move demo/ to docs/tutorial/, commit assets, consolidate TUI docs

- demo/ renamed to docs/tutorial/ (tapes, scripts, TUTORIAL.md)
- docs/tutorial/assets/ added to git (51 MB of GIFs + PNGs); removed
  /demo/assets/ from .gitignore so images render on Codeberg
- docs/tui-reference.md removed; its hotkey tables merged into a new
  "Hotkey Quick Reference" section at the end of TUTORIAL.md
- TUTORIAL.md: updated install section (mage buildDocker, no
  GOTOOLCHAIN=auto), fixed README relative path (../../README.md),
  updated internal tapes/scripts/assets path prose
- README.md: updated all demo/ image paths and links to docs/tutorial/;
  TUI and recording-modes links now point to TUTORIAL.md anchors
- AGENTS.md: updated demo/ references to docs/tutorial/
- Magefile.go: updated demoDir/demoTapesDir/demoScriptsDir/demoRunTape/
  demoSudoKeepers constants to docs/tutorial/ paths

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

18 files changed, 0 insertions, 773 deletions

diff --git a/demo/TUTORIAL.md b/demo/TUTORIAL.md
deleted file mode 100644
index 5940d05..0000000
--- a/demo/TUTORIAL.md
+++ /dev/null
@@ -1,200 +0,0 @@
-# I/O Riot NG: a guided tour
-
-This tutorial walks through every major surface of `ior` — the dashboard tabs, the live stream, recording, headless modes, and the in-TUI flamegraph — using short animated GIFs so you can *see* what the keys actually do.
-
-Every GIF in this document is regenerated from a [VHS](https://github.com/charmbracelet/vhs) tape under [`demo/tapes/`](./tapes). To rebuild them all, run `sudo -v && mage demo` (see [Regenerating the demo](#regenerating-the-demo)).
-
-## Contents
-
-1. [Installing ior](#installing-ior)
-2. [First launch: the PID picker](#first-launch-the-pid-picker)
-3. [Touring the dashboard tabs](#touring-the-dashboard-tabs)
-   - [1 · Flamegraph (default landing tab)](#1--flamegraph-default-landing-tab)
-   - [2 · Overview](#2--overview)
-   - [3 · Syscalls](#3--syscalls)
-   - [4 · Files](#4--files)
-   - [5 · Processes](#5--processes)
-   - [6 · Latency + Gaps](#6--latency--gaps)
-   - [7 · Stream](#7--stream)
-4. [Mastering the Stream tab](#mastering-the-stream-tab)
-   - [Pause + stacked filters](#pause--stacked-filters)
-   - [Regex search](#regex-search)
-   - [CSV export](#csv-export)
-5. [Choosing what to trace](#choosing-what-to-trace)
-6. [Recording for offline analysis](#recording-for-offline-analysis)
-   - [TUI Parquet recording](#tui-parquet-recording)
-   - [Headless modes](#headless-modes)
-7. [Regenerating the demo](#regenerating-the-demo)
-
-## Installing ior
-
-See the [main README](../README.md) for full install steps. In short:
-
-```shell
-git clone https://codeberg.org/snonux/ior ~/git/ior
-git clone https://github.com/aquasecurity/libbpfgo ~/git/libbpfgo
-sudo dnf install -y golang clang bpftool elfutils-libelf-devel zlib-static glibc-static libzstd-static
-git -C ~/git/libbpfgo checkout v0.9.2-libbpf-1.5.1
-git -C ~/git/libbpfgo submodule update --init --recursive
-make -C ~/git/libbpfgo libbpfgo-static
-cd ~/git/ior
-env GOTOOLCHAIN=auto mage all
-```
-
-ior needs `CAP_BPF`, so every invocation below uses `sudo`.
-
-The build dance only has to happen once: the resulting `ior` binary is fully statically linked (libbpf, libelf, libzstd, zlib are baked in) **and** the embedded BPF object uses CO-RE, so libbpf relocates field offsets against the target kernel's BTF at load time. Build it on one box, then `scp ior` to any other Linux host with a BTF-enabled kernel and run it there. See the [Compile once, run everywhere](../README.md#compile-once-run-everywhere) section in the main README for details.
