diff --git a/.env.example b/.env.example
index a2f8afa24..5ddf78383 100644
--- a/.env.example
+++ b/.env.example
@@ -118,8 +118,8 @@ OPENSKY_AUTH_MODE=oauth
 OPENSKY_CLIENT_ID=
 OPENSKY_CLIENT_SECRET=
 
-# Optional: higher Launch Library 2 request allowance. Public access works
-# without a token.
+# Launch Library 2: leave blank for standard public access (no key needed).
+# Optional paid Patreon tokens raise request limits; there is no free API key.
 LL2_API_TOKEN=
 
 # Optional: OpenSky credentials JSON file path (alternative to above)
diff --git a/README.md b/README.md
index c49c53ece..c3c3d7ef3 100644
--- a/README.md
+++ b/README.md
@@ -385,7 +385,7 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 | 🚲 **Bikeshare**            | Live station availability                                                                                                                                                                                                                                                                                                                                                           | GBFS                                    | 🟢                                                                                                  |
 | 🧭 **Directions**           | Click A and B on the globe for a street-following drive, walk or cycle route draped on the terrain with turn-by-turn steps — then FLY the camera along it. No key, no geocoder, no mic                                                                                                                                                                                              | OSRM on FOSSGIS servers (OpenStreetMap) | 🟢                                                                                                  |
 | 🔥 **Active Fires**         | Live NASA FIRMS detections, trailing 24h                                                                                                                                                                                                                                                                                                                                            | NASA FIRMS                              | 🟡                                                                                                  |
-| 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🟡 optional token raises the allowance)                                                         |
+| 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🔴 optional paid token raises the allowance)                                                         |
 | 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way                                                                                                                                                                                                                                                                          | OpenStreetMap                           | 🟢                                                                                                  |
 | 🌬️ **Wind**                 | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center                                                                                                                                                                                                                                                                 | NOAA GFS / ECMWF IFS                    | 🟢                                                                                                  |
 | 🌦️ **Observed Weather**     | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline                                                                                                                                                                                                     | NOAA nowCOAST                           | 🟢                                                                                                  |
@@ -527,9 +527,11 @@ _What the TomTom key buys you: rush-hour density painted on the city — then di
 |     | Key                  | Why                                                           | Get it                                             |
 | --- | -------------------- | ------------------------------------------------------------- | -------------------------------------------------- |
 | 🟡  | **OpenSky**          | ✈️ More flight-polling credits (🟢 anonymous works without)   | [opensky-network.org](https://opensky-network.org) |
-| 🟡  | **Launch Library 2** | 🚀 Higher space-missions request allowance (🟢 works without) | [thespacedevs.com](https://thespacedevs.com)       |
+| 🔴  | **Launch Library 2** | 🚀 Optional paid token for higher limits (🟢 no key needed for public access) | [thespacedevs.com/supportus](https://thespacedevs.com/supportus) |
 
 Add these if you need higher polling allowances.
+Leave `LL2_API_TOKEN` blank for standard public access. LL2 tokens are optional
+paid Patreon upgrades for higher limits; there is no free API-key signup.
 
 `npm run doctor` reports Node/npm readiness, the primary provider routes, and
 where each configured provider was found without printing credential values.
diff --git a/SECURITY.md b/SECURITY.md
index e53883548..b694d8dcd 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -73,7 +73,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
 - **Redacted debug logging.** The voice debug log (`.gev-logs/`, gitignored) strips API keys, bearer tokens, client secrets, and image data URLs before writing.
-- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control.
+- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless terrain route (`/api/terrain/heights`) uses the same cross-site checks, minus the forwarding-header refusal: it guards only the per-client quota and point cache, not a key or a bill, and the map needs it to render behind a reverse proxy.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads and the Maps JavaScript API that Street View runs on, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
 
 Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance.
diff --git a/changelog.d/1197-launch-library-provider-guidance.md b/changelog.d/1197-launch-library-provider-guidance.md
new file mode 100644
index 000000000..34cbe299e
--- /dev/null
+++ b/changelog.d/1197-launch-library-provider-guidance.md
@@ -0,0 +1,5 @@
+- Share Launch Library request cache keys across installations refreshing in the
+  same UTC minute, identify the app to the provider, and explain that standard
+  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
+  upgrades; existing local cache and server-only token handling are unchanged
+  (rudycelekli, #1197).
diff --git a/changelog.d/1199-launch-cache-provenance.md b/changelog.d/1199-launch-cache-provenance.md
new file mode 100644
index 000000000..04f33cb7f
--- /dev/null
+++ b/changelog.d/1199-launch-cache-provenance.md
@@ -0,0 +1,3 @@
+- Keep Space Missions marked STALE when Launch Library 2 falls back to cached
+  launch data, and return to NOMINAL after a fresh response without discarding
+  retained missions (rudycelekli, #1199).
diff --git a/changelog.d/686-terrain-heights-bounds.md b/changelog.d/686-terrain-heights-bounds.md
new file mode 100644
index 000000000..7e0004069
--- /dev/null
+++ b/changelog.d/686-terrain-heights-bounds.md
@@ -0,0 +1,9 @@
+- Bound what a caller can grow through `/api/terrain/heights`. Every distinct
+  5-decimal point was a permanent in-memory entry, a permanent line in an
+  uncapped `.gev-cache/terrain-heights.json`, and a live upstream call, with
+  nothing limiting the rate. The point cache now holds at most 50,000 entries
+  and evicts oldest-first, a cache file above
+  24 MB is not read back, and the route is limited to 90 requests/minute per
+  client (270 global). Evicting a point costs one refetch, never a wrong
+  answer, since terrain does not move. Ordinary use is unaffected: a full
+  `test:track` run drives 10 requests, peaking at 8/min (daikaginza, #686).
diff --git a/changelog.d/975-terrain-cross-site-gate.md b/changelog.d/975-terrain-cross-site-gate.md
new file mode 100644
index 000000000..6c0e42156
--- /dev/null
+++ b/changelog.d/975-terrain-cross-site-gate.md
@@ -0,0 +1,8 @@
+- Cross-site pages can no longer fill the terrain-height cache or spend the
+  visitor's own `/api/terrain/heights` rate-limit quota through the visitor's
+  browser. The route refuses a cross-site `Sec-Fetch-Site` or a foreign or
+  opaque `Origin` before rate limiting, cache access or upstream work. Unlike
+  the cost-bearing routes it still answers same-origin requests that arrive
+  through a reverse proxy, so terrain keeps rendering behind nginx, Caddy or
+  Cloudflare instead of falling back to the geoid (Sunil56224972, daikaginza,
+  #975).
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index a7e191f8a..5b448247d 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -819,7 +819,11 @@ position stay off the map. Genuine zero coordinates remain valid. Undisclosed
 stage coordinates, downrange distance and flight numbers remain unknown; the
 mission panel omits the flight-number label when no number was reported.
 Pending mission requests abort on disable/destruction and malformed launch
-snapshots preserve the last accepted display. Catalog groups, propagation cadence,
+snapshots preserve the last accepted display. A Launch Library stale-cache fallback
+retains its missions but reports STALE in Data Layers; a fresh snapshot clears that
+provenance. Hiding retained missions does not relabel them as fresh, and teardown
+clears the instance state. Injected getLaunches-only sources remain supported.
+Catalog groups, propagation cadence,
 tracking intent, replay timing, controls and source attribution remain unchanged.
 
 The fire layer now exposes `./layers/firms`: an instance factory with separate
@@ -1448,6 +1452,18 @@ an empty dock. Explicit zero and caller-supplied numeric fallbacks remain valid.
 
 ## Terrain height cache bound
 
+The `/api/terrain/heights` route refuses cross-site browser requests before
+rate limiting, cache access or upstream work: a `Sec-Fetch-Site` other than
+`same-origin`/`none` (an `<img>` on another page), or a foreign or opaque
+`Origin`, gets `403`. The per-client limiter keys on the socket address, which
+for such a request is the visitor's own browser, so without the gate any page
+could spend the visitor's 90/min quota and leave the app's own lookups on
+`429`. Unlike the cost-bearing routes, the terrain gate does not refuse
+reverse-proxy forwarding headers: terrain is keyless and needed for rendering,
+and a `403` there would send every chunk to the geoid fallback for an instance
+served behind the documented reverse proxy. Same-origin app requests,
+non-browser local callers and proxied same-origin requests keep working.
+
 The terrain proxy parser rejects finite longitudes outside [-180, 180] and
 latitudes outside [-90, 90] for every client before upstream resolution. One
 out-of-range point rejects the whole batch; inclusive WGS84 bounds remain valid.
@@ -1485,6 +1501,14 @@ The Node-only `gods-eye-view/server/providers/space` export supplies factories;
 `sources/space` supplies fixed upstream URL builders with no I/O or environment
 access. Callers retain validation, transport and response policy.
 
