A threshold tells you a number crossed a line. The model tells you what that combination of readings usually means, how serious it is, and what to do in the next ten minutes.
Threshold detection is fast, cheap and predictable, so it owns the alarm. The model never sits between a hazard and the buzzer. It runs after the fact on readings that are ambiguous — which keeps response time deterministic and keeps inference cost proportional to real events rather than to uptime.
Sending every reading to a model would be expensive and would tell you nothing new for the 99% that are nominal. Analysis is triggered by a breach or by a pattern the deterministic layer flags as unusual, so the cost tracks incidents rather than sensor cadence.
Each analysis returns a severity score, a plain-language read of what the sensor combination suggests, and a recommended action. That is what an operator can use at 2am. The underlying values stay attached so an engineer can disagree with it later.
With enough baseline per device, the platform models where a channel is heading and flags escalation before the threshold is crossed. It is trained on that site's own readings, and predictions carry feedback so wrong calls actually improve the model rather than just being dismissed.
