Hi Craig - sorry for keeping you waiting a bit here.  Interesting case though and makes totally sense.

Concerning hysteresis - I had to take a good look also again to make sure.  But in essence, hysteresis does function on discrete levels but there are some particular things about it.

Now, I believe I might have found a way to set it up that might get close to what you are looking for.

Set 'Established' to NORMAL in the alarm template (GREEN)

Set 'Idle' to CRITICAL HI in the alarm template (RED)

Set 'Active' to MAJOR HI in the alarm template (YELLOW)

Now also put HYST OFF on x seconds and check the box for CRITICAL HIGH (so it will only apply to the CRITICAL HIGH limit)

What you should be getting now is that when it goes from ESTABLISHED to IDLE, it will create a critical alarm.  When it goes from IDLE to ACTIVE, it will not create a major alarm, and will wait for x seconds. Only when it stays in ACTIVE for longer than x seconds, it will create a major alarm for the state ACTIVE, replacing the critical alarm.

I have no idea when it goes to IDLE and then goes into ACTIVE, how long it is there in that mode, before it goes back to IDLE again.  But for what you want, you need x to be high enough so that it doesn't update the alarm before going back to IDLE.  Then again, keep in mind that this x also applies when going from IDLE to ESTABLISHED, so you do not want it too high.

But probably it actually goes from IDLE to ACTIVE, and then to ESTABLISHED (not from ACTIVE to IDLE and then to ESTABLISHED).  In that case, it will depend on how long it was in that ACTIVE state before it went to ESTABLISHED.  Example: if you set it to 10 seconds, and it goes from IDLE to ACTIVE, and then after 6 seconds it goes from ACTIVE to ESTABLISHED, then it would take 4 seconds to clear the alarm.

I had to test this and see if we could somehow make it what you are after, so I hope I got it right.  If not, maybe this helps to further play around.