Land the seeding world gate on main and pin merged submodules

[jehanazad]

Summary

Recovery PR for a stacked-merge race: #268 merged into its base branch feat/adsb-world-provenance after #267 had already merged that branch to main, so the seeding-pool world gate never reached main. This merges the stranded wiring in and bumps both submodule pins to the upstream merge commits.

Changes

• Merge origin/feat/adsb-world-provenance (= the Wire the world gate into ADS-B seeding #268 content: node_world moved to core/state.py as the single world authority, wired into the associator ctor, auto-tag snapshot filtered by world, world_rejects in /api/radar/association/status).
• libs/retina-analytics → 1450417 (merge commit of Gate ADS-B seed verification by world retina-analytics#23, replacing the branch-head pin 7495ce4 — same tree).
• libs/retina-simulation → 754cca1 (merge commit of Make the adsb.lol relay opt-in and declare its world retina-simulation#12: --real-adsb opt-in relay gate + source:"real" tagging). This is the pin the fleet rebuild needs to actually stop the adsb.lol relay.

Test coverage

• Targeted backend suites green on this branch against the merge-commit pins: test_known_claiming.py, test_adsb_seed_backend.py, test_solver_stats.py, test_sim_ingest.py (145 passed).
• Pre-commit gate clean.

Review notes

• The code diff vs main is exactly what Wire the world gate into ADS-B seeding #268 already reviewed; the only new material is the two submodule pointer bumps.

🤖 Generated with Claude Code

[claude]

Claude finished @jehanazad's task in 5m 32s —— View job

---

Code review — PR #269

• Gather context (PR diff, description, CLAUDE.md)
• Understand request: code review (/code-review:code-review offworldlabs/retina-server/pull/269)
• Run code review over the PR diff
• Post review findings

Scope: Traced the retina-server diff line-by-line (this PR is mostly the stranded #268 content landing, plus two submodule pin bumps) and cross-checked call sites for the _node_world → state.node_world() move.

What looks solid:

• backend/core/state.py: node_world() is a clean move of known_claiming._node_world, correctly ordered before node_associator construction, wired via node_world_provider=node_world.
• known_claiming.py / frame_processor.py: all call sites updated to state.node_world(...); grepped the backend for stale _node_world references — none remain.
• frame_processor.py's new cross-world filter mirrors the existing gate in known_claiming.py and is covered by a new, well-constructed test (test_cross_world_state_is_not_attached).
• routes/analytics.py's new world_rejects key follows the existing getattr(..., 0) pattern used for every other counter in that block.
• Import ordering/circularity for the relocated function is safe — the function-local import inside core/state.py is preserved, matching the pre-existing pattern.
• Submodule pin bumps (libs/retina-analytics, libs/retina-simulation) couldn't be inspected directly (no network access to the submodule repos in this sandbox), but test_associator_gets_the_state_world_resolver self-verifies the node_world_provider kwarg name — a mismatch there would raise TypeError at import and fail the whole suite, so that risk is effectively covered by construction.

No correctness bugs found in the retina-server-side diff — it's a faithful move/rename plus a correctly-gated, well-tested new filter. Two observability gaps worth a look:

1. backend/routes/analytics.py:175 — world_rejects counter is untested against a real reject

"world_rejects": getattr(_a, "adsb_seed_world_rejects", 0),

This reads adsb_seed_world_rejects via getattr(..., 0), but no test exercises an actual cross-world seed-reject to confirm that attribute name matches what the pinned retina-analytics lib exposes. If the pinned lib's counter is named differently — now or after a future submodule bump — getattr silently falls back to 0: /api/radar/association/status would report zero world-rejects forever with no test failure, masking exactly the cross-world contamination this PR was built to surface. The existing test_association_status_carries_the_adsb_seed_block only checks key presence, not that the value reflects a real reject.

2. backend/services/frame_processor.py:379-380 — silent filtering in the predictive-tagging world gate

_nw = state.node_world(node_id)
_states = {h: s for h, s in state._adsb_for_seeding().items() if s.get("world") in (None, _nw)}

This new filter drops other-world ADS-B states with no counter, unlike its sibling world gates in this same PR (known_claiming's known_claims_world_rejects, the associator's adsb_seed_world_rejects) which are the documented single source of truth for this kind of rejection. A node with heavy real/sim cache overlap could have most of its predictive auto-tag candidates filtered out every frame with zero operator-visible signal — there'd be no way to distinguish "no aircraft nearby" from "world gate is silently discarding everything" via the existing /api/radar/association/status telemetry.

Neither is a correctness bug in this PR — both are pre-existing-style gaps in observability that this PR's own stated goal (making cross-world contamination visible) would benefit from closing.