All notable changes to Phantom Tide are recorded here.
Dates are UTC. Versions follow semantic versioning.
Sign-up now runs a multi-layer check before an account is created, following a small number of sign-ups from disposable and invalid accounts. Real addresses are not affected. If a sign-up is refused in error, open a registration issue.
Some aircraft category labels were displaying as single characters (A, G, R, S) instead of the full category name. This was a data issue; it has been corrected. Labels now show the right category: Cargo, Military, Tactical Transport, Government, and others.
The dataset was also audited for informal tag entries that had built up over time. Labels now reflect operational category rather than editorial shorthand.
Aircraft label chips have lighter borders and lower contrast so they sit behind the callsign and identity fields rather than competing with them.
A correctness pass across the backend resolved a number of edge-case bugs in the intelligence and data processing layers. Behaviour on normal inputs is unchanged.
- A new header search field lets analysts pull historical tracks for an entire airline or operator fleet by ICAO callsign prefix (for example, all United Airlines or Ryanair aircraft active in the archive window).
- Each matching aircraft is rendered as a coloured polyline on a dedicated fleet-track layer. Track points carry per-segment timestamps and speed.
- Available at premium tier. Starter sessions receive a gated empty state with a clear tier indicator rather than an error.
- The DSC distress banner now updates every 90 seconds regardless of whether the Intel workspace is open. Previously the alert only fired when the Intel panel was in view, so analysts working map-only could miss an active distress event.
- Active distress positions now render with a pulsing visual ring so they are immediately distinguishable from static event markers at all zoom levels.
- Vessel names in the distress banner are resolved correctly when the summary payload is absent, closing a path where the banner showed "Unknown vessel" instead of the actual callsign or name.
- The stale-workspace banner no longer fires in manual refresh mode.
- The thermal-AIS coincidence gap analysis, which identifies maritime areas where VIIRS thermal activity is present but vessel identity is absent or very sparse, is now visible as a map layer.
- Cells are colour-coded by anomaly severity (critical, high, moderate, low). Each cell popup shows gap type, fire radiative power, detection count, and AIS vessel count inside the scan radius.
- The layer refreshes every six hours via background scheduling and is available
at premium tier from the Layers panel as
Thermal-AIS Gap Zones.
- The Vessel Formations indicator in the layer rail was appearing underneath the aircraft positions entry. It is now correctly placed beneath the global vessel snapshot feed that it derives from.
- Enabling
Maritime thermals onlywhile the thermal fire sub-toggle was off silently produced an empty map because the filter had nothing to act on. The toggle now implicitly re-enables thermal fires when maritime focus is switched on, so the filter always has data to filter.
- Maritime region and EEZ layer requests that cover the full world extent are now short-circuited before any per-feature work, reducing response time from several seconds to under 50 ms on the world-scale load.
- The thermal-AIS batch job now uses a tighter AIS query window that fits within the per-query memory budget, eliminating intermittent out-of-memory failures on busy archive days.
- Archive database upgraded to the latest stable release. Two new query indexes reduce scan cost for per-source queries and entity-correlated lookups. A memory-spill setting for large join operations is now active so those queries degrade gracefully under pressure rather than failing.
- Python runtime dependencies refreshed: starlette 1.1.0 ---> 1.2.1, clickhouse-connect 1.1.0 ---> 1.1.1, h3 4.4.2 ---> 4.5.0. An unmaintained alpha proxy-discovery package removed; proxy discovery continues to work via the direct proxy pool and built-in discovery path.
- GDACS volcano and wildfire hazard types removed. Both endpoints have been returning 404 for an extended period; removing them eliminates recurring collector error noise and speeds up the hazard collection cycle.
- Collector credential loading now consistently prefers environment variable overrides over stored secrets-file values, removing a configuration drift that could silently keep a stale credential active after a rebuild.
- A new layer covers strategic ports and maritime chokepoints with near-real-time water level observations from NOAA CO-OPS tide stations. Each station shows the latest measured water level, the nearest 6-minute tidal prediction, deviation from predicted, tidal datum, and station context.
- Useful for understanding port-side access conditions and tidal anomalies without
needing a full global sea-level archive. The layer is operator-discoverable and
toggleable from the Layers panel as
Strategic Tide Stations.
- Low-elevation coastal zone data from the NASA SEDAC LECZ v3 dataset now appears as a static layer covering the same strategic port set as the tide stations. Each point identifies whether a port or chokepoint sits within a documented low-elevation coastal zone and records the dominant LECZ class and sampled share of cells within 10m elevation.
- Surfaces in the Area Intelligence Report so area queries can explain which strategic ports carry physical coastal exposure risk alongside live maritime feeds.
- Status chips in the Intel workspace now act as retry controls for their own briefing lane. Clicking a delayed, stale, or failed chip reloads that specific briefing without requiring a full workspace refresh or hunting for the global reload control.
- Delayed-state empty panels now include an explicit
Reload briefingaction. The queued-briefing toolbar copy clarifies that promoting a queued briefing also reloads it.
- Decision telemetry is now scoped to the contributing analyst rather than pooled across all users. The scorecard states exactly what the analyst is seeing: "this browser session only," "current analyst session," or "global analyst scope." Cross-analyst reads require premium access.
- Scorecard aggregates now track
accept,reject, and non-final outcomes separately. Zero-valued outcomes are preserved rather than collapsed to null, so all-reject sessions show correct zero acceptance rather than appearing empty. - Invalid decision payloads are rejected at the API boundary with HTTP 422. Internal write failures return opaque 500 errors rather than leaking backend detail. Detail-panel decision posts now route through the shared trusted API wrapper so onboarding and auth retry behavior is preserved.
- The
Last recordedfreshness label in the scorecard updates in-session immediately after a successful decision, without waiting for the next deferred refresh cycle.
- The EMODnet WMS proxy now enforces limits on tile dimensions, pixel count, image format, CRS, and bounding box shape. The proxy remains a tile relay for the existing UI rather than an open-ended render or export surface.
- The scheduler now consistently prefers non-empty environment overrides over values stored in the secrets file when building collectors that accept both. This removes a hidden configuration drift that could cause a stale token in the secrets file to override a newer environment token and silently break dependent collectors after a rebuild.
- Whole-stack dependency refresh: FastAPI, Uvicorn, Pydantic, SQLAlchemy, Psycopg, NumPy, Pandas, Playwright, and other runtime packages updated to current upstream versions. Infrastructure images (Redis, ClickHouse, Caddy, PostgreSQL) updated.
- Entity-feed hot-path caching: watchlist-hit and ranked-intelligence snapshots are now keyed on the current refresh revision, reducing per-request rescans of the full entity cache under repeated reads.
- GPSwise startup cache preload restored: spoofing and jamming snapshots warm correctly on API and worker boot instead of logging non-fatal preload failures.
- FAA restricted-airspace fast path: requests that already span the full world extent are short-circuited at the API layer, removing the per-feature slicing cost from initial map bootstrap.
