Merge main into pr-594

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

docs/APPLICATION.md

@@ -105,14 +105,17 @@ checks when changing this wiring.
 
 `src/search` owns forward/reverse geocoding, place search and route provider
 interfaces. `createStandaloneApplication({ geospatial })` accepts `endpoints`
-and `providers`; the defaults preserve Google/Photon search, Google place context
-and the local OSRM route proxy. Location, annotations, HUD labels and voice use
-the composed service. Provider-specific credentials belong in the selected
-transport; server secrets never belong in browser configuration.
+and `providers`. Default forward search tries decimal coordinates and bundled
+place names (`presets`) first, without a network request, then Google when a key
+is configured, Photon, and the local `/api/geocode` Nominatim route. The
+defaults also keep Google place context and the local OSRM route proxy.
+Location, annotations, HUD labels and voice use the composed service.
+Provider-specific credentials belong in the selected transport; server secrets
+never belong in browser configuration.
 
-For a compatible protocol, configure `geocode`, `photon`, `reverse`, `textSearch`,
-`nearby` or `route` endpoints. These are developer-selected configuration, not
-URLs accepted from page queries or model arguments. A different protocol supplies
+For a compatible protocol, configure `geocode`, `photon`, `nominatim`, `reverse`,
+`textSearch`, `nearby` or `route` endpoints. These are developer-selected
+configuration, not URLs accepted from page queries or model arguments. A different protocol supplies
 an adapter function instead. The exported `createDefaultPlaceSearch` constructor
 supports the same options for direct composition:
 
@@ -181,10 +184,14 @@ separate constructors. Pass these to `createApplication`; use its `signal` and
 `defer` for ownership. The compatibility catalog is still page-scoped: construct
 one application per page. Controls, actions and renderers use the same layer
 instances. Configure sources with `application/sources` before registration or
-state restoration, and release them after the consumers stop.
+state restoration, and release them after the consumers stop. The catalog
+constructor (`application/layers`) also requires `wind`, `weather` and
+`cyclones` sources with `getSnapshot` for the Weather layers, and owns the
+observed-history clock those layers share for the catalog's lifetime.
 
 `application/services` accepts boundary, terrain, regional-context, weather and
-summary services. `application/requests` supplies the existing HTTP protocols
+summary services; its weather service supplies cockpit local conditions, not the
+Weather layers. `application/requests` supplies the existing HTTP protocols
 with configurable endpoints and a scoped transport. Changing an endpoint works
 only for a compatible protocol; another protocol supplies a service adapter.
 Cancellation discards late response bodies, and replacing a source invalidates

docs/CODE-BOUNDARIES.md

@@ -277,6 +277,90 @@ share restoration and movement of controls between containers remain caller-owne
 Existing helper imports from `cockpitMath.js` and `rightRailPolicy.js` remain
 compatible through re-exports.
 
+### Adding a right-rail readout panel
+
+Add the shell in `src/ui/templates/context.html` inside `#right-context-rail`:
+a `.panel-collapsible` with a stable `id` and matching `data-panel-id`, the
+existing `.panel-header`, collapse button and a dedicated body. Register it
+with the existing panel chrome/layout owners; do not allocate rail space in
+the body renderer. Set `hidden` while empty so the allocator ignores it, and
+expand through the existing collapse button only on first appearance per page
+session, and only when the chrome marked the restored state as a default
+(`data-collapsed-preference`), never over a stored or shared choice. Preserve
+the user's later collapse choice, including body remounts. Mark the body
+`data-rail-scroller` when it scrolls: the rail's measuring pass lifts its
+`max-height` and puts the scroll offset back afterwards. Panel bodies only
+scroll on an open-card change, with one write, never on a refresh.
+
+Compose `createRailCards({ container, document, onParams, onOpen })` and
+`createRailTimeline({ container, document, onCommit, onPreview, onStep,
+onLatest, onPlay })`. Cards reconcile `{ id, title, badge, open, compact,
+compactStatus, blocks }` in place. Their full-width native button headers expose
+`aria-expanded` and `aria-controls`; articles expose `data-open`. The feature
+adapter owns accordion state. Generic cards do not select data or enable layers.
+
+`blocks` is an ordered array of loose, optional `{ id, type, ... }` descriptors,
+rendered by `railCardBlocks.js`. There are no per-section disclosures:
+
+- `summary`: `text`, a single summary line.
+- `list`: `list: { ariaLabel, items }`, reconciled by `syncRowList` in `rowList.js`.
+- `lines`: keyed `lines: [{ id, text, muted? }]` for details and status.
+- `settings`: `settings: [{ id, label, chips }]`; each labelled row has a 56 px
+  label column and a wrapping `syncChipGroup` from `chipGroup.js`.
+- `legend`: `legend: { colors, labels, units?, zeroIndex?, categorical? }` for a
+  ramp/scale (including a physical freezing anchor) or separate keyed swatches.
+- `actions`: keyed `actions: [{ id, label, params?, href?, onClick?, disabled?,
+hint? }]` in a footer, using buttons or safe new-tab links.
+- `result`: `label`, keyed `lines`, and optional `clear: { params | onClick }`;
+  its accessible × button sits beside the title.
+
+Every block and control has a stable id. Lists, settings, actions and results
+can appear in any requested order, including a scene panel's rectangle action,
+results list, then selected-scene details. Chip/list/action `params` dispatch
+through `onParams(cardId, params)`; the feature adapter supplies
+`setLayerParams(id, params, { origin: 'user' })`. Current descriptors and disabled
+state are read at dispatch. Identical updates do not move nodes or write DOM;
+focused controls survive feed refreshes.
+
+Weather descriptors retain top-level `chips`, `list` and `legend` for non-DOM
+consumers. They expose `summary.settings`, `summary.actions` and optional
+`summary.result`; wind also retains its raw captured `summary.reading`.
+`readout: true` layer rows render only the toggle and source/meta line; their
+subscriptions still refresh the cards. Cards own configuration and readings.
+
+Weather orders cyclones, wind, then a bordered Observed history group containing
+the timeline and active radar, satellite and lightning cards. The group heading
+and scope name its active products. The timeline stays visible whenever any
+observed product is enabled; fewer than two ticks disables transport. Pass
+`heading: false` to the timeline when the containing group owns the heading.
+Exactly one active card is open. Header clicks and newly enabled ids choose it
+(the last new entry wins a batch); refreshes and clock ticks retain it. First
+appearance uses cyclones with storms, otherwise the first card. Disabling the
+open layer falls back to the first remaining card. A WeakMap per document keeps
+explicit choices through body remounts without adding share state. Card opening,
+storm selection and layer enabling remain independent.
+
+Optional card/badge/slider class names provide feature styling. Card titles use
+`.data-name` typography; meta/time/badges use `.data-toggle-meta` typography;
+setting/result labels use `.panel-title`; chips retain `.data-toggle-chip`.
+Reserve one status line, even without a legend. Use app tokens. Wind's footer
+reads the map center into a result after the action. The captured location stays
+fixed until another read; model changes resample that location, units reformat
+it, and × clears both reading and map marker.
+
+The timeline shows endpoint times and receives ticks, index, mode, playing,
+readout and disabled state. Its preview callback receives the tick and index and
+may return readout text; commits receive the same values after a 150 ms coalesced
+drag or final change. Feature adapters own data mapping and service subscriptions;
+generic modules own DOM/listeners/timers and release them in `destroy()`.
+
+Keep persistence with panel chrome: collapse uses
+`godsEyeView.v6.panelCollapsed.<panelId>`, position uses
+`godsEyeView.v8.panelPos.<panelId>`, and share state uses the registered panel id.
+Do not rename existing
+ids or reset persistence versions when adding a body. The WEATHER adapter is
+`src/ui/weatherPanel.js`; its observed-history selection remains transient.
+
 ## Visual input
 
