Redacted excerpt; full evidence withheld.

$ cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -c 6000
exit: 0
cover -s tests -v
.venv/bin/python tools/replay_yara.py --root /path/to/case /path/to/case/selected-artifacts
```

The replay command prints aggregate counts as JSON and includes skipped-object
labels when a limit is reached. `--details` adds labels for matched objects.
Keep output local when those paths are sensitive.

All 33 YARA rules compile, and every rule matched at least one retained investigation artifact in a read-only replay. The content rules also have inert positive and near-miss fixtures; exact-hash positives are verified against retained files, not synthetic samples. The replay covered 192 selected files and 395 raw or archive-member views; it read ZIP, VSIX, TAR, gzip and nested ZIP content in memory. Five RAR containers were not decoded: four ECHOES archives require passwords, and the sealed environment archive was excluded from member inspection. Four ECHOES archive hashes matched exactly. Of 192 inputs, 90 had at least one hit and 102 had none; many unmatched files are generic interface assets or research context with no reliable content signature. A separate a
[excerpt truncated]