Update README and main.go to clarify spool archive path handling

Author: 0x4D31

README.md

@@ -56,7 +56,7 @@ Santa Spool → Watcher → Decoder → Rules Engine → Signal Generator → Sh
 **Spool lifecycle:**
 - Spool files with no detections are deleted after processing to keep Santa's spool from filling
 - Files that produced detections are archived to `santa.archive_dir` (default: `/var/lib/santamon/spool_hits`)
-- Signals include the originating spool file name so you can retrieve the archived protobuf if needed
+- Signals include the archived spool path when available so you can retrieve the protobuf if needed
 
 **Process Lineage:**
 - In-memory cache of recent process execution history

cmd/santamon/main.go

@@ -433,14 +433,11 @@ func runCommand() {
 				log.Printf("Processing file: %s", filePath)
 			}
 
-			spoolFileName := filepath.Base(filePath)
 			spoolArchivePath := ""
 			if cfg.Santa.ArchiveDir != "" {
-				spoolArchivePath = filepath.Join(cfg.Santa.ArchiveDir, spoolFileName)
-			}
-			spoolContext := map[string]any{
-				"spool_file": spoolFileName,
+				spoolArchivePath = filepath.Join(cfg.Santa.ArchiveDir, filepath.Base(filePath))
 			}
+			spoolContext := map[string]any{}
 			if spoolArchivePath != "" {
 				spoolContext["spool_archive_path"] = spoolArchivePath
 			}