 `gods-eye-view/ui/input` exports `bindApplicationShortcuts` and

docs/DIRECTOR-CAMERA.md

@@ -0,0 +1,110 @@
+# Director camera directions
+
+Version 4 scene documents can name geographic anchors and describe an explicit
+camera move followed by a hold. Existing camera-pose shots still use the ordinary
+camera flight. Import, playback, Load, Replay and seek accept the new directions;
+[EDIT DETAILS](DIRECTOR-SHARING.md) captures anchors and move starts; a graphical
+path editor remains a later extension.
+
+```json
+{
+  "version": 4,
+  "scenes": [{
+    "id": "austin",
+    "title": "Across Austin",
+    "anchors": [
+      { "id": "west", "title": "West viewpoint", "lat": 30.2672,
+        "lon": -97.76, "alt": 6000, "altitudeReference": "ellipsoid" },
+      { "id": "east", "title": "East viewpoint", "lat": 30.2672,
+        "lon": -97.73, "alt": 7000, "altitudeReference": "ellipsoid" }
+    ],
+    "shots": [{
+      "id": "crossing",
+      "title": "Cross the city",
+      "durationSec": 4,
+      "holdSec": 2,
+      "camera": { "anchorId": "east", "heading": 10, "pitch": -45, "roll": 0 },
+      "move": {
+        "from": { "anchorId": "west", "heading": 350, "pitch": -45, "roll": 0 },
+        "easing": "cubic-in-out"
+      },
+      "visual": { "style": "normal" },
+      "layers": {}
+    }]
+  }]
+}
+```
+
+## One owner for each authored value
+
+An anchor is a scene-local geographic position, with a stable `id`, optional
+`title`, latitude, longitude, height and explicit altitude reference. Each scene
+accepts at most 1,024 anchors. IDs must be unique within that scene. References to
+missing anchors fail validation before replacing a project.
+
+The shot's `camera` is its destination. It can be an inline pose or an
+`anchorId` plus orientation. The optional `move.from` uses the same pose/reference
+shape. References cannot also carry inline coordinates. They do not form chains.
+Heading, pitch and roll belong to each camera pose, so two shots can look in
+different directions from the same geographic anchor. Omitted orientation uses
+heading 0, pitch −35 and roll 0 degrees.
+
+An explicit move requires `move.from`, `move.easing`, `durationSec` and `holdSec`.
+Its duration is 0.2–86,400 seconds; the hold is 0–86,400 seconds. The destination
+is not copied into another field. `linear` and `cubic-in-out` are the supported
+easings. A shot without `move` retains the existing ordinary flight, even in a
+version-4 file. Its destination may also reference an anchor.
+
+Capture continues to create ordinary camera-pose shots. Update Shot stores the
+current viewport as an inline destination, preserving an explicit move's start
+and easing; it does not change a shared anchor and thereby move other shots.
+Editing imported directions and anchors currently means editing the scene JSON.
+
+## Coordinates and altitude
+
+Latitude/longitude use WGS84 degrees. Orientation uses the application's Cesium
+heading/pitch/roll convention in degrees: heading rotates from local north,
+negative pitch looks down, and zero pitch is horizontal. Camera positions use
+meters above the WGS84 ellipsoid, matching `Cartesian3.fromDegrees` and captured
+camera poses. These heights are not mean-sea-level elevations or heights above
+the visible surface.
+
+Every anchor and every inline endpoint of an explicit move must say
+`"altitudeReference": "ellipsoid"`. Ordinary legacy poses without that field
+already use the same reference. Terrain-relative and mean-sea-level references
+are rejected; no terrain request, default ground estimate or implicit conversion
+is made. Authors must provide ellipsoidal heights with enough clearance for their
+scene. The format does not promise collision avoidance or terrain following.
+
+During an explicit move, latitude and altitude interpolate between endpoints.
+Longitude takes the shortest signed arc across the dateline; heading and roll
+also take their shortest signed arcs. An exact 180-degree tie takes the negative
+arc. This is an authored coordinate interpolation, not a geodesic or a camera
+flight with an automatically raised arc. Endpoints are exact, including zero
+pitch. Curved paths and look-at targets are later extensions.
+
+## Time, seeking and cancellation
+
+Load and Replay of an explicit move start at its authored `from` pose, regardless
+of the current viewport. Play uses that same start. Both live playback and seek
+use `sampleCameraMove`; a seek into the hold uses the exact destination. Backward
+seeks do not depend on a prior camera position. Existing scene-pack media/reveal
+rules can extend holds as before.
+
+Each active explicit move owns one animation-frame callback. Stop, replacement,
+import, teardown, a navigation handoff or manual pointer/wheel input revokes that
+callback and settles the move. Navigation also cancels a run during an authored
+hold, so the next shot cannot retake the camera. Camera claims still respect
+Cockpit's refusal. Already queued callbacks cannot move a replacement scene.
+The timing diagnostic includes the active authored camera animation.
+
+The renderer-independent `gods-eye-view/director` export provides
+`resolveCameraPose(scene, camera)`, `resolveCameraMove(scene, shot)` and
+`sampleCameraMove(move, progress)`. These expect validated/normalized data.
+Rendering and frame ownership live in `src/scenes/cameraMotion.js`; the existing
+scene controller supplies camera application and lifecycle cancellation.
+
+Version-1/2/3 projects migrate to version 4 without converting their ordinary
+shots into explicit moves. IDs, positions, durations, visual settings, packs and
+source attribution survive. The bloom scale remains independent of the document
+version; version-3 bloom is never interpreted as the older inverted scale.