-
-## First launch: the PID picker
-
-`sudo ./ior` starts with the **PID picker**. The cursor is on **All PIDs**, so pressing `Enter` traces the whole system. Type into the filter box to narrow the list by PID, comm, or cmdline; arrow keys move the selection.
-
-![Cold start: PID picker, then the dashboard appears](./assets/01-launch.gif)
-
-The same picker can be re-opened later from the dashboard with `p`.
-
-![PID picker default state](./assets/screenshot-pidpicker.png)
-
-## Touring the dashboard tabs
-
-The dashboard has seven tabs, addressable by number key. The default landing tab is **Flamegraph**. `tab` / `shift+tab` step forward / back.
-
-| Key | Tab               | What it shows                                                            |
-|-----|-------------------|--------------------------------------------------------------------------|
-| `1` | Flamegraph (`Flm`)| Live FlameGraph of the configured stack (`comm`/`path`/`tracepoint`)     |
-| `2` | Overview (`Ovr`)  | Sparkline + top syscalls + top paths summary                             |
-| `3` | Syscalls (`Sys`)  | Sortable per-syscall counters, latency, byte volume                      |
-| `4` | Files (`Fil`)     | Per-path counters; `d` toggles directory grouping                        |
-| `5` | Processes (`Pro`) | Per-process / per-comm counters                                          |
-| `6` | Latency (`Lat`)   | Latency + inter-syscall gap histograms                                   |
-| `7` | Stream (`Str`)    | Live tail of individual traced events                                    |
-
-### 1 · Flamegraph (default landing tab)
-
-The first thing you see after dismissing the PID picker is the **live flamegraph**. Bars grow as new events come in. `o` cycles the stack ordering (e.g. `comm/path/tracepoint` ↔ `comm/tracepoint/path`); `b` toggles the size metric (event count vs. duration vs. gap).
-
-![Live flamegraph rebuilding from real workload](./assets/13-tui-flamegraph.gif)
-
-### 2 · Overview
-
-Press `2`. The Overview tab is the at-a-glance view: a sparkline of recent event volume, the top syscalls, and the top paths.
-
-![Overview tab populating](./assets/02-overview-tab.gif)
-
-### 3 · Syscalls
-
-Press `3`. A sortable table of every traced syscall (count, average latency, total bytes). `j` / `k` (or arrow keys) scroll the rows; `←` / `→` move the selected column; `s` sorts by the selected column using its default direction; `S` reverses.
-
-![Syscalls table with sort + reverse-sort](./assets/03-syscalls-tab.gif)
-
-### 4 · Files
-
-Press `4`. Per-path counters. The most useful key here is `d`, which toggles **directory grouping** — paths roll up into their parent directory, which is essential when one process touches thousands of files in `/usr/share/...`.
-
-![Files tab toggling directory grouping](./assets/04-files-tab.gif)
-
-### 5 · Processes
-
-Press `5`. Per-process / per-comm view. `S` reverse-sorts; combine with `←` / `→` to pick a column.
-
-![Processes tab](./assets/05-processes-tab.gif)
-
-### 6 · Latency + Gaps
-
-Press `6`. Two histograms: syscall **latency** (how long the syscall ran) and the inter-syscall **gap** (idle time on the same thread between syscalls). The big-write workload running in the background spreads the latency distribution noticeably.
-
-![Latency + gap histograms](./assets/06-latency-gaps-tab.gif)
-
-### 7 · Stream
-
-Press `7`. A live tail of every traced event row — comm, PID, TID, syscall, file, FD, return value, bytes, latency, gap. This is the workhorse view; the next section explores it in depth.
-
-![Stream tab live-tailing rows](./assets/07-stream-live.gif)
-
-## Mastering the Stream tab
-
-Stream has two modes: **Live** (rows scroll past) and **Pause** (`space` toggles). Almost everything interesting happens in pause mode.
-
-### Pause + stacked filters
-
-In pause mode, navigate with `j`/`k` (rows) and `←` / `→` (columns). Pressing `Enter` on the selected cell **pushes a new filter onto a stack** and immediately re-filters the ring buffer. Filters are stackable, so you can drill down — first by `Comm`, then by `Syscall`, then by `File`. `Esc` pops the most recent filter (LIFO); keep hitting `Esc` to undo all the way back.
