Merge remote-tracking branch 'upstream/main' into feat/bikeshare-bogota-santiago

# Conflicts:
#	CHANGELOG.md
#	DATA_SOURCES.md
#	src/data/dataCredits.js
#	src/layers/bikeshare/registry.js

src/layers/airQuality/index.js

@@ -0,0 +1,286 @@
+import * as Cesium from 'cesium';
+import {
+  AIR_QUALITY_BANDS,
+  AIR_QUALITY_OVERLAY_SOURCE_ID,
+  AIR_QUALITY_OVERLAY_COHORT_LIMIT,
+  AIR_QUALITY_OVERLAY_COLLISION_CAPACITY,
+  AIR_QUALITY_PROVIDERS,
+  createAirQualityOverlayEntry,
+  mapAnalystRecord,
+  newestObservation,
+  readingsAreStale,
+  readingsInView,
+  selectAirQualityOverlayCohort,
+} from './model.js';
+export * from './model.js';
+export { createEcccAirQualitySource } from './source.js';
+
+/** Station markers are a point reading, not an extent. */
+const STATION_MARKER_RADIUS_M = 6_000;
+/** Readings listed in the readout card. */
+const READOUT_LIMIT = 5;
+
+/** Own one air-quality display, its refresh lifecycle, and its readout card. */
+export function createAirQualityLayer({ source, overlayHost } = {}) {
+  if (typeof source?.getSnapshot !== 'function')
+    throw new TypeError('Air quality requires a snapshot source');
+  if (!overlayHost) throw new TypeError('Air quality requires an overlay host');
+  let _viewer = null;
+  let _request = null;
+  let _dataSource = null;
+  let _readings = [];
+  let _count = 0;
+  let _lastUpdate = null;
+  let _lastError = null;
+  let _enabled = false;
+  let rowControlsListener = null;
+
+  const notify = () => rowControlsListener?.();
+
+  /** The camera's lon/lat rectangle in degrees, or null when unresolvable. */
+  const viewRectangle = () => {
+    const rectangle = _viewer?.camera?.computeViewRectangle?.();
+    if (!rectangle) return null;
+    const toDeg = Cesium.Math.toDegrees;
+    return {
+      west: toDeg(rectangle.west),
+      south: toDeg(rectangle.south),
+      east: toDeg(rectangle.east),
+      north: toDeg(rectangle.north),
+    };
+  };
+
+  const layer = {
+    id: 'air-quality',
+    name: 'Air quality',
+    icon: '◍',
+    source: 'ECCC MSC GeoMet',
+    updateInterval: 1_200_000,
+
+    init(viewer) {
+      if (_viewer) throw new Error('Air quality layer is already initialized');
+      _viewer = viewer;
+      _dataSource = new Cesium.CustomDataSource('air-quality');
+      _dataSource.show = false;
+      viewer.dataSources.add(_dataSource);
+      _readings = [];
+      _count = 0;
+      _lastUpdate = null;
+      _lastError = null;
+      _enabled = false;
+      overlayHost.setVisible(AIR_QUALITY_OVERLAY_SOURCE_ID, false);
+    },
+
+    enable() {
+      _enabled = true;
+      if (_dataSource) _dataSource.show = true;
+      overlayHost.setVisible(AIR_QUALITY_OVERLAY_SOURCE_ID, true);
+      notify();
+    },
+
+    disable() {
+      // Abort in flight: a response arriving after disable must not redraw.
+      _request?.abort();
+      _request = null;
+      _enabled = false;
+      if (_dataSource) _dataSource.show = false;
+      overlayHost.clearSource(AIR_QUALITY_OVERLAY_SOURCE_ID);
+      overlayHost.setVisible(AIR_QUALITY_OVERLAY_SOURCE_ID, false);
+      notify();
+    },
+
+    async update() {
+      if (!_enabled || !_dataSource) return false;
+      _request?.abort();
+      const request = new AbortController();
+      _request = request;
+      try {
+        const readings = await source.getSnapshot({ signal: request.signal });
+        // A superseded or aborted request must not touch the scene, and neither
+        // must one that lands after the layer was switched off.
+        if (request.signal.aborted || _request !== request || !_enabled)
+          return false;
+        _readings = readings;
+        this._render();
+        _count = _readings.length;
+        _lastUpdate = Date.now();
+        _lastError = null;
+        notify();
+        return true;
+      } catch (error) {
+        if (request.signal.aborted || _request !== request) return false;
+        _lastError = error?.message || 'Air quality request failed';
+        console.warn('[Data:AirQuality] Refresh failed:', _lastError);
+        notify();
+        return false;
+      } finally {
+        if (_request === request) _request = null;
+      }
+    },
+
+    /** Rebuild entities and overlay labels from the current readings. */
+    _render() {
+      if (!_dataSource) return;
+      _dataSource.entities.removeAll();
+      const overlayEntries = [];
+      for (const reading of _readings) {
+        const position = Cesium.Cartesian3.fromDegrees(
+          reading.lon,
+          reading.lat,
+        );
+        const color = Cesium.Color.fromCssColorString(reading.color);
+        _dataSource.entities.add(
+          new Cesium.Entity({
+            id: `air-quality:${reading.id}`,
+            position,
+            ellipse: {
+              // Static axes, as in the earthquake layer: a per-frame axis
+              // re-tessellates the clamped ground primitive every frame.
+              semiMajorAxis: STATION_MARKER_RADIUS_M,
+              semiMinorAxis: STATION_MARKER_RADIUS_M,
+              material: new Cesium.ColorMaterialProperty(color.withAlpha(0.35)),
+              outline: true,
+              outlineColor: color.withAlpha(0.9),
+              outlineWidth: 2,
+              heightReference: Cesium.HeightReference.CLAMP_TO_GROUND,
+            },
+            properties: {
+              provider: reading.provider,
+              scale: reading.scale,
+              value: reading.value,
+              band: reading.band,
+              name: reading.name,
+              zone: reading.zone,
+              risk: reading.risk,
+              observedMs: reading.observedMs,
+              note: reading.note,
+              lat: reading.lat,
+              lon: reading.lon,
+            },
+          }),
+        );
+        overlayEntries.push(
+          createAirQualityOverlayEntry({
+            id: reading.id,
+            position,
+            title: `${reading.name} ${reading.label}`,
+            accent: reading.color,
+            value: reading.value,
+          }),
+        );
+      }
+      if (_enabled) {
+        overlayHost.setEntries(
+          AIR_QUALITY_OVERLAY_SOURCE_ID,
+          selectAirQualityOverlayCohort(overlayEntries),
+          {
+            cohortLimit: AIR_QUALITY_OVERLAY_COHORT_LIMIT,
+            collisionCapacity: AIR_QUALITY_OVERLAY_COLLISION_CAPACITY,
+            moving: false,
+          },
+        );
+      }
+    },
+
+    destroy(viewer = _viewer) {
+      _request?.abort();
+      _request = null;
+      _enabled = false;
+      overlayHost.clearSource(AIR_QUALITY_OVERLAY_SOURCE_ID);
+      overlayHost.setVisible(AIR_QUALITY_OVERLAY_SOURCE_ID, false);
+      if (_dataSource) {
+        viewer?.dataSources?.remove(_dataSource, true);
+        _dataSource = null;
+      }
+      _viewer = null;
+      _readings = [];
+      _count = 0;
+      _lastUpdate = null;
+      _lastError = null;
+      rowControlsListener = null;
+    },
+
+    /**
+     * Readout descriptor for the Weather panel: the band legend, and the worst
+     * readings currently in view.
+     *
+     * `readout: true` renders the toggle and source line only; the card owns
+     * the rest. Coverage is stated plainly because this layer is not global.
+     */
+    getRowControls() {
+      const provider = AIR_QUALITY_PROVIDERS.eccc;
+      const inView = readingsInView(_readings, viewRectangle(), READOUT_LIMIT);
+      const newest = _readings.reduce(
+        (max, reading) => Math.max(max, reading.observedMs || 0),
+        0,
+      );
+      return {
+        readout: true,
+        summary: {
+          label: provider.label,
+          coverage: provider.coverage,
+          validTime: newest ? new Date(newest).toISOString() : undefined,
+          detail: `${provider.network} · ${provider.scale}`,
+          status: _lastError
+            ? _lastError
+            : _count === 0
+              ? _lastUpdate === null
+                ? 'No readings available'
+                : 'No current readings'
+              : `${_count} stations reporting`,
+          units: provider.scale,
+        },
+        legend: AIR_QUALITY_BANDS.map((band) => ({
+          color: band.color,
+          label: band.label,
+        })),
+        legendCategorical: true,
+        list: {
+          ariaLabel: 'Highest air-quality readings in view',
+          items: inView.map((reading, index) => ({
+            id: reading.id,
+            ordinal: index + 1,
+            lead: `${reading.scale} ${reading.label}`,
+            text: `${reading.name} · ${reading.risk}`,
+            accent: reading.color,
+          })),
+        },
+      };
+    },
+
+    setRowControlsListener(listener) {
+      rowControlsListener = typeof listener === 'function' ? listener : null;
+    },
+
+    /**
+     * Snapshot readings as JSON-safe records for the analyst query engine.
+     * @param {number} [maxCount=500]
+     * @returns {Array<object>}
+     */
+    getAnalystRecords(maxCount = 500) {
+      if (!_enabled || !_readings.length) return [];
+      const limit = Number.isFinite(maxCount)
+        ? Math.max(1, Math.floor(maxCount))
+        : 500;
+      return _readings
+        .slice(0, limit)
+        .map((reading, index) => mapAnalystRecord(reading, index));
+    },
+
+    getStats() {
+      // `lastUpdate` is when a response was received; `observedAt` is when the
+      // network actually measured. Freshness is judged on the latter, so a feed
+      // that keeps answering with hours-old observations reports STALE rather
+      // than being narrated as live by the HUD and voice provenance envelope.
+      return {
+        count: _count,
+        lastUpdate: _lastUpdate,
+        error: _lastError,
+        observedAt: newestObservation(_readings),
+        // Only a completed refresh can be stale; before one there is no feed.
+        stale: _lastUpdate !== null && readingsAreStale(_readings),
+      };
+    },
+  };
+  return layer;
+}

src/layers/airQuality/model.js

@@ -0,0 +1,377 @@
+/**
+ * @module layers/airQuality/model
+ *
+ * Air-quality readings, normalized across networks. Pure — no Cesium, no
+ * network.
+ *
+ * Air-quality indices are not interchangeable numbers. Canada's AQHI runs 1 to
+ * 10+ on health risk; the US AQI runs 0 to 500 on concentration breakpoints;
+ * Europe's EAQI is a five-step category. A reading is therefore carried as
+ * `{ provider, scale, value, band }` — who measured it, which index it is, the
+ * value on that index's own terms, and the band it falls in — so a second
+ * network can be added without retrofitting a shared numeric meaning that does
+ * not exist.
+ *
+ * Only ECCC's AQHI is implemented here; `AIR_QUALITY_PROVIDERS` is the seam a
+ * later provider registers against.
+ */
+
+/** Band identifiers shared across providers, in ascending severity. */
+export const AIR_QUALITY_BANDS = Object.freeze([
+  Object.freeze({ id: 'low', label: 'Low', color: '#4cc9f0' }),
+  Object.freeze({ id: 'moderate', label: 'Moderate', color: '#ffd43b' }),
+  Object.freeze({ id: 'high', label: 'High', color: '#ff6b35' }),
+  Object.freeze({ id: 'very-high', label: 'Very High', color: '#c1121f' }),
+]);
+
+const BAND_BY_ID = new Map(AIR_QUALITY_BANDS.map((band) => [band.id, band]));
+
+/** Colour used when a station reports no usable reading. */
+export const AIR_QUALITY_UNKNOWN_COLOR = '#6b7785';
+
+export const AIR_QUALITY_OVERLAY_SOURCE_ID = 'air-quality';
+export const AIR_QUALITY_OVERLAY_COHORT_LIMIT = 48;
+export const AIR_QUALITY_OVERLAY_COLLISION_CAPACITY = 32;
+
+/**
+ * A reading this old is stale enough that displaying it would misinform.
+ * AQHI publishes hourly, so six hours is five missed publications.
+ */
+export const OBSERVATION_MAX_AGE_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * How old the newest observation may be before the layer reports itself stale.
+ *
+ * This is deliberately separate from the age at which a reading is dropped.
+ * `lastUpdate` records when we last *received* a response, which stays current
+ * even when the network publishes nothing new; freshness has to be judged on
+ * the source's own observation time instead. AQHI publishes hourly, so a newest
+ * reading beyond two hours means at least one publication was missed and the
+ * feed should not be described as live.
+ */
+export const STALE_AFTER_MS = 2 * 60 * 60 * 1000;
+
+/**
+ * The newest observation time across a set of readings, or null when empty.
+ * @param {Array<object>} readings
+ * @returns {number|null} Epoch ms.
+ */
+export function newestObservation(readings) {
+  if (!Array.isArray(readings) || readings.length === 0) return null;
+  let newest = null;
+  for (const reading of readings) {
+    const at = Number(reading?.observedMs);
+    if (Number.isFinite(at) && (newest === null || at > newest)) newest = at;
+  }
+  return newest;
+}
+
+/**
+ * Is a set of readings stale, judged on source observation time? An empty
+ * set is stale: a refresh that kept no current observation has nothing live.
+ * @param {Array<object>} readings
+ * @param {number} [now=Date.now()]
+ * @returns {boolean}
+ */
+export function readingsAreStale(readings, now = Date.now()) {
+  const newest = newestObservation(readings);
+  // No current observation at all — every row was dropped as too old or
+  // unusable — is the stalest a feed can be, not a nominal one.
+  if (newest === null) return true;
+  return now - newest > STALE_AFTER_MS;
+}
+
+/**
+ * Registered provider descriptors. `coverage` is stated plainly because the
+ * layer is not global and the row must say so.
+ */
+export const AIR_QUALITY_PROVIDERS = Object.freeze({
+  eccc: Object.freeze({
+    id: 'eccc',
+    scale: 'AQHI',
+    label: 'Air quality',
+    network: 'Environment and Climate Change Canada',
+    coverage: 'Canada only · ECCC AQHI network',
+    /** ECCC's published band thresholds, evaluated in order. */
+    bands: Object.freeze([
+      Object.freeze({ id: 'low', max: 3 }),
+      Object.freeze({ id: 'moderate', max: 6 }),
+      Object.freeze({ id: 'high', max: 10 }),
+      Object.freeze({ id: 'very-high', max: Infinity }),
+    ]),
+  }),
+});
+
+/** Band descriptor for an id, or null. */
+export function airQualityBandById(bandId) {
+  return BAND_BY_ID.get(String(bandId ?? '')) || null;
+}
+
+/** Accent colour for a band id, falling back to neutral grey. */
+export function airQualityColor(bandId) {
+  return airQualityBandById(bandId)?.color || AIR_QUALITY_UNKNOWN_COLOR;
+}
+
+/**
+ * The published AQHI value for a raw ECCC reading: an integer from 1 up.
+ *
+ * ECCC reports whole numbers with a floor of 1 — there is no "AQHI 0" and no
+ * "AQHI 1.08". A raw value below 1 is a legitimate low reading, not an error,
+ * and is published as 1.
+ *
+ * @param {number|string|null|undefined} raw - Raw `aqhi` value from the API.
+ * @returns {number|null} Published integer AQHI, or null when unusable.
+ */
+export function aqhiDisplayValue(raw) {
+  // Guard the empty forms BEFORE coercing: Number(null) and Number('') are both
+  // 0, which would otherwise floor to a confident "AQHI 1" for a station that
+  // reported nothing at all.
+  if (raw === null || raw === undefined || raw === '') return null;
+  if (typeof raw !== 'number' && typeof raw !== 'string') return null;
+  if (typeof raw === 'string' && raw.trim() === '') return null;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0) return null;
+  return Math.max(1, Math.round(value));
+}
+
+/**
+ * The band id for a value on a provider's scale.
+ * @param {string} providerId
+ * @param {number|null} value - Already in the provider's published form.
+ * @returns {string|null}
+ */
+export function bandForValue(providerId, value) {
+  const provider = AIR_QUALITY_PROVIDERS[String(providerId ?? '')];
+  if (!provider || !Number.isFinite(value)) return null;
+  return provider.bands.find((band) => value <= band.max)?.id ?? null;
+}
+
+/**
+ * Display text for a value on a provider's scale.
+ * AQHI collapses everything above ten into the open-ended "10+".
+ * @param {string} providerId
+ * @param {number|null} value
+ * @returns {string}
+ */
+export function valueLabel(providerId, value) {
+  if (!Number.isFinite(value)) return '--';
+  if (providerId === 'eccc') return value > 10 ? '10+' : String(value);
+  return String(value);
+}
+
+/** Plain-language risk phrase for a band id. */
+export function bandRiskText(bandId) {
+  const band = airQualityBandById(bandId);
+  return band ? `${band.label} health risk` : null;
+}
+
+/**
+ * Validate a station FeatureCollection into an id-keyed catalog.
+ *
+ * Atomic: a structurally broken response returns null so the caller keeps its
+ * last good catalog. A station missing coordinates is skipped, since one
+ * unusable station is not evidence the catalog is broken.
+ *
+ * @param {object} geojson - GeoJSON FeatureCollection from `aqhi-stations`.
+ * @returns {Map<string, object>|null} Stations by location_id, or null.
+ */
+export function normalizeAqhiStations(geojson) {
+  if (!Array.isArray(geojson?.features)) return null;
+  const stations = new Map();
+  for (const feature of geojson.features) {
+    const properties = feature?.properties;
+    if (
+      !properties ||
+      typeof properties !== 'object' ||
+      Array.isArray(properties)
+    )
+      return null;
+    const coordinates = feature?.geometry?.coordinates;
+    if (!Array.isArray(coordinates) || coordinates.length < 2) continue;
+    const [lon, lat] = coordinates.map(Number);
+    if (!Number.isFinite(lon) || !Number.isFinite(lat)) continue;
+    if (Math.abs(lat) > 90 || Math.abs(lon) > 180) return null;
+    const id = String(properties.location_id ?? feature.id ?? '').trim();
+    if (!id) continue;
+    stations.set(id, {
+      id,
+      name: String(properties.location_name_en || id).trim(),
+      // ECCC's administrative zone: atl, que, ont, pnr, pyr.
+      zone: String(properties['eccc_administrative-zone'] || '').trim(),
+      lat,
+      lon,
+    });
+  }
+  return stations;
+}
+
+/**
+ * Join latest ECCC observations onto known stations into provider-shaped rows.
+ *
+ * The catalog is the only thing that supplies a reading its coordinates, so an
+ * observation without a matching station cannot be placed and is dropped.
+ * Readings older than OBSERVATION_MAX_AGE_MS are dropped too — a six-hour-old
+ * air-quality number presented as current is worse than no number.
+ *
+ * @param {object} geojson - FeatureCollection from `aqhi-observations-realtime`.
+ * @param {Map<string, object>} stations - Known stations by location_id.
+ * @param {number} [now=Date.now()] - Clock seam for tests.
+ * @returns {Array<object>|null} Normalized readings, or null when malformed.
+ */
+export function normalizeAqhiObservations(geojson, stations, now = Date.now()) {
+  if (!Array.isArray(geojson?.features)) return null;
+  if (!(stations instanceof Map)) return null;
+  const provider = AIR_QUALITY_PROVIDERS.eccc;
+  const newest = new Map();
+  for (const feature of geojson.features) {
+    const properties = feature?.properties;
+    if (
+      !properties ||
+      typeof properties !== 'object' ||
+      Array.isArray(properties)
+    )
+      return null;
+    const stationId = String(properties.location_id ?? '').trim();
+    const station = stations.get(stationId);
+    if (!station) continue;
+
+    const value = aqhiDisplayValue(properties.aqhi);
+    if (value === null) continue;
+    const observedMs = Date.parse(properties.observation_datetime);
+    if (!Number.isFinite(observedMs)) continue;
+    if (now - observedMs > OBSERVATION_MAX_AGE_MS) continue;
+
+    const previous = newest.get(stationId);
+    if (previous && previous.observedMs >= observedMs) continue;
+    const band = bandForValue(provider.id, value);
+    newest.set(stationId, {
+      id: `${provider.id}:${stationId}`,
+      provider: provider.id,
+      scale: provider.scale,
+      value,
+      band,
+      stationId,
+      name: station.name,
+      zone: station.zone,
+      lat: station.lat,
+      lon: station.lon,
+      observedMs,
+      color: airQualityColor(band),
+      label: valueLabel(provider.id, value),
+      risk: bandRiskText(band),
+      note: String(properties.special_notes_en || '').trim() || null,
+    });
+  }
+  return [...newest.values()].sort(
+    (a, b) => b.value - a.value || a.stationId.localeCompare(b.stationId),
+  );
+}
+
+/**
+ * Build the source-owned presentation for one station label.
+ * @param {object} input
+ * @returns {object}
+ */
+export function createAirQualityOverlayEntry({
+  id,
+  position,
+  title,
+  accent,
+  value,
+}) {
+  return {
+    id: String(id),
+    position,
+    variant: 'label',
+    title,
+    accent,
+    // Worse air wins the label budget — the reading people need to see first.
+    priority: Math.round(Number(value) || 0) * 1000,
+    collisionGroup: 'ambient-label',
+    paintLane: 'ambient-label',
+    interactive: false,
+    edgeFade: 'keyhole',
+    horizonCull: true,
+    terrainOcclusion: false,
+    gapPx: 14,
+    verticalOnly: true,
+    placement: 'above',
+  };
+}
+
+/** Keep the worst readings, with stable identity as the tie-break. */
+export function selectAirQualityOverlayCohort(
+  entries,
+  limit = AIR_QUALITY_OVERLAY_COHORT_LIMIT,
+) {
+  const cap = Math.max(
+    0,
+    Math.min(AIR_QUALITY_OVERLAY_COHORT_LIMIT, Math.floor(Number(limit) || 0)),
+  );
+  if (!Array.isArray(entries) || cap === 0) return [];
+  return entries
+    .slice()
+    .sort(
+      (a, b) =>
+        b.priority - a.priority || String(a.id).localeCompare(String(b.id)),
+    )
+    .slice(0, cap);
+}
+
+/**
+ * The worst readings inside a lon/lat rectangle, for the readout card.
+ *
+ * A null rectangle means the camera could not resolve one (a fully oblique or
+ * space-level view); everything is then in scope rather than nothing, so the
+ * card degrades to the worst readings overall instead of going blank.
+ *
+ * @param {Array<object>} readings
+ * @param {?{west:number, south:number, east:number, north:number}} rect - Degrees.
+ * @param {number} [limit=5]
+ * @returns {Array<object>}
+ */
+export function readingsInView(readings, rect, limit = 5) {
+  if (!Array.isArray(readings)) return [];
+  const cap = Math.max(0, Math.floor(Number(limit) || 0));
+  if (cap === 0) return [];
+  const inside = !rect
+    ? readings
+    : readings.filter((reading) => {
+        if (reading.lat < rect.south || reading.lat > rect.north) return false;
+        // A rectangle crossing the antimeridian has west > east.
+        return rect.west <= rect.east
+          ? reading.lon >= rect.west && reading.lon <= rect.east
+          : reading.lon >= rect.west || reading.lon <= rect.east;
+      });
+  return inside
+    .slice()
+    .sort((a, b) => b.value - a.value || a.stationId.localeCompare(b.stationId))
+    .slice(0, cap);
+}
+
+/**
+ * Map one reading to a JSON-safe analyst record. Pure — no Cesium types.
+ * @param {object|null|undefined} raw
+ * @param {number} [index=0]
+ * @returns {object}
+ */
+export function mapAnalystRecord(raw, index = 0) {
+  const num = (v) => (Number.isFinite(v) ? v : null);
+  const text = (v) => {
+    const t = String(v ?? '').trim();
+    return t || null;
+  };
+  return {
+    id: text(raw?.id) || `AIR-${String(index).padStart(4, '0')}`,
+    provider: text(raw?.provider),
+    scale: text(raw?.scale),
+    value: num(raw?.value),
+    band: text(raw?.band),
+    name: text(raw?.name),
+    zone: text(raw?.zone),
+    risk: text(raw?.risk),
+    lat: num(raw?.lat),
+    lon: num(raw?.lon),
+    observedMs: num(raw?.observedMs),
+  };
+}

src/layers/airQuality/model.test.mjs

@@ -0,0 +1,269 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  AIR_QUALITY_BANDS,
+  AIR_QUALITY_PROVIDERS,
+  AIR_QUALITY_UNKNOWN_COLOR,
+  OBSERVATION_MAX_AGE_MS,
+  STALE_AFTER_MS,
+  airQualityColor,
+  aqhiDisplayValue,
+  bandForValue,
+  bandRiskText,
+  mapAnalystRecord,
+  normalizeAqhiObservations,
+  normalizeAqhiStations,
+  readingsAreStale,
+  readingsInView,
+  selectAirQualityOverlayCohort,
+  valueLabel,
+} from './model.js';
+
+const NOW = Date.parse('2026-09-24T18:30:00Z');
+const RECENT = '2026-09-24T18:00:00Z';
+const collection = (features) => ({ type: 'FeatureCollection', features });
+const station = (id, name, zone, lon, lat) => ({
+  type: 'Feature',
+  geometry: { type: 'Point', coordinates: [lon, lat] },
+  properties: {
+    location_id: id,
+    location_name_en: name,
+    'eccc_administrative-zone': zone,
+  },
+});
+const observation = (id, aqhi, when = RECENT) => ({
+  type: 'Feature',
+  properties: { location_id: id, aqhi, observation_datetime: when },
+});
+
+const STATIONS = collection([
+  station('IAKID', 'Calgary', 'pnr', -114.0575, 51.0458),
+  station('OAAAA', 'Toronto', 'ont', -79.3832, 43.6532),
+  station('AAAAA', 'Halifax', 'atl', -63.5752, 44.6488),
+]);
+
+// ── provider-shaped records ────────────────────────────────────────────────
+
+test('readings carry the provider-neutral {provider, scale, value, band} shape', () => {
+  // Indices are not interchangeable numbers: AQHI is 1-10+ on health risk,
+  // US AQI is 0-500 on concentration. The shape names which index a value is on
+  // so a second network can be added without inventing a shared meaning.
+  const stations = normalizeAqhiStations(STATIONS);
+  const [row] = normalizeAqhiObservations(
+    collection([observation('IAKID', 2.32)]),
+    stations,
+    NOW,
+  );
+  assert.equal(row.provider, 'eccc');
+  assert.equal(row.scale, 'AQHI');
+  assert.equal(row.value, 2);
+  assert.equal(row.band, 'low');
+});
+
+test('bands map from a value on a named provider scale', () => {
+  assert.equal(bandForValue('eccc', 1), 'low');
+  assert.equal(bandForValue('eccc', 3), 'low');
+  assert.equal(bandForValue('eccc', 4), 'moderate');
+  assert.equal(bandForValue('eccc', 7), 'high');
+  assert.equal(bandForValue('eccc', 11), 'very-high');
+  // An unregistered provider cannot be banded rather than being guessed at.
+  assert.equal(bandForValue('unknown-network', 5), null);
+  assert.equal(bandForValue('eccc', null), null);
+});
+
+test('the provider states its coverage plainly', () => {
+  assert.match(AIR_QUALITY_PROVIDERS.eccc.coverage, /Canada only/);
+  assert.equal(AIR_QUALITY_PROVIDERS.eccc.scale, 'AQHI');
+});
+
+test("values above ten collapse to the scale's open-ended label", () => {
+  assert.equal(valueLabel('eccc', 10), '10');
+  assert.equal(valueLabel('eccc', 11), '10+');
+  assert.equal(valueLabel('eccc', null), '--');
+});
+
+test('every band has a distinct colour, and an unknown band is neutral', () => {
+  const colors = AIR_QUALITY_BANDS.map((b) => b.color);
+  assert.equal(new Set(colors).size, colors.length);
+  assert.equal(airQualityColor('nonsense'), AIR_QUALITY_UNKNOWN_COLOR);
+  assert.equal(bandRiskText('high'), 'High health risk');
+  assert.equal(bandRiskText(null), null);
+});
+
+// ── published form ─────────────────────────────────────────────────────────
+
+test('AQHI rounds to the published integer form and floors at 1', () => {
+  assert.equal(aqhiDisplayValue(1.08), 1);
+  assert.equal(aqhiDisplayValue(3.5), 4);
+  assert.equal(aqhiDisplayValue(0), 1);
+  assert.equal(aqhiDisplayValue('3'), 3);
+});
+
+test('an absent reading never becomes a confident AQHI 1', () => {
+  // Number(null) and Number('') are both 0, which would floor to 1.
+  for (const empty of [null, undefined, '', '   ', NaN, true, {}, [], -1]) {
+    assert.equal(aqhiDisplayValue(empty), null, `${JSON.stringify(empty)}`);
+  }
+});
+
+// ── snapshot validation ────────────────────────────────────────────────────
+
+test('stations normalize into an id-keyed catalog carrying their zone', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  assert.equal(stations.size, 3);
+  assert.equal(stations.get('OAAAA').zone, 'ont');
+});
+
+test('malformed payloads are rejected atomically', () => {
+  assert.equal(normalizeAqhiStations(null), null);
+  assert.equal(normalizeAqhiStations(collection([{ properties: null }])), null);
+  const stations = normalizeAqhiStations(STATIONS);
+  assert.equal(normalizeAqhiObservations(null, stations, NOW), null);
+  assert.equal(
+    normalizeAqhiObservations(collection([]), 'not a map', NOW),
+    null,
+  );
+});
+
+test('an observation with no matching station is dropped', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  const rows = normalizeAqhiObservations(
+    collection([observation('IAKID', 2), observation('ZZZZZ', 9)]),
+    stations,
+    NOW,
+  );
+  assert.equal(rows.length, 1);
+});
+
+test('a stale reading is dropped rather than shown as current', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  const old = new Date(NOW - OBSERVATION_MAX_AGE_MS - 60_000).toISOString();
+  const rows = normalizeAqhiObservations(
+    collection([observation('IAKID', 3, old), observation('OAAAA', 4)]),
+    stations,
+    NOW,
+  );
+  assert.deepEqual(
+    rows.map((r) => r.stationId),
+    ['OAAAA'],
+  );
+});
+
+test('a snapshot whose every observation was too old is stale, not nominal', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  const old = new Date(NOW - OBSERVATION_MAX_AGE_MS - 60_000).toISOString();
+  const rows = normalizeAqhiObservations(
+    collection([observation('IAKID', 3, old), observation('OAAAA', 4, old)]),
+    stations,
+    NOW,
+  );
+  assert.deepEqual(rows, []);
+  assert.equal(readingsAreStale(rows, NOW), true);
+  assert.equal(readingsAreStale([{ observedMs: NOW - 60_000 }], NOW), false);
+  assert.equal(
+    readingsAreStale([{ observedMs: NOW - STALE_AFTER_MS - 1 }], NOW),
+    true,
+  );
+});
+
+test('the newest reading per station wins and worst air sorts first', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  const rows = normalizeAqhiObservations(
+    collection([
+      observation('IAKID', 3, '2026-09-24T16:00:00Z'),
+      observation('IAKID', 7, '2026-09-24T18:00:00Z'),
+      observation('OAAAA', 5),
+    ]),
+    stations,
+    NOW,
+  );
+  assert.deepEqual(
+    rows.map((r) => r.value),
+    [7, 5],
+  );
+});
+
+// ── readout selection ──────────────────────────────────────────────────────
+
+const reading = (id, value, lat, lon) => ({
+  id,
+  stationId: id,
+  value,
+  lat,
+  lon,
+  name: id,
+});
+
+test('the readout lists the worst readings inside the view rectangle', () => {
+  const rows = [
+    reading('west', 9, 51.0, -114.0),
+    reading('east', 4, 43.6, -79.3),
+    reading('mild', 2, 51.1, -114.1),
+  ];
+  const inView = readingsInView(
+    rows,
+    { west: -115, south: 50, east: -113, north: 52 },
+    5,
+  );
+  assert.deepEqual(
+    inView.map((r) => r.id),
+    ['west', 'mild'],
+  );
+});
+
+test('an unresolvable view rectangle degrades to the worst overall, not to blank', () => {
+  // A space-level or fully oblique camera cannot produce a rectangle; the card
+  // should still say something useful.
+  const rows = [reading('a', 3, 0, 0), reading('b', 8, 10, 10)];
+  assert.deepEqual(
+    readingsInView(rows, null, 5).map((r) => r.id),
+    ['b', 'a'],
+  );
+  assert.deepEqual(readingsInView(rows, null, 0), []);
+  assert.deepEqual(readingsInView(null, null, 5), []);
+});
+
+test('a view rectangle crossing the antimeridian still selects correctly', () => {
+  // west > east is how a dateline-crossing rectangle is expressed.
+  const rows = [reading('near', 5, 0, 179), reading('far', 9, 0, 100)];
+  const inView = readingsInView(
+    rows,
+    { west: 170, south: -10, east: -170, north: 10 },
+    5,
+  );
+  assert.deepEqual(
+    inView.map((r) => r.id),
+    ['near'],
+  );
+});
+
+test('the overlay cohort is capped and deterministic', () => {
+  const entries = Array.from({ length: 120 }, (_, i) => ({
+    id: `s${i}`,
+    priority: i % 11,
+  }));
+  const cohort = selectAirQualityOverlayCohort(entries);
+  assert.ok(cohort.length <= 48);
+  assert.deepEqual(
+    cohort.map((e) => e.id),
+    selectAirQualityOverlayCohort(entries).map((e) => e.id),
+  );
+});
+
+test('analyst records are JSON-safe and name the provider and scale', () => {
+  const stations = normalizeAqhiStations(STATIONS);
+  const [row] = normalizeAqhiObservations(
+    collection([observation('IAKID', 2)]),
+    stations,
+    NOW,
+  );
+  const record = mapAnalystRecord(row, 0);
+  assert.deepEqual(JSON.parse(JSON.stringify(record)), record);
+  assert.equal(record.provider, 'eccc');
+  assert.equal(record.scale, 'AQHI');
+  const empty = mapAnalystRecord(undefined, 7);
+  assert.equal(empty.id, 'AIR-0007');
+  for (const [key, value] of Object.entries(empty)) {
+    assert.notEqual(value, undefined, `${key} must not be undefined`);
+  }
+});

src/layers/airQuality/ownership.test.mjs

@@ -0,0 +1,275 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createAirQualityLayer } from './index.js';
+import { layerFeedState } from '../../data/feedState.js';
+import { STALE_AFTER_MS } from './model.js';
+
+function harness(source) {
+  const sources = [];
+  const events = [];
+  const viewer = {
+    dataSources: {
+      add(value) {
+        sources.push(value);
+      },
+      remove(value) {
+        sources.splice(sources.indexOf(value), 1);
+      },
+    },
+  };
+  const layer = createAirQualityLayer({
+    source,
+    overlayHost: {
+      setEntries(...args) {
+        events.push(args);
+      },
+      setVisible() {},
+      clearSource() {},
+    },
+  });
+  layer.init(viewer);
+  layer.enable(viewer);
+  return { layer, viewer, sources, events };
+}
+
+const reading = (id, value, overrides = {}) => ({
+  id: `eccc:${id}`,
+  provider: 'eccc',
+  scale: 'AQHI',
+  value,
+  band: 'low',
+  stationId: id,
+  name: id,
+  zone: 'ont',
+  lat: 43.65,
+  lon: -79.38,
+  observedMs: 1_700_000_000_000,
+  color: '#4cc9f0',
+  label: String(value),
+  risk: 'Low health risk',
+  note: null,
+  ...overrides,
+});
+
+const staticSource = (rows) => ({ getSnapshot: async () => rows });
+
+test('a layer requires both a snapshot source and an overlay host', () => {
+  assert.throws(() => createAirQualityLayer(), /snapshot source/);
+  assert.throws(
+    () => createAirQualityLayer({ source: staticSource([]) }),
+    /overlay host/,
+  );
+});
+
+test('initialization is single-use and owns exactly one data source', () => {
+  const { layer, viewer, sources } = harness(staticSource([]));
+  assert.equal(sources.length, 1);
+  assert.throws(() => layer.init(viewer), /already initialized/);
+  layer.destroy(viewer);
+  assert.equal(sources.length, 0);
+});
+
+test('a refresh renders readings and publishes an overlay cohort', async () => {
+  const { layer, events } = harness(
+    staticSource([reading('A', 2), reading('B', 7)]),
+  );
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 2);
+  assert.equal(layer.getStats().error, null);
+  assert.equal(events.at(-1)[0], 'air-quality');
+});
+
+// ── the abort + enabled guard ──────────────────────────────────────────────
+
+test('a response landing after disable cannot redraw the scene', async () => {
+  // The failure this prevents: disable() clears the overlay, then an in-flight
+  // response resolves and repopulates it behind the user's back.
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const { layer, events } = harness({
+    getSnapshot: async ({ signal } = {}) => {
+      await gate;
+      signal?.throwIfAborted();
+      return [reading('A', 5)];
+    },
+  });
+  const pending = layer.update();
+  layer.disable();
+  const publishedBefore = events.length;
+  release();
+  assert.equal(await pending, false, 'a late response must not be applied');
+  assert.equal(
+    events.length,
+    publishedBefore,
+    'no overlay write after disable',
+  );
+  assert.equal(layer.getStats().count, 0);
+});
+
+test('disable aborts the request in flight', async () => {
+  let seenSignal = null;
+  const { layer } = harness({
+    getSnapshot: async ({ signal } = {}) => {
+      seenSignal = signal;
+      await new Promise((resolve) => setTimeout(resolve, 40));
+      signal?.throwIfAborted();
+      return [];
+    },
+  });
+  const pending = layer.update();
+  layer.disable();
+  await pending;
+  assert.ok(seenSignal, 'a signal was passed through to the source');
+  assert.equal(seenSignal.aborted, true);
+});
+
+test('a superseded refresh does not clobber the newer one', async () => {
+  let call = 0;
+  const { layer } = harness({
+    getSnapshot: async ({ signal } = {}) => {
+      call += 1;
+      const mine = call;
+      await new Promise((resolve) => setTimeout(resolve, mine === 1 ? 40 : 1));
+      signal?.throwIfAborted();
+      return [reading(`call-${mine}`, mine)];
+    },
+  });
+  const first = layer.update();
+  const second = layer.update();
+  const [firstResult, secondResult] = await Promise.all([first, second]);
+  assert.equal(firstResult, false, 'the superseded call reports no update');
+  assert.equal(secondResult, true);
+  assert.equal(layer.getAnalystRecords()[0].name, 'call-2');
+});
+
+test('update is a no-op while the layer is disabled', async () => {
+  const { layer } = harness(staticSource([reading('A', 2)]));
+  layer.disable();
+  assert.equal(await layer.update(), false);
+  assert.equal(layer.getStats().count, 0);
+});
+
+// ── readout descriptor ─────────────────────────────────────────────────────
+
+test('the readout descriptor carries the band legend and coverage', async () => {
+  const { layer } = harness(staticSource([reading('A', 2), reading('B', 9)]));
+  await layer.update();
+  const controls = layer.getRowControls();
+  assert.equal(controls.readout, true);
+  assert.match(controls.summary.coverage, /Canada only/);
+  // The Weather panel's legend shape: one {color, label} per band.
+  assert.equal(controls.legendCategorical, true);
+  assert.deepEqual(
+    controls.legend.map((entry) => entry.label),
+    ['Low', 'Moderate', 'High', 'Very High'],
+  );
+  assert.ok(
+    controls.legend.every((entry) => /^#[0-9a-f]{6}$/i.test(entry.color)),
+  );
+  // Worst first, and every item keyed.
+  assert.deepEqual(
+    controls.list.items.map((i) => i.text),
+    ['B · Low health risk', 'A · Low health risk'],
+  );
+  assert.ok(controls.list.items.every((i) => i.id));
+  assert.match(controls.summary.status, /2 stations reporting/);
+});
+
+test('the readout reports an error rather than a silent empty card', async () => {
+  const { layer } = harness({
+    getSnapshot: async () => {
+      throw new Error('ECCC HTTP 503');
+    },
+  });
+  await layer.update();
+  assert.match(layer.getRowControls().summary.status, /503/);
+});
+
+test('row-control listeners are notified on refresh and teardown-safe', async () => {
+  const { layer, viewer } = harness(staticSource([reading('A', 2)]));
+  let calls = 0;
+  layer.setRowControlsListener(() => {
+    calls += 1;
+  });
+  await layer.update();
+  assert.ok(calls >= 1, 'a refresh notifies the card');
+  layer.destroy(viewer);
+  const after = calls;
+  layer.setRowControlsListener(() => {
+    calls += 1;
+  });
+  assert.equal(calls, after);
+});
+
+// ── feed-state honesty ─────────────────────────────────────────────────────
+
+test('freshness is judged on observation time, not on when we last fetched', async () => {
+  // lastUpdate stays current every time the network answers, even when it
+  // answers with nothing new. Judging freshness on it would let the HUD and
+  // voice describe hours-old air quality as live.
+  const aged = Date.now() - STALE_AFTER_MS - 60_000;
+  const { layer } = harness(
+    staticSource([reading('A', 2, { observedMs: aged })]),
+  );
+  await layer.update();
+  const stats = layer.getStats();
+  assert.ok(
+    stats.lastUpdate >= Date.now() - 5_000,
+    'we did just receive a response',
+  );
+  assert.equal(stats.observedAt, aged, 'but the observation itself is old');
+  assert.equal(stats.stale, true);
+  assert.equal(
+    layerFeedState(stats),
+    'stale',
+    'provenance must not read this as nominal',
+  );
+});
+
+test('a current reading reports nominal', async () => {
+  const { layer } = harness(
+    staticSource([reading('A', 2, { observedMs: Date.now() - 10 * 60_000 })]),
+  );
+  await layer.update();
+  const stats = layer.getStats();
+  assert.equal(stats.stale, false);
+  assert.equal(layerFeedState(stats), 'nominal');
+});
+
+test('a refresh that kept no current observation reports stale, not nominal', async () => {
+  // Every observation older than OBSERVATION_MAX_AGE_MS is dropped, so a feed
+  // that only has hours-old rows yields an empty snapshot. That is the
+  // stalest a feed can be; it must not read as a healthy empty layer.
+  const { layer } = harness(staticSource([]));
+  assert.equal(layer.getStats().stale, false, 'no refresh yet, no verdict');
+  await layer.update();
+  const stats = layer.getStats();
+  assert.equal(stats.count, 0);
+  assert.equal(stats.observedAt, null);
+  assert.equal(stats.stale, true);
+  assert.equal(layerFeedState(stats), 'stale');
+  assert.equal(layer.getRowControls().summary.status, 'No current readings');
+});
+
+test('a failed refresh over good readings reports degraded, not nominal', async () => {
+  let fail = false;
+  const { layer } = harness({
+    getSnapshot: async () => {
+      if (fail) throw new Error('ECCC HTTP 503');
+      return [reading('A', 2, { observedMs: Date.now() - 10 * 60_000 })];
+    },
+  });
+  await layer.update();
+  assert.equal(layerFeedState(layer.getStats()), 'nominal');
+  fail = true;
+  await layer.update();
+  const stats = layer.getStats();
+  assert.ok(stats.count > 0, 'the previous readings are still displayed');
+  assert.equal(
+    layerFeedState(stats),
+    'degraded',
+    'showing old data after a failure is degraded',
+  );
+});

src/layers/airQuality/source.js

@@ -0,0 +1,104 @@
+import { readResponseJsonCapped } from '../../sources/httpBody.js';
+import { normalizeAqhiStations, normalizeAqhiObservations } from './model.js';
+
+const COLLECTIONS_ROOT = 'https://api.weather.gc.ca/collections';
+const STATIONS_URL = `${COLLECTIONS_ROOT}/aqhi-stations/items`;
+const OBSERVATIONS_URL = `${COLLECTIONS_ROOT}/aqhi-observations-realtime/items`;
+
+/** Comfortably above Canada's ~134 stations without inviting a huge page. */
+const STATION_LIMIT = 500;
+const OBSERVATION_LIMIT = 500;
+/** Station geometry is near-static — a few changes a year. Refetch twice a day. */
+const STATION_TTL_MS = 12 * 60 * 60 * 1000;
+/** A full 500-row GeoJSON page is a few hundred KB; anything past this is not a page. */
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+
+/**
+ * Request and validate a complete ECCC AQHI snapshot before it can replace
+ * displayed readings. The first registered air-quality provider.
+ *
+ * Two collections are involved. `aqhi-stations` is the catalog — it supplies
+ * every reading its coordinates and is cached for twelve hours because it
+ * barely changes. `aqhi-observations-realtime` is the hourly reading feed,
+ * requested with `latest=true` so the response is current values rather than
+ * the full observation history, which is roughly 2,000 rows nationally.
+ *
+ * The station catalog is only replaced when a refresh actually returns
+ * stations, so a transient empty response cannot blank the layer.
+ *
+ * @param {object} [options]
+ * @param {Function} [options.fetchImpl] - Injected fetch, for tests.
+ * @param {() => number} [options.now] - Clock seam, for tests.
+ * @param {number} [options.timeoutMs=15000] - Deadline for each request.
+ * @returns {{getSnapshot: Function}}
+ */
+export function createEcccAirQualitySource({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+  timeoutMs = 15_000,
+} = {}) {
+  /** @type {Map<string, object>} */
+  let stations = new Map();
+  let stationsFetchedAt = 0;
+
+  /** One bounded GeoJSON page: deadline, caller abort, byte cap, row cap. */
+  const getJson = async (url, limit, signal) => {
+    const controller = new AbortController();
+    const abort = () => controller.abort(signal.reason);
+    signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(
+      () => controller.abort(new Error('ECCC request timed out')),
+      timeoutMs,
+    );
+    try {
+      signal?.throwIfAborted();
+      const response = await fetchImpl(url, {
+        headers: { Accept: 'application/json' },
+        signal: controller.signal,
+      });
+      if (!response.ok) throw new Error(`ECCC HTTP ${response.status}`);
+      const payload = await readResponseJsonCapped(
+        response,
+        MAX_RESPONSE_BYTES,
+        controller.signal,
+      );
+      // The server's `limit` is a request, not a guarantee.
+      if (Array.isArray(payload?.features) && payload.features.length > limit)
+        return { ...payload, features: payload.features.slice(0, limit) };
+      return payload;
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', abort);
+    }
+  };
+
+  return {
+    async getSnapshot({ signal } = {}) {
+      const clock = now();
+      if (stations.size === 0 || clock - stationsFetchedAt > STATION_TTL_MS) {
+        const payload = await getJson(
+          `${STATIONS_URL}?f=json&limit=${STATION_LIMIT}`,
+          STATION_LIMIT,
+          signal,
+        );
+        const next = normalizeAqhiStations(payload);
+        if (!next) throw new Error('Malformed AQHI station response');
+        // An empty refresh must not wipe a good catalog.
+        if (next.size > 0) {
+          stations = next;
+          stationsFetchedAt = clock;
+        }
+      }
+      if (stations.size === 0) throw new Error('No AQHI stations available');
+
+      const payload = await getJson(
+        `${OBSERVATIONS_URL}?f=json&latest=true&limit=${OBSERVATION_LIMIT}`,
+        OBSERVATION_LIMIT,
+        signal,
+      );
+      const readings = normalizeAqhiObservations(payload, stations, clock);
+      if (!readings) throw new Error('Malformed AQHI observation response');
+      return readings;
+    },
+  };
+}

src/layers/airQuality/source.test.mjs

@@ -0,0 +1,197 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createEcccAirQualitySource } from './source.js';
+
+const NOW = Date.parse('2026-09-24T18:30:00Z');
+const HOUR = 60 * 60 * 1000;
+const station = (id) => ({
+  type: 'Feature',
+  geometry: { type: 'Point', coordinates: [-79.38, 43.65] },
+  properties: { location_id: id, location_name_en: id },
+});
+const observation = (id, at = NOW, aqhi = 3) => ({
+  type: 'Feature',
+  properties: {
+    location_id: id,
+    aqhi,
+    observation_datetime: new Date(at - 10 * 60_000).toISOString(),
+  },
+});
+const json = (body, init) =>
+  new Response(JSON.stringify(body), {
+    headers: { 'content-type': 'application/json' },
+    ...init,
+  });
+
+/** A fetch that serves the station catalog and observations from mutable state. */
+function feed() {
+  const state = {
+    clock: NOW,
+    stations: [station('A')],
+    stationIds: null,
+    urls: [],
+  };
+  state.source = createEcccAirQualitySource({
+    now: () => state.clock,
+    fetchImpl: async (url) => {
+      state.urls.push(url);
+      return json({
+        type: 'FeatureCollection',
+        // Every known station reports ten minutes before the current clock.
+        features: url.includes('aqhi-stations')
+          ? state.stations
+          : (state.stationIds || ['A']).map((id) =>
+              observation(id, state.clock),
+            ),
+      });
+    },
+  });
+  state.stationRequests = () =>
+    state.urls.filter((url) => url.includes('aqhi-stations')).length;
+  return state;
+}
+
+test('the station catalog is cached for twelve hours, then refetched', async () => {
+  const state = feed();
+  await state.source.getSnapshot();
+  state.clock = NOW + 12 * HOUR;
+  await state.source.getSnapshot();
+  assert.equal(state.stationRequests(), 1, 'within the TTL the cache serves');
+  state.clock = NOW + 12 * HOUR + 1;
+  await state.source.getSnapshot();
+  assert.equal(
+    state.stationRequests(),
+    2,
+    'past the TTL the catalog refreshes',
+  );
+});
+
+test('an empty catalog refresh keeps the previous catalog', async () => {
+  const state = feed();
+  await state.source.getSnapshot();
+  state.stations = [];
+  state.clock = NOW + 13 * HOUR;
+  const readings = await state.source.getSnapshot();
+  assert.deepEqual(
+    readings.map((reading) => reading.stationId),
+    ['A'],
+  );
+  // The empty refresh did not count as fresh, so the next call retries it.
+  await state.source.getSnapshot();
+  assert.equal(state.stationRequests(), 3);
+});
+
+test('an empty first catalog is an error, not an empty layer', async () => {
+  const state = feed();
+  state.stations = [];
+  await assert.rejects(state.source.getSnapshot(), /No AQHI stations/);
+});
+
+test('requests ask for JSON, the latest observations only, and a bounded page', async () => {
+  const state = feed();
+  await state.source.getSnapshot();
+  const [stations, observations] = state.urls.map((url) => new URL(url));
+  assert.equal(stations.pathname, '/collections/aqhi-stations/items');
+  assert.equal(stations.searchParams.get('f'), 'json');
+  assert.equal(stations.searchParams.get('limit'), '500');
+  assert.equal(
+    observations.pathname,
+    '/collections/aqhi-observations-realtime/items',
+  );
+  // Without latest=true the collection returns the full history (~2,000 rows).
+  assert.equal(observations.searchParams.get('latest'), 'true');
+  assert.equal(observations.searchParams.get('limit'), '500');
+});
+
+test('rows past the requested limit are ignored', async () => {
+  const state = feed();
+  state.stations = Array.from({ length: 600 }, (_, index) =>
+    station(`S${String(index).padStart(3, '0')}`),
+  );
+  state.stationIds = state.stations.map((row) => row.properties.location_id);
+  const readings = await state.source.getSnapshot();
+  assert.equal(readings.length, 500);
+});
+
+test('a malformed catalog and HTTP errors reject', async () => {
+  await assert.rejects(
+    createEcccAirQualitySource({
+      fetchImpl: async () => json({ features: 'no' }),
+    }).getSnapshot(),
+    /Malformed AQHI station/,
+  );
+  await assert.rejects(
+    createEcccAirQualitySource({
+      fetchImpl: async () => json({}, { status: 503 }),
+    }).getSnapshot(),
+    /ECCC HTTP 503/,
+  );
+});
+
+test('an oversized response is refused before it is parsed', async () => {
+  const big = 'x'.repeat(4 * 1024 * 1024 + 1);
+  await assert.rejects(
+    createEcccAirQualitySource({
+      fetchImpl: async () =>
+        new Response(new Blob([big]).stream(), {
+          headers: { 'content-type': 'application/json' },
+        }),
+    }).getSnapshot(),
+    (error) => error.code === 'RESPONSE_TOO_LARGE',
+  );
+  await assert.rejects(
+    createEcccAirQualitySource({
+      fetchImpl: async () =>
+        json({}, { headers: { 'content-length': String(5 * 1024 * 1024) } }),
+    }).getSnapshot(),
+    (error) => error.code === 'RESPONSE_TOO_LARGE',
+  );
+});
+
+test('a caller abort cancels the request and detaches its listener', async () => {
+  const caller = new AbortController();
+  let requestSignal = null;
+  const source = createEcccAirQualitySource({
+    fetchImpl: (_url, { signal }) => {
+      requestSignal = signal;
+      return new Promise((_resolve, reject) =>
+        signal.addEventListener('abort', () => reject(signal.reason), {
+          once: true,
+        }),
+      );
+    },
+  });
+  const pending = source.getSnapshot({ signal: caller.signal });
+  caller.abort(new Error('layer disabled'));
+  await assert.rejects(pending, /layer disabled/);
+  assert.equal(requestSignal.aborted, true);
+  const already = new AbortController();
+  already.abort(new Error('before start'));
+  let calls = 0;
+  await assert.rejects(
+    createEcccAirQualitySource({
+      fetchImpl: async () => {
+        calls += 1;
+        return json({ features: [] });
+      },
+    }).getSnapshot({ signal: already.signal }),
+    /before start/,
+  );
+  assert.equal(calls, 0);
+});
+
+test('a request that outlives its deadline is aborted', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const source = createEcccAirQualitySource({
+    timeoutMs: 1_000,
+    fetchImpl: (_url, { signal }) =>
+      new Promise((_resolve, reject) =>
+        signal.addEventListener('abort', () => reject(signal.reason), {
+          once: true,
+        }),
+      ),
+  });
+  const pending = source.getSnapshot();
+  t.mock.timers.tick(1_000);
+  await assert.rejects(pending, /ECCC request timed out/);
+});

src/layers/bikeshare/barcelonaSystems.test.mjs

@@ -0,0 +1,104 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { CITY_BY_ID } from './registry.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+// Each Barcelona system's host, and the stations farthest from its registered
+// centre in the live feed (checked 2026-10-16). AMBici spans the metropolitan
+// area, so it lists its south-western and north-eastern ends.
+const SYSTEMS = {
+  'barcelona-bicing': {
+    host: 'barcelona.publicbikesystem.net',
+    provider: 'Bicing',
+    stations: [
+      { name: 'AV. RASOS DE PEGUERA, 10', lat: 41.462095, lon: 2.178959 },
+      { name: 'C/ 60, NÚMERO 25', lat: 41.3467746, lon: 2.1436235 },
+    ],
+  },
+  'barcelona-ambici': {
+    host: 'gbfs.nextbike.net',
+    provider: 'AMBici',
+    stations: [
+      { name: 'Poal', lat: 41.268865, lon: 1.943849 },
+      { name: 'Platja del Manresà', lat: 41.460101, lon: 2.267271 },
+      { name: 'Can Ruti', lat: 41.482205, lon: 2.237607 },
+    ],
+  },
+};
+
+// The production range check, with no viewer or fetches behind it.
+const parts = {
+  model: createModel({ state: {}, services: {}, parts: {}, source: null }),
+};
+const { computeInRangeCities } = createViewport({
+  state: {},
+  services: { render: { governorRequestRender() {} } },
+  parts,
+  source: null,
+});
+
+test('Bicing and AMBici are registered and readable through the proxy', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    assert.ok(system, `${id} is registered`);
+    assert.equal(system.provider, expected.provider);
+    assert.deepEqual(system.hosts, [expected.host]);
+    for (const feed of [
+      system.stationInformationUrl,
+      system.stationStatusUrl,
+    ]) {
+      const url = new URL(feed);
+      assert.ok(isAllowedGbfsHost(url.hostname), `${id} host ${url.hostname}`);
+      assert.ok(
+        isAllowedGbfsPath(url.pathname, url.hostname),
+        `${id} path ${url.pathname}`,
+      );
+    }
+  }
+});
+
+test('a camera over each outermost station activates its system', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    for (const station of expected.stations) {
+      assert.ok(
+        computeInRangeCities({ lat: station.lat, lon: station.lon }).has(id),
+        `${station.name} activates ${id}`,
+      );
+    }
+  }
+});
+
+test('each load radius reaches its outermost stations', () => {
+  // The range check floors every radius at 100 km, so the test above passes
+  // with any loadRadiusKm; get_bike_share uses the radius as registered.
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    for (const station of expected.stations) {
+      const distance = parts.model.haversineKm(
+        system.centerLat,
+        system.centerLon,
+        station.lat,
+        station.lon,
+      );
+      assert.ok(
+        distance <= system.loadRadiusKm,
+        `${station.name} is ${distance.toFixed(1)} km from the ${id} centre`,
+      );
+    }
+  }
+});
+
+test('a camera over central Barcelona activates both systems', () => {
+  // Plaça de Catalunya.
+  const active = computeInRangeCities({ lat: 41.387, lon: 2.17 });
+  assert.ok(active.has('barcelona-bicing'));
+  assert.ok(active.has('barcelona-ambici'));
+});
+
+test('the nextbike allowance is that one host, not its domain', () => {
+  assert.equal(isAllowedGbfsHost('gbfs.nextbike.net'), true);
+  assert.equal(isAllowedGbfsHost('api.nextbike.net'), false);
+  assert.equal(isAllowedGbfsHost('gbfs.nextbike.net.example'), false);
+});

src/layers/bikeshare/brPbscCities.test.mjs

@@ -0,0 +1,73 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { CITY_BY_ID } from './registry.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+// Each Bike Itaú city's PBSC host, and the station farthest from its
+// registered centre in the live feed (checked 2026-10-15).
+const CITIES = {
+  'sao-paulo-bike-itau': {
+    host: 'saopaulo.publicbikesystem.net',
+    stations: [{ name: '260 - P3', lat: -23.568235, lon: -46.740715 }],
+  },
+  'rio-de-janeiro-bike-itau': {
+    host: 'riodejaneiro.publicbikesystem.net',
+    stations: [{ name: '293 - Praia da Macumba', lat: -23.03135, lon: -43.479584 }],
+  },
+  'salvador-bike-itau': {
+    host: 'salvador.publicbikesystem.net',
+    stations: [{ name: '49 - Stella Maris', lat: -12.93645, lon: -38.32701 }],
+  },
+  'recife-bike-itau': {
+    host: 'recife.publicbikesystem.net',
+    stations: [{ name: '69 - Praia de Piedade', lat: -8.186205, lon: -34.918371 }],
+  },
+  'porto-alegre-bike-itau': {
+    host: 'portoalegre.publicbikesystem.net',
+    stations: [{ name: '72 - Avenida Tramandaí', lat: -30.135915, lon: -51.22684 }],
+  },
+  'brasilia-bike-itau': {
+    host: 'brasilia.publicbikesystem.net',
+    stations: [{ name: "60 - Parque Olhos d'Água", lat: -15.7431, lon: -47.88667 }],
+  },
+  'curitiba-bike-itau': {
+    host: 'curitiba.publicbikesystem.net',
+    stations: [{ name: '42 - Terminal Portão', lat: -25.476885, lon: -49.292608 }],
+  },
+};
+
+// The production range check, with no viewer or fetches behind it.
+const parts = { model: createModel({ state: {}, services: {}, parts: {}, source: null }) };
+const { computeInRangeCities } = createViewport({
+  state: {},
+  services: { render: { governorRequestRender() {} } },
+  parts,
+  source: null,
+});
+
+test('the Bike Itaú systems are registered and readable through the proxy', () => {
+  for (const [id, expected] of Object.entries(CITIES)) {
+    const city = CITY_BY_ID.get(id);
+    assert.ok(city, `${id} is registered`);
+    assert.equal(city.provider, 'Bike Itaú');
+    assert.deepEqual(city.hosts, [expected.host]);
+    for (const feed of [city.stationInformationUrl, city.stationStatusUrl]) {
+      const url = new URL(feed);
+      assert.ok(isAllowedGbfsHost(url.hostname), `${id} host ${url.hostname}`);
+      assert.ok(isAllowedGbfsPath(url.pathname), `${id} path ${url.pathname}`);
+    }
+  }
+});
+
+test('a camera over each outermost station activates its system', () => {
+  for (const [id, expected] of Object.entries(CITIES)) {
+    for (const station of expected.stations) {
+      assert.ok(
+        computeInRangeCities({ lat: station.lat, lon: station.lon }).has(id),
+        `${station.name} activates ${id}`,
+      );
+    }
+  }
+});

src/layers/bikeshare/controls.js

@@ -56,7 +56,7 @@ export function createControls({ state: layerState, services, parts, source }) {
 
     /**
      * Return current layer statistics for the UI status display.
-     * @returns {{ count: number, lastUpdate: number|null, loading: boolean, loadingLabel?: string, error?: string }}
+     * @returns {{ count: number, lastUpdate: number|null, loading: boolean, loadingLabel?: string, error?: string, degraded?: boolean, stale?: boolean }}
      */
     getStats() {
       const stats = {
@@ -70,7 +70,21 @@ export function createControls({ state: layerState, services, parts, source }) {
             ? `syncing ${layerState._activeCityIds.size} city feeds...`
             : 'scanning nearby systems...';
       }
-      if (layerState._error) stats.error = layerState._error;
+      // A failed city is only the layer's failure when it left nothing on the
+      // map. While other cities still render, the partial failure reads
+      // DEGRADED; when every in-range city failed and only previously drawn
+      // points remain, they read STALE.
+      if (layerState._failedCityIds.size > 0) {
+        if (layerState._stationRenderMap.size === 0) {
+          stats.error = 'GBFS fetch error';
+        } else {
+          stats.degraded = true;
+          const allFailed = Array.from(layerState._activeCityIds).every(
+            (cityId) => layerState._failedCityIds.has(cityId),
+          );
+          if (allFailed) stats.stale = true;
+        }
+      }
       return stats;
     },
   };

src/layers/bikeshare/failureReporting.test.mjs

@@ -0,0 +1,376 @@
+// BIKESHARE FAILURE REPORTING — one dead city is not a dead layer.
+//
+// City feeds are fetched independently, but the layer reported failure through
+// a single flag. A city whose operator had retired its feed set that flag on
+// every proximity check, and the only code that cleared it ran on a successful
+// *activation* — which an already-loaded city never repeats. The result was a
+// permanent LOAD FAILED over a map drawing a thousand live stations.
+//
+// These cases pin the rule that replaced it: the layer reports failure only
+// when it has nothing to show, and a city that comes back clears its own
+// failure rather than waiting for a neighbour to succeed.
+//
+// Run with: npm test
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createState } from './state.js';
+import { createControls } from './controls.js';
+
+function makeLayer() {
+  const services = {
+    overlays: {
+      setOverlayEntries() {},
+      setOverlaySourceVisible() {},
+      clearOverlaySource() {},
+    },
+  };
+  const state = createState({ services });
+  const parts = { queries: { collectDetectableStations: () => [] } };
+  const { methods } = createControls({ state, services, parts, source: {} });
+  return { state, methods };
+}
+
+/** Stand in for a rendered station without reaching into the renderer. */
+function renderStations(state, count) {
+  for (let i = 0; i < count; i += 1) state._stationRenderMap.set(`s${i}`, {});
+  state._count = state._stationRenderMap.size;
+}
+
+test('a failed city does not fail a layer that is drawing stations', () => {
+  const { state, methods } = makeLayer();
+  renderStations(state, 1069);
+  state._failedCityIds.add('buffalo-reddy');
+
+  const stats = methods.getStats();
+  assert.equal(stats.count, 1069);
+  assert.equal(
+    stats.error,
+    undefined,
+    'a layer drawing 1069 stations reported LOAD FAILED',
+  );
+});
+
+test('the layer reports failure when a failed city left it with nothing', () => {
+  const { state, methods } = makeLayer();
+  state._failedCityIds.add('buffalo-reddy');
+
+  const stats = methods.getStats();
+  assert.equal(stats.count, 0);
+  assert.equal(stats.error, 'GBFS fetch error');
+});
+
+test('a layer with nothing to draw and nothing failed is not an error', () => {
+  const { state, methods } = makeLayer();
+
+  // Out of range of every city is empty, not broken.
+  assert.equal(methods.getStats().error, undefined);
+});
+
+test('a recovered city clears its own failure', () => {
+  const { state, methods } = makeLayer();
+  state._failedCityIds.add('buffalo-reddy');
+  assert.equal(methods.getStats().error, 'GBFS fetch error');
+
+  state._failedCityIds.delete('buffalo-reddy');
+  assert.equal(
+    methods.getStats().error,
+    undefined,
+    'the failure outlived the city that caused it',
+  );
+});
+
+// The cases above pin how getStats() reads failure state. The cases below
+// drive the real proximity check, status poll and lifecycle against a fake
+// GBFS source, so the failure state they read is the state the layer builds.
+
+import * as Cesium from 'cesium';
+import { CITY_BY_ID } from './registry.js';
+import { createIngestion } from './ingestion.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { createRendering } from './rendering.js';
+import { createLifecycle } from './lifecycle.js';
+
+const TORONTO = 'toronto-bike-share';
+const BUFFALO = 'buffalo-reddy';
+// Within range of both Toronto and Buffalo.
+const BETWEEN = { lat: 43.25, lon: -79.1 };
+// Within range of Toronto only.
+const TORONTO_ONLY = { lat: 43.7, lon: -79.6 };
+// Within range of Buffalo only.
+const BUFFALO_ONLY = { lat: 42.5, lon: -78.0 };
+const LOW_M = 10_000;
+
+// disable() detaches a keydown listener; node has no document.
+globalThis.document ??= {
+  addEventListener() {},
+  removeEventListener() {},
+};
+
+/** A GBFS source whose per-city answers each test can change. */
+function makeSource() {
+  const cityOf = (url) => {
+    for (const [id, city] of CITY_BY_ID) {
+      if (url === city.stationInformationUrl) return { id, kind: 'info' };
+      if (url === city.stationStatusUrl) return { id, kind: 'status' };
+    }
+    throw new Error(`unexpected GBFS url ${url}`);
+  };
+  const source = {
+    dead: new Set(),
+    deadStatus: new Set(),
+    /** Optional per-call override: (cityId, kind) => Promise | undefined. */
+    hook: null,
+    async getStations(url, { signal } = {}) {
+      const { id, kind } = cityOf(url);
+      const hooked = source.hook?.(id, kind);
+      if (hooked) return hooked;
+      await new Promise((resolve) => setTimeout(resolve, 1));
+      signal?.throwIfAborted();
+      if (source.dead.has(id)) throw new Error('GBFS HTTP 404');
+      if (kind === 'status' && source.deadStatus.has(id))
+        throw new Error('GBFS HTTP 503');
+      const city = CITY_BY_ID.get(id);
+      if (kind === 'info') {
+        return {
+          data: {
+            stations: [
+              {
+                station_id: `${id}-1`,
+                name: `${id} dock`,
+                lat: city.centerLat,
+                lon: city.centerLon,
+                capacity: 10,
+              },
+            ],
+          },
+        };
+      }
+      return {
+        data: {
+          stations: [
+            {
+              station_id: `${id}-1`,
+              num_bikes_available: 3,
+              num_docks_available: 7,
+              is_installed: true,
+              is_renting: true,
+              is_returning: true,
+            },
+          ],
+        },
+      };
+    },
+  };
+  return source;
+}
+
+/** Assemble the layer from its real parts around a camera the test moves. */
+function makeLiveLayer() {
+  const source = makeSource();
+  const services = {
+    render: { governorRequestRender() {} },
+    overlays: {
+      setOverlayEntries() {},
+      setOverlaySourceVisible() {},
+      clearOverlaySource() {},
+    },
+    sprites: { registerSpriteCollection() {}, restoreSpriteOrder() {} },
+    picking: { registerPickOwner() {}, unregisterPickOwner() {} },
+  };
+  const state = createState({ services });
+  const parts = {};
+  const context = { state, services, parts, source };
+  parts.ingestion = createIngestion(context);
+  parts.model = createModel(context);
+  parts.viewport = createViewport(context);
+  parts.rendering = createRendering(context);
+  // Selection owns a DOM click handler; nothing here selects a station.
+  parts.selection = {
+    _installClickHandler() {},
+    _clearSelection() {},
+    _onKeyDown() {},
+  };
+  parts.queries = { collectDetectableStations: () => [] };
+  parts.lifecycle = createLifecycle(context);
+  const { methods: controls } = createControls(context);
+
+  const camera = { ...BETWEEN, height: LOW_M };
+  const viewer = {
+    camera: {
+      get positionCartographic() {
+        return Cesium.Cartographic.fromDegrees(
+          camera.lon,
+          camera.lat,
+          camera.height,
+        );
+      },
+      computeViewRectangle: () => undefined,
+      changed: { addEventListener() {}, removeEventListener() {} },
+    },
+    scene: { globe: {}, primitives: { add() {}, remove() {} } },
+  };
+  parts.lifecycle.methods.init(viewer);
+
+  return {
+    state,
+    source,
+    stats: () => controls.getStats(),
+    moveTo(place, height = LOW_M) {
+      Object.assign(camera, place, { height });
+      return parts.viewport.runProximityCheck();
+    },
+    async enable() {
+      parts.lifecycle.methods.enable(viewer);
+      await settle();
+    },
+    disable: () => parts.lifecycle.methods.disable(viewer),
+    poll: () => parts.ingestion.methods.update(),
+  };
+}
+
+/** Let fire-and-forget activation started by enable() finish. */
+async function settle() {
+  for (let i = 0; i < 5; i += 1)
+    await new Promise((resolve) => setTimeout(resolve, 2));
+}
+
+function deferred() {
+  let resolve, reject;
+  const promise = new Promise((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+test('a city that fails beside one that renders reads DEGRADED, not healthy', async () => {
+  const layer = makeLiveLayer();
+  layer.source.dead.add(BUFFALO);
+  await layer.enable();
+
+  const stats = layer.stats();
+  assert.equal(stats.count, 1, 'Toronto should still draw');
+  assert.equal(stats.error, undefined);
+  assert.equal(stats.degraded, true, 'the Buffalo failure was hidden');
+  assert.equal(stats.stale, undefined);
+});
+
+test('a failed city that comes back clears its own failure', async () => {
+  const layer = makeLiveLayer();
+  layer.source.dead.add(BUFFALO);
+  await layer.enable();
+  assert.equal(layer.stats().degraded, true);
+
+  layer.source.dead.clear();
+  await layer.moveTo(BETWEEN);
+  const stats = layer.stats();
+  assert.equal(stats.count, 2);
+  assert.equal(stats.degraded, undefined);
+  assert.equal(stats.error, undefined);
+});
+
+test('a status poll that recovers clears the failure the last poll set', async () => {
+  const layer = makeLiveLayer();
+  await layer.moveTo(TORONTO_ONLY);
+  await layer.enable();
+  layer.source.deadStatus.add(TORONTO);
+  await layer.poll();
+  assert.equal(layer.stats().degraded, true);
+
+  layer.source.deadStatus.clear();
+  await layer.poll();
+  assert.equal(layer.stats().degraded, undefined);
+  assert.equal(layer.stats().stale, undefined);
+});
+
+test('a failure does not outlive its city leaving range', async () => {
+  const layer = makeLiveLayer();
+  layer.source.dead.add(BUFFALO);
+  await layer.enable();
+  await layer.moveTo(BUFFALO_ONLY);
+  assert.equal(layer.stats().error, 'GBFS fetch error');
+
+  // Low over the open Atlantic: nothing in range is empty, not broken.
+  await layer.moveTo({ lat: 30, lon: -40 });
+  const stats = layer.stats();
+  assert.equal(stats.count, 0);
+  assert.equal(stats.error, undefined, 'LOAD FAILED over empty ocean');
+  assert.equal(stats.degraded, undefined);
+});
+
+test('zooming out above the altitude gate drops a city failure', async () => {
+  const layer = makeLiveLayer();
+  layer.source.dead.add(BUFFALO);
+  await layer.enable();
+  await layer.moveTo(BUFFALO_ONLY);
+  assert.equal(layer.stats().error, 'GBFS fetch error');
+
+  await layer.moveTo(BUFFALO_ONLY, 200_000);
+  const stats = layer.stats();
+  assert.equal(stats.count, 0);
+  assert.equal(stats.error, undefined, 'LOAD FAILED above the gate');
+});
+
+test('a late rejection from before a disable/re-enable is ignored', async () => {
+  const layer = makeLiveLayer();
+  await layer.moveTo(BUFFALO_ONLY);
+  const first = deferred();
+  // The first info request hangs and ignores its abort signal.
+  layer.source.hook = (id, kind) => {
+    if (id !== BUFFALO || kind !== 'info') return undefined;
+    layer.source.hook = null;
+    return first.promise;
+  };
+  await layer.enable();
+  layer.disable();
+  await layer.enable();
+  assert.equal(layer.stats().count, 1, 're-enable should draw Buffalo');
+
+  first.reject(new Error('GBFS HTTP 500'));
+  await settle();
+  const stats = layer.stats();
+  assert.equal(stats.count, 1, 'a stale rejection tore down live points');
+  assert.equal(stats.error, undefined);
+  assert.equal(stats.degraded, undefined);
+});
+
+test('a late status poll rejection from before a disable/re-enable is ignored', async () => {
+  const layer = makeLiveLayer();
+  await layer.moveTo(TORONTO_ONLY);
+  await layer.enable();
+  const first = deferred();
+  layer.source.hook = (id, kind) => {
+    if (id !== TORONTO || kind !== 'status') return undefined;
+    layer.source.hook = null;
+    return first.promise;
+  };
+  const poll = layer.poll();
+  layer.disable();
+  await layer.enable();
+
+  first.reject(new Error('GBFS HTTP 500'));
+  await poll;
+  const stats = layer.stats();
+  assert.equal(stats.count, 1);
+  assert.equal(stats.degraded, undefined);
+  assert.equal(stats.error, undefined);
+});
+
+test('every status poll failing over cached points reads STALE, not fresh', async () => {
+  const layer = makeLiveLayer();
+  await layer.moveTo(TORONTO_ONLY);
+  await layer.enable();
+  const loadedAt = layer.stats().lastUpdate;
+  assert.ok(loadedAt, 'activation should record freshness');
+
+  layer.source.deadStatus.add(TORONTO);
+  await new Promise((resolve) => setTimeout(resolve, 5));
+  await layer.poll();
+  const stats = layer.stats();
+  assert.equal(stats.count, 1, 'the cached points stay drawn');
+  assert.equal(stats.error, undefined);
+  assert.equal(stats.degraded, true);
+  assert.equal(stats.stale, true);
+  assert.equal(stats.lastUpdate, loadedAt, 'a failed poll advanced freshness');
+});

src/layers/bikeshare/ingestion.js

@@ -171,30 +171,34 @@ export function createIngestion({
 
       const generation = layerState._proximityGeneration;
       const cityIds = Array.from(layerState._activeCityIds);
+      const isCurrent = (cityId) =>
+        layerState._enabled &&
+        layerState._activeCityIds.has(cityId) &&
+        generation === layerState._proximityGeneration;
+      let refreshed = false;
       await Promise.all(
         cityIds.map(async (cityId) => {
           try {
             const statusMap = await loadCityStationStatus(cityId, generation);
-            if (
-              !layerState._enabled ||
-              !layerState._activeCityIds.has(cityId) ||
-              generation !== layerState._proximityGeneration
-            )
-              return;
+            if (!isCurrent(cityId)) return;
             parts.rendering.applyStatusToPoints(cityId, statusMap);
+            layerState._failedCityIds.delete(cityId);
+            refreshed = true;
           } catch (error) {
-            if (error?.name === 'AbortError') return;
+            if (error?.name === 'AbortError' || !isCurrent(cityId)) return;
             console.warn(
               `[Data:Bikeshare] ${cityId} status update error:`,
               error,
             );
-            layerState._error = 'GBFS status update failed';
+            layerState._failedCityIds.add(cityId);
           }
         }),
       );
 
       layerState._count = layerState._stationRenderMap.size;
-      if (layerState._count > 0) layerState._lastUpdate = Date.now();
+      // Freshness advances only on a poll that actually refreshed a city.
+      if (refreshed && layerState._count > 0)
+        layerState._lastUpdate = Date.now();
     },
   };
 

src/layers/bikeshare/lifecycle.js

@@ -51,7 +51,7 @@ export function createLifecycle({
       layerState._lastUpdate = null;
       layerState._loading = false;
       layerState._loadingOps = 0;
-      layerState._error = null;
+      layerState._failedCityIds.clear();
       layerState._limitWarned = false;
 
       layerState._overlayHost.setVisible(
@@ -75,7 +75,7 @@ export function createLifecycle({
      */
     enable(viewer) {
       layerState._enabled = true;
-      layerState._error = null;
+      layerState._failedCityIds.clear();
       layerState._pointCollection.show = true;
       layerState._overlayHost.setVisible(
         BIKESHARE_SELECTED_OVERLAY_SOURCE_ID,

src/layers/bikeshare/proxyRoute.test.mjs

@@ -17,6 +17,7 @@ import { createModel } from './model.js';
 import { CITY_BY_ID } from './registry.js';
 
 const AUSTIN = CITY_BY_ID.get('austin-capmetro');
+const OSLO = CITY_BY_ID.get('oslo-bysykkel');
 
 const STATION_INFORMATION = {
   data: {
@@ -204,6 +205,101 @@ test('the proxy relays its cache policy and upstream host through the mounted ro
   );
 });
 
