chore: reconcile #816 with merged right-rail fix #918

CHANGELOG.md

@@ -5,6 +5,12 @@
   Repeated Context-open calls and rail-driven expansion both close the mini,
   with a regression for auto-collapse restoration (raysung-2026, #804).
 
+- The right rail ignores panels that other CSS hides, such as during an event
+  view, so they no longer force one-panel-at-a-time layout or collapse visible
+  panels. Panels the rail collapses itself are still restored.
+
+- Coordinate searches refuse empty latitude or longitude components instead of navigating to an unintended location.
+
 - Bing Aerial and Bing Labels request HTTPS tiles on HTTP localhost through
   their ion-backed providers, retaining ion and per-tile attribution without
   widening the Content Security Policy.
@@ -198,6 +204,12 @@
   largest cities) and `CCTV_VEGVESEN_VIDEO=0` keeps stills only. Attributed
   under NLOD 2.0.
 
+- Live HLS cameras play on a page opened over plain HTTP from another machine
+  (`HOST=0.0.0.0`). The client lease id came from `crypto.randomUUID`, which
+  browsers only expose in secure contexts, so starting a live feed threw
+  before playback. The id now falls back to a v4 UUID built from
+  `crypto.getRandomValues`, which the server's lease check accepts.
+
 ## [0.2.1] — 2026-10-02 — God's Eye View through Your Agent (with security fixes and other features)
 
 - Ship each bundled data pack once. The region, marine, admin-boundary,