Merge origin/main into german/navara

Main's work since the last merge runs on the globe contract where this
branch draws through it:

- Satellites take main's classes, sensors, ground-track bearings and
  world time through contract points and rings; launches take the world
  timeline. The satellite's cockpit subject dims, copies positions and
  refocuses through the contract.
- Flights, military and vessels keep main's photos, retry cool-downs,
  world-clock motion and the ship bridge. Trail seeding in the shared
  aircraft tracking reads each layer's clock.
- Traffic's flow lines and single build draw as ground sets; transit
  keeps dated credits and the new cities; CCTV opens the nearest camera,
  and the Quebec overlay projects and tests the horizon through the
  contract. Bikeshare's manager cleanup moved into its current lifecycle.
- Draw keeps main's mark actions across engine switches.
- The world clock in src/time is plain numbers again: Julian dates come
  from src/geo, the frame loop is injected, and the binding to Cesium's
  viewer clock lives in src/globe/cesium/worldTime.js. Navara's sky and
  sun follow the world time; live feeds keep the real time.
- The cockpit's orbital view, with its sensor zoom, ground focus and
  satellite switching, stays Cesium-only for now: Navara hides its entry.
  Its Cesium calls live in src/globe/cesium/orbital.js. The ship bridge's
  finest-detail waterline sampling is Cesium-only too; Navara samples
  loaded geometry and detailed terrain. Both are in KNOWN-ISSUES.
- Main's tests that built a Cesium scene by hand run on the fake engine.
- The boundary manifest is regenerated, the coupling baseline records
  the orbital and bridge code, and the main-chunk baseline is raised to
  the merged size: main itself grew its main chunk by 93,959 bytes
  (gzip -9) since the previous merge base.

scripts/build-admin-packs.mjs

@@ -7,13 +7,16 @@
  *     Natural Earth 10m admin-1 states and provinces (public domain).
  *   src/data/local_data/us_census_counties/counties.json
  *     US Census Bureau cartographic boundary counties (public domain).
+ *   src/data/local_data/natural_earth/populated_places.json
+ *     Natural Earth 10m populated places as points, for the orbital view's
+ *     "near <city>" (`src/data/placeBelow.js`; public domain).
  *
  * Both sources are pinned by URL and SHA-256, so a rerun reproduces the packs
  * byte for byte. Downloads are cached outside the repository (default: the
  * system temp directory) and are never committed.
  *
  * Usage:
- *   node scripts/build-admin-packs.mjs [--cache <dir>] [--only countries|admin1|counties]
+ *   node scripts/build-admin-packs.mjs [--cache <dir>] [--only countries|admin1|counties|places]
  *
  * The provenance READMEs beside each pack record these parameters.
  */
@@ -101,6 +104,9 @@ export const PARAMS = Object.freeze({
     elsewhereMinPopulation: 50_000,
     cityStateMaxKm2: 1_000,
   },
+  // Every populated place, kept as a point: name, position and the two
+  // prominence ranks the orbital view picks "near <city>" by.
+  places: { decimals: 3 },
 });
 
 const args = process.argv.slice(2);
@@ -688,6 +694,47 @@ async function buildAdmin1() {
   };
 }
 
+async function buildPlaces() {
+  const params = PARAMS.places;
+  const source = await fetchPinned('places');
+  const factor = 10 ** params.decimals;
+  const round = (value) => Math.round(value * factor) / factor;
+  const places = JSON.parse(source.bytes.toString('utf8'))
+    .features.map((f) => f.properties)
+    .filter(
+      (p) =>
+        p.name &&
+        Number.isFinite(p.latitude) &&
+        Number.isFinite(p.longitude) &&
+        Number.isFinite(p.scalerank),
+    )
+    .map((p) => [
+      p.name,
+      round(p.latitude),
+      round(p.longitude),
+      p.scalerank,
+      Number.isFinite(p.rank_max) ? p.rank_max : 0,
+    ])
+    .sort((a, b) => a[3] - b[3] || b[4] - a[4] || a[0].localeCompare(b[0]));
+  return {
+    meta: {
+      title: 'Natural Earth populated places',
+      source: 'ne_10m_populated_places_simple',
+      url: SOURCES.places.url,
+      sha256: source.digest,
+      commit: NE_COMMIT,
+      license:
+        'Public domain (https://www.naturalearthdata.com/about/terms-of-use/)',
+      schema:
+        'places[]: [name, latitude, longitude, scalerank (0 most prominent .. 10), rank_max (population class, 0..14; higher is larger)]',
+      decimals: params.decimals,
+      curation: params,
+      script: 'scripts/build-admin-packs.mjs',
+    },
+    places,
+  };
+}
+
 async function buildCounties() {
   const params = PARAMS.counties;
   const source = await fetchPinned('counties');
@@ -768,4 +815,13 @@ if (isMain) {
       'src/data/local_data/us_census_counties/counties.json',
       await buildCounties(),
     );
+  if (!only || only === 'places') {
+    const relative = 'src/data/local_data/natural_earth/populated_places.json';
+    const pack = await buildPlaces();
+    const text = JSON.stringify(pack) + '\n';
+    await writeFile(path.join(ROOT, relative), text);
+    console.log(
+      `${relative}: ${pack.places.length} places, ${Buffer.byteLength(text)} bytes`,
+    );
+  }
 }

