Findings

On 100 cases declared before any run, every diagnoser saw the same evidence and was scored by the same harness. Where Katyayani and llama3 disagreed, Katyayani was right 41 times and llama3 2; the difference holds after correcting for every comparison made. A small model trained on real incidents beats general models reading the same data.

On servers from a machine group it never trained on, the learned detector is both more accurate and far quieter — the pairing that decides whether anyone keeps reading the alerts.

Trained from scratch on public security text, it composes answers from the passages Sati retrieved and cites one. It is worse than simple word overlap at copying identifiers, so every ID it writes is checked against its citation.