Clearer anomaly descriptions on failing monitors

When a monitor fails, Sifflet describes the detected anomaly in the UI, in incidents, and in alerts (Slack, email…). This description used to be the same for every monitor template. It now depends on the monitor template, so failures are easier to understand at a glance.

Previously, every monitor template produced this generic message:

Anomaly detected in 1 timeslot: [2026-09-28 01:00 +0000] Value = 11386 Expected = [0.0, 9407].

Now, an hourly volume monitor reports:

Too many rows for data of 2026-09-28, 01:00–02:00 UTC: got 11,386 rows, expected at most 9,407 (21% more).

and a daily freshness monitor reports:

No new data from 2026-09-26 to 2026-09-28 (3 days). Last data received on 2026-09-25.

Only new monitor runs use the new wording. Past results keep their original message.

The wording related to groups for monitors that include a group-by clause doesn't change.

Breaking change for message parsers: if a service of yours parses these messages, it will stop working once the change reaches your instance. The wording of anomaly messages isn't covered by Sifflet's backward-compatibility guarantees.

We're enabling this change progressively. If you need more time to adapt, contact us and we'll delay it for your instance.