Add process view

docs/PROTOCOL.md

@@ -53,6 +53,7 @@ Auth modes at handshake: public key (viewer), capability token / `pd1.` invite,
 | `queryData` | viewer | `{ chart, after, before, points, group, tier }` | Time series |
 | `getWeights` | viewer | see below | Metric Correlations / alert weights |
 | `queryLogs` | viewer* | see below | Anomaly / audit / journal lines |
+| `listProcesses` | viewer | sort / filter / q / limit | Live Linux `/proc` process table |
 | `getAllMetrics` | viewer | `{ format: json\|prometheus\|shell }` | Latest export |
 
 \* `queryLogs` method role is viewer so anomaly search works for all dialers; **audit** and **journal** sources require **admin** inside the handler.
@@ -84,6 +85,19 @@ REST parity: `GET /api/v*/weights`. Engine: `server/services/weights.js`.
 
 Journal is **enabled by default** on Linux (`PEARDATA_JOURNAL=0` to disable). Installer grants `systemd-journal` to the agent user. REST: `GET /api/v*/logs`. Engine: `server/services/logs.js`. UI: [user-guide/logs.md](../user-guide/logs.md).
 
+#### `listProcesses`
+
+| Arg | Notes |
+|-----|--------|
+| `sort` | `cpu` (default) \| `rss` \| `pid` \| `name` \| `io` \| `threads` \| `age` \| `fds` \| `state` |
+| `order` | `desc` (default) \| `asc` |
+| `filter` | `all` \| `running` \| `sleeping` \| `zombie` \| `stopped` \| `highcpu` \| `highmem` \| `hasio` \| `kernel` \| `user` |
+| `q` | Substring over pid / name / cmdline / user / cgroup |
+| `limit` / `offset` | Cap ≤2000 |
+| `pid` | Optional — return one process with detail fields (fds, exe, cwd, …) |
+
+Linux `/proc` only. Rates need two samples (~450ms cache). REST: `GET /api/v*/processes`. UI: [user-guide/processes.md](../user-guide/processes.md).
+
 ### Live subscriptions
 
 | Method | Role | Args |