refactor: separate civil-flight records and rendering

docs/CODE-BOUNDARIES.md

@@ -477,3 +477,17 @@ These package groups contain their own dependencies and exclude application
 assembly. `applicationShell` retains composition and compatibility methods;
 those methods delegate to the state owner. Source-based regression checks inspect
 that implementation owner, and browser acceptance exercises the assembled UI.
+
+## Civil-flight records and acquisition
+
+`layers/flights/records` owns metadata, sticky observations, geoid values and
+missing-poll admission. `layers/flights/ingestion` owns the source and request
+lifetime, backoff and freshness state. Both are portable package groups with no
+Cesium, viewer, billboard, model or application imports.
+
+The layer composes these with `snapshotRenderer`, which applies record changes
+to Cesium history and primitives and coordinates existing follow operations.
+Occlusion points live with rendering state. Eviction still releases tracking
+before deleting records; incomplete snapshots retain recent contacts for the
+existing bounded interval. The renderer retains its existing per-frame scratch
+objects; reconciliation occurs on source refresh, not on each frame.

docs/CURRENT-STATE.md

@@ -1,5 +1,12 @@
 # God's Eye View Current State
 
+Civil flights separate source acquisition, portable record reconciliation and
+scene application. The record owner keeps sticky metadata, geoid cache and
+bounded missing-poll state; ingestion owns cancellation, source freshness and
+backoff. The snapshot renderer owns Cartesian history, billboard/model changes
+and follow transitions. Aviation altitude remains separate from render height;
+partial retention, military suppression and ground-sampling policies are unchanged.
+
 The UI facade composes separate owners for navigation authority, share restoration,
 visual settings and panel chrome. Navigation owns request generations and follow
 handoff; restoration owns its coordinator, deferred notices, gestures and timer;