Merge pull request 'Incident date filter matched nothing' (#168) from fix/incident-date-filter into main

Incident started_at is an isoformat() string (incident_correlator.py,
routers/incidents.py), not a Firestore timestamp like calls. The range
bounds were Dates, which Firestore compares by type, so any date range
returned zero incidents. Bounds are now UTC ISO strings in the same
"+00:00" shape, which order lexicographically by time.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -133,7 +133,20 @@ jobs:
           # has confirmed the tag it names actually answered /health. A
           # fresh VM with no file yet falls back to :latest, same escape
           # hatch as a manual `up -d` with no TAG set.
-          PREV_TAG=$(cat /opt/drb/.last_good_tag 2>/dev/null || echo latest)
+          #
+          # server-26#156: `cat missing-file || echo latest` only falls back
+          # when cat itself fails (nonzero exit) -- a file that EXISTS but is
+          # EMPTY (the state this file was found in, 2026-09-20) makes cat
+          # succeed with empty output, so PREV_TAG became "" instead of
+          # "latest". That "" then failed the emptiness check below and
+          # exited 1 -- AFTER git pull + up -d had already succeeded -- which
+          # skips the Health check step entirely (later steps don't run after
+          # a failure), and Health check is the ONLY thing that ever writes a
+          # real value here. Self-perpetuating: every deploy failed the same
+          # way forever, with the app itself deploying fine underneath it.
+          # ${VAR:-default} covers empty AND unset in one expansion.
+          PREV_TAG=$(cat /opt/drb/.last_good_tag 2>/dev/null)
+          PREV_TAG="${PREV_TAG:-latest}"
           echo "PREV_TAG=$PREV_TAG"
 
           # Deploy THIS commit's images, not :latest. Overlapping runs are

drb-c2-core/app/internal/transcript_correction.py

@@ -28,10 +28,23 @@ counties may have one talkgroup covering a single municipality, and that
 municipality's streets must not be buried under a county-wide list. A
 single-municipality system is the degenerate case: populate the system level and
 every talkgroup inherits it.
+
+THE PROMPT'S OWN RULES ARE NOT ENFORCED (server-26#162). "Do NOT expand
+ten-codes" and "NEVER add information" are instructions to the model, not
+checks on its output — `correct()` used to accept `raw["corrected"]` verbatim.
+Caught live: the same call came back with "10-7" rewritten to "10-13" in one
+place and "10-4" in another, and "7" expanded into "ShotSpotter" — a real code
+swapped for a different real code reads exactly as confident and trustworthy
+as a correct one, which is worse than leaving the raw mishearing in place. The
+model isn't graded on this at write time; `_code_tokens()` is a
+verify-what-you-can-cheaply-check backstop, not a fix to the model's judgment:
+it only catches a code-shaped token changing, not a wrong word substituted for
+another equally plausible word.
 """
 
 import asyncio
 import json
+import re
 from typing import Any, Optional
 
 from app.config import settings
@@ -96,6 +109,19 @@ def _dedupe(items: list[str]) -> list[str]:
     return out
 
 
+# Ten-codes ("10-4"), unit/signal shorthand ("4-2"), and the digit-group
+# fragments radio traffic reads out loud ("7-2-1" of a case number) all share
+# this shape. The guard below does not need to know which of those a given
+# token is — it only needs the SET of them to survive a "correction"
+# unchanged, in order. A model rewriting "10-7" as "10-13" is not the kind of
+# mishearing this pass exists to fix (server-26#162).
+_CODE_TOKEN_RE = re.compile(r"\b\d{1,3}(?:-\d{1,3})+\b")
+
+
+def _code_tokens(text: str) -> list[str]:
+    return _CODE_TOKEN_RE.findall(text or "")
+
+
 def _talkgroup_entry(system_doc: dict, talkgroup_id: Optional[int]) -> dict:
     """The config.talkgroups[] entry for this talkgroup, or {}."""
     if talkgroup_id is None:
@@ -317,6 +343,31 @@ async def correct(
         if verified_segments:
             corrected_segments = verified_segments
 
+    # server-26#162: a code-shaped token ("10-7", "4-2", a case-number
+    # fragment like "7-2-1") changing at all — not just going missing, any
+    # change — means the model touched something this pass has no business
+    # touching. Reject that half of the correction outright rather than trust
+    # a rewrite that already broke its own instructions once. Checked against
+    # the ORIGINAL text/segment, not each other, so a joined-text correction
+    # and a segment correction are judged independently, same as everywhere
+    # else in this function.
+    if corrected is not None and _code_tokens(corrected) != _code_tokens(text):
+        logger.warning(
+            f"Transcript correction for call {call_id} changed code-shaped "
+            f"tokens ({_code_tokens(text)} -> {_code_tokens(corrected)}) — "
+            f"discarding the joined correction"
+        )
+        corrected = None
+    if corrected_segments is not None:
+        for seg, orig in zip(corrected_segments, segments or []):
+            if _code_tokens(seg["text"]) != _code_tokens(orig.get("text", "")):
+                logger.warning(
+                    f"Transcript correction for call {call_id} changed "
+                    f"code-shaped tokens in a segment — discarding segment corrections"
+                )
+                corrected_segments = None
+                break
+
     if corrected or corrected_segments or not_speech:
         changed = raw.get("changed") or []
         logger.info(

drb-c2-core/app/internal/wer.py

@@ -0,0 +1,44 @@
+"""
+Word error rate — server-26#163's eval harness needs a real number to compare
+against, not a vibe. Standard definition: word-level Levenshtein distance
+between a human-verified reference and the machine hypothesis, divided by the
+reference's own word count. Case-insensitive, punctuation-insensitive — this
+measures whether the right WORDS came out, not transcript formatting.
+"""
+import re
+from typing import Optional
+
+
+def _tokenize(text: str) -> list[str]:
+    return re.findall(r"[\w']+", (text or "").lower())
+
+
+def word_error_rate(reference: str, hypothesis: str) -> Optional[float]:
+    """
+    (substitutions + deletions + insertions) / len(reference words).
+
+    None when the reference has no words — WER is undefined there, not 0.0;
+    a caller that defaults a None to 0.0 would report a perfect score for a
+    call nobody actually transcribed.
+    """
+    ref = _tokenize(reference)
+    hyp = _tokenize(hypothesis)
+    if not ref:
+        return None
+    if not hyp:
+        return 1.0
+
+    n, m = len(ref), len(hyp)
+    # Single-row DP over Levenshtein distance — O(n*m) time, O(m) space.
+    row = list(range(m + 1))
+    for i in range(1, n + 1):
+        prev_diag = row[0]
+        row[0] = i
+        for j in range(1, m + 1):
+            prev_row_j = row[j]
+            if ref[i - 1] == hyp[j - 1]:
+                row[j] = prev_diag
+            else:
+                row[j] = 1 + min(prev_diag, row[j], row[j - 1])
+            prev_diag = prev_row_j
+    return row[m] / n

drb-c2-core/app/routers/calls.py

@@ -5,6 +5,7 @@ from typing import Optional
 from app.internal import firestore as fstore
 from app.internal.auth import (
     require_admin_token,
+    require_firebase_token,
     require_service_or_firebase_token,
     resolve_caller_org_id,
     reprocess_limiter,
@@ -15,9 +16,49 @@ from app.internal.storage import gcs_uri_for_call, with_playback_url
 class TranscriptUpdate(BaseModel):
     transcript: str
 
