# Phase 17 — Leaderboard, History, and Analytics Report

## Status

Phase 17 is complete. The application now has privacy-aware published leaderboards, ledger-derived earning history, closed-UTC daily summaries, idempotent analytics rollups, immutable rollup evidence, and permission-separated Admin reporting.

## Delivered

- Migration `022_harden_analytics_and_leaderboards.sql` adds earning breakdown/reversal projections, generation-keyed leaderboard snapshots, immutable entry/run guards, source watermarks, performance indexes, public period configuration, and `reports.financial.view`.
- The scheduler builds daily/task/user projections and 12 leaderboard snapshot combinations inside one transaction for the previous closed UTC date.
- Public earning history uses posted/reversed ledger evidence, strict categories, integer minor units, and a signed keyset cursor.
- Public leaderboards expose only stored display snapshots and allow a user to opt out through profile preferences.
- Operational Admin reports require `reports.view`; money totals require the distinct `reports.financial.view` permission.
- Every report uses validated inclusive UTC dates with a bounded 366-day range and audited reads.

## Safety decisions

- Analytics never becomes wallet authority and never mutates financial events.
- Telegram IDs and internal user IDs are absent from leaderboard output.
- Anonymous preference survives Telegram profile synchronization.
- Only allowlisted metrics, periods, categories, and report fields reach repository queries.
- Snapshot entries and rollup run evidence cannot be edited or deleted at the database layer.
- One date/currency run key and one metric/period/date generation key make retries deterministic.

## Verification

Phase 17 adds **16 focused tests** across unit, integration, and security suites. They cover UTC periods, report-range bounds, cursor signatures/tampering, ledger-derived signed deltas, reversal summaries, public privacy, all snapshot combinations, Admin money calculations, profile opt-out, authentication, exact report permissions, immutable migration evidence, parameterized history, and profile-merge persistence.

The complete suite contains **327 tests**. The database verifier confirms **22 migrations, 6 seeds, 75 domain tables, 249 named constraints, 191 up statements, 170 down statements, and 19 seed statements**.

No live MySQL database, Telegram bot, payout provider, or deployment environment was accessed or modified.

## Next phase

Phase 18 will implement the premium Mini App frontend over the authenticated APIs, including dashboard, tasks, leaderboard, referrals, withdrawals, history, tutorials, profile privacy, Telegram theme/safe-area behavior, and resilient loading/error/offline states.

**Phase 17 status: COMPLETE — focused tests 16/16; full quality gate passed 327/327.**