fix(queries): honest operator_activity — defend against phantom wins

The dashboard claimed a "win" that turned out to be a writer-side
arg-misalignment in liquidation-scanner.js (already fixed upstream):
some skip-decision rows ('aave_gas_budget_rejected') were logged with
success=1 because a string was passed where the success boolean
belonged. The string was truthy-coerced to 1.

This commit hardens the read path so the dashboard remains accurate
even if future writer bugs sneak similar junk in:

- liquidation_attempts: COUNT(DISTINCT tx_hash) over rows where
  tx_hash is a real on-chain hash (0x + 64 hex). Previously naive
  COUNT(*) double-counted every bundle (one submit + one timeout
  row per attempt) and triple-counted some failed paths. Skip rows
  with no tx_hash are now correctly excluded — they're "we looked
  and didn't fire", not attempts.

- liquidations_won: same tx_hash predicate ANDed with success=1.
  Now requires both flags to align with a real on-chain hash. Old
  query trusted success=1 alone.

- recentLiquidations: same tx_hash hardening applied so the public
  feed never surfaces a phantom-win row.

Test fixture extended with a phantom-win row matching the bug
pattern; new regression test asserts the row is excluded.
Adds _nowMs / _windowMs injection seams so tests can pin the
24h cutoff onto 2023-vintage fixtures.

76 tests pass (was 75).

Author: S. K. Rotwang MMMMMMMMM

src/queries.js

@@ -376,13 +376,22 @@ export function recentLiquidations(db, params = {}) {
 	// `strategy` typically looks like 'aave_liquidation', 'morpho_…' etc.
 	// so a `LIKE protocol||'%'` filter routes the user's `protocol` to
 	// matching landings.
+	//
+	// `success=1 AND tx_hash looks real` — see the comment in
+	// getStatsOverview's operator_activity block for why the tx_hash
+	// predicate is non-negotiable: a writer-side arg-misalignment used
+	// to set success=1 on no-tx skip rows. We've since fixed the writer,
+	// but the dashboard must remain robust against any future regression.
 	const landings = protocol
 		? db.prepare(`
 			SELECT timestamp, block_number, strategy, borrower_address,
 			       tx_hash, success, actual_profit_usd, gas_used_usd
 			FROM executions
 			WHERE timestamp >= ?
 			  AND success = 1
+			  AND tx_hash IS NOT NULL
+			  AND tx_hash LIKE '0x%'
+			  AND length(tx_hash) = 66
 			  AND strategy LIKE ?
 			ORDER BY timestamp DESC
 			LIMIT ?
@@ -393,6 +402,9 @@ export function recentLiquidations(db, params = {}) {
 			FROM executions
 			WHERE timestamp >= ?
 			  AND success = 1
+			  AND tx_hash IS NOT NULL
+			  AND tx_hash LIKE '0x%'
+			  AND length(tx_hash) = 66
 			ORDER BY timestamp DESC
 			LIMIT ?
 		`).all(sinceMs, limit);
@@ -792,7 +804,12 @@ const HF_BUCKETS = Object.freeze([
 export async function getStatsOverview(db, params = {}) {
 	const shadowPath = params._shadowPath ?? '/opt/mevbot/data/shadow-blocks.jsonl';
 	const ttlMs = params._ttlMs ?? 60_000;
-	const now = Date.now();
+	// Test-injection seam: tests pass fixture rows with timestamps far
+	// in the past, so they pass `_nowMs` (and optionally `_windowMs`) to
+	// shift the 24h cutoff onto the fixture. Production always reads
+	// the real wall clock.
+	const now = params._nowMs ?? Date.now();
+	const windowMs = params._windowMs ?? (24 * 60 * 60 * 1000);
 
 	// Cheap row counts — same trick as getHealth: O(log n) via max(rowid).
 	const tableSize = (table) => {
@@ -874,7 +891,7 @@ export async function getStatsOverview(db, params = {}) {
 	// is only ~2.4K rows so a date-aggregated query is cheap; the
 	// timestamp index makes the range scan fast.
 	const cutoff30d = now - 30 * 24 * 60 * 60 * 1000;
-	const cutoff24h = now - 24 * 60 * 60 * 1000;
+	const cutoff24h = now - windowMs;
 	const liqsPerDay = db.prepare(`
 		SELECT
 			CAST((timestamp - (timestamp % 86400000)) AS INTEGER) AS day_ms,
@@ -898,19 +915,44 @@ export async function getStatsOverview(db, params = {}) {
 	// labels because those are operator-private. The intent is a
 	// "is the bot doing its job?" signal that operators (and curious
 	// outsiders) can see without revealing how much money is at stake.
+	//
+	// IMPORTANT — three layers of "honest counting":
+	//
+	// (a) Attempts = COUNT(DISTINCT tx_hash) over rows where tx_hash
+	//     looks like a real on-chain hash (`0x` + 64 hex chars). The
+	//     bot writes a row per outcome (submit, timeout, missed, failed)
+	//     for each bundle, so a naive COUNT(*) double- or triple-counts
+	//     every single attempt. Distinct tx_hash collapses these back
+	//     to one row per pursued opportunity.
+	//
+	// (b) Skipped decisions ('aave_low_gas_skip', 'aave_preflight_*',
+	//     'aave_gas_budget_rejected', 'aave_revalidation_skip') don't
+	//     have a tx_hash at all and are excluded — those are "we looked
+	//     and decided not to fire", not attempts.
+	//
+	// (c) Wins require BOTH success=1 AND a real tx_hash. A historical
+	//     writer bug (since fixed) flipped success=1 on no-tx rows when
+	//     the call-site packed positional args tightly and misaligned
+	//     the success column with a string value. Even after the writer
+	//     fix, we keep the tx_hash predicate as defence-in-depth.
+	const REAL_TX = `tx_hash IS NOT NULL
+		AND tx_hash LIKE '0x%'
+		AND length(tx_hash) = 66`;
 	const ourExec24h = db.prepare(`
 		SELECT
-			COUNT(*)                                     AS attempts,
-			COALESCE(SUM(CASE WHEN success=1 THEN 1 ELSE 0 END), 0) AS successes
+			COUNT(DISTINCT tx_hash) AS attempts,
+			COUNT(DISTINCT CASE WHEN success=1 THEN tx_hash END) AS successes
 		FROM executions
 		WHERE timestamp >= ?
+		  AND ${REAL_TX}
 	`).get(cutoff24h);
 	const ourExec7d = db.prepare(`
 		SELECT
-			COUNT(*)                                     AS attempts,
-			COALESCE(SUM(CASE WHEN success=1 THEN 1 ELSE 0 END), 0) AS successes
+			COUNT(DISTINCT tx_hash) AS attempts,
+			COUNT(DISTINCT CASE WHEN success=1 THEN tx_hash END) AS successes
 		FROM executions
 		WHERE timestamp >= ?
+		  AND ${REAL_TX}
 	`).get(now - 7 * 24 * 60 * 60 * 1000);
 
