runtime capture pt2: vst3 loads AT ImageBase 0x180000000; 0x540658 = field [ctx+0x540658] not RVA; beacon->ctx script (racy)

handoff/NOTES_LEVEL.md

@@ -349,3 +349,31 @@ getFunctionContaining(0x52ac64) and has the complete per-band loop + FFT-conv).
 ##    опять +1.4 dB).
 ## => мультибанд: сумма displacements -> sat-кривая. Каждая полоса отдельно калибруется single-
 ##    band рендерами; комбинация закрывается runtime или sat-подгонкой на b1on12_b2on12.
+
+
+## ============ 2026-08-18h2: RUNTIME CAPTURE PARTIAL (base 0x180000000, 0x540658 = FIELD NOT RVA) ============
+
+### Runtime capture infra (rtcapture2.py, WORKS):
+- Launch: `reaper -nosplash -renderproject X.rpp`; host pid found by scanning /proc/*/maps for 'soothe2'
+  (lowest map addr with soothe2 in path = PE base). **vst3 loads AT ImageBase 0x180000000** (no reloc).
+- Reading /proc/pid/mem (+0x180000000) works DURING render; process dies right after render finishes.
+- Section table (Authoritative): .text rva 0x1000 raw 0x600 vsize 0x1a52000; IPPCODE 0x1a53000/0x1a51e00;
+  .rdata 0x1baa000/0x1ba8400 vsize 0xa60000; .data 0x260a000/0x2608200 vsize 0x72000; .pdata 0x267c000.
+- FILE->RVA mapping: raw off F maps to rva = F - raw_sec + va_sec (e.g. .text: F=0x53F658<->rva=0x541058).
+
+### CRITICAL: 0x540658 (and 0x540678/0x5407c8/0x5408b0/etc) are FIELD OFFSETS, NOT RVAs!
+- Disasm at rva 0x52b771: `mov rax,[rdi+0x540658]` -> window read is [ctx+0x540658] (ctx = DSP object).
+- Static soothe_mem.bin is RVA-linear; reading at 0x540658 gives .text CODE bytes (garbage floats).
+- So the "window" (FIR*=WINDOW in FFT-conv step 5) lives in the HEAP DSP object at offset 0x540658,
+  NOT in module image. Runtime must locate `ctx` = base of DSP object.
+- Beacon idea: phase_table_1024 (twiddle doubles 0x182615608 in .data) is the FFT-plan table;
+  scan host heap for u64==0x182615608, then the pointer owner is plan (+0x18/+0x20/+0x68 fields)
+  -> ctx = byte_addr_of_(pointer_field) - field_offset; window at ctx+0x540658.
+  (rtdeep2.py implements this; currently racy - host may exit before numpy import + first scan.)
+
+### Notes for next session:
+- Render lifetime is short (~2-19s); to win the race: import numpy BEFORE Popen, scan /proc instantly,
+  and re-run if host missed. Could also pre-load module into gdb for direct ctx inspection.
+- Alternative: find ctx via 'consumers_out' alloc chain (note :119-135) if heap layout known.
+- Verified render outputs: out_dual300.wav etc; run_sweep works; pkill -9 -x reaper hangs shell -
+  use `pkill -9 -f "reap[e]r"` style to avoid killing own bash.