diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 870eb51aa..82fc9201b 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -9,12 +9,15 @@ broader suffix variants. Follow-ups retain boundary provenance, and cancelled
 lookups preserve the previous analyst cohort and boundary source. Navigation
 search keeps a successful geocode, with no search or view-based region recovery.
 
-CelesTrak accepts only the seven satellite groups used by the app and gates
-requests before provider work. CelesTrak and Launch Library failures start a
-provider-wide cooldown: Retry-After seconds or HTTP dates are bounded to 5 seconds
-through 30 minutes, with a 60-second fallback. During cooldown dated last-good
-data is served with stale provenance, otherwise the proxy returns a bounded
-error without another upstream attempt. Error bodies are cancelled before reading.
+CelesTrak accepts only the eight satellite groups used by the app (the seven
+satellite-layer groups plus `active` for Space Missions) and gates cross-site
+requests before provider work with the keyless same-site policy, so the
+documented reverse proxy still works. CelesTrak and Launch Library failures
+start a provider-wide cooldown that a later failure never shortens: Retry-After
+seconds or HTTP dates are bounded to 5 seconds through 30 minutes, with a
+60-second fallback. During cooldown dated last-good data is served with stale
+provenance, otherwise the proxy returns a bounded error without another upstream
+attempt. Error bodies are cancelled before reading.
 
 Terrain height requests accept at most 64 points, matching the browser service's
 existing batch size and one bounded upstream chunk. Larger requests return HTTP
diff --git a/server/providers/space/celestrak.js b/server/providers/space/celestrak.js
index 315e9b3f0..013fce1b1 100644
--- a/server/providers/space/celestrak.js
+++ b/server/providers/space/celestrak.js
@@ -2,7 +2,7 @@ import path from 'node:path';
 import { promises as fsp } from 'node:fs';
 import { celestrakTleUrl } from '../../../src/data/spaceProviderRequests.js';
 import { providerCooldownMs } from './cooldown.js';
-import { admitSameSite } from '../common/same-site.js';
+import { admitSameSiteKeyless } from '../common/same-site.js';
 import { readResponseTextCapped } from '../common/http.js';
 
 /**
@@ -34,6 +34,8 @@ export function celestrakProxy() {
     'galileo',
     'geo',
     'starlink',
+    // Space Missions (`getActiveTle`) reads the full active catalog.
+    'active',
   ]);
   let cooldownUntil = 0;
   const mem = new Map(); // group -> { at: epochMs, body: string }
@@ -77,7 +79,12 @@ export function celestrakProxy() {
       },
     });
     if (!res.ok) {
-      cooldownUntil = Date.now() + providerCooldownMs(res);
+      // Group refreshes run in parallel: a later failure without Retry-After
+      // must never shorten a longer deadline an earlier one already set.
+      cooldownUntil = Math.max(
+        cooldownUntil,
+        Date.now() + providerCooldownMs(res),
+      );
       void res.body?.cancel().catch(() => {});
       throw new Error(`HTTP ${res.status}`);
     }
@@ -96,7 +103,9 @@ export function celestrakProxy() {
       const group = String(req.url || '')
         .replace(/^\//, '')
         .split('?')[0];
-      if (admitSameSite(req, res)) return;
+      // Keyless and needed to render the satellites layer: refuse cross-site
+      // browsers but keep the documented reverse-proxy deployment working.
+      if (admitSameSiteKeyless(req, res)) return;
       if (req.method !== 'GET') {
         res.writeHead(405);
         res.end();
diff --git a/server/providers/space/launch-library.js b/server/providers/space/launch-library.js
index 4e8ac629d..f95be2056 100644
--- a/server/providers/space/launch-library.js
+++ b/server/providers/space/launch-library.js
@@ -90,8 +90,12 @@ export function rocketLaunchesProxy() {
       headers: launchLibraryRequestHeaders(),
     });
     if (!upstream.ok) {
-      cooldownUntil = Date.now() + providerCooldownMs(upstream);
-      cooldownStatus = upstream.status;
+      const deadline = Date.now() + providerCooldownMs(upstream);
+      // Never shorten a longer cooldown that is already in force.
+      if (deadline >= cooldownUntil) {
+        cooldownUntil = deadline;
+        cooldownStatus = upstream.status;
+      }
       void upstream.body?.cancel().catch(() => {});
       const error = new Error(`upstream HTTP ${upstream.status}`);
       error.upstreamStatus = upstream.status;
diff --git a/src/proxyErrorResponses.test.mjs b/src/proxyErrorResponses.test.mjs
index d215e78a3..4f9ef7602 100644
--- a/src/proxyErrorResponses.test.mjs
+++ b/src/proxyErrorResponses.test.mjs
@@ -25,7 +25,6 @@ function fixture(name, overrides = {}, preview = false) {
   const logs = [];
   const deps = {
     readResponseTextCapped, coalesceProxyRequest, providerCooldownMs,
-    admitSameSite: () => false,
     // The rate-limited proxies reach for these; give them the real ones so a
     // fixture request is throttled exactly as production would be.
     makeRateLimiter, clientKey,
diff --git a/src/tooling/spaceProviders.test.mjs b/src/tooling/spaceProviders.test.mjs
index 2abc9d5fc..7aef775b1 100644
--- a/src/tooling/spaceProviders.test.mjs
+++ b/src/tooling/spaceProviders.test.mjs
@@ -12,6 +12,7 @@ import {
   launchLibraryRecentUrl,
 } from 'gods-eye-view/sources/space';
 import * as compatibility from '../../server/providers/local.js';
+import { createLaunchSource } from 'gods-eye-view/layers/launches/source';
 
