Add host correlation and assurance coverage

docs/COMMAND_REFERENCE.md

@@ -103,6 +103,8 @@ enodia-sentinel list-detectors
 ```
 
 Prints the poll detectors and whether each is enabled by config.
+The list includes rarity state such as `first_seen`; that detector keeps its
+local baseline under `log_dir/first-seen.json`.
 
 ### `rules`
 
@@ -282,6 +284,9 @@ sharing a PID or a common ancestor — the web server or SSH session they descen
 from), with a **time-window fallback** for alerts that carry no live PID (FIM
 drift, package tamper, hidden modules). Each captured snapshot records an
 `incident_id`; the index lives in `incidents.json` under `log_dir`.
+If a correlation rule matches the incident's raw alert set, the incident record
+also carries a `correlations` list and may escalate severity without hiding the
+underlying snapshots.
 
 - `list` — incidents newest-first: id, last seen, severity, alert count, and the
   signatures involved.
@@ -383,7 +388,7 @@ endpoint, for cron/monitoring.
 
 Stable JSON contracts are documented in [SCHEMAS.md](SCHEMAS.md). Current v1
 IDs cover alert objects/snapshots, incident records/views/exports, status,
-response plans, and response audit JSONL records.
+integrity/hash-chain state, response plans, and response audit JSONL records.
 
 Exit code: