Release v0.4.0: WHEA Logger, Crash Dump & BSOD Analyzer, Scan State Persistence & TUI Improvements

[SecretLUL]

Summary of v0.4.0 Release

This release introduces the WHEA Hardware Error Logger (\whea_logger) and Crash Dump & BSOD Analyzer (\crash_analysis) diagnostic modules alongside scan state persistence, scheduled tasks dynamic resolution, terminal UX enhancements, and triage controls.

🩺 1. WHEA Hardware Error Logger (\whea_logger)

• Queries \Microsoft-Windows-WHEA-Logger\ provider events via \wevtutil.exe.
• CPU Machine Check & Cache Hierarchy (Events 19 & 18): Triangulates \ApicId\ / Core, \MCABank, \MciStat, \MciAddr\ to isolate Curve Optimizer / undervolt instability, silicon degradation, and RAM memory controller errors.
• PCIe Root Port & Bus Errors (Event 17): Triangulates \Bus:Device:Function\ and Device IDs to identify PCIe link dropouts and riser issues.
• Memory Integrity (Event 47): Detects physical memory parity/ECC errors and XMP/EXPO timing faults.
• Storage Platform Faults (Event 1): Traps StorPort / NVMe communication faults.
• Fixes: Disables PCIe ASPM power management dropouts via \powercfg.exe\ and schedules Windows Memory Diagnostic (\mdsched.exe).

💥 2. Crash Dump & BSOD Analyzer (\crash_analysis)

Fully automated parsing of kernel minidumps — no external tools (WinDbg, BlueScreenView) required:

• Direct dump parsing: Reads \C:\Windows\Minidump*.dmp\ and parses the \PAGEDU64\ / \PAGEDUMP\ kernel dump headers in pure Rust to extract the bugcheck stop code, its four parameters and embedded driver module names (ASCII + UTF-16LE scan, matched against known trouble drivers such as \nvlddmkm.sys, \amdkmdag.sys, \igdkmd64.sys).
• Event correlation: Cross-checks with BugCheck Event 1001 (stop code from the System log, English/German/XML text formats) and Kernel-Power Event 41 (unexpected shutdowns without a bugcheck — PSU, thermals, hard freezes).
• Findings: \crash_driver_fault\ (faulting driver named in triage with rollback/clean-reinstall plan, Critical from 2 crashes), \crash_video_tdr\ (0x116/0x117 GPU TDR), \crash_memory_bugcheck\ (0x1A/0x50/0x2E/0x77/0xC2/0x19 memory-class stop codes), \crash_bugcheck_history\ (recurring codes without driver attribution), \crash_unexpected_shutdown\ and \crash_stale_dumps\ (cleanup of accumulated dumps).
• Fixes: Opens Device Manager for driver rollback, schedules Windows Memory Diagnostic (\mdsched.exe) for memory-class stop codes and deletes analysed dumps via PowerShell.
• Test safety: Scans read dumps through an injectable directory, so tests never touch the real \C:\Windows\Minidump.

💾 3. Scan State Persistence & Reconciler

• Diagnosed scan state is saved to %APPDATA%\WinMedic\last_scan.json.
• Reconciles saved states on app startup with newly added engine modules.
• Tracks pending reboots across system restarts.

🛠️ 4. UI & Engine Improvements

• Added [A]\ shortcut in Triage view to toggle select/deselect all visible issues.
• Added page scrolling ([PgUp], [PgDn], [Home], [End]) in Triage list.
• Widened default terminal size to 165 columns with automatic window sizing.
• Added ACL takeown / icacls fallback for protected scheduled tasks.

🔁 5. Repaired Findings No Longer Reappear

Three scans re-raised findings that a repair had already handled, or that no repair could ever clear. All three are fixed at the scan side, where the defect was:

• Scheduled Tasks ignored a task's State. Disabling is the only thing the repair does, and Windows neither resets LastTaskResult nor restores a deleted program — so every task WinMedic switched off came straight back on the next scan. Disabled tasks are now skipped in both checks. The disable additionally reads the state back, so a TrustedInstaller-owned task that accepts the command without applying it (for example the UpdateOrchestrator brokers) is reported as a failed repair rather than a successful one.
• System Cleaner raised a finding on any non-zero byte. Every directory it sweeps is one the system refills by itself — a service's next log line, Explorer's 129-byte Recycle Bin desktop.ini shell stub, the next favicon a browser caches — so findings reappeared seconds after a successful repair. Cleanup targets now need 10 MB (50 MB for browser caches) before they are worth reporting, and the Recycle Bin shell stub is neither counted nor deleted.
• Network & DNS ran nslookup <name> 8.8.8.8, pinning a public resolver and bypassing the machine's own. Any network blocking outbound port 53 produced a permanent CRITICAL finding that ipconfig /flushdns cannot possibly fix. The check now queries the configured resolver for two independent names, parses the answer record rather than substring-matching a header that is present on failure too, and re-queries after the repair so an unfixed resolver fails honestly with the reason.

🌐 6. Brave & Opera Cache Sweeping

The README claimed the cache cleaner covered Brave and Opera; the discovery only ever walked Chrome, Edge and Firefox, so both browsers' caches were never touched.

• Brave is Chromium on the same User Data\<profile>\<cache> layout as Chrome and Edge — all three now share one discovery helper instead of two copies of the same loop.
• Opera has no User Data root: each installed flavour (Opera Stable, Opera GX Stable, Opera One, …) gets its own directory under Opera Software, and that directory is the profile. Flavours are enumerated rather than named, so one Opera ships next needs no code change. Both the LocalAppData and the Roaming root are checked, since the caches moved between releases.
• Only Default and Profile N directories are collected, so Chromium's shared state next to them (Local State, the user's dictionary, safe-browsing lists) is never swept.
• The progress line, issue title and fix steps now name the browsers actually covered.

Verification

• \cargo test --lib: 362 passed; 0 failed (15 new regression tests for the three recurrence bugs, 20 new tests for the crash dump analyzer)
• \cargo test --test integration_tests: All integration test suites passed (incl. 2 new crash_analysis tests; module-count assertions updated to 11 modules)
• \cargo clippy --all-targets: 0 warnings
• \cargo fmt --check: Clean formatting