Merge remote-tracking branch 'upstream/main' into fix/houston-cctv-pack

2026-11-04 10:24:02 +00:00 · 2026-10-30 19:00:31 -07:00
commit 78ebb7ae1f
@@ -259,6 +259,8 @@ AISSTREAM_API_KEY=
 # CCTV_HOUSTON_ENABLED=                                 # set to 1 to opt in; off by default (TranStar terms)
 # CCTV_HOUSTON_MAX_SOURCES=250                         # cap cameras loaded from the Houston TranStar catalog (nearest metro cores first)
 # CCTV_HOUSTON_CAMERAS_URL=                            # override the Houston TranStar catalog URL
 # CCTV_A22_ENABLED=1                                   # set 0 to disable the Autostrada del Brennero (A22, Italy) webcams
 # CCTV_A22_URL=                                        # override the Open Data Hub A22 webcam catalog URL
 # CCTV_MAX_SOURCES=4000                                # catalog-wide ceiling, shared round-robin across packs
 # CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
 # CCTV_FORCE_AUSTIN=                                   # force live default sources when a source-pack JSON is configured
@@ -1,5 +1,692 @@
 # Changelog
 ## [Unreleased]
 ## [0.3.0] — 2026-10-27 — Street Level, On Your Phone, in Your Language
 - Show a Street Level view facing 359.5° or more as 0°. The viewer caption
  rounded the bearing without wrapping, so a view facing 359.6° read "360°"
  (Aditya, @Rohilalala, #1431).
 - The visual styles and their presets mark their labels with the catalog-free
  `msg()`, so the share-link codec, and any server that loads it, no longer
  bundles every translation catalog (about 0.9 MB) (samehkhamis, #1421).
 - Keep a location search that found nothing, or failed, in the field so it can
  be corrected: the query stays, focused and selected, and a persistent
  announced message under the search row says what to do next, instead of a
  toast followed by a cleared and closed field (samehkhamis, #1420).
 - Hosts can read share links on their server: the share-link codec and the
  `/share/<code>` address helpers are now package exports,
  `@gods-eye-view/core/share/view-codec` and `@gods-eye-view/core/share/link-path`
  (samehkhamis, #1419).
 - Share links are now short: the share button makes `/share/<code>` links
  that open on any copy of the app, follow the aircraft, military aircraft or
  satellite you were following, and fall back to its last-known position with
  a notice if it isn't reporting. A mistyped link is refused instead of
  opening a different view. Long `#v=2` links keep working (samehkhamis, #1418).
 - Make Clear All clear the saved and shared layer selection. Layers that a
  context mode had already switched off no longer stay in the share link and
  come back on reload (samehkhamis, #1417).
 - Restore a share link opened in an already-open tab. Pasting a link into the
  address bar, following one, or using Back/Forward now moves the camera and
  restores the style, map, panels and layers instead of changing only the URL
  (samehkhamis, #1416).
 - Add a Scope checkbox and extend feathering to 200%, retaining scope settings
  across HUD layouts, share links and scenes. First run opens with Scope ON at
  100% feather; explicit settings and historical links retain their values. Give
  Tactical, Operator and Minimal text black backplates only when Scope is OFF,
  including vertical metadata, without changing the original HUD text color, glow or
  opacity. Scope ON retains its original HUD presentation (bilawalsidhu, #1410).
  Keep title and tagline positions stable when toggling Scope, include the eye
  in the title backing, and brighten the two secondary labels only with Scope OFF.
 - Remove four modules nothing in the app imports: `src/app/sourceSlot.js`,
  `src/data/flowTiles.js`, `src/data/issPass.js` and `src/data/localGeojson.js`.
  The local GeoJSON layer tests now build layers the way the catalog does, so
  they keep covering `localGeojsonCore.js`. Package exports are unchanged
  (samehkhamis, #1403).
 - Aircraft on the ground keep getting ground-height samples after the
  computer's clock steps back, instead of waiting for it to catch up
  (quanticsoul4772, #1399).
 - The Sharpen slider at 0 now turns the sharpen pass off instead of still
  sharpening at a low amount (quanticsoul4772, #1398).
 - Show a locally heard aircraft tracking 359.5° or more as TRK 0°. The Local
  ADS-B card rounded the track without wrapping, so 359.7° read "TRK 360°"
  (Rudy Celekli, @rudycelekli, #1396).
 - Report a fire detection's acquisition time as a UTC timestamp in
  `get_active_fires`. The tool joined FIRMS's unpadded date and time, so a
  00:45 UTC detection read "2026-01-01 45"; it now reads
  `2026-01-01T00:45:00.000Z`. Missing or invalid dates and times remain
  unknown rather than rolling into another calendar day
  (Rudy Celekli, @rudycelekli, #1395).
 - Report Docker container health with a local HTTP check using Node, with the
  same port parsing as the launcher (John Rogers, @14traits, #1394).
 - Start the Docker install on SELinux hosts such as Fedora and RHEL. Compose now
  mounts the checkout with `:z`; without it the container could not read `/app`
  and stopped with "Cannot find module '/app/scripts/docker-start.mjs'"
  (Anıl Güvenç, @anilguvenc, #1391).
 - Render awareness-overlay bearings and courses that round through north as
  `000°`, rather than `360°` (Rudy Celekli, #1390).
 - Show cockpit wind from 359.5° or more as 0°, not 360°. Rounding 359.6°
  printed "N · 360°" on the local wind direction
  (Rudy Celekli, @rudycelekli, #1389).
 - Show a drawn line of 999.5 m or more as 1.0 km. The draw hint kept metres
  below 1000, then rounded 999.6 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1388).
 - Show a Contacts entry 999.5 m or more away as 1.0 km. The panel kept meters
  below 1000, then rounded 999.6 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1387).
 - Show a route leg of 995 m or more as 1.0 km. The route summary and step
  cards kept meters below 1000, then rounded 996 m up to "1000 m"
  (Rudy Celekli, @rudycelekli, #1386).
 - Show a route leg of 59.5 seconds or more as 1 min. The route summary and step
  cards kept seconds below 60, then rounded 59.6 s up to "60 s"
  (Rudy Celekli, @rudycelekli, #1385).
 - The HUD's AI place summary drops a reply that arrives after the camera has
  started moving, so a summary asked for before a flight no longer names the
  old place mid-flight. Cancelled or partially typed summaries retry even if the place
  context stays the same (quanticsoul4772, #1384).
 - Reduce repeated work in aircraft detection candidates by caching unchanged
  callsign/registration text and reusing resolved fleet models. Metadata updates,
  live positions and tracked-aircraft/model handoffs remain immediate
  (samehkhamis, #1379).
 - Increase touch-first globe zoom sensitivity to three times the default while
  retaining Cesium collision and distance limits.
 - Reuse one delayed display timestamp per civil-aircraft fleet update and cache
  extrapolation coordinate frames until their fix coordinates change. Preserve
  contact counts, movement cadence, tracked motion and ground corrections.
 - Turning a layer off frees the memory its entities held. Cesium kept
  removed layers' draw commands in reused per-pass arrays, so Data Centers
  kept 116 MiB after it was switched off, submarine cables 74 MiB and dams
  30 MiB; they now keep 13, 9 and 9 MiB (quanticsoul4772, #1367).
 - Aircraft 3D models (Flights, Military Flights, Local ADS-B) skip Cesium's
  dynamic environment map, a sky render and GPU readback per model. With
  ~150 models in the scene at Atlanta on Google 3D, GPU time per frame at
  rest falls from 14.3-14.8 ms to 12.1-12.5 ms; a same-model comparison
  showed no visible change (quanticsoul4772, #1366).
 - Drop the decimal when fire radiative power rounds to 10 MW. A 9.96 MW
  detection was labeled 10.0 MW because the one-decimal cutoff ran before
  rounding (Rudy Celekli, @rudycelekli, #1354).
 - Count a transit report that is 90 seconds old as one minute. The card kept
  seconds through 89s, then rounded 90s up to "Reported 2 min ago"
  (Rudy Celekli, @rudycelekli, #1353).
 - Read a destination heading that rounds to north as 000. 359.6° was shown as
  360° on the destination bearing while the compass tape already uses 000
  (Rudy Celekli, @rudycelekli, #1352).
 - Keep a tracked vessel's speed, course, heading and fix time when AISStream
  static data arrives; the static message only merges name, type, destination
  and IMO (rudycelekli, #1351).
 - Apply changed static metadata immediately, retaining known fields when a
  later static report omits them, without refreshing the vessel's position
  (samehkhamis, #1351).
 - Convert NHC cyclone movement speed from miles per hour to knots, so
  `movement.speedKt` in cyclone query results is no longer about 15% high
  (rudycelekli, #1350).
 - Label NHC cyclone classifications by their published meanings: `PTC` is a
  post-tropical cyclone, `PC` a potential tropical cyclone, and subtropical
  systems arrive as `STS` and `STD` (rudycelekli, #1349).
 - Wake staged weather imagery on a 150 ms timer while waiting for readiness,
  avoiding a continuous render loop and cancelling the wake when work ends
  (@nu-stats, #1345).
 - Phrase slight and sharp ramps as directions, so a ramp reads "slightly left"
  instead of "on the slightly left", and a lane names its side in both
  the proxy response and localized browser instructions
  (Rudy Celekli, @rudycelekli, #1343).
 - Keep an impossible wildfire acquisition date off the detection clock, so a
  fire is not labeled with a later day it did not happen
  (Rudy Celekli, @rudycelekli, #1342).
 - Reject impossible KartaView photo timestamps, so 31 February is unknown
  instead of rolling forward into March and passing the imagery date filter
  (Rudy Celekli, @rudycelekli, #1341).
 - Read a hemisphere letter that is separated from its number, so a search for
  `40.7128 N 74.0060 W` flies there instead of falling through to the geocoders
  (Rudy Celekli, @rudycelekli, #1340).