-
-![Pause, push two filters, undo with Esc](./assets/08-stream-pause-filter.gif)
-
-The filter is reflected in the bottom status line, and matches the same syntax you'd type by hand: `comm~bash`, `syscall~openat`, `latency>=100000`, etc.
-
-### Regex search
-
-`/` opens a forward regex prompt; `?` opens a backward one. `n` jumps to the next match in the same direction; `N` reverses. The search runs against every column on every row in the ring buffer and wraps at the end.
-
-![Regex search with /, n, n, then ?](./assets/09-stream-regex-search.gif)
-
-### CSV export
-
-Three keys, three flavours:
-
-- `e` — quick export of the **current TUI-filter snapshot** to `ior-stream-<timestamp>.csv` in the current working directory. Works from any tab, not just Stream.
-- `x` — quick export of the **paused stream view** specifically (preserves your filter stack).
-- `X` — same as `x`, but prompts for a filename first.
-- `E` — open the most recent stream-exported CSV in your `$EDITOR` (`hx` / `vi` fallback).
-
-![Press 'e', then ls the resulting CSV](./assets/10-stream-csv-export.gif)
-
-If you don't want CSV export at all, start ior with `-tuiExport=false`; the help footer hides the export keys and `e` becomes a no-op.
-
-## Choosing what to trace
-
-Three modal pickers reshape what the rest of the TUI sees:
-
-- `p` — **PID picker** (re-opens the launch picker).
-- `t` — **TID picker** for thread-level focus.
-- `o` — **Probes** dialog: enable / disable individual syscall tracepoints.
-
-![PID, TID, and probe pickers](./assets/11-pid-tid-probe.gif)
-
-Restricting to a single PID is also exposed as a CLI flag (`-pid <n>`), as is comm/path filtering (`-comm`, `-path`). Tracepoint subsetting on the command line uses `-tps <regex>` / `-tpsExclude <regex>`.
-
-## Recording for offline analysis
-
-ior has three persistence flows; each solves a different problem.
-
-| Flow                   | How                                          | What you get                                            |
-|------------------------|----------------------------------------------|---------------------------------------------------------|
-| TUI Parquet recording  | `R` from the dashboard                       | streaming Parquet of every row that passes your filter  |
-| Headless `.ior.zst`    | `sudo ./ior -flamegraph -name <name>`        | one aggregated native trace artifact (bandwidth-cheap)  |
-| Headless Parquet       | `sudo ./ior -parquet trace.parquet`          | streaming Parquet, full firehose, no TUI                |
-| Plain CSV              | `sudo ./ior -plain`                          | one CSV row per event on stdout                         |
-
-### TUI Parquet recording
-
-Press `R` in the dashboard, accept the default filename (`ior-recording-<timestamp>.parquet`) with `Enter`, and rows start streaming to disk. The footer shows the active recording path (or the last error). Press `R` again to stop.
-
-![Start, run, and stop a parquet recording](./assets/12-parquet-recording.gif)
-
-The recorder follows your *current* TUI global filter — narrow with `p`/`t`/`o` first if you want a focused capture.
-
-### Headless modes
-
-For unattended captures or scripting, skip the TUI entirely. The demo runs all three back-to-back, capped with `-duration` so each terminates on its own.
-
-![Three headless flows in one tape](./assets/14-headless-modes.gif)
-
-`-flamegraph` writes one aggregated `.ior.zst` artifact at shutdown — ideal for `ior`'s native flamegraph and integration workflows. `-parquet` streams every row, so the file grows continuously. `-plain` is the lightest weight: CSV to stdout you can pipe into anything.
-
-## Regenerating the demo
-
-The whole asset pipeline is reproducible:
-
-```shell
-mage installDemoTools          # one-time: VHS via go install + ttyd via dnf
-sudo -v                        # warm the sudo timestamp once
-mage demo                      # regen all 14 GIFs + screenshots (~10 min)
-```
-
-Or rebuild a single tape after editing it:
-
-```shell
-TAPE=07-stream-live mage demoOne
-```
-
-Tapes live in [`demo/tapes/`](./tapes), the background workload that drives them is [`demo/scripts/workload.sh`](./scripts/workload.sh), and the resulting assets land in [`demo/assets/`](./assets). VHS records headlessly under `ttyd` + Chromium — no real terminal window opens, so `mage demo` is safe to run in the background while you keep working.
diff --git a/demo/scripts/run-tape.sh b/demo/scripts/run-tape.sh
deleted file mode 100755
index c22e2e3..0000000
--- a/demo/scripts/run-tape.sh
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-# One-tape wrapper: starts the background workload, runs vhs <tape>, kills the
-# workload. Tapes themselves don't need to know about the workload — they just
-# launch ior and drive the TUI.