scripts/build-owner-flags.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+/**
+ * Build the owner flag sheet the orbital Cockpit marks a satellite's owner
+ * country with (`src/ui/ownerFlag.js`): every flag in OWNER_COUNTRY_CODES
+ * (`src/layers/satellites/classes.js`), drawn from the flag-icons 4:3 SVGs
+ * at twice the readout's 20 × 15 px, in one PNG the app loads at startup.
+ *
+ *   src/data/local_data/owner_flags/owner_flags.png   the sheet
+ *   src/ui/ownerFlagSheet.js                           its layout (generated)
+ *
+ * Flag i (in the sorted code list) sits at column i % COLUMNS, row
+ * floor(i / COLUMNS), each cell followed by a GUTTER of transparent pixels. A rerun with the same flag-icons and sharp versions
+ * reproduces both files.
+ *
+ * Usage: node scripts/build-owner-flags.mjs
+ */
+
+import { readFile, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as prettier from 'prettier';
+import sharp from 'sharp';
+import { OWNER_COUNTRY_CODES } from '../src/layers/satellites/classes.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const FLAGS_DIR = path.join(
+  path.dirname(require.resolve('flag-icons/package.json')),
+  'flags/4x3',
+);
+const FLAG_ICONS_VERSION = require('flag-icons/package.json').version;
+
+/** One flag's cell, CSS pixels × 2. */
+export const CELL = Object.freeze({ width: 40, height: 30 });
+/**
+ * Transparent sheet pixels after each flag, so a browser smoothing a scaled
+ * flag (a 125% display) never reaches into its neighbour.
+ */
+export const GUTTER = 2;
+export const COLUMNS = 16;
+
+const SHEET = path.join(
+  ROOT,
+  'src/data/local_data/owner_flags/owner_flags.png',
+);
+const LAYOUT = path.join(ROOT, 'src/ui/ownerFlagSheet.js');
+
+async function flagCell(code) {
+  const svg = await readFile(path.join(FLAGS_DIR, `${code.toLowerCase()}.svg`));
+  return sharp(svg, { density: 300 })
+    .resize(CELL.width, CELL.height, { fit: 'fill' })
+    .png()
+    .toBuffer();
+}
+
+const codes = [...OWNER_COUNTRY_CODES];
+const rows = Math.ceil(codes.length / COLUMNS);
+const pitchX = CELL.width + GUTTER;
+const pitchY = CELL.height + GUTTER;
+const cells = await Promise.all(codes.map(flagCell));
+const sheet = await sharp({
+  create: {
+    width: COLUMNS * pitchX,
+    height: rows * pitchY,
+    channels: 4,
+    background: { r: 0, g: 0, b: 0, alpha: 0 },
+  },
+})
+  .composite(
+    cells.map((input, i) => ({
+      input,
+      left: (i % COLUMNS) * pitchX,
+      top: Math.floor(i / COLUMNS) * pitchY,
+    })),
+  )
+  .png({ compressionLevel: 9, palette: true, quality: 100, effort: 10 })
+  .toBuffer();
+await writeFile(SHEET, sheet);
+
+const layout = `// Generated by scripts/build-owner-flags.mjs from flag-icons ${FLAG_ICONS_VERSION}; do not edit.
+/** The owner flag sheet's layout: flag i at column i % columns, row i / columns. */
+export const OWNER_FLAG_SHEET = Object.freeze({
+  cellWidthPx: ${CELL.width},
+  cellHeightPx: ${CELL.height},
+  gutterPx: ${GUTTER},
+  columns: ${COLUMNS},
+  rows: ${rows},
+  codes: Object.freeze(${JSON.stringify(codes)}),
+});
+`;
+await writeFile(
+  LAYOUT,
+  await prettier.format(layout, {
+    ...(await prettier.resolveConfig(LAYOUT)),
+    filepath: LAYOUT,
+  }),
+);
+console.log(
+  `Wrote ${codes.length} flags (${COLUMNS} × ${rows}), ${(sheet.length / 1024).toFixed(1)} KB.`,
+);

