Lot 16: what the watcher keeps

[geeooff]

Lot 16, What the watcher keeps: where the handles and memory the installed watcher gained over its first sessions came from, and what was done about them. Measured step by step, then on the whole installed process on the maintainer's machine through a Battlefield 6 session, a five-hour GTA Online session and the menu.

What changed for the person running it

• GPU counters through PerfLib instead of PDH. Naming a game by what the graphics card draws left some 3.7 MB and 19 handles for the rest of the watcher's run: PdhCloseQuery frees the query, not what PDH loaded to resolve the counter path. GPU Engine is a V2 counter set, and Microsoft documents the PerfLib consumer functions for reading those with minimal overhead. The reader finds the set and the counter by their English names, checks the counter's registered type (PERF_100NSEC_TIMER) before applying its documented formula, and walks the documented sample layout in plain code, every size bounded, tested on hand-built blocks. It now leaves 0.24 MB and 18 handles; checked against typeperf, then in the field: bf6.exe (75% of the rendering), as PDH said on 2026-09-16.
• The menu's entries open through a helper that ends. ShellExecute leaves the shell's machinery in its caller: 147 handles for Edit configuration, 84 more for Open log. The watcher now starts its own executable with a hidden open command, which does what Microsoft documents for a caller that exits right after (STA COM, ShellExecuteExW with SEE_MASK_NOASYNC) and ends. Verified from the menu: all three entries open in front, three handles kept for the three.
• How it works gains a section on what the watcher costs, with the measured figures.

Left as they are, by decision: the menu's own first opening (some 50 handles and 1 MB, Windows' cost for a process's first menu, the same with or without the dark-mode call, paid once) and Check for updates (111 handles and 1 MB, a click made once a release).

Sessions, reloads and configuration faults were measured to leave nothing.

For the reviewer

• src/detect/gpu.rs: rewritten on PerfLib; the three calls that size their answer are bounded to four attempts, since the refinement runs on the engine's thread.
• src/open.rs, cli.rs (open, hidden), tray.rs: the helper and its callers.
• presence-probe: menu-cost <open|check|spawn|menu|menu-dark> and gpu-load, the instruments behind the figures.
• Cargo.toml: Win32_System_Com for the helper; the registry feature's comment corrected (it still described the change notification Lot 15 measured never arrives).
• AGENTS.md: the cost principle says to measure what a call leaves, not only what it takes; the menu pitfall points at the helper.

One commit (1c8c3ec) went in with cargo fmt --check failing; ecb6ff1 fixes it rather than rewriting history.

scripts\build.ps1 test green locally, 207 tests.

🤖 Generated with Claude Code