cleanup

28 files changed, 265 insertions, 202 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 06f8c39..b4d4e0f 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -1,7 +1,7 @@
 // Code generated - don't change manually!
 
-/// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related
 /// Ignoring sys_enter_accept4 sys_exit_accept4 as possibly not file I/O related
+/// Ignoring sys_enter_accept sys_exit_accept as possibly not file I/O related
 /// Ignoring sys_enter_acct sys_exit_acct as possibly not file I/O related
 /// Ignoring sys_enter_add_key sys_exit_add_key as possibly not file I/O related
 /// Ignoring sys_enter_adjtimex sys_exit_adjtimex as possibly not file I/O related
@@ -17,20 +17,20 @@
 /// Ignoring sys_enter_clock_gettime sys_exit_clock_gettime as possibly not file I/O related
 /// Ignoring sys_enter_clock_nanosleep sys_exit_clock_nanosleep as possibly not file I/O related
 /// Ignoring sys_enter_clock_settime sys_exit_clock_settime as possibly not file I/O related
-/// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related
 /// Ignoring sys_enter_clone3 sys_exit_clone3 as possibly not file I/O related
+/// Ignoring sys_enter_clone sys_exit_clone as possibly not file I/O related
 /// Ignoring sys_enter_connect sys_exit_connect as possibly not file I/O related
 /// Ignoring sys_enter_delete_module sys_exit_delete_module as possibly not file I/O related
-/// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related
 /// Ignoring sys_enter_epoll_create1 sys_exit_epoll_create1 as possibly not file I/O related
+/// Ignoring sys_enter_epoll_create sys_exit_epoll_create as possibly not file I/O related
 /// Ignoring sys_enter_epoll_ctl sys_exit_epoll_ctl as possibly not file I/O related
-/// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related
 /// Ignoring sys_enter_epoll_pwait2 sys_exit_epoll_pwait2 as possibly not file I/O related
+/// Ignoring sys_enter_epoll_pwait sys_exit_epoll_pwait as possibly not file I/O related
 /// Ignoring sys_enter_epoll_wait sys_exit_epoll_wait as possibly not file I/O related
-/// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related
 /// Ignoring sys_enter_eventfd2 sys_exit_eventfd2 as possibly not file I/O related
-/// Ignoring sys_enter_execve sys_exit_execve as possibly not file I/O related
+/// Ignoring sys_enter_eventfd sys_exit_eventfd as possibly not file I/O related
 /// Ignoring sys_enter_execveat sys_exit_execveat as possibly not file I/O related
+/// Ignoring sys_enter_execve sys_exit_execve as possibly not file I/O related
 /// Ignoring sys_enter_exit sys_exit_exit as possibly not file I/O related
 /// Ignoring sys_enter_exit_group sys_exit_exit_group as possibly not file I/O related
 /// Ignoring sys_enter_fanotify_init sys_exit_fanotify_init as possibly not file I/O related
@@ -42,14 +42,13 @@
 /// Ignoring sys_enter_futex_wait sys_exit_futex_wait as possibly not file I/O related
 /// Ignoring sys_enter_futex_waitv sys_exit_futex_waitv as possibly not file I/O related
 /// Ignoring sys_enter_futex_wake sys_exit_futex_wake as possibly not file I/O related
-/// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related
-/// Ignoring sys_enter_get_robust_list sys_exit_get_robust_list as possibly not file I/O related
 /// Ignoring sys_enter_getcpu sys_exit_getcpu as possibly not file I/O related
 /// Ignoring sys_enter_getegid sys_exit_getegid as possibly not file I/O related
 /// Ignoring sys_enter_geteuid sys_exit_geteuid as possibly not file I/O related
 /// Ignoring sys_enter_getgid sys_exit_getgid as possibly not file I/O related
 /// Ignoring sys_enter_getgroups sys_exit_getgroups as possibly not file I/O related
 /// Ignoring sys_enter_getitimer sys_exit_getitimer as possibly not file I/O related
+/// Ignoring sys_enter_get_mempolicy sys_exit_get_mempolicy as possibly not file I/O related
 /// Ignoring sys_enter_getpeername sys_exit_getpeername as possibly not file I/O related
 /// Ignoring sys_enter_getpgid sys_exit_getpgid as possibly not file I/O related
 /// Ignoring sys_enter_getpgrp sys_exit_getpgrp as possibly not file I/O related
@@ -60,6 +59,7 @@
 /// Ignoring sys_enter_getresgid sys_exit_getresgid as possibly not file I/O related
 /// Ignoring sys_enter_getresuid sys_exit_getresuid as possibly not file I/O related
 /// Ignoring sys_enter_getrlimit sys_exit_getrlimit as possibly not file I/O related
+/// Ignoring sys_enter_get_robust_list sys_exit_get_robust_list as possibly not file I/O related
 /// Ignoring sys_enter_getrusage sys_exit_getrusage as possibly not file I/O related
 /// Ignoring sys_enter_getsid sys_exit_getsid as possibly not file I/O related
 /// Ignoring sys_enter_getsockname sys_exit_getsockname as possibly not file I/O related
@@ -69,8 +69,8 @@
 /// Ignoring sys_enter_getuid sys_exit_getuid as possibly not file I/O related
 /// Ignoring sys_enter_init_module sys_exit_init_module as possibly not file I/O related
 /// Ignoring sys_enter_inotify_add_watch sys_exit_inotify_add_watch as possibly not file I/O related
-/// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related
 /// Ignoring sys_enter_inotify_init1 sys_exit_inotify_init1 as possibly not file I/O related
+/// Ignoring sys_enter_inotify_init sys_exit_inotify_init as possibly not file I/O related
 /// Ignoring sys_enter_inotify_rm_watch sys_exit_inotify_rm_watch as possibly not file I/O related
 /// Ignoring sys_enter_ioperm sys_exit_ioperm as possibly not file I/O related
 /// Ignoring sys_enter_iopl sys_exit_iopl as possibly not file I/O related
@@ -97,11 +97,11 @@
 /// Ignoring sys_enter_memfd_secret sys_exit_memfd_secret as possibly not file I/O related
 /// Ignoring sys_enter_migrate_pages sys_exit_migrate_pages as possibly not file I/O related
 /// Ignoring sys_enter_mincore sys_exit_mincore as possibly not file I/O related
-/// Ignoring sys_enter_mknod sys_exit_mknod as possibly not file I/O related
 /// Ignoring sys_enter_mknodat sys_exit_mknodat as possibly not file I/O related
-/// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related
+/// Ignoring sys_enter_mknod sys_exit_mknod as possibly not file I/O related
 /// Ignoring sys_enter_mlock2 sys_exit_mlock2 as possibly not file I/O related
 /// Ignoring sys_enter_mlockall sys_exit_mlockall as possibly not file I/O related
+/// Ignoring sys_enter_mlock sys_exit_mlock as possibly not file I/O related
 /// Ignoring sys_enter_modify_ldt sys_exit_modify_ldt as possibly not file I/O related
 /// Ignoring sys_enter_mount sys_exit_mount as possibly not file I/O related
 /// Ignoring sys_enter_move_mount sys_exit_move_mount as possibly not file I/O related
@@ -119,8 +119,8 @@
 /// Ignoring sys_enter_msgget sys_exit_msgget as possibly not file I/O related
 /// Ignoring sys_enter_msgrcv sys_exit_msgrcv as possibly not file I/O related
 /// Ignoring sys_enter_msgsnd sys_exit_msgsnd as possibly not file I/O related
-/// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related
 /// Ignoring sys_enter_munlockall sys_exit_munlockall as possibly not file I/O related
+/// Ignoring sys_enter_munlock sys_exit_munlock as possibly not file I/O related
