diff --git a/.env.example b/.env.example
index a2f8afa24..5ddf78383 100644
--- a/.env.example
+++ b/.env.example
@@ -118,8 +118,8 @@ OPENSKY_AUTH_MODE=oauth
 OPENSKY_CLIENT_ID=
 OPENSKY_CLIENT_SECRET=
 
-# Optional: higher Launch Library 2 request allowance. Public access works
-# without a token.
+# Launch Library 2: leave blank for standard public access (no key needed).
+# Optional paid Patreon tokens raise request limits; there is no free API key.
 LL2_API_TOKEN=
 
 # Optional: OpenSky credentials JSON file path (alternative to above)
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6d6b968db..ba0d38768 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -54,8 +54,9 @@ head -40 scripts/qa-radio.mjs  # what this runnable gate proves and how to run i
 Runnable gate entrypoints document what they assert and how to invoke them.
 Most need a dev server; some also need a specific provider key or port. Follow
 the entrypoint's header rather than assuming every matching file accepts the
-same arguments. Only a couple (`qa:map-source-tray`, `qa:transit`) have an
-`npm run` alias.
+same arguments. Five have an `npm run` alias: `qa:map-source-tray`,
+`qa:panel-resize`, `qa:street-level`, `qa:street-level:fixtures` and
+`qa:transit`.
 
 If you aren't sure which gate covers your change, search `docs/CURRENT-STATE.md`
 for the feature: it names the gate for many of them, and it's the authoritative
@@ -63,12 +64,13 @@ runtime reference either way. `scripts/qa-l9-matrix.mjs` aggregates the broader
 release-candidate checks and selected harnesses; it does not replace the focused
 gate for the feature you changed.
 
-> **CI does not cover this for you.** The workflow runs the setup policy
+> **CI covers only two of these for you.** The workflow runs the setup policy
 > checks, the formatting and package-boundary checks, the unit suite and the
-> production build, plus a Windows onboarding job. It runs neither
-> `npm run test:track` nor any `qa-*.mjs` gate — both need a live dev server
-> and a browser. Include the applicable local run in your PR's validation
-> evidence.
+> production build, plus a Windows onboarding job, and against the built preview
+> it runs `qa:street-level:fixtures` and `qa:panel-resize`. It does not run
+> `npm run test:track` or any other `qa-*.mjs` gate — those need a live dev
+> server and a browser. Include the applicable local run in your PR's
+> validation evidence.
 
 ## Share-link layer tokens
 
diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md
index 0e04fb39b..d930bcb8f 100644
--- a/DATA_SOURCES.md
+++ b/DATA_SOURCES.md
@@ -69,10 +69,12 @@ How to read this:
 | **Bike Share Toronto** (`toronto.publicbikesystem.net`) | Bikeshare station availability, Toronto | Operator GBFS feed. No licence is published: the City's open-data package declares none and the feed has no `license_url`. Attribution is given to the operator. | "Bike Share Toronto (Toronto Parking Authority)" |
 | **Bike Itaú / Tembici** (`*.publicbikesystem.net`, seven Brazilian cities, Santiago and Bogotá) | Bikeshare station availability: São Paulo, Rio de Janeiro, Salvador, Recife, Porto Alegre, Brasília, Curitiba, Santiago de Chile and Bogotá | Operator GBFS feeds. No licence is published: the feeds' `system_information.json` carries no `license_url`, operator or attribution fields. Attribution is given to the operator. | "Bike Itaú (Tembici)"; "Tembici Bogotá" |
 | **Bicing** (`barcelona.publicbikesystem.net`) | Bikeshare station availability, Barcelona | Operator GBFS feed (PBSC), keyless. The feed publishes no licence; the City's own open-data copy of the same station data is CC BY 4.0 but needs a token. Attribution is given to the operator. | "Bicing, Barcelona City Council (B:SM)" |
+| **BiciMAD** (`madrid.publicbikesystem.net`) | Bikeshare station availability, Madrid | Operator GBFS feed (PBSC), keyless. Madrid's open-data catalogue publishes this feed (`datos.madrid.es`, dataset `900021-0-bicimad-gbfs`, owner EMT Madrid) under [EMT's open-data terms](https://mobilitylabs.emtmadrid.es/sip/terms-of-use): commercial and non-commercial reuse, with attribution REQUIRED (section 5.2). | "Powered by EMT de Madrid", linking to `https://www.emtmadrid.es` |
+| **Spanish city bikes on PBSC** (`*.publicbikesystem.net`: Zaragoza, Valladolid, A Coruña, Donostia-San Sebastián, Bilbao, Rivas-Vaciamadrid) | Bikeshare station availability: Bizi Zaragoza, BIKI, BiciCoruña, Dbizi, Bilbao Bizi, BicinRivas | Operator GBFS feeds, keyless. The feeds' `system_information.json` carries no `license_url`, and no operator or city publishes a licence for them; MobilityData's catalogue lists CC BY 4.0 without naming a source. Attribution is given to the operator. | "Bizi Zaragoza"; "BIKI, AUVASA (Valladolid)"; "BiciCoruña"; "Dbizi (Donostia-San Sebastián)"; "Bilbao Bizi, Bilbao City Council"; "BicinRivas, Rivas-Vaciamadrid City Council" |
 | **AMBici** (nextbike, `gbfs.nextbike.net`) | Bikeshare station availability, Barcelona metropolitan area (e-bikes) | Operator GBFS feed, keyless. `system_information.license_id` is **CC0-1.0**; no attribution required, given anyway. | "AMBici, Àrea Metropolitana de Barcelona, operated by nextbike" |
 | **Oslo / Bergen / Trondheim Bysykkel** (Urban Sharing, `gbfs.urbansharing.com`) | Bikeshare availability, Oslo, Bergen and Trondheim city bikes. Keyless GBFS; the proxy sends the `Client-Identifier` header the operators ask for | [NLOD 2.0](https://data.norge.no/nlod/en/2.0) — attribution REQUIRED ([Oslo](https://oslobysykkel.no/en/open-data/realtime), [Bergen](https://bergenbysykkel.no/en/apne-data/sanntid), [Trondheim](https://trondheimbysykkel.no/en/open-data/realtime)) | "Contains data under the Norwegian licence for Open Government data (NLOD) made available by Oslo Bysykkel, Bergen Bysykkel and Trondheim Bysykkel" |
 | **Kolumbus / Farte Bysykkel** (Entur Mobility, `api.entur.io/mobility/v2/gbfs`) | Bikeshare availability, Kolumbus Bysykkel (Stavanger/Nord-Jæren) and Farte Bysykkel (Skien/Porsgrunn). Keyless GBFS; the proxy sends the `ET-Client-Name` header Entur requires and is limited to Entur's GBFS paths | [NLOD](https://data.norge.no/nlod/en/2.0) per the [Entur Mobility API docs](https://developer.entur.org/pages-mobility-docs-mobility-v2) — attribution REQUIRED | "Contains data under the Norwegian licence for Open Government data (NLOD) made available by Entur (Kolumbus Bysykkel, Farte Bysykkel)" |
-| **JCDecaux Cyclocity** (`api.cyclocity.fr`) | Bikeshare availability, Bysykkel Lillestrøm. Keyless GBFS; the proxy is limited to JCDecaux contract paths | [Licence Ouverte / Etalab](https://developer.jcdecaux.com/files/Open-Licence-fr.pdf) (the feed's `license_url`) — attribution REQUIRED | "Bysykkel Lillestrøm: JCDecaux, Licence Ouverte" |
+| **JCDecaux Cyclocity** (`api.cyclocity.fr`) | Bikeshare availability: Bysykkel Lillestrøm, Valenbisi (Valencia) and Sevici (Seville). Keyless GBFS; the proxy is limited to JCDecaux contract paths | [Licence Ouverte / Etalab](https://developer.jcdecaux.com/files/Open-Licence-fr.pdf) (each feed's `license_url`) — attribution REQUIRED | "Bysykkel Lillestrøm, Valenbisi, Sevici: JCDecaux, Licence Ouverte" |
 | **MBTA / MassDOT** (cdn.mbta.com) | Transit layer live vehicles and up to 15 minutes of recently observed positions, Greater Boston | MBTA / MassDOT open realtime vehicle data, used for the live view and up to fifteen minutes of recently observed positions; published for developer use and not against their use. | Attribution to MBTA / MassDOT (courtesy text) |
 | **CapMetro** (data.texas.gov) | Transit layer live vehicles, Austin TX | CapMetro open realtime vehicle data, used for the live view; published for developer use and not against their use. | Attribution to CapMetro (courtesy text) |
 | **Metro Transit** (Metropolitan Council) | Transit layer live vehicles, Minneapolis–St Paul | Metro Transit / Metropolitan Council open realtime vehicle data, used for the live view; published for developer use and not against their use. | Attribution to Metro Transit / Metropolitan Council (courtesy text) |
diff --git a/README.md b/README.md
index c49c53ece..c3c3d7ef3 100644
--- a/README.md
+++ b/README.md
@@ -385,7 +385,7 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 | 🚲 **Bikeshare**            | Live station availability                                                                                                                                                                                                                                                                                                                                                           | GBFS                                    | 🟢                                                                                                  |
 | 🧭 **Directions**           | Click A and B on the globe for a street-following drive, walk or cycle route draped on the terrain with turn-by-turn steps — then FLY the camera along it. No key, no geocoder, no mic                                                                                                                                                                                              | OSRM on FOSSGIS servers (OpenStreetMap) | 🟢                                                                                                  |
 | 🔥 **Active Fires**         | Live NASA FIRMS detections, trailing 24h                                                                                                                                                                                                                                                                                                                                            | NASA FIRMS                              | 🟡                                                                                                  |
-| 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🟡 optional token raises the allowance)                                                         |
+| 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🔴 optional paid token raises the allowance)                                                         |
 | 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way                                                                                                                                                                                                                                                                          | OpenStreetMap                           | 🟢                                                                                                  |
 | 🌬️ **Wind**                 | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center                                                                                                                                                                                                                                                                 | NOAA GFS / ECMWF IFS                    | 🟢                                                                                                  |
 | 🌦️ **Observed Weather**     | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline                                                                                                                                                                                                     | NOAA nowCOAST                           | 🟢                                                                                                  |
@@ -527,9 +527,11 @@ _What the TomTom key buys you: rush-hour density painted on the city — then di
 |     | Key                  | Why                                                           | Get it                                             |
 | --- | -------------------- | ------------------------------------------------------------- | -------------------------------------------------- |
 | 🟡  | **OpenSky**          | ✈️ More flight-polling credits (🟢 anonymous works without)   | [opensky-network.org](https://opensky-network.org) |
-| 🟡  | **Launch Library 2** | 🚀 Higher space-missions request allowance (🟢 works without) | [thespacedevs.com](https://thespacedevs.com)       |
+| 🔴  | **Launch Library 2** | 🚀 Optional paid token for higher limits (🟢 no key needed for public access) | [thespacedevs.com/supportus](https://thespacedevs.com/supportus) |
 
 Add these if you need higher polling allowances.
+Leave `LL2_API_TOKEN` blank for standard public access. LL2 tokens are optional
+paid Patreon upgrades for higher limits; there is no free API-key signup.
 
 `npm run doctor` reports Node/npm readiness, the primary provider routes, and
 where each configured provider was found without printing credential values.
diff --git a/SECURITY.md b/SECURITY.md
index e53883548..b694d8dcd 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -73,7 +73,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
 - **Redacted debug logging.** The voice debug log (`.gev-logs/`, gitignored) strips API keys, bearer tokens, client secrets, and image data URLs before writing.
-- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control.
+- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless terrain route (`/api/terrain/heights`) uses the same cross-site checks, minus the forwarding-header refusal: it guards only the per-client quota and point cache, not a key or a bill, and the map needs it to render behind a reverse proxy.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads and the Maps JavaScript API that Street View runs on, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
 
 Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance.
diff --git a/changelog.d/1094-dependency-security-patches.md b/changelog.d/1094-dependency-security-patches.md
new file mode 100644
index 000000000..058359efc
--- /dev/null
+++ b/changelog.d/1094-dependency-security-patches.md
@@ -0,0 +1,4 @@
+- Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
+  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
+  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
+  #1094).
diff --git a/changelog.d/1101-tle-catalog-number-match.md b/changelog.d/1101-tle-catalog-number-match.md
new file mode 100644
index 000000000..d1e2aa407
--- /dev/null
+++ b/changelog.d/1101-tle-catalog-number-match.md
@@ -0,0 +1,3 @@
+- Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
+  spliced catalog cannot pair one satellite's elements with another's; the next
+  valid set still parses (VG31OP, #1101).
diff --git a/changelog.d/1186-launch-unknown-coordinates.md b/changelog.d/1186-launch-unknown-coordinates.md
new file mode 100644
index 000000000..d03c2d902
--- /dev/null
+++ b/changelog.d/1186-launch-unknown-coordinates.md
@@ -0,0 +1,4 @@
+- Keep missing launch-pad coordinates unknown so launches use the location
+  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
+  flight numbers no longer show "FLIGHT 0"
+  (Rudy Celekli, @rudycelekli, #1186).
diff --git a/changelog.d/1190-bikeshare-spain-cities.md b/changelog.d/1190-bikeshare-spain-cities.md
new file mode 100644
index 000000000..f07faa813
--- /dev/null
+++ b/changelog.d/1190-bikeshare-spain-cities.md
@@ -0,0 +1,6 @@
+- Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
+  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
+  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
+  BicinRivas, about 1,840 stations. Station names read underscores as word
+  breaks, and station capacity counts docks rather than PBSC's geofenced area
+  (ulihhhh, #1190).
diff --git a/changelog.d/1197-launch-library-provider-guidance.md b/changelog.d/1197-launch-library-provider-guidance.md
new file mode 100644
index 000000000..34cbe299e
--- /dev/null
+++ b/changelog.d/1197-launch-library-provider-guidance.md
@@ -0,0 +1,5 @@
+- Share Launch Library request cache keys across installations refreshing in the
+  same UTC minute, identify the app to the provider, and explain that standard
+  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
+  upgrades; existing local cache and server-only token handling are unchanged
+  (rudycelekli, #1197).
diff --git a/changelog.d/1199-launch-cache-provenance.md b/changelog.d/1199-launch-cache-provenance.md
new file mode 100644
index 000000000..04f33cb7f
--- /dev/null
+++ b/changelog.d/1199-launch-cache-provenance.md
@@ -0,0 +1,3 @@
+- Keep Space Missions marked STALE when Launch Library 2 falls back to cached
+  launch data, and return to NOMINAL after a fresh response without discarding
+  retained missions (rudycelekli, #1199).
diff --git a/changelog.d/287-shared-great-circle-distance.md b/changelog.d/287-shared-great-circle-distance.md
new file mode 100644
index 000000000..c2db9d54d
--- /dev/null
+++ b/changelog.d/287-shared-great-circle-distance.md
@@ -0,0 +1,5 @@
+- The client's great-circle distances now come from one shared
+  `src/geoDistance.js` (`greatCircleKm`/`greatCircleMeters`, `{lat, lon}`
+  points). The Earth radius is standardized on 6371.0088 km, so distances shift
+  by about 1.4 ppm and region areas by about 2.8 ppm, and missing or
+  out-of-range points return `Infinity` (onionviolet, #287; Rajojha-1, #749).
diff --git a/changelog.d/686-terrain-heights-bounds.md b/changelog.d/686-terrain-heights-bounds.md
new file mode 100644
index 000000000..7e0004069
--- /dev/null
+++ b/changelog.d/686-terrain-heights-bounds.md
@@ -0,0 +1,9 @@
+- Bound what a caller can grow through `/api/terrain/heights`. Every distinct
+  5-decimal point was a permanent in-memory entry, a permanent line in an
+  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
+  nothing limiting the rate. The point cache now holds at most 50,000 entries
+  and evicts oldest-first, a cache file above
+  24 MB is not read back, and the route is limited to 90 requests/minute per
+  client (270 global). Evicting a point costs one refetch, never a wrong
+  answer, since terrain does not move. Ordinary use is unaffected: a full
+  `test:track` run drives 10 requests, peaking at 8/min (daikaginza, #686).
diff --git a/changelog.d/761-dev-unwatched-runtime-dirs.md b/changelog.d/761-dev-unwatched-runtime-dirs.md
new file mode 100644
index 000000000..d3aaf0a91
--- /dev/null
+++ b/changelog.d/761-dev-unwatched-runtime-dirs.md
@@ -0,0 +1,5 @@
+- The dev server no longer watches `.gev-cache` and `.gev-logs`. Providers write
+  cache files and logs there while the app runs, and none of it is source, so
+  the watcher now skips it; this guards against the DNS-lookup delays heavy
+  cache writes have caused, though no difference was measured on current main
+  (monwiss, #761).
diff --git a/changelog.d/767-alpha5-catalog-numbers.md b/changelog.d/767-alpha5-catalog-numbers.md
new file mode 100644
index 000000000..8a96698a1
--- /dev/null
+++ b/changelog.d/767-alpha5-catalog-numbers.md
@@ -0,0 +1,11 @@
+- Read satellite catalog numbers written in Alpha-5, the TLE spelling of
+  numbers above 99999: a letter for the first two digits, skipping I and O
+  (`A0000` is 100000, `Z9999` is 339999). The satellites layer converted such a
+  field to `NaN`, so every Alpha-5 satellite shared one catalog entry and all
+  but the first were dropped as duplicates; the satellite tools read the same
+  field as no number, so such a satellite could not be found by it. The layer
+  and the tools now decode the field in `src/sources/tle.js`, and reject a
+  malformed one (a sign, decimal point, hex, embedded space or stray letter)
+  instead of reading part of it as a number. This is Alpha-5 TLE
+  compatibility: CelesTrak's TLE feed carries no satellite above 99999, which
+  needs the OMM feed (#1191) (Honorius Neogy, #767, fixes #751).
diff --git a/changelog.d/975-terrain-cross-site-gate.md b/changelog.d/975-terrain-cross-site-gate.md
new file mode 100644
index 000000000..6c0e42156
--- /dev/null
+++ b/changelog.d/975-terrain-cross-site-gate.md
@@ -0,0 +1,8 @@
+- Cross-site pages can no longer fill the terrain-height cache or spend the
+  visitor's own `/api/terrain/heights` rate-limit quota through the visitor's
+  browser. The route refuses a cross-site `Sec-Fetch-Site` or a foreign or
+  opaque `Origin` before rate limiting, cache access or upstream work. Unlike
+  the cost-bearing routes it still answers same-origin requests that arrive
+  through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or
+  Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza,
+  #975).
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 8d1ddb28b..988be74ed 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -1,5 +1,20 @@
 # God's Eye View Current State
 
+Shared distance checks use `src/geoDistance.js` with `{ lat, lon }` points and
+the IUGG mean spherical Earth radius, 6371.0088 km. `greatCircleKm` is
+canonical; `greatCircleMeters` is its exact metre conversion. Missing,
+non-finite, and out-of-range points (latitude outside ±90, longitude outside
+±180) return `Infinity`, so threshold and nearest-item consumers exclude invalid
+positions. Older exported `haversineKm` entry points remain as compatibility
+wrappers only. `src/data/approxDistance.js`, the equirectangular
+viewer-proximity approximation, is deliberately separate, as are intentional
+local angular, projection, ellipsoidal prefilter, and small-viewport
+approximations. Four great-circle copies remain for a follow-up:
+`src/data/adminBoundaries.js` and `src/tools/area.js` pass unwrapped longitudes
+across the antimeridian, so they cannot use the strict ±180 check as-is, and
+`src/sources/adsbRecords.js` and `server/providers/common/geo.js` keep their own
+implementations.
+
 Vessel sources can report healthy empty coverage using a current, complete
 snapshot with zero raw rows, a healthy transport and a positive last-message
 time. This clears obsolete contacts and settles startup without manufacturing
@@ -791,8 +806,17 @@ and `./layers/launches`. Each owns its catalog, render state, tracking, interact
 and teardown. Source adapters retain the existing CelesTrak and Launch Library
 endpoints; standalone entries provide scene services and the satellite dependency.
 The mission factory separates paths, replay, camera, panel, overlays and placement.
+Launch Library pad coordinates retain unknown values: missing fields use the
+reported location coordinates when available, and launches without a known pad
+position stay off the map. Genuine zero coordinates remain valid. Undisclosed
+stage coordinates, downrange distance and flight numbers remain unknown; the
+mission panel omits the flight-number label when no number was reported.
 Pending mission requests abort on disable/destruction and malformed launch
-snapshots preserve the last accepted display. Catalog groups, propagation cadence,
+snapshots preserve the last accepted display. A Launch Library stale-cache fallback
+retains its missions but reports STALE in Data Layers; a fresh snapshot clears that
+provenance. Hiding retained missions does not relabel them as fresh, and teardown
+clears the instance state. Injected getLaunches-only sources remain supported.
+Catalog groups, propagation cadence,
 tracking intent, replay timing, controls and source attribution remain unchanged.
 
 The fire layer now exposes `./layers/firms`: an instance factory with separate
@@ -1254,7 +1278,13 @@ String arrays regardless of the reported feed version. Nonempty English text
 (including regional `en-*` tags, case-insensitive) takes precedence, then the first
 usable translation. An unusable `name` falls back to `short_name` with the same
 rules; if neither supplies text, the station remains available with an empty name
-(the globe uses its station-ID label and the tool returns `null`). Malformed
+(the globe uses its station-ID label and the tool returns `null`). A run of underscores,
+with the spaces around it, reads as one word break and the ends are trimmed:
+JCDecaux's Spanish contracts publish `_PLAZA_MUSICO_LOPEZ_CHAVARRI`. Other spacing
+stays as published. Capacity counts docks: PBSC adds the bikes a station accepts
+in its geofenced area to `capacity` and reports that part as `geofenced_capacity`
+(Bilbao Bizi: 839 = 39 docks + 800), so the layer, its colour ratio and
+`get_bike_share` read `capacity − geofenced_capacity` when the extension is present. Malformed
 translation entries do not interrupt loading of the other stations. This covers
 station names, not complete GBFS v3 support.
 `scripts/qa-gbfs-names.mjs` checks synthetic localized names through the real layer,
@@ -1419,6 +1449,18 @@ an empty dock. Explicit zero and caller-supplied numeric fallbacks remain valid.
 
 ## Terrain height cache bound
 
+The `/api/terrain/heights` route refuses cross-site browser requests before
+rate limiting, cache access or upstream work: a `Sec-Fetch-Site` other than
+`same-origin`/`none` (an `<img>` on another page), or a foreign or opaque
+`Origin`, gets `403`. The per-client limiter keys on the socket address, which
+for such a request is the visitor's own browser, so without the gate any page
+could spend the visitor's 90/min quota and leave the app's own lookups on
+`429`. Unlike the cost-bearing routes, the terrain gate does not refuse
+reverse-proxy forwarding headers: terrain is keyless and needed for rendering,
+and a `403` there would send every chunk to the geoid fallback for an instance
+served behind the documented reverse proxy. Same-origin app requests,
+non-browser local callers and proxied same-origin requests keep working.
+
 The terrain proxy parser rejects finite longitudes outside [-180, 180] and
 latitudes outside [-90, 90] for every client before upstream resolution. One
 out-of-range point rejects the whole batch; inclusive WGS84 bounds remain valid.
@@ -1456,9 +1498,20 @@ The Node-only `gods-eye-view/server/providers/space` export supplies factories;
 `sources/space` supplies fixed upstream URL builders with no I/O or environment
 access. Callers retain validation, transport and response policy.
 
+LL2 recent-launch requests use UTC minute-aligned bounds over the same 30-day
+window, so installations refreshing in the same minute share an upstream cache
+key. The upper bound trails the current time by less than one minute. Requests
+identify the app and repository through User-Agent; the existing 15-minute local
+cache, stale fallback and optional server-only Authorization remain unchanged.
+Provider Settings identifies LL2 tokens as optional paid higher-rate upgrades:
+standard public access needs no key, and its field can remain blank.
+
 The shared TLE text parser skips incomplete named sets and resumes at the next
 complete set. A missing orbital line does not discard the later satellites in
-the catalog; satellite layers and next-pass tools use the same parser.
+the catalog. A set whose two lines carry different catalog numbers, or a
+malformed catalog number, is skipped the same way, so a spliced catalog cannot
+pair one satellite's elements with another's. Satellite layers and next-pass
+tools use the same parser.
 
