Merge current main into GNSS integration candidate

src/annotations/regionRing.test.mjs

@@ -51,9 +51,11 @@ test('region ring: Natural Earth names resolve without a geocoder', async () =>
 test('region ring: a slow admin-boundary lookup returns region-timeout within the budget', async () => {
   let adminSignal;
   let release;
+  let lookupStarted;
   const { resolveRegionRingForQuery } = createAnnotationResolver({
     featureSource: featureSource({
       getAdministrativeAreas(_point, { signal }) {
+        lookupStarted = Date.now();
         adminSignal = signal;
         return new Promise((resolve) => {
           release = resolve;
@@ -61,7 +63,6 @@ test('region ring: a slow admin-boundary lookup returns region-timeout within th
       },
     }),
   });
-  const started = Date.now();
   const region = await resolveRegionRingForQuery(
     'Atlantis',
     undefined,
@@ -73,8 +74,10 @@ test('region ring: a slow admin-boundary lookup returns region-timeout within th
     ring: null,
     error: 'region-timeout',
   });
+  // Timed from the boundary lookup, so the bundled pack scans before it do not
+  // count. Under the 3 s default budget, so an ignored budgetMs still fails.
   assert.ok(
-    Date.now() - started < 1000,
+    Date.now() - lookupStarted < 2_000,
     'returns at the budget, not the lookup',
   );
   // The lookup is left running so it can fill the boundary cache.

src/codexOauthRealtime.test.mjs

@@ -145,17 +145,20 @@ test('Codex OAuth reader enforces expiry margin and bounds tokens without exp by
 
 test('Codex login resolves an installed executable before PATH and starts browser auth detached', async () => {
   const checked = [];
+  // Built with path.join so the stub matches the resolver on Windows too,
+  // where the separators are backslashes.
+  const installed = path.join('/home/fixture', '.local', 'bin', 'codex');
   assert.equal(
     resolveCodexExecutable({
       environment: {},
       home: '/home/fixture',
       access(candidate) {
         checked.push(candidate);
-        if (candidate.endsWith('/.local/bin/codex')) return;
+        if (candidate === installed) return;
         throw new Error('missing');
       },
     }),
-    path.join('/home/fixture', '.local', 'bin', 'codex'),
+    installed,
   );
   assert.equal(checked.length, 1);
 

src/data/firms-coordinate-evidence.test.mjs

@@ -0,0 +1,69 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseFirmsCsv } from './firmsCsv.js';
+import { adaptFirmsRecords } from './firmsAdapt.js';
+test('missing positions do not become fire detections at zero coordinates', () => {
+  const csv =
+    'latitude,longitude,acq_date,acq_time,confidence,frp\n,1,2026-07-16,1200,n,1\n1, ,2026-07-16,1200,n,1\n95,1,2026-07-16,1200,n,1\n1,181,2026-07-16,1200,n,1\n0,0,2026-07-16,1200,n,1\n-90,-180,2026-07-16,1200,n,1';
+  assert.deepEqual(
+    parseFirmsCsv(csv).map((r) => [r.lat, r.lon]),
+    [
+      [0, 0],
+      [-90, -180],
+    ],
+  );
+  const records = [
+    { lat: null, lon: 1 },
+    { lat: '', lon: 1 },
+    { lat: false, lon: 1 },
+    { lat: 95, lon: 1 },
+    { lat: 1, lon: 181 },
+    { lat: '0', lon: 0 },
+    { lat: -90, lon: -180 },
+  ];
+  assert.deepEqual(
+    adaptFirmsRecords(records).map((r) => [r.index, r.lat, r.lon]),
+    [
+      [0, 0, 0],
+      [1, -90, -180],
+    ],
+  );
+});
+
+test('both axes keep their exact bounds and drop values just past them', () => {
+  const row = (lat, lon) => `${lat},${lon},2026-07-16,1200,n,1`;
+  const csv = [
+    'latitude,longitude,acq_date,acq_time,confidence,frp',
+    row(90, 180),
+    row(-90, -180),
+    row(90.000001, 0),
+    row(-90.000001, 0),
+    row(0, 180.000001),
+    row(0, -180.000001),
+    row(' ', 5),
+    row(5, '\t'),
+  ].join('\n');
+  assert.deepEqual(
+    parseFirmsCsv(csv).map((r) => [r.lat, r.lon]),
+    [
+      [90, 180],
+      [-90, -180],
+    ],
+  );
+  const kept = adaptFirmsRecords([
+    { lat: 90, lon: 180 },
+    { lat: '-90', lon: '-180' },
+    { lat: -90.000001, lon: 0 },
+    { lat: 0, lon: -180.000001 },
+    { lat: 5, lon: ' ' },
+    { lat: 5, lon: undefined },
+    { lat: [5], lon: 5 },
+  ]);
+  assert.deepEqual(
+    kept.map((r) => [r.lat, r.lon]),
+    [
+      [90, 180],
+      [-90, -180],
+    ],
+  );
+});

src/data/firmsAdapt.js

@@ -7,8 +7,8 @@
  */
 
 /**
- * Map proxy fire records into internal fire records. Records with
- * non-finite coordinates are skipped; `index` is the post-skip position
+ * Map proxy fire records into internal fire records. Records with missing,
+ * non-numeric or out-of-range (WGS84) coordinates are skipped; `index` is the post-skip position
  * (it keys pick ids and context-store ids, so it must stay sequential).
  * `contextEntity`/`position` start null and are lazily filled by the layer.
  * @param {?Array<Object>} records - /api/firms `fires` array.
@@ -21,7 +21,15 @@ export function adaptFirmsRecords(records) {
   for (const record of records) {
     const lat = Number(record?.lat);
     const lon = Number(record?.lon);
-    if (!Number.isFinite(lat) || !Number.isFinite(lon)) continue;
+    if (
+      !hasCoordinateValue(record?.lat) ||
+      !hasCoordinateValue(record?.lon) ||
+      !Number.isFinite(lat) ||
+      !Number.isFinite(lon) ||
+      Math.abs(lat) > 90 ||
+      Math.abs(lon) > 180
+    )
+      continue;
     fires.push({
       index: fires.length,
       lat,
@@ -110,3 +118,11 @@ function finiteNumber(value) {
   const number = Number(value);
   return Number.isFinite(number) ? number : 0;
 }
+
+// Same rule as parseFirmsCsv: a blank or non-numeric value is not a zero.
+function hasCoordinateValue(value) {
+  return (
+    typeof value === 'number' ||
+    (typeof value === 'string' && value.trim() !== '')
+  );
+}

src/data/firmsCsv.js

@@ -105,7 +105,17 @@ export function parseFirmsCsv(text) {
     if (parts.length < header.length) continue; // malformed row — skip
     const lat = Number(parts[iLat]);
     const lon = Number(parts[iLon]);
-    if (!Number.isFinite(lat) || !Number.isFinite(lon)) continue;
+    // Blank or out-of-range positions are dropped, never read as 0 (see
+    // hasCoordinateValue in firmsAdapt.js for the proxy-record side).
+    if (
+      !parts[iLat].trim() ||
+      !parts[iLon].trim() ||
+      !Number.isFinite(lat) ||
+      !Number.isFinite(lon) ||
+      Math.abs(lat) > 90 ||
+      Math.abs(lon) > 180
+    )
+      continue;
 
     records.push({
       lat,

src/data/manager.test.mjs

@@ -2398,10 +2398,13 @@ test('a newer absolute intent aborts a hung guard-compensation instead of starvi
   removeGuard();
   // The newest intent must be able to abort the hung compensation and run.
   const pendingFinalOn = mgr.setEnabled('flights', true, { origin: 'user' });
+  let giveUpTimer;
   const finalOn = await Promise.race([
     pendingFinalOn,
-    new Promise((resolve) => setTimeout(() => resolve('starved'), 2000)),
-  ]);
+    new Promise((resolve) => {
+      giveUpTimer = setTimeout(() => resolve('starved'), 2000);
+    }),
+  ]).finally(() => clearTimeout(giveUpTimer));
   assert.notEqual(finalOn, 'starved', 'newest intent must not starve behind the compensation');
   assert.equal(compensationAborted, true, 'the hung compensation was aborted');
   assert.equal(await pendingBlockedOn, false, 'the guard-blocked request stays unfulfilled');
@@ -2451,10 +2454,13 @@ test('re-entrant setEnabled from a blocked-adoption listener supersedes the comp
   releaseFirstDisable();
 
   const blockedOn = await pendingBlockedOn;
+  let giveUpTimer;
   const reentrant = await Promise.race([
     (async () => reentrantResult === null ? 'never-fired' : await reentrantResult)(),
-    new Promise((resolve) => setTimeout(() => resolve('starved'), 2000)),
-  ]);
+    new Promise((resolve) => {
+      giveUpTimer = setTimeout(() => resolve('starved'), 2000);
+    }),
+  ]).finally(() => clearTimeout(giveUpTimer));
   await pendingOff;
   await mgr.waitForLayerSettled('flights');
   unsubscribe();

src/data/regionalModel.js

@@ -87,14 +87,22 @@ export function normalizeRegionalArticles(payload, limit = MAX_ARTICLES) {
   return articles;
 }
 