 /// Ignoring sys_enter_munmap sys_exit_munmap as possibly not file I/O related
 /// Ignoring sys_enter_nanosleep sys_exit_nanosleep as possibly not file I/O related
 /// Ignoring sys_enter_newuname sys_exit_newuname as possibly not file I/O related
@@ -129,8 +129,8 @@
 /// Ignoring sys_enter_personality sys_exit_personality as possibly not file I/O related
 /// Ignoring sys_enter_pidfd_open sys_exit_pidfd_open as possibly not file I/O related
 /// Ignoring sys_enter_pidfd_send_signal sys_exit_pidfd_send_signal as possibly not file I/O related
-/// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related
 /// Ignoring sys_enter_pipe2 sys_exit_pipe2 as possibly not file I/O related
+/// Ignoring sys_enter_pipe sys_exit_pipe as possibly not file I/O related
 /// Ignoring sys_enter_pivot_root sys_exit_pivot_root as possibly not file I/O related
 /// Ignoring sys_enter_pkey_alloc sys_exit_pkey_alloc as possibly not file I/O related
 /// Ignoring sys_enter_pkey_free sys_exit_pkey_free as possibly not file I/O related
@@ -162,11 +162,11 @@
 /// Ignoring sys_enter_rt_sigsuspend sys_exit_rt_sigsuspend as possibly not file I/O related
 /// Ignoring sys_enter_rt_sigtimedwait sys_exit_rt_sigtimedwait as possibly not file I/O related
 /// Ignoring sys_enter_rt_tgsigqueueinfo sys_exit_rt_tgsigqueueinfo as possibly not file I/O related
-/// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related
-/// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related
 /// Ignoring sys_enter_sched_getaffinity sys_exit_sched_getaffinity as possibly not file I/O related
 /// Ignoring sys_enter_sched_getattr sys_exit_sched_getattr as possibly not file I/O related
 /// Ignoring sys_enter_sched_getparam sys_exit_sched_getparam as possibly not file I/O related
+/// Ignoring sys_enter_sched_get_priority_max sys_exit_sched_get_priority_max as possibly not file I/O related
+/// Ignoring sys_enter_sched_get_priority_min sys_exit_sched_get_priority_min as possibly not file I/O related
 /// Ignoring sys_enter_sched_getscheduler sys_exit_sched_getscheduler as possibly not file I/O related
 /// Ignoring sys_enter_sched_rr_get_interval sys_exit_sched_rr_get_interval as possibly not file I/O related
 /// Ignoring sys_enter_sched_setaffinity sys_exit_sched_setaffinity as possibly not file I/O related
@@ -184,10 +184,6 @@
 /// Ignoring sys_enter_sendmmsg sys_exit_sendmmsg as possibly not file I/O related
 /// Ignoring sys_enter_sendmsg sys_exit_sendmsg as possibly not file I/O related
 /// Ignoring sys_enter_sendto sys_exit_sendto as possibly not file I/O related
-/// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related
-/// Ignoring sys_enter_set_mempolicy_home_node sys_exit_set_mempolicy_home_node as possibly not file I/O related
-/// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related
-/// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related
 /// Ignoring sys_enter_setdomainname sys_exit_setdomainname as possibly not file I/O related
 /// Ignoring sys_enter_setfsgid sys_exit_setfsgid as possibly not file I/O related
 /// Ignoring sys_enter_setfsuid sys_exit_setfsuid as possibly not file I/O related
@@ -195,6 +191,8 @@
 /// Ignoring sys_enter_setgroups sys_exit_setgroups as possibly not file I/O related
 /// Ignoring sys_enter_sethostname sys_exit_sethostname as possibly not file I/O related
 /// Ignoring sys_enter_setitimer sys_exit_setitimer as possibly not file I/O related
+/// Ignoring sys_enter_set_mempolicy sys_exit_set_mempolicy as possibly not file I/O related
+/// Ignoring sys_enter_set_mempolicy_home_node sys_exit_set_mempolicy_home_node as possibly not file I/O related
 /// Ignoring sys_enter_setns sys_exit_setns as possibly not file I/O related
 /// Ignoring sys_enter_setpgid sys_exit_setpgid as possibly not file I/O related
 /// Ignoring sys_enter_setpriority sys_exit_setpriority as possibly not file I/O related
@@ -203,8 +201,10 @@
 /// Ignoring sys_enter_setresuid sys_exit_setresuid as possibly not file I/O related
 /// Ignoring sys_enter_setreuid sys_exit_setreuid as possibly not file I/O related
 /// Ignoring sys_enter_setrlimit sys_exit_setrlimit as possibly not file I/O related
+/// Ignoring sys_enter_set_robust_list sys_exit_set_robust_list as possibly not file I/O related
 /// Ignoring sys_enter_setsid sys_exit_setsid as possibly not file I/O related
 /// Ignoring sys_enter_setsockopt sys_exit_setsockopt as possibly not file I/O related
+/// Ignoring sys_enter_set_tid_address sys_exit_set_tid_address as possibly not file I/O related
 /// Ignoring sys_enter_settimeofday sys_exit_settimeofday as possibly not file I/O related
 /// Ignoring sys_enter_setuid sys_exit_setuid as possibly not file I/O related
 /// Ignoring sys_enter_shmat sys_exit_shmat as possibly not file I/O related
@@ -213,8 +213,8 @@
 /// Ignoring sys_enter_shmget sys_exit_shmget as possibly not file I/O related
 /// Ignoring sys_enter_shutdown sys_exit_shutdown as possibly not file I/O related
 /// Ignoring sys_enter_sigaltstack sys_exit_sigaltstack as possibly not file I/O related
-/// Ignoring sys_enter_signalfd sys_exit_signalfd as possibly not file I/O related
 /// Ignoring sys_enter_signalfd4 sys_exit_signalfd4 as possibly not file I/O related
+/// Ignoring sys_enter_signalfd sys_exit_signalfd as possibly not file I/O related
 /// Ignoring sys_enter_socket sys_exit_socket as possibly not file I/O related
 /// Ignoring sys_enter_socketpair sys_exit_socketpair as possibly not file I/O related
 /// Ignoring sys_enter_splice sys_exit_splice as possibly not file I/O related
@@ -228,12 +228,12 @@
 /// Ignoring sys_enter_time sys_exit_time as possibly not file I/O related
 /// Ignoring sys_enter_timer_create sys_exit_timer_create as possibly not file I/O related
 /// Ignoring sys_enter_timer_delete sys_exit_timer_delete as possibly not file I/O related
-/// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related
-/// Ignoring sys_enter_timer_gettime sys_exit_timer_gettime as possibly not file I/O related
-/// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related
 /// Ignoring sys_enter_timerfd_create sys_exit_timerfd_create as possibly not file I/O related
 /// Ignoring sys_enter_timerfd_gettime sys_exit_timerfd_gettime as possibly not file I/O related
 /// Ignoring sys_enter_timerfd_settime sys_exit_timerfd_settime as possibly not file I/O related
+/// Ignoring sys_enter_timer_getoverrun sys_exit_timer_getoverrun as possibly not file I/O related
+/// Ignoring sys_enter_timer_gettime sys_exit_timer_gettime as possibly not file I/O related
+/// Ignoring sys_enter_timer_settime sys_exit_timer_settime as possibly not file I/O related
 /// Ignoring sys_enter_times sys_exit_times as possibly not file I/O related
 /// Ignoring sys_enter_tkill sys_exit_tkill as possibly not file I/O related
 /// Ignoring sys_enter_umask sys_exit_umask as possibly not file I/O related
diff --git a/internal/event/event.go b/internal/event/event.go
index 48bde48..c846e04 100644
--- a/internal/event/event.go
+++ b/internal/event/event.go
@@ -7,7 +7,7 @@ import (
 )
 
 var poolOfEventPairs = sync.Pool{
-	New: func() interface{} { return &Pair{} },
+	New: func() any { return &Pair{} },
 }
 
