frontend: move accent-role blue/sky to Iris (popup links, play glyph, admin info banners)

Category colours (police tag, trips) stay as-is: they're semantic, not accent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

drb-c2-core/.env.example

@@ -31,9 +31,57 @@ NY511_API_KEY=
 NY511_API_BASE=
 # Ontario 511 developer key (camera provider "ontario511"; providers default OFF)
 ONTARIO511_API_KEY=
+# NWS weather alerts / METAR wind (server-26#237). NWS requires app name + contact in the User-Agent
+NWS_USER_AGENT=DRB (you@example.com)
+# Comma list of NWS state/marine area codes served
+NWS_AREA=NY
 
-# OpenAI — for transcription (Whisper), intelligence extraction, embeddings, and summaries
+# OpenAI — transcription (whisper-1, and the STT fallback), extraction, embeddings
 OPENAI_API_KEY=
+# Since 2026-11-08 OpenAI also serves the correlation decision and transcript
+# correction (CORR_CHEAP_MODEL / TRANSCRIPT_CORRECTION_MODEL, default gpt-4o-mini).
+# GEMINI_API_KEY is only needed if you point either of those at a gemini-* model.
+# OpenAI transcription model: whisper-1 | gpt-4o-mini-transcribe | gpt-4o-transcribe
+STT_MODEL=whisper-1
+
+# STT provider (server-26#297). Any OpenAI-compatible /audio/transcriptions API.
+# auto (default): groq if GROQ_API_KEY is set, compat if STT_BASE_URL is set,
+# otherwise openai — so leaving these blank keeps today's OpenAI behaviour.
+STT_PROVIDER=auto
+# Groq: whisper-large-v3-turbo, $0.04/audio-hour (min 10s billed per request).
+GROQ_API_KEY=
+# Model on the non-OpenAI provider.
+STT_COMPAT_MODEL=whisper-large-v3-turbo
+# Override the endpoint/key (blank = provider default: https://api.groq.com/openai/v1
+# and GROQ_API_KEY). Set both for a self-hosted OpenAI-compatible server.
+STT_BASE_URL=
+STT_API_KEY=
+# Retry on OpenAI STT_MODEL when the provider above fails (needs OPENAI_API_KEY).
+STT_FALLBACK_TO_OPENAI=true
+# Area places / local names / vocabulary in the STT prompt (non-OpenAI provider only).
+STT_VOCAB_PROMPT_ENABLED=true
+# Estimated prompt token budget (Whisper keeps only the last 224).
+STT_PROMPT_MAX_TOKENS=200
+
+# Scene extraction / embeddings models (server-26#298)
+EXTRACTION_MODEL=gpt-4o-mini
+EMBEDDING_MODEL=text-embedding-3-small
+# Skip correction + extraction for radio housekeeping (roll call, bare 10-4s).
+# Default false = shadow mode (verdict recorded, nothing skipped). Turn on only
+# after a shadow window shows no real events flagged (server-26#127).
+CHATTER_GATE_ENABLED=false
+# In-process geocode cache (Maps terms allow caching lat/lng <= 30 days)
+GEOCODE_CACHE_TTL_SECONDS=86400
+GEOCODE_CACHE_NEGATIVE_TTL_SECONDS=3600
+GEOCODE_CACHE_MAX_ENTRIES=5000
+
+# Push-alert confidence gate (server-26#300). Below the floor -> held (admin-only
+# GET /alerts/held). High-severity matches also need N calls on the incident or
+# the high confidence bar.
+ALERT_MIN_CONFIDENCE=0.5
+ALERT_HIGH_SEVERITY_MIN_CONFIDENCE=0.85
+ALERT_CORROBORATION_MIN_CALLS=2
+ALERT_STT_REFERENCE=0.3
 SUMMARY_INTERVAL_MINUTES=15
 CORRELATION_WINDOW_HOURS=4
 EMBEDDING_SIMILARITY_THRESHOLD=0.82

drb-c2-core/app/config.py

@@ -28,8 +28,39 @@ class Settings(BaseSettings):
 
     # OpenAI (STT + intelligence)
     openai_api_key: Optional[str] = None
+    # The OpenAI transcription model. Used when OpenAI is the STT provider AND
+    # as the fallback when another provider fails (server-26#297).
     stt_model: str = "whisper-1"  # whisper-1 | gpt-4o-mini-transcribe | gpt-4o-transcribe
 
+    # ── STT provider (server-26#297) ──────────────────────────────────────────
+    # Any OpenAI-compatible /audio/transcriptions endpoint. Groq serves
+    # whisper-large-v3-turbo at $0.04/audio-hour against whisper-1's $0.36, same
+    # API (min billed length 10s per request, prompt capped at 224 tokens --
+    # console.groq.com/docs/speech-to-text, checked 2026-10-27).
+    #   auto   -- groq when GROQ_API_KEY is set, compat when STT_BASE_URL is
+    #             set, else openai. The default, so a deploy without either
+    #             behaves exactly as before.
+    #   openai -- OpenAI only (stt_model).
+    #   groq   -- Groq (stt_compat_model), OpenAI fallback.
+    #   compat -- any other OpenAI-compatible server: stt_base_url + stt_api_key
+    #             + stt_compat_model (e.g. a self-hosted faster-whisper, #296).
+    stt_provider: str = "auto"
+    stt_base_url: Optional[str] = None   # None -> the provider's own default
+    stt_api_key: Optional[str] = None    # None -> GROQ_API_KEY / OPENAI_API_KEY
+    groq_api_key: Optional[str] = None
+    stt_compat_model: str = "whisper-large-v3-turbo"  # model on a non-OpenAI provider
+    # Retry a failed non-OpenAI request once on OpenAI stt_model. Needs
+    # OPENAI_API_KEY; without it a primary failure just means no transcript.
+    stt_fallback_to_openai: bool = True
+    # Domain vocabulary in the STT prompt (area places, local_knowledge terms,
+    # vocabulary). Applied to the non-OpenAI provider only: whisper-1 echoed
+    # vocabulary into silence before (see transcription.py), so the OpenAI
+    # path -- including the fallback -- keeps today's fixed prompt.
+    stt_vocab_prompt_enabled: bool = True
+    # Whisper keeps only the LAST 224 prompt tokens and silently drops the
+    # rest. The prompt is built against this estimated budget, with headroom.
+    stt_prompt_max_tokens: int = 200
+
     # AI request timeouts (server-26#153). Without these the OpenAI SDK waits
     # up to 600s per attempt and retries twice, and the google-genai client
     # waits forever, so a hung provider call had no upper bound at all — and
@@ -48,8 +79,31 @@ class Settings(BaseSettings):
     # google-genai does not retry unless told to, so this is the whole bound.
     gemini_timeout_seconds: float = 60.0
 
+    # Scene extraction + embeddings (server-26#298). Were literals in
+    # intelligence.py; any OpenAI chat model that supports JSON mode works.
+    extraction_model: str = "gpt-4o-mini"
+    embedding_model: str = "text-embedding-3-small"
+    # Skip correction + extraction (+ embedding, geocoding) for transcripts
+    # chatter_classifier.gate_chatter calls radio housekeeping. OFF by default:
+    # a gated call carries no units, so it is thin and takes the no-fit-check
+    # thin attach (mechanism A) instead of the fit-tested path or the #115
+    # orphan gate, and server-26#127 set "0 false positives in a live shadow
+    # window" as the bar for going live. Read chatter_classifier_verdict off a
+    # shadow window first, then set CHATTER_GATE_ENABLED=true.
+    chatter_gate_enabled: bool = False
+
     # Google Maps (geocoding)
     google_maps_api_key: Optional[str] = None
+    # In-process cache of Geocoding API answers (server-26#298). Dispatch
+    # repeats the same address on every follow-up call of a job, and the
+    # place verifier re-geocodes the same nouns. In-process rather than
+    # Firestore: a Firestore read costs about what it saves, adds latency on
+    # every miss, and would persist Maps content -- the Maps terms allow
+    # caching lat/lng for at most 30 days, and an in-memory TTL can never
+    # outlive that. Lost on restart, which only costs a few repeat lookups.
+    geocode_cache_ttl_seconds: int = 24 * 60 * 60
+    geocode_cache_negative_ttl_seconds: int = 60 * 60  # ZERO_RESULTS etc.
+    geocode_cache_max_entries: int = 5000
     # 511NY developer key (server-26#183/#198). Issued with the NYSDOT Developer
     # Access Agreement grant; the keyless legacy API is gone since the 511x cutover.
     ny511_api_key: Optional[str] = None
@@ -59,28 +113,32 @@ class Settings(BaseSettings):
     # Camera providers (app/internal/cameras). Keys only; every provider is still
     # OFF until an admin enables it, and licence-gated ones need an acknowledgement.
     ontario511_api_key: Optional[str] = None
+    # Weather context (server-26#237). api.weather.gov requires a User-Agent that
+    # names the app AND a contact (e.g. "DRB (ops@example.com)"); the placeholder
+    # default must be overridden in every deploy -- NWS may block anonymous agents.
+    nws_user_agent: str = "DRB scanner map (contact: set NWS_USER_AGENT)"
+    # Comma list of NWS state/marine area codes for /alerts/active (the areas served).
+    nws_area: str = "NY"
+    # NWS alerts cache TTL; the issue asks 60-120 s (floored at 30 s in code).
+    weather_alerts_ttl_s: int = 90
 
-    # Gemini (intelligence extraction, embeddings, incident summaries)
+    # Gemini: only used if CORR_CHEAP_MODEL / TRANSCRIPT_CORRECTION_MODEL is set
+    # to a gemini-* ID (app/internal/llm.py). OpenAI serves both by default.
     gemini_api_key: Optional[str] = None
-    # Correlation consensus models
-    # corr_cheap_model  — first-pass LLM correlator (runs on every call)
-    # corr_smart_model  — tiebreaker (only fires when rules and cheap LLM disagree)
-    # Both IDs below were retired by Google and returned 404 on every call from
-    # some point before 2026-08-18 until they were corrected. Because a failed
-    # LLM call falls back to the rules decision, nothing broke loudly -- the
-    # entire LLM tier and the consensus tiebreak were simply dead in production
-    # while correlation behaviour was being tuned against rules-only output.
-    # Verify against https://ai.google.dev/gemini-api/docs/models before changing.
-    corr_cheap_model: str = "gemini-3.6-flash"   # was gemini-2.0-flash (shut down)
-    # gemini-2.5-pro was closed to new projects by 2026-09 (every tiebreak 404'd
-    # in the first replay run, server-26#170); Google lists no stable Pro model,
-    # so the smart tier is the newest stable Flash instead.
-    corr_smart_model: str = "gemini-3.8-flash"   # was gemini-2.5-pro, gemini-1.5-pro
+    # Correlation LLM (server-26#299). The rules engine decides every confident
+    # case; this model is called at most ONCE per scene, and only when the rules
+    # flag the decision as ambiguous (incident_correlator._ambiguity). There is
+    # no second "smart" tier any more: the cheap/smart consensus tiebreak ran on
+    # ~15% of scenes and resolved nearly every disagreement as "new" (#115).
+    # A model ID was once retired by its provider and 404'd on every call for
+    # days; a failed LLM call falls back to the rules decision, so nothing broke
+    # loudly. Verify the ID against the provider's model list before changing.
+    corr_cheap_model: str = "gpt-4o-mini"   # OpenAI since 2026-11-08 (was gemini-3.6-flash); a gemini-* ID still works
     # Transcript correction (server-26#36). Runs inside transcription, once per
     # transcribed call above MIN_WORDS_FOR_CORRECTION, so it is priced like STT
     # rather than like the correlation tier — cheap model on purpose.
     transcript_correction_enabled: bool = True
-    transcript_correction_model: str = "gemini-3.6-flash"
+    transcript_correction_model: str = "gpt-4o-mini"  # OpenAI since 2026-11-08; a gemini-* ID still works
     # Retry Whisper once when its output is degenerate. The same clip produced a
     # 56-word ten-code counting run on one attempt and real speech on the next
     # (2026-08-23, call e49ea32c), so a hallucination is a coin-flip rather than
@@ -101,6 +159,30 @@ class Settings(BaseSettings):
     # else's PII. Both gates must be open before any snippet leaves.
     alert_transcript_snippet_enabled: bool = False
     place_verify_max_per_call: int = 3
+    # ── Alert confidence gate (server-26#300) ─────────────────────────────────
+    # Nothing in the pipeline emits a confidence, so the alerter derives one:
+    # how the rule matched (talkgroup 1.0 / extracted tag 0.8 / raw transcript
+    # text only 0.5 -- the CrimeRadar "fire alarm" -> "firearm" failure was a
+    # transcript match) scaled down when Whisper's own per-token probability
+    # (calls.stt_confidence) is below alert_stt_reference. Below the floor ->
+    # held, never pushed. High-severity matches also need the incident to
+    # have alert_corroboration_min_calls calls, or a confidence at or above
+    # alert_high_severity_min_confidence; held ones are released when a
+    # later call corroborates the incident. Starting values, not measured.
+    alert_min_confidence: float = 0.5
+    alert_high_severity_min_confidence: float = 0.85
+    alert_corroboration_min_calls: int = 2
+    # Low on purpose: exp(avg_logprob) on vocoded radio audio is often well
+    # under 0.5 for speech that is right, and Groq/OpenAI logprobs are not on
+    # a shared scale. Only clearly garbled audio should pull the score down.
+    alert_stt_reference: float = 0.3
+    alert_high_severity_terms: list[str] = [
+        "shots-fired", "shots fired", "shooting", "shot", "gun", "firearm", "weapon",
+        "stabbing", "stabbed", "officer-down", "officer down", "10-13",
+        "officer-needs-assistance", "active-shooter", "hostage", "barricade",
+        "explosion", "structure-fire", "structure fire", "working-fire",
+        "entrapment", "cardiac-arrest", "vehicle-pursuit", "pursuit",
+    ]
     # How close a candidate has to sound before it may rewrite a transcript.
     # Below this, Places Text Search will confidently hand back the nearest
     # business for any garbage string.
@@ -114,6 +196,39 @@ class Settings(BaseSettings):
     embedding_similarity_threshold: float = 0.93  # slow-path: requires location corroboration
     embedding_no_location_threshold: float = 0.97 # slow-path: match without location (very high bar)
     embedding_cross_tg_threshold: float = 0.85    # cross-TG path: same dept + 2+ shared units
+    # server-26#86: the content-divergence veto on a unit-overlap link. This is
+    # a DIVERGENCE bar, not a match bar, so it sits deliberately below
+    # embedding_similarity_threshold: two calls about different jobs on one
+    # dispatch channel still share ten-codes, unit IDs and address phrasing, so
+    # "not a match" (< 0.93) is not evidence of "a different job". Below this
+    # bar the link is vetoed; between the two bars the link is neither
+    # confirmed nor refused, so it is AMBIGUOUS and goes to the LLM (#299)
+    # instead of silently merging. 0.82 is the historical literal, unmeasured
+    # against real score distributions.
+    embedding_divergence_threshold: float = 0.82
+    # A unit-overlap link is only a confident one while the incident is fresh:
+    # idle under this many minutes (the old hard-coded 15 of the divergence
+    # veto) AND open under unit_link_confident_max_span_minutes. Past either,
+    # shared units alone are mechanism B (CORRELATION_REVIEW_0820.md) — patrol
+    # units work job after job on one channel — so the link is ambiguous.
+    unit_link_fresh_idle_minutes: int = 15
+    unit_link_confident_max_span_minutes: int = 30
+    # server-26#189: an incident open this long accepts no more WEAK links
+    # (unit overlap without location/content agreement, or an LLM link) — only
+    # vehicle, location or embedding evidence, until the hard
+    # incident_max_duration_minutes cap. The 09-27 "Rollover Entrapment"
+    # sink absorbed unrelated Ch 1 jobs for 2h34m this way. Thin replies are
+    # exempt: they never refresh updated_at, so they cannot keep a sink alive.
+    incident_weak_link_max_span_minutes: int = 90
+    # server-26#189: an LLM link may not pull a call geocoded farther than
+    # this from a non-pursuit incident's verified pin (the same 4x
+    # location_proximity_km the slow path accepts). The LLM tier had no
+    # distance check at all, which is how one incident drew a 37 km path.
+    incident_max_spread_km: float = 2.0
+    # server-26#301: an upload arriving more than this long after the call
+    # started is correlated as of its started_at (clock pin), not now. Well
+    # above normal upload + STT lag so on-time calls are never back-dated.
+    late_upload_anchor_minutes: int = 10
     location_proximity_km: float = 0.5        # radius for location-proximity matching
     geocode_max_km: float = 40.0              # reject geocode results farther than this from the node
     incident_auto_resolve_minutes: int = 90   # auto-resolve after N minutes with no new calls (major / unknown severity)
@@ -139,9 +254,7 @@ class Settings(BaseSettings):
     # at 9.7 min. Every correct thin attach in that dump was <= 3.4 min idle
     # and every wrong one was >= 8.2, so 5 separates them with room on both
     # sides. Genuine back-and-forth is handled by the 30-second tier-1 path
-    # above this. Also the escape hatch in routers/upload.py's LLM-orphan gate
-    # (_recent_incident_on_same_talkgroup, server-26#115) — check both call
-    # sites before retuning this.
+    # above this.
     tg_dispatch_thin_idle_minutes: int = 5
 
     # ── Hard caps: an incident past either of these stops accepting calls ──────

drb-c2-core/app/internal/ai_clients.py

@@ -34,6 +34,24 @@ def openai_client(timeout: Optional[float] = None):
     )
 
 
+def stt_client(api_key: Optional[str], base_url: Optional[str] = None):
+    """
+    Synchronous client for an OpenAI-compatible transcription endpoint
+    (server-26#297) -- OpenAI itself, Groq, or a self-hosted server. Same
+    timeout/retry limits as every other client here, with STT's own timeout.
+    """
+    from openai import OpenAI
+    kwargs = {}
+    if base_url:
+        kwargs["base_url"] = base_url
+    return OpenAI(
+        api_key=api_key,
+        timeout=settings.stt_timeout_seconds,
+        max_retries=settings.openai_max_retries,
+        **kwargs,
+    )
+
+
 def async_openai_client(timeout: Optional[float] = None):
     """Async OpenAI client, same limits as openai_client()."""
     from openai import AsyncOpenAI

drb-c2-core/app/internal/ai_health.py

@@ -32,7 +32,7 @@ from typing import Optional
 from app.internal.logger import logger
 from app.config import settings
 
-TIERS = ("transcription", "correlation_cheap", "correlation_smart", "extraction")
+TIERS = ("transcription", "correlation_cheap", "extraction")
 
 # Consecutive failures a TRANSIENT condition must reach before it alerts.
 # Permanent conditions skip this entirely and alert on failure #1.

drb-c2-core/app/internal/alerter.py

@@ -2,9 +2,19 @@
 Alert dispatch engine.
 
 Loads enabled alert rules from Firestore and checks each one against the call's
-talkgroup ID, tags, and transcript.  On a match:
+talkgroup ID, tags, and transcript.  On a match that passes the confidence
+gate (server-26#300, `_assess`):
   1. Creates an AlertEvent document in Firestore.
   2. Optionally POSTs a Discord webhook message if the rule has one configured.
+A match that fails the gate is written to `alert_holds` instead -- never
+pushed, readable by admins (GET /alerts/held) -- and a hold that was waiting
+only on corroboration is released when a later call brings its incident to
+alert_corroboration_min_calls calls.
+
+WHY A GATE: CrimeRadar pushed "shots fired at an elementary school" after STT
+heard "fire alarm" as "firearm". A keyword hit in raw transcript text is the
+weakest evidence this pipeline has, and a push alert is the one surface that
+cannot be taken back.
 
 Raw transcript text is withheld from both by default -- see _snippet_allowed
 and server-26#85.
@@ -54,6 +64,8 @@ async def check_and_dispatch(
     # Loop-invariant: every rule here belongs to the same org, so the opt-in is
     # resolved once rather than per match.
     snippet_allowed = await _snippet_allowed(org_id)
+    evidence = await _evidence(call_doc or {})
+    pushed_rules: set[str] = set()
 
     for rule in rules:
         matched_keywords = _match_rule(rule, talkgroup_id, tags, transcript)
@@ -63,6 +75,12 @@ async def check_and_dispatch(
         alert_id = str(uuid.uuid4())
         snippet = _snippet(transcript) if snippet_allowed else None
         now = datetime.now(timezone.utc).isoformat()
+        verdict = _assess(matched_keywords, tags, evidence)
+        if not verdict["push"]:
+            await _hold(alert_id, rule, org_id, call_id, node_id, talkgroup_id,
+                        talkgroup_name, matched_keywords, snippet, now, verdict, evidence)
+            continue
+        pushed_rules.add(rule.get("rule_id", ""))
         event = {
             "alert_id": alert_id,
             "org_id": org_id,
@@ -76,6 +94,9 @@ async def check_and_dispatch(
             "transcript_snippet": snippet,
             "triggered_at": now,
             "acknowledged": False,
+            "confidence": verdict["confidence"],
+            "high_severity": verdict["high_severity"],
+            "corroborating_calls": evidence["max_calls"],
         }
 
         try:
@@ -92,6 +113,192 @@ async def check_and_dispatch(
         if webhook_url:
             await _post_webhook(webhook_url, rule.get("name", ""), talkgroup_name, matched_keywords, snippet)
 
+    await _release_corroborated(rules, evidence, call_id, pushed_rules)
+
+
+# ── Confidence gate (server-26#300) ─────────────────────────────────────────
+
+# How a rule matched, as evidence. Talkgroup activity is metadata, not
+# recognised speech, so it cannot be misheard.
+_W_TALKGROUP = 1.0
+_W_TAG = 0.8          # the extraction model put it in tags
+_W_TRANSCRIPT = 0.6   # substring of raw STT text only (above the 0.5 default floor)
+
+
+def _norm_term(term: str) -> str:
+    return (term or "").strip().lower().replace("-", " ")
+
+
+def _is_high_severity_term(term: str) -> bool:
+    wanted = {_norm_term(t) for t in settings.alert_high_severity_terms}
+    return _norm_term(term) in wanted
+
+
+async def _evidence(call_doc: dict) -> dict:
+    """What the call doc and its incidents say about how much to trust it."""
+    incident_ids = list(call_doc.get("incident_ids") or [])
+    max_calls = 0
+    max_severity = call_doc.get("severity")
+    severity_rank = {"routine": 0, "minor": 1, "moderate": 2, "major": 3}
+    for iid in incident_ids:
+        try:
+            inc = await fstore.doc_get("incidents", iid) or {}
+        except Exception as e:
+            logger.warning(f"Alerter: could not read incident {iid}: {e}")
+            continue
+        max_calls = max(max_calls, len(inc.get("call_ids") or []))
+        if severity_rank.get(inc.get("severity"), -1) > severity_rank.get(max_severity, -1):
+            max_severity = inc.get("severity")
+    stt = call_doc.get("stt_confidence")
+    return {
+        "incident_ids": incident_ids,
+        "max_calls": max_calls,
+        "severity": max_severity,
+        "stt_confidence": stt if isinstance(stt, (int, float)) else None,
+        "not_speech": bool(call_doc.get("transcript_not_speech")),
+    }
+
+
+def _assess(matched: list[str], tags: list[str], evidence: dict) -> dict:
+    """
+    Push or hold, and why. Pure, so the gate is testable without Firestore.
+
+    confidence = match weight x STT factor. The STT factor is 1.0 unless
+    Whisper's own mean token probability is under alert_stt_reference, and
+    1.0 when there is none (a json-only model) rather than guessing.
+    """
+    content = [m for m in matched if not m.startswith("talkgroup:")]
+    if not content:
+        weight = _W_TALKGROUP
+    elif any(m in (tags or []) for m in content):
+        weight = _W_TAG
+    else:
+        weight = _W_TRANSCRIPT
+
+    stt = evidence.get("stt_confidence")
+    stt_factor = 1.0
+    if content and stt is not None and settings.alert_stt_reference > 0:
+        stt_factor = min(1.0, max(0.0, stt / settings.alert_stt_reference))
+    if content and evidence.get("not_speech"):
+        stt_factor = 0.0  # the corrector called this recogniser noise
+    confidence = round(weight * stt_factor, 3)
+
+    high = bool(content) and (
+        any(_is_high_severity_term(m) for m in content)
+        or any(_is_high_severity_term(t) for t in (tags or []))
+        or evidence.get("severity") == "major"
+    )
+    corroborated = evidence.get("max_calls", 0) >= settings.alert_corroboration_min_calls
+
+    if confidence < settings.alert_min_confidence:
+        return {"push": False, "confidence": confidence, "high_severity": high,
+                "hold_reason": "low_confidence"}
+    if high and not corroborated and confidence < settings.alert_high_severity_min_confidence:
+        return {"push": False, "confidence": confidence, "high_severity": high,
+                "hold_reason": "needs_corroboration"}
+    return {"push": True, "confidence": confidence, "high_severity": high, "hold_reason": None}
+
+
+async def _hold(alert_id, rule, org_id, call_id, node_id, talkgroup_id, talkgroup_name,
+                matched_keywords, snippet, now, verdict, evidence) -> None:
+    """Record a gated match where admins can see it, and push nothing."""
+    hold = {
+        "alert_id": alert_id,
+        "org_id": org_id,
+        "rule_id": rule.get("rule_id", ""),
+        "rule_name": rule.get("name", ""),
+        "call_id": call_id,
+        "node_id": node_id,
+        "talkgroup_id": talkgroup_id,
+        "talkgroup_name": talkgroup_name or "",
+        "matched_keywords": matched_keywords,
+        "transcript_snippet": snippet,
+        "triggered_at": now,
+        "status": "held",
+        "hold_reason": verdict["hold_reason"],
+        "confidence": verdict["confidence"],
+        "high_severity": verdict["high_severity"],
+        # One incident to wait on: the first the call linked to. A call that
+        # linked to none can never be corroborated, so it stays held.
+        "incident_id": (evidence["incident_ids"] or [None])[0],
+        "corroborating_calls": evidence["max_calls"],
+    }
+    try:
+        await fstore.doc_set("alert_holds", alert_id, hold, merge=False)
+    except Exception as e:
+        logger.warning(f"Alerter: could not save held alert: {e}")
+        return
+    logger.info(
+        f"Alert HELD ({verdict['hold_reason']}, confidence={verdict['confidence']}, "
+        f"high_severity={verdict['high_severity']}, calls={evidence['max_calls']}): "
+        f"rule='{rule.get('name')}' call={call_id} keywords={matched_keywords}"
+    )
+
+
+async def _release_corroborated(rules: list[dict], evidence: dict, call_id: str,
+                                pushed_rules: set[str]) -> None:
+    """
+    Push holds that were waiting only on corroboration once their incident
+    has enough calls. A low-confidence hold is never released this way: a
+    second call on the incident says the event is real, not that the first
+    call was heard right. A rule this call already pushed for supersedes its
+    hold instead of alerting twice.
+    """
+    if evidence["max_calls"] < settings.alert_corroboration_min_calls:
+        return
+    by_id = {r.get("rule_id", ""): r for r in rules}
+    for iid in evidence["incident_ids"]:
+        try:
+            holds = await fstore.collection_list("alert_holds", incident_id=iid, status="held")
+        except Exception as e:
+            logger.warning(f"Alerter: could not read holds for incident {iid}: {e}")
+            continue
+        for hold in holds:
+            if hold.get("hold_reason") != "needs_corroboration":
+                continue
+            rule = by_id.get(hold.get("rule_id", ""))
+            now = datetime.now(timezone.utc).isoformat()
+            if rule is None or hold.get("rule_id", "") in pushed_rules:
+                status = "superseded" if rule is not None else "rule_gone"
+                await _set_hold_status(hold, status, call_id, now)
+                continue
+            event = {k: hold.get(k) for k in (
+                "alert_id", "org_id", "rule_id", "rule_name", "call_id", "node_id",
+                "talkgroup_id", "talkgroup_name", "matched_keywords",
+                "transcript_snippet", "confidence", "high_severity",
+            )}
+            event.update({
+                "triggered_at": now,
+                "acknowledged": False,
+                "released_from_hold": True,
+                "corroborated_by_call_id": call_id,
+                "corroborating_calls": evidence["max_calls"],
+            })
+            try:
+                await fstore.doc_set("alert_events", hold["alert_id"], event, merge=False)
+            except Exception as e:
+                logger.warning(f"Alerter: could not release held alert {hold.get('alert_id')}: {e}")
+                continue
+            await _set_hold_status(hold, "released", call_id, now)
+            pushed_rules.add(hold.get("rule_id", ""))
+            logger.info(
+                f"Alert released from hold: rule='{hold.get('rule_name')}' incident={iid} "
+                f"corroborated by call {call_id} ({evidence['max_calls']} calls)"
+            )
+            webhook_url = rule.get("discord_webhook")
+            if webhook_url:
+                await _post_webhook(webhook_url, rule.get("name", ""), hold.get("talkgroup_name"),
+                                    hold.get("matched_keywords") or [], hold.get("transcript_snippet"))
+
+
+async def _set_hold_status(hold: dict, status: str, call_id: str, now: str) -> None:
+    try:
+        await fstore.doc_update("alert_holds", hold["alert_id"], {
+            "status": status, "resolved_at": now, "resolved_by_call_id": call_id,
+        })
+    except Exception as e:
+        logger.warning(f"Alerter: could not update hold {hold.get('alert_id')}: {e}")
+
 
 async def _snippet_allowed(org_id: Optional[str]) -> bool:
     """

drb-c2-core/app/internal/chatter_classifier.py

@@ -14,13 +14,18 @@ This module is that classifier. It is a PURE function of the transcript text —
 no Firestore, no LLM call, no side effects — so it is cheap to run on every
 transcript and cheap to test against real dumps offline.
 
-SHADOW MODE ONLY. As of this module's introduction, nothing skips scene
-extraction based on this verdict. `intelligence.extract_scenes` calls
-`classify_chatter` purely to record the verdict on the call doc
-(`chatter_classifier_verdict` / `chatter_classifier_reason`) so it becomes
-observable in the next `/admin` correlation-debug dump, exactly like
-`corr_gate_veto` (server-26#115 / PR #126). See the TODO at that call site for
-what has to be true before this flips live.
+A COST GATE SINCE server-26#298, through `gate_chatter`, not
+`classify_chatter` — built but OFF by default (`chatter_gate_enabled`) until a
+shadow window shows gated calls don't over-merge. `classify_chatter` is still
+the shadow verdict recorded on every call doc (`chatter_classifier_verdict` /
+`chatter_classifier_reason`), so the `/admin` tallies keep measuring the same
+thing. The gate is stricter on the one shape the #127 review flagged as a live
+false-positive risk: `roll_call` matches "roll call" anywhere, so "Delayed for
+roll call, then respond to a structure fire at 12 Main Street" is a roll_call
+verdict. The gate only skips a roll call whose remaining words are callsigns
+and roll-call phrasing. When enabled, gated transcripts skip transcript
+correction and scene extraction (and with it embedding and geocoding); the free
+rule paths (clearance parse, self-initiated/plate backstop) still run.
 
 Precision over recall, deliberately. A false positive here — flagging a REAL
 event as chatter — would, once live, silently mean that event never gets a
@@ -133,3 +138,36 @@ def classify_chatter(transcript: Optional[str]) -> tuple[bool, Optional[str]]:
         return False, None
 
     return True, "bare_acknowledgement"
+
+
+# Words a roll call is made of, beyond the filler/designator/phonetic sets.
+_ROLL_CALL_WORDS = frozenset({
+    "roll", "call", "all", "cars", "car", "patrol", "patrols", "troop", "staff",
+    "concludes", "time", "came", "because", "volunteer", "nyc", "kl", "henry",
+    "here", "present", "s", "m", "it",
+})
+# A roll call may name a place or two ("Post 4, Ossining"); more than this many
+# leftover words means something else is being said in the same transmission.
+_ROLL_CALL_MAX_LEFTOVER = 2
+
+
+def gate_chatter(transcript: Optional[str]) -> tuple[bool, Optional[str]]:
+    """
+    Whether to skip paid AI for this transcript (server-26#298).
+
+    `classify_chatter`'s verdict, with roll_call narrowed: the transcript must
+    be roll-call content end to end, not a roll call mentioned on the way to
+    something real. Precision over recall still — a false positive here means
+    a real event never gets a scene.
+    """
+    is_chatter, reason = classify_chatter(transcript)
+    if not is_chatter:
+        return False, None
+    if reason == "roll_call":
+        leftover = [
+            t for t in _tokenize(transcript or "")
+            if not _is_filler_token(t) and t not in _ROLL_CALL_WORDS
+        ]
+        if len(leftover) > _ROLL_CALL_MAX_LEFTOVER:
+            return False, None
+    return True, reason

drb-c2-core/app/internal/discord_guild_link.py

@@ -27,6 +27,16 @@ Firestore layout:
     unlinked_at|None, unlinked_by|None
 
 Person names are never stored: the redeemer is kept as a Discord user id.
+
+Every way a server gets linked — ``/drb link code:`` (``redeem_and_settle``),
+the platform admin's ``PUT /discord/guilds/{id}/link`` and the per-bot OAuth
+invite (server-26#225 S6) (both ``link_and_settle``) — writes the guild doc
+through ONE transaction body (``_apply_link``) and then runs ONE settle step
+(``_settle``): a server that was acting for a different org (in practice the
+``DISCORD_UNLINKED_GUILD_ORG_ID`` fallback) has its live radio channels
+stopped, because they were placed on that org's nodes. The org it acted for
+before is read inside the same transaction as the write, so the stop decision
+can't race a concurrent link.
 """
 from __future__ import annotations
 
@@ -35,6 +45,7 @@ import secrets
 from datetime import datetime, timedelta, timezone
 from typing import Optional
 
+from app.internal import discord_streams as streams
 from app.internal import firestore as fstore
 
 CODES = "discord_link_codes"
@@ -91,6 +102,63 @@ async def mint_code(org_id: str, uid: str) -> dict:
             "expires_minutes": CODE_TTL_MINUTES}
 
 
+# Stop reasons the settle step stamps on the streams it stops.
+RELINK_STOP_REASON = "relinked"
+ADMIN_RELINK_STOP_REASON = "server linked to another organization"
+
+
+def _apply_link(txn, guild_ref, guild: Optional[dict], *, org_id: str, guild_id: str,
+                guild_name: Optional[str], linked_by: str, via: str, now: datetime,
+                allow_move: bool = False, extra: Optional[dict] = None):
+    """The guild-side half of every link, inside a transaction whose reads are
+    all done. Returns a LinkError (nothing written) or the result dict:
+    ``{org_id, already_linked, previous_org_id}`` — ``previous_org_id`` is the
+    org the server acted for before (its link, else the fallback org).
+
+    ``allow_move`` is the platform admin's support override; every self-serve
+    path refuses to move a server another org has linked."""
+    current = (guild or {}).get("org_id")
+    if current and current != org_id and not allow_move:
+        return LinkError(409, "linked_elsewhere",
+                         "This server is already linked to a different DRB organization. "
+                         "That organization has to unlink it first.")
+    iso = now.isoformat()
+    name = (guild_name or "").strip()[:100]
+    txn.set(guild_ref, {
+        "guild_id": guild_id,
+        "org_id": org_id,
+        "guild_name": name or (guild or {}).get("guild_name"),
+        "linked_by": linked_by,
+        "linked_via": via,
+        "linked_at": ((guild or {}).get("linked_at") if current == org_id else None) or iso,
+        "unlinked_at": None,
+        "unlinked_by": None,
+        # A server an admin removed (streams.remove_guild) comes back on link.
+        "removed_at": None,
+        "removed_by": None,
+        **(extra or {}),
+    }, merge=True)
+    return {"org_id": org_id, "already_linked": current == org_id,
+            "previous_org_id": streams.acting_org_of(guild)}
+
+
+def link_guild_txn(org_id: str, guild_id: str, guild_name: Optional[str], linked_by: str, via: str, *,
+                   allow_move: bool = False, extra: Optional[dict] = None, now: Optional[datetime] = None):
+    """Transaction body that links ``guild_id`` to ``org_id`` directly (no code)."""
+    db = fstore.db
+    when = now or _now()
+
+    def _txn(txn):
+        guild_ref = db.collection(GUILDS).document(guild_id)
+        snap = guild_ref.get(transaction=txn)
+        guild = snap.to_dict() if snap.exists else None
+        out = _apply_link(txn, guild_ref, guild, org_id=org_id, guild_id=guild_id, guild_name=guild_name,
+                          linked_by=linked_by, via=via, now=when, allow_move=allow_move, extra=extra)
+        return {"error": out} if isinstance(out, LinkError) else out
+
+    return _txn
+
+
 def _redeem_txn(code: str, guild_id: str, guild_name: Optional[str], discord_user_id: str, now: datetime):
     """Build the transaction body. Every read happens before any write."""
     db = fstore.db
@@ -113,37 +181,20 @@ def _redeem_txn(code: str, guild_id: str, guild_name: Optional[str], discord_use
             return {"error": LinkError(410, "code_expired",
                                        "That link code has expired. Generate a new one in DRB → "
                                        "Settings → Organization.")}
-        org_id = doc["org_id"]
-        current = (guild or {}).get("org_id")
-        if current and current != org_id:
-            return {"error": LinkError(409, "linked_elsewhere",
-                                       "This server is already linked to a different DRB organization. "
-                                       "That organization has to unlink it first.")}
-
-        iso = now.isoformat()
-        txn.update(code_ref, {"redeemed_at": iso, "redeemed_guild_id": guild_id,
+        out = _apply_link(txn, guild_ref, guild, org_id=doc["org_id"], guild_id=guild_id,
+                          guild_name=guild_name, linked_by=f"discord:{discord_user_id}", via="code", now=now)
+        if isinstance(out, LinkError):
+            return {"error": out}       # the code is NOT consumed: its org can use it elsewhere
+        txn.update(code_ref, {"redeemed_at": now.isoformat(), "redeemed_guild_id": guild_id,
                               "redeemed_by_discord_id": discord_user_id})
-        txn.set(guild_ref, {
-            "guild_id": guild_id,
-            "org_id": org_id,
-            "guild_name": (guild_name or "")[:100] or (guild or {}).get("guild_name"),
-            "linked_by": f"discord:{discord_user_id}",
-            "linked_via": "code",
-            "linked_at": ((guild or {}).get("linked_at") if current == org_id else None) or iso,
-            "unlinked_at": None,
-            "unlinked_by": None,
-            # A server an admin removed (streams.remove_guild) comes back on link.
-            "removed_at": None,
-            "removed_by": None,
-        }, merge=True)
-        return {"org_id": org_id, "already_linked": current == org_id,
-                "created_by_uid": doc.get("created_by_uid")}
+        return {**out, "created_by_uid": doc.get("created_by_uid")}
 
     return _txn
 
 
 async def redeem_code(raw_code: str, guild_id: str, guild_name: Optional[str], discord_user_id: str) -> dict:
-    """Link ``guild_id`` to the code's org. Raises LinkError on refusal."""
+    """Link ``guild_id`` to the code's org. Raises LinkError on refusal.
+    Does NOT stop anything — routes call ``redeem_and_settle``."""
     code = normalize(raw_code)
     if len(code) != _CODE_LEN:
         raise LinkError(404, "invalid_code",
@@ -155,6 +206,39 @@ async def redeem_code(raw_code: str, guild_id: str, guild_name: Optional[str], d
     return result
 
 
+async def _settle(guild_id: str, result: dict, stop_reason: str) -> dict:
+    """After a link committed: a server that was acting for another org (the
+    fallback org, or — admin override only — another linked org) has its live
+    radio channels stopped; they were placed on that org's nodes, and left
+    running the reconciler would keep re-placing them there
+    (server-26#225 plan finding 3: this lived in two routers before)."""
+    before = result.get("previous_org_id")
+    stopped: list = []
+    if before and before != result["org_id"]:
+        stopped = await streams.stop_guild(str(guild_id), stop_reason)
+    return {**result, "streams_stopped": stopped}
+
+
+async def link_and_settle(org_id: str, guild_id: str, guild_name: Optional[str], linked_by: str, via: str, *,
+                          allow_move: bool = False, extra: Optional[dict] = None,
+                          stop_reason: str = RELINK_STOP_REASON) -> dict:
+    """Link a server to an org directly (admin, OAuth) and settle. Raises
+    LinkError (``linked_elsewhere``) unless ``allow_move``. Returns
+    ``{org_id, already_linked, previous_org_id, streams_stopped}``."""
+    result = await fstore.run_transaction(
+        link_guild_txn(org_id, str(guild_id), guild_name, linked_by, via, allow_move=allow_move, extra=extra))
+    if "error" in result:
+        raise result["error"]
+    return await _settle(guild_id, result, stop_reason)
+
+
+async def redeem_and_settle(raw_code: str, guild_id: str, guild_name: Optional[str],
+                            discord_user_id: str) -> dict:
+    """``/drb link code:`` — redeem, then settle. Raises LinkError."""
+    result = await redeem_code(raw_code, guild_id, guild_name, discord_user_id)
+    return await _settle(guild_id, result, RELINK_STOP_REASON)
+
+
 async def list_org_guilds(org_id: str) -> list[dict]:
     return [
         {"guild_id": g.get("guild_id"), "guild_name": g.get("guild_name"),

drb-c2-core/app/internal/discord_oauth.py

@@ -0,0 +1,246 @@
+"""
+Per-bot OAuth "Connect a Discord server" (server-26#225 S6, owner decision Q1).
+
+An org owner links a Discord server by inviting ONE radio bot through
+Discord's OAuth2 bot invite. The invite's ``state`` carries a single-use,
+short-lived nonce bound to the org and the user who started it; Discord
+redirects back with ``code`` (and ``guild_id``), C2 exchanges the code with
+THAT bot application's client secret, and the exchange's ``guild`` object —
+never the query string — says which server to link.
+
+Secrets:
+
+  bot_oauth/{token_id}            server-only (Firestore rules deny all
+    client_secret, enabled,       client reads; c2-core's admin SDK only)
+    set_by, set_at, checked_at
+
+  The secret is never on ``bot_tokens`` (GET /tokens returns an allowlist of
+  those fields), never returned by any route, never logged, never put in an
+  error string. Firestore encrypts it at rest like every other document; the
+  codebase has no application-level encryption pattern (bot tokens are
+  stored the same way), so none is invented here.
+
+States:
+
+  discord_oauth_states/{sha256(nonce)}   the nonce itself is never stored
+    org_id, uid, token_id, node_id, return_to, created_at, expires_at,
+    used_at|None, used_by|None
+
+OAuth is off while ``settings.discord_oauth_redirect_uri`` is empty: every
+route 404s and the UI hides the button.
+
+HTTP goes through discord_rest's shared client (User-Agent, transport for
+tests) and counts 401/403/429 answers against its process-wide breaker, so a
+wrong secret retried in a loop can't contribute to an IP ban either.
+"""
+from __future__ import annotations
+
+import hashlib
+import secrets
+import time
+from datetime import datetime, timedelta, timezone
+from typing import Any, Optional
+from urllib.parse import urlencode
+
+import httpx
+
+from app.config import settings
+from app.internal import discord_leases as leases
+from app.internal import discord_rest
+from app.internal import firestore as fstore
+
+OAUTH = "bot_oauth"
+STATES = "discord_oauth_states"
+AUTHORIZE_URL = "https://discord.com/oauth2/authorize"
+# Discord client secrets are 32 url-safe characters today; accept a margin.
+SECRET_MIN, SECRET_MAX = 16, 128
+RETURN_TO_MAX = 200
+
+
+def enabled() -> bool:
+    return bool((settings.discord_oauth_redirect_uri or "").strip())
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def state_key(nonce: str) -> str:
+    return hashlib.sha256((nonce or "").encode()).hexdigest()
+
+
+def safe_return_to(value: Optional[str]) -> Optional[str]:
+    """A same-site path only (``/nodes/abc``), never an absolute or
+    protocol-relative URL — the callback page redirects to it."""
+    v = (value or "").strip()
+    if not v or len(v) > RETURN_TO_MAX or not v.startswith("/") or v.startswith("//") or "\\" in v:
+        return None
+    if any(ord(ch) < 0x20 for ch in v):
+        return None
+    return v
+
+
+# ---------------------------------------------------------------------------
+# Secrets
+# ---------------------------------------------------------------------------
+
+async def enabled_token_ids() -> set[str]:
+    """Bots whose OAuth secret is set and enabled."""
+    return {d.get("token_id") for d in await fstore.collection_list(OAUTH)
+            if d.get("token_id") and d.get("enabled") and d.get("client_secret")}
+
+
+async def load_secret(token_id: str) -> Optional[str]:
+    doc = await fstore.doc_get(OAUTH, token_id)
+    if not doc or not doc.get("enabled") or not doc.get("client_secret"):
+        return None
+    return doc["client_secret"]
+
+
+async def store_secret(token_id: str, client_secret: str, uid: str) -> None:
+    now = _now().isoformat()
+    await fstore.doc_set(OAUTH, token_id, {
+        "token_id": token_id, "client_secret": client_secret, "enabled": True,
+        "set_by": uid, "set_at": now, "checked_at": now,
+    }, merge=False)
+
+
+async def clear_secret(token_id: str) -> bool:
+    if not await fstore.doc_get(OAUTH, token_id):
+        return False
+    await fstore.doc_delete(OAUTH, token_id)
+    return True
+
+
+# ---------------------------------------------------------------------------
+# Discord OAuth2 HTTP (client_id + client_secret, basic auth)
+# ---------------------------------------------------------------------------
+
+async def _post_form(path: str, data: dict, client_id: str, client_secret: str) -> discord_rest.RestResult:
+    """POST an application-authenticated form. Never raises for a Discord or
+    network failure; the error string never holds the secret, the code or a
+    token (only Discord's short ``error`` field)."""
+    now = time.monotonic()
+    if discord_rest._breaker.tripped(now):
+        return discord_rest.RestResult(None, error="Discord REST paused (invalid-request budget reached)")
+    try:
+        r = await discord_rest._client().post(path, data=data, auth=(client_id, client_secret))
+    except httpx.HTTPError as e:
+        return discord_rest.RestResult(None, error=type(e).__name__)
+    status = r.status_code
+    if status in (401, 403) or (status == 429 and r.headers.get("x-ratelimit-scope") != "shared"):
+        discord_rest._breaker.record(time.monotonic())
+    body: Any = None
+    try:
+        body = r.json() if r.content else None
+    except ValueError:
+        body = None
+    if 200 <= status < 300:
+        return discord_rest.RestResult(status, body)
+    err = body.get("error") if isinstance(body, dict) and isinstance(body.get("error"), str) else None
+    return discord_rest.RestResult(status, None, error=f"Discord answered {status}" + (f" ({err[:40]})" if err else ""))
+
+
+async def exchange_code(client_id: str, client_secret: str, code: str) -> discord_rest.RestResult:
+    return await _post_form("/oauth2/token", {
+        "grant_type": "authorization_code", "code": code,
+        "redirect_uri": settings.discord_oauth_redirect_uri.strip(),
+    }, client_id, client_secret)
+
+
+async def revoke(client_id: str, client_secret: str, access_token: Optional[str]) -> None:
+    """Best effort: C2 never uses the user's access token, so it is revoked
+    as soon as the guild has been read from the exchange."""
+    if access_token:
+        await _post_form("/oauth2/token/revoke", {"token": access_token, "token_type_hint": "access_token"},
+                         client_id, client_secret)
+
+
+async def check_secret(client_id: str, client_secret: str) -> discord_rest.RestResult:
+    """Prove ``client_secret`` belongs to ``client_id`` with a client-
+    credentials grant (scope ``identify`` — the bot owner's own token), then
+    revoke the token it returns. Nothing is stored from the answer."""
+    r = await _post_form("/oauth2/token", {"grant_type": "client_credentials", "scope": "identify"},
+                         client_id, client_secret)
+    if r.ok and isinstance(r.data, dict):
+        await revoke(client_id, client_secret, r.data.get("access_token"))
+    return r
+
+
+# ---------------------------------------------------------------------------
+# State + authorize URL
+# ---------------------------------------------------------------------------
+
+def authorize_url(application_id: str, nonce: str) -> str:
+    return AUTHORIZE_URL + "?" + urlencode({
+        "client_id": application_id,
+        "scope": "bot",
+        "permissions": str(leases.RADIO_BOT_PERMISSIONS),
+        "response_type": "code",
+        "redirect_uri": settings.discord_oauth_redirect_uri.strip(),
+        "state": nonce,
+    })
+
+
+async def create_state(*, org_id: str, uid: str, token_id: str, node_id: Optional[str],
+                       return_to: Optional[str]) -> tuple[str, datetime]:
+    nonce = secrets.token_urlsafe(32)
+    now = _now()
+    expires_at = now + timedelta(seconds=max(60, settings.discord_oauth_state_ttl_seconds))
+    await fstore.doc_set(STATES, state_key(nonce), {
+        "org_id": org_id, "uid": uid, "token_id": token_id, "node_id": node_id,
+        "return_to": return_to, "created_at": now.isoformat(), "expires_at": expires_at.isoformat(),
+        "used_at": None, "used_by": None,
+    }, merge=False)
+    return nonce, expires_at
+
+
+class StateError(Exception):
+    def __init__(self, status: int, code: str, message: str):
+        super().__init__(message)
+        self.status, self.code, self.message = status, code, message
+
+
+def consume_state_txn(nonce: str, uid: str, now: datetime):
+    """Transaction body: the state must exist, be unexpired and unused, and
+    belong to ``uid`` (login-CSRF: someone else's state never links into the
+    caller's org, and the caller's own code can't be replayed by another
+    account). Any presentation of a live state burns it — a failure later in
+    the flow means starting again, never retrying the same state."""
+    db = fstore.db
+    key = state_key(nonce)
+
+    def _txn(txn):
+        ref = db.collection(STATES).document(key)
+        snap = ref.get(transaction=txn)
+        doc = snap.to_dict() if snap.exists else None
+        if not doc:
+            return {"error": StateError(400, "invalid_state",
+                                        "That Discord link is not valid. Start again from DRB.")}
+        if doc.get("used_at"):
+            return {"error": StateError(409, "state_used",
+                                        "That Discord link was already used. Start again from DRB.")}
+        txn.update(ref, {"used_at": now.isoformat(), "used_by": uid})
+        try:
+            expired = now > datetime.fromisoformat(doc.get("expires_at") or "")
+        except ValueError:
+            expired = True
+        if expired:
+            return {"error": StateError(410, "state_expired",
+                                        "That Discord link expired. Start again from DRB.")}
+        if doc.get("uid") != uid:
+            return {"error": StateError(403, "wrong_user",
+                                        "That Discord link was started by a different DRB account. "
+                                        "Sign in as that account, or start again.")}
+        return {"state": doc}
+
+    return _txn
+
+
+async def consume_state(nonce: str, uid: str) -> dict:
+    if not nonce or len(nonce) > 200:
+        raise StateError(400, "invalid_state", "That Discord link is not valid. Start again from DRB.")
+    out = await fstore.run_transaction(consume_state_txn(nonce, uid, _now()))
+    if "error" in out:
+        raise out["error"]
+    return out["state"]

drb-c2-core/app/internal/discord_rest.py

@@ -655,3 +655,100 @@ async def guild_snapshot(token_doc: dict, guild_id: str, *, refresh: bool = Fals
                                  error=f"check failed ({type(e).__name__})")
 
     return await access_cache.get_or_load(key, _load, lambda s: ttl_for(s.status), refresh=refresh)
+
+
+# ---------------------------------------------------------------------------
+# Voice-channel directory from a radio bot's view (server-26#225 S5)
+# ---------------------------------------------------------------------------
+
+DIRECTORY_MAX_CHANNELS = 200    # same cap as PUT /discord/guilds/{id}/directory
+_DIRECTORY_NAME_MAX = 100
+VOICE_CHANNEL = 2
+CATEGORY_CHANNEL = 4
+
+
+def _int_or(value: Any, default: int = 0) -> int:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return default
+
+
+def directory_from_snapshot(snap: Optional[GuildSnapshot]) -> Optional[dict]:
+    """A server's name and voice channels as one radio bot's snapshot sees
+    them, in the shape the DRB server bot pushes (``PUT
+    /discord/guilds/{id}/directory``): ``{name, voice_channels: [{channel_id,
+    name, category, position}]}``, in Discord's sidebar order (channels with
+    no category first, then each category by position; channels by position,
+    then id). None unless the snapshot is OK.
+
+    Every voice channel in the list is kept, including any this bot can't
+    View, exactly like the server bot's gateway list: whether a bot may join
+    is the permission check's answer (discord_streams.evaluate_access), and
+    the picker shows it per channel. Stage channels are not voice channels
+    here either."""
+    if snap is None or snap.status != OK or not isinstance(snap.channels, list):
+        return None
+    chans = [c for c in snap.channels if isinstance(c, dict) and c.get("id") is not None]
+    cats = {str(c["id"]): c for c in chans if c.get("type") == CATEGORY_CHANNEL}
+
+    def parent(c: dict) -> Optional[dict]:
+        return cats.get(str(c.get("parent_id") or ""))
+
+    def order(c: dict) -> tuple:
+        p = parent(c)
+        top = (0, 0, 0) if p is None else (1, _int_or(p.get("position")), _int_or(p.get("id")))
+        return (*top, _int_or(c.get("position")), _int_or(c.get("id")))
+
+    out: list[dict] = []
+    for c in sorted((c for c in chans if c.get("type") == VOICE_CHANNEL), key=order)[:DIRECTORY_MAX_CHANNELS]:
+        p = parent(c)
+        category = str(p.get("name") or "")[:_DIRECTORY_NAME_MAX] if p else ""
+        out.append({
+            "channel_id": str(c["id"]),
+            "name": str(c.get("name") or "")[:_DIRECTORY_NAME_MAX],
+            "category": category or None,
+            "position": len(out),
+        })
+    name = snap.guild.get("name") if isinstance(snap.guild, dict) else None
+    return {"name": str(name)[:_DIRECTORY_NAME_MAX] if name else None, "voice_channels": out}
+
+
+@dataclass
+class DirectoryResult:
+    """``guild_directory``'s answer. ``status``: OK (``name`` and
+    ``voice_channels`` from ``token_id``'s snapshot), NOT_MEMBER (every bot
+    asked turned out not to be in the server, or its token is invalid) or
+    UNKNOWN (no usable answer — keep what is stored)."""
+    guild_id: str
+    status: str
+    name: Optional[str] = None
+    voice_channels: Optional[list] = None
+    token_id: Optional[str] = None
+    fetched_at: Optional[float] = None
+
+
+async def guild_directory(token_docs: list[dict], guild_id: str, *, refresh: bool = False,
+                          max_bots: int = 3) -> DirectoryResult:
+    """The voice-channel list of one server, read from the first of
+    ``token_docs`` (radio bots believed to be in it, best first) whose cached
+    snapshot is OK. It is the same snapshot the permission check reads, so
+    listing channels costs no extra Discord request. At most ``max_bots``
+    bots are asked, one after another. Never raises for a Discord failure.
+
+    The caller decides which server and which bots: this never looks a
+    server up by itself, so it can't discover one (a server DRB doesn't
+    already know is never listed from a radio bot's membership)."""
+    guild_id = str(guild_id)
+    statuses: list[str] = []
+    for doc in token_docs[:max(1, max_bots)]:
+        snap = await guild_snapshot(doc, guild_id, refresh=refresh)
+        statuses.append(snap.status)
+        d = directory_from_snapshot(snap)
+        if d is not None:
+            return DirectoryResult(guild_id=guild_id, status=OK, name=d["name"],
+                                   voice_channels=d["voice_channels"], token_id=snap.token_id,
+                                   fetched_at=snap.fetched_at)
+    if statuses and all(s in (NOT_MEMBER, INVALID) for s in statuses):
+        return DirectoryResult(guild_id=guild_id, status=NOT_MEMBER)
+    return DirectoryResult(guild_id=guild_id, status=UNKNOWN)

drb-c2-core/app/internal/discord_streams.py

@@ -53,6 +53,7 @@ A retained MQTT message therefore never stores a bot credential on the broker.
 from __future__ import annotations
 
 import asyncio
+import time
 from datetime import datetime, timezone, timedelta
 from typing import Optional
 
@@ -93,6 +94,17 @@ def _parse_ts(value) -> Optional[datetime]:
 # Guild -> org
 # ---------------------------------------------------------------------------
 
+def acting_org_of(link: Optional[dict]) -> Optional[str]:
+    """``resolve_guild_org`` for an already-read ``discord_guilds`` doc (None =
+    no doc). Pure, so a link transaction can decide from the snapshot it read
+    (discord_guild_link.link_guild_txn, server-26#225 S6)."""
+    if link and link.get("org_id"):
+        return link["org_id"]
+    if link and link.get("unlinked_at"):
+        return None
+    return settings.discord_unlinked_guild_org_id or None
+
+
 async def resolve_guild_org(guild_id: str) -> Optional[str]:
     """The org a Discord server acts for: its ``discord_guilds`` link, else
     ``settings.discord_unlinked_guild_org_id`` (None when that is empty).
@@ -100,12 +112,7 @@ async def resolve_guild_org(guild_id: str) -> Optional[str]:
     A server an org explicitly unlinked (``unlinked_at`` set, server-26#213)
     gets no fallback: otherwise unlinking org B's server would quietly hand it
     to the founding org."""
-    link = await fstore.doc_get(GUILDS, str(guild_id))
-    if link and link.get("org_id"):
-        return link["org_id"]
-    if link and link.get("unlinked_at"):
-        return None
-    return settings.discord_unlinked_guild_org_id or None
+    return acting_org_of(await fstore.doc_get(GUILDS, str(guild_id)))
 
 
 async def _node_stream_counts(exclude_stream_id: Optional[str] = None) -> dict[str, int]:
@@ -352,14 +359,39 @@ async def check_bots(tokens: dict[str, dict], token_ids: list[str], guild_id: st
             for t in token_ids}
 
 
+# server-26#251: an interactive start (a person pressed Start / ran /join)
+# re-reads a bot's snapshot that says "denied" once it is this old, so a
+# permission fixed in Discord a moment ago is seen without waiting out the
+# cache. The reconciler never does (plan finding 4: no REST loop).
+RECHECK_DENIED_AFTER_SECONDS = 10.0
+
+
 async def _perm_check(*, org_id: str, guild_id: str, channel_id: str, stream_id: str,
-                      preferred_token_id: Optional[str], node_ids: set) -> Optional[dict]:
+                      preferred_token_id: Optional[str], node_ids: set,
+                      recheck_denied: bool = False) -> Optional[dict]:
     if not settings.discord_perm_check_enabled:
         return None
     tokens = {t["token_id"]: t for t in await fstore.collection_list(leases.TOKENS) if t.get("token_id")}
     ids = tokens_to_check(tokens, guild_id=guild_id, org_id=org_id, node_ids=node_ids,
                           exclude_stream_id=stream_id, preferred_token_id=preferred_token_id)
-    return await check_bots(tokens, ids, guild_id, channel_id)
+    snaps = await gather_snapshots(tokens, ids, guild_id)
+
+    def verdict(t: str) -> dict:
+        return evaluate_access(snaps[t], channel_id, bot=tokens[t].get("name") or t) if snaps.get(t) \
+            else _unanswered()
+
+    out = {t: verdict(t) for t in ids}
+    if recheck_denied:
+        now = time.time()
+        stale = [t for t in ids if out[t]["status"] == leases.PERM_DENIED
+                 and now - (getattr(snaps.get(t), "fetched_at", None) or now) >= RECHECK_DENIED_AFTER_SECONDS]
+        if stale:
+            fresh = await gather_snapshots(tokens, stale, guild_id, refresh=True)
+            for t, snap in fresh.items():
+                if snap is not None:     # not answered in time: keep the cached verdict
+                    snaps[t] = snap
+                    out[t] = verdict(t)
+    return out
 
 
 def _channel_ref(perms: Optional[dict], channel_name: Optional[str]) -> str:
@@ -409,7 +441,9 @@ ERROR_TEXT = {
     "pool_exhausted": ("Every radio bot that can join this server is already busy — a bot can be in only one voice "
                        "channel per server, and a bot carrying radio on another node can't be shared. Add another "
                        "radio bot to DRB and invite it to this server, or stop a radio channel here."),
-    "limit": "This server already has its maximum number of radio channels. Stop one with /leave first.",
+    # Reaches the web picker and /join alike: name both ways to stop one.
+    "limit": "This server already has its maximum number of radio channels. Stop one first (Stop on a node's "
+             "Discord radio panel, or /leave in Discord).",
     "preferred_unavailable": "That radio bot can't be used here (it was removed, failed validation, or belongs to "
                              "another organization). Pick another bot, or let DRB choose any free one.",
     "pool_full": ("No radio bot is in this server, and every DRB radio bot that could be invited is already in its "
@@ -484,6 +518,7 @@ async def start_stream(
     preferred_token_id: Optional[str] = None,
     max_streams: Optional[int] = None,
     stream_id: Optional[str] = None,
+    interactive: bool = False,
 ) -> dict:
     """Put ``system_id`` on a voice channel.
 
@@ -504,6 +539,12 @@ async def start_stream(
     channel first (``_perm_check``; server-26#225). Every entry point — the
     bot's /join, the web picker, the node command and the reconciler —
     comes through here, so none can hand a node a bot Discord will refuse.
+
+    ``interactive``: a person asked for this start (the routes pass True,
+    the reconciler never does). A bot whose cached check says "denied" is
+    then asked again if that answer is more than
+    ``RECHECK_DENIED_AFTER_SECONDS`` old (server-26#251), so "fix it in
+    Discord, then try again" works on the next try.
     """
     if mode not in ("persistent", "adhoc"):
         raise StreamError("bad_mode", "mode must be persistent or adhoc", status=400)
@@ -527,14 +568,14 @@ async def start_stream(
             org_id=org_id, guild_id=guild_id, channel_id=channel_id, system_id=system_id, mode=mode,
             channel_name=channel_name, guild_name=guild_name, created_by=created_by, node_id=node_id,
             preferred_token_id=preferred_token_id, max_streams=max_streams, stream_id=stream_id,
-            existing=existing,
+            existing=existing, interactive=interactive,
         )
 
 
 async def _start_locked(*, org_id: str, guild_id: str, channel_id: str, system_id: str, mode: str,
                         channel_name: Optional[str], guild_name: Optional[str], created_by: Optional[str],
                         node_id: Optional[str], preferred_token_id: Optional[str], max_streams: Optional[int],
-                        stream_id: Optional[str], existing: dict) -> dict:
+                        stream_id: Optional[str], existing: dict, interactive: bool = False) -> dict:
     already_on = False
     if stream_id:
         existing = await fstore.doc_get(STREAMS, stream_id) or existing   # re-read under the lock
@@ -612,7 +653,8 @@ async def _start_locked(*, org_id: str, guild_id: str, channel_id: str, system_i
 
     node_ids = {n["node_id"] for n in candidates}
     perms = await _perm_check(org_id=org_id, guild_id=guild_id, channel_id=channel_id, stream_id=stream_id,
-                              preferred_token_id=preferred_token_id, node_ids=node_ids)
+                              preferred_token_id=preferred_token_id, node_ids=node_ids,
+                              recheck_denied=interactive)
     if perms and any(p.get("status") == "bad_channel" for p in perms.values()):
         raise StreamError("bad_channel", f"{_channel_ref(perms, channel_name)} is not a voice channel. "
                                          "Radio can only play in a voice channel — pick one from the list.",
@@ -638,7 +680,7 @@ async def _start_locked(*, org_id: str, guild_id: str, channel_id: str, system_i
                     # Bots that just turned out to be members get checked too.
                     perms = await _perm_check(org_id=org_id, guild_id=guild_id, channel_id=channel_id,
                                               stream_id=stream_id, preferred_token_id=preferred_token_id,
-                                              node_ids=node_ids)
+                                              node_ids=node_ids, recheck_denied=interactive)
                 res = await leases.lease_for_stream(stream_id, node_id=node["node_id"], org_id=org_id,
                                                     preferred_token_id=preferred_token_id, stream_fields=fields,
                                                     soft_preferred_token_id=soft_pref, perms=perms)

drb-c2-core/app/internal/gemini.py

@@ -16,7 +16,6 @@ what it actually spent instead of an estimate.
 """
 import json
 import threading
-from contextvars import ContextVar
 from typing import Optional
 
 from app.config import settings
@@ -27,18 +26,6 @@ _client_lock = threading.Lock()
 # Models that rejected a thinking level: retried without one from then on.
 _no_thinking_level: set[str] = set()
 
-_usage_sink: ContextVar[Optional[dict]] = ContextVar("drb_gemini_usage", default=None)
-
-
-def collect_usage(sink: Optional[dict]):
-    """Route token counts for the current context into `sink` (a replay run). Returns a reset token."""
-    return _usage_sink.set(sink)
-
-
-def reset_usage(token) -> None:
-    _usage_sink.reset(token)
-
-
 def _get_client():
     global _client
     with _client_lock:
@@ -71,14 +58,8 @@ def _record(purpose: str, model: str, usage) -> None:
     prompt = getattr(usage, "prompt_token_count", None) or 0
     output = getattr(usage, "candidates_token_count", None) or 0
     thoughts = getattr(usage, "thoughts_token_count", None) or 0
-    logger.info(f"gemini usage {purpose} {model}: in={prompt} out={output} thinking={thoughts}")
-    sink = _usage_sink.get()
-    if sink is not None:
-        row = sink.setdefault(f"{purpose}:{model}", {"calls": 0, "in": 0, "out": 0, "thinking": 0})
-        row["calls"] += 1
-        row["in"] += prompt
-        row["out"] += output
-        row["thinking"] += thoughts
+    from app.internal.llm import record_usage
+    record_usage(purpose, model, prompt, output, thoughts)
 
 
 def generate_json(model: str, prompt: str, *, purpose: str,

drb-c2-core/app/internal/incident_correlator.py

@@ -43,6 +43,13 @@ Matching priority (in order):
 Calls with no incident_type skip new-incident creation but still run paths 1–3,
 so unclassified calls (short transport end, "en route", etc.) can link to an
 existing incident via talkgroup match.
+
+Decision flow (server-26#299): the rules engine decides every confident case on
+its own. When it flags its decision as ambiguous (`_ambiguity`: opening an
+incident while live candidates exist, orphaning an unfit same-talkgroup
+follow-up, or linking on unverified shared units), routers/upload.py makes ONE
+cheap LLM call (llm_correlator.decide) and commits its answer instead. There is
+no second LLM tier and no consensus vote.
 """
 import math
 import re
@@ -65,26 +72,65 @@ _SEVERITY_RANK = {"routine": 0, "minor": 1, "moderate": 2, "major": 3}
 
 def _max_severity(current: Optional[str], new: Optional[str]) -> str:
     """
-    Highest of two severities on the four-level ladder — the merge rule used
-    every time a call attaches to an existing incident.
-
-    Severity is monotonic by design: it only ever rises, never falls, as more
-    calls link. An incident briefly assessed "major" genuinely was major at
-    that moment; a later call that sounds calmer ("units clear", dispatcher
-    moving on) is evidence the SITUATION is winding down, not that the earlier
-    read was wrong. That's what `status`/`resolved_at` are for — resolution
-    retires an incident, it doesn't retroactively erase how serious it was.
-    Every severity-driven surface (worst-first incident rail, "Major only"
-    filter, map colour) exists to make sure a major event is never missed;
-    downgrading severity mid-incident would silently defeat that on the exact
-    incidents it exists to protect. A malformed/unrecognized value from either
-    side ranks as "routine" so it can never suppress a real escalation.
+    Highest of two severities on the four-level ladder. A malformed or
+    unrecognized value from either side ranks as "routine" so it can never
+    suppress a real escalation.
     """
     current = current if current in _SEVERITY_RANK else "routine"
     new     = new if new in _SEVERITY_RANK else "routine"
     return current if _SEVERITY_RANK[current] >= _SEVERITY_RANK[new] else new
 
 
+# server-26#190 — explicit stand-down / unfounded dispositions. Deliberately a
+# short list of phrases that only ever mean "there is less here than was
+# reported"; a calmer-SOUNDING follow-up ("Engine 5 on scene", "copy") is not
+# one, because extraction judges each transmission on its own words and a
+# working fire's routine status traffic would otherwise talk it down to
+# routine. Left out: "disregard"/"cancel" ("disregard my last" is a radio
+# correction), "all clear" ("primary search all clear" on a working fire) and
+# "code 4" (scene secure, not "nothing happened").
+_STAND_DOWN_RE = re.compile(
+    r"\b(?:unfounded|false alarm|no (?:fire|flames|smoke showing)|nothing (?:showing|found|evident)"
+    r"|gone on arrival|g\.?o\.?a\.?|stand(?:ing)? down|stood down"
+    r"|fire(?:'s| is)? out)\b",
+    re.IGNORECASE,
+)
+
+
+def _is_stand_down(transcript: Optional[str]) -> bool:
+    return bool(transcript and _STAND_DOWN_RE.search(transcript))
+
+
+def _severity_after_link(
+    inc: dict, call_severity: Optional[str], transcript: Optional[str],
+) -> dict:
+    """
+    The incident's severity fields after one more call links (server-26#190).
+
+    `severity` is the CURRENT read and drives the live surfaces (worst-first
+    rail, map colour, severity-scaled quiet timer). It rises immediately on
+    any worse call, and falls only on an explicit stand-down disposition
+    ("they lit a fireplace... only smoke showing, no flames") — then to that
+    call's own severity. It used to only ever ratchet up, which left a false
+    Major on the wall for the full 90-minute Major quiet timer after units
+    reported nothing there.
+
+    `severity_peak` keeps the old monotonic meaning (the worst this incident
+    was ever judged), so history and any "was this ever major" question still
+    have an answer that later chatter cannot erase.
+    """
+    current = inc.get("severity") if inc.get("severity") in _SEVERITY_RANK else "routine"
+    peak    = _max_severity(inc.get("severity_peak"), current)
+    new     = call_severity if call_severity in _SEVERITY_RANK else "routine"
+    out     = {"severity_peak": _max_severity(peak, new)}
+    if _SEVERITY_RANK[new] < _SEVERITY_RANK[current] and _is_stand_down(transcript):
+        out["severity"] = new
+        out["severity_deescalated_from"] = current
+    else:
+        out["severity"] = _max_severity(current, new)
+    return out
+
+
 # Maximum plausible ground speed for a moving incident (pursuit/transport).
 # ~3 miles/min ≈ 180 mph — well above real pursuit speeds, but generous enough
 # to tolerate GPS drift and call-timing jitter.  Anything faster is a bad geocode
@@ -278,16 +324,88 @@ def has_event_substance(ctx: dict) -> bool:
     a vehicle, a geocode, or a tag.
 
     This is the substance half of the incident-creation gate (see
-    `_run_decision`, "Severity, not type, decides..."), factored out so the
-    consensus LLM-orphan gate in routers/upload.py mirrors it exactly and can
-    never drop a call the creation gate would have opened. `call_units` and
-    `location` are deliberately excluded — radio protocol puts a unit ID and a
-    place name in almost every transmission, so counting them as substance
-    makes the check trivially true.
+    `resolve_new_incident_type`). `call_units` and `location` are deliberately
+    excluded — radio protocol puts a unit ID and a place name in almost every
+    transmission, so counting them as substance makes the check trivially true.
     """
     return bool(ctx.get("call_vehicles") or ctx.get("coords") or ctx.get("tags"))
 
 
+def resolve_new_incident_type(ctx: dict) -> Optional[str]:
+    """
+    The type a NEW incident opened by this call gets, or None when the call is
+    not incident-worthy and must orphan instead. The one creation gate, shared
+    by the rules engine and the LLM tier (llm_correlator._parse_response), so
+    an LLM "new" can neither open what the rules gate refuses nor be demoted
+    to orphan for lacking a type the rules gate would have defaulted.
+
+    Severity, not type, decides whether a call is incident-worthy. Requiring a
+    concrete incident_type meant a channel whose traffic never classifies —
+    transit/rail administration, records lookups, prisoner transports — could
+    never open a SECOND incident: every later call funnelled into whichever
+    incident was created first (2026-08-16: TG 9048, 28 calls / 49 min)
+    alongside 30+ permanent orphans. So anything the extractor judged a real
+    event (minor+), or that carries substance (`has_event_substance`), opens
+    an incident under the neutral "other" type. `call_units` and `location`
+    are NOT substance — the first version of this gate counted them, turned
+    "11-Victor, 72 at Holland Station" into its own incident, and left 37 of
+    50 incidents open, one call each.
+    """
+    resolved = ctx.get("incident_type") or _infer_type_from_tags(ctx.get("tags") or [])
+    if resolved:
+        return resolved
+    if ctx.get("call_severity") in ("minor", "moderate", "major") or has_event_substance(ctx):
+        return "other"
+    return None
+
+
+def is_clearance_only(ctx: dict) -> bool:
+    """
+    "45-9, I'm clear." carries one fact: which unit is done. Only the rules
+    engine's unit match can say which incident that is; an LLM link here would
+    apply the clear to whatever incident it picked, so such a call is never
+    sent to the LLM tier.
+    """
+    units = ctx.get("call_units") or []
+    cleared = ctx.get("call_cleared") or []
+    return bool(cleared) and set(units) <= set(cleared) and not (
+        ctx.get("tags") or ctx.get("location") or ctx.get("call_vehicles") or ctx.get("incident_type")
+    )
+
+
+_LLM_TRUE  = frozenset({"true", "yes", "1"})
+_LLM_FALSE = frozenset({"false", "no", "0", "", "none", "null"})
+
+
+def parse_llm_bool(value) -> bool:
+    """
+    A yes/no field from an LLM, failing CLOSED (server-26#88).
+
+    `bool(value)` reads the JSON *string* "false" as True, so a model that
+    quoted its booleans would resolve whatever incident the scene linked into.
+    Only a real bool, or an exact true-ish token, counts as True; anything
+    else — "false", "maybe", a number, a dict — is False. For `resolved` and
+    `reassignment` a missed True costs a stale open incident or one missed
+    unit release; a false True closes a live incident or blanks a call's units.
+
+    Public because the extraction boundary (intelligence.py) is where it
+    belongs; routers/upload.py applies it too, so a value that reaches the
+    scene loop un-coerced is still validated there.
+    """
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        token = value.strip().lower()
+        if token in _LLM_TRUE:
+            return True
+        if token not in _LLM_FALSE:
+            logger.warning(f"parse_llm_bool: unrecognised value {value!r} read as False")
+        return False
+    if value is not None:
+        logger.warning(f"parse_llm_bool: non-boolean {type(value).__name__} {value!r} read as False")
+    return False
+
+
 def _infer_type_from_tags(tags: list[str]) -> Optional[str]:
     """Return an incident type inferred from tags, or None if ambiguous."""
     for tag in tags:
@@ -483,7 +601,7 @@ def _resolve_incident_title(
     of strictly higher severity.  Rationale in the commit message; in short, an
     incident's identity is the event that opened it, and the one situation
     where the header must change is the one where things got worse.  This
-    mirrors `_max_severity`: monotonic, never walked back by later chatter.
+    mirrors `severity_peak`: monotonic, never walked back by later chatter.
 
     Two non-renames are still allowed, because neither replaces an event name:
       • filling in a placeholder title on an incident that opened on a call
@@ -656,6 +774,43 @@ def _incident_at_capacity(inc: dict, now: datetime) -> Optional[str]:
     return None
 
 
+def _weak_link_capped(inc: dict, now: datetime) -> bool:
+    """server-26#189 — past this span an incident takes only strong evidence."""
+    return _incident_span_minutes(inc, now) >= settings.incident_weak_link_max_span_minutes
+
+
+def llm_candidates(ctx: dict) -> list[dict]:
+    """
+    The incidents the LLM tier may see and link into: the rules engine's
+    `recent` pool minus anything at the hard caps or past the weak-link span
+    cap (server-26#189). Every LLM link is weak evidence — a model's reading
+    of two transcripts — so an incident that has been open long enough to
+    have become a catch-all is not offered to it at all.
+    """
+    now = ctx["now"]
+    return [
+        inc for inc in ctx.get("recent") or []
+        if not _incident_at_capacity(inc, now) and not _weak_link_capped(inc, now)
+    ]
+
+
+def llm_link_allowed(inc: dict, ctx: dict) -> bool:
+    """
+    Distance guard on an LLM-chosen link (server-26#189). When both the call
+    and a non-pursuit incident are geocoded and farther apart than
+    `incident_max_spread_km`, the model's link is refused: every rules path
+    already has a location check of its own, and the LLM tier had none.
+    """
+    coords = ctx.get("coords")
+    pin = _verified_pin(inc)
+    if not coords or not pin:
+        return True
+    if set(inc.get("tags") or []) & _PURSUIT_TAGS:
+        return True
+    dist = _haversine_km(coords["lat"], coords["lng"], pin["lat"], pin["lng"])
+    return dist <= settings.incident_max_spread_km
+
+
 def _drop_capped(incidents: list[dict], now: datetime) -> list[dict]:
     """Remove over-cap incidents from a candidate pool (see _incident_at_capacity)."""
     kept: list[dict] = []
@@ -979,7 +1134,7 @@ def _run_decision(ctx: dict) -> dict:
     # Hard caps, enforced regardless of which path would have matched. Normally
     # a no-op because _build_context already filtered these out; re-applied here
     # so the guarantee holds for any caller that assembles a ctx directly
-    # (tests, the LLM tiebreak path) rather than through _build_context.
+    # (tests) rather than through _build_context.
     _capped_ids    = {
         inc.get("incident_id")
         for inc in (list(ctx["all_active"]) + list(ctx["recent"]))
@@ -1013,6 +1168,10 @@ def _run_decision(ctx: dict) -> dict:
 
     matched_incident: Optional[dict] = None
     corr_debug: dict = {}
+    # Why the fast path refused a same-talkgroup candidate, when it did. A
+    # "no_signal" refusal is the one the rules cannot settle: a substantive
+    # call on a channel with a live incident and no evidence either way.
+    tg_reject: Optional[str] = None
 
     # ── 1. Fast path: talkgroup match with recency gate ──────────────────────
     #
@@ -1168,13 +1327,14 @@ def _run_decision(ctx: dict) -> dict:
                     "corr_incident_idle_min": round(_incident_idle_minutes(candidate, now), 1),
                     "corr_fit_signal": fit_signal,
                 }
-                if fit_signal == "unit_overlap" and call_units:
+                if fit_signal.startswith("unit_") and call_units:
                     corr_debug["corr_matched_units"] = _matching_units(call_units, candidate.get("units"))
                 logger.info(
                     f"Correlator fast-path: call {call_id} → {candidate['incident_id']} "
                     f"(signal={fit_signal})"
                 )
             else:
+                tg_reject = fit_signal
                 logger.info(
                     f"Correlator fast-path skipped: call {call_id} — {fit_signal} "
                     f"from {candidate['incident_id']}; will attempt new incident"
@@ -1207,13 +1367,14 @@ def _run_decision(ctx: dict) -> dict:
                     "corr_candidates": len(tg_recent),
                     "corr_fit_signal": fit_signal,
                 }
-                if fit_signal == "unit_overlap" and call_units:
+                if fit_signal.startswith("unit_") and call_units:
                     corr_debug["corr_matched_units"] = _matching_units(call_units, candidate.get("units"))
                 logger.info(
                     f"Correlator fast-path (disambig {len(tg_recent)} candidates): "
                     f"call {call_id} → {candidate['incident_id']} (signal={fit_signal})"
                 )
             else:
+                tg_reject = fit_signal
                 logger.info(
                     f"Correlator fast-path disambig: no candidate fits call {call_id} "
                     f"across {len(tg_recent)} incidents ({fit_signal}) — will attempt new incident"
@@ -1249,28 +1410,27 @@ def _run_decision(ctx: dict) -> dict:
                 and inc.get("updated_at", "") > best_unit_inc.get("updated_at", "")
                 for inc in all_active
             )
-            # Location conflict check: same unit at a clearly different location
-            # means the officer has moved to a new scene (e.g. dispatch sent
-            # them to a second call without an explicit reassignment signal).
-            location_conflict = False
-            if coords and not reassigned_away:
-                inc_coords_uc = best_unit_inc.get("location_coords")
-                if inc_coords_uc:
-                    uc_dist = _haversine_km(
-                        coords["lat"], coords["lng"],
-                        inc_coords_uc["lat"], inc_coords_uc["lng"],
-                    )
-                    if uc_dist > settings.location_proximity_km:
-                        location_conflict = True
-                        logger.info(
-                            f"Correlator unit-continuity skipped: call {call_id} — "
-                            f"unit match but location conflict ({uc_dist:.2f}km) with "
-                            f"{best_unit_inc['incident_id']}"
-                        )
-            if not reassigned_away and not location_conflict:
+            # Same unit-overlap judgement as the fast path (_unit_fit): a
+            # location conflict means the officer has moved to a new scene, a
+            # sink past the weak-link span cap takes no unit-only links
+            # (server-26#189), and an old incident with no location or content
+            # agreement is linked but flagged unverified, i.e. ambiguous.
+            uc_fit, uc_signal = (False, "reassigned_away")
+            if not reassigned_away:
+                uc_fit, uc_signal = _unit_fit(
+                    best_unit_inc, coords, call_embedding, now,
+                    settings.location_proximity_km,
+                )
+            if not uc_fit:
+                logger.info(
+                    f"Correlator unit-continuity skipped: call {call_id} vs "
+                    f"{best_unit_inc['incident_id']} — {uc_signal}"
+                )
+            else:
                 matched_incident = best_unit_inc
                 corr_debug = {
                     "corr_path": "unit-continuity",
+                    "corr_fit_signal": uc_signal,
                     "corr_incident_idle_min": round(_incident_idle_minutes(best_unit_inc, now), 1),
                     # Unlike this file's other two paths (fast/single, fast/disambig),
                     # a match here is unit-driven by construction (call_unit_set &
@@ -1445,63 +1605,66 @@ def _run_decision(ctx: dict) -> dict:
 
     # ── Decision output ───────────────────────────────────────────────────────
     if matched_incident:
-        return {
-            "action": "link",
-            "matched_incident": matched_incident,
-            "incident_type": incident_type,
-            "corr_debug": corr_debug,
-        }
-
-    if not create_if_new:
-        return {"action": "orphan", "matched_incident": None, "incident_type": None, "corr_debug": corr_debug}
-
-    # Attempt type inference from tags before giving up on creation
-    resolved_type = incident_type
-    if not resolved_type and tags:
-        resolved_type = _infer_type_from_tags(tags)
-        if resolved_type:
+        action, resolved_type = "link", incident_type
+    elif not create_if_new:
+        action, resolved_type = "orphan", None
+    else:
+        resolved_type = resolve_new_incident_type(ctx)
+        action = "new" if resolved_type else "orphan"
+        if resolved_type and resolved_type != incident_type:
             logger.info(
-                f"Correlator: inferred incident_type={resolved_type!r} from tags {tags} for call {call_id}"
+                f"Correlator: call {call_id} has no incident_type — opening a "
+                f"{resolved_type!r} incident (severity={call_severity}, tags={tags})"
             )
 
-    # Severity, not type, decides whether a call is incident-worthy.
-    #
-    # Requiring a concrete incident_type here meant a channel whose traffic never
-    # classifies — transit/rail administration, records lookups, prisoner
-    # transports — could never open a SECOND incident.  Every later call on that
-    # talkgroup then funnelled into whichever incident happened to be created
-    # first, producing hour-long incidents made of unrelated transmissions
-    # (2026-08-16: TG 9048, 28 calls / 49 min) alongside 30+ permanent orphans.
-    #
-    # Anything the extractor judged a real event, or that carries any concrete
-    # content, now opens an incident under the neutral "other" type.  Only
-    # content-free routine traffic is still left for the thin path to attach.
-    #
-    # `call_units` and `location` are NOT substance.  Radio protocol puts a unit
-    # ID in essentially every transmission and a place name in most of them, so
-    # including them made has_substance true almost always and the severity check
-    # dead code — the first version of this gate turned "11-Victor, 72 at Holland
-    # Station" into its own incident and left 37 of 50 incidents open, one call
-    # each.  A vehicle, a geocode, or a tag means the extractor found something
-    # beyond who was speaking and where they stood.
-    if not resolved_type:
-        has_substance = has_event_substance(ctx)
-        if call_severity in ("minor", "moderate", "major") or has_substance:
-            resolved_type = "other"
-            logger.info(
-                f"Correlator: call {call_id} has no incident_type — opening an 'other' "
-                f"incident (severity={call_severity}, substance={has_substance})"
-            )
-
-    if not resolved_type:
-        return {"action": "orphan", "matched_incident": None, "incident_type": None, "corr_debug": corr_debug}
-
-    return {
-        "action": "new",
-        "matched_incident": None,
+    decision = {
+        "action": action,
+        "matched_incident": matched_incident,
         "incident_type": resolved_type,
         "corr_debug": corr_debug,
     }
+    decision["ambiguous"] = _ambiguity(decision, tg_reject, ctx)
+    return decision
+
+
+def _ambiguity(decision: dict, tg_reject: Optional[str], ctx: dict) -> Optional[str]:
+    """
+    Why the rules decision is NOT confident enough to commit alone, or None
+    when it is (server-26#299). Only an ambiguous decision is sent to the LLM
+    tier, once; every other decision is the rules engine's alone.
+
+    Ambiguous:
+      • "new_with_candidates" — the rules would OPEN an incident while live,
+        LLM-eligible incidents exist. Opening is the expensive mistake: this
+        system over-splits, and rules-only correlation opened ~1.8x the
+        incidents per hour of LLM-assisted (#170, 2026-10-04 control window)
+        — duplicates of a running job and typed radio housekeeping.
+      • "unfit_tg_candidate" — the rules would ORPHAN a substantive call that
+        has a live incident on its own talkgroup but no evidence for or
+        against it (fit test "no_signal"): an unfit follow-up.
+      • "unverified_unit_link" — the rules would LINK on shared units alone
+        into an incident that is no longer fresh, with no location or content
+        agreement (mechanism B; #103: the content veto has nothing to measure
+        when the scene has no embedding). Between the divergence and match
+        embedding bars (#86) a link lands here too.
+
+    Never ambiguous: thin calls (nothing to reason about), clearance-only
+    calls (only the unit match can place a 10-8), link-only sweeps
+    (create_if_new=False — rules-only by design), or when the LLM would have
+    no candidates to choose from.
+    """
+    if not ctx.get("create_if_new", True) or ctx.get("is_thin_call"):
+        return None
+    if is_clearance_only(ctx) or not llm_candidates(ctx):
+        return None
+    action = decision["action"]
+    if action == "new":
+        return "new_with_candidates"
+    if action == "orphan" and tg_reject == "no_signal":
+        return "unfit_tg_candidate"
+    if action == "link" and (decision["corr_debug"] or {}).get("corr_fit_signal") == "unit_overlap_unverified":
+        return "unverified_unit_link"
+    return None
 
 
 # ─────────────────────────────────────────────────────────────────────────────
@@ -1514,7 +1677,7 @@ async def _apply_and_log(decision: dict, ctx: dict) -> Optional[str]:
 
     server-26#96: every scene of a multi-scene call reaches this function
     independently (upload.py's ``for scene_index, scene in enumerate(scenes):``
-    loop → _correlate_with_consensus → preview_correlation/apply_correlation),
+    loop → _correlate → preview_correlation/apply_correlation),
     and every scene writes to the SAME call doc. Writing corr_debug only at
     the flat top level meant scene 2's write silently clobbered scene 1's
     corr_path/corr_consensus/etc — the call doc ended up describing a splice
@@ -1553,18 +1716,14 @@ async def _apply_and_log(decision: dict, ctx: dict) -> Optional[str]:
                 "incident_id":   incident_id,
                 "corr_debug":    corr_debug,
                 # server-26#139: this scene's OWN extracted incident_type/
-                # severity, as read by _call_is_substanceless's ctx at
-                # decision time — not the call doc's flat top-level field,
-                # which is last-scene-wins (server-26#96) and was the reason
-                # #138's "type" veto couldn't be told apart from cross-scene
-                # contamination without re-guessing from a live dump.
+                # severity, as read from ctx at decision time — not the call
+                # doc's flat top-level field, which is last-scene-wins
+                # (server-26#96).
                 # NOTE: unlike incident_type, call_severity is already
                 # coerced to "routine" when extraction emitted nothing
                 # (ctx build: `severity or "routine"`) — a scene reading
                 # "routine" here doesn't distinguish "extraction said
-                # routine" from "extraction said nothing". Don't split a
-                # severity veto the way #138 splits the type veto without
-                # accounting for that.
+                # routine" from "extraction said nothing".
                 "incident_type": ctx.get("incident_type"),
                 "severity":      ctx.get("call_severity"),
             }
@@ -1613,6 +1772,7 @@ async def _apply_decision(decision: dict, ctx: dict) -> Optional[str]:
             talkgroup_name=talkgroup_name, incident_type=incident_type,
             cleared_units=call_cleared, refresh_activity=not thin_link,
             call_severity=call_severity, call_srcaddr=call_srcaddr,
+            call_transcript=ctx.get("scene_transcript"),
         )
         return matched_incident["incident_id"]
 
@@ -1798,6 +1958,65 @@ def _disambiguate(
     return best
 
 
+def _unit_fit(
+    inc: dict,
+    call_coords: Optional[dict],
+    call_embedding: Optional[list],
+    now: Optional[datetime],
+    proximity_km: float,
+) -> tuple[bool, str]:
+    """
+    Judge a link whose evidence is a shared unit. Same officer usually means
+    same call — but on a shared dispatch channel a patrol unit works job after
+    job, so shared units alone grow chains (mechanism B,
+    CORRELATION_REVIEW_0820.md). In order:
+
+      • call and incident both geocoded: far apart → (False,
+        "unit_loc_conflict"), the officer moved to a new scene; close →
+        (True, "unit_location_match").
+      • embeddings agree at the match bar → (True, "unit_content_match").
+      • incident past the weak-link span cap (#189) → (False,
+        "weak_link_span_cap"): a long-running incident stops taking
+        unit-only evidence.
+      • incident fresh (idle < unit_link_fresh_idle_minutes) and young (open
+        < unit_link_confident_max_span_minutes) → (True, "unit_overlap"). No
+        content veto here: an update on the same scene often shares little
+        vocabulary with the dispatch and does not restate the address.
+      • not fresh, embeddings below the DIVERGENCE bar (#86) → (False,
+        "content_divergence").
+      • anything else → (True, "unit_overlap_unverified"): the rules keep the
+        link but cannot vouch for it, so the decision is ambiguous and goes
+        to the LLM tier. This is where a scene with no embedding lands
+        (#103) — it used to skip the veto and link as if verified, which
+        removed the only brake on the unit loop for ~93% of calls.
+    """
+    inc_coords = inc.get("location_coords")
+    if call_coords and inc_coords:
+        dist_km = _haversine_km(
+            call_coords["lat"], call_coords["lng"],
+            inc_coords["lat"], inc_coords["lng"],
+        )
+        return (False, "unit_loc_conflict") if dist_km > proximity_km else (True, "unit_location_match")
+
+    sim: Optional[float] = None
+    inc_emb = inc.get("embedding")
+    if call_embedding and inc_emb:
+        sim = _cosine_similarity(call_embedding, inc_emb)
+        if sim >= settings.embedding_similarity_threshold:
+            return True, "unit_content_match"
+
+    if now is None:
+        return True, "unit_overlap_unverified"
+    if _weak_link_capped(inc, now):
+        return False, "weak_link_span_cap"
+    fresh = _idle_gate_minutes(inc, now) < settings.unit_link_fresh_idle_minutes
+    if fresh and _incident_span_minutes(inc, now) < settings.unit_link_confident_max_span_minutes:
+        return True, "unit_overlap"
+    if not fresh and sim is not None and sim < settings.embedding_divergence_threshold:
+        return False, "content_divergence"
+    return True, "unit_overlap_unverified"
+
+
 def _call_fits_incident(
     inc: dict,
     call_units: list[str],
@@ -1812,18 +2031,14 @@ def _call_fits_incident(
     Return (fits, signal) — fits is True when this call plausibly belongs to
     the incident; signal names the specific evidence that drove the decision.
 