+
+class EvalTranscriptUpdate(BaseModel):
+    text: str
+
 router = APIRouter(prefix="/calls", tags=["calls"])
 
 
+def _parse_ts(value: Optional[str], field: str) -> Optional[datetime]:
+    """ISO string from a query param → aware datetime, or 400.
+
+    started_at is stored as a Firestore timestamp, so a cursor or range bound
+    passed through as the raw string compares by *type* (every string sorts
+    after every timestamp) rather than by time — a string cursor made "Load
+    more" return the first page again.
+    """
+    if not value:
+        return None
+    try:
+        dt = datetime.fromisoformat(value.replace("Z", "+00:00"))
+    except ValueError:
+        raise HTTPException(400, f"{field} is not an ISO-8601 timestamp.")
+    return dt if dt.tzinfo else dt.replace(tzinfo=timezone.utc)
+
+
+def _next_cursor(rows: list[dict], matches: list[dict], page: list[dict], window: int) -> Optional[str]:
+    """Where the next page of a bounded-window scan starts.
+
+    More matches than fit on the page → resume right after the last row
+    returned, or every match between it and the end of the window is skipped
+    (a 200-row window shown 50 at a time lost 150 calls per "Load more").
+    Otherwise resume after the last row SCANNED, not the last match — a page
+    whose last match sits early in the window would re-scan everything after
+    it and loop forever on a sparse filter. A short window is the end.
+    """
+    if len(matches) > len(page):
+        last = page[-1].get("started_at")
+    elif len(rows) == window:
+        last = rows[-1].get("started_at")
+    else:
+        return None
+    return last.isoformat() if hasattr(last, "isoformat") else last
+
+
 @router.get("")
 async def list_calls(
     node_id: Optional[str] = Query(None),
@@ -50,7 +91,9 @@ async def search_calls(
     link: str = Query("any", pattern="^(any|orphan|linked)$"),
     transcript: str = Query("any", pattern="^(any|yes|no)$"),
     q: Optional[str] = Query(None, description="case-insensitive substring of the transcript"),
-    decoded: dict = Depends(require_admin_token),
+    date_from: Optional[str] = Query(None, description="ISO timestamp, inclusive lower bound on started_at"),
+    date_to: Optional[str] = Query(None, description="ISO timestamp, inclusive upper bound on started_at"),
+    decoded: dict = Depends(require_firebase_token),
 ):
     """
     Paged, filterable call archive — the backend for the /calls page.
@@ -68,6 +111,11 @@ async def search_calls(
 
     `window_exhausted` says the scan hit its cap before filling the page, so an
     empty result means "not in this window", not "none exist".
+
+    Open to every org member (viewer included), not just admins: the Firestore
+    rules already let any member read every call doc in their org
+    (firestore.rules `calls` → docInMyOrg), so this route exposes nothing a
+    viewer's browser couldn't already read directly.
     """
     org_id = await resolve_caller_org_id(decoded)
     if org_id is None:
@@ -78,13 +126,24 @@ async def search_calls(
     if not org_id:
         raise HTTPException(403, "No organization scope for this caller.")
 
+    cursor_dt = _parse_ts(cursor, "cursor")
+    from_dt = _parse_ts(date_from, "date_from")
+    to_dt = _parse_ts(date_to, "date_to")
+
+    # A range on the ordered field rides the same org_id/started_at index.
+    conditions: list[tuple[str, str, object]] = [("org_id", "==", org_id)]
+    if from_dt:
+        conditions.append(("started_at", ">=", from_dt))
+    if to_dt:
+        conditions.append(("started_at", "<=", to_dt))
+
     window = max(limit * 10, 200)
     rows = await fstore.collection_where(
         "calls",
-        [("org_id", "==", org_id)],
+        conditions,
         order_by=[("started_at", "DESCENDING")],
         limit_to=window,
-        start_after={"started_at": cursor} if cursor else None,
+        start_after={"started_at": cursor_dt} if cursor_dt else None,
     )
 
     needle = (q or "").strip().lower()
@@ -113,13 +172,7 @@ async def search_calls(
     matches = [c for c in rows if _keep(c)]
     page = matches[:limit]
 
-    # Cursor advances over the SCANNED window, not the filtered page — otherwise
+    next_cursor = _next_cursor(rows, matches, page, window)
-    # a page whose last match sits early in the window would re-scan everything
-    # after it on the next request and loop forever on a sparse filter.
-    next_cursor = None
-    if len(rows) == window:
-        last_scanned = rows[-1].get("started_at")
-        next_cursor = last_scanned.isoformat() if hasattr(last_scanned, "isoformat") else last_scanned
 
     return {
         "calls": [with_playback_url(c) for c in page],
@@ -130,6 +183,107 @@ async def search_calls(
     }
 