 - Carry HUD LAT/LON seconds that round up to 60.00" into the minutes and
  degrees, so longitude -122.35 reads `122°21'00.00"W` instead of
  `122°20'60.00"W` (rudycelekli, #1339).
 - Improve touch selection of aircraft and vessels through the shared contact
  picker, reveal tracked aircraft details when opening Context, support downward
  swipe dismissal of phone drawers while preserving scrolling and controls, and
  enlarge the phone logo (samehkhamis, #1338).
 - Evict terrain-height cache entries in fetch-time order without repeatedly
  sorting the full cache, while keeping refreshed points newest and ordering
  restored entries by their fetch time (daikaginza, #1326).
 - Add a phone layout for viewports 720px and narrower: the globe stays full
  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
  panel sheet at a time, keeping attribution visible and scene STOP reachable.
  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).
 - Export the KartaView and Panoramax Street Level providers, so a host composing
  its own provider list can offer the keyless providers without Mapillary
  (samehkhamis, #1324).
 - A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
  token itself (such as a same-origin proxy). Its sequence lookups go there
  through the source's transport, and the photo viewer uses MapillaryJS's
  Graph provider at that endpoint, so no client token is needed in the page
  (samehkhamis, #1324).
 - Remove dead code across the repository: three modules nothing imports
  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
  and locals nothing reads, a duplicate copy of the bundled dams data and an
  unused ship model. The app no longer builds an unused default wind layer
  and Bhote Koshi locator layer when it loads. Package exports are unchanged
  (samehkhamis, #1321).
 - Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).
 - Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
  while Radio and Cyber supply explicit field palettes without changing the
  current appearance or native control behavior (mazy1998, #1309).
 - Share read-only status badge presentation across CCTV source/frame labels,
  calibration provenance and Weather coverage, preserving status meanings,
  palettes, translations and announcements while preparing the view contract
  for a future Vue migration (mazy1998, #1306).
 - Share native dropdown and numeric-field styling across Scene, CCTV, Display
  and Radio controls, with a shared CCTV number-input builder that preserves
  existing precision, validation and commit behavior (mazy1998, #1305).
 - Point distances wrap longitude differences across the antimeridian, in voice
  proximity checks and `places_nearby` (quanticsoul4772, #1304).
 - `get_wind` flags stale forecasts (`stale`) when the wind proxy serves a
  cached model run (quanticsoul4772, #1303).
 - Give ordinary Scene and CCTV actions shared native buttons with consistent
  default, destructive and compact styling while preserving their existing
  behavior and specialized controls (mazy1998, #1302).
 - Unify segmented selectors for model coverage, detection allocation, drawing
  shape, Street View and imagery comparison while preserving their existing
  behavior. Keep compact labels such as FILL and FLAT on one line, and let
  collapsed Weather release space to the open rail panel. Reserve the full mode
  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).
 - Add a shared Voice Preview and Settings panel with browser-local preferences,
  inactivity controls and accessible floating provider controls on compact layouts;
  recover inactivity after confirmed audio-less replies, release retired audio
  observers and keep cost warnings visible outside Settings
  (manjunath22466, #1299).
 - Add Simplified Chinese (zh-CN) to the language picker, with localized dates
  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
  and @EDIT-Aeterna (#979).
  (German, @gekh, #1298).
 - Add the S2 GhostMaps layer: S2 Underground's public KMZ intel products
  (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran
  and Yemen products and the newest incident drop) from
  github.com/s2underground/GhostMaps, with one chip per product and report
  cards on click. `/api/ghostmaps` watches the repository's branch head every
  15 s and pushes each new commit to open pages, which reload only the
  products that changed (Black Pine Defense).
 - Clear a temporary GhostMaps upstream error and notify open pages when the
  repository becomes reachable again, including when no new edition was published.
 - Release packed-image resources when a load is cancelled or fails, respect
  injected or omitted GhostMaps sources, and wait for background cache warm-up
  before removing provider test fixtures.
 - Include Simplified Chinese translations and keep the combined voice prompt
  within its existing size limit while retaining all spoken aliases.
 - A Street Level provider whose `zoomFor` still answers `{zoom, kind}`, the
  shape before the core went slim, draws its lines again instead of a silent
  blank; an overview level or any answer that is not a whole zoom shows the
  zoom-in hint (asturksever, #1288).
 - Give ordinary sliders a shared native control and consistent track, thumb,
  value, focus and disabled styling while preserving feature behavior and
  specialized controls (mazy1998, #1287).
 - The Street Level SINCE note sits on the value's line, in its type and a
  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
  had lost its size variable in the Street Level slim-down and rendered
  larger than the value, on a line of its own (asturksever, #1286).
 - Keep aircraft route labels on the scheduled airport leg instead of accepting
  its distant great-circle extensions, preserving generous endpoint tolerance
  across the signed-angle branch cut (rudycelekli, #1284).
 - Report cached CelesTrak satellite records as stale in the Data Layers row,
  preserving separate core and dense catalog provenance through refresh,
  removal and lifecycle cleanup (rudycelekli, #1283).
 - Pause periodic network updates in hidden tabs; the overdue update on return restarts the polling schedule, so the next poll follows one interval later even when that update fails (asturksever, #1282).
 - Report and guard browser visibility during Transit QA so hidden-page polling pauses cannot masquerade as playback regressions (asturksever, #1282).
 - Require each live city to supply its own feed vehicles in Transit QA; retained vehicles cannot qualify another city (asturksever, #1282).
 - Bound the Transit card-anchor probe by observed poll coverage instead of a fixed 20-second window (asturksever, #1282).
 - Keep visible-page Transit probes focused through the browser testing API (asturksever, #1282).
 - Add a real-browser regression gate for hidden-tab periodic work, explicit refresh, resume and teardown (asturksever, #1282).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1282).
 - Hold rendering only for animated content (asturksever, #1281).
 - Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
 - Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
 - Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
 - Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
 - Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
 - Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).
 - Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).
 - Reserve singleflight before disk cache reads (asturksever, #1278).
 - Bound each height request to one upstream chunk (asturksever, #1276).
 - Preserve enable during first-load replacement (asturksever, #1275).
 - Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
 - Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).
 - Scan the kml root delimiter in bounded time (asturksever, #1274).
 - Retire unavailable history and keep local trails (asturksever, #1273).
 - Normalize geocoder bias across the antimeridian (asturksever, #1272).
 - Reject inherited style keys during restore (asturksever, #1271).
 - Respect provider cooldowns and bound tle groups (asturksever, #1270).
 - Coalesce refreshes and cool down opensky failures (asturksever, #1269).
 - Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
 - Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).
 - Honor Docker Compose trusted-peer and allowed-host settings from the shell
  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
  access to Provider Settings before Vite starts (asturksever, #1265).
 - Prevent malformed Overpass filters from blocking the local server, and reject
  cross-site or excessive query requests before reading their bodies
  (asturksever, #1264; fixes #1248).
 - Release unread responses from the optional Google-token probe so keyless
  browser validation can settle; the Overpass gate recognizes only that probe's
  expected 404 as an unavailable capability (asturksever, #1264).
 - Make tracking arrival checks respect the aircraft update cadence while checking
  orientation on the first reveal, avoiding false failures at faster render
  rates (asturksever, #1264).
 - The terrain-heights bounds tests no longer read the checkout's
  `.gev-cache/terrain-heights.json`. Each test gets a cache file of its own, so
  `npm test` no longer fails after the dev server has cached terrain near
  Austin (KnottyDyes, #1244).
 - Replace the blocky JPEG sky around the globe with the 9,096 stars of the
  Yale Bright Star Catalogue, drawn as sharp points where they are at the
  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
  #1243).
 - `get_traffic_flow` flags stale cached TomTom tiles and reports the oldest
  tile fetch time (`stale`, `oldest_tile_at`), with pending freshness metadata
  released on failed or cancelled tile reads (quanticsoul4772, #1239).
 - Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
  with on-demand snapshots and attribution. No API key is required; set
  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).
 - Require a geocoded containment anchor for ambiguous analyst region names,
  preserve boundary provenance and cancellation safety, and retain exact-name
  precedence for natural outlines (manjunath22466, #1235).
 - Serve the camera catalog while it refreshes. An expired catalog made every
  camera request wait for the slowest pack to reload; it is now answered at
  once while one background refresh runs, so only the first load waits. Estonia's
  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
  on about a third of loads (quanticsoul4772, #1234).
 - Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
  cancel both response streams when either response fails or overflows the 4 MB
  byte cap, and deduplicate camera IDs before per-pack prioritization
  (yaka0007, #1233).
 - Skip bike-share stations with missing, blank or invalid coordinates instead
  of placing them at coerced zero coordinates or accepting out-of-range values.
  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #1232).
 - OpenSky sign-in matches what OpenSky accepts since 2026-03-18. The server
  now reads `OPENSKY_CREDENTIALS_FILE` (the `credentials.json` OpenSky's
  account page downloads) on every platform, not only through the macOS
  launcher, and no longer sends retired username/password Basic auth:
  `OPENSKY_AUTH_MODE=basic` loads anonymously with one warning saying what to
  set instead (quanticsoul4772, #1229).
 - Credential-file warnings omit parser excerpts and filesystem error details;
  the path example also works with the macOS launchers.
 - Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
  otherwise skipped with one log line saying where to get a key
  (quanticsoul4772, #1228).
 - The first-run card can be closed on a phone or tablet. "ESC to dismiss" is
  now a button that closes the card the same way ESC does; touch screens read
  DISMISS, and phones no longer hide it, so choosing a mission is not the only
  way out (KnottyDyes, #1226).
 - Add continuous globe rotation with direction and speed controls and a globe-fit
  check before starting (manjunath22466, #1225).
 - Open God's Eye View from Pinokio in the system browser using the supported
  `popout` menu option. The application's framing policy is unchanged
  (NukeThemAII, #1222).
 - Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
  command, while preserving an earlier accepted deferred input
  (Manjunath, #1220).