- Maritime-context startup warning now emits once per cold boot instead of once per request, removing routine log spam while preserving the signal when relevant.
- Frontend tooling: Biome upgraded from 1.9.4 to 2.4.15 with config migrated to the current schema.
- The area intelligence report, traffic query, and reference context endpoint now respond in under a millisecond for warm queries, down from up to 39 seconds in the previous release. The improvement comes from a spatial index that pre-filters geographic candidates before distance computation and from fixing a cache bypass that was re-reading the same large reference files from disk on every call.
- Cold start on first access builds the spatial index once. All subsequent calls use the cached index. An index built for one query is shared across all concurrent requests for the same reference dataset.
- The traffic query and reference context query now share the same area reference cache when called for the same coordinates. The right-click area workflow no longer recomputes reference context twice for the same point.
- The first-visit identifier field now accepts only a valid email address. Free-text names and placeholder entries are rejected at entry. The field is still optional; skipping it bypasses the requirement entirely.
- Test suite: all 1225 automated tests pass. Three classes of cross-test interference were identified and fixed: archive drop-count contamination, storage health state surviving test file boundaries, and a spatial index cache that returned stale data when test fixtures redirected the reference data path. The fixes address real isolation contracts in the production code, not only test scaffolding.
- Live AIS positions are now clustered into vessel formations and rendered on the map as hull polygons. Each formation is classified as grid, linear, or organic. Grid formations include an AIS spoofing advisory because tight uniform spacing is a known indicator of synthesised position data.
- Formation detail shows centroid, mean vessel spacing, and the list of contributing vessels. Formations refresh every five minutes alongside the live position feeds.
- A new lane in the Intel workspace surfaces primary analyst decision-quality metrics: hypothesis acceptance rate, median review latency, and high-tier false-positive rate. The scorecard is always visible at the top of the lane so quality state is readable without opening any detail.
- Full breakdowns by threat class, source family, and confidence tier are available under progressive disclosure. Accept, reject, and defer decisions on active hypotheses are now recorded and contribute to the longitudinal quality record.
- Every standard event-source layer now shows a live freshness chip in the layer rail indicating how old the displayed data is. Briefing headers and the queued-briefing tray show matching inline freshness context.
- Healthy layers now carry trust context without inflating the issue-count badge, so the issue summary reflects real problems rather than routine loaded state.
- Vessel map popups now display the IMO number alongside MMSI when the identity can be resolved from the analyst's loaded context. IMO is omitted when no seven-digit identifier is available. This closes a common cross-reference gap where analysts needed to open the full detail panel to obtain a vessel's IMO.
- DART ocean buoy stations are now always plotted on the map, not only during anomaly events. Normal readings and anomaly readings both produce visible positions; anomaly detections continue to receive higher source confidence weighting in the evidence engine.
- The three separate GPS interference source toggles (daily grid, jamming reports, spoofing reports) are now consolidated into a single GPS Interference layer. H3 hex cells render with the correct geographic footprint; spoofing markers render separately within the same layer. The consolidated layer uses partial-success loading, so a degraded upstream source does not hide the remaining data.
- Clicking a VIIRS thermal anomaly circle or a geometry anomaly track marker on the map now opens the detail side panel immediately. Previously these markers did not participate in the click-to-detail workflow.
- Backend health messages are translated to plain English throughout the dashboard. Archive backlog reasons are grouped into a single consolidated summary line rather than one raw string per affected source. The ClickHouse status label is now "Archive write" to make its role clearer to analysts who are not familiar with internal infrastructure names.
- Collector-backed chokepoint points now render to the map as soon as their artifact resolves rather than waiting behind slower unrelated collector overlays. The default collector subfilter prioritises chokepoints while leaving heavier NATS and infrastructure sidecars opt-in.
- Three visual weight tiers are now applied consistently across the whole dashboard. The map stage, active incident alerts, and time-window controls are visually dominant. The layer rail, header metadata, and legend are quieter. Analysts scanning the dashboard for the first time should reach the map and the active alert strip before the layer controls.
- Time-window buttons and history-mode controls now carry a two-pixel underline emphasis on the active state in addition to color changes. The underline is color-independent so the active control is always distinguishable without relying on hue alone.
UX: Layer count detail hidden until needed
- Secondary count metadata (loaded count versus rendered count breakdowns) is now hidden by default and appears on hover or row expansion. A pulsing indicator replaces the zero-count badge during initial load, removing false-empty states during the first refresh cycle.
- Each row in the Maritime Threat panel now carries a color-coded left border reflecting the threat type: red for piracy and armed robbery; amber for GPS disruption; purple for dark-fleet and seized-fleet activity; blue for other advisories. Zero-count or unavailable categories render with a muted neutral border so they do not compete with active threats visually.
- When the watchlist panel contains no visible entities, it now shows guidance and an "Enable Live Watchlist" button that directly enables the relevant tracking layers. The previous behavior was a static empty message with no action path.
- Keyboard focus rings now come from a single CSS source, removing inconsistency between surfaces. Mobile header context chips display the current time window and replay status and update dynamically on state change. Display state throughout the dashboard is now fully CSS-driven rather than mixed with JavaScript inline-style manipulation.
- Historical batch scanning for thermal anomalies in maritime areas with absent or sparse vessel identity is now available through the intelligence endpoint. The scan runs on a configurable historical window and returns the highest-scoring cells ranked by anomaly strength, separated into zero-AIS gaps and sparse-AIS gaps. Results are refreshed on a scheduled cadence and served from cache so the endpoint stays fast under load.
- This is the historical precision path for a detection capability that is already running in the live evidence engine. Promotion to live alerting follows only after historical precision is confirmed against the returned cell list.
- Multi-source convergence weighting now resolves at strait scale rather than basin scale at five named maritime chokepoints. Events that fall inside a registered chokepoint boundary snap to a finer grid cell so a single strait carries its own convergence score rather than sharing weighting with the surrounding basin.
- Chokepoint identity is now visible in the convergence response so analysts and downstream consumers can distinguish a strait-scale score from an open-ocean basin score.
- A new precursor detector fires when a vessel loiters at low speed close to a submarine cable across multiple observations, with an escalation path when a thermal anomaly appears near the same cable corridor within a short follow window. Both tiers retain explicit negative evidence covering benign alternatives such as fishing, anchoring at refuge, and station-keeping.
- Three external feed candidates completed triage: a maritime security alert feed was closed as contract-restricted; a broad multi-jurisdiction warning aggregation feed was declined as too noisy for bounded analyst use; a historical maritime incident archive was classified as historical reference only with a bounded area-report path.
- Military installation and internet infrastructure reference datasets expanded with vetted new rows and provenance backfill on all legacy entries. A national meteorological authority warning polygon sidecar was added as bounded area-report context.
- The threat intelligence panel now surfaces the ranked drivers behind the current risk level and provides bounded focus actions so an analyst can jump directly from a threat driver to the relevant layer and map region.
