@@ -46,17 +46,17 @@ root; adjust the path for a Debug build.
 | 20 | Three strikes stop it | set `"boot_strikes": 3` in `gao.json`, log off and on, `--status`; then `--boot on` | yes | last boot line `not applied: disabled after 3 crashes ...`; after `--boot on`, `strikes: 0 of 3` | Pass (2026-09-26). With `boot_strikes: 3`, log off/on: `last boot: ... not applied: disabled after 3 crashes; run `gao --boot on` to retry`; `--boot on` then showed `strikes: 0 of 3`. Note: the card still carried the profile from the previous logon, because logging off does not reset the driver; in the real case (three crashes) each crash reboots the machine, which does. |
 | 21 | A driver change blocks it | set `"driver": "000.00"` in `gao.json`, run `--apply`; restore the value | yes | `not applied: driver changed (000.00 -> ...)` | Pass (2026-09-26). With `"driver": "000.00"`: `--apply` printed `not applied: driver changed (000.00 -> 610.74); run `gao --optimize` again`, exit 1. Value restored afterwards. |
 | 22 | Boot-apply off | `--boot off`, then `schtasks /Query /TN GpuAutoOptimizer` | yes | `boot-apply off: task removed`; schtasks reports the task does not exist | Pass (2026-09-26). `--boot off`: `boot-apply off: task removed`; `schtasks /Query /TN GpuAutoOptimizer`: `ERROR: The system cannot find the file specified.`; `--status`: `boot-apply: off`. |
-| 23 | Memory search stops at the bandwidth peak | `--optimize best` (elevated) | yes | log shows `mem +N: bandwidth X GB/s` per step and `mem: bandwidth peak +N`; the peak is where bandwidth stops rising, not the top of the range | |
-| 24 | Edges are confirmed | same run as 23 | yes | `confirm core +N` and `confirm ... mem +N` lines with 30 s probes; `RESULT:` reports the confirmed values the margin was applied to | |
-| 25 | Boot-apply runs the installed copy | `--boot on`, `schtasks /Query /TN \GpuAutoOptimizer\BootApply /XML`, log off and on, `--status` | yes | exe in `%ProgramFiles%\GpuAutoOptimizer\`; XML shows `DisallowStartIfOnBatteries false`, `ExecutionTimeLimit PT5M`, `IgnoreNew`, the Program Files path; `last boot: ... applied`; `boot copy: up to date` | |
-| 26 | State folder is admin-only | `icacls "%ProgramData%\GpuAutoOptimizer"`; `--status` unelevated; a user-created folder is refused | no / yes | SYSTEM and Administrators full, Users read & execute, no inherited entries; `--status` works; a folder created by the user before the first elevated run makes `--optimize` refuse | |
+| 23 | Memory search stops at the bandwidth peak | `--optimize best` (elevated) | yes | log shows `mem +N: bandwidth X GB/s` per step and `mem: bandwidth peak +N`; the peak is where bandwidth stops rising, not the top of the range | Pass (2026-09-27, driver 610.74): one `bandwidth` line per 50 MHz step. On this card bandwidth kept rising to the top of the range (454.3 GB/s at +0, 513.0 at +1500), so there was no peak inside it. The 1 % tie band picked +1400 (509.3 GB/s), the lowest offset within 1 % of the best. The earlier guess that +1050 was already past the peak was wrong. |
+| 24 | Edges are confirmed | same run as 23 | yes | `confirm core +N` and `confirm ... mem +N` lines with 30 s probes; `RESULT:` reports the confirmed values the margin was applied to | Pass (2026-09-27): `confirm core +195 / mem +0` STABLE, `confirm core +135 / mem +1400` STABLE. `RESULT: power 105 %, core +135 MHz (confirmed +195), mem +950 MHz (confirmed +1400)`. Soak STABLE, score 5764 -> 6008 it/s (+4.2 %). |
+| 25 | Boot-apply runs the installed copy | `--boot on`, `schtasks /Query /TN \GpuAutoOptimizer\BootApply /XML`, log off and on, `--status` | yes | exe in `%ProgramFiles%\GpuAutoOptimizer\`; XML shows `DisallowStartIfOnBatteries false`, `ExecutionTimeLimit PT0S`, `Priority 5`, `--tray`, `IgnoreNew`, the Program Files path; `last boot: ... applied`; `boot copy: up to date` | Failed (2026-09-27): `could not create the task (schtasks exit 1)`. The old task `\GpuAutoOptimizer` is a file in the task root, and it blocks creating the `\GpuAutoOptimizer\` folder. Fixed: `--boot on` now removes the old task first. Both executables were copied to Program Files correctly. Re-run pending. |
+| 26 | State folder is admin-only | `icacls "%ProgramData%\GpuAutoOptimizer"`; `--status` unelevated; a user-created folder is refused | no / yes | SYSTEM and Administrators full, Users read & execute, no inherited entries; `--status` works; a folder created by the user before the first elevated run makes `--optimize` refuse | Pass (2026-09-27): a folder the user created (owner `Gebruiker`) is refused (`not owned by Administrators or SYSTEM`); a junction is refused (`is a link or not a folder`) and its target's ACL is unchanged. The folder gao created: SYSTEM and Administrators `(OI)(CI)(F)`, Users `(OI)(CI)(RX)`, no inherited entries. |
 | 27 | No DLL planting | copy `C:\Windows\System32\version.dll` next to the exe as `d3d11.dll`, `dxgi.dll`, `d3dcompiler_47.dll`, `msvcp140.dll`, `vcruntime140.dll` and `vcruntime140_1.dll`; run `--stress 5`, `--bandwidth`, `--status`; delete the copies | no | all three work normally (a loaded fake would break the import) | Pass (2026-09-27, driver 610.74). `--stress 5` `STABLE` (5768 it/s), `--bandwidth` 491.8 GB/s, `--status` normal. `dumpbin /dependents`: static imports only `KERNEL32`, `ADVAPI32`, `SHELL32`, `ole32` (KnownDLLs; the CRT is linked statically); `d3d11`, `dxgi`, `D3DCOMPILER_47` delay-loaded after `SetDefaultDllDirectories`. |
 | 28 | Old journal is not imported | first elevated run after the move | yes | the new journal starts empty; nothing under `%LOCALAPPDATA%` is read by the elevated process | Dropped as a migration on 2026-09-27: reading a user-writable file from the elevated process could be redirected to disclose other files (P4b review). The old journal on the reference machine had no open entries (136 lines, 0 freezes), so no ceiling was lost. |
 | 29 | The window renders and idles | start `GpuAutoOptimizer.exe` unelevated | no | GPU name, driver, telemetry, saved/applied tune and presets shown; under 1 % of one CPU core while idle | Pass (2026-09-27): all shown (screenshot); 0.05 CPU-seconds over 5 s idle (~1 %); 0.02 after the P5 fix pass. |
 | 30 | Optimize from the window | Restart as administrator, pick Best, Optimize | yes | run screen with live temperature/power and the probe log; results screen with before/after | |
 | 31 | Abort from the window | Abort during the core search | yes | the run ends with `aborted`, card at stock | |
 | 32 | Tray app at logon | apply at logon on, log off and on | yes (task) | tray icon present, tune applied, `boot.log` `applied`, strike cleared after 2 min | |
-| 33 | Watchdog re-applies after a TDR | tray running, `dxcap -forcetdr`, wait 45 s, `gao --status` | yes | `applied:` equals the saved tune again; `boot.log` has `watchdog: ... re-applied`; a balloon said so | |
+| 33 | Watchdog re-applies after a TDR | tray running, `dxcap -forcetdr`, wait 45 s, `gao --status` | yes | `applied:` equals the saved tune again; `boot.log` has `watchdog: ... re-applied`; a balloon said so | Failed (2026-09-27): the tray crashed on the forced TDR. It hit an access violation inside `nvml.dll`, called from the 1 s telemetry tick (crash dump in the state folder), so nothing re-applied the tune. Fixed: the tray's periodic hardware work is now guarded. After a reset (UI device removed, a failed read-back, or a fault) NVML and NVAPI are re-created 5 s later. A build with an injected access violation recovered and kept running. Re-run pending. |
 | 34 | Watchdog backs off from another tool | tray running, set an offset in MSI Afterburner and Apply | no | a balloon says another program changed the settings; the watchdog does not fight it | |
 | 35 | One instance | start the app twice | no | the second start brings the first window forward and exits | Pass (2026-09-27, after the P5 fix pass): the second start exits with code 0, the first keeps running. |
 | 36 | CLI and tray side by side | tray running with the tune kept applied; `gao --reset`, wait 45 s, `gao --status`; then `gao --optimize` from a shell while the window runs an optimize | yes | after `--reset` the card stays at stock (the tray notes it and does not re-apply); after `gao --apply` the tray keeps the tune applied again; the second optimize refuses with `another optimize is already running` | |
 