 - Keep NASA FIRMS fire and ALPR camera labels English in voice tool results
  (`track_entity`, `get_entity_context`, pointer context); the voice card still
  shows them in the interface language (daikaginza, #1207).
 - Report actual outcomes when voice enables or disables CCTV through the shared
  layer lifecycle, including failed and cancelled changes (manjunath22466,
  #1205).
 - Draw CCTV stills at their source aspect on the monitor plane instead of
  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
  every still was widened; they are now centered and pillarboxed on the dark
  the placeholder already ends on (Danielslay86, #1201).
 - Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
  video camera could only be found by opening it. Stills stay cyan and the
  active camera stays amber, and focus de-emphasis fades the violet the same
  way (Danielslay86, #1200).
 - Keep Space Missions marked STALE when Launch Library 2 falls back to cached
  launch data, and return to NOMINAL after a fresh response without discarding
  retained missions (rudycelekli, #1199).
 - Share Launch Library request cache keys across installations refreshing in the
  same UTC minute, identify the app to the provider, and explain that standard
  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
  upgrades; existing local cache and server-only token handling are unchanged
  (rudycelekli, #1197).
 - Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
  BicinRivas, about 1,840 stations. Station names read underscores as word
  breaks, and station capacity counts docks rather than PBSC's geofenced area
  (ulihhhh, #1190).
 - Keep missing launch-pad coordinates unknown so launches use the location
  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
  flight numbers no longer show "FLIGHT 0"
  (Rudy Celekli, @rudycelekli, #1186).
 - Flights' ground floor works across the antimeridian. The viewer-distance
  check behind the 150 km floor radius and its copy in the photoreal mesh-floor
  sampler subtracted longitudes without wrapping, so two points 21 km apart
  across 180° measured about 38,000 km and low or grounded aircraft just across
  the line from the viewer were never floored. A contact's display corridor
  walked a segment across 180° the long way round, spending its cell budget on
  ground behind the contact, and a contact on the seam lost its cell hysteresis.
  SEARCH NEARBY SITES on a view across 180° searched Google Places around
  longitude 0, on the far side of the globe, with a radius sized from the view's
  height alone; it now searches the view (Aditya, @Rohilalala, #1173).
 - Keep missing CCTV numbers unknown instead of reading them as zero. `Number`
  turns null, blank strings and booleans into 0 or 1, and the camera source
  list sends an unknown number as JSON null, so a source-pack camera that left
  out its pose reached the browser as zeros clamped to each field's floor —
  facing north, pitch −2°, FOV 20°, range 120 m, mount 6 m and ground 0 m —
  instead of the defaults (id-hash heading, −17°, 74°, 700 m, 24 m and the
  city's ground); a null or blank position placed the camera at 0,0. The
  server's `toFiniteNumber` and the browser's `safeNumber` now treat absent,
  blank and boolean values as missing. The same conversion also stops a
  Tallinn row with a null heading reading as a confident north-facing camera,
  a Caltrans camera with a blank elevation losing its 150 m ground prior, and
  a TfL or Catalonia camera with a null or blank coordinate being kept at 0,0
  or on the zero meridian (omerbberk, #1172).
 - Director shot actions land on the requested shot. A seek to a shot's start
  could round a hair below it and select the end of the previous shot for some
  shot counts and durations (Aditya, @Rohilalala, #1171).
 - Fire-perimeter queries handle outlines and holes crossing the antimeridian:
  areas enclosed near ±180° are included, areas at the opposite meridian are
  excluded, and returned perimeter coordinates stay near the dateline. Incident
  cards use the same circular longitude mean and compare multipart outline
  areas along short longitude edges, keeping the card on the largest polygon
  (Arianna Method, @ariannamethod, #1142).
 - Scenes keep the "Scene not saved" status when a capture, update, append or
  import cannot be saved, and an unreadable saved project no longer overwrites
  the recovery checkpoint. `startScene()` resolves to its documented result,
  `afterShotId` works without an explicit scene, and `scenesRun` counts the
  distinct scenes queued (djabhi31, #1135).
 - Label camera-tool Street View fallbacks as historical Google imagery rather
  than the current camera view; keep unknown frame provenance explicit
  (rudycelekli, #1118).
 - Release superseded Google Street View open waits and suppress metadata
  requests whose viewer was unmounted while the service loaded (rudycelekli,
  #1117).
 - Exclude aircraft without a reported altitude from requested altitude bands;
  unfiltered aircraft queries still retain them (rudycelekli, #1115).
 - A failed Esri Satellite or keyless terrain load still shows OSM or flat terrain
  at once, but no longer lasts the whole session: while the fallback is on
  screen, the real provider is retried in the background (30 seconds, doubling
  to a 10-minute cap) and replaces it live once it loads. Map switches never
  wait for a retry (Aditya, @Rohilalala, #1111).
 - Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
  spliced catalog cannot pair one satellite's elements with another's; the next
  valid set still parses (VG31OP, #1101).
 - Overpass data whose element tags contain a failure phrase ("timed out",
  "runtime error", "too many requests" and similar, e.g. a place named "Timed
  Out Escape Rooms") is returned as data instead of being refused and putting
  the endpoint on cooldown; upstream failures are read from the remark (Aditya,
  @Rohilalala, #1097).
 - Military aircraft keep their last heading and speed when an adsb.lol row omits
  `track` or `gs`, instead of turning north and stopping; a grounded row without
  a speed still reads 0 (Aditya, @Rohilalala, #1096).
 - Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
  #1094).
 - Location search accepts two-dimensional WGS84 `geo:` URIs offline, with
  the existing coordinate framing and label. Unsupported URI fields are passed
  to the remaining search providers unchanged (cj-vana, #1071).
 - Keyless standalone startup answers an unavailable Google tile-token endpoint
  with uncached 204 instead of a browser-visible 404. Existing providers take
  precedence, and unrelated API routes behave as before. (dvilrgamerz, #1066)
 - On Windows, `npm run doctor` and the Pinokio install no longer print Node's
  DEP0190 warning ("Passing args to a child process with shell option true can
  lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
  the shell command string instead of an argument array (quanticsoul4772, #1057).
 - `aircraft_in_area` and `vessels_in_area` take `group_by` and `stats`, so an
  MCP client can ask which airlines, countries, aircraft types or ship types
  dominate an area, or the average altitude or speed, over every match instead
  of estimating from the returned rows. Airlines come from the ICAO designator
  in each callsign (SWA1234 counts as SWA), so the breakdown works on feeds
  that report no operator; operator and type are counted only where the feed
  reports them. Ship types count by family, so AIS codes 70 to 79 are all
  cargo; type 0 ("not available") and the reserved codes 100 to 255 count as
  unknown. Altitude and speed stats cover airborne aircraft only, so parked
  aircraft do not pull the means down. Every vessel answer, `find_vessel`
  included, now reads AIS ship-type codes as their family and a destination
  with no letters as unknown (quanticsoul4772, #1056).
 - Add Hong Kong Transport Department traffic snapshot cameras as a keyless CCTV
  source pack: the public DATA.GOV.HK English locations XML, frames pinned to
  `tdcctv.data.one.gov.hk`, with DATA.GOV.HK Terms of Use attribution. By
  default nearly the full TD catalog (~1,013 cameras; cap 1,100) loads,
  prioritized across Hong Kong Island, Kowloon and the New Territories. Headings
  use the shared id-hash fallback at low confidence. `CCTV_HK_MAX_SOURCES` sets
  the cap (8–1,200) and `CCTV_HK_ENABLED=0` turns the pack off (JCY2515, #990).
 - Cross-site pages can no longer fill the terrain-height cache or spend the
  visitor's own `/api/terrain/heights` rate-limit quota through the visitor's
  browser. The route refuses a cross-site `Sec-Fetch-Site` or a foreign or
  opaque `Origin` before rate limiting, cache access or upstream work. Unlike
  the cost-bearing routes it still answers same-origin requests that arrive
  through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or
  Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza,
  #975).
 - Street Level is rebuilt around one small provider registry: Mapillary,
  KartaView, Panoramax and Google Street View share one coverage drawer and
  one photo viewer, one source lit at a time. Floating and docked panels,
  FOLLOW, surface modes, the legend and the Mapillary proxy's disk cache are
  gone; `.gev-cache/mapillary/` from earlier runs is no longer read and can be
  deleted (gekh, #974).
 - Cross-site browser requests can no longer spend the TomTom traffic-tile
  budget through `/api/tomtom/*`. The shared same-site gate runs before status,
  cache, and upstream work; same-origin app requests and non-browser local
  callers remain supported (Sunil56224972, #973).
 - Recent Imagery: opening DETAILS scrolls its card into view when it opens below
  the fold. The panel used to restore the previous scroll position right after
  the reveal, so the card stayed out of sight (Ian Blenke, #970).
 - Harden Vite's filesystem deny list for local-only artifacts: repo `dist/`,
  `.gev-logs/`, and `.gev-cache/` are denied without blocking dependency
  `dist/` directories, and checkout paths containing glob metacharacters are
  escaped before building the root-anchored pattern (blowing-a-raspberry, #948).
 - Give each Statens vegvesen camera its own ground height from Kartverket's
  keyless point-height API (CC BY 4.0) instead of one flat 150 m prior, so
  mountain-pass cameras no longer sit hundreds of metres below the terrain
  where neither the point-height prior nor the ground snap resolves. About 850
  of ~855 cameras get a height; the rest keep the old prior. Requests carry 20
  points, the most the API answers from its 1 m terrain model, eight at a
  time; a cold lookup takes about 6–13 s. Cameras over water use the water
  surface rather than the sea-floor depth the API returns there; for bridge
  cameras that is still below the deck. Heights are cached for good and misses
  for 6 h, so a refresh only asks about new or moved cameras. After a
  failing request (a 408, 429 or 5xx, a network error, a request over 10 s or
  an unreadable body) the lookup stops and backs off (Retry-After, else
  30 min, longer than the refresh). The lane waits at most 12 s from its
  start, and only on a cold cache; a slower first lookup leaves the cameras it
  had not reached on the flat prior until the next 15-minute refresh, and
  keeps filling the cache meanwhile.