 // Event is the common contract implemented by decoded syscall trace events.
diff --git a/internal/event/pair.go b/internal/event/pair.go
index 3eb8a16..4d3f342 100644
--- a/internal/event/pair.go
+++ b/internal/event/pair.go
@@ -25,20 +25,13 @@ type Pair struct {
 	Comm            string
 	Duration        uint64
 	DurationToPrev  uint64
-	Bytes           uint64 // Number of bytes transferred (read/write/transfer syscalls only)
-	Equals          bool
+	Bytes          uint64 // Number of bytes transferred (read/write/transfer syscalls only)
 }
 
 func NewPair(enterEv Event) *Pair {
 	e := poolOfEventPairs.Get().(*Pair)
-	e.EnterEv = enterEv
-	e.ExitEv = nil
-	e.File = nil
-	e.Comm = ""
-	e.Duration = 0
-	e.DurationToPrev = 0
-	e.Bytes = 0
-	e.Equals = false
+	// Zero all fields via struct literal to prevent stale data from previous pool reuse.
+	*e = Pair{EnterEv: enterEv}
 	return e
 }
 
@@ -126,13 +119,7 @@ func (e *Pair) Recycle() {
 	if e.ExitEv != nil {
 		e.ExitEv.Recycle()
 	}
-	e.EnterEv = nil
-	e.ExitEv = nil
-	e.File = nil
-	e.Comm = ""
-	e.Duration = 0
-	e.DurationToPrev = 0
-	e.Bytes = 0
-	e.Equals = false
+	// Zero all fields via struct literal to prevent stale data on pool reuse.
+	*e = Pair{}
 	poolOfEventPairs.Put(e)
 }
diff --git a/internal/file/file.go b/internal/file/file.go
index ab67fe2..fc9c320 100644
--- a/internal/file/file.go
+++ b/internal/file/file.go
@@ -99,8 +99,11 @@ func parseFlagsFromFdInfo(data []byte) (Flags, error) {
 	for scanner.Scan() {
 		line := scanner.Text()
 		if strings.HasPrefix(line, "flags:") {
-			flagsStr := strings.Fields(line)[1]
-			flags, err := strconv.ParseUint(flagsStr, 8, 32)
+			fields := strings.Fields(line)
+			if len(fields) < 2 {
+				return unknownFlag, fmt.Errorf("malformed flags line in fdinfo: %q", line)
+			}
+			flags, err := strconv.ParseUint(fields[1], 8, 32)
 			return Flags(flags), err
 		}
 	}
@@ -118,7 +121,7 @@ func (f *FdFile) String() string {
 	var sb strings.Builder
 
 	if len(f.name) == 0 {
-		sb.WriteString("E:name") // Emtpy name string
+		sb.WriteString("E:name") // Empty name string
 	} else {
 		sb.WriteString(f.name)
 	}
diff --git a/internal/flags/flags.go b/internal/flags/flags.go
index 0baac9a..9b1c3cf 100644
--- a/internal/flags/flags.go
+++ b/internal/flags/flags.go
@@ -26,7 +26,7 @@ type Config struct {
 	PprofEnable  bool
 	Duration     int
 
-	// Tracepints flags
+	// Tracepoints flags
 	TracepointsToAttach  []*regexp.Regexp
 	TracepointsToExclude []*regexp.Regexp
 
@@ -234,6 +234,30 @@ func extractTracepointFlags(tracepoints string) (regexes []*regexp.Regexp, err e
 	return regexes, nil
 }
 
+// TraceFilter builds a globalfilter.Filter from the config's filter fields.
+// If GlobalFilter is already active, it is returned as-is. Otherwise,
+// individual CLI-level filters (CommFilter, PathFilter, PidFilter, TidFilter)
+// are merged into a new filter.
+func (cfg Config) TraceFilter() globalfilter.Filter {
+	filter := cfg.GlobalFilter.Clone()
+	if filter.IsActive() {
+		return filter
+	}
+	if cfg.CommFilter != "" {
+		filter.Comm = &globalfilter.StringFilter{Pattern: cfg.CommFilter}
+	}
+	if cfg.PathFilter != "" {
+		filter.File = &globalfilter.StringFilter{Pattern: cfg.PathFilter}
+	}
+	if cfg.PidFilter > 0 {
+		filter.PID = globalfilter.NewEqFilter(int64(cfg.PidFilter))
+	}
+	if cfg.TidFilter > 0 {
+		filter.TID = globalfilter.NewEqFilter(int64(cfg.TidFilter))
+	}
+	return filter
+}
+
 func (flags Config) ShouldIAttachTracepoint(tracepointName string) bool {
 	for _, re := range flags.TracepointsToExclude {
 		if re.MatchString(tracepointName) {
diff --git a/internal/flamegraph/iordata.go b/internal/flamegraph/iordata.go
index 76e438a..36b5103 100644
--- a/internal/flamegraph/iordata.go
+++ b/internal/flamegraph/iordata.go
@@ -14,8 +14,7 @@ import (
 	"ior/internal/file"
 	"ior/internal/types"
 
-	// Is there a zstd library part of Go 1.25
-	"github.com/DataDog/zstd"
+	"github.com/DataDog/zstd" // Go stdlib does not include zstd; third-party dep required
 )
 
 type pathType = string
@@ -61,19 +60,13 @@ func LoadFromFile(filename string) (iter.Seq[IterRecord], error) {
 	return iod.iter(), nil
 }
 
-func cloneString(s string) string {
-	// Clone the string by creating a new string with the same content
-	// This is a workaround to avoid using unsafe package
-	return string([]byte(s))
-}
-
-func (iod iorData) addEventPair(ev *event.Pair) {
+func (iod *iorData) addEventPair(ev *event.Pair) {
 	cnt := Counter{Count: 1, Duration: ev.Duration, DurationToPrev: ev.DurationToPrev, Bytes: ev.Bytes}
 	iod.add(ev.FileName(), ev.EnterEv.GetTraceId(), strings.TrimSpace(ev.Comm), ev.EnterEv.GetPid(),
 		ev.EnterEv.GetTid(), ev.Flags(), cnt)
 }
 
-func (iod iorData) add(path pathType, traceId traceIdType, comm commType,
+func (iod *iorData) add(path pathType, traceId traceIdType, comm commType,
 	pid pidType, tid tidType, flags flagsType, addCnt Counter) {
 
 	key := recordKey{
@@ -92,14 +85,14 @@ func (iod iorData) add(path pathType, traceId traceIdType, comm commType,
 	iod.records[key] = cnt.add(addCnt)
 }
 
-func (iod iorData) merge(other iorData) iorData {
+func (iod *iorData) merge(other iorData) *iorData {
 	for key, cnt := range other.records {
 		iod.add(key.Path, key.TraceID, key.Comm, key.Pid, key.Tid, key.Flags, cnt)
 	}
 	return iod
 }
 