 	// At-risk count — anything with HF below 1.05. Aave straight from

test/queries.test.js

@@ -74,24 +74,43 @@ beforeAll(() => {
 		);
 	}
 
+	// A 66-char `0x…` hash is a real on-chain tx hash. The fixtures use
+	// these so the operator_activity SQL (which requires
+	// length(tx_hash)=66 to defend against writer-side junk) counts them.
+	const FAKE_MISSED_HASH = '0x' + 'a'.repeat(64);
+	const FAKE_LANDED_HASH = '0x' + 'b'.repeat(64);
+	const FAKE_NO_TX_HASH  = '0'; // simulates the historical writer bug
+	const FAKE_LIQ_ADDR    = '0x' + 'c'.repeat(40);
+
 	db.prepare(`
 		INSERT INTO missed_liquidations
 			(tx_hash, timestamp, block_number, borrower_address,
 			 liquidator, debt_asset, collateral_asset,
 			 debt_to_cover, liquidated_collateral, debt_usd,
 			 was_tracking, would_have_been_profitable)
 		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`).run('0xtx1', 1_700_000_010_000, 25_000_010, ADDR_A,
-		'0xliquidator', 'USDC', 'WETH',
+	`).run(FAKE_MISSED_HASH, 1_700_000_010_000, 25_000_010, ADDR_A,
+		FAKE_LIQ_ADDR, 'USDC', 'WETH',
 		'50000000000', '1000000000000000000', 50000, 1, 1);
 
+	// One genuine landing with a real-looking 66-char tx hash.
 	db.prepare(`
 		INSERT INTO executions
 			(timestamp, block_number, strategy, borrower_address, tx_hash, success,
 			 actual_profit_usd, gas_used_usd)
 		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
 	`).run(1_700_000_020_000, 25_000_020, 'aave_liquidation', ADDR_C,
-		'0xtx2', 1, 300, 12.5);
+		FAKE_LANDED_HASH, 1, 300, 12.5);
+
+	// One phantom "win" from the historical writer arg-misalignment bug:
+	// success=1 with tx_hash='0'. The query MUST exclude this.
+	db.prepare(`
+		INSERT INTO executions
+			(timestamp, block_number, strategy, borrower_address, tx_hash, success,
+			 actual_profit_usd, gas_used_usd)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+	`).run(1_700_000_021_000, 25_000_021, 'aave_gas_budget_rejected', ADDR_A,
+		FAKE_NO_TX_HASH, 1, null, null);
 
 	// Disk fixtures for spark JSON and shadow-blocks JSONL.
 	tmpRoot = join(tmpdir(), `seneschal-test-${Date.now()}-${process.pid}`);
@@ -407,6 +426,26 @@ describe('getStatsOverview', () => {
 		expect(json).not.toMatch(/gas_used/i);
 	});
 
+	test('operator_activity ignores phantom-win rows (tx_hash="0", success=1)', async () => {
+		// The fixture inserts ONE genuine landing and ONE phantom row
+		// produced by the historical writer arg-misalignment bug. Honest
+		// counting must yield exactly 1 win, not 2.
+		_resetLeaderboardCacheForTest();
+		// Make the cutoff window wide enough to include the fixture
+		// timestamps (year 2023). The default 24h/7d window misses them.
+		const r = await getStatsOverview(db, {
+			_shadowPath: shadowPath,
+			_sparkPath: sparkPath,
+			_ttlMs: 1,
+			_nowMs: 1_700_000_100_000,
+			_windowMs: 200_000
+		});
+		const op = r.operator_activity;
+		// One genuine landing in the fixture — phantom row excluded.
+		expect(op.liquidations_won_24h).toBe(1);
+		expect(op.liquidation_attempts_24h).toBe(1);
+	});
+
 	test('Morpho rows in top_at_risk have null debt_usd', async () => {
 		_resetLeaderboardCacheForTest();
 		const r = await getStatsOverview(db, {