Stop ambient radio chatter from opening incidents, and refill the map

The 23:46Z correlation dump confirmed the severity gate fixed the problem it
was written for -- orphans fell from 69 to 16, and only three of those are
after the deploy boundary, two of them deliberate skips. Nothing on TG 9048
absorbs the channel any more; the largest post-deploy incident is four calls
over nine minutes and is genuinely one event.

It overcorrected. 37 of 50 incidents were open, most a single routine call.
The cause was the gate's own substance test, which counted `units` and
`location`. Radio protocol puts a unit ID in essentially every transmission
and a place name in most of them, so has_substance was true almost always and
the severity check never actually ran -- "11-Victor, 72 at Holland Station"
became its own permanent incident. Substance is now a vehicle, a geocode or a
tag: things the extractor found beyond who was speaking and where they stood.
Severity still opens an incident on its own, so nothing real is lost.

incident_type is now validated against the enum the prompt offers rather than
trusted. It is written straight through to incident.type and rendered as the
title, so a model that answered the severity question in the type field
produced an incident titled "Routine -- TGID 9563". Unrecognised values become
None and fall to the tag/severity path, which is what "unknown" already did.

The map was empty for a separate reason: geocoding accepted only ROOFTOP and
RANGE_INTERPOLATED. Dispatch names places the way people speak, and Google
returns GEOMETRIC_CENTER for exactly those forms -- intersections ("Lake
Street and Veterans Memorial Drive") and named POIs ("Brewster Station").
Requiring a street address discarded nearly every real dispatch location and
left only numbered addresses plotted, which is why the July incidents have
coordinates and none since do. GEOMETRIC_CENTER is now accepted; APPROXIMATE
is still rejected, since a region centroid is what an ungeocodable string
degrades to. Note this is necessary but may not be sufficient -- if
GOOGLE_MAPS_API_KEY is unset on the host the map stays empty regardless, and
that has not been checked from here.

Two things found and deliberately not fixed, both in DEFERRED.md. One call can
still land in two incidents, because upload.py correlates each extracted scene
independently and the model over-split one conversation; multi-scene is
intentional, so that is prompt tuning rather than a code change. And nothing
closes an incident that merely goes quiet -- signal-resolution and master
auto-resolve both exist, but a one-call incident nobody clears stays active
forever. That wanted the over-creation fixed first so a time-based sweeper
would not just paper over it.

Gate tests updated: units and location alone must now orphan, and the case
that matters most is kept explicit -- units with a real severity still open an
incident. 17 pass. No new environment variables, so CI deploys this without an
ansible run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-c2-core/app/internal/intelligence.py

@@ -68,6 +68,13 @@ System: {system_id}
 Talkgroup: {talkgroup_name}
 {ten_codes_block}{vocabulary_block}{transcript_block}"""
 
+# The incident_type enum offered to the model in EXTRACTION_PROMPT.  Kept here
+# rather than only in the prompt so a model that invents a value cannot write it
+# into incident.type.  "unknown" is deliberately absent — it is a real answer
+# from the model but not a usable type, and is normalised to None alongside
+# anything unrecognised.
+_VALID_INCIDENT_TYPES = frozenset({"fire", "ems", "police", "accident", "other"})
+
 # Geographic bias radius for geocoding — half-width in degrees (~55 km)
 _GEO_DELTA = 0.5
 
@@ -240,7 +247,19 @@ async def extract_scenes(
         # and is kept.  Collapsing it to None used to make the call untypeable,
         # and an untypeable call could never open an incident — see the creation
         # gate in incident_correlator._run_decision().
-        if incident_type in ("unknown", ""):
+        #
+        # Anything outside the enum is a model error, not a new category.  The
+        # value is written straight through to incident.type and rendered as the
+        # incident title, so on 2026-08-16 a model that answered the severity
+        # question in the type field produced an incident literally titled
+        # "Routine — TGID 9563".  Unrecognised values become None and fall to the
+        # tag/severity path, which is the same treatment "unknown" already got.
+        if incident_type not in _VALID_INCIDENT_TYPES:
+            if incident_type and incident_type != "unknown":
+                logger.warning(
+                    f"Intelligence: discarding invalid incident_type {incident_type!r} "
+                    f"(not in {sorted(_VALID_INCIDENT_TYPES)})"
+                )
             incident_type = None
 
         # Geocode this scene's location.
@@ -420,11 +439,17 @@ async def _geocode_location(
                 return None
             result = data["results"][0]
             location_type = result.get("geometry", {}).get("location_type", "")
-            # Only accept address-level precision. GEOMETRIC_CENTER (city/neighborhood
-            # centroid) and APPROXIMATE (region boundary) produce coordinates that look
-            # valid but are too vague for 0.5km proximity matching — they often resolve
-            # to the same point as the node's position and create false proximity matches.
-            if location_type not in ("ROOFTOP", "RANGE_INTERPOLATED"):
+            # Reject only APPROXIMATE — a region/city boundary centroid, which is
+            # what an ungeocodable string degrades to and is genuinely useless.
+            #
+            # ROOFTOP-only was too strict and emptied the map: dispatch names
+            # places the way people speak, and Google returns GEOMETRIC_CENTER for
+            # exactly those forms — intersections ("Lake Street and Veterans
+            # Memorial Drive") and named POIs ("Brewster Station"). Both are
+            # precise enough to plot and to proximity-match; requiring a street
+            # address threw away nearly every real dispatch location, leaving only
+            # numbered addresses geocoded.
+            if location_type not in ("ROOFTOP", "RANGE_INTERPOLATED", "GEOMETRIC_CENTER"):
                 logger.info(
                     f"Geocoding rejected '{location_str}' — imprecise result "
                     f"(location_type={location_type!r}), returning None"