-func (iod iorData) serializeToFile(flamegraphName string) (retErr error) {
+func (iod *iorData) serializeToFile(flamegraphName string) (retErr error) {
 	hostname, err := hostnameFn()
 	if err != nil {
 		return fmt.Errorf("get hostname: %w", err)
@@ -118,24 +111,25 @@ func (iod iorData) serializeToFile(flamegraphName string) (retErr error) {
 		return fmt.Errorf("create temp file %s: %w", tmpFilename, err)
 	}
 	defer func() {
-		if err := file.Close(); err != nil {
-			retErr = errors.Join(retErr, fmt.Errorf("close temp file %s: %w", tmpFilename, err))
+		// Close file on error paths; on success it is already closed before rename.
+		if retErr != nil {
+			file.Close()
 		}
 	}()
 
 	encoder := zstd.NewWriter(file)
-	defer func() {
-		if err := encoder.Close(); err != nil {
-			retErr = errors.Join(retErr, fmt.Errorf("close zstd writer for %s: %w", tmpFilename, err))
-		}
-	}()
 
 	gobEncoder := gob.NewEncoder(encoder)
 	if err := gobEncoder.Encode(iod.records); err != nil {
 		return fmt.Errorf("encode ior records: %w", err)
 	}
-	if err := encoder.Flush(); err != nil {
-		return fmt.Errorf("flush ior records: %w", err)
+	// Close encoder before file to flush the final zstd frame, then close
+	// the file to flush OS buffers. Both must complete before rename.
+	if err := encoder.Close(); err != nil {
+		return fmt.Errorf("close zstd writer for %s: %w", tmpFilename, err)
+	}
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("close temp file %s: %w", tmpFilename, err)
 	}
 
 	if err := os.Rename(tmpFilename, filename); err != nil {
@@ -173,7 +167,7 @@ func (iod *iorData) loadFromFile(filename string) (retErr error) {
 	return nil
 }
 
-func (iod iorData) serialize() ([]byte, error) {
+func (iod *iorData) serialize() ([]byte, error) {
 	var buf bytes.Buffer
 	enc := gob.NewEncoder(&buf)
 	err := enc.Encode(iod.records)
@@ -224,7 +218,7 @@ func (ir IterRecord) StringByName(name string) (string, error) {
 	}
 }
 
-func (iod iorData) iter() iter.Seq[IterRecord] {
+func (iod *iorData) iter() iter.Seq[IterRecord] {
 	return func(yield func(IterRecord) bool) {
 		for key, cnt := range iod.records {
 			record := IterRecord{
diff --git a/internal/flamegraph/iordata_test.go b/internal/flamegraph/iordata_test.go
index 722cad3..f805aab 100644
--- a/internal/flamegraph/iordata_test.go
+++ b/internal/flamegraph/iordata_test.go
@@ -90,7 +90,7 @@ func TestMerge(t *testing.T) {
 	t.Log("iod2", iod2)
 	t.Log("iod3", iod3)
 	t.Log("iod4", iod4)
-	merged := iod1.merge(iod2).merge(iod3).merge(iod4)
+	merged := *iod1.merge(iod2).merge(iod3).merge(iod4)
 	t.Log("merged", merged)
 
 	t.Run("Merged correctly", func(t *testing.T) {
@@ -217,7 +217,7 @@ func TestMergeEmpty(t *testing.T) {
 	})
 
 	empty := newIorData()
-	merged := iod.merge(empty)
+	merged := *iod.merge(empty)
 
 	if len(merged.records) != 1 {
 		t.Errorf("Expected 1 record, got %d", len(merged.records))
diff --git a/internal/flamegraph/livetrie.go b/internal/flamegraph/livetrie.go
index 600e404..51f3697 100644
--- a/internal/flamegraph/livetrie.go
+++ b/internal/flamegraph/livetrie.go
@@ -1,10 +1,10 @@
 package flamegraph
 
 import (
+	"cmp"
 	"encoding/json"
 	"fmt"
 	"slices"
-	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -277,8 +277,8 @@ type childSnapshotState struct {
 func buildSnapshotWithTotal(node *trieNode, depth int, minFraction float64, rootTotal uint64, forceKeep bool) (*trieSnapshot, uint64) {
 	total := node.value
 	children := slices.Clone(node.children)
-	sort.Slice(children, func(i, j int) bool {
-		return children[i].name < children[j].name
+	slices.SortFunc(children, func(a, b *trieNode) int {
+		return cmp.Compare(a.name, b.name)
 	})
 
 	childStates := make([]childSnapshotState, 0, len(children))
@@ -335,13 +335,13 @@ func ensureFallbackVisibleChildren(children []childSnapshotState, depth int, min
 			candidates = append(candidates, idx)
 		}
 	}
-	sort.Slice(candidates, func(i, j int) bool {
-		left := children[candidates[i]]
-		right := children[candidates[j]]
-		if left.total == right.total {
-			return left.node.name < right.node.name
+	slices.SortFunc(candidates, func(a, b int) int {
+		left := children[a]
+		right := children[b]
+		if left.total != right.total {
+			return cmp.Compare(right.total, left.total)
 		}
-		return left.total > right.total
+		return cmp.Compare(left.node.name, right.node.name)
 	})
 
 	limit := liveTrieMinVisibleChildrenWhenPruned
diff --git a/internal/flamegraph/trie.go b/internal/flamegraph/trie.go
index 022b846..d7790c2 100644
--- a/internal/flamegraph/trie.go
+++ b/internal/flamegraph/trie.go
@@ -1,6 +1,9 @@
 package flamegraph
 
-import "sort"
+import (
+	"cmp"
+	"slices"
+)
 
 type trieNode struct {
 	name     string
@@ -35,8 +38,8 @@ func (t *trie) computeTotals() {
 			t.maxDepth = depth
 		}
 
-		sort.Slice(node.children, func(i, j int) bool {
-			return node.children[i].name < node.children[j].name
+		slices.SortFunc(node.children, func(a, b *trieNode) int {
+			return cmp.Compare(a.name, b.name)
 		})
 
 		total := node.value
diff --git a/internal/generate/codegen.go b/internal/generate/codegen.go
index 9b9f52c..1c7a9b3 100644
--- a/internal/generate/codegen.go
+++ b/internal/generate/codegen.go
@@ -1,8 +1,9 @@
 package generate
 
 import (
+	"cmp"
 	"fmt"
-	"sort"
+	"slices"
 	"strings"
 )
 
@@ -37,8 +38,8 @@ func GenerateTracepointsC(formats []Format) string {
 		accepted = append(accepted, tracepoints...)
 	}
 
-	sort.Slice(accepted, func(i, j int) bool {
-		return accepted[i].Format.ID > accepted[j].Format.ID
+	slices.SortFunc(accepted, func(a, b GeneratedTracepoint) int {
+		return cmp.Compare(b.Format.ID, a.Format.ID)
 	})
 
 	b.WriteString("\n")
@@ -147,6 +148,6 @@ func syscallFormatNames(sc Syscall) []string {
 	if sc.Exit != nil {
 		names = append(names, sc.Exit.Name)
 	}
-	sort.Strings(names)
+	slices.Sort(names)
 	return names
 }
diff --git a/internal/generate/typesgo.go b/internal/generate/typesgo.go
index dca40fc..9f91981 100644
--- a/internal/generate/typesgo.go
+++ b/internal/generate/typesgo.go
@@ -295,7 +295,7 @@ func writeGetterMethods(b *strings.Builder, goName, selfRef string) {
 }
 
 func writeSyncPool(b *strings.Builder, goName, selfRef string) {
-	fmt.Fprintf(b, "var poolOf%ss = sync.Pool{\n\tNew: func() interface{} { return &%s{} },\n}\n\n", goName, goName)
+	fmt.Fprintf(b, "var poolOf%ss = sync.Pool{\n\tNew: func() any { return &%s{} },\n}\n\n", goName, goName)
 	fmt.Fprintf(b, "func New%s(raw []byte) *%s {\n", goName, goName)
 	fmt.Fprintf(b, "\t%s := poolOf%ss.Get().(*%s)\n", selfRef, goName, goName)
 	fmt.Fprintf(b, "\tif err := binary.Read(bytes.NewReader(raw), binary.LittleEndian, %s); err != nil {\n", selfRef)
diff --git a/internal/globalfilter/filter.go b/internal/globalfilter/filter.go
index 6d19207..d55c4c1 100644
--- a/internal/globalfilter/filter.go
+++ b/internal/globalfilter/filter.go
@@ -23,6 +23,26 @@ type NumericFilter struct {
 	Value int64
 }
 