+LL2 recent-launch requests use UTC minute-aligned bounds over the same 30-day
+window, so installations refreshing in the same minute share an upstream cache
+key. The upper bound trails the current time by less than one minute. Requests
+identify the app and repository through User-Agent; the existing 15-minute local
+cache, stale fallback and optional server-only Authorization remain unchanged.
+Provider Settings identifies LL2 tokens as optional paid higher-rate upgrades:
+standard public access needs no key, and its field can remain blank.
+
 The shared TLE text parser skips incomplete named sets and resumes at the next
 complete set. A missing orbital line does not discard the later satellites in
 the catalog. A set whose two lines carry different catalog numbers, or a
@@ -2671,6 +2695,17 @@ down | auth-failed` (plus the unchanged `missing-key`/`unsupported`) with
 >   tunings. Ambient overlap includes each sprite's own rendered extent. The
 >   gated AIS, CCTV, and satellite passes retain an active-emphasis count so a
 >   settled dim contact always completes its release after tracking ends.
+> - **Terrain-height bounds:** because every distinct 5-decimal point is its own
+>   cache key, its own line in `.gev-cache/terrain-heights.json`, and its own
+>   upstream call, four limits bound what a caller can grow. Coordinates outside
+>   WGS-84 range are rejected with `400` at parse (finite is not the same as on
+>   Earth); the point cache holds at most 50,000 entries, evicting oldest-first
+>   — terrain does not move, so an evicted point costs one refetch and never a
+>   wrong answer; a cache file above 24 MB is not read back into memory (the
+>   ceiling `rocketLaunchesProxy` already applies); and the route carries an
+>   always-on limiter of 90 requests/minute/client, 270 global. That cap is an
+>   order of magnitude above measured demand — a full `npm run test:track` run
+>   drove 10 requests, peaking at 8/min.
 > - **Terrain-height resilience:** `/api/terrain/heights` caches canonical
 >   5-decimal points individually, reconstructs reordered/overlapping batches
 >   in exact request order, and refreshes only missing or stale points. Upstream
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 9b5b893bd..b353f7067 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -96,6 +96,7 @@
   "server/providers/space/launch-library.js",
   "src/data/spaceProviderRequests.js",
   "src/tooling/spaceProviders.test.mjs",
+  "src/tooling/ll2Integration.test.mjs",
   "server/providers/terrain.js",
   "server/providers/traffic.js",
   "server/providers/firms.js",
@@ -446,6 +447,7 @@
   "src/data/rocketLaunches.js",
   "src/layers/satellites/source.test.mjs",
   "src/layers/launches/source.test.mjs",
+  "src/layers/launches/ingestion.test.mjs",
   "src/layers/installations/lifecycle.js",
   "src/layers/installations/viewport.js",
   "src/layers/installations/controls.js",
@@ -1063,5 +1065,6 @@
   "src/ui/flyToDataSource.test.mjs",
   "scripts/assemble-changelog.mjs",
   "src/tooling/changelogFragments.test.mjs",
-  "src/data/gbfsProxyRateLimit.test.mjs"
+  "src/data/gbfsProxyRateLimit.test.mjs",
+  "src/terrainHeightsBounds.test.mjs"
 ]
diff --git a/scripts/package-boundaries.json b/scripts/package-boundaries.json
index 07f2545a3..627c9307f 100644
--- a/scripts/package-boundaries.json
+++ b/scripts/package-boundaries.json
@@ -114,7 +114,11 @@
     "exports": ["./server/providers/terrain"],
     "modules": [
       "server/providers/terrain.js",
-      "src/data/terrainHeightsProxy.js"
+      "src/data/terrainHeightsProxy.js",
+      "server/providers/common/rate-limit.js",
+      "src/sources/rateLimit.js",
+      "server/providers/common/same-site.js",
+      "src/localRequestGate.mjs"
     ],
     "external": []
   },
diff --git a/server/providers/common/same-site.js b/server/providers/common/same-site.js
index 11e9d37b4..c5aeb610f 100644
--- a/server/providers/common/same-site.js
+++ b/server/providers/common/same-site.js
@@ -41,3 +41,48 @@ export function sameSiteGated(handler) {
     return handler(req, res, next);
   };
 }
+
+/**
+ * Proxy header values arrive client-controlled; read one only when it is a
+ * single scheme token, never a comma-separated chain.
+ * @param {import('node:http').IncomingMessage} req
+ * @returns {'http:'|'https:'}
+ */
+function forwardedProtocol(req) {
+  if (req.socket?.encrypted) return 'https:';
+  const proto = String(req.headers?.['x-forwarded-proto'] || '')
+    .trim()
+    .toLowerCase();
+  return proto === 'https' ? 'https:' : 'http:';
+}
+
+/**
+ * Cross-site gate for keyless routes the map needs in order to render
+ * (`/api/terrain/heights`). It refuses the same cross-site browser shapes as
+ * `admitSameSite` (a `Sec-Fetch-Site` other than same-origin/none, a foreign
+ * or opaque `Origin`) but does not refuse reverse-proxy forwarding headers:
+ * those protect credentials and spend, which a keyless route has neither of,
+ * and refusing them would break rendering for an instance served behind the
+ * reverse proxy the README documents. A single `X-Forwarded-Proto` supplies
+ * the scheme an `Origin` is compared against. That header cannot be attached
+ * to a cross-site browser request without a CORS preflight this server never
+ * answers, and `Sec-Fetch-Site` is still enforced regardless.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @returns {boolean} True when a 403 was sent.
+ */
+export function admitSameSiteKeyless(req, res) {
+  const verdict = admitSameSiteRequest({
+    hostHeader: req.headers?.host,
+    protocol: forwardedProtocol(req),
+    origin: req.headers?.origin,
+    secFetchSite: req.headers?.['sec-fetch-site'],
+    proxyHeaders: {},
+  });
+  if (verdict.ok) return false;
+  res.statusCode = verdict.status;
+  res.setHeader('Content-Type', 'application/json');
+  res.setHeader('Cache-Control', 'no-store');
+  res.end(JSON.stringify({ error: verdict.error }));
+  return true;
+}
diff --git a/server/providers/space/launch-library.js b/server/providers/space/launch-library.js
index 50825df03..7b56b6220 100644
--- a/server/providers/space/launch-library.js
+++ b/server/providers/space/launch-library.js
@@ -13,6 +13,8 @@ export function launchLibraryRequestHeaders(token = process.env.LL2_API_TOKEN) {
   const normalized = String(token || '').trim();
   return {
     Accept: 'application/json',
+    'User-Agent':
+      'gods-eye-view-launch-library-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
     ...(normalized ? { Authorization: `Token ${normalized}` } : {}),
   };
 }
diff --git a/server/providers/terrain.js b/server/providers/terrain.js
index e58a63ea5..32083d23a 100644
--- a/server/providers/terrain.js
+++ b/server/providers/terrain.js
@@ -8,6 +8,8 @@ import {
   terrainPointKey,
   validTerrainResult,
 } from '../../src/data/terrainHeightsProxy.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import { admitSameSiteKeyless } from './common/same-site.js';
 
