Use main’s shared canonical base64 schema and lifetime/UID facts. Consolidate traced ownership attribution with the strict PID/path policy, preserving exact ps arguments, thread-group boundaries and both historical-PID controls. Remove superseded schemas, classifiers and absence controls; declare alias and same-process attribution gaps. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)