+test('the Norwegian city-bike systems are served through the mounted route', async () => {
+  for (const [id, systemId] of [
+    ['oslo-bysykkel', 'oslobysykkel.no'],
+    ['bergen-bysykkel', 'bergenbysykkel.no'],
+    ['trondheim-bysykkel', 'trondheimbysykkel.no'],
+  ]) {
+    const system = CITY_BY_ID.get(id);
+    assert.ok(system, `${id} is registered`);
+    assert.deepEqual(system.hosts, ['gbfs.urbansharing.com']);
+    assert.equal(
+      system.stationStatusUrl,
+      `https://gbfs.urbansharing.com/${systemId}/station_status.json`,
+    );
+  }
+
+  await withUpstream(
+    {
+      [OSLO.stationInformationUrl]: STATION_INFORMATION,
+      [OSLO.stationStatusUrl]: STATION_STATUS,
+    },
+    async (requested) => {
+      const source = createBikeshareSource({ fetchImpl: mountGbfsProxy() });
+      const info = await source.getStations(OSLO.stationInformationUrl);
+      const status = await source.getStations(OSLO.stationStatusUrl);
+      assert.deepEqual(requested, [
+        OSLO.stationInformationUrl,
+        OSLO.stationStatusUrl,
+      ]);
+      assert.equal(info.data.stations.length, 1);
+      assert.equal(status.data.stations.length, 1);
+
+      const response = await mountGbfsProxy()(
+        '/api/gbfs/' + encodeURIComponent(OSLO.stationStatusUrl),
+      );
+      assert.equal(response.status, 200);
+      assert.equal(
+        response.headers.get('x-gbfs-upstream'),
+        'gbfs.urbansharing.com',
+      );
+    },
+  );
+});
+
+test('every Norwegian city-bike system is registered and reachable through the mounted route', async () => {
+  const expected = {
+    'stavanger-kolumbus':
+      'https://api.entur.io/mobility/v2/gbfs/v2/kolumbusbysykkel/station_status',
+    'skien-farte':
+      'https://api.entur.io/mobility/v2/gbfs/v2/fartebysykkel/station_status',
+    'lillestrom-bysykkel':
+      'https://api.cyclocity.fr/contracts/lillestrom/gbfs/station_status.json',
+  };
+  const upstream = {};
+  for (const [id, statusUrl] of Object.entries(expected)) {
+    const system = CITY_BY_ID.get(id);
+    assert.ok(system, `${id} is registered`);
+    assert.equal(system.stationStatusUrl, statusUrl);
+    upstream[system.stationInformationUrl] = STATION_INFORMATION;
+    upstream[system.stationStatusUrl] = STATION_STATUS;
+  }
+
+  await withUpstream(upstream, async (requested) => {
+    const source = createBikeshareSource({ fetchImpl: mountGbfsProxy() });
+    for (const id of Object.keys(expected)) {
+      const system = CITY_BY_ID.get(id);
+      const info = await source.getStations(system.stationInformationUrl);
+      const status = await source.getStations(system.stationStatusUrl);
+      assert.equal(info.data.stations.length, 1, `${id} information`);
+      assert.equal(status.data.stations.length, 1, `${id} status`);
+    }
+    assert.equal(requested.length, 6);
+
+    // Entur's extensionless station_information keeps its 5-minute cache.
+    const kolumbus = CITY_BY_ID.get('stavanger-kolumbus');
+    const response = await mountGbfsProxy()(
+      '/api/gbfs/' + encodeURIComponent(kolumbus.stationInformationUrl),
+    );
+    assert.equal(response.headers.get('cache-control'), 'public, max-age=300');
+  });
+});
+
+test('the mounted route keeps multi-API hosts to their GBFS tree', async () => {
+  await withUpstream({}, async (requested) => {
+    const mounted = mountGbfsProxy();
+    for (const target of [
+      'https://api.entur.io/journey-planner/v3/station_status',
+      'https://api.cyclocity.fr/other/station_status.json',
+    ]) {
+      const response = await mounted('/api/gbfs/' + encodeURIComponent(target));
+      assert.equal(response.status, 400, target);
+    }
+    assert.deepEqual(requested, []);
+  });
+});
+
 test('the query-string shape the client used to send is refused by the mounted route', async () => {
   await withUpstream(
     { [AUSTIN.stationStatusUrl]: STATION_STATUS },
@@ -298,3 +394,55 @@ for (const hook of ['configureServer', 'configurePreviewServer']) {
     );
   });
 }
+
+test('unknown GBFS counts stay unknown through the source, model and station color', async () => {
+  const { createRendering } = await import('./rendering.js');
+  const { COLOR_NEUTRAL, COLOR_RED } = await import('./policy.js');
+  for (const missing of [null, '']) {
+    const source = createBikeshareSource({
+      fetchImpl: async () =>
+        Response.json({
+          data: {
+            stations: [
+              {
+                station_id: '2537',
+                num_bikes_available: missing,
+                num_docks_available: 4,
+                is_installed: true,
+                is_renting: true,
+                is_returning: true,
+              },
+            ],
+          },
+        }),
+    });
+    const model = createModel({});
+    const status = model
+      .parseStationStatus(await source.getStations(AUSTIN.stationStatusUrl))
+      .get('2537');
+    const rendering = createRendering({
+      state: {},
+      services: { render: {} },
+      parts: { model },
+    });
+    assert.equal(status.bikesAvailable, null);
+    assert.equal(
+      model.toNonNegativeInteger(status.bikesAvailable),
+      null,
+      'render-map normalization preserves unknown',
+    );
+    assert.equal(rendering.statusToColor(status, 12), COLOR_NEUTRAL);
+    assert.equal(rendering.resolveCapacity(missing, status), 4);
+    assert.equal(
+      rendering.statusToColor({ ...status, bikesAvailable: 0 }, 12),
+      COLOR_RED,
+      'reported zero is still empty',
+    );
+    assert.equal(
+      model.toNonNegativeInteger(missing, 7),
+      7,
+      'caller fallback is preserved',
+    );
+    assert.equal(model.toNonNegativeInteger('3'), 3);
+  }
+});

src/layers/bikeshare/registry.js

@@ -23,6 +23,47 @@ function bcycleEntry({
     ...buildBcycleUrls(systemId),
   };
 }
+function urbanSharingEntry({
+  id,
+  city,
+  centerLat,
+  centerLon,
+  systemId,
+  provider,
+  loadRadiusKm = 100,
+}) {
+  return {
+    id,
+    city,
+    centerLat,
+    centerLon,
+    loadRadiusKm,
+    provider,
+    stationInformationUrl: `https://gbfs.urbansharing.com/${systemId}/station_information.json`,
+    stationStatusUrl: `https://gbfs.urbansharing.com/${systemId}/station_status.json`,
+  };
+}
+function enturEntry({
+  id,
+  city,
+  centerLat,
+  centerLon,
+  systemId,
+  provider,
+  loadRadiusKm = 100,
+}) {
+  const base = `https://api.entur.io/mobility/v2/gbfs/v2/${systemId}`;
+  return {
+    id,
+    city,
+    centerLat,
+    centerLon,
+    loadRadiusKm,
+    provider,
+    stationInformationUrl: `${base}/station_information`,
+    stationStatusUrl: `${base}/station_status`,
+  };
+}
 const RAW_GBFS_CITY_REGISTRY = [
   {
     id: 'nyc-citibike',
@@ -48,6 +89,56 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://gbfs.lyft.com/gbfs/2.3/chi/en/station_status.json',
     provider: 'Divvy',
   },
+  {
+    id: 'detroit-mogo',
+    city: 'Detroit, MI',
+    centerLat: 42.3314,
+    centerLon: -83.0458,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://detroit.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://detroit.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'MoGo',
+  },
+  {
+    id: 'pittsburgh-pogoh',
+    city: 'Pittsburgh, PA',
+    centerLat: 40.4406,
+    centerLon: -79.9959,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://pittsburgh.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://pittsburgh.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'POGOH',
+  },
+  {
+    id: 'aspen-we-cycle',
+    city: 'Aspen, CO',
+    centerLat: 39.1911,
+    centerLon: -106.8175,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://aspen.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://aspen.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'WE-cycle',
+  },
+  // HIBike serves both Kailua-Kona and Hilo, about 95 km apart; the centre sits
+  // between them so a camera over either town loads the whole system.
+  {
+    id: 'hawaii-island-hibike',
+    city: 'Kona & Hilo, HI',
+    centerLat: 19.68,
+    centerLon: -155.54,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://kona.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://kona.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'HIBike',
+  },
   {
     id: 'dc-capital-bikeshare',
     city: 'Washington, DC',
@@ -143,18 +234,6 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://hon.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
     provider: 'Biki',
   },
-  {
-    id: 'columbus-cogo',
-    city: 'Columbus, OH',
-    centerLat: 39.9612,
-    centerLon: -82.9988,
-    loadRadiusKm: 90,
-    stationInformationUrl:
-      'https://gbfs.cogobikeshare.com/gbfs/2.3/en/station_information.json',
-    stationStatusUrl:
-      'https://gbfs.cogobikeshare.com/gbfs/2.3/en/station_status.json',
-    provider: 'CoGo',
-  },
   {
     id: 'chattanooga-bikechatt',
     city: 'Chattanooga, TN',
@@ -167,6 +246,90 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://chat.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
     provider: 'Bike Chattanooga',
   },
+  {
+    id: 'sao-paulo-bike-itau',
+    city: 'São Paulo, SP',
+    centerLat: -23.5505,
+    centerLon: -46.6333,
+    loadRadiusKm: 100,
+    stationInformationUrl:
+      'https://saopaulo.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://saopaulo.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'rio-de-janeiro-bike-itau',
+    city: 'Rio de Janeiro, RJ',
+    centerLat: -22.9068,
+    centerLon: -43.1729,
+    loadRadiusKm: 100,
+    stationInformationUrl:
+      'https://riodejaneiro.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://riodejaneiro.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'salvador-bike-itau',
+    city: 'Salvador, BA',
+    centerLat: -12.9777,
+    centerLon: -38.5016,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://salvador.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://salvador.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'recife-bike-itau',
+    city: 'Recife, PE',
+    centerLat: -8.0476,
+    centerLon: -34.877,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://recife.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://recife.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'porto-alegre-bike-itau',
+    city: 'Porto Alegre, RS',
+    centerLat: -30.0346,
+    centerLon: -51.2177,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://portoalegre.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://portoalegre.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'brasilia-bike-itau',
+    city: 'Brasília, DF',
+    centerLat: -15.7939,
+    centerLon: -47.8828,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://brasilia.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://brasilia.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
+  {
+    id: 'curitiba-bike-itau',
+    city: 'Curitiba, PR',
+    centerLat: -25.4284,
+    centerLon: -49.2733,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://curitiba.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://curitiba.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Itaú',
+  },
   {
     id: 'bogota-tembici',
     city: 'Bogotá, Colombia',
@@ -191,6 +354,18 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://santiago.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
     provider: 'Bike Itaú Santiago',
   },
+  {
+    id: 'toronto-bike-share',
+    city: 'Toronto, ON',
+    centerLat: 43.6532,
+    centerLon: -79.3832,
+    loadRadiusKm: 90,
+    stationInformationUrl:
+      'https://toronto.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://toronto.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bike Share Toronto',
+  },
   bcycleEntry({
     id: 'boulder-bcycle',
     city: 'Boulder, CO',
@@ -258,14 +433,6 @@ const RAW_GBFS_CITY_REGISTRY = [
     systemId: 'bcycle_pacersbikeshare',
     provider: 'Pacers Bikeshare',
   }),
-  bcycleEntry({
-    id: 'fort-lauderdale-broward',
-    city: 'Fort Lauderdale, FL',
-    centerLat: 26.1224,
-    centerLon: -80.1373,
-    systemId: 'bcycle_broward',
-    provider: 'Broward B-cycle',
-  }),
   bcycleEntry({
     id: 'memphis-bcycle',
     city: 'Memphis, TN',
@@ -280,22 +447,32 @@ const RAW_GBFS_CITY_REGISTRY = [
     centerLon: -93.625,
     systemId: 'bcycle_desmoines',
   }),
-  bcycleEntry({
+  {
+    // Tugo moved off BCycle to PBSC; the bcycle_tugo feed is gone (404).
     id: 'tucson-tugo',
     city: 'Tucson, AZ',
     centerLat: 32.2226,
     centerLon: -110.9747,
-    systemId: 'bcycle_tugo',
+    loadRadiusKm: 100,
+    stationInformationUrl:
+      'https://tucson.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://tucson.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
     provider: 'Tugo',
-  }),
-  bcycleEntry({
+  },
+  {
+    // Trinity Metro moved off BCycle to PBSC; the bcycle_fortworth feed is gone.
     id: 'fort-worth-trinity',
     city: 'Fort Worth, TX',
     centerLat: 32.7555,
     centerLon: -97.3308,
-    systemId: 'bcycle_fortworth',
+    loadRadiusKm: 100,
+    stationInformationUrl:
+      'https://fortworth.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://fortworth.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
     provider: 'Trinity Metro',
-  }),
+  },
   bcycleEntry({
     id: 'omaha-heartland',
     city: 'Omaha, NE',
@@ -319,14 +496,20 @@ const RAW_GBFS_CITY_REGISTRY = [
     centerLon: -82.394,
     systemId: 'bcycle_greenville',
   }),
-  bcycleEntry({
+  {
+    // Reddy left BCycle for Social Bicycles; the bcycle_reddy feed is gone
+    // (404). This is the endpoint the MobilityData GBFS registry lists.
     id: 'buffalo-reddy',
     city: 'Buffalo, NY',
     centerLat: 42.8864,
     centerLon: -78.8784,
-    systemId: 'bcycle_reddy',
+    loadRadiusKm: 100,
+    stationInformationUrl:
+      'https://reddybikeshare.socialbicycles.com/opendata/station_information.json',
+    stationStatusUrl:
+      'https://reddybikeshare.socialbicycles.com/opendata/station_status.json',
     provider: 'Reddy Bikeshare',
-  }),
+  },
   bcycleEntry({
     id: 'las-vegas-rtc-bike-share',
     city: 'Las Vegas, NV',
@@ -342,6 +525,85 @@ const RAW_GBFS_CITY_REGISTRY = [
     centerLon: -119.6982,
     systemId: 'bcycle_santabarbara',
   }),
+  urbanSharingEntry({
+    id: 'oslo-bysykkel',
+    city: 'Oslo, Norway',
+    centerLat: 59.9139,
+    centerLon: 10.7522,
+    systemId: 'oslobysykkel.no',
+    provider: 'Oslo Bysykkel',
+  }),
+  urbanSharingEntry({
+    id: 'bergen-bysykkel',
+    city: 'Bergen, Norway',
+    centerLat: 60.3913,
+    centerLon: 5.3221,
+    systemId: 'bergenbysykkel.no',
+    provider: 'Bergen Bysykkel',
+  }),
+  urbanSharingEntry({
+    id: 'trondheim-bysykkel',
+    city: 'Trondheim, Norway',
+    centerLat: 63.4305,
+    centerLon: 10.3951,
+    systemId: 'trondheimbysykkel.no',
+    provider: 'Trondheim Bysykkel',
+  }),
+  enturEntry({
+    id: 'stavanger-kolumbus',
+    city: 'Stavanger, Norway',
+    centerLat: 58.9,
+    centerLon: 5.72,
+    systemId: 'kolumbusbysykkel',
+    provider: 'Kolumbus Bysykkel',
+  }),
+  enturEntry({
+    id: 'skien-farte',
+    city: 'Skien/Porsgrunn, Norway',
+    centerLat: 59.16,
+    centerLon: 9.64,
+    systemId: 'fartebysykkel',
+    provider: 'Farte Bysykkel',
+    loadRadiusKm: 40,
+  }),
+  {
+    id: 'lillestrom-bysykkel',
+    city: 'Lillestrøm, Norway',
+    centerLat: 59.9556,
+    centerLon: 11.0492,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://api.cyclocity.fr/contracts/lillestrom/gbfs/station_information.json',
+    stationStatusUrl:
+      'https://api.cyclocity.fr/contracts/lillestrom/gbfs/station_status.json',
+    provider: 'Bysykkel Lillestrøm',
+  },
+  {
+    id: 'barcelona-bicing',
+    city: 'Barcelona, Spain',
+    centerLat: 41.3926,
+    centerLon: 2.164,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://barcelona.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://barcelona.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bicing',
+  },
+  // AMBici covers the metropolitan municipalities around Barcelona, from
+  // Castelldefels to Badalona, and overlaps Bicing only at the city edge.
+  {
+    id: 'barcelona-ambici',
+    city: 'Barcelona metropolitan area, Spain',
+    centerLat: 41.37,
+    centerLon: 2.07,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://gbfs.nextbike.net/maps/gbfs/v2/nextbike_bs/en/station_information.json',
+    stationStatusUrl:
+      'https://gbfs.nextbike.net/maps/gbfs/v2/nextbike_bs/en/station_status.json',
+    provider: 'AMBici',
+  },
 ];
 function normalizeRegistryEntry(entry) {
   const id = String(entry?.id || '')
@@ -370,11 +632,13 @@ function normalizeRegistryEntry(entry) {
   ) {
     throw new Error(`GBFS entry "${id}" must use https URLs`);
   }
-  // Validate that URLs end with expected GBFS endpoint filenames
-  if (!/\/station_information\.json$/i.test(stationInformationUrl.pathname)) {
+  // Validate that URLs end with expected GBFS endpoint names (Entur omits .json)
+  if (
+    !/\/station_information(\.json)?$/i.test(stationInformationUrl.pathname)
+  ) {
     throw new Error(`GBFS entry "${id}" station_information URL is invalid`);
   }
-  if (!/\/station_status\.json$/i.test(stationStatusUrl.pathname)) {
+  if (!/\/station_status(\.json)?$/i.test(stationStatusUrl.pathname)) {
     throw new Error(`GBFS entry "${id}" station_status URL is invalid`);
   }
 

src/layers/bikeshare/registry.test.mjs

@@ -0,0 +1,58 @@
+// BIKESHARE REGISTRY — a city entry is only useful if the proxy will serve it.
+//
+// A registry entry and the GBFS proxy allowlist are edited in different files,
+// so a city can look correctly registered while every one of its requests is
+// rejected at the proxy. These cases hold the two together: each entry is
+// checked against the same host and path predicates the proxy enforces, so a
+// new city that the proxy would refuse fails here rather than silently
+// rendering an empty layer.
+//
+// Run with: npm test
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { GBFS_CITY_REGISTRY, CITY_BY_ID } from './registry.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+test('every registered city is reachable through the GBFS proxy allowlist', () => {
+  for (const city of GBFS_CITY_REGISTRY) {
+    for (const raw of [city.stationInformationUrl, city.stationStatusUrl]) {
+      const url = new URL(raw);
+      assert.equal(
+        isAllowedGbfsHost(url.hostname),
+        true,
+        `${city.id}: host ${url.hostname} is not allowlisted`,
+      );
+      assert.equal(
+        isAllowedGbfsPath(url.pathname, url.hostname),
+        true,
+        `${city.id}: path ${url.pathname} is not allowlisted`,
+      );
+    }
+  }
+});
+
+test('Bike Share Toronto is registered against the PBSC v2 feeds', () => {
+  const toronto = CITY_BY_ID.get('toronto-bike-share');
+  assert.ok(toronto, 'toronto-bike-share is missing from the registry');
+  assert.equal(toronto.city, 'Toronto, ON');
+  assert.equal(toronto.provider, 'Bike Share Toronto');
+  assert.equal(
+    toronto.stationInformationUrl,
+    'https://toronto.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+  );
+  assert.equal(
+    toronto.stationStatusUrl,
+    'https://toronto.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+  );
+});
+
+test('the Toronto center sits inside the system service area', () => {
+  const toronto = CITY_BY_ID.get('toronto-bike-share');
+  // Bounding box of the 1,069 live stations, sampled from the published
+  // station_information feed: 43.588..43.813 N, -79.603..-79.123 W.
+  assert.ok(toronto.centerLat > 43.588 && toronto.centerLat < 43.813);
+  assert.ok(toronto.centerLon > -79.603 && toronto.centerLon < -79.123);
+  // The system spans roughly 37 km east-west, so the load radius has to clear
+  // half that from the center or downtown pans lose the outer stations.
+  assert.ok(toronto.loadRadiusKm >= 25);
+});

src/layers/bikeshare/state.js

@@ -99,9 +99,17 @@ export function createState({ services }) {
 
   layerState._loadingOps = 0;
 
-  /** Most recent error message string, or null. */
+  /**
+   * @type {Set<string>} City ids whose most recent fetch failed.
+   *
+   * Per city rather than one layer-wide flag: feeds are fetched independently,
+   * so a retired operator must not mark a layer that other cities are still
+   * populating as failed. Entries are dropped when their city leaves range.
+   * The layer reports failure only when these cost it everything it had to
+   * draw, and degraded otherwise — see `getStats()` in controls.js.
+   */
 
-  layerState._error = null;
+  layerState._failedCityIds = new Set();
 
   /** Whether the MAX_TOTAL_POINTS cap warning has already been logged. */
 

src/layers/bikeshare/usPbscCities.test.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { CITY_BY_ID } from './registry.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+// Each city's PBSC host, and the stations farthest from its registered centre
+// in the live feed (checked 2026-10-13). HIBike's centre sits between its two
+// towns, so it lists the outermost station in each.
+const CITIES = {
+  'detroit-mogo': {
+    host: 'detroit.publicbikesystem.net',
+    provider: 'MoGo',
+    stations: [{ name: 'Robina Ave & W Twelve Mile Rd', lat: 42.50288, lon: -83.18921 }],
+  },
+  'pittsburgh-pogoh': {
+    host: 'pittsburgh.publicbikesystem.net',
+    provider: 'POGOH',
+    stations: [{ name: 'Wilkinsburg Park & Ride', lat: 40.446951, lon: -79.888593 }],
+  },
+  'aspen-we-cycle': {
+    host: 'aspen.publicbikesystem.net',
+    provider: 'WE-cycle',
+    stations: [{ name: 'Cowen Dr | Hwy 133', lat: 39.413115, lon: -107.220634 }],
+  },
+  'hawaii-island-hibike': {
+    host: 'kona.publicbikesystem.net',
+    provider: 'HIBike',
+    stations: [
+      { name: 'Kona Community Center', lat: 19.642932, lon: -156.004962 },
+      { name: 'Kealoha Beach Park, Hilo', lat: 19.733317, lon: -155.029202 },
+    ],
+  },
+};
+
+// The production range check, with no viewer or fetches behind it.
+const parts = { model: createModel({ state: {}, services: {}, parts: {}, source: null }) };
+const { computeInRangeCities } = createViewport({
+  state: {},
+  services: { render: { governorRequestRender() {} } },
+  parts,
+  source: null,
+});
+
+test('the added US PBSC systems are registered and readable through the proxy', () => {
+  for (const [id, expected] of Object.entries(CITIES)) {
+    const city = CITY_BY_ID.get(id);
+    assert.ok(city, `${id} is registered`);
+    assert.equal(city.provider, expected.provider);
+    assert.deepEqual(city.hosts, [expected.host]);
+    for (const feed of [city.stationInformationUrl, city.stationStatusUrl]) {
+      const url = new URL(feed);
+      assert.ok(isAllowedGbfsHost(url.hostname), `${id} host ${url.hostname}`);
+      assert.ok(isAllowedGbfsPath(url.pathname), `${id} path ${url.pathname}`);
+    }
+  }
+});
+
+test('a camera over each outermost station activates its system', () => {
+  for (const [id, expected] of Object.entries(CITIES)) {
+    for (const station of expected.stations) {
+      assert.ok(
+        computeInRangeCities({ lat: station.lat, lon: station.lon }).has(id),
+        `${station.name} activates ${id}`,
+      );
+    }
+  }
+});
+
+test('HIBike stays inactive away from Hawaii Island', () => {
+  // Honolulu is about 270 km from the HIBike centre.
+  assert.equal(
+    computeInRangeCities({ lat: 21.3069, lon: -157.8583 }).has('hawaii-island-hibike'),
+    false,
+  );
+});

src/layers/bikeshare/viewport.js

@@ -122,6 +122,9 @@ export function createViewport({ state: layerState, services, parts, source }) {
     const cityIds = Array.from(layerState._activeCityIds);
     for (const cityId of cityIds) deactivateCity(cityId);
     layerState._activeCityIds.clear();
+    // A failure belongs to a city in range; none are once everything is off.
+    layerState._failedCityIds.clear();
+    layerState._count = 0;
   }
 
   /**
@@ -168,11 +171,19 @@ export function createViewport({ state: layerState, services, parts, source }) {
         return;
       parts.rendering.applyStatusToPoints(cityId, statusMap);
       layerState._lastUpdate = Date.now();
-      layerState._error = null;
+      layerState._failedCityIds.delete(cityId);
     } catch (error) {
       if (error?.name === 'AbortError') return;
+      // A rejection from superseded work must not mark (or tear down) a city
+      // that a newer proximity check or re-enable now owns.
+      if (
+        !layerState._enabled ||
+        !layerState._activeCityIds.has(cityId) ||
+        generation !== layerState._proximityGeneration
+      )
+        return;
       console.warn(`[Data:Bikeshare] ${cityId} activate error:`, error);
-      layerState._error = 'GBFS fetch error';
+      layerState._failedCityIds.add(cityId);
       deactivateCity(cityId);
       layerState._activeCityIds.delete(cityId);
     } finally {
@@ -208,6 +219,10 @@ export function createViewport({ state: layerState, services, parts, source }) {
         deactivateCity(cityId);
       }
     }
+    // A failure never outlives its city's range.
+    for (const cityId of layerState._failedCityIds) {
+      if (!nextActive.has(cityId)) layerState._failedCityIds.delete(cityId);
+    }
 
     layerState._activeCityIds = nextActive;
     if (layerState._activeCityIds.size === 0) {

src/layers/cctv/catalog.js

@@ -1,4 +1,41 @@
 import { CAMERA_SEEDS, SOURCE_ENDPOINT } from './policy.js';
+import {
+  lookupModelSpec,
+  horizontalFovRangeDeg,
+  fixedHorizontalFovDeg,
+} from './modelSpecs.js';
+
+/**
+ * Applies datasheet enrichment to a camera in place: when it names a known
+ * hardware `model` (and, when published, a matching `manufacturer`), the spec
+ * record is attached for the HUD and the datasheet's horizontal FOV range
+ * rides along as `specFovMinDeg`/`specFovMaxDeg`. Only fixed-lens hardware
+ * fills the FOV, and only when none was given: an explicit source/seed
+ * `fovDeg` or a curated pose is never overwritten. A PTZ/varifocal range says
+ * what the lens CAN do, not where it is zoomed now.
+ * Unknown models — the common case — change nothing.
+ * @param {Object} camera - Camera being built (mutated).
+ * @param {{model?:string, manufacturer?:string, explicitFov?:boolean}} hardware
+ *   - Hardware model/manufacturer from a source or seed, and whether that
+ *   source or seed stated its own `fovDeg`.
+ * @param {(v:number,min:number,max:number)=>number} clamp - Pose clamp helper.
+ */
+function applyModelEnrichment(camera, hardware, clamp) {
+  const { model, manufacturer, explicitFov } = hardware;
+  const spec = model ? lookupModelSpec(model, manufacturer) : null;
+  if (!spec) return;
+  const range = horizontalFovRangeDeg(spec);
+  if (range) {
+    camera.specFovMinDeg = range.minDeg;
+    camera.specFovMaxDeg = range.maxDeg;
+  }
+  const fixedFov = fixedHorizontalFovDeg(spec);
+  if (fixedFov && !explicitFov && camera.poseSource !== 'curated') {
+    camera.fovDeg = clamp(fixedFov, 20, 125);
+    camera.fovSource = 'datasheet';
+  }
+  camera.spec = spec;
+}
 
 export function createCatalog({ state: layerState, services, parts, source }) {
   const { CITY_POIS } = services.locations;
@@ -45,6 +82,11 @@ export function createCatalog({ state: layerState, services, parts, source }) {
           parts.model.clamp(seed.elevationM ?? 22, 8, 80),
         pitchDeg: parts.model.clamp(seed.pitchDeg ?? -17, -40, -4),
       };
+      applyModelEnrichment(
+        camera,
+        { model: seed.model, explicitFov: seed.fovDeg != null },
+        parts.model.clamp,
+      );
       parts.model.ensureCameraPose(camera);
       catalog.push(camera);
     }
@@ -204,7 +246,22 @@ export function createCatalog({ state: layerState, services, parts, source }) {
             ? source.groundHeights
             : null,
         poseSource,
+        model: String(source.model || ''),
+        manufacturer: String(source.manufacturer || ''),
       };
+      applyModelEnrichment(
+        camera,
+        {
+          model: source.model || seed?.model,
+          manufacturer: source.model ? source.manufacturer : '',
+          explicitFov:
+            (source.fovDeg != null && Number.isFinite(Number(source.fovDeg))) ||
+            CAMERA_SEEDS.some(
+              (entry) => entry.id === id && entry.fovDeg != null,
+            ),
+        },
+        parts.model.clamp,
+      );
       parts.model.ensureCameraPose(camera);
       catalog.push(camera);
     }

src/layers/cctv/modelSpecs.js

@@ -0,0 +1,531 @@
+/**
+ * @module cctvModelSpecs
+ *
+ * Hardware-model spec enrichment for the CCTV layer.
+ *
+ * When a catalog camera names its hardware model (source packs may set
+ * `model`; hand-authored seeds may too), the model resolves to a datasheet
+ * record and the HUD meta line gains the model's real specs. A fixed-lens
+ * model's horizontal FOV replaces the frustum's estimate; a PTZ/varifocal or
+ * multi-sensor range is carried as capability metadata beside the estimate,
+ * because the lens's current zoom is unknown.
+ * Cameras without an identified model are untouched — unknown never implies
+ * anything.
+ *
+ * Spec records are vendored verbatim from the CCTV Camera Database
+ * (https://github.com/ch-bas/cctv-camera-database, CC0-1.0) — an open dataset
+ * of 28,000+ camera models transcribed from manufacturer datasheets (84% with
+ * FOV, as of v2.26.0). This module vendors the records that the currently integrated public
+ * catalogs publish hardware for — King County WA (Cohu, Bosch AUTODOME, Axis
+ * Q6135-LE), plus the Bosch AUTODOME and Axis PTZ/multisensor models that
+ * appear in Sarasota County FL and Sioux Falls SD open data; packs that
+ * publish other hardware models can grow it, or vendor the full extract.
+ *
+ * Scope guardrail: records describe camera PRODUCTS (optics, resolution,
+ * night vision) — never endpoints, stream paths, or access/config data.
+ */
+
+/** Verbatim records from the dataset's model-enrichment extract (v2.26.0). */
+const RECORDS = [
+  {
+    id: 'axis-q6135-le',
+    brand: 'Axis',
+    model: 'Q6135-LE',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/axis-q6135-le/',
+    aliases: ['01959-004'],
+    fov_deg: '58.3-2.4 horizontal',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    night_vision: { type: 'ir', range_m: 250 },
+    environment: ['outdoor'],
+    ndaa_compliant: true,
+  },
+  {
+    id: 'hanwha-xnp-6400rw',
+    brand: 'Hanwha',
+    model: 'XNP-6400RW',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/hanwha-xnp-6400rw/',
+    aliases: ['Wisenet PTZ Plus 2MP 40x IR PTZ'],
+    fov_deg: '65.66-1.88 horizontal / 39.4-1.09 vertical',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    night_vision: { type: 'ir', range_m: 200 },
+    environment: ['outdoor'],
+    ndaa_compliant: true,
+  },
+  {
+    id: 'hikvision-ds-2cd2087g3-li2uy',
+    brand: 'Hikvision',
+    model: 'DS-2CD2087G3-LI2UY',
+    type: 'bullet',
+    url: 'https://www.cctv-database.com/camera/hikvision-ds-2cd2087g3-li2uy/',
+    fov_deg: '108.8 horizontal (2.8mm) / 93.3 horizontal (4mm)',
+    resolution: { mp: 8, w: 3840, h: 2160, label: '8MP (4K)' },
+    night_vision: { type: 'color', range_m: 40 },
+    environment: ['outdoor'],
+    ndaa_compliant: false,
+  },
+  {
+    id: 'axis-f4105-lre',
+    brand: 'Axis',
+    model: 'F4105-LRE',
+    type: 'dome',
+    url: 'https://www.cctv-database.com/camera/axis-f4105-lre/',
+    fov_deg: '110 horizontal, 60 vertical',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p HD' },
+    night_vision: { type: 'ir', range_m: 10 },
+    environment: ['outdoor'],
+    ndaa_compliant: true,
+  },
+  {
+    id: 'axis-p3707-pe',
+    brand: 'Axis',
+    model: 'P3707-PE',
+    type: 'panoramic',
+    url: 'https://www.cctv-database.com/camera/axis-p3707-pe/',
+    aliases: ['AXIS P3707-PE', 'P3707-PE'],
+    fov_deg: '108-54 horizontal per sensor (4x 1080p)',
+    resolution: {
+      mp: 8,
+      w: 1920,
+      h: 1080,
+      label: '4x 2MP (8MP total; 4x 1080p)',
+    },
+    lens_count: 4,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'axis-q6000-e-mk-ii',
+    brand: 'Axis',
+    model: 'Q6000-E Mk II',
+    type: 'panoramic',
+    url: 'https://www.cctv-database.com/camera/axis-q6000-e-mk-ii/',
+    aliases: [
+      'AXIS Q6000-E Mk II',
+      'Q6000-E Mk II 50 Hz',
+      'Q6000-E Mk II 60 Hz',
+    ],
+    fov_deg: 'up to 360 combined; 113-152 horizontal per sensor',
+    resolution: {
+      mp: 8,
+      w: 1920,
+      h: 1080,
+      label: '4x 2MP (8MP total; 4x 1080p)',
+    },
+    lens_count: 4,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'axis-q6054-e',
+    brand: 'Axis',
+    model: 'Q6054-E',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/axis-q6054-e/',
+    aliases: ['AXIS Q6054-E', 'Q6054-E 50 Hz', 'Q6054-E 60 Hz'],
+    fov_deg: '62.9-2.2 horizontal',
+    resolution: { mp: 1, w: 1280, h: 720, label: '720p HD' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'axis-q6155-e',
+    brand: 'Axis',
+    model: 'Q6155-E',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/axis-q6155-e/',
+    aliases: ['AXIS Q6155-E', 'Q6155-E 50 Hz', 'Q6155-E 60 Hz'],
+    fov_deg: '66.7-2.36 horizontal',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p HD' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-autodome-500i',
+    brand: 'Bosch',
+    model: 'AutoDome 500i Series (VG4)',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-autodome-500i/',
+    aliases: [
+      'VG4 AUTODOME',
+      'VG4 AUTODOME H.264',
+      'AutoDome 500i',
+      'AutoDome 500i Series',
+      'VG4-500i',
+      'VG4-500',
+    ],
+    fov_deg: '57.8-1.7 horizontal',
+    resolution: { mp: 0.4, label: '540 TVL (NTSC/PAL)' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-autodome-ip-dynamic-7000-hd',
+    brand: 'Bosch',
+    model: 'AUTODOME IP dynamic 7000 HD',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-autodome-ip-dynamic-7000-hd/',
+    aliases: ['AUTODOME IP dynamic 7000 HD', 'AUTODOME 7000 dynamic HD'],
+    fov_deg: '65-2.3 horizontal',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p HD (2MP)' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-autodome-ip-starlight-7000-hd',
+    brand: 'Bosch',
+    model: 'AUTODOME IP starlight 7000 HD',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-autodome-ip-starlight-7000-hd/',
+    aliases: [
+      'AUTODOME IP starlight 7000 HD',
+      'Starlight 7000HD',
+      'VG5-7130-CPT4',
+      'VG5-7130',
+    ],
+    fov_deg: '59-2.1 horizontal',
+    resolution: { mp: 1, w: 1280, h: 720, label: '720p HD (1.3MP sensor)' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-ndp-5502-30',
+    brand: 'Bosch',
+    model: 'AUTODOME IP 5000i (NDP-5502-Z30)',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-ndp-5502-30/',
+    aliases: [
+      'AUTODOME IP 5000i',
+      'NDP-5502-Z30',
+      'NDP-5502-Z30C',
+      'NDP-5502-30',
+    ],
+    fov_deg: '60.9-2.4 horizontal',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p HD (2MP)' },
+    ptz: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-ndp-7512-z30',
+    brand: 'Bosch',
+    model: 'AUTODOME IP starlight 7000i (NDP-7512-Z30)',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-ndp-7512-z30/',
+    aliases: [
+      'AUTODOME IP starlight 7000i',
+      'NDP-7512-Z30',
+      'NDP-7512-Z30C',
+      'NDP-7512-Z30K',
+    ],
+    fov_deg: '64.7-2.3 horizontal',
+    resolution: { mp: 2, w: 1920, h: 1080, label: '1080p HD (2MP)' },
+    ptz: true,
+    autotracking: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'bosch-vg5-836-ecev',
+    brand: 'Bosch',
+    model: 'AUTODOME 800 Series HD PTZ (VG5-836-ECEV)',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/bosch-vg5-836-ecev/',
+    aliases: ['VG5-836-ECEV', 'VG5-836', 'AUTODOME 800 Series'],
+    resolution: { mp: 2, label: '1080p' },
+    ptz: true,
+    autotracking: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'cohu-3920-idome',
+    brand: 'Cohu',
+    model: '3920 iDome',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/cohu-3920-idome/',
+    aliases: [
+      '3920',
+      '3920 Series',
+      '3923',
+      '3925',
+      '3925 Dome',
+      'iDome 3925',
+      'Cohu iDome 3920 Series',
+    ],
+    resolution: { mp: 0.4, label: 'NTSC / 470 TVL' },
+    ptz: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'cohu-3950-iview',
+    brand: 'Cohu',
+    model: '3950 iVIEW',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/cohu-3950-iview/',
+    aliases: ['3950', '3950 Series', 'Cohu 3950 Series iVIEW'],
+    resolution: { mp: 0.4, label: 'NTSC / 470 TVL' },
+    ptz: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+  {
+    id: 'cohu-3960',
+    brand: 'Cohu',
+    model: '3960',
+    type: 'ptz',
+    url: 'https://www.cctv-database.com/camera/cohu-3960/',
+    aliases: ['3960 Series', '3964', '3965', 'Cohu 3960 iView'],
+    resolution: { mp: 0.4, label: 'NTSC/PAL / 470 TVL' },
+    ptz: true,
+    varifocal: true,
+    environment: ['outdoor'],
+  },
+];
+
+/** Lowercase + collapse whitespace, the shared normal form for matching. */
+function normalize(value) {
+  return String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, ' ');
+}
+
+/**
+ * Whitespace words of a name, lowercased, with surrounding punctuation trimmed
+ * so "(NDP-7512-Z30)" reads as "ndp-7512-z30". Inner hyphens and dots stay:
+ * "f4105-lre-unknown" is one word, never "f4105-lre" plus noise.
+ * @param {string} value
+ * @returns {string[]}
+ */
+function words(value) {
+  return normalize(value)
+    .split(' ')
+    .map((raw) => raw.replace(/^[^a-z0-9]+|[^a-z0-9]+$/g, ''))
+    .filter(Boolean);
+}
+
+/**
+ * Descriptor words that never identify hardware: product-type nouns, codec
+ * and resolution/zoom/frequency tokens ("h.264", "2mp", "40x", "1080p").
+ */
+const GENERIC_WORDS = new Set([
+  'network',
+  'camera',
+  'cam',
+  'ip',
+  'ptz',
+  'dome',
+  'bullet',
+  'box',
+  'hd',
+  'ir',
+  'outdoor',
+  'indoor',
+  'series',
+]);
+
+function isGeneric(word) {
+  return (
+    GENERIC_WORDS.has(word) ||
+    /^h\.?\d+$/.test(word) ||
+    /^\d+(?:\.\d+)?(?:mp|p|k|x|mm|hz|tvl)$/.test(word)
+  );
+}
+
+/** A model code: letters AND digits, and not a generic descriptor. */
+function isModelCode(word) {
+  return /[a-z]/.test(word) && /\d/.test(word) && !isGeneric(word);
+}
+
+/** Hyphenated variant suffixes that do not change the hardware. */
+const VARIANT_SUFFIXES = new Set(['50hz', '60hz', 'ntsc', 'pal']);
+
+/** "q6155-e-60hz" → "q6155-e"; "f4105-lre-unknown" is left as is. */
+function stripVariantSuffix(word) {
+  let out = word;
+  for (;;) {
+    const cut = out.lastIndexOf('-');
+    if (cut <= 0 || !VARIANT_SUFFIXES.has(out.slice(cut + 1))) return out;
+    out = out.slice(0, cut);
+  }
+}
+
+/** Manufacturer names (lowercased words) accepted for each record brand. */
+const BRAND_ALIASES = {
+  Hanwha: ['wisenet', 'samsung'],
+  Hikvision: ['hiwatch'],
+};
+
+function brandWords(record) {
+  return new Set([
+    ...words(record.brand),
+    ...(BRAND_ALIASES[record.brand] || []),
+  ]);
+}
+
+/**
+ * One entry per record name (model + aliases). `required` is every
+ * non-generic word of the name — all must appear in a query, so a generation
+ * or suffix ("Mk II", "7000i" vs "7000") is never dropped. `hasCode` marks
+ * names carrying a letter+digit model code; names without one ("3950",
+ * "01959-004", "AUTODOME 800 Series") match only when the brand does.
+ */
+const NAME_INDEX = RECORDS.flatMap((record) => {
+  const brand = brandWords(record);
+  return [record.model, ...(record.aliases || [])].map((name) => {
+    const nameWords = words(name);
+    return {
+      record,
+      brand,
+      allowed: new Set(nameWords),
+      required: nameWords.filter((word) => !isGeneric(word)),
+      hasCode: nameWords.some(isModelCode),
+    };
+  });
+});
+
+/**
+ * Looks up a spec record for a hardware-model string.
+ *
+ * A record name matches when every non-generic word of that name appears in
+ * the query (case-insensitive, punctuation-trimmed) and every other query word
+ * is generic or the record's brand. That lets a VERBOSE registry string
+ * resolve — "AXIS Q6155-E PTZ Dome Network Camera" finds the Q6155-E — while
+ * an unrelated code ("Q1615"), a generation suffix ("Mk II") or a longer part
+ * number ("F4105-LRE-UNKNOWN") rejects the match. Codec, resolution and
+ * product-type words never identify hardware on their own. A name with no
+ * letter+digit model code ("3950") needs the brand, from `manufacturer` or the
+ * query itself. A `manufacturer` that is not the record's brand always
+ * rejects. Matches on two different records are ambiguous → null (never
+ * guesses).
+ * @param {string} model - Hardware model as named by a source pack or seed.
+ * @param {string} [manufacturer] - The source's manufacturer, when published.
+ * @returns {Object|null} The verbatim spec record, or null when unknown.
+ */
+export function lookupModelSpec(model, manufacturer) {
+  const query = words(model).map(stripVariantSuffix);
+  if (!query.length) return null;
+  const maker = words(manufacturer);
+  const found = new Set();
+  for (const entry of NAME_INDEX) {
+    const makerMatches = maker.some((word) => entry.brand.has(word));
+    if (maker.length && !makerMatches) continue;
+    if (
+      !entry.hasCode &&
+      !makerMatches &&
+      !query.some((word) => entry.brand.has(word))
+    )
+      continue;
+    if (!entry.required.length) continue;
+    if (!entry.required.every((word) => query.includes(word))) continue;
+    if (
+      !query.every(
+        (word) =>
+          entry.allowed.has(word) || entry.brand.has(word) || isGeneric(word),
+      )
+    )
+      continue;
+    found.add(entry.record);
+  }
+  return found.size === 1 ? [...found][0] : null;
+}
+
+/**
+ * Datasheet horizontal FOV as the range the hardware can cover. Only
+ * segments stating a horizontal figure count — vertical and "combined"
+ * panoramic figures never do — and parenthesized lens/sensor notes are
+ * ignored. A zoom ('58.3-2.4 horizontal') and a lens-option list
+ * ('108.8 horizontal (2.8mm) / 93.3 horizontal (4mm)') both yield a range.
+ * @param {Object} spec - A record from this module.
+ * @returns {{minDeg:number, maxDeg:number}|null} Null when unstated.
+ */
+export function horizontalFovRangeDeg(spec) {
+  const values = [];
+  for (const segment of String(spec?.fov_deg || '').split(/[/;,]/)) {
+    if (!/horizontal/i.test(segment)) continue;
+    const figures = segment.replace(/\([^)]*\)/g, '').split(/horizontal/i)[0];
+    for (const match of figures.matchAll(/\d+(?:\.\d+)?/g)) {
+      const value = Number(match[0]);
+      if (Number.isFinite(value) && value > 0) values.push(value);
+    }
+  }
+  if (!values.length) return null;
+  return { minDeg: Math.min(...values), maxDeg: Math.max(...values) };
+}
+
+/**
+ * The datasheet horizontal FOV as the camera's CURRENT optical state, which
+ * holds only for fixed single-lens hardware stating one figure. PTZ,
+ * varifocal and multi-sensor models publish a capability range whose in-use
+ * value is unknown — known hardware capability is not known pose state — so
+ * they return null and keep their estimated FOV.
+ * @param {Object} spec - A record from this module.
+ * @returns {number|null} Fixed horizontal FOV in degrees, or null.
+ */
+export function fixedHorizontalFovDeg(spec) {
+  if (!spec || spec.ptz || spec.varifocal || (spec.lens_count || 1) > 1)
+    return null;
+  const range = horizontalFovRangeDeg(spec);
+  return range && range.minDeg === range.maxDeg ? range.minDeg : null;
+}
+
+/**
+ * True when the camera's CURRENT FOV is the datasheet figure: it was filled
+ * from a fixed-lens datasheet and no manual calibration offset has moved it.
+ * @param {Object} camera - Catalog camera (see applyModelEnrichment).
+ * @returns {boolean}
+ */
+export function isDatasheetFov(camera) {
+  return camera?.fovSource === 'datasheet' && !camera.calibration?.fovDeg;
+}
+
+/**
+ * HUD token for a datasheet FOV that describes capability rather than the
+ * camera's current state, e.g. 'SPEC FOV 2.4–58° (CAPABILITY)'.
+ * @param {Object} camera - Catalog camera (see applyModelEnrichment).
+ * @returns {string|null} Null when the datasheet FOV already IS the camera's
+ *   FOV (fixed lens) or no datasheet range is known.
+ */
+export function specFovCapabilityToken(camera) {
+  if (!camera || camera.fovSource === 'datasheet') return null;
+  const { specFovMinDeg: min, specFovMaxDeg: max } = camera;
+  if (!Number.isFinite(min) || !Number.isFinite(max)) return null;
+  const fmt = (deg) => (deg < 10 ? deg.toFixed(1) : String(Math.round(deg)));
+  const span = min === max ? fmt(max) : `${fmt(min)}–${fmt(max)}`;
+  return `SPEC FOV ${span}° (CAPABILITY)`;
+}
+
+/**
+ * One-line spec summary for HUD meta text.
+ * @param {Object} spec - A record from this module.
+ * @returns {string} e.g. 'Axis Q6135-LE · 1080p · IR 250m · PTZ' ('' for null).
+ */
+export function specSummary(spec) {
+  if (!spec) return '';
+  const parts = [`${spec.brand} ${spec.model}`];
+  if (spec.resolution?.label) parts.push(spec.resolution.label);
+  if (spec.night_vision) {
+    parts.push(
+      `${spec.night_vision.type.toUpperCase()}${spec.night_vision.range_m ? ` ${spec.night_vision.range_m}m` : ''}`,
+    );
+  }
+  if (spec.ptz) parts.push('PTZ');
+  return parts.join(' · ');
+}

src/layers/cctv/modelSpecs.test.mjs

@@ -0,0 +1,301 @@
+// src/layers/cctv/modelSpecs.test.mjs
+// Hardware-model spec enrichment: lookup semantics (case-insensitive, alias
+// matching, unknown → null — never a guess), datasheet-FOV parsing across the
+// real fov_deg string shapes, and the HUD spec-summary line.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  lookupModelSpec,
+  horizontalFovRangeDeg,
+  fixedHorizontalFovDeg,
+  specFovCapabilityToken,
+  isDatasheetFov,
+  specSummary,
+} from './modelSpecs.js';
+import { createCatalog } from './catalog.js';
+
+test('lookupModelSpec matches case-insensitively and trims', () => {
+  const spec = lookupModelSpec('  q6135-le ');
+  assert.ok(spec);
+  assert.equal(spec.brand, 'Axis');
+  assert.equal(lookupModelSpec('Q6135-LE'), spec);
+});
+
+test('lookupModelSpec matches aliases', () => {
+  // A part number without letters needs the brand.
+  const byAlias = lookupModelSpec('01959-004', 'Axis');
+  assert.ok(byAlias);
+  assert.equal(byAlias.model, 'Q6135-LE');
+});
+
+test('vendored table covers the integrated catalogs published hardware', () => {
+  // Models the live packs publish: King County (Cohu, AUTODOME IP 5000i),
+  // Sarasota (Bosch AUTODOME 7000/VG4), Sioux Falls (Axis).
+  // King County publishes "3950" with Manufacturer "Cohu".
+  const cohu = lookupModelSpec('3950', 'Cohu');
+  assert.equal(cohu?.brand, 'Cohu');
+  const autodome = lookupModelSpec('AUTODOME IP 5000i');
+  assert.ok(autodome && horizontalFovRangeDeg(autodome).maxDeg > 0);
+  const vg4 = lookupModelSpec('VG4 AUTODOME H.264'); // Sarasota's string
+  assert.ok(vg4);
+  const axis = lookupModelSpec('Q6155-E'); // Sioux Falls
+  assert.deepEqual(horizontalFovRangeDeg(axis), { minDeg: 2.36, maxDeg: 66.7 });
+});
+
+test('verbose registry strings resolve via distinctive-token fallback', () => {
+  // Sioux Falls publishes the full product title, not the bare model.
+  assert.equal(
+    lookupModelSpec('AXIS Q6155-E PTZ Dome Network Camera')?.model,
+    'Q6155-E',
+  );
+  assert.equal(lookupModelSpec('AXIS Q6000-E Mk II')?.model, 'Q6000-E Mk II');
+  assert.equal(
+    lookupModelSpec('AUTODOME IP starlight 7000i camera')?.id,
+    'bosch-ndp-7512-z30',
+  );
+  // Punctuation around the model token doesn't defeat the match.
+  assert.equal(
+    lookupModelSpec('camera (P3707-PE), outdoor')?.model,
+    'P3707-PE',
+  );
+});
+
+test('token fallback never matches on generic words or wrong models', () => {
+  // Only generic descriptors — no distinctive hardware token — stays null.
+  assert.equal(lookupModelSpec('PTZ Dome Camera'), null);
+  assert.equal(lookupModelSpec('HD Network Camera'), null);
+  assert.equal(lookupModelSpec('Outdoor Dome Camera'), null);
+  // A real-looking but unknown model resolves to nothing, not a near neighbour.
+  assert.equal(lookupModelSpec('AXIS FooBar-9 Network Camera'), null);
+  // A generation token alone must not collide with a similar one: "7000"
+  // belongs to two records (dynamic / starlight 7000 HD), so a bare
+  // "AUTODOME 7000" is ambiguous → null rather than an arbitrary pick.
+  assert.equal(lookupModelSpec('AUTODOME 7000'), null);
+});
+
+test('exact match still wins over the token fallback', () => {
+  // "3965" is an alias of the 3960, not the 3950.
+  assert.equal(lookupModelSpec('3965', 'Cohu')?.id, 'cohu-3960');
+  assert.equal(lookupModelSpec('AUTODOME IP 5000i')?.id, 'bosch-ndp-5502-30');
+});
+
+test('lookupModelSpec returns null for unknown or empty input — never guesses', () => {
+  assert.equal(lookupModelSpec('NOT-A-REAL-MODEL'), null);
+  assert.equal(lookupModelSpec(''), null);
+  assert.equal(lookupModelSpec(null), null);
+  assert.equal(lookupModelSpec(undefined), null);
+});
+
+test('horizontalFovRangeDeg reads the full range across real fov_deg shapes', () => {
+  const range = (model) => horizontalFovRangeDeg(lookupModelSpec(model));
+  // PTZ zoom: both ends, not just the wide one.
+  assert.deepEqual(range('Q6135-LE'), { minDeg: 2.4, maxDeg: 58.3 });
+  // Vertical figures never count.
+  assert.deepEqual(range('XNP-6400RW'), { minDeg: 1.88, maxDeg: 65.66 });
+  // Lens options: parenthesized focal lengths are not FOV figures.
+  assert.deepEqual(range('DS-2CD2087G3-LI2UY'), {
+    minDeg: 93.3,
+    maxDeg: 108.8,
+  });
+  assert.deepEqual(range('F4105-LRE'), { minDeg: 110, maxDeg: 110 });
+  // The "360 combined" panoramic figure is not a horizontal lens FOV.
+  assert.deepEqual(range('Q6000-E Mk II'), { minDeg: 113, maxDeg: 152 });
+  assert.deepEqual(range('P3707-PE'), { minDeg: 54, maxDeg: 108 });
+});
+
+test('horizontalFovRangeDeg returns null when no numeric FOV is stated', () => {
+  assert.equal(horizontalFovRangeDeg({ fov_deg: '' }), null);
+  assert.equal(horizontalFovRangeDeg({ fov_deg: 'wide dynamic range' }), null);
+  assert.equal(horizontalFovRangeDeg({ fov_deg: '60 vertical' }), null);
+  assert.equal(horizontalFovRangeDeg({}), null);
+  assert.equal(horizontalFovRangeDeg(null), null);
+});
+
+test('fixedHorizontalFovDeg is the current FOV only for fixed single-lens hardware', () => {
+  // Fixed dome, one horizontal figure: the datasheet IS the optical state.
+  assert.equal(fixedHorizontalFovDeg(lookupModelSpec('F4105-LRE')), 110);
+  // Known hardware capability != known pose state: PTZ, multi-sensor, and a
+  // model sold in several lens options all stay estimated.
+  for (const model of [
+    'Q6135-LE',
+    'XNP-6400RW',
+    'AUTODOME IP 5000i',
+    'P3707-PE',
+    'Q6000-E Mk II',
+    'DS-2CD2087G3-LI2UY',
+  ]) {
+    assert.equal(fixedHorizontalFovDeg(lookupModelSpec(model)), null, model);
+  }
+  assert.equal(fixedHorizontalFovDeg(null), null);
+});
+
+test('specFovCapabilityToken labels a datasheet range as capability, never as current FOV', () => {
+  assert.equal(
+    specFovCapabilityToken({ specFovMinDeg: 2.4, specFovMaxDeg: 58.3 }),
+    'SPEC FOV 2.4–58° (CAPABILITY)',
+  );
+  assert.equal(
+    specFovCapabilityToken({ specFovMinDeg: 113, specFovMaxDeg: 113 }),
+    'SPEC FOV 113° (CAPABILITY)',
+  );
+  // Already the camera's FOV (fixed lens) or nothing known: no token.
+  assert.equal(
+    specFovCapabilityToken({
+      fovSource: 'datasheet',
+      specFovMinDeg: 110,
+      specFovMaxDeg: 110,
+    }),
+    null,
+  );
+  assert.equal(specFovCapabilityToken({}), null);
+  assert.equal(specFovCapabilityToken(null), null);
+});
+
+/** Browser catalog with the pose math stubbed: only enrichment is under test. */
+function browserCatalog() {
+  const model = {
+    safeNumber: (value, fallback = NaN) =>
+      Number.isFinite(Number(value)) ? Number(value) : fallback,
+    normalizeHeading: (deg) => ((deg % 360) + 360) % 360,
+    clamp: (value, lo, hi) => Math.min(hi, Math.max(lo, value)),
+    headingFromId: () => 0,
+    normalizeFeedType: (type) => type,
+    ensureCameraPose: () => {},
+  };
+  return createCatalog({
+    state: {},
+    services: { locations: { CITY_POIS: {} } },
+    parts: { model },
+    source: {},
+  });
+}
+
+test('catalog keeps the estimated FOV for PTZ hardware and fills only fixed-lens datasheets', () => {
+  const [ptz, fixed, unknown] = browserCatalog().buildCatalogFromSources([
+    { id: 'ptz', lat: 47.7, lon: -122, fovDeg: 44, model: 'Q6135-LE' },
+    { id: 'fixed', lat: 47.7, lon: -122, model: 'F4105-LRE' },
+    { id: 'unknown', lat: 47.7, lon: -122, fovDeg: 44, model: 'NOPE-1' },
+  ]);
+
+  // PTZ: the frustum keeps its estimate; the datasheet range is metadata.
+  assert.equal(ptz.fovDeg, 44);
+  assert.equal(ptz.fovSource, undefined);
+  assert.equal(ptz.specFovMinDeg, 2.4);
+  assert.equal(ptz.specFovMaxDeg, 58.3);
+  assert.equal(ptz.spec.model, 'Q6135-LE');
+
+  // Fixed lens: the datasheet figure is the optical state.
+  assert.equal(fixed.fovDeg, 110);
+  assert.equal(fixed.fovSource, 'datasheet');
+
+  // Unknown hardware changes nothing.
+  assert.equal(unknown.fovDeg, 44);
+  assert.equal(unknown.spec, undefined);
+  assert.equal(unknown.specFovMaxDeg, undefined);
+});
+
+test('codec, format and product words never identify hardware', () => {
+  // "h.264" is in the VG4 AUTODOME alias; it is a codec, not a model code.
+  assert.equal(lookupModelSpec('Axis Q1615 H.264 Network Camera'), null);
+  assert.equal(lookupModelSpec('H.264 Network Camera'), null);
+  assert.equal(lookupModelSpec('H.265 IP Camera'), null);
+});
+
+test('generation and suffix distinctions are preserved', () => {
+  // A Mk II is not the vendored (Mk I) Q6135-LE.
+  assert.equal(lookupModelSpec('AXIS Q6135-LE Mk II'), null);
+  // A longer part number is a different product...
+  assert.equal(lookupModelSpec('F4105-LRE-UNKNOWN'), null);
+  // ...unless the rest is a mains-frequency variant suffix.
+  assert.equal(lookupModelSpec('Q6155-E-60Hz')?.id, 'axis-q6155-e');
+});
+
+test('manufacturer must agree with the record brand', () => {
+  // Purely numeric models need a brand match.
+  assert.equal(lookupModelSpec('3950'), null);
+  assert.equal(lookupModelSpec('Pelco 3950'), null);
+  assert.equal(lookupModelSpec('3950', 'Pelco'), null);
+  // A model code under the wrong manufacturer is not that record either.
+  assert.equal(lookupModelSpec('Q6135-LE', 'Hikvision'), null);
+  // Case-insensitive, with company suffixes and aliases.
+  assert.equal(lookupModelSpec('3950', 'COHU')?.id, 'cohu-3950-iview');
+  assert.equal(
+    lookupModelSpec('Q6135-LE', 'Axis Communications AB')?.id,
+    'axis-q6135-le',
+  );
+  assert.equal(
+    lookupModelSpec('XNP-6400RW', 'Hanwha Vision')?.id,
+    'hanwha-xnp-6400rw',
+  );
+  assert.equal(
+    lookupModelSpec('XNP-6400RW', 'Wisenet')?.id,
+    'hanwha-xnp-6400rw',
+  );
+});
+
+test('King County snapshot model strings still resolve', () => {
+  // Model/Manufacturer pairs as published in the King County feed.
+  assert.equal(lookupModelSpec('3950', 'Cohu')?.id, 'cohu-3950-iview');
+  assert.equal(lookupModelSpec('3965', 'Cohu')?.id, 'cohu-3960');
+  assert.equal(lookupModelSpec('3925 Dome', 'Cohu')?.id, 'cohu-3920-idome');
+  assert.equal(lookupModelSpec('Q6135-LE', 'Axis')?.id, 'axis-q6135-le');
+  assert.equal(
+    lookupModelSpec('AUTODOME IP 5000i', 'BOSCH')?.id,
+    'bosch-ndp-5502-30',
+  );
+});
+
+test('catalog never overwrites an explicit FOV or a curated pose', () => {
+  const [explicit, curated, cohu, pelco] =
+    browserCatalog().buildCatalogFromSources([
+      { id: 'explicit', lat: 47.7, lon: -122, fovDeg: 44, model: 'F4105-LRE' },
+      {
+        id: 'curated',
+        lat: 47.7,
+        lon: -122,
+        model: 'F4105-LRE',
+        poseSource: 'curated',
+      },
+      { id: 'cohu', lat: 47.7, lon: -122, model: '3950', manufacturer: 'Cohu' },
+      {
+        id: 'pelco',
+        lat: 47.7,
+        lon: -122,
+        model: '3950',
+        manufacturer: 'Pelco',
+      },
+    ]);
+  assert.equal(explicit.fovDeg, 44);
+  assert.equal(explicit.fovSource, undefined);
+  assert.equal(explicit.spec.model, 'F4105-LRE');
+  assert.equal(curated.fovDeg, 74);
+  assert.equal(curated.fovSource, undefined);
+  // The source's manufacturer reaches the lookup.
+  assert.equal(cohu.spec?.id, 'cohu-3950-iview');
+  assert.equal(pelco.spec, undefined);
+});
+
+test('the DATASHEET label drops once calibration moves the FOV', () => {
+  const camera = { fovSource: 'datasheet', fovDeg: 110 };
+  assert.equal(isDatasheetFov(camera), true);
+  assert.equal(isDatasheetFov({ ...camera, calibration: { fovDeg: 0 } }), true);
+  assert.equal(
+    isDatasheetFov({ ...camera, calibration: { fovDeg: 6 } }),
+    false,
+  );
+  assert.equal(isDatasheetFov({ fovDeg: 74 }), false);
+  assert.equal(isDatasheetFov(null), false);
+});
+
+test('specSummary renders the HUD line and degrades by omission', () => {
+  assert.equal(
+    specSummary(lookupModelSpec('Q6135-LE')),
+    'Axis Q6135-LE · 1080p · IR 250m · PTZ',
+  );
+  // No night vision / no PTZ → those segments are simply absent.
+  assert.equal(
+    specSummary({ brand: 'Axis', model: 'X', resolution: { label: '4K' } }),
+    'Axis X · 4K',
+  );
+  assert.equal(specSummary(null), '');
+});

src/layers/cctv/presentation.js

@@ -1,6 +1,11 @@
 import { CCTV_AMBIENT_CARD_MAX } from '../../data/cctvLod.js';
 import { ACTIVE_FRAME_REFRESH_MS, IDLE_FRAME_REFRESH_MS } from './policy.js';
 import { headingHudToken, isHeadingEstimated } from './headingConfidence.js';
+import {
+  specSummary,
+  specFovCapabilityToken,
+  isDatasheetFov,
+} from './modelSpecs.js';
 
 export function createPresentation({
   state: layerState,
@@ -39,7 +44,12 @@ export function createPresentation({
       // A synthetic bearing (headingConfidence 'low', no human calibration)
       // is tagged so a hashed guess never reads as a surveyed facing (#639).
       headingHudToken(active.camera),
-      `FOV ${Math.round(active.camera.fovDeg)}°`,
+      // Identified hardware labels its FOV as datasheet-sourced (catalog.js)
+      // only while no manual calibration offset has moved it.
+      `FOV ${Math.round(active.camera.fovDeg)}°${isDatasheetFov(active.camera) ? ' (DATASHEET)' : ''}`,
+      // A PTZ/varifocal datasheet range is what the lens can do, not its
+      // current zoom, so it is shown beside the estimate, never as it.
+      specFovCapabilityToken(active.camera),
       `COVERAGE ${area.toFixed(2)}km²`,
       overlapCount > 0 ? `OVERLAP ${overlapCount} cams` : 'ISOLATED VIEW',
       `PROJ ${layerState._showProjection ? 'MONITOR' : 'OFF'}`,
@@ -49,6 +59,10 @@ export function createPresentation({
         ? `SRC ${String(health.sourceKind).toUpperCase()}`
         : `SRC ${String(active.camera.feedType || 'image').toUpperCase()}`,
       `${viewBand.toUpperCase()} CONTEXT`,
+      // Identified hardware: append the model's datasheet specs + attribution.
+      active.camera.spec
+        ? `${specSummary(active.camera.spec).toUpperCase()} · SPECS: CCTV-DATABASE.COM`
+        : null,
     ]
       .filter(Boolean)
       .join(' · ');
@@ -86,6 +100,15 @@ export function createPresentation({
       headingEstimated: isHeadingEstimated(camera),
       pitchDeg: camera.pitchDeg,
       fovDeg: camera.fovDeg,
+      // Identified-hardware enrichment passthrough (catalog.js / modelSpecs.js).
+      fovSource: isDatasheetFov(camera)
+        ? 'datasheet'
+        : camera.fovSource === 'datasheet'
+          ? 'calibrated'
+          : camera.fovSource || 'estimated',
+      specFovMinDeg: camera.specFovMinDeg ?? null,
+      specFovMaxDeg: camera.specFovMaxDeg ?? null,
+      spec: camera.spec || null,
       rangeM: camera.rangeM,
       elevationM: camera.absoluteHeightM,
       mountHeightM: camera.mountHeightM,

src/layers/cctv/videoPlayback.js

@@ -1,3 +1,28 @@
+/**
+ * A v4 UUID for the client lease. `crypto.randomUUID` only exists in secure
+ * contexts, so a page opened over plain HTTP from another machine (the
+ * HOST=0.0.0.0 LAN opt-in) has none; `getRandomValues` exists in every context
+ * and yields the same shape the server's lease check accepts.
+ */
+export function createLeaseId(cryptoImpl = globalThis.crypto) {
+  if (typeof cryptoImpl.randomUUID === 'function') {
+    return cryptoImpl.randomUUID();
+  }
+  const bytes = cryptoImpl.getRandomValues(new Uint8Array(16));
+  bytes[6] = (bytes[6] & 0x0f) | 0x40;
+  bytes[8] = (bytes[8] & 0x3f) | 0x80;
+  const hex = Array.from(bytes, (byte) => byte.toString(16).padStart(2, '0'));
+  return [
+    hex.slice(0, 4),
+    hex.slice(4, 6),
+    hex.slice(6, 8),
+    hex.slice(8, 10),
+    hex.slice(10),
+  ]
+    .map((group) => group.join(''))
+    .join('-');
+}
+
 /** One decoder per active camera; both surfaces consume this video element. */
 export function attachCctvVideo(
   video,
@@ -7,13 +32,14 @@ export function attachCctvVideo(
     loadHls = () => import('hls.js'),
     onFailure = () => {},
     fetchImpl = globalThis.fetch,
+    cryptoImpl = globalThis.crypto,
   } = {},
 ) {
   // Preserve replay for existing finite video feeds; live HLS must not loop.
   video.loop = feedType !== 'hls';
   let disposed = false;
   let hls = null;
-  const leaseId = feedType === 'hls' ? globalThis.crypto.randomUUID() : null;
+  const leaseId = feedType === 'hls' ? createLeaseId(cryptoImpl) : null;
   const mediaUrl =
     feedType === 'hls'
       ? `${url}${url.includes('?') ? '&' : '?'}lease=${leaseId}`

src/layers/cctv/videoPlayback.test.mjs

@@ -1,6 +1,15 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
-import { attachCctvVideo } from './videoPlayback.js';
+import { webcrypto } from 'node:crypto';
+import { attachCctvVideo, createLeaseId } from './videoPlayback.js';
+
+const LEASE_V4 =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
+/** What an insecure context exposes: getRandomValues but no randomUUID. */
+const insecureCrypto = {
+  getRandomValues: (array) => webcrypto.getRandomValues(array),
+};
 function video() {
   const v = new EventTarget();
   Object.assign(v, {
@@ -69,6 +78,34 @@ test('native HLS releases its client lease without response-header access', asyn
   assert.equal(releases[0].init.method, 'DELETE');
 });
 
+test('lease ids are v4 UUIDs with or without crypto.randomUUID', () => {
+  assert.match(createLeaseId(), LEASE_V4);
+  const ids = new Set();
+  for (let i = 0; i < 64; i++) ids.add(createLeaseId(insecureCrypto));
+  assert.equal(ids.size, 64);
+  for (const id of ids) assert.match(id, LEASE_V4);
+});
+
+test('HLS starts on a plain-HTTP LAN page without crypto.randomUUID', async () => {
+  const source = video();
+  source.canPlayType = () => 'probably';
+  const playback = attachCctvVideo(source, '/api/cctv/media/a', 'hls', {
+    loadHls: async () => ({ default: { isSupported: () => false } }),
+    fetchImpl: async () => {},
+    cryptoImpl: insecureCrypto,
+  });
+  try {
+    await playback.ready;
+    const lease = new URL(
+      source.src,
+      'http://192.168.1.10:4173/',
+    ).searchParams.get('lease');
+    assert.match(lease, LEASE_V4);
+  } finally {
+    playback.dispose();
+  }
+});
+
 test('finite video feeds retain looping while live HLS does not loop', async () => {
   for (const feedType of ['mp4', 'webm', 'hls']) {
     const source = video();

src/layers/cyclones/index.js

@@ -386,6 +386,7 @@ export function createCyclonesLayer({
           })),
         },
         chips: [],
+        legendCategorical: true,
         legend: storm
           ? [
               { label: 'Advisory center / forecast track', color: '#7fe6ed' },

src/layers/directions/index.js

@@ -617,32 +617,11 @@ export function createDirectionsLayer({ services, source }) {
   }
 
   function pickGround(screenPosition) {
-    const scene = _viewer?.scene;
-    let cartesian = null;
-    if (
-      scene?.pickPositionSupported &&
-      typeof scene.pickPosition === 'function'
-    ) {
-      try {
-        cartesian = scene.pickPosition(screenPosition);
-      } catch {
-        cartesian = null;
-      }
-    }
-    if (
-      !services.scenePick.isPickedWorldPosition(cartesian) &&
-      typeof _viewer?.camera?.pickEllipsoid === 'function'
-    ) {
-      try {
-        cartesian = _viewer.camera.pickEllipsoid(
-          screenPosition,
-          Cesium.Ellipsoid.WGS84,
-        );
-      } catch {
-        cartesian = null;
-      }
-    }
-    if (!services.scenePick.isPickedWorldPosition(cartesian)) return null;
+    const cartesian = services.scenePick.pickGroundPosition(
+      _viewer,
+      screenPosition,
+    );
+    if (!cartesian) return null;
     const carto = Cesium.Cartographic.fromCartesian(cartesian);
     if (!carto) return null;
     return {

src/layers/flights/policy.js

@@ -7,6 +7,7 @@ export {
   ERROR_BACKOFF_INTERVAL,
 } from './recordPolicy.js';
 import * as Cesium from 'cesium';
+import { EMERGENCY_TINT_CSS } from '../../data/aircraftEmergency.js';
 
 export const FOCUS_EVIDENCE_DEV = import.meta.env?.DEV === true;
 
@@ -14,6 +15,11 @@ export const FOCUS_EVIDENCE_DEV = import.meta.env?.DEV === true;
 
 export const MIL_TINT = Cesium.Color.fromCssColorString('#FFB800');
 
+/** Red tint for aircraft broadcasting an emergency (7500/7600/7700 or ADS-B status). */
+
+export const EMERGENCY_TINT =
+  Cesium.Color.fromCssColorString(EMERGENCY_TINT_CSS);
+
 // --- Ground traffic (owner reversal 2026-07-03: "absolutely we should see planes
 // taxiing and landing") -----------------------------------------------------------
 // Present-but-grounded planes are RENDERED instead of being skipped: same class

src/layers/flights/queries.js

@@ -15,6 +15,7 @@ import {
   FOCUS_EVIDENCE_DEV,
   FLEET_DR_INTERVAL_MS,
 } from './policy.js';
+import { emergencyBroadcastPhrase } from '../../data/aircraftEmergency.js';
 
 export function createQueries({
   flightState,
@@ -167,6 +168,10 @@ export function createQueries({
         flightState.records.missingPolls.get(icao24) ||
         flightState.feed._backoff,
       ),
+      // This poll's transponder broadcast (not sticky; see records.js).
+      squawk: info?.squawk ?? null,
+      emergency: info?.emergency ? { ...info.emergency } : null,
+      emergencyBroadcast: emergencyBroadcastPhrase(info?.emergency),
       airline: info?.airline ?? null,
       // CLASS label follows the TR-3B conversion so every downstream card
       // (cockpit, Contacts, analyst) agrees with the triangle on screen.
@@ -219,7 +224,10 @@ export function createQueries({
    *   lon: number|null, altitudeM: number|null, speedMps: number|null,
    *   heading: number|null, verticalRateMps: number|null, onGround: boolean,
    *   military: boolean, aircraftClass: string|null, originCountry: string|null,
-   *   operator: string|null, routeOrigin: string|null, routeDestination: string|null}}
+   *   operator: string|null, squawk: string|null, emergency: boolean,
+   *   emergencyKind: string|null, emergencySource: 'squawk'|'ads-b'|null,
+   *   emergencyBroadcast: string|null, lastContactAtMs: number|null, routeOrigin: string|null,
+   *   routeDestination: string|null}}
    */
 
   function mapAnalystRecord(
@@ -253,6 +261,20 @@ export function createQueries({
       aircraftClass: tr3bAircraftClass(icao24, text(info?.klass)),
       originCountry: text(info?.originCountry),
       operator: text(info?.airline),
+      squawk: text(info?.squawk),
+      // True while this poll broadcast an emergency (7500/7600/7700 or the
+      // ADS-B status); priority statuses (lifeguard, minfuel) report the kind
+      // without the flag.
+      emergency: info?.emergency?.severity === 'emergency',
+      emergencyKind: text(info?.emergency?.kind),
+      // Provenance, so a summary can say "broadcasting squawk 7700" rather
+      // than "ADS-B reports general emergency" (or flatten both): 'squawk'
+      // when the Mode A code names the status, 'ads-b' for the readsb field.
+      emergencySource: text(info?.emergency?.source),
+      emergencyBroadcast: emergencyBroadcastPhrase(info?.emergency),
+      // Latest known general aircraft-message contact, retained if a poll
+      // has no time. This is not the receipt time of the current status.
+      lastContactAtMs: num(info?.lastContactEpochMs),
       routeOrigin: routeOk ? text(info?.route?.origin?.code) : null,
       routeDestination: routeOk ? text(info?.route?.destination?.code) : null,
     };

src/layers/flights/records.js

@@ -4,6 +4,7 @@ import {
   pickRenderAltitudeM,
 } from '../../data/renderAltitude.js';
 import { classifyAircraft } from '../../data/aircraftClass.js';
+import { aircraftEmergency } from '../../data/aircraftEmergency.js';
 import {
   approxDistanceKm,
   GROUND_FLOOR_CLAMP_RADIUS_KM,
@@ -226,6 +227,22 @@ export class FlightRecords {
       // like callsign so a transient blank row doesn't blank the field.
       originCountry:
         stickyText(origin_country, prevMeta?.originCountry) || null,
+      // Per poll, NOT sticky: an emergency code clears when the crew resets
+      // it, so a blank squawk must not hold a stale 7700 on screen.
+      squawk: observation.squawk ?? null,
+      // One source-switch omission may retain an ADS-B status, while an
+      // explicit clear or changed squawk always takes effect immediately.
+      emergency:
+        observation.emergency === undefined &&
+        observation.squawk === prevMeta?.squawk &&
+        prevMeta?.emergency?.source === 'ads-b' &&
+        (prevMeta?.missingEmergencyPolls ?? 0) < 1
+          ? prevMeta.emergency
+          : aircraftEmergency(observation),
+      missingEmergencyPolls:
+        observation.emergency === undefined
+          ? (prevMeta?.missingEmergencyPolls ?? 0) + 1
+          : 0,
       // OpenSky distinguishes the last position epoch from the last
       // transponder message. The fleet coast horizon uses this actual
       // contact time so a temporarily old position does not hard-freeze
@@ -258,10 +275,12 @@ export class FlightRecords {
     return { icao24, prevMeta, meta, groundFlipped, fixEpochMs };
   }
 
-  absence(id, { complete, likelyLanded }) {
-    // Partial admissions do not prove absence, but retention remains bounded.
+  absence(id, { complete, retainIds, likelyLanded }) {
+    // Partial admissions and position-less rows do not prove absence, but
+    // retention remains bounded; a likely-landed position-less contact
+    // still takes the landed limit.
     if (
-      !complete &&
+      (!complete || (retainIds?.has(id) && !likelyLanded)) &&
       Date.now() - (this.data.get(id)?.observedReceiptMs ?? 0) < 300000
     )
       return 'retain';

src/layers/flights/records.test.mjs

@@ -106,3 +106,37 @@ test('ground transitions preserve last render height while a surface cell is col
   assert.equal(next.meta.renderAltitudeM, 1040);
   assert.equal(next.meta.wasAirborne, true);
 });
+
+test('complete snapshots age out vanished aircraft and retain position-less ones unless landed', () => {
+  const store = records();
+  for (const id of ['abc123', 'def456', 'ghi789'])
+    store.receive(observation({ id, reference: id }), view());
+  // abc123 and ghi789 are still listed without a position; def456 vanished.
+  const absent = (id, likelyLanded = false) =>
+    store.absence(id, {
+      complete: true,
+      retainIds: new Set(['abc123', 'ghi789']),
+      likelyLanded,
+    });
+  assert.deepEqual(
+    [absent('def456'), absent('def456'), absent('def456')],
+    ['stale', 'stale', 'remove'],
+  );
+  assert.equal(absent('abc123'), 'retain');
+  assert.equal(store.missingPolls.has('abc123'), false);
+  // A landed contact that lost its position takes the landed fast-cull.
+  assert.equal(absent('ghi789', true), 'remove');
+  // Position-less retention stays bounded like partial admission.
+  store.data.get('abc123').observedReceiptMs = Date.now() - 300001;
+  assert.equal(absent('abc123'), 'stale');
+});
+
+test('civil emergency status follows the latest poll instead of sticking', () => {
+  const store = records();
+  const first = store.receive(observation({ squawk: '7700' }), view());
+  assert.equal(first.meta.squawk, '7700');
+  assert.equal(first.meta.emergency.kind, 'general');
+  const next = store.receive(observation({ squawk: '2000' }), view());
+  assert.equal(next.meta.squawk, '2000');
+  assert.equal(next.meta.emergency, null);
+});

src/layers/flights/rendering.js

@@ -3,6 +3,7 @@ import { cyberSonarBaseAlpha } from '../../cyberSonar.js';
 import { selectModelEligible } from '../../data/modelEligibility.js';
 import { civilAircraftModelSpec } from './modelSpec.js';
 import { CLASS_SCALE_2D } from '../../data/aircraftClass.js';
+import { isEmergency } from '../../data/aircraftEmergency.js';
 import { cockpitContactDotImage } from '../../data/cockpitContactDot.js';
 import { aircraftIcon, TRACKED_ICON_PX } from '../../data/aircraftIcons.js';
 import {
@@ -13,6 +14,7 @@ import {
 import { limitCourseStep, courseSlewCapDps } from '../../data/motionModel.js';
 import {
   MIL_TINT,
+  EMERGENCY_TINT,
   GROUND_SCALE,
   COCKPIT_CONTACT_SIZE_PX,
   COCKPIT_CIVILIAN_COLOR,
@@ -54,13 +56,34 @@ export function createRendering({
   const { applyAircraftBillboardTreatment, applyAircraftModelTreatment } =
     services.recession;
 
-  /** Fleet (untracked) billboard tint: amber for known-military, white otherwise.
+  /** True while this contact's latest poll broadcast an emergency code. */
+
+  function _isEmergency(icao24, info = flightState.records.data.get(icao24)) {
+    return isEmergency(info?.emergency);
+  }
+
+  /** Fleet (untracked) billboard tint: red while broadcasting an emergency,
+   *  amber for known-military, white otherwise.
    *  Ground traffic gets NO special tint (owner verdict 2026-07-03 field test). */
 
-  function _fleetBillboardColor(icao24) {
+  function _fleetBillboardColor(
+    icao24,
+    info = flightState.records.data.get(icao24),
+  ) {
+    if (_isEmergency(icao24, info)) return EMERGENCY_TINT;
     return isMilitaryIcao(icao24) ? MIL_TINT : Cesium.Color.WHITE;
   }
 
+  /** Cockpit far-contact dot tint: the emergency red outranks the category tint. */
+
+  function _cockpitContactColor(
+    icao24,
+    info = flightState.records.data.get(icao24),
+  ) {
+    if (_isEmergency(icao24, info)) return EMERGENCY_TINT;
+    return isMilitaryIcao(icao24) ? MIL_TINT : COCKPIT_CIVILIAN_COLOR;
+  }
+
   /** Fleet billboard scale: per-class scale, ×GROUND_SCALE while grounded. */
 
   function _fleetBillboardScale(icao24, klass) {
@@ -129,9 +152,7 @@ export function createRendering({
       bb.height = COCKPIT_CONTACT_SIZE_PX;
       bb.scale = limbScale;
       bb.scaleByDistance = _cockpitBillboardScaleByDistance();
-      bb.color = (
-        isMilitaryIcao(icao24) ? MIL_TINT : COCKPIT_CIVILIAN_COLOR
-      ).withAlpha(freshnessAlpha);
+      bb.color = _cockpitContactColor(icao24).withAlpha(freshnessAlpha);
       bb.rotation = 0;
       return;
     }
@@ -162,7 +183,7 @@ export function createRendering({
 
   function _modelColor(icao24) {
     if (icao24 === flightState._trackedIcao) return Cesium.Color.CYAN;
-    return isMilitaryIcao(icao24) ? MIL_TINT : Cesium.Color.WHITE;
+    return _fleetBillboardColor(icao24);
   }
 