 /**
  * Re:Earth terrain point-height proxy: batched lon/lat → ellipsoidal height
@@ -20,11 +22,31 @@ import {
  * Only missing/stale points go upstream; the response is rebuilt in exact
  * request order. Larger requests are chunked sequentially, and one failing
  * chunk does not discard the chunks that resolved.
+ *
+ * Bounds, because every distinct 5dp point is its own key: coordinates must be
+ * in WGS-84 range (rejected at parse), the point cache has an entry ceiling
+ * with oldest-first eviction, an over-large cache file is not read back, and
+ * the route carries an always-on per-client limiter. The route also refuses
+ * cross-site browser requests, so another web page cannot use the visitor's
+ * browser to fill the cache or spend the visitor's own rate-limit quota.
+ * Reverse-proxied same-origin requests are admitted: terrain is keyless and
+ * needed for rendering, and a 403 would send every chunk to the geoid fallback.
  */
-export function terrainHeightsProxy() {
+export function terrainHeightsProxy(options = {}) {
+  // Destructured in the body, not the signature: `proxyErrorResponses.test.mjs`
+  // extracts these proxies by slicing to the first closing brace in column
+  // zero, so a multi-line parameter list would cut the function in half.
+  // Overridable so the ceilings can be exercised as behaviour rather than
+  // asserted as constants; production constructs this with no arguments.
+  const {
+    cacheMaxEntries = 50_000,
+    cacheMaxDiskBytes = 24 * 1024 * 1024,
+    cachePath,
+  } = options;
   const TTL_MS = 30 * 24 * 3600_000;
-  const CACHE_DIR = path.join(process.cwd(), '.gev-cache');
-  const CACHE_PATH = path.join(CACHE_DIR, 'terrain-heights.json');
+  const CACHE_PATH =
+    cachePath || path.join(process.cwd(), '.gev-cache', 'terrain-heights.json');
+  const CACHE_DIR = path.dirname(CACHE_PATH);
   // Sized against measured upstream latency, not the documented page cap.
   // Re:Earth serves 87-186 ms/point depending on load (observed 2026-09-12,
   // a 2x swing within one hour). 256 points therefore costs 22-48 s and blows
@@ -34,9 +56,50 @@ export function terrainHeightsProxy() {
   // that range.
   const UPSTREAM_CHUNK = 64;
   const MAX_POINTS = 2000;
+  /**
+   * Entry ceiling for the point cache, and with it the file written from it.
+   *
+   * Every distinct 5dp point is a separate key, so without a ceiling the map
+   * — and the JSON dumped from it verbatim — grow for as long as a caller
+   * supplies new coordinates. Measured against real use rather than guessed:
+   * this checkout's `.gev-cache/terrain-heights.json` held 6,189 entries in
+   * 1.0 MB after ordinary sessions, i.e. ~168 bytes/entry. 50,000 entries is
+   * eight times that working set and ~8 MB on disk, comfortably inside the
+   * 24 MB ceiling `rocketLaunchesProxy` already applies to its own cache file.
+   */
+  const CACHE_MAX_ENTRIES = cacheMaxEntries;
+  /** Refuse to load a cache file larger than this (mirrors rocketLaunchesProxy). */
+  const CACHE_MAX_DISK_BYTES = cacheMaxDiskBytes;
+  /**
+   * Requests/min/client. Terrain is keyless and free, so this guards the point
+   * cache and the upstream community service rather than a bill. Sized from
+   * measurement: across a full `npm run test:track` run — the heaviest
+   * exercise this app has — the route served 10 requests, peaking at 8/min.
+   * 90/min is an order of magnitude above that, and the band `/api/overpass`
+   * and `/api/military-installations` already use.
+   */
+  const RATE_PER_MIN = 90;
+  const allow = makeRateLimiter({
+    windowMs: 60_000,
+    max: RATE_PER_MIN,
+    globalMax: RATE_PER_MIN * 3,
+  });
 
   /** @type {Map<string, {at:number, result:object}>} keyed by canonical 5dp lon/lat. */
   const mem = new Map();
+
+  /**
+   * Drop the oldest entries until the map is back inside its ceiling.
+   * Oldest-first by fetch time, the same shape `trackBackfillProxies` uses.
+   * Terrain does not move, so evicting an old point costs one refetch, never
+   * a wrong answer.
+   */
+  function evictOverflow() {
+    if (mem.size <= CACHE_MAX_ENTRIES) return;
+    const byAge = [...mem.entries()].sort((a, b) => a[1].at - b[1].at);
+    for (let i = 0; i < byAge.length && mem.size > CACHE_MAX_ENTRIES; i += 1)
+      mem.delete(byAge[i][0]);
+  }
   /** @type {Map<string, Promise<Array<object>>>} single-flight per missing-point subset. */
   const inflight = new Map();
   let diskLoaded = false;
@@ -47,6 +110,21 @@ export function terrainHeightsProxy() {
     if (diskLoaded) return;
     diskLoaded = true;
     try {
+      // A cache file past the ceiling is not read back into memory: loading it
+      // would reinstate exactly the unbounded map the ceiling exists to stop.
+      // The next flush rewrites a bounded one.
+      //
+      // "Cannot measure it" is not "too large": if stat is unavailable, fall
+      // through and let readFile decide, so an absent file behaves exactly as
+      // it did before this guard existed.
+      let sizeBytes = null;
+      try {
+        sizeBytes = (await fsp.stat(CACHE_PATH)).size;
+      } catch {
+        sizeBytes = null;
+      }
+      if (sizeBytes !== null && sizeBytes > CACHE_MAX_DISK_BYTES)
+        throw new Error('cache file too large');
       const parsed = JSON.parse(await fsp.readFile(CACHE_PATH, 'utf8'));
       const pointEntries =
         parsed?.version === 2 &&
@@ -87,6 +165,7 @@ export function terrainHeightsProxy() {
         }
         diskDirty = mem.size > 0;
       }
+      evictOverflow();
     } catch {
       /* no disk cache yet */
     }
@@ -157,12 +236,25 @@ export function terrainHeightsProxy() {
 
   const installMiddleware = (server) => {
     server.middlewares.use('/api/terrain/heights', async (req, res) => {
+      // Refuse cross-site browser requests (an <img> or fetch from another
+      // site) before the limiter, cache or upstream see them. Same-origin app
+      // requests, non-browser loopback callers (MCP panel_request) and the app
+      // served behind a reverse proxy pass.
+      if (admitSameSiteKeyless(req, res)) return;
       const send = (status, bodyObj) => {
         if (res.headersSent) return;
         res.writeHead(status, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify(bodyObj));
       };
       try {
+        if (!allow(clientKey(req))) {
+          res.writeHead(429, {
+            'Content-Type': 'application/json',
+            'Retry-After': '10',
+          });
+          res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+          return;
+        }
         await loadDiskOnce();
         const parsedUrl = new URL(req.url || '', 'http://internal');
         const rawPoints = parsedUrl.searchParams.get('points');
@@ -187,7 +279,10 @@ export function terrainHeightsProxy() {
           fetchMissing: fetchMissingSingleFlight,
           ttlMs: TTL_MS,
         });
-        if (outcome.cacheChanged) diskDirty = true;
+        if (outcome.cacheChanged) {
+          evictOverflow();
+          diskDirty = true;
+        }
         if (outcome.upstreamError) {
           console.warn(
             '[terrain-heights-proxy] refresh incomplete' +
diff --git a/src/data/regionalProxy.test.mjs b/src/data/regionalProxy.test.mjs
index acc1b1a22..97891bef8 100644
--- a/src/data/regionalProxy.test.mjs
+++ b/src/data/regionalProxy.test.mjs
@@ -59,9 +59,13 @@ test('new data proxies install the same routes in dev and preview servers', () =
 
 test('Launch Library uses a 15-minute cache and optional server-side token header', () => {
   assert.equal(LL2_CACHE_TTL_MS, 15 * 60_000);
-  assert.deepEqual(launchLibraryRequestHeaders(''), { Accept: 'application/json' });
-  assert.deepEqual(launchLibraryRequestHeaders(' secret '), {
+  const headers = {
     Accept: 'application/json',
+    'User-Agent': 'gods-eye-view-launch-library-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
+  };
+  assert.deepEqual(launchLibraryRequestHeaders(''), headers);
+  assert.deepEqual(launchLibraryRequestHeaders(' secret '), {
+    ...headers,
     Authorization: 'Token secret',
   });
 });
diff --git a/src/data/spaceProviderRequests.js b/src/data/spaceProviderRequests.js
index 8e3030f97..e0f1707f4 100644
--- a/src/data/spaceProviderRequests.js
+++ b/src/data/spaceProviderRequests.js
@@ -7,10 +7,12 @@ export function celestrakTleUrl(group) {
 }
 
