What's the difference in a column?

This blog is filled with the times I'm just so brilliant, but this is not one of those times.  In our due-diligence in verifying all our items, objects, and processes will stand up to being upgraded by R12 an analyst started asking us some questions about an alert which just so happens to be one I created.  The statement was being made that "it does not pull up anything" which was curious to me, since I usually don't send alerts out unless I can test them successfully (often many many times) before putting my team on them.  Sure enough, I went back to see that I DID test the alert and it DID show information so now I'm really curious and digging into the statements being made in relation to actual_start_time being selected as the criteria for the alert.

Seems innocent enough right?  I had wanted to find out when a Journal Import ended within the first hour of it being in a non-normal status (Cancelled, Terminated, Error, you get the idea) but in fact that isn't what I asked the alert to do.  Because I used actual_start_time, and not actual_completion_time, I was asking the alert to tell me if a Journal Import ended in a non-normal state only if it started within the past hour.  How about that huh?  So I looked back in the history of when the alert should have come out, and sure enough there was a Journal Import that started at 8 AM and didn't end abnormally until after 10 AM so when the alert ran this wasn't picked up.  A good lesson learned that even with good intentions, you can do something completely wrong, and not find out about it until too late.