Alert Cooldown and Deduplication Rule¶
Attention management — instantiates Temporal Resolution and Sampling Rate Design
Collapses repeated or duplicate alerts from the same condition and holds off re-firing for a cooldown, while still letting genuine escalations through.
An Alert Cooldown and Deduplication Rule acts on the alert stream, not the sampling stream. Downstream of whatever is observing the process, it groups alerts that share an underlying cause, suppresses duplicates for a hold-down period, and rate-limits notifications so that one ongoing condition produces one notification instead of forty — while a genuine escalation (a new severity, a spread to a new scope) still breaks through immediately. Its defining property is that it changes how often a human is told, never how often the process is watched. That is the line separating it from every cadence sibling: those decide when to observe; this one decides when the observation is worth interrupting a person for, and its entire job is to protect finite attention without dropping the alert that actually matters.
Example¶
A household video doorbell faces a delivery truck idling across the street. Naïvely, its motion detector would fire on every flicker of the truck and the leaves behind it — forty "motion detected" pushes in two minutes, until the owner mutes the app and stops looking. A cooldown-and-dedup rule collapses the flood: the first motion in a zone sends one push, then a three-minute cooldown suppresses further motion in that same zone, and a running count ("+38 more") preserves the fact that activity continued. Crucially, the rule keys suppression to zone and cause, so when motion crosses into the front-door zone — a different, higher-stakes event — it bypasses the cooldown and pushes at once. The owner gets one useful ping instead of a muted stream, and still hears immediately about the person walking up the path.
How it works¶
- Define the dedup key. What makes two alerts "the same" — same source, same zone, same root cause — so duplicates can be collapsed rather than repeated.
- Set the cooldown window. After firing, suppress further same-key alerts for a hold-down period, optionally rolling the suppressed count into a summary.
- Define the escalation bypass. The conditions — higher severity, wider scope, a new signature — under which an alert must break through the cooldown regardless.
Tuning parameters¶
- Dedup key granularity — coarse keys collapse aggressively but risk merging distinct events; fine keys are safer but let more through.
- Cooldown length — longer quiets the channel more but delays awareness of a re-firing condition.
- Escalation-bypass conditions — how readily suppression is overridden; permissive bypass protects against missed escalations at the cost of more interruptions.
- Rollup vs silent drop — whether suppressed alerts are counted and summarized or discarded, trading a little clutter for an audit trail.
When it helps, and when it misleads¶
Its strength is that it directly fights alarm fatigue — the well-documented failure in clinical and industrial monitoring where too many alerts train people to tune out all of them, including the true one.[n1] By collapsing floods into single, meaningful notifications it keeps the channel credible. Its failure modes are the cost of suppression. Too-aggressive dedup can swallow a real second event that merely resembled a duplicate, and too-long a cooldown can delay a genuine escalation past the moment it could have been acted on. The guarding discipline is to keep the escalation bypass conservative and audited, and never to let a cooldown exceed the decision-latency budget of the condition it might be muting.
How it implements the components¶
oversampling_burden_check— alert fatigue is the canonical over-observation burden, and this rule is the burden control applied to the notification channel.aggregation_window_definition— the cooldown is a suppression window over which repeated same-key alerts are collapsed into one notification.decision_latency_requirement— the cooldown length must stay inside the time an escalation still has to be acted on, so suppression never outlasts the deadline.
Does NOT set how often the process itself is observed (sampling_interval_or_trigger_rule, cadence_adaptation_policy): those are fixed_interval_sampling_schedule and adaptive_sampling_rate_controller. This rule filters alerts after observation has already happened; it never changes the sampling rate.
Related¶
- Instantiates: Temporal Resolution and Sampling Rate Design — supplies the archetype's attention-side guard: keeping the notification channel usable at whatever cadence the process is watched.
- Consumes: event_triggered_capture_gate — the triggered events it deduplicates typically arrive from a capture gate or threshold detector upstream.
- Sibling mechanisms: fixed_interval_sampling_schedule · adaptive_sampling_rate_controller · event_triggered_capture_gate · anti_aliasing_prefilter_or_smoothing_rule · rolling_window_aggregation · multi_resolution_dashboard · burst_sampling_protocol
Editorial Notes¶
Form Classification¶
Form family: Control, Automation & Runtime
Rationale: Collapses repeated or duplicate alerts from the same condition and holds off re-firing for a cooldown, while still letting genuine escalations through, making its operative form a state-dependent executable control that senses, filters, routes, or actuates during operation.
Independent corroboration: The frozen evidence defines Alert Cooldown and Deduplication Rule as 'Collapses repeated or duplicate alerts from the same condition and holds off re-firing for a cooldown, while still letting genuine escalations through', so its operative form is Control, Automation & Runtime.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Single lineage
Present-day reach: Multi-domain
Rationale: Monitoring, event-processing, and site-reliability systems developed fingerprinting, deduplication, hold-down windows, and severity bypasses to turn repeated events into actionable incidents.
Related originating lineages:
- Information Theory — Filtering redundant messages while retaining novel or higher-severity information reflects signal-versus-noise and coding concerns.
Review resolution: Cooldown, keying, and deduplication are established software event-processing constructs. Information theory materially informs signal redundancy; psychology and interface design explain the human benefit but are application rationales rather than independent origins.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] Alarm fatigue — the well-documented desensitization that sets in when people are exposed to frequent alarms, most of them non-actionable, until they begin to ignore, silence, or bypass the whole system. It is the failure this mechanism exists to prevent, and the reason suppression is a feature rather than a bug. ↩