 export function launchLibraryRecentUrl(end) {
-  const start = new Date(end.getTime() - 30 * 86400000);
+  // Stable minute boundaries let different installations share LL2's cache.
+  const roundedEnd = new Date(Math.floor(end.getTime() / 60000) * 60000);
+  const start = new Date(roundedEnd.getTime() - 30 * 86400000);
   const url = new URL('https://ll.thespacedevs.com/2.3.0/launches/');
   url.searchParams.set('net__gte', start.toISOString());
-  url.searchParams.set('net__lte', end.toISOString());
+  url.searchParams.set('net__lte', roundedEnd.toISOString());
   url.searchParams.set('limit', '100');
   url.searchParams.set('mode', 'detailed');
   return url;
diff --git a/src/i18n/locales/es.json b/src/i18n/locales/es.json
index b5b0a3abb..f93f42070 100644
--- a/src/i18n/locales/es.json
+++ b/src/i18n/locales/es.json
@@ -842,7 +842,8 @@
   "Real live traffic (keyless runs a simulation)": "Tráfico real en vivo (sin clave se usa una simulación)",
   "Bing imagery map stacks + world terrain": "Imágenes de Bing + terreno mundial",
   "More flight-polling credits (anonymous works without)": "Más créditos de consulta de vuelos (sin clave funciona el modo anónimo)",
-  "Higher space-missions request allowance": "Mayor límite de peticiones para misiones espaciales",
+  "Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.": "El acceso público a misiones espaciales no necesita clave. Déjalo en blanco para el uso estándar; los tokens de pago solo aumentan los límites de solicitudes.",
+  "Optional paid token — public access works without one": "Token opcional de pago — el acceso público funciona sin él",
   "Scene action failed": "La acción de escena falló",
   "Project exported": "Proyecto exportado",
   "Next session: {pendingId} — this session stays on {modelId}": "Sesión siguiente: {pendingId} — esta sesión sigue en {modelId}",
diff --git a/src/i18n/locales/ru.json b/src/i18n/locales/ru.json
index 019415690..6a58ab901 100644
--- a/src/i18n/locales/ru.json
+++ b/src/i18n/locales/ru.json
@@ -74,7 +74,8 @@
   "Removed from {store}. Restarting — this page reloads itself.": "Удалено: {store}. Перезапуск — страница перезагрузится сама.",
   "More flight-polling credits (anonymous works without)": "Повышенный лимит запросов рейсов (анонимно работает и без ключа)",
   "Street-level imagery and coverage in the Street Level layer. Free: register an app in the Mapillary developer dashboard and paste its Client Token": "Уличные снимки и покрытие в слое «Уличные снимки». Бесплатно: зарегистрируйте приложение в панели разработчика Mapillary и вставьте его клиентский токен (Client Token).",
-  "Higher space-missions request allowance": "Повышенный лимит запросов для космических миссий",
+  "Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.": "Общедоступные данные космических миссий не требуют ключа. Для обычного использования оставьте поле пустым; платные токены только повышают лимиты запросов.",
+  "Optional paid token — public access works without one": "Необязательный платный токен — публичный доступ работает без него",
   "Places context + Street View fallback; optional separate key": "Контекст Places + резерв: Просмотр улиц; отдельный ключ — по желанию",
   "Voice control — API key or ChatGPT OAuth": "Голосовое управление — ключ API или ChatGPT OAuth",
   "Live ships, worldwide": "Суда в реальном времени по всему миру",
diff --git a/src/keySetup.js b/src/keySetup.js
index aab3d62b0..b67c9df66 100644
--- a/src/keySetup.js
+++ b/src/keySetup.js
@@ -215,7 +215,7 @@ export function stripKeylessBasemapFromHash(hash) {
   }
 }
 
-const TIER_DOTS = Object.freeze({ metered: '🔴', free: '🟡' });
+const TIER_DOTS = Object.freeze({ metered: '🔴', paid: '🔴', free: '🟡' });
 
 function updateCloudVoiceAuthControl(auth, busy = false) {
   const mode = readStoredCloudVoiceAuthMode();
@@ -259,7 +259,9 @@ function buildRow(documentRef, key) {
   tier.title =
     key.tier === 'metered'
       ? t('Metered — a billing-enabled account')
-      : t('Free key — register, paste, done');
+      : key.tier === 'paid'
+        ? t('Optional paid token — public access works without one')
+        : t('Free key — register, paste, done');
   head.append(led, title, tier);
   if (key.clientExposed) {
     const exposed = documentRef.createElement('span');
diff --git a/src/keySetupCore.mjs b/src/keySetupCore.mjs
index 30c695370..10bbe32a5 100644
--- a/src/keySetupCore.mjs
+++ b/src/keySetupCore.mjs
@@ -29,7 +29,8 @@ export const KEY_SETUP_APPEND_HEADER =
 /**
  * Provider credentials, in display order — most magic per
  * minute first. `tier` mirrors the README's color legend: 'metered' (🔴) is a
- * billing-enabled account, 'free' (🟡) is a register-and-paste key.
+ * billing-enabled account, 'free' (🟡) is a register-and-paste key, and
+ * 'paid' (🔴) is an optional paid higher-rate token.
  * `clientExposed` marks the keys that are injected into the browser
  * bundle by design (restrict them at the provider, per SECURITY.md).
  * `hidden` keeps advanced configuration out of the panel and missing-key count.
@@ -119,10 +120,12 @@ export const KEY_SETUP_KEYS = Object.freeze([
   Object.freeze({
     id: 'launch-library',
     title: 'LAUNCH LIBRARY', // i18n-ignore: provider product name
-    unlocks: msg('Higher space-missions request allowance'),
-    getUrl: 'https://thespacedevs.com',
+    unlocks: msg(
+      'Public space-missions access needs no key. Leave blank for standard use; paid tokens only raise request limits.',
+    ),
+    getUrl: 'https://thespacedevs.com/supportus',
     envVars: Object.freeze(['LL2_API_TOKEN']),
-    tier: 'free',
+    tier: 'paid',
   }),
 ]);
 
diff --git a/src/layers/launches/controls.js b/src/layers/launches/controls.js
index d55394bcc..b0dc035cb 100644
--- a/src/layers/launches/controls.js
+++ b/src/layers/launches/controls.js
@@ -57,6 +57,7 @@ export function createControls({ state: layerState, services, parts, source }) {
         orbitMatches: layerState._orbitMatches,
         lastUpdate: layerState._lastUpdate,
         error: layerState._lastError,
+        stale: layerState._stale,
       };
     },
 