 ## Build configuration and local provider boundaries
 
@@ -2639,6 +2692,17 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with
 >   tunings. Ambient overlap includes each sprite's own rendered extent. The
 >   gated AIS, CCTV, and satellite passes retain an active-emphasis count so a
 >   settled dim contact always completes its release after tracking ends.
+> - **Terrain-height bounds:** because every distinct 5-decimal point is its own
+>   cache key, its own line in `.gev-cache/terrain-heights.json`, and its own
+>   upstream call, four limits bound what a caller can grow. Coordinates outside
+>   WGS-84 range are rejected with `400` at parse (finite is not the same as on
+>   Earth); the point cache holds at most 50,000 entries, evicting oldest-first
+>   — terrain does not move, so an evicted point costs one refetch and never a
+>   wrong answer; a cache file above 24 MB is not read back into memory (the
+>   ceiling `rocketLaunchesProxy` already applies); and the route carries an
+>   always-on limiter of 90 requests/minute/client, 270 global. That cap is an
+>   order of magnitude above measured demand — a full `npm run test:track` run
+>   drove 10 requests, peaking at 8/min.
 > - **Terrain-height resilience:** `/api/terrain/heights` caches canonical
 >   5-decimal points individually, reconstructs reordered/overlapping batches
 >   in exact request order, and refreshes only missing or stale points. Upstream
@@ -3373,7 +3437,7 @@ its criteria cannot be silently ignored.
 | CCTV                   | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Statens vegvesen (NO, stills + live HLS) + King County (WA) Open Data + WSDOT (WA) Open Data + NYC DOT TMC (opt-in) + City of Toronto RESCU + Catalonia (Servei Català de Trànsit) + Street View fallback | `src/data/cctv.js`                                    | `/api/cctv`                                              | 10s (active)                                                                      |
 | Radio                  | Radio Browser (public-domain station directory)                                                                                                                                                 | `src/data/radio.js`                                   | `/api/radio/stations`, `/api/radio/click/:uuid`          | 45 min directory refresh                                                          |
 | Transit 🚌             | Operator GTFS-Realtime VehiclePositions (7 keyless regions, `src/data/transitFeeds.js`)                                                                                                         | `src/layers/transit/` via `src/app/layers/transit.js` | `/api/transit`                                           | 15s (poll + delayed playback)                                                     |
-| Bikeshare 🚲           | GBFS (Lyft + BCycle + Social Bicycles + PBSC incl. Bike Share Toronto, Bike Itaú (Brazil) and Bicing (Barcelona) + Urban Sharing, Entur, JCDecaux NO + nextbike (AMBici))                                                                                                                                        | `src/data/bikeshare.js`                               | `/api/gbfs`                                              | 60s                                                                               |
+| Bikeshare 🚲           | GBFS (Lyft + BCycle + Social Bicycles + PBSC incl. Bike Share Toronto, Bike Itaú (Brazil), Bicing (Barcelona) and seven other Spanish cities + Urban Sharing, Entur, JCDecaux (Lillestrøm, Valencia, Seville) + nextbike (AMBici))                                                                                                                                        | `src/data/bikeshare.js`                               | `/api/gbfs`                                              | 60s                                                                               |
 | Directions 🧭          | OSRM on FOSSGIS servers (OpenStreetMap)                                                                                                                                                         | `src/data/directions.js`                              | `/api/route` (`steps=1`)                                 | on placement / mode change                                                        |
 | Datacenters ▣          | OSM extract (bundled)                                                                                                                                                                           | `src/data/localLayers.js`                             | —                                                        | static                                                                            |
 | Dams ▰                 | OpenInfraMap/OSM extract (bundled)                                                                                                                                                              | `src/data/localLayers.js`                             | —                                                        | static                                                                            |
@@ -4323,6 +4387,7 @@ silently demoting every later lookup for the session.
 - **The DENSE chip reports the dense LOAD, not the catalog param.** The param flips synchronously while the Starlink shell takes seconds to arrive over a chunked load, and CelesTrak 502s that feed regularly. So the chip reads `DENSE ···` (busy, disabled) while loading, ACTIVE only once dense points are actually on screen, and `DENSE ✕` with the reason on hover when the load fails — a failure also reverts `catalog` to `core`, drops any partial chunk, and leaves the chip clickable to retry. A load is judged by points added, not by HTTP status: a 200 carrying an empty body, a passed-through HTML error page, or only TLEs the core catalog already owns fails with the same revert semantics as a 502. Any explicit request for `core` clears a latched error even when the mode does not change, so a Space Missions restore of an already-core snapshot never leaves the user with a failure they did not cause. Because the load settles asynchronously, the layer pushes a re-render through the optional `setRowControlsListener()` hook; nothing else would repaint that row before the 5-minute catalog refresh, so the count and legend would otherwise sit stale.
 - **A dependency owner takes the row with it.** Space Missions borrows this layer for TLE lookup with `showPoints:false`; while points are hidden the layer returns empty row controls, so the legend never describes an empty sky and the chip cannot accept a write that the owner's restore would silently revert.
 - The detection-overlay record cache (`_detectionObjects`) is cleared with the catalog on every rebuild: it stamps id/class at creation only, and a rebuild can re-tag a satellite when a partial CelesTrak outage changes which group wins dedupe.
+- **Catalog numbers above 99999** can be written in a TLE as Alpha-5: a letter A–Z, skipping I and O, for the first two digits, so `A0000` is 100000 and `Z9999` is 339999. CelesTrak's TLE feed carries no satellite above 99999 (that needs the OMM feed, #1191), so this is compatibility with Alpha-5 TLEs. `src/sources/tle.js` decodes the field through one shared helper: `noradIdFromSatnum()` for the satellites layer, which keys and deduplicates its catalog by that number, and `tleCatalogNumber()` for the satellite tools. Plain digits read as before (`noradIdFromSatnum()` accepts any length, as an OMM satrec carries the number unpadded); a malformed field — a sign, decimal point, hex, exponent, embedded space, stray or lowercase letter, or blank — is rejected rather than partly read, as `NaN` in the layer and `null` in the tools.
 - **CCTV estimated bearings:** a camera whose pack marks `headingConfidence: 'low'` (the id-hash
   `fallbackHeadingFromId` bearing) shows `HDG n° (ESTIMATED)` in the HUD and draws its coverage
   wireframe dashed; colours, widths and active/idle emphasis are unchanged. A manual calibration
@@ -5458,9 +5523,9 @@ When runtime behavior or architecture changes, update this file in the same chan
 
 ## Dependency security baseline
 
-The lockfile uses DOMPurify 3.4.15, protobufjs 8.8.0, PostCSS 8.5.28, and
-nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA uses Puppeteer 25.10.0;
-image-processing tools use Sharp 0.35.4. QA scripts await Puppeteer's asynchronous
+The lockfile uses DOMPurify 3.4.17, protobufjs 8.8.0, PostCSS 8.5.28,
+source-map-js 1.2.2 and nanoid 3.3.19. Cesium remains on 1.138.0. Browser QA
+uses Puppeteer 25.10.0; image-processing tools use Sharp 0.35.5. QA scripts await Puppeteer's asynchronous
 executable-path lookup before testing or passing the path to Chrome. Supported Node versions remain
 24.14.x and 26.x. Use `npm ci` to reproduce the checked-in dependency tree.
 
diff --git a/package-lock.json b/package-lock.json
index e89fd9c65..7b6d3476f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -548,9 +548,9 @@
       }
     },
     "node_modules/@img/sharp-darwin-arm64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.4.tgz",
-      "integrity": "sha512-Uhfl4V4lhP2nbUVF9+hyH1+luj86f1gUFeo8ALYxFoULoU+G87D43BfeMP8XHsk9boxAnCY/bf2EHwhA7MuGsA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-arm64/-/sharp-darwin-arm64-0.35.5.tgz",
+      "integrity": "sha512-QRUlFQ0WxvdWyqqG/WtI3iupfD5rBzmCHXSdPsY91sAtVtTo7Q4cb6zOccZ3gqEqkr0f1As1ehLqmEpDsRf+lg==",
       "cpu": [
         "arm64"
       ],
@@ -567,13 +567,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-arm64": "1.3.3"
+        "@img/sharp-libvips-darwin-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-darwin-x64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.4.tgz",
-      "integrity": "sha512-hWniXY3bG5qKpkKrAwPe4y+VTPmf086YQAnkxWh7uA1YrlRouWGa0M0Mxj3ZjnXFkv7/TD1bTy9lGUK26vRvWw==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-darwin-x64/-/sharp-darwin-x64-0.35.5.tgz",
+      "integrity": "sha512-+BR255RhDlpygUpOc/Jdt1nT6DQ3XG/ERo5wbcdOf5Q320dKtPCKPLR1LJs9VGXRaMa8l1uUa0tkCNOXiAxZUw==",
       "cpu": [
         "x64"
       ],
@@ -590,13 +590,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-darwin-x64": "1.3.3"
+        "@img/sharp-libvips-darwin-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-freebsd-wasm32": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.4.tgz",
-      "integrity": "sha512-lIsKw/BU+kjB4eZjxrYrZmwOJYi3Ajrv66iAlBmUPyKc3HpnloevB1g3wxGD9P/5BbQ1brBGl65VRRrCvQDEqA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-freebsd-wasm32/-/sharp-freebsd-wasm32-0.35.5.tgz",
+      "integrity": "sha512-Y/z91nEZ4uIBX5X3nfTovjU9lHNKFYbL2lpHCLVNmXQK03VIZvXBBt0KxbPGp2SdGSF+2mQU4e+hQaWOt86iAw==",
       "dev": true,
       "license": "Apache-2.0",
       "optional": true,
@@ -604,7 +604,7 @@
         "freebsd"
       ],
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.4"
+        "@img/sharp-wasm32": "0.35.5"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -614,9 +614,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-arm64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.3.tgz",
-      "integrity": "sha512-suTBPTDGrI9WodccaDdwZItTSaBYASlBk1NSfElSHrUfzu3szG6lvIF58+WiFvnfzuK8ZBFS5zE00PxqxnRiPg==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-arm64/-/sharp-libvips-darwin-arm64-1.3.4.tgz",
+      "integrity": "sha512-5R89nBYiRdUlSWJxPhO+GVtaXzXSxKnRu/xqMn3KTA3L9EB9Oy/P+Nn2f2vlhPuUdy/Zusb2DarbyTpGCfEDuw==",
       "cpu": [
         "arm64"
       ],
@@ -631,9 +631,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-darwin-x64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.3.tgz",
-      "integrity": "sha512-FVJZ5mITMobmXIz/hPDTw0EintTW5H3WfrxwLqEqjiIihlu+hVRyGrFQ60xl0Lxn7Bt3zdpevPaQi0HEzqz9fw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-darwin-x64/-/sharp-libvips-darwin-x64-1.3.4.tgz",
+      "integrity": "sha512-iR2OKH80yi0U+dUplyh3/xdpFvps6YkCwsXenIJxqxR1v9o+xtKTGbS9H7cps+2Vxjc8B1j96p75NmTGjIhtpQ==",
       "cpu": [
         "x64"
       ],
@@ -648,9 +648,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.3.tgz",
-      "integrity": "sha512-3rbU4vqXXc3hY/OiXdl52xZvT0F1yEngWfvqudtPJg/KkyiaQw2DRsFrNzpmLvfavbwOq3qXn36GP8obHRULQA==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm/-/sharp-libvips-linux-arm-1.3.4.tgz",
+      "integrity": "sha512-LmRtTsOHuvM2+wlO2Db37dx5MiZhB0FvSunciw48YjdOkZz9KAiRbm8ujeMOA1INqmei5NapFxYEK1D1ZSidmw==",
       "cpu": [
         "arm"
       ],
@@ -665,9 +665,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-arm64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.3.tgz",
-      "integrity": "sha512-0DaL0A6Xu6sQSQFwe4iVCrKWU2cCTItnRsYsCdxAMm9NF6twAA9BKnoqy4hqz4+azQ0JHuA26qiUKsf1XJ/v5A==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-arm64/-/sharp-libvips-linux-arm64-1.3.4.tgz",
+      "integrity": "sha512-Y3dgX/6lE2QhQb+Gxy0WZxfg9MEm/JBjamZpS2IklP7xIQoKN4hzAm7KcMVGtaVDt3neE9OKBC7vAfonA/Lr1A==",
       "cpu": [
         "arm64"
       ],
@@ -682,9 +682,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-ppc64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.3.tgz",
-      "integrity": "sha512-cdn1OvUBwsXhbC0zSzJnNzf5MZ/mTrobawDvNXBTxe8VtqKAm0sRuEY2Evzovb/w9JMk4TvRxqt1mekSuJz64w==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-ppc64/-/sharp-libvips-linux-ppc64-1.3.4.tgz",
+      "integrity": "sha512-Le6boB8Tai0Nis+gIxIpKx68UDVVIqdR8Tin5Yf1z2LJJQLDJvCDRqRu+jC2qCoD+eIomonmOwB4smBRxfVpYQ==",
       "cpu": [
         "ppc64"
       ],
@@ -699,9 +699,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-riscv64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.3.tgz",
-      "integrity": "sha512-HjPVx7yKz+0lqdhDlTw1tt90wamBoxhiXpvl1XZpJLiHH4RCJ5yDTqH+VlYPv2fwFs89JFw4c1IexYOcQUi4IQ==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-riscv64/-/sharp-libvips-linux-riscv64-1.3.4.tgz",
+      "integrity": "sha512-aHkkIEHPRdQEegJN20MLmGtxYD9R2wQr3Cwpddnu5+YKMt6Uzax7S9h5gpZTo8wyrGuZSlfQ63OevL5mTyOC7Q==",
       "cpu": [
         "riscv64"
       ],
@@ -716,9 +716,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-s390x": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.3.tgz",
-      "integrity": "sha512-neWLh+3yCNThxnfy3c4BbVBeGgt9aftno+XbT56iK28RgeDs3UOFWviLWlUu0bArYVYJaFDK+RRohbicUNCm8Q==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-s390x/-/sharp-libvips-linux-s390x-1.3.4.tgz",
+      "integrity": "sha512-ra/mB6MikESDUO7Yg+Mi95bFBb9GsObURuhnOv3OqknjGe9sZrG8tCe9q0xSIGrtLgvgw0gKnFWcK4blSgQOuQ==",
       "cpu": [
         "s390x"
       ],
@@ -733,9 +733,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linux-x64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.3.tgz",
-      "integrity": "sha512-4vKmvAst9nrowcqquKFAyZJUDolUaIp8uRiN0mWFguJ1IplC9/pitXtlnnlU4aa/eJw3J7i67V+pwUL+wZGdsA==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linux-x64/-/sharp-libvips-linux-x64-1.3.4.tgz",
+      "integrity": "sha512-GJ//SSXbnwSDes02umB3nDJLFcQzw8a18V8fyhqr6tV515tOEMdImjjxj1AoafMRz56F3PHgftnj1QEKSU1zkw==",
       "cpu": [
         "x64"
       ],
@@ -750,9 +750,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-arm64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.3.tgz",
-      "integrity": "sha512-Y9kQaLMuNoB0bPYOOdcZMaseNrFpPodIWWMrx+CZyydf2xn68j9WYc6sWWRrDwNkzCQjKYfc68L7jKjGlHMibw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-arm64/-/sharp-libvips-linuxmusl-arm64-1.3.4.tgz",
+      "integrity": "sha512-hvulFwtjUcagsis6BBxHwGFwWoNZjgYmULGVrZcyfNbjA8hKILbRxGg15/7w5HDyXHXUos/j6baAWqnCyQ2DWA==",
       "cpu": [
         "arm64"
       ],
@@ -767,9 +767,9 @@
       }
     },
     "node_modules/@img/sharp-libvips-linuxmusl-x64": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.3.tgz",
-      "integrity": "sha512-fj8Mv0HHfD1Rr+4I68+3agJynxDWtBFgicTbSOb9Bke6pIwzGcJ+RX/yHjmiEGFMCavY/dxvem7MyNaJF+wDiw==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/@img/sharp-libvips-linuxmusl-x64/-/sharp-libvips-linuxmusl-x64-1.3.4.tgz",
+      "integrity": "sha512-6zXKeE/p39I1AmA3cJG35eyBGNqNddLnUXjhwBnsGjFPWqf5VKkDBEqaEkPDoTEtkxwi2vv8Tcr2mDyP4So7Fg==",
       "cpu": [
         "x64"
       ],
@@ -784,9 +784,9 @@
       }
     },
     "node_modules/@img/sharp-linux-arm": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.4.tgz",
-      "integrity": "sha512-7OAS8gI0EReKGVN2HssHlM6umJgxF5VI3xN0p9FA91p/YO+ou5hiNghLdZ5BEHztwaaK5+bLKRf8x/o2L2nk9A==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm/-/sharp-linux-arm-0.35.5.tgz",
+      "integrity": "sha512-LEaXK2WdXVK5ykcw0buWyPMsmLLL2vpHLD6yrNSW+JGEL3BZPA4tpKN6iaMc4AxTTAoaX/sU1rOL51lcIz48ZQ==",
       "cpu": [
         "arm"
       ],
@@ -803,13 +803,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm": "1.3.3"
+        "@img/sharp-libvips-linux-arm": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-arm64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.4.tgz",
-      "integrity": "sha512-De4jpEnAU8Hd5oT0j1G3uL4ZvTuipVMn7YC6vPaJhy6/7EwEae0SVAoBrUMYQbkLGDm85taVWwuPc1a44LTzCQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-arm64/-/sharp-linux-arm64-0.35.5.tgz",
+      "integrity": "sha512-LYVx5JTsOM2CBzmxreh+nl64/3H6Xb09iSLknqH47z2T2DFFxDeFLP5y4dJwe6H7uGQlHPyEEtIqyo3DYsRwdQ==",
       "cpu": [
         "arm64"
       ],
@@ -826,13 +826,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-arm64": "1.3.3"
+        "@img/sharp-libvips-linux-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-ppc64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.4.tgz",
-      "integrity": "sha512-2oYZJeIl4kCcMGk4ouZVjnkCtFrpQFlNEtJ6GbxzhHQchwH0NH/qEb9ykmOl29dqwMq+JhFdZn+1ak2FKhI9fQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-ppc64/-/sharp-linux-ppc64-0.35.5.tgz",
+      "integrity": "sha512-QVxAAq8evVRI9ia2vqgwrmWucn5Dfv+JdWzj75pD8omHLPSP7f8p20O8jxzjCcuCEQEOtYOZUmX1hkiZ0kdevA==",
       "cpu": [
         "ppc64"
       ],
@@ -849,13 +849,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-ppc64": "1.3.3"
+        "@img/sharp-libvips-linux-ppc64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-riscv64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.4.tgz",
-      "integrity": "sha512-cPbNChoRURAWdebDIHSenxRpgEdy7JkPydSnUxRm9VvKD7m0/xVaR/8Fzlu81pk5nHEvHH87UZUA7cTtwnbJSA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-riscv64/-/sharp-linux-riscv64-0.35.5.tgz",
+      "integrity": "sha512-LtdreXguaavKODPIfzJ4kffx7UNt1omwtK0rch4EBbbSTXPnxWmYSayXdLJw0fJzQ97kHt1gL/yh4tvU+nCyRQ==",
       "cpu": [
         "riscv64"
       ],
@@ -872,13 +872,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-riscv64": "1.3.3"
+        "@img/sharp-libvips-linux-riscv64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-s390x": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.4.tgz",
-      "integrity": "sha512-RY0JFY8Fd6RonCBtHz+DvadaPkXDSI1AUn6yWL9TipqkZ1vY8w8evqdgyDFnkm4/K1ve1TvZiaePP5oSd4+WVQ==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-s390x/-/sharp-linux-s390x-0.35.5.tgz",
+      "integrity": "sha512-UZasTOFiYzotTsGOCu42BfUzP6Tu6Do/947iRm1RsLKvlllxwGcn4RN27LibGWceix4Y+Pmw3jsnTcCQIgWjqA==",
       "cpu": [
         "s390x"
       ],
@@ -895,13 +895,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-s390x": "1.3.3"
+        "@img/sharp-libvips-linux-s390x": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linux-x64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.4.tgz",
-      "integrity": "sha512-9qvvEAuk8k89TfWUoX2htWjbAMX8p+NxCppjpcg5k6xMsjhBQPTsoIh36h9Qde4WRuGpJeYnOjdosDn/cnv+OA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linux-x64/-/sharp-linux-x64-0.35.5.tgz",
+      "integrity": "sha512-SxFtLTeJInhAA9Q836kux2vZNeOBQEx658qvbboZScr0wIARym3IcGmW7KpVD5sbVg0Ojy+udFQdayYIZyoNog==",
       "cpu": [
         "x64"
       ],
@@ -918,13 +918,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linux-x64": "1.3.3"
+        "@img/sharp-libvips-linux-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linuxmusl-arm64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.4.tgz",
-      "integrity": "sha512-KB5jxpfWQTr0nc3xdHtWChdbifHrBGsd2SM62Eyxrl8afikm+f5qGBU75SJIZBT/S1MC8XyacdlXBMSWq6OURA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-arm64/-/sharp-linuxmusl-arm64-0.35.5.tgz",
+      "integrity": "sha512-9HbMclmI1zlNkFRs3z9/eBtDjfD0sGlrX1z6b1qwmiFY5ElDLh4BC0LPBdVp7z1DXFiKlIcznf+ZlsuZzLxQqg==",
       "cpu": [
         "arm64"
       ],
@@ -941,13 +941,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3"
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-linuxmusl-x64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.4.tgz",
-      "integrity": "sha512-f+eZJZIQNEEd26RPSW+76chwOf1XtA2Y/O+5ocVyLliHkeih3e+jhLVBdNTd2rS3IbNXK8+ug93Vf5ZXtF5Lxg==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-linuxmusl-x64/-/sharp-linuxmusl-x64-0.35.5.tgz",
+      "integrity": "sha512-4KOphqB035HrVdqLZfCgMzzERrQkkzOwRhl4OAkRO1YCldbaFjySXMaK534Mo0V+LndnlJk+sbUyLeU0ULyD1A==",
       "cpu": [
         "x64"
       ],
@@ -964,13 +964,13 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.3"
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.4"
       }
     },
     "node_modules/@img/sharp-wasm32": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.4.tgz",
-      "integrity": "sha512-zQnl4Kwp7Q6NHsENtU2T/00Zi+w3AQNwz3+UaTyVBy2FpXrzXzGjndpK61onhZjRtRpQXxCTeqw19bVyXOh7jA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-wasm32/-/sharp-wasm32-0.35.5.tgz",
+      "integrity": "sha512-Ptsga1su4tQx+LLF1ECS9U6nz5kmrXKo6XVbtR48Ke3ZRxxgaWBu7IDtEe1quo8hiupwm6WFqxVlXaSf7IINGQ==",
       "dev": true,
       "license": "Apache-2.0 AND LGPL-3.0-or-later AND MIT",
       "optional": true,
@@ -985,9 +985,9 @@
       }
     },
     "node_modules/@img/sharp-webcontainers-wasm32": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.4.tgz",
-      "integrity": "sha512-ESfNkywmCfPNyaZjxooddJQiQ+l/nTpGEOGthxiLnIHXC/CmcBixnfwUleX9mCz9ovrUUvKMap/pm8RYbzfwaA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-webcontainers-wasm32/-/sharp-webcontainers-wasm32-0.35.5.tgz",
+      "integrity": "sha512-hfhF/FmoQyTUkA0bIKFOtw536BQSeBMe6BF6QyWlrPxT754+TFLaZ7sKKTfvvM0yJgKgaYTwnFCIZ/GuDw5SUA==",
       "cpu": [
         "wasm32"
       ],
@@ -995,7 +995,7 @@
       "license": "Apache-2.0",
       "optional": true,
       "dependencies": {
-        "@img/sharp-wasm32": "0.35.4"
+        "@img/sharp-wasm32": "0.35.5"
       },
       "engines": {
         "node": ">=20.9.0"
@@ -1005,9 +1005,9 @@
       }
     },
     "node_modules/@img/sharp-win32-arm64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.4.tgz",
-      "integrity": "sha512-iNdlBX9gLVvqe2I3uIJSIKTq6wckP/DYxZtcqxm09x5Gi24DnFBmPAWZmr60ZyYMG0xlzo6goG3670ar+RXvRw==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-arm64/-/sharp-win32-arm64-0.35.5.tgz",
+      "integrity": "sha512-X4t7g+7ZA5DKblCBEXGjUqqemj4vczING/5viFwAL8h4N3qYeyjwdCvRLHi4EdOUI+2Z7UFlp1VM+p/AuEtm6Q==",
       "cpu": [
         "arm64"
       ],
@@ -1025,9 +1025,9 @@
       }
     },
     "node_modules/@img/sharp-win32-ia32": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.4.tgz",
-      "integrity": "sha512-kqRsbaa5CS6KHlpxnN7WhE6vAAugXyZButpRdvDWetlv6Qv4N9WTcrWzF7tXfB9T7MsoadqdI8hmwLq6UlLvtw==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-ia32/-/sharp-win32-ia32-0.35.5.tgz",
+      "integrity": "sha512-5Zm82LoBc43nhwNybZlG7Y1KO//Zhsn306fQl29ZOuStHLGTo3BWL83q3cznX0poxSAMuYL1On/BHBxkBeKr6A==",
       "cpu": [
         "ia32"
       ],
@@ -1045,9 +1045,9 @@
       }
     },
     "node_modules/@img/sharp-win32-x64": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.4.tgz",
-      "integrity": "sha512-XtmnYhBcrORsJ4XJngyzr/EWP0hRZLAZRFaApdKuviyqF78+ylxh2y06ZmtULAMOnObJ3ucpN0AcwSWnMowTRg==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/@img/sharp-win32-x64/-/sharp-win32-x64-0.35.5.tgz",
+      "integrity": "sha512-x76eH0vEiHlcMQu8Y8IenntaACtddpT6W0wmXtWrnKcnKI7ME5DdgqhAD6SEWOEl1v2zDvkZDhFA9KnURwpfqg==",
       "cpu": [
         "x64"
       ],
@@ -1833,9 +1833,9 @@
       "integrity": "sha512-6QvTW9mrGeIegrFXdtQi9pk7O/nSK6lSdXW2eqUspN5LWD7UTji2Fqw5V2YLjBpHEoU9Xl/eUWNpDeZvoyOv2w=="
     },
     "node_modules/dompurify": {
-      "version": "3.4.15",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.15.tgz",
-      "integrity": "sha512-EUBjM+B+lkDE41iE82DDSCfkoPGfXx8IxFxPMjNzm/Uk4xDet77rTN9wqlxlVg71kK7XGuUMv6wUxJUwwv+Xyw==",
+      "version": "3.4.17",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+      "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -2782,9 +2782,9 @@
       "license": "ISC"
     },
     "node_modules/sharp": {
-      "version": "0.35.4",
-      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.4.tgz",
-      "integrity": "sha512-n++8XWcj+jCOr2IOl7h8LbKnGBDY4aPbmprMONBNFdn0ImXqpGVv5zliDs0V9HbmbCQLpbuo2ej9rAoOQTvMDA==",
+      "version": "0.35.5",
+      "resolved": "https://registry.npmjs.org/sharp/-/sharp-0.35.5.tgz",
+      "integrity": "sha512-Ywn4OnzGukp7CDMrp08RQ50YKmuwG47brZgIVPTvBaaAfQlRlygrRqSrxdCiL9M+LlzLBiJ68IR1QqvzHyjC7g==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2799,31 +2799,31 @@
         "url": "https://opencollective.com/libvips"
       },
       "optionalDependencies": {
-        "@img/sharp-darwin-arm64": "0.35.4",
-        "@img/sharp-darwin-x64": "0.35.4",
-        "@img/sharp-freebsd-wasm32": "0.35.4",
-        "@img/sharp-libvips-darwin-arm64": "1.3.3",
-        "@img/sharp-libvips-darwin-x64": "1.3.3",
-        "@img/sharp-libvips-linux-arm": "1.3.3",
-        "@img/sharp-libvips-linux-arm64": "1.3.3",
-        "@img/sharp-libvips-linux-ppc64": "1.3.3",
-        "@img/sharp-libvips-linux-riscv64": "1.3.3",
-        "@img/sharp-libvips-linux-s390x": "1.3.3",
-        "@img/sharp-libvips-linux-x64": "1.3.3",
-        "@img/sharp-libvips-linuxmusl-arm64": "1.3.3",
-        "@img/sharp-libvips-linuxmusl-x64": "1.3.3",
-        "@img/sharp-linux-arm": "0.35.4",
-        "@img/sharp-linux-arm64": "0.35.4",
-        "@img/sharp-linux-ppc64": "0.35.4",
-        "@img/sharp-linux-riscv64": "0.35.4",
-        "@img/sharp-linux-s390x": "0.35.4",
-        "@img/sharp-linux-x64": "0.35.4",
-        "@img/sharp-linuxmusl-arm64": "0.35.4",
-        "@img/sharp-linuxmusl-x64": "0.35.4",
-        "@img/sharp-webcontainers-wasm32": "0.35.4",
-        "@img/sharp-win32-arm64": "0.35.4",
-        "@img/sharp-win32-ia32": "0.35.4",
-        "@img/sharp-win32-x64": "0.35.4"
+        "@img/sharp-darwin-arm64": "0.35.5",
+        "@img/sharp-darwin-x64": "0.35.5",
+        "@img/sharp-freebsd-wasm32": "0.35.5",
+        "@img/sharp-libvips-darwin-arm64": "1.3.4",
+        "@img/sharp-libvips-darwin-x64": "1.3.4",
+        "@img/sharp-libvips-linux-arm": "1.3.4",
+        "@img/sharp-libvips-linux-arm64": "1.3.4",
+        "@img/sharp-libvips-linux-ppc64": "1.3.4",
+        "@img/sharp-libvips-linux-riscv64": "1.3.4",
+        "@img/sharp-libvips-linux-s390x": "1.3.4",
+        "@img/sharp-libvips-linux-x64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-arm64": "1.3.4",
+        "@img/sharp-libvips-linuxmusl-x64": "1.3.4",
+        "@img/sharp-linux-arm": "0.35.5",
+        "@img/sharp-linux-arm64": "0.35.5",
+        "@img/sharp-linux-ppc64": "0.35.5",
+        "@img/sharp-linux-riscv64": "0.35.5",
+        "@img/sharp-linux-s390x": "0.35.5",
+        "@img/sharp-linux-x64": "0.35.5",
+        "@img/sharp-linuxmusl-arm64": "0.35.5",
+        "@img/sharp-linuxmusl-x64": "0.35.5",
+        "@img/sharp-webcontainers-wasm32": "0.35.5",
+        "@img/sharp-win32-arm64": "0.35.5",
+        "@img/sharp-win32-ia32": "0.35.5",
+        "@img/sharp-win32-x64": "0.35.5"
       },
       "peerDependenciesMeta": {
         "@types/node": {
@@ -2832,9 +2832,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 79ab12626..4668c4f5a 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -96,6 +96,7 @@
   "server/providers/space/launch-library.js",
   "src/data/spaceProviderRequests.js",
   "src/tooling/spaceProviders.test.mjs",
+  "src/tooling/ll2Integration.test.mjs",
   "server/providers/terrain.js",
   "server/providers/traffic.js",
   "server/providers/firms.js",
@@ -446,6 +447,7 @@
   "src/data/rocketLaunches.js",
   "src/layers/satellites/source.test.mjs",
   "src/layers/launches/source.test.mjs",
+  "src/layers/launches/ingestion.test.mjs",
   "src/layers/installations/lifecycle.js",
   "src/layers/installations/viewport.js",
   "src/layers/installations/controls.js",
@@ -733,6 +735,7 @@
   "src/voice/session.test.mjs",
   "src/layers/alpr/records.js",
   "src/layers/earthquakes/records.js",
+  "src/layers/earthquakes/records.test.mjs",
   "src/sources/sourceSlot.js",
   "src/data/feedState.js",
   "src/app/localGeojsonServices.js",
@@ -1062,5 +1065,6 @@
   "src/ui/flyToDataSource.test.mjs",
   "scripts/assemble-changelog.mjs",
   "src/tooling/changelogFragments.test.mjs",
-  "src/data/gbfsProxyRateLimit.test.mjs"
+  "src/data/gbfsProxyRateLimit.test.mjs",
+  "src/terrainHeightsBounds.test.mjs"
 ]
diff --git a/scripts/package-boundaries.json b/scripts/package-boundaries.json
index 40090ba19..7085cfc74 100644
--- a/scripts/package-boundaries.json
+++ b/scripts/package-boundaries.json
@@ -114,7 +114,11 @@
     "exports": ["./server/providers/terrain"],
     "modules": [
       "server/providers/terrain.js",
-      "src/data/terrainHeightsProxy.js"
+      "src/data/terrainHeightsProxy.js",
+      "server/providers/common/rate-limit.js",
+      "src/sources/rateLimit.js",
+      "server/providers/common/same-site.js",
+      "src/localRequestGate.mjs"
     ],
     "external": []
   },
@@ -301,6 +305,7 @@
       "server/providers/regional/weather-effects.js",
       "server/providers/regional/weather.js",
       "src/data/regionalModel.js",
+      "src/geoDistance.js",
       "src/nominatimGeocode.js",
       "src/sources/httpBody.js",
       "src/i18n/marker.js",
@@ -377,6 +382,7 @@
       "src/search/nominatim.js",
       "src/nominatimGeocode.js",
       "src/data/regionalModel.js",
+      "src/geoDistance.js",
       "src/data/naturalEarthRegions.js",
       "src/data/bundledJson.js",
       "src/data/retryableLoad.js",
@@ -915,6 +921,7 @@
       "src/data/motionModel.js",
       "src/data/renderAltitude.js",
       "src/data/routePlausible.js",
+      "src/geoDistance.js",
       "src/data/trackedModelRegime.js",
       "src/data/trackingClickGesture.js",
       "src/layers/flights/controller.js",
@@ -1009,6 +1016,7 @@
       "src/data/motionModel.js",
       "src/data/renderAltitude.js",
       "src/data/routePlausible.js",
+      "src/geoDistance.js",
       "src/data/trackedModelRegime.js",
       "src/data/trackingClickGesture.js",
       "src/layers/aircraft/classification.js",
@@ -1249,6 +1257,7 @@
       "src/data/flowMatch.js",
       "src/data/tomtomTiles.js",
       "src/data/trafficBounds.js",
+      "src/geoDistance.js",
       "src/data/trafficFlowStyle.js",
       "src/data/trafficPresetStyle.js",
       "src/data/trafficQueue.js",
@@ -1297,6 +1306,7 @@
       "src/layers/bikeshare/ingestion.js",
       "src/layers/bikeshare/lifecycle.js",
       "src/layers/bikeshare/model.js",
+      "src/geoDistance.js",
       "src/sources/gbfsStations.js",
       "src/layers/bikeshare/policy.js",
       "src/layers/bikeshare/queries.js",
@@ -1340,6 +1350,7 @@
       "src/layers/cctv/ingestion.js",
       "src/layers/cctv/lifecycle.js",
       "src/layers/cctv/model.js",
+      "src/geoDistance.js",
       "src/layers/cctv/modelSpecs.js",
       "src/layers/cctv/navigation.js",
       "src/layers/cctv/policy.js",
@@ -1527,6 +1538,7 @@
     "exports": ["./geography/natural-earth", "./geography/neighborhoods"],
     "modules": [
       "src/data/naturalEarthRegions.js",
+      "src/geoDistance.js",
       "src/data/neighborhoodPolygons.js",
       "src/data/bundledJson.js",
       "src/data/retryableLoad.js",
@@ -1661,6 +1673,7 @@
       "src/data/bhoteKoshiFloodPath.js",
       "src/data/bhoteKoshiShotPaths.js",
       "src/annotations/annotationEngine.js",
+      "src/geoDistance.js",
       "src/annotations/annotationResolver.js",
       "src/annotations/hybridAnnotationRenderer.js",
       "src/annotations/index.js",
@@ -2513,6 +2526,7 @@
       "src/data/bhoteKoshiIncidentPlaces.js",
       "src/data/bhoteKoshiFloodPath.js",
       "src/data/bhoteKoshiShotPaths.js",
+      "src/geoDistance.js",
       "src/annotations/annotationResolver.js",
       "src/annotations/resolver.js",
       "src/app/catalog.js",
@@ -3075,6 +3089,7 @@
       "src/data/approxDistance.js",
       "src/data/dataCredits.js",
       "src/data/geoid.js",
+      "src/geoDistance.js",
       "src/data/local_data/natural_earth/marine.json",
       "src/data/local_data/natural_earth/regions.json",
       "src/data/local_data/neighborhoods/san-francisco.json",
@@ -3328,7 +3343,7 @@
   },
   "regional-source": {
     "exports": ["./sources/regional"],
-    "modules": ["src/data/regionalModel.js"],
+    "modules": ["src/data/regionalModel.js", "src/geoDistance.js"],
     "external": []
   },
   "voice-action-schemas": {
@@ -3491,6 +3506,7 @@
       "src/search/google.js",
       "src/search/geospatial.js",
       "src/data/regionalModel.js",
+      "src/geoDistance.js",
       "src/sources/httpBody.js",
       "src/i18n/marker.js",
       "src/sources/nominatim.js"
@@ -3514,6 +3530,7 @@
       "src/nominatimGeocode.js",
       "src/search/geospatial.js",
       "src/data/regionalModel.js",
+      "src/geoDistance.js",
       "src/sources/httpBody.js",
       "src/i18n/marker.js"
     ],
@@ -3529,6 +3546,7 @@
       "server/providers/transitHistory.js",
       "src/data/gtfsRealtime.js",
       "src/data/transitFeeds.js",
+      "src/geoDistance.js",
       "src/data/transitProxy.js",
       "src/sources/httpBody.js",
       "src/i18n/marker.js",
@@ -3544,6 +3562,7 @@
     "modules": [
       "src/data/gtfsRealtime.js",
       "src/data/transitFeeds.js",
+      "src/geoDistance.js",
       "src/data/transitProxy.js",
       "src/sources/transitHistory.js"
     ],
@@ -3565,6 +3584,7 @@
       "src/data/geoid.js",
       "src/data/groundFloor.js",
       "src/data/gtfsRealtime.js",
+      "src/geoDistance.js",
       "src/data/iconOrientation.js",
       "src/data/inputOwnership.js",
       "src/data/labelArbiter.js",
@@ -3622,6 +3642,7 @@
       "src/data/iconOrientation.js",
       "src/data/inputOwnership.js",
       "src/data/transitFeeds.js",
+      "src/geoDistance.js",
       "src/data/transitIcons.js",
       "src/data/transitPresetStyle.js",
       "src/layers/transit/controls.js",
@@ -3669,6 +3690,7 @@
     "exports": ["./sources/transit-service"],
     "modules": [
       "src/data/transitFeeds.js",
+      "src/geoDistance.js",
       "src/data/transitProxy.js",
       "src/data/gtfsRealtime.js",
       "src/sources/httpBody.js",
@@ -3793,7 +3815,8 @@
       "src/view/index.js",
       "src/tools/views.js",
       "src/tools/globePanel.js",
-      "src/tools/queries/panelRequest.js"
+      "src/tools/queries/panelRequest.js",
+      "src/geoDistance.js"
     ],
     "external": ["satellite.js"]
   },
diff --git a/server/providers/aircraft/enrichment.js b/server/providers/aircraft/enrichment.js
index 9b7c1b1bb..4c069fa7f 100644
--- a/server/providers/aircraft/enrichment.js
+++ b/server/providers/aircraft/enrichment.js
@@ -7,8 +7,9 @@ const ADSBDB_MAX_RESPONSE_BYTES = 1024 * 1024;
 /**
  * adsbdb.com enrichment proxy: callsign → route (airline + origin/destination
  * airports) and hex → aircraft type/registration. Free community API — cached
- * aggressively: ONE upstream request per new key ever (404s negative-cached),
- * persisted to disk so restarts don't re-hammer it. Adapted from skylight
+ * aggressively: successes and 404s are kept per key for 24 hours (TTL_MS) and
+ * persisted to disk so restarts don't re-hammer it; other failures are not
+ * cached. Adapted from skylight
  * (MIT) server/src/enrich/routes.ts.
  */
 export function adsbdbProxy() {
diff --git a/server/providers/common/same-site.js b/server/providers/common/same-site.js
index 11e9d37b4..c5aeb610f 100644
--- a/server/providers/common/same-site.js
+++ b/server/providers/common/same-site.js
@@ -41,3 +41,48 @@ export function sameSiteGated(handler) {
     return handler(req, res, next);
   };
 }
+
+/**
+ * Proxy header values arrive client-controlled; read one only when it is a
+ * single scheme token, never a comma-separated chain.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {'http:'|'https:'}
+ */
+function forwardedProtocol(req) {
+  if (req.socket?.encrypted) return 'https:';
+  const proto = String(req.headers?.['x-forwarded-proto'] || '')
+    .trim()
+    .toLowerCase();
+  return proto === 'https' ? 'https:' : 'http:';
+}
+
+/**
+ * Cross-site gate for keyless routes the map needs in order to render
+ * (`/api/terrain/heights`). It refuses the same cross-site browser shapes as
+ * `admitSameSite` (a `Sec-Fetch-Site` other than same-origin/none, a foreign
+ * or opaque `Origin`) but does not refuse reverse-proxy forwarding headers:
+ * those protect credentials and spend, which a keyless route has neither of,
+ * and refusing them would break rendering for an instance served behind the
+ * reverse proxy the README documents. A single `X-Forwarded-Proto` supplies
+ * the scheme an `Origin` is compared against. That header cannot be attached
+ * to a cross-site browser request without a CORS preflight this server never
+ * answers, and `Sec-Fetch-Site` is still enforced regardless.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @returns {boolean} True when a 403 was sent.
+ */
+export function admitSameSiteKeyless(req, res) {
+  const verdict = admitSameSiteRequest({
+    hostHeader: req.headers?.host,
+    protocol: forwardedProtocol(req),
+    origin: req.headers?.origin,
+    secFetchSite: req.headers?.['sec-fetch-site'],
+    proxyHeaders: {},
+  });
+  if (verdict.ok) return false;
+  res.statusCode = verdict.status;
+  res.setHeader('Content-Type', 'application/json');
+  res.setHeader('Cache-Control', 'no-store');
+  res.end(JSON.stringify({ error: verdict.error }));
+  return true;
+}
diff --git a/server/providers/space/launch-library.js b/server/providers/space/launch-library.js
index 50825df03..7b56b6220 100644
--- a/server/providers/space/launch-library.js
+++ b/server/providers/space/launch-library.js
@@ -13,6 +13,8 @@ export function launchLibraryRequestHeaders(token = process.env.LL2_API_TOKEN) {
   const normalized = String(token || '').trim();
   return {
     Accept: 'application/json',
+    'User-Agent':
+      'gods-eye-view-launch-library-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
     ...(normalized ? { Authorization: `Token ${normalized}` } : {}),
   };
 }
diff --git a/server/providers/terrain.js b/server/providers/terrain.js
index e58a63ea5..32083d23a 100644
--- a/server/providers/terrain.js
+++ b/server/providers/terrain.js
@@ -8,6 +8,8 @@ import {
   terrainPointKey,
   validTerrainResult,
 } from '../../src/data/terrainHeightsProxy.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import { admitSameSiteKeyless } from './common/same-site.js';
 
