Common Operating Picture — "The Picture"

Every operating picture
says "real-time". None says
how much you can brief.

Pick an incident and the seven essential elements of information assemble round it, each with its time of record, its age against its own cadence and one of four states. One number heads them: BRIEFABLE n of 7 for this operational period.

California reference implementation · 1,106 assertions green on 2026-10-21 · 40 behaviours On-prem · keyless basemaps · no API key anywhere in the app

© 2026 Tabaqat · Built on Strata — sovereign geospatial applications. Beside command, never the system of record: not CAD, not a warning originator, not the ICS 209 of record. Every bound feed probed 2026-10-21.

The decision this drives

What goes into this period's briefing, and what to chase before it does.

The user is the EOC's Situational Awareness section, the Situation Unit elevated to report to the EOC director in NIMS's EOC structure. They assemble the picture for one incident, once per operational period. Their output is a briefing draft and a list of items still to validate.

It is never a decision to evacuate, dispatch or warn. Those belong to the incident commander, to CAD and to the alert originator. The app sits beside them, and anyone looking at the screen can see that.

Buyer: EOC director · state / county emergency management Second buyer: an industrial, energy or giga-project watch centre near a public incident

0 of 10EOC and watch-centre platform pages read on 2026-10-21 that state any handling of the operational period. None names the ICS 209

All ten say "real-time" or "near-real-time". Only one (Esri) states a refresh interval and a last-update stamp. None shows which element of the picture is verified and which is not.

Juvare WebEOC · Veoci · D4H · Noggin · Hexagon OnCall · Esri · Everbridge VCC · Dataminr · Samdesk · AlertMedia, each read on its own product page.

The finding that shaped the app

NIMS never defines a "common operating picture". It does define how you verify one.

The phrase isn't in the doctrine

We read the NIMS doctrine, Third Edition (October 2017) in full on 2026-10-21. "Common operating picture" appears in neither its glossary nor its body. The product category is named after a concept the standard never specifies, so the app cites what NIMS actually governs.

Validation has five tests

Staff "review data to determine if it is incomplete, inaccurate, embellished, outdated, or misleading" (p.56). Outdated is one of the five tests. That makes the age of every element a requirement of the doctrine.

A SITREP covers one period

A Situation Report is "confirmed or verified information" (p.70), "a snapshot of the incident status during the past operational period" (p.54). The period is "typically 12 to 24 hours" (p.68).

So the app's roles are NIMS's Essential Elements of Information, not every layer we could find. Each one carries its age, whether it has been validated, and the operational period it belongs to.

Where this sits — benchmark and coexist, never copy

Most COPs are boards with a map. None shows which part you can brief.

What exists	How the picture is held	Freshness & verification	Verdict
Juvare WebEOC	boards; the Situation Report board rolls sections up for approval, "typically published at least once every 24 hours"	not stated per element	The system of record most EOC buyers own. We sit beside it
Esri Emergency Management Operations	an Incident Status Dashboard of maps, lists, charts and gauges	the only vendor page showing "last update" times and a 3-minute refresh	The stack the buyer may already own. This app runs on it
Veoci · D4H · Noggin · Hexagon OnCall	"create a common operating picture"; the map is one feature among boards	"real-time"; no per-element age or verification shown	Boards with a map: 6 of the 10 platforms read
Watch Duty · Perimeter	map-first. Watch Duty now sells "a common operating picture" to agencies; Perimeter replays incidents day by day	Watch Duty: "accuracy is more important than speed"; no data-age display stated	Sells trust to the public, but not per element or per period
The Picture	one incident · seven EEI · BRIEFABLE n of 7	each element's age against its own cadence, whether it is validated, and the period it belongs to	The gap

Across the field, freshness is a slogan, and verification is something the public products sell. No platform we read shows each element's age against its own cadence, marks which elements are verified, or ties either to the period whose SITREP they feed.

The silhouette — "incident-anchor"

The incident is the anchor, not a filter.

We considered three layouts. A board of tiles with a map widget was rejected: six of ten platforms already sell exactly that, and it turns the incident into a filter. A scrolling briefing page was rejected because the operator would read it instead of operating it. The incident anchor won, because the question starts with "for the incident I pick".

