Production releaseThe command map is live for authenticated Advanced access. Detailed responses are owner-bound and marked private/no-store. The fixed 11-region aggregate remains available as the bounded public overview.

One Map, Two Evidence Levels

The public regional layer still reports thresholded activity bands at 11 fixed analytical anchors. It does not serialize exact aircraft counts, tactical identifiers, paths, or dynamic source coordinates. Advanced mode adds a separate command layer built from the detailed source observations already used elsewhere in Watchtower.

The new command view keeps both levels visible without presenting either as an order of battle. Operators can switch among five basemaps and 12 command controls while the map, entity locator, source status, and event rail remain on the same live canvas in embedded and full-screen layouts.

What the Command Layer Adds

  • Deduplicated air observations grouped by heuristic affiliation, including US, NATO, Russian, Chinese, and other classifications.
  • Naval observations with freshness state rather than silent reuse of an expired position.
  • Warnings, emergency squawks, transponder-loss indicators, loiter patterns, refuel hints, formation signals, thermal clusters, and public base-watch context.
  • In-memory movement trails retained for up to 45 minutes and never written into the browser's last-good response cache.
  • An entity locator, bounded event rail, accessible detail dialogs, responsive mobile flow, and same-canvas full-screen operation.
Classification boundaryAffiliation and role labels are source-derived or heuristic. Loiter, refuel, formation, and transponder-loss rows are analytical indicators, not mission confirmation. A thermal cluster is not confirmation of a strike.

Owner-Bound Delivery

The command client requests /agent/api/military-command with the current expected-owner binding. The router requires an authenticated Watchtower-scoped session with can_view_advanced, checks the owner before work begins, and revalidates authorization after the asynchronous source build before any payload is released.

Every success and denial response uses private, no-store, max-age=0, varies on the session cookie and expected owner, and strips shared-cache and cross-origin policy inherited from the public source route. Anonymous, missing-owner, wrong-owner, wrong-scope, and downgraded access all fail closed.

Lifecycle Controls

Detailed command state is intentionally temporary. Sign-out, account replacement, access loss, replay entry, page lifecycle changes, and authorization expiry abort active requests and purge payloads, coordinates, trails, selections, popups, warning baselines, and pulses. The client accepts only the newest authorized snapshot for the current owner.

  • Authorization must have been verified within two minutes.
  • Detailed snapshots expire after two hours and future-dated observations are rejected.
  • Warning pulses last 18 seconds, do not fire for the initial baseline, and remain static under reduced motion.
  • Stale warning rows remain explicitly labeled and are excluded from current warning metrics and pulses.
  • Null, blank, boolean, non-finite, array, and out-of-range coordinates do not become map geometry.

Verification

PASS31 focused frontend, private-router, payment, and Risk Overview contracts.
PASSDesktop, 390 px mobile, full-screen, same-canvas, five-basemap, and 12-control browser checks.
PASSRequest ordering, access-loss races, replay purge, authorization expiry, finite pulse, and reduced-motion checks.
PASSAnonymous, owner-only, missing-owner, wrong-owner, and valid-owner response policy checks.
PASSAtomic deployment, exact artifact identity, service invocation binding, public convergence, and retained rollback verification.

What This Release Does Not Claim

  • It does not provide exhaustive global military-force coverage.
  • It does not infer classified identity, intent, payload, target, or mission from public observations.
  • It does not treat source absence as evidence that military activity is absent.
  • It does not make detailed source observations confidential at the API level. The legacy /agent/api/military compatibility route remains public; owner gating defines the Advanced product and UI boundary.

The result is a denser operational workspace with stricter state handling, not a claim of perfect visibility. Source health, observation age, geometry provenance, and analytical limits remain part of the interface.

Related releasePublic Regional Military Map