-#
-# vhs is invoked with cwd set to the repo root, so all paths inside tapes
-# (Output, Screenshot, the ./ior binary) are repo-relative.
-#
-# Usage: run-tape.sh <path-to-tape>
-
-set -euo pipefail
-
-if [ $# -ne 1 ]; then
-    echo "usage: $0 <tape-file>" >&2
-    exit 2
-fi
-
-TAPE="$(realpath "$1")"
-ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
-WORKLOAD="${ROOT}/demo/scripts/workload.sh"
-
-if [ ! -f "$TAPE" ]; then
-    echo "tape not found: $TAPE" >&2
-    exit 2
-fi
-
-# Pre-flight: vhs and ttyd must be on PATH; sudo timestamp must be live.
-command -v vhs >/dev/null || { echo "vhs not on PATH (run: mage installDemoTools)" >&2; exit 3; }
-command -v ttyd >/dev/null || { echo "ttyd not on PATH (run: mage installDemoTools)" >&2; exit 3; }
-sudo -n true 2>/dev/null || { echo "sudo timestamp expired (run: sudo -v)" >&2; exit 4; }
-
-# Start workload in its own session/process group so we can kill the whole tree.
-setsid "$WORKLOAD" </dev/null >/dev/null 2>&1 &
-WL_PID=$!
-
-cleanup() {
-    if kill -0 "$WL_PID" 2>/dev/null; then
-        # The workload runs `setsid` so its PID == its PGID.
-        kill -TERM -- "-$WL_PID" 2>/dev/null || true
-        sleep 0.5
-        kill -KILL -- "-$WL_PID" 2>/dev/null || true
-    fi
-    # Best-effort: stop any straggling ior processes from this tape.
-    sudo -n pkill -TERM -f '/ior$' 2>/dev/null || true
-}
-trap cleanup EXIT INT TERM
-
-# Give the workload a moment to spool up before recording.
-sleep 2
-
-cd "$ROOT"
-vhs "$TAPE"
diff --git a/demo/scripts/sudo-keepalive.sh b/demo/scripts/sudo-keepalive.sh
deleted file mode 100755
index 4ae1e27..0000000
--- a/demo/scripts/sudo-keepalive.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-# Refreshes the sudo timestamp every minute so a long demo regen never trips a
-# password prompt. Intended to be backgrounded by `mage demo` and killed at the
-# end of the run.
-
-set -u
-
-trap 'exit 0' TERM INT
-
-while true; do
-    sudo -n true 2>/dev/null || exit 1
-    sleep 60
-done
diff --git a/demo/scripts/workload.sh b/demo/scripts/workload.sh
deleted file mode 100755
index ebbf58b..0000000
--- a/demo/scripts/workload.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-# Background workload for demo tapes. Generates a steady mix of file I/O
-# (open/read/close), big writes (fsync/dd), stat-heavy traffic, and ioworkload
-# scenarios so every TUI tab has something interesting to display.
-#
-# Designed to be killed via `kill $!` from the tape wrapper. All children are
-# placed in this script's process group so a single signal cleans them up.
-
-set -u
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-IOWORKLOAD="${ROOT}/../ioworkload"
-SCRATCH="$(mktemp -d -t ior-demo-workload-XXXXXX)"
-trap 'rm -rf "$SCRATCH"' EXIT
-
-cleanup() {
-    trap - TERM INT
-    # Kill the entire process group so all background loops stop.
-    kill -- -$$ 2>/dev/null || true
-    exit 0
-}
-trap cleanup TERM INT
-
-# A) walk /usr and read first byte of each file: tons of openat/read/close + varied paths.