-    fits=True  signals: "unit_overlap" | "vehicle_overlap" | "location_proximity"
+    fits=True  signals: see `_unit_fit` for the unit_* family | "vehicle_overlap"
+                        | "location_proximity"
     fits=False signals: "unit_loc_conflict" | "content_divergence"
-                        | "location_conflict" | "no_signal"
+                        | "weak_link_span_cap" | "location_conflict" | "no_signal"
 
     Evaluation order:
-    1. Unit overlap. Same officer = same call. Also runs a location-conflict
-       guard: geocoded on both sides and clearly different → the officer has
-       moved to a new scene, false positive. No geocode on the call (or on
-       the incident, with a call geocode) AND the incident is old (≥ 15 min)
-       → content divergence as a location proxy (embedding similarity < 0.82
-       → different scene). Skipped for recent incidents (< 15 min) — an
-       update without re-stating the address is normal.
+    1. Unit overlap — judged by `_unit_fit`, which also decides whether the
+       link is confident or only "unit_overlap_unverified" (ambiguous).
     2. Vehicle overlap → True.
     3. Location proximity. Both geocoded and close → True; far apart with no
        other positive signal → False.
@@ -1850,44 +2065,9 @@ def _call_fits_incident(
     inc_units = _unit_keys(inc.get("units"))
     matched_units = _matching_units(call_units, inc.get("units"))
     if matched_units:
-        if call_coords:
-            # Hard location conflict: geocoded on both sides and clearly different.
-            inc_coords_u = inc.get("location_coords")
-            if inc_coords_u:
-                dist_km = _haversine_km(
-                    call_coords["lat"], call_coords["lng"],
-                    inc_coords_u["lat"], inc_coords_u["lng"],
-                )
-                if dist_km > proximity_km:
-                    logger.info(f"  fits[{inc_id}]: unit_overlap({matched_units}) but location_conflict dist={dist_km:.2f}km → unit_loc_conflict")
-                    return False, "unit_loc_conflict"
-            elif call_embedding and idle_min >= 15:
-                # Call has geocode but incident doesn't — fall back to content
-                # divergence as a location proxy.  Without this, stale incidents
-                # that never geocoded absorb unrelated calls purely on unit
-                # overlap (e.g. a patrol officer working a second scene 70 min
-                # after the original call).
-                inc_emb_u = inc.get("embedding")
-                if inc_emb_u:
-                    sim = _cosine_similarity(call_embedding, inc_emb_u)
-                    if sim < 0.82:
-                        logger.info(f"  fits[{inc_id}]: unit_overlap({matched_units}) but content_divergence (has_call_coords/no_inc_coords) sim={sim:.3f} → content_divergence")
-                        return False, "content_divergence"
-        elif call_embedding and idle_min >= 15:
-            # No geocode available AND old incident: use content divergence as a
-            # location-proxy veto.  After 15+ minutes an officer at a completely
-            # different scene will be discussing clearly different content.
-            # Skip this for recent incidents — an officer updating on the same
-            # scene without re-stating the address is normal and their update
-            # won't share much vocabulary with the original dispatch.
-            inc_emb_u = inc.get("embedding")
-            if inc_emb_u:
-                sim = _cosine_similarity(call_embedding, inc_emb_u)
-                if sim < 0.82:
-                    logger.info(f"  fits[{inc_id}]: unit_overlap({matched_units}) but content_divergence sim={sim:.3f} → content_divergence")
-                    return False, "content_divergence"
-        logger.info(f"  fits[{inc_id}]: unit_overlap matched={matched_units} → unit_overlap")
-        return True, "unit_overlap"
+        fit, signal = _unit_fit(inc, call_coords, call_embedding, now, proximity_km)
+        logger.info(f"  fits[{inc_id}]: unit_overlap matched={matched_units} → {signal}")
+        return fit, signal
 
     # ── 2. Vehicle overlap ────────────────────────────────────────────────────
     inc_vehicles = set(inc.get("vehicles") or [])
@@ -2047,6 +2227,7 @@ async def _update_incident(
     refresh_activity: bool = True,
     call_severity: Optional[str] = None,
     call_srcaddr: Optional[str] = None,
+    call_transcript: Optional[str] = None,
 ) -> None:
     incident_id = inc["incident_id"]
 
@@ -2109,7 +2290,9 @@ async def _update_incident(
         "units_cleared":     units_cleared,
         "location_mentions": location_mentions,
         "summary_stale":     True,
-        "severity":          _max_severity(inc.get("severity"), call_severity),
+        # Current severity can step DOWN on an explicit stand-down; the peak
+        # never does (server-26#190, _severity_after_link).
+        **_severity_after_link(inc, call_severity, call_transcript),
         # Always all three, always together — writing one without the others is
         # what let the label and the pin drift apart (server-26#23).
         **location_fields,
@@ -2123,7 +2306,18 @@ async def _update_incident(
     # acknowledging.  The incident now ages from its last SUBSTANTIVE call, and
     # thin traffic rides along without extending its life.
     if refresh_activity:
-        updates["updated_at"] = _floor_at_started_at(inc, now).isoformat()
+        # Never move updated_at BACKWARD: a back-dated `now` (sweep, or a late
+        # upload's clock pin, server-26#301) would make a live incident look
+        # idle, failing on-time calls' recency gates and timer-closing it early.
+        when = _floor_at_started_at(inc, now)
+        try:
+            prev = datetime.fromisoformat(str(inc.get("updated_at") or "").replace("Z", "+00:00"))
+            if prev.tzinfo is None:
+                prev = prev.replace(tzinfo=timezone.utc)
+            when = max(when, prev)
+        except ValueError:
+            pass
+        updates["updated_at"] = when.isoformat()
         if is_new_call:  # a second scene of the same call is not a second call
             updates["substantive_call_count"] = (
                 inc.get("substantive_call_count")
@@ -2233,6 +2427,7 @@ async def _create_incident(
         "vehicles":          call_vehicles,
         "srcaddrs":          [call_srcaddr] if call_srcaddr else [],
         "severity":          call_severity,
+        "severity_peak":     call_severity,
         "summary":           None,
         "summary_stale":     True,
         "summary_last_run":  None,

drb-c2-core/app/internal/intelligence.py

@@ -1,7 +1,8 @@
 """
-GPT-4o-mini intelligence extraction from call transcripts.
+Intelligence extraction from call transcripts.
 
-Sends the transcript to GPT-4o-mini with a structured prompt that detects
+Sends the transcript to the extraction model (settings.extraction_model,
+gpt-4o-mini by default) with a structured prompt that detects
 whether the recording contains one or multiple distinct scenes (back-to-back
 dispatch conversations on a busy channel).  Returns a list of scene dicts —
 one per detected incident.  Most calls produce a single scene.
@@ -12,12 +13,14 @@ import asyncio
 import json
 import math
 import re
+from collections import OrderedDict
 from typing import Optional
 from app.internal.logger import logger
 from app.internal import firestore as fstore
 from app.internal import ai_health
 from app.internal import area_context
-from app.internal.chatter_classifier import classify_chatter
+from app.internal import incident_correlator
+from app.internal.chatter_classifier import classify_chatter, gate_chatter
 # Location validity is defined once, by the module that owns the incident's
 # location/pin invariant.  incident_correlator does not import this module, so
 # this is not a cycle.
@@ -218,11 +221,12 @@ async def extract_scenes(
             pass
         return []
 
-    # server-26#127 — SHADOW MODE ONLY. Computes whether this transcript looks
+    # server-26#127 — the shadow verdict. Computes whether this transcript looks
     # like non-event radio housekeeping (roll call, bare 10-4/10-8/98
-    # acknowledgements, unit check-ins) and records the verdict on the call
-    # doc, but does NOT skip extraction anywhere below — every path runs
-    # exactly as it did before this landed. Deliberately ahead of the ≤5-word
+    # acknowledgements, unit check-ins) and records it on the call doc. The
+    # live cost gate (server-26#298, gate_chatter below) is a stricter view of
+    # the same classifier; this verdict is recorded unchanged so the /admin
+    # tallies keep measuring the same thing. Deliberately ahead of the ≤5-word
     # skip: most bare acknowledgements ARE ≤5 words, and the first pass of
     # this feature put the classifier after that return, so it never saw the
     # bulk of its own target population — a review backtest against three
@@ -231,13 +235,9 @@ async def extract_scenes(
     # roughly a fifth of the real catch rate. Computing it once, here, and
     # folding the result into whichever skip/continue path runs below fixes
     # that without adding a second Firestore write.
-    # TODO(server-26#127): flip this from shadow to live (skip extraction and
-    # write skip_reason="non_event_chatter" instead of just recording the
-    # verdict) once a live shadow-mode window confirms 0 false positives on
-    # real production traffic — pay particular attention to whole-transcript
-    # vs contains-anywhere matching for "roll call" and to digit-hyphen street
-    # addresses (e.g. "72-Holland"), both flagged as classifier risks that the
-    # dump backtest could not surface on its own.
+    # Residual risk of the live gate, unchanged from the #127 review: a
+    # digit-hyphen street address ("72-Holland") alone in a transmission reads
+    # as a unit ID. CHATTER_GATE_ENABLED=false restores shadow mode.
     chatter_is_chatter, chatter_reason = classify_chatter(transcript)
 
     # Transcripts with ≤5 words carry no extractable intelligence — GPT hallucinates
@@ -277,6 +277,40 @@ async def extract_scenes(
                      "tags": tags, "incident_type": typ, "severity": sev}]
         return []
 
+    # server-26#298 — the gate is live. Radio housekeeping has no incident
+    # content for the extraction model to find, so it no longer pays for an
+    # extraction, an embedding per scene and a geocode to come back as a thin
+    # routine scene. gate_chatter is classify_chatter with roll_call narrowed
+    # to whole-transcript roll calls (the #127 review's false-positive shape).
+    # The free rule paths still run, exactly as on the <=5-word path above.
+    from app.config import settings
+    gated, gate_reason = gate_chatter(transcript) if settings.chatter_gate_enabled else (False, None)
+    if gated:
+        logger.info(
+            f"Intelligence: call {call_id} — non-event chatter ({gate_reason}), skipping extraction"
+        )
+        cleared_unit = _short_clearance_unit(transcript)
+        tags, typ, sev = _self_initiated_backstop(transcript, [], None, "routine", talkgroup_name)
+        updates = {
+            "skip_reason": "non_event_chatter",
+            "severity":    sev if tags else "routine",
+            "chatter_classifier_verdict": chatter_is_chatter,
+            "chatter_classifier_reason":  chatter_reason,
+        }
+        if cleared_unit:
+            updates["units"] = [cleared_unit]
+            updates["cleared_units"] = [cleared_unit]
+        try:
+            await fstore.doc_set("calls", call_id, updates)
+        except Exception:
+            pass
+        if cleared_unit:
+            return [_clearance_scene(transcript, cleared_unit)]
+        if tags:
+            return [{**_clearance_scene(transcript, ""), "units": [], "cleared_units": [],
+                     "tags": tags, "incident_type": typ, "severity": sev}]
+        return []
+
     try:
         await fstore.doc_set("calls", call_id, {
             "chatter_classifier_verdict": chatter_is_chatter,
@@ -294,13 +328,14 @@ async def extract_scenes(
     except Exception as e:
         text = str(e)
         kind = ai_health.classify(text)
-        logger.warning(f"GPT-4o-mini extraction failed for call {call_id}: {text}")
+        from app.config import settings as _s
+        logger.warning(f"Extraction ({_s.extraction_model}) failed for call {call_id}: {text}")
         await ai_health.report_degraded(
-            "extraction", "openai", "gpt-4o-mini",
+            "extraction", "openai", _s.extraction_model,
             {"billing": "the OpenAI account is out of credit",
              "dead_model": "model is unavailable"}.get(kind, f"extraction failed: {text[:200]}"),
             {"billing": "Top up OpenAI billing",
-             "dead_model": "Update the extraction model in intelligence.py"}.get(kind, "Usually transient"),
+             "dead_model": "Update EXTRACTION_MODEL"}.get(kind, "Usually transient"),
             permanent=kind != "transient",
         )
         return []
@@ -364,8 +399,10 @@ async def extract_scenes(
         severity:           str            = scene.get("severity") or "routine"
         if severity == "unknown":
             severity = "routine"
-        resolved:           bool           = bool(scene.get("resolved", False))
-        reassignment:       bool           = bool(scene.get("reassignment", False))
+        # server-26#88: bool("false") is True, which let a model answering
+        # with a JSON string resolve an incident it merely linked into.
+        resolved:           bool           = incident_correlator.parse_llm_bool(scene.get("resolved"))
+        reassignment:       bool           = incident_correlator.parse_llm_bool(scene.get("reassignment"))
         transcript_corrected: Optional[str]= scene.get("transcript_corrected") or None
         segment_indices:    Optional[list] = scene.get("segment_indices")
 
@@ -690,8 +727,15 @@ async def _geocode_location(
     """
     Geocode using Google Maps Geocoding API, biased toward the channel's area.
 
-    Returns {"lat": float, "lng": float}, or None if geocoding fails or the
-    result lands outside the area this channel covers.
+    Returns {"lat": float, "lng": float, "location_type": str}, or None if
+    geocoding fails or the result lands outside the area this channel covers.
+
+    server-26#236: `location_type` (ROOFTOP / RANGE_INTERPOLATED /
+    GEOMETRIC_CENTER) rides along with the coordinates so the map can show how
+    precise a pin is — a route centroid must not draw the same teardrop as a
+    rooftop. It is display-only: every consumer of these coords reads only
+    "lat"/"lng", and the dict is stored as-is on the call doc and, through
+    incident_correlator._resolve_location_pair, on the incident pin.
 
     THE REFERENCE POINT IS THE TALKGROUP, NOT THE NODE (server-26#6 / #37). This
     used to reject anything more than geocode_max_km (40km) from the receiving
@@ -722,7 +766,6 @@ async def _geocode_location(
     touch the anchor path at all — an anchor's own radius is always authoritative
     when one has been resolved.
     """
-    import httpx
     from app.config import settings
 
     if not settings.google_maps_api_key:
@@ -748,70 +791,122 @@ async def _geocode_location(
         f"{ref_lat - delta},{ref_lon - delta}"
         f"|{ref_lat + delta},{ref_lon + delta}"
     )
-    params = {
-        "address": location_str,
-        "bounds":  bounds,
-        "region":  "us",
-        "key":     settings.google_maps_api_key,
-    }
     try:
-        async with httpx.AsyncClient(timeout=5.0) as client:
-            r = await client.get(
-                "https://maps.googleapis.com/maps/api/geocode/json",
-                params=params,
-            )
-            r.raise_for_status()
-            data = r.json()
-            if data.get("status") != "OK" or not data.get("results"):
-                return None
-            result = data["results"][0]
-            location_type = result.get("geometry", {}).get("location_type", "")
-            # Reject only APPROXIMATE — a region/city boundary centroid, which is
-            # what an ungeocodable string degrades to and is genuinely useless.
-            #
-            # ROOFTOP-only was too strict and emptied the map: dispatch names
-            # places the way people speak, and Google returns GEOMETRIC_CENTER for
-            # exactly those forms — intersections ("Lake Street and Veterans
-            # Memorial Drive") and named POIs ("Brewster Station"). Both are
-            # precise enough to plot and to proximity-match; requiring a street
-            # address threw away nearly every real dispatch location, leaving only
-            # numbered addresses geocoded.
-            if location_type not in ("ROOFTOP", "RANGE_INTERPOLATED", "GEOMETRIC_CENTER"):
-                logger.info(
-                    f"Geocoding rejected '{location_str}' — imprecise result "
-                    f"(location_type={location_type!r}), returning None"
-                )
-                return None
-            loc = result["geometry"]["location"]
-            lat, lng = float(loc["lat"]), float(loc["lng"])
-            dist_km = _geo_dist_km(ref_lat, ref_lon, lat, lng)
-            if dist_km > max_km:
-                # server-26#159: the node-distance bound is a proxy for "is
-                # this plausible" that only makes sense when the node's own
-                # position is our best guess at the area — never when the
-                # query already names a different region on its own terms.
-                if not (ref_label == "node" and trust_named_region):
-                    logger.warning(
-                        f"Geocoding rejected '{location_str}' → ({lat:.4f}, {lng:.4f}) "
-                        f"— {dist_km:.1f}km from {ref_label} exceeds {max_km:.1f}km"
-                    )
-                    return None
-                logger.info(
-                    f"Geocoding '{location_str}' → ({lat:.4f}, {lng:.4f}) is "
-                    f"{dist_km:.1f}km from the receiving node, past {max_km:.1f}km — "
-                    f"accepted anyway: the query names its own region, not the node's"
-                )
-            coords = {"lat": lat, "lng": lng}
+        result = await _geocode_lookup(location_str, bounds)
+        if result is None:
+            return None
+        location_type = result.get("geometry", {}).get("location_type", "")
+        # Reject only APPROXIMATE — a region/city boundary centroid, which is
+        # what an ungeocodable string degrades to and is genuinely useless.
+        #
+        # ROOFTOP-only was too strict and emptied the map: dispatch names
+        # places the way people speak, and Google returns GEOMETRIC_CENTER for
+        # exactly those forms — intersections ("Lake Street and Veterans
+        # Memorial Drive") and named POIs ("Brewster Station"). Both are
+        # precise enough to plot and to proximity-match; requiring a street
+        # address threw away nearly every real dispatch location, leaving only
+        # numbered addresses geocoded.
+        if location_type not in ("ROOFTOP", "RANGE_INTERPOLATED", "GEOMETRIC_CENTER"):
             logger.info(
-                f"Geocoded '{location_str}' → {coords} "
-                f"({dist_km:.1f}km from {ref_label}) [{location_type}]"
+                f"Geocoding rejected '{location_str}' — imprecise result "
+                f"(location_type={location_type!r}), returning None"
             )
-            return coords
+            return None
+        loc = result["geometry"]["location"]
+        lat, lng = float(loc["lat"]), float(loc["lng"])
+        dist_km = _geo_dist_km(ref_lat, ref_lon, lat, lng)
+        if dist_km > max_km:
+            # server-26#159: the node-distance bound is a proxy for "is
+            # this plausible" that only makes sense when the node's own
+            # position is our best guess at the area — never when the
+            # query already names a different region on its own terms.
+            if not (ref_label == "node" and trust_named_region):
+                logger.warning(
+                    f"Geocoding rejected '{location_str}' → ({lat:.4f}, {lng:.4f}) "
+                    f"— {dist_km:.1f}km from {ref_label} exceeds {max_km:.1f}km"
+                )
+                return None
+            logger.info(
+                f"Geocoding '{location_str}' → ({lat:.4f}, {lng:.4f}) is "
+                f"{dist_km:.1f}km from the receiving node, past {max_km:.1f}km — "
+                f"accepted anyway: the query names its own region, not the node's"
+            )
+        coords = {"lat": lat, "lng": lng, "location_type": location_type}
+        logger.info(
+            f"Geocoded '{location_str}' → {coords} "
+            f"({dist_km:.1f}km from {ref_label}) [{location_type}]"
+        )
+        return coords
     except Exception as e:
         logger.warning(f"Geocoding failed for '{location_str}': {e}")
     return None
 
 
+# server-26#298: geocode answers, keyed by the exact request (address +
+# bounds). Only the first result's geometry is kept — the minimum the checks
+# in _geocode_location read — so the cache holds coordinates, not Maps
+# content. The distance/precision checks still run per call on a hit, so a
+# cached answer is judged against whatever anchor or node asks.
+_geocode_cache: "OrderedDict[tuple[str, str], tuple[float, Optional[dict]]]" = OrderedDict()
+geocode_cache_stats = {"hits": 0, "misses": 0}
+
+
+def clear_geocode_cache() -> None:
+    _geocode_cache.clear()
+    geocode_cache_stats.update(hits=0, misses=0)
+
+
+async def _geocode_lookup(address: str, bounds: str) -> Optional[dict]:
+    """
+    The Geocoding API's first result for `address` inside `bounds`, or None
+    when it has none. Cached in process (settings.geocode_cache_*). A network
+    error or non-200 raises and is NOT cached — the next call retries.
+    """
+    import time
+    import httpx
+    from app.config import settings
+
+    key = (address.strip().lower(), bounds)
+    now = time.monotonic()
+    hit = _geocode_cache.get(key)
+    if hit is not None:
+        expires, value = hit
+        if expires > now:
+            _geocode_cache.move_to_end(key)
+            geocode_cache_stats["hits"] += 1
+            return value
+        _geocode_cache.pop(key, None)
+    geocode_cache_stats["misses"] += 1
+
+    async with httpx.AsyncClient(timeout=5.0) as client:
+        r = await client.get(
+            "https://maps.googleapis.com/maps/api/geocode/json",
+            params={"address": address, "bounds": bounds, "region": "us",
+                    "key": settings.google_maps_api_key},
+        )
+        r.raise_for_status()
+        data = r.json()
+
+    status = data.get("status")
+    value: Optional[dict] = None
+    if status == "OK" and data.get("results"):
+        geometry = data["results"][0].get("geometry") or {}
+        value = {"geometry": {"location": geometry.get("location") or {},
+                              "location_type": geometry.get("location_type", "")}}
+        ttl = settings.geocode_cache_ttl_seconds
+    elif status == "ZERO_RESULTS":
+        ttl = settings.geocode_cache_negative_ttl_seconds
+    else:
+        # OVER_QUERY_LIMIT / REQUEST_DENIED / UNKNOWN_ERROR: a key or quota
+        # problem, not an answer about this address.
+        return None
+    if ttl > 0 and settings.geocode_cache_max_entries > 0:
+        _geocode_cache[key] = (now + ttl, value)
+        while len(_geocode_cache) > settings.geocode_cache_max_entries:
+            _geocode_cache.popitem(last=False)
+    return value
+
+
 def _municipality_from_tg(tg_name: Optional[str]) -> Optional[str]:
     """
     Extract the municipality name from a talkgroup name.
@@ -936,7 +1031,7 @@ def _sync_extract(
     ten_codes: Optional[dict[str, str]] = None,
     unit_format_hint: Optional[str] = None,
 ) -> list[dict]:
-    """Call GPT-4o-mini and return a list of scene dicts."""
+    """Call the extraction model and return a list of scene dicts."""
     from app.config import settings
     from app.internal.ai_clients import openai_client
 
@@ -958,7 +1053,7 @@ def _sync_extract(
     try:
         client = openai_client()
         response = client.chat.completions.create(
-            model="gpt-4o-mini",
+            model=settings.extraction_model,
             messages=[{"role": "user", "content": prompt}],
             response_format={"type": "json_object"},
         )
@@ -973,7 +1068,7 @@ def _sync_extract(
         return [raw]
 
     except json.JSONDecodeError as e:
-        logger.warning(f"GPT-4o-mini returned non-JSON: {e}")
+        logger.warning(f"Extraction model returned non-JSON: {e}")
         return []
     # Any other exception is the API call itself failing (no credit, rate
     # limit, outage) and propagates to extract_scenes, which reports it to
@@ -983,7 +1078,7 @@ def _sync_extract(
 
 
 def _sync_embed(text: str) -> Optional[list[float]]:
-    """Generate a text-embedding-3-small vector for semantic similarity."""
+    """Generate an embedding (settings.embedding_model) for semantic similarity."""
     from app.config import settings
     from app.internal.ai_clients import openai_client
 
@@ -992,7 +1087,7 @@ def _sync_embed(text: str) -> Optional[list[float]]:
 
     try:
         client = openai_client()
-        result = client.embeddings.create(model="text-embedding-3-small", input=text)
+        result = client.embeddings.create(model=settings.embedding_model, input=text)
         return result.data[0].embedding
     except Exception as e:
         logger.warning(f"Embedding generation failed: {e}")

drb-c2-core/app/internal/llm.py

@@ -0,0 +1,96 @@
+"""
+One entry point for the two small JSON-mode LLM jobs: the correlation decision
+on ambiguous scenes and transcript correction.
+
+The provider follows the model name: a `gemini-*` model goes through
+app/internal/gemini.py, anything else is an OpenAI chat model. Since the
+2026-11-08 provider consolidation both defaults are OpenAI (gpt-4o-mini), so
+one funded account (OpenAI) covers extraction, embeddings, summaries and these
+two jobs; Groq stays optional for transcription. Pointing either model setting
+back at a gemini-* ID needs no code change.
+
+Token counts from both providers land in the same usage sink, so a replay run
+(app/internal/replay.py) reports what it spent whichever provider served it.
+"""
+import json
+from contextvars import ContextVar
+from typing import Optional
+
+from app.config import settings
+from app.internal.logger import logger
+
+_usage_sink: ContextVar[Optional[dict]] = ContextVar("drb_llm_usage", default=None)
+
+
+def collect_usage(sink: Optional[dict]):
+    """Route token counts for the current context into `sink` (a replay run). Returns a reset token."""
+    return _usage_sink.set(sink)
+
+
+def reset_usage(token) -> None:
+    _usage_sink.reset(token)
+
+
+def record_usage(purpose: str, model: str, prompt: int, output: int, thinking: int = 0) -> None:
+    logger.info(f"llm usage {purpose} {model}: in={prompt} out={output} thinking={thinking}")
+    sink = _usage_sink.get()
+    if sink is not None:
+        row = sink.setdefault(f"{purpose}:{model}", {"calls": 0, "in": 0, "out": 0, "thinking": 0})
+        row["calls"] += 1
+        row["in"] += prompt
+        row["out"] += output
+        row["thinking"] += thinking
+
+
+def provider_for(model: str) -> str:
+    return "gemini" if (model or "").startswith("gemini") else "openai"
+
+
+def available(model: str) -> bool:
+    """Whether the provider serving `model` has a key configured."""
+    key = settings.gemini_api_key if provider_for(model) == "gemini" else settings.openai_api_key
+    return bool(key)
+
+
+def timeout_seconds(model: str) -> float:
+    if provider_for(model) == "gemini":
+        return settings.gemini_timeout_seconds
+    return (1 + max(0, settings.openai_max_retries)) * settings.openai_timeout_seconds
+
+
+def billing_fix(model: str) -> str:
+    if provider_for(model) == "gemini":
+        return "Top up billing at https://ai.studio/projects"
+    return "Top up billing at https://platform.openai.com/settings/organization/billing"
+
+
+def generate_json(model: str, prompt: str, *, purpose: str,
+                  thinking_level: Optional[str] = "minimal") -> dict:
+    """
+    Synchronous (run it via asyncio.to_thread). Returns the parsed JSON body.
+    Raises on API failure so callers' ai_health classification (billing /
+    dead model / transient) is unchanged. `thinking_level` only applies to
+    Gemini 3.x; OpenAI's gpt-4o family has no such setting.
+    """
+    if provider_for(model) == "gemini":
+        from app.internal import gemini
+        return gemini.generate_json(model, prompt, purpose=purpose, thinking_level=thinking_level)
+
+    from app.internal.ai_clients import openai_client
+    # JSON mode requires the word "JSON" in the prompt; both prompts say
+    # "Return JSON" / "Respond with JSON only".
+    kwargs = {}
+    # Reasoning models (o-series, gpt-5) reject a temperature; chat models get 0.
+    if not model.startswith(("o1", "o3", "o4", "gpt-5")):
+        kwargs["temperature"] = 0
+    resp = openai_client().chat.completions.create(
+        model=model,
+        messages=[{"role": "user", "content": prompt}],
+        response_format={"type": "json_object"},
+        **kwargs,
+    )
+    usage = getattr(resp, "usage", None)
+    record_usage(purpose, model,
+                 getattr(usage, "prompt_tokens", 0) or 0,
+                 getattr(usage, "completion_tokens", 0) or 0)
+    return json.loads(resp.choices[0].message.content or "{}")

drb-c2-core/app/internal/llm_correlator.py

@@ -1,23 +1,23 @@
 """
-LLM-based incident correlator using Gemini.
+LLM incident correlator (settings.corr_cheap_model, via app/internal/llm.py).
 
-Two functions are exposed:
-  decide(call_id, ctx)                           — cheap first-pass (corr_cheap_model)
-  tiebreak(rules_decision, llm_decision, ctx)    — smart tiebreaker (corr_smart_model)
+One function is exposed:
+  decide(call_id, ctx) — called by routers/upload.py ONLY when the rules
+                         engine marked its decision ambiguous
+                         (incident_correlator._ambiguity), at most once per
+                         scene. server-26#299 removed the second "smart"
+                         tiebreak tier and the cheap/smart consensus vote.
 
-Both return a decision dict compatible with _run_decision() in incident_correlator:
+It returns a decision dict compatible with incident_correlator._apply_decision:
   {"action": "link"|"new"|"orphan",
    "matched_incident": dict|None,
    "incident_type": str|None,
    "corr_debug": dict,
-   "reasoning": str}     ← extra field for logging/tiebreak comparison
+   "reasoning": str}
 
-decide() is skipped for thin calls (no content to reason about) and when
-GEMINI_API_KEY is not set — in those cases returns None so the caller knows
-to fall back to the rules decision.
-
-Error handling: any Gemini failure returns None from decide() and the
-rules_decision from tiebreak() so the pipeline never stalls.
+or None — no API key, nothing to choose from, an answer that fails
+validation, or any LLM failure — and the caller then commits the rules
+decision unchanged, so the pipeline never stalls on the LLM.
 """
 import asyncio
 from datetime import datetime, timezone
@@ -155,8 +155,9 @@ call that reports a new event, below.):
   same one — especially once that incident has been open a long time (see
   open:/calls:).
 - Reserve "new" for a call that clearly describes a DIFFERENT event from every
-  recent incident — a different place, different units, and a different subject,
-  not merely a different transmission about the same job.
+  recent incident — a different place or subject, not merely a different
+  transmission about the same job. Shared units alone do not make it the same
+  event (see EXCEPT above).
 - "orphan" a call that is not an incident at all: radio checks, roll call,
   a unit marking on/off duty or 10-8/10-98, mileage/log entries, a bare
   acknowledgement. Do not open a "new" incident for these.
@@ -166,103 +167,75 @@ call that reports a new event, below.):
 """
 
 
-def _build_decide_prompt(ctx: dict) -> str:
-    now    = ctx["now"]
-    recent = ctx["recent"]
-    inc_block = (
-        "\n".join(_inc_summary(inc, now) for inc in _prompt_incidents(recent))
-        if recent else "(none)"
-    )
+def _build_decide_prompt(ctx: dict, candidates: list[dict]) -> str:
+    now = ctx["now"]
+    inc_block = "\n".join(_inc_summary(inc, now) for inc in _prompt_incidents(candidates))
     return (
         "You are an incident correlator for a public safety radio monitoring system.\n\n"
         "A new radio call has arrived. Decide whether it belongs to an existing active incident, "
-        "represents a new incident, or should be orphaned (not enough information).\n\n"
+        "represents a new incident, or should be orphaned (not an incident at all).\n\n"
         f"NEW CALL:\n{_call_block(ctx)}\n\n"
-        f"ACTIVE INCIDENTS ({len(recent)} recent):\n{inc_block}\n"
-        f"{_RULES}\n"
-        f"Respond with JSON only (no markdown):\n{_SCHEMA}"
-    )
-
-
-def _build_tiebreak_prompt(rules_decision: dict, llm_decision: dict, ctx: dict) -> str:
-    now    = ctx["now"]
-    recent = ctx["recent"]
-    inc_block = (
-        "\n".join(_inc_summary(inc, now) for inc in _prompt_incidents(recent))
-        if recent else "(none)"
-    )
-
-    def _fmt(d: dict, name: str) -> str:
-        action  = d.get("action", "?")
-        inc     = d.get("matched_incident")
-        inc_id  = inc["incident_id"] if inc else (d.get("incident_id") or "null")
-        reason  = d.get("reasoning") or (d.get("corr_debug") or {}).get("corr_fit_signal") or "—"
-        return f"  {name}: action={action}, incident_id={inc_id}, reasoning={reason!r}"
-
-    return (
-        "You are a senior incident correlator for a public safety radio monitoring system.\n\n"
-        "Two correlation engines disagree. You must make the final decision.\n\n"
-        f"NEW CALL:\n{_call_block(ctx)}\n\n"
-        f"ACTIVE INCIDENTS ({len(recent)} recent):\n{inc_block}\n\n"
-        "DISAGREEMENT:\n"
-        f"{_fmt(rules_decision, 'Rules engine')}\n"
-        f"{_fmt(llm_decision, 'LLM correlator')}\n"
+        f"ACTIVE INCIDENTS ({len(candidates)} recent):\n{inc_block}\n"
         f"{_RULES}\n"
         f"Respond with JSON only (no markdown):\n{_SCHEMA}"
     )
 
 
 # ─────────────────────────────────────────────────────────────────────────────
-# Gemini API call (sync, runs in thread pool)
+# LLM call (sync, runs in thread pool)
 # ─────────────────────────────────────────────────────────────────────────────
 
 def _sync_gemini(model_name: str, prompt: str) -> dict:
-    from app.internal import gemini
-    return gemini.generate_json(model_name, prompt, purpose="correlation")
+    from app.internal import llm
+    return llm.generate_json(model_name, prompt, purpose="correlation")
 
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Decision parsing
 # ─────────────────────────────────────────────────────────────────────────────
 
-def _parse_response(raw: dict, ctx: dict) -> dict:
+def _parse_response(raw: dict, ctx: dict, candidates: list[dict]) -> Optional[dict]:
     """
-    Convert raw Gemini JSON output to a decision dict compatible with _run_decision().
-    Resolves incident_id → full incident doc from ctx["all_active"].
-    Handles type inference for "new" actions the same way as the rules engine.
-    """
-    from app.internal.incident_correlator import _infer_type_from_tags  # same-package import
+    Convert the model's raw JSON to a decision dict, or None when the answer is
+    unusable and the rules decision should stand.
 
-    action    = raw.get("action", "orphan")
+    A "link" must name one of the candidates the model was shown — not any
+    active incident: the shown list is the one with the #189 weak-link cap
+    applied — and pass the distance guard (incident_correlator.
+    llm_link_allowed). A "new" takes its type from the same creation gate the
+    rules use, so it is refused (orphan) exactly when the rules would refuse
+    it. An unknown action is unusable, not an orphan: the old "default to
+    orphan" silently dropped calls on a malformed reply.
+    """
+    from app.internal.incident_correlator import llm_link_allowed, resolve_new_incident_type
+
+    action    = raw.get("action")
     reasoning = raw.get("reasoning", "")
-
     if action not in ("link", "new", "orphan"):
-        action = "orphan"
+        logger.warning(f"LLM correlator: unusable action {action!r} — keeping the rules decision")
+        return None
 
     matched_incident: Optional[dict] = None
-
+    incident_type: Optional[str] = None
     if action == "link":
         inc_id = raw.get("incident_id")
-        if inc_id:
-            matched_incident = next(
-                (i for i in ctx["all_active"] if i.get("incident_id") == inc_id),
-                None,
-            )
+        matched_incident = next((i for i in candidates if i.get("incident_id") == inc_id), None)
         if not matched_incident:
             logger.warning(
-                f"LLM correlator: incident_id={inc_id!r} not in active incidents — orphaning"
+                f"LLM correlator: incident_id={inc_id!r} is not a shown candidate — keeping the rules decision"
             )
-            action = "orphan"
-
-    incident_type: Optional[str] = None
-    if action in ("link", "new"):
+            return None
+        if not llm_link_allowed(matched_incident, ctx):
+            logger.info(
+                f"LLM correlator: link to {inc_id} refused — call is geocoded beyond "
+                f"incident_max_spread_km of its pin (server-26#189)"
+            )
+            return None
         incident_type = ctx["incident_type"]
+    elif action == "new":
+        incident_type = resolve_new_incident_type(ctx)
         if not incident_type:
-            incident_type = _infer_type_from_tags(ctx["tags"])
-        if action == "new" and not incident_type:
-            # Can't create an incident without a type — demote to orphan
             action = "orphan"
-            matched_incident = None
 
     return {
         "action":            action,
@@ -279,54 +252,35 @@ def _parse_response(raw: dict, ctx: dict) -> dict:
 
 async def decide(call_id: str, ctx: dict) -> Optional[dict]:
     """
-    Run the cheap LLM correlator (corr_cheap_model) on the call.
-
-    Returns a decision dict or None if:
-      - GEMINI_API_KEY is not configured
-      - the call is thin (content-free — no value from LLM)
-      - there are no recent active incidents to reason about
-      - Gemini fails
-
-    Callers should treat None as "fall back to rules decision".
+    One cheap-model correlation decision for an ambiguous scene. Returns None
+    (keep the rules decision) when the model's provider has no API key, there
+    is no candidate to show, the answer fails validation, or the call fails.
     """
-    if not settings.gemini_api_key:
+    from app.internal.incident_correlator import llm_candidates
+
+    from app.internal import llm
+    if not llm.available(settings.corr_cheap_model):
         return None
-
-    if ctx["is_thin_call"]:
-        return None  # thin calls have no transcript/units/coords to reason about
-
-    if _is_clearance_only(ctx):
-        # "45-9, I'm clear." carries one fact: which unit is done. Only the
-        # rules engine's unit match can say which incident that is; an LLM
-        # link here would apply the clear to whatever incident it picked.
+    candidates = llm_candidates(ctx)
+    if not candidates:
         return None
 
-    if not ctx["recent"]:
-        return None  # no incidents to correlate against — rules handles new-only
-
     try:
-        prompt   = _build_decide_prompt(ctx)
+        prompt   = _build_decide_prompt(ctx, candidates)
         raw      = await asyncio.to_thread(_sync_gemini, settings.corr_cheap_model, prompt)
-        decision = _parse_response(raw, ctx)
+    except Exception as e:
+        await _log_llm_failure("LLM correlator", "correlation_cheap", call_id, settings.corr_cheap_model, e)
+        return None
+    await ai_health.report_healthy("correlation_cheap")
+    decision = _parse_response(raw if isinstance(raw, dict) else {}, ctx, candidates)
+    if decision:
         _id = (decision["matched_incident"] or {}).get("incident_id", "null")
         logger.info(
             f"LLM correlator ({settings.corr_cheap_model}): call {call_id} → "
             f"action={decision['action']} incident={_id} "
             f"reasoning={decision['reasoning']!r}"
         )
-        await ai_health.report_healthy("correlation_cheap")
-        return decision
-    except Exception as e:
-        await _log_llm_failure("LLM correlator", "correlation_cheap", call_id, settings.corr_cheap_model, e)
-        return None
-
-
-def _is_clearance_only(ctx: dict) -> bool:
-    units = ctx.get("call_units") or []
-    cleared = ctx.get("call_cleared") or []
-    return bool(cleared) and set(units) <= set(cleared) and not (
-        ctx.get("tags") or ctx.get("location") or ctx.get("call_vehicles") or ctx.get("incident_type")
-    )
+    return decision
 
 
 _dead_models: set[str] = set()
@@ -350,7 +304,7 @@ async def _log_llm_failure(where: str, tier: str, call_id: str, model: str, exc:
 
     if kind == "dead_model":
         await _log_tier_down(where, tier, model, "model is unavailable",
-                             "Update CORR_CHEAP_MODEL/CORR_SMART_MODEL in config.py", text)
+                             "Update CORR_CHEAP_MODEL in config.py", text)
         return
 
     # A depleted balance reads as 429, the same status as an ordinary rate limit,
@@ -358,20 +312,23 @@ async def _log_llm_failure(where: str, tier: str, call_id: str, model: str, exc:
     # dead account never does. ai_health.classify() keeps a burst of rate limits
     # at WARNING while an empty account escalates like a bad model ID.
     if kind == "billing":
-        await _log_tier_down(where, tier, model, "the Gemini account is out of credit",
-                             "Top up billing at https://ai.studio/projects", text)
+        from app.internal import llm
+        await _log_tier_down(where, tier, model, f"the {llm.provider_for(model)} account is out of credit",
+                             llm.billing_fix(model), text)
         return
 
     logger.warning(f"{where} failed for call {call_id}: {text}")
+    from app.internal import llm
     await ai_health.report_degraded(
-        tier, "gemini", model, "transient API error",
+        tier, llm.provider_for(model), model, "transient API error",
         "no action needed unless this persists", permanent=False,
     )
 
 
 async def _log_tier_down(where: str, tier: str, model: str, problem: str, fix: str, text: str) -> None:
     """ERROR once per model, not once per call — this runs at radio-traffic volume."""
-    await ai_health.report_degraded(tier, "gemini", model, problem, fix, permanent=True)
+    from app.internal import llm
+    await ai_health.report_degraded(tier, llm.provider_for(model), model, problem, fix, permanent=True)
     if model in _dead_models:
         return
     _dead_models.add(model)
@@ -379,37 +336,3 @@ async def _log_tier_down(where: str, tier: str, model: str, problem: str, fix: s
         f"{where}: {problem} ({model!r}) -- the LLM correlation tier is DISABLED "
         f"and every call is falling back to rules-only. {fix}. API said: {text}"
     )
-
-
-async def tiebreak(rules_decision: dict, llm_decision: dict, ctx: dict) -> dict:
-    """
-    Run the smart tiebreaker (corr_smart_model) when rules and LLM disagree.
-    Falls back to rules_decision on any error.
-    """
-    call_id = ctx["call_id"]
-    try:
-        prompt   = _build_tiebreak_prompt(rules_decision, llm_decision, ctx)
-        raw      = await asyncio.to_thread(_sync_gemini, settings.corr_smart_model, prompt)
-        decision = _parse_response(raw, ctx)
-        _id = (decision["matched_incident"] or {}).get("incident_id", "null")
-        logger.info(
-            f"LLM tiebreak ({settings.corr_smart_model}): call {call_id} → "
-            f"action={decision['action']} incident={_id} "
-            f"reasoning={decision['reasoning']!r}"
-        )
-        await ai_health.report_healthy("correlation_smart")
-        return decision
-    except Exception as e:
-        await _log_llm_failure("LLM tiebreak", "correlation_smart", call_id, settings.corr_smart_model, e)
-        return rules_decision
-
-
-def decisions_agree(rules: dict, llm: dict) -> bool:
-    """True if both decisions agree on action and (when action=="link") on the target incident."""
-    if rules["action"] != llm["action"]:
-        return False
-    if rules["action"] == "link":
-        r_id = (rules.get("matched_incident") or {}).get("incident_id")
-        l_id = (llm.get("matched_incident")   or {}).get("incident_id")
-        return r_id == l_id
-    return True

drb-c2-core/app/internal/mqtt_handler.py

@@ -128,6 +128,8 @@ class MQTTHandler:
                 "sdr_devices": payload.get("sdr_devices"),
                 "op25_sdr_serial": payload.get("op25_sdr_serial"),
                 "sdr_count": payload.get("sdr_count"),  # None until reported, never a guessed 1
+                "disk_free_bytes": payload.get("disk_free_bytes"),
+                "disk_total_bytes": payload.get("disk_total_bytes"),
                 "enforce_override_timeout": payload.get("enforce_override_timeout", True),
                 "is_overridden": False,
                 "override_system_id": None,
@@ -161,8 +163,11 @@ class MQTTHandler:
             # radio_channels (node-26#24): a conventional node's channels and
             # whether each is encrypted — the one decode failure the owner has
             # to hear about from C2, since nothing on the node can fix it.
+            # disk_* (node-26#41): free/total bytes of the host disk the node
+            # records to — a full disk silently stopped node-002 for 17 days.
             for key in ("secondary_sdr_mode", "secondary_sdr_priority", "secondary_sdr_running",
-                        "sdr_pins", "sdr_devices", "op25_sdr_serial", "radio_channels"):
+                        "sdr_pins", "sdr_devices", "op25_sdr_serial", "radio_channels",
+                        "disk_free_bytes", "disk_total_bytes"):
                 if key in payload:
                     updates[key] = payload[key]
             if "sdr_count" in payload:

drb-c2-core/app/internal/outages/__init__.py

@@ -0,0 +1,8 @@
+"""Pluggable power-outage providers (map layer, server-26#184).
+
+Same shape as ``app.internal.cameras``: every source is one adapter carrying
+its catalogued licence status, every provider defaults OFF, and a licence-gated
+one serves only after an admin acknowledgement recorded in audit_log
+(``registry``). Scraped utility storm-center JSON is never shipped -- those
+sources are stubs until a data-sharing agreement exists.
+"""

drb-c2-core/app/internal/outages/base.py

@@ -0,0 +1,201 @@
+"""Outage provider interface, normalised record and the per-provider feed cache.
+
+The licence model (``Licence``, ``LicenceInfo``, the GATED set) is the camera
+layer's, imported -- one catalogue vocabulary for every licence-gated source.
+Only the acknowledgement wording differs (outage data, not imagery), so
+``OutageLicenceInfo`` overrides ``warning()`` and nothing else.
+
+Outage feeds are public and identical for every org, so -- like the camera
+catalogs -- they are cached in memory, fetched lazily on request, and never
+written to Firestore. A failed refresh keeps serving the last good feed and
+reports the error and its age: a dead feed must show as an error, never as an
+empty layer (the AI-silent-failures lesson).
+"""
+import asyncio
+import time
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional, Tuple
+
+from app.internal.cameras.base import (   # noqa: F401  (re-exported for adapters)
+    BBox, Licence, LicenceInfo, bbox_intersects, finite, get_json, require_parsed, safe_error,
+)
+from app.internal.logger import logger
+
+RETRY_AFTER_FAILURE_S = 60
+DEFAULT_FEED_TTL_S = 5 * 60   # ODIN asks utilities for updates every 5-15 min
+USER_AGENT = "DRB-c2-core/1.0 (+public power-outage data; contact via odin.ornl.gov)"
+
+OutageArea = Dict[str, Any]
+
+
+@dataclass(frozen=True)
+class OutageLicenceInfo(LicenceInfo):
+    """``LicenceInfo`` with the acknowledgement worded for outage data."""
+
+    def warning(self) -> Optional[str]:
+        if self.status == Licence.PROHIBITED:
+            return f"{self.label}. This source's terms forbid this use; it cannot be enabled."
+        if not self.gated:
+            return None
+        return (f"{self.label}. {self.terms} Enabling it means DRB shows this source's outage data "
+                f"to every signed-in user. Only confirm if DRB actually holds the right to do so.")
+
+
+@dataclass(frozen=True)
+class OutageProviderMeta:
+    id: str
+    name: str
+    region: str
+    coverage: BBox                      # rough bbox; a query outside it never triggers a fetch
+    licence: LicenceInfo
+    granularity: str                    # "county", "point/polygon", ...
+    implemented: bool
+    notes: str                          # what is verified vs unverified about this adapter
+    homepage: Optional[str] = None
+    ttl_s: int = DEFAULT_FEED_TTL_S
+
+
+class OutageProvider:
+    """Base adapter. Subclasses set ``meta`` and implement ``fetch``."""
+    meta: OutageProviderMeta
+
+    async def fetch(self) -> List[OutageArea]:
+        raise NotImplementedError(f"{self.meta.id}: adapter is a stub ({self.meta.notes})")
+
+    def coverage_note(self) -> Optional[str]:
+        """What this source can and cannot see, shown next to its data."""
+        return None
+
+
+class StubProvider(OutageProvider):
+    """A catalogued source with no adapter -- listed so Admin shows its licence
+    status, but it can never be enabled."""
+
+    def __init__(self, meta: OutageProviderMeta):
+        assert not meta.implemented
+        self.meta = meta
+
+
+class Feed:
+    """In-memory cache of one provider's normalised outage areas."""
+
+    def __init__(self, provider: OutageProvider):
+        self.provider = provider
+        self.items: List[OutageArea] = []
+        self.fetched_at: Optional[float] = None       # epoch s of last SUCCESSFUL fetch
+        self.last_attempt_at: Optional[float] = None
+        self.error: Optional[str] = None
+        self._next_attempt = 0.0
+        self._lock = asyncio.Lock()
+
+    async def get(self) -> "Feed":
+        if time.time() < self._next_attempt:
+            return self
+        async with self._lock:
+            if time.time() < self._next_attempt:
+                return self
+            ttl = self.provider.meta.ttl_s
+            self.last_attempt_at = time.time()
+            try:
+                items = await self.provider.fetch()
+                self.items = items
+                self.fetched_at = time.time()
+                self.error = None
+                self._next_attempt = time.time() + ttl
+            except Exception as e:
+                self._next_attempt = time.time() + min(ttl, RETRY_AFTER_FAILURE_S)
+                self.error = safe_error(e)
+                logger.warning(f"outages/{self.provider.meta.id}: refresh failed, serving {len(self.items)} cached: {self.error}")
+        return self
+
+    def status(self) -> dict:
+        return {"fetched_at": self.fetched_at, "last_attempt_at": self.last_attempt_at,
+                "error": self.error, "count": len(self.items)}
+
+
+# ── helpers shared by adapters ───────────────────────────────────────────────
+
+def make_area(provider_id: str, fips: str, *, county: Optional[str], state: Optional[str], customers_out: int,
+              customers_served: Optional[int] = None, etr: Optional[str] = None, since: Optional[str] = None,
+              updated_at: Optional[str] = None, lat: Optional[float] = None, lon: Optional[float] = None,
+              bbox: Optional[BBox] = None, utilities: Optional[List[dict]] = None,
+              stale_customers_out: int = 0) -> OutageArea:
+    """One normalised county outage record. ``id`` is provider-prefixed.
+
+    ``customers_out`` counts only live events. ``stale_customers_out`` counts
+    events the source still lists whose own restoration estimate passed long
+    ago (ODIN carries April rows in October) -- kept visible, never summed in.
+    ``stale`` is True when every event in the county is stale."""
+    return {
+        "id": f"{provider_id}:{fips}",
+        "provider": provider_id,
+        "fips": fips, "county": county, "state": state,
+        "customers_out": customers_out,
+        "stale_customers_out": stale_customers_out,
+        "stale": customers_out == 0 and stale_customers_out > 0,
+        "customers_served": customers_served,
+        "etr": etr,                 # latest estimated restoration across the county's outages, if any
+        "since": since,             # earliest reported start across the county's outages
+        "updated_at": updated_at,   # newest time a reporting utility in this county last sent data
+        # Approximate: the centre of the county's bounding box, for placing a label.
+        "lat": lat, "lon": lon,
+        "bbox": list(bbox) if bbox else None,   # south, west, north, east
+        "utilities": utilities or [],
+    }
+
+
+def area_in_bbox(area: OutageArea, bbox: BBox) -> bool:
+    """County bbox intersects the query; falls back to the label point."""
+    b = area.get("bbox")
+    if b and len(b) == 4:
+        return bbox_intersects((b[0], b[1], b[2], b[3]), bbox)
+    lat, lon = area.get("lat"), area.get("lon")
+    if lat is None or lon is None:
+        return False
+    s, w, n, e = bbox
+    return s <= lat <= n and w <= lon <= e
+
+
+def parse_iso(v: Any) -> Optional[datetime]:
+    """ISO-8601 (with Z or offset) -> aware UTC datetime; None when unparseable."""
+    if not isinstance(v, str) or not v:
+        return None
+    try:
+        d = datetime.fromisoformat(v.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return (d if d.tzinfo else d.replace(tzinfo=timezone.utc)).astimezone(timezone.utc)
+
+
+def iso(d: Optional[datetime]) -> Optional[str]:
+    return d.isoformat().replace("+00:00", "Z") if d else None
+
+
+def geometry_bbox(geom: Any) -> Optional[BBox]:
+    """Bounding box (south, west, north, east) of a GeoJSON Polygon/MultiPolygon."""
+    if not isinstance(geom, dict):
+        return None
+    lats: List[float] = []
+    lons: List[float] = []
+
+    def walk(c: Any) -> None:
+        if isinstance(c, list) and len(c) >= 2 and not isinstance(c[0], list):
+            lon, lat = finite(c[0]), finite(c[1])
+            if lon is not None and lat is not None and -180 <= lon <= 180 and -90 <= lat <= 90:
+                lons.append(lon)
+                lats.append(lat)
+        elif isinstance(c, list):
+            for x in c:
+                walk(x)
+
+    walk(geom.get("coordinates"))
+    if not lats:
+        return None
+    return (min(lats), min(lons), max(lats), max(lons))
+
+
+def bbox_centre(b: Optional[BBox]) -> Tuple[Optional[float], Optional[float]]:
+    if not b:
+        return None, None
+    return (round((b[0] + b[2]) / 2, 5), round((b[1] + b[3]) / 2, 5))

drb-c2-core/app/internal/outages/providers.py

@@ -0,0 +1,273 @@
+"""Outage sources -- server-26#184 (source-terms table in its 2026-10-05 comment).
+
+Only ODIN has an adapter. Every other source is listed so Admin shows its
+licence status, and is a stub because DRB holds no right to use it: the utility
+storm-center maps are undocumented JSON with no reuse licence (the panel ruling
+stands -- do not ship scraped utility data commercially), PowerOutage.us
+licenses its API for personal/non-commercial use only, and EAGLE-I's live feed
+is a DOE partner system. Do not "fix" a stub by scraping.
+
+ODIN, verified first-hand 2026-10-05 against https://odin.ornl.gov/v3/api-docs
+(the OpenAPI document the ODIN developer guide points at) and live responses:
+
+  GET /odi?format=JSON     public, no token. ``{"outage": [CIM Outage, ...]}``,
+                           one row per outage event, every row aggregated to a
+                           county: ``communityDescriptor`` = 5-digit county FIPS,
+                           ``metersAffected``, ``reportedStartTime``,
+                           ``estimatedRestorationTime.ert``, ``names`` carrying
+                           ``UtilityName`` / ``UtilityId`` (EIA id).
+  GET /odi/map?scale=COUNTY  public. One row per county with active outages:
+                           ``id`` (FIPS), ``countyName``, ``stateName``,
+                           ``metersOut`` (= sum of /odi metersAffected, checked),
+                           ``feature`` (county Polygon/MultiPolygon).
+  GET /odi/status          public. One row per reporting utility: ``eiaId``,
+                           ``name``, ``receivedDate``, ``hasError``.
+
+``metersServed`` on /odi/map is the utility's system-wide total (National Grid
+NY carries 1,686,884 on every county), so it is NOT a county denominator and
+``customers_served`` stays None.
+"""
+import asyncio
+import re
+from datetime import datetime, timedelta, timezone
+from typing import Dict, List, Optional, Tuple
+
+from app.internal.outages.base import (
+    Licence, OutageArea, OutageLicenceInfo, OutageProvider, OutageProviderMeta, StubProvider, USER_AGENT,
+    bbox_centre, finite, geometry_bbox, get_json, iso, make_area, parse_iso, require_parsed,
+)
+
+US_BBOX = (17.5, -180.0, 72.0, -64.0)   # CONUS + AK + HI + PR, rough
+NY_BBOX = (40.4, -80.0, 45.1, -71.7)
+
+ODIN_BASE = "https://odin.ornl.gov"
+ODIN_OPENAPI = "https://odin.ornl.gov/v3/api-docs"
+_FIPS = re.compile(r"^\d{5}$")
+# An event whose own estimated restoration passed this long ago is stale: ODIN
+# still listed Avangrid rows from April 2026 (ETR April/May) on 2026-10-05.
+# Those are not live outages and must not be summed into one or set "since".
+STALE_AFTER_ETR = timedelta(hours=24)
+
+
+class OdinProvider(OutageProvider):
+    meta = OutageProviderMeta(
+        id="odin",
+        name="ODIN (Oak Ridge National Laboratory / DOE)",
+        region="United States -- participating utilities only (NY: National Grid, Central Hudson, Avangrid reporting 2026-10-05)",
+        coverage=US_BBOX,
+        licence=OutageLicenceInfo(
+            status=Licence.UNVERIFIED,
+            label="Licence unverified -- public county-level API, but no terms of use or reuse licence found",
+            terms=("ODIN documents GET /odi, /odi/map and /odi/status as public, non-authenticated endpoints "
+                   "returning current outages aggregated to county FIPS (OpenAPI read first-hand 2026-10-05). "
+                   "That document carries no licence or terms-of-service field, and no terms-of-use page was "
+                   "found on odin.ornl.gov. ORNL is operated for DOE by a contractor and the data is "
+                   "utility-reported, so federal public-domain status cannot be assumed. Confirm reuse terms "
+                   "with ODIN (odin.ornl.gov/pages/contact.html) before relying on it commercially."),
+            terms_url=ODIN_OPENAPI,
+            attribution="Outage data: ODIN, Oak Ridge National Laboratory (utility-reported)",
+            attribution_url="https://odin.ornl.gov",
+            disclaimer=("County-level counts of meters reported out by utilities that participate in ODIN. "
+                        "A utility that does not report to ODIN shows no outages here, even during one. "
+                        "Restoration times are the utility's estimate, when given."),
+            issue="server-26#184",
+        ),
+        granularity="county (FIPS)",
+        implemented=True,
+        notes=("Public API, verified first-hand 2026-10-05: /odi?format=JSON (counts, start, ETR, utility EIA id), "
+               "/odi/map?scale=COUNTY (county name, state, county polygon -> bbox and label point) and /odi/status "
+               "(utility last-received time). Counts are meters, used as customers. Con Edison / O&R are on ODIN's "
+               "participant list but were NOT reporting on 2026-10-05, so NYC/Westchester show nothing from ODIN "
+               "until they do. Schema canary: rows upstream but none parseable is an error, never an empty layer."),
+        homepage="https://odin.ornl.gov",
+    )
+
+    def __init__(self) -> None:
+        self.reporting_utilities: Optional[int] = None
+        self.utilities_with_error: Optional[int] = None
+
+    async def fetch(self) -> List[OutageArea]:
+        h = {"User-Agent": USER_AGENT}
+        odi, county_map, status = await asyncio.gather(
+            get_json(f"{ODIN_BASE}/odi", params={"format": "JSON"}, headers=h),
+            get_json(f"{ODIN_BASE}/odi/map", params={"scale": "COUNTY"}, headers=h),
+            get_json(f"{ODIN_BASE}/odi/status", headers=h),
+        )
+        areas, info = parse_odin(odi, county_map, status)
+        self.reporting_utilities = info["reporting_utilities"]
+        self.utilities_with_error = info["utilities_with_error"]
+        return areas
+
+    def coverage_note(self) -> Optional[str]:
+        n = self.reporting_utilities
+        base = "Only utilities that report to ODIN appear; one outside ODIN shows no outages here even during one."
+        if n is None:
+            return base
+        err = f", {self.utilities_with_error} with a feed error" if self.utilities_with_error else ""
+        return f"{base} {n} utilities reporting nationwide{err}."
+
+
+def _utility(names: object) -> Tuple[Optional[str], Optional[str]]:
+    name = eia = None
+    for n in names if isinstance(names, list) else []:
+        if not isinstance(n, dict):
+            continue
+        if n.get("nameType") == "UtilityName" and isinstance(n.get("name"), str):
+            name = n["name"]
+        elif n.get("nameType") == "UtilityId" and n.get("name") is not None:
+            eia = str(n["name"])
+    return name, eia
+
+
+def parse_odin(odi: object, county_map: object, status: object,
+               now: Optional[datetime] = None) -> Tuple[List[OutageArea], dict]:
+    """The three public ODIN responses -> one normalised record per county.
+
+    Events whose estimated restoration is more than ``STALE_AFTER_ETR`` before
+    ``now`` are counted separately (``stale_customers_out``), not as live.
+
+    Raises ValueError when a payload has the wrong top-level shape or when rows
+    came back but none could be read -- an upstream schema change must surface
+    as a feed error, not as an empty map."""
+    if not isinstance(odi, dict) or not isinstance(odi.get("outage"), list):
+        raise ValueError("ODIN /odi: expected {'outage': [...]} -- upstream schema change?")
+    if not isinstance(county_map, list):
+        raise ValueError("ODIN /odi/map: expected a list -- upstream schema change?")
+    if not isinstance(status, list):
+        raise ValueError("ODIN /odi/status: expected a list -- upstream schema change?")
+
+    # Utility freshness, by EIA id.
+    received: Dict[str, str] = {}
+    errors = 0
+    for u in status:
+        if not isinstance(u, dict):
+            continue
+        errors += 1 if u.get("hasError") is True else 0
+        eia, d = u.get("eiaId"), parse_iso(u.get("receivedDate"))
+        if eia is not None and d is not None:
+            received[str(eia)] = iso(d)
+    require_parsed(len(status), list(received), "ODIN /odi/status")
+
+    # County geography.
+    geo: Dict[str, dict] = {}
+    for row in county_map:
+        if not isinstance(row, dict):
+            continue
+        fips = str(row.get("id") or "")
+        if not _FIPS.match(fips):
+            continue
+        b = geometry_bbox(row.get("feature"))
+        geo[fips] = {"county": row.get("countyName") if isinstance(row.get("countyName"), str) else None,
+                     "state": row.get("stateName") if isinstance(row.get("stateName"), str) else None,
+                     "bbox": b}
+    require_parsed(len(county_map), list(geo), "ODIN /odi/map county")
+
+    # Outage events, aggregated per county.
+    stale_before = (now or datetime.now(timezone.utc)) - STALE_AFTER_ETR
+    agg: Dict[str, dict] = {}
+    parsed = stale_events = 0
+    for o in odi["outage"]:
+        if not isinstance(o, dict):
+            continue
+        fips = str(o.get("communityDescriptor") or "")
+        meters = finite(o.get("metersAffected"))
+        if not _FIPS.match(fips) or meters is None or meters < 0:
+            continue
+        parsed += 1
+        area = o.get("outageArea") if isinstance(o.get("outageArea"), dict) else {}
+        start = parse_iso(o.get("reportedStartTime")) or parse_iso(area.get("earliestReportedTime"))
+        ert_obj = o.get("estimatedRestorationTime") if isinstance(o.get("estimatedRestorationTime"), dict) else {}
+        ert = parse_iso(ert_obj.get("ert"))
+        if ert is not None and ert.year < 2000:   # Puget Sound Energy sends 0001-01-01T00:00:00Z for "no ETR"
+            ert = None
+        stale = ert is not None and ert < stale_before
+        stale_events += stale
+        a = agg.setdefault(fips, {"out": 0, "stale_out": 0, "utilities": {},
+                                  "live": {"since": None, "etr": None}, "stale": {"since": None, "etr": None}})
+        a["stale_out" if stale else "out"] += int(meters)
+        t = a["stale" if stale else "live"]   # since/etr come from live events whenever there are any
+        if start and (t["since"] is None or start < t["since"]):
+            t["since"] = start
+        if ert and (t["etr"] is None or ert > t["etr"]):
+            t["etr"] = ert
+        name, eia = _utility(o.get("names"))
+        key = eia or name or "unknown"
+        u = a["utilities"].setdefault(key, {"name": name, "eia_id": eia, "customers_out": 0,
+                                             "stale_customers_out": 0})
+        u["stale_customers_out" if stale else "customers_out"] += int(meters)
+    require_parsed(len(odi["outage"]), [None] * parsed, "ODIN /odi outage")
+
+    areas: List[OutageArea] = []
+    for fips, a in agg.items():
+        g = geo.get(fips, {})
+        utilities = sorted(a["utilities"].values(), key=lambda u: (-u["customers_out"], -u["stale_customers_out"]))
+        stamps = [received[u["eia_id"]] for u in utilities if u["eia_id"] in received]
+        lat, lon = bbox_centre(g.get("bbox"))
+        t = a["live"] if a["out"] else a["stale"]
+        areas.append(make_area(
+            "odin", fips, county=g.get("county"), state=g.get("state"), customers_out=a["out"],
+            stale_customers_out=a["stale_out"], customers_served=None, etr=iso(t["etr"]), since=iso(t["since"]),
+            updated_at=max(stamps) if stamps else None, lat=lat, lon=lon, bbox=g.get("bbox"),
+            utilities=utilities,
+        ))
+    areas.sort(key=lambda r: (-r["customers_out"], -r["stale_customers_out"]))
+    return areas, {"reporting_utilities": len(status), "utilities_with_error": errors, "stale_events": stale_events}
+
+
+# ── stubs: catalogued, never enable-able ─────────────────────────────────────
+
+_STORM_CENTER_TERMS = ("The utility's public outage map is backed by undocumented JSON (vendor storm-center "
+                       "endpoints) with no published licence for automated reuse; the endpoints can change "
+                       "without notice. Panel ruling (server-26#184): do not ship scraped utility data "
+                       "commercially. A direct data-sharing agreement is the licensed path (also a sales lead).")
+
+
+def _stub(id: str, name: str, region: str, coverage, status: Licence, label: str, terms: str,
+          terms_url: Optional[str], granularity: str, notes: str, homepage: Optional[str]) -> StubProvider:
+    return StubProvider(OutageProviderMeta(
+        id=id, name=name, region=region, coverage=coverage,
+        licence=OutageLicenceInfo(status=status, label=label, terms=terms, terms_url=terms_url,
+                                  issue="server-26#184"),
+        granularity=granularity, implemented=False, notes=notes, homepage=homepage,
+    ))
+
+
+PROVIDERS: List[OutageProvider] = [
+    OdinProvider(),
+    _stub("poweroutage_us", "PowerOutage.us (FE Bluefire LLC)", "United States", US_BBOX, Licence.PAID,
+          "Paid API -- licence is personal/non-commercial (news media excepted); commercial use needs an agreement DRB does not hold",
+          ("API & Content Terms: the licence is for \"personal and noncommercial use (except for News Media "
+           "Organizations)\"; commercial use needs a separate agreement; pricing by contact. Quoted from a "
+           "search summary -- the terms page returned 403 to a direct fetch, so re-read it first-hand before "
+           "any acknowledgement."),
+          "https://poweroutage.us/legal/apitermsofuse", "county / utility",
+          "No adapter: needs a commercial contract and its API documentation.", "https://poweroutage.us"),
+    _stub("coned_oru_stormcenter", "Con Edison / Orange & Rockland outage map", "NYC, Westchester, Orange & Rockland",
+          NY_BBOX, Licence.AGREEMENT_REQUIRED,
+          "Requires a data-sharing agreement -- undocumented storm-center JSON, no reuse licence",
+          _STORM_CENTER_TERMS, "https://www.coned.com/en/services-and-outages/outage-map-faq", "point / polygon + ETR",
+          ("No adapter by design. Con Edison and O&R are on ODIN's participant list but were not reporting to "
+           "ODIN on 2026-10-05; if they start, the ODIN adapter covers them at county level."),
+          "https://outagemap.coned.com"),
+    _stub("nyseg_rge_stormcenter", "NYSEG / RG&E outage map (Avangrid)", "Upstate NY", NY_BBOX,
+          Licence.AGREEMENT_REQUIRED,
+          "Requires a data-sharing agreement -- undocumented storm-center JSON, no reuse licence",
+          _STORM_CENTER_TERMS, None, "point / polygon + ETR",
+          ("No adapter by design. Avangrid (NYSEG/RG&E) reports to ODIN, so county-level data arrives through "
+           "the ODIN adapter."),
+          "https://www.nyseg.com"),
+    _stub("central_hudson_stormcenter", "Central Hudson outage map", "Hudson Valley, NY", NY_BBOX,
+          Licence.AGREEMENT_REQUIRED,
+          "Requires a data-sharing agreement -- undocumented storm-center JSON, no reuse licence",
+          _STORM_CENTER_TERMS, None, "point / polygon + ETR",
+          ("No adapter by design. Central Hudson reports to ODIN, so county-level data arrives through the "
+           "ODIN adapter."),
+          "https://www.cenhud.com"),
+    _stub("eagle_i_live", "EAGLE-I live feed (ORNL / DOE)", "United States", US_BBOX, Licence.AGREEMENT_REQUIRED,
+          "Live feed is a DOE / government-partner system -- DRB has no access agreement",
+          ("EAGLE-I's live 15-minute county outage feed is restricted to DOE and government partners. The public "
+           "ORNL Constellation dataset is historic only (no terms stated on the dataset) and is no use for a "
+           "live map."),
+          "https://doi.ccs.ornl.gov/dataset/d26451af-7ea4-577c-8285-78b72cd8a2dc", "county",
+          "No adapter: needs a DOE partner agreement.", "https://eagle-i.doe.gov"),
+]

drb-c2-core/app/internal/outages/registry.py

@@ -0,0 +1,216 @@
+"""Outage provider registry: settings, licence gate, and bbox queries.
+
+Mirrors ``app.internal.cameras.registry`` rule for rule. Settings live in
+Firestore ``config/outage_providers``::
+
+    {"providers": {"<id>": {"enabled": bool, "updated_at": iso, "updated_by": {...},
+                            "acknowledgement": {"by_uid", "by_email", "at", "licence_status", "warning"} | None}}}
+
+Rules (owner decision #247 on server-26#184):
+  * every provider defaults OFF -- a missing doc/entry means off, and an
+    unreadable settings doc means everything is off (fail closed);
+  * a stub (no adapter) or a PROHIBITED source can never be enabled;
+  * a GATED licence (agreement required / non-commercial / unverified / paid)
+    can only be enabled with an explicit acknowledgement, recorded with who and
+    when in the settings doc AND audit_log. The audit write is a precondition
+    for a gated enable: no record, no enable;
+  * an acknowledgement is bound to the licence status it was given for. If a
+    provider's catalogued status changes in code, the old acknowledgement no
+    longer counts and the provider stops serving until re-acknowledged.
+"""
+import asyncio
+import time
+from datetime import datetime, timezone
+from typing import Dict, List, Optional, Tuple
+
+from app.internal import firestore as fstore
+from app.internal.logger import logger
+from app.internal.outages import providers as sources
+from app.internal.outages.base import BBox, Feed, Licence, OutageArea, OutageProvider, area_in_bbox, bbox_intersects
+
+COLLECTION, DOC_ID = "config", "outage_providers"
+_TTL_S = 30.0
+MAX_AREAS = 3000   # per response; ODIN's whole country is ~100-300 counties on a normal day
+
+PROVIDERS: Dict[str, OutageProvider] = {p.meta.id: p for p in sources.PROVIDERS}
+FEEDS: Dict[str, Feed] = {pid: Feed(p) for pid, p in PROVIDERS.items() if p.meta.implemented}
+
+NO_SOURCE_MESSAGE = "No licensed outage source covers this area."
+
+_cache: Dict[str, dict] = {}
+_cache_ts = 0.0
+
+
+class ProviderError(Exception):
+    """A refused settings change. ``code`` is the HTTP status the router returns."""
+
+    def __init__(self, code: int, message: str, **extra):
+        super().__init__(message)
+        self.code, self.message, self.extra = code, message, extra
+
+
+def invalidate_cache() -> None:
+    global _cache_ts
+    _cache_ts = 0.0
+
+
+async def get_settings() -> Dict[str, dict]:
+    """Per-provider settings. Unreadable Firestore means everything is OFF (fail closed)."""
+    global _cache, _cache_ts
+    if _cache_ts and time.monotonic() - _cache_ts < _TTL_S:
+        return _cache
+    try:
+        doc = await fstore.doc_get(COLLECTION, DOC_ID) or {}
+        provs = doc.get("providers") if isinstance(doc.get("providers"), dict) else {}
+        _cache = {k: v for k, v in provs.items() if isinstance(v, dict)}
+    except Exception as e:
+        logger.warning(f"outage providers: settings unreadable ({e}); treating every provider as OFF")
+        _cache = {}
+    _cache_ts = time.monotonic()
+    return _cache
+
+
+def effective(provider: OutageProvider, entry: Optional[dict]) -> Tuple[bool, Optional[str]]:
+    """(serving?, reason-if-not) for a provider given its settings entry."""
+    meta = provider.meta
+    if not meta.implemented:
+        return False, "adapter is a stub"
+    if meta.licence.status == Licence.PROHIBITED:
+        return False, "source terms forbid this use"
+    if not entry or not entry.get("enabled"):
+        return False, "disabled (default)"
+    if meta.licence.gated:
+        ack = entry.get("acknowledgement") or {}
+        if ack.get("licence_status") != meta.licence.status.value:
+            return False, "licence acknowledgement missing or out of date"
+    return True, None
+
+
+async def is_serving(provider_id: str) -> bool:
+    p = PROVIDERS.get(provider_id)
+    if p is None:
+        return False
+    return effective(p, (await get_settings()).get(provider_id))[0]
+
+
+async def set_enabled(provider_id: str, enabled: bool, actor: Tuple[str, str],
+                      acknowledge_licence: bool = False) -> dict:
+    p = PROVIDERS.get(provider_id)
+    if p is None:
+        raise ProviderError(404, f"unknown outage provider '{provider_id}'")
+    meta, lic = p.meta, p.meta.licence
+    uid, email = actor
+    now = datetime.now(timezone.utc).isoformat()
+    entry: dict = {"enabled": bool(enabled), "updated_at": now, "updated_by": {"uid": uid, "email": email}}
+
+    if enabled:
+        if not meta.implemented:
+            raise ProviderError(409, f"{meta.name}: no working adapter -- {meta.notes}")
+        if lic.status == Licence.PROHIBITED:
+            raise ProviderError(409, lic.warning() or "prohibited")
+        if lic.gated:
+            if not acknowledge_licence:
+                raise ProviderError(409, f"{meta.name}: licence acknowledgement required",
+                                    requires_acknowledgement=True, warning=lic.warning(),
+                                    licence=lic.as_dict())
+            entry["acknowledgement"] = {"by_uid": uid, "by_email": email, "at": now,
+                                        "licence_status": lic.status.value, "warning": lic.warning()}
+            # Precondition, not a side effect: a gated enable with no audit
+            # record must not happen. A failure here aborts before the write.
+            try:
+                await _audit(actor, "outage_provider.enable_acknowledged", provider_id,
+                             {"licence_status": lic.status.value, "licence_label": lic.label,
+                              "warning": lic.warning(), "acknowledged_at": now})
+            except Exception as e:
+                logger.error(f"outage providers: audit write failed, refusing gated enable of {provider_id} ({e})")
+                raise ProviderError(503, "audit log unavailable -- a licence-gated provider cannot be enabled "
+                                         "without an audit record; try again")
+    else:
+        entry["acknowledgement"] = None   # re-enabling a gated source needs a fresh acknowledgement
+
+    before = (await get_settings()).get(provider_id) or {}
+    await fstore.doc_set(COLLECTION, DOC_ID, {"providers": {provider_id: entry}}, merge=True)
+    invalidate_cache()
+    if not (enabled and lic.gated):
+        try:
+            await _audit(actor, "outage_provider.enable" if enabled else "outage_provider.disable", provider_id,
+                         {"from": bool(before.get("enabled")), "to": bool(enabled),
+                          "licence_status": lic.status.value})
+        except Exception as e:   # the toggle already happened; never 500 a completed write
+            logger.error(f"outage providers: audit write failed for {provider_id} ({e})")
+    logger.info(f"outage provider {provider_id} -> enabled={enabled} by {email or uid}")
+    return await describe(provider_id)
+
+
+async def _audit(actor: Tuple[str, str], action: str, provider_id: str, details: dict) -> None:
+    from app.internal import audit
+    await audit.write_audit(actor_uid=actor[0], actor_email=actor[1], action=action,
+                            details={"provider_id": provider_id, **details})
+
+
+async def describe(provider_id: str) -> dict:
+    p = PROVIDERS[provider_id]
+    entry = (await get_settings()).get(provider_id) or {}
+    serving, reason = effective(p, entry)
+    m = p.meta
+    feed = FEEDS.get(provider_id)
+    return {
+        "id": m.id, "name": m.name, "region": m.region, "granularity": m.granularity,
+        "implemented": m.implemented, "notes": m.notes, "homepage": m.homepage,
+        "licence": m.licence.as_dict(),
+        "enabled": bool(entry.get("enabled")),
+        "serving": serving, "not_serving_reason": reason,
+        "acknowledgement": entry.get("acknowledgement"),
+        "updated_at": entry.get("updated_at"), "updated_by": entry.get("updated_by"),
+        "coverage_note": p.coverage_note(),
+        "health": feed.status() if feed else None,
+    }
+
+
+async def list_providers() -> List[dict]:
+    await get_settings()
+    return [await describe(pid) for pid in PROVIDERS]
+
+
+def credit(provider_id: str) -> dict:
+    lic = PROVIDERS[provider_id].meta.licence
+    return {"attribution": lic.attribution, "attribution_url": lic.attribution_url, "disclaimer": lic.disclaimer}
+
+
+async def outages_in_bbox(bbox: BBox) -> dict:
+    """Outage areas from every SERVING provider whose coverage meets ``bbox``.
+    Providers that are off are never fetched.
+
+    ``status`` says why the list is what it is, so an empty layer is never
+    ambiguous: ``none_enabled`` (no provider is on), ``no_source`` (none of the
+    serving providers covers this area), ``error`` (every covering provider
+    failed and has nothing cached), else ``ok`` -- which may legitimately
+    carry zero areas when nothing is out."""
+    conf = await get_settings()
+    serving = [pid for pid in FEEDS if effective(PROVIDERS[pid], conf.get(pid))[0]]
+    live = [pid for pid in serving if bbox_intersects(PROVIDERS[pid].meta.coverage, bbox)]
+    await asyncio.gather(*(FEEDS[pid].get() for pid in live))
+    areas: List[OutageArea] = []
+    providers = []
+    for pid in serving:
+        feed = FEEDS[pid]
+        hits = [a for a in feed.items if area_in_bbox(a, bbox)] if pid in live else []
+        room = max(0, MAX_AREAS - len(areas))
+        areas.extend(hits[:room])
+        providers.append({"id": pid, "name": PROVIDERS[pid].meta.name, **credit(pid),
+                          "granularity": PROVIDERS[pid].meta.granularity,
+                          "coverage_note": PROVIDERS[pid].coverage_note(),
+                          "covers_bbox": pid in live,
+                          "fetched_at": feed.fetched_at, "error": feed.error,
+                          "total_in_bbox": len(hits), "truncated": len(hits) > room})
+
+    if not serving:
+        status, message = "none_enabled", "No outage source is enabled. An admin can enable one under Admin -> Outage providers."
+    elif not live:
+        status, message = "no_source", NO_SOURCE_MESSAGE
+    elif all(FEEDS[pid].error and FEEDS[pid].fetched_at is None for pid in live):
+        status, message = "error", "Every outage source covering this area failed to load; see each provider's error."
+    else:
+        status, message = "ok", None
+    return {"areas": areas, "providers": providers, "serving_count": len(serving),
+            "status": status, "message": message}

drb-c2-core/app/internal/place_verifier.py

@@ -23,7 +23,8 @@ permanently improves the reference data for that channel.
 
 NO ANCHOR MEANS SKIP, NOT ACCEPT. An anchor too wide to discriminate is not
 stored at all (see `area_context`), and without one this module returns
-immediately. A statewide radius would confirm anything inside it, which is worse
+immediately. A channel nobody described may still get one from its own
+talkgroup name plus the node's state (server-26#160, `_talkgroup_anchor`). A statewide radius would confirm anything inside it, which is worse
 than not checking — it looks like verification and is not.
 
 THE FREE TIER RUNS FIRST. A sound-alike among the terms the operator already
@@ -169,6 +170,50 @@ def _known_soundalike(heard: str, area: dict) -> Optional[dict]:
     return best
 
 
+async def _talkgroup_anchor(
+    talkgroup_name: Optional[str], node_id: Optional[str],
+) -> tuple[Optional[dict], str]:
+    """
+    An anchor derived from the talkgroup's own name plus the receiving node's
+    state, or (None, ""). Same width rule as an operator anchor
+    (area_context.resolve_anchor drops anything wider than
+    area_anchor_max_radius_km, and caches per place for the process).
+
+    A STATE IS REQUIRED. "Springfield PD" alone geocodes to whichever
+    Springfield Google prefers, and an anchor in the wrong half of the
+    country would let Maps rewrite real local streets into sound-alikes from
+    there (the failure server-26#36 added `state` to prevent). The node's
+    reverse-geocoded state is coarse enough to be right even when the node
+    sits far from the area the channel covers.
+    """
+    from app.internal import firestore as fstore
+    from app.internal.intelligence import _get_node_state, _municipality_from_tg
+
+    muni = _municipality_from_tg(talkgroup_name)
+    if not muni or not node_id:
+        return None, ""
+    node = await fstore.doc_get_cached("nodes", node_id) or {}
+    lat, lon = node.get("lat"), node.get("lon")
+    if lat is None or lon is None:
+        return None, ""
+    state = await _get_node_state(node_id, lat, lon)
+    if not state:
+        return None, ""
+    place = {"municipality": muni, "state": state}
+    resolved = await area_context.resolve_anchor(place)
+    if not resolved:
+        return None, ""
+    try:
+        anchor = {
+            "lat": float(resolved["center"]["lat"]),
+            "lng": float(resolved["center"]["lng"]),
+            "radius_km": float(resolved["radius_km"]),
+        }
+    except (KeyError, TypeError, ValueError):
+        return None, ""
+    return anchor, f"{muni}, {state}"
+
+
 # -- Public --------------------------------------------------------------------
 
 def _substitute(text: str, swaps: list[tuple[str, str]]) -> str:
@@ -186,6 +231,8 @@ async def verify(
     tg_area: Optional[dict],
     system_id: Optional[str] = None,
     talkgroup_id: Optional[Any] = None,
+    talkgroup_name: Optional[str] = None,
+    node_id: Optional[str] = None,
 ) -> tuple[Optional[str], Optional[list[dict]]]:
     """
     Check the corrector's location nouns against the talkgroup's anchor.
@@ -197,12 +244,18 @@ async def verify(
     if not settings.place_verification_enabled or not locations:
         return None, None
 
+    area = area_context.effective(system_area, tg_area)
     anchor = area_context.anchor_for(system_area, tg_area)
+    suffix = _place_suffix(area)
+    if not anchor and not area_context.has_place(area):
+        # server-26#160: nobody described this channel, but its own name may
+        # (e.g. "New York City - NYPD Citywide 2 Patch") — the same signal
+        # #159 trusted in intelligence.py's geocoder. Only when an operator set
+        # NOTHING: a place that is set but has no anchor was too wide or is
+        # stale, and that skip stays load-bearing.
+        anchor, suffix = await _talkgroup_anchor(talkgroup_name, node_id)
     if not anchor:
         return None, None  # load-bearing: no anchor means skip, never accept
-
-    area = area_context.effective(system_area, tg_area)
-    suffix = _place_suffix(area)
     swaps: list[tuple[str, str]] = []
     proposals: list[dict] = []
 

drb-c2-core/app/internal/recorrelation_sweep.py

@@ -65,14 +65,18 @@ def pipeline_worst_case_seconds(n_scenes: int = _BOUND_SCENES) -> float:
     _run_intelligence_pipeline."""
     openai_attempts = 1 + max(0, settings.openai_max_retries)
     stt_rounds = 2 if settings.stt_retry_on_degenerate else 1
-    stt = stt_rounds * openai_attempts * settings.stt_timeout_seconds
-    # Transcript correction (inside transcribe_call). gemini.generate_json only
-    # re-issues a request when the model rejects a thinking level — a fast
-    # 400, not a timeout — and google-genai itself does not retry.
-    correction = settings.gemini_timeout_seconds
+    # A failed primary STT provider falls back to OpenAI (server-26#297), so
+    # the worst case is every configured target timing out in turn.
+    from app.internal.transcription import stt_targets
+    stt_providers = max(1, len(stt_targets()))
+    stt = stt_providers * stt_rounds * openai_attempts * settings.stt_timeout_seconds
+    # Transcript correction and the correlation decision go through
+    # llm.generate_json; the bound depends on which provider serves the model.
+    from app.internal import llm
+    correction = llm.timeout_seconds(settings.transcript_correction_model)
     extraction = openai_attempts * settings.openai_timeout_seconds
     embeddings = n_scenes * openai_attempts * settings.openai_timeout_seconds
-    correlation = 2 * settings.gemini_timeout_seconds  # decide + tiebreak, scene 0
+    correlation = llm.timeout_seconds(settings.corr_cheap_model)  # at most one LLM call, scene 0 (#299)
     return stt + correction + extraction + embeddings + correlation + _NON_AI_SLACK_SECONDS
 
 
@@ -80,24 +84,28 @@ def _derive_min_minutes() -> int:
     return max(_FLOOR_MINUTES, math.ceil(pipeline_worst_case_seconds() / 60))
 
 
-# 21 with the defaults (stt 120s, openai 60s x2 attempts, gemini 60s, 3 scenes).
+# 22 with the defaults (stt 120s, openai 60s x2 attempts for every call, 3 scenes).
 MIN_MINUTES_SINCE_PIPELINE_START = _derive_min_minutes()
 
-# Standard link-only retry budget before a call is tombstoned corr_path="unlinked".
-MAX_SWEEP_ATTEMPTS = 3
-# server-26#115 — a call the consensus LLM-orphan gate parked (llm=orphan vs
-# rules=new, no substance) gets a longer budget. The gate fires before any
-# incident for the job may exist, so the substantive call that would justify
-# linking can land well after the standard ~6 min. Still link-only: a genuinely
-# thin call must not mint an incident, and the rules creation gate would re-orphan
-# it anyway.
-GATED_ORPHAN_SWEEP_ATTEMPTS = 10
 
+def _last_chance(call: dict, now: datetime) -> bool:
+    """
+    server-26#27 — the retry budget is wall-clock, not an attempt count.
 
-def _max_sweep_attempts(call: dict) -> int:
-    if call.get("corr_consensus") == "llm_orphan_gate":
-        return GATED_ORPHAN_SWEEP_ATTEMPTS
-    return MAX_SWEEP_ATTEMPTS
+    The old budget was 3 attempts, which with the #131 hold-back expired ~19
+    minutes after the pipeline started, while the incident the orphan belongs
+    to may be opened later than that (`f321b047` was tombstoned three minutes
+    after its own incident was created). An orphan is now retried on every
+    pass for as long as the scan query can see it, and tombstoned
+    corr_path="unlinked" only on its LAST visible pass: the one after which
+    its ended_at falls out of `recorrelation_scan_minutes`. A call with no
+    parseable ended_at gets no further retries.
+    """
+    ended = _parse_dt(call.get("ended_at"))
+    if ended is None:
+        return True
+    remaining = timedelta(minutes=settings.recorrelation_scan_minutes) - (now - ended)
+    return remaining <= timedelta(minutes=settings.summary_interval_minutes)
 
 
 async def recorrelation_loop() -> None:
@@ -149,9 +157,8 @@ async def _run_sweep_pass() -> None:
         ("status",   "==",  "ended"),
         ("ended_at", ">=",  cutoff),
     ])
-    # corr_path="unlinked" is written after the attempt budget is exhausted.
-    # Allows a few retries so a welfare-check call can link to an escalation
-    # incident that is created a few minutes later, without sweeping 30× forever.
+    # corr_path="unlinked" is the tombstone written on an orphan's last
+    # visible pass (_last_chance); the scan window itself is the budget.
     orphans = [
         c for c in recent_ended
         if not c.get("incident_ids") and not c.get("incident_id")
@@ -163,7 +170,6 @@ async def _run_sweep_pass() -> None:
         # the thin path minutes later and attached to whatever was most recent —
         # a second route into the over-merge the thin fix above addresses.
         and not c.get("skip_reason")
-        and c.get("corr_sweep_count", 0) < _max_sweep_attempts(c)
         and not _pipeline_likely_still_running(c, now)
     ]
 
@@ -173,14 +179,14 @@ async def _run_sweep_pass() -> None:
     logger.info(f"Re-correlation sweep: {len(orphans)} orphaned call(s) to check")
     linked = 0
     for call in orphans:
-        if await _recorrelate_orphan(call):
+        if await _recorrelate_orphan(call, now):
             linked += 1
 
     if linked:
         logger.info(f"Re-correlation sweep: linked {linked}/{len(orphans)} orphaned call(s)")
 
 
-async def _recorrelate_orphan(call: dict) -> bool:
+async def _recorrelate_orphan(call: dict, now: datetime) -> bool:
     """
     Attempt to link a single orphaned call to an existing incident.
     Returns True if a match was found and the call was linked.
@@ -223,12 +229,10 @@ async def _recorrelate_orphan(call: dict) -> bool:
         )
         return True
 
-    # Increment the attempt counter. Once the budget is reached the orphan filter
-    # above will stop picking this call up, and we write corr_path="unlinked" as
-    # a permanent tombstone.
-    attempts = call.get("corr_sweep_count", 0) + 1
-    update: dict = {"corr_sweep_count": attempts}
-    if attempts >= _max_sweep_attempts(call):
+    # The attempt count is kept for the admin debug view only; the budget is
+    # the scan window (_last_chance), after which the call is tombstoned.
+    update: dict = {"corr_sweep_count": call.get("corr_sweep_count", 0) + 1}
+    if _last_chance(call, now):
         update["corr_path"] = "unlinked"
     await fstore.doc_set("calls", call_id, update)
     return False

drb-c2-core/app/internal/replay.py

@@ -58,9 +58,10 @@ PREFETCH = 6
 # Estimates, not a bill — nothing in DRB reads a real invoice (server-26#45).
 USD_WHISPER_PER_MIN    = 0.006
 USD_PER_EXTRACTION     = 0.0005   # gpt-4o-mini scene extraction + embedding
-USD_PER_CORRECTION     = 0.0003   # Gemini flash transcript correction
+USD_PER_CORRECTION     = 0.0004   # gpt-4o-mini transcript correction (~1.5k in / 300 out tokens)
 USD_PER_GEOCODE        = 0.005    # Google geocode, roughly one per located scene
-USD_PER_LLM_CORRELATE  = 0.0005   # Gemini flash consensus decision
+USD_PER_LLM_CORRELATE  = 0.0004   # one gpt-4o-mini correlation decision (~2k in / 100 out; ambiguous scenes only)
+_LLM_CONSENSUS = ("llm", "rules_guard", "agreed", "tiebreak", "llm_orphan_gate")
 
 # Fields the pipeline writes onto a call doc. Stripped when a call is copied
 # into the sandbox so the replay recomputes them instead of inheriting the
@@ -73,6 +74,9 @@ _DERIVED = {
     "vehicles", "cleared_units", "severity", "incident_type", "type",
     "embedding", "skip_reason", "intelligence_started_at", "reassignment",
     "resolved", "has_updates", "audio_url",
+    # server-26#297: which STT produced the transcript, and its confidence —
+    # a re-transcription that comes back empty must not keep the live values.
+    "stt_provider", "stt_model", "stt_audio_seconds", "stt_confidence",
 }
 _DERIVED_PREFIXES = ("corr_", "chatter_classifier_", "eval_")
 _TRANSCRIPT_FIELDS = (
@@ -406,6 +410,7 @@ async def _prepare(call: dict, mode: str, source_scenes: dict[str, dict]) -> dic
             transcript, segments = await transcription.transcribe_call(
                 call_id, call["audio_gcs_uri"], talkgroup_name,
                 system_id=call.get("system_id"), talkgroup_id=call.get("talkgroup_id"),
+                node_id=call.get("node_id"),
             )
     else:
         transcript, segments = _stored_input(call)
@@ -469,9 +474,9 @@ async def _run(run_id: str, org_id: str, calls: list[dict], mode: str,
     fl_token = force_flags(_flags_for(mode))
     ai_failures: list = []
     ai_token = ai_health.collect_sandbox_failures(ai_failures)
-    from app.internal import gemini
+    from app.internal import llm
     usage: dict = {}
-    usage_token = gemini.collect_usage(usage)
+    usage_token = llm.collect_usage(usage)
     try:
         sem = asyncio.Semaphore(PREFETCH)
 
@@ -564,7 +569,7 @@ async def _run(run_id: str, org_id: str, calls: list[dict], mode: str,
         metrics = compute_metrics(incidents, sb_calls)
         metrics["est_cost_usd"] = _running_cost(progress, metrics, mode)
         metrics["ai_failures"] = dict(Counter(f"{f['tier']}: {f['problem']}" for f in ai_failures))
-        metrics["gemini_usage"] = usage
+        metrics["llm_usage"] = usage
     except Exception as e:
         status = "failed"
         errors.append(f"run: {type(e).__name__}: {e}"[:300])
@@ -572,7 +577,7 @@ async def _run(run_id: str, org_id: str, calls: list[dict], mode: str,
         logger.error(f"Replay {run_id} failed: {e}")
     finally:
         ai_health._sandbox_failures.reset(ai_token)
-        gemini.reset_usage(usage_token)
+        llm.reset_usage(usage_token)
         unforce_flags(fl_token)
         fstore.exit_sandbox(sb_token)
         _cancel.discard(run_id)
@@ -636,7 +641,11 @@ def compute_metrics(incidents: list[dict], calls: list[dict]) -> dict:
             corr_path[r.get("corr_path") or "none"] += 1
             consensus[r.get("corr_consensus") or "none"] += 1
     linked = sum(1 for c in calls if c.get("incident_ids"))
-    llm = sum(n for k, n in consensus.items() if k not in ("none", "rules_only"))
+    # Scene decisions that made an LLM call (server-26#299: at most one each).
+    # "rules_fallback" is excluded — the call failed or was unusable, so it
+    # was mostly not billed. "agreed"/"tiebreak" are pre-#299 runs' values
+    # (a tiebreak was two calls, so old runs under-count by their tiebreaks).
+    llm = sum(n for k, n in consensus.items() if k in _LLM_CONSENSUS)
     return {
         "calls": len(calls),
         "calls_linked": linked,

drb-c2-core/app/internal/storage.py

@@ -100,24 +100,65 @@ async def upload_audio(data: bytes, filename: str, call_id: str = "") -> Optiona
     return gcs_uri
 
 
-async def download_audio(gcs_uri: str) -> Optional[bytes]:
-    """Fetch an object back out of GCS. Server-side read — no signing involved."""
+# ── Ranged reads for /media playback (server-26#233) ────────────────────────
+# A 600 s FLAC call is ~13 MB. /media used to pull the whole object into
+# memory (the old download_audio(), removed once nothing called it — #225 S8),
+# so the browser waited for all of it before the first sample played. These
+# two read only what a request asks for: the
+# object size (one metadata GET) and then an inclusive byte span, which the
+# router streams out in chunks. One cached client, because the router issues
+# several span reads per playback and a fresh Client() per read re-resolves
+# credentials every time.
+_gcs_client_cache = None
+
+
+def _gcs_client():
+    global _gcs_client_cache
+    if _gcs_client_cache is None:
+        from google.cloud import storage
+        if settings.gcp_credentials_path:
+            _gcs_client_cache = storage.Client.from_service_account_json(settings.gcp_credentials_path)
+        else:
+            _gcs_client_cache = storage.Client()
+    return _gcs_client_cache
+
+
+async def audio_object_size(gcs_uri: str) -> Optional[int]:
+    """Size in bytes of a stored audio object, or None if it is missing/unreadable."""
     bucket_name, blob_path = split_gcs_uri(gcs_uri)
     if not bucket_name:
         return None
 
-    def _download() -> bytes:
-        from google.cloud import storage
-        if settings.gcp_credentials_path:
-            client = storage.Client.from_service_account_json(settings.gcp_credentials_path)
-        else:
-            client = storage.Client()
-        return client.bucket(bucket_name).blob(blob_path).download_as_bytes()
+    def _size() -> Optional[int]:
+        blob = _gcs_client().bucket(bucket_name).blob(blob_path)
+        blob.reload()
+        return blob.size
 
     try:
-        return await asyncio.to_thread(_download)
+        size = await asyncio.to_thread(_size)
     except Exception as e:
-        logger.warning(f"GCS download failed for {gcs_uri}: {e}")
+        logger.warning(f"GCS metadata read failed for {gcs_uri}: {e}")
+        return None
+    return int(size) if size is not None else None
+
+
+async def download_audio_range(gcs_uri: str, start: int, end: int) -> Optional[bytes]:
+    """Bytes ``start``..``end`` INCLUSIVE of a stored object (GCS's own convention).
+
+    Reads only that span from GCS — never the whole object.
+    """
+    bucket_name, blob_path = split_gcs_uri(gcs_uri)
+    if not bucket_name:
+        return None
+
+    def _read() -> bytes:
+        blob = _gcs_client().bucket(bucket_name).blob(blob_path)
+        return blob.download_as_bytes(start=start, end=end)
+
+    try:
+        return await asyncio.to_thread(_read)
+    except Exception as e:
+        logger.warning(f"GCS ranged read failed for {gcs_uri} [{start}-{end}]: {e}")
         return None
 
 

drb-c2-core/app/internal/transcript_correction.py

@@ -116,11 +116,37 @@ def _dedupe(items: list[str]) -> list[str]:
 # mishearing this pass exists to fix (server-26#162).
 _CODE_TOKEN_RE = re.compile(r"\b\d{1,3}(?:-\d{1,3})+\b")
 
+# Bare numbers (the rest of server-26#162): the same call had a bare "7"
+# turned into "ShotSpotter". A unit number, a post, a house number or a count
+# the recogniser DID hear must survive, in order. A number may still be
+# added, because a sound-alike can legitimately be one ("back to Rose" ->
+# "back to Route 9"). "4th" is not bare (it is a word).
+_BARE_NUMBER_RE = re.compile(r"(?<![\w-])\d+(?![\w-])")
+
+# "NEVER add information" is the other prompt rule nothing checked. A
+# correction substitutes sound-alikes, so it may shift the word count a little
+# ("Holmes Street and 4th and Rowe" -> "Home Street and Forest Ave"); growing
+# by more than this is the model writing, not correcting.
+_MAX_ADDED_WORDS = 4
+_MAX_GROWTH_RATIO = 0.25
+
 
 def _code_tokens(text: str) -> list[str]:
     return _CODE_TOKEN_RE.findall(text or "")
 
 
+def _lost_numbers(original: str, corrected: str) -> bool:
+    """True unless every bare number of `original` is still in `corrected`, in order."""
+    remaining = iter(_BARE_NUMBER_RE.findall(corrected or ""))
+    return not all(any(n == m for m in remaining) for n in _BARE_NUMBER_RE.findall(original or ""))
+
+
+def _grew(original: str, corrected: str) -> bool:
+    n_orig = len((original or "").split())
+    n_new = len((corrected or "").split())
+    return n_new - n_orig > max(_MAX_ADDED_WORDS, int(n_orig * _MAX_GROWTH_RATIO))
+
+
 def _talkgroup_entry(system_doc: dict, talkgroup_id: Optional[int]) -> dict:
     """The config.talkgroups[] entry for this talkgroup, or {}."""
     if talkgroup_id is None:
@@ -227,11 +253,11 @@ def build_context_block(context: dict, talkgroup_name: Optional[str]) -> str:
 
 
 def _sync_gemini(model_name: str, prompt: str) -> dict:
-    from app.internal import gemini
+    from app.internal import llm
     # Correction rewrites text against vocabulary; keep a little reasoning
     # ("low") rather than the correlator's "minimal" until a replay shows
     # minimal doesn't hurt it.
-    return gemini.generate_json(model_name, prompt, purpose="correction", thinking_level="low")
+    return llm.generate_json(model_name, prompt, purpose="correction", thinking_level="low")
 
 
 async def correct(
@@ -241,6 +267,7 @@ async def correct(
     system_id: Optional[str] = None,
     talkgroup_id: Optional[int] = None,
     talkgroup_name: Optional[str] = None,
+    node_id: Optional[str] = None,
 ) -> tuple[Optional[str], Optional[list[dict]], bool]:
     """
     Second-opinion pass over a transcript.
@@ -255,7 +282,8 @@ async def correct(
     so a correction that only fixed the joined transcript would never reach the
     model on exactly the multi-transmission calls that carry the most content.
     """
-    if not settings.gemini_api_key or not settings.transcript_correction_enabled:
+    from app.internal import llm
+    if not llm.available(settings.transcript_correction_model) or not settings.transcript_correction_enabled:
         return None, None, False
 
     if len((text or "").split()) < MIN_WORDS_FOR_CORRECTION:
@@ -330,6 +358,8 @@ async def correct(
                 context.get("tg_area"),
                 system_id=system_id,
                 talkgroup_id=talkgroup_id,
+                talkgroup_name=talkgroup_name,
+                node_id=node_id,
             )
         except Exception as e:
             logger.warning(f"Place verification failed for call {call_id}: {e}")
@@ -354,6 +384,18 @@ async def correct(
             f"discarding the joined correction"
         )
         corrected = None
+    if corrected is not None and _lost_numbers(text, corrected):
+        logger.warning(
+            f"Transcript correction for call {call_id} dropped or changed a number — "
+            f"discarding the joined correction"
+        )
+        corrected = None
+    if corrected is not None and _grew(text, corrected):
+        logger.warning(
+            f"Transcript correction for call {call_id} grew the transcript "
+            f"({len(text.split())} -> {len(corrected.split())} words) — discarding the joined correction"
+        )
+        corrected = None
     if corrected_segments is not None:
         for seg, orig in zip(corrected_segments, segments or []):
             if _code_tokens(seg["text"]) != _code_tokens(orig.get("text", "")):
@@ -363,6 +405,13 @@ async def correct(
                 )
                 corrected_segments = None
                 break
+            if _lost_numbers(orig.get("text", ""), seg["text"]) or _grew(orig.get("text", ""), seg["text"]):
+                logger.warning(
+                    f"Transcript correction for call {call_id} grew a segment or dropped "
+                    f"a number in one — discarding segment corrections"
+                )
+                corrected_segments = None
+                break
 
     if corrected or corrected_segments or not_speech:
         changed = raw.get("changed") or []

drb-c2-core/app/internal/transcription.py

@@ -1,18 +1,25 @@
 """
-Speech-to-text transcription for recorded calls using OpenAI Whisper.
+Speech-to-text transcription for recorded calls.
 
