Spread alerting

An alert is a threshold on the exit gap at a stated size, for a stated pool. All three parts are required — a threshold without a size is not a condition, because the same book is fine at $100k and catastrophic at $5M.

Alerts fire on transition into breach and re-arm only after the gap recovers past the threshold plus a hysteresis band you set. A book oscillating around a threshold would otherwise page you every few minutes, which trains people to ignore the channel.

Delivery is at-least-once. Deduplicate on pool and timestamp; a handler that assumes exactly-once will eventually double-act on a breach.