-(
-    while true; do
-        find /usr/share /usr/lib -maxdepth 4 -type f 2>/dev/null \
-            | shuf -n 800 \
-            | xargs -r -I{} sh -c 'head -c 1 "{}" >/dev/null 2>&1' || true
-        sleep 1
-    done
-) &
-
-# B) periodic large write with fsync via dd: fills the latency tab with slow writes.
-(
-    while true; do
-        dd if=/dev/zero of="${SCRATCH}/big.bin" bs=1M count=20 conv=fsync status=none 2>/dev/null || true
-        sleep 3
-        rm -f "${SCRATCH}/big.bin"
-    done
-) &
-
-# C) stat-heavy directory crawl: feeds the syscall tab with newfstatat/getdents.
-(
-    while true; do
-        find /etc /var/log -maxdepth 3 >/dev/null 2>&1 || true
-        sleep 2
-    done
-) &
-
-# D) ioworkload scenario rotation if the binary exists: gives us syscall variety
-# beyond what the shell utilities trigger (mmap, dup, fcntl, sync, rename, link).
-if [ -x "$IOWORKLOAD" ]; then
-    (
-        scenarios=(
-            open-basic
-            readwrite-basic
-            stat-basic
-            stat-statx
-            mmap-basic
-            sync-basic
-            dup-basic
-            fcntl-dupfd
-            rename-basic
-            link-basic
-            dir-basic
-        )
-        while true; do
-            for s in "${scenarios[@]}"; do
-                "$IOWORKLOAD" --scenario="$s" >/dev/null 2>&1 || true
-            done
-        done
-    ) &
-fi
-
-# Idle until killed.
-wait
diff --git a/demo/tapes/01-launch.tape b/demo/tapes/01-launch.tape
deleted file mode 100644
index 1e2b558..0000000
--- a/demo/tapes/01-launch.tape
+++ /dev/null
@@ -1,23 +0,0 @@
-# 01-launch: cold start of ior. Shows the PID picker, then the default landing tab
-# (Flamegraph) once Enter selects "All PIDs".
-Output demo/assets/01-launch.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 4500ms
-Screenshot demo/assets/screenshot-pidpicker.png
-Sleep 1500ms
-Enter
-Sleep 5s
-Screenshot demo/assets/screenshot-dashboard.png
-Sleep 2s
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/02-overview-tab.tape b/demo/tapes/02-overview-tab.tape
deleted file mode 100644
index a16a0b8..0000000
--- a/demo/tapes/02-overview-tab.tape
+++ /dev/null
@@ -1,23 +0,0 @@
-# 02-overview-tab: dashboard Overview tab — sparkline, top syscalls, top paths fill in.
-# Key 2 switches to Overview (key 1 is Flamegraph, the default landing tab).
-Output demo/assets/02-overview-tab.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "2"
-Sleep 6s
-Screenshot demo/assets/screenshot-overview.png
-Sleep 1s
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/03-syscalls-tab.tape b/demo/tapes/03-syscalls-tab.tape
deleted file mode 100644
index 376f632..0000000
--- a/demo/tapes/03-syscalls-tab.tape
+++ /dev/null
@@ -1,36 +0,0 @@
-# 03-syscalls-tab: sortable syscalls table, j/k to scroll, s/S to sort/reverse-sort.
-# Key 3 switches to Syscalls.
-Output demo/assets/03-syscalls-tab.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "3"
-Sleep 3s
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 800ms
-Type "k"
-Sleep 600ms
-Right
-Sleep 600ms
-Type "s"
-Sleep 1500ms
-Type "S"
-Sleep 2s
-Screenshot demo/assets/screenshot-syscalls.png
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/04-files-tab.tape b/demo/tapes/04-files-tab.tape
deleted file mode 100644
index 49adfee..0000000
--- a/demo/tapes/04-files-tab.tape
+++ /dev/null
@@ -1,32 +0,0 @@
-# 04-files-tab: files tab plus directory-grouped view toggle (`d`).
-# Key 4 switches to Files.
-Output demo/assets/04-files-tab.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "4"
-Sleep 3s
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 800ms
-Type "d"
-Sleep 3s
-Screenshot demo/assets/screenshot-files-grouped.png
-Type "d"
-Sleep 2s
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/05-processes-tab.tape b/demo/tapes/05-processes-tab.tape
deleted file mode 100644
index ad5f64e..0000000
--- a/demo/tapes/05-processes-tab.tape
+++ /dev/null
@@ -1,30 +0,0 @@
-# 05-processes-tab: processes tab, scroll, and reverse-sort.
