Five GET rollup endpoints (techniques, by-identity, by-attacker, by-campaign, by-session) and the Navigator export (fleet + per-identity) now call into the TTPMixin methods. Rule catalogue endpoint still returns [] — backed by the RuleStore which lands at E.3.5/E.3.6.