Skip lowman checks during known strat windows (beta-2.2.4)

[owens1127]

Summary

• beta-2.2.3/2.2.2 false positives: “Allowed” lowmans used CheatedChance values above the 0.05 flag threshold, and/or only covered solo while duo/trio still hit TooFewPlayers at 0.995 → cron BlacklistFlaggedInstances (>= 0.95) blacklisted thousands of legit clears.
• Fix: skipLowmanForKnownStrat in methods.go skips lowman heuristics entirely during the bubble push-off glitch window (kill/time checks still run). Removed per-player-count pantheon boss-push lowman hacks from heuristics.go.
• Window: bubblePushOffGlitchStart = 2026-06-14 — Desert Perpetual (activity 15, fresh + checkpoint); Garden / VoG / Vow / RoN final-boss checkpoint only (activities 7, 9, 10, 12); Pantheon 2 Morgeth + Insurrection Prime Rev (activity 102, versions 133/134).

Deploy

ssh raidhub
cd /RaidHub/Services && git pull origin main
export PATH=/usr/local/go/bin:$PATH
make hermes && sudo systemctl restart hermes
strings bin/hermes | grep beta-2.2.4

Post-merge backfill (clear-flags)

Use tools/clear-flags. It clears matching flag_instance / flag_instance_player rows (versions ≠ current CheatCheckVersion), removes blacklists for those instances, and resets cheat_level for affected players.

clear-flags matches (cheat_check_bitmask & bitmap) = bitmap — all bits in the filter must be present. Extra bits (e.g. Solo) on the row are fine.

Note: clear-flags filters cheat_check_version != current (not IN ('beta-2.2.2','beta-2.2.3')), so dry-run counts for Garden/VoG can include older-version lowmans. Prefer verifying beta-2.2.2/beta-2.2.3 counts via admin SQL before apply.

Prod-verified bitmaps (2026-06-18, beta-2.2.2/beta-2.2.3, flag_instance)

Cohort	-bitmap value	Matches
Desert Perpetual + TooFewPlayersFresh	4611686018427420672	6,676
Desert Perpetual + UnlikelyLowman	562949953454080	7,744
Pantheon 2 + UnlikelyLowman	562967133290496	501,504
Pantheon 2 + TooFewPlayersCheckpoint	2305843026393563136	715
Pantheon 2 + TooFewPlayersFresh	4611686035607257088	84
Garden + UnlikelyLowman	562949953421440	26
VoG + UnlikelyLowman	562949953421824	39

Do not clear: RaidBit | TotalInstanceKills (e.g. VoG 18014398509482496, n=643) — kill heuristic still active.

On prod (after Hermes is on beta-2.2.4):

cd /RaidHub/Services
set -a && source .env && set +a
export PATH=/usr/local/go/bin:$PATH

GLITCH_DATE=2026-06-14T00:00:00Z

run_clear() {
  local bitmap="$1"
  echo "=== dry-run bitmap=$bitmap ==="
  go run ./tools/clear-flags/ -dry-run -date="$GLITCH_DATE" -bitmap="$bitmap"
  go run ./tools/clear-flags/ -date="$GLITCH_DATE" -bitmap="$bitmap"
}

run_clear "4611686018427420672"   # DP TooFewFresh
run_clear "562949953454080"      # DP UnlikelyLowman
run_clear "562949953421440"       # Garden
run_clear "562949953421824"       # VoG
run_clear "562967133290496"       # P2 UnlikelyLowman
run_clear "2305843026393563136"   # P2 TooFewCheckpoint
run_clear "4611686035607257088"   # P2 TooFewFresh

Re-enqueue rechecks after clearing so instances get a clean beta-2.2.4 pass.

Test plan

• go build ./lib/services/cheat_detection/...
• Merge → deploy Hermes → strings bin/hermes | grep beta-2.2.4
• clear-flags -dry-run each row; counts should match ~prod table above
• Apply clear-flags + enqueue rechecks
• Spot-check Desert Perpetual + Pantheon Morgeth lowmans not blacklisted

[owens1127]

Prod bitmap verification (pre-merge)

Queried flagging.flag_instance on prod for (bitmask & filter) = filter with cheat_check_version IN ('beta-2.2.2','beta-2.2.3').

Key corrections from draft backfill:

• Pantheon false positives are almost entirely Pantheon2 | UnlikelyLowman (562967133290496, 501,504 rows) — not TooFewPlayersFresh (0 matches with only that bit; 84 with raid bit).
• Pantheon also needs Pantheon2 | TooFewPlayersCheckpoint (2305843026393563136, 715 rows).
• Desert Perpetual solo-fresh wave is DesertPerpetual | TooFewPlayersFresh (4611686018427420672, 6,676); rows often also have Solo set — subset match still works.
• DesertPerpetual | UnlikelyLowman = 562949953454080 (7,744) — not 562949953421312 alone.
• Do not clear RaidBit | TotalInstanceKills (e.g. VoG 18014398509482496, 643 rows) — kill heuristic, still active after this fix.

Dry-run each -bitmap from the updated PR table before apply; instance_count should line up with the match column.