   /** The FLEET's 3D-model regime: models3d enabled AND the camera zoomed in past the altitude
@@ -1009,10 +1030,8 @@ export function createRendering({
         flightState._cockpitNearContacts.has(icao24);
       const layerBaseColor =
         flightState._cockpitContactMode && !isCockpitNear
-          ? isMilitaryIcao(icao24)
-            ? MIL_TINT
-            : COCKPIT_CIVILIAN_COLOR
-          : _fleetBillboardColor(icao24);
+          ? _cockpitContactColor(icao24, info)
+          : _fleetBillboardColor(icao24, info);
       const baseColor = layerBaseColor;
       const treatment = applyAircraftBillboardTreatment({
         billboard: bb,

src/layers/flights/snapshotRenderer.js

@@ -243,6 +243,7 @@ export function createFlightSnapshotRenderer({
       if (currentIcaos.has(icao24)) continue;
       const absence = records.absence(icao24, {
         complete: snapshot.complete,
+        retainIds: snapshot.retainIds,
         likelyLanded: queries._likelyLanded(icao24),
       });
       if (absence === 'retain') continue;

src/layers/gnss/index.js

@@ -0,0 +1,422 @@
+import * as Cesium from 'cesium';
+import {
+  GNSS_LEVEL_COLORS,
+  GNSS_MIN_AIRCRAFT,
+  GNSS_WINDOW_MS,
+  accumulateGnssObservations,
+  binGnssCells,
+  gnssProvenance,
+  pruneGnssObservations,
+} from './records.js';
+export * from './records.js';
+export { createAdsbGnssSource } from './source.js';
+
+/**
+ * GroundPrimitive allowPicking:false suppresses ids but still submits stencil
+ * commands in Cesium's pick pass, erasing picks of overlapping ground geometry.
+ * This fill participates only in rendering, so sibling polygons remain pickable.
+ */
+class GnssGroundFill extends Cesium.GroundPrimitive {
+  update(frameState) {
+    if (!frameState.passes.pick) super.update(frameState);
+  }
+}
+
+/** Low stays visible over land so coverage reads apart from no data. */
+const FILL_ALPHA = Object.freeze({ low: 0.3, medium: 0.42, high: 0.55 });
+const LEVEL_LABELS = Object.freeze({
+  low: 'Low-accuracy score < 2%',
+  medium: 'Low-accuracy score 2–10%',
+  high: 'Low-accuracy score > 10%',
+});
+
+/** Degrees at the centre of the current view, or null before the camera settles. */
+export function defaultGnssViewAnchor(viewer) {
+  const canvas = viewer?.scene?.canvas;
+  const ellipsoid = viewer?.scene?.globe?.ellipsoid;
+  // At globe scale the visible rectangle can be the whole world, whose
+  // midpoint is unrelated to the place under the screen centre.
+  const centre =
+    canvas?.clientWidth > 0 &&
+    canvas.clientHeight > 0 &&
+    viewer.camera?.pickEllipsoid?.(
+      new Cesium.Cartesian2(canvas.clientWidth / 2, canvas.clientHeight / 2),
+      ellipsoid,
+    );
+  const rectangle =
+    !centre && viewer?.camera?.computeViewRectangle?.(ellipsoid);
+  const carto = centre
+    ? (ellipsoid || Cesium.Ellipsoid.WGS84).cartesianToCartographic(centre)
+    : rectangle
+      ? Cesium.Rectangle.center(rectangle)
+      : viewer?.camera?.positionCartographic;
+  if (!carto) return null;
+  const latitude = Cesium.Math.toDegrees(carto.latitude);
+  const longitude = Cesium.Math.toDegrees(carto.longitude);
+  return Number.isFinite(latitude) && Number.isFinite(longitude)
+    ? { latitude, longitude }
+    : null;
+}
+
+/**
+ * Own one GNSS navigation-integrity display: rolling integrity observations
+ * around the views the user visits, binned into cells coloured by the
+ * gpsjam low-accuracy score. Share links retain token 3.
+ */
+export function createGnssIntegrityLayer({
+  source,
+  viewAnchor = defaultGnssViewAnchor,
+  now = () => Date.now(),
+  monotonicNow = () => performance.now(),
+  windowMs = GNSS_WINDOW_MS,
+} = {}) {
+  if (typeof source?.getSnapshot !== 'function')
+    throw new TypeError('GNSS integrity layer requires a snapshot source');
+  let _viewer = null;
+  let _primitives = null;
+  let _request = null;
+  let _enabled = false;
+  let _cells = [];
+  let _signature = null;
+  let _lastUpdate = null;
+  let _lastError = null;
+  let _stale = false;
+  let _manager = null;
+  let _cameraTimer = null;
+  let _backgroundRefresh = null;
+  let _lastQueryKey = null;
+  let _lastRequestAt = -Infinity;
+  let _removeCameraEnd = null;
+  let _removeCameraChanged = null;
+  let _coverage = null;
+  let _retryTimer = null;
+  let _retryAt = 0;
+  let _failureCount = 0;
+  const _observations = new Map();
+  const provenance = gnssProvenance({ windowMs });
+
+  const queryKey = (anchor) =>
+    anchor
+      ? `${Math.round(anchor.latitude)},${Math.round(anchor.longitude)}`
+      : null;
+
+  function scheduleCameraRefresh() {
+    if (!_enabled || !_primitives) return;
+    if (now() < _retryAt) return;
+    const key = queryKey(viewAnchor(_viewer));
+    if (!key || key === _lastQueryKey) return;
+    clearTimeout(_cameraTimer);
+    // Debounce drags and bound moving/follow cameras to at most 24 requests
+    // per minute. Nearby views share the proxy's whole-degree cache key.
+    _cameraTimer = setTimeout(
+      async () => {
+        _cameraTimer = null;
+        if (!_enabled || _backgroundRefresh || _request) return;
+        const key = queryKey(viewAnchor(_viewer));
+        if (!key || key === _lastQueryKey) return;
+        await refreshInBackground();
+      },
+      Math.max(600, 2500 - (monotonicNow() - _lastRequestAt)),
+    );
+  }
+
+  async function refreshInBackground() {
+    if (!_enabled || _backgroundRefresh) return;
+    const controller = new AbortController();
+    _backgroundRefresh = controller;
+    try {
+      if (_manager)
+        await _manager.refreshLayer(layer.id, { signal: controller.signal });
+      else await layer.update(undefined, { signal: controller.signal });
+    } finally {
+      if (_backgroundRefresh === controller) {
+        _backgroundRefresh = null;
+        scheduleCameraRefresh();
+        scheduleRetry();
+      }
+    }
+  }
+
+  function scheduleRetry() {
+    clearTimeout(_retryTimer);
+    _retryTimer = null;
+    if (!_enabled || !_retryAt) return;
+    // Long provider cooldowns keep their full deadline. Browser timers cannot
+    // exceed ~24 days, so wake in bounded chunks without fetching early.
+    _retryTimer = setTimeout(
+      () => {
+        _retryTimer = null;
+        void refreshInBackground();
+      },
+      Math.min(2147483647, Math.max(0, _retryAt - now())),
+    );
+    _retryTimer?.unref?.();
+  }
+
+  /** Age the store without new evidence, so expired cells leave the globe. */
+  function expire() {
+    pruneGnssObservations(_observations, now(), { windowMs });
+    _cells = binGnssCells(_observations);
+    render();
+  }
+
+  function render() {
+    // Only the id and band change what is drawn; counts alone do not.
+    const signature = JSON.stringify(
+      _cells.map(({ id, level }) => [id, level]),
+    );
+    if (signature === _signature) return;
+    _signature = signature;
+    _primitives.removeAll();
+    if (_cells.length) {
+      _primitives.add(
+        new GnssGroundFill({
+          geometryInstances: _cells.map(
+            (cell) =>
+              new Cesium.GeometryInstance({
+                id: `${layer.id}:${cell.id}`,
+                geometry: new Cesium.RectangleGeometry({
+                  rectangle: Cesium.Rectangle.fromDegrees(
+                    cell.west,
+                    cell.south,
+                    cell.east,
+                    cell.north,
+                  ),
+                  vertexFormat: Cesium.PerInstanceColorAppearance.VERTEX_FORMAT,
+                }),
+                attributes: {
+                  color: Cesium.ColorGeometryInstanceAttribute.fromColor(
+                    Cesium.Color.fromCssColorString(
+                      GNSS_LEVEL_COLORS[cell.level],
+                    ).withAlpha(FILL_ALPHA[cell.level]),
+                  ),
+                },
+              }),
+          ),
+          appearance: new Cesium.PerInstanceColorAppearance({
+            flat: true,
+            translucent: true,
+          }),
+          classificationType: Cesium.ClassificationType.BOTH,
+          allowPicking: false,
+          // Retain the compact rectangle descriptors for inspection, not Entity visualizers.
+          releaseGeometryInstances: false,
+        }),
+      );
+    }
+    _viewer?.scene?.requestRender?.();
+  }
+
+  const layer = {
+    id: 'gnss-integrity',
+    name: 'GNSS Integrity',
+    icon: '📡',
+    source: 'adsb.lol',
+    /** Where each part of the method comes from; see records.js. */
+    provenance,
+    updateInterval: 60000,
+
+    attachDataManager(manager) {
+      _manager = manager;
+    },
+
+    init(viewer) {
+      if (_viewer)
+        throw new Error('GNSS integrity layer is already initialized');
+      _viewer = viewer;
+      _primitives = new Cesium.PrimitiveCollection();
+      _primitives.id = layer.id;
+      _primitives.show = false;
+      viewer.scene.groundPrimitives.add(_primitives);
+      _removeCameraEnd = viewer.camera?.moveEnd?.addEventListener(
+        scheduleCameraRefresh,
+      );
+      _removeCameraChanged = viewer.camera?.changed?.addEventListener(
+        scheduleCameraRefresh,
+      );
+    },
+
+    enable() {
+      _enabled = true;
+      // Cells left from before a long disable must not reappear past the window.
+      if (_primitives) {
+        expire();
+        _primitives.show = true;
+      }
+    },
+
+    disable() {
+      clearTimeout(_cameraTimer);
+      _cameraTimer = null;
+      clearTimeout(_retryTimer);
+      _retryTimer = null;
+      _backgroundRefresh?.abort();
+      _backgroundRefresh = null;
+      _request?.abort();
+      _request = null;
+      _enabled = false;
+      if (_primitives) _primitives.show = false;
+    },
+
+    async update(_viewerArg, { signal } = {}) {
+      if (!_enabled || !_primitives || signal?.aborted) return false;
+      if (now() < _retryAt) {
+        expire();
+        scheduleRetry();
+        return true;
+      }
+      _retryAt = 0;
+      clearTimeout(_retryTimer);
+      _retryTimer = null;
+      const anchor = viewAnchor(_viewer);
+      // No anchor yet (camera still settling) is not a failure: returning
+      // false would make the manager reject the enable. The next interval
+      // retries; cells already drawn still age out of the window.
+      if (!anchor) {
+        expire();
+        return true;
+      }
+      _request?.abort();
+      const request = new AbortController();
+      _request = request;
+      const onAbort = () => request.abort(signal.reason);
+      signal?.addEventListener('abort', onAbort, { once: true });
+      _lastQueryKey = queryKey(anchor);
+      _lastRequestAt = monotonicNow();
+      _coverage = {
+        kind: 'regional',
+        latitude: Math.round(anchor.latitude),
+        longitude: Math.round(anchor.longitude),
+        radiusNm: 250,
+      };
+      let received = false;
+      try {
+        const snapshot = await source.getSnapshot(anchor, {
+          signal: request.signal,
+        });
+        if (request.signal.aborted || _request !== request || !_enabled)
+          return false;
+        received = true;
+        // Date the rows by when the proxy observed them: a cached or stale
+        // replay keeps its original age instead of restarting the window.
+        // The proxy reports that age, so client and server clocks never mix.
+        const at = now();
+        accumulateGnssObservations(_observations, snapshot.rows, at, {
+          windowMs,
+          observedAt: at - snapshot.ageMs,
+        });
+        _cells = binGnssCells(_observations);
+        render();
+        _stale = snapshot.stale === true;
+        _lastUpdate = at - snapshot.ageMs;
+        _lastError = null;
+        _retryAt = 0;
+        _failureCount = 0;
+        return true;
+      } catch (e) {
+        if (request.signal.aborted || _request !== request || !_enabled)
+          return false;
+        // A renderer/programming failure remains a real lifecycle failure.
+        // Only acquisition failures are kept enabled for recovery.
+        if (received) throw e;
+        console.warn('[Data:GNSS] Fetch error:', e);
+        _lastError = e?.message || 'GNSS integrity source unavailable';
+        // Keep the last cells only while their evidence is inside the window.
+        expire();
+        if (e?.retryable === false) return false;
+        _failureCount = Math.min(3, _failureCount + 1);
+        const delay =
+          Number.isFinite(e?.retryAfterMs) && e.retryAfterMs > 0
+            ? e.retryAfterMs
+            : Math.min(120000, 30000 * 2 ** (_failureCount - 1));
+        _retryAt = Math.max(
+          _retryAt,
+          Math.min(Number.MAX_VALUE, now() + delay),
+        );
+        // Enabling the display succeeded. Stats still report an unavailable
+        // or degraded feed; the manager keeps its normal refresh failure lane.
+        return true;
+      } finally {
+        signal?.removeEventListener('abort', onAbort);
+        if (_request === request) _request = null;
+        scheduleCameraRefresh();
+        scheduleRetry();
+      }
+    },
+
+    destroy(viewer = _viewer) {
+      layer.disable();
+      _removeCameraEnd?.();
+      _removeCameraChanged?.();
+      _removeCameraEnd = null;
+      _removeCameraChanged = null;
+      _observations.clear();
+      _cells = [];
+      _signature = null;
+      if (_primitives) {
+        viewer.scene.groundPrimitives.remove(_primitives);
+        _primitives = null;
+      }
+      _viewer = null;
+      _lastUpdate = null;
+      _lastError = null;
+      _stale = false;
+      _coverage = null;
+      _retryAt = 0;
+      _failureCount = 0;
+      _lastQueryKey = null;
+      _manager = null;
+    },
+
+    getRowControls() {
+      return {
+        chips: [],
+        info:
+          'Regional sample · 250 nm radius · cells from visited views over 30 min' +
+          (_lastError && _retryAt
+            ? ` · ${_lastError} · Retrying automatically${
+                _retryAt <= 8640000000000000
+                  ? ` at ${new Date(_retryAt).toISOString().slice(11, 19)} UTC`
+                  : ' after provider cooldown'
+              }`
+            : ''),
+        infoTitle:
+          'Updates automatically after pan or zoom and once a minute. The public feed covers a 250-nautical-mile circle around the view centre; zooming out does not make it a worldwide snapshot. Blank cells are outside sampled coverage or have insufficient observations.',
+        legend: ['high', 'medium', 'low'].map((level, index) => ({
+          label: LEVEL_LABELS[level],
+          color: GNSS_LEVEL_COLORS[level],
+          count: _cells.filter((cell) => cell.level === level).length,
+          ...(index === 0
+            ? {
+                blurb: `Low-accuracy score = 100 × max(0, bad − 1) / total: one aircraft is discounted, so this is not the raw share. Cells need ${GNSS_MIN_AIRCRAFT} aircraft over ${provenance.window.minutes} minutes. Navigation-integrity anomalies are not a detection of jamming or spoofing.`,
+              }
+            : {}),
+        })),
+      };
+    },
+
+    getStats() {
+      return {
+        count: _cells.length,
+        levels: Object.fromEntries(
+          ['low', 'medium', 'high'].map((level) => [
+            level,
+            _cells.filter((cell) => cell.level === level).length,
+          ]),
+        ),
+        lastUpdate: _lastUpdate,
+        error: _lastError,
+        retryInSec: _retryAt
+          ? Math.max(0, Math.ceil((_retryAt - now()) / 1000))
+          : null,
+        stale: _stale,
+        provenance,
+        coverage: _coverage,
+        // Load-bearing: without an explicit boolean, layerFeedState reads the
+        // adsb.lol source name as a flights fallback (src/data/feedState.js).
+        fallback: false,
+      };
+    },
+  };
+  return layer;
+}

src/layers/gnss/ownership.test.mjs

@@ -0,0 +1,700 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import * as Cesium from 'cesium';
+import { createGnssIntegrityLayer, defaultGnssViewAnchor } from './index.js';
+import { LayerLifecycle } from '../../data/lifecycle.js';
+import { layerFeedState } from '../../data/feedState.js';
+
+const row = (hex, lat, degraded) => ({
+  hex,
+  lat,
+  lon: 30.2,
+  nic: degraded ? 0 : 8,
+  nacp: degraded ? 0 : 10,
+  gpsLost: false,
+  degraded,
+});
+
+function harness(
+  getSnapshot,
+  {
+    anchor: initialAnchor = { latitude: 50, longitude: 30 },
+    initialize = true,
+  } = {},
+) {
+  let anchor = initialAnchor;
+  const sources = [];
+  const viewer = {
+    camera: { moveEnd: new Cesium.Event(), changed: new Cesium.Event() },
+    scene: {
+      globe: { show: true },
+      groundPrimitives: {
+        add(value) {
+          sources.push(value);
+        },
+        remove(value) {
+          sources.splice(sources.indexOf(value), 1);
+          value.destroy();
+        },
+      },
+    },
+  };
+  let clock = 1_000;
+  const anchors = [];
+  const layer = createGnssIntegrityLayer({
+    // The real source refuses an undated snapshot; stubs default to a fresh one.
+    source: {
+      async getSnapshot(...args) {
+        const snapshot = await getSnapshot(...args);
+        return { ageMs: 0, ...snapshot };
+      },
+    },
+    viewAnchor: () => {
+      anchors.push(anchor);
+      return anchor;
+    },
+    now: () => clock,
+    monotonicNow: () => clock,
+  });
+  if (initialize) layer.init(viewer);
+  return {
+    layer,
+    sources,
+    anchors,
+    viewer,
+    advance(ms) {
+      clock += ms;
+    },
+    now: () => clock,
+    setAnchor(value) {
+      anchor = value;
+    },
+  };
+}
+
+const MIN = 60_000;
+const threeHealthy = () => [
+  row('a1', 1.1, false),
+  row('a2', 1.2, false),
+  row('a3', 1.3, false),
+];
+
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+test('a globe-wide rectangle uses the visible screen centre as the query anchor', () => {
+  const anchor = defaultGnssViewAnchor({
+    scene: {
+      canvas: { clientWidth: 1000, clientHeight: 800 },
+      globe: { ellipsoid: Cesium.Ellipsoid.WGS84 },
+    },
+    camera: {
+      pickEllipsoid(pixel) {
+        assert.deepEqual(pixel, new Cesium.Cartesian2(500, 400));
+        return Cesium.Cartesian3.fromDegrees(-97, 30);
+      },
+      computeViewRectangle: () => {
+        throw new Error('centre hit must not compute a rectangle');
+      },
+    },
+  });
+  assert.ok(Math.abs(anchor.latitude - 30) < 1e-8);
+  assert.ok(Math.abs(anchor.longitude + 97) < 1e-8);
+});
+
+test('pan and zoom refresh through the manager without toggling; nearby changes are coalesced', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout', 'setInterval'] });
+  let calls = 0;
+  const h = harness(
+    async () => {
+      calls++;
+      return { rows: threeHealthy() };
+    },
+    { initialize: false },
+  );
+  const manager = new LayerLifecycle(h.viewer);
+  manager.register(h.layer);
+  h.layer.attachDataManager(manager);
+  const changes = [];
+  manager.subscribe((change) => changes.push(change.type));
+  await manager.setEnabled(h.layer.id, true);
+  h.setAnchor({ latitude: 54, longitude: 19 });
+  h.viewer.camera.changed.raiseEvent();
+  h.setAnchor({ latitude: 55, longitude: 20 });
+  h.viewer.camera.moveEnd.raiseEvent();
+  h.advance(2500);
+  t.mock.timers.tick(2500);
+  await flush();
+  assert.equal(calls, 2, 'one initial read and one read for the latest view');
+  assert.deepEqual(h.anchors.at(-1), { latitude: 55, longitude: 20 });
+  assert.ok(changes.includes('refresh-transition'));
+  assert.ok(changes.includes('refresh'));
+  assert.equal(manager.isEnabled(h.layer.id), true);
+  assert.deepEqual(h.layer.getStats().coverage, {
+    kind: 'regional',
+    latitude: 55,
+    longitude: 20,
+    radiusNm: 250,
+  });
+  assert.match(h.layer.getRowControls().info, /Regional sample.*250 nm radius/);
+  h.setAnchor({ latitude: 55.1, longitude: 20.1 });
+  h.viewer.camera.changed.raiseEvent();
+  h.advance(5000);
+  t.mock.timers.tick(5000);
+  await flush();
+  assert.equal(calls, 2, 'nearby views reuse the same query region');
+  await manager.destroyAll();
+  assert.equal(h.viewer.camera.moveEnd.numberOfListeners, 0);
+  assert.equal(h.viewer.camera.changed.numberOfListeners, 0);
+});
+
+test('movement during a pending refresh follows up at the newest view; disable cancels queued work', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const calls = [];
+  let resolvePending;
+  const h = harness((anchor) => {
+    calls.push(anchor);
+    if (calls.length === 2)
+      return new Promise((resolve) => {
+        resolvePending = resolve;
+      });
+    return { rows: threeHealthy() };
+  });
+  h.layer.enable();
+  await h.layer.update();
+  h.setAnchor({ latitude: 54, longitude: 19 });
+  h.viewer.camera.moveEnd.raiseEvent();
+  h.advance(2500);
+  t.mock.timers.tick(2500);
+  await flush();
+  h.setAnchor({ latitude: 35, longitude: 140 });
+  h.viewer.camera.changed.raiseEvent();
+  h.advance(2500);
+  t.mock.timers.tick(2500);
+  await flush();
+  assert.equal(calls.length, 2, 'only one camera request in flight');
+  resolvePending({ rows: threeHealthy() });
+  await flush();
+  h.advance(600);
+  t.mock.timers.tick(600);
+  await flush();
+  assert.equal(calls.length, 3);
+  assert.deepEqual(calls.at(-1), { latitude: 35, longitude: 140 });
+  h.setAnchor({ latitude: 10, longitude: 10 });
+  h.viewer.camera.moveEnd.raiseEvent();
+  h.layer.disable();
+  h.advance(5000);
+  t.mock.timers.tick(5000);
+  await flush();
+  assert.equal(calls.length, 3, 'disable drains the camera timer');
+  h.layer.destroy();
+});
+
+test('the layer requires a snapshot source and cannot be initialized twice', () => {
+  assert.throws(() => createGnssIntegrityLayer({}), TypeError);
+  const { layer } = harness(async () => ({ rows: [] }));
+  assert.throws(() => layer.init({ dataSources: { add() {} } }), /already/);
+});
+
+test('an enabled refresh bins the snapshot into coloured ground cells', async () => {
+  const { layer, sources, anchors } = harness(async (anchor, { signal }) => {
+    assert.deepEqual(anchor, { latitude: 50, longitude: 30 });
+    assert.ok(signal instanceof AbortSignal);
+    return {
+      rows: [
+        row('a1', 50.1, true),
+        row('a2', 50.1, true),
+        row('a3', 50.2, false),
+        row('a4', 50.3, false),
+        row('b1', 55.1, false),
+      ],
+      stale: false,
+    };
+  });
+  assert.equal(await layer.update(), false, 'disabled layers do not fetch');
+  assert.equal(anchors.length, 0);
+  layer.enable();
+  assert.equal(sources[0].show, true);
+  assert.equal(await layer.update(), true);
+  const entities = sources[0].get(0).geometryInstances;
+  assert.equal(entities.length, 1, 'the one-aircraft cell is withheld');
+  assert.equal(entities[0].id, 'gnss-integrity:280:420');
+  assert.ok(entities[0].geometry instanceof Cesium.RectangleGeometry);
+  assert.equal(sources[0].get(0).allowPicking, false);
+  const stats = layer.getStats();
+  assert.equal(stats.count, 1);
+  assert.equal(stats.error, null);
+  assert.equal(stats.fallback, false);
+  const { legend } = layer.getRowControls();
+  assert.deepEqual(
+    legend.map(({ count }) => count),
+    [1, 0, 0],
+  );
+  assert.match(legend[0].blurb, /not a detection/);
+  assert.match(legend[0].blurb, /need 3 aircraft/);
+});
+
+test('the visible layer leads with low navigation accuracy and exposes its provenance', async () => {
+  const { layer } = harness(async () => ({ rows: [], stale: false }));
+  assert.equal(
+    layer.id,
+    'gnss-integrity',
+    'the unpublished id describes the measured state',
+  );
+  assert.equal(layer.name, 'GNSS Integrity');
+  assert.doesNotMatch(layer.name, /interference|jamming/i);
+  const { legend } = layer.getRowControls();
+  assert.deepEqual(
+    legend.map(({ label }) => label),
+    [
+      'Low-accuracy score > 10%',
+      'Low-accuracy score 2–10%',
+      'Low-accuracy score < 2%',
+    ],
+  );
+  const { blurb } = legend[0];
+  assert.match(blurb, /one aircraft is discounted/);
+  assert.match(blurb, /not the raw share/);
+  assert.match(blurb, /not a detection/);
+  assert.equal(layer.provenance.classifier.id, 'gev-nic-nacp-v2');
+  assert.equal(layer.provenance.classifier.definedBy, 'GEV');
+  assert.equal(layer.provenance.classifier.validated, false);
+  assert.equal(layer.provenance.aggregation.source, 'https://gpsjam.org/faq');
+  assert.deepEqual(layer.provenance.window, {
+    minutes: 30,
+    scope: 'visited-view',
+    cellDeg: 0.5,
+    minAircraft: 3,
+    definedBy: 'GEV',
+  });
+  assert.equal(layer.provenance.interpretation.validated, false);
+  assert.equal(layer.getStats().provenance, layer.provenance);
+});
+
+test('a failed refresh keeps the last cells and reports the error', async () => {
+  let fail = false;
+  const { layer, sources } = harness(async () => {
+    if (fail) throw new Error('adsb.lol HTTP 502');
+    return {
+      rows: [
+        row('a1', 1.1, false),
+        row('a2', 1.2, false),
+        row('a3', 1.3, false),
+      ],
+      stale: true,
+    };
+  });
+  layer.enable();
+  await layer.update();
+  assert.equal(layer.getStats().stale, true);
+  fail = true;
+  assert.equal(await layer.update(), true);
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 1);
+  assert.equal(layer.getStats().error, 'adsb.lol HTTP 502');
+  assert.equal(layer.getStats().count, 1);
+});
+
+test('observations expire with the window, and disable aborts the request in flight', async () => {
+  let pending;
+  const { layer, sources, advance } = harness(
+    (anchor, { signal }) =>
+      new Promise((resolve, reject) => {
+        pending = { resolve };
+        signal.addEventListener('abort', () => reject(signal.reason));
+      }),
+  );
+  layer.enable();
+  let result = layer.update();
+  pending.resolve({
+    rows: [row('a1', 1.1, false), row('a2', 1.2, false), row('a3', 1.3, false)],
+  });
+  assert.equal(await result, true);
+  assert.equal(layer.getStats().count, 1);
+
+  advance(31 * 60_000);
+  result = layer.update();
+  pending.resolve({ rows: [] });
+  assert.equal(await result, true);
+  assert.equal(layer.getStats().count, 0);
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 0);
+
+  result = layer.update();
+  layer.disable();
+  assert.equal(await result, false);
+  assert.equal(sources[0].show, false);
+});
+
+test('no view anchor means no request, and destroy releases the data source', async () => {
+  let calls = 0;
+  const { layer, sources } = harness(
+    async () => {
+      calls += 1;
+      return { rows: [] };
+    },
+    { anchor: null },
+  );
+  layer.enable();
+  assert.equal(
+    await layer.update(),
+    true,
+    'a settling camera is not a failure',
+  );
+  assert.equal(calls, 0);
+  assert.equal(layer.getStats().error, null);
+  layer.destroy();
+  assert.equal(sources.length, 0);
+  assert.equal(layer.getStats().count, 0);
+});
+
+test('a replayed stale snapshot keeps its observation age and expires on time', async () => {
+  // The proxy keeps answering with the snapshot it observed at t=1000.
+  const { layer, sources, advance, now } = harness(async () => ({
+    rows: threeHealthy(),
+    ageMs: now() - 1_000,
+    stale: true,
+  }));
+  layer.enable();
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 1);
+  advance(29 * MIN);
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 1);
+  advance(2 * MIN);
+  assert.equal(
+    await layer.update(),
+    true,
+    'the replay is not an error, only no evidence',
+  );
+  assert.equal(
+    layer.getStats().count,
+    0,
+    'the replay did not restart the window',
+  );
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 0);
+});
+
+test('cells expire during prolonged fetch failures', async () => {
+  let fail = false;
+  const { layer, sources, advance } = harness(async () => {
+    if (fail) throw new Error('adsb.lol HTTP 502');
+    return { rows: threeHealthy() };
+  });
+  layer.enable();
+  await layer.update();
+  fail = true;
+  advance(20 * MIN);
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 1, 'still inside the window');
+  advance(11 * MIN);
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 0);
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 0);
+  assert.equal(layer.getStats().error, 'adsb.lol HTTP 502');
+});
+
+test('cells expire while no view anchor is available', async () => {
+  let calls = 0;
+  const { layer, sources, advance, setAnchor } = harness(async () => {
+    calls += 1;
+    return { rows: threeHealthy() };
+  });
+  layer.enable();
+  await layer.update();
+  setAnchor(null);
+  advance(20 * MIN);
+  assert.equal(await layer.update(), true);
+  assert.equal(layer.getStats().count, 1);
+  advance(11 * MIN);
+  assert.equal(await layer.update(), true);
+  assert.equal(calls, 1, 'no anchor means no request');
+  assert.equal(layer.getStats().count, 0);
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 0);
+  assert.equal(layer.getStats().error, null);
+});
+
+test('re-enabling after a long disable does not show cells past the window', async () => {
+  const { layer, sources, advance } = harness(async () => ({
+    rows: threeHealthy(),
+  }));
+  layer.enable();
+  await layer.update();
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 1);
+  layer.disable();
+  advance(31 * MIN);
+  layer.enable();
+  assert.equal(layer.getStats().count, 0);
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 0);
+});
+
+const threeCells = () => ({
+  rows: [row('a1', 50.1, true), row('a2', 50.1, true), row('a3', 50.2, false)],
+});
+
+test('an identical snapshot leaves the drawn entities untouched', async () => {
+  const { layer, sources } = harness(async () => threeCells());
+  layer.enable();
+  await layer.update();
+  const first = sources[0].get(0);
+  await layer.update();
+  assert.equal(sources[0].get(0)?.geometryInstances.length ?? 0, 1);
+  assert.equal(sources[0].get(0), first);
+});
+
+test('an initial feed failure stays enabled, reports unavailable, and recovers automatically', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout', 'setInterval'] });
+  let calls = 0;
+  const h = harness(
+    async () => {
+      calls++;
+      if (calls === 1) throw new Error('adsb.lol HTTP 502');
+      return { rows: threeHealthy() };
+    },
+    { initialize: false },
+  );
+  const manager = new LayerLifecycle(h.viewer);
+  manager.register(h.layer);
+  h.layer.attachDataManager(manager);
+  const changes = [];
+  manager.subscribe((c) => changes.push(c.type));
+  assert.equal(await manager.setEnabled(h.layer.id, true), true);
+  assert.equal(manager.isEnabled(h.layer.id), true);
+  assert.equal(layerFeedState(h.layer.getStats()), 'unavailable');
+  assert.equal(h.layer.getStats().retryInSec, 30);
+  assert.match(
+    h.layer.getRowControls().info,
+    /HTTP 502.*Retrying automatically at/,
+  );
+  assert.equal(changes.includes('visibility-failed'), false);
+  assert.equal(
+    await manager.refreshLayer(h.layer.id),
+    false,
+    'feed remains honestly unhealthy during cooldown',
+  );
+  assert.equal(calls, 1, 'a manual refresh cannot bypass cooldown');
+  h.advance(30000);
+  t.mock.timers.tick(30000);
+  await flush();
+  assert.equal(calls, 2);
+  assert.equal(manager.isEnabled(h.layer.id), true);
+  assert.equal(layerFeedState(h.layer.getStats()), 'nominal');
+  assert.equal(h.layer.getStats().count, 1);
+  assert.equal(h.layer.getStats().retryInSec, null);
+  assert.doesNotMatch(h.layer.getRowControls().info, /Retrying/);
+  await manager.destroyAll();
+});
+
+test('provider cooldown is preserved across movement and toggling; disable cancels retry work', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const h = harness(async () => {
+    calls++;
+    if (calls === 1)
+      throw Object.assign(new Error('Rate limited (HTTP 429)'), {
+        retryAfterMs: 3600000,
+      });
+    return { rows: threeHealthy() };
+  });
+  h.layer.enable();
+  await h.layer.update();
+  h.setAnchor({ latitude: 10, longitude: 20 });
+  h.viewer.camera.moveEnd.raiseEvent();
+  h.advance(30000);
+  t.mock.timers.tick(30000);
+  await flush();
+  await h.layer.update();
+  assert.equal(calls, 1);
+  assert.equal(h.layer.getStats().retryInSec, 3570);
+  h.layer.disable();
+  h.advance(30000);
+  t.mock.timers.tick(30000);
+  await flush();
+  h.layer.enable();
+  await h.layer.update();
+  assert.equal(calls, 1, 'reenabling does not erase a provider deadline');
+  h.advance(3540000);
+  t.mock.timers.tick(3540000);
+  await flush();
+  assert.equal(calls, 2);
+  assert.deepEqual(h.anchors.at(-1), { latitude: 10, longitude: 20 });
+  h.layer.destroy();
+
+  const stopped = harness(async () => {
+    throw new Error('network unavailable');
+  });
+  stopped.layer.enable();
+  await stopped.layer.update();
+  stopped.layer.disable();
+  stopped.advance(30000);
+  t.mock.timers.tick(30000);
+  await flush();
+  assert.equal(stopped.anchors.length, 1, 'disabled layers do not retry');
+  stopped.layer.destroy();
+});
+
+test('repeated acquisition failures back off, while genuine non-retryable failures reject startup', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const h = harness(async () => {
+    calls++;
+    throw new Error('network unavailable');
+  });
+  h.layer.enable();
+  await h.layer.update();
+  assert.equal(h.layer.getStats().retryInSec, 30);
+  h.advance(30000);
+  t.mock.timers.tick(30000);
+  await flush();
+  assert.equal(h.layer.getStats().retryInSec, 60);
+  h.advance(60000);
+  t.mock.timers.tick(60000);
+  await flush();
+  assert.equal(h.layer.getStats().retryInSec, 120);
+  assert.equal(calls, 3);
+  h.layer.destroy();
+  const fatal = harness(async () => {
+    throw Object.assign(new Error('invalid request (HTTP 400)'), {
+      retryable: false,
+    });
+  });
+  fatal.layer.enable();
+  assert.equal(await fatal.layer.update(), false);
+  assert.equal(fatal.layer.getStats().retryInSec, null);
+  fatal.layer.destroy();
+});
+
+test('GERMAN: stale snapshot keeps the source observation age in row stats', async () => {
+  const h = harness(async () => ({
+    rows: threeHealthy(),
+    ageMs: 120000,
+    stale: true,
+  }));
+  h.layer.enable();
+  await h.layer.update();
+  assert.equal(h.layer.getStats().lastUpdate, h.now() - 120000);
+  h.layer.destroy();
+});
+
+test('GERMAN: camera debounce and minimum request gap are pinned', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const h = harness(async () => {
+    calls++;
+    return { rows: [] };
+  });
+  h.layer.enable();
+  await h.layer.update();
+  h.setAnchor({ latitude: 51, longitude: 31 });
+  h.viewer.camera.changed.raiseEvent();
+  h.advance(2499);
+  t.mock.timers.tick(2499);
+  await flush();
+  assert.equal(calls, 1);
+  h.advance(1);
+  t.mock.timers.tick(1);
+  await flush();
+  assert.equal(calls, 2);
+  h.advance(3000);
+  h.setAnchor({ latitude: 52, longitude: 32 });
+  h.viewer.camera.changed.raiseEvent();
+  h.advance(599);
+  t.mock.timers.tick(599);
+  await flush();
+  assert.equal(calls, 2);
+  h.advance(1);
+  t.mock.timers.tick(1);
+  await flush();
+  assert.equal(calls, 3);
+  h.layer.destroy();
+});
+
+test('camera movement during initial activation waits for acquisition before following up', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const calls = [];
+  let resolve;
+  const h = harness((anchor) => {
+    calls.push(anchor);
+    return calls.length === 1
+      ? new Promise((r) => (resolve = r))
+      : Promise.resolve({ rows: threeHealthy() });
+  });
+  h.layer.enable();
+  const initial = h.layer.update();
+  h.setAnchor({ latitude: 51, longitude: 31 });
+  h.viewer.camera.changed.raiseEvent();
+  h.advance(2500);
+  t.mock.timers.tick(2500);
+  await flush();
+  assert.equal(calls.length, 1);
+  resolve({ rows: threeHealthy() });
+  assert.equal(await initial, true);
+  h.advance(600);
+  t.mock.timers.tick(600);
+  await flush();
+  assert.equal(calls.length, 2);
+  h.layer.destroy();
+});
+
+test('monotonic camera scheduling is unaffected by wall-clock rollback', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const h = harness(async () => ({ rows: [] }));
+  h.layer.destroy();
+  let wall = 1800000000000,
+    mono = 0,
+    anchor = { latitude: 50, longitude: 30 },
+    calls = 0;
+  const layer = createGnssIntegrityLayer({
+    source: {
+      getSnapshot: async () => {
+        calls++;
+        return { rows: [], ageMs: 0 };
+      },
+    },
+    viewAnchor: () => anchor,
+    now: () => wall,
+    monotonicNow: () => mono,
+  });
+  layer.init(h.viewer);
+  layer.enable();
+  await layer.update();
+  wall -= 3600000;
+  mono = 3000;
+  anchor = { latitude: 51, longitude: 31 };
+  h.viewer.camera.changed.raiseEvent();
+  mono += 600;
+  t.mock.timers.tick(600);
+  await flush();
+  assert.equal(calls, 2);
+  layer.destroy();
+});
+
+test('GNSS fill emits no pick-pass commands but keeps normal rendering', async (t) => {
+  const h = harness(async () => ({ rows: threeHealthy() }));
+  h.layer.enable();
+  await h.layer.update();
+  const fill = h.sources[0].get(0);
+  let updates = 0;
+  t.mock.method(Cesium.GroundPrimitive.prototype, 'update', () => updates++);
+  fill.update({ passes: { pick: true } });
+  assert.equal(updates, 0);
+  fill.update({ passes: { render: true, pick: false } });
+  assert.equal(updates, 1);
+  h.layer.destroy();
+  assert.equal(fill.isDestroyed(), true);
+});
+
+test('view anchor falls back to rectangle, then nadir, then no camera', () => {
+  assert.equal(defaultGnssViewAnchor({}), null);
+  const viewer = {
+    camera: {
+      computeViewRectangle: () => Cesium.Rectangle.fromDegrees(20, 40, 22, 42),
+    },
+  };
+  const rectangleAnchor = defaultGnssViewAnchor(viewer);
+  assert.ok(Math.abs(rectangleAnchor.latitude - 41) < 1e-10);
+  assert.ok(Math.abs(rectangleAnchor.longitude - 21) < 1e-10);
+  viewer.camera = {
+    positionCartographic: Cesium.Cartographic.fromDegrees(21, 41),
+  };
+  const nadirAnchor = defaultGnssViewAnchor(viewer);
+  assert.ok(Math.abs(nadirAnchor.latitude - 41) < 1e-10);
+  assert.ok(Math.abs(nadirAnchor.longitude - 21) < 1e-10);
+});

src/layers/gnss/records.js

@@ -0,0 +1,318 @@
+/**
+ * Low navigation accuracy reported by ADS-B aircraft, binned into cells.
+ *
+ * Aircraft broadcasting DO-260 version 1/2 ADS-B report how much they trust
+ * their own position: NIC (integrity containment radius) and NACp (position
+ * accuracy). A cluster of aircraft reporting low values in one area is a
+ * navigation-integrity anomaly. Jamming or spoofing is one common cause, so
+ * such clusters are a well-known public proxy for GNSS interference, but
+ * avionics faults and old transponders also report low values: suspected
+ * interference is a second, unvalidated interpretation, never the primary
+ * state.
+ *
+ * Three separately sourced parts make up the method (see `gnssProvenance`):
+ * - Per-aircraft classifier, defined by GEV: aircraft-reported NIC < 7
+ *   (except unknown NIC 0 with NACp >= 10) or NACp < 8 (borrowed
+ *   from the US 14 CFR 91.227(c) ADS-B Out performance minima, which are not
+ *   a published interference classifier) or the readsb/tar1090 `gpsOkBefore`
+ *   flag. gpsjam.org does not publish its per-aircraft threshold.
+ * - Cell aggregation: gpsjam.org's published formula and 2% / 10% bands.
+ * - Window: a GEV-defined rolling 30 minutes over the views the user visits.
+ */
+
+/** Position source can switch to MLAT after GPS loss; quality must remain aircraft-reported. */
+const QUALIFYING_TYPES = new Set(['adsb_icao', 'mlat']);
+/** Restrict to decoded DO-260A/B quality fields; readsb does not decode v3 quality as v3. */
+const QUALIFYING_VERSIONS = new Set([1, 2]);
+/** NIC below 7: containment radius of 0.2 NM or more (below the US 91.227 ADS-B Out minimum). GEV threshold. */
+export const GNSS_NIC_THRESHOLD = 7;
+/** NACp below 8: position uncertainty of 93 m or more (below the US 91.227 minimum). GEV threshold. */
+export const GNSS_NACP_THRESHOLD = 8;
+/** Positions older than this are not current evidence of the local sky. */
+const MAX_POSITION_AGE_S = 60;
+/** Cell edge in degrees: roughly 55 km north-south, similar in area to an H3 res-4 cell. */
+export const GNSS_CELL_DEG = 0.5;
+/** Hide sparse one- and two-aircraft cells; the aggregation separately discounts one bad report. */
+export const GNSS_MIN_AIRCRAFT = 3;
+/** Rolling window over which aircraft seen in a cell are counted. */
+export const GNSS_WINDOW_MS = 30 * 60_000;
+/** gpsjam.org band edges, in percent of aircraft (after discounting one). */
+export const GNSS_MEDIUM_PERCENT = 2;
+export const GNSS_HIGH_PERCENT = 10;
+
+/** Primary cell state: what the data shows (low navigation accuracy). */
+export const GNSS_ANOMALY_STATE = 'navigation-integrity-anomaly';
+export const GNSS_NOMINAL_STATE = 'nominal';
+/** Secondary, unvalidated reading of an anomaly cell. */
+export const GNSS_INTERPRETATION = 'suspected-gnss-interference';
+
+/** The per-aircraft rule; GEV-defined and not validated against known events. */
+export const GNSS_CLASSIFIER = Object.freeze({
+  id: 'gev-nic-nacp-v2',
+  rule: `gpsOkBefore set || aircraft-reported NACp < ${GNSS_NACP_THRESHOLD} || (aircraft-reported NIC < ${GNSS_NIC_THRESHOLD} && !(NIC === 0 && NACp >= 10))`,
+  basis: '14 CFR 91.227(c) ADS-B Out performance minima (US regulation)',
+  definedBy: 'GEV',
+  validated: false,
+});
+
+/**
+ * Machine-readable provenance of the cell output: which part of the method
+ * comes from where, and which parts are unvalidated.
+ *
+ * @param {{windowMs?: number}} [options] The window the layer actually uses.
+ */
+export function gnssProvenance({ windowMs = GNSS_WINDOW_MS } = {}) {
+  return Object.freeze({
+    classifier: GNSS_CLASSIFIER,
+    aggregation: Object.freeze({
+      id: 'gpsjam-cell-bands',
+      formula: '100 * max(0, bad - 1) / total',
+      bands: Object.freeze([GNSS_MEDIUM_PERCENT, GNSS_HIGH_PERCENT]),
+      source: 'https://gpsjam.org/faq',
+      definedBy: 'gpsjam.org',
+    }),
+    window: Object.freeze({
+      minutes: windowMs / 60_000,
+      scope: 'visited-view',
+      cellDeg: GNSS_CELL_DEG,
+      minAircraft: GNSS_MIN_AIRCRAFT,
+      definedBy: 'GEV',
+    }),
+    state: Object.freeze({
+      id: GNSS_ANOMALY_STATE,
+      meaning: 'low navigation accuracy reported by ADS-B aircraft',
+    }),
+    interpretation: Object.freeze({
+      id: GNSS_INTERPRETATION,
+      validated: false,
+      note: 'one possible cause of an anomaly cell; avionics faults also report low values',
+    }),
+  });
+}
+
+/** Provenance at the default window. */
+export const GNSS_PROVENANCE = gnssProvenance();
+
+const HEX_PATTERN = /^~?[0-9a-f]{6}$/;
+
+const finite = (value) => typeof value === 'number' && Number.isFinite(value);
+
+/**
+ * Reduce one adsb.lol / readsb `aircraft.json`-style payload to the integrity
+ * facts the layer needs. Returns null when the payload has no aircraft array.
+ *
+ * @param {{ac?: object[], now?: number}} payload - readsb-style snapshot.
+ * @returns {{hex: string, lat: number, lon: number, nic: number|null, nacp: number|null, gpsLost: boolean, degraded: boolean}[]|null}
+ */
+export function normalizeGnssAircraft(payload) {
+  if (!Array.isArray(payload?.ac)) return null;
+  const rows = [];
+  const seen = new Set();
+  for (const aircraft of payload.ac) {
+    if (!aircraft || typeof aircraft !== 'object') continue;
+    const hex = typeof aircraft.hex === 'string' ? aircraft.hex : '';
+    if (!HEX_PATTERN.test(hex) || seen.has(hex)) continue;
+    if (!QUALIFYING_TYPES.has(aircraft.type)) continue;
+    if (!QUALIFYING_VERSIONS.has(aircraft.version)) continue;
+    if (aircraft.alt_baro === 'ground' || !finite(aircraft.alt_baro)) continue;
+    let { lat, lon } = aircraft;
+    const derived = (field) =>
+      aircraft.tisb?.includes(field) || aircraft.mlat?.includes(field);
+    const nic = finite(aircraft.nic) && !derived('nic') ? aircraft.nic : null;
+    const nacp =
+      finite(aircraft.nac_p) && !derived('nac_p') ? aircraft.nac_p : null;
+    if (!finite(lat) || Math.abs(lat) > 90) continue;
+    if (!finite(lon) || Math.abs(lon) > 180) continue;
+    // Only a position confirmed within the last minute is current evidence; a
+    // missing, invalid or negative age confirms nothing.
+    const age = aircraft.seen_pos;
+    if (!finite(age) || age < 0 || age > MAX_POSITION_AGE_S) continue;
+    // readsb exposes the flag while GPS is lost (15 s–15 min after the
+    // last good position), and removes it on recovery. Locate that evidence
+    // at the last good GNSS position, rather than a later MLAT estimate.
+    const gpsLost = finite(aircraft.gpsOkBefore) && aircraft.gpsOkBefore > 0;
+    if (nic === null && nacp === null && !gpsLost) continue;
+    if (
+      gpsLost &&
+      finite(aircraft.gpsOkLat) &&
+      Math.abs(aircraft.gpsOkLat) <= 90 &&
+      finite(aircraft.gpsOkLon) &&
+      Math.abs(aircraft.gpsOkLon) <= 180
+    ) {
+      lat = aircraft.gpsOkLat;
+      lon = aircraft.gpsOkLon;
+    }
+    seen.add(hex);
+    rows.push({
+      hex,
+      lat,
+      lon,
+      nic,
+      nacp,
+      gpsLost,
+      degraded:
+        gpsLost ||
+        (nacp !== null && nacp < GNSS_NACP_THRESHOLD) ||
+        (nic !== null &&
+          nic < GNSS_NIC_THRESHOLD &&
+          !(nic === 0 && nacp !== null && nacp >= 10)),
+    });
+  }
+  return rows;
+}
+
+/** Stable key of the cell containing a position. */
+export function gnssCellKey(lat, lon, cellDeg = GNSS_CELL_DEG) {
+  const row = Math.floor((Math.min(lat, 89.999999) + 90) / cellDeg);
+  const col = Math.floor((Math.min(lon, 179.999999) + 180) / cellDeg);
+  return `${row}:${col}`;
+}
+
+/**
+ * Fold one snapshot into a rolling observation store. Each aircraft counts
+ * once per cell per window. Presence and degraded evidence age separately: a
+ * degraded report keeps the aircraft degraded in that cell for one window
+ * after the report itself, however many healthy reports follow, so an
+ * aircraft that loses GNSS mid-cell is not averaged away and a recovered one
+ * is not held degraded forever.
+ *
+ * Every row is dated by when the snapshot was observed, not when it arrived:
+ * replaying a cached or stale snapshot never makes its evidence younger, and
+ * a snapshot older than the window adds nothing.
+ *
+ * @param {Map<string, {cell: string, seenAt: number, degradedAt: number|null}>} store
+ * @param {ReturnType<typeof normalizeGnssAircraft>} rows
+ * @param {number} nowMs
+ * @param {{windowMs?: number, cellDeg?: number, observedAt?: number}} [options]
+ *   `observedAt` is the snapshot's observation time (defaults to `nowMs`;
+ *   a future time is clamped to `nowMs`, a non-finite one adds nothing).
+ * @returns {Map} The same store, pruned to the window.
+ */
+export function accumulateGnssObservations(
+  store,
+  rows,
+  nowMs,
+  {
+    windowMs = GNSS_WINDOW_MS,
+    cellDeg = GNSS_CELL_DEG,
+    observedAt = nowMs,
+  } = {},
+) {
+  const at = Number.isFinite(observedAt) ? Math.min(observedAt, nowMs) : NaN;
+  if (Number.isFinite(at) && nowMs - at <= windowMs) {
+    for (const row of rows || []) {
+      if (!Number.isFinite(row?.lat) || !Number.isFinite(row?.lon)) continue;
+      const cell = gnssCellKey(row.lat, row.lon, cellDeg);
+      const key = `${row.hex}|${cell}`;
+      const previous = store.get(key);
+      const previousDegradedAt = previous?.degradedAt ?? null;
+      store.set(key, {
+        cell,
+        seenAt: Math.max(previous?.seenAt ?? at, at),
+        degradedAt: row.degraded
+          ? Math.max(previousDegradedAt ?? at, at)
+          : previousDegradedAt,
+      });
+    }
+  }
+  return pruneGnssObservations(store, nowMs, { windowMs });
+}
+
+/**
+ * Drop observations older than the window and degraded evidence older than
+ * the window, without adding anything. Used when no fresh snapshot arrives.
+ *
+ * @param {Map<string, {cell: string, seenAt: number, degradedAt: number|null}>} store
+ * @param {number} nowMs
+ * @param {{windowMs?: number}} [options]
+ * @returns {Map} The same store.
+ */
+export function pruneGnssObservations(
+  store,
+  nowMs,
+  { windowMs = GNSS_WINDOW_MS } = {},
+) {
+  for (const [key, entry] of store) {
+    if (nowMs - entry.seenAt > windowMs) store.delete(key);
+    else if (entry.degradedAt != null && nowMs - entry.degradedAt > windowMs)
+      store.set(key, { ...entry, degradedAt: null });
+  }
+  return store;
+}
+
+/**
+ * Navigation-integrity level of a cell, using gpsjam.org's published cell
+ * formula and bands: the first degraded aircraft is discounted to limit false
+ * positives, then under 2% is low, 2–10% medium and over 10% high. Medium and
+ * high cells are navigation-integrity anomalies.
+ */
+export function gnssIntegrityLevel(total, degraded) {
+  const percent = total > 0 ? (100 * Math.max(0, degraded - 1)) / total : 0;
+  const level =
+    percent > GNSS_HIGH_PERCENT
+      ? 'high'
+      : percent >= GNSS_MEDIUM_PERCENT
+        ? 'medium'
+        : 'low';
+  const anomaly = level !== 'low';
+  return {
+    percent,
+    level,
+    state: anomaly ? GNSS_ANOMALY_STATE : GNSS_NOMINAL_STATE,
+    interpretation: anomaly ? GNSS_INTERPRETATION : null,
+  };
+}
+
+/**
+ * Aggregate the observation store into displayable cells. Expects a store
+ * already pruned to the window by `accumulateGnssObservations` or
+ * `pruneGnssObservations`.
+ *
+ * @returns {{id: string, south: number, west: number, north: number, east: number, lat: number, lon: number, aircraft: number, degraded: number, percentDegraded: number, level: 'low'|'medium'|'high', state: string, interpretation: string|null}[]}
+ */
+export function binGnssCells(
+  store,
+  { cellDeg = GNSS_CELL_DEG, minAircraft = GNSS_MIN_AIRCRAFT } = {},
+) {
+  const tallies = new Map();
+  for (const { cell, degradedAt } of store.values()) {
+    const tally = tallies.get(cell) || { aircraft: 0, degraded: 0 };
+    tally.aircraft += 1;
+    if (degradedAt != null) tally.degraded += 1;
+    tallies.set(cell, tally);
+  }
+  const cells = [];
+  for (const [id, { aircraft, degraded }] of tallies) {
+    if (aircraft < minAircraft) continue;
+    const [row, col] = id.split(':').map(Number);
+    const south = row * cellDeg - 90;
+    const west = col * cellDeg - 180;
+    const { percent, level, state, interpretation } = gnssIntegrityLevel(
+      aircraft,
+      degraded,
+    );
+    cells.push({
+      id,
+      south,
+      west,
+      north: south + cellDeg,
+      east: west + cellDeg,
+      lat: south + cellDeg / 2,
+      lon: west + cellDeg / 2,
+      aircraft,
+      degraded,
+      percentDegraded: Math.round(percent * 10) / 10,
+      level,
+      state,
+      interpretation,
+    });
+  }
+  return cells.sort((a, b) => a.id.localeCompare(b.id));
+}
+
+/** Legend colors: gpsjam's green / amber / red convention. */
+export const GNSS_LEVEL_COLORS = Object.freeze({
+  low: '#3fb950',
+  medium: '#e3b341',
+  high: '#f85149',
+});

src/layers/gnss/records.test.mjs

@@ -0,0 +1,491 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  accumulateGnssObservations,
+  binGnssCells,
+  GNSS_CLASSIFIER,
+  GNSS_PROVENANCE,
+  GNSS_WINDOW_MS,
+  gnssCellKey,
+  gnssIntegrityLevel,
+  gnssProvenance,
+  normalizeGnssAircraft,
+  pruneGnssObservations,
+} from './records.js';
+
+const aircraft = (overrides = {}) => ({
+  hex: '4ca7b5',
+  type: 'adsb_icao',
+  version: 2,
+  alt_baro: 36000,
+  lat: 50.1,
+  lon: 19.9,
+  nic: 8,
+  nac_p: 10,
+  seen_pos: 1.2,
+  ...overrides,
+});
+
+test('normalization keeps airborne decoded ADS-B v1/v2 quality with current positions', () => {
+  const rows = normalizeGnssAircraft({
+    ac: [
+      aircraft(),
+      aircraft({
+        hex: '000001',
+        type: 'mlat',
+        nic: undefined,
+        nac_p: undefined,
+      }),
+      aircraft({ hex: '000002', type: 'tisb_icao' }),
+      aircraft({ hex: '000003', version: 0 }),
+      aircraft({ hex: '000004', alt_baro: 'ground' }),
+      aircraft({ hex: '000005', seen_pos: 120 }),
+      aircraft({ hex: '000006', nic: undefined, nac_p: undefined }),
+      aircraft({ hex: '000007', lat: 95 }),
+      aircraft({ hex: '000008', version: undefined }),
+      // Only DO-260A/B (versions 1 and 2) define NIC and NACp.
+      aircraft({ hex: '000009', version: 3 }),
+      aircraft({ hex: '00000a', version: '2' }),
+      aircraft({ hex: '00000b', version: 1.5 }),
+      // A position is current only when its age is known, finite and 0..60 s.
+      aircraft({ hex: '00000c', seen_pos: undefined }),
+      aircraft({ hex: '00000d', seen_pos: null }),
+      aircraft({ hex: '00000e', seen_pos: -0.5 }),
+      aircraft({ hex: '00000f', seen_pos: '1.2' }),
+      aircraft({ hex: '000010', seen_pos: Number.NaN }),
+      aircraft({ hex: '000011', seen_pos: 60.1 }),
+      aircraft({ hex: 'not-hex' }),
+      aircraft(),
+      // A non-ICAO (`~`) address still self-reports over 1090ES ADS-B.
+      aircraft({ hex: '~a1b2c3' }),
+      // Version 1, and both ends of the position-age range, qualify.
+      aircraft({ hex: 'b00001', version: 1, seen_pos: 0 }),
+      aircraft({ hex: 'b00002', seen_pos: 60 }),
+      null,
+    ],
+  });
+  assert.deepEqual(rows, [
+    {
+      hex: '4ca7b5',
+      lat: 50.1,
+      lon: 19.9,
+      nic: 8,
+      nacp: 10,
+      gpsLost: false,
+      degraded: false,
+    },
+    {
+      hex: '~a1b2c3',
+      lat: 50.1,
+      lon: 19.9,
+      nic: 8,
+      nacp: 10,
+      gpsLost: false,
+      degraded: false,
+    },
+    ...['b00001', 'b00002'].map((hex) => ({
+      hex,
+      lat: 50.1,
+      lon: 19.9,
+      nic: 8,
+      nacp: 10,
+      gpsLost: false,
+      degraded: false,
+    })),
+  ]);
+  assert.equal(normalizeGnssAircraft({}), null);
+  assert.equal(normalizeGnssAircraft(null), null);
+});
+
+test('low NIC, low NACp or a readsb GPS-loss flag each mark an aircraft degraded', () => {
+  const rows = normalizeGnssAircraft({
+    ac: [
+      aircraft({ hex: 'a00001', nic: 6 }),
+      aircraft({ hex: 'a00002', nac_p: 7 }),
+      aircraft({ hex: 'a00003', gpsOkBefore: 1790690000.1 }),
+      aircraft({ hex: 'a00004', nic: 7, nac_p: 8 }),
+    ],
+  });
+  assert.deepEqual(
+    rows.map(({ hex, degraded, gpsLost }) => [hex, degraded, gpsLost]),
+    [
+      ['a00001', true, false],
+      ['a00002', true, false],
+      ['a00003', true, true],
+      ['a00004', false, false],
+    ],
+  );
+});
+
+test('cell keys are stable half-degree bins, clamped at the poles and antimeridian', () => {
+  assert.equal(gnssCellKey(50.1, 19.9), gnssCellKey(50.4, 19.6));
+  assert.notEqual(gnssCellKey(50.1, 19.9), gnssCellKey(50.6, 19.9));
+  assert.equal(gnssCellKey(90, 180), gnssCellKey(89.9, 179.9));
+  assert.equal(gnssCellKey(-90, -180), '0:0');
+  // Just south-west of the origin falls in the last cell before 0°, not cell 0.
+  assert.equal(gnssCellKey(-0.1, -0.1), '179:359');
+});
+
+test('integrity level follows the gpsjam.org published cell formula and bands', () => {
+  const nominal = {
+    percent: 0,
+    level: 'low',
+    state: 'nominal',
+    interpretation: null,
+  };
+  assert.deepEqual(gnssIntegrityLevel(10, 0), nominal);
+  // One degraded aircraft is always discounted.
+  assert.deepEqual(gnssIntegrityLevel(10, 1), nominal);
+  assert.equal(gnssIntegrityLevel(50, 2).level, 'medium');
+  assert.equal(gnssIntegrityLevel(10, 2).level, 'medium');
+  assert.equal(gnssIntegrityLevel(10, 3).level, 'high');
+  assert.equal(gnssIntegrityLevel(0, 0).level, 'low');
+});
+
+test('the primary state is a navigation-integrity anomaly; interference is only the secondary reading', () => {
+  for (const [total, bad] of [
+    [50, 2],
+    [10, 3],
+  ]) {
+    const { state, interpretation } = gnssIntegrityLevel(total, bad);
+    assert.equal(state, 'navigation-integrity-anomaly');
+    assert.equal(interpretation, 'suspected-gnss-interference');
+  }
+  const store = new Map();
+  accumulateGnssObservations(
+    store,
+    [
+      { hex: 'h1', lat: 10.1, lon: 10.1, degraded: true },
+      { hex: 'h2', lat: 10.2, lon: 10.2, degraded: true },
+      { hex: 'h3', lat: 10.3, lon: 10.3, degraded: false },
+    ],
+    0,
+  );
+  const [cell] = binGnssCells(store);
+  assert.equal(cell.level, 'high');
+  assert.equal(cell.state, 'navigation-integrity-anomaly');
+  assert.equal(cell.interpretation, 'suspected-gnss-interference');
+  for (const key of Object.keys(cell))
+    assert.doesNotMatch(key, /interference|jamming|spoof/i);
+});
+
+test('provenance separates the GEV classifier from the gpsjam aggregation and the GEV window', () => {
+  assert.deepEqual(GNSS_PROVENANCE.classifier, {
+    id: 'gev-nic-nacp-v2',
+    rule: 'gpsOkBefore set || aircraft-reported NACp < 8 || (aircraft-reported NIC < 7 && !(NIC === 0 && NACp >= 10))',
+    basis: '14 CFR 91.227(c) ADS-B Out performance minima (US regulation)',
+    definedBy: 'GEV',
+    validated: false,
+  });
+  assert.equal(GNSS_PROVENANCE.classifier, GNSS_CLASSIFIER);
+  assert.deepEqual(GNSS_PROVENANCE.aggregation, {
+    id: 'gpsjam-cell-bands',
+    formula: '100 * max(0, bad - 1) / total',
+    bands: [2, 10],
+    source: 'https://gpsjam.org/faq',
+    definedBy: 'gpsjam.org',
+  });
+  assert.deepEqual(GNSS_PROVENANCE.window, {
+    minutes: 30,
+    scope: 'visited-view',
+    cellDeg: 0.5,
+    minAircraft: 3,
+    definedBy: 'GEV',
+  });
+  assert.equal(GNSS_PROVENANCE.state.id, 'navigation-integrity-anomaly');
+  assert.equal(
+    GNSS_PROVENANCE.interpretation.id,
+    'suspected-gnss-interference',
+  );
+  assert.equal(GNSS_PROVENANCE.interpretation.validated, false);
+  assert.ok(Object.isFrozen(GNSS_PROVENANCE));
+  assert.ok(Object.isFrozen(GNSS_PROVENANCE.aggregation.bands));
+  // The bands in provenance are the ones the level function applies.
+  const [medium, high] = GNSS_PROVENANCE.aggregation.bands;
+  assert.equal(gnssIntegrityLevel(100, 1 + medium).level, 'medium');
+  assert.equal(gnssIntegrityLevel(100, 1 + high).level, 'medium');
+  assert.equal(gnssIntegrityLevel(100, 2 + high).level, 'high');
+  assert.equal(gnssProvenance({ windowMs: 10 * 60_000 }).window.minutes, 10);
+});
+
+test('observations count each aircraft once per cell and expire after the window', () => {
+  const store = new Map();
+  const at = (lat, hex, degraded) => ({ hex, lat, lon: 20.1, degraded });
+  accumulateGnssObservations(
+    store,
+    [at(50.1, 'a1', true), at(50.2, 'a2', false), at(50.3, 'a3', false)],
+    0,
+    { windowMs: 1000 },
+  );
+  // a1 recovers inside the same cell: it stays degraded for the window.
+  accumulateGnssObservations(store, [at(50.2, 'a1', false)], 500, {
+    windowMs: 1000,
+  });
+  let [cell] = binGnssCells(store);
+  assert.equal(cell.aircraft, 3);
+  assert.equal(cell.degraded, 1);
+  assert.equal(cell.level, 'low');
+  assert.deepEqual(
+    [cell.south, cell.west, cell.north, cell.east],
+    [50, 20, 50.5, 20.5],
+  );
+
+  accumulateGnssObservations(store, [], 1200, { windowMs: 1000 });
+  assert.equal(store.size, 1);
+  assert.deepEqual(binGnssCells(store), []);
+});
+
+const MIN = 60_000;
+const report = (hex, degraded, lat = 50.1) => ({
+  hex,
+  lat,
+  lon: 20.1,
+  degraded,
+});
+const entry = (store, hex) =>
+  [...store].find(([key]) => key.startsWith(`${hex}|`))?.[1];
+
+test('degraded evidence expires one window after the degraded report, despite continuing healthy reports', () => {
+  const store = new Map();
+  accumulateGnssObservations(store, [report('a1', true)], 0);
+  // a1 keeps reporting healthy every minute in the same cell.
+  for (let minute = 1; minute <= 30; minute += 1)
+    accumulateGnssObservations(store, [report('a1', false)], minute * MIN);
+  assert.equal(entry(store, 'a1').seenAt, 30 * MIN);
+  assert.equal(
+    entry(store, 'a1').degradedAt,
+    0,
+    'healthy reports do not refresh the degraded evidence',
+  );
+  accumulateGnssObservations(store, [report('a1', false)], 31 * MIN);
+  assert.deepEqual(entry(store, 'a1'), {
+    cell: gnssCellKey(50.1, 20.1),
+    seenAt: 31 * MIN,
+    degradedAt: null,
+  });
+  // A new degraded report starts its own window.
+  accumulateGnssObservations(store, [report('a1', true)], 32 * MIN);
+  assert.equal(entry(store, 'a1').degradedAt, 32 * MIN);
+  accumulateGnssObservations(store, [report('a1', false)], 40 * MIN);
+  assert.equal(entry(store, 'a1').degradedAt, 32 * MIN);
+});
+
+test('a degraded cell turns healthy once its degraded evidence is older than the window', () => {
+  const store = new Map();
+  const healthy = [report('a2', false), report('a3', false)];
+  accumulateGnssObservations(
+    store,
+    [report('a1', true), report('b1', true), ...healthy],
+    0,
+  );
+  assert.equal(binGnssCells(store)[0].level, 'high');
+  for (let minute = 10; minute <= 30; minute += 10)
+    accumulateGnssObservations(
+      store,
+      [report('a1', false), report('b1', false), ...healthy],
+      minute * MIN,
+    );
+  assert.equal(binGnssCells(store)[0].degraded, 2);
+  accumulateGnssObservations(
+    store,
+    [report('a1', false), report('b1', false), ...healthy],
+    31 * MIN,
+  );
+  const [cell] = binGnssCells(store);
+  assert.equal(cell.aircraft, 4);
+  assert.equal(cell.degraded, 0);
+  assert.equal(cell.level, 'low');
+});
+
+test('an aircraft returning after the window starts fresh', () => {
+  const store = new Map();
+  accumulateGnssObservations(store, [report('a1', true)], 0);
+  // a1 leaves; nothing is heard from it for longer than the window.
+  accumulateGnssObservations(store, [], 31 * MIN);
+  assert.equal(store.size, 0);
+  accumulateGnssObservations(store, [report('a1', false)], 32 * MIN);
+  assert.deepEqual(entry(store, 'a1'), {
+    cell: gnssCellKey(50.1, 20.1),
+    seenAt: 32 * MIN,
+    degradedAt: null,
+  });
+  // Returning degraded dates the evidence from the new report.
+  const again = new Map();
+  accumulateGnssObservations(again, [report('a9', true)], 0);
+  accumulateGnssObservations(again, [], 31 * MIN);
+  accumulateGnssObservations(again, [report('a9', true)], 33 * MIN);
+  assert.equal(entry(again, 'a9').degradedAt, 33 * MIN);
+});
+
+test('an aircraft heard healthy right after the window drops its stale degraded evidence', () => {
+  // No prune runs in between: the old entry is still in the store when the
+  // healthy report arrives, so the new report alone must not carry it over.
+  const store = new Map();
+  accumulateGnssObservations(store, [report('a1', true)], 0);
+  accumulateGnssObservations(store, [report('a1', false)], 31 * MIN);
+  assert.deepEqual(entry(store, 'a1'), {
+    cell: gnssCellKey(50.1, 20.1),
+    seenAt: 31 * MIN,
+    degradedAt: null,
+  });
+  // Exactly one window after the degraded report it still counts.
+  const edge = new Map();
+  accumulateGnssObservations(edge, [report('a1', true)], 0);
+  accumulateGnssObservations(edge, [report('a1', false)], 30 * MIN);
+  assert.equal(entry(edge, 'a1').degradedAt, 0);
+});
+
+test('rows are dated by the snapshot observation time, so a replay never restarts the window', () => {
+  const store = new Map();
+  const snapshot = [report('a1', true), report('a2', false)];
+  accumulateGnssObservations(store, snapshot, 0, { observedAt: 0 });
+  // The same snapshot replayed (cached or stale) 29 minutes later.
+  accumulateGnssObservations(store, snapshot, 29 * MIN, { observedAt: 0 });
+  assert.equal(entry(store, 'a1').seenAt, 0);
+  assert.equal(entry(store, 'a1').degradedAt, 0);
+  accumulateGnssObservations(store, snapshot, 31 * MIN, { observedAt: 0 });
+  assert.equal(store.size, 0, 'a replay older than the window adds nothing');
+
+  // An older replay never moves an entry's age backwards either.
+  accumulateGnssObservations(store, snapshot, 40 * MIN);
+  accumulateGnssObservations(store, [report('a2', true)], 41 * MIN, {
+    observedAt: 35 * MIN,
+  });
+  assert.equal(entry(store, 'a2').seenAt, 40 * MIN);
+  assert.equal(entry(store, 'a2').degradedAt, 35 * MIN);
+
+  // A future time is clamped to now; an undated snapshot adds nothing.
+  accumulateGnssObservations(store, [report('f1', true)], 50 * MIN, {
+    observedAt: 99 * MIN,
+  });
+  assert.equal(entry(store, 'f1').seenAt, 50 * MIN);
+  for (const observedAt of [null, Number.NaN])
+    accumulateGnssObservations(store, [report('u1', true)], 50 * MIN, {
+      observedAt,
+    });
+  assert.equal(entry(store, 'u1'), undefined);
+});
+
+test('pruning without new rows drops expired observations and expired degraded evidence', () => {
+  const store = new Map();
+  accumulateGnssObservations(store, [report('a1', true)], 0);
+  accumulateGnssObservations(store, [report('a1', false)], 20 * MIN);
+  accumulateGnssObservations(store, [report('a2', false)], 0);
+  assert.equal(pruneGnssObservations(store, 31 * MIN), store);
+  assert.deepEqual(
+    [...store.keys()].map((key) => key.split('|')[0]),
+    ['a1'],
+  );
+  assert.equal(entry(store, 'a1').degradedAt, null);
+  pruneGnssObservations(store, 51 * MIN);
+  assert.equal(store.size, 0);
+  assert.equal(GNSS_WINDOW_MS, 30 * MIN);
+});
+
+test('rows without finite coordinates never key a cell', () => {
+  const store = new Map();
+  accumulateGnssObservations(
+    store,
+    [
+      { hex: 'n1', lat: Number.NaN, lon: 10.1, degraded: true },
+      { hex: 'n2', lat: 10.1, lon: '10.1', degraded: true },
+      null,
+    ],
+    0,
+  );
+  assert.equal(store.size, 0);
+});
+
+test('cells below the minimum aircraft count are withheld', () => {
+  const store = new Map();
+  accumulateGnssObservations(
+    store,
+    [
+      { hex: 'b1', lat: 10.1, lon: 10.1, degraded: true },
+      { hex: 'b2', lat: 10.2, lon: 10.2, degraded: true },
+    ],
+    0,
+  );
+  assert.deepEqual(binGnssCells(store), []);
+  const [cell] = binGnssCells(store, { minAircraft: 2 });
+  assert.equal(cell.level, 'high');
+  assert.equal(cell.percentDegraded, 50);
+});
+
+test('MLAT GPS-loss evidence uses the last good GNSS location and ignores MLAT NIC', () => {
+  const [row] = normalizeGnssAircraft({
+    ac: [
+      aircraft({
+        type: 'mlat',
+        nac_p: 0,
+        nic: 0,
+        mlat: ['lat', 'lon', 'nic'],
+        gpsOkBefore: 1800000000,
+        gpsOkLat: 54.2,
+        gpsOkLon: 19.3,
+      }),
+    ],
+  });
+  assert.ok(row);
+  assert.equal(row.lat, 54.2);
+  assert.equal(row.lon, 19.3);
+  assert.equal(row.nic, null);
+  assert.equal(row.degraded, true);
+  const [healthy] = normalizeGnssAircraft({
+    ac: [aircraft({ type: 'mlat', nic: 0, mlat: ['nic'] })],
+  });
+  assert.equal(healthy.degraded, false);
+});
+
+test('TIS-B accuracy fields and unknown containment do not manufacture anomalies', () => {
+  const rows = normalizeGnssAircraft({
+    ac: [
+      aircraft({ hex: 'a00001', nac_p: 0, tisb: ['nac_p'] }),
+      aircraft({ hex: 'a00002', nic: 0, tisb: ['nic'] }),
+      aircraft({ hex: 'a00003', nic: 0, nac_p: 10 }),
+      aircraft({ hex: 'a00004', nic: 0, nac_p: 8 }),
+      aircraft({ hex: 'a00005', nic: 6, nac_p: 10 }),
+    ],
+  });
+  assert.deepEqual(
+    rows.map((r) => r.degraded),
+    [false, false, false, true, true],
+  );
+});
+
+// Quality-field subsets captured from public adsb.lol US point responses on
+// 2026-10-14 (34,-118 and 41,-73, radius 250 nm), ODbL 1.0 / adsb.lol contributors.
+// Only field provenance is reused; the airborne ADS-B envelopes are synthetic.
+test('public US quality-field fixtures do not turn rebroadcast accuracy into own accuracy', () => {
+  const tisbQuality = {
+    nic: 0,
+    nac_p: 0,
+    tisb: [
+      'altitude',
+      'alt_baro',
+      'gs',
+      'track',
+      'geom_rate',
+      'lat',
+      'lon',
+      'nic',
+      'rc',
+      'nac_p',
+      'nac_v',
+      'sil',
+      'sil_type',
+    ],
+    mlat: [],
+  };
+  assert.deepEqual(normalizeGnssAircraft({ ac: [aircraft(tisbQuality)] }), []);
+  const unknownContainment = {
+    nic: 0,
+    nac_p: 10,
+    tisb: ['callsign'],
+    mlat: [],
+  };
+  assert.equal(
+    normalizeGnssAircraft({ ac: [aircraft(unknownContainment)] })[0].degraded,
+    false,
+  );
+});

src/layers/gnss/source.js

@@ -0,0 +1,76 @@
+import { readResponseJsonCapped } from '../../sources/httpBody.js';
+
+function retryDelay(raw, nowMs) {
+  if (!raw) return null;
+  const seconds = Number(raw);
+  const ms = seconds * 1000;
+  if (Number.isFinite(ms) && seconds > 0)
+    return Math.min(3600000, Math.max(5000, ms));
+  const at = Date.parse(raw);
+  return Number.isFinite(at) && at > nowMs
+    ? Math.min(3600000, Math.max(5000, at - nowMs))
+    : null;
+}
+
+/** Request integrity facts around a view anchor through the same-origin adsb.lol proxy. */
+export function createAdsbGnssSource({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+} = {}) {
+  return {
+    async getSnapshot({ latitude, longitude } = {}, { signal } = {}) {
+      signal?.throwIfAborted();
+      if (!Number.isFinite(latitude) || !Number.isFinite(longitude))
+        throw new Error('GNSS snapshot needs a view anchor');
+      const params = new URLSearchParams({
+        lat: String(Math.round(latitude)),
+        lon: String(Math.round(longitude)),
+      });
+      const response = await fetchImpl(`/api/gnss-integrity?${params}`, {
+        signal,
+      });
+      if (!response.ok) {
+        const limited = response.status === 429;
+        const retryAfterMs = retryDelay(
+          response.headers.get('retry-after'),
+          now(),
+        );
+        throw Object.assign(
+          new Error(
+            limited
+              ? 'GNSS feed rate limited (HTTP 429)'
+              : `GNSS feed unavailable (HTTP ${response.status})`,
+          ),
+          {
+            status: response.status,
+            retryable: limited || response.status >= 500,
+            retryAfterMs: retryAfterMs ?? (limited ? 60000 : null),
+          },
+        );
+      }
+      const payload = await readResponseJsonCapped(
+        response,
+        4 * 1024 * 1024,
+        signal,
+      );
+      signal?.throwIfAborted();
+      if (!Array.isArray(payload?.rows))
+        throw new Error('Malformed GNSS integrity snapshot');
+      // The snapshot's age (measured on the proxy's clock) dates every row in
+      // the rolling window; an undated snapshot could only be treated as new,
+      // so it is refused.
+      if (!Number.isFinite(payload.ageMs) || payload.ageMs < 0)
+        throw new Error('GNSS integrity snapshot has no observation time');
+      return {
+        rows: payload.rows,
+        ageMs: payload.ageMs,
+        fetchedAt: Number.isFinite(payload.fetchedAt)
+          ? payload.fetchedAt
+          : null,
+        stale: payload.stale === true,
+        classifier:
+          typeof payload.classifier === 'string' ? payload.classifier : null,
+      };
+    },
+  };
+}

src/layers/gnss/source.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createAdsbGnssSource } from './source.js';
+
+test('the source asks the same-origin proxy for the view anchor', async () => {
+  const calls = [];
+  const source = createAdsbGnssSource({
+    fetchImpl: async (url, options) => {
+      calls.push(url);
+      assert.ok(options.signal instanceof AbortSignal);
+      return Response.json({
+        fetchedAt: 5,
+        ageMs: 0,
+        classifier: 'gev-nic-nacp-v2',
+        rows: [{ hex: 'abc123' }],
+      });
+    },
+  });
+  const snapshot = await source.getSnapshot(
+    { latitude: 50.06143, longitude: 19.93658 },
+    { signal: new AbortController().signal },
+  );
+  assert.deepEqual(calls, ['/api/gnss-integrity?lat=50&lon=20']);
+  assert.deepEqual(snapshot, {
+    rows: [{ hex: 'abc123' }],
+    ageMs: 0,
+    fetchedAt: 5,
+    stale: false,
+    classifier: 'gev-nic-nacp-v2',
+  });
+});
+
+test('the source reports stale proxy data and rejects bad input or responses', async () => {
+  const reply = (body, init) => async () => Response.json(body, init);
+  const stale = await createAdsbGnssSource({
+    fetchImpl: reply({ rows: [], fetchedAt: 7, ageMs: 90_000, stale: true }),
+  }).getSnapshot({ latitude: 1, longitude: 2 });
+  assert.equal(stale.stale, true);
+  assert.equal(stale.ageMs, 90_000, 'a stale reply keeps its observation age');
+  assert.equal(stale.fetchedAt, 7);
+  assert.equal(stale.classifier, null);
+  // Without an observation age the rows could only be dated as new.
+  for (const ageMs of [undefined, null, '7', -1, Number.NaN])
+    await assert.rejects(
+      createAdsbGnssSource({
+        fetchImpl: reply({ rows: [], fetchedAt: 7, ageMs }),
+      }).getSnapshot({ latitude: 1, longitude: 2 }),
+      /no observation time/,
+    );
+
+  await assert.rejects(
+    createAdsbGnssSource({ fetchImpl: reply({}) }).getSnapshot({}),
+    /view anchor/,
+  );
+  await assert.rejects(
+    createAdsbGnssSource({
+      fetchImpl: reply({ error: 'x' }, { status: 502 }),
+    }).getSnapshot({ latitude: 1, longitude: 2 }),
+    /HTTP 502/,
+  );
+  await assert.rejects(
+    createAdsbGnssSource({ fetchImpl: reply({ rows: 'no' }) }).getSnapshot({
+      latitude: 1,
+      longitude: 2,
+    }),
+    /Malformed/,
+  );
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(
+    createAdsbGnssSource({ fetchImpl: reply({ rows: [] }) }).getSnapshot(
+      { latitude: 1, longitude: 2 },
+      { signal: controller.signal },
+    ),
+  );
+});
+
+test('HTTP failures distinguish rate limiting, preserve Retry-After and classify retryability', async () => {
+  const at = Date.UTC(2026, 9, 13, 12);
+  for (const [status, header, delay, retryable] of [
+    [429, '3600', 3600000, true],
+    [429, new Date(at + 3600000).toUTCString(), 3600000, true],
+    [429, null, 60000, true],
+    [429, 'Infinity', 60000, true],
+    [502, '5', 5000, true],
+    [502, null, null, true],
+    [400, null, null, false],
+  ]) {
+    const source = createAdsbGnssSource({
+      now: () => at,
+      fetchImpl: async () =>
+        Response.json(
+          {},
+          { status, headers: header ? { 'Retry-After': header } : {} },
+        ),
+    });
+    await assert.rejects(
+      source.getSnapshot({ latitude: 50, longitude: 20 }),
+      (e) => {
+        assert.equal(e.status, status);
+        assert.equal(e.retryAfterMs, delay);
+        assert.equal(e.retryable, retryable);
+        assert.match(
+          e.message,
+          status === 429 ? /rate limited/ : /feed unavailable/,
+        );
+        return true;
+      },
+    );
+  }
+});

src/layers/military/policy.js

@@ -6,6 +6,7 @@ export {
   ERROR_BACKOFF_INTERVAL,
 } from './recordPolicy.js';
 import * as Cesium from 'cesium';
+import { EMERGENCY_TINT_CSS } from '../../data/aircraftEmergency.js';
 