-Audio is downloaded from GCS then sent to the Whisper API. Falls back to
-returning None on any failure so the intelligence pipeline can still run.
+Audio is downloaded from GCS once, then sent to an OpenAI-compatible
+/audio/transcriptions endpoint: OpenAI whisper-1 by default, or a cheaper
+provider (Groq whisper-large-v3-turbo, a self-hosted server) when configured,
+with OpenAI as the fallback when that provider fails (server-26#297). Returns
+None on any failure so the intelligence pipeline can still run.
 """
 import asyncio
+import math
 import re
 import tempfile
 import os
+from dataclasses import dataclass
 from typing import Optional
 from app.internal.logger import logger
 from app.internal import firestore as fstore
 from app.internal import ai_health
 from app.internal import transcript_correction
+from app.internal import area_context
+from app.internal.chatter_classifier import gate_chatter
 from app.config import settings
 
 # Whisper treats `prompt` as preceding transcript text, not instructions.
@@ -43,6 +50,19 @@ _RUN_RATIO = 0.7             # share of consecutive pairs that must step by +1
 _MIN_SEGMENTS_FOR_REPEAT = 6  # segments needed before repetition is considered
 _UNIQUE_RATIO = 0.25         # unique/total segment texts at or below this is degenerate
 _MAX_PHRASE_REPEATS = 8      # identical consecutive phrase repeats allowed in one blob
+# Whisper's own failure test (openai/whisper transcribe.py, compression_ratio_
+# threshold=2.4): text that gzips this well is a loop, whatever its shape. The
+# two checks above only know two loop shapes; this catches the rest (two
+# phrases alternating, a list re-emitted) without a model call, so a noise
+# gate survives with transcript correction switched off (server-26#83). Only
+# on longer text -- a short string has too little to compress to judge.
+_MAX_COMPRESSION_RATIO = 2.4
+_MIN_CHARS_FOR_COMPRESSION = 200
+# Prompt echo (server-26#297): on silence Whisper can emit its own prompt.
+# With a vocabulary glossary in the prompt that reads as a list of local
+# street names. See _prompt_echo for why this is kept narrow.
+_ECHO_MIN_TERMS = 3
+_ECHO_WORD_RATIO = 0.6
 
 
 def _ten_code_run(text: str) -> bool:
@@ -77,7 +97,74 @@ def _phrase_loop(text: str) -> bool:
     return False
 
 
-def _is_degenerate(text: str, segments: list[dict]) -> bool:
+def _compression_ratio(text: str) -> float:
+    import zlib
+    raw = text.encode("utf-8")
+    return len(raw) / max(1, len(zlib.compress(raw)))
+
+
+def _prompt_echo(text: str, glossary: list[str]) -> bool:
+    """
+    True if the transcript is the prompt's own glossary read back.
+
+    Deliberately narrow (review of server-26#297): a real location readback
+    ("Main Street, Croton Avenue, Route 9") names glossary terms too, and
+    that is where map pins come from. So either the lead-in itself came back
+    ("Local names: ..."), or nearly the whole glossary did, in prompt order,
+    with little else around it.
+    """
+    if not text or not glossary:
+        return False
+    low = text.lower()
+    if "local names" in low:
+        return True
+    if len(glossary) < _ECHO_MIN_TERMS:
+        return False
+    positions = []
+    for t in glossary:
+        m = re.search(rf"\b{re.escape(t.lower())}\b", low)
+        if m:
+            positions.append(m.start())
+    if len(positions) < max(_ECHO_MIN_TERMS, math.ceil(0.8 * len(glossary))):
+        return False
+    if positions != sorted(positions):
+        return False
+    words = re.findall(r"[\w'-]+", low)
+    term_words = {w for t in glossary for w in re.findall(r"[\w'-]+", t.lower())}
+    return bool(words) and sum(1 for w in words if w in term_words) / len(words) >= _ECHO_WORD_RATIO
+
+
+def _compression_loop(text: str, segments: list[dict]) -> bool:
+    """
+    Whisper applies its 2.4 threshold per 30s decode window, and zlib's ratio
+    grows with length, so judging a whole 5-minute call at once would drop
+    busy real traffic. Judge ~30s windows of segments (or ~500-char chunks of
+    a segment-less transcript) and call it a loop only when at least half of
+    the windows long enough to judge are loops.
+    """
+    windows: list[str] = []
+    if segments:
+        cur, start = [], None
+        for s in segments:
+            st = float(s.get("start") or 0.0)
+            if start is None:
+                start = st
+            if st - start > 30.0 and cur:
+                windows.append(" ".join(cur))
+                cur, start = [], st
+            cur.append(s.get("text") or "")
+        if cur:
+            windows.append(" ".join(cur))
+    else:
+        windows = [text[i:i + 500] for i in range(0, len(text), 500)]
+    judged = [w for w in windows if len(w) >= _MIN_CHARS_FOR_COMPRESSION]
+    if not judged:
+        return False
+    loops = sum(1 for w in judged if _compression_ratio(w) > _MAX_COMPRESSION_RATIO)
+    return loops * 2 >= len(judged)
+
+
+def _is_degenerate(text: str, segments: list[dict], glossary: Optional[list[str]] = None) -> bool:
     """True if a transcript looks like Whisper output rather than radio traffic.
 
     Applied AFTER the per-segment no_speech_prob filter, which does not catch
@@ -88,6 +175,10 @@ def _is_degenerate(text: str, segments: list[dict]) -> bool:
         return False
     if _ten_code_run(text) or _phrase_loop(text):
         return True
+    if _compression_loop(text, segments):
+        return True
+    if _prompt_echo(text, glossary or []):
+        return True
     # Near-identical segments repeated across the whole recording.
     if len(segments) >= _MIN_SEGMENTS_FOR_REPEAT:
         normalised = {s["text"].strip().lower() for s in segments}
@@ -96,7 +187,155 @@ def _is_degenerate(text: str, segments: list[dict]) -> bool:
     return False
 
 
-async def _log_transcribe_failure(call_id: str, exc: Exception) -> None:
+
+
+# ── Providers (server-26#297) ───────────────────────────────────────────────
+
+_GROQ_BASE_URL = "https://api.groq.com/openai/v1"
+
+
+@dataclass(frozen=True)
+class SttTarget:
+    """One OpenAI-compatible transcription endpoint to try."""
+    provider: str            # "openai" | "groq" | "compat"
+    model: str
+    api_key: Optional[str]
+    base_url: Optional[str]  # None -> the OpenAI SDK default
+    vocab_prompt: bool       # whether the domain-vocabulary prompt is sent
+    tier: str                # ai_health tier this target reports to
+
+
+def stt_targets() -> list[SttTarget]:
+    """
+    The endpoints to try, in order: the configured provider, then OpenAI as
+    fallback. Empty when nothing usable is configured.
+
+    `stt_provider="auto"` resolves to Groq only when GROQ_API_KEY is set, so a
+    deploy that has not provisioned the key yet keeps transcribing on OpenAI
+    exactly as before.
+    """
+    provider = (settings.stt_provider or "auto").strip().lower()
+    if provider == "auto":
+        if settings.groq_api_key:
+            provider = "groq"
+        elif settings.stt_base_url:
+            provider = "compat"  # an explicit endpoint is a compat server
+        else:
+            provider = "openai"
+
+    openai_target = SttTarget(
+        provider="openai", model=settings.stt_model, api_key=settings.openai_api_key,
+        base_url=None, vocab_prompt=False, tier="transcription",
+    )
+    if provider not in ("groq", "compat"):
+        if provider != "openai":
+            logger.warning(f"Unknown STT_PROVIDER {settings.stt_provider!r} — using OpenAI")
+        return [openai_target] if settings.openai_api_key else []
+
+    if provider == "groq":
+        key = settings.stt_api_key or settings.groq_api_key
+        base = settings.stt_base_url or _GROQ_BASE_URL
+    else:
+        # A self-hosted server may not check the key, but the SDK insists on one.
+        key = settings.stt_api_key or "unused"
+        base = settings.stt_base_url
+
+    targets: list[SttTarget] = []
+    if key and base:
+        targets.append(SttTarget(
+            provider=provider, model=settings.stt_compat_model, api_key=key, base_url=base,
+            vocab_prompt=settings.stt_vocab_prompt_enabled, tier="transcription",
+        ))
+    else:
+        logger.warning(f"STT provider {provider!r} has no API key/base URL — using OpenAI only")
+    if settings.openai_api_key and (not targets or settings.stt_fallback_to_openai):
+        tier = "transcription_fallback" if targets else "transcription"
+        targets.append(SttTarget(**{**openai_target.__dict__, "tier": tier}))
+    return targets
+
+
+# ── Prompt (server-26#297) ──────────────────────────────────────────────────
+
+_CODE_SHAPED = re.compile(r"^\s*\d{1,3}(?:-\d{1,3})+\s*$")
+_MAX_TERM_CHARS = 40
+
+
+def _estimate_tokens(text: str) -> int:
+    """
+    Conservative token estimate for Whisper's GPT-2 tokenizer, without the
+    tokenizer: one per punctuation mark and per digit, ~4 letters per token
+    for words. Over-counts real English slightly, which is the safe side —
+    Whisper drops prompt tokens past 224 from the FRONT, silently.
+    """
+    n = 0
+    for piece in re.findall(r"[A-Za-z]+|\d|[^\sA-Za-z\d]", text or ""):
+        n += max(1, math.ceil(len(piece) / 4)) if piece[0].isalpha() else 1
+    return n
+
+
+def _glossary_terms(context: Optional[dict]) -> list[str]:
+    """
+    Local names worth spelling for the recogniser, most specific first:
+    the talkgroup/system local_knowledge terms, then vocabulary.
+
+    Never ten-codes. An enumerated run of codes in the prompt is what made
+    Whisper count "10-4. 10-5. 10-6." over silence (see _WHISPER_PROMPT), so
+    the ten_codes reference and any code-shaped vocabulary term stay out.
+    """
+    if not context:
+        return []
+    area = context.get("area") or {}
+    terms = [e.get("term") or "" for e in (area.get("local_knowledge") or []) if isinstance(e, dict)]
+    terms += [t for t in (context.get("vocabulary") or []) if isinstance(t, str)]
+    out: list[str] = []
+    seen: set[str] = set()
+    for t in terms:
+        t = t.strip()
+        key = t.lower()
+        if not t or key in seen or len(t) > _MAX_TERM_CHARS or _CODE_SHAPED.match(t):
+            continue
+        seen.add(key)
+        out.append(t)
+    return out
+
+
+def build_stt_prompt(
+    talkgroup_name: Optional[str], context: Optional[dict] = None,
+) -> tuple[str, list[str]]:
+    """
+    The STT prompt, and the glossary terms that made it in.
+
+    Without `context` this is exactly the prompt OpenAI has always been sent.
+    With it, the channel's area and local names go in front of the fixed
+    radio-speech priming, cut to settings.stt_prompt_max_tokens. A glossary
+    is how Whisper's prompting guide says to fix the spelling of proper
+    nouns; the priming text stays last because it is the part that sets style.
+    """
+    tg_prefix = f"Talkgroup: {talkgroup_name}. " if talkgroup_name else ""
+    if not context:
+        return tg_prefix + _WHISPER_PROMPT, []
+
+    area = context.get("area") or {}
+    place = ", ".join(str(area[f]) for f in area_context.PLACE_FIELDS if area.get(f))
+    head = tg_prefix + (f"{place}. " if place else "")
+    budget = settings.stt_prompt_max_tokens - _estimate_tokens(head + _WHISPER_PROMPT)
+
+    chosen: list[str] = []
+    for term in _glossary_terms(context):
+        trial = "Local names: " + ", ".join(chosen + [term]) + ". "
+        if _estimate_tokens(trial) > budget:
+            continue  # a shorter later term may still fit
+        chosen.append(term)
+    glossary = ("Local names: " + ", ".join(chosen) + ". ") if chosen else ""
+    prompt = head + glossary + _WHISPER_PROMPT
+    if _estimate_tokens(prompt) > settings.stt_prompt_max_tokens:
+        return tg_prefix + _WHISPER_PROMPT, []
+    return prompt, chosen
+
+
+# ── Failure reporting ───────────────────────────────────────────────────────
+
+async def _log_transcribe_failure(call_id: str, exc: Exception, target: SttTarget) -> None:
     """
     Log a transcription failure, escalating a permanent condition to ERROR
     once (via app.internal.ai_health, which also drives the /health/ai
@@ -115,47 +354,71 @@ async def _log_transcribe_failure(call_id: str, exc: Exception) -> None:
     """
     text = str(exc)
     kind = ai_health.classify(text)
+    who = f"{target.provider} ({target.model})"
+    billing_url = {
+        "openai": "https://platform.openai.com/settings/organization/billing",
+        "groq": "https://console.groq.com/settings/billing",
+    }.get(target.provider, "the provider's billing page")
 
     if kind == "billing":
-        problem = "the OpenAI account cannot be billed"
-        fix = "top up at https://platform.openai.com/settings/organization/billing"
+        problem = f"the {target.provider} account cannot be billed"
+        fix = f"top up at {billing_url}"
         logger.error(
-            "Transcription: the OpenAI account cannot be billed -- EVERY call is "
-            "now stored with no transcript, so extraction, correlation and "
-            "incidents are all dead downstream. Top up at "
-            f"https://platform.openai.com/settings/organization/billing. API said: {text}"
+            f"Transcription: the {target.provider} account cannot be billed -- calls on this "
+            f"provider get no transcript (OpenAI fallback, if configured, is carrying them). "
+            f"Top up at {billing_url}. API said: {text}"
         )
         await ai_health.report_degraded(
-            "transcription", "openai", settings.stt_model, problem, fix, permanent=True
+            target.tier, target.provider, target.model, problem, fix, permanent=True
         )
         return
 
     if kind == "dead_model":
         problem = "the STT model is unavailable"
-        fix = "update STT_MODEL in config.py"
+        fix = "update STT_MODEL / STT_COMPAT_MODEL"
         logger.error(
-            f"Transcription: the configured model ({settings.stt_model!r}) is unavailable "
-            "-- EVERY call is now stored with no transcript, so extraction, correlation "
-            f"and incidents are all dead downstream. Update STT_MODEL in config.py. API said: {text}"
+            f"Transcription: the configured model {who} is unavailable -- calls on this provider "
+            f"get no transcript. Update STT_MODEL / STT_COMPAT_MODEL. API said: {text}"
         )
         await ai_health.report_degraded(
-            "transcription", "openai", settings.stt_model, problem, fix, permanent=True
+            target.tier, target.provider, target.model, problem, fix, permanent=True
         )
         return
 
-    logger.warning(f"Transcription failed for call {call_id}: {text}")
+    logger.warning(f"Transcription via {who} failed for call {call_id}: {text}")
     await ai_health.report_degraded(
-        "transcription", "openai", settings.stt_model,
+        target.tier, target.provider, target.model,
         "transient API error", "no action needed unless this persists", permanent=False,
     )
 
 
+# ── Pipeline entry point ────────────────────────────────────────────────────
+
+async def _transcribe_with(
+    call_id: str, tmp_path: str, target: SttTarget, prompt: str, glossary: list[str],
+) -> dict:
+    """One target, with the one retry on degenerate output. Raises on API failure."""
+    result = await asyncio.to_thread(_sync_transcribe_file, tmp_path, target, prompt, glossary)
+    # A hallucination is a coin-flip, not a property of the clip: call
+    # e49ea32c produced a 56-word ten-code counting run on one attempt and
+    # ordinary speech on the next, same audio and temperature=0. Discarding
+    # on the first bad roll threw away a recoverable transcript, so spend
+    # one more request before giving up.
+    if result["degenerate"] and settings.stt_retry_on_degenerate:
+        logger.info(f"Retrying transcription for call {call_id} after degenerate output")
+        result = await asyncio.to_thread(_sync_transcribe_file, tmp_path, target, prompt, glossary)
+        if result["degenerate"]:
+            logger.warning(f"Transcription for call {call_id} was degenerate twice — giving up")
+    return result
+
+
 async def transcribe_call(
     call_id: str,
     gcs_uri: str,
     talkgroup_name: Optional[str] = None,
     system_id: Optional[str] = None,
     talkgroup_id: Optional[int] = None,
+    node_id: Optional[str] = None,
 ) -> tuple[Optional[str], list[dict]]:
     """
     Transcribe audio at the given GCS URI and store the result in Firestore.
@@ -167,36 +430,78 @@ async def transcribe_call(
     if not gcs_uri or not gcs_uri.startswith("gs://"):
         return None, []
 
+    targets = stt_targets()
+    if not targets:
+        logger.warning("No STT provider configured (OPENAI_API_KEY / GROQ_API_KEY unset) — transcription disabled.")
+        return None, []
+
+    context: Optional[dict] = None
+    if any(t.vocab_prompt for t in targets):
+        try:
+            context = await transcript_correction.resolve_context(system_id, talkgroup_id)
+        except Exception as e:
+            logger.warning(f"Could not resolve STT vocabulary for call {call_id}: {e}")
+
     try:
-        transcript, segments, degenerate = await asyncio.to_thread(
-            _sync_transcribe, gcs_uri, talkgroup_name
-        )
-        # A hallucination is a coin-flip, not a property of the clip: call
-        # e49ea32c produced a 56-word ten-code counting run on one attempt and
-        # ordinary speech on the next, same audio and temperature=0. Discarding
-        # on the first bad roll threw away a recoverable transcript, so spend
-        # one more request before giving up.
-        if degenerate and settings.stt_retry_on_degenerate:
-            logger.info(f"Retrying transcription for call {call_id} after degenerate output")
-            transcript, segments, degenerate = await asyncio.to_thread(
-                _sync_transcribe, gcs_uri, talkgroup_name
-            )
-            if degenerate:
-                logger.warning(
-                    f"Transcription for call {call_id} was degenerate twice — giving up"
-                )
+        tmp_path = await asyncio.to_thread(_download, gcs_uri)
     except Exception as e:
-        await _log_transcribe_failure(call_id, e)
+        # Not a provider failure: classify() would read a GCS "not found" as a
+        # retired model and page someone to change STT_MODEL.
+        logger.warning(f"Could not download audio for call {call_id} ({gcs_uri}): {e}")
+        return None, []
+
+    result: Optional[dict] = None
+    used: Optional[SttTarget] = None
+    try:
+        for i, target in enumerate(targets):
+            prompt, glossary = build_stt_prompt(talkgroup_name, context if target.vocab_prompt else None)
+            try:
+                result = await _transcribe_with(call_id, tmp_path, target, prompt, glossary)
+            except Exception as e:
+                await _log_transcribe_failure(call_id, e, target)
+                if i + 1 < len(targets):
+                    logger.warning(
+                        f"Transcription for call {call_id}: {target.provider} failed, "
+                        f"falling back to {targets[i + 1].provider} ({targets[i + 1].model})"
+                    )
+                continue
+            used = target
+            break
+    finally:
+        try:
+            os.unlink(tmp_path)
+        except OSError:
+            pass
+
+    if used is None or result is None:
         return None, []
 
     # No exception means the provider call itself succeeded (this also
     # covers transcripts discarded as degenerate/hallucinated output —
-    # that's a filtering decision, not a provider failure), so the
-    # transcription tier is healthy and any prior degradation clears.
-    await ai_health.report_healthy("transcription")
+    # that's a filtering decision, not a provider failure), so that tier is
+    # healthy and any prior degradation clears. A fallback success clears
+    # only the fallback tier: the primary is still broken and must stay red.
+    await ai_health.report_healthy(used.tier)
+
+    transcript: Optional[str] = result["text"]
+    segments: list[dict] = result["segments"]
 
     if transcript:
-        updates: dict = {"transcript": transcript}
+        updates: dict = {
+            "transcript": transcript,
+            # Which endpoint produced this text, and how much audio it billed,
+            # so cost (server-26#45) and an A/B of providers can be read off
+            # the call docs instead of guessed.
+            "stt_provider": used.provider,
+            "stt_model": used.model,
+        }
+        if result.get("duration") is not None:
+            updates["stt_audio_seconds"] = result["duration"]
+        if result.get("confidence") is not None:
+            # Mean per-token probability, exp(avg_logprob) weighted by segment
+            # length. The only STT-side confidence there is; the alert gate
+            # reads it (server-26#300).
+            updates["stt_confidence"] = result["confidence"]
         if segments:
             updates["segments"] = segments
 
@@ -212,17 +517,30 @@ async def transcribe_call(
         from app.internal.feature_flags import resolve_flags
         _, _ai_flag = await resolve_flags(system_id)
 
+        # server-26#298: radio housekeeping (roll call, a bare "Post 4, 10-8,
+        # copy") has no proper noun to correct, and extraction skips it too
+        # (intelligence.extract_scenes), so a correction pass here is pure
+        # spend. Same pure classifier both places, so they cannot disagree.
+        is_chatter, chatter_reason = (
+            gate_chatter(transcript) if settings.chatter_gate_enabled else (False, None)
+        )
+
         corrected, corrected_segments, not_speech = (None, None, False)
-        if _ai_flag("transcript_correction_enabled"):
+        if not _ai_flag("transcript_correction_enabled"):
+            logger.info(
+                f"Transcript correction disabled — saving raw transcript for call {call_id}"
+            )
+        elif is_chatter:
+            logger.info(
+                f"Transcript correction skipped for call {call_id}: chatter ({chatter_reason})"
+            )
+        else:
             corrected, corrected_segments, not_speech = await transcript_correction.correct(
                 call_id, transcript, segments,
                 system_id=system_id,
                 talkgroup_id=talkgroup_id,
                 talkgroup_name=talkgroup_name,
-            )
-        else:
-            logger.info(
-                f"Transcript correction disabled — saving raw transcript for call {call_id}"
+                node_id=node_id,
             )
         if corrected_segments:
             # Raw stays as evidence; the corrected copy is what extraction reads.
@@ -241,7 +559,7 @@ async def transcribe_call(
         try:
             await fstore.doc_set("calls", call_id, updates)
             logger.info(
-                f"Transcript saved for call {call_id} "
+                f"Transcript saved for call {call_id} via {used.provider}/{used.model} "
                 f"({len(transcript)} chars, {len(segments)} segment(s)"
                 f"{', corrected' if corrected and not not_speech else ''})"
             )
@@ -259,27 +577,10 @@ async def transcribe_call(
     return transcript, segments
 
 
-def _sync_transcribe(
-    gcs_uri: str,
-    talkgroup_name: Optional[str] = None,
-) -> tuple[Optional[str], list[dict], bool]:
-    """Download audio from GCS and transcribe with OpenAI Whisper.
-
-    Third element is True when output was DISCARDED as degenerate, which the
-    caller distinguishes from ordinary silence so it can retry — the same clip
-    can hallucinate on one attempt and transcribe on the next.
-    """
+def _download(gcs_uri: str) -> str:
+    """Download the recording to a temp file once; the caller deletes it."""
     from google.cloud import storage as gcs
     from google.oauth2 import service_account
-    from app.config import settings
-    from app.internal.ai_clients import openai_client
-
-    if not settings.openai_api_key:
-        logger.warning("OPENAI_API_KEY not set — transcription disabled.")
-        # Tuple, not a bare None: the caller unpacks two values, so returning
-        # None here raised a TypeError that surfaced as a misleading
-        # "Transcription failed" instead of the real missing-key warning.
-        return None, [], False
 
     without_scheme = gcs_uri[len("gs://"):]
     bucket_name, blob_path = without_scheme.split("/", 1)
@@ -293,77 +594,116 @@ def _sync_transcribe(
     else:
         gcs_client = gcs.Client()
 
-    bucket = gcs_client.bucket(bucket_name)
-    blob = bucket.blob(blob_path)
-
+    blob = gcs_client.bucket(bucket_name).blob(blob_path)
     suffix = os.path.splitext(blob_path)[1] or ".mp3"
     with tempfile.NamedTemporaryFile(suffix=suffix, delete=False) as tmp:
         tmp_path = tmp.name
-
     try:
         blob.download_to_filename(tmp_path)
-
-        tg_prefix = f"Talkgroup: {talkgroup_name}. " if talkgroup_name else ""
-        # Vocabulary is intentionally excluded from the Whisper prompt.
-        # whisper-1 treats the prompt as a transcription prior and echoes
-        # vocabulary terms into noise/silence, polluting downstream extraction.
-        # Vocabulary context is applied in the GPT extraction step instead,
-        # where it is used as reference rather than a transcription prior.
-        prompt = tg_prefix + _WHISPER_PROMPT
-
-        # Only whisper-1 supports verbose_json (per-segment timestamps + no_speech_prob).
-        # gpt-4o-transcribe and gpt-4o-mini-transcribe only support json/text.
-        use_verbose = settings.stt_model == "whisper-1"
-
-        # Own timeout, not openai_timeout_seconds: this request uploads the
-        # whole recording (server-26#153).
-        stt_client = openai_client(timeout=settings.stt_timeout_seconds)
-        with open(tmp_path, "rb") as f:
-            response = stt_client.audio.transcriptions.create(
-                model=settings.stt_model,
-                file=f,
-                language="en",
-                prompt=prompt,
-                response_format="verbose_json" if use_verbose else "json",
-                temperature=0,
-            )
-
-        if use_verbose:
-            # Filter hallucinated segments.  Two sources of hallucination in P25 recordings:
-            #
-            # 1. Trailing silence / static — Whisper fills silence past real content with
-            #    sequential radio codes (10-4, 10-5...).  Clamped by audio duration.
-            #
-            # 2. Leading silence — OP25 recordings typically have a short silence at the
-            #    start before the first PTT press.  Whisper sometimes hallucinates filler
-            #    words or codes over this silence.  Detected via no_speech_prob > 0.8
-            #    (Whisper's own confidence that a segment contains no real speech).
-            audio_duration: float = getattr(response, "duration", None) or float("inf")
-            segments = [
-                {"start": round(s.start, 2), "end": round(s.end, 2), "text": s.text.strip()}
-                for s in (response.segments or [])
-                if s.text.strip()
-                and s.start < audio_duration
-                and getattr(s, "no_speech_prob", 0.0) < 0.8
-            ]
-            # Reconstruct text from non-hallucinated segments only so the two stay
-            # in sync.  If every segment was filtered, text becomes None which prevents
-            # the intelligence pipeline from running on hallucinated content.
-            text = " ".join(s["text"] for s in segments) or None
-            if _is_degenerate(text or "", segments):
-                logger.info(f"Discarded hallucinated transcript for {gcs_uri}: {(text or '')[:80]!r}")
-                return None, [], True
-            return text, segments, False
-        else:
-            # json format returns just {"text": "..."} — no segments or timestamps.
-            # Intelligence extraction falls back to treating the whole transcript as one block.
-            text = (response.text or "").strip() or None
-            if _is_degenerate(text or "", []):
-                logger.info(f"Discarded hallucinated transcript for {gcs_uri}: {(text or '')[:80]!r}")
-                return None, [], True
-            return text, [], False
-    finally:
+    except Exception:
         try:
             os.unlink(tmp_path)
         except OSError:
             pass
+        raise
+    return tmp_path
+
+
+def _segment_confidence(raw_segments: list) -> Optional[float]:
+    """exp(avg_logprob) per segment, weighted by segment length; None if absent."""
+    total, weight = 0.0, 0.0
+    for s in raw_segments:
+        lp = getattr(s, "avg_logprob", None)
+        if lp is None:
+            continue
+        w = max(0.01, float(getattr(s, "end", 0) or 0) - float(getattr(s, "start", 0) or 0))
+        total += math.exp(float(lp)) * w
+        weight += w
+    return round(total / weight, 3) if weight else None
+
+
+def _sync_transcribe_file(
+    tmp_path: str, target: SttTarget, prompt: str, glossary: Optional[list[str]] = None,
+) -> dict:
+    """Transcribe one downloaded file on one target.
+
+    Returns {"text", "segments", "degenerate", "duration", "confidence"}.
+    `degenerate` is True when output was DISCARDED as degenerate, which the
+    caller distinguishes from ordinary silence so it can retry — the same clip
+    can hallucinate on one attempt and transcribe on the next. Raises on any
+    API failure, so the caller can fall back to the next target.
+    """
+    from app.internal.ai_clients import stt_client
+
+    # verbose_json (per-segment timestamps + no_speech_prob) is a Whisper
+    # feature: whisper-1 on OpenAI, every whisper-* model on Groq. OpenAI's
+    # gpt-4o-transcribe / gpt-4o-mini-transcribe only support json/text.
+    use_verbose = target.model.startswith("whisper")
+
+    client = stt_client(target.api_key, target.base_url)
+    with open(tmp_path, "rb") as f:
+        response = client.audio.transcriptions.create(
+            model=target.model,
+            file=f,
+            language="en",
+            prompt=prompt,
+            response_format="verbose_json" if use_verbose else "json",
+            temperature=0,
+        )
+
+    if use_verbose:
+        # Filter hallucinated segments.  Two sources of hallucination in P25 recordings:
+        #
+        # 1. Trailing silence / static — Whisper fills silence past real content with
+        #    sequential radio codes (10-4, 10-5...).  Clamped by audio duration.
+        #
+        # 2. Leading silence — OP25 recordings typically have a short silence at the
+        #    start before the first PTT press.  Whisper sometimes hallucinates filler
+        #    words or codes over this silence.  Detected via no_speech_prob > 0.8
+        #    (Whisper's own confidence that a segment contains no real speech).
+        duration = getattr(response, "duration", None)
+        audio_duration: float = duration or float("inf")
+        kept = [
+            s for s in (response.segments or [])
+            if (_seg(s, "text") or "").strip()
+            and (_seg(s, "start") or 0.0) < audio_duration
+            and (_seg(s, "no_speech_prob") or 0.0) < 0.8
+        ]
+        segments = [
+            {"start": round(_seg(s, "start") or 0.0, 2), "end": round(_seg(s, "end") or 0.0, 2),
+             "text": _seg(s, "text").strip()}
+            for s in kept
+        ]
+        # Reconstruct text from non-hallucinated segments only so the two stay
+        # in sync.  If every segment was filtered, text becomes None which prevents
+        # the intelligence pipeline from running on hallucinated content.
+        text = " ".join(s["text"] for s in segments) or None
+        base = {"duration": duration, "confidence": _segment_confidence([_SegView(s) for s in kept])}
+        if _is_degenerate(text or "", segments, glossary):
+            logger.info(f"Discarded hallucinated transcript from {target.provider}: {(text or '')[:80]!r}")
+            return {"text": None, "segments": [], "degenerate": True, **base}
+        return {"text": text, "segments": segments, "degenerate": False, **base}
+
+    # json format returns just {"text": "..."} — no segments or timestamps.
+    # Intelligence extraction falls back to treating the whole transcript as one block.
+    text = (response.text or "").strip() or None
+    if _is_degenerate(text or "", [], glossary):
+        logger.info(f"Discarded hallucinated transcript from {target.provider}: {(text or '')[:80]!r}")
+        return {"text": None, "segments": [], "degenerate": True, "duration": None, "confidence": None}
+    return {"text": text, "segments": [], "degenerate": False, "duration": None, "confidence": None}
+
+
+def _seg(s, field: str):
+    """Segment field from an SDK object or a plain dict (OpenAI-compatible
+    servers do not all come back through the same pydantic model)."""
+    if isinstance(s, dict):
+        return s.get(field)
+    return getattr(s, field, None)
+
+
+class _SegView:
+    """Attribute view over a segment, for _segment_confidence."""
+    def __init__(self, s):
+        self.avg_logprob = _seg(s, "avg_logprob")
+        self.start = _seg(s, "start")
+        self.end = _seg(s, "end")

drb-c2-core/app/internal/weather.py

@@ -0,0 +1,408 @@
+"""Weather context for the map: NWS active alerts and nearest-METAR wind (server-26#237).
+
+Sources -- both US Government works, public domain, no licence gate:
+  * NWS alerts: https://api.weather.gov/alerts/active?area=<codes>
+    (docs: https://www.weather.gov/documentation/services-web-api). NWS requires
+    a User-Agent naming the app and a contact, and rate-limits, so the feed is
+    fetched server-side, cached (``settings.weather_alerts_ttl_s``) and shared by
+    every viewer. Credit: "National Weather Service".
+  * METAR wind: https://aviationweather.gov/api/data/metar?bbox=minLat,minLon,maxLat,maxLon&format=json
+    (docs: https://aviationweather.gov/data/api/). Verified 2026-10-05: JSON list,
+    one latest report per station, HTTP 204 with an empty body when the bbox holds
+    no station, ``wdir`` is an int or the string "VRB".
+
+Shape and failure rules are the 511NY ones (app/internal/ny511.py): a failed
+refresh keeps serving the last good data and reports the error and its age; a
+payload whose records ALL fail to parse is a schema change and an error, never
+an empty layer.
+
+Many NWS alerts carry ``geometry: null`` -- they are zone-based (forecast/county
+zones listed in ``affectedZones``). Each zone's polygon is fetched once and kept
+24 h. An alert whose zones cannot be resolved is returned in ``zone_only`` with
+its event and expiry, so nothing is silently dropped.
+"""
+import asyncio
+import math
+import time
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional, Tuple
+
+import httpx
+
+from app.config import settings
+from app.internal.cameras.base import safe_error
+from app.internal.logger import logger
+
+NWS_ALERTS_URL = "https://api.weather.gov/alerts/active"
+NWS_ZONE_PREFIX = "https://api.weather.gov/zones/"   # only zone URLs under this are ever fetched
+METAR_URL = "https://aviationweather.gov/api/data/metar"
+CREDIT = "National Weather Service"
+WIND_CREDIT = "NOAA Aviation Weather Center (METAR)"
+DEFAULT_USER_AGENT = "DRB scanner map (contact: set NWS_USER_AGENT)"
+
+RETRY_AFTER_FAILURE_S = 30
+ZONE_TTL_S = 24 * 3600
+ZONE_FAILURE_RETRY_S = 15 * 60
+ZONE_CONCURRENCY = 6
+# A state-wide winter event can list 100+ zones. Fetches past this cap wait for
+# the next refresh (the zone cache fills across refreshes); meanwhile the alert
+# shows in zone_only or with the zones resolved so far.
+MAX_ZONE_FETCHES_PER_REFRESH = 80
+# Wall-clock cap on one refresh's zone fetches. The refresh runs under the feed
+# lock, so without it a slow zone endpoint (20 s timeout x 80 fetches / 6 wide)
+# could hold every /weather/alerts request for minutes. Unfinished zones are
+# simply not cached and are retried next refresh.
+ZONE_BUDGET_S = 15.0
+
+WIND_TTL_S = 5 * 60
+WIND_CELL_DEG = 0.5      # wind cache cell; one upstream call per cell per TTL
+WIND_MAX_KM = 75.0       # a station farther than this says nothing about the incident's wind
+WIND_STALE_S = 2 * 3600  # older reports are returned but flagged stale
+_WIND_CACHE_MAX = 500
+
+_warned_ua = False
+
+
+def _headers(accept: str) -> Dict[str, str]:
+    global _warned_ua
+    ua = settings.nws_user_agent or DEFAULT_USER_AGENT
+    if (ua == DEFAULT_USER_AGENT or "example.com" in ua) and not _warned_ua:
+        _warned_ua = True
+        logger.warning("NWS_USER_AGENT is the placeholder -- set it to 'app (contact email)'; NWS may block us")
+    return {"User-Agent": ua, "Accept": accept}
+
+
+# ── geometry helpers ─────────────────────────────────────────────────────────
+
+def _polygons(geom: Any) -> List[Any]:
+    """Polygon coordinate arrays out of a Polygon / MultiPolygon / GeometryCollection."""
+    if not isinstance(geom, dict):
+        return []
+    t = geom.get("type")
+    if t == "Polygon" and isinstance(geom.get("coordinates"), list):
+        return [geom["coordinates"]]
+    if t == "MultiPolygon" and isinstance(geom.get("coordinates"), list):
+        return list(geom["coordinates"])
+    if t == "GeometryCollection":
+        return [p for g in geom.get("geometries") or [] for p in _polygons(g)]
+    return []
+
+
+def _merge(polys: List[Any]) -> Optional[Dict[str, Any]]:
+    if not polys:
+        return None
+    if len(polys) == 1:
+        return {"type": "Polygon", "coordinates": polys[0]}
+    return {"type": "MultiPolygon", "coordinates": polys}
+
+
+def _bbox(geom: Optional[Dict[str, Any]]) -> Optional[List[float]]:
+    """[south, west, north, east] of a (Multi)Polygon, or None."""
+    lats: List[float] = []
+    lons: List[float] = []
+    for poly in _polygons(geom):
+        for ring in poly:
+            for pt in ring:
+                try:
+                    lons.append(float(pt[0]))
+                    lats.append(float(pt[1]))
+                except (TypeError, ValueError, IndexError):
+                    continue
+    if not lats:
+        return None
+    return [min(lats), min(lons), max(lats), max(lons)]
+
+
+def intersects(b: Optional[List[float]], south: float, west: float, north: float, east: float) -> bool:
+    return b is not None and b[0] <= north and b[2] >= south and b[1] <= east and b[3] >= west
+
+
+# ── NWS alerts ───────────────────────────────────────────────────────────────
+
+def normalize_alert(feature: Any) -> Optional[Dict[str, Any]]:
+    """One GeoJSON feature -> our record (geometry may still be None). None if unparseable."""
+    if not isinstance(feature, dict):
+        return None
+    p = feature.get("properties")
+    if not isinstance(p, dict):
+        return None
+    aid = p.get("id") or feature.get("id")
+    event = p.get("event")
+    if not aid or not event:
+        return None
+    geometry = _merge(_polygons(feature.get("geometry")))
+    zones = [z for z in (p.get("affectedZones") or []) if isinstance(z, str)]
+    return {
+        "id": aid,
+        "event": event,
+        "severity": p.get("severity"),
+        "urgency": p.get("urgency"),
+        "headline": p.get("headline"),
+        "onset": p.get("onset"),
+        "expires": p.get("expires"),
+        "ends": p.get("ends"),
+        "sender_name": p.get("senderName"),   # an NWS office ("NWS Upton NY"), not a person
+        "area_desc": p.get("areaDesc"),
+        "geometry": geometry,
+        "geometry_source": "alert" if geometry else None,
+        "zones": zones,
+    }
+
+
+class _ZoneCache:
+    def __init__(self):
+        self._entries: Dict[str, Tuple[float, Optional[List[Any]]]] = {}   # url -> (expires_at, polygons|None)
+
+    def get(self, url: str) -> Tuple[bool, Optional[List[Any]]]:
+        e = self._entries.get(url)
+        if e is None or e[0] < time.time():
+            return False, None
+        return True, e[1]
+
+    def put(self, url: str, polys: Optional[List[Any]]):
+        ttl = ZONE_TTL_S if polys else ZONE_FAILURE_RETRY_S
+        self._entries[url] = (time.time() + ttl, polys)
+
+    def purge(self):
+        now = time.time()
+        for k in [k for k, e in self._entries.items() if e[0] < now]:
+            del self._entries[k]
+
+    def clear(self):
+        self._entries.clear()
+
+
+zones = _ZoneCache()
+
+
+async def _fetch_zone(client: "httpx.AsyncClient", url: str, sem: asyncio.Semaphore) -> None:
+    async with sem:
+        try:
+            r = await client.get(url, headers=_headers("application/geo+json"))
+            r.raise_for_status()
+            polys = _polygons(r.json().get("geometry"))
+        except Exception as e:
+            logger.warning(f"NWS zone {url} unresolved: {safe_error(e)}")
+            polys = []
+        zones.put(url, polys or None)
+
+
+async def _resolve_zones(client: "httpx.AsyncClient", alerts: List[Dict[str, Any]]) -> None:
+    """Fill geometry for zone-based alerts in place, from the 24 h zone cache."""
+    zones.purge()
+    wanted: List[str] = []
+    for a in alerts:
+        if a["geometry"] is None:
+            for z in a["zones"]:
+                if z.startswith(NWS_ZONE_PREFIX) and not zones.get(z)[0] and z not in wanted:
+                    wanted.append(z)
+    if wanted:
+        sem = asyncio.Semaphore(ZONE_CONCURRENCY)
+        try:
+            await asyncio.wait_for(
+                asyncio.gather(*(_fetch_zone(client, z, sem) for z in wanted[:MAX_ZONE_FETCHES_PER_REFRESH])),
+                timeout=ZONE_BUDGET_S)
+        except asyncio.TimeoutError:
+            logger.warning(f"NWS zone fetches over {ZONE_BUDGET_S:.0f}s budget; the rest resolve next refresh")
+    for a in alerts:
+        if a["geometry"] is not None:
+            continue
+        polys: List[Any] = []
+        missing = 0
+        for z in a["zones"]:
+            hit, p = zones.get(z)
+            if hit and p:
+                polys.extend(p)
+            else:
+                missing += 1
+        a["geometry"] = _merge(polys)
+        if a["geometry"] is not None:
+            a["geometry_source"] = "zones"
+            a["zones_unresolved"] = missing   # >0: drawn area is smaller than the real one
+
+
+async def _fetch_alerts() -> Tuple[List[Dict[str, Any]], List[Dict[str, Any]]]:
+    area = ",".join(s.strip().upper() for s in (settings.nws_area or "").split(",") if s.strip())
+    if not area:
+        raise ValueError("NWS_AREA is empty -- no state/marine area to ask NWS for")
+    async with httpx.AsyncClient(timeout=20.0) as client:
+        r = await client.get(NWS_ALERTS_URL, params={"area": area}, headers=_headers("application/geo+json"))
+        r.raise_for_status()
+        raw = r.json()
+        features = raw.get("features") if isinstance(raw, dict) else None
+        if not isinstance(features, list):
+            raise ValueError("NWS alerts payload has no 'features' list -- schema change?")
+        parsed = [a for a in (normalize_alert(f) for f in features) if a is not None]
+        if features and not parsed:
+            raise ValueError(f"0 of {len(features)} NWS alerts parsed -- schema change?")
+        await _resolve_zones(client, parsed)
+    mapped, zone_only = [], []
+    for a in parsed:
+        a["bbox"] = _bbox(a["geometry"])
+        if a["geometry"] is None:
+            zone_only.append({k: v for k, v in a.items() if k not in ("geometry", "geometry_source", "bbox")})
+        else:
+            mapped.append(a)
+    return mapped, zone_only
+
+
+class _AlertsFeed:
+    def __init__(self):
+        self.alerts: List[Dict[str, Any]] = []
+        self.zone_only: List[Dict[str, Any]] = []
+        self.fetched_at: Optional[float] = None   # epoch s of last SUCCESSFUL fetch
+        self.error: Optional[str] = None
+        self._next_attempt = 0.0
+        self._lock = asyncio.Lock()
+
+    async def get(self) -> "_AlertsFeed":
+        if time.time() < self._next_attempt:
+            return self
+        async with self._lock:   # single flight: waiters see the refreshed state
+            if time.time() < self._next_attempt:
+                return self
+            ttl = max(30, int(settings.weather_alerts_ttl_s))
+            try:
+                self.alerts, self.zone_only = await _fetch_alerts()
+                self.fetched_at = time.time()
+                self.error = None
+                self._next_attempt = time.time() + ttl
+            except Exception as e:
+                self._next_attempt = time.time() + min(ttl, RETRY_AFTER_FAILURE_S)
+                self.error = safe_error(e)
+                logger.warning(f"NWS alerts refresh failed, serving {len(self.alerts)} cached: {self.error}")
+        return self
+
+
+alerts = _AlertsFeed()
+
+
+# ── METAR wind ───────────────────────────────────────────────────────────────
+
+def haversine_km(lat1: float, lon1: float, lat2: float, lon2: float) -> float:
+    p1, p2 = math.radians(lat1), math.radians(lat2)
+    dp, dl = p2 - p1, math.radians(lon2 - lon1)
+    a = math.sin(dp / 2) ** 2 + math.cos(p1) * math.cos(p2) * math.sin(dl / 2) ** 2
+    return 6371.0 * 2 * math.asin(min(1.0, math.sqrt(a)))
+
+
+def normalize_metar(x: Any) -> Optional[Dict[str, Any]]:
+    if not isinstance(x, dict) or not x.get("icaoId"):
+        return None
+    try:
+        lat, lon = float(x["lat"]), float(x["lon"])
+    except (KeyError, TypeError, ValueError):
+        return None
+    wspd = x.get("wspd")
+    if not isinstance(wspd, (int, float)):
+        return None   # no wind group in this report
+    wdir = x.get("wdir")
+    variable = isinstance(wdir, str) and wdir.upper() == "VRB"
+    obs = x.get("obsTime")
+    obs_iso = (datetime.fromtimestamp(obs, tz=timezone.utc).isoformat().replace("+00:00", "Z")
+               if isinstance(obs, (int, float)) else x.get("reportTime"))
+    gust = x.get("wgst")
+    return {
+        "station": x["icaoId"],
+        "station_name": x.get("name") or "",
+        "lat": lat, "lon": lon,
+        "obs_epoch": obs if isinstance(obs, (int, float)) else None,
+        "obs_time": obs_iso,
+        "wind_dir_deg": wdir if isinstance(wdir, (int, float)) else None,
+        "variable": variable,
+        "wind_kt": wspd,
+        "gust_kt": gust if isinstance(gust, (int, float)) else None,
+        "raw": x.get("rawOb"),
+    }
+
+
+class _WindCell:
+    def __init__(self):
+        self.stations: List[Dict[str, Any]] = []
+        self.fetched_at: Optional[float] = None
+        self.error: Optional[str] = None
+        self.next_attempt = 0.0
+        self.lock = asyncio.Lock()
+
+
+_wind_cells: Dict[Tuple[int, int], _WindCell] = {}
+
+
+def _cell_key(lat: float, lon: float) -> Tuple[int, int]:
+    return (math.floor(lat / WIND_CELL_DEG), math.floor(lon / WIND_CELL_DEG))
+
+
+async def _fetch_metars(key: Tuple[int, int]) -> List[Dict[str, Any]]:
+    # Search box = the cell padded by WIND_MAX_KM, so every point in the cell sees
+    # every station within WIND_MAX_KM of it.
+    s, w = key[0] * WIND_CELL_DEG, key[1] * WIND_CELL_DEG
+    n, e = s + WIND_CELL_DEG, w + WIND_CELL_DEG
+    pad_lat = WIND_MAX_KM / 111.0
+    pad_lon = WIND_MAX_KM / (111.0 * max(0.2, math.cos(math.radians(max(abs(s), abs(n))))))
+    bbox = f"{s - pad_lat:.3f},{w - pad_lon:.3f},{n + pad_lat:.3f},{e + pad_lon:.3f}"
+    async with httpx.AsyncClient(timeout=15.0) as client:
+        r = await client.get(METAR_URL, params={"bbox": bbox, "format": "json"}, headers=_headers("application/json"))
+        r.raise_for_status()
+        if r.status_code == 204 or not r.content.strip():
+            return []   # no station in the box
+        raw = r.json()
+    if not isinstance(raw, list):
+        raise ValueError(f"METAR API: expected a JSON list, got {type(raw).__name__}")
+    latest: Dict[str, Dict[str, Any]] = {}
+    for m in (normalize_metar(x) for x in raw):
+        if m is None:
+            continue
+        cur = latest.get(m["station"])
+        if cur is None or (m["obs_epoch"] or 0) > (cur["obs_epoch"] or 0):
+            latest[m["station"]] = m
+    # Schema canary: reports without a wind group are normal, but if NO record even
+    # has a station id and position, the field names changed under us.
+    if raw and not any(isinstance(x, dict) and x.get("icaoId") and "lat" in x for x in raw):
+        raise ValueError(f"0 of {len(raw)} METAR records parsed -- schema change?")
+    return list(latest.values())
+
+
+async def _cell(lat: float, lon: float) -> _WindCell:
+    key = _cell_key(lat, lon)
+    cell = _wind_cells.get(key)
+    if cell is None:
+        if len(_wind_cells) >= _WIND_CACHE_MAX:   # bound memory: drop expired cells, then the oldest
+            for k in [k for k, c in _wind_cells.items() if c.next_attempt < time.time() and not c.lock.locked()]:
+                del _wind_cells[k]
+            if len(_wind_cells) >= _WIND_CACHE_MAX:
+                del _wind_cells[min(_wind_cells, key=lambda k: _wind_cells[k].next_attempt)]
+        cell = _wind_cells[key] = _WindCell()
+    if time.time() < cell.next_attempt:
+        return cell
+    async with cell.lock:
+        if time.time() < cell.next_attempt:
+            return cell
+        try:
+            cell.stations = await _fetch_metars(key)
+            cell.fetched_at = time.time()
+            cell.error = None
+            cell.next_attempt = time.time() + WIND_TTL_S
+        except Exception as e:
+            cell.next_attempt = time.time() + RETRY_AFTER_FAILURE_S
+            cell.error = safe_error(e)
+            logger.warning(f"METAR refresh for cell {key} failed, serving {len(cell.stations)} cached: {cell.error}")
+    return cell
+
+
+async def nearest_wind(lat: float, lon: float) -> Dict[str, Any]:
+    """Wind from the nearest METAR station within WIND_MAX_KM, or a clear reason why not."""
+    cell = await _cell(lat, lon)
+    base = {"fetched_at": cell.fetched_at, "error": cell.error, "credit": WIND_CREDIT}
+    ranked = sorted(((haversine_km(lat, lon, s["lat"], s["lon"]), s) for s in cell.stations), key=lambda t: t[0])
+    if not ranked or ranked[0][0] > WIND_MAX_KM:
+        if cell.fetched_at is None:
+            reason = f"METAR feed unavailable: {cell.error}" if cell.error else "METAR feed not fetched yet"
+        else:
+            reason = f"no METAR station reporting wind within {WIND_MAX_KM:.0f} km"
+        return {**base, "available": False, "reason": reason, "wind": None}
+    dist, s = ranked[0]
+    stale = s["obs_epoch"] is not None and time.time() - s["obs_epoch"] > WIND_STALE_S
+    wind = {k: v for k, v in s.items() if k not in ("obs_epoch",)}
+    wind["distance_km"] = round(dist, 1)
+    wind["stale"] = stale
+    return {**base, "available": True, "reason": None, "wind": wind}

drb-c2-core/app/main.py

@@ -19,12 +19,14 @@ from app.internal.auth import (
 )
 from app.routers import nodes, systems, calls, upload, tokens, incidents, alerts, admin, trips, places, links, users
 from app.routers import enrollment, media, org, waitlist, telemetry, replay, traffic, cameras
+from app.routers import outages, weather
 from app.routers import discord as discord_router
 from app.routers import discord_link as discord_link_router
 from app.internal import dynsec
 from app.internal import firestore as fstore
 from app.routers import discord_web
 from app.routers import discord_checks
+from app.routers import discord_oauth
 
 
 async def _clear_legacy_token_flags():
@@ -147,6 +149,9 @@ app.include_router(places.router,    dependencies=[Depends(require_service_or_fi
 app.include_router(traffic.router,   dependencies=[Depends(require_service_or_firebase_token)])
 app.include_router(cameras.router,   dependencies=[Depends(require_service_or_firebase_token)])
 app.include_router(cameras.admin_router)  # auth: admin only, per endpoint (needs the principal for audit)
+app.include_router(outages.router,   dependencies=[Depends(require_service_or_firebase_token)])
+app.include_router(outages.admin_router)  # auth: admin only, per endpoint (needs the principal for audit)
+app.include_router(weather.router,    dependencies=[Depends(require_service_or_firebase_token)])  # auth: any signed-in user/service, like traffic
 app.include_router(upload.router)    # auth is per-node, handled inline
 app.include_router(admin.router)     # auth is per-endpoint (read: firebase, write: admin)
 app.include_router(replay.router)    # auth: admin only (every route spends or reads a replay run)
@@ -166,6 +171,7 @@ app.include_router(discord_web.router)
 app.include_router(discord_router.router)
 app.include_router(discord_link_router.router)  # auth per-endpoint (org owner / bot service key) — server-26#213
 app.include_router(discord_checks.router)  # auth per-endpoint (org member / service key or admin) — server-26#225
+app.include_router(discord_oauth.router)  # auth per-endpoint (org owner / signed-in starter); 404 while OAuth is off — #225 S6
 # NOTE: there used to be an app.routers.mqtt_auth router here (an HTTP
 # backend for the mosquitto-go-auth plugin). That plugin's upstream project
 # is archived (no CVE patches) and was rejected for an internet-facing

drb-c2-core/app/routers/admin.py

@@ -109,9 +109,9 @@ async def debug_correlation(
             "scene_index":            scene_index,
             "transcript":             scene.get("transcript"),
             "incident_id":            scene.get("incident_id"),
-            # server-26#139: this scene's OWN incident_type/severity, as seen
-            # by _call_is_substanceless at decision time — not the call doc's
-            # flat top-level field, which is last-scene-wins (server-26#96).
+            # server-26#139: this scene's OWN incident_type/severity at decision
+            # time — not the call doc's flat top-level field, which is
+            # last-scene-wins (server-26#96).
             "incident_type":          scene.get("incident_type"),
             "severity":               scene.get("severity"),
             "corr_path":              corr_debug.get("corr_path"),
@@ -126,7 +126,7 @@ async def debug_correlation(
             "corr_llm_reasoning":     corr_debug.get("corr_llm_reasoning"),
             "corr_llm_action":        corr_debug.get("corr_llm_action"),
             "corr_rules_action":      corr_debug.get("corr_rules_action"),
-            "corr_gate_veto":         corr_debug.get("corr_gate_veto"),
+            "corr_band":              corr_debug.get("corr_band"),
         }
 
     def _call_summary(call: dict) -> dict:
@@ -173,20 +173,18 @@ async def debug_correlation(
             "corr_matched_units":    call.get("corr_matched_units"),
             "corr_sweep_count":      call.get("corr_sweep_count"),
             "skip_reason":           call.get("skip_reason"),
-            # LLM consensus tier fields — written by upload.py's
-            # _correlate_with_consensus / llm_correlator.py, but previously
-            # dropped here, making it impossible to tell from this endpoint
-            # whether the LLM correlation tier is actually running (server-26#24).
+            # LLM tier fields — written by upload.py's _correlate /
+            # llm_correlator.py, but previously dropped here, making it
+            # impossible to tell from this endpoint whether the LLM
+            # correlation tier is actually running (server-26#24).
             "corr_consensus":        call.get("corr_consensus"),
             "corr_llm_reasoning":    call.get("corr_llm_reasoning"),
             "corr_llm_action":       call.get("corr_llm_action"),
             "corr_rules_action":     call.get("corr_rules_action"),
-            # server-26#115 — why an llm=orphan/rules=new disagreement escalated
-            # to tiebreak instead of being gated (see upload.py's
-            # _call_is_substanceless). Present only on that disagreement shape;
-            # written here specifically so a live measurement window can read
-            # the reason instead of reconstructing it by hand from the dump.
-            "corr_gate_veto":        call.get("corr_gate_veto"),
+            # server-26#299 — why the rules marked this decision ambiguous and
+            # sent it to the LLM (incident_correlator._ambiguity). Absent on a
+            # confident rules decision.
+            "corr_band":             call.get("corr_band"),
             # server-26#127 — shadow-mode upstream chatter classifier verdict.
             # Written by intelligence.extract_scenes on every transcript that
             # reaches real scene extraction (not on garbage/too-short skips).
@@ -298,7 +296,8 @@ async def debug_correlation(
         orphans_by_tg[tg_key]["count"] += 1
         if not o.get("incident_type") and not o.get("tags"):
             orphans_by_tg[tg_key]["no_type_count"] += 1
-        if (o.get("corr_sweep_count") or 0) >= 3:
+        # Tombstoned by the sweep's wall-clock budget (server-26#27).
+        if o.get("corr_path") == "unlinked":
             orphans_by_tg[tg_key]["sweep_exhausted_count"] += 1
 
     # ── Summary ───────────────────────────────────────────────────────────────
@@ -374,9 +373,8 @@ async def debug_correlation(
         "corr_fit_signal":        _tally(e.get("corr_fit_signal") for e in scene_entries),
         "corr_consensus":         _tally(e.get("corr_consensus") for e in scene_entries),
         "corr_llm_action":        _tally(e.get("corr_llm_action") for e in scene_entries),
-        # server-26#115 — this IS the number the escape-hatch fix exists to
-        # produce: why each llm=orphan/rules=new call escaped the gate.
-        "corr_gate_veto":         _tally(e.get("corr_gate_veto") for e in scene_entries),
+        # server-26#299 — how often, and why, the LLM tier was consulted.
+        "corr_band":              _tally(e.get("corr_band") for e in scene_entries),
         # server-26#127 — shadow-mode chatter classifier. The target
         # population is non-events, which land as orphans or single-call
         # incidents, NOT as a slice of every linked call -- tally `orphans`

drb-c2-core/app/routers/alerts.py

@@ -28,6 +28,27 @@ async def list_alerts(
     return await fstore.collection_list("alert_events", **filters)
 
 
+@router.get("/alerts/held")
+async def list_held_alerts(
+    status: Optional[str] = Query("held", description="held | released | superseded | rule_gone; empty = all"),
+    org_id: Optional[str] = Query(None, description="Platform-admin only — omit for every org."),
+    _: dict = Depends(require_admin_token),
+):
+    """
+    Rule matches the confidence gate kept from being pushed (server-26#300).
+    Admin-only: a held match is by definition one we do not trust enough to
+    show, so it does not belong on any customer surface (and alert_holds has
+    no Firestore rule, so the browser cannot read it directly either).
+    """
+    filters = {}
+    if status:
+        filters["status"] = status
+    if org_id:
+        filters["org_id"] = org_id
+    holds = await fstore.collection_list("alert_holds", **filters)
+    return sorted(holds, key=lambda h: h.get("triggered_at") or "", reverse=True)
+
+
 @router.post("/alerts/{alert_id}/acknowledge")
 async def acknowledge_alert(alert_id: str, decoded: dict = Depends(require_service_or_firebase_token)):
     doc = await fstore.doc_get("alert_events", alert_id)

drb-c2-core/app/routers/discord.py

@@ -17,7 +17,6 @@ Auth:
 from __future__ import annotations
 
 import secrets
-from datetime import datetime, timezone
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Path, Security
@@ -26,6 +25,7 @@ from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from pydantic import BaseModel, Field
 
 from app.config import settings
+from app.internal import discord_guild_link as glink
 from app.internal import discord_leases as leases
 from app.internal import discord_rest
 from app.internal import discord_streams as streams
@@ -138,6 +138,7 @@ async def start_stream(body: StreamStart, _: dict = Depends(require_service_key_
             mode=body.mode, channel_name=body.channel_name, guild_name=body.guild_name,
             created_by=body.created_by, preferred_token_id=body.preferred_token_id,
             max_streams=settings.discord_guild_max_streams, stream_id=body.stream_id,
+            interactive=True,   # /join, the admin page: re-read a stale "denied" (server-26#251)
         )
     except streams.StreamError as e:
         return _error(e)
@@ -181,23 +182,18 @@ async def link_guild(guild_id: str, body: GuildLink, decoded: dict = Depends(req
     org = await fstore.doc_get("organizations", body.org_id)
     if not org:
         raise HTTPException(404, "Organization not found.")
-    previous_org = await streams.resolve_guild_org(guild_id)
-    doc = {
-        "guild_id": guild_id, "org_id": body.org_id,
-        "linked_by": decoded.get("uid"), "linked_at": datetime.now(timezone.utc).isoformat(),
-        # Re-linking a server that was unlinked or removed brings it back.
-        "unlinked_at": None, "unlinked_by": None, "removed_at": None, "removed_by": None,
-    }
-    if body.guild_name and body.guild_name.strip():
-        doc["guild_name"] = body.guild_name.strip()[:100]
-    await fstore.doc_set(streams.GUILDS, guild_id, doc)
-    # Live channels in this server were placed on the previous org's nodes;
-    # left running, the reconciler would keep re-placing them there, so one
-    # org's equipment would keep serving a server that now belongs to another.
-    stopped: list[str] = []
-    if previous_org and previous_org != body.org_id:
-        stopped = await streams.stop_guild(guild_id, "server linked to another organization")
-    return {"ok": True, "guild_id": guild_id, "org_id": body.org_id, "stopped": stopped}
+    # Support override: may move a server between orgs. Re-linking a server
+    # that was unlinked or removed brings it back. Live channels placed on the
+    # previous org's nodes are stopped (glink._settle) — left running, the
+    # reconciler would keep re-placing them there.
+    out = await glink.link_and_settle(body.org_id, guild_id, body.guild_name, decoded.get("uid") or "admin",
+                                      "admin", allow_move=True, stop_reason=glink.ADMIN_RELINK_STOP_REASON)
+    uid, email = describe_actor(decoded)
+    await write_audit(uid, email, "discord.guild.link", details={
+        "guild_id": guild_id, "org_id": body.org_id, "previous_org_id": out["previous_org_id"],
+        "already_linked": out["already_linked"], "streams_stopped": len(out["streams_stopped"]), "via": "admin",
+    })
+    return {"ok": True, "guild_id": guild_id, "org_id": body.org_id, "stopped": out["streams_stopped"]}
 
 
 @router.delete("/streams/{stream_id}")
@@ -273,6 +269,11 @@ async def admin_overview(_: dict = Depends(require_admin_token)):
     Radio bots come from ``GET /tokens``; no token string is returned here.
     Discord user ids (``created_by_discord_id``) and the linking admin's uid
     are deliberately left out.
+
+    Per server, ``main_bot_present`` (the DRB server bot — optional since
+    server-26#225: True/False as it last reported, None = never heard from it
+    there) and ``radio_bots`` (names of radio bots Discord last said are in
+    it). A server with radio bots and no server bot is a normal setup.
     """
     links = {str(g.get("guild_id")): g for g in await fstore.collection_list(streams.GUILDS)
              if g.get("guild_id")}
@@ -288,6 +289,11 @@ async def admin_overview(_: dict = Depends(require_admin_token)):
             continue  # removed from DRB (DELETE /discord/guilds/{id}); re-listed if it gets a channel again
         guilds[gid] = {"guild_id": gid, "guild_name": link.get("guild_name"), "linked": bool(link.get("org_id")),
                        "org_id": link.get("org_id"), "linked_at": link.get("linked_at"),
+                       "linked_via": link.get("linked_via"),
+                       # The DRB server bot is optional (server-26#225 S8): True/False
+                       # = it said it is / is not in the server, None = never heard.
+                       "main_bot_present": link.get("bot_present"),
+                       "directory_source": link.get("directory_source"),
                        # Explicitly unlinked servers get no fallback org (mirrors
                        # streams.resolve_guild_org once server-26#218 lands).
                        "_no_fallback": bool(link.get("unlinked_at"))}
@@ -295,7 +301,8 @@ async def admin_overview(_: dict = Depends(require_admin_token)):
     for s in all_streams:
         gid = str(s.get("guild_id") or leases.guild_of(s.get("stream_id") or ""))
         g = guilds.setdefault(gid, {"guild_id": gid, "guild_name": None, "linked": False,
-                                    "org_id": None, "linked_at": None})
+                                    "org_id": None, "linked_at": None, "linked_via": None,
+                                    "main_bot_present": None, "directory_source": None})
         if s.get("guild_name") and not g.get("guild_name"):
             g["guild_name"] = s["guild_name"]
         node = nodes.get(s.get("node_id")) or {}
@@ -309,6 +316,11 @@ async def admin_overview(_: dict = Depends(require_admin_token)):
         g["acting_org_id"] = acting
         g["acting_org_name"] = (orgs.get(acting) or {}).get("name") if acting else None
         g["live_streams"] = sum(1 for r in rows if r.get("guild_id") == g["guild_id"] and r.get("desired") == "on")
+        # Radio bots Discord last said are in the server (names only). Any one
+        # of them is enough to list channels, check permissions and stream.
+        g["radio_bots"] = sorted(str(t.get("name") or tid) for tid, t in tokens.items()
+                                 if t.get("valid") is not False and isinstance(t.get("guild_ids"), list)
+                                 and g["guild_id"] in t["guild_ids"])
 
     # Streams sharing a voice channel sit together, oldest first.
     rows.sort(key=lambda r: (0 if r.get("desired") == "on" else 1, r.get("guild_name") or r.get("guild_id") or "",

drb-c2-core/app/routers/discord_checks.py

@@ -84,6 +84,8 @@ def _channel_state(rows: list[dict], enabled: bool) -> str:
         return "needs_fix"        # a start is refused with missing_permissions
     if any(r["ok"] for r in rows):
         return "busy"
+    if any(r["status"] == discord_rest.INVALID for r in rows):
+        return "invalid"          # the bot IS here, but Discord rejected its token (#257)
     return "no_bot"
 
 

drb-c2-core/app/routers/discord_link.py

@@ -101,23 +101,21 @@ async def redeem_link_code(guild_id: str, body: RedeemBody, principal: dict = De
     redeem_guild_limiter.check(f"guild:{guild_id}")
     redeem_user_limiter.check(f"user:{body.discord_user_id}")
     actor = f"discord:{body.discord_user_id}"
-    before = await streams.resolve_guild_org(guild_id)
     try:
-        result = await glink.redeem_code(body.code, guild_id, body.guild_name, body.discord_user_id)
+        # Links, then stops anything the server had playing for the org it
+        # acted for before (the DISCORD_UNLINKED_GUILD_ORG_ID fallback).
+        result = await glink.redeem_and_settle(body.code, guild_id, body.guild_name, body.discord_user_id)
     except glink.LinkError as e:
         await write_audit(actor, "", "discord.guild.link_refused",
                           details={"guild_id": guild_id, "reason": e.code})
         return JSONResponse(status_code=e.status, content={"detail": e.message, "code": e.code})
 
     org_id = result["org_id"]
-    stopped: list = []
-    if before and before != org_id:
-        # The server was acting for DISCORD_UNLINKED_GUILD_ORG_ID; anything it
-        # had playing belongs to that org, not the one it just linked to.
-        stopped = await streams.stop_guild(guild_id, "relinked")
+    stopped = result["streams_stopped"]
     await write_audit(actor, "", "discord.guild.link", details={
         "guild_id": guild_id, "org_id": org_id, "already_linked": result["already_linked"],
         "code_created_by_uid": result.get("created_by_uid"), "streams_stopped": len(stopped),
+        "via": "code",
     })
     logger.info(f"Discord guild {guild_id} linked to org={org_id!r} by {actor}")
     org = await fstore.doc_get("organizations", org_id)

drb-c2-core/app/routers/discord_oauth.py

@@ -0,0 +1,310 @@
+"""
+"Connect a Discord server" through a radio bot's own OAuth2 invite
+(server-26#225 S6, owner decision Q1 = per-bot OAuth).
+
+  GET  /discord/oauth/options   org owner / platform admin — which bot Connect
+                                would invite (no state minted). 404 = off.
+  POST /discord/oauth/start     org owner / platform admin — mint a state,
+                                return Discord's authorize URL
+  POST /discord/oauth/complete  signed-in user who started it — exchange the
+                                code, link the server, check permissions
+
+Platform admins may pass ?org_id= to act for another org (resolve_org_scope).
+Every route is a 404 while ``discord_oauth_redirect_uri`` is empty or no
+eligible bot has an OAuth secret (PUT /tokens/{id}/oauth).
+
+Which bot (``_pick_bot``): an explicit ``token_id`` the org may use; else the
+radio bot preferred for ``system_id`` (the org's own system or a shared one;
+strict: a preferred bot that can't connect is a 404, not a quiet swap); else
+the radio bot preferred for the node's system (``node_id``); else the org's own
+bring-your-own bot; else the pool bot with the fewest servers that is under
+``discord_pool_bot_guild_cap`` (owner decision Q3). Only bots with an OAuth
+secret set count. A bot the caller's org can't use is a 404, never a 403.
+
+The org a server links to is the one the STATE names, re-checked against a
+fresh read of the caller's membership; the server is the one Discord's code
+exchange names. The redirect's ``guild_id`` query parameter is ignored.
+
+This reverses ``discord_web``'s old "C2 never calls Discord on the browser's
+behalf" on purpose (plan finding 5): the call is made with the bot
+application's credentials, after the org-scope checks and rate limits here.
+"""
+from __future__ import annotations
+
+import asyncio
+from typing import Annotated, Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel, Field
+
+from app.config import settings
+from app.internal import discord_guild_link as glink
+from app.internal import discord_leases as leases
+from app.internal import discord_oauth as oauth
+from app.internal import discord_rest
+from app.internal import discord_streams as streams
+from app.internal import firestore as fstore
+from app.internal.audit import write_audit
+from app.internal.auth import (
+    _RateLimiter, describe_actor, get_role, require_firebase_token, require_org_owner_token, resolve_org_scope,
+)
+from app.internal.logger import logger
+from app.routers.discord_checks import voice_check
+
+router = APIRouter(prefix="/discord/oauth", tags=["discord"])
+
+start_limiter = _RateLimiter(max_calls=5, window_seconds=600)
+complete_limiter = _RateLimiter(max_calls=10, window_seconds=600)
+_ID = r"^[A-Za-z0-9_-]{1,64}$"
+_OFF = "Connecting a Discord server through DRB isn't available."
+
+
+def _require_enabled() -> None:
+    if not oauth.enabled():
+        raise HTTPException(404, _OFF)
+
+
+def _err(status: int, code: str, message: str, **extra) -> JSONResponse:
+    return JSONResponse(status_code=status, content={"detail": message, "code": code, **extra})
+
+
+def _server_count(tok: dict) -> Optional[int]:
+    members = tok.get("guild_ids")
+    return len(members) if isinstance(members, list) else None
+
+
+def _usable(tok: dict, org_id: str, oauth_ids: set) -> bool:
+    return (tok.get("token_id") in oauth_ids
+            and tok.get("valid") is not False
+            and bool(tok.get("application_id"))
+            and tok.get("org_id") in (None, org_id)
+            and leases.invitable(tok))
+
+
+async def _pick_bot(org_id: str, *, node_id: Optional[str] = None,
+                    token_id: Optional[str] = None, system_id: Optional[str] = None) -> tuple[dict, str]:
+    """(token doc, why) — why is ``chosen`` | ``preferred`` | ``org_bot`` |
+    ``pool``. Raises HTTPException 404 when nothing fits."""
+    tokens = {t["token_id"]: t for t in await fstore.collection_list(leases.TOKENS) if t.get("token_id")}
+    oauth_ids = await oauth.enabled_token_ids()
+
+    if token_id:
+        tok = tokens.get(token_id)
+        if not tok or tok.get("org_id") not in (None, org_id):
+            raise HTTPException(404, "Radio bot not found.")
+        if not _usable(tok, org_id, oauth_ids):
+            raise HTTPException(404, f"{tok.get('name') or 'That radio bot'} can't be used to connect a server "
+                                     "right now.")
+        return tok, "chosen"
+
+    if system_id:
+        # Same visibility as a node's system: the org's own or a shared one
+        # (no org_id). Another org's system is a 404, never a 403.
+        system = await fstore.doc_get("systems", system_id)
+        if not system or system.get("org_id") not in (None, org_id):
+            raise HTTPException(404, "System not found.")
+        pref_id = system.get("preferred_token_id") or ""
+        if pref_id:
+            # The caller asked for THIS system's bot by name: inviting a
+            # different one instead would be the silent swap this exists to stop.
+            pref = tokens.get(pref_id)
+            if not pref or not _usable(pref, org_id, oauth_ids):
+                raise HTTPException(404, "That system's radio bot can't be used to connect a server right now.")
+            return pref, "preferred"
+
+    if node_id:
+        node = await fstore.doc_get("nodes", node_id)
+        if not node or node.get("org_id") != org_id:
+            raise HTTPException(404, "Node not found.")
+        system_id = streams._effective_system(node)
+        system = await fstore.doc_get("systems", system_id) if system_id else None
+        pref = tokens.get((system or {}).get("preferred_token_id") or "")
+        if pref and _usable(pref, org_id, oauth_ids):
+            return pref, "preferred"
+
+    own = sorted((t for t in tokens.values() if t.get("org_id") == org_id and _usable(t, org_id, oauth_ids)),
+                 key=lambda t: (str(t.get("name") or "").lower(), t["token_id"]))
+    if own:
+        return own[0], "org_bot"
+
+    cap = settings.discord_pool_bot_guild_cap
+    pool = sorted((t for t in tokens.values() if t.get("org_id") is None and _usable(t, org_id, oauth_ids)),
+                  key=lambda t: (_server_count(t) if _server_count(t) is not None else cap,
+                                 str(t.get("name") or "").lower(), t["token_id"]))
+    if pool:
+        return pool[0], "pool"
+    raise HTTPException(404, _OFF)
+
+
+def _bot_summary(tok: dict, why: str) -> dict:
+    return {"name": tok.get("name") or "DRB radio bot", "reason": why,
+            "own_bot": tok.get("org_id") is not None}
+
+
+# ---------------------------------------------------------------------------
+# Routes
+# ---------------------------------------------------------------------------
+
+@router.get("/options")
+async def oauth_options(node_id: Optional[str] = Query(None, pattern=_ID),
+                        token_id: Optional[str] = Query(None, pattern=_ID),
+                        org_id: Optional[str] = None,
+                        decoded: dict = Depends(require_org_owner_token),
+                        system_id: Annotated[Optional[str], Query(pattern=_ID)] = None):
+    """Whether Connect is offered here, and which bot it would invite."""
+    _require_enabled()
+    scope = resolve_org_scope(decoded, org_id)
+    tok, why = await _pick_bot(scope, node_id=node_id, token_id=token_id, system_id=system_id)
+    return {"available": True, "bot": _bot_summary(tok, why)}
+
+
+class StartBody(BaseModel):
+    node_id: Optional[str] = Field(None, pattern=_ID)
+    token_id: Optional[str] = Field(None, pattern=_ID)
+    system_id: Optional[str] = Field(None, pattern=_ID)
+    return_to: Optional[str] = None
+
+
+@router.post("/start")
+async def oauth_start(body: StartBody, org_id: Optional[str] = None,
+                      decoded: dict = Depends(require_org_owner_token)):
+    _require_enabled()
+    scope = resolve_org_scope(decoded, org_id)
+    uid, email = describe_actor(decoded)
+    start_limiter.check(f"{uid}:discord_oauth_start")
+    tok, why = await _pick_bot(scope, node_id=body.node_id, token_id=body.token_id,
+                               system_id=body.system_id)
+    return_to = oauth.safe_return_to(body.return_to)
+    nonce, expires_at = await oauth.create_state(org_id=scope, uid=uid, token_id=tok["token_id"],
+                                                 node_id=body.node_id, return_to=return_to)
+    await write_audit(uid, email, "discord.oauth.start", details={
+        "org_id": scope, "token_id": tok["token_id"], "reason": why, "node_id": body.node_id,
+        "system_id": body.system_id})
+    return {"authorize_url": oauth.authorize_url(str(tok["application_id"]), nonce),
+            "expires_at": expires_at.isoformat(), "bot": _bot_summary(tok, why)}
+
+
+class CompleteBody(BaseModel):
+    # Lengths checked in the handler: a pydantic 422 would echo the code back.
+    code: str
+    state: str
+
+
+async def _still_owner(decoded: dict, uid: str, org_id: str) -> bool:
+    """Fresh read: the claims in an ID token can be up to an hour old."""
+    if get_role(decoded) == "admin":
+        return True
+    member = await fstore.doc_get("org_members", uid)
+    return bool(member and member.get("org_id") == org_id and member.get("org_role") == "owner")
+
+
+async def _channel_summary(guild_id: str, org_id: str, node_id: Optional[str]) -> Optional[dict]:
+    """Permissions right after the link, within discord_oauth_link_check_seconds.
+    None = not answered in time (the picker's badges will say)."""
+    link = await fstore.doc_get(streams.GUILDS, guild_id) or {}
+    try:
+        out = await asyncio.wait_for(
+            voice_check(guild_id=guild_id, org_id=org_id, node_id=node_id,
+                        channels=link.get("voice_channels") or [], channel_id=None, refresh=True,
+                        with_token_ids=False),
+            timeout=settings.discord_oauth_link_check_seconds)
+    except Exception as e:   # timeout or anything else: the link already stands
+        logger.info(f"Discord OAuth link {guild_id}: permission check skipped ({type(e).__name__})")
+        return None
+    channels = [{"channel_id": c["channel_id"], "name": c.get("name"), "state": c["state"],
+                 "fix": next((b.get("fix") for b in c.get("bots") or [] if b.get("fix")), None)}
+                for c in out.get("channels") or []]
+    return {
+        "enabled": out.get("enabled"),
+        "channels_ready": sum(1 for c in channels if c["state"] == "ready"),
+        "channels_blocked": sum(1 for c in channels if c["state"] == "needs_fix"),
+        "channels": channels,
+    }
+
+
+@router.post("/complete")
+async def oauth_complete(body: CompleteBody, decoded: dict = Depends(require_firebase_token)):
+    _require_enabled()
+    uid, email = describe_actor(decoded)
+    complete_limiter.check(f"{uid}:discord_oauth_complete")
+    if not (0 < len(body.code) <= 200):
+        return _err(400, "code_rejected", "Discord didn't accept that sign-in. Start again from DRB.")
+
+    # 1. Consume the state (single use; must be this caller's).
+    try:
+        state = await oauth.consume_state(body.state, uid)
+    except oauth.StateError as e:
+        await write_audit(uid, email, "discord.oauth.refused", details={"reason": e.code})
+        return _err(e.status, e.code, e.message)
+    org_id, token_id = state["org_id"], state["token_id"]
+    return_to = state.get("return_to")
+
+    # 2. Still the owner of that org (fresh read, not the token's claims).
+    if not await _still_owner(decoded, uid, org_id):
+        await write_audit(uid, email, "discord.oauth.refused", details={"org_id": org_id, "reason": "not_owner"})
+        return _err(403, "not_owner", "Only the organization owner can connect a Discord server.")
+
+    # 3. Exchange the code with that bot application's own secret.
+    tok = await fstore.doc_get(leases.TOKENS, token_id)
+    secret = await oauth.load_secret(token_id)
+    if (not tok or not tok.get("application_id") or not secret
+            or tok.get("org_id") not in (None, org_id) or tok.get("valid") is False):
+        return _err(409, "bot_unavailable", "That radio bot can no longer connect servers. Start again from DRB.")
+    client_id = str(tok["application_id"])
+    r = await oauth.exchange_code(client_id, secret, body.code)
+    if not r.ok or not isinstance(r.data, dict):
+        await write_audit(uid, email, "discord.oauth.refused", details={
+            "org_id": org_id, "token_id": token_id, "reason": "exchange_failed", "status": r.status})
+        if r.status is not None and 400 <= r.status < 500 and r.status != 429:
+            return _err(400, "code_rejected", "Discord didn't accept that sign-in. Start again from DRB.")
+        return _err(502, "discord_unavailable", "Couldn't reach Discord to finish connecting. Start again from DRB.")
+    await oauth.revoke(client_id, secret, r.data.get("access_token"))
+
+    # 4. The server is the one Discord's exchange names — never the query string.
+    guild = r.data.get("guild") if isinstance(r.data.get("guild"), dict) else None
+    guild_id = str((guild or {}).get("id") or "")
+    if not guild_id.isdigit():
+        await write_audit(uid, email, "discord.oauth.refused", details={
+            "org_id": org_id, "token_id": token_id, "reason": "no_guild"})
+        return _err(400, "no_guild", "Discord didn't say which server the bot was added to. Start again from DRB.")
+    guild_name = guild.get("name") if isinstance(guild.get("name"), str) else None
+
+    # 5. Link + settle (a server another org linked is never moved: 409).
+    try:
+        result = await glink.link_and_settle(org_id, guild_id, guild_name, uid, "oauth",
+                                             extra={"linked_with_token_id": token_id})
+    except glink.LinkError as e:
+        await write_audit(uid, email, "discord.guild.link_refused", details={
+            "guild_id": guild_id, "org_id": org_id, "reason": e.code, "via": "oauth", "token_id": token_id})
+        return _err(e.status, e.code, e.message, guild_name=guild_name, bot_name=tok.get("name"))
+
+    # 6. The bot is in the server now: record it, drop stale cached answers, audit.
+    members = tok.get("guild_ids")
+    if isinstance(members, list) and guild_id not in members:
+        await fstore.doc_update(leases.TOKENS, token_id, {"guild_ids": [*members, guild_id]})
+    discord_rest.invalidate(guild_id=guild_id)
+    await write_audit(uid, email, "discord.guild.link", details={
+        "guild_id": guild_id, "org_id": org_id, "already_linked": result["already_linked"],
+        "previous_org_id": result["previous_org_id"], "streams_stopped": len(result["streams_stopped"]),
+        "via": "oauth", "token_id": token_id,
+    })
+    logger.info(f"Discord guild {guild_id} linked to org={org_id!r} via OAuth (bot {token_id}) by uid={uid}")
+
+    # 7. Which voice channels are ready, in the same request (capped).
+    check = await _channel_summary(guild_id, org_id, state.get("node_id"))
+    return {
+        "ok": True,
+        "guild_id": guild_id,
+        "guild_name": guild_name,
+        "org_id": org_id,
+        "bot_name": tok.get("name"),
+        "already_linked": result["already_linked"],
+        "streams_stopped": len(result["streams_stopped"]),
+        "node_id": state.get("node_id"),
+        "return_to": return_to,
+        "checked": check is not None,
+        "channels_ready": check["channels_ready"] if check else None,
+        "channels_blocked": check["channels_blocked"] if check else None,
+        "channels": check["channels"] if check else [],
+    }

drb-c2-core/app/routers/discord_web.py

@@ -6,15 +6,49 @@ The node page used to take raw guild/channel IDs. It now picks from:
   * the Discord servers the caller's org owns — ``discord_guilds`` docs that
     resolve to the node's org (an explicit link, or the unlinked-server
     fallback org, same rule the bot uses: streams.resolve_guild_org), and
-  * their voice channels, from a directory the DRB server bot pushes
-    (``PUT /discord/guilds/{id}/directory``). The bot already holds its
-    gateway cache of every server it is in; C2 never calls Discord with a
-    token on the browser's behalf and no token string ever reaches the browser.
+  * their voice channels, from a directory kept on ``discord_guilds/{id}``.
+
+Where the directory comes from (server-26#225 S5 — the main bot is optional):
+
+  * the DRB server bot, when it is in the server: it pushes its gateway view
+    (``PUT /discord/guilds/{id}/directory``) on start, on changes and every
+    15 minutes (``directory_source: "main_bot"``);
+  * otherwise a radio bot that is in the server: C2 reads the channel list
+    over Discord REST with that bot's token (discord_rest.guild_directory —
+    the same cached snapshot the permission check reads, so no extra
+    request) and stores it (``directory_source: "radio_bot"``,
+    ``radio_bot_present``). That happens when the picker is opened and the
+    stored list is missing (inline, inside the permission-check time budget)
+    or older than ``discord_directory_refresh_seconds`` (in the background).
+
+This reverses the old rule "C2 never calls Discord on the browser's behalf"
+on purpose (server-26#225 plan finding 5): C2 does call Discord when a
+signed-in user opens the picker, presses Start or Re-check — with a radio
+bot's token, only for a server already linked to the caller's org, through
+discord_rest's rate-limited, cached, breaker-guarded client (refresh=1 at
+most once per 10 s per user and server). No token string ever reaches the
+browser, and REST answers never create or re-link a ``discord_guilds`` doc.
+
+The DRB server bot is optional end to end (server-26#225 S8). One radio bot
+in the server is enough to link it (per-bot OAuth, routers/discord_oauth.py),
+list its voice channels (here), check permissions (routers/discord_checks.py)
+and stream (streams.start_stream). The server bot adds its slash commands
+(/join, /leave, /status, /drb link) and a gateway-fed channel list; every
+path it uses keeps working.
+
+Which servers an org sees (``_org_guilds``):
+
+  * linked to the org: shown unless the server bot said it left AND no
+    radio bot the org may use is in it (``bot_tokens.guild_ids``);
+  * acting for the org only through the unlinked-server fallback: shown only
+    while the server bot is there, exactly as before. A radio bot's
+    membership never discovers a server, and REST never creates a
+    ``discord_guilds`` doc.
 
 A pick becomes a ``discord_streams`` desired-state doc **pinned to this node**
 (streams.start_stream(node_id=...)), exactly what the old raw-ID path did, with
 the checks that path skipped: the server must belong to the node's org, the
-channel must be a voice channel the bot reported in that server, and the
+channel must be a voice channel in that server's directory, and the
 per-server and per-node stream caps apply.
 
 Auth:
@@ -29,6 +63,7 @@ Auth:
 """
 from __future__ import annotations
 
+import asyncio
 from datetime import datetime, timezone
 from typing import Optional
 
@@ -38,6 +73,7 @@ from pydantic import BaseModel, Field
 
 from app.config import settings
 from app.internal import discord_leases as leases
+from app.internal import discord_rest
 from app.internal import discord_streams as streams
 from app.internal import firestore as fstore
 from app.internal.audit import write_audit
@@ -54,6 +90,14 @@ router = APIRouter(prefix="/discord", tags=["discord"])
 
 MAX_CHANNELS = 200
 _NAME_MAX = 100
+MAIN_BOT = "main_bot"
+RADIO_BOT = "radio_bot"
+# The server bot re-pushes every 15 min. A list it pushed more than three
+# pushes ago means it is down (it never said it left): a radio bot's view
+# takes over until it is back.
+MAIN_BOT_STALE_SECONDS = 45 * 60
+# How many member radio bots are asked, one after another, for the list.
+DIRECTORY_BOTS = 3
 
 
 def _now_iso() -> str:
@@ -80,16 +124,20 @@ class GuildDirectory(BaseModel):
 @router.put("/guilds/{guild_id}/directory")
 async def put_guild_directory(guild_id: str, body: GuildDirectory, _: dict = Depends(require_service_key)):
     """The server bot's view of one Discord server: its name and voice channels.
-    Merged onto ``discord_guilds/{id}`` — never touches ``org_id`` (the link)."""
+    Merged onto ``discord_guilds/{id}`` — never touches ``org_id`` (the link).
+    Cached Discord snapshots of the server are dropped (a channel was added,
+    removed or renamed), so the next permission check reads it fresh."""
     if not guild_id.isdigit():
         raise HTTPException(400, "guild_id must be a Discord snowflake.")
     data: dict = {"guild_id": guild_id, "bot_present": body.present, "directory_at": _now_iso()}
     if body.present:
         data["voice_channels"] = [c.model_dump() for c in body.voice_channels]
+        data["directory_source"] = MAIN_BOT
         if body.name:
             # Same field the /drb link flow writes (feat/213-guild-link, PR #218).
             data["guild_name"] = body.name
     await fstore.doc_set(streams.GUILDS, guild_id, data)
+    discord_rest.invalidate(guild_id=guild_id)
     return {"ok": True, "guild_id": guild_id, "voice_channels": len(body.voice_channels)}
 
 
@@ -130,24 +178,156 @@ def _require_control(can: bool) -> None:
         raise HTTPException(403, "Only the organization owner, an admin, or this node's operator can do that.")
 