 
+@router.get("/eval-queue")
+async def eval_queue(
+    limit: int = Query(5, ge=1, le=20),
+    cursor: Optional[str] = Query(None, description="started_at of the last row of the previous page"),
+    decoded: dict = Depends(require_admin_token),
+):
+    """
+    A batch of calls that have a machine transcript but no human-verified one
+    yet — the backend for the STT eval page (server-26#163).
+
+    Deliberately separate from `PATCH /{call_id}/transcript`: that route is a
+    PRODUCTION correction — it re-runs extraction, unlinks incidents, and
+    feeds the vocabulary learner. An eval annotation must never trigger any
+    of that; it only exists to measure the pipeline, not to change what it
+    already decided. `eval_transcript` lives next to `transcript`/
+    `transcript_corrected` on the call doc and nothing downstream reads it.
+
+    Same bounded-window-scan-plus-cursor shape as `/search`, for the same
+    reason: no composite index exists for "eval_transcript is unset", and one
+    scan ordered by started_at is already trusted here. Paging through with
+    the returned cursor is how "however many, over time" actually works —
+    each call is where the last session left off, not a fresh random sample.
+    """
+    org_id = await resolve_caller_org_id(decoded)
+    if org_id is None:
+        org_id = decoded.get("org_id")
+    if not org_id:
+        raise HTTPException(403, "No organization scope for this caller.")
+
+    cursor_dt = _parse_ts(cursor, "cursor")
+    window = max(limit * 20, 300)
+    rows = await fstore.collection_where(
+        "calls",
+        [("org_id", "==", org_id)],
+        order_by=[("started_at", "DESCENDING")],
+        limit_to=window,
+        start_after={"started_at": cursor_dt} if cursor_dt else None,
+    )
+
+    def _eligible(c: dict) -> bool:
+        text = c.get("transcript_corrected") or c.get("transcript") or ""
+        return bool(text) and not c.get("eval_transcript")
+
+    matches = [c for c in rows if _eligible(c)]
+    page = matches[:limit]
+
+    next_cursor = _next_cursor(rows, matches, page, window)
+
+    return {
+        "calls": [with_playback_url(c) for c in page],
+        "next_cursor": next_cursor,
+        "scanned": len(rows),
+        "matched": len(matches),
+        "window_exhausted": len(rows) == window,
+    }
+
+
+@router.get("/eval-stats")
+async def eval_stats(decoded: dict = Depends(require_admin_token)):
+    """
+    How many calls have a human-verified transcript, and the WER of the raw
+    and corrected machine transcripts against them (server-26#163).
+
+    Whole-collection scan, matching `GET /calls` (list_calls above) rather
+    than the bounded-window pattern the paged routes use: the eval set this
+    is measuring is built a few calls at a time and expected to stay small
+    (tens to hundreds), so a full scan filtered in Python is the honest
+    answer rather than a windowed guess that could miss eval'd calls sitting
+    outside a recency window.
+    """
+    from app.internal.wer import word_error_rate
+
+    org_id = await resolve_caller_org_id(decoded)
+    filters = {"org_id": org_id} if org_id is not None else {}
+    calls = await fstore.collection_list("calls", **filters)
+
+    raw_wers: list[float] = []
+    corrected_wers: list[float] = []
+    for c in calls:
+        ref = c.get("eval_transcript")
+        if not ref:
+            continue
+        raw = c.get("transcript") or ""
+        corrected = c.get("transcript_corrected") or raw
+        raw_wer = word_error_rate(ref, raw)
+        corrected_wer = word_error_rate(ref, corrected)
+        if raw_wer is not None:
+            raw_wers.append(raw_wer)
+        if corrected_wer is not None:
+            corrected_wers.append(corrected_wer)
+
+    def _avg(xs: list[float]) -> Optional[float]:
+        return round(sum(xs) / len(xs), 4) if xs else None
+
+    return {
+        "eval_count": len(raw_wers),
+        "raw_wer": _avg(raw_wers),
+        "corrected_wer": _avg(corrected_wers),
+    }
+
+
 @router.get("/{call_id}")
 async def get_call(call_id: str, decoded: dict = Depends(require_service_or_firebase_token)):
     call = await fstore.doc_get("calls", call_id)
@@ -313,3 +467,29 @@ async def patch_transcript(
         preserve_transcript_correction=True,
     )
     return {"ok": True, "call_id": call_id}
+
+
+@router.put("/{call_id}/eval-transcript")
+async def put_eval_transcript(
+    call_id: str,
+    body: EvalTranscriptUpdate,
+    decoded: dict = Depends(require_admin_token),
+):
+    """
+    Record a human-verified reference transcript for the STT eval harness
+    (server-26#163). Pure data capture — unlike `PATCH /{call_id}/transcript`
+    above, this never touches `transcript`/`transcript_corrected`, never
+    re-runs extraction, never unlinks incidents, and never feeds the
+    vocabulary learner. It exists to MEASURE the pipeline's output, not to
+    change it; the two must not share a code path.
+    """
+    call = await fstore.doc_get("calls", call_id)
+    if not call:
+        raise HTTPException(404, f"Call '{call_id}' not found.")
+
+    await fstore.doc_set("calls", call_id, {
+        "eval_transcript": body.text,
+        "eval_transcript_by": decoded.get("email") or decoded.get("uid"),
+        "eval_transcript_at": datetime.now(timezone.utc).isoformat(),
+    })
+    return {"ok": True, "call_id": call_id}

drb-c2-core/tests/test_calls_parse_ts.py

@@ -0,0 +1,59 @@
+"""calls._parse_ts — cursor/date bounds must reach Firestore as datetimes.
+
+A raw ISO string compared against a timestamp field sorts by type, not time,
+which made the Archive's "Load more" return the first page again.
+"""
+from datetime import datetime, timezone
+
+import pytest
+from fastapi import HTTPException
+
+from app.routers.calls import _next_cursor, _parse_ts
+
+
+def test_empty_is_none():
+    assert _parse_ts(None, "cursor") is None
+    assert _parse_ts("", "cursor") is None
+
+
+def test_z_suffix_parses_as_utc():
+    assert _parse_ts("2026-09-20T12:00:00Z", "date_from") == datetime(2026, 9, 20, 12, tzinfo=timezone.utc)
+
+
+def test_naive_is_assumed_utc():
+    assert _parse_ts("2026-09-20T12:00:00", "date_to").tzinfo == timezone.utc
+
+
+def test_round_trips_isoformat_cursor():
+    dt = datetime(2026, 9, 20, 12, 30, 5, 123456, tzinfo=timezone.utc)
+    assert _parse_ts(dt.isoformat(), "cursor") == dt
+
+
+def test_garbage_is_400():
+    with pytest.raises(HTTPException) as exc:
+        _parse_ts("yesterday", "date_from")
+    assert exc.value.status_code == 400
+
+
+# ── _next_cursor ──────────────────────────────────────────────────────────
+
+
+def _rows(n):
+    return [{"started_at": datetime(2026, 9, 20, 12, i // 60, i % 60, tzinfo=timezone.utc)} for i in range(n)]
+
+
+def test_cursor_resumes_after_last_returned_row_when_matches_overflow():
+    rows = _rows(200)
+    page = rows[:50]
+    assert _next_cursor(rows, rows, page, 200) == page[-1]["started_at"].isoformat()
+
+
+def test_cursor_resumes_after_window_when_page_holds_every_match():
+    rows = _rows(200)
+    matches = rows[:3]
+    assert _next_cursor(rows, matches, matches, 200) == rows[-1]["started_at"].isoformat()
+
+
+def test_short_window_is_the_end():
+    rows = _rows(20)
+    assert _next_cursor(rows, rows[:5], rows[:5], 200) is None