scripts/build-ucs-satellites.py

@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+'''Maintainer-only UCS Satellite Database pack build (openpyxl).
+
+Reads the UCS Excel release and writes the compact pack the satellites layer
+loads: one row per satellite, keyed by NORAD number, with string-table indexes
+for the repeated text columns. Starlink rows are left out: the layer files
+every STARLINK object under its own class and operator without them.
+
+Usage: python scripts/build-ucs-satellites.py "<path>/UCS-Satellite-Database 5-1-2023.xlsx"
+'''
+import argparse
+import json
+import logging
+from pathlib import Path
+import re
+
+import openpyxl
+
+LOG = logging.getLogger('build-ucs-satellites')
+
+ROOT = Path(__file__).resolve().parent.parent
+PACK = ROOT / 'src/data/local_data/ucs_satellites'
+VERSION = 'UCS-Satellite-Database 5-1-2023'
+DATA_CURRENT_TO = '2023-05-01'
+URL = 'https://www.ucsusa.org/satellite_database'
+
+# Output column -> spreadsheet header.
+COLUMNS = {
+    'operator': 'Operator/Owner',
+    'operatorCountry': 'Country of Operator/Owner',
+    'purpose': 'Purpose',
+}
+STARLINK = re.compile(r'\bstarlink\b', re.I)
+
+
+def clean(value: object) -> str:
+    '''One cell as tidy text; UCS's placeholders for nothing become ''.'''
+    text = re.sub(r'\s+', ' ', str(value or '')).strip()
+    return '' if text.lower() in ('', 'none', 'n/a') else text
+
+
+def build(xlsx: Path) -> dict:
+    '''Read the release's first sheet into the pack the layer loads.'''
+    sheet = openpyxl.load_workbook(xlsx, read_only=True, data_only=True).worksheets[0]
+    rows = sheet.iter_rows(values_only=True)
+    header = {str(h).strip(): i for i, h in enumerate(next(rows)) if h}
+    names = [header['Current Official Name of Satellite'], header['Name of Satellite, Alternate Names']]
+    norad_col = header['NORAD Number']
+    tables = {key: [''] for key in COLUMNS}
+    index = {key: {'': 0} for key in COLUMNS}
+    records = {}
+    source_rows = skipped_starlink = invalid_norad = 0
+    for row in rows:
+        if not any(row):
+            continue
+        source_rows += 1
+        if any(STARLINK.search(clean(row[i])) for i in names):
+            skipped_starlink += 1
+            continue
+        try:
+            norad = int(float(row[norad_col]))
+        except (TypeError, ValueError):
+            invalid_norad += 1
+            continue
+        if norad <= 0:
+            invalid_norad += 1
+            continue
+        record = [norad]
+        for key, column in COLUMNS.items():
+            text = clean(row[header[column]])
+            if text not in index[key]:
+                index[key][text] = len(tables[key])
+                tables[key].append(text)
+            record.append(index[key][text])
+        # A duplicate NORAD number keeps the first row, as UCS lists it.
+        records.setdefault(norad, record)
+    ordered = [records[n] for n in sorted(records)]
+    return {
+        'meta': {
+            'source': 'Union of Concerned Scientists Satellite Database',
+            'version': VERSION,
+            'url': URL,
+            'dataCurrentTo': DATA_CURRENT_TO,
+            'license': 'Free, unrestricted use; acknowledgement requested (UCS database manual, section 3)',
+            'curation': {
+                'sourceRows': source_rows,
+                'starlinkRowsDropped': skipped_starlink,
+                'invalidNoradDropped': invalid_norad,
+                'duplicateNoradDropped': source_rows - skipped_starlink - invalid_norad - len(ordered),
+                'columns': COLUMNS,
+            },
+            'recordCount': len(ordered),
+        },
+        'fields': ['noradId', *COLUMNS],
+        'strings': tables,
+        'records': ordered,
+    }
+
+
+def main() -> None:
+    '''Build the pack from the release given on the command line.'''
+    logging.basicConfig(level=logging.INFO, format='%(message)s')
+    parser = argparse.ArgumentParser(description='Build the UCS satellite pack from the UCS Excel release.')
+    parser.add_argument('xlsx', type=Path, help='UCS-Satellite-Database <version>.xlsx')
+    pack = build(parser.parse_args().xlsx)
+    PACK.mkdir(parents=True, exist_ok=True)
+    out = PACK / 'ucs_satellites.json'
+    # LF on every platform: the repository stores text with LF endings.
+    out.write_text(
+        json.dumps(pack, ensure_ascii=False, separators=(',', ':')) + '\n',
+        encoding='utf-8',
+        newline='\n',
+    )
+    LOG.info('%s: %d records, %d bytes', out.relative_to(ROOT), pack['meta']['recordCount'], out.stat().st_size)
+
+
+if __name__ == '__main__':
+    main()