+// NewEqFilter creates an equality NumericFilter for a positive value.
+// Returns nil if value is not positive.
+func NewEqFilter(value int64) *NumericFilter {
+	if value <= 0 {
+		return nil
+	}
+	return &NumericFilter{Op: OpEq, Value: value}
+}
+
+// EqValue returns the filter's positive equality value if the filter
+// represents an exact-match constraint (Op == OpEq and Value > 0).
+// Returns (0, false) when the filter is nil, uses a different operator,
+// or has a non-positive value.
+func (f *NumericFilter) EqValue() (int, bool) {
+	if f == nil || f.Op != OpEq || f.Value <= 0 {
+		return 0, false
+	}
+	return int(f.Value), true
+}
+
 type StringFilter struct {
 	Pattern string
 }
diff --git a/internal/parquet/schema.go b/internal/parquet/schema.go
index 2ede444..62d448b 100644
--- a/internal/parquet/schema.go
+++ b/internal/parquet/schema.go
@@ -1,7 +1,9 @@
 package parquet
 
 import (
+	"os"
 	"strconv"
+	"time"
 
 	"ior/internal/flags"
 	"ior/internal/streamrow"
@@ -35,6 +37,20 @@ type FileMetadata struct {
 	IORVersion        string
 }
 
+// NewFileMetadata constructs file-level metadata for a parquet trace file,
+// populating the hostname, timestamp, version, and recording mode.
+func NewFileMetadata(mode string) FileMetadata {
+	meta := FileMetadata{
+		StartedAtUnixNano: uint64(time.Now().UnixNano()),
+		Mode:              mode,
+		IORVersion:        flags.Version,
+	}
+	if hostname, err := os.Hostname(); err == nil {
+		meta.Hostname = hostname
+	}
+	return meta
+}
+
 // RecordFromStream converts one shared stream row into the persisted format.
 func RecordFromStream(row streamrow.Row, filterEpoch uint64) Record {
 	return Record{
diff --git a/internal/probemanager/grouping.go b/internal/probemanager/grouping.go
index aa4f133..be55659 100644
--- a/internal/probemanager/grouping.go
+++ b/internal/probemanager/grouping.go
@@ -35,19 +35,17 @@ func GroupTracepoints(names []string) map[string]TracepointPair {
 }
 
 func parseSyscallTracepoint(name string) (base string, isEnter bool, ok bool) {
-	if strings.HasPrefix(name, sysEnterPrefix) {
-		base = strings.TrimPrefix(name, sysEnterPrefix)
-		if base == "" {
+	if after, found := strings.CutPrefix(name, sysEnterPrefix); found {
+		if after == "" {
 			return "", false, false
 		}
-		return base, true, true
+		return after, true, true
 	}
-	if strings.HasPrefix(name, sysExitPrefix) {
-		base = strings.TrimPrefix(name, sysExitPrefix)
-		if base == "" {
+	if after, found := strings.CutPrefix(name, sysExitPrefix); found {
+		if after == "" {
 			return "", false, false
 		}
-		return base, false, true
+		return after, false, true
 	}
 	return "", false, false
 }
diff --git a/internal/probemanager/manager.go b/internal/probemanager/manager.go
index 4c9dcec..cad755e 100644
--- a/internal/probemanager/manager.go
+++ b/internal/probemanager/manager.go
@@ -1,9 +1,10 @@
 package probemanager
 
 import (
+	"cmp"
 	"errors"
 	"fmt"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 )
@@ -244,7 +245,7 @@ func (m *Manager) States() []ProbeState {
 		}
 		out = append(out, state)
 	}
-	sort.Slice(out, func(i, j int) bool { return out[i].Syscall < out[j].Syscall })
+	slices.SortFunc(out, func(a, b ProbeState) int { return cmp.Compare(a.Syscall, b.Syscall) })
 	return out
 }
 
diff --git a/internal/statsengine/bench_test.go b/internal/statsengine/bench_test.go
index 646bdda..99d5c87 100644
--- a/internal/statsengine/bench_test.go
+++ b/internal/statsengine/bench_test.go
@@ -1,7 +1,7 @@
 package statsengine
 
 import (
-	"math/rand"
+	"math/rand/v2"
 	"testing"
 	"time"
 
@@ -9,7 +9,7 @@ import (
 )
 
 func BenchmarkSyscallAccumulatorSnapshot(b *testing.B) {
-	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewSource(123)))
+	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewPCG(123, 0)))
 	traceIDs := []types.TraceId{
 		types.SYS_ENTER_READ,
 		types.SYS_ENTER_WRITE,
diff --git a/internal/statsengine/filerank.go b/internal/statsengine/filerank.go
index dd83e8d..d24ab93 100644
--- a/internal/statsengine/filerank.go
+++ b/internal/statsengine/filerank.go
@@ -1,8 +1,9 @@
 package statsengine
 
 import (
+	"cmp"
 	"container/heap"
-	"sort"
+	"slices"
 
 	"ior/internal/event"
 	"ior/internal/types"
@@ -123,11 +124,11 @@ func buildFileSnapshots(inputs []fileSnapshotInput) []FileSnapshot {
 	for _, in := range inputs {
 		out = append(out, in.toSnapshot())
 	}
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Accesses != out[j].Accesses {
-			return out[i].Accesses > out[j].Accesses
+	slices.SortFunc(out, func(a, b FileSnapshot) int {
+		if a.Accesses != b.Accesses {
+			return cmp.Compare(b.Accesses, a.Accesses)
 		}
-		return out[i].Path < out[j].Path
+		return cmp.Compare(a.Path, b.Path)
 	})
 	return out
 }
diff --git a/internal/statsengine/process.go b/internal/statsengine/process.go
index b00a4bb..3bfd019 100644
--- a/internal/statsengine/process.go
+++ b/internal/statsengine/process.go
@@ -1,7 +1,8 @@
 package statsengine
 
 import (
-	"sort"
+	"cmp"
+	"slices"
 	"time"
 
 	"ior/internal/event"
@@ -115,14 +116,14 @@ func buildProcessSnapshots(inputs []processSnapshotInput, elapsed time.Duration)
 	for _, in := range inputs {
 		result = append(result, in.toSnapshot(rateDiv))
 	}
-	sort.Slice(result, func(i, j int) bool {
-		if result[i].Syscalls != result[j].Syscalls {
-			return result[i].Syscalls > result[j].Syscalls
+	slices.SortFunc(result, func(a, b ProcessSnapshot) int {
+		if a.Syscalls != b.Syscalls {
+			return cmp.Compare(b.Syscalls, a.Syscalls)
 		}
-		if result[i].Bytes != result[j].Bytes {
-			return result[i].Bytes > result[j].Bytes
+		if a.Bytes != b.Bytes {
+			return cmp.Compare(b.Bytes, a.Bytes)
 		}
-		return result[i].PID < result[j].PID
+		return cmp.Compare(a.PID, b.PID)
 	})
 	return result
 }
@@ -136,8 +137,14 @@ func (a *processAccumulator) compactIfNeeded() {
 	for _, stats := range a.byPID {
 		ordered = append(ordered, stats)
 	}
-	sort.Slice(ordered, func(i, j int) bool {
-		return betterProcessRank(ordered[i], ordered[j])
+	slices.SortFunc(ordered, func(a, b *processStats) int {
+		if betterProcessRank(a, b) {
+			return -1
+		}
+		if betterProcessRank(b, a) {
+			return 1
+		}
+		return 0
 	})
 	if len(ordered) > a.topN {
 		ordered = ordered[:a.topN]
diff --git a/internal/statsengine/syscall.go b/internal/statsengine/syscall.go
index 4feeab2..93931d1 100644
--- a/internal/statsengine/syscall.go
+++ b/internal/statsengine/syscall.go
@@ -1,9 +1,10 @@
 package statsengine
 
 import (
+	"cmp"
 	"math"
-	"math/rand"
-	"sort"
+	"math/rand/v2"
+	"slices"
 	"time"
 