drb-c2-core/tests/test_eval_transcript.py

@@ -0,0 +1,145 @@
+"""
+server-26#163 — the STT eval harness: word_error_rate() and the three routes
+that back the /admin "STT Eval" tab.
+
+Load-bearing property, checked directly: eval annotation must never touch
+`transcript`/`transcript_corrected`, re-run extraction, or unlink incidents —
+that's PATCH /{call_id}/transcript's job, a production correction with real
+side effects. This is pure measurement and must stay pure.
+"""
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.internal.wer import word_error_rate
+from app.main import app
+from app.internal.auth import require_admin_token, require_service_or_firebase_token
+from app.routers import calls
+
+client = TestClient(app)
+
+ADMIN = {"role": "admin", "org_id": "org-A"}
+
+
+def _override(decoded: dict):
+    # calls.router carries its own router-level require_service_or_firebase_token
+    # (app/main.py) ON TOP OF each admin route's own require_admin_token — both
+    # have to be overridden or the router-level one 401s before the route's own
+    # dependency is ever evaluated.
+    app.dependency_overrides[require_admin_token] = lambda: decoded
+    app.dependency_overrides[require_service_or_firebase_token] = lambda: decoded
+
+
+def teardown_function():
+    app.dependency_overrides.pop(require_admin_token, None)
+    app.dependency_overrides.pop(require_service_or_firebase_token, None)
+
+
+# ── word_error_rate ─────────────────────────────────────────────────────────
+
+def test_identical_transcripts_are_zero_wer():
+    assert word_error_rate("K on the 600, I'm on Jackson Avenue.",
+                            "K on the 600, I'm on Jackson Avenue.") == 0.0
+
+
+def test_case_and_punctuation_are_ignored():
+    assert word_error_rate("Home Street and Forest Ave!", "home street and forest ave") == 0.0
+
+
+def test_one_substitution_out_of_three_words():
+    assert word_error_rate("the cat sat", "the cat sit") == pytest.approx(1 / 3)
+
+
+def test_empty_reference_is_undefined_not_zero():
+    """A call nobody transcribed must not score as a perfect match."""
+    assert word_error_rate("", "anything") is None
+    assert word_error_rate(None, "anything") is None
+
+
+def test_empty_hypothesis_against_real_reference_is_total_loss():
+    assert word_error_rate("home street and forest ave", "") == 1.0
+
+
+def test_insertion_counts_against_the_hypothesis():
+    # reference 3 words, hypothesis adds 2 extra -> 2 insertions / 3 ref words
+    assert word_error_rate("show me clear", "show me clear right now") == pytest.approx(2 / 3)
+
+
+# ── GET /calls/eval-queue ───────────────────────────────────────────────────
+
+def _call(call_id, transcript="a real transcript here", corrected=None, eval_transcript=None, org_id="org-A"):
+    return {
+        "call_id": call_id, "org_id": org_id, "started_at": "2026-09-21T00:00:00+00:00",
+        "transcript": transcript, "transcript_corrected": corrected, "eval_transcript": eval_transcript,
+    }
+
+
+def test_eval_queue_skips_already_evaluated_and_transcript_less_calls():
+    rows = [
+        _call("c1", eval_transcript="already done"),
+        _call("c2", transcript=None),
+        _call("c3"),
+    ]
+    _override(ADMIN)
+    with patch.object(calls.fstore, "collection_where", AsyncMock(return_value=rows)):
+        resp = client.get("/calls/eval-queue")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert [c["call_id"] for c in body["calls"]] == ["c3"]
+    assert body["matched"] == 1
+
+
+def test_eval_queue_requires_an_org_scope():
+    _override({"role": "admin"})  # platform admin, no org claim
+    resp = client.get("/calls/eval-queue")
+    assert resp.status_code == 403
+
+
+# ── GET /calls/eval-stats ───────────────────────────────────────────────────
+
+def test_eval_stats_averages_wer_across_evaluated_calls_only():
+    rows = [
+        _call("c1", transcript="the cat sat", corrected="the cat sat", eval_transcript="the cat sat"),  # 0.0 / 0.0
+        _call("c2", transcript="the cat sit", corrected="the cat sat", eval_transcript="the cat sat"),  # raw 1/3, corrected 0.0
+        _call("c3", eval_transcript=None),  # excluded entirely
+    ]
+    _override(ADMIN)
+    with patch.object(calls.fstore, "collection_list", AsyncMock(return_value=rows)):
+        resp = client.get("/calls/eval-stats")
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body["eval_count"] == 2
+    assert body["raw_wer"] == pytest.approx((0.0 + 1 / 3) / 2, abs=1e-4)
+    assert body["corrected_wer"] == 0.0
+
+
+def test_eval_stats_with_nothing_evaluated_yet_reports_none_not_zero():
+    _override(ADMIN)
+    with patch.object(calls.fstore, "collection_list", AsyncMock(return_value=[_call("c1")])):
+        resp = client.get("/calls/eval-stats")
+    body = resp.json()
+    assert body == {"eval_count": 0, "raw_wer": None, "corrected_wer": None}
+
+
+# ── PUT /{call_id}/eval-transcript ──────────────────────────────────────────
+
+def test_put_eval_transcript_writes_only_eval_fields():
+    _override(ADMIN)
+    existing = _call("c1", transcript="raw text", corrected="corrected text")
+    with patch.object(calls.fstore, "doc_get", AsyncMock(return_value=existing)), \
+         patch.object(calls.fstore, "doc_set", AsyncMock()) as mock_set:
+        resp = client.put("/calls/c1/eval-transcript", json={"text": "the verified ground truth"})
+    assert resp.status_code == 200
+    (collection, doc_id, doc), _ = mock_set.await_args
+    assert collection == "calls" and doc_id == "c1"
+    assert doc["eval_transcript"] == "the verified ground truth"
+    assert doc["eval_transcript_at"]
+    assert "transcript" not in doc and "transcript_corrected" not in doc
+
+
+def test_put_eval_transcript_404s_on_missing_call():
+    _override(ADMIN)
+    with patch.object(calls.fstore, "doc_get", AsyncMock(return_value=None)):
+        resp = client.put("/calls/nope/eval-transcript", json={"text": "x"})
+    assert resp.status_code == 404

drb-c2-core/tests/test_transcript_correction.py

@@ -211,6 +211,60 @@ async def test_model_failure_leaves_the_transcript_alone():
         assert await tc.correct("c1", "x y z w", SEGS, system_id="sys-1") == (None, None, False)
 
 
+# ── Code-token guard (server-26#162) ────────────────────────────────────────
+# Caught live: the same call came back with "10-7" rewritten to "10-13" in one
+# place and "10-4" in another. A real code swapped for a different real code
+# reads exactly as trustworthy as a correct one — worse than leaving the raw
+# mishearing in place, since nothing downstream can tell it happened.
+
+@pytest.mark.asyncio
+async def test_changed_ten_code_is_discarded():
+    payload = {"corrected": "10-13, we're back in town."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct("c1", "10-7, we're back in town.", None, system_id="sys-1")
+    assert text is None
+
+
+@pytest.mark.asyncio
+async def test_invented_code_token_is_discarded():
+    """Nothing code-shaped in the original — the model added one from nothing."""
+    payload = {"corrected": "ShotSpotter, 10-4, group of 3 shooting outside."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct("c1", "Seven, group of 3 shooting outside.", None, system_id="sys-1")
+    assert text is None
+
+
+@pytest.mark.asyncio
+async def test_legitimate_place_correction_with_unchanged_codes_still_applies():
+    """The guard must not collateral-damage a correction that never touches
+    a code token — Home/Forest for Holmes/4th-and-Rowe is exactly the kind of
+    fix this pass exists to make."""
+    payload = {"corrected": "10-13 coming over on Home Street and Forest Ave, 4-2."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct(
+            "c1", "10-13 coming over on Holmes Street and 4th and Rowe, 4-2.",
+            None, system_id="sys-1",
+        )
+    assert text == "10-13 coming over on Home Street and Forest Ave, 4-2."
+
+
+@pytest.mark.asyncio
+async def test_segment_code_change_discards_segments_only():
+    """A code change in one segment discards the whole segments array (same
+    all-or-nothing rule as a length mismatch), but the independently-checked
+    joined correction still stands if it kept its own codes intact. The
+    joined `text`/`corrected` pair here is deliberately code-free — this test
+    isolates the segment-level guard, not the joined-text one."""
+    payload = {
+        "corrected": "Show it out to Ossining, back to Route 9.",
+        "segments": ["Headquarters, 10-13.", "Show it out to Ossining.", "360 north, back to Route 9."],
+    }
+    with _system(), _gemini(payload):
+        text, segs, _ = await tc.correct("c1", "x y z w", SEGS, system_id="sys-1", talkgroup_id=9048)
+    assert segs is None
+    assert text == "Show it out to Ossining, back to Route 9."
+
+
 @pytest.mark.asyncio
 async def test_reference_data_reaches_the_prompt():
     seen = {}

drb-frontend/app/admin/page.tsx

@@ -4,7 +4,7 @@ import { useAuth } from "@/components/AuthProvider";
 import { c2api } from "@/lib/c2api";
 import { useEffect, useState, useRef, useCallback } from "react";
 import { useRouter } from "next/navigation";
-import type { UserRecord, AuditEntry, UserRole } from "@/lib/types";
+import type { UserRecord, AuditEntry, UserRole, CallRecord } from "@/lib/types";
 