+/** A reported number, or null when the observation is missing or not numeric. */
+function observedNumber(value) {
+  if (
+    value == null ||
+    typeof value === 'boolean' ||
+    (typeof value === 'string' && !value.trim())
+  )
+    return null;
+  return Number.isFinite(Number(value)) ? Number(value) : null;
+}
+
 /** Normalize Open-Meteo current conditions into a small source-stamped record. */
 export function normalizeRegionalWeather(payload) {
   const current = payload?.current;
-  if (!current || !Number.isFinite(Number(current.temperature_2m))) return null;
-  const numberOrNull = (value) => {
-    if (value === null || value === undefined || value === '') return null;
-    return Number.isFinite(Number(value)) ? Number(value) : null;
-  };
+  if (!current || observedNumber(current.temperature_2m) == null) return null;
+  const numberOrNull = observedNumber;
   // Open-Meteo reports zone-naive timestamps ("2026-08-17T00:15") that are UTC,
   // but JS parses zoneless date-times as LOCAL — pin them to UTC explicitly.
   const observedRaw =
@@ -119,8 +127,8 @@ export function normalizeRegionalWeather(payload) {
 
 /** Translate the WMO weather code used by Open-Meteo into concise cockpit copy. */
 export function weatherCodeLabel(code) {
-  const value = Number(code);
-  if (!Number.isFinite(value)) return 'CONDITIONS UNKNOWN';
+  const value = observedNumber(code);
+  if (value == null) return 'CONDITIONS UNKNOWN';
   if (value === 0) return 'CLEAR';
   if ([1, 2].includes(value)) return 'PARTLY CLOUDY';
   if (value === 3) return 'OVERCAST';

src/data/route-cap-truthfulness.test.mjs

@@ -0,0 +1,24 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { normalizeOsrmSteps, ROUTE_STEPS_MAX } from './routeSteps.js';
+const step = (type) => ({
+  maneuver: { type, location: [10, 20] },
+  distance: 10,
+  duration: 1,
+});
+test('exact-cap routes remain complete and boundary exits retain their distance', () => {
+  const steps = Array.from({ length: ROUTE_STEPS_MAX }, () => step('turn'));
+  assert.equal(normalizeOsrmSteps({ legs: [{ steps }] }).truncated, false);
+  assert.equal(
+    normalizeOsrmSteps({ legs: [{ steps: [...steps, step('turn')] }] })
+      .truncated,
+    true,
+  );
+  steps[steps.length - 1] = step('roundabout');
+  const result = normalizeOsrmSteps({
+    legs: [{ steps: [...steps, step('exit roundabout')] }],
+  });
+  assert.equal(result.truncated, false);
+  assert.equal(result.steps.length, ROUTE_STEPS_MAX);
+  assert.equal(result.steps.at(-1).distanceM, 20);
+});

src/data/routeSteps.js

@@ -185,9 +185,9 @@ export function normalizeOsrmSteps(route) {
         }
         continue;
       }
+      if (out.length >= ROUTE_STEPS_MAX) return { steps: out, truncated: true };
       step.instruction = instructionFor(step);
       out.push(step);
-      if (out.length >= ROUTE_STEPS_MAX) return { steps: out, truncated: true };
     }
   }
   return { steps: out, truncated: false };

src/data/routeSteps.test.mjs

@@ -206,9 +206,9 @@ test('the step list is capped, and the cap is reported rather than hidden', () =
   // would present a route that simply stops in the middle of a road.
   assert.equal(cut.truncated, true);
   const exact = normalizeOsrmSteps({
-    legs: [{ steps: many.slice(0, ROUTE_STEPS_MAX - 1) }],
+    legs: [{ steps: many.slice(0, ROUTE_STEPS_MAX) }],
   });
-  assert.equal(exact.steps.length, ROUTE_STEPS_MAX - 1);
+  assert.equal(exact.steps.length, ROUTE_STEPS_MAX);
   assert.equal(exact.truncated, false, 'a route that fits is not cut');
 });
 

src/data/weather-missing-observations.test.mjs

@@ -0,0 +1,20 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { normalizeRegionalWeather, weatherCodeLabel } from './regionalModel.js';
+test('missing weather observations never assert clear conditions', () => {
+  for (const value of [null, undefined, '', ' ', false, true]) {
+    assert.equal(weatherCodeLabel(value), 'CONDITIONS UNKNOWN');
+    assert.equal(
+      normalizeRegionalWeather({ current: { temperature_2m: value } }),
+      null,
+    );
+  }
+  assert.equal(weatherCodeLabel(0), 'CLEAR');
+  assert.equal(weatherCodeLabel('0'), 'CLEAR');
+  const record = normalizeRegionalWeather({
+    current: { temperature_2m: 0, weather_code: null, wind_speed_10m: false },
+  });
+  assert.equal(record.temperatureC, 0);
+  assert.equal(record.weatherCode, null);
+  assert.equal(record.windKph, null);
+});

src/director/camera.js

@@ -28,6 +28,11 @@ export function resolveCameraMove(scene, shot) {
   };
 }
 
+/** Wrap an interpolated camera longitude to WGS84 without changing authored endpoints. */
+export function normalizeCameraLongitude(longitude) {
+  return ((((longitude + 180) % 360) + 360) % 360) - 180;
+}
+
 /** Sample the same authored curve for playback and seeking, taking the short longitude/angle arc. */
 export function sampleCameraMove(move, progress) {
   const t = Math.max(0, Math.min(1, Number(progress) || 0));
@@ -45,7 +50,7 @@ export function sampleCameraMove(move, progress) {
   const { from, to } = move;
   return {
     lat: lerp(from.lat, to.lat),
-    lon: ((((angle(from.lon, to.lon) + 180) % 360) + 360) % 360) - 180,
+    lon: normalizeCameraLongitude(angle(from.lon, to.lon)),
     alt: lerp(from.alt, to.alt),
     heading: angle(from.heading, to.heading),
     pitch: lerp(from.pitch, to.pitch),

src/director/director-dateline-seek.test.mjs

@@ -0,0 +1,53 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { cameraAtProgress } from './timeline.js';
+const camera = (lon) => ({
+  lat: 10,
+  lon,
+  alt: 1000,
+  heading: 0,
+  pitch: -40,
+  roll: 0,
+});
+test('director seek follows the short dateline arc in both directions', () => {
+  for (const [a, b] of [
+    [179, -179],
+    [-179, 179],
+  ]) {
+    assert.equal(
+      Math.abs(cameraAtProgress(camera(a), camera(b), 0.5).lon),
+      180,
+    );
+    assert.equal(cameraAtProgress(camera(a), camera(b), 0).lon, a);
+    assert.equal(cameraAtProgress(camera(a), camera(b), 1).lon, b);
+    assert.ok(Math.abs(cameraAtProgress(camera(a), camera(b), 0.25).lon) > 179);
+  }
+  assert.equal(cameraAtProgress(camera(20), camera(24), 0.5).lon, 22);
+});
+
+test('director seek keeps exact ±180 endpoints and picks the short arc near the antipode', () => {
+  for (const [a, b] of [
+    [180, -180],
+    [-180, 180],
+  ]) {
+    assert.equal(cameraAtProgress(camera(a), camera(b), 0).lon, a);
+    assert.equal(cameraAtProgress(camera(a), camera(b), 1).lon, b);
+    assert.equal(
+      Math.abs(cameraAtProgress(camera(a), camera(b), 0.5).lon),
+      180,
+    );
+  }
+  // 10°E to 169.9°W is 179.9° westward through Greenwich, not 180.1° east.
+  const mid = cameraAtProgress(camera(10), camera(-169.9), 0.5).lon;
+  assert.ok(mid > -81 && mid < -79, `short arc midpoint, got ${mid}`);
+});
+
+test('director seek turns heading and roll the short way for any authored angles', () => {
+  const pose = (heading, roll) => ({ ...camera(0), heading, roll });
+  const mid = cameraAtProgress(pose(350, 350), pose(-350, -350), 0.5);
+  // 350° and -350° are 20° apart through 0°/360°, not 340° through 180°.
+  for (const value of [mid.heading, mid.roll]) {
+    const wrapped = ((value % 360) + 360) % 360;
+    assert.ok(wrapped < 1e-9 || 360 - wrapped < 1e-9, `got ${value}`);
+  }
+});