  `CCTV_VEGVESEN_HEIGHTS=0` turns it off. Follow-up to #929 (trygvehhh, #945).
 - Extract a reusable model-free World Packet from the existing voice
  `get_current_view_state` owner without restoring disabled layers to the
  model context. Keep the enabled-only payload, disabled-layer count, source
  provenance, action result and view-state contract; read the layer roster once
  per packet; voice retains the speech/card envelope at its own boundary.
  Credits: original GEV voice/layer contributors and #880 implementation.
 - Add optional Gemini Live voice to the standalone app, with a provider chooser,
  server-held API key, microphone streaming, shared map actions and captions.
  Switching providers ends the old conversation and preserves the input mode
  (Manjunath, #872).
 - Close the compact Radio disclosure when an adaptive tactical right-rail
  restore directly expands Context, before Space Missions can be covered.
  A repeated Context-open request also clears stale disclosure state.
  Real PanelChrome constructor wiring and the rail reflow path are covered
  by focused regressions. Credits: kvnloo (#816), raysung-2026's original
  #804 report, asturksever's review, and quanticsoul4772's independent
  Windows diagnosis.
 - Changelog entries are now one file per pull request. A change adds
  `changelog.d/<pull request>-<slug>.md` instead of editing the top of
  `CHANGELOG.md`, which two pull requests in flight could not share — it was the
  most frequent merge conflict in the open queue, and for six of them the only
  one. `npm run changelog` splices the directory into `CHANGELOG.md` at release
  time and empties it; `npm run changelog:check` reports the batch and changes
  nothing. Fragment text is copied through unchanged (daikaginza, #787).
 - Read satellite catalog numbers written in Alpha-5, the TLE spelling of
  numbers above 99999: a letter for the first two digits, skipping I and O
  (`A0000` is 100000, `Z9999` is 339999). The satellites layer converted such a
  field to `NaN`, so every Alpha-5 satellite shared one catalog entry and all
  but the first were dropped as duplicates; the satellite tools read the same
  field as no number, so such a satellite could not be found by it. The layer
  and the tools now decode the field in `src/sources/tle.js`, and reject a
  malformed one (a sign, decimal point, hex, embedded space or stray letter)
  instead of reading part of it as a number. This is Alpha-5 TLE
  compatibility: CelesTrak's TLE feed carries no satellite above 99999, which
  needs the OMM feed (#1191) (Honorius Neogy, #767, fixes #751).
 - The dev server no longer watches `.gev-cache` and `.gev-logs`. Providers write
  cache files and logs there while the app runs, and none of it is source, so
  the watcher now skips it; this guards against the DNS-lookup delays heavy
  cache writes have caused, though no difference was measured on current main
  (monwiss, #761).
 - Bound what a caller can grow through `/api/terrain/heights`. Every distinct
  5-decimal point was a permanent in-memory entry, a permanent line in an
  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
  nothing limiting the rate. The point cache now holds at most 50,000 entries
  and evicts oldest-first, a cache file above
  24 MB is not read back, and the route is limited to 90 requests/minute per
  client (270 global). Evicting a point costs one refetch, never a wrong
  answer, since terrain does not move. Ordinary use is unaffected: a full
  `test:track` run drives 10 requests, peaking at 8/min (daikaginza, #686).
 - Add FL511 (Florida DOT) traffic cameras as an opt-in CCTV source pack:
  the statewide ArcGIS catalog, read a page at a time under a byte cap with
  redirects refused, and frames pinned to FL511's two image hosts over HTTPS.
  FL511's terms limit its content to individual, personal use, and any other
  use (a public deployment included) needs FDOT's express written consent, so
  the pack stays off unless `CCTV_FLORIDA_ENABLED=1`. Headings come from the
  catalog's direction codes, and camera ids come from the image channel, since
  the catalog's ID column repeats across regions. `CCTV_FLORIDA_MAX_SOURCES`
  sets the cap (Danielslay86, #605).
 - The client's great-circle distances now come from one shared
  `src/geoDistance.js` (`greatCircleKm`/`greatCircleMeters`, `{lat, lon}`
  points). The Earth radius is standardized on 6371.0088 km, so distances shift
  by about 1.4 ppm and region areas by about 2.8 ppm, and missing or
  out-of-range points return `Infinity` (onionviolet, #287; Rajojha-1, #749).
 - The tracked-aircraft descriptor now publishes `verticalRateMps`, on both the
  civil and military layers, so a consumer reading `getTrackedInfo()` no longer
  has to reach past it into the raw poll record for climb/descent. Reported,
@@ -291,8 +978,6 @@
  point. A slow render gets one bounded second frame request, while hidden,
  stale, moved-camera, invalid and oversized captures still fail closed.
 ## [Unreleased]
 - Add a keyless Air quality layer to the Weather group, with Environment and
  Climate Change Canada's AQHI as the first registered provider. Readings carry
  `{ provider, scale, value, band }` so another network can be added without
@@ -507,6 +1192,28 @@
  needs only the Map Tiles API and the Maps JavaScript API (Street View). Keyless sessions and the Photon/Nominatim
  fallback order are unchanged.
 - Voice can switch on every shipped data layer (the two scene-driven
  Bhote Koshi layers stay scene-only), including transit, Recent
  Imagery, wind, the weather layers, cyclones and mapped installations, and
  understands their spoken names ("buses", "hurricanes", "military bases").
  One voice manifest (`src/voice/layerManifest.js`) generates the tool enums
  and aliases, and a unit test fails when a new layer has no entry.
 - `analyst_query` counts up to 250,000 loaded records per layer instead of the
  first 2,000, and says when a layer went past that (`complete: false`). It
  also answers over bikeshare stations, transit vehicles, rocket launches,
  cyclones, ALPR cameras, mapped installations, local ADS-B aircraft and fire perimeters; fire
  records carry their sensor (VIIRS or MODIS).
 - Unknown fields, operators, units, value types, scope kinds and invalid
  centres are refused with the allowed values instead of answering zero or widening to anywhere. A
  layer that is off, still loading or unavailable is reported as such, not
  as a count of zero; a partly answerable query is marked `partial`.
  Distance sorts honour `sortDir`, a written unit such as `altitudeM(ft)`
  converts, and large rankings no longer sort the whole set.
 - Results carry `lat`/`lon` for each item and a `display` object with the
  scope, the feed window (earthquakes and fires cover the last 24 h) and any
  caveat for the screen. The model is asked to answer in one short phrase.
 - The weather and Recent Imagery panels can be opened by voice.
 ## [0.2.1] — 2026-10-02 — God's Eye View through Your Agent (with security fixes and other features)
 - Ship each bundled data pack once. The region, marine, admin-boundary,
@@ -789,32 +1496,6 @@
  (`src/ui/imagerySplit.js`, `src/maps/imageryComparison.js`), and
  `MapSourceController.subscribe()` reports every settled map switch.
 ## Unreleased — voice reaches every layer; honest analyst answers
 - Voice can switch on every shipped data layer (the two scene-driven
  Bhote Koshi layers stay scene-only), including transit, Recent
  Imagery, wind, the weather layers, cyclones and mapped installations, and
  understands their spoken names ("buses", "hurricanes", "military bases").
  One voice manifest (`src/voice/layerManifest.js`) generates the tool enums
  and aliases, and a unit test fails when a new layer has no entry.
 - `analyst_query` counts up to 250,000 loaded records per layer instead of the
  first 2,000, and says when a layer went past that (`complete: false`). It
  also answers over bikeshare stations, transit vehicles, rocket launches,
  cyclones, ALPR cameras, mapped installations, local ADS-B aircraft and fire perimeters; fire
  records carry their sensor (VIIRS or MODIS).
 - Unknown fields, operators, units, value types, scope kinds and invalid
  centres are refused with the allowed values instead of answering zero or widening to anywhere. A
  layer that is off, still loading or unavailable is reported as such, not
  as a count of zero; a partly answerable query is marked `partial`.
  Distance sorts honour `sortDir`, a written unit such as `altitudeM(ft)`
  converts, and large rankings no longer sort the whole set.
 - Results carry `lat`/`lon` for each item and a `display` object with the
  scope, the feed window (earthquakes and fires cover the last 24 h) and any
  caveat for the screen. The model is asked to answer in one short phrase.
 - The weather and Recent Imagery panels can be opened by voice.
 ## Unreleased — local receiver feeds
 ### Local receiver feeds
 - The Local ADS-B layer also reads local 1090 MHz and 978 MHz UAT decoder
@@ -957,7 +1638,6 @@
 Add feed provenance to analyst/view answers and HUD context while retaining existing response fields and runner ownership (Matt Van Horn, #347).
 Analyst records for loaded satellites, datacenters and dams, with explicit bounded count/rank coverage (Matt Van Horn, #351).
 - New Fire Perimeters layer (Events group): live NIFC WFIGS interagency
  wildfire incident perimeters as ground-clamped polygons with a
  containment-colored fire line, refreshed every 5 minutes from the public
@@ -1234,6 +1914,7 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 ### Other changes
 - Add ECMWF IFS model selection to Wind (#464, thanks @beneduzi), with model-scoped forecast-step caches, cancellation of replaced requests, and separate issue/valid timestamps.
 - Add bounded Director feature actions with accessible controls, explicit camera/layer admission and cancellation; restore pack geometry on same-shot seek. Preserve existing scenes and content attribution.
@@ -2042,3 +2723,4 @@ represent previously published GitHub Releases.
 ## [0.1.0] — 2026-02-09
 - Initial project version.