 
-async def _org_guilds(org_id: str) -> list[dict]:
-    """``discord_guilds`` docs this org may stream into, bot still present.
+async def _load_tokens() -> dict[str, dict]:
+    return {t["token_id"]: t for t in await fstore.collection_list(leases.TOKENS) if t.get("token_id")}
+
+
+def _member_radio_bots(tokens: dict[str, dict], guild_id: str, org_id: Optional[str]) -> list[str]:
+    """Radio bots this org may use (pool, or the org's own) that Discord last
+    said are in the server, best first. Unknown membership (``guild_ids``
+    None) does not count: presence has to be positive."""
+    out = [tid for tid, t in tokens.items()
+           if t.get("token") and t.get("valid") is not False and t.get("org_id") in (None, org_id)
+           and isinstance(t.get("guild_ids"), list) and guild_id in t["guild_ids"]]
+    out.sort(key=lambda tid: leases._candidate_order(tid, tokens[tid], "", org_id, None))
+    return out
+
+
+async def _org_guilds(org_id: str, tokens: Optional[dict] = None) -> list[dict]:
+    """``discord_guilds`` docs this org may stream into, with a bot there.
     Mirrors streams.resolve_guild_org: explicit link, else the unlinked-server
     fallback org — except a server an org explicitly unlinked (``unlinked_at``,
-    PR #218), which gets no fallback."""
+    PR #218), which gets no fallback.
+
+    A linked server is shown while the server bot is there or a radio bot the
+    org may use is (server-26#225 S5: the main bot is optional). A server
+    that acts for the org only through the fallback still needs the server
+    bot: a radio bot's membership never discovers one."""
     fallback = settings.discord_unlinked_guild_org_id or None
+    if tokens is None:
+        tokens = await _load_tokens()
     out = []
     for g in await fstore.collection_list(streams.GUILDS):
         gid = str(g.get("guild_id") or "")
-        if not gid or g.get("bot_present") is False:
+        if not gid:
             continue
-        owner = g.get("org_id") or (None if g.get("unlinked_at") else fallback)
-        if owner and owner == org_id:
-            out.append(g)
+        if g.get("org_id"):
+            if g["org_id"] != org_id:
+                continue
+            if g.get("bot_present") is False and not _member_radio_bots(tokens, gid, org_id):
+                continue
+        else:
+            if g.get("unlinked_at") or not fallback or fallback != org_id or g.get("bot_present") is False:
+                continue
+        out.append(g)
     out.sort(key=lambda g: ((_guild_name(g) or "").lower(), g["guild_id"]))
     return out
 
 
+# ---------------------------------------------------------------------------
+# Directory from a radio bot (server-26#225 S5)
+# ---------------------------------------------------------------------------
+
+def _age_seconds(ts) -> Optional[float]:
+    when = streams._parse_ts(ts)
+    return (datetime.now(timezone.utc) - when).total_seconds() if when else None
+
+
+def _directory_due(g: dict) -> Optional[str]:
+    """None when the stored list is fine; "missing" when there is none;
+    "stale" when it is old. Only for a server linked to an org — a fallback
+    server's list is the server bot's alone."""
+    if not g.get("org_id"):
+        return None
+    if g.get("voice_channels") is None:
+        return "missing"
+    from_main = g.get("bot_present") is True and (g.get("directory_source") or MAIN_BOT) == MAIN_BOT
+    limit = MAIN_BOT_STALE_SECONDS if from_main else settings.discord_directory_refresh_seconds
+    age = _age_seconds(g.get("directory_at"))
+    return "stale" if age is None or age > limit else None
+
+
+def _main_bot_list_fresh(g: dict) -> bool:
+    """The server bot is there and its own list is current: it wins."""
+    return (g.get("bot_present") is True and (g.get("directory_source") or MAIN_BOT) == MAIN_BOT
+            and _directory_due(g) is None)
+
+
+async def _refresh_directory(g: dict, org_id: str, tokens: dict[str, dict]) -> Optional[dict]:
+    """Read one linked server's voice channels from a member radio bot and
+    store them. Returns the fields written (also merged into ``g``), or None
+    when nothing was learned. Writes only onto the existing doc, and only
+    while it is still linked to ``org_id``: never creates a doc, never
+    touches ``org_id`` or the server bot's ``bot_present``."""
+    gid = g["guild_id"]
+    members = _member_radio_bots(tokens, gid, org_id)
+    if not members:
+        return None
+    docs = [{**tokens[t], "token_id": t} for t in members]
+    res = await discord_rest.guild_directory(docs, gid, max_bots=DIRECTORY_BOTS)
+    now = _now_iso()
+    if res.status == discord_rest.OK:
+        updates: dict = {"voice_channels": res.voice_channels, "directory_at": now,
+                         "directory_source": RADIO_BOT, "radio_bot_present": True, "radio_bot_checked_at": now}
+        if res.name:
+            updates["guild_name"] = res.name
+    elif res.status == discord_rest.NOT_MEMBER:
+        updates = {"radio_bot_present": False, "radio_bot_checked_at": now}
+    else:
+        return None
+    cur = await fstore.doc_get(streams.GUILDS, gid)
+    if not cur or cur.get("org_id") != org_id:
+        return None   # unlinked / moved / removed meanwhile
+    if _main_bot_list_fresh(cur):
+        return None   # the server bot pushed a fresh list meanwhile; it wins
+    await fstore.doc_update(streams.GUILDS, gid, updates)
+    g.update(updates)
+    logger.info(f"Discord directory for {gid} from radio bot {res.token_id or '-'}: "
+                f"{res.status}, {len(res.voice_channels or [])} voice channel(s)")
+    return updates
+
+
+_directory_tasks: dict[str, asyncio.Task] = {}
+
+
+async def _refresh_quietly(g: dict, org_id: str, tokens: dict[str, dict]) -> None:
+    try:
+        await _refresh_directory(g, org_id, tokens)
+    except Exception as e:   # a background refresh must never surface anywhere
+        logger.warning(f"Discord directory refresh for {g.get('guild_id')} failed: {type(e).__name__}")
+
+
+def _refresh_in_background(g: dict, org_id: str, tokens: dict[str, dict]) -> None:
+    gid = g["guild_id"]
+    running = _directory_tasks.get(gid)
+    if running is not None and not running.done():
+        return
+    task = asyncio.create_task(_refresh_quietly(dict(g), org_id, tokens))
+    _directory_tasks[gid] = task
+    task.add_done_callback(lambda t, gid=gid: _directory_tasks.pop(gid, None)
+                           if _directory_tasks.get(gid) is t else None)
+
+
+async def _fill_directories(guilds: list[dict], org_id: str, tokens: dict[str, dict]) -> None:
+    """Missing lists are read now (all servers at once, inside the
+    permission-check budget — an answer that comes later is cached and
+    stored by the next look); stale ones are refreshed in the background and
+    the stored list is shown meanwhile."""
+    now: list[dict] = []
+    for g in guilds:
+        due = _directory_due(g)
+        if not due or not _member_radio_bots(tokens, g["guild_id"], org_id):
+            continue
+        if due == "missing":
+            now.append(g)
+        else:
+            _refresh_in_background(g, org_id, tokens)
+    if not now:
+        return
+    tasks = [asyncio.create_task(_refresh_quietly(g, org_id, tokens)) for g in now]
+    await asyncio.wait(tasks, timeout=settings.discord_perm_check_budget_seconds)
+
+
 def _bot_status(tokens: dict, *, node_id: str, guild_id: str, org_id: str) -> dict:
     res = leases.pick_token(tokens, node_id=node_id, guild_id=guild_id, org_id=org_id)
     if res.ok:
@@ -181,7 +361,10 @@ async def join_options(node_id: str, decoded: dict = Depends(require_firebase_to
     system_id = streams._effective_system(node)
     system = (await fstore.doc_get_cached("systems", system_id)) if system_id else None
 
-    guilds = await _org_guilds(org_id) if org_id else []
+    tokens = await _load_tokens()
+    guilds = await _org_guilds(org_id, tokens) if org_id else []
+    if org_id:
+        await _fill_directories(guilds, org_id, tokens)
     live = [s for s in await fstore.collection_list(streams.STREAMS, desired="on")
             if s.get("org_id") == org_id]
     nodes = {n.get("node_id"): n.get("name") for n in await fstore.collection_list("nodes", org_id=org_id)
@@ -190,7 +373,6 @@ async def join_options(node_id: str, decoded: dict = Depends(require_firebase_to
     by_channel: dict[tuple, list] = {}
     for s in sorted(live, key=lambda s: (s.get("created_at") or "", s.get("stream_id") or "")):
         by_channel.setdefault((str(s.get("guild_id")), str(s.get("channel_id"))), []).append(s)
-    tokens = {t["token_id"]: t for t in await fstore.collection_list(leases.TOKENS) if t.get("token_id")}
     token_names = {tid: t.get("name") or tid for tid, t in tokens.items()}
 
     out_guilds = []
@@ -216,6 +398,10 @@ async def join_options(node_id: str, decoded: dict = Depends(require_firebase_to
             "linked": bool(g.get("org_id")),
             "synced": g.get("voice_channels") is not None,
             "synced_at": g.get("directory_at"),
+            # Who listed the channels: "main_bot" (DRB server bot) or "radio_bot" (S5).
+            "directory_source": (g.get("directory_source") or (MAIN_BOT if g.get("voice_channels") is not None
+                                                               else None)),
+            "main_bot_present": g.get("bot_present") is True,
             "voice_channels": channels,
             "streams_on": sum(1 for s in live if s.get("guild_id") == gid),
             "bot": _bot_status(tokens, node_id=node_id, guild_id=gid, org_id=org_id),
@@ -261,10 +447,24 @@ async def start_node_stream(node_id: str, body: NodeStreamStart, decoded: dict =
         raise HTTPException(409, "This node is not listening to a system yet.")
 
     guild_id, channel_id = str(body.guild_id), str(body.channel_id)
-    guild = next((g for g in await _org_guilds(org_id) if g["guild_id"] == guild_id), None)
+    tokens = await _load_tokens()
+    guild = next((g for g in await _org_guilds(org_id, tokens) if g["guild_id"] == guild_id), None)
     if not guild:
         raise HTTPException(404, "That Discord server is not linked to this organization.")
-    channel = next((c for c in guild.get("voice_channels") or [] if str(c.get("channel_id")) == channel_id), None)
+
+    def _find(g: dict) -> Optional[dict]:
+        return next((c for c in g.get("voice_channels") or [] if str(c.get("channel_id")) == channel_id), None)
+
+    channel = _find(guild)
+    if not channel and guild.get("org_id") and not _main_bot_list_fresh(guild):
+        # No list yet, or a radio bot's list that may predate this channel:
+        # read it once more (cached snapshot) before saying no.
+        try:
+            await asyncio.wait_for(_refresh_directory(guild, org_id, tokens),
+                                   timeout=settings.discord_perm_check_budget_seconds)
+        except asyncio.TimeoutError:
+            pass
+        channel = _find(guild)
     if not channel:
         raise HTTPException(400, "That is not a voice channel DRB can see in this server. "
                                  "Refresh the list and pick again.")
@@ -287,6 +487,7 @@ async def start_node_stream(node_id: str, body: NodeStreamStart, decoded: dict =
             channel_name=channel.get("name"), guild_name=_guild_name(guild),
             created_by=f"web:{decoded.get('uid') or 'unknown'}",
             max_streams=settings.discord_guild_max_streams,
+            interactive=True,
         )
     except streams.StreamError as e:
         return JSONResponse(status_code=e.status,

drb-c2-core/app/routers/media.py

@@ -10,19 +10,100 @@ happens inline below, in the same spirit as routers/enrollment.py.
 The bucket stays fully private and c2-core reads the object server-side with
 Application Default Credentials, so no GCS signed URL — and therefore no
 service-account private key on the VM — is involved anywhere in this path.
+
+HTTP Range (server-26#233): the body is streamed from GCS in fixed-size span
+reads instead of downloaded whole first. A 600 s FLAC call is ~13 MB, and the
+old full-body response (``Accept-Ranges: none``) made the browser wait for all
+of it before playback started and made seeking re-download it. Now playback
+starts after the first span and a seek is a ``206`` for just the bytes needed.
+Only a single range is honoured; a multi-range request gets the full body,
+which RFC 9110 §14.2 permits.
 """
-from fastapi import APIRouter, HTTPException, Query, Response
+import re
+from typing import AsyncIterator, Optional, Tuple
+
+from fastapi import APIRouter, Header, HTTPException, Query, Response
+from fastapi.responses import StreamingResponse
+
 from app.internal import firestore as fstore
-from app.internal.storage import verify_audio_link, gcs_uri_for_call, download_audio, content_type_for
+from app.internal.logger import logger
+from app.internal.storage import (
+    audio_object_size,
+    content_type_for,
+    download_audio_range,
+    gcs_uri_for_call,
+    verify_audio_link,
+)
 
 router = APIRouter(prefix="/media", tags=["media"])
 
+# Bytes per GCS span read. ~25 s of FLAC at ~1.3 MB/min, so the first span —
+# the only one the browser waits on — is one small GCS round-trip.
+STREAM_CHUNK_BYTES = 512 * 1024
+
+# Immutable content, but the URL expires — cache privately only.
+_CACHE_CONTROL = "private, max-age=3600"
+
+_RANGE_RE = re.compile(r"^\s*bytes\s*=\s*(\d*)\s*-\s*(\d*)\s*$", re.IGNORECASE)
+
+
+class _Unsatisfiable(Exception):
+    pass
+
+
+def parse_range(header: Optional[str], size: int) -> Optional[Tuple[int, int]]:
+    """Resolve a ``Range`` header against an object of ``size`` bytes.
+
+    Returns an inclusive ``(start, end)``, or None when the header is absent or
+    should be ignored (not ``bytes``, multi-range, malformed — RFC 9110 lets a
+    server answer those with the full 200). Raises _Unsatisfiable for a
+    well-formed range that selects nothing (-> 416).
+    """
+    if not header:
+        return None
+    m = _RANGE_RE.match(header)
+    if not m:
+        return None  # other unit, multi-range ("a-b,c-d") or garbage
+    first, last = m.group(1), m.group(2)
+    if first == "" and last == "":
+        return None
+    if first == "":
+        # Suffix range: the final N bytes.
+        n = int(last)
+        if n == 0 or size == 0:
+            raise _Unsatisfiable()
+        return max(0, size - n), size - 1
+    start = int(first)
+    if last != "" and int(last) < start:
+        return None  # invalid spec -> ignore the header
+    if start >= size:
+        raise _Unsatisfiable()
+    end = size - 1 if last == "" else min(int(last), size - 1)
+    return start, end
+
+
+async def _stream(gcs_uri: str, first_chunk: bytes, start: int, end: int) -> AsyncIterator[bytes]:
+    yield first_chunk
+    pos = start + len(first_chunk)
+    while pos <= end:
+        chunk_end = min(pos + STREAM_CHUNK_BYTES - 1, end)
+        data = await download_audio_range(gcs_uri, pos, chunk_end)
+        if not data:
+            # Headers are already sent, so the status can't change; ending the
+            # body short makes the client see a truncated response rather than
+            # silently wrong audio.
+            logger.warning(f"/media stream cut short at byte {pos} of {gcs_uri}")
+            return
+        yield data
+        pos += len(data)
+
 
 @router.get("/calls/{call_id}/audio")
 async def get_call_audio(
     call_id: str,
     exp: int = Query(..., description="Link expiry, unix seconds."),
     sig: str = Query(..., description="HMAC over call_id and expiry."),
+    range_header: Optional[str] = Header(None, alias="Range"),
 ):
     # Verify before touching Firestore so an invalid link costs nothing.
     if not verify_audio_link(call_id, exp, sig):
@@ -36,26 +117,48 @@ async def get_call_audio(
     if not gcs_uri:
         raise HTTPException(404, "No audio for this call.")
 
-    data = await download_audio(gcs_uri)
-    if not data:
+    size = await audio_object_size(gcs_uri)
+    if size is None:
         raise HTTPException(404, "Audio object missing from storage.")
 
-    return Response(
-        content=data,
-        # Was hardcoded audio/mpeg. The node now uploads FLAC, and a browser
-        # will not play a FLAC body labelled audio/mpeg. Derived from the stored
-        # object's extension so old .mp3 recordings keep working unchanged.
-        media_type=content_type_for(gcs_uri),
-        headers={
-            "Content-Length": str(len(data)),
-            # Whole body at once, no Range support. This was comfortable at
-            # 16 kbps mono (~60 KB for a 30 s call); FLAC is ~1.3 MB/min, so a
-            # long call is now tens of MB and the browser must download all of
-            # it before playback starts. Acceptable for typical few-second
-            # transmissions, but this is the change that makes Range support
-            # actually matter — see DEFERRED.md.
-            "Accept-Ranges": "none",
-            # Immutable content, but the URL expires — cache privately only.
-            "Cache-Control": "private, max-age=3600",
-        },
+    # Was hardcoded audio/mpeg. The node now uploads FLAC, and a browser will
+    # not play a FLAC body labelled audio/mpeg. Derived from the stored
+    # object's extension so old .mp3 recordings keep working unchanged.
+    media_type = content_type_for(gcs_uri)
+
+    try:
+        span = parse_range(range_header, size)
+    except _Unsatisfiable:
+        return Response(
+            status_code=416,
+            headers={"Content-Range": f"bytes */{size}", "Accept-Ranges": "bytes"},
+        )
+
+    if size == 0:
+        return Response(
+            content=b"",
+            media_type=media_type,
+            headers={"Accept-Ranges": "bytes", "Cache-Control": _CACHE_CONTROL},
+        )
+
+    start, end = span if span else (0, size - 1)
+    # Fetched before the response starts so a read failure is still a clean
+    # 404 rather than a stream that dies after a 200/206 has gone out.
+    first = await download_audio_range(gcs_uri, start, min(start + STREAM_CHUNK_BYTES - 1, end))
+    if not first:
+        raise HTTPException(404, "Audio object missing from storage.")
+
+    headers = {
+        "Content-Length": str(end - start + 1),
+        "Accept-Ranges": "bytes",
+        "Cache-Control": _CACHE_CONTROL,
+    }
+    if span:
+        headers["Content-Range"] = f"bytes {start}-{end}/{size}"
+
+    return StreamingResponse(
+        _stream(gcs_uri, first, start, end),
+        status_code=206 if span else 200,
+        media_type=media_type,
+        headers=headers,
     )

drb-c2-core/app/routers/nodes.py

@@ -210,7 +210,7 @@ async def send_command(
             doc = await discord_streams.start_stream(
                 org_id=node.get("org_id"), guild_id=cmd.guild_id, channel_id=cmd.channel_id,
                 system_id=system_id, node_id=node_id, preferred_token_id=cmd.preferred_token_id,
-                mode="adhoc",
+                mode="adhoc", interactive=True,
             )
         except discord_streams.StreamError as e:
             raise HTTPException(e.status, e.message)

drb-c2-core/app/routers/outages.py

@@ -0,0 +1,52 @@
+"""Power-outage endpoints (map layer, server-26#184).
+
+``GET /outages`` -- any signed-in user (auth applied at include time in main.py):
+outage areas inside a bbox from every provider an admin has enabled, each with
+the provider's attribution, disclaimer, coverage note and feed freshness, plus
+a ``status`` that says why an empty list is empty.
+
+``/admin/outage-providers`` -- platform admin only: list every catalogued
+provider with its licence status and health, and toggle it. Gated licences
+need ``acknowledge_licence: true``; that acknowledgement is stored with who and
+when and written to audit_log (see app/internal/outages/registry.py).
+"""
+from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi.responses import JSONResponse
+from pydantic import BaseModel
+
+from app.internal.auth import describe_actor, require_admin_token
+from app.internal.outages import registry
+
+router = APIRouter(prefix="/outages", tags=["outages"])
+admin_router = APIRouter(prefix="/admin/outage-providers", tags=["admin"])
+
+
+@router.get("")
+async def get_outages(
+    south: float = Query(..., ge=-90, le=90),
+    west: float = Query(..., ge=-180, le=180),
+    north: float = Query(..., ge=-90, le=90),
+    east: float = Query(..., ge=-180, le=180),
+):
+    if south > north or west > east:
+        raise HTTPException(400, "bbox must satisfy south<=north and west<=east")
+    return await registry.outages_in_bbox((south, west, north, east))
+
+
+class ProviderToggle(BaseModel):
+    enabled: bool
+    acknowledge_licence: bool = False
+
+
+@admin_router.get("")
+async def list_outage_providers(_=Depends(require_admin_token)):
+    return {"providers": await registry.list_providers()}
+
+
+@admin_router.put("/{provider_id}")
+async def set_outage_provider(provider_id: str, body: ProviderToggle, principal: dict = Depends(require_admin_token)):
+    try:
+        return await registry.set_enabled(provider_id, body.enabled, describe_actor(principal),
+                                          acknowledge_licence=body.acknowledge_licence)
+    except registry.ProviderError as e:
+        return JSONResponse(status_code=e.code, content={"detail": e.message, **e.extra})

drb-c2-core/app/routers/tokens.py

@@ -2,8 +2,10 @@ import uuid
 from fastapi import APIRouter, HTTPException, Depends, Query
 from pydantic import BaseModel
 from typing import Optional
+from app.config import settings
 from app.internal import firestore as fstore
 from app.internal import discord_leases as leases
+from app.internal import discord_oauth
 from app.internal import discord_rest
 from app.internal.audit import write_audit
 from app.internal.auth import (
@@ -27,9 +29,27 @@ class TokenCreate(BaseModel):
     org_id: Optional[str] = None
 
 
-def _masked(t: dict) -> dict:
-    out = {**t, "token": "•••" + (t.get("token") or "")[-4:]}
+# What GET /tokens may return of a bot_tokens doc (server-26#225 S6: an
+# allowlist, so a field added to the doc later — a secret, say — never
+# leaks by default). The token string itself is masked; OAuth client secrets
+# live in bot_oauth/{id}, never on this doc, and are never returned.
+_PUBLIC_TOKEN_FIELDS = (
+    "token_id", "name", "org_id", "valid", "guild_ids", "check_error", "validated_at",
+    "application_id", "bot_user_id", "bot_name", "lease", "in_use", "assigned_node_id", "assigned_at",
+    "preferred_for_system_id",
+)
+
+
+def _masked(t: dict, oauth_ids: Optional[set] = None) -> dict:
+    out = {k: t[k] for k in _PUBLIC_TOKEN_FIELDS if k in t}
+    out["token"] = "•••" + (t.get("token") or "")[-4:]
     out["invite_url"] = leases.invite_url(t.get("application_id"))
+    members = t.get("guild_ids")
+    out["server_count"] = len(members) if isinstance(members, list) else None
+    # Pool bots stop being offered at the cap (owner decision Q3); BYO bots have none.
+    out["server_cap"] = settings.discord_pool_bot_guild_cap if t.get("org_id") is None else None
+    if oauth_ids is not None:
+        out["oauth_enabled"] = t.get("token_id") in oauth_ids
     return out
 
 
@@ -47,7 +67,8 @@ async def _republish_after_release(lease: Optional[dict]) -> None:
 @router.get("")
 async def list_tokens(_: dict = Depends(require_admin_token)):
     """List all tokens. The actual token string is masked for safety."""
-    return [_masked(t) for t in await fstore.collection_list("bot_tokens")]
+    oauth_ids = await discord_oauth.enabled_token_ids()
+    return [_masked(t, oauth_ids) for t in await fstore.collection_list("bot_tokens")]
 
 
 @router.post("", status_code=201)
@@ -83,7 +104,7 @@ async def refresh_token(token_id: str, _: dict = Depends(require_admin_token)):
     if not await fstore.doc_get("bot_tokens", token_id):
         raise HTTPException(404, "Token not found.")
     await discord_rest.refresh_membership([token_id])
-    return _masked(await fstore.doc_get("bot_tokens", token_id) or {})
+    return _masked(await fstore.doc_get("bot_tokens", token_id) or {}, await discord_oauth.enabled_token_ids())
 
 
 @router.post("/flush", status_code=200)
@@ -265,3 +286,57 @@ async def delete_token(token_id: str, _: dict = Depends(require_admin_token)):
     if existing.get("lease"):
         raise HTTPException(409, "Token is currently leased to a node. Stop its radio channels (or flush) first.")
     await fstore.doc_delete("bot_tokens", token_id)
+    await discord_oauth.clear_secret(token_id)
+
+
+class OAuthSecret(BaseModel):
+    # Length is checked in the handler, not here: a pydantic 422 echoes the
+    # rejected input back in its body.
+    client_secret: str
+
+
+@router.put("/{token_id}/oauth", status_code=200)
+async def set_oauth_secret(token_id: str, body: OAuthSecret, decoded: dict = Depends(require_admin_token)):
+    """Set (or replace) this radio bot application's OAuth2 client secret, so
+    "Connect a Discord server" can invite it (server-26#225 S6). Checked with
+    Discord first (client-credentials grant) — a wrong secret is refused and
+    nothing is stored. The secret goes to bot_oauth/{id}, server-side only:
+    it is never echoed, never returned by any route and never logged."""
+    if "/" in token_id:
+        raise HTTPException(400, "Bad id.")
+    tok = await fstore.doc_get("bot_tokens", token_id)
+    if not tok:
+        raise HTTPException(404, "Token not found.")
+    if not tok.get("application_id"):
+        raise HTTPException(409, "DRB doesn't know this bot's application id yet. Re-check the bot, then try again.")
+    secret = (body.client_secret or "").strip()
+    if not (discord_oauth.SECRET_MIN <= len(secret) <= discord_oauth.SECRET_MAX):
+        raise HTTPException(400, "That doesn't look like a Discord client secret. Copy it from the Discord "
+                                 "Developer Portal → OAuth2.")
+    r = await discord_oauth.check_secret(str(tok["application_id"]), secret)
+    uid, email = describe_actor(decoded)
+    if not r.ok:
+        await write_audit(uid, email, "discord.token.oauth_refused", details={
+            "token_id": token_id, "status": r.status})
+        if r.status in (400, 401):
+            raise HTTPException(400, "Discord didn't accept that client secret for this bot's application. "
+                                     "Copy it again from the Discord Developer Portal → OAuth2.")
+        raise HTTPException(503, "Couldn't check the secret with Discord right now. Nothing was saved; "
+                                 "try again in a minute.")
+    await discord_oauth.store_secret(token_id, secret, uid)
+    await write_audit(uid, email, "discord.token.oauth_set", details={"token_id": token_id})
+    logger.info(f"Radio bot {token_id}: OAuth secret set by uid={uid}")
+    return {"ok": True, "token_id": token_id, "oauth_enabled": True,
+            "redirect_uri_configured": discord_oauth.enabled()}
+
+
+@router.delete("/{token_id}/oauth", status_code=200)
+async def clear_oauth_secret(token_id: str, decoded: dict = Depends(require_admin_token)):
+    """Forget this bot's OAuth secret: Connect stops offering it."""
+    if "/" in token_id:
+        raise HTTPException(400, "Bad id.")
+    removed = await discord_oauth.clear_secret(token_id)
+    uid, email = describe_actor(decoded)
+    if removed:
+        await write_audit(uid, email, "discord.token.oauth_clear", details={"token_id": token_id})
+    return {"ok": True, "token_id": token_id, "oauth_enabled": False}

drb-c2-core/app/routers/upload.py

@@ -1,4 +1,5 @@
 import secrets
+from datetime import datetime, timedelta, timezone
 from typing import Optional
 from fastapi import APIRouter, BackgroundTasks, UploadFile, File, Form, HTTPException, Security
 from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
@@ -66,6 +67,24 @@ async def upload_call_audio(
     if len(data) > settings.upload_max_bytes:
         raise HTTPException(413, f"File too large (max {settings.upload_max_bytes // (1024*1024)} MB).")
 
+    # server-26#302: the edge node retries uploads (spooled for up to 72h), and
+    # a retry arrives whenever the node lost the response to an upload C2 had
+    # already stored. call_id is the idempotency key: audio already stored
+    # means this upload was already processed, so
+    # re-running Whisper/extraction/correlation would double the AI spend and
+    # double-link the call (the server-26#131 shape). Not atomic: two retries
+    # racing inside one request's lifetime can both pass this check.
+    # Keyed on stored audio only: the pipeline marker alone would refuse a
+    # retry forever (and hand the node a null URL to keep retrying) after a
+    # pipeline crash; such a call is recovered by the sweep or a reprocess.
+    existing = await fstore.doc_get("calls", call_id) or {}
+    if existing.get("audio_gcs_uri"):
+        logger.info(
+            f"Upload for call {call_id} from {node_id} is a retry of one already "
+            f"processed — returning the stored audio, pipeline not re-run"
+        )
+        return {"url": existing.get("audio_gcs_uri"), "already_uploaded": True}
+
     gcs_uri = await upload_audio(data, file.filename or "", call_id=call_id)
 
     if gcs_uri:
@@ -112,99 +131,56 @@ async def upload_call_audio(
     return {"url": gcs_uri}
 
 
-# server-26#115 — the consensus LLM-orphan gate only fires when the call is
-# genuinely substanceless. The earlier version tested `rules_decision["corr_debug"]`
-# for a "positive signal", but corr_debug is EMPTY at preview time for
-# action=="new" (corr_path:"new" is written at APPLY time), so that test was
-# always False and the gate dropped real events — a major "extinguishing fire",
-# geocoded calls, pursuit updates. The substance test now runs against `ctx`,
-# which is fully populated at preview time.
+# New-event signals: an LLM "orphan" may not drop a call carrying one when the
+# rules would open an incident for it (server-26#299). A missed real event is
+# worse than one extra incident, and the sweep is link-only, so a dropped event
+# never comes back. These are the old #115 gate's vetoes, which existed because
+# a looser gate dropped typed and geocoded fire calls.
+_LLM_ORPHAN_VETO_SEVERITIES = ("moderate", "major")
 
 
-def _recent_incident_on_same_talkgroup(ctx: dict) -> bool:
+def _llm_orphan_vetoed(ctx: dict) -> bool:
+    from app.internal.incident_correlator import has_event_substance
+    return bool(
+        ctx.get("reassignment") or ctx.get("incident_type")
+        or ctx.get("call_severity") in _LLM_ORPHAN_VETO_SEVERITIES
+        or has_event_substance(ctx)
+    )
+
+
+def _merge_llm_decision(rules: dict, llm: dict, ctx: dict) -> tuple[dict, str]:
     """
-    True when a recent incident is running on this call's own system +
-    talkgroup, within `settings.tg_dispatch_thin_idle_minutes` (5 min) —
-    applied uniformly regardless of the talkgroup's name (server-26#134).
-    Covers "unit dispatched, thin ack 10-30s later": the ack has no
-    substance of its own but plainly belongs to the job just opened.
-
-    Reads ctx["recent"] (the rules engine's own candidate list — no extra
-    Firestore read). That list is status=="active" incidents only, so an
-    already-resolved or capacity-capped same-talkgroup incident won't be
-    seen here even if chronologically recent (server-26#115, unresolved —
-    would need a dedicated non-status-filtered query).
-
-    Whether this limitation explains the 2/24 unexplained gate misses in the
-    window #3 measurement is UNANSWERED, not confirmed either way — a prior
-    pass here claimed a "confirmed explanation" for both that turned out to
-    be self-contradictory. Read `corr_gate_veto` (written to corr_debug on
-    every escalation of this exact disagreement shape — see the caller) in
-    the next measurement window instead of guessing from the raw dump again.
-    # TODO(server-26#115): add a talkgroup-scoped incident lookup (any
-    # status, no capacity filter) if a future measurement window pins a real
-    # gate miss on a resolved/capped same-talkgroup incident.
+    The decision to commit for an ambiguous scene, and the corr_consensus
+    value that says who made it: "llm", or "rules_guard" when the LLM's
+    orphan was refused for a call with a strong new-event signal.
     """
-    from app.internal.incident_correlator import _idle_gate_minutes
-
-    tg_id = ctx.get("talkgroup_id")
-    system_id = ctx.get("system_id")
-    if tg_id is None or not system_id:
-        return False
-    tg_str = str(tg_id)
-    now = ctx.get("now") or clock.now()
-    idle_limit = settings.tg_dispatch_thin_idle_minutes
-    for inc in ctx.get("recent") or []:
-        if system_id not in (inc.get("system_ids") or []):
-            continue
-        if tg_str not in (inc.get("talkgroup_ids") or []):
-            continue
-        if _idle_gate_minutes(inc, now) <= idle_limit:
-            return True
-    return False
+    if llm["action"] == "orphan" and rules["action"] == "new" and _llm_orphan_vetoed(ctx):
+        return rules, "rules_guard"
+    if (
+        llm["action"] == rules["action"] == "link"
+        and llm["matched_incident"]["incident_id"] == rules["matched_incident"]["incident_id"]
+    ):
+        # The LLM confirmed the rules' own link: keep the rules' path/fit
+        # signal so corr_path histograms stay comparable across runs.
+        return rules, "llm"
+    final = {
+        "action":           llm["action"],
+        "matched_incident": llm["matched_incident"],
+        "incident_type":    llm["incident_type"],
+        "corr_debug":       dict(llm.get("corr_debug") or {}),
+    }
+    if llm["action"] == "link":
+        # The rules' corr_path/fit signal described a different judgement
+        # (possibly a different incident); keep it under corr_rules_* only.
+        final["corr_debug"]["corr_path"] = "llm"
+    elif llm["action"] == "orphan" and rules["action"] == "link":
+        # Tombstone: the rules-only sweep would otherwise re-commit the very
+        # unverified unit link the LLM just refused.
+        final["corr_debug"]["corr_path"] = "llm_orphan"
+    return final, "llm"
 
 
-def _call_is_substanceless(ctx: dict) -> tuple[bool, Optional[str]]:
-    """
-    True when the call carries nothing that marks it as a real event:
-      • no resolved incident_type and not a reassignment, AND
-      • severity is not moderate/major, AND
-      • no vehicle, geocode or tag (incident_correlator.has_event_substance —
-        the same predicate the incident-creation gate uses), AND
-      • no recent incident already running on the same talkgroup.
-    Only then may the LLM-orphan gate drop the call without a tiebreak.
-
-    Returns (substanceless, veto_reason). veto_reason names whichever
-    condition kept the tiebreak alive ("type" | "reassignment" | "severity" |
-    "substance" | "recent_tg"), or None when the call is substanceless. The
-    caller writes this into corr_debug on the escalation path so a live
-    measurement window can see *why* each llm=orphan/rules=new call escaped
-    the gate instead of inferring it after the fact from the raw dump —
-    exactly the guesswork that produced a wrong "confirmed explanation" for
-    2 window-#3 misses on the first pass of this fix.
-    """
-    from app.internal import incident_correlator
-
-    # The incident-creation gate skips the has_event_substance check entirely
-    # when a type resolved (incident_correlator._run_decision ~:1397), so a
-    # typed call — fire/medical/etc. — opens an incident on substance we do not
-    # re-check here. reassignment=True is dispatch pulling a unit onto a NEW
-    # job (units are blanked at :296 for exactly that reason): the strongest
-    # new-incident signal in the pipeline. Either one means "keep the tiebreak".
-    if ctx.get("incident_type"):
-        return False, "type"
-    if ctx.get("reassignment"):
-        return False, "reassignment"
-    if (ctx.get("call_severity") or "routine") in ("moderate", "major"):
-        return False, "severity"
-    if incident_correlator.has_event_substance(ctx):
-        return False, "substance"
-    if _recent_incident_on_same_talkgroup(ctx):
-        return False, "recent_tg"
-    return True, None
-
-
-async def _correlate_with_consensus(
+async def _correlate(
     call_id: str,
     node_id: str,
     system_id: Optional[str],
@@ -222,19 +198,22 @@ async def _correlate_with_consensus(
     severity: Optional[str] = None,
     transcript: Optional[str] = None,
     scene_index: int = 0,
-) -> Optional[str]:
+) -> tuple[Optional[str], dict]:
     """
-    Consensus correlator: runs the rules engine and the cheap LLM in sequence.
-    If they agree the rules decision is committed directly.
-    If they disagree a smarter tiebreaker LLM makes the final call.
+    Correlate one scene (server-26#299): the rules engine decides; only when
+    it marks its decision ambiguous is ONE cheap LLM call made, and a usable
+    LLM answer is committed instead. Returns (incident_id, committed decision).
 
-    Falls back to rules-only when GEMINI_API_KEY is absent, the call is
-    content-free (thin), or any LLM call fails.
+    corr_consensus on the call doc says who decided:
+      "rules_only"     — confident rules decision, no LLM call
+      "llm"            — ambiguous, the LLM's answer was committed
+      "rules_fallback" — ambiguous, LLM unavailable/failed/unusable → rules
+      "rules_guard"    — ambiguous, LLM said orphan on a call with a strong
+                         new-event signal → rules "new" kept
+    and corr_band names why it was ambiguous.
 
-    ``scene_index`` (server-26#96) — which scene of the call this is, from the
-    caller's ``enumerate(scenes)`` loop. Threaded through so the call doc's
-    per-scene ``scenes`` map records this scene's own corr_debug/transcript
-    instead of colliding with every other scene's write on the flat fields.
+    ``scene_index`` (server-26#96) — which scene of the call this is, so the
+    call doc's per-scene ``scenes`` map records this scene's own decision.
     """
     from app.internal import incident_correlator, llm_correlator
 
@@ -247,68 +226,119 @@ async def _correlate_with_consensus(
         embedding=embedding, severity=severity, transcript=transcript,
         scene_index=scene_index,
     )
-    ctx             = preview["ctx"]
-    rules_decision  = preview["decision"]
+    ctx   = preview["ctx"]
+    rules = preview["decision"]
+    band  = rules.get("ambiguous")
 
-    llm_decision = await llm_correlator.decide(call_id, ctx)
+    if not band:
+        rules["corr_debug"]["corr_consensus"] = "rules_only"
+        return await incident_correlator.apply_correlation(preview), rules
 
-    if llm_decision is None:
-        # LLM unavailable, skipped (thin call), or errored — rules wins.
-        rules_decision["corr_debug"]["corr_consensus"] = "rules_only"
-        return await incident_correlator.apply_correlation(preview)
-
-    if llm_correlator.decisions_agree(rules_decision, llm_decision):
-        rules_decision["corr_debug"]["corr_consensus"] = "agreed"
-        rules_decision["corr_debug"]["corr_llm_reasoning"] = llm_decision.get("reasoning", "")
-        return await incident_correlator.apply_correlation(preview)
-
-    # server-26#115 — LLM-orphan gate.
-    # When the cheap LLM says `orphan`, the rules engine says `new`, and the call
-    # is genuinely substanceless (routine severity, no vehicle/geocode/tag, and
-    # no incident already running on this talkgroup), resolve to `orphan` and DO
-    # NOT pay for the smart tiebreaker. A bare rules `new` there means only
-    # "nothing to link to" — trivially true for radio housekeeping (check-ins,
-    # roll call, 10-8/10-98) — and the tiebreaker rubber-stamped it ~21/21 of the
-    # time on exactly this disagreement (CORRELATION_REVIEW_0907b.md). Any real
-    # signal (severity, coords, tags, a live same-talkgroup incident) still
-    # escalates, so an event the LLM misreads as orphan is not lost.
-    is_orphan_vs_new = llm_decision["action"] == "orphan" and rules_decision["action"] == "new"
-    substanceless, gate_veto_reason = _call_is_substanceless(ctx) if is_orphan_vs_new else (False, None)
-    if is_orphan_vs_new and substanceless:
-        logger.info(
-            f"Consensus gate for call {call_id}: llm=orphan vs rules=new and call "
-            f"is substanceless — resolving orphan, skipping tiebreak"
-        )
-        gated = {
-            "action": "orphan",
-            "matched_incident": None,
-            "incident_type": None,
-            "corr_debug": dict(rules_decision.get("corr_debug") or {}),
-        }
-        gated["corr_debug"].update({
-            "corr_consensus":     "llm_orphan_gate",
-            "corr_rules_action":  rules_decision["action"],
-            "corr_llm_action":    llm_decision["action"],
-            "corr_llm_reasoning": llm_decision.get("reasoning", ""),
-        })
-        return await incident_correlator.apply_correlation({"decision": gated, "ctx": ctx})
-
-    # Disagree — escalate to the smarter tiebreaker.
+    llm = await llm_correlator.decide(call_id, ctx)
+    if llm is None:
+        final, consensus = rules, "rules_fallback"
+    else:
+        final, consensus = _merge_llm_decision(rules, llm, ctx)
+    final["corr_debug"].update({
+        "corr_consensus":    consensus,
+        "corr_band":         band,
+        "corr_rules_action": rules["action"],
+    })
+    if llm is not None:
+        final["corr_debug"]["corr_llm_action"]    = llm["action"]
+        final["corr_debug"]["corr_llm_reasoning"] = llm.get("reasoning", "")
     logger.info(
-        f"Consensus disagreement for call {call_id}: "
-        f"rules={rules_decision['action']} vs llm={llm_decision['action']} — tiebreak"
+        f"Correlation for call {call_id} scene {scene_index}: ambiguous ({band}) — "
+        f"rules={rules['action']} llm={llm['action'] if llm else 'none'} → {consensus}"
     )
-    final = await llm_correlator.tiebreak(rules_decision, llm_decision, ctx)
-    final["corr_debug"]["corr_consensus"]    = "tiebreak"
-    final["corr_debug"]["corr_rules_action"] = rules_decision["action"]
-    final["corr_debug"]["corr_llm_action"]   = llm_decision["action"]
-    if is_orphan_vs_new:
-        # server-26#115 — record *why* the llm=orphan/rules=new gate stood
-        # down instead of leaving a future measurement window to guess it
-        # from the raw dump (which produced a wrong "confirmed explanation"
-        # for 2/24 misses the first time around).
-        final["corr_debug"]["corr_gate_veto"] = gate_veto_reason
-    return await incident_correlator.apply_correlation({"decision": final, "ctx": ctx})
+    return await incident_correlator.apply_correlation({"decision": final, "ctx": ctx}), final
+
+
+def _may_resolve(decision: dict) -> bool:
+    """
+    server-26#88: honour a scene's `resolved` flag only on a link the
+    correlator was confident about, or on the incident this very scene opened.
+    A scene that attached by thin recency, or whose placement was ambiguous
+    (an LLM pick, or a rules fallback in the ambiguous band), has no business
+    closing an incident it may not belong to — that closed live incidents
+    while the event was still on the air.
+    """
+    if decision.get("action") == "new":
+        return True
+    debug = decision.get("corr_debug") or {}
+    return (
+        decision.get("action") == "link"
+        and debug.get("corr_consensus") == "rules_only"
+        and debug.get("corr_path") != "fast/thin"
+    )
+
+
+async def _correlate_scenes(
+    call_id: str,
+    node_id: str,
+    system_id: Optional[str],
+    talkgroup_id: Optional[int],
+    talkgroup_name: Optional[str],
+    scenes: list[dict],
+) -> tuple[list[str], list[str]]:
+    """
+    Correlate each scene of one call independently — a single recording can
+    carry several events on a busy channel — and apply each scene's LLM
+    closure. Returns (incident_ids, merged tags). Shared by the live pipeline,
+    replay (via _extract_and_correlate) and the transcript-PATCH path.
+    """
+    from app.internal import incident_correlator
+
+    incident_ids: list[str] = []
+    all_tags: list[str] = []
+    for scene_index, scene in enumerate(scenes):
+        all_tags.extend(scene["tags"])
+        # When dispatch is pulling a unit to a NEW call (reassignment), suppress
+        # unit overlap so the new scene doesn't chain into the unit's previous
+        # incident. parse_llm_bool (#88): a quoted "false" is not True.
+        is_reassignment = incident_correlator.parse_llm_bool(scene.get("reassignment"))
+        corr_units = [] if is_reassignment else scene.get("units")
+        incident_id, decision = await _correlate(
+            call_id=call_id,
+            node_id=node_id,
+            system_id=system_id,
+            talkgroup_id=talkgroup_id,
+            talkgroup_name=talkgroup_name,
+            tags=scene["tags"],
+            incident_type=scene["incident_type"],
+            location=scene["location"],
+            location_coords=scene["location_coords"],
+            units=corr_units,
+            vehicles=scene.get("vehicles"),
+            cleared_units=scene.get("cleared_units"),
+            reassignment=is_reassignment,
+            embedding=scene.get("embedding"),
+            severity=scene.get("severity"),
+            transcript=scene.get("transcript"),
+            scene_index=scene_index,
+        )
+        if incident_id and incident_id not in incident_ids:
+            incident_ids.append(incident_id)
+        if incident_id and incident_correlator.parse_llm_bool(scene.get("resolved")):
+            if not _may_resolve(decision):
+                logger.info(
+                    f"Ignoring closure from call {call_id} scene {scene_index}: link into "
+                    f"{incident_id} was not confident (server-26#88)"
+                )
+                continue
+            await fstore.doc_set("incidents", incident_id, {
+                "status": "resolved",
+                "resolved_at": clock.now().isoformat(),
+                "resolved_via": "llm_closure",
+                # One transmission read as "it's over" ("transport complete")
+                # closed the whole 09-22 bridge MVA at 14:44 and its next 56
+                # calls opened a second incident (server-26#170). Inferred from
+                # a single call, so provisional, like a timer close.
+                "reopenable": True,
+            })
+            await incident_correlator.maybe_resolve_parent(incident_id)
+            logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
+    return incident_ids, all_tags
 
 
 async def _resolve_flags(system_id: Optional[str]):
@@ -335,7 +365,7 @@ async def _run_extraction_pipeline(
     preserve_transcript_correction: bool = False,
 ) -> None:
     """Run steps 2-4 of the intelligence pipeline using an existing transcript."""
-    from app.internal import intelligence, incident_correlator, alerter
+    from app.internal import intelligence, alerter
 
     flags, _flag = await _resolve_flags(system_id)
 
@@ -353,45 +383,9 @@ async def _run_extraction_pipeline(
         )
 
         # Step 3: Correlate each scene to an incident independently.
-        # server-26#96: scene_index is threaded through so each scene's
-        # corr_debug/transcript lands in its own entry of the call doc's
-        # `scenes` map instead of clobbering every other scene's write.
-        for scene_index, scene in enumerate(scenes):
-            all_tags.extend(scene["tags"])
-            # When dispatch is pulling a unit to a NEW call (reassignment), suppress unit
-            # overlap so the new scene doesn't chain into the unit's previous incident.
-            is_reassignment = bool(scene.get("reassignment"))
-            corr_units = [] if is_reassignment else scene.get("units")
-            incident_id = await _correlate_with_consensus(
-                call_id=call_id,
-                node_id=node_id,
-                system_id=system_id,
-                talkgroup_id=talkgroup_id,
-                talkgroup_name=talkgroup_name,
-                tags=scene["tags"],
-                incident_type=scene["incident_type"],
-                location=scene["location"],
-                location_coords=scene["location_coords"],
-                units=corr_units,
-                vehicles=scene.get("vehicles"),
-                cleared_units=scene.get("cleared_units"),
-                reassignment=is_reassignment,
-                embedding=scene.get("embedding"),
-                severity=scene.get("severity"),
-                transcript=scene.get("transcript"),
-                scene_index=scene_index,
-            )
-            if incident_id and incident_id not in incident_ids:
-                incident_ids.append(incident_id)
-            if scene["resolved"] and incident_id:
-                await fstore.doc_set("incidents", incident_id, {
-                    "status": "resolved",
-                    "resolved_at": clock.now().isoformat(),
-                    "resolved_via": "llm_closure",
-                    "reopenable": True,  # provisional, see _extract_and_correlate
-                })
-                await incident_correlator.maybe_resolve_parent(incident_id)
-                logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
+        incident_ids, all_tags = await _correlate_scenes(
+            call_id, node_id, system_id, talkgroup_id, talkgroup_name, scenes,
+        )
     else:
         scope = "globally" if not flags["correlation_enabled"] else f"system {system_id}"
         logger.info(f"Correlation disabled ({scope}) — skipping scene extraction and correlation for call {call_id} (reprocess)")
@@ -430,7 +424,7 @@ async def _extract_and_correlate(
     copy of it that can drift. Caller owns the correlation feature-flag check
     and alerting.
     """
-    from app.internal import intelligence, incident_correlator
+    from app.internal import intelligence
 
     # Step 2: Scene detection + intelligence extraction
     if scenes is None:
@@ -443,50 +437,9 @@ async def _extract_and_correlate(
             )
 
     # Step 3: Correlate each scene independently.
-    # A single recording can produce multiple incidents on a busy channel.
-    incident_ids: list[str] = []
-    all_tags: list[str] = []
-    # server-26#96: scene_index is threaded through so each scene's
-    # corr_debug/transcript lands in its own entry of the call doc's
-    # `scenes` map instead of clobbering every other scene's write.
-    for scene_index, scene in enumerate(scenes):
-        all_tags.extend(scene["tags"])
-        is_reassignment = bool(scene.get("reassignment"))
-        corr_units = [] if is_reassignment else scene.get("units")
-        incident_id = await _correlate_with_consensus(
-            call_id=call_id,
-            node_id=node_id,
-            system_id=system_id,
-            talkgroup_id=talkgroup_id,
-            talkgroup_name=talkgroup_name,
-            tags=scene["tags"],
-            incident_type=scene["incident_type"],
-            location=scene["location"],
-            location_coords=scene["location_coords"],
-            units=corr_units,
-            vehicles=scene.get("vehicles"),
-            cleared_units=scene.get("cleared_units"),
-            reassignment=is_reassignment,
-            embedding=scene.get("embedding"),
-            severity=scene.get("severity"),
-            transcript=scene.get("transcript"),
-            scene_index=scene_index,
-        )
-        if incident_id and incident_id not in incident_ids:
-            incident_ids.append(incident_id)
-        if scene["resolved"] and incident_id:
-            await fstore.doc_set("incidents", incident_id, {
-                "status": "resolved",
-                "resolved_at": clock.now().isoformat(),
-                "resolved_via": "llm_closure",
-                # One transmission read as "it's over" ("transport complete")
-                # closed the whole 09-22 bridge MVA at 14:44 and its next 56
-                # calls opened a second incident (server-26#170). Inferred from
-                # a single call, so provisional, like a timer close.
-                "reopenable": True,
-            })
-            await incident_correlator.maybe_resolve_parent(incident_id)
-            logger.info(f"Auto-resolved incident {incident_id} (LLM closure detection)")
+    incident_ids, all_tags = await _correlate_scenes(
+        call_id, node_id, system_id, talkgroup_id, talkgroup_name, scenes,
+    )
 
     # Correlator also runs for calls with no scenes (unclassified) to attempt
     # talkgroup-based linking even when no transcript could be produced.
@@ -501,8 +454,11 @@ async def _extract_and_correlate(
     if not scenes:
         _call_doc = await fstore.doc_get("calls", call_id)
         skip_reason = (_call_doc or {}).get("skip_reason")
-        if not skip_reason or skip_reason == "transcript_too_short":
-            incident_id = await _correlate_with_consensus(
+        # non_event_chatter (server-26#298) is the same population as
+        # transcript_too_short, just longer: housekeeping that skipped the
+        # paid extraction but may still be a same-talkgroup follow-up.
+        if not skip_reason or skip_reason in ("transcript_too_short", "non_event_chatter"):
+            incident_id, _ = await _correlate(
                 call_id=call_id,
                 node_id=node_id,
                 system_id=system_id,
@@ -512,6 +468,11 @@ async def _extract_and_correlate(
                 incident_type=None,
                 location=None,
                 location_coords=None,
+                # server-26#104: the call doc's own severity, as
+                # recorrelation_sweep passes it. None resolved to "routine",
+                # which turned a reprocessed not-thin call into a thin one
+                # that attaches with no fit check.
+                severity=(_call_doc or {}).get("severity"),
             )
             if incident_id:
                 incident_ids.append(incident_id)
@@ -522,6 +483,33 @@ async def _extract_and_correlate(
     return incident_ids, all_tags, scenes
 
 
+def _late_upload_anchor(call_doc: Optional[dict]) -> Optional[datetime]:
+    """
+    The call's own started_at when its upload is late (server-26#301), else
+    None. "Late" is `late_upload_anchor_minutes` behind the real clock: an
+    on-time call keeps being judged against now exactly as before, so the live
+    path's recency windows are unchanged; only a spooled/retried upload is
+    back-dated. A started_at in the future or unparseable is ignored.
+    """
+    raw = (call_doc or {}).get("started_at")
+    if not raw:
+        return None
+    if isinstance(raw, datetime):   # mqtt_handler stores a native timestamp
+        started = raw
+    else:
+        try:
+            started = datetime.fromisoformat(str(raw).replace("Z", "+00:00"))
+        except ValueError:
+            return None
+    if started.tzinfo is None:
+        started = started.replace(tzinfo=timezone.utc)
+    lag = clock.now() - started
+    if lag > timedelta(minutes=settings.late_upload_anchor_minutes):
+        logger.info(f"Late upload: call started {lag} ago — correlating as of {started.isoformat()}")
+        return started
+    return None
+
+
 async def _run_intelligence_pipeline(
     call_id: str,
     node_id: str,
@@ -586,7 +574,7 @@ async def _run_intelligence_pipeline(
         if _flag("stt_enabled"):
             transcript, segments = await transcription.transcribe_call(
                 call_id, gcs_uri, talkgroup_name,
-                system_id=system_id, talkgroup_id=talkgroup_id,
+                system_id=system_id, talkgroup_id=talkgroup_id, node_id=node_id,
             )
         else:
             scope = "globally" if not flags["stt_enabled"] else f"system {system_id}"
@@ -596,15 +584,27 @@ async def _run_intelligence_pipeline(
     incident_ids: list[str] = []
     all_tags: list[str] = []
     if _flag("correlation_enabled"):
-        incident_ids, all_tags, _ = await _extract_and_correlate(
-            call_id=call_id,
-            node_id=node_id,
-            system_id=system_id,
-            talkgroup_id=talkgroup_id,
-            talkgroup_name=talkgroup_name,
-            transcript=transcript,
-            segments=segments,
-        )
+        # server-26#301: a late upload (the node spools and retries for up to
+        # 72h) is correlated as of when the call happened, not as of now — the
+        # same clock pin replay uses, so every recency gate and every
+        # started_at/updated_at/resolved_at it writes is on the call's own
+        # timeline. Without it a call hours late linked into whatever incident
+        # was live on its talkgroup now, or opened one at the wrong time.
+        anchor = _late_upload_anchor(_call_doc)
+        tok = clock.pin(anchor) if anchor else None
+        try:
+            incident_ids, all_tags, _ = await _extract_and_correlate(
+                call_id=call_id,
+                node_id=node_id,
+                system_id=system_id,
+                talkgroup_id=talkgroup_id,
+                talkgroup_name=talkgroup_name,
+                transcript=transcript,
+                segments=segments,
+            )
+        finally:
+            if tok is not None:
+                clock.unpin(tok)
     else:
         scope = "globally" if not flags["correlation_enabled"] else f"system {system_id}"
         logger.info(f"Correlation disabled ({scope}) — skipping scene extraction and correlation for call {call_id}")

drb-c2-core/app/routers/weather.py

@@ -0,0 +1,51 @@
+"""Weather context for the map (server-26#237): NWS alerts + nearest-METAR wind.
+
+Public-domain US Government data, cached server-side in app/internal/weather.py;
+no licence gate (unlike 511NY / outage providers).
+"""
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException, Query
+
+from app.internal import weather
+
+router = APIRouter(prefix="/weather", tags=["weather"])
+
+
+@router.get("/alerts")
+async def get_alerts(
+    south: Optional[float] = Query(None, ge=-90, le=90),
+    west: Optional[float] = Query(None, ge=-180, le=180),
+    north: Optional[float] = Query(None, ge=-90, le=90),
+    east: Optional[float] = Query(None, ge=-180, le=180),
+):
+    """Active NWS alerts with polygons, optionally filtered to those intersecting a bbox.
+
+    ``zone_only`` holds alerts whose zones could not be resolved to a polygon; it
+    is never bbox-filtered (there is no shape to test) and never dropped.
+    """
+    box = (south, west, north, east)
+    if any(v is not None for v in box) and any(v is None for v in box):
+        raise HTTPException(400, "give all of south, west, north, east or none")
+    if south is not None and (south > north or west > east):
+        raise HTTPException(400, "bbox must satisfy south<=north and west<=east")
+    feed = await weather.alerts.get()
+    items = feed.alerts
+    if south is not None:
+        items = [a for a in items if weather.intersects(a.get("bbox"), south, west, north, east)]
+    return {
+        "alerts": items,
+        "zone_only": feed.zone_only,
+        "fetched_at": feed.fetched_at,
+        "error": feed.error,
+        "credit": weather.CREDIT,
+    }
+
+
+@router.get("/wind")
+async def get_wind(
+    lat: float = Query(..., ge=-90, le=90),
+    lon: float = Query(..., ge=-180, le=180),
+):
+    """Wind from the nearest METAR station, or ``available: false`` with a reason."""
+    return await weather.nearest_wind(lat, lon)

drb-c2-core/tests/conftest.py

@@ -96,3 +96,13 @@ def _no_real_discord(monkeypatch):
     monkeypatch.setattr(discord_rest, "_transport", httpx.MockTransport(_offline))
     yield
     discord_rest.reset()
+
+
+@pytest.fixture(autouse=True)
+def _fresh_geocode_cache():
+    """The geocode cache (server-26#298) is process-wide; a test that stubs
+    Maps must never be answered by a previous test's stub."""
+    from app.internal import intelligence
+    intelligence.clear_geocode_cache()
+    yield
+    intelligence.clear_geocode_cache()

drb-c2-core/tests/test_ai_flag_gating.py

@@ -100,7 +100,7 @@ async def _run_ingest(global_correlation, system_ai_flags):
     )
     with g, sysdoc, \
          patch.object(upload, "fstore") as fs, \
-         patch.object(upload, "_correlate_with_consensus", AsyncMock(return_value=None)) as corr, \
+         patch.object(upload, "_correlate", AsyncMock(return_value=(None, {}))) as corr, \
          patch("app.internal.transcription.transcribe_call",
                AsyncMock(return_value=("units respond to main street", []))), \
          patch("app.internal.intelligence.extract_scenes", AsyncMock(return_value=[])) as scenes, \
@@ -219,15 +219,21 @@ async def test_transcript_correction_is_skipped_when_its_flag_is_off():
          patch.object(transcription, "fstore") as fs, \
          patch.object(transcription, "ai_health") as health, \
          patch.object(transcription, "transcript_correction") as tc, \
-         patch("asyncio.to_thread", AsyncMock(return_value=("units respond", [], False))):
+         patch.object(transcription.settings, "openai_api_key", "k"), \
+         patch.object(transcription.settings, "groq_api_key", None), \
+         patch.object(transcription, "_download", lambda uri: "/nonexistent.mp3"), \
+         patch.object(transcription, "_sync_transcribe_file", lambda *a, **k: {
+             "text": "units respond to the fire on Main Street", "segments": [],
+             "degenerate": False, "duration": 3.0, "confidence": None}):
         fs.doc_set = AsyncMock()
         health.report_healthy = AsyncMock()
         health.report_failure = AsyncMock()
         tc.correct = AsyncMock()
-        await transcription.transcribe_call(
+        text, _ = await transcription.transcribe_call(
             "call-1", "gs://bucket/call-1.mp3", "PD Dispatch", system_id="sys-1"
         )
 
+    assert text == "units respond to the fire on Main Street", "the transcript must still be produced"
     tc.correct.assert_not_awaited()
 
 

drb-c2-core/tests/test_ai_health.py

@@ -136,15 +136,15 @@ async def test_transient_failure_alerts_once_threshold_crossed():
 async def test_recovery_alerts_once_after_an_alerted_episode():
     with patch.object(ai_health, "_post_webhook", new=AsyncMock()) as webhook:
         await ai_health.report_degraded(
-            "correlation_smart", "gemini", "gemini-1.5-pro",
+            "correlation_cheap", "gemini", "gemini-3.6-flash",
             "the Gemini account is out of credit", "top up billing", permanent=True,
         )
         webhook.reset_mock()
 
-        await ai_health.report_healthy("correlation_smart")
+        await ai_health.report_healthy("correlation_cheap")
 
     webhook.assert_awaited_once()
-    state = ai_health.snapshot()["correlation_smart"]
+    state = ai_health.snapshot()["correlation_cheap"]
     assert state["degraded"] is False
     assert state["alerted"] is False
     assert state["consecutive_failures"] == 0

drb-c2-core/tests/test_ai_timeouts.py

@@ -153,8 +153,10 @@ def test_timeout_messages_classify_as_transient():
 
 
 def _corr_ctx():
+    from datetime import datetime, timezone
     return {"call_id": "c1", "is_thin_call": False, "recent": [{"incident_id": "i1"}],
-            "all_active": [], "call_units": ["12"], "call_cleared": [], "tags": ["mva"]}
+            "all_active": [], "call_units": ["12"], "call_cleared": [], "tags": ["mva"],
+            "now": datetime.now(timezone.utc)}
 
 
 @pytest.mark.asyncio
@@ -162,35 +164,22 @@ async def test_gemini_timeout_in_decide_falls_back_to_rules():
     def hang(model, prompt):
         raise httpx.ReadTimeout("The read operation timed out")
 
-    with patch.object(settings, "gemini_api_key", "test-key"), \
-         patch.object(llm_correlator, "_build_decide_prompt", lambda ctx: "p"), \
+    with patch.object(settings, "openai_api_key", "test-key"), \
+         patch.object(llm_correlator, "_build_decide_prompt", lambda ctx, cands: "p"), \
          patch.object(llm_correlator, "_sync_gemini", hang):
-        assert await llm_correlator.decide("c1", _corr_ctx()) is None  # None == rules_only
+        assert await llm_correlator.decide("c1", _corr_ctx()) is None  # None == keep the rules decision
     state = ai_health.snapshot()["correlation_cheap"]
     assert state["consecutive_failures"] == 1
     assert state["permanent"] is False
 
 
-@pytest.mark.asyncio
-async def test_gemini_timeout_in_tiebreak_keeps_the_rules_decision():
-    def hang(model, prompt):
-        raise httpx.ReadTimeout("The read operation timed out")
-
-    rules = {"action": "new", "matched_incident": None, "corr_debug": {}}
-    with patch.object(llm_correlator, "_build_tiebreak_prompt", lambda r, l, c: "p"), \
-         patch.object(llm_correlator, "_sync_gemini", hang):
-        out = await llm_correlator.tiebreak(rules, {"action": "orphan"}, _corr_ctx())
-    assert out is rules
-    assert ai_health.snapshot()["correlation_smart"]["permanent"] is False
-
-
 @pytest.mark.asyncio
 async def test_gemini_timeout_in_transcript_correction_keeps_raw_text():
     def hang(model, prompt):
         raise httpx.ReadTimeout("The read operation timed out")
 
     text = "engine 5 respond to a structure fire at 12 main street smoke showing"
-    with patch.object(settings, "gemini_api_key", "test-key"), \
+    with patch.object(settings, "openai_api_key", "test-key"), \
          patch.object(transcript_correction, "resolve_context", AsyncMock(return_value={})), \
          patch.object(transcript_correction, "_sync_gemini", hang):
         assert await transcript_correction.correct("c1", text) == (None, None, False)
@@ -233,8 +222,8 @@ def test_worst_case_bound_follows_the_settings():
          patch.object(settings, "gemini_timeout_seconds", 20.0), \
          patch.object(settings, "stt_retry_on_degenerate", True):
         bound = recorrelation_sweep.pipeline_worst_case_seconds(n_scenes=2)
-    # stt 2x2x100 + correction 20 + extraction 2x10 + embeds 2x2x10 + decide/tiebreak 2x20 + slack
-    assert bound == 400 + 20 + 20 + 40 + 40 + recorrelation_sweep._NON_AI_SLACK_SECONDS
+    # stt 2x2x100 + correction 20 + extraction 2x10 + embeds 2x2x10 + one correlation call 20 + slack
+    assert bound == 400 + 20 + 20 + 40 + 20 + recorrelation_sweep._NON_AI_SLACK_SECONDS
 
 
 def test_hold_back_covers_the_worst_case_and_never_drops_below_old_floor():

drb-c2-core/tests/test_alert_gate.py

@@ -0,0 +1,168 @@
+"""
+server-26#300 — confidence gate before any push alert.
+
+CrimeRadar pushed "shots fired at an elementary school" after STT heard "fire
+alarm" as "firearm". A single uncorroborated transcript hit on a
+high-severity term must be held, not pushed; a corroborated incident releases
+it; low-confidence matches never push.
+"""
+import pytest
+from unittest.mock import AsyncMock, patch
+
+from app.internal import alerter
+from tests.fake_firestore import FakeFirestore
+
+
+def _ev(**over):
+    base = {"incident_ids": [], "max_calls": 0, "severity": None,
+            "stt_confidence": None, "not_speech": False}
+    base.update(over)
+    return base
+
+
+# ── the pure decision ───────────────────────────────────────────────────────
+
+def test_talkgroup_only_rule_always_pushes():
+    v = alerter._assess(["talkgroup:9048"], [], _ev(stt_confidence=0.1))
+    assert v["push"] and v["confidence"] == 1.0
+
+
+def test_transcript_only_firearm_single_call_is_held():
+    v = alerter._assess(["firearm"], [], _ev())
+    assert not v["push"] and v["hold_reason"] == "needs_corroboration"
+    assert v["high_severity"] is True
+
+
+def test_tagged_shots_fired_still_needs_corroboration():
+    v = alerter._assess(["shots-fired"], ["shots-fired"], _ev(max_calls=1))
+    assert not v["push"] and v["confidence"] == 0.8
+
+
+def test_corroborated_high_severity_pushes():
+    v = alerter._assess(["shots-fired"], ["shots-fired"], _ev(max_calls=2))
+    assert v["push"]
+
+
+def test_major_incident_makes_any_content_match_high_severity():
+    v = alerter._assess(["school"], [], _ev(severity="major"))
+    assert v["high_severity"] and not v["push"]
+
+
+def test_ordinary_tag_match_pushes():
+    v = alerter._assess(["mva"], ["mva"], _ev(max_calls=1))
+    assert v["push"] and not v["high_severity"]
+
+
+def test_low_stt_confidence_holds_even_ordinary_matches():
+    v = alerter._assess(["mva"], ["mva"], _ev(stt_confidence=0.1))
+    assert not v["push"] and v["hold_reason"] == "low_confidence"
+    assert v["confidence"] == round(0.8 * 0.1 / 0.3, 3)
+
+
+def test_typical_radio_logprob_does_not_hold_a_transcript_match():
+    """exp(avg_logprob) of ~0.4 is normal on vocoded audio (review of #300)."""
+    v = alerter._assess(["mva"], [], _ev(stt_confidence=0.4))
+    assert v["push"]
+
+
+def test_not_speech_never_pushes_content():
+    v = alerter._assess(["mva"], ["mva"], _ev(not_speech=True))
+    assert not v["push"]
+
+
+# ── end to end through Firestore ────────────────────────────────────────────
+
+RULE = {"rule_id": "r1", "name": "Weapons", "enabled": True, "org_id": "org-1",
+        "keywords": ["firearm", "shots-fired"], "discord_webhook": "https://discord.example/wh"}
+
+
+@pytest.fixture
+def fs(monkeypatch):
+    fake = FakeFirestore.install(monkeypatch)
+    fake.put("alert_rules", "r1", dict(RULE))
+    return fake
+
+
+def _posts():
+    posted = []
+
+    class _Client:
+        async def __aenter__(self): return self
+        async def __aexit__(self, *a): return False
+
+        async def post(self, url, json=None, **k):
+            posted.append(json)
+
+    return posted, patch("httpx.AsyncClient", lambda *a, **k: _Client())
+
+
+async def _dispatch(call_id, tags, transcript):
+    await alerter.check_and_dispatch(call_id=call_id, node_id="n1", talkgroup_id=1,
+                                     talkgroup_name="PD Dispatch", tags=tags, transcript=transcript)
+
+
+@pytest.mark.asyncio
+async def test_crimeradar_case_is_held_then_released_by_corroboration(fs):
+    fs.put("calls", "c1", {"org_id": "org-1", "incident_ids": ["inc-1"]})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1"], "severity": "moderate"})
+    posted, http = _posts()
+    with http:
+        await _dispatch("c1", [], "report of a firearm at the elementary school")
+    assert posted == [], "a single uncorroborated firearm hit must not push"
+    assert fs.data.get("alert_events", {}) == {}
+    (hold,) = fs.data["alert_holds"].values()
+    assert hold["status"] == "held" and hold["hold_reason"] == "needs_corroboration"
+    assert hold["incident_id"] == "inc-1"
+
+    # A second call joins the incident; it does not itself mention a firearm.
+    fs.put("calls", "c2", {"org_id": "org-1", "incident_ids": ["inc-1"]})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1", "c2"], "severity": "moderate"})
+    with http:
+        await _dispatch("c2", [], "units on scene, stand by")
+    assert len(posted) == 1 and "Weapons" in posted[0]["content"]
+    (event,) = fs.data["alert_events"].values()
+    assert event["released_from_hold"] is True and event["corroborated_by_call_id"] == "c2"
+    assert fs.get("alert_holds", hold["alert_id"])["status"] == "released"
+
+
+@pytest.mark.asyncio
+async def test_low_confidence_hold_is_not_released_by_corroboration(fs):
+    fs.put("calls", "c1", {"org_id": "org-1", "incident_ids": ["inc-1"], "stt_confidence": 0.1})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1"]})
+    posted, http = _posts()
+    with http:
+        await _dispatch("c1", [], "firearm")
+    (hold,) = fs.data["alert_holds"].values()
+    assert hold["hold_reason"] == "low_confidence"
+
+    fs.put("calls", "c2", {"org_id": "org-1", "incident_ids": ["inc-1"]})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1", "c2"]})
+    with http:
+        await _dispatch("c2", [], "units on scene")
+    assert posted == []
+    assert fs.get("alert_holds", hold["alert_id"])["status"] == "held"
+
+
+@pytest.mark.asyncio
+async def test_rule_pushed_now_supersedes_its_hold_instead_of_alerting_twice(fs):
+    fs.put("calls", "c1", {"org_id": "org-1", "incident_ids": ["inc-1"]})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1"]})
+    posted, http = _posts()
+    with http:
+        await _dispatch("c1", ["shots-fired"], "shots fired")
+    fs.put("calls", "c2", {"org_id": "org-1", "incident_ids": ["inc-1"]})
+    fs.put("incidents", "inc-1", {"call_ids": ["c1", "c2"]})
+    with http:
+        await _dispatch("c2", ["shots-fired"], "more shots fired")
+    assert len(posted) == 1
+    (hold,) = fs.data["alert_holds"].values()
+    assert hold["status"] == "superseded"
+
+
+@pytest.mark.asyncio
+async def test_held_alerts_are_listed_for_admins(fs):
+    from app.routers import alerts as alerts_router
+    fs.put("alert_holds", "h1", {"alert_id": "h1", "status": "held", "triggered_at": "2026-10-27T01:00:00"})
+    fs.put("alert_holds", "h2", {"alert_id": "h2", "status": "released", "triggered_at": "2026-10-27T02:00:00"})
+    out = await alerts_router.list_held_alerts(status="held", org_id=None, _={})
+    assert [h["alert_id"] for h in out] == ["h1"]

drb-c2-core/tests/test_chatter_gate.py

@@ -0,0 +1,194 @@
+"""
+server-26#298 — the chatter pre-filter gates every paid call.
+
+Radio housekeeping (roll call, a bare "Post 4, 10-8, 10-4") used to go through
+transcript correction, scene extraction, an embedding per scene and a geocode,
+only to come back as a thin routine scene. Now it pays for none of them; the
+free rule paths (clearance parse, self-initiated/plate backstop) still run.
+"""
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from app.config import settings
+from app.internal import intelligence, transcription
+from app.internal.chatter_classifier import gate_chatter
+
+
+@pytest.fixture(autouse=True)
+def _gate_on():
+    """The gate ships OFF (shadow) until a live window clears it (#127);
+    these tests exercise it switched on."""
+    with patch.object(settings, "chatter_gate_enabled", True):
+        yield
+
+
+class _NoPaidCalls:
+    """Fail the test if any paid extraction/embedding/geocode call happens."""
+
+    def __enter__(self):
+        def _boom(*a, **k):
+            raise AssertionError("a paid AI call was made for chatter")
+
+        async def _aboom(*a, **k):
+            raise AssertionError("a paid geocode was made for chatter")
+
+        self.ps = [
+            patch.object(intelligence, "_sync_extract", _boom),
+            patch.object(intelligence, "_sync_embed", _boom),
+            patch.object(intelligence, "_geocode_lookup", _aboom),
+        ]
+        for p in self.ps:
+            p.start()
+        return self
+
+    def __exit__(self, *a):
+        for p in self.ps:
+            p.stop()
+
+
+async def _extract(transcript, talkgroup_name="PD Dispatch"):
+    saved: dict = {}
+
+    async def _doc_set(coll, doc_id, data, merge=True):
+        saved.update(data)
+
+    with patch.object(intelligence.fstore, "doc_get_cached", AsyncMock(return_value=None)), \
+         patch.object(intelligence.fstore, "doc_set", _doc_set):
+        scenes = await intelligence.extract_scenes("call-1", transcript, talkgroup_name)
+    return scenes, saved
+
+
+@pytest.mark.asyncio
+async def test_bare_acknowledgement_over_five_words_skips_extraction():
+    with _NoPaidCalls():
+        scenes, saved = await _extract("10-4, 10-4 Central, 98. 10-4, 98.")
+    assert scenes == []
+    assert saved["skip_reason"] == "non_event_chatter"
+    assert saved["severity"] == "routine"
+    assert saved["chatter_classifier_verdict"] is True
+
+
+@pytest.mark.asyncio
+async def test_whole_roll_call_skips_extraction():
+    roll = ("Car 100, roll call. Henry 1. Henry 1. Sam 1. Sam 1. 45 Baker. 45 Baker. "
+            "11 Adam. Adam. 11 Baker. Baker. Staff 1. 1. Staff 2.")
+    with _NoPaidCalls():
+        scenes, saved = await _extract(roll)
+    assert scenes == [] and saved["skip_reason"] == "non_event_chatter"
+
+
+@pytest.mark.asyncio
+async def test_roll_call_mentioned_on_the_way_to_a_real_job_still_extracts():
+    """The #127 review's false-positive shape must still reach the model."""
+    text = "Delayed for roll call, then respond to a structure fire at 12 Main Street"
+    assert gate_chatter(text) == (False, None)
+    with patch.object(intelligence, "_sync_extract", return_value=[]) as ext:
+        await _extract(text)
+    ext.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_plate_read_chatter_still_becomes_a_stop_for_free():
+    text = "Lincoln Charlie Robert 7-4-0-7, Lincoln Charlie Robert 7-4-0-7."
+    with _NoPaidCalls():
+        scenes, saved = await _extract(text)
+    assert len(scenes) == 1 and scenes[0]["tags"] == ["traffic-stop"]
+    assert saved["severity"] == "minor"
+
+
+@pytest.mark.asyncio
+async def test_gate_off_restores_shadow_mode():
+    with patch.object(settings, "chatter_gate_enabled", False), \
+         patch.object(intelligence, "_sync_extract", return_value=[]) as ext:
+        _, saved = await _extract("10-4, 10-4 Central, 98. 10-4, 98.")
+    ext.assert_called_once()
+    assert saved["chatter_classifier_verdict"] is True, "the shadow verdict is still recorded"
+
+
+@pytest.mark.asyncio
+async def test_real_event_is_not_gated():
+    with patch.object(intelligence, "_sync_extract", return_value=[]) as ext:
+        await _extract("Shots fired, officer down, requesting backup immediately at the school.")
+    ext.assert_called_once()
+
+
+@pytest.mark.asyncio
+async def test_transcription_skips_correction_for_chatter():
+    flags = {"transcript_correction_enabled": True}
+    with patch.object(settings, "openai_api_key", "k"), \
+         patch.object(settings, "groq_api_key", None), \
+         patch.object(transcription, "_download", lambda uri: "/nonexistent.flac"), \
+         patch.object(transcription, "_sync_transcribe_file", lambda *a, **k: {
+             "text": "Post 4, 10-8. 10-4. Copy, 98.", "segments": [],
+             "degenerate": False, "duration": 2.0, "confidence": None}), \
+         patch.object(transcription.fstore, "doc_set", AsyncMock()), \
+         patch.object(transcription, "ai_health") as health, \
+         patch.object(transcription.transcript_correction, "correct", AsyncMock()) as correct, \
+         patch("app.internal.feature_flags.resolve_flags",
+               AsyncMock(return_value=(flags, lambda k: flags.get(k, True)))):
+        health.report_healthy = AsyncMock()
+        text, _ = await transcription.transcribe_call("call-1", "gs://b/c.flac", "PD Dispatch")
+    assert text == "Post 4, 10-8. 10-4. Copy, 98."
+    correct.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_chatter_still_reaches_the_free_thin_correlation_path():
+    """non_event_chatter joins transcript_too_short in upload.py's no-scene
+    fallback (rules-only for a thin call — no LLM)."""
+    from app.routers import upload
+
+    with patch.object(upload, "fstore") as fs, \
+         patch.object(upload, "_correlate", AsyncMock(return_value=(None, None))) as corr:
+        fs.doc_get = AsyncMock(return_value={"skip_reason": "non_event_chatter", "severity": "routine"})
+        fs.doc_set = AsyncMock()
+        await upload._extract_and_correlate(
+            call_id="c1", node_id="n1", system_id="s1", talkgroup_id=1,
+            talkgroup_name="PD Dispatch", transcript="10-4 Central, 98.", scenes=[],
+        )
+    corr.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_no_scene_fallback_passes_the_call_doc_severity():
+    """server-26#104: a reprocessed call whose doc says 'major' must not be
+    re-correlated as 'routine' (thin, no fit check)."""
+    from app.routers import upload
+
+    with patch.object(upload, "fstore") as fs, \
+         patch.object(upload, "_correlate", AsyncMock(return_value=(None, None))) as corr:
+        fs.doc_get = AsyncMock(return_value={"severity": "major"})
+        fs.doc_set = AsyncMock()
+        await upload._extract_and_correlate(
+            call_id="c1", node_id="n1", system_id="s1", talkgroup_id=1,
+            talkgroup_name="PD Dispatch", transcript="whatever", scenes=[],
+        )
+    assert corr.await_args.kwargs["severity"] == "major"
+
+
+@pytest.mark.asyncio
+async def test_gate_off_still_corrects_chatter():
+    """With the gate off, transcription must not skip correction either."""
+    flags = {"transcript_correction_enabled": True}
+    with patch.object(settings, "chatter_gate_enabled", False), \
+         patch.object(settings, "openai_api_key", "k"), \
+         patch.object(settings, "groq_api_key", None), \
+         patch.object(transcription, "_download", lambda uri: "/nonexistent.flac"), \
+         patch.object(transcription, "_sync_transcribe_file", lambda *a, **k: {
+             "text": "Post 4, 10-8. 10-4. Copy, 98.", "segments": [],
+             "degenerate": False, "duration": 2.0, "confidence": None}), \
+         patch.object(transcription.fstore, "doc_set", AsyncMock()), \
+         patch.object(transcription, "ai_health") as health, \
+         patch.object(transcription.transcript_correction, "correct",
+                      AsyncMock(return_value=(None, None, False))) as correct, \
+         patch("app.internal.feature_flags.resolve_flags",
+               AsyncMock(return_value=(flags, lambda k: flags.get(k, True)))):
+        health.report_healthy = AsyncMock()
+        await transcription.transcribe_call("call-1", "gs://b/c.flac", "PD Dispatch")
+    correct.assert_awaited_once()
+
+
+def test_gate_ships_off():
+    from app.config import Settings
+    assert Settings.model_fields["chatter_gate_enabled"].default is False

drb-c2-core/tests/test_clearance_tracking.py

@@ -53,12 +53,11 @@ def test_a_unit_never_on_the_incident_cannot_close_it():
 
 
 def test_clearance_only_call_skips_the_llm():
-    from app.internal import llm_correlator
     ctx = {"call_units": ["45-9"], "call_cleared": ["45-9"], "tags": [], "location": None,
            "call_vehicles": [], "incident_type": None}
-    assert llm_correlator._is_clearance_only(ctx)
-    assert not llm_correlator._is_clearance_only({**ctx, "tags": ["mva"]})
-    assert not llm_correlator._is_clearance_only({**ctx, "call_cleared": []})
+    assert ic.is_clearance_only(ctx)
+    assert not ic.is_clearance_only({**ctx, "tags": ["mva"]})
+    assert not ic.is_clearance_only({**ctx, "call_cleared": []})
 
 
 def test_only_numbered_units_hold_an_incident_open():

drb-c2-core/tests/test_consensus_gate.py

@@ -1,430 +0,0 @@
-"""
-server-26#115 — two consensus-quality fixes.
-
-Fix 1 (routers/upload.py): when the cheap LLM says `orphan`, the rules engine
-says `new`, and the call is genuinely SUBSTANCELESS (routine severity, no
-vehicle/geocode/tag, and no incident already running on the same talkgroup),
-resolve to `orphan` and DO NOT pay for the smart tiebreaker. Radio housekeeping
-(unit check-ins, roll call, 10-8/10-98) was being promoted to incidents because
-the tiebreaker rubber-stamped the rules `new` ~21/21 of the time
-(CORRELATION_REVIEW_0907b.md).
-
-The substance test runs against `ctx` (fully populated at preview time), NOT
-against `rules_decision["corr_debug"]` — that dict is EMPTY at preview time for
-action=="new" (corr_path:"new" is written at APPLY time), so the first version of
-this gate fired on real events (a `major` "extinguishing fire", geocoded calls,
-pursuit updates).
-
-Fix 2 (incident_correlator.py): the `location` correlation path linked on a bare
-sub-`location_proximity_km` (0.5 km) distance alone, taking whichever incident
-came first in an unsorted `recent`. In a dense village two unrelated events
-routinely geocode that close. A `location` link now needs unit overlap with the
-candidate OR a distance under a tighter bar, and picks the NEAREST qualifying
-candidate. A unit-overlap location link is tagged `location_unit_overlap` so it
-does not merge into the fast path's bucket in the admin fit-signal histogram.
-"""
-from datetime import datetime, timedelta, timezone
-from unittest.mock import AsyncMock, patch
-
-import pytest
-
-from app.routers import upload
-from app.internal.incident_correlator import _run_decision, has_event_substance
-
-NOW = datetime(2026, 9, 7, 21, 30, 0, tzinfo=timezone.utc)
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Fix 1 — the LLM-orphan gate in _correlate_with_consensus
-# ─────────────────────────────────────────────────────────────────────────────
-
-def _preview(action, corr_debug=None, ctx=None):
-    base_ctx = {"call_id": "call-1"}
-    if ctx:
-        base_ctx.update(ctx)
-    return {
-        "decision": {
-            "action": action,
-            "matched_incident": None,
-            "incident_type": "other" if action == "new" else None,
-            "corr_debug": {} if corr_debug is None else dict(corr_debug),
-        },
-        "ctx": base_ctx,
-    }
-
-
-def _llm(action, reasoning="—"):
-    md = {"incident_id": "inc-1"} if action == "link" else None
-    return {"action": action, "matched_incident": md, "reasoning": reasoning}
-
-
-async def _run_consensus(preview, llm_decision):
-    tiebreak_result = {
-        "action": "new", "matched_incident": None, "incident_type": "other",
-        "corr_debug": {}, "reasoning": "tb",
-    }
-    with patch("app.internal.incident_correlator.preview_correlation",
-               new=AsyncMock(return_value=preview)), \
-         patch("app.internal.incident_correlator.apply_correlation",
-               new=AsyncMock(return_value="incident-x")) as m_apply, \
-         patch("app.internal.llm_correlator.decide",
-               new=AsyncMock(return_value=llm_decision)), \
-         patch("app.internal.llm_correlator.tiebreak",
-               new=AsyncMock(return_value=tiebreak_result)) as m_tiebreak:
-        await upload._correlate_with_consensus(
-            call_id="call-1", node_id="n1", system_id="sys-1",
-            talkgroup_id=9048, talkgroup_name="Dispatch", tags=[],
-            incident_type=None, location=None, location_coords=None,
-        )
-    return m_apply, m_tiebreak
-
-
-async def test_substanceless_no_recent_same_tg_incident_gates_without_tiebreak():
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}), _llm("orphan", "unit check-in, not an incident"),
-    )
-    m_tiebreak.assert_not_called()
-    m_apply.assert_called_once()
-    gated = m_apply.call_args[0][0]["decision"]
-    assert gated["action"] == "orphan"
-    dbg = gated["corr_debug"]
-    assert dbg["corr_consensus"] == "llm_orphan_gate"
-    assert dbg["corr_consensus"] != "tiebreak"
-    assert dbg["corr_rules_action"] == "new"
-    assert dbg["corr_llm_action"] == "orphan"
-    assert dbg["corr_llm_reasoning"] == "unit check-in, not an incident"
-
-
-@pytest.mark.parametrize("severity", ["moderate", "major"])
-async def test_moderate_or_major_severity_is_not_gated(severity):
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"call_severity": severity}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_routine_severity_alone_still_gates():
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"call_severity": "routine"}), _llm("orphan"),
-    )
-    m_tiebreak.assert_not_called()
-    assert m_apply.call_args[0][0]["decision"]["action"] == "orphan"
-
-
-async def test_call_with_coords_is_not_gated():
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"coords": {"lat": 41.15, "lng": -73.86}}),
-        _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_call_with_tags_is_not_gated():
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"tags": ["structure-fire"]}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_call_with_vehicles_is_not_gated():
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"call_vehicles": ["red sedan"]}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_call_with_resolved_incident_type_is_not_gated():
-    # The creation gate skips has_event_substance when a type resolved, so a
-    # typed call (fire/medical/…) opens an incident on substance the gate does
-    # not re-check — it must keep the tiebreak, not be dropped.
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"incident_type": "fire"}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_reassignment_call_is_not_gated():
-    # reassignment=True is dispatch pulling a unit onto a NEW job (units are
-    # blanked for exactly that reason) — the strongest new-incident signal.
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx={"reassignment": True}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_recent_incident_on_same_talkgroup_is_not_gated():
-    ctx = {
-        "system_id": "sys-1",
-        "talkgroup_id": 9048,
-        "talkgroup_name": "Dispatch",
-        "now": NOW,
-        "recent": [{
-            "incident_id": "inc-live",
-            "system_ids": ["sys-1"],
-            "talkgroup_ids": ["9048"],
-            "updated_at": (NOW - timedelta(minutes=1)).isoformat(),
-        }],
-    }
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-# server-26#115 window #3 (CORRELATION_REVIEW_0912.md): the escape hatch used
-# to treat ANY same-talkgroup incident inside the 2h correlation_window_hours
-# as "recent", which on a busy dispatch channel (3-13 incidents/2h) was
-# satisfied almost unconditionally — the gate fired 0/24 times against its own
-# target shape. It now only counts an incident as recent within
-# settings.tg_dispatch_thin_idle_minutes (5 min), applied uniformly regardless
-# of the talkgroup's name (owner correction, 2026-09-13 — see
-# test_channel_name_does_not_affect_the_window below for why the dichotomy
-# this originally had with incident_correlator's fast/thin idle selection was
-# removed here).
-
-async def test_recent_same_tg_incident_inside_new_short_window_still_escapes_gate():
-    ctx = {
-        "system_id": "sys-1",
-        "talkgroup_id": 9048,
-        "talkgroup_name": "Dispatch",
-        "now": NOW,
-        "recent": [{
-            "incident_id": "inc-live",
-            "system_ids": ["sys-1"],
-            "talkgroup_ids": ["9048"],
-            # 3 min ago — inside tg_dispatch_thin_idle_minutes (5).
-            "updated_at": (NOW - timedelta(minutes=3)).isoformat(),
-        }],
-    }
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-
-
-async def test_recent_same_tg_incident_older_than_short_window_now_gates():
-    # Regression test for the fix: 8 minutes is past the 5-minute bound but
-    # still inside the OLD 2-hour correlation_window_hours lookback. Before
-    # the fix this escaped the gate on any channel; after the fix it gates.
-    ctx = {
-        "system_id": "sys-1",
-        "talkgroup_id": 9048,
-        "talkgroup_name": "Dispatch",
-        "now": NOW,
-        "recent": [{
-            "incident_id": "inc-stale",
-            "system_ids": ["sys-1"],
-            "talkgroup_ids": ["9048"],
-            "updated_at": (NOW - timedelta(minutes=8)).isoformat(),
-        }],
-    }
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_not_called()
-    assert m_apply.call_args[0][0]["decision"]["action"] == "orphan"
-
-
-async def test_channel_name_does_not_affect_the_window():
-    # Owner correction, 2026-09-13 (direct scanning experience): a talkgroup
-    # named "tac"/"tactical" only sees materially different traffic during a
-    # real incident, and that's rare -- the bulk of traffic on any monitored
-    # channel, including high-risk stops and pursuits, runs on the main
-    # channel regardless of what it's named. An earlier version of this used
-    # a longer 15-minute window on anything not literally named "dispatch"/
-    # "patched"/"primary" (mirroring incident_correlator's fast/thin idle
-    # selection); that meant a busy single-channel department not literally
-    # named "dispatch" silently got the more permissive window and could
-    # reproduce #115's original bug. Same 8-minute age as the dispatch-named
-    # test above, but on a channel named "Tac 3" -- must gate identically,
-    # not escape into a longer window just because of the name.
-    ctx = {
-        "system_id": "sys-1",
-        "talkgroup_id": 383,
-        "talkgroup_name": "Tac 3",
-        "now": NOW,
-        "recent": [{
-            "incident_id": "inc-tac",
-            "system_ids": ["sys-1"],
-            "talkgroup_ids": ["383"],
-            "updated_at": (NOW - timedelta(minutes=8)).isoformat(),
-        }],
-    }
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_not_called()
-    assert m_apply.call_args[0][0]["decision"]["action"] == "orphan"
-
-
-async def test_gate_veto_reason_is_recorded_on_the_escalation_path():
-    # server-26#115: a live measurement window must be able to see *why* an
-    # llm=orphan/rules=new call escaped the gate without guessing from the raw
-    # dump (which produced a wrong "confirmed explanation" for 2 window-#3
-    # misses the first time). corr_gate_veto names the surviving condition.
-    ctx = {"call_severity": "major"}
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-    final = m_apply.call_args[0][0]["decision"]
-    assert final["corr_debug"]["corr_gate_veto"] == "severity"
-
-
-async def test_gate_veto_reason_is_absent_when_the_disagreement_is_not_orphan_vs_new():
-    # corr_gate_veto is only meaningful for the llm=orphan/rules=new shape the
-    # gate targets — it must not appear (or be misleadingly None-vs-absent) on
-    # an unrelated disagreement shape.
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("link", {}), _llm("orphan"),
-    )
-    m_tiebreak.assert_called_once()
-    final = m_apply.call_args[0][0]["decision"]
-    assert "corr_gate_veto" not in final["corr_debug"]
-
-
-async def test_recent_incident_on_a_different_talkgroup_still_gates():
-    ctx = {
-        "system_id": "sys-1",
-        "talkgroup_id": 9048,
-        "recent": [{
-            "incident_id": "inc-other",
-            "system_ids": ["sys-1"],
-            "talkgroup_ids": ["1200"],
-        }],
-    }
-    m_apply, m_tiebreak = await _run_consensus(
-        _preview("new", {}, ctx=ctx), _llm("orphan"),
-    )
-    m_tiebreak.assert_not_called()
-    assert m_apply.call_args[0][0]["decision"]["action"] == "orphan"
-
-
-async def test_llm_link_vs_rules_new_still_escalates():
-    m_apply, m_tiebreak = await _run_consensus(_preview("new", {}), _llm("link", "same job"))
-    m_tiebreak.assert_called_once()
-
-
-async def test_llm_orphan_vs_rules_link_still_escalates():
-    # Not the gate condition (gate needs rules=="new"); must fall through.
-    m_apply, m_tiebreak = await _run_consensus(_preview("link", {}), _llm("orphan"))
-    m_tiebreak.assert_called_once()
-
-
-def test_has_event_substance_predicate():
-    assert has_event_substance({"coords": {"lat": 1, "lng": 2}})
-    assert has_event_substance({"tags": ["fire"]})
-    assert has_event_substance({"call_vehicles": ["sedan"]})
-    assert not has_event_substance({})
-    assert not has_event_substance({"coords": None, "tags": [], "call_vehicles": []})
-    # units and location are NOT substance — nearly every transmission has them.
-    assert not has_event_substance({"call_units": ["7-Adam"], "location": "Main St"})
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Fix 2 — tighten corr_path=location
-# ─────────────────────────────────────────────────────────────────────────────
-
-CALL_COORDS = {"lat": 41.150000, "lng": -73.860000}
-# ~0.39 km north of the call — inside location_proximity_km (0.5) but well
-# outside the tight bar (_LOCATION_TIGHT_PROXIMITY_KM, 0.2).
-FAR_INC_COORDS = {"lat": 41.153500, "lng": -73.860000}
-# ~0.13 km north of the call — inside the tight bar.
-NEAR_INC_COORDS = {"lat": 41.151200, "lng": -73.860000}
-# ~0.28 km north — inside the 0.5 radius, outside the 0.2 tight bar; used as a
-# second candidate that must lose the nearest-wins sort to NEAR_INC_COORDS.
-MID_INC_COORDS = {"lat": 41.152500, "lng": -73.860000}
-
-
-def _inc(incident_id, coords, units):
-    return {
-        "incident_id": incident_id,
-        "system_ids": ["sys-1"],
-        "talkgroup_ids": ["100"],           # different TGID → fast path is a no-op
-        "location_coords": coords,
-        "units": units,
-        "tags": [],
-        "type": "police",
-        "updated_at": (NOW - timedelta(minutes=6)).isoformat(),
-        "started_at": (NOW - timedelta(minutes=20)).isoformat(),
-        "status": "active",
-        "call_ids": ["c0"],
-    }
-
-
-def _loc_ctx(*, incidents, call_units):
-    return {
-        "call_id": "call-loc",
-        "all_active": list(incidents),
-        "recent": list(incidents),
-        "call_doc": {},
-        "call_embedding": None,
-        "call_units": call_units,
-        "call_vehicles": [],
-        "call_cleared": [],
-        "call_severity": "routine",
-        "coords": CALL_COORDS,
-        "is_thin_call": False,
-        "now": NOW,
-        "system_id": "sys-1",
-        "talkgroup_id": 999,               # not in inc.talkgroup_ids
-        "talkgroup_name": "Tactical",
-        "tags": [],
-        "incident_type": "police",
-        "location": "Main St",
-        "location_coords": CALL_COORDS,
-        "reassignment": True,              # suppress the unit-continuity path
-        "create_if_new": True,
-    }
-
-
-def test_location_path_in_radius_but_no_unit_overlap_no_tight_proximity_does_not_link(caplog):
-    ctx = _loc_ctx(
-        incidents=[_inc("inc-loc", FAR_INC_COORDS, ["7-Adam"])],
-        call_units=["3-Boy"],
-    )
-    with caplog.at_level("INFO", logger="drb-c2-core"):
-        decision = _run_decision(ctx)
-    # Reaches, and is rejected by, the new guard (not an earlier path).
-    assert "location-path skipped" in caplog.text
-    assert decision["action"] != "link"
-    assert (decision.get("corr_debug") or {}).get("corr_path") != "location"
-
-
-def test_location_path_links_on_unit_overlap_with_distinct_fit_signal():
-    ctx = _loc_ctx(
-        incidents=[_inc("inc-loc", FAR_INC_COORDS, ["5-Adam"])],
-        call_units=["5-Adam"],
-    )
-    decision = _run_decision(ctx)
-    assert decision["action"] == "link"
-    assert decision["corr_debug"]["corr_path"] == "location"
-    # NOT "unit_overlap" — that value belongs to the fast path's histogram bucket.
-    assert decision["corr_debug"]["corr_fit_signal"] == "location_unit_overlap"
-
-
-def test_location_path_links_on_tight_proximity_without_unit_overlap():
-    ctx = _loc_ctx(
-        incidents=[_inc("inc-loc", NEAR_INC_COORDS, ["7-Adam"])],
-        call_units=["3-Boy"],
-    )
-    decision = _run_decision(ctx)
-    assert decision["action"] == "link"
-    assert decision["corr_debug"]["corr_path"] == "location"
-    assert decision["corr_debug"]["corr_fit_signal"] == "location_proximity"
-
-
-def test_location_path_picks_nearest_in_radius_candidate():
-    # `recent` order puts the farther tight-proximity incident first; the guard
-    # must still select the nearest one.
-    ctx = _loc_ctx(
-        incidents=[
-            _inc("inc-mid", MID_INC_COORDS, ["3-Boy"]),   # ~0.28 km, tight-fail
-            _inc("inc-near", NEAR_INC_COORDS, ["3-Boy"]),  # ~0.13 km, tight-pass
-        ],
-        call_units=["3-Boy"],
-    )
-    decision = _run_decision(ctx)
-    assert decision["action"] == "link"
-    assert decision["matched_incident"]["incident_id"] == "inc-near"
-    assert decision["corr_debug"]["corr_path"] == "location"

