fix

internal/features/spike_test.go

@@ -121,3 +121,37 @@ func TestDetectSpikesSkipsDuplicateHopsAndCountsClients(t *testing.T) {
 		t.Fatalf("clients = %d, want 2", got[0].Patterns[0].Clients)
 	}
 }
+
+func TestMarkBadActors(t *testing.T) {
+	at := time.Date(2026, 9, 20, 12, 0, 0, 0, time.UTC)
+	ev := func(ip, route string, status int, class string) Event {
+		return Event{Timestamp: at, Service: "nginx", IsError: true, ClientIP: ip, Route: route, StatusCode: status, UAClass: class}
+	}
+	var events []Event
+	for _, r := range []string{"/.env", "/.cursorrules", "/.codex/auth.json"} { // probe scanner
+		events = append(events, ev("198.51.100.1", r, 404, "browser"))
+	}
+	events = append(events, ev("198.51.100.1", "/", 503, "browser")) // its innocent request
+	for i := 0; i < 15; i++ {                                        // enumerator of ordinary-looking paths
+		events = append(events, ev("198.51.100.2", "/api/x"+string(rune('a'+i)), 404, "browser"))
+	}
+	events = append(events,
+		ev("203.0.113.5", "/missing", 404, "ai_crawler"),    // declared crawler 4xx: bad actor
+		ev("203.0.113.5", "/api/orders", 500, "ai_crawler"), // ...but its 5xx is a real defect
+		ev("203.0.113.6", "/api/orders", 500, "browser"),
+		ev("203.0.113.7", "/missing", 404, "library"), // libraries are not crawlers
+	)
+	MarkBadActors(events, BadActorConfig{})
+	got := map[string]int{}
+	for _, e := range events {
+		got[e.BadActor]++
+	}
+	if got[BadActorProbe] != 4 || got[BadActorEnumerator] != 15 || got[BadActorBot] != 1 || got[""] != 3 {
+		t.Fatalf("marking wrong: %+v", got)
+	}
+	for _, e := range events {
+		if e.ClientIP == "203.0.113.5" && e.StatusCode == 500 && e.BadActor != "" {
+			t.Fatal("a crawler-provoked 5xx must stay visible")
+		}
+	}
+}