 /**
  * Re:Earth terrain point-height proxy: batched lon/lat → ellipsoidal height
@@ -20,11 +22,31 @@ import {
  * Only missing/stale points go upstream; the response is rebuilt in exact
  * request order. Larger requests are chunked sequentially, and one failing
  * chunk does not discard the chunks that resolved.
+ *
+ * Bounds, because every distinct 5dp point is its own key: coordinates must be
+ * in WGS-84 range (rejected at parse), the point cache has an entry ceiling
+ * with oldest-first eviction, an over-large cache file is not read back, and
+ * the route carries an always-on per-client limiter. The route also refuses
+ * cross-site browser requests, so another web page cannot use the visitor's
+ * browser to fill the cache or spend the visitor's own rate-limit quota.
+ * Reverse-proxied same-origin requests are admitted: terrain is keyless and
+ * needed for rendering, and a 403 would send every chunk to the geoid fallback.
  */
-export function terrainHeightsProxy() {
+export function terrainHeightsProxy(options = {}) {
+  // Destructured in the body, not the signature: `proxyErrorResponses.test.mjs`
+  // extracts these proxies by slicing to the first closing brace in column
+  // zero, so a multi-line parameter list would cut the function in half.
+  // Overridable so the ceilings can be exercised as behaviour rather than
+  // asserted as constants; production constructs this with no arguments.
+  const {
+    cacheMaxEntries = 50_000,
+    cacheMaxDiskBytes = 24 * 1024 * 1024,
+    cachePath,
+  } = options;
   const TTL_MS = 30 * 24 * 3600_000;
-  const CACHE_DIR = path.join(process.cwd(), '.gev-cache');
-  const CACHE_PATH = path.join(CACHE_DIR, 'terrain-heights.json');
+  const CACHE_PATH =
+    cachePath || path.join(process.cwd(), '.gev-cache', 'terrain-heights.json');
+  const CACHE_DIR = path.dirname(CACHE_PATH);
   // Sized against measured upstream latency, not the documented page cap.
   // Re:Earth serves 87-186 ms/point depending on load (observed 2026-09-12,
   // a 2x swing within one hour). 256 points therefore costs 22-48 s and blows
@@ -34,9 +56,50 @@ export function terrainHeightsProxy() {
   // that range.
   const UPSTREAM_CHUNK = 64;
   const MAX_POINTS = 2000;
+  /**
+   * Entry ceiling for the point cache, and with it the file written from it.
+   *
+   * Every distinct 5dp point is a separate key, so without a ceiling the map
+   * — and the JSON dumped from it verbatim — grow for as long as a caller
+   * supplies new coordinates. Measured against real use rather than guessed:
+   * this checkout's `.gev-cache/terrain-heights.json` held 6,189 entries in
+   * 1.0 MB after ordinary sessions, i.e. ~168 bytes/entry. 50,000 entries is
+   * eight times that working set and ~8 MB on disk, comfortably inside the
+   * 24 MB ceiling `rocketLaunchesProxy` already applies to its own cache file.
+   */
+  const CACHE_MAX_ENTRIES = cacheMaxEntries;
+  /** Refuse to load a cache file larger than this (mirrors rocketLaunchesProxy). */
+  const CACHE_MAX_DISK_BYTES = cacheMaxDiskBytes;
+  /**
+   * Requests/min/client. Terrain is keyless and free, so this guards the point
+   * cache and the upstream community service rather than a bill. Sized from
+   * measurement: across a full `npm run test:track` run — the heaviest
+   * exercise this app has — the route served 10 requests, peaking at 8/min.
+   * 90/min is an order of magnitude above that, and the band `/api/overpass`
+   * and `/api/military-installations` already use.
+   */
+  const RATE_PER_MIN = 90;
+  const allow = makeRateLimiter({
+    windowMs: 60_000,
+    max: RATE_PER_MIN,
+    globalMax: RATE_PER_MIN * 3,
+  });
 
   /** @type {Map<string, {at:number, result:object}>} keyed by canonical 5dp lon/lat. */
   const mem = new Map();
+
+  /**
+   * Drop the oldest entries until the map is back inside its ceiling.
+   * Oldest-first by fetch time, the same shape `trackBackfillProxies` uses.
+   * Terrain does not move, so evicting an old point costs one refetch, never
+   * a wrong answer.
+   */
+  function evictOverflow() {
+    if (mem.size <= CACHE_MAX_ENTRIES) return;
+    const byAge = [...mem.entries()].sort((a, b) => a[1].at - b[1].at);
+    for (let i = 0; i < byAge.length && mem.size > CACHE_MAX_ENTRIES; i += 1)
+      mem.delete(byAge[i][0]);
+  }
   /** @type {Map<string, Promise<Array<object>>>} single-flight per missing-point subset. */
   const inflight = new Map();
   let diskLoaded = false;
@@ -47,6 +110,21 @@ export function terrainHeightsProxy() {
     if (diskLoaded) return;
     diskLoaded = true;
     try {
+      // A cache file past the ceiling is not read back into memory: loading it
+      // would reinstate exactly the unbounded map the ceiling exists to stop.
+      // The next flush rewrites a bounded one.
+      //
+      // "Cannot measure it" is not "too large": if stat is unavailable, fall
+      // through and let readFile decide, so an absent file behaves exactly as
+      // it did before this guard existed.
+      let sizeBytes = null;
+      try {
+        sizeBytes = (await fsp.stat(CACHE_PATH)).size;
+      } catch {
+        sizeBytes = null;
+      }
+      if (sizeBytes !== null && sizeBytes > CACHE_MAX_DISK_BYTES)
+        throw new Error('cache file too large');
       const parsed = JSON.parse(await fsp.readFile(CACHE_PATH, 'utf8'));
       const pointEntries =
         parsed?.version === 2 &&
@@ -87,6 +165,7 @@ export function terrainHeightsProxy() {
         }
         diskDirty = mem.size > 0;
       }
+      evictOverflow();
     } catch {
       /* no disk cache yet */
     }
@@ -157,12 +236,25 @@ export function terrainHeightsProxy() {
 
   const installMiddleware = (server) => {
     server.middlewares.use('/api/terrain/heights', async (req, res) => {
+      // Refuse cross-site browser requests (an <img> or fetch from another
+      // site) before the limiter, cache or upstream see them. Same-origin app
+      // requests, non-browser loopback callers (MCP panel_request) and the app
+      // served behind a reverse proxy pass.
+      if (admitSameSiteKeyless(req, res)) return;
       const send = (status, bodyObj) => {
         if (res.headersSent) return;
         res.writeHead(status, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(bodyObj));
       };
       try {
+        if (!allow(clientKey(req))) {
+          res.writeHead(429, {
+            'Content-Type': 'application/json',
+            'Retry-After': '10',
+          });
+          res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+          return;
+        }
         await loadDiskOnce();
         const parsedUrl = new URL(req.url || '', 'http://internal');
         const rawPoints = parsedUrl.searchParams.get('points');
@@ -187,7 +279,10 @@ export function terrainHeightsProxy() {
           fetchMissing: fetchMissingSingleFlight,
           ttlMs: TTL_MS,
         });
-        if (outcome.cacheChanged) diskDirty = true;
+        if (outcome.cacheChanged) {
+          evictOverflow();
+          diskDirty = true;
+        }
         if (outcome.upstreamError) {
           console.warn(
             '[terrain-heights-proxy] refresh incomplete' +
diff --git a/server/standalone/unwatched-cache.js b/server/standalone/unwatched-cache.js
new file mode 100644
index 000000000..130d0ece4
--- /dev/null
+++ b/server/standalone/unwatched-cache.js
@@ -0,0 +1,28 @@
+/**
+ * Directories the app writes to while it runs. None is source, and none
+ * should reload anything.
+ */
+const RUNTIME_WRITE_GLOBS = Object.freeze([
+  '**/.gev-cache/**',
+  '**/.gev-logs/**',
+]);
+
+/**
+ * Keep the directories the app writes to out of the dev server's file watcher.
+ *
+ * Disk-cached providers write a file per response into `.gev-cache`, and the
+ * voice debug log appends to `.gev-logs`. Left watched, each write costs the
+ * watcher stat calls on libuv's thread pool, which `getaddrinfo` shares; heavy
+ * cache writes have been seen to delay upstream DNS lookups.
+ *
+ * @returns {import('vite').Plugin} Config-only plugin; no server hooks.
+ */
+export function unwatchedRuntimeDirsPlugin() {
+  return {
+    name: 'gev-unwatched-runtime-dirs',
+    apply: 'serve',
+    config: () => ({
+      server: { watch: { ignored: [...RUNTIME_WRITE_GLOBS] } },
+    }),
+  };
+}
diff --git a/server/standalone/vite.config.js b/server/standalone/vite.config.js
index a14292597..03a935092 100644
--- a/server/standalone/vite.config.js
+++ b/server/standalone/vite.config.js
@@ -6,6 +6,7 @@ import { localProviderPlugins } from '../providers/local.js';
 import { localMcpPlugin } from '../mcp/plugin.js';
 import { apiNotFoundPlugin } from './api-not-found.js';
 import { standaloneVoiceTools } from './voiceTools.js';
+import { unwatchedRuntimeDirsPlugin } from './unwatched-cache.js';
 
 const root = fileURLToPath(new URL('../../', import.meta.url));
 
@@ -20,6 +21,7 @@ export default defineConfig(({ command, mode }) => {
       ...localProviderPlugins({ realtime: { tools: standaloneVoiceTools() } }),
       localMcpPlugin(),
       apiNotFoundPlugin(),
+      unwatchedRuntimeDirsPlugin(),
     ],
     googleApiKey: process.env.GOOGLE_MAPS_API_KEY,
     cesiumToken: process.env.CESIUM_ION_TOKEN,
diff --git a/src/annotations/annotationEngine.js b/src/annotations/annotationEngine.js
index 645aa3f3d..b0622579d 100644
--- a/src/annotations/annotationEngine.js
+++ b/src/annotations/annotationEngine.js
@@ -1,6 +1,7 @@
 import { isUnavailableCapability } from '../sources/capability.js';
 import { defaultGeospatial } from '../search/defaults.js';
 import * as Cesium from 'cesium';
+import { greatCircleMeters } from '../geoDistance.js';
 import {
   holdContinuousRender,
   releaseContinuousRender,
@@ -1567,16 +1568,7 @@ async function fetchRoute(coordPairs, mode, signal, service) {
 }
 
 function greatCircleM(a, b) {
-  const R = 6371000;
-  const toRad = (deg) => (deg * Math.PI) / 180;
-  const dLat = toRad(b.lat - a.lat);
-  const dLon = toRad(b.lon - a.lon);
-  const la1 = toRad(a.lat);
-  const la2 = toRad(b.lat);
-  const h =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(la1) * Math.cos(la2) * Math.sin(dLon / 2) ** 2;
-  return 2 * R * Math.asin(Math.min(1, Math.sqrt(h)));
+  return greatCircleMeters(a, b);
 }
 
 function formatDistance(m) {
diff --git a/src/annotations/drawMode.js b/src/annotations/drawMode.js
index 34f08e8f1..02a501010 100644
--- a/src/annotations/drawMode.js
+++ b/src/annotations/drawMode.js
@@ -20,6 +20,8 @@ import { t, tn } from '../i18n/index.js';
  * `drawTool.js`.
  */
 
