Process launch telemetry identifies the program that ran, but it cannot show whether that program created a payload, replaced a configuration file, or renamed a staged artifact. This issue adds a file activity thin slice for Linux, Windows, and macOS while retaining the durable process identity established earlier in the course.
File operations need process identity
A PID is only locally unique for a short period and may be reused after exit. Every file fixture therefore carries
process.uid, allowing storage and investigation code to join a create or rename operation to the correct launch record. The join is more important than collecting every possible file callback.