 	"ior/internal/event"
@@ -55,15 +56,17 @@ type syscallSnapshotInput struct {
 }
 
 func newSyscallAccumulator() *syscallAccumulator {
-	return newSyscallAccumulatorWithConfig(syscallReservoirSampleCapDefault, rand.New(rand.NewSource(time.Now().UnixNano())))
+	return newSyscallAccumulatorWithConfig(syscallReservoirSampleCapDefault, nil)
 }
 
+// newSyscallAccumulatorWithConfig creates a syscall accumulator with the given
+// sample capacity and optional RNG. A nil rng uses the auto-seeded default.
 func newSyscallAccumulatorWithConfig(sampleCap int, rng *rand.Rand) *syscallAccumulator {
 	if sampleCap <= 0 {
 		sampleCap = syscallReservoirSampleCapDefault
 	}
 	if rng == nil {
-		rng = rand.New(rand.NewSource(time.Now().UnixNano()))
+		rng = rand.New(rand.NewPCG(rand.Uint64(), rand.Uint64()))
 	}
 
 	return &syscallAccumulator{
@@ -135,11 +138,11 @@ func buildSyscallSnapshots(inputs []syscallSnapshotInput, elapsed time.Duration)
 	for _, in := range inputs {
 		result = append(result, in.toSnapshot(rateDiv))
 	}
-	sort.Slice(result, func(i, j int) bool {
-		if result[i].Count != result[j].Count {
-			return result[i].Count > result[j].Count
+	slices.SortFunc(result, func(a, b SyscallSnapshot) int {
+		if a.Count != b.Count {
+			return cmp.Compare(b.Count, a.Count)
 		}
-		return result[i].Name < result[j].Name
+		return cmp.Compare(a.Name, b.Name)
 	})
 	return result
 }
@@ -161,8 +164,8 @@ func (s *syscallStats) addSample(duration uint64, cap int, rng *rand.Rand) {
 		return
 	}
 
-	idx := rng.Int63n(int64(s.seenLatencies))
-	if idx >= int64(cap) {
+	idx := rng.IntN(int(s.seenLatencies))
+	if idx >= cap {
 		return
 	}
 	s.samples[idx] = duration
@@ -183,7 +186,7 @@ func (s *syscallStats) ensurePercentiles() {
 	}
 
 	sorted := append([]uint64(nil), s.samples...)
-	sort.Slice(sorted, func(i, j int) bool { return sorted[i] < sorted[j] })
+	slices.Sort(sorted)
 	s.cachedP50 = samplePercentile(sorted, 0.50)
 	s.cachedP95 = samplePercentile(sorted, 0.95)
 	s.cachedP99 = samplePercentile(sorted, 0.99)
diff --git a/internal/statsengine/syscall_test.go b/internal/statsengine/syscall_test.go
index b315bd8..b00582d 100644
--- a/internal/statsengine/syscall_test.go
+++ b/internal/statsengine/syscall_test.go
@@ -2,7 +2,7 @@ package statsengine
 
 import (
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"testing"
 	"time"
 
@@ -11,7 +11,7 @@ import (
 )
 
 func TestSyscallAccumulatorBasicStats(t *testing.T) {
-	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewSource(1)))
+	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewPCG(1, 0)))
 	traceID := types.SYS_ENTER_READ
 
 	acc.Add(newPair(traceID, 10, 100, 0))
@@ -54,7 +54,7 @@ func TestSyscallAccumulatorBasicStats(t *testing.T) {
 }
 
 func TestSyscallAccumulatorSortsByCountThenName(t *testing.T) {
-	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewSource(2)))
+	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewPCG(2, 0)))
 
 	idA := types.SYS_ENTER_OPENAT
 	idB := types.SYS_ENTER_READ
@@ -76,7 +76,7 @@ func TestSyscallAccumulatorSortsByCountThenName(t *testing.T) {
 }
 
 func TestSyscallAccumulatorReservoirPercentilesAccuracy(t *testing.T) {
-	acc := newSyscallAccumulatorWithConfig(100, rand.New(rand.NewSource(7)))
+	acc := newSyscallAccumulatorWithConfig(100, rand.New(rand.NewPCG(7, 0)))
 	traceID := types.SYS_ENTER_WRITE
 
 	for d := uint64(1); d <= 10_000; d++ {
@@ -95,7 +95,7 @@ func TestSyscallAccumulatorReservoirPercentilesAccuracy(t *testing.T) {
 }
 
 func TestSyscallAccumulatorZeroElapsedRate(t *testing.T) {
-	acc := newSyscallAccumulatorWithConfig(32, rand.New(rand.NewSource(9)))
+	acc := newSyscallAccumulatorWithConfig(32, rand.New(rand.NewPCG(9, 0)))
 	acc.Add(newPair(types.SYS_ENTER_READ, 9, 0, 0))
 
 	snap := acc.Snapshot(0)
@@ -108,7 +108,7 @@ func TestSyscallAccumulatorZeroElapsedRate(t *testing.T) {
 }
 
 func TestSyscallAccumulatorPercentilesRecomputeAfterThreshold(t *testing.T) {
-	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewSource(11)))
+	acc := newSyscallAccumulatorWithConfig(10_000, rand.New(rand.NewPCG(11, 0)))
 	traceID := types.SYS_ENTER_READ
 
 	for i := 1; i <= 1000; i++ {
diff --git a/internal/tui/dashboard/bubbles.go b/internal/tui/dashboard/bubbles.go
index e6e2909..f50eba8 100644
--- a/internal/tui/dashboard/bubbles.go
+++ b/internal/tui/dashboard/bubbles.go
@@ -1,11 +1,12 @@
 package dashboard
 
 import (
+	"cmp"
 	"fmt"
 	"hash/fnv"
 	"image/color"
 	"math"
-	"sort"
+	"slices"
 	"strings"
 	"unicode/utf8"
 