@@ -232,11 +232,17 @@ bool enable_boot(std::string* message) {
     const std::string xml = boot_task_xml(std::string(u8.begin(), u8.end()), "--tray", sid, "PT0S");
     const auto xml_path = app_dir() / L"BootApply.xml";
     if (!write_utf16_file(xml_path, xml)) return say("could not write " + xml_path.string(), false);
+    // The pre-P4b task is a file named \GpuAutoOptimizer in the task root, which
+    // blocks creating the \GpuAutoOptimizer\ folder: it has to go first.
+    const bool had_legacy = boot_task_legacy_exists();
+    if (had_legacy && boot_task_remove_legacy() != 0) return say("could not remove the old logon task \\GpuAutoOptimizer", false);
     const int code = boot_task_create_xml(xml_path);
     std::error_code ec;
     std::filesystem::remove(xml_path, ec);
-    if (code != 0) return say("could not create the task (schtasks exit " + std::to_string(code) + ")", false);
-    boot_task_remove_legacy();   // only once the new task exists
+    if (code != 0)
+        return say("could not create the task (schtasks exit " + std::to_string(code) + ")" +
+                       (had_legacy ? "; the old logon task was already removed, so nothing applies the tune at logon" : ""),
+                   false);
     Config cfg = load_config();
     cfg.boot_strikes = 0;
     if (!save_config(cfg)) return say("task created, but could not reset the strike counter", false);
 