scripts/dev-fresh.sh

@@ -44,7 +44,7 @@ CCTV_NSW_ENABLED="${CCTV_NSW_ENABLED:-1}"
 CCTV_NSW_MAX_SOURCES="${CCTV_NSW_MAX_SOURCES:-250}"
 CCTV_CALGARY_ENABLED="${CCTV_CALGARY_ENABLED:-1}"
 CCTV_CALGARY_MAX_SOURCES="${CCTV_CALGARY_MAX_SOURCES:-220}"
-CCTV_MAX_SOURCES="${CCTV_MAX_SOURCES:-4000}"
+CCTV_MAX_SOURCES="${CCTV_MAX_SOURCES:-7350}"
 
 # Capture which provider credentials genuinely came from the parent shell
 # before this launcher resolves dotenv and Keychain fallbacks. Only names are

scripts/engine-coupling-baseline.json

@@ -3,14 +3,14 @@
     "cesiumLayerRendererLines": 0,
     "navaraLayerRendererLines": 0,
     "cesiumImportFiles": 3,
-    "viewerLines": 750,
+    "viewerLines": 784,
     "navaraKindChecks": 1,
     "engineSniffCalls": 0,
     "engineExtensionReads": 3,
     "groundEffectPasses": 0,
     "cesiumSdkLoads": 3,
     "screenSpaceHandlerFiles": 2,
-    "engineNameLines": 27
+    "engineNameLines": 21
   },
-  "measuredAt": "One selection path and test level"
+  "measuredAt": "Orbital cockpit and bridge mesh sampling"
 }

scripts/format-scope.json

@@ -115,6 +115,8 @@
   "src/data/terrainHeightsProxy.test.mjs",
   "src/data/tomtomTiles.js",
   "src/data/tomtomTiles.test.mjs",
+  "src/data/tileBudget.js",
+  "src/data/tileBudget.test.mjs",
   "src/data/firmsCsv.js",
   "src/data/firmsCsv.test.mjs",
   "src/tooling/environmentProviders.test.mjs",
@@ -331,6 +333,12 @@
   "src/ui/styles/responsive.css",
   "src/ui/styles/voice-cost.css",
   "src/ui/styles/cockpit.css",
+  "src/ui/styles/cockpitBridge.css",
+  "src/ui/styles/cockpitRadar.css",
+  "src/ui/styles/cockpitOrbital.css",
+  "src/layers/satellites/sensors.js",
+  "src/layers/satellites/sensors.test.mjs",
+  "src/data/imagingSensors.js",
   "src/ui/styles/command-dock-compact.css",
   "src/app/stateChannel.js",
   "src/app/stateChannel.test.mjs",
@@ -582,6 +590,7 @@
   "src/data/cctvHk.test.mjs",
   "src/data/cctvVegvesen.test.mjs",
   "src/data/cctvA22.test.mjs",
+  "src/data/cctvIceland.test.mjs",
   "src/data/cctvNyc.test.mjs",
   "src/data/cctvHouston.test.mjs",
   "src/data/cctvNswSource.test.mjs",
@@ -1053,6 +1062,7 @@
   "scripts/qa-traffic-motion.mjs",
   "src/layers/traffic/motion.test.mjs",
   "src/layers/traffic/handoff.test.mjs",
+  "src/layers/traffic/lineRebuild.test.mjs",
   "scripts/qa-journey-recorder.mjs",
   "scripts/qa-alpr-journey.mjs",
   "scripts/qa-context-arrivals.mjs",
@@ -1104,6 +1114,7 @@
   "src/globe/cesium/starrySky.test.mjs",
   "src/tooling/skyAssets.test.mjs",
   "src/tooling/skyAssets.paintOut.test.mjs",
+  "src/tooling/responseCompression.test.mjs",
   "scripts/qa-anime-sky.mjs",
   "scripts/qa-sky-model-lighting.mjs",
   "server/providers/overpass/requestAdmission.test.mjs",
@@ -1697,5 +1708,10 @@
   "src/ui/releaseTrackers.js",
   "src/testSupport/domClasses.mjs",
   "src/layers/shared/imageryHost.js",
-  "src/layers/shared/imageryHost.test.mjs"
+  "src/layers/shared/imageryHost.test.mjs",
+  "scripts/build-owner-flags.mjs",
+  "src/ui/ownerFlagSheet.js",
+  "src/data/placePacksLoading.test.mjs",
+  "src/ui/placePacksLoading.js",
+  "src/ui/placePacksLoading.test.mjs"
 ]