@@ -422,8 +423,8 @@ func (c *bubbleChart) renderBubblesToGrid(grid [][]bubbleCell, width, height int
 	for idx := range c.nodes {
 		order = append(order, idx)
 	}
-	sort.Slice(order, func(i, j int) bool {
-		return c.nodes[order[i]].radius < c.nodes[order[j]].radius
+	slices.SortFunc(order, func(a, b int) int {
+		return cmp.Compare(c.nodes[a].radius, c.nodes[b].radius)
 	})
 	if c.selected >= 0 && c.selected < len(c.nodes) {
 		filtered := order[:0]
@@ -641,13 +642,13 @@ func buildBubbleTargets(data []bubbleDatum, metric bubbleMetric, width, height i
 	if len(filtered) == 0 {
 		return nil
 	}
-	sort.Slice(filtered, func(i, j int) bool {
-		vi := bubbleValue(filtered[i], metric)
-		vj := bubbleValue(filtered[j], metric)
-		if vi != vj {
-			return vi > vj
+	slices.SortFunc(filtered, func(a, b bubbleDatum) int {
+		va := bubbleValue(a, metric)
+		vb := bubbleValue(b, metric)
+		if va != vb {
+			return cmp.Compare(vb, va)
 		}
-		return filtered[i].Label < filtered[j].Label
+		return cmp.Compare(a.Label, b.Label)
 	})
 	if len(filtered) > bubbleMaxItems {
 		filtered = filtered[:bubbleMaxItems]
diff --git a/internal/tui/dashboard/files.go b/internal/tui/dashboard/files.go
index f24c87c..df850ab 100644
--- a/internal/tui/dashboard/files.go
+++ b/internal/tui/dashboard/files.go
@@ -1,9 +1,9 @@
 package dashboard
 
 import (
+	"cmp"
 	"path/filepath"
 	"slices"
-	"sort"
 	"strconv"
 
 	"ior/internal/statsengine"
@@ -425,11 +425,11 @@ func aggregateFilesByDir(files []statsengine.FileSnapshot) []DirSnapshot {
 		out = append(out, s)
 	}
 
-	sort.Slice(out, func(i, j int) bool {
-		if out[i].Accesses != out[j].Accesses {
-			return out[i].Accesses > out[j].Accesses
+	slices.SortFunc(out, func(a, b DirSnapshot) int {
+		if a.Accesses != b.Accesses {
+			return cmp.Compare(b.Accesses, a.Accesses)
 		}
-		return out[i].Dir < out[j].Dir
+		return cmp.Compare(a.Dir, b.Dir)
 	})
 	return out
 }
diff --git a/internal/tui/dashboard/icicle.go b/internal/tui/dashboard/icicle.go
index 92c4834..768783b 100644
--- a/internal/tui/dashboard/icicle.go
+++ b/internal/tui/dashboard/icicle.go
@@ -1,10 +1,11 @@
 package dashboard
 
 import (
+	"cmp"
 	"fmt"
 	"math"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strings"
 
 	"ior/internal/statsengine"
@@ -169,13 +170,13 @@ func sortedIcicleChildren(node *icicleNode, metric bubbleMetric) []*icicleNode {
 	for _, child := range node.children {
 		out = append(out, child)
 	}
-	sort.Slice(out, func(i, j int) bool {
-		vi := icicleValue(out[i], metric)
-		vj := icicleValue(out[j], metric)
-		if vi != vj {
-			return vi > vj
+	slices.SortFunc(out, func(a, b *icicleNode) int {
+		va := icicleValue(a, metric)
+		vb := icicleValue(b, metric)
+		if va != vb {
+			return cmp.Compare(vb, va)
 		}
-		return out[i].name < out[j].name
+		return cmp.Compare(a.name, b.name)
 	})
 	return out
 }
diff --git a/internal/tui/dashboard/treemap.go b/internal/tui/dashboard/treemap.go
index 7193952..dd62d13 100644
--- a/internal/tui/dashboard/treemap.go
+++ b/internal/tui/dashboard/treemap.go
@@ -1,10 +1,11 @@
 package dashboard
 
 import (
+	"cmp"
 	"fmt"
 	"image/color"
 	"math"
-	"sort"
+	"slices"
 	"strings"
 	"unicode/utf8"
 
@@ -131,11 +132,11 @@ func buildSyscallTreemapItems(snap *statsengine.Snapshot, metric bubbleMetric) [
 	if len(items) == 0 {
 		return nil
 	}
-	sort.Slice(items, func(i, j int) bool {
-		if items[i].Value != items[j].Value {
-			return items[i].Value > items[j].Value
+	slices.SortFunc(items, func(a, b syscallTreemapItem) int {
+		if a.Value != b.Value {
+			return cmp.Compare(b.Value, a.Value)
 		}
-		return items[i].Name < items[j].Name
+		return cmp.Compare(a.Name, b.Name)
 	})
 	if len(items) > maxSyscallTreemapItems {
 		items = items[:maxSyscallTreemapItems]
@@ -174,11 +175,11 @@ func buildFilesTreemapItems(snap *statsengine.Snapshot, metric bubbleMetric) []s
 	if len(items) == 0 {
 		return nil
 	}
-	sort.Slice(items, func(i, j int) bool {
-		if items[i].Value != items[j].Value {
-			return items[i].Value > items[j].Value
+	slices.SortFunc(items, func(a, b syscallTreemapItem) int {
+		if a.Value != b.Value {
+			return cmp.Compare(b.Value, a.Value)
 		}
-		return items[i].Name < items[j].Name
+		return cmp.Compare(a.Name, b.Name)
 	})
 	if len(items) > maxSyscallTreemapItems {
 		items = items[:maxSyscallTreemapItems]
@@ -217,11 +218,11 @@ func buildProcessesTreemapItems(snap *statsengine.Snapshot, metric bubbleMetric)
 	if len(items) == 0 {
 		return nil
 	}
-	sort.Slice(items, func(i, j int) bool {
-		if items[i].Value != items[j].Value {
-			return items[i].Value > items[j].Value
+	slices.SortFunc(items, func(a, b syscallTreemapItem) int {
+		if a.Value != b.Value {
+			return cmp.Compare(b.Value, a.Value)
 		}
-		return items[i].Name < items[j].Name
+		return cmp.Compare(a.Name, b.Name)
 	})
 	if len(items) > maxSyscallTreemapItems {
 		items = items[:maxSyscallTreemapItems]
diff --git a/internal/tui/flamegraph/model.go b/internal/tui/flamegraph/model.go
index a7b26f8..0552a4f 100644
--- a/internal/tui/flamegraph/model.go
+++ b/internal/tui/flamegraph/model.go
@@ -1,11 +1,11 @@
 package flamegraph
 
 import (
+	"cmp"
 	"encoding/json"
 	"fmt"
 	"image/color"
 	"slices"
-	"sort"
 	"strings"
 	"time"
 
@@ -727,8 +727,8 @@ func framesAtDepthFiltered(frames []tuiFrame, depth int, include map[int]bool) [
 			indices = append(indices, idx)
 		}
 	}
-	sort.Slice(indices, func(i, j int) bool {
-		return frames[indices[i]].Col < frames[indices[j]].Col
+	slices.SortFunc(indices, func(a, b int) int {
+		return cmp.Compare(frames[a].Col, frames[b].Col)
 	})
 	return indices
 }
@@ -878,19 +878,19 @@ func (m Model) visibleTraversalOrder() []int {
 		}
 		indices = append(indices, idx)
 	}
-	sort.Slice(indices, func(i, j int) bool {
-		left := m.frames[indices[i]]
-		right := m.frames[indices[j]]
+	slices.SortFunc(indices, func(a, b int) int {
+		left := m.frames[a]
+		right := m.frames[b]
 		if left.Depth != right.Depth {
-			return left.Depth < right.Depth
+			return cmp.Compare(left.Depth, right.Depth)
 		}
 		if left.Col != right.Col {
-			return left.Col < right.Col
+			return cmp.Compare(left.Col, right.Col)
 		}
 		if left.Row != right.Row {
-			return left.Row < right.Row
+			return cmp.Compare(left.Row, right.Row)
 		}
-		return indices[i] < indices[j]
+		return cmp.Compare(a, b)
 	})
 	return indices
 }
diff --git a/internal/tui/flamegraph/renderer.go b/internal/tui/flamegraph/renderer.go
index f9f6a89..12e5f8e 100644
--- a/internal/tui/flamegraph/renderer.go
+++ b/internal/tui/flamegraph/renderer.go
@@ -1,11 +1,12 @@
 package flamegraph
 
 import (
+	"cmp"
 	"fmt"
 	"hash/fnv"
 	"image/color"
 	"math"
-	"sort"
+	"slices"
 	"strings"
 	"unicode/utf8"
 
