Until seeing the user-created files and such still hanging around. So it was time to bring the OS back from the recovery partition (staying with Windows for the moment), at least to see how that would fare. In the future, other OSs like Linux could come in via one of the only two USB ports provided (no ethernet or DVD burner included) but I stayed with what was on board as an experiment.
Lenovo's recovery app behaved as advertised. BUT as will be the case often, it won't go back to Windows 10 if it wasn't already there. This "box" began life at Windows 8. So it replaces that system, which wants about 225 updates in two or three hunks to get up to speed. Now, in about two days, the computer discovered that it could be Windows 8.1, so that was another 137 updates that it needed. Then another 10 security updates after that. Then another nine optionals out of ten (I elected not to put Skype onto this computer).
Then there were the little things. Put an adhesive cover over the camera lens. Grab a few utilities I favor (like SpyBot Anti-Beacon, Spyware Blaster and Mrs. Clinton's IT company's favorite, BleachBit (available for Linux, Windows and on command line for OSX). Uninstall lots of start menu crud. Go over it with screen cleaner. Oh, and if you do something similar like this, give things about a week to settle in. Some security updates won't go in until others do, so let's not assume Redmond got everything in the right order.