A detection engineer is writing a YARA-L multi-event rule that groups login events by user over a 1-hour match window. For each matched user, the SOC wants the outcome to report the single highest risk score observed among all correlated events in the window, so downstream alert triage can prioritize the worst observed behavior. Which outcome construction correctly produces this value?