Carried forward to v1.79.0:
- Trusted coast-station and rescue-endpoint geometry registry to draw more DSC counterpart links directly on the map.
- Analyst filters for DSC class, counterpart type, and unresolved geometry.
- Continued reduction of false-absence and mixed-workspace ambiguity under degraded backend pressure.
- Maritime hazard, NAVAREA, and SMAPS warnings now flow through a stricter coordinate-binding and geometry-validation pipeline. The parser refuses to combine a latitude on one line with a longitude several lines later when there is no syntactic binding between them, so warnings whose narrative text mentions stray coordinate-like numbers no longer produce false polygons.
- Polygons that would span ocean-scale distances (thousands of kilometres of diameter or edge length) are automatically downgraded to a marker-only cluster instead of being filled on the map. The downgrade reason (implausible diameter, implausible edge, weak coordinate binding, antimeridian artefact, or low-confidence cluster) is shown in the right- panel detail so the analyst can see why a particular warning is rendered as markers rather than a hazard area.
- Real local hazard boxes (such as a 15' x 15' exclusion area) continue to render as filled polygons with their geodesic area surfaced. Long missile shots, firing corridors, and trajectories continue to render as lines even when they cross the antimeridian, because line plausibility is now separated from polygon plausibility.
- Antimeridian crossings (lines and bounded areas near +/- 180 degrees) now produce continuous geometry and a tight bounding box rather than a globe-spanning artefact.
- Two of the heaviest static reference layers now support bounded delivery
instead of always forcing whole-world geometry through the browser.
maritime-regionsand FAA restricted-airspace can now return viewport-bounded slices, so the map no longer has to download and parse the full global EEZ or FAA polygon set just to render the visible area. - Bulk layer-enable behavior is less self-destructive. The browser now batches layer-enable work instead of fanning out repeated refresh and render passes while the workspace is still settling.
- Zoom-gated reference layers no longer fetch below the zoom level where they can actually render usefully. This reduces wasted transfer and parse work on first load and on broad-area map views.
- The browser is less trigger-happy about declaring a live refresh delay. A single missed browser deadline no longer immediately reads as a visible incident if the dashboard still has recent confirmed-good state.
- When repeated deadline misses do happen, the degraded-state banner now names the route that timed out. This turns a vague "browser deadline exceeded" warning into something the operator can actually triage.
- The shell still keeps the last confirmed-good state visible during retry, but it is more explicit about when the problem is a repeated route-level delay rather than a one-off slow fetch.
- DSC communications now expose busiest counterpart relationships in the intelligence workflow, including top directed contact pairs in the live graph.
- Selected vessels can surface "who this ship calls most" style context from the same DSC evidence base, making it easier to move from a single DSC row to an emerging communications pattern.
- Counterpart-link drawing remains conditional on usable geometry, but the surrounding table and detail workflow now preserves more of the unresolved comms graph instead of flattening it away.
- The dashboard no longer depends on
flagcdn.comfor vessel or watchlist flag badges. Flag images are now bundled locally so popups and tables keep working when the external CDN is blocked or unavailable. - Local and remote rebuild paths are now more explicit:
- local
clean-rebuildkeeps runtime volumes while forcing fresh images and containers - local
nukestays destructive and explicit - remote deploy now has a matching
--freshpath plus a guarded Phantom Tide-only--nukepath for full runtime reset and staged recovery
- local
- Release/performance capture now stamps the running app version and local git state so stale rebuilds are easier to catch during validation.
- DSC communications are now surfaced as a first-class analyst lane instead of a feed-branded sidecar. The intel workspace keeps mapped and unmapped communications visible together so the operator can inspect the comms graph, not just the subset with immediate map geometry.
- Selected vessels can now load linked DSC communications directly into the same right-side detail panel used for the rest of Phantom Tide. When the counterpart ship or coast station has resolvable geometry, the map draws a communication link so the operator can see who is talking to whom without leaving the main workflow.
- DSC rows are now classified into analyst-facing semantics such as
Test call,Safety voice handoff,Routine call,Distress relay, and SAR-linked urgency or coordination. This keeps routine radio checks from dominating the table while preserving them as evidence. - SAR-linked classification is now inferred from rescue-coordination endpoint identity in addition to distress/urgency protocol fields, so non-distress rescue coordination traffic can still be surfaced as operationally relevant context.
- The public README now matches the current portal surface and release line instead of the older v1.72.x product brief.
- Public screenshots were regenerated from the rebuilt local stack, including new DSC communications, DSC detail, and vessel-led DSC workflow views.
- A new inference rule fires when a VIIRS thermal event falls inside the projected motion corridor of a vessel that has gone AIS-silent.
- The corridor extends forward from the vessel's last known position along its last reported course and speed. Lateral uncertainty starts at 10 km and grows with elapsed silence (2.5 km/h, capped at 50 km) to reflect accumulating positional ambiguity.
- Watchlist tier: any corridor VIIRS hit — plausible co-location requiring corroboration.
- Alert tier: corridor hit with high fire radiative power (>= 30 MW) from a maritime-class detection — strong coincidence of two independent anomaly signals with tight spatial constraint.
- Vessels without a last-known course are excluded; silence alone is flagged in retained negative evidence together with the corridor width and elapsed silence duration.
- A new inference rule fires when a VIIRS thermal anomaly cell has absent or sparse AIS traffic in its vicinity, signaling possible dark ship-to-ship transfer, unreported offshore activity, or transponder-off operation.
- Zero-AIS tier (Watchlist): anomaly score >= 6.0 with no vessel identity within 30 nm. Maritime detection types (offshore, thermal_anomaly) are annotated in the hypothesis statement.
- Sparse-AIS tier (Exploratory): EXTREME anomaly score (>= 12.0) with at most one AIS vessel within 30 nm.
- Both tiers retain full negative evidence: AIS count, search radius, cell score and severity, and an explicit caveat that remote or low-traffic areas may have structurally low AIS coverage independently of any suppression.
- The GPSJam daily H3 interference grid is now fully visible on the map and included in proximity queries. A rendering bug prevented the layer from appearing: the source was not registered in the layer name index, so all markers were silently discarded before display.
- The observation timestamp is now anchored to noon UTC of the published observation date rather than the ingestion wall-clock, so GPSJam events age correctly against stale-threshold display logic.
- The right-click proximity panel now shows all sources inside the radius circle, not only the first matching category.
- A copy button exports a padded plain-text snapshot covering event rows (all sources), datacenter infrastructure hits, and entity intelligence hits.
- The navy vessel overlay now sources last-known positions from entity feed intelligence rows when a direct AIS fix or watchlist-alert position is unavailable. Popups distinguish last-known positions from current fixes.
- The map left-rail now shows a distinct zoom-action strip for each source that is hidden because the current zoom level is below the operator's disclosure threshold. The strip displays the withheld count and a "zoom to N+" button so the analyst can act without guessing why markers are absent. AIS, OpenSky, VIIRS, SMAPS, DailyMem, NGA MIS, NDBC, and NDBC SAR2 all gain this treatment. The indigo count badge distinguishes zoom-suppressed state from the amber tier-cap state.