+import { greatCircleMeters } from '../geoDistance.js';
+
 export const DRAW_SHAPES = Object.freeze(['area', 'line', 'pin']);
 export const MIN_VERTICES = Object.freeze({ area: 3, line: 2, pin: 1 });
 /**
@@ -49,14 +51,7 @@ export function createDrawSession(shape = 'area') {
 
 /** Great-circle distance in metres between two {lon, lat} points. */
 export function greatCircleM(a, b) {
-  const R = 6371000;
-  const toRad = (d) => (d * Math.PI) / 180;
-  const dLat = toRad(b.lat - a.lat);
-  const dLon = toRad(b.lon - a.lon);
-  const h =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(toRad(a.lat)) * Math.cos(toRad(b.lat)) * Math.sin(dLon / 2) ** 2;
-  return 2 * R * Math.asin(Math.sqrt(Math.min(1, h)));
+  return greatCircleMeters(a, b);
 }
 
 /**
diff --git a/src/cockpitCloudEffects.js b/src/cockpitCloudEffects.js
index 053217810..ccbf31831 100644
--- a/src/cockpitCloudEffects.js
+++ b/src/cockpitCloudEffects.js
@@ -1,5 +1,6 @@
 import { applicationServices } from './services/application.js';
 import * as Cesium from 'cesium';
+import { greatCircleMeters } from './geoDistance.js';
 import {
   deriveWeatherEffectProfile,
   weatherAltitudeFactors,
@@ -127,23 +128,9 @@ function compileShader(gl, type, source) {
 }
 
 function greatCircleM(a, b) {
-  if (
-    ![a?.latitude, a?.longitude, b?.latitude, b?.longitude].every(
-      Number.isFinite,
-    )
-  )
-    return Infinity;
-  const latitudeA = Cesium.Math.toRadians(a.latitude);
-  const latitudeB = Cesium.Math.toRadians(b.latitude);
-  const latitudeDelta = Cesium.Math.toRadians(b.latitude - a.latitude);
-  const longitudeDelta = Cesium.Math.toRadians(b.longitude - a.longitude);
-  const haversine =
-    Math.sin(latitudeDelta / 2) ** 2 +
-    Math.cos(latitudeA) *
-      Math.cos(latitudeB) *
-      Math.sin(longitudeDelta / 2) ** 2;
-  return (
-    6371000 * 2 * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine))
+  return greatCircleMeters(
+    { lat: a?.latitude, lon: a?.longitude },
+    { lat: b?.latitude, lon: b?.longitude },
   );
 }
 
diff --git a/src/data/analystEngine.js b/src/data/analystEngine.js
index 697469dba..6c3361aff 100644
--- a/src/data/analystEngine.js
+++ b/src/data/analystEngine.js
@@ -27,6 +27,7 @@
 import { feedProvenanceEnvelope } from './layerSnapshot.js';
 import { pointInRing } from './naturalEarthRegions.js';
 import { VOICE_LAYER_MANIFEST, voiceLayer } from '../voice/layerManifest.js';
+import { greatCircleKm } from '../geoDistance.js';
 
 /**
  * Layers the engine understands, with the fields queries may reference,
@@ -98,17 +99,9 @@ function toEpochMs(value) {
   return Date.parse(text);
 }
 
-const EARTH_R_KM = 6371;
-
-/** Great-circle distance in km. */
+/** @deprecated Use geoDistance.greatCircleKm with `{ lat, lon }` points. */
 export function haversineKm(lat1, lon1, lat2, lon2) {
-  const d2r = Math.PI / 180;
-  const dLat = (lat2 - lat1) * d2r;
-  const dLon = (lon2 - lon1) * d2r;
-  const a =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(lat1 * d2r) * Math.cos(lat2 * d2r) * Math.sin(dLon / 2) ** 2;
-  return 2 * EARTH_R_KM * Math.asin(Math.min(1, Math.sqrt(a)));
+  return greatCircleKm({ lat: lat1, lon: lon1 }, { lat: lat2, lon: lon2 });
 }
 
 /**
diff --git a/src/data/dataCredits.js b/src/data/dataCredits.js
index c13c7dd94..8d3949351 100644
--- a/src/data/dataCredits.js
+++ b/src/data/dataCredits.js
@@ -305,7 +305,10 @@ export const DATA_CREDITS = [
     html:
       'Bikeshare availability: GBFS operator feeds ' +
       '(e.g. Austin BCycle; Bike Share Toronto, operated by the Toronto Parking Authority; Bike Itaú and Tembici Bogotá, operated by Tembici; ' +
-      'Bicing, Barcelona City Council (B:SM); AMBici, Àrea Metropolitana de Barcelona, operated by nextbike)',
+      'Bicing, Barcelona City Council (B:SM); AMBici, Àrea Metropolitana de Barcelona, operated by nextbike; ' +
+      'BiciMAD, <a href="https://www.emtmadrid.es" target="_blank" rel="noopener">Powered by EMT de Madrid</a>; ' +
+      'Bizi Zaragoza; BIKI, AUVASA (Valladolid); BiciCoruña; Dbizi (Donostia-San Sebastián); ' +
+      'Bilbao Bizi, Bilbao City Council; BicinRivas, Rivas-Vaciamadrid City Council)',
   },
   {
     key: 'urbansharing-gbfs',
@@ -324,7 +327,7 @@ export const DATA_CREDITS = [
   {
     key: 'jcdecaux-gbfs',
     html:
-      'City bikes (Lillestrøm): Bysykkel Lillestrøm, JCDecaux — ' +
+      'City bikes (Lillestrøm, Valencia, Seville): Bysykkel Lillestrøm, Valenbisi, Sevici, JCDecaux — ' +
       '<a href="https://developer.jcdecaux.com/files/Open-Licence-fr.pdf" target="_blank" rel="noopener">Licence Ouverte</a>',
   },
   {
diff --git a/src/data/naturalEarthRegions.js b/src/data/naturalEarthRegions.js
index 0c7af42d0..c40e180ac 100644
--- a/src/data/naturalEarthRegions.js
+++ b/src/data/naturalEarthRegions.js
@@ -18,8 +18,8 @@
 
 import { loadBundledJson } from './bundledJson.js';
 import { createRetryableLoader } from './retryableLoad.js';
+import { EARTH_RADIUS_KM, greatCircleKm } from '../geoDistance.js';
 
-const EARTH_RADIUS_KM = 6371;
 const toRad = (d) => (d * Math.PI) / 180;
 
 /** Spherical-excess ring area (km²) — same family as turf/geojson-area. */
@@ -36,15 +36,6 @@ function ringAreaKm2(ring) {
   return Math.abs((sum * EARTH_RADIUS_KM * EARTH_RADIUS_KM) / 2);
 }
 
-function haversineKm(lon1, lat1, lon2, lat2) {
-  const dLat = toRad(lat2 - lat1);
-  const dLon = toRad(lon2 - lon1);
-  const h =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(toRad(lat1)) * Math.cos(toRad(lat2)) * Math.sin(dLon / 2) ** 2;
-  return 2 * EARTH_RADIUS_KM * Math.asin(Math.min(1, Math.sqrt(h)));
-}
-
 /**
  * Normalize a query/name for matching: lowercase, strip diacritics and
  * punctuation, collapse whitespace, strip a leading "the ".
@@ -157,7 +148,10 @@ function buildEntries(pack, kind) {
       polygons,
       areaKm2,
       bbox: [minLon, minLat, maxLon, maxLat],
-      bboxDiagonalKm: haversineKm(minLon, minLat, maxLon, maxLat),
+      bboxDiagonalKm: greatCircleKm(
+        { lat: minLat, lon: minLon },
+        { lat: maxLat, lon: maxLon },
+      ),
     });
   }
   return out;
diff --git a/src/data/naturalEarthRegions.test.mjs b/src/data/naturalEarthRegions.test.mjs
index 36c1946ad..5dd78adea 100644
--- a/src/data/naturalEarthRegions.test.mjs
+++ b/src/data/naturalEarthRegions.test.mjs
@@ -3,6 +3,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { statSync, readFileSync } from 'node:fs';
 import { findNaturalRegion, listRegions, lookupNaturalRegionOutline, pointInRing } from './naturalEarthRegions.js';
+import { greatCircleKm } from '../geoDistance.js';
 
 const PACK_DIR = new URL('./local_data/natural_earth/', import.meta.url);
 
@@ -19,6 +20,16 @@ test('marquee ranges resolve with sane areas (owner acceptance: Alps + Rockies)'
   assert.ok(rockies.areaKm2 >= 700_000 && rockies.areaKm2 < 1_500_000,
     `Rockies area sane (got ${Math.round(rockies.areaKm2)} km²)`);
   assert.ok(rockies.bboxDiagonalKm > 2000, 'Rockies span thousands of km');
+  const coordinates = rockies.polygons.flat();
+  const minLon = Math.min(...coordinates.map(([lon]) => lon));
+  const minLat = Math.min(...coordinates.map(([, lat]) => lat));
+  const maxLon = Math.max(...coordinates.map(([lon]) => lon));
+  const maxLat = Math.max(...coordinates.map(([, lat]) => lat));
+  assert.equal(
+    rockies.bboxDiagonalKm,
+    greatCircleKm({ lat: minLat, lon: minLon }, { lat: maxLat, lon: maxLon }),
+    'Natural Earth bbox conversion maps [lon, lat] data into { lat, lon } points',
+  );
 });
 
 test('aliases and articles: "the Alps", "Rockies", "Sahara Desert", "Himalaya"', async () => {
diff --git a/src/data/regionalModel.js b/src/data/regionalModel.js
index fca473994..46f162d6f 100644
--- a/src/data/regionalModel.js
+++ b/src/data/regionalModel.js
@@ -1,3 +1,5 @@
+import { greatCircleMeters } from '../geoDistance.js';
+
 const MAX_ARTICLES = 5;
 
 function cleanText(value, maxLength = 180) {
@@ -153,19 +155,8 @@ export function weatherCodeLabel(code) {
 
 /** Great-circle distance used to avoid refetching a regional brief every animation frame. */
 export function regionalDistanceM(from, to) {
-  if (
-    ![from?.latitude, from?.longitude, to?.latitude, to?.longitude].every(
-      Number.isFinite,
-    )
-  ) {
-    return Infinity;
-  }
-  const phi1 = (from.latitude * Math.PI) / 180;
-  const phi2 = (to.latitude * Math.PI) / 180;
-  const deltaPhi = ((to.latitude - from.latitude) * Math.PI) / 180;
-  const deltaLambda = ((to.longitude - from.longitude) * Math.PI) / 180;
-  const a =
-    Math.sin(deltaPhi / 2) ** 2 +
-    Math.cos(phi1) * Math.cos(phi2) * Math.sin(deltaLambda / 2) ** 2;
-  return 6371000 * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+  return greatCircleMeters(
+    { lat: from?.latitude, lon: from?.longitude },
+    { lat: to?.latitude, lon: to?.longitude },
+  );
 }
diff --git a/src/data/regionalProxy.test.mjs b/src/data/regionalProxy.test.mjs
index acc1b1a22..97891bef8 100644
--- a/src/data/regionalProxy.test.mjs
+++ b/src/data/regionalProxy.test.mjs
@@ -59,9 +59,13 @@ test('new data proxies install the same routes in dev and preview servers', () =
 
 test('Launch Library uses a 15-minute cache and optional server-side token header', () => {
   assert.equal(LL2_CACHE_TTL_MS, 15 * 60_000);
-  assert.deepEqual(launchLibraryRequestHeaders(''), { Accept: 'application/json' });
-  assert.deepEqual(launchLibraryRequestHeaders(' secret '), {
+  const headers = {
     Accept: 'application/json',
+    'User-Agent': 'gods-eye-view-launch-library-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
+  };
+  assert.deepEqual(launchLibraryRequestHeaders(''), headers);
+  assert.deepEqual(launchLibraryRequestHeaders(' secret '), {
+    ...headers,
     Authorization: 'Token secret',
   });
 });
diff --git a/src/data/rocketLaunches.test.mjs b/src/data/rocketLaunches.test.mjs
index ccfd280e2..b68a11db3 100644
--- a/src/data/rocketLaunches.test.mjs
+++ b/src/data/rocketLaunches.test.mjs
@@ -677,6 +677,37 @@ test('uses Launch Library 2 pad latitude/longitude fields', () => {
   assert.equal(launches[0].lon, -120.611);
 });
 
+test('null or blank pad coordinates stay unknown instead of becoming 0', () => {
+  const base = { net: '2026-07-20T10:00:00Z' };
+  for (const blank of [null, '', '  ', false]) {
+    assert.deepEqual(
+      normalizeRocketLaunches([{ ...base, id: 'blank', pad: { latitude: blank, longitude: blank } }], NOW),
+      [],
+    );
+  }
+});
+
+test('null pad coordinates use the location fallback instead of 0,0', () => {
+  const base = { net: '2026-07-20T10:00:00Z' };
+  const [fallback] = normalizeRocketLaunches([{ ...base, id: 'fallback',
+    pad: { latitude: null, longitude: null, location: { coordinates: '-80.6,28.6' } } }], NOW);
+  assert.equal(fallback.lat, 28.6);
+  assert.equal(fallback.lon, -80.6);
+});
+
+test('an undisclosed landing keeps top-level position and stage numbers unknown', () => {
+  const base = { net: '2026-07-20T10:00:00Z' };
+  const [launch] = normalizeRocketLaunches([{ ...base, id: 'landing', pad: { latitude: 1, longitude: 2 },
+    rocket: { launcher_stage: [{ launcher_flight_number: null,
+      landing: { attempt: true, latitude: null, longitude: null, downrange_distance: null,
+        landing_location: { latitude: null, longitude: null } } }] } }], NOW);
+  const [stage] = launch.recoveryStages;
+  assert.equal(stage.lat, null);
+  assert.equal(stage.lon, null);
+  assert.equal(stage.downrangeKm, null);
+  assert.equal(stage.flightNumber, null);
+});
+
 test('normalizes detailed payload and stage recovery records', () => {
   const launches = normalizeRocketLaunches({ results: [{
     id: 'recovery-details',
diff --git a/src/data/routePlausible.js b/src/data/routePlausible.js
index a8c0e9259..238c2e6cb 100644
--- a/src/data/routePlausible.js
+++ b/src/data/routePlausible.js
@@ -10,19 +10,9 @@
  * low → its destination should be nearby).
  */
 
-const D2R = Math.PI / 180;
-const R_KM = 6371;
+import { EARTH_RADIUS_KM, greatCircleKm, isGeoPoint } from '../geoDistance.js';
 
-/** Haversine great-circle distance in km. */
-export function greatCircleKm(lat1, lon1, lat2, lon2) {
-  const p1 = lat1 * D2R;
-  const p2 = lat2 * D2R;
-  const dp = (lat2 - lat1) * D2R;
-  const dl = (lon2 - lon1) * D2R;
-  const a =
-    Math.sin(dp / 2) ** 2 + Math.cos(p1) * Math.cos(p2) * Math.sin(dl / 2) ** 2;
-  return R_KM * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
-}
+const D2R = Math.PI / 180;
 
 function bearingRad(lat1, lon1, lat2, lon2) {
   const p1 = lat1 * D2R;
@@ -36,10 +26,11 @@ function bearingRad(lat1, lon1, lat2, lon2) {
 
 /** Signed cross-track distance (km) of point from the great circle p1→p2. */
 export function crossTrackKm(lat, lon, lat1, lon1, lat2, lon2) {
-  const d13 = greatCircleKm(lat1, lon1, lat, lon) / R_KM;
+  const d13 =
+    greatCircleKm({ lat: lat1, lon: lon1 }, { lat, lon }) / EARTH_RADIUS_KM;
   const b13 = bearingRad(lat1, lon1, lat, lon);
   const b12 = bearingRad(lat1, lon1, lat2, lon2);
-  return Math.asin(Math.sin(d13) * Math.sin(b13 - b12)) * R_KM;
+  return Math.asin(Math.sin(d13) * Math.sin(b13 - b12)) * EARTH_RADIUS_KM;
 }
 
 const NEAR_ENDPOINT_KM = 130;
@@ -65,14 +56,14 @@ export function routePlausible({
   origin = null,
   destination = null,
 }) {
-  const haveO = Number.isFinite(origin?.lat) && Number.isFinite(origin?.lon);
-  const haveD =
-    Number.isFinite(destination?.lat) && Number.isFinite(destination?.lon);
+  const position = { lat: latDeg, lon: lonDeg };
+  if (!isGeoPoint(position)) return true;
+  const haveO = isGeoPoint(origin);
+  const haveD = isGeoPoint(destination);
   if (!haveO && !haveD) return true; // no coordinates — cannot judge, do not hide
 
   // (a) Geographic consistency: near an endpoint, or roughly on the path.
-  const near = (pt) =>
-    greatCircleKm(latDeg, lonDeg, pt.lat, pt.lon) < NEAR_ENDPOINT_KM;
+  const near = (point) => greatCircleKm(position, point) < NEAR_ENDPOINT_KM;
   let geomOk = (haveO && near(origin)) || (haveD && near(destination));
   if (!geomOk && haveO && haveD) {
     geomOk =
@@ -99,17 +90,10 @@ export function routePlausible({
     Math.abs(verticalRateMps) > VERT_TREND_MPS
   ) {
     if (verticalRateMps > 0) {
-      if (
-        haveO &&
-        greatCircleKm(latDeg, lonDeg, origin.lat, origin.lon) > LOCAL_AIRPORT_KM
-      )
+      if (haveO && greatCircleKm(position, origin) > LOCAL_AIRPORT_KM)
         return false; // departing — origin should be local
     } else {
-      if (
-        haveD &&
-        greatCircleKm(latDeg, lonDeg, destination.lat, destination.lon) >
-          LOCAL_AIRPORT_KM
-      )
+      if (haveD && greatCircleKm(position, destination) > LOCAL_AIRPORT_KM)
         return false; // arriving — destination should be local
     }
   }
diff --git a/src/data/routePlausible.test.mjs b/src/data/routePlausible.test.mjs
index dab932c6e..aa59a0c18 100644
--- a/src/data/routePlausible.test.mjs
+++ b/src/data/routePlausible.test.mjs
@@ -1,14 +1,15 @@
 // src/data/routePlausible.test.mjs
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
-import { routePlausible, greatCircleKm } from './routePlausible.js';
+import { greatCircleKm } from '../geoDistance.js';
+import { routePlausible } from './routePlausible.js';
 
 const SFO = { lat: 37.6188, lon: -122.3754 };
 const LAX = { lat: 33.9416, lon: -118.4085 };
 const JFK = { lat: 40.6413, lon: -73.7781 };
 
 test('greatCircleKm sanity: SFO→LAX ≈ 543 km', () => {
-  const d = greatCircleKm(SFO.lat, SFO.lon, LAX.lat, LAX.lon);
+  const d = greatCircleKm(SFO, LAX);
   assert.ok(Math.abs(d - 543) < 15, `got ${d}`);
 });
 
@@ -41,4 +42,8 @@ test('missing data never hides a route (cannot judge → allow)', () => {
     latDeg: 51.5, lonDeg: -0.12,
     origin: { lat: null, lon: null }, destination: null,
   }), true);
+  assert.equal(routePlausible({
+    latDeg: 95, lonDeg: 0,
+    origin: SFO, destination: LAX,
+  }), true);
 });
diff --git a/src/data/spaceProviderRequests.js b/src/data/spaceProviderRequests.js
index 8e3030f97..e0f1707f4 100644
--- a/src/data/spaceProviderRequests.js
+++ b/src/data/spaceProviderRequests.js
@@ -7,10 +7,12 @@ export function celestrakTleUrl(group) {
 }
 
 export function launchLibraryRecentUrl(end) {
-  const start = new Date(end.getTime() - 30 * 86400000);
+  // Stable minute boundaries let different installations share LL2's cache.
+  const roundedEnd = new Date(Math.floor(end.getTime() / 60000) * 60000);
+  const start = new Date(roundedEnd.getTime() - 30 * 86400000);
   const url = new URL('https://ll.thespacedevs.com/2.3.0/launches/');
   url.searchParams.set('net__gte', start.toISOString());
-  url.searchParams.set('net__lte', end.toISOString());
+  url.searchParams.set('net__lte', roundedEnd.toISOString());
   url.searchParams.set('limit', '100');
   url.searchParams.set('mode', 'detailed');
   return url;
diff --git a/src/data/trafficBounds.js b/src/data/trafficBounds.js
index ff5142133..5919f26f1 100644
--- a/src/data/trafficBounds.js
+++ b/src/data/trafficBounds.js
@@ -13,31 +13,11 @@
  * @module data/trafficBounds
  */
 
-/** @const {number} Mean Earth radius in km (spherical approximation). */
-const EARTH_RADIUS_KM = 6371;
+import { EARTH_RADIUS_KM, greatCircleKm, isGeoPoint } from '../geoDistance.js';
 
 const toRad = (deg) => (deg * Math.PI) / 180;
 const toDeg = (rad) => (rad * 180) / Math.PI;
 
-/**
- * Great-circle distance between two lat/lon points (haversine).
- *
- * @param {number} lat1 - First point latitude (degrees).
- * @param {number} lon1 - First point longitude (degrees).
- * @param {number} lat2 - Second point latitude (degrees).
- * @param {number} lon2 - Second point longitude (degrees).
- * @returns {number} Distance in kilometres.
- */
-export function greatCircleKm(lat1, lon1, lat2, lon2) {
-  const p1 = toRad(lat1);
-  const p2 = toRad(lat2);
-  const dp = toRad(lat2 - lat1);
-  const dl = toRad(lon2 - lon1);
-  const a =
-    Math.sin(dp / 2) ** 2 + Math.cos(p1) * Math.cos(p2) * Math.sin(dl / 2) ** 2;
-  return 2 * EARTH_RADIUS_KM * Math.asin(Math.min(1, Math.sqrt(a)));
-}
-
 /**
  * Initial bearing (radians) from point 1 toward point 2 along the great circle.
  *
@@ -111,10 +91,13 @@ export function deriveFetchCenter({
   hitLon,
   maxPullKm = 12,
 }) {
-  if (!Number.isFinite(hitLat) || !Number.isFinite(hitLon)) {
+  if (!isGeoPoint({ lat: hitLat, lon: hitLon })) {
     return { lat: nadirLat, lon: nadirLon, source: 'nadir' };
   }
-  const distKm = greatCircleKm(nadirLat, nadirLon, hitLat, hitLon);
+  const distKm = greatCircleKm(
+    { lat: nadirLat, lon: nadirLon },
+    { lat: hitLat, lon: hitLon },
+  );
   if (distKm <= maxPullKm) {
     return { lat: hitLat, lon: hitLon, source: 'hit' };
   }
diff --git a/src/data/trafficBounds.test.mjs b/src/data/trafficBounds.test.mjs
index 0ff38628d..bbc60cbfe 100644
--- a/src/data/trafficBounds.test.mjs
+++ b/src/data/trafficBounds.test.mjs
@@ -1,8 +1,8 @@
 // src/data/trafficBounds.test.mjs
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
+import { greatCircleKm } from '../geoDistance.js';
 import {
-  greatCircleKm,
   deriveFetchCenter,
   clampBoundsAroundCenter,
 } from './trafficBounds.js';
@@ -11,7 +11,7 @@ import {
 const NADIR = { lat: 30.2672, lon: -97.7431 };
 
 test('greatCircleKm sanity: Austin -> ~5 km north', () => {
-  const d = greatCircleKm(NADIR.lat, NADIR.lon, NADIR.lat + 0.045, NADIR.lon);
+  const d = greatCircleKm(NADIR, { lat: NADIR.lat + 0.045, lon: NADIR.lon });
   assert.ok(Math.abs(d - 5.0) < 0.1, `got ${d}`);
 });
 
@@ -41,14 +41,14 @@ test('oblique look within 12 km: uses the hit point verbatim', () => {
 test('horizon gaze: far hit is pulled back to 12 km along the bearing', () => {
   // Hit ~100 km due east of nadir.
   const hit = { lat: NADIR.lat, lon: NADIR.lon + 1.041 };
-  assert.ok(greatCircleKm(NADIR.lat, NADIR.lon, hit.lat, hit.lon) > 90, 'precondition: far hit');
+  assert.ok(greatCircleKm(NADIR, hit) > 90, 'precondition: far hit');
   const c = deriveFetchCenter({
     nadirLat: NADIR.lat, nadirLon: NADIR.lon,
     hitLat: hit.lat, hitLon: hit.lon,
     maxPullKm: 12,
   });
   assert.equal(c.source, 'pulled');
-  const d = greatCircleKm(NADIR.lat, NADIR.lon, c.lat, c.lon);
+  const d = greatCircleKm(NADIR, c);
   assert.ok(Math.abs(d - 12) < 0.05, `pulled distance ${d} km, expected ~12`);
   // Due-east bearing: latitude stays ~constant, longitude moves east but well
   // short of the hit.
@@ -64,12 +64,12 @@ test('pull cap is honored for other maxPullKm values', () => {
     maxPullKm: 5,
   });
   assert.equal(c.source, 'pulled');
-  const d = greatCircleKm(NADIR.lat, NADIR.lon, c.lat, c.lon);
+  const d = greatCircleKm(NADIR, c);
   assert.ok(Math.abs(d - 5) < 0.05, `pulled distance ${d} km, expected ~5`);
 });
 
