Module watch 

The FindFirstChangeNotificationW entry.

Entry 3 of the audited catalogue. It watches a directory for a class of changes and produces a handle that becomes signalled when one occurs.

The handle it produces is not an ordinary handle

A change-notification handle is closed with FindCloseChangeNotification, not CloseHandle. Passing it to CloseHandle is a resource leak that nothing reports: the call may even appear to succeed. That is why this entry returns ChangeNotification rather than a bare OwnedHandle – the type is what remembers which routine closes it, so a caller cannot forget.

What it does and does not tell you

The handle signals that something in the watched set changed. It carries no record of what, and a burst of changes may signal once. A consumer needing the individual changes wants ReadDirectoryChangesW, which is a different call and therefore a different entry. This one is the cheap “something happened, go look” primitive, and the crate does not blur them.

Structs

ChangeNotification

An owned change-notification handle.

NotifyFilter

Which changes a watch reports.

WatchDirectory

An owned, marshalable parameter set for FindFirstChangeNotificationW.