- The Postgres schema now includes dormant auth tables (
pt_users,pt_sessions,pt_entitlements,pt_auth_audit) that establish the migration boundary for v2.0 per-user analyst workspaces. No application routes read or write these tables in v1.73.0. /api/healthnow includes anauthblock reporting whether the Postgres auth backend is reachable and whether the session and entitlement tables are present.
- Aircraft entering the tracked airspace window already inside a restricted
zone now correctly emit an
inside_window_startcrossing event. Shapely 2.x changed the semantics ofSTRtree.query(point, predicate="covers")— it now testspoint.covers(polygon)rather thanpolygon.covers(point). Changed topredicate="covered_by"to restore correct containment lookup.
- Polylines crossing the 180° dateline are now split at the antimeridian and rendered as two arcs rather than a single line that spans the globe backwards. Affected layers: maritime EEZ boundaries, submarine cables, vessel routing paths, AIS spoof track overlays, and event geometry.
- The public restricted-airspace crossing feed now includes a compact
qualityblock by default, so downstream polling clients can distinguish confirmed empty windows from partial archive or reference-data degradation without requesting the full metadata payload. - The collector-backed shell is more honest under partial or mixed state. Loaded map-layer context now discloses stale, reused, mixed-run, and scan-bounded artifact state more explicitly instead of letting coherent- looking context read as a single fresh snapshot.
- The browser now surfaces partial workspace hydration as a first-class warning. If collector artifacts or saved layer restores are still loading or failed in the latest pass, the shell now says so directly instead of showing a quietly incomplete workspace.
- Large optional GeoJSON and bootstrap layer restores now run through bounded browser queues so high-value context recovers first and “enable all layers” is less likely to collapse into random absence.
- Phantom Tide now ships one bounded public API endpoint:
/api/public/aircraft/restricted-airspace-crossings. - The feed is designed for external polling and dataset building from replay-derived restricted-airspace crossing candidates, with polling watermarks, freshness truth, and replay-first cautioning.
- Data Collector Service artifacts now appear as product-facing intelligence context instead of remaining only in integration notes.
- Optional map layers now cover collector-backed chokepoints, NATS UAS restrictions, NATS visual reference points, NATS sectors, ports, pipelines, refineries, desalination sites, and seaport/terminal infrastructure.
- Selected vessel and aircraft detail can now explain nearest chokepoint, infrastructure, and airspace context from the loaded map-layer cache.
- Vessel and aircraft intelligence rows now use high-level attribution for dark-vessel, U.S. Navy, sanctioned, military, and emergency context.
- The release also tightens Firefox console noise and dead-code audit hygiene around framework-wired routes.
- The browser now defaults to a stable workspace instead of silently
reapplying every visible change on a fixed timer. Phantom Tide checks a
lightweight visible-lane manifest, surfaces
New datawhen the current workspace changed, and lets the analyst choose when to apply that state. - Live mode remains available for passive browsing, but it now pauses while you are inspecting detail, typing, moving the map, or scrubbing history so the workspace does not move underneath an active investigation.
- The header sync action is now rate-limited. Manual workspace sync can only be forced once every three minutes, with a visible cooldown instead of repeated redraw churn.
- Aircraft quick jump is now a real free-text search surface. The modal opened
with
/searches across loaded live tracks, alerts, and tracked/watchlist aircraft with bounded fuzzy matching on callsign, registration, ICAO24, owner/operator, model, and watchlist context. - Maritime reference context is wider and more useful. The product now ships additional bounded explainer layers for nearby ports, chokepoints, disruptions, response capability, refuge areas, passage baselines, spills, and shipping-accident context without turning them into heavy default-render overlays.
- Analyst payloads now use generic
reference_*maritime context keys instead of leaking internal source branding directly through the UI contract. - Map and intel routes now expose stronger
partial,empty_reason, and freshness truth so a clean-looking empty result is less likely to hide a degraded or unavailable dependency. - The release also tightens exact-match maritime identity maintenance with a stronger support-vessel identity dataset and a documented static vessel triage workflow for future updates.
- Plus many more bug fixes and improvements etc and some UI changes.
- Aircraft airspace-crossing analysis is now replay-first and path-based, rather than reading sampled points as a stronger alert than the evidence supports.
- Archive-backed scored and confidence-bearing surfaces now fail closed during degraded archive durability instead of quietly continuing through backlog or loss states.
- Replay identity and provenance are stronger: archive rows now carry typed identity and fetch/archive fields directly instead of depending on mixed-ID fallbacks and opaque blobs.
- Reference-context geography is less misleading. The platform now distinguishes unknown coverage from known absence and uses a bounded PostGIS-backed context path with explicit fallback semantics.
- Convergence, thermal, and VIIRS significance surfaces now state their heuristic method and bounds explicitly instead of implying calibrated confidence where none exists.
- Aircraft explainers now carry bounded UK airspace context. Selected aircraft detail and the Area Intelligence Report now reuse the same query-backed UK airspace explainer lane, with explicit explanatory-only wording instead of widening default map rendering.
- Vessel identity joins now behave like advisory context, not a second truth surface. Identity joins now surface match basis, confidence, alias variation, and contradiction-aware cautioning across watchlist, spoofing, and selected-vessel detail without reading like entity confirmation.
- Identity workflow language is less likely to overclaim. Vessel detail panels now frame identity joins as context and caution signals, not system verdicts.
- Starter mode now boots lighter. Default Starter load is reduced to a smaller baseline so the shell spends less refresh budget before the analyst has chosen heavier overlays.
- Degraded backend state no longer blocks the whole shell by default. Source-age, truncation, and scheduler-owner degradation now stay as warning surfaces unless the API is actually unreachable.
- China teapot refineries are more visible as a static context layer. The exact-only refinery layer now renders with a stronger map treatment so it reads as intentional context instead of disappearing into country-scale map clutter.
- Map jumps are less brittle on event detail. Event-detail focus now preserves property-backed coordinates and normalizes wrapped longitudes, closing a class of wrong-world jumps on point detail reopen.
- The map is less likely to fight the analyst. Deferred map focus, static detail clicks, alert handoff, and refresh-time detail updates now share one guarded interaction contract, so background refresh is much less likely to snap the viewport after you have started dragging or zooming.
- Incident banners are a real action surface now. Selectable alert banners gained an explicit primary action and keyboard-safe inspector handoff instead of depending on a clickable live-region container.
- Hidden workflows spend less refresh budget. Convergence history stays cold until the risk-zone workflow is actually enabled, hidden satellite layers no longer consume a deferred refresh slot, and the replay-first airspace-crossing feed is shared across banner and intel consumers instead of being fetched twice per cycle.
- China teapot refineries now participate in the live product. The exact- only refinery dataset now powers a premium lazy map layer, area-report context, vessel-detail maritime context, and live sanctioned/seized vessel map detail without letting centroid-grade fallback points masquerade as map truth.