-test('pickEllipsoid failure (non-finite hit): falls back to the camera nadir', () => {
-  for (const [hitLat, hitLon] of [[NaN, NaN], [undefined, undefined], [30.3, undefined]]) {
+test('invalid ground hit falls back to the camera nadir', () => {
+  for (const [hitLat, hitLon] of [[NaN, NaN], [undefined, undefined], [30.3, undefined], [91, -97], [30, 181]]) {
     const c = deriveFetchCenter({
       nadirLat: NADIR.lat, nadirLon: NADIR.lon,
       hitLat, hitLon,
diff --git a/src/data/transitFeeds.js b/src/data/transitFeeds.js
index dfd3d6b18..b8476a6ee 100644
--- a/src/data/transitFeeds.js
+++ b/src/data/transitFeeds.js
@@ -1,3 +1,5 @@
+import { greatCircleKm } from '../geoDistance.js';
+
 /**
  * @module transitFeeds
  * @description Registry of keyless, openly licensed GTFS-Realtime
@@ -773,7 +775,8 @@ export function getRegisteredTransitFeed(id) {
 }
 
 /**
- * Great-circle distance in km.
+ * Great-circle distance in km. Retained for compatibility with existing
+ * transit consumers; new shared spatial code should use `greatCircleKm`.
  * @param {number} aLat
  * @param {number} aLon
  * @param {number} bLat
@@ -781,13 +784,7 @@ export function getRegisteredTransitFeed(id) {
  * @returns {number}
  */
 export function haversineKm(aLat, aLon, bLat, bLon) {
-  const toRad = (deg) => (deg * Math.PI) / 180;
-  const dLat = toRad(bLat - aLat);
-  const dLon = toRad(bLon - aLon);
-  const h =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(toRad(aLat)) * Math.cos(toRad(bLat)) * Math.sin(dLon / 2) ** 2;
-  return 2 * 6371 * Math.asin(Math.min(1, Math.sqrt(h)));
+  return greatCircleKm({ lat: aLat, lon: aLon }, { lat: bLat, lon: bLon });
 }
 
 /**
diff --git a/src/geoDistance.js b/src/geoDistance.js
new file mode 100644
index 000000000..e71b72bb3
--- /dev/null
+++ b/src/geoDistance.js
@@ -0,0 +1,70 @@
+/**
+ * Canonical geographic point used by shared spatial utilities.
+ *
+ * @typedef {{lat: number, lon: number}} GeoPoint
+ */
+
+/** IUGG mean spherical Earth radius, in kilometres. */
+export const EARTH_RADIUS_KM = 6371.0088;
+
+const DEGREES_TO_RADIANS = Math.PI / 180;
+
+/**
+ * Whether a value is a canonical, finite WGS84-style point in degrees.
+ * Longitudes are not implicitly wrapped because an out-of-range value usually
+ * indicates a broken coordinate contract at the caller.
+ *
+ * @param {*} point
+ * @returns {point is GeoPoint}
+ */
+export function isGeoPoint(point) {
+  return (
+    Number.isFinite(point?.lat) &&
+    point.lat >= -90 &&
+    point.lat <= 90 &&
+    Number.isFinite(point?.lon) &&
+    point.lon >= -180 &&
+    point.lon <= 180
+  );
+}
+
+/**
+ * Great-circle distance in kilometres between two `{ lat, lon }` points.
+ *
+ * `{ lat, lon }` is the canonical shared coordinate representation. Invalid,
+ * missing, non-finite, or out-of-range coordinates return `Infinity`, which
+ * keeps invalid points out of threshold and nearest-neighbour selections.
+ *
+ * @param {GeoPoint} from
+ * @param {GeoPoint} to
+ * @returns {number}
+ */
+export function greatCircleKm(from, to) {
+  if (!isGeoPoint(from) || !isGeoPoint(to)) return Number.POSITIVE_INFINITY;
+
+  const latitude1 = from.lat * DEGREES_TO_RADIANS;
+  const latitude2 = to.lat * DEGREES_TO_RADIANS;
+  const latitudeDelta = (to.lat - from.lat) * DEGREES_TO_RADIANS;
+  const longitudeDelta = (to.lon - from.lon) * DEGREES_TO_RADIANS;
+  const haversine =
+    Math.sin(latitudeDelta / 2) ** 2 +
+    Math.cos(latitude1) *
+      Math.cos(latitude2) *
+      Math.sin(longitudeDelta / 2) ** 2;
+  const bounded = Math.min(1, Math.max(0, haversine));
+  return (
+    2 * EARTH_RADIUS_KM * Math.atan2(Math.sqrt(bounded), Math.sqrt(1 - bounded))
+  );
+}
+
+/**
+ * Great-circle distance in metres, with the same point and invalid-input
+ * contract as {@link greatCircleKm}.
+ *
+ * @param {GeoPoint} from
+ * @param {GeoPoint} to
+ * @returns {number}
+ */
+export function greatCircleMeters(from, to) {
+  return greatCircleKm(from, to) * 1000;
+}
diff --git a/src/geoDistance.test.mjs b/src/geoDistance.test.mjs
new file mode 100644
index 000000000..67d6c32fc
--- /dev/null
+++ b/src/geoDistance.test.mjs
@@ -0,0 +1,78 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  EARTH_RADIUS_KM,
+  greatCircleKm,
+  greatCircleMeters,
+  isGeoPoint,
+} from './geoDistance.js';
+
+const AUSTIN = Object.freeze({ lat: 30.2672, lon: -97.7431 });
+const HOUSTON = Object.freeze({ lat: 29.7604, lon: -95.3698 });
+
+test('great-circle identity and symmetry', () => {
+  assert.equal(greatCircleKm(AUSTIN, AUSTIN), 0);
+  assert.equal(greatCircleKm(AUSTIN, HOUSTON), greatCircleKm(HOUSTON, AUSTIN));
+});
+
+test('great-circle one-degree calibration and canonical units', () => {
+  const kilometres = greatCircleKm({ lat: 0, lon: 0 }, { lat: 1, lon: 0 });
+  assert.ok(Math.abs(kilometres - 111.195) < 0.001);
+  assert.equal(
+    greatCircleMeters({ lat: 0, lon: 0 }, { lat: 1, lon: 0 }),
+    kilometres * 1000,
+  );
+});
+
+test('great-circle handles dateline crossing and antipodal points', () => {
+  const acrossDateline = greatCircleKm(
+    { lat: 0, lon: 179 },
+    { lat: 0, lon: -179 },
+  );
+  assert.ok(Math.abs(acrossDateline - 222.39) < 0.01);
+  assert.ok(
+    Math.abs(
+      greatCircleKm({ lat: 0, lon: 0 }, { lat: 0, lon: 180 }) -
+        Math.PI * EARTH_RADIUS_KM,
+    ) < 1e-9,
+  );
+});
+
+test('canonical points require explicit latitude and longitude keys', () => {
+  assert.equal(isGeoPoint({ lat: 10, lon: 80 }), true);
+  assert.equal(isGeoPoint({ latitude: 10, longitude: 80 }), false);
+  assert.equal(isGeoPoint([10, 80]), false);
+  assert.equal(
+    greatCircleKm(
+      { latitude: 10, longitude: 80 },
+      { latitude: 20, longitude: 70 },
+    ),
+    Infinity,
+  );
+});
+
+test('latitude-before-longitude regression rejects a swapped Austin point', () => {
+  assert.ok(Number.isFinite(greatCircleKm(AUSTIN, HOUSTON)));
+  assert.equal(
+    greatCircleKm(
+      { lat: AUSTIN.lon, lon: AUSTIN.lat },
+      { lat: HOUSTON.lon, lon: HOUSTON.lat },
+    ),
+    Infinity,
+  );
+});
+
+test('invalid, missing, non-finite, and out-of-range points return Infinity', () => {
+  for (const point of [
+    null,
+    {},
+    { lat: 0 },
+    { lat: NaN, lon: 0 },
+    { lat: 0, lon: Infinity },
+    { lat: 90.0001, lon: 0 },
+    { lat: 0, lon: -180.0001 },
+  ]) {
+    assert.equal(greatCircleKm(point, AUSTIN), Infinity);
+    assert.equal(greatCircleMeters(AUSTIN, point), Infinity);
+  }
+});
diff --git a/src/hud.js b/src/hud.js
index 783e1d566..8190f4b1b 100644
--- a/src/hud.js
+++ b/src/hud.js
@@ -15,6 +15,7 @@ import { applicationServices } from './services/application.js';
  */
 
 import * as Cesium from 'cesium';
+import { greatCircleKm } from './geoDistance.js';
 import { forward as toMGRS } from 'mgrs';
 import { CITY_POIS } from './cityPois.js';
 import { composeLocalityTag } from './hudLocality.js';
@@ -683,13 +684,7 @@ export class IntelHUD {
    * @returns {number} Distance in kilometers.
    */
   _haversineKm(lat1, lon1, lat2, lon2) {
-    const toRad = (deg) => Cesium.Math.toRadians(deg);
-    const dLat = toRad(lat2 - lat1);
-    const dLon = toRad(lon2 - lon1);
-    const a =
-      Math.sin(dLat / 2) ** 2 +
-      Math.cos(toRad(lat1)) * Math.cos(toRad(lat2)) * Math.sin(dLon / 2) ** 2;
-    return 6371 * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+    return greatCircleKm({ lat: lat1, lon: lon1 }, { lat: lat2, lon: lon2 });
   }
 
   /**
diff --git a/src/i18n/locales/es.json b/src/i18n/locales/es.json
index b5b0a3abb..f93f42070 100644
--- a/src/i18n/locales/es.json
+++ b/src/i18n/locales/es.json
@@ -842,7 +842,8 @@
   "Real live traffic (keyless runs a simulation)": "Tráfico real en vivo (sin clave se usa una simulación)",
   "Bing imagery map stacks + world terrain": "Imágenes de Bing + terreno mundial",
   "More flight-polling credits (anonymous works without)": "Más créditos de consulta de vuelos (sin clave funciona el modo anónimo)",
-  "Higher space-missions request allowance": "Mayor límite de peticiones para misiones espaciales",
+  "Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.": "El acceso público a misiones espaciales no necesita clave. Déjalo en blanco para el uso estándar; los tokens de pago solo aumentan los límites de solicitudes.",
+  "Optional paid token — public access works without one": "Token opcional de pago — el acceso público funciona sin él",
   "Scene action failed": "La acción de escena falló",
   "Project exported": "Proyecto exportado",
   "Next session: {pendingId} — this session stays on {modelId}": "Sesión siguiente: {pendingId} — esta sesión sigue en {modelId}",
diff --git a/src/i18n/locales/ru.json b/src/i18n/locales/ru.json
index 019415690..6a58ab901 100644
--- a/src/i18n/locales/ru.json
+++ b/src/i18n/locales/ru.json
@@ -74,7 +74,8 @@
   "Removed from {store}. Restarting — this page reloads itself.": "Удалено: {store}. Перезапуск — страница перезагрузится сама.",
   "More flight-polling credits (anonymous works without)": "Повышенный лимит запросов рейсов (анонимно работает и без ключа)",
   "Street-level imagery and coverage in the Street Level layer. Free: register an app in the Mapillary developer dashboard and paste its Client Token": "Уличные снимки и покрытие в слое «Уличные снимки». Бесплатно: зарегистрируйте приложение в панели разработчика Mapillary и вставьте его клиентский токен (Client Token).",
-  "Higher space-missions request allowance": "Повышенный лимит запросов для космических миссий",
+  "Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.": "Общедоступные данные космических миссий не требуют ключа. Для обычного использования оставьте поле пустым; платные токены только повышают лимиты запросов.",
+  "Optional paid token — public access works without one": "Необязательный платный токен — публичный доступ работает без него",
   "Places context + Street View fallback; optional separate key": "Контекст Places + резерв: Просмотр улиц; отдельный ключ — по желанию",
   "Voice control — API key or ChatGPT OAuth": "Голосовое управление — ключ API или ChatGPT OAuth",
   "Live ships, worldwide": "Суда в реальном времени по всему миру",
diff --git a/src/keySetup.js b/src/keySetup.js
index aab3d62b0..b67c9df66 100644
--- a/src/keySetup.js
+++ b/src/keySetup.js
@@ -215,7 +215,7 @@ export function stripKeylessBasemapFromHash(hash) {
   }
 }
 
-const TIER_DOTS = Object.freeze({ metered: '🔴', free: '🟡' });
+const TIER_DOTS = Object.freeze({ metered: '🔴', paid: '🔴', free: '🟡' });
 
 function updateCloudVoiceAuthControl(auth, busy = false) {
   const mode = readStoredCloudVoiceAuthMode();
@@ -259,7 +259,9 @@ function buildRow(documentRef, key) {
   tier.title =
     key.tier === 'metered'
       ? t('Metered — a billing-enabled account')
-      : t('Free key — register, paste, done');
+      : key.tier === 'paid'
+        ? t('Optional paid token — public access works without one')
+        : t('Free key — register, paste, done');
   head.append(led, title, tier);
   if (key.clientExposed) {
     const exposed = documentRef.createElement('span');
diff --git a/src/keySetupCore.mjs b/src/keySetupCore.mjs
index 30c695370..10bbe32a5 100644
--- a/src/keySetupCore.mjs
+++ b/src/keySetupCore.mjs
@@ -29,7 +29,8 @@ export const KEY_SETUP_APPEND_HEADER =
 /**
  * Provider credentials, in display order — most magic per
  * minute first. `tier` mirrors the README's color legend: 'metered' (🔴) is a
- * billing-enabled account, 'free' (🟡) is a register-and-paste key.
+ * billing-enabled account, 'free' (🟡) is a register-and-paste key, and
+ * 'paid' (🔴) is an optional paid higher-rate token.
  * `clientExposed` marks the keys that are injected into the browser
  * bundle by design (restrict them at the provider, per SECURITY.md).
  * `hidden` keeps advanced configuration out of the panel and missing-key count.
@@ -119,10 +120,12 @@ export const KEY_SETUP_KEYS = Object.freeze([
   Object.freeze({
     id: 'launch-library',
     title: 'LAUNCH LIBRARY', // i18n-ignore: provider product name
-    unlocks: msg('Higher space-missions request allowance'),
-    getUrl: 'https://thespacedevs.com',
+    unlocks: msg(
+      'Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.',
+    ),
+    getUrl: 'https://thespacedevs.com/supportus',
     envVars: Object.freeze(['LL2_API_TOKEN']),
-    tier: 'free',
+    tier: 'paid',
   }),
 ]);
 
diff --git a/src/layers/bikeshare/model.js b/src/layers/bikeshare/model.js
index d501d073c..96a543232 100644
--- a/src/layers/bikeshare/model.js
+++ b/src/layers/bikeshare/model.js
@@ -5,6 +5,7 @@ import {
   parseStationStatus,
   toNonNegativeInteger,
 } from '../../sources/gbfsStations.js';
+import { greatCircleKm } from '../../geoDistance.js';
 
 export function createModel({ state: layerState, services, parts, source }) {
   /**
@@ -28,15 +29,7 @@ export function createModel({ state: layerState, services, parts, source }) {
    */
 
   function haversineKm(aLat, aLon, bLat, bLon) {
-    const toRad = (value) => (value * Math.PI) / 180;
-    const dLat = toRad(bLat - aLat);
-    const dLon = toRad(bLon - aLon);
-    const p1 = toRad(aLat);
-    const p2 = toRad(bLat);
-    const a =
-      Math.sin(dLat / 2) ** 2 +
-      Math.cos(p1) * Math.cos(p2) * Math.sin(dLon / 2) ** 2;
-    return 6371 * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+    return greatCircleKm({ lat: aLat, lon: aLon }, { lat: bLat, lon: bLon });
   }
 
   /**
diff --git a/src/layers/bikeshare/registry.js b/src/layers/bikeshare/registry.js
index b56678187..9b3c29f20 100644
--- a/src/layers/bikeshare/registry.js
+++ b/src/layers/bikeshare/registry.js
@@ -604,6 +604,114 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://gbfs.nextbike.net/maps/gbfs/v2/nextbike_bs/en/station_status.json',
     provider: 'AMBici',
   },
+  {
+    id: 'madrid-bicimad',
+    city: 'Madrid, Spain',
+    centerLat: 40.4241,
+    centerLon: -3.6825,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://madrid.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://madrid.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'BiciMAD',
+  },
+  {
+    id: 'valencia-valenbisi',
+    city: 'Valencia, Spain',
+    centerLat: 39.4706,
+    centerLon: -0.3749,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://api.cyclocity.fr/contracts/valence/gbfs/station_information.json',
+    stationStatusUrl:
+      'https://api.cyclocity.fr/contracts/valence/gbfs/station_status.json',
+    provider: 'Valenbisi',
+  },
+  {
+    id: 'zaragoza-bizi',
+    city: 'Zaragoza, Spain',
+    centerLat: 41.6481,
+    centerLon: -0.8927,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://zaragoza.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://zaragoza.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bizi Zaragoza',
+  },
+  {
+    id: 'sevilla-sevici',
+    city: 'Seville, Spain',
+    centerLat: 37.3726,
+    centerLon: -5.9607,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://api.cyclocity.fr/contracts/seville/gbfs/station_information.json',
+    stationStatusUrl:
+      'https://api.cyclocity.fr/contracts/seville/gbfs/station_status.json',
+    provider: 'Sevici',
+  },
+  {
+    id: 'valladolid-biki',
+    city: 'Valladolid, Spain',
+    centerLat: 41.6233,
+    centerLon: -4.7382,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://valladolid.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://valladolid.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'BIKI',
+  },
+  {
+    id: 'a-coruna-bicicoruna',
+    city: 'A Coruña, Spain',
+    centerLat: 43.3534,
+    centerLon: -8.4156,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://acoruna.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://acoruna.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'BiciCoruña',
+  },
+  {
+    id: 'donostia-dbizi',
+    city: 'Donostia-San Sebastián, Spain',
+    centerLat: 43.3075,
+    centerLon: -1.9696,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://sansebastian.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://sansebastian.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Dbizi',
+  },
+  {
+    id: 'bilbao-bilbaobizi',
+    city: 'Bilbao, Spain',
+    centerLat: 43.2624,
+    centerLon: -2.9367,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://bilbao.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://bilbao.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bilbao Bizi',
+  },
+  {
+    id: 'rivas-bicinrivas',
+    city: 'Rivas-Vaciamadrid, Spain',
+    centerLat: 40.3535,
+    centerLon: -3.5319,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://rivas.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://rivas.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'BicinRivas',
+  },
 ];
 function normalizeRegistryEntry(entry) {
   const id = String(entry?.id || '')
diff --git a/src/layers/bikeshare/spainCitiesSystems.test.mjs b/src/layers/bikeshare/spainCitiesSystems.test.mjs
new file mode 100644
index 000000000..2c502456f
--- /dev/null
+++ b/src/layers/bikeshare/spainCitiesSystems.test.mjs
@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { CITY_BY_ID } from './registry.js';
+import { createIngestion } from './ingestion.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+// Each system's host, its stations farthest from the registered centre in
+// opposite directions, and the stations its live feed lists away from the
+// city: a workshop at (0,0), a lab in Madrid, planned sites with no position
+// yet (checked 2026-10-17). JCDecaux names keep their feed spelling here.
+const SYSTEMS = {
+  'madrid-bicimad': {
+    host: 'madrid.publicbikesystem.net',
+    provider: 'BiciMAD',
+    stations: [
+      {
+        name: '627 - Alcalde Andrés Madrid Dávila, 92',
+        lat: 40.398303,
+        lon: -3.548534,
+      },
+      {
+        name: '672 - Estación de tren de El Barrial-Pozuelo',
+        lat: 40.464908,
+        lon: -3.807764,
+      },
+    ],
+  },
+  'valencia-valenbisi': {
+    host: 'api.cyclocity.fr',
+    provider: 'Valenbisi',
+    stations: [
+      { name: '_CAMPAMENTO_81', lat: 39.499875, lon: -0.426354 },
+      { name: '_EDIFICIO_VELES_E_VENTS', lat: 39.461943, lon: -0.323856 },
+    ],
+  },
+  'zaragoza-bizi': {
+    host: 'zaragoza.publicbikesystem.net',
+    provider: 'Bizi Zaragoza',
+    stations: [
+      { name: '231- Heroínas Sitios: Gómara', lat: 41.627549, lon: -0.962297 },
+      { name: '263- Avda. Real Zaragoza', lat: 41.666994, lon: -0.823078 },
+    ],
+  },
+  'sevilla-sevici': {
+    host: 'api.cyclocity.fr',
+    provider: 'Sevici',
+    stations: [
+      { name: '_ESTADIO OLIMPICO', lat: 37.415898, lon: -6.005849 },
+      { name: '_HOSPITAL VALME', lat: 37.320325, lon: -5.969204 },
+    ],
+    strays: [
+      {
+        station_id: '298',
+        name: '_LAB MADRID',
+        lat: 40.448779,
+        lon: -3.584983,
+      },
+      { station_id: '300', name: '_TALLER SEVILLA', lat: 0, lon: 0 },
+    ],
+  },
+  'valladolid-biki': {
+    host: 'valladolid.publicbikesystem.net',
+    provider: 'BIKI',
+    stations: [
+      { name: '1002 Puente Duero', lat: 41.55413, lon: -4.79122 },
+      { name: '1005 Santovenia Centro Civico', lat: 41.692504, lon: -4.688387 },
+    ],
+  },
+  'a-coruna-bicicoruna': {
+    host: 'acoruna.publicbikesystem.net',
+    provider: 'BiciCoruña',
+    stations: [
+      { name: 'Novo Mesoiro III', lat: 43.323367, lon: -8.443926 },
+      { name: 'Adormideras', lat: 43.3833748, lon: -8.3956482 },
+    ],
+    strays: [
+      { station_id: '24', name: 'Playa de Oza', lat: 0, lon: 0 },
+      { station_id: '37', name: 'Campus Elviña 2', lat: 0, lon: 0 },
+      { station_id: '38', name: 'Campus Zapateira', lat: 0, lon: 0 },
+    ],
+  },
+  'donostia-dbizi': {
+    host: 'sansebastian.publicbikesystem.net',
+    provider: 'Dbizi',
+    stations: [
+      { name: '59 - BUENAVISTA', lat: 43.321211, lon: -1.922239 },
+      { name: '54 - BERIO 42', lat: 43.305158, lon: -2.016997 },
+    ],
+  },
+  'bilbao-bilbaobizi': {
+    host: 'bilbao.publicbikesystem.net',
+    provider: 'Bilbao Bizi',
+    stations: [
+      { name: 'ZORROTZAKO KIROLDEGIA', lat: 43.2778696, lon: -2.9735575 },
+      { name: 'OTXARKOAGA', lat: 43.258515, lon: -2.899282 },
+    ],
+  },
+  'rivas-bicinrivas': {
+    host: 'rivas.publicbikesystem.net',
+    provider: 'BicinRivas',
+    stations: [
+      {
+        name: 'Polideportivo Parque Sureste',
+        lat: 40.3236695,
+        lon: -3.5127191,
+      },
+      { name: 'OCÉANO ÁRTICO', lat: 40.383292, lon: -3.5343627 },
+    ],
+  },
+};
+
+// The production range check, with no viewer or fetches behind it.
+const parts = {
+  model: createModel({ state: {}, services: {}, parts: {}, source: null }),
+};
+const { computeInRangeCities } = createViewport({
+  state: {},
+  services: { render: { governorRequestRender() {} } },
+  parts,
+  source: null,
+});
+
+/** Station information for `id` through the real ingestion path. */
+async function loadThroughIngestion(id, stations) {
+  const city = CITY_BY_ID.get(id);
+  const state = {
+    _stationInfoCache: new Map(),
+    _inFlightInfo: new Map(),
+    _inFlightStatus: new Map(),
+    _loadingOps: 0,
+    _loading: false,
+  };
+  const ingestion = createIngestion({
+    state,
+    services: {},
+    parts,
+    source: {
+      async getStations(url) {
+        assert.equal(url, city.stationInformationUrl);
+        return { data: { stations } };
+      },
+    },
+  });
+  return ingestion.loadCityStationInfo(id, 1);
+}
+
+test('the Spanish city systems are registered and readable through the proxy', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    assert.ok(system, `${id} is registered`);
+    assert.equal(system.provider, expected.provider);
+    assert.deepEqual(system.hosts, [expected.host]);
+    for (const feed of [
+      system.stationInformationUrl,
+      system.stationStatusUrl,
+    ]) {
+      const url = new URL(feed);
+      assert.ok(isAllowedGbfsHost(url.hostname), `${id} host ${url.hostname}`);
+      assert.ok(
+        isAllowedGbfsPath(url.pathname, url.hostname),
+        `${id} path ${url.pathname}`,
+      );
+    }
+  }
+});
+
+test('a camera over each outermost station activates its system', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    for (const station of expected.stations) {
+      assert.ok(
+        computeInRangeCities({ lat: station.lat, lon: station.lon }).has(id),
+        `${station.name} activates ${id}`,
+      );
+    }
+  }
+});
+
+test('each load radius reaches its outermost stations', () => {
+  // The range check floors every radius at 100 km, but station information is
+  // trimmed to the radius as registered, so it has to reach every station.
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    for (const station of expected.stations) {
+      const distance = parts.model.haversineKm(
+        system.centerLat,
+        system.centerLon,
+        station.lat,
+        station.lon,
+      );
+      assert.ok(
+        distance <= system.loadRadiusKm,
+        `${station.name} is ${distance.toFixed(1)} km from the ${id} centre`,
+      );
+    }
+  }
+});
+
+test('a camera over central Madrid activates BiciMAD and BicinRivas', () => {
+  // Puerta del Sol.
+  const active = computeInRangeCities({ lat: 40.4169, lon: -3.7035 });
+  assert.ok(active.has('madrid-bicimad'));
+  assert.ok(active.has('rivas-bicinrivas'));
+});
+
+test('stations a feed lists away from its city are not loaded', async () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    if (!expected.strays) continue;
+    const local = expected.stations.map((station, index) => ({
+      station_id: `local-${index}`,
+      ...station,
+    }));
+    const stations = await loadThroughIngestion(id, [
+      ...local,
+      ...expected.strays,
+    ]);
+    assert.deepEqual(
+      [...stations.keys()],
+      local.map((station) => station.station_id),
+      `${id} keeps only its local stations`,
+    );
+  }
+});
+
+test('JCDecaux station names reach the layer without underscores', async () => {
+  for (const id of ['valencia-valenbisi', 'sevilla-sevici']) {
+    const stations = await loadThroughIngestion(
+      id,
+      SYSTEMS[id].stations.map((station, index) => ({
+        station_id: String(index),
+        ...station,
+      })),
+    );
+    for (const station of stations.values())
+      assert.doesNotMatch(station.name, /_/, `${id}: ${station.name}`);
+  }
+  const valenbisi = await loadThroughIngestion('valencia-valenbisi', [
+    { station_id: '81', ...SYSTEMS['valencia-valenbisi'].stations[0] },
+  ]);
+  assert.equal(valenbisi.get('81').name, 'CAMPAMENTO 81');
+});
+
+test('PBSC station capacity reaches the layer as docks, without the geofenced area', async () => {
+  // Bilbao Bizi's ARAGOI and a BiciMAD station as published on 2026-10-17.
+  const [bilbao] = SYSTEMS['bilbao-bilbaobizi'].stations;
+  const bilbaoStations = await loadThroughIngestion('bilbao-bilbaobizi', [
+    { station_id: '1', ...bilbao, capacity: 839, geofenced_capacity: 800 },
+  ]);
+  assert.equal(bilbaoStations.get('1').capacity, 39);
+  const [madrid] = SYSTEMS['madrid-bicimad'].stations;
+  const madridStations = await loadThroughIngestion('madrid-bicimad', [
+    { station_id: '627', ...madrid, capacity: 47, geofenced_capacity: 20 },
+  ]);
+  assert.equal(madridStations.get('627').capacity, 27);
+});
diff --git a/src/layers/cctv/model.js b/src/layers/cctv/model.js
index bdf350b4e..3354e0d43 100644
--- a/src/layers/cctv/model.js
+++ b/src/layers/cctv/model.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { greatCircleKm } from '../../geoDistance.js';
 import { staticFrameRefreshMs } from '../../data/cctvLod.js';
 import { frameFetchDue, cardFetchPolicy } from '../../data/cctvCards.js';
 import { DEFAULT_CAMERA_CALIBRATION } from './policy.js';
@@ -309,12 +310,7 @@ export function createModel({ state: layerState, services, parts, source }) {
    */
 
   function haversineKm(lat1, lon1, lat2, lon2) {
-    const dLat = toRad(lat2 - lat1);
-    const dLon = toRad(lon2 - lon1);
-    const a =
-      Math.sin(dLat / 2) ** 2 +
-      Math.cos(toRad(lat1)) * Math.cos(toRad(lat2)) * Math.sin(dLon / 2) ** 2;
-    return 6371 * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
+    return greatCircleKm({ lat: lat1, lon: lon1 }, { lat: lat2, lon: lon2 });
   }
 