@@ -70,6 +70,7 @@ How to read this:
 | **NYC DOT Traffic Management Center** (`webcams.nyctmc.org`) | CCTV camera catalog + frames, New York City five boroughs | NYC DOT requires developers to sign a [data-sharing agreement](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) for the camera feed. **Off by default**; enable only under your own agreement | "NYC DOT Traffic Management Center" + NYC DOT's required application disclaimer (in the Data attribution popover) |
 | **City of Toronto Open Data** (`opendata.toronto.ca`)                 | CCTV camera catalog + frames, Toronto city streets                                                                                  | [Open Government Licence – Toronto](https://www.toronto.ca/city-government/data-research-maps/open-data/open-data-licence/) — attribution REQUIRED                                                                                                                                                                                                    | "Contains information licensed under the Open Government Licence – Toronto"                                                                 |
 | **Houston TranStar** (`traffic.houstontranstar.org`, frames `www.houstontranstar.org`) | CCTV camera catalog + frames, Greater Houston | No licence. The [TranStar disclaimer](https://traffic.houstontranstar.org/disclaimer.aspx) (Content Usage) prohibits copying or distribution, and external framing or linking to specific images, without TxDOT's prior written permission. Off unless `CCTV_HOUSTON_ENABLED=1` | "Houston TranStar" (courtesy) |
 | **Autostrada del Brennero (A22)** (catalog `tourism.api.opendatahub.com`, frames `www.autobrennero.it/WebCamImg/`) | CCTV camera catalog + frames, A22 Brenner–Modena motorway, Italy | Public Autobrennero webcam images; camera list republished by the Open Data Hub, whose records are tagged CC0 (`ClosedData: false`, licence holder Autobrennero); Autobrennero publishes no terms of its own for the images | "Webcam images © Autostrada del Brennero S.p.A., via the Open Data Hub (NOI Techpark)" (courtesy) |
 | **GBFS (Lyft / BCycle / Social Bicycles / PBSC)**                     | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                                   |
 | **Bike Share Toronto** (`toronto.publicbikesystem.net`) | Bikeshare station availability, Toronto | Operator GBFS feed. No licence is published: the City's open-data package declares none and the feed has no `license_url`. Attribution is given to the operator. | "Bike Share Toronto (Toronto Parking Authority)" |
 | **Bike Itaú / Tembici** (`*.publicbikesystem.net`, seven Brazilian cities, Santiago and Bogotá) | Bikeshare station availability: São Paulo, Rio de Janeiro, Salvador, Recife, Porto Alegre, Brasília, Curitiba, Santiago de Chile and Bogotá | Operator GBFS feeds. No licence is published: the feeds' `system_information.json` carries no `license_url`, operator or attribution fields. Attribution is given to the operator. | "Bike Itaú (Tembici)"; "Tembici Bogotá" |
@@ -178,6 +179,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `[email protected]` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras/<uuid>/image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover.
 - **City of Toronto RESCU cameras.** Keyless. The camera list is the City's public `tmcearthcameras.json` on `opendata.toronto.ca` (dataset "Traffic Cameras", Transportation Services), served as JSONP and unwrapped with an anchored pattern. This is the municipal network the Ontario 511 pack does not carry: downtown arterials plus the Gardiner, DVP, Allen and Lake Shore. The list publishes no frame URL, so frame URLs are BUILT from the documented `CameraImages/loc####.jpg` convention and a strictly-digits camera number, pinning the frame proxy to the portal origin by construction; the list fetch refuses redirects and bounds the body it buffers. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `D1`-`D4` fields are the directions of the *comparison* images (static reference stills captured in 2016 under a different path), not a bearing for the live pan-tilt-zoom frame, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. A camera that is temporarily out of service still answers 200 with a byte-identical "Image Unavailable" placeholder rather than an error (about 6% of the network at any moment), so such a camera reads as healthy; the frame it shows is the agency's, not a synthesized one. The licence requires the attribution statement above. Disable with `CCTV_TORONTO_ENABLED=0`.
 - **Houston TranStar cameras.** Keyless. The camera list is the public `traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js` catalog (~1,000 cameras across Greater Houston); frames are stills at `www.houstontranstar.org/snapshots/cctv/<id>.jpg`, synthesized from a validated numeric id rather than taken from the payload, and only that host is registered. Cameras whose catalog id is `0` (a different, non-snapshot class) and cameras outside Greater Houston are dropped. Dedicated `dir` values (North/South/East/West) become high-confidence headings; `None` uses the shared id-hash fallback at low confidence. TranStar's disclaimer is not a licence to ship the stills on by default (its FAQ grants permission-free use only for the RSS feeds), so the pack stays off unless `CCTV_HOUSTON_ENABLED=1`. Opting in loads the 250 cameras nearest downtown, Uptown, the Medical Center, IAH and Galveston; `CCTV_HOUSTON_MAX_SOURCES` (8–400) changes the cap. Snapshots update about every 3 minutes, which is also the ambient still cadence. Frames are fetched at request time and never stored or redistributed.
 - **Autostrada del Brennero (A22) webcams.** Keyless. The camera list is one request to the Open Data Hub tourism API (`tourism.api.opendatahub.com/v1/WebcamInfo?source=a22`), run by NOI Techpark in South Tyrol, which republishes Autobrennero's own list of 13 motorway webcams with coordinates and kilometre markers. Frames are the operator's stills on `www.autobrennero.it/WebCamImg/km<N>.jpg`, refreshed about once a minute, and only the exact image for each camera's kilometre is registered. The feed names no bearing, so headings use the id-hash fallback at low confidence. The road climbs from about 20 m in the Po valley to about 1,370 m at the Brenner Pass, so each camera's ground elevation comes from a per-kilometre table sampled from the Copernicus GLO-90 DEM (via Open-Meteo's elevation API); a camera not in the table uses a 200 m prior. The Open Data Hub tags every record CC0 (`ClosedData: false`, Autobrennero as licence holder), but that tag is the aggregator's metadata and Autobrennero publishes no terms of its own for the images, so they are credited to the operator as a courtesy and are not redistributed. Frames are fetched at request time and never stored. Disable with `CCTV_A22_ENABLED=0`.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
 - **Transit (GTFS-Realtime).** The proxy requests only registered operator feeds, validates redirects, bounds responses, and uses conditional requests, short snapshot caching and failure backoff. All sixteen registered regions are live-enabled; each can be disabled independently. Vehicles use delayed playback between reports, with report age and waiting states shown separately. Session-local selected trails are available for every feed. MBTA additionally retains up to 15 minutes of recently observed positions in the running proxy, so available history can survive a browser reload; server restart clears it. History reads never fetch upstream, and other feeds have no proxy retention. Nothing is archived to disk or collected in the background. Operator text credits are included as a courtesy and do not imply endorsement. Heights are aligned to work with Google 3D tiles; subway markers are shown at street level because these feeds do not supply depth. The TTC feed is BusTime, the surface system: it carries buses and streetcars and no subway at all. About four in ten of its vehicles report no route at all (unassigned or deadheading), and those are shown with the feed default rather than a route-established mode. It sends no ETag or Last-Modified, so its conditional requests fall through to the ordinary snapshot cache. Three Golden Horseshoe neighbours run alongside it — MiWay, Hamilton HSR and Durham Region Transit — each bus-only and each polled only near its own region. Durham Region Transit publishes no bearing on any vehicle, so those sprites take their heading from observed movement like any other feed that omits it. Guelph, Kingston and Barrie extend the same pattern eastward and north. Hamilton, Guelph, Burlington and YRT publish route ids that are not the number on the vehicle, so those entries carry a route-name table taken from each operator’s own published GTFS; any id missing from a table renders unchanged rather than blank. A label is never invented: YRT runs a route `9101` that appears nowhere in its published routes, so it stays as the feed sends it. Burlington’s is the one that cannot be shortcut: `351` is route 1 while `3510` is route 10, so the table is a real join rather than a trimmed prefix. GO Transit / Metrolinx is deliberately absent: its REALTIME feed requires an API key issued by manual review, which the keyless admission rule excludes (its static schedule download is keyless, but carries no vehicle positions). Barrie and YRT/Viva each invite acceptance of their licence through a form, and each licence also states that using the data is itself acceptance; this deployment relies on that clause, which is recorded in both entries. Grand River Transit in Waterloo is absent for a different reason: it answers, but its feed header was months stale and it publishes no per-vehicle timestamps, so it would render vehicles that look live and are not. Ottawa’s OC Transpo falls to the same keyless admission rule as GO Transit — its realtime feed requires an API key. London Transit and Thunder Bay Transit publish vehicle positions over plain HTTP with no HTTPS endpoint available. Every other Ontario system — Brampton, Oakville, Niagara, Milton, Windsor, Greater Sudbury, UP Express and a dozen smaller operators — publishes static GTFS schedules only, with no realtime vehicle positions to register. Between the nine included and these exclusions, every Ontario realtime vehicle-position feed catalogued in the Mobility Database is accounted for.
 - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and non-array or empty successful payloads are rejected atomically. Individual structurally malformed rows are skipped rather than failing the whole query; the response carries their bounded `rejectedStationCount` (at most 10,000), which the client adds to its own rejected rows and reports as degraded coverage without discarding the accepted generation. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply.
@@ -61,7 +61,7 @@ Start with the included data sources, then add your own. Each layer is a separat
 - **🎯 Click-to-track anything:** Camera locks on, draws a fading trail, surfaces full metadata — and a tracked fire or vessel hands you off to the nearest live camera in one click.
 - **🖊️ Voice whiteboard:** Speak annotations onto the world — real boundary polygons, marks, and routes.
 - **🛫 3D hangar:** Real per-class aircraft models — 787, ATR-72, Citation, Bell 206, MQ-9 — and a tracked contact swaps from glyph to 3D model as you close in.
- **🎨 Reskin reality:** GLSL sensor looks over the normal globe — CRT, NVG, FLIR/thermal, Noir, Snow.
+- **🎨 Reskin reality:** GLSL sensor looks over the normal globe — CRT, NVG, FLIR/thermal, Noir.
 - **🟩 Detection overlay:** Screen-space bounding boxes and IDs on everything in view.
 - **🎖️ Military HUD:** Tactical heads-up display with intelligence-style telemetry.
