Merge upstream/main 73c14ac74

changelog.d/1014-director-callback-failures.md

@@ -0,0 +1,4 @@
+- Director clock listeners, interaction observers and scene release failures
+  no longer leave the director inconsistent: each scene is released once, and
+  a phase error is kept (with the release failure logged) when cleanup also
+  fails (deepeshbind, #1014).

changelog.d/1056-area-tool-breakdowns.md

@@ -1,12 +0,0 @@
-- `aircraft_in_area` and `vessels_in_area` take `group_by` and `stats`, so an
-  MCP client can ask which airlines, countries, aircraft types or ship types
-  dominate an area, or the average altitude or speed, over every match instead
-  of estimating from the returned rows. Airlines come from the ICAO designator
-  in each callsign (SWA1234 counts as SWA), so the breakdown works on feeds
-  that report no operator; operator and type are counted only where the feed
-  reports them. Ship types count by family, so AIS codes 70 to 79 are all
-  cargo; type 0 ("not available") and the reserved codes 100 to 255 count as
-  unknown. Altitude and speed stats cover airborne aircraft only, so parked
-  aircraft do not pull the means down. Every vessel answer, `find_vessel`
-  included, now reads AIS ship-type codes as their family and a destination
-  with no letters as unknown (quanticsoul4772, #1056).

changelog.d/1057-windows-npm-dep0190.md

@@ -1,4 +0,0 @@
-- On Windows, `npm run doctor` and the Pinokio install no longer print Node's
-  DEP0190 warning ("Passing args to a child process with shell option true can
-  lead to security vulnerabilities"): npm.cmd's fixed subcommand is now part of
-  the shell command string instead of an argument array (quanticsoul4772, #1057).

changelog.d/1071-geo-uri-search.md

@@ -1,3 +0,0 @@
-- Location search accepts two-dimensional WGS84 `geo:` URIs offline, with
-  the existing coordinate framing and label. Unsupported URI fields are passed
-  to the remaining search providers unchanged (cj-vana, #1071).

changelog.d/1078-firms-ipv4-fallback.md

@@ -0,0 +1,4 @@
+- FIRMS fire data loads on hosts where IPv6 is unreachable and IPv4 is slow to
+  connect: a request whose every address fails to connect retries once over
+  IPv4, and FIRMS warnings name the underlying connection errors instead of
+  only `fetch failed` (jeffblakely, #1078).

changelog.d/1086-prohibited-restricted-airspace.md

@@ -0,0 +1,8 @@
+- Add a Prohibited & Restricted Airspace layer for FAA prohibited (P) and
+  restricted (R) special-use airspace. The keyless `/api/drone-airspace` proxy
+  pages the public SUA FeatureServer, keeps a one-hour snapshot, and serves
+  stale data when a refresh fails. Zones draw as ground polygons (red
+  prohibited, orange restricted); selection shows name, altitude range, times
+  of use and agency, and the row legend states the layer is informational only
+  and does not include the UAS Facility Map or UAS flight restrictions. Off by
+  default; share-link token `8` (mvanhorn, #1086).

changelog.d/1093-multipart-cable-feature-ownership.md

@@ -0,0 +1,4 @@
+- Keep every submarine-cable segment associated with its source feature after
+  Cesium expands multipart geometry, correcting segment colors, click destinations
+  and horizon culling while retaining one reference stem per feature
+  (@Aliciawque, #1093).

changelog.d/1094-dependency-security-patches.md

@@ -1,4 +0,0 @@
-- Update DOMPurify to 3.4.17, Sharp to 0.35.5 and source-map-js to 1.2.2 for
-  GHSA-p98j-92pf-mc4p, GHSA-6688-9rhm-gjv2, GHSA-wq5f-xc86-pv6w and
-  GHSA-68fv-2mgg-jv7q; `npm audit` now reports no vulnerabilities (NurstarK,
-  #1094).

changelog.d/1096-military-hold-track-speed.md

@@ -1,3 +0,0 @@
-- Military aircraft keep their last heading and speed when an adsb.lol row omits
-  `track` or `gs`, instead of turning north and stopping; a grounded row without
-  a speed still reads 0 (Aditya, @Rohilalala, #1096).

changelog.d/1097-overpass-remark-failure-phrases.md

@@ -1,5 +0,0 @@
-- Overpass data whose element tags contain a failure phrase ("timed out",
-  "runtime error", "too many requests" and similar, e.g. a place named "Timed
-  Out Escape Rooms") is returned as data instead of being refused and putting
-  the endpoint on cooldown; upstream failures are read from the remark (Aditya,
-  @Rohilalala, #1097).

