Pipeline: clover_orders → ingest event → incremental aggregators → rolling snapshots (hourly/daily/weekly).
Bill for tip %: COALESCE(payment_total, total). Avg tip % excludes orders where tip > bill.
Tabs: Snapshots = SQL window stats; Velocity = 15/60/1440m counters; Profiles = EMA per employee; Rule triggers = fire counts; Merchant = store baseline; Risk signals = per-txn scores.
Hover i on any column header for formulas.
Fraud intelligence derived from Clover ingest — snapshots, velocity, profiles, and explainable signals.
Orders in the Transactions table come from clover_orders. Aggregation runs on order_ingest events — this tool creates any missing ingest rows from stored orders, then processes has_aggregated = false.
Rolling window metrics per employee (tips, refunds, risk).
Short-window burst counters (15m, 1h, 24h).
Long-term trust, typical tips, working patterns.
Historical rule firing per employee.
Store-level baselines and peak hours.
Triggered rule evaluations (full audit trail on detail page).