Merge branch 'main' into codex/overpass-admission-review-fixes

2026-11-04 02:14:01 +00:00 · 2026-11-03 15:07:08 +00:00
commit 34906c9abb
@@ -256,6 +256,8 @@ AISSTREAM_API_KEY=
 # CCTV_TAIWAN_ENABLED=1                                # set 0 to skip Taiwan Freeway Bureau (MOTC) road cameras
 # CCTV_TAIWAN_MAX_SOURCES=600                          # cap Taiwan freeway cameras (1-2000); no API key required
 # CCTV_TAIWAN_URL=                                     # override the Freeway Bureau MOTC 2.0 CCTV.xml URL
 # CCTV_A22_ENABLED=1                                   # set 0 to disable the Autostrada del Brennero (A22, Italy) webcams
 # CCTV_A22_URL=                                        # override the Open Data Hub A22 webcam catalog URL
 # CCTV_MAX_SOURCES=4000                                # catalog-wide ceiling, shared round-robin across packs
 # CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
 # CCTV_FORCE_AUSTIN=                                   # force live default sources when a source-pack JSON is configured
@@ -263,6 +265,32 @@ AISSTREAM_API_KEY=
 # Optional: comma-separated Overpass URLs; use only instances you run or pay for.
 OVERPASS_UPSTREAMS=
 # Optional: place-lookup endpoints. Lookups try bundled data first, then the
 # endpoint set here. Nominatim stays off unless NOMINATIM_URL is set; Photon
 # uses its public service when PHOTON_URL is unset.
 # NOMINATIM_URL: search endpoint for last-resort place search and voice
 # outlines (e.g. https://nominatim.example.org/search). A configured URL
 # selects the endpoint explicitly. Unset, empty and invalid values disable
 # Nominatim; nothing falls back to nominatim.openstreetmap.org. Use an endpoint
 # you operate or are authorized to use. Answers are cached (outlines 90 days,
 # places 30 days, no-results 24 h in .gev-cache/nominatim).
 # Explicit public-service configuration retains per-install pacing and caps;
 # these do not establish an application-wide allowance or authorize public use.
 # NOMINATIM_URL=
 # Public-instance requests per UTC day, outlines and search together. Not
 # applied to your own NOMINATIM_URL.
 # NOMINATIM_DAILY_CAP=50
 # Public-instance pacing is shared through .gev-cache/nominatim/state.json. If
 # the server stopped mid-request (or its disk filled), it leaves a
 # state.json.dispatch.* marker and refuses public lookups ("unfinished durable
 # Nominatim dispatch") for ten minutes rather than risk breaking the spacing;
 # the next lookup after that removes the marker and resumes with fresh spacing.
 # PHOTON_URL: keyless place search endpoint used by the browser
 # (e.g. https://photon.example.org/api/). Unset uses photon.komoot.io; set it
 # empty to disable. Only https endpoints are accepted (the page's
 # Content-Security-Policy allows no plain-http origin); any other value disables it.
 # PHOTON_URL=
 # Optional: who may frame the app in embed mode (?embed=1), as CSP
 # frame-ancestors sources such as "https://example.com", or * for any page.
 # Unset, no page may frame it. Other pages of the app can never be framed.
@@ -40,7 +40,7 @@ body:
    attributes:
      label: OS, Node version, browser
      description: Include the versions you can find. Write "unknown" for anything unavailable.
-      placeholder: "Windows 11, Node 24.14.0, Chrome 151"
+      placeholder: "Windows 11, Node 24.22.2, Chrome 151"
    validations:
      required: true
  - type: input
@@ -34,7 +34,8 @@ If it's bigger, link to it instead.
 <!--
 Which layer-panel group should it sit in? The current groups are in PANEL_GROUPS
-in src/ui/layerPanel.js: Movement, Cameras, Infrastructure, Events, Weather, Utilities.
+in src/ui/layerPanel.js: Movement, Cameras, Infrastructure, Events, Weather, Audio,
 and Utilities (its rows render in the separate UTILITIES panel).
 If none fits, propose a new group and say why.
 -->
@@ -20,10 +20,10 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        node: [24.14.0, 26.x]
+        node: [24.22.2, 26.x]
    env:
      PUPPETEER_SKIP_DOWNLOAD: '1'
-      GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.14.0' && '1' || '0' }}
+      GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.22.2' && '1' || '0' }}
    steps:
      - name: Check out source
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
@@ -76,7 +76,7 @@ jobs:
      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
-          node-version: 24.14.0
+          node-version: 24.22.2
          cache: npm
      - name: Install locked dependencies and headless Chrome
@@ -131,7 +131,7 @@ jobs:
      - name: Use Node.js
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
-          node-version: 24.14.0
+          node-version: 24.22.2
          cache: npm
      - name: Run the Pinokio install path
@@ -20,3 +20,8 @@ node_modules
 .vite
 .vite-*
 *.min.js
 # Application views, and panels lifted from them, hold the page markup
 # verbatim; reflowing it changes the DOM
 src/ui/views/*View.vue
 src/ui/views/panels/
@@ -2,5 +2,11 @@
  "singleQuote": true,
  "tabWidth": 2,
  "semi": true,
-  "endOfLine": "lf"
+  "endOfLine": "lf",
  "overrides": [
    {
      "files": "*.vue",
      "options": { "htmlWhitespaceSensitivity": "strict" }
    }
  ]
 }
@@ -1,5 +1,692 @@
 # Changelog
 ## [Unreleased]
 ## [0.3.0] — 2026-10-27 — Street Level, On Your Phone, in Your Language
 - Show a Street Level view facing 359.5° or more as 0°. The viewer caption
  rounded the bearing without wrapping, so a view facing 359.6° read "360°"
  (Aditya, @Rohilalala, #1431).
 - The visual styles and their presets mark their labels with the catalog-free
  `msg()`, so the share-link codec, and any server that loads it, no longer
  bundles every translation catalog (about 0.9 MB) (samehkhamis, #1421).
 - Keep a location search that found nothing, or failed, in the field so it can
  be corrected: the query stays, focused and selected, and a persistent
  announced message under the search row says what to do next, instead of a
  toast followed by a cleared and closed field (samehkhamis, #1420).
 - Hosts can read share links on their server: the share-link codec and the
  `/share/<code>` address helpers are now package exports,
  `@gods-eye-view/core/share/view-codec` and `@gods-eye-view/core/share/link-path`
  (samehkhamis, #1419).
 - Share links are now short: the share button makes `/share/<code>` links
  that open on any copy of the app, follow the aircraft, military aircraft or
  satellite you were following, and fall back to its last-known position with
  a notice if it isn't reporting. A mistyped link is refused instead of
  opening a different view. Long `#v=2` links keep working (samehkhamis, #1418).
 - Make Clear All clear the saved and shared layer selection. Layers that a
  context mode had already switched off no longer stay in the share link and
  come back on reload (samehkhamis, #1417).
 - Restore a share link opened in an already-open tab. Pasting a link into the
  address bar, following one, or using Back/Forward now moves the camera and
  restores the style, map, panels and layers instead of changing only the URL
  (samehkhamis, #1416).
 - Add a Scope checkbox and extend feathering to 200%, retaining scope settings
  across HUD layouts, share links and scenes. First run opens with Scope ON at
  100% feather; explicit settings and historical links retain their values. Give
  Tactical, Operator and Minimal text black backplates only when Scope is OFF,
  including vertical metadata, without changing the original HUD text color, glow or
  opacity. Scope ON retains its original HUD presentation (bilawalsidhu, #1410).
  Keep title and tagline positions stable when toggling Scope, include the eye
  in the title backing, and brighten the two secondary labels only with Scope OFF.
 - Remove four modules nothing in the app imports: `src/app/sourceSlot.js`,
  `src/data/flowTiles.js`, `src/data/issPass.js` and `src/data/localGeojson.js`.
  The local GeoJSON layer tests now build layers the way the catalog does, so
  they keep covering `localGeojsonCore.js`. Package exports are unchanged
  (samehkhamis, #1403).
 - Aircraft on the ground keep getting ground-height samples after the
  computer's clock steps back, instead of waiting for it to catch up
  (quanticsoul4772, #1399).
 - The Sharpen slider at 0 now turns the sharpen pass off instead of still
  sharpening at a low amount (quanticsoul4772, #1398).
 - Show a locally heard aircraft tracking 359.5° or more as TRK 0°. The Local
  ADS-B card rounded the track without wrapping, so 359.7° read "TRK 360°"
  (Rudy Celekli, @rudycelekli, #1396).
 - Report a fire detection's acquisition time as a UTC timestamp in
  `get_active_fires`. The tool joined FIRMS's unpadded date and time, so a
  00:45 UTC detection read "2026-01-01 45"; it now reads
  `2026-01-01T00:45:00.000Z`. Missing or invalid dates and times remain
  unknown rather than rolling into another calendar day
  (Rudy Celekli, @rudycelekli, #1395).
 - Report Docker container health with a local HTTP check using Node, with the
  same port parsing as the launcher (John Rogers, @14traits, #1394).
 - Start the Docker install on SELinux hosts such as Fedora and RHEL. Compose now
  mounts the checkout with `:z`; without it the container could not read `/app`
  and stopped with "Cannot find module '/app/scripts/docker-start.mjs'"
  (Anıl Güvenç, @anilguvenc, #1391).
 - Render awareness-overlay bearings and courses that round through north as
  `000°`, rather than `360°` (Rudy Celekli, #1390).
 - Show cockpit wind from 359.5° or more as 0°, not 360°. Rounding 359.6°
  printed "N · 360°" on the local wind direction
  (Rudy Celekli, @rudycelekli, #1389).
 - Show a drawn line of 999.5 m or more as 1.0 km. The draw hint kept metres
  below 1000, then rounded 999.6 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1388).
 - Show a Contacts entry 999.5 m or more away as 1.0 km. The panel kept meters
  below 1000, then rounded 999.6 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1387).
 - Show a route leg of 995 m or more as 1.0 km. The route summary and step
  cards kept meters below 1000, then rounded 996 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1386).
 - Show a route leg of 59.5 seconds or more as 1 min. The route summary and step
  cards kept seconds below 60, then rounded 59.6 s up to "60 s"
  (Rudy Celekli, @rudycelekli, #1385).
 - The HUD's AI place summary drops a reply that arrives after the camera has
  started moving, so a summary asked for before a flight no longer names the
  old place mid-flight. Cancelled or partially typed summaries retry even if the place
  context stays the same (quanticsoul4772, #1384).
 - Reduce repeated work in aircraft detection candidates by caching unchanged
  callsign/registration text and reusing resolved fleet models. Metadata updates,
  live positions and tracked-aircraft/model handoffs remain immediate
  (samehkhamis, #1379).
 - Increase touch-first globe zoom sensitivity to three times the default while
  retaining Cesium collision and distance limits.
 - Reuse one delayed display timestamp per civil-aircraft fleet update and cache
  extrapolation coordinate frames until their fix coordinates change. Preserve
  contact counts, movement cadence, tracked motion and ground corrections.
 - Turning a layer off frees the memory its entities held. Cesium kept
  removed layers' draw commands in reused per-pass arrays, so Data Centers
  kept 116 MiB after it was switched off, submarine cables 74 MiB and dams
  30 MiB; they now keep 13, 9 and 9 MiB (quanticsoul4772, #1367).
 - Aircraft 3D models (Flights, Military Flights, Local ADS-B) skip Cesium's
  dynamic environment map, a sky render and GPU readback per model. With
  ~150 models in the scene at Atlanta on Google 3D, GPU time per frame at
  rest falls from 14.3-14.8 ms to 12.1-12.5 ms; a same-model comparison
  showed no visible change (quanticsoul4772, #1366).
 - Drop the decimal when fire radiative power rounds to 10 MW. A 9.96 MW
  detection was labeled 10.0 MW because the one-decimal cutoff ran before
  rounding (Rudy Celekli, @rudycelekli, #1354).
 - Count a transit report that is 90 seconds old as one minute. The card kept
  seconds through 89s, then rounded 90s up to "Reported 2 min ago"
  (Rudy Celekli, @rudycelekli, #1353).
 - Read a destination heading that rounds to north as 000. 359.6° was shown as
  360° on the destination bearing while the compass tape already uses 000
  (Rudy Celekli, @rudycelekli, #1352).
 - Keep a tracked vessel's speed, course, heading and fix time when AISStream
  static data arrives; the static message only merges name, type, destination
  and IMO (rudycelekli, #1351).
 - Apply changed static metadata immediately, retaining known fields when a
  later static report omits them, without refreshing the vessel's position
  (samehkhamis, #1351).
 - Convert NHC cyclone movement speed from miles per hour to knots, so
  `movement.speedKt` in cyclone query results is no longer about 15% high
  (rudycelekli, #1350).
 - Label NHC cyclone classifications by their published meanings: `PTC` is a
  post-tropical cyclone, `PC` a potential tropical cyclone, and subtropical
  systems arrive as `STS` and `STD` (rudycelekli, #1349).
 - Wake staged weather imagery on a 150 ms timer while waiting for readiness,
  avoiding a continuous render loop and cancelling the wake when work ends
  (@nu-stats, #1345).
 - Phrase slight and sharp ramps as directions, so a ramp reads "slightly left"
  instead of "on the slightly left", and a lane names its side in both
  the proxy response and localized browser instructions
  (Rudy Celekli, @rudycelekli, #1343).
 - Keep an impossible wildfire acquisition date off the detection clock, so a
  fire is not labeled with a later day it did not happen
  (Rudy Celekli, @rudycelekli, #1342).
 - Reject impossible KartaView photo timestamps, so 31 February is unknown
  instead of rolling forward into March and passing the imagery date filter
  (Rudy Celekli, @rudycelekli, #1341).
 - Read a hemisphere letter that is separated from its number, so a search for
  `40.7128 N 74.0060 W` flies there instead of falling through to the geocoders
  (Rudy Celekli, @rudycelekli, #1340).
 - Carry HUD LAT/LON seconds that round up to 60.00" into the minutes and
  degrees, so longitude -122.35 reads `122°21'00.00"W` instead of
  `122°20'60.00"W` (rudycelekli, #1339).
 - Improve touch selection of aircraft and vessels through the shared contact
  picker, reveal tracked aircraft details when opening Context, support downward
  swipe dismissal of phone drawers while preserving scrolling and controls, and
  enlarge the phone logo (samehkhamis, #1338).
 - Evict terrain-height cache entries in fetch-time order without repeatedly
  sorting the full cache, while keeping refreshed points newest and ordering
  restored entries by their fetch time (daikaginza, #1326).
 - Add a phone layout for viewports 720px and narrower: the globe stays full
  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
  panel sheet at a time, keeping attribution visible and scene STOP reachable.
  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).
 - Export the KartaView and Panoramax Street Level providers, so a host composing
  its own provider list can offer the keyless providers without Mapillary
  (samehkhamis, #1324).
 - A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
  token itself (such as a same-origin proxy). Its sequence lookups go there
  through the source's transport, and the photo viewer uses MapillaryJS's
  Graph provider at that endpoint, so no client token is needed in the page
  (samehkhamis, #1324).
 - Remove dead code across the repository: three modules nothing imports
  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
  and locals nothing reads, a duplicate copy of the bundled dams data and an
  unused ship model. The app no longer builds an unused default wind layer
  and Bhote Koshi locator layer when it loads. Package exports are unchanged
  (samehkhamis, #1321).
 - Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).
 - Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
  while Radio and Cyber supply explicit field palettes without changing the
  current appearance or native control behavior (mazy1998, #1309).
 - Share read-only status badge presentation across CCTV source/frame labels,
  calibration provenance and Weather coverage, preserving status meanings,
  palettes, translations and announcements while preparing the view contract
  for a future Vue migration (mazy1998, #1306).
