Add BkTempusBucket struct and extend BkStatsResponse with TempusEnabled,
TempusQpcFrequency, TempusSubsystemCount, and a 14-element Tempus bucket array.
Add IpcUserHookFlagDeferredLaunchGateRelease, RuntimeFlagNtApiHooksDisarmed, and the
LaunchIntegrity* constants (Default/Untrusted/Low/Medium/High/System) matching the
new ABI definitions.
Remove the MarkInterfaceReady P/Invoke binding. Add IntegrityLevel as the new
penultimate parameter to the SetUserHookTarget binding.
The API graph view was republishing the entire snapshot on every timer tick
when rows already existed, even if no new hook data had arrived. Because the
view model resets the backing observable collection during publish, that caused
constant UI churn, repeated allocations, and self-noise that obscured the real
call stream.
At the same time, memory action details were not surfacing the captured hook
origin chain well enough to answer where an allocation originated from. The UI
only considered a small fixed set of symbol tokens and had no fallback to raw
IPs or any visible validation around the return address.
Tighten the analysis surface in two ways:
- only republish the API graph when the snapshot is marked dirty
- expose the shared IPC stack-frame constant to the analysis formatter
- build hook frame lists from all available symbol slots and fall back to raw
stack IPs when symbols are not yet resolved
- derive origin-module text from either OriginPath or originSymbol
- append hook frame summaries directly into memory action details
- surface return-address resolved/in-stack checks so the operator can judge
whether the caller origin is backed by the captured stack
This cuts the constant redraw pressure and makes memory.alloc style events far
more actionable when tracing module origin and caller flow.
dutchpsycho