changelog.d/1101-tle-catalog-number-match.md

@@ -1,3 +0,0 @@
-- Skip TLE sets whose line 1 and line 2 carry different catalog numbers, so a
-  spliced catalog cannot pair one satellite's elements with another's; the next
-  valid set still parses (VG31OP, #1101).

changelog.d/1111-map-fallback-retry.md

@@ -1,5 +0,0 @@
-- A failed Esri Satellite or keyless terrain load still shows OSM or flat terrain
-  at once, but no longer lasts the whole session: while the fallback is on
-  screen, the real provider is retried in the background (30 seconds, doubling
-  to a 10-minute cap) and replaces it live once it loads. Map switches never
-  wait for a retry (Aditya, @Rohilalala, #1111).

changelog.d/1115-aircraft-altitude-band-unknown.md

@@ -1,2 +0,0 @@
-- Exclude aircraft without a reported altitude from requested altitude bands;
-  unfiltered aircraft queries still retain them (rudycelekli, #1115).

changelog.d/1117-google-viewer-lifecycle.md

@@ -1,3 +0,0 @@
-- Release superseded Google Street View open waits and suppress metadata
-  requests whose viewer was unmounted while the service loaded (rudycelekli,
-  #1117).

changelog.d/1118-cctv-snapshot-fallback-provenance.md

@@ -1,3 +0,0 @@
-- Label camera-tool Street View fallbacks as historical Google imagery rather
-  than the current camera view; keep unknown frame provenance explicit
-  (rudycelekli, #1118).

changelog.d/1125-houston-cctv-pack.md

@@ -0,0 +1,18 @@
+- Add Houston traffic cameras from Houston TranStar as a CCTV pack. The camera
+  list is one keyless JSON request to
+  `traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js`; frames are
+  stills synthesized from each numeric camera id on `www.houstontranstar.org`,
+  so a catalog field cannot steer the proxy off-host. Cameras without a
+  snapshot id, and cameras outside Greater Houston, are dropped. TranStar's
+  `dir` field (the side of the freeway the camera sits on) seeds a
+  low-confidence heading along the nearest lanes' travel direction. TranStar's
+  Content Usage terms (traffic.houstontranstar.org/disclaimer.aspx) prohibit
+  copying, distribution and external framing of its images without TxDOT's
+  written permission, so the pack is off by default; operators should set
+  `CCTV_HOUSTON_ENABLED=1` only if they hold that permission. Frames are
+  relayed on demand with `no-store` and not archived. Once enabled, it loads
+  the 250 cameras nearest downtown, Uptown, the Medical Center, IAH and
+  Galveston; `CCTV_HOUSTON_MAX_SOURCES` changes that cap.
+  Snapshots update about every 3 minutes. The catalog-wide ceiling is
+  unchanged; extra cameras share it round-robin with the other packs
+  (mvanhorn, #1125).

changelog.d/1135-director-save-status-run-results.md

@@ -1,5 +0,0 @@
-- Scenes keep the "Scene not saved" status when a capture, update, append or
-  import cannot be saved, and an unreadable saved project no longer overwrites
-  the recovery checkpoint. `startScene()` resolves to its documented result,
-  `afterShotId` works without an explicit scene, and `scenesRun` counts the
-  distinct scenes queued (djabhi31, #1135).

changelog.d/114-open-map-overlays.md

@@ -0,0 +1,3 @@
+- Add Sea Marks (OpenSeaMap) and Ski Pistes (OpenSnowMap) as two raster
+  overlay layers under Infrastructure. They drape on the globe stacks and on
+  Google 3D, and share links keep each one (Tom-Neverwinter, #114).

changelog.d/1142-antimeridian-fire-perimeters.md

@@ -1,6 +0,0 @@
-- Fire-perimeter queries handle outlines and holes crossing the antimeridian:
-  areas enclosed near ±180° are included, areas at the opposite meridian are
-  excluded, and returned perimeter coordinates stay near the dateline. Incident
-  cards use the same circular longitude mean and compare multipart outline
-  areas along short longitude edges, keeping the card on the largest polygon
-  (Arianna Method, @ariannamethod, #1142).

changelog.d/1171-director-goto-shot.md

@@ -1,3 +0,0 @@
-- Director shot actions land on the requested shot. A seek to a shot's start
-  could round a hair below it and select the end of the previous shot for some
-  shot counts and durations (Aditya, @Rohilalala, #1171).

