fix(analytics): stop counting bot User rows as humans

[lilyshen0722]

The bug

HUMAN_FILTER in backend/routes/admin/analytics.ts keyed only on botMetadata.agentName absence, through an $or that also passed anything with no botMetadata object at all. It never checked isBot:

$or: [
  { botMetadata: { $exists: false } },
  { 'botMetadata.agentName': { $exists: false } },   // ← true for bots without an agentName key
]

Not every bot User row carries agentName. Rows written by the gateway bridge, the summarizer, and several openclaw install paths set botMetadata without it, so they satisfied the second clause and were counted as humans.

On the dev instance that is 8 rows out of 85 — clawdbot-bridge, commonly-summarizer, four openclaw-inst-*, socialpulse-adasdsad. Effects:

• totalUsers, DAU, WAU and daily signups inflated by ~10%
• every funnel rate deflated, because a bot sitting in the denominator can never attach an agent or send a message

Corrected human count is 77, and the activation rate moves up accordingly.

Three sites, one definition

The flaw appeared three times, because the shared constant was declared below the funnel route that needed it:

Site	Was
/funnel	inlined its own copy of the filter
HUMAN_FILTER	used by /usage signups, DAU, WAU, totalUsers
botIds	the same criterion inverted, so it missed the same 8 rows and let them count as human posters too

HUMAN_FILTER and BOT_FILTER are now exact logical complements, hoisted above first use, with a test pinning that property — if they ever drift, a row is either counted twice or dropped from both.

What was NOT wrong

Checked while verifying, so nobody re-audits it: messages read PostgreSQL (the Mongo path is correctly flagged in-file as an undercount), the JS dayKey and the SQL AT TIME ZONE 'UTC' day-cast agree so no days are silently dropped by the if (row) merge, and lastActive is populated on all 77 humans.

Tests

New admin.analytics.human-filter.test.js runs against a real in-memory Mongo, so filter semantics are under test rather than a mock's recorded call args. It seeds a human, a classic agent row, a bot with botMetadata but no agentName (the leak), and a bot marked only by isBot — then asserts one human out of four across totalUsers, DAU/WAU, and signup cohorts, plus the complement property.

Test Suites: 2 passed, 2 total
Tests:       12 passed, 12 total

One fixture change in the existing suite: it decided "is this the bot query?" from the mere presence of the botMetadata.agentName field. HUMAN_FILTER now names that field too ($exists: false), so the signup query took the bot branch and returned docs with no createdAt — new Date(undefined).toISOString() threw and the endpoint 500'd. Retargeted to the actual discriminator ($or).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RWkf1SuYRHosxnPqsXwaVa