 /**
  * @module militaryFlights
@@ -40,6 +41,11 @@ export const MIL_ICON_COLOR = Cesium.Color.fromCssColorString('#FFB800');
 
 export const TRACKED_ICON_COLOR = Cesium.Color.fromCssColorString('#FFD166');
 
+/** @constant {Cesium.Color} Red tint for aircraft broadcasting an emergency (mirror of flights) */
+
+export const EMERGENCY_ICON_COLOR =
+  Cesium.Color.fromCssColorString(EMERGENCY_TINT_CSS);
+
 // --- Ground traffic (owner reversal 2026-07-03; mirror of flights.js) ---------------
 // adsb.lol/readsb flags ground traffic with alt_baro === "ground" (no separate
 // boolean). Such aircraft are RENDERED instead of floating at the 3 km altitude

src/layers/military/queries.js

@@ -9,6 +9,7 @@ import {
   CONTACT_MATCH_TIER,
 } from '../../data/contactMatch.js';
 import { LANDED_ALT_MAX_FT, LANDED_SPEED_MAX_MPS } from './policy.js';
+import { emergencyBroadcastPhrase } from '../../data/aircraftEmergency.js';
 
 export function createQueries({
   flightState,
@@ -133,6 +134,10 @@ export function createQueries({
         flightState.records.missingPolls.get(icao24) ||
         flightState.feed._backoff,
       ),
+      // This poll's transponder broadcast (not sticky; see records.js).
+      squawk: info?.squawk ?? null,
+      emergency: info?.emergency ? { ...info.emergency } : null,
+      emergencyBroadcast: emergencyBroadcastPhrase(info?.emergency),
     };
   }
 
@@ -156,7 +161,9 @@ export function createQueries({
    *   lon: number|null, altitudeM: number|null, speedMps: number|null,
    *   heading: number|null, verticalRateMps: number|null, onGround: boolean,
    *   military: boolean, aircraftClass: string|null, originCountry: null,
-   *   operator: string|null, routeOrigin: null, routeDestination: null}}
+   *   operator: string|null, squawk: string|null, emergency: boolean,
+   *   emergencyKind: string|null, emergencySource: 'squawk'|'ads-b'|null,
+   *   emergencyBroadcast: string|null, lastContactAtMs: number|null, routeOrigin: null, routeDestination: null}}
    */
 
   function mapAnalystRecord(icao24, info) {
@@ -187,6 +194,20 @@ export function createQueries({
       aircraftClass: tr3bAircraftClass(icao24, text(info?.klass)),
       originCountry: null,
       operator: text(info?.operator),
+      squawk: text(info?.squawk),
+      // True while this poll broadcast an emergency (7500/7600/7700 or the
+      // ADS-B status); priority statuses (lifeguard, minfuel) report the kind
+      // without the flag.
+      emergency: info?.emergency?.severity === 'emergency',
+      emergencyKind: text(info?.emergency?.kind),
+      // Provenance, so a summary can say "broadcasting squawk 7700" rather
+      // than "ADS-B reports general emergency" (or flatten both): 'squawk'
+      // when the Mode A code names the status, 'ads-b' for the readsb field.
+      emergencySource: text(info?.emergency?.source),
+      emergencyBroadcast: emergencyBroadcastPhrase(info?.emergency),
+      // Latest known general aircraft-message contact, retained if a poll
+      // has no time. This is not the receipt time of the current status.
+      lastContactAtMs: num(info?.lastContactEpochMs),
       routeOrigin: null,
       routeDestination: null,
     };

src/layers/military/records.js

@@ -1,6 +1,7 @@
 import { pickRenderAltitudeM } from '../../data/renderAltitude.js';
 import { stickyText, stickyNumber } from '../../data/aircraftMeta.js';
 import { classifyAircraft } from '../../data/aircraftClass.js';
+import { aircraftEmergency } from '../../data/aircraftEmergency.js';
 import {
   GROUND_FLOOR_WARM_MAX_ALT_M,
   LANDED_MISSING_POLL_LIMIT,
@@ -161,6 +162,9 @@ export class MilitaryFlightRecords {
         null,
       ),
       turnRateDps: prevMeta?.turnRateDps || 0,
+      // Per poll, NOT sticky (mirror of flights): a cleared code clears here.
+      squawk: aircraft.squawk ?? null,
+      emergency: aircraftEmergency(aircraft),
       onGround,
       // Round 7: sticky airborne history (see _likelyLanded).
       wasAirborne: prevMeta?.wasAirborne === true || !onGround,

src/layers/military/records.test.mjs

@@ -98,3 +98,19 @@ test('military records keep bounded partial retention and release metadata only
     'remove',
   );
 });
+
+test('military emergency status follows the latest poll instead of sticking', () => {
+  const records = store();
+  const first = records.receive(
+    observation({ squawk: '1234', emergency: 'minfuel' }),
+    context(),
+  );
+  assert.equal(first.meta.squawk, '1234');
+  assert.equal(first.meta.emergency.kind, 'minfuel');
+  assert.equal(first.meta.emergency.severity, 'priority');
+  const next = records.receive(
+    observation({ squawk: '1234', emergency: 'none' }),
+    context(),
+  );
+  assert.equal(next.meta.emergency, null);
+});

src/layers/military/rendering.js

@@ -18,6 +18,7 @@ import {
   screenProjectedRotation,
 } from '../../data/iconOrientation.js';
 import { limitCourseStep, courseSlewCapDps } from '../../data/motionModel.js';
+import { isEmergency } from '../../data/aircraftEmergency.js';
 import {
   PLANE_MODEL_SCALE,
   PLANE_MODEL_URL,
@@ -33,6 +34,7 @@ import {
   COCKPIT_CONTACT_SIZE_PX,
   MIL_ICON_COLOR,
   TRACKED_ICON_COLOR,
+  EMERGENCY_ICON_COLOR,
   MODEL_ALT_CEIL_M,
   MODEL_MAX_ALL,
   MODEL_MAX,
@@ -159,7 +161,7 @@ export function createRendering({
       bb.height = COCKPIT_CONTACT_SIZE_PX;
       bb.scale = limbScale;
       bb.scaleByDistance = _cockpitBillboardScaleByDistance();
-      bb.color = MIL_ICON_COLOR.withAlpha(freshnessAlpha);
+      bb.color = _fleetBillboardColor(icao24).withAlpha(freshnessAlpha);
       bb.rotation = 0;
       return;
     }
@@ -173,7 +175,9 @@ export function createRendering({
     bb.height = icao24 === flightState._trackedIcao ? 24 : 20;
     bb.scale = _militaryBillboardScale(icao24) * limbScale;
     bb.scaleByDistance = _normalBillboardScaleByDistance();
-    bb.color = MIL_ICON_COLOR.withAlpha(cyberSonarBaseAlpha(bb));
+    bb.color = _fleetBillboardColor(icao24, meta).withAlpha(
+      cyberSonarBaseAlpha(bb),
+    );
   }
 
   /** Sprite kind for one contact's billboard. Identity for every aircraft except
@@ -189,7 +193,17 @@ export function createRendering({
 
   function _modelColor(icao24) {
     if (icao24 === flightState._trackedIcao) return TRACKED_ICON_COLOR;
-    return MIL_ICON_COLOR;
+    return _fleetBillboardColor(icao24);
+  }
+
+  /** Fleet (untracked) tint: red while the latest poll broadcast an emergency,
+   *  amber otherwise. Cockpit far-contact dots use it too. */
+
+  function _fleetBillboardColor(
+    icao24,
+    info = flightState.records.data.get(icao24),
+  ) {
+    return isEmergency(info?.emergency) ? EMERGENCY_ICON_COLOR : MIL_ICON_COLOR;
   }
 
   /** The FLEET's 3D-model regime: models3d enabled AND the camera zoomed in past the altitude
@@ -965,7 +979,7 @@ export function createRendering({
       const isCockpitNear =
         flightState._cockpitContactMode &&
         flightState._cockpitNearContacts.has(icao24);
-      const baseColor = MIL_ICON_COLOR;
+      const baseColor = _fleetBillboardColor(icao24, info);
       const treatment = applyAircraftBillboardTreatment({
         billboard: bb,
         baseScale:
@@ -1082,6 +1096,7 @@ export function createRendering({
     _applyFleetBillboardPresentation,
     _iconKind,
     _modelColor,
+    _fleetBillboardColor,
     _modelRegimeActive,
     _modelCap,
     _modelAddDistM,

src/layers/military/snapshotRenderer.js

@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { cyberSonarBaseAlpha } from '../../cyberSonar.js';
 import { CLASS_SCALE_2D } from '../../data/aircraftClass.js';
 import {
   turnRateFromFixHistory,
@@ -7,12 +8,7 @@ import {
 } from '../../data/motionModel.js';
 import { aircraftIcon } from '../../data/aircraftIcons.js';
 import { POSITION_HISTORY_LIMIT } from './recordPolicy.js';
-import {
-  BILLBOARD_SCALE,
-  GROUND_SCALE,
-  TRACKED_ICON_COLOR,
-  MIL_ICON_COLOR,
-} from './policy.js';
+import { BILLBOARD_SCALE, GROUND_SCALE, TRACKED_ICON_COLOR } from './policy.js';
 
 /** Apply military record changes to Cesium resources and existing follow operations. */
 export function createMilitarySnapshotRenderer({
@@ -125,6 +121,11 @@ export function createMilitarySnapshotRenderer({
 
       if (flightState._billboards.has(icao24)) {
         const bb = flightState._billboards.get(icao24);
+        if (!isTracked) {
+          bb.color = rendering
+            ._fleetBillboardColor(icao24, meta)
+            .withAlpha(cyberSonarBaseAlpha(bb));
+        }
         // Position AND rotation are owned by the fleet pass (_fleetTick);
         // course changes land on the next rotation pass (forced below).
         // Ground flips (landing/takeoff) restyle this SAME billboard in
@@ -161,7 +162,9 @@ export function createMilitarySnapshotRenderer({
           // Screen-projected rotation lands on the next fleet tick.
           rotation: 0,
           alignedAxis: Cesium.Cartesian3.ZERO,
-          color: isTracked ? TRACKED_ICON_COLOR : MIL_ICON_COLOR,
+          color: isTracked
+            ? TRACKED_ICON_COLOR
+            : rendering._fleetBillboardColor(icao24, meta),
           sizeInMeters: false,
           scaleByDistance: rendering._normalBillboardScaleByDistance(),
           // Grounded/near-surface planes sit at/below the photoreal tile

src/layers/military/tracking.js

@@ -21,7 +21,6 @@ import {
   TRAIL_COLOR,
   BILLBOARD_SCALE,
   GROUND_SCALE,
-  MIL_ICON_COLOR,
   AMBER_TRANSPARENT,
   TRACKED_ICON_COLOR,
 } from './policy.js';
@@ -780,12 +779,16 @@ export function createTracking({
       bb.width = 20;
       bb.height = 20;
       // Ground-aware restore (a plane untracked while taxiing comes back at
-      // ground scale; tint is full amber on the ground and in the air).
+      // ground scale; the fleet tint is amber, or red while broadcasting an
+      // emergency, on the ground and in the air).
       bb.scale =
         BILLBOARD_SCALE *
         (CLASS_SCALE_2D[meta?.klass] || 1) *
         (meta?.onGround ? GROUND_SCALE : 1);
-      bb.color = MIL_ICON_COLOR;
+      bb.color = parts.rendering._fleetBillboardColor(
+        flightState._trackedIcao,
+        meta,
+      );
       bb.rotation = flightState._lastTrackedRotation;
     }
     flightState._lastCamPoseSig = ''; // force a fleet rotation pass on the next tick

src/layers/recentImagery/catalog.js

@@ -27,7 +27,8 @@ const CMR_SEARCH_AFTER = 'CMR-Search-After';
 /**
  * Read one product's granules across CMR pages, sending back each response's
  * `CMR-Search-After` cursor until a short page, a missing cursor or the
- * record cap ends the walk. `truncated` is measured against CMR's `hits`.
+ * record cap ends the walk. `truncated` means CMR's `hits` exceed the rows
+ * read, or the cap dropped valid granules from the last page read.
  * @param {{ product: string, url: string, fetchImpl: typeof fetch, signal?: AbortSignal, maxRecords?: number }} request
  * @returns {Promise<{ granules: Array<object>, truncated: boolean }>}
  */
@@ -40,6 +41,8 @@ export async function fetchCmrPages({
 }) {
   const granules = [];
   let hits = 0;
+  let readCount = 0;
+  let capped = 0;
   let cursor = null;
   for (;;) {
     const init = { signal };
@@ -47,19 +50,27 @@ export async function fetchCmrPages({
     const response = await fetchImpl(url, init);
     if (!response?.ok)
       throw new Error(`HTTP ${response?.status ?? 'error'} from CMR`);
-    const page = parseCmrUmm(await response.json(), product);
-    granules.push(...page.granules);
+    const json = await response.json();
+    const rawCount = Array.isArray(json?.items) ? json.items.length : 0;
+    const page = parseCmrUmm(json, product);
+    readCount += rawCount;
+    const admitted = page.granules.slice(
+      0,
+      Math.max(0, maxRecords - granules.length),
+    );
+    granules.push(...admitted);
+    capped += page.granules.length - admitted.length;
     hits = Math.max(hits, page.hits);
     cursor = response.headers?.get?.(CMR_SEARCH_AFTER) ?? null;
     if (
       !cursor ||
-      page.granules.length < CMR_PAGE_SIZE ||
-      granules.length >= maxRecords ||
-      granules.length >= hits
+      rawCount < CMR_PAGE_SIZE ||
+      readCount >= maxRecords ||
+      readCount >= hits
     )
       break;
   }
-  return { granules, truncated: hits > granules.length };
+  return { granules, truncated: hits > readCount || capped > 0 };
 }
 
 function finiteOrNull(value) {

src/layers/recentImagery/cmr-raw-page-budget.test.mjs

@@ -0,0 +1,98 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { fetchCmrPages } from './catalog.js';
+const item = (id) => ({
+  meta: { 'concept-id': id },
+  umm: {
+    TemporalExtent: {
+      RangeDateTime: { BeginningDateTime: '2026-09-18T12:00:00Z' },
+    },
+  },
+});
+test('discarded rows do not turn a full CMR page into a final page', async () => {
+  let calls = 0;
+  const result = await fetchCmrPages({
+    product: 'S30',
+    url: 'fixture',
+    fetchImpl: async () => {
+      calls++;
+      const items =
+        calls === 1
+          ? Array.from({ length: 200 }, (_, i) =>
+              i === 0 ? {} : item(String(i)),
+            )
+          : [item('last')];
+      return Response.json(
+        { hits: 201, items },
+        { headers: { 'CMR-Search-After': `cursor-${calls}` } },
+      );
+    },
+  });
+  assert.equal(calls, 2);
+  assert.equal(result.granules.length, 200);
+  assert.equal(result.granules.at(-1).id, 'last');
+  assert.equal(result.truncated, false);
+});
+test('a non-page-multiple limit never returns more admitted records than its budget', async () => {
+  let calls = 0;
+  const result = await fetchCmrPages({
+    product: 'S30',
+    url: 'fixture',
+    maxRecords: 250,
+    fetchImpl: async () => {
+      calls++;
+      return Response.json(
+        {
+          hits: 1000,
+          items: Array.from({ length: 200 }, (_, i) => item(`${calls}:${i}`)),
+        },
+        { headers: { 'CMR-Search-After': `cursor-${calls}` } },
+      );
+    },
+  });
+  assert.equal(calls, 2);
+  assert.equal(result.granules.length, 250);
+  assert.equal(result.truncated, true);
+});
+test('valid records dropped by the cap mark the result truncated even when every hit was read', async () => {
+  let calls = 0;
+  const result = await fetchCmrPages({
+    product: 'S30',
+    url: 'fixture',
+    maxRecords: 250,
+    fetchImpl: async () => {
+      calls++;
+      return Response.json(
+        {
+          hits: 400,
+          items: Array.from({ length: 200 }, (_, i) => item(`${calls}:${i}`)),
+        },
+        { headers: { 'CMR-Search-After': `cursor-${calls}` } },
+      );
+    },
+  });
+  assert.equal(calls, 2);
+  assert.equal(result.granules.length, 250);
+  assert.equal(result.truncated, true);
+});
+test('malformed rows discarded under the cap leave a fully examined result untruncated', async () => {
+  let calls = 0;
+  const result = await fetchCmrPages({
+    product: 'S30',
+    url: 'fixture',
+    maxRecords: 250,
+    fetchImpl: async () => {
+      calls++;
+      const items = Array.from({ length: 200 }, (_, i) =>
+        calls === 2 && i >= 50 ? {} : item(`${calls}:${i}`),
+      );
+      return Response.json(
+        { hits: 400, items },
+        { headers: { 'CMR-Search-After': `cursor-${calls}` } },
+      );
+    },
+  });
+  assert.equal(calls, 2);
+  assert.equal(result.granules.length, 250);
+  assert.equal(result.truncated, false);
+});

src/layers/recentImagery/imagery-box-missing-edge.test.mjs

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  boxCentre,
+  boxFromRectangle,
+  dequantizeBox,
+  validateBox,
+} from './model.js';
+import { searchHls } from './catalog.js';
+
+test('missing imagery edges do not turn into invented zero coordinates', () => {
+  for (const value of [null, undefined, '', ' ', false, true]) {
+    const box = { west: value, south: 0, east: 1, north: 1 };
+    assert.equal(validateBox(box).ok, false);
+    assert.equal(validateBox(box).reason, 'invalid');
+    assert.equal(boxCentre(box), null);
+  }
+  assert.equal(validateBox({ west: 0, south: 0, east: 1, north: 1 }).ok, true);
+  assert.equal(
+    validateBox({ west: '0', south: '0', east: '1', north: '1' }).ok,
+    true,
+  );
+});
+
+test('every edge and every box entry point refuses a missing edge', async () => {
+  const blanks = [null, undefined, '', ' ', false, [], {}];
+  for (const edge of ['west', 'south', 'east', 'north']) {
+    for (const value of blanks) {
+      const box = { west: 1, south: 1, east: 2, north: 2, [edge]: value };
+      assert.equal(validateBox(box).ok, false, `${edge}=${String(value)}`);
+      // Share-link integers and Cesium radians are converted per edge.
+      assert.equal(dequantizeBox(box), null, `share ${edge}`);
+      assert.equal(boxFromRectangle(box), null, `radians ${edge}`);
+    }
+  }
+  let fetched = false;
+  await assert.rejects(
+    searchHls({
+      box: { west: ' ', south: 1, east: 2, north: 2 },
+      fetchImpl: async () => {
+        fetched = true;
+      },
+    }),
+    TypeError,
+  );
+  assert.equal(fetched, false);
+  assert.ok(dequantizeBox({ west: 0, south: 0, east: 100000, north: 100000 }));
+});

src/layers/recentImagery/model.js

@@ -75,6 +75,14 @@ const pad2 = (value) => String(value).padStart(2, '0');
  * east are not swapped: west > east crosses the dateline and `validateBox`
  * rejects it. Null when any edge is nonfinite.
  */
+/** A box edge as a number, or null when it is missing, blank or not numeric. */
+function edgeNumber(value) {
+  if (typeof value === 'number') return Number.isFinite(value) ? value : null;
+  if (typeof value !== 'string' || !value.trim()) return null;
+  const number = Number(value);
+  return Number.isFinite(number) ? number : null;
+}
+
 function normalizeBox(box) {
   if (!box || typeof box !== 'object') return null;
   const [west, south, east, north] = [
@@ -82,8 +90,8 @@ function normalizeBox(box) {
     box.south,
     box.east,
     box.north,
-  ].map(Number);
-  if (![west, south, east, north].every(Number.isFinite)) return null;
+  ].map(edgeNumber);
+  if ([west, south, east, north].some((edge) => edge == null)) return null;
   return {
     west,
     south: Math.min(south, north),
@@ -211,11 +219,16 @@ export function boxFromPin(lon, lat, sideKm = PIN_BOX_SIDE_KM) {
 
 function mapBox(box, fn) {
   if (!box || typeof box !== 'object') return null;
+  // Converting first would turn a blank edge into 0 before normalizeBox sees it.
+  const edge = (value) => {
+    const number = edgeNumber(value);
+    return number == null ? null : fn(number);
+  };
   return normalizeBox({
-    west: fn(box.west),
-    south: fn(box.south),
-    east: fn(box.east),
-    north: fn(box.north),
+    west: edge(box.west),
+    south: edge(box.south),
+    east: edge(box.east),
+    north: edge(box.north),
   });
 }
 

src/layers/recentImagery/source.js

@@ -1,7 +1,11 @@
 import { searchHls } from './catalog.js';
 import { gibsTemplate, wvsSnapshotUrl } from './model.js';
 
-/** NASA-compatible imagery acquisition; transport and URL builders are replaceable. */
+/**
+ * NASA-compatible imagery acquisition; transport and URL builders are replaceable.
+ * Thumbnail responses must expose Data-Present: true for image admission, or
+ * false for confirmed empty coverage, including injected getThumbnail sources.
+ */
 export function createRecentImagerySource({
   fetchImpl = (...args) => globalThis.fetch(...args),
   search = searchHls,

src/layers/recentImagery/thumbnail-presence-proof.test.mjs

@@ -0,0 +1,30 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createThumbnailLoader } from './thumbnails.js';
+test('missing or malformed presence evidence cannot prove thumbnail pixels', async () => {
+  for (const header of [null, 'unknown', '', 'true', 'false']) {
+    let decodes = 0;
+    const loader = createThumbnailLoader({
+      requestThumbnail: async () => ({
+        ok: true,
+        headers: { get: (key) => (key === 'Data-Present' ? header : null) },
+        blob: async () => {
+          decodes++;
+          return new Blob(['fixture']);
+        },
+      }),
+      createObjectUrl: () => 'blob:fixture',
+    });
+    loader.request(
+      { key: 'fixture', product: 'S30', day: '2026-09-18' },
+      { west: 0, east: 1, south: 0, north: 1 },
+    );
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(
+      loader.get('fixture').status,
+      header === 'true' ? 'present' : header === 'false' ? 'empty' : 'error',
+    );
+    assert.equal(decodes, header === 'true' ? 1 : 0);
+    loader.destroy();
+  }
+});

src/layers/recentImagery/thumbnails.js

@@ -100,12 +100,12 @@ export function createThumbnailLoader({
         cancelled = true;
       } else if (response?.ok) {
         const present = String(
-          response.headers?.get?.('Data-Present') ?? 'true',
+          response.headers?.get?.('Data-Present') ?? '',
         ).toLowerCase();
         acquisitionTime = response.headers?.get?.('Acquisition-Time') || null;
         if (present === 'false') {
           status = 'empty';
-        } else {
+        } else if (present === 'true') {
           const blob = await response.blob();
           if (controller.signal.aborted) cancelled = true;
           else {

src/layers/streetLevel/glyphs.js

@@ -65,6 +65,15 @@ export function imageConeGlyph({
   });
 }
 
+/** Street View-style marker: a field-of-view cone from a white-ringed dot. */
+export function viewConeMarkerGlyph({ size = 56, color = '#4285f4' } = {}) {
+  return cachedGlyph(`view-cone:${size}:${color}`, size, (ctx, c) => {
+    wedge(ctx, c, size * 0.48, 0.62, color, 0.38);
+    wedge(ctx, c, size * 0.3, 0.62, color, 0.3);
+    dot(ctx, c, size * 0.13, color, '#ffffff', Math.max(2, size * 0.05));
+  });
+}
+
 /** Marker for the image the viewer currently shows. */
 export function positionMarkerGlyph({ size = 44, color = '#ffb300' } = {}) {
   return cachedGlyph(`pos:${size}:${color}`, size, (ctx, c) => {

src/layers/streetLevel/groundClick.js

@@ -0,0 +1,56 @@
+import * as Cesium from 'cesium';
+import { GROUND_CLICK_MAX_HEIGHT_M } from './policy.js';
+import { cameraHeightAboveGround } from './view.js';
+
+/** Whether the camera is low enough for a click on the ground to mean a street. */
+export function groundClickHeightOk(viewer, groundAt) {
+  if (!viewer?.camera?.positionCartographic) return false;
+  return (
+    cameraHeightAboveGround(viewer, { groundAt }) <= GROUND_CLICK_MAX_HEIGHT_M
+  );
+}
+
+/**
+ * A click on the map itself at street zoom opens the nearest image of the
+ * active `groundClick` providers, without moving the camera. The height is
+ * measured at the click, not read from the cached flag.
+ * @param {{state: object, openNearest: Function, isAvailable: (entry: object) => boolean, groundAt?: Function}} options
+ * @returns {(screenPosition: {x: number, y: number}, picked?: object) => Promise<boolean>|false}
+ */
+export function createGroundClick({
+  state,
+  openNearest,
+  isAvailable,
+  groundAt = null,
+}) {
+  return function openAtGround(screenPosition, picked) {
+    const scenePick = state.services.scenePick;
+    if (!state.enabled || !state.viewer || !scenePick?.pickGroundPosition)
+      return false;
+    if (
+      !scenePick.isSurfacePick(picked) ||
+      !groundClickHeightOk(state.viewer, groundAt)
+    )
+      return false;
+    const providerIds = [...state.providers.values()]
+      .filter(
+        (entry) =>
+          entry.on &&
+          entry.def.groundClick &&
+          entry.status?.configured &&
+          isAvailable(entry),
+      )
+      .map((entry) => entry.def.id);
+    if (!providerIds.length) return false;
+    const position = scenePick.pickGroundPosition(state.viewer, screenPosition);
+    const carto = position && Cesium.Cartographic.fromCartesian(position);
+    if (!carto) return false;
+    return openNearest(
+      {
+        lon: Cesium.Math.toDegrees(carto.longitude),
+        lat: Cesium.Math.toDegrees(carto.latitude),
+      },
+      { providerIds, frame: false },
+    );
+  };
+}

src/layers/streetLevel/groundClick.test.mjs

@@ -0,0 +1,133 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import * as Cesium from 'cesium';
+import { createGroundClick, groundClickHeightOk } from './groundClick.js';
+import * as scenePick from '../../data/scenePick.js';
+
+const GROUND = Cesium.Cartesian3.fromDegrees(-121.4944, 38.5816, 10);
+const TILESET = { isCesium3DTileset: true };
+
+/**
+ * A layer state with providers `{id, on, groundClick, configured, available}`;
+ * `picked` is where the depth buffer lands, `ellipsoid` the fallback hit.
+ */
+function harness({
+  providers = [
+    { id: 'mapillary', groundClick: false },
+    { id: 'google', groundClick: true },
+  ],
+  height = 400,
+  enabled = true,
+  picked = GROUND,
+  ellipsoid = undefined,
+} = {}) {
+  const opened = [];
+  const state = {
+    enabled,
+    services: { scenePick },
+    providers: new Map(
+      providers.map(
+        ({
+          id,
+          on = true,
+          groundClick,
+          configured = true,
+          available = true,
+        }) => [
+          id,
+          { on, def: { id, groundClick }, status: { configured }, available },
+        ],
+      ),
+    ),
+    viewer: {
+      scene: { pickPositionSupported: true, pickPosition: () => picked },
+      camera: {
+        pickEllipsoid: () => ellipsoid,
+        positionCartographic: Cesium.Cartographic.fromDegrees(
+          -121.4944,
+          38.5816,
+          height,
+        ),
+      },
+    },
+  };
+  const openAtGround = createGroundClick({
+    state,
+    openNearest: (point, options) => {
+      opened.push({ point, options });
+      return Promise.resolve(true);
+    },
+    isAvailable: (entry) => entry.available,
+  });
+  return { opened, openAtGround };
+}
+
+const near = (point) =>
+  Math.abs(point.lon - -121.4944) < 1e-9 &&
+  Math.abs(point.lat - 38.5816) < 1e-9;
+
+test('a click on the map opens the click-to-open providers there, without moving the camera', () => {
+  for (const picked of [undefined, { primitive: TILESET }, { content: {} }]) {
+    const { opened, openAtGround } = harness();
+    openAtGround({ x: 10, y: 20 }, picked);
+    assert.equal(opened.length, 1, JSON.stringify(picked));
+    assert.ok(near(opened[0].point));
+    assert.deepEqual(opened[0].options, {
+      providerIds: ['google'],
+      frame: false,
+    });
+  }
+});
+
+test('where the depth buffer names no place, the ellipsoid answers', () => {
+  const { opened, openAtGround } = harness({
+    picked: new Cesium.Cartesian3(500, 0, 0),
+    ellipsoid: GROUND,
+  });
+  openAtGround({ x: 1, y: 1 });
+  assert.ok(near(opened[0].point));
+});
+
+test('nothing opens over another layer’s object, the sky, from high up, off its map stack, or with the provider off', () => {
+  const cases = [
+    { picked: { id: { id: 'flight:1' } }, label: 'an entity' },
+    { picked: { id: 'cctv:7', primitive: TILESET }, label: 'an id on a tile' },
+    { options: { picked: null, ellipsoid: undefined }, label: 'the sky' },
+    { options: { height: 5000 }, label: 'high up' },
+    {
+      options: {
+        providers: [{ id: 'google', groundClick: true, available: false }],
+      },
+      label: 'not Google 3D',
+    },
+    {
+      options: { providers: [{ id: 'google', groundClick: true, on: false }] },
+      label: 'off',
+    },
+    {
+      options: {
+        providers: [{ id: 'google', groundClick: true, configured: false }],
+      },
+      label: 'no key',
+    },
+    { options: { enabled: false }, label: 'layer off' },
+  ];
+  for (const { picked, options = {}, label } of cases) {
+    const { opened, openAtGround } = harness(options);
+    assert.equal(openAtGround({ x: 1, y: 1 }, picked), false, label);
+    assert.equal(opened.length, 0, label);
+  }
+});
+
+test('street zoom is measured above the ground under the camera', () => {
+  const viewer = (height) => ({
+    camera: {
+      positionCartographic: Cesium.Cartographic.fromDegrees(0, 0, height),
+    },
+    scene: { globe: { getHeight: () => 1500 } },
+  });
+  // 1,500 m up a plateau, 2,000 m above it: still a street.
+  assert.equal(groundClickHeightOk(viewer(3500)), true);
+  assert.equal(groundClickHeightOk(viewer(5000)), false);
+  assert.equal(groundClickHeightOk(null), false);
+});

src/layers/streetLevel/imageSize.js

@@ -0,0 +1,64 @@
+/**
+ * An image's pixel size read from its header, before anything decodes it:
+ * a picture host can serve a small file that declares enormous dimensions,
+ * and a decode of it alone can take the tab (or the GPU process) down.
+ * JPEG (SOFn), PNG (IHDR), WebP (VP8, VP8L, VP8X) and GIF; null for any
+ * other format, or a header this does not reach.
+ * @param {Uint8Array} bytes   The start of the file (a JPEG's EXIF can push its SOF past 64 kB).
+ * @returns {{width: number, height: number}|null}
+ */
+export function imageSize(bytes) {
+  if (!bytes || bytes.length < 12) return null;
+  const b = bytes;
+  const be16 = (i) => (b[i] << 8) | b[i + 1];
+  const le16 = (i) => b[i] | (b[i + 1] << 8);
+  const le24 = (i) => b[i] | (b[i + 1] << 8) | (b[i + 2] << 16);
+  const ascii = (i, text) =>
+    [...text].every((char, k) => b[i + k] === char.charCodeAt(0));
+  // JPEG: walk the markers to the first start-of-frame.
+  if (b[0] === 0xff && b[1] === 0xd8) {
+    let i = 2;
+    while (i + 9 < b.length) {
+      if (b[i] !== 0xff) return null;
+      const marker = b[i + 1];
+      // Fill bytes, and markers with no length.
+      if (marker === 0xff) {
+        i++;
+        continue;
+      }
+      if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd9)) {
+        i += 2;
+        continue;
+      }
+      const isFrame =
+        marker >= 0xc0 &&
+        marker <= 0xcf &&
+        marker !== 0xc4 &&
+        marker !== 0xc8 &&
+        marker !== 0xcc;
+      if (isFrame) return { width: be16(i + 7), height: be16(i + 5) };
+      i += 2 + be16(i + 2);
+    }
+    return null;
+  }
+  // PNG: IHDR is the first chunk.
+  if (b[0] === 0x89 && ascii(1, 'PNG') && ascii(12, 'IHDR')) {
+    const u32 = (i) =>
+      ((b[i] << 24) | (b[i + 1] << 16) | (b[i + 2] << 8) | b[i + 3]) >>> 0;
+    return { width: u32(16), height: u32(20) };
+  }
+  if (ascii(0, 'RIFF') && ascii(8, 'WEBP') && b.length >= 30) {
+    if (ascii(12, 'VP8 '))
+      return { width: le16(26) & 0x3fff, height: le16(28) & 0x3fff };
+    if (ascii(12, 'VP8L'))
+      return {
+        width: 1 + (((b[22] & 0x3f) << 8) | b[21]),
+        height:
+          1 + (((b[24] & 0x0f) << 10) | (b[23] << 2) | ((b[22] & 0xc0) >> 6)),
+      };
+    if (ascii(12, 'VP8X')) return { width: 1 + le24(24), height: 1 + le24(27) };
+    return null;
+  }
+  if (ascii(0, 'GIF8')) return { width: le16(6), height: le16(8) };
+  return null;
+}

src/layers/streetLevel/imageSize.test.mjs

@@ -0,0 +1,82 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { imageSize } from './imageSize.js';
+
+const bytes = (...parts) =>
+  Uint8Array.from(
+    parts.flat().map((v) => (typeof v === 'string' ? v.charCodeAt(0) : v)),
+  );
+const ascii = (text) => [...text];
+
+test('a JPEG’s size is read from its first frame, past an EXIF segment', () => {
+  const exif = [0xff, 0xe1, 0x00, 0x10, ...new Array(14).fill(0)];
+  const sof = [0xff, 0xc0, 0x00, 0x11, 0x08, 0x0b, 0xc0, 0x0f, 0xc0];
+  const jpeg = bytes([0xff, 0xd8], exif, sof, new Array(20).fill(0));
+  assert.deepEqual(imageSize(jpeg), { width: 0x0fc0, height: 0x0bc0 });
+  // Progressive (SOF2) too; a DHT (C4) is not a frame.
+  const dht = [0xff, 0xc4, 0x00, 0x04, 0, 0];
+  const sof2 = [0xff, 0xc2, 0x00, 0x11, 0x08, 0x00, 0x10, 0x00, 0x20];
+  assert.deepEqual(
+    imageSize(bytes([0xff, 0xd8], dht, sof2, new Array(10).fill(0))),
+    {
+      width: 32,
+      height: 16,
+    },
+  );
+});
+
+test('PNG, WebP (lossy, lossless, extended) and GIF sizes', () => {
+  const png = bytes(
+    [0x89],
+    ascii('PNG'),
+    [0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13],
+    ascii('IHDR'),
+    [0, 0, 0x10, 0, 0, 0, 0x08, 0],
+  );
+  assert.deepEqual(imageSize(png), { width: 4096, height: 2048 });
+  const riff = (chunk, rest) =>
+    bytes(ascii('RIFF'), [0, 0, 0, 0], ascii('WEBP'), ascii(chunk), rest);
+  const vp8 = riff('VP8 ', [...new Array(10).fill(0), 0x00, 0x08, 0x00, 0x04]);
+  assert.deepEqual(imageSize(vp8), { width: 2048, height: 1024 });
+  // VP8L: 14-bit width-1 and height-1 packed after the 0x2f signature.
+  const w = 99;
+  const h = 49;
+  const packed = w | (h << 14);
+  const vp8l = riff('VP8L', [
+    0,
+    0,
+    0,
+    0,
+    0x2f,
+    packed & 0xff,
+    (packed >> 8) & 0xff,
+    (packed >> 16) & 0xff,
+    (packed >> 24) & 0xff,
+    0,
+    0,
+    0,
+    0,
+    0,
+    0,
+  ]);
+  assert.deepEqual(imageSize(vp8l), { width: 100, height: 50 });
+  const vp8x = riff(
+    'VP8X',
+    [0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0x0f, 0x00, 0xff, 0x07, 0x00],
+  );
+  assert.deepEqual(imageSize(vp8x), { width: 4096, height: 2048 });
+  const gif = bytes(ascii('GIF89a'), [0x40, 0x01, 0xf0, 0x00], [0, 0]);
+  assert.deepEqual(imageSize(gif), { width: 320, height: 240 });
+});
+
+test('anything else, or a header cut short, has no size', () => {
+  assert.equal(imageSize(null), null);
+  assert.equal(imageSize(new Uint8Array(4)), null);
+  assert.equal(imageSize(bytes(ascii('<html><body>'))), null);
+  assert.equal(
+    imageSize(
+      bytes([0xff, 0xd8, 0xff, 0xe1, 0xff, 0xff], new Array(8).fill(0)),
+    ),
+    null,
+  );
+});

src/layers/streetLevel/index.js

@@ -1,3 +1,4 @@
+import * as Cesium from 'cesium';
 import { createState } from './state.js';
 import { createMarker } from './marker.js';
 import { createCameraFollow } from './cameraFollow.js';
@@ -5,17 +6,23 @@ import { createCredits } from './credits.js';
 import { createPickRouter } from './pickRouter.js';
 import { createSelection } from './selection.js';
 import { createViewerHost } from './viewerHost.js';
-import { requiresKeyIdFor, validateProviders } from './registry.js';
+import { filtersOf, requiresKeyIdFor, validateProviders } from './registry.js';
 import { normalizeFilter, resolveFilter, sameFilter } from './filter.js';
 import { decodeParams, encodeParams } from './params.js';
-import { composeUIState, summarizeCoverage } from './uiState.js';
+import {
+  composeUIState,
+  keyAlternatives,
+  summarizeCoverage,
+} from './uiState.js';
 import { cameraHeightAboveGround, viewCentre, whenIdle } from './view.js';
+import { createGroundClick, groundClickHeightOk } from './groundClick.js';
 import { createGroundCaster, nextSurfaceMode } from './groundCast.js';
 import { createMeshSampler } from './meshSampler.js';
 
 /** Above this camera height the ground under the camera is not worth fetching. */
 const SURFACE_WARM_BELOW_M = 6000;
 import {
+  AIM_AT_GROUND_MESSAGE,
   FOLLOW_MAP_STACK_ID,
   NEAREST_RADIUS_M,
   POSITION_PICK_ID,
@@ -66,6 +73,12 @@ export function createStreetLevelLayer({
       entry.instance.clearSequence?.();
   };
   parts.selection = createSelection(context);
+  parts.openAtGround = createGroundClick({
+    state,
+    openNearest: (point, options) => layer.openNearest(point, options),
+    isAvailable: (entry) => providerAvailable(entry),
+    groundAt: parts.groundCaster?.groundAt ?? null,
+  });
 
   let notifyQueued = false;
   function notify() {
@@ -95,7 +108,15 @@ export function createStreetLevelLayer({
       getSurface: () => state.surface,
       notify,
       actions: {
-        openImage: (imageId) => openImage(entry.def.id, imageId),
+        /** `{frame: false}` opens it without moving the camera. */
+        openImage: (imageId, options) =>
+          openImage(entry.def.id, imageId, options),
+        /** This provider's image nearest a point the user picked on the map. */
+        openNearest: (point) =>
+          layer.openNearest(point, {
+            providerIds: [entry.def.id],
+            frame: false,
+          }),
         /**
          * Show a provider error, or withdraw it (null). A withdrawal clears
          * only this provider's own error, never a newer one from elsewhere.
@@ -115,11 +136,13 @@ export function createStreetLevelLayer({
     });
   }
 
+  // One source at a time: the first provider that defaults on.
+  const startsOn = definitionsFrozen.find((def) => def.defaultOn !== false);
   for (const def of definitionsFrozen) {
     const entry = {
       def,
       instance: null,
-      on: true,
+      on: def === startsOn,
       status: null,
       /** The error this provider last reported, until it withdraws it. */
       reportedError: null,
@@ -140,6 +163,39 @@ export function createStreetLevelLayer({
     notify();
   }
 
+  /** Usable only on its map stack (Google's terms: Street View on Google 3D only). */
+  function providerAvailable(entry) {
+    const required = entry.def.requiresMapStack;
+    return !required || mapStack?.getActiveId?.() === required;
+  }
+
+  /** Leaving a provider's map stack closes its image, viewer and credit. */
+  function syncProviderAvailability() {
+    const owner = state.providers.get(state.street.providerId);
+    if (state.street.open && owner && !providerAvailable(owner))
+      layer.closeViewer();
+    for (const entry of state.providers.values()) {
+      if (!entry.def.requiresMapStack) continue;
+      if (state.enabled && entry.on && providerAvailable(entry))
+        parts.credits.show(state.viewer, entry.def);
+      else {
+        parts.credits.hide(state.viewer, entry.def);
+        parts.viewerHost.unmount(entry.def.id);
+      }
+    }
+    notify();
+  }
+
+  /** Whether a ground click can open an image: the camera is at street zoom. */
+  function syncGroundClickReady() {
+    const ready =
+      state.enabled &&
+      groundClickHeightOk(state.viewer, parts.groundCaster?.groundAt);
+    if (ready === state.groundClickReady) return;
+    state.groundClickReady = ready;
+    notify();
+  }
+
   /**
    * Camera height above bare earth, for the surface mode. A cold grid cell is
    * fetched once and the mode rechecked when it lands.
@@ -162,6 +218,7 @@ export function createStreetLevelLayer({
 
   /** Cast overlays to bare earth on Google 3D at street zoom; drape them elsewhere. */
   function syncSurface() {
+    syncGroundClickReady();
     const available = Boolean(parts.groundCaster) && state.enabled;
     const photoreal = mapStack?.getActiveId?.() === FOLLOW_MAP_STACK_ID;
     const mode = nextSurfaceMode(state.surface, {
@@ -222,9 +279,13 @@ export function createStreetLevelLayer({
   function activate(entry) {
     if (!state.viewer) return;
     entry.instance.activate(state.viewer);
-    parts.credits.show(state.viewer, entry.def);
     if (!entry.status) refreshStatus(entry);
-    whenIdle(() => parts.viewerHost.prewarm([entry]), 1500);
+    if (!providerAvailable(entry)) return;
+    parts.credits.show(state.viewer, entry.def);
+    // The map may have changed by then.
+    whenIdle(() => {
+      if (providerAvailable(entry)) parts.viewerHost.prewarm([entry]);
+    }, 1500);
   }
 
   function deactivate(entry) {
@@ -241,25 +302,101 @@ export function createStreetLevelLayer({
     nearestLookup = null;
   }
 
-  function openImage(providerId, imageId) {
-    abortNearest();
-    return parts.viewerHost.open(providerId, imageId);
+  /** Ground under the screen centre; null for sky, undefined when it cannot aim. */
+  function screenCentreGround() {
+    const canvas = state.viewer?.scene?.canvas;
+    const pick = state.services.scenePick?.pickGroundPosition;
+    if (!pick || !canvas?.clientWidth || !canvas?.clientHeight)
+      return undefined;
+    const position = pick(state.viewer, {
+      x: canvas.clientWidth / 2,
+      y: canvas.clientHeight / 2,
+    });
+    const carto = position && Cesium.Cartographic.fromCartesian(position);
+    return carto
+      ? {
+          lon: Cesium.Math.toDegrees(carto.longitude),
+          lat: Cesium.Math.toDegrees(carto.latitude),
+        }
+      : null;
   }
 
+  /** `frame: false` keeps the camera where it is (the user picked the spot). */
+  function openImage(providerId, imageId, { frame = true } = {}) {
+    abortNearest();
+    const entry = state.providers.get(providerId);
+    if (entry && !providerAvailable(entry)) {
+      state.street.loading = false;
+      state.street.error = unavailableReason(entry);
+      notify();
+      return Promise.resolve(false);
+    }
+    return parts.viewerHost.open(providerId, imageId, { frame });
+  }
+
+  function unavailableReason(entry) {
+    return `${entry.def.name} needs the Google 3D map: choose it under MAP SOURCE`;
+  }
+
+  /** One imagery source at a time: lighting a provider darkens the others. */
   function setProviderEnabled(providerId, on) {
     const entry = state.providers.get(providerId);
     if (!entry) return false;
+    const before = litIds();
     const next = on !== false;
-    if (entry.on === next) return true;
-    entry.on = next;
-    if (state.enabled) {
-      if (next) activate(entry);
-      else deactivate(entry);
-    }
+    if (next)
+      for (const other of state.providers.values())
+        if (other !== entry && other.on) switchProvider(other, false);
+    switchProvider(entry, next);
+    sourceChanged(before);
     notify();
     return true;
   }
 
+  const litIds = () =>
+    [...state.providers]
+      .filter(([, entry]) => entry.on)
+      .map(([id]) => id)
+      .join();
+
+  /**
+   * After a chip, voice or a link changed the lit source: a lookup still
+   * running and its spinner or error were about the source switched away
+   * (an open photo keeps its own state).
+   */
+  function sourceChanged(before) {
+    if (litIds() === before) return;
+    abortNearest();
+    if (state.street.open) return;
+    state.street.error = null;
+    state.street.loading = false;
+  }
+
+  function switchProvider(entry, on) {
+    if (entry.on === on) return;
+    entry.on = on;
+    if (!state.enabled) return;
+    if (on) activate(entry);
+    else deactivate(entry);
+  }
+
+  /**
+   * The one provider params leave lit: of those they switch on, the one
+   * already on (reapplying never flips), else the first; with none, the lit
+   * one unless they switch it off.
+   */
+  function litByParams(switches) {
+    const asked = [...state.providers.keys()].filter(
+      (id) => switches.get(id) === true,
+    );
+    const current = [...state.providers]
+      .filter(([, entry]) => entry.on)
+      .map(([id]) => id);
+    if (asked.length)
+      return asked.find((id) => current.includes(id)) ?? asked[0];
+    return current.find((id) => switches.get(id) !== false) ?? null;
+  }
+
   function setCoverageFilter(next) {
     const filter = normalizeFilter(next, state.filter);
     if (sameFilter(filter, state.filter)) return;
@@ -270,8 +407,19 @@ export function createStreetLevelLayer({
     notify();
   }
 
+  /** The hint a ground-click provider shows, or the provider's own. */
+  function hintFor(entry, stats) {
+    if (entry.def.groundClick && stats.hint && !state.groundClickReady)
+      return `zoom in to a street to open ${entry.def.name}`;
+    return stats.hint || '';
+  }
+
+  /** Providers usable on this map stack; the others are not shown at all. */
+  const listedEntries = () =>
+    [...state.providers.values()].filter((entry) => providerAvailable(entry));
+
   function providerSnapshots() {
-    return [...state.providers.values()].map((entry) => {
+    return listedEntries().map((entry) => {
       const stats = entry.instance.coverageStats();
       return {
         id: entry.def.id,
@@ -285,9 +433,14 @@ export function createStreetLevelLayer({
         requiresKeyId: entry.def.requiresKeyId || null,
         loading: stats.loading === true,
         count: stats.count || 0,
-        hint: stats.hint || '',
+        hint: hintFor(entry, stats),
         error: stats.error || null,
         color: entry.def.colors.coverage,
+        coverageLabel: entry.def.coverageLabel || null,
+        highlightsSequence: entry.def.highlightsSequence !== false,
+        sinceBasis: entry.def.sinceBasis === 'upload' ? 'upload' : 'capture',
+        groundClick: entry.def.groundClick === true,
+        filters: [...filtersOf(entry.def)],
       };
     });
   }
@@ -313,24 +466,43 @@ export function createStreetLevelLayer({
 
   function getUIState() {
     const { host, ...street } = state.street;
-    return composeUIState({
+    const ui = composeUIState({
       enabled: state.enabled,
+      groundClickReady: state.groundClickReady,
       filter: state.filter,
       providers: providerSnapshots(),
       street,
       sequence: sequenceSnapshot(),
       surface: state.surface,
     });
+    // The lit source cannot run on this map: say so, not a blank panel.
+    const stranded = [...state.providers.values()].find(
+      (entry) => entry.on && !providerAvailable(entry),
+    );
+    if (stranded && !ui.providers.some((p) => p.on))
+      ui.coverage.hint = unavailableReason(stranded);
+    return ui;
   }
 
   const layer = {
     id: STREET_LEVEL_LAYER_ID,
     name: 'Street Level',
     icon: '📷',
-    source: definitionsFrozen.map((def) => def.name).join(' · '),
+    /** The sources usable on this map (Street View only on Google 3D). */
+    get source() {
+      return listedEntries()
+        .map((entry) => entry.def.name)
+        .join(' · ');
+    },
     updateInterval: 0,
     statsRefreshInterval: 1000,
-    requiresKeyId: requiresKeyIdFor(definitionsFrozen),
+    /** The key the switched-on providers share (or null), for the layer row. */
+    get requiresKeyId() {
+      const on = [...state.providers.values()].filter((entry) => entry.on);
+      return requiresKeyIdFor(
+        on.length ? on.map((entry) => entry.def) : definitionsFrozen,
+      );
+    },
     /** Registered providers, in chip order. */
     providerIds: definitionsFrozen.map((def) => def.id),
     getSourceAvailability() {
@@ -404,16 +576,19 @@ export function createStreetLevelLayer({
 
     getStats() {
       // The lifecycle polls this every second: summarise, don't snapshot.
-      const coverage = summarizeCoverage(providerSnapshots());
+      const snapshots = providerSnapshots();
+      const coverage = summarizeCoverage(snapshots);
       let loadingLabel = '';
       const keyLabel = coverage.keyRejected ? 'KEY REJECTED' : 'KEY REQUIRED';
       if (coverage.keyRequired) loadingLabel = keyLabel;
       else if (coverage.loading) loadingLabel = 'loading coverage...';
       else if (coverage.hint && state.enabled) loadingLabel = coverage.hint;
       return {
+        source: layer.source,
         count: coverage.count,
         loading: coverage.loading,
         keyRequired: coverage.keyRequired,
+        keyAlternatives: keyAlternatives(snapshots),
         error: coverage.keyRequired
           ? coverage.keyRejected
             ? coverage.error || keyLabel
@@ -441,9 +616,11 @@ export function createStreetLevelLayer({
       unsubscribeMapStack =
         mapStack?.subscribe?.(() => {
           syncFollowAvailability();
+          syncProviderAvailability();
           syncSurface();
         }) || null;
       syncFollowAvailability();
+      syncProviderAvailability();
       syncSurface();
     },
 
@@ -460,7 +637,13 @@ export function createStreetLevelLayer({
         providerIds: state.providers.keys(),
         filter: state.filter,
       });
-      for (const [id, on] of decoded.providers) setProviderEnabled(id, on);
+      const lit = litByParams(decoded.providers);
+      const before = litIds();
+      for (const [id, entry] of state.providers)
+        if (id !== lit) switchProvider(entry, false);
+      if (lit) switchProvider(state.providers.get(lit), true);
+      sourceChanged(before);
+      notify();
       setCoverageFilter(decoded.filter);
       return true;
     },
@@ -476,15 +659,39 @@ export function createStreetLevelLayer({
     attachViewerHost(element) {
       parts.viewerHost.attach(element);
       if (element && state.enabled)
-        whenIdle(() => parts.viewerHost.prewarm(activeEntries()), 1500);
+        whenIdle(
+          () =>
+            parts.viewerHost.prewarm(
+              activeEntries().filter((entry) => providerAvailable(entry)),
+            ),
+          1500,
+        );
     },
     setProviderEnabled,
     /** Imagery filter for coverage, cones and nearest-image lookups. */
     setCoverageFilter,
     openImage,
-    /** Open the nearest image any active provider has around a point. */
-    async openNearest(point) {
-      const view = point || viewCentre(state.viewer);
+    /**
+     * Open the nearest image of the active providers (or `providerIds`) near
+     * a point, else the view centre, or with `aim: 'screen-centre'` the ground
+     * under the screen centre (sky: nothing).
+     */
+    async openNearest(
+      point,
+      { providerIds = null, frame = true, aim = 'view' } = {},
+    ) {
+      let view = point;
+      if (!view && aim === 'screen-centre') {
+        view = screenCentreGround();
+        if (view === null) {
+          abortNearest();
+          state.street.loading = false;
+          state.street.error = AIM_AT_GROUND_MESSAGE;
+          notify();
+          return false;
+        }
+      }
+      view ||= viewCentre(state.viewer);
       if (!Number.isFinite(view?.lat) || !Number.isFinite(view?.lon))
         return false;
       abortNearest();
@@ -495,7 +702,11 @@ export function createStreetLevelLayer({
       state.street.error = null;
       notify();
       let lastError = null;
-      for (const entry of activeEntries()) {
+      const asked = (entry) =>
+        (!providerIds || providerIds.includes(entry.def.id)) &&
+        providerAvailable(entry);
+      const entries = activeEntries().filter(asked);
+      for (const entry of entries) {
         let imageId = null;
         try {
           imageId = await entry.instance.nearestImage(
@@ -511,17 +722,20 @@ export function createStreetLevelLayer({
         }
         if (signal.aborted) return false;
         if (!state.enabled) break;
-        // This provider was switched off while it looked: try the next.
-        if (!imageId || !entry.on) continue;
+        // Switched off, or its map left, while it looked: try the next.
+        if (!imageId || !entry.on || !providerAvailable(entry)) continue;
         nearestLookup = null;
-        return openImage(entry.def.id, imageId);
+        return openImage(entry.def.id, imageId, { frame });
       }
       if (nearestLookup === lookup) nearestLookup = null;
       // Switched off while it looked: nothing to open, nothing to report.
-      if (state.enabled && activeEntries().length)
+      const stillOn = entries.some(
+        (entry) => entry.on && providerAvailable(entry),
+      );
+      if (state.enabled && stillOn)
         state.street.error =
           lastError?.message ||
-          `No street-level imagery within ${NEAREST_RADIUS_M} m of the view centre`;
+          `No street-level imagery within ${NEAREST_RADIUS_M} m of ${point ? 'that point' : 'the view centre'}`;
       state.street.loading = false;
       notify();
       return false;

src/layers/streetLevel/index.test.mjs

@@ -4,6 +4,7 @@ import * as Cesium from 'cesium';
 import { createStreetLevelLayer } from './index.js';
 import { MAPILLARY_CREDIT_HTML } from './providers/mapillary/policy.js';
 import { createMapillaryProvider } from './providers/mapillary/index.js';
+import { createKartaViewProvider } from './providers/kartaview/index.js';
 import { fakeStreetLevelProvider as fakeProvider } from '../../testSupport/streetLevelFakes.mjs';
 
 /**
@@ -92,8 +93,8 @@ function deferred() {
 }
 
 /** A provider whose viewer reports a pose for every image it opens. */
-function posingProvider() {
-  const provider = fakeProvider();
+function posingProvider(options) {
+  const provider = fakeProvider(options);
   const create = provider.create;
   provider.create = (context) => {
     const instance = create(context);
@@ -483,6 +484,328 @@ test('switching a provider on while the layer is off activates nothing (M01)', a
   assert.equal(viewer.credits.length, 1);
 });
 
+/** The real Google provider over the Street View fakes, beside a Mapillary stand-in. */
+async function withStreetView(
+  t,
+  { mapStack = 'photoreal', nearest, mapillaryKeyless = false } = {},
+) {
+  const { createGoogleProvider } = await import('./providers/google/index.js');
+  const { fakeHost, fakeMapsLoader, fakeStreetViewLibrary } =
+    await import('../../testSupport/googleStreetViewFakes.mjs');
+  const fake = fakeStreetViewLibrary({
+    panoramas: {
+      'pano-a': { lat: 38.5816, lng: -121.4944, imageDate: '2024-05' },
+    },
+    nearest: nearest ?? (() => 'pano-a'),
+  });
+  const mapillaryLookups = [];
+  const mapillary = fakeProvider({
+    nearestImage: async (point) => {
+      mapillaryLookups.push(point);
+      return null;
+    },
+  });
+  mapillary.requiresKeyId = 'mapillary';
+  if (mapillaryKeyless) {
+    mapillary.stats.keyRequired = true;
+    const create = mapillary.create;
+    mapillary.create = (context) => ({
+      ...create(context),
+      status: async () => ({ configured: false }),
+    });
+  }
+  const loader = fakeMapsLoader(fake.library);
+  const google = createGoogleProvider({
+    getApiKey: () => 'browser-key',
+    loader,
+  });
+  const { layer, viewer } = await enabledLayer(t, [mapillary, google]);
+  const stack = fakeMapStack(mapStack);
+  layer.attachMapStackController(stack);
+  layer.attachViewerHost(fakeHost());
+  return { layer, viewer, stack, fake, loader, mapillaryLookups };
+}
+
+test('Street View starts off, and the layer row names the key of the providers that are on', async (t) => {
+  const { layer } = await withStreetView(t);
+  const google = () =>
+    layer.getUIState().providers.find((p) => p.id === 'google');
+  assert.equal(google().on, false);
+  assert.equal(layer.requiresKeyId, 'mapillary');
+  layer.setProviderEnabled('google', true);
+  assert.equal(layer.requiresKeyId, 'google-maps', 'Street View alone');
+});
+
+test('the layer starts with one source lit: the first that defaults on', async (t) => {
+  const { layer } = await enabledLayer(t, [
+    fakeProvider(),
+    fakeProvider({ id: 'panoramax', pickPrefix: 'pmx:' }),
+  ]);
+  assert.deepEqual(
+    layer
+      .getUIState()
+      .providers.filter((p) => p.on)
+      .map((p) => p.id),
+    ['mapillary'],
+  );
+});
+
+test('leaving Google 3D during a Street View lookup ends it without an error or a stuck spinner', async (t) => {
+  const { layer, stack, fake } = await withStreetView(t);
+  layer.setProviderEnabled('google', true);
+  let answer;
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    new Promise((resolve) => {
+      answer = resolve;
+    });
+  const opening = layer.openNearest({ lat: 38.5816, lon: -121.4944 });
+  await settle();
+  assert.equal(layer.getUIState().street.loading, true);
+  stack.switchTo('bing');
+  answer({ data: { location: { pano: 'pano-a' }, imageDate: '2024-05' } });
+  assert.equal(await opening, false);
+  const { street } = layer.getUIState();
+  assert.equal(street.loading, false, 'OPEN STREET VIEW is usable again');
+  assert.equal(street.error, null);
+  assert.equal(street.open, false);
+});
+
+test('a source swap during a lookup reports no false "no imagery"', async (t) => {
+  let answer;
+  const mapillary = fakeProvider({
+    nearestImage: () =>
+      new Promise((resolve) => {
+        answer = resolve;
+      }),
+  });
+  const other = fakeProvider({ id: 'panoramax', pickPrefix: 'pmx:' });
+  const { layer } = await enabledLayer(t, [mapillary, other]);
+  const opening = layer.openNearest({ lat: 1, lon: 2 });
+  layer.setProviderEnabled('panoramax', true);
+  answer('img-1');
+  assert.equal(await opening, false);
+  assert.equal(layer.getUIState().street.error, null);
+  assert.equal(layer.getUIState().street.loading, false);
+});
+
+test('Street View lit off Google 3D says why the panel is empty', async (t) => {
+  const { layer, stack } = await withStreetView(t);
+  layer.setProviderEnabled('google', true);
+  stack.switchTo('esri-imagery');
+  assert.match(
+    layer.getUIState().coverage.hint,
+    /Google Street View needs the Google 3D map/,
+  );
+  layer.setProviderEnabled('mapillary', true);
+  assert.doesNotMatch(layer.getUIState().coverage.hint, /Google 3D/);
+});
+
+test('one imagery source at a time: lighting one darkens the other, either way', async (t) => {
+  const { layer } = await withStreetView(t);
+  const lit = () =>
+    layer
+      .getUIState()
+      .providers.filter((p) => p.on)
+      .map((p) => p.id);
+  assert.deepEqual(lit(), ['mapillary'], 'Mapillary by default: it is free');
+  layer.setProviderEnabled('google', true);
+  assert.deepEqual(lit(), ['google']);
+  assert.equal(layer.getParams().mapillary, false);
+  layer.setProviderEnabled('mapillary', true);
+  assert.deepEqual(lit(), ['mapillary']);
+  assert.equal(layer.getParams().google, false);
+  // Params that light one switch to it; reapplying them changes nothing.
+  layer.setParams({ google: true });
+  assert.deepEqual(lit(), ['google']);
+  layer.setParams({ google: true });
+  assert.deepEqual(lit(), ['google']);
+  // Params lighting both keep the one already on, however often applied.
+  for (let i = 0; i < 2; i++) {
+    layer.setParams({ mapillary: true, providerSwitches: 'google-1' });
+    assert.deepEqual(lit(), ['google']);
+  }
+  layer.setParams({ mapillary: true, google: false });
+  assert.deepEqual(lit(), ['mapillary']);
+  // Filter-only params leave the source alone.
+  layer.setParams({ pano: 'pano' });
+  assert.deepEqual(lit(), ['mapillary']);
+  // Darkening the only lit one leaves none: the panel turns the layer off.
+  layer.setProviderEnabled('mapillary', false);
+  assert.deepEqual(lit(), []);
+});
+
+test('Street View appears only on the Google 3D map: chip, legend, credit, source and images', async (t) => {
+  const { layer, viewer, stack } = await withStreetView(t, {
+    mapStack: 'esri-imagery',
+  });
+  layer.setProviderEnabled('google', true);
+  await settle();
+  const ui = () => layer.getUIState();
+  const listed = () => ui().providers.map((p) => p.id);
+  const credited = () =>
+    viewer.credits.some((credit) => /Street View imagery/.test(credit.html));
+  assert.deepEqual(listed(), ['mapillary'], 'no Street View chip');
+  assert.ok(!ui().legend.some((item) => item.key === 'google'));
+  assert.equal(credited(), false, 'no Google credit on another map');
+  assert.equal(layer.source, 'Mapillary');
+  assert.equal(layer.getStats().source, 'Mapillary');
+  assert.equal(await layer.openImage('google', 'pano-a'), false);
+  assert.match(ui().street.error, /needs the Google 3D map/);
+  assert.equal(layer.getParams().google, true, 'the choice is kept');
+
+  stack.switchTo('photoreal');
+  assert.deepEqual(listed(), ['mapillary', 'google']);
+  assert.equal(credited(), true);
+  assert.equal(layer.source, 'Mapillary · Google Street View');
+  assert.equal(await layer.openImage('google', 'pano-a'), true);
+  assert.equal(ui().street.providerId, 'google');
+
+  stack.switchTo('bing');
+  await settle();
+  assert.equal(ui().street.open, false, 'closed with the map');
+  assert.equal(credited(), false);
+  assert.deepEqual(listed(), ['mapillary']);
+});
+
+test('the UI state says when a click (or the button) can open Street View here', async (t) => {
+  const { layer } = await withStreetView(t);
+  assert.equal(typeof layer.getUIState().groundClickReady, 'boolean');
+});
+
+test('a lookup for the click-to-open providers asks only them and reports "that point"', async (t) => {
+  const { layer, mapillaryLookups } = await withStreetView(t, {
+    nearest: () => null,
+  });
+  layer.setProviderEnabled('google', true);
+  await settle();
+  const opened = await layer.openNearest(
+    { lat: 38.58, lon: -121.49 },
+    { providerIds: ['google'], frame: false },
+  );
+  assert.equal(opened, false);
+  assert.deepEqual(mapillaryLookups, [], 'Mapillary was not asked');
+  assert.equal(
+    layer.getUIState().street.error,
+    'No street-level imagery within 50 m of that point',
+  );
+});
+
+test('an image opened from a ground click leaves the camera where it is', async (t) => {
+  const { layer, viewer } = await withStreetView(t);
+  layer.setProviderEnabled('google', true);
+  await settle();
+  await layer.openNearest(
+    { lat: 38.58, lon: -121.49 },
+    { providerIds: ['google'], frame: false },
+  );
+  assert.equal(layer.getUIState().street.imageId, 'pano-a');
+  assert.equal(viewer.flights.started, 0, 'no framing flight');
+});
+
+test('off Google 3D not even Google\u2019s script is loaded for Street View', async (t) => {
+  const { layer, loader } = await withStreetView(t, {
+    mapStack: 'esri-imagery',
+  });
+  layer.setProviderEnabled('google', true);
+  layer.attachViewerHost({ ownerDocument: { createElement: () => ({}) } });
+  await new Promise((resolve) => setTimeout(resolve, 100));
+  assert.deepEqual(loader.imports, [], 'no prewarm, no lookup');
+});
+
+test('the button’s “centre of the view” is the ground under the middle of the screen', async (t) => {
+  const { createStreetLevelLayer: create } = await import('./index.js');
+  const scenePick = await import('../../data/scenePick.js');
+  const lookups = [];
+  const provider = fakeProvider({
+    nearestImage: async (point) => {
+      lookups.push(point);
+      return null;
+    },
+  });
+  const saved = globalThis.document;
+  const drawing = new Proxy({}, { get: () => () => ({ addColorStop() {} }) });
+  globalThis.document = Object.assign(new EventTarget(), {
+    createElement: () => ({ getContext: () => drawing }),
+  });
+  const viewer = fakeViewer();
+  const centre = Cesium.Cartesian3.fromDegrees(-121.4937, 38.5799, 0);
+  Object.assign(viewer.scene, {
+    pickPositionSupported: true,
+    pickPosition: (at) => (at.x === 500 && at.y === 300 ? centre : undefined),
+  });
+  viewer.scene.canvas.clientWidth = 1000;
+  viewer.scene.canvas.clientHeight = 600;
+  const layer = create({ providers: [provider], services: { scenePick } });
+  layer.init(viewer);
+  layer.enable(viewer);
+  t.after(() => {
+    layer.destroy();
+    globalThis.document = saved;
+  });
+  await layer.openNearest(undefined, { aim: 'screen-centre' });
+  assert.equal(lookups.length, 1);
+  assert.ok(Math.abs(lookups[0].lat - 38.5799) < 1e-9);
+  assert.ok(Math.abs(lookups[0].lon - -121.4937) < 1e-9);
+});
+
+test('the button aimed at the sky opens nothing, and says to aim at a street', async (t) => {
+  const { createStreetLevelLayer: create } = await import('./index.js');
+  const scenePick = await import('../../data/scenePick.js');
+  const lookups = [];
+  const provider = fakeProvider({
+    nearestImage: async (point) => {
+      lookups.push(point);
+      return null;
+    },
+  });
+  const saved = globalThis.document;
+  const drawing = new Proxy({}, { get: () => () => ({ addColorStop() {} }) });
+  globalThis.document = Object.assign(new EventTarget(), {
+    createElement: () => ({ getContext: () => drawing }),
+  });
+  const viewer = fakeViewer();
+  // Every ground pick misses: the middle of the screen is sky.
+  Object.assign(viewer.scene, {
+    pickPositionSupported: true,
+    pickPosition: () => undefined,
+  });
+  viewer.camera.pickEllipsoid = () => undefined;
+  viewer.scene.canvas.clientWidth = 1000;
+  viewer.scene.canvas.clientHeight = 600;
+  const layer = create({ providers: [provider], services: { scenePick } });
+  layer.init(viewer);
+  layer.enable(viewer);
+  t.after(() => {
+    layer.destroy();
+    globalThis.document = saved;
+  });
+  assert.equal(
+    await layer.openNearest(undefined, { aim: 'screen-centre' }),
+    false,
+  );
+  assert.deepEqual(lookups, [], 'no lookup at the view centre instead');
+  const { street } = layer.getUIState();
+  assert.match(street.error, /Aim the middle of the view at a street/);
+  assert.equal(street.loading, false);
+});
+
+test('with no Mapillary token, the layer points at Street View, on Google 3D only', async (t) => {
+  const { layer, stack } = await withStreetView(t, { mapillaryKeyless: true });
+  await settle();
+  const stats = layer.getStats();
+  assert.equal(stats.keyRequired, true);
+  assert.deepEqual(stats.keyAlternatives, [
+    { id: 'google', label: 'GOOGLE STREET VIEW', requiresKeyId: 'google-maps' },
+  ]);
+  assert.deepEqual(layer.getUIState().keyAlternatives, stats.keyAlternatives);
+  stack.switchTo('esri-imagery');
+  assert.deepEqual(layer.getStats().keyAlternatives, [], 'not off Google 3D');
+  // Lit, Street View draws: the layer is no longer key-gated.
+  stack.switchTo('photoreal');
+  layer.setProviderEnabled('google', true);
+  assert.equal(layer.getStats().keyRequired, false);
+});
+
 test('an empty provider composition enables and tears down without acquiring imagery', async (t) => {
   const { layer, viewer } = await enabledLayer(t, []);
   assert.deepEqual(layer.providerIds, []);
@@ -496,3 +819,127 @@ test('an empty provider composition enables and tears down without acquiring ima
   layer.enable(viewer);
   assert.deepEqual(layer.getUIState().providers, []);
 });
+
+test('a failed lookup’s error goes when another source is lit; a provider can open an image without framing', async (t) => {
+  const failing = fakeProvider({
+    nearestImage: async () => {
+      throw new Error('KartaView did not answer in time — try again');
+    },
+  });
+  const other = fakeProvider({ id: 'other', pickPrefix: 'oth:' });
+  const { layer, viewer } = await enabledLayer(t, [failing, other]);
+  layer.attachViewerHost({});
+  await layer.openNearest({ lat: 1, lon: 1 });
+  assert.match(layer.getUIState().street.error, /did not answer/);
+  layer.setProviderEnabled('other', true);
+  await settle();
+  assert.equal(layer.getUIState().street.error, null);
+  // A provider's own open (KartaView's ‹ ›) can leave the camera alone.
+  await other.context().actions.openImage('img-1', { frame: false });
+  assert.deepEqual(other.calls.open, ['img-1']);
+  assert.equal(viewer.flights.started, 0);
+});
+
+test('a provider’s own open can leave the camera where it is; a default open frames', async (t) => {
+  const provider = posingProvider();
+  const { layer, viewer } = await enabledLayer(t, [provider]);
+  layer.attachViewerHost({});
+  await provider.context().actions.openImage('img-1', { frame: false });
+  assert.deepEqual(provider.calls.open, ['img-1']);
+  assert.equal(viewer.flights.started, 0, 'frame: false keeps the camera');
+  await provider.context().actions.openImage('img-2');
+  assert.equal(viewer.flights.started, 1, 'a default open frames the image');
+});
+
+test('a provider’s openNearest (a line click) asks only that provider and leaves the camera', async (t) => {
+  const lit = posingProvider({ nearestImage: async () => 'lit-near' });
+  const other = fakeProvider({
+    id: 'other',
+    pickPrefix: 'oth:',
+    nearestImage: async () => 'other-near',
+  });
+  const { layer, viewer } = await enabledLayer(t, [lit, other]);
+  layer.attachViewerHost({});
+  const point = { lat: 38.58, lon: -121.49 };
+  // The other source is off: its click asks nobody else.
+  await other.context().actions.openNearest(point);
+  await settle();
+  assert.deepEqual(lit.calls.open, [], 'the lit source was not asked');
+  assert.deepEqual(other.calls.open, []);
+  await lit.context().actions.openNearest(point);
+  assert.deepEqual(lit.calls.open, ['lit-near']);
+  assert.equal(viewer.flights.started, 0, 'the user picked the spot');
+});
+
+test('KartaView through the core: its own swatch without Selected, its lines counted as streets', async (t) => {
+  const kartaView = createKartaViewProvider({
+    source: {
+      getTile: async () => ({ lines: [] }),
+      nearestPhotos: async () => [],
+      getPhoto: async () => {
+        throw new Error('KartaView has no such photo');
+      },
+      getSequencePhotos: async () => ({ photos: [], hasMore: false }),
+      probeImage: async () => true,
+    },
+  });
+  const { layer } = await enabledLayer(t, [kartaView]);
+  layer.setProviderEnabled('kartaview', true);
+  await settle();
+  const ui = layer.getUIState();
+  assert.deepEqual(
+    ui.legend.map((entry) => entry.key),
+    ['kartaview'],
+  );
+  assert.equal(ui.coverage.label?.noun, 'streets');
+  assert.equal(
+    ui.providers.find((p) => p.id === 'kartaview').highlightsSequence,
+    false,
+  );
+});
+
+test('switching source by params (the chip path) stops a running lookup and clears its spinner and error', async (t) => {
+  const slow = slowLookups();
+  const looking = fakeProvider({ nearestImage: slow.nearestImage });
+  const other = fakeProvider({ id: 'other', pickPrefix: 'oth:' });
+  const { layer } = await enabledLayer(t, [looking, other]);
+  layer.attachViewerHost({});
+  const opening = layer.openNearest({ lat: 1, lon: 1 });
+  await settle();
+  assert.equal(layer.getUIState().street.loading, true);
+  layer.setParams({ mapillary: false, other: true });
+  assert.equal(slow.lookups[0].signal.aborted, true, 'the lookup is stopped');
+  assert.equal(
+    layer.getUIState().street.loading,
+    false,
+    'no spinner left behind',
+  );
+  // The stopped lookup answers late: nothing opens, nothing is reported.
+  slow.lookups[0].answer.resolve('img1');
+  assert.equal(await opening, false);
+  assert.deepEqual(looking.calls.open, []);
+  assert.equal(layer.getUIState().street.error, null);
+});
+
+test('switching source by params clears a failed lookup’s error; reapplying the same switches does not', async (t) => {
+  const failing = fakeProvider({
+    nearestImage: async () => {
+      throw new Error('KartaView did not answer in time — try again');
+    },
+  });
+  const { layer: second } = await enabledLayer(t, [
+    failing,
+    fakeProvider({ id: 'other', pickPrefix: 'oth:' }),
+  ]);
+  second.attachViewerHost({});
+  await second.openNearest({ lat: 1, lon: 1 });
+  assert.match(second.getUIState().street.error, /did not answer/);
+  second.setParams({ mapillary: false, other: true });
+  assert.equal(second.getUIState().street.error, null);
+  // Reapplying the same switches (a restore) leaves state alone.
+  await second.openNearest({ lat: 1, lon: 1 });
+  const kept = second.getUIState().street.error;
+  assert.match(kept, /No street-level imagery/);
+  second.setParams({ mapillary: false, other: true });
+  assert.equal(second.getUIState().street.error, kept);
+});

src/layers/streetLevel/limiter.js

@@ -0,0 +1,49 @@
+/**
+ * A gate letting at most `limit` tasks run at once, first in first out, or
+ * newest first with `lifo` (the last request is the one the user waits on).
+ */
+export function createLimiter(limit, { lifo = false } = {}) {
+  let running = 0;
+  const queue = [];
+  function next() {
+    while (running < limit && queue.length) {
+      const { task, resolve, reject, signal } = lifo
+        ? queue.pop()
+        : queue.shift();
+      if (signal?.aborted) {
+        reject(signal.reason);
+        continue;
+      }
+      running++;
+      Promise.resolve()
+        .then(task)
+        .then(resolve, reject)
+        .finally(() => {
+          running--;
+          next();
+        });
+    }
+  }
+  return {
+    run(task, { signal } = {}) {
+      return new Promise((resolve, reject) => {
+        const item = { task, resolve, reject, signal };
+        queue.push(item);
+        signal?.addEventListener(
+          'abort',
+          () => {
+            const at = queue.indexOf(item);
+            if (at === -1) return;
+            queue.splice(at, 1);
+            reject(signal.reason);
+          },
+          { once: true },
+        );
+        next();
+      });
+    },
+    get pending() {
+      return running + queue.length;
+    },
+  };
+}

src/layers/streetLevel/limiter.test.mjs

@@ -0,0 +1,84 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createLimiter } from './limiter.js';
+
+const tick = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+/** A task that runs until `finish()`. */
+function held(log, name) {
+  let finish;
+  const done = new Promise((resolve) => (finish = resolve));
+  return {
+    task: () => {
+      log.push(name);
+      return done.then(() => name);
+    },
+    finish: () => finish(),
+  };
+}
+
+test('at most `limit` tasks run; queued ones start first in, first out', async () => {
+  const log = [];
+  const gate = createLimiter(2);
+  const tasks = ['a', 'b', 'c', 'd'].map((name) => held(log, name));
+  const results = tasks.map(({ task }) => gate.run(task));
+  await tick();
+  assert.deepEqual(log, ['a', 'b']);
+  assert.equal(gate.pending, 4);
+  tasks[0].finish();
+  await tick();
+  assert.deepEqual(log, ['a', 'b', 'c']);
+  for (const { finish } of tasks) finish();
+  assert.deepEqual(await Promise.all(results), ['a', 'b', 'c', 'd']);
+  assert.equal(gate.pending, 0);
+});
+
+test('lifo starts the newest queued task next', async () => {
+  const log = [];
+  const gate = createLimiter(1, { lifo: true });
+  const tasks = ['a', 'b', 'c'].map((name) => held(log, name));
+  const results = tasks.map(({ task }) => gate.run(task));
+  await tick();
+  tasks[0].finish();
+  await tick();
+  assert.deepEqual(log, ['a', 'c']);
+  tasks[2].finish();
+  tasks[1].finish();
+  await Promise.all(results);
+});
+
+test('a queued task whose signal aborts never runs, leaves the queue and rejects with the reason', async () => {
+  const log = [];
+  const gate = createLimiter(1);
+  const first = held(log, 'a');
+  const running = gate.run(first.task);
+  const controller = new AbortController();
+  const queued = gate.run(held(log, 'b').task, { signal: controller.signal });
+  await tick();
+  assert.equal(gate.pending, 2);
+  controller.abort(new Error('overtaken'));
+  await assert.rejects(queued, /overtaken/);
+  assert.equal(gate.pending, 1, 'out of the queue');
+  first.finish();
+  await running;
+  await tick();
+  assert.deepEqual(log, ['a'], 'b never ran');
+});
+
+test('a task already aborted when its turn comes is skipped', async () => {
+  const log = [];
+  const gate = createLimiter(1);
+  const first = held(log, 'a');
+  const running = gate.run(first.task);
+  const signal = {
+    aborted: false,
+    reason: new Error('gone'),
+    addEventListener() {},
+  };
+  const queued = gate.run(held(log, 'b').task, { signal });
+  signal.aborted = true;
+  first.finish();
+  await running;
+  await assert.rejects(queued, /gone/);
+  assert.deepEqual(log, ['a']);
+});