drb-c2-core/tests/test_correlation_decision_flow.py

@@ -0,0 +1,432 @@
+"""
+server-26#299 — rules decide confident outcomes; ONE cheap LLM call only in the
+ambiguous band; no cheap/smart consensus tiebreak.
+
+Also pins the section fixes that ride on the new shape:
+  #86  divergence veto bar is a setting, and the band between it and the match
+       bar is ambiguous rather than a silent merge
+  #103 a scene with no embedding is "unverified", not verified
+  #88  LLM yes/no fields fail closed; a closure only counts on a confident link
+  #189 weak links refused past the span cap; LLM links distance-guarded
+  #190 severity steps down on an explicit stand-down, the peak never does
+  #27  sweep budget is wall-clock
+  #301 late uploads are correlated on the call's own clock
+  #302 a retried upload does not re-run the pipeline
+"""
+from datetime import datetime, timedelta, timezone
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from app.config import settings
+from app.internal import incident_correlator as ic
+from app.internal import llm_correlator, recorrelation_sweep
+from app.routers import upload
+
+NOW = datetime(2026, 10, 27, 15, 0, 0, tzinfo=timezone.utc)
+
+
+def _inc(incident_id="inc-1", idle=1.0, span=None, **kw) -> dict:
+    updated = NOW - timedelta(minutes=idle)
+    started = NOW - timedelta(minutes=span if span is not None else idle)
+    inc = {
+        "incident_id": incident_id, "system_ids": ["sys-1"], "talkgroup_ids": ["383"],
+        "updated_at": updated.isoformat(), "started_at": started.isoformat(),
+        "status": "active", "call_ids": ["seed"], "type": "police",
+    }
+    inc.update(kw)
+    return inc
+
+
+def _ctx(incidents=(), **kw) -> dict:
+    incidents = list(incidents)
+    base = {
+        "call_id": "call-1", "all_active": incidents, "recent": incidents,
+        "call_doc": {}, "call_embedding": None, "call_units": [], "call_vehicles": [],
+        "call_cleared": [], "call_severity": "routine", "coords": None,
+        "is_thin_call": False, "now": NOW, "system_id": "sys-1", "talkgroup_id": 383,
+        "talkgroup_name": "Ch 1", "tags": [], "incident_type": None, "location": None,
+        "location_coords": None, "reassignment": False, "create_if_new": True,
+    }
+    base.update(kw)
+    return base
+
+
+def _vec(sim: float) -> tuple[list, list]:
+    """Two unit vectors with cosine similarity `sim`."""
+    import math
+    return [1.0, 0.0], [sim, math.sqrt(max(0.0, 1 - sim * sim))]
+
+
+# ── The band ────────────────────────────────────────────────────────────────
+
+def test_fresh_unit_link_is_confident():
+    d = ic._run_decision(_ctx([_inc(idle=2, units=["6-Adam"])], call_units=["6-Adam"]))
+    assert d["action"] == "link"
+    assert d["corr_debug"]["corr_fit_signal"] == "unit_overlap"
+    assert d["ambiguous"] is None
+
+
+def test_stale_unit_link_without_embedding_is_ambiguous_not_verified():
+    # #103: no embedding used to skip the veto and link as if verified.
+    d = ic._run_decision(_ctx([_inc(idle=20, units=["6-Adam"])], call_units=["6-Adam"]))
+    assert d["action"] == "link"
+    assert d["corr_debug"]["corr_fit_signal"] == "unit_overlap_unverified"
+    assert d["ambiguous"] == "unverified_unit_link"
+
+
+def test_young_but_long_running_unit_link_is_ambiguous():
+    # #189: busy channel keeps idle low; age is what reveals a sink forming.
+    inc = _inc(idle=1, span=settings.unit_link_confident_max_span_minutes + 5, units=["6-Adam"])
+    d = ic._run_decision(_ctx([inc], call_units=["6-Adam"]))
+    assert d["ambiguous"] == "unverified_unit_link"
+
+
+@pytest.mark.parametrize("sim,expected", [
+    (0.80, ("orphan", "content_divergence")),     # below the divergence bar → veto
+    (0.88, ("link", "unit_overlap_unverified")),  # between the bars → ambiguous (#86)
+    (0.95, ("link", "unit_content_match")),       # at the match bar → confident
+])
+def test_divergence_band_between_the_two_thresholds(sim, expected):
+    call_emb, inc_emb = _vec(sim)
+    inc = _inc(idle=20, units=["6-Adam"], embedding=inc_emb)
+    fit, signal = ic._call_fits_incident(
+        inc, ["6-Adam"], [], None, settings.location_proximity_km,
+        call_embedding=call_emb, now=NOW,
+    )
+    assert (("link" if fit else "orphan"), signal) == expected
+
+
+def test_divergence_bar_is_the_setting_not_a_literal():
+    call_emb, inc_emb = _vec(0.88)
+    inc = _inc(idle=20, units=["6-Adam"], embedding=inc_emb)
+    with patch.object(settings, "embedding_divergence_threshold", 0.90):
+        fit, signal = ic._call_fits_incident(
+            inc, ["6-Adam"], [], None, settings.location_proximity_km,
+            call_embedding=call_emb, now=NOW,
+        )
+    assert (fit, signal) == (False, "content_divergence")
+
+
+def test_new_with_live_candidates_is_ambiguous_without_none():
+    d = ic._run_decision(_ctx([_inc(talkgroup_ids=["999"])], incident_type="police"))
+    assert (d["action"], d["ambiguous"]) == ("new", "new_with_candidates")
+    d = ic._run_decision(_ctx([], incident_type="police"))
+    assert (d["action"], d["ambiguous"]) == ("new", None)
+
+
+def test_orphan_with_unfit_same_tg_candidate_is_ambiguous():
+    # Substantive (a location) but untyped, live incident on its talkgroup, no evidence.
+    d = ic._run_decision(_ctx([_inc(idle=2)], location="Mohegan Park Ave"))
+    assert (d["action"], d["ambiguous"]) == ("orphan", "unfit_tg_candidate")
+
+
+def test_thin_sweep_and_clearance_calls_are_never_ambiguous():
+    inc = _inc(idle=0.2)
+    assert ic._run_decision(_ctx([inc], is_thin_call=True))["ambiguous"] is None
+    assert ic._run_decision(_ctx([inc], incident_type="police", create_if_new=False))["ambiguous"] is None
+    stale = _inc(idle=20, units=["45-9"])
+    d = ic._run_decision(_ctx([stale], call_units=["45-9"], call_cleared=["45-9"]))
+    assert d["action"] == "link" and d["ambiguous"] is None
+
+
+# ── #189: caps on absorption ────────────────────────────────────────────────
+
+def test_weak_link_span_cap_refuses_unit_only_links():
+    inc = _inc(idle=1, span=settings.incident_weak_link_max_span_minutes + 1, units=["6-Adam"])
+    d = ic._run_decision(_ctx([inc], call_units=["6-Adam"], incident_type="accident"))
+    assert d["action"] == "new"
+    assert ic.llm_candidates(_ctx([inc])) == []
+
+
+def test_weak_link_span_cap_also_binds_unit_continuity():
+    inc = _inc(idle=1, span=settings.incident_weak_link_max_span_minutes + 1,
+               units=["6-Adam"], talkgroup_ids=["999"])
+    d = ic._run_decision(_ctx([inc], call_units=["6-Adam"]))
+    assert d["action"] == "orphan"
+
+
+def test_llm_link_distance_guard():
+    pin = {"lat": 41.0, "lng": -73.8}
+    inc = _inc(location="Main St", location_coords=pin, location_coords_source="Main St")
+    near = _ctx(coords={"lat": 41.005, "lng": -73.8})
+    far = _ctx(coords={"lat": 41.2, "lng": -73.8})   # ~22 km
+    assert ic.llm_link_allowed(inc, near)
+    assert not ic.llm_link_allowed(inc, far)
+    assert ic.llm_link_allowed({**inc, "tags": ["vehicle-pursuit"]}, far)
+
+
+# ── llm_correlator: one call, validated ─────────────────────────────────────
+
+def test_parse_rejects_links_to_unshown_incidents_and_bad_actions():
+    shown = [_inc("inc-1")]
+    ctx = _ctx(shown)
+    assert llm_correlator._parse_response({"action": "link", "incident_id": "nope"}, ctx, shown) is None
+    assert llm_correlator._parse_response({"action": "maybe"}, ctx, shown) is None
+    ok = llm_correlator._parse_response({"action": "link", "incident_id": "inc-1"}, ctx, shown)
+    assert ok["action"] == "link" and ok["matched_incident"]["incident_id"] == "inc-1"
+
+
+def test_parse_new_uses_the_rules_creation_gate():
+    ctx = _ctx(call_severity="minor")
+    assert llm_correlator._parse_response({"action": "new"}, ctx, [])["incident_type"] == "other"
+    out = llm_correlator._parse_response({"action": "new"}, _ctx(), [])
+    assert out["action"] == "orphan"
+
+
+async def _correlate_with(rules_decision, llm_return, ctx=None):
+    ctx = ctx or _ctx([_inc()])
+    preview = {"decision": rules_decision, "ctx": ctx}
+    with patch("app.internal.incident_correlator.preview_correlation", AsyncMock(return_value=preview)), \
+         patch("app.internal.incident_correlator.apply_correlation", AsyncMock(return_value="inc-x")) as apply, \
+         patch("app.internal.llm_correlator.decide", AsyncMock(return_value=llm_return)) as decide:
+        _, final = await upload._correlate(
+            call_id="call-1", node_id="n", system_id="sys-1", talkgroup_id=383,
+            talkgroup_name="Ch 1", tags=[], incident_type=None, location=None,
+            location_coords=None,
+        )
+    return final, decide, apply
+
+
+def _rules(action, ambiguous=None, inc=None):
+    return {"action": action, "matched_incident": inc, "incident_type": "police" if action == "new" else None,
+            "corr_debug": {}, "ambiguous": ambiguous}
+
+
+def _llm(action, inc=None):
+    return {"action": action, "matched_incident": inc, "incident_type": "police" if action == "new" else None,
+            "corr_debug": {"corr_llm_reasoning": "r"}, "reasoning": "r"}
+
+
+@pytest.mark.asyncio
+async def test_confident_rules_decision_never_calls_the_llm():
+    final, decide, _ = await _correlate_with(_rules("new"), _llm("orphan"))
+    decide.assert_not_awaited()
+    assert final["corr_debug"]["corr_consensus"] == "rules_only"
+
+
+@pytest.mark.asyncio
+async def test_ambiguous_decision_makes_exactly_one_llm_call_and_commits_it():
+    inc = _inc("inc-2")
+    final, decide, apply = await _correlate_with(_rules("new", "new_with_candidates"), _llm("link", inc))
+    decide.assert_awaited_once()
+    committed = apply.await_args.args[0]["decision"]
+    assert committed["action"] == "link" and committed["matched_incident"]["incident_id"] == "inc-2"
+    dbg = final["corr_debug"]
+    assert dbg["corr_consensus"] == "llm" and dbg["corr_path"] == "llm"
+    assert dbg["corr_band"] == "new_with_candidates"
+    assert (dbg["corr_rules_action"], dbg["corr_llm_action"]) == ("new", "link")
+
+
+@pytest.mark.asyncio
+async def test_llm_unavailable_keeps_the_rules_decision():
+    rules = _rules("new", "new_with_candidates")
+    final, decide, _ = await _correlate_with(rules, None)
+    assert final is rules and final["corr_debug"]["corr_consensus"] == "rules_fallback"
+
+
+@pytest.mark.asyncio
+async def test_llm_orphan_cannot_drop_a_major_or_reassignment_call():
+    final, _, _ = await _correlate_with(
+        _rules("new", "new_with_candidates"), _llm("orphan"), _ctx([_inc()], call_severity="major"))
+    assert final["action"] == "new" and final["corr_debug"]["corr_consensus"] == "rules_guard"
+    final, _, _ = await _correlate_with(
+        _rules("new", "new_with_candidates"), _llm("orphan"), _ctx([_inc()]))
+    assert final["action"] == "orphan" and final["corr_debug"]["corr_consensus"] == "llm"
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("extra", [{"incident_type": "fire"}, {"tags": ["structure-fire"]},
+                                   {"coords": {"lat": 41.0, "lng": -73.8}}, {"reassignment": True}])
+async def test_llm_orphan_cannot_drop_a_typed_or_substantive_call(extra):
+    final, _, _ = await _correlate_with(
+        _rules("new", "new_with_candidates"), _llm("orphan"), _ctx([_inc()], **extra))
+    assert final["action"] == "new" and final["corr_debug"]["corr_consensus"] == "rules_guard"
+
+
+@pytest.mark.asyncio
+async def test_llm_orphan_over_a_rules_link_is_tombstoned_for_the_sweep():
+    inc = _inc()
+    rules = _rules("link", "unverified_unit_link", inc)
+    final, _, _ = await _correlate_with(rules, _llm("orphan"))
+    assert final["action"] == "orphan" and final["corr_debug"]["corr_path"] == "llm_orphan"
+
+
+@pytest.mark.asyncio
+async def test_back_dated_link_never_moves_updated_at_backward():
+    inc = _inc(idle=1, span=10)
+    with patch.object(ic, "fstore") as fs:
+        fs.doc_set = AsyncMock()
+        await ic._update_incident(inc, "late-call", 383, "sys-1", [], None, None, ["6-Adam"], [], None,
+                                  NOW - timedelta(hours=3))
+    assert fs.doc_set.await_args.args[2]["updated_at"] == inc["updated_at"]
+
+
+@pytest.mark.asyncio
+async def test_llm_confirming_the_rules_link_keeps_the_rules_path():
+    inc = _inc()
+    rules = _rules("link", "unverified_unit_link", inc)
+    rules["corr_debug"] = {"corr_path": "fast/single", "corr_fit_signal": "unit_overlap_unverified"}
+    final, _, _ = await _correlate_with(rules, _llm("link", inc))
+    assert final["corr_debug"]["corr_path"] == "fast/single"
+    assert final["corr_debug"]["corr_consensus"] == "llm"
+
+
+def test_no_tiebreak_tier_remains():
+    assert not hasattr(llm_correlator, "tiebreak")
+    assert not hasattr(settings, "corr_smart_model")
+    assert not hasattr(upload, "_correlate_with_consensus")
+
+
+# ── #88 ─────────────────────────────────────────────────────────────────────
+
+@pytest.mark.parametrize("value,expected", [
+    (True, True), (False, False), ("true", True), ("True", True), ("yes", True),
+    ("false", False), ("False", False), ("no", False), ("", False), (None, False),
+    ("maybe", False), (1, False), ({"x": 1}, False),
+])
+def test_parse_llm_bool_fails_closed(value, expected):
+    assert ic.parse_llm_bool(value) is expected
+
+
+def test_closure_only_honoured_on_a_confident_link_or_own_new_incident():
+    assert upload._may_resolve({"action": "new", "corr_debug": {"corr_consensus": "llm"}})
+    assert upload._may_resolve({"action": "link", "corr_debug": {"corr_consensus": "rules_only",
+                                                                  "corr_path": "fast/single"}})
+    assert not upload._may_resolve({"action": "link", "corr_debug": {"corr_consensus": "rules_only",
+                                                                      "corr_path": "fast/thin"}})
+    assert not upload._may_resolve({"action": "link", "corr_debug": {"corr_consensus": "llm",
+                                                                      "corr_path": "llm"}})
+    assert not upload._may_resolve({"action": "orphan", "corr_debug": {}})
+
+
+@pytest.mark.asyncio
+async def test_quoted_false_does_not_resolve_or_blank_units():
+    scene = {"tags": [], "incident_type": "police", "location": None, "location_coords": None,
+             "units": ["6-Adam"], "resolved": "false", "reassignment": "false"}
+    corr = AsyncMock(return_value=("inc-1", {"action": "new", "corr_debug": {}}))
+    with patch.object(upload, "_correlate", corr), patch.object(upload, "fstore") as fs:
+        fs.doc_set = AsyncMock()
+        await upload._correlate_scenes("call-1", "n", "sys-1", 383, "Ch 1", [scene])
+    assert corr.await_args.kwargs["units"] == ["6-Adam"]
+    assert corr.await_args.kwargs["reassignment"] is False
+    fs.doc_set.assert_not_awaited()
+
+
+# ── #190 ────────────────────────────────────────────────────────────────────
+
+def test_severity_escalates_immediately_and_keeps_its_peak():
+    out = ic._severity_after_link({"severity": "minor"}, "major", "shots fired")
+    assert out["severity"] == "major" and out["severity_peak"] == "major"
+
+
+def test_calmer_followup_without_stand_down_does_not_deescalate():
+    out = ic._severity_after_link({"severity": "major"}, "routine", "Engine 5 on scene, 10-4")
+    assert out["severity"] == "major" and "severity_deescalated_from" not in out
+
+
+def test_explicit_stand_down_deescalates_but_peak_stays():
+    inc = {"severity": "major"}
+    out = ic._severity_after_link(inc, "minor", "Only smoke showing, no flames.")
+    assert out == {"severity": "minor", "severity_peak": "major", "severity_deescalated_from": "major"}
+    later = ic._severity_after_link({**inc, **out}, "routine", "copy")
+    assert later["severity"] == "minor" and later["severity_peak"] == "major"
+
+
+@pytest.mark.parametrize("text", [
+    "call was unfounded", "false alarm, resetting the panel", "GOA, nothing found",
+    "Code 4, you can stand down", "fire is out",
+])
+def test_stand_down_phrases(text):
+    assert ic._is_stand_down(text)
+
+
+@pytest.mark.parametrize("text", ["disregard my last", "code 40", "flames showing",
+                                  "primary search all clear", "Code 4", None])
+def test_not_stand_down_phrases(text):
+    assert not ic._is_stand_down(text)
+
+
+# ── #27 ─────────────────────────────────────────────────────────────────────
+
+def test_sweep_tombstones_only_on_the_last_visible_pass():
+    scan = settings.recorrelation_scan_minutes
+    young = {"ended_at": (NOW - timedelta(minutes=20)).isoformat()}
+    last = {"ended_at": (NOW - timedelta(minutes=scan - 1)).isoformat()}
+    assert not recorrelation_sweep._last_chance(young, NOW)
+    assert recorrelation_sweep._last_chance(last, NOW)
+    assert recorrelation_sweep._last_chance({}, NOW)
+
+
+@pytest.mark.asyncio
+async def test_sweep_keeps_retrying_past_the_old_three_attempt_budget():
+    call = {"call_id": "c", "started_at": (NOW - timedelta(minutes=30)).isoformat(),
+            "ended_at": (NOW - timedelta(minutes=30)).isoformat(), "corr_sweep_count": 5}
+    with patch("app.internal.incident_correlator.correlate_call", AsyncMock(return_value=None)), \
+         patch.object(recorrelation_sweep, "fstore") as fs:
+        fs.doc_set = AsyncMock()
+        assert await recorrelation_sweep._recorrelate_orphan(call, NOW) is False
+    assert fs.doc_set.await_args.args[2] == {"corr_sweep_count": 6}
+
+
+# ── #301 / #302 ─────────────────────────────────────────────────────────────
+
+def test_late_upload_is_anchored_to_started_at_and_on_time_is_not():
+    with patch("app.internal.clock.now", return_value=NOW):
+        late = NOW - timedelta(hours=3)
+        assert upload._late_upload_anchor({"started_at": late.isoformat()}) == late
+        assert upload._late_upload_anchor({"started_at": late}) == late          # native timestamp
+        assert upload._late_upload_anchor({"started_at": (NOW - timedelta(minutes=1)).isoformat()}) is None
+        assert upload._late_upload_anchor({}) is None
+
+
+@pytest.mark.asyncio
+async def test_late_upload_correlates_on_the_calls_own_clock():
+    from app.internal import clock
+    seen = {}
+    started = NOW - timedelta(hours=3)
+
+    async def fake_extract(**kw):
+        seen["now"] = clock.now()
+        return [], [], []
+
+    flags = ({"stt_enabled": False, "correlation_enabled": True}, lambda k: k == "correlation_enabled")
+    with patch.object(upload, "fstore") as fs, \
+         patch.object(upload, "_resolve_flags", AsyncMock(return_value=flags)), \
+         patch.object(upload, "_extract_and_correlate", fake_extract), \
+         patch("app.internal.talkgroups.resolve", AsyncMock(return_value="Ch 1")), \
+         patch("app.internal.alerter.check_and_dispatch", AsyncMock()):
+        fs.doc_get = AsyncMock(return_value={"started_at": started.isoformat(), "talkgroup_name": "Ch 1"})
+        fs.doc_set = AsyncMock()
+        await upload._run_intelligence_pipeline("call-1", "n", "sys-1", 383, "Ch 1", None)
+    assert seen["now"] == started
+    assert clock.now() != started   # pin released
+
+
+@pytest.mark.asyncio
+async def test_retried_upload_returns_stored_audio_without_rerunning_the_pipeline():
+    from fastapi import BackgroundTasks
+    from fastapi.security import HTTPAuthorizationCredentials
+
+    docs = {
+        ("node_keys", "n"): {"api_key": "k"},
+        ("nodes", "n"): {"approval_status": "approved"},
+        ("calls", "call-1"): {"audio_gcs_uri": "gs://b/call-1.mp3"},
+    }
+
+    class _File:
+        filename = "a.mp3"
+
+        async def read(self):
+            return b"audio"
+
+    bt = BackgroundTasks()
+    with patch.object(upload, "fstore") as fs, patch.object(upload, "upload_audio", AsyncMock()) as up:
+        fs.doc_get = AsyncMock(side_effect=lambda coll, doc_id: docs.get((coll, doc_id)))
+        out = await upload.upload_call_audio(
+            background_tasks=bt, file=_File(), call_id="call-1", node_id="n",
+            credentials=HTTPAuthorizationCredentials(scheme="Bearer", credentials="k"),
+        )
+    assert out == {"url": "gs://b/call-1.mp3", "already_uploaded": True}
+    up.assert_not_awaited()
+    assert bt.tasks == []

drb-c2-core/tests/test_correlator_location_path.py

@@ -0,0 +1,141 @@
+"""
+server-26#115 — location-path corroboration, plus the shared substance predicate.
+
+(The consensus LLM-orphan gate that used to be tested here was removed with the
+cheap/smart tiebreak in server-26#299; its replacement is tested in
+test_correlation_decision_flow.py.)
+
+The `location` correlation path linked on a bare sub-`location_proximity_km`
+(0.5 km) distance alone, taking whichever incident came first in an unsorted
+`recent`. In a dense village two unrelated events routinely geocode that close.
+A `location` link now needs unit overlap with the candidate OR a distance under a
+tighter bar, and picks the NEAREST qualifying candidate. A unit-overlap location
+link is tagged `location_unit_overlap` so it does not merge into the fast path's
+bucket in the admin fit-signal histogram.
+"""
+from datetime import datetime, timedelta, timezone
+
+import pytest
+
+from app.internal.incident_correlator import _run_decision, has_event_substance
+
+NOW = datetime(2026, 9, 7, 21, 30, 0, tzinfo=timezone.utc)
+
+
+def test_has_event_substance_predicate():
+    assert has_event_substance({"coords": {"lat": 1, "lng": 2}})
+    assert has_event_substance({"tags": ["fire"]})
+    assert has_event_substance({"call_vehicles": ["sedan"]})
+    assert not has_event_substance({})
+    assert not has_event_substance({"coords": None, "tags": [], "call_vehicles": []})
+    # units and location are NOT substance — nearly every transmission has them.
+    assert not has_event_substance({"call_units": ["7-Adam"], "location": "Main St"})
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Fix 2 — tighten corr_path=location
+# ─────────────────────────────────────────────────────────────────────────────
+
+CALL_COORDS = {"lat": 41.150000, "lng": -73.860000}
+# ~0.39 km north of the call — inside location_proximity_km (0.5) but well
+# outside the tight bar (_LOCATION_TIGHT_PROXIMITY_KM, 0.2).
+FAR_INC_COORDS = {"lat": 41.153500, "lng": -73.860000}
+# ~0.13 km north of the call — inside the tight bar.
+NEAR_INC_COORDS = {"lat": 41.151200, "lng": -73.860000}
+# ~0.28 km north — inside the 0.5 radius, outside the 0.2 tight bar; used as a
+# second candidate that must lose the nearest-wins sort to NEAR_INC_COORDS.
+MID_INC_COORDS = {"lat": 41.152500, "lng": -73.860000}
+
+
+def _inc(incident_id, coords, units):
+    return {
+        "incident_id": incident_id,
+        "system_ids": ["sys-1"],
+        "talkgroup_ids": ["100"],           # different TGID → fast path is a no-op
+        "location_coords": coords,
+        "units": units,
+        "tags": [],
+        "type": "police",
+        "updated_at": (NOW - timedelta(minutes=6)).isoformat(),
+        "started_at": (NOW - timedelta(minutes=20)).isoformat(),
+        "status": "active",
+        "call_ids": ["c0"],
+    }
+
+
+def _loc_ctx(*, incidents, call_units):
+    return {
+        "call_id": "call-loc",
+        "all_active": list(incidents),
+        "recent": list(incidents),
+        "call_doc": {},
+        "call_embedding": None,
+        "call_units": call_units,
+        "call_vehicles": [],
+        "call_cleared": [],
+        "call_severity": "routine",
+        "coords": CALL_COORDS,
+        "is_thin_call": False,
+        "now": NOW,
+        "system_id": "sys-1",
+        "talkgroup_id": 999,               # not in inc.talkgroup_ids
+        "talkgroup_name": "Tactical",
+        "tags": [],
+        "incident_type": "police",
+        "location": "Main St",
+        "location_coords": CALL_COORDS,
+        "reassignment": True,              # suppress the unit-continuity path
+        "create_if_new": True,
+    }
+
+
+def test_location_path_in_radius_but_no_unit_overlap_no_tight_proximity_does_not_link(caplog):
+    ctx = _loc_ctx(
+        incidents=[_inc("inc-loc", FAR_INC_COORDS, ["7-Adam"])],
+        call_units=["3-Boy"],
+    )
+    with caplog.at_level("INFO", logger="drb-c2-core"):
+        decision = _run_decision(ctx)
+    # Reaches, and is rejected by, the new guard (not an earlier path).
+    assert "location-path skipped" in caplog.text
+    assert decision["action"] != "link"
+    assert (decision.get("corr_debug") or {}).get("corr_path") != "location"
+
+
+def test_location_path_links_on_unit_overlap_with_distinct_fit_signal():
+    ctx = _loc_ctx(
+        incidents=[_inc("inc-loc", FAR_INC_COORDS, ["5-Adam"])],
+        call_units=["5-Adam"],
+    )
+    decision = _run_decision(ctx)
+    assert decision["action"] == "link"
+    assert decision["corr_debug"]["corr_path"] == "location"
+    # NOT "unit_overlap" — that value belongs to the fast path's histogram bucket.
+    assert decision["corr_debug"]["corr_fit_signal"] == "location_unit_overlap"
+
+
+def test_location_path_links_on_tight_proximity_without_unit_overlap():
+    ctx = _loc_ctx(
+        incidents=[_inc("inc-loc", NEAR_INC_COORDS, ["7-Adam"])],
+        call_units=["3-Boy"],
+    )
+    decision = _run_decision(ctx)
+    assert decision["action"] == "link"
+    assert decision["corr_debug"]["corr_path"] == "location"
+    assert decision["corr_debug"]["corr_fit_signal"] == "location_proximity"
+
+
+def test_location_path_picks_nearest_in_radius_candidate():
+    # `recent` order puts the farther tight-proximity incident first; the guard
+    # must still select the nearest one.
+    ctx = _loc_ctx(
+        incidents=[
+            _inc("inc-mid", MID_INC_COORDS, ["3-Boy"]),   # ~0.28 km, tight-fail
+            _inc("inc-near", NEAR_INC_COORDS, ["3-Boy"]),  # ~0.13 km, tight-pass
+        ],
+        call_units=["3-Boy"],
+    )
+    decision = _run_decision(ctx)
+    assert decision["action"] == "link"
+    assert decision["matched_incident"]["incident_id"] == "inc-near"
+    assert decision["corr_debug"]["corr_path"] == "location"

drb-c2-core/tests/test_correlator_merge_caps.py

@@ -332,13 +332,18 @@ def test_duration_cap_blocks_the_thin_path_too():
     assert _run_decision(_ctx(all_active=[inc], recent=[inc]))["action"] == "orphan"
 
 
-def test_incident_just_under_the_duration_cap_still_accepts_calls():
+def test_incident_just_under_the_duration_cap_still_accepts_strong_evidence():
+    # Past the weak-link span cap (server-26#189) shared units alone no longer
+    # link, but strong evidence (a shared vehicle) still does until the hard cap.
     inc = _long_running(settings.incident_max_duration_minutes - 10)
     inc["units"] = ["6-Adam"]
+    inc["vehicles"] = ["red sedan"]
     decision = _run_decision(_ctx(
-        all_active=[inc], recent=[inc], is_thin_call=False, call_units=["6-Adam"],
+        all_active=[inc], recent=[inc], is_thin_call=False,
+        call_units=["7-Boy"], call_vehicles=["red sedan"],
     ))
     assert decision["action"] == "link"
+    assert decision["corr_debug"]["corr_fit_signal"] == "vehicle_overlap"
 
 
 def test_call_count_cap_forces_a_new_incident():

drb-c2-core/tests/test_discord_directory.py

@@ -0,0 +1,392 @@
+"""
+Channel list and presence without the main bot (server-26#225 S5), plus the
+interactive re-check of a cached "denied" answer (server-26#251).
+
+* discord_rest.directory_from_snapshot / guild_directory: a radio bot's REST
+  snapshot becomes the same directory the DRB server bot pushes.
+* _org_guilds: a linked server stays visible with only a radio bot in it; a
+  fallback-org server still needs the server bot; REST never discovers a
+  server or creates a ``discord_guilds`` doc.
+* join_options / start_node_stream: a missing list is read inline from a
+  member radio bot, a stale one in the background; the server bot's fresh
+  list is never overwritten; nothing is written onto a server that was
+  unlinked meanwhile.
+* start_stream(interactive=True) re-reads a "denied" snapshot older than
+  RECHECK_DENIED_AFTER_SECONDS once; the reconciler never does.
+"""
+import asyncio
+import time
+from datetime import datetime, timedelta, timezone
+
+import pytest
+from fastapi import HTTPException
+
+from app.config import settings
+from app.internal import discord_rest
+from app.internal import discord_streams as streams
+from app.routers import discord as discord_router
+from app.models import CommandPayload
+from app.routers import discord_web as web
+from app.routers import nodes as nodes_router
+from tests.test_discord_perm_check import (  # noqa: F401  (fs = fixture)
+    ADMIN, GUILD, ORG, OTHER, OWNER, SYS, _guild, _snap, _token, fs, run,
+)
+
+LINKED = "300"     # linked to ORG, never seen by the server bot
+
+
+def _ago(seconds: float) -> str:
+    return (datetime.now(timezone.utc) - timedelta(seconds=seconds)).isoformat()
+
+
+def _rest_channels():
+    return [
+        {"id": "9", "name": "Radio", "type": 4, "position": 1},
+        {"id": "8", "name": "Admin", "type": 4, "position": 0},
+        {"id": "3001", "name": "dispatch", "type": 2, "position": 1, "parent_id": "9", "permission_overwrites": []},
+        {"id": "3002", "name": "fireground", "type": 2, "position": 0, "parent_id": "9", "permission_overwrites": []},
+        {"id": "3003", "name": "staff", "type": 2, "position": 0, "parent_id": "8", "permission_overwrites": []},
+        {"id": "3004", "name": "lobby", "type": 2, "position": 5, "permission_overwrites": []},
+        {"id": "3005", "name": "general", "type": 0, "position": 0, "permission_overwrites": []},
+        {"id": "3006", "name": "town hall", "type": 13, "position": 0, "permission_overwrites": []},
+    ]
+
+
+def _rest_snap(tok_id, guild_id=LINKED, status=discord_rest.OK):
+    if status != discord_rest.OK:
+        return discord_rest.GuildSnapshot(token_id=tok_id, guild_id=guild_id, status=status, error="x")
+    return discord_rest.GuildSnapshot(
+        token_id=tok_id, guild_id=guild_id, status=discord_rest.OK, bot_user_id=f"u-{tok_id}",
+        guild={**_guild(), "id": guild_id, "name": "Station 9"}, member={"roles": []},
+        channels=_rest_channels())
+
+
+@pytest.fixture
+def dfs(fs, monkeypatch):
+    """The perm-check fixture plus a linked server only radio bots know."""
+    fs.put("discord_guilds", LINKED, {"guild_id": LINKED, "org_id": ORG, "linked_at": _ago(60)})
+    fs.dir_mode = {}        # token_id -> "ok" | "not_member" | "unknown"
+
+    async def _snapshot(token_doc, guild_id, *, refresh=False):
+        tid = token_doc["token_id"]
+        fs.snap_calls.append((tid, guild_id, refresh))
+        if guild_id != LINKED:
+            mode = fs.snap_mode.get(tid, "ok")
+            return _snap(tid, muted=(mode == "muted"))
+        mode = fs.dir_mode.get(tid, "ok")
+        status = {"ok": discord_rest.OK, "not_member": discord_rest.NOT_MEMBER}.get(mode, discord_rest.UNKNOWN)
+        return _rest_snap(tid, status=status)
+    monkeypatch.setattr(discord_rest, "guild_snapshot", _snapshot)
+    web._directory_tasks.clear()
+    return fs
+
+
+async def _drain():
+    while web._directory_tasks:
+        await asyncio.gather(*list(web._directory_tasks.values()), return_exceptions=True)
+
+
+def _ids(opts):
+    return [g["guild_id"] for g in opts["guilds"]]
+
+
+# ---------------------------------------------------------------------------
+# discord_rest — directory from a snapshot
+# ---------------------------------------------------------------------------
+
+def test_directory_from_snapshot_matches_the_server_bots_shape_and_order():
+    d = discord_rest.directory_from_snapshot(_rest_snap("t1"))
+    assert d["name"] == "Station 9"
+    assert [(c["channel_id"], c["category"], c["position"]) for c in d["voice_channels"]] == [
+        ("3004", None, 0),            # no category first
+        ("3003", "Admin", 1),         # categories by position
+        ("3002", "Radio", 2),         # channels by position inside one
+        ("3001", "Radio", 3),
+    ]                                 # text and stage channels are not listed
+    assert set(d["voice_channels"][0]) == {"channel_id", "name", "category", "position"}
+
+
+def test_directory_from_snapshot_is_none_unless_ok():
+    assert discord_rest.directory_from_snapshot(None) is None
+    for status in (discord_rest.NOT_MEMBER, discord_rest.UNKNOWN, discord_rest.INVALID):
+        assert discord_rest.directory_from_snapshot(_rest_snap("t1", status=status)) is None
+
+
+def test_directory_caps_channels_and_name_length():
+    snap = _rest_snap("t1")
+    snap.channels = [{"id": str(5000 + i), "name": "x" * 300, "type": 2, "position": i} for i in range(250)]
+    d = discord_rest.directory_from_snapshot(snap)
+    assert len(d["voice_channels"]) == discord_rest.DIRECTORY_MAX_CHANNELS
+    assert len(d["voice_channels"][0]["name"]) == 100
+
+
+async def test_guild_directory_tries_the_next_bot_and_reports_not_member(dfs):
+    _token(dfs, "a", guilds=(LINKED,))
+    _token(dfs, "b", guilds=(LINKED,))
+    docs = [{**dfs.get("bot_tokens", t)} for t in ("a", "b")]
+    dfs.dir_mode["a"] = "not_member"
+    got = await discord_rest.guild_directory(docs, LINKED)
+    assert got.status == discord_rest.OK and got.token_id == "b" and len(got.voice_channels) == 4
+    dfs.dir_mode["b"] = "not_member"
+    assert (await discord_rest.guild_directory(docs, LINKED)).status == discord_rest.NOT_MEMBER
+    dfs.dir_mode["b"] = "unknown"
+    assert (await discord_rest.guild_directory(docs, LINKED)).status == discord_rest.UNKNOWN
+    assert (await discord_rest.guild_directory([], LINKED)).status == discord_rest.UNKNOWN
+
+
+# ---------------------------------------------------------------------------
+# Which servers an org sees
+# ---------------------------------------------------------------------------
+
+def test_linked_server_with_only_a_radio_bot_is_listed_with_its_channels(dfs):
+    """Owner requirement 1: invite only the radio bot, no main bot."""
+    _token(dfs, "byo", org=ORG, guilds=(LINKED,))
+    opts = run(web.join_options("n1", OWNER))
+    g = next(g for g in opts["guilds"] if g["guild_id"] == LINKED)
+    assert g["synced"] is True and g["directory_source"] == "radio_bot" and g["main_bot_present"] is False
+    assert [c["name"] for c in g["voice_channels"]] == ["lobby", "staff", "fireground", "dispatch"]
+    assert g["name"] == "Station 9" and g["linked"] is True and g["bot"]["ok"] is True
+    doc = dfs.get("discord_guilds", LINKED)
+    assert doc["org_id"] == ORG and "bot_present" not in doc          # never the server bot's field
+    assert doc["radio_bot_present"] is True and doc["directory_source"] == "radio_bot"
+    assert doc["guild_name"] == "Station 9" and len(doc["voice_channels"]) == 4
+    assert "secret" not in repr(opts)
+
+
+def test_linked_server_without_any_radio_bot_keeps_todays_behaviour(dfs):
+    opts = run(web.join_options("n1", OWNER))
+    g = next(g for g in opts["guilds"] if g["guild_id"] == LINKED)
+    assert g["synced"] is False and g["bot"]["ok"] is False            # invite links, as before
+    assert not [c for c in dfs.snap_calls if c[1] == LINKED]
+
+
+@pytest.mark.parametrize("tok", [
+    {"org": OTHER},                                   # another org's branded bot
+    {"guilds": None},                                 # membership never checked
+    {"valid": False},
+])
+def test_only_a_usable_member_bot_keeps_a_server_without_the_main_bot(dfs, tok):
+    dfs.put("discord_guilds", LINKED, {**dfs.get("discord_guilds", LINKED), "bot_present": False})
+    kw = {"guilds": (LINKED,), **tok}
+    _token(dfs, "x", **kw)
+    assert LINKED not in _ids(run(web.join_options("n1", OWNER)))
+    assert not [c for c in dfs.snap_calls if c[1] == LINKED]
+
+
+def test_server_bot_leaving_keeps_server_while_a_radio_bot_is_in_it(dfs):
+    _token(dfs, "t1", guilds=(GUILD,))
+    run(web.put_guild_directory(GUILD, web.GuildDirectory(present=False), {"service": True}))
+    opts = run(web.join_options("n1", OWNER))
+    assert GUILD in _ids(opts)
+    g = next(g for g in opts["guilds"] if g["guild_id"] == GUILD)
+    assert g["main_bot_present"] is False
+
+
+def test_fallback_server_is_never_discovered_by_a_radio_bot(dfs, monkeypatch):
+    monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", ORG)
+    dfs.put("discord_guilds", "400", {"guild_id": "400", "bot_present": False, "voice_channels": []})
+    _token(dfs, "t1", guilds=("400", "401", LINKED))      # also in a server DRB has no doc for
+    ids = _ids(run(web.join_options("n1", OWNER)))
+    assert "400" not in ids and "401" not in ids
+    assert dfs.get("discord_guilds", "401") is None                      # REST never creates a doc
+    assert not [c for c in dfs.snap_calls if c[1] in ("400", "401")]
+
+
+def test_fallback_server_list_is_never_read_over_rest(dfs, monkeypatch):
+    monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", ORG)
+    dfs.put("discord_guilds", "400", {"guild_id": "400", "bot_present": True, "voice_channels": None,
+                                      "directory_at": _ago(99999)})
+    _token(dfs, "t1", guilds=("400",))
+    assert "400" in _ids(run(web.join_options("n1", OWNER)))
+    assert not [c for c in dfs.snap_calls if c[1] == "400"]
+
+
+# ---------------------------------------------------------------------------
+# When the list is read, and who wins
+# ---------------------------------------------------------------------------
+
+def test_fresh_main_bot_list_is_never_read_over_rest(dfs):
+    _token(dfs, "t1", guilds=(LINKED,))
+    dfs.put("discord_guilds", LINKED, {**dfs.get("discord_guilds", LINKED), "bot_present": True,
+                                       "directory_source": "main_bot", "directory_at": _ago(600),
+                                       "voice_channels": [{"channel_id": "3001", "name": "dispatch"}]})
+    opts = run(web.join_options("n1", OWNER))
+    g = next(g for g in opts["guilds"] if g["guild_id"] == LINKED)
+    assert g["directory_source"] == "main_bot" and len(g["voice_channels"]) == 1
+    assert not [c for c in dfs.snap_calls if c[1] == LINKED]
+
+
+def test_stale_list_is_refreshed_in_the_background(dfs):
+    _token(dfs, "t1", guilds=(LINKED,))
+    old = [{"channel_id": "3001", "name": "old name"}]
+    dfs.put("discord_guilds", LINKED, {**dfs.get("discord_guilds", LINKED), "voice_channels": old,
+                                       "directory_source": "radio_bot",
+                                       "directory_at": _ago(settings.discord_directory_refresh_seconds + 5)})
+
+    async def go():
+        opts = await web.join_options("n1", OWNER)
+        await _drain()
+        return opts
+    opts = run(go())
+    g = next(g for g in opts["guilds"] if g["guild_id"] == LINKED)
+    assert [c["name"] for c in g["voice_channels"]] == ["old name"]        # stored list shown meanwhile
+    assert len(dfs.get("discord_guilds", LINKED)["voice_channels"]) == 4  # and replaced right after
+
+
+def test_dead_main_bot_list_is_taken_over_by_a_radio_bot(dfs):
+    _token(dfs, "t1", guilds=(LINKED,))
+    dfs.put("discord_guilds", LINKED, {**dfs.get("discord_guilds", LINKED), "bot_present": True,
+                                       "directory_at": _ago(web.MAIN_BOT_STALE_SECONDS + 60),
+                                       "voice_channels": [{"channel_id": "3001", "name": "dispatch"}]})
+
+    async def go():
+        await web.join_options("n1", OWNER)
+        await _drain()
+    run(go())
+    doc = dfs.get("discord_guilds", LINKED)
+    assert doc["directory_source"] == "radio_bot" and len(doc["voice_channels"]) == 4
+    assert doc["bot_present"] is True                                     # not ours to change
+
+
+def test_not_member_marks_presence_and_keeps_the_list(dfs):
+    _token(dfs, "t1", guilds=(LINKED,))
+    keep = [{"channel_id": "3001", "name": "dispatch"}]
+    dfs.put("discord_guilds", LINKED, {**dfs.get("discord_guilds", LINKED), "voice_channels": keep,
+                                       "directory_source": "radio_bot", "directory_at": _ago(99999)})
+    dfs.dir_mode["t1"] = "not_member"
+
+    async def go():
+        await web.join_options("n1", OWNER)
+        await _drain()
+    run(go())
+    doc = dfs.get("discord_guilds", LINKED)
+    assert doc["radio_bot_present"] is False and doc["voice_channels"] == keep
+
+
+def test_refresh_never_writes_onto_a_server_unlinked_meanwhile(dfs, monkeypatch):
+    _token(dfs, "t1", guilds=(LINKED,))
+    real = discord_rest.guild_directory
+
+    async def _unlink_then_answer(docs, guild_id, **kw):
+        dfs.put("discord_guilds", LINKED, {"guild_id": LINKED, "org_id": None, "unlinked_at": _ago(0)})
+        return await real(docs, guild_id, **kw)
+    monkeypatch.setattr(discord_rest, "guild_directory", _unlink_then_answer)
+    g = dict(dfs.get("discord_guilds", LINKED), org_id=ORG)
+    assert run(web._refresh_directory(g, ORG, {"t1": dfs.get("bot_tokens", "t1")})) is None
+    assert "voice_channels" not in dfs.get("discord_guilds", LINKED)
+
+
+def test_slow_discord_never_holds_the_picker_past_the_budget(dfs, monkeypatch):
+    _token(dfs, "t1", guilds=(LINKED,))
+    monkeypatch.setattr(settings, "discord_perm_check_budget_seconds", 0.05)
+
+    async def _slow(docs, guild_id, **kw):
+        await asyncio.sleep(5)
+    monkeypatch.setattr(discord_rest, "guild_directory", _slow)
+
+    async def go():
+        t0 = time.monotonic()
+        opts = await web.join_options("n1", OWNER)
+        return opts, time.monotonic() - t0
+    opts, took = run(go())
+    assert took < 1.0
+    assert next(g for g in opts["guilds"] if g["guild_id"] == LINKED)["synced"] is False
+
+
+def test_directory_push_marks_main_bot_and_drops_cached_snapshots(dfs, monkeypatch):
+    dropped = []
+    monkeypatch.setattr(discord_rest, "invalidate", lambda token_id=None, guild_id=None: dropped.append(
+        (token_id, guild_id)) or 0)
+    run(web.put_guild_directory(LINKED, web.GuildDirectory(name="S9", voice_channels=[
+        web.VoiceChannelIn(channel_id="3001", name="dispatch")]), {"service": True}))
+    doc = dfs.get("discord_guilds", LINKED)
+    assert doc["directory_source"] == "main_bot" and doc["bot_present"] is True and doc["org_id"] == ORG
+    assert dropped == [(None, LINKED)]
+
+
+# ---------------------------------------------------------------------------
+# Starting from the picker without the main bot
+# ---------------------------------------------------------------------------
+
+def test_start_checks_the_channel_against_the_radio_bots_list(dfs):
+    _token(dfs, "byo", org=ORG, guilds=(LINKED,))
+    doc = run(web.start_node_stream("n1", web.NodeStreamStart(guild_id=LINKED, channel_id="3001"), OWNER))
+    assert doc["ok"] is True and doc["token_id"] == "byo"
+    s = dfs.get("discord_streams", doc["stream_id"])
+    assert s["channel_name"] == "dispatch" and s["guild_name"] == "Station 9" and s["node_id"] == "n1"
+
+
+def test_start_refuses_a_channel_the_radio_bot_does_not_list(dfs):
+    _token(dfs, "byo", org=ORG, guilds=(LINKED,))
+    for bad in ("3005", "3999"):          # a text channel; no such channel
+        with pytest.raises(HTTPException) as e:
+            run(web.start_node_stream("n1", web.NodeStreamStart(guild_id=LINKED, channel_id=bad), OWNER))
+        assert e.value.status_code == 400
+
+
+# ---------------------------------------------------------------------------
+# server-26#251 — an interactive start re-reads a stale "denied"
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def aging(fs, monkeypatch):
+    """Snapshots that are ``fs.age`` seconds old unless refreshed; ``muted``
+    until ``fs.fixed`` (the owner fixed the permission in Discord)."""
+    fs.age, fs.fixed = 60.0, False
+
+    async def _snapshot(token_doc, guild_id, *, refresh=False):
+        tid = token_doc["token_id"]
+        fs.snap_calls.append((tid, guild_id, refresh))
+        s = _snap(tid, muted=not (refresh and fs.fixed))
+        s.fetched_at = time.time() - (0 if refresh else fs.age)
+        return s
+    monkeypatch.setattr(discord_rest, "guild_snapshot", _snapshot)
+    _token(fs, "t1", name="DRB Radio 2")
+    return fs
+
+
+def _join():
+    return discord_router.start_stream(discord_router.StreamStart(guild_id=GUILD, channel_id="1001",
+                                                                  system_id=SYS), {"service": True})
+
+
+def test_join_after_fixing_the_permission_succeeds_at_once(aging):
+    aging.fixed = True
+    r = run(_join())
+    assert r["token_id"] == "t1"
+    assert ("t1", GUILD, True) in aging.snap_calls
+
+
+def test_still_denied_after_the_recheck_is_refused(aging):
+    r = run(_join())
+    assert r.status_code == 409 and b"can't Speak in #dispatch" in r.body
+    assert [c for c in aging.snap_calls if c[2]] == [("t1", GUILD, True)]     # once
+
+
+def test_a_fresh_denied_answer_is_not_asked_again(aging):
+    aging.age = 1.0
+    aging.fixed = True
+    r = run(_join())
+    assert r.status_code == 409
+    assert not [c for c in aging.snap_calls if c[2]]
+
+
+async def test_reconciler_never_rechecks(aging):
+    aging.fixed = True
+    with pytest.raises(streams.StreamError) as e:
+        await streams.start_stream(org_id=ORG, guild_id=GUILD, channel_id="1001", system_id=SYS)
+    assert e.value.code == "missing_permissions"
+    assert not [c for c in aging.snap_calls if c[2]]
+
+
+def test_web_picker_start_is_interactive(aging):
+    aging.fixed = True
+    doc = run(web.start_node_stream("n1", web.NodeStreamStart(guild_id=GUILD, channel_id="1001"), OWNER))
+    assert doc["ok"] is True and doc["token_id"] == "t1"
+
+
+def test_node_discord_join_command_is_interactive(aging):
+    aging.fixed = True
+    out = run(nodes_router.send_command("n1", CommandPayload(action="discord_join", guild_id=GUILD,
+                                                             channel_id="1001"), ADMIN))
+    assert out["ok"] is True and out["token_id"] == "t1"

drb-c2-core/tests/test_discord_oauth.py

@@ -0,0 +1,464 @@
+"""
+Per-bot OAuth "Connect a Discord server" (server-26#225 S6).
+
+Discord is an httpx.MockTransport; Firestore is tests/fake_firestore.py.
+"""
+import asyncio
+import base64
+import json
+import logging
+from datetime import datetime, timedelta, timezone
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+import pytest
+from fastapi import HTTPException
+
+from app.config import settings
+from app.internal import discord_guild_link as glink
+from app.internal import discord_oauth as oauth
+from app.internal import discord_rest
+from app.internal import discord_streams as streams
+from app.routers import discord_oauth as router
+from app.routers import tokens as tokens_router
+from tests.fake_firestore import FakeFirestore
+
+REDIRECT = "https://drb.example.test/discord/connected"
+SECRET_A = "s3cr3t-app-a-0123456789abcdefXYZ"
+SECRET_POOL = "s3cr3t-pool-0123456789abcdefXYZ"
+GUILD = "100000000000000001"
+OWNER_A = {"uid": "owner-a", "email": "a@example.test", "org_id": "org-a", "org_role": "owner"}
+OWNER_B = {"uid": "owner-b", "email": "b@example.test", "org_id": "org-b", "org_role": "owner"}
+ADMIN = {"uid": "admin-1", "email": "admin@example.test", "role": "admin", "org_id": "founding"}
+
+
+class Discord:
+    """Scripted OAuth endpoints. ``token_reply`` answers POST /oauth2/token."""
+
+    def __init__(self):
+        self.calls: list[httpx.Request] = []
+        self.token_reply = httpx.Response(200, json={
+            "access_token": "user-access-token", "token_type": "Bearer", "scope": "bot",
+            "guild": {"id": GUILD, "name": "Station 7"}})
+
+    def __call__(self, request: httpx.Request) -> httpx.Response:
+        self.calls.append(request)
+        path = request.url.path.removeprefix("/api/v10")
+        if path == "/oauth2/token":
+            r = self.token_reply
+            return r(request) if callable(r) else r
+        if path == "/oauth2/token/revoke":
+            return httpx.Response(200, json={})
+        return httpx.Response(404, json={"code": 0})
+
+    def form(self, i: int) -> dict:
+        return {k: v[0] for k, v in parse_qs(self.calls[i].content.decode()).items()}
+
+    def basic(self, i: int) -> str:
+        raw = self.calls[i].headers["authorization"].split(" ", 1)[1]
+        return base64.b64decode(raw).decode()
+
+    def paths(self):
+        return [r.url.path.removeprefix("/api/v10") for r in self.calls]
+
+
+@pytest.fixture
+def discord(monkeypatch):
+    d = Discord()
+    discord_rest.reset()
+    monkeypatch.setattr(discord_rest, "_transport", httpx.MockTransport(d))
+    return d
+
+
+@pytest.fixture
+def fs(monkeypatch, discord):
+    fake = FakeFirestore.install(monkeypatch)
+    monkeypatch.setattr(settings, "discord_oauth_redirect_uri", REDIRECT)
+    monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", "")
+    monkeypatch.setattr(settings, "discord_pool_bot_guild_cap", 90)
+    for org in ("org-a", "org-b", "founding"):
+        fake.put("organizations", org, {"org_id": org, "name": org})
+    fake.put("org_members", "owner-a", {"uid": "owner-a", "org_id": "org-a", "org_role": "owner"})
+    fake.put("org_members", "owner-b", {"uid": "owner-b", "org_id": "org-b", "org_role": "owner"})
+    # org-a's own bot, two pool bots (one full), org-b's own bot.
+    fake.put("bot_tokens", "own-a", {"token_id": "own-a", "name": "Riverton Radio", "token": "tok-own-a",
+                                     "org_id": "org-a", "application_id": "111", "guild_ids": []})
+    fake.put("bot_tokens", "pool-1", {"token_id": "pool-1", "name": "DRB Radio 1", "token": "tok-pool-1",
+                                      "org_id": None, "application_id": "201", "guild_ids": ["9"] * 40})
+    fake.put("bot_tokens", "pool-2", {"token_id": "pool-2", "name": "DRB Radio 2", "token": "tok-pool-2",
+                                      "org_id": None, "application_id": "202", "guild_ids": ["9"] * 90})
+    fake.put("bot_tokens", "own-b", {"token_id": "own-b", "name": "Harbor Radio", "token": "tok-own-b",
+                                     "org_id": "org-b", "application_id": "333", "guild_ids": []})
+    for tid, secret in (("own-a", SECRET_A), ("pool-1", SECRET_POOL), ("pool-2", SECRET_POOL),
+                        ("own-b", SECRET_A)):
+        fake.put(oauth.OAUTH, tid, {"token_id": tid, "client_secret": secret, "enabled": True})
+    for lim in (router.start_limiter, router.complete_limiter):
+        lim._log.clear()
+    stopped: list = []
+
+    async def _stop_guild(guild_id, reason, channel_id=None, stream_id=None):
+        stopped.append((guild_id, reason))
+        return [f"{guild_id}:1"]
+    monkeypatch.setattr(streams, "stop_guild", _stop_guild)
+    fake.stopped = stopped
+
+    async def _voice_check(**kw):
+        return {"enabled": True, "channels": [
+            {"channel_id": "1", "name": "dispatch", "state": "ready", "bots": [{"fix": None}]},
+            {"channel_id": "2", "name": "fireground", "state": "needs_fix",
+             "bots": [{"fix": "In Discord: Edit Channel → Permissions → add Riverton Radio → allow Speak, "
+                              "then try again."}]},
+            {"channel_id": "3", "name": "ops", "state": "unknown", "bots": []},
+        ]}
+    monkeypatch.setattr(router, "voice_check", _voice_check)
+    return fake
+
+
+def _audit(fake, action):
+    return [e for e in (fake.data.get("audit_log") or {}).values() if e["action"] == action]
+
+
+def _status(resp):
+    return getattr(resp, "status_code", 200)
+
+
+def _body(resp):
+    return json.loads(resp.body) if hasattr(resp, "body") else resp
+
+
+async def _start(decoded=OWNER_A, **kw):
+    out = await router.oauth_start(router.StartBody(**kw), org_id=None, decoded=decoded)
+    q = parse_qs(urlparse(out["authorize_url"]).query)
+    return out, {k: v[0] for k, v in q.items()}
+
+
+async def _complete(state, decoded=OWNER_A, code="the-code"):
+    return await router.oauth_complete(router.CompleteBody(code=code, state=state), decoded=decoded)
+
+
+# ---------------------------------------------------------------------------
+# Off switch
+# ---------------------------------------------------------------------------
+
+async def test_every_route_is_404_while_redirect_uri_is_empty(fs, monkeypatch):
+    monkeypatch.setattr(settings, "discord_oauth_redirect_uri", "")
+    for call in (router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A),
+                 router.oauth_start(router.StartBody(), org_id=None, decoded=OWNER_A),
+                 _complete("anything")):
+        with pytest.raises(HTTPException) as e:
+            await call
+        assert e.value.status_code == 404
+
+
+async def test_404_when_no_usable_bot_has_a_secret(fs):
+    for tid in ("own-a", "pool-1", "pool-2"):
+        fs.data[oauth.OAUTH].pop(tid)
+    with pytest.raises(HTTPException) as e:
+        await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A)
+    assert e.value.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# Which bot
+# ---------------------------------------------------------------------------
+
+async def test_org_bot_first_then_least_full_pool_bot_under_cap(fs):
+    out = await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A)
+    assert out["bot"] == {"name": "Riverton Radio", "reason": "org_bot", "own_bot": True}
+    fs.data[oauth.OAUTH].pop("own-a")
+    out = await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A)
+    assert out["bot"]["name"] == "DRB Radio 1" and out["bot"]["reason"] == "pool"
+    # pool-2 is at the cap (90): never offered, even when it's the only one left
+    fs.data[oauth.OAUTH].pop("pool-1")
+    with pytest.raises(HTTPException) as e:
+        await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A)
+    assert e.value.status_code == 404
+
+
+async def test_preferred_bot_for_the_nodes_system_wins(fs):
+    fs.put("nodes", "n1", {"node_id": "n1", "org_id": "org-a", "assigned_system_id": "s1"})
+    fs.put("systems", "s1", {"system_id": "s1", "org_id": "org-a", "preferred_token_id": "pool-1"})
+    out = await router.oauth_options(node_id="n1", token_id=None, org_id=None, decoded=OWNER_A)
+    assert out["bot"]["name"] == "DRB Radio 1" and out["bot"]["reason"] == "preferred"
+    # another org's node is a 404
+    fs.put("nodes", "nb", {"node_id": "nb", "org_id": "org-b", "assigned_system_id": "s1"})
+    with pytest.raises(HTTPException) as e:
+        await router.oauth_options(node_id="nb", token_id=None, org_id=None, decoded=OWNER_A)
+    assert e.value.status_code == 404
+
+
+async def test_system_id_invites_that_systems_preferred_bot(fs):
+    """The S7 picker's "bot for a system" choice: a platform-pinned pool bot
+    is invited by system_id, never quietly swapped for Automatic."""
+    fs.put("systems", "s1", {"system_id": "s1", "org_id": "org-a", "preferred_token_id": "pool-1"})
+    out = await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A, system_id="s1")
+    assert out["bot"] == {"name": "DRB Radio 1", "reason": "preferred", "own_bot": False}
+    out, q = await _start(system_id="s1", return_to="/settings")
+    assert q["client_id"] == "201" and out["bot"]["reason"] == "preferred"
+    assert _audit(fs, "discord.oauth.start")[-1]["details"]["system_id"] == "s1"
+    # a shared system (no org_id) serves every org, as on the node path
+    fs.put("systems", "shared", {"system_id": "shared", "org_id": None, "preferred_token_id": "pool-1"})
+    out = await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_B,
+                                     system_id="shared")
+    assert out["bot"]["name"] == "DRB Radio 1"
+    # system_id outranks node_id
+    fs.put("nodes", "n1", {"node_id": "n1", "org_id": "org-a", "assigned_system_id": "s2"})
+    fs.put("systems", "s2", {"system_id": "s2", "org_id": "org-a", "preferred_token_id": "own-a"})
+    out = await router.oauth_options(node_id="n1", token_id=None, org_id=None, decoded=OWNER_A, system_id="s1")
+    assert out["bot"]["name"] == "DRB Radio 1"
+
+
+async def test_system_id_of_another_org_or_unknown_is_404(fs):
+    fs.put("systems", "sb", {"system_id": "sb", "org_id": "org-b", "preferred_token_id": "pool-1"})
+    for sid in ("sb", "nope"):
+        with pytest.raises(HTTPException) as e:
+            await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A, system_id=sid)
+        assert e.value.status_code == 404 and e.value.detail == "System not found."
+        with pytest.raises(HTTPException) as e:
+            await _start(system_id=sid)
+        assert e.value.status_code == 404
+    assert not _audit(fs, "discord.oauth.start")
+    # a platform admin acting for org-b may use it
+    out = await router.oauth_options(node_id=None, token_id=None, org_id="org-b", decoded=ADMIN, system_id="sb")
+    assert out["bot"]["name"] == "DRB Radio 1"
+
+
+async def test_system_id_whose_bot_cannot_connect_is_404_not_a_swap(fs):
+    # pool-2 is at the cap; another org's bot pinned (bad data); no secret
+    fs.put("systems", "s1", {"system_id": "s1", "org_id": "org-a", "preferred_token_id": "pool-2"})
+    fs.put("systems", "s2", {"system_id": "s2", "org_id": "org-a", "preferred_token_id": "own-b"})
+    fs.put("systems", "s3", {"system_id": "s3", "org_id": "org-a", "preferred_token_id": "pool-1"})
+    fs.data[oauth.OAUTH].pop("pool-1")
+    for sid in ("s1", "s2", "s3"):
+        with pytest.raises(HTTPException) as e:
+            await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A, system_id=sid)
+        assert e.value.status_code == 404 and "Harbor" not in str(e.value.detail)
+    # no preferred bot at all: the usual order (org's own bot first)
+    fs.put("systems", "s4", {"system_id": "s4", "org_id": "org-a"})
+    out = await router.oauth_options(node_id=None, token_id=None, org_id=None, decoded=OWNER_A, system_id="s4")
+    assert out["bot"]["reason"] == "org_bot"
+
+
+async def test_explicit_bot_must_be_usable_by_the_org(fs):
+    out = await router.oauth_options(node_id=None, token_id="pool-1", org_id=None, decoded=OWNER_A)
+    assert out["bot"]["reason"] == "chosen"
+    for tid in ("own-b", "pool-2", "nope"):     # other org's bot, full pool bot, unknown
+        with pytest.raises(HTTPException) as e:
+            await router.oauth_options(node_id=None, token_id=tid, org_id=None, decoded=OWNER_A)
+        assert e.value.status_code == 404
+
+
+# ---------------------------------------------------------------------------
+# Start
+# ---------------------------------------------------------------------------
+
+async def test_start_returns_the_bot_invite_and_stores_only_a_hash_of_the_state(fs):
+    out, q = await _start(return_to="/nodes/n1")
+    assert urlparse(out["authorize_url"]).netloc == "discord.com"
+    assert q["client_id"] == "111" and q["scope"] == "bot" and q["response_type"] == "code"
+    assert q["permissions"] == str((1 << 10) | (1 << 20) | (1 << 21))
+    assert q["redirect_uri"] == REDIRECT
+    nonce = q["state"]
+    assert len(nonce) >= 40
+    assert fs.get(oauth.STATES, nonce) is None                       # the nonce itself is never stored
+    st = fs.get(oauth.STATES, oauth.state_key(nonce))
+    assert st["org_id"] == "org-a" and st["uid"] == "owner-a" and st["token_id"] == "own-a"
+    assert st["return_to"] == "/nodes/n1" and st["used_at"] is None
+    assert len(_audit(fs, "discord.oauth.start")) == 1
+
+
+@pytest.mark.parametrize("bad", ["https://evil.test/x", "//evil.test/x", "/\\evil.test", "nodes", "/a\nb"])
+async def test_return_to_is_a_same_site_path_only(fs, bad):
+    _, q = await _start(return_to=bad)
+    assert fs.get(oauth.STATES, oauth.state_key(q["state"]))["return_to"] is None
+
+
+async def test_start_rate_limited_per_user(fs):
+    for _ in range(5):
+        await _start()
+    with pytest.raises(HTTPException) as e:
+        await _start()
+    assert e.value.status_code == 429
+
+
+# ---------------------------------------------------------------------------
+# Complete
+# ---------------------------------------------------------------------------
+
+async def test_complete_links_the_server_from_the_exchange_and_reports_channels(fs, discord):
+    _, q = await _start(return_to="/settings/discord")
+    out = await _complete(q["state"])
+    assert out["ok"] and out["guild_id"] == GUILD and out["guild_name"] == "Station 7"
+    assert out["org_id"] == "org-a" and out["bot_name"] == "Riverton Radio"
+    assert (out["channels_ready"], out["channels_blocked"]) == (1, 1)
+    assert out["channels"][1]["fix"].startswith("In Discord")
+    assert out["return_to"] == "/settings/discord"
+
+    g = fs.get(streams.GUILDS, GUILD)
+    assert g["org_id"] == "org-a" and g["linked_via"] == "oauth" and g["linked_by"] == "owner-a"
+    assert g["linked_with_token_id"] == "own-a"
+    assert fs.get("bot_tokens", "own-a")["guild_ids"] == [GUILD]
+    # the exchange used that bot application's own credentials and the exact redirect URI
+    assert discord.paths() == ["/oauth2/token", "/oauth2/token/revoke"]
+    assert discord.basic(0) == f"111:{SECRET_A}"
+    assert discord.form(0) == {"grant_type": "authorization_code", "code": "the-code", "redirect_uri": REDIRECT}
+    assert discord.form(1)["token"] == "user-access-token"           # revoked straight away
+    assert fs.get(oauth.STATES, oauth.state_key(q["state"]))["used_at"]
+    [entry] = _audit(fs, "discord.guild.link")
+    assert entry["details"]["via"] == "oauth" and entry["details"]["guild_id"] == GUILD
+
+
+async def test_state_is_single_use(fs):
+    _, q = await _start()
+    assert _status(await _complete(q["state"])) == 200
+    again = await _complete(q["state"])
+    assert _status(again) == 409 and _body(again)["code"] == "state_used"
+
+
+async def test_another_users_state_is_refused_and_burned(fs):
+    _, q = await _start(OWNER_A)
+    resp = await _complete(q["state"], decoded=OWNER_B)              # login-CSRF shape
+    assert _status(resp) == 403 and _body(resp)["code"] == "wrong_user"
+    assert fs.get(streams.GUILDS, GUILD) is None
+    assert _status(await _complete(q["state"], decoded=OWNER_A)) == 409   # consumed
+
+
+async def test_expired_and_unknown_states(fs):
+    _, q = await _start()
+    key = oauth.state_key(q["state"])
+    past = (datetime.now(timezone.utc) - timedelta(seconds=1)).isoformat()
+    fs.put(oauth.STATES, key, {**fs.get(oauth.STATES, key), "expires_at": past})
+    resp = await _complete(q["state"])
+    assert _status(resp) == 410 and fs.get(streams.GUILDS, GUILD) is None
+    assert _status(await _complete("not-a-state")) == 400
+
+
+async def test_caller_who_is_no_longer_owner_is_refused(fs, discord):
+    _, q = await _start()
+    fs.put("org_members", "owner-a", {"uid": "owner-a", "org_id": "org-a", "org_role": "member"})
+    resp = await _complete(q["state"])                               # token claims still say owner
+    assert _status(resp) == 403 and _body(resp)["code"] == "not_owner"
+    assert discord.calls == [] and fs.get(streams.GUILDS, GUILD) is None
+
+
+async def test_exchange_without_a_guild_links_nothing(fs, discord):
+    discord.token_reply = httpx.Response(200, json={"access_token": "x", "scope": "bot"})
+    _, q = await _start()
+    resp = await _complete(q["state"])
+    assert _status(resp) == 400 and _body(resp)["code"] == "no_guild"
+    assert fs.get(streams.GUILDS, GUILD) is None
+
+
+async def test_rejected_code_and_unreachable_discord(fs, discord):
+    discord.token_reply = httpx.Response(400, json={"error": "invalid_grant"})
+    _, q = await _start()
+    resp = await _complete(q["state"])
+    assert _status(resp) == 400 and _body(resp)["code"] == "code_rejected"
+
+    def _down(request):
+        raise httpx.ConnectError("down", request=request)
+    discord.token_reply = _down
+    _, q = await _start()
+    resp = await _complete(q["state"])
+    assert _status(resp) == 502 and fs.get(streams.GUILDS, GUILD) is None
+
+
+async def test_server_linked_to_another_org_is_never_moved(fs):
+    fs.put(streams.GUILDS, GUILD, {"guild_id": GUILD, "org_id": "org-b", "guild_name": "Harbor"})
+    _, q = await _start()
+    resp = await _complete(q["state"])
+    assert _status(resp) == 409 and _body(resp)["code"] == "linked_elsewhere"
+    assert fs.get(streams.GUILDS, GUILD)["org_id"] == "org-b"
+    assert fs.stopped == []
+    assert [e["details"]["via"] for e in _audit(fs, "discord.guild.link_refused")] == ["oauth"]
+
+
+async def test_linking_away_from_the_fallback_org_stops_its_streams(fs, monkeypatch):
+    monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", "founding")
+    _, q = await _start()
+    out = await _complete(q["state"])
+    assert out["streams_stopped"] == 1 and fs.stopped == [(GUILD, glink.RELINK_STOP_REASON)]
+
+
+async def test_permission_check_timeout_leaves_the_link_standing(fs, monkeypatch):
+    monkeypatch.setattr(settings, "discord_oauth_link_check_seconds", 0.05)
+
+    async def _slow(**kw):
+        await asyncio.sleep(1)
+    monkeypatch.setattr(router, "voice_check", _slow)
+    _, q = await _start()
+    out = await _complete(q["state"])
+    assert out["ok"] and out["checked"] is False and out["channels_ready"] is None
+    assert fs.get(streams.GUILDS, GUILD)["org_id"] == "org-a"
+
+
+async def test_bot_handed_to_another_org_after_start_is_refused(fs):
+    _, q = await _start()
+    fs.put("bot_tokens", "own-a", {**fs.get("bot_tokens", "own-a"), "org_id": "org-b"})
+    resp = await _complete(q["state"])
+    assert _status(resp) == 409 and _body(resp)["code"] == "bot_unavailable"
+
+
+# ---------------------------------------------------------------------------
+# Secrets: PUT /tokens/{id}/oauth, never returned, never logged
+# ---------------------------------------------------------------------------
+
+async def test_set_secret_checks_it_with_discord_and_never_echoes_it(fs, discord, caplog):
+    caplog.set_level(logging.DEBUG)
+    fs.data[oauth.OAUTH].clear()
+    discord.token_reply = httpx.Response(401, json={"error": "invalid_client"})
+    with pytest.raises(HTTPException) as e:
+        await tokens_router.set_oauth_secret("pool-1", tokens_router.OAuthSecret(client_secret=SECRET_POOL),
+                                             decoded=ADMIN)
+    assert e.value.status_code == 400 and fs.get(oauth.OAUTH, "pool-1") is None
+
+    discord.token_reply = httpx.Response(200, json={"access_token": "cc-token", "scope": "identify"})
+    out = await tokens_router.set_oauth_secret("pool-1", tokens_router.OAuthSecret(client_secret=SECRET_POOL),
+                                               decoded=ADMIN)
+    assert out["oauth_enabled"] is True
+    assert discord.form(1) == {"grant_type": "client_credentials", "scope": "identify"}
+    assert discord.basic(1) == f"201:{SECRET_POOL}"
+    assert discord.form(2)["token"] == "cc-token"                    # the check's token is revoked
+    assert fs.get(oauth.OAUTH, "pool-1")["client_secret"] == SECRET_POOL
+    assert "client_secret" not in fs.get("bot_tokens", "pool-1")
+
+    listed = await tokens_router.list_tokens(_=ADMIN)
+    everything = json.dumps([listed, out, fs.data.get("audit_log")]) + caplog.text
+    assert SECRET_POOL not in everything and "tok-pool-1" not in everything
+    row = next(t for t in listed if t["token_id"] == "pool-1")
+    assert row["oauth_enabled"] is True and row["server_count"] == 40 and row["server_cap"] == 90
+
+
+async def test_unreachable_discord_saves_nothing(fs, discord):
+    fs.data[oauth.OAUTH].clear()
+
+    def _down(request):
+        raise httpx.ConnectError("down", request=request)
+    discord.token_reply = _down
+    with pytest.raises(HTTPException) as e:
+        await tokens_router.set_oauth_secret("pool-1", tokens_router.OAuthSecret(client_secret=SECRET_POOL),
+                                             decoded=ADMIN)
+    assert e.value.status_code == 503 and fs.get(oauth.OAUTH, "pool-1") is None
+
+
+async def test_token_list_is_an_allowlist(fs):
+    fs.put("bot_tokens", "pool-1", {**fs.get("bot_tokens", "pool-1"), "client_secret": "LEAK", "future": "x"})
+    row = next(t for t in await tokens_router.list_tokens(_=ADMIN) if t["token_id"] == "pool-1")
+    assert "client_secret" not in row and "future" not in row
+    assert row["token"] == "•••ol-1" and row["name"] == "DRB Radio 1"
+
+
+async def test_clear_and_delete_remove_the_secret(fs):
+    await tokens_router.clear_oauth_secret("pool-1", decoded=ADMIN)
+    assert fs.get(oauth.OAUTH, "pool-1") is None
+    await tokens_router.delete_token("own-a", _=ADMIN)
+    assert fs.get(oauth.OAUTH, "own-a") is None
+
+
+async def test_malformed_secret_is_refused_without_echo(fs, discord):
+    fs.data[oauth.OAUTH].clear()
+    with pytest.raises(HTTPException) as e:
+        await tokens_router.set_oauth_secret("pool-1", tokens_router.OAuthSecret(client_secret="short-secret"),
+                                             decoded=ADMIN)
+    assert e.value.status_code == 400 and "short-secret" not in str(e.value.detail)
+    assert discord.calls == [] and fs.get(oauth.OAUTH, "pool-1") is None

drb-c2-core/tests/test_discord_owner_flows.py

@@ -0,0 +1,506 @@
+"""
+The two owner setups from server-26#225, end to end (S8).
+
+  1. One-bot org: no DRB server bot anywhere. A platform admin adds the org's
+     own radio bot and its OAuth secret; the owner marks it preferred for the
+     org's system, connects the Discord server through that bot's invite,
+     opens the node page's picker and starts a stream.
+  2. Full setup: the DRB server bot is in the server (directory push, /drb
+     link, /join) beside several radio bots. C2 places each stream by
+     membership, Discord permissions on the voice channel, one voice channel
+     per bot per server and the system's preferred bot, lets several bots
+     share one voice channel, and explains when nothing fits.
+
+Every route handler here is the real one, and so is every module under it
+(discord_streams, discord_leases, discord_rest, discord_oauth,
+discord_guild_link, discord_perms). Only the edges are fake: Firestore is
+tests/fake_firestore.py, MQTT records what would be published, and Discord is
+``DiscordWorld`` behind httpx.MockTransport — a small model of servers, roles,
+channel overrides and bot applications that answers the same REST and OAuth2
+calls Discord does.
+"""
+from __future__ import annotations
+
+import base64
+import json
+from dataclasses import dataclass, field
+from typing import Optional
+from urllib.parse import parse_qs, urlparse
+
+import httpx
+import pytest
+from fastapi.security import HTTPAuthorizationCredentials
+
+from app.config import settings
+from app.internal import discord_perms as perms
+from app.internal import discord_rest
+from app.internal import discord_streams as streams
+from app.routers import discord as discord_router
+from app.routers import discord_checks as checks
+from app.routers import discord_link as link_router
+from app.routers import discord_oauth as oauth_router
+from app.routers import discord_web as web
+from app.routers import tokens as tokens_router
+from tests.fake_firestore import FakeFirestore
+
+ORG = "org-a"
+VOICE = perms.VIEW_CHANNEL | perms.CONNECT | perms.SPEAK
+REDIRECT = "https://drb.example.test/discord/connected"
+ADMIN = {"uid": "admin-1", "email": "admin@example.test", "role": "admin", "org_id": "founding"}
+OWNER = {"uid": "owner-a", "email": "owner@example.test", "org_id": ORG, "org_role": "owner"}
+SERVICE = {"service": True}
+
+
+# ---------------------------------------------------------------------------
+# A small Discord
+# ---------------------------------------------------------------------------
+
+@dataclass
+class BotApp:
+    name: str
+    token: str
+    user_id: str
+    app_id: str
+    secret: str
+
+
+@dataclass
+class Guild:
+    gid: str
+    name: str
+    roles: dict = field(default_factory=dict)       # role id -> permission int (@everyone id = gid)
+    role_names: dict = field(default_factory=dict)
+    channels: list = field(default_factory=list)
+    members: dict = field(default_factory=dict)     # user id -> [role ids]
+
+
+class DiscordWorld:
+    """Answers Discord REST (``Authorization: Bot …``) and OAuth2
+    (``Authorization: Basic client_id:secret``) for the bots and servers in
+    it. Adding a bot through the OAuth code exchange makes it a member, like
+    the real "Authorize" click does."""
+
+    def __init__(self):
+        self.bots: dict[str, BotApp] = {}         # token -> app
+        self.guilds: dict[str, Guild] = {}
+        self.pending: dict[str, tuple] = {}       # oauth code -> (app_id, guild_id)
+        self.requests: list[httpx.Request] = []
+
+    # --- world building ---------------------------------------------------
+    def bot(self, name: str, n: int) -> BotApp:
+        b = BotApp(name=name, token=f"bot-token-{n}", user_id=f"9000{n}", app_id=f"7000{n}",
+                   secret=f"client-secret-{n}-0123456789abcdef")
+        self.bots[b.token] = b
+        return b
+
+    def guild(self, gid: str, name: str) -> Guild:
+        g = Guild(gid=gid, name=name, roles={gid: VOICE}, role_names={gid: "@everyone"})
+        self.guilds[gid] = g
+        return g
+
+    def authorize(self, app: BotApp, gid: str) -> str:
+        """The owner clicks Authorize in Discord for ``gid``: Discord sends
+        the browser back with a code."""
+        code = f"code-{app.app_id}-{gid}"
+        self.pending[code] = (app.app_id, gid)
+        return code
+
+    def auth_kinds(self) -> list[str]:
+        return [r.headers.get("authorization", "").split(" ", 1)[0] for r in self.requests]
+
+    def bot_tokens_used(self) -> set[str]:
+        return {r.headers["authorization"].split(" ", 1)[1] for r in self.requests
+                if r.headers.get("authorization", "").startswith("Bot ")}
+
+    # --- transport --------------------------------------------------------
+    def __call__(self, request: httpx.Request) -> httpx.Response:
+        self.requests.append(request)
+        path = request.url.path.removeprefix("/api/v10")
+        auth = request.headers.get("authorization", "")
+        if path.startswith("/oauth2/token"):
+            return self._oauth(request, path, auth)
+        if not auth.startswith("Bot "):
+            return httpx.Response(401, json={"code": 0, "message": "401: Unauthorized"})
+        app = self.bots.get(auth[4:])
+        if app is None:
+            return httpx.Response(401, json={"code": 0, "message": "401: Unauthorized"})
+        return self._rest(app, request, path)
+
+    def _oauth(self, request: httpx.Request, path: str, auth: str) -> httpx.Response:
+        if not auth.startswith("Basic "):
+            return httpx.Response(401, json={"error": "invalid_client"})
+        client_id, _, secret = base64.b64decode(auth[6:]).decode().partition(":")
+        app = next((a for a in self.bots.values() if a.app_id == client_id), None)
+        if app is None or app.secret != secret:
+            return httpx.Response(401, json={"error": "invalid_client"})
+        if path == "/oauth2/token/revoke":
+            return httpx.Response(200, json={})
+        form = {k: v[0] for k, v in parse_qs(request.content.decode()).items()}
+        if form.get("grant_type") == "client_credentials":
+            return httpx.Response(200, json={"access_token": "cc-token", "token_type": "Bearer"})
+        if form.get("grant_type") != "authorization_code" or form.get("redirect_uri") != REDIRECT:
+            return httpx.Response(400, json={"error": "invalid_grant"})
+        pending = self.pending.pop(form.get("code"), None)
+        if not pending or pending[0] != client_id:
+            return httpx.Response(400, json={"error": "invalid_grant"})
+        g = self.guilds[pending[1]]
+        g.members.setdefault(app.user_id, [])          # the bot joins the server
+        return httpx.Response(200, json={"access_token": "user-access-token", "token_type": "Bearer",
+                                         "scope": "bot", "guild": {"id": g.gid, "name": g.name}})
+
+    def _rest(self, app: BotApp, request: httpx.Request, path: str) -> httpx.Response:
+        parts = path.strip("/").split("/")
+        if path == "/users/@me":
+            return httpx.Response(200, json={"id": app.user_id, "username": app.name, "bot": True})
+        if path == "/oauth2/applications/@me":
+            return httpx.Response(200, json={"id": app.app_id, "name": app.name})
+        if path == "/users/@me/guilds":
+            after = int(request.url.params.get("after") or 0)
+            mine = sorted((g for g in self.guilds.values() if app.user_id in g.members), key=lambda g: int(g.gid))
+            return httpx.Response(200, json=[{"id": g.gid, "name": g.name} for g in mine if int(g.gid) > after])
+        if parts[0] == "guilds" and len(parts) >= 2:
+            g = self.guilds.get(parts[1])
+            if g is None or app.user_id not in g.members:
+                return httpx.Response(404, json={"code": discord_rest.UNKNOWN_GUILD, "message": "Unknown Guild"})
+            if len(parts) == 2:
+                return httpx.Response(200, json={
+                    "id": g.gid, "name": g.name, "owner_id": "human-owner",
+                    "roles": [{"id": rid, "name": g.role_names.get(rid, rid), "permissions": str(p)}
+                              for rid, p in g.roles.items()]})
+            if parts[2] == "members" and len(parts) == 4:
+                if parts[3] not in g.members:
+                    return httpx.Response(404, json={"code": discord_rest.UNKNOWN_MEMBER})
+                return httpx.Response(200, json={"user": {"id": parts[3]}, "roles": g.members[parts[3]]})
+            if parts[2] == "channels":
+                return httpx.Response(200, json=g.channels)
+        return httpx.Response(404, json={"code": 0, "message": "404: Not Found"})
+
+
+def voice(cid: str, name: str, position: int, *overwrites: dict, parent: Optional[str] = None) -> dict:
+    return {"id": cid, "name": name, "type": 2, "position": position, "user_limit": 0,
+            "parent_id": parent, "permission_overwrites": list(overwrites)}
+
+
+def deny(role_id: str, bits: int) -> dict:
+    return {"id": role_id, "type": 0, "allow": "0", "deny": str(bits)}
+
+
+# ---------------------------------------------------------------------------
+# Fixture: fake Firestore + MQTT + Discord, one org
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def env(monkeypatch):
+    fake = FakeFirestore.install(monkeypatch)
+    world = DiscordWorld()
+    discord_rest.reset()
+    monkeypatch.setattr(discord_rest, "_transport", httpx.MockTransport(world))
+    published: list = []
+    from app.internal.mqtt_handler import mqtt_handler
+    monkeypatch.setattr(mqtt_handler, "publish_discord_desired", lambda n, p: published.append((n, p)) or True)
+    monkeypatch.setattr(settings, "discord_oauth_redirect_uri", REDIRECT)
+    monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", "")
+    monkeypatch.setattr(settings, "discord_perm_check_enabled", True)
+    streams._publish_locks.clear()
+    streams._guild_locks.clear()
+    checks._last_refresh.clear()
+    web._directory_tasks.clear()
+    for lim in (oauth_router.start_limiter, oauth_router.complete_limiter, link_router.mint_limiter,
+                link_router.redeem_guild_limiter, link_router.redeem_user_limiter):
+        lim._log.clear()
+    fake.put("organizations", ORG, {"org_id": ORG, "name": "Riverton"})
+    fake.put("org_members", OWNER["uid"], {"uid": OWNER["uid"], "org_id": ORG, "org_role": "owner"})
+    yield fake, world, published
+    discord_rest.reset()
+
+
+def _node(fake, nid: str, system_id: str):
+    fake.put("nodes", nid, {"node_id": nid, "name": f"Node {nid}", "org_id": ORG, "status": "online",
+                            "approval_status": "approved", "assigned_system_id": system_id})
+
+
+def _body(resp):
+    return json.loads(resp.body) if hasattr(resp, "body") else resp
+
+
+def _status(resp):
+    return getattr(resp, "status_code", 200)
+
+
+def _no_secrets(world: DiscordWorld, *payloads) -> None:
+    text = json.dumps(payloads, default=str)
+    for app in world.bots.values():
+        assert app.token not in text and app.secret not in text
+
+
+# ---------------------------------------------------------------------------
+# 1. One-bot org — no DRB server bot
+# ---------------------------------------------------------------------------
+
+async def test_one_bot_org_links_lists_checks_and_streams_without_the_server_bot(env):
+    fake, world, published = env
+    fake.put("systems", "sys-a", {"system_id": "sys-a", "name": "Riverton P25", "org_id": ORG})
+    _node(fake, "n1", "sys-a")
+    fake.put("node_keys", "n1", {"api_key": "node-key-n1"})
+    g = world.guild("400000000000000001", "Riverton FD")
+    g.channels = [
+        {"id": "400000000000000010", "name": "Radio", "type": 4, "position": 0, "permission_overwrites": []},
+        voice("400000000000000011", "dispatch", 0, parent="400000000000000010"),
+        {"id": "400000000000000012", "name": "general", "type": 0, "position": 1, "permission_overwrites": []},
+    ]
+    riverton = world.bot("Riverton Radio", 1)
+    # A pool bot exists too (no OAuth secret, not in the server): never chosen here.
+    fake.put("bot_tokens", "pool-1", {"token_id": "pool-1", "name": "DRB Radio 1", "token": "pool-token",
+                                      "org_id": None, "application_id": "60001", "guild_ids": [], "valid": True,
+                                      "lease": None})
+
+    # Platform admin: add the org's own bot, then its OAuth client secret.
+    added = await tokens_router.add_token(
+        tokens_router.TokenCreate(name="Riverton Radio", token=riverton.token, org_id=ORG), ADMIN)
+    tid = added["token_id"]
+    assert added["valid"] is True and added["guild_ids"] == []
+    out = await tokens_router.set_oauth_secret(tid, tokens_router.OAuthSecret(client_secret=riverton.secret), ADMIN)
+    assert out["oauth_enabled"] is True
+
+    # Owner (Q2): their own bot, preferred for their own system.
+    await tokens_router.set_preferred_system(tid, "sys-a", OWNER)
+    assert fake.get("systems", "sys-a")["preferred_token_id"] == tid
+
+    # Owner: Connect a Discord server from the node — the preferred bot is invited.
+    opts = await oauth_router.oauth_options(node_id="n1", token_id=None, org_id=None, decoded=OWNER)
+    assert opts["bot"] == {"name": "Riverton Radio", "reason": "preferred", "own_bot": True}
+    start = await oauth_router.oauth_start(oauth_router.StartBody(node_id="n1", return_to="/nodes/n1"),
+                                           org_id=None, decoded=OWNER)
+    q = {k: v[0] for k, v in parse_qs(urlparse(start["authorize_url"]).query).items()}
+    assert q["client_id"] == riverton.app_id and q["scope"] == "bot" and q["redirect_uri"] == REDIRECT
+
+    # In Discord: pick Riverton FD, Authorize. Discord sends the browser back.
+    code = world.authorize(riverton, g.gid)
+    done = _body(await oauth_router.oauth_complete(oauth_router.CompleteBody(code=code, state=q["state"]),
+                                                   decoded=OWNER))
+    assert done["ok"] is True and done["guild_id"] == g.gid and done["guild_name"] == "Riverton FD"
+    assert done["return_to"] == "/nodes/n1" and done["bot_name"] == "Riverton Radio"
+    # Permissions were checked in the same request, from the radio bot's view.
+    assert done["checked"] is True and done["channels_ready"] == 1 and done["channels_blocked"] == 0
+    assert [c["name"] for c in done["channels"]] == ["dispatch"]
+
+    link = fake.get("discord_guilds", g.gid)
+    assert link["org_id"] == ORG and link["linked_via"] == "oauth"
+    assert "bot_present" not in link                     # the server bot never said anything
+    assert g.gid in fake.get("bot_tokens", tid)["guild_ids"]
+
+    # Node page: the server is listed, its channels read through the radio bot.
+    opts = await web.join_options("n1", OWNER)
+    [gopt] = opts["guilds"]
+    assert gopt["guild_id"] == g.gid and gopt["linked"] is True
+    assert gopt["main_bot_present"] is False and gopt["directory_source"] == "radio_bot"
+    assert [c["name"] for c in gopt["voice_channels"]] == ["dispatch"]
+    assert gopt["bot"]["ok"] is True
+    vc = await checks.node_voice_check("n1", g.gid, refresh=0, channel_id=None, decoded=OWNER)
+    [row] = vc["channels"]
+    assert row["state"] == "ready" and [b["name"] for b in row["bots"]] == ["Riverton Radio"]
+
+    # Start: the preferred bot carries it, on this node.
+    started = await web.start_node_stream(
+        "n1", web.NodeStreamStart(guild_id=g.gid, channel_id="400000000000000011", mode="persistent"), OWNER)
+    assert _status(started) == 200, _body(started)
+    assert started["token_id"] == tid and started["delivered"] is True
+    stream = fake.get("discord_streams", started["stream_id"])
+    assert stream["node_id"] == "n1" and stream["guild_name"] == "Riverton FD"
+    assert stream["channel_name"] == "dispatch" and stream["mode"] == "persistent"
+    node_id, payload = published[-1]
+    assert node_id == "n1"
+    assert [(s["stream_id"], s["token_id"]) for s in payload["streams"]] == [(started["stream_id"], tid)]
+
+    # The node picks the token string up with its own key — the only place it leaves C2.
+    got = await discord_router.node_token(
+        "n1", tid, HTTPAuthorizationCredentials(scheme="Bearer", credentials="node-key-n1"))
+    assert got["token"] == riverton.token
+
+    # Nothing but this org's radio bot ever talked to Discord, and nothing a
+    # browser saw carries a token or a client secret.
+    assert world.bot_tokens_used() == {riverton.token}
+    assert set(world.auth_kinds()) <= {"Bot", "Basic"}
+    _no_secrets(world, opts, vc, done, started, start, await tokens_router.list_tokens(ADMIN))
+
+
+async def test_one_bot_org_reconciler_replaces_the_stream_without_the_server_bot(env):
+    """Persistent stream, node lost: the reconciler re-places it on another
+    node of the same system with the same radio bot — no server bot involved."""
+    fake, world, published = env
+    fake.put("systems", "sys-a", {"system_id": "sys-a", "name": "Riverton P25", "org_id": ORG})
+    _node(fake, "n1", "sys-a")
+    _node(fake, "n2", "sys-a")
+    g = world.guild("400000000000000001", "Riverton FD")
+    g.channels = [voice("400000000000000011", "dispatch", 0)]
+    riverton = world.bot("Riverton Radio", 1)
+    g.members[riverton.user_id] = []
+    fake.put("bot_tokens", "own", {"token_id": "own", "name": "Riverton Radio", "token": riverton.token,
+                                   "org_id": ORG, "application_id": riverton.app_id, "bot_user_id": riverton.user_id,
+                                   "guild_ids": [g.gid], "valid": True, "lease": None})
+    fake.put("discord_guilds", g.gid, {"guild_id": g.gid, "org_id": ORG, "linked_via": "oauth"})
+
+    started = await web.start_node_stream(
+        "n1", web.NodeStreamStart(guild_id=g.gid, channel_id="400000000000000011", mode="persistent"), OWNER)
+    sid = started["stream_id"]
+    # n1 goes away for good (past the lease grace).
+    fake.put("nodes", "n1", {**fake.get("nodes", "n1"), "status": "offline",
+                             "last_seen": "2026-01-01T00:00:00+00:00"})
+    await streams.reconcile_once()
+    s = fake.get("discord_streams", sid)
+    assert s["desired"] == "on" and s["node_id"] == "n2" and s["token_id"] == "own"
+    assert world.bot_tokens_used() == {riverton.token}
+
+
+# ---------------------------------------------------------------------------
+# 2. Full setup — DRB server bot + several radio bots
+# ---------------------------------------------------------------------------
+
+GID = "500000000000000001"
+DISPATCH, FIREGROUND, LOBBY = "500000000000000011", "500000000000000012", "500000000000000013"
+MUTED = "500000000000000099"
+
+
+@pytest.fixture
+def full(env):
+    fake, world, published = env
+    for sid, name in (("sys-a", "County P25"), ("sys-b", "City Fire"), ("sys-c", "EMS")):
+        fake.put("systems", sid, {"system_id": sid, "name": name, "org_id": ORG})
+    _node(fake, "n1", "sys-a")
+    _node(fake, "n2", "sys-b")
+    _node(fake, "n3", "sys-c")
+    g = world.guild(GID, "Station 7")
+    g.roles[MUTED], g.role_names[MUTED] = 0, "Muted"
+    g.channels = [
+        voice(DISPATCH, "dispatch", 0, deny(MUTED, perms.SPEAK)),       # @Muted can't Speak here
+        voice(FIREGROUND, "fireground", 1, deny(GID, perms.CONNECT)),   # nobody can Connect here
+        voice(LOBBY, "lobby", 2),
+    ]
+    bots = {}
+    for n, (tid, name, org, member, roles) in enumerate((
+            ("own-a", "Riverton Radio", ORG, True, [MUTED]),
+            ("pool-1", "DRB Radio 1", None, True, []),
+            ("pool-2", "DRB Radio 2", None, True, []),
+            ("pool-3", "DRB Radio 3", None, False, []),
+    ), start=1):
+        app = world.bot(name, n)
+        if member:
+            g.members[app.user_id] = roles
+        fake.put("bot_tokens", tid, {"token_id": tid, "name": name, "token": app.token, "org_id": org,
+                                     "application_id": app.app_id, "bot_user_id": app.user_id,
+                                     "guild_ids": [GID] if member else [], "valid": True, "lease": None})
+        bots[tid] = app
+    # A platform admin pinned DRB Radio 2 to City Fire.
+    fake.put("systems", "sys-b", {**fake.get("systems", "sys-b"), "preferred_token_id": "pool-2"})
+    fake.bots = bots
+    return fake, world, published
+
+
+async def _server_bot_sets_up(fake):
+    """The DRB server bot is in Station 7: it pushes its channel list, and
+    someone with Manage Server runs /drb link with the owner's code."""
+    await web.put_guild_directory(GID, web.GuildDirectory(name="Station 7", voice_channels=[
+        web.VoiceChannelIn(channel_id=DISPATCH, name="dispatch", category="Radio", position=0),
+        web.VoiceChannelIn(channel_id=FIREGROUND, name="fireground", category="Radio", position=1),
+        web.VoiceChannelIn(channel_id=LOBBY, name="lobby", category="Radio", position=2),
+    ]), SERVICE)
+    minted = await link_router.create_link_code(org_id=None, decoded=OWNER)
+    out = _body(await link_router.redeem_link_code(
+        GID, link_router.RedeemBody(code=minted["code"], discord_user_id="123456", guild_name="Station 7"),
+        SERVICE))
+    assert out["ok"] is True and out["org_id"] == ORG
+
+
+async def test_full_setup_places_each_stream_and_explains_every_refusal(full):
+    fake, world, published = full
+    await _server_bot_sets_up(fake)
+    link = fake.get("discord_guilds", GID)
+    assert link["org_id"] == ORG and link["bot_present"] is True and link["directory_source"] == "main_bot"
+
+    # Before anything plays: nobody may Connect in #fireground. Every member
+    # bot is named with what removed the permission; the bot that isn't in
+    # the server yet is offered as an invite.
+    r = await web.start_node_stream("n1", web.NodeStreamStart(guild_id=GID, channel_id=FIREGROUND), OWNER)
+    body = _body(r)
+    assert _status(r) == 409 and body["code"] == "missing_permissions"
+    assert sorted(d["name"] for d in body["denied"]) == ["DRB Radio 1", "DRB Radio 2", "Riverton Radio"]
+    assert all(d["missing"][0] == "Connect" for d in body["denied"])
+    assert body["detail"].startswith("No radio bot can play in #fireground:")
+    assert "#fireground's override for @everyone" in body["detail"]
+    assert [i["name"] for i in body["invite"]] == ["DRB Radio 3"]
+    assert fake.data.get("discord_streams") in (None, {})
+
+    # /join County P25 in #dispatch (DRB server bot): the org's own bot comes
+    # first but @Muted can't Speak there, so DRB Radio 1 takes it.
+    a = _body(await discord_router.start_stream(discord_router.StreamStart(
+        guild_id=GID, channel_id=DISPATCH, system_id="sys-a", channel_name="dispatch", created_by="111"), SERVICE))
+    assert a["token_id"] == "pool-1" and a["node_id"] == "n1"
+
+    # /join City Fire in the SAME channel: its preferred bot, beside the first.
+    b = _body(await discord_router.start_stream(discord_router.StreamStart(
+        guild_id=GID, channel_id=DISPATCH, system_id="sys-b", channel_name="dispatch", created_by="111"), SERVICE))
+    assert b["token_id"] == "pool-2" and b["node_id"] == "n2" and b["stream_id"] != a["stream_id"]
+    on_dispatch = [s for s in fake.data["discord_streams"].values()
+                   if s["channel_id"] == DISPATCH and s["desired"] == "on"]
+    assert sorted(s["token_id"] for s in on_dispatch) == ["pool-1", "pool-2"]
+
+    # EMS on #dispatch from the web picker: both pool bots already hold a
+    # voice channel in this server, and the org's own bot is muted there.
+    vc = await checks.node_voice_check("n3", GID, refresh=0, channel_id=DISPATCH, decoded=OWNER)
+    [row] = vc["channels"]
+    assert row["state"] == "needs_fix"
+    by_name = {b["name"]: b for b in row["bots"]}
+    assert by_name["DRB Radio 1"]["unavailable_reason"] == "busy_here"
+    assert by_name["Riverton Radio"]["missing"] == ["Speak"]
+    assert "@Muted" in by_name["Riverton Radio"]["reason"]
+    r = await web.start_node_stream("n3", web.NodeStreamStart(guild_id=GID, channel_id=DISPATCH), OWNER)
+    body = _body(r)
+    assert _status(r) == 409 and body["code"] == "missing_permissions"
+    assert body["detail"].startswith("Riverton Radio can't Speak in #dispatch:")
+    assert "Edit Channel → Permissions → add Riverton Radio → allow Speak" in body["detail"]
+
+    # EMS on #lobby: nothing overrides @Muted there, so the org's own bot plays it.
+    c = await web.start_node_stream("n3", web.NodeStreamStart(guild_id=GID, channel_id=LOBBY), OWNER)
+    assert _status(c) == 200 and c["token_id"] == "own-a"
+
+    # Naming a bot that already holds a channel here is refused, not swapped.
+    r = await discord_router.start_stream(discord_router.StreamStart(
+        guild_id=GID, channel_id=LOBBY, system_id="sys-a", preferred_token_id="pool-1"), SERVICE)
+    body = _body(r)
+    assert _status(r) == 409 and body["code"] == "preferred_busy"
+    assert "DRB Radio 1 is already playing County P25 in #dispatch" in body["detail"]
+
+    # Each node was told only about its own stream, by token id.
+    last = {n: p for n, p in published}
+    assert {n: [s["token_id"] for s in p["streams"]] for n, p in last.items()} == {
+        "n1": ["pool-1"], "n2": ["pool-2"], "n3": ["own-a"]}
+
+    # /status and the admin page see both kinds of bot.
+    ov = await discord_router.guild_overview(GID, SERVICE)
+    assert ov["linked"] is True and len(ov["streams"]) == 3
+    adm = await discord_router.admin_overview(ADMIN)
+    [ga] = [x for x in adm["guilds"] if x["guild_id"] == GID]
+    assert ga["main_bot_present"] is True and ga["linked_via"] == "code"
+    assert ga["radio_bots"] == ["DRB Radio 1", "DRB Radio 2", "Riverton Radio"]
+    # Only radio bots ever called Discord; the server bot works over the gateway.
+    assert world.bot_tokens_used() <= {app.token for app in fake.bots.values()}
+    _no_secrets(world, ov, adm, vc)
+
+
+async def test_full_setup_server_bot_leaving_keeps_radio_working(full):
+    """The DRB server bot is kicked: the server stays usable through its
+    radio bots (picker, permission check, start) — the main bot is optional."""
+    fake, world, published = full
+    await _server_bot_sets_up(fake)
+    await web.put_guild_directory(GID, web.GuildDirectory(present=False), SERVICE)
+    assert fake.get("discord_guilds", GID)["bot_present"] is False
+
+    opts = await web.join_options("n1", OWNER)
+    [gopt] = opts["guilds"]
+    assert gopt["main_bot_present"] is False
+    assert [c["name"] for c in gopt["voice_channels"]] == ["dispatch", "fireground", "lobby"]
+    c = await web.start_node_stream("n1", web.NodeStreamStart(guild_id=GID, channel_id=LOBBY), OWNER)
+    assert _status(c) == 200 and c["token_id"] == "own-a"
+    adm = await discord_router.admin_overview(ADMIN)
+    [ga] = [x for x in adm["guilds"] if x["guild_id"] == GID]
+    assert ga["main_bot_present"] is False and len(ga["radio_bots"]) == 3

drb-c2-core/tests/test_discord_perm_check.py

@@ -84,7 +84,7 @@ def fs(monkeypatch):
     monkeypatch.setattr(settings, "discord_unlinked_guild_org_id", "")
     monkeypatch.setattr(settings, "discord_perm_check_enabled", True)
 