diff --git a/src/layers/launches/ingestion.js b/src/layers/launches/ingestion.js
index e7eab0565..bd1529c0b 100644
--- a/src/layers/launches/ingestion.js
+++ b/src/layers/launches/ingestion.js
@@ -168,9 +168,16 @@ export function createIngestion({
   async function performMissionUpdate(token) {
     try {
       ensureActiveTleLookup(token);
-      const payload = await source.getLaunches({
-        signal: layerState._sourceController.signal,
-      });
+      const { payload, stale } = source.getLaunchSnapshot
+        ? await source.getLaunchSnapshot({
+            signal: layerState._sourceController.signal,
+          })
+        : {
+            payload: await source.getLaunches({
+              signal: layerState._sourceController.signal,
+            }),
+            stale: false,
+          };
       const launches = parts.model.normalizeRocketLaunches(payload);
       if (
         !layerState._enabled ||
@@ -214,6 +221,7 @@ export function createIngestion({
       parts.panel.renderMissionPanel();
       layerState._lastUpdate = Date.now();
       layerState._lastError = null;
+      layerState._stale = stale === true;
     } catch (error) {
       if (layerState._enabled && token === layerState._lifecycleToken) {
         layerState._lastError = error.message;
diff --git a/src/layers/launches/ingestion.test.mjs b/src/layers/launches/ingestion.test.mjs
new file mode 100644
index 000000000..c19cb40e4
--- /dev/null
+++ b/src/layers/launches/ingestion.test.mjs
@@ -0,0 +1,315 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import * as Cesium from 'cesium';
+import { createLaunchSource } from './source.js';
+import { createState } from './state.js';
+import { createModel } from './model.js';
+import { createIngestion } from './ingestion.js';
+import { createControls } from './controls.js';
+import { createLifecycle } from './lifecycle.js';
+import { layerFeedState } from '../../data/feedState.js';
+
+const noop = () => {};
+
+async function fixture({ legacySource = false } = {}) {
+  const launch = {
+    id: 'owned-launch',
+    name: 'Owned mission fixture',
+    net: new Date(Date.now() - 3600000).toISOString(),
+    status: { name: 'Launch Successful' },
+    pad: { name: 'Owned pad', latitude: 28.6, longitude: -80.6 },
+    rocket: { payloads: [] },
+  };
+  const mode = { cache: 'HIT', results: [launch], hold: false };
+  let arrival;
+  let release;
+  const server = http.createServer((req, res) => {
+    if (req.url === '/api/celestrak/active') {
+      res.end('');
+      return;
+    }
+    assert.equal(req.url, '/api/launches');
+    const send = () => {
+      if (res.destroyed) return;
+      res.writeHead(200, {
+        'Content-Type': 'application/json',
+        'X-GEV-Cache': mode.cache,
+      });
+      res.end(JSON.stringify({ results: mode.results }));
+    };
+    if (mode.hold) {
+      release = send;
+      arrival?.();
+    } else send();
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const origin = `http://127.0.0.1:${server.address().port}`;
+  const launchSource = createLaunchSource({
+    fetchImpl: (url, options) => {
+      assert.ok(['/api/launches', '/api/celestrak/active'].includes(url));
+      return fetch(new URL(url, origin), options);
+    },
+  });
+  const source = legacySource
+    ? {
+        getLaunches: launchSource.getLaunches,
+        getActiveTle: launchSource.getActiveTle,
+      }
+    : launchSource;
+  const services = {
+    overlays: {
+      setOverlayEntries: noop,
+      setOverlaySourceVisible: noop,
+      clearOverlaySource: noop,
+    },
+    render: { holdContinuousRender: noop, releaseContinuousRender: noop },
+  };
+  const state = createState({ services });
+  state._enabled = true;
+  state._lifecycleToken = 1;
+  state._dataSource = new Cesium.CustomDataSource('owned-qualification');
+  const canvas = Object.assign(new EventTarget(), {
+    disableRootEvents: true,
+    onwheel: null,
+    style: {},
+  });
+  const viewer = {
+    dataSources: new Cesium.DataSourceCollection(),
+    scene: { canvas, preRender: new Cesium.Event(), drillPick: () => [] },
+  };
+  await viewer.dataSources.add(state._dataSource);
+  // Only presentation boundaries are inert. Source, normalization, state,
+  // ingestion, lifecycle, stats and feed-state policy execute unchanged.
+  const parts = {
+    panel: {
+      createMissionPanel: noop,
+      renderMissionRoster: noop,
+      renderMissionPanel: noop,
+      clearMissionRosterHover: noop,
+    },
+    replay: { stopMissionReplay: noop },
+    selection: {
+      setSelectedMission: noop,
+      focusMission: noop,
+      stopMissionZoomAnchor: noop,
+    },
+    orbitRendering: {
+      removeMissionOrbitPrimitives: noop,
+      syncMissionOrbitPrimitiveVisibility: noop,
+    },
+    overlays: {
+      createReplayVehicleOverlay: noop,
+      clearMissionOverlaySources: noop,
+      hideReplayVehicleOverlay: noop,
+      destroyReplayVehicleOverlay: noop,
+    },
+    launchPad: {
+      initLaunchPadZonePrimitive: noop,
+      hideLaunchPadZone: noop,
+      destroyLaunchPadZonePrimitive: noop,
+    },
+    rendering: {
+      updateMissionFrame: noop,
+      addLaunchEntity(record) {
+        state._dataSource.entities.add({
+          id: record.id,
+          name: record.name,
+          position: Cesium.Cartesian3.fromDegrees(record.lon, record.lat),
+        });
+      },
+    },
+  };
+  const context = { state, services, parts, source };
+  parts.model = createModel(context);
+  parts.ingestion = createIngestion(context);
+  parts.controls = createControls(context);
+  parts.lifecycle = createLifecycle(context);
+  const current = () => {
+    const stats = parts.controls.methods.getStats();
+    return {
+      stats,
+      feed: layerFeedState(stats),
+      rendered: state._dataSource?.entities.values.map((x) => x.id) || [],
+      enabled: state._enabled,
+    };
+  };
+  return {
+    mode,
+    state,
+    source,
+    current,
+    viewer,
+    init: () => parts.lifecycle.methods.init(viewer),
+    update: () => parts.ingestion.methods.update(),
+    disable: () => parts.lifecycle.methods.disable(),
+    destroy: () => parts.lifecycle.methods.destroy(viewer),
+    holdArrival: () =>
+      new Promise((resolve) => {
+        arrival = resolve;
+      }),
+    release: () => release?.(),
+    async close() {
+      await parts.lifecycle.methods.destroy(viewer);
+      server.closeAllConnections();
+      await new Promise((resolve) => server.close(resolve));
+    },
+  };
+}
+
+test('fresh launches remain nominal through ingestion and the layer stats', async () => {
+  const f = await fixture();
+  try {
+    await f.update();
+    const value = f.current();
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.stats.count, 1);
+    assert.deepEqual(value.rendered, ['owned-launch']);
+    assert.equal(value.stats.error, null);
+    assert.ok(value.stats.lastUpdate);
+  } finally {
+    await f.close();
+  }
+});
+
+test('STALE-ERROR provenance reaches the layer feed state without dropping records', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    assert.equal((await f.source.getLaunchSnapshot()).stale, true);
+    await f.update();
+    const value = f.current();
+    assert.equal(value.stats.count, 1);
+    assert.deepEqual(value.rendered, ['owned-launch']);
+    assert.equal(value.feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('a fresh recovery clears stale launch provenance', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    const stale = f.current();
+    f.mode.cache = 'MISS';
+    await f.update();
+    const recovered = f.current();
+    assert.equal(recovered.feed, 'nominal');
+    assert.equal(recovered.stats.count, 1);
+    assert.equal(recovered.stats.error, null);
+    assert.equal(stale.feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('an empty stale snapshot still identifies its fallback provenance', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    f.mode.results = [];
+    await f.update();
+    assert.equal(f.current().stats.count, 0);
+    assert.equal(f.current().feed, 'stale');
+  } finally {
+    await f.close();
+  }
+});
+
+test('getLaunches-only injected sources remain supported', async () => {
+  const f = await fixture({ legacySource: true });
+  try {
+    await f.update();
+    assert.equal(f.current().feed, 'nominal');
+    assert.deepEqual(f.current().rendered, ['owned-launch']);
+  } finally {
+    await f.close();
+  }
+});
+
+test('disable cancels a pending stale response without committing it', async () => {
+  const f = await fixture();
+  try {
+    await f.update();
+    const healthy = f.current();
+    f.mode.cache = 'STALE-ERROR';
+    f.mode.hold = true;
+    const arrived = f.holdArrival();
+    const pending = f.update();
+    await arrived;
+    await f.disable();
+    f.release();
+    await pending;
+    const value = f.current();
+    assert.equal(value.enabled, false);
+    assert.equal(value.stats.lastUpdate, healthy.stats.lastUpdate);
+    assert.equal(value.feed, 'nominal');
+    assert.equal(f.state._sourceController.signal.aborted, true);
+  } finally {
+    await f.close();
+  }
+});
+
+test('hiding retained stale records does not relabel them as fresh', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.disable();
+    assert.equal(f.current().feed, 'stale');
+    assert.equal(f.current().stats.count, 1);
+  } finally {
+    await f.close();
+  }
+});
+
+test('destroy clears the previous feed state and records', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.destroy();
+    const value = f.current();
+    assert.equal(value.stats.count, 0);
+    assert.equal(value.stats.lastUpdate, null);
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.enabled, false);
+  } finally {
+    await f.close();
+  }
+});
+
+test('destroy followed by actual init starts a clean instance with owned handlers', async () => {
+  const f = await fixture();
+  try {
+    f.mode.cache = 'STALE-ERROR';
+    await f.update();
+    await f.destroy();
+    await f.init();
+    const value = f.current();
+    assert.equal(value.feed, 'nominal');
+    assert.equal(value.stats.count, 0);
+    assert.equal(value.stats.lastUpdate, null);
+    assert.equal(value.stats.error, null);
+    assert.equal(value.enabled, false);
+    assert.equal(f.viewer.dataSources.length, 1);
+    assert.equal(f.viewer.scene.preRender.numberOfListeners, 1);
+    const click = f.state._clickHandler;
+    const move = f.state._moveHandler;
+    assert.ok(click instanceof Cesium.ScreenSpaceEventHandler);
+    assert.ok(move instanceof Cesium.ScreenSpaceEventHandler);
+    assert.equal(
+      typeof click.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK),
+      'function',
+    );
+    await f.destroy();
+    assert.equal(click.isDestroyed(), true);
+    assert.equal(move.isDestroyed(), true);
+    assert.equal(f.viewer.dataSources.length, 0);
+    assert.equal(f.viewer.scene.preRender.numberOfListeners, 0);
+  } finally {
+    await f.close();
+  }
+});
diff --git a/src/layers/launches/lifecycle.js b/src/layers/launches/lifecycle.js
index 58d70d34b..75b0276a3 100644
--- a/src/layers/launches/lifecycle.js
+++ b/src/layers/launches/lifecycle.js
@@ -20,6 +20,7 @@ export function createLifecycle({
       viewer.dataSources.add(layerState._dataSource);
       layerState._count = 0;
       layerState._lastUpdate = null;
+      layerState._stale = false;
       layerState._lastError = null;
       layerState._orbitMatches = 0;
       parts.overlays.clearMissionOverlaySources();
@@ -160,6 +161,7 @@ export function createLifecycle({
       layerState._count = 0;
       layerState._orbitMatches = 0;
       layerState._lastUpdate = null;
+      layerState._stale = false;
       layerState._activeTleText = null;
       layerState._activeTlePromise = null;
       layerState._activeTlePromiseToken = 0;
diff --git a/src/layers/launches/state.js b/src/layers/launches/state.js
index 0f0194221..d70be5b54 100644
--- a/src/layers/launches/state.js
+++ b/src/layers/launches/state.js
@@ -19,6 +19,8 @@ export function createState({ services }) {
 
   state._lastError = null;
 