 - Share native dropdown and numeric-field styling across Scene, CCTV, Display
  and Radio controls, with a shared CCTV number-input builder that preserves
  existing precision, validation and commit behavior (mazy1998, #1305).
 - Point distances wrap longitude differences across the antimeridian, in voice
  proximity checks and `places_nearby` (quanticsoul4772, #1304).
 - `get_wind` flags stale forecasts (`stale`) when the wind proxy serves a
  cached model run (quanticsoul4772, #1303).
 - Give ordinary Scene and CCTV actions shared native buttons with consistent
  default, destructive and compact styling while preserving their existing
  behavior and specialized controls (mazy1998, #1302).
 - Unify segmented selectors for model coverage, detection allocation, drawing
  shape, Street View and imagery comparison while preserving their existing
  behavior. Keep compact labels such as FILL and FLAT on one line, and let
  collapsed Weather release space to the open rail panel. Reserve the full mode
  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).
 - Add a shared Voice Preview and Settings panel with browser-local preferences,
  inactivity controls and accessible floating provider controls on compact layouts;
  recover inactivity after confirmed audio-less replies, release retired audio
  observers and keep cost warnings visible outside Settings
  (manjunath22466, #1299).
 - Add Simplified Chinese (zh-CN) to the language picker, with localized dates
  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
  and @EDIT-Aeterna (#979).
  (German, @gekh, #1298).
 - Add the S2 GhostMaps layer: S2 Underground's public KMZ intel products
  (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran
  and Yemen products and the newest incident drop) from
  github.com/s2underground/GhostMaps, with one chip per product and report
  cards on click. `/api/ghostmaps` watches the repository's branch head every
  15 s and pushes each new commit to open pages, which reload only the
  products that changed (Black Pine Defense).
 - Clear a temporary GhostMaps upstream error and notify open pages when the
  repository becomes reachable again, including when no new edition was published.
 - Release packed-image resources when a load is cancelled or fails, respect
  injected or omitted GhostMaps sources, and wait for background cache warm-up
  before removing provider test fixtures.
 - Include Simplified Chinese translations and keep the combined voice prompt
  within its existing size limit while retaining all spoken aliases.
 - A Street Level provider whose `zoomFor` still answers `{zoom, kind}`, the
  shape before the core went slim, draws its lines again instead of a silent
  blank; an overview level or any answer that is not a whole zoom shows the
  zoom-in hint (asturksever, #1288).
 - Give ordinary sliders a shared native control and consistent track, thumb,
  value, focus and disabled styling while preserving feature behavior and
  specialized controls (mazy1998, #1287).
 - The Street Level SINCE note sits on the value's line, in its type and a
  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
  had lost its size variable in the Street Level slim-down and rendered
  larger than the value, on a line of its own (asturksever, #1286).
 - Keep aircraft route labels on the scheduled airport leg instead of accepting
  its distant great-circle extensions, preserving generous endpoint tolerance
  across the signed-angle branch cut (rudycelekli, #1284).
 - Report cached CelesTrak satellite records as stale in the Data Layers row,
  preserving separate core and dense catalog provenance through refresh,
  removal and lifecycle cleanup (rudycelekli, #1283).
 - Pause periodic network updates in hidden tabs; the overdue update on return restarts the polling schedule, so the next poll follows one interval later even when that update fails (asturksever, #1282).
 - Report and guard browser visibility during Transit QA so hidden-page polling pauses cannot masquerade as playback regressions (asturksever, #1282).
 - Require each live city to supply its own feed vehicles in Transit QA; retained vehicles cannot qualify another city (asturksever, #1282).
 - Bound the Transit card-anchor probe by observed poll coverage instead of a fixed 20-second window (asturksever, #1282).
 - Keep visible-page Transit probes focused through the browser testing API (asturksever, #1282).
 - Add a real-browser regression gate for hidden-tab periodic work, explicit refresh, resume and teardown (asturksever, #1282).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1282).
 - Hold rendering only for animated content (asturksever, #1281).
 - Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
 - Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
 - Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
 - Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
 - Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
 - Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).
 - Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).
 - Reserve singleflight before disk cache reads (asturksever, #1278).
 - Bound each height request to one upstream chunk (asturksever, #1276).
 - Preserve enable during first-load replacement (asturksever, #1275).
 - Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
 - Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).
 - Scan the kml root delimiter in bounded time (asturksever, #1274).
 - Retire unavailable history and keep local trails (asturksever, #1273).
 - Normalize geocoder bias across the antimeridian (asturksever, #1272).
 - Reject inherited style keys during restore (asturksever, #1271).
 - Respect provider cooldowns and bound tle groups (asturksever, #1270).
 - Coalesce refreshes and cool down opensky failures (asturksever, #1269).
 - Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
 - Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).
 - Honor Docker Compose trusted-peer and allowed-host settings from the shell
  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
  access to Provider Settings before Vite starts (asturksever, #1265).
 - Prevent malformed Overpass filters from blocking the local server, and reject
  cross-site or excessive query requests before reading their bodies
  (asturksever, #1264; fixes #1248).
 - Release unread responses from the optional Google-token probe so keyless
  browser validation can settle; the Overpass gate recognizes only that probe's
  expected 404 as an unavailable capability (asturksever, #1264).
 - Make tracking arrival checks respect the aircraft update cadence while checking
  orientation on the first reveal, avoiding false failures at faster render
  rates (asturksever, #1264).
 - The terrain-heights bounds tests no longer read the checkout's
  `.gev-cache/terrain-heights.json`. Each test gets a cache file of its own, so
  `npm test` no longer fails after the dev server has cached terrain near
  Austin (KnottyDyes, #1244).
 - Replace the blocky JPEG sky around the globe with the 9,096 stars of the
  Yale Bright Star Catalogue, drawn as sharp points where they are at the
  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
  #1243).
 - `get_traffic_flow` flags stale cached TomTom tiles and reports the oldest
  tile fetch time (`stale`, `oldest_tile_at`), with pending freshness metadata
  released on failed or cancelled tile reads (quanticsoul4772, #1239).
 - Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
  with on-demand snapshots and attribution. No API key is required; set
  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).
 - Require a geocoded containment anchor for ambiguous analyst region names,
  preserve boundary provenance and cancellation safety, and retain exact-name
  precedence for natural outlines (manjunath22466, #1235).
 - Serve the camera catalog while it refreshes. An expired catalog made every
  camera request wait for the slowest pack to reload; it is now answered at
  once while one background refresh runs, so only the first load waits. Estonia's
  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
  on about a third of loads (quanticsoul4772, #1234).
 - Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
  cancel both response streams when either response fails or overflows the 4 MB
  byte cap, and deduplicate camera IDs before per-pack prioritization
  (yaka0007, #1233).
 - Skip bike-share stations with missing, blank or invalid coordinates instead
  of placing them at coerced zero coordinates or accepting out-of-range values.
  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #1232).
 - OpenSky sign-in matches what OpenSky accepts since 2026-03-18. The server
  now reads `OPENSKY_CREDENTIALS_FILE` (the `credentials.json` OpenSky's
  account page downloads) on every platform, not only through the macOS
  launcher, and no longer sends retired username/password Basic auth:
  `OPENSKY_AUTH_MODE=basic` loads anonymously with one warning saying what to
  set instead (quanticsoul4772, #1229).
 - Credential-file warnings omit parser excerpts and filesystem error details;
  the path example also works with the macOS launchers.
 - Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
  otherwise skipped with one log line saying where to get a key
  (quanticsoul4772, #1228).
 - The first-run card can be closed on a phone or tablet. "ESC to dismiss" is
  now a button that closes the card the same way ESC does; touch screens read
  DISMISS, and phones no longer hide it, so choosing a mission is not the only
  way out (KnottyDyes, #1226).
 - Add continuous globe rotation with direction and speed controls and a globe-fit
  check before starting (manjunath22466, #1225).
 - Open God's Eye View from Pinokio in the system browser using the supported
  `popout` menu option. The application's framing policy is unchanged
  (NukeThemAII, #1222).
 - Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
  command, while preserving an earlier accepted deferred input
  (Manjunath, #1220).
 - Keep NASA FIRMS fire and ALPR camera labels English in voice tool results
  (`track_entity`, `get_entity_context`, pointer context); the voice card still
  shows them in the interface language (daikaginza, #1207).
 - Report actual outcomes when voice enables or disables CCTV through the shared
  layer lifecycle, including failed and cancelled changes (manjunath22466,
  #1205).
 - Draw CCTV stills at their source aspect on the monitor plane instead of
  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
  every still was widened; they are now centered and pillarboxed on the dark
  the placeholder already ends on (Danielslay86, #1201).
 - Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
  video camera could only be found by opening it. Stills stay cyan and the
  active camera stays amber, and focus de-emphasis fades the violet the same
  way (Danielslay86, #1200).
 - Keep Space Missions marked STALE when Launch Library 2 falls back to cached
  launch data, and return to NOMINAL after a fresh response without discarding
  retained missions (rudycelekli, #1199).
 - Share Launch Library request cache keys across installations refreshing in the
  same UTC minute, identify the app to the provider, and explain that standard
  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
  upgrades; existing local cache and server-only token handling are unchanged
  (rudycelekli, #1197).
 - Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
  BicinRivas, about 1,840 stations. Station names read underscores as word
  breaks, and station capacity counts docks rather than PBSC's geofenced area
  (ulihhhh, #1190).
 - Keep missing launch-pad coordinates unknown so launches use the location
  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
  flight numbers no longer show "FLIGHT 0"
  (Rudy Celekli, @rudycelekli, #1186).
 - Flights' ground floor works across the antimeridian. The viewer-distance
  check behind the 150 km floor radius and its copy in the photoreal mesh-floor
  sampler subtracted longitudes without wrapping, so two points 21 km apart
  across 180° measured about 38,000 km and low or grounded aircraft just across
  the line from the viewer were never floored. A contact's display corridor
  walked a segment across 180° the long way round, spending its cell budget on
  ground behind the contact, and a contact on the seam lost its cell hysteresis.
  SEARCH NEARBY SITES on a view across 180° searched Google Places around
  longitude 0, on the far side of the globe, with a radius sized from the view's
  height alone; it now searches the view (Aditya, @Rohilalala, #1173).
 - Keep missing CCTV numbers unknown instead of reading them as zero. `Number`
  turns null, blank strings and booleans into 0 or 1, and the camera source
  list sends an unknown number as JSON null, so a source-pack camera that left
  out its pose reached the browser as zeros clamped to each field's floor —
  facing north, pitch −2°, FOV 20°, range 120 m, mount 6 m and ground 0 m —
  instead of the defaults (id-hash heading, −17°, 74°, 700 m, 24 m and the
  city's ground); a null or blank position placed the camera at 0,0. The
  server's `toFiniteNumber` and the browser's `safeNumber` now treat absent,
  blank and boolean values as missing. The same conversion also stops a
  Tallinn row with a null heading reading as a confident north-facing camera,
  a Caltrans camera with a blank elevation losing its 150 m ground prior, and
  a TfL or Catalonia camera with a null or blank coordinate being kept at 0,0
  or on the zero meridian (omerbberk, #1172).
 - Director shot actions land on the requested shot. A seek to a shot's start
  could round a hair below it and select the end of the previous shot for some
  shot counts and durations (Aditya, @Rohilalala, #1171).
 - Fire-perimeter queries handle outlines and holes crossing the antimeridian:
  areas enclosed near ±180° are included, areas at the opposite meridian are
  excluded, and returned perimeter coordinates stay near the dateline. Incident
  cards use the same circular longitude mean and compare multipart outline
  areas along short longitude edges, keeping the card on the largest polygon
  (Arianna Method, @ariannamethod, #1142).
 - Scenes keep the "Scene not saved" status when a capture, update, append or
  import cannot be saved, and an unreadable saved project no longer overwrites
  the recovery checkpoint. `startScene()` resolves to its documented result,
  `afterShotId` works without an explicit scene, and `scenesRun` counts the
  distinct scenes queued (djabhi31, #1135).
 - Label camera-tool Street View fallbacks as historical Google imagery rather
  than the current camera view; keep unknown frame provenance explicit
  (rudycelekli, #1118).
 - Release superseded Google Street View open waits and suppress metadata
  requests whose viewer was unmounted while the service loaded (rudycelekli,
  #1117).
 - Exclude aircraft without a reported altitude from requested altitude bands;
  unfiltered aircraft queries still retain them (rudycelekli, #1115).
 - A failed Esri Satellite or keyless terrain load still shows OSM or flat terrain
  at once, but no longer lasts the whole session: while the fallback is on
  screen, the real provider is retried in the background (30 seconds, doubling
  to a 10-minute cap) and replaces it live once it loads. Map switches never
  wait for a retry (Aditya, @Rohilalala, #1111).
 - Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
  spliced catalog cannot pair one satellite's elements with another's; the next
  valid set still parses (VG31OP, #1101).
 - Overpass data whose element tags contain a failure phrase ("timed out",
  "runtime error", "too many requests" and similar, e.g. a place named "Timed
  Out Escape Rooms") is returned as data instead of being refused and putting
  the endpoint on cooldown; upstream failures are read from the remark (Aditya,
  @Rohilalala, #1097).
 - Military aircraft keep their last heading and speed when an adsb.lol row omits
  `track` or `gs`, instead of turning north and stopping; a grounded row without
  a speed still reads 0 (Aditya, @Rohilalala, #1096).
 - Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
  #1094).
 - Location search accepts two-dimensional WGS84 `geo:` URIs offline, with
  the existing coordinate framing and label. Unsupported URI fields are passed
  to the remaining search providers unchanged (cj-vana, #1071).
 - Keyless standalone startup answers an unavailable Google tile-token endpoint
  with uncached 204 instead of a browser-visible 404. Existing providers take
  precedence, and unrelated API routes behave as before. (dvilrgamerz, #1066)
 - On Windows, `npm run doctor` and the Pinokio install no longer print Node's
  DEP0190 warning ("Passing args to a child process with shell option true can
  lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
  the shell command string instead of an argument array (quanticsoul4772, #1057).
 - `aircraft_in_area` and `vessels_in_area` take `group_by` and `stats`, so an
  MCP client can ask which airlines, countries, aircraft types or ship types
  dominate an area, or the average altitude or speed, over every match instead
  of estimating from the returned rows. Airlines come from the ICAO designator
  in each callsign (SWA1234 counts as SWA), so the breakdown works on feeds
  that report no operator; operator and type are counted only where the feed
  reports them. Ship types count by family, so AIS codes 70 to 79 are all
  cargo; type 0 ("not available") and the reserved codes 100 to 255 count as
  unknown. Altitude and speed stats cover airborne aircraft only, so parked
  aircraft do not pull the means down. Every vessel answer, `find_vessel`
  included, now reads AIS ship-type codes as their family and a destination
  with no letters as unknown (quanticsoul4772, #1056).
 - Add Hong Kong Transport Department traffic snapshot cameras as a keyless CCTV
  source pack: the public DATA.GOV.HK English locations XML, frames pinned to
  `tdcctv.data.one.gov.hk`, with DATA.GOV.HK Terms of Use attribution. By
  default nearly the full TD catalog (~1,013 cameras; cap 1,100) loads,
  prioritized across Hong Kong Island, Kowloon and the New Territories. Headings
  use the shared id-hash fallback at low confidence. `CCTV_HK_MAX_SOURCES` sets
  the cap (8–1,200) and `CCTV_HK_ENABLED=0` turns the pack off (JCY2515, #990).
 - Cross-site pages can no longer fill the terrain-height cache or spend the
  visitor's own `/api/terrain/heights` rate-limit quota through the visitor's
  browser. The route refuses a cross-site `Sec-Fetch-Site` or a foreign or
  opaque `Origin` before rate limiting, cache access or upstream work. Unlike
  the cost-bearing routes it still answers same-origin requests that arrive
  through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or
  Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza,
  #975).
 - Street Level is rebuilt around one small provider registry: Mapillary,
  KartaView, Panoramax and Google Street View share one coverage drawer and
  one photo viewer, one source lit at a time. Floating and docked panels,
  FOLLOW, surface modes, the legend and the Mapillary proxy's disk cache are
  gone; `.gev-cache/mapillary/` from earlier runs is no longer read and can be
  deleted (gekh, #974).
 - Cross-site browser requests can no longer spend the TomTom traffic-tile
  budget through `/api/tomtom/*`. The shared same-site gate runs before status,
  cache, and upstream work; same-origin app requests and non-browser local
  callers remain supported (Sunil56224972, #973).
 - Recent Imagery: opening DETAILS scrolls its card into view when it opens below
  the fold. The panel used to restore the previous scroll position right after
  the reveal, so the card stayed out of sight (Ian Blenke, #970).
 - Harden Vite's filesystem deny list for local-only artifacts: repo `dist/`,
  `.gev-logs/`, and `.gev-cache/` are denied without blocking dependency
  `dist/` directories, and checkout paths containing glob metacharacters are
  escaped before building the root-anchored pattern (blowing-a-raspberry, #948).
 - Give each Statens vegvesen camera its own ground height from Kartverket's
  keyless point-height API (CC BY 4.0) instead of one flat 150 m prior, so
  mountain-pass cameras no longer sit hundreds of metres below the terrain
  where neither the point-height prior nor the ground snap resolves. About 850
  of ~855 cameras get a height; the rest keep the old prior. Requests carry 20
  points, the most the API answers from its 1 m terrain model, eight at a
  time; a cold lookup takes about 6–13 s. Cameras over water use the water
  surface rather than the sea-floor depth the API returns there; for bridge
  cameras that is still below the deck. Heights are cached for good and misses
  for 6 h, so a refresh only asks about new or moved cameras. After a
  failing request (a 408, 429 or 5xx, a network error, a request over 10 s or
  an unreadable body) the lookup stops and backs off (Retry-After, else
  30 min, longer than the refresh). The lane waits at most 12 s from its
  start, and only on a cold cache; a slower first lookup leaves the cameras it
  had not reached on the flat prior until the next 15-minute refresh, and
  keeps filling the cache meanwhile.
  `CCTV_VEGVESEN_HEIGHTS=0` turns it off. Follow-up to #929 (trygvehhh, #945).
 - Extract a reusable model-free World Packet from the existing voice
  `get_current_view_state` owner without restoring disabled layers to the
  model context. Keep the enabled-only payload, disabled-layer count, source
  provenance, action result and view-state contract; read the layer roster once
  per packet; voice retains the speech/card envelope at its own boundary.
  Credits: original GEV voice/layer contributors and #880 implementation.
 - Add optional Gemini Live voice to the standalone app, with a provider chooser,
  server-held API key, microphone streaming, shared map actions and captions.
  Switching providers ends the old conversation and preserves the input mode
  (Manjunath, #872).
 - Close the compact Radio disclosure when an adaptive tactical right-rail
  restore directly expands Context, before Space Missions can be covered.
  A repeated Context-open request also clears stale disclosure state.
  Real PanelChrome constructor wiring and the rail reflow path are covered
  by focused regressions. Credits: kvnloo (#816), raysung-2026's original
  #804 report, asturksever's review, and quanticsoul4772's independent
  Windows diagnosis.
 - Changelog entries are now one file per pull request. A change adds
  `changelog.d/<pull request>-<slug>.md` instead of editing the top of
  `CHANGELOG.md`, which two pull requests in flight could not share — it was the
  most frequent merge conflict in the open queue, and for six of them the only
  one. `npm run changelog` splices the directory into `CHANGELOG.md` at release
  time and empties it; `npm run changelog:check` reports the batch and changes
  nothing. Fragment text is copied through unchanged (daikaginza, #787).
 - Read satellite catalog numbers written in Alpha-5, the TLE spelling of
  numbers above 99999: a letter for the first two digits, skipping I and O
  (`A0000` is 100000, `Z9999` is 339999). The satellites layer converted such a
  field to `NaN`, so every Alpha-5 satellite shared one catalog entry and all
  but the first were dropped as duplicates; the satellite tools read the same
  field as no number, so such a satellite could not be found by it. The layer
  and the tools now decode the field in `src/sources/tle.js`, and reject a
  malformed one (a sign, decimal point, hex, embedded space or stray letter)
  instead of reading part of it as a number. This is Alpha-5 TLE
  compatibility: CelesTrak's TLE feed carries no satellite above 99999, which
  needs the OMM feed (#1191) (Honorius Neogy, #767, fixes #751).
 - The dev server no longer watches `.gev-cache` and `.gev-logs`. Providers write
  cache files and logs there while the app runs, and none of it is source, so
  the watcher now skips it; this guards against the DNS-lookup delays heavy
  cache writes have caused, though no difference was measured on current main
  (monwiss, #761).
 - Bound what a caller can grow through `/api/terrain/heights`. Every distinct
  5-decimal point was a permanent in-memory entry, a permanent line in an
  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
  nothing limiting the rate. The point cache now holds at most 50,000 entries
  and evicts oldest-first, a cache file above
  24 MB is not read back, and the route is limited to 90 requests/minute per
  client (270 global). Evicting a point costs one refetch, never a wrong
  answer, since terrain does not move. Ordinary use is unaffected: a full
  `test:track` run drives 10 requests, peaking at 8/min (daikaginza, #686).
 - Add FL511 (Florida DOT) traffic cameras as an opt-in CCTV source pack:
  the statewide ArcGIS catalog, read a page at a time under a byte cap with
  redirects refused, and frames pinned to FL511's two image hosts over HTTPS.
  FL511's terms limit its content to individual, personal use, and any other
  use (a public deployment included) needs FDOT's express written consent, so
  the pack stays off unless `CCTV_FLORIDA_ENABLED=1`. Headings come from the
  catalog's direction codes, and camera ids come from the image channel, since
  the catalog's ID column repeats across regions. `CCTV_FLORIDA_MAX_SOURCES`
  sets the cap (Danielslay86, #605).
 - The client's great-circle distances now come from one shared
  `src/geoDistance.js` (`greatCircleKm`/`greatCircleMeters`, `{lat, lon}`
  points). The Earth radius is standardized on 6371.0088 km, so distances shift
  by about 1.4 ppm and region areas by about 2.8 ppm, and missing or
  out-of-range points return `Infinity` (onionviolet, #287; Rajojha-1, #749).
 - The tracked-aircraft descriptor now publishes `verticalRateMps`, on both the
  civil and military layers, so a consumer reading `getTrackedInfo()` no longer
  has to reach past it into the raw poll record for climb/descent. Reported,
@@ -291,8 +978,6 @@
  point. A slow render gets one bounded second frame request, while hidden,
  stale, moved-camera, invalid and oversized captures still fail closed.
 ## [Unreleased]
 - Add a keyless Air quality layer to the Weather group, with Environment and
  Climate Change Canada's AQHI as the first registered provider. Readings carry
  `{ provider, scale, value, band }` so another network can be added without
@@ -507,6 +1192,28 @@
  needs only the Map Tiles API and the Maps JavaScript API (Street View). Keyless sessions and the Photon/Nominatim
  fallback order are unchanged.
 - Voice can switch on every shipped data layer (the two scene-driven
  Bhote Koshi layers stay scene-only), including transit, Recent
  Imagery, wind, the weather layers, cyclones and mapped installations, and
  understands their spoken names ("buses", "hurricanes", "military bases").
  One voice manifest (`src/voice/layerManifest.js`) generates the tool enums
  and aliases, and a unit test fails when a new layer has no entry.
 - `analyst_query` counts up to 250,000 loaded records per layer instead of the
  first 2,000, and says when a layer went past that (`complete: false`). It
  also answers over bikeshare stations, transit vehicles, rocket launches,
  cyclones, ALPR cameras, mapped installations, local ADS-B aircraft and fire perimeters; fire
  records carry their sensor (VIIRS or MODIS).
 - Unknown fields, operators, units, value types, scope kinds and invalid
  centres are refused with the allowed values instead of answering zero or widening to anywhere. A
  layer that is off, still loading or unavailable is reported as such, not
  as a count of zero; a partly answerable query is marked `partial`.
  Distance sorts honour `sortDir`, a written unit such as `altitudeM(ft)`
  converts, and large rankings no longer sort the whole set.
 - Results carry `lat`/`lon` for each item and a `display` object with the
  scope, the feed window (earthquakes and fires cover the last 24 h) and any
  caveat for the screen. The model is asked to answer in one short phrase.
 - The weather and Recent Imagery panels can be opened by voice.
 ## [0.2.1] — 2026-10-02 — God's Eye View through Your Agent (with security fixes and other features)
 - Ship each bundled data pack once. The region, marine, admin-boundary,
@@ -789,32 +1496,6 @@
  (`src/ui/imagerySplit.js`, `src/maps/imageryComparison.js`), and
  `MapSourceController.subscribe()` reports every settled map switch.
 ## Unreleased — voice reaches every layer; honest analyst answers
 - Voice can switch on every shipped data layer (the two scene-driven
  Bhote Koshi layers stay scene-only), including transit, Recent
  Imagery, wind, the weather layers, cyclones and mapped installations, and
  understands their spoken names ("buses", "hurricanes", "military bases").
  One voice manifest (`src/voice/layerManifest.js`) generates the tool enums
  and aliases, and a unit test fails when a new layer has no entry.
 - `analyst_query` counts up to 250,000 loaded records per layer instead of the
  first 2,000, and says when a layer went past that (`complete: false`). It
  also answers over bikeshare stations, transit vehicles, rocket launches,
  cyclones, ALPR cameras, mapped installations, local ADS-B aircraft and fire perimeters; fire
  records carry their sensor (VIIRS or MODIS).
 - Unknown fields, operators, units, value types, scope kinds and invalid
  centres are refused with the allowed values instead of answering zero or widening to anywhere. A
  layer that is off, still loading or unavailable is reported as such, not
  as a count of zero; a partly answerable query is marked `partial`.
  Distance sorts honour `sortDir`, a written unit such as `altitudeM(ft)`
  converts, and large rankings no longer sort the whole set.
 - Results carry `lat`/`lon` for each item and a `display` object with the
  scope, the feed window (earthquakes and fires cover the last 24 h) and any
  caveat for the screen. The model is asked to answer in one short phrase.
 - The weather and Recent Imagery panels can be opened by voice.
 ## Unreleased — local receiver feeds
 ### Local receiver feeds
 - The Local ADS-B layer also reads local 1090 MHz and 978 MHz UAT decoder
@@ -957,7 +1638,6 @@
 Add feed provenance to analyst/view answers and HUD context while retaining existing response fields and runner ownership (Matt Van Horn, #347).
 Analyst records for loaded satellites, datacenters and dams, with explicit bounded count/rank coverage (Matt Van Horn, #351).
 - New Fire Perimeters layer (Events group): live NIFC WFIGS interagency
  wildfire incident perimeters as ground-clamped polygons with a
  containment-colored fire line, refreshed every 5 minutes from the public
@@ -1234,6 +1914,7 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 ### Other changes
 - Add ECMWF IFS model selection to Wind (#464, thanks @beneduzi), with model-scoped forecast-step caches, cancellation of replaced requests, and separate issue/valid timestamps.
 - Add bounded Director feature actions with accessible controls, explicit camera/layer admission and cancellation; restore pack geometry on same-shot seek. Preserve existing scenes and content attribution.
@@ -2042,3 +2723,4 @@ represent previously published GitHub Releases.
 ## [0.1.0] — 2026-02-09
 - Initial project version.
@@ -4,13 +4,15 @@ Thanks for being here. God's Eye View is an open foundation for live spatial int
 ## Getting set up
-Use Node.js 24.14.x or 26.x (also enforced by `package.json`).
+Use Node.js 24 (24.14.0 or later) or 26.x (also enforced by `package.json`).
 Prefer 24.22.1 or later: earlier releases lack the October 21, 2026 security
 fixes, including CVE-2026-111497 (a Brotli decoder flaw).
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git
 cd gods-eye-view
-nvm install 24.14.0
+nvm install 24.22.2
-nvm use 24.14.0
+nvm use 24.22.2
 npm install
 npm run doctor
 ./scripts/dev-fresh.sh        # or: npm run dev (keys are optional)
@@ -27,6 +29,25 @@ through Pinokio; the terminal path above remains the contributor path.
 Open `http://localhost:4173`. Before sending a PR run `npm run build`, `npm test`, and `npm run test:track` (dev server must be up) — **all three must stay green.**
 ### Test prerequisites
 - **`npm test`** — unit tests. Runs standalone; no dev server or credentials
  required. Exit code is the gate.
 - **`npm run test:track`** — the 3D flight-tracking regression harness. It
  drives the **real app** in headless Chromium, so it **requires a running
  dev server** (default `http://localhost:4173`). To target another instance,
  run `npm run test:track -- --url <app-url>` (or
  `node scripts/track-regression.mjs --url <app-url>`). It does not depend on
  live OpenSky / adsb.lol / AISStream (those are optional or rate-limited
  locally); it installs a persistent `fetch` shim that returns synthetic
  aircraft in the exact upstream payload shapes the layers parse.
 - **`npm run build`** — production Vite build. No server or credentials
  required; it validates that the client bundle compiles cleanly.
 Each feature also has its own headless gate; see
 [Feature regression gates](#feature-regression-gates) below. Docs and changelog
 rules are under [Pull requests](#pull-requests).
 ## Checking a built app locally
 Run `npm run build` followed by `npm run preview`. Preview serves the built
@@ -115,7 +136,7 @@ The highest-leverage places to jump in:
 ## Architecture in one minute
- **No framework.** Vanilla JS + [CesiumJS](https://cesium.com/platform/cesiumjs/) + [Vite](https://vitejs.dev/).
+- **Vue 3 + Pinia for the interface,** [CesiumJS](https://cesium.com/platform/cesiumjs/) for the globe and [Vite](https://vitejs.dev/) to build. See [Building UI](#building-ui).
 - **Assembly lives in `src/app/`; standalone defaults live in `src/standalone/`.** UI controllers live in `src/ui/`, layer factories in `src/layers/`, portable sources in `src/sources/`, and application operations in `src/services/`. Existing `src/data/<layer>.js` entries retain compatibility; new code belongs with its focused owner.
 - Sources acquire records; renderers own Cesium resources. Import `gods-eye-view/layers/<family>/source` when only a source factory is needed. Common voice controls consume the session interface; protocol adapters own connection details.
 - **Secrets stay server-side.** Anything needing a private key goes through a local proxy under `server/providers/`. The browser only ever sees the Google Maps key (which you restrict) and ephemeral tokens.
@@ -126,9 +147,65 @@ The highest-leverage places to jump in:
 - ES modules, **2-space indent, single quotes, semicolons.**
 - JSDoc on exported/public functions.
 - Match the surrounding code — comment density, naming, and idiom.
- User-visible text goes through `t()`, `tn()` or `msg()`, or a `data-i18n*` attribute in markup, and `npm run i18n` must pass. See [docs/I18N.md](docs/I18N.md).
+- User-visible text goes through `t()` or `tn()`, with `msg()` marking English that is stored and translated later. Components call `t()` in their templates, so their text follows the locale; `data-i18n*` attributes are only for static page markup such as the loading screen, and `npm run i18n` rejects them in a template. `npm run i18n` must pass. See [docs/I18N.md](docs/I18N.md).
 - Prefer small, reviewable commits. Conventional-commit-style prefixes (`feat:`, `fix:`, `perf:`, `docs:`) are appreciated but not required.
 ## Building UI
 New UX elements are Vue components whose state lives in a Pinia store, and so
 are existing ones when a change converts them:
 - **Views are Vue components.** Application views live in `src/ui/views/` and
  the components they place in `src/ui/views/panels/`; a component that
  belongs to one feature sits beside its owner (`src/ui/rail/`,
  `src/ui/weather/`). A view renders what its store holds and forwards
  clicks and input to the store; it holds no application logic.
 - **State lives in a Pinia store** in `src/ui/stores/`. The owner presents a
  plain view object and publishes it to the store; the view renders it. User
  actions return to the owner through handlers it connects to the store,
  which replace an earlier owner's. Where several owners answer different
  actions of one store, use `createOwners()` from `src/ui/stores/owners.js`:
  `act(name, ...args)` calls the newest connected owner that handles `name`,
  and the owner calls `detach(token)` when it stops.
 - **Portable owners stay framework-free.** An owner in a portable export
  imports neither Vue nor Pinia: it takes a `publish` option or offers a
  `subscribe…()`, and the application shell connects it to the store.
  `npm run check:boundaries` enforces this.
 - **Reuse the kit first.** `src/ui/kit/` has one component per control:
  `UiButton` (including pressed toggles and pressable chips), `UiSelect`,
  `UiSlider`, `UiSegmented`, `UiChip` (a label, not a control), `UiBadge`,
  `UiEmpty`, `UiIcon`, `UiTooltip`, `UiPanel` and `UiRail`. Use these before
  writing a control. When the kit lacks something, extend a kit component or
  add one that follows the kit's names, props, events and class names (see
  [Component kit](docs/VUE-MIGRATION.md#component-kit)), rather than
  building a one-off.
 - **No hand-written DOM binding.** Don't build elements or write text,
  classes or attributes from a controller to show UI state; render it from
  the store. New controls take input through the store rather than through
  listeners the owner adds. To render outside the view's host (the body, the
  globe container, or a slot another surface opens), use `<Teleport>` to
  `body`, a fixed id or a container the owner publishes; don't move nodes by
  hand. What stays imperative: classes on `<body>` and `<head>`, which sit
  outside Vue (`cockpit-mode`, `ui-clean-view`); focus moves; positions a
  layout pass measures in the same task that writes them; and surfaces an
  owner paints or plays, such as the Cesium canvas, overlay canvases and live
  video. A few existing surfaces keep listeners or bindings that
  [docs/VUE-MIGRATION.md](docs/VUE-MIGRATION.md) records; keep those
  contracts when you change them, and don't copy them into new UI.
 - **Text** goes through `t()` or `tn()` where the template renders it.
  English kept in a constant or a store is marked with `msg()` and passed to
  `t()` when it renders, since a `t()` at module load would fix the English.
 - **Test components, not markup strings.** Mount the component over
  happy-dom with `@vue/test-utils` or `createApp` and assert what it renders
  from its store (see `src/testSupport/vueDom.mjs`, `src/ui/kit/*.test.mjs`
  and `src/ui/views/intelHudView.test.mjs`). Run one such file with
  `node --import=./build/registerVue.js --test <file>`. Don't pass happy-dom
  nodes to `assert.equal`/`deepEqual`; compare them with `assertSameNode()`
  from `src/testSupport/domAssert.mjs`.
 [docs/VUE-MIGRATION.md](docs/VUE-MIGRATION.md) records how each surface moved
 and what stays imperative, and why.
 ## Formatting and reusable components
 Run `npm run format` before submitting changes, then `npm run format:check`
@@ -170,8 +247,9 @@ template has a section for them.
   instead of attaching it.
 3. **The proposed category.** Say which layer-panel group the layer belongs in.
   The groups are defined in `PANEL_GROUPS` in `src/ui/layerPanel.js` (today:
-   Movement, Cameras, Infrastructure, Events, Weather and Utilities). A layer
+   Movement, Cameras, Infrastructure, Events, Weather and Audio, plus Utilities,
-   that isn't listed there falls under "Other layers". If none of the groups
+   whose rows render in the separate UTILITIES panel). A layer that isn't
   listed there falls under "Other layers". If none of the groups
   fits, propose a new one and explain why.
 4. **The data source and licence.** Name the provider and endpoint, link its
   licence or terms, give the attribution shown in the app, and say whether it
@@ -38,6 +38,7 @@ How to read this:
 | **Environment and Climate Change Canada** (MSC GeoMet OGC API) | Air quality (AQHI) — Canadian station observations | [ECCC Data Servers End-use Licence](https://eccc-msc.github.io/open-data/licence/readme_en/) (open, attribution required, no endorsement implied) | "Contains information licensed under the Environment and Climate Change Canada Data Servers End-use Licence" |
 | **NASA GIBS** (WMTS tiles + Worldview Snapshots) and **NASA CMR** (granule catalog) | Recent Imagery layer: HLS S30/L30 (Sentinel-2, Landsat 8/9) and VIIRS true-colour tiles draped on the map, per-day thumbnails and PNG exports; the HLS granule catalog (dates, cloud, footprints) for a selected box | U.S. public domain (NASA data); keyless, browser-direct (CORS `*`); no bulk use — one 30-day catalog query per box, tiles bounded to the box, six tile requests in flight | "We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS)." — [gibs.earthdata.nasa.gov](https://gibs.earthdata.nasa.gov), [HLS](https://lpdaac.usgs.gov/products/hlss30v002/) |
 | **NIFC WFIGS** (Wildland Fire Interagency Geospatial Services, ArcGIS feature service) | Fire Perimeters layer: current interagency wildfire incident perimeters, containment, and incident facts | U.S. public domain (interagency wildland-fire data published through the [NIFC Open Data portal](https://data-nifc.opendata.arcgis.com/)); fetched keyless through `/api/fire-perimeters` (5-minute server cache) with `exceededTransferLimit` paging | "Wildfire perimeters: National Interagency Fire Center (WFIGS)" |
 | **S2 Underground GhostMaps** (`github.com/s2underground/GhostMaps`) | S2 GhostMaps layer: the current edition of S2's KMZ intel products (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran and Yemen products, newest incident drop). Keyless. `/api/ghostmaps` reads the branch head from git's ref advertisement every 15 s (`GHOSTMAPS_POLL_SECONDS`, minimum 5 s), lists the tree through the GitHub REST API only when the head changes (optional `GITHUB_TOKEN`), downloads files by commit-pinned raw URLs into `.gev-cache/ghostmaps/` and pushes new catalogs to browsers over server-sent events | [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) (repository README: "S2 Underground © 2025 by S2A1"); non-commercial, attribution required; files are fetched at runtime, never stored in this repository | "S2 GhostMaps intel products: S2 Underground © by S2A1, CC BY-NC-SA 4.0" — shown in-app |
 | **InciWeb** (inciweb.wildfire.gov)                                    | Per-incident "InciWeb ↗" card links to official incident pages (narratives, evacuation/closure notices) | U.S. government public incident information. Links are matched best-effort by incident name and state, with incident page origin and update times checked on selection. Same-origin `/api/fire-perimeters/inciweb` routes cache the catalog for 1 hour and publication metadata for 30 minutes; linked pages remain InciWeb content | "Incident information: InciWeb (inciweb.wildfire.gov)" |
 | **OpenFreeMap / OpenMapTiles** | Vector tiles | OpenStreetMap data under ODbL 1.0 | OpenFreeMap © OpenMapTiles |
 | **Overture Maps Foundation** | Military area names pack | [ODbL 1.0](https://opendatacommons.org/licenses/odbl/1-0/) | Overture Maps Foundation |
@@ -68,6 +69,7 @@ How to read this:
 | **Kartverket** (`ws.geonorge.no/hoydedata/v1/punkt`)               | Terrain heights (NN2000) used as the ground prior for Statens vegvesen cameras                                                     | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — attribution REQUIRED | "© Kartverket", modified (heights over water set to 0 m, rounded to 0.1 m) |
 | **NYC DOT Traffic Management Center** (`webcams.nyctmc.org`) | CCTV camera catalog + frames, New York City five boroughs | NYC DOT requires developers to sign a [data-sharing agreement](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) for the camera feed. **Off by default**; enable only under your own agreement | "NYC DOT Traffic Management Center" + NYC DOT's required application disclaimer (in the Data attribution popover) |
 | **City of Toronto Open Data** (`opendata.toronto.ca`)                 | CCTV camera catalog + frames, Toronto city streets                                                                                  | [Open Government Licence – Toronto](https://www.toronto.ca/city-government/data-research-maps/open-data/open-data-licence/) — attribution REQUIRED                                                                                                                                                                                                    | "Contains information licensed under the Open Government Licence – Toronto"                                                                 |
 | **Autostrada del Brennero (A22)** (catalog `tourism.api.opendatahub.com`, frames `www.autobrennero.it/WebCamImg/`) | CCTV camera catalog + frames, A22 Brenner–Modena motorway, Italy | Public Autobrennero webcam images; camera list republished by the Open Data Hub, whose records are tagged CC0 (`ClosedData: false`, licence holder Autobrennero); Autobrennero publishes no terms of its own for the images | "Webcam images © Autostrada del Brennero S.p.A., via the Open Data Hub (NOI Techpark)" (courtesy) |
 | **GBFS (Lyft / BCycle / Social Bicycles / PBSC)**                     | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                                   |
 | **Bike Share Toronto** (`toronto.publicbikesystem.net`) | Bikeshare station availability, Toronto | Operator GBFS feed. No licence is published: the City's open-data package declares none and the feed has no `license_url`. Attribution is given to the operator. | "Bike Share Toronto (Toronto Parking Authority)" |
 | **Bike Itaú / Tembici** (`*.publicbikesystem.net`, seven Brazilian cities, Santiago and Bogotá) | Bikeshare station availability: São Paulo, Rio de Janeiro, Salvador, Recife, Porto Alegre, Brasília, Curitiba, Santiago de Chile and Bogotá | Operator GBFS feeds. No licence is published: the feeds' `system_information.json` carries no `license_url`, operator or attribution fields. Attribution is given to the operator. | "Bike Itaú (Tembici)"; "Tembici Bogotá" |
@@ -96,6 +98,8 @@ How to read this:
 | **Burlington Transit** (opendata.burlington.ca) | Transit layer live vehicles, Burlington ON | Burlington Transit realtime data under the City of Burlington Open Data Terms of Use, which permit any lawful purpose. The terms are revocable and must travel with the data, so the credit links them. Route ids are internal keys and are joined to the City’s published GTFS. | Credit to the City of Burlington plus a link to its Open Data Terms of Use, which the licence requires |
 | **Radio Browser**                                                     | Geolocated internet-radio station directory and station-level tags                                                                  | Public-domain directory data under PDDL 1.0; individual broadcaster stream terms apply                                                                                                                                                                                                                                                                | "Radio Browser" plus a link to the selected broadcaster                                                                                     |
 | **Re:Earth Terrain** (Mapterhorn)                                     | Terrain (keyless globe stacks — OSM etc. — + `/api/terrain/heights` ellipsoidal-height lookups)                                     | Terrain mesh: CC BY 4.0; geoid: EGM2008 (NGA, public domain)                                                                                                                                                                                                                                                                                          | "Terrain (keyless globe stacks): Re:Earth Terrain / Mapterhorn (CC BY 4.0) / EGM2008 (NGA)"                                                 |
 | **OpenSeaMap** (`tiles.openseamap.org`) | Sea Marks layer: raster overlay of buoys, lighthouses and ports (#10) | Chart tiles CC BY-SA 2.0; data ODbL 1.0 via OpenStreetMap | "Sea marks © OpenSeaMap contributors (CC BY-SA 2.0) · Data © OpenStreetMap contributors (ODbL)" |
 | **OpenSnowMap** (`www.opensnowmap.org`) | Ski Pistes layer: raster overlay of ski runs and lifts (#10) | Tiles CC BY-SA; data ODbL 1.0 via OpenStreetMap; bulk tile download forbidden without prior agreement | "Ski pistes © www.opensnowmap.org (CC BY-SA) · Data © OpenStreetMap contributors (ODbL)" |
 | **OSRM on the FOSSGIS routing servers** (`routing.openstreetmap.de`) | Street-following routes for the Directions layer and voice route annotations, via `/api/route` | [FOSSGIS routing usage policy](https://routing.openstreetmap.de/about.html): "Display the required attribution and display a link to 'fix the map'", "Use a valid user agent and, if applicable, a correct referrer", "One request per second max", "No scraping, no heavy usage". The full policy is the German [FOSSGIS Nutzungsbedingungen](https://www.fossgis.de/arbeitsgruppen/osm-server/nutzungsbedingungen/); FOSSGIS also states that the server may be embedded in your own pages but "eine gewerbliche Nutzung ist nur mit Einschränkungen erlaubt" (commercial use only with restrictions). Route data derives from OpenStreetMap (ODbL 1.0) | "Routing: OSRM on the FOSSGIS servers" + a "fix the map" link — shown in the Data attribution popover |
 ### Local receiver input (not fetched from a service)
@@ -116,6 +120,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Freeway Bureau, MOTC (Taiwan).** National freeway cameras from the Freeway Bureau's keyless [CCTV static table](https://tisvcloud.freeway.gov.tw/history/motc20/CCTV.xml) in the MOTC 2.0 standard, refreshed daily and fetched at runtime (never bundled). Freeway Bureau traffic data is published under the [Open Government Data License, Taiwan (Version 1.0)](https://data.gov.tw/license), which permits reuse, including commercial reuse, with attribution; the app credits the Freeway Bureau, MOTC, names the dataset and links the licence, as its attribution exhibit asks. The table publishes each camera's MJPEG stream on one of four official camera servers (`cctvn`, `cctvn5`, `cctvc`, `cctvs` under `freeway.gov.tw`). The frame proxy relays single images, so each published stream URL is mapped to the same server's single-JPEG path for the same camera number (`/abs2mjpg/bmjpg` → `/abs2mjpg/jpg`, `/live-view/mjpg/video.cgi` → `/live-view/jpg/image.cgi`); only those exact HTTPS pairs are registered, and the still path is not itself listed in the table. These are on-demand snapshots, not continuous video. Camera headings are low-confidence estimates. No API key is required. The table host does not answer from some networks outside Taiwan (the camera servers do); there the pack is empty, logs one warning and retries hourly. On by default; `CCTV_TAIWAN_ENABLED=0` skips the pack, and `CCTV_TAIWAN_MAX_SOURCES` defaults to 600 (bounded to 1–2000).
 - **Google Maps Platform.** You supply your own API key and are bound by [Google's ToS](https://cloud.google.com/maps-platform/terms). Google Maps Content (tiles, geocodes, places) **may not be cached, stored, rehosted, or committed** — this app only ever uses it live, which is the compliant pattern. The "Google" attribution is displayed on the globe and must stay visible. Restrict your key (see [SECURITY.md](SECURITY.md)).
 - **Sea Marks and Ski Pistes (#10).** Two keyless raster overlay layers under Infrastructure, OpenSeaMap sea marks and OpenSnowMap ski pistes, requested tile by tile as the camera views them, with no prefetch, bulk download or caching on our side (OpenSnowMap forbids bulk tile download without prior agreement). They drape on the globe on the OSM and Bing stacks and on the Google Photorealistic tileset on Google 3D (see `src/maps/imageryHost.js`). OpenRailwayMap and OpenInfraMap, also requested in #10, are not included: OpenRailwayMap's tile server only answers requests whose Referer is its own site, and OpenInfraMap serves vector tiles that need a vector rendering pipeline.
