Capture writev/readv payloads and mark sendfile bodies (tracepoint-only)

[shinagawa-web]

Part of v0.2.0 (#32). The tracepoint-only half of closing the #37 capture gaps — everything that does not need a kprobe. Sibling of #68 (which handles the one case that does: sendfile body bytes).

Problem

tinytap hooks write/read/sendto/recvfrom/sendmsg/recvmsg syscall tracepoints, but not writev/readv or sendfile. So:

• writev/readv — vectored I/O. The payload is in user space (the iovec buffers), so it's fully capturable; tinytap just doesn't hook it yet. Servers that write headers+body in one vectored call (Go net/http, some Node paths) lose those bytes today.
• sendfile — the body bytes are kernel-to-kernel and unreachable without a kprobe (that's Capture sendfile/splice body bytes via a TCP-send-path kprobe #68). But the metadata — byte count and the fds — comes straight off sys_enter_sendfile64. Capturing that lets the panel say "50 KiB body sent via sendfile (zero-copy, content not captured)" instead of dropping the exchange silently.

All of this stays within the existing tracepoint design (#8) — no vmlinux.h, no CO-RE, no kprobe.

Scope

• writev/readv content — hook sys_enter_writev / sys_exit_readv (and writev/readv counterparts). Walk the iovec array and sample bytes as the existing write/read paths do. Bound the iovec loop to a fixed max entry count for the verifier; log/flag when truncated.
• sendfile metadata — hook sys_enter_sendfile64 (+ sys_exit for the returned count). Emit an event carrying the out_fd and byte count, flagged as a zero-copy body with no captured content.
• Render — the detail/body view shows the writev/readv bytes like any other payload, and shows the sendfile marker (body: N bytes via sendfile — content not captured) so the limitation reads clearly rather than as missing data.
• Event schema: document any new syscall ids / flags in docs/event-schema.md.

Out of scope

• sendfile/splice body content — needs a TCP-path kprobe, tracked in Capture sendfile/splice body bytes via a TCP-send-path kprobe #68
• TLS — v0.4

Done when

• A response written via writev shows its body in the detail panel
• A static-file response sent via sendfile shows the body size and an explicit "content not captured" marker, not an empty/absent exchange
• New syscalls are reflected in docs/event-schema.md

Refs: #37 (gap discovery), #68 (the kprobe half), #35 (body view), #36 (payload cap).