@@ -66,9 +66,12 @@ struct App {
     ComPtr<ID3D11RenderTargetView> rtv;
     bool device_lost = false;   // retried every second until a new device exists
 
-    gao::Nvml nvml;
-    gao::Nvapi nvapi;
+    // Pointers: re-created after a driver reset (see hw_lost()).
+    std::unique_ptr<gao::Nvml> nvml;
+    std::unique_ptr<gao::Nvapi> nvapi;
     bool nvml_ok = false, nvapi_ok = false;
+    bool hw_lost = false;            // re-create them at hw_retry_at
+    ULONGLONG hw_retry_at = 0;
     gao::GpuControl gpu;
 
     gao::gui::UiState ui;
@@ -246,8 +249,8 @@ void refresh_status(bool with_task) {
     g.ui.profile = cfg.profile;
     g.ui.strikes = cfg.boot_strikes;
     if (g.nvml_ok) {
-        g.ui.driver = g.nvml.DriverVersion();
-        const std::string gpu_id = g.nvml.GpuUuid(kGpu);
+        g.ui.driver = g.nvml->DriverVersion();
+        const std::string gpu_id = g.nvml->GpuUuid(kGpu);
         g.ui.profile_driver_ok = cfg.profile && !g.ui.driver.empty() && g.ui.driver == cfg.profile->driver;
         g.ui.profile_gpu_ok = cfg.profile && !gpu_id.empty() && gpu_id == cfg.profile->gpu;
     }
@@ -295,12 +298,13 @@ bool refuse_while_tuning() {
 