- The refinery layer now tells the truth when nothing is in view. If the exact-only refinery points are loaded but off-screen, the layer note says so explicitly instead of looking dead from the default world view.
- Restore-time health truth is stronger. Runtime artifact freshness and missing-artifact degradation are now exposed directly in health for shared runtime state, local event snapshots, and scheduler heartbeat files.
- Alert behavior is now governed by one queue contract. Invalid alerts no longer mount, dismissed alerts unmount cleanly, only one alert expands at a time, and selected alerts now hand detail ownership to the inspector instead of fighting the map.
- The operator shell is more stable under degraded backend state. Startup transport failures, onboarding loops, and local auth-off paths no longer trap the dashboard behind blocking overlays when the correct behavior is to degrade in place.
- The desktop workspace was tightened without changing the product model. Header groups, layer rail density, alert stack placement, and inspector ownership were cleaned up so the map remains dominant and the screen reads more like an operational console than a patched demo.
- Release metadata is back under one source of truth. Runtime version, cache-buster markers, package metadata, launcher banner, and both repos' README/CHANGELOG surfaces are now syncable from one release command instead of being updated manually in several places.
- Layer event counts now match what you see on the map. Count badges previously included events with null or zero coordinates that never produce markers. Badges now reflect the rendered count only.
- NWS Marine alerts are back. A 2025 NWS API change made the batch zone-geometry endpoint return null geometry for all features, causing the collector to produce 0 usable events. Zone boundaries are now fetched individually, cached locally for 6 hours, and resolved in parallel so subsequent runs cost almost nothing.
- VIIRS layer no longer reuses incomplete downloads. Partial HDF5 files and HTML error pages saved to disk during upstream outages are now detected and re-downloaded automatically.
- Layer data no longer goes stale silently after a backend sync. A bug in the GeoJSON cache meant that store updates made during runtime sync were never surfaced to clients until a restart. This is fixed.
- Events are no longer dropped during a ClickHouse outage. Events that cannot reach ClickHouse are spilled to a local file and replayed automatically once the connection recovers.
- Persistently-down non-critical sources now appear in health. Collectors that have been failing continuously for more than 3 hours are now visible as advisories in the health payload instead of silently failing in the background.
- Layers panel heading layout fixed. The tier label and enable-layers button no longer stack vertically.
- Archive replay rows now carry explicit source semantics — live movement, stable snapshots, reference snapshots, target-state checks, and derived analytical events — so downstream consumers can distinguish feed types.
- Runtime truth is stricter: stale local snapshots and mismatched live/snapshot generations are now rejected rather than silently mixed.
- Health now exposes route latency percentiles (p50, p95, p99), generation mismatch counters, and ClickHouse archive queue depth.
- A first backend slice of vessel-target history by IMO is available for sanctioned and seized vessel replay context over the evidence archive.
- Browser nearby traffic actions open the detail panel immediately with a loading state rather than blocking on the API response.
- Split-runtime health now exposes when the service is using a coherent live generation versus a fallback snapshot, instead of flattening those states into one generic degraded banner.
- Historical drift in snapshot-style feeds is now easier to detect because the system tracks whether rows were new, changed, removed, and archived during each refresh cycle.
- The browser refresh path now blocks only on the primary map feeds; secondary layers and secondary intel work moved out of the critical path, so live refreshes are less likely to bunch into one burst.
- Background intel fetch failures no longer shout the same full-backend outage message as a critical map/API failure.
- Release metadata and browser asset markers were resynced for
v1.54.2, so the shipped line is easier to verify and easier to roll back to.
- Right-click map workflow now includes a direct nearby aircraft-and-ships query with explicit radius selection, current source freshness context, and click-through drill-in to the nearest plotted live track.
- The same nearby-traffic query now has proper validator support and powers the area-report traffic slice, reducing drift between the fast query surface and the plain-text sitrep workflow.
- Frontend startup and protected reads are more reliable on locked deployments, and the browser no longer amplifies runtime-sync-only backend states into a louder analyst-facing alarm.
- The live events timeline now states what it really is: a pollable live-receipt rail, not a disguised historical archive feed.
- API responses now include a machine-readable backend-trust header so ingest clients can tell when the service is serving normal shared state versus snapshot-backed or otherwise degraded runtime state.
- Phantom Tide now exposes a replay-oriented aircraft-airspace crossing ledger for FAA restricted-airspace context, with watermark polling for backend consumers. This is groundwork for later alerting, not a premature loud alarm surface.
- Several viewport-capped reference layers now update in place during map pan/zoom instead of clearing and rebuilding every visible object, reducing unnecessary redraw churn on desktop analyst sessions.
- The browser refresh path now seeds frontend trust before its first protected data refresh on nonce-enforced deployments, which prevents startup refresh loops from hard-failing on protected reads.
- GeoJSON cache eviction no longer crashes on vessel-enriched map payloads when cache revisions include multiple upstream dependencies.
- Aircraft popup panels now colour-code by FAA registrant type so analysts can immediately distinguish corporate, LLC, government, and individual ownership without reading fine text.
- EMODnet subsea cable, pipeline, and wind-farm layers restored after upstream renamed their GeoServer namespaces.
- Newly-appeared aircraft now receive a bounded visual emphasis on arrival, consistent with how fire detections, seized vessels, and DART buoy anomalies have been signalled since v1.51.x.
- Internal spoofing triage clustering rewritten from O(n²) single-linkage to O(n) H3 hex binning, significantly reducing worst-case processing time on dense unknown-MMSI buckets.
- Dark-fleet proximity scan rebuilt with a spatial grid index reducing the per-detection AIS search from linear to near-constant time.
- ClickHouse batch writes now run in an isolated thread with a 45-second timeout so a slow or unresponsive ClickHouse cannot stall data collection pipelines.
- A per-source circuit breaker now prevents dead upstream sources from being polled continuously after repeated failures; the circuit reopens automatically with exponential back-off.
- Analysts can now pin the map to recent archived windows with explicit temporal controls, and live polling pauses while archived state is active so the interface does not mix present and historical views.
- Dense layers now build a bounded in-viewport marker budget instead of instantiating off-screen state first, which reduces redraw pressure on heavy views.
- Shutdown behavior is now ordered and drain-aware: background work stops in sequence, buffered evidence writes are flushed, and cache connections close cleanly during split-role restart paths.
- Browser trust and session token handling were hardened, and the onboarding path now preserves its expected success contract.
- The workspace chrome is more compact. Access, session, and system state now collapse into summary sections so the live map and layer controls reclaim the first screenful on desktop.
- Expensive derived clustering work is no longer pulled through the ordinary idle refresh path unless the relevant context is visible, which reduces unnecessary request-path pressure.
- Runtime truth is more explicit: the health surface now reports deployment role, scheduler ownership, trust mode, and related runtime invariants, making split-role drift easier to spot.
- Public acknowledgements were cleaned up so the UI points to public docs rather than carrying extra attribution clutter in the product chrome.
