Merge branch 'main' into fix/terrain-test-cache-isolation

changelog.d/1200-cctv-live-icon-color.md

@@ -0,0 +1,5 @@
+- Color CCTV cameras with a video feed violet. Cameras with an HLS, MP4 or
+  WebM feed were the same cyan as stills, so a DelDOT or Statens vegvesen
+  video camera could only be found by opening it. Stills stay cyan and the
+  active camera stays amber, and focus de-emphasis fades the violet the same
+  way (Danielslay86, #1200).

changelog.d/1201-cctv-stills-aspect.md

@@ -0,0 +1,4 @@
+- Draw CCTV stills at their source aspect on the monitor plane instead of
+  stretching them to the 16:9 canvas. Most DOT cameras publish 4:3 frames, so
+  every still was widened; they are now centered and pillarboxed on the dark
+  the placeholder already ends on (Danielslay86, #1201).

changelog.d/1205-cctv-tool-routing.md

@@ -0,0 +1,3 @@
+- Report actual outcomes when voice enables or disables CCTV through the shared
+  layer lifecycle, including failed and cancelled changes (manjunath22466,
+  #1205).

changelog.d/1220-openai-typed-send.md

@@ -0,0 +1,3 @@
+- Avoid starting or queuing a reply when the local channel rejects a typed OpenAI
+  command, while preserving an earlier accepted deferred input
+  (Manjunath, #1220).

changelog.d/1225-globe-rotation.md

@@ -0,0 +1,2 @@
+- Add continuous globe rotation with direction and speed controls and a globe-fit
+  check before starting (manjunath22466, #1225).

changelog.d/1228-cctv-ontario-511-key.md

@@ -0,0 +1,4 @@
+- Load Ontario 511 cameras again. 511on.ca's camera endpoint now requires a
+  free developer key; set `ONTARIO_511_API_KEY` to enable the pack, which is
+  otherwise skipped with one log line saying where to get a key
+  (quanticsoul4772, #1228).

changelog.d/1229-opensky-oauth-only.md

@@ -0,0 +1,8 @@
+- OpenSky sign-in matches what OpenSky accepts since 2026-03-18. The server
+  now reads `OPENSKY_CREDENTIALS_FILE` (the `credentials.json` OpenSky's
+  account page downloads) on every platform, not only through the macOS
+  launcher, and no longer sends retired username/password Basic auth:
+  `OPENSKY_AUTH_MODE=basic` loads anonymously with one warning saying what to
+  set instead (quanticsoul4772, #1229).
+- Credential-file warnings omit parser excerpts and filesystem error details;
+  the path example also works with the macOS launchers.

changelog.d/1233-tarktee-datex-catalog-hardening.md

@@ -0,0 +1,4 @@
+- Harden the Tarktee (Estonia) DATEX2 camera catalog fetches: refuse redirects,
+  cancel both response streams when either response fails or overflows the 4 MB
+  byte cap, and deduplicate camera IDs before per-pack prioritization
+  (yaka0007, #1233).

changelog.d/1234-cctv-catalog-background-refresh.md

@@ -0,0 +1,5 @@
+- Serve the camera catalog while it refreshes. An expired catalog made every
+  camera request wait for the slowest pack to reload; it is now answered at
+  once while one background refresh runs, so only the first load waits. Estonia's
+  slow Tarktee feeds get 30 s instead of 15 s, so the pack no longer drops out
+  on about a third of loads (quanticsoul4772, #1234).

changelog.d/1235-location-resolution.md

@@ -0,0 +1,3 @@
+- Require a geocoded containment anchor for ambiguous analyst region names,
+  preserve boundary provenance and cancellation safety, and retain exact-name
+  precedence for natural outlines (manjunath22466, #1235).

changelog.d/1237-taiwan-freeway-cctv.md

@@ -0,0 +1,4 @@
+- Add Taiwan's national freeway cameras from the Freeway Bureau, MOTC to CCTV:
+  ~1,800 cameras read at runtime from the official MOTC 2.0 open-data table,
+  with on-demand snapshots and attribution. No API key is required; set
+  `CCTV_TAIWAN_ENABLED=0` to skip it (419vive, #1237).

changelog.d/1243-starfield-sky.md

@@ -0,0 +1,5 @@
+- Replace the blocky JPEG sky around the globe with the 9,096 stars of the
+  Yale Bright Star Catalogue, drawn as sharp points where they are at the
+  scene time, over a soft Milky Way from ESO/S. Brunier (CC BY 4.0). The Sun
+  and Moon stay; the anime style hides the Milky Way. Assets: 296 kB (gekh,
+  #1243).

