windows3-3  Exercise 1: How Long Must You Watch?
=================================================================

Verification: Level 1 (run on the author's machine, no administrator rights; the programs it starts are stopped at the end).

Prediction (work this out before running the script):

  With 5 samples (a 12-second window) only the growth phase of the cache program is visible, so the
  detector should call it steady growth. With 20 samples (about a minute) the plateau appears
  and the verdict should change to PLATEAU.

Commands (sim.ps1 and leakwatch.ps1 saved in the same folder):

  .\leakwatch.ps1 -SimPath .\sim.ps1 -Modes cache -Samples 5
  .\leakwatch.ps1 -SimPath .\sim.ps1 -Modes cache

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  5 samples:
  private MB over time (every other sample):  cache
    t=  0s         74
    t=  6s        124
    t= 12s        172
  cache    memory   74 ->  172 MB ( 493.7 MB/min, last third  481.2): STEADY GROWTH (leak-like)
  cache    handles  656 ->   644   (   -72 /min, last third      0): FLAT

  20 samples (the cache line from the full four-program run in the chapter):
  cache    memory   74 ->  171 MB (  61.1 MB/min, last third   -0.2): PLATEAU (cache-like)
  cache    handles  656 ->   607   (   -55 /min, last third     -9): FLAT

WHY THIS WORKS AS AN ANSWER
---------------------------
  The same program is a leak in the 12-second window (172 MB, 494 MB/min, last third still steep)
  and a plateau in the 60-second window (171 MB, last third -0.2 MB/min). The program did not
  change; only the observation did. The two sentences: a window shorter than the time a cache takes to fill
  shows only growth and looks like a leak, so you must watch long enough for a cache to level off
  (for a real suspect Microsoft says hours), and you should judge the last part of the window, not the whole.
  Common mistakes: judging from the first minute after a program starts; reading the overall MB/min
  without looking at the last third; and forgetting how short five samples are (3 seconds apart, so they
  span 12 seconds, after the 4 seconds the script waits for the program to start).