23h: kernel-consumer hunt — no direct readers of FIR data outside 529fe0 (init-only xrefs); bp on loop end silent in render => duplicated chain instantiation suspected; active RIP sampler fnsample.py working (2.4k in-module samples, MSVC stackfill dominates steady state; core leads 52e1c0/534580 on param phase); yabridge stale socket dirs break respawn — documented

scripts/fnall.py

@@ -52,27 +52,17 @@ def pt(req, pid, addr=0, data=0):
 
 
 def find_host():
-    # fastest signal: any non-reaper child of a reaper process
-    reapers = []
-    for p in glob.glob('/proc/[0-9]*'):
-        try:
-            cmd = open(f'/proc/{p}/cmdline', 'rb').read()
-            if b'reaper' in cmd and b'yabridge' not in cmd:
-                reapers.append(int(os.path.basename(p)))
-        except Exception:
-            continue
+    # proven maps-based finder (same as rendersnap.py)
     for p in glob.glob('/proc/[0-9]*'):
         pid = int(os.path.basename(p))
         try:
-            st = open(f'/proc/{pid}/stat').read().split()
-            ppid = int(st[3])
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
         except Exception:
             continue
-        if ppid in reapers and pid not in reapers:
+        if 'soothe2' in maps and 'reaper' not in cmd:
             return pid
     return None
-
-
 def drain_waits():
     out = []
     while True:
@@ -95,6 +85,18 @@ def main():
     t0 = time.time()
     while time.time() - t0 < 30 and not host:
         host = find_host()
+        if host is None and time.time() - t0 > 2:
+            # fallback: maps-based
+            for p in glob.glob('/proc/[0-9]*'):
+                pid = int(os.path.basename(p))
+                try:
+                    cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+                    maps = open(f'/proc/{pid}/maps').read()
+                except Exception:
+                    continue
+                if 'soothe2' in maps and 'reaper' not in cmd:
+                    host = pid
+                    break
         time.sleep(0.002)
     if not host:
         print('NO HOST')
@@ -111,8 +113,8 @@ def main():
     pt(PTRACE_INTERRUPT, host)
 
     # phase 2: pump events, seize newcomers until set stabilizes
-    stable_until = time.time() + 2.5
-    deadline = time.time() + 8.0
+    stable_until = time.time() + float(os.environ.get('FN_STAB','0.05'))
+    deadline = time.time() + 3.0
     while time.time() < deadline:
         for pid, st in drain_waits():
             pass  # they stay stopped; we hold them

scripts/fnsample.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+"""fnsample.py — active RIP sampling of all threads via PTRACE_INTERRUPT
+during the offline-render burst. Finds which code ACTUALLY executes."""
+import ctypes
+import glob
+import os
+import signal
+import struct
+import subprocess
+import sys
+import time
+
+MOD_LO, MOD_HI = 0x180001000, 0x181baa000
+DUR = float(os.environ.get('SAMP_DUR', '2.5'))
+
+PTRACE_CONT = 7
+PTRACE_GETREGS = 12
+PTRACE_INTERRUPT = 0x4207
+PTRACE_SEIZE = 0x4206
+PTRACE_O_TRACECLONE = 2
+
+libc = ctypes.CDLL('libc.so.6', use_errno=True)
+
+
+class UserRegs(ctypes.Structure):
+    _fields_ = [(n, ctypes.c_ulonglong) for n in (
+        'r15', 'r14', 'r13', 'r12', 'rbp', 'rbx', 'r11', 'r10',
+        'r9', 'r8', 'rax', 'rcx', 'rdx', 'rsi', 'rdi', 'orig_rax',
+        'rip', 'cs', 'eflags', 'rsp', 'ss', 'fs_base', 'gs_base',
+        'ds', 'es', 'fs', 'gs')]
+
+
+def pt(req, pid, addr=0, data=0):
+    libc.ptrace.restype = ctypes.c_long
+    r = libc.ptrace(req, pid, ctypes.c_void_p(addr), ctypes.c_void_p(data))
+    return None if r == -1 else r
+
+
+def find_host():
+    for p in glob.glob('/proc/[0-9]*'):
+        pid = int(os.path.basename(p))
+        try:
+            cmd = open(f'/proc/{pid}/cmdline', 'rb').read().replace(b'\0', b' ').decode('utf8', 'replace')
+            maps = open(f'/proc/{pid}/maps').read()
+        except Exception:
+            continue
+        if 'soothe2' in maps and 'reaper' not in cmd:
+            return pid
+    return None
+
+
+def main():
+    subprocess.run("pkill -9 -x reaper; pkill -9 -f '[y]abridge'; sleep 1", shell=True)
+    proc = subprocess.Popen(['/usr/bin/reaper', '-nosplash', '-ignoreerrors',
+                             '-renderproject', '/home/m/soothe-bt/dual_b1q_0.5.rpp'],
+                            stdout=open('/dev/null', 'w'), stderr=subprocess.STDOUT)
+    host = None
+    t0 = time.time()
+    while time.time() - t0 < 30 and not host:
+        host = find_host()
+        time.sleep(0.002)
+    if not host:
+        print('NO HOST')
+        return 1
+    print('host %d at %.3fs' % (host, time.time() - t0), flush=True)
+
+    seized = {host}
+    pt(PTRACE_SEIZE, host, 0, PTRACE_O_TRACECLONE)
+    pt(PTRACE_CONT, host, 0, 0)
+
+    ips = {}
+    t_end = time.time() + DUR
+    t_start = None
+    nsamp = 0
+    while time.time() < t_end:
+        # resweep tids occasionally
+        for tid_s in glob.glob(f'/proc/{host}/task/*'):
+            tid = int(os.path.basename(tid_s))
+            if tid not in seized:
+                if pt(PTRACE_SEIZE, tid, 0, PTRACE_O_TRACECLONE) is not None:
+                    seized.add(tid)
+        for tid in list(seized):
+            if pt(PTRACE_INTERRUPT, tid) is None:
+                continue
+            got = False
+            for _ in range(20):
+                try:
+                    pid, status = os.waitpid(tid, os.WUNTRACED | os.WNOHANG)
+                except ChildProcessError:
+                    break
+                if pid == tid:
+                    got = True
+                    break
+                time.sleep(0.0002)
+            if got:
+                regs = UserRegs()
+                if pt(PTRACE_GETREGS, tid, 0, ctypes.addressof(regs)) is not None:
+                    nsamp += 1
+                    if t_start is None:
+                        t_start = time.time()
+                    if MOD_LO <= regs.rip < MOD_HI:
+                        b = regs.rip >> 4 << 4
+                        ips[b] = ips.get(b, 0) + 1
+            pt(PTRACE_CONT, tid, 0, 0)
+    print('samples=%d in-module=%d unique64=%d window=%.2fs..%.2fs'
+          % (nsamp, sum(ips.values()), len(ips),
+             (t_start or t0) - t0, time.time() - t0))
+    core = {a: c for a, c in ips.items() if 0x180520000 <= a < 0x180560000}
+    for a, c in sorted(core.items(), key=lambda x: -x[1])[:18]:
+        print('CORE %#x %d' % (a, c))
+    for b, c in sorted(ips.items(), key=lambda x: -x[1])[:6]:
+        print('%#x %d' % (b, c))
+    proc.kill()
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())