Preview statusThis article describes staged work that is not currently deployed. A production-scoped rebase, final-hash regression run, production smoke test, and rollback evidence remain open.

This development preview describes candidate changes across the path from public feed ingestion to map output. The goal is not to make every observation look certain. It is to preserve what each source actually says, reject records that do not satisfy the public contract, and keep failed refreshes from damaging the last verified state.

Evidence boundaryAircraft, vessel, thermal, and news-derived records are indicators with different provenance and precision. They are not independent confirmation of intent, attribution, target, or strike outcome.

What the Candidate Changes

Freshness and completeness are enforced

ADS-B, IntelSky, and AIS inputs now pass explicit freshness and completeness checks before entering the public payload. A same-version cache entry is not accepted merely because its schema label matches. The durable cache must also satisfy the current public privacy and source-family requirements.

Public identifiers stay public-safe

Tactical identifiers are removed from public output. Emergency-warning-system records pass the same privacy validation rather than bypassing it as a special source. The map, aggregate counts, and exposed rows are generated from the same accepted record set so a private row cannot survive in one representation after being removed from another.

State mutation is transactional

Tracking history and cooldown memory are committed only after a candidate vessel or aircraft snapshot passes validation. A rejected refresh cannot partially advance state and then influence a later alert. Concurrent builds are coalesced and normalized cache keys prevent equivalent requests from producing parallel mutation paths.

Cross-feed identity is typed

Deduplication no longer treats an identifier string as globally unique across unrelated source families. Identity keys include the observation type and source root. The fusion layer uses independent sourceRoot values, reducing accidental corroboration when two rows are transformations of the same upstream observation.

Compressed responses are bounded

Gzip and related response bodies have an output ceiling during decompression. A small compressed response can no longer expand without limit inside the router. Oversized or malformed expansions fail closed while the last good public payload remains available.

Scoring and Activity

Activity and threshold-crossing metrics are now computed independently of polling frequency. Repeating the same refresh does not manufacture additional activity. Fusion remains a support model, not a calibrated probability, and every contributing family retains its own caveat.

Candidate Verification Status

STAGEDCandidate contracts cover malformed emergency-warning and ADS-B snapshot rejection.
STAGEDCandidate freshness policy covers stale AIS and unsafe same-schema cache entries.
STAGEDCandidate ingestion bounds compressed expansion before JSON acceptance.
STAGEDCandidate state handling is designed to keep rejected vessel snapshots transactional.
PENDINGFinal-hash static, router, browser, startup, and owner-precondition results must be retained.
PENDINGProduction API/browser smoke testing, accepted hashes, and rollback rehearsal are not complete.

What This Does Not Do

  • It does not expose paid or restricted provider data without an approved contract, credential, schema, retention policy, and redistribution right.
  • It does not infer classified identity, mission, payload, or intent from a public track.
  • It does not turn thermal clusters or media reports into confirmed strike events.
  • It does not treat two transformations of one upstream source as independent corroboration.

The proposed public contracts are military-osint-v1.0.0 and military-public-policy-v1.0.0. They are not production contracts until the scoped release passes its deployment gate.

Next releaseGlobal Geopolitical Risk, Without False Precision