Community aggregate metrics and pilot operating model

State: FROZEN definitions, 2026-10-02. Owner phase P23-T03 (issue #93). Definitions freeze here before any instrumentation: no metric below may be collected, logged or displayed until its row is marked COLLECTED with the stated source. Existing backend/frontier modules are locally integrated; the new commercial UX is not. No future phase is implemented by this document.

Collection posture (verified, not promised)

• Android ships zero analytics SDKs (dependency scan 2026-10-02: no Firebase/Crashlytics/Sentry/telemetry client) and no advertising ID; location, notifications and photos are runtime opt-ins. Anything the app does not already persist locally is NOT_COLLECTED.
• Backend service metrics stay under the existing label policy (docs/operator/monitoring.md): bounded series, route templates only, contributor/station/observation IDs can never be label values (pinned by unit test), private scrape endpoint.
• Consent basis: account-gated writes already require a live session; notifications/location/photos require OS runtime grant; anonymous reads need nothing. No new consent surface is created by these definitions.

Frozen aggregate definitions

Metric	Purpose	Denominator / window	Min. aggregation	Retention / deletion	Status
Fresh station coverage	Pilot readiness per city	Directory stations in the pilot city; 7-day survey cadence	City-level only; no per-contributor breakdown	Recomputed; no retained series	DEFINED
Observation age (median)	Staleness honesty	Current projections in the pilot city; rolling 7 days	City-level, n≥5 stations or withheld	Recomputed; no retained series	DEFINED
Confirmation delay	Pipeline health	Import → consensus completion; per survey week	Job-system counters only (jobs_oldest_queued_seconds exists)	Existing job retention	COLLECTED (infra counters)
Valid / rejected / disputed share	Consensus quality	Community decisions per survey week	Week-level shares; no contributor rows	Follows observation retention	DEFINED
Contribution completion	Funnel health	Started vs submitted captures	Local-only; never leaves the device	App-data lifetime (user-cleared)	DEFINED, device-local
Report volume	Abuse load signal	Reports filed per city per week	City/week counts; reporter identity never stored anywhere	Case retention (12 months, audit rows first)	COLLECTED (moderation cases)
Moderation backlog / response	Staffing adequacy	Open cases; report → decision latency	Operator-only; never public	Case retention (12 months)	COLLECTED (ops queue listing)
Opt-in return participation	Return-flow value	Alert-enabled vehicles with ≥1 shown alert per week	Cohort counts, n≥5 or withheld	Device-local history (user-cleared)	DEFINED, device-local

Rules: percentages render only with the exact denominator beside them (no 0% certainty, no invented coverage); sparse cells show the dated ANP reference instead; nothing here creates per-user tracking.

Low-coverage city handling

Below usable community density the product stays honest: UNKNOWN / no-coverage states, dated ANP reference, no simulated members, prices or activity. Opening a city requires the staffing checklist below recorded in its pilot plan — never implied by this document.

Staffing / capacity / moderation checklist (per pilot city)

• Named moderation coverage with a response target and a triage cadence; backlog/response reviewed against the table above.
• Support route staffed (re-report path exists in-app since P22; in-app help surface since P23-T02).
• Privacy operations reachable (export/erase runbook, 24-hour evidence expiry, 12-month audit purge).
• Stop/rollback criteria owned by the rehearsal (P23-T04) and the pilot plan — not by this document.

Costs from measured utilization only

Measured 2026-10-02 (local, warm cache): backend full unit suite passes with zero failures; -race PostGIS integration per package in seconds-to-tens-of-seconds; app unit suites in ~1–2 min; quick-verify 12–13 s; feedback hot paths ~0.5–0.7 µs/op (application layer). Pilot hosting, storage and staffing costs are unknown until the pilot plan attaches real numbers — no budget is invented here.