From raw records to candidates.
Spatial, temporal, semantic, behavioral, and cross-platform evidence are shown together.
Every flag has a reason.
Analysts can inspect account, platform, action, timing, and dimension values at record level.
Make the result reproducible.
The protocol locks the corpus, oracle, split, metrics, and output receipt before execution.