Deleting thirty alerts, and the one that mattered

Thirty-one rules, 412 firings in a month, four of which corresponded to something a user would have noticed.

the audit, per rule:
  fired    acted on
   188        0     cpu above 80%
    94        0     disk above 70%
    41        1     5xx rate above 0.1% for 1m
    22        0     replica lag above 5s
     4        4     checkout error rate above 2% for 5m

deleted 23. rewrote 5 to alert on the promise rather than
the cause. kept 3 unchanged.

The rule that survived unchanged is the one written last and written about a user-visible outcome, which is the pattern. The disk rule was not deleted so much as moved — a threshold that fires monthly and is never urgent is a report, and it became a line in the daily summary where it belongs.