   /**
diff --git a/src/layers/earthquakes/records.test.mjs b/src/layers/earthquakes/records.test.mjs
new file mode 100644
index 000000000..cd7b6a874
--- /dev/null
+++ b/src/layers/earthquakes/records.test.mjs
@@ -0,0 +1,261 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { normalizeEarthquakeSnapshot } from './records.js';
+
+test('normalizeEarthquakeSnapshot parses valid GeoJSON earthquake features', () => {
+  const geojson = {
+    type: 'FeatureCollection',
+    features: [
+      {
+        id: 'us7000m123',
+        type: 'Feature',
+        geometry: {
+          type: 'Point',
+          coordinates: [-122.4194, 37.7749, 10.5],
+        },
+        properties: {
+          mag: 4.2,
+          place: 'San Francisco Bay Area, CA',
+          time: 1711929600000,
+        },
+      },
+    ],
+  };
+
+  const rows = normalizeEarthquakeSnapshot(geojson);
+  assert.equal(Array.isArray(rows), true);
+  assert.equal(rows.length, 1);
+  assert.deepEqual(rows[0], {
+    stableId: 'us7000m123',
+    usgsId: 'us7000m123',
+    lon: -122.4194,
+    lat: 37.7749,
+    depthKm: 10.5,
+    mag: 4.2,
+    place: 'San Francisco Bay Area, CA',
+    time: 1711929600000,
+  });
+});
+
+test('normalizeEarthquakeSnapshot generates index-based stable IDs when id is missing or blank', () => {
+  const geojson = {
+    features: [
+      {
+        id: null,
+        geometry: { type: 'Point', coordinates: [139.6917, 35.6895, 25.0] },
+        properties: { mag: 3.5, place: 'Tokyo, Japan', time: 1711930000000 },
+      },
+      {
+        id: '',
+        geometry: { type: 'Point', coordinates: [-70.6693, -33.4489, 45.2] },
+        properties: { mag: 5.1, place: 'Santiago, Chile', time: 1711931000000 },
+      },
+    ],
+  };
+
+  const rows = normalizeEarthquakeSnapshot(geojson);
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].stableId, 'event-1');
+  assert.equal(rows[0].usgsId, null);
+  assert.equal(rows[1].stableId, 'event-2');
+  assert.equal(rows[1].usgsId, '');
+});
+
+test('normalizeEarthquakeSnapshot filters events below M2.5 without dropping the feed', () => {
+  const geojson = {
+    features: [
+      {
+        id: 'ev-sub',
+        geometry: { type: 'Point', coordinates: [10, 20, 5] },
+        properties: { mag: 2.49, place: 'Minor tremor' },
+      },
+      {
+        id: 'ev-null-mag',
+        geometry: { type: 'Point', coordinates: [11, 21, 5] },
+        properties: { mag: null, place: 'Uncalculated' },
+      },
+      {
+        id: 'ev-threshold',
+        geometry: { type: 'Point', coordinates: [12, 22, 5] },
+        properties: { mag: 2.5, place: 'Threshold event' },
+      },
+      {
+        id: 'ev-strong',
+        geometry: { type: 'Point', coordinates: [13, 23, 5] },
+        properties: { mag: 6.8, place: 'Major event' },
+      },
+    ],
+  };
+
+  const rows = normalizeEarthquakeSnapshot(geojson);
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0].stableId, 'ev-threshold');
+  assert.equal(rows[0].mag, 2.5);
+  assert.equal(rows[1].stableId, 'ev-strong');
+  assert.equal(rows[1].mag, 6.8);
+});
+
+test('normalizeEarthquakeSnapshot normalizes optional fields to null when omitted or invalid', () => {
+  const geojson = {
+    features: [
+      {
+        id: 'ev-sparse',
+        geometry: { coordinates: [-100, 40] }, // depth omitted
+        properties: { mag: 3.0, place: 12345, time: 'invalid' }, // place not string, time not number
+      },
+    ],
+  };
+
+  const rows = normalizeEarthquakeSnapshot(geojson);
+  assert.equal(rows.length, 1);
+  assert.equal(rows[0].depthKm, null);
+  assert.equal(rows[0].place, null);
+  assert.equal(rows[0].time, null);
+});
+
+test('normalizeEarthquakeSnapshot returns null for malformed structures or non-array features', () => {
+  assert.equal(normalizeEarthquakeSnapshot(null), null);
+  assert.equal(normalizeEarthquakeSnapshot(undefined), null);
+  assert.equal(normalizeEarthquakeSnapshot({}), null);
+  assert.equal(normalizeEarthquakeSnapshot({ features: 'not-an-array' }), null);
+  assert.equal(normalizeEarthquakeSnapshot({ features: null }), null);
+});
+
+test('normalizeEarthquakeSnapshot returns null for invalid geometries or out-of-range coordinates', () => {
+  const baseFeature = {
+    id: 'test',
+    geometry: { type: 'Point', coordinates: [0, 0, 0] },
+    properties: { mag: 3.0 },
+  };
+
+  // Non-Point geometry
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: {
+            type: 'LineString',
+            coordinates: [
+              [0, 0],
+              [1, 1],
+            ],
+          },
+        },
+      ],
+    }),
+    null,
+  );
+
+  // Missing or short coordinates
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        { ...baseFeature, geometry: { type: 'Point', coordinates: [0] } },
+      ],
+    }),
+    null,
+  );
+
+  // Longitude out of range [-180, 180]
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: { type: 'Point', coordinates: [180.1, 0, 0] },
+        },
+      ],
+    }),
+    null,
+  );
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: { type: 'Point', coordinates: [-180.1, 0, 0] },
+        },
+      ],
+    }),
+    null,
+  );
+
+  // Latitude out of range [-90, 90]
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: { type: 'Point', coordinates: [0, 90.1, 0] },
+        },
+      ],
+    }),
+    null,
+  );
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: { type: 'Point', coordinates: [0, -90.1, 0] },
+        },
+      ],
+    }),
+    null,
+  );
+
+  // Non-finite depth
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [
+        {
+          ...baseFeature,
+          geometry: { type: 'Point', coordinates: [0, 0, NaN] },
+        },
+      ],
+    }),
+    null,
+  );
+
+  // Magnitude > 10
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [{ ...baseFeature, properties: { mag: 10.1 } }],
+    }),
+    null,
+  );
+
+  // Non-object or array properties
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [{ ...baseFeature, properties: 'invalid' }],
+    }),
+    null,
+  );
+  assert.equal(
+    normalizeEarthquakeSnapshot({
+      features: [{ ...baseFeature, properties: [] }],
+    }),
+    null,
+  );
+});
+
+test('normalizeEarthquakeSnapshot returns null when feed contains duplicate IDs', () => {
+  const geojson = {
+    features: [
+      {
+        id: 'duplicate-id',
+        geometry: { type: 'Point', coordinates: [0, 0, 0] },
+        properties: { mag: 3.0 },
+      },
+      {
+        id: 'duplicate-id',
+        geometry: { type: 'Point', coordinates: [1, 1, 1] },
+        properties: { mag: 4.0 },
+      },
+    ],
+  };
+
+  assert.equal(normalizeEarthquakeSnapshot(geojson), null);
+});
diff --git a/src/layers/flights/policy.js b/src/layers/flights/policy.js
index 80d77dddd..2c015e6c9 100644
--- a/src/layers/flights/policy.js
+++ b/src/layers/flights/policy.js
@@ -219,8 +219,8 @@ export const COURSE_SLEW_DT_MAX_SEC = 0.25;
 // adsbdb enrichment (best-effort, fail-silent). Bounded fan-out: max 4
 // concurrent requests, dispatches dripped ≥ENRICH_DISPATCH_GAP_MS apart
 // (≤5/s — adsbdb is a free community API; the dev-server proxy additionally
-// caches per-key on disk forever, negative results included, so repeat
-// sessions never re-hit adsbdb). Each key is requested at most once per
+// caches successful and 404 responses per key for 24 hours, so later sessions
+// may refresh them). Each key is requested at most once per
 // session. Priority jobs (tracked plane, model-eligible planes) jump the
 // queue; the ambient fleet sweep (below) fills the back at poll cadence.
 // ---------------------------------------------------------------------------
@@ -243,7 +243,7 @@ export const ENRICH_DISPATCH_GAP_MS = 200;
 //     of drip, so the backlog can't outgrow a poll and re-sorts fresh), and
 //   - a ROLLING token-bucket budget (below) bounding the sustained ambient
 //     request rate (repeat sessions resolve instantly from the proxy's
-//     permanent disk cache).
+//     24-hour disk cache).
 // Fail-silent by contract: the sweep never throws into the poll loop, never
 // blocks rendering, and never touches tracking state. When a type answer
 // lands, _requestTypeEnrichment's callback swaps the billboard glyph + scale
@@ -257,7 +257,7 @@ export const ENRICH_DISPATCH_GAP_MS = 200;
 // ENRICH_AMBIENT_REFILL_TOKENS every ENRICH_AMBIENT_REFILL_WINDOW_MS, clamped
 // at the ceiling (no banking beyond one bucket). Numbers: 150 / 5 min sustains
 // 0.5 req/s worst case — an order of magnitude under the 5/s drip that (with
-// the 4-concurrent limit + the proxy's permanent disk cache) is the REAL
+// the 4-concurrent limit + the proxy's 24-hour disk cache) is the REAL
 // politeness bound on adsbdb; the 300 ceiling preserves the old first-look
 // burst so a fresh region still classifies quickly.
 /** Bucket ceiling: max ambient tokens held at once (= the initial burst). */
diff --git a/src/layers/launches/controls.js b/src/layers/launches/controls.js
index d55394bcc..b0dc035cb 100644
--- a/src/layers/launches/controls.js
+++ b/src/layers/launches/controls.js
@@ -57,6 +57,7 @@ export function createControls({ state: layerState, services, parts, source }) {
         orbitMatches: layerState._orbitMatches,
         lastUpdate: layerState._lastUpdate,
         error: layerState._lastError,
+        stale: layerState._stale,
       };
     },
 
diff --git a/src/layers/launches/ingestion.js b/src/layers/launches/ingestion.js
index e7eab0565..bd1529c0b 100644
--- a/src/layers/launches/ingestion.js
+++ b/src/layers/launches/ingestion.js
@@ -168,9 +168,16 @@ export function createIngestion({
   async function performMissionUpdate(token) {
     try {
       ensureActiveTleLookup(token);
-      const payload = await source.getLaunches({
-        signal: layerState._sourceController.signal,
-      });
+      const { payload, stale } = source.getLaunchSnapshot
+        ? await source.getLaunchSnapshot({
+            signal: layerState._sourceController.signal,
+          })
+        : {
+            payload: await source.getLaunches({
+              signal: layerState._sourceController.signal,
+            }),
+            stale: false,
+          };
       const launches = parts.model.normalizeRocketLaunches(payload);
       if (
         !layerState._enabled ||
@@ -214,6 +221,7 @@ export function createIngestion({
       parts.panel.renderMissionPanel();
       layerState._lastUpdate = Date.now();
       layerState._lastError = null;
+      layerState._stale = stale === true;
     } catch (error) {
       if (layerState._enabled && token === layerState._lifecycleToken) {
         layerState._lastError = error.message;
diff --git a/src/layers/launches/ingestion.test.mjs b/src/layers/launches/ingestion.test.mjs
new file mode 100644
index 000000000..c19cb40e4
--- /dev/null
+++ b/src/layers/launches/ingestion.test.mjs
@@ -0,0 +1,315 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import * as Cesium from 'cesium';
+import { createLaunchSource } from './source.js';
+import { createState } from './state.js';
+import { createModel } from './model.js';
+import { createIngestion } from './ingestion.js';
+import { createControls } from './controls.js';
+import { createLifecycle } from './lifecycle.js';
+import { layerFeedState } from '../../data/feedState.js';
+
+const noop = () => {};
+
+async function fixture({ legacySource = false } = {}) {
+  const launch = {
+    id: 'owned-launch',
+    name: 'Owned mission fixture',
+    net: new Date(Date.now() - 3600000).toISOString(),
+    status: { name: 'Launch Successful' },
+    pad: { name: 'Owned pad', latitude: 28.6, longitude: -80.6 },
+    rocket: { payloads: [] },
+  };
+  const mode = { cache: 'HIT', results: [launch], hold: false };
+  let arrival;
+  let release;
+  const server = http.createServer((req, res) => {
+    if (req.url === '/api/celestrak/active') {
+      res.end('');
+      return;
+    }
+    assert.equal(req.url, '/api/launches');
+    const send = () => {
+      if (res.destroyed) return;
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        'X-GEV-Cache': mode.cache,
+      });
+      res.end(JSON.stringify({ results: mode.results }));
+    };
+    if (mode.hold) {
+      release = send;
+      arrival?.();
+    } else send();
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const origin = `http://127.0.0.1:${server.address().port}`;
+  const launchSource = createLaunchSource({
+    fetchImpl: (url, options) => {
+      assert.ok(['/api/launches', '/api/celestrak/active'].includes(url));
+      return fetch(new URL(url, origin), options);
+    },
+  });
+  const source = legacySource
+    ? {
+        getLaunches: launchSource.getLaunches,
+        getActiveTle: launchSource.getActiveTle,
+      }
+    : launchSource;
+  const services = {
+    overlays: {
+      setOverlayEntries: noop,
+      setOverlaySourceVisible: noop,
+      clearOverlaySource: noop,
+    },
+    render: { holdContinuousRender: noop, releaseContinuousRender: noop },
+  };
+  const state = createState({ services });
+  state._enabled = true;
+  state._lifecycleToken = 1;
+  state._dataSource = new Cesium.CustomDataSource('owned-qualification');
+  const canvas = Object.assign(new EventTarget(), {
+    disableRootEvents: true,
+    onwheel: null,
+    style: {},
+  });
+  const viewer = {
+    dataSources: new Cesium.DataSourceCollection(),
+    scene: { canvas, preRender: new Cesium.Event(), drillPick: () => [] },
+  };
+  await viewer.dataSources.add(state._dataSource);
+  // Only presentation boundaries are inert. Source, normalization, state,
+  // ingestion, lifecycle, stats and feed-state policy execute unchanged.
+  const parts = {
+    panel: {
+      createMissionPanel: noop,
+      renderMissionRoster: noop,
+      renderMissionPanel: noop,
+      clearMissionRosterHover: noop,
+    },
+    replay: { stopMissionReplay: noop },
+    selection: {
+      setSelectedMission: noop,
+      focusMission: noop,
+      stopMissionZoomAnchor: noop,
+    },
+    orbitRendering: {
+      removeMissionOrbitPrimitives: noop,
+      syncMissionOrbitPrimitiveVisibility: noop,
+    },
+    overlays: {
+      createReplayVehicleOverlay: noop,
+      clearMissionOverlaySources: noop,
+      hideReplayVehicleOverlay: noop,
+      destroyReplayVehicleOverlay: noop,
+    },
+    launchPad: {
+      initLaunchPadZonePrimitive: noop,
+      hideLaunchPadZone: noop,
+      destroyLaunchPadZonePrimitive: noop,
+    },
+    rendering: {
+      updateMissionFrame: noop,
+      addLaunchEntity(record) {
+        state._dataSource.entities.add({
+          id: record.id,
+          name: record.name,
+          position: Cesium.Cartesian3.fromDegrees(record.lon, record.lat),
+        });
+      },
+    },
+  };
+  const context = { state, services, parts, source };
+  parts.model = createModel(context);
+  parts.ingestion = createIngestion(context);
+  parts.controls = createControls(context);
+  parts.lifecycle = createLifecycle(context);
+  const current = () => {
+    const stats = parts.controls.methods.getStats();
+    return {
+      stats,
+      feed: layerFeedState(stats),
+      rendered: state._dataSource?.entities.values.map((x) => x.id) || [],
+      enabled: state._enabled,
+    };
+  };
+  return {
+    mode,
+    state,
+    source,
+    current,
+    viewer,
+    init: () => parts.lifecycle.methods.init(viewer),
+    update: () => parts.ingestion.methods.update(),
+    disable: () => parts.lifecycle.methods.disable(),
+    destroy: () => parts.lifecycle.methods.destroy(viewer),
+    holdArrival: () =>
+      new Promise((resolve) => {
+        arrival = resolve;
+      }),
+    release: () => release?.(),
+    async close() {
+      await parts.lifecycle.methods.destroy(viewer);
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    },
+  };
+}
+
+test('fresh launches remain nominal through ingestion and the layer stats', async () => {
+  const f = await fixture();
+  try {
+    await f.update();
+    const value = f.current();
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.stats.count, 1);
+    assert.deepEqual(value.rendered, ['owned-launch']);
+    assert.equal(value.stats.error, null);
+    assert.ok(value.stats.lastUpdate);
+  } finally {
+    await f.close();
+  }
+});
+
+test('STALE-ERROR provenance reaches the layer feed state without dropping records', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    assert.equal((await f.source.getLaunchSnapshot()).stale, true);
+    await f.update();
+    const value = f.current();
+    assert.equal(value.stats.count, 1);
+    assert.deepEqual(value.rendered, ['owned-launch']);
+    assert.equal(value.feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('a fresh recovery clears stale launch provenance', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    const stale = f.current();
+    f.mode.cache = 'MISS';
+    await f.update();
+    const recovered = f.current();
+    assert.equal(recovered.feed, 'nominal');
+    assert.equal(recovered.stats.count, 1);
+    assert.equal(recovered.stats.error, null);
+    assert.equal(stale.feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('an empty stale snapshot still identifies its fallback provenance', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    f.mode.results = [];
+    await f.update();
+    assert.equal(f.current().stats.count, 0);
+    assert.equal(f.current().feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('getLaunches-only injected sources remain supported', async () => {
+  const f = await fixture({ legacySource: true });
+  try {
+    await f.update();
+    assert.equal(f.current().feed, 'nominal');
+    assert.deepEqual(f.current().rendered, ['owned-launch']);
+  } finally {
+    await f.close();
+  }
+});
+
+test('disable cancels a pending stale response without committing it', async () => {
+  const f = await fixture();
+  try {
+    await f.update();
+    const healthy = f.current();
+    f.mode.cache = 'STALE-ERROR';
+    f.mode.hold = true;
+    const arrived = f.holdArrival();
+    const pending = f.update();
+    await arrived;
+    await f.disable();
+    f.release();
+    await pending;
+    const value = f.current();
+    assert.equal(value.enabled, false);
+    assert.equal(value.stats.lastUpdate, healthy.stats.lastUpdate);
+    assert.equal(value.feed, 'nominal');
+    assert.equal(f.state._sourceController.signal.aborted, true);
+  } finally {
+    await f.close();
+  }
+});
+
+test('hiding retained stale records does not relabel them as fresh', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.disable();
+    assert.equal(f.current().feed, 'stale');
+    assert.equal(f.current().stats.count, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('destroy clears the previous feed state and records', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.destroy();
+    const value = f.current();
+    assert.equal(value.stats.count, 0);
+    assert.equal(value.stats.lastUpdate, null);
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.enabled, false);
+  } finally {
+    await f.close();
+  }
+});
+
+test('destroy followed by actual init starts a clean instance with owned handlers', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.destroy();
+    await f.init();
+    const value = f.current();
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.stats.count, 0);
+    assert.equal(value.stats.lastUpdate, null);
+    assert.equal(value.stats.error, null);
+    assert.equal(value.enabled, false);
+    assert.equal(f.viewer.dataSources.length, 1);
+    assert.equal(f.viewer.scene.preRender.numberOfListeners, 1);
+    const click = f.state._clickHandler;
+    const move = f.state._moveHandler;
+    assert.ok(click instanceof Cesium.ScreenSpaceEventHandler);
+    assert.ok(move instanceof Cesium.ScreenSpaceEventHandler);
+    assert.equal(
+      typeof click.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK),
+      'function',
+    );
+    await f.destroy();
+    assert.equal(click.isDestroyed(), true);
+    assert.equal(move.isDestroyed(), true);
+    assert.equal(f.viewer.dataSources.length, 0);
+    assert.equal(f.viewer.scene.preRender.numberOfListeners, 0);
+  } finally {
+    await f.close();
+  }
+});
diff --git a/src/layers/launches/lifecycle.js b/src/layers/launches/lifecycle.js
index 58d70d34b..75b0276a3 100644
--- a/src/layers/launches/lifecycle.js
+++ b/src/layers/launches/lifecycle.js
@@ -20,6 +20,7 @@ export function createLifecycle({
       viewer.dataSources.add(layerState._dataSource);
       layerState._count = 0;
       layerState._lastUpdate = null;
+      layerState._stale = false;
       layerState._lastError = null;
       layerState._orbitMatches = 0;
       parts.overlays.clearMissionOverlaySources();
@@ -160,6 +161,7 @@ export function createLifecycle({
       layerState._count = 0;
       layerState._orbitMatches = 0;
       layerState._lastUpdate = null;
+      layerState._stale = false;
       layerState._activeTleText = null;
       layerState._activeTlePromise = null;
       layerState._activeTlePromiseToken = 0;
diff --git a/src/layers/launches/model.js b/src/layers/launches/model.js
index 0a9dd67ea..5697e07e8 100644
--- a/src/layers/launches/model.js
+++ b/src/layers/launches/model.js
@@ -10,6 +10,9 @@ export const UNKNOWN_LAUNCH_STATUS = msg('Unknown');
 
 export function createModel({ state: layerState, services, parts, source }) {
   function finiteCoordinate(value) {
+    // Number(null), Number('') and Number(false) are 0: absent is not zero.
+    if (value == null || typeof value === 'boolean') return null;
+    if (typeof value === 'string' && value.trim() === '') return null;
     const number = Number(value);
     return Number.isFinite(number) ? number : null;
   }
@@ -184,15 +187,11 @@ export function createModel({ state: layerState, services, parts, source }) {
         const pad = launch.pad || {};
         const location = pad.location || {};
         const coordinates = location.coordinates || '';
-        const [coordinateLon, coordinateLat] = String(coordinates)
-          .split(',')
-          .map(Number);
-        const lat = Number.isFinite(Number(pad.latitude))
-          ? Number(pad.latitude)
-          : coordinateLat;
-        const lon = Number.isFinite(Number(pad.longitude))
-          ? Number(pad.longitude)
-          : coordinateLon;
+        const [coordinateLon, coordinateLat] = String(coordinates).split(',');
+        const lat =
+          finiteCoordinate(pad.latitude) ?? finiteCoordinate(coordinateLat);
+        const lon =
+          finiteCoordinate(pad.longitude) ?? finiteCoordinate(coordinateLon);
         const payloads = normalizePayloadFlights(launch);
         return {
           id: String(
diff --git a/src/layers/launches/state.js b/src/layers/launches/state.js
index 0f0194221..d70be5b54 100644
--- a/src/layers/launches/state.js
+++ b/src/layers/launches/state.js
@@ -19,6 +19,8 @@ export function createState({ services }) {
 
   state._lastError = null;
 