+  state._stale = false;
+
   state._orbitMatches = 0;
 
   state._clickHandler = null;
diff --git a/src/proxyErrorResponses.test.mjs b/src/proxyErrorResponses.test.mjs
index c6a7269ab..78f3f59f0 100644
--- a/src/proxyErrorResponses.test.mjs
+++ b/src/proxyErrorResponses.test.mjs
@@ -4,6 +4,7 @@ import { readFileSync } from 'node:fs';
 import path from 'node:path';
 import { parseTerrainPoints } from './data/terrainHeightsProxy.js';
 import { readResponseTextCapped, coalesceProxyRequest } from './sources/httpBody.js';
+import { makeRateLimiter, clientKey } from '../server/providers/common/rate-limit.js';
 
 const source = ['local.js', 'common/http.js', 'aircraft/enrichment.js', 'terrain.js', 'space/celestrak.js', 'space/launch-library.js', '../../src/data/spaceProviderRequests.js']
   .map(file => readFileSync(new URL(`../server/providers/${file}`, import.meta.url), 'utf8'))
@@ -23,6 +24,12 @@ function fixture(name, overrides = {}, preview = false) {
   const logs = [];
   const deps = {
     readResponseTextCapped, coalesceProxyRequest,
+    // The rate-limited proxies reach for these; give them the real ones so a
+    // fixture request is throttled exactly as production would be.
+    makeRateLimiter, clientKey,
+    // terrain.js gates cross-site requests first; fixture requests carry no
+    // browser headers, so admit them like a loopback tool.
+    admitSameSiteKeyless: () => false,
     path, process: { cwd: () => '/fixture', env: {} },
     fsp: {
       readFile: async () => { throw new Error('cache absent'); },
diff --git a/src/terrainHeightsBounds.test.mjs b/src/terrainHeightsBounds.test.mjs
new file mode 100644
index 000000000..cd1a9ad36
--- /dev/null
+++ b/src/terrainHeightsBounds.test.mjs
@@ -0,0 +1,368 @@
+// TERRAIN HEIGHTS — the bounds on a cache keyed by caller-chosen coordinates.
+//
+// Every distinct 5dp lon/lat is its own cache key, its own permanent line in
+// `.gev-cache/terrain-heights.json`, and its own upstream call. Four things
+// bound that: WGS-84 range at parse, an entry ceiling on the map, a size
+// ceiling on the file that is read back, and a per-client request limiter.
+//
+// These cases drive the real exported route handler. `fetch` is stubbed per
+// test and restored after, so a case that reaches upstream fails loudly.
+//
+// Run with: npm test
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { parseTerrainPoints } from './data/terrainHeightsProxy.js';
+import { terrainHeightsProxy } from '../server/providers/terrain.js';
+import { admitSameSite } from '../server/providers/common/same-site.js';
+
+function install(plugin) {
+  const routes = new Map();
+  plugin.configureServer({
+    middlewares: {
+      use(path, handler) {
+        routes.set(path, handler);
+      },
+    },
+  });
+  return routes;
+}
+
+function request(
+  handler,
+  { url = '/', remoteAddress = '127.0.0.1', reqHeaders = {} } = {},
+) {
+  return new Promise((resolve, reject) => {
+    const headers = new Map();
+    const req = {
+      method: 'GET',
+      url,
+      headers: reqHeaders,
+      socket: { remoteAddress },
+    };
+    const res = {
+      statusCode: 200,
+      headersSent: false,
+      setHeader(name, value) {
+        headers.set(String(name).toLowerCase(), String(value));
+      },
+      writeHead(status, hdrs = {}) {
+        this.statusCode = status;
+        this.headersSent = true;
+        for (const [name, value] of Object.entries(hdrs))
+          headers.set(String(name).toLowerCase(), String(value));
+      },
+      end(body = '') {
+        let parsed = null;
+        try {
+          parsed = body ? JSON.parse(String(body)) : null;
+        } catch {
+          parsed = String(body);
+        }
+        resolve({
+          statusCode: this.statusCode,
+          headers: Object.fromEntries(headers),
+          body: parsed,
+        });
+      },
+    };
+    Promise.resolve(handler(req, res)).catch(reject);
+  });
+}
+
+function stubFetch(t, impl) {
+  const original = globalThis.fetch;
+  globalThis.fetch = impl;
+  t.after(() => {
+    globalThis.fetch = original;
+  });
+}
+
+/**
+ * Answer like Re:Earth does: one `{ellipsoid}` per requested point, in order.
+ * Records which point strings were actually asked for, so a test can assert on
+ * cache misses rather than on internal state.
+ */
+function stubTerrainUpstream(t) {
+  const asked = [];
+  stubFetch(t, async (url) => {
+    const points = decodeURIComponent(
+      new URL(String(url)).searchParams.get('points') || '',
+    )
+      .split(';')
+      .filter(Boolean);
+    asked.push(...points);
+    return Response.json({ results: points.map(() => ({ ellipsoid: 150 })) });
+  });
+  return asked;
+}
+
+test('a coordinate off the globe is not a cache key', () => {
+  // Finite but not on Earth — the old guard accepted every one of these.
+  for (const raw of [
+    '0,91',
+    '0,-91',
+    '181,0',
+    '-181,0',
+    '1e9,1e9',
+    '0,90.00001',
+  ])
+    assert.equal(parseTerrainPoints(raw), null, raw);
+
+  // The poles and the antimeridian are real places and must still parse.
+  for (const raw of ['0,90', '0,-90', '180,0', '-180,0', '-97.74,30.26'])
+    assert.ok(parseTerrainPoints(raw), raw);
+});
+
+test('an out-of-range point is refused before it reaches upstream or the cache', async (t) => {
+  let upstreamCalls = 0;
+  stubFetch(t, async () => {
+    upstreamCalls += 1;
+    return new Response('[]', { status: 200 });
+  });
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  const refused = await request(route, { url: '/?points=0,91' });
+  assert.equal(refused.statusCode, 400);
+  assert.equal(
+    upstreamCalls,
+    0,
+    'an impossible coordinate must not cost an upstream call',
+  );
+});
+
+test('one out-of-range point rejects the batch it is hidden in', async (t) => {
+  stubFetch(t, async () => new Response('[]', { status: 200 }));
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const mixed = await request(route, {
+    url: '/?points=-97.74,30.26;0,999;-97.75,30.27',
+  });
+  assert.equal(mixed.statusCode, 400);
+});
+
+test('the point cache stops growing, and an evicted point is simply refetched', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  // A ceiling of 3 exercises the same code path 50,000 does, in four requests.
+  const route = install(terrainHeightsProxy({ cacheMaxEntries: 3 })).get(
+    '/api/terrain/heights',
+  );
+
+  const point = (i) => `-97.7${i}000,30.26000`;
+  for (let i = 1; i <= 4; i += 1)
+    await request(route, { url: `/?points=${point(i)}` });
+  assert.equal(asked.length, 4, 'four distinct points, four upstream lookups');
+
+  // The newest point is still cached...
+  await request(route, { url: `/?points=${point(4)}` });
+  assert.equal(asked.length, 4, 'a cached point costs nothing');
+
+  // ...and the oldest was evicted, so it costs one refetch — never a wrong
+  // answer, because terrain does not move.
+  await request(route, { url: `/?points=${point(1)}` });
+  assert.equal(asked.length, 5, 'the evicted point was asked for again');
+  assert.equal(asked[4], point(1));
+});
+
+test('an over-large cache file is not read back into memory', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const point = '-97.74000,30.26000';
+  const dir = await mkdtemp(path.join(tmpdir(), 'gev-terrain-'));
+  const cachePath = path.join(dir, 'terrain-heights.json');
+  t.after(() => rm(dir, { recursive: true, force: true }));
+
+  // A cache file holding the answer, but larger than the ceiling allows.
+  const padded = {
+    version: 2,
+    points: { [point]: { at: Date.now(), result: { ellipsoid: 150 } } },
+    _pad: 'x'.repeat(4096),
+  };
+  await writeFile(cachePath, JSON.stringify(padded), 'utf8');
+
+  const route = install(