src/director/packs/asset-stream-cancellation.test.mjs

@@ -0,0 +1,79 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createAssetDirectorySource } from './source.js';
+test('cancellation during the terminating read cannot return a scene asset', async () => {
+  for (const cancel of [true, false]) {
+    const controller = new AbortController();
+    let reads = 0,
+      cancelled = 0,
+      released = 0;
+    const source = createAssetDirectorySource({
+      baseUrl: 'https://fixture.example/assets/',
+      fetchImpl: async () => ({
+        ok: true,
+        headers: new Headers({ 'content-type': 'application/octet-stream' }),
+        body: {
+          getReader() {
+            return {
+              async read() {
+                reads++;
+                if (reads === 1)
+                  return { done: false, value: new Uint8Array([1, 2]) };
+                if (cancel) controller.abort();
+                return { done: true };
+              },
+              async cancel() {
+                cancelled++;
+              },
+              releaseLock() {
+                released++;
+              },
+            };
+          },
+        },
+      }),
+    });
+    const pending = source({ path: 'scene.bin', signal: controller.signal });
+    if (cancel) await assert.rejects(pending, { name: 'AbortError' });
+    else assert.deepEqual([...(await pending).bytes], [1, 2]);
+    assert.equal(cancelled, 1);
+    assert.equal(released, 1);
+  }
+});
+
+test('cancellation during reader cleanup cannot return a scene asset', async () => {
+  const controller = new AbortController();
+  const reason = new DOMException('scene changed', 'AbortError');
+  let released = 0;
+  const source = createAssetDirectorySource({
+    baseUrl: 'https://fixture.example/assets/',
+    fetchImpl: async () => ({
+      ok: true,
+      headers: new Headers(),
+      body: {
+        getReader() {
+          let reads = 0;
+          return {
+            async read() {
+              reads++;
+              return reads === 1
+                ? { done: false, value: new Uint8Array([1]) }
+                : { done: true };
+            },
+            async cancel() {
+              controller.abort(reason);
+            },
+            releaseLock() {
+              released++;
+            },
+          };
+        },
+      },
+    }),
+  });
+  await assert.rejects(
+    source({ path: 'scene.bin', signal: controller.signal }),
+    (error) => error === reason,
+  );
+  assert.equal(released, 1);
+});

src/director/packs/source.js

@@ -41,6 +41,7 @@ export function createAssetDirectorySource({
       for (;;) {
         signal?.throwIfAborted();
         const { done, value } = await reader.read();
+        signal?.throwIfAborted();
         if (done) break;
         length += value.byteLength;
         if (length > maxBytes) throw new Error('Asset exceeds byte limit');
@@ -50,6 +51,8 @@ export function createAssetDirectorySource({
       await reader.cancel().catch(() => {});
       reader.releaseLock();
     }
+    // Cleanup awaits too; a cancel during it must still discard the asset.
+    signal?.throwIfAborted();
     const bytes = new Uint8Array(length);
     let offset = 0;
     for (const chunk of chunks) {

src/director/timeline.js

@@ -2,6 +2,7 @@ import {
   resolveCameraPose,
   resolveCameraMove,
   sampleCameraMove,
+  normalizeCameraLongitude,
 } from './camera.js';
 
 const DEFAULT_SHOT_DURATION_SEC = 4;
@@ -40,12 +41,19 @@ export function cameraAtProgress(fromCamera, toCamera, progress) {
   const lerp = (from, to) => Number(from) + (Number(to) - Number(from)) * eased;
   const lerpAngle = (from, to) => {
     const start = Number(from) || 0;
-    const delta = ((Number(to) - start + 540) % 360) - 180;
+    // Double modulo keeps the delta in [-180, 180) for any authored angles,
+    // as sampleCameraMove does; a single % goes negative below -540.
+    const delta = ((((Number(to) - start + 540) % 360) + 360) % 360) - 180;
     return start + delta * eased;
   };
   return {
     lat: lerp(source.lat, target.lat),
-    lon: lerp(source.lon, target.lon),
+    lon:
+      t === 0
+        ? Number(source.lon)
+        : t === 1
+          ? Number(target.lon)
+          : normalizeCameraLongitude(lerpAngle(source.lon, target.lon)),
     alt: lerp(source.alt, target.alt),
     heading: lerpAngle(source.heading, target.heading),
     pitch: lerp(source.pitch, target.pitch),

src/layers/cctv/videoPlayback.js

@@ -1,3 +1,28 @@
+/**
+ * A v4 UUID for the client lease. `crypto.randomUUID` only exists in secure
+ * contexts, so a page opened over plain HTTP from another machine (the
+ * HOST=0.0.0.0 LAN opt-in) has none; `getRandomValues` exists in every context
+ * and yields the same shape the server's lease check accepts.
+ */
+export function createLeaseId(cryptoImpl = globalThis.crypto) {
+  if (typeof cryptoImpl.randomUUID === 'function') {
+    return cryptoImpl.randomUUID();
+  }
+  const bytes = cryptoImpl.getRandomValues(new Uint8Array(16));
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'));
+  return [
+    hex.slice(0, 4),
+    hex.slice(4, 6),
+    hex.slice(6, 8),
+    hex.slice(8, 10),
+    hex.slice(10),
+  ]
+    .map((group) => group.join(''))
+    .join('-');
+}
+
 /** One decoder per active camera; both surfaces consume this video element. */
 export function attachCctvVideo(
   video,
@@ -7,13 +32,14 @@ export function attachCctvVideo(
     loadHls = () => import('hls.js'),
     onFailure = () => {},
     fetchImpl = globalThis.fetch,
+    cryptoImpl = globalThis.crypto,
   } = {},
 ) {
   // Preserve replay for existing finite video feeds; live HLS must not loop.
   video.loop = feedType !== 'hls';
   let disposed = false;
   let hls = null;
-  const leaseId = feedType === 'hls' ? globalThis.crypto.randomUUID() : null;
+  const leaseId = feedType === 'hls' ? createLeaseId(cryptoImpl) : null;
   const mediaUrl =
     feedType === 'hls'
       ? `${url}${url.includes('?') ? '&' : '?'}lease=${leaseId}`

src/layers/cctv/videoPlayback.test.mjs

@@ -1,6 +1,15 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { attachCctvVideo } from './videoPlayback.js';
+import { webcrypto } from 'node:crypto';
+import { attachCctvVideo, createLeaseId } from './videoPlayback.js';
+
+const LEASE_V4 =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/** What an insecure context exposes: getRandomValues but no randomUUID. */
+const insecureCrypto = {
+  getRandomValues: (array) => webcrypto.getRandomValues(array),
+};
 function video() {
   const v = new EventTarget();
   Object.assign(v, {
@@ -69,6 +78,34 @@ test('native HLS releases its client lease without response-header access', asyn
   assert.equal(releases[0].init.method, 'DELETE');
 });
 