changelog.d/1264-overpass-request-admission.md

@@ -0,0 +1,9 @@
+- Prevent malformed Overpass filters from blocking the local server, and reject
+  cross-site or excessive query requests before reading their bodies
+  (asturksever, #1264; fixes #1248).
+- Release unread responses from the optional Google-token probe so keyless
+  browser validation can settle; the Overpass gate recognizes only that probe's
+  expected 404 as an unavailable capability (asturksever, #1264).
+- Make tracking arrival checks respect the aircraft update cadence while checking
+  orientation on the first reveal, avoiding false failures at faster render
+  rates (asturksever, #1264).

changelog.d/1265-docker-trusted-peers.md

@@ -0,0 +1,3 @@
+- Honor Docker Compose trusted-peer and allowed-host settings from the shell
+  or project `.env`, and let `GEV_KEY_SETUP_TRUSTED_PEERS=none` disable gateway
+  access to Provider Settings before Vite starts (asturksever, #1265).

changelog.d/1268-radio-issue-fix.md

@@ -0,0 +1,2 @@
+- Normalize station tags and retain valid mixed rows; skipped malformed rows still report degraded coverage (asturksever, #1268).
+- Correct Radio QA push-to-talk setup to target the mounted voice controller (asturksever, #1268).

changelog.d/1269-aircraft-issue-fix.md

@@ -0,0 +1 @@
+- Coalesce refreshes and cool down opensky failures (asturksever, #1269).

changelog.d/1270-space-issue-fix.md

@@ -0,0 +1 @@
+- Respect provider cooldowns and bound tle groups (asturksever, #1270).

changelog.d/1271-share-issue-fix.md

@@ -0,0 +1 @@
+- Reject inherited style keys during restore (asturksever, #1271).

changelog.d/1273-history-issue-fix.md

@@ -0,0 +1 @@
+- Retire unavailable history and keep local trails (asturksever, #1273).

changelog.d/1274-import-issue-fix.md

@@ -0,0 +1 @@
+- Scan the kml root delimiter in bounded time (asturksever, #1274).

changelog.d/1275-forecast-issue-fix.md

@@ -0,0 +1,3 @@
+- Preserve enable during first-load replacement (asturksever, #1275).
+- Release disabled weather camera listeners and make teardown resource leaks fail the browser probe (asturksever, #1275).
+- Keep visible-page weather teardown probes focused through the browser testing API (asturksever, #1275).

changelog.d/1276-terrain-issue-fix.md

@@ -0,0 +1 @@
+- Bound each height request to one upstream chunk (asturksever, #1276).

changelog.d/1278-overpass-issue-fix.md

@@ -0,0 +1 @@
+- Reserve singleflight before disk cache reads (asturksever, #1278).

changelog.d/1279-launch-issue-fix.md

@@ -0,0 +1 @@
+- Throttle mission hover picks with a trailing check for the last pointer position, and clear stale cursors (asturksever, #1279).

changelog.d/1281-traffic-issue-fix.md

@@ -0,0 +1,8 @@
+- Hold rendering only for animated content (asturksever, #1281).
+- Exercise current vector road sources and published camera bounds in Traffic fixture QA (asturksever, #1281).
+- Establish browser-level foreground visibility for Traffic QA and reject hidden-page samples (asturksever, #1281).
+- Supply CORS headers on cross-origin traffic fixtures and report browser exceptions without disabling browser security (asturksever, #1281).
+- Isolate the Traffic keyless browser scenario from the keyed page’s workers and intercepted cache (asturksever, #1281).
+- Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1281).
+- Intercept only Traffic provider URLs, leaving Cesium worker and module loading untouched (asturksever, #1281).
+- Settle an unfinished Traffic height correction when the last animated point leaves, so the layer stops reporting loading once its render hold is released (asturksever, #1281).

changelog.d/1282-polling-issue-fix.md

@@ -0,0 +1,7 @@
+- Pause periodic network updates in hidden tabs; the overdue update on return restarts the polling schedule, so the next poll follows one interval later even when that update fails (asturksever, #1282).
+- Report and guard browser visibility during Transit QA so hidden-page polling pauses cannot masquerade as playback regressions (asturksever, #1282).
+- Require each live city to supply its own feed vehicles in Transit QA; retained vehicles cannot qualify another city (asturksever, #1282).
+- Bound the Transit card-anchor probe by observed poll coverage instead of a fixed 20-second window (asturksever, #1282).
+- Keep visible-page Transit probes focused through the browser testing API (asturksever, #1282).
+- Add a real-browser regression gate for hidden-tab periodic work, explicit refresh, resume and teardown (asturksever, #1282).
+- Restore minimized test windows before screenshots so native compositor pauses cannot stall browser acceptance (asturksever, #1282).

