Composition notes

• Three grains, one page: control = section (context), finding = row (owns the SLA clock, status, and reasons), occurrence = evidence line (count + lastSeen + detail, never its own clock). The data model doesn't change — qdash's finding_key = v2:{control}:{scope_kind}:{scope_id} is already the finding fingerprint; only the page's grain moves.
• The ×200 case is the argument: one Unapproved tool use finding with 200 tool calls, reclassified medium→high on magnitude. Per-instance clocks would report 200 breaches from one root cause and demand 200 identical reasons.
• Recurrence is honest: "simulate: new occurrence" on the resolved paste-site condition re-opens it at 35d against a 30d target — instantly past SLA, because the original detection stays the exposure anchor. A fix that didn't hold never earns a fresh clock.
• Occurrences roll up; dispositions audit: the audit record shows only human/system verbs — 200 occur rows would drown it. Evidence shows the recent occurrences with their detail lines. Units come from a per-control noun map (tool calls, connections, opens, installs) — the fix for qdash c5's "N violations" / hardcoded-units threads.
• qdash's decision vocabulary maps onto the five verbs: investigate / assign_owner → acknowledge · accept_risk → exception · open_ticket → escalate · block_* → enforce · approve_destination → a control edit, not a finding verb. snoozed has no successor — snooze is an exception without a reason or expiry, and this revision deliberately kills it.
• Not mocked, recorded as product requirements: URL-addressable filters (?control= ?sev= ?q= deep links from six pages), auto-expanding the group a deep link targets, and the flat per-occurrence view (belongs one level down, as this page's drill — not a peer toggle).
• Machinery: state machine · rubric · findings → SLA · feeds the SLA report.