-# Key 5 switches to Processes.
-Output demo/assets/05-processes-tab.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "5"
-Sleep 3s
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 400ms
-Type "j"
-Sleep 800ms
-Type "S"
-Sleep 2s
-Screenshot demo/assets/screenshot-processes.png
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/06-latency-gaps-tab.tape b/demo/tapes/06-latency-gaps-tab.tape
deleted file mode 100644
index b19ae58..0000000
--- a/demo/tapes/06-latency-gaps-tab.tape
+++ /dev/null
@@ -1,22 +0,0 @@
-# 06-latency-gaps-tab: latency + inter-syscall gap histograms (driven by dd writes).
-# Key 6 switches to Latency.
-Output demo/assets/06-latency-gaps-tab.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "6"
-Sleep 8s
-Screenshot demo/assets/screenshot-latency.png
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/07-stream-live.tape b/demo/tapes/07-stream-live.tape
deleted file mode 100644
index 9d7ad4f..0000000
--- a/demo/tapes/07-stream-live.tape
+++ /dev/null
@@ -1,22 +0,0 @@
-# 07-stream-live: stream tab live-tailing rows.
-# Key 7 switches to Stream.
-Output demo/assets/07-stream-live.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "7"
-Sleep 6s
-Screenshot demo/assets/screenshot-stream-live.png
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/08-stream-pause-filter.tape b/demo/tapes/08-stream-pause-filter.tape
deleted file mode 100644
index 416830c..0000000
--- a/demo/tapes/08-stream-pause-filter.tape
+++ /dev/null
@@ -1,46 +0,0 @@
-# 08-stream-pause-filter: pause stream, navigate cells, push two filters onto the stack, undo with Esc.
-# Key 7 switches to Stream.
-Output demo/assets/08-stream-pause-filter.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "7"
-Sleep 4s
-Space
-Sleep 1s
-Down
-Sleep 300ms
-Down
-Sleep 300ms
-Down
-Sleep 800ms
-Right
-Sleep 500ms
-Right
-Sleep 500ms
-Enter
-Sleep 1500ms
-Down
-Sleep 400ms
-Right
-Sleep 400ms
-Enter
-Sleep 2s
-Screenshot demo/assets/screenshot-stream-filtered.png
-Escape
-Sleep 1s
-Escape
-Sleep 1500ms
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/09-stream-regex-search.tape b/demo/tapes/09-stream-regex-search.tape
deleted file mode 100644
index b643740..0000000
--- a/demo/tapes/09-stream-regex-search.tape
+++ /dev/null
@@ -1,40 +0,0 @@
-# 09-stream-regex-search: regex search forward (/), n to advance, ? for backward.
-# Key 7 switches to Stream.
-Output demo/assets/09-stream-regex-search.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "7"
-Sleep 4s
-Space
-Sleep 1s
-Type "/"
-Sleep 600ms
-Type "openat"
-Sleep 700ms
-Enter
-Sleep 1500ms
-Type "n"
-Sleep 800ms
-Type "n"
-Sleep 800ms
-Screenshot demo/assets/screenshot-stream-search.png
-Type "?"
-Sleep 600ms
-Type "stat"
-Sleep 700ms
-Enter
-Sleep 1500ms
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/10-stream-csv-export.tape b/demo/tapes/10-stream-csv-export.tape
deleted file mode 100644
index c1f4935..0000000
--- a/demo/tapes/10-stream-csv-export.tape
+++ /dev/null
@@ -1,28 +0,0 @@
-# 10-stream-csv-export: 'e' to export current filtered stream snapshot, then ls the CSV produced.
-# Key 7 switches to Stream.
-Output demo/assets/10-stream-csv-export.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "7"
-Sleep 4s
-Type "e"
-Sleep 2s
-Screenshot demo/assets/screenshot-stream-export.png
-Sleep 1s
-Type "q"
-Sleep 1s
-Type "ls -lh ior-stream-*.csv"
-Enter
-Sleep 2s
diff --git a/demo/tapes/11-pid-tid-probe.tape b/demo/tapes/11-pid-tid-probe.tape
deleted file mode 100644
index caccc48..0000000
--- a/demo/tapes/11-pid-tid-probe.tape
+++ /dev/null
@@ -1,41 +0,0 @@
-# 11-pid-tid-probe: re-open PID picker (p), TID picker (t), probe toggle dialog (o).