changelog.d/1283-satellite-cache-provenance.md

@@ -0,0 +1,3 @@
+- Report cached CelesTrak satellite records as stale in the Data Layers row,
+  preserving separate core and dense catalog provenance through refresh,
+  removal and lifecycle cleanup (rudycelekli, #1283).

changelog.d/1284-route-plausibility-segment.md

@@ -0,0 +1,3 @@
+- Keep aircraft route labels on the scheduled airport leg instead of accepting
+  its distant great-circle extensions, preserving generous endpoint tolerance
+  across the signed-angle branch cut (rudycelekli, #1284).

changelog.d/1286-since-note-inline.md

@@ -0,0 +1,4 @@
+- The Street Level SINCE note sits on the value's line, in its type and a
+  size smaller: with KartaView lit it reads ANY DATE (by upload date). It
+  had lost its size variable in the Street Level slim-down and rendered
+  larger than the value, on a line of its own (asturksever, #1286).

changelog.d/1287-shared-sliders.md

@@ -0,0 +1,3 @@
+- Give ordinary sliders a shared native control and consistent track, thumb,
+  value, focus and disabled styling while preserving feature behavior and
+  specialized controls (mazy1998, #1287).

changelog.d/1298-simplified-chinese.md

@@ -0,0 +1,4 @@
+- Add Simplified Chinese (zh-CN) to the language picker, with localized dates
+  and readable Chinese labels. Based on translations by @abiyeenzo (#914)
+  and @EDIT-Aeterna (#979).
+  (German, @gekh, #1298).

changelog.d/1301-shared-segmented-selectors.md

@@ -0,0 +1,5 @@
+- Unify segmented selectors for model coverage, detection allocation, drawing
+  shape, Street View and imagery comparison while preserving their existing
+  behavior. Keep compact labels such as FILL and FLAT on one line, and let
+  collapsed Weather release space to the open rail panel. Reserve the full mode
+  button height in Recent Imagery so keyboard focus is not clipped (mazy1998, #1301).

changelog.d/1302-shared-action-buttons.md

@@ -0,0 +1,3 @@
+- Give ordinary Scene and CCTV actions shared native buttons with consistent
+  default, destructive and compact styling while preserving their existing
+  behavior and specialized controls (mazy1998, #1302).

changelog.d/1304-antimeridian-distances.md

@@ -0,0 +1,2 @@
+- Point distances wrap longitude differences across the antimeridian, in voice
+  proximity checks and `places_nearby` (quanticsoul4772, #1304).

changelog.d/1305-shared-native-form-fields.md

@@ -0,0 +1,3 @@
+- Share native dropdown and numeric-field styling across Scene, CCTV, Display
+  and Radio controls, with a shared CCTV number-input builder that preserves
+  existing precision, validation and commit behavior (mazy1998, #1305).

changelog.d/1306-shared-status-badges.md

@@ -0,0 +1,4 @@
+- Share read-only status badge presentation across CCTV source/frame labels,
+  calibration provenance and Weather coverage, preserving status meanings,
+  palettes, translations and announcements while preparing the view contract
+  for a future Vue migration (mazy1998, #1306).

changelog.d/1309-shared-field-css-ownership.md

@@ -0,0 +1,3 @@
+- Clarify shared field CSS ownership: CCTV owns calibration editor sizing,
+  while Radio and Cyber supply explicit field palettes without changing the
+  current appearance or native control behavior (mazy1998, #1309).

changelog.d/1317-provider-response-hardening.md

@@ -0,0 +1 @@
+- Validate provider response formats, strengthen camera source checks, and apply consistent API response protections (samehkhamis, #1317).

changelog.d/1321-dead-code-cleanup.md

@@ -0,0 +1,6 @@
+- Remove dead code across the repository: three modules nothing imports
+  (`src/ui.js`, `src/standalone/ui.js`, `src/data/localLayers.js`), exports
+  and locals nothing reads, a duplicate copy of the bundled dams data and an
+  unused ship model. The app no longer builds an unused default wind layer
+  and Bhote Koshi locator layer when it loads. Package exports are unchanged
+  (samehkhamis, #1321).

