fix(overpass): keyless gate, loopback admission headroom and per-phase arrival budgets

Address gekh's review of 69a87fe2:

- P1: /api/overpass now uses admitSameSiteKeyless, like /api/terrain/heights,
  so an instance behind the README's reverse proxy keeps its Overpass-backed
  layers; cross-site shapes are still refused and forwarding headers no
  longer launder them. SECURITY.md, the gate header and CURRENT-STATE say so.
- P2: admission keys IPv6 peers by /64 and folds IPv4-mapped peers
  (clientNetworkKey), and loopback has its own 300/min window outside the
  900/min global, so a few LAN peers cannot lock the owner's browser out.
- P2 (track): the settle and reveal frames each get their own 500 ms budget,
  measured from moveEnd and from the settle frame respectively, so a ~300 ms
  SwiftShader frame no longer trips the reveal deadline while both stay
  inside the 1 s idle refresh.
- Smaller: drop the dead settings-block check and stale probe comment in
  query.js, clamp whitespace-tolerant [ timeout : N ], and add tests for the
  global window, the /64 keying, loopback headroom, proxied admission and
  cache hits spending admission but not upstream budget.

Co-Authored-By: Claude Fable 5.1 <[email protected]>

src/localRequestGate.mjs

@@ -3,13 +3,16 @@
  *
  * The credential panel has its own stricter gate (`admitKeySetupRequest` in
  * keySetupCore.mjs): loopback socket + local Host + exact Origin + JSON
- * Content-Type. The four endpoints here — `/api/realtime/token` (mints an
- * OpenAI Realtime token = spends money), `/api/openai/hud-summary` (OpenAI
- * spend), `/api/google/nearby-places` (Google spend), and
- * `/api/realtime/debug-log` (appends to a local JSONL) — were previously
- * ungated, so a hostile web page open in the same browser could reach them
- * cross-site: a `fetch` carries a foreign `Origin`, and an `<img>`/navigation
- * carries NO `Origin` at all but does carry `Sec-Fetch-Site: cross-site`.
+ * Content-Type. The endpoints behind this gate — `/api/realtime/token` (mints
+ * an OpenAI Realtime token = spends money), `/api/openai/hud-summary` (OpenAI
+ * spend), `/api/google/nearby-places` (Google spend),
+ * `/api/realtime/debug-log` (appends to a local JSONL) and the quota-bearing
+ * routes SECURITY.md lists with them — were previously ungated, so a hostile
+ * web page open in the same browser could reach them cross-site: a `fetch`
+ * carries a foreign `Origin`, and an `<img>`/navigation carries NO `Origin`
+ * at all but does carry `Sec-Fetch-Site: cross-site`. The keyless map routes
+ * (`/api/terrain/heights`, `/api/overpass`) reuse this core through
+ * `admitSameSiteKeyless` with the forwarding-header refusal switched off.
  *
  * This module is the pure core that refuses those shapes while keeping the
  * documented `HOST=0.0.0.0` LAN opt-in and non-browser loopback tools (the two

src/tooling/trackArrivalObservation.mjs

@@ -1,11 +1,18 @@
-/** A reveal must beat the one-second idle rotation refresh, regardless of FPS. */
+/**
+ * Wall-clock budget for EACH observed frame, regardless of FPS. Both the settle
+ * frame (measured from the forced moveEnd) and the reveal frame (measured from
+ * the settle frame that hid the contact) must land inside it, so neither can be
+ * repaired by the one-second idle rotation refresh before it is read — while a
+ * ~300 ms software-rendered frame (headless SwiftShader) still fits twice.
+ */
 export const ARRIVAL_OBSERVATION_MS = 500;
 
