---
id: 019cb9fd-149e-7d94-bab1-caa9edbcb1d2
name: Large Order Wave Monitor
kind: Anomaly
cron: 0 0 * * * *
analysis_window: 1h
comparison_periods: [1d, 7d]
---

Detect periods when orders consistently contain an unusually high number of items, indicating large tables or group orders that strain kitchen capacity.

## Known Tables & Columns

### `curated.kitchen_orders`
- `guid` (varchar, PK) - order identifier
- `store_guid` (varchar) - which store/restaurant
- `items_count` (int) - number of items in the order
- `order_type` (varchar) - DINE_IN, TO_GO, DELIVERY
- `guest_table` (varchar) - table identifier (e.g., T1-T24)
- `server_name` (varchar) - server who took the order
- `done` (tinyint) - whether the order is complete
- `is_deleted` (tinyint) - soft delete flag
- `create_time` (int, unix timestamp) - when the order was created
- `preparation_time` (int, seconds, nullable) - total order preparation time

## Analysis Approach

1. Query all orders created in the last {AnalysisWindow} from `curated.kitchen_orders` (`is_deleted=0`).
2. Verify that each 15-minute window contains at least **15 orders**. Ignore windows with fewer data points.
3. Group by 15-minute windows and compute the **average items_count** per window.
4. Compare against the historical baseline (same time windows {ComparisonPeriods}). Normal orders typically have 1-4 items depending on time of day; lunch/dinner peaks average 3-4 items.
5. Flag windows where the average `items_count` is significantly elevated -- specifically, look for sustained periods (3+ consecutive windows) where most orders have 6-10 items.
6. Also compute the **percentage of large orders** (`items_count >= 6`) in each window. Under normal conditions this should be rare (<10%); during an anomaly it will be the majority.
7. Check the downstream impact: do these large orders correlate with increased overall prep times or a growing backlog?

## Baseline Reference

Normal item counts by time of day:
- Off-peak (late night, early morning): 1-2 items average
- Moderate (mid-morning, afternoon): 2-3 items average
- Peak (lunch 12-14, dinner 18-20): 3-4 items average

Anomalous: sustained 6-10 items per order across multiple consecutive windows.

## Severity Guidance

- **Low**: Average items_count 2.5x above baseline sustained for 3+ consecutive windows
- **Medium**: Average items_count 3x above baseline sustained for 3+ windows, with visible kitchen impact
- **High**: Average items_count 3x+ above baseline sustained over 15+ minutes, kitchen clearly overwhelmed