Make "AI is off" true, and stop the transcript PATCH from destroying calls

config/ai_features was not the switch it was documented to be. Three paths
spent money with it off, and one path read it wrong, so per-system opt-outs
did not opt anything out.

- Correlation in the ingest pipeline tested the raw global flag instead of the
  per-system resolution. With a system opted out, extraction was skipped but
  the no-scenes fallback still correlated the call with empty tags, taking the
  thin/recency path and attaching it to whatever incident was most recent on
  that system. The opt-out did not disable correlation, it disabled good
  correlation and left the worst kind running. (#75)

- Transcript correction ran on every transcribed call gated only by an env var,
  spending Gemini tokens and a Places lookup per proposed location. An
  "STT-only" window was never STT-only and its cost could not be attributed.
  Now behind transcript_correction_enabled. (#76)

- _run_extraction_pipeline and the vocabulary learner, both reachable from
  PATCH /calls/{id}/transcript, checked no flags at all. (#76, #81)

The flag resolver now lives in feature_flags.resolve_flags() rather than as a
local helper in upload.py. Three copies of that logic is how #75 happened.

PATCH /calls/{id}/transcript now refuses with 409 when correlation is off.
That route wipes tags, severity, location, units, embedding and unlinks the
call from every incident before queueing re-extraction. Gating extraction
alone would have made it destructive-only in the standing flags-off
configuration: the call left blank and orphaned forever, with the route still
answering 200. The wipe and the rebuild are one transaction in intent, so it
refuses before the first write.

Also: the summarizer's stale-incident sweep is no longer behind
summaries_enabled. It is pure Firestore with no model call in it, and gating
it meant nothing auto-resolved while AI was off - so every incident stayed
active forever and the candidate set every correlation reads kept growing.

transcript_correction_enabled is documented as NOT a pure cost lever. The
corrector is also the noise gate that sets not_speech; with it off, recogniser
noise reaches extraction as a real transcript, comes back thin, and
auto-attaches. Never open an evaluation window with correction off and
correlation on.

14 tests added covering flag precedence, both pipeline paths, the 409, the
correction gate and the summarizer no-op. Suite: 264 passed.

Refs #75, #76, #81, #45.

drb-c2-core/app/routers/upload.py

@@ -159,6 +159,19 @@ async def _correlate_with_consensus(
     return await incident_correlator.apply_correlation({"decision": final, "ctx": ctx})
 
 
+async def _resolve_flags(system_id: Optional[str]):
+    """
+    Resolve AI feature flags for a given system.
+
+    Thin alias for `feature_flags.resolve_flags` — the resolver lives there
+    because transcription and the calls router need the same answer, and three
+    copies of it is how server-26#75 happened in the first place.
+    """
+    from app.internal.feature_flags import resolve_flags
+
+    return await resolve_flags(system_id)
+
+
 async def _run_extraction_pipeline(
     call_id: str,
     node_id: str,
@@ -172,48 +185,55 @@ async def _run_extraction_pipeline(
     """Run steps 2-4 of the intelligence pipeline using an existing transcript."""
     from app.internal import intelligence, incident_correlator, alerter
 
-    # Step 2: Scene detection + intelligence extraction.
-    # Returns one scene per distinct incident detected in the recording.
-    scenes = await intelligence.extract_scenes(
-        call_id, transcript, talkgroup_name,
-        talkgroup_id=talkgroup_id, system_id=system_id, segments=segments,
-        node_id=node_id,
-        preserve_transcript_correction=preserve_transcript_correction,
-    )
+    flags, _flag = await _resolve_flags(system_id)
 