@@ -129,11 +130,11 @@ func allocateChildWidths(children []*snapshotNode, parentTotal uint64, span int)
 	// If proportional rounding culled every child, surface top contributors so
 	// the user can still navigate beyond the root frame.
 	if used == 0 {
-		sort.Slice(items, func(i, j int) bool {
-			if items[i].total == items[j].total {
-				return items[i].idx < items[j].idx
+		slices.SortFunc(items, func(a, b childWidth) int {
+			if a.total != b.total {
+				return cmp.Compare(b.total, a.total)
 			}
-			return items[i].total > items[j].total
+			return cmp.Compare(a.idx, b.idx)
 		})
 		visible := min(span, len(items))
 		for i := 0; i < visible; i++ {
@@ -334,8 +335,8 @@ func buildRenderRows(frames []tuiFrame, width, rowOffset, maxRow, barHeight, ava
 	rows := make([]string, 0, (maxRow-rowOffset+1)*barHeight)
 	for row := maxRow; row >= rowOffset; row-- {
 		framesAtRow := rowsByDepth[row]
-		sort.Slice(framesAtRow, func(i, j int) bool {
-			return framesAtRow[i].frame.Col < framesAtRow[j].frame.Col
+		slices.SortFunc(framesAtRow, func(a, b indexedFrame) int {
+			return cmp.Compare(a.frame.Col, b.frame.Col)
 		})
 		for repeat := 0; repeat < barHeight; repeat++ {
 			showLabels := repeat == barHeight/2
@@ -680,8 +681,8 @@ func compactMatchRoots(frames []tuiFrame, matchSet map[int]bool) []matchRoot {
 			total: frames[idx].Total,
 		})
 	}
-	sort.Slice(roots, func(i, j int) bool {
-		return len(roots[i].path) < len(roots[j].path)
+	slices.SortFunc(roots, func(a, b matchRoot) int {
+		return cmp.Compare(len(a.path), len(b.path))
 	})
 	merged := make([]matchRoot, 0, len(roots))
 	for _, candidate := range roots {
diff --git a/internal/tui/pidpicker/proclist.go b/internal/tui/pidpicker/proclist.go
index 20e580d..73ff209 100644
--- a/internal/tui/pidpicker/proclist.go
+++ b/internal/tui/pidpicker/proclist.go
@@ -2,11 +2,12 @@ package pidpicker
 
 import (
 	"bytes"
+	"cmp"
 	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -50,8 +51,8 @@ func scanProcessesFrom(procRoot string) ([]ProcessInfo, error) {
 		processes = append(processes, process)
 	}
 
-	sort.Slice(processes, func(i, j int) bool {
-		return processes[i].Pid < processes[j].Pid
+	slices.SortFunc(processes, func(a, b ProcessInfo) int {
+		return cmp.Compare(a.Pid, b.Pid)
 	})
 	return processes, nil
 }
@@ -145,8 +146,8 @@ func scanThreadsFrom(procRoot string, pid int) ([]ProcessInfo, error) {
 		threads = append(threads, thread)
 	}
 
-	sort.Slice(threads, func(i, j int) bool {
-		return threads[i].Pid < threads[j].Pid
+	slices.SortFunc(threads, func(a, b ProcessInfo) int {
+		return cmp.Compare(a.Pid, b.Pid)
 	})
 	return threads, nil
 }
@@ -209,11 +210,11 @@ func scanAllThreadsFrom(procRoot string) ([]ProcessInfo, error) {
 	}
 	wg.Wait()
 
-	sort.Slice(threads, func(i, j int) bool {
-		if threads[i].Pid == threads[j].Pid {
-			return threads[i].ParentPID < threads[j].ParentPID
+	slices.SortFunc(threads, func(a, b ProcessInfo) int {
+		if a.Pid != b.Pid {
+			return cmp.Compare(a.Pid, b.Pid)
 		}
-		return threads[i].Pid < threads[j].Pid
+		return cmp.Compare(a.ParentPID, b.ParentPID)
 	})
 	return threads, nil
 }
diff --git a/internal/types/generated_types.go b/internal/types/generated_types.go
index 63c4319..ff3ed02 100644
--- a/internal/types/generated_types.go
+++ b/internal/types/generated_types.go
@@ -338,7 +338,7 @@ func (o *OpenEvent) GetTime() uint64 {
 }
 
 var poolOfOpenEvents = sync.Pool{
-	New: func() interface{} { return &OpenEvent{} },
+	New: func() any { return &OpenEvent{} },
 }
 
 func NewOpenEvent(raw []byte) *OpenEvent {
@@ -405,7 +405,7 @@ func (n *NullEvent) GetTime() uint64 {
 }
 
 var poolOfNullEvents = sync.Pool{
-	New: func() interface{} { return &NullEvent{} },
+	New: func() any { return &NullEvent{} },
 }
 
 func NewNullEvent(raw []byte) *NullEvent {
@@ -473,7 +473,7 @@ func (f *FdEvent) GetTime() uint64 {
 }
 
 var poolOfFdEvents = sync.Pool{
-	New: func() interface{} { return &FdEvent{} },
+	New: func() any { return &FdEvent{} },
 }
 
 func NewFdEvent(raw []byte) *FdEvent {
@@ -542,7 +542,7 @@ func (r *RetEvent) GetTime() uint64 {
 }
 
 var poolOfRetEvents = sync.Pool{
-	New: func() interface{} { return &RetEvent{} },
+	New: func() any { return &RetEvent{} },
 }
 
 func NewRetEvent(raw []byte) *RetEvent {
@@ -611,7 +611,7 @@ func (n *NameEvent) GetTime() uint64 {
 }
 
 var poolOfNameEvents = sync.Pool{
-	New: func() interface{} { return &NameEvent{} },
+	New: func() any { return &NameEvent{} },
 }
 
 func NewNameEvent(raw []byte) *NameEvent {
@@ -679,7 +679,7 @@ func (p *PathEvent) GetTime() uint64 {
 }
 
 var poolOfPathEvents = sync.Pool{
-	New: func() interface{} { return &PathEvent{} },
+	New: func() any { return &PathEvent{} },
 }
 
 func NewPathEvent(raw []byte) *PathEvent {
@@ -749,7 +749,7 @@ func (f *FcntlEvent) GetTime() uint64 {
 }
 
 var poolOfFcntlEvents = sync.Pool{
-	New: func() interface{} { return &FcntlEvent{} },
+	New: func() any { return &FcntlEvent{} },
 }
 
 func NewFcntlEvent(raw []byte) *FcntlEvent {
@@ -818,7 +818,7 @@ func (d *Dup3Event) GetTime() uint64 {
 }
 
 var poolOfDup3Events = sync.Pool{
-	New: func() interface{} { return &Dup3Event{} },
+	New: func() any { return &Dup3Event{} },
 }
 
 func NewDup3Event(raw []byte) *Dup3Event {
@@ -886,7 +886,7 @@ func (o *OpenByHandleAtEvent) GetTime() uint64 {
 }
 
 var poolOfOpenByHandleAtEvents = sync.Pool{
-	New: func() interface{} { return &OpenByHandleAtEvent{} },
+	New: func() any { return &OpenByHandleAtEvent{} },
 }
 
 func NewOpenByHandleAtEvent(raw []byte) *OpenByHandleAtEvent {