Make neighbor position estimates conservative and evidence-aware

[dborup]

Summary

Make neighbor-derived estimates conservative and evidence-aware, and show neighbor evidence geometry instead of a precise-looking estimated pin on node details.

• One shared, bounded geographic-group estimator caps traffic influence, decays older evidence, excludes negligible contributors, and abstains for insufficient or similarly supported competing groups.
• The map shows a dashed convex hull of supported visible neighbors, or a line for two/collinear positions. Coincident positions provide no geometry. It never invents a radius from neighbor spread.
• The node may be outside this geometry. This is not triangulation, a calibrated confidence region, or a radio coverage boundary. Direct RSSI and four direct observers are not required.
• Reported GPS remains separate and unchanged. Compatibility centroid fields remain in the API, but node views no longer plot them as estimated position pins or print approximate centroid coordinates.
• Node-detail contributors are checked with the existing bulk identity-visibility helper, including hidden observer aliases and both blacklists. Visibility lookup failure abstains.
• Typed API/OpenAPI documentation and the node guide describe the geometry, limitations, dates, and independent held-out evaluation procedure.

Scope and compatibility

No ingestor, schema, deployment, production configuration, or dependency changes. No additional workflow changes in this update. Legacy approximate path consumers retain their existing filtering and centroid contracts; node-detail centroids may differ when privacy exclusions apply.

Initial uncalibrated policy choices remain: 30 km seed radius, logarithmic count weighting capped at 20, seven-day age half-life, 0.25 unknown-freshness multiplier, 10% relative evidence floor, and 80% competing-group threshold. Exposing these in the Customizer is a separate follow-up; this update adds no new operator setting.

Performance

Candidate work remains bounded to 20. Grouping is at most a 20-by-20 distance matrix; geometry adds a bounded sort/hull and at most 20 vertices. Node-detail visibility uses a bulk lookup, never per-contributor queries. No network requests per neighbor are added.

Fresh Apple M5 / Go 1.26.3 maximum-candidate samples: 10.73–10.98 microseconds/op, 5,000 B/op, 20 allocations/op. The previously documented estimator without geometry measured approximately 7.7 microseconds/op, 2,944 B/op, 10 allocations/op. These are separate runs, not a controlled speed comparison: geometry adds work and allocations, including in legacy estimator callers.

Fresh local validation for this update

• Full Go server suite passed; unchanged ingestor suite passed.
• Focused geometry/visibility tests passed with the race detector; server and ingestor vet passed.
• All 202 frontend test files passed.
• Frontend regression checks cover malformed/missing geometry, abstention, legacy responses, antimeridian handling, and unchanged reported GPS.
• Actual local Chromium/Leaflet browser validation: 525 checks passed, independently rerun by the parent. Covers full node pages at 390/768/1440 px, actual mobile list navigation, desktop panes, polygon/line/no-geometry cases, reported GPS, and dateline geometry. External map tiles are blocked; synthetic API fixtures are used. Screenshots were inspected. This is presentation validation, not field accuracy validation.
• Whitespace and JavaScript syntax checks passed.

Earlier PR validation and accuracy-evaluation design remain applicable, but no real-world accuracy percentage has been established. The offline three-receiver RSSI experiment is not a positioning calibration and no private measurements are committed.

Open limitations and merge gate

• This PR remains a draft and currently conflicts with newer master. It must be synchronized and retested before merge, including compatibility with the separate estimated-position operator switch in PR feat: add operator switch for estimated node positions #318. Neither PR is merged by this task.
• The earlier broad test-e2e-playwright.js run stopped on the existing #navStats wait on both this branch and its pristine old base; the owner previously approved a draft with that limitation recorded. This update does not claim a fresh green broad-suite run.
• Top-20 lifetime edge selection precedes position/freshness filtering; useful candidates can still be missed.
• Neighbor positions and persisted edges are not independently verified RF sources. Coherent but wrong evidence can yield a misleading area.
• The ambiguity heuristic is incomplete and similarly old evidence can still pass the relative floor. Read sighting dates; estimated does not establish a current location.
• A hull or line represents neighbor evidence, not measured target-location uncertainty. The target may lie outside it.
• Existing approximate positions in other path/analytics consumers are not converted to areas by this update.
• Tablet list selection opens the existing summary-only slide-over without a map. The full tablet page is covered directly; its existing same-hash “Open full detail” navigation issue is not fixed here.

No staging/production contact, merge, or deployment is part of this update.

[dborup]

Parked on purpose: the operator switch from #318 now lets an instance disable neighbor-derived estimates entirely, and the instances we run will have them disabled. Revisit if estimates are re-enabled.