+test('lease ids are v4 UUIDs with or without crypto.randomUUID', () => {
+  assert.match(createLeaseId(), LEASE_V4);
+  const ids = new Set();
+  for (let i = 0; i < 64; i++) ids.add(createLeaseId(insecureCrypto));
+  assert.equal(ids.size, 64);
+  for (const id of ids) assert.match(id, LEASE_V4);
+});
+
+test('HLS starts on a plain-HTTP LAN page without crypto.randomUUID', async () => {
+  const source = video();
+  source.canPlayType = () => 'probably';
+  const playback = attachCctvVideo(source, '/api/cctv/media/a', 'hls', {
+    loadHls: async () => ({ default: { isSupported: () => false } }),
+    fetchImpl: async () => {},
+    cryptoImpl: insecureCrypto,
+  });
+  try {
+    await playback.ready;
+    const lease = new URL(
+      source.src,
+      'http://192.168.1.10:4173/',
+    ).searchParams.get('lease');
+    assert.match(lease, LEASE_V4);
+  } finally {
+    playback.dispose();
+  }
+});
+
 test('finite video feeds retain looping while live HLS does not loop', async () => {
   for (const feedType of ['mp4', 'webm', 'hls']) {
     const source = video();

src/layers/recentImagery/imagery-box-missing-edge.test.mjs

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  boxCentre,
+  boxFromRectangle,
+  dequantizeBox,
+  validateBox,
+} from './model.js';
+import { searchHls } from './catalog.js';
+
+test('missing imagery edges do not turn into invented zero coordinates', () => {
+  for (const value of [null, undefined, '', ' ', false, true]) {
+    const box = { west: value, south: 0, east: 1, north: 1 };
+    assert.equal(validateBox(box).ok, false);
+    assert.equal(validateBox(box).reason, 'invalid');
+    assert.equal(boxCentre(box), null);
+  }
+  assert.equal(validateBox({ west: 0, south: 0, east: 1, north: 1 }).ok, true);
+  assert.equal(
+    validateBox({ west: '0', south: '0', east: '1', north: '1' }).ok,
+    true,
+  );
+});
+
+test('every edge and every box entry point refuses a missing edge', async () => {
+  const blanks = [null, undefined, '', ' ', false, [], {}];
+  for (const edge of ['west', 'south', 'east', 'north']) {
+    for (const value of blanks) {
+      const box = { west: 1, south: 1, east: 2, north: 2, [edge]: value };
+      assert.equal(validateBox(box).ok, false, `${edge}=${String(value)}`);
+      // Share-link integers and Cesium radians are converted per edge.
+      assert.equal(dequantizeBox(box), null, `share ${edge}`);
+      assert.equal(boxFromRectangle(box), null, `radians ${edge}`);
+    }
+  }
+  let fetched = false;
+  await assert.rejects(
+    searchHls({
+      box: { west: ' ', south: 1, east: 2, north: 2 },
+      fetchImpl: async () => {
+        fetched = true;
+      },
+    }),
+    TypeError,
+  );
+  assert.equal(fetched, false);
+  assert.ok(dequantizeBox({ west: 0, south: 0, east: 100000, north: 100000 }));
+});

src/layers/recentImagery/model.js

@@ -75,6 +75,14 @@ const pad2 = (value) => String(value).padStart(2, '0');
  * east are not swapped: west > east crosses the dateline and `validateBox`
  * rejects it. Null when any edge is nonfinite.
  */
+/** A box edge as a number, or null when it is missing, blank or not numeric. */
+function edgeNumber(value) {
+  if (typeof value === 'number') return Number.isFinite(value) ? value : null;
+  if (typeof value !== 'string' || !value.trim()) return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
 function normalizeBox(box) {
   if (!box || typeof box !== 'object') return null;
   const [west, south, east, north] = [
@@ -82,8 +90,8 @@ function normalizeBox(box) {
     box.south,
     box.east,
     box.north,
-  ].map(Number);
-  if (![west, south, east, north].every(Number.isFinite)) return null;
+  ].map(edgeNumber);
+  if ([west, south, east, north].some((edge) => edge == null)) return null;
   return {
     west,
     south: Math.min(south, north),
@@ -211,11 +219,16 @@ export function boxFromPin(lon, lat, sideKm = PIN_BOX_SIDE_KM) {
 
 function mapBox(box, fn) {
   if (!box || typeof box !== 'object') return null;
+  // Converting first would turn a blank edge into 0 before normalizeBox sees it.
+  const edge = (value) => {
+    const number = edgeNumber(value);
+    return number == null ? null : fn(number);
+  };
   return normalizeBox({
-    west: fn(box.west),
-    south: fn(box.south),
-    east: fn(box.east),
-    north: fn(box.north),
+    west: edge(box.west),
+    south: edge(box.south),
+    east: edge(box.east),
+    north: edge(box.north),
   });
 }
 

src/layers/streetLevel/street-level-unique-tiles.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { tilesForBbox } from './tileMath.js';
+
+test('reachable polar dateline coverage ranks 24 distinct tiles before overview truncation', () => {
+  // coverage uses the actual view bbox above zoom 1; polar views can wrap.
+  const bbox = [-10, 60, -20, 85];
+  const result = tilesForBbox(bbox, 3);
+  const keys = result.tiles.map((tile) => `${tile.x}/${tile.y}/${tile.z}`);
+  assert.equal(keys.length, 24);
+  assert.equal(new Set(keys).size, 24);
+  assert.equal(result.total, 24);
+  assert.equal(result.truncated, false);
+  const overview = tilesForBbox(bbox, 3, { limit: 16 });
+  assert.equal(overview.total, 24);
+  assert.equal(overview.tiles.length, 16);
+  assert.equal(
+    new Set(overview.tiles.map((tile) => `${tile.x}/${tile.y}/${tile.z}`)).size,
+    16,
+  );
+  assert.equal(overview.truncated, true);
+});
+
+test('a limit that fits every distinct tile is not spent on repeats', () => {
+  // Before de-duplication this box yielded 27 entries for 24 tiles, so a
+  // 24-slot overview held repeats and still reported itself truncated.
+  const result = tilesForBbox([-10, 60, -20, 85], 3, { limit: 24 });
+  const keys = result.tiles.map((tile) => `${tile.x}/${tile.y}/${tile.z}`);
+  assert.equal(new Set(keys).size, 24);
+  assert.equal(result.truncated, false);
+});

src/layers/streetLevel/tileMath.js

@@ -146,8 +146,16 @@ export function tilesForBbox(bbox, z, { limit = Infinity, focus = null } = {}) {
         const dx = Math.abs(tile.x - centre.x);
         return Math.min(dx, n - dx) ** 2 + (tile.y - centre.y) ** 2;
       };
-  // Each tile's distance is computed once; ties keep their row order.
-  const ranked = tiles
+  // The date-line halves share a column when the gap between east and west is
+  // narrower than a tile; count that column once so a capped overview does not
+  // spend its slots on repeats. Each tile's distance is computed once; ties keep
+  // their row order.
+  const unique = [
+    ...new Map(
+      tiles.map((tile) => [`${tile.x}/${tile.y}/${tile.z}`, tile]),
+    ).values(),
+  ];
+  const ranked = unique
     .map((tile) => ({ tile, d: distance2(tile) }))
     .sort((a, b) => a.d - b.d)
     .map(({ tile }) => tile);

src/maps/controller.js

@@ -131,7 +131,8 @@ export class MapSourceController {
    * @returns {() => void} Unsubscribe.
    */
   subscribe(listener) {
-    if (typeof listener !== 'function') return () => {};
+    // A destroyed controller never settles again, so it takes no listeners.
+    if (typeof listener !== 'function' || this._destroyed) return () => {};
     this._subscribers.add(listener);
     return () => {
       this._subscribers.delete(listener);
@@ -142,6 +143,8 @@ export class MapSourceController {
     if (this._destroyed || !this._subscribers.size) return;
     const state = this.getState();
     for (const listener of [...this._subscribers]) {
+      if (this._destroyed) return;
+      if (!this._subscribers.has(listener)) continue;
       try {
         listener(state);
       } catch (error) {