changelog.d/1172-cctv-missing-numbers.md

@@ -1,13 +0,0 @@
-- Keep missing CCTV numbers unknown instead of reading them as zero. `Number`
-  turns null, blank strings and booleans into 0 or 1, and the camera source
-  list sends an unknown number as JSON null, so a source-pack camera that left
-  out its pose reached the browser as zeros clamped to each field's floor —
-  facing north, pitch −2°, FOV 20°, range 120 m, mount 6 m and ground 0 m —
-  instead of the defaults (id-hash heading, −17°, 74°, 700 m, 24 m and the
-  city's ground); a null or blank position placed the camera at 0,0. The
-  server's `toFiniteNumber` and the browser's `safeNumber` now treat absent,
-  blank and boolean values as missing. The same conversion also stops a
-  Tallinn row with a null heading reading as a confident north-facing camera,
-  a Caltrans camera with a blank elevation losing its 150 m ground prior, and
-  a TfL or Catalonia camera with a null or blank coordinate being kept at 0,0
-  or on the zero meridian (omerbberk, #1172).

changelog.d/1173-antimeridian-ground-floor.md

@@ -1,10 +0,0 @@
-- Flights' ground floor works across the antimeridian. The viewer-distance
-  check behind the 150 km floor radius and its copy in the photoreal mesh-floor
-  sampler subtracted longitudes without wrapping, so two points 21 km apart
-  across 180° measured about 38,000 km and low or grounded aircraft just across
-  the line from the viewer were never floored. A contact's display corridor
-  walked a segment across 180° the long way round, spending its cell budget on
-  ground behind the contact, and a contact on the seam lost its cell hysteresis.
-  SEARCH NEARBY SITES on a view across 180° searched Google Places around
-  longitude 0, on the far side of the globe, with a radius sized from the view's
-  height alone; it now searches the view (Aditya, @Rohilalala, #1173).

changelog.d/1186-launch-unknown-coordinates.md

@@ -1,4 +0,0 @@
-- Keep missing launch-pad coordinates unknown so launches use the location
-  fallback or stay off the map instead of appearing at 0°N 0°E. Missing stage
-  flight numbers no longer show "FLIGHT 0"
-  (Rudy Celekli, @rudycelekli, #1186).

changelog.d/1190-bikeshare-spain-cities.md

@@ -1,6 +0,0 @@
-- Add nine Spanish city bike systems to Bike Share and `get_bike_share`: BiciMAD
-  (Madrid), Valenbisi (Valencia), Bizi Zaragoza, Sevici (Seville), BIKI
-  (Valladolid), BiciCoruña, Dbizi (Donostia-San Sebastián), Bilbao Bizi and
-  BicinRivas, about 1,840 stations. Station names read underscores as word
-  breaks, and station capacity counts docks rather than PBSC's geofenced area
-  (ulihhhh, #1190).

changelog.d/1197-launch-library-provider-guidance.md

@@ -1,5 +0,0 @@
-- Share Launch Library request cache keys across installations refreshing in the
-  same UTC minute, identify the app to the provider, and explain that standard
-  space-missions access needs no key. Optional higher-rate LL2 tokens are paid
-  upgrades; existing local cache and server-only token handling are unchanged
-  (rudycelekli, #1197).

changelog.d/1199-launch-cache-provenance.md

@@ -1,3 +0,0 @@
-- Keep Space Missions marked STALE when Launch Library 2 falls back to cached
-  launch data, and return to NOMINAL after a fresh response without discarding
-  retained missions (rudycelekli, #1199).

changelog.d/1200-cctv-live-icon-color.md

@@ -1,5 +0,0 @@
-- Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
-  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
-  video camera could only be found by opening it. Stills stay cyan and the
-  active camera stays amber, and focus de-emphasis fades the violet the same
-  way (Danielslay86, #1200).

changelog.d/1201-cctv-stills-aspect.md

@@ -1,4 +0,0 @@
-- Draw CCTV stills at their source aspect on the monitor plane instead of
-  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
-  every still was widened; they are now centered and pillarboxed on the dark
-  the placeholder already ends on (Danielslay86, #1201).

changelog.d/1205-cctv-tool-routing.md

@@ -1,3 +0,0 @@
-- Report actual outcomes when voice enables or disables CCTV through the shared
-  layer lifecycle, including failed and cancelled changes (manjunath22466,
-  #1205).