 // ---------------------------------------------------------------------------
 // Shared primitives
@@ -1047,16 +1047,193 @@ function StaleCallsTab() {
   );
 }
 
+// ---------------------------------------------------------------------------
+// STT eval (server-26#163) — the eval harness for real transcription
+// accuracy. Separate from patchTranscript's "fix this call" flow: this never
+// re-runs extraction or touches an incident, it only records what was
+// actually said next to what Whisper heard, so eval-stats can report a real
+// WER instead of a guess. Built to be worked in short sessions, a handful of
+// calls at a time, over however many sittings it takes — not a one-shot form.
+// ---------------------------------------------------------------------------
+
+function fmtPct(x: number | null | undefined): string {
+  return x === null || x === undefined ? "—" : `${(x * 100).toFixed(1)}%`;
+}
+
+function EvalStatsBar({ stats }: { stats: { eval_count: number; raw_wer: number | null; corrected_wer: number | null } | null }) {
+  return (
+    <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 flex flex-wrap gap-x-8 gap-y-2">
+      <div>
+        <p className="text-xs text-gray-500 font-mono">Calls verified</p>
+        <p className="text-white text-lg font-mono">{stats?.eval_count ?? "—"}</p>
+      </div>
+      <div>
+        <p className="text-xs text-gray-500 font-mono">Raw WER (whisper-1)</p>
+        <p className="text-white text-lg font-mono">{fmtPct(stats?.raw_wer)}</p>
+      </div>
+      <div>
+        <p className="text-xs text-gray-500 font-mono">Corrected WER (shipped)</p>
+        <p className="text-white text-lg font-mono">{fmtPct(stats?.corrected_wer)}</p>
+      </div>
+      {stats && stats.eval_count > 0 && stats.eval_count < 20 && (
+        <p className="text-xs text-amber-400 font-mono self-end">
+          fewer than 20 calls — numbers will move a lot until this grows
+        </p>
+      )}
+    </div>
+  );
+}
+
+function SttEvalTab() {
+  const [stats, setStats] = useState<{ eval_count: number; raw_wer: number | null; corrected_wer: number | null } | null>(null);
+  const [queue, setQueue] = useState<CallRecord[]>([]);
+  const [cursor, setCursor] = useState<string | null>(null);
+  const [exhausted, setExhausted] = useState(false);
+  const [draft, setDraft] = useState("");
+  const [loadingBatch, setLoadingBatch] = useState(false);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const fetching = useRef(false);
+
+  const current = queue[0] ?? null;
+
+  const refreshStats = useCallback(() => {
+    c2api.getEvalStats().then(setStats).catch(() => { /* stats are a nice-to-have, not load-bearing */ });
+  }, []);
+
+  const loadBatch = useCallback(async () => {
+    if (fetching.current) return;
+    fetching.current = true;
+    setLoadingBatch(true);
+    setError(null);
+    try {
+      const res = await c2api.getEvalQueue(5, cursor);
+      setQueue((q) => [...q, ...res.calls]);
+      setCursor(res.next_cursor);
+      if (res.calls.length === 0 && !res.next_cursor) setExhausted(true);
+    } catch (e) {
+      setError(String(e));
+    } finally {
+      setLoadingBatch(false);
+      fetching.current = false;
+    }
+  }, [cursor]);
+
+  useEffect(() => { refreshStats(); }, [refreshStats]);
+
+  // Auto-refill: whenever the local queue runs dry and there's more to scan
+  // (or we haven't checked yet), pull another batch. Covers the sparse-window
+  // case too — a page with matches:0 but a next_cursor just means "keep
+  // scanning", not "done", so this fires again on its own.
+  useEffect(() => {
+    if (queue.length === 0 && !exhausted) loadBatch();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [queue.length, exhausted]);
+
+  useEffect(() => {
+    setDraft(current ? (current.transcript_corrected || current.transcript || "") : "");
+  }, [current]);
+
+  async function saveAndNext() {
+    if (!current) return;
+    setSaving(true);
+    setError(null);
+    try {
+      await c2api.putEvalTranscript(current.call_id, draft);
+      setQueue((q) => q.slice(1));
+      refreshStats();
+    } catch (e) {
+      setError(String(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  function skip() {
+    setQueue((q) => q.slice(1));
+  }
+
+  return (
+    <div className="space-y-4">
+      <p className="text-xs text-gray-500 font-mono">
+        Listen to the audio, correct the transcript below until it matches what was actually said, then save.
+        This never touches the call&apos;s real transcript or re-runs anything — it only records ground truth
+        for measuring the pipeline. Do as many or as few as you have time for; it picks up where you left off.
+      </p>
+
+      <EvalStatsBar stats={stats} />
+
+      {error && (
+        <div className="bg-red-950 border border-red-800 rounded-lg p-3">
+          <p className="text-red-400 text-sm font-mono">{error}</p>
+        </div>
+      )}
+
+      {current ? (
+        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-3">
+          <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-xs font-mono text-gray-400">
+            <span>{new Date(current.started_at).toLocaleString()}</span>
+            <span>{current.talkgroup_name || (current.talkgroup_id ? `TGID ${current.talkgroup_id}` : "unknown talkgroup")}</span>
+          </div>
+
+          {current.audio_url ? (
+            // eslint-disable-next-line jsx-a11y/media-has-caption
+            <audio controls src={current.audio_url} className="w-full h-9" />
+          ) : (
+            <p className="text-xs text-gray-500 italic">No audio on this call — skip it.</p>
+          )}
+
+          <div>
+            <label className="text-xs text-gray-400 block mb-1">
+              Machine transcript (pre-filled) — correct it into what was actually said
+            </label>
+            <textarea
+              value={draft}
+              onChange={(e) => setDraft(e.target.value)}
+              rows={4}
+              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            />
+          </div>
+
+          <div className="flex gap-2">
+            <button
+              onClick={saveAndNext}
+              disabled={saving || !draft.trim()}
+              className="bg-indigo-600 hover:bg-indigo-500 disabled:opacity-50 text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
+            >
+              {saving ? "Saving…" : "Save & next"}
+            </button>
+            <button
+              onClick={skip}
+              disabled={saving}
+              className="bg-gray-800 hover:bg-gray-700 disabled:opacity-50 border border-gray-700 text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
+            >
+              Skip
+            </button>
+          </div>
+        </div>
+      ) : (
+        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4">
+          <p className="text-sm font-mono text-gray-400">
+            {loadingBatch ? "Loading calls…" : exhausted ? "Nothing left to verify right now — check back after more calls come in." : "Loading…"}
+          </p>
+        </div>
+      )}
+    </div>
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Main admin page
 // ---------------------------------------------------------------------------
 
-type AdminTab = "features" | "correlation" | "users" | "audit" | "calls";
+type AdminTab = "features" | "correlation" | "users" | "audit" | "calls" | "eval";
 
 const TAB_LABELS: { key: AdminTab; label: string }[] = [
   { key: "features",    label: "AI Features" },
   { key: "correlation", label: "Correlation Debug" },
   { key: "calls",       label: "Calls" },
+  { key: "eval",        label: "STT Eval" },
   { key: "users",       label: "Users" },
   { key: "audit",       label: "Audit Log" },
 ];
@@ -1102,6 +1279,7 @@ export default function AdminPage() {
       {tab === "features"    && <FeaturesTab />}
       {tab === "correlation" && <CorrelationDebugTab />}
       {tab === "calls"       && <StaleCallsTab />}
+      {tab === "eval"        && <SttEvalTab />}
       {tab === "users"       && <UsersTab currentUid={user?.uid ?? ""} />}
       {tab === "audit"       && <AuditLogTab />}
     </div>

drb-frontend/app/calls/page.tsx

@@ -6,8 +6,9 @@
 // never correlated was invisible. That is the wrong way round when correlation
 // quality is the thing under development — the orphans are the evidence.
 //
-// Admin-only, because it exposes every call in the org regardless of node
+// Readable by every org member — the Firestore rules already let any member
-// ownership and carries the manual attribution controls.
+// read every call in their org. The manual attribution controls stay
+// admin-only, matching the admin gate on the link/unlink routes.
 