-    # Per-token snapshot behaviour: "ok" | "muted" | "unknown" | "slow" | "not_member"
+    # Per-token snapshot behaviour: "ok" | "muted" | "unknown" | "slow" | "not_member" | "invalid"
     fake.snap_mode = {}
     fake.snap_calls = []
 
@@ -99,6 +99,8 @@ def fs(monkeypatch):
             return _snap(tid, status=discord_rest.UNKNOWN)
         if mode == "not_member":
             return _snap(tid, status=discord_rest.NOT_MEMBER)
+        if mode == "invalid":
+            return _snap(tid, status=discord_rest.INVALID)
         return _snap(tid, muted=(mode == "muted"))
     monkeypatch.setattr(discord_rest, "guild_snapshot", _snapshot)
 
@@ -413,6 +415,23 @@ def test_voice_check_needs_fix_when_every_free_bot_is_denied(fs):
     assert out["channels"][0]["state"] == "unknown"        # can't tell -> start still allowed
 
 
+def test_voice_check_invalid_token_is_not_no_bot(fs):
+    # server-26#257: the bot is in the server but Discord rejected its token.
+    # "No radio bot" (and an invite to a bot already there) would be wrong.
+    _token(fs, "t1")
+    fs.snap_mode["t1"] = "invalid"
+    out = run(checks.node_voice_check("n1", GUILD, refresh=0, channel_id="1001", decoded=OWNER))
+    assert out["channels"][0]["state"] == "invalid"
+    assert out["channels"][0]["bots"][0]["status"] == "invalid"
+    # a working bot elsewhere in the list still wins
+    _token(fs, "t2")
+    discord_rest.invalidate()
+    out = run(checks.node_voice_check("n1", GUILD, refresh=0, channel_id="1001", decoded=OWNER))
+    assert out["channels"][0]["state"] == "ready"
+    # no bot at all is still no_bot
+    assert checks._channel_state([], True) == "no_bot"
+
+
 def test_voice_check_is_org_scoped(fs):
     _token(fs, "t1")
     for node, guild, who in (("n1", "200", OWNER), ("nx", GUILD, OWNER), ("n1", GUILD, STRANGER)):

drb-c2-core/tests/test_discord_web_picker.py

@@ -80,7 +80,10 @@ def test_directory_push_keeps_org_link(fs):
     assert [c["channel_id"] for c in g["voice_channels"]] == ["1003"]
 
 
-def test_directory_bot_removed_hides_guild(fs):
+def test_directory_bot_removed_hides_guild_without_a_radio_bot(fs):
+    # server-26#225 S5: the server bot leaving hides a linked server only when
+    # no radio bot the org may use is in it either.
+    fs.put("bot_tokens", "t1", {**fs.get("bot_tokens", "t1"), "guild_ids": ["200"]})
     run(web.put_guild_directory("100", web.GuildDirectory(present=False), {"service": True}))
     opts = run(web.join_options("n1", OWNER))
     assert opts["guilds"] == []

drb-c2-core/tests/test_gemini_helper.py

@@ -34,12 +34,13 @@ def test_minimal_thinking_by_default_and_usage_lands_in_the_sink():
     models = _FakeModels()
     a, b = _patched(models)
     sink = {}
-    tok = gemini.collect_usage(sink)
+    from app.internal import llm
+    tok = llm.collect_usage(sink)
     try:
         with a, b:
             assert gemini.generate_json("m1", "p", purpose="correlation") == {"action": "link"}
     finally:
-        gemini.reset_usage(tok)
+        llm.reset_usage(tok)
     assert models.configs == [{"thinking_level": "minimal"}]
     assert sink == {"correlation:m1": {"calls": 1, "in": 1200, "out": 30, "thinking": 0}}
 

drb-c2-core/tests/test_geocode_cache.py

@@ -0,0 +1,162 @@
+"""
+server-26#298 — geocode result cache in front of the Google Geocoding API,
+and server-26#160 — place verification gets an anchor from the talkgroup's
+own name when nobody configured one.
+"""
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+import app.internal.intelligence as intel
+from app.config import settings
+from app.internal import place_verifier as pv
+
+ANCHOR = {"lat": 41.16, "lng": -73.86, "radius_km": 10.0}
+
+
+class _Counter:
+    def __init__(self, payload=None, exc=None):
+        self.calls = 0
+        self.payload = payload
+        self.exc = exc
+
+    def patch(self):
+        outer = self
+
+        class _Resp:
+            def raise_for_status(self):
+                if outer.exc:
+                    raise outer.exc
+
+            def json(self):
+                return outer.payload
+
+        class _Client:
+            async def __aenter__(self): return self
+            async def __aexit__(self, *a): return False
+
+            async def get(self, *a, **k):
+                outer.calls += 1
+                return _Resp()
+
+        return patch("httpx.AsyncClient", lambda *a, **k: _Client())
+
+
+def _ok(lat=41.161, lng=-73.861):
+    return {"status": "OK", "results": [{"geometry": {
+        "location": {"lat": lat, "lng": lng}, "location_type": "ROOFTOP"}}]}
+
+
+@pytest.fixture(autouse=True)
+def _key():
+    with patch.object(settings, "google_maps_api_key", "test-key"):
+        yield
+
+
+@pytest.mark.asyncio
+async def test_repeat_address_is_one_request():
+    c = _Counter(_ok())
+    with c.patch():
+        a = await intel._geocode_location("12 Main Street, Ossining", anchor=ANCHOR)
+        b = await intel._geocode_location("12 main street, ossining ", anchor=ANCHOR)
+    assert a == b == {"lat": 41.161, "lng": -73.861, "location_type": "ROOFTOP"}
+    assert c.calls == 1
+    assert intel.geocode_cache_stats == {"hits": 1, "misses": 1}
+
+
+@pytest.mark.asyncio
+async def test_cached_answer_is_still_judged_against_the_caller_anchor():
+    c = _Counter(_ok())
+    with c.patch():
+        assert await intel._geocode_location("12 Main Street", anchor=ANCHOR)
+        far = {"lat": 0.0, "lng": 0.0, "radius_km": 10.0}
+        # Different bounds -> different key, so a separate request — never a
+        # cached answer leaking past a different area's distance check.
+        assert await intel._geocode_location("12 Main Street", anchor=far) is None
+    assert c.calls == 2
+
+
+@pytest.mark.asyncio
+async def test_zero_results_is_cached_but_errors_are_not():
+    c = _Counter({"status": "ZERO_RESULTS", "results": []})
+    with c.patch():
+        await intel._geocode_location("Cool Parts, Illinois", anchor=ANCHOR)
+        await intel._geocode_location("Cool Parts, Illinois", anchor=ANCHOR)
+    assert c.calls == 1
+
+    denied = _Counter({"status": "REQUEST_DENIED"})
+    with denied.patch():
+        await intel._geocode_location("Snowden Avenue", anchor=ANCHOR)
+        await intel._geocode_location("Snowden Avenue", anchor=ANCHOR)
+    assert denied.calls == 2, "a key/quota failure is not an answer about the address"
+
+    boom = _Counter(_ok(), exc=RuntimeError("503"))
+    with boom.patch():
+        await intel._geocode_location("Croton Point", anchor=ANCHOR)
+        await intel._geocode_location("Croton Point", anchor=ANCHOR)
+    assert boom.calls == 2
+
+
+@pytest.mark.asyncio
+async def test_ttl_expiry_and_size_bound():
+    c = _Counter(_ok())
+    with c.patch(), patch.object(settings, "geocode_cache_ttl_seconds", 0):
+        await intel._geocode_location("12 Main Street", anchor=ANCHOR)
+        await intel._geocode_location("12 Main Street", anchor=ANCHOR)
+    assert c.calls == 2, "TTL 0 disables the cache"
+
+    c = _Counter(_ok())
+    with c.patch(), patch.object(settings, "geocode_cache_max_entries", 2):
+        for street in ("A Street", "B Street", "C Street"):
+            await intel._geocode_location(street, anchor=ANCHOR)
+    assert len(intel._geocode_cache) == 2
+
+
+# ── server-26#160 ───────────────────────────────────────────────────────────
+
+@pytest.mark.asyncio
+async def test_unconfigured_channel_gets_an_anchor_from_its_talkgroup_name():
+    resolved = {"center": {"lat": 40.71, "lng": -74.0}, "radius_km": 25.0}
+    seen = {}
+
+    async def _geo(query, anchor):
+        seen["query"], seen["anchor"] = query, anchor
+        return {"lat": 40.7, "lng": -74.0}
+
+    with patch.object(pv.settings, "place_verification_enabled", True), \
+         patch.object(intel.fstore, "doc_get_cached", AsyncMock(return_value={"lat": 41.2, "lon": -73.8})), \
+         patch.object(intel, "_get_node_state", AsyncMock(return_value="New York")), \
+         patch.object(pv.area_context, "resolve_anchor", AsyncMock(return_value=resolved)) as res, \
+         patch.object(pv, "_geocode_in_anchor", _geo):
+        await pv.verify("c1", "Respond to Lexington Avenue", None, ["Lexington Avenue"],
+                        {}, {}, talkgroup_name="New York City PD", node_id="node-1")
+    res.assert_awaited_once_with({"municipality": "New York City", "state": "New York"})
+    assert seen["anchor"] == {"lat": 40.71, "lng": -74.0, "radius_km": 25.0}
+    assert seen["query"] == "Lexington Avenue, New York City, New York"
+
+
+@pytest.mark.asyncio
+async def test_no_state_means_no_derived_anchor():
+    """'Springfield PD' alone could anchor anywhere — skip, never guess."""
+    with patch.object(pv.settings, "place_verification_enabled", True), \
+         patch.object(intel.fstore, "doc_get_cached", AsyncMock(return_value={"lat": 41.2, "lon": -73.8})), \
+         patch.object(intel, "_get_node_state", AsyncMock(return_value="")), \
+         patch.object(pv, "_geocode_in_anchor") as geo:
+        out = await pv.verify("c1", "Respond to Main Street", None, ["Main Street"],
+                              {}, {}, talkgroup_name="Springfield PD", node_id="node-1")
+    assert out == (None, None)
+    geo.assert_not_called()
+
+
+@pytest.mark.asyncio
+async def test_configured_place_without_anchor_still_skips():
+    """A place that is set but too wide (no anchor stored) keeps the
+    load-bearing skip; the talkgroup-name fallback is only for unset areas."""
+    with patch.object(pv.settings, "place_verification_enabled", True), \
+         patch.object(pv, "_talkgroup_anchor", AsyncMock()) as derived, \
+         patch.object(pv, "_geocode_in_anchor") as geo:
+        out = await pv.verify("c1", "Main Street", None, ["Main Street"],
+                              {"state": "Colorado"}, {}, talkgroup_name="Denver PD", node_id="n")
+    assert out == (None, None)
+    derived.assert_not_awaited()
+    geo.assert_not_called()

drb-c2-core/tests/test_geocode_location_type.py

@@ -0,0 +1,56 @@
+"""
+server-26#236: geocode precision must travel with the coordinates.
+
+`_geocode_location` already judged a result by Google's `location_type` but
+returned only {lat, lng}, so a GEOMETRIC_CENTER route centroid and a ROOFTOP
+address drew the same pin. The type is now part of the returned dict, which
+is stored as-is on the call doc and carried unchanged onto the incident pin by
+`incident_correlator._resolve_location_pair`.
+
+Display-only: every correlator read of location_coords indexes ["lat"] and
+["lng"] directly, so the extra key cannot change a correlation decision.
+"""
+from unittest.mock import patch
+
+import pytest
+
+import app.internal.intelligence as intel
+from app.config import settings
+from tests.test_geocode_named_region import _maps_result
+
+
+@pytest.fixture(autouse=True)
+def _api_key():
+    with patch.object(settings, "google_maps_api_key", "test-key"):
+        yield
+
+
+ANCHOR = {"lat": 41.16, "lng": -73.86, "radius_km": 10.0}
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("location_type", ["ROOFTOP", "RANGE_INTERPOLATED", "GEOMETRIC_CENTER"])
+async def test_accepted_location_type_is_returned_with_the_coords(location_type):
+    with _maps_result(41.161, -73.861, location_type=location_type):
+        coords = await intel._geocode_location("1 Main Street, Ossining", anchor=ANCHOR)
+    assert coords == {"lat": 41.161, "lng": -73.861, "location_type": location_type}
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("location_type", ["APPROXIMATE", "", "SOMETHING_NEW"])
+async def test_rejected_location_type_still_returns_none(location_type):
+    with _maps_result(41.161, -73.861, location_type=location_type):
+        coords = await intel._geocode_location("Ossining", anchor=ANCHOR)
+    assert coords is None
+
+
+def test_location_type_survives_onto_the_incident_pin():
+    """`_resolve_location_pair` stores the call's coords dict as-is, so the
+    precision reaches the incident without any correlator change."""
+    from app.internal.incident_correlator import _resolve_location_pair
+
+    pin = {"lat": 41.161, "lng": -73.861, "location_type": "GEOMETRIC_CENTER"}
+    fields = _resolve_location_pair({}, "Route 9 and Main Street", pin)
+    assert fields["location_coords"] == pin
+    assert fields["location_coords_source"] == "Route 9 and Main Street"
+

drb-c2-core/tests/test_geocode_named_region.py

@@ -69,7 +69,7 @@ async def test_named_region_geocode_accepted_beyond_node_distance():
             node_lat=NODE_LAT, node_lon=NODE_LON,
             trust_named_region=True,
         )
-    assert coords == {"lat": FAR_LAT, "lng": FAR_LNG}
+    assert coords == {"lat": FAR_LAT, "lng": FAR_LNG, "location_type": "ROOFTOP"}
 
 
 @pytest.mark.asyncio
@@ -110,7 +110,7 @@ async def test_named_region_geocode_within_node_distance_is_unaffected():
             node_lat=NODE_LAT, node_lon=NODE_LON,
             trust_named_region=True,
         )
-    assert coords == {"lat": near_lat, "lng": near_lng}
+    assert coords == {"lat": near_lat, "lng": near_lng, "location_type": "ROOFTOP"}
 
 
 @pytest.mark.asyncio

drb-c2-core/tests/test_intelligence_llm_bool.py

@@ -0,0 +1,14 @@
+"""server-26#88 — resolved/reassignment are parsed, not bool()-coerced."""
+import pytest
+
+from app.internal.incident_correlator import parse_llm_bool as _llm_bool
+
+
+@pytest.mark.parametrize("value,expected", [
+    (True, True), (False, False),
+    ("true", True), ("TRUE", True), (" Yes ", True), ("yes", True),
+    ("false", False), ("False", False), ("no", False), ("NO", False),
+    ("", False), ("maybe", False), (None, False), (1, False), (0, False), ([], False),
+])
+def test_llm_bool(value, expected):
+    assert _llm_bool(value) is expected

drb-c2-core/tests/test_llm_provider.py

@@ -0,0 +1,48 @@
+"""app/internal/llm.py: provider follows the model name (2026-11-08 consolidation)."""
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from app.config import settings
+from app.internal import llm
+
+
+def test_provider_follows_model_name():
+    assert llm.provider_for("gpt-4o-mini") == "openai"
+    assert llm.provider_for("gemini-3.6-flash") == "gemini"
+
+
+def test_available_checks_the_right_key():
+    with patch.object(settings, "openai_api_key", "k"), patch.object(settings, "gemini_api_key", None):
+        assert llm.available("gpt-4o-mini") and not llm.available("gemini-3.6-flash")
+
+
+def test_defaults_are_openai():
+    assert llm.provider_for(settings.corr_cheap_model) == "openai"
+    assert llm.provider_for(settings.transcript_correction_model) == "openai"
+
+
+def test_openai_path_parses_json_and_records_usage():
+    resp = SimpleNamespace(
+        choices=[SimpleNamespace(message=SimpleNamespace(content='{"action": "new"}'))],
+        usage=SimpleNamespace(prompt_tokens=120, completion_tokens=9),
+    )
+    calls = {}
+
+    class FakeClient:
+        def __init__(self):
+            self.chat = SimpleNamespace(completions=SimpleNamespace(create=self.create))
+
+        def create(self, **kw):
+            calls.update(kw)
+            return resp
+
+    sink = {}
+    tok = llm.collect_usage(sink)
+    try:
+        with patch("app.internal.ai_clients.openai_client", FakeClient):
+            out = llm.generate_json("gpt-4o-mini", "Return JSON", purpose="correlation")
+    finally:
+        llm.reset_usage(tok)
+    assert out == {"action": "new"}
+    assert calls["response_format"] == {"type": "json_object"}
+    assert sink["correlation:gpt-4o-mini"] == {"calls": 1, "in": 120, "out": 9, "thinking": 0}

drb-c2-core/tests/test_media_range.py

@@ -0,0 +1,220 @@
+"""
+HTTP Range on /media/calls/{id}/audio (server-26#233).
+
+The GCS reads are replaced by an in-memory object: ``audio_object_size`` and
+``download_audio_range`` are patched where routers/media.py looks them up, and
+every span read is recorded so the tests can assert the route never asks GCS
+for more than the requested range (plus at most one STREAM_CHUNK_BYTES span).
+"""
+import time
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from app.internal import storage
+from app.routers import media
+
+app = FastAPI()
+app.include_router(media.router)
+client = TestClient(app)
+
+CALL_ID = "call-abc"
+GCS_URI = "gs://bucket/calls/call-abc.flac"
+
+
+class FakeObject:
+    """A stored object plus a log of every (start, end) span read from it."""
+
+    def __init__(self, data: bytes):
+        self.data = data
+        self.reads: list[tuple[int, int]] = []
+        self.size_calls = 0
+
+    async def size(self, gcs_uri):
+        self.size_calls += 1
+        return len(self.data)
+
+    async def read(self, gcs_uri, start, end):
+        self.reads.append((start, end))
+        return self.data[start:end + 1]
+
+
+@pytest.fixture
+def signed(monkeypatch):
+    monkeypatch.setattr(storage.settings, "service_key", "test-key", raising=False)
+    exp = int(time.time()) + 600
+    return {"exp": exp, "sig": storage.sign_audio_link(CALL_ID, exp)}
+
+
+def _run(obj: FakeObject, params, headers=None, doc=None):
+    doc_get = AsyncMock(return_value=doc if doc is not None else {"call_id": CALL_ID, "audio_gcs_uri": GCS_URI})
+    with patch.object(media.fstore, "doc_get", doc_get), \
+            patch.object(media, "audio_object_size", obj.size), \
+            patch.object(media, "download_audio_range", obj.read):
+        resp = client.get(f"/media/calls/{CALL_ID}/audio", params=params, headers=headers or {})
+    return resp, doc_get
+
+
+def test_bounded_range_returns_206_with_exact_bytes(signed):
+    obj = FakeObject(bytes(range(256)) * 40)  # 10240 bytes
+    resp, _ = _run(obj, signed, {"Range": "bytes=100-199"})
+    assert resp.status_code == 206
+    assert resp.content == obj.data[100:200]
+    assert resp.headers["content-range"] == f"bytes 100-199/{len(obj.data)}"
+    assert resp.headers["content-length"] == "100"
+    assert resp.headers["accept-ranges"] == "bytes"
+    assert resp.headers["content-type"] == "audio/flac"
+    assert resp.headers["cache-control"] == "private, max-age=3600"
+    # Only the requested span was read from GCS — not the whole object.
+    assert obj.reads == [(100, 199)]
+
+
+def test_open_ended_range(signed):
+    obj = FakeObject(b"x" * 5000 + b"tail")
+    resp, _ = _run(obj, signed, {"Range": "bytes=5000-"})
+    assert resp.status_code == 206
+    assert resp.content == b"tail"
+    assert resp.headers["content-range"] == "bytes 5000-5003/5004"
+
+
+def test_suffix_range(signed):
+    obj = FakeObject(b"0123456789")
+    resp, _ = _run(obj, signed, {"Range": "bytes=-3"})
+    assert resp.status_code == 206
+    assert resp.content == b"789"
+    assert resp.headers["content-range"] == "bytes 7-9/10"
+
+
+def test_suffix_longer_than_object_returns_whole_object(signed):
+    obj = FakeObject(b"0123456789")
+    resp, _ = _run(obj, signed, {"Range": "bytes=-500"})
+    assert resp.status_code == 206
+    assert resp.content == obj.data
+    assert resp.headers["content-range"] == "bytes 0-9/10"
+
+
+def test_end_past_object_is_clamped(signed):
+    obj = FakeObject(b"0123456789")
+    resp, _ = _run(obj, signed, {"Range": "bytes=8-999"})
+    assert resp.status_code == 206
+    assert resp.content == b"89"
+    assert resp.headers["content-range"] == "bytes 8-9/10"
+
+
+@pytest.mark.parametrize("rng", ["bytes=10-", "bytes=50-60", "bytes=-0"])
+def test_unsatisfiable_range_is_416(signed, rng):
+    obj = FakeObject(b"0123456789")
+    resp, _ = _run(obj, signed, {"Range": rng})
+    assert resp.status_code == 416
+    assert resp.headers["content-range"] == "bytes */10"
+    assert obj.reads == []
+
+
+def test_no_range_is_200_full_body_and_advertises_ranges(signed):
+    obj = FakeObject(b"abcdef" * 100)
+    resp, _ = _run(obj, signed)
+    assert resp.status_code == 200
+    assert resp.content == obj.data
+    assert resp.headers["accept-ranges"] == "bytes"
+    assert resp.headers["content-length"] == str(len(obj.data))
+    assert "content-range" not in resp.headers
+
+
+@pytest.mark.parametrize("rng", ["bytes=0-1,4-5", "items=0-5", "bytes=5-2", "garbage"])
+def test_ignored_range_headers_fall_back_to_200(signed, rng):
+    obj = FakeObject(b"0123456789")
+    resp, _ = _run(obj, signed, {"Range": rng})
+    assert resp.status_code == 200
+    assert resp.content == obj.data
+
+
+def test_long_object_is_streamed_in_bounded_spans(signed):
+    # A ~13 MB "600 s FLAC": a seek near the end reads only from there on, in
+    # spans no larger than STREAM_CHUNK_BYTES, and the first span is all the
+    # route waits on before the response starts.
+    size = 13 * 1024 * 1024
+    obj = FakeObject(bytes(size))
+    start = size - 1_500_000
+    resp, _ = _run(obj, signed, {"Range": f"bytes={start}-"})
+    assert resp.status_code == 206
+    assert len(resp.content) == 1_500_000
+    assert obj.reads[0][0] == start
+    assert all(e - s + 1 <= media.STREAM_CHUNK_BYTES for s, e in obj.reads)
+    assert sum(e - s + 1 for s, e in obj.reads) == 1_500_000
+
+
+def test_bad_signature_is_403_before_any_lookup(signed):
+    obj = FakeObject(b"0123456789")
+    resp, doc_get = _run(obj, {"exp": signed["exp"], "sig": "0" * 64}, {"Range": "bytes=0-3"})
+    assert resp.status_code == 403
+    doc_get.assert_not_called()
+    assert obj.size_calls == 0
+    assert obj.reads == []
+
+
+def test_expired_link_is_403(signed, monkeypatch):
+    exp = int(time.time()) - 5
+    obj = FakeObject(b"0123456789")
+    resp, doc_get = _run(obj, {"exp": exp, "sig": storage.sign_audio_link(CALL_ID, exp)})
+    assert resp.status_code == 403
+    doc_get.assert_not_called()
+
+
+def test_missing_object_is_404(signed):
+    obj = FakeObject(b"")
+
+    async def no_size(gcs_uri):
+        return None
+
+    with patch.object(media.fstore, "doc_get", AsyncMock(return_value={"call_id": CALL_ID, "audio_gcs_uri": GCS_URI})), \
+            patch.object(media, "audio_object_size", no_size), \
+            patch.object(media, "download_audio_range", obj.read):
+        resp = client.get(f"/media/calls/{CALL_ID}/audio", params=signed)
+    assert resp.status_code == 404
+
+
+def test_legacy_mp3_keeps_its_content_type(signed):
+    obj = FakeObject(b"ID3" + b"\0" * 50)
+    resp, _ = _run(obj, signed, {"Range": "bytes=0-2"}, doc={"call_id": CALL_ID, "audio_gcs_uri": "gs://b/calls/x.mp3"})
+    assert resp.status_code == 206
+    assert resp.headers["content-type"] == "audio/mpeg"
+    assert resp.content == b"ID3"
+
+
+# ── storage.py: the ranged reads never pull the whole object ────────────────
+def _fake_client(monkeypatch, size=1234, payload=b"span"):
+    from unittest.mock import MagicMock
+    client = MagicMock()
+    blob = client.bucket.return_value.blob.return_value
+    blob.size = size
+    blob.download_as_bytes.return_value = payload
+    monkeypatch.setattr(storage, "_gcs_client_cache", client)
+    return client, blob
+
+
+def test_storage_size_reloads_metadata_only(monkeypatch):
+    import asyncio
+    client, blob = _fake_client(monkeypatch, size=13_000_000)
+    assert asyncio.run(storage.audio_object_size(GCS_URI)) == 13_000_000
+    client.bucket.assert_called_with("bucket")
+    client.bucket.return_value.blob.assert_called_with("calls/call-abc.flac")
+    blob.reload.assert_called_once()
+    blob.download_as_bytes.assert_not_called()
+
+
+def test_storage_range_read_passes_inclusive_bounds(monkeypatch):
+    import asyncio
+    _, blob = _fake_client(monkeypatch)
+    assert asyncio.run(storage.download_audio_range(GCS_URI, 100, 199)) == b"span"
+    blob.download_as_bytes.assert_called_once_with(start=100, end=199)
+
+
+def test_storage_range_read_failure_returns_none(monkeypatch):
+    import asyncio
+    _, blob = _fake_client(monkeypatch)
+    blob.download_as_bytes.side_effect = RuntimeError("gcs down")
+    assert asyncio.run(storage.download_audio_range(GCS_URI, 0, 10)) is None
+    blob.reload.side_effect = RuntimeError("404")
+    assert asyncio.run(storage.audio_object_size(GCS_URI)) is None

drb-c2-core/tests/test_mqtt_handler.py

@@ -118,6 +118,22 @@ async def test_checkin_updates_existing_configured_node(handler):
     assert "last_seen" in updates
 
 
+@pytest.mark.asyncio
+async def test_checkin_stores_disk_free_and_total(handler):
+    # node-26#41: a full disk stopped node-002 recording while it showed Online.
+    existing = {"node_id": "node-01", "status": "online", "configured": True}
+    with patch("app.internal.mqtt_handler.fstore") as mock_fstore:
+        mock_fstore.doc_get = AsyncMock(return_value=existing)
+        mock_fstore.doc_update = AsyncMock()
+        await handler._handle_checkin("node-01", {"disk_free_bytes": 5, "disk_total_bytes": 100})
+        updates = mock_fstore.doc_update.call_args[0][2]
+        assert updates["disk_free_bytes"] == 5 and updates["disk_total_bytes"] == 100
+
+        # An older node that doesn't report disk must not wipe the fields.
+        await handler._handle_checkin("node-01", {"name": "x"})
+        assert "disk_free_bytes" not in mock_fstore.doc_update.call_args[0][2]
+
+
 @pytest.mark.asyncio
 async def test_checkin_does_not_promote_unconfigured_to_online(handler):
     existing = {

drb-c2-core/tests/test_outage_providers.py

@@ -0,0 +1,329 @@
+"""Power-outage providers (server-26#184): registry, licence gate, admin routes, ODIN adapter.
+
+What is held here (mirrors tests/test_camera_providers.py):
+  * every provider defaults OFF, and an off provider is never fetched;
+  * stubs can never be enabled (409);
+  * a gated licence needs ``acknowledge_licence``, which is stored with who/when
+    and audited -- and an audit failure refuses the enable (fail closed);
+  * an acknowledgement given for a different licence status no longer counts;
+  * the admin routes are admin-only;
+  * the ODIN parser reads the recorded public payloads, and an all-unparseable
+    payload is an error, not an empty layer;
+  * an area no serving provider covers says so instead of returning a bare [].
+"""
+import asyncio
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from fastapi import HTTPException
+from fastapi.testclient import TestClient
+
+from app.internal.auth import require_admin_token, require_service_or_firebase_token
+from app.internal.outages import base, providers, registry
+from app.internal.outages.base import Licence
+from app.main import app
+
+client = TestClient(app)
+ADMIN = {"uid": "admin-1", "email": "admin@example.com", "role": "admin"}
+FIXTURE = json.loads((Path(__file__).parent / "fixtures" / "odin_public_2026-10-05.json").read_text())
+STUBS = ("poweroutage_us", "coned_oru_stormcenter", "nyseg_rge_stormcenter", "central_hudson_stormcenter", "eagle_i_live")
+NY_BBOX = (42.5, -78.5, 43.5, -75.5)   # Rochester .. Syracuse
+RECORDED_AT = datetime(2026, 10, 5, 6, 45, tzinfo=timezone.utc)   # when the fixture was captured
+
+
+class FakeStore:
+    def __init__(self):
+        self.docs = {}
+        self.audit = []
+
+    async def doc_get(self, col, doc):
+        return self.docs.get((col, doc))
+
+    async def doc_set(self, col, doc, data, merge=True):
+        cur = self.docs.setdefault((col, doc), {})
+        if col == "audit_log":
+            self.audit.append(data)
+            return
+        for k, v in data.items():   # one-level deep merge is all registry needs
+            if merge and isinstance(v, dict) and isinstance(cur.get(k), dict):
+                cur[k] = {**cur[k], **v}
+            else:
+                cur[k] = v
+
+
+@pytest.fixture(autouse=True)
+def store():
+    s = FakeStore()
+    registry.invalidate_cache()
+    for feed in registry.FEEDS.values():
+        feed.items, feed.fetched_at, feed.error, feed._next_attempt = [], None, None, 0.0
+    with patch.object(registry.fstore, "doc_get", s.doc_get), patch.object(registry.fstore, "doc_set", s.doc_set), \
+            patch("app.internal.audit.fstore.doc_set", s.doc_set):
+        yield s
+    registry.invalidate_cache()
+    app.dependency_overrides.clear()
+
+
+def run(coro):
+    return asyncio.run(coro)
+
+
+def _odin_areas():
+    return providers.parse_odin(FIXTURE["odi_format_json"], FIXTURE["odi_map_scale_county"], FIXTURE["odi_status"],
+                                now=RECORDED_AT)[0]
+
+
+# ── registry / gate ──────────────────────────────────────────────────────────
+
+def test_every_catalogued_source_is_registered_and_defaults_off():
+    listed = run(registry.list_providers())
+    assert {p["id"] for p in listed} == {"odin", *STUBS}
+    assert all(p["enabled"] is False and p["serving"] is False for p in listed)
+    assert all(p["licence"]["label"] for p in listed)
+    odin = next(p for p in listed if p["id"] == "odin")
+    assert odin["licence"]["status"] == "unverified" and odin["licence"]["gated"] is True
+    assert odin["licence"]["terms_url"] == "https://odin.ornl.gov/v3/api-docs"
+    assert odin["not_serving_reason"] == "disabled (default)"
+
+
+def test_catalogued_licence_statuses_match_the_source_terms():
+    lic = {pid: p.meta.licence.status for pid, p in registry.PROVIDERS.items()}
+    assert lic["poweroutage_us"] == Licence.PAID
+    for pid in ("coned_oru_stormcenter", "nyseg_rge_stormcenter", "central_hudson_stormcenter", "eagle_i_live"):
+        assert lic[pid] == Licence.AGREEMENT_REQUIRED, pid
+    assert all(not registry.PROVIDERS[pid].meta.implemented for pid in STUBS)
+
+
+def test_warning_is_worded_for_outage_data():
+    w = registry.PROVIDERS["odin"].meta.licence.warning()
+    assert "outage data" in w and "imagery" not in w
+
+
+def test_off_provider_is_never_fetched():
+    fetch = AsyncMock(return_value=[])
+    with patch.object(registry.PROVIDERS["odin"], "fetch", fetch):
+        out = run(registry.outages_in_bbox(NY_BBOX))
+    assert out["areas"] == [] and out["providers"] == [] and fetch.await_count == 0
+    assert out["serving_count"] == 0 and out["status"] == "none_enabled"
+
+
+def test_stubs_cannot_be_enabled():
+    for pid in STUBS:
+        with pytest.raises(registry.ProviderError) as e:
+            run(registry.set_enabled(pid, True, ("u", "e"), acknowledge_licence=True))
+        assert e.value.code == 409, pid
+
+
+def test_gated_licence_requires_acknowledgement(store):
+    with pytest.raises(registry.ProviderError) as e:
+        run(registry.set_enabled("odin", True, ("u1", "a@x")))
+    assert e.value.code == 409 and e.value.extra["requires_acknowledgement"] is True
+    assert "Licence unverified" in e.value.extra["warning"]
+    assert not store.audit and not run(registry.is_serving("odin"))
+
+    out = run(registry.set_enabled("odin", True, ("u1", "a@x"), acknowledge_licence=True))
+    assert out["serving"] is True
+    ack = out["acknowledgement"]
+    assert ack["by_uid"] == "u1" and ack["by_email"] == "a@x" and ack["at"]
+    assert ack["licence_status"] == Licence.UNVERIFIED.value
+    assert store.audit[-1]["action"] == "outage_provider.enable_acknowledged"
+    assert store.audit[-1]["details"]["provider_id"] == "odin"
+    assert store.docs[("config", "outage_providers")]["providers"]["odin"]["enabled"] is True
+
+
+def test_gated_enable_refused_when_audit_cannot_be_written(store):
+    with patch.object(registry, "_audit", AsyncMock(side_effect=RuntimeError("firestore down"))):
+        with pytest.raises(registry.ProviderError) as e:
+            run(registry.set_enabled("odin", True, ("u", "e"), acknowledge_licence=True))
+    assert e.value.code == 503
+    assert not run(registry.is_serving("odin"))
+    assert ("config", "outage_providers") not in store.docs
+
+
+def test_disable_clears_acknowledgement_and_is_audited(store):
+    run(registry.set_enabled("odin", True, ("u", "e"), acknowledge_licence=True))
+    out = run(registry.set_enabled("odin", False, ("u", "e")))
+    assert out["serving"] is False and out["acknowledgement"] is None
+    assert store.audit[-1]["action"] == "outage_provider.disable"
+
+
+def test_stale_acknowledgement_stops_serving():
+    p = registry.PROVIDERS["odin"]
+    entry = {"enabled": True, "acknowledgement": {"licence_status": "paid"}}
+    assert registry.effective(p, entry) == (False, "licence acknowledgement missing or out of date")
+    entry["acknowledgement"]["licence_status"] = p.meta.licence.status.value
+    assert registry.effective(p, entry) == (True, None)
+
+
+def test_unreadable_settings_fail_closed():
+    with patch.object(registry.fstore, "doc_get", AsyncMock(side_effect=RuntimeError("boom"))):
+        registry.invalidate_cache()
+        assert run(registry.get_settings()) == {}
+        assert not run(registry.is_serving("odin"))
+
+
+# ── bbox query ───────────────────────────────────────────────────────────────
+
+def test_query_returns_areas_in_bbox_with_credit(store):
+    run(registry.set_enabled("odin", True, ("u", "e"), acknowledge_licence=True))
+    with patch.object(registry.PROVIDERS["odin"], "fetch", AsyncMock(return_value=_odin_areas())):
+        out = run(registry.outages_in_bbox(NY_BBOX))
+    assert out["status"] == "ok" and out["serving_count"] == 1
+    assert {a["fips"] for a in out["areas"]} == {"36055", "36067"}   # not Albany, not King County WA
+    prov = out["providers"][0]
+    assert prov["attribution"].startswith("Outage data: ODIN") and prov["disclaimer"]
+    assert prov["total_in_bbox"] == 2 and prov["fetched_at"] and prov["error"] is None
+    assert "Only utilities that report to ODIN appear" in prov["coverage_note"]
+
+
+def test_area_no_serving_provider_covers_says_so(store):
+    run(registry.set_enabled("odin", True, ("u", "e"), acknowledge_licence=True))
+    fetch = AsyncMock(return_value=_odin_areas())
+    with patch.object(registry.PROVIDERS["odin"], "fetch", fetch):
+        out = run(registry.outages_in_bbox((51.4, -0.2, 51.6, 0.1)))   # London
+    assert fetch.await_count == 0   # outside ODIN coverage -> never fetched
+    assert out["areas"] == [] and out["status"] == "no_source"
+    assert out["message"] == "No licensed outage source covers this area."
+
+
+def test_dead_feed_is_an_error_not_an_empty_layer(store):
+    run(registry.set_enabled("odin", True, ("u", "e"), acknowledge_licence=True))
+    with patch.object(registry.PROVIDERS["odin"], "fetch", AsyncMock(side_effect=ValueError("schema change?"))):
+        out = run(registry.outages_in_bbox(NY_BBOX))
+    assert out["status"] == "error" and "schema change" in out["providers"][0]["error"]
+
+
+def test_failed_refresh_keeps_last_good_feed():
+    feed = registry.FEEDS["odin"]
+    with patch.object(feed.provider, "fetch", AsyncMock(return_value=_odin_areas())):
+        run(feed.get())
+    feed._next_attempt = 0.0
+    with patch.object(feed.provider, "fetch", AsyncMock(side_effect=RuntimeError("down"))):
+        run(feed.get())
+    assert len(feed.items) == 4 and "down" in feed.error and feed.fetched_at
+
+
+# ── admin routes ─────────────────────────────────────────────────────────────
+
+def test_admin_routes_require_admin():
+    def deny():
+        raise HTTPException(403, "Admin access required")
+    app.dependency_overrides[require_admin_token] = deny
+    assert client.get("/admin/outage-providers").status_code == 403
+    assert client.put("/admin/outage-providers/odin", json={"enabled": True, "acknowledge_licence": True}).status_code == 403
+
+
+def test_admin_route_toggle_and_gate(store):
+    app.dependency_overrides[require_admin_token] = lambda: ADMIN
+    r = client.put("/admin/outage-providers/odin", json={"enabled": True})
+    assert r.status_code == 409 and r.json()["requires_acknowledgement"] is True
+    assert r.json()["licence"]["status"] == "unverified"
+    r = client.put("/admin/outage-providers/odin", json={"enabled": True, "acknowledge_licence": True})
+    assert r.status_code == 200 and r.json()["acknowledgement"]["by_email"] == "admin@example.com"
+    assert client.put("/admin/outage-providers/poweroutage_us",
+                      json={"enabled": True, "acknowledge_licence": True}).status_code == 409
+    assert client.put("/admin/outage-providers/nope", json={"enabled": True}).status_code == 404
+    listed = client.get("/admin/outage-providers").json()["providers"]
+    assert next(p for p in listed if p["id"] == "odin")["serving"] is True
+
+
+def test_outages_route_rejects_inverted_bbox_and_reports_status():
+    app.dependency_overrides[require_service_or_firebase_token] = lambda: {"uid": "v"}
+    assert client.get("/outages", params={"south": 2, "west": 0, "north": 1, "east": 1}).status_code == 400
+    r = client.get("/outages", params={"south": 40.9, "west": -74.0, "north": 41.4, "east": -73.4})
+    assert r.status_code == 200 and r.json()["areas"] == [] and r.json()["status"] == "none_enabled"
+
+
+def test_outages_route_requires_sign_in():
+    def deny():
+        raise HTTPException(401, "Not signed in")
+    app.dependency_overrides[require_service_or_firebase_token] = deny
+    assert client.get("/outages", params={"south": 40, "west": -74, "north": 41, "east": -73}).status_code == 401
+
+
+# ── ODIN adapter (recorded public payloads, 2026-10-05) ──────────────────────
+
+def test_odin_parser_reads_recorded_payload():
+    areas, info = providers.parse_odin(FIXTURE["odi_format_json"], FIXTURE["odi_map_scale_county"], FIXTURE["odi_status"],
+                                       now=RECORDED_AT)
+    by = {a["fips"]: a for a in areas}
+    assert set(by) == {"36001", "36067", "36055", "53033"}
+    onondaga = by["36067"]
+    assert onondaga["id"] == "odin:36067" and onondaga["provider"] == "odin"
+    assert onondaga["county"] == "Onondaga" and onondaga["state"] == "New York"
+    assert onondaga["customers_out"] == 11 and onondaga["customers_served"] is None
+    assert onondaga["etr"] == "2026-10-05T08:00:00Z" and onondaga["since"] == "2026-10-04T18:35:40Z"
+    assert onondaga["updated_at"].startswith("2026-10-05T06:20:47")
+    assert onondaga["utilities"] == [{"name": "NATIONAL GRID", "eia_id": "13573", "customers_out": 11,
+                                      "stale_customers_out": 0}]
+    assert onondaga["stale"] is False and onondaga["stale_customers_out"] == 0
+    s, w, n, e = onondaga["bbox"]
+    assert s < onondaga["lat"] < n and w < onondaga["lon"] < e
+    assert 42.7 < onondaga["lat"] < 43.3 and -76.6 < onondaga["lon"] < -75.8
+    # King County WA: several outage events from two utilities, summed per county
+    king = by["53033"]
+    assert king["customers_out"] == sum(r["metersOut"] for r in FIXTURE["odi_map_scale_county"] if r["id"] == "53033")
+    assert len(king["utilities"]) == 2
+    # Puget Sound Energy's "0001-01-01T00:00:00Z" means no ETR -- not a restoration time, not stale.
+    assert king["etr"] is None and king["stale_customers_out"] == 0
+    assert info["reporting_utilities"] == len(FIXTURE["odi_status"]) and info["utilities_with_error"] == 1
+
+
+def test_odin_events_long_past_their_etr_are_stale_not_live():
+    # ODIN still listed Avangrid's Monroe County row from April 2026 (ETR
+    # 2026-04-10) on 2026-10-05. It must not read as 18 customers out right now.
+    by = {a["fips"]: a for a in _odin_areas()}
+    monroe = by["36055"]
+    assert monroe["customers_out"] == 0 and monroe["stale_customers_out"] == 18 and monroe["stale"] is True
+    assert monroe["since"].startswith("2026-04-10")   # still shown, so the stale row is explainable
+    # Same payload, captured the day the outage was live: not stale.
+    live = {a["fips"]: a for a in providers.parse_odin(
+        FIXTURE["odi_format_json"], FIXTURE["odi_map_scale_county"], FIXTURE["odi_status"],
+        now=datetime(2026, 4, 10, 20, 0, tzinfo=timezone.utc))[0]}
+    assert live["36055"]["customers_out"] == 18 and live["36055"]["stale"] is False
+    # Live counties sort ahead of stale ones.
+    assert [a["stale"] for a in _odin_areas()] == sorted(a["stale"] for a in _odin_areas())
+
+
+def test_odin_fetch_uses_the_three_public_endpoints():
+    calls = []
+
+    async def fake_get_json(url, params=None, headers=None):
+        calls.append((url, params))
+        return {"https://odin.ornl.gov/odi": FIXTURE["odi_format_json"],
+                "https://odin.ornl.gov/odi/map": FIXTURE["odi_map_scale_county"],
+                "https://odin.ornl.gov/odi/status": FIXTURE["odi_status"]}[url]
+
+    p = providers.OdinProvider()
+    with patch.object(providers, "get_json", fake_get_json):
+        areas = run(p.fetch())
+    assert len(areas) == 4
+    assert ("https://odin.ornl.gov/odi", {"format": "JSON"}) in calls
+    assert ("https://odin.ornl.gov/odi/map", {"scale": "COUNTY"}) in calls
+    assert p.reporting_utilities == len(FIXTURE["odi_status"])
+    assert "utilities reporting nationwide" in p.coverage_note()
+
+
+def test_odin_schema_canary_trips_on_unparseable_payload():
+    odi, cmap, status = FIXTURE["odi_format_json"], FIXTURE["odi_map_scale_county"], FIXTURE["odi_status"]
+    renamed_odi = {"outage": [{"county": "36067", "count": 11}]}   # fields renamed upstream
+    with pytest.raises(ValueError, match="schema"):
+        providers.parse_odin(renamed_odi, cmap, status)
+    with pytest.raises(ValueError, match="schema"):
+        providers.parse_odin(odi, [{"fips": "36067"}], status)
+    with pytest.raises(ValueError, match="schema"):
+        providers.parse_odin(odi, cmap, [{"utility": "x"}])
+    with pytest.raises(ValueError, match="schema"):
+        providers.parse_odin([], cmap, status)                   # wrapper changed
+    # A genuinely quiet day is NOT an error: nothing upstream, nothing parsed.
+    assert providers.parse_odin({"outage": []}, [], status)[0] == []
+
+
+def test_area_in_bbox_uses_county_extent():
+    a = base.make_area("odin", "36067", county="Onondaga", state="New York", customers_out=1,
+                       lat=43.0, lon=-76.2, bbox=(42.77, -76.5, 43.27, -75.9))
+    assert base.area_in_bbox(a, (43.2, -76.0, 43.5, -75.5))     # overlaps the county's corner only
+    assert not base.area_in_bbox(a, (44.0, -76.0, 44.5, -75.5))

drb-c2-core/tests/test_stt_provider.py

@@ -0,0 +1,279 @@
+"""
+server-26#297 — config-driven STT provider with OpenAI as the fallback.
+
+The default must stay OpenAI until a Groq key exists (so prod does not break
+before the key is provisioned), a failing primary must fall back to whisper-1
+without losing the call, and the vocabulary prompt must never carry a
+ten-code series (the hallucination documented in transcription.py).
+"""
+from unittest.mock import AsyncMock, patch
+
+import pytest
+
+from app.internal import transcription as tr
+from app.config import settings
+
+
+def _settings(**over):
+    base = dict(stt_provider="auto", groq_api_key=None, openai_api_key="sk-openai",
+                stt_api_key=None, stt_base_url=None, stt_fallback_to_openai=True,
+                stt_model="whisper-1", stt_compat_model="whisper-large-v3-turbo")
+    base.update(over)
+    return [patch.object(settings, k, v) for k, v in base.items()]
+
+
+class _patched:
+    def __init__(self, **over):
+        self.ps = _settings(**over)
+
+    def __enter__(self):
+        for p in self.ps:
+            p.start()
+
+    def __exit__(self, *a):
+        for p in self.ps:
+            p.stop()
+
+
+# ── provider resolution ─────────────────────────────────────────────────────
+
+def test_default_without_groq_key_is_openai_only():
+    with _patched():
+        targets = tr.stt_targets()
+    assert [(t.provider, t.model, t.tier) for t in targets] == [("openai", "whisper-1", "transcription")]
+    assert targets[0].vocab_prompt is False, "the OpenAI path keeps today's fixed prompt"
+
+
+def test_groq_key_makes_groq_primary_with_openai_fallback():
+    with _patched(groq_api_key="gsk"):
+        targets = tr.stt_targets()
+    assert [(t.provider, t.model) for t in targets] == [
+        ("groq", "whisper-large-v3-turbo"), ("openai", "whisper-1")]
+    assert targets[0].base_url == "https://api.groq.com/openai/v1"
+    assert targets[0].api_key == "gsk"
+    assert targets[1].tier == "transcription_fallback"
+
+
+def test_fallback_can_be_switched_off():
+    with _patched(groq_api_key="gsk", stt_fallback_to_openai=False):
+        assert [t.provider for t in tr.stt_targets()] == ["groq"]
+
+
+def test_no_openai_key_means_no_fallback():
+    with _patched(groq_api_key="gsk", openai_api_key=None):
+        assert [t.provider for t in tr.stt_targets()] == ["groq"]
+
+
+def test_compat_server_from_base_url():
+    with _patched(stt_base_url="http://whisper.local/v1", stt_compat_model="large-v3"):
+        targets = tr.stt_targets()
+    assert targets[0].provider == "compat" and targets[0].base_url == "http://whisper.local/v1"
+    assert targets[0].model == "large-v3"
+
+
+def test_explicit_groq_without_key_degrades_to_openai():
+    with _patched(stt_provider="groq"):
+        assert [t.provider for t in tr.stt_targets()] == ["openai"]
+
+
+def test_nothing_configured_is_empty():
+    with _patched(openai_api_key=None):
+        assert tr.stt_targets() == []
+
+
+# ── fallback in transcribe_call ─────────────────────────────────────────────
+
+def _ok(text="Engine 5 responding to a structure fire on Main Street"):
+    return {"text": text, "segments": [{"start": 0.0, "end": 3.0, "text": text}],
+            "degenerate": False, "duration": 3.0, "confidence": 0.81}
+
+
+async def _transcribe(sync_impl, **over):
+    saved: dict = {}
+
+    async def _doc_set(coll, doc_id, data, merge=True):
+        saved.update(data)
+
+    flags = {"transcript_correction_enabled": False}
+    with _patched(**over), \
+         patch.object(tr, "_download", lambda uri: "/nonexistent.flac"), \
+         patch.object(tr, "_sync_transcribe_file", sync_impl), \
+         patch.object(tr.transcript_correction, "resolve_context", AsyncMock(return_value={})), \
+         patch.object(tr.fstore, "doc_set", _doc_set), \
+         patch.object(tr, "ai_health") as health, \
+         patch("app.internal.feature_flags.resolve_flags",
+               AsyncMock(return_value=(flags, lambda k: flags.get(k, True)))):
+        health.report_healthy = AsyncMock()
+        health.report_degraded = AsyncMock()
+        health.classify = lambda text: "transient"
+        result = await tr.transcribe_call("call-1", "gs://b/call-1.flac", "PD Dispatch", system_id="sys-1")
+    return result, saved, health
+
+
+@pytest.mark.asyncio
+async def test_primary_failure_falls_back_to_openai():
+    seen = []
+
+    def sync(path, target, prompt, glossary=None):
+        seen.append(target.provider)
+        if target.provider == "groq":
+            raise RuntimeError("503 Service Unavailable")
+        return _ok()
+
+    (text, segments), saved, health = await _transcribe(sync, groq_api_key="gsk")
+    assert seen == ["groq", "openai"]
+    assert text.startswith("Engine 5")
+    assert saved["stt_provider"] == "openai" and saved["stt_model"] == "whisper-1"
+    # The primary stays red; only the fallback tier is marked healthy.
+    assert health.report_degraded.await_args.args[:3] == ("transcription", "groq", "whisper-large-v3-turbo")
+    health.report_healthy.assert_awaited_once_with("transcription_fallback")
+
+
+@pytest.mark.asyncio
+async def test_primary_success_records_provider_and_cost_inputs():
+    (text, _), saved, health = await _transcribe(lambda *a, **k: _ok(), groq_api_key="gsk")
+    assert saved["stt_provider"] == "groq"
+    assert saved["stt_model"] == "whisper-large-v3-turbo"
+    assert saved["stt_audio_seconds"] == 3.0
+    assert saved["stt_confidence"] == 0.81
+    health.report_healthy.assert_awaited_once_with("transcription")
+
+
+@pytest.mark.asyncio
+async def test_every_target_failing_returns_nothing():
+    def sync(*a, **k):
+        raise RuntimeError("boom")
+
+    (text, segments), saved, health = await _transcribe(sync, groq_api_key="gsk")
+    assert (text, segments) == (None, [])
+    assert health.report_degraded.await_count == 2
+    health.report_healthy.assert_not_awaited()
+
+
+@pytest.mark.asyncio
+async def test_default_config_never_calls_groq():
+    seen = []
+
+    def sync(path, target, prompt, glossary=None):
+        seen.append((target.provider, target.base_url))
+        return _ok()
+
+    await _transcribe(sync)
+    assert seen == [("openai", None)]
+
+
+# ── prompt ──────────────────────────────────────────────────────────────────
+
+CONTEXT = {
+    "area": {"municipality": "Ossining", "county": "Westchester", "state": "New York",
+             "local_knowledge": [{"term": "Snowden Avenue"}, {"term": "Sing Sing", "meaning": "prison"}]},
+    "vocabulary": ["10-13", "5-David", "Croton Point", "Snowden Avenue"],
+    "ten_codes": {"10-4": "ack", "10-13": "officer needs assistance"},
+}
+
+
+def test_no_context_is_the_legacy_prompt():
+    prompt, glossary = tr.build_stt_prompt("PD Dispatch", None)
+    assert prompt == "Talkgroup: PD Dispatch. " + tr._WHISPER_PROMPT
+    assert glossary == []
+
+
+def test_vocabulary_prompt_carries_places_but_never_ten_codes():
+    prompt, glossary = tr.build_stt_prompt("PD Dispatch", CONTEXT)
+    assert "Ossining, Westchester, New York" in prompt
+    assert glossary == ["Snowden Avenue", "Sing Sing", "5-David", "Croton Point"]
+    assert "10-13" not in prompt, "a code-shaped vocabulary term must stay out"
+    assert "officer needs assistance" not in prompt
+    assert prompt.endswith(tr._WHISPER_PROMPT)
+
+
+def test_prompt_stays_inside_the_token_budget():
+    big = {"area": {}, "vocabulary": [f"Placename{i} Boulevard" for i in range(200)]}
+    with patch.object(settings, "stt_prompt_max_tokens", 200):
+        prompt, glossary = tr.build_stt_prompt("PD Dispatch", big)
+    assert tr._estimate_tokens(prompt) <= 200
+    assert 0 < len(glossary) < 200
+
+
+def test_token_estimate_is_conservative_for_radio_text():
+    # GPT-2 tokenises this at ~25 tokens; the estimate must not be lower.
+    assert tr._estimate_tokens("Engine 5 responding to a structure fire on Main Street, 10-4.") >= 20
+
+
+# ── degenerate output the vocabulary prompt could add ───────────────────────
+
+def test_prompt_echo_is_discarded():
+    glossary = ["Snowden Avenue", "Sing Sing", "Croton Point", "Main Street"]
+    assert tr._is_degenerate("Snowden Avenue, Sing Sing, Croton Point, Main Street.", [], glossary)
+    assert tr._is_degenerate("Local names: Snowden Avenue, Sing Sing.", [], glossary)
+
+
+def test_one_real_street_in_a_sentence_is_not_an_echo():
+    glossary = ["Snowden Avenue", "Sing Sing", "Croton Point"]
+    real = "Car 4 respond to Snowden Avenue for a report of a disabled vehicle."
+    assert not tr._is_degenerate(real, [], glossary)
+
+
+def test_compression_ratio_catches_an_alternating_loop():
+    loop = "Dispatch, copy. Unit 4, go ahead. " * 12
+    assert not tr._phrase_loop(loop), "the old checks miss this shape"
+    assert tr._is_degenerate(loop, [])
+
+
+def test_real_long_traffic_passes_the_compression_check():
+    real = (
+        "Headquarters to 5 David, respond to 12 Snowden Avenue for a report of a "
+        "two-car accident with injuries, caller states one vehicle is overturned. "
+        "5 David copies, en route from Route 9. Be advised EMS has been notified "
+        "and Ossining Fire is responding as well. 5 David on scene, two vehicles, "
+        "one patient complaining of neck pain, requesting a tow for one."
+    )
+    assert len(real) >= tr._MIN_CHARS_FOR_COMPRESSION
+    assert not tr._is_degenerate(real, [])
+
+
+def test_sweep_hold_back_counts_the_fallback_attempt():
+    from app.internal import recorrelation_sweep
+    with _patched():
+        single = recorrelation_sweep.pipeline_worst_case_seconds()
+    with _patched(groq_api_key="gsk"):
+        double = recorrelation_sweep.pipeline_worst_case_seconds()
+    stt_one = (2 if settings.stt_retry_on_degenerate else 1) * (1 + settings.openai_max_retries) \
+        * settings.stt_timeout_seconds
+    assert double - single == stt_one
+    assert double / 60 < settings.recorrelation_scan_minutes, "the sweep must still be able to recover the call"
+
+
+def test_location_readback_is_not_an_echo():
+    """Review of #297: intersection/address readbacks are where pins come from."""
+    glossary = ["Route 9", "Croton Avenue", "North Highland Place", "Main Street", "Ossining"]
+    for real in ("Route 9 and Croton Avenue, North Highland Place.",
+                 "Main Street, Croton Avenue, Route 9, Ossining."):
+        assert not tr._is_degenerate(real, [], glossary), real
+
+
+def test_long_busy_call_is_judged_per_window():
+    seg_text = "Engine 5 responding, Ladder 2 responding, Medic 1 en route to Main Street. "
+    segments = [{"start": float(i * 5), "end": float(i * 5 + 4), "text": seg_text} for i in range(60)]
+    text = " ".join(s["text"] for s in segments)
+    # One repeated real update for 5 minutes still loops within every window,
+    # so this is degenerate — but a varied call with one looping window out of three is not.
+    assert tr._is_degenerate(text, segments)
+    real = [
+        "Headquarters to 5 David, respond to 12 Snowden Avenue for a two-car accident.",
+        "5 David copies, en route from Route 9, ETA four minutes.",
+        "Be advised EMS has been notified and Ossining Fire is responding as well.",
+        "5 David on scene, two vehicles, one patient complaining of neck pain.",
+        "Requesting a tow for the blue sedan, it is blocking the northbound lane.",
+        "Copy, tow is being contacted, any further units needed at this time?",
+        "Negative, traffic is backing up toward Croton Point, send one for control.",
+        "6 Henry, can you clear the larceny and assist 5 David on Snowden?",
+        "6 Henry clearing, show me en route, coming down from North Highland.",
+        "Medic 1 on location, patient is being packaged for transport to Phelps.",
+        "Fire is standing by for fluids, no entrapment, both drivers out of the cars.",
+        "Received, all units be advised the roadway is now closed southbound.",
+    ]
+    loop = "Dispatch, copy. Unit 4, go ahead. " * 12
+    varied = [{"start": float(i * 5), "end": float(i * 5 + 4), "text": t} for i, t in enumerate(real)]
+    varied.append({"start": 70.0, "end": 98.0, "text": loop})  # its own window
+    assert not tr._is_degenerate(" ".join(s["text"] for s in varied), varied)

drb-c2-core/tests/test_transcript_correction.py

@@ -57,7 +57,7 @@ def _api_key():
     The dev venv has no GEMINI_API_KEY, and correct() returns early without one
     — which would make every assertion below pass for the wrong reason.
     """
-    with patch.object(tc.settings, "gemini_api_key", "test-key"):
+    with patch.object(tc.settings, "openai_api_key", "test-key"):
         yield
 
 
@@ -260,7 +260,10 @@ async def test_segment_code_change_discards_segments_only():
         "segments": ["Headquarters, 10-13.", "Show it out to Ossining.", "360 north, back to Route 9."],
     }
     with _system(), _gemini(payload):
-        text, segs, _ = await tc.correct("c1", "x y z w", SEGS, system_id="sys-1", talkgroup_id=9048)
+        # A realistic joined original (code-free, like the correction): a
+        # placeholder like "x y z w" now trips the server-26#162 growth guard.
+        text, segs, _ = await tc.correct("c1", "Shout out to Optum, back to Rose.", SEGS,
+                                         system_id="sys-1", talkgroup_id=9048)
     assert segs is None
     assert text == "Show it out to Ossining, back to Route 9."
 
@@ -279,3 +282,30 @@ async def test_reference_data_reaches_the_prompt():
     assert "Sing Sing — state prison" in p, "a term without its meaning is half the information"
     assert "Ossining, Westchester, New York" in p, "state must reach the prompt (server-26#36)"
     assert "10-13=officer needs assistance" in p
+
+
+# ── server-26#162, the rest: bare numbers and invented words ────────────────
+
+@pytest.mark.asyncio
+async def test_a_bare_number_turned_into_a_word_is_rejected():
+    """The live case: a bare "7" came back as "ShotSpotter"."""
+    payload = {"corrected": "Car ShotSpotter on Home Street and Forest Ave."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct("c1", "Car 7 on Holmes Street and 4th and Rowe.", None, system_id="sys-1")
+    assert text is None
+
+
+@pytest.mark.asyncio
+async def test_a_place_fix_that_keeps_its_numbers_still_passes():
+    payload = {"corrected": "Car 7 on Home Street and Forest Ave."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct("c1", "Car 7 on Holmes Street and 4th and Rowe.", None, system_id="sys-1")
+    assert text == "Car 7 on Home Street and Forest Ave."
+
+
+@pytest.mark.asyncio
+async def test_a_correction_that_writes_new_sentences_is_rejected():
+    payload = {"corrected": "Car 7 on Main Street. Suspect is armed and fled northbound in a red sedan."}
+    with _system(), _gemini(payload):
+        text, _, _ = await tc.correct("c1", "Car 7 on Mane Street.", None, system_id="sys-1")
+    assert text is None

drb-c2-core/tests/test_upload_short_transcript_correlation.py

@@ -29,7 +29,7 @@ async def _run_ingest(skip_reason):
          patch("app.internal.firestore.doc_get_cached",
                AsyncMock(return_value={"system_id": "sys-1", "ai_flags": {}})), \
          patch.object(upload, "fstore") as fs, \
-         patch.object(upload, "_correlate_with_consensus", AsyncMock(return_value=None)) as corr, \
+         patch.object(upload, "_correlate", AsyncMock(return_value=(None, {}))) as corr, \
          patch("app.internal.transcription.transcribe_call",
                AsyncMock(return_value=("10-8", []))), \
          patch("app.internal.intelligence.extract_scenes", AsyncMock(return_value=[])), \

drb-c2-core/tests/test_weather.py

@@ -0,0 +1,239 @@
+"""
+server-26#237 — weather backend: NWS active alerts + nearest-METAR wind.
+
+Pins the failure shapes that would otherwise look like "no weather right now":
+an upstream error keeps last-good data AND reports the error, a schema change is
+an error (not an empty layer), and zone-based alerts (geometry null) are never
+dropped. Also pins the NWS contract: User-Agent sent, one upstream call per TTL.
+"""
+import asyncio
+from unittest.mock import patch
+
+from fastapi.testclient import TestClient
+
+from app.main import app
+from app.internal import weather
+from app.internal.auth import require_service_or_firebase_token
+
+client = TestClient(app)
+
+SQUARE = {"type": "Polygon", "coordinates": [[[-74.0, 41.0], [-73.5, 41.0], [-73.5, 41.5], [-74.0, 41.5], [-74.0, 41.0]]]}
+ZONE_POLY = {"type": "Polygon", "coordinates": [[[-75.0, 42.0], [-74.5, 42.0], [-74.5, 42.5], [-75.0, 42.0]]]}
+ZONE_A = "https://api.weather.gov/zones/forecast/NYZ067"
+ZONE_B = "https://api.weather.gov/zones/forecast/NYZ999"
+
+
+def _alert(aid, event, geometry=None, zones=()):
+    return {"id": f"https://api.weather.gov/alerts/{aid}", "type": "Feature", "geometry": geometry,
+            "properties": {"id": aid, "event": event, "severity": "Severe", "urgency": "Immediate",
+                           "headline": f"{event} issued by NWS Upton NY", "onset": "2026-10-05T10:00:00-04:00",
+                           "expires": "2026-10-05T12:00:00-04:00", "ends": None, "senderName": "NWS Upton NY",
+                           "areaDesc": "Westchester", "affectedZones": list(zones)}}
+
+
+class Resp:
+    def __init__(self, body=None, status=200):
+        self._body, self.status_code = body, status
+        self.content = b"" if body is None else b"{}"
+
+    def raise_for_status(self):
+        if self.status_code >= 400:
+            raise RuntimeError(f"HTTP {self.status_code}")
+
+    def json(self):
+        return self._body
+
+
+class FakeHttp:
+    """Routes GETs by URL; records every call (url, params, headers)."""
+    def __init__(self, routes):
+        self.routes, self.calls = routes, []
+
+    def __call__(self, **kw):
+        return self
+
+    async def __aenter__(self):
+        return self
+
+    async def __aexit__(self, *a):
+        pass
+
+    async def get(self, url, params=None, headers=None):
+        self.calls.append((url, params, headers))
+        r = self.routes.get(url)
+        if r is None:
+            return Resp(status=404)
+        return r() if callable(r) else r
+
+
+def setup_function():
+    app.dependency_overrides[require_service_or_firebase_token] = lambda: {"admin": True}
+    weather.alerts = weather._AlertsFeed()
+    weather.zones.clear()
+    weather._wind_cells.clear()
+
+
+def teardown_function():
+    app.dependency_overrides.pop(require_service_or_firebase_token, None)
+
+
+def _nws(features, extra=None):
+    routes = {weather.NWS_ALERTS_URL: Resp({"type": "FeatureCollection", "features": features})}
+    routes.update(extra or {})
+    return FakeHttp(routes)
+
+
+def test_happy_path_normalises_and_sends_user_agent():
+    http = _nws([_alert("a1", "Severe Thunderstorm Warning", SQUARE)])
+    with patch.object(weather.httpx, "AsyncClient", http), \
+         patch.object(weather.settings, "nws_user_agent", "DRB (ops@example.com)"), \
+         patch.object(weather.settings, "nws_area", "ny, ct"):
+        feed = asyncio.run(weather.alerts.get())
+    url, params, headers = http.calls[0]
+    assert params == {"area": "NY,CT"}
+    assert headers["User-Agent"] == "DRB (ops@example.com)" and headers["Accept"] == "application/geo+json"
+    a = feed.alerts[0]
+    assert {k: a[k] for k in ("id", "event", "severity", "urgency", "sender_name", "expires")} == {
+        "id": "a1", "event": "Severe Thunderstorm Warning", "severity": "Severe", "urgency": "Immediate",
+        "sender_name": "NWS Upton NY", "expires": "2026-10-05T12:00:00-04:00"}
+    assert a["geometry"] == SQUARE and a["geometry_source"] == "alert"
+    assert a["bbox"] == [41.0, -74.0, 41.5, -73.5]
+    assert feed.error is None and feed.fetched_at is not None and feed.zone_only == []
+
+
+def test_null_geometry_resolves_zones_or_lands_in_zone_only():
+    http = _nws(
+        [_alert("z1", "Flood Watch", None, [ZONE_A]),          # zone resolves -> polygon
+         _alert("z2", "Heat Advisory", None, [ZONE_B]),        # zone 404s -> zone_only, not dropped
+         _alert("z3", "Wind Advisory", None, ["https://evil.example/zones/x"])],  # never fetched
+        {ZONE_A: Resp({"geometry": ZONE_POLY, "properties": {}})})
+    with patch.object(weather.httpx, "AsyncClient", http):
+        feed = asyncio.run(weather.alerts.get())
+    assert [a["id"] for a in feed.alerts] == ["z1"]
+    assert feed.alerts[0]["geometry"] == ZONE_POLY and feed.alerts[0]["geometry_source"] == "zones"
+    assert feed.alerts[0]["zones_unresolved"] == 0
+    assert sorted(z["id"] for z in feed.zone_only) == ["z2", "z3"]
+    assert feed.zone_only[0]["expires"] and feed.zone_only[0]["event"]
+    assert not any("evil.example" in c[0] for c in http.calls)
+
+    # second refresh: zone cache (24 h) means ZONE_A is not fetched again
+    weather.alerts._next_attempt = 0.0
+    with patch.object(weather.httpx, "AsyncClient", http):
+        asyncio.run(weather.alerts.get())
+    assert sum(1 for c in http.calls if c[0] == ZONE_A) == 1
+
+
+def test_upstream_500_keeps_last_good_and_reports_error():
+    ok = _nws([_alert("a1", "Tornado Warning", SQUARE)])
+    with patch.object(weather.httpx, "AsyncClient", ok):
+        asyncio.run(weather.alerts.get())
+    good_at = weather.alerts.fetched_at
+    weather.alerts._next_attempt = 0.0
+    with patch.object(weather.httpx, "AsyncClient", FakeHttp({weather.NWS_ALERTS_URL: Resp(status=500)})):
+        feed = asyncio.run(weather.alerts.get())
+    assert [a["id"] for a in feed.alerts] == ["a1"] and feed.fetched_at == good_at
+    assert "500" in feed.error
+    assert feed._next_attempt - __import__("time").time() <= weather.RETRY_AFTER_FAILURE_S + 1
+
+    r = client.get("/weather/alerts")
+    body = r.json()
+    assert r.status_code == 200 and body["error"] and len(body["alerts"]) == 1
+    assert body["fetched_at"] == good_at and body["credit"] == "National Weather Service"
+
+
+def test_schema_canary_trips_when_no_feature_parses():
+    http = FakeHttp({weather.NWS_ALERTS_URL: Resp({"features": [{"props": {}}, {"properties": {"name": "x"}}]})})
+    with patch.object(weather.httpx, "AsyncClient", http):
+        feed = asyncio.run(weather.alerts.get())
+    assert feed.alerts == [] and "schema" in feed.error
+
+
+def test_empty_feature_list_is_not_an_error():
+    with patch.object(weather.httpx, "AsyncClient", _nws([])):
+        feed = asyncio.run(weather.alerts.get())
+    assert feed.error is None and feed.fetched_at is not None and feed.alerts == []
+
+
+def test_cache_one_upstream_call_per_ttl_even_when_concurrent():
+    http = _nws([_alert("a1", "Tornado Warning", SQUARE)])
+
+    async def many():
+        await asyncio.gather(*(weather.alerts.get() for _ in range(8)))
+        await weather.alerts.get()
+
+    with patch.object(weather.httpx, "AsyncClient", http):
+        asyncio.run(many())
+    assert sum(1 for c in http.calls if c[0] == weather.NWS_ALERTS_URL) == 1
+
+
+def test_endpoint_bbox_filter_and_validation():
+    far = {"type": "Polygon", "coordinates": [[[-79.0, 42.8], [-78.5, 42.8], [-78.5, 43.0], [-79.0, 42.8]]]}  # Buffalo
+    http = _nws([_alert("near", "Flood Warning", SQUARE), _alert("far", "Lake Effect Snow Warning", far),
+                 _alert("zo", "Heat Advisory", None, [ZONE_B])])
+    with patch.object(weather.httpx, "AsyncClient", http):
+        r = client.get("/weather/alerts", params={"south": 40.9, "west": -74.2, "north": 41.2, "east": -73.4})
+        body = r.json()
+        assert r.status_code == 200 and [a["id"] for a in body["alerts"]] == ["near"]
+        assert [z["id"] for z in body["zone_only"]] == ["zo"]   # never bbox-filtered away
+        assert len(client.get("/weather/alerts").json()["alerts"]) == 2
+    assert client.get("/weather/alerts", params={"south": 41.4, "west": -74, "north": 40.9, "east": -73}).status_code == 400
+    assert client.get("/weather/alerts", params={"south": 40.9}).status_code == 400
+
+
+def _metar(icao, lat, lon, wdir, wspd, wgst=None, obs=None):
+    return {"icaoId": icao, "name": f"{icao} airport", "lat": lat, "lon": lon,
+            "obsTime": obs or int(__import__("time").time()) - 600, "reportTime": "2026-10-05T06:48:00.000Z",
+            "wdir": wdir, "wspd": wspd, "wgst": wgst, "rawOb": f"METAR {icao} ..."}
+
+
+def test_wind_picks_nearest_station_and_caches_per_cell():
+    rows = [_metar("KLGA", 40.7794, -73.8803, 310, 6),
+            _metar("KHPN", 41.067, -73.7076, "VRB", 4, 18),
+            _metar("KHPN", 41.067, -73.7076, 200, 3, obs=1)]   # older duplicate report
+    http = FakeHttp({weather.METAR_URL: Resp(rows)})
+    with patch.object(weather.httpx, "AsyncClient", http):
+        r = client.get("/weather/wind", params={"lat": 41.03, "lon": -73.76})   # White Plains
+        body = r.json()
+        assert r.status_code == 200 and body["available"] is True
+        w = body["wind"]
+        assert w["station"] == "KHPN" and w["distance_km"] < 10
+        assert w["wind_dir_deg"] is None and w["variable"] is True and w["wind_kt"] == 4 and w["gust_kt"] == 18
+        assert w["stale"] is False and body["credit"]
+        client.get("/weather/wind", params={"lat": 41.04, "lon": -73.77})   # same cell -> cached
+    assert len(http.calls) == 1
+    params, headers = http.calls[0][1], http.calls[0][2]
+    s, w_, n, e = (float(v) for v in params["bbox"].split(","))
+    assert s < 41.03 < n and w_ < -73.76 < e and params["format"] == "json"
+    assert "User-Agent" in headers
+
+
+def test_wind_unavailable_reasons():
+    with patch.object(weather.httpx, "AsyncClient", FakeHttp({weather.METAR_URL: Resp(None, status=204)})):
+        body = client.get("/weather/wind", params={"lat": 30.0, "lon": -50.0}).json()
+    assert body["available"] is False and "no METAR station" in body["reason"] and body["error"] is None
+
+    weather._wind_cells.clear()
+    with patch.object(weather.httpx, "AsyncClient", FakeHttp({weather.METAR_URL: Resp(status=503)})):
+        body = client.get("/weather/wind", params={"lat": 41.03, "lon": -73.76}).json()
+    assert body["available"] is False and "unavailable" in body["reason"] and "503" in body["error"]
+
+
+def test_slow_zone_endpoint_cannot_hold_the_feed_lock():
+    """Zone fetches run under the feed lock; a hung zone endpoint must not stall
+    every /weather/alerts request -- the alert lands in zone_only instead."""
+    import time
+
+    class SlowZones(FakeHttp):
+        async def get(self, url, params=None, headers=None):
+            if url.startswith(weather.NWS_ZONE_PREFIX):
+                await asyncio.sleep(5)
+            return await super().get(url, params, headers)
+
+    http = SlowZones({weather.NWS_ALERTS_URL: Resp({"features": [_alert("z1", "Flood Watch", None, [ZONE_A])]}),
+                      ZONE_A: Resp({"geometry": ZONE_POLY})})
+    with patch.object(weather, "ZONE_BUDGET_S", 0.2), patch.object(weather.httpx, "AsyncClient", http):
+        t0 = time.time()
+        feed = asyncio.run(weather.alerts.get())
+    assert time.time() - t0 < 2
+    assert feed.error is None and [z["id"] for z in feed.zone_only] == ["z1"]
+    assert weather.zones.get(ZONE_A) == (False, None)   # not cached as a failure; retried next refresh

drb-frontend/app/admin/page.tsx

@@ -4,6 +4,7 @@ import { useAuth } from "@/components/AuthProvider";
 import { c2api } from "@/lib/c2api";
 import { ReplayTab } from "@/components/admin/ReplayTab";
 import { CameraProvidersTab } from "@/components/admin/CameraProvidersTab";
+import { OutageProvidersTab } from "@/components/admin/OutageProvidersTab";
 import { useEffect, useState, useRef, useCallback } from "react";
 import { useRouter } from "next/navigation";
 import type { UserRecord, AuditEntry, UserRole, CallRecord } from "@/lib/types";
@@ -84,7 +85,7 @@ function fmtDatetime(iso: string | null | undefined) {
 const ROLE_COLORS: Record<UserRole, string> = {
   admin:    "bg-indigo-900 text-indigo-300",
   operator: "bg-green-900 text-green-300",
-  viewer:   "bg-gray-800 text-gray-400",
+  viewer:   "bg-raised text-ink-2",
 };
 
 function RoleBadge({ role }: { role: UserRole }) {
@@ -135,14 +136,14 @@ function FeaturesTab() {
         </div>
       )}
       {loading ? (
-        <p className="text-gray-500 text-sm font-mono">Loading…</p>
+        <p className="text-ink-muted text-sm font-mono">Loading…</p>
       ) : (
-        <div className="bg-gray-900 border border-gray-800 rounded-xl divide-y divide-gray-800">
+        <div className="bg-surface border border-line rounded-xl divide-y divide-line">
           {FLAG_META.map(({ key, label, description }) => (
             <div key={key} className="flex items-center justify-between gap-4 px-5 py-4">
               <div className="min-w-0">
                 <p className="text-white text-sm font-semibold">{label}</p>
-                <p className="text-gray-500 text-xs mt-0.5 leading-snug">{description}</p>
+                <p className="text-ink-muted text-xs mt-0.5 leading-snug">{description}</p>
               </div>
               <Toggle
                 enabled={flags?.[key] ?? true}
@@ -237,30 +238,30 @@ function CorrelationDebugTab() {
 
   return (
     <div className="space-y-4">
-      <p className="text-xs text-gray-500 font-mono">
+      <p className="text-xs text-ink-muted font-mono">
         Fetches recent incidents with per-call correlation debug fields, plus orphaned calls.
         Copy the JSON and paste it to Claude to diagnose correlation problems.
       </p>
 
       <div className="flex flex-wrap items-end gap-4">
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Incidents (limit)</label>
+          <label className="text-xs text-ink-2 block mb-1">Incidents (limit)</label>
           <input
             type="number"
             min={1} max={100}
             value={limit}
             onChange={(e) => setLimit(Math.min(100, Math.max(1, Number(e.target.value))))}
-            className="w-24 bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-24 bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
           />
         </div>
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Orphan scan window (hours)</label>
+          <label className="text-xs text-ink-2 block mb-1">Orphan scan window (hours)</label>
           <input
             type="number"
             min={1} max={168}
             value={orphanHours}
             onChange={(e) => setOrphanHours(Math.min(168, Math.max(1, Number(e.target.value))))}
-            className="w-28 bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-28 bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
           />
         </div>
         <button
@@ -280,12 +281,12 @@ function CorrelationDebugTab() {
 
       {meta && (
         <div className="flex items-center justify-between">
-          <p className="text-xs text-gray-500 font-mono">
+          <p className="text-xs text-ink-muted font-mono">
             {meta.incident_count} incidents · {meta.orphaned_call_count} orphaned calls · {meta.generated_at}
           </p>
           <button
             onClick={handleCopy}
-            className="text-xs font-mono px-3 py-1.5 rounded-lg border border-gray-700 bg-gray-900 text-gray-300 hover:text-white transition-colors"
+            className="text-xs font-mono px-3 py-1.5 rounded-lg border border-line-strong bg-surface text-ink-2 hover:text-white transition-colors"
           >
             {copied ? "Copied!" : "Copy JSON"}
           </button>
@@ -294,22 +295,22 @@ function CorrelationDebugTab() {
 
       {meta && Object.keys(pathCounts).length > 0 && (
         <div className="grid grid-cols-2 gap-3">
-          <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-1">
-            <p className="text-xs text-gray-400 font-mono font-semibold mb-2">corr_path distribution</p>
+          <div className="bg-surface border border-line rounded-xl p-4 space-y-1">
+            <p className="text-xs text-ink-2 font-mono font-semibold mb-2">corr_path distribution</p>
             {Object.entries(pathCounts).sort((a, b) => b[1] - a[1]).map(([path, n]) => (
               <div key={path} className="flex justify-between text-xs font-mono">
-                <span className="text-gray-300">{path}</span>
+                <span className="text-ink-2">{path}</span>
                 <span className="text-indigo-400">{n}</span>
               </div>
             ))}
           </div>
-          <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-1">
-            <p className="text-xs text-gray-400 font-mono font-semibold mb-2">fit_signal distribution</p>
+          <div className="bg-surface border border-line rounded-xl p-4 space-y-1">
+            <p className="text-xs text-ink-2 font-mono font-semibold mb-2">fit_signal distribution</p>
             {Object.keys(signalCounts).length === 0
-              ? <p className="text-xs text-gray-600 font-mono">No signal data yet — deploy correlator update first</p>
+              ? <p className="text-xs text-ink-muted font-mono">No signal data yet — deploy correlator update first</p>
               : Object.entries(signalCounts).sort((a, b) => b[1] - a[1]).map(([sig, n]) => (
                   <div key={sig} className="flex justify-between text-xs font-mono">
-                    <span className={sig === "time_fallback" ? "text-yellow-400" : "text-gray-300"}>{sig}</span>
+                    <span className={sig === "time_fallback" ? "text-yellow-400" : "text-ink-2"}>{sig}</span>
                     <span className="text-indigo-400">{n}</span>
                   </div>
                 ))
@@ -319,13 +320,13 @@ function CorrelationDebugTab() {
       )}
 
       {meta?.orphans_by_talkgroup && meta.orphans_by_talkgroup.length > 0 && (
-        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-1">
-          <p className="text-xs text-gray-400 font-mono font-semibold mb-2">orphans by talkgroup</p>
+        <div className="bg-surface border border-line rounded-xl p-4 space-y-1">
+          <p className="text-xs text-ink-2 font-mono font-semibold mb-2">orphans by talkgroup</p>
           {meta.orphans_by_talkgroup.map((tg) => (
             <div key={String(tg.talkgroup_id)} className="flex justify-between text-xs font-mono">
-              <span className="text-gray-300">{tg.talkgroup_name} <span className="text-gray-600">({tg.talkgroup_id})</span></span>
-              <span className="text-gray-400">
-                {tg.count} total · <span className="text-gray-500">{tg.no_type_count} no-type</span> · <span className="text-red-400">{tg.sweep_exhausted_count} exhausted</span>
+              <span className="text-ink-2">{tg.talkgroup_name} <span className="text-ink-muted">({tg.talkgroup_id})</span></span>
+              <span className="text-ink-2">
+                {tg.count} total · <span className="text-ink-muted">{tg.no_type_count} no-type</span> · <span className="text-red-400">{tg.sweep_exhausted_count} exhausted</span>
               </span>
             </div>
           ))}
@@ -335,7 +336,7 @@ function CorrelationDebugTab() {
       {json && (
         <pre
           ref={preRef}
-          className="bg-gray-950 border border-gray-800 rounded-xl p-4 text-xs text-gray-300 font-mono overflow-auto max-h-[60vh] whitespace-pre"
+          className="bg-page border border-line rounded-xl p-4 text-xs text-ink-2 font-mono overflow-auto max-h-[60vh] whitespace-pre"
         >
           {json}
         </pre>
@@ -454,13 +455,13 @@ function UserDetailPanel({
   const isSelf = user.uid === currentUid;
 
   return (
-    <div className="bg-gray-900 border border-gray-700 rounded-xl p-5 space-y-5 font-mono">
+    <div className="bg-surface border border-line-strong rounded-xl p-5 space-y-5 font-mono">
       <div className="flex items-start justify-between">
         <div>
           <p className="text-white font-semibold">{detail.email}</p>
-          <p className="text-xs text-gray-500 mt-0.5">{detail.uid}</p>
+          <p className="text-xs text-ink-muted mt-0.5">{detail.uid}</p>
         </div>
-        <button onClick={onClose} className="text-gray-600 hover:text-gray-300 transition-colors text-xl leading-none">×</button>
+        <button onClick={onClose} className="text-ink-muted hover:text-ink transition-colors text-xl leading-none">×</button>
       </div>
 
       {error && (
@@ -471,21 +472,21 @@ function UserDetailPanel({
 
       <div className="space-y-3">
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Display Name</label>
+          <label className="text-xs text-ink-2 block mb-1">Display Name</label>
           <input
             value={editName}
             onChange={(e) => setEditName(e.target.value)}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
             placeholder="Full name"
           />
         </div>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Role</label>
+          <label className="text-xs text-ink-2 block mb-1">Role</label>
           <select
             value={editRole}
             onChange={(e) => setEditRole(e.target.value as UserRole)}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
           >
             <option value="admin">Admin — full access</option>
             <option value="operator">Operator — owns nodes</option>
@@ -495,13 +496,13 @@ function UserDetailPanel({
 
         {editRole === "operator" && (
           <div>
-            <label className="text-xs text-gray-400 block mb-1">
-              Owned Node IDs <span className="text-gray-600">(comma-separated, required)</span>
+            <label className="text-xs text-ink-2 block mb-1">
+              Owned Node IDs <span className="text-ink-muted">(comma-separated, required)</span>
             </label>
             <input
               value={editNodes}
               onChange={(e) => setEditNodes(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
               placeholder="node-abc123, node-def456"
             />
           </div>
@@ -516,10 +517,10 @@ function UserDetailPanel({
         </button>
       </div>
 
-      <div className="border-t border-gray-800 pt-4 space-y-2 text-xs">
+      <div className="border-t border-line pt-4 space-y-2 text-xs">
         <div className="flex justify-between items-center gap-3">
-          <span className="text-gray-500">Organization</span>
-          <span className={`font-mono truncate ${detail.org_id && detail.org_id === myOrgId ? "text-gray-300" : "text-yellow-400"}`}>
+          <span className="text-ink-muted">Organization</span>
+          <span className={`font-mono truncate ${detail.org_id && detail.org_id === myOrgId ? "text-ink-2" : "text-yellow-400"}`}>
             {!detail.org_id
               ? "None: sees no data"
               : detail.org_id === myOrgId
@@ -537,34 +538,34 @@ function UserDetailPanel({
           </button>
         )}
         <div className="flex justify-between">
-          <span className="text-gray-500">Status</span>
+          <span className="text-ink-muted">Status</span>
           <span className={detail.disabled ? "text-red-400" : "text-green-400"}>
             {detail.disabled ? "Disabled" : "Active"}
           </span>
         </div>
         <div className="flex justify-between">
-          <span className="text-gray-500">Discord</span>
-          <span className="text-gray-300">
+          <span className="text-ink-muted">Discord</span>
+          <span className="text-ink-2">
             {detail.discord_linked
               ? `@${detail.discord_username ?? detail.discord_user_id}`
               : "Not linked"}
           </span>
         </div>
         <div className="flex justify-between">
-          <span className="text-gray-500">Created</span>
-          <span className="text-gray-300">{fmtDate(detail.creation_time)}</span>
+          <span className="text-ink-muted">Created</span>
+          <span className="text-ink-2">{fmtDate(detail.creation_time)}</span>
         </div>
         <div className="flex justify-between">
-          <span className="text-gray-500">Last sign-in</span>
-          <span className="text-gray-300">{fmtDate(detail.last_sign_in)}</span>
+          <span className="text-ink-muted">Last sign-in</span>
+          <span className="text-ink-2">{fmtDate(detail.last_sign_in)}</span>
         </div>
       </div>
 
       {(detail.sessions?.length ?? 0) > 0 && (
-        <div className="border-t border-gray-800 pt-4">
+        <div className="border-t border-line pt-4">
           <button
             onClick={() => setShowSessions((v) => !v)}
-            className="text-xs text-gray-500 hover:text-gray-300 transition-colors flex items-center gap-1"
+            className="text-xs text-ink-muted hover:text-ink transition-colors flex items-center gap-1"
           >
             <span>{showSessions ? "▲" : "▼"}</span>
             <span>Login history ({detail.sessions?.length} recent)</span>
@@ -572,9 +573,9 @@ function UserDetailPanel({
           {showSessions && (
             <div className="mt-3 space-y-1.5 max-h-48 overflow-y-auto">
               {detail.sessions?.map((s) => (
-                <div key={s.session_id} className="text-xs text-gray-400 flex justify-between gap-4">
+                <div key={s.session_id} className="text-xs text-ink-2 flex justify-between gap-4">
                   <span>{fmtDatetime(s.timestamp)}</span>
-                  <span className="text-gray-600 truncate">{s.ip ?? "—"}</span>
+                  <span className="text-ink-muted truncate">{s.ip ?? "—"}</span>
                 </div>
               ))}
             </div>
@@ -582,7 +583,7 @@ function UserDetailPanel({
         </div>
       )}
 
-      <div className="border-t border-gray-800 pt-4 flex gap-4 flex-wrap">
+      <div className="border-t border-line pt-4 flex gap-4 flex-wrap">
         {!isSelf ? (
           <>
             <button
@@ -601,7 +602,7 @@ function UserDetailPanel({
             </button>
           </>
         ) : (
-          <p className="text-xs text-gray-600">Cannot disable or delete your own account.</p>
+          <p className="text-xs text-ink-muted">Cannot disable or delete your own account.</p>
         )}
       </div>
     </div>
@@ -666,19 +667,19 @@ function CreateUserModal({
   if (inviteLink) {
     return (
       <div className="fixed inset-0 z-50 bg-black/70 flex items-center justify-center p-4">
-        <div className="bg-gray-900 border border-gray-700 rounded-xl w-full max-w-md p-6 space-y-4 font-mono">
+        <div className="bg-surface border border-line-strong rounded-xl w-full max-w-md p-6 space-y-4 font-mono">
           <h2 className="text-white font-semibold">User Created</h2>
-          <p className="text-xs text-gray-400">
+          <p className="text-xs text-ink-2">
             Share this one-time invite link with the new user so they can set their password.
             It expires after use.
           </p>
-          <div className="bg-gray-800 border border-gray-700 rounded-lg p-3">
+          <div className="bg-raised border border-line-strong rounded-lg p-3">
             <p className="text-xs text-indigo-300 break-all">{inviteLink}</p>
           </div>
           <div className="flex gap-3">
             <button
               onClick={copyLink}
-              className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+              className="flex-1 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg py-2 text-sm transition-colors"
             >
               {copied ? "Copied!" : "Copy link"}
             </button>
@@ -696,37 +697,37 @@ function CreateUserModal({
 
   return (
     <div className="fixed inset-0 z-50 bg-black/70 flex items-center justify-center p-4">
-      <div className="bg-gray-900 border border-gray-700 rounded-xl w-full max-w-md p-6 font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl w-full max-w-md p-6 font-mono">
         <h2 className="text-white font-semibold mb-4">Create User</h2>
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Email</label>
+            <label className="text-xs text-ink-2 block mb-1">Email</label>
             <input
               type="email"
               value={email}
               onChange={(e) => setEmail(e.target.value)}
               required
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               placeholder="user@example.com"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">
-              Display Name <span className="text-gray-600">(optional)</span>
+            <label className="text-xs text-ink-2 block mb-1">
+              Display Name <span className="text-ink-muted">(optional)</span>
             </label>
             <input
               value={displayName}
               onChange={(e) => setDisplayName(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               placeholder="Jane Smith"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Role</label>
+            <label className="text-xs text-ink-2 block mb-1">Role</label>
             <select
               value={role}
               onChange={(e) => setRole(e.target.value as UserRole)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             >
               <option value="admin">Admin — full access</option>
               <option value="operator">Operator — owns nodes</option>
@@ -735,14 +736,14 @@ function CreateUserModal({
           </div>
           {role === "operator" && (
             <div>
-              <label className="text-xs text-gray-400 block mb-1">
-                Owned Node IDs <span className="text-gray-600">(comma-separated, required)</span>
+              <label className="text-xs text-ink-2 block mb-1">
+                Owned Node IDs <span className="text-ink-muted">(comma-separated, required)</span>
               </label>
               <input
                 value={nodeIds}
                 onChange={(e) => setNodeIds(e.target.value)}
                 required
-                className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+                className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
                 placeholder="node-abc123, node-def456"
               />
             </div>
@@ -759,7 +760,7 @@ function CreateUserModal({
             <button
               type="button"
               onClick={onClose}
-              className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+              className="flex-1 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg py-2 text-sm transition-colors"
             >
               Cancel
             </button>
@@ -819,7 +820,7 @@ function UsersTab({ currentUid }: { currentUid: string }) {
       )}
 
       <div className="flex items-center justify-between">
-        <p className="text-xs text-gray-500 font-mono">{users.length} user{users.length !== 1 ? "s" : ""}</p>
+        <p className="text-xs text-ink-muted font-mono">{users.length} user{users.length !== 1 ? "s" : ""}</p>
         <button
           onClick={() => setShowCreate(true)}
           className="bg-indigo-600 hover:bg-indigo-500 text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
@@ -835,14 +836,14 @@ function UsersTab({ currentUid }: { currentUid: string }) {
       )}
 