 - **🌐 Global Context:** Stage the full situational picture with one switch — and get your exact view back when you leave.
@@ -294,14 +294,14 @@ Choose a first-run mission, or try these in order. The GIFs show Google Photorea
 ![Tracking the ISS along its orbital path as it crosses over Ukraine](docs/media/14-iss-over-ukraine.gif)
-6. **Switch the optics.** Tap `1`–`7` — CRT, NVG, FLIR — and the whole live planet re-renders through a different sensor.
+6. **Switch the optics.** Tap `1`–`6` — CRT, NVG, FLIR — and the whole live planet re-renders through a different sensor.
 ![Cycling a dense live globe through CRT, FLIR, and NVG in one continuous view](docs/media/01-style-sweep.gif)
 7. **Talk to it** _(needs an OpenAI key)_: _"Take me to LAX and select the nearest airborne aircraft."_
 8. **Come home.** Hit **Reset Globe** — or just say _"zoom out to a globe view."_
-**Keyboard:** `1`–`7` visual styles · `H` HUD · `D` detection · `C` cockpit · `` ` `` frame rate · `Esc` out. Trackpad pinch zooms the globe.
+**Keyboard:** `1`–`6` visual styles · `H` HUD · `D` detection · `C` cockpit · `` ` `` frame rate · `Esc` out. Trackpad pinch zooms the globe.
 ---
@@ -399,7 +399,7 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 | 🌍 **Earthquakes**          | Global seismic activity, last 24h                                                                                                                                                                                                                                                                                                                                                   | USGS                                    | 🟢                                                                                                  |
 | ◍ **Air quality**           | Live AQHI on the published 1–10+ health-risk scale, with a Weather-panel card showing the band legend and the highest readings in view. **Canada only** — ECCC is the first registered provider | ECCC MSC GeoMet                          | 🟢                                                                                                  |
 | 🚗 **Traffic**              | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations                                                                                                                                                                                                       | TomTom + OSM                            | 🟢 simulation · 🟡 live flow speeds                                                                 |
-| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed) opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent) and opt-in Houston (TranStar, off unless CCTV_HOUSTON_ENABLED=1). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
+| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC) · Italy (A22 Brennero motorway), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed), opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent) and opt-in Houston (TranStar, off unless CCTV_HOUSTON_ENABLED=1). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
 | 📷 **Mapped ALPR Cameras**  | License-plate-reader camera locations tagged by OpenStreetMap contributors, loaded one city-sized view at a time, with **SHOW NEAREST**. Locations and tags only: no plate data, no video                                                                                                                                                                                           | OpenStreetMap (incl. DeFlock mapping)   | 🟢                                                                                                  |
 | 📷 **Street Level**         | Street-level photos behind one panel, one chip per provider: coverage on the streets, image cones, an embedded viewer with full-screen **EXPAND**. Mapillary, Google Street View, KartaView and Panoramax | Mapillary · Google · KartaView · Panoramax | 🟢 KartaView, Panoramax · 🟡 Mapillary token · 🔴 Google Maps key |
 | 📻 **Radio**                | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster                                                                                                                                                                                                                                                 | Radio Browser / broadcasters            | 🟢                                                                                                  |
@@ -0,0 +1,4 @@
 - Director clock listeners, interaction observers and scene release failures
  no longer leave the director inconsistent: each scene is released once, and
  a phase error is kept (with the release failure logged) when cleanup also
  fails (deepeshbind, #1014).
@@ -1,12 +0,0 @@
 - `aircraft_in_area` and `vessels_in_area` take `group_by` and `stats`, so an
  MCP client can ask which airlines, countries, aircraft types or ship types
  dominate an area, or the average altitude or speed, over every match instead
  of estimating from the returned rows. Airlines come from the ICAO designator
  in each callsign (SWA1234 counts as SWA), so the breakdown works on feeds
  that report no operator; operator and type are counted only where the feed
  reports them. Ship types count by family, so AIS codes 70 to 79 are all
  cargo; type 0 ("not available") and the reserved codes 100 to 255 count as
  unknown. Altitude and speed stats cover airborne aircraft only, so parked
  aircraft do not pull the means down. Every vessel answer, `find_vessel`
  included, now reads AIS ship-type codes as their family and a destination
  with no letters as unknown (quanticsoul4772, #1056).
@@ -1,4 +0,0 @@
 - On Windows, `npm run doctor` and the Pinokio install no longer print Node's
  DEP0190 warning ("Passing args to a child process with shell option true can
  lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
  the shell command string instead of an argument array (quanticsoul4772, #1057).
@@ -1,3 +0,0 @@
 - Keyless standalone startup answers an unavailable Google tile-token endpoint
  with uncached 204 instead of a browser-visible 404. Existing providers take
  precedence, and unrelated API routes behave as before. (dvilrgamerz, #1066)
@@ -1,3 +0,0 @@
 - Location search accepts two-dimensional WGS84 `geo:` URIs offline, with
  the existing coordinate framing and label. Unsupported URI fields are passed
  to the remaining search providers unchanged (cj-vana, #1071).
@@ -0,0 +1,4 @@
 - FIRMS fire data loads on hosts where IPv6 is unreachable and IPv4 is slow to
  connect: a request whose every address fails to connect retries once over
  IPv4, and FIRMS warnings name the underlying connection errors instead of
  only `fetch failed` (jeffblakely, #1078).
@@ -1,4 +0,0 @@
 - Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
  #1094).
@@ -1,3 +0,0 @@
 - Military aircraft keep their last heading and speed when an adsb.lol row omits
  `track` or `gs`, instead of turning north and stopping; a grounded row without
  a speed still reads 0 (Aditya, @Rohilalala, #1096).
@@ -1,5 +0,0 @@
 - Overpass data whose element tags contain a failure phrase ("timed out",
  "runtime error", "too many requests" and similar, e.g. a place named "Timed
  Out Escape Rooms") is returned as data instead of being refused and putting
  the endpoint on cooldown; upstream failures are read from the remark (Aditya,
  @Rohilalala, #1097).
@@ -1,3 +0,0 @@
 - Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
  spliced catalog cannot pair one satellite's elements with another's; the next
  valid set still parses (VG31OP, #1101).
@@ -1,5 +0,0 @@
 - A failed Esri Satellite or keyless terrain load still shows OSM or flat terrain
  at once, but no longer lasts the whole session: while the fallback is on
  screen, the real provider is retried in the background (30 seconds, doubling
  to a 10-minute cap) and replaces it live once it loads. Map switches never
  wait for a retry (Aditya, @Rohilalala, #1111).
@@ -1,2 +0,0 @@
 - Exclude aircraft without a reported altitude from requested altitude bands;
  unfiltered aircraft queries still retain them (rudycelekli, #1115).
@@ -1,3 +0,0 @@
 - Release superseded Google Street View open waits and suppress metadata
  requests whose viewer was unmounted while the service loaded (rudycelekli,
  #1117).
@@ -1,3 +0,0 @@
 - Label camera-tool Street View fallbacks as historical Google imagery rather
  than the current camera view; keep unknown frame provenance explicit
  (rudycelekli, #1118).
@@ -1,5 +0,0 @@
 - Scenes keep the "Scene not saved" status when a capture, update, append or
  import cannot be saved, and an unreadable saved project no longer overwrites
  the recovery checkpoint. `startScene()` resolves to its documented result,
  `afterShotId` works without an explicit scene, and `scenesRun` counts the
  distinct scenes queued (djabhi31, #1135).
@@ -1,6 +0,0 @@
 - Fire-perimeter queries handle outlines and holes crossing the antimeridian:
  areas enclosed near ±180° are included, areas at the opposite meridian are
  excluded, and returned perimeter coordinates stay near the dateline. Incident
  cards use the same circular longitude mean and compare multipart outline
  areas along short longitude edges, keeping the card on the largest polygon
  (Arianna Method, @ariannamethod, #1142).
@@ -1,3 +0,0 @@
 - Director shot actions land on the requested shot. A seek to a shot's start
  could round a hair below it and select the end of the previous shot for some
  shot counts and durations (Aditya, @Rohilalala, #1171).
@@ -1,13 +0,0 @@
 - Keep missing CCTV numbers unknown instead of reading them as zero. `Number`
  turns null, blank strings and booleans into 0 or 1, and the camera source
  list sends an unknown number as JSON null, so a source-pack camera that left
  out its pose reached the browser as zeros clamped to each field's floor —
  facing north, pitch −2°, FOV 20°, range 120 m, mount 6 m and ground 0 m —
  instead of the defaults (id-hash heading, −17°, 74°, 700 m, 24 m and the
  city's ground); a null or blank position placed the camera at 0,0. The
  server's `toFiniteNumber` and the browser's `safeNumber` now treat absent,
  blank and boolean values as missing. The same conversion also stops a
  Tallinn row with a null heading reading as a confident north-facing camera,
  a Caltrans camera with a blank elevation losing its 150 m ground prior, and
  a TfL or Catalonia camera with a null or blank coordinate being kept at 0,0
  or on the zero meridian (omerbberk, #1172).
@@ -1,10 +0,0 @@
 - Flights' ground floor works across the antimeridian. The viewer-distance
  check behind the 150 km floor radius and its copy in the photoreal mesh-floor
  sampler subtracted longitudes without wrapping, so two points 21 km apart
  across 180° measured about 38,000 km and low or grounded aircraft just across
  the line from the viewer were never floored. A contact's display corridor
  walked a segment across 180° the long way round, spending its cell budget on
  ground behind the contact, and a contact on the seam lost its cell hysteresis.
  SEARCH NEARBY SITES on a view across 180° searched Google Places around
  longitude 0, on the far side of the globe, with a radius sized from the view's
  height alone; it now searches the view (Aditya, @Rohilalala, #1173).
@@ -1,4 +0,0 @@
 - Keep missing launch-pad coordinates unknown so launches use the location
  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
  flight numbers no longer show "FLIGHT 0"
  (Rudy Celekli, @rudycelekli, #1186).