changelog.d/1206-radio-priority-countries.md

@@ -0,0 +1,6 @@
+- Add optional keyless Radio priority-country coverage with up to 40 stations
+  per configured country inside the existing 750-station cap; the UK alias uses
+  the canonical GB code. Country query
+  failures do not block a healthy global catalog. Bound mirror attempts to three
+  and retry failed or partial refreshes after 60 seconds on all installations,
+  including those without priority countries configured (m3ayush, #1206).

changelog.d/1209-layer-errors-english-in-data.md

@@ -0,0 +1,5 @@
+- Keep Directions route errors, the Local ADS-B receiver error and Global
+  Context cohort reasons English in layer data; the Layers panel, Radio card
+  and awareness panel still show them in the interface language. The route
+  proxy's "routing busy" and "route proxy error" refusals are now translated
+  too (daikaginza, #1209).

changelog.d/1220-openai-typed-send.md

@@ -1,3 +0,0 @@
-- Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
-  command, while preserving an earlier accepted deferred input
-  (Manjunath, #1220).

changelog.d/1225-globe-rotation.md

@@ -1,2 +0,0 @@
-- Add continuous globe rotation with direction and speed controls and a globe-fit
-  check before starting (manjunath22466, #1225).

changelog.d/1228-cctv-ontario-511-key.md

@@ -1,4 +0,0 @@
-- Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
-  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
-  otherwise skipped with one log line saying where to get a key
-  (quanticsoul4772, #1228).

changelog.d/1233-tarktee-datex-catalog-hardening.md

@@ -1,4 +0,0 @@
-- Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
-  cancel both response streams when either response fails or overflows the 4 MB
-  byte cap, and deduplicate camera IDs before per-pack prioritization
-  (yaka0007, #1233).

changelog.d/1234-cctv-catalog-background-refresh.md

@@ -1,5 +0,0 @@
-- Serve the camera catalog while it refreshes. An expired catalog made every
-  camera request wait for the slowest pack to reload; it is now answered at
-  once while one background refresh runs, so only the first load waits. Estonia's
-  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
-  on about a third of loads (quanticsoul4772, #1234).

changelog.d/1235-location-resolution.md

@@ -1,3 +0,0 @@
-- Require a geocoded containment anchor for ambiguous analyst region names,
-  preserve boundary provenance and cancellation safety, and retain exact-name
-  precedence for natural outlines (manjunath22466, #1235).

changelog.d/1237-taiwan-freeway-cctv.md

@@ -1,4 +0,0 @@
-- Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
-  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
-  with on-demand snapshots and attribution. No API key is required; set
-  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).

changelog.d/1243-starfield-sky.md

@@ -1,5 +0,0 @@
-- Replace the blocky JPEG sky around the globe with the 9,096 stars of the
-  Yale Bright Star Catalogue, drawn as sharp points where they are at the
-  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
-  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
-  #1243).

changelog.d/1264-overpass-request-admission.md

@@ -1,9 +0,0 @@
-- Prevent malformed Overpass filters from blocking the local server, and reject
-  cross-site or excessive query requests before reading their bodies
-  (asturksever, #1264; fixes #1248).
-- Release unread responses from the optional Google-token probe so keyless
-  browser validation can settle; the Overpass gate recognizes only that probe's
-  expected 404 as an unavailable capability (asturksever, #1264).
-- Make tracking arrival checks respect the aircraft update cadence while checking
-  orientation on the first reveal, avoiding false failures at faster render
-  rates (asturksever, #1264).

changelog.d/1265-docker-trusted-peers.md

@@ -1,3 +0,0 @@
-- Honor Docker Compose trusted-peer and allowed-host settings from the shell
-  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
-  access to Provider Settings before Vite starts (asturksever, #1265).

changelog.d/1268-radio-issue-fix.md

@@ -1,2 +0,0 @@
-- Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
-- Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).

changelog.d/1269-aircraft-issue-fix.md

@@ -1 +0,0 @@
-- Coalesce refreshes and cool down opensky failures (asturksever, #1269).

changelog.d/1270-space-issue-fix.md

@@ -1 +0,0 @@
-- Respect provider cooldowns and bound tle groups (asturksever, #1270).

changelog.d/1271-share-issue-fix.md

@@ -1 +0,0 @@
-- Reject inherited style keys during restore (asturksever, #1271).

changelog.d/1273-history-issue-fix.md

@@ -1 +0,0 @@
-- Retire unavailable history and keep local trails (asturksever, #1273).