scripts/main-chunk-baseline.json

@@ -1,6 +1,6 @@
 {
-  "gzipBytes": 2066560,
-  "allowanceBytes": 20666,
+  "gzipBytes": 2176199,
+  "allowanceBytes": 21762,
   "measuredAt": "Keyless production build with dynamically loaded layer displays",
   "allowance": "1% of the baseline; growth past it fails npm run check:main-chunk until the baseline is raised on purpose"
 }

scripts/qa-aircraft-heading.mjs

@@ -101,6 +101,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
 import { installNavaraHeadingProbe } from './qa-heading-navara.mjs';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 // ---------------------------------------------------------------------------
 // Args (same shape as track-regression.mjs)
@@ -474,6 +475,7 @@ async function main() {
   const failedResponses = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1280, height: 800 });
     page.on('console', (msg) => {
       if (msg.type() === 'error') {

scripts/qa-aircraft-sprites.mjs

@@ -32,6 +32,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import { classifyAircraft, CLASS_SCALE_2D, CLASS_SCALE_3D, CLASS_MODEL_REAL } from '../src/data/aircraftClass.js';
 // Hangar fleet (2026-08-16): real per-class GLBs render at scale 1; military
 // heavies (airliner/quadjet/glider) render airplane.glb at 1 x class; only
@@ -192,6 +193,7 @@ async function main() {
   const httpErrors = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1280, height: 800 });
     page.on('console', (msg) => {
       if (msg.type() === 'error') {

scripts/qa-cockpit-utility.mjs

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import puppeteer from 'puppeteer';
 import { blockPaidQaMaps } from './qa-map-policy.mjs';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const shotsDir = path.join(repoRoot, 'qa-shots', 'cockpit-utility');
@@ -31,6 +32,7 @@ const browser = await puppeteer.launch({
 });
 const page = await browser.newPage();
 await blockPaidQaMaps(page);
+await stubPlanespotters(page);
 const failures = [];
 const consoleErrors = [];
 const localHttpErrors = [];
@@ -827,6 +829,7 @@ try {
   // a legitimate retained snapshot cannot satisfy or invalidate a FIRST-fetch
   // assertion when camera motion supersedes the manager's initial update.
   const readinessPage = await browser.newPage();
+  await stubPlanespotters(readinessPage);
   let deferredInstallationReadiness;
   try {
     await blockPaidQaMaps(readinessPage);

scripts/qa-context-arrivals.mjs

@@ -28,6 +28,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import { createScreencast, moveCamera } from './qa-journey-recorder.mjs';
 
 const argv = process.argv.slice(2);
@@ -77,6 +78,7 @@ const browser = await puppeteer.launch({
 
 async function openPage({ aircraft = false } = {}) {
   const page = await browser.newPage();
+  await stubPlanespotters(page);
   await page.setViewport({ width: 1440, height: 900 });
   page.on('console', (message) => {
     if (message.type() === 'error') result.consoleErrors.push(message.text());

