brutal. before anyone rushes to help, lock the timeline down: last clean signature, approval surface, extension or device changes, and whether this was key compromise vs malicious approval. if the root cause stays fuzzy, cleanup just creates a second blast radius.