How these notes are written
Evidence and interpretation stay apart
Evidence is what a tool or source returned. Interpretation is what I think it means. Each note keeps them in separate places, so a later reader can judge the evidence again.
Confidence is written in words
Low, medium or high, with one sentence on why. The reason matters more than the rating.
Samples are hashes only
Notes reference samples by SHA-256. No live links, no downloadable samples.
Every note ends with a next step
A note that leaves the reader stuck is unfinished.