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useRouter } from "next/navigation";
@@ -23,6 +24,7 @@ import { Button } from "@/components/ui/Button";
 import { EmptyState, ErrorBanner } from "@/components/ui/EmptyState";
 import { SkeletonCard } from "@/components/ui/Skeleton";
 import { MachineOutputNotice } from "@/components/ui/MachineOutputNotice";
+import { DateRange, dayStart, dayEnd } from "@/components/ui/DateRange";
 
 type LinkFilter = "any" | "orphan" | "linked";
 type TranscriptFilter = "any" | "yes" | "no";
@@ -68,11 +70,13 @@ function ArchiveRow({
   call,
   systemName,
   incidents,
+  canEdit,
   onChanged,
 }: {
   call: CallRecord;
   systemName?: string;
   incidents: IncidentRecord[];
+  canEdit: boolean;
   onChanged: () => void;
 }) {
   const [open, setOpen] = useState(false);
@@ -178,18 +182,18 @@ function ArchiveRow({
                 <div key={id} className="flex items-center gap-2 text-xs">
                   <span className="text-ink-muted">attached to</span>
                   <span className="text-ink-2 truncate">{inc?.title ?? id.slice(0, 8)}</span>
-                  <button
+                  {canEdit && <button
                     onClick={() => detach(id)}
                     disabled={busy}
                     className="text-sev-major hover:underline disabled:opacity-50 shrink-0"
                   >
                     detach
-                  </button>
+                  </button>}
                 </div>
               );
             })}
 
-            <div className="flex flex-wrap items-center gap-2">
+            {canEdit && <div className="flex flex-wrap items-center gap-2">
               <select
                 value={attachTo}
                 onChange={(e) => setAttachTo(e.target.value)}
@@ -208,7 +212,7 @@ function ArchiveRow({
               <Button size="sm" variant="secondary" onClick={attach} disabled={!attachTo || busy}>
                 {busy ? "Saving…" : "Attach"}
               </Button>
-            </div>
+            </div>}
           </div>
 
           {error && <ErrorBanner message={error} />}
@@ -219,8 +223,9 @@ function ArchiveRow({
 }
 
 export default function ArchivePage() {
-  const { isAdmin, loading: authLoading } = useAuth();
+  const { user, orgId, isAdmin, loading: authLoading } = useAuth();
   const router = useRouter();
+  const canView = Boolean(user && (orgId || isAdmin));
   const { systems } = useSystems();
   const { incidents } = useIncidents(200);
 
@@ -235,10 +240,12 @@ export default function ArchivePage() {
   const [systemId, setSystemId] = useState("");
   const [q, setQ] = useState("");
   const [submittedQ, setSubmittedQ] = useState("");
+  const [dateFrom, setDateFrom] = useState("");
+  const [dateTo, setDateTo] = useState("");
 
   useEffect(() => {
-    if (!authLoading && !isAdmin) router.replace("/");
+    if (!authLoading && !canView) router.replace("/");
-  }, [authLoading, isAdmin, router]);
+  }, [authLoading, canView, router]);
 
   const load = useCallback(
     async (nextCursor: string | null, append: boolean) => {
@@ -252,6 +259,8 @@ export default function ArchivePage() {
           transcript,
           system_id: systemId || undefined,
           q: submittedQ || undefined,
+          date_from: dayStart(dateFrom)?.toISOString(),
+          date_to: dayEnd(dateTo)?.toISOString(),
         });
         setCalls((prev) => (append ? [...prev, ...res.calls] : res.calls));
         setCursor(res.next_cursor);
@@ -262,14 +271,14 @@ export default function ArchivePage() {
         setLoading(false);
       }
     },
-    [link, transcript, systemId, submittedQ],
+    [link, transcript, systemId, submittedQ, dateFrom, dateTo],
   );
 
   // Reload from the top whenever a filter changes.
   useEffect(() => {
-    if (authLoading || !isAdmin) return;
+    if (authLoading || !canView) return;
     load(null, false);
-  }, [authLoading, isAdmin, load]);
+  }, [authLoading, canView, load]);
 
   const systemName = useMemo(() => {
     const m = new Map(systems.map((s) => [s.system_id, s.name]));
@@ -277,7 +286,7 @@ export default function ArchivePage() {
   }, [systems]);
 
   // Every hook runs before this guard — see the note in app/nodes/page.tsx.
-  if (authLoading || !isAdmin) return null;
+  if (authLoading || !canView) return null;
 
   const orphanCount = calls.filter((c) => callIncidentIds(c).length === 0).length;
   const noTranscript = calls.filter((c) => !(c.transcript_corrected || c.transcript)).length;
@@ -286,7 +295,9 @@ export default function ArchivePage() {
     <div className="space-y-6">
       <PageHeader
         title="Archive"
-        description="Every call on the account, correlated or not. Attach an orphan to the incident it belongs to, or detach one the correlator got wrong."
+        description={isAdmin
+          ? "Every call on the account, correlated or not. Attach an orphan to the incident it belongs to, or detach one the correlator got wrong."
+          : "Every call on the account, correlated or not."}
       />
 
       <div className="flex flex-wrap items-center gap-3">
@@ -329,6 +340,8 @@ export default function ArchivePage() {
           ))}
         </select>
 