src/layers/streetLevel/lineCoverage.test.mjs

@@ -0,0 +1,532 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createLineCoverage } from './lineCoverage.js';
+import {
+  coverageViewer,
+  tileCentre,
+} from '../../testSupport/streetLevelFakes.mjs';
+import { until } from '../../testSupport/kartaViewFakes.mjs';
+
+const TUNING = Object.freeze({
+  maxTiles: 9,
+  overviewMaxTiles: 0,
+  maxSequences: 900,
+  lineWidthPx: 2,
+  overviewPointPx: 2,
+  moveDebounceMs: 10,
+  viewRangeMinM: 2_500,
+  viewRangePerHeight: 10,
+  viewNearM: 1_000,
+});
+
+/**
+ * Line coverage over one tile holding one line, on a viewer looking down from
+ * `height`. `fetchTile` answers with that line unless `fail` says otherwise.
+ */
+function setup(
+  t,
+  {
+    zoomFor,
+    messages = { rateLimited: 'busy' },
+    passes,
+    fail,
+    decoded = null,
+    tuning = TUNING,
+    overviewPointSize = null,
+  } = {},
+) {
+  const centre = tileCentre(-121.4944, 38.5816);
+  const viewer = coverageViewer(
+    { lon: centre.lon, lat: centre.lat, height: 900 },
+    t,
+  );
+  const state = {
+    viewer,
+    services: {},
+    keyRequired: false,
+    keyRejected: false,
+    context: {
+      getFilter: () => ({ pano: 'all', sinceMs: null }),
+      isActive: () => true,
+      notify() {},
+      getSurface: () => 'draped',
+      groundCaster: null,
+      meshSampler: null,
+    },
+    coverage: {
+      zoom: null,
+      kind: null,
+      tiles: new Map(),
+      stale: new Map(),
+      staleTimer: null,
+      pending: new Map(),
+      lastError: null,
+      holdUntil: 0,
+      holdTimer: null,
+      debounceTimer: null,
+      removeCameraListener: null,
+      terrainReady: Promise.resolve(),
+      hint: '',
+    },
+    sequence: { selectedId: null },
+  };
+  const asked = [];
+  const coverage = createLineCoverage({
+    state,
+    fetchTile: async (tile) => {
+      asked.push(tile);
+      if (fail) throw fail;
+      if (decoded) return decoded(centre, tile);
+      return {
+        sequences: [
+          {
+            id: 'line-1',
+            parts: [
+              [
+                [centre.lon - 0.001, centre.lat],
+                [centre.lon + 0.001, centre.lat],
+              ],
+            ],
+            capturedAt: 0,
+            isPano: false,
+          },
+        ],
+        overview: [],
+      };
+    },
+    zoomFor:
+      zoomFor ??
+      ((height) =>
+        Number.isFinite(height) && height <= 6_000
+          ? { zoom: 14, kind: 'sequence' }
+          : null),
+    colors: { coverage: '#635bff', selected: '#00e5ff' },
+    pickPrefix: 'test:line:',
+    renderKey: 'test-coverage',
+    tuning,
+    messages,
+    ...(passes ? { passes } : {}),
+    ...(overviewPointSize ? { overviewPointSize } : {}),
+  });
+  t.after(() => {
+    coverage.clear();
+    coverage.resetErrors();
+  });
+  return { viewer, state, coverage, asked };
+}
+
+test('above the zoom range the provider’s own “zoom in” hint shows; without one, the generic hint', (t) => {
+  const tooHigh = 'zoom in to see test coverage';
+  const high = setup(t, { messages: { rateLimited: 'busy', tooHigh } });
+  high.viewer.view.height = 7_000;
+  high.coverage.refresh();
+  assert.equal(high.state.coverage.hint, tooHigh);
+  assert.equal(high.state.coverage.zoom, null);
+  assert.equal(high.asked.length, 0, 'nothing is asked from up there');
+  const generic = setup(t);
+  generic.viewer.view.height = 7_000;
+  generic.coverage.refresh();
+  assert.notEqual(generic.state.coverage.hint, tooHigh);
+  assert.match(generic.state.coverage.hint, /Point the camera/);
+});
+
+test('a provider’s passes() decides which lines are drawn and counted', async (t) => {
+  const all = setup(t, { passes: () => true });
+  all.coverage.refresh();
+  assert.ok(await until(() => all.state.coverage.tiles.size === 1));
+  assert.equal(all.coverage.sequenceCount(), 1, 'control: the line is drawn');
+  const none = setup(t, { passes: () => false });
+  none.coverage.refresh();
+  assert.ok(await until(() => none.state.coverage.tiles.size === 1));
+  assert.equal(none.coverage.sequenceCount(), 0, 'filtered out');
+});
+
+test('a refused key without its own message keeps the error it came with', async (t) => {
+  const refused = Object.assign(new Error('the source refused the key'), {
+    keyRejected: true,
+  });
+  const { state, coverage } = setup(t, { fail: refused });
+  coverage.refresh();
+  assert.ok(await until(() => state.keyRejected === true));
+  assert.equal(state.coverage.lastError, 'the source refused the key');
+});
+
+/** Three lines in one tile: an old long one, then two newer short ones. */
+function threeLines(centre) {
+  const line = (id, capturedAt, span) => ({
+    id,
+    parts: [
+      [
+        [centre.lon - span, centre.lat],
+        [centre.lon + span, centre.lat],
+      ],
+    ],
+    capturedAt,
+    isPano: false,
+  });
+  return {
+    sequences: [
+      line('old-long', 1, 0.002),
+      line('new-short', 2, 0.0002),
+      line('newer-short', 3, 0.0001),
+    ],
+    overview: [],
+  };
+}
+
+test('the per-tile cap keeps the newest lines, or the provider’s own order with keepOrder', async (t) => {
+  const capped = { ...TUNING, maxTiles: 1, maxSequences: 2 };
+  const drawnIds = (state) =>
+    [...state.coverage.tiles.values()].flatMap((tile) => [
+      ...tile.sequences.keys(),
+    ]);
+  const newest = setup(t, { decoded: threeLines, tuning: capped });
+  newest.coverage.refresh();
+  assert.ok(await until(() => newest.state.coverage.tiles.size === 1));
+  assert.deepEqual(drawnIds(newest.state).sort(), ['new-short', 'newer-short']);
+  const kept = setup(t, {
+    decoded: threeLines,
+    tuning: { ...capped, keepOrder: true },
+  });
+  kept.coverage.refresh();
+  assert.ok(await until(() => kept.state.coverage.tiles.size === 1));
+  assert.deepEqual(drawnIds(kept.state), ['old-long', 'new-short']);
+});
+
+test('overview points take the provider’s size, each its own', async (t) => {
+  const { state, coverage, viewer } = setup(t, {
+    zoomFor: () => ({ zoom: 3, kind: 'overview' }),
+    tuning: { ...TUNING, overviewMaxTiles: 4 },
+    decoded: (centre) => ({
+      sequences: [],
+      overview: [
+        { id: 'a', lon: centre.lon, lat: centre.lat, weight: 1 },
+        { id: 'b', lon: centre.lon + 0.01, lat: centre.lat, weight: 50_000 },
+      ],
+    }),
+    overviewPointSize: (point) => (point.weight > 1 ? 7 : 3),
+  });
+  coverage.refresh();
+  assert.ok(await until(() => state.coverage.tiles.size > 0));
+  const sizes = [];
+  for (const primitive of viewer.scene.primitives.items)
+    for (let i = 0; i < (primitive.length ?? 0); i++)
+      sizes.push(primitive.get(i).pixelSize);
+  assert.deepEqual(sizes.sort(), [3, 7]);
+});
+
+test('a point budget skips lines past it, and a shorter one later may still fit', async (t) => {
+  const { state, coverage } = setup(t, {
+    tuning: {
+      ...TUNING,
+      maxTiles: 1,
+      maxSequences: 10,
+      maxPoints: 5,
+      keepOrder: true,
+    },
+    decoded: (centre) => {
+      const line = (id, n) => ({
+        id,
+        parts: [
+          Array.from({ length: n }, (_, i) => [
+            centre.lon - 0.001 + i * 0.0001,
+            centre.lat,
+          ]),
+        ],
+        capturedAt: 0,
+        isPano: false,
+      });
+      return {
+        sequences: [line('three', 3), line('four', 4), line('two', 2)],
+        overview: [],
+      };
+    },
+  });
+  coverage.refresh();
+  assert.ok(await until(() => state.coverage.tiles.size === 1));
+  const [tile] = state.coverage.tiles.values();
+  assert.deepEqual([...tile.sequences.keys()], ['three', 'two']);
+});
+
+/** A line of `n` points, its id unique to the tile. */
+function pointsLine(id, n, tile, centre) {
+  return {
+    id,
+    parts: [
+      Array.from({ length: n }, (_, i) => [
+        centre.lon - 0.001 + i * 0.00001,
+        centre.lat,
+      ]),
+    ],
+    capturedAt: 0,
+    isPano: false,
+  };
+}
+
+test('the point budget is shared: a sparse tile keeps its few, a dense one gets the rest', async (t) => {
+  const tuning = {
+    ...TUNING,
+    maxTiles: 9,
+    maxSequences: 900,
+    maxPoints: 90,
+    keepOrder: true,
+  };
+  const { state, coverage } = setup(t, {
+    // Street zoom far enough in that several tiles are in view.
+    zoomFor: () => ({ zoom: 18, kind: 'sequence' }),
+    tuning,
+    decoded: (centre, tile) => {
+      const dense = tile.x % 2 === 0 && tile.y % 2 === 0;
+      const lines = dense
+        ? Array.from({ length: 30 }, (_, i) =>
+            pointsLine(`d${tile.x}/${tile.y}/${i}`, 5, tile, centre),
+          )
+        : [pointsLine(`s${tile.x}/${tile.y}`, 2, tile, centre)];
+      return { sequences: lines, overview: [] };
+    },
+  });
+  coverage.refresh();
+  assert.ok(
+    await until(
+      () => state.coverage.tiles.size > 1 && !state.coverage.pending.size,
+    ),
+  );
+  const entries = [...state.coverage.tiles.values()];
+  const drawn = (entry) => entry.pointsDrawn;
+  const total = entries.reduce((sum, entry) => sum + drawn(entry), 0);
+  assert.ok(total <= tuning.maxPoints, `within the budget: ${total}`);
+  const sparse = entries.filter((entry) => entry.pointDemand === 2);
+  const dense = entries.filter((entry) => entry.pointDemand === 150);
+  assert.ok(sparse.length && dense.length, 'both kinds in view');
+  for (const entry of sparse)
+    assert.equal(drawn(entry), 2, 'a sparse tile keeps all');
+  const fair = Math.floor(tuning.maxPoints / tuning.maxTiles);
+  const left = tuning.maxPoints - sparse.length * 2;
+  for (const entry of dense)
+    assert.ok(
+      drawn(entry) > fair || dense.length * fair >= left,
+      `a dense tile gets more than the even share: ${drawn(entry)}`,
+    );
+  assert.ok(
+    total > tuning.maxPoints - 5 * dense.length,
+    'little budget unused',
+  );
+});
+
+test('a selected sequence the budget left out is drawn, highlighted', async (t) => {
+  const { state, coverage } = setup(t, {
+    tuning: {
+      ...TUNING,
+      maxTiles: 1,
+      maxSequences: 10,
+      maxPoints: 5,
+      keepOrder: true,
+    },
+    decoded: (centre, tile) => ({
+      sequences: [
+        pointsLine('long', 5, tile, centre),
+        pointsLine('short', 3, tile, centre),
+      ],
+      overview: [],
+    }),
+  });
+  coverage.refresh();
+  assert.ok(await until(() => state.coverage.tiles.size === 1));
+  const [tile] = state.coverage.tiles.values();
+  assert.deepEqual([...tile.sequences.keys()], ['long']);
+  state.sequence.selectedId = 'short';
+  coverage.recolorSequence('short', true);
+  assert.deepEqual([...tile.sequences.keys()].sort(), ['long', 'short']);
+});
+
+/** Count the line primitives a coverage adds to the scene. */
+function countAdds(viewer) {
+  const counts = { added: 0 };
+  for (const collection of [
+    viewer.scene.groundPrimitives,
+    viewer.scene.primitives,
+  ]) {
+    const add = collection.add.bind(collection);
+    collection.add = (primitive) => {
+      counts.added++;
+      return add(primitive);
+    };
+  }
+  return counts;
+}
+
+test('a tile redrawn for a new share keeps its old lines until the new ones are ready', async (t) => {
+  const tuning = {
+    ...TUNING,
+    maxTiles: 9,
+    maxSequences: 900,
+    maxPoints: 90,
+    keepOrder: true,
+  };
+  const { state, coverage, viewer } = setup(t, {
+    zoomFor: () => ({ zoom: 18, kind: 'sequence' }),
+    tuning,
+    decoded: (centre, tile) => {
+      const dense = tile.x % 2 === 0 && tile.y % 2 === 0;
+      return {
+        sequences: dense
+          ? Array.from({ length: 30 }, (_, i) =>
+              pointsLine(`d${tile.x}/${tile.y}/${i}`, 5, tile, centre),
+            )
+          : [pointsLine(`s${tile.x}/${tile.y}`, 2, tile, centre)],
+        overview: [],
+      };
+    },
+  });
+  coverage.refresh();
+  assert.ok(
+    await until(
+      () => state.coverage.tiles.size > 1 && !state.coverage.pending.size,
+    ),
+  );
+  const redrawn = [...state.coverage.tiles.values()].filter(
+    (entry) => entry.swap,
+  );
+  assert.ok(redrawn.length > 0, 'a dense tile took a bigger share');
+  for (const entry of redrawn)
+    for (const { primitive } of entry.swap.old)
+      assert.ok(
+        viewer.scene.groundPrimitives.items.has(primitive) ||
+          viewer.scene.primitives.items.has(primitive),
+        'the old lines are still on the globe while the new ones build',
+      );
+});
+
+test('a second redraw while a swap still builds keeps the lines on screen', async (t) => {
+  const { state, coverage, viewer } = setup(t, {
+    zoomFor: () => ({ zoom: 18, kind: 'sequence' }),
+    tuning: {
+      ...TUNING,
+      maxTiles: 9,
+      maxSequences: 900,
+      maxPoints: 90,
+      keepOrder: true,
+    },
+    decoded: (centre, tile) => {
+      const dense = tile.x % 2 === 0 && tile.y % 2 === 0;
+      return {
+        sequences: dense
+          ? Array.from({ length: 30 }, (_, i) =>
+              pointsLine(`d${tile.x}/${tile.y}/${i}`, 5, tile, centre),
+            )
+          : [pointsLine(`s${tile.x}/${tile.y}`, 2, tile, centre)],
+        overview: [],
+      };
+    },
+  });
+  coverage.refresh();
+  assert.ok(
+    await until(
+      () => state.coverage.tiles.size > 1 && !state.coverage.pending.size,
+    ),
+  );
+  // A tile mid-swap (its new lines never become ready here) with a line
+  // the cap left out: selecting that line redraws the tile again.
+  const entry = [...state.coverage.tiles.values()].find(
+    (tile) =>
+      tile.swap &&
+      tile.sequenceList.some((sequence) => !tile.sequences.has(sequence.id)),
+  );
+  assert.ok(entry, 'a swapping tile with a line left out');
+  const onScreen = [...entry.swap.old];
+  const building = entry.primitives.map(({ primitive }) => primitive);
+  const left = entry.sequenceList.find(
+    (sequence) => !entry.sequences.has(sequence.id),
+  );
+  state.sequence.selectedId = left.id;
+  coverage.recolorSequence(left.id, true);
+  assert.ok(entry.sequences.has(left.id), 'the selected line is drawn');
+  const onGlobe = (primitive) =>
+    viewer.scene.groundPrimitives.items.has(primitive) ||
+    viewer.scene.primitives.items.has(primitive);
+  for (const { primitive } of onScreen)
+    assert.ok(
+      onGlobe(primitive),
+      'the lines on screen stay until the new ones are ready',
+    );
+  for (const primitive of building)
+    assert.ok(!onGlobe(primitive), 'the first swap’s unready lines are gone');
+  assert.ok(entry.swap, 'still swapping');
+});
+
+test('a selected line outside the cap does not make its tile redraw on every settle, nor does one the filter hides', async (t) => {
+  let pano = 'all';
+  const { state, coverage, viewer } = setup(t, {
+    tuning: {
+      ...TUNING,
+      maxTiles: 1,
+      maxSequences: 10,
+      maxPoints: 5,
+      keepOrder: true,
+    },
+    decoded: (centre, tile) => ({
+      sequences: [
+        pointsLine('long', 5, tile, centre),
+        { ...pointsLine('short', 3, tile, centre), isPano: true },
+      ],
+      overview: [],
+    }),
+  });
+  state.context.getFilter = () => ({ pano, sinceMs: null });
+  coverage.refresh();
+  assert.ok(await until(() => state.coverage.tiles.size === 1));
+  state.sequence.selectedId = 'short';
+  coverage.recolorSequence('short', true);
+  const counts = countAdds(viewer);
+  for (let i = 0; i < 3; i++) {
+    coverage.refresh();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  assert.equal(counts.added, 0, 'settles redraw nothing');
+  // A selection the filter hides is not drawn, so it is not redrawn for.
+  pano = 'flat';
+  coverage.rebuild();
+  const after = countAdds(viewer);
+  for (let i = 0; i < 3; i++) coverage.recolorSequence('short', true);
+  assert.equal(after.added, 0);
+});
+
+test('small share increases add up: a retained tile redraws once its share has grown past the threshold since its last draw', async (t) => {
+  const tuning = {
+    ...TUNING,
+    maxTiles: 1,
+    maxSequences: 900,
+    maxPoints: 100,
+    keepOrder: true,
+  };
+  const { state, coverage } = setup(t, {
+    tuning,
+    decoded: (centre, tile) => ({
+      sequences: Array.from({ length: 30 }, (_, i) =>
+        pointsLine(`l${i}`, 4, tile, centre),
+      ),
+      overview: [],
+    }),
+  });
+  coverage.refresh();
+  assert.ok(
+    await until(
+      () => state.coverage.tiles.size === 1 && !state.coverage.pending.size,
+    ),
+  );
+  const [tile] = state.coverage.tiles.values();
+  assert.equal(tile.pointsDrawn, 100);
+  const settle = async () => {
+    coverage.refresh();
+    await until(() => !state.coverage.pending.size);
+    await new Promise((resolve) => setTimeout(resolve, 10));
+  };
+  // +8%: under the threshold, nothing is redrawn.
+  tuning.maxPoints = 108;
+  await settle();
+  assert.equal(tile.pointsDrawn, 100);
+  // +8% again: +16% since the tile was last drawn, so it is redrawn.
+  tuning.maxPoints = 116;
+  await settle();
+  assert.equal(tile.pointsDrawn, 116, 'the grown share is drawn');
+});

src/layers/streetLevel/marker.js

@@ -1,11 +1,27 @@
 import * as Cesium from 'cesium';
-import { positionMarkerGlyph } from './glyphs.js';
+import { positionMarkerGlyph, viewConeMarkerGlyph } from './glyphs.js';
 import { COLORS, POSITION_PICK_ID } from './policy.js';
 import { refineHeights } from './groundCast.js';
 import { createHorizonCull } from './view.js';
 
 const SPRITE_ID = 'street-level:marker';
 
+function markerLook(style) {
+  if (style?.kind === 'view-cone') {
+    const color = style.color || COLORS.position;
+    return {
+      key: `view-cone:${color}`,
+      image: viewConeMarkerGlyph({ color }),
+      size: 48,
+    };
+  }
+  return {
+    key: 'pin',
+    image: positionMarkerGlyph({ color: COLORS.position }),
+    size: 40,
+  };
+}
+
 /** On-globe marker for the open image; in terrain mode it stands on bare earth. */
 export function createMarker({ state, parts }) {
   const { render, sprites } = state.services;
@@ -42,7 +58,8 @@ export function createMarker({ state, parts }) {
     const dem = ground.groundAt(lon, lat);
     if (dem === null) {
       ground.prepare([[lon, lat]]).then((ready) => {
-        if (ready && last?.position === position) set(position, last.bearing);
+        if (ready && last?.position === position)
+          set(position, last.bearing, last.style);
       });
       return null;
     }
@@ -53,14 +70,15 @@ export function createMarker({ state, parts }) {
 
   // A new mesh sample may move the marker onto (or off) the road surface.
   parts?.meshSampler?.onSampled(() => {
-    if (last && state.surface === 'terrain') set(last.position, last.bearing);
+    if (last && state.surface === 'terrain')
+      set(last.position, last.bearing, last.style);
   });
 
-  /** Move (or create) the marker; a null position removes it. */
-  function set(position, bearing) {
+  /** Move (or create) the marker; null removes it. `style`: the provider's `marker`. */
+  function set(position, bearing, style = null) {
     const collection = state.marker.collection;
     if (!collection) return;
-    last = position ? { position, bearing } : null;
+    last = position ? { position, bearing, style } : null;
     if (!position) {
       collection.removeAll();
       state.marker.billboard = null;
@@ -78,14 +96,20 @@ export function createMarker({ state, parts }) {
       height === null
         ? Cesium.HeightReference.CLAMP_TO_GROUND
         : Cesium.HeightReference.NONE;
+    const look = markerLook(style);
+    if (state.marker.billboard && state.marker.look !== look.key) {
+      collection.remove?.(state.marker.billboard);
+      state.marker.billboard = null;
+    }
     if (!state.marker.billboard) {
+      state.marker.look = look.key;
       state.marker.billboard = collection.add({
         id: POSITION_PICK_ID,
         position: cartesian,
-        image: positionMarkerGlyph({ color: COLORS.position }),
-        imageId: 'sl-position',
-        width: 40,
-        height: 40,
+        image: look.image,
+        imageId: `sl-position:${look.key}`,
+        width: look.size,
+        height: look.size,
         alignedAxis: Cesium.Cartesian3.UNIT_Z,
         heightReference,
         disableDepthTestDistance: Number.POSITIVE_INFINITY,
@@ -117,7 +141,7 @@ export function createMarker({ state, parts }) {
 
   /** Re-place the marker after the surface mode changes. */
   function setSurface() {
-    if (last) set(last.position, last.bearing);
+    if (last) set(last.position, last.bearing, last.style);
   }
 
   return {

src/layers/streetLevel/marker.test.mjs

@@ -40,6 +40,7 @@ function setup({ parts = {}, surface = 'draped' } = {}) {
       collection: {
         show: true,
         add: (options) => ({ ...options }),
+        remove() {},
         removeAll() {},
       },
       billboard: null,
@@ -187,3 +188,28 @@ test('draped mode clamps the marker to the globe whatever the ground says', () =
   );
   assert.equal(ground.prepares.length, 0);
 });
+
+test('a Street View photo gets a blue view cone; a Mapillary photo GEV\u2019s pin', () => {
+  const { state, marker } = setup();
+  const removed = [];
+  state.marker.collection.remove = (billboard) => removed.push(billboard);
+  const streetView = { kind: 'view-cone', color: '#4285f4' };
+  marker.set({ lon: -121.49, lat: 38.58 }, 45, streetView);
+  const cone = state.marker.billboard;
+  assert.equal(cone.imageId, 'sl-position:view-cone:#4285f4');
+  assert.equal(
+    cone.rotation,
+    -Cesium.Math.toRadians(45),
+    'it turns with the view',
+  );
+  // Dragging the panorama keeps the look and the billboard.
+  marker.set({ lon: -121.49, lat: 38.58 }, 90, streetView);
+  assert.equal(state.marker.billboard, cone);
+  // Re-placed for a surface change: still the cone.
+  marker.setSurface();
+  assert.equal(state.marker.billboard, cone);
+  // A Mapillary photo next (its provider has no marker): the pin.
+  marker.set({ lon: -121.49, lat: 38.58 }, 90, undefined);
+  assert.equal(state.marker.billboard.imageId, 'sl-position:pin');
+  assert.deepEqual(removed, [cone]);
+});

src/layers/streetLevel/panorama.js

@@ -0,0 +1,245 @@
+/**
+ * A minimal equirectangular panorama renderer on WebGL: one full-screen
+ * triangle whose fragment shader turns each pixel's view ray into texture
+ * coordinates. The image centre is the camera's forward direction; yaw turns
+ * right from it, pitch looks up.
+ */
+
+export const PANO_FOV_DEFAULT_DEG = 80;
+export const PANO_FOV_MIN_DEG = 30;
+export const PANO_FOV_MAX_DEG = 100;
+export const PANO_PITCH_LIMIT_DEG = 85;
+
+const VERTEX = `
+attribute vec2 a_position;
+varying vec2 v_ndc;
+void main() {
+  v_ndc = a_position;
+  gl_Position = vec4(a_position, 0.0, 1.0);
+}`;
+
+const FRAGMENT = `
+precision highp float;
+uniform sampler2D u_image;
+uniform float u_yaw;
+uniform float u_pitch;
+uniform float u_tanHalfFov;
+uniform float u_aspect;
+varying vec2 v_ndc;
+const float PI = 3.141592653589793;
+void main() {
+  vec3 ray = normalize(vec3(v_ndc.x * u_tanHalfFov * u_aspect, v_ndc.y * u_tanHalfFov, -1.0));
+  float cp = cos(u_pitch), sp = sin(u_pitch);
+  ray = vec3(ray.x, ray.y * cp - ray.z * sp, ray.y * sp + ray.z * cp);
+  float cy = cos(u_yaw), sy = sin(u_yaw);
+  ray = vec3(ray.x * cy - ray.z * sy, ray.y, ray.x * sy + ray.z * cy);
+  float lon = atan(ray.x, -ray.z);
+  float lat = asin(clamp(ray.y, -1.0, 1.0));
+  gl_FragColor = texture2D(u_image, vec2(0.5 + lon / (2.0 * PI), 0.5 - lat / PI));
+}`;
+
+/** Wrap degrees into [0, 360). */
+export function wrapDegrees(value) {
+  return ((value % 360) + 360) % 360;
+}
+
+export function clampPitch(degrees) {
+  return Math.max(
+    -PANO_PITCH_LIMIT_DEG,
+    Math.min(PANO_PITCH_LIMIT_DEG, degrees),
+  );
+}
+
+export function clampFov(degrees) {
+  return Math.max(PANO_FOV_MIN_DEG, Math.min(PANO_FOV_MAX_DEG, degrees));
+}
+
+/**
+ * Texture coordinates the shader samples for a view ray, for tests and
+ * picking: `yaw`/`pitch` in degrees, the ray in camera space (x right, y up,
+ * z backward).
+ */
+export function rayToUv(ray, { yaw = 0, pitch = 0 } = {}) {
+  const p = (pitch * Math.PI) / 180;
+  const w = (yaw * Math.PI) / 180;
+  const length = Math.hypot(ray[0], ray[1], ray[2]) || 1;
+  let [x, y, z] = ray.map((v) => v / length);
+  [y, z] = [
+    y * Math.cos(p) - z * Math.sin(p),
+    y * Math.sin(p) + z * Math.cos(p),
+  ];
+  [x, z] = [
+    x * Math.cos(w) - z * Math.sin(w),
+    x * Math.sin(w) + z * Math.cos(w),
+  ];
+  const lon = Math.atan2(x, -z);
+  const lat = Math.asin(Math.max(-1, Math.min(1, y)));
+  return [0.5 + lon / (2 * Math.PI), 0.5 - lat / Math.PI];
+}
+
+function compile(gl, type, source) {
+  const shader = gl.createShader(type);
+  gl.shaderSource(shader, source);
+  gl.compileShader(shader);
+  if (!gl.getShaderParameter(shader, gl.COMPILE_STATUS)) {
+    const log = gl.getShaderInfoLog(shader);
+    gl.deleteShader(shader);
+    throw new Error(`Panorama shader failed: ${log}`);
+  }
+  return shader;
+}
+
+const isPowerOfTwo = (n) => n > 0 && (n & (n - 1)) === 0;
+
+/**
+ * A panorama view on `canvas`. Throws when WebGL is unavailable, so the
+ * caller can fall back to a flat picture.
+ * @param {HTMLCanvasElement} canvas
+ * @returns {{setImage: (image: TexImageSource) => void, setView: (view: {yaw?: number, pitch?: number, fov?: number}) => void, getView: () => {yaw: number, pitch: number, fov: number}, resize: () => void, render: () => void, hasImage: () => boolean, destroy: () => void}}
+ */
+export function createPanoramaRenderer(canvas) {
+  const gl =
+    canvas.getContext('webgl', {
+      antialias: false,
+      depth: false,
+      preserveDrawingBuffer: false,
+    }) || canvas.getContext('experimental-webgl');
+  if (!gl) throw new Error('WebGL is unavailable');
+
+  const program = gl.createProgram();
+  gl.attachShader(program, compile(gl, gl.VERTEX_SHADER, VERTEX));
+  gl.attachShader(program, compile(gl, gl.FRAGMENT_SHADER, FRAGMENT));
+  gl.linkProgram(program);
+  if (!gl.getProgramParameter(program, gl.LINK_STATUS))
+    throw new Error('Panorama program failed to link');
+  gl.useProgram(program);
+
+  const buffer = gl.createBuffer();
+  gl.bindBuffer(gl.ARRAY_BUFFER, buffer);
+  // One triangle covering the screen.
+  gl.bufferData(
+    gl.ARRAY_BUFFER,
+    new Float32Array([-1, -1, 3, -1, -1, 3]),
+    gl.STATIC_DRAW,
+  );
+  const position = gl.getAttribLocation(program, 'a_position');
+  gl.enableVertexAttribArray(position);
+  gl.vertexAttribPointer(position, 2, gl.FLOAT, false, 0, 0);
+  const uniforms = Object.fromEntries(
+    ['u_image', 'u_yaw', 'u_pitch', 'u_tanHalfFov', 'u_aspect'].map((name) => [
+      name,
+      gl.getUniformLocation(program, name),
+    ]),
+  );
+  const texture = gl.createTexture();
+  let loaded = false;
+  let frame = 0;
+  const view = { yaw: 0, pitch: 0, fov: PANO_FOV_DEFAULT_DEG };
+
+  /** Match the drawing buffer to the canvas's laid-out size. */
+  function syncSize() {
+    const ratio = Math.min(globalThis.devicePixelRatio || 1, 2);
+    const width = Math.max(1, Math.round(canvas.clientWidth * ratio));
+    const height = Math.max(1, Math.round(canvas.clientHeight * ratio));
+    if (canvas.width !== width || canvas.height !== height) {
+      canvas.width = width;
+      canvas.height = height;
+    }
+  }
+
+  function resize() {
+    syncSize();
+    scheduleRender();
+  }
+
+  function draw() {
+    frame = 0;
+    if (gl.isContextLost()) return;
+    // Every frame: the canvas may have been laid out since the last one.
+    syncSize();
+    gl.viewport(0, 0, canvas.width, canvas.height);
+    gl.clearColor(0, 0, 0, 1);
+    gl.clear(gl.COLOR_BUFFER_BIT);
+    if (!loaded) return;
+    gl.uniform1i(uniforms.u_image, 0);
+    gl.uniform1f(uniforms.u_yaw, (view.yaw * Math.PI) / 180);
+    gl.uniform1f(uniforms.u_pitch, (view.pitch * Math.PI) / 180);
+    gl.uniform1f(uniforms.u_tanHalfFov, Math.tan((view.fov * Math.PI) / 360));
+    gl.uniform1f(uniforms.u_aspect, canvas.width / Math.max(1, canvas.height));
+    gl.drawArrays(gl.TRIANGLES, 0, 3);
+  }
+
+  function scheduleRender() {
+    if (frame) return;
+    frame = requestAnimationFrame(draw);
+  }
+
+  return {
+    setImage(image) {
+      gl.activeTexture(gl.TEXTURE0);
+      gl.bindTexture(gl.TEXTURE_2D, texture);
+      gl.pixelStorei(gl.UNPACK_FLIP_Y_WEBGL, false);
+      // RGBA: the format a decoded ImageBitmap uploads without conversion.
+      gl.texImage2D(
+        gl.TEXTURE_2D,
+        0,
+        gl.RGBA,
+        gl.RGBA,
+        gl.UNSIGNED_BYTE,
+        image,
+      );
+      // Read before the close: a closed bitmap measures 0×0.
+      const { width, height } = image;
+      // The pixels are on the GPU now; a bitmap's copy can go.
+      image.close?.();
+      // Linear only: a mipmapped lookup draws a seam where longitude wraps.
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MIN_FILTER, gl.LINEAR);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_MAG_FILTER, gl.LINEAR);
+      const repeat =
+        isPowerOfTwo(width) && isPowerOfTwo(height)
+          ? gl.REPEAT
+          : gl.CLAMP_TO_EDGE;
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_S, repeat);
+      gl.texParameteri(gl.TEXTURE_2D, gl.TEXTURE_WRAP_T, gl.CLAMP_TO_EDGE);
+      loaded = true;
+      resize();
+      scheduleRender();
+    },
+    setView(next = {}) {
+      if (Number.isFinite(next.yaw)) view.yaw = wrapDegrees(next.yaw);
+      if (Number.isFinite(next.pitch)) view.pitch = clampPitch(next.pitch);
+      if (Number.isFinite(next.fov)) view.fov = clampFov(next.fov);
+      scheduleRender();
+    },
+    getView: () => ({ ...view }),
+    resize,
+    render: scheduleRender,
+    hasImage: () => loaded,
+    clear() {
+      loaded = false;
+      // Hand the 32 MB texture back: a closed viewer keeps only 1×1.
+      gl.bindTexture(gl.TEXTURE_2D, texture);
+      gl.texImage2D(
+        gl.TEXTURE_2D,
+        0,
+        gl.RGBA,
+        1,
+        1,
+        0,
+        gl.RGBA,
+        gl.UNSIGNED_BYTE,
+        new Uint8Array(4),
+      );
+      scheduleRender();
+    },
+    destroy() {
+      if (frame) cancelAnimationFrame(frame);
+      frame = 0;
+      loaded = false;
+      gl.deleteTexture(texture);
+      gl.deleteBuffer(buffer);
+      gl.deleteProgram(program);
+      gl.getExtension('WEBGL_lose_context')?.loseContext();
+    },
+  };
+}

src/layers/streetLevel/panorama.test.mjs

@@ -0,0 +1,199 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  PANO_FOV_MAX_DEG,
+  PANO_FOV_MIN_DEG,
+  PANO_PITCH_LIMIT_DEG,
+  clampFov,
+  clampPitch,
+  createPanoramaRenderer,
+  rayToUv,
+  wrapDegrees,
+} from './panorama.js';
+
+const close = (actual, expected) =>
+  actual.forEach((value, i) =>
+    assert.ok(Math.abs(value - expected[i]) < 1e-9, `${actual} ≉ ${expected}`),
+  );
+
+test('straight ahead samples the image centre; yaw turns right, pitch looks up', () => {
+  close(rayToUv([0, 0, -1]), [0.5, 0.5]);
+  close(rayToUv([0, 0, -1], { yaw: 90 }), [0.75, 0.5]);
+  close(rayToUv([0, 0, -1], { yaw: -90 }), [0.25, 0.5]);
+  close(rayToUv([0, 0, -1], { pitch: 45 }), [0.5, 0.25]);
+  close(rayToUv([0, 0, -1], { pitch: -90 }), [0.5, 1]);
+  // Pitch first, then yaw: looking up-right stays up.
+  close(rayToUv([0, 0, -1], { yaw: 90, pitch: 45 }), [0.75, 0.25]);
+  // A ray to the right of the screen is the same as turning right.
+  close(rayToUv([1, 0, 0]), [0.75, 0.5]);
+});
+
+test('view limits: pitch stops short of the poles, field of view stays usable', () => {
+  assert.equal(clampPitch(120), PANO_PITCH_LIMIT_DEG);
+  assert.equal(clampPitch(-120), -PANO_PITCH_LIMIT_DEG);
+  assert.equal(clampFov(5), PANO_FOV_MIN_DEG);
+  assert.equal(clampFov(170), PANO_FOV_MAX_DEG);
+  assert.equal(wrapDegrees(-30), 330);
+  assert.equal(wrapDegrees(725), 5);
+});
+
+/**
+ * A WebGL stand-in that records draw calls and uniform values; `lost` makes
+ * it report a lost context.
+ */
+function stubGl() {
+  const gl = {
+    lost: false,
+    calls: [],
+    uniforms: {},
+    isContextLost: () => gl.lost,
+    getShaderParameter: () => true,
+    getProgramParameter: () => true,
+    getUniformLocation: (program, name) => name,
+    getExtension: () => null,
+    uniform1f: (name, value) => (gl.uniforms[name] = value),
+  };
+  return new Proxy(gl, {
+    get(target, key) {
+      if (key in target) return target[key];
+      if (typeof key === 'string' && /^[A-Z_0-9]+$/.test(key)) return key;
+      return (...args) => {
+        target.calls.push(key);
+        return { key, args };
+      };
+    },
+  });
+}
+
+/** A panorama on a stub canvas, with frames run when the test says. */
+function stubPanorama(t, { width = 400, height = 250 } = {}) {
+  const gl = stubGl();
+  const canvas = {
+    clientWidth: width,
+    clientHeight: height,
+    width: 300,
+    height: 150,
+    getContext: () => gl,
+  };
+  const frames = [];
+  const saved = {
+    request: globalThis.requestAnimationFrame,
+    cancel: globalThis.cancelAnimationFrame,
+  };
+  globalThis.requestAnimationFrame = (callback) => frames.push(callback);
+  globalThis.cancelAnimationFrame = () => {};
+  t.after(() => {
+    globalThis.requestAnimationFrame = saved.request;
+    globalThis.cancelAnimationFrame = saved.cancel;
+  });
+  const renderer = createPanoramaRenderer(canvas);
+  const runFrames = () => {
+    while (frames.length) frames.shift()();
+  };
+  return { gl, canvas, renderer, runFrames };
+}
+
+const IMAGE = { width: 1024, height: 512 };
+
+test('a panorama draws once it has an image; looking up and right are positive angles', (t) => {
+  const { gl, renderer, runFrames } = stubPanorama(t);
+  renderer.render();
+  runFrames();
+  assert.equal(gl.calls.includes('drawArrays'), false, 'nothing to draw yet');
+  renderer.setImage(IMAGE);
+  renderer.setView({ yaw: 30, pitch: 30 });
+  runFrames();
+  assert.ok(gl.calls.includes('drawArrays'));
+  assert.ok(gl.uniforms.u_pitch > 0, `u_pitch ${gl.uniforms.u_pitch}`);
+  assert.ok(Math.abs(gl.uniforms.u_pitch - Math.PI / 6) < 1e-9);
+  assert.ok(Math.abs(gl.uniforms.u_yaw - Math.PI / 6) < 1e-9);
+  renderer.setView({ pitch: -20 });
+  runFrames();
+  assert.ok(gl.uniforms.u_pitch < 0, 'looking down is negative');
+});
+
+test('a lost WebGL context draws nothing', (t) => {
+  const { gl, renderer, runFrames } = stubPanorama(t);
+  renderer.setImage(IMAGE);
+  gl.lost = true;
+  gl.calls.length = 0;
+  runFrames();
+  assert.deepEqual(
+    gl.calls.filter((call) =>
+      ['viewport', 'clear', 'drawArrays'].includes(call),
+    ),
+    [],
+  );
+});
+
+test('the canvas is measured again when it draws, not only when its image arrived', (t) => {
+  // The image arrives while the canvas is still hidden (0×0)…
+  const { canvas, renderer, runFrames } = stubPanorama(t, {
+    width: 0,
+    height: 0,
+  });
+  renderer.setImage(IMAGE);
+  assert.deepEqual([canvas.width, canvas.height], [1, 1]);
+  // …and is laid out before the frame draws.
+  canvas.clientWidth = 400;
+  canvas.clientHeight = 250;
+  runFrames();
+  assert.deepEqual([canvas.width, canvas.height], [400, 250]);
+});
+
+test('an image uploads as RGBA and its bitmap is released; closing hands the texture back as 1×1', (t) => {
+  const { gl, renderer } = stubPanorama(t);
+  const uploads = [];
+  gl.texImage2D = (...args) => uploads.push(args);
+  let closed = false;
+  renderer.setImage({
+    width: 2048,
+    height: 1024,
+    close: () => (closed = true),
+  });
+  assert.equal(uploads.length, 1);
+  assert.equal(
+    uploads[0][2],
+    'RGBA',
+    'the format a decoded bitmap uploads without conversion',
+  );
+  assert.equal(closed, true, 'the decoded copy is freed once on the GPU');
+  renderer.clear();
+  const last = uploads.at(-1);
+  assert.deepEqual(
+    [last[3], last[4]],
+    [1, 1],
+    'a closed viewer keeps a 1×1 texture',
+  );
+  assert.equal(renderer.hasImage(), false);
+});
+
+test('a power-of-two bitmap wraps in longitude even though it is closed once uploaded', (t) => {
+  const { gl, renderer } = stubPanorama(t);
+  const wraps = [];
+  gl.texParameteri = (target, name, value) => wraps.push([name, value]);
+  gl.TEXTURE_WRAP_S = 'WRAP_S';
+  gl.REPEAT = 'REPEAT';
+  gl.CLAMP_TO_EDGE = 'CLAMP';
+  const bitmap = {
+    width: 2048,
+    height: 1024,
+    // A closed ImageBitmap measures 0×0.
+    close() {
+      this.width = 0;
+      this.height = 0;
+    },
+  };
+  renderer.setImage(bitmap);
+  assert.deepEqual(
+    wraps.find(([name]) => name === 'WRAP_S'),
+    ['WRAP_S', 'REPEAT'],
+  );
+  wraps.length = 0;
+  renderer.setImage({ width: 2000, height: 1000 });
+  assert.deepEqual(
+    wraps.find(([name]) => name === 'WRAP_S'),
+    ['WRAP_S', 'CLAMP'],
+    'other sizes clamp (WebGL 1 repeats powers of two only)',
+  );
+});

src/layers/streetLevel/photoViewer.js

@@ -0,0 +1,922 @@
+import {
+  createPanoramaRenderer,
+  PANO_FOV_DEFAULT_DEG,
+  wrapDegrees,
+} from './panorama.js';
+import { imageSize } from './imageSize.js';
+
+/** A photo download (tens of kilobytes to a few megabytes). */
+export const IMAGE_TIMEOUT_MS = 15_000;
+
+/** A picture file or decoded side past these is refused (a photo is a few MB). */
+export const MAX_IMAGE_BYTES = 48 * 1024 * 1024;
+export const MAX_IMAGE_SIDE = 16_384;
+/** 64 MP: 256 MB once decoded to RGBA. A 16,384 px square is four times that. */
+export const MAX_IMAGE_PIXELS = 8_192 * 8_192;
+/** Where in a file to look for its dimensions (a JPEG's EXIF comes first). */
+const HEADER_BYTES = 256 * 1024;
+
+/** Whether a picture this size is past what the viewer decodes. */
+export function tooManyPixels(width, height) {
+  return (
+    width > MAX_IMAGE_SIDE ||
+    height > MAX_IMAGE_SIDE ||
+    width * height > MAX_IMAGE_PIXELS
+  );
+}
+
+/** Panorama texture widths: enough for a docked viewer, and for an expanded one. */
+export const PANO_MID_SIZE = Object.freeze([2048, 1024]);
+export const PANO_FULL_SIZE = Object.freeze([4096, 2048]);
+
+/**
+ * Load an image within the timeout. A CORS-clean one (for WebGL) is decoded
+ * off the main thread into an ImageBitmap where the browser can: uploading
+ * a decoded bitmap costs a fraction of uploading an <img> (90 ms → 15 ms for
+ * 4096×2048 on a phone-class CPU). `resize` shrinks a bitmap while decoding
+ * it (a panorama larger than any texture the viewer uploads).
+ * @param {string} url
+ * @param {{crossOrigin?: boolean, timeoutMs?: number, resize?: [number, number]|null, failure?: string}} [options]
+ */
+export function loadImage(
+  url,
+  {
+    crossOrigin = true,
+    timeoutMs = IMAGE_TIMEOUT_MS,
+    resize = null,
+    failure = 'The photo could not be loaded',
+    signal = null,
+  } = {},
+) {
+  if (
+    crossOrigin &&
+    url &&
+    typeof globalThis.createImageBitmap === 'function' &&
+    typeof globalThis.fetch === 'function'
+  )
+    return loadBitmap(url, timeoutMs, resize, failure, signal);
+  return new Promise((resolve, reject) => {
+    if (!url) return reject(new Error(failure));
+    if (signal?.aborted) return reject(new Error(failure));
+    const image = new Image();
+    if (crossOrigin) image.crossOrigin = 'anonymous';
+    image.decoding = 'async';
+    // Stop the download: another photo opened, or the time ran out.
+    const stop = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener?.('abort', stop);
+      image.onload = image.onerror = null;
+      image.src = '';
+      reject(new Error(failure));
+    };
+    const timer = setTimeout(stop, timeoutMs);
+    signal?.addEventListener?.('abort', stop, { once: true });
+    const settle = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener?.('abort', stop);
+    };
+    image.onload = () => {
+      settle();
+      // An <img> reads no header first: refuse what it decoded too large.
+      if (tooManyPixels(image.naturalWidth || 0, image.naturalHeight || 0)) {
+        image.src = '';
+        reject(oversized(failure));
+        return;
+      }
+      resolve(image);
+    };
+    image.onerror = () => {
+      settle();
+      reject(new Error(failure));
+    };
+    image.src = url;
+  });
+}
+
+async function loadBitmap(url, timeoutMs, resize, failure, signal) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  // The caller's abort (the photo changed) stops a multi-megabyte download.
+  const onAbort = () => controller.abort();
+  if (signal?.aborted) controller.abort();
+  signal?.addEventListener?.('abort', onAbort, { once: true });
+  try {
+    const response = await fetch(url, {
+      mode: 'cors',
+      signal: controller.signal,
+    });
+    if (!response.ok) throw new Error(failure);
+    // Picture hosts are not ours: refuse a file or an image past any real
+    // photo's size before it is decoded.
+    const length = Number(response.headers?.get?.('content-length'));
+    if (length > MAX_IMAGE_BYTES) throw oversized(failure);
+    const blob = await boundedBlob(response, failure);
+    // Its declared size, before anything decodes it.
+    const size = imageSize(
+      new Uint8Array(await blob.slice(0, HEADER_BYTES).arrayBuffer()),
+    );
+    if (size && tooManyPixels(size.width, size.height))
+      throw oversized(failure);
+    const bitmap = await (resize
+      ? createImageBitmap(blob, {
+          resizeWidth: resize[0],
+          resizeHeight: resize[1],
+          resizeQuality: 'high',
+        })
+      : createImageBitmap(blob));
+    // (A resized decode reports its new size: this guards unresized ones.)
+    if (tooManyPixels(bitmap.width, bitmap.height)) {
+      bitmap.close?.();
+      throw oversized(failure);
+    }
+    return bitmap;
+  } catch (error) {
+    // A size refusal stays one: the viewer must not fetch it another way.
+    if (error?.tooLarge) throw error;
+    throw new Error(failure);
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener?.('abort', onAbort);
+  }
+}
+
+/**
+ * A picture refused for its size (`tooLarge`): the viewer will not load
+ * that file another way, an <img> having no size limit at all.
+ */
+export function oversized(failure) {
+  return Object.assign(new Error(failure), { tooLarge: true });
+}
+
+/**
+ * The body as a Blob, read with a running count so a host that sends no
+ * length (or a false one) cannot fill memory before the cap is checked.
+ */
+async function boundedBlob(response, failure) {
+  const reader = response.body?.getReader?.();
+  if (!reader) {
+    const blob = await response.blob();
+    if (blob.size > MAX_IMAGE_BYTES) throw oversized(failure);
+    return blob;
+  }
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > MAX_IMAGE_BYTES) {
+      reader.cancel().catch(() => {});
+      throw oversized(failure);
+    }
+    chunks.push(value);
+  }
+  return new Blob(chunks, {
+    type: response.headers?.get?.('content-type') || 'image/jpeg',
+  });
+}
+
+/** The panorama size a canvas this wide can show sharply at this field of view. */
+export function panoSizeFor(canvasPixels, fovDeg) {
+  const needed = (Math.max(1, canvasPixels) * 360) / Math.max(1, fovDeg);
+  return needed > PANO_MID_SIZE[0] ? PANO_FULL_SIZE : PANO_MID_SIZE;
+}
+
+/**
+ * @typedef {object} PhotoSources   Where a provider's photo comes from.
+ * @property {(photo: object) => boolean} hasPano   A 360° photo with an equirectangular image.
+ * @property {(photo: object) => {url: string, width: number, resize?: [number, number]|null}|null} panoFirst
+ *   The panorama shown first, its texture width (0 when it is only a preview), and a size to shrink it to.
+ * @property {(photo: object, size: [number, number], view: {expanded: boolean}) => {url: string, resize?: [number, number]|null, timeoutMs?: number}|null} panoSharp
+ *   A sharper panorama for a canvas that needs `size`, or null; `expanded` while the viewer is.
+ * @property {(photo: object, view: {expanded: boolean}) => Array<string>} flatFirst   Flat versions to try in turn (`expanded` while the viewer is).
+ * @property {(photo: object, pixels: number) => string|null} flatSharp
+ *   A sharper flat version for a picture this many device pixels wide, or null.
+ * @property {(photo: object) => {title?: string|null, creator?: string|null, license?: string|null, externalUrl: string, capturedAtPrecision?: 'day'|'month'}} describe
+ * @property {(photo: object) => number|null} [bearingOf]   Where the camera looked (default `photo.heading`).
+ */
+
+/**
+ * Viewer adapter for providers whose photos are plain image files: a flat
+ * photo in an <img>, a 360° photo on a WebGL panorama (drag to look, wheel
+ * or pinch to zoom), and ‹ › to step along the sequence (also ← →). Poses
+ * follow the view direction.
+ *
+ * Photos are normalized by the provider: `{id, sequenceId, lon, lat,
+ * heading, isPano, capturedAt}` plus whatever its `sources` read.
+ *
+ * @param {object} options
+ * @param {string} options.providerId
+ * @param {string} options.name   Provider name for labels and messages, e.g. 'KartaView'.
+ * @param {PhotoSources} options.sources
+ * @param {(photoId: string) => Promise<object>} options.getPhoto   A normalized photo.
+ * @param {(photo: object, delta: -1|1) => Promise<string|null>} options.step   The photo `delta` along the sequence, or null at its end.
+ * @param {(imageId: string) => void} options.onStep   Open the photo ‹ › chose (through the core, so loading and errors show).
+ * @param {(photo: object) => void} [options.onShown]   A photo is on screen.
+ * @param {(photo: object) => void} [options.onShowing]   The photo this open shows, just before its pose.
+ * @param {(imageId: string) => void} [options.onReopen]   Draw the same photo again after a GPU reset (default: `onStep`).
+ * @param {() => boolean} [options.onEscape]   Esc in the docked viewer: true when it was used (e.g. a selection cleared).
+ * @param {object} [options.render]   Render governor.
+ * @param {(url: string, options?: object) => Promise<HTMLImageElement|ImageBitmap>} [options.load]
+ * @param {(canvas: HTMLCanvasElement) => object} [options.createRenderer]
+ * @returns {import('./registry.js').ViewerAdapter}
+ */
+export function createPhotoViewer({
+  providerId,
+  name,
+  sources,
+  getPhoto,
+  step,
+  onStep,
+  onShown = () => {},
+  onShowing = () => {},
+  onReopen = onStep,
+  onEscape = () => false,
+  render,
+  load = loadImage,
+  createRenderer = createPanoramaRenderer,
+}) {
+  const LOAD_FAILED = `The ${name} photo could not be loaded`;
+  const listeners = new Set();
+  let root = null;
+  let picture = null;
+  let canvas = null;
+  let prevButton = null;
+  let nextButton = null;
+  let renderer = null;
+  /** WebGL failed once: 360° photos show their front view instead. */
+  let rendererFailed = false;
+  let photo = null;
+  /** What shows: 'flat', 'pano' or null. */
+  let showing = null;
+  let openSeq = 0;
+  let renderMode = 'letterbox';
+  let drag = null;
+  let poseFrame = 0;
+  let removeListeners = [];
+  /** The document the viewer was built in (new canvases come from it). */
+  let documentOf = null;
+  /** A context loss's look direction, for the reopen of that photo. */
+  let restoreView = null;
+  /** The panel's viewer box, where Esc is listened for (null: the root). */
+  let escapeTarget = null;
+  /** Width of the panorama texture on screen (0: the preview). */
+  let panoWidth = 0;
+  /** The sharper panorama on its way, for which open (resizes come in bursts). */
+  let panoComing = null;
+  /** A resize came while it loaded: look again once it lands. */
+  let lookAgain = false;
+  /** The sharper flat version on screen, and the one on its way. */
+  let flatSharp = { shown: null, loading: null };
+  /** The open in progress: another open, a close or an unmount stops its downloads. */
+  let openAbort = null;
+  /** The photo an open is fetching: ‹ › step on from it, not the old one. */
+  let openingId = null;
+  /** ‹ › chose this photo: keep the panorama's look direction for it. */
+  let keepViewFor = null;
+  /** ‹ › presses run one after another, each from where the last one went. */
+  let steps = Promise.resolve();
+
+  /** Files refused for their size: never loaded again, by any path. */
+  const refused = new Set();
+  async function loadAs(url, options) {
+    if (refused.has(url)) throw oversized(LOAD_FAILED);
+    try {
+      return await load(url, { failure: LOAD_FAILED, ...options });
+    } catch (error) {
+      if (error?.tooLarge) refused.add(url);
+      throw error;
+    }
+  }
+
+  function requestRender() {
+    render?.governorRequestRender?.(`${providerId}-viewer`);
+  }
+
+  function emit() {
+    if (!photo || !showing) return;
+    // A lost GPU context, still being recovered: the open that redraws the
+    // panorama poses once it is on screen.
+    if (showing === 'pano' && !renderer) return;
+    const view = showing === 'pano' ? renderer.getView() : null;
+    const heading = sources.bearingOf
+      ? sources.bearingOf(photo)
+      : photo.heading;
+    const described = sources.describe(photo);
+    const pose = {
+      providerId,
+      imageId: photo.id,
+      position: { lon: photo.lon, lat: photo.lat },
+      bearing:
+        heading === null || heading === undefined
+          ? null
+          : view
+            ? wrapDegrees(heading + view.yaw)
+            : heading,
+      tilt: view ? view.pitch : 0,
+      altitude: null,
+      isPano: showing === 'pano',
+      capturedAt: photo.capturedAt,
+      capturedAtPrecision: described.capturedAtPrecision || 'day',
+      title: described.title ?? null,
+      creator: described.creator ?? null,
+      license: described.license ?? null,
+      sequenceId: photo.sequenceId,
+      externalUrl: described.externalUrl,
+    };
+    for (const listener of [...listeners]) {
+      try {
+        listener(pose);
+      } catch {
+        /* listener errors are the core's to log */
+      }
+    }
+    requestRender();
+  }
+
+  /** Re-emit on the next frame: a drag moves the view many times a frame. */
+  function emitSoon() {
+    if (poseFrame) return;
+    poseFrame = requestAnimationFrame(() => {
+      poseFrame = 0;
+      emit();
+    });
+  }
+
+  function syncButtons() {
+    const enabled = Boolean(photo?.sequenceId) && showing !== null;
+    if (prevButton) prevButton.disabled = !enabled;
+    if (nextButton) nextButton.disabled = !enabled;
+    if (enabled) checkEnds(photo);
+  }
+
+  /** Disable ‹ or › at once where the sequence ends (it also warms the neighbours). */
+  function checkEnds(target) {
+    for (const [delta, button] of [
+      [-1, prevButton],
+      [1, nextButton],
+    ])
+      step(target, delta).then(
+        (id) => {
+          if (photo === target && button && !id) disable(button);
+        },
+        () => {},
+      );
+  }
+
+  /** Disable a step button, keeping keyboard focus in the viewer. */
+  function disable(button) {
+    if (button.ownerDocument?.activeElement === button) root?.focus?.();
+    button.disabled = true;
+  }
+
+  function show(kind) {
+    showing = kind;
+    if (picture) picture.hidden = kind !== 'flat';
+    if (canvas) canvas.hidden = kind !== 'pano';
+    if (root) root.dataset.kind = kind || '';
+    syncButtons();
+  }
+
+  function applyRenderMode() {
+    if (picture)
+      picture.style.objectFit = renderMode === 'fill' ? 'cover' : 'contain';
+  }
+
+  function ensureRenderer() {
+    if (renderer || rendererFailed || !canvas) return renderer;
+    try {
+      renderer = createRenderer(canvas);
+    } catch {
+      rendererFailed = true;
+      renderer = null;
+    }
+    return renderer;
+  }
+
+  /**
+   * A lost WebGL context (GPU reset, memory pressure) takes the panorama
+   * with it: drop the renderer, and show the photo again on a new one.
+   */
+  function onContextLost(event) {
+    event.preventDefault?.();
+    const lost = renderer;
+    renderer = null;
+    // The new renderer starts facing the photo's heading: keep the user's look.
+    if (showing === 'pano' && photo && lost)
+      restoreView = { id: photo.id, view: lost.getView() };
+    try {
+      lost?.destroy();
+    } catch {
+      /* already gone */
+    }
+    // A lost canvas hands back its lost context: draw on a new element.
+    const fresh = makeCanvas(documentOf);
+    fresh.hidden = canvas.hidden;
+    canvas.replaceWith?.(fresh);
+    canvas = fresh;
+    // Show the photo again through the core, unless a newer one is opening.
+    if (showing === 'pano' && photo && openingId === null) {
+      const again = photo.id;
+      show(null);
+      openingId = again;
+      onReopen(again);
+    }
+  }
+
+  /** The panorama canvas, wired for drag, pinch, wheel and context loss. */
+  function makeCanvas(doc) {
+    const element = doc.createElement('canvas');
+    element.className = 'sl-photo-pano';
+    element.hidden = true;
+    listen(element, 'pointerdown', onPointerDown);
+    listen(element, 'pointermove', onPointerMove);
+    listen(element, 'pointerup', onPointerUp);
+    listen(element, 'pointercancel', onPointerUp);
+    listen(element, 'wheel', onWheel, { passive: false });
+    listen(element, 'webglcontextlost', onContextLost);
+    return element;
+  }
+
+  /**
+   * Step along the sequence from the photo showing, or from the one on its
+   * way after an earlier press, and open it through the core.
+   */
+  function stepBy(delta) {
+    steps = steps.then(async () => {
+      const fromId = openingId ?? photo?.id;
+      if (!fromId || !root) return;
+      let from;
+      let nextId = null;
+      try {
+        from = await getPhoto(fromId);
+        if (from.sequenceId) nextId = await step(from, delta);
+      } catch {
+        // Not the end of the sequence, just no answer: the press is lost.
+        return;
+      }
+      // Closed, or another photo was opened meanwhile.
+      if ((openingId ?? photo?.id) !== fromId) return;
+      if (!nextId) {
+        const button = delta < 0 ? prevButton : nextButton;
+        if (button && photo?.id === fromId) disable(button);
+        return;
+      }
+      openingId = nextId;
+      keepViewFor = nextId;
+      onStep(nextId);
+    });
+  }
+
+  /** Pointers on the panorama: one drags the view, two pinch the zoom. */
+  const pointers = new Map();
+  let pinch = null;
+
+  function pinchSpan() {
+    const [a, b] = [...pointers.values()];
+    return Math.max(1, Math.hypot(a.x - b.x, a.y - b.y));
+  }
+
+  function onPointerDown(event) {
+    if (showing !== 'pano' || !renderer) return;
+    if (event.pointerType === 'mouse' && event.button !== 0) return;
+    pointers.set(event.pointerId, { x: event.clientX, y: event.clientY });
+    canvas.setPointerCapture?.(event.pointerId);
+    if (pointers.size === 2) {
+      drag = null;
+      pinch = { span: pinchSpan(), fov: renderer.getView().fov };
+      return;
+    }
+    drag = {
+      id: event.pointerId,
+      x: event.clientX,
+      y: event.clientY,
+      view: renderer.getView(),
+    };
+    canvas.classList.add('sl-photo-dragging');
+  }
+
+  function onPointerMove(event) {
+    if (pointers.has(event.pointerId))
+      pointers.set(event.pointerId, { x: event.clientX, y: event.clientY });
+    if (pinch && pointers.size === 2 && renderer) {
+      renderer.setView({ fov: pinch.fov * (pinch.span / pinchSpan()) });
+      return;
+    }
+    if (!drag || event.pointerId !== drag.id || !renderer) return;
+    const { fov } = drag.view;
+    const width = Math.max(1, canvas.clientWidth);
+    const height = Math.max(1, canvas.clientHeight);
+    const vertical = fov;
+    const horizontal = fov * (width / height);
+    renderer.setView({
+      yaw: drag.view.yaw - ((event.clientX - drag.x) / width) * horizontal,
+      pitch: drag.view.pitch + ((event.clientY - drag.y) / height) * vertical,
+    });
+    emitSoon();
+  }
+
+  function onPointerUp(event) {
+    pointers.delete(event.pointerId);
+    if (pointers.size < 2) pinch = null;
+    if (!drag || event.pointerId !== drag.id) return;
+    drag = null;
+    canvas.classList.remove('sl-photo-dragging');
+  }
+
+  function onWheel(event) {
+    if (showing !== 'pano' || !renderer) return;
+    event.preventDefault();
+    const { fov } = renderer.getView();
+    renderer.setView({ fov: fov * Math.exp(event.deltaY * 0.001) });
+  }
+
+  /**
+   * Docked, Esc anywhere in the viewer's box (the photo, its toolbar, its
+   * caption) is the provider's before the panel's, which would collapse;
+   * expanded, the dialog's own Esc shrinks it.
+   */
+  function onEscapeKey(event) {
+    if (
+      event.key !== 'Escape' ||
+      event.shiftKey ||
+      event.defaultPrevented ||
+      root?.closest?.('.sl-viewer-wrap-expanded') ||
+      !onEscape()
+    )
+      return;
+    event.preventDefault();
+    event.stopPropagation();
+  }
+
+  function onKeyDown(event) {
+    if (!escapeTarget) onEscapeKey(event);
+    if (
+      event.defaultPrevented ||
+      event.altKey ||
+      event.ctrlKey ||
+      event.metaKey
+    )
+      return;
+    const pano = showing === 'pano' && renderer;
+    const turn = { ArrowLeft: -1, ArrowRight: 1 }[event.key];
+    // Shift+← → look around a panorama; ← → step along the sequence.
+    if (turn && event.shiftKey && pano) {
+      event.preventDefault();
+      const { yaw, fov } = renderer.getView();
+      renderer.setView({ yaw: yaw + (turn * fov) / 4 });
+      emitSoon();
+    } else if (turn) {
+      event.preventDefault();
+      stepBy(turn);
+    } else if ((event.key === 'ArrowUp' || event.key === 'ArrowDown') && pano) {
+      event.preventDefault();
+      const { pitch, fov } = renderer.getView();
+      renderer.setView({
+        pitch: pitch + ((event.key === 'ArrowUp' ? 1 : -1) * fov) / 6,
+      });
+      emitSoon();
+    } else if (['+', '=', '-', '_'].includes(event.key) && pano) {
+      event.preventDefault();
+      const { fov } = renderer.getView();
+      renderer.setView({
+        fov: fov * (event.key === '+' || event.key === '=' ? 0.85 : 1 / 0.85),
+      });
+    }
+  }
+
+  function listen(target, type, handler, options) {
+    target.addEventListener(type, handler, options);
+    removeListeners.push(() =>
+      target.removeEventListener(type, handler, options),
+    );
+  }
+
+  function build(host) {
+    const doc = host.ownerDocument;
+    documentOf = doc;
+    root = doc.createElement('div');
+    root.className = 'sl-photo-viewer';
+    root.dataset.provider = providerId;
+    root.tabIndex = 0;
+    root.setAttribute('role', 'group');
+    root.setAttribute(
+      'aria-label',
+      `${name} photo. ← and → step along the sequence. On a 360° photo, drag or use Shift+← →, ↑ ↓ to look around, and + − to zoom`,
+    );
+    picture = doc.createElement('img');
+    picture.className = 'sl-photo-flat';
+    picture.alt = `${name} street-level photo`;
+    picture.draggable = false;
+    picture.hidden = true;
+    canvas = makeCanvas(doc);
+    const nav = (label, glyph, delta) => {
+      const button = doc.createElement('button');
+      button.type = 'button';
+      button.className = `sl-photo-step sl-photo-step-${delta < 0 ? 'prev' : 'next'}`;
+      button.textContent = glyph;
+      button.title = label;
+      button.setAttribute('aria-label', label);
+      button.disabled = true;
+      listen(button, 'click', (event) => {
+        event.stopPropagation();
+        stepBy(delta);
+      });
+      return button;
+    };
+    prevButton = nav('Previous photo in this sequence (←)', '‹', -1);
+    nextButton = nav('Next photo in this sequence (→)', '›', 1);
+    root.append(picture, canvas, prevButton, nextButton);
+    host.append(root);
+    listen(root, 'keydown', onKeyDown);
+    // The viewer's box in the panel; without one, the root's own handler
+    // takes Esc (one listener per element and type).
+    escapeTarget = host.closest?.('.sl-viewer-wrap') ?? null;
+    if (escapeTarget) listen(escapeTarget, 'keydown', onEscapeKey);
+    applyRenderMode();
+  }
+
+  function teardown() {
+    pointers.clear();
+    pinch = null;
+    for (const remove of removeListeners) remove();
+    removeListeners = [];
+    if (poseFrame) cancelAnimationFrame(poseFrame);
+    poseFrame = 0;
+    drag = null;
+    renderer?.destroy();
+    renderer = null;
+    root?.remove();
+    root = picture = canvas = prevButton = nextButton = null;
+    showing = null;
+    photo = null;
+  }
+
+  /** Device pixels across the flat photo's frame (its longer side). */
+  function viewerPixels() {
+    const ratio = globalThis.devicePixelRatio || 1;
+    const element = showing === 'pano' ? canvas : picture;
+    const side = Math.max(
+      element?.clientWidth || 0,
+      element?.clientHeight || 0,
+    );
+    return (side || root?.clientWidth || 0) * ratio;
+  }
+
+  /** A sharper version once the first is on screen, if nothing replaced it. */
+  async function upgrade(target, seq, kind) {
+    // A 360° photo shown flat (no WebGL) keeps its front view.
+    if (kind === 'flat' && target.isPano) return;
+    // Another photo is opening: the one still shown is not worth more bytes.
+    if (openingId !== null && openingId !== target.id) return;
+    const signal = openAbort?.signal;
+    if (kind === 'pano') {
+      const size = panoSizeNow();
+      if (size[0] <= panoWidth) return;
+      // Resizes come in bursts while the panel animates: one load at a time
+      // for this photo, and one more look once it lands.
+      if (panoComing?.seq === seq) {
+        lookAgain = true;
+        return;
+      }
+      const sharp = sources.panoSharp(target, size, {
+        expanded: isExpanded(),
+      });
+      if (!sharp?.url) return;
+      const coming = { seq, width: size[0], controller: new AbortController() };
+      panoComing = coming;
+      lookAgain = false;
+      try {
+        const image = await loadAs(sharp.url, {
+          crossOrigin: true,
+          signal: coming.controller.signal,
+          resize: sharp.resize ?? null,
+          ...(sharp.timeoutMs ? { timeoutMs: sharp.timeoutMs } : {}),
+        });
+        if (seq !== openSeq || photo !== target || showing !== 'pano') {
+          image.close?.();
+          return;
+        }
+        if (!renderer || size[0] <= panoWidth) {
+          image.close?.();
+          return;
+        }
+        renderer.setImage(image);
+        panoWidth = size[0];
+        requestRender();
+      } catch {
+        /* the first version stays */
+      } finally {
+        if (panoComing === coming) {
+          panoComing = null;
+          if (lookAgain && seq === openSeq && photo === target) {
+            lookAgain = false;
+            upgrade(target, seq, 'pano');
+          }
+        }
+      }
+      return;
+    }
+    const url = sources.flatSharp(target, viewerPixels());
+    if (!url || url === flatSharp.shown || url === flatSharp.loading) return;
+    const sharp = flatSharp;
+    sharp.loading = url;
+    try {
+      const image = await loadAs(url, { crossOrigin: false, signal });
+      if (seq !== openSeq || photo !== target || showing !== 'flat') return;
+      picture.src = image.src;
+      sharp.shown = url;
+      requestRender();
+    } catch {
+      /* the first version stays; a later resize may try again */
+    } finally {
+      // Discarded or failed: nothing is on its way, so it may be asked again.
+      if (sharp.loading === url) sharp.loading = null;
+    }
+  }
+
+  /** The viewer is the expanded dialog, not docked in the panel. */
+  function isExpanded() {
+    return Boolean(root?.closest?.('.sl-viewer-wrap-expanded'));
+  }
+
+  /** Another photo, or none: a sharper panorama still on its way is not needed. */
+  function dropSharpPanorama() {
+    panoComing?.controller?.abort();
+    panoComing = null;
+    lookAgain = false;
+  }
+
+  /** The sharp panorama this viewer needs now: 2,048 docked, 4,096 expanded. */
+  function panoSizeNow() {
+    const ratio = Math.min(globalThis.devicePixelRatio || 1, 2);
+    const width = (canvas?.clientWidth || 0) * ratio;
+    return panoSizeFor(width, renderer?.getView().fov ?? PANO_FOV_DEFAULT_DEG);
+  }
+
+  async function showPano(target, seq, keepView, signal) {
+    // If the panorama fails, the caller shows the front view rather than
+    // waiting on it twice.
+    const first = sources.panoFirst(target);
+    if (!first?.url) throw new Error(LOAD_FAILED);
+    const image = await loadAs(first.url, {
+      crossOrigin: true,
+      signal,
+      // Never decoded at more than the texture it becomes.
+      resize: first.resize ?? PANO_MID_SIZE,
+    });
+    if (seq !== openSeq) {
+      image.close?.();
+      return false;
+    }
+    // The context may have been lost while this loaded: build on the new
+    // canvas, or let the caller show the front view.
+    if (!ensureRenderer()) {
+      image.close?.();
+      throw new Error(LOAD_FAILED);
+    }
+    const restore = restoreView?.id === target.id ? restoreView.view : null;
+    restoreView = null;
+    if (restore) renderer.setView(restore);
+    else if (!keepView || showing !== 'pano')
+      renderer.setView({ yaw: 0, pitch: 0, fov: PANO_FOV_DEFAULT_DEG });
+    photo = target;
+    // Shown first: a hidden canvas measures 0 and would be sized 1×1.
+    show('pano');
+    renderer.setImage(image);
+    panoWidth = first.width || 0;
+    // A sharper version of the photo before was dropped by `open`; one of
+    // this photo, asked by a resize meanwhile, is still worth having.
+    return true;
+  }
+
+  async function showFlat(target, seq, signal) {
+    const urls = sources
+      .flatFirst(target, { expanded: isExpanded() })
+      .filter(Boolean);
+    let image;
+    let failure = null;
+    for (const url of urls) {
+      try {
+        image = await loadAs(url, { crossOrigin: false, signal });
+        break;
+      } catch (error) {
+        failure = error;
+        if (seq !== openSeq) return false;
+      }
+    }
+    if (!image) throw failure || new Error(LOAD_FAILED);
+    if (seq !== openSeq) return false;
+    picture.src = image.src;
+    flatSharp = { shown: null, loading: null };
+    photo = target;
+    show('flat');
+    return true;
+  }
+
+  async function openPhoto(id, seq, keepView, signal) {
+    const target = await getPhoto(id, { signal });
+    if (seq !== openSeq) return;
+    let shown = false;
+    if (sources.hasPano(target) && ensureRenderer()) {
+      try {
+        shown = await showPano(target, seq, keepView, signal);
+      } catch {
+        // The panorama failed: its front view is better than nothing.
+        if (seq !== openSeq) return;
+        shown = await showFlat(target, seq, signal);
+      }
+    } else shown = await showFlat(target, seq, signal);
+    if (!shown) return;
+    onShowing(target);
+    emit();
+    onShown(target);
+    upgrade(target, seq, showing);
+  }
+
+  const adapter = {
+    async mount(host) {
+      if (!host) throw new Error('Street Level viewer has no host element');
+      if (root && root.parentNode === host) return;
+      teardown();
+      rendererFailed = false;
+      build(host);
+    },
+
+    /** Resolves once the photo is on screen and its pose was emitted. */
+    async open(imageId) {
+      if (!root) throw new Error(`${name} viewer is not mounted`);
+      const id = String(imageId);
+      const seq = ++openSeq;
+      dropSharpPanorama();
+      // The previous open's downloads stop: only this photo is wanted now.
+      openAbort?.abort();
+      const opening = (openAbort = new AbortController());
+      const keepView = keepViewFor === id;
+      keepViewFor = null;
+      openingId = id;
+      try {
+        await openPhoto(id, seq, keepView, opening.signal);
+      } catch (error) {
+        // A later open, or a close, stopped this one: that is not a failure.
+        if (seq !== openSeq) return;
+        throw error;
+      } finally {
+        if (openingId === id && seq === openSeq) openingId = null;
+      }
+    },
+
+    close() {
+      openSeq++;
+      dropSharpPanorama();
+      openAbort?.abort();
+      openAbort = null;
+      openingId = null;
+      keepViewFor = null;
+      photo = null;
+      flatSharp = { shown: null, loading: null };
+      show(null);
+      if (picture) picture.removeAttribute('src');
+      renderer?.clear?.();
+    },
+
+    unmount() {
+      openSeq++;
+      dropSharpPanorama();
+      openAbort?.abort();
+      openAbort = null;
+      refused.clear();
+      openingId = null;
+      keepViewFor = null;
+      flatSharp = { shown: null, loading: null };
+      teardown();
+    },
+
+    resize() {
+      renderer?.resize();
+      // Expanded: a docked viewer's panorama or flat version is now too soft.
+      if (showing === 'pano' && photo && panoSizeNow()[0] > panoWidth)
+        upgrade(photo, openSeq, 'pano');
+      else if (showing === 'flat' && photo) upgrade(photo, openSeq, 'flat');
+    },
+
+    /** FIT / FILL frame a flat photo; a panorama has no frame to fit. */
+    supportsRenderModes: () => showing !== 'pano',
+
+    setRenderMode(mode) {
+      renderMode = mode === 'fill' ? 'fill' : 'letterbox';
+      applyRenderMode();
+    },
+
+    /** The photo's direction became known (its drive loaded): pose again. */
+    refreshPose() {
+      emit();
+    },
+
+    onPose(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+  };
+  return adapter;
+}

