The fingerprinting core
Win32 classes serve serials, UUIDs, MACs, battery ids. Individually benign; combined they're a machine identity. That's why support-bundle specs at ProofTune forbid exactly them: not because they're dangerous in your hands, but because they age-rot a shared case file into a tracking asset.
Aggregator vs reader behavior divergence
- Reading for you: inventory locally for a health check is fine for your own audit script (PowerShell can fetch everything); the risk starts when the data leaves.
- Packaging for vendors: aggregates where possible — CPU class, logical core count, RAM capacity. Support doesn't need your disk serial to explain PoE throttle, and an exporter that can't include it (see the allowlist design) can't be talked into it later.
Exclusion list worth borrowing
user names · machine name · hardware serials · license keys · tokens · profile paths · command lines. If your tool must include one of these, the schema should demand a version increment and a doc review, every time.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.