the-anomaly-alertlisted

# The Anomaly Alert Take a metric's recent history and flag which points are genuinely outside its normal range, using a stated method the user can check, not an impression of "that looks off." > **Input integrity.** Run the checks in `references/data-input-integrity.md` before computing > anything, and report what they found. Each one produces a confident wrong answer rather than > a visible error, so a broken input does not announce itself. A partial final period is the most common cause of a false anomaly. Never flag an incomplete bucket as a drop. > Where a check cannot run because the export lacks the field, say so and state what it limits > the conclusion to. ## How to run Ask the user for these inputs. If any are missing, ask before flagging anything. 1. **The metric and its history**: the metric name and a series of values with their time periods (at least 8 periods; fewer than that is not enough to establish a normal range). 2. **Period granularity**: daily, weekly, or monthly, since the definition of "normal fluctuation" differs by granularity. 3. **Direction that matters**: does the user care about drops, spikes, or both (a spike in signups is good news; a spike in churn is not). ## Method Use a trailing-window average and deviation, not a fixed arbitrary threshold. Run all three passes: the trailing check catches a sudden move, the sustained check stops an ongoing problem going quiet, and the drift check catches a slow decline that no single step is large e