changelog.d/1274-import-issue-fix.md

@@ -1 +0,0 @@
-- Scan the kml root delimiter in bounded time (asturksever, #1274).

changelog.d/1275-forecast-issue-fix.md

@@ -1,3 +0,0 @@
-- Preserve enable during first-load replacement (asturksever, #1275).
-- Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
-- Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).

changelog.d/1276-terrain-issue-fix.md

@@ -1 +0,0 @@
-- Bound each height request to one upstream chunk (asturksever, #1276).

changelog.d/1278-overpass-issue-fix.md

@@ -1 +0,0 @@
-- Reserve singleflight before disk cache reads (asturksever, #1278).

changelog.d/1279-launch-issue-fix.md

@@ -1 +0,0 @@
-- Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).

changelog.d/1281-traffic-issue-fix.md

@@ -1,8 +0,0 @@
-- Hold rendering only for animated content (asturksever, #1281).
-- Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
-- Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
-- Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
-- Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
-- Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
-- Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
-- Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).

changelog.d/1283-satellite-cache-provenance.md

@@ -1,3 +0,0 @@
-- Report cached CelesTrak satellite records as stale in the Data Layers row,
-  preserving separate core and dense catalog provenance through refresh,
-  removal and lifecycle cleanup (rudycelekli, #1283).

changelog.d/1284-route-plausibility-segment.md

@@ -1,3 +0,0 @@
-- Keep aircraft route labels on the scheduled airport leg instead of accepting
-  its distant great-circle extensions, preserving generous endpoint tolerance
-  across the signed-angle branch cut (rudycelekli, #1284).

changelog.d/1286-since-note-inline.md

@@ -1,4 +0,0 @@
-- The Street Level SINCE note sits on the value's line, in its type and a
-  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
-  had lost its size variable in the Street Level slim-down and rendered
-  larger than the value, on a line of its own (asturksever, #1286).

changelog.d/1287-shared-sliders.md

@@ -1,3 +0,0 @@
-- Give ordinary sliders a shared native control and consistent track, thumb,
-  value, focus and disabled styling while preserving feature behavior and
-  specialized controls (mazy1998, #1287).

changelog.d/1298-simplified-chinese.md

@@ -1,4 +0,0 @@
-- Add Simplified Chinese (zh-CN) to the language picker, with localized dates
-  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
-  and @EDIT-Aeterna (#979).
-  (German, @gekh, #1298).

changelog.d/1301-shared-segmented-selectors.md

@@ -1,5 +0,0 @@
-- Unify segmented selectors for model coverage, detection allocation, drawing
-  shape, Street View and imagery comparison while preserving their existing
-  behavior. Keep compact labels such as FILL and FLAT on one line, and let
-  collapsed Weather release space to the open rail panel. Reserve the full mode
-  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).

changelog.d/1302-shared-action-buttons.md

@@ -1,3 +0,0 @@
-- Give ordinary Scene and CCTV actions shared native buttons with consistent
-  default, destructive and compact styling while preserving their existing
-  behavior and specialized controls (mazy1998, #1302).

changelog.d/1305-shared-native-form-fields.md

@@ -1,3 +0,0 @@
-- Share native dropdown and numeric-field styling across Scene, CCTV, Display
-  and Radio controls, with a shared CCTV number-input builder that preserves
-  existing precision, validation and commit behavior (mazy1998, #1305).

changelog.d/1306-shared-status-badges.md

@@ -1,4 +0,0 @@
-- Share read-only status badge presentation across CCTV source/frame labels,
-  calibration provenance and Weather coverage, preserving status meanings,
-  palettes, translations and announcements while preparing the view contract
-  for a future Vue migration (mazy1998, #1306).

changelog.d/1308-overpass-admission-review-fixes.md

@@ -0,0 +1,13 @@
+- Keep Overpass-backed layers working behind a reverse proxy: `/api/overpass`
+  now uses the keyless same-site gate, admits forwarding headers and still
+  refuses cross-site requests. Direct loopback requests keep their own
+  admission window; proxied requests, including those a local reverse proxy
+  relays over loopback, are admitted as remote traffic keyed by their socket,
+  and IPv6 peers are keyed by /64, so neither LAN peers nor proxied users can
+  exhaust the owner's admission. The upstream budget stays shared, so an owner
+  cache miss can still be rate-limited (asturksever, #1308).
+- Give the tracking arrival check a wall-clock budget per observed frame and
+  retry only an inconclusive timeout: a timeout keeps every angle it
+  measured, including a late frame's, and a wrong one fails without retry, so slow software-rendered
+  frames no longer fail the check and a real violation is never retried into a
+  pass (asturksever, #1308).

