fix

internal/alerts/alerts_test.go

@@ -128,3 +128,38 @@ func TestTelegramTruncates(t *testing.T) {
 		t.Fatalf("message too long: %d", n)
 	}
 }
+
+func TestScannerClientIsMutedEntirely(t *testing.T) {
+	at := time.Date(2026, 9, 20, 12, 0, 0, 0, time.UTC)
+	cur := at.Add(-2 * time.Minute)
+	scanner := func(route string, n int) []features.Event {
+		ev := burst("p-"+route, n, cur, 503, route)
+		for i := range ev {
+			ev[i].ClientIP = "198.51.100.9"
+		}
+		return ev
+	}
+	var events []features.Event
+	for _, r := range []string{"/.env", "/.cursorrules", "/.codex/auth.json"} {
+		events = append(events, scanner(r, 4)...)
+	}
+	events = append(events, scanner("/", 12)...) // the scanner's innocent-looking root request
+	if got := DetectAlerts(events, at, features.SpikeConfig{Window: 5 * time.Minute, BaselineWindows: 12, MinExcess: 5}); len(got) != 0 {
+		t.Fatalf("scanner traffic alerted: %+v", got)
+	}
+	// a different client with the same 503 on "/" still alerts
+	other := burst("real-503", 12, cur, 503, "/")
+	if got := DetectAlerts(other, at, features.SpikeConfig{Window: 5 * time.Minute, BaselineWindows: 12, MinExcess: 5}); len(got) != 1 {
+		t.Fatalf("real failure was muted: %+v", got)
+	}
+}
+
+func TestMinExcessAppliesAfterTriage(t *testing.T) {
+	at := time.Date(2026, 9, 20, 12, 0, 0, 0, time.UTC)
+	cur := at.Add(-2 * time.Minute)
+	// 200 probe errors + 6 real ones: total excess is large, actionable excess is 6 < 10
+	events := append(burst("probe", 200, cur, 404, "/.env"), burst("real", 6, cur, 503, "/api")...)
+	if got := DetectAlerts(events, at, features.SpikeConfig{Window: 5 * time.Minute, BaselineWindows: 12, MinExcess: 10}); len(got) != 0 {
+		t.Fatalf("paged on excess that was mostly probes: %+v", got)
+	}
+}