When does a finding become a confirmed problem?

A finding becomes a case, a confirmed problem, the moment triage rules the claim sound, or a person opens it by hand. Triage is one autonomous pass over the finding’s own claim, checked against the evidence and nothing else. It reaches one of three verdicts. Sound means the claim holds, so a case opens. Artifact means the problem is with the measurement rather than the agent, so the finding closes and the miss is logged against the detector that fired. Unclear means the evidence doesn’t settle it, so the finding closes too.

There’s no holding queue for maybe. A finding ruled artifact or unclear isn’t gone for good though: if the same cause keeps firing, it comes back for another look under the recurrence rule, and a case opens the moment triage, or a person, calls it real.

A frustration finding, like a high-confidence secret leak, is ruled when it is filed and opens its case without triage. For frustration, the finding’s claim is a rise in a call site’s rate of frustrated conversations, and those numbers are the evidence.