补测：行为检测支持历史区间；特征扫描自动时间切片；历史画像保留

tests/test_behavior.py

@@ -99,5 +99,32 @@ class FusedTests(unittest.TestCase):
                 store.close()
 
 
+class HistoricalBehaviourTests(unittest.TestCase):
+    def test_historical_profile_survives_live_refresh(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = watch.Store(os.path.join(directory, "ips.db"))
+            try:
+                store.upsert_historical_profiles([{
+                    "ip": "198.51.100.9", "score": 80,
+                    "verdict": "建议封禁", "signals": ["历史补测"],
+                    "last_ts": "2026-10-18T10:00:00Z", "total": 1000,
+                }])
+                store.replace_behavior_profiles([{
+                    "ip": "203.0.113.9", "score": 70,
+                    "verdict": "仅告警（共享出口）"}])
+                rows = {r["ip"]: dict(r) for r in store.conn.execute(
+                    "SELECT * FROM behavior_profiles")}
+                self.assertEqual(rows["198.51.100.9"]["historical"], 1)
+                self.assertEqual(rows["203.0.113.9"]["historical"], 0)
+
+                store.sync_fused()
+                fused = {r["ip"]: dict(r) for r in store.conn.execute(
+                    "SELECT * FROM ip_fused")}
+                self.assertEqual(fused["198.51.100.9"]["first_banned_at"],
+                                 "2026-10-18T10:00:00Z")
+            finally:
+                store.close()
+
+
 if __name__ == "__main__":
     unittest.main()