-Output demo/assets/11-pid-tid-probe.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "p"
-Sleep 2s
-Down
-Sleep 400ms
-Down
-Sleep 400ms
-Screenshot demo/assets/screenshot-pidpicker-open.png
-Escape
-Sleep 1s
-Type "t"
-Sleep 2s
-Screenshot demo/assets/screenshot-tidpicker.png
-Escape
-Sleep 1s
-Type "o"
-Sleep 2s
-Down
-Sleep 400ms
-Down
-Sleep 400ms
-Screenshot demo/assets/screenshot-probes.png
-Escape
-Sleep 1s
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/12-parquet-recording.tape b/demo/tapes/12-parquet-recording.tape
deleted file mode 100644
index c6f3399..0000000
--- a/demo/tapes/12-parquet-recording.tape
+++ /dev/null
@@ -1,28 +0,0 @@
-# 12-parquet-recording: start parquet recording (R), accept default filename (Enter), dwell, stop (R), exit, ls the file.
-Output demo/assets/12-parquet-recording.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior"
-Enter
-Sleep 5s
-Enter
-Sleep 4s
-Type "R"
-Sleep 1500ms
-Enter
-Sleep 4s
-Screenshot demo/assets/screenshot-recording-active.png
-Type "R"
-Sleep 1500ms
-Type "q"
-Sleep 1s
-Type "ls -lh ior-recording-*.parquet"
-Enter
-Sleep 2s
diff --git a/demo/tapes/13-tui-flamegraph.tape b/demo/tapes/13-tui-flamegraph.tape
deleted file mode 100644
index 7572159..0000000
--- a/demo/tapes/13-tui-flamegraph.tape
+++ /dev/null
@@ -1,22 +0,0 @@
-# 13-tui-flamegraph: in-TUI flamegraph view. The default landing tab (key `1`) is the
-# live flamegraph. Workload running in the background drives real frame data.
-# `-fields` and `-count` let you reshape stack ordering and the size metric.
-Output demo/assets/13-tui-flamegraph.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "sudo -n /home/paul/git/ior/ior -fields comm,path,tracepoint -count count"
-Enter
-Sleep 5s
-Enter
-Sleep 8s
-Screenshot demo/assets/screenshot-flamegraph.png
-Sleep 2s
-Type "q"
-Sleep 1s
diff --git a/demo/tapes/14-headless-modes.tape b/demo/tapes/14-headless-modes.tape
deleted file mode 100644
index ce894f6..0000000
--- a/demo/tapes/14-headless-modes.tape
+++ /dev/null
@@ -1,38 +0,0 @@
-# 14-headless-modes: all three headless flows in one tape — -flamegraph -name (.ior.zst),
-# -parquet (streaming rows), -plain (CSV to stdout). Each capped with -duration so the demo terminates.
-Output demo/assets/14-headless-modes.gif
-Set Shell "bash"
-Set Padding 20
-
-Hide
-Type "cd $(mktemp -d -t ior-demo-XXXX) && clear"
-Enter
-Sleep 300ms
-Show
-
-Type "# 1) Aggregated native trace artifact (.ior.zst)"
-Enter
-Sleep 800ms
-Type "sudo -n /home/paul/git/ior/ior -flamegraph -name demo-trace -duration 5"
-Enter
-Sleep 7s
-Type "ls -lh demo-trace*.ior.zst"
-Enter
-Sleep 2s
-
-Type "# 2) Per-row streaming Parquet"
-Enter
-Sleep 800ms
-Type "sudo -n /home/paul/git/ior/ior -parquet demo.parquet -duration 5"
-Enter
-Sleep 7s
-Type "ls -lh demo.parquet"
-Enter
-Sleep 2s
-
-Type "# 3) Plain CSV to stdout (head only)"
-Enter
-Sleep 800ms
-Type "sudo -n /home/paul/git/ior/ior -plain -duration 3 2>/dev/null | head -n 8"
-Enter
-Sleep 6s