+        <DateRange from={dateFrom} to={dateTo} onChange={(f, t) => { setDateFrom(f); setDateTo(t); }} />
+
         <form
           onSubmit={(e) => { e.preventDefault(); setSubmittedQ(q.trim()); }}
           className="flex items-center gap-2 ml-auto"
@@ -373,6 +386,7 @@ export default function ArchivePage() {
               call={call}
               systemName={systemName(call.system_id)}
               incidents={incidents}
+              canEdit={isAdmin}
               onChanged={() => load(null, false)}
             />
           ))}

drb-frontend/app/incidents/page.tsx

@@ -13,6 +13,7 @@ import { Badge } from "@/components/ui/Badge";
 import { EmptyState, ErrorBanner } from "@/components/ui/EmptyState";
 import { SkeletonCard } from "@/components/ui/Skeleton";
 import { MachineOutputNotice } from "@/components/ui/MachineOutputNotice";
+import { DateRange, dayStart, dayEnd } from "@/components/ui/DateRange";
 import { isKnownSeverity, severityRank } from "@/lib/severity";
 import { SeverityMark, SeveritySpine } from "@/components/marks/SeverityMark";
 import { TypeGlyph } from "@/components/marks/TypeGlyph";
@@ -27,6 +28,23 @@ const SEVERITY_FILTERS: { key: SeverityFilter; label: string }[] = [
 const FILTER_THRESHOLD: Record<SeverityFilter, number> = { all: -1, minor: 1, moderate: 2, major: 3 };
 
 type SortMode = "recent" | "severity";
+type StatusFilter = "any" | "active" | "resolved";
+
+const INCIDENT_TYPES = ["fire", "police", "ems", "accident", "other"];
+
+// Firestore holds the paging; text/type/status filtering runs over the loaded
+// window, so "Load more" also widens what the search can find.
+const PAGE_SIZE = 100;
+
+function matchesSearch(inc: IncidentRecord, needle: string): boolean {
+  if (!needle) return true;
+  const hay = [
+    inc.title, inc.location, inc.summary, inc.type,
+    ...(inc.units ?? []), ...(inc.vehicles ?? []), ...(inc.tags ?? []),
+    ...(inc.location_mentions ?? []),
+  ].filter(Boolean).join(" ").toLowerCase();
+  return hay.includes(needle);
+}
 
 // The Firestore client surfaces a missing composite index or an undeployed
 // ruleset as a raw multi-line string with a console URL in it — not something
@@ -178,11 +196,19 @@ function CreateModal({ onClose, onCreate }: { onClose: () => void; onCreate: (bo
 
 export default function IncidentsPage() {
   const { isAdmin } = useAuth();
-  const { incidents, loading, error } = useIncidents();
+  const [pageLimit, setPageLimit] = useState(PAGE_SIZE);
+  const [dateFrom, setDateFrom] = useState("");
+  const [dateTo, setDateTo] = useState("");
+  const rangeFrom = useMemo(() => dayStart(dateFrom), [dateFrom]);
+  const rangeTo = useMemo(() => dayEnd(dateTo), [dateTo]);
+  const { incidents, loading, error, hasMore } = useIncidents(pageLimit, rangeFrom, rangeTo);
   const activeCalls = useActiveCalls();
   const [showCreate, setShowCreate] = useState(false);
   const [severityFilter, setSeverityFilter] = useState<SeverityFilter>("all");
   const [sortMode, setSortMode] = useState<SortMode>("recent");
+  const [statusFilter, setStatusFilter] = useState<StatusFilter>("any");
+  const [typeFilter, setTypeFilter] = useState("");
+  const [search, setSearch] = useState("");
 
   const onAirIncidentIds = useMemo(() => {
     const s = new Set<string>();
@@ -194,12 +220,24 @@ export default function IncidentsPage() {
 
   const filtered = useMemo(() => {
     const threshold = FILTER_THRESHOLD[severityFilter];
-    const list = incidents.filter((i) => severityRank(i.severity) >= threshold);
+    const needle = search.trim().toLowerCase();
+    const list = incidents.filter((i) =>
+      severityRank(i.severity) >= threshold &&
+      (statusFilter === "any" || i.status === statusFilter) &&
+      (!typeFilter || i.type === typeFilter) &&
+      matchesSearch(i, needle)
+    );
     if (sortMode === "severity") {
       return [...list].sort((a, b) => severityRank(b.severity) - severityRank(a.severity) || b.started_at.localeCompare(a.started_at));
     }
     return list; // useIncidents() already orders by started_at desc
-  }, [incidents, severityFilter, sortMode]);
+  }, [incidents, severityFilter, sortMode, statusFilter, typeFilter, search]);
+
+  const filtersActive = severityFilter !== "all" || statusFilter !== "any" || typeFilter !== "" || search.trim() !== "" || dateFrom !== "" || dateTo !== "";
+  function clearFilters() {
+    setSeverityFilter("all"); setStatusFilter("any"); setTypeFilter(""); setSearch("");
+    setDateFrom(""); setDateTo(""); setPageLimit(PAGE_SIZE);
+  }
 
   const hiddenCount = incidents.length - filtered.length;
   const activeCount = filtered.filter((i) => i.status === "active").length;
@@ -249,7 +287,39 @@ export default function IncidentsPage() {
             </button>
           ))}
         </div>
-        <label className="flex items-center gap-2 text-xs text-ink-muted">
+        <input
+          type="search"
+          value={search}
+          onChange={(e) => setSearch(e.target.value)}
+          placeholder="Search title, location, units…"
+          className="bg-surface border border-line rounded-lg text-sm text-ink px-3 py-2 w-full sm:w-64 focus:outline-none focus:border-accent"
+        />
+      </div>
+
+      <div className="flex flex-wrap items-center gap-3">
+        <select
+          value={statusFilter}
+          onChange={(e) => setStatusFilter(e.target.value as StatusFilter)}
+          className="bg-surface border border-line rounded-lg px-2 py-1.5 text-sm text-ink-2 focus:outline-none focus:border-accent"
+        >
+          <option value="any">Any status</option>
+          <option value="active">Active</option>
+          <option value="resolved">Resolved</option>
+        </select>
+        <select
+          value={typeFilter}
+          onChange={(e) => setTypeFilter(e.target.value)}
+          className="bg-surface border border-line rounded-lg px-2 py-1.5 text-sm text-ink-2 focus:outline-none focus:border-accent"
+        >
+          <option value="">All types</option>
+          {INCIDENT_TYPES.map((t) => <option key={t} value={t}>{t}</option>)}
+        </select>
+        <DateRange
+          from={dateFrom}
+          to={dateTo}
+          onChange={(f, t) => { setDateFrom(f); setDateTo(t); setPageLimit(PAGE_SIZE); }}
+        />
+        <label className="flex items-center gap-2 text-xs text-ink-muted ml-auto">
           Sort
           <select
             value={sortMode}
@@ -270,7 +340,8 @@ export default function IncidentsPage() {
         <>
           {hiddenCount > 0 && (
             <p className="text-xs text-ink-muted">
-              {hiddenCount} incident{hiddenCount !== 1 ? "s" : ""} hidden by the severity filter.
+              {hiddenCount} of {incidents.length} loaded incident{incidents.length !== 1 ? "s" : ""} hidden by filters
+              {hasMore && " — load more to search further back"}.
             </p>
           )}
 