changelog.d/1309-shared-field-css-ownership.md

@@ -1,3 +0,0 @@
-- Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
-  while Radio and Cyber supply explicit field palettes without changing the
-  current appearance or native control behavior (mazy1998, #1309).

changelog.d/1317-provider-response-hardening.md

@@ -1 +0,0 @@
-- Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).

changelog.d/1321-dead-code-cleanup.md

@@ -1,6 +0,0 @@
-- Remove dead code across the repository: three modules nothing imports
-  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
-  and locals nothing reads, a duplicate copy of the bundled dams data and an
-  unused ship model. The app no longer builds an unused default wind layer
-  and Bhote Koshi locator layer when it loads. Package exports are unchanged
-  (samehkhamis, #1321).

changelog.d/1324-street-level-provider-exports.md

@@ -1,8 +0,0 @@
-- Export the KartaView and Panoramax Street Level providers, so a host composing
-  its own provider list can offer the keyless providers without Mapillary
-  (samehkhamis, #1324).
-- A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
-  token itself (such as a same-origin proxy). Its sequence lookups go there
-  through the source's transport, and the photo viewer uses MapillaryJS's
-  Graph provider at that endpoint, so no client token is needed in the page
-  (samehkhamis, #1324).

changelog.d/1325-phone-layout.md

@@ -1,4 +0,0 @@
-- Add a phone layout for viewports 720px and narrower: the globe stays full
-  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
-  panel sheet at a time, keeping attribution visible and scene STOP reachable.
-  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).

changelog.d/1338-mobile-contact-context.md

@@ -1,4 +0,0 @@
-- Improve touch selection of aircraft and vessels through the shared contact
-  picker, reveal tracked aircraft details when opening Context, support downward
-  swipe dismissal of phone drawers while preserving scrolling and controls, and
-  enlarge the phone logo (samehkhamis, #1338).

changelog.d/1341-kartaview-impossible-timestamps.md

@@ -1,3 +0,0 @@
-- Reject impossible KartaView photo timestamps, so 31 February is unknown
-  instead of rolling forward into March and passing the imagery date filter
-  (Rudy Celekli, @rudycelekli, #1341).

changelog.d/1342-firms-acquisition-calendar.md

@@ -1,3 +0,0 @@
-- Keep an impossible wildfire acquisition date off the detection clock, so a
-  fire is not labeled with a later day it did not happen
-  (Rudy Celekli, @rudycelekli, #1342).

changelog.d/1344-inline-panel-visibility.md

@@ -0,0 +1,4 @@
+- Pause the HUD's camera readout while the page is hidden, as polled layers
+  already do. An app embedded inline in a panel keeps both updating, because the
+  panel's host can report the page as hidden while it is on screen (nu-stats,
+  #1344).

changelog.d/1374-director-seek-visibility.md

@@ -0,0 +1,4 @@
+- Restore a shot's declared layer visibility when seeking within it after manual
+  layer changes, including toggles still in flight. Only changed layers are
+  reconciled; refused restoration reports a failed seek and keeps the last
+  position, while undeclared operator layers are preserved (@oneill9, #1374).

changelog.d/1401-geocode-place-region.md

@@ -0,0 +1,2 @@
+- A "place, region" search such as "Paris, Texas" now lands on the place in
+  that region instead of a namesake elsewhere (quanticsoul4772, #1401).

changelog.d/1402-terrain-429-pause.md

@@ -0,0 +1,5 @@
+- The terrain proxy stops asking the upstream for a while after a 429
+  (its Retry-After, at most 10 minutes, or 60 s) instead of retrying on every
+  page request, and a Retry-After longer than its 10 s retry budget now ends
+  the retries at once instead of sleeping the budget out (quanticsoul4772,
+  #1402).

changelog.d/1404-perimeters-stale.md

@@ -0,0 +1,3 @@
+- Fire Perimeters and `get_fire_perimeters` say when WFIGS is unreachable and
+  the last snapshot is being shown (STALE, its age, "data may be stale"), and
+  that snapshot is served for at most 24 hours (quanticsoul4772, #1404).

changelog.d/1405-traffic-layer-stale.md

@@ -0,0 +1,3 @@
+- The Traffic layer reads STALE instead of LIVE when the TomTom proxy serves
+  cached flow tiles (budget spent or TomTom failing), and the row dates them by
+  the oldest cached tile (quanticsoul4772, #1405).

