What the Monitoring figures are made of.

The measured half of our public test set rests on cases we wrote and mark as ours in the data: six suspicious typologies (structuring, rapid movement, dormant burst, round-tripping, cash-intensive, layering fan-out) and, deliberately, their six benign cases. Payroll moves money fast. A market season looks like a dormant account waking. A loan instalment repeats the same amount to the last unit. Rents cluster like structuring. What tells each benign case apart from its typology is in the data, history and validity period, and a test checks that structure. The label alone never carries it.

A set without these benign cases would flatter each scenario, because any scenario looks good when the benign cases are easy. The cases are what the measurement is for, and the findings above say which scenario fires on which case, as measured.

The generated half comes from the written cases under a stated seed, the fixed number that starts the random draw. The variation obeys one rule above all others. It must not undo the nature it varies. Structuring deposits stay under the reporting threshold. Round-trip amounts and loan instalments move by one common factor, so their equal amounts stay equal. Round savings amounts stay round. Each variant passes the case checks before it is added.

The two halves are never blended. The set holds them in two blocks, each with its source in the data. When a scenario scores better on the generated half than on the written one, the page shows that gap. It does not average it away.

Two scenarios need a scale to turn a raw number into a score: the amount scale and the velocity scale. Both are assumed values with stated bounds and a stated source, written in one file with the reason for each. Neither is a constant buried in the code. Change a scale and the public test set must be measured again and signed again, and the content hash makes a silent retune impossible.

Each rate comes with its Wilson confidence interval at 95 percent (the range the true rate is likely to sit in) and the count it was measured on. Below twenty observations a rate is noted, and no number is quoted for it. Recall is the share of true suspicious cases a scenario catches. On your own history the tool refuses recall outright with fewer than five confirmed suspicious cases. It prints the refusal and no figure.

The threshold, the score at which a scenario fires, sits on one grid shared by each scenario, 0.50 to 1.00 in steps of 0.01. A case counts as an alert when its score is at or above the threshold. The comparison is inclusive, so the strictest threshold still means something for a scenario that scores exactly 1.