Alerts

An alert is a row before it is an email. It is written in the same transaction as the event that caused it, so nothing about a failed delivery, an unreachable mail server, or an instance going to sleep mid-send can lose it.

Latency, honestly

Detection runs when an event arrives, because that is the only moment this service is reliably running — it sleeps after fifteen idle minutes. So an alert is not raised the instant a spike begins; it is raised on the next event that reaches a woken instance, and the wake itself takes about a hundred seconds. A spike that starts and stops entirely within a quiet period is never seen at all.