- Phantom Tide now ships with a dedicated background worker for scheduler and collector work, reducing pressure on the public API process.
- The browser refresh path is staged more deliberately, so core source/map updates land before secondary intel refreshes pile on.
- A real public operator guide now documents the map-first workflow, state-semantics model, adaptive-mode limits, and the keyboard fast lane.
- Browser trust handling is now explicit and safer to operate, and several map refresh guards were added so bad coordinates do not cascade into redraw crashes.
This release improves the real browser hot path and makes several analyst-facing surfaces more explicit and easier to trust.
- High-frequency map and intel routes now support real browser revalidation
with
ETag/304 Not Modifiedon unchanged data. This reduces repeated full-body downloads and reparsing on steady-state refresh. - Dense GeoJSON payloads were trimmed on the hot path so unchanged or low-value fields do not ride every refresh by default.
- The frontend refresh loop now uses bounded jitter and backoff under pressure instead of hammering the API in synchronized 30-second bursts.
- Convergence zones now expose a 72-hour change view. Cells can show prior score, score delta, and whether a hotspot is newly emerged versus 3 days ago.
- The geometry-anomalies analyst overlay is more usable: severity, raised geometry-test labels, and observed-window context are shown directly.
- The Area Intelligence Report now visibly anchors the queried radius on the map before building its plain-text SITREP, making the workflow easier to read.
- Tracked aircraft workflow and convergence scoring are now foregrounded more clearly in the product docs and About page so the platform's distinctive capabilities are easier to understand.
- API-key upgrade flow now distinguishes expired or disabled keys from generic invalid tokens.
- The starter onboarding
Skippath now works correctly. Skipping no longer traps the browser in a gate-reopen loop on the next protected API request.
This release addresses silent failure modes, data loss vectors, and performance bottlenecks identified during a comprehensive architecture audit.
- Health endpoint overhaul: The
/api/healthendpoint now reports semantic system status (ok/degraded/unhealthy) based on data freshness of critical signal families. Previously, "ok" only meant the process was alive. A newdegraded_reasonsfield provides machine-readable diagnostics. - ClickHouse archival data loss detection: The in-memory buffer that feeds ClickHouse writes now tracks overflow. When buffer capacity is reached, the health endpoint reports the count of dropped events so operators can tune flush intervals or increase capacity.
- Scheduler job resilience: All scheduled background jobs now tolerate up to 2 minutes of scheduler backpressure before being classified as misfires. Previously, a delay of more than 1 second caused silent job skips.
- Reference data protection: Collection paths that return empty results due to upstream failures no longer wipe existing reference state. The system retains the last known good snapshot until a successful collection replaces it.
- Redis automatic reconnection: If the Redis connection drops at runtime, the system now detects the failure and automatically reconnects on a cooldown schedule. Previously, a Redis outage after startup permanently disabled event persistence until the next process restart.
- Baseline anomaly computation: The per-cell statistical path for anomaly scoring is now numpy-vectorized. Large datasets (500k+ observations) process 10-50x faster, eliminating scheduler stalls during periodic rebuilds.
- Geospatial math consolidation: Haversine distance calculations — previously duplicated across four modules with minor implementation differences — are consolidated into a single numpy-accelerated utility module. Candidate-proximity searches now use a single vectorized call instead of per-entity Python loops.
- Zimbabwe government aircraft (Z-WPF, Z-WPE): updated operator attribution. Robert Mugabe, who died in September 2019, is no longer referenced as president. Both aircraft are Boeing 767s operated by Air Zimbabwe and used on occasion as state transport under President Emmerson Mnangagwa (in office since November 2017).
- Sudan government aircraft (ST-PRA): attribution corrected. Omar Al-Bashir was removed from power in April 2019 and faces outstanding ICC arrest warrants. The Ilyushin Il-62M itself was destroyed at Khartoum airport during the April 2023 civil war and is no longer active.
- Russia — Shuvalov-linked aircraft (M-VQBI): title corrected. The individual linked to this aircraft left the Russian government in May 2018 and now leads a state development corporation.
- Belarus government aircraft (EW-85815): status note added. The Tupolev Tu-154M type was effectively retired globally by 2020–2021; operational status of this specific airframe is unconfirmed.
- Qatar Amiri Flight (VP-BAT): corrected. The Boeing 747SP was retired from Qatar royal service around 2018–2019, subsequently re-registered as a US civil aircraft, and is listed for commercial sale.
- NOAA Aircraft Operations Center fleet description: updated to reflect the G-IV/SP phaseout. The first replacement Gulfstream G550 entered service in spring 2025; a second arrives in 2028. WP-3D Orion, Twin Otter, and King Air 350CER fleet counts remain unchanged.
- Bristow / HM Coastguard SAR network: description updated to enumerate all 10 permanent helicopter SAR bases and note two seasonal bases (Oban and Carlisle) activated in 2026 under the UKSAR2G programme.
- A new GPS interference grid layer is now live, updated daily from aggregated aircraft receiver reports. Affected cells are displayed as amber hexagons on the map. Clicking a cell shows the percentage of aircraft reporting degradation and the observation date.
- Two severity tiers are tracked: high (≥50% of aircraft affected) and medium (25–49%). Both feed the convergence scoring engine so a vessel dark event in a high-interference zone scores differently from one in a clear environment.
- Correlating a vessel going dark with an active high-interference grid cell at the same position and date helps distinguish GPS spoofing/jamming from a simple communications failure.
- When NOAA SWPC data indicates HF radio blackout risk (Kp G3+ geomagnetic storm, or an M1.0+ X-ray solar flare, or an active ICAO space weather advisory), a derived HF Blackout Zone event is now generated.
- This covers the 2–30 MHz spectrum including NAVTEX, GMDSS distress, and MF/HF weather fax bands. An active HF blackout means vessel distress calls on HF may not be receivable.
- Correlating a vessel comms gap with an active G3+ storm removes the jamming hypothesis and narrows the cause to atmospheric conditions.
- Satellite visibility data for major commercial SATCOM constellations is now cached internally from public TLE sources, refreshed every 6 hours.
- This data underpins future vessel-level SATCOM coverage annotation: if the geometry shows zero satellites above the horizon at a vessel's position, a VSAT outage is explicable by coverage gap rather than interference.
- Aircraft popups for US-registered aircraft (ICAO24 in the a00000–afffff range) now include a "Load registry data" button that fetches owner, N-number, manufacturer, model, year, type, seat count, weight class, and registration expiry from the FAA Releasable Aircraft Registry (305,709 records, US public domain).
- Deregistered aircraft receive a prominent red "DEREGISTERED" badge.
- The popup header shows the registry build date so analysts know the data age.
- US coastal marine zone warnings (Gulf of Mexico, Atlantic, Pacific, Gulf of Alaska) are now collected from the National Weather Service and displayed as a dedicated layer.
- 13 maritime event types covered: Hurricane Force Wind Warning through Small Craft Advisory, filtered from the national alerts feed.
