v0.21.8 — Comprehensive Audit Fixes

What's Fixed

Engine / Data Pipeline

• CPU busy % underflow — uint64 subtraction could wrap on counter reset, producing absurd percentages
• Sentinel delta spike (5 probes) — synflood, portscan, dnsmon, connrate, outbound all had a bug where counter reset caused full cumulative count to be treated as single-tick delta, triggering false alerts
• Division by zero in TCP RTT/ConnLat sort when Count==0 — produced NaN/Inf breaking sort order
• Conntrack Exhaustion pattern too permissive — random packet drops alone could incorrectly trigger conntrack exhaustion diagnosis (MinMatch 1→2)
• Port scan duration now computed from BPF first_ns timestamp — was always showing "0s"

UI / UX

• ANSI column misalignment in IO device table — bar() ANSI codes shifted subsequent columns
• Dead Enter drilldown hint removed from CGroups page (was never implemented)
• Explain panel no longer shows overview glossary on unrelated pages (Timeline, Events, Thresholds, DiskGuard, Logs, Services, Diagnostics)
• Sessions stub hidden from Security page (was showing "not yet implemented")
• Dead code removed: unused healthBadge function
• Consistent footers on CGroups and Events pages using pageFooter()

README

• Updated all version references and stale counts (16 pages, 6 layouts, 23 patterns, 47+ evidence checks, 14 security sections)
• Added Intel page (X) and F5/F6 layouts to documentation
• Fixed default interval (3s not 1s) and history (600 not 300)
• Fixed Ctrl+D save layout shortcut documentation