src/layers/streetLevel/photoViewer.test.mjs

@@ -0,0 +1,538 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createPhotoViewer } from './photoViewer.js';
+import { fakeHost, until } from '../../testSupport/kartaViewFakes.mjs';
+
+const PHOTOS = {
+  a: { id: 'a', sequenceId: 's', lon: 1, lat: 2, heading: 0, isPano: true },
+  b: { id: 'b', sequenceId: 's', lon: 1, lat: 2, heading: 0, isPano: true },
+  f: { id: 'f', sequenceId: 's', lon: 1, lat: 2, heading: 0, isPano: false },
+  g: { id: 'g', sequenceId: 's', lon: 1, lat: 2, heading: 0, isPano: false },
+};
+
+/** Sources whose panoramas and sharper flat versions are named after the photo. */
+const SOURCES = {
+  hasPano: (photo) => photo.isPano,
+  panoFirst: (photo) => ({ url: `${photo.id}-first`, width: 2048 }),
+  panoSharp: (photo) => ({ url: `${photo.id}-sharp` }),
+  flatFirst: (photo) => [`${photo.id}-first`],
+  flatSharp: (photo, pixels) => (pixels > 1000 ? `${photo.id}-sharp` : null),
+  describe: () => ({ externalUrl: 'https://example.org' }),
+};
+
+/** A viewer whose loads wait until `release(url)` (or fail with `fail(url)`). */
+function setup() {
+  const pending = new Map();
+  const loads = [];
+  const images = [];
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: (url) =>
+      new Promise((resolve, reject) => {
+        loads.push(url);
+        pending.set(url, { resolve, reject });
+      }),
+    createRenderer: () => ({
+      setImage: (image) => images.push(image.src),
+      setView() {},
+      getView: () => ({ yaw: 0, pitch: 0, fov: 80 }),
+      resize() {},
+      clear() {},
+      destroy() {},
+    }),
+  });
+  const release = (url) => {
+    const closed = { value: false };
+    pending.get(url).resolve({ src: url, close: () => (closed.value = true) });
+    pending.delete(url);
+    return closed;
+  };
+  const fail = (url) => {
+    pending.get(url).reject(new Error('gone'));
+    pending.delete(url);
+  };
+  return { viewer, loads, images, release, fail, host: fakeHost() };
+}
+
+const tick = () => new Promise((resolve) => setTimeout(resolve, 0));
+const parts = (host) => {
+  const [picture, canvas] = host.children[0].children;
+  return { picture, canvas };
+};
+
+test('a panorama that arrives after another photo opened is released, not shown', async () => {
+  const env = setup();
+  await env.viewer.mount(env.host);
+  const first = env.viewer.open('a');
+  await tick();
+  const second = env.viewer.open('b');
+  await tick();
+  const stale = env.release('a-first');
+  await first;
+  assert.equal(stale.value, true, 'its bitmap is closed');
+  env.release('b-first');
+  await second;
+  assert.deepEqual(env.images, ['b-first']);
+});
+
+test('one sharp panorama download per open, even across a quick switch and a burst of resizes', async (t) => {
+  const env = setup();
+  t.after(() => delete globalThis.devicePixelRatio);
+  globalThis.devicePixelRatio = 1;
+  await env.viewer.mount(env.host);
+  const { canvas } = parts(env.host);
+  canvas.clientWidth = 1800;
+  const opening = env.viewer.open('a');
+  await tick();
+  env.release('a-first');
+  await opening;
+  await tick();
+  assert.ok(env.loads.includes('a-sharp'), 'expanded: the sharp one is asked');
+  // Photo b opens while a's sharp version is still on its way.
+  const next = env.viewer.open('b');
+  await tick();
+  env.release('b-first');
+  await next;
+  await tick();
+  assert.ok(env.loads.includes('b-sharp'));
+  // a's download finishes late; resizes must not ask for b's again.
+  env.release('a-sharp');
+  await tick();
+  env.viewer.resize();
+  env.viewer.resize();
+  await tick();
+  assert.equal(env.loads.filter((url) => url === 'b-sharp').length, 1);
+  env.release('b-sharp');
+  await tick();
+  assert.deepEqual(env.images, ['a-first', 'b-first', 'b-sharp']);
+});
+
+test('a sharper flat version that failed is tried again on the next resize', async (t) => {
+  const env = setup();
+  t.after(() => delete globalThis.devicePixelRatio);
+  globalThis.devicePixelRatio = 1;
+  await env.viewer.mount(env.host);
+  const { picture } = parts(env.host);
+  picture.clientWidth = 1200;
+  const opening = env.viewer.open('f');
+  await tick();
+  env.release('f-first');
+  await opening;
+  await tick();
+  env.fail('f-sharp');
+  await tick();
+  assert.equal(picture.src, 'f-first');
+  env.viewer.resize();
+  await tick();
+  assert.equal(env.loads.filter((url) => url === 'f-sharp').length, 2);
+  env.release('f-sharp');
+  assert.ok(await until(() => picture.src === 'f-sharp'));
+});
+
+test('Esc: the docked viewer offers it to the provider first; expanded, it is the dialog’s', async () => {
+  let asked = 0;
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    onEscape: () => ++asked > 0,
+    load: async (url) => ({ src: url }),
+  });
+  const host = fakeHost();
+  await viewer.mount(host);
+  const root = host.children[0];
+  const press = () => {
+    const event = { key: 'Escape', prevented: false, stopped: false };
+    event.preventDefault = () => (event.prevented = true);
+    event.stopPropagation = () => (event.stopped = true);
+    root.fire('keydown', event);
+    return event;
+  };
+  const docked = press();
+  assert.equal(asked, 1);
+  assert.equal(docked.prevented && docked.stopped, true);
+  root.closest = (selector) =>
+    selector.includes('sl-viewer-wrap-expanded') ? {} : null;
+  const expanded = press();
+  assert.equal(asked, 1, 'not asked while expanded');
+  assert.equal(expanded.prevented, false);
+});
+
+test('a sharp panorama still downloading when another photo opens is aborted', async (t) => {
+  const signals = [];
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: (url, options) =>
+      url.endsWith('-sharp')
+        ? new Promise((_, reject) => {
+            signals.push(options.signal);
+            options.signal?.addEventListener('abort', () =>
+              reject(new Error('aborted')),
+            );
+          })
+        : Promise.resolve({ src: url }),
+    createRenderer: () => ({
+      setImage() {},
+      setView() {},
+      getView: () => ({ yaw: 0, pitch: 0, fov: 80 }),
+      resize() {},
+      clear() {},
+      destroy() {},
+    }),
+  });
+  t.after(() => delete globalThis.devicePixelRatio);
+  globalThis.devicePixelRatio = 1;
+  const host = fakeHost();
+  await viewer.mount(host);
+  parts(host).canvas.clientWidth = 1800;
+  await viewer.open('a');
+  await tick();
+  assert.equal(signals.length, 1);
+  assert.equal(signals[0].aborted, false);
+  await viewer.open('f');
+  assert.equal(signals[0].aborted, true, 'not needed any more');
+});
+
+test('a lost WebGL context while the first panorama loads releases its bitmap', async () => {
+  let closed = false;
+  let built = 0;
+  let land = null;
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: (url) =>
+      new Promise((resolve) => {
+        land = () => resolve({ src: url, close: () => (closed = true) });
+      }),
+    // The first renderer is lost mid-load; a new one cannot be built.
+    createRenderer: () => {
+      built++;
+      if (built > 1) throw new Error('context lost');
+      return {
+        setImage() {},
+        setView() {},
+        getView: () => ({ yaw: 0, pitch: 0, fov: 80 }),
+        resize() {},
+        clear() {},
+        destroy() {},
+      };
+    },
+  });
+  const host = fakeHost();
+  await viewer.mount(host);
+  const opening = viewer.open('a');
+  assert.ok(await until(() => land !== null), 'the panorama is loading');
+  parts(host).canvas.fire('webglcontextlost', {});
+  const first = land;
+  first();
+  // The panorama failed: the front view is loaded flat instead.
+  assert.ok(await until(() => land !== first), 'the flat fallback loads');
+  land();
+  await opening;
+  assert.equal(built, 2, 'a new renderer was tried');
+  assert.equal(closed, true, 'the bitmap no renderer took is closed');
+});
+
+test('docked, Esc anywhere in the viewer’s box (toolbar, caption) is offered to the provider', async () => {
+  let asked = 0;
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    onEscape: () => ++asked > 0,
+    load: async (url) => ({ src: url }),
+  });
+  const host = fakeHost();
+  const wrap = fakeHost();
+  host.closest = (selector) => (selector === '.sl-viewer-wrap' ? wrap : null);
+  await viewer.mount(host);
+  const flags = { stopped: false, prevented: false };
+  // Focus back on EXPAND after a shrink: the key reaches the wrap, not the photo.
+  wrap.fire('keydown', {
+    key: 'Escape',
+    stopPropagation: () => (flags.stopped = true),
+    preventDefault: () => (flags.prevented = true),
+  });
+  assert.equal(asked, 1);
+  assert.deepEqual(flags, { stopped: true, prevented: true });
+  viewer.unmount();
+  wrap.fire('keydown', { key: 'Escape' });
+  assert.equal(asked, 1, 'unmounted: the listener is gone');
+});
+
+test('a picture file or bitmap past any real photo’s size is refused', async (t) => {
+  const { loadImage, MAX_IMAGE_BYTES, MAX_IMAGE_SIDE } =
+    await import('./photoViewer.js');
+  const saved = {
+    fetch: globalThis.fetch,
+    createImageBitmap: globalThis.createImageBitmap,
+  };
+  t.after(() => Object.assign(globalThis, saved));
+  let closed = 0;
+  const bitmap = (width, height) => ({ width, height, close: () => closed++ });
+  globalThis.createImageBitmap = async (blob) => blob.bitmap;
+  const respond = ({ length, size, width = 100, height = 50 }) =>
+    (globalThis.fetch = async () => ({
+      ok: true,
+      headers: new Map([['content-length', String(length ?? '')]]),
+      blob: async () => ({
+        size: size ?? 10,
+        bitmap: bitmap(width, height),
+        slice: () => ({ arrayBuffer: async () => new ArrayBuffer(0) }),
+      }),
+    }));
+  const refusedForSize = (error) => {
+    assert.match(error.message, /could not be loaded/);
+    assert.equal(error.tooLarge, true, 'marked as a size refusal');
+    return true;
+  };
+  respond({ length: MAX_IMAGE_BYTES + 1 });
+  await assert.rejects(loadImage('https://x/a.jpg'), refusedForSize);
+  respond({ size: MAX_IMAGE_BYTES + 1 });
+  await assert.rejects(loadImage('https://x/a.jpg'), refusedForSize);
+  respond({ width: MAX_IMAGE_SIDE + 1 });
+  await assert.rejects(loadImage('https://x/a.jpg'), refusedForSize);
+  assert.equal(closed, 1, 'the oversize bitmap is released');
+  // No length given, a body that keeps coming: cut off while it streams.
+  let pulled = 0;
+  globalThis.fetch = async () => ({
+    ok: true,
+    headers: new Map(),
+    body: new ReadableStream({
+      pull(controller) {
+        pulled++;
+        controller.enqueue(new Uint8Array(8 * 1024 * 1024));
+      },
+    }),
+  });
+  await assert.rejects(loadImage('https://x/a.jpg'), refusedForSize);
+  assert.ok(pulled * 8 * 1024 * 1024 <= MAX_IMAGE_BYTES + 16 * 1024 * 1024);
+  // Other failures are not size refusals.
+  globalThis.fetch = async () => ({ ok: false, headers: new Map() });
+  await assert.rejects(
+    loadImage('https://x/a.jpg'),
+    (error) => !error.tooLarge,
+  );
+  respond({});
+  assert.equal((await loadImage('https://x/a.jpg')).width, 100);
+});
+
+/** A viewer whose loads are held, recording each load's signal by url. */
+function heldViewer() {
+  const pending = new Map();
+  const signals = new Map();
+  const loads = [];
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: (url, options = {}) =>
+      new Promise((resolve, reject) => {
+        loads.push(url);
+        signals.set(url, options.signal);
+        options.signal?.addEventListener('abort', () =>
+          reject(new Error('aborted')),
+        );
+        pending.set(url, { resolve, reject });
+      }),
+  });
+  const release = (url) => {
+    pending.get(url).resolve({ src: url });
+    pending.delete(url);
+  };
+  return { viewer, pending, signals, loads, release, host: fakeHost() };
+}
+
+test('a new open, a close or an unmount stops the downloads of the open before it', async () => {
+  const env = heldViewer();
+  await env.viewer.mount(env.host);
+  const first = env.viewer.open('f');
+  assert.ok(await until(() => env.signals.has('f-first')));
+  const second = env.viewer.open('g');
+  assert.equal(env.signals.get('f-first').aborted, true, 'f is not wanted now');
+  await first.catch(() => {});
+  assert.ok(await until(() => env.signals.has('g-first')));
+  env.viewer.close();
+  assert.equal(env.signals.get('g-first').aborted, true, 'closed');
+  await second.catch(() => {});
+  const third = env.viewer.open('f');
+  assert.ok(await until(() => env.pending.has('f-first')));
+  env.viewer.unmount();
+  assert.equal(env.signals.get('f-first').aborted, true, 'unmounted');
+  await third.catch(() => {});
+});
+
+test('a sharper flat version on its way stops when another photo opens, and is asked again later', async (t) => {
+  t.after(() => delete globalThis.devicePixelRatio);
+  globalThis.devicePixelRatio = 1;
+  const env = heldViewer();
+  await env.viewer.mount(env.host);
+  parts(env.host).picture.clientWidth = 1200;
+  const opening = env.viewer.open('f');
+  assert.ok(await until(() => env.pending.has('f-first')));
+  env.release('f-first');
+  await opening;
+  assert.ok(
+    await until(() => env.pending.has('f-sharp')),
+    'the 1,200 px viewer asks for more',
+  );
+  // Resizes while it loads (the panel animating) do not ask again.
+  env.viewer.resize();
+  env.viewer.resize();
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.equal(env.loads.filter((url) => url === 'f-sharp').length, 1);
+  // g opens (and fails): f's sharp download stops, f stays on screen.
+  const failing = env.viewer.open('g');
+  assert.equal(env.signals.get('f-sharp').aborted, true);
+  assert.ok(await until(() => env.pending.has('g-first')));
+  env.pending.get('g-first').reject(new Error('gone'));
+  env.pending.delete('g-first');
+  await failing.catch(() => {});
+  // The discarded response does not block f's sharp version for good.
+  env.signals.delete('f-sharp');
+  env.viewer.resize();
+  assert.ok(await until(() => env.signals.has('f-sharp')), 'asked again');
+});
+
+test('a resize while another photo opens does not upgrade the photo still shown', async (t) => {
+  t.after(() => delete globalThis.devicePixelRatio);
+  globalThis.devicePixelRatio = 1;
+  const env = heldViewer();
+  await env.viewer.mount(env.host);
+  const opening = env.viewer.open('f');
+  assert.ok(await until(() => env.pending.has('f-first')));
+  env.release('f-first');
+  await opening;
+  // g is opening; EXPAND resizes the viewer meanwhile.
+  const next = env.viewer.open('g');
+  assert.ok(await until(() => env.pending.has('g-first')));
+  parts(env.host).picture.clientWidth = 1200;
+  env.viewer.resize();
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.equal(env.pending.has('f-sharp'), false, 'f is on its way out');
+  env.release('g-first');
+  await next;
+  assert.ok(await until(() => env.pending.has('g-sharp')), 'g gets it');
+});
+
+test('a panorama is always decoded at a bounded size', async () => {
+  const env = heldViewer();
+  const options = [];
+  const viewer = createPhotoViewer({
+    providerId: 'test',
+    name: 'Test',
+    sources: SOURCES,
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: async (url, opts) => {
+      options.push(opts);
+      return { src: url };
+    },
+    createRenderer: () => ({
+      setImage() {},
+      setView() {},
+      getView: () => ({ yaw: 0, pitch: 0, fov: 80 }),
+      resize() {},
+      clear() {},
+      destroy() {},
+    }),
+  });
+  await viewer.mount(env.host);
+  await viewer.open('a');
+  // SOURCES' panoFirst names no size: the viewer still bounds it.
+  assert.deepEqual(options[0].resize, [2048, 1024]);
+});
+
+test('a header that declares a huge image is refused before anything decodes it', async (t) => {
+  const { loadImage } = await import('./photoViewer.js');
+  const saved = {
+    fetch: globalThis.fetch,
+    createImageBitmap: globalThis.createImageBitmap,
+  };
+  t.after(() => Object.assign(globalThis, saved));
+  let decoded = 0;
+  globalThis.createImageBitmap = async () => {
+    decoded++;
+    return { width: 10, height: 10 };
+  };
+  // A 1 kB PNG that says it is 16,384 × 16,384.
+  const png = new Uint8Array(1024);
+  png.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13]);
+  png.set(
+    [...'IHDR'].map((c) => c.charCodeAt(0)),
+    12,
+  );
+  png.set([0, 0, 0x40, 0, 0, 0, 0x40, 0], 16);
+  globalThis.fetch = async () => new Response(png);
+  await assert.rejects(
+    loadImage('https://x/bomb.png'),
+    (error) => error.tooLarge === true,
+  );
+  assert.equal(decoded, 0, 'never decoded');
+});
+
+test('an <img> that turns out too large is refused and let go', async (t) => {
+  const { loadImage, MAX_IMAGE_SIDE } = await import('./photoViewer.js');
+  const saved = globalThis.Image;
+  t.after(() => (globalThis.Image = saved));
+  let size = [MAX_IMAGE_SIDE + 1, 100];
+  const images = [];
+  globalThis.Image = class {
+    constructor() {
+      images.push(this);
+    }
+    set src(value) {
+      this._src = value;
+      if (value)
+        queueMicrotask(() => {
+          [this.naturalWidth, this.naturalHeight] = size;
+          this.onload?.();
+        });
+    }
+    get src() {
+      return this._src;
+    }
+  };
+  await assert.rejects(
+    loadImage('https://x/a.jpg', { crossOrigin: false }),
+    (error) => error.tooLarge === true,
+  );
+  assert.equal(images.at(-1).src, '', 'its pixels let go');
+  size = [4000, 3000];
+  const ok = await loadImage('https://x/b.jpg', { crossOrigin: false });
+  assert.equal(ok.naturalWidth, 4000);
+  // An aborted <img> load stops and rejects.
+  size = [10, 10];
+  const controller = new AbortController();
+  const aborted = loadImage('https://x/c.jpg', {
+    crossOrigin: false,
+    signal: controller.signal,
+  });
+  controller.abort();
+  await assert.rejects(aborted);
+  assert.equal(images.at(-1).src, '', 'its download stops');
+});

src/layers/streetLevel/policy.js

@@ -7,6 +7,9 @@ export const POSITION_PICK_ID = 'sl:pos';
 /** One colour per imagery source: chip, coverage lines, points, cones and legend. */
 export const PROVIDER_COLORS = Object.freeze({
   mapillary: '#05cb63',
+  google: '#4285f4',
+  kartaview: '#635bff',
+  panoramax: '#ff6f00',
 });
 
 /** Colours every provider shares: the selection highlight and the marker. */
@@ -35,3 +38,9 @@ export const FOLLOW_MAP_STACK_ID = 'photoreal';
 
 /** Eye height above the sampled ground when the globe camera follows the viewer. */
 export const FOLLOW_EYE_HEIGHT_M = 2.4;
+
+/** Above this, a ground click is a misclick, not a street. */
+export const GROUND_CLICK_MAX_HEIGHT_M = 3_000;
+
+export const AIM_AT_GROUND_MESSAGE =
+  'Aim the middle of the view at a street to look for imagery there';

src/layers/streetLevel/providers/google/index.js

@@ -0,0 +1,184 @@
+import { FOLLOW_MAP_STACK_ID } from '../../policy.js';
+import { createMapsLoader } from './mapsLoader.js';
+import { createGoogleViewer } from './viewer.js';
+import {
+  COLORS,
+  GOOGLE_CREDIT_HTML,
+  GOOGLE_KEY_ID,
+  GOOGLE_LABEL,
+  GOOGLE_NAME,
+  GOOGLE_PROVIDER_ID,
+  GROUND_CLICK_HINT,
+  KEY_REJECTED_MESSAGE,
+  NEAREST_RADIUS_M,
+  NEAREST_TIMEOUT_MS,
+  NO_ANSWER_MESSAGE,
+  PICK_PREFIX,
+} from './policy.js';
+
+/** `promise`, unless it times out, `signal` aborts or Google refuses the key. */
+function settleWithin(promise, { ms, signal, loader }) {
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(
+      () => finish(reject, new Error(NO_ANSWER_MESSAGE)),
+      ms,
+    );
+    const onAbort = () => finish(reject, signal.reason);
+    signal?.addEventListener('abort', onAbort, { once: true });
+    const stopAuthWatch = loader.onAuthFailure(() =>
+      finish(reject, new Error(KEY_REJECTED_MESSAGE)),
+    );
+    promise.then(
+      (value) => finish(resolve, value),
+      (error) => finish(reject, error),
+    );
+    function finish(settle, value) {
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+      stopAuthWatch();
+      settle(value);
+    }
+  });
+}
+
+/**
+ * Google Street View provider: Google's panorama viewer and nearest-panorama
+ * lookups. It draws no coverage; a click on a street opens the panorama.
+ * @returns {import('../../registry.js').StreetLevelProvider}
+ */
+export function createGoogleProvider({
+  getApiKey,
+  loader = createMapsLoader({ getApiKey }),
+}) {
+  if (typeof getApiKey !== 'function')
+    throw new TypeError('Google Street View needs getApiKey');
+
+  return Object.freeze({
+    id: GOOGLE_PROVIDER_ID,
+    name: GOOGLE_NAME,
+    label: GOOGLE_LABEL,
+    requiresKeyId: GOOGLE_KEY_ID,
+    pickPrefix: PICK_PREFIX.root,
+    colors: COLORS,
+    credit: Object.freeze({ html: GOOGLE_CREDIT_HTML }),
+    groundClick: true,
+    // Google's terms forbid Street View beside non-Google maps.
+    requiresMapStack: FOLLOW_MAP_STACK_ID,
+    // Every panorama is billed to the Maps key.
+    defaultOn: false,
+    // All 360°, and no coverage for a date filter to thin.
+    filters: [],
+    marker: Object.freeze({ kind: 'view-cone', color: COLORS.coverage }),
+
+    create(context) {
+      let keyRequired = !getApiKey();
+      let active = false;
+      let service = null;
+      async function getService() {
+        const lib = await loader.importLibrary('streetView');
+        service ||= new lib.StreetViewService();
+        return service;
+      }
+      const viewer = createGoogleViewer({
+        loader,
+        getService,
+        render: context.services?.render,
+      });
+      const stopAuthWatch = loader.onAuthFailure(() => {
+        // Switched off: its chip says so.
+        if (context.isActive?.())
+          context.actions.reportError(KEY_REJECTED_MESSAGE);
+        context.notify();
+      });
+
+      return {
+        async status() {
+          keyRequired = !getApiKey();
+          context.notify();
+          return { configured: !keyRequired };
+        },
+
+        init() {},
+
+        activate() {
+          active = true;
+        },
+
+        deactivate() {
+          active = false;
+        },
+
+        destroy() {
+          active = false;
+          stopAuthWatch();
+        },
+
+        refreshCoverage() {},
+
+        /** No filter applies to Street View (see `filters`). */
+        setFilter() {},
+
+        coverageStats() {
+          const keyRejected = loader.authFailed();
+          return {
+            count: 0,
+            zoom: null,
+            kind: null,
+            loading: false,
+            hint:
+              !active || keyRequired || keyRejected ? '' : GROUND_CLICK_HINT,
+            error: keyRejected ? KEY_REJECTED_MESSAGE : null,
+            keyRequired,
+            keyRejected,
+          };
+        },
+
+        handlePick: () => false,
+
+        /**
+         * Nearest Google-collected outdoor panorama, or null. The imagery
+         * filters do not apply (see `filters`).
+         */
+        async nearestImage({ lat, lon }, { signal } = {}) {
+          if (loader.authFailed()) throw new Error(KEY_REJECTED_MESSAGE);
+          signal?.throwIfAborted();
+          // Set once the caller has its answer (aborted, timed out, refused):
+          // a lookup still waiting on Google's script then asks nothing.
+          let settled = false;
+          const lookup = (async () => {
+            const lib = await loader.importLibrary('streetView');
+            await getService();
+            if (settled) return null;
+            const { GOOGLE, OUTDOOR } = lib.StreetViewSource;
+            try {
+              const { data } = await service.getPanorama({
+                location: { lat, lng: lon },
+                radius: NEAREST_RADIUS_M,
+                // Both: Google's own imagery, outdoors (sources intersect).
+                sources: [GOOGLE, OUTDOOR],
+                preference: lib.StreetViewPreference.NEAREST,
+              });
+              return data;
+            } catch (error) {
+              if (error?.code === 'ZERO_RESULTS') return null;
+              throw error;
+            }
+          })();
+          const data = await settleWithin(lookup, {
+            ms: NEAREST_TIMEOUT_MS,
+            signal,
+            loader,
+          }).finally(() => {
+            settled = true;
+          });
+          const panoId = data?.location?.pano;
+          if (!panoId) return null;
+          viewer.remember(panoId, data);
+          return panoId;
+        },
+
+        viewer,
+      };
+    },
+  });
+}

src/layers/streetLevel/providers/google/mapsLoader.js

@@ -0,0 +1,85 @@
+/**
+ * Loads the Google Maps JavaScript API once per page, on first use. Google's
+ * `gm_authFailure` (key refused) reaches every `onAuthFailure` listener.
+ */
+
+const SCRIPT_ORIGIN = 'https://maps.googleapis.com';
+const READY_CALLBACK = '__gevGoogleMapsReady';
+/** The page's one script load, shared by every loader on it. */
+const PAGE_LOAD = Symbol.for('gev.googleMapsLoad');
+
+/**
+ * @param {{getApiKey: () => string|null|undefined, document?: Document, global?: object}} options
+ */
+export function createMapsLoader({
+  getApiKey,
+  document = globalThis.document,
+  global = globalThis,
+}) {
+  let authFailed = false;
+  let authHandlerInstalled = false;
+  const authListeners = new Set();
+
+  /** Once per loader: a retry must not wrap its own handler. */
+  function installAuthHandler() {
+    if (authHandlerInstalled) return;
+    authHandlerInstalled = true;
+    const previous = global.gm_authFailure;
+    global.gm_authFailure = () => {
+      authFailed = true;
+      for (const listener of [...authListeners]) {
+        try {
+          listener();
+        } catch {
+          /* a listener's error is its own */
+        }
+      }
+      if (typeof previous === 'function') previous();
+    };
+  }
+
+  function load() {
+    const key = getApiKey?.();
+    if (!key)
+      return Promise.reject(new Error('GOOGLE_MAPS_API_KEY is not set'));
+    installAuthHandler();
+    if (global[PAGE_LOAD]) return global[PAGE_LOAD];
+    if (global.google?.maps?.importLibrary)
+      return Promise.resolve(global.google.maps);
+    const loading = new Promise((resolve, reject) => {
+      global[READY_CALLBACK] = () => {
+        delete global[READY_CALLBACK];
+        resolve(global.google.maps);
+      };
+      const script = document.createElement('script');
+      script.async = true;
+      script.src = `${SCRIPT_ORIGIN}/maps/api/js?${new URLSearchParams({
+        key,
+        v: 'weekly',
+        loading: 'async',
+        callback: READY_CALLBACK,
+      })}`;
+      script.onerror = () => {
+        if (global[PAGE_LOAD] === loading) delete global[PAGE_LOAD];
+        script.remove();
+        delete global[READY_CALLBACK];
+        reject(new Error('The Google Maps JavaScript API could not load'));
+      };
+      document.head.append(script);
+    });
+    global[PAGE_LOAD] = loading;
+    return loading;
+  }
+
+  return {
+    async importLibrary(name) {
+      const maps = await load();
+      return maps.importLibrary(name);
+    },
+    authFailed: () => authFailed,
+    onAuthFailure(listener) {
+      authListeners.add(listener);
+      return () => authListeners.delete(listener);
+    },
+  };
+}

src/layers/streetLevel/providers/google/mapsLoader.test.mjs

@@ -0,0 +1,144 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createMapsLoader } from './mapsLoader.js';
+
+/** A document whose appended scripts the test loads or fails. */
+function fakePage() {
+  const scripts = [];
+  const document = {
+    createElement: () => {
+      const script = {
+        remove() {
+          scripts.splice(scripts.indexOf(script), 1);
+        },
+      };
+      return script;
+    },
+    head: { append: (script) => scripts.push(script) },
+  };
+  const global = {};
+  const library = { name: 'streetView' };
+  /** Google's script arrived: it defines google.maps and calls back. */
+  const loadScript = () => {
+    global.google = {
+      maps: { importLibrary: async (name) => ({ ...library, name }) },
+    };
+    const callback = new URL(scripts.at(-1).src).searchParams.get('callback');
+    global[callback]();
+  };
+  return { document, global, scripts, loadScript };
+}
+
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+test('the API loads once, with the key, asynchronously, and hands out libraries', async () => {
+  const page = fakePage();
+  const loader = createMapsLoader({ getApiKey: () => 'k-1', ...page });
+  const first = loader.importLibrary('streetView');
+  const second = loader.importLibrary('streetView');
+  await settle();
+  assert.equal(page.scripts.length, 1, 'one script for concurrent imports');
+  const url = new URL(page.scripts[0].src);
+  assert.equal(
+    url.origin + url.pathname,
+    'https://maps.googleapis.com/maps/api/js',
+  );
+  assert.equal(url.searchParams.get('key'), 'k-1');
+  assert.equal(url.searchParams.get('loading'), 'async');
+  assert.equal(page.scripts[0].async, true);
+  page.loadScript();
+  assert.equal((await first).name, 'streetView');
+  assert.equal((await second).name, 'streetView');
+  const callback = url.searchParams.get('callback');
+  assert.equal(page.global[callback], undefined, 'the callback is cleaned up');
+});
+
+test('two loaders on one page share one script and both get the API', async () => {
+  const page = fakePage();
+  const first = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const second = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const one = first.importLibrary('streetView');
+  const two = second.importLibrary('streetView');
+  await settle();
+  assert.equal(page.scripts.length, 1, 'one script for the page');
+  page.loadScript();
+  assert.equal((await one).name, 'streetView');
+  assert.equal((await two).name, 'streetView');
+  assert.equal((await first.importLibrary('streetView')).name, 'streetView');
+});
+
+test('after a failed script, either loader on the page can retry it', async () => {
+  const page = fakePage();
+  const first = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const second = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const failed = first.importLibrary('streetView');
+  await settle();
+  page.scripts[0].onerror();
+  await assert.rejects(failed, /could not load/);
+  const retry = second.importLibrary('streetView');
+  const again = first.importLibrary('streetView');
+  await settle();
+  assert.equal(page.scripts.length, 1);
+  page.loadScript();
+  assert.equal((await retry).name, 'streetView');
+  assert.equal((await again).name, 'streetView');
+});
+
+test('without a key nothing loads', async () => {
+  const page = fakePage();
+  const loader = createMapsLoader({ getApiKey: () => null, ...page });
+  await assert.rejects(loader.importLibrary('streetView'), /not set/);
+  assert.equal(page.scripts.length, 0);
+});
+
+test('a script that fails to load can be retried', async () => {
+  const page = fakePage();
+  const loader = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const failed = loader.importLibrary('streetView');
+  await settle();
+  page.scripts[0].onerror();
+  await assert.rejects(failed, /could not load/);
+  assert.equal(page.scripts.length, 0, 'the failed script is removed');
+  const retry = loader.importLibrary('streetView');
+  await settle();
+  assert.equal(page.scripts.length, 1);
+  page.loadScript();
+  assert.equal((await retry).name, 'streetView');
+});
+
+test("Google's refusal of the key reaches every listener and the page's own handler", async () => {
+  const page = fakePage();
+  let before = 0;
+  page.global.gm_authFailure = () => before++;
+  const loader = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const heard = [];
+  const stop = loader.onAuthFailure(() => heard.push('a'));
+  loader.importLibrary('streetView');
+  await settle();
+  assert.equal(loader.authFailed(), false);
+  page.global.gm_authFailure();
+  assert.equal(loader.authFailed(), true);
+  assert.deepEqual(heard, ['a']);
+  assert.equal(before, 1, 'a handler installed earlier still runs');
+  stop();
+  page.global.gm_authFailure();
+  assert.deepEqual(heard, ['a']);
+});
+
+test('a retried load still reports a refusal once, and the page handler once', async () => {
+  const page = fakePage();
+  let before = 0;
+  page.global.gm_authFailure = () => before++;
+  const loader = createMapsLoader({ getApiKey: () => 'k', ...page });
+  const heard = [];
+  loader.onAuthFailure(() => heard.push('a'));
+  const failed = loader.importLibrary('streetView');
+  await settle();
+  page.scripts[0].onerror();
+  await assert.rejects(failed);
+  loader.importLibrary('streetView');
+  await settle();
+  page.global.gm_authFailure();
+  assert.deepEqual(heard, ['a']);
+  assert.equal(before, 1);
+});

src/layers/streetLevel/providers/google/policy.js

@@ -0,0 +1,65 @@
+import { COLORS as SHARED_COLORS, PROVIDER_COLORS } from '../../policy.js';
+
+export { NEAREST_RADIUS_M } from '../../policy.js';
+
+export const GOOGLE_PROVIDER_ID = 'google';
+export const GOOGLE_NAME = 'Google Street View';
+export const GOOGLE_LABEL = 'GOOGLE STREET VIEW';
+/** The browser Maps key; Street View also needs the Maps JavaScript API on it. */
+export const GOOGLE_KEY_ID = 'google-maps';
+
+export const PICK_PREFIX = Object.freeze({ root: 'gsv:' });
+
+export const COLORS = Object.freeze({
+  coverage: PROVIDER_COLORS.google,
+  selected: SHARED_COLORS.selected,
+});
+
+export const GOOGLE_CREDIT_HTML =
+  'Street View imagery © <a href="https://www.google.com/streetview/" target="_blank" rel="noopener">Google</a>';
+
+/** Shown when Google refuses the key (gm_authFailure). */
+export const KEY_REJECTED_MESSAGE =
+  'Google refused GOOGLE_MAPS_API_KEY for Street View — check that the Maps JavaScript API is enabled for it and this site is an allowed referrer';
+
+/** Past these, a nearest lookup, an open or a details lookup has failed. */
+export const NEAREST_TIMEOUT_MS = 10_000;
+export const OPEN_TIMEOUT_MS = 20_000;
+export const DETAILS_TIMEOUT_MS = 10_000;
+/** Pause after a failed details lookup before a view event can retry. */
+export const DETAILS_RETRY_COOLDOWN_MS = 5_000;
+
+export const NO_ANSWER_MESSAGE =
+  'Street View did not answer — check the network, and that the Maps JavaScript API is enabled for GOOGLE_MAPS_API_KEY';
+
+export const GROUND_CLICK_HINT = 'click a street to open Street View';
+
+/** Deep link to a panorama on Google Maps (Maps URLs). */
+export function streetViewUrl(panoId, { heading = 0, pitch = 0 } = {}) {
+  const params = new URLSearchParams({
+    api: '1',
+    map_action: 'pano',
+    pano: String(panoId),
+    heading: String(Math.round(heading)),
+    pitch: String(Math.round(pitch)),
+  });
+  return `https://www.google.com/maps/@?${params}`;
+}
+
+/** Epoch ms for a Street View image date ('YYYY-MM'), or null. */
+export function imageDateMs(imageDate) {
+  const match = /^(\d{4})-(\d{2})/.exec(String(imageDate ?? ''));
+  if (!match) return null;
+  const month = Number(match[2]);
+  if (month < 1 || month > 12) return null;
+  return Date.UTC(Number(match[1]), month - 1, 1);
+}
+
+/** The photographer from a copyright line ('© 2024 Google' → 'Google'). */
+export function creatorFrom(copyright) {
+  const text = String(copyright ?? '')
+    .replace(/^©\s*(\d{4}\s+)?/, '')
+    .replace(/^From the Owner,\s*Photo by:\s*/i, '')
+    .trim();
+  return text || null;
+}

src/layers/streetLevel/providers/google/provider.test.mjs

@@ -0,0 +1,293 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createGoogleProvider } from './index.js';
+import {
+  GROUND_CLICK_HINT,
+  KEY_REJECTED_MESSAGE,
+  creatorFrom,
+  imageDateMs,
+  streetViewUrl,
+} from './policy.js';
+import { PROVIDER_COLORS } from '../../policy.js';
+import { requiresKeyIdFor, validateProviders } from '../../registry.js';
+import { createMapillaryProvider } from '../mapillary/index.js';
+import {
+  fakeHost,
+  fakeMapsLoader,
+  fakeStreetViewLibrary,
+} from '../../../../testSupport/googleStreetViewFakes.mjs';
+
+const PANORAMAS = {
+  fresh: { lat: 38.5816, lng: -121.4944, imageDate: '2025-06' },
+  old: { lat: 38.6, lng: -121.5, imageDate: '2009-03' },
+};
+
+function setup({ key = 'browser-key', nearest = () => 'fresh' } = {}) {
+  const fake = fakeStreetViewLibrary({ panoramas: PANORAMAS, nearest });
+  const loader = fakeMapsLoader(fake.library);
+  let apiKey = key;
+  const def = createGoogleProvider({ getApiKey: () => apiKey, loader });
+  const reported = [];
+  let filter = { pano: 'all', sinceMs: null };
+  let active = false;
+  const context = {
+    services: {},
+    getFilter: () => filter,
+    isActive: () => active,
+    notify() {},
+    actions: { reportError: (message) => reported.push(message) },
+  };
+  const created = def.create(context);
+  // The core switches it on and off; mirror that for isActive().
+  const instance = {
+    ...created,
+    activate() {
+      active = true;
+      created.activate();
+    },
+    deactivate() {
+      active = false;
+      created.deactivate();
+    },
+  };
+  return {
+    def,
+    instance,
+    fake,
+    loader,
+    reported,
+    setFilter: (next) => (filter = next),
+    setKey: (next) => (apiKey = next),
+  };
+}
+
+test('the provider registers beside Mapillary, off by default, gated on the browser Maps key', () => {
+  const { def } = setup();
+  assert.equal(def.id, 'google');
+  assert.equal(def.label, 'GOOGLE STREET VIEW');
+  assert.deepEqual(def.filters, [], 'no imagery filter applies');
+  assert.deepEqual(def.marker, { kind: 'view-cone', color: '#4285f4' });
+  assert.equal(def.requiresKeyId, 'google-maps');
+  assert.equal(def.defaultOn, false, 'every panorama is billed');
+  assert.equal(def.groundClick, true);
+  assert.equal(def.colors.coverage, PROVIDER_COLORS.google);
+  assert.match(def.credit.html, /Street View imagery © .*Google/);
+  const mapillary = createMapillaryProvider({
+    source: {
+      getStatus() {},
+      getTile() {},
+      getSequenceImages() {},
+      nearestImages() {},
+    },
+  });
+  const both = validateProviders([mapillary, def]);
+  assert.equal(requiresKeyIdFor(both), null, 'each chip gates on its own key');
+  assert.throws(() => createGoogleProvider({}), /getApiKey/);
+});
+
+test('status follows the browser Maps key', async () => {
+  const { instance, setKey } = setup({ key: '' });
+  assert.deepEqual(await instance.status(), { configured: false });
+  assert.equal(instance.coverageStats().keyRequired, true);
+  setKey('browser-key');
+  assert.deepEqual(await instance.status(), { configured: true });
+  assert.equal(instance.coverageStats().keyRequired, false);
+});
+
+test('the nearest lookup asks Google for its own outdoor imagery within 50 m', async () => {
+  const { instance, fake } = setup();
+  assert.equal(
+    await instance.nearestImage({ lat: 38.58, lon: -121.49 }),
+    'fresh',
+  );
+  const [request] = fake.lookups;
+  assert.deepEqual(request.location, { lat: 38.58, lng: -121.49 });
+  assert.equal(request.radius, 50);
+  assert.deepEqual(request.sources, ['google', 'outdoor']);
+  assert.equal(request.preference, 'nearest');
+});
+
+test('no panorama nearby is null; the imagery filters (Mapillary\u2019s) do not apply', async () => {
+  const none = setup({ nearest: () => null });
+  assert.equal(await none.instance.nearestImage({ lat: 0, lon: 0 }), null);
+
+  const { instance, setFilter } = setup({ nearest: () => 'old' }); // 2009
+  for (const filter of [
+    { pano: 'all', sinceMs: Date.UTC(2020, 0, 1) },
+    { pano: 'flat', sinceMs: null },
+    { pano: 'pano', sinceMs: Date.UTC(2025, 0, 1) },
+  ]) {
+    setFilter(filter);
+    assert.equal(await instance.nearestImage({ lat: 0, lon: 0 }), 'old');
+  }
+  assert.equal(instance.coverageStats().hint, '', 'off: no hint');
+  instance.activate();
+  setFilter({ pano: 'flat', sinceMs: null });
+  assert.equal(instance.coverageStats().hint, GROUND_CLICK_HINT);
+});
+
+test('an aborted lookup gives up before asking Google', async () => {
+  const { instance } = setup();
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(
+    instance.nearestImage({ lat: 0, lon: 0 }, { signal: controller.signal }),
+    { name: 'AbortError' },
+  );
+});
+
+test('a key Google refuses reads KEY REJECTED, shows why, and stops lookups', async () => {
+  const { instance, loader, reported } = setup();
+  instance.activate();
+  assert.equal(instance.coverageStats().hint, GROUND_CLICK_HINT);
+  loader.refuseKey();
+  const stats = instance.coverageStats();
+  assert.equal(stats.keyRejected, true);
+  assert.equal(stats.error, KEY_REJECTED_MESSAGE);
+  assert.equal(stats.hint, '', 'no "click a street" hint over a dead key');
+  assert.deepEqual(reported, [KEY_REJECTED_MESSAGE]);
+  await assert.rejects(instance.nearestImage({ lat: 0, lon: 0 }), {
+    message: KEY_REJECTED_MESSAGE,
+  });
+  instance.destroy();
+  assert.equal(loader.listenerCount(), 0, 'destroy stops listening');
+});
+
+test('the hint shows only while the provider is on', () => {
+  const { instance } = setup();
+  assert.equal(instance.coverageStats().hint, '');
+  instance.activate();
+  assert.equal(instance.coverageStats().hint, GROUND_CLICK_HINT);
+  instance.deactivate();
+  assert.equal(instance.coverageStats().hint, '');
+});
+
+test('image dates, photographers and deep links read the way Google writes them', () => {
+  assert.equal(imageDateMs('2024-05'), Date.UTC(2024, 4, 1));
+  assert.equal(imageDateMs('2024-13'), null);
+  assert.equal(imageDateMs(undefined), null);
+  assert.equal(creatorFrom('© 2024 Google'), 'Google');
+  assert.equal(creatorFrom('From the Owner, Photo by: Ada'), 'Ada');
+  assert.equal(creatorFrom(''), null);
+  assert.equal(
+    streetViewUrl('a b', { heading: 90.4, pitch: -9.6 }),
+    'https://www.google.com/maps/@?api=1&map_action=pano&pano=a+b&heading=90&pitch=-10',
+  );
+});
+
+test('a lookup Google never answers fails after the timeout, and a refused key fails it at once', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const { NEAREST_TIMEOUT_MS, NO_ANSWER_MESSAGE } = await import('./policy.js');
+  const { instance, fake, loader } = setup();
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    new Promise(() => {});
+  const hung = instance.nearestImage({ lat: 0, lon: 0 });
+  await Promise.resolve();
+  await Promise.resolve();
+  t.mock.timers.tick(NEAREST_TIMEOUT_MS);
+  await assert.rejects(hung, { message: NO_ANSWER_MESSAGE });
+
+  const refused = instance.nearestImage({ lat: 0, lon: 0 });
+  await Promise.resolve();
+  loader.refuseKey();
+  await assert.rejects(refused, { message: KEY_REJECTED_MESSAGE });
+  assert.equal(
+    loader.listenerCount(),
+    1,
+    'only the provider’s own watch is left',
+  );
+});
+
+test('aborting a lookup in flight gives up at once', async () => {
+  const { instance, fake } = setup();
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    new Promise(() => {});
+  const controller = new AbortController();
+  const lookup = instance.nearestImage(
+    { lat: 0, lon: 0 },
+    { signal: controller.signal },
+  );
+  controller.abort();
+  await assert.rejects(lookup, { name: 'AbortError' });
+});
+
+test('a lookup cancelled while Google\u2019s script loads asks Google nothing', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const { NEAREST_TIMEOUT_MS } = await import('./policy.js');
+  const fake = fakeStreetViewLibrary({
+    panoramas: PANORAMAS,
+    nearest: () => 'fresh',
+  });
+  const loader = fakeMapsLoader(fake.library, { deferred: true });
+  const instance = createGoogleProvider({
+    getApiKey: () => 'browser-key',
+    loader,
+  }).create({
+    services: {},
+    getFilter: () => ({ pano: 'all', sinceMs: null }),
+    isActive: () => true,
+    notify() {},
+    actions: { reportError() {} },
+  });
+  const flush = async () => {
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+  };
+  // Aborted, then timed out, while the script still loads.
+  const controller = new AbortController();
+  const aborted = instance.nearestImage(
+    { lat: 0, lon: 0 },
+    { signal: controller.signal },
+  );
+  controller.abort();
+  await assert.rejects(aborted, { name: 'AbortError' });
+  const expired = instance.nearestImage({ lat: 0, lon: 0 });
+  t.mock.timers.tick(NEAREST_TIMEOUT_MS);
+  await assert.rejects(expired, /did not answer/);
+  // The script arrives: a current lookup still gets its answer.
+  const current = instance.nearestImage({ lat: 0, lon: 0 });
+  loader.release();
+  await flush();
+  assert.equal(await current, 'fresh');
+  assert.equal(fake.lookups.length, 1, 'only the current lookup asked Google');
+});
+
+test('a Google outage is an error, not "no imagery here"', async () => {
+  const { instance, fake } = setup();
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    Promise.reject(
+      Object.assign(new Error('UNKNOWN_ERROR'), {
+        code: 'UNKNOWN_ERROR',
+        endpoint: 'STREETVIEW_GET_PANORAMA',
+      }),
+    );
+  await assert.rejects(instance.nearestImage({ lat: 0, lon: 0 }), {
+    code: 'UNKNOWN_ERROR',
+  });
+});
+
+test('a refusal while the provider is off reports no error over another photo', () => {
+  const { instance, loader, reported } = setup();
+  loader.refuseKey();
+  assert.deepEqual(reported, []);
+  assert.equal(
+    instance.coverageStats().keyRejected,
+    true,
+    'its chip still says so',
+  );
+});
+
+test('the panorama a lookup found is dated without a second lookup', async () => {
+  const { instance, fake } = setup();
+  await instance.nearestImage({ lat: 38.58, lon: -121.49 });
+  const host = fakeHost();
+  const poses = [];
+  instance.viewer.onPose((pose) => poses.push(pose));
+  await instance.viewer.mount(host);
+  await instance.viewer.open('fresh');
+  assert.equal(poses.at(-1).capturedAt, Date.UTC(2025, 5, 1));
+  assert.deepEqual(
+    fake.lookups.filter((request) => request.pano),
+    [],
+    'no getPanorama({pano}) for a panorama the lookup already described',
+  );
+});

src/layers/streetLevel/providers/google/viewer.js

@@ -0,0 +1,286 @@
+import {
+  DETAILS_RETRY_COOLDOWN_MS,
+  DETAILS_TIMEOUT_MS,
+  GOOGLE_PROVIDER_ID,
+  KEY_REJECTED_MESSAGE,
+  NO_ANSWER_MESSAGE,
+  OPEN_TIMEOUT_MS,
+  creatorFrom,
+  imageDateMs,
+  streetViewUrl,
+} from './policy.js';
+
+const PANORAMA_OPTIONS = Object.freeze({
+  visible: false,
+  // The caption has the address; Google's card covers a docked panorama.
+  addressControl: false,
+  linksControl: true,
+  panControl: true,
+  zoomControl: true,
+  clickToGo: true,
+  showRoadLabels: true,
+  // The panel has EXPAND and ×.
+  fullscreenControl: false,
+  enableCloseButton: false,
+  motionTracking: false,
+  motionTrackingControl: false,
+});
+
+/**
+ * Viewer adapter over Google's StreetViewPanorama: emits a pose for every
+ * panorama and view change, including steps along Google's arrows.
+ * @param {{loader: ReturnType<import('./mapsLoader.js').createMapsLoader>, getService?: () => Promise<object>, render?: object}} options
+ * @returns {import('../../registry.js').ViewerAdapter & {remember: Function}}
+ */
+export function createGoogleViewer({ loader, getService, render } = {}) {
+  let library = null;
+  let panorama = null;
+  let element = null;
+  let host = null;
+  let service = null;
+  let pendingOpen = null;
+  let cancelShown = null;
+  /** Bumped by `unmount`: a construction it overtook builds nothing. */
+  let generation = 0;
+  let subscriptions = [];
+  const described = new Map();
+  /** Panorama id → its lookup in flight; a late answer to a dropped one is ignored. */
+  const lookingUp = new Map();
+  const retryAfter = new Map();
+  const listeners = new Set();
+
+  function requestRender() {
+    render?.governorRequestRender?.('google-street-view');
+  }
+
+  async function ensureLibrary() {
+    library ||= await loader.importLibrary('streetView');
+    return library;
+  }
+
+  function emit(pose) {
+    for (const listener of [...listeners]) {
+      try {
+        listener(pose);
+      } catch {
+        /* listener errors are the core's to log */
+      }
+    }
+  }
+
+  function metaFrom(data) {
+    return {
+      capturedAt: imageDateMs(data?.imageDate),
+      creator: creatorFrom(data?.copyright),
+      title: data?.location?.description || null,
+    };
+  }
+
+  /**
+   * Look up a panorama's date, photographer and address once, then re-emit
+   * the pose. A failed or timed-out lookup can retry after the cooldown.
+   */
+  async function describe(panoId) {
+    if (described.has(panoId) || lookingUp.has(panoId)) return;
+    if (Date.now() < (retryAfter.get(panoId) ?? 0)) return;
+    const lookup = { timer: null };
+    lookingUp.set(panoId, lookup);
+    const current = () => lookingUp.get(panoId) === lookup;
+    try {
+      const { data } = await new Promise((resolve, reject) => {
+        lookup.timer = setTimeout(
+          () => reject(new Error(NO_ANSWER_MESSAGE)),
+          DETAILS_TIMEOUT_MS,
+        );
+        (async () => {
+          service ||= getService
+            ? await getService()
+            : new (await ensureLibrary()).StreetViewService();
+          return service.getPanorama({ pano: panoId });
+        })().then(resolve, reject);
+      });
+      if (!current()) return;
+      described.set(panoId, metaFrom(data));
+      retryAfter.delete(panoId);
+    } catch {
+      if (current())
+        retryAfter.set(panoId, Date.now() + DETAILS_RETRY_COOLDOWN_MS);
+      return;
+    } finally {
+      clearTimeout(lookup.timer);
+      if (current()) lookingUp.delete(panoId);
+    }
+    publishPose();
+  }
+
+  function releaseLookups() {
+    for (const lookup of lookingUp.values()) clearTimeout(lookup.timer);
+    lookingUp.clear();
+  }
+
+  function publishPose() {
+    const panoId = panorama?.getPano?.();
+    const latLng = panorama?.getPosition?.();
+    if (!panoId || !latLng || pendingOpen === null) return;
+    const meta = described.get(panoId);
+    if (!meta) describe(panoId);
+    const pov = panorama.getPov() || {};
+    emit({
+      providerId: GOOGLE_PROVIDER_ID,
+      imageId: panoId,
+      position: { lon: latLng.lng(), lat: latLng.lat() },
+      bearing: Number.isFinite(pov.heading) ? pov.heading : null,
+      tilt: Number.isFinite(pov.pitch) ? pov.pitch : 0,
+      altitude: null,
+      isPano: true,
+      capturedAt: meta?.capturedAt ?? null,
+      capturedAtPrecision: 'month',
+      creator: meta?.creator ?? null,
+      title: meta?.title ?? null,
+      sequenceId: null,
+      externalUrl: streetViewUrl(panoId, {
+        heading: pov.heading || 0,
+        pitch: pov.pitch || 0,
+      }),
+    });
+    requestRender();
+  }
+
+  async function ensurePanorama(target) {
+    if (panorama && host === target) return panorama;
+    const built = generation;
+    const { StreetViewPanorama } = await ensureLibrary();
+    if (built !== generation) throw new Error('Street View was unmounted');
+    if (panorama && host === target) return panorama;
+    destroyPanorama();
+    element = target.ownerDocument.createElement('div');
+    element.className = 'sl-google-panorama';
+    element.style.cssText = 'position:absolute;inset:0;';
+    target.append(element);
+    host = target;
+    panorama = new StreetViewPanorama(element, PANORAMA_OPTIONS);
+    // Not pano_changed: it can fire with the old panorama's position.
+    subscriptions = ['position_changed', 'pov_changed'].map((name) =>
+      panorama.addListener(name, () => publishPose()),
+    );
+    return panorama;
+  }
+
+  function destroyPanorama() {
+    for (const subscription of subscriptions) subscription.remove();
+    subscriptions = [];
+    try {
+      panorama?.setVisible(false);
+    } catch {
+      /* already gone */
+    }
+    element?.remove();
+    panorama = null;
+    element = null;
+    host = null;
+  }
+
+  /**
+   * Resolves once `panoId` shows (OK status, or a new position when the
+   * status stays OK); rejects on no imagery, a refused key or no answer.
+   */
+  function shown(instance, panoId) {
+    if (instance.getPano() === panoId && instance.getStatus() === 'OK')
+      return Promise.resolve();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () => finish(reject, new Error(NO_ANSWER_MESSAGE)),
+        OPEN_TIMEOUT_MS,
+      );
+      const stopAuthWatch = loader.onAuthFailure(() =>
+        finish(reject, new Error(KEY_REJECTED_MESSAGE)),
+      );
+      cancelShown = () => finish(resolve);
+      // At a position event the status may still be the last panorama's failure.
+      const onStatus = () => {
+        if (pendingOpen !== panoId) return finish(resolve);
+        const status = instance.getStatus();
+        if (status === 'OK') finish(resolve);
+        else if (status)
+          finish(
+            reject,
+            new Error('Street View has no imagery for this place'),
+          );
+      };
+      const onPosition = () => {
+        if (pendingOpen !== panoId || instance.getStatus() === 'OK')
+          finish(resolve);
+      };
+      const subscriptions = [
+        instance.addListener('status_changed', onStatus),
+        instance.addListener('position_changed', onPosition),
+      ];
+      function finish(settle, value) {
+        cancelShown = null;
+        clearTimeout(timer);
+        for (const subscription of subscriptions) subscription.remove();
+        stopAuthWatch();
+        settle(value);
+      }
+    });
+  }
+
+  return {
+    async mount(target) {
+      if (!target) throw new Error('Street Level viewer has no host element');
+      await ensurePanorama(target);
+    },
+
+    async open(imageId) {
+      const panoId = String(imageId);
+      if (!host) throw new Error('Street View is not mounted');
+      if (loader.authFailed()) throw new Error(KEY_REJECTED_MESSAGE);
+      pendingOpen = panoId;
+      const instance = await ensurePanorama(host);
+      if (pendingOpen !== panoId) return;
+      const ready = shown(instance, panoId);
+      instance.setPano(panoId);
+      instance.setVisible(true);
+      await ready;
+      if (pendingOpen !== panoId) return;
+      publishPose();
+    },
+
+    close() {
+      pendingOpen = null;
+      cancelShown?.();
+      try {
+        panorama?.setVisible(false);
+      } catch {
+        /* torn down */
+      }
+    },
+
+    unmount() {
+      pendingOpen = null;
+      cancelShown?.();
+      releaseLookups();
+      generation++;
+      destroyPanorama();
+    },
+
+    resize() {
+      if (!panorama) return;
+      try {
+        globalThis.google?.maps?.event?.trigger(panorama, 'resize');
+      } catch {
+        /* no-op */
+      }
+    },
+
+    onPose(listener) {
+      listeners.add(listener);
+      return () => listeners.delete(listener);
+    },
+
+    /** Seed the details cache from a nearest lookup's answer. */
+    remember(panoId, data) {
+      if (panoId && data) described.set(String(panoId), metaFrom(data));
+    },
+  };
+}

src/layers/streetLevel/providers/google/viewer.test.mjs

@@ -0,0 +1,405 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createGoogleViewer } from './viewer.js';
+import { DETAILS_RETRY_COOLDOWN_MS, DETAILS_TIMEOUT_MS } from './policy.js';
+import {
+  fakeHost,
+  fakeMapsLoader,
+  fakeStreetViewLibrary,
+} from '../../../../testSupport/googleStreetViewFakes.mjs';
+
+const PANORAMAS = {
+  'pano-a': {
+    lat: 38.5816,
+    lng: -121.4944,
+    imageDate: '2024-05',
+    copyright: '© 2024 Google',
+    description: '10th St',
+  },
+  'pano-b': {
+    lat: 38.5817,
+    lng: -121.4944,
+    imageDate: '2019-08',
+    copyright: 'From the Owner, Photo by: Ada',
+  },
+};
+
+function setup() {
+  const fake = fakeStreetViewLibrary({ panoramas: PANORAMAS });
+  const loader = fakeMapsLoader(fake.library);
+  const viewer = createGoogleViewer({ loader });
+  const poses = [];
+  viewer.onPose((pose) => poses.push(pose));
+  const host = fakeHost();
+  return { fake, loader, viewer, poses, host };
+}
+
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+test('opening a panorama shows it and emits a provider-neutral pose', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  assert.equal(host.children.length, 1, 'renders in its own element');
+  const [panorama] = fake.built;
+  assert.equal(panorama.options.fullscreenControl, false);
+  assert.equal(panorama.options.addressControl, false, 'the caption has it');
+  assert.equal(panorama.options.enableCloseButton, false);
+  assert.equal(panorama.visible, false, 'nothing shows before an open');
+
+  await viewer.open('pano-a');
+  assert.equal(panorama.visible, true);
+  await settle(); // the pose is dated once its lookup answers
+  const pose = poses.at(-1);
+  assert.deepEqual(
+    {
+      providerId: pose.providerId,
+      imageId: pose.imageId,
+      position: pose.position,
+      isPano: pose.isPano,
+      capturedAt: pose.capturedAt,
+      capturedAtPrecision: pose.capturedAtPrecision,
+      creator: pose.creator,
+      title: pose.title,
+    },
+    {
+      providerId: 'google',
+      imageId: 'pano-a',
+      position: { lon: -121.4944, lat: 38.5816 },
+      isPano: true,
+      capturedAt: Date.UTC(2024, 4, 1),
+      capturedAtPrecision: 'month',
+      creator: 'Google',
+      title: '10th St',
+    },
+  );
+  assert.match(pose.externalUrl, /map_action=pano&pano=pano-a/);
+});
+
+test('dragging the view and stepping along an arrow both emit poses; the date is looked up once per panorama', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano-a');
+  const [panorama] = fake.built;
+  panorama.setPov({ heading: 90, pitch: -10 });
+  await settle();
+  assert.deepEqual(
+    [poses.at(-1).bearing, poses.at(-1).tilt],
+    [90, -10],
+    'the view follows the drag',
+  );
+  // Google's own arrow: the panorama changes without an open.
+  panorama.setPano('pano-b');
+  await settle();
+  await settle();
+  assert.equal(poses.at(-1).imageId, 'pano-b');
+  assert.equal(poses.at(-1).creator, 'Ada');
+  const dateLookups = fake.lookups.filter((request) => request.pano);
+  assert.deepEqual(
+    dateLookups.map((request) => request.pano),
+    ['pano-a', 'pano-b'],
+  );
+});
+
+test('a panorama Google has no imagery for fails the open', async () => {
+  const { viewer, host } = setup();
+  await viewer.mount(host);
+  await assert.rejects(viewer.open('gone'), /no imagery/);
+});
+
+test('a closed panorama is hidden and its late view changes emit nothing', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano-a');
+  const [panorama] = fake.built;
+  viewer.close();
+  assert.equal(panorama.visible, false);
+  const count = poses.length;
+  panorama.setPov({ heading: 180, pitch: 0 });
+  await settle();
+  assert.equal(poses.length, count);
+});
+
+test('an open overtaken by a newer one only shows the newer panorama', async () => {
+  const { viewer, poses, host } = setup();
+  await viewer.mount(host);
+  const first = viewer.open('pano-a');
+  const second = viewer.open('pano-b');
+  await Promise.all([first, second]);
+  assert.deepEqual(
+    [...new Set(poses.map((pose) => pose.imageId))].at(-1),
+    'pano-b',
+  );
+  assert.ok(!poses.some((pose) => pose.imageId === 'pano-a'));
+});
+
+test('unmounting removes the element and every listener', async () => {
+  const { fake, viewer, host } = setup();
+  await viewer.mount(host);
+  const [panorama] = fake.built;
+  assert.ok(panorama.listenerCount() > 0);
+  viewer.unmount();
+  assert.equal(host.children.length, 0);
+  assert.equal(panorama.listenerCount(), 0);
+  await assert.rejects(viewer.open('pano-a'), /not mounted/);
+});
+
+test('there is no prewarm: Google\u2019s script loads on first use only, never on another map', () => {
+  const { viewer, loader } = setup();
+  assert.equal(viewer.prewarm, undefined);
+  assert.deepEqual(loader.imports, []);
+});
+
+test('a key Google refuses fails the open at once, not after the timeout', async () => {
+  const { fake, loader, viewer, host } = setup();
+  await viewer.mount(host);
+  const [panorama] = fake.built;
+  // Google refuses the key while the panorama loads; it never reports OK.
+  panorama.setPano = (id) => {
+    panorama.pano = id;
+    queueMicrotask(() => loader.refuseKey());
+  };
+  await assert.rejects(viewer.open('pano-a'), /Maps JavaScript API is enabled/);
+  await assert.rejects(viewer.open('pano-b'), /Maps JavaScript API is enabled/);
+  assert.equal(loader.listenerCount(), 0, 'no auth listener is left behind');
+});
+
+test('a viewer unmounted while the library loads builds no panorama (none is billed)', async () => {
+  const fake = fakeStreetViewLibrary({ panoramas: PANORAMAS });
+  const loader = fakeMapsLoader(fake.library, { deferred: true });
+  const viewer = createGoogleViewer({ loader });
+  const host = fakeHost();
+  const mounting = viewer.mount(host);
+  viewer.unmount();
+  loader.release();
+  await assert.rejects(mounting, /unmounted/);
+  assert.equal(fake.built.length, 0);
+  assert.equal(host.children.length, 0);
+});
+
+test('a date that arrives after the photo was closed emits nothing', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano-a');
+  const [panorama] = fake.built;
+  let answer;
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    new Promise((resolve) => {
+      answer = resolve;
+    });
+  panorama.setPano('pano-b'); // Google's arrow; its date is still unknown
+  await settle();
+  assert.equal(poses.at(-1).imageId, 'pano-b', 'the step shows at once');
+  assert.equal(
+    poses.at(-1).capturedAt,
+    null,
+    'undated until the lookup answers',
+  );
+  viewer.close();
+  const count = poses.length;
+  answer({ data: { imageDate: '2019-08' } });
+  await settle();
+  assert.equal(poses.length, count);
+});
+
+test('an open never waits on the date lookup', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  fake.library.StreetViewService.prototype.getPanorama = () =>
+    new Promise(() => {}); // the metadata never answers
+  await viewer.open('pano-a');
+  assert.equal(poses.at(-1).imageId, 'pano-a');
+  viewer.unmount();
+});
+
+test('closing while a panorama loads settles the open and drops its listeners', async () => {
+  const { fake, loader, viewer, host } = setup();
+  await viewer.mount(host);
+  const [panorama] = fake.built;
+  const before = panorama.listenerCount();
+  panorama.setPano = (id) => {
+    panorama.pano = id; // still loading
+  };
+  const opening = viewer.open('pano-a');
+  await settle();
+  viewer.close();
+  await opening;
+  assert.equal(panorama.listenerCount(), before);
+  assert.equal(loader.listenerCount(), 0);
+});
+
+test('a second open whose status stays OK still resolves, on the new position', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano-a');
+  assert.equal(fake.built[0].getStatus(), 'OK');
+  await viewer.open('pano-b'); // OK → OK: no status_changed
+  assert.equal(poses.at(-1).imageId, 'pano-b');
+});
+
+test('Google answering with a newer id for the place shows that id', async () => {
+  const fake = fakeStreetViewLibrary({
+    panoramas: PANORAMAS,
+    substitutes: { 'old-id': 'pano-a' },
+  });
+  const viewer = createGoogleViewer({ loader: fakeMapsLoader(fake.library) });
+  const poses = [];
+  viewer.onPose((pose) => poses.push(pose));
+  await viewer.mount(fakeHost());
+  await viewer.open('old-id');
+  assert.equal(poses.at(-1).imageId, 'pano-a');
+});
+
+test('a panorama that never shows fails after the timeout and leaves no listener', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const { OPEN_TIMEOUT_MS, NO_ANSWER_MESSAGE } = await import('./policy.js');
+  const { fake, loader, viewer, host } = setup();
+  await viewer.mount(host);
+  const [panorama] = fake.built;
+  const before = panorama.listenerCount();
+  panorama.setPano = (id) => {
+    panorama.pano = id; // Google never answers
+  };
+  const opening = viewer.open('pano-a');
+  await Promise.resolve();
+  await Promise.resolve();
+  t.mock.timers.tick(OPEN_TIMEOUT_MS);
+  await assert.rejects(opening, { message: NO_ANSWER_MESSAGE });
+  assert.equal(panorama.listenerCount(), before);
+  assert.equal(loader.listenerCount(), 0);
+});
+
+test('failed details lookups cool down through repeated drags and retry after the pause', async (t) => {
+  let now = 1_000;
+  t.mock.method(Date, 'now', () => now);
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  const getPanorama = fake.library.StreetViewService.prototype.getPanorama;
+  let failures = 2;
+  let calls = 0;
+  fake.library.StreetViewService.prototype.getPanorama = function (request) {
+    calls++;
+    if (failures-- > 0) return Promise.reject(new Error('offline'));
+    return getPanorama.call(this, request);
+  };
+  await viewer.open('pano-a');
+  assert.equal(poses.at(-1).capturedAt, null, 'undated while it failed');
+  assert.equal(calls, 1);
+  for (let attempt = 0; attempt < 2; attempt++) {
+    for (let heading = 0; heading < 20; heading++) {
+      fake.built[0].setPov({ heading, pitch: 0 });
+      await settle();
+    }
+    assert.equal(calls, attempt + 1, 'drags do not retry during the pause');
+    assert.equal(poses.at(-1).bearing, 19, 'pose updates still follow drags');
+    now += DETAILS_RETRY_COOLDOWN_MS - 1;
+    fake.built[0].setPov({ heading: 20, pitch: 0 });
+    await settle();
+    assert.equal(calls, attempt + 1, 'still paused just before the deadline');
+    now++;
+    fake.built[0].setPov({ heading: 21, pitch: 0 });
+    await settle();
+    assert.equal(calls, attempt + 2, 'one retry at the deadline');
+  }
+  assert.equal(poses.at(-1).capturedAt, Date.UTC(2024, 4, 1));
+  now += DETAILS_RETRY_COOLDOWN_MS;
+  fake.built[0].setPov({ heading: 10, pitch: 0 });
+  await settle();
+  assert.equal(calls, 3, 'successful details stay cached');
+});
+
+test('a failed panorama does not delay details for another panorama', async (t) => {
+  t.mock.method(Date, 'now', () => 1_000);
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  const getPanorama = fake.library.StreetViewService.prototype.getPanorama;
+  const requests = [];
+  fake.library.StreetViewService.prototype.getPanorama = function (request) {
+    requests.push(request.pano);
+    if (request.pano === 'pano-a') return Promise.reject(new Error('offline'));
+    return getPanorama.call(this, request);
+  };
+  await viewer.open('pano-a');
+  fake.built[0].setPano('pano-b');
+  await settle();
+  assert.deepEqual(requests, ['pano-a', 'pano-b']);
+  assert.equal(poses.at(-1).creator, 'Ada');
+  fake.built[0].setPano('pano-a');
+  await settle();
+  assert.deepEqual(
+    requests,
+    ['pano-a', 'pano-b'],
+    'returning respects the pause',
+  );
+});
+
+test('a retry after a failed open is not failed by the old panorama\u2019s status', async () => {
+  const { viewer, poses, host } = setup();
+  await viewer.mount(host);
+  await assert.rejects(viewer.open('gone'), /no imagery/);
+  // The new panorama moves first; its OK status follows.
+  await viewer.open('pano-a');
+  assert.equal(poses.at(-1).imageId, 'pano-a');
+});
+
+test('a details lookup that never answers times out, cools down and retries', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout', 'Date'], now: 1_000 });
+  const flush = async () => {
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+  };
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  const getPanorama = fake.library.StreetViewService.prototype.getPanorama;
+  const requests = [];
+  let hang = true;
+  fake.library.StreetViewService.prototype.getPanorama = function (request) {
+    requests.push(request.pano);
+    return hang ? new Promise(() => {}) : getPanorama.call(this, request);
+  };
+  const opening = viewer.open('pano-a');
+  await flush();
+  await opening;
+  assert.deepEqual(requests, ['pano-a']);
+  fake.built[0].setPov({ heading: 5, pitch: 0 });
+  await flush();
+  assert.deepEqual(requests, ['pano-a'], 'one lookup in flight at a time');
+  t.mock.timers.tick(DETAILS_TIMEOUT_MS);
+  await flush();
+  hang = false;
+  fake.built[0].setPov({ heading: 6, pitch: 0 });
+  await flush();
+  assert.deepEqual(requests, ['pano-a'], 'the cooldown follows a timeout');
+  t.mock.timers.tick(DETAILS_RETRY_COOLDOWN_MS);
+  fake.built[0].setPov({ heading: 7, pitch: 0 });
+  await flush();
+  assert.deepEqual(requests, ['pano-a', 'pano-a']);
+  assert.equal(poses.at(-1).capturedAt, Date.UTC(2024, 4, 1));
+  assert.equal(poses.at(-1).bearing, 7);
+});
+
+test('a remount looks up again a panorama whose lookup hung', async () => {
+  const { fake, viewer, poses, host } = setup();
+  await viewer.mount(host);
+  const getPanorama = fake.library.StreetViewService.prototype.getPanorama;
+  const requests = [];
+  let answerHung;
+  fake.library.StreetViewService.prototype.getPanorama = function (request) {
+    requests.push(request.pano);
+    if (requests.length === 1)
+      return new Promise((resolve) => {
+        answerHung = () => resolve(getPanorama.call(this, request));
+      });
+    return getPanorama.call(this, request);
+  };
+  await viewer.open('pano-b');
+  viewer.unmount();
+  await viewer.mount(host);
+  await viewer.open('pano-b');
+  await settle();
+  assert.deepEqual(requests, ['pano-b', 'pano-b']);
+  assert.equal(poses.at(-1).creator, 'Ada');
+  // The hung answer arriving now is for a viewer that is gone: dropped.
+  const count = poses.length;
+  answerHung();
+  await settle();
+  assert.equal(poses.length, count);
+});

src/layers/streetLevel/providers/kartaview/decode.js

@@ -0,0 +1,176 @@
+import { MASK_KEEP_SHARE, MASK_SAMPLE_PX } from './policy.js';
+
+/** More than any real tile holds (a dense z13 tile has ~4,700 segments). */
+export const MAX_TILE_SEGMENTS = 20_000;
+/** A chained line stops growing here and the next one starts. */
+export const MAX_LINE_POINTS = 5_000;
+
+/**
+ * The way segments of a KartaView coverage tile
+ * (`{lines: [{track: [{lat, lng}]}]}`), as [lon, lat] point lists. Lines
+ * carry no sequence, date or projection: a filter thins them through a mask
+ * (see `maskedSegments`).
+ * @param {object} payload
+ * @returns {Array<Array<[number, number]>>}
+ */
+export function tileSegments(payload) {
+  // Not cached as empty: an unreadable tile is asked for again.
+  if (!Array.isArray(payload?.lines))
+    throw new Error('KartaView sent an unreadable coverage tile');
+  const segments = [];
+  for (const line of payload.lines) {
+    if (segments.length >= MAX_TILE_SEGMENTS) break;
+    const points = [];
+    for (const point of Array.isArray(line?.track) ? line.track : []) {
+      const lon = Number(point?.lng);
+      const lat = Number(point?.lat);
+      if (!Number.isFinite(lon) || !Number.isFinite(lat)) continue;
+      const last = points[points.length - 1];
+      if (last && last[0] === lon && last[1] === lat) continue;
+      points.push([lon, lat]);
+    }
+    if (points.length >= 2) segments.push(points);
+  }
+  return segments;
+}
+
+/**
+ * Segments chained into line records for the shared coverage: segments
+ * that meet end to start are joined, which cuts the line count about
+ * fourfold.
+ * @param {Array<Array<[number, number]>>} segments
+ * @param {{x: number, y: number, z: number}} address
+ * @returns {{sequences: Array<{id: string, parts: Array<Array<[number, number]>>, capturedAt: number, isPano: boolean}>, overview: Array<never>}}
+ */
+export function chainSegments(segments, { x, y, z }) {
+  const key = ([lon, lat]) => `${lon},${lat}`;
+  const startingAt = new Map();
+  segments.forEach((segment, index) => {
+    const at = key(segment[0]);
+    const list = startingAt.get(at);
+    if (list) list.push(index);
+    else startingAt.set(at, [index]);
+  });
+  const used = new Uint8Array(segments.length);
+  // Per start point, how far its list has been used: each segment is looked
+  // at once, so a tile of segments sharing one point stays linear.
+  const cursor = new Map();
+  const nextFrom = (point) => {
+    const at = key(point);
+    const list = startingAt.get(at);
+    if (!list) return undefined;
+    let i = cursor.get(at) ?? 0;
+    while (i < list.length && used[list[i]]) i++;
+    cursor.set(at, i);
+    return list[i];
+  };
+  const sequences = [];
+  segments.forEach((segment, index) => {
+    if (used[index]) return;
+    used[index] = 1;
+    const chain = [...segment];
+    for (;;) {
+      const next = nextFrom(chain[chain.length - 1]);
+      if (next === undefined) break;
+      // Full: the segment starts the next line instead.
+      if (chain.length + segments[next].length - 1 > MAX_LINE_POINTS) break;
+      used[next] = 1;
+      chain.push(...segments[next].slice(1));
+    }
+    sequences.push({
+      id: `${z}/${x}/${y}/${sequences.length}`,
+      parts: [chain],
+      capturedAt: 0,
+      isPano: false,
+    });
+  });
+  return { sequences, overview: [] };
+}
+
+/** Decode a KartaView coverage tile into the shared coverage's line records. */
+export function decodeCoverageTile(payload, address) {
+  return chainSegments(tileSegments(payload), address);
+}
+
+/**
+ * The segments a filtered PNG tile of the same address draws over. The PNG
+ * draws the same ways a few pixels wide (on a transparent ground): a
+ * segment is kept when at least half the points sampled along it have a
+ * drawn pixel within one pixel. Segments either lie on it or miss it
+ * almost entirely (Jakarta, 360° only: 332 of 1,041 kept, 676 missed, 33
+ * between). A segment with no point on the tile is not this tile's to keep.
+ * @param {Array<Array<[number, number]>>} segments
+ * @param {{width: number, height: number, alpha: ArrayLike<number>}} mask  one alpha byte per pixel
+ * @param {{x: number, y: number, z: number}} address
+ */
+export function maskedSegments(segments, mask, { x, y, z }) {
+  const { width, height, alpha } = mask;
+  const n = 2 ** z;
+  const toPixel = ([lon, lat]) => {
+    const sin = Math.sin((lat * Math.PI) / 180);
+    const my = 0.5 - Math.log((1 + sin) / (1 - sin)) / (4 * Math.PI);
+    return [(((lon + 180) / 360) * n - x) * width, (my * n - y) * height];
+  };
+  const drawnNear = (px, py) => {
+    const cx = Math.floor(px);
+    const cy = Math.floor(py);
+    for (let dy = -1; dy <= 1; dy++)
+      for (let dx = -1; dx <= 1; dx++) {
+        const X = cx + dx;
+        const Y = cy + dy;
+        if (X < 0 || Y < 0 || X >= width || Y >= height) continue;
+        if (alpha[Y * width + X] > 0) return true;
+      }
+    return false;
+  };
+  return segments.filter((segment) => {
+    let on = 0;
+    let tested = 0;
+    let [ax, ay] = toPixel(segment[0]);
+    for (let i = 1; i < segment.length; i++) {
+      const [bx, by] = toPixel(segment[i]);
+      const steps = Math.max(
+        1,
+        Math.ceil(Math.hypot(bx - ax, by - ay) / MASK_SAMPLE_PX),
+      );
+      // Each point once: a segment's next stretch starts where this one ends.
+      for (let j = i === 1 ? 0 : 1; j <= steps; j++) {
+        const px = ax + ((bx - ax) * j) / steps;
+        const py = ay + ((by - ay) * j) / steps;
+        if (px < 0 || py < 0 || px >= width || py >= height) continue;
+        tested++;
+        if (drawnNear(px, py)) on++;
+      }
+      ax = bx;
+      ay = by;
+    }
+    return tested > 0 && on / tested >= MASK_KEEP_SHARE;
+  });
+}
+
+/**
+ * A PNG mask's alpha, one byte per pixel, decoded off the main thread
+ * where the browser can.
+ * @param {Uint8Array} bytes  the PNG
+ * @returns {Promise<{width: number, height: number, alpha: Uint8Array}>}
+ */
+export async function readMaskImage(bytes) {
+  const bitmap = await createImageBitmap(
+    new Blob([bytes], { type: 'image/png' }),
+  );
+  try {
+    const { width, height } = bitmap;
+    const canvas =
+      typeof OffscreenCanvas === 'function'
+        ? new OffscreenCanvas(width, height)
+        : Object.assign(document.createElement('canvas'), { width, height });
+    const context = canvas.getContext('2d', { willReadFrequently: true });
+    context.drawImage(bitmap, 0, 0);
+    const rgba = context.getImageData(0, 0, width, height).data;
+    const alpha = new Uint8Array(width * height);
+    for (let i = 0; i < alpha.length; i++) alpha[i] = rgba[i * 4 + 3];
+    return { width, height, alpha };
+  } finally {
+    bitmap.close?.();
+  }
+}

src/layers/streetLevel/providers/kartaview/decode.test.mjs

@@ -0,0 +1,187 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  MAX_LINE_POINTS,
+  MAX_TILE_SEGMENTS,
+  chainSegments,
+  decodeCoverageTile,
+  maskedSegments,
+  tileSegments,
+} from './decode.js';
+
+const at = (lng, lat) => ({ lat: String(lat), lng: String(lng) });
+const TILE = { x: 4412, y: 6061, z: 14 };
+
+test('segments that meet end to start chain into one line', () => {
+  const { sequences, overview } = decodeCoverageTile(
+    {
+      lines: [
+        { track: [at(1, 1), at(2, 1)], matched: '1' },
+        { track: [at(5, 5), at(6, 6)], matched: '1' },
+        { track: [at(2, 1), at(3, 1), at(4, 2)], matched: '1' },
+      ],
+    },
+    TILE,
+  );
+  assert.deepEqual(overview, []);
+  assert.equal(sequences.length, 2);
+  assert.deepEqual(sequences[0].parts, [
+    [
+      [1, 1],
+      [2, 1],
+      [3, 1],
+      [4, 2],
+    ],
+  ]);
+  assert.equal(sequences[0].id, '14/4412/6061/0');
+  assert.equal(sequences[1].id, '14/4412/6061/1');
+  // Nothing to date or project: every line passes as flat and undated.
+  assert.equal(sequences[0].capturedAt, 0);
+  assert.equal(sequences[0].isPano, false);
+});
+
+test('a junction continues one way only, and every segment is drawn exactly once', () => {
+  const { sequences } = decodeCoverageTile(
+    {
+      lines: [
+        { track: [at(0, 0), at(1, 0)] },
+        { track: [at(1, 0), at(2, 0)] },
+        { track: [at(1, 0), at(1, 1)] },
+        // A loop back to its own start must end, not spin.
+        { track: [at(9, 9), at(9, 8)] },
+        { track: [at(9, 8), at(9, 9)] },
+      ],
+    },
+    TILE,
+  );
+  const points = sequences.reduce((sum, s) => sum + s.parts[0].length, 0);
+  assert.equal(sequences.length, 3);
+  // 5 segments of 2 points, 2 joins in chains: 10 - 2 = 8 points.
+  assert.equal(points, 8);
+});
+
+test('bad points, repeats and one-point tracks are skipped; an empty tile has no lines', () => {
+  const { sequences } = decodeCoverageTile(
+    {
+      lines: [
+        { track: [at(1, 1), at(1, 1), { lat: 'x', lng: '2' }, at(2, 2)] },
+        { track: [at(3, 3)] },
+        { track: null },
+        null,
+      ],
+    },
+    TILE,
+  );
+  assert.equal(sequences.length, 1);
+  assert.deepEqual(sequences[0].parts[0], [
+    [1, 1],
+    [2, 2],
+  ]);
+  assert.deepEqual(decodeCoverageTile({ lines: [] }, TILE).sequences, []);
+});
+
+test('a tile that is not a line list fails, so it is asked for again rather than kept empty', () => {
+  for (const payload of [
+    null,
+    {},
+    { lines: 'nope' },
+    { status: { apiCode: 690 } },
+  ])
+    assert.throws(
+      () => decodeCoverageTile(payload, TILE),
+      /unreadable coverage tile/,
+    );
+});
+
+test('a tile whose segments all share one point decodes in linear time', () => {
+  // [P, Q_i, P]: every chain step looks at the same start point's list.
+  // 60k: the old quadratic chaining took over a second; capped and linear
+  // decoding takes tens of milliseconds.
+  const lines = Array.from({ length: 60_000 }, (_, i) => ({
+    track: [at(0, 0), at(1 + i * 1e-6, 1), at(0, 0)],
+  }));
+  const started = performance.now();
+  const { sequences } = decodeCoverageTile({ lines }, TILE);
+  const ms = performance.now() - started;
+  assert.ok(
+    ms < 1_000,
+    `${Math.round(ms)} ms (quadratic chaining took ~200 ms per 20k and grows fourfold per doubling)`,
+  );
+  const points = sequences.reduce((sum, s) => sum + s.parts[0].length, 0);
+  assert.ok(sequences.every((s) => s.parts[0].length <= MAX_LINE_POINTS));
+  assert.equal(
+    points,
+    MAX_TILE_SEGMENTS * 2 + sequences.length,
+    'every segment drawn once',
+  );
+});
+
+test('a tile is capped in segments and in points per line', () => {
+  const lines = Array.from({ length: MAX_TILE_SEGMENTS + 500 }, (_, i) => ({
+    track: [at(i, 0), at(i + 1, 0)],
+  }));
+  const { sequences } = decodeCoverageTile({ lines }, TILE);
+  const points = sequences.reduce((sum, s) => sum + s.parts[0].length, 0);
+  // One long chain, cut into lines of at most MAX_LINE_POINTS.
+  assert.ok(sequences.every((s) => s.parts[0].length <= MAX_LINE_POINTS));
+  assert.ok(points <= MAX_TILE_SEGMENTS + sequences.length);
+  assert.ok(
+    sequences.length >= Math.floor(MAX_TILE_SEGMENTS / MAX_LINE_POINTS),
+  );
+});
+
+/** [lon, lat] at pixel (px, py) of a 512 px mask of `tile` (Web Mercator). */
+function lonLatAt(px, py, { x, y, z } = TILE, size = 512) {
+  const n = 2 ** z;
+  const lon = ((x + px / size) / n) * 360 - 180;
+  const my = Math.PI * (1 - (2 * (y + py / size)) / n);
+  const lat = (Math.atan(Math.sinh(my)) * 180) / Math.PI;
+  return [lon, lat];
+}
+
+/** A 512 px mask drawn on the given rows. */
+function rowsMask(rows) {
+  const alpha = new Uint8Array(512 * 512);
+  for (const [from, to] of rows) alpha.fill(255, from * 512, (to + 1) * 512);
+  return { width: 512, height: 512, alpha };
+}
+
+test('a mask keeps the segments it draws over, chained as before', () => {
+  const along = (row, from = 40, to = 470) => [
+    lonLatAt(from, row),
+    lonLatAt(to, row),
+  ];
+  const segments = [
+    along(100), // drawn at row 100
+    along(101.6), // a pixel off: still drawn within one pixel
+    along(300), // not drawn
+    // Two thirds along the drawn row, then off it: kept (at least half).
+    [lonLatAt(40, 100), lonLatAt(400, 100), lonLatAt(400, 280)],
+    // A third along it, then off: dropped.
+    [lonLatAt(300, 100), lonLatAt(400, 100), lonLatAt(400, 300)],
+    // Off the tile entirely: not this tile's to keep.
+    [lonLatAt(-200, 100), lonLatAt(-20, 100)],
+  ];
+  const kept = maskedSegments(segments, rowsMask([[99, 100]]), TILE);
+  assert.deepEqual(kept, [segments[0], segments[1], segments[3]]);
+  assert.deepEqual(maskedSegments(segments, rowsMask([]), TILE), []);
+  // A full mask keeps every segment that is on the tile.
+  assert.equal(maskedSegments(segments, rowsMask([[0, 511]]), TILE).length, 5);
+});
+
+test('decoding is segments then chaining: the same lines either way', () => {
+  const payload = {
+    lines: [
+      { track: [at(1, 1), at(2, 1)] },
+      { track: [at(2, 1), at(3, 1)] },
+      { track: [at(5, 5), at(6, 6)] },
+    ],
+  };
+  const segments = tileSegments(payload);
+  assert.equal(segments.length, 3);
+  assert.deepEqual(
+    chainSegments(segments, TILE),
+    decodeCoverageTile(payload, TILE),
+  );
+  assert.throws(() => tileSegments({}), /unreadable coverage tile/);
+});

