more ml

internal/features/spike_test.go

@@ -39,3 +39,41 @@ func TestDetectSpikesRequiresMinimumExcess(t *testing.T) {
 		t.Fatalf("3 errors should stay under the floor: %+v", got)
 	}
 }
+
+func TestBaselineTrimIgnoresEarlierStorm(t *testing.T) {
+	at := time.Date(2026, 9, 19, 12, 0, 0, 0, time.UTC)
+	cfg := SpikeConfig{Window: 5 * time.Minute, BaselineWindows: 10}
+	var events []Event
+	add := func(sig string, n int, when time.Time) {
+		for i := 0; i < n; i++ {
+			events = append(events, Event{Timestamp: when.Add(time.Duration(i) * time.Millisecond), Service: "api", IsError: true, PatternSignature: sig})
+		}
+	}
+	// one earlier storm in 1 of 10 baseline windows, then a smaller repeat now
+	add("storm", 1000, at.Add(-6*cfg.Window))
+	add("storm", 60, at.Add(-cfg.Window))
+	got := DetectSpikes(events, at, cfg)
+	if len(got) != 1 || got[0].Patterns[0].BaselineMean != 0 {
+		t.Fatalf("storm baseline should be trimmed to 0, got %+v", got)
+	}
+}
+
+func TestSuppressorCooldownAndEscalation(t *testing.T) {
+	at := time.Date(2026, 9, 19, 12, 0, 0, 0, time.UTC)
+	spike := func(at time.Time, count int) []Spike {
+		return []Spike{{Service: "api", WindowEnd: at, Patterns: []PatternDelta{{Signature: "x", Count: count, Excess: float64(count)}}}}
+	}
+	s := NewSuppressor(30 * time.Minute)
+	if len(s.Filter(spike(at, 20))) != 1 {
+		t.Fatal("first alert should pass")
+	}
+	if len(s.Filter(spike(at.Add(5*time.Minute), 22))) != 0 {
+		t.Fatal("repeat inside cooldown should be suppressed")
+	}
+	if len(s.Filter(spike(at.Add(10*time.Minute), 45))) != 1 {
+		t.Fatal("2x escalation should re-alert")
+	}
+	if len(s.Filter(spike(at.Add(50*time.Minute), 46))) != 1 {
+		t.Fatal("alert after cooldown should pass")
+	}
+}