windows3-4  Exercise 2: Find What Your Patterns Missed
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before running: look at the 'Everything else' category and guess which familiar programs are in it.
  Then predict which category will grow when you add a missing pattern.

Commands (workload.ps1 saved in the current folder). Run it as it is, read the last line, then change the
Cloud sync pattern to  '^(onedrive|onedrive\.sync\.service|dropbox|googledrivefs|box)$'  and run it again:

  .\workload.ps1

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  First run (original patterns):
  Windows itself          120 procs   1,986 MB    28%
  Browsers                 28 procs   1,590 MB    22%
  Everything else         100 procs   1,327 MB    19%
  Cloud sync                1 procs     856 MB    12%
  Editors and dev tools    24 procs     809 MB    11%
  Security                  6 procs     346 MB     5%
  Embedded browsers        20 procs     189 MB     3%
  TOTAL                   299 procs   7,104 MB
  Largest in "Everything else": claude 304 MB, lingma 217 MB, slack 176 MB, onedrive.sync.service 111 MB, secure system 101 MB

  Second run (onedrive.sync.service added to Cloud sync):
  Windows itself          120 procs   1,988 MB    28%
  Browsers                 28 procs   1,595 MB    22%
  Everything else         100 procs   1,225 MB    17%
  Cloud sync                2 procs     967 MB    14%
  Editors and dev tools    24 procs     811 MB    11%
  Security                  6 procs     344 MB     5%
  Embedded browsers        20 procs     189 MB     3%
  TOTAL                   300 procs   7,119 MB
  Largest in "Everything else": claude 300 MB, lingma 207 MB, slack 176 MB, securityservice 104 MB, secure system 101 MB

WHY THIS WORKS AS AN ANSWER
---------------------------
  The first run's last line shows onedrive.sync.service (111 MB) sitting in 'Everything else', a program
  that belongs with the sync client. After the pattern change the Cloud sync category is larger by about
  that amount (856 MB, 12%, to 967 MB, 14%) and the Everything else category is smaller by about the same.
  The other megabyte figures differ between the two runs by tens of megabytes because the machine was running
  in between: the browsers and the embedded browsers each moved. That is why the exercise asks which
  category changed, not for exact megabytes, and why comparing runs only makes sense for the category you
  edited.
  Common mistakes: judging a pattern by the main process name only; ignoring the catch-all list; and treating
  a change of 5 or 10 MB between runs in a category you did not edit as meaningful.