@@ -1,6 +0,0 @@
 - Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
  BicinRivas, about 1,840 stations. Station names read underscores as word
  breaks, and station capacity counts docks rather than PBSC's geofenced area
  (ulihhhh, #1190).
@@ -1,5 +0,0 @@
 - Share Launch Library request cache keys across installations refreshing in the
  same UTC minute, identify the app to the provider, and explain that standard
  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
  upgrades; existing local cache and server-only token handling are unchanged
  (rudycelekli, #1197).
@@ -1,3 +0,0 @@
 - Keep Space Missions marked STALE when Launch Library 2 falls back to cached
  launch data, and return to NOMINAL after a fresh response without discarding
  retained missions (rudycelekli, #1199).
@@ -1,5 +0,0 @@
 - Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
  video camera could only be found by opening it. Stills stay cyan and the
  active camera stays amber, and focus de-emphasis fades the violet the same
  way (Danielslay86, #1200).
@@ -1,4 +0,0 @@
 - Draw CCTV stills at their source aspect on the monitor plane instead of
  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
  every still was widened; they are now centered and pillarboxed on the dark
  the placeholder already ends on (Danielslay86, #1201).
@@ -1,3 +0,0 @@
 - Report actual outcomes when voice enables or disables CCTV through the shared
  layer lifecycle, including failed and cancelled changes (manjunath22466,
  #1205).
@@ -1,3 +0,0 @@
 - Keep NASA FIRMS fire and ALPR camera labels English in voice tool results
  (`track_entity`, `get_entity_context`, pointer context); the voice card still
  shows them in the interface language (daikaginza, #1207).
@@ -0,0 +1,5 @@
 - Keep Directions route errors, the Local ADS-B receiver error and Global
  Context cohort reasons English in layer data; the Layers panel, Radio card
  and awareness panel still show them in the interface language. The route
  proxy's "routing busy" and "route proxy error" refusals are now translated
  too (daikaginza, #1209).
@@ -1,3 +0,0 @@
 - Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
  command, while preserving an earlier accepted deferred input
  (Manjunath, #1220).
@@ -1,3 +0,0 @@
 - Open God's Eye View from Pinokio in the system browser using the supported
  `popout` menu option. The application's framing policy is unchanged
  (NukeThemAII, #1222).
@@ -1,2 +0,0 @@
 - Add continuous globe rotation with direction and speed controls and a globe-fit
  check before starting (manjunath22466, #1225).
@@ -1,4 +0,0 @@
 - The first-run card can be closed on a phone or tablet. "ESC to dismiss" is
  now a button that closes the card the same way ESC does; touch screens read
  DISMISS, and phones no longer hide it, so choosing a mission is not the only
  way out (KnottyDyes, #1226).
@@ -1,4 +0,0 @@
 - Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
  otherwise skipped with one log line saying where to get a key
  (quanticsoul4772, #1228).
@@ -1,8 +0,0 @@
 - OpenSky sign-in matches what OpenSky accepts since 2026-03-18. The server
  now reads `OPENSKY_CREDENTIALS_FILE` (the `credentials.json` OpenSky's
  account page downloads) on every platform, not only through the macOS
  launcher, and no longer sends retired username/password Basic auth:
  `OPENSKY_AUTH_MODE=basic` loads anonymously with one warning saying what to
  set instead (quanticsoul4772, #1229).
 - Credential-file warnings omit parser excerpts and filesystem error details;
  the path example also works with the macOS launchers.
@@ -1,3 +0,0 @@
 - Skip bike-share stations with missing, blank or invalid coordinates instead
  of placing them at coerced zero coordinates or accepting out-of-range values.
  Explicit zero coordinates and numeric strings remain supported (Bortlesboat, #1232).
@@ -1,4 +0,0 @@
 - Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
  cancel both response streams when either response fails or overflows the 4 MB
  byte cap, and deduplicate camera IDs before per-pack prioritization
  (yaka0007, #1233).
@@ -1,5 +0,0 @@
 - Serve the camera catalog while it refreshes. An expired catalog made every
  camera request wait for the slowest pack to reload; it is now answered at
  once while one background refresh runs, so only the first load waits. Estonia's
  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
  on about a third of loads (quanticsoul4772, #1234).
@@ -1,3 +0,0 @@
 - Require a geocoded containment anchor for ambiguous analyst region names,
  preserve boundary provenance and cancellation safety, and retain exact-name
  precedence for natural outlines (manjunath22466, #1235).
@@ -1,4 +0,0 @@
 - Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
  with on-demand snapshots and attribution. No API key is required; set
  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).
@@ -1,3 +0,0 @@
 - `get_traffic_flow` flags stale cached TomTom tiles and reports the oldest
  tile fetch time (`stale`, `oldest_tile_at`), with pending freshness metadata
  released on failed or cancelled tile reads (quanticsoul4772, #1239).
@@ -1,5 +0,0 @@
 - Replace the blocky JPEG sky around the globe with the 9,096 stars of the
  Yale Bright Star Catalogue, drawn as sharp points where they are at the
  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
  #1243).
@@ -1,4 +0,0 @@
 - The terrain-heights bounds tests no longer read the checkout's
  `.gev-cache/terrain-heights.json`. Each test gets a cache file of its own, so
  `npm test` no longer fails after the dev server has cached terrain near
  Austin (KnottyDyes, #1244).
@@ -1,9 +0,0 @@
 - Prevent malformed Overpass filters from blocking the local server, and reject
  cross-site or excessive query requests before reading their bodies
  (asturksever, #1264; fixes #1248).
 - Release unread responses from the optional Google-token probe so keyless
  browser validation can settle; the Overpass gate recognizes only that probe's
  expected 404 as an unavailable capability (asturksever, #1264).
 - Make tracking arrival checks respect the aircraft update cadence while checking
  orientation on the first reveal, avoiding false failures at faster render
  rates (asturksever, #1264).
@@ -1,3 +0,0 @@
 - Honor Docker Compose trusted-peer and allowed-host settings from the shell
  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
  access to Provider Settings before Vite starts (asturksever, #1265).
@@ -1,2 +0,0 @@
 - Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
 - Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).
@@ -1 +0,0 @@
 - Coalesce refreshes and cool down opensky failures (asturksever, #1269).
@@ -1 +0,0 @@
 - Respect provider cooldowns and bound tle groups (asturksever, #1270).
@@ -1 +0,0 @@
 - Reject inherited style keys during restore (asturksever, #1271).
@@ -1 +0,0 @@
 - Normalize geocoder bias across the antimeridian (asturksever, #1272).
@@ -1 +0,0 @@
 - Retire unavailable history and keep local trails (asturksever, #1273).
@@ -1 +0,0 @@
 - Scan the kml root delimiter in bounded time (asturksever, #1274).
@@ -1,3 +0,0 @@
 - Preserve enable during first-load replacement (asturksever, #1275).
 - Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
 - Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).
@@ -1 +0,0 @@
 - Bound each height request to one upstream chunk (asturksever, #1276).
@@ -1 +0,0 @@
 - Reserve singleflight before disk cache reads (asturksever, #1278).
@@ -1 +0,0 @@
 - Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).
@@ -1,8 +0,0 @@
 - Hold rendering only for animated content (asturksever, #1281).
 - Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
 - Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
 - Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
 - Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
 - Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
 - Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).
@@ -1,7 +0,0 @@
 - Pause periodic network updates in hidden tabs; the overdue update on return restarts the polling schedule, so the next poll follows one interval later even when that update fails (asturksever, #1282).
 - Report and guard browser visibility during Transit QA so hidden-page polling pauses cannot masquerade as playback regressions (asturksever, #1282).
 - Require each live city to supply its own feed vehicles in Transit QA; retained vehicles cannot qualify another city (asturksever, #1282).
 - Bound the Transit card-anchor probe by observed poll coverage instead of a fixed 20-second window (asturksever, #1282).
 - Keep visible-page Transit probes focused through the browser testing API (asturksever, #1282).
 - Add a real-browser regression gate for hidden-tab periodic work, explicit refresh, resume and teardown (asturksever, #1282).
 - Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1282).
@@ -1,3 +0,0 @@
 - Report cached CelesTrak satellite records as stale in the Data Layers row,
  preserving separate core and dense catalog provenance through refresh,
  removal and lifecycle cleanup (rudycelekli, #1283).
@@ -1,3 +0,0 @@
 - Keep aircraft route labels on the scheduled airport leg instead of accepting
  its distant great-circle extensions, preserving generous endpoint tolerance
  across the signed-angle branch cut (rudycelekli, #1284).
@@ -1,4 +0,0 @@
 - The Street Level SINCE note sits on the value's line, in its type and a
  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
  had lost its size variable in the Street Level slim-down and rendered
  larger than the value, on a line of its own (asturksever, #1286).
@@ -1,3 +0,0 @@
 - Give ordinary sliders a shared native control and consistent track, thumb,
  value, focus and disabled styling while preserving feature behavior and
  specialized controls (mazy1998, #1287).
@@ -1,4 +0,0 @@
 - A Street Level provider whose `zoomFor` still answers `{zoom, kind}`, the
  shape before the core went slim, draws its lines again instead of a silent
  blank; an overview level or any answer that is not a whole zoom shows the
  zoom-in hint (asturksever, #1288).
@@ -1,14 +0,0 @@
 - Add the S2 GhostMaps layer: S2 Underground's public KMZ intel products
  (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran
  and Yemen products and the newest incident drop) from
  github.com/s2underground/GhostMaps, with one chip per product and report
  cards on click. `/api/ghostmaps` watches the repository's branch head every
  15 s and pushes each new commit to open pages, which reload only the
  products that changed (Black Pine Defense).
 - Clear a temporary GhostMaps upstream error and notify open pages when the
  repository becomes reachable again, including when no new edition was published.
 - Release packed-image resources when a load is cancelled or fails, respect
  injected or omitted GhostMaps sources, and wait for background cache warm-up
  before removing provider test fixtures.
