Harden detection coverage, provenance hot path, and operator safety

[grloper]

Acts on a security & efficiency review of the sensor.

Detection coverage

• Expand the sensitive-syscall set to modern post-exploitation and evasion primitives: memfd_create, process_vm_read/writev, bpf, seccomp, userfaultfd, setns/unshare/mount, io_uring_setup/enter, sendto/sendmsg/sendmmsg, pidfd_getfd, init_module/finit_module, kexec_load, prctl, chroot, accept4. These only ever escalate a call already coming from injected code (or an opt-in --audit-sensitive breadcrumb), so legitimate programs stay silent.
• Track recvmmsg as a first-stage input channel.

Robustness / correctness

• maps: drop degenerate (start >= end) regions and keep the map sorted, then answer region_at with an O(log n) binary search instead of a linear scan — it runs for rip, rsp, and memory-op targets on every syscall.
• tracer: replace panicking HashMap indexing in the wait loop with fallible lookups so a phantom stop can never crash the sensor.
• engine: free a process's cached memory map and detector chain state when its last thread exits, bounding memory on long traces of forking targets.

Terminal / output safety

• Neutralise ANSI escape sequences in attacker-influenced display fields (process comm names, mapped-file labels) before they reach the TTY, in both the log line and the dashboard.
• Surface JSON-sink write failures instead of dropping them: warn once on the stream, banner in the TUI. A dropped detection is the worst outcome.
• The --json file sink now appends rather than truncates, preserving prior evidence across re-runs.

CLI / portability

• Add --version, a --max-targets cap for scan, a /proc preflight check, and a warning when --trust-region spans an implausibly large area.
• Fail the build with a clear message on non-x86-64 targets.
• syscalls::name returns Cow<'static, str>, avoiding a heap allocation per known syscall on the hot path; remove dead is_payload_capable.

Testing

Adds 12 unit tests. All existing unit and ptrace-driven integration tests pass; verified end-to-end against the real binaries (benign, benign-threads, shellcode-sim) for both false-positive and true-positive behavior, plus the new --version, --json append, --max-targets, and --trust-region warning paths.

🤖 Generated with Claude Code

https://claude.ai/code/session_016ATUW6fbK4Spc3fJKL6se1

---

Generated by Claude Code