docs/DIRECTOR-DATA-PACKS.md

@@ -0,0 +1,115 @@
+# Director data packs
+
+Version-5 scene documents can declare `dataPacks` on a scene and select them by
+`dataPackIds` on each shot. Import validates declarations without loading assets.
+Loading, seeking or playing a shot acquires only its selected packs. A shot with
+no pack IDs clears the preceding shot's packs. Existing scene recipes and assets
+keep their current paths, notices and behavior.
+
+A pack manifest is version 1 and requires an ID, format, source, attribution and
+placement. Sources describe storage; placement describes geography. Source names
+refer to trusted application registrations, never scripts to import. A document
+cannot supply request headers, keys, cookies, endpoints or executable handlers.
+
+```json
+{
+  "version": 5,
+  "scenes": [{
+    "id": "example",
+    "title": "My geographic notes",
+    "dataPacks": [{
+      "id": "notes",
+      "version": 1,
+      "format": "geojson",
+      "source": { "adapter": "assets", "path": "my-scene/notes.geojson" },
+      "attribution": { "text": "Your name", "license": "Your asset's actual license" },
+      "placement": { "altitudeReference": "ellipsoid" }
+    }],
+    "shots": [{
+      "id": "overview",
+      "camera": { "lat": 30.2672, "lon": -97.742, "alt": 2600, "pitch": -70 },
+      "durationSec": 4,
+      "holdSec": 2,
+      "dataPackIds": ["notes"]
+    }]
+  }]
+}
+```
+
+For the standalone application, put that asset at
+`public/scene-assets/my-scene/notes.geojson`. The registered `assets` source has
+an explicit `/scene-assets/` base on the application's origin. Importing a file
+from disk does not grant access to adjacent local files or infer a remote base.
+Relative paths cannot contain traversal, query strings, fragments, URL syntax,
+percent escapes or empty segments. Asset directories are served as static files;
+this is not a new arbitrary-URL proxy.
+
+## Formats and placement
+
+- **`geojson`:** a UTF-8 `FeatureCollection`, served as `application/geo+json` or
+  `application/json`. Each feature needs a unique string `id`. Point, LineString
+  and Polygon (including holes) are supported. Coordinates are WGS84
+  `[longitude, latitude, ellipsoidHeightMeters]`; missing height means zero,
+  which can be underground. Supply appropriate heights. Geometry properties
+  are ignored: they cannot select external icons, HTML, styling or scripts.
+  Placement is `{ "altitudeReference": "ellipsoid" }`.
+- **`image`:** PNG served as `image/png`, at most 4096×4096 pixels, checked before
+  decoding. Placement is `{ "bounds": [west, south, east, north], "height": 300,
+  "altitudeReference": "ellipsoid" }`. Bounds must increase and cannot cross
+  the dateline. The image is a horizontal geographic rectangle at that height.
+- **`media`:** MP4/WebM video or MPEG/Ogg/WAV/WebM audio, with the matching standard
+  MIME type. Placement is `{ "anchorId": "media-location" }`, referring to a
+  scene-local anchor with explicit ellipsoid height. A labelled marker locates
+  the media; an attribution card provides native, user-operated playback
+  controls. Media never autoplays. Codec support depends on the browser. D5 does
+  not synchronize media time with scene time or embed third-party players.
+
+Pack attribution always includes nonempty `text` and `license`; an optional
+HTTPS `url` opens as a source link with no opener/referrer. Importing or sharing
+an asset never changes its license. D5 adds no third-party content and preserves
+all existing Nepal content and contributor notices.
+
+Optional `byteLength` specifies the exact expected byte count; optional `sha256`
+is a lowercase hexadecimal SHA-256 digest checked before rendering. There are at
+most 8 packs per scene, 8 MiB per asset, and 32 MiB of selected assets per shot.
+GeoJSON additionally allows at most 2,000 features and 50,000 positions.
+Transforms, terrain-relative placement, terrain collision avoidance, arbitrary
+GeoJSON styles and archive extraction are not implemented. Explicit local files
+can be shared through [JSON asset bundles](DIRECTOR-SHARING.md).
+
+## Loading and resource ownership
+
+The `director` package export provides `createAssetDirectorySource` and
+`createDataPackSession`. The former receives an explicit trusted HTTP(S)
+directory `baseUrl` and optional `fetchImpl`; it confines every relative asset
+path to that directory. Cross-origin directories require CORS. Requests omit
+credentials and referrers, reject redirects, and use `cache: 'no-store'`.
+There is no persistent pack cache, offline fallback or silent substitute. A
+missing, invalid, oversized or integrity-mismatched asset fails the shot's pack
+load, removes partial results and reports a stable error without exposing a URL.
+Successful loading leaves the attribution cards visible with the assets.
+
+`createApplicationTools({ sceneDataPacks: { sources } })` and
+`new SceneDirector(viewer, style, data, { dataPacks: { sources } })` accept a
+registry of source functions. Each receives `{ path, signal, maxBytes }` and
+returns `{ bytes: Uint8Array, mimeType }`. Custom transports must honor the
+signal, bound reads and return the real MIME type. They remain application code,
+not scene document fields. Without registrations, referenced sources fail closed.
+
+The portable session receives format adapters separately. Each adapter receives
+`{ pack, asset, anchors, signal }` and returns a resource with an idempotent
+`dispose()`. Core's scene composition supplies Cesium geometry/image rendering
+and text-only attribution/native media controls. The session applies a 15-second
+load deadline and rejects late results, even when an adapter ignores abort.
+
+Stop, replacement, next-shot selection, scene release and destruction cancel
+pending work, remove owned entities/cards, stop media and revoke object URLs.
+Run completion releases packs with its run signal. Direct LOAD and seek retain
+packs until the next operation or Stop. Resources are reacquired per shot;
+there are no disabled pack refresh loops. `getDataPackState()` returns copied
+status and resource counts for lifecycle diagnostics.
+
+Run `node scripts/qa-director-packs.mjs` against a credentialed local server to
+exercise the real import/load/seek/Stop path with self-authored synthetic assets.
+See [actions](DIRECTOR-INTERACTIONS.md) and [authoring/sharing](DIRECTOR-SHARING.md)
+for the controls built on this manifest/loading boundary.

