docs(walkthroughs): document the area tours and why findings close and reopen

docs/content/import_data/import_intro/reimport.md

@@ -81,6 +81,21 @@ If you want a Risk Accepted or Duplicate Finding to become Active again, you nee
 
 The **Scan Date** field on the Reimport form starts empty. Left empty, each Finding that the Reimport creates keeps the date from the report (or today's date if the report has none). If you select a Scan Date, it is applied to every Finding the Reimport creates. Findings that already exist in the Test keep their dates either way.
 
+## Why Findings Close and Reopen
+
+A Finding that keeps closing and coming back is usually reimport doing exactly what it was asked to, on data that does not match what the user expects. The evidence is on two pages:
+
+* the **Import History** on the Test page counts the Findings each Reimport **closed** and **reactivated** (see [Actions](#actions));
+* the Finding's **Notes** say which Reimport changed it: "Mitigated by *scan type* re-upload." when a Reimport closed it, and "Re-activated by *scan type* re-upload." when one reopened it. A Finding closed by hand has neither note.
+
+Three causes account for most cases:
+
+* **A partial scan reimported into a Test that holds a full one.** Close Old Findings is on by default for Reimport, so every Finding the partial scan did not report is closed, and reopened again when the next full scan reports it. Reimport each scope into its own Test, or turn off **Close Old Findings** for the partial run.
+* **A Finding closed by hand while the scanner still reports it.** Closing a Finding does not tell the scanner anything: the next Reimport finds it in the report and reopens it. To keep a Finding closed while the scanner still reports it, mark it **False Positive**, **Out of Scope** or **Risk Accepted** instead. Reimport never reopens a Finding with one of those statuses.
+* **A Finding whose location moved.** When a line number or file path is part of how Reimport matches a tool's Findings, a Finding that moves no longer matches: the old one is closed and an identical new one is created. See [Reimport Deduplication](#reimport-deduplication) for how to match on stable fields, and Track Findings as Locations Change in DefectDojo Pro.
+
+For a scanner that reports every Finding on every run and is triaged elsewhere, **Do Not Reactivate** keeps Closed Findings closed (see [Reopen Findings](#reopen-findings)).
+
 ## Opening the Reimport form
 
 The **Re\-Import Findings** form can be accessed on any Test page, under the **⚙️Gear** drop\-down menu.

docs/content/navigation/PRO__walkthroughs.md

@@ -1,6 +1,6 @@
 ---
 title: "In-App Walkthroughs"
-description: "Guided, step-by-step tours of the DefectDojo Pro UI: the App Tour, the first-visit offer, and turning the offer off per user"
+description: "Guided, step-by-step tours of the DefectDojo Pro UI: the App Tour, the tours for each area, the first-visit offer, and turning the offer off per user"
 weight: 9
 audience: pro
 ---
@@ -58,6 +58,24 @@ If the sidebar is collapsed to its icon rail, the tour expands it for the sideba
 
 On a phone-sized screen the card becomes a sheet along the bottom of the screen, or along the top when the outlined area is in the lower half, so it never covers what it points at.
 
+## Tours by area
+
+Beyond the App Tour, each area that people ask about most has its own tour. A tour is listed in the lightbulb under **This Page** on the pages it covers, and the ones marked *General* are also listed everywhere else. Like the App Tour, each one works with whatever you can see: it picks a real record to walk through, and skips the steps that need one when there is none. A step that needs a permission you do not have is skipped too.
+
+| Tour | Listed on | What it covers | Who sees it |
+|---|---|---|---|
+| **Why Findings Close and Reopen** | A Test and a Finding | The Import History counts, the notes a Reimport writes, the three causes behind most reopened Findings, the statuses a Reimport never reopens, and how Reimport matching works | Anyone who can view the Test. The last step, Matching Configuration, needs permission to view Dedupe Pools |
+| **Organizations, Assets, Engagements and Tests** (or Product Types, Products, Engagements and Tests) | Organization, Asset, Engagement and Test pages; *General* | How the four levels fit together, from the Organization list down to a Test's Import History, and where an import puts its Test | Anyone. The import step needs permission to import scan results |
+| **Finding Statuses, SLAs and Risk Acceptance** | The Findings lists, Risk Accepted Findings, Risk Acceptances and a Finding | What each status means, where an SLA deadline comes from, closing without a fix, and the two lists that show accepted risk | Anyone. The Risk Acceptances steps need permission to view risk acceptances |
+| **The Findings List** | Every Findings status list | Filters and sort, Keyword Search, saved Views, Columns, and selecting Findings for bulk actions | Anyone. Views and Columns are skipped when page layouts are locked |
+| **Exporting Findings** | Every Findings list | That an export follows the list's filters, the Export menu and its formats, and choosing the fields | Anyone who can view Findings |
+| **API Access** | The API token page; *General* | Where the API key is, the header it goes in, regenerating it, getting it from a script, the API docs, and automating against `/api/v2/` | Anyone |
+| **Reports** | The Reporting pages | Templates, blocks and themes, generating a report, output formats, and finding the file under Generated Reports | Users who can view generated reports, when Reporting is turned on |
+| **SSO and Login** | Authorization and the login and provider settings pages | Configured versus enabled providers, the password and auto-redirect switches, creating users on first login, keeping a way back in, and why a new SSO user sees nothing yet | Users who can view identity providers. The login switches need permission to change them |
+| **Classic Jira or the Jira Connector** | The Downstream connector and Jira pages | Which Jira integration is which, whether to move to the connector, and which push to use on a Finding | Users who can view integrations, when Downstream connectors are turned on |
+| **Locations** | The Locations pages | What replaced Endpoints, where the Locations lists are, and a Location's status, the Assets that reference it and its open Findings | Users who can view Locations, when Locations are turned on |
+| **Upstream Connectors** | The Upstream connector and records pages | Configured and available connectors, a connector's unmapped and mapped records, and its Operations history | Users who can view connectors |
+
 ## The first-visit offer
 
 The first time a user opens **Home** on a desktop-sized screen, a small card just above the lightbulb offers the App Tour. It is an offer, not a takeover, and the page stays usable behind it: