Merge main and preserve shared control surfaces

# Conflicts:
#	src/ui/templates/layer-panels.html
#	style.css

scripts/format-scope.json

@@ -283,6 +283,7 @@
   "src/ui/scenePresentation.js",
   "src/ui/sceneControls.test.mjs",
   "scripts/qa-scene-controls.mjs",
+  "scripts/qa-action-buttons.mjs",
   "src/ui.js",
   "src/standalone/ui.js",
   "src/ui/applicationShell.js",
@@ -307,6 +308,7 @@
   "src/ui/styles/layers.css",
   "src/ui/styles/controls.css",
   "src/ui/styles/slider.css",
+  "src/ui/styles/action-button.css",
   "src/ui/styles/cctv.css",
   "src/ui/styles/foundation.css",
   "src/ui/styles/first-run.css",
@@ -1069,6 +1071,7 @@
   "scripts/assemble-changelog.mjs",
   "src/tooling/changelogFragments.test.mjs",
   "src/data/gbfsProxyRateLimit.test.mjs",
-  "src/data/routeSegment.test.mjs",
-  "src/terrainHeightsBounds.test.mjs"
+  "src/terrainHeightsBounds.test.mjs",
+  "server/providers/overpass/requestAdmission.test.mjs",
+  "src/tooling/trackArrivalObservation.test.mjs"
 ]

scripts/package-boundaries.json

@@ -252,6 +252,7 @@
       "server/providers/common/http.js",
       "server/providers/common/rate-limit.js",
       "server/providers/common/request.js",
+      "server/providers/common/same-site.js",
       "server/providers/overpass.js",
       "server/providers/overpass/cache.js",
       "server/providers/overpass/constants.js",
@@ -261,6 +262,7 @@
       "server/providers/places/routes.js",
       "src/data/placeProviderPayloads.js",
       "src/data/routeSteps.js",
+      "src/localRequestGate.mjs",
       "src/sources/httpBody.js",
       "src/i18n/marker.js",
       "src/sources/overpass.js",
@@ -615,6 +617,7 @@
       "src/ui/scenes.js",
       "src/ui/sceneControls.js",
       "src/ui/scenePresentation.js",
+      "src/ui/actionButton.js",
       "src/i18n/index.js",
       "src/i18n/locale.js",
       "src/i18n/locales/es.json",
@@ -739,6 +742,7 @@
       "src/ui/rightPanelRail.js",
       "src/ui/sceneControls.js",
       "src/ui/scenePresentation.js",
+      "src/ui/actionButton.js",
       "src/ui/scenes.js",
       "src/ui/shareRestoration.js",
       "src/ui/shellElements.js",
@@ -851,6 +855,7 @@
       "src/ui/scenes.js",
       "src/ui/sceneControls.js",
       "src/ui/scenePresentation.js",
+      "src/ui/actionButton.js",
       "src/contextModePolicy.js",
       "src/director/clock.js",
       "src/director/timeline.js",
@@ -2217,6 +2222,7 @@
       "src/ui/rightPanelRail.js",
       "src/ui/sceneControls.js",
       "src/ui/scenePresentation.js",
+      "src/ui/actionButton.js",
       "src/ui/scenes.js",
       "src/ui/shareRestoration.js",
       "src/ui/shellElements.js",

scripts/qa-action-buttons.mjs

@@ -0,0 +1,335 @@
+#!/usr/bin/env node
+/**
+ * Scenes/CCTV action-button acceptance against dev or production preview:
+ * QA_BASE_URL=http://127.0.0.1:4179 node scripts/qa-action-buttons.mjs
+ * Uses the installed CCTV controller with fixture camera/action ports to prove
+ * native dispatch/disabled/teardown without providers or world calibration writes.
+ * Real Scene authoring/playback remains covered by qa-scene-controls.mjs.
+ */
+import fs from 'node:fs';
+import puppeteer from 'puppeteer';
+
+const browser = await puppeteer.launch({
+  headless: true,
+  args: ['--use-gl=angle', '--use-angle=swiftshader'],
+});
+const page = await browser.newPage();
+const errors = [];
+page.on('pageerror', (error) => errors.push(error.message));
+let failures = 0;
+const check = (name, passed, detail) => {
+  console.log(`[${passed ? 'PASS' : 'FAIL'}] ${name}`);
+  if (!passed) {
+    failures++;
+    console.log(JSON.stringify(detail));
+  }
+};
+const shots = 'qa-shots/action-buttons';
+fs.mkdirSync(shots, { recursive: true });
+
+try {
+  await page.setViewport({ width: 1440, height: 900 });
+  await page.goto(
+    `${process.env.QA_BASE_URL || 'http://127.0.0.1:4179'}/?welcome=0`,
+    { waitUntil: 'domcontentloaded' },
+  );
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView?.styleManager?._cctvControls &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 60000 },
+  );
+  const inventory = await page.evaluate(() => {
+    const ids = [
+      'scene-new-btn',
+      'scene-delete-btn',
+      'scene-capture-btn',
+      'scene-update-shot-btn',
+      'scene-start-btn',
+      'scene-stop-btn',
+      'scene-next-btn',
+      'scene-export-btn',
+      'scene-import-btn',
+      'scene-download-btn',
+      'cctv-nearest-btn',
+      'cctv-prev-btn',
+      'cctv-next-btn',
+      'cctv-focus-btn',
+      'cctv-calib-save-btn',
+      'cctv-calib-reset-btn',
+    ];
+    const ordinary = ids.map((id) => document.getElementById(id));
+    const generated = [
+      ...document.querySelectorAll(
+        '.scene-shot-btn, [data-director-authoring] button',
+      ),
+    ];
+    const toggles = [
+      'cctv-enable-btn',
+      'cctv-coverage-btn',
+      'cctv-auto-hop-btn',
+      'cctv-projection-btn',
+      'cctv-adjust-btn',
+    ].map((id) => document.getElementById(id));
+    return {
+      shared: [...ordinary, ...generated].every(
+        (node) =>
+          node?.type === 'button' &&
+          node.classList.contains('gev-action-button'),
+      ),
+      generated: generated.length,
+      layout: ordinary.every((node) => {
+        const style = getComputedStyle(node);
+        return style.minWidth === '72px' && style.flexGrow === '1';
+      }),
+      togglesSeparate: toggles.every(
+        (node) => node && !node.classList.contains('gev-action-button'),
+      ),
+      compactDanger: !!document.querySelector(
+        '.scene-shot-danger.gev-action-button--compact.gev-action-button--danger',
+      ),
+    };
+  });
+  check(
+    'static and generated actions share the native component',
+    inventory.shared && inventory.generated >= 4 && inventory.compactDanger,
+    inventory,
+  );
+  check(
+    'persistent CCTV toggles retain their existing controls',
+    inventory.togglesSeparate,
+  );
+  check('ordinary actions retain their panel sizing', inventory.layout);
+
+  await page.evaluate(() => {
+    const manager = window.__godsEyeView.styleManager;
+    const owner = manager._cctvControls;
+    owner._cctvUnsubscribe?.();
+    owner._cctvUnsubscribe = null;
+    window.__qaButtonCalls = [];
+    const record = (...args) => window.__qaButtonCalls.push(args);
+    owner.actions = {
+      ...owner.actions,
+      isEnabled: () => true,
+      toggleEnabled: async () => {
+        record('enable');
+        return true;
+      },
+      runExplicitFocus: (select, focus) => focus(select()),
+      setParams: (params, options) => record('params', params, options),
+      showToast: () => {},
+    };
+    owner.cctv = {
+      focusNearest: () => {
+        record('nearest');
+        return 'a';
+      },
+      cycleCamera: (direction) => {
+        record('cycle', direction);
+        return 'b';
+      },
+      focusCamera: (id, seconds) => record('focus', id, seconds),
+    };
+    window.__qaCameraState = {
+      enabled: true,
+      activeCameraId: 'a',
+      cameras: [
+        { id: 'a', city: 'Fixture', name: 'A' },
+        { id: 'b', city: 'Fixture', name: 'B' },
+      ],
+      activeCamera: { id: 'a', name: 'A', basePose: {} },
+    };
+    owner._renderCctvState(window.__qaCameraState);
+    manager.setPanelCollapsed('cctv-panel', false, {
+      persist: false,
+      syncShare: false,
+    });
+  });
+  await page.focus('#cctv-next-btn');
+  await page.keyboard.press('Space');
+  await page.waitForFunction(() => window.__qaButtonCalls.length === 3);
+  check(
+    'native Space dispatches Next and its focus once',
+    await page.evaluate(
+      () =>
+        JSON.stringify(window.__qaButtonCalls) ===
+        JSON.stringify([['enable'], ['cycle', 1], ['focus', 'b', 1.4]]),
+    ),
+  );
+  check(
+    'native keyboard activation keeps a visible focus ring',
+    await page.$eval(
+      '#cctv-next-btn',
+      (node) =>
+        document.activeElement === node &&
+        getComputedStyle(node).outlineStyle === 'solid',
+    ),
+  );
+  await page.evaluate(() => {
+    window.__qaButtonCalls = [];
+  });
+  await page.focus('#cctv-prev-btn');
+  await page.keyboard.press('Enter');
+  await page.waitForFunction(() => window.__qaButtonCalls.length === 3);
+  check(
+    'native Enter dispatches Previous once',
+    await page.evaluate(
+      () =>
+        JSON.stringify(window.__qaButtonCalls) ===
+        JSON.stringify([['enable'], ['cycle', -1], ['focus', 'b', 1.4]]),
+    ),
+  );
+
+  for (const [id, expected] of [
+    ['cctv-nearest-btn', [['enable'], ['nearest'], ['focus', 'a', 1.8]]],
+    [
+      'cctv-focus-btn',
+      [
+        ['enable'],
+        ['focus', 'a', 1.9],
+        ['params', { selectedCameraId: 'a' }, { origin: 'user' }],
+      ],
+    ],
+  ]) {
+    await page.evaluate(() => {
+      window.__qaButtonCalls = [];
+    });
+    await page.click(`#${id}`);
+    await page.waitForFunction(() => window.__qaButtonCalls.length === 3);
+    const calls = await page.evaluate(() => window.__qaButtonCalls);
+    check(
+      `${id} retains its existing action and focus timing`,
+      JSON.stringify(calls) === JSON.stringify(expected),
+      calls,
+    );
+  }
+
+  await page.evaluate(() => {
+    window.__qaButtonCalls = [];
+  });
+  await page.click('#cctv-calib-save-btn');
+  await page.click('#cctv-calib-reset-btn');
+  const calibration = await page.evaluate(() => window.__qaButtonCalls);
+  check(
+    'Save and Reset retain camera identity and user-origin dispatch',
+    JSON.stringify(calibration) ===
+      JSON.stringify([
+        [
+          'params',
+          { selectedCameraId: 'a', calibration: { cameraId: 'a', save: true } },
+          { origin: 'user' },
+        ],
+        [
+          'params',
+          {
+            selectedCameraId: 'a',
+            calibration: { cameraId: 'a', reset: true },
+          },
+          { origin: 'user' },
+        ],
+      ]),
+    calibration,
+  );
+  await page.evaluate(() => {
+    window.__qaButtonCalls = [];
+    window.__godsEyeView.styleManager._cctvControls._renderCctvState({
+      enabled: false,
+    });
+  });
+  await page.click('#cctv-next-btn');
+  await page.waitForFunction(
+    () => {
+      const node = document.getElementById('cctv-next-btn');
+      return node.disabled && Number(getComputedStyle(node).opacity) === 0.45;
+    },
+    { timeout: 3000 },
+  );
+  check(
+    'disabled actions stay inert and keep disabled presentation',
+    await page.$eval(
+      '#cctv-next-btn',
+      (node) =>
+        node.disabled &&
+        getComputedStyle(node).opacity === '0.45' &&
+        window.__qaButtonCalls.length === 0,
+    ),
+  );
+
+  for (const width of [1440, 620, 390]) {
+    await page.setViewport({ width, height: 900 });
+    for (const panel of ['scene-panel', 'cctv-panel']) {
+      await page.evaluate((panel) => {
+        window.__godsEyeView.styleManager.setPanelCollapsed(panel, false, {
+          persist: false,
+          syncShare: false,
+        });
+      }, panel);
+      const fit = await page.$eval(`#${panel}`, (root) => {
+        const buttons = [...root.querySelectorAll('.gev-action-button')];
+        const rect = root.getBoundingClientRect();
+        return {
+          count: buttons.length,
+          fits:
+            buttons.length > 0 &&
+            buttons.every((button) => {
+              const box = button.getBoundingClientRect();
+              return (
+                box.width > 0 &&
+                box.left >= rect.left &&
+                box.right <= rect.right + 1 &&
+                box.left >= 0 &&
+                box.right <= innerWidth + 1 &&
+                button.scrollWidth <= button.clientWidth
+              );
+            }),
+        };
+      });
+      check(`${panel} actions fit at ${width}px`, fit.fits, fit);
+      if (width !== 620)
+        await page.screenshot({ path: `${shots}/${panel}-${width}.png` });
+    }
+  }
+  await page.evaluate(() => {
+    const owner = window.__godsEyeView.styleManager._cctvControls;
+    owner.destroy();
+    document.getElementById('cctv-next-btn').disabled = false;
+    window.__qaButtonCalls = [];
+  });
+  await page.click('#cctv-next-btn');
+  check(
+    'destroyed controllers revoke action listeners',
+    await page.evaluate(() => window.__qaButtonCalls.length === 0),
+  );
+  const localized = new URL(page.url());
+  localized.searchParams.set('lang', 'ru');
+  await page.goto(localized.href, { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView?.styleManager?._cctvControls &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 60000 },
+  );
+  for (const panel of ['scene-panel', 'cctv-panel']) {
+    await page.evaluate((panel) => {
+      window.__godsEyeView.styleManager.setPanelCollapsed(panel, false, {
+        persist: false,
+        syncShare: false,
+      });
+    }, panel);
+    const translated = await page.$eval(`#${panel}`, (root) => {
+      const buttons = [...root.querySelectorAll('.gev-action-button')];
+      return (
+        document.documentElement.lang === 'ru' &&
+        buttons.length > 0 &&
+        buttons.every((node) => node.scrollWidth <= node.clientWidth)
+      );
+    });
+    check(`Russian ${panel} action labels fit at 390px`, translated);
+    await page.screenshot({ path: `${shots}/${panel}-ru-390.png` });
+  }
+  check('no uncaught browser errors', errors.length === 0, errors);
+} finally {
+  await browser.close();
+}
+console.log(`RESULT: ${failures} failures`);
+process.exitCode = failures ? 1 : 0;

scripts/qa-overpass-offload.mjs

@@ -306,7 +306,16 @@ try {
   await observeNetwork(page);
   page.on('pageerror', (error) => result.errors.push(error.message));
   page.on('console', (message) => {
-    if (message.type() === 'error' && result.consoleErrors.length < 30)
+    if (message.type() !== 'error') return;
+    // A keyless server does not offer optional Google tokens. Keep every other
+    // HTTP or JavaScript error visible, including failures of this route other
+    // than its expected capability-miss 404.
+    const optionalTokenMiss =
+      message.location().url === new URL('/api/google/tiles-token', url).href &&
+      /^Failed to load resource: the server responded with a status of 404\b/.test(
+        message.text(),
+      );
+    if (!optionalTokenMiss && result.consoleErrors.length < 30)
       result.consoleErrors.push(message.text());
   });
   page.on('requestfailed', (request) => {

scripts/qa-scene-controls.mjs

@@ -66,7 +66,8 @@ try {
       );
     }),
   );
-  await page.click('#scene-capture-btn');
+  await page.focus('#scene-capture-btn');
+  await page.keyboard.press('Space');
   await page.waitForFunction(
     () => document.querySelectorAll('.scene-shot-row').length === 1,
   );

scripts/track-regression.mjs

@@ -94,6 +94,7 @@
 
 import fs from 'node:fs';
 import puppeteer from 'puppeteer';
+import { arrivalRotationPassed } from '../src/tooling/trackArrivalObservation.mjs';
 import { classifyAircraft, CLASS_SCALE_3D, CLASS_MODEL_REAL } from '../src/data/aircraftClass.js';
 import { ensureGeoidReady, geoidHeight } from '../src/data/geoid.js';
 
@@ -2695,16 +2696,17 @@ async function main() {
     //       reappear wearing its stale/creation-north nose for up to 1 s).
     // Staged deterministically: park the camera nadir over the synthetic
     // cluster, let rotations settle, TAMPER a billboard's rotation, then
-    // trigger each path with the camera idle. The idle-drift catch-up
-    // (ROTATION_REFRESH_MS = 1 s) can coincidentally mask a regression in a
-    // ~300 ms SwiftShader frame window, so a regression shows as an
-    // intermittent (not guaranteed) failure — never a false failure.
+    // trigger each path with the camera idle. The fleet runs every 80 ms,
+    // independently of rendered FPS. Observe the first completed settle and
+    // reveal frames within 500 ms of forcing moveEnd, before the 1 s idle
+    // rotation refresh can repair an incorrect first reveal.
     // ============================================================
     console.log('\nChange 4 — arrival rotation: moveEnd settle pass + horizon-reveal pass');
     const arrival = await evalPage(async () => {
       const v = window.__godsEyeView.viewer;
       const dm = window.__godsEyeView.dataManager;
       const { screenProjectedRotation } = await import(`${window.__gevQaSourceBase || '/src'}/data/iconOrientation.js`);
+      const { observeArrivalRotation } = await import(`${window.__gevQaSourceBase || '/src'}/tooling/trackArrivalObservation.mjs`);
       // 3D models OFF for this phase: a model-handed-off billboard is hidden
       // and skips rotation updates entirely — the probes need live billboards
       // (this is also the app's default state the field report came from).
@@ -2766,39 +2768,29 @@ async function main() {
         const bb = findBB(id);
         if (!bb || !bb.show) return { error: `${id} missing/hidden` };
         const r0 = bb.rotation; // settled tamper origin; correctness uses a fresh projection below
-        // (a) settle pass: tamper, then raise moveEnd with the camera IDLE —
-        // the pose signature is unchanged, so only the moveEnd hook can fix
-        // this before the 1 s catch-up.
-        bb.rotation = r0 + 1.5;
-        v.camera.moveEnd.raiseEvent();
-        await nextFrames(2);
-        const afterMoveEnd = bb.rotation;
-        // A real-GPU fleet tick can land near the edge of the frame budget and
-        // advance the contact before the probe reads it. Compare with the
-        // production projection at the CURRENT position, not the now-stale r0.
-        const expectedMoveEnd = screenProjectedRotation(v.scene, bb.position, course, null);
-        // (b) reveal pass: tamper + hide — the next fleet tick must flip it
-        // visible AND correct the nose in that same tick (camera still idle,
-        // no moveEnd raised). Diagnostic fields (round 5): record WHICH frame
-        // the flip landed on (flipFrame; -1 = never within the extended
-        // window) and whether a 3D model owns this id — distinguishes "tick
-        // slow under load" from "occluder says hidden" from "model handoff".
-        bb.rotation = r0 + 1.5;
-        bb.show = false;
-        let flipFrame = -1;
-        for (let f = 1; f <= 6; f++) {
-          await nextFrames(1);
-          if (bb.show && flipFrame === -1) flipFrame = f;
-          if (f >= 2 && flipFrame !== -1) break;
-        }
-        const expectedReveal = screenProjectedRotation(v.scene, bb.position, course, null);
+        const observed = await observeArrivalRotation({
+          scene: v.scene,
+          startMoveEnd() {
+            // Only moveEnd can repair the tampered angle at the idle pose.
+            bb.rotation = r0 + 1.5;
+            v.camera.moveEnd.raiseEvent();
+          },
+          startReveal() {
+            // Hide immediately after the confirmed settle frame. The next
+            // eligible fleet tick must reveal AND re-aim in that same tick.
+            bb.rotation = r0 + 1.5;
+            bb.show = false;
+          },
+          read() {
+            return {
+              shown: bb.show,
+              rotationError: angDiff(bb.rotation,
+                screenProjectedRotation(v.scene, bb.position, course, null)),
+            };
+          },
+        });
         const hasModel = !!(window.__g3dFindModel && window.__g3dFindModel(id));
-        return {
-          r0,
-          dMoveEnd: angDiff(afterMoveEnd, expectedMoveEnd),
-          dReveal: angDiff(bb.rotation, expectedReveal),
-          shown: bb.show, flipFrame, hasModel,
-        };
+        return { r0, ...observed, hasModel };
       };
       const flightCourse = window.__SYNTH.flights.find((f) => f.icao === 'aaa002')?.track ?? 0;
       const militaryCourse = window.__SYNTH.military.find((m) => m.hex === 'bbb101')?.track ?? 0;
@@ -2807,22 +2799,13 @@ async function main() {
         military: await probe('bbb101', militaryCourse),
       };
     });
-    const fmtArr = (a) => (!a ? `no result (${arrival?.error || 'phase error'})` : a.error ? a.error
-      : `settle-err=${(a.dMoveEnd * 180 / Math.PI).toFixed(1)}° reveal-err=${(a.dReveal * 180 / Math.PI).toFixed(1)}° shown=${a.shown} flipFrame=${a.flipFrame} hasModel=${a.hasModel}`);
+    const fmtArr = (a) => (!a ? `no result (${arrival?.error || 'phase error'})` : a.error ? `${a.error}; elapsed=${Number(a.elapsedMs).toFixed(1)} ms`
+      : `settle-err=${(a.dMoveEnd * 180 / Math.PI).toFixed(1)}° reveal-err=${(a.dReveal * 180 / Math.PI).toFixed(1)}° shown=${a.shown} flipFrame=${a.flipFrame} settle=${a.moveEndMs.toFixed(1)} ms reveal=${a.revealMs.toFixed(1)} ms total=${a.elapsedMs.toFixed(1)} ms hasModel=${a.hasModel}`);
     const TAMPER_DEG = 1.5 * 180 / Math.PI; // ≈ 86° — an uncorrected nose stays this far off
-    // Reveal budget re-pinned 2 → 4 frames (round 5): the diagnostic probe
-    // shows the military flip consistently lands on frame 2 — the exact edge
-    // of the old budget — so any load hiccup flaked it (flights lands frame
-    // 1). The regression this protects against is a reveal that waits for
-    // the 1 s idle catch-up (~30-60 frames) or never re-aims; 4 frames still
-    // catches that with a wide margin, with zero-headroom flakes gone.
-    const arrOk = (a) => !!a && !a.error && a.shown
-      && (a.flipFrame === -1 ? false : a.flipFrame <= 4)
-      && a.dMoveEnd * 180 / Math.PI < 10 && a.dReveal * 180 / Math.PI < 10;
-    record(`arrival: moveEnd + reveal both re-aim within 4 frames, flights (tamper was ${TAMPER_DEG.toFixed(0)}°)`,
-      arrOk(arrival.flights), fmtArr(arrival.flights));
-    record(`arrival: moveEnd + reveal both re-aim within 4 frames, military (tamper was ${TAMPER_DEG.toFixed(0)}°)`,
-      arrOk(arrival.military), fmtArr(arrival.military));
+    record(`arrival: moveEnd + first reveal both re-aim before idle refresh, flights (tamper was ${TAMPER_DEG.toFixed(0)}°)`,
+      arrivalRotationPassed(arrival.flights), fmtArr(arrival.flights));
+    record(`arrival: moveEnd + first reveal both re-aim before idle refresh, military (tamper was ${TAMPER_DEG.toFixed(0)}°)`,
+      arrivalRotationPassed(arrival.military), fmtArr(arrival.military));
 
     // ============================================================
     // DISPLAY FLOOR (2026-08-19): a grounded contact must never render below