scripts/qa-emergency-squawk.mjs

@@ -27,6 +27,7 @@
  */
 
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -223,6 +224,7 @@ async function main() {
   const errors = [];
   try {
     const page = await browser.newPage();
+    await stubPlanespotters(page);
     await page.setViewport({ width: 1440, height: 900 });
     page.on('pageerror', (e) => errors.push(e.message));
     const { lon, lat } = CENTER;

scripts/qa-focus-evidence.mjs

@@ -22,6 +22,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import puppeteer from 'puppeteer';
+import { stubPlanespotters } from './qa-photo-stub.mjs';
 
 const argv = process.argv.slice(2);
 const getOpt = (name, fallback = null) => {
@@ -684,6 +685,7 @@ async function main() {
     ],
   });
   const page = await browser.newPage();
+  await stubPlanespotters(page);
   await page.setViewport(VIEWPORT);
   const consoleMessages = [];
   page.on('console', (message) => {

scripts/qa-l9-matrix.mjs

@@ -239,11 +239,11 @@ function satisfiesEngines(version, range) {
  * re-resolve the interpreter from PATH and hand the gate a different Node than
  * the one the check believes it selected.
  * @param {string} version e.g. "v24.19.0"
- * @returns {boolean} true only for a parseable Node 24.
+ * @returns {boolean} true for a parseable supported Node 24 or 26.
  */
 function isCalibratedAllocationRuntime(version) {
   const [maj] = String(version || '').trim().replace(/^v/, '').split('.').map((n) => Number.parseInt(n, 10));
-  return maj === 24;
+  return maj === 24 || maj === 26;
 }
 
 /**
@@ -546,7 +546,7 @@ const check = (spec) => { CHECKS.push(spec); };
 
 // ─── A · REPO GATES ───────────────────────────────────────────────────────
 check({
-  id: 'A1', group: 'A', desc: 'Node runtime satisfies package.json engines (allocation budgets are pinned to Node 24)',
+  id: 'A1', group: 'A', desc: 'Node runtime satisfies package.json engines (allocation budgets cover supported Node majors)',
   run: async () => {
     const pkg = JSON.parse(readFileSync(resolve(REPO_ROOT, 'package.json'), 'utf8'));
     const range = pkg.engines?.node || '(unset)';
@@ -557,7 +557,7 @@ check({
     if (satisfied) return pass(`node ${process.versions.node} satisfies "${range}"`);
     // An off-range runtime is an environment problem, not a product defect —
     // but it silently disables the allocation gate, so say so loudly. A3 then
-    // runs that gate under a discovered Node 24.
+    // runs that gate under a discovered calibrated Node 24 fallback.
     return env.node24
       ? skip(`node ${process.versions.node} is OUTSIDE "${range}"; A3 runs the allocation gate under ${env.node24.label}, but prefer running the whole L9 pass on Node 24`, 'ENV')
       : fail(`node ${process.versions.node} is OUTSIDE "${range}" and no Node 24 runtime was found — the allocation gate cannot run at all`);
@@ -579,13 +579,13 @@ check({
 });
 
 check({
-  id: 'A3', group: 'A', desc: 'Allocation microbenchmarks actually EXECUTE (they silently skip off Node 24)',
+  id: 'A3', group: 'A', desc: 'Allocation microbenchmarks actually EXECUTE on supported Node majors',
   run: async () => {
     // npm test prints "[unit] SKIPPED n allocation microbenchmarks" and still
-    // exits 0 when the runtime is not Node 24. A green suite is therefore NOT
-    // proof the gate ran. Force it, under Node 24 when one is discoverable.
+    // exits 0 when the runtime is outside the calibrated supported majors. A green
+    // suite is therefore NOT proof the gate ran. Force it under a calibrated runtime.
     //
-    // ALWAYS invoke the Node 24 BINARY directly — never `npm test`. npm
+    // ALWAYS invoke the calibrated Node binary directly — never `npm test`. npm
     // re-resolves the interpreter from PATH and can land back on the system
     // Node even when THIS process is already 24: running the whole matrix under
     // `mise exec [email protected] --`, the npm shell-out still re-execed system
@@ -597,10 +597,10 @@ check({
       const v = await sh(bin, ['--version'], { timeoutMs: 60000 });
       const version = (v.out || '').trim();
       if (!isCalibratedAllocationRuntime(version)) {
-        // run-unit-tests.mjs refuses to measure calibrated budgets off Node 24,
+        // run-unit-tests.mjs refuses to measure calibrated budgets off supported Node majors,
         // so a wrong binary means the gate never ran. That is this check failing
         // to establish its own claim — not evidence about the product.
-        return crash(`the runtime selected for the allocation gate (${label}) reports ${version || 'no parseable version'}, not Node 24 — the gate would refuse or silently skip, so this check verified nothing`);
+        return crash(`the runtime selected for the allocation gate (${label}) reports ${version || 'no parseable version'}, not Node 24 or 26 — the gate would refuse or silently skip, so this check verified nothing`);
       }
       const r = await sh(bin, [resolve(REPO_ROOT, 'scripts/run-unit-tests.mjs')], {
         timeoutMs: 600000, env: { GEV_REQUIRE_ALLOCATION_GATE: '1' },
@@ -611,9 +611,9 @@ check({
     };
 