 - **OpenSky Network.** Its license is **non-commercial**, and operational use of the REST API in a live product can require a prior written agreement with OpenSky — even for non-profit/government use. If you deploy this commercially, contact OpenSky for your own terms. The flights layer is a toggle and runs anonymously by default.
 - **adsb.lol flight fallback.** When OpenSky is unavailable and no last-good OpenSky response exists, the server requests a cached, capped 250 nm adsb.lol point snapshot around the current camera subpoint. This is regional observed context, not worldwide completeness; provenance is exposed in the Flights stats/context row. Military ICAOs remain reconciled through the existing dedicated military registry rather than duplicated.
 <a id="gnss-integrity"></a>
@@ -175,6 +180,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Kartverket ground heights for Statens vegvesen cameras.** The camera feed's points are 2D, so the loader asks Kartverket's keyless point-height API (`ws.geonorge.no/hoydedata/v1/punkt`, CC BY 4.0) for the terrain height at each camera. Requests carry 20 points: the API accepts 50, but above ~20 it answers the extra points from contour lines (`hoydekurver`, metres to ~20 m off) or not at all. Eight requests run at a time, about 36 for the whole country: a cold lookup took 6–13 s in testing (single requests 0.6–9.5 s). Answers are matched by the coordinates the API echoes and recorded only for points that request asked about. Over water the API returns the sea-floor depth (`dybdekurver` or `Havflate`), which is replaced by 0 m, the water surface; for the ~14 bridge cameras that is below the deck, but much closer than the sea floor or the flat prior. Heights are cached in memory by position for the life of the server, and points with no height (a few ferry quays and bridges, or a point a 200 answer leaves out) for 6 h, so the 15-minute catalog refresh only asks about new or moved cameras. The first failing request (a 408, 429 or 5xx, a network error, a request over 10 s, or an unreadable or oversized body) stops the lookup, with no retries, and no new lookup starts until the backoff ends (Retry-After when sent, else 30 min, longer than the refresh; bounded to 1 min–1 h). Any other 4xx marks that request's points as having no height and the lookup carries on. The whole lookup has a 30 s deadline; a lookup cut short by it resumes on the next refresh without a backoff. The lane waits at most 12 s, counted from the start of the loader, and only when more than 10% of the cameras have no answer yet; a few new cameras or expired misses are looked up in the background. A slower lookup keeps filling the cache, and the cameras it had not reached keep the flat prior until the next 15-minute refresh (about 190 of 865 on one slow first run). Only coordinates are sent, with the same User-Agent as the other CCTV requests. `CCTV_VEGVESEN_HEIGHTS=0` turns the lookup off. The Kartverket credit, with a note that heights over water are set to 0 m and heights are rounded to 0.1 m, is shown beside the Statens vegvesen entry in the Data attribution popover.
 - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `[email protected]` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras/<uuid>/image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover.
 - **City of Toronto RESCU cameras.** Keyless. The camera list is the City's public `tmcearthcameras.json` on `opendata.toronto.ca` (dataset "Traffic Cameras", Transportation Services), served as JSONP and unwrapped with an anchored pattern. This is the municipal network the Ontario 511 pack does not carry: downtown arterials plus the Gardiner, DVP, Allen and Lake Shore. The list publishes no frame URL, so frame URLs are BUILT from the documented `CameraImages/loc####.jpg` convention and a strictly-digits camera number, pinning the frame proxy to the portal origin by construction; the list fetch refuses redirects and bounds the body it buffers. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `D1`-`D4` fields are the directions of the *comparison* images (static reference stills captured in 2016 under a different path), not a bearing for the live pan-tilt-zoom frame, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. A camera that is temporarily out of service still answers 200 with a byte-identical "Image Unavailable" placeholder rather than an error (about 6% of the network at any moment), so such a camera reads as healthy; the frame it shows is the agency's, not a synthesized one. The licence requires the attribution statement above. Disable with `CCTV_TORONTO_ENABLED=0`.
 - **Autostrada del Brennero (A22) webcams.** Keyless. The camera list is one request to the Open Data Hub tourism API (`tourism.api.opendatahub.com/v1/WebcamInfo?source=a22`), run by NOI Techpark in South Tyrol, which republishes Autobrennero's own list of 13 motorway webcams with coordinates and kilometre markers. Frames are the operator's stills on `www.autobrennero.it/WebCamImg/km<N>.jpg`, refreshed about once a minute, and only the exact image for each camera's kilometre is registered. The feed names no bearing, so headings use the id-hash fallback at low confidence. The road climbs from about 20 m in the Po valley to about 1,370 m at the Brenner Pass, so each camera's ground elevation comes from a per-kilometre table sampled from the Copernicus GLO-90 DEM (via Open-Meteo's elevation API); a camera not in the table uses a 200 m prior. The Open Data Hub tags every record CC0 (`ClosedData: false`, Autobrennero as licence holder), but that tag is the aggregator's metadata and Autobrennero publishes no terms of its own for the images, so they are credited to the operator as a courtesy and are not redistributed. Frames are fetched at request time and never stored. Disable with `CCTV_A22_ENABLED=0`.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
 - **Transit (GTFS-Realtime).** The proxy requests only registered operator feeds, validates redirects, bounds responses, and uses conditional requests, short snapshot caching and failure backoff. All sixteen registered regions are live-enabled; each can be disabled independently. Vehicles use delayed playback between reports, with report age and waiting states shown separately. Session-local selected trails are available for every feed. MBTA additionally retains up to 15 minutes of recently observed positions in the running proxy, so available history can survive a browser reload; server restart clears it. History reads never fetch upstream, and other feeds have no proxy retention. Nothing is archived to disk or collected in the background. Operator text credits are included as a courtesy and do not imply endorsement. Heights are aligned to work with Google 3D tiles; subway markers are shown at street level because these feeds do not supply depth. The TTC feed is BusTime, the surface system: it carries buses and streetcars and no subway at all. About four in ten of its vehicles report no route at all (unassigned or deadheading), and those are shown with the feed default rather than a route-established mode. It sends no ETag or Last-Modified, so its conditional requests fall through to the ordinary snapshot cache. Three Golden Horseshoe neighbours run alongside it — MiWay, Hamilton HSR and Durham Region Transit — each bus-only and each polled only near its own region. Durham Region Transit publishes no bearing on any vehicle, so those sprites take their heading from observed movement like any other feed that omits it. Guelph, Kingston and Barrie extend the same pattern eastward and north. Hamilton, Guelph, Burlington and YRT publish route ids that are not the number on the vehicle, so those entries carry a route-name table taken from each operator’s own published GTFS; any id missing from a table renders unchanged rather than blank. A label is never invented: YRT runs a route `9101` that appears nowhere in its published routes, so it stays as the feed sends it. Burlington’s is the one that cannot be shortcut: `351` is route 1 while `3510` is route 10, so the table is a real join rather than a trimmed prefix. GO Transit / Metrolinx is deliberately absent: its REALTIME feed requires an API key issued by manual review, which the keyless admission rule excludes (its static schedule download is keyless, but carries no vehicle positions). Barrie and YRT/Viva each invite acceptance of their licence through a form, and each licence also states that using the data is itself acceptance; this deployment relies on that clause, which is recorded in both entries. Grand River Transit in Waterloo is absent for a different reason: it answers, but its feed header was months stale and it publishes no per-vehicle timestamps, so it would render vehicles that look live and are not. Ottawa’s OC Transpo falls to the same keyless admission rule as GO Transit — its realtime feed requires an API key. London Transit and Thunder Bay Transit publish vehicle positions over plain HTTP with no HTTPS endpoint available. Every other Ontario system — Brampton, Oakville, Niagara, Milton, Windsor, Greater Sudbury, UP Express and a dozen smaller operators — publishes static GTFS schedules only, with no realtime vehicle positions to register. Between the nine included and these exclusions, every Ontario realtime vehicle-position feed catalogued in the Mobility Database is accounted for.
 - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and non-array or empty successful payloads are rejected atomically. Individual structurally malformed rows are skipped rather than failing the whole query; the response carries their bounded `rejectedStationCount` (at most 10,000), which the client adds to its own rejected rows and reports as degraded coverage without discarding the accepted generation. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply.
@@ -183,7 +189,8 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Re:Earth Terrain.** Keyless (no API key). Used two ways: (1) `src/mapStackController.js` swaps in a `Cesium.CesiumTerrainProvider` pointed at Re:Earth's `cesium-mesh/ellipsoid` quantized-mesh endpoint for globe stacks without a Cesium ion token (e.g. OSM), replacing a flat `EllipsoidTerrainProvider`; falls back to the flat provider if the endpoint can't be reached. (2) The server-side `/api/terrain/heights` proxy (disk-cached, serve-stale) resolves per-point ellipsoidal ground height for entity placement. Both are best-effort with a keyless-safe fallback (bundled EGM96 geoid math) if Re:Earth is unreachable.
 - **OSRM on the FOSSGIS routing servers.** Keyless (no API key). Every route is requested by a person: clicking A and B in the Directions layer, or a voice "route from A to B". The server-side `/api/route` proxy sends an identifying `User-Agent`, pins the upstream host, accepts 2-12 coordinates, rejects any leg over 600 km or a total over 2,500 km, caps the buffered response at 8 MB, times the upstream out at 12 s, rate-limits per client, caches each route for 10 minutes, and coalesces identical requests that are in flight at the same time. Turn-by-turn maneuvers are asked for only when a caller wants them (`steps=1`), so the callers that do not read them send the smaller request. The "fix the map" link the policy asks for is in the Data attribution popover beside the OpenStreetMap credit.
 - **Mapped installations.** OpenFreeMap military polygons use a bundled Overture/OSM name index; wide views show named points. Optional operator-configured Overpass and explicit Google Places searches keep their own source paths. Mapped data does not establish current activity or complete coverage.
- **Place search.** Named-place fly-to uses Google Geocoding when a Maps key is configured, then Photon's public instance, then `/api/geocode` (Nominatim search) when neither answers. `/api/geocode` uses the shared Nominatim forward-search queue at no more than one request per second, sends an identifying `User-Agent` and `Referer`, caches answers for five minutes, shares one upstream call between identical searches already in flight, bounds the queue so a burst is refused rather than held, and drops a queued search whose caller has given up. It asks for one result per search and is not used for systematic or bulk queries.
+- **Place search.** Named-place fly-to uses Google Geocoding when a Maps key is configured, then Photon (`PHOTON_URL`; unset uses the public instance, empty disables it), then `/api/geocode` (Nominatim search) when neither answers. `/api/geocode` and the voice outline route `/api/geocode/outline` share one Nominatim queue (`NOMINATIM_URL`; unset, empty and invalid values disable it; an operator must explicitly select an authorized endpoint): one request at a time at least 1.1 s apart, an identifying `User-Agent` and `Referer`, a short queue that refuses a burst, a pause after 429/403/5xx answers (honouring `Retry-After` in full), at most one retry after a network failure, and a per-install daily cap on public-instance requests (`NOMINATIM_DAILY_CAP`, default 50). Processes using the same installation state file hold one lock through the actual fetch invocation and recording the next public start, with the daily slot persisted before invocation; restarts share that count, spacing and any pause. An unfinished dispatch marker fails closed until operator recovery; it is never automatically reclaimed. Public access fails closed if the state file cannot be read, locked, written or semantically validated. This coordination does not span independent installations or state directories and does not establish an application-wide public-service allowance or authorize public use. An operator-selected non-public endpoint is outside the public cap, spacing and durable-state requirement; an upstream cooldown is kept with the endpoint that returned it rather than leaking across operator URLs. Answers are cached on disk (outlines 90 days, places 30 days, no-results 24 hours); failures are not cached. Outlines are looked up only for an explicit ask, after bundled data and any configured Overpass, and only results whose type suits the ask are used. Administrative outline responses expose country/admin-1/admin-2 identity only when the selected Nominatim row has a recognized, unambiguous address type consistent with its own name; numeric rank, ambiguous types, missing fields and contradictory names do not manufacture identity. It is not used for systematic or bulk queries.
 - **Street and building outlines.** Voice street highlights, pointed-at buildings and grounds use the OpenFreeMap vector tiles the traffic layer already loads. Traffic and outlines share one bounded pending fetch/decode owner per immutable XYZ tile; materialized outline geometry is charged to the retained-byte ceiling and capped by coordinate count. Consumer result caches and request lifetimes remain independent, while eviction or explicit teardown cancels queued idle projections and releases their decoded owner. No Overpass request is made unless `OVERPASS_UPSTREAMS` is configured. Named grounds require a returned name matching the selected place, except that an ask whose head noun names a kind of grounds (a school, university or college, hospital, cemetery, stadium or zoo) may use the part of the smallest unnamed tile area of that class that holds the resolved place; a differently named area never answers. Other anonymous landcover polygons cannot establish identity, so unsupported grounds stay unavailable rather than borrowing a nearby POI name.
 - **Cockpit regional briefing.** `/api/regional-brief` rounds aircraft coordinates into 0.1° cache cells, caches results for five minutes, and resolves physical regions from bundled public-domain Natural Earth polygons without reverse-geocoding requests. Google News RSS is queried with the resolved locality/region first; GDELT is used only when that RSS query fails or is empty. Google's published Google News terms restrict that source to personal, noncommercial use, so commercial deployments must disable/replace it or obtain separate permission; GDELT permits commercial dataset use with citation. The Data attribution popover identifies the active headline sources; article links retain publisher attribution. Headlines are location-query matches, not verified incidents, risk rankings, or evidence that a location is safe. Empty, partial, stale, and unavailable source states remain distinct. Open-Meteo supplies current conditions independently of the news source. `WX OFF` disables cockpit weather rendering only; the Local Info briefing still fetches its source-backed weather values and displays the required linked Open-Meteo credit.
 - **Dynamic weather presentation.** While cockpit mode is active, `/api/weather-effects` requests current Open-Meteo observations for the aircraft/camera location, rounds coordinates into 0.1° cache cells, caches results for five minutes, and may retain a stale observation for up to 30 minutes during a transient outage. WMO condition code selects the visual family; observed cloud cover, precipitation, visibility, wind speed, and wind direction bound its strength and motion. Missing or expired weather renders no synthetic atmospheric effect, and normal globe view never renders the weather overlay.
@@ -205,6 +212,8 @@ The [Bhote Koshi event pack](public/events/bhote-koshi-2026/README.md), under `p
 | **DataSF Analysis Neighborhoods** (41 SF neighborhood polygons)             | `neighborhoods/`                  | **PDDL 1.0** (public domain)                                                                              | ✅ (no restrictions)                             | "City & County of San Francisco — DataSF" (courtesy — not legally required) |
 | **Natural Earth countries, states and provinces** (260 admin-0/map units + 4,587 admin-1 polygons)             | `natural_earth/`                  | **Public domain**                                                                                         | ✅ (no restrictions)                             | "Made with Natural Earth" (courtesy credit — not legally required)          |
 | **US Census Bureau counties** (3,235 county polygons)                       | `us_census_counties/`             | **Public domain**                                                                                         | ✅ (no restrictions)                             | "U.S. Census Bureau" (courtesy — not legally required)                      |
 | **US Census Bureau places** (32,629 city, town and CDP polygons)            | `us_census_places/`               | **Public domain**                                                                                         | ✅ (no restrictions)                             | "U.S. Census Bureau" (courtesy — not legally required)                      |
 | **Who's On First neighborhoods** (61,441 polygons)                          | `wof_neighborhoods/`              | Per source: CC BY, ODC-By, Open Government licences, CC0, PDDL, public domain (folder `ATTRIBUTION.md`)   | ✅ (attribution)                                 | "Neighborhood boundaries: Who's On First and contributors"; per-source credits in the folder |
 | **Yale Bright Star Catalogue** (9,096 stars, sky background)                | `sky/`                            | **Public domain**                                                                                         | ✅ (no restrictions)                             | "Yale Bright Star Catalogue (Hoffleit & Warren, via CDS)" (courtesy credit) |
 | **ESO Milky Way panorama** (eso0932a, blurred cube map, sky background)     | `sky/`                            | **CC BY 4.0**                                                                                             | ✅ (attribution; changes stated)                 | "ESO/S. Brunier"                                                            |
 | **CCTV ground heights** (3,445 cameras)                                     | `cctv_ground_heights/`            | Precomputed camera placement heights, aligned to work with Google Photorealistic 3D Tiles (folder README) | —                                                | —                                                                           |
@@ -301,6 +310,15 @@ the retrieval date (2026-07-30), exact download URL, license evidence, and the
 deterministic transform (`scripts/build-sf-neighborhoods.mjs`: `nhood` → `name`, ~2 m
 Douglas-Peucker simplification, 6-decimal rounding).