src/maps/imagery.js

@@ -25,5 +25,42 @@ export function createEsriImagery() {
 export function createIonImagery(style, accessToken) {
   accessToken = String(accessToken || '').trim();
   if (!accessToken) throw new Error('Ion imagery requires an explicit token');
+  if (
+    style === Cesium.IonWorldImageryStyle.AERIAL ||
+    style === Cesium.IonWorldImageryStyle.AERIAL_WITH_LABELS
+  ) {
+    return createBingIonImagery(style, accessToken);
+  }
   return Cesium.IonImageryProvider.fromAssetId(style, { accessToken });
 }
+
+async function createBingIonImagery(style, accessToken) {
+  const endpoint = await new Cesium.Resource({
+    url: `https://api.cesium.com/v1/assets/${style}/endpoint`,
+    queryParameters: { access_token: accessToken },
+  }).fetchJson();
+  if (
+    endpoint?.type !== 'IMAGERY' ||
+    endpoint.externalType !== 'BING' ||
+    typeof endpoint.options?.url !== 'string'
+  ) {
+    throw new Error('Ion world imagery did not return a Bing imagery endpoint');
+  }
+  // Bing otherwise follows the page's HTTP scheme on localhost. Resolve its
+  // ion-issued credentials through public APIs so tiles use HTTPS without
+  // weakening CSP, changing SDK defaults or touching provider internals.
+  const { url, ...options } = endpoint.options;
+  const provider = await Cesium.BingMapsImageryProvider.fromUrl(url, {
+    ...options,
+    tileProtocol: 'https',
+  });
+  const ionCredits = (endpoint.attributions ?? []).map(
+    ({ html, collapsible }) => new Cesium.Credit(html, collapsible === false),
+  );
+  const getTileCredits = provider.getTileCredits.bind(provider);
+  provider.getTileCredits = (x, y, level) => [
+    ...ionCredits,
+    ...(getTileCredits(x, y, level) ?? []),
+  ];
+  return provider;
+}

src/maps/map-subscription-ownership.test.mjs

@@ -0,0 +1,89 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { MapSourceController } from './controller.js';
+function fixture() {
+  return new MapSourceController(
+    {
+      scene: {
+        globe: { show: true },
+        requestRender() {},
+        frameState: {
+          creditDisplay: { addStaticCredit() {}, removeStaticCredit() {} },
+        },
+        primitives: { add() {}, remove() {} },
+      },
+      imageryLayers: { add() {}, remove() {} },
+    },
+    {
+      registry: {
+        defaultId: 'fixture',
+        sources: [
+          {
+            descriptor: { id: 'fixture', label: 'Fixture', kind: 'imagery' },
+            imagery: async () => ({}),
+          },
+        ],
+      },
+      createImageryLayer: (provider) => ({ provider }),
+    },
+  );
+}
+test('an unsubscribed owner is skipped in the same map settlement delivery', async () => {
+  const controller = fixture();
+  const calls = [];
+  let detach;
+  controller.subscribe(() => {
+    calls.push('first');
+    detach();
+  });
+  detach = controller.subscribe(() => calls.push('detached'));
+  controller.subscribe(() => calls.push('last'));
+  await controller.setStack('fixture');
+  assert.deepEqual(calls, ['first', 'last']);
+  controller.destroy();
+});
+test('destroying the controller during delivery stops remaining listeners', async () => {
+  const controller = fixture();
+  const calls = [];
+  controller.subscribe(() => {
+    calls.push('destroy');
+    controller.destroy();
+  });
+  controller.subscribe(() => calls.push('detached'));
+  await controller.setStack('fixture');
+  assert.deepEqual(calls, ['destroy']);
+});
+
+test('a listener re-added after destroy during delivery is not called', async () => {
+  const controller = fixture();
+  const calls = [];
+  const later = () => calls.push('later');
+  controller.subscribe(() => {
+    calls.push('destroy');
+    controller.destroy();
+    controller.subscribe(later);
+  });
+  controller.subscribe(later);
+  await controller.setStack('fixture');
+  assert.deepEqual(calls, ['destroy']);
+});
+
+test('delivery order: added during delivery waits, duplicates run once, re-added runs', async () => {
+  const controller = fixture();
+  const calls = [];
+  const twice = () => calls.push('twice');
+  const readded = () => calls.push('readded');
+  let offReadded;
+  controller.subscribe(() => {
+    calls.push('first');
+    controller.subscribe(() => calls.push('added-late'));
+    offReadded();
+    controller.subscribe(readded);
+  });
+  controller.subscribe(twice);
+  controller.subscribe(twice);
+  offReadded = controller.subscribe(readded);
+  await controller.setStack('fixture');
+  assert.deepEqual(calls, ['first', 'twice', 'readded']);
+  controller.destroy();
+});

src/maps/sourceFactories.test.mjs

@@ -89,7 +89,7 @@ test('imagery and terrain pass their own ion token without relying on SDK defaul
       calls.push({ kind: 'terrain', resource, options });
       return { id: 'terrain' };
     };
-    await createIonImagery(Cesium.IonWorldImageryStyle.AERIAL, 'imagery-token');
+    await createIonImagery(12345, 'imagery-token');
     const result = await createWorldTerrain('terrain-token');
     assert.equal(calls[0].options.accessToken, 'imagery-token');
     assert.equal(calls[1].options.accessToken, 'terrain-token');
@@ -104,6 +104,162 @@ test('imagery and terrain pass their own ion token without relying on SDK defaul
   }
 });
 
+test('both Bing ion stacks use HTTPS and retain ion and per-tile attribution', async (t) => {
+  const defaultToken = Cesium.Ion.defaultAccessToken;
+  const metadataCalls = [];
+  const bingCalls = [];
+  const perTileCalls = [];
+  const bingCredit = new Cesium.Credit('Bing tile credit', true);
+  const endpoint = {
+    type: 'IMAGERY',
+    externalType: 'BING',
+    options: Object.freeze({
+      url: 'https://dev.virtualearth.net',
+      key: 'ion-issued-bing-fixture',
+      mapStyle: 'Aerial',
+      tileProtocol: 'http',
+    }),
+    attributions: [
+      { html: 'Ion required credit', collapsible: false },
+      { html: 'Ion optional credit', collapsible: true },
+    ],
+  };
+  t.mock.method(Cesium.Resource.prototype, 'fetchJson', async function () {
+    metadataCalls.push({
+      url: this.url,
+      token: this.queryParameters.access_token,
+    });
+    const mapStyle = this.url.includes(
+      `/assets/${Cesium.IonWorldImageryStyle.AERIAL_WITH_LABELS}/`,
+    )
+      ? 'AerialWithLabels'
+      : 'Aerial';
+    return {
+      ...endpoint,
+      options: Object.freeze({ ...endpoint.options, mapStyle }),
+    };
+  });
+  t.mock.method(Cesium.IonImageryProvider, 'fromAssetId', () =>
+    assert.fail('Bing must not inherit the local HTTP page protocol'),
+  );
+  t.mock.method(
+    Cesium.BingMapsImageryProvider,
+    'fromUrl',
+    async (url, options) => {
+      bingCalls.push({ url, options });
+      const provider = {
+        errorEvent: new Cesium.Event(),
+        getTileCredits(x, y, level) {
+          assert.equal(this, provider);
+          perTileCalls.push([x, y, level]);
+          return level === 0 ? undefined : [bingCredit];
+        },
+      };
+      return provider;
+    },
+  );
+  for (const style of [
+    Cesium.IonWorldImageryStyle.AERIAL,
+    Cesium.IonWorldImageryStyle.AERIAL_WITH_LABELS,
+  ]) {
+    const provider = await createIonImagery(style, ' own-ion-token ');
+    const credits = provider.getTileCredits(3, 4, 5);
+    assert.deepEqual(
+      credits.map(({ html, showOnScreen }) => ({ html, showOnScreen })),
+      [
+        { html: 'Ion required credit', showOnScreen: true },
+        { html: 'Ion optional credit', showOnScreen: false },
+        { html: 'Bing tile credit', showOnScreen: true },
+      ],
+    );
+    assert.equal(credits[2], bingCredit);
+    assert.equal(provider.getTileCredits(0, 0, 0).length, 2);
+    assert.ok(provider.errorEvent instanceof Cesium.Event);
+    assert.equal(metadataCalls.at(-1).token, 'own-ion-token');
+    const requested = new URL(metadataCalls.at(-1).url);
+    assert.equal(requested.origin, 'https://api.cesium.com');
+    assert.equal(requested.pathname, `/v1/assets/${style}/endpoint`);
+  }
+  assert.deepEqual(perTileCalls, [
+    [3, 4, 5],
+    [0, 0, 0],
+    [3, 4, 5],
+    [0, 0, 0],
+  ]);
+  assert.equal(bingCalls.length, 2);
+  for (const [index, { url, options }] of bingCalls.entries()) {
+    assert.equal(url, 'https://dev.virtualearth.net');
+    assert.deepEqual(options, {
+      key: 'ion-issued-bing-fixture',
+      mapStyle: index === 0 ? 'Aerial' : 'AerialWithLabels',
+      tileProtocol: 'https',
+    });
+  }
+  assert.equal(endpoint.options.tileProtocol, 'http');
+  assert.equal(Cesium.Ion.defaultAccessToken, defaultToken);
+});
+
+test('Bing ion metadata and construction failures propagate without another source', async (t) => {
+  const style = Cesium.IonWorldImageryStyle.AERIAL;
+  const metadataError = new Error('ion metadata fixture failure');
+  const providerError = new Error('Bing construction fixture failure');
+  let metadata = () => {
+    throw metadataError;
+  };
+  let bingCalls = 0;
+  t.mock.method(Cesium.Resource.prototype, 'fetchJson', async () => metadata());
+  t.mock.method(Cesium.BingMapsImageryProvider, 'fromUrl', async () => {
+    bingCalls += 1;
+    throw providerError;
+  });
+  t.mock.method(Cesium.IonImageryProvider, 'fromAssetId', () =>
+    assert.fail('Bing failures must not silently use an alternate provider'),
+  );
+  await assert.rejects(createIonImagery(style, 'test-token'), metadataError);
+  for (const endpoint of [
+    undefined,
+    {
+      type: 'TERRAIN',
+      externalType: 'BING',
+      options: { url: 'https://example.test' },
+    },
+    {
+      type: 'IMAGERY',
+      externalType: 'OTHER',
+      options: { url: 'https://example.test' },
+    },
+    { type: 'IMAGERY', externalType: 'BING', options: {} },
+  ]) {
+    metadata = () => endpoint;
+    await assert.rejects(
+      createIonImagery(style, 'test-token'),
+      /Bing imagery endpoint/,
+    );
+  }
+  assert.equal(bingCalls, 0);
+  metadata = () => ({
+    type: 'IMAGERY',
+    externalType: 'BING',
+    options: { url: 'https://dev.virtualearth.net', key: 'bing-fixture' },
+  });
+  await assert.rejects(createIonImagery(style, 'test-token'), providerError);
+  assert.equal(bingCalls, 1);
+});
+
+test('other ion imagery assets keep the standard SDK factory', async (t) => {
+  const expected = {};
+  const calls = [];
+  t.mock.method(Cesium.Resource.prototype, 'fetchJson', () =>
+    assert.fail('generic assets must use the SDK ion factory'),
+  );
+  t.mock.method(Cesium.IonImageryProvider, 'fromAssetId', async (...args) => {
+    calls.push(args);
+    return expected;
+  });
+  assert.equal(await createIonImagery(12345, ' custom-token '), expected);
+  assert.deepEqual(calls, [[12345, { accessToken: 'custom-token' }]]);
+});
+
 test('cancellation after ion metadata prevents terrain construction', async () => {
   const originalResource = Cesium.IonResource.fromAssetId;
   const originalTerrain = Cesium.CesiumTerrainProvider.fromUrl;