     const [maj] = process.versions.node.split('.').map(Number);
-    if (maj === 24) return runGate(process.execPath, 'this runtime');
+    if (maj === 24 || maj === 26) return runGate(process.execPath, 'this runtime');
     if (env.node24) return runGate(env.node24.bin, env.node24.label);
-    return skip(`no Node 24 runtime found (running ${process.versions.node}); the gate SKIPS silently — install Node 24 and re-run`, 'OWNER-RUN');
+    return skip(`no calibrated Node 24/26 runtime found (running ${process.versions.node}); the gate SKIPS silently — install a supported Node runtime and re-run`, 'OWNER-RUN');
   },
 });
 

scripts/qa-photo-stub.mjs

@@ -0,0 +1,78 @@
+/**
+ * Keep browser QA off third-party aircraft photo services.
+ *
+ * Tracking a civil flight asks Planespotters for the aircraft's photo. QA
+ * runs track synthetic hexes, so a real request only adds a third-party
+ * dependency and, when the service refuses a headless browser, a console
+ * error that fails the "no console errors" checks. Every photo lookup is
+ * answered with no photos instead, without leaving the browser.
+ */
+
+/** Origin of the aircraft photo lookup. */
+export const PLANESPOTTERS_ORIGIN = 'https://api.planespotters.net';
+
+/** The answer every stubbed lookup gets: no photos for this aircraft. */
+export const PLANESPOTTERS_EMPTY_BODY = JSON.stringify({ photos: [] });
+
+/** Whether a URL is a photo lookup the stub answers. */
+export function isPlanespottersRequest(url) {
+  try {
+    return new URL(String(url)).origin === PLANESPOTTERS_ORIGIN;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Answer an intercepted photo lookup from a page that already uses request
+ * interception. Returns false for any other request, which the caller
+ * handles as before.
+ * @param {import('puppeteer').HTTPRequest} request
+ * @returns {boolean} Whether the request was answered.
+ */
+export function respondToPlanespotters(request) {
+  if (!isPlanespottersRequest(request.url())) return false;
+  request.respond({
+    status: 200,
+    contentType: 'application/json',
+    headers: { 'Access-Control-Allow-Origin': '*' },
+    body: PLANESPOTTERS_EMPTY_BODY,
+  });
+  return true;
+}
+
+/**
+ * Stub photo lookups in a page that does not intercept requests: wraps
+ * `fetch` before any app code runs, so a lookup never reaches the network.
+ * Composes with other `fetch` shims in either order.
+ * @param {import('puppeteer').Page} page
+ * @returns {Promise<void>}
+ */
+export async function stubPlanespotters(page) {
+  await page.evaluateOnNewDocument(
+    (origin, body) => {
+      const original = window.fetch.bind(window);
+      window.fetch = (input, init) => {
+        const href =
+          typeof input === 'string' ? input : input?.url || String(input);
+        let target = '';
+        try {
+          target = new URL(href, location.href).origin;
+        } catch {
+          /* not a URL */
+        }
+        if (target === origin) {
+          return Promise.resolve(
+            new Response(body, {
+              status: 200,
+              headers: { 'Content-Type': 'application/json' },
+            }),
+          );
+        }
+        return original(input, init);
+      };
+    },
+    PLANESPOTTERS_ORIGIN,
+    PLANESPOTTERS_EMPTY_BODY,
+  );
+}

scripts/run-unit-tests.mjs

@@ -8,15 +8,16 @@ export const ALLOCATION_TEST_FILES = Object.freeze([
   'src/overlays/worldOverlayAllocation.test.mjs',
 ]);
 