changelog.d/1427-military-installations-cross-site-gate.md

@@ -0,0 +1,4 @@
+- The military-installations proxy (`/api/military-installations`) now refuses
+  cross-site and reverse-proxy-forwarded browser requests with 403 before any
+  Overpass work, through the same shared gate as `/api/overpass`. Same-origin
+  app requests and local tools such as curl still work (@Sunil56224972, #1427).

changelog.d/1430-traditional-chinese.md

@@ -0,0 +1,4 @@
+- Add Traditional Chinese (zh-Hant) with language selection and localized
+  Chinese readouts: the Simplified Chinese catalog written in Traditional
+  characters, based on translations by @abiyeenzo (#914) and @EDIT-Aeterna
+  (#979) (German, @gekh, #1430).

changelog.d/1432-vessel-course-north.md

@@ -0,0 +1,3 @@
+- Show a vessel course of 359.5° or more as 0°. Vessel cards and the AIS HUD
+  rounded the course without wrapping, so a ship with no reported heading on
+  a 359.7° course read "360°" and "HDG: 360DEG" (Aditya, @Rohilalala, #1432).

changelog.d/1433-awareness-marker-kilometre.md

@@ -0,0 +1,6 @@
+- Show a Contacts marker 999.5 m or more away as 1.0 km. The on-globe marker
+  chose metres before rounding, so 999.6 m read "1000 m" while the panel read
+  "1.0 km" (Aditya, @Rohilalala, #1433).
+- Distance labels share one formatter that takes each unit cut after rounding,
+  so the Contacts panel and markers, the drawn-line measure and the Cockpit
+  show 9.96 km as 10 km rather than 10.0 km (#1433).

changelog.d/1434-voice-unknown-altitude.md

@@ -0,0 +1,3 @@
+- Selecting the nearest aircraft by voice no longer says "0 feet" for a contact
+  whose feed reported no altitude; the reply and card leave the altitude out
+  (Aditya, @Rohilalala, #1434).

changelog.d/1435-military-positionless-rows.md

@@ -0,0 +1,5 @@
+- Military aircraft that leave the adsb.lol feed fade and are removed again.
+  The feed's routine position-less rows no longer mark every snapshot partial,
+  which kept vanished aircraft at full opacity for up to five minutes; those
+  rows keep only their own aircraft, and a likely-landed one still leaves on
+  the landed limit (Aditya, @Rohilalala, #1435).

changelog.d/1436-military-geom-vertical-rate.md

@@ -0,0 +1,3 @@
+- Military aircraft whose transponders report a GNSS vertical rate now carry it
+  in analyst and tracked-aircraft data instead of null (Aditya, @Rohilalala,
+  #1436).

changelog.d/1441-cctv-heading-north.md

@@ -0,0 +1,3 @@
+- Show a CCTV camera facing 359.5° or more as HDG 0°. The HUD heading token
+  and the camera panel rounded the bearing without wrapping, so a camera
+  facing 359.6° read "HDG 360°" (Aditya, @Rohilalala, #1441).

changelog.d/1442-traffic-coverage-edges.md

@@ -0,0 +1,4 @@
+- Keep Street Traffic's flow status honest at the edges. A few TomTom-matched
+  dots among hundreds rounded to 0% and read "(no matches)", and a few
+  simulated dots rounded to "100% cov"; coverage now stays within 1–99% while
+  both are shown (Aditya, @Rohilalala, #1442).

changelog.d/1443-replay-countdown-ten.md

@@ -0,0 +1,3 @@
+- Run Space Missions' Replay Ascent countdown from T−10 after the five-second
+  tile hold; the hold ran 10 s and the countdown started at T−05 (Aditya,
+  @Rohilalala, #1443).

changelog.d/1444-replay-speed-countdown.md

@@ -0,0 +1,3 @@
+- Keep Space Missions' replay countdown in real time when the replay speed
+  changes before liftoff; 0.25× had stretched T−8 to T−32 (Aditya,
+  @Rohilalala, #1444).

changelog.d/1445-annotation-label-units.md

@@ -0,0 +1,3 @@
+- Label a route, arrow or drawn line of 995 m or more as 1.0 km, and of
+  9,950 m or more as 10 km. The placed label picked the unit before rounding,
+  so it read "1000 m" and "10.0 km" (Aditya, @Rohilalala, #1445).

