Online anomaly detection for fleet telemetry — constant-memory detectors, a transport-agnostic stream engine, and an evaluation harness that scores detectors the way operators experience them: recall, precision, and how many seconds until the alert fires. Pure standard library, zero dependencies.
Every naive streaming detector fails the same way: it learns the anomaly into its own baseline. EWMA variance inflates during a slow ramp until the fault is invisible; a median window absorbs a drift and hides it; CUSUM latches into permanent alarm after a level shift and pages forever. stream-sentinel ships the fix for each failure mode — learn-gating, robust window admission, classic CUSUM restart — and the test suite proves they stay fixed.
The simulator injects three realistic fault types (gradual engine overheats, fuel leaks, sudden oil-pressure drops) with exact onset timestamps, so detection quality is measured, not estimated.
Charts below are the actual output of stream-sentinel --vehicles 50 --hours 4: 216,000 readings, 45 injected faults, seeded and deterministic.
Real simulated trace: temperature ramps +25°C over four minutes. All three detectors fire inside the fault window — CUSUM first at 75s, EWMA at 85s, MAD at 165s — then re-arm instead of paging forever.
Across all 45 injected faults on 150 vehicle-channel streams.
Seconds from fault onset to first alert (10s reading interval).