@@ -302,19 +373,27 @@ export default function IncidentsPage() {
 
           {filtered.length === 0 && !error && (
             <EmptyState
-              title={incidents.length === 0 ? "No incidents recorded yet" : "No incidents match this filter"}
+              title={incidents.length === 0 && !filtersActive ? "No incidents recorded yet" : "No incidents match these filters"}
               description={
-                incidents.length === 0
+                incidents.length === 0 && !filtersActive
                   ? "Incidents appear automatically once calls start correlating."
-                  : "Try a lower severity threshold."
+                  : "Try clearing a filter, or load older incidents."
               }
               action={
-                incidents.length > 0 && severityFilter !== "all" ? (
+                filtersActive ? (
-                  <Button variant="secondary" size="sm" onClick={() => setSeverityFilter("all")}>Clear filter</Button>
+                  <Button variant="secondary" size="sm" onClick={clearFilters}>Clear filters</Button>
                 ) : undefined
               }
             />
           )}
+
+          {hasMore && (
+            <div className="flex justify-center">
+              <Button variant="secondary" onClick={() => setPageLimit((n) => n + PAGE_SIZE)}>
+                Load more
+              </Button>
+            </div>
+          )}
         </>
       )}
 

drb-frontend/components/ui/DateRange.tsx

@@ -0,0 +1,57 @@
+"use client";
+
+// A from/to pair of native date inputs. Values are the inputs' own
+// "YYYY-MM-DD" strings; dayStart/dayEnd turn them into the local-midnight
+// bounds a started_at range query needs, so "to" includes the whole day.
+
+export function dayStart(ymd: string): Date | undefined {
+  if (!ymd) return undefined;
+  const [y, m, d] = ymd.split("-").map(Number);
+  return new Date(y, m - 1, d, 0, 0, 0, 0);
+}
+
+export function dayEnd(ymd: string): Date | undefined {
+  if (!ymd) return undefined;
+  const [y, m, d] = ymd.split("-").map(Number);
+  return new Date(y, m - 1, d, 23, 59, 59, 999);
+}
+
+const inputClass =
+  "bg-surface border border-line rounded-lg px-2 py-1.5 text-sm text-ink-2 focus:outline-none focus:border-accent";
+
+export function DateRange({
+  from,
+  to,
+  onChange,
+}: {
+  from: string;
+  to: string;
+  onChange: (from: string, to: string) => void;
+}) {
+  return (
+    <div className="flex items-center gap-2 text-xs text-ink-muted">
+      <input
+        type="date"
+        aria-label="From date"
+        value={from}
+        max={to || undefined}
+        onChange={(e) => onChange(e.target.value, to)}
+        className={inputClass}
+      />
+      <span>to</span>
+      <input
+        type="date"
+        aria-label="To date"
+        value={to}
+        min={from || undefined}
+        onChange={(e) => onChange(from, e.target.value)}
+        className={inputClass}
+      />
+      {(from || to) && (
+        <button onClick={() => onChange("", "")} className="text-ink-muted hover:text-ink-2">
+          clear
+        </button>
+      )}
+    </div>
+  );
+}

drb-frontend/lib/c2api.ts

@@ -82,6 +82,8 @@ export const c2api = {
     link?: "any" | "orphan" | "linked";
     transcript?: "any" | "yes" | "no";
     q?: string;
+    date_from?: string;
+    date_to?: string;
   }) => {
     const qs = new URLSearchParams();
     for (const [k, v] of Object.entries(params)) {
@@ -100,6 +102,30 @@ export const c2api = {
   closeStallCalls: (olderThanMinutes: number, dryRun: boolean) =>
     request<{ dry_run: boolean; older_than_minutes: number; count: number; call_ids: string[] }>(`/calls/close-stale?older_than_minutes=${olderThanMinutes}&dry_run=${dryRun}`, { method: "POST" }),
 
+  // STT eval harness (server-26#163) — separate from patchTranscript above,
+  // which is a production correction with real side effects (re-extraction,
+  // incident unlinking, vocabulary learning). This is pure measurement.
+  getEvalQueue: (limit: number, cursor?: string | null) => {
+    const qs = new URLSearchParams({ limit: String(limit) });
+    if (cursor) qs.set("cursor", cursor);
+    return request<{
+      calls: import("@/lib/types").CallRecord[];
+      next_cursor: string | null;
+      scanned: number;
+      matched: number;
+      window_exhausted: boolean;
+    }>(`/calls/eval-queue?${qs.toString()}`);
+  },
+  getEvalStats: () =>
+    request<{ eval_count: number; raw_wer: number | null; corrected_wer: number | null }>(
+      "/calls/eval-stats"
+    ),
+  putEvalTranscript: (callId: string, text: string) =>
+    request<{ ok: boolean; call_id: string }>(`/calls/${callId}/eval-transcript`, {
+      method: "PUT",
+      body: JSON.stringify({ text }),
+    }),
+
   // Incidents
   getIncidents: (params?: { status?: string; type?: string }) => {
     const qs = params ? "?" + new URLSearchParams(params as Record<string, string>).toString() : "";

drb-frontend/lib/types.ts

@@ -158,6 +158,10 @@ export interface CallRecord {
   corr_incident_idle_min?: number | null;
   corr_shared_units?: number | null;
   corr_candidates?: number | null;
+  /** Human-verified reference transcript for the STT eval harness (server-26#163) — never read by anything downstream. */
+  eval_transcript?: string | null;
+  eval_transcript_by?: string | null;
+  eval_transcript_at?: string | null;
 }
 
 export interface IncidentRecord {

drb-frontend/lib/useIncidents.ts

@@ -11,12 +11,19 @@ const toISO = (v: unknown): string =>
   (v as { toDate?: () => Date })?.toDate?.()?.toISOString?.() ??
   (typeof v === "string" ? v : new Date().toISOString());
 
-export function useIncidents(limitCount = 100) {
+export function useIncidents(limitCount = 100, dateFrom?: Date, dateTo?: Date) {
   const [incidents, setIncidents] = useState<IncidentRecord[]>([]);
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
+  // A full page means there may be older incidents past the limit; a short
+  // page means the query reached the end of the collection.
+  const [hasMore, setHasMore] = useState(false);
   const { orgId } = useAuth();
 
+  // Stable ms values so the effect dependency doesn't fire on every render
+  const dateFromMs = dateFrom?.getTime();
+  const dateToMs = dateTo?.getTime();
+
   useEffect(() => {
     let unsubFirestore: (() => void) | undefined;
 
@@ -34,9 +41,18 @@ export function useIncidents(limitCount = 100) {
         return;
       }
 
+      // A range on the ordered field rides the existing org_id/started_at index.
+      // Incident started_at is stored as a Python isoformat() STRING
+      // ("2026-09-20T12:00:00.123456+00:00", incident_correlator.py), not a
+      // Firestore timestamp — unlike calls. A Date bound compares by type and
+      // matches nothing, so the bounds go in as UTC ISO strings in the same
+      // shape, which then compare lexicographically in time order.
+      const isoBound = (ms: number) => new Date(ms).toISOString().replace("Z", "+00:00");
       const q = query(
         collection(db, "incidents"),
         where("org_id", "==", orgId),
+        ...(dateFromMs != null ? [where("started_at", ">=", isoBound(dateFromMs))] : []),
+        ...(dateToMs != null ? [where("started_at", "<=", isoBound(dateToMs))] : []),
         orderBy("started_at", "desc"),
         limit(limitCount)
       );
@@ -49,6 +65,7 @@ export function useIncidents(limitCount = 100) {
             updated_at: toISO(data.updated_at),
           } as IncidentRecord;
         }));
+        setHasMore(snap.size >= limitCount);
         setLoading(false);
       }, (err: FirestoreError) => {
         console.error("useIncidents:", err);
@@ -61,9 +78,9 @@ export function useIncidents(limitCount = 100) {
       unsubAuth();
       if (unsubFirestore) unsubFirestore();
     };
-  }, [limitCount, orgId]);
+  }, [limitCount, dateFromMs, dateToMs, orgId]);
 
-  return { incidents, loading, error };
+  return { incidents, loading, error, hasMore };
 }
 
 export function useIncident(incidentId: string | null) {