docs/DIRECTOR-INTERACTIONS.md

@@ -0,0 +1,66 @@
+# Director scene actions
+
+Version-6 scene documents can attach actions to stable GeoJSON feature IDs in a
+shot's selected data packs. Existing versions 1–5 migrate without adding actions.
+Import validates data and references; it does not load assets or execute actions.
+
+Add `interactions` to a shot, for example:
+
+```json
+{
+  "id": "read-outline",
+  "label": "About this outline",
+  "target": { "packId": "outline", "featureId": "boundary" },
+  "action": {
+    "type": "card",
+    "text": "An authored explanation, displayed as plain text.",
+    "url": "https://example.org/source"
+  }
+}
+```
+
+The target must be a feature in a GeoJSON pack selected by that shot. Points,
+lines and polygons retain stable pack/feature identities. Assets load before
+feature existence is checked; a missing feature refuses the entire action set.
+Images and native media are not interaction targets in this version.
+
+| Action | Fields | Behavior |
+| --- | --- | --- |
+| `card` | `text`, optional `url` | Show plain text and an optional HTTPS source link; never HTML |
+| `focus` | `anchorId` | Set a top-down camera pose at a scene anchor through camera ownership arbitration |
+| `shot` | `shotId` | Load another shot in the same scene at its authored start |
+| `layer` | `layerId`, boolean `enabled` | Request an explicit state through the ordinary layer admission path |
+
+There are at most 64 interactions per shot. Card text is limited to 4,096
+characters; source links cannot contain credentials, query strings or fragments.
+No script, module, arbitrary fetch endpoint or request header is accepted.
+
+Actions appear after LOAD or seek finishes. Click a pack feature to select its
+actions and focus the first button; choose a button explicitly to execute it.
+Tab traverses buttons and Enter/Space activates them. The selected buttons have
+visible outlines, and status feedback is announced to assistive technology.
+There are no global keyboard shortcuts to collide with navigation or typing.
+Drawing ownership blocks both pointer selection and action execution. Camera
+focus uses existing navigation admission, including Cockpit restrictions.
+
+Actions are inactive during automatic playback and camera travel. They do not
+introduce automatic branching or loops. A chain of user-triggered shot changes
+is limited to 64 transitions; an explicit LOAD starts a new chain. Import/Stop,
+replacement, playback and teardown remove selection, cards and picking handlers,
+and abort pending layer requests. No per-frame interaction loop runs.
+
+A layer action must name a layer with an explicit baseline in the current shot.
+A target shot must declare a baseline for every layer the departing shot can
+change. LOAD and seek reapply those baselines and clear selection. Stop cancels
+pending transitions; already completed layer changes remain visible, consistent
+with ordinary scene controls. Camera focus is an immediate anchor pose, not a
+new timeline segment; seek restores the authored camera pose. Scene JSON is not
+modified by executing an action.
+
+The portable interaction session owns action admission/cancellation. The scene
+interaction owner supplies accessible DOM and picking; pack renderers own the
+feature identities and release them with their geometry. Layer/source admission
+and camera arbitration remain with their existing owners.
+
+Author actions in scene JSON or the validated EDIT DETAILS draft.
+[Import preview and file sharing](DIRECTOR-SHARING.md) preserve those declarations. Existing content, assets, notices and contributor credit are preserved.

docs/DIRECTOR-SHARING.md

@@ -0,0 +1,96 @@
+# Director authoring and file sharing
+
+Open Scenes and select a scene and shot. Existing capture, update, playback and
+whole-project export controls remain available. Authored scene content, source
+links, assets and contributor credit are preserved.
+
+## Review imports before applying
+
+IMPORT accepts scene JSON (including older supported versions) or a
+`.gevbundle.json` asset bundle. A preview lists scenes, shots, data-pack attribution,
+configured or unavailable sources, missing layer IDs and bundled bytes. Preview
+makes no asset requests and does not change the current project. Configured
+sources do not guarantee that a file exists: ordinary assets are checked on LOAD.
+Bundle preview verifies the manifest and byte integrity; format decoding and
+geometry limits are still enforced when rendering.
+
+Apply replaces the current project after validation and playback cleanup. Export
+your current project first if you want to keep both. Cancel or Escape discards
+the staged import. A changed project invalidates an open draft rather than being
+overwritten. Invalid files leave the existing project and browser save intact.
+The programmatic `importProjectFile(file)` API still applies trusted callers'
+imports directly; the installed file chooser supplies the review step.
+
+## Edit scene details
+
+EDIT DETAILS provides validated JSON fields for:
+
+- Scene anchors and data-pack manifests.
+- The selected shot's camera, optional move, duration, hold, pack IDs and actions.
+
+Capture camera as anchor adds a named geographic position to the draft. Set move
+start to current camera creates a pose-to-pose move ending at the shot's existing
+camera; Use ordinary flight removes that explicit move. Heights are meters above
+the WGS84 ellipsoid. Apply details validates the complete project, preserves IDs,
+layer declarations and content notices, and keeps the selected shot. Cancel
+leaves the project unchanged. See [camera directions](DIRECTOR-CAMERA.md),
+[data packs](DIRECTOR-DATA-PACKS.md) and [actions](DIRECTOR-INTERACTIONS.md) for
+field definitions. This is a basic draft editor, not a node graph or path editor.
+
+## Share a selected scene
+
+SHARE SCENE exports only the selected scene. Download scene JSON preserves its
+camera, timing, layers, anchors, manifests, interactions and attribution, but
+contains no asset bytes. The recipient needs the referenced source registrations
+and files. Existing EXPORT PRESETS continues to export the entire project.
+
+For a bundle, select the declared pack files or a folder, then Download asset
+bundle. Folder paths match a manifest path either directly or after removing the
+chosen root directory. Individual filenames must be unambiguous across all pack
+sources; ambiguous or missing matches fail without downloading a partial bundle.
+Previously imported bundle files can be reused. Export never automatically fetches
+remote files or copies registered recipe media. Existing integrity declarations
+must match the files you supply.
+
+Bundles include only declared data-pack files. Registered scene content, linked
+media, map tiles and live data are not included. Source notices and licenses remain
+in the document; packaging a file does not grant permission to redistribute it.
+
+## Bundle format and limits
+
+A bundle is uncompressed JSON with these fields:
+
+```json
+{
+  "format": "gev-scene-bundle",
+  "version": 1,
+  "project": { "version": 6, "scenes": [] },
+  "assets": []
+}
+```
+
+Each asset contains `path`, `mimeType`, `base64` and lowercase hexadecimal `sha256`.
+Export copies the document and rewrites pack references to the reserved
+`scene-bundle` source, adding exact `byteLength` and `sha256`. Paths are confined
+relative names; URLs, traversal, duplicate or unreferenced assets, unknown fields,
+missing packs and mismatched hashes are rejected. Scene documents remain bounded
+at 5 MiB. A bundle allows 50 MiB of JSON, 64 files, 8 MiB per file and 32 MiB of
+asset bytes in total. Supported MIME types are JSON/GeoJSON, PNG, MP4/WebM video
+and MPEG/Ogg/WAV/WebM audio. Normal pack format and geometry checks still apply.
+There are no executable modules, request headers or credentials in the format.
+
+Imported bytes stay in memory for the current project and session. Stop releases
+rendered resources while retaining these bytes for replay. Project replacement
+or application teardown releases them. Only scene JSON is saved in browser
+storage: **reimport the bundle after reloading the app**. Missing bundle bytes
+fail explicitly, with no network fallback. This is file sharing, not a storage
+service or an offline basemap.
+
+Portable helpers are exported through `gods-eye-view/director`: `parseSceneShare`,
+`readSceneShare`, `createSceneBundle`, `createBundleAssets`, `describeSceneShare`,
+`editSceneDetails` and `selectSceneDocument`. Loading and UI remain separate owners.
+`getSharingState()` reports copied dialog/asset counts for lifecycle diagnostics.
+
+Run `node scripts/qa-director-sharing.mjs` against the local server for installed
+controls, cancellation, stale drafts, export/import round trips, resource cleanup
+and narrow-screen acceptance. Fixtures are synthetic and carry their own notices.

docs/DIRECTOR.md

@@ -0,0 +1,108 @@
+# Director: reusable scene playback
+
+Director is the scene playback system. Ordered shot execution, authored timing and playback clocks are separated
+from the scene editor and application rendering. This document
+records implemented camera directions, data packs, declarative interactions and
+file sharing, along with the remaining extensions.
+
+## Implemented boundary
+
+`src/director/playback.js`, exported as `gods-eye-view/director`, provides:
+
+- `buildPlaybackQueue(scenes, startSceneId, { single })`: ordered scenes/shots,
+  retaining the existing round-robin behavior.
+- `playSceneQueue(queue, { token, adapter, previousScene, releaseOnFinish })`:
+  sequential execution, cancellation checks and scene release.
+
+The runner imports no renderer, UI, storage, recipe or dataset. An adapter supplies
+these phases, in order: `selectShot`, `applyVisual`, `applyLayers`, `travel`,
+`settle`, `hold`, `completeShot`. Each receives `{ scene, shot, index, total,
+token }`. It also supplies `releaseScene(scene, token?)` and optionally `complete()`.
+Callbacks may return promises. Each playback invocation requires its own adapter
+state and token; the caller owns camera arbitration and concurrent-run refusal.
+
+The runner checks cancellation after each phase. Adapters must also pass the
+abort signal or liveness predicate into pending work: a check between phases
+cannot stop a camera flight or network request already in progress. Cleanup
+between scenes and on preview exit runs without an aborted token. A refused
+initial handoff starts no shot. Final cleanup runs on completion, Stop or failure;
+`releaseOnFinish: false` retains the final scene for ordinary playback. Exceptions
+propagate so the caller can restore its controls. Empty/already-cancelled queues
+acquire no resources. This low-level API expects normalized scene objects;
+untrusted file validation belongs at the import boundary.
+
+`src/scenes/playbackAdapter.js` connects this runner to the existing
+`SceneDirector`. The latter still owns editor state, saved-project import/export,
+camera ownership and asynchronous load/seek arbitration. Pure seek calculations
+live in `src/director/timeline.js`; `src/director/clock.js` owns the run/load/shot
+tickers, hold deadlines, snapshots and clock subscriptions. Stop settles pending
+holds immediately, and revoked tick callbacks cannot affect a replacement clock.
+`getPlaybackTimingState()` exposes copied snapshots and an active-timer count for
+lifecycle diagnostics without exposing timer handles.
+
+The `director` export also provides `sceneTimingForShot`, `sceneSeekState`,
+`cameraAtProgress` and `createPlaybackClock`. Timeline functions receive duration
+and hold resolvers; the clock receives timing, running-state and progress callbacks.
+They import no renderer, storage, recipe or dataset.
+
+`src/scenes/shotPresentation.js` prepares layer/seek context and resolves holds
+and map preferences through a scene-pack registry. The `scenes` export provides
+`createScenePackRegistry({ recipes, adapters })`; pass the result as `scenePacks`
+in the SceneDirector constructor options. Trusted adapters can supply
+`minimumHoldSec(states)`, `resolveVisual(shot, visual, isMapStackAvailable)` and
+`cancelMotion(getLayerModule)`. Default composition registers the existing Nepal
+presentation rules. These are code-level composition hooks, not executable
+modules imported from scene files. Existing media-owner waits remain bounded.
+
+All authored scenes, assets, IDs, source links, attribution and existing JSON
+projects are preserved. The Nepal sequence remains the contribution introduced
+by @manjunath22466 in #590. Its clips use source links/embeds; comparison images
+and river coordinates are bundled. See the
+[event pack provenance](../public/events/bhote-koshi-2026/README.md).
+
+## Next changes, in order
+
+1. **Timeline and content separation — implemented.** Pure duration/seek
+   calculations, an owned clock and registered presentation rules preserve
+   existing recipes and content. Tests cover direct load, forward/backward seek,
+   replay, bounded media waits and cancellation at pending transitions.
+2. **Versioned scene document — implemented for existing camera-pose shots.**
+   [The scene document](SCENE-DOCUMENT.md) preserves version-1/2/3 imports. Bounded validation
+   rejects malformed files before replacing current state; legacy migration
+   preserves IDs, pack bindings and visual edits. Unreadable saved files are
+   protected from fallback writes. Camera anchors, pack manifests and actions
+   receive stable IDs with their respective later format extensions.
+3. **Camera directions — implemented for pose-to-pose moves.**
+   [Version 4](DIRECTOR-CAMERA.md) adds scene-local geographic anchors, explicit
+   start/destination poses, easing, duration and holds. Playback and seek share
+   the same sampler. Ellipsoidal heights are explicit; terrain-relative input
+   is rejected. Existing shots retain ordinary flights. Basic anchor/move authoring is available through EDIT DETAILS; curved paths and
+   look-at targets remain later extensions.
+4. **Data packs and placement — implemented for bounded assets.**
+   [Version 5](DIRECTOR-DATA-PACKS.md) defines a pack manifest with format/version,
+   source, attribution/license and optional integrity/size metadata. It distinguishes
+   registered asset directories from geographic coordinates, image bounds and
+   media anchors. GeoJSON, PNG and native media adapters load with byte/time
+   limits and explicit ellipsoid heights. Stop and replacement release resources.
+   Paths resolve against a trusted directory base; missing/offline assets fail
+   explicitly. File bundles are available; transforms and terrain-relative placement
+   remain future extensions. Scene files carry no credentials or executable modules.
+5. **Declarative interactions — implemented.** [Version 6](DIRECTOR-INTERACTIONS.md)
+   connects selected feature IDs to accessible text/source cards, anchor focus,
+   shot seek and admitted layer changes. References are validated and pending
+   actions cancel on Stop, replacement or teardown. Scene files contain no
+   JavaScript or arbitrary HTML; actions require explicit user input.
+6. **Sharing and basic authoring — implemented.** [Authoring and sharing](DIRECTOR-SHARING.md)
+   adds import preview, missing-source/layer diagnostics, validated scene/shot
+   drafts and selected-scene JSON or explicit-file bundles. Pack attribution is
+   preserved. Bundle bytes last for the session and must be reimported after a
+   reload. A future node graph can author the same document without becoming a
+   playback or format requirement.
+
+Each step must preserve existing scene editing, keyboard playback, camera
+arbitration, layer cleanup, media timing and provider fallback. Acceptance includes
+portable runner tests, existing Director regressions and browser playback with
+Stop/seek/replay, plus tracking and voice checks. Use reproducible local fixtures
+for failures and cancellation, alongside live visual checks for actual content.
+
+Declarative actions are implemented in version 6; see [scene actions](DIRECTOR-INTERACTIONS.md) for supported targets, execution and reset semantics.

docs/INFRASTRUCTURE-LAYERS.md

@@ -36,7 +36,8 @@ const layers = createInfrastructureLayers({
 | `governorRequestRender` | `(reason)`; request a frame through the existing render scheduler |
 
 Each returned layer supports `init(viewer)`, `enable(viewer)`, `disable(viewer)`,
-`update(viewer)`, `destroy(viewer)`, `getStats()` and `getLodDiagnostics()`.
+`update(viewer)`, `destroy(viewer)`, `getStats()`, `getLodDiagnostics()` and
+`getAnalystRecords()`.
 Use the same viewer for the instance's entire lifetime. Each viewer/context/overlay
 host permits one live instance per layer ID; destroy an old instance before
 replacing it. Separate applications may use identical IDs with separate hosts.

docs/KNOWN-ISSUES.md

@@ -1,6 +1,6 @@
 # KNOWN ISSUES
 
-Updated: July 8, 2026
+Updated: September 22, 2026
 
 This file tracks active runtime issues only.
 
@@ -78,6 +78,56 @@ Status: Open (owner-accepted 2026-07-08, documented)
 
 ---
 
+### Weather layers: coverage and meaning
+Status: Open (source limits, by design)
+
+- **Rain radar covers the contiguous United States only.** It shows MRMS
+  reflectivity in dBZ, not rainfall rate or a forecast; a gap in coverage does not
+  mean no precipitation.
+- **Lightning density is a ground-network grid, not GLM flashes.** It is NOAA's
+  15-minute density product derived from Vaisala NLDN/GLD360 on an approximately
+  8 km grid, for the Americas and Pacific only (110°E across the dateline to 0°,
+  25°S–80°N). It is not a live strike counter or an all-clear.
+- **Cyclone advisories cover NOAA's basins only:** the Atlantic and the
+  eastern/central North Pacific (NHC and CPHC). Storms elsewhere do not appear.
+  The cone is forecast-center uncertainty, not storm size.
+- **Satellite clouds:** global infrared is hourly with typically 2–3 hours of
+  source latency. Clouds only is a brightness filter, not a cloud mask.
+- **Wind is a forecast.** The animation flows through one forecast on an
+  approximately 1° grid and does not advance forecast time or follow the
+  observed-history timeline.
+- **History is not shared.** Share links carry the weather layers and their
+  settings but open at Latest.
+- **3D Tiles detail window during history playback:** when a frame's detail image
+  is slow to arrive, the window may fall back to the coarser full-extent image
+  until it does.
+- Native hardware GPU behavior of the wind and weather renderers is not yet
+  verified.
+
+---
+
+### Satellite passes and analyst answers
+Status: Open (by design)
+
+- Pass predictions search the next 24 hours for satellites in the loaded catalog.
+  Visibility is a geometric estimate (satellite sunlit, observer's Sun at or
+  below −6°); it ignores weather, satellite brightness and orbital-element age.
+- Analyst counts and ranks cover a bounded set of loaded records (by default
+  2,000 per layer for satellites, datacenters and dams), so omitted records can
+  change a nearest or count answer. Satellite distance is ground distance.
+
+---
+
+### Live camera video (HLS)
+Status: Open (limits)
+
+- At most two live-video sessions run at once. RTMP-only sources and encrypted,
+  fMP4 or byte-range playlists are not supported.
+- When live video fails, the camera falls back to its labeled still, Street View
+  or placeholder frame, which is not live video.
+
+---
+
 ## Closed / Intentional (for clarity)
 
 ### Proxy SSRF and error-surface hardening gaps
@@ -118,5 +168,14 @@ Context:
   converted to **live NASA FIRMS data** on 2026-07-16: the `/api/firms` proxy merges
   three VIIRS NRT sources (trailing 24 h, 30 min cache, serve-stale-on-failure) and the
   bundled snapshot was deleted. Requires a free server-side `FIRMS_MAP_KEY`; without it
-  the layer shows a KEY REQUIRED state.
-- Weather radar is still held out of OSS v1 after QA found the previous overlay did not provide reliable visible value.
+  the layer row reads "Needs FIRMS_MAP_KEY — add it in Provider Settings".
+
+---
+
+### Weather radar held out of the open-source release
+Status: Closed — observed rain radar shipped (September 2026)
+
+Context:
+- Rain radar, Satellite clouds, Lightning density, Wind and Cyclone advisories
+  are in the Weather group of Data Layers. Their current limits are listed under
+  "Weather layers: coverage and meaning" above.

docs/LOCAL-RECEIVERS.md

@@ -0,0 +1,82 @@
+# Local receivers
+
+The Local ADS-B layer draws aircraft heard by your own receivers. It has two
+inputs, and it can use both at once.
+
+| Input        | What it is                                                                                                                          | Bands                |
+| ------------ | ----------------------------------------------------------------------------------------------------------------------------------- | -------------------- |
+| Browser SDR  | A USB RTL-SDR opened by the browser through WebUSB (Radio panel, Local RTL-SDR card). Decoding runs in the page.                   | 1090 MHz             |
+| Decoder feed | The `aircraft.json` served by a decoder you run: dump1090-fa, readsb or tar1090 (1090 MHz), or dump978-fa + skyaware978 (978 MHz). | 1090 MHz, 978 MHz UAT |
+
+Aircraft from both inputs are merged by ICAO address. The newest position
+wins, and the click card names every band and source that heard the aircraft
+in the last 60 s. Aircraft heard only on 978 MHz UAT draw with a thin ring.
+
+Local aircraft usually lead their public twins. The public Flights layer
+renders positions about one poll interval (~30 s) behind so it can interpolate
+smoothly between fixes, while local receiver aircraft are shown as heard. An
+aircraft in both layers therefore draws twice, the magenta local marker ahead
+of the public one; both markers are drawn on purpose.
+
+## Which to use
+
+- **One plain RTL-SDR dongle, desktop Chrome or Edge:** use the browser SDR.
+  Nothing else to install.
+- **A dual-band board, a Raspberry Pi feeder, or a dongle already used by a
+  decoder:** use a decoder feed. A USB dongle can be opened by only one program
+  at a time, so a dongle that dump1090 or dump978 owns cannot also be opened by
+  the browser.
+
+## Configuring feeds
+
+Feeds are set in the server environment only (`.env`), never in the browser:
+
+```sh
+LOCAL_RECEIVER_FEEDS=1090=http://localhost:8080/data/aircraft.json,978=http://localhost:8978/data/aircraft.json
+```
+
+Each entry is `band=url`, where `band` is `1090` or `978`. The URL must:
+
+- use `http` or `https`;
+- point at loopback, a private (RFC1918) address, `localhost` or a `*.local`
+  name. Public addresses, link-local addresses (including `169.254.169.254`),
+  IPv6 and other host names are refused;
+- have a path ending in `aircraft.json`, with no credentials, query or
+  fragment.
+
+An entry that breaks a rule is logged when the server starts, shown as
+`invalid` and never fetched. Restart the server after changing the value.
+
+The server reads every feed about once a second while the Local ADS-B layer is
+on. A feed is `live`, `stale` (its own `now` is more than 10 s old, usually a
+stopped decoder), `unreachable` or `invalid`. The Layers panel row and the
+Local RTL-SDR card show these states.
+
+## Example: dump1090-fa and dump978-fa on macOS or Linux
+
+Write each decoder's JSON to a directory, then serve the directory on
+localhost. Each command keeps running, so start each in its own terminal:
+
+```sh
+# 1090 MHz
+dump1090-fa --device-index 0 --write-json /tmp/adsb1090
+python3 -m http.server 8080 --bind 127.0.0.1 --directory /tmp/adsb1090
+
+# 978 MHz UAT: dump978-fa decodes, skyaware978 writes aircraft.json
+dump978-fa --sdr driver=rtlsdr,rtl=1 --raw-port 30978
+skyaware978 --connect localhost:30978 --json-dir /tmp/adsb978
+python3 -m http.server 8978 --bind 127.0.0.1 --directory /tmp/adsb978
+```
+
+```sh
+LOCAL_RECEIVER_FEEDS=1090=http://localhost:8080/aircraft.json,978=http://localhost:8978/aircraft.json
+```
+
+A board with two identical-serial channels, such as the Nooelec FlyCatcher,
+cannot be told apart by serial number. Select each channel by index:
+`--device-index <n>` for dump1090-fa and `--sdr driver=rtlsdr,rtl=<n>` for
+dump978-fa. `rtl_test` lists the indexes.
+
+A tar1090 or readsb install on a Raspberry Pi already serves
+`http://<pi-address>/tar1090/data/aircraft.json`. Use the Pi's private address
+or its `.local` name.

docs/SCENE-DOCUMENT.md

@@ -0,0 +1,105 @@
+# Scene document format
+
+Scenes exports a UTF-8 JSON project. Version 5 adds [data packs](DIRECTOR-DATA-PACKS.md)
+and is the write format. Versions 1, 2, 3, 4 and unversioned legacy files migrate on
+import without converting their existing shots into authored moves. Unknown versions or unsupported fields are rejected with
+a field path before the current project, selection or saved bytes change.
+
+```json
+{
+  "version": 5,
+  "scenes": [{
+    "id": "my-scene",
+    "title": "My scene",
+    "shots": [{
+      "id": "my-shot",
+      "title": "Arrival",
+      "durationSec": 4,
+      "holdSec": 1,
+      "camera": { "lat": 51.5, "lon": -0.12, "alt": 800,
+        "heading": 0, "pitch": -35, "roll": 0 },
+      "visual": { "style": "normal" },
+      "layers": { "traffic": { "enabled": true } }
+    }]
+  }]
+}
+```
+
+## Fields and migration
+
+The root requires `scenes` (an array, which may be empty). Optional root fields
+are `version`, `createdAt`, `updatedAt` and `installedBuiltInSceneIds` (string IDs).
+Each scene requires a `shots` array; optional fields are `id`, `title`,
+`releaseLayerIds`, `appliedShotPacks` and version-4 `anchors`. A pack marker has `id`, optional numeric
+`version` and `shotBindings` (original shot title to saved shot ID). These markers
+retain the editor's existing pack-update and rename behavior.
+
+Shots accept `id`, `title`, `durationSec`, `holdSec`, `camera`, `visual`, `layers`,
+`sourcePackId`, `sourcePackVersion` and version-4 `move`. Scene IDs are unique within the project;
+shot IDs are unique within their scene. Existing IDs and pack bindings survive
+migration. Missing IDs are generated once and persisted by the next save/export.
+Missing titles and optional camera/visual fields receive the editor's defaults.
+Empty scenes and intentionally empty projects remain empty.
+
+Camera latitude/longitude and heading/pitch/roll use degrees. Altitude uses
+meters above the WGS84 ellipsoid. Import preserves finite heights below
+100 meters and zero pitch, which previously fell through to defaults. Anchors and explicit moves require the `ellipsoid` altitude reference;
+terrain-relative inputs are rejected. See the camera contract for exact semantics.
+Flight durations retain the editor's minimum of 0.2 seconds and its 4-second
+fallback for zero; holds may be zero.
+
+Visual fields are `style`, `mapStack`, `styleParams`, `bloom`, `sharpen`, `hud`, and
+`detection`, and `scope`. Bloom has `enabled`, `intensity`, `version`; sharpen has `enabled`,
+`intensity`; HUD has `visible`, `variant`; detection has `mode`, `density`,
+`allocation`, `fadePct` and `outsideOpacityPct`. Scope has `enabled`, `featherPct`.
+The latter settings were written by Update Shot but previously lost during
+normalization; they now survive import and capture.
+Version-1/2 bloom without an explicit scale version uses the original inverted
+scale and migrates once to scale 2. The scene document and bloom scale versions
+are separate. Legacy numeric strings are accepted for numeric fields.
+
+Layer entries accept a boolean shorthand or `{ "enabled": true, "params": {} }`.
+Parameters and style parameters retain nested JSON data. They are interpreted by
+already registered components; importing a file does not fetch its URLs, register
+modules, evaluate code or apply its layers. Unsupported structural fields are
+rejected instead of silently dropping potential edits. Map-stack selection
+retains the existing registered-stack behavior.
+
+## Validation limits
+
+`gods-eye-view/director` exports `parseSceneDocument(text)`,
+`validateSceneDocument(project)`, `stringifySceneDocument(project)`,
+`SceneDocumentError`, `SCENE_DOCUMENT_VERSION` and `SCENE_DOCUMENT_LIMITS`.
+Validation is independent of the renderer, storage and recipes. Parsing checks
+UTF-8 size before JSON decoding; the file importer also checks file size before
+reading it. Migration/defaults live separately in `src/scenes/project.js`.
+
+Limits are 5 MiB, 256 scenes, 10,000 total shots, 10,000 entries per collection,
+24 levels of nesting, 200,000 visited values, 65,536 characters per JSON string,
+256 characters per field/ID, and 4,096 characters per title. Numeric values must
+be finite. Camera limits are latitude ±90, longitude ±180, altitude −12,000 to
+1 billion meters, heading/roll ±360 and pitch ±90; durations/holds are at most
+86,400 seconds. Post-processing values are bounded and normalized to the existing
+slider ranges. Object prototype keys are refused at every depth.
+
+An invalid import leaves the current project and playback untouched. A valid
+import cancels and settles pending playback before replacing the project. If
+multiple files are read concurrently, only the newest request can replace it.
+Disposal prevents a pending import from publishing.
+
+The browser storage key remains `godsEyeView.sceneProject.v2` for compatibility;
+that key's suffix is not the document version. An unreadable saved project stays
+in storage. The app supplies temporary defaults and a visible warning, but blocks
+saving over the original bytes until a valid file is explicitly imported. Export
+can preserve temporary edits. Storage writes use the same validation before replacing saved bytes; invalid
+edits and storage write failures surface an unsaved toast.
+
+Only authored project fields belong in this file. Runtime clocks, camera flights,
+loading progress and run diagnostics remain separate. Camera anchors and authored
+moves arrived in version 4; data packs follow in version 5. Declarative
+interactions remain a planned extension. No scene assets, source links, licenses or contributor attribution
+change with this document boundary.
+
+Version 5 additionally accepts scene `dataPacks` and shot `dataPackIds`, as
+defined in [data packs](DIRECTOR-DATA-PACKS.md). Version-4 camera documents
+continue to import without adding any packs.