changelog.d/1446-draw-area-units.md

@@ -0,0 +1,3 @@
+- Show a drawn area of 9,999.5 m² or more as 1.0 ha, and of 999,500 m² or
+  more as 1.00 km². The draw hint picked the unit before rounding, so it read
+  "10000 m²" and "100.0 ha" (Aditya, @Rohilalala, #1446).

changelog.d/1447-bikeshare-derived-capacity.md

@@ -0,0 +1,3 @@
+- Bike Share stations whose feed publishes no capacity now take it from each
+  status poll's bikes and docks instead of keeping the first poll's value or
+  the placeholder 15 (Aditya, @Rohilalala, #1447).

changelog.d/1448-local-adsb-geom-rate.md

@@ -0,0 +1,6 @@
+- Local ADS-B decoder feeds now carry a GNSS-sourced vertical rate
+  (`geom_rate`) when no barometric rate is sent, so the card shows V/S
+  instead of a dash (Aditya, @Rohilalala, #1448).
+- Local ADS-B, military and the adsb.lol flight fallback read the vertical
+  rate through one shared readsb field reader, so all three prefer the
+  barometric rate and fall back to the GNSS rate the same way (#1448).

changelog.d/1449-cable-tool-duplicates.md

@@ -0,0 +1,3 @@
+- List each submarine cable once in find_submarine_cables. TeleGeography
+  splits 17 cables (2Africa, Echo, Hawaiki) into several features, so a
+  search for Echo read "3 submarine cables" (Aditya, @Rohilalala, #1449).

changelog.d/1450-directions-ten-km.md

@@ -0,0 +1,3 @@
+- Show a route of 9.95 km or more as 10 km. The Directions row and step
+  cards kept one decimal until the raw distance reached 10 km, so 9.96 km
+  read "10.0 km" (Aditya, @Rohilalala, #1450).

changelog.d/1451-alpr-direction-north.md

@@ -0,0 +1,2 @@
+- Show an ALPR camera's mapped bearing of 359.5° or more as DIRECTION 0°
+  rather than DIRECTION 360° (Aditya, @Rohilalala, #1451).

changelog.d/1452-transit-heading-north.md

@@ -0,0 +1,3 @@
+- Show a transit vehicle's reported bearing of 359.5° or more as 0°. The
+  selected-vehicle card rounded it without wrapping, so a bus heading 359.6°
+  read "reported hdg 360°" (Aditya, @Rohilalala, #1452).

changelog.d/1453-satellite-launch-year.md

@@ -0,0 +1,6 @@
+- Space Missions no longer shows an older satellite with a similar name and a
+  different known launch year as a new payload's orbit: the launch-year check
+  on loaded satellites now runs (Aditya, @Rohilalala, #1453).
+- Satellite launch years come from one TLE designator parser for both the
+  loaded catalog and the active-TLE fallback; a blank designator is an
+  unknown year instead of 2000 (#1453).

changelog.d/1454-voice-context-heading-north.md

@@ -0,0 +1,5 @@
+- Describe a selected flight or military contact on 359.5° or more to the
+  voice assistant as heading 0°, not 360° (Aditya, @Rohilalala, #1454).
+- Heading and bearing readouts share one rounding helper, so the Cockpit's
+  TRACK ACQUIRED course no longer reads 360°, and a negative bearing wraps
+  instead of printing a minus sign (#1454).

changelog.d/1456-terrain-partial-heights.md

@@ -0,0 +1,3 @@
+- A terrain request the proxy can only partly answer (a 429 pause, or a point
+  the upstream returns without a height) now keeps the real heights it has
+  instead of putting the whole chunk on the geoid (quanticsoul4772, #1456).

changelog.d/1457-dock-icon-only-wings.md

@@ -0,0 +1,5 @@
+- Between 721px and 900px wide (tablet portrait, phone landscape), the
+  Location and Visual Presets dock wings show only their icons, so their
+  labels no longer spill over the voice control or take taps meant for the
+  mic button. The full name stays in the tooltip and accessible name, and the
+  Cyber layout keeps its labels (Denis Groshev, @ZloyS, #1457).

changelog.d/1458-node-24-22-1-security-release.md

@@ -0,0 +1,4 @@
+- The Docker image and CI now pin Node 24.22.2, the current 24 LTS patch. It
+  carries the October 21, 2026 security fixes first released in 24.22.1,
+  including CVE-2026-111497 in the Brotli decoder (Luis Ortiz, @anobjectn,
+  #1458).