+    terrainHeightsProxy({ cachePath, cacheMaxDiskBytes: 1024 }),
+  ).get('/api/terrain/heights');
+  await request(route, { url: `/?points=${point}` });
+  assert.deepEqual(
+    asked,
+    [point],
+    'the oversized file was skipped, so the point was a miss',
+  );
+
+  // The same file under a ceiling that admits it IS used, which is what proves
+  // the previous assertion came from the size guard and not a broken path.
+  const admitted = install(
+    terrainHeightsProxy({ cachePath, cacheMaxDiskBytes: 1024 * 1024 }),
+  ).get('/api/terrain/heights');
+  await request(admitted, { url: `/?points=${point}` });
+  assert.deepEqual(asked, [point], 'a cache within the ceiling is still read');
+});
+
+test('the route refuses a flood of requests from one client', async (t) => {
+  stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  let refusedAt = 0;
+  for (let i = 1; i <= 95; i += 1) {
+    // A different point each time: distinct keys are the growth path.
+    const lon = (-97.7 - i / 1000).toFixed(5);
+    const answer = await request(route, { url: `/?points=${lon},30.26` });
+    if (answer.statusCode === 429) {
+      refusedAt = i;
+      break;
+    }
+  }
+  assert.equal(refusedAt, 91, 'the 91st request in a minute is refused');
+});
+
+test('a cross-site page cannot fill the cache or spend the visitor quota', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const host = 'localhost:5173';
+  const refused = [
+    { host, 'sec-fetch-site': 'cross-site' }, // <img src> from any web page
+    { host, 'sec-fetch-site': 'same-site' },
+    { host, origin: 'https://evil.example' }, // fetch from another page
+    { host, origin: 'null' }, // sandboxed frame
+    // Behind a reverse proxy the browser's own Sec-Fetch-Site still decides.
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+  ];
+  // More refused requests than the 90/min quota, each a distinct new key.
+  for (let i = 0; i < 100; i += 1) {
+    const reqHeaders = refused[i % refused.length];
+    const answer = await request(route, {
+      url: `/?points=${(-97 - i / 1000).toFixed(5)},30.26`,
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 403, JSON.stringify(reqHeaders));
+  }
+  assert.deepEqual(asked, [], 'nothing reached upstream or the cache');
+
+  // The visitor's own app still has its full quota afterwards, and a
+  // loopback tool that sends no browser headers is admitted too.
+  const app = await request(route, {
+    url: '/?points=-97.74,30.26',
+    reqHeaders: { host, 'sec-fetch-site': 'same-origin' },
+  });
+  assert.equal(app.statusCode, 200);
+  const tool = await request(route, { url: '/?points=-97.75,30.26' });
+  assert.equal(tool.statusCode, 200);
+  assert.equal(asked.length, 2);
+});
+
+test('the app served behind a reverse proxy still gets terrain', async (t) => {
+  const asked = stubTerrainUpstream(t);
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+  const host = 'globe.example.lan';
+  // What nginx/Caddy/Cloudflare add in front of a same-origin app fetch. The
+  // cost-bearing routes refuse these; terrain is keyless and needed to render,
+  // so a 403 here would drop every chunk to the geoid fallback.
+  const proxied = [
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-for': '203.0.113.9',
+    },
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      'cf-connecting-ip': '203.0.113.9',
+    },
+    {
+      host,
+      'sec-fetch-site': 'same-origin',
+      forwarded: 'for=203.0.113.9;proto=https',
+      via: '1.1 caddy',
+    },
+    // TLS terminated at the proxy: the page origin is https, the hop is http.
+    {
+      host,
+      origin: `https://${host}`,
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-proto': 'https',
+      'x-forwarded-for': '203.0.113.9',
+    },
+  ];
+  for (const [i, reqHeaders] of proxied.entries()) {
+    const answer = await request(route, {
+      url: `/?points=${(-97.8 - i / 1000).toFixed(5)},30.26`,
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 200, JSON.stringify(reqHeaders));
+  }
+  assert.equal(asked.length, proxied.length);
+
+  // Proxied or not, a cross-site page is still refused before any work.
+  for (const reqHeaders of [
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+    {
+      host,
+      'x-forwarded-proto': 'https',
+      origin: 'https://evil.example',
+    },
+    // A forwarded scheme does not make an http Origin match an https page.
+    { host, 'x-forwarded-proto': 'https', origin: `http://${host}` },
+  ]) {
+    const answer = await request(route, {
+      url: '/?points=-97.9,30.26',
+      reqHeaders,
+    });
+    assert.equal(answer.statusCode, 403, JSON.stringify(reqHeaders));
+  }
+  assert.equal(asked.length, proxied.length, 'refusals cost no upstream call');
+});
+
+test('cost-bearing routes still refuse proxied requests', () => {
+  // The keyless exemption is scoped to terrain; the shared gate is unchanged.
+  const res = {
+    statusCode: 200,
+    headers: {},
+    setHeader(name, value) {
+      this.headers[name.toLowerCase()] = value;
+    },
+    end(body) {
+      this.body = body;
+    },
+  };
+  const refused = admitSameSite(
+    {
+      headers: {
+        host: 'globe.example.lan',
+        'sec-fetch-site': 'same-origin',
+        'x-forwarded-for': '203.0.113.9',
+      },
+      socket: {},
+    },
+    res,
+  );
+  assert.equal(refused, true);
+  assert.equal(res.statusCode, 403);
+  assert.deepEqual(JSON.parse(res.body), {
+    error: 'Proxied requests are not accepted',
+  });
+});
+
+test('a second client keeps its own quota', async (t) => {
+  stubFetch(t, async () =>
+    Response.json([{ lng: -97.74, lat: 30.26, height: 150 }]),
+  );
+  const route = install(terrainHeightsProxy()).get('/api/terrain/heights');
+
+  for (let i = 0; i < 90; i += 1)
+    await request(route, {
+      url: `/?points=${(-98 - i / 1000).toFixed(5)},30.26`,
+      remoteAddress: '198.51.100.7',
+    });
+  const exhausted = await request(route, {
+    url: '/?points=-99.5,30.26',
+    remoteAddress: '198.51.100.7',
+  });
+  assert.equal(exhausted.statusCode, 429);
+
+  const neighbour = await request(route, {
+    url: '/?points=-99.6,30.26',
+    remoteAddress: '198.51.100.8',
+  });
+  assert.notEqual(neighbour.statusCode, 429);
+});
diff --git a/src/tooling/ll2Integration.test.mjs b/src/tooling/ll2Integration.test.mjs
new file mode 100644
index 000000000..30325eaab
--- /dev/null
+++ b/src/tooling/ll2Integration.test.mjs
@@ -0,0 +1,232 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { promises as fsp } from 'node:fs';
+import http from 'node:http';
+import { launchLibraryRecentUrl } from '../data/spaceProviderRequests.js';
+import {
+  launchLibraryRequestHeaders,
+  rocketLaunchesProxy,
+} from '../../server/providers/space/launch-library.js';
+import { keySetupStatus } from '../keySetupCore.mjs';
+import { initKeySetup } from '../keySetup.js';
+
+test('LL2 requests from the same UTC minute share a cache key without mutating callers', () => {
+  const first = new Date('2026-10-17T16:20:00.001Z');
+  const last = new Date('2026-10-17T16:20:59.999Z');
+  assert.equal(
+    launchLibraryRecentUrl(first).href,
+    launchLibraryRecentUrl(last).href,
+  );
+  assert.equal(first.toISOString(), '2026-10-17T16:20:00.001Z');
+  assert.equal(last.toISOString(), '2026-10-17T16:20:59.999Z');
+});
+
+for (const [date, end] of [
+  ['2026-10-17T16:20:00.001Z', '2026-10-17T16:20:00.000Z'],
+  ['2026-10-17T16:20:59.999Z', '2026-10-17T16:20:00.000Z'],
+  ['2026-10-17T16:21:00.000Z', '2026-10-17T16:21:00.000Z'],
+  ['2026-01-01T00:00:00.001Z', '2026-01-01T00:00:00.000Z'],
+]) {
+  test(`LL2 bounds retain the 30-day UTC window at ${date}`, () => {
+    const url = launchLibraryRecentUrl(new Date(date));
