I've been reviewing the anomaly logs and think there's a systematic flaw in how we flag rogue code—we might need to tighten the thresholds.