fixes

internal/alerts/filter.go

@@ -37,3 +37,44 @@ func FilterActionable(spikes []features.Spike, keepMuted bool, muted map[triage.
 	}
 	return out
 }
+
+// Priority ranks how urgently a pattern needs a human. Client errors (4xx)
+// are the caller's problem more often than ours, so they rank below server
+// failures and count for less when deciding whether to page.
+type Priority string
+
+const (
+	PriorityHigh   Priority = "high"
+	PriorityMedium Priority = "medium"
+	PriorityLow    Priority = "low"
+)
+
+// lowPriorityWeight is how much a low-priority pattern's excess counts toward
+// the paging threshold: five 4xx errors weigh as one 5xx.
+const lowPriorityWeight = 0.2
+
+// PriorityOf ranks an example event: 4xx is low; server failures (5xx, or a
+// service defect, saturation or unreachable dependency) are high.
+func PriorityOf(e features.Event, c triage.Category) Priority {
+	switch {
+	case e.StatusCode >= 400 && e.StatusCode < 500:
+		return PriorityLow
+	case e.StatusCode >= 500, c == triage.ServiceDefect, c == triage.CapacitySaturation, c == triage.DependencyUnreachable:
+		return PriorityHigh
+	}
+	return PriorityMedium
+}
+
+// PagingExcess is a spike's excess with low-priority patterns discounted, so a
+// pile of 4xx cannot page on its own but still tips a real 5xx spike.
+func PagingExcess(sp features.Spike) float64 {
+	var total float64
+	for _, p := range sp.Patterns {
+		if PriorityOf(p.Example, TriageOf(p.Example).Category) == PriorityLow {
+			total += p.Excess * lowPriorityWeight
+		} else {
+			total += p.Excess
+		}
+	}
+	return total
+}