Detect-learn is a product, not a disclaimer
Shipping a WAF in prevent on day one is how you earn a reputation for false positives. xorappsec’s modes exist because the unsupervised model is empty until it has seen your URLs.
Kindergarten after ten requests is not a bug. It means: keep learning. Graduate means: critical events are safe to prevent. Master and PhD require trusted sources — several of them — so one compromised laptop cannot become the source of truth.
The playground defaults to prevent-learn so a demo is dramatic. Production should start in detect-learn, watch /api/v1/events, add exceptions only for confirmed mistakes, then flip the asset. Start prevent at minimum-confidence: critical, then high.
Tuning suggestions are optional supervised learning. The engine learns without them. They just get you to Master faster.