fix

docs/STATUS.md

@@ -143,6 +143,22 @@ Categories: `scanner_probe`, `dependency_unreachable`, `client_credential_issue`
     orchestrator pattern signature); `HasUpstream` is loaded but not yet a triage
     rule; trace propagation is missing in cart/checkout/profile/scheduling (roots only).
 
+- Alerts (`internal/alerts`, env `OTEL_ALERT_*`, secret `otel-alerts`): the server
+  runs the spike detector every minute and posts to Telegram (and/or a generic
+  webhook). First tick after a start only primes the suppressor. `GET /api/alerts`,
+  `POST /api/alerts/test`, `go run ./cmd/alert-test`. Recent alerts are in memory only.
+- Bad actors (`features.MarkBadActors`): an event is marked, never dropped, when its
+  client hit >=3 probe paths (`probe-scanner`), walked >=15 not-found routes
+  (`enumerator`), or is a declared crawler/agent/scanner getting a 4xx (`bot-4xx`;
+  their 5xx stay visible). Marked events are ignored by `DetectSpikes`/alerts and
+  counted in `Row.BadActorErrors`. **`Row.Label` now targets the clean future error
+  rate** (logical requests, no bad actors); `RawLabel` is the old raw-count label. AI
+  crawler rows stay in the data on purpose (see memory: flag, not block).
+  Client rules need a resolved client IP, so they only cover data since the trace
+  columns shipped; the bot rule works on any row with a UA class.
+- Route ids: `term_<hex>` style segments normalize to `{id}` (per-session websocket
+  routes were creating a new pattern each session).
+
 ## Commands
 
 ```bash