windows3-2  Exercise 2: Programs That Promised More Than They Hold
=================================================================

Verification: Level 1 (read-only or short-lived allocation; run on the author's machine, no administrator rights).

Prediction (work this out before running the script):

  The browser (many processes) and the Edge WebView helper processes should show large gaps.
  A database server such as mysqld should show a very small resident share. Memory Compression
  should not appear at all, because it has almost no commit to be resident out of.

ex2.ps1 (run it with:  powershell -ExecutionPolicy Bypass -File ex2.ps1):

  # ex2.ps1: which programs have promised far more than they hold in RAM?
  $counters = '\Process(*)\Working Set - Private', '\Process(*)\Private Bytes'
  $rows = foreach ($s in (Get-Counter $counters).CounterSamples) {
      if ($s.InstanceName -in '_total', 'idle') { continue }
      [pscustomobject]@{ App = ($s.InstanceName -replace '#\d+$', ''); Counter = ($s.Path -split '\\')[-1]; Value = $s.CookedValue }
  }
  $apps = $rows | Group-Object App | ForEach-Object {
      $g = $_.Group
      $pws = ($g | Where-Object Counter -eq 'working set - private' | Measure-Object Value -Sum).Sum
      $com = ($g | Where-Object Counter -eq 'private bytes' | Measure-Object Value -Sum).Sum
      [pscustomobject]@{ App = $_.Name; Procs = @($g | Where-Object Counter -eq 'private bytes').Count; PrivateWS = $pws; Commit = $com; Gap = $com - $pws }
  }
  'Programs with the biggest gap between commit and private working set:'
  $apps | Sort-Object Gap -Descending | Select-Object -First 5 | ForEach-Object {
      '  {0,-18} {1,3} procs  commit {2,6:N0} MB  private WS {3,6:N0} MB  gap {4,6:N0} MB  ({5:N0} % resident)' -f $_.App, $_.Procs,
          ($_.Commit / 1MB), ($_.PrivateWS / 1MB), ($_.Gap / 1MB), (100 * $_.PrivateWS / $_.Commit) }

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  Programs with the biggest gap between commit and private working set:
    firefox             26 procs  commit  3,165 MB  private WS  1,923 MB  gap  1,242 MB  (61 % resident)
    msedgewebview2      20 procs  commit  1,310 MB  private WS    282 MB  gap  1,028 MB  (22 % resident)
    code                12 procs  commit  1,413 MB  private WS    669 MB  gap    744 MB  (47 % resident)
    mysqld               2 procs  commit    615 MB  private WS      2 MB  gap    613 MB  (0 % resident)
    claude               1 procs  commit    684 MB  private WS    271 MB  gap    413 MB  (40 % resident)

WHY THIS WORKS AS AN ANSWER
---------------------------
  Firefox has a 1,242 MB gap (61 % resident) and the WebView helpers 1,028 MB (22 % resident). mysqld
  has promised 615 MB but has about 2 MB in RAM: 0 % resident. A Task Manager sorted by Memory would
  list mysqld near the bottom, even though it is the program that has committed the most relative to
  what it is using. That is not a fault: a database often reserves memory for caches it fills later.
  The measurements here cannot show whether any of these gaps is a problem; chapter 3 shows how to
  watch a figure over time before calling something a leak.
  Common mistakes: ranking by working set rather than private working set (shared pages inflate
  many-process programs); forgetting to strip the "#1", "#2" suffixes so that each process is
  treated as its own program; and assuming a big gap means a leak.