Reduced false positives by relaxing printer detection thresholds, made single placement warnings non-blocking, improved command burst tolerance, and kept repeated suspicious behavior detectable for real offenders.