pub fn derive_sessions(records: &[AuditRecord]) -> Vec<Session>Expand description
Group records into sessions, one per distinct branch_ref.
Branches are emitted in first-seen order (the order their first record appears in records), so
the result is deterministic. Each branch’s records are ordered by [order_branch], opened_unix
is the minimum unix on the branch, and action_count == records.len().
Honesty note (read this): the number of returned sessions is the number of distinct entry-point unlocks, which is only a proxy for the number of attackers — see the module docs. Shared credentials or one persistent actor across branches both defeat a naive head-count.