Tighten failed-entry comments and docs

docs/CURRENT-STATE.md

@@ -5329,7 +5329,7 @@ silently demoting every later lookup for the session.
 - Context is set for reading in every theme: mode, standby and action labels are 10 px, and the panel draws no glow halo. Outside Cyber, the two modes form one segmented control, the standby guidance is plain left-aligned text rather than a dashed placeholder, and the panel's section titles share the side panels' dock-label colour. Cyber keeps its separately framed mode buttons, its red panel titles, and in layout-focus a framed, centred standby card over its radar art.
 - The expanded desktop header omits the redundant `ON` label; the active mode button carries state. Expanded Contact results also omit the duplicate `GLOBAL CONTEXT` / `CONTEXT ONLY` status row and begin with the selected subject and its 250 km scope. Global Context does not fabricate a selected-entity model preview: the provisional hand-authored aircraft wireframe was removed because it was not geometry extracted from the selected entity's actual asset.
 - Dependency ownership is reversible: disabling Global Context releases only dependencies it enabled, while user-enabled layers remain on. This also removes the Military-layer suppression handoff when Global Context owned Military, allowing an already-enabled civilian Flights layer to resume its normal mixed rendering. If OpenSky is unavailable and has no last-good cache, Flights requests a capped 250 nm adsb.lol point snapshot around the current view anchor and labels that provenance explicitly; it never relabels military-feed rows as civilian data. If both inputs fail, Flights remains `UNKNOWN`.
-- Space Missions is replay-isolated: Rocket Launches and Satellites are the only Data Layers permitted while the mode is active. Direct UI and voice entry capture the same pre-entry snapshot; internal dependency and restoration enables do not create a user-owned Context session. Entry waits for incompatible layers to shut down, direct incompatible enables are blocked before lifecycle work, and the entry gate remains active through the complete Rocket Launches enable. That enable includes the first mission-index load: an HTTP error, timeout, network failure or malformed payload before any index has loaded fails the enable, so Context rolls back to the pre-entry layers and the camera returns to its pre-entry view instead of committing an empty, isolating mode. A valid empty index still enters, and a refresh failure after an index loaded keeps its records and the mode. The roster reads `LOADING 30-DAY MISSION INDEX` while that first load is pending and `30-DAY MISSION INDEX UNAVAILABLE` once it failed. A newer same-target ON request takes ownership of the pending entry without releasing its isolation snapshot, including when it arrives while the prior request is awaiting the adoption guard. A caller abort, resource cancellation, newer OFF, or layer teardown waits for exact manager settlement and restores that snapshot without resurrecting Rocket Launches. If an abort lands after only part of a restore settles, Context completes the same exact target without the stale caller signal and then replays newer explicit layer intent. Dedicated Voice Context cancellation reports a stable cancelled result plus the current Context state; generic layer visibility additionally exposes manager phase, reason, successor, and lifecycle details. Once an exact voice visibility intent commits, a newer voice turn cannot relabel it as cancelled while Context settlement completes; pre-commit aborts remain cancellable and final lifecycle mismatches remain failures. Clear Selected Layers reserves its complete captured OFF set before sequential teardown; a newer absolute request of any origin supersedes only its layer reservation and remains authoritative. A rejected layer teardown retains the truthful enabled state, rolls already-stopped siblings back to the captured pre-entry set, and aborts replay; rapid exit/re-entry serializes the full Satellite enabled-state and parameter restore before a new snapshot is taken. Contacts remains additive and restores user-enabled layers normally.
+- Space Missions is replay-isolated: Rocket Launches and Satellites are the only Data Layers permitted while the mode is active. Direct UI and voice entry capture the same pre-entry snapshot; internal dependency and restoration enables do not create a user-owned Context session. Entry waits for incompatible layers to shut down, direct incompatible enables are blocked before lifecycle work, and the entry gate remains active through the complete Rocket Launches enable. That enable includes the first mission-index load: an HTTP error, timeout, network failure or malformed payload before any index has loaded fails the enable, so Context rolls back to the pre-entry layers instead of committing an empty, isolating mode; the camera returns to its pre-entry view unless it moved after the entry flight. A valid empty index still enters, and a refresh failure after an index loaded keeps its records and the mode. The roster reads `LOADING 30-DAY MISSION INDEX` while that first load is pending and `30-DAY MISSION INDEX UNAVAILABLE` once it failed. A newer same-target ON request takes ownership of the pending entry without releasing its isolation snapshot, including when it arrives while the prior request is awaiting the adoption guard. A caller abort, resource cancellation, newer OFF, or layer teardown waits for exact manager settlement and restores that snapshot without resurrecting Rocket Launches. If an abort lands after only part of a restore settles, Context completes the same exact target without the stale caller signal and then replays newer explicit layer intent. Dedicated Voice Context cancellation reports a stable cancelled result plus the current Context state; generic layer visibility additionally exposes manager phase, reason, successor, and lifecycle details. Once an exact voice visibility intent commits, a newer voice turn cannot relabel it as cancelled while Context settlement completes; pre-commit aborts remain cancellable and final lifecycle mismatches remain failures. Clear Selected Layers reserves its complete captured OFF set before sequential teardown; a newer absolute request of any origin supersedes only its layer reservation and remains authoritative. A rejected layer teardown retains the truthful enabled state, rolls already-stopped siblings back to the captured pre-entry set, and aborts replay; rapid exit/re-entry serializes the full Satellite enabled-state and parameter restore before a new snapshot is taken. Contacts remains additive and restores user-enabled layers normally.
 - Enabled Data Layer controls report normalized feed health on the button (`LOADING`, `DEGRADED`, `STALE`, `FALLBACK`, or `UNAVAILABLE`) while the metadata line retains the source and reason. A partial CelesTrak group failure keeps the usable catalog and reports `DEGRADED`; a total outage keeps last-good catalog data visible but reports `UNAVAILABLE`.
 - On activation it focuses the nearest currently observed aircraft across the civilian and military feeds, with military winning an exact distance tie; if none are available, it focuses an observed AIS vessel. The aircraft search is deliberately uncapped and one refresh-tick retry handles initially empty feeds. This is an attention-priority navigation shortcut, not a high-risk, affiliation, or threat classification.
 - A selected aircraft, AIS vessel, or mapped installation gets a 250 km **context window** with nearby cohort counts, nearest examples, source labels, and stale/unavailable reasons. It emits `NEARBY` or `UNKNOWN`; no detection, engagement, affiliation, or sensor-activity conclusion is calculated.