       {loading ? (
-        <p className="text-gray-500 text-sm font-mono">Loading…</p>
+        <p className="text-ink-muted text-sm font-mono">Loading…</p>
       ) : users.length === 0 ? (
-        <p className="text-gray-600 text-sm font-mono">No users found.</p>
+        <p className="text-ink-muted text-sm font-mono">No users found.</p>
       ) : (
-        <div className="border border-gray-800 rounded-xl overflow-hidden">
+        <div className="border border-line rounded-xl overflow-hidden">
           <table className="w-full text-xs font-mono">
             <thead>
-              <tr className="bg-gray-900 text-gray-500 uppercase tracking-wider">
+              <tr className="bg-surface text-ink-muted uppercase tracking-wider">
                 <th className="px-4 py-2.5 text-left">Email</th>
                 <th className="px-4 py-2.5 text-left hidden lg:table-cell">Name</th>
                 <th className="px-4 py-2.5 text-left">Role</th>
@@ -856,17 +857,17 @@ function UsersTab({ currentUid }: { currentUid: string }) {
               {users.map((u) => (
                 <tr
                   key={u.uid}
-                  className={`border-t border-gray-800 transition-colors ${
-                    selectedUid === u.uid ? "bg-gray-800/60" : "hover:bg-gray-900/60"
+                  className={`border-t border-line transition-colors ${
+                    selectedUid === u.uid ? "bg-raised/60" : "hover:bg-raised/60"
                   }`}
                 >
-                  <td className="px-4 py-2.5 text-gray-200">{u.email ?? "—"}</td>
-                  <td className="px-4 py-2.5 text-gray-400 hidden lg:table-cell">{u.display_name ?? "—"}</td>
+                  <td className="px-4 py-2.5 text-ink">{u.email ?? "—"}</td>
+                  <td className="px-4 py-2.5 text-ink-2 hidden lg:table-cell">{u.display_name ?? "—"}</td>
                   <td className="px-4 py-2.5"><RoleBadge role={u.role} /></td>
-                  <td className="px-4 py-2.5 text-gray-500 hidden sm:table-cell">
+                  <td className="px-4 py-2.5 text-ink-muted hidden sm:table-cell">
                     {u.discord_linked ? `@${u.discord_username ?? "linked"}` : "—"}
                   </td>
-                  <td className="px-4 py-2.5 text-gray-500 hidden md:table-cell">{fmtDate(u.last_sign_in)}</td>
+                  <td className="px-4 py-2.5 text-ink-muted hidden md:table-cell">{fmtDate(u.last_sign_in)}</td>
                   <td className="px-4 py-2.5">
                     {u.disabled
                       ? <span className="text-red-500">Disabled</span>
@@ -951,15 +952,15 @@ function AuditLogTab() {
       )}
 
       {loading ? (
-        <p className="text-gray-500 text-sm font-mono">Loading…</p>
+        <p className="text-ink-muted text-sm font-mono">Loading…</p>
       ) : entries.length === 0 ? (
-        <p className="text-gray-600 text-sm font-mono">No audit entries yet.</p>
+        <p className="text-ink-muted text-sm font-mono">No audit entries yet.</p>
       ) : (
         <>
-          <div className="border border-gray-800 rounded-xl overflow-hidden">
+          <div className="border border-line rounded-xl overflow-hidden">
             <table className="w-full text-xs font-mono">
               <thead>
-                <tr className="bg-gray-900 text-gray-500 uppercase tracking-wider">
+                <tr className="bg-surface text-ink-muted uppercase tracking-wider">
                   <th className="px-4 py-2.5 text-left">Time</th>
                   <th className="px-4 py-2.5 text-left">Action</th>
                   <th className="px-4 py-2.5 text-left hidden sm:table-cell">Actor</th>
@@ -969,12 +970,12 @@ function AuditLogTab() {
               </thead>
               <tbody>
                 {entries.map((e) => (
-                  <tr key={e.log_id} className="border-t border-gray-800 hover:bg-gray-900/40">
-                    <td className="px-4 py-2.5 text-gray-500 whitespace-nowrap">{fmtDatetime(e.timestamp)}</td>
+                  <tr key={e.log_id} className="border-t border-line hover:bg-raised/40">
+                    <td className="px-4 py-2.5 text-ink-muted whitespace-nowrap">{fmtDatetime(e.timestamp)}</td>
                     <td className={`px-4 py-2.5 whitespace-nowrap ${actionColor(e.action)}`}>{e.action}</td>
-                    <td className="px-4 py-2.5 text-gray-400 hidden sm:table-cell">{e.actor_email}</td>
-                    <td className="px-4 py-2.5 text-gray-400 hidden md:table-cell">{e.target_email ?? "—"}</td>
-                    <td className="px-4 py-2.5 text-gray-600 max-w-xs truncate">
+                    <td className="px-4 py-2.5 text-ink-2 hidden sm:table-cell">{e.actor_email}</td>
+                    <td className="px-4 py-2.5 text-ink-2 hidden md:table-cell">{e.target_email ?? "—"}</td>
+                    <td className="px-4 py-2.5 text-ink-muted max-w-xs truncate">
                       {Object.keys(e.details).length > 0
                         ? Object.entries(e.details)
                             .map(([k, v]) => `${k}: ${JSON.stringify(v)}`)
@@ -1028,26 +1029,26 @@ function StaleCallsTab() {
 
   return (
     <div className="space-y-5">
-      <p className="text-xs text-gray-500 font-mono">
-        Finds calls stuck in <span className="text-gray-300">active</span> status because a node rebooted before sending an end-call event.
+      <p className="text-xs text-ink-muted font-mono">
+        Finds calls stuck in <span className="text-ink-2">active</span> status because a node rebooted before sending an end-call event.
         Preview first, then close.
       </p>
 
       <div className="flex flex-wrap items-end gap-4">
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Older than (minutes)</label>
+          <label className="text-xs text-ink-2 block mb-1">Older than (minutes)</label>
           <input
             type="number"
             min={1} max={1440}
             value={minutes}
             onChange={(e) => setMinutes(Math.min(1440, Math.max(1, Number(e.target.value))))}
-            className="w-28 bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-28 bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
           />
         </div>
         <button
           onClick={() => run(true)}
           disabled={loading}
-          className="bg-gray-800 hover:bg-gray-700 disabled:opacity-50 border border-gray-700 text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
+          className="bg-raised hover:bg-gray-700 disabled:opacity-50 border border-line-strong text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
         >
           {loading ? "Working…" : "Preview"}
         </button>
@@ -1067,18 +1068,18 @@ function StaleCallsTab() {
       )}
 
       {result && (
-        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-2">
+        <div className="bg-surface border border-line rounded-xl p-4 space-y-2">
           <p className="text-sm font-mono text-white">
             {result.dry_run ? "Preview: " : "Closed: "}
             <span className={result.count > 0 ? "text-amber-400" : "text-green-400"}>
               {result.count} stale call{result.count !== 1 ? "s" : ""}
             </span>
-            {result.count === 0 && <span className="text-gray-500"> — nothing to clear</span>}
+            {result.count === 0 && <span className="text-ink-muted"> — nothing to clear</span>}
           </p>
           {result.call_ids.length > 0 && (
             <div className="max-h-40 overflow-y-auto space-y-0.5">
               {result.call_ids.map((id) => (
-                <p key={id} className="text-xs font-mono text-gray-400">{id}</p>
+                <p key={id} className="text-xs font-mono text-ink-2">{id}</p>
               ))}
             </div>
           )}
@@ -1103,17 +1104,17 @@ function fmtPct(x: number | null | undefined): string {
 
 function EvalStatsBar({ stats }: { stats: { eval_count: number; raw_wer: number | null; corrected_wer: number | null } | null }) {
   return (
-    <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 flex flex-wrap gap-x-8 gap-y-2">
+    <div className="bg-surface border border-line rounded-xl p-4 flex flex-wrap gap-x-8 gap-y-2">
       <div>
-        <p className="text-xs text-gray-500 font-mono">Calls verified</p>
+        <p className="text-xs text-ink-muted font-mono">Calls verified</p>
         <p className="text-white text-lg font-mono">{stats?.eval_count ?? "—"}</p>
       </div>
       <div>
-        <p className="text-xs text-gray-500 font-mono">Raw WER (whisper-1)</p>
+        <p className="text-xs text-ink-muted font-mono">Raw WER (whisper-1)</p>
         <p className="text-white text-lg font-mono">{fmtPct(stats?.raw_wer)}</p>
       </div>
       <div>
-        <p className="text-xs text-gray-500 font-mono">Corrected WER (shipped)</p>
+        <p className="text-xs text-ink-muted font-mono">Corrected WER (shipped)</p>
         <p className="text-white text-lg font-mono">{fmtPct(stats?.corrected_wer)}</p>
       </div>
       {stats && stats.eval_count > 0 && stats.eval_count < 20 && (
@@ -1168,8 +1169,10 @@ function SttEvalTab() {
   // scanning", not "done", so this fires again on its own.
   useEffect(() => {
     if (queue.length === 0 && !exhausted) loadBatch();
+    // `cursor` is a dep so an empty page that advanced the cursor scans the
+    // next one; without it the tab sat on "Loading…" forever.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [queue.length, exhausted]);
+  }, [queue.length, exhausted, cursor]);
 
   useEffect(() => {
     setDraft(current ? (current.transcript_corrected || current.transcript || "") : "");
@@ -1196,7 +1199,7 @@ function SttEvalTab() {
 
   return (
     <div className="space-y-4">
-      <p className="text-xs text-gray-500 font-mono">
+      <p className="text-xs text-ink-muted font-mono">
         Listen to the audio, correct the transcript below until it matches what was actually said, then save.
         This never touches the call&apos;s real transcript or re-runs anything — it only records ground truth
         for measuring the pipeline. Do as many or as few as you have time for; it picks up where you left off.
@@ -1211,8 +1214,8 @@ function SttEvalTab() {
       )}
 
       {current ? (
-        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4 space-y-3">
-          <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-xs font-mono text-gray-400">
+        <div className="bg-surface border border-line rounded-xl p-4 space-y-3">
+          <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-xs font-mono text-ink-2">
             <span>{new Date(current.started_at).toLocaleString()}</span>
             <span>{current.talkgroup_name || (current.talkgroup_id ? `TGID ${current.talkgroup_id}` : "unknown talkgroup")}</span>
           </div>
@@ -1221,18 +1224,18 @@ function SttEvalTab() {
             // eslint-disable-next-line jsx-a11y/media-has-caption
             <audio controls src={current.audio_url} className="w-full h-9" />
           ) : (
-            <p className="text-xs text-gray-500 italic">No audio on this call — skip it.</p>
+            <p className="text-xs text-ink-muted italic">No audio on this call — skip it.</p>
           )}
 
           <div>
-            <label className="text-xs text-gray-400 block mb-1">
+            <label className="text-xs text-ink-2 block mb-1">
               Machine transcript (pre-filled) — correct it into what was actually said
             </label>
             <textarea
               value={draft}
               onChange={(e) => setDraft(e.target.value)}
               rows={4}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
             />
           </div>
 
@@ -1247,15 +1250,15 @@ function SttEvalTab() {
             <button
               onClick={skip}
               disabled={saving}
-              className="bg-gray-800 hover:bg-gray-700 disabled:opacity-50 border border-gray-700 text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
+              className="bg-raised hover:bg-gray-700 disabled:opacity-50 border border-line-strong text-white text-sm font-mono px-4 py-1.5 rounded-lg transition-colors"
             >
               Skip
             </button>
           </div>
         </div>
       ) : (
-        <div className="bg-gray-900 border border-gray-800 rounded-xl p-4">
-          <p className="text-sm font-mono text-gray-400">
+        <div className="bg-surface border border-line rounded-xl p-4">
+          <p className="text-sm font-mono text-ink-2">
             {loadingBatch ? "Loading calls…" : exhausted ? "Nothing left to verify right now — check back after more calls come in." : "Loading…"}
           </p>
         </div>
@@ -1268,11 +1271,12 @@ function SttEvalTab() {
 // Main admin page
 // ---------------------------------------------------------------------------
 
-type AdminTab = "features" | "cameras" | "correlation" | "replay" | "users" | "audit" | "calls" | "eval";
+type AdminTab = "features" | "cameras" | "outages" | "correlation" | "replay" | "users" | "audit" | "calls" | "eval";
 
 const TAB_LABELS: { key: AdminTab; label: string }[] = [
   { key: "features",    label: "AI Features" },
   { key: "cameras",     label: "Camera providers" },
+  { key: "outages",     label: "Outage providers" },
   { key: "correlation", label: "Correlation Debug" },
   { key: "replay",      label: "Replay" },
   { key: "calls",       label: "Calls" },
@@ -1285,7 +1289,7 @@ export default function AdminPage() {
   const { user, isAdmin, loading: authLoading } = useAuth();
   const router = useRouter();
   const [tab, setTab] = useState<AdminTab>("features");
-  // Deep link to a tab (/admin#cameras), e.g. from the live wall's empty state.
+  // Deep link to a tab (/admin#cameras, /admin#outages), e.g. from a map layer's empty state.
   useEffect(() => {
     const h = window.location.hash.slice(1);
     if (TAB_LABELS.some((t) => t.key === h)) setTab(h as AdminTab);
@@ -1304,19 +1308,22 @@ export default function AdminPage() {
   if (!isAdmin) return null;
 
   // Users/Audit tabs benefit from full width; everything else is narrow
-  const wide = tab === "users" || tab === "audit" || tab === "replay" || tab === "cameras";
+  const wide = tab === "users" || tab === "audit" || tab === "replay" || tab === "cameras" || tab === "outages";
 
   return (
-    <div className={`space-y-6 ${wide ? "" : "max-w-2xl"}`}>
+    // The width toggle wraps the tab body only. It used to wrap the tab bar
+    // too, so the bar reflowed on every switch and left the cursor over
+    // whatever landed under it (e.g. Calls -> "Close calls").
+    <div className="space-y-6">
       <h1 className="text-white text-xl font-bold font-mono">Admin</h1>
 
-      <div className="flex flex-wrap gap-1 bg-gray-900 border border-gray-800 rounded-lg p-1 w-fit">
+      <div className="flex flex-wrap gap-1 bg-surface border border-line rounded-lg p-1 w-fit">
         {TAB_LABELS.map(({ key, label }) => (
           <button
             key={key}
             onClick={() => setTab(key)}
             className={`text-sm font-mono px-4 py-1.5 rounded-md transition-colors ${
-              tab === key ? "bg-gray-800 text-white" : "text-gray-500 hover:text-gray-300"
+              tab === key ? "bg-raised text-white" : "text-ink-muted hover:text-ink"
             }`}
           >
             {label}
@@ -1324,14 +1331,17 @@ export default function AdminPage() {
         ))}
       </div>
 
+      <div className={`space-y-6 ${wide ? "" : "max-w-2xl"}`}>
       {tab === "features"    && <FeaturesTab />}
       {tab === "cameras"     && <CameraProvidersTab />}
+      {tab === "outages"     && <OutageProvidersTab />}
       {tab === "correlation" && <CorrelationDebugTab />}
       {tab === "replay"      && <ReplayTab />}
       {tab === "calls"       && <StaleCallsTab />}
       {tab === "eval"        && <SttEvalTab />}
       {tab === "users"       && <UsersTab currentUid={user?.uid ?? ""} />}
       {tab === "audit"       && <AuditLogTab />}
+      </div>
     </div>
   );
 }

drb-frontend/app/alerts/page.tsx

@@ -5,6 +5,8 @@ import { useAuth } from "@/components/AuthProvider";
 import { useAlerts } from "@/lib/useAlerts";
 import { MachineOutputNotice } from "@/components/ui/MachineOutputNotice";
 import { c2api } from "@/lib/c2api";
+import { errorMessage } from "@/lib/c2error";
+import { ErrorBanner } from "@/components/ui/EmptyState";
 import type { AlertRule } from "@/lib/types";
 
 function fmtTime(iso: string) {
@@ -20,6 +22,10 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
   const [webhook, setWebhook] = useState("");
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // Load and toggle/delete failures (server-26#284) — separate from the create
+  // form's own `error`, and it keeps the list from claiming "no rules" when
+  // the fetch actually failed.
+  const [listError, setListError] = useState<string | null>(null);
 
   async function load() {
     if (loaded) return;
@@ -27,8 +33,9 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
       const data = await c2api.getAlertRules() as AlertRule[];
       setRules(data);
       setLoaded(true);
+      setListError(null);
     } catch (e) {
-      console.error(e);
+      setListError(`Couldn't load alert rules: ${errorMessage(e)}`);
     }
   }
 
@@ -50,8 +57,8 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
       const created = await c2api.createAlertRule(body) as AlertRule;
       setRules((prev) => [created, ...prev]);
       setName(""); setKeywords(""); setTgIds(""); setWebhook("");
-    } catch {
-      setError("Failed to create rule.");
+    } catch (e) {
+      setError(`Failed to create rule: ${errorMessage(e)}`);
     } finally {
       setSaving(false);
     }
@@ -61,52 +68,55 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
     try {
       await c2api.updateAlertRule(rule.rule_id, { enabled: !rule.enabled });
       setRules((prev) => prev.map((r) => r.rule_id === rule.rule_id ? { ...r, enabled: !r.enabled } : r));
-    } catch (e) { console.error(e); }
+      setListError(null);
+    } catch (e) { setListError(`Couldn't update "${rule.name}": ${errorMessage(e)}`); }
   }
 
   async function handleDelete(id: string) {
+    if (!window.confirm("Delete this alert rule?")) return;
     try {
       await c2api.deleteAlertRule(id);
       setRules((prev) => prev.filter((r) => r.rule_id !== id));
-    } catch (e) { console.error(e); }
+      setListError(null);
+    } catch (e) { setListError(`Couldn't delete the rule: ${errorMessage(e)}`); }
   }
 
   return (
     <div className="space-y-6">
       {isAdmin && (
-        <form onSubmit={handleCreate} className="bg-gray-900 border border-gray-800 rounded-xl p-5 space-y-4">
+        <form onSubmit={handleCreate} className="bg-surface border border-line rounded-xl p-5 space-y-4">
           <h3 className="text-white font-mono text-sm font-bold">New Alert Rule</h3>
           <div className="grid grid-cols-2 gap-4">
             <div>
-              <label className="text-xs text-gray-400 block mb-1">Name</label>
+              <label className="text-xs text-ink-2 block mb-1">Name</label>
               <input
                 required value={name} onChange={(e) => setName(e.target.value)}
                 placeholder="e.g. Structure Fire"
-                className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               />
             </div>
             <div>
-              <label className="text-xs text-gray-400 block mb-1">Keywords (comma-separated)</label>
+              <label className="text-xs text-ink-2 block mb-1">Keywords (comma-separated)</label>
               <input
                 value={keywords} onChange={(e) => setKeywords(e.target.value)}
                 placeholder="fire, smoke, structure"
-                className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               />
             </div>
             <div>
-              <label className="text-xs text-gray-400 block mb-1">Talkgroup IDs (comma-separated)</label>
+              <label className="text-xs text-ink-2 block mb-1">Talkgroup IDs (comma-separated)</label>
               <input
                 value={tgIds} onChange={(e) => setTgIds(e.target.value)}
                 placeholder="9048, 9600"
-                className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               />
             </div>
             <div>
-              <label className="text-xs text-gray-400 block mb-1">Discord Webhook URL (optional)</label>
+              <label className="text-xs text-ink-2 block mb-1">Discord Webhook URL (optional)</label>
               <input
                 value={webhook} onChange={(e) => setWebhook(e.target.value)}
                 placeholder="https://discord.com/api/webhooks/…"
-                className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               />
             </div>
           </div>
@@ -120,13 +130,17 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
         </form>
       )}
 
-      <div className="bg-gray-900 border border-gray-800 rounded-xl overflow-hidden">
-        {rules.length === 0 ? (
-          <p className="text-gray-600 text-sm font-mono p-4">No alert rules configured.</p>
+      {listError && <ErrorBanner message={listError} />}
+
+      <div className="bg-surface border border-line rounded-xl overflow-hidden">
+        {!loaded ? (
+          <p className="text-ink-muted text-sm font-mono p-4">{listError ? "Rules unavailable." : "Loading…"}</p>
+        ) : rules.length === 0 ? (
+          <p className="text-ink-muted text-sm font-mono p-4">No alert rules configured.</p>
         ) : (
           <table className="w-full text-left">
             <thead>
-              <tr className="border-b border-gray-800 text-xs text-gray-500 uppercase">
+              <tr className="border-b border-line text-xs text-ink-muted uppercase">
                 <th className="px-4 py-3">Name</th>
                 <th className="px-4 py-3">Keywords</th>
                 <th className="px-4 py-3">Talkgroups</th>
@@ -137,11 +151,11 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
             </thead>
             <tbody>
               {rules.map((rule) => (
-                <tr key={rule.rule_id} className="border-b border-gray-800">
+                <tr key={rule.rule_id} className="border-b border-line">
                   <td className="px-4 py-3 text-white text-sm">{rule.name}</td>
-                  <td className="px-4 py-3 text-gray-400 text-xs font-mono">{rule.keywords.join(", ") || "—"}</td>
-                  <td className="px-4 py-3 text-gray-400 text-xs font-mono">{rule.talkgroup_ids.join(", ") || "—"}</td>
-                  <td className="px-4 py-3 text-gray-400 text-xs">
+                  <td className="px-4 py-3 text-ink-2 text-xs font-mono">{rule.keywords.join(", ") || "—"}</td>
+                  <td className="px-4 py-3 text-ink-2 text-xs font-mono">{rule.talkgroup_ids.join(", ") || "—"}</td>
+                  <td className="px-4 py-3 text-ink-2 text-xs">
                     {rule.discord_webhook ? (
                       <span className="text-green-400">configured</span>
                     ) : "—"}
@@ -153,13 +167,13 @@ function RulesTab({ isAdmin }: { isAdmin: boolean }) {
                         className={`text-xs px-2 py-0.5 rounded-full transition-colors ${
                           rule.enabled
                             ? "bg-green-900 text-green-300 hover:bg-green-800"
-                            : "bg-gray-800 text-gray-400 hover:bg-gray-700"
+                            : "bg-raised text-ink-2 hover:bg-gray-700"
                         }`}
                       >
                         {rule.enabled ? "enabled" : "disabled"}
                       </button>
                     ) : (
-                      <span className={`text-xs ${rule.enabled ? "text-green-400" : "text-gray-500"}`}>
+                      <span className={`text-xs ${rule.enabled ? "text-green-400" : "text-ink-muted"}`}>
                         {rule.enabled ? "enabled" : "disabled"}
                       </span>
                     )}
@@ -188,11 +202,13 @@ export default function AlertsPage() {
   const { isAdmin } = useAuth();
   const { alerts, loading, error } = useAlerts();
   const [tab, setTab] = useState<"events" | "rules">("events");
+  const [ackError, setAckError] = useState<string | null>(null);
 
   async function handleAcknowledge(id: string) {
+    setAckError(null);
     try {
       await c2api.acknowledgeAlert(id);
-    } catch (e) { console.error(e); }
+    } catch (e) { setAckError(`Couldn't acknowledge: ${errorMessage(e)}`); }
   }
 
   const unacked = alerts.filter((a) => !a.acknowledged);
@@ -209,13 +225,13 @@ export default function AlertsPage() {
       </div>
 
       {/* Tabs */}
-      <div className="flex gap-1 bg-gray-900 border border-gray-800 rounded-lg p-1 w-fit">
+      <div className="flex gap-1 bg-surface border border-line rounded-lg p-1 w-fit">
         {(["events", ...(isAdmin ? ["rules"] : [])] as const).map((t) => (
           <button
             key={t}
             onClick={() => setTab(t as "events" | "rules")}
             className={`text-sm font-mono px-4 py-1.5 rounded-md transition-colors capitalize ${
-              tab === t ? "bg-gray-800 text-white" : "text-gray-500 hover:text-gray-300"
+              tab === t ? "bg-raised text-white" : "text-ink-muted hover:text-ink"
             }`}
           >
             {t === "events" ? "Triggered Alerts" : "Rules"}
@@ -223,9 +239,11 @@ export default function AlertsPage() {
         ))}
       </div>
 
+      {tab === "events" && ackError && <ErrorBanner message={ackError} />}
+
       {tab === "events" && (
         loading ? (
-          <p className="text-gray-500 text-sm font-mono">Loading…</p>
+          <p className="text-ink-muted text-sm font-mono">Loading…</p>
         ) : error ? (
           <p className="text-red-400 text-sm font-mono">
             {/requires an index|PERMISSION_DENIED|insufficient permissions/i.test(error)
@@ -233,7 +251,7 @@ export default function AlertsPage() {
               : `Couldn't load alerts: ${error}`}
           </p>
         ) : alerts.length === 0 ? (
-          <p className="text-gray-600 text-sm font-mono">No alerts triggered yet.</p>
+          <p className="text-ink-muted text-sm font-mono">No alerts triggered yet.</p>
         ) : (
           <div className="space-y-3">
           {/* Gate A / A2 (server-26#46) — the Snippet column is transcript text,
@@ -242,10 +260,10 @@ export default function AlertsPage() {
             variant="inline"
             detail="alerts match against automated transcripts and may fire on, or miss, the wrong words."
           />
-          <div className="bg-gray-900 border border-gray-800 rounded-xl overflow-hidden">
+          <div className="bg-surface border border-line rounded-xl overflow-hidden">
             <table className="w-full text-left">
               <thead>
-                <tr className="border-b border-gray-800 text-xs text-gray-500 uppercase">
+                <tr className="border-b border-line text-xs text-ink-muted uppercase">
                   <th className="px-4 py-3">Rule</th>
                   <th className="px-4 py-3">Talkgroup</th>
                   <th className="px-4 py-3">Matched</th>
@@ -258,10 +276,10 @@ export default function AlertsPage() {
                 {alerts.map((alert) => (
                   <tr
                     key={alert.alert_id}
-                    className={`border-b border-gray-800 ${alert.acknowledged ? "opacity-50" : ""}`}
+                    className={`border-b border-line ${alert.acknowledged ? "opacity-50" : ""}`}
                   >
                     <td className="px-4 py-3 text-white text-sm">{alert.rule_name}</td>
-                    <td className="px-4 py-3 text-gray-400 text-xs font-mono">
+                    <td className="px-4 py-3 text-ink-2 text-xs font-mono">
                       {alert.talkgroup_name || alert.talkgroup_id || "—"}
                     </td>
                     <td className="px-4 py-3">
@@ -273,17 +291,17 @@ export default function AlertsPage() {
                         ))}
                       </div>
                     </td>
-                    <td className="px-4 py-3 text-gray-400 text-xs font-mono max-w-xs truncate">
+                    <td className="px-4 py-3 text-ink-2 text-xs font-mono max-w-xs truncate">
                       {alert.transcript_snippet || "—"}
                     </td>
-                    <td className="px-4 py-3 text-gray-400 text-xs font-mono">{fmtTime(alert.triggered_at)}</td>
+                    <td className="px-4 py-3 text-ink-2 text-xs font-mono">{fmtTime(alert.triggered_at)}</td>
                     <td className="px-4 py-3">
                       {alert.acknowledged ? (
-                        <span className="text-xs text-gray-500">acked</span>
+                        <span className="text-xs text-ink-muted">acked</span>
                       ) : (
                         <button
                           onClick={() => handleAcknowledge(alert.alert_id)}
-                          className="text-xs bg-gray-800 hover:bg-gray-700 text-gray-300 px-2 py-1 rounded transition-colors"
+                          className="text-xs bg-raised hover:bg-gray-700 text-ink-2 px-2 py-1 rounded transition-colors"
                         >
                           Acknowledge
                         </button>

drb-frontend/app/faq/page.tsx

@@ -68,7 +68,7 @@ function ChevronIcon({ open }: { open: boolean }) {
     <svg
       width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2"
       strokeLinecap="round" strokeLinejoin="round"
-      className={`text-gray-500 shrink-0 transition-transform ${open ? "rotate-180" : ""}`}
+      className={`text-ink-muted shrink-0 transition-transform ${open ? "rotate-180" : ""}`}
     >
       <polyline points="6 9 12 15 18 9" />
     </svg>
@@ -83,10 +83,10 @@ export default function FaqPage() {
       <div className="text-center">
         <Badge tone="brand">FAQ</Badge>
         <h1 className="text-display-sm md:text-display text-white mt-5">Frequently asked questions</h1>
-        <p className="text-gray-400 mt-4">Can&apos;t find what you&apos;re looking for? Sign in and reach out from your account.</p>
+        <p className="text-ink-2 mt-4">Can&apos;t find what you&apos;re looking for? Sign in and reach out from your account.</p>
       </div>
 
-      <div className="mt-12 divide-y divide-gray-800 border-t border-b border-gray-800">
+      <div className="mt-12 divide-y divide-line border-t border-b border-line">
         {FAQS.map((item, i) => {
           const open = openIndex === i;
           return (
@@ -100,7 +100,7 @@ export default function FaqPage() {
                 <ChevronIcon open={open} />
               </button>
               {open && (
-                <div className="text-gray-400 text-sm leading-relaxed pb-5 pr-8 animate-fade-in">{item.a}</div>
+                <div className="text-ink-2 text-sm leading-relaxed pb-5 pr-8 animate-fade-in">{item.a}</div>
               )}
             </div>
           );

drb-frontend/app/features/page.tsx

@@ -17,7 +17,7 @@ const SECTIONS: {
     body:
       "The correlation engine groups related transmissions — across talkgroups and even across nodes — into a single incident. A pursuit renders as a path through every checkin point heard while it moved; a structure fire or accident renders as a pin at the location dispatch gave.",
     points: [
-      "Hybrid rule + LLM correlation with a cheap/smart consensus tiebreak",
+      "Rules decide clear-cut matches; an LLM weighs in only on the ambiguous ones",
       "Distance, timing, shared units, and talkgroup signals all feed the match",
       "Every call keeps its correlation debug trail for admins to audit",
     ],
@@ -76,7 +76,7 @@ export default function FeaturesPage() {
       <div className="max-w-2xl">
         <Badge tone="brand">Features</Badge>
         <h1 className="text-display-sm md:text-display text-white mt-5">Everything between the radio and the map</h1>
-        <p className="text-gray-400 mt-4 leading-relaxed">
+        <p className="text-ink-2 mt-4 leading-relaxed">
           DRB is the pipeline from decoded radio traffic to a picture your team can act on: transcription,
           correlation, mapping, and a live relay — end to end.
         </p>
@@ -88,12 +88,12 @@ export default function FeaturesPage() {
             <div className="lg:col-span-2">
               <p className="text-indigo-400 text-xs font-mono uppercase tracking-wider font-semibold">{s.eyebrow}</p>
               <h2 className="text-white text-2xl font-bold mt-2">{s.title}</h2>
-              <p className="text-gray-400 mt-3 leading-relaxed">{s.body}</p>
+              <p className="text-ink-2 mt-3 leading-relaxed">{s.body}</p>
             </div>
             <Card padding="lg" className="lg:col-span-3">
               <ul className="space-y-3">
                 {s.points.map((p) => (
-                  <li key={p} className="flex items-start gap-3 text-sm text-gray-300">
+                  <li key={p} className="flex items-start gap-3 text-sm text-ink-2">
                     <span className="mt-1.5 w-1.5 h-1.5 rounded-full bg-indigo-500 shrink-0" />
                     {p}
                   </li>
@@ -107,7 +107,7 @@ export default function FeaturesPage() {
         ))}
       </div>
 
-      <div className="text-center mt-20 pt-16 border-t border-gray-800">
+      <div className="text-center mt-20 pt-16 border-t border-line">
         <h2 className="text-display-sm text-white">See it running on your own traffic</h2>
         <div className="mt-6">
           <LinkButton href="/login" size="lg">Get started</LinkButton>

drb-frontend/app/globals.css

@@ -4,6 +4,8 @@
 
 @import 'leaflet/dist/leaflet.css';
 
+/* Palette: "Iris" (2026-11) — graphite neutrals + one indigo-violet accent.
+ * Tailwind's gray/indigo scales are remapped to match in tailwind.config.ts. */
 /* ── Design tokens ────────────────────────────────────────────────────────────
  * Single source of truth for surface, ink and encoding colour. `:root` is the
  * LIGHT theme; `.dark` on <html> (set by ThemeProvider, darkMode: ["class"])
@@ -16,43 +18,43 @@
  * Do not add a hue here for a category; add a glyph.
  */
 :root {
-  --page:        #F4F6F9;
+  --page:        #F7F7F8;
   --surface:     #FFFFFF;
-  --raised:      #F7F9FB;
-  --line:        rgba(11,17,27,.11);
-  --line-strong: rgba(11,17,27,.22);
-  --ink:         #101620;
-  --ink-2:       #46536A;
-  --ink-muted:   #6B788C;
+  --raised:      #F2F2F5;
+  --line:        rgba(24,24,27,.10);
+  --line-strong: rgba(24,24,27,.20);
+  --ink:         #18181B;
+  --ink-2:       #52525B;
+  --ink-muted:   #6B6B76;
 
-  --accent:       #2A78D6;
-  --sev-moderate: #B07800;
-  --sev-major:    #C0281F;
+  --accent:       #5E6AD2;
+  --sev-moderate: #B54708;
+  --sev-major:    #D92D20;
 
-  --map-bg:    #E8ECF1;
-  --map-block: #DFE4EB;
+  --map-bg:    #ECECF0;
+  --map-block: #E1E1E8;
   --map-road:  #FFFFFF;
-  --map-water: #D3E2EE;
+  --map-water: #DADDF2;
 }
 
 .dark {
-  --page:        #0B0E13;
-  --surface:     #141922;
-  --raised:      #1B2230;
-  --line:        rgba(255,255,255,.09);
-  --line-strong: rgba(255,255,255,.17);
-  --ink:         #E8EBF0;
-  --ink-2:       #A5B0C2;
-  --ink-muted:   #77839A;
+  --page:        #08090A;
+  --surface:     #111214;
+  --raised:      #1A1B1F;
+  --line:        rgba(255,255,255,.08);
+  --line-strong: rgba(255,255,255,.16);
+  --ink:         #EDEDEF;
+  --ink-2:       #A9A9B3;
+  --ink-muted:   #8B8B96; /* 5.3:1 on raised — holds AA at 10-12px (#136) */
 
-  --accent:       #3987E5;
-  --sev-moderate: #C98500;
-  --sev-major:    #D03B3B;
+  --accent:       #8B93F0;
+  --sev-moderate: #FDB022;
+  --sev-major:    #F97066; /* 6.6:1 as text on surface (#136) */
 
-  --map-bg:    #0E131B;
-  --map-block: #161C26;
-  --map-road:  #232C3A;
-  --map-water: #12202E;
+  --map-bg:    #0D0E11;
+  --map-block: #16171B;
+  --map-road:  #26272D;
+  --map-water: #141729;
 }
 
 /* ── Base ─────────────────────────────────────────────────────────────────── */
@@ -69,7 +71,7 @@ html, body {
 
 /* Dark mode: raw gray-600/700 text sits ~2.4:1 on the near-black page — below
  * readable. Lift both to gray-500 (~4:1). */
-.dark .text-gray-600, .dark .text-gray-700 { color: #6b7280; }
+.dark .text-gray-600, .dark .text-gray-700 { color: #7A7A85; }
 
 /* ── Light mode overrides ─────────────────────────────────────────────────── */
 /*
@@ -80,34 +82,34 @@ html, body {
 
 /* Structural backgrounds */
 html:not(.dark),
-html:not(.dark) body                { background-color: #f1f5f9; color: #0f172a; }
-html:not(.dark) .bg-gray-950        { background-color: #f1f5f9 !important; }
-html:not(.dark) .bg-gray-950\/95    { background-color: rgba(241,245,249,0.95) !important; }
+html:not(.dark) body                { background-color: #f2f2f5; color: #18181b; }
+html:not(.dark) .bg-gray-950        { background-color: #f2f2f5 !important; }
+html:not(.dark) .bg-gray-950\/95    { background-color: rgba(242,242,245,0.95) !important; }
 html:not(.dark) .bg-gray-900        { background-color: #ffffff !important; }
 html:not(.dark) .bg-gray-900\/60    { background-color: rgba(255,255,255,0.85) !important; }
 html:not(.dark) .bg-gray-900\/50    { background-color: rgba(255,255,255,0.75) !important; }
 html:not(.dark) .bg-gray-900\/30    { background-color: rgba(255,255,255,0.50) !important; }
-html:not(.dark) .bg-gray-800        { background-color: #f1f5f9 !important; }
-html:not(.dark) .bg-gray-800\/60    { background-color: rgba(226,232,240,0.70) !important; }
-html:not(.dark) .bg-gray-800\/40    { background-color: rgba(241,245,249,0.60) !important; }
-html:not(.dark) .bg-gray-800\/30    { background-color: rgba(241,245,249,0.50) !important; }
-html:not(.dark) .bg-gray-700        { background-color: #e2e8f0 !important; }
+html:not(.dark) .bg-gray-800        { background-color: #f2f2f5 !important; }
+html:not(.dark) .bg-gray-800\/60    { background-color: rgba(228,228,231,0.70) !important; }
+html:not(.dark) .bg-gray-800\/40    { background-color: rgba(242,242,245,0.60) !important; }
+html:not(.dark) .bg-gray-800\/30    { background-color: rgba(242,242,245,0.50) !important; }
+html:not(.dark) .bg-gray-700        { background-color: #e4e4e7 !important; }
 
 /* Borders */
-html:not(.dark) .border-gray-800   { border-color: #e2e8f0 !important; }
-html:not(.dark) .border-gray-700   { border-color: #cbd5e1 !important; }
-html:not(.dark) .border-gray-600   { border-color: #94a3b8 !important; }
-html:not(.dark) .border-gray-800\/60 { border-color: #e2e8f0 !important; }
-html:not(.dark) .divide-gray-800 > * + * { border-color: #e2e8f0 !important; }
+html:not(.dark) .border-gray-800   { border-color: #e4e4e7 !important; }
+html:not(.dark) .border-gray-700   { border-color: #d4d4d8 !important; }
+html:not(.dark) .border-gray-600   { border-color: #a1a1aa !important; }
+html:not(.dark) .border-gray-800\/60 { border-color: #e4e4e7 !important; }
+html:not(.dark) .divide-gray-800 > * + * { border-color: #e4e4e7 !important; }
 
 /* Text */
-html:not(.dark) .text-white        { color: #0f172a !important; }
-html:not(.dark) .text-gray-100     { color: #1e293b !important; }
-html:not(.dark) .text-gray-200     { color: #1e293b !important; }
-html:not(.dark) .text-gray-300     { color: #334155 !important; }
-html:not(.dark) .text-gray-400     { color: #475569 !important; }
-html:not(.dark) .text-gray-500     { color: #64748b !important; }
-html:not(.dark) .text-gray-600     { color: #94a3b8 !important; }
+html:not(.dark) .text-white        { color: #18181b !important; }
+html:not(.dark) .text-gray-100     { color: #27272a !important; }
+html:not(.dark) .text-gray-200     { color: #27272a !important; }
+html:not(.dark) .text-gray-300     { color: #3f3f46 !important; }
+html:not(.dark) .text-gray-400     { color: #52525b !important; }
+html:not(.dark) .text-gray-500     { color: #6b6b76 !important; }
+html:not(.dark) .text-gray-600     { color: #a1a1aa !important; }
 
 /* …except on saturated fills (primary/danger/success buttons), where the fill
  * stays dark in both themes — remapping to navy made their labels unreadable. */
@@ -116,15 +118,15 @@ html:not(.dark) .text-white:is(.bg-accent, .bg-sev-major, .bg-sev-moderate,
   .bg-green-600, .bg-green-700, .bg-yellow-700, .bg-yellow-800, .bg-gray-600) { color: #ffffff !important; }
 
 /* Hover states */
-html:not(.dark) .hover\:bg-gray-900:hover  { background-color: #f8fafc !important; }
+html:not(.dark) .hover\:bg-gray-900:hover  { background-color: #fafafa !important; }
 html:not(.dark) .hover\:bg-gray-900\/50:hover { background-color: rgba(255,255,255,0.75) !important; }
-html:not(.dark) .hover\:bg-gray-800:hover  { background-color: #f1f5f9 !important; }
-html:not(.dark) .hover\:bg-gray-700:hover  { background-color: #e2e8f0 !important; }
-html:not(.dark) .active\:bg-gray-800:active { background-color: #f1f5f9 !important; }
+html:not(.dark) .hover\:bg-gray-800:hover  { background-color: #f2f2f5 !important; }
+html:not(.dark) .hover\:bg-gray-700:hover  { background-color: #e4e4e7 !important; }
+html:not(.dark) .active\:bg-gray-800:active { background-color: #f2f2f5 !important; }
 
 /* Hover text */
-html:not(.dark) .hover\:text-gray-300:hover { color: #334155 !important; }
-html:not(.dark) .hover\:text-gray-200:hover { color: #1e293b !important; }
+html:not(.dark) .hover\:text-gray-300:hover { color: #3f3f46 !important; }
+html:not(.dark) .hover\:text-gray-200:hover { color: #27272a !important; }
 
 /* ── Accent badge palette (dark → light) ─────────────────────────────────── */
 
@@ -162,11 +164,11 @@ html:not(.dark) .text-green-400    { color: #16a34a !important; }
 html:not(.dark) .border-green-800  { border-color: #86efac !important; }
 
 /* Unconfigured / Info */
-html:not(.dark) .bg-indigo-950     { background-color: #eef2ff !important; }
-html:not(.dark) .bg-indigo-900     { background-color: #eef2ff !important; }
-html:not(.dark) .text-indigo-300   { color: #4338ca !important; }
-html:not(.dark) .text-indigo-400   { color: #6366f1 !important; }
-html:not(.dark) .border-indigo-800 { border-color: #a5b4fc !important; }
+html:not(.dark) .bg-indigo-950     { background-color: #f0f1fd !important; }
+html:not(.dark) .bg-indigo-900     { background-color: #f0f1fd !important; }
+html:not(.dark) .text-indigo-300   { color: #4e58b8 !important; }
+html:not(.dark) .text-indigo-400   { color: #5e6ad2 !important; }
+html:not(.dark) .border-indigo-800 { border-color: #c8ccf6 !important; }
 
 /* ── Pulsing ring for recording nodes ────────────────────────────────────── */
 @keyframes pulse-ring {
@@ -191,6 +193,28 @@ html:not(.dark) .border-indigo-800 { border-color: #a5b4fc !important; }
   z-index: 0;
 }
 
+/* The legend floats above the map's stacking context, so it would cover the
+ * expanded layers list (both live in the right-hand column). Hide it while the
+ * list is open. */
+.relative:has(.leaflet-control-layers-expanded) > .drb-legend {
+  visibility: hidden;
+}
+
+/* "Dark" base layer (#136): the prod tile URL is bright OSM, so dark-theme
+ * overlay cards sat on a bright, busy map. Inverting the raster keeps the
+ * keyless OSM source (CARTO's dark_all CDN proved flaky, #117) while giving
+ * the overlays the dark ground their palette was chosen for. */
+.leaflet-tile-pane .drb-tiles-dark {
+  filter: invert(1) hue-rotate(180deg) brightness(0.9) contrast(0.9) saturate(0.6);
+}
+
+/* Leaflet popups stay white in both themes (their body text is a fixed
+ * gray-900), so the theme's muted ink — light grey in dark mode, ~2.9:1 on
+ * white — is pinned to a grey that holds AA on white (~6:1). */
+.leaflet-popup-content .text-ink-muted {
+  color: #5F5F69;
+}
+
 /* Pinned 511 camera tiles (MapView DotCameraLayer): strip Leaflet's tooltip
  * padding and let the tile's own theme colours show, so the tile is no bigger
  * than the video it holds. */
@@ -204,14 +228,22 @@ html:not(.dark) .border-indigo-800 { border-color: #a5b4fc !important; }
 }
 
 /* ── Form inputs ─────────────────────────────────────────────────────────── */
+/* Placeholders must read as hints, not values: Tailwind's default #9ca3af on
+ * the dark surface looked like filled-in text (e.g. /systems Local Area showed
+ * "Ossining / Westchester" next to "no area set"). Dimmer + italic in dark. */
+.dark input::placeholder,
+.dark textarea::placeholder {
+  color: #6E6E78;
+  font-style: italic;
+}
 html:not(.dark) input:not([type="submit"]):not([type="button"]):not([type="reset"]),
 html:not(.dark) select,
 html:not(.dark) textarea {
-  color: #0f172a;
+  color: #18181b;
 }
 html:not(.dark) input::placeholder,
 html:not(.dark) textarea::placeholder {
-  color: #94a3b8;
+  color: #a1a1aa;
 }
 
 /* ── Marketing/product surface additions (2026-08 overhaul) ─────────────────
@@ -222,8 +254,8 @@ html:not(.dark) textarea::placeholder {
  */
 
 /* Tinted accent surfaces (plan highlight cards, "included" checks, danger zones) */
-html:not(.dark) .bg-indigo-600\/10   { background-color: rgba(79,70,229,0.08) !important; }
-html:not(.dark) .border-indigo-600\/40 { border-color: rgba(79,70,229,0.35) !important; }
+html:not(.dark) .bg-indigo-600\/10   { background-color: rgba(94,106,210,0.08) !important; }
+html:not(.dark) .border-indigo-600\/40 { border-color: rgba(94,106,210,0.35) !important; }
 html:not(.dark) .bg-green-600\/10    { background-color: rgba(22,163,74,0.08) !important; }
 html:not(.dark) .bg-red-600\/10      { background-color: rgba(220,38,38,0.08) !important; }
 html:not(.dark) .border-red-600\/40  { border-color: rgba(220,38,38,0.35) !important; }
@@ -232,10 +264,10 @@ html:not(.dark) .border-yellow-600\/40 { border-color: rgba(202,138,4,0.35) !imp
 
 /* Marketing hero background — subtle radial glow, brand-neutral in both themes */
 .marketing-hero-bg {
-  background-image: radial-gradient(ellipse 80% 50% at 50% -10%, rgba(99,102,241,0.25), transparent 60%);
+  background-image: radial-gradient(ellipse 80% 50% at 50% -10%, rgba(94,106,210,0.25), transparent 60%);
 }
 html:not(.dark) .marketing-hero-bg {
-  background-image: radial-gradient(ellipse 80% 50% at 50% -10%, rgba(99,102,241,0.12), transparent 60%);
+  background-image: radial-gradient(ellipse 80% 50% at 50% -10%, rgba(94,106,210,0.12), transparent 60%);
 }
 
 /* Skeleton loading shimmer */

drb-frontend/app/incidents/[id]/page.tsx

@@ -2,7 +2,8 @@
 
 import dynamic from "next/dynamic";
 import { useMemo, useState } from "react";
-import { useParams, useRouter } from "next/navigation";
+import Link from "next/link";
+import { useParams } from "next/navigation";
 import { useIncident } from "@/lib/useIncidents";
 import { useCallsByIncident } from "@/lib/useCalls";
 import { useAuth } from "@/components/AuthProvider";
@@ -13,25 +14,17 @@ import { SeverityMark } from "@/components/marks/SeverityMark";
 import { isKnownSeverity } from "@/lib/severity";
 import { Button } from "@/components/ui/Button";
 import { MachineOutputNotice } from "@/components/ui/MachineOutputNotice";
-import type { CallRecord } from "@/lib/types";
+import { ErrorBanner } from "@/components/ui/EmptyState";
+import { errorMessage } from "@/lib/c2error";
+import { MAY_BE_MERGED_KM, pathStops, stopNumbers } from "@/lib/liveWall";
 
 const MapView = dynamic(() => import("@/components/MapView"), { ssr: false });
 
 const EARLIER_PAGE_SIZE = 8;
 
-function haversineKm(a: { lat: number; lng: number }, b: { lat: number; lng: number }): number {
-  const R = 6371;
-  const dLat = ((b.lat - a.lat) * Math.PI) / 180;
-  const dLng = ((b.lng - a.lng) * Math.PI) / 180;
-  const s =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos((a.lat * Math.PI) / 180) * Math.cos((b.lat * Math.PI) / 180) * Math.sin(dLng / 2) ** 2;
-  return R * 2 * Math.atan2(Math.sqrt(s), Math.sqrt(1 - s));
-}
-
-function elapsedLabel(startedAt: string, active: boolean, updatedAt: string): string {
+function elapsedLabel(startedAt: string, active: boolean, endedAt: string): string {
   const start = new Date(startedAt).getTime();
-  const end = active ? Date.now() : new Date(updatedAt).getTime();
+  const end = active ? Date.now() : new Date(endedAt).getTime();
   const mins = Math.max(0, Math.round((end - start) / 60000));
   if (mins < 60) return `${mins}m`;
   const hrs = Math.floor(mins / 60);
@@ -41,7 +34,6 @@ function elapsedLabel(startedAt: string, active: boolean, updatedAt: string): st
 export default function IncidentDetailPage() {
   const params = useParams();
   const id = params.id as string;
-  const router = useRouter();
 
   const { incident, loading } = useIncident(id);
   const { calls, loading: callsLoading } = useCallsByIncident(id);
@@ -49,31 +41,15 @@ export default function IncidentDetailPage() {
 
   const [summarizing, setSummarizing] = useState(false);
   const [resolving, setResolving] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
   const [earlierShown, setEarlierShown] = useState(EARLIER_PAGE_SIZE);
 
-  // Same ordering/filtering MapView's IncidentPathLayer uses, so the stop
-  // number shown on a spine entry matches the number on its map marker.
-  const geocodedCalls = useMemo(
-    () =>
-      calls
-        .filter((c): c is CallRecord & { location_coords: { lat: number; lng: number } } => !!c.location_coords)
-        .slice()
-        .sort((a, b) => a.started_at.localeCompare(b.started_at)),
-    [calls]
-  );
-  const stopNumberByCallId = useMemo(() => {
-    const m = new Map<string, number>();
-    geocodedCalls.forEach((c, i) => m.set(c.call_id, i + 1));
-    return m;
-  }, [geocodedCalls]);
-
-  const pathLengthKm = useMemo(() => {
-    let total = 0;
-    for (let i = 1; i < geocodedCalls.length; i++) {
-      total += haversineKm(geocodedCalls[i - 1].location_coords!, geocodedCalls[i].location_coords!);
-    }
-    return total;
-  }, [geocodedCalls]);
+  // Stop numbers and path length come from the same liveWall.pathStops() the
+  // map's IncidentPathLayer draws from (server-26#236), so the spine numbers
+  // exactly what the map numbers: only a movement incident (police/accident
+  // with a pursuit tag) is numbered, and an impossible-speed stop never is.
+  const path = useMemo(() => (incident ? pathStops(incident, calls) : null), [incident, calls]);
+  const stopNumberByCallId = useMemo(() => (path ? stopNumbers(path) : new Map<string, number>()), [path]);
 
   const newestFirst = useMemo(
     () => calls.slice().sort((a, b) => b.started_at.localeCompare(a.started_at)),
@@ -81,16 +57,20 @@ export default function IncidentDetailPage() {
   );
 
   async function handleResolve() {
+    // No reopen path exists (server-26#284), so resolving is final from the UI.
+    if (!window.confirm("Mark this incident resolved? This can't be undone from the app.")) return;
     setResolving(true);
+    setActionError(null);
     try { await c2api.updateIncident(id, { status: "resolved" }); }
-    catch (e) { console.error(e); }
+    catch (e) { setActionError(`Couldn't resolve: ${errorMessage(e)}`); }
     finally { setResolving(false); }
   }
 
   async function handleSummarize() {
     setSummarizing(true);
+    setActionError(null);
     try { await c2api.summarizeIncident(id); }
-    catch (e) { console.error(e); }
+    catch (e) { setActionError(`Couldn't regenerate the summary: ${errorMessage(e)}`); }
     finally { setSummarizing(false); }
   }
 
@@ -102,18 +82,23 @@ export default function IncidentDetailPage() {
   const unitsCleared = incident.units_cleared ?? [];
   const vehicles = incident.vehicles ?? [];
   const active = incident.status === "active";
+  // A manual resolve doesn't set resolved_at and updated_at can predate the
+  // last call, which showed "0m elapsed" on an 11-call incident — so a
+  // resolved incident runs to the latest of those and its newest call.
+  const resolvedEnd = [incident.resolved_at, incident.updated_at, newestFirst[0]?.ended_at, newestFirst[0]?.started_at]
+    .filter((t): t is string => !!t)
+    .reduce((a, b) => (b > a ? b : a), incident.started_at);
 
   const visible = newestFirst.slice(0, earlierShown);
   const remaining = newestFirst.length - visible.length;
 
   return (
     <div className="space-y-4">
-      <button
-        onClick={() => router.back()}
-        className="text-xs text-ink-muted hover:text-ink-2 transition-colors"
-      >
+      {/* A real link, not router.back(): arriving from Live or a shared URL,
+          "back" went to the map or out of the app. */}
+      <Link href="/incidents" className="text-xs text-ink-muted hover:text-ink-2 transition-colors">
         ← Incidents
-      </button>
+      </Link>
 
       {/* Header — glyph, severity chip, status, title at 27px, elapsed/path/count */}
       <div className="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-3">
@@ -129,8 +114,13 @@ export default function IncidentDetailPage() {
             {incident.title ?? "Incident"}
           </h1>
           <p className="text-xs text-ink-muted font-mono">
-            {elapsedLabel(incident.started_at, active, incident.updated_at)} elapsed
-            {pathLengthKm > 0 && <> · {pathLengthKm.toFixed(1)} km path</>}
+            {elapsedLabel(incident.started_at, active, resolvedEnd)} elapsed
+            {path?.movement && path.lengthKm > 0 && <> · {path.lengthKm.toFixed(1)} km path</>}
+            {path?.mayBeMerged && (
+              <span title={`The calls' locations span ${path.lengthKm.toFixed(0)} km (over ${MAY_BE_MERGED_KM} km) — this may be more than one event`}>
+                {" · "}may be merged
+              </span>
+            )}
             {" · "}{incident.call_ids.length} call{incident.call_ids.length !== 1 ? "s" : ""}
           </p>
         </div>
@@ -148,6 +138,8 @@ export default function IncidentDetailPage() {
         )}
       </div>
 
+      {actionError && <ErrorBanner message={actionError} />}
+
       {displayTags.length > 0 && (
         <div className="flex flex-wrap gap-1">
           {displayTags.map((t) => (

drb-frontend/app/incidents/page.tsx

@@ -6,6 +6,7 @@ import { useAuth } from "@/components/AuthProvider";
 import { useIncidents } from "@/lib/useIncidents";
 import { useActiveCalls } from "@/lib/useCalls";
 import { c2api } from "@/lib/c2api";
+import { errorMessage } from "@/lib/c2error";
 import type { IncidentRecord } from "@/lib/types";
 import { PageHeader } from "@/components/ui/PageHeader";
 import { Button } from "@/components/ui/Button";
@@ -204,6 +205,7 @@ export default function IncidentsPage() {
   const { incidents, loading, error, hasMore } = useIncidents(pageLimit, rangeFrom, rangeTo);
   const activeCalls = useActiveCalls();
   const [showCreate, setShowCreate] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
   const [severityFilter, setSeverityFilter] = useState<SeverityFilter>("all");
   const [sortMode, setSortMode] = useState<SortMode>("recent");
   const [statusFilter, setStatusFilter] = useState<StatusFilter>("any");
@@ -257,8 +259,11 @@ export default function IncidentsPage() {
   }, [filtered]);
 
   async function handleResolve(id: string) {
+    // No reopen path exists (server-26#284), so resolving is final from the UI.
+    if (!window.confirm("Mark this incident resolved? This can't be undone from the app.")) return;
+    setActionError(null);
     try { await c2api.updateIncident(id, { status: "resolved" }); }
-    catch (e) { console.error(e); }
+    catch (e) { setActionError(`Couldn't resolve: ${errorMessage(e)}`); }
   }
 
   return (
@@ -273,6 +278,8 @@ export default function IncidentsPage() {
           chips are pipeline output, so the notice rides with the list. */}
       <MachineOutputNotice variant="inline" />
 
+      {actionError && <ErrorBanner message={actionError} />}
+
       <div className="flex flex-wrap items-center justify-between gap-3">
         <div className="flex flex-wrap gap-1 bg-surface border border-line rounded-lg p-1 w-fit">
           {SEVERITY_FILTERS.map(({ key, label }) => (

drb-frontend/app/login/page.tsx

@@ -87,30 +87,30 @@ export default function LoginPage() {
         <span className="inline-flex items-center justify-center w-8 h-8 rounded-lg bg-indigo-600 text-white">D</span>
         DRB
       </Link>
-      <div className="bg-gray-900 border border-gray-700 rounded-xl p-8 space-y-5 font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl p-8 space-y-5 font-mono">
         <h1 className="text-white text-lg font-bold">Sign in</h1>
 
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Email</label>
+            <label className="text-xs text-ink-2 block mb-1">Email</label>
             <input
               type="email"
               value={email}
               onChange={(e) => setEmail(e.target.value)}
               required
               autoComplete="email"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Password</label>
+            <label className="text-xs text-ink-2 block mb-1">Password</label>
             <input
               type="password"
               value={password}
               onChange={(e) => setPassword(e.target.value)}
               required
               autoComplete="current-password"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           {error && (
@@ -127,7 +127,7 @@ export default function LoginPage() {
 
         <div className="flex items-center gap-3">
           <div className="flex-1 h-px bg-gray-700" />
-          <span className="text-xs text-gray-500">or</span>
+          <span className="text-xs text-ink-muted">or</span>
           <div className="flex-1 h-px bg-gray-700" />
         </div>
 
@@ -146,7 +146,7 @@ export default function LoginPage() {
           Continue with Google
         </button>
 
-        <p className="text-center text-xs text-gray-500">
+        <p className="text-center text-xs text-ink-muted">
           Don&apos;t have an account?{" "}
           <Link href="/signup" className="text-indigo-400 hover:text-indigo-300 transition-colors">Sign up</Link>
         </p>

drb-frontend/app/nodes/[id]/page.tsx

@@ -15,6 +15,8 @@ import { CallRow } from "@/components/CallRow";
 import { MachineOutputNotice } from "@/components/ui/MachineOutputNotice";
 import { useAuth } from "@/components/AuthProvider";
 import { c2api } from "@/lib/c2api";
+import { errorMessage } from "@/lib/c2error";
+import { diskState, DISK_TEXT_CLASS } from "@/lib/nodeDisk";
 import type { NodeRecord } from "@/lib/types";
 
 function ApprovalBadge({ status }: { status: string | null }) {
@@ -54,10 +56,14 @@ export default function NodeDetailPage() {
     return unsub;
   }, [id]);
 
-  async function sendCommand(action: string) {
+  async function sendCommand(action: string, label: string) {
     setSending(true);
     try {
       await c2api.sendCommand(id, { action });
+      alert(`${label} sent to the node.`);
+    } catch (e) {
+      // Was try/finally only: an unhandled rejection and no feedback (server-26#284).
+      alert(`Couldn't send ${label.toLowerCase()}: ${errorMessage(e)}`);
     } finally {
       setSending(false);
     }
@@ -125,7 +131,7 @@ export default function NodeDetailPage() {
   }
 
   if (!node) {
-    return <p className="text-gray-500 font-mono text-sm">Loading node…</p>;
+    return <p className="text-ink-muted font-mono text-sm">Loading node…</p>;
   }
 
   const system = systemMap[node.assigned_system_id ?? ""];
@@ -135,7 +141,7 @@ export default function NodeDetailPage() {
       <div className="flex items-start justify-between">
         <div>
           <h1 className="text-xl font-bold text-white font-mono">{node.name}</h1>
-          <p className="text-gray-500 text-sm font-mono">{node.node_id}</p>
+          <p className="text-ink-muted text-sm font-mono">{node.node_id}</p>
         </div>
         <StatusBadge status={node.status} />
       </div>
@@ -147,7 +153,7 @@ export default function NodeDetailPage() {
             <span className="text-base">⚠</span>
             <span>Local System Override Active</span>
           </div>
-          <p className="text-gray-400 text-xs leading-relaxed">
+          <p className="text-ink-2 text-xs leading-relaxed">
             This node is operating on a local system override. 
             {node.override_timeout_at ? (
               <> Resets automatically on: <span className="text-white font-bold">{new Date(node.override_timeout_at).toLocaleString()}</span>.</>
@@ -155,7 +161,8 @@ export default function NodeDetailPage() {
               <> No timeout is currently enforced (permanent override).</>
             )}
           </p>
-          <div className="flex gap-2">
+          {/* Override routes are require_service_key_or_admin (server-26#222). */}
+          {isAdmin && <div className="flex gap-2">
             {node.override_timeout_at && (
               <button
                 onClick={async () => {
@@ -184,12 +191,12 @@ export default function NodeDetailPage() {
             >
               Force Revert Config
             </button>
-          </div>
+          </div>}
         </div>
       )}
 
       {/* Info */}
-      <div className="bg-gray-900 border border-gray-800 rounded-lg divide-y divide-gray-800 font-mono text-sm">
+      <div className="bg-surface border border-line rounded-lg divide-y divide-line font-mono text-sm">
         {[
           ["System",    system?.name ?? "Unassigned"],
           ["Location",  `${node.lat}, ${node.lon}`],
@@ -208,12 +215,23 @@ export default function NodeDetailPage() {
           ...(node.node_type !== "portable" ? [["Enforce Timeout", node.enforce_override_timeout ? "Yes" : "No"]] : []),
         ].map(([label, value]) => (
           <div key={label} className="flex justify-between px-4 py-2.5">
-            <span className="text-gray-500">{label}</span>
-            <span className="text-gray-200">{value}</span>
+            <span className="text-ink-muted">{label}</span>
+            <span className="text-ink">{value}</span>
           </div>
         ))}
+        {(() => {
+          const disk = diskState(node);
+          return (
+            <div className="flex justify-between px-4 py-2.5">
+              <span className="text-ink-muted">Disk</span>
+              <span className={disk ? DISK_TEXT_CLASS[disk.level] : "text-ink-muted"}>
+                {disk ? `${disk.level !== "ok" ? "⚠ " : ""}${disk.label}` : "not reported (node software too old)"}
+              </span>
+            </div>
+          );
+        })()}
         <div className="flex justify-between px-4 py-2.5">
-          <span className="text-gray-500">Approval</span>
+          <span className="text-ink-muted">Approval</span>
           <ApprovalBadge status={node.approval_status ?? null} />
         </div>
       </div>
@@ -232,7 +250,7 @@ export default function NodeDetailPage() {
           <button
             onClick={handleReject}
             disabled={approving}
-            className="px-4 py-2 bg-red-900 hover:bg-red-800 disabled:opacity-50 text-gray-300 rounded-lg text-sm font-mono transition-colors"
+            className="px-4 py-2 bg-red-900 hover:bg-red-800 disabled:opacity-50 text-ink-2 rounded-lg text-sm font-mono transition-colors"
           >
             Reject
           </button>
@@ -240,25 +258,34 @@ export default function NodeDetailPage() {
       )}
 
       {/* Actions */}
+      {/* Configure and Restart are admin-only on the server (server-26#222);
+          non-admins get a note instead of a button that 403s. */}
+      {!isAdmin && !node.configured && (
+        <p className="text-sm text-ink-2">This node isn&apos;t configured yet. An admin needs to assign it a radio system.</p>
+      )}
       <div className="flex flex-wrap gap-3">
-        <button
-          onClick={() => setShowConfig(true)}
-          className="px-4 py-2 bg-indigo-700 hover:bg-indigo-600 text-white rounded-lg text-sm font-mono transition-colors"
-        >
-          {node.configured ? "Reassign System" : "Configure"}
-        </button>
-        <button
-          disabled={sending}
-          onClick={() => sendCommand("op25_restart")}
-          className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
-        >
-          Restart OP25
-        </button>
+        {isAdmin && (
+          <button
+            onClick={() => setShowConfig(true)}
+            className="px-4 py-2 bg-indigo-700 hover:bg-indigo-600 text-white rounded-lg text-sm font-mono transition-colors"
+          >
+            {node.configured ? "Reassign System" : "Configure"}
+          </button>
+        )}
+        {isAdmin && (
+          <button
+            disabled={sending}
+            onClick={() => sendCommand("op25_restart", "Restart OP25")}
+            className="px-4 py-2 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
+          >
+            Restart OP25
+          </button>
+        )}
         {isAdmin && (
           <button
             disabled={sending}
             onClick={handleRequestUpdate}
-            className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
+            className="px-4 py-2 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
           >
             Update Node Software
           </button>
@@ -283,16 +310,16 @@ export default function NodeDetailPage() {
 
       {/* Recent calls */}
       <section>
-        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider mb-3">Recent Calls</h2>
+        <h2 className="text-sm font-semibold text-ink-2 uppercase tracking-wider mb-3">Recent Calls</h2>
         {/* Gate A / A2 (server-26#46) — each row expands to a transcript. */}
         {nodeCalls.length > 0 && <MachineOutputNotice variant="inline" className="mb-3" />}
         {nodeCalls.length === 0 ? (
-          <p className="text-gray-600 text-sm font-mono">No calls recorded from this node.</p>
+          <p className="text-ink-muted text-sm font-mono">No calls recorded from this node.</p>
         ) : (
           <div className="overflow-x-auto">
             <table className="w-full text-sm">
               <thead>
-                <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+                <tr className="text-xs text-ink-muted uppercase tracking-wider border-b border-line">
                   <th className="px-4 py-2 text-left">Time</th>
                   <th className="px-4 py-2 text-left">Talkgroup</th>
                   <th className="px-4 py-2 text-left">System</th>

drb-frontend/app/nodes/page.tsx

@@ -65,7 +65,7 @@ export default function NodesPage() {
           <button
             onClick={handleUpdateAll}
             disabled={updatingAll}
-            className="px-4 py-2 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
+            className="px-4 py-2 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg text-sm font-mono transition-colors disabled:opacity-50"
           >
             {updatingAll ? "Requesting…" : "Update All Nodes"}
           </button>
@@ -79,22 +79,28 @@ export default function NodesPage() {
           </h2>
           <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
             {pending.map((n) => (
-              <div key={n.node_id} onClick={() => setConfigNode(n)} className="cursor-pointer">
-                <NodeCard node={n} system={systemMap[n.assigned_system_id ?? ""]} linkToDetail={false} />
-              </div>
+              // Configuring is admin-only on the server (server-26#222); for
+              // everyone else the card links to the node page instead.
+              isAdmin ? (
+                <div key={n.node_id} onClick={() => setConfigNode(n)} className="cursor-pointer">
+                  <NodeCard node={n} system={systemMap[n.assigned_system_id ?? ""]} linkToDetail={false} />
+                </div>
+              ) : (
+                <NodeCard key={n.node_id} node={n} system={systemMap[n.assigned_system_id ?? ""]} />
+              )
             ))}
           </div>
         </div>
       )}
 
       <div className="space-y-2">
-        <h2 className="text-sm font-semibold text-gray-400 uppercase tracking-wider">
+        <h2 className="text-sm font-semibold text-ink-2 uppercase tracking-wider">
           All Nodes ({nodes.length})
         </h2>
         {loading ? (
-          <p className="text-gray-600 text-sm font-mono">Loading…</p>
+          <p className="text-ink-muted text-sm font-mono">Loading…</p>
         ) : nodes.length === 0 ? (
-          <p className="text-gray-600 text-sm font-mono">No nodes registered yet. Boot a Pi to get started.</p>
+          <p className="text-ink-muted text-sm font-mono">No nodes registered yet. Boot a Pi to get started.</p>
         ) : (
           <div className="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-4">
             {nodes.map((n) => (

drb-frontend/app/onboarding/page.tsx

@@ -55,17 +55,17 @@ export default function OnboardingPage() {
 
   return (
     <div className="max-w-sm mx-auto pt-16">
-      <div className="bg-gray-900 border border-gray-700 rounded-xl p-8 space-y-5 font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl p-8 space-y-5 font-mono">
         <div>
           <h1 className="text-white text-lg font-bold">Set up your organization</h1>
-          <p className="text-gray-400 text-xs mt-2 leading-relaxed">
+          <p className="text-ink-2 text-xs mt-2 leading-relaxed">
             One more step — name the organization your nodes, calls, and incidents will belong to. You can change this later.
           </p>
         </div>
 
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Organization name</label>
+            <label className="text-xs text-ink-2 block mb-1">Organization name</label>
             <input
               type="text"
               value={orgName}
@@ -73,7 +73,7 @@ export default function OnboardingPage() {
               required
               autoFocus
               placeholder="e.g. Riverside County Scanner"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           {error && <p className="text-red-400 text-xs">{error}</p>}

drb-frontend/app/page.tsx

@@ -51,7 +51,7 @@ function MarketingHomePage() {
             <h1 className="text-display-sm md:text-display mt-5 text-white">
               See what&apos;s happening on the radio, as an incident — not a wall of calls.
             </h1>
-            <p className="text-gray-400 text-base md:text-lg mt-5 max-w-2xl leading-relaxed">
+            <p className="text-ink-2 text-base md:text-lg mt-5 max-w-2xl leading-relaxed">
               DRB turns field SDR nodes into a live public-safety picture: police/fire radio is decoded, transcribed,
               and correlated into incidents you can watch on a map or scrub back through in history — with a Discord
               bot to relay the audio live to your team.
@@ -68,7 +68,7 @@ function MarketingHomePage() {
       <section className="max-w-screen-xl mx-auto px-4 md:px-6 py-16 md:py-20">
         <div className="max-w-2xl mb-10">
           <h2 className="text-display-sm text-white">The unit of value is the incident</h2>
-          <p className="text-gray-400 mt-3">
+          <p className="text-ink-2 mt-3">
             A scanner feed is noise. DRB's job is to turn that noise into a small number of things you actually care
             about — and let you click into any one of them for the full picture.
           </p>
@@ -77,14 +77,14 @@ function MarketingHomePage() {
           {CAPABILITIES.map((c) => (
             <Card key={c.title} padding="lg" hover>
               <h3 className="text-white font-semibold">{c.title}</h3>
-              <p className="text-gray-400 text-sm mt-2 leading-relaxed">{c.body}</p>
+              <p className="text-ink-2 text-sm mt-2 leading-relaxed">{c.body}</p>
             </Card>
           ))}
         </div>
       </section>
 
       {/* How it works */}
-      <section className="border-t border-gray-800">
+      <section className="border-t border-line">
         <div className="max-w-screen-xl mx-auto px-4 md:px-6 py-16 md:py-20">
           <h2 className="text-display-sm text-white mb-10">How it works</h2>
           <div className="grid grid-cols-1 md:grid-cols-3 gap-8">
@@ -92,7 +92,7 @@ function MarketingHomePage() {
               <div key={s.n}>
                 <p className="text-indigo-400 font-mono text-sm font-bold">{s.n}</p>
                 <h3 className="text-white font-semibold mt-2">{s.title}</h3>
-                <p className="text-gray-400 text-sm mt-2 leading-relaxed">{s.body}</p>
+                <p className="text-ink-2 text-sm mt-2 leading-relaxed">{s.body}</p>
               </div>
             ))}
           </div>
@@ -100,12 +100,12 @@ function MarketingHomePage() {
       </section>
 
       {/* Pricing — Gate A (minutes #42/#62): no price on a public surface. */}
-      <section className="border-t border-gray-800">
+      <section className="border-t border-line">
         <div className="max-w-screen-xl mx-auto px-4 md:px-6 py-16 md:py-20">
           <div className="flex flex-col md:flex-row md:items-end justify-between gap-4">
             <div>
               <h2 className="text-display-sm text-white">Pricing is in development</h2>
-              <p className="text-gray-400 mt-2 max-w-xl">
+              <p className="text-ink-2 mt-2 max-w-xl">
                 We would rather talk to you about what you need than post a number we would have to
                 walk back. Tell us about your coverage area and we will figure it out together.
               </p>
@@ -118,10 +118,10 @@ function MarketingHomePage() {
       </section>
 
       {/* Final CTA */}
-      <section className="border-t border-gray-800">
+      <section className="border-t border-line">
         <div className="max-w-screen-xl mx-auto px-4 md:px-6 py-16 md:py-20 text-center">
           <h2 className="text-display-sm text-white">Bring your first node online</h2>
-          <p className="text-gray-400 mt-3 max-w-xl mx-auto">
+          <p className="text-ink-2 mt-3 max-w-xl mx-auto">
             Tell us about your coverage area. We will get you a node online and you will see incidents within minutes of your first call.
           </p>
           <div className="mt-8">

drb-frontend/app/pricing/page.tsx

@@ -15,7 +15,7 @@ export default function PricingPage() {
     <div className="max-w-screen-xl mx-auto px-4 md:px-6 py-16 md:py-20">
       <div className="text-center max-w-2xl mx-auto">
         <h1 className="text-display-sm md:text-display text-white">Pricing is in development</h1>
-        <p className="text-gray-400 mt-4">
+        <p className="text-ink-2 mt-4">
           We are still working out what a fair price looks like for the people who actually use this.
           Rather than post a number we would have to walk back, we would rather talk to you about what
           you need and what it is worth.
@@ -24,7 +24,7 @@ export default function PricingPage() {
 
       <Card padding="lg" className="mt-12 max-w-2xl mx-auto">
         <h2 className="text-white text-lg font-bold">What you get today</h2>
-        <p className="text-gray-400 text-sm mt-2 leading-relaxed">
+        <p className="text-ink-2 text-sm mt-2 leading-relaxed">
           The full incident pipeline — transcription, correlation into incidents, mapping, and the
           Discord relay. Node counts, seats, and history length are set per account while we work out
           the plan structure.
@@ -35,7 +35,7 @@ export default function PricingPage() {
       </Card>
 
       <div className="text-center mt-16">
-        <p className="text-gray-400">
+        <p className="text-ink-2">
           Questions?{" "}
           <Link href="/faq" className="text-indigo-400 hover:text-indigo-300 transition-colors">Check the FAQ</Link>
           {" "}or{" "}

drb-frontend/app/privacy/page.tsx

@@ -63,18 +63,18 @@ export default function PrivacyPage() {
       </div>
 
       <h1 className="text-display-sm text-white">Privacy Policy</h1>
-      <p className="text-gray-500 text-sm mt-2 font-mono">Draft — last structured {new Date().getFullYear()}</p>
+      <p className="text-ink-muted text-sm mt-2 font-mono">Draft — last structured {new Date().getFullYear()}</p>
 
       <div className="mt-10 space-y-8">
         {SECTIONS.map((s) => (
           <section key={s.heading}>
             <h2 className="text-white font-semibold">{s.heading}</h2>
-            <p className="text-gray-500 text-sm mt-2 leading-relaxed italic">{s.note}</p>
+            <p className="text-ink-muted text-sm mt-2 leading-relaxed italic">{s.note}</p>
           </section>
         ))}
       </div>
 
-      <p className="text-gray-600 text-xs font-mono mt-16">
+      <p className="text-ink-muted text-xs font-mono mt-16">
         Questions in the meantime? <Link href="/faq" className="text-indigo-400 hover:text-indigo-300 transition-colors">Check the FAQ</Link> or{" "}
         <Link href="/login" className="text-indigo-400 hover:text-indigo-300 transition-colors">sign in to reach us directly</Link>.
       </p>

drb-frontend/app/profile/page.tsx

@@ -92,13 +92,13 @@ export default function ProfilePage() {
         <div>
           <h1 className="text-white text-xl font-bold">{displayName}</h1>
           {user.displayName && user.email && (
-            <p className="text-gray-400 text-sm mt-0.5">{user.email}</p>
+            <p className="text-ink-2 text-sm mt-0.5">{user.email}</p>
           )}
           {role && (
             <span className={`inline-block mt-1 text-xs font-mono px-2 py-0.5 rounded-full ${
               role === "admin"    ? "bg-indigo-900 text-indigo-300" :
               role === "operator" ? "bg-green-900 text-green-300" :
-                                    "bg-gray-800 text-gray-400"
+                                    "bg-raised text-ink-2"
             }`}>
               {role === "admin" ? "Admin" : role === "operator" ? "Operator" : "Viewer"}
             </span>
@@ -107,9 +107,9 @@ export default function ProfilePage() {
       </div>
 
       {/* Firebase account */}
-      <section className="bg-gray-900 border border-gray-800 rounded-xl divide-y divide-gray-800">
+      <section className="bg-surface border border-line rounded-xl divide-y divide-line">
         <div className="px-4 py-3">
-          <p className="text-xs text-gray-500 uppercase tracking-wider font-mono mb-2">Account</p>
+          <p className="text-xs text-ink-muted uppercase tracking-wider font-mono mb-2">Account</p>
           <div className="space-y-2">
             <Row label="Email" value={user.email ?? "—"} />
             <Row label="UID" value={user.uid} mono truncate />
@@ -125,12 +125,12 @@ export default function ProfilePage() {
       </section>
 
       {/* Discord linking */}
-      <section className="bg-gray-900 border border-gray-800 rounded-xl overflow-hidden">
+      <section className="bg-surface border border-line rounded-xl overflow-hidden">
         <div className="px-4 py-3">
-          <p className="text-xs text-gray-500 uppercase tracking-wider font-mono mb-3">Discord</p>
+          <p className="text-xs text-ink-muted uppercase tracking-wider font-mono mb-3">Discord</p>
 
           {linkLoading ? (
-            <p className="text-gray-500 text-sm">Loading…</p>
+            <p className="text-ink-muted text-sm">Loading…</p>
           ) : linkStatus?.linked ? (
             <div className="space-y-3">
               <div className="space-y-2">
@@ -156,21 +156,21 @@ export default function ProfilePage() {
             </div>
           ) : (
             <div className="space-y-3">
-              <p className="text-sm text-gray-400">
+              <p className="text-sm text-ink-2">
                 Link your Discord account to access private trips from both the web and Discord.
               </p>
               {code ? (
                 <div className="space-y-2">
-                  <div className="bg-gray-800 rounded-lg px-4 py-3 flex items-center gap-3">
+                  <div className="bg-raised rounded-lg px-4 py-3 flex items-center gap-3">
                     <span className="font-mono text-2xl tracking-[0.4em] text-white select-all">{code}</span>
                   </div>
-                  <p className="text-xs text-gray-400">
-                    Run <span className="font-mono text-gray-200">/link {code}</span> in Discord. Code expires in {codeExpiry} minutes.
+                  <p className="text-xs text-ink-2">
+                    Run <span className="font-mono text-ink">/link {code}</span> in Discord. Code expires in {codeExpiry} minutes.
                   </p>
                   <button
                     onClick={generateCode}
                     disabled={generating}
-                    className="text-xs text-gray-500 hover:text-gray-300 transition-colors disabled:opacity-50"
+                    className="text-xs text-ink-muted hover:text-ink transition-colors disabled:opacity-50"
                   >
                     Generate new code
                   </button>
@@ -190,9 +190,9 @@ export default function ProfilePage() {
       </section>
 
       {/* Sign out */}
-      <section className="bg-gray-900 border border-gray-800 rounded-xl">
+      <section className="bg-surface border border-line rounded-xl">
         <div className="px-4 py-3 flex items-center justify-between">
-          <p className="text-sm text-gray-400">Sign out of this device</p>
+          <p className="text-sm text-ink-2">Sign out of this device</p>
           <button
             onClick={handleSignOut}
             className="text-sm text-red-500 hover:text-red-400 transition-colors"
@@ -213,8 +213,8 @@ function Row({ label, value, mono = false, truncate = false }: {
 }) {
   return (
     <div className="flex items-start justify-between gap-4">
-      <span className="text-xs text-gray-500 shrink-0">{label}</span>
-      <span className={`text-sm text-gray-200 text-right ${mono ? "font-mono text-xs" : ""} ${truncate ? "truncate max-w-[200px]" : ""}`}>
+      <span className="text-xs text-ink-muted shrink-0">{label}</span>
+      <span className={`text-sm text-ink text-right ${mono ? "font-mono text-xs" : ""} ${truncate ? "truncate max-w-[200px]" : ""}`}>
         {value}
       </span>
     </div>

drb-frontend/app/settings/api-keys/page.tsx

@@ -39,11 +39,11 @@ function CreateKeyModal({ onClose, onCreated }: { onClose: () => void; onCreated
       <div className="fixed inset-0 z-50 bg-black/70 flex items-center justify-center p-4">
         <Card padding="lg" className="w-full max-w-lg space-y-4">
           <h2 className="text-white font-semibold">Key created</h2>
-          <p className="text-xs text-gray-400">
+          <p className="text-xs text-ink-2">
             Copy this key now — it won&apos;t be shown again. This is a sample key from the demo module in{" "}
-            <code className="text-gray-300">lib/apiKeys.ts</code>; it doesn&apos;t authenticate against anything.
+            <code className="text-ink-2">lib/apiKeys.ts</code>; it doesn&apos;t authenticate against anything.
           </p>
-          <div className="bg-gray-800 border border-gray-700 rounded-lg p-3">
+          <div className="bg-raised border border-line-strong rounded-lg p-3">
             <p className="text-xs text-indigo-300 break-all font-mono">{rawKey}</p>
           </div>
           <div className="flex gap-3">
@@ -61,11 +61,11 @@ function CreateKeyModal({ onClose, onCreated }: { onClose: () => void; onCreated
         <h2 className="text-white font-semibold mb-4">New API key</h2>
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Label</label>
+            <label className="text-xs text-ink-2 block mb-1">Label</label>
             <input
               required value={name} onChange={(e) => setName(e.target.value)}
               placeholder="e.g. Ops dashboard integration"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div className="flex gap-3">
@@ -96,9 +96,9 @@ export default function ApiKeysSettingsPage() {
     <div className="space-y-4">
       <div className="bg-indigo-600/10 border border-indigo-600/40 rounded-xl p-4">
         <p className="text-indigo-300 text-sm font-semibold">Preview feature</p>
-        <p className="text-gray-400 text-xs mt-1 leading-relaxed">
+        <p className="text-ink-2 text-xs mt-1 leading-relaxed">
           Organization API keys aren&apos;t backed by a real endpoint yet — this screen runs against an in-memory
-          demo module (<code className="text-gray-300">lib/apiKeys.ts</code>) so the flow can be reviewed end to
+          demo module (<code className="text-ink-2">lib/apiKeys.ts</code>) so the flow can be reviewed end to
           end. See that file for the exact backend routes a real integration needs.
         </p>
       </div>
@@ -108,7 +108,7 @@ export default function ApiKeysSettingsPage() {
       )}
 
       <div className="flex items-center justify-between">
-        <p className="text-sm text-gray-500">{loading ? "Loading…" : `${active.length} active key${active.length !== 1 ? "s" : ""}`}</p>
+        <p className="text-sm text-ink-muted">{loading ? "Loading…" : `${active.length} active key${active.length !== 1 ? "s" : ""}`}</p>
         <Button size="sm" onClick={() => setShowCreate(true)}>+ Create key</Button>
       </div>
 
@@ -118,7 +118,7 @@ export default function ApiKeysSettingsPage() {
         <Card padding="none" className="overflow-hidden">
           <table className="w-full text-sm">
             <thead>
-              <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800 bg-gray-900">
+              <tr className="text-xs text-ink-muted uppercase tracking-wider border-b border-line bg-surface">
                 <th className="px-4 py-3 text-left">Label</th>
                 <th className="px-4 py-3 text-left">Key</th>
                 <th className="px-4 py-3 text-left hidden sm:table-cell">Created</th>
@@ -129,11 +129,11 @@ export default function ApiKeysSettingsPage() {
             </thead>
             <tbody>
               {keys.map((k) => (
-                <tr key={k.key_id} className="border-b border-gray-800 last:border-0">
+                <tr key={k.key_id} className="border-b border-line last:border-0">
                   <td className="px-4 py-3 text-white">{k.name}</td>
-                  <td className="px-4 py-3 text-gray-500 font-mono text-xs">{k.key_prefix}…</td>
-                  <td className="px-4 py-3 text-gray-400 text-xs hidden sm:table-cell">{fmtDate(k.created_at)}</td>
-                  <td className="px-4 py-3 text-gray-400 text-xs hidden sm:table-cell">{k.last_used_at ? fmtDate(k.last_used_at) : "Never"}</td>
+                  <td className="px-4 py-3 text-ink-muted font-mono text-xs">{k.key_prefix}…</td>
+                  <td className="px-4 py-3 text-ink-2 text-xs hidden sm:table-cell">{fmtDate(k.created_at)}</td>
+                  <td className="px-4 py-3 text-ink-2 text-xs hidden sm:table-cell">{k.last_used_at ? fmtDate(k.last_used_at) : "Never"}</td>
                   <td className="px-4 py-3">
                     {k.revoked ? <Badge tone="danger">Revoked</Badge> : <Badge tone="success">Active</Badge>}
                   </td>

drb-frontend/app/settings/billing/page.tsx

@@ -54,12 +54,12 @@ function UsageBar({ label, used, limit }: { label: string; used: number; limit:
   return (
     <div>
       <div className="flex items-baseline justify-between mb-1.5">
-        <span className="text-xs text-gray-400 font-mono">{label}</span>
-        <span className="text-xs font-mono text-gray-300">
+        <span className="text-xs text-ink-2 font-mono">{label}</span>
+        <span className="text-xs font-mono text-ink-2">
           {used} / {limit === "unlimited" ? "∞" : limit}
         </span>
       </div>
-      <div className="h-2 rounded-full bg-gray-800 overflow-hidden">
+      <div className="h-2 rounded-full bg-raised overflow-hidden">
         <div
           className={`h-full rounded-full transition-all ${nearLimit ? "bg-orange-500" : "bg-indigo-500"}`}
           style={{ width: limit === "unlimited" ? "8%" : `${pct}%` }}
@@ -142,7 +142,7 @@ export default function BillingSettingsPage() {
 
   return (
     <div className="space-y-6 max-w-4xl">
-      <p className="text-xs text-gray-600 font-mono">
+      <p className="text-xs text-ink-muted font-mono">
         Demo data — this page isn&apos;t connected to a live payment processor. See lib/billing.ts for the integration plan.
       </p>
 
@@ -164,7 +164,7 @@ export default function BillingSettingsPage() {
           <UsageBar label="Seats" used={usage.seatsUsed} limit={usage.seatsLimit} />
           <UsageBar label="Nodes" used={usage.nodesUsed} limit={usage.nodesLimit} />
         </div>
-        <div className="mt-5 pt-5 border-t border-gray-800">
+        <div className="mt-5 pt-5 border-t border-line">
           <Button variant="secondary" size="sm" onClick={handleManageBilling} disabled={portalBusy}>
             {portalBusy ? "Opening…" : "Manage payment method & invoices"}
           </Button>
@@ -179,10 +179,10 @@ export default function BillingSettingsPage() {
             return (
               <div
                 key={p.id}
-                className={`rounded-xl border p-4 flex flex-col ${p.highlighted ? "border-indigo-600/40" : "border-gray-800"}`}
+                className={`rounded-xl border p-4 flex flex-col ${p.highlighted ? "border-indigo-600/40" : "border-line"}`}
               >
                 <p className="text-white font-semibold text-sm">{p.name}</p>
-                <p className="text-gray-500 text-xs mt-1 flex-1">{p.tagline}</p>
+                <p className="text-ink-muted text-xs mt-1 flex-1">{p.tagline}</p>
                 {(UNBUILT_CLAIMS[p.id] ?? []).length > 0 && (
                   <div className="flex flex-wrap gap-1 mt-2">
                     {(UNBUILT_CLAIMS[p.id] ?? []).map((claim) => (
@@ -212,17 +212,17 @@ export default function BillingSettingsPage() {
       <Card>
         <CardHeader title="Invoice history" />
         {invoices.length === 0 ? (
-          <p className="text-gray-600 text-sm">No invoices yet.</p>
+          <p className="text-ink-muted text-sm">No invoices yet.</p>
         ) : (
-          <div className="divide-y divide-gray-800">
+          <div className="divide-y divide-line">
             {invoices.map((inv) => (
               <div key={inv.id} className="flex items-center justify-between gap-4 py-3">
                 <div className="min-w-0">
-                  <p className="text-gray-200 text-sm">{inv.description}</p>
-                  <p className="text-gray-600 text-xs font-mono">{fmtDate(inv.date)}</p>
+                  <p className="text-ink text-sm">{inv.description}</p>
+                  <p className="text-ink-muted text-xs font-mono">{fmtDate(inv.date)}</p>
                 </div>
                 <div className="flex items-center gap-3 shrink-0">
-                  <span className="text-gray-300 text-sm font-mono">${inv.amountUsd.toFixed(2)}</span>
+                  <span className="text-ink-2 text-sm font-mono">${inv.amountUsd.toFixed(2)}</span>
                   <Badge tone={INVOICE_TONE[inv.status]}>{inv.status}</Badge>
                 </div>
               </div>

drb-frontend/app/settings/discord/page.tsx

@@ -43,8 +43,8 @@ function Kpi({ k, v, s }: { k: string; v: string; s: string }) {
 
 function HowItWorks() {
   const steps = [
-    ["1 · Desired", "/join in Discord or this page writes a discord_streams doc."],
-    ["2 · Lease", "C2 picks an online node on that system and a radio bot already in that server, in one transaction."],
+    ["1 · Desired", "A node page's picker, this page, or /join (DRB server bot) writes a discord_streams doc."],
+    ["2 · Lease", "C2 picks an online node on that system and a radio bot already in that server that Discord lets View, Connect and Speak in the channel — the system's preferred bot first — in one transaction."],
     ["3 · Reconcile", "A retained MQTT message tells the node its full channel list (token ids, never token strings)."],
     ["4 · Voice", "The node logs in as the leased bot and plays its PulseAudio capture — never Icecast."],
     ["5 · Actual", "The node reports each channel's real state; this page and the Discord reply show it."],
@@ -54,6 +54,12 @@ function HowItWorks() {
       title="How a radio channel stays up"
       note="Node reboot, C2 sweep, Discord voice drop: the node re-reads its desired state and reconnects; persistent channels whose node went away are re-placed on another node. A channel desired-on but not connected for 2 minutes turns red on the Radio channels tab."
     >
+      <p className="px-4 pt-4 text-xs text-ink-2">
+        <b className="text-ink">The DRB server bot is optional.</b> One radio bot in a Discord server is enough: adding it
+        through <i>Connect a Discord server</i> (Settings → Organization) links the server, and C2 reads its voice
+        channels and permissions with that bot. The server bot adds the slash commands (/join, /leave, /status,
+        /drb link) and pushes its own channel list; both ways keep working side by side.
+      </p>
       <div className="grid gap-2 p-4 grid-cols-1 sm:grid-cols-2 lg:grid-cols-5">
         {steps.map(([t, d]) => (
           <div key={t} className="bg-raised border border-line rounded-lg p-3 text-xs text-ink-muted">

drb-frontend/app/settings/layout.tsx

@@ -43,15 +43,15 @@ export default function SettingsLayout({ children }: { children: React.ReactNode
         description="Organization profile, team access, node ownership, API keys, and billing."
       />
 
-      <div className="flex flex-wrap gap-1 bg-gray-900 border border-gray-800 rounded-lg p-1 w-fit max-w-full overflow-x-auto">
+      <div className="flex flex-wrap gap-1 bg-surface border border-line rounded-lg p-1 w-fit max-w-full overflow-x-auto">
         {[...TABS, ...(isAdmin ? ADMIN_TABS : [])].map((t) => (
           <Link
             key={t.href}
             href={t.href}
             className={`text-sm font-mono px-4 py-1.5 rounded-md transition-colors whitespace-nowrap ${
               pathname === t.href || pathname.startsWith(t.href + "/")
-                ? "bg-gray-800 text-white"
-                : "text-gray-500 hover:text-gray-300"
+                ? "bg-raised text-white"
+                : "text-ink-muted hover:text-ink"
             }`}
           >
             {t.label}

drb-frontend/app/settings/members/page.tsx

@@ -46,8 +46,8 @@ function InviteModal({ onClose, onCreated }: { onClose: () => void; onCreated: (
       <div className="fixed inset-0 z-50 bg-black/70 flex items-center justify-center p-4">
         <Card padding="lg" className="w-full max-w-md space-y-4">
           <h2 className="text-white font-semibold">Member invited</h2>
-          <p className="text-xs text-gray-400">Share this one-time invite link so they can set their password. It expires after use.</p>
-          <div className="bg-gray-800 border border-gray-700 rounded-lg p-3">
+          <p className="text-xs text-ink-2">Share this one-time invite link so they can set their password. It expires after use.</p>
+          <div className="bg-raised border border-line-strong rounded-lg p-3">
             <p className="text-xs text-indigo-300 break-all">{inviteLink}</p>
           </div>
           <Button onClick={onClose} fullWidth>Done</Button>
@@ -62,18 +62,18 @@ function InviteModal({ onClose, onCreated }: { onClose: () => void; onCreated: (
         <h2 className="text-white font-semibold mb-4">Invite a member</h2>
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Email</label>
+            <label className="text-xs text-ink-2 block mb-1">Email</label>
             <input
               type="email" required value={email} onChange={(e) => setEmail(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
               placeholder="teammate@example.com"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Role</label>
+            <label className="text-xs text-ink-2 block mb-1">Role</label>
             <select
               value={role} onChange={(e) => setRole(e.target.value as UserRole)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             >
               <option value="admin">Admin — full access</option>
               <option value="operator">Operator — owns nodes</option>
@@ -130,7 +130,7 @@ export default function MembersSettingsPage() {
       )}
 
       <div className="flex items-center justify-between">
-        <p className="text-sm text-gray-500">
+        <p className="text-sm text-ink-muted">
           {loading ? "Loading members…" : `${users.length} member${users.length !== 1 ? "s" : ""}`}
         </p>
         <Button size="sm" onClick={() => setShowInvite(true)}>+ Invite member</Button>
@@ -144,7 +144,7 @@ export default function MembersSettingsPage() {
         <Card padding="none" className="overflow-hidden">
           <table className="w-full text-sm">
             <thead>
-              <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800 bg-gray-900">
+              <tr className="text-xs text-ink-muted uppercase tracking-wider border-b border-line bg-surface">
                 <th className="px-4 py-3 text-left">Member</th>
                 <th className="px-4 py-3 text-left">Role</th>
                 <th className="px-4 py-3 text-left hidden sm:table-cell">Owned nodes</th>
@@ -155,10 +155,10 @@ export default function MembersSettingsPage() {
               {loading
                 ? Array.from({ length: 3 }).map((_, i) => <SkeletonRow key={i} cols={4} />)
                 : users.map((u) => (
-                    <tr key={u.uid} className="border-b border-gray-800 last:border-0">
+                    <tr key={u.uid} className="border-b border-line last:border-0">
                       <td className="px-4 py-3">
                         <p className="text-white">{u.display_name || u.email}</p>
-                        {u.display_name && <p className="text-gray-600 text-xs">{u.email}</p>}
+                        {u.display_name && <p className="text-ink-muted text-xs">{u.email}</p>}
                       </td>
                       <td className="px-4 py-3">
                         {u.uid === user?.uid ? (
@@ -168,7 +168,7 @@ export default function MembersSettingsPage() {
                             value={u.role}
                             disabled={savingUid === u.uid}
                             onChange={(e) => handleRoleChange(u, e.target.value as UserRole)}
-                            className="bg-gray-800 border border-gray-700 rounded-lg px-2 py-1 text-xs text-white focus:outline-none focus:border-indigo-500 disabled:opacity-50"
+                            className="bg-raised border border-line-strong rounded-lg px-2 py-1 text-xs text-white focus:outline-none focus:border-indigo-500 disabled:opacity-50"
                           >
                             <option value="admin">Admin</option>
                             <option value="operator">Operator</option>
@@ -176,7 +176,7 @@ export default function MembersSettingsPage() {
                           </select>
                         )}
                       </td>
-                      <td className="px-4 py-3 text-gray-400 text-xs hidden sm:table-cell">
+                      <td className="px-4 py-3 text-ink-2 text-xs hidden sm:table-cell">
                         {u.role === "operator" ? u.owned_node_ids.length : "—"}
                       </td>
                       <td className="px-4 py-3 hidden md:table-cell">
@@ -189,7 +189,7 @@ export default function MembersSettingsPage() {
         </Card>
       )}
 