Pick a row and that incident lights up while the rest dim to 35 %. A dashed 15 km straight-line ring is drawn round its point of origin, and the dossier assembles the seven elements, each in exactly one of four states:

✓ VALIDATEDpassed the five NIMS tests this period, and unchanged since

● CURRENTinside its source's own cadence, not yet validated

◷ STALEpast its cadence or its own rule; the reason is printed

⊘ NO FEED HEREno public feed covers it; shown with its citation, never as zero

A schematic of the layout; the shipped screen is on the next slide. The rail, map and dossier are one selection: pick a row and all three re-assemble. The number sits next to the evidence for it, and the denominator is always 7, because a gap is counted, never dropped.

The application, first paint

The first screen is the signature, not an empty dossier.

The Picture at first paint: incident rail on the left with NORTE selected, a dark map with the dashed 15 km straight-line ring round the NORTE perimeter and Caltrans camera squares, the legend open, and the dossier on the right reading BRIEFABLE 0 of 7 with E1 Incident area STALE.

Shipped build, 2026-10-21: a browser screenshot written by the automated driver, not a mock-up. With no deep link the app auto-selects the wildfire with the newest WFIGS perimeter. On that day it was NORTE, Orange County.

A notice bar that never goes away. It says the app is not the system of record, and names what is: the IMT's ICS 209, the issuing county, NWS and IPAWS.
The rail hides nothing silently. 71 of 71 shown. Prescribed burns are a counted chip (20 · hidden). Missing size reads "not reported", never 0.
BRIEFABLE 0 of 7 at first paint, and it says why. E1 is ◷ STALE because the perimeter was last mapped 2026-10-20 18:19Z, before this period began at 07:00 PDT.
Every element shows its age. Time of record · time of fetch · polling cadence, e.g. rec 2026-10-20 18:19Z · fetched 15:02Z · polls 5 min.
The standard map controls, an interactive legend that keeps its denominators (32 of 32), and a ring you can set to 8 · 15 · 30 km.

The signature loop — validate, and the number moves

One element passes the five NIMS tests. BRIEFABLE goes from 0 to 1.

The dossier after validation: BRIEFABLE 1 of 7, E1 Incident area marked VALIDATED by JM, Sit Unit at 08:03 PDT, LOCAL — NOT SHARED, with a Remove validation button and a toast reading Validated in this browser — local, not shared.

The "JM, Sit Unit" mark was entered by the automated browser driver as a test step. It is not a real validation. The ledger starts empty, and nothing is seeded.

NORTE · P0 · 2026-10-21before → after

E1 Incident area◷ STALE✓ VALIDATED

E2–E5, E7● CURRENT● CURRENT

E6 Damage inspections⊘ NO FEED⊘ NO FEED

BRIEFABLE0 of 71 of 7

All five tests, or no mark. Not incomplete · not inaccurate · not embellished · not outdated · not misleading. With four ticked, the mark is refused.
A mark doesn't outlive its data. If the time of record or the count changes, it reads "superseded — re-validate" and the number drops.
Held in this browser only, labelled LOCAL — NOT SHARED wherever it is shown, and carried into every export.

The element that lies politely

"The image loads" doesn't mean "the camera works".

Statewide, 743 of 2,836 in-service Caltrans cameras (26 %) answer HTTP 200 image/jpeg with a fresh Last-Modified, and the image is a white "Temporarily Unavailable" card. 82 more return HTTP 500. A card passes the status, type, size and date checks. Only its pixels give it away.

fetch → createImageBitmap → canvas, in the browser
count the share of near-white pixels (> 235 of 255)
above 0.6 ⇒ an unavailable card · live image measured 0.13 · card 0.86
and independently: older than 3 × its own update frequency ⇒ stale

At build, one card carried a stale burned-in date, and one District 7 camera had a Last-Modified about 1,126 h old. Neither the header nor the caption can be trusted, so the pixel test stays.