 /**
  * Observe the first completed moveEnd frame and the first subsequent reveal.
- * The deadline starts when moveEnd is forced, before its rotation baseline, so
- * waiting for either frame cannot let the one-second idle refresh mask a bug.
- * `read` snapshots visibility and rotation error against the current position.
+ * The settle deadline starts when moveEnd is forced, before its rotation
+ * baseline; the reveal deadline restarts at the settle frame, which is where
+ * the contact is hidden. `read` snapshots visibility and rotation error
+ * against the current position.
  */
 export function observeArrivalRotation({
   scene,
@@ -18,6 +25,7 @@ export function observeArrivalRotation({
 }) {
   return new Promise((resolve, reject) => {
     const startedAt = now();
+    let phaseStartedAt = startedAt;
     let moveEnd = null;
     let moveEndMs = null;
     let revealFrames = 0;
@@ -40,11 +48,16 @@ export function observeArrivalRotation({
       moveEndMs,
       flipFrame: -1,
     });
+    const armDeadline = () => {
+      clearTimer(timer);
+      timer = setTimer(() => finish(expired()), ARRIVAL_OBSERVATION_MS);
+    };
     remove = scene.postRender.addEventListener(() => {
       if (done) return;
       try {
-        const elapsedMs = now() - startedAt;
-        if (elapsedMs >= ARRIVAL_OBSERVATION_MS) {
+        const at = now();
+        const elapsedMs = at - startedAt;
+        if (at - phaseStartedAt >= ARRIVAL_OBSERVATION_MS) {
           finish(expired());
           return;
         }
@@ -52,6 +65,8 @@ export function observeArrivalRotation({
         if (moveEnd === null) {
           moveEnd = sample;
           moveEndMs = elapsedMs;
+          phaseStartedAt = at;
+          armDeadline();
           startReveal();
         } else {
           revealFrames++;
@@ -76,7 +91,7 @@ export function observeArrivalRotation({
         reject(error);
       }
     });
-    timer = setTimer(() => finish(expired()), ARRIVAL_OBSERVATION_MS);
+    armDeadline();
     try {
       startMoveEnd();
       scene.requestRender();
@@ -93,7 +108,8 @@ export function arrivalRotationPassed(observation) {
     !!observation &&
     !observation.error &&
     observation.shown === true &&
-    observation.elapsedMs < ARRIVAL_OBSERVATION_MS &&
+    observation.moveEndMs < ARRIVAL_OBSERVATION_MS &&
+    observation.revealMs < ARRIVAL_OBSERVATION_MS &&
     (observation.dMoveEnd * 180) / Math.PI < 10 &&
     (observation.dReveal * 180) / Math.PI < 10
   );

src/tooling/trackArrivalObservation.test.mjs

@@ -110,7 +110,8 @@ test('no reveal fails at a deadline before the one-second idle catch-up', async
   assert.equal(ARRIVAL_OBSERVATION_MS, 500);
   f.frame(8, { shown: true, rotationError: 0 });
   f.frame(480);
-  f.expire(500);
+  // The reveal budget is measured from the 8 ms settle frame.
+  f.expire(508);
   const result = await f.observation;
   assert.match(result.error, /reveal.*500 ms/);
   assert.equal(arrivalRotationPassed(result), false);
@@ -123,20 +124,46 @@ test('no reveal fails at a deadline before the one-second idle catch-up', async
 test('a late visible frame fails even if the timeout callback is delayed', async () => {
   const f = fixture();
   f.frame(8, { shown: true, rotationError: 0 });
-  f.frame(501, { shown: true, rotationError: 0 });
+  f.frame(509, { shown: true, rotationError: 0 });
   const result = await f.observation;
   assert.match(result.error, /reveal.*500 ms/);
-  assert.equal(result.elapsedMs, 501);
+  assert.equal(result.elapsedMs, 509);
   assert.equal(arrivalRotationPassed(result), false);
 });
 
-test('the deadline includes moveEnd setup rather than restarting when hidden', async () => {
+test('a slow software renderer passes when each frame stays inside its own budget', async () => {
+  // Headless SwiftShader frames run ~300 ms: settle lands at 300 ms and the
+  // reveal at 600 ms from moveEnd. Both stay inside the 1 s idle refresh.
   const f = fixture();
-  f.frame(400, { shown: true, rotationError: 0 });
+  f.frame(300, { shown: true, rotationError: 0 });
+  f.expire(500); // the settle frame re-armed the deadline to 800 ms
   f.frame(600, { shown: true, rotationError: 0 });
   const result = await f.observation;
-  assert.equal(result.moveEndMs, 400);
+  assert.equal(result.moveEndMs, 300);
+  assert.equal(result.revealMs, 300);
   assert.equal(result.elapsedMs, 600);
+  assert.equal(result.flipFrame, 1);
+  assert.equal(arrivalRotationPassed(result), true);
+  assert.equal(f.resources.timers, 0);
+});
+
+test('a settle frame later than its budget fails as a moveEnd timeout', async () => {
+  const f = fixture();
+  f.frame(500, { shown: true, rotationError: 0 });
+  const result = await f.observation;
+  assert.match(result.error, /moveEnd.*500 ms/);
+  assert.equal(result.moveEndMs, null);
+  assert.equal(arrivalRotationPassed(result), false);
+});
+
+test('a reveal later than its own budget fails even after a fast settle frame', async () => {
+  const f = fixture();
+  f.frame(400, { shown: true, rotationError: 0 });
+  f.frame(901, { shown: true, rotationError: 0 });
+  const result = await f.observation;
+  assert.match(result.error, /reveal.*500 ms/);
+  assert.equal(result.moveEndMs, 400);
+  assert.equal(result.elapsedMs, 901);
   assert.equal(arrivalRotationPassed(result), false);
 });