A local-first Windows telemetry investigation tool: evidence first, claims second,
explanation last. Monitor an explicitly authorized evidence workspace, receive
notifications about meaningful deterministic results, and trace each claim back to
its original bytes. Manual JSONL import remains available for testing and fallback.