src/layers/launches/controls.js

@@ -12,7 +12,7 @@ export function createControls({ state: layerState, services, parts, source }) {
 
     /** Release only Space Mission camera ownership, preserving layer and selection state. */
     releaseCameraOwnership() {
-      // A failed entry no longer gives back the view it replaced.
+      // Navigation takes the camera; a failed entry must not restore the old view.
       layerState._entryCameraView = null;
       parts.panel.clearMissionRosterHover();
       parts.replay.stopMissionReplay();

src/layers/launches/failedEntry.test.mjs

@@ -1,8 +1,5 @@
-// A Space Missions entry whose mission index never loads must not commit the
-// mode. The real manager, Context coordinator and launches ingestion run
-// against a local /api/launches that answers 429, so the test follows the
-// same failure the browser sees: isolation clears the other layers, the first
-// update fails, and the entry rolls back to the layers and view it replaced.
+// The real manager, Context coordinator and launches ingestion run against a
+// local /api/launches, so a failed first load takes the browser's path.
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import http from 'node:http';
@@ -137,8 +134,7 @@ async function fixture(t) {
     dataSources: new Cesium.DataSourceCollection(),
     scene: { canvas, preRender: new Cesium.Event(), drillPick: () => [] },
   };
-  // Scene presentation is inert; source, ingestion, lifecycle, panel views
-  // and the satellites dependency run unchanged.
+  // Only scene presentation is stubbed.
   const parts = {
     overlays: {
       shortMissionLabel: (name) => name,
@@ -281,7 +277,6 @@ test('a direct Space Missions entry that gets HTTP 429 rolls back instead of iso
   assert.deepEqual(f.view(), before, 'the pre-entry view comes back');
   assert.ok(f.camera.cancelled > 0, 'the full-globe flight is cancelled');
 
-  // Nothing is left isolating the workspace.
   assert.equal(
     await f.manager.setEnabled('wind', true, { origin: 'user' }),
     true,
@@ -454,7 +449,7 @@ test('a refresh failure after a loaded index keeps the mode and its records', as
   assert.equal(f.missions.getStats().error, 'HTTP 429');
   assert.equal(f.rosters.at(-1).entries.length, 1);
 
-  // Leaving a mode that loaded keeps today's camera behaviour.
+  // Leaving a loaded mode does not restore the pre-entry view.
   await f.manager.setEnabled('rocket-launches', false, { origin: 'user' });
   await f.settle();
   assert.deepEqual(f.view(), framed);

src/layers/launches/ingestion.js

@@ -229,9 +229,8 @@ export function createIngestion({
       if (layerState._enabled && token === layerState._lifecycleToken) {
         layerState._lastError = error.message;
         console.warn('[Data:RocketLaunches] Fetch error:', error);
-        // Without one usable index there is no mode to enter: report the
-        // failure so the manager fails the enable closed and Context rolls
-        // back. A refresh after a loaded index keeps its records instead.
+        // No index yet: fail the enable so Context rolls back.
+        // After a loaded index, a failed refresh keeps its records.
         if (layerState._lastUpdate === null) {
           parts.panel.renderMissionRoster();
           throw error;

src/layers/launches/lifecycle.js

@@ -139,10 +139,7 @@ function sameCameraView(camera, view) {
   );
 }
 
-/**
- * Return to the pose before entry while the entry's full-globe flight still
- * holds the camera: in flight, or landed with nothing moved since.
- */
+/** Restore the pre-entry view if the entry flight still holds the camera. */
 function restoreCameraView(viewer, view, landedView) {
   const camera = viewer?.camera;
   if (!camera) return;

src/layers/launches/panel.js

@@ -263,10 +263,7 @@ export function createPanel({ state: layerState, services, parts, source }) {
     publishPanel();
   }
 
-  /**
-   * The roster entries as the list shows them; null while the first index
-   * is still loading, and an empty failed roster once that load failed.
-   */
+  /** The roster as listed; null until the first index loads or fails. */
   function presentRoster() {
     if (layerState._lastUpdate === null && !layerState._launches.length) {
       if (!layerState._lastError) return null;

src/layers/launches/replay.js

@@ -314,7 +314,7 @@ export function createReplay({ state: layerState, services, parts, source }) {
     layerState._replayCameraToken++;
     if (layerState._replayCameraRemover) layerState._replayCameraRemover();
     layerState._replayCameraRemover = null;
-    // Without a replay the camera is not ours: leave other flights running.
+    // Cancel only a replay's flight; any other flight runs on.
     if (stoppedLaunchId && layerState._viewer?.camera) {
       layerState._viewer.camera.cancelFlight();
       layerState._viewer.camera.lookAtTransform(Cesium.Matrix4.IDENTITY);