docs/UI-OWNERSHIP.md

@@ -0,0 +1,35 @@
+# Application UI ownership
+
+`src/ui/applicationShell.js` constructs controls, connects their explicit inputs
+and coordinates shutdown. `shellFacade.js` preserves the methods used by layers,
+scene playback and voice. It delegates; new behavior belongs with its owner.
+
+| Owner | Responsibility |
+| --- | --- |
+| `navigationController.js` | Navigation generation, tracking release and camera authority |
+| `locationNavigation.js` | Destination lookup/selection, orbit, world jumps and globe-reset completion |
+| `cockpitCoordinator.js` | Cockpit entry/rollback, readouts and the single Display portal |
+| `visualSettings.js` | Effects, detection overrides, visual restoration and render-loop lifetime |
+| `panelChrome.js` | Disclosure, docking, layout and Cockpit panel restoration |
+| `aircraftDisplay.js` | Shared commercial/military 3D display preferences and controls |
+| `layerBindings.js` | Data-manager attachment, selected-tracker adoption and camera-entry listeners |
+| `displayBindings.js` | Keyboard/display subscriptions and frame-rate monitor lifetime |
+| `shareRestoration.js` | Initial share/layer restoration and cancellation |
+| `shellFeedback.js` | Loading feedback, notices and toast lifetime |
+
+Owners receive named services, elements, operations and readers. They do not
+receive the application shell itself. Readers resolve a replaceable collaborator
+at use time; operations cross an ownership boundary without copying its state.
+The facade exposes existing properties as delegates rather than duplicate state.
+
+Shutdown has two phases. First revoke input, deferred navigation, camera-entry
+listeners, lookups, timers and rendering work. Then await Context restoration,
+release sensor overrides while the manager is still attached, detach layer
+services and destroy scene resources. Late callbacks cannot acquire the camera.
+Manager replacement also releases subscriptions and the previous Directions
+module even if the replacement does not provide a Directions layer.
+
+Source-contract tests follow both sides of delegated wiring. Lifecycle tests
+exercise pending reset cancellation, stale camera callbacks, replacement and
+idempotent teardown. Browser acceptance covers the composed application, including
+share restoration, scene commands, navigation, Cockpit, display and voice.

docs/VOICE-OWNERSHIP.md

@@ -0,0 +1,48 @@
+# Realtime voice ownership
+
+`realtimeController.js` composes the session and owns its status, UI bindings and
+overall lifetime. It coordinates startup and shutdown. `realtimeFacade.js`
+preserves existing methods and properties by delegation, without copying state.
+The session adapter, action runner and backend interfaces remain unchanged.
+
+| Owner | State and responsibility |
+| --- | --- |
+| `realtimeConnection.js` | Start generation, request cancellation, peer/data channel, acquired microphone stream and playback element |
+| `realtimeTurns.js` | Active and superseded responses, pending confirmations, deduplicated calls and action cancellation |
+| `realtimeRadio.js` | Speaker ducking, prepared playback, stronger-action reservations and playback observers |
+| `realtimeInput.js` | Physical Space gesture, microphone mute, input/output meters and their frame/listener lifetime |
+| `realtimeCost.js` | Next-session preferences and the current session's model-bound meter |
+| `realtimeViewport.js` | One retained image, bounded deletion identities and capture generation |
+| `realtimeDiagnostics.js` | Bounded error history and sanitized optional diagnostics |
+
+Pure input policy, preferences and protocol-response policy have separate modules.
+Owners receive named readers, operations or focused collaborators. Cross-owner
+cancellation uses operations; response handling does not own Radio's reservations
+or viewport deletion bookkeeping.
+
+Shutdown first invalidates acquisition and action work, then closes transport,
+stops audio analysis, releases media and clears conversation/input state. Full
+removal also detaches UI, keyboard, annotation and Radio observers. Radio takeover
+retains confirmed playback through that same shutdown path. A late offer, peer callback,
+viewport capture or cancelled meter frame cannot enter a replacement session.
+Action and post-capture continuations retain their conversation identity before
+publishing output, queueing a response or changing status.
+
+Behavioral invariants remain in force: a 500 ms Space hold claims push-to-talk;
+short control taps and text entry remain native; a click-started session stays
+open-mic. Every accepted or refused tool call receives its terminal output once.
+New typed input supersedes old intent. Radio waits for the spoken confirmation and
+verified muted playback. A live cost meter stays bound to its negotiated model,
+even when the next-session preference changes.
+
+Run the unit suite and both live recorded-audio modes against a configured local
+server:
+
+```sh
+node scripts/qa-voice-wav.mjs http://localhost:4173
+node scripts/qa-voice-wav.mjs http://localhost:4173 --push-to-talk
+```
+
+The second mode uses the actual Space shortcut, verifies microphone acquisition
+and release, and checks the same globe/Radio outcome. Tracking and scene-control
+acceptance exercise voice's shared application operations separately.