-    # Step 3: Correlate each scene to an incident independently.
     incident_ids: list[str] = []
     all_tags: list[str] = []
-    for scene in scenes:
-        all_tags.extend(scene["tags"])
-        # When dispatch is pulling a unit to a NEW call (reassignment), suppress unit
-        # overlap so the new scene doesn't chain into the unit's previous incident.
-        is_reassignment = bool(scene.get("reassignment"))
-        corr_units = [] if is_reassignment else scene.get("units")
-        incident_id = await _correlate_with_consensus(
-            call_id=call_id,
+
+    if _flag("correlation_enabled"):
+        # Step 2: Scene detection + intelligence extraction.
+        # Returns one scene per distinct incident detected in the recording.
+        scenes = await intelligence.extract_scenes(
+            call_id, transcript, talkgroup_name,
+            talkgroup_id=talkgroup_id, system_id=system_id, segments=segments,
             node_id=node_id,
-            system_id=system_id,
-            talkgroup_id=talkgroup_id,
-            talkgroup_name=talkgroup_name,
-            tags=scene["tags"],
-            incident_type=scene["incident_type"],
-            location=scene["location"],
-            location_coords=scene["location_coords"],
-            units=corr_units,
-            vehicles=scene.get("vehicles"),
-            cleared_units=scene.get("cleared_units"),
-            reassignment=is_reassignment,
+            preserve_transcript_correction=preserve_transcript_correction,
         )
-        if incident_id and incident_id not in incident_ids:
-            incident_ids.append(incident_id)
-        if scene["resolved"] and incident_id:
-            await fstore.doc_set("incidents", incident_id, {
-                "status": "resolved",
-                "resolved_at": datetime.now(timezone.utc).isoformat(),
-            })
-            await incident_correlator.maybe_resolve_parent(incident_id)
-            logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
+
+        # Step 3: Correlate each scene to an incident independently.
+        for scene in scenes:
+            all_tags.extend(scene["tags"])
+            # When dispatch is pulling a unit to a NEW call (reassignment), suppress unit
+            # overlap so the new scene doesn't chain into the unit's previous incident.
+            is_reassignment = bool(scene.get("reassignment"))
+            corr_units = [] if is_reassignment else scene.get("units")
+            incident_id = await _correlate_with_consensus(
+                call_id=call_id,
+                node_id=node_id,
+                system_id=system_id,
+                talkgroup_id=talkgroup_id,
+                talkgroup_name=talkgroup_name,
+                tags=scene["tags"],
+                incident_type=scene["incident_type"],
+                location=scene["location"],
+                location_coords=scene["location_coords"],
+                units=corr_units,
+                vehicles=scene.get("vehicles"),
+                cleared_units=scene.get("cleared_units"),
+                reassignment=is_reassignment,
+            )
+            if incident_id and incident_id not in incident_ids:
+                incident_ids.append(incident_id)
+            if scene["resolved"] and incident_id:
+                await fstore.doc_set("incidents", incident_id, {
+                    "status": "resolved",
+                    "resolved_at": datetime.now(timezone.utc).isoformat(),
+                })
+                await incident_correlator.maybe_resolve_parent(incident_id)
+                logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
+    else:
+        scope = "globally" if not flags["correlation_enabled"] else f"system {system_id}"
+        logger.info(f"Correlation disabled ({scope}) — skipping scene extraction and correlation for call {call_id} (reprocess)")
 
     if incident_ids:
         await fstore.doc_set("calls", call_id, {"incident_ids": incident_ids})
@@ -245,7 +265,6 @@ async def _run_intelligence_pipeline(
       4. Check alert rules and dispatch notifications
     """
     from app.internal import transcription, intelligence, incident_correlator, alerter, talkgroups
-    from app.internal.feature_flags import get_flags
 
     # The node only sends talkgroup_name when OP25 had it in the loaded tags
     # file, so it arrives empty for exactly the talkgroups C2 can name from the
@@ -265,19 +284,7 @@ async def _run_intelligence_pipeline(
         except Exception as e:
             logger.warning(f"Could not backfill talkgroup_name on call {call_id}: {e}")
 
-    flags = await get_flags()
-
-    # Resolve per-system overrides: system flag=False beats global flag=True,
-    # but global flag=False beats everything (master switch).
-    system_ai_flags: dict = {}
-    if system_id:
-        sys_doc = await fstore.doc_get_cached("systems", system_id)
-        system_ai_flags = (sys_doc or {}).get("ai_flags") or {}
-
-    def _flag(name: str) -> bool:
-        if not flags[name]:          # global master off
-            return False
-        return system_ai_flags.get(name, True)  # system override, default inherit
+    flags, _flag = await _resolve_flags(system_id)
 
     transcript: Optional[str] = None
     segments: list[dict] = []
@@ -310,7 +317,7 @@ async def _run_intelligence_pipeline(
     # A single recording can produce multiple incidents on a busy channel.
     incident_ids: list[str] = []
     all_tags: list[str] = []
-    if flags["correlation_enabled"]:
+    if _flag("correlation_enabled"):
         for scene in scenes:
             all_tags.extend(scene["tags"])
             is_reassignment = bool(scene.get("reassignment"))