- Warnings feed into the convergence scoring engine with severity-weighted contribution (hurricane force = 2.5, storm warning = 2.0, down to 0.8 for small craft advisories).
- Right-clicking the map now includes an "Area Report..." option that generates a structured plain-text SITREP for any radius.
- The report includes a signal summary by source, a notable signals table, nearby infrastructure, and entity feed hits — the same data shown in the proximity query panel, formatted for copy-paste into an analyst log.
-
VIIRS thermal and DNB markers now visible during daytime hours. VIIRS satellite detections are collected 3–24 hours after the satellite pass. DNB (night-light) detections are from nighttime orbital passes and are structurally 6–18 hours old by observation time when viewed during the day. The time-window filter now uses data ingestion time rather than observation time, making all recent VIIRS data visible regardless of when the satellite passed.
-
OpenSky aircraft markers no longer flash/reset on page refresh. Each aircraft is now identified by a stable ID derived from its ICAO24 address. Previously, IDs changed every 30 seconds as position timestamps rotated, causing every aircraft to appear to vanish and re-appear on each refresh.
-
VanIsle infrastructure data no longer fetches twice on startup. A scheduler timing issue caused the infrastructure collector to run once at process start and once more immediately via its interval job. The interval is now correctly offset so the startup run is the only first fetch.
-
Click-to-zoom on intel table rows fully restored. Every table (aircraft, thermal hotspots, vessels, NOTAMs, GPS disruptions, MARAD, ICC, entity feed) had silently stopped jumping the map when rows were clicked. Root cause was a runtime crash in the marker interaction guard that occurred before the map focus call could fire. No data was affected; navigation and zoom functions now work correctly across all intel tables.
-
Clicking map markers overlaid by a convergence zone now works. Previously, a convergence zone polygon's filled area blocked clicks on markers underneath it. The fix routes pointer events only through the zone border stroke, so markers inside a convergence area are fully interactive.
-
Tier upgrade now applies immediately. Entering a premium access key previously left starter-capped data visible until the next timed refresh cycle. The upgrade now forces an immediate data refresh and clears the starter-tier badge from affected layers.
-
Sanctioned vessel popup cleaned up. An informational note about upcoming premium depth expansion was shown unconditionally on all tiers. It has been removed as the expanded capability is now live.
- The first-visit email field is no longer required. Users can skip it by clicking "Skip" or by leaving the field empty and clicking "Continue." Non-empty fields are still validated and submitted. The modal text makes clear that email is optional and used only for maintenance notices.
- VanIsle Network infrastructure (ports, desalination plants, pipelines, refineries) is now part of the Supplemental Entity Feed layer. The previously separate toggle has been removed. One toggle controls both the entity corroboration rings and the infrastructure overlay.
- Sanctioned vessel popups now show a red "AIS DARK GAP" badge or amber "LOITERING" badge when the vessel is independently flagged by the entity tracker for extended AIS silence or unusual loitering behavior.
- Convergence cell popups now label these signal families explicitly as "AIS dark gap (VanIsle)" and "Vessel loitering (VanIsle)" in their contributing evidence breakdown.
- The compliance signal feeds into the convergence scoring engine with weighting that reflects the significance of intentional AIS absence.
- A persistent panel above "Recent NOTAMs" in the left sidebar lists every entity currently active in the entity feed that matches the vessel or aircraft watchlist.
- Each row shows an on-map status indicator (green dot = currently visible on the map), entity type, display name, watchlist database, and last-seen time.
- Clicking a row flies the map to the entity's last known position.
- The panel updates every refresh cycle. When no watchlisted entities are on-map, it shows a quiet empty state rather than hiding.
- The main JavaScript file has been split into three purpose-separated files loaded in dependency order. Parse time, maintainability, and parallel load behavior are improved. No user-visible functionality has changed.
- High-frequency map feed responses now carry conditional caching headers. Browsers that already hold the current data skip the payload download on repeat polls, reducing network and render overhead on stable pictures.
- Static reference layer responses are pre-built at startup rather than serialized on each request, removing per-request encoding cost from the most-polled routes.
- Watchlist entity feed calls are decoupled from the main 30-second refresh cycle. The feed refreshes on its own 10-minute cadence and no longer consumes shared request concurrency on every cycle.
- Container log writes switched to a lower-overhead driver, removing synchronous disk write pressure from every log line.
- SIGMET hazard popups now display plain-language descriptions rather than raw aviation codes. Hazard type, intensity, affected area, valid window, and movement are presented in readable form.
- Polygon hover labels upgraded to show region name and hazard type together instead of the raw code string.
- Original bulletin text preserved in a collapsible section for analysts who need the source record.
- New premium layer: cross-references a supplemental entity feed against live vessel and aircraft positions. Matched entities receive highlight rings on the map — red for watchlist hits, cyan for general corroboration.
- Watchlist hits appear in a dedicated intel table section showing entity type, identifier, observation count, last seen time, and live map status.
- Ring positions update each refresh cycle as underlying positions move, even when the entity feed itself has not changed.
- Available under the Supplemental Entity Feed toggle in the layer panel.
- Tier access control consolidated into a single registry. Adding a new gated feature now requires one entry rather than updates across multiple lists, eliminating the class of drift bug where a feature could appear in one list but not another.
- Fixed: three reference layers were accessible to starter-tier sessions despite being configured as premium-only. The registry consolidation corrected the inconsistency.
- Fixed: premium-tier unavailability badges were remaining visible for authenticated premium sessions due to a CSS specificity conflict between the badge class and the hidden attribute. Resolved.
- International and domestic aviation weather SIGMETs integrated as a new map layer. Coverage includes convective activity, volcanic ash, turbulence, tropical cyclone warnings, and other hazards relevant to maritime airspace.
- Hazard polygons rendered as semi-transparent overlays with centroid markers. Each event shows hazard type, severity, affected area, altitude ceiling, and valid window.
- A maritime relevance flag distinguishes hazards directly over ocean areas from land-based events.
- Layer refreshes every 20 minutes. Expired events are dropped before display.
- Vessel and aircraft detail panels now include a Show Track button for premium sessions. Selecting it renders a fading historical track polyline — opacity scaled from oldest to newest — with per-segment timestamps and speed.
- Track history draws from the platform archive rather than the live position feed, so coverage extends back through the retention window.
- Starter sessions receive an empty track response with a clear tier indicator rather than an error.
- Three additional maritime reference overlays added to the premium layer set:
- Restricted and danger zones — areas where vessel presence requires explanation. AIS gaps inside these zones are expected rather than anomalous.
- Ship-to-ship transfer zones — lightering areas where vessels may legally conduct at-sea transfers. Sanctioned-vessel dwell in these areas is a potential illicit transfer signal.
- Designated anchorages — official holding areas. Vessels anchored outside designated anchorages represent a deviation from expected behaviour.
- Supplemental vessel and aircraft identity feeds integrated as a background data source, refreshing every 10 minutes independently of the main refresh cycle.
