Checkout incident threshold

A root cause requires two independent, time-correlated event streams plus a prediction that is observed after an operator-controlled change. Otherwise report ranked unresolved hypotheses and next discriminating observations.