docs(reports): Kaiten/STD timeline follow-up and API review addendum

[rdmmf]

Follow-up analysis requested on doc/reports/mirai7_diff_7b70_vs_botnet.md, driven entirely through the BSimVis API.

New reports

• doc/reports/mirai7_kaiten_timeline.md — the analysis
• doc/reports/api_pivoting_review_followup.md — API usability addendum

Findings

• The eight 2026-02-09 *net samples carry an identical 59-symbol malware set across 8 architectures — one cross-compiled build. The family is two generations (2025-04, 2026-02), not a gradient.
• The same-ISA A vs net diff (both MIPS:LE) puts 36 of 37 malware functions at similarity 1.000; only processCmd changed (967 → 2153 features). This corrects the earlier report — its sockprintf +316 %, main +78 % and print +32 % deltas were SuperH4 decompilation artefacts.
• The command table has 29 entries when read off MIPS; SuperH4 recovers 13. Five game-title commands (CSGO, GTAV, TF2, R6-DROP, R6-LAG) were previously invisible.
• DNSw is a flood handler, dispatched as DNS <target> <port> <secs> — not DNS-based C2 resolution.
• C2 lives in a .data char * array (commServer), default port 6982, confirmed unreachable through the API.

API issues raised

Issue	Impact
avg_features on matched diff rows is max(), not a mean	hides growth on the rows that changed
functions_metadata uses name, search endpoints use function_name	silent None, reads as "diff has no names"
Matched rows can pair differently-named functions unflagged	fabricates renames (SendSTD_HEX → SendHOME1 at 1.000)
Score penalises containment	an ancestor scores 0.485, an unrelated fork 0.625
diff?table= carries no score	extra round trip
No data-section / DAT_ symbol read	the family's top IOC is unreachable

./scripts/wt-test.sh — 278/278 passed.

🤖 Generated with Claude Code

[rdmmf]

The reports on this branch are the background for #28 — a proposal to turn the timeline built by hand here into a family evolution view in BSimVis.

Reports referenced there:

• doc/reports/mirai7_kaiten_timeline.md — the sankey and the analysis behind it
• doc/reports/mirai7_diff_7b70_vs_botnet.md — the two-sample version diff that started it
• doc/reports/mirai7_family_report.md — corpus overview
• doc/reports/api_pivoting_review.md + api_pivoting_review_followup.md — API usability findings

The rendered diagram (doc/reports/img/kaiten_sankey.png) is embedded in the issue from this branch, so the branch needs to stay alive for the image to resolve.

[rdmmf]

Added the same analysis for the Mirai side of the collection: doc/reports/mirai7_mirai_timeline.md.

The Kaiten method did not transfer. Only 4 of 164 Mirai files kept symbols, and those four use four different names for the same modules (attack_tcp_syn / attack_tcp_syn_aisuru / flood_syndata / udpplain_thread), so a symbol-set diff compares vocabularies rather than code. The analysis runs on similarity clusters instead, with symbol names used only as labels: 100 symbols → 101 clusters → 54 capabilities, reaching 80 otherwise-stripped samples.

What the clusters showed that names could not:

• xor_init and table_init share a cluster — a rename, not a new capability.
• mipsel's flood_* and nova.mipsel's *_thread cluster only with themselves — those forks rewrote the attack layer.
• The shared core (RNG, config table, checksums) is carried by 61–96 % of reachable samples; the attack layer and C2 resolver are fork-specific (15–20 %).
• Limit worth knowing: clusters resolve modules, not individual attack methods — one cluster holds ten attack_* variants that share a packet loop.

doc/reports/api_pivoting_review_followup.md gains a §4 with the API gaps this pass exposed — chiefly that finding those 4 symbolised files cost 164 calls and ~6 MB, that the clusters map is keyed by cluster_id while the drill-down wants cluster_uuid, and that clusters carry no first_seen, so the timeline is a client-side join.

./scripts/wt-test.sh — 278/278 passed.