- Entity feed corroboration badges appear in vessel and aircraft detail panels when the identifier is present in the feed, showing observation count and last seen time.
- Proximity query results include an entity feed corroboration column for matched vessels and aircraft within the search radius.
- Watchlist-matched entities in the feed trigger hypothesis entries when active positions are present.
- Ports and Terminals sidebar badge corrected from premium to enterprise following the tier change in v1.42.0.
- The global ports and terminals reference layer is now enterprise-only. The layer is renamed from Ports to Ports and Terminals across all user-facing surfaces. The data and underlying access path are unchanged.
- Locked sessions now see explicit enterprise-tier messaging rather than the generic premium-locked copy.
- Analyst hypotheses now expire after 48 hours on each collection cycle, keeping the hypothesis panel uncluttered in long-running deployments. The hypothesis query endpoint accepts an optional age filter for on-demand trimming independent of the scheduled expiry.
- Navigation warning, broadcast warning, and NOTAM intel table routes hardened against silent failures on records with missing or null fields. Count queries use direct store methods rather than over-fetching and slicing in the application layer.
- Global ports reference layer added at premium tier with startup fallback seeding so the layer survives volume-backed deployments.
- Thermal proximity alerts can now surface port context alongside energy, datacenter, and strategic infrastructure context.
- Thermal alert detail panels now distinguish proxy-only detections from confirmed anomalies and show observation age more clearly.
- Offshore drilling unit state now normalised at ingest. Status, activity bucket, and detail fields arrive pre-computed rather than being inferred from raw strings in the browser.
- Thermal detection subtype fidelity made explicit. When the feed cannot distinguish fire subtype, collector health degrades visibly rather than silently implying the feed is inactive.
- Thermal layer counts now separately report loaded, rendered, maritime-filter-held, and zoom-held state, removing the common confusion where a maritime filter made a live feed appear empty.
- Fixed white-screen regression on mobile marker tap. The detail panel backdrop is now a dark semi-transparent overlay rather than a near-opaque white cover.
- Fixed API unavailable state on iOS Safari caused by the onboarding dialog being pushed behind the software keyboard. Dialog now tracks the visual viewport so the submit control is always reachable.
- Desktop sidebar density reduced: touch-sized controls scaled down for pointer use without affecting mobile touch targets.
- Removed obsolete CSS properties with no effect on current browsers.
- Added viewport safe-area support for notched and Dynamic Island devices.
- Maritime thermal subfilter added to the VIIRS layer, allowing isolation of offshore detections from land-based fire activity.
- Thermal detections now carry an explicit policy outcome — background, context, watch, or page — so the system's assessment is visible rather than implicit.
- Known offshore flare basins encoded as negative controls so routine hydrocarbon signatures are not promoted based on proximity alone.
- Thermal popup and proximity surfaces now distinguish offshore and gas-flare detections and show nearby infrastructure context.
- Platform persistence health now visible end-to-end from backend to dashboard.
- Partial persistence flush failures now requeue buffered events rather than discarding them.
- Hidden layers no longer continue refreshing when not in view.
- Large event snapshots no longer rewrite browser session storage on every poll when data has not changed.
- Redundant manual refresh controls removed. The dashboard now exposes the automatic refresh loop through a passive countdown rather than duplicate operator controls.
- Unused sidebar search UI removed.
- Access tier banner can now be dismissed per session.
- Premium expanded-depth toggles now unlock correctly on premium sessions and allow explicit fallback to preview depth.
- Map polling reuses cached responses until data actually changes rather than expiring on a wall-clock TTL, so unchanged layers stop missing the cache on routine refresh cycles.
- Sanctioned-vessel route and zone index rebuilt only when the underlying source has changed.
- Protected browser sessions now require server-issued onboarding completion before the API unlocks. Onboarding responses marked no-store to prevent stale session state being cached by the browser.
- Onboarding intake rejects obvious placeholder addresses and enforces uniqueness.
- Thermal layer now separates fire detections from night-light detections, exposes hotspot clusters with unusualness scoring, and renders pixel-footprint geometry where available.
- Nearby port, offshore, infrastructure, and strategic context surfaces in thermal proximity alerts.
- Dense thermal layers now explain loaded versus rendered state through counts, zoom hints, and subfilter breakdowns.
- Thermal proximity route no longer materialises full event payloads on hot paths, removing the serialisation cliff under repeat load.
- Large static reference layers cached server-side and restored from saved state through a staggered idle queue rather than a fan-out load at startup.
- Event geometry now persists correctly through the archive and restores on read, closing a silent geometry-loss path for geometric evidence types.
- Source health auto-expands when sources are degraded or cache-backed.
- Starter access upgrades cleanly through browser session exchange when a valid key is entered. The access-key store is shared between the management tooling and the running container.
- Header now surfaces an explicit access key entry point. Sidebar no longer duplicates the upgrade prompt.
- Starter access now gates on a first-use modal before the dashboard starts, rather than treating onboarding as a cosmetic overlay.
- Email intake stays on-box in runtime-only storage with no public route exposure.
- Starter-tier limits now apply consistently across both the map feed and the raw event API.
- Frontend access state now follows server truth on session expiry, logout, or tier downgrade. Stale privileged data is cleared when the backend narrows access.
- Optional-auth deployments fall back cleanly to starter access on logout rather than freezing the dashboard.
- Access panel now shows current tier, session status, and expiry.
- GeoJSON cache hits reuse pre-serialised bytes. Capped map responses keep newest-first semantics without sorting the full result set.
- Bulk map feed responses no longer force maritime enrichment by default. The enrichment index rebuilds on source file change rather than a fixed timer. Large feature sets skip analyst-facing enrichment instead of turning the default map feed into a CPU trap.
See geojson-cpu-outage.md for the full incident record.
- VIIRS proximity alerting restored for close-range offshore detections near strategic context.
- Nearest cable distance suppressed from detail panels when the nearest cable is more than 1000 km away.
- Starter-tier preview layers render in a visibly distinct state. Upgrade messaging uses generic access language rather than source-specific wording.
- Optional dashboard authentication added as a deployment-wide session gate. Protected deployments require a browser session exchange before API access is granted. Open local development can remain ungated by configuration.
- Starter tier defaults to a reduced map profile. Dense premium-candidate layers are off by default. Premium depth is capped until a session upgrade is completed.
- Military installation data made internal-only. User-facing routes and frontend load paths removed.
- Collector health states preserve backend run modes end-to-end. The UI can now distinguish empty, error, cache, stale, and partial states rather than collapsing them into ambiguous badges.
- First archive boundary: raw feed data archived before normalisation so replay and provenance work has a stable baseline to work from.
- Release version exposed through a runtime API endpoint so the dashboard header version reflects the deployed line rather than hardcoded text.
- Convergence endpoint uses a short-lived response cache, removing redundant recomputation from the default dashboard poll loop.
- Refresh fan-out split by cadence: slow-moving sources no longer refetch on every 30-second cycle.
This candidate was rolled back. Changes were carried forward into v1.30.0.