sigwood v0.2.4

Fixed

• scan vertical and horizontal findings now describe the time window that actually
  triggered them, not the whole loaded span. These scans fire when enough distinct ports
  or hosts appear inside a sliding window, but the reported evidence - connection count,
  scan-state ratio, top states, port-range entropy, and host velocity - was previously
  computed over every connection the pair exchanged across the entire log. A short scan
  burst buried in a long benign baseline between the same two hosts was therefore diluted:
  because severity and ranking are driven by the scan-state ratio, a real burst could be
  under-severitied and pushed down the report by the surrounding benign traffic. Evidence,
  severity, and rank now all reflect the triggering window. Block and slow scans are
  unchanged (their evidence was already window- and span-correct by design).

Changed

• The DNS detector's default surface threshold now matches its 1.8 high-entropy bar.
  On the measurement corpus, 87 of 105 DNS findings scored from 1.5 up to but not
  including 1.8; the 18 findings at or above 1.8 remain under the new default.
• The default hunt is now a curated set rather than every available detector. Fresh
  installs, omitted selection, --detect=, and --detect=default select aws, beacon, dns,
  scan, and syslog; duration remains runnable by name while its severity evidence is rebuilt.
  Reports and dry runs disclose that opt-in remainder. Explicit --detect=all and existing
  configs with detect = "all" are unchanged and continue to run everything. This is a
  quieter default, not a claim that detector logic became smarter.