Graduate to prevent-learn

1. Run at least a day of real traffic in detect-learn. Blocking is off; events and learning still happen.
2. Open the Learn tab. Kindergarten / Primary / High School → keep waiting. Bachelor → review tuning suggestions.
3. Add trusted sources (office egress, CI). After minNumOfSources distinct identities agree, the benign baseline accelerates.
4. Confirm obvious attacks still show as high/critical in Events (SQLi, JNDI). If they do not, you have a decode or policy problem — do not flip prevent yet.
5. Set the asset mode to prevent-learn with minimum-confidence: critical, then high after a quiet week.
6. Set fail-open: false only after inspect p99 is healthy.

Longer write-up: Detect-learn is a product.