-/** Whether this runtime matches the one the allocation budgets were calibrated on. */
+/** Whether this runtime matches a supported major the allocation budgets are calibrated on. */
 export function isCalibratedAllocationRuntime(version = process.versions.node) {
-  return Number.parseInt(String(version).split('.')[0], 10) === 24;
+  const major = Number.parseInt(String(version).split('.')[0], 10);
+  return major === 24 || major === 26;
 }
 
-/** Require the runtime on which allocation budgets were calibrated. */
-export function assertNode24AllocationRuntime(version = process.versions.node) {
+/** Require a runtime on which allocation budgets are calibrated. */
+export function assertCalibratedAllocationRuntime(version = process.versions.node) {
   if (!isCalibratedAllocationRuntime(version)) {
-    throw new Error(`Allocation budgets require the calibrated Node 24 runtime; received ${version}`);
+    throw new Error(`Allocation budgets require calibrated Node 24 or 26; received ${version}`);
   }
   return version;
 }
@@ -95,19 +96,18 @@ export function runUnitTests() {
   const parallelStatus = runTests(['--test', ...plan.parallel]);
   if (parallelStatus !== 0) return parallelStatus;
 
-  // The GC-bracketed budgets are calibrated on Node 24 and are meaningless on
-  // other allocators. A contributor's suite must stay green on any supported
-  // engine (package.json permits >=24), so uncalibrated runtimes skip the
+  // The GC-bracketed budgets are calibrated on every supported Node major.
+  // Unsupported runtimes may still run ordinary tests, so uncalibrated runtimes skip the
   // probes with a warning. Set GEV_REQUIRE_ALLOCATION_GATE=1 (pinned CI /
   // release batteries) to make an uncalibrated runtime a hard failure.
   if (!isCalibratedAllocationRuntime()) {
     if (process.env.GEV_REQUIRE_ALLOCATION_GATE === '1') {
-      assertNode24AllocationRuntime();
+      assertCalibratedAllocationRuntime();
     }
     console.warn(
       `[unit] SKIPPED ${ALLOCATION_TEST_FILES.length} allocation microbenchmarks: `
-      + `budgets are calibrated for Node 24, running ${process.versions.node}. `
-      + 'Run under Node 24 (or set GEV_REQUIRE_ALLOCATION_GATE=1 to fail instead).',
+      + `budgets are calibrated for Node 24 and 26, running ${process.versions.node}. `
+      + 'Run under Node 24 or 26 (or set GEV_REQUIRE_ALLOCATION_GATE=1 to fail instead).',
     );
     return 0;
   }

scripts/track-regression.mjs

@@ -94,6 +94,7 @@
 
 import fs from 'node:fs';
 import puppeteer from 'puppeteer';
+import { respondToPlanespotters } from './qa-photo-stub.mjs';
 import { arrivalAngleViolated, arrivalRotationPassed } from '../src/tooling/trackArrivalObservation.mjs';
 import { classifyAircraft, CLASS_SCALE_3D, CLASS_MODEL_REAL } from '../src/data/aircraftClass.js';
 import { ensureGeoidReady, geoidHeight } from '../src/data/geoid.js';
@@ -287,6 +288,8 @@ async function main() {
         });
         return;
       }
+      // Aircraft photo lookups never reach the third party: no photos.
+      if (respondToPlanespotters(request)) return;
       if (url.origin === APP_ORIGIN && url.pathname === '/api/openai/hud-summary') {
         request.respond({
           status: 200,
@@ -409,6 +412,15 @@ async function main() {
             status: 'ready',
           }));
         }
+        // CelesTrak SATCAT, which the satellite classes read beside the TLEs.
+        // An empty CSV (header only) keeps the run hermetic: the classes fall
+        // back to names and groups, as they do when SATCAT is unavailable.
+        if (isAppRequest && url.pathname.startsWith('/api/celestrak-satcat/')) {
+          return Promise.resolve(new Response(
+            'OBJECT_NAME,OBJECT_ID,NORAD_CAT_ID,OBJECT_TYPE,OPS_STATUS_CODE,LAUNCH_DATE\n',
+            { status: 200, headers: { 'Content-Type': 'text/csv' } },
+          ));
+        }
         // CelesTrak TLE groups. Served from a fixed two-satellite catalog so
         // the satellite assertions are deterministic and the run never depends
         // on an upstream that rate-limits (it was answering 403 the night this