 function install(plugin, preview = false) {
   const routes = new Map();
@@ -22,17 +23,23 @@ function install(plugin, preview = false) {
       },
     },
   });
-  return async (route, url = '/', method = 'GET') => {
+  return async (route, url = '/', method = 'GET', headers = {}) => {
     const res = {
       headersSent: false,
+      headers: {},
       writeHead(status, headers) {
         Object.assign(this, { status, headers, headersSent: true });
       },
+      // The same-site gates answer 403 through statusCode + setHeader.
+      setHeader(name, value) {
+        this.headers[name] = value;
+      },
       end(body) {
         this.body = body;
+        this.status ??= this.statusCode;
       },
     };
-    await routes.get(route)({ url, method }, res);
+    await routes.get(route)({ url, method, headers, socket: {} }, res);
     return res;
   };
 }
@@ -270,3 +277,118 @@ test('space providers honor Retry-After, gate groups, preserve stale dates and r
     }
   }
 });
+
+test('Space Missions reads the active catalog through the real proxy while unknown groups stay rejected', async (t) => {
+  isolateDisk(t);
+  const tle = 'ISS\n1 25544U fixture\n2 25544 fixture\n';
+  const fetched = [];
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    fetched.push(new URL(url).searchParams.get('GROUP'));
+    return new Response(tle);
+  });
+  const request = install(celestrakProxy());
+  // Route the browser source's real request into the middleware.
+  const source = createLaunchSource({
+    fetchImpl: async (url) => {
+      const prefix = '/api/celestrak';
+      assert.ok(url.startsWith(`${prefix}/`));
+      const res = await request(prefix, url.slice(prefix.length));
+      return new Response(res.body, { status: res.status });
+    },
+  });
+  assert.equal(await source.getActiveTle(), tle);
+  assert.deepEqual(fetched, ['active']);
+  for (const group of ['/not-a-group', '/active-extra', '/../active'])
+    assert.equal((await request('/api/celestrak', group)).status, 400);
+  assert.deepEqual(fetched, ['active'], 'rejected groups never reach upstream');
+});
+
+test('CelesTrak admits a same-origin request behind the documented reverse proxy and refuses foreign origins', async (t) => {
+  isolateDisk(t);
+  let calls = 0;
+  t.mock.method(globalThis, 'fetch', async () => {
+    calls++;
+    return new Response('ISS\n1 25544U fixture\n2 25544 fixture\n');
+  });
+  const request = install(celestrakProxy());
+  const proxied = {
+    host: 'gev.example.test',
+    'x-forwarded-for': '203.0.113.7',
+    'x-forwarded-host': 'gev.example.test',
+    'x-forwarded-proto': 'https',
+    via: '1.1 proxy',
+  };
+  const app = await request('/api/celestrak', '/stations', 'GET', {
+    ...proxied,
+    origin: 'https://gev.example.test',
+    'sec-fetch-site': 'same-origin',
+  });
+  assert.equal(app.status, 200);
+  assert.equal(app.headers['x-tle-cache'], 'MISS');
+  assert.equal(calls, 1);
+  for (const headers of [
+    { ...proxied, origin: 'https://unrelated.example' },
+    { ...proxied, origin: 'null' },
+    { ...proxied, 'sec-fetch-site': 'cross-site' },
+  ]) {
+    const refused = await request('/api/celestrak', '/visual', 'GET', headers);
+    assert.equal(refused.status, 403);
+  }
+  assert.equal(calls, 1, 'refused requests do no provider or cache work');
+});
+
+for (const longFirst of [true, false])
+  test(`CelesTrak keeps the longest cooldown when concurrent failures finish ${longFirst ? 'long then short' : 'short then long'}`, async (t) => {
+    isolateDisk(t);
+    t.mock.method(console, 'warn', () => {});
+    let now = Date.now();
+    t.mock.method(Date, 'now', () => now);
+    const pending = new Map();
+    let calls = 0;
+    t.mock.method(globalThis, 'fetch', async (url) => {
+      calls++;
+      const group = new URL(url).searchParams.get('GROUP');
+      await new Promise((resolve) => pending.set(group, resolve));
+      return group === 'stations'
+        ? new Response('slow down', {
+            status: 429,
+            headers: { 'Retry-After': '1800' },
+          })
+        : new Response('unavailable', { status: 503 });
+    });
+    const request = install(celestrakProxy());
+    const long = request('/api/celestrak', '/stations');
+    const short = request('/api/celestrak', '/visual');
+    while (pending.size < 2) await new Promise(setImmediate);
+    const order = longFirst
+      ? [
+          ['stations', long],
+          ['visual', short],
+        ]
+      : [
+          ['visual', short],
+          ['stations', long],
+        ];
+    for (const [group, response] of order) {
+      pending.get(group)();
+      assert.equal((await response).status, 502);
+    }
+    assert.equal(calls, 2);
+    const cooling = await request('/api/celestrak', '/geo');
+    assert.equal(cooling.status, 502);
+    assert.equal(cooling.headers['Retry-After'], '1800');
+    now += 61_000;
+    assert.equal((await request('/api/celestrak', '/geo')).status, 502);
+    assert.equal(
+      calls,
+      2,
+      'the 60 s fallback did not replace the 30 min deadline',
+    );
+    now += 1800_000;
+    t.mock.method(
+      globalThis,
+      'fetch',
+      async () => new Response('ISS\n1 25544U fixture\n2 25544 fixture\n'),
+    );
+    assert.equal((await request('/api/celestrak', '/geo')).status, 200);
+  });