 - Include Simplified Chinese translations and keep the combined voice prompt
  within its existing size limit while retaining all spoken aliases.
@@ -1,4 +0,0 @@
 - Add Simplified Chinese (zh-CN) to the language picker, with localized dates
  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
  and @EDIT-Aeterna (#979).
  (German, @gekh, #1298).
@@ -1,5 +0,0 @@
 - Add a shared Voice Preview and Settings panel with browser-local preferences,
  inactivity controls and accessible floating provider controls on compact layouts;
  recover inactivity after confirmed audio-less replies, release retired audio
  observers and keep cost warnings visible outside Settings
  (manjunath22466, #1299).
@@ -1,5 +0,0 @@
 - Unify segmented selectors for model coverage, detection allocation, drawing
  shape, Street View and imagery comparison while preserving their existing
  behavior. Keep compact labels such as FILL and FLAT on one line, and let
  collapsed Weather release space to the open rail panel. Reserve the full mode
  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).
@@ -1,3 +0,0 @@
 - Give ordinary Scene and CCTV actions shared native buttons with consistent
  default, destructive and compact styling while preserving their existing
  behavior and specialized controls (mazy1998, #1302).
@@ -1,2 +0,0 @@
 - `get_wind` flags stale forecasts (`stale`) when the wind proxy serves a
  cached model run (quanticsoul4772, #1303).
@@ -1,2 +0,0 @@
 - Point distances wrap longitude differences across the antimeridian, in voice
  proximity checks and `places_nearby` (quanticsoul4772, #1304).
@@ -1,3 +0,0 @@
 - Share native dropdown and numeric-field styling across Scene, CCTV, Display
  and Radio controls, with a shared CCTV number-input builder that preserves
  existing precision, validation and commit behavior (mazy1998, #1305).
@@ -1,4 +0,0 @@
 - Share read-only status badge presentation across CCTV source/frame labels,
  calibration provenance and Weather coverage, preserving status meanings,
  palettes, translations and announcements while preparing the view contract
  for a future Vue migration (mazy1998, #1306).
@@ -1,3 +0,0 @@
 - Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
  while Radio and Cyber supply explicit field palettes without changing the
  current appearance or native control behavior (mazy1998, #1309).
@@ -1 +0,0 @@
 - Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).
@@ -1,6 +0,0 @@
 - Remove dead code across the repository: three modules nothing imports
  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
  and locals nothing reads, a duplicate copy of the bundled dams data and an
  unused ship model. The app no longer builds an unused default wind layer
  and Bhote Koshi locator layer when it loads. Package exports are unchanged
  (samehkhamis, #1321).
@@ -1,8 +0,0 @@
 - Export the KartaView and Panoramax Street Level providers, so a host composing
  its own provider list can offer the keyless providers without Mapillary
  (samehkhamis, #1324).
 - A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
  token itself (such as a same-origin proxy). Its sequence lookups go there
  through the source's transport, and the photo viewer uses MapillaryJS's
  Graph provider at that endpoint, so no client token is needed in the page
  (samehkhamis, #1324).
@@ -1,4 +0,0 @@
 - Add a phone layout for viewports 720px and narrower: the globe stays full
  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
  panel sheet at a time, keeping attribution visible and scene STOP reachable.
  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).
@@ -1,3 +0,0 @@
 - Evict terrain-height cache entries in fetch-time order without repeatedly
  sorting the full cache, while keeping refreshed points newest and ordering
  restored entries by their fetch time (daikaginza, #1326).
@@ -1,4 +0,0 @@
 - Improve touch selection of aircraft and vessels through the shared contact
  picker, reveal tracked aircraft details when opening Context, support downward
  swipe dismissal of phone drawers while preserving scrolling and controls, and
  enlarge the phone logo (samehkhamis, #1338).
@@ -1,3 +0,0 @@
 - Carry HUD LAT/LON seconds that round up to 60.00" into the minutes and
  degrees, so longitude -122.35 reads `122°21'00.00"W` instead of
  `122°20'60.00"W` (rudycelekli, #1339).
@@ -1,3 +0,0 @@
 - Read a hemisphere letter that is separated from its number, so a search for
  `40.7128 N 74.0060 W` flies there instead of falling through to the geocoders
  (Rudy Celekli, @rudycelekli, #1340).
@@ -1,3 +0,0 @@
 - Reject impossible KartaView photo timestamps, so 31 February is unknown
  instead of rolling forward into March and passing the imagery date filter
  (Rudy Celekli, @rudycelekli, #1341).
@@ -1,3 +0,0 @@
 - Keep an impossible wildfire acquisition date off the detection clock, so a
  fire is not labeled with a later day it did not happen
  (Rudy Celekli, @rudycelekli, #1342).
@@ -1,4 +0,0 @@
 - Phrase slight and sharp ramps as directions, so a ramp reads "slightly left"
  instead of "on the slightly left", and a lane names its side in both
  the proxy response and localized browser instructions
  (Rudy Celekli, @rudycelekli, #1343).
@@ -0,0 +1,4 @@
 - Pause the HUD's camera readout while the page is hidden, as polled layers
  already do. An app embedded inline in a panel keeps both updating, because the
  panel's host can report the page as hidden while it is on screen (nu-stats,
  #1344).
@@ -1,3 +0,0 @@
 - Wake staged weather imagery on a 150 ms timer while waiting for readiness,
  avoiding a continuous render loop and cancelling the wake when work ends
  (@nu-stats, #1345).
@@ -1,3 +0,0 @@
 - Label NHC cyclone classifications by their published meanings: `PTC` is a
  post-tropical cyclone, `PC` a potential tropical cyclone, and subtropical
  systems arrive as `STS` and `STD` (rudycelekli, #1349).
@@ -1,3 +0,0 @@
 - Convert NHC cyclone movement speed from miles per hour to knots, so
  `movement.speedKt` in cyclone query results is no longer about 15% high
  (rudycelekli, #1350).
@@ -1,6 +0,0 @@
 - Keep a tracked vessel's speed, course, heading and fix time when AISStream
  static data arrives; the static message only merges name, type, destination
  and IMO (rudycelekli, #1351).
 - Apply changed static metadata immediately, retaining known fields when a
  later static report omits them, without refreshing the vessel's position
  (samehkhamis, #1351).
@@ -1,3 +0,0 @@
 - Read a destination heading that rounds to north as 000. 359.6° was shown as
  360° on the destination bearing while the compass tape already uses 000
  (Rudy Celekli, @rudycelekli, #1352).
@@ -1,3 +0,0 @@
 - Count a transit report that is 90 seconds old as one minute. The card kept
  seconds through 89s, then rounded 90s up to "Reported 2 min ago"
  (Rudy Celekli, @rudycelekli, #1353).
@@ -1,3 +0,0 @@
 - Drop the decimal when fire radiative power rounds to 10 MW. A 9.96 MW
  detection was labeled 10.0 MW because the one-decimal cutoff ran before
  rounding (Rudy Celekli, @rudycelekli, #1354).
@@ -1,5 +0,0 @@
 - Aircraft 3D models (Flights, Military Flights, Local ADS-B) skip Cesium's
  dynamic environment map, a sky render and GPU readback per model. With
  ~150 models in the scene at Atlanta on Google 3D, GPU time per frame at
  rest falls from 14.3-14.8 ms to 12.1-12.5 ms; a same-model comparison
  showed no visible change (quanticsoul4772, #1366).
@@ -1,4 +0,0 @@
 - Turning a layer off frees the memory its entities held. Cesium kept
  removed layers' draw commands in reused per-pass arrays, so Data Centers
  kept 116 MiB after it was switched off, submarine cables 74 MiB and dams
  30 MiB; they now keep 13, 9 and 9 MiB (quanticsoul4772, #1367).
@@ -0,0 +1,4 @@
 - Restore a shot's declared layer visibility when seeking within it after manual
  layer changes, including toggles still in flight. Only changed layers are
  reconciled; refused restoration reports a failed seek and keeps the last
  position, while undeclared operator layers are preserved (@oneill9, #1374).
@@ -1,5 +0,0 @@
 - Increase touch-first globe zoom sensitivity to three times the default while
  retaining Cesium collision and distance limits.
 - Reuse one delayed display timestamp per civil-aircraft fleet update and cache
  extrapolation coordinate frames until their fix coordinates change. Preserve
  contact counts, movement cadence, tracked motion and ground corrections.
@@ -1,4 +0,0 @@
 - Reduce repeated work in aircraft detection candidates by caching unchanged
  callsign/registration text and reusing resolved fleet models. Metadata updates,
  live positions and tracked-aircraft/model handoffs remain immediate
  (samehkhamis, #1379).
		`@@ -1,2 +0,0 @@`
			`- Exclude aircraft without a reported altitude from requested altitude bands;`
			`unfiltered aircraft queries still retain them (rudycelekli, #1115).`
		`@@ -1,2 +0,0 @@`
			`- Add continuous globe rotation with direction and speed controls and a globe-fit`
			`check before starting (manjunath22466, #1225).`
		`@@ -1,2 +0,0 @@`
			`- Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).`
			`- Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).`
		`@@ -1 +0,0 @@`
			`- Coalesce refreshes and cool down opensky failures (asturksever, #1269).`
		`@@ -1 +0,0 @@`
			`- Respect provider cooldowns and bound tle groups (asturksever, #1270).`
		`@@ -1 +0,0 @@`
			`- Reject inherited style keys during restore (asturksever, #1271).`
		`@@ -1 +0,0 @@`
			`- Normalize geocoder bias across the antimeridian (asturksever, #1272).`
		`@@ -1 +0,0 @@`
			`- Retire unavailable history and keep local trails (asturksever, #1273).`
		`@@ -1 +0,0 @@`
			`- Scan the kml root delimiter in bounded time (asturksever, #1274).`
		`@@ -1 +0,0 @@`
			`- Bound each height request to one upstream chunk (asturksever, #1276).`