 ### Local CCTV source packs (`config/`)
 The server can read a local camera list from `CCTV_SOURCES_FILE` (default
 `config/cctv_sources.austin.json`, which ships empty) and inline JSON from
 `CCTV_SOURCES_JSON`; the two are merged, and inline entries win on a duplicate
 id. A non-empty local pack replaces the live open-data camera packs unless
 `CCTV_FORCE_AUSTIN=1` is set. The packs under `config/` show the schema, and a
 pack's cameras keep their own source's license and attribution.
 ---
 ## Weather sources
@@ -4,7 +4,7 @@
 # proxies (ADS-B, AIS, Overpass, OpenAI Realtime, ...) as middleware, so there
 # is nothing else to containerise. See compose.yaml for the usual entry point.
 # Same Node as CI (package.json engines, .github/workflows), pinned by digest.
-FROM node:24.14.0-slim@sha256:d8e448a56fc63242f70026718378bd4b00f8c82e78d20eefb199224a4d8e33d8
+FROM node:24.22.2-slim@sha256:c86ecead9e55a5210ac1727de38a4ca840bf03dcaf34dc9749addbf383b1920c
 # Puppeteer is only used by the QA scripts; skip its ~150MB Chromium download.
 ENV PUPPETEER_SKIP_DOWNLOAD=1
@@ -61,7 +61,7 @@ Start with the included data sources, then add your own. Each layer is a separat
 - **🎯 Click-to-track anything:** Camera locks on, draws a fading trail, surfaces full metadata — and a tracked fire or vessel hands you off to the nearest live camera in one click.
 - **🖊️ Voice whiteboard:** Speak annotations onto the world — real boundary polygons, marks, and routes.
 - **🛫 3D hangar:** Real per-class aircraft models — 787, ATR-72, Citation, Bell 206, MQ-9 — and a tracked contact swaps from glyph to 3D model as you close in.
- **🎨 Reskin reality:** GLSL sensor looks over the normal globe — CRT, NVG, FLIR/thermal, Noir, Snow.
+- **🎨 Reskin reality:** GLSL sensor looks over the normal globe — CRT, NVG, FLIR/thermal, Noir.
 - **🟩 Detection overlay:** Screen-space bounding boxes and IDs on everything in view.
 - **🎖️ Military HUD:** Tactical heads-up display with intelligence-style telemetry.
 - **🌐 Global Context:** Stage the full situational picture with one switch — and get your exact view back when you leave.
@@ -89,7 +89,7 @@ Start with the included data sources, then add your own. Each layer is a separat
 ## ⚡ Quick Start
-**Start without an account or API keys.** Both paths open the same app with
+**Local setup needs no account or API keys.** The app opens with
 Esri satellite imagery and keyless terrain. OSM is the fallback if Esri is
 unreachable. Flights, military traffic, satellites, earthquakes, public
 cameras, radio, and launches are available without keys.
@@ -129,8 +129,9 @@ hardware; it does not establish a minimum GPU requirement.
 ### Path 2 — Terminal / coding agent
-Use **Node.js 24.x (24.14.0 or later) or 26.x**. The setup doctor warns about
+Use **Node.js 24.x (24.14.0 or later) or 26.x**; 24.22.1 or later (26.12.1 or
-Node 25, which is end-of-life.
+later on 26) includes the October 21, 2026 security fixes, among them
 CVE-2026-111497. The setup doctor warns about Node 25, which is end-of-life.
 ```bash
 git clone https://github.com/bilawalsidhu/gods-eye-view.git
@@ -233,10 +234,48 @@ the container.
 </details>
 ### Path 4 — GitHub Codespaces (cloud, no local install)
 Codespaces requires a GitHub account. Overpass queries and OpenAI voice token
 requests return HTTP 403 through its forwarded HTTPS URL, even with API keys
 in `.env` and `GEV_ALLOWED_HOSTS` configured. Use a local setup for these features.
 The codespace runs the dev server in a cloud workspace, so Node and the dependencies
 never touch your machine. The globe still renders in your own browser, so it
 needs the same graphics there as any other path. GitHub Free includes 120
 core-hours a month with no card on file — about 60 hours on the default 2-core
 machine. Org and Enterprise plans include no free quota; current terms and
 quotas apply.
 1. Fork this repository, then open **your fork** on GitHub.
 2. Click the green **Code** button, the **Codespaces** tab, then **Create codespace on main**.
 3. In the codespace terminal:
   ```bash
   nvm install 24 && nvm use 24
   npm ci
   npm run doctor
   GEV_ALLOWED_HOSTS="$CODESPACE_NAME-4173.$GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN" npm run dev
   ```
 4. Open the **Ports** tab, find `4173`, and click the globe icon to open it in
   the browser. The port is private by default, so the URL asks for your GitHub
   login. Keep it private: a public port lets anyone use the app and the keys
   in your `.env`.
 `GEV_ALLOWED_HOSTS` there is required, not optional. The dev server answers only
 the hostnames it trusts, and a forwarded port arrives on
 `$CODESPACE_NAME-4173.$GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN`. Without it the
 page is `Blocked request. This host is not allowed.` Leading-dot wildcards are
 ignored on purpose, so pass that exact name.
 ⚠️ **A codespace is reachable from the internet.** Treat it as the
 wider-publish case in [Sharing an instance](#-sharing-an-instance). Provider
 Settings is unavailable on the forwarded URL. Never commit your workspace
 `.env`. [SECURITY.md](SECURITY.md) has the threat model.
 ### Then power it up — in the app, not in a file
-Keys are upgrades, not prerequisites. When you want one, click the **POWER UP**
+For a local setup, keys are upgrades, not prerequisites. When you want one,
-chip in the bottom-right corner: Provider Settings lists every supported key,
+click the **POWER UP** chip in the bottom-right corner: Provider Settings lists every supported key,
 what it switches on, and where to get it. Paste, hit **SAVE KEYS**, and the app
 restarts itself with the new capability on. Once everything is configured the
 chip reads **POWERED UP** — and if a compact layout hides it, `?setup=1`
@@ -294,14 +333,14 @@ Choose a first-run mission, or try these in order. The GIFs show Google Photorea
 ![Tracking the ISS along its orbital path as it crosses over Ukraine](docs/media/14-iss-over-ukraine.gif)
-6. **Switch the optics.** Tap `1`–`7` — CRT, NVG, FLIR — and the whole live planet re-renders through a different sensor.
+6. **Switch the optics.** Tap `1`–`6` — CRT, NVG, FLIR — and the whole live planet re-renders through a different sensor.
 ![Cycling a dense live globe through CRT, FLIR, and NVG in one continuous view](docs/media/01-style-sweep.gif)
 7. **Talk to it** _(needs an OpenAI key)_: _"Take me to LAX and select the nearest airborne aircraft."_
 8. **Come home.** Hit **Reset Globe** — or just say _"zoom out to a globe view."_
-**Keyboard:** `1`–`7` visual styles · `H` HUD · `D` detection · `C` cockpit · `` ` `` frame rate · `Esc` out. Trackpad pinch zooms the globe.
+**Keyboard:** `1`–`6` visual styles · `H` HUD · `D` detection · `C` cockpit · `` ` `` frame rate · `Esc` out. Trackpad pinch zooms the globe.
 ---
@@ -357,7 +396,7 @@ camera input stops rotation.
 > 🗣️ _"Outline the state of Texas."_ · _"Annotate the Texas State Capitol and its grounds"_ — it draws the **actual enclosing boundary**, not a circle. · _"How far is the Eiffel Tower from the Louvre?"_ — a connector arrow appears and it speaks the distance. Everything persists until you say _"clear the map."_
-**✍️ Or draw it yourself** — DISPLAY ▸ **Draw**: pick Area, Line or Pin, click the vertices on the real world, double-click to finish, label it. Same whiteboard, same persistence, no microphone needed.
+**✍️ Or draw it yourself** — UTILITIES ▸ **Draw**: pick Area, Line or Pin and a colour, click the vertices on the real world, double-click to finish, then name, recolour, hide or fly to each shape from its row. Same whiteboard, same persistence, no microphone needed.
 ![Zilker Park and Lady Bird Lake drawing onto the 3D city as persistent vector annotations, by voice](docs/media/01-voice-annotate-zilker.gif)
@@ -399,7 +438,7 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 | 🌍 **Earthquakes**          | Global seismic activity, last 24h                                                                                                                                                                                                                                                                                                                                                   | USGS                                    | 🟢                                                                                                  |
 | ◍ **Air quality**           | Live AQHI on the published 1–10+ health-risk scale, with a Weather-panel card showing the band legend and the highest readings in view. **Canada only** — ECCC is the first registered provider | ECCC MSC GeoMet                          | 🟢                                                                                                  |
 | 🚗 **Traffic**              | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations                                                                                                                                                                                                       | TomTom + OSM                            | 🟢 simulation · 🟡 live flow speeds                                                                 |
-| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed) and opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
+| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC) · Italy (A22 Brennero motorway), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed) and opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
 | 📷 **Mapped ALPR Cameras**  | License-plate-reader camera locations tagged by OpenStreetMap contributors, loaded one city-sized view at a time, with **SHOW NEAREST**. Locations and tags only: no plate data, no video                                                                                                                                                                                           | OpenStreetMap (incl. DeFlock mapping)   | 🟢                                                                                                  |
 | 📷 **Street Level**         | Street-level photos behind one panel, one chip per provider: coverage on the streets, image cones, an embedded viewer with full-screen **EXPAND**. Mapillary, Google Street View, KartaView and Panoramax | Mapillary · Google · KartaView · Panoramax | 🟢 KartaView, Panoramax · 🟡 Mapillary token · 🔴 Google Maps key |
 | 📻 **Radio**                | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster                                                                                                                                                                                                                                                 | Radio Browser / broadcasters            | 🟢                                                                                                  |
@@ -415,7 +454,7 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 **Weather, keyless.** **Wind** animates 10 m forecast flow from NOAA GFS or ECMWF IFS, with an optional color field and a reading at map center. **Rain radar**, **Satellite clouds** and **Lightning density** are observations on one history timeline in the **WEATHER** panel (step back, **Play**, **Latest**); **Cyclone advisories** draw NHC and CPHC positions, forecast tracks and cones. On Google 3D Tiles the observed layers float above the city as translucent shells, sharpened around your view.
-In the app, **Data Layers** groups them as Movement, Cameras, Infrastructure, Events, Weather and Utilities.
+In the app, **Data Layers** groups them as Movement, Cameras, Infrastructure, Events, Weather and Audio; Directions sits in the separate **Utilities** panel with Draw and Import.
 **The basemap ladder — what each tier buys you:**
@@ -491,12 +530,12 @@ How the globe handles live data:
 - **Sits on the real ground.** Entity heights are aligned to work with Google 3D tiles, so aircraft park on aprons and cameras stand on street corners instead of floating.
 - **Caching and request budgets.** An OpenSky credit governor, a TomTom daily tile budget, and disk-cached TLEs reduce repeated requests. These controls do not replace provider quotas or billing controls.
 - **Server-side credentials.** Every API that touches a private key (OpenAI, AISStream, OpenSky OAuth, camera frames) is brokered through a hardened server-side proxy with SSRF protection, response caps, and sanitized errors. The only keys the browser sees are Google Maps and Cesium ion (restrict both at the provider).
- **No framework.** Vanilla JavaScript, **CesiumJS**, and **Vite** — plus **Google Photorealistic 3D Tiles** for the planet and the **OpenAI Realtime API** for voice. Fast to read, fast to hack on.
+- **A small stack.** **Vue 3** and **Pinia** for the interface, **CesiumJS** for the globe and **Vite** to build it — plus **Google Photorealistic 3D Tiles** for the planet and the **OpenAI Realtime API** for voice. Fast to read, fast to hack on.
 ```
 src/
 ├── main.js                 # Bootstrap: Google 3D tiles, layer registration
-├── ui/                     # Runtime UI — panels, HUD, styles, controls
+├── ui/                     # Runtime UI — Vue views, Pinia stores, kit, controllers, styles
 ├── hud.js                  # Intelligence HUD + AI scene summary
 ├── keySetup.js             # POWER UP panel — in-app provider keys (dev server only)
 ├── mapStackController.js   # Basemap switching — Google 3D / Esri / OSM / ion stacks
@@ -1,40 +0,0 @@
 import { readFileSync } from 'node:fs';
 export const APPLICATION_TEMPLATES = Object.freeze([
  'scene-chrome',
  'cockpit',
  'display-controls',
  'command-dock',
  'layer-panels',
  'context',
  'welcome',
  'provider-settings',
  'hud-loading',
 ]);
 const allowed = new Set(APPLICATION_TEMPLATES);
 /** Expand only known component templates; markers cannot name filesystem paths. */
 export function expandApplicationHtml(html) {
  return html.replace(
    /^[ \t]*<!-- gev:template ([^\s]+) -->\r?\n?/gm,
    (_, name) => {
      if (!allowed.has(name))
        throw new Error(`Unknown application template: ${name}`);
      return readFileSync(
        new URL(`../src/ui/templates/${name}.html`, import.meta.url),
        'utf8',
      );
    },
  );
 }
 /** Assemble static application markup before Vite processes scripts and assets. */
 export function applicationHtmlPlugin() {
  return {
    name: 'application-component-templates',
    transformIndexHtml: {
      order: 'pre',
      handler: expandApplicationHtml,
    },
  };
 }
@@ -0,0 +1,8 @@
 import { registerHooks } from 'node:module';
 import { load } from './vueLoader.js';
 // Lets Node import single-file components: `node --import=<this file>`.
 // Hosts reach it as `<core package>/build/register-vue`. The hooks run on the
 // loading thread: off-thread hooks (module.register) would add a round trip
 // to every module a test imports, not only the components.
 registerHooks({ load });
@@ -1,6 +1,7 @@
 import { fileURLToPath } from 'node:url';
 import { applicationHtmlPlugin } from './application-html.js';
 import cesium from 'vite-plugin-cesium';
 import vue from '@vitejs/plugin-vue';
 import { VUE_PLUGIN_OPTIONS } from './vueOptions.js';
 import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
 import { embedFramingPlugin } from './embed-framing.js';
 import { panelBuildPlugin } from './panel.js';
@@ -24,6 +25,32 @@ export function escapeFsDenyPath(path) {
 const REPO_ROOT_GLOB = escapeFsDenyPath(REPO_ROOT);
 /**
 * Browser-safe form of the optional Photon endpoint build input. Only https
 * is accepted: the page's connect-src allows no plain-http origin, so an
 * http endpoint would only fail later, silently, in the browser.