src/layers/streetLevel/providers/kartaview/index.js

@@ -0,0 +1,608 @@
+import { createLineCoverage } from '../../lineCoverage.js';
+import { createLru, createTileCache } from '../../tileCache.js';
+
+export { createTileCache } from '../../tileCache.js';
+import { createSequenceCones, thinImages } from '../../sequenceCones.js';
+import { metresBetween } from '../../view.js';
+import {
+  chainSegments,
+  maskedSegments,
+  readMaskImage,
+  tileSegments,
+} from './decode.js';
+import { createKartaViewSource } from './source.js';
+import { createKartaViewViewer } from './viewer.js';
+import {
+  ARCHIVED_MESSAGE,
+  COLORS,
+  COVERAGE_MAX_HEIGHT_M,
+  COVERAGE_NOUN,
+  COVERAGE_STREET_ZOOM_BELOW_M,
+  COVERAGE_TUNING,
+  FILTERED_OUT_MESSAGE,
+  KARTAVIEW_CREDIT_HTML,
+  KARTAVIEW_LABEL,
+  KARTAVIEW_NAME,
+  KARTAVIEW_PROVIDER_ID,
+  LINE_CLICK_HINT,
+  NEAREST_PROBES,
+  NEAREST_RADIUS_M,
+  NO_COVERAGE_HINT,
+  PICK_PREFIX,
+  RATE_LIMITED_MESSAGE,
+  SEQUENCE_PAGE_EDGE,
+  SEQUENCE_PAGE_SIZE,
+  TOO_HIGH_HINT,
+  assignCourses,
+  cameraBearing,
+  normalizePhoto,
+  passesKartaViewFilter,
+  tileFilterQuery,
+} from './policy.js';
+
+/** Photos kept in memory by id (sequence pages fill it). */
+const PHOTO_CACHE_SIZE = 4000;
+/** Sequence pages kept in memory. */
+const PAGE_CACHE_SIZE = 12;
+
+/** z14 near the street, z13 a little higher, nothing above. */
+export function kartaViewZoomFor(heightM) {
+  if (!Number.isFinite(heightM) || heightM > COVERAGE_MAX_HEIGHT_M) return null;
+  return {
+    zoom: heightM > COVERAGE_STREET_ZOOM_BELOW_M ? 13 : 14,
+    kind: 'sequence',
+  };
+}
+
+/** The 1-based page of a sequence that holds `index`, if no photo is missing. */
+function pageOf(index) {
+  return Math.floor(Math.max(0, index) / SEQUENCE_PAGE_SIZE) + 1;
+}
+
+/**
+ * KartaView Street Level provider: keyless coverage lines from KartaView's
+ * tile API, the photos nearest a clicked line, cones along the photo's
+ * sequence, and a flat or 360° viewer with ‹ › along the sequence.
+ * @param {{source?: ReturnType<typeof createKartaViewSource>, viewerOptions?: object, readMask?: typeof readMaskImage}} [options]
+ * @returns {import('../../registry.js').StreetLevelProvider}
+ */
+export function createKartaViewProvider({
+  source = createKartaViewSource(),
+  viewerOptions = {},
+  readMask = readMaskImage,
+} = {}) {
+  return Object.freeze({
+    id: KARTAVIEW_PROVIDER_ID,
+    name: KARTAVIEW_NAME,
+    label: KARTAVIEW_LABEL,
+    requiresKeyId: null,
+    pickPrefix: PICK_PREFIX.root,
+    colors: COLORS,
+    // Its own marker, as Street View has: a purple cone that turns with the view.
+    marker: Object.freeze({ kind: 'view-cone', color: COLORS.coverage }),
+    credit: Object.freeze({ html: KARTAVIEW_CREDIT_HTML }),
+    defaultOn: false,
+    // 360° / flat and SINCE, as Mapillary: KartaView filters the lines on
+    // its server (see tileFilterQuery), the photos by their own record.
+    filters: Object.freeze(['pano', 'since']),
+    // SINCE is the upload date for KartaView: the panel notes it.
+    sinceBasis: 'upload',
+    // Its lines are streets, not sequences: a selected drive shows as cones.
+    highlightsSequence: false,
+    coverageLabel: Object.freeze({
+      noun: COVERAGE_NOUN,
+      action: LINE_CLICK_HINT,
+    }),
+
+    create(context) {
+      const state = {
+        context,
+        services: context.services,
+        viewer: null,
+        keyRequired: false,
+        keyRejected: false,
+        statusKnown: true,
+        coverage: {
+          zoom: null,
+          tiles: new Map(),
+          stale: new Map(),
+          staleTimer: null,
+          pending: new Map(),
+          lastError: null,
+          holdUntil: 0,
+          holdTimer: null,
+          debounceTimer: null,
+          removeCameraListener: null,
+          terrainReady: null,
+          hint: '',
+          kind: null,
+        },
+        sequence: {
+          selectedId: null,
+          images: [],
+          cache: new Map(),
+          collection: null,
+          loading: false,
+          abort: null,
+        },
+      };
+      const photos = createLru(PHOTO_CACHE_SIZE);
+      const pages = createLru(PAGE_CACHE_SIZE);
+      /** The photo last opened in each sequence: its cones centre on it. */
+      const anchors = new Map();
+      /** The sequence page the cones were drawn from. */
+      let drawnPage = null;
+
+      /** A record as a photo; the one already known keeps its identity (and course). */
+      function remember(record) {
+        const fresh = normalizePhoto(record);
+        if (!fresh) return null;
+        const known = photos.get(fresh.id);
+        const photo = known ? Object.assign(known, fresh) : fresh;
+        photos.set(photo.id, photo);
+        return photo;
+      }
+
+      async function getPhoto(photoId, { signal } = {}) {
+        const cached = photos.get(photoId);
+        if (cached) return cached;
+        const photo = remember(await source.getPhoto(photoId, { signal }));
+        if (!photo) throw new Error('KartaView has no position for this photo');
+        return photo;
+      }
+
+      /** A page of a sequence's photos, in index order (shared while in flight). */
+      function loadPage(sequenceId, page) {
+        const key = `${sequenceId}:${page}`;
+        let entry = pages.get(key);
+        if (!entry) {
+          entry = source
+            .getSequencePhotos(sequenceId, {
+              page,
+              itemsPerPage: SEQUENCE_PAGE_SIZE,
+            })
+            .then(({ photos: records, hasMore }) => {
+              const list = assignCourses(
+                records
+                  .map(remember)
+                  .filter(Boolean)
+                  .sort(
+                    (a, b) => (a.sequenceIndex ?? 0) - (b.sequenceIndex ?? 0),
+                  ),
+                metresBetween,
+              );
+              // The open photo may have just learnt which way it looked. The
+              // page is good whatever the viewer is doing.
+              try {
+                viewer.refreshPose?.();
+              } catch {
+                /* the next pose carries the direction */
+              }
+              return { page, hasMore, photos: list };
+            });
+          pages.set(key, entry);
+          entry.catch(() => pages.delete(key));
+        }
+        return entry;
+      }
+
+      /**
+       * The page holding `photo`. Pages follow photo ids, which only roughly
+       * follow the index, and photos go missing, so the page the index
+       * suggests is a first guess: step towards the photo until a page holds
+       * it, or the pages straddle where it would be.
+       */
+      async function homePage(photo) {
+        let number = pageOf(photo.sequenceIndex ?? 0);
+        const index = photo.sequenceIndex ?? 0;
+        let page = await loadPage(photo.sequenceId, number);
+        if (!page.photos.length && number > 1) {
+          // Past the end (many photos deleted): find the last page by halving.
+          let low = 1;
+          let high = number - 1;
+          while (low < high) {
+            const middle = Math.ceil((low + high) / 2);
+            if ((await loadPage(photo.sequenceId, middle)).photos.length)
+              low = middle;
+            else high = middle - 1;
+          }
+          number = low;
+        }
+        const seen = new Set();
+        while (!seen.has(number) && seen.size < 8) {
+          seen.add(number);
+          page = await loadPage(photo.sequenceId, number);
+          if (page.photos.some((p) => p.id === photo.id)) return page;
+          const first = page.photos[0]?.sequenceIndex;
+          const last = page.photos.at(-1)?.sequenceIndex;
+          // Past the last page, or before this page's photos: go back.
+          if ((first === undefined || index < first) && number > 1) number--;
+          else if (last !== undefined && index > last && page.hasMore) number++;
+          else break;
+        }
+        return page;
+      }
+
+      /**
+       * The photos around `photo` in index order: its page, plus a
+       * neighbour page when it sits near an edge (pages overlap in index).
+       * @returns {Promise<{home: number, photos: Array<object>}>}
+       */
+      async function windowOf(photo) {
+        const home = await homePage(photo);
+        const list = home.photos;
+        const found = list.findIndex((p) => p.id === photo.id);
+        // A photo no page lists sits where its index would.
+        const at =
+          found !== -1
+            ? found
+            : list.filter(
+                (p) => (p.sequenceIndex ?? 0) < (photo.sequenceIndex ?? 0),
+              ).length;
+        const parts = [list];
+        if (at < SEQUENCE_PAGE_EDGE && home.page > 1)
+          parts.push((await loadPage(photo.sequenceId, home.page - 1)).photos);
+        if (at >= list.length - SEQUENCE_PAGE_EDGE && home.hasMore)
+          parts.push((await loadPage(photo.sequenceId, home.page + 1)).photos);
+        if (parts.length === 1) return { home: home.page, photos: list };
+        const byId = new Map(parts.flat().map((p) => [p.id, p]));
+        return {
+          home: home.page,
+          photos: [...byId.values()].sort(
+            (a, b) => (a.sequenceIndex ?? 0) - (b.sequenceIndex ?? 0),
+          ),
+        };
+      }
+
+      /**
+       * Photo id → whether its file is there (archived ones are not). Only
+       * a definite answer is kept: a storage hiccup is asked again next
+       * time, and meanwhile the photo is tried. A probe is shared, so it
+       * runs to its own timeout rather than any one caller's abort.
+       */
+      const probes = createLru(PHOTO_CACHE_SIZE);
+      function showable(photo) {
+        if (!photo?.urls?.view) return Promise.resolve(false);
+        let probe = probes.get(photo.id);
+        if (!probe) {
+          probe = source.probeImage(photo.urls.view).then(
+            (answer) => {
+              if (answer === null) probes.delete(photo.id);
+              return answer !== false;
+            },
+            () => {
+              probes.delete(photo.id);
+              return true;
+            },
+          );
+          probes.set(photo.id, probe);
+        }
+        return probe;
+      }
+
+      // A tile's way segments, kept a while: panning back, or a filter
+      // change, asks KartaView nothing more for them.
+      const tiles = createTileCache({
+        load: async (tile, { signal }) =>
+          tileSegments(await source.getTile(tile, { signal })),
+      });
+      // A filtered tile's mask, by filter and tile.
+      const masks = createTileCache({
+        load: async ({ query, ...tile }, { signal }) =>
+          readMask(await source.getTileMask(tile, query, { signal })),
+        keyOf: ({ query, z, x, y }) => `${query}|${z}/${x}/${y}`,
+      });
+      /** The tile's lines under the filter now: all, or the masked ones. */
+      async function fetchTile(tile, options) {
+        const query = tileFilterQuery(context.getFilter());
+        if (!query) return chainSegments(await tiles.get(tile, options), tile);
+        const [segments, mask] = await Promise.all([
+          tiles.get(tile, options),
+          masks.get({ ...tile, query }, options),
+        ]);
+        return chainSegments(maskedSegments(segments, mask, tile), tile);
+      }
+      /** The query the drawn lines were loaded under. */
+      let drawnQuery = tileFilterQuery(context.getFilter());
+
+      /**
+       * The next showable photo `delta` along the sequence, or null at its
+       * end. Archived photos are skipped, a few at most.
+       */
+      async function step(photo, delta) {
+        if (!photo?.sequenceId) return null;
+        let from = photo;
+        for (let skipped = 0; skipped <= NEAREST_PROBES; skipped++) {
+          const { photos: list } = await windowOf(from);
+          let at = list.findIndex((p) => p.id === from.id);
+          if (at === -1) {
+            // Not found anywhere: the nearest index on the right side.
+            const index = from.sequenceIndex ?? 0;
+            const later = list.findIndex((p) => (p.sequenceIndex ?? 0) > index);
+            if (delta > 0 && later === -1) return null;
+            at =
+              delta > 0
+                ? later - 1
+                : later === -1
+                  ? list.length
+                  : list.findIndex((p) => (p.sequenceIndex ?? 0) >= index);
+          }
+          const next = list[at + delta];
+          if (!next) return null;
+          if (await showable(next)) return next.id;
+          from = next;
+        }
+        return null;
+      }
+
+      const coverage = createLineCoverage({
+        state,
+        fetchTile,
+        zoomFor: kartaViewZoomFor,
+        colors: COLORS,
+        pickPrefix: PICK_PREFIX.line,
+        renderKey: 'kartaview-coverage',
+        tuning: COVERAGE_TUNING,
+        messages: { rateLimited: RATE_LIMITED_MESSAGE, tooHigh: TOO_HIGH_HINT },
+        // Filtered on the way in (fetchTile): a line has no date to test.
+        passes: () => true,
+      });
+
+      const cones = createSequenceCones({
+        state,
+        async loadImages(sequenceId, { signal }) {
+          let anchor = anchors.get(sequenceId);
+          if (!anchor) return [];
+          let window = await windowOf(anchor);
+          signal?.throwIfAborted();
+          // Another photo of the drive opened while that page loaded (its
+          // re-centre found nothing drawn yet): centre on the newest one.
+          while (anchors.get(sequenceId) !== anchor) {
+            anchor = anchors.get(sequenceId);
+            window = await windowOf(anchor);
+            signal?.throwIfAborted();
+          }
+          drawnPage = { sequenceId, page: window.home };
+          countPhotos(sequenceId);
+          return thinImages(
+            window.photos.map((photo) => ({
+              id: photo.id,
+              lon: photo.lon,
+              lat: photo.lat,
+              compassAngle: cameraBearing(photo) ?? 0,
+              capturedAt: photo.capturedAt ?? 0,
+              uploadedAt: photo.uploadedAt,
+              isPano: photo.isPano,
+            })),
+          );
+        },
+        colors: COLORS,
+        pickPrefix: PICK_PREFIX.image,
+        spriteId: 'street-level:kartaview-cones',
+        renderKey: 'kartaview-sequence',
+        // By projection and upload date, as the lines.
+        passes: passesKartaViewFilter,
+      });
+
+      /** Sequence id → its photo count from KartaView (asked once). */
+      const counts = new Map();
+      function countPhotos(sequenceId) {
+        if (counts.has(sequenceId) || !source.getSequenceCount) return;
+        counts.set(sequenceId, undefined);
+        source.getSequenceCount(sequenceId).then(
+          (count) => {
+            if (count === null) counts.delete(sequenceId);
+            else {
+              counts.set(sequenceId, count);
+              context.notify();
+            }
+          },
+          () => counts.delete(sequenceId),
+        );
+      }
+
+      /** ‹ › open through the core (loading, errors, cones), camera still. */
+      function openStepped(photoId) {
+        context.actions.openImage(photoId, { frame: false });
+      }
+
+      /**
+       * The cones show one page of a sequence: once a photo of the selected
+       * sequence opens on another page (‹ ›, a cone, a line), re-centre them.
+       */
+      async function recentreCones(photo) {
+        if (!photo?.sequenceId) return;
+        if (state.sequence.selectedId !== photo.sequenceId) return;
+        const drawn = drawnPage;
+        if (drawn?.sequenceId !== photo.sequenceId) return;
+        const window = await windowOf(photo).catch(() => null);
+        // Still the drawn page and the latest photo once the page is in.
+        if (
+          window &&
+          drawnPage === drawn &&
+          window.home !== drawn.page &&
+          anchors.get(photo.sequenceId) === photo
+        )
+          cones.select(photo.sequenceId, { force: true });
+      }
+
+      const viewer = createKartaViewViewer({
+        getPhoto: async (photoId) => {
+          const photo = await getPhoto(photoId);
+          if (photo.sequenceId) anchors.set(photo.sequenceId, photo);
+          return photo;
+        },
+        step,
+        onStep: openStepped,
+        onShown: recentreCones,
+        // After a GPU reset the same photo is drawn again by the viewer
+        // itself: going through the core would cancel a lookup the user
+        // started. A failure still shows.
+        onReopen: (photoId) =>
+          viewer
+            .open(photoId)
+            .catch((error) =>
+              context.actions.reportError(
+                error?.message || 'The KartaView photo could not be loaded',
+              ),
+            ),
+        // Esc in the viewer clears the selected drive, as the panel says.
+        onEscape: () => {
+          if (!state.sequence.selectedId) return false;
+          cones.clearSelection();
+          drawnPage = null;
+          return true;
+        },
+        render: context.services?.render,
+        ...viewerOptions,
+      });
+
+      return {
+        async status() {
+          return { configured: true };
+        },
+
+        init(cesiumViewer) {
+          state.viewer = cesiumViewer;
+          cones.ensureCollections(cesiumViewer);
+          cones.setVisible(false);
+        },
+
+        activate(cesiumViewer) {
+          state.viewer = cesiumViewer;
+          cones.setVisible(true);
+          coverage.attach(cesiumViewer);
+        },
+
+        deactivate() {
+          coverage.detach();
+          coverage.clear();
+          coverage.resetErrors();
+          cones.clearSelection();
+          cones.setVisible(false);
+          drawnPage = null;
+          // Tens of MB of decoded lines are not kept for a source left off.
+          tiles.clear();
+          masks.clear();
+        },
+
+        destroy(cesiumViewer) {
+          coverage.detach();
+          coverage.clear();
+          coverage.resetErrors();
+          cones.destroy(cesiumViewer);
+          tiles.clear();
+          masks.clear();
+        },
+
+        refreshCoverage: () => coverage.refresh(),
+
+        /**
+         * The filter changed: the lines come from KartaView again under it
+         * (the old ones show meanwhile), the cones are drawn again.
+         */
+        setFilter() {
+          const query = tileFilterQuery(context.getFilter());
+          if (query !== drawnQuery) {
+            drawnQuery = query;
+            coverage.reload();
+          }
+          cones.rerender();
+        },
+
+        setSurface() {
+          coverage.setSurface();
+          cones.rerender();
+        },
+
+        coverageStats() {
+          const { hint } = state.coverage;
+          const count = coverage.sequenceCount();
+          const loading = state.coverage.pending.size > 0;
+          const empty =
+            state.coverage.zoom !== null &&
+            !loading &&
+            count === 0 &&
+            !state.coverage.lastError;
+          return {
+            count,
+            zoom: state.coverage.zoom,
+            kind: state.coverage.kind,
+            loading,
+            hint: hint || (empty ? NO_COVERAGE_HINT : ''),
+            error: state.coverage.lastError,
+            keyRequired: false,
+            keyRejected: false,
+          };
+        },
+
+        /** A line opens the photo nearest the click; a cone opens its photo. */
+        handlePick(pickId, { groundPoint } = {}) {
+          if (pickId.startsWith(PICK_PREFIX.image)) {
+            context.actions.openImage(pickId.slice(PICK_PREFIX.image.length));
+            return true;
+          }
+          if (pickId.startsWith(PICK_PREFIX.line)) {
+            const point = groundPoint?.();
+            if (point) context.actions.openNearest(point);
+            return true;
+          }
+          return false;
+        },
+
+        // Never from the cache: it is keyed by sequence, the cones by page.
+        selectSequence: (sequenceId) =>
+          cones.select(sequenceId, { force: true }),
+        clearSequence: () => {
+          cones.clearSelection();
+          drawnPage = null;
+        },
+        // The drive's own count, not the thinned page of it the cones show.
+        sequenceStats: () => ({
+          selectedId: state.sequence.selectedId,
+          images:
+            counts.get(state.sequence.selectedId) ??
+            state.sequence.images.length,
+          loading: state.sequence.loading,
+        }),
+
+        /**
+         * The nearest photo within the search radius that can be shown, or
+         * null. Many photos are archived (their files answer 409) or have no
+         * file at all, so the nearest few are tried in turn.
+         */
+        async nearestImage({ lat, lon }, { signal } = {}) {
+          const filter = context.getFilter();
+          const records = await source.nearestPhotos(
+            { lat, lon, filter },
+            { signal },
+          );
+          const near = [];
+          let filteredOut = 0;
+          for (const record of records) {
+            const photo = remember(record);
+            if (!photo?.urls.view) continue;
+            const metres = metresBetween({ lat, lon }, photo);
+            if (metres > NEAREST_RADIUS_M) continue;
+            if (!passesKartaViewFilter(photo, filter)) filteredOut++;
+            else near.push({ photo, metres });
+          }
+          near.sort((a, b) => a.metres - b.metres);
+          // Probed side by side (photo storage is not the API host): the
+          // nearest one that answers wins.
+          const candidates = near.slice(0, NEAREST_PROBES);
+          const answers = await Promise.all(
+            candidates.map(({ photo }) => showable(photo, { signal })),
+          );
+          const hit = candidates.find((_, i) => answers[i]);
+          if (hit) return hit.photo.id;
+          if (near.length) throw new Error(ARCHIVED_MESSAGE);
+          if (filteredOut) throw new Error(FILTERED_OUT_MESSAGE);
+          return null;
+        },
+
+        viewer,
+      };
+    },
+  });
+}

src/layers/streetLevel/providers/kartaview/policy.js

@@ -0,0 +1,394 @@
+import { COLORS as SHARED_COLORS, PROVIDER_COLORS } from '../../policy.js';
+
+export { NEAREST_RADIUS_M } from '../../policy.js';
+
+/** Identity and tuning for the KartaView street-level provider (keyless). */
+export const KARTAVIEW_PROVIDER_ID = 'kartaview';
+export const KARTAVIEW_NAME = 'KartaView';
+export const KARTAVIEW_LABEL = 'KARTAVIEW';
+
+/**
+ * The public API. Its documented twin, api.openstreetcam.org, still answers
+ * but serves empty coverage tiles.
+ */
+export const KARTAVIEW_API_HOST = 'https://api.kartaview.org';
+/** KartaView's image proxy: resizes a photo given its base64url address. */
+export const KARTAVIEW_CDN_HOST = 'https://cdn.kartaview.org';
+
+/** Stable id prefixes for picked primitives; every one starts with `kv:`. */
+export const PICK_PREFIX = Object.freeze({
+  root: 'kv:',
+  line: 'kv:line:',
+  image: 'kv:img:',
+});
+
+export const COLORS = Object.freeze({
+  coverage: PROVIDER_COLORS.kartaview,
+  selected: SHARED_COLORS.selected,
+});
+
+/**
+ * Coverage lines are OSM ways with photos, from z13–14 JSON tiles. Lower
+ * zooms take seconds per tile (z10 does not answer), so higher up the panel
+ * asks the user to zoom in.
+ */
+export const COVERAGE_STREET_ZOOM_BELOW_M = 2_500;
+export const COVERAGE_MAX_HEIGHT_M = 6_000;
+export const COVERAGE_TUNING = Object.freeze({
+  maxTiles: 9,
+  overviewMaxTiles: 0,
+  // Chained ways are short: a dense downtown z13 tile holds ~1,500, so each
+  // tile may draw 1,600 (a frame stays at 16.7 ms with 4,400 drawn).
+  maxSequences: 14_400,
+  lineWidthPx: 2.5,
+  overviewPointPx: 2.5,
+  moveDebounceMs: 320,
+  viewRangeMinM: 2_500,
+  viewRangePerHeight: 10,
+  viewNearM: 1_000,
+});
+export const TOO_HIGH_HINT = 'zoom in to see KartaView coverage';
+export const NO_COVERAGE_HINT = 'no KartaView photos in view';
+export const RATE_LIMITED_MESSAGE =
+  'KartaView is rate-limiting requests — they resume on their own';
+
+/**
+ * The photo API answers 429 to more than about three requests at once, so
+ * at most two are in flight; a 429 is retried after a short wait.
+ */
+export const PHOTO_API_CONCURRENCY = 2;
+export const PHOTO_API_RETRIES = 3;
+export const PHOTO_API_RETRY_BASE_MS = 800;
+/** A Retry-After longer than this is not waited out. */
+export const PHOTO_API_RETRY_MAX_MS = 10_000;
+/** The API is HTTP/1.1 (six connections): tiles 3, lookups 2, pages 1. */
+export const TILE_CONCURRENCY = 3;
+export const PAGE_CONCURRENCY = 1;
+export const TILE_TIMEOUT_MS = 20_000;
+export const PHOTO_API_TIMEOUT_MS = 15_000;
+/**
+ * The first try of a lookup: KartaView sometimes sits on a lookup for 11 s
+ * and more, then answers the same one again in 3 s.
+ */
+export const PHOTO_API_FIRST_TIMEOUT_MS = 8_000;
+/** A sequence page is about 650 kB of JSON. */
+export const PAGE_TIMEOUT_MS = 30_000;
+/** Real tiles are under 1 MB; refuse anything absurd before parsing it. */
+export const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+/** A photo download (tens of kilobytes to a few megabytes). */
+export const IMAGE_TIMEOUT_MS = 15_000;
+/** Whether a photo file is there (not archived): headers only. */
+export const IMAGE_PROBE_TIMEOUT_MS = 8_000;
+/** Nearest photos probed (at once) before giving up on archived ones; ‹ › skip this many. */
+export const NEAREST_PROBES = 6;
+export const ARCHIVED_MESSAGE =
+  'KartaView’s photos here are archived and cannot be shown';
+
+/** Photos asked for around a point; the API returns them nearest first. */
+export const NEAREST_LIMIT = 10;
+/** The photo API's search zoom: 18 searches the few tens of metres around the point. */
+export const NEAREST_SEARCH_ZOOM = 18;
+
+/**
+ * Photos of a sequence fetched at once, around the open one. Records are
+ * ~2.6 kB each, so a page is ~650 kB; the cones and ‹ › use it. Pages are in
+ * photo-id order, which only roughly follows the sequence index.
+ */
+export const SEQUENCE_PAGE_SIZE = 250;
+/** Within this many photos of a page's edge, its neighbour page joins it. */
+export const SEQUENCE_PAGE_EDGE = 12;
+
+/** Equirectangular panorama sizes: a quick preview, then the sharp one. */
+export const PANO_PREVIEW_SIZE = Object.freeze([1024, 512]);
+/** A flat photo's first version, then its sharp one. */
+export const FLAT_VIEW_SIZE = Object.freeze([1280, 1280]);
+export const FLAT_FULL_SIZE = Object.freeze([2560, 2560]);
+
+/** On-globe credit: KartaView imagery is CC BY-SA 4.0 and needs attribution. */
+export const KARTAVIEW_CREDIT_HTML =
+  'Street Level: imagery © <a href="https://kartaview.org" target="_blank" rel="noopener">KartaView</a> contributors, CC BY-SA 4.0';
+
+/**
+ * The imagery filter (360° or flat, SINCE). KartaView filters coverage on
+ * its server only in its PNG tiles: its JSON tiles come back empty once a
+ * filter is asked for. So a filtered PNG tile is a mask, and a JSON line is
+ * kept where it lies on the mask's drawn pixels.
+ *
+ * KartaView's date filter is the upload date, and SINCE goes by it
+ * throughout (lines, the photo a click opens, the cones), as KartaView's own
+ * map does; the panel says so under the slider.
+ */
+export const MASK_TIMEOUT_MS = 20_000;
+/**
+ * A filtered PNG tile is drawn on demand and a dense one can outlast
+ * KartaView's own 60 s (504); it keeps drawing, and has the tile a few
+ * seconds later. A timeout or a 5xx is asked again this many times in all.
+ */
+export const MASK_ATTEMPTS = 4;
+export const MASK_RETRY_WAIT_MS = 4_000;
+/** Real masks are tens of kilobytes. */
+export const MASK_MAX_BYTES = 2 * 1024 * 1024;
+/** A segment is kept when this share of the points along it lies on the mask. */
+export const MASK_KEEP_SHARE = 0.5;
+/** Points along a segment are tested this many mask pixels apart. */
+export const MASK_SAMPLE_PX = 2;
+export const MASK_SLOW_MESSAGE =
+  'KartaView did not filter this area in time — move the map to ask again';
+export const FILTERED_OUT_MESSAGE =
+  'None of KartaView’s photos here pass the imagery filter';
+/** Under the SINCE slider while KartaView is lit. */
+export const SINCE_NOTE = 'KartaView: by upload date';
+
+/** The UTC calendar day of `ms`, as KartaView's startDate reads it. */
+function utcDay(ms) {
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+const filtersSince = (filter) =>
+  Number.isFinite(filter?.sinceMs) && filter.sinceMs > 0;
+
+const DAY_MS = 86_400_000;
+
+/**
+ * Whether a photo passes the resolved imagery filter by its projection and
+ * upload date, the cut-off taken as its UTC day, as KartaView's startDate.
+ * @param {{isPano: boolean, uploadedAt: number|null}} photo
+ * @param {{pano: string, sinceMs: number|null}|null} filter
+ */
+export function passesKartaViewFilter(photo, filter) {
+  if (!filter) return true;
+  if (filter.pano === 'pano' && !photo.isPano) return false;
+  if (filter.pano === 'flat' && photo.isPano) return false;
+  if (!filtersSince(filter)) return true;
+  const day = Math.floor(filter.sinceMs / DAY_MS) * DAY_MS;
+  return (photo.uploadedAt ?? 0) >= day;
+}
+
+/**
+ * The query of a filtered PNG coverage tile, or '' when nothing is
+ * filtered. The day, not the instant, so it is stable for a day (and keys
+ * the mask cache).
+ * @param {{pano: string, sinceMs: number|null}|null} filter  resolved
+ */
+export function tileFilterQuery(filter) {
+  const params = new URLSearchParams();
+  if (filter?.pano === 'pano') params.set('fieldOfView', '360');
+  else if (filter?.pano === 'flat') params.set('fieldOfView', 'plane');
+  if (filtersSince(filter)) params.set('startDate', utcDay(filter.sinceMs));
+  return params.toString();
+}
+
+/**
+ * The photo search's own filter: projection and upload date (its
+ * `fieldOfView` is ignored).
+ * @param {{pano: string, sinceMs: number|null}|null} filter  resolved
+ * @returns {Record<string, string>}
+ */
+export function photoFilterParams(filter) {
+  const params = {};
+  if (filter?.pano === 'pano') params.projection = 'SPHERE';
+  else if (filter?.pano === 'flat') params.projection = 'PLANE';
+  if (filtersSince(filter)) params.startDate = utcDay(filter.sinceMs);
+  return params;
+}
+
+/** The cone and coverage noun: a line is a street with photos, not a sequence. */
+export const COVERAGE_NOUN = 'streets';
+export const LINE_CLICK_HINT = 'click a line for its nearest photo';
+
+/** Base64url of a string, as the image proxy reads addresses. */
+function base64Url(text) {
+  const bytes = new TextEncoder().encode(text);
+  let binary = '';
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary)
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '');
+}
+
+/** A photo resized by KartaView's image proxy to fit `width`×`height`. */
+export function resizedImageUrl(url, [width, height]) {
+  if (!url) return null;
+  return `${KARTAVIEW_CDN_HOST}/pr:sharp/rs:fit:${width}:${height}/${base64Url(url)}`;
+}
+
+/** Epoch ms for a KartaView timestamp ('2016-02-19 15:28:18.000', UTC), or null. */
+export function kartaViewTimeMs(value) {
+  const match =
+    /^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2})(?::(\d{2}))?)?/.exec(
+      String(value ?? ''),
+    );
+  if (!match) return null;
+  const [, y, mo, d, h = '0', mi = '0', s = '0'] = match;
+  if (Number(y) < 1990) return null;
+  const ms = Date.UTC(+y, +mo - 1, +d, +h, +mi, +s);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+/** Initial great-circle bearing from `a` to `b`, degrees clockwise from north. */
+export function bearingBetween(a, b) {
+  const rad = Math.PI / 180;
+  const dLon = (b.lon - a.lon) * rad;
+  const y = Math.sin(dLon) * Math.cos(b.lat * rad);
+  const x =
+    Math.cos(a.lat * rad) * Math.sin(b.lat * rad) -
+    Math.sin(a.lat * rad) * Math.cos(b.lat * rad) * Math.cos(dLon);
+  return (Math.atan2(y, x) / rad + 360) % 360;
+}
+
+/** Photos closer than this say nothing about the direction of travel. */
+const COURSE_MIN_STEP_M = 2;
+/** How many photos along to look for one far enough away. */
+const COURSE_SEARCH = 5;
+
+/**
+ * Give each photo of a drive (in index order) its `course`: the direction
+ * of travel from it to the next photo a few metres on (from the previous one
+ * at the end). KartaView is dashcam imagery, so this is where the camera
+ * looks; its `heading` is the device compass, which reads 0 without one and
+ * can sit 110° off inside a car.
+ * @param {Array<{lon: number, lat: number, course?: number|null}>} photos
+ * @param {(a: object, b: object) => number} metres
+ */
+export function assignCourses(photos, metres) {
+  photos.forEach((photo, i) => {
+    let course = null;
+    for (let j = i + 1; j <= i + COURSE_SEARCH && j < photos.length; j++)
+      if (metres(photo, photos[j]) >= COURSE_MIN_STEP_M) {
+        course = bearingBetween(photo, photos[j]);
+        break;
+      }
+    for (
+      let k = i - 1;
+      course === null && k >= i - COURSE_SEARCH && k >= 0;
+      k--
+    )
+      if (metres(photos[k], photo) >= COURSE_MIN_STEP_M)
+        course = bearingBetween(photos[k], photo);
+    photo.course = course;
+  });
+  return photos;
+}
+
+/** Where the camera looked: the direction of travel, else the compass, else unknown. */
+export function cameraBearing(photo) {
+  return photo?.course ?? photo?.heading ?? null;
+}
+
+/** A coordinate pair as numbers; the road-matched one when KartaView has it. */
+function positionOf(record) {
+  const matchLat = Number(record.matchLat);
+  const matchLon = Number(record.matchLng);
+  if (
+    Number.isFinite(matchLat) &&
+    Number.isFinite(matchLon) &&
+    (matchLat !== 0 || matchLon !== 0)
+  )
+    return { lat: matchLat, lon: matchLon };
+  return { lat: Number(record.lat), lon: Number(record.lng) };
+}
+
+const STORAGE_HOST = /^storage\d+$/;
+
+/** A KartaView photo-storage address, or null for anything else. */
+function storageUrl(value) {
+  try {
+    const url = new URL(String(value));
+    return url.protocol === 'https:' &&
+      /^storage\d+\.openstreetcam\.org$/.test(url.hostname)
+      ? url.href
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A photo file's address. The API's `fileurl*` fields always name storage1,
+ * but a photo whose `storage` is another host (storage2…) is only there, so
+ * the address is built from `storage` and the relative `filepath*`. A
+ * `fileurl*` fallback must itself be on KartaView's storage.
+ */
+function fileUrl(record, pathKey, urlKey) {
+  const path = record[pathKey];
+  if (STORAGE_HOST.test(record.storage || '') && path)
+    return storageUrl(
+      `https://${record.storage}.openstreetcam.org/files/photo/${path}`,
+    );
+  return storageUrl(record[urlKey]);
+}
+
+/** A storage URL with its `{{sizeprefix}}` placeholder filled. */
+function sized(record, prefix) {
+  const fill = (value) =>
+    typeof value === 'string' && value.includes('{{sizeprefix}}')
+      ? value.replace('{{sizeprefix}}', prefix)
+      : null;
+  const path = fill(record.filepath);
+  return fileUrl(
+    { ...record, filepath: path, fileurl: fill(record.fileurl) },
+    'filepath',
+    'fileurl',
+  );
+}
+
+/**
+ * A photo API record in the shape the provider uses, or null without an id
+ * or a position.
+ * @returns {{id: string, sequenceId: string|null, sequenceIndex: number|null, lon: number, lat: number, heading: number|null, isPano: boolean, capturedAt: number|null, urls: {view: string|null, full: string|null, pano: string|null}}|null}
+ */
+export function normalizePhoto(record) {
+  if (!record || record.id == null) return null;
+  const { lat, lon } = positionOf(record);
+  if (!Number.isFinite(lat) || !Number.isFinite(lon)) return null;
+  // 0,0 is a missing fix, not a photo in the Gulf of Guinea.
+  if (lat === 0 && lon === 0) return null;
+  if (Math.abs(lat) > 90 || Math.abs(lon) > 180) return null;
+  // An exact 0 is a device without a compass (whole drives read 0), not north.
+  const heading =
+    record.heading === '' || record.heading == null
+      ? NaN
+      : Number(record.heading) || NaN;
+  const isPano =
+    record.projection === 'SPHERE' || Number(record.fieldOfView) >= 360;
+  const full =
+    fileUrl(record, 'filepathProc', 'fileurlProc') || sized(record, 'proc');
+  const index = Number(record.sequenceIndex);
+  return {
+    id: String(record.id),
+    sequenceId: record.sequenceId != null ? String(record.sequenceId) : null,
+    sequenceIndex: Number.isFinite(index) ? index : null,
+    lon,
+    lat,
+    heading: Number.isFinite(heading) ? heading : null,
+    isPano,
+    capturedAt:
+      kartaViewTimeMs(record.shotDate) ?? kartaViewTimeMs(record.dateAdded),
+    // KartaView's SINCE goes by this (its server filters by upload date).
+    uploadedAt: kartaViewTimeMs(record.dateAdded),
+    urls: {
+      // A 1280 px rendition; for a 360° photo it is the front view only.
+      view:
+        fileUrl(record, 'filepathLTh', 'fileurlLTh') ||
+        sized(record, 'lth') ||
+        full,
+      full,
+      // A 360° photo's equirectangular image ('wrapped_proc').
+      pano: isPano && /wrapped/.test(full || '') ? full : null,
+    },
+  };
+}
+
+/**
+ * Where the image link goes. KartaView's photo pages fail for signed-out
+ * visitors ("Sequence cannot be loaded"), so it is the full-size photo
+ * through KartaView's image proxy, which also serves photos whose storage
+ * host answers 502 directly.
+ */
+export function kartaViewPhotoUrl(photo) {
+  const url = photo?.urls?.full || photo?.urls?.view;
+  return url
+    ? `${KARTAVIEW_CDN_HOST}/pr:sharp/${base64Url(url)}`
+    : 'https://kartaview.org';
+}

src/layers/streetLevel/providers/kartaview/policy.test.mjs

@@ -0,0 +1,348 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  assignCourses,
+  bearingBetween,
+  cameraBearing,
+  kartaViewPhotoUrl,
+  kartaViewTimeMs,
+  normalizePhoto,
+  passesKartaViewFilter,
+  photoFilterParams,
+  resizedImageUrl,
+  tileFilterQuery,
+} from './policy.js';
+
+/** A photo record as /2.0/photo returns it (trimmed to what is read). */
+function record(overrides = {}) {
+  return {
+    id: '7102491',
+    sequenceId: '14010',
+    sequenceIndex: '950',
+    lat: '42.335712',
+    lng: '-83.048301',
+    matchLat: '42.335731506347656',
+    matchLng: '-83.04828643798828',
+    heading: '299.58',
+    fieldOfView: '0',
+    projection: 'PLANE',
+    shotDate: '2016-08-23 20:17:47.000',
+    dateAdded: '2016-08-24 04:01:07',
+    storage: 'storage1',
+    filepath: '2016/8/24/{{sizeprefix}}/14010_ba53c_57bd1d23d50b7.jpg',
+    filepathLTh: '2016/8/24/lth/14010_ba53c_57bd1d23d50b7.jpg',
+    filepathProc: '2016/8/24/proc/14010_ba53c_57bd1d23d50b7.jpg',
+    fileurl:
+      'https://storage1.openstreetcam.org/files/photo/2016/8/24/{{sizeprefix}}/14010_ba53c_57bd1d23d50b7.jpg',
+    fileurlLTh:
+      'https://storage1.openstreetcam.org/files/photo/2016/8/24/lth/14010_ba53c_57bd1d23d50b7.jpg',
+    fileurlProc:
+      'https://storage1.openstreetcam.org/files/photo/2016/8/24/proc/14010_ba53c_57bd1d23d50b7.jpg',
+    ...overrides,
+  };
+}
+
+test('a photo record normalizes to numbers, the road-matched position and UTC capture time', () => {
+  const photo = normalizePhoto(record());
+  assert.equal(photo.id, '7102491');
+  assert.equal(photo.sequenceId, '14010');
+  assert.equal(photo.sequenceIndex, 950);
+  assert.equal(photo.lat, 42.335731506347656);
+  assert.equal(photo.lon, -83.04828643798828);
+  assert.equal(photo.heading, 299.58);
+  assert.equal(photo.isPano, false);
+  assert.equal(photo.capturedAt, Date.UTC(2016, 7, 23, 20, 17, 47));
+  assert.equal(photo.urls.pano, null);
+});
+
+test('photo files come from the storage host the record names, not the one its URLs say', () => {
+  // The API writes storage1 into every URL; this photo lives on storage2.
+  const photo = normalizePhoto(record({ storage: 'storage2' }));
+  assert.equal(
+    photo.urls.view,
+    'https://storage2.openstreetcam.org/files/photo/2016/8/24/lth/14010_ba53c_57bd1d23d50b7.jpg',
+  );
+  assert.equal(
+    photo.urls.full,
+    'https://storage2.openstreetcam.org/files/photo/2016/8/24/proc/14010_ba53c_57bd1d23d50b7.jpg',
+  );
+  // The link goes through the image proxy, which serves photos whose
+  // storage host answers 502 directly.
+  const link = kartaViewPhotoUrl(photo);
+  assert.match(link, /^https:\/\/cdn\.kartaview\.org\/pr:sharp\/[\w-]+$/);
+  assert.equal(
+    Buffer.from(link.split('/').at(-1), 'base64url').toString(),
+    photo.urls.full,
+  );
+  // A fallback address must be on KartaView's storage, over https.
+  for (const fileurlLTh of [
+    'https://tracker.example/x.jpg',
+    'http://storage1.openstreetcam.org/a.jpg',
+    'https://storage1.openstreetcam.org.evil.example/a.jpg',
+    'javascript:alert(1)',
+  ]) {
+    const hostile = normalizePhoto(
+      record({ storage: '', filepathLTh: '', fileurlLTh, fileurl: fileurlLTh }),
+    );
+    assert.notEqual(hostile.urls.view, fileurlLTh);
+    assert.doesNotMatch(
+      String(hostile.urls.view),
+      /tracker|javascript|evil|^http:/,
+    );
+  }
+  // An unexpected storage value falls back to the URLs as given.
+  const odd = normalizePhoto(record({ storage: 'https://evil.example' }));
+  assert.match(odd.urls.view, /^https:\/\/storage1\.openstreetcam\.org\//);
+  // No large thumbnail path: the size prefix fills in.
+  const bare = normalizePhoto(
+    record({ filepathLTh: '', fileurlLTh: '', storage: 'storage3' }),
+  );
+  assert.equal(
+    bare.urls.view,
+    'https://storage3.openstreetcam.org/files/photo/2016/8/24/lth/14010_ba53c_57bd1d23d50b7.jpg',
+  );
+});
+
+test('a 360° photo keeps its equirectangular image; the unmatched position is the fallback', () => {
+  const photo = normalizePhoto(
+    record({
+      projection: 'SPHERE',
+      fieldOfView: '360',
+      matchLat: '0',
+      matchLng: '0',
+      storage: 'storage13',
+      filepathProc: '2022/10/6/wrapped_proc/6187609_626b8.jpg',
+    }),
+  );
+  assert.equal(photo.isPano, true);
+  assert.equal(photo.lat, 42.335712);
+  assert.equal(
+    photo.urls.pano,
+    'https://storage13.openstreetcam.org/files/photo/2022/10/6/wrapped_proc/6187609_626b8.jpg',
+  );
+  // A sphere without a wrapped image has nothing to project.
+  assert.equal(
+    normalizePhoto(record({ projection: 'SPHERE', fieldOfView: '360' })).urls
+      .pano,
+    null,
+  );
+});
+
+test('records without an id or a position are dropped; a missing heading is null', () => {
+  assert.equal(normalizePhoto(null), null);
+  // 0,0 is a missing fix.
+  assert.equal(
+    normalizePhoto(
+      record({ lat: '0', lng: '0', matchLat: '0', matchLng: '0' }),
+    ),
+    null,
+  );
+  assert.equal(normalizePhoto(record({ lat: '95', matchLat: '95' })), null);
+  assert.equal(normalizePhoto(record({ id: undefined })), null);
+  assert.equal(
+    normalizePhoto(
+      record({ lat: 'x', lng: 'y', matchLat: undefined, matchLng: undefined }),
+    ),
+    null,
+  );
+  assert.equal(normalizePhoto(record({ heading: '' })).heading, null);
+  // A device without a compass reads 0 for a whole drive: unknown, not north.
+  assert.equal(normalizePhoto(record({ heading: '0' })).heading, null);
+  assert.equal(normalizePhoto(record({ heading: '0.5' })).heading, 0.5);
+  assert.equal(normalizePhoto(record({ heading: 'n/a' })).heading, null);
+});
+
+test('timestamps parse as UTC; years before 1990 and garbage are unknown', () => {
+  assert.equal(kartaViewTimeMs('2022-03-21'), Date.UTC(2022, 2, 21));
+  assert.equal(
+    kartaViewTimeMs('2022-03-21T06:42:59'),
+    Date.UTC(2022, 2, 21, 6, 42, 59),
+  );
+  assert.equal(kartaViewTimeMs('0000-00-00 00:00:00'), null);
+  assert.equal(kartaViewTimeMs(''), null);
+  assert.equal(kartaViewTimeMs(null), null);
+  const fallback = normalizePhoto(record({ shotDate: null }));
+  assert.equal(fallback.capturedAt, Date.UTC(2016, 7, 24, 4, 1, 7));
+});
+
+test('resized images go through the proxy with a base64url address', () => {
+  const url = resizedImageUrl(
+    'https://storage13.openstreetcam.org/files/photo/a?b=c+d',
+    [1024, 512],
+  );
+  const [, encoded] = /\/rs:fit:1024:512\/(.+)$/.exec(url);
+  assert.match(url, /^https:\/\/cdn\.kartaview\.org\/pr:sharp\/rs:fit:/);
+  assert.doesNotMatch(encoded, /[+/=]/);
+  const decoded = Buffer.from(
+    encoded.replace(/-/g, '+').replace(/_/g, '/'),
+    'base64',
+  ).toString();
+  assert.equal(
+    decoded,
+    'https://storage13.openstreetcam.org/files/photo/a?b=c+d',
+  );
+  assert.equal(resizedImageUrl(null, [1, 1]), null);
+});
+
+test('a storage value that only contains a storage host name builds no address from it', () => {
+  for (const storage of ['evil.example/#storage1', 'storage1.evil.example']) {
+    const photo = normalizePhoto(record({ storage }));
+    // Not a storage host: the API's own storage URLs serve.
+    assert.equal(
+      photo.urls.view,
+      'https://storage1.openstreetcam.org/files/photo/2016/8/24/lth/14010_ba53c_57bd1d23d50b7.jpg',
+      storage,
+    );
+    assert.equal(
+      photo.urls.full,
+      'https://storage1.openstreetcam.org/files/photo/2016/8/24/proc/14010_ba53c_57bd1d23d50b7.jpg',
+      storage,
+    );
+  }
+});
+
+test('a 360° field of view makes a panorama whatever the projection says', () => {
+  assert.equal(
+    normalizePhoto(record({ projection: 'PLANE', fieldOfView: '360' })).isPano,
+    true,
+  );
+  assert.equal(
+    normalizePhoto(record({ projection: 'PLANE', fieldOfView: '359' })).isPano,
+    false,
+  );
+});
+
+test('a longitude past ±180 is not a position', () => {
+  assert.equal(normalizePhoto(record({ lng: '181', matchLng: '181' })), null);
+  assert.equal(normalizePhoto(record({ lng: '-181', matchLng: '-181' })), null);
+  assert.equal(
+    normalizePhoto(record({ lng: '180', matchLng: '180' })).lon,
+    180,
+  );
+});
+
+test('with no processed-photo path the size prefix gives the full photo', () => {
+  const photo = normalizePhoto(
+    record({ filepathProc: '', fileurlProc: '', storage: 'storage3' }),
+  );
+  assert.equal(
+    photo.urls.full,
+    'https://storage3.openstreetcam.org/files/photo/2016/8/24/proc/14010_ba53c_57bd1d23d50b7.jpg',
+  );
+  // Only the large thumbnail, no path at all: the thumbnail still shows.
+  const thumbOnly = normalizePhoto(
+    record({
+      filepathProc: '',
+      fileurlProc: '',
+      filepath: '',
+      fileurl: '',
+      storage: 'storage3',
+    }),
+  );
+  assert.equal(thumbOnly.urls.full, null);
+  assert.match(
+    thumbOnly.urls.view,
+    /^https:\/\/storage3\.openstreetcam\.org\/.*\/lth\//,
+  );
+});
+
+test('the camera looks along the drive: each photo’s course points to the next one a few metres on', () => {
+  // North along a meridian, 5 m apart, then a repeat of the last position.
+  const step = 5 / 110_540;
+  const photos = [0, 1, 2, 3].map((i) => ({ lon: 10, lat: 50 + i * step }));
+  photos.push({ lon: 10, lat: 50 + 3 * step }); // a stop: same place
+  const metres = (a, b) =>
+    Math.hypot(
+      (b.lon - a.lon) * 111_320 * Math.cos((a.lat * Math.PI) / 180),
+      (b.lat - a.lat) * 110_540,
+    );
+  assignCourses(photos, metres);
+  for (const photo of photos)
+    assert.ok(
+      Math.abs(photo.course) < 0.5 || Math.abs(photo.course - 360) < 0.5,
+      `${photo.course}`,
+    );
+  // Eastward: 90°.
+  const east = [0, 1].map((i) => ({ lon: 10 + (i * 5) / 71_600, lat: 50 }));
+  assignCourses(east, metres);
+  assert.ok(
+    Math.abs(east[0].course - 90) < 0.5 && Math.abs(east[1].course - 90) < 0.5,
+  );
+  // A lone photo has no course; the compass is the fallback, then unknown.
+  const [lone] = assignCourses([{ lon: 1, lat: 1 }], metres);
+  assert.equal(lone.course, null);
+  assert.equal(cameraBearing({ ...lone, heading: 42 }), 42);
+  assert.equal(cameraBearing({ ...lone, heading: null }), null);
+  assert.equal(
+    cameraBearing({ course: 90, heading: 200 }),
+    90,
+    'the drive beats the compass',
+  );
+  assert.ok(
+    Math.abs(bearingBetween({ lon: 0, lat: 0 }, { lon: 0, lat: -1 }) - 180) <
+      1e-9,
+  );
+});
+
+test('the imagery filter becomes KartaView’s tile query and photo-search params', () => {
+  // 2026-03-05 23:30 UTC: the cut-off day is the UTC one.
+  const sinceMs = Date.UTC(2026, 2, 5, 23, 30);
+  assert.equal(tileFilterQuery(null), '');
+  assert.equal(tileFilterQuery({ pano: 'all', sinceMs: null }), '');
+  assert.equal(
+    tileFilterQuery({ pano: 'pano', sinceMs: null }),
+    'fieldOfView=360',
+  );
+  assert.equal(
+    tileFilterQuery({ pano: 'flat', sinceMs }),
+    'fieldOfView=plane&startDate=2026-03-05',
+  );
+  assert.equal(tileFilterQuery({ pano: 'all', sinceMs: 0 }), '');
+  // The search ignores fieldOfView; its projection filters instead.
+  assert.deepEqual(photoFilterParams({ pano: 'all', sinceMs: null }), {});
+  assert.deepEqual(photoFilterParams({ pano: 'pano', sinceMs }), {
+    projection: 'SPHERE',
+    startDate: '2026-03-05',
+  });
+  assert.deepEqual(photoFilterParams({ pano: 'flat', sinceMs: null }), {
+    projection: 'PLANE',
+  });
+});
+
+test('KartaView’s SINCE is the upload date, from the start of the cut-off’s UTC day', () => {
+  const photo = normalizePhoto(
+    record({
+      shotDate: '2016-08-23 20:17:47.000',
+      dateAdded: '2026-03-05 00:10:00',
+    }),
+  );
+  assert.equal(photo.uploadedAt, Date.UTC(2026, 2, 5, 0, 10));
+  const since = (iso) => ({ pano: 'all', sinceMs: Date.parse(iso) });
+  // Taken in 2016, uploaded on the cut-off day: it passes, as KartaView's
+  // startDate=2026-03-05 keeps it.
+  assert.equal(
+    passesKartaViewFilter(photo, since('2026-03-05T23:00:00Z')),
+    true,
+  );
+  assert.equal(
+    passesKartaViewFilter(photo, since('2026-03-06T00:00:00Z')),
+    false,
+  );
+  assert.equal(
+    passesKartaViewFilter(photo, { pano: 'pano', sinceMs: null }),
+    false,
+  );
+  assert.equal(
+    passesKartaViewFilter(photo, { pano: 'flat', sinceMs: null }),
+    true,
+  );
+  assert.equal(passesKartaViewFilter(photo, null), true);
+  assert.equal(
+    passesKartaViewFilter(
+      { ...photo, uploadedAt: null },
+      since('2020-01-01T00:00:00Z'),
+    ),
+    false,
+    'no upload date passes no SINCE',
+  );
+});

src/layers/streetLevel/providers/kartaview/source.js

@@ -0,0 +1,412 @@
+import {
+  IMAGE_PROBE_TIMEOUT_MS,
+  MAX_RESPONSE_BYTES,
+  KARTAVIEW_API_HOST,
+  MASK_ATTEMPTS,
+  MASK_MAX_BYTES,
+  MASK_RETRY_WAIT_MS,
+  MASK_SLOW_MESSAGE,
+  MASK_TIMEOUT_MS,
+  NEAREST_LIMIT,
+  NEAREST_SEARCH_ZOOM,
+  PAGE_CONCURRENCY,
+  PAGE_TIMEOUT_MS,
+  PHOTO_API_CONCURRENCY,
+  PHOTO_API_RETRIES,
+  PHOTO_API_RETRY_BASE_MS,
+  PHOTO_API_RETRY_MAX_MS,
+  PHOTO_API_FIRST_TIMEOUT_MS,
+  PHOTO_API_TIMEOUT_MS,
+  TILE_CONCURRENCY,
+  TILE_TIMEOUT_MS,
+  photoFilterParams,
+} from './policy.js';
+import { createLimiter } from '../../limiter.js';
+
+export { createLimiter } from '../../limiter.js';
+
+/**
+ * An HTTP or API failure; `retryAfterSec` is set while KartaView rate-limits,
+ * `timedOut` when it did not answer in time (the one failure worth asking
+ * again at once).
+ */
+export class KartaViewSourceError extends Error {
+  constructor(
+    message,
+    { status = 0, retryAfterSec = null, timedOut = false } = {},
+  ) {
+    super(message);
+    this.name = 'KartaViewSourceError';
+    this.status = status;
+    this.retryAfterSec = retryAfterSec;
+    this.timedOut = timedOut;
+  }
+}
+
+const NO_ANSWER = 'KartaView did not answer in time — try again';
+const UNREACHABLE = 'KartaView could not be reached — check the network';
+const UNREADABLE = 'KartaView sent an answer that could not be read';
+/** Statuses that mean a photo file is gone, not that storage hiccupped. */
+const GONE_STATUSES = Object.freeze([403, 404, 409, 410]);
+
+/** Resolves after `ms`, or rejects when `signal` aborts first. */
+function wait(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(signal.reason);
+    const timer = setTimeout(done, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal.reason);
+    };
+    signal?.addEventListener('abort', onAbort, { once: true });
+    function done() {
+      signal?.removeEventListener('abort', onAbort);
+      resolve();
+    }
+  });
+}
+
+/** Seconds from a Retry-After header, or null. */
+function retryAfterSeconds(response) {
+  const header = response.headers?.get?.('retry-after');
+  const value = header == null || header === '' ? NaN : Number(header);
+  return Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+/**
+ * KartaView's public API, browser-side and keyless (it allows any origin).
+ * It speaks HTTP/1.1, so the browser opens six connections to it: tiles take
+ * at most three, photo lookups two and sequence pages one, so a lookup never
+ * waits behind slow tiles or pages. The photo API answers 429 to more than
+ * about three requests at once; a 429 (and a lookup that timed out) is
+ * retried.
+ * @param {{fetchImpl?: typeof fetch, apiHost?: string, retryBaseMs?: number, maskRetryMs?: number}} [options]
+ */
+export function createKartaViewSource({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  apiHost = KARTAVIEW_API_HOST,
+  retryBaseMs = PHOTO_API_RETRY_BASE_MS,
+  maskRetryMs = MASK_RETRY_WAIT_MS,
+} = {}) {
+  const limiter = createLimiter(PHOTO_API_CONCURRENCY);
+  const tileLimiter = createLimiter(TILE_CONCURRENCY);
+  const pageLimiter = createLimiter(PAGE_CONCURRENCY, { lifo: true });
+
+  /** GET JSON within `timeoutMs`; the caller's abort wins over the timeout. */
+  function getJson(url, { signal, timeoutMs }) {
+    return fetchBody(url, { signal, timeoutMs, as: 'json' });
+  }
+
+  /**
+   * GET a body within `timeoutMs`, at most `maxBytes` of it, as parsed JSON
+   * or (`as: 'bytes'`) a Uint8Array; the caller's abort wins over the
+   * timeout.
+   */
+  async function fetchBody(
+    url,
+    { signal, timeoutMs, as = 'json', maxBytes = MAX_RESPONSE_BYTES },
+  ) {
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(signal.reason);
+    if (signal?.aborted) throw signal.reason;
+    signal?.addEventListener('abort', onAbort, { once: true });
+    const timer = setTimeout(
+      () =>
+        controller.abort(
+          new KartaViewSourceError(NO_ANSWER, { timedOut: true }),
+        ),
+      timeoutMs,
+    );
+    let response = null;
+    let read = false;
+    try {
+      response = await fetchImpl(url, { signal: controller.signal });
+      if (response.status === 429)
+        throw new KartaViewSourceError('KartaView is rate-limiting requests', {
+          status: 429,
+          retryAfterSec: retryAfterSeconds(response) ?? 2,
+        });
+      if (!response.ok)
+        throw new KartaViewSourceError(
+          `KartaView answered HTTP ${response.status}`,
+          { status: response.status },
+        );
+      const length = Number(response.headers?.get?.('content-length'));
+      const tooMuch = () =>
+        new KartaViewSourceError('KartaView sent too much data', {
+          status: response.status,
+        });
+      if (length > maxBytes) throw tooMuch();
+      // KartaView answers chunked, without a length: count while reading.
+      const reader = response.body?.getReader?.();
+      if (!reader) {
+        read = true;
+        try {
+          if (as === 'bytes')
+            return new Uint8Array(await response.arrayBuffer());
+          return await response.json();
+        } catch (error) {
+          if (controller.signal.aborted) throw error;
+          throw new KartaViewSourceError(UNREADABLE, {
+            status: response.status,
+          });
+        }
+      }
+      read = true;
+      const chunks = [];
+      let bytes = 0;
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        bytes += value.byteLength;
+        if (bytes > maxBytes) {
+          reader.cancel().catch(() => {});
+          throw tooMuch();
+        }
+        chunks.push(value);
+      }
+      const body = new Uint8Array(bytes);
+      let offset = 0;
+      for (const chunk of chunks) {
+        body.set(chunk, offset);
+        offset += chunk.byteLength;
+      }
+      if (as === 'bytes') return body;
+      try {
+        return JSON.parse(new TextDecoder().decode(body));
+      } catch {
+        throw new KartaViewSourceError(UNREADABLE, {
+          status: response.status,
+        });
+      }
+    } catch (error) {
+      if (signal?.aborted) throw signal.reason;
+      if (controller.signal.aborted) throw controller.signal.reason;
+      if (error instanceof KartaViewSourceError) throw error;
+      // fetch rejects on no network, a blocked request or a refused CORS check.
+      throw new KartaViewSourceError(UNREACHABLE);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+      // An answer turned away unread (429, an error, too long) still holds
+      // its connection, one of the six the browser has: let it go.
+      if (response && !read) {
+        controller.abort();
+        if (response.body && !response.body.locked)
+          response.body.cancel?.().catch?.(() => {});
+      }
+    }
+  }
+
+  /**
+   * A photo-API call through `gate`, retrying 429s with backoff and, once, a
+   * call that timed out.
+   */
+  async function photoApi(
+    path,
+    params,
+    { signal } = {},
+    {
+      gate = limiter,
+      timeoutMs = PHOTO_API_TIMEOUT_MS,
+      firstTimeoutMs = PHOTO_API_FIRST_TIMEOUT_MS,
+    } = {},
+  ) {
+    const query = params ? `?${new URLSearchParams(params)}` : '';
+    const url = `${apiHost}${path}${query}`;
+    let timeouts = 0;
+    for (let attempt = 0; ; attempt++) {
+      try {
+        const payload = await gate.run(
+          // A slow first answer is usually quick when asked again.
+          () =>
+            getJson(url, {
+              signal,
+              timeoutMs: timeouts === 0 ? firstTimeoutMs : timeoutMs,
+            }),
+          { signal },
+        );
+        const code = Number(payload?.status?.apiCode);
+        // 600 ok, 601 empty, 602 partial: anything else is a refusal.
+        if (Number.isFinite(code) && (code < 600 || code > 603))
+          throw new KartaViewSourceError(
+            `KartaView refused the request (code ${code})`,
+            { status: Number(payload?.status?.httpCode) || 0 },
+          );
+        return payload?.result ?? {};
+      } catch (error) {
+        if (signal?.aborted) throw error;
+        const timedOut = error?.timedOut === true;
+        if (timedOut && timeouts++ < 1) continue;
+        if (error?.status !== 429 || attempt >= PHOTO_API_RETRIES) {
+          if (error?.status === 429)
+            throw new KartaViewSourceError(
+              'KartaView is rate-limiting requests — try again in a moment',
+              { status: 429, retryAfterSec: error.retryAfterSec },
+            );
+          throw error;
+        }
+        await wait(
+          Math.min(
+            PHOTO_API_RETRY_MAX_MS,
+            Math.max(
+              retryBaseMs * 2 ** attempt,
+              (error.retryAfterSec ?? 0) * 1000,
+            ),
+          ),
+          signal,
+        );
+      }
+    }
+  }
+
+  return {
+    /** A coverage tile: `{lines: [{track: [{lat, lng}]}]}`. */
+    async getTile({ x, y, z }, { signal } = {}) {
+      const url = `${apiHost}/2.0/sequence/tiles/${x}/${y}/${z}.json`;
+      const once = () =>
+        tileLimiter.run(
+          () => getJson(url, { signal, timeoutMs: TILE_TIMEOUT_MS }),
+          { signal },
+        );
+      try {
+        return await once();
+      } catch (error) {
+        // A cold dense tile can outlast the timeout; KartaView has it ready
+        // by the second ask.
+        if (signal?.aborted || error?.timedOut !== true) throw error;
+        return once();
+      }
+    },
+
+    /**
+     * A filtered coverage tile as PNG bytes, `query` from tileFilterQuery
+     * (KartaView filters only its PNG tiles). It draws a filtered tile on
+     * demand; a dense one can outlast its own 60 s (504) and still be drawn,
+     * so a timeout or a 5xx is asked again a few seconds later.
+     */
+    async getTileMask({ x, y, z }, query, { signal } = {}) {
+      const url = `${apiHost}/2.0/sequence/tiles/${x}/${y}/${z}.png?${query}`;
+      for (let attempt = 1; ; attempt++) {
+        try {
+          // Outside the gate between tries: a wait holds no connection.
+          return await tileLimiter.run(
+            () =>
+              fetchBody(url, {
+                signal,
+                timeoutMs: MASK_TIMEOUT_MS,
+                as: 'bytes',
+                maxBytes: MASK_MAX_BYTES,
+              }),
+            { signal },
+          );
+        } catch (error) {
+          if (signal?.aborted) throw error;
+          const drawing =
+            error?.timedOut === true || [502, 503, 504].includes(error?.status);
+          if (!drawing) throw error;
+          if (attempt >= MASK_ATTEMPTS)
+            throw new KartaViewSourceError(MASK_SLOW_MESSAGE, {
+              timedOut: true,
+            });
+          await wait(maskRetryMs, signal);
+        }
+      }
+    },
+
+    /**
+     * Whether a photo file is there: true, false when it is gone (archived
+     * photos answer 409, and a HEAD says 200 regardless), or null when the
+     * storage did not say (timeout, network, 5xx). It GETs and stops at the
+     * headers.
+     */
+    async probeImage(url, { signal } = {}) {
+      if (!url) return false;
+      const controller = new AbortController();
+      const onAbort = () => controller.abort(signal.reason);
+      if (signal?.aborted) throw signal.reason;
+      signal?.addEventListener('abort', onAbort, { once: true });
+      const timer = setTimeout(
+        () => controller.abort(),
+        IMAGE_PROBE_TIMEOUT_MS,
+      );
+      try {
+        const response = await fetchImpl(url, { signal: controller.signal });
+        if (response.ok) return true;
+        return GONE_STATUSES.includes(response.status) ? false : null;
+      } catch {
+        if (signal?.aborted) throw signal.reason;
+        return null;
+      } finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', onAbort);
+        // The body is not needed: drop it.
+        controller.abort();
+      }
+    },
+
+    /**
+     * Photo records around a point, nearest first; with a resolved imagery
+     * `filter`, only those of its projection uploaded since its cut-off.
+     */
+    async nearestPhotos({ lat, lon, filter = null }, { signal } = {}) {
+      const result = await photoApi(
+        '/2.0/photo/',
+        {
+          lat: lat.toFixed(7),
+          lng: lon.toFixed(7),
+          zoomLevel: String(NEAREST_SEARCH_ZOOM),
+          itemsPerPage: String(NEAREST_LIMIT),
+          ...photoFilterParams(filter),
+        },
+        { signal },
+      );
+      return Array.isArray(result.data) ? result.data : [];
+    },
+
+    /** One photo record. */
+    async getPhoto(photoId, { signal } = {}) {
+      const result = await photoApi(
+        `/2.0/photo/${encodeURIComponent(photoId)}`,
+        null,
+        { signal },
+      );
+      if (!result.data || typeof result.data !== 'object')
+        throw new KartaViewSourceError('KartaView has no such photo');
+      return result.data;
+    },
+
+    /** How many photos a sequence has, or null if KartaView does not say. */
+    async getSequenceCount(sequenceId, { signal } = {}) {
+      const result = await photoApi(
+        `/2.0/sequence/${encodeURIComponent(sequenceId)}`,
+        null,
+        { signal },
+      );
+      const count = Number(result.data?.countActivePhotos);
+      return Number.isFinite(count) && count > 0 ? count : null;
+    },
+
+    /** A page of a sequence's photos in capture order (1-based `page`). */
+    async getSequencePhotos(
+      sequenceId,
+      { page, itemsPerPage },
+      { signal } = {},
+    ) {
+      const result = await photoApi(
+        `/2.0/sequence/${encodeURIComponent(sequenceId)}/photos`,
+        { page: String(page), itemsPerPage: String(itemsPerPage) },
+        { signal },
+        {
+          gate: pageLimiter,
+          timeoutMs: PAGE_TIMEOUT_MS,
+          firstTimeoutMs: PAGE_TIMEOUT_MS,
+        },
+      );
+      return {
+        photos: Array.isArray(result.data) ? result.data : [],
+        hasMore: result.hasMoreData === true,
+      };
+    },
+  };
+}