 void act_apply() {
     if (refuse_while_tuning()) return;
+    if (!g.nvml_ok || !g.nvapi_ok) { g.ui.message = "The NVIDIA driver is not available right now."; return; }
     std::string why;
     if (!gao::app::prepare_state(&why)) { g.ui.message = why; return; }
     gao::Config cfg = gao::app::load_config();
     cfg.boot_strikes = 0;   // strikes only gate the logon apply
-    const std::string driver = g.nvml_ok ? g.nvml.DriverVersion() : std::string();
-    const auto d = gao::decide_boot(cfg, driver, g.nvml_ok ? g.nvml.GpuUuid(kGpu) : std::string());
+    const std::string driver = g.nvml_ok ? g.nvml->DriverVersion() : std::string();
+    const auto d = gao::decide_boot(cfg, driver, g.nvml_ok ? g.nvml->GpuUuid(kGpu) : std::string());
     if (d != gao::BootDecision::Apply) { g.ui.message = "Not applied: " + gao::app::decision_text(d, cfg, driver); return; }
     if (!gao::apply_profile(g.gpu, *cfg.profile, &why)) { g.ui.message = "Not applied: " + why; return; }
     g.watch = true;
@@ -311,6 +315,7 @@ void act_apply() {
 
 void act_revert() {
     if (refuse_while_tuning()) return;
+    if (!g.nvml_ok || !g.nvapi_ok) { g.ui.message = "The NVIDIA driver is not available right now."; return; }
     const bool ok = g.gpu.reset_to_stock && g.gpu.reset_to_stock();
     g.watch = false;   // stock by choice: the watchdog must not undo it
     g.ui.message = ok ? "Back at stock. The saved tune is not re-applied until you apply it again."
@@ -346,12 +351,72 @@ void render() {
     if (hr == DXGI_ERROR_DEVICE_REMOVED || hr == DXGI_ERROR_DEVICE_RESET) recover_device();
 }
 
+// ---------------------------------------------------------------- hardware
+
+// A driver reset (TDR) can leave NVML and NVAPI state in this long-running
+// process stale, and a call during the reset has faulted inside nvml.dll
+// (hardware check 33). The tray exists to survive exactly that: its periodic
+// hardware work runs guarded, and after a reset the libraries are re-created.
+
+void init_hw() {
+    g.nvml = std::make_unique<gao::Nvml>();
+    g.nvapi = std::make_unique<gao::Nvapi>();
+    g.nvml_ok = g.nvml->Init();
+    g.nvapi_ok = g.nvapi->Init();
+    g.gpu = g.nvml_ok && g.nvapi_ok ? gao::make_gpu_control(*g.nvml, *g.nvapi, kGpu) : gao::GpuControl{};
+}
+
+// Structured exceptions, not C++ ones: an access violation inside a driver DLL.
+// A function with __try may not hold destructible objects, hence the function
+// pointer. Objects in the frames it skips are not destroyed (/EHsc); that leak
+// is the price of keeping the watchdog alive.
+bool guarded(void (*fn)(void*), void* ctx) {
+    __try {
+        fn(ctx);
+        return true;
+    } __except (GetExceptionCode() == EXCEPTION_ACCESS_VIOLATION ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH) {
+        return false;
+    }
+}
+template <class F> bool guarded(F f) {
+    return guarded([](void* p) { (*static_cast<F*>(p))(); }, &f);
+}
+
+// Stop using the libraries and re-create them a few seconds from now, when
+// the driver is back. The watchdog then finds the tune gone and re-applies it.
+void hw_lost() {
+    g.gpu = {};
+    g.nvml_ok = g.nvapi_ok = false;
+    g.hw_lost = true;
+    g.hw_retry_at = GetTickCount64() + 5000;
+    // Shutting down a library that just faulted may fault again; then leave it.
+    gao::Nvml* nvml = g.nvml.release();
+    gao::Nvapi* nvapi = g.nvapi.release();
+    guarded([nvml] { delete nvml; });
+    guarded([nvapi] { delete nvapi; });
+}
+
+void retry_hw() {
+    if (!g.hw_lost || GetTickCount64() < g.hw_retry_at) return;
+    if (!guarded([] { init_hw(); }) || !g.nvml_ok || !g.nvapi_ok) {
+        hw_lost();   // not back yet
+        return;
+    }
+    g.hw_lost = false;
+    refresh_status(false);
+}
+
 // ---------------------------------------------------------------- timers
 
