A practical workflow for turning noisy logs into a short, testable suspect list—without outsourcing judgment to the model..