Where each plugin looks.

A name marked “from what you supply” relies on something you give it, like a snapshot or an export.

First Hour reads reports, so it is not on the map.

Rave’s editorial reading of the signed entries.

• The Mac itself: arrived, gone, traces
• A file: traces
• An app or extension: arrived, gone, traces
• A project: arrived, gone, traces
• A secret: set up, arrived, gone, traces
• A coding agent: arrived, now, gone, traces
• A directory account: set up, arrived, gone, traces

1. A plugin that can see a removal directly. An uninstalled app, a deleted launch item, a file in the Trash, a process that ended. Today the only way to see that something is gone is to compare two snapshots you dated yourself.
2. Anything about traces. A launch item that points at a program that no longer exists, a hook that names a server that was removed, a port held open by an app that was uninstalled.
3. When things arrived. We can see when a download arrived. We cannot see when an app, an extension, a hook or a repo did.
4. What actually ran. No plugin here collects execution events. Dependency Autopsy matches execution records you supply, but cannot verify them.
5. Local user accounts. Nothing here reads account creation, logins, privilege changes or deletions.
6. Network beyond open ports: connections, DNS, what left the Mac, which networks it joined.

A dash is a plugin we want. A filled place needs a reason beyond doing the same thing another way.