Fixed the incident ack/resolve behavior.

tests/test_incidents.py

@@ -32,3 +32,8 @@ class IncidentTests(unittest.TestCase):
 
             self.assertEqual(applied_again["lifecycle_status"], "acknowledged")
             self.assertEqual(applied_again["note"], "checking vpn logs")
+
+    def test_incident_id_is_stable_when_evidence_changes(self):
+        first = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "windows"}]}, [])[0]
+        second = build_incidents([], {"alice": [{"score": 25, "reason": "new source ip", "stream_id": "windows"}]}, [])[0]
+        self.assertEqual(first["id"], second["id"])