+    assert.equal(url.origin, 'https://ll.thespacedevs.com');
+    assert.equal(url.pathname, '/2.3.0/launches/');
+    assert.equal(url.searchParams.get('net__lte'), end);
+    assert.equal(
+      Date.parse(end) - Date.parse(url.searchParams.get('net__gte')),
+      30 * 86400000,
+    );
+    assert.equal(url.searchParams.get('limit'), '100');
+    assert.equal(url.searchParams.get('mode'), 'detailed');
+  });
+}
+
+test('LL2 headers identify the app and preserve optional server-only authorization', () => {
+  const publicHeaders = launchLibraryRequestHeaders('');
+  assert.match(publicHeaders['User-Agent'], /^gods-eye-view.*\/1\.0 /);
+  assert.ok(
+    publicHeaders['User-Agent'].includes(
+      'https://github.com/bilawalsidhu/gods-eye-view',
+    ),
+  );
+  assert.equal(publicHeaders.Accept, 'application/json');
+  assert.equal(publicHeaders.Authorization, undefined);
+  const paidHeaders = launchLibraryRequestHeaders(' owned-fixture-token ');
+  assert.equal(paidHeaders.Authorization, 'Token owned-fixture-token');
+  assert.equal(paidHeaders['User-Agent'], publicHeaders['User-Agent']);
+});
+
+test('actual setup rendering distinguishes optional paid LL2 from unrelated free keys', async () => {
+  const created = [];
+  const node = () => {
+    const value = {
+      dataset: {},
+      children: [],
+      append(...children) {
+        this.children.push(...children);
+      },
+      querySelector() {
+        return null;
+      },
+      querySelectorAll() {
+        return [];
+      },
+      addEventListener() {},
+      removeEventListener() {},
+      setAttribute() {},
+      remove() {},
+    };
+    created.push(value);
+    return value;
+  };
+  const rows = node();
+  const root = node();
+  root.querySelector = (selector) =>
+    selector === '[data-key-setup-rows]' ? rows : null;
+  const chip = node();
+  const status = keySetupStatus({});
+  status.keys = status.keys.filter((key) =>
+    ['launch-library', 'mapillary'].includes(key.id),
+  );
+  const setup = await initKeySetup({
+    documentRef: {
+      getElementById: (id) => (id === 'key-setup-chip' ? chip : root),
+      createElement: node,
+      addEventListener() {},
+      removeEventListener() {},
+    },
+    fetchImpl: async () => ({ ok: true, json: async () => status }),
+  });
+  assert.ok(setup);
+  try {
+    const ll2 = rows.children.find(
+      (row) => row.dataset.keyId === 'launch-library',
+    );
+    const free = rows.children.find((row) => row.dataset.keyId === 'mapillary');
+    const tier = (row) =>
+      row.children[0].children.find(
+        (child) => child.className === 'key-setup-tier',
+      );
+    assert.match(tier(ll2).title, /optional paid token/i);
+    assert.match(ll2.children[1].textContent, /leave blank/i);
+    assert.match(ll2.children[1].textContent, /no key/i);
+    assert.equal(tier(free).title, 'Free key — register, paste, done');
+    const serialized = JSON.stringify(status);
+    assert.ok(!serialized.includes('owned-fixture-token'));
+  } finally {
+    setup.destroy();
+  }
+});
+
+test('real LL2 proxy sends cacheable headers and bounds, retaining its memory cache', async (t) => {
+  for (const method of ['readFile', 'stat'])
+    t.mock.method(fsp, method, async () => {
+      throw new Error('owned fixture has no disk cache');
+    });
+  t.mock.method(fsp, 'mkdir', async () => {});
+  t.mock.method(fsp, 'writeFile', async () => {});
+  const calls = [];
+  t.mock.method(globalThis, 'fetch', async (url, options) => {
+    calls.push({ url: new URL(url), options });
+    return new Response(
+      JSON.stringify({ results: [{ id: 'owned-launch-fixture' }] }),
+    );
+  });
+  let handler;
+  rocketLaunchesProxy().configureServer({
+    middlewares: {
+      use(route, value) {
+        assert.equal(route, '/api/launches');
+        handler = value;
+      },
+    },
+  });
+  async function request() {
+    const res = {
+      writeHead(status, headers) {
+        this.status = status;
+        this.headers = headers;
+      },
+      end(body) {
+        this.body = body;
+      },
+    };
+    await handler({ method: 'GET' }, res);
+    return res;
+  }
+  const first = await request();
+  const second = await request();
+  assert.equal(first.status, 200);
+  assert.equal(second.body, first.body);
+  assert.equal(second.headers['X-GEV-Cache'], 'HIT');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].options.headers['User-Agent'], /gods-eye-view/);
+  assert.match(calls[0].url.searchParams.get('net__lte'), /:00\.000Z$/);
+  assert.match(calls[0].url.searchParams.get('net__gte'), /:00\.000Z$/);
+});
+
+for (const preview of [false, true]) {
+  test(`LL2 proxy sends its identifying headers over real owned HTTP in ${preview ? 'preview' : 'development'}`, async (t) => {
+    for (const method of ['readFile', 'stat'])
+      t.mock.method(fsp, method, async () => {
+        throw new Error('no owned cache');
+      });
+    t.mock.method(fsp, 'mkdir', async () => {});
+    t.mock.method(fsp, 'writeFile', async () => {});
+    const received = [];
+    const upstream = http.createServer((req, res) => {
+      received.push({
+        url: new URL(req.url, 'http://fixture.invalid'),
+        headers: req.headers,
+      });
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ results: [{ id: 'owned-wire-fixture' }] }));
+    });
+    await new Promise((resolve) => upstream.listen(0, '127.0.0.1', resolve));
+    const originalFetch = globalThis.fetch;
+    t.mock.method(globalThis, 'fetch', (url, options) => {
+      const parsed = new URL(url);
+      assert.equal(parsed.origin, 'https://ll.thespacedevs.com');
+      return originalFetch(
+        `http://127.0.0.1:${upstream.address().port}${parsed.pathname}${parsed.search}`,
+        options,
+      );
+    });
+    let handler;
+    const plugin = rocketLaunchesProxy();
+    plugin[preview ? 'configurePreviewServer' : 'configureServer']({
+      middlewares: {
+        use(_route, value) {
+          handler = value;
+        },
+      },
+    });
+    const proxy = http.createServer((req, res) => {
+      void handler(req, res);
+    });
+    await new Promise((resolve) => proxy.listen(0, '127.0.0.1', resolve));
+    try {
+      const result = await originalFetch(
+        `http://127.0.0.1:${proxy.address().port}/api/launches`,
+      );
+      assert.equal(result.status, 200);
+      assert.deepEqual(await result.json(), {
+        results: [{ id: 'owned-wire-fixture' }],
+      });
+      assert.equal(received.length, 1);
+      assert.match(
+        received[0].headers['user-agent'],
+        /^gods-eye-view-launch-library-proxy\/1\.0 /,
+      );
+      assert.equal(received[0].headers.authorization, undefined);
+      assert.match(received[0].url.searchParams.get('net__lte'), /:00\.000Z$/);
+    } finally {
+      proxy.closeAllConnections();
+      upstream.closeAllConnections();
+      await Promise.all([
+        new Promise((resolve) => proxy.close(resolve)),
+        new Promise((resolve) => upstream.close(resolve)),
+      ]);
+    }
+  });
+}
diff --git a/src/tooling/spaceProviders.test.mjs b/src/tooling/spaceProviders.test.mjs
index 443ca5b96..a5b2cecba 100644
--- a/src/tooling/spaceProviders.test.mjs
+++ b/src/tooling/spaceProviders.test.mjs
@@ -81,8 +81,8 @@ test('portable requests keep fixed origins, encode group data and preserve the 3
   assert.equal(url.origin, 'https://ll.thespacedevs.com');
   assert.equal(url.pathname, '/2.3.0/launches/');
   assert.deepEqual(Object.fromEntries(url.searchParams), {
-    net__gte: '2026-01-30T12:34:56.000Z',
-    net__lte: '2026-03-01T12:34:56.000Z',
+    net__gte: '2026-01-30T12:34:00.000Z',
+    net__lte: '2026-03-01T12:34:00.000Z',
     limit: '100',
     mode: 'detailed',
   });