 void on_telemetry() {
-    if (g.device_lost) recover_device();
+    // A removed UI device is the first sign of a driver reset; the window is
+    // often hidden, so no Present() would report it.
+    const bool reset = g.device && g.device->GetDeviceRemovedReason() != S_OK;
+    if (g.device_lost || reset) recover_device();
+    if (reset && !g.hw_lost) hw_lost();
+    retry_hw();
     if (g.nvml_ok) {
-        g.ui.telemetry = g.nvml.Read(kGpu);
+        g.ui.telemetry = g.nvml->Read(kGpu);
         gao::gui::push_history(g.ui.temp_history, static_cast<float>(std::max(g.ui.telemetry.temp_c, 0)));
         gao::gui::push_history(g.ui.power_history, static_cast<float>(std::max(g.ui.telemetry.power_w, 0)));
     }
@@ -381,8 +446,13 @@ void on_watchdog() {
     if (!g.ui.elevated || !g.nvml_ok || !g.nvapi_ok) return;
     const gao::Config cfg = gao::app::load_config();
     if (!cfg.profile) return;
-    const std::string driver = g.nvml.DriverVersion(), gpu_id = g.nvml.GpuUuid(kGpu);
-    const auto action = g.watchdog.check(*cfg.profile, g.gpu.read_applied(), !driver.empty() && driver == cfg.profile->driver,
+    const auto applied = g.gpu.read_applied();
+    if (!applied) {   // NVAPI handles go stale after a driver reset: re-create
+        hw_lost();
+        return;
+    }
+    const std::string driver = g.nvml->DriverVersion(), gpu_id = g.nvml->GpuUuid(kGpu);
+    const auto action = g.watchdog.check(*cfg.profile, applied, !driver.empty() && driver == cfg.profile->driver,
                                          !gpu_id.empty() && gpu_id == cfg.profile->gpu, std::chrono::steady_clock::now());
     switch (action) {
         case gao::WatchAction::None: return;
@@ -473,8 +543,8 @@ LRESULT CALLBACK wnd_proc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp) {
             }
             return 0;
         case WM_TIMER:
-            if (wp == kTimerTelemetry) on_telemetry();
-            else if (wp == kTimerWatchdog) on_watchdog();
+            if (wp == kTimerTelemetry) { if (!guarded([] { on_telemetry(); })) hw_lost(); }
+            else if (wp == kTimerWatchdog) { if (!guarded([] { on_watchdog(); })) hw_lost(); }
             else if (wp == kTimerStrike) { clear_strike(); refresh_status(false); }
             return 0;
         case WM_APP_WAKE:
@@ -588,9 +658,7 @@ int WINAPI wWinMain(HINSTANCE inst, HINSTANCE, PWSTR cmdline, int) {
     ImGui_ImplDX11_Init(g.device.Get(), g.ctx.Get());
 
     g.worker = std::make_unique<gao::gui::OptimizeWorker>([] { PostMessageW(g.hwnd, WM_APP_WAKE, 0, 0); });
-    g.nvml_ok = g.nvml.Init();
-    g.nvapi_ok = g.nvapi.Init();
-    if (g.nvml_ok && g.nvapi_ok) g.gpu = gao::make_gpu_control(g.nvml, g.nvapi, kGpu);
+    init_hw();
     g.ui.gpu_name = gao::nvidia_adapter_name();
 
     tray_icon(NIM_ADD);