TAIL: Threshold-Adjacent Incident Log