NORTE · 15 km ring · E5 cameras2026-10-21

In service in the ring39

Showing an imageclassified by pixels32

Showing an "unavailable" card0

Not answeringHTTP 500, no CORS header7

The period bar — replay only what was recorded

Step back a period, and the app says what it doesn't have.

Replaying P-1: a banner reads no snapshot — this browser was not open during P-1; perimeter = FIRIS version mapped 2026-10-17 02:22Z; other layers are live. The dossier says posting is closed while replaying.

P-1 on 2026-10-21: "no snapshot — this browser was not open during P-1 · perimeter = FIRIS version mapped 2026-10-17 02:22Z · other layers are live".

12-hour periods from 07:00 PT, P-3 to P0, each step showing how many snapshots this browser took in it.
A snapshot is real or absent. The previous app replayed periods with a filter. This one shows the snapshot it actually took, or says the browser was not open.
The only replayed geometry is a source's own. FIRIS keeps every mapped perimeter version (NORTE 2, COOLEY 5). The bar draws the newest one at or before the period's end.
Snapshots are taken automatically on every change, capped at 200 per incident, and any drop is stated. The cap is only exercised in the offline suite.
Posting is closed while replaying. Go back to now to add a verified update.

The export — a draft, and it says so

The briefing leaves shaped like an ICS 209, never as one.

The SITREP draft print sheet for NORTE with a red banner at top and bottom reading DRAFT — NOT THE ICS 209 OF RECORD, LOCAL — NOT SHARED; blocks 7 size, 8 percent contained, 11 time period, 28 significant events, 30 structures and 34 evacuation status.

The block 28 entry in this print was typed by the automated browser driver as a test step, not by a real Situation Unit. The 4-page PDF the driver wrote was checked by hand: the banner prints at the top and bottom of all 4 pages.

The ICS 209 is prepared "once daily or for each operational period". This draft pre-fills the blocks that public feeds can honestly answer, and leaves the judgement blocks blank for the Situation Unit to finish in its own system.

ICS 209 blockthis draft

7 Size · 8 % contained570 ac · 92 %filled

11 Time periodP0, 07:00–19:00 PDTfilled

28 Events · 34 Evacuationlocal feed · zonesfilled

30 Structuresno 2026 DINS eventsays so

36 · 39 · 41 Judgementprojected · needs · plansblank

Block 7 prints the incident's 570 ac (ICS 209) with the perimeter's 570.38 GIS acres beside it as a separate figure. They are never averaged. Feed JSON downloads as cop-feed-<IrwinID>-<stamp>.json.

The California spine — public, keyless, and every trap inverted on purpose

Seven elements. Six traps that decide the number.

The layer date ticks with no change

On both WFIGS layers, dataLastEditDate advanced about every 10 minutes while the response body hash stayed identical. Freshness therefore comes from record times, and changes are detected by a body hash.

Orders that never expired

8 of 9 Evacuation Orders statewide are Tulare flood zones last updated 2023-09-21, still published as current. Any zone more than 30 days old renders "unverified — check the issuer" and marks E2 stale.

An error that answers 200

The DINS distance query in 4326 returns HTTP 200 carrying {"error":{"code":400…}}. Any {error} body counts as a failed fetch, never as zero. There is no 2026 inspection at all (newest event 2025-11-23).

Lane closures are planned work

8,472 of 11,038 rows start in the future, and District 7 alone is 14.2 MB per poll. E4 counts only closures in place now, in the districts the ring touches. Emergency closures have no keyless feed, and the app says so.

Size and containment are mostly blank

Of 72 California wildfires, size was set on 31 and containment on 10. The rail and the draft print "not reported", never 0. "Hide 100 % contained" keeps the rows with blank containment visible.

Seven counties are gaps

Imperial, Kings, Merced, San Francisco, Alpine, Sacramento and Stanislaus publish no zones to the statewide aggregation. For an incident there, E2 reads ⊘ NO FEED HERE with the county's own link. It never reads "no zones".