-      <p className="text-xs text-gray-600 font-mono">
+      <p className="text-xs text-ink-muted font-mono">
         Need to disable or delete a member? Use the full user admin panel under Admin → Users.
       </p>
     </div>

drb-frontend/app/settings/nodes/page.tsx

@@ -114,7 +114,7 @@ function EnrollmentTokensPanel() {
           </p>
 
           <div className="flex items-start gap-2">
-            <p className="flex-1 text-xs text-indigo-100 font-mono break-all bg-gray-900 rounded px-2 py-1.5">{justMinted}</p>
+            <p className="flex-1 text-xs text-indigo-100 font-mono break-all bg-surface rounded px-2 py-1.5">{justMinted}</p>
             <button
               type="button"
               onClick={() => navigator.clipboard?.writeText(justMinted).then(() => {
@@ -133,7 +133,7 @@ function EnrollmentTokensPanel() {
               : <>(check the broker host)</>}:
           </p>
           <div className="flex items-start gap-2">
-            <pre className="flex-1 text-xs text-indigo-100 font-mono whitespace-pre-wrap break-all bg-gray-900 rounded px-2 py-1.5">{installCmd}</pre>
+            <pre className="flex-1 text-xs text-indigo-100 font-mono whitespace-pre-wrap break-all bg-surface rounded px-2 py-1.5">{installCmd}</pre>
             <button
               type="button"
               onClick={() => navigator.clipboard?.writeText(installCmd).then(() => {
@@ -163,7 +163,7 @@ function EnrollmentTokensPanel() {
             value={label}
             onChange={(e) => setLabel(e.target.value)}
             placeholder="Node ID, e.g. node-003"
-            className="flex-1 min-w-[12rem] bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="flex-1 min-w-[12rem] bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
           <Button type="submit" size="sm" disabled={minting || !label.trim()}>
             {minting ? "Minting…" : "New token"}
@@ -176,11 +176,11 @@ function EnrollmentTokensPanel() {
           <SkeletonRow cols={1} />
         </div>
       ) : tokens.length === 0 ? (
-        <p className="text-gray-600 text-xs">No enrollment tokens yet.</p>
+        <p className="text-ink-muted text-xs">No enrollment tokens yet.</p>
       ) : (
         <table className="w-full text-sm">
           <thead>
-            <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800">
+            <tr className="text-xs text-ink-muted uppercase tracking-wider border-b border-line">
               <th className="py-2 text-left">Label</th>
               <th className="py-2 text-left hidden sm:table-cell">Created</th>
               <th className="py-2 text-left">Status</th>
@@ -189,14 +189,14 @@ function EnrollmentTokensPanel() {
           </thead>
           <tbody>
             {tokens.map((t) => (
-              <tr key={t.token_id} className="border-b border-gray-800 last:border-0">
+              <tr key={t.token_id} className="border-b border-line last:border-0">
                 <td className="py-2 text-white">{t.label}</td>
-                <td className="py-2 text-gray-500 text-xs hidden sm:table-cell">
+                <td className="py-2 text-ink-muted text-xs hidden sm:table-cell">
                   {new Date(t.created_at).toLocaleDateString()}
                 </td>
                 <td className="py-2 text-xs">
                   {t.revoked ? (
-                    <span className="text-gray-600">Revoked</span>
+                    <span className="text-ink-muted">Revoked</span>
                   ) : (
                     <span className="text-green-400">Active · {t.uses} use{t.uses !== 1 ? "s" : ""}</span>
                   )}
@@ -283,7 +283,7 @@ export default function NodeOwnershipSettingsPage() {
       <EnrollmentTokensPanel />
 
       <div className="space-y-4">
-        <p className="text-sm text-gray-500">
+        <p className="text-sm text-ink-muted">
           Assign each node to the operator responsible for it. Operators only see and manage the nodes assigned to them here.
         </p>
 
@@ -292,7 +292,7 @@ export default function NodeOwnershipSettingsPage() {
       <Card padding="none" className="overflow-hidden">
         <table className="w-full text-sm">
           <thead>
-            <tr className="text-xs text-gray-500 uppercase tracking-wider border-b border-gray-800 bg-gray-900">
+            <tr className="text-xs text-ink-muted uppercase tracking-wider border-b border-line bg-surface">
               <th className="px-4 py-3 text-left">Node</th>
               <th className="px-4 py-3 text-left hidden sm:table-cell">Status</th>
               <th className="px-4 py-3 text-left">Owner</th>
@@ -302,17 +302,17 @@ export default function NodeOwnershipSettingsPage() {
             {loading ? (
               Array.from({ length: 3 }).map((_, i) => <SkeletonRow key={i} cols={3} />)
             ) : nodes.length === 0 ? (
-              <tr><td colSpan={3} className="px-4 py-8 text-center text-gray-600 text-sm">No nodes registered yet.</td></tr>
+              <tr><td colSpan={3} className="px-4 py-8 text-center text-ink-muted text-sm">No nodes registered yet.</td></tr>
             ) : (
               nodes.map((n) => {
                 const owner = ownerByNode.get(n.node_id);
                 return (
-                  <tr key={n.node_id} className="border-b border-gray-800 last:border-0">
+                  <tr key={n.node_id} className="border-b border-line last:border-0">
                     <td className="px-4 py-3">
                       <Link href={`/nodes/${n.node_id}`} className="text-white hover:text-indigo-300 transition-colors">
                         {n.name}
                       </Link>
-                      <p className="text-gray-600 text-xs font-mono">{n.node_id}</p>
+                      <p className="text-ink-muted text-xs font-mono">{n.node_id}</p>
                     </td>
                     <td className="px-4 py-3 hidden sm:table-cell"><StatusBadge status={n.status} /></td>
                     <td className="px-4 py-3">
@@ -320,7 +320,7 @@ export default function NodeOwnershipSettingsPage() {
                         value={owner?.uid ?? UNASSIGNED}
                         disabled={savingNodeId === n.node_id}
                         onChange={(e) => reassign(n.node_id, e.target.value)}
-                        className="bg-gray-800 border border-gray-700 rounded-lg px-2 py-1.5 text-xs text-white focus:outline-none focus:border-indigo-500 disabled:opacity-50 max-w-[14rem]"
+                        className="bg-raised border border-line-strong rounded-lg px-2 py-1.5 text-xs text-white focus:outline-none focus:border-indigo-500 disabled:opacity-50 max-w-[14rem]"
                       >
                         <option value={UNASSIGNED}>Unassigned</option>
                         {assignable.map((u) => (

drb-frontend/app/settings/organization/page.tsx

@@ -16,7 +16,7 @@ import { PreferredBotsCard } from "@/components/discord/PreferredBotsCard";
 function StatTile({ label, value }: { label: string; value: string | number }) {
   return (
     <div>
-      <p className="text-xs text-gray-500 uppercase tracking-wider font-mono">{label}</p>
+      <p className="text-xs text-ink-muted uppercase tracking-wider font-mono">{label}</p>
       <p className="text-2xl font-bold text-white font-mono mt-1">{value}</p>
     </div>
   );
@@ -69,12 +69,12 @@ export default function OrganizationSettingsPage() {
         />
         <div className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Organization name</label>
+            <label className="text-xs text-ink-2 block mb-1">Organization name</label>
             <input
               value={orgName}
               disabled={orgLoading || !canEdit}
               onChange={(e) => setOrgName(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 disabled:opacity-50"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 disabled:opacity-50"
             />
           </div>
           {saveError && <p className="text-red-400 text-xs">{saveError}</p>}
@@ -110,7 +110,7 @@ export default function OrganizationSettingsPage() {
             value={sub ? sub.status.replace("_", " ") : "—"}
           />
         </div>
-        <div className="mt-5 pt-5 border-t border-gray-800 flex items-center gap-4 text-sm">
+        <div className="mt-5 pt-5 border-t border-line flex items-center gap-4 text-sm">
           <Link href="/settings/billing" className="text-indigo-400 hover:text-indigo-300 transition-colors">
             Manage plan & billing →
           </Link>
@@ -124,7 +124,7 @@ export default function OrganizationSettingsPage() {
 
       <PreferredBotsCard canEdit={canEdit} />
 
-      <div className="bg-gray-900 border border-red-800/60 rounded-xl p-5">
+      <div className="bg-surface border border-red-800/60 rounded-xl p-5">
         <CardHeader title="Danger zone" subtitle="Destructive organization-level actions." />
         <div className="flex flex-wrap gap-3">
           <Button variant="danger" size="sm" disabled title="Not available in this build — contact support">

drb-frontend/app/signup/page.tsx

@@ -61,23 +61,23 @@ export default function SignupPage() {
         <span className="inline-flex items-center justify-center w-8 h-8 rounded-lg bg-indigo-600 text-white">D</span>
         DRB
       </Link>
-      <div className="bg-gray-900 border border-gray-700 rounded-xl p-8 space-y-5 font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl p-8 space-y-5 font-mono">
         <h1 className="text-white text-lg font-bold">Create your account</h1>
 
         <form onSubmit={handleSubmit} className="space-y-4">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Email</label>
+            <label className="text-xs text-ink-2 block mb-1">Email</label>
             <input
               type="email"
               value={email}
               onChange={(e) => setEmail(e.target.value)}
               required
               autoComplete="email"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Password</label>
+            <label className="text-xs text-ink-2 block mb-1">Password</label>
             <input
               type="password"
               value={password}
@@ -85,7 +85,7 @@ export default function SignupPage() {
               required
               minLength={6}
               autoComplete="new-password"
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           {error && (
@@ -102,7 +102,7 @@ export default function SignupPage() {
 
         <div className="flex items-center gap-3">
           <div className="flex-1 h-px bg-gray-700" />
-          <span className="text-xs text-gray-500">or</span>
+          <span className="text-xs text-ink-muted">or</span>
           <div className="flex-1 h-px bg-gray-700" />
         </div>
 
@@ -121,7 +121,7 @@ export default function SignupPage() {
           Continue with Google
         </button>
 
-        <p className="text-center text-xs text-gray-500">
+        <p className="text-center text-xs text-ink-muted">
           Already have an account?{" "}
           <Link href="/login" className="text-indigo-400 hover:text-indigo-300 transition-colors">Sign in</Link>
         </p>

drb-frontend/app/systems/page.tsx

@@ -438,17 +438,17 @@ function RRImportModal({
 
   return (
     <div className="fixed inset-0 z-50 bg-black/70 flex items-center justify-center p-4">
-      <div className="bg-gray-900 border border-gray-700 rounded-xl w-full max-w-lg max-h-[90vh] flex flex-col font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl w-full max-w-lg max-h-[90vh] flex flex-col font-mono">
         {/* Header */}
-        <div className="px-5 pt-5 pb-4 border-b border-gray-800">
+        <div className="px-5 pt-5 pb-4 border-b border-line">
           <h2 className="text-white font-semibold">{system.name}</h2>
-          <p className="text-xs text-gray-500 mt-0.5">
+          <p className="text-xs text-ink-muted mt-0.5">
             {system.systemType}{system.location ? ` · ${system.location}` : ""}
           </p>
           {system.sysIds && (
-            <p className="text-xs text-gray-600 mt-0.5">System IDs: {system.sysIds}</p>
+            <p className="text-xs text-ink-muted mt-0.5">System IDs: {system.sysIds}</p>
           )}
-          <p className="text-xs text-gray-500 mt-1">
+          <p className="text-xs text-ink-muted mt-1">
             {system.categories.length} categor{system.categories.length !== 1 ? "ies" : "y"} · {total} talkgroups
           </p>
         </div>
@@ -456,7 +456,7 @@ function RRImportModal({
         {/* Category list */}
         <div className="flex-1 overflow-y-auto px-5 py-4 space-y-1.5">
           <div className="flex items-center justify-between mb-2">
-            <p className="text-xs text-gray-400 uppercase tracking-wider">Talkgroup Categories</p>
+            <p className="text-xs text-ink-2 uppercase tracking-wider">Talkgroup Categories</p>
             <div className="flex gap-3 text-xs text-indigo-400">
               <button
                 type="button"
@@ -480,18 +480,18 @@ function RRImportModal({
                 type="checkbox"
                 checked={selected.has(cat.name)}
                 onChange={() => toggle(cat.name)}
-                className="rounded border-gray-600 bg-gray-800 accent-indigo-500"
+                className="rounded border-line-strong bg-raised accent-indigo-500"
               />
-              <span className="text-sm text-gray-200 flex-1 group-hover:text-white transition-colors truncate">
+              <span className="text-sm text-ink flex-1 group-hover:text-white transition-colors truncate">
                 {cat.name}
               </span>
-              <span className="text-xs text-gray-600 shrink-0">{cat.talkgroups.length} TGs</span>
+              <span className="text-xs text-ink-muted shrink-0">{cat.talkgroups.length} TGs</span>
             </label>
           ))}
         </div>
 
         {/* Footer */}
-        <div className="px-5 pb-5 pt-4 border-t border-gray-800 flex gap-3">
+        <div className="px-5 pb-5 pt-4 border-t border-line flex gap-3">
           <button
             type="button"
             onClick={handleImport}
@@ -503,7 +503,7 @@ function RRImportModal({
           <button
             type="button"
             onClick={onCancel}
-            className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+            className="flex-1 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg py-2 text-sm transition-colors"
           >
             Cancel
           </button>
@@ -533,10 +533,10 @@ function LocalKnowledgeField({
   multiline?: boolean;
 }) {
   const cls =
-    "w-full mt-0.5 bg-gray-900 border border-gray-700 rounded px-2 py-1 text-white text-xs focus:outline-none focus:border-indigo-500";
+    "w-full mt-0.5 bg-surface border border-line-strong rounded px-2 py-1 text-white text-xs focus:outline-none focus:border-indigo-500";
   return (
     <label className="block">
-      <span className="text-xs text-gray-500 font-sans">{label}</span>
+      <span className="text-xs text-ink-muted font-sans">{label}</span>
       {multiline ? (
         <textarea
           value={value}
@@ -656,8 +656,8 @@ function TalkgroupEditor({
       )}
 
       <div className="flex items-center justify-between">
-        <label className="text-xs text-gray-400">
-          Talkgroups{talkgroups.length > 0 && <span className="text-gray-600 ml-1">({talkgroups.length})</span>}
+        <label className="text-xs text-ink-2">
+          Talkgroups{talkgroups.length > 0 && <span className="text-ink-muted ml-1">({talkgroups.length})</span>}
         </label>
         <div className="flex gap-3">
           {/* RadioReference file import */}
@@ -704,10 +704,10 @@ function TalkgroupEditor({
       )}
 
       {showPaste && (
-        <div className="space-y-2 p-3 bg-gray-800 rounded-lg border border-gray-700">
-          <p className="text-xs text-gray-500">
+        <div className="space-y-2 p-3 bg-raised rounded-lg border border-line-strong">
+          <p className="text-xs text-ink-muted">
             Paste rows from RadioReference — tab- or comma-separated:{" "}
-            <span className="text-gray-400">ID, Name, Tag</span>
+            <span className="text-ink-2">ID, Name, Tag</span>
             <br />Tags: fire · police · ems · transit · public works · other
           </p>
           <textarea
@@ -715,7 +715,7 @@ function TalkgroupEditor({
             onChange={(e) => setPasteText(e.target.value)}
             rows={6}
             placeholder={"1234\tFire Dispatch\tfire\n5678\tPolice Zone 1\tpolice\n9012\tEMS\tems"}
-            className="w-full bg-gray-900 border border-gray-700 rounded px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
+            className="w-full bg-surface border border-line-strong rounded px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
           />
           <button
             type="button"
@@ -729,10 +729,10 @@ function TalkgroupEditor({
       )}
 
       {talkgroups.length > 0 ? (
-        <div className="border border-gray-800 rounded-lg overflow-hidden">
+        <div className="border border-line rounded-lg overflow-hidden">
           <table className="w-full text-xs font-mono">
             <thead>
-              <tr className="bg-gray-800 text-gray-400">
+              <tr className="bg-raised text-ink-2">
                 <th className="px-3 py-1.5 text-left w-20">Dec ID</th>
                 <th className="px-3 py-1.5 text-left">Name</th>
                 <th className="px-3 py-1.5 text-left w-28">Tag</th>
@@ -742,7 +742,7 @@ function TalkgroupEditor({
             <tbody>
               {talkgroups.map((tg, i) => (
                 <Fragment key={i}>
-                <tr className="border-t border-gray-800 hover:bg-gray-800/30">
+                <tr className="border-t border-line hover:bg-raised/30">
                   <td className="px-2 py-1">
                     <input
                       value={tg.id}
@@ -763,7 +763,7 @@ function TalkgroupEditor({
                     <select
                       value={tg.tag}
                       onChange={(e) => updateRow(i, "tag", e.target.value)}
-                      className="w-full bg-gray-900 text-gray-300 focus:outline-none rounded px-1"
+                      className="w-full bg-surface text-ink-2 focus:outline-none rounded px-1"
                     >
                       {TG_TAGS.map((t) => (
                         <option key={t} value={t}>{t}</option>
@@ -776,7 +776,7 @@ function TalkgroupEditor({
                       title="Local knowledge for the transcript corrector"
                       onClick={() => setExpanded(expanded === i ? null : i)}
                       className={`transition-colors font-bold mr-2 ${
-                        hasLocalKnowledge(tg) ? "text-indigo-400" : "text-gray-600 hover:text-gray-300"
+                        hasLocalKnowledge(tg) ? "text-indigo-400" : "text-ink-muted hover:text-ink"
                       }`}
                     >
                       {expanded === i ? "▾" : "▸"}
@@ -784,7 +784,7 @@ function TalkgroupEditor({
                     <button
                       type="button"
                       onClick={() => removeRow(i)}
-                      className="text-gray-600 hover:text-red-400 transition-colors font-bold"
+                      className="text-ink-muted hover:text-red-400 transition-colors font-bold"
                     >
                       ×
                     </button>
@@ -794,11 +794,11 @@ function TalkgroupEditor({
                     talkgroups and most inherit the system's context rather than
                     override it. */}
                 {expanded === i && (
-                  <tr className="border-t border-gray-800 bg-gray-900/60">
+                  <tr className="border-t border-line bg-surface/60">
                     <td colSpan={4} className="px-3 py-3">
-                      <p className="text-xs text-gray-500 mb-2 font-sans">
+                      <p className="text-xs text-ink-muted mb-2 font-sans">
                         Given to the transcript corrector for this talkgroup only, ranked
-                        <span className="text-gray-300"> above</span> the system&apos;s own list.
+                        <span className="text-ink-2"> above</span> the system&apos;s own list.
                         Leave blank to inherit the system&apos;s.
                       </p>
                       <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
@@ -849,7 +849,7 @@ function TalkgroupEditor({
           </table>
         </div>
       ) : (
-        <p className="text-xs text-gray-600 italic py-1">
+        <p className="text-xs text-ink-muted italic py-1">
           No talkgroups — add rows, paste from RadioReference, or use the RadioReference import button.
         </p>
       )}
@@ -864,52 +864,52 @@ function P25Form({ value, onChange }: { value: P25Config; onChange: (v: P25Confi
     <div className="space-y-4">
       <div className="grid grid-cols-3 gap-3">
         <div>
-          <label className="text-xs text-gray-400 block mb-1">NAC (hex)</label>
+          <label className="text-xs text-ink-2 block mb-1">NAC (hex)</label>
           <input
             value={value.nac}
             onChange={(e) => onChange({ ...value, nac: e.target.value })}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
             placeholder="0x293"
           />
         </div>
         <div>
-          <label className="text-xs text-gray-400 block mb-1">System ID</label>
+          <label className="text-xs text-ink-2 block mb-1">System ID</label>
           <input
             value={value.system_id}
             onChange={(e) => onChange({ ...value, system_id: e.target.value })}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
             placeholder="50513"
           />
         </div>
         <div>
-          <label className="text-xs text-gray-400 block mb-1">WACN (hex)</label>
+          <label className="text-xs text-ink-2 block mb-1">WACN (hex)</label>
           <input
             value={value.wacn}
             onChange={(e) => onChange({ ...value, wacn: e.target.value })}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
             placeholder="0xBEE00"
           />
         </div>
       </div>
       <div>
-        <label className="text-xs text-gray-400 block mb-1">
-          Control Channels <span className="text-gray-600">(MHz, comma-separated)</span>
+        <label className="text-xs text-ink-2 block mb-1">
+          Control Channels <span className="text-ink-muted">(MHz, comma-separated)</span>
         </label>
         <input
           value={value.control_channels}
           onChange={(e) => onChange({ ...value, control_channels: e.target.value })}
-          className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+          className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
           placeholder="851.0125, 851.5125, 852.0125"
         />
       </div>
       <div>
-        <label className="text-xs text-gray-400 block mb-1">
-          Voice Channels <span className="text-gray-600">(MHz, comma-separated — leave blank for auto-discovery)</span>
+        <label className="text-xs text-ink-2 block mb-1">
+          Voice Channels <span className="text-ink-muted">(MHz, comma-separated — leave blank for auto-discovery)</span>
         </label>
         <input
           value={value.voice_channels}
           onChange={(e) => onChange({ ...value, voice_channels: e.target.value })}
-          className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
+          className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500"
           placeholder="Optional"
         />
       </div>
@@ -923,7 +923,7 @@ function P25Form({ value, onChange }: { value: P25Config; onChange: (v: P25Confi
 
 // ── Fixed-channel editors (node-26#24) ────────────────────────────────────────
 
-const INPUT = "w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500";
+const INPUT = "w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm font-mono focus:outline-none focus:border-indigo-500";
 
 function ConventionalForm({ value, onChange }: { value: P25Config; onChange: (v: P25Config) => void }) {
   const chs = value.channels;
@@ -931,13 +931,13 @@ function ConventionalForm({ value, onChange }: { value: P25Config; onChange: (v:
     onChange({ ...value, channels: chs.map((ch, j) => (j === i ? { ...ch, [field]: v } : ch)) });
   return (
     <div className="space-y-4">
-      <p className="text-xs text-gray-500">
+      <p className="text-xs text-ink-muted">
         Fixed voice channels with no control channel — RadioReference lists them as conventional
         frequencies with mode P25 (or &quot;DE&quot;). A node decodes up to {MAX_CONVENTIONAL_CHANNELS} on
         one SDR, within about 1.5 MHz of each other. Each channel&apos;s calls are labelled with its name.
       </p>
       <div className="space-y-2">
-        <div className="grid grid-cols-[1fr_1.5fr_0.8fr_auto] gap-2 text-xs text-gray-400">
+        <div className="grid grid-cols-[1fr_1.5fr_0.8fr_auto] gap-2 text-xs text-ink-2">
           <span>Frequency (MHz)</span>
           <span>Channel name</span>
           <span>NAC (hex, optional)</span>
@@ -992,7 +992,7 @@ function ConventionalForm({ value, onChange }: { value: P25Config; onChange: (v:
         talkgroups={value.talkgroups}
         onChange={(tgs) => onChange({ ...value, talkgroups: tgs })}
       />
-      <p className="text-xs text-gray-600 -mt-2">
+      <p className="text-xs text-ink-muted -mt-2">
         Talkgroups are optional here: only needed if the radios send distinct talkgroup IDs you want named.
       </p>
     </div>
@@ -1004,7 +1004,7 @@ function AnalogForm({ value, onChange }: { value: AnalogConfig; onChange: (v: An
   return (
     <div className="grid grid-cols-2 gap-3">
       <div>
-        <label htmlFor="analog-freq" className="text-xs text-gray-400 block mb-1">Frequency (MHz)</label>
+        <label htmlFor="analog-freq" className="text-xs text-ink-2 block mb-1">Frequency (MHz)</label>
         <input
           id="analog-freq"
           value={ch.freq}
@@ -1016,7 +1016,7 @@ function AnalogForm({ value, onChange }: { value: AnalogConfig; onChange: (v: An
         />
       </div>
       <div>
-        <label htmlFor="analog-name" className="text-xs text-gray-400 block mb-1">Channel name</label>
+        <label htmlFor="analog-name" className="text-xs text-ink-2 block mb-1">Channel name</label>
         <input
           id="analog-name"
           value={ch.name}
@@ -1124,27 +1124,27 @@ function SystemForm({
   const title = initial && !createOnly ? "Edit System" : createOnly ? "Duplicate System" : "New System";
 
   return (
-    <form onSubmit={handleSubmit} className="bg-gray-900 border border-gray-700 rounded-xl p-5 space-y-4 font-mono">
+    <form onSubmit={handleSubmit} className="bg-surface border border-line-strong rounded-xl p-5 space-y-4 font-mono">
       <h3 className="text-white font-semibold">{title}</h3>
 
       <div className="grid grid-cols-2 gap-3">
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Name</label>
+          <label className="text-xs text-ink-2 block mb-1">Name</label>
           <input
             value={name}
             onChange={(e) => setName(e.target.value)}
             required
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             placeholder="Westchester County P25"
           />
         </div>
         <div>
-          <label htmlFor="system-kind" className="text-xs text-gray-400 block mb-1">Type</label>
+          <label htmlFor="system-kind" className="text-xs text-ink-2 block mb-1">Type</label>
           <select
             id="system-kind"
             value={kind}
             onChange={(e) => handleKindChange(e.target.value as SystemKind)}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           >
             {KIND_OPTIONS.map((o) => (
               <option key={o.value} value={o.value}>{o.label}</option>
@@ -1165,12 +1165,12 @@ function SystemForm({
         <AnalogForm value={analog} onChange={setAnalog} />
       ) : (
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Config (JSON)</label>
+          <label className="text-xs text-ink-2 block mb-1">Config (JSON)</label>
           <textarea
             value={rawJson}
             onChange={(e) => setRawJson(e.target.value)}
             rows={10}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
           />
         </div>
       )}
@@ -1179,7 +1179,7 @@ function SystemForm({
         <button
           type="button"
           onClick={toggleRaw}
-          className="text-xs text-gray-600 hover:text-gray-400 transition-colors"
+          className="text-xs text-ink-muted hover:text-ink-2 transition-colors"
         >
           {showRaw ? "← Use structured form" : "Edit raw JSON →"}
         </button>
@@ -1198,7 +1198,7 @@ function SystemForm({
         <button
           type="button"
           onClick={onCancel}
-          className="flex-1 bg-gray-800 hover:bg-gray-700 text-gray-300 rounded-lg py-2 text-sm transition-colors"
+          className="flex-1 bg-raised hover:bg-gray-700 text-ink-2 rounded-lg py-2 text-sm transition-colors"
         >
           Cancel
         </button>
@@ -1267,10 +1267,10 @@ function PreferredTokenPanel({ systemId, initialTokenId }: { systemId: string; i
   const currentToken = tokens?.find((t) => t.token_id === preferredId);
 
   return (
-    <div className="mt-3 border-t border-gray-800 pt-3">
+    <div className="mt-3 border-t border-line pt-3">
       <button
         onClick={toggle}
-        className="text-xs text-gray-500 hover:text-gray-300 font-mono transition-colors flex items-center gap-1"
+        className="text-xs text-ink-muted hover:text-ink font-mono transition-colors flex items-center gap-1"
       >
         <span>{open ? "▲" : "▼"}</span>
         <span>
@@ -1282,14 +1282,14 @@ function PreferredTokenPanel({ systemId, initialTokenId }: { systemId: string; i
       {open && (
         <div className="mt-3 space-y-2 font-mono text-xs">
           {tokens === null ? (
-            <p className="text-gray-600 italic">Loading tokens…</p>
+            <p className="text-ink-muted italic">Loading tokens…</p>
           ) : error ? (
             <p className="text-red-400">{error}</p>
           ) : tokens.length === 0 ? (
-            <p className="text-gray-600 italic">No tokens in pool.</p>
+            <p className="text-ink-muted italic">No tokens in pool.</p>
           ) : (
             <>
-              <p className="text-gray-600">
+              <p className="text-ink-muted">
                 When a node on this system joins a voice channel, this token is tried first.
               </p>
               <div className="space-y-1.5">
@@ -1303,7 +1303,7 @@ function PreferredTokenPanel({ systemId, initialTokenId }: { systemId: string; i
                       disabled={saving}
                       className="accent-indigo-500"
                     />
-                    <span className={`flex-1 ${t.in_use && preferredId !== t.token_id ? "text-gray-600" : "text-gray-300"}`}>
+                    <span className={`flex-1 ${t.in_use && preferredId !== t.token_id ? "text-ink-muted" : "text-ink-2"}`}>
                       {t.name}
                       {t.in_use && <span className="ml-1.5 text-green-600">in use</span>}
                     </span>
@@ -1314,13 +1314,13 @@ function PreferredTokenPanel({ systemId, initialTokenId }: { systemId: string; i
                 <button
                   onClick={handleClear}
                   disabled={saving}
-                  className="text-gray-600 hover:text-gray-400 transition-colors disabled:opacity-50"
+                  className="text-ink-muted hover:text-ink-2 transition-colors disabled:opacity-50"
                 >
                   Clear preference (use any free token)
                 </button>
               )}
               {!preferredId && (
-                <p className="text-gray-700">No preference — any free token will be used.</p>
+                <p className="text-ink-muted">No preference — any free token will be used.</p>
               )}
               {currentToken && (
                 <p className="text-indigo-500">Preferred: {currentToken.name}</p>
@@ -1371,10 +1371,10 @@ function AiFlagsPanel({ systemId, initial }: { systemId: string; initial: System
   ];
 
   return (
-    <div className="mt-3 border-t border-gray-800 pt-3">
+    <div className="mt-3 border-t border-line pt-3">
       <button
         onClick={() => setOpen((v) => !v)}
-        className="text-xs text-gray-500 hover:text-gray-300 font-mono transition-colors flex items-center gap-1"
+        className="text-xs text-ink-muted hover:text-ink font-mono transition-colors flex items-center gap-1"
       >
         <span>{open ? "▲" : "▼"}</span>
         <span>AI Flags</span>
@@ -1400,23 +1400,23 @@ function AiFlagsPanel({ systemId, initial }: { systemId: string; initial: System
                 >
                   <span className={`inline-block h-3.5 w-3.5 rounded-full bg-white shadow transition-transform ${isOn ? "translate-x-4" : "translate-x-0.5"}`} />
                 </button>
-                <span className="text-gray-300 flex-1">{label}</span>
+                <span className="text-ink-2 flex-1">{label}</span>
                 {isSet ? (
                   <button
                     onClick={() => handleClear(key)}
                     disabled={saving === key}
-                    className="text-gray-600 hover:text-gray-400 transition-colors"
+                    className="text-ink-muted hover:text-ink-2 transition-colors"
                     title="Clear override (inherit global)"
                   >
                     reset
                   </button>
                 ) : (
-                  <span className="text-gray-700">inherits global</span>
+                  <span className="text-ink-muted">inherits global</span>
                 )}
               </div>
             );
           })}
-          <p className="text-gray-700 pt-1">Overrides apply on top of global AI flags. "reset" restores global default.</p>
+          <p className="text-ink-muted pt-1">Overrides apply on top of global AI flags. "reset" restores global default.</p>
         </div>
       )}
     </div>
@@ -1456,15 +1456,15 @@ function SourceCallPlayer({ callId }: { callId: string }) {
         {loading ? "loading…" : open ? "▲ source" : "▶ source"}
       </button>
       {open && call && (
-        <div className="mt-1.5 space-y-1 pl-2 border-l border-gray-700">
+        <div className="mt-1.5 space-y-1 pl-2 border-l border-line-strong">
           {call.audio_url ? (
             <audio src={call.audio_url} controls className="w-full" style={{ height: "1.75rem" }} />
           ) : (
-            <p className="text-gray-600 italic">No audio</p>
+            <p className="text-ink-muted italic">No audio</p>
           )}
           {transcript && (
             <>
-              <p className="text-gray-500 italic line-clamp-2">{transcript}</p>
+              <p className="text-ink-muted italic line-clamp-2">{transcript}</p>
               {/* Gate A / A2 (server-26#46) — this is a raw pipeline transcript. */}
               <MachineOutputNotice variant="inline" className="text-[10px]" />
             </>
@@ -1528,16 +1528,16 @@ function AreaContextPanel({ systemId }: { systemId: string }) {
     : 0;
 
   return (
-    <div className="mt-3 border-t border-gray-800 pt-3">
+    <div className="mt-3 border-t border-line pt-3">
       <button
         onClick={toggle}
-        className="text-xs text-gray-500 hover:text-gray-300 font-mono transition-colors flex items-center gap-1"
+        className="text-xs text-ink-muted hover:text-ink font-mono transition-colors flex items-center gap-1"
       >
         <span>{open ? "▲" : "▼"}</span>
         <span>
           Local Area
           {area !== null && (
-            <span className="text-gray-600 ml-1">
+            <span className="text-ink-muted ml-1">
               ({filled > 0 ? `${filled} field${filled === 1 ? "" : "s"} set` : "not set"})
             </span>
           )}
@@ -1546,16 +1546,16 @@ function AreaContextPanel({ systemId }: { systemId: string }) {
 
       {open && (
         <div className="mt-3 space-y-3 text-xs">
-          {loading && <p className="text-gray-600 italic font-mono">Loading…</p>}
+          {loading && <p className="text-ink-muted italic font-mono">Loading…</p>}
           {area && (
             <>
-              <p className="text-gray-500">
+              <p className="text-ink-muted">
                 Given to the transcript corrector for every talkgroup on this system.
                 Whisper mishears local names constantly — naming them here is what lets
                 them be put back.
               </p>
-              <p className="text-gray-500">
-                Fill this in <span className="text-gray-300">only if it is true of every
+              <p className="text-ink-muted">
+                Fill this in <span className="text-ink-2">only if it is true of every
                 talkgroup</span> on the system. One town, one department — fill it once here.
                 A system spanning several counties — leave it blank and describe each
                 talkgroup in the edit form instead.
@@ -1592,7 +1592,7 @@ function AreaContextPanel({ systemId }: { systemId: string }) {
               {/* The anchor is the backend's answer to what was typed above, and
                   it decides whether location checking runs at all — so it is
                   worth showing rather than leaving as invisible state. */}
-              <p className="text-gray-600 font-mono">{anchorLabel(area)}</p>
+              <p className="text-ink-muted font-mono">{anchorLabel(area)}</p>
               <button
                 type="button"
                 onClick={save}
@@ -1659,16 +1659,16 @@ function TalkgroupPendingPanel({ systemId }: { systemId: string }) {
   const total = (rows ?? []).reduce((n, r) => n + r.pending.length, 0);
 
   return (
-    <div className="mt-3 border-t border-gray-800 pt-3">
+    <div className="mt-3 border-t border-line pt-3">
       <button
         onClick={toggle}
-        className="text-xs text-gray-500 hover:text-gray-300 font-mono transition-colors flex items-center gap-1"
+        className="text-xs text-ink-muted hover:text-ink font-mono transition-colors flex items-center gap-1"
       >
         <span>{open ? "▲" : "▼"}</span>
         <span>
           Proposed Terms
           {rows !== null && (
-            <span className={total > 0 ? "text-indigo-400 ml-1" : "text-gray-600 ml-1"}>
+            <span className={total > 0 ? "text-indigo-400 ml-1" : "text-ink-muted ml-1"}>
               ({total > 0 ? `${total} awaiting review` : "none"})
             </span>
           )}
@@ -1677,9 +1677,9 @@ function TalkgroupPendingPanel({ systemId }: { systemId: string }) {
 
       {open && (
         <div className="mt-3 space-y-3 text-xs">
-          {rows === null && <p className="text-gray-600 italic font-mono">Loading…</p>}
+          {rows === null && <p className="text-ink-muted italic font-mono">Loading…</p>}
           {rows !== null && total === 0 && (
-            <p className="text-gray-600 italic">
+            <p className="text-ink-muted italic">
               Nothing proposed yet. Terms appear here when a corrected place name
               turns out to be real nearby, or when the induction loop spots one in
               recent traffic.
@@ -1687,19 +1687,19 @@ function TalkgroupPendingPanel({ systemId }: { systemId: string }) {
           )}
           {(rows ?? []).map((row) => (
             <div key={row.talkgroup_id}>
-              <p className="text-gray-400 font-mono mb-1">
+              <p className="text-ink-2 font-mono mb-1">
                 {row.talkgroup_name || `TGID ${row.talkgroup_id}`}
               </p>
               <ul className="space-y-1">
                 {row.pending.map((p) => (
                   <li
                     key={p.term}
-                    className="flex items-start gap-2 bg-gray-900/60 border border-gray-800 rounded px-2 py-1"
+                    className="flex items-start gap-2 bg-surface/60 border border-line rounded px-2 py-1"
                   >
                     <span className="flex-1">
                       <span className="text-white font-mono">{p.term}</span>
-                      {p.meaning && <span className="text-gray-500"> — {p.meaning}</span>}
-                      <span className="text-gray-700 ml-2">{p.source}</span>
+                      {p.meaning && <span className="text-ink-muted"> — {p.meaning}</span>}
+                      <span className="text-ink-muted ml-2">{p.source}</span>
                     </span>
                     <button
                       type="button"
@@ -1713,7 +1713,7 @@ function TalkgroupPendingPanel({ systemId }: { systemId: string }) {
                       type="button"
                       disabled={busy === `${row.talkgroup_id}:${p.term}`}
                       onClick={() => act(row.talkgroup_id, p.term, false)}
-                      className="text-gray-600 hover:text-red-400 disabled:opacity-40 font-semibold"
+                      className="text-ink-muted hover:text-red-400 disabled:opacity-40 font-semibold"
                     >
                       Drop
                     </button>
@@ -1802,16 +1802,16 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
   }
 
   return (
-    <div className="mt-3 border-t border-gray-800 pt-3">
+    <div className="mt-3 border-t border-line pt-3">
       <button
         onClick={toggle}
-        className="text-xs text-gray-500 hover:text-gray-300 font-mono transition-colors flex items-center gap-1"
+        className="text-xs text-ink-muted hover:text-ink font-mono transition-colors flex items-center gap-1"
       >
         <span>{open ? "▲" : "▼"}</span>
         <span>
           Vocabulary
           {vocab !== null && (
-            <span className="text-gray-600 ml-1">
+            <span className="text-ink-muted ml-1">
               ({vocab.length} terms{pending.length > 0 ? `, ${pending.length} pending` : ""})
             </span>
           )}
@@ -1820,7 +1820,7 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
 
       {open && (
         <div className="mt-3 space-y-3 font-mono text-xs">
-          {loading && <p className="text-gray-600 italic">Loading…</p>}
+          {loading && <p className="text-ink-muted italic">Loading…</p>}
 
           {!loading && vocab !== null && (
             <>
@@ -1832,19 +1832,19 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
                 >
                   {bootstrapping ? "Bootstrapping…" : bootstrapped ? "Re-bootstrap with AI" : "Bootstrap with AI"}
                 </button>
-                <span className="text-gray-600">GPT-4o generates local knowledge (agencies, units, streets)</span>
+                <span className="text-ink-muted">GPT-4o generates local knowledge (agencies, units, streets)</span>
               </div>
 
               <div>
-                <p className="text-gray-500 uppercase tracking-wider mb-1.5">Approved ({vocab.length})</p>
+                <p className="text-ink-muted uppercase tracking-wider mb-1.5">Approved ({vocab.length})</p>
                 {vocab.length > 0 ? (
                   <div className="flex flex-wrap gap-1.5">
                     {vocab.map((term) => (
-                      <span key={term} className="inline-flex items-center gap-1 bg-gray-800 text-gray-300 px-2 py-0.5 rounded-full">
+                      <span key={term} className="inline-flex items-center gap-1 bg-raised text-ink-2 px-2 py-0.5 rounded-full">
                         {term}
                         <button
                           onClick={() => handleRemove(term)}
-                          className="text-gray-600 hover:text-red-400 transition-colors leading-none"
+                          className="text-ink-muted hover:text-red-400 transition-colors leading-none"
                         >
                           ×
                         </button>
@@ -1852,7 +1852,7 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
                     ))}
                   </div>
                 ) : (
-                  <p className="text-gray-600 italic">No terms yet — bootstrap or add manually.</p>
+                  <p className="text-ink-muted italic">No terms yet — bootstrap or add manually.</p>
                 )}
               </div>
 
@@ -1861,12 +1861,12 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
                   value={newTerm}
                   onChange={(e) => setNewTerm(e.target.value)}
                   placeholder="Add term (e.g. 5-baker, YVAC)"
-                  className="flex-1 bg-gray-800 border border-gray-700 rounded-lg px-3 py-1.5 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
+                  className="flex-1 bg-raised border border-line-strong rounded-lg px-3 py-1.5 text-white text-xs font-mono focus:outline-none focus:border-indigo-500"
                 />
                 <button
                   type="submit"
                   disabled={adding || !newTerm.trim()}
-                  className="bg-gray-700 hover:bg-gray-600 disabled:opacity-50 text-gray-200 px-3 py-1.5 rounded-lg transition-colors"
+                  className="bg-gray-700 hover:bg-gray-600 disabled:opacity-50 text-ink px-3 py-1.5 rounded-lg transition-colors"
                 >
                   Add
                 </button>
@@ -1874,17 +1874,17 @@ function VocabularyPanel({ systemId }: { systemId: string }) {
 
               {pending.length > 0 && (
                 <div>
-                  <p className="text-gray-500 uppercase tracking-wider mb-1.5">
+                  <p className="text-ink-muted uppercase tracking-wider mb-1.5">
                     Induction suggestions ({pending.length})
                   </p>
                   <div className="space-y-2">
                     {pending.map((p) => (
                       <div key={p.term} className="space-y-1">
                         <div className="flex items-center gap-2">
-                          <span className="text-gray-300 flex-1">{p.term}</span>
-                          <span className="text-gray-600">{p.source}</span>
+                          <span className="text-ink-2 flex-1">{p.term}</span>
+                          <span className="text-ink-muted">{p.source}</span>
                           <button onClick={() => handleApprove(p.term)} className="text-green-500 hover:text-green-400 transition-colors px-1">✓</button>
-                          <button onClick={() => handleDismiss(p.term)} className="text-gray-600 hover:text-red-400 transition-colors px-1">✕</button>
+                          <button onClick={() => handleDismiss(p.term)} className="text-ink-muted hover:text-red-400 transition-colors px-1">✕</button>
                         </div>
                         {p.source_call_ids && p.source_call_ids.length > 0 && (
                           <div className="pl-1 space-y-1">
@@ -1930,7 +1930,8 @@ export default function SystemsPage() {
   if (authLoading || (!isAdmin && !isOperator)) return null;
   async function handleDelete(id: string) {
     if (!confirm("Delete this system?")) return;
-    await c2api.deleteSystem(id);
+    try { await c2api.deleteSystem(id); }
+    catch (e) { alert(`Couldn't delete the system: ${e instanceof Error ? e.message : String(e)}`); }
   }
 
   function openEdit(s: SystemRecord) {
@@ -1952,12 +1953,16 @@ export default function SystemsPage() {
     <div className="space-y-6">
       <div className="flex items-center justify-between">
         <h1 className="text-xl font-bold text-white font-mono">Systems</h1>
-        <button
-          onClick={() => { setEditing("new"); setEditIsDuplicate(false); }}
-          className="bg-indigo-600 hover:bg-indigo-500 text-white px-4 py-2 rounded-lg text-sm font-mono transition-colors"
-        >
-          + New System
-        </button>
+        {/* Every systems write route is require_admin_token (server-26#283);
+            operators get a read-only view. */}
+        {isAdmin && (
+          <button
+            onClick={() => { setEditing("new"); setEditIsDuplicate(false); }}
+            className="bg-indigo-600 hover:bg-indigo-500 text-white px-4 py-2 rounded-lg text-sm font-mono transition-colors"
+          >
+            + New System
+          </button>
+        )}
       </div>
 
       {editing && (
@@ -1970,9 +1975,9 @@ export default function SystemsPage() {
       )}
 
       {loading ? (
-        <p className="text-gray-600 text-sm font-mono">Loading…</p>
+        <p className="text-ink-muted text-sm font-mono">Loading…</p>
       ) : systems.length === 0 ? (
-        <p className="text-gray-600 text-sm font-mono">No systems defined yet.</p>
+        <p className="text-ink-muted text-sm font-mono">No systems defined yet.</p>
       ) : (
         <div className="space-y-3">
           {systems.map((s) => {
@@ -1987,13 +1992,13 @@ export default function SystemsPage() {
               ? (s.config.channels as unknown[]).length
               : null;
             return (
-              <div key={s.system_id} className="bg-gray-900 border border-gray-800 rounded-lg p-4 font-mono">
+              <div key={s.system_id} className="bg-surface border border-line rounded-lg p-4 font-mono">
                 <div className="flex items-start justify-between">
                   <div>
                     <p className="text-white font-semibold">{s.name}</p>
-                    <p className="text-xs text-gray-500">{s.system_id}</p>
+                    <p className="text-xs text-ink-muted">{s.system_id}</p>
                     {(s.config.nac || ccCount !== null || chCount !== null || tgCount !== null) && (
-                      <p className="text-xs text-gray-600 mt-0.5 space-x-2">
+                      <p className="text-xs text-ink-muted mt-0.5 space-x-2">
                         {!!s.config.nac && <span>NAC {String(s.config.nac)}</span>}
                         {ccCount !== null && <span>· {ccCount} CC</span>}
                         {chCount !== null && <span>· {chCount} ch</span>}
@@ -2001,11 +2006,11 @@ export default function SystemsPage() {
                       </p>
                     )}
                   </div>
-                  <span className="text-xs bg-gray-800 border border-gray-700 text-gray-400 px-2 py-0.5 rounded">
+                  <span className="text-xs bg-raised border border-line-strong text-ink-2 px-2 py-0.5 rounded">
                     {kindLabel(s)}
                   </span>
                 </div>
-                <div className="mt-3 flex gap-3">
+                {isAdmin && <div className="mt-3 flex gap-3">
                   <button
                     onClick={() => openEdit(s)}
                     className="text-xs text-indigo-400 hover:text-indigo-300 transition-colors"
@@ -2014,7 +2019,7 @@ export default function SystemsPage() {
                   </button>
                   <button
                     onClick={() => openDuplicate(s)}
-                    className="text-xs text-gray-500 hover:text-gray-300 transition-colors"
+                    className="text-xs text-ink-muted hover:text-ink transition-colors"
                   >
                     Duplicate
                   </button>
@@ -2024,15 +2029,21 @@ export default function SystemsPage() {
                   >
                     Delete
                   </button>
-                </div>
+                </div>}
                 {/* GET /tokens and PUT /tokens/{id}/prefer are platform-admin only
                     (server-26#204 item 6), so for anyone else this panel could
                     neither list the pool nor save a choice (server-26#213 item 4). */}
                 {isAdmin && <PreferredTokenPanel systemId={s.system_id} initialTokenId={s.preferred_token_id} />}
-                <AiFlagsPanel systemId={s.system_id} initial={(s as unknown as { ai_flags?: SystemAiFlags }).ai_flags ?? {}} />
-                <AreaContextPanel systemId={s.system_id} />
-                <TalkgroupPendingPanel systemId={s.system_id} />
-                <VocabularyPanel systemId={s.system_id} />
+                {/* All admin-only routes (server-26#283), incl. area-context and
+                    talkgroup-pending GETs and every vocabulary write. */}
+                {isAdmin && (
+                  <>
+                    <AiFlagsPanel systemId={s.system_id} initial={(s as unknown as { ai_flags?: SystemAiFlags }).ai_flags ?? {}} />
+                    <AreaContextPanel systemId={s.system_id} />
+                    <TalkgroupPendingPanel systemId={s.system_id} />
+                    <VocabularyPanel systemId={s.system_id} />
+                  </>
+                )}
               </div>
             );
           })}

drb-frontend/app/terms/page.tsx

@@ -69,18 +69,18 @@ export default function TermsPage() {
       </div>
 
       <h1 className="text-display-sm text-white">Terms of Service</h1>
-      <p className="text-gray-500 text-sm mt-2 font-mono">Draft — last structured {new Date().getFullYear()}</p>
+      <p className="text-ink-muted text-sm mt-2 font-mono">Draft — last structured {new Date().getFullYear()}</p>
 
       <div className="mt-10 space-y-8">
         {SECTIONS.map((s) => (
           <section key={s.heading}>
             <h2 className="text-white font-semibold">{s.heading}</h2>
-            <p className="text-gray-500 text-sm mt-2 leading-relaxed italic">{s.note}</p>
+            <p className="text-ink-muted text-sm mt-2 leading-relaxed italic">{s.note}</p>
           </section>
         ))}
       </div>
 
-      <p className="text-gray-600 text-xs font-mono mt-16">
+      <p className="text-ink-muted text-xs font-mono mt-16">
         Questions in the meantime? <Link href="/faq" className="text-indigo-400 hover:text-indigo-300 transition-colors">Check the FAQ</Link> or{" "}
         <Link href="/login" className="text-indigo-400 hover:text-indigo-300 transition-colors">sign in to reach us directly</Link>.
       </p>

drb-frontend/app/trips/[id]/page.tsx

@@ -5,6 +5,7 @@ import ReactMarkdown from "react-markdown";
 import { useParams, useRouter } from "next/navigation";
 import { useAuth } from "@/components/AuthProvider";
 import { c2api } from "@/lib/c2api";
+import { errorMessage } from "@/lib/c2error";
 import type { TripEvent, TripRecord, PlaceResult } from "@/lib/types";
 
 // ---------------------------------------------------------------------------
@@ -141,7 +142,7 @@ function PlaceSearch({
           onChange={(e) => setQuery(e.target.value)}
           onKeyDown={(e) => e.key === "Enter" && (e.preventDefault(), search())}
           placeholder="Search a place…"
-          className="flex-1 bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+          className="flex-1 bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
         />
         <button
           type="button"
@@ -153,7 +154,7 @@ function PlaceSearch({
         </button>
       </div>
       {results.length > 0 && (
-        <div className="bg-gray-800 border border-gray-700 rounded-lg overflow-hidden divide-y divide-gray-700">
+        <div className="bg-raised border border-line-strong rounded-lg overflow-hidden divide-y divide-line-strong">
           {results.map((p) => (
             <button
               key={p.place_id}
@@ -162,7 +163,7 @@ function PlaceSearch({
               className="w-full text-left px-3 py-2 hover:bg-gray-700 transition-colors"
             >
               <p className="text-white text-sm font-medium">{p.name}</p>
-              <p className="text-gray-400 text-xs">{p.address}</p>
+              <p className="text-ink-2 text-xs">{p.address}</p>
               {p.rating && (
                 <p className="text-yellow-400 text-xs">★ {p.rating}</p>
               )}
@@ -240,60 +241,60 @@ function AddEventModal({
     <div className="fixed inset-0 bg-black/70 flex items-center justify-center z-50 p-4">
       <form
         onSubmit={handleSubmit}
-        className="bg-gray-900 border border-gray-700 rounded-xl p-6 w-full max-w-lg space-y-4 max-h-[90vh] overflow-y-auto"
+        className="bg-surface border border-line-strong rounded-xl p-6 w-full max-w-lg space-y-4 max-h-[90vh] overflow-y-auto"
       >
         <h2 className="text-white font-bold text-lg">{isEdit ? "Edit Event" : "Add Event"}</h2>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Title</label>
+          <label className="text-xs text-ink-2 block mb-1">Title</label>
           <input
             required value={title} onChange={(e) => setTitle(e.target.value)}
             placeholder="Dinner at the bar"
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
         </div>
 
         <div className="grid grid-cols-3 gap-3">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Date</label>
+            <label className="text-xs text-ink-2 block mb-1">Date</label>
             <input
               required type="date"
               min={trip.start_date} max={trip.end_date}
               value={date} onChange={(e) => setDate(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Start</label>
+            <label className="text-xs text-ink-2 block mb-1">Start</label>
             <input
               type="time" value={startTime} onChange={(e) => setStartTime(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">End</label>
+            <label className="text-xs text-ink-2 block mb-1">End</label>
             <input
               type="time" value={endTime} onChange={(e) => setEndTime(e.target.value)}
               min={startTime}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
         </div>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Find a place</label>
+          <label className="text-xs text-ink-2 block mb-1">Find a place</label>
           <PlaceSearch near={trip.location} onSelect={handlePlaceSelect} />
         </div>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">
+          <label className="text-xs text-ink-2 block mb-1">
             Location{" "}
-            <span className="text-gray-600">(auto-filled from search, or type manually)</span>
+            <span className="text-ink-muted">(auto-filled from search, or type manually)</span>
           </label>
           <input
             value={location} onChange={(e) => setLocation(e.target.value)}
             placeholder={`Inherits: ${trip.location}`}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
         </div>
 
@@ -307,16 +308,16 @@ function AddEventModal({
         )}
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Notes (optional)</label>
+          <label className="text-xs text-ink-2 block mb-1">Notes (optional)</label>
           <textarea
             value={notes} onChange={(e) => setNotes(e.target.value)} rows={2}
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none resize-none"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none resize-none"
           />
         </div>
 
         {availableTags.length > 0 && (
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Tags</label>
+            <label className="text-xs text-ink-2 block mb-1">Tags</label>
             <div className="flex flex-wrap gap-1.5">
               {availableTags.map((tag) => {
                 const active = tags.includes(tag);
@@ -326,7 +327,7 @@ function AddEventModal({
                     type="button"
                     onClick={() => setTags((prev) => active ? prev.filter((t) => t !== tag) : [...prev, tag])}
                     className={`text-xs rounded-full px-2.5 py-1 border transition-colors ${
-                      active ? tagColor(tag, availableTags) : "bg-gray-800 text-gray-500 border-gray-700 hover:border-gray-600 hover:text-gray-400"
+                      active ? tagColor(tag, availableTags) : "bg-raised text-ink-muted border-line-strong hover:border-line-strong hover:text-ink-2"
                     }`}
                   >
                     {tag}
@@ -340,7 +341,7 @@ function AddEventModal({
         {error && <p className="text-red-400 text-xs">{error}</p>}
 
         <div className="flex gap-3 justify-end pt-1">
-          <button type="button" onClick={onClose} className="text-sm text-gray-400 hover:text-gray-200 px-4 py-2">
+          <button type="button" onClick={onClose} className="text-sm text-ink-2 hover:text-ink px-4 py-2">
             Cancel
           </button>
           <button
@@ -389,7 +390,7 @@ function DayTimeline({
 
   if (timed.length === 0 && untimed.length === 0) {
     return (
-      <p className="text-gray-600 text-sm font-mono py-8 text-center">
+      <p className="text-ink-muted text-sm font-mono py-8 text-center">
         No events on this day yet.
       </p>
     );
@@ -424,10 +425,10 @@ function DayTimeline({
               style={{ top: (h * 60 - rangeStart) * PX_PER_MIN }}
               className="absolute inset-x-0 flex items-center pointer-events-none"
             >
-              <span className="w-14 text-right pr-3 text-xs text-gray-600 font-mono shrink-0 -translate-y-2">
+              <span className="w-14 text-right pr-3 text-xs text-ink-muted font-mono shrink-0 -translate-y-2">
                 {h === 0 ? "12 AM" : h < 12 ? `${h} AM` : h === 12 ? "12 PM" : `${h - 12} PM`}
               </span>
-              <div className="flex-1 border-t border-gray-800/70" />
+              <div className="flex-1 border-t border-line/70" />
             </div>
           ))}
 
@@ -444,7 +445,7 @@ function DayTimeline({
                 {e.end_time && (
                   <div
                     style={{ top, height, left: 60, right: 0 }}
-                    className="absolute bg-gray-800/30 border-l-2 border-gray-600/30 z-0 pointer-events-none"
+                    className="absolute bg-raised/30 border-l-2 border-line-strong/30 z-0 pointer-events-none"
                   />
                 )}
                 {/* Dashed marker line + label */}
@@ -452,15 +453,15 @@ function DayTimeline({
                   style={{ top, left: 60, right: 0 }}
                   className="absolute z-10 flex items-center gap-2"
                 >
-                  <div className="flex-1 border-t border-dashed border-gray-600/40" />
-                  <span className="text-gray-500 text-[10px] font-mono shrink-0 pr-1">
+                  <div className="flex-1 border-t border-dashed border-line-strong/40" />
+                  <span className="text-ink-muted text-[10px] font-mono shrink-0 pr-1">
                     {fmtTime(e.start_time)}
                   </span>
-                  <span className="text-gray-500 text-[10px] truncate max-w-[120px] shrink-0">{e.title}</span>
+                  <span className="text-ink-muted text-[10px] truncate max-w-[120px] shrink-0">{e.title}</span>
                   {isAdmin && (
                     <div className="flex gap-1 opacity-0 group-hover:opacity-100 transition-opacity shrink-0">
-                      <button onClick={() => onEdit(e)} className="text-gray-600 hover:text-indigo-400 text-[10px]">Edit</button>
-                      <button onClick={() => onDelete(e.event_id)} className="text-gray-600 hover:text-red-400 text-xs leading-none">×</button>
+                      <button onClick={() => onEdit(e)} className="text-ink-muted hover:text-indigo-400 text-[10px]">Edit</button>
+                      <button onClick={() => onDelete(e.event_id)} className="text-ink-muted hover:text-red-400 text-xs leading-none">×</button>
                     </div>
                   )}
                 </div>
@@ -483,25 +484,27 @@ function DayTimeline({
                   style={{ top, height, left: 60, right: 0 }}
                   className={`absolute rounded-lg px-3 py-2 overflow-hidden group transition-colors z-20 ${
                     isConflict
-                      ? "bg-red-950/70 border border-red-700/70"
-                      : "bg-indigo-950/60 border border-indigo-800/50 hover:border-indigo-600/70"
+                      // Theme tokens: the old bg-indigo-950/60 had no light-mode
+                      // override, so light mode got dark text on a dark block.
+                      ? "bg-sev-major/15 border border-sev-major/50"
+                      : "bg-accent/15 border border-accent/40 hover:border-accent/70"
                   }`}
                 >
                   <div className="flex items-start justify-between gap-2 h-full">
                     <div className="min-w-0 flex-1">
                       <p className="text-white text-xs font-semibold leading-tight truncate">{e.title}</p>
                       {height >= 44 && (
-                        <p className={`text-xs font-mono mt-0.5 ${isConflict ? "text-red-400" : "text-indigo-400"}`}>
+                        <p className={`text-xs font-mono mt-0.5 ${isConflict ? "text-sev-major" : "text-accent"}`}>
                           {fmtTime(e.start_time)}
                           {e.end_time ? ` – ${fmtTime(e.end_time)}` : ""}
                           {isConflict ? "  ⚠ conflict" : ""}
                         </p>
                       )}
                       {height >= 60 && !e.location_inherited && e.location && (
-                        <p className="text-gray-500 text-xs mt-0.5 truncate">{e.location}</p>
+                        <p className="text-ink-muted text-xs mt-0.5 truncate">{e.location}</p>
                       )}
                       {height >= 60 && e.notes && (
-                        <p className="text-gray-600 text-xs mt-0.5 italic truncate">{e.notes}</p>
+                        <p className="text-ink-muted text-xs mt-0.5 italic truncate">{e.notes}</p>
                       )}
                       {e.tags?.length > 0 && (
                         <div className="flex flex-wrap gap-1 mt-1">
@@ -525,13 +528,13 @@ function DayTimeline({
                         <>
                           <button
                             onClick={() => onEdit(e)}
-                            className="text-gray-600 hover:text-indigo-400 text-xs opacity-0 group-hover:opacity-100 transition-opacity"
+                            className="text-ink-muted hover:text-indigo-400 text-xs opacity-0 group-hover:opacity-100 transition-opacity"
                           >
                             Edit
                           </button>
                           <button
                             onClick={() => onDelete(e.event_id)}
-                            className="text-gray-600 hover:text-red-400 text-base leading-none opacity-0 group-hover:opacity-100 transition-opacity"
+                            className="text-ink-muted hover:text-red-400 text-base leading-none opacity-0 group-hover:opacity-100 transition-opacity"
                           >
                             ×
                           </button>
@@ -543,9 +546,9 @@ function DayTimeline({
                 {drive && (
                   <div
                     style={{ top: top + height + 2, left: 60 }}
-                    className="absolute text-xs text-gray-600 font-mono flex items-center gap-1 z-20"
+                    className="absolute text-xs text-ink-muted font-mono flex items-center gap-1 z-20"
                   >
-                    <span className="text-gray-700">↓</span> {drive} drive
+                    <span className="text-ink-muted">↓</span> {drive} drive
                   </div>
                 )}
               </div>
@@ -557,18 +560,18 @@ function DayTimeline({
       {/* Untimed / all-day events */}
       {untimed.length > 0 && (
         <div className="space-y-1.5">
-          <p className="text-xs font-mono text-gray-600 uppercase tracking-wider">Unscheduled</p>
+          <p className="text-xs font-mono text-ink-muted uppercase tracking-wider">Unscheduled</p>
           {untimed.map((e) => (
             <div
               key={e.event_id}
-              className="bg-gray-900 border border-gray-800 rounded-lg px-4 py-2.5 flex items-center justify-between group"
+              className="bg-surface border border-line rounded-lg px-4 py-2.5 flex items-center justify-between group"
             >
               <div className="min-w-0">
                 <p className="text-white text-sm">{e.title}</p>
                 {!e.location_inherited && e.location && (
-                  <p className="text-gray-500 text-xs mt-0.5">{e.location}</p>
+                  <p className="text-ink-muted text-xs mt-0.5">{e.location}</p>
                 )}
-                {e.notes && <p className="text-gray-600 text-xs italic mt-0.5">{e.notes}</p>}
+                {e.notes && <p className="text-ink-muted text-xs italic mt-0.5">{e.notes}</p>}
                 {e.tags?.length > 0 && (
                   <div className="flex flex-wrap gap-1 mt-1">
                     {e.tags.map((t) => <TagPill key={t} tag={t} availableTags={availableTags} />)}
@@ -585,11 +588,11 @@ function DayTimeline({
                 {isAdmin && (
                   <>
                     <button onClick={() => onEdit(e)}
-                      className="text-xs text-gray-600 hover:text-indigo-400 opacity-0 group-hover:opacity-100 transition-opacity">
+                      className="text-xs text-ink-muted hover:text-indigo-400 opacity-0 group-hover:opacity-100 transition-opacity">
                       Edit
                     </button>
                     <button onClick={() => onDelete(e.event_id)}
-                      className="text-gray-600 hover:text-red-400 text-sm opacity-0 group-hover:opacity-100 transition-opacity">
+                      className="text-ink-muted hover:text-red-400 text-sm opacity-0 group-hover:opacity-100 transition-opacity">
                       ×
                     </button>
                   </>
@@ -728,17 +731,17 @@ function AssistantPanel({
   return (
     <div className="flex flex-col h-full">
       {/* Header */}
-      <div className="px-4 py-3 border-b border-gray-800 shrink-0 flex items-start justify-between gap-2">
+      <div className="px-4 py-3 border-b border-line shrink-0 flex items-start justify-between gap-2">
         <div>
           <p className="text-white text-sm font-semibold">Trip Assistant</p>
-          <p className="text-gray-500 text-xs mt-0.5">
+          <p className="text-ink-muted text-xs mt-0.5">
             Tell me what you want to do — I can search places and suggest events.
           </p>
         </div>
         {messages.length > 0 && (
           <button
             onClick={clearChat}
-            className="text-xs text-gray-600 hover:text-gray-400 transition-colors shrink-0 mt-0.5"
+            className="text-xs text-ink-muted hover:text-ink-2 transition-colors shrink-0 mt-0.5"
           >
             Clear
           </button>
@@ -758,7 +761,7 @@ function AssistantPanel({
               <button
                 key={prompt}
                 onClick={() => { setInput(prompt); }}
-                className="w-full text-left bg-gray-800/60 hover:bg-gray-800 border border-gray-700/50 rounded-lg px-3 py-2 text-gray-400 text-xs transition-colors"
+                className="w-full text-left bg-raised/60 hover:bg-raised border border-line-strong/50 rounded-lg px-3 py-2 text-ink-2 text-xs transition-colors"
               >
                 {prompt}
               </button>
@@ -772,7 +775,7 @@ function AssistantPanel({
               className={`rounded-xl px-3 py-2 text-sm max-w-[90%] ${
                 msg.role === "user"
                   ? "bg-indigo-600 text-white"
-                  : "bg-gray-800 text-gray-200"
+                  : "bg-raised text-ink"
               }`}
             >
               {msg.role === "user" ? msg.content : (
@@ -804,11 +807,11 @@ function AssistantPanel({
                   className={`w-full border rounded-xl p-3 space-y-1.5 transition-all ${
                     s.added
                       ? "border-green-800/50 bg-green-950/30"
-                      : "border-gray-700 bg-gray-900"
+                      : "border-line-strong bg-surface"
                   }`}
                 >
                   <p className="text-white text-sm font-semibold">{s.title}</p>
-                  <div className="text-xs text-gray-400 space-y-0.5">
+                  <div className="text-xs text-ink-2 space-y-0.5">
                     {s.date && (
                       <p>
                         {fmtDate(s.date)}
@@ -817,7 +820,7 @@ function AssistantPanel({
                       </p>
                     )}
                     {s.location && <p className="truncate">{s.location}</p>}
-                    {s.notes && <p className="text-gray-500 italic">{s.notes}</p>}
+                    {s.notes && <p className="text-ink-muted italic">{s.notes}</p>}
                     {s.tags && s.tags.length > 0 && (
                       <div className="flex flex-wrap gap-1 pt-0.5">
                         {s.tags.map((t) => <TagPill key={t} tag={t} availableTags={trip.available_tags ?? []} />)}
@@ -840,7 +843,7 @@ function AssistantPanel({
                       </button>
                       <button
                         onClick={() => dismissSuggestion(msg.id, idx)}
-                        className="px-3 text-gray-500 hover:text-gray-300 text-xs transition-colors"
+                        className="px-3 text-ink-muted hover:text-ink text-xs transition-colors"
                       >
                         Skip
                       </button>
@@ -856,7 +859,7 @@ function AssistantPanel({
 
         {loading && (
           <div className="flex items-start">
-            <div className="bg-gray-800 rounded-xl px-3 py-2 text-gray-400 text-sm">
+            <div className="bg-raised rounded-xl px-3 py-2 text-ink-2 text-sm">
               <span className="animate-pulse">Thinking…</span>
             </div>
           </div>
@@ -865,7 +868,7 @@ function AssistantPanel({
       </div>
 
       {/* Input */}
-      <div className="px-3 py-3 border-t border-gray-800 shrink-0">
+      <div className="px-3 py-3 border-t border-line shrink-0">
         <div className="flex gap-2">
           <textarea
             ref={inputRef}
@@ -875,7 +878,7 @@ function AssistantPanel({
             placeholder="What do you want to do?"
             disabled={loading}
             rows={1}
-            className="flex-1 bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 disabled:opacity-50 resize-none overflow-hidden"
+            className="flex-1 bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 disabled:opacity-50 resize-none overflow-hidden"
           />
           <button
             onClick={send}
@@ -955,7 +958,7 @@ export default function TripDetailPage() {
   async function handleDeleteTrip() {
     if (!trip) return;
     try { await c2api.deleteTrip(trip.trip_id); router.push("/trips"); }
-    catch (e) { console.error(e); }
+    catch (e) { alert(`Couldn't delete the trip: ${errorMessage(e)}`); }
   }
 
   async function handleDeleteEvent(eventId: string) {
@@ -963,7 +966,7 @@ export default function TripDetailPage() {
     try {
       await c2api.deleteTripEvent(trip.trip_id, eventId);
       setTrip((prev) => prev ? { ...prev, events: prev.events.filter((e) => e.event_id !== eventId) } : prev);
-    } catch (e) { console.error(e); }
+    } catch (e) { alert(`Couldn't delete the event: ${errorMessage(e)}`); }
   }
 
   async function handleUpdateEvent(body: object) {
@@ -1055,8 +1058,8 @@ export default function TripDetailPage() {
     setTrip((prev) => prev ? { ...prev, overlap_tags: overlap } : prev);
   }
 
-  if (loading) return <p className="text-gray-500 text-sm font-mono">Loading…</p>;
-  if (!trip)   return <p className="text-gray-500 text-sm font-mono">Trip not found.</p>;
+  if (loading) return <p className="text-ink-muted text-sm font-mono">Loading…</p>;
+  if (!trip)   return <p className="text-ink-muted text-sm font-mono">Trip not found.</p>;
 
   const days       = dateRange(trip.start_date, trip.end_date);
   const attendees  = Object.values(trip.attendees ?? {});
@@ -1070,7 +1073,7 @@ export default function TripDetailPage() {
       <div className="space-y-4">
         <button
           onClick={() => router.push("/trips")}
-          className="text-sm font-mono text-gray-500 hover:text-gray-300 transition-colors"
+          className="text-sm font-mono text-ink-muted hover:text-ink transition-colors"
         >
           ← Trips
         </button>
@@ -1078,7 +1081,7 @@ export default function TripDetailPage() {
         <div className="flex items-start justify-between gap-4 flex-wrap">
           <div className="space-y-1">
             <h1 className="text-white text-2xl font-bold">{trip.name}</h1>
-            <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-sm text-gray-400">
+            <div className="flex flex-wrap items-center gap-x-3 gap-y-1 text-sm text-ink-2">
               <span>{trip.location}</span>
               {trip.maps_link && (
                 <a href={trip.maps_link} target="_blank" rel="noopener noreferrer"
@@ -1086,11 +1089,11 @@ export default function TripDetailPage() {
                   Maps
                 </a>
               )}
-              <span className="text-gray-700">•</span>
+              <span className="text-ink-muted">•</span>
               <span className="font-mono text-xs">{fmtDate(trip.start_date)} — {fmtDate(trip.end_date)}</span>
               {attendees.length > 0 && (
                 <>
-                  <span className="text-gray-700">•</span>
+                  <span className="text-ink-muted">•</span>
                   <span className="text-xs">{attendees.join(", ")}</span>
                 </>
               )}
@@ -1114,7 +1117,7 @@ export default function TripDetailPage() {
                 </button>
                 <button
                   onClick={handleToggleVisibility}
-                  className="text-xs text-gray-500 hover:text-gray-300 transition-colors border border-gray-700 rounded-lg px-3 py-2"
+                  className="text-xs text-ink-muted hover:text-ink transition-colors border border-line-strong rounded-lg px-3 py-2"
                 >
                   {trip.visibility === "private" ? "Make public" : "Make private"}
                 </button>
@@ -1159,9 +1162,9 @@ export default function TripDetailPage() {
                   onChange={(e) => setTagInput(e.target.value)}
                   onKeyDown={(e) => e.key === "Enter" && (e.preventDefault(), handleAddTag())}
                   placeholder="Add tag…"
-                  className="bg-transparent border border-gray-700 rounded-full px-2.5 py-0.5 text-xs text-gray-400 placeholder-gray-600 focus:outline-none focus:border-gray-500 w-24"
+                  className="bg-transparent border border-line-strong rounded-full px-2.5 py-0.5 text-xs text-ink-2 placeholder-ink-muted focus:outline-none focus:border-gray-500 w-24"
                 />
-                <button onClick={handleAddTag} className="text-xs text-gray-500 hover:text-gray-300 transition-colors">+</button>
+                <button onClick={handleAddTag} className="text-xs text-ink-muted hover:text-ink transition-colors">+</button>
               </div>
             )}
           </div>
@@ -1170,13 +1173,13 @@ export default function TripDetailPage() {
         {/* Invite management — admin only, only when private */}
         {isAdmin && trip.visibility === "private" && (
           <div className="space-y-2">
-            <p className="text-xs text-gray-500 uppercase tracking-wider font-mono">Invited</p>
+            <p className="text-xs text-ink-muted uppercase tracking-wider font-mono">Invited</p>
             <div className="flex flex-wrap items-center gap-2">
               {(trip.invited_discord_ids ?? []).length === 0 && (
-                <span className="text-xs text-gray-600">No invites yet</span>
+                <span className="text-xs text-ink-muted">No invites yet</span>
               )}
               {(trip.invited_discord_ids ?? []).map((discordId) => (
-                <span key={discordId} className="inline-flex items-center gap-1 text-xs bg-gray-800 border border-gray-700 rounded-full px-2.5 py-0.5 text-gray-300">
+                <span key={discordId} className="inline-flex items-center gap-1 text-xs bg-raised border border-line-strong rounded-full px-2.5 py-0.5 text-ink-2">
                   <span className="font-mono">{discordId}</span>
                   <button
                     onClick={() => handleRevokeInvite(discordId)}
@@ -1192,9 +1195,9 @@ export default function TripDetailPage() {
                   onChange={(e) => setInviteInput(e.target.value)}
                   onKeyDown={(e) => e.key === "Enter" && (e.preventDefault(), handleInvite())}
                   placeholder="Discord user ID…"
-                  className="bg-transparent border border-gray-700 rounded-full px-2.5 py-0.5 text-xs text-gray-400 placeholder-gray-600 focus:outline-none focus:border-gray-500 w-36"
+                  className="bg-transparent border border-line-strong rounded-full px-2.5 py-0.5 text-xs text-ink-2 placeholder-ink-muted focus:outline-none focus:border-gray-500 w-36"
                 />
-                <button onClick={handleInvite} className="text-xs text-gray-500 hover:text-gray-300 transition-colors">+</button>
+                <button onClick={handleInvite} className="text-xs text-ink-muted hover:text-ink transition-colors">+</button>
               </div>
             </div>
           </div>
@@ -1218,13 +1221,13 @@ export default function TripDetailPage() {
                   className={`flex flex-col items-center px-3 py-2 rounded-xl text-xs transition-colors relative ${
                     day === selectedDay
                       ? "bg-indigo-600 text-white"
-                      : "bg-gray-900 border border-gray-800 text-gray-400 hover:border-gray-700 hover:text-gray-200"
+                      : "bg-surface border border-line text-ink-2 hover:border-line-strong hover:text-ink"
                   }`}
                 >
                   <span className="font-mono font-bold">{short}</span>
                   <span className="font-mono">{date}</span>
                   {count > 0 && (
-                    <span className={`text-xs mt-0.5 ${day === selectedDay ? "text-indigo-200" : "text-gray-600"}`}>
+                    <span className={`text-xs mt-0.5 ${day === selectedDay ? "text-indigo-200" : "text-ink-muted"}`}>
                       {count}
                     </span>
                   )}
@@ -1238,7 +1241,7 @@ export default function TripDetailPage() {
 
           {/* Selected day */}
           <div className="space-y-4">
-            <p className="text-sm font-mono text-gray-400 uppercase tracking-wider">
+            <p className="text-sm font-mono text-ink-2 uppercase tracking-wider">
               {fmtDayHeading(selectedDay)}
             </p>
             <DayTimeline
@@ -1254,7 +1257,7 @@ export default function TripDetailPage() {
         </div>
 
         {/* Right: AI Assistant — sticky */}
-        <div className="w-80 xl:w-96 shrink-0 sticky top-20 h-[calc(100vh-240px)] flex flex-col bg-gray-900 border border-gray-800 rounded-xl overflow-hidden">
+        <div className="w-80 xl:w-96 shrink-0 sticky top-20 h-[calc(100vh-240px)] flex flex-col bg-surface border border-line rounded-xl overflow-hidden">
           <AssistantPanel trip={trip} onAddEvent={handleAssistantAddEvent} />
         </div>
       </div>

drb-frontend/app/trips/page.tsx

@@ -5,6 +5,7 @@ import { useRouter } from "next/navigation";
 import { useAuth } from "@/components/AuthProvider";
 import { useTrips } from "@/lib/useTrips";
 import { c2api } from "@/lib/c2api";
+import { errorMessage } from "@/lib/c2error";
 import type { TripRecord } from "@/lib/types";
 
 function fmtDate(iso: string) {
@@ -29,25 +30,25 @@ function TripCard({ trip, isAdmin, onDelete }: {
 
   return (
     <div
-      className="bg-gray-900 border border-gray-800 rounded-xl p-5 cursor-pointer hover:border-gray-700 transition-colors"
+      className="bg-surface border border-line rounded-xl p-5 cursor-pointer hover:border-line-strong transition-colors"
       onClick={() => router.push(`/trips/${trip.trip_id}`)}
     >
       <div className="flex items-start justify-between gap-4">
         <div className="min-w-0">
           <div className="flex items-center gap-2 mb-1">
             <span className={`text-xs font-mono px-2 py-0.5 rounded-full ${
-              upcoming ? "bg-indigo-900 text-indigo-300" : "bg-gray-800 text-gray-500"
+              upcoming ? "bg-indigo-900 text-indigo-300" : "bg-raised text-ink-muted"
             }`}>
               {upcoming ? "Upcoming" : "Past"}
             </span>
           </div>
           <h3 className="text-white font-semibold text-sm leading-snug">{trip.name}</h3>
-          <p className="text-gray-400 text-xs mt-1">{trip.location}</p>
-          <p className="text-gray-500 text-xs font-mono mt-1">
+          <p className="text-ink-2 text-xs mt-1">{trip.location}</p>
+          <p className="text-ink-muted text-xs font-mono mt-1">
             {fmtDate(trip.start_date)} — {fmtDate(trip.end_date)}
           </p>
           {attendeeCount > 0 && (
-            <p className="text-gray-500 text-xs mt-1">
+            <p className="text-ink-muted text-xs mt-1">
               {attendeeCount} going
             </p>
           )}
@@ -102,59 +103,59 @@ function CreateModal({ onClose, onCreate }: {
     <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-50 p-4">
       <form
         onSubmit={handleSubmit}
-        className="bg-gray-900 border border-gray-700 rounded-xl p-6 w-full max-w-md space-y-4 max-h-[90vh] overflow-y-auto"
+        className="bg-surface border border-line-strong rounded-xl p-6 w-full max-w-md space-y-4 max-h-[90vh] overflow-y-auto"
       >
         <h2 className="text-white font-bold">New Trip</h2>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Name</label>
+          <label className="text-xs text-ink-2 block mb-1">Name</label>
           <input
             required value={name} onChange={(e) => setName(e.target.value)}
             placeholder="Road trip to Nashville"
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
         </div>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Location</label>
+          <label className="text-xs text-ink-2 block mb-1">Location</label>
           <input
             required value={location} onChange={(e) => setLocation(e.target.value)}
             placeholder="Nashville, TN"
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
         </div>
 
         <div className="grid grid-cols-2 gap-3">
           <div>
-            <label className="text-xs text-gray-400 block mb-1">Start date</label>
+            <label className="text-xs text-ink-2 block mb-1">Start date</label>
             <input
               required type="date" value={start} onChange={(e) => setStart(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
           <div>
-            <label className="text-xs text-gray-400 block mb-1">End date</label>
+            <label className="text-xs text-ink-2 block mb-1">End date</label>
             <input
               required type="date" value={end} onChange={(e) => setEnd(e.target.value)}
               min={start}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
             />
           </div>
         </div>
 
         <div>
-          <label className="text-xs text-gray-400 block mb-1">Google Maps link (optional)</label>
+          <label className="text-xs text-ink-2 block mb-1">Google Maps link (optional)</label>
           <input
             type="url" value={mapsLink} onChange={(e) => setMapsLink(e.target.value)}
             placeholder="https://maps.google.com/…"
-            className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+            className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
           />
         </div>
 
         {error && <p className="text-red-400 text-xs">{error}</p>}
 
         <div className="flex gap-3 justify-end">
-          <button type="button" onClick={onClose} className="text-sm text-gray-400 hover:text-gray-200 px-4 py-2">
+          <button type="button" onClick={onClose} className="text-sm text-ink-2 hover:text-ink px-4 py-2">
             Cancel
           </button>
           <button
@@ -179,8 +180,9 @@ export default function TripsPage() {
   const past     = trips.filter((t) => t.end_date < today);
 
   async function handleDelete(id: string) {
+    if (!confirm("Delete this trip?")) return;
     try { await c2api.deleteTrip(id); }
-    catch (e) { console.error(e); }
+    catch (e) { alert(`Couldn't delete the trip: ${errorMessage(e)}`); }
   }
 
   return (
@@ -198,12 +200,12 @@ export default function TripsPage() {
       </div>
 
       {loading ? (
-        <p className="text-gray-500 text-sm font-mono">Loading…</p>
+        <p className="text-ink-muted text-sm font-mono">Loading…</p>
       ) : (
         <>
           {upcoming.length > 0 && (
             <section>
-              <h2 className="text-sm font-mono text-gray-400 uppercase tracking-wider mb-3">Upcoming</h2>
+              <h2 className="text-sm font-mono text-ink-2 uppercase tracking-wider mb-3">Upcoming</h2>
               <div className="space-y-3">
                 {upcoming.map((t) => (
                   <TripCard key={t.trip_id} trip={t} isAdmin={isAdmin} onDelete={handleDelete} />
@@ -214,7 +216,7 @@ export default function TripsPage() {
 
           {past.length > 0 && (
             <section>
-              <h2 className="text-sm font-mono text-gray-400 uppercase tracking-wider mb-3">Past</h2>
+              <h2 className="text-sm font-mono text-ink-2 uppercase tracking-wider mb-3">Past</h2>
               <div className="space-y-3">
                 {past.map((t) => (
                   <TripCard key={t.trip_id} trip={t} isAdmin={isAdmin} onDelete={handleDelete} />
@@ -224,7 +226,7 @@ export default function TripsPage() {
           )}
 
           {trips.length === 0 && (
-            <p className="text-gray-600 text-sm font-mono">No trips yet.</p>
+            <p className="text-ink-muted text-sm font-mono">No trips yet.</p>
           )}
         </>
       )}

drb-frontend/app/waitlist/page.tsx

@@ -40,11 +40,11 @@ export default function WaitlistPage() {
         <span className="inline-flex items-center justify-center w-8 h-8 rounded-lg bg-indigo-600 text-white">D</span>
         DRB
       </Link>
-      <div className="bg-gray-900 border border-gray-700 rounded-xl p-8 space-y-5 font-mono">
+      <div className="bg-surface border border-line-strong rounded-xl p-8 space-y-5 font-mono">
         {done ? (
           <>
             <h1 className="text-white text-lg font-bold">You&apos;re on the list</h1>
-            <p className="text-gray-400 text-sm leading-relaxed">
+            <p className="text-ink-2 text-sm leading-relaxed">
               Thanks — we&apos;ll reach out at the email you gave us. In the meantime, feel free to{" "}
               <Link href="/faq" className="text-indigo-400 hover:text-indigo-300 transition-colors">read the FAQ</Link>.
             </p>
@@ -53,39 +53,39 @@ export default function WaitlistPage() {
           <>
             <div>
               <h1 className="text-white text-lg font-bold">Request access</h1>
-              <p className="text-gray-400 text-xs mt-2 leading-relaxed">
+              <p className="text-ink-2 text-xs mt-2 leading-relaxed">
                 Self-serve signup isn&apos;t open yet. Leave your details and we&apos;ll follow up to get your organization set up.
               </p>
             </div>
             <form onSubmit={handleSubmit} className="space-y-4">
               <div>
-                <label className="text-xs text-gray-400 block mb-1">Email</label>
+                <label className="text-xs text-ink-2 block mb-1">Email</label>
                 <input
                   type="email"
                   value={email}
                   onChange={(e) => setEmail(e.target.value)}
                   required
                   autoComplete="email"
-                  className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                  className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
                 />
               </div>
               <div>
-                <label className="text-xs text-gray-400 block mb-1">Organization (optional)</label>
+                <label className="text-xs text-ink-2 block mb-1">Organization (optional)</label>
                 <input
                   type="text"
                   value={orgName}
                   onChange={(e) => setOrgName(e.target.value)}
-                  className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+                  className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
                 />
               </div>
               <div>
-                <label className="text-xs text-gray-400 block mb-1">Anything else? (optional)</label>
+                <label className="text-xs text-ink-2 block mb-1">Anything else? (optional)</label>
                 <textarea
                   value={note}
                   onChange={(e) => setNote(e.target.value)}
                   rows={3}
                   maxLength={2000}
-                  className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 resize-none"
+                  className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 resize-none"
                 />
               </div>
               {error && <p className="text-red-400 text-xs">{error}</p>}

drb-frontend/components/CallRow.tsx

@@ -85,17 +85,17 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
   return (
     <>
       <tr
-        className={`border-b border-gray-800 font-mono text-sm ${hasDetails ? "cursor-pointer hover:bg-gray-900/50" : "hover:bg-gray-900/30"}`}
+        className={`border-b border-line font-mono text-sm ${hasDetails ? "cursor-pointer hover:bg-raised/50" : "hover:bg-raised/30"}`}
         onClick={() => hasDetails && setExpanded((v) => !v)}
       >
-        <td className="px-4 py-2 text-gray-400 text-xs whitespace-nowrap">
-          <span className="text-gray-600">{new Date(call.started_at).toLocaleDateString([], { month: "short", day: "numeric" })} </span>
+        <td className="px-4 py-2 text-ink-2 text-xs whitespace-nowrap">
+          <span className="text-ink-muted">{new Date(call.started_at).toLocaleDateString([], { month: "short", day: "numeric" })} </span>
           {new Date(call.started_at).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit" })}
         </td>
-        <td className="px-4 py-2 text-gray-300">
+        <td className="px-4 py-2 text-ink-2">
           <span>{call.talkgroup_name || call.talkgroup_id || "—"}</span>
           {call.tags && call.tags.length > 0 && (
-            <span className={`ml-2 text-xs px-1.5 py-0.5 rounded-full capitalize ${TAG_COLORS[call.tags[0]] ?? "bg-gray-800 text-gray-400"}`}>
+            <span className={`ml-2 text-xs px-1.5 py-0.5 rounded-full capitalize ${TAG_COLORS[call.tags[0]] ?? "bg-raised text-ink-2"}`}>
               {call.tags[0]}
             </span>
           )}
@@ -104,29 +104,29 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
             <span className="ml-2">{severityBadge(call.severity)}</span>
           )}
         </td>
-        <td className="px-4 py-2 text-gray-400 hidden sm:table-cell">{systemName ?? call.system_id ?? "—"}</td>
-        <td className="px-4 py-2 text-gray-400 hidden sm:table-cell">{call.node_id}</td>
+        <td className="px-4 py-2 text-ink-2 hidden sm:table-cell">{systemName ?? call.system_id ?? "—"}</td>
+        <td className="px-4 py-2 text-ink-2 hidden sm:table-cell">{call.node_id}</td>
         <td className="px-4 py-2">
           {isActive ? (
             <span className="text-orange-400 animate-pulse">● live</span>
           ) : (
-            <span className="text-gray-500">{duration(call.started_at, call.ended_at)}</span>
+            <span className="text-ink-muted">{duration(call.started_at, call.ended_at)}</span>
           )}
         </td>
         <td className="px-4 py-2 text-xs">
           {hasAudio ? (
-            <span className="text-blue-400">▶</span>
+            <span className="text-accent">▶</span>
           ) : (
-            <span className="text-gray-700">—</span>
+            <span className="text-ink-muted">—</span>
           )}
         </td>
-        <td className="px-4 py-2 text-gray-600 text-xs">
+        <td className="px-4 py-2 text-ink-muted text-xs">
           {hasDetails && (expanded ? "▲" : "▼")}
         </td>
       </tr>
 
       {expanded && hasDetails && (
-        <tr className="bg-gray-900/60 border-b border-gray-800">
+        <tr className="bg-surface/60 border-b border-line">
           <td colSpan={7} className="px-6 py-3 space-y-2">
             {/* Audio player */}
             {hasAudio && (
@@ -140,7 +140,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
                   onClick={(e) => e.stopPropagation()}
                 />
               ) : (
-                <p className="text-xs text-gray-600 font-mono">Loading audio…</p>
+                <p className="text-xs text-ink-muted font-mono">Loading audio…</p>
               )
             )}
 
@@ -150,7 +150,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
                 {call.tags.map((tag) => (
                   <span
                     key={tag}
-                    className={`text-xs px-2 py-0.5 rounded-full capitalize ${TAG_COLORS[tag] ?? "bg-gray-800 text-gray-400"}`}
+                    className={`text-xs px-2 py-0.5 rounded-full capitalize ${TAG_COLORS[tag] ?? "bg-raised text-ink-2"}`}
                   >
                     {tag}
                   </span>
@@ -161,7 +161,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
             {/* Incident links — one per scene detected in the recording */}
             {incidentIds.length > 0 && (
               <div className="flex flex-wrap gap-x-3 gap-y-0.5 text-xs font-mono text-indigo-400">
-                <span className="text-gray-600">{incidentIds.length === 1 ? "Incident:" : "Incidents:"}</span>
+                <span className="text-ink-muted">{incidentIds.length === 1 ? "Incident:" : "Incidents:"}</span>
                 {incidentIds.map((id) => (
                   <a key={id} href={`/incidents/${id}`} className="underline hover:text-indigo-300">
                     {id.slice(0, 8)}…
@@ -172,9 +172,9 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
 
             {/* Correlation debug — admin only */}
             {isAdmin && call.corr_path && (
-              <div className="flex flex-wrap gap-x-3 gap-y-0.5 text-xs font-mono text-gray-600">
+              <div className="flex flex-wrap gap-x-3 gap-y-0.5 text-xs font-mono text-ink-muted">
                 <span>corr:</span>
-                <span className="text-gray-400">{call.corr_path}</span>
+                <span className="text-ink-2">{call.corr_path}</span>
                 {call.corr_incident_idle_min != null && (
                   <span>idle {call.corr_incident_idle_min}min</span>
                 )}
@@ -200,7 +200,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
                   value={editText}
                   onChange={(e) => setEditText(e.target.value)}
                   rows={4}
-                  className="w-full bg-gray-800 border border-gray-600 rounded-lg px-3 py-2 text-xs text-gray-200 font-mono focus:outline-none focus:border-indigo-500 resize-none"
+                  className="w-full bg-raised border border-line-strong rounded-lg px-3 py-2 text-xs text-ink font-mono focus:outline-none focus:border-indigo-500 resize-none"
                 />
                 <div className="flex items-center gap-2 flex-wrap">
                   <button
@@ -212,7 +212,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
                   </button>
                   <button
                     onClick={(e) => { e.stopPropagation(); setEditing(false); }}
-                    className="text-xs text-gray-500 hover:text-gray-300 px-3 py-1 transition-colors"
+                    className="text-xs text-ink-muted hover:text-ink px-3 py-1 transition-colors"
                   >
                     Cancel
                   </button>
@@ -224,23 +224,23 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
             ) : hasSegments ? (
               <div className="space-y-1">
                 <div className="flex items-center justify-between">
-                  <span className="text-xs text-gray-600 font-mono">
+                  <span className="text-xs text-ink-muted font-mono">
                     {hasBoth && !showOriginal ? "corrected" : `${call.segments!.length} transmissions`}
                   </span>
                   {isAdmin && (
-                    <button onClick={(e) => { e.stopPropagation(); startEdit(); }} className="text-xs text-gray-600 hover:text-gray-400 font-mono transition-colors">edit</button>
+                    <button onClick={(e) => { e.stopPropagation(); startEdit(); }} className="text-xs text-ink-muted hover:text-ink-2 font-mono transition-colors">edit</button>
                   )}
                 </div>
                 {hasBoth && !showOriginal ? (
-                  <pre className="text-xs text-gray-300 bg-gray-800 rounded-lg px-4 py-3 whitespace-pre-wrap font-mono leading-relaxed max-h-48 overflow-y-auto">
+                  <pre className="text-xs text-ink-2 bg-raised rounded-lg px-4 py-3 whitespace-pre-wrap font-mono leading-relaxed max-h-48 overflow-y-auto">
                     {call.transcript_corrected}
                   </pre>
                 ) : (
-                  <div className="bg-gray-800 rounded-lg px-4 py-3 space-y-2 max-h-48 overflow-y-auto">
+                  <div className="bg-raised rounded-lg px-4 py-3 space-y-2 max-h-48 overflow-y-auto">
                     {call.segments!.map((seg, i) => (
                       <div key={i} className="flex gap-3 text-xs font-mono">
-                        <span className="text-gray-600 shrink-0">{i + 1}. [{seg.start}s]</span>
-                        <span className="text-gray-300">{seg.text}</span>
+                        <span className="text-ink-muted shrink-0">{i + 1}. [{seg.start}s]</span>
+                        <span className="text-ink-2">{seg.text}</span>
                       </div>
                     ))}
                   </div>
@@ -248,7 +248,7 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
                 {hasBoth && (
                   <button
                     onClick={(e) => { e.stopPropagation(); setShowOriginal((v) => !v); }}
-                    className="text-xs text-gray-600 hover:text-gray-400 font-mono transition-colors"
+                    className="text-xs text-ink-muted hover:text-ink-2 font-mono transition-colors"
                   >
                     {showOriginal ? "show corrected ↑" : "show original ↓"}
                   </button>
@@ -258,27 +258,27 @@ export function CallRow({ call, systemName, isAdmin }: Props) {
               <div className="space-y-1">
                 <div className="flex items-center justify-between">
                   <div className="flex items-center gap-2">
-                    {hasBoth && <span className="text-xs text-gray-600 font-mono">{showOriginal ? "original" : "corrected"}</span>}
-                    {!hasBoth && call.transcript_corrected && <span className="text-xs text-gray-600 font-mono">corrected</span>}
+                    {hasBoth && <span className="text-xs text-ink-muted font-mono">{showOriginal ? "original" : "corrected"}</span>}
+                    {!hasBoth && call.transcript_corrected && <span className="text-xs text-ink-muted font-mono">corrected</span>}
                   </div>
                   {isAdmin && (
-                    <button onClick={(e) => { e.stopPropagation(); startEdit(); }} className="text-xs text-gray-600 hover:text-gray-400 font-mono transition-colors">edit</button>
+                    <button onClick={(e) => { e.stopPropagation(); startEdit(); }} className="text-xs text-ink-muted hover:text-ink-2 font-mono transition-colors">edit</button>
                   )}
                 </div>
-                <pre className="text-xs text-gray-300 bg-gray-800 rounded-lg px-4 py-3 whitespace-pre-wrap font-mono leading-relaxed max-h-40 overflow-y-auto">
+                <pre className="text-xs text-ink-2 bg-raised rounded-lg px-4 py-3 whitespace-pre-wrap font-mono leading-relaxed max-h-40 overflow-y-auto">
                   {displayTranscript}
                 </pre>
                 {hasBoth && (
                   <button
                     onClick={(e) => { e.stopPropagation(); setShowOriginal((v) => !v); }}
-                    className="text-xs text-gray-600 hover:text-gray-400 font-mono transition-colors"
+                    className="text-xs text-ink-muted hover:text-ink-2 font-mono transition-colors"
                   >
                     {showOriginal ? "show corrected ↑" : "show original ↓"}
                   </button>
                 )}
               </div>
             ) : (
-              <p className="text-xs text-gray-600 font-mono italic">No transcript available.</p>
+              <p className="text-xs text-ink-muted font-mono italic">No transcript available.</p>
             )}
           </td>
         </tr>