Same call_id linked into 2 incident records with identical extracted data (~2% of linked calls) #131
Closed
opened 2026-09-13 13:19:39 -04:00 by logan
·
2 comments
No Branch/Tag Specified
Labels
Clear labels
area/ai-pipeline
area/auth
area/billing
area/correlation
area/discord
area/frontend
area/governance
area/growth
area/infra-deploy
area/legal
area/map
area/mqtt
area/node-ota
area/osint
area/recording-audio
area/sdr-radio
area/transcription
board
board:agenda
minutes:draft
minutes:final
role:ceo
role:cfo
role:cio
role:ciso
role:cmo
role:coo
role:cto
Scene/entity extraction, summarizer, AI providers, embeddings
AuthN/Z, roles, tenancy/org scoping, API keys, credentials
Plans, entitlements, AI spend accounting and caps
Incident correlation, linking, lifecycle, severity, corr_debug
Discord bot, radio bots, voice streams, bot tokens, webhooks
Web UI: Next.js app and the edge-node local dashboard
Board process, minutes, unattended runner, agent tooling
Go-to-market, outreach, cold email, discovery conversations
CI/CD, VM, registry, Firestore rules/indexes deploy, Terraform/Caddy
ToS, retention, licences/DAAs, CAN-SPAM, E&O, name suppression
Live map: pins, paths, tiles, legend, geocoding
Node-C2 MQTT, checkins, commands, node sweeper, dynsec
Node install, enrollment, OTA updater, image skew
External feeds: cameras, 511, ADS-B, AIS, outages, and their licences
Call capture, boundaries, PulseAudio, ring buffer, trimming, attribution
OP25 decode, SDR hardware/tuning, conventional, second SDR, mesh radio
STT, transcript correction, place verification, name accuracy
Board process: minutes and board-filed items
Needs board scoping at the next sitting; CEO removes the label once scoped
One exec pre-read, closed by CEO
CEO ruling; open until enacted
Filed by the CEO
Filed by the CFO
Filed by the CIO
Filed by the CISO
Filed by the CMO
Filed by the COO
Filed by the CTO
kind
behavior-bug
Wrong product behavior; the instrument reads it correctly
kind
measurement-bug
Corrupts the recording/instrument (debug data, evals, health checks), not behavior
priority
p0
Drop everything: prod broken, live exposure, or owner-ruled P0
priority
p1
Next up: blocks a gate, a customer, or core incident quality
priority
p2
Normal: real defect or planned work, schedule in turn
priority
p3
Low: minor, cosmetic, or someday
status
blocked
Waiting on an external party, spend, or another issue
status
in-progress
Branch or PR open against it
status
needs-decision
Waiting on an owner or board ruling before work
status
needs-info
Root cause or repro unknown; needs a reading first
type
bug
Something built is wrong: code, data, or a measurement
type
chore
Maintenance, refactor, tests, pinning, cleanup: no user-visible change
type
decision
A ruling to make or record: board minutes, owner calls, legal reviews
type
docs
Docs, runbooks, CLAUDE.md, skills, SOPs
type
feature
New capability or an extension of an existing one
type
security
Security, privacy, credential or tenant-isolation exposure
type
tracking
Tracker, checklist, initiative or punch-list spanning several changes
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: logan/server-26#131
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Investigation of #5 (scene over-splitting) found this instead, while ruling out #5's own stated mechanism. Full evidence in the #5 comment thread.
The bug: the same single-scene call (
call_id) ends up attached to TWO separate incident records with byte-identical extracted data (same tags, location, units, severity) — not two different scenes describing two different things, the exact same extracted content, duplicated across incidents.Scan across 3 live dumps (
corr_dump_9-7_0437am.json,corr_dump_9-7_pm.json,corr_dump_9-12.json): 10 hits total (4/2/4), out of 173/173/181 linked calls per window (~2%). Every hit has identicaltags/location/units/severitybetween its two incident appearances — ruling out genuine multi-scene extraction (which would produce different content per scene).Example (
corr_dump_9-7_0437am), transcript: "6-David, that's going to be track 4, intox male in his 40s, track 4, Mt. Vernon East. Affirmative. 10-4." — appears in incident3254fd80("Intoxicated Subject at track 4, Mt. Vernon East") ANDfe04dd3a("Police — MTA PD Districts 6/7/11 - Police Dispatch"), both carryingtags=['intoxicated-subject'],location='track 4, Mt. Vernon East',units=['6-David']. This is the same call DEFERRED.md cites from 2026-09-06 (then 3 incidents) — still occurring 2026-09-07 (now 2 incidents).Likely mechanism:
corr_path/corr_consensuson the two appearances are usually identical (bothnew/tiebreak, or bothfast/disambig/agreed) — consistent with the same call being run through correlation twice (initial pass + a re-correlation sweep pass, or two overlapping upload/reprocess paths), with each pass landing on or creating a different incident target without removing the call from the other. Needs an engineer readingincident_correlator.py's sweep/re-correlationcall_ids-append path — does anything guard against a call already carrying anincident_idbeing re-appended to a second, different incident without being detached from the first?Test gap: nothing currently covers "the same call_id must not end up in two different incidents'
call_ids" — worth an invariant test regardless of root cause once found.Relates to: #5 (originally suspected as the mechanism; ruled out — closing #5, this issue replaces it), #27 (sweep retry budget), #96 (per-scene call-doc storage, unrelated mechanism but same investigation pass).
Fixed by PR #154, merged to main. Root cause was a race between the re-correlation sweep and the real-time upload pipeline, not a scene-extraction issue -- confirmed with drb-correlation-review. Follow-up filed at #153 (missing client timeouts, the actual reason the 5-min hold-back was raised to 15).
Fix confirmed working — window #5 measurement (
CORRELATION_REVIEW_0914.md).Zero duplicate-links among calls that started after this window began (i.e., processed entirely under the fixed code, deployed as
a919770). The 3 duplicates visible in the raw (non-time-boxed) dump all started 2026-09-13, hours before the fix deployed -- pre-existing contamination, not a new occurrence.Not addressed: those 3 stale duplicates are still bad data in the database (each linked to two incidents). Cosmetic at this volume -- not filing a cleanup issue unless it recurs at scale.