 */
 function photonEndpointSetting(value) {
  if (value === undefined) return undefined;
  const text = String(value ?? '').trim();
  if (!text || ['off', 'none', 'disabled'].includes(text.toLowerCase()))
    return null;
  try {
    const url = new URL(text);
    if (
      url.protocol !== 'https:' ||
      url.username ||
      url.password ||
      url.search ||
      url.hash
    )
      return null;
    return url.href;
  } catch {
    return null;
  }
 }
 /**
 * Content-Security-Policy for every document the dev/preview server serves.
 * No inline script is permitted, and the only foreign script origins are the
@@ -142,12 +169,14 @@ export function createBrowserViteConfig({
  publicDir,
  googleApiKey,
  cesiumToken,
  photonUrl,
  mapillaryToken,
  host = 'localhost',
  port = 4173,
  allowedHosts = DEFAULT_ALLOWED_HOSTS,
  command,
 } = {}) {
  const photonSetting = photonEndpointSetting(photonUrl);
  return {
    plugins: [
      // First, so every API response, including a Host refusal, carries them.
@@ -155,7 +184,8 @@ export function createBrowserViteConfig({
      // Next, so no provider route answers a Host the server does not allow.
      hostCheckPlugin(),
      cesium(),
-      applicationHtmlPlugin(),
+      // Application views are Vue single-file components.
      vue(VUE_PLUGIN_OPTIONS),
      ...plugins,
      embedFramingPlugin(),
      panelBuildPlugin(),
@@ -209,8 +239,20 @@ export function createBrowserViteConfig({
    // framing + CSP hardening (one constant, no drift).
    preview: { headers: BROWSER_HEADERS },
    define: {
      // vue-i18n holds the locale and catalogs; Core formats the messages
      // (src/ui/i18n.js), so the build drops vue-i18n's message compiler.
      __VUE_I18N_FULL_INSTALL__: 'false',
      __VUE_I18N_LEGACY_API__: 'false',
      __INTLIFY_PROD_DEVTOOLS__: 'false',
      __INTLIFY_DROP_MESSAGE_COMPILER__: 'true',
      'import.meta.env.GOOGLE_MAPS_API_KEY': JSON.stringify(googleApiKey),
      'import.meta.env.CESIUM_ION_TOKEN': JSON.stringify(cesiumToken),
      // Only expose a validated URL or the explicit disabled sentinel.
      ...(photonSetting === undefined
        ? {}
        : {
            'import.meta.env.PHOTON_URL': JSON.stringify(photonSetting),
          }),
      // Mapillary client tokens are public by design (see SECURITY.md).
      'import.meta.env.MAPILLARY_CLIENT_TOKEN': JSON.stringify(
        mapillaryToken ?? '',
@@ -0,0 +1,170 @@
 import { createHash, randomBytes } from 'node:crypto';
 import {
  lstatSync,
  mkdirSync,
  readFileSync,
  renameSync,
  rmSync,
  writeFileSync,
 } from 'node:fs';
 import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { VUE_TEMPLATE_OPTIONS } from './vueOptions.js';
 const require = createRequire(import.meta.url);
 // The compiler loads on the first component that is not cached, so a test
 // process that imports no views, or only cached ones, never pays for it.
 let compiler = null;
 const sfcCompiler = () => (compiler ??= require('vue/compiler-sfc'));
 /**
 * Compile a single-file component to an ES module for Node, so unit tests (the
 * application's and a host's) can import components without a bundler.
 * Styles are dropped: tests read the global stylesheet separately.
 */
 export function compileVueModule(source, filename) {
  const { compileScript, compileTemplate, parse } = sfcCompiler();
  // The template is parsed with the SFC; parse it as the browser build does.
  const { descriptor, errors } = parse(source, {
    filename,
    templateParseOptions: VUE_TEMPLATE_OPTIONS.compilerOptions,
  });
  if (errors.length) throw errors[0];
  const id = filename;
  if (descriptor.scriptSetup) {
    return compileScript(descriptor, {
      id,
      inlineTemplate: true,
      templateOptions: VUE_TEMPLATE_OPTIONS,
    }).content;
  }
  const script = descriptor.script
    ? compileScript(descriptor, { id, genDefaultAs: '__sfc__' }).content
    : 'const __sfc__ = {};';
  let template = '';
  if (descriptor.template) {
    const compiled = compileTemplate({
      source: descriptor.template.content,
      filename,
      id,
      ...VUE_TEMPLATE_OPTIONS,
    });
    if (compiled.errors.length) throw compiled.errors[0];
    template = compiled.code;
  }
  return `${script}\n${template}\nif (typeof render === 'function') __sfc__.render = render;\nexport default __sfc__;\n`;
 }
 // The loader's own code is part of every key, so a change to how components
 // compile never reuses output from before it.
 let loaderFingerprint = null;
 const fingerprint = () =>
  (loaderFingerprint ??= createHash('sha256')
    .update(readFileSync(fileURLToPath(import.meta.url)))
    .update(readFileSync(new URL('./vueOptions.js', import.meta.url)))
    .update(require('vue/package.json').version)
    .digest('hex'));
 /**
 * Where compiled components are kept between test processes, never a
 * package's own tree (a host's checks refuse files inside Core): the system
 * temp directory, or on Windows the per-user local app data directory, since
 * a temp directory there may be shared and its ownership is not checked.
 * GEV_VUE_CACHE=0 compiles every time.
 */
 export function vueCacheDirectory(
  env = process.env,
  platform = process.platform,
 ) {
  if (env.GEV_VUE_CACHE === '0') return null;
  if (platform === 'win32') {
    return env.LOCALAPPDATA ? path.join(env.LOCALAPPDATA, 'gev-vue-sfc') : null;
  }
  return path.join(tmpdir(), `gev-vue-sfc-${process.getuid()}`);
 }
 /** The cache entry for one component: its path, its text and the loader. */
 export function vueCacheKey(source, filename) {
  return createHash('sha256')
    .update(JSON.stringify([fingerprint(), filename]))
    .update('\0')
    .update(source)
    .digest('hex');
 }
 /**
 * Compile a component, reusing a previous process's result for the same text.
 * A cache that cannot be read or written only costs the compile.
 */
 export function cachedVueModule(
  source,
  filename,
  directory = vueCacheDirectory(),
 ) {
  if (!directory || !ownCacheDirectory(directory)) {
    return compileVueModule(source, filename);
  }
  const entry = path.join(directory, `${vueCacheKey(source, filename)}.mjs`);
  try {
    return readFileSync(entry, 'utf8');
  } catch {
    // Not compiled yet.
  }
  const compiled = compileVueModule(source, filename);
  // Concurrent test processes and threads may compile the same component;
  // each writes its own new file and the rename makes the entry appear whole.
  const partial = `${entry}.${randomBytes(6).toString('hex')}.tmp`;
  try {
    writeFileSync(partial, compiled, { flag: 'wx', mode: 0o600 });
    renameSync(partial, entry);
  } catch {
    // An unwritable directory, or a rename another process holds open,
    // leaves the cache without this entry.
    try {
      rmSync(partial, { force: true });
    } catch {
      // A partial file that cannot be removed is only clutter.
    }
  }
  return compiled;
 }
 /**
 * Cached modules run as code, so the directory must be this user's own: a
 * real directory (not a link), owned by the current user and writable by no
 * one else. In a shared temp directory another user could otherwise create it
 * first and plant modules. On Windows it sits in the user's own profile.
 */
 const checkedDirectories = new Map();
 export function ownCacheDirectory(directory) {
  if (!checkedDirectories.has(directory)) {
    checkedDirectories.set(directory, isOwnDirectory(directory));
  }
  return checkedDirectories.get(directory);
 }
 function isOwnDirectory(directory) {
  try {
    mkdirSync(directory, { recursive: true, mode: 0o700 });
    const stats = lstatSync(directory);
    if (!stats.isDirectory()) return false;
    if (process.platform === 'win32') return true;
    return stats.uid === process.getuid() && (stats.mode & 0o022) === 0;
  } catch {
    return false;
  }
 }
 /** Synchronous module hook (module.registerHooks): `.vue` loads compiled. */
 export function load(url, context, nextLoad) {
  if (!url.endsWith('.vue')) return nextLoad(url, context);
  const filename = fileURLToPath(url);
  return {
    format: 'module',
    source: cachedVueModule(readFileSync(filename, 'utf8'), filename),
    shortCircuit: true,
  };
 }
@@ -0,0 +1,16 @@
 /**
 * Template options shared by the browser build, the boundary check and the
 * unit-test loader. Whitespace between nodes is kept (as a single space) so
 * an application view renders as its static markup did; Prettier formats
 * single-file components with strict whitespace sensitivity to match. Asset
 * URLs such as `/pin.svg` stay literal instead of becoming module imports.
 */
 export const VUE_TEMPLATE_OPTIONS = Object.freeze({
  compilerOptions: Object.freeze({ whitespace: 'preserve' }),
  transformAssetUrls: false,
 });
 /** `@vitejs/plugin-vue` options for application builds. */
 export const VUE_PLUGIN_OPTIONS = Object.freeze({
  template: VUE_TEMPLATE_OPTIONS,
 });
@@ -0,0 +1,4 @@
 - Director clock listeners, interaction observers and scene release failures
  no longer leave the director inconsistent: each scene is released once, and
  a phase error is kept (with the release failure logged) when cleanup also
  fails (deepeshbind, #1014).
@@ -1,12 +0,0 @@
 - `aircraft_in_area` and `vessels_in_area` take `group_by` and `stats`, so an
  MCP client can ask which airlines, countries, aircraft types or ship types
  dominate an area, or the average altitude or speed, over every match instead
  of estimating from the returned rows. Airlines come from the ICAO designator
  in each callsign (SWA1234 counts as SWA), so the breakdown works on feeds
  that report no operator; operator and type are counted only where the feed
  reports them. Ship types count by family, so AIS codes 70 to 79 are all
  cargo; type 0 ("not available") and the reserved codes 100 to 255 count as
  unknown. Altitude and speed stats cover airborne aircraft only, so parked
  aircraft do not pull the means down. Every vessel answer, `find_vessel`
  included, now reads AIS ship-type codes as their family and a destination
  with no letters as unknown (quanticsoul4772, #1056).
@@ -1,4 +0,0 @@
 - On Windows, `npm run doctor` and the Pinokio install no longer print Node's
  DEP0190 warning ("Passing args to a child process with shell option true can
  lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
  the shell command string instead of an argument array (quanticsoul4772, #1057).
@@ -1,3 +0,0 @@
 - Keyless standalone startup answers an unavailable Google tile-token endpoint
  with uncached 204 instead of a browser-visible 404. Existing providers take
  precedence, and unrelated API routes behave as before. (dvilrgamerz, #1066)
@@ -1,3 +0,0 @@
 - Location search accepts two-dimensional WGS84 `geo:` URIs offline, with
  the existing coordinate framing and label. Unsupported URI fields are passed
  to the remaining search providers unchanged (cj-vana, #1071).
@@ -0,0 +1,4 @@
 - FIRMS fire data loads on hosts where IPv6 is unreachable and IPv4 is slow to
  connect: a request whose every address fails to connect retries once over
  IPv4, and FIRMS warnings name the underlying connection errors instead of
  only `fetch failed` (jeffblakely, #1078).
@@ -0,0 +1,4 @@
 - Keep every submarine-cable segment associated with its source feature after
  Cesium expands multipart geometry, correcting segment colors, click destinations
  and horizon culling while retaining one reference stem per feature
  (@Aliciawque, #1093).
@@ -1,4 +0,0 @@
 - Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
  #1094).
@@ -1,3 +0,0 @@
 - Military aircraft keep their last heading and speed when an adsb.lol row omits
  `track` or `gs`, instead of turning north and stopping; a grounded row without
  a speed still reads 0 (Aditya, @Rohilalala, #1096).
@@ -1,5 +0,0 @@
 - Overpass data whose element tags contain a failure phrase ("timed out",
  "runtime error", "too many requests" and similar, e.g. a place named "Timed
  Out Escape Rooms") is returned as data instead of being refused and putting
  the endpoint on cooldown; upstream failures are read from the remark (Aditya,
  @Rohilalala, #1097).
@@ -1,3 +0,0 @@
 - Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
  spliced catalog cannot pair one satellite's elements with another's; the next
  valid set still parses (VG31OP, #1101).
@@ -1,5 +0,0 @@
 - A failed Esri Satellite or keyless terrain load still shows OSM or flat terrain
  at once, but no longer lasts the whole session: while the fallback is on
  screen, the real provider is retried in the background (30 seconds, doubling
  to a 10-minute cap) and replaces it live once it loads. Map switches never
  wait for a retry (Aditya, @Rohilalala, #1111).
@@ -1,2 +0,0 @@
 - Exclude aircraft without a reported altitude from requested altitude bands;
  unfiltered aircraft queries still retain them (rudycelekli, #1115).
@@ -1,3 +0,0 @@
 - Release superseded Google Street View open waits and suppress metadata
  requests whose viewer was unmounted while the service loaded (rudycelekli,
  #1117).
@@ -1,3 +0,0 @@
 - Label camera-tool Street View fallbacks as historical Google imagery rather
  than the current camera view; keep unknown frame provenance explicit
  (rudycelekli, #1118).
@@ -1,5 +0,0 @@
 - Scenes keep the "Scene not saved" status when a capture, update, append or
  import cannot be saved, and an unreadable saved project no longer overwrites
  the recovery checkpoint. `startScene()` resolves to its documented result,
  `afterShotId` works without an explicit scene, and `scenesRun` counts the
  distinct scenes queued (djabhi31, #1135).
@@ -0,0 +1,3 @@
 - Add Sea Marks (OpenSeaMap) and Ski Pistes (OpenSnowMap) as two raster
  overlay layers under Infrastructure. They drape on the globe stacks and on
  Google 3D, and share links keep each one (Tom-Neverwinter, #114).
@@ -1,6 +0,0 @@
 - Fire-perimeter queries handle outlines and holes crossing the antimeridian:
  areas enclosed near ±180° are included, areas at the opposite meridian are
  excluded, and returned perimeter coordinates stay near the dateline. Incident
  cards use the same circular longitude mean and compare multipart outline
  areas along short longitude edges, keeping the card on the largest polygon
  (Arianna Method, @ariannamethod, #1142).
@@ -1,3 +0,0 @@
 - Director shot actions land on the requested shot. A seek to a shot's start
  could round a hair below it and select the end of the previous shot for some
  shot counts and durations (Aditya, @Rohilalala, #1171).
@@ -1,13 +0,0 @@
 - Keep missing CCTV numbers unknown instead of reading them as zero. `Number`
  turns null, blank strings and booleans into 0 or 1, and the camera source
  list sends an unknown number as JSON null, so a source-pack camera that left
  out its pose reached the browser as zeros clamped to each field's floor —
  facing north, pitch −2°, FOV 20°, range 120 m, mount 6 m and ground 0 m —
  instead of the defaults (id-hash heading, −17°, 74°, 700 m, 24 m and the
  city's ground); a null or blank position placed the camera at 0,0. The
  server's `toFiniteNumber` and the browser's `safeNumber` now treat absent,
  blank and boolean values as missing. The same conversion also stops a
  Tallinn row with a null heading reading as a confident north-facing camera,
  a Caltrans camera with a blank elevation losing its 150 m ground prior, and
  a TfL or Catalonia camera with a null or blank coordinate being kept at 0,0
  or on the zero meridian (omerbberk, #1172).
@@ -1,10 +0,0 @@
 - Flights' ground floor works across the antimeridian. The viewer-distance
  check behind the 150 km floor radius and its copy in the photoreal mesh-floor
  sampler subtracted longitudes without wrapping, so two points 21 km apart
  across 180° measured about 38,000 km and low or grounded aircraft just across
  the line from the viewer were never floored. A contact's display corridor
  walked a segment across 180° the long way round, spending its cell budget on
  ground behind the contact, and a contact on the seam lost its cell hysteresis.