+  state._stale = false;
+
   state._orbitMatches = 0;
 
   state._clickHandler = null;
diff --git a/src/layers/satellites/catalog.js b/src/layers/satellites/catalog.js
index 25eaf9b2c..fd136c82d 100644
--- a/src/layers/satellites/catalog.js
+++ b/src/layers/satellites/catalog.js
@@ -1,5 +1,6 @@
 import * as Cesium from 'cesium';
 import { twoline2satrec } from 'satellite.js';
+import { noradIdFromSatnum } from '../../sources/tle.js';
 import {
   DENSE_REFRESH_FRAMES,
   DENSE_GROUP_PATH,
@@ -113,7 +114,7 @@ export function createCatalog({ state: layerState, services, parts, source }) {
           const entry = entries[i];
           const satrec = twoline2satrec(entry.line1, entry.line2);
           if (!satrec || satrec.error !== 0) continue;
-          const noradId = Number(satrec.satnum);
+          const noradId = noradIdFromSatnum(satrec.satnum);
           if (layerState._catalog.has(noradId)) continue; // core catalog keeps priority
           const pos = parts.orbits.propagatePosition(satrec, now);
           if (!pos) continue;
diff --git a/src/layers/satellites/ingestion.js b/src/layers/satellites/ingestion.js
index 7284cdd8c..f8ca1db56 100644
--- a/src/layers/satellites/ingestion.js
+++ b/src/layers/satellites/ingestion.js
@@ -1,6 +1,7 @@
 import { twoline2satrec } from 'satellite.js';
 import * as Cesium from 'cesium';
 import { msg } from '../../i18n/index.js';
+import { noradIdFromSatnum } from '../../sources/tle.js';
 import { CATALOG_GROUPS, ISS_NORAD, POINT_STYLES } from './policy.js';
 
 export function createIngestion({
@@ -111,7 +112,7 @@ export function createIngestion({
           const satrec = twoline2satrec(entry.line1, entry.line2);
           if (!satrec || satrec.error !== 0) continue;
 
-          const noradId = Number(satrec.satnum);
+          const noradId = noradIdFromSatnum(satrec.satnum);
           if (seen.has(noradId)) continue;
           seen.add(noradId);
 
diff --git a/src/layers/satellites/ingestion.test.mjs b/src/layers/satellites/ingestion.test.mjs
new file mode 100644
index 000000000..313d999ee
--- /dev/null
+++ b/src/layers/satellites/ingestion.test.mjs
@@ -0,0 +1,80 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseTleText } from '../../sources/tle.js';
+import { createIngestion } from './ingestion.js';
+
+// The ISS set (1 January 2024) with its catalog field swapped per satellite.
+const ISS_LINE1 =
+  '1 25544U 98067A   24001.50000000  .00016717  00000-0  30370-3 0  9993';
+const ISS_LINE2 =
+  '2 25544  51.6416 247.4627 0006703 130.5360 325.0288 15.50377579432323';
+
+function tleSet(name, field) {
+  return [
+    name,
+    ISS_LINE1.replace('25544', field),
+    ISS_LINE2.replace('25544', field),
+  ].join('\n');
+}
+
+function ingestionFor(catalogText) {
+  const state = {
+    _trackingRefreshEpoch: 0,
+    _activeUpdateControllers: new Set(),
+    _pointCollection: {
+      removeAll() {},
+      add: (point) => point,
+    },
+    _points: new Map(),
+    _orbitPaths: new Map(),
+    _catalog: new Map(),
+    _detectionObjects: new Map(),
+    _denseLoadToken: 0,
+    _catalogRevision: 0,
+    _params: { catalog: 'core', showOrbits: false },
+  };
+  const parts = {
+    orbits: {
+      parseTLE: parseTleText,
+      propagatePosition: () => ({ longitude: 0, latitude: 0, altitude: 4e5 }),
+    },
+    labels: { _syncIssOverlay() {} },
+    controls: { _pointStyleFor: () => ({}) },
+    rendering: { _showOrbitPath() {} },
+    tracking: {
+      async _reconcileTrackedSubjectContext() {},
+      _applyPendingTrackingRestore() {},
+    },
+    catalog: {},
+  };
+  const source = {
+    async readGroup() {
+      return { ok: true, text: catalogText };
+    },
+  };
+  const { methods } = createIngestion({ state, services: {}, parts, source });
+  return { state, update: () => methods.update({ scene: {} }) };
+}
+
+test('every Alpha-5 satellite keeps its own catalog entry through dedupe', async (t) => {
+  t.mock.method(console, 'log', () => {});
+  t.mock.method(console, 'warn', () => {});
+  const { state, update } = ingestionFor(
+    [
+      tleSet('FIRST', 'A0000'),
+      tleSet('SECOND', 'B0001'),
+      tleSet('THIRD', 'Z9999'),
+    ].join('\n'),
+  );
+  await update();
+  assert.deepEqual(
+    [...state._catalog].map(([id, entry]) => [id, entry.name]),
+    [
+      [100000, 'FIRST'],
+      [110001, 'SECOND'],
+      [339999, 'THIRD'],
+    ],
+  );
+  assert.deepEqual([...state._points.keys()], [100000, 110001, 339999]);
+  assert.equal(state._count, 3);
+});
diff --git a/src/layers/satellites/orbits.js b/src/layers/satellites/orbits.js
index 32bb57cf9..0e4461e85 100644
--- a/src/layers/satellites/orbits.js
+++ b/src/layers/satellites/orbits.js
@@ -8,7 +8,7 @@ import {
   twoline2satrec,
 } from 'satellite.js';
 import { findNextSatellitePass } from '../../data/satellitePass.js';
-import { parseTleText } from '../../sources/tle.js';
+import { noradIdFromSatnum, parseTleText } from '../../sources/tle.js';
 import { ORBIT_PATH_STEPS, ISS_NORAD } from './policy.js';
 
 export function createOrbits({ state: layerState, services, parts, source }) {
@@ -284,7 +284,7 @@ export function createOrbits({ state: layerState, services, parts, source }) {
     const current = propagatePosition(satrec, referenceDate);
     if (!current) return null;
     return {
-      noradId: Number(satrec.satnum),
+      noradId: noradIdFromSatnum(satrec.satnum),
       name: String(name || '').trim(),
       current,
       periodSec: orbitalPeriodSeconds(satrec),
diff --git a/src/locations.js b/src/locations.js
index 1c5e94f2f..d17186905 100644
--- a/src/locations.js
+++ b/src/locations.js
@@ -3,6 +3,7 @@ import { isUnavailableCapability } from './sources/capability.js';
 import { createOverpassFeatureSource } from './sources/overpassFeatures.js';
 import { applicationServices } from './services/application.js';
 import * as Cesium from 'cesium';
+import { greatCircleKm } from './geoDistance.js';
 import {
   viewportBias,
   placesNearViewRecovery,
@@ -648,18 +649,6 @@ export const PLACE_ANCHOR_OFFSET_RATIO = 0.15;
  */
 const PLACE_FALLBACK_HALF_SPAN_KM = 20;
 
-/** Great-circle distance in km (small enough here that the spherical model is fine). */
-function greatCircleKm(lat1, lng1, lat2, lng2) {
-  const dLat = Cesium.Math.toRadians(lat2 - lat1);
-  const dLng = Cesium.Math.toRadians(lng2 - lng1);
-  const a =
-    Math.sin(dLat / 2) ** 2 +
-    Math.cos(Cesium.Math.toRadians(lat1)) *
-      Math.cos(Cesium.Math.toRadians(lat2)) *
-      Math.sin(dLng / 2) ** 2;
-  return 6371 * 2 * Math.asin(Math.min(1, Math.sqrt(a)));
-}
-
 /**
  * Sanity-gate a geocode viewport before framing it. Pure — exported for unit tests.
  *
@@ -694,10 +683,8 @@ export function placeFramingViewport(
     return viewport;
 
   const offsetKm = greatCircleKm(
-    anchorLat,
-    anchorLng,
-    metrics.centerLat,
-    metrics.centerLng,
+    { lat: anchorLat, lon: anchorLng },
+    { lat: metrics.centerLat, lon: metrics.centerLng },
   );
   if (offsetKm <= metrics.spanKm * PLACE_ANCHOR_OFFSET_RATIO) return viewport;
 
diff --git a/src/proxyErrorResponses.test.mjs b/src/proxyErrorResponses.test.mjs
index c6a7269ab..78f3f59f0 100644
--- a/src/proxyErrorResponses.test.mjs
+++ b/src/proxyErrorResponses.test.mjs
@@ -4,6 +4,7 @@ import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { parseTerrainPoints } from './data/terrainHeightsProxy.js';
 import { readResponseTextCapped, coalesceProxyRequest } from './sources/httpBody.js';
+import { makeRateLimiter, clientKey } from '../server/providers/common/rate-limit.js';
 
 const source = ['local.js', 'common/http.js', 'aircraft/enrichment.js', 'terrain.js', 'space/celestrak.js', 'space/launch-library.js', '../../src/data/spaceProviderRequests.js']
   .map(file => readFileSync(new URL(`../server/providers/${file}`, import.meta.url), 'utf8'))
@@ -23,6 +24,12 @@ function fixture(name, overrides = {}, preview = false) {
   const logs = [];
   const deps = {
     readResponseTextCapped, coalesceProxyRequest,
+    // The rate-limited proxies reach for these; give them the real ones so a
+    // fixture request is throttled exactly as production would be.
+    makeRateLimiter, clientKey,
+    // terrain.js gates cross-site requests first; fixture requests carry no
+    // browser headers, so admit them like a loopback tool.
+    admitSameSiteKeyless: () => false,
     path, process: { cwd: () => '/fixture', env: {} },
     fsp: {
       readFile: async () => { throw new Error('cache absent'); },
diff --git a/src/sources/gbfsStations.js b/src/sources/gbfsStations.js
index 74f2efd23..c37c2fae4 100644
--- a/src/sources/gbfsStations.js
+++ b/src/sources/gbfsStations.js
@@ -51,15 +51,25 @@ export function extractStationsArray(payload) {
   return [];
 }
 
+/**
+ * Station name text as a reader expects it. JCDecaux's Spanish contracts
+ * (Valenbisi, Sevici) prefix every name with "_" and Valenbisi joins words
+ * with it ("_PLAZA_MUSICO_LOPEZ_CHAVARRI"), so an underscore reads as a word
+ * break. Other spacing is the operator's own and stays as published.
+ */
+function tidyStationName(text) {
+  return text.replace(/\s*_+\s*/g, ' ').trim();
+}
+
 /** Read legacy text or a GBFS v3 Localized String, preferring usable English text. */
 function stationName(value) {
-  if (typeof value === 'string') return value.trim();
+  if (typeof value === 'string') return tidyStationName(value);
   if (!Array.isArray(value)) return '';
 
   let fallback = '';
   for (const translation of value) {
     if (typeof translation?.text !== 'string') continue;
-    const text = translation.text.trim();
+    const text = tidyStationName(translation.text);
     if (!text) continue;
     if (!fallback) fallback = text;
     if (
@@ -71,6 +81,23 @@ function stationName(value) {
   return fallback;
 }
 
+/**
+ * Docks a station physically has. PBSC adds the bikes a station accepts in its
+ * geofenced area around the docks to `capacity` and reports that part as
+ * `geofenced_capacity` (not a GBFS field): Bilbao Bizi publishes 39 docks as
+ * capacity 839 with geofenced_capacity 800. Without the extension, or when it
+ * would exceed the total, `capacity` is read as given. PBSC also counts the
+ * bikes parked in that area (`num_bikes_overflow`) in `num_bikes_available`, so
+ * a crowded station can report more bikes than docks.
+ */
+function dockCapacity(raw) {
+  const capacity = toNonNegativeInteger(raw?.capacity);
+  const geofenced = toNonNegativeInteger(raw?.geofenced_capacity);
+  if (capacity == null || geofenced == null || geofenced > capacity)
+    return capacity;
+  return capacity - geofenced;
+}
+
 /**
  * Parse a GBFS station_information payload into a Map of station metadata.
  * Handles field-name variations across different GBFS providers
@@ -95,7 +122,7 @@ export function parseStationInformation(payload) {
       name: stationName(raw?.name) || stationName(raw?.short_name),
       lat,
       lon,
-      capacity: toNonNegativeInteger(raw?.capacity),
+      capacity: dockCapacity(raw),
       isInstalled: normalizeGbfsBool(raw?.is_installed, true),
       isRenting: normalizeGbfsBool(raw?.is_renting, true),
       isReturning: normalizeGbfsBool(raw?.is_returning, true),
diff --git a/src/sources/gbfsStations.test.mjs b/src/sources/gbfsStations.test.mjs
index 8c60da90c..91983df98 100644
--- a/src/sources/gbfsStations.test.mjs
+++ b/src/sources/gbfsStations.test.mjs
@@ -15,6 +15,25 @@ const parseName = (fields, version) =>
     data: { stations: [station(fields)] },
   }).get('s1').name;
 
+const parseCapacity = (fields) =>
+  parseStationInformation({ data: { stations: [station(fields)] } }).get('s1')
+    .capacity;
+
+test('capacity counts docks, not the geofenced area PBSC adds to it', () => {
+  // Bilbao Bizi, BiciMAD and Dbizi as published on 2026-10-17.
+  assert.equal(parseCapacity({ capacity: 839, geofenced_capacity: 800 }), 39);
+  assert.equal(parseCapacity({ capacity: 43, geofenced_capacity: 20 }), 23);
+  assert.equal(parseCapacity({ capacity: 19, geofenced_capacity: 0 }), 19);
+});
+
+test('capacity is read as given without a usable geofenced_capacity', () => {
+  assert.equal(parseCapacity({ capacity: 27 }), 27);
+  assert.equal(parseCapacity({ capacity: 27, geofenced_capacity: null }), 27);
+  assert.equal(parseCapacity({ capacity: 27, geofenced_capacity: 'n/a' }), 27);
+  assert.equal(parseCapacity({ capacity: 10, geofenced_capacity: 30 }), 10);
+  assert.equal(parseCapacity({ capacity: null, geofenced_capacity: 5 }), null);
+});
+
 test('GBFS v2 station names remain trimmed strings', () => {
   assert.equal(
     parseName({ name: ' Republic Square ', short_name: 'Short' }, '2.3'),
@@ -22,6 +41,42 @@ test('GBFS v2 station names remain trimmed strings', () => {
   );
 });
 
+test('underscores in station names read as word breaks', () => {
+  // As published by JCDecaux's Spanish contracts (checked 2026-10-17).
+  for (const [published, shown] of [
+    ['_PLAZA_MUSICO_LOPEZ_CHAVARRI', 'PLAZA MUSICO LOPEZ CHAVARRI'],
+    ['_GLORIETA OLIMPICA', 'GLORIETA OLIMPICA'],
+    ['_CAMPAMENTO_81', 'CAMPAMENTO 81'],
+    ['Plaza__Mayor_ ', 'Plaza Mayor'],
+  ]) {
+    assert.equal(parseName({ name: published }), shown);
+  }
+});
+
+test('spacing without underscores stays as the operator published it', () => {
+  assert.equal(parseName({ name: 'C/  NÀPOLS, 82' }), 'C/  NÀPOLS, 82');
+});
+
+test('a name of only underscores falls back to short_name, then to empty', () => {
+  assert.equal(parseName({ name: '_', short_name: '_S_1_' }), 'S 1');
+  assert.equal(parseName({ name: '__', short_name: '_' }), '');
+});
+
+test('underscores are read the same in GBFS v3 localized names', () => {
+  assert.equal(
+    parseName(
+      {
+        name: [
+          { language: 'es', text: '_' },
+          { language: 'en', text: '_COLON_I' },
+        ],
+      },
+      '3.0',
+    ),
+    'COLON I',
+  );
+});
+
 test('GBFS v3 station names prefer English over the first translation', () => {
   assert.equal(
     parseName(
diff --git a/src/sources/tle.js b/src/sources/tle.js
index ac7aedc2c..61c409a2b 100644
--- a/src/sources/tle.js
+++ b/src/sources/tle.js
@@ -13,7 +13,14 @@ export function parseTleText(text) {
     const name = lines[i];
     const line1 = lines[i + 1];
     const line2 = lines[i + 2];
-    if (line1.startsWith('1 ') && line2.startsWith('2 ')) {
+    const cat1 = tleCatalogNumber(line1);
+    const cat2 = tleCatalogNumber(line2);
+    if (
+      line1.startsWith('1 ') &&
+      line2.startsWith('2 ') &&
+      cat1 !== null &&
+      cat1 === cat2
+    ) {
       result.push({ name, line1, line2 });
       i += 2;
     }
@@ -21,8 +28,47 @@ export function parseTleText(text) {
   return result;
 }
 
