The published companion snapshot contains 33 named YARA rules in 28 files, and every rule matched at least one object in the saved investigation material, while none matched the small local software baseline. A later, separate local review narrowed seven source rules after selected controls produced collisions; the revisions preserved all earlier artifact matches, but are not part of the published snapshot.

The wallet-agent rule initially matched marker-rich research prose, and requiring ELF magic at byte zero rejects that text fixture. It checks the header, not the executable's behavior.

The companion repository contains file-content rules and a parse-only JavaScript scanner, but it no longer includes the event rules or workspace-configuration rules: authentic endpoint logs and the original .vscode task and settings files were not available for replay.…