src/qaChrome.test.mjs

@@ -0,0 +1,27 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { MACOS_CHROME, chromeExecutablePath } from '../scripts/qa-chrome.mjs';
+
+test('gates keep macOS Chrome where it is installed', () => {
+  assert.equal(
+    chromeExecutablePath({ env: {}, exists: (p) => p === MACOS_CHROME }),
+    MACOS_CHROME,
+  );
+});
+
+test('gates fall back to Puppeteer’s browser without macOS Chrome', () => {
+  assert.equal(
+    chromeExecutablePath({ env: {}, exists: () => false }),
+    undefined,
+  );
+});
+
+test('an explicit executable path wins', () => {
+  assert.equal(
+    chromeExecutablePath({
+      env: { PUPPETEER_EXECUTABLE_PATH: 'C:\\Chrome\\chrome.exe' },
+      exists: () => true,
+    }),
+    'C:\\Chrome\\chrome.exe',
+  );
+});

src/sdr/controller.test.mjs

@@ -357,10 +357,11 @@ test('WebUSB picker remains available when no authorized receiver matches', asyn
 
 /** Resolve with the promise's value, or 'timed out' after `ms`. */
 function within(promise, ms = 1_000) {
-  return Promise.race([
-    promise,
-    new Promise((resolve) => setTimeout(() => resolve('timed out'), ms)),
-  ]);
+  let timer;
+  const timeout = new Promise((resolve) => {
+    timer = setTimeout(() => resolve('timed out'), ms);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
 }
 
 /**

src/search/coordinate-empty-components.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseCoordinateQuery } from './coordinateParser.js';
+test('search refuses omitted components and repeated separators', () => {
+  for (const q of ['30,, -97', ',30,-97', '30,-97,', '30;; -97', '30,; -97'])
+    assert.equal(parseCoordinateQuery(q), null, q);
+  for (const q of ['30,-97', '30; -97', '30 -97', 'N 30, W 97'])
+    assert.deepEqual(
+      [parseCoordinateQuery(q).lat, parseCoordinateQuery(q).lon],
+      [30, -97],
+    );
+});

src/search/coordinateParser.js

@@ -49,8 +49,8 @@ function splitComponents(query) {
   const parts = /[,;]/.test(text)
     ? text.split(/[,;]/)
     : text.split(/\s+(?=[+-]?[.\d]|[NSEW]\s*[+-]?[.\d])/i);
-  const trimmed = parts.map((part) => part.trim()).filter(Boolean);
-  return trimmed.length === 2 ? trimmed : null;
+  const trimmed = parts.map((part) => part.trim());
+  return trimmed.length === 2 && trimmed.every(Boolean) ? trimmed : null;
 }
 
 /** Present a parsed pair the way a coordinate is normally written. */

src/services/terrainHeights.js

@@ -272,28 +272,26 @@ export function createTerrainHeights({
     const uncached = [];
     const seenKeys = new Set();
     const now = Date.now();
+    // What this call resolved or found warm, so the assembly below can report a
+    // point even if a later chunk's writes pushed it past CACHE_MAX_ENTRIES.
+    // Without it a batch big enough to evict its own entries would report
+    // points as unresolved that it had in fact resolved.
+    const resolvedThisCall = new Map();
     for (const item of work) {
-      const entry = cache.get(item.key);
+      const entry = cacheTouch(item.key);
       const fallbackCooling =
         entry?.source === 'geoid-fallback' &&
         Number.isFinite(entry.retryAt) &&
         now < entry.retryAt;
-      if (
-        (entry && entry.source === 'reearth') ||
-        fallbackCooling ||
-        seenKeys.has(item.key)
-      )
+      if ((entry && entry.source === 'reearth') || fallbackCooling) {
+        resolvedThisCall.set(item.key, entry);
         continue;
+      }
+      if (seenKeys.has(item.key)) continue;
       seenKeys.add(item.key);
       uncached.push(item);
     }
 
-    // What this call resolved, so the assembly below can report a point even
-    // if a later chunk's writes pushed it past CACHE_MAX_ENTRIES. Without it a
-    // batch big enough to evict its own earlier chunks would report points as
-    // unresolved that it had in fact just resolved.
-    const resolvedThisCall = new Map();
-
     // Resolve the network path in sequential <=CHUNK_SIZE chunks. Each chunk's
     // failure is isolated to that chunk's points (geoid fallback), so a single
     // bad chunk doesn't lose results for the rest of a large batch.

src/services/terrainHeights.test.mjs

@@ -114,6 +114,47 @@ test('a batch larger than the cache bound still reports every point it resolved'
   assert.equal(warm.length, 4);
 });
 