  SEARCH NEARBY SITES on a view across 180° searched Google Places around
  longitude 0, on the far side of the globe, with a radius sized from the view's
  height alone; it now searches the view (Aditya, @Rohilalala, #1173).
@@ -1,4 +0,0 @@
 - Keep missing launch-pad coordinates unknown so launches use the location
  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
  flight numbers no longer show "FLIGHT 0"
  (Rudy Celekli, @rudycelekli, #1186).
@@ -1,6 +0,0 @@
 - Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
  BicinRivas, about 1,840 stations. Station names read underscores as word
  breaks, and station capacity counts docks rather than PBSC's geofenced area
  (ulihhhh, #1190).
@@ -1,5 +0,0 @@
 - Share Launch Library request cache keys across installations refreshing in the
  same UTC minute, identify the app to the provider, and explain that standard
  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
  upgrades; existing local cache and server-only token handling are unchanged
  (rudycelekli, #1197).
@@ -1,3 +0,0 @@
 - Keep Space Missions marked STALE when Launch Library 2 falls back to cached
  launch data, and return to NOMINAL after a fresh response without discarding
  retained missions (rudycelekli, #1199).
@@ -1,5 +0,0 @@
 - Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
  video camera could only be found by opening it. Stills stay cyan and the
  active camera stays amber, and focus de-emphasis fades the violet the same
  way (Danielslay86, #1200).
@@ -1,4 +0,0 @@
 - Draw CCTV stills at their source aspect on the monitor plane instead of
  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
  every still was widened; they are now centered and pillarboxed on the dark
  the placeholder already ends on (Danielslay86, #1201).
@@ -1,3 +0,0 @@
 - Report actual outcomes when voice enables or disables CCTV through the shared
  layer lifecycle, including failed and cancelled changes (manjunath22466,
  #1205).
@@ -1,3 +0,0 @@
 - Keep NASA FIRMS fire and ALPR camera labels English in voice tool results
  (`track_entity`, `get_entity_context`, pointer context); the voice card still
  shows them in the interface language (daikaginza, #1207).
@@ -0,0 +1,5 @@
 - Keep Directions route errors, the Local ADS-B receiver error and Global
  Context cohort reasons English in layer data; the Layers panel, Radio card
  and awareness panel still show them in the interface language. The route
  proxy's "routing busy" and "route proxy error" refusals are now translated
  too (daikaginza, #1209).
@@ -1,3 +0,0 @@
 - Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
  command, while preserving an earlier accepted deferred input
  (Manjunath, #1220).
@@ -1,3 +0,0 @@
 - Open God's Eye View from Pinokio in the system browser using the supported
  `popout` menu option. The application's framing policy is unchanged
  (NukeThemAII, #1222).
@@ -1,2 +0,0 @@
 - Add continuous globe rotation with direction and speed controls and a globe-fit
  check before starting (manjunath22466, #1225).
@@ -1,4 +0,0 @@
 - The first-run card can be closed on a phone or tablet. "ESC to dismiss" is
  now a button that closes the card the same way ESC does; touch screens read
  DISMISS, and phones no longer hide it, so choosing a mission is not the only
  way out (KnottyDyes, #1226).
@@ -1,4 +0,0 @@
 - Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
  otherwise skipped with one log line saying where to get a key
  (quanticsoul4772, #1228).
@@ -1,8 +0,0 @@
 - OpenSky sign-in matches what OpenSky accepts since 2026-03-18. The server
  now reads `OPENSKY_CREDENTIALS_FILE` (the `credentials.json` OpenSky's
  account page downloads) on every platform, not only through the macOS
  launcher, and no longer sends retired username/password Basic auth:
  `OPENSKY_AUTH_MODE=basic` loads anonymously with one warning saying what to
  set instead (quanticsoul4772, #1229).
 - Credential-file warnings omit parser excerpts and filesystem error details;
  the path example also works with the macOS launchers.
@@ -1,3 +0,0 @@
 - Skip bike-share stations with missing, blank or invalid coordinates instead
  of placing them at coerced zero coordinates or accepting out-of-range values.
  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #1232).
@@ -1,4 +0,0 @@
 - Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
  cancel both response streams when either response fails or overflows the 4 MB
  byte cap, and deduplicate camera IDs before per-pack prioritization
  (yaka0007, #1233).
@@ -1,5 +0,0 @@
 - Serve the camera catalog while it refreshes. An expired catalog made every
  camera request wait for the slowest pack to reload; it is now answered at
  once while one background refresh runs, so only the first load waits. Estonia's
  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
  on about a third of loads (quanticsoul4772, #1234).
@@ -1,3 +0,0 @@
 - Require a geocoded containment anchor for ambiguous analyst region names,
  preserve boundary provenance and cancellation safety, and retain exact-name
  precedence for natural outlines (manjunath22466, #1235).
@@ -1,4 +0,0 @@
 - Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
  with on-demand snapshots and attribution. No API key is required; set
  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).
@@ -1,3 +0,0 @@
 - `get_traffic_flow` flags stale cached TomTom tiles and reports the oldest
  tile fetch time (`stale`, `oldest_tile_at`), with pending freshness metadata
  released on failed or cancelled tile reads (quanticsoul4772, #1239).
@@ -1,5 +0,0 @@
 - Replace the blocky JPEG sky around the globe with the 9,096 stars of the
  Yale Bright Star Catalogue, drawn as sharp points where they are at the
  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
  #1243).
@@ -1,4 +0,0 @@
 - The terrain-heights bounds tests no longer read the checkout's
  `.gev-cache/terrain-heights.json`. Each test gets a cache file of its own, so
  `npm test` no longer fails after the dev server has cached terrain near
  Austin (KnottyDyes, #1244).
@@ -1,9 +0,0 @@
 - Prevent malformed Overpass filters from blocking the local server, and reject
  cross-site or excessive query requests before reading their bodies
  (asturksever, #1264; fixes #1248).
 - Release unread responses from the optional Google-token probe so keyless
  browser validation can settle; the Overpass gate recognizes only that probe's
  expected 404 as an unavailable capability (asturksever, #1264).
 - Make tracking arrival checks respect the aircraft update cadence while checking
  orientation on the first reveal, avoiding false failures at faster render
  rates (asturksever, #1264).
@@ -1,3 +0,0 @@
 - Honor Docker Compose trusted-peer and allowed-host settings from the shell
  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
  access to Provider Settings before Vite starts (asturksever, #1265).
@@ -1,2 +0,0 @@
 - Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
 - Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).
@@ -1 +0,0 @@
 - Coalesce refreshes and cool down opensky failures (asturksever, #1269).
@@ -1 +0,0 @@
 - Respect provider cooldowns and bound tle groups (asturksever, #1270).
@@ -1 +0,0 @@
 - Reject inherited style keys during restore (asturksever, #1271).
@@ -1 +0,0 @@
 - Normalize geocoder bias across the antimeridian (asturksever, #1272).
@@ -1 +0,0 @@
 - Retire unavailable history and keep local trails (asturksever, #1273).
@@ -1 +0,0 @@
 - Scan the kml root delimiter in bounded time (asturksever, #1274).
@@ -1,3 +0,0 @@
 - Preserve enable during first-load replacement (asturksever, #1275).
 - Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
 - Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).
@@ -1 +0,0 @@
 - Bound each height request to one upstream chunk (asturksever, #1276).
@@ -1 +0,0 @@
 - Reserve singleflight before disk cache reads (asturksever, #1278).
@@ -1 +0,0 @@
 - Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).
@@ -1,8 +0,0 @@
 - Hold rendering only for animated content (asturksever, #1281).
 - Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
 - Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
 - Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
 - Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
 - Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
 - Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).
@@ -1,7 +0,0 @@
 - Pause periodic network updates in hidden tabs; the overdue update on return restarts the polling schedule, so the next poll follows one interval later even when that update fails (asturksever, #1282).
 - Report and guard browser visibility during Transit QA so hidden-page polling pauses cannot masquerade as playback regressions (asturksever, #1282).
 - Require each live city to supply its own feed vehicles in Transit QA; retained vehicles cannot qualify another city (asturksever, #1282).
 - Bound the Transit card-anchor probe by observed poll coverage instead of a fixed 20-second window (asturksever, #1282).
 - Keep visible-page Transit probes focused through the browser testing API (asturksever, #1282).
 - Add a real-browser regression gate for hidden-tab periodic work, explicit refresh, resume and teardown (asturksever, #1282).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1282).
@@ -1,3 +0,0 @@
 - Report cached CelesTrak satellite records as stale in the Data Layers row,
  preserving separate core and dense catalog provenance through refresh,
  removal and lifecycle cleanup (rudycelekli, #1283).
@@ -1,3 +0,0 @@
 - Keep aircraft route labels on the scheduled airport leg instead of accepting
  its distant great-circle extensions, preserving generous endpoint tolerance
  across the signed-angle branch cut (rudycelekli, #1284).
@@ -1,4 +0,0 @@
 - The Street Level SINCE note sits on the value's line, in its type and a
  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
  had lost its size variable in the Street Level slim-down and rendered
  larger than the value, on a line of its own (asturksever, #1286).
@@ -1,3 +0,0 @@
 - Give ordinary sliders a shared native control and consistent track, thumb,
  value, focus and disabled styling while preserving feature behavior and
  specialized controls (mazy1998, #1287).
@@ -1,4 +0,0 @@
 - A Street Level provider whose `zoomFor` still answers `{zoom, kind}`, the
  shape before the core went slim, draws its lines again instead of a silent
  blank; an overview level or any answer that is not a whole zoom shows the
  zoom-in hint (asturksever, #1288).
@@ -1,4 +0,0 @@
 - Add Simplified Chinese (zh-CN) to the language picker, with localized dates
  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
  and @EDIT-Aeterna (#979).
  (German, @gekh, #1298).
@@ -1,5 +0,0 @@
 - Unify segmented selectors for model coverage, detection allocation, drawing
  shape, Street View and imagery comparison while preserving their existing
  behavior. Keep compact labels such as FILL and FLAT on one line, and let
  collapsed Weather release space to the open rail panel. Reserve the full mode
  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).
@@ -1,3 +0,0 @@
 - Give ordinary Scene and CCTV actions shared native buttons with consistent
  default, destructive and compact styling while preserving their existing
  behavior and specialized controls (mazy1998, #1302).
@@ -1,2 +0,0 @@
 - `get_wind` flags stale forecasts (`stale`) when the wind proxy serves a
  cached model run (quanticsoul4772, #1303).
@@ -1,2 +0,0 @@
 - Point distances wrap longitude differences across the antimeridian, in voice
  proximity checks and `places_nearby` (quanticsoul4772, #1304).
@@ -1,3 +0,0 @@
 - Share native dropdown and numeric-field styling across Scene, CCTV, Display
  and Radio controls, with a shared CCTV number-input builder that preserves
  existing precision, validation and commit behavior (mazy1998, #1305).
@@ -1,4 +0,0 @@
 - Share read-only status badge presentation across CCTV source/frame labels,
  calibration provenance and Weather coverage, preserving status meanings,
  palettes, translations and announcements while preparing the view contract
  for a future Vue migration (mazy1998, #1306).
@@ -1,3 +0,0 @@
 - Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
  while Radio and Cyber supply explicit field palettes without changing the
  current appearance or native control behavior (mazy1998, #1309).
@@ -1 +0,0 @@
 - Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).
@@ -1,6 +0,0 @@
 - Remove dead code across the repository: three modules nothing imports
  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
  and locals nothing reads, a duplicate copy of the bundled dams data and an
  unused ship model. The app no longer builds an unused default wind layer
  and Bhote Koshi locator layer when it loads. Package exports are unchanged
  (samehkhamis, #1321).
@@ -1,8 +0,0 @@
 - Export the KartaView and Panoramax Street Level providers, so a host composing
  its own provider list can offer the keyless providers without Mapillary
  (samehkhamis, #1324).
 - A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
  token itself (such as a same-origin proxy). Its sequence lookups go there
  through the source's transport, and the photo viewer uses MapillaryJS's
  Graph provider at that endpoint, so no client token is needed in the page
  (samehkhamis, #1324).
@@ -1,4 +0,0 @@
 - Add a phone layout for viewports 720px and narrower: the globe stays full
  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
  panel sheet at a time, keeping attribution visible and scene STOP reachable.
  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).
@@ -1,3 +0,0 @@
 - Evict terrain-height cache entries in fetch-time order without repeatedly
  sorting the full cache, while keeping refreshed points newest and ordering
  restored entries by their fetch time (daikaginza, #1326).
@@ -1,4 +0,0 @@
 - Improve touch selection of aircraft and vessels through the shared contact
  picker, reveal tracked aircraft details when opening Context, support downward
  swipe dismissal of phone drawers while preserving scrolling and controls, and
  enlarge the phone logo (samehkhamis, #1338).
@@ -1,3 +0,0 @@
 - Carry HUD LAT/LON seconds that round up to 60.00" into the minutes and
  degrees, so longitude -122.35 reads `122°21'00.00"W` instead of
  `122°20'60.00"W` (rudycelekli, #1339).
@@ -1,3 +0,0 @@
 - Read a hemisphere letter that is separated from its number, so a search for
  `40.7128 N 74.0060 W` flies there instead of falling through to the geocoders
  (Rudy Celekli, @rudycelekli, #1340).
@@ -1,3 +0,0 @@
 - Reject impossible KartaView photo timestamps, so 31 February is unknown
  instead of rolling forward into March and passing the imagery date filter
  (Rudy Celekli, @rudycelekli, #1341).
@@ -1,3 +0,0 @@
 - Keep an impossible wildfire acquisition date off the detection clock, so a
  fire is not labeled with a later day it did not happen
  (Rudy Celekli, @rudycelekli, #1342).
@@ -1,4 +0,0 @@
 - Phrase slight and sharp ramps as directions, so a ramp reads "slightly left"
  instead of "on the slightly left", and a lane names its side in both
  the proxy response and localized browser instructions
  (Rudy Celekli, @rudycelekli, #1343).
@@ -0,0 +1,4 @@
 - Pause the HUD's camera readout while the page is hidden, as polled layers
  already do. An app embedded inline in a panel keeps both updating, because the
  panel's host can report the page as hidden while it is on screen (nu-stats,
  #1344).
		`@@ -1,2 +0,0 @@`
			`- Exclude aircraft without a reported altitude from requested altitude bands;`
			`unfiltered aircraft queries still retain them (rudycelekli, #1115).`
		`@@ -1,2 +0,0 @@`
			`- Add continuous globe rotation with direction and speed controls and a globe-fit`
			`check before starting (manjunath22466, #1225).`
		`@@ -1,2 +0,0 @@`
			`- Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).`
			`- Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).`
		`@@ -1 +0,0 @@`
			`- Coalesce refreshes and cool down opensky failures (asturksever, #1269).`
		`@@ -1 +0,0 @@`
			`- Respect provider cooldowns and bound tle groups (asturksever, #1270).`
		`@@ -1 +0,0 @@`
			`- Reject inherited style keys during restore (asturksever, #1271).`
		`@@ -1 +0,0 @@`
			`- Normalize geocoder bias across the antimeridian (asturksever, #1272).`
		`@@ -1 +0,0 @@`
			`- Retire unavailable history and keep local trails (asturksever, #1273).`
		`@@ -1 +0,0 @@`
			`- Scan the kml root delimiter in bounded time (asturksever, #1274).`
		`@@ -1 +0,0 @@`
			`- Bound each height request to one upstream chunk (asturksever, #1276).`