-/** The NORAD catalog number from TLE line 1, or null. */
-export function tleCatalogNumber(line1) {
-  const number = Number.parseInt(String(line1).slice(2, 7), 10);
-  return Number.isInteger(number) ? number : null;
+// Alpha-5: a letter A–Z, skipping I and O, then exactly four digits.
+const ALPHA5 = /^[A-HJ-NP-Z]\d{4}$/;
+const DIGITS = /^\d+$/;
+
+/**
+ * The catalog number a catalog field stands for, or null for any other field.
+ *
+ * A field is either plain digits or Alpha-5, the TLE spelling of numbers above
+ * 99999: the letter stands for 10–33 in the ten-thousands place, skipping I
+ * and O, so 100000 is "A0000" and 339999 is "Z9999". Anything else (a sign, a
+ * decimal point, hex, an embedded space, a lowercase or trailing letter) is
+ * not a catalog number.
+ * @param {string} field the field with any leading spaces already removed
+ * @returns {number | null}
+ */
+function decodeCatalogField(field) {
+  if (DIGITS.test(field)) return Number(field);
+  if (!ALPHA5.test(field)) return null;
+  const letter = field[0];
+  let tens = letter.charCodeAt(0) - 65 + 10;
+  if (letter > 'I') tens -= 1;
+  if (letter > 'O') tens -= 1;
+  return tens * 10000 + Number(field.slice(1));
+}
+
+/**
+ * NORAD catalog number of a satrec as a number, or NaN.
+ *
+ * satellite.js keeps the TLE's five-character field verbatim in
+ * `satrec.satnum`, and `Number("A0000")` is NaN, so every Alpha-5 satellite
+ * would share one NaN key. Digits of any length (an OMM satrec carries the
+ * number unpadded) and Alpha-5 decode; anything else, blank included, is NaN.
+ * @param {string} satnum
+ * @returns {number}
+ */
+export function noradIdFromSatnum(satnum) {
+  return decodeCatalogField(String(satnum ?? '').trim()) ?? Number.NaN;
+}
+
+/** The NORAD catalog number from TLE line 1 or 2 (columns 3–7), or null. */
+export function tleCatalogNumber(line) {
+  const field = String(line).slice(2, 7);
+  return decodeCatalogField(field.replace(/^ +/, ''));
 }
diff --git a/src/terrainHeightsBounds.test.mjs b/src/terrainHeightsBounds.test.mjs
new file mode 100644
index 000000000..cd1a9ad36
--- /dev/null
+++ b/src/terrainHeightsBounds.test.mjs
@@ -0,0 +1,368 @@
+// TERRAIN HEIGHTS — the bounds on a cache keyed by caller-chosen coordinates.
+//
+// Every distinct 5dp lon/lat is its own cache key, its own permanent line in
+// `.gev-cache/terrain-heights.json`, and its own upstream call. Four things
+// bound that: WGS-84 range at parse, an entry ceiling on the map, a size
+// ceiling on the file that is read back, and a per-client request limiter.
+//
+// These cases drive the real exported route handler. `fetch` is stubbed per
+// test and restored after, so a case that reaches upstream fails loudly.
+//
+// Run with: npm test
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { parseTerrainPoints } from './data/terrainHeightsProxy.js';
+import { terrainHeightsProxy } from '../server/providers/terrain.js';
+import { admitSameSite } from '../server/providers/common/same-site.js';
+
+function install(plugin) {
+  const routes = new Map();
+  plugin.configureServer({
+    middlewares: {
+      use(path, handler) {
+        routes.set(path, handler);
+      },
+    },
+  });
+  return routes;
+}
+
+function request(
+  handler,
+  { url = '/', remoteAddress = '127.0.0.1', reqHeaders = {} } = {},
+) {
+  return new Promise((resolve, reject) => {
+    const headers = new Map();
+    const req = {
+      method: 'GET',
+      url,
+      headers: reqHeaders,
+      socket: { remoteAddress },
+    };
+    const res = {
+      statusCode: 200,
+      headersSent: false,
+      setHeader(name, value) {
+        headers.set(String(name).toLowerCase(), String(value));
+      },
+      writeHead(status, hdrs = {}) {
+        this.statusCode = status;
+        this.headersSent = true;
+        for (const [name, value] of Object.entries(hdrs))
+          headers.set(String(name).toLowerCase(), String(value));
+      },
+      end(body = '') {
+        let parsed = null;
+        try {
+          parsed = body ? JSON.parse(String(body)) : null;
+        } catch {
+          parsed = String(body);
+        }
+        resolve({
+          statusCode: this.statusCode,
+          headers: Object.fromEntries(headers),
+          body: parsed,
+        });
+      },
+    };
+    Promise.resolve(handler(req, res)).catch(reject);
+  });
+}
+
+function stubFetch(t, impl) {
+  const original = globalThis.fetch;
+  globalThis.fetch = impl;
+  t.after(() => {
+    globalThis.fetch = original;
+  });
+}
+
+/**
+ * Answer like Re:Earth does: one `{ellipsoid}` per requested point, in order.
+ * Records which point strings were actually asked for, so a test can assert on
+ * cache misses rather than on internal state.
+ */
+function stubTerrainUpstream(t) {
+  const asked = [];
+  stubFetch(t, async (url) => {
+    const points = decodeURIComponent(
+      new URL(String(url)).searchParams.get('points') || '',
+    )
+      .split(';')
+      .filter(Boolean);
+    asked.push(...points);
+    return Response.json({ results: points.map(() => ({ ellipsoid: 150 })) });
+  });
+  return asked;
+}
+
+test('a coordinate off the globe is not a cache key', () => {
+  // Finite but not on Earth — the old guard accepted every one of these.
+  for (const raw of [
+    '0,91',
+    '0,-91',
+    '181,0',
+    '-181,0',
+    '1e9,1e9',
+    '0,90.00001',
+  ])
+    assert.equal(parseTerrainPoints(raw), null, raw);
+
+  // The poles and the antimeridian are real places and must still parse.
+  for (const raw of ['0,90', '0,-90', '180,0', '-180,0', '-97.74,30.26'])
+    assert.ok(parseTerrainPoints(raw), raw);
+});
+
+test('an out-of-range point is refused before it reaches upstream or the cache', async (t) => {
+  let upstreamCalls = 0;
+  stubFetch(t, async () => {
+    upstreamCalls += 1;
+    return new Response('[]', { status: 200 });
+  });
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  const refused = await request(route, { url: '/?points=0,91' });
+  assert.equal(refused.statusCode, 400);
+  assert.equal(
+    upstreamCalls,
+    0,
+    'an impossible coordinate must not cost an upstream call',
+  );
+});
+
+test('one out-of-range point rejects the batch it is hidden in', async (t) => {
+  stubFetch(t, async () => new Response('[]', { status: 200 }));
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const mixed = await request(route, {
+    url: '/?points=-97.74,30.26;0,999;-97.75,30.27',
+  });
+  assert.equal(mixed.statusCode, 400);
+});
+
+test('the point cache stops growing, and an evicted point is simply refetched', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  // A ceiling of 3 exercises the same code path 50,000 does, in four requests.
+  const route = install(terrainHeightsProxy({ cacheMaxEntries: 3 })).get(
+    '/api/terrain/heights',
+  );
+
+  const point = (i) => `-97.7${i}000,30.26000`;
+  for (let i = 1; i <= 4; i += 1)
+    await request(route, { url: `/?points=${point(i)}` });
+  assert.equal(asked.length, 4, 'four distinct points, four upstream lookups');
+
+  // The newest point is still cached...
+  await request(route, { url: `/?points=${point(4)}` });
+  assert.equal(asked.length, 4, 'a cached point costs nothing');
+
+  // ...and the oldest was evicted, so it costs one refetch — never a wrong
+  // answer, because terrain does not move.
+  await request(route, { url: `/?points=${point(1)}` });
+  assert.equal(asked.length, 5, 'the evicted point was asked for again');
+  assert.equal(asked[4], point(1));
+});
+
+test('an over-large cache file is not read back into memory', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const point = '-97.74000,30.26000';
+  const dir = await mkdtemp(path.join(tmpdir(), 'gev-terrain-'));
+  const cachePath = path.join(dir, 'terrain-heights.json');
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  // A cache file holding the answer, but larger than the ceiling allows.
+  const padded = {
+    version: 2,
+    points: { [point]: { at: Date.now(), result: { ellipsoid: 150 } } },
+    _pad: 'x'.repeat(4096),
+  };
+  await writeFile(cachePath, JSON.stringify(padded), 'utf8');
+
+  const route = install(
+    terrainHeightsProxy({ cachePath, cacheMaxDiskBytes: 1024 }),
+  ).get('/api/terrain/heights');
+  await request(route, { url: `/?points=${point}` });
+  assert.deepEqual(
+    asked,
+    [point],
+    'the oversized file was skipped, so the point was a miss',
+  );
+
+  // The same file under a ceiling that admits it IS used, which is what proves
+  // the previous assertion came from the size guard and not a broken path.
+  const admitted = install(
+    terrainHeightsProxy({ cachePath, cacheMaxDiskBytes: 1024 * 1024 }),
+  ).get('/api/terrain/heights');
+  await request(admitted, { url: `/?points=${point}` });
+  assert.deepEqual(asked, [point], 'a cache within the ceiling is still read');
+});
+
+test('the route refuses a flood of requests from one client', async (t) => {
+  stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  let refusedAt = 0;
+  for (let i = 1; i <= 95; i += 1) {
+    // A different point each time: distinct keys are the growth path.
+    const lon = (-97.7 - i / 1000).toFixed(5);
+    const answer = await request(route, { url: `/?points=${lon},30.26` });
+    if (answer.statusCode === 429) {
+      refusedAt = i;
+      break;
+    }
+  }
+  assert.equal(refusedAt, 91, 'the 91st request in a minute is refused');
+});
+
+test('a cross-site page cannot fill the cache or spend the visitor quota', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const host = 'localhost:5173';
+  const refused = [
+    { host, 'sec-fetch-site': 'cross-site' }, // <img src> from any web page
+    { host, 'sec-fetch-site': 'same-site' },
+    { host, origin: 'https://evil.example' }, // fetch from another page
+    { host, origin: 'null' }, // sandboxed frame
+    // Behind a reverse proxy the browser's own Sec-Fetch-Site still decides.
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+  ];
+  // More refused requests than the 90/min quota, each a distinct new key.
+  for (let i = 0; i < 100; i += 1) {
+    const reqHeaders = refused[i % refused.length];
+    const answer = await request(route, {
+      url: `/?points=${(-97 - i / 1000).toFixed(5)},30.26`,
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 403, JSON.stringify(reqHeaders));
+  }
+  assert.deepEqual(asked, [], 'nothing reached upstream or the cache');
+
+  // The visitor's own app still has its full quota afterwards, and a
+  // loopback tool that sends no browser headers is admitted too.
+  const app = await request(route, {
+    url: '/?points=-97.74,30.26',
+    reqHeaders: { host, 'sec-fetch-site': 'same-origin' },
+  });
+  assert.equal(app.statusCode, 200);
+  const tool = await request(route, { url: '/?points=-97.75,30.26' });
+  assert.equal(tool.statusCode, 200);
+  assert.equal(asked.length, 2);
+});
+
+test('the app served behind a reverse proxy still gets terrain', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const host = 'globe.example.lan';
+  // What nginx/Caddy/Cloudflare add in front of a same-origin app fetch. The
+  // cost-bearing routes refuse these; terrain is keyless and needed to render,
+  // so a 403 here would drop every chunk to the geoid fallback.
+  const proxied = [
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-for': '203.0.113.9',
+    },
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      'cf-connecting-ip': '203.0.113.9',
+    },
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      forwarded: 'for=203.0.113.9;proto=https',
+      via: '1.1 caddy',
+    },
+    // TLS terminated at the proxy: the page origin is https, the hop is http.
+    {
+      host,
+      origin: `https://${host}`,
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-proto': 'https',
+      'x-forwarded-for': '203.0.113.9',
+    },
+  ];
+  for (const [i, reqHeaders] of proxied.entries()) {
+    const answer = await request(route, {
+      url: `/?points=${(-97.8 - i / 1000).toFixed(5)},30.26`,
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 200, JSON.stringify(reqHeaders));
+  }
+  assert.equal(asked.length, proxied.length);
+
+  // Proxied or not, a cross-site page is still refused before any work.
+  for (const reqHeaders of [
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+    {
+      host,
+      'x-forwarded-proto': 'https',
+      origin: 'https://evil.example',
+    },
+    // A forwarded scheme does not make an http Origin match an https page.
+    { host, 'x-forwarded-proto': 'https', origin: `http://${host}` },
+  ]) {
+    const answer = await request(route, {
+      url: '/?points=-97.9,30.26',
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 403, JSON.stringify(reqHeaders));
+  }
+  assert.equal(asked.length, proxied.length, 'refusals cost no upstream call');
+});
+
+test('cost-bearing routes still refuse proxied requests', () => {
+  // The keyless exemption is scoped to terrain; the shared gate is unchanged.
+  const res = {
+    statusCode: 200,
+    headers: {},
+    setHeader(name, value) {
+      this.headers[name.toLowerCase()] = value;
+    },
+    end(body) {
+      this.body = body;
+    },
+  };
+  const refused = admitSameSite(
+    {
+      headers: {
+        host: 'globe.example.lan',
+        'sec-fetch-site': 'same-origin',
+        'x-forwarded-for': '203.0.113.9',
+      },
+      socket: {},
+    },
+    res,
+  );
+  assert.equal(refused, true);
+  assert.equal(res.statusCode, 403);
+  assert.deepEqual(JSON.parse(res.body), {
+    error: 'Proxied requests are not accepted',
+  });
+});
+
+test('a second client keeps its own quota', async (t) => {
+  stubFetch(t, async () =>
+    Response.json([{ lng: -97.74, lat: 30.26, height: 150 }]),
+  );
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  for (let i = 0; i < 90; i += 1)
+    await request(route, {
+      url: `/?points=${(-98 - i / 1000).toFixed(5)},30.26`,
+      remoteAddress: '198.51.100.7',
+    });
+  const exhausted = await request(route, {
+    url: '/?points=-99.5,30.26',
+    remoteAddress: '198.51.100.7',
+  });
+  assert.equal(exhausted.statusCode, 429);
+
+  const neighbour = await request(route, {
+    url: '/?points=-99.6,30.26',
+    remoteAddress: '198.51.100.8',
+  });
+  assert.notEqual(neighbour.statusCode, 429);
+});
diff --git a/src/tooling/ll2Integration.test.mjs b/src/tooling/ll2Integration.test.mjs
new file mode 100644
index 000000000..30325eaab
--- /dev/null
+++ b/src/tooling/ll2Integration.test.mjs
@@ -0,0 +1,232 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { promises as fsp } from 'node:fs';
+import http from 'node:http';
+import { launchLibraryRecentUrl } from '../data/spaceProviderRequests.js';
+import {
+  launchLibraryRequestHeaders,
+  rocketLaunchesProxy,
+} from '../../server/providers/space/launch-library.js';
+import { keySetupStatus } from '../keySetupCore.mjs';
+import { initKeySetup } from '../keySetup.js';
+
+test('LL2 requests from the same UTC minute share a cache key without mutating callers', () => {
+  const first = new Date('2026-10-17T16:20:00.001Z');
+  const last = new Date('2026-10-17T16:20:59.999Z');
+  assert.equal(
+    launchLibraryRecentUrl(first).href,
+    launchLibraryRecentUrl(last).href,
+  );
+  assert.equal(first.toISOString(), '2026-10-17T16:20:00.001Z');
+  assert.equal(last.toISOString(), '2026-10-17T16:20:59.999Z');
+});
+
+for (const [date, end] of [
+  ['2026-10-17T16:20:00.001Z', '2026-10-17T16:20:00.000Z'],
+  ['2026-10-17T16:20:59.999Z', '2026-10-17T16:20:00.000Z'],
+  ['2026-10-17T16:21:00.000Z', '2026-10-17T16:21:00.000Z'],
+  ['2026-01-01T00:00:00.001Z', '2026-01-01T00:00:00.000Z'],
+]) {
+  test(`LL2 bounds retain the 30-day UTC window at ${date}`, () => {
+    const url = launchLibraryRecentUrl(new Date(date));
+    assert.equal(url.origin, 'https://ll.thespacedevs.com');
+    assert.equal(url.pathname, '/2.3.0/launches/');
+    assert.equal(url.searchParams.get('net__lte'), end);
+    assert.equal(
+      Date.parse(end) - Date.parse(url.searchParams.get('net__gte')),
+      30 * 86400000,
+    );
+    assert.equal(url.searchParams.get('limit'), '100');
+    assert.equal(url.searchParams.get('mode'), 'detailed');
+  });
+}
+
+test('LL2 headers identify the app and preserve optional server-only authorization', () => {
+  const publicHeaders = launchLibraryRequestHeaders('');
+  assert.match(publicHeaders['User-Agent'], /^gods-eye-view.*\/1\.0 /);
+  assert.ok(
+    publicHeaders['User-Agent'].includes(
+      'https://github.com/bilawalsidhu/gods-eye-view',
+    ),
+  );
+  assert.equal(publicHeaders.Accept, 'application/json');
+  assert.equal(publicHeaders.Authorization, undefined);
+  const paidHeaders = launchLibraryRequestHeaders(' owned-fixture-token ');
+  assert.equal(paidHeaders.Authorization, 'Token owned-fixture-token');
+  assert.equal(paidHeaders['User-Agent'], publicHeaders['User-Agent']);
+});
+
+test('actual setup rendering distinguishes optional paid LL2 from unrelated free keys', async () => {
+  const created = [];
+  const node = () => {
+    const value = {
+      dataset: {},
+      children: [],
+      append(...children) {
+        this.children.push(...children);
+      },
+      querySelector() {
+        return null;
+      },
+      querySelectorAll() {
+        return [];
+      },
+      addEventListener() {},
+      removeEventListener() {},
+      setAttribute() {},
+      remove() {},
+    };
+    created.push(value);
+    return value;
+  };
+  const rows = node();
+  const root = node();
+  root.querySelector = (selector) =>
+    selector === '[data-key-setup-rows]' ? rows : null;
+  const chip = node();
+  const status = keySetupStatus({});
+  status.keys = status.keys.filter((key) =>
+    ['launch-library', 'mapillary'].includes(key.id),
+  );
+  const setup = await initKeySetup({
+    documentRef: {
+      getElementById: (id) => (id === 'key-setup-chip' ? chip : root),
+      createElement: node,
+      addEventListener() {},
+      removeEventListener() {},
+    },
+    fetchImpl: async () => ({ ok: true, json: async () => status }),
+  });
+  assert.ok(setup);
+  try {
+    const ll2 = rows.children.find(
+      (row) => row.dataset.keyId === 'launch-library',
+    );
+    const free = rows.children.find((row) => row.dataset.keyId === 'mapillary');
+    const tier = (row) =>
+      row.children[0].children.find(
+        (child) => child.className === 'key-setup-tier',
+      );
+    assert.match(tier(ll2).title, /optional paid token/i);
+    assert.match(ll2.children[1].textContent, /leave blank/i);
+    assert.match(ll2.children[1].textContent, /no key/i);
+    assert.equal(tier(free).title, 'Free key — register, paste, done');
+    const serialized = JSON.stringify(status);
+    assert.ok(!serialized.includes('owned-fixture-token'));
+  } finally {
+    setup.destroy();
+  }
+});
+
+test('real LL2 proxy sends cacheable headers and bounds, retaining its memory cache', async (t) => {
+  for (const method of ['readFile', 'stat'])
+    t.mock.method(fsp, method, async () => {
+      throw new Error('owned fixture has no disk cache');
+    });
+  t.mock.method(fsp, 'mkdir', async () => {});
+  t.mock.method(fsp, 'writeFile', async () => {});
+  const calls = [];
+  t.mock.method(globalThis, 'fetch', async (url, options) => {
+    calls.push({ url: new URL(url), options });
+    return new Response(
+      JSON.stringify({ results: [{ id: 'owned-launch-fixture' }] }),
+    );
+  });
+  let handler;
+  rocketLaunchesProxy().configureServer({
+    middlewares: {
+      use(route, value) {
+        assert.equal(route, '/api/launches');
+        handler = value;
+      },
+    },
+  });
+  async function request() {
+    const res = {
+      writeHead(status, headers) {
+        this.status = status;
+        this.headers = headers;
+      },
+      end(body) {
+        this.body = body;
+      },
+    };
+    await handler({ method: 'GET' }, res);
+    return res;
+  }
+  const first = await request();
+  const second = await request();
+  assert.equal(first.status, 200);
+  assert.equal(second.body, first.body);
+  assert.equal(second.headers['X-GEV-Cache'], 'HIT');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].options.headers['User-Agent'], /gods-eye-view/);
+  assert.match(calls[0].url.searchParams.get('net__lte'), /:00\.000Z$/);
+  assert.match(calls[0].url.searchParams.get('net__gte'), /:00\.000Z$/);
+});
+
+for (const preview of [false, true]) {
+  test(`LL2 proxy sends its identifying headers over real owned HTTP in ${preview ? 'preview' : 'development'}`, async (t) => {
+    for (const method of ['readFile', 'stat'])
+      t.mock.method(fsp, method, async () => {
+        throw new Error('no owned cache');
+      });
+    t.mock.method(fsp, 'mkdir', async () => {});
+    t.mock.method(fsp, 'writeFile', async () => {});
+    const received = [];
+    const upstream = http.createServer((req, res) => {
+      received.push({
+        url: new URL(req.url, 'http://fixture.invalid'),
+        headers: req.headers,
+      });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ results: [{ id: 'owned-wire-fixture' }] }));
+    });
+    await new Promise((resolve) => upstream.listen(0, '127.0.0.1', resolve));
+    const originalFetch = globalThis.fetch;
+    t.mock.method(globalThis, 'fetch', (url, options) => {
+      const parsed = new URL(url);
+      assert.equal(parsed.origin, 'https://ll.thespacedevs.com');
+      return originalFetch(
+        `http://127.0.0.1:${upstream.address().port}${parsed.pathname}${parsed.search}`,
+        options,
+      );
+    });
+    let handler;
+    const plugin = rocketLaunchesProxy();
+    plugin[preview ? 'configurePreviewServer' : 'configureServer']({
+      middlewares: {
+        use(_route, value) {
+          handler = value;
+        },
+      },
+    });
+    const proxy = http.createServer((req, res) => {
+      void handler(req, res);
+    });
+    await new Promise((resolve) => proxy.listen(0, '127.0.0.1', resolve));
+    try {
+      const result = await originalFetch(
+        `http://127.0.0.1:${proxy.address().port}/api/launches`,
+      );
+      assert.equal(result.status, 200);
+      assert.deepEqual(await result.json(), {
+        results: [{ id: 'owned-wire-fixture' }],
+      });
+      assert.equal(received.length, 1);
+      assert.match(
+        received[0].headers['user-agent'],
+        /^gods-eye-view-launch-library-proxy\/1\.0 /,
+      );
+      assert.equal(received[0].headers.authorization, undefined);
+      assert.match(received[0].url.searchParams.get('net__lte'), /:00\.000Z$/);
+    } finally {
+      proxy.closeAllConnections();
+      upstream.closeAllConnections();
+      await Promise.all([
+        new Promise((resolve) => proxy.close(resolve)),
+        new Promise((resolve) => upstream.close(resolve)),
+      ]);
+    }
+  });
+}
diff --git a/src/tooling/spaceProviders.test.mjs b/src/tooling/spaceProviders.test.mjs
index 443ca5b96..a5b2cecba 100644
--- a/src/tooling/spaceProviders.test.mjs
+++ b/src/tooling/spaceProviders.test.mjs
@@ -81,8 +81,8 @@ test('portable requests keep fixed origins, encode group data and preserve the 3
   assert.equal(url.origin, 'https://ll.thespacedevs.com');
   assert.equal(url.pathname, '/2.3.0/launches/');
   assert.deepEqual(Object.fromEntries(url.searchParams), {
-    net__gte: '2026-01-30T12:34:56.000Z',
-    net__lte: '2026-03-01T12:34:56.000Z',
+    net__gte: '2026-01-30T12:34:00.000Z',
+    net__lte: '2026-03-01T12:34:00.000Z',
     limit: '100',
     mode: 'detailed',
   });
diff --git a/src/tooling/viteBuild.test.mjs b/src/tooling/viteBuild.test.mjs
index 86a9afb63..9e38a0295 100644
--- a/src/tooling/viteBuild.test.mjs
+++ b/src/tooling/viteBuild.test.mjs
@@ -89,17 +89,34 @@ test('root config retains existing named exports and standalone provider order',
     assert.equal(compatibility[name], value, name);
   const config = standaloneConfig({ mode: 'test' });
   assert.deepEqual(
-    config.plugins.slice(3, -4).map((plugin) => plugin.name),
+    config.plugins.slice(3, -5).map((plugin) => plugin.name),
     providers.localProviderPlugins().map((plugin) => plugin.name),
   );
-  assert.equal(config.plugins.at(-5).name, 'gev-key-setup');
+  assert.equal(config.plugins.at(-6).name, 'gev-key-setup');
   // The local MCP route follows every provider and precedes the API fallback.
-  assert.equal(config.plugins.at(-4).name, 'local-mcp');
-  assert.equal(config.plugins.at(-3).name, 'api-not-found');
+  assert.equal(config.plugins.at(-5).name, 'local-mcp');
+  assert.equal(config.plugins.at(-4).name, 'api-not-found');
+  // Config-only, so it sits after the provider slice rather than in it.
+  assert.equal(config.plugins.at(-3).name, 'gev-unwatched-runtime-dirs');
   assert.equal(config.plugins.at(-2).name, 'embed-framing');
   assert.equal(config.plugins.at(-1).name, 'panel-build');
 });
 
+test('directories the server writes while it runs are kept out of the dev watcher', () => {
+  // Providers write cache files and logs here while the app runs; none of it is
+  // source, so the dev watcher has no reason to stat it.
+  const config = standaloneConfig({ mode: 'test' });
+  const plugin = config.plugins.find(
+    ({ name }) => name === 'gev-unwatched-runtime-dirs',
+  );
+  // Dev only: preview and build have no watcher.
+  assert.equal(plugin.apply, 'serve');
+  assert.deepEqual(plugin.config().server.watch.ignored, [
+    '**/.gev-cache/**',
+    '**/.gev-logs/**',
+  ]);
+});
+
 test('build export resolves in Node and has no browser fallback', async () => {
   const exported = await import('gods-eye-view/build/vite');
   assert.equal(exported.createBrowserViteConfig, createBrowserViteConfig);
diff --git a/src/tools/queries/space.test.mjs b/src/tools/queries/space.test.mjs
index f6c2a8df8..0eb5ce346 100644
--- a/src/tools/queries/space.test.mjs
+++ b/src/tools/queries/space.test.mjs
@@ -1,7 +1,12 @@
 import assert from 'node:assert/strict';
 import test from 'node:test';
+import { twoline2satrec } from 'satellite.js';
 import { composeCatalog, coreTools } from '../index.js';
-import { parseTleText, tleCatalogNumber } from '../../sources/tle.js';
+import {
+  noradIdFromSatnum,
+  parseTleText,
+  tleCatalogNumber,
+} from '../../sources/tle.js';
 
 // Element sets published for 1 January 2024.
 const TLE = `ISS (ZARYA)
@@ -51,6 +56,125 @@ for (const missingLine of [1, 2]) {
   });
 }
 
+test('TLE parsing rejects pairs with mismatched catalog numbers and resumes', () => {
+  const text = `SAT A
+1 25544U 98067A   24001.50000000  .00016717  00000-0  30270-3 0  9994
+2 48274  41.4697 175.8913 0005643 312.8370 141.6893 15.61287398150000
+SAT B
+1 48274U 21035A   24001.50000000  .00020137  00000-0  24481-3 0  9993
+2 48274  41.4697 175.8913 0005643 312.8370 141.6893 15.61287398150000
+`;
+  const entries = parseTleText(text);
+  assert.deepEqual(
+    entries.map((entry) => entry.name),
+    ['SAT B'],
+  );
+  assert.equal(tleCatalogNumber(entries[0].line1), 48274);
+  assert.equal(tleCatalogNumber(entries[0].line2), 48274);
+});
+
+test('TLE parsing accepts matching Alpha-5 pairs and rejects mismatched Alpha-5 pairs', () => {
+  const text = `SAT MISMATCH
+1 A0000U 98067A   24001.50000000  .00016717  00000-0  30270-3 0  9994
+2 A0001  41.4697 175.8913 0005643 312.8370 141.6893 15.61287398150000
+SAT ALPHA5
+1 A0000U 98067A   24001.50000000  .00016717  00000-0  30270-3 0  9994
+2 A0000  41.4697 175.8913 0005643 312.8370 141.6893 15.61287398150000
+`;
+  const entries = parseTleText(text);
+  assert.deepEqual(
+    entries.map((entry) => entry.name),
+    ['SAT ALPHA5'],
+  );
+  assert.equal(tleCatalogNumber(entries[0].line1), 100000);
+  assert.equal(tleCatalogNumber(entries[0].line2), 100000);
+});
+
+test('TLE parsing rejects a pair whose catalog fields are malformed and resumes', () => {
+  // Read as digits up to the first non-digit, both fields would be 2554.
+  const text = `SAT MALFORMED
+1 2554AU 98067A   24001.50000000  .00016717  00000-0  30270-3 0  9994
+2 2554B  51.6416 247.4627 0006703 130.5360 325.0288 15.50377579432414
+SAT HALF MALFORMED
+1 2554AU 98067A   24001.50000000  .00016717  00000-0  30270-3 0  9994
+2 02554  51.6416 247.4627 0006703 130.5360 325.0288 15.50377579432414
+${TLE}`;
+  assert.deepEqual(
+    parseTleText(text).map((entry) => entry.name),
+    ['ISS (ZARYA)', 'CSS (TIANHE)'],
+  );
+});
+
+test('Alpha-5 catalog numbers decode, skipping I and O', () => {
+  for (const [field, id] of [
+    ['A0000', 100000],
+    ['A0404', 100404],
+    ['H9999', 179999],
+    ['J0000', 180000],
+    ['N9999', 229999],
+    ['P0000', 230000],
+    ['T0449', 270449],
+    ['Z9999', 339999],
+  ]) {
+    assert.equal(noradIdFromSatnum(field), id, field);
+    assert.equal(tleCatalogNumber(`1 ${field}U`), id, field);
+  }
+});
+
+test('a digit catalog field reads as it did before', () => {
+  assert.equal(noradIdFromSatnum('25544'), 25544);
+  assert.equal(noradIdFromSatnum('00404'), 404);
+  assert.equal(noradIdFromSatnum('  404'), 404);
+  assert.equal(tleCatalogNumber('1 25544U'), 25544);
+  assert.equal(tleCatalogNumber('1   404U'), 404);
+  // An OMM satrec carries the number unpadded, past five digits.
+  assert.equal(noradIdFromSatnum('100000'), 100000);
+});
+
+test('a malformed catalog field is no number', () => {
+  for (const field of [
+    'I0000',
+    'O0000',
+    'a0404',
+    'A00',
+    '2554A',
+    '255 4',
+    '-1234',
+    '0x1F0',
+    '1.5',
+    '1e3',
+    '',
+    '     ',
+  ]) {
+    assert.ok(Number.isNaN(noradIdFromSatnum(field)), JSON.stringify(field));
+    assert.equal(
+      tleCatalogNumber(`1 ${field.padEnd(5)}U`),
+      null,
+      JSON.stringify(field),
+    );
+  }
+  assert.ok(Number.isNaN(noradIdFromSatnum(undefined)));
+});
+
+test('a satellite numbered above 99999 keeps its number and is found by it', async () => {
+  // The ISS set with its catalog field in Alpha-5: A0000 is 100000.
+  const text = TLE.replaceAll('25544', 'A0000');
+  const [iss] = parseTleText(text);
+  const { satnum } = twoline2satrec(iss.line1, iss.line2);
+  assert.ok(Number.isNaN(Number(satnum))); // what the catalog builders used
+  assert.equal(noradIdFromSatnum(satnum), 100000);
+  const catalog = composeCatalog({
+    tools: coreTools,
+    services: { satellites: satellites(text), clock: CLOCK },
+  });
+  const result = await catalog.call('next_satellite_pass', {
+    location: { lat: 40.7, lon: -74 },
+    satellite: '100000',
+  });
+  assert.equal(result.data.satellite, 'ISS (ZARYA)');
+  assert.equal(result.data.norad, 100000);
+});
+
 test('the next pass defaults to the ISS and reports times, peak and direction', async () => {
   const catalog = composeCatalog({
     tools: coreTools,
diff --git a/src/voice/gevActions.js b/src/voice/gevActions.js
index db089cecf..26974ce60 100644
--- a/src/voice/gevActions.js
+++ b/src/voice/gevActions.js
@@ -11,6 +11,7 @@ import { defaultGeospatial } from '../search/defaults.js';
 import { msg } from '../i18n/index.js';
 import * as Cesium from 'cesium';
 import { CITY_POIS } from '../cityPois.js';
+import { greatCircleKm } from '../geoDistance.js';
 import {
   findPoiByName,
   flyToGlobeView,
@@ -3742,8 +3743,10 @@ function centerMatchesSubject(center, subjectPosition) {
   const subjectLat = Cesium.Math.toDegrees(carto.latitude);
   const subjectLon = Cesium.Math.toDegrees(carto.longitude);
   return (
-    haversineKm(subjectLat, subjectLon, center.lat, center.lon) <=
-    SUBJECT_CENTER_TOLERANCE_KM
+    greatCircleKm(
+      { lat: subjectLat, lon: subjectLon },
+      { lat: center.lat, lon: center.lon },
+    ) <= SUBJECT_CENTER_TOLERANCE_KM
   );
 }
 
@@ -4033,7 +4036,7 @@ function nearbyKnownLandmarks(latitude, longitude, cameraHeightM) {
   for (const [cityId, city] of Object.entries(CITY_POIS)) {
     for (let poiIndex = 0; poiIndex < city.pois.length; poiIndex++) {
       const poi = city.pois[poiIndex];
-      const distanceKm = haversineKm(latitude, longitude, poi.lat, poi.lon);
+      const distanceKm = greatCircleKm({ lat: latitude, lon: longitude }, poi);
       if (distanceKm > maxDistanceKm) continue;
       matches.push({
         name: poi.name,
@@ -4048,20 +4051,6 @@ function nearbyKnownLandmarks(latitude, longitude, cameraHeightM) {
   return matches.sort((a, b) => a.distanceKm - b.distanceKm).slice(0, 5);
 }
 
-function haversineKm(lat1, lon1, lat2, lon2) {
-  const toRad = (value) => Cesium.Math.toRadians(value);
-  const radiusKm = 6371.0088;
-  const dLat = toRad(lat2 - lat1);
-  const dLon = toRad(lon2 - lon1);
-  const a =
-    Math.sin(dLat / 2) * Math.sin(dLat / 2) +
-    Math.cos(toRad(lat1)) *
-      Math.cos(toRad(lat2)) *
-      Math.sin(dLon / 2) *
-      Math.sin(dLon / 2);
-  return 2 * radiusKm * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
-}
-
 function coarseBasemapPlace(
   viewScale,
   latitude,