The spine: WFIGS incidents and perimeters (downstream of IRWIN, never an IRWIN integration) · FIRIS perimeter versions · Cal OES evacuation aggregation + CAL FIRE status view · CHHS Open Shelters + FEMA ESF-6 · Caltrans lane closures + CCTV · CAL FIRE DINS · NWS alerts in effect at the point of origin · USGS 24 h. Not bound, and labelled: CAL FIRE's incident list (no CORS), satellite hotspots (gated three ways), July's frozen evacuation URL. Catalog: 2,553 service URLs crawled 2026-07-16, each probed when it is pinned; 16 are excluded because their names contain spaces, and the app says so.

Proof, not promises

Built, driven and measured on 2026-10-21.

1,106assertions green on 2026-10-21: 339 live · 479 offline · 288 in real headless Chrome, across 40 specified behaviours

25/25shared map-controls conformance checks; check-drift OK against @strata/map-controls 1.0.4

4.72worst informational contrast ratio, measured in both themes. The floor is 4.5

0API keys, build steps and dependencies. Run node server.mjs and it works

Only the browser caught it

MapLibre's compact attribution renders expanded until the first drag. The credit line ran across the scale bar and the legend while every DOM assertion stayed green. The ring label wrapped to "15 km straight-". Both are now pinned in the offline suite.

A failed refresh never blanks the map

The last good data is kept, and only the freshness indicator changes: "refresh failed 08:04 — showing 08:02". The browser suite drives this and the recovery. A WFIGS feed that comes back empty shows the quiet-season line, and the map stays drawn.

Not all green — said plainly

The code was edited on 2026-10-22. A re-run that day: offline 479 / 479, drift OK. The live (339) and browser (288) suites have not been re-run since. Untested live: T11's evacuation rebuild window, and the 11-minute T7 slow watch, which never completed.

Reading the figures: every number on these slides comes from the recipe's terminal probes or from the shipped app on 2026-10-21. There is no generated data in this build: nothing is seeded. The validation and verified update in the screenshots were typed by the automated browser driver as test steps, held locally and labelled as such.

Stated as boundaries, not caveats

What this application will not do.

Beside command, never the system of record. It is not CAD, not resource ordering and not a damage assessment of record, and the SITREP is not the ICS 209 of record. The notice bar says so on screen, and every export repeats it word for word.
It originates nothing. There is no compose or send control for any alert. The failure the research found is an alert, not a map: on 9 January 2025 an alert meant for West Hills went to nearly 10 million residents of Los Angeles County.
Local, not shared. Validations, verified updates and snapshots live in one browser and leave only as a PDF or JSON. Snapshots exist only for the times that browser was open.
Straight-line distance, never drive-time. No routing engine is named, so none is implied.

Only as good as the public feeds. WFIGS reports size on under half of California wildfires and containment on about one in seven. California publishes no damage inspections for 2026, and emergency road closures have no keyless feed.
It cannot tell a server error from a block. A camera that answers HTTP 500 with no CORS header looks to the browser like a CORS failure, so both count as not answering.
Internal only. There is no public view, because the local feed may hold unvalidated items. English only. No hotspot layer, because every route is gated.
Read-only. An optional write-back to the customer's own ArcGIS incident-log layer is specified in the recipe and switched off in this build.

Every one of these is written into the delivered application's own README. A tool that hides its edges costs you the project it cannot finish.

Point it at your jurisdiction

One incident you pick.
Seven elements you must brief.

Bring your incident source and the public or agency feeds that answer the seven elements where you are: perimeters, evacuation zones, shelters, closures, cameras, damage and weather. Then set your operational period, and the dossier reads your incident instead of a California wildfire.

Chosen at build, not hardcoded: the picture radius (8 · 15 · 30 km straight-line), the operational period (12 h or 24 h, and its start time), the theme, and an optional write-back to your own ArcGIS incident-log layer (specified in the recipe, off in this build). It runs alongside the WebEOC and Esri stack you already own. A watch centre near a public incident can read the same picture of that incident.

tabaqat.net → Solutions → Emergency Management info@tabaqat.net

© 2026 Tabaqat · Built on Strata. Reference implementation over California, probed 2026-10-21. Beside command — not CAD, not a warning originator, not the ICS 209 of record, and not a public information map.