Expand offline review checks and fix relative output finalization

VALIDATION.txt

@@ -188,3 +188,44 @@ Die Erweiterung verarbeitet Archive ohne Ausführung enthaltener Programme.
 Unvollständige gzip-Streams werden als Verarbeitungsfehler ausgewiesen.
 Zusätzliche strukturierte Logkorrelation ist optional; der Batch-Helfer aktiviert sie nicht.
 Erkennungsgrenzen: FILESYSTEM_COVERAGE.txt. Validierung ist keine Clean-Garantie.
+
+
+SUPPLEMENTAL REVIEW CHECKS — 2026-10-05
+
+Version 1.0.2 adds ten low-severity Sigma review rules and eleven filesystem
+content checks, plus candidate web-tree file names and BLX configuration paths.
+The default Sigma catalog validates with 57 rules; public indicators remain
+246. Unverified additional indicators are kept in an optional private pack.
+
+All 151 tests passed with warnings treated as errors. Ruff lint, formatting and
+strict mypy passed. Positive and negative controls exercise each new Sigma rule
+on raw and decoded views. Filesystem tests cover original anomalous bytes,
+configuration path restrictions and suppression of an error-message lookalike
+inside a binary package. Eleven filesystem tests passed after increasing the
+stream overlap to 8 KiB for bounded patterns spanning a block boundary.
+
+An isolated installed package also validated all 57 rules. All 25 supplemental
+private indicator values matched raw and Base64-decoded text in a separate
+private check. This demonstrates matching behavior, not malicious attribution.
+
+Two existing configuration/program exports were rescanned: 5,361 and 5,319
+regular files, with no read errors and no hits from the added checks. Existing
+heuristic candidates remain separate from newly added checks. A retained larger
+snapshot inventory was compared against all 12 supplemental SHA-256 values:
+53,696 file hashes, no match. This inventory comparison did not reread the
+original larger archive and does not prove current system integrity.
+
+
+RELATIVE OUTPUT REGRESSION
+
+A real-data run completed analysis but failed while finalizing a relative output
+path. Preparation resolves paths internally; the CLI now resolves its preparation
+root before constructing relative provenance references. A regression verifies
+SUMMARY.txt and each manifest input root when --output is relative. All 152 tests
+then passed with warnings treated as errors; Ruff and strict mypy passed.
+
+The completed run's output was recovered only after every one of its 851 input
+inventory entries matched a freshly prepared copy. It processed 1,117,532 records:
+two missing-file review events, no supplemental IOC or file-hash hit. Status
+remains partial: ten binary-file read stops and 106,842 decoding failures, with
+no matching or inventory errors. These counts are not compromise indicators.