Production updateA scoped map is deployed in the Conflict / Military tab. The release publishes only thresholded activity bands at fixed regional anchors. It does not deploy the broader ingestion, alerting, deduplication, or state-migration candidate described in the original preview.

What Is Live Now

The new /agent/api/military-map endpoint evaluates public ADS-B observations on the server, then discards tactical records before serialization. Every successful response contains exactly 11 fixed watch-region anchors and a 30-minute timestamp bucket.

  • Activity is disclosed only as suppressed, 5_9, 10_24, 25_49, or 50_plus.
  • Counts from zero through four serialize identically as suppressed.
  • Exact counts, identifiers, callsigns, registrations, headings, paths, samples, and dynamic observation coordinates are rejected by server and client validators.
  • Malformed or unavailable upstream data fails closed with a fixed unavailable response.
  • Equivalent query variants share one validated stable-cache entry, while force refresh remains owner/local only.
  • The same five basemaps are available in embedded and full-screen views, with a responsive mobile layout.

The production map contracts are military-map-aggregate-v1.0.0 and military-public-aggregate-v1.0.0. Those contracts apply only to this map endpoint and map UI.

This development preview describes candidate changes across the path from public feed ingestion to map output. The goal is not to make every observation look certain. It is to preserve what each source actually says, reject records that do not satisfy the public contract, and keep failed refreshes from damaging the last verified state.

Evidence boundaryAircraft, vessel, thermal, and news-derived records are indicators with different provenance and precision. They are not independent confirmation of intent, attribution, target, or strike outcome.

What the Candidate Changes

Freshness and completeness are enforced

ADS-B, IntelSky, and AIS inputs now pass explicit freshness and completeness checks before entering the public payload. A same-version cache entry is not accepted merely because its schema label matches. The durable cache must also satisfy the current public privacy and source-family requirements.

Public identifiers stay public-safe

Tactical identifiers are removed from public output. Emergency-warning-system records pass the same privacy validation rather than bypassing it as a special source. The map, aggregate counts, and exposed rows are generated from the same accepted record set so a private row cannot survive in one representation after being removed from another.

State mutation is transactional

Tracking history and cooldown memory are committed only after a candidate vessel or aircraft snapshot passes validation. A rejected refresh cannot partially advance state and then influence a later alert. Concurrent builds are coalesced and normalized cache keys prevent equivalent requests from producing parallel mutation paths.

Cross-feed identity is typed

Deduplication no longer treats an identifier string as globally unique across unrelated source families. Identity keys include the observation type and source root. The fusion layer uses independent sourceRoot values, reducing accidental corroboration when two rows are transformations of the same upstream observation.

Compressed responses are bounded

Gzip and related response bodies have an output ceiling during decompression. A small compressed response can no longer expand without limit inside the router. Oversized or malformed expansions fail closed while the last good public payload remains available.

Scoring and Activity

Activity and threshold-crossing metrics are now computed independently of polling frequency. Repeating the same refresh does not manufacture additional activity. Fusion remains a support model, not a calibrated probability, and every contributing family retains its own caveat.

Broader Candidate Verification Status

STAGEDCandidate contracts cover malformed emergency-warning and ADS-B snapshot rejection.
STAGEDCandidate freshness policy covers stale AIS and unsafe same-schema cache entries.
STAGEDCandidate ingestion bounds compressed expansion before JSON acceptance.
STAGEDCandidate state handling is designed to keep rejected vessel snapshots transactional.
PENDINGFinal-hash static, router, browser, startup, and owner-precondition results must be retained.
PENDINGProduction API/browser smoke testing, accepted hashes, and rollback rehearsal are not complete.

What This Does Not Do

  • It does not expose paid or restricted provider data without an approved contract, credential, schema, retention policy, and redistribution right.
  • It does not infer classified identity, mission, payload, or intent from a public track.
  • It does not turn thermal clusters or media reports into confirmed strike events.
  • It does not treat two transformations of one upstream source as independent corroboration.

The broader proposed contracts remain military-osint-v1.0.0 and military-public-policy-v1.0.0. They are not production contracts; only the narrower regional map contracts above are live.

Next releaseGlobal Geopolitical Risk, Without False Precision