Eight Minutes #2, discussed: the attacker's session read straight from the audit logs — the flag that fired, the pivot, the warnings deleted.