changelog.d/1324-street-level-provider-exports.md

@@ -0,0 +1,8 @@
+- Export the KartaView and Panoramax Street Level providers, so a host composing
+  its own provider list can offer the keyless providers without Mapillary
+  (samehkhamis, #1324).
+- A Mapillary source can take a `graphEndpoint`, a Graph API base that adds the
+  token itself (such as a same-origin proxy). Its sequence lookups go there
+  through the source's transport, and the photo viewer uses MapillaryJS's
+  Graph provider at that endpoint, so no client token is needed in the page
+  (samehkhamis, #1324).

changelog.d/1325-phone-layout.md

@@ -0,0 +1,4 @@
+- Add a phone layout for viewports 720px and narrower: the globe stays full
+  screen and a bottom tab bar (Layers, Cameras, Context, Search, More) opens one
+  panel sheet at a time, keeping attribution visible and scene STOP reachable.
+  Adapted from the phone tab-shell in #203 by blearymoth (samehkhamis, #1325).

changelog.d/1338-mobile-contact-context.md

@@ -0,0 +1,4 @@
+- Improve touch selection of aircraft and vessels through the shared contact
+  picker, reveal tracked aircraft details when opening Context, support downward
+  swipe dismissal of phone drawers while preserving scrolling and controls, and
+  enlarge the phone logo (samehkhamis, #1338).

changelog.d/1341-kartaview-impossible-timestamps.md

@@ -0,0 +1,3 @@
+- Reject impossible KartaView photo timestamps, so 31 February is unknown
+  instead of rolling forward into March and passing the imagery date filter
+  (Rudy Celekli, @rudycelekli, #1341).

changelog.d/1342-firms-acquisition-calendar.md

@@ -0,0 +1,3 @@
+- Keep an impossible wildfire acquisition date off the detection clock, so a
+  fire is not labeled with a later day it did not happen
+  (Rudy Celekli, @rudycelekli, #1342).

changelog.d/872-gemini-live-voice.md

@@ -0,0 +1,4 @@
+- Add optional Gemini Live voice to the standalone app, with a provider chooser,
+  server-held API key, microphone streaming, shared map actions and captions.
+  Switching providers ends the old conversation and preserves the input mode
+  (Manjunath, #872).

changelog.d/945-cctv-vegvesen-kartverket-heights.md

@@ -0,0 +1,17 @@
+- Give each Statens vegvesen camera its own ground height from Kartverket's
+  keyless point-height API (CC BY 4.0) instead of one flat 150 m prior, so
+  mountain-pass cameras no longer sit hundreds of metres below the terrain
+  where neither the point-height prior nor the ground snap resolves. About 850
+  of ~855 cameras get a height; the rest keep the old prior. Requests carry 20
+  points, the most the API answers from its 1 m terrain model, eight at a
+  time; a cold lookup takes about 6–13 s. Cameras over water use the water
+  surface rather than the sea-floor depth the API returns there; for bridge
+  cameras that is still below the deck. Heights are cached for good and misses
+  for 6 h, so a refresh only asks about new or moved cameras. After a
+  failing request (a 408, 429 or 5xx, a network error, a request over 10 s or
+  an unreadable body) the lookup stops and backs off (Retry-After, else
+  30 min, longer than the refresh). The lane waits at most 12 s from its
+  start, and only on a cold cache; a slower first lookup leaves the cameras it
+  had not reached on the flat prior until the next 15-minute refresh, and
+  keeps filling the cache meanwhile.
+  `CCTV_VEGVESEN_HEIGHTS=0` turns it off. Follow-up to #929 (trygvehhh, #945).

changelog.d/974-street-level-slim.md

@@ -0,0 +1,6 @@
+- Street Level is rebuilt around one small provider registry: Mapillary,
+  KartaView, Panoramax and Google Street View share one coverage drawer and
+  one photo viewer, one source lit at a time. Floating and docked panels,
+  FOLLOW, surface modes, the legend and the Mapillary proxy's disk cache are
+  gone; `.gev-cache/mapillary/` from earlier runs is no longer read and can be
+  deleted (gekh, #974).

changelog.d/990-hong-kong-cctv.md

@@ -0,0 +1,7 @@
+- Add Hong Kong Transport Department traffic snapshot cameras as a keyless CCTV
+  source pack: the public DATA.GOV.HK English locations XML, frames pinned to
+  `tdcctv.data.one.gov.hk`, with DATA.GOV.HK Terms of Use attribution. By
+  default nearly the full TD catalog (~1,013 cameras; cap 1,100) loads,
+  prioritized across Hong Kong Island, Kowloon and the New Territories. Headings
+  use the shared id-hash fallback at low confidence. `CCTV_HK_MAX_SOURCES` sets
+  the cap (8–1,200) and `CCTV_HK_ENABLED=0` turns the pack off (JCY2515, #990).