Lot 16: what the watcher keeps

AGENTS.md

@@ -37,8 +37,12 @@ These decide most questions before they are asked.
   must stay the cheapest thing it does; during a game the watcher waits on
   a handle and does nothing. A change to either is measured on the whole
   installed process against the last release -- processor over minutes,
-  private memory, handles -- with `presence-probe cost` and `footprint`
-  for the steps, and the figures go in the record and the changelog.
+  private memory, handles -- with `presence-probe cost`, `footprint` and
+  `menu-cost` for the steps, and the figures go in the record and the
+  changelog. A system library can keep what it loaded for the life of its
+  caller, whatever its close function says: PDH and the shell did
+  (`docs/design/16-footprint.md`). Measure what a call leaves, not only
+  what it takes.
 - **Strict and simple over clever.** An unambiguous state ("it is off, fix the
   file") beats a fallback whose behaviour needs explaining. Put the strict
   option first and argue for a fallback only if it protects something
@@ -220,7 +224,9 @@ commands; do not.
   Task Scheduler exports them, and carry placeholders the release check
   verifies. Read and write them with that encoding.
 - `TrackPopupMenuEx` is modal and re-enters the window procedure; never hold a
-  `RefCell` borrow across it, or across `ShellExecuteW`.
+  `RefCell` borrow across it, or across any call that can show UI. The
+  shell is no longer called from the watcher at all: the menu's entries go
+  through the `open` helper, `src/open.rs`, and a new one should too.
 - `FindWindow` cannot find a window whose class was registered by another
   process; use `EnumWindows`.
 - A process started after `WM_QUERYENDSESSION` dies with

CHANGELOG.md

@@ -15,7 +15,15 @@ a section is written.
 
 ## [Unreleased]
 
-Nothing yet.
+### Changed
+
+- Telling a game from its launcher by what the graphics card is drawing no
+  longer adds some 3.5 MB to the watcher's memory for the rest of its run:
+  the counters are read the lighter way Windows offers for them.
+- *Edit configuration*, *Open log* and *Documentation* no longer leave some
+  1.2 MB in the watcher for the rest of its run, and more for each kind of
+  file: a short-lived helper opens them and takes that cost with it when it
+  ends.
 
 ## [0.3.0] - 2026-09-23
 

Cargo.toml

@@ -41,14 +41,18 @@ windows = { version = "0.62", features = [
     # MsiEnumRelatedProducts: whether the installer owns the executables, which
     # decides how `purge` removes them.
     "Win32_System_ApplicationInstallationAndServicing",
+    # CoInitializeEx: the apartment Microsoft asks for before ShellExecuteEx,
+    # in the helper that opens what the menu offers.
+    "Win32_System_Com",
     # The updater: WinHTTP for the release, CNG for the SHA-256 of what it
     # fetched. Microsoft's libraries, no HTTP or hashing crate.
     "Win32_Networking_WinHttp",
     "Win32_Security_Cryptography",
     # FindFirstChangeNotificationW: the configuration folder, watched for the
     # live reload.
     "Win32_Storage_FileSystem",
-    # RegNotifyChangeKeyValue: Windows' game list, watched rather than polled.
+    # RegQueryInfoKeyW: the last-write time of Windows' game list, asked at
+    # each idle look, since its change notification never arrives (Lot 15).
     "Win32_System_Registry",
     # WNDCLASSEXW names HBRUSH, HICON and HCURSOR, so the window class needs Gdi
     # even though this program never draws anything.
@@ -64,6 +68,8 @@ windows = { version = "0.62", features = [
     # K32EnumProcesses: the process ids alone, which the idle look takes
     # every poll instead of a Toolhelp snapshot, about 130 times cheaper.
     "Win32_System_ProcessStatus",
+    # The PerfLib consumer functions: the GPU Engine counters the refinement
+    # reads, without what PDH keeps for the process's life (Lot 16).
     "Win32_System_Performance",
     "Win32_System_SystemInformation",
     "Win32_System_Threading",

docs/design/06-notification-icon.md

@@ -11,7 +11,7 @@ exits cleanly, and the icon survives killing and restarting Explorer. Closed
 
 - [x] `Shell_NotifyIcon` with `NOTIFYICON_VERSION_4`, on the Lot 5 window
 - [x] Context menu: edit configuration · open log · documentation · quit
-- [x] All three opened through `ShellExecuteW`, with a Notepad fallback when nothing claims `.toml`
+- [x] All three opened through `ShellExecuteW`, with a Notepad fallback when nothing claims `.toml` — in a helper process that ends since 2026-09-23, for what the shell leaves in its caller ([Lot 16](16-footprint.md))
 - [x] The documentation entry opens the build's own commit on GitHub
 - [x] Re-added on `TaskbarCreated`, so an Explorer restart does not lose it
 - [x] Follows the taskbar theme, and re-reads it when the menu is about to open

docs/design/15-marked-games.md

@@ -499,7 +499,8 @@ leak. Naming a game (every process asked its path and package) leaves
 after: a cost paid once, at the first session, not a leak. It accounts
 for about twenty handles in the probe; the watcher gains some 260 over its
 first sessions, and the rest is not yet traced. Both are proposed as a
-separate piece of work — the lot's own cost is nil.
+separate piece of work, [Lot 16](16-footprint.md) — the lot's own cost is
+nil.
 
 ## What it changed in the program — built 2026-09-23