src/layers/streetLevel/providers/kartaview/source.test.mjs

@@ -0,0 +1,728 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  KartaViewSourceError,
+  createKartaViewSource,
+  createLimiter,
+} from './source.js';
+import {
+  MASK_ATTEMPTS,
+  MASK_SLOW_MESSAGE,
+  NEAREST_LIMIT,
+  NEAREST_SEARCH_ZOOM,
+  PHOTO_API_CONCURRENCY,
+  PHOTO_API_RETRIES,
+  PHOTO_API_FIRST_TIMEOUT_MS,
+  PHOTO_API_TIMEOUT_MS,
+  PAGE_TIMEOUT_MS,
+  TILE_CONCURRENCY,
+} from './policy.js';
+
+/** A body streamed as browsers do, in `size`-byte chunks. */
+function streamed(text, size = 16_384) {
+  const bytes = new TextEncoder().encode(text);
+  let at = 0;
+  return {
+    getReader: () => ({
+      read: async () => {
+        if (at >= bytes.length) return { done: true };
+        const value = bytes.slice(at, at + size);
+        at += size;
+        return { done: false, value };
+      },
+      cancel: async () => {},
+    }),
+  };
+}
+
+// A 200 as browsers deliver it: streamed, so the code under test reads it
+// the way it does in production (`json` is there only to fail loudly).
+const ok = (body) => ({
+  ok: true,
+  status: 200,
+  headers: new Map(),
+  body: streamed(JSON.stringify(body)),
+  json: async () => {
+    throw new Error('a browser answer is read from its stream');
+  },
+});
+const status = (code, headers = new Map()) => ({
+  ok: false,
+  status: code,
+  headers,
+  json: async () => ({}),
+});
+const photoPayload = (data) => ({
+  status: { apiCode: 600, httpCode: 200 },
+  result: { data, hasMoreData: false },
+});
+
+test('coverage tiles come from api.kartaview.org as JSON', async () => {
+  const urls = [];
+  const source = createKartaViewSource({
+    fetchImpl: async (url) => {
+      urls.push(url);
+      return ok({ lines: [] });
+    },
+  });
+  assert.deepEqual(await source.getTile({ x: 4412, y: 6061, z: 14 }), {
+    lines: [],
+  });
+  assert.deepEqual(urls, [
+    'https://api.kartaview.org/2.0/sequence/tiles/4412/6061/14.json',
+  ]);
+});
+
+test('photo lookups run at most two at a time', async () => {
+  let running = 0;
+  let peak = 0;
+  const source = createKartaViewSource({
+    fetchImpl: async () => {
+      running++;
+      peak = Math.max(peak, running);
+      await new Promise((resolve) => setTimeout(resolve, 5));
+      running--;
+      return ok(photoPayload({ id: '1' }));
+    },
+  });
+  await Promise.all(
+    Array.from({ length: 7 }, (_, i) => source.getPhoto(String(i))),
+  );
+  assert.equal(peak, PHOTO_API_CONCURRENCY);
+});
+
+test('a 429 is retried after a wait, then answered', async () => {
+  let calls = 0;
+  const source = createKartaViewSource({
+    retryBaseMs: 1,
+    fetchImpl: async () => {
+      calls++;
+      return calls < 3
+        ? status(429, new Map([['retry-after', '0']]))
+        : ok(photoPayload([{ id: '9' }]));
+    },
+  });
+  const records = await source.nearestPhotos({ lat: 42.3, lon: -83.04 });
+  assert.deepEqual(records, [{ id: '9' }]);
+  assert.equal(calls, 3);
+});
+
+test('rate-limiting that outlasts the retries is reported with a wait', async () => {
+  let calls = 0;
+  const source = createKartaViewSource({
+    retryBaseMs: 1,
+    fetchImpl: async () => {
+      calls++;
+      return status(429, new Map([['retry-after', '0.001']]));
+    },
+  });
+  await assert.rejects(source.getPhoto('1'), (error) => {
+    assert.ok(error instanceof KartaViewSourceError);
+    assert.equal(error.status, 429);
+    assert.ok(error.retryAfterSec > 0);
+    assert.match(error.message, /try again in a moment/);
+    return true;
+  });
+  assert.equal(calls, PHOTO_API_RETRIES + 1);
+});
+
+test('an API refusal inside a 200 is a readable error with its code; 601 is just empty', async () => {
+  const refusing = createKartaViewSource({
+    fetchImpl: async () =>
+      ok({
+        status: { apiCode: 612, apiMessage: ' out of range ', httpCode: 400 },
+        result: {},
+      }),
+  });
+  await assert.rejects(
+    refusing.getPhoto('1'),
+    /KartaView refused the request \(code 612\)/,
+  );
+  const empty = createKartaViewSource({
+    fetchImpl: async () =>
+      ok({ status: { apiCode: 601 }, result: { data: [] } }),
+  });
+  assert.deepEqual(await empty.nearestPhotos({ lat: 0, lon: 0 }), []);
+  const page = await empty.getSequencePhotos('2008', {
+    page: 2,
+    itemsPerPage: 1000,
+  });
+  assert.deepEqual(page, { photos: [], hasMore: false });
+});
+
+test('HTTP errors, network failures and non-JSON become readable errors', async () => {
+  const http = createKartaViewSource({ fetchImpl: async () => status(500) });
+  await assert.rejects(http.getTile({ x: 0, y: 0, z: 14 }), /HTTP 500/);
+  let asked = 0;
+  const offline = createKartaViewSource({
+    fetchImpl: async () => {
+      asked++;
+      throw new TypeError('Failed to fetch');
+    },
+  });
+  // Not a timeout: no network is said as much, and not asked again at once.
+  await assert.rejects(
+    offline.getPhoto('1'),
+    /could not be reached — check the network/,
+  );
+  assert.equal(asked, 1);
+  const garbled = createKartaViewSource({
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      json: async () => {
+        throw new SyntaxError('Unexpected token <');
+      },
+    }),
+  });
+  await assert.rejects(
+    garbled.getTile({ x: 0, y: 0, z: 14 }),
+    /could not be read/,
+  );
+  const torn = createKartaViewSource({
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      body: streamed('{"lines": [', 4),
+    }),
+  });
+  await assert.rejects(
+    torn.getTile({ x: 0, y: 0, z: 14 }),
+    /could not be read/,
+  );
+});
+
+test('an abort stops a queued lookup without fetching, and wins over a retry wait', async () => {
+  let calls = 0;
+  let release;
+  const gate = new Promise((resolve) => (release = resolve));
+  const source = createKartaViewSource({
+    retryBaseMs: 10_000,
+    fetchImpl: async (url) => {
+      calls++;
+      if (url.includes('/slow')) await gate;
+      return status(429);
+    },
+  });
+  // Two slow lookups fill the queue; the third waits for a slot.
+  const first = new AbortController();
+  const slow = [
+    source.getPhoto('slow', { signal: first.signal }),
+    source.getPhoto('slow', { signal: first.signal }),
+  ];
+  const controller = new AbortController();
+  const queued = source.getPhoto('queued', { signal: controller.signal });
+  controller.abort(new Error('overtaken'));
+  await assert.rejects(queued, /overtaken/);
+  assert.equal(calls, 2, 'the queued lookup never fetched');
+  release();
+  // Each slow one is now waiting 10 s to retry; nothing else is asked.
+  const retrying = new AbortController();
+  const waiting = source.getPhoto('slow', { signal: retrying.signal });
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  retrying.abort(new Error('closed'));
+  await assert.rejects(waiting, /closed/);
+  // The two first lookups are still waiting out their backoff: drop them.
+  first.abort(new Error('done'));
+  for (const promise of slow) await assert.rejects(promise, /done/);
+});
+
+test('the limiter runs tasks in order and keeps going after a failure', async () => {
+  const limiter = createLimiter(1);
+  const order = [];
+  const failing = limiter.run(async () => {
+    order.push('a');
+    throw new Error('a failed');
+  });
+  const second = limiter.run(async () => {
+    order.push('b');
+    return 'b';
+  });
+  await assert.rejects(failing, /a failed/);
+  assert.equal(await second, 'b');
+  assert.deepEqual(order, ['a', 'b']);
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.equal(limiter.pending, 0);
+});
+
+test('tiles, lookups and sequence pages queue separately, so a lookup never waits behind them', async () => {
+  const running = { tile: 0, photo: 0, page: 0 };
+  const peak = { tile: 0, photo: 0, page: 0 };
+  const release = [];
+  const kind = (url) =>
+    url.includes('/tiles/')
+      ? 'tile'
+      : url.includes('/photos')
+        ? 'page'
+        : 'photo';
+  const source = createKartaViewSource({
+    fetchImpl: async (url) => {
+      const k = kind(url);
+      running[k]++;
+      peak[k] = Math.max(peak[k], running[k]);
+      if (k !== 'photo') await new Promise((resolve) => release.push(resolve));
+      running[k]--;
+      return k === 'tile' ? ok({ lines: [] }) : ok(photoPayload([]));
+    },
+  });
+  const tiles = Array.from({ length: 9 }, (_, i) =>
+    source.getTile({ x: i, y: 0, z: 14 }),
+  );
+  const pages = [1, 2].map((page) =>
+    source.getSequencePhotos('1', { page, itemsPerPage: 500 }),
+  );
+  // Every slow tile and page is in flight or queued; a lookup still answers.
+  assert.deepEqual(await source.nearestPhotos({ lat: 1, lon: 1 }), []);
+  assert.equal(peak.tile, TILE_CONCURRENCY);
+  assert.equal(peak.page, 1);
+  while (release.length) {
+    release.shift()();
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  await Promise.all([...tiles, ...pages]);
+  assert.equal(peak.tile, TILE_CONCURRENCY);
+  assert.equal(peak.page, 1);
+});
+
+test('a lookup that times out is asked once more, then reported as no answer in time', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const outcome = await onMockClock(t, () =>
+    createKartaViewSource({
+      fetchImpl: (url, { signal }) => {
+        calls++;
+        return new Promise((resolve, reject) =>
+          signal.addEventListener('abort', () => reject(signal.reason)),
+        );
+      },
+    }).getPhoto('1'),
+  );
+  assert.match(
+    String(outcome?.error?.message),
+    /did not answer in time — try again/,
+  );
+  assert.equal(outcome.error.timedOut, true);
+  assert.equal(calls, 2);
+});
+
+test('an image probe reads only the status: an archived photo (409) is not showable', async () => {
+  const seen = [];
+  const source = createKartaViewSource({
+    fetchImpl: async (url, { signal }) => {
+      seen.push(signal);
+      return {
+        ok: !url.includes('archived'),
+        status: url.includes('archived') ? 409 : 200,
+      };
+    },
+  });
+  assert.equal(
+    await source.probeImage('https://storage13.openstreetcam.org/ok.jpg'),
+    true,
+  );
+  assert.equal(
+    await source.probeImage('https://storage13.openstreetcam.org/archived.jpg'),
+    false,
+  );
+  assert.equal(await source.probeImage(null), false);
+  assert.ok(
+    seen.every((signal) => signal.aborted),
+    'the body is dropped',
+  );
+  const offline = createKartaViewSource({
+    fetchImpl: async () => {
+      throw new TypeError('Failed to fetch');
+    },
+  });
+  // No answer is not an answer: the caller may try again later.
+  assert.equal(
+    await offline.probeImage('https://x.openstreetcam.org/a.jpg'),
+    null,
+  );
+  const busy = createKartaViewSource({
+    fetchImpl: async () => ({ ok: false, status: 502 }),
+  });
+  assert.equal(
+    await busy.probeImage('https://x.openstreetcam.org/a.jpg'),
+    null,
+  );
+});
+
+test('a cold tile that times out is asked once more; an unreachable one is not', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const outcome = await onMockClock(t, () =>
+    createKartaViewSource({
+      fetchImpl: (url, { signal }) => {
+        calls++;
+        if (calls === 1)
+          return new Promise((resolve, reject) =>
+            signal.addEventListener('abort', () => reject(signal.reason)),
+          );
+        return Promise.resolve(ok({ lines: [] }));
+      },
+    }).getTile({ x: 1, y: 2, z: 13 }),
+  );
+  assert.deepEqual(outcome.value, { lines: [] });
+  assert.equal(calls, 2);
+  let asked = 0;
+  const offline = createKartaViewSource({
+    fetchImpl: async () => {
+      asked++;
+      throw new TypeError('Failed to fetch');
+    },
+  });
+  await assert.rejects(
+    offline.getTile({ x: 1, y: 2, z: 13 }),
+    /could not be reached/,
+  );
+  assert.equal(asked, 1);
+});
+
+test('an absurdly large answer is refused before it is parsed', async () => {
+  let parsed = false;
+  const source = createKartaViewSource({
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map([['content-length', String(64 * 1024 * 1024)]]),
+      json: async () => {
+        parsed = true;
+        return { lines: [] };
+      },
+    }),
+  });
+  await assert.rejects(source.getTile({ x: 1, y: 2, z: 13 }), /too much data/);
+  assert.equal(parsed, false);
+});
+
+test('sequence pages run one at a time, the newest first', async () => {
+  const order = [];
+  let release;
+  const gate = new Promise((resolve) => (release = resolve));
+  const source = createKartaViewSource({
+    fetchImpl: async (url) => {
+      const page = new URL(url).searchParams.get('page');
+      order.push(page);
+      if (page === '1') await gate;
+      return ok(photoPayload([]));
+    },
+  });
+  const pages = ['1', '2', '3'].map((page) =>
+    source.getSequencePhotos('9', { page, itemsPerPage: 250 }),
+  );
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  release();
+  await Promise.all(pages);
+  assert.deepEqual(order, ['1', '3', '2']);
+});
+
+/** Every pending promise callback, without moving the mocked clock. */
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+/**
+ * Run `call` on the mocked clock in 100 ms steps until it settles (60 s at
+ * most). `stamp()` reads the clock, for a fetch to record when it was asked.
+ */
+async function onMockClock(t, call, { until = 60_000 } = {}) {
+  let now = 0;
+  const stamp = () => now;
+  let outcome = null;
+  const promise = call(stamp);
+  promise.then(
+    (value) => (outcome = { value, at: now }),
+    (error) => (outcome = { error, at: now }),
+  );
+  while (!outcome && now < until) {
+    await flush();
+    if (outcome) break;
+    t.mock.timers.tick(100);
+    now += 100;
+  }
+  await flush();
+  return outcome;
+}
+
+test('429 waits double from 0.8 s, wait out a longer Retry-After up to 10 s, and 2 s without one', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  async function waits(retryAfter) {
+    const asked = [];
+    const headers = new Map(
+      retryAfter === undefined ? [] : [['retry-after', retryAfter]],
+    );
+    const outcome = await onMockClock(t, (stamp) =>
+      createKartaViewSource({
+        fetchImpl: async () => {
+          asked.push(stamp());
+          return asked.length <= PHOTO_API_RETRIES
+            ? status(429, headers)
+            : ok(photoPayload({ id: '1' }));
+        },
+      }).getPhoto('1'),
+    );
+    assert.deepEqual(outcome?.value, { id: '1' }, `answered (${retryAfter})`);
+    return asked.slice(1).map((at, i) => at - asked[i]);
+  }
+  assert.deepEqual(await waits('0'), [800, 1600, 3200], 'doubling backoff');
+  assert.deepEqual(await waits('5'), [5000, 5000, 5000], 'Retry-After wins');
+  assert.deepEqual(await waits('30'), [10_000, 10_000, 10_000], 'capped');
+  assert.deepEqual(await waits(undefined), [2000, 2000, 3200], 'assumed 2 s');
+});
+
+test('a lookup that hangs is given up after a short first try, then the full timeout, then reported', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const asked = [];
+  const outcome = await onMockClock(t, (stamp) =>
+    createKartaViewSource({
+      fetchImpl: (url, { signal }) => {
+        asked.push(stamp());
+        return new Promise((resolve, reject) =>
+          signal.addEventListener('abort', () => reject(signal.reason)),
+        );
+      },
+    }).getPhoto('1'),
+  );
+  assert.deepEqual(asked, [0, PHOTO_API_FIRST_TIMEOUT_MS]);
+  assert.match(String(outcome?.error?.message), /did not answer in time/);
+  assert.equal(outcome.at, PHOTO_API_FIRST_TIMEOUT_MS + PHOTO_API_TIMEOUT_MS);
+});
+
+test('the nearest lookup asks for the few photos around the point at the search zoom', async () => {
+  const urls = [];
+  const source = createKartaViewSource({
+    fetchImpl: async (url) => {
+      urls.push(new URL(url));
+      return ok(photoPayload([]));
+    },
+  });
+  await source.nearestPhotos({ lat: 42.33, lon: -83.04 });
+  assert.equal(urls[0].pathname, '/2.0/photo/');
+  assert.deepEqual(Object.fromEntries(urls[0].searchParams), {
+    lat: '42.3300000',
+    lng: '-83.0400000',
+    zoomLevel: String(NEAREST_SEARCH_ZOOM),
+    itemsPerPage: String(NEAREST_LIMIT),
+  });
+  assert.equal(NEAREST_SEARCH_ZOOM, 18);
+  assert.equal(NEAREST_LIMIT, 10);
+});
+
+test('a chunked answer with no length is cut off once it grows past the cap', async () => {
+  let reads = 0;
+  let cancelled = false;
+  const chunk = new Uint8Array(6 * 1024 * 1024);
+  const source = createKartaViewSource({
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      body: {
+        getReader: () => ({
+          read: async () =>
+            ++reads > 10 ? { done: true } : { done: false, value: chunk },
+          cancel: async () => {
+            cancelled = true;
+          },
+        }),
+      },
+    }),
+  });
+  await assert.rejects(source.getTile({ x: 1, y: 2, z: 13 }), /too much data/);
+  assert.equal(reads, 3, 'stopped at the third 6 MB chunk');
+  assert.equal(cancelled, true);
+  const small = createKartaViewSource({
+    fetchImpl: async () => {
+      const bytes = new TextEncoder().encode('{"lines":[]}');
+      let given = false;
+      return {
+        ok: true,
+        status: 200,
+        headers: new Map(),
+        body: {
+          getReader: () => ({
+            read: async () =>
+              given
+                ? { done: true }
+                : ((given = true), { done: false, value: bytes }),
+            cancel: async () => {},
+          }),
+        },
+      };
+    },
+  });
+  assert.deepEqual(await small.getTile({ x: 1, y: 2, z: 13 }), { lines: [] });
+});
+
+test('a chunked answer split mid-character is reassembled in order', async () => {
+  const payload = {
+    lines: [
+      {
+        track: [{ lat: '1', lng: '2' }],
+        name: 'Strada Memorandumului — Cluj-Napoca 😀',
+      },
+    ],
+    note: 'ăîşţ'.repeat(200),
+  };
+  const source = createKartaViewSource({
+    fetchImpl: async () => ({
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      // 3-byte chunks cut multi-byte characters in two.
+      body: streamed(JSON.stringify(payload), 3),
+    }),
+  });
+  assert.deepEqual(await source.getTile({ x: 1, y: 2, z: 13 }), payload);
+});
+
+test('a sequence page gets the full 30 s on its first try, then 30 s once more', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const asked = [];
+  const outcome = await onMockClock(
+    t,
+    (stamp) =>
+      createKartaViewSource({
+        fetchImpl: (url, { signal }) => {
+          asked.push(stamp());
+          return new Promise((resolve, reject) =>
+            signal.addEventListener('abort', () => reject(signal.reason)),
+          );
+        },
+      }).getSequencePhotos('9', { page: 1, itemsPerPage: 250 }),
+    { until: 120_000 },
+  );
+  assert.deepEqual(asked, [0, PAGE_TIMEOUT_MS]);
+  assert.match(String(outcome?.error?.message), /did not answer in time/);
+  assert.equal(outcome.at, 2 * PAGE_TIMEOUT_MS);
+});
+
+test('an answer turned away unread (an error, a 429, a length past the cap) lets its connection go', async () => {
+  /** A response whose body is never read: records its cancel and the abort. */
+  const unread = (answer) => {
+    const seen = { cancelled: false, signal: null };
+    const fetchImpl = async (url, { signal }) => {
+      seen.signal = signal;
+      return {
+        ...answer,
+        body: {
+          locked: false,
+          getReader: () => {
+            throw new Error('not read');
+          },
+          cancel: async () => {
+            seen.cancelled = true;
+          },
+        },
+      };
+    };
+    return { seen, fetchImpl };
+  };
+  const cases = [
+    [{ ok: false, status: 503, headers: new Map() }, /HTTP 503/],
+    [
+      {
+        ok: true,
+        status: 200,
+        headers: new Map([['content-length', String(64 * 1024 * 1024)]]),
+      },
+      /too much data/,
+    ],
+  ];
+  for (const [answer, message] of cases) {
+    const { seen, fetchImpl } = unread(answer);
+    const source = createKartaViewSource({ fetchImpl });
+    await assert.rejects(source.getTile({ x: 1, y: 2, z: 13 }), message);
+    assert.equal(seen.signal.aborted, true, `${message}: request aborted`);
+    assert.equal(seen.cancelled, true, `${message}: body cancelled`);
+  }
+  // A 429 is let go before its retry is asked.
+  const { seen, fetchImpl } = unread({
+    ok: false,
+    status: 429,
+    headers: new Map([['retry-after', '0']]),
+  });
+  const signals = [];
+  const source = createKartaViewSource({
+    fetchImpl: async (url, init) => {
+      signals.push(init.signal);
+      if (signals.length === 1) return fetchImpl(url, init);
+      return ok(photoPayload([]));
+    },
+  });
+  await source.getPhoto('1');
+  assert.equal(signals[0].aborted, true);
+  assert.equal(seen.cancelled, true);
+  assert.equal(signals[1].aborted, false, 'a read answer is left alone');
+});
+
+test('a filtered tile comes as PNG bytes; KartaView still drawing it (504) is asked again, then given up', async () => {
+  const png = new Uint8Array([137, 80, 78, 71, 1, 2, 3]);
+  const bytesOf = () => ({
+    ok: true,
+    status: 200,
+    headers: new Map(),
+    body: {
+      getReader: () => {
+        let given = false;
+        return {
+          read: async () =>
+            given
+              ? { done: true }
+              : ((given = true), { done: false, value: png }),
+          cancel: async () => {},
+        };
+      },
+    },
+  });
+  const urls = [];
+  let answers = [status(504), status(503), bytesOf()];
+  const source = createKartaViewSource({
+    maskRetryMs: 0,
+    fetchImpl: async (url) => {
+      urls.push(url);
+      return answers.shift();
+    },
+  });
+  const tile = { x: 13054, y: 8474, z: 14 };
+  assert.deepEqual(await source.getTileMask(tile, 'fieldOfView=360'), png);
+  assert.deepEqual(urls, [
+    'https://api.kartaview.org/2.0/sequence/tiles/13054/8474/14.png?fieldOfView=360',
+    'https://api.kartaview.org/2.0/sequence/tiles/13054/8474/14.png?fieldOfView=360',
+    'https://api.kartaview.org/2.0/sequence/tiles/13054/8474/14.png?fieldOfView=360',
+  ]);
+  // Still drawing after every try: given up, saying so.
+  urls.length = 0;
+  answers = Array.from({ length: 10 }, () => status(504));
+  await assert.rejects(source.getTileMask(tile, 'fieldOfView=360'), {
+    message: MASK_SLOW_MESSAGE,
+    timedOut: true,
+  });
+  assert.equal(urls.length, MASK_ATTEMPTS);
+  // A refusal is not asked again.
+  urls.length = 0;
+  answers = [status(400)];
+  await assert.rejects(source.getTileMask(tile, 'fieldOfView=360'), /HTTP 400/);
+  assert.equal(urls.length, 1);
+});
+
+test('a filtered nearest search asks KartaView for the projection and upload date', async () => {
+  const urls = [];
+  const source = createKartaViewSource({
+    fetchImpl: async (url) => {
+      urls.push(new URL(url));
+      return ok(photoPayload([]));
+    },
+  });
+  await source.nearestPhotos({
+    lat: 42.3314,
+    lon: -83.0458,
+    filter: { pano: 'pano', sinceMs: Date.UTC(2026, 0, 2, 12) },
+  });
+  await source.nearestPhotos({ lat: 42.3314, lon: -83.0458 });
+  assert.equal(urls[0].searchParams.get('projection'), 'SPHERE');
+  assert.equal(urls[0].searchParams.get('startDate'), '2026-01-02');
+  assert.equal(urls[1].searchParams.has('projection'), false);
+  assert.equal(urls[1].searchParams.has('startDate'), false);
+});

src/layers/streetLevel/providers/kartaview/viewer.js

@@ -0,0 +1,90 @@
+import {
+  createPhotoViewer,
+  loadImage as loadAnyImage,
+} from '../../photoViewer.js';
+import {
+  FLAT_FULL_SIZE,
+  FLAT_VIEW_SIZE,
+  IMAGE_TIMEOUT_MS,
+  KARTAVIEW_NAME,
+  KARTAVIEW_PROVIDER_ID,
+  PANO_PREVIEW_SIZE,
+  cameraBearing,
+  kartaViewPhotoUrl,
+  resizedImageUrl,
+} from './policy.js';
+
+export { panoSizeFor } from '../../photoViewer.js';
+
+const LOAD_FAILED = 'The KartaView photo could not be loaded';
+
+/** Load a KartaView photo (see photoViewer.js `loadImage`). */
+export function loadImage(url, options = {}) {
+  return loadAnyImage(url, {
+    timeoutMs: IMAGE_TIMEOUT_MS,
+    failure: LOAD_FAILED,
+    ...options,
+  });
+}
+
+/**
+ * Where KartaView photos come from. Only KartaView's image proxy can shrink
+ * a 13,000 px panorama, so panoramas and flat upgrades go through it.
+ * @type {import('../../photoViewer.js').PhotoSources}
+ */
+const KARTAVIEW_SOURCES = Object.freeze({
+  hasPano: (photo) => Boolean(photo.isPano && photo.urls.pano),
+  panoFirst: (photo) => ({
+    url: resizedImageUrl(photo.urls.pano, PANO_PREVIEW_SIZE),
+    width: 0,
+    resize: PANO_PREVIEW_SIZE,
+  }),
+  panoSharp: (photo, size) => ({
+    url: resizedImageUrl(photo.urls.pano, size),
+  }),
+  // The proxy's 1,280 px version is a few hundred kB; KartaView's own
+  // "large thumbnail" can be 1.7 MB. Either serves when the other fails.
+  // A 360° photo's front view is only on storage.
+  flatFirst: (photo) => [
+    photo.isPano ? null : resizedImageUrl(photo.urls.full, FLAT_VIEW_SIZE),
+    photo.urls.view,
+  ],
+  // A docked viewer shows the 1,280 px version in full: the 2,560 px one
+  // (~0.6 MB a photo) waits until the viewer is bigger than that.
+  flatSharp: (photo, pixels) =>
+    pixels > FLAT_VIEW_SIZE[0]
+      ? resizedImageUrl(photo.urls.full, FLAT_FULL_SIZE)
+      : null,
+  // The camera's direction, which the drive's track may refine.
+  bearingOf: (photo) => cameraBearing(photo),
+  describe: (photo) => ({
+    // KartaView's only place name is the sequence's, where the drive began.
+    title: null,
+    creator: null,
+    externalUrl: kartaViewPhotoUrl(photo),
+  }),
+});
+
+/**
+ * Viewer adapter for KartaView photos: a flat photo in an <img>, a 360°
+ * photo on a WebGL panorama, and ‹ › along the sequence (photoViewer.js).
+ *
+ * @param {object} options
+ * @param {(photoId: string) => Promise<object>} options.getPhoto   A normalized photo (policy.js normalizePhoto).
+ * @param {(photo: object, delta: -1|1) => Promise<string|null>} options.step
+ * @param {(imageId: string) => void} options.onStep
+ * @param {(photo: object) => void} [options.onShown]
+ * @param {object} [options.render]
+ * @param {(url: string, options?: object) => Promise<HTMLImageElement>} [options.load]
+ * @param {(canvas: HTMLCanvasElement) => object} [options.createRenderer]
+ * @returns {import('../../registry.js').ViewerAdapter}
+ */
+export function createKartaViewViewer({ load = loadImage, ...options }) {
+  return createPhotoViewer({
+    providerId: KARTAVIEW_PROVIDER_ID,
+    name: KARTAVIEW_NAME,
+    sources: KARTAVIEW_SOURCES,
+    load,
+    ...options,
+  });
+}

src/layers/streetLevel/providers/kartaview/viewer.test.mjs

@@ -0,0 +1,989 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createKartaViewViewer, loadImage, panoSizeFor } from './viewer.js';
+import { fakeHost, until } from '../../../../testSupport/kartaViewFakes.mjs';
+
+const PHOTOS = {
+  flat1: {
+    id: 'flat1',
+    sequenceId: 's1',
+    sequenceIndex: 1,
+    lon: -83.04,
+    lat: 42.33,
+    heading: 90,
+    isPano: false,
+    capturedAt: Date.UTC(2016, 7, 23),
+    urls: {
+      view: 'https://storage2.openstreetcam.org/lth/a.jpg',
+      full: 'https://storage2.openstreetcam.org/proc/a.jpg',
+      pano: null,
+    },
+  },
+  flat2: {
+    id: 'flat2',
+    sequenceId: 's1',
+    sequenceIndex: 2,
+    lon: -83.0401,
+    lat: 42.33,
+    heading: 92,
+    isPano: false,
+    capturedAt: Date.UTC(2016, 7, 23),
+    urls: {
+      view: 'https://storage2.openstreetcam.org/lth/b.jpg',
+      full: 'https://storage2.openstreetcam.org/proc/b.jpg',
+      pano: null,
+    },
+  },
+  pano1: {
+    id: 'pano1',
+    sequenceId: 's2',
+    sequenceIndex: 7,
+    lon: 106.84,
+    lat: -6.19,
+    heading: 150,
+    isPano: true,
+    capturedAt: Date.UTC(2022, 2, 21),
+    urls: {
+      view: 'https://storage13.openstreetcam.org/lth/p.jpg',
+      full: 'https://storage13.openstreetcam.org/wrapped_proc/p.jpg',
+      pano: 'https://storage13.openstreetcam.org/wrapped_proc/p.jpg',
+    },
+  },
+  pano2: {
+    id: 'pano2',
+    sequenceId: 's2',
+    sequenceIndex: 8,
+    lon: 106.8401,
+    lat: -6.19,
+    heading: 152,
+    isPano: true,
+    capturedAt: Date.UTC(2022, 2, 21),
+    urls: {
+      view: 'https://storage13.openstreetcam.org/lth/q.jpg',
+      full: 'https://storage13.openstreetcam.org/wrapped_proc/q.jpg',
+      pano: 'https://storage13.openstreetcam.org/wrapped_proc/q.jpg',
+    },
+  },
+};
+
+function fakeRenderer(canvas) {
+  const view = { yaw: 0, pitch: 0, fov: 80 };
+  return {
+    canvas,
+    images: [],
+    hiddenAtSetImage: [],
+    setImage(image) {
+      this.images.push(image.src);
+      // A hidden canvas measures 0×0: sizing it then gives a 1×1 buffer.
+      this.hiddenAtSetImage.push(canvas?.hidden);
+    },
+    setView(next) {
+      Object.assign(view, next);
+    },
+    getView: () => ({ ...view }),
+    resize() {},
+    clear() {},
+    destroy() {
+      this.destroyed = true;
+    },
+  };
+}
+
+PHOTOS.pano2 = {
+  ...PHOTOS.pano1,
+  id: 'pano2',
+  sequenceIndex: 8,
+  urls: {
+    view: 'https://storage13.openstreetcam.org/lth/p2.jpg',
+    full: 'https://storage13.openstreetcam.org/wrapped_proc/p2.jpg',
+    pano: 'https://storage13.openstreetcam.org/wrapped_proc/p2.jpg',
+  },
+};
+
+function setup({
+  failLoads = [],
+  rendererThrows = false,
+  steps = {},
+  failSteps = false,
+  hold = () => false,
+} = {}) {
+  const loads = [];
+  const held = [];
+  const closed = [];
+  const renderers = [];
+  const stepped = [];
+  const asked = [];
+  const attempts = { renderer: 0 };
+  const viewer = createKartaViewViewer({
+    getPhoto: async (id) => {
+      if (!PHOTOS[id]) throw new Error('no such photo');
+      return PHOTOS[id];
+    },
+    step: async (photo, delta) => {
+      asked.push(`${photo.id}:${delta}`);
+      if (failSteps) throw new Error('KartaView did not answer in time');
+      return steps[`${photo.id}:${delta}`] ?? null;
+    },
+    // The core opens what ‹ › chose; here the adapter is opened directly.
+    onStep: (id) => {
+      stepped.push(id);
+      viewer.open(id).catch(() => {});
+    },
+    load: async (url, options) => {
+      loads.push({ url, crossOrigin: options?.crossOrigin });
+      if (failLoads.some((part) => url.includes(part)))
+        throw new Error('The KartaView photo could not be loaded');
+      // A decoded bitmap: close() frees it.
+      const image = { src: url, close: () => closed.push(url) };
+      if (!hold(url)) return image;
+      return new Promise((resolve) => held.push(() => resolve(image)));
+    },
+    createRenderer: (canvas) => {
+      attempts.renderer++;
+      if (rendererThrows) throw new Error('WebGL is unavailable');
+      const renderer = fakeRenderer(canvas);
+      renderers.push(renderer);
+      return renderer;
+    },
+  });
+  const poses = [];
+  viewer.onPose((pose) => poses.push(pose));
+  const host = fakeHost();
+  return {
+    viewer,
+    poses,
+    host,
+    loads,
+    renderers,
+    stepped,
+    asked,
+    attempts,
+    held,
+    closed,
+  };
+}
+
+const parts = (host) => {
+  const root = host.children[0];
+  const [picture, canvas, prev, next] = root.children;
+  return { root, picture, canvas, prev, next };
+};
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+test('a flat photo shows its 1280 px version, then the sharp one, with a pose facing its heading', async () => {
+  const { viewer, poses, host, loads } = setup({
+    steps: { 'flat1:1': 'flat2', 'flat1:-1': 'flat0' },
+  });
+  await viewer.mount(host);
+  const { picture, canvas, prev, next } = parts(host);
+  picture.clientWidth = 1600; // expanded: the sharp version is wanted
+  assert.equal(prev.disabled, true, 'nothing to step through yet');
+  await viewer.open('flat1');
+  assert.equal(picture.hidden, false);
+  assert.equal(canvas.hidden, true);
+  assert.equal(prev.disabled, false);
+  assert.equal(next.disabled, false);
+  const pose = poses.at(-1);
+  assert.deepEqual(
+    {
+      providerId: pose.providerId,
+      imageId: pose.imageId,
+      position: pose.position,
+      bearing: pose.bearing,
+      tilt: pose.tilt,
+      isPano: pose.isPano,
+      sequenceId: pose.sequenceId,
+      capturedAt: pose.capturedAt,
+      title: pose.title,
+    },
+    {
+      providerId: 'kartaview',
+      imageId: 'flat1',
+      position: { lon: -83.04, lat: 42.33 },
+      bearing: 90,
+      tilt: 0,
+      isPano: false,
+      sequenceId: 's1',
+      capturedAt: Date.UTC(2016, 7, 23),
+      title: null,
+    },
+  );
+  assert.match(pose.externalUrl, /^https:\/\/cdn\.kartaview\.org\/pr:sharp\//);
+  // The proxy's 1,280 px version first: KartaView's own can be 1.7 MB.
+  assert.match(
+    loads[0].url,
+    /^https:\/\/cdn\.kartaview\.org\/.*rs:fit:1280:1280/,
+  );
+  assert.equal(loads[0].crossOrigin, false, 'an <img> needs no CORS');
+  await settle();
+  assert.match(
+    loads[1].url,
+    /^https:\/\/cdn\.kartaview\.org\/.*rs:fit:2560:2560/,
+  );
+  assert.equal(picture.src, loads[1].url, 'upgraded to the sharp version');
+  assert.equal(viewer.supportsRenderModes(), true);
+  viewer.setRenderMode('fill');
+  assert.equal(picture.style.objectFit, 'cover');
+});
+
+test('a failing image proxy falls back to the photo on KartaView storage', async () => {
+  const { viewer, host, loads } = setup({ failLoads: ['cdn.kartaview.org'] });
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  assert.equal(loads[1].url, PHOTOS.flat1.urls.view);
+  assert.equal(parts(host).picture.hidden, false);
+  assert.equal(parts(host).picture.src, PHOTOS.flat1.urls.view);
+});
+
+test('a 360° photo shows on the panorama, preview first; dragging turns the bearing', async () => {
+  const { viewer, poses, host, loads, renderers } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const { picture, canvas } = parts(host);
+  assert.equal(canvas.hidden, false);
+  assert.equal(picture.hidden, true);
+  assert.match(loads[0].url, /rs:fit:1024:512/);
+  assert.equal(loads[0].crossOrigin, true, 'WebGL textures need CORS');
+  assert.equal(poses.at(-1).isPano, true);
+  assert.equal(poses.at(-1).bearing, 150);
+  assert.equal(viewer.supportsRenderModes(), false, 'no frame to fit');
+  await settle();
+  // Docked (400 px at 80°), 2,048 px is all it can show.
+  assert.match(renderers[0].images.at(-1), /rs:fit:2048:1024/);
+  // Drag left by a quarter of the width: the view turns right.
+  const frames = [];
+  globalThis.requestAnimationFrame = (callback) => {
+    frames.push(callback);
+    return frames.length;
+  };
+  try {
+    canvas.fire('pointerdown', {
+      button: 0,
+      pointerId: 1,
+      clientX: 200,
+      clientY: 100,
+    });
+    canvas.fire('pointermove', { pointerId: 1, clientX: 100, clientY: 100 });
+    canvas.fire('pointerup', { pointerId: 1 });
+    frames.forEach((callback) => callback());
+  } finally {
+    delete globalThis.requestAnimationFrame;
+  }
+  const turned = poses.at(-1).bearing;
+  assert.ok(turned > 150 && turned < 360, `bearing ${turned} turned right`);
+});
+
+test('without WebGL, or when the panorama fails, a 360° photo shows its front view', async () => {
+  const noGl = setup({ rendererThrows: true });
+  await noGl.viewer.mount(noGl.host);
+  await noGl.viewer.open('pano1');
+  assert.equal(parts(noGl.host).picture.hidden, false);
+  assert.equal(noGl.loads[0].url, PHOTOS.pano1.urls.view);
+  assert.equal(noGl.poses.at(-1).isPano, false);
+  await settle();
+  assert.equal(
+    noGl.loads.length,
+    1,
+    'the equirectangular image never replaces it',
+  );
+
+  const broken = setup({ failLoads: ['cdn.kartaview.org'] });
+  await broken.viewer.mount(broken.host);
+  await broken.viewer.open('pano1');
+  assert.equal(parts(broken.host).picture.hidden, false);
+  assert.equal(broken.poses.at(-1).imageId, 'pano1');
+});
+
+test('‹ › and the arrow keys step along the sequence; ends disable at once', async () => {
+  const { viewer, poses, host, stepped, asked } = setup({
+    steps: { 'flat1:1': 'flat2', 'flat2:-1': 'flat1' },
+  });
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  const { root, prev, next } = parts(host);
+  assert.ok(
+    await until(() => prev.disabled),
+    'flat1 is the first photo: known up front',
+  );
+  assert.equal(next.disabled, false);
+  next.fire('click');
+  assert.ok(await until(() => poses.at(-1).imageId === 'flat2'));
+  assert.deepEqual(stepped, ['flat2'], 'the core is asked to open it');
+  assert.ok(await until(() => next.disabled), 'flat2 is the last photo');
+  assert.equal(prev.disabled, false);
+  // A modified arrow, then a plain → (at the end: it only asks). Presses run
+  // in turn, so once → has asked, a stepping ⌘← would have asked first.
+  const before = asked.length;
+  root.fire('keydown', { key: 'ArrowLeft', metaKey: true });
+  root.fire('keydown', { key: 'ArrowRight' });
+  assert.ok(await until(() => asked.length > before));
+  await settle();
+  assert.deepEqual(
+    asked.slice(before),
+    ['flat2:1'],
+    'modified arrows are not ours',
+  );
+  assert.equal(poses.at(-1).imageId, 'flat2');
+  root.fire('keydown', { key: 'ArrowLeft' });
+  assert.ok(await until(() => poses.at(-1).imageId === 'flat1'));
+});
+
+test('quick presses each step on from the photo the last one chose', async () => {
+  const chain = { 'flat1:1': 'flat2', 'flat2:1': 'pano1' };
+  const { viewer, host, stepped } = setup({
+    steps: chain,
+    rendererThrows: true,
+  });
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  const { next } = parts(host);
+  next.fire('click');
+  next.fire('click');
+  assert.ok(await until(() => stepped.length === 2), `stepped ${stepped}`);
+  assert.deepEqual(stepped, ['flat2', 'pano1']);
+});
+
+test('a newer open wins; close hides the photo; unmount tears down the panorama', async () => {
+  const { viewer, poses, host, renderers } = setup();
+  await viewer.mount(host);
+  const first = viewer.open('pano1');
+  const second = viewer.open('flat1');
+  await Promise.all([first, second]);
+  assert.deepEqual(
+    poses.map((pose) => pose.imageId),
+    ['flat1'],
+    'the overtaken panorama never posed',
+  );
+  assert.equal(renderers.length, 0, 'nor built a WebGL context');
+  await viewer.open('pano1');
+  viewer.close();
+  const { picture, canvas, root } = parts(host);
+  assert.equal(canvas.hidden, true);
+  assert.equal(picture.hidden, true);
+  assert.equal(root.dataset.kind, '');
+  await assert.rejects(viewer.open('nope'), /no such photo/);
+  viewer.unmount();
+  assert.equal(host.children.length, 0);
+  assert.equal(renderers[0].destroyed, true);
+  await assert.rejects(viewer.open('flat1'), /not mounted/);
+});
+
+test('a panorama is put on screen before its image is sized into the canvas', async () => {
+  const { viewer, host, renderers } = setup();
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  await viewer.open('pano1');
+  await settle();
+  assert.deepEqual(renderers[0].hiddenAtSetImage, [false, false]);
+});
+
+test('a step that gets no answer is not the end of the sequence', async () => {
+  const { viewer, host, poses, asked } = setup({ failSteps: true });
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  const { next } = parts(host);
+  next.disabled = false;
+  // The ends check asked once already; the press asks again and fails.
+  const asks = () => asked.filter((ask) => ask === 'flat1:1').length;
+  next.fire('click');
+  assert.ok(await until(() => asks() === 2), 'the press asked');
+  await settle();
+  assert.equal(next.disabled, false, 'still enabled: try again');
+  assert.equal(poses.at(-1).imageId, 'flat1');
+});
+
+test('the keyboard looks around a panorama: Shift+arrows turn, ↑ ↓ tilt, + − zoom', async (t) => {
+  globalThis.requestAnimationFrame = (callback) => setTimeout(callback, 0);
+  t.after(() => delete globalThis.requestAnimationFrame);
+  const { viewer, host, renderers, stepped, asked } = setup({
+    steps: { 'pano1:1': 'flat1' },
+  });
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const { root } = parts(host);
+  const view = () => renderers[0].getView();
+  const before = asked.length;
+  root.fire('keydown', { key: 'ArrowRight', shiftKey: true });
+  assert.ok(view().yaw > 0, 'turned right');
+  root.fire('keydown', { key: 'ArrowUp' });
+  assert.ok(view().pitch > 0, 'looked up');
+  const fov = view().fov;
+  root.fire('keydown', { key: '+' });
+  assert.ok(view().fov < fov, 'zoomed in');
+  root.fire('keydown', { key: '-' });
+  root.fire('keydown', { key: '-' });
+  assert.ok(view().fov > fov, 'zoomed out');
+  root.fire('keydown', { key: 'ArrowRight' });
+  assert.ok(await until(() => stepped.length === 1));
+  assert.deepEqual(stepped, ['flat1'], 'a plain arrow still steps');
+  // Only that press asked, then flat1's ends check: a Shift+→ that stepped
+  // would have sent the plain → on from flat1.
+  assert.ok(await until(() => asked.slice(before).length >= 3));
+  await settle();
+  assert.deepEqual(
+    asked.slice(before).sort(),
+    ['flat1:-1', 'flat1:1', 'pano1:1'],
+    'none of the others stepped',
+  );
+});
+
+test('two fingers pinch the panorama’s zoom', async () => {
+  const { viewer, host, renderers } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const { canvas } = parts(host);
+  const before = renderers[0].getView().fov;
+  canvas.fire('pointerdown', {
+    pointerId: 1,
+    pointerType: 'touch',
+    clientX: 100,
+    clientY: 100,
+  });
+  canvas.fire('pointerdown', {
+    pointerId: 2,
+    pointerType: 'touch',
+    clientX: 140,
+    clientY: 100,
+  });
+  canvas.fire('pointermove', {
+    pointerId: 2,
+    pointerType: 'touch',
+    clientX: 180,
+    clientY: 100,
+  });
+  assert.ok(renderers[0].getView().fov < before, 'spread zooms in');
+  canvas.fire('pointerup', { pointerId: 1 });
+  canvas.fire('pointerup', { pointerId: 2 });
+});
+
+test('a lost WebGL context drops the panorama and shows the photo again on a new one', async () => {
+  const { viewer, host, renderers, poses, stepped } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const lost = parts(host).canvas;
+  lost.fire('webglcontextlost');
+  assert.equal(renderers[0].destroyed, true);
+  // A lost canvas only ever gives back its lost context: a new element.
+  assert.notEqual(parts(host).canvas, lost);
+  assert.deepEqual(stepped, ['pano1'], 'reopened through the core');
+  assert.ok(await until(() => renderers.length === 2), 'a new renderer');
+  assert.equal(renderers[1].canvas, parts(host).canvas);
+  assert.equal(poses.at(-1).imageId, 'pano1');
+  assert.equal(parts(host).canvas.hidden, false);
+});
+
+test('a context lost while a newer photo opens leaves that open alone', async () => {
+  const { viewer, host, stepped } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const opening = viewer.open('flat1');
+  parts(host).canvas.fire('webglcontextlost');
+  await opening;
+  assert.deepEqual(stepped, [], 'no reopen of the old panorama');
+  assert.equal(parts(host).picture.hidden, false);
+});
+
+test('a WebGL failure only lasts until the viewer is mounted again', async () => {
+  let fail = true;
+  const built = [];
+  const viewer = createKartaViewViewer({
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep() {},
+    load: async (url) => ({ src: url }),
+    createRenderer: (canvas) => {
+      if (fail) throw new Error('WebGL is unavailable');
+      const renderer = fakeRenderer(canvas);
+      built.push(renderer);
+      return renderer;
+    },
+  });
+  const host = fakeHost();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  assert.equal(parts(host).picture.hidden, false, 'front view');
+  viewer.unmount();
+  fail = false;
+  const again = fakeHost();
+  await viewer.mount(again);
+  await viewer.open('pano1');
+  assert.equal(built.length, 1);
+  assert.equal(parts(again).canvas.hidden, false);
+});
+
+/** Flat photos a → d of one drive, for the tests that hold loads back. */
+const DRIVE = Object.fromEntries(
+  ['a', 'b', 'c', 'd'].map((id, index) => [
+    id,
+    {
+      id,
+      sequenceId: 'drive',
+      sequenceIndex: index,
+      lon: 0.1 + index * 0.0001,
+      lat: 0.1,
+      heading: 0,
+      isPano: false,
+      capturedAt: 0,
+      urls: {
+        view: `https://storage2.openstreetcam.org/lth/${id}.jpg`,
+        full: `https://storage2.openstreetcam.org/proc/${id}.jpg`,
+        pano: null,
+      },
+    },
+  ]),
+);
+const DRIVE_ORDER = Object.keys(DRIVE);
+
+/** Which drive photo, at which size, an image address shows. */
+function shows(src) {
+  const proxied =
+    /^https:\/\/cdn\.kartaview\.org\/pr:sharp\/rs:fit:(\d+):\d+\/([\w-]+)$/.exec(
+      src || '',
+    );
+  const url = proxied ? Buffer.from(proxied[2], 'base64url').toString() : src;
+  const id = /\/(\w+)\.jpg$/.exec(url || '')?.[1] ?? null;
+  return proxied ? `${id}@${proxied[1]}` : id;
+}
+
+/**
+ * A viewer whose photo loads (and, with `slowSteps`, step answers) wait for
+ * the test. ‹ › open through a stand-in core that, like the real one, awaits
+ * a tick (the viewer mount) before it opens the photo.
+ */
+function heldSetup({ slowSteps = false } = {}) {
+  const loads = [];
+  const asks = [];
+  const stepped = [];
+  const shown = [];
+  const viewer = createKartaViewViewer({
+    getPhoto: async (id) => {
+      if (!DRIVE[id]) throw new Error('no such photo');
+      return DRIVE[id];
+    },
+    step: (photo, delta) => {
+      const answer = DRIVE_ORDER[DRIVE_ORDER.indexOf(photo.id) + delta] ?? null;
+      if (!slowSteps) return Promise.resolve(answer);
+      return new Promise((resolve) =>
+        asks.push({ key: `${photo.id}:${delta}`, resolve }),
+      );
+    },
+    onStep: async (id) => {
+      stepped.push(id);
+      await settle();
+      viewer.open(id).catch(() => {});
+    },
+    onShown: (photo) => shown.push(photo.id),
+    load: (url) =>
+      new Promise((resolve, reject) =>
+        loads.push({
+          url,
+          shows: shows(url),
+          resolve: () => resolve({ src: url }),
+          reject: () =>
+            reject(new Error('The KartaView photo could not be loaded')),
+        }),
+      ),
+    createRenderer: () => {
+      throw new Error('no WebGL in Node');
+    },
+  });
+  const poses = [];
+  viewer.onPose((pose) => poses.push(pose.imageId));
+  const host = fakeHost();
+  /** Let the load showing `what` (e.g. 'a@1280') finish. */
+  const release = async (what) => {
+    assert.ok(
+      await until(() => loads.some((load) => load.shows === what)),
+      `${what} is loading: ${loads.map((load) => load.shows)}`,
+    );
+    const at = loads.findIndex((load) => load.shows === what);
+    loads.splice(at, 1)[0].resolve();
+    await settle();
+  };
+  /** Answer the oldest pending step ask for `key` (e.g. 'a:1'). */
+  const answer = async (key, value) => {
+    assert.ok(await until(() => asks.some((ask) => ask.key === key)));
+    const at = asks.findIndex((ask) => ask.key === key);
+    asks.splice(at, 1)[0].resolve(value);
+    await settle();
+  };
+  return { viewer, host, loads, asks, stepped, shown, poses, release, answer };
+}
+
+test('quick presses while the next photo is still loading each step on from the last one chosen', async () => {
+  const { viewer, host, stepped, release } = heldSetup();
+  await viewer.mount(host);
+  const opening = viewer.open('a');
+  await release('a@1280');
+  await opening;
+  const { next } = parts(host);
+  assert.ok(await until(() => !next.disabled));
+  // b, c and d never load: each press steps on from the photo on its way.
+  next.fire('click');
+  next.fire('click');
+  next.fire('click');
+  assert.ok(await until(() => stepped.length >= 3), `stepped ${stepped}`);
+  await settle();
+  assert.deepEqual(stepped, ['b', 'c', 'd']);
+});
+
+test('a slow sharp version of an older photo never replaces the newer photo', async () => {
+  const { viewer, host, shown, poses, release } = heldSetup();
+  await viewer.mount(host);
+  // An expanded viewer, so the sharp version is wanted.
+  parts(host).picture.clientWidth = 1600;
+  const first = viewer.open('a');
+  await release('a@1280');
+  await first;
+  const second = viewer.open('b');
+  await release('b@1280');
+  await second;
+  const { picture } = parts(host);
+  assert.equal(shows(picture.src), 'b@1280');
+  await release('a@2560'); // a's upgrade, overtaken
+  assert.equal(shows(picture.src), 'b@1280', 'a never comes back');
+  await release('b@2560');
+  assert.equal(shows(picture.src), 'b@2560', 'b’s own upgrade lands');
+  assert.deepEqual(shown, ['a', 'b']);
+  assert.deepEqual(poses, ['a', 'b']);
+});
+
+test('an overtaken flat open never shows, nor tells the provider it did', async () => {
+  const { viewer, host, shown, poses, loads, release } = heldSetup();
+  await viewer.mount(host);
+  const first = viewer.open('a');
+  assert.ok(await until(() => loads.length === 1), 'a is loading');
+  const second = viewer.open('b');
+  await release('b@1280');
+  await second;
+  await release('a@1280');
+  await first;
+  const { picture } = parts(host);
+  assert.equal(shows(picture.src), 'b@1280');
+  assert.deepEqual(poses, ['b']);
+  assert.deepEqual(shown, ['b'], 'onShown only for the photo on screen');
+});
+
+test('a photo still loading when the viewer closes stays closed', async () => {
+  const { viewer, host, shown, poses, loads, release } = heldSetup();
+  await viewer.mount(host);
+  const opening = viewer.open('a');
+  assert.ok(await until(() => loads.length === 1), 'a is loading');
+  viewer.close();
+  await release('a@1280');
+  await opening;
+  const { picture, root } = parts(host);
+  assert.equal(picture.hidden, true);
+  assert.equal(root.dataset.kind, '');
+  assert.deepEqual(poses, []);
+  assert.deepEqual(shown, []);
+});
+
+test('an ends check for an earlier photo does not disable › on the photo now showing', async () => {
+  const { viewer, host, release, answer } = heldSetup({ slowSteps: true });
+  await viewer.mount(host);
+  const first = viewer.open('a');
+  await release('a@1280');
+  await first;
+  const second = viewer.open('c');
+  await release('c@1280');
+  await second;
+  const { prev, next } = parts(host);
+  await answer('c:-1', 'b');
+  await answer('c:1', 'd');
+  // a's check answers last, saying nothing lies before or after it.
+  await answer('a:-1', null);
+  await answer('a:1', null);
+  assert.equal(prev.disabled, false);
+  assert.equal(next.disabled, false, 'c still has a next photo');
+});
+
+test('a press whose answer comes after another photo was opened is dropped', async () => {
+  const { viewer, host, stepped, release, answer, asks } = heldSetup({
+    slowSteps: true,
+  });
+  await viewer.mount(host);
+  const first = viewer.open('a');
+  await release('a@1280');
+  await first;
+  await answer('a:-1', null);
+  await answer('a:1', 'b');
+  const { next } = parts(host);
+  next.disabled = false;
+  next.fire('click');
+  assert.ok(await until(() => asks.some((ask) => ask.key === 'a:1')));
+  // The user picks another photo meanwhile.
+  const other = viewer.open('d');
+  await release('d@1280');
+  await other;
+  await answer('a:1', 'b');
+  await settle();
+  assert.deepEqual(stepped, [], 'the old press does not open b over d');
+});
+
+test('a failed open does not become the photo ‹ › step from', async () => {
+  const { viewer, host, stepped } = setup({ steps: { 'flat1:1': 'flat2' } });
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  await assert.rejects(viewer.open('nope'), /no such photo/);
+  parts(host).next.disabled = false;
+  parts(host).next.fire('click');
+  assert.ok(await until(() => stepped.length === 1));
+  assert.deepEqual(stepped, ['flat2'], 'from the photo still showing');
+});
+
+test('WebGL is tried once per mount, not again for every 360° photo', async () => {
+  const { viewer, host, attempts } = setup({ rendererThrows: true });
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  await viewer.open('pano2');
+  assert.equal(attempts.renderer, 1);
+  assert.equal(parts(host).picture.hidden, false, 'front views instead');
+});
+
+test('a step button that disables under the keyboard hands focus to the viewer', async () => {
+  const { viewer, host } = setup();
+  await viewer.mount(host);
+  const { root, prev, next } = parts(host);
+  let focused = 0;
+  root.focus = () => focused++;
+  next.ownerDocument = { activeElement: next };
+  prev.ownerDocument = { activeElement: root };
+  await viewer.open('flat1');
+  assert.ok(await until(() => next.disabled && prev.disabled));
+  assert.equal(focused, 1, 'only for the focused button');
+});
+
+test('› to another 360° photo keeps the look direction; opening one afresh faces its heading', async (t) => {
+  globalThis.requestAnimationFrame = (callback) => setTimeout(callback, 0);
+  t.after(() => delete globalThis.requestAnimationFrame);
+  const { viewer, host, renderers, poses } = setup({
+    steps: { 'pano1:1': 'pano2' },
+  });
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const { root, next } = parts(host);
+  root.fire('keydown', { key: 'ArrowRight', shiftKey: true });
+  const yaw = renderers[0].getView().yaw;
+  assert.ok(yaw > 0);
+  next.fire('click');
+  assert.ok(await until(() => poses.at(-1).imageId === 'pano2'));
+  assert.equal(renderers[0].getView().yaw, yaw, 'still looking the same way');
+  await viewer.open('pano1');
+  assert.equal(renderers[0].getView().yaw, 0, 'a fresh open faces ahead');
+});
+
+/** A viewer whose loads for `held` URLs wait until `release()`. */
+function heldPanoSetup(held) {
+  const renderers = [];
+  const stepped = [];
+  let release;
+  const gate = new Promise((resolve) => (release = resolve));
+  const viewer = createKartaViewViewer({
+    getPhoto: async (id) => PHOTOS[id],
+    step: async () => null,
+    onStep: (id) => {
+      stepped.push(id);
+      viewer.open(id).catch(() => {});
+    },
+    load: async (url) => {
+      if (held.some((part) => url.includes(part))) await gate;
+      return { src: url };
+    },
+    createRenderer: (canvas) => {
+      const renderer = fakeRenderer(canvas);
+      renderers.push(renderer);
+      return renderer;
+    },
+  });
+  const poses = [];
+  viewer.onPose((pose) => poses.push(pose));
+  return { viewer, renderers, stepped, poses, host: fakeHost(), release };
+}
+
+const pano2Preview = Buffer.from(
+  'https://storage13.openstreetcam.org/wrapped_proc/p2.jpg',
+).toString('base64url');
+
+test('a context lost while a newer panorama loads shows that one on a new canvas, not a black viewer', async () => {
+  const { viewer, renderers, poses, host, release, stepped } = heldPanoSetup([
+    pano2Preview,
+  ]);
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  const opening = viewer.open('pano2');
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  parts(host).canvas.fire('webglcontextlost');
+  release();
+  await opening;
+  assert.equal(
+    poses.at(-1).imageId,
+    'pano2',
+    'the newer panorama is on screen',
+  );
+  assert.equal(poses.at(-1).isPano, true);
+  assert.deepEqual(stepped, [], 'its own open, not a reopen of the old one');
+  assert.equal(renderers.length, 2, 'drawn by a new renderer');
+  assert.equal(renderers[1].canvas, parts(host).canvas);
+  assert.equal(parts(host).canvas.hidden, false);
+});
+
+test('a second context loss, on the new canvas, reopens again; the new canvas still drags', async (t) => {
+  globalThis.requestAnimationFrame = (callback) => setTimeout(callback, 0);
+  t.after(() => delete globalThis.requestAnimationFrame);
+  const { viewer, host, renderers, stepped, poses } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  parts(host).canvas.fire('webglcontextlost');
+  assert.ok(await until(() => renderers.length === 2));
+  parts(host).canvas.fire('webglcontextlost');
+  assert.ok(await until(() => renderers.length === 3), 'reopened twice');
+  assert.deepEqual(stepped, ['pano1', 'pano1']);
+  assert.equal(renderers[2].canvas, parts(host).canvas);
+  const canvas = parts(host).canvas;
+  const before = poses.at(-1).bearing;
+  canvas.fire('pointerdown', {
+    button: 0,
+    pointerId: 7,
+    pointerType: 'mouse',
+    clientX: 200,
+    clientY: 100,
+  });
+  canvas.fire('pointermove', { pointerId: 7, clientX: 100, clientY: 100 });
+  canvas.fire('pointerup', { pointerId: 7 });
+  assert.ok(await until(() => poses.at(-1).bearing !== before), 'dragged');
+});
+
+test('a context loss keeps where the user was looking', async () => {
+  const { viewer, host, renderers } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  renderers[0].setView({ yaw: 70, pitch: 12, fov: 60 });
+  parts(host).canvas.fire('webglcontextlost');
+  assert.ok(await until(() => renderers.length === 2));
+  assert.deepEqual(renderers[1].getView(), { yaw: 70, pitch: 12, fov: 60 });
+});
+
+test('the panorama is as sharp as the viewer needs: 2,048 docked, 4,096 once expanded', async () => {
+  assert.deepEqual(panoSizeFor(400, 80), [2048, 1024]);
+  assert.deepEqual(panoSizeFor(1400, 80), [4096, 2048]);
+  const { viewer, host, renderers } = setup();
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  assert.ok(await until(() => renderers[0].images.length === 2));
+  assert.match(renderers[0].images[1], /rs:fit:2048:1024/);
+  // Expanded: the panel tells the viewer it resized.
+  parts(host).canvas.clientWidth = 1400;
+  viewer.resize();
+  assert.ok(await until(() => renderers[0].images.length === 3));
+  assert.match(renderers[0].images[2], /rs:fit:4096:2048/);
+  viewer.resize();
+  for (let i = 0; i < 4; i++) await new Promise((r) => setTimeout(r, 0));
+  assert.equal(renderers[0].images.length, 3, 'not again once sharp');
+});
+
+test('a CORS image is decoded off the main thread into an ImageBitmap where the browser can', async (t) => {
+  // A blob whose header names no size (the viewer then reads none).
+  const fakeBlob = {
+    size: 4,
+    slice: () => ({ arrayBuffer: async () => new ArrayBuffer(0) }),
+  };
+  const saved = {
+    fetch: globalThis.fetch,
+    bitmap: globalThis.createImageBitmap,
+  };
+  t.after(() => {
+    globalThis.fetch = saved.fetch;
+    globalThis.createImageBitmap = saved.bitmap;
+  });
+  const fetched = [];
+  globalThis.fetch = async (url, init) => {
+    fetched.push({ url, mode: init.mode });
+    return url.includes('gone')
+      ? { ok: false, status: 409 }
+      : { ok: true, blob: async () => fakeBlob };
+  };
+  globalThis.createImageBitmap = async (blob) => ({
+    blob,
+    width: 4096,
+    height: 2048,
+  });
+  const bitmap = await loadImage('https://cdn.kartaview.org/a', {
+    crossOrigin: true,
+  });
+  assert.deepEqual(bitmap, { blob: fakeBlob, width: 4096, height: 2048 });
+  assert.deepEqual(fetched, [
+    { url: 'https://cdn.kartaview.org/a', mode: 'cors' },
+  ]);
+  await assert.rejects(
+    loadImage('https://cdn.kartaview.org/gone', { crossOrigin: true }),
+    /could not be loaded/,
+  );
+});
+
+test('a docked viewer keeps the 1,280 px photo; expanding it brings the 2,560 px one', async () => {
+  const { viewer, host, loads } = setup();
+  await viewer.mount(host);
+  await viewer.open('flat1');
+  for (let i = 0; i < 4; i++) await settle();
+  assert.equal(loads.length, 1, 'no 2,560 px download for a 400 px frame');
+  parts(host).picture.clientWidth = 1600;
+  viewer.resize();
+  assert.ok(await until(() => loads.length === 2));
+  assert.match(loads[1].url, /rs:fit:2560:2560/);
+  assert.equal(parts(host).picture.src, loads[1].url);
+  viewer.resize();
+  for (let i = 0; i < 4; i++) await settle();
+  assert.equal(loads.length, 2, 'once only');
+});
+
+test('resizes while a sharper panorama loads start no second load; the last size wins once it lands', async () => {
+  let first = true;
+  const { viewer, host, loads, renderers, held } = setup({
+    hold: (url) => {
+      const holdIt = first && url.includes('rs:fit:2048');
+      if (holdIt) first = false;
+      return holdIt;
+    },
+  });
+  await viewer.mount(host);
+  await viewer.open('pano1');
+  assert.ok(await until(() => held.length === 1));
+  // The panel animates open: a burst of resizes while 2,048 px loads.
+  parts(host).canvas.clientWidth = 1400;
+  for (let i = 0; i < 5; i++) viewer.resize();
+  for (let i = 0; i < 4; i++) await settle();
+  assert.equal(loads.length, 2, 'the preview and the one 2,048 px load');
+  held[0]();
+  assert.ok(await until(() => renderers[0].images.length === 3));
+  assert.match(renderers[0].images[1], /rs:fit:2048:1024/);
+  assert.match(renderers[0].images[2], /rs:fit:4096:2048/);
+  for (let i = 0; i < 4; i++) await settle();
+  assert.equal(loads.length, 3, 'one more load, for the size asked last');
+});
+
+test('a preview or sharper version nobody will draw is freed, not left decoded', async () => {
+  const { viewer, host, renderers, held, closed } = setup({
+    hold: (url) => /rs:fit:(1024|2048):/.test(url),
+  });
+  await viewer.mount(host);
+  // pano1's preview is still loading when flat1 opens over it.
+  const overtaken = viewer.open('pano1');
+  assert.ok(await until(() => held.length === 1));
+  await viewer.open('flat1');
+  held[0]();
+  await overtaken;
+  assert.deepEqual(closed.length, 1);
+  assert.match(closed[0], /rs:fit:1024/, 'the overtaken preview');
+  // pano1 shows; its sharp version lands after flat1 replaced it.
+  const shown = viewer.open('pano1');
+  assert.ok(await until(() => held.length === 2));
+  held[1]();
+  await shown;
+  assert.ok(await until(() => held.length === 3));
+  await viewer.open('flat1');
+  held[2]();
+  assert.ok(await until(() => closed.length === 2));
+  assert.match(closed[1], /rs:fit:2048/, 'the overtaken sharp version');
+  assert.equal(renderers[0].images.length, 1, 'only the preview was drawn');
+});

src/layers/streetLevel/providers/mapillary/coverage.js

@@ -1,21 +1,11 @@
-import * as Cesium from 'cesium';
-import { decodeCoverageTile } from './decode.js';
-import { passesImageryFilter } from '../../filter.js';
 import {
-  createHorizonCull,
-  groundUnderCamera,
-  metresBetween,
-  viewFocus,
-  visibleBbox,
-  whenIdle,
-} from '../../view.js';
-import { densifyLine, MESH_DENSIFY_DEG } from '../../groundCast.js';
-import { MESH_SAMPLE_RADIUS_M } from '../../meshSampler.js';
+  createLineCoverage,
+  sequenceIdFromPick as lineSequenceIdFromPick,
+} from '../../lineCoverage.js';
+import { decodeCoverageTile } from './decode.js';
 import {
   coverageZoomForHeight,
   overviewZoomForHeight,
-  tileBounds,
-  tilesForBbox,
 } from '../../tileMath.js';
 import {
   COLORS,
@@ -33,885 +23,48 @@ import {
   SEQUENCE_VIEW_RANGE_PER_HEIGHT,
 } from './policy.js';
 
-/** Draped lines stay at most this long while a tile's cast lines build. */
-export const SWAP_MAX_WAIT_MS = 4000;
-/** Tiles touched by new mesh samples are redrawn at most this often. */
-const REMESH_INTERVAL_MS = 1500;
-/** Gap between redrawing one dirty tile and the next. */
-const REMESH_STAGGER_MS = 120;
-/** Old-zoom tiles are kept at most this long after a zoom change. */
-const STALE_TILE_MAX_MS = 6000;
-/** Sequences per primitive: smaller batches build, and show, sooner. */
-const SEQUENCE_PRIMITIVE_BATCH = 120;
+export { SWAP_MAX_WAIT_MS, meshBoxInRange } from '../../lineCoverage.js';
 
-const PER_TILE_SEQUENCE_CAP = Math.floor(
-  COVERAGE_MAX_SEQUENCES / COVERAGE_MAX_TILES,
-);
-
-/** Colour for a sequence: Mapillary green, GEV cyan while selected. */
-function sequenceColor({ selected = false } = {}) {
-  return selected
-    ? Cesium.Color.fromCssColorString(COLORS.selected)
-    : Cesium.Color.fromCssColorString(COLORS.coverage).withAlpha(0.92);
-}
-
-/** Separates a multi-part sequence's part index from its id in pick ids. */
-const PART_SEPARATOR = '~';
-
-/** Pick ids for every part of a sequence; the first part is unsuffixed. */
-function partIds(sequence) {
-  return sequence.parts.map((_, index) =>
-    index
-      ? `${PICK_PREFIX.sequence}${sequence.id}${PART_SEPARATOR}${index}`
-      : `${PICK_PREFIX.sequence}${sequence.id}`,
-  );
+/** Overview points (z0–5) from orbit, sequence lines (z11–14) below 60 km. */
+export function mapillaryZoomFor(heightM) {
+  const sequence = coverageZoomForHeight(heightM);
+  if (sequence != null) return { zoom: sequence, kind: 'sequence' };
+  const overview = overviewZoomForHeight(heightM);
+  return overview != null ? { zoom: overview, kind: 'overview' } : null;
 }
 
 /** Sequence id for any part's pick id (`mly:seq:<id>[~<part>]`), else null. */
 export function sequenceIdFromPick(pickId) {
-  if (typeof pickId !== 'string' || !pickId.startsWith(PICK_PREFIX.sequence))
-    return null;
-  const rest = pickId.slice(PICK_PREFIX.sequence.length);
-  const cut = rest.indexOf(PART_SEPARATOR);
-  return cut === -1 ? rest : rest.slice(0, cut);
+  return lineSequenceIdFromPick(pickId, PICK_PREFIX.sequence);
 }
 
-/**
- * Whether any point of `box` ({west, south, east, north}) is within the mesh
- * sampler's range of `centre`, the ground point under the camera.
- */
-export function meshBoxInRange(box, centre) {
-  // Move the camera's longitude to the box's side of the date line first:
-  // clamping 179.999 into a box at -179.99 would pick its far edge.
-  const lon =
-    centre.lon +
-    360 * Math.round(((box.west + box.east) / 2 - centre.lon) / 360);
-  const nearest = {
-    lon: Math.min(box.east, Math.max(box.west, lon)),
-    lat: Math.min(box.north, Math.max(box.south, centre.lat)),
-  };
-  return metresBetween(centre, nearest) <= MESH_SAMPLE_RADIUS_M;
-}
-
-/**
- * Camera-driven coverage: overview points (z0–5) from orbit, sequence lines
- * (z11–14) near the ground. In terrain surface mode a tile is drawn draped
- * first, then swapped for lines cast to the bare earth (draped lines would
- * land on roofs), so coverage never waits on terrain heights.
- */
+/** Mapillary's vector-tile coverage through the server proxy. */
 export function createCoverage({ state, source }) {
-  const { render } = state.services;
-
-  function requestRender() {
-    render?.governorRequestRender?.('mapillary-coverage');
-  }
-
-  function ensureTerrainReady() {
-    return (state.coverage.terrainReady ||=
-      Cesium.GroundPolylinePrimitive.initializeTerrainHeights());
-  }
-
-  function tileKey({ x, y, z }) {
-    return `${z}/${x}/${y}`;
-  }
-
-  /** The imagery filter, resolved now: "since N days" moves with the clock. */
-  function filter() {
-    return state.context.getFilter();
-  }
-
-  function terrainMode() {
-    return (
-      state.context.getSurface?.() === 'terrain' &&
-      Boolean(state.context.groundCaster)
-    );
-  }
-
-  /**
-   * A tile's sequences, filtered then capped: capping first could leave a
-   * dense tile of newer flat captures with no 360° lines at all.
-   */
-  function drawnSequences(entry) {
-    const drawn = [];
-    const current = filter();
-    for (const sequence of entry.sequenceList) {
-      if (drawn.length >= PER_TILE_SEQUENCE_CAP) break;
-      if (passesImageryFilter(sequence, current)) drawn.push(sequence);
-    }
-    return drawn;
-  }
-
-  /**
-   * Batched primitives for a tile's sequence parts: cast polylines where
-   * terrain heights are cached, draped ground lines otherwise. Each batch
-   * records the selection its colours were built with.
-   */
-  function buildSequencePrimitives(sequences) {
-    const ground = terrainMode() ? state.context.groundCaster : null;
-    const meshAt = ground ? state.context.meshSampler?.meshAt : undefined;
-    const selectedId = state.sequence.selectedId ?? null;
-    const draped = [];
-    const cast = [];
-    for (const sequence of sequences) {
-      const color = Cesium.ColorGeometryInstanceAttribute.fromColor(
-        sequenceColor({ selected: sequence.id === selectedId }),
-      );
-      const ids = partIds(sequence);
-      sequence.parts.forEach((coordinates, index) => {
-        const flat = ground?.castLine(coordinates, { meshAt });
-        let positions;
-        try {
-          positions = flat
-            ? Cesium.Cartesian3.fromDegreesArrayHeights(flat)
-            : Cesium.Cartesian3.fromDegreesArray(coordinates.flat());
-        } catch {
-          return;
-        }
-        if (positions.length < 2) return;
-        const geometry = flat
-          ? new Cesium.PolylineGeometry({
-              positions,
-              width: COVERAGE_LINE_WIDTH_PX,
-              vertexFormat: Cesium.PolylineColorAppearance.VERTEX_FORMAT,
-              arcType: Cesium.ArcType.NONE,
-            })
-          : new Cesium.GroundPolylineGeometry({
-              positions,
-              width: COVERAGE_LINE_WIDTH_PX,
-            });
-        (flat ? cast : draped).push(
-          new Cesium.GeometryInstance({
-            geometry,
-            id: ids[index],
-            attributes: { color },
-          }),
-        );
-      });
-    }
-    const primitives = [];
-    for (let i = 0; i < draped.length; i += SEQUENCE_PRIMITIVE_BATCH)
-      primitives.push({
-        onGround: true,
-        selectedId,
-        primitive: new Cesium.GroundPolylinePrimitive({
-          geometryInstances: draped.slice(i, i + SEQUENCE_PRIMITIVE_BATCH),
-          appearance: new Cesium.PolylineColorAppearance(),
-          classificationType: Cesium.ClassificationType.BOTH,
-          asynchronous: true,
-          allowPicking: true,
-        }),
-      });
-    for (let i = 0; i < cast.length; i += SEQUENCE_PRIMITIVE_BATCH)
-      primitives.push({
-        onGround: false,
-        selectedId,
-        primitive: new Cesium.Primitive({
-          geometryInstances: cast.slice(i, i + SEQUENCE_PRIMITIVE_BATCH),
-          appearance: new Cesium.PolylineColorAppearance({ translucent: true }),
-          asynchronous: true,
-          allowPicking: true,
-        }),
-      });
-    return { primitives, draped, cast: cast.length };
-  }
-
-  /**
-   * Fetch the terrain heights a tile's lines need, then redraw it cast.
-   * `castRequested` stops the redraw from casting again at once; a refresh
-   * `retry`s a tile whose lines are still draped (a failed or partial cast),
-   * and it is redrawn only when more of its lines can be cast.
-   */
-  function castTile(entry, { retry = false } = {}) {
-    if ((entry.castRequested && !retry) || entry.castAbort || !terrainMode())
-      return;
-    entry.castRequested = true;
-    entry.castAbort = new AbortController();
-    const { signal } = entry.castAbort;
-    const lines = [...entry.sequences.values()].flatMap(
-      (sequence) => sequence.parts,
-    );
-    const caster = state.context.groundCaster;
-    caster.prepareLines(lines, { signal }).then(() => {
-      if (entry.castAbort?.signal === signal) entry.castAbort = null;
-      const attached = [...state.coverage.tiles.values()].includes(entry);
-      if (signal.aborted || !attached || !terrainMode()) return;
-      // Nothing new to cast: keep what is drawn until the next refresh.
-      // Counted like buildSequencePrimitives: a cast line needs two points.
-      const castable = lines.filter(
-        (coords) => caster.castLine(coords)?.length >= 6,
-      ).length;
-      if (castable <= (entry.castLines || 0)) {
-        entry.castRequested = (entry.castLines || 0) > 0;
-        return;
-      }
-      // A remesh may have cleared the flag while this was in flight.
-      entry.castRequested = true;
-      redrawTile(entry);
-      requestMesh(entry);
-    });
-  }
-
-  /** Rebuild a tile's lines; the old ones stay up until the new are ready. */
-  function redrawTile(entry) {
-    const previous = entry.primitives;
-    entry.primitives = [];
-    attachPrimitive(entry);
-    removeWhenReady(entry, previous);
-  }
-
-  /** Lon/lat under the camera, where mesh range is measured from. */
-  function meshCentre() {
-    const carto = state.viewer?.camera?.positionCartographic;
-    if (!carto) return null;
-    return {
-      lon: Cesium.Math.toDegrees(carto.longitude),
-      lat: Cesium.Math.toDegrees(carto.latitude),
-    };
-  }
-
-  /**
-   * A tile's drawn lines with bounding boxes, built once per filter; mesh
-   * points are densified the first time a line is in range.
-   */
-  function meshParts(entry) {
-    if (entry.meshParts) return entry.meshParts;
-    entry.meshParts = [];
-    for (const sequence of entry.sequences.values())
-      for (const part of sequence.parts) {
-        const box = {
-          west: Infinity,
-          south: Infinity,
-          east: -Infinity,
-          north: -Infinity,
-        };
-        for (const [lon, lat] of part) {
-          if (lon < box.west) box.west = lon;
-          if (lon > box.east) box.east = lon;
-          if (lat < box.south) box.south = lat;
-          if (lat > box.north) box.north = lat;
-        }
-        entry.meshParts.push({ part, box, points: null });
-      }
-    return entry.meshParts;
-  }
-
-  /**
-   * Ask for mesh samples under a cast tile's lines within the sampler's range
-   * of the camera; the rest are asked for when a camera move brings them in.
-   */
-  function requestMesh(entry) {
-    const sampler = state.context.meshSampler;
-    if (!sampler || entry.kind !== 'sequence' || !terrainMode()) return;
-    const centre = meshCentre();
-    if (!centre || !entry.bounds || !meshBoxInRange(entry.bounds, centre))
-      return;
-    const points = [];
-    for (const line of meshParts(entry)) {
-      if (!meshBoxInRange(line.box, centre)) continue;
-      line.points ||= densifyLine(line.part, MESH_DENSIFY_DEG);
-      for (const point of line.points) points.push(point);
-    }
-    if (points.length) sampler.request(points);
-  }
-
-  /** Redraw the tiles new mesh samples fall in, throttled. */
-  function onMeshSampled(batch) {
-    if (!terrainMode() || !state.context.isActive()) return;
-    for (const entry of state.coverage.tiles.values()) {
-      if (entry.kind !== 'sequence' || !entry.bounds) continue;
-      const { west, south, east, north } = entry.bounds;
-      if (
-        batch.some(
-          ([lon, lat]) =>
-            lon >= west && lon <= east && lat >= south && lat <= north,
-        )
-      )
-        state.coverage.remeshDirty.add(entry);
-    }
-    if (!state.coverage.remeshDirty.size || state.coverage.remeshTimer) return;
-    const wait = Math.max(
-      0,
-      REMESH_INTERVAL_MS - (Date.now() - (state.coverage.remeshAt || 0)),
-    );
-    state.coverage.remeshTimer = setTimeout(remesh, wait);
-  }
-
-  /** Redraw one dirty tile per idle slice, so a burst of samples never stalls a frame. */
-  function remesh() {
-    state.coverage.remeshTimer = null;
-    state.coverage.remeshAt = Date.now();
-    if (!terrainMode() || !state.context.isActive()) {
-      state.coverage.remeshDirty.clear();
-      return;
-    }
-    const attached = new Set(state.coverage.tiles.values());
-    const [entry] = state.coverage.remeshDirty;
-    if (!entry) return;
-    state.coverage.remeshDirty.delete(entry);
-    if (attached.has(entry)) {
-      redrawTile(entry);
-      requestRender();
-    }
-    if (state.coverage.remeshDirty.size)
-      state.coverage.remeshTimer = setTimeout(
-        () => whenIdle(remesh, 500),
-        REMESH_STAGGER_MS,
-      );
-  }
-
-  state.coverage.remeshDirty = new Set();
-  state.context.meshSampler?.onSampled(onMeshSampled);
-
-  /**
-   * Remove a tile's previous primitives once all its current ones are ready
-   * (or after a few seconds); detaching the tile removes them at once.
-   */
-  function removeWhenReady(entry, old) {
-    const scene = state.viewer?.scene;
-    finishSwap(entry);
-    if (!scene?.postRender) {
-      removePrimitives(old);
-      return;
-    }
-    const fresh = entry.primitives;
-    const started = Date.now();
-    const stop = scene.postRender.addEventListener(() => {
-      const ready = fresh.every(
-        ({ primitive }) => primitive.ready || primitive.isDestroyed?.(),
-      );
-      if (!ready && Date.now() - started < SWAP_MAX_WAIT_MS) {
-        requestRender();
-        return;
-      }
-      finishSwap(entry);
-      requestRender();
-    });
-    entry.swap = { old, stop };
-    requestRender();
-  }
-
-  function finishSwap(entry) {
-    if (!entry.swap) return;
-    entry.swap.stop();
-    removePrimitives(entry.swap.old);
-    entry.swap = null;
-  }
-
-  function buildOverviewCollection(points) {
-    const collection = new Cesium.PointPrimitiveCollection({
-      blendOption: Cesium.BlendOption.TRANSLUCENT,
-    });
-    const green = Cesium.Color.fromCssColorString(COLORS.coverage).withAlpha(
-      0.85,
-    );
-    const drawn = [];
-    const current = filter();
-    for (const point of points) {
-      if (!passesImageryFilter(point, current)) continue;
-      drawn.push(
-        collection.add({
-          position: Cesium.Cartesian3.fromDegrees(point.lon, point.lat),
-          color: green,
-          pixelSize: COVERAGE_OVERVIEW_POINT_PX,
-          // Google 3D terrain and clouds must not hide the near side's dots;
-          // the horizon cull hides the far side's, which this lets through.
-          disableDepthTestDistance: Number.POSITIVE_INFINITY,
-        }),
-      );
-    }
-    return { collection, points: drawn };
-  }
-
-  /** Every overview point on the globe, current zoom and old alike. */
-  function* overviewPoints() {
-    for (const entry of drawnEntries())
-      if (entry.overviewPoints) yield* entry.overviewPoints;
-  }
-
-  // Overview points skip the depth test: hide the far hemisphere's.
-  const horizon = createHorizonCull({
-    getViewer: () => state.viewer,
-    items: overviewPoints,
-    onChange: requestRender,
+  return createLineCoverage({
+    state,
+    fetchTile: async (tile, { signal }) =>
+      decodeCoverageTile(
+        await source.getTile('coverage', tile.z, tile.x, tile.y, { signal }),
+        tile,
+      ),
+    zoomFor: mapillaryZoomFor,
+    colors: COLORS,
+    pickPrefix: PICK_PREFIX.sequence,
+    renderKey: 'mapillary-coverage',
+    tuning: {
+      maxTiles: COVERAGE_MAX_TILES,
+      overviewMaxTiles: COVERAGE_OVERVIEW_MAX_TILES,
+      maxSequences: COVERAGE_MAX_SEQUENCES,
+      lineWidthPx: COVERAGE_LINE_WIDTH_PX,
+      overviewPointPx: COVERAGE_OVERVIEW_POINT_PX,
+      moveDebounceMs: COVERAGE_MOVE_DEBOUNCE_MS,
+      viewRangeMinM: SEQUENCE_VIEW_RANGE_MIN_M,
+      viewRangePerHeight: SEQUENCE_VIEW_RANGE_PER_HEIGHT,
+      viewNearM: SEQUENCE_VIEW_NEAR_M,
+    },
+    messages: {
+      keyRejected: KEY_REJECTED_MESSAGE,
+      rateLimited: RATE_LIMITED_MESSAGE,
+    },
   });
-
-  function attachPrimitive(entry) {
-    const scene = state.viewer?.scene;
-    if (!scene) return;
-    if (entry.kind === 'sequence') {
-      // Lookup, picking and counts follow what is drawn, not the whole tile.
-      const sequences = drawnSequences(entry);
-      entry.sequences = new Map(sequences.map((s) => [s.id, s]));
-      const { primitives, draped, cast } = buildSequencePrimitives(sequences);
-      entry.primitives = primitives;
-      entry.count = sequences.length;
-      for (const { primitive, onGround } of primitives)
-        (onGround ? scene.groundPrimitives : scene.primitives).add(primitive);
-      // Fewer lines cast than last time: the caster has dropped heights this
-      // tile used (a full cache), so it must be cast again.
-      if (cast < (entry.castLines || 0)) entry.castRequested = false;
-      entry.castLines = cast;
-      entry.drapedLines = draped.length;
-      if (draped.length) castTile(entry);
-      watchSelection();
-    } else {
-      const { collection, points } = buildOverviewCollection(entry.points);
-      entry.primitive = collection;
-      entry.overviewPoints = points;
-      entry.count = points.length;
-      scene.primitives.add(collection);
-      // Cull the new points now, then all of them whenever the camera moves.
-      horizon.update(points);
-    }
-  }
-
-  function removePrimitives(list) {
-    const scene = state.viewer?.scene;
-    for (const { primitive, onGround } of list || []) {
-      try {
-        (onGround ? scene?.groundPrimitives : scene?.primitives)?.remove(
-          primitive,
-        );
-      } catch {
-        /* already gone */
-      }
-    }
-  }
-
-  function detachPrimitive(entry) {
-    const scene = state.viewer?.scene;
-    finishSwap(entry);
-    removePrimitives(entry.primitives);
-    entry.primitives = [];
-    if (entry.primitive) {
-      try {
-        scene?.primitives?.remove(entry.primitive);
-      } catch {
-        /* already gone */
-      }
-      entry.primitive = null;
-      entry.overviewPoints = null;
-    }
-  }
-
-  /** Stop a tile's pending terrain lookup (tile dropped or retired). */
-  function cancelCast(entry) {
-    entry.castAbort?.abort();
-    entry.castAbort = null;
-  }
-
-  function removeTile(key) {
-    const entry = state.coverage.tiles.get(key);
-    if (!entry) return;
-    cancelCast(entry);
-    detachPrimitive(entry);
-    state.coverage.tiles.delete(key);
-  }
-
-  async function loadTile(tile, kind) {
-    const key = tileKey(tile);
-    if (state.coverage.tiles.has(key) || state.coverage.pending.has(key))
-      return;
-    const controller = new AbortController();
-    state.coverage.pending.set(key, controller);
-    notify();
-    try {
-      // Fetch and the one-time terrain-height table load run side by side,
-      // both handled from the start so an early tile failure is not unhandled.
-      const [bytes] = await Promise.all([
-        source.getTile('coverage', tile.z, tile.x, tile.y, {
-          signal: controller.signal,
-        }),
-        kind === 'sequence' ? ensureTerrainReady() : null,
-      ]);
-      // Only an abort, a retire, a clear or a newer request for this tile
-      // discards the bytes; a refresh that still wants the tile keeps them.
-      const current = () =>
-        state.coverage.pending.get(key) === controller &&
-        !state.coverage.tiles.has(key);
-      if (
-        controller.signal.aborted ||
-        !current() ||
-        kind !== state.coverage.kind ||
-        tile.z !== state.coverage.zoom
-      )
-        return;
-      const decoded = decodeCoverageTile(bytes, tile);
-      const entry = { kind, primitive: null, primitives: [], count: 0 };
-      // Padded: vector tiles carry a small buffer past their edge.
-      const bounds = tileBounds(tile.x, tile.y, tile.z);
-      const pad = (bounds.east - bounds.west) * 0.05;
-      entry.bounds = {
-        west: bounds.west - pad,
-        east: bounds.east + pad,
-        south: bounds.south - pad,
-        north: bounds.north + pad,
-      };
-      if (kind === 'sequence') {
-        // Newest first; the per-tile cap applies to what passes the filter.
-        entry.sequenceList = decoded.sequences.sort(
-          (a, b) => (b.capturedAt || 0) - (a.capturedAt || 0),
-        );
-        entry.sequences = new Map();
-        entry.total = decoded.sequences.length;
-      } else {
-        entry.points = decoded.overview;
-        entry.sequences = new Map();
-        entry.total = decoded.overview.length;
-      }
-      attachPrimitive(entry);
-      state.coverage.tiles.set(key, entry);
-      state.coverage.lastError = null;
-      requestRender();
-    } catch (error) {
-      if (
-        controller.signal.aborted ||
-        state.coverage.pending.get(key) !== controller
-      )
-        return;
-      state.coverage.lastError = error?.message || 'Coverage tile failed';
-      if (error?.keyRequired) state.keyRequired = true;
-      if (error?.keyRejected) {
-        // Every other tile would be refused too: stop asking.
-        state.keyRejected = true;
-        state.coverage.lastError = KEY_REJECTED_MESSAGE;
-      }
-      if (error?.retryAfterSec) holdFor(error.retryAfterSec);
-    } finally {
-      // Only the request that still owns the key settles it: a superseded one
-      // must not drop a newer request's entry (which is what counts as loading).
-      if (state.coverage.pending.get(key) === controller) {
-        state.coverage.pending.delete(key);
-        if (!state.coverage.pending.size) purgeStale();
-      }
-      notify();
-    }
-  }
-
-  /**
-   * Mapillary is rate-limiting: keep what is drawn, request nothing until the
-   * wait is over, then refresh once.
-   */
-  function holdFor(seconds) {
-    clearTimeout(state.coverage.holdTimer);
-    state.coverage.holdUntil = Date.now() + seconds * 1000;
-    state.coverage.lastError = RATE_LIMITED_MESSAGE;
-    state.coverage.holdTimer = setTimeout(() => {
-      state.coverage.holdTimer = null;
-      state.coverage.holdUntil = 0;
-      if (state.coverage.lastError === RATE_LIMITED_MESSAGE)
-        state.coverage.lastError = null;
-      refresh();
-    }, seconds * 1000);
-  }
-
-  /** Forget refusals when the provider goes off, so the next run asks again. */
-  function resetErrors() {
-    clearTimeout(state.coverage.holdTimer);
-    state.coverage.holdTimer = null;
-    state.coverage.holdUntil = 0;
-    state.coverage.lastError = null;
-    state.keyRejected = false;
-  }
-
-  /** Drop the previous zoom's tiles once the new ones are on screen. */
-  function purgeStale() {
-    clearTimeout(state.coverage.staleTimer);
-    state.coverage.staleTimer = null;
-    if (!state.coverage.stale.size) return;
-    for (const entry of state.coverage.stale.values()) detachPrimitive(entry);
-    state.coverage.stale.clear();
-    requestRender();
-  }
-
-  /** Move tiles to the stale set: the old zoom shows until the new one loads. */
-  function retire() {
-    for (const controller of state.coverage.pending.values())
-      controller.abort();
-    state.coverage.pending.clear();
-    for (const [key, entry] of state.coverage.tiles) {
-      cancelCast(entry);
-      const previous = state.coverage.stale.get(key);
-      if (previous) detachPrimitive(previous);
-      state.coverage.stale.set(key, entry);
-    }
-    state.coverage.tiles.clear();
-    clearTimeout(state.coverage.staleTimer);
-    state.coverage.staleTimer = setTimeout(purgeStale, STALE_TILE_MAX_MS);
-  }
-
-  function notify() {
-    