+test('warm batch consumers retain their terrain cells ahead of unused cells', async () => {
+  let calls = 0;
+  const terrain = createTerrainHeights({
+    maxCacheEntries: 2,
+    source: {
+      async getHeights(points) {
+        calls++;
+        return points.map((p) => ({ ellipsoid: 100 + p.lon }));
+      },
+    },
+  });
+  const p = (lon) => ({ lat: 0, lon });
+  await terrain.resolveEllipsoidalGround([p(1)]);
+  await terrain.resolveEllipsoidalGround([p(2)]);
+  await terrain.resolveEllipsoidalGround([p(1)]);
+  assert.equal(calls, 2);
+  await terrain.resolveEllipsoidalGround([p(3)]);
+  assert.equal(terrain.cachedEllipsoidalGround(0, 1), 101);
+  assert.equal(terrain.cachedEllipsoidalGround(0, 2), null);
+  assert.equal(calls, 3);
+});
+
+test('a batch still reports its warm points after its own fetches evict them', async () => {
+  const terrain = createTerrainHeights({
+    source: stubSource(),
+    maxCacheEntries: 2,
+  });
+  await terrain.resolveEllipsoidalGround([pointAt(0)]);
+
+  const results = await terrain.resolveEllipsoidalGround([
+    pointAt(0),
+    pointAt(1),
+    pointAt(2),
+  ]);
+
+  results.forEach((result, i) => {
+    assert.equal(result.source, 'reearth', `point ${i} reported resolved`);
+    assert.equal(result.ellipsoid, heightAt(lonAt(i)));
+  });
+});
+
 test('an out-of-range cache bound falls back to the default instead of disabling the cache', async () => {
   for (const maxCacheEntries of [0, -1, Number.NaN, undefined]) {
     const terrain = createTerrainHeights({

src/styles/snow.js

@@ -29,11 +29,13 @@ export const snowShader = {
       float depth = 0.5 + layer * 0.5;
       float speed = 0.4 + layer * 0.3;
       float size = mix(0.01, 0.025, layer);
-      float windForce = sin(time * 0.5 + layer * 3.14) * (0.05 + wind * 0.2);
+      float windForce = 0.05 + wind * 0.2;
 
       vec2 snowUV = uv * vec2(1.0, 0.5) * (4.0 + layer * 4.0);
       snowUV.y += time * speed;
-      snowUV.x += time * windForce;
+      // Offset is the integral of a swaying velocity sin(time * 0.5 + phase) * windForce,
+      // so the sway stays bounded however long the app has been running.
+      snowUV.x -= 2.0 * cos(time * 0.5 + layer * 3.14) * windForce;
 
       vec2 cell = floor(snowUV);
       vec2 f = fract(snowUV);

src/tools/results.js

@@ -24,7 +24,9 @@ export function capRows(rows, limit = DEFAULT_LIMIT) {
 
 /** Format an epoch millisecond time as ISO 8601, or null. */
 export function isoTime(ms) {
-  return Number.isFinite(ms) ? new Date(ms).toISOString() : null;
+  if (!Number.isFinite(ms)) return null;
+  const date = new Date(ms);
+  return Number.isFinite(date.getTime()) ? date.toISOString() : null;
 }
 
 /** "1 earthquake", "3 earthquakes". */

src/tools/schema.js

@@ -106,10 +106,20 @@ export function validateValue(schema, value, path = 'arguments') {
         fail('must be a string');
         break;
       }
-      if (schema.minLength != null && value.length < schema.minLength)
-        fail(`must be at least ${schema.minLength} characters`);
-      if (schema.maxLength != null && value.length > schema.maxLength)
-        fail(`must be at most ${schema.maxLength} characters`);
+      if (schema.minLength != null || schema.maxLength != null) {
+        // Code points, as JSON Schema counts. Counting stops once both bounds
+        // are decided, so a huge argument costs no more than its limit.
+        const limit = Math.max(
+          schema.minLength ?? 0,
+          schema.maxLength != null ? schema.maxLength + 1 : 0,
+        );
+        let length = 0;
+        for (const _ of value) if (++length >= limit) break;
+        if (schema.minLength != null && length < schema.minLength)
+          fail(`must be at least ${schema.minLength} characters`);
+        if (schema.maxLength != null && length > schema.maxLength)
+          fail(`must be at most ${schema.maxLength} characters`);
+      }
       if (
         schema.pattern !== undefined &&
         !new RegExp(schema.pattern, 'u').test(value)

src/tools/tool-schema-codepoints.test.mjs

@@ -0,0 +1,33 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { validateValue } from './schema.js';
+test('tool string schemas count Unicode characters rather than UTF-16 units', () => {
+  const value = '𠮷野家😀';
+  assert.deepEqual(validateValue({ type: 'string', maxLength: 4 }, value), []);
+  assert.equal(
+    validateValue({ type: 'string', minLength: 5 }, value).length,
+    1,
+  );
+  assert.equal(
+    validateValue({ type: 'string', maxLength: 3 }, value).length,
+    1,
+  );
+  assert.deepEqual(
+    validateValue({ type: 'string', minLength: 4, maxLength: 4 }, 'abcd'),
+    [],
+  );
+  assert.equal(validateValue({ type: 'string', minLength: 2 }, '𠮷').length, 1);
+});
+
+test('tool string bounds hold at their edges and on huge arguments', () => {
+  const string = (bounds) => ({ type: 'string', ...bounds });
+  assert.deepEqual(validateValue(string({ maxLength: 3 }), '😀😀😀'), []);
+  assert.equal(validateValue(string({ maxLength: 3 }), '😀😀😀😀').length, 1);
+  assert.deepEqual(validateValue(string({ minLength: 3 }), '😀😀😀'), []);
+  assert.deepEqual(validateValue(string({}), 'x'.repeat(1e6)), []);
+  // Counting all of it takes roughly 0.7 s; stopping at the limit takes none.
+  const huge = 'x'.repeat(1e8);
+  const started = performance.now();
+  assert.equal(validateValue(string({ maxLength: 60 }), huge).length, 1);
+  assert.ok(performance.now() - started < 200, 'stops counting past the limit');
+});

src/tools/tool-timestamp-range.test.mjs

@@ -0,0 +1,59 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { isoTime } from './results.js';
+import { getBikeShare } from './queries/mobility.js';
+test('out-of-range finite timestamps are unknown rather than throwing', async () => {
+  for (const value of [1e30, -1e30, NaN, Infinity, null])
+    assert.equal(isoTime(value), null);
+  assert.equal(isoTime(0), '1970-01-01T00:00:00.000Z');
+  assert.equal(isoTime(8640000000000000), '+275760-09-13T00:00:00.000Z');
+  assert.equal(isoTime(-8640000000000000), '-271821-04-20T00:00:00.000Z');
+  for (const value of [8640000000000001, -8640000000000001, -Infinity])
+    assert.equal(isoTime(value), null);
+  assert.equal(isoTime(-1), '1969-12-31T23:59:59.999Z');
+  const station = {
+    station_id: 's1',
+    name: 'Fixture',
+    lat: 0,
+    lon: 0,
+    capacity: 4,
+  };
+  const result = await getBikeShare.run(
+    { area: { bbox: [-1, -1, 1, 1] } },
+    {
+      services: {
+        bikeshare: {
+          systems: [
+            {
+              id: 'fixture',
+              city: 'Fixture',
+              centerLat: 0,
+              centerLon: 0,
+              loadRadiusKm: 30,
+              stationInformationUrl: 'information',
+              stationStatusUrl: 'status',
+            },
+          ],
+          async getStations(url) {
+            return {
+              data: {
+                stations:
+                  url === 'information'
+                    ? [station]
+                    : [
+                        {
+                          station_id: 's1',
+                          last_reported: 1e30,
+                          num_bikes_available: 2,
+                        },
+                      ],
+              },
+            };
+          },
+        },
+      },
+    },
+  );
+  assert.equal(result.data.returned, 1);
+  assert.equal(result.data.rows[0].last_reported, null);
+});

src/ui/panelRails.test.mjs

@@ -704,6 +704,51 @@ test('narrow-screen rails pin every hosted panel glow inside its panel box', ()
   }
 });
 
+test('right layout ignores a CSS-hidden expanded panel when deciding exclusivity', () => {
+  const f = fixture('right');
+  const weather = element('weather-panel', { height: 300 });
+  weather.computed.display = 'none';
+  f.stack.children.push(weather);
+  weather.parentElement = f.stack;
+
+  f.run();
+
+  assert.equal(f.stack.classList.contains('layout-exclusive'), false);
+  assert.equal(f.stack.dataset.expandedCount, '0');
+  assert.equal(f.first.getAttribute('aria-hidden'), undefined);
+  assert.equal(f.second.getAttribute('aria-hidden'), undefined);
+  assert.equal(
+    weather.style.getPropertyValue('--right-panel-allocated-height'),
+    '',
+  );
+});
+
+test('right layout still restores panels that exclusive presentation hides', () => {
+  const f = fixture('right');
+  // Model layers.css: an exclusive rail hides its collapsed panels.
+  f.options.windowRef.getComputedStyle = (node) => ({
+    ...node.computed,
+    display:
+      f.stack.classList.contains('layout-exclusive') &&
+      node.classList.contains('collapsed')
+        ? 'none'
+        : node.computed.display,
+  });
+  f.expand(f.first, 250);
+  f.second.classList.add('layout-auto-collapsed');
+  f.stack.classList.add('layout-exclusive');
+
+  f.run();
+  assert.equal(f.stack.classList.contains('layout-exclusive'), true);
+  assert.equal(f.second.getAttribute('aria-hidden'), 'true');
+
+  f.options.hud.visible = false;
+  f.run();
+  assert.equal(f.second.classList.contains('collapsed'), false);
+  assert.equal(f.second.classList.contains('layout-auto-collapsed'), false);
+  assert.deepEqual(f.collapsed, ['second']);
+});
+
 test('right layout ignores a hidden panel: no lane, no gap, no auto-collapse', () => {
   const f = fixture('right');
   const imagery = element('recent-imagery-panel', { height: 0 });

src/ui/rightPanelRail.js

@@ -69,10 +69,17 @@ export function layoutRightPanelRail({
   // A collapse may schedule one follow-up, which only measures and allocates.
   const isCollapseRetry = pendingCollapseRetries.delete(stack);
 
-  // A floating (lifted-out) panel is not laid out by the rail.
+  // A floating (lifted-out) panel is not laid out by the rail. Neither is one
+  // that other CSS hides, such as an event view. Exclusive presentation hides
+  // collapsed panels itself; those stay in the rail so they can be restored.
+  const hiddenByRail = (panel) =>
+    stack.classList.contains('layout-exclusive') &&
+    panel.classList.contains('collapsed');
   const panels = [...stack.children].filter(
     (panel) =>
-      panel.matches('[data-panel-id]:not(.panel-floating)') && !panel.hidden,
+      panel.matches('[data-panel-id]:not(.panel-floating)') &&
+      !panel.hidden &&
+      (hiddenByRail(panel) || getComputedStyle(panel).display !== 'none'),
   );
   if (!hud.visible || hud.variant !== 'tactical') {
     for (const panel of panels.filter((item) =>

src/unitTestRunner.test.mjs

@@ -1,14 +1,40 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import {
   ALLOCATION_TEST_FILES,
+  UNIT_TEST_ROOTS,
   allocationTestArgs,
   assertNode24AllocationRuntime,
   buildUnitTestPlan,
+  discoverUnitTestFiles,
   isCalibratedAllocationRuntime,
 } from '../scripts/run-unit-tests.mjs';
 
+const repositoryRoot = fileURLToPath(new URL('..', import.meta.url));
+
+/** Every `*.test.mjs` a contributor could add, found without consulting the runner. */
+function testFilesOnDisk(root) {
+  // Build outputs and dependencies are not places a contributor writes a test,
+  // and walking them would be slow enough to matter. Everything else counts.
+  const skip = new Set(['node_modules', 'dist', 'build', 'public']);
+  const found = [];
+  const visit = (directory) => {
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (entry.name.startsWith('.') || skip.has(entry.name)) continue;
+      const absolute = path.join(directory, entry.name);
+      if (entry.isDirectory()) visit(absolute);
+      else if (entry.isFile() && entry.name.endsWith('.test.mjs')) {
+        found.push(path.relative(root, absolute).split(path.sep).join('/'));
+      }
+    }
+  };
+  visit(root);
+  return found.sort();
+}
+
 test('unit runner serializes only GC-bracketed allocation microbenchmarks', () => {
   const ordinary = [
     'src/data/manager.test.mjs',
@@ -37,6 +63,30 @@ test('unit runner serializes only GC-bracketed allocation microbenchmarks', () =
   );
 });
 
+test('the runner discovers every test file in the repository', () => {
+  // CI's unit-test job runs `npm test`, which runs exactly what this function
+  // returns. A `*.test.mjs` outside the searched roots therefore never runs
+  // there, while still reading — in review and to its author — like covered
+  // code. Compare the two sets rather than their sizes, so the failure names the
+  // files instead of only disagreeing about a count. The final equality also
+  // catches the reverse: files the runner finds that this walk skips.
+  const discovered = discoverUnitTestFiles(repositoryRoot);
+  const onDisk = testFilesOnDisk(repositoryRoot);
+  const undiscovered = onDisk.filter((file) => !discovered.includes(file));
+  assert.deepEqual(
+    undiscovered,
+    [],
+    `test files the runner never executes: ${undiscovered.join(', ')}`,
+  );
+  assert.deepEqual(discovered, onDisk);
+  for (const file of discovered) {
+    assert.ok(
+      UNIT_TEST_ROOTS.some((root) => file.startsWith(`${root}/`)),
+      `${file} should sit under one of ${UNIT_TEST_ROOTS.join(', ')}`,
+    );
+  }
+});
+
 test('allocation runtime calibration is explicit and pinned to Node 24', () => {
   assert.equal(assertNode24AllocationRuntime('24.19.0'), '24.19.0');
   assert.throws(

src/voice/gevActions.js

@@ -4809,9 +4809,11 @@ function compactAnalystItem(r) {
     if (!present(r[key]) || key in compact) continue;
     if (spec.type === 'time') {
       const ms = Number(r[key]);
-      if (Number.isFinite(ms)) {
+      // A finite value can still be past Date's range, where toISOString throws.
+      const time = new Date(ms);
+      if (Number.isFinite(time.getTime())) {
         if (key === 'lastContactAtMs') compact.lastContactAtMs = ms;
-        else compact.time = new Date(ms).toISOString();
+        else compact.time = time.toISOString();
       }
     } else compact[key] = r[key];
   }

src/voice/gevActions.test.mjs

@@ -3483,6 +3483,26 @@ test('analyst_query refusals carry their code and the allowed values', async ()
   assert.match(ok.items[0].time, /^\d{4}-\d\d-\d\dT/);
 });
 
+test('analyst_query keeps its answer when one record has an out-of-range time', async () => {
+  globalThis.window = globalThis.window || { clearTimeout, setTimeout, requestIdleCallback: null };
+  const now = Date.now();
+  const earthquakes = {
+    getStats: () => ({ count: 2, lastUpdate: now }),
+    getAnalystRecords: () => [
+      { id: 'q', lat: 0, lon: 0, magnitude: 5, timeMs: now },
+      { id: 'r', lat: 1, lon: 1, magnitude: 4, timeMs: 8.64e15 + 1 },
+    ],
+  };
+  const { runner } = manifestRunner({ earthquakes }, { enabled: ['earthquakes'] });
+  const result = await runner('analyst_query', { layers: ['earthquakes'], scope: { kind: 'anywhere' } });
+  assert.equal(result.ok, true);
+  const q = result.items.find((item) => item.id === 'q');
+  assert.match(q.time, /^\d{4}-\d\d-\d\dT/);
+  const r = result.items.find((item) => item.id === 'r');
+  assert.ok(r, 'the record is still listed');
+  assert.equal(r.time, undefined, 'an unrepresentable time is omitted');
+});
+
 test('spoken layer names from the manifest reach the newer layers', async () => {
   globalThis.window = globalThis.window || { clearTimeout, setTimeout, requestIdleCallback: null };
   const stub = () => ({ getStats: () => ({ count: 0 }) });

src/weatherEffectsMath.js

@@ -13,7 +13,13 @@ function range01(value, min, max) {
  * Missing weather fails clear instead of inventing conditions.
  */
 export function deriveWeatherEffectProfile(weather) {
-  if (!weather || !Number.isFinite(Number(weather.weatherCode))) {
+  const reported = weather?.weatherCode;
+  // Number(null) and Number('') are 0 (clear), so a missing code is checked first.
+  if (
+    reported == null ||
+    reported === '' ||
+    !Number.isFinite(Number(reported))
+  ) {
     return {
       available: false,
       cloud: 0,

src/weatherEffectsMath.test.mjs

@@ -10,6 +10,15 @@ test('missing weather fails clear instead of inventing effects', () => {
   assert.equal(profile.storm, 0);
 });
 
+test('a missing weather code is unavailable, not clear', () => {
+  for (const weatherCode of [null, undefined, '']) {
+    const profile = deriveWeatherEffectProfile({ weatherCode, cloudCoverPct: 90 });
+    assert.equal(profile.available, false, `weatherCode ${weatherCode}`);
+    assert.equal(profile.cloud, 0);
+  }
+  assert.equal(deriveWeatherEffectProfile({ weatherCode: 0 }).available, true);
+});
+
 test('clear weather follows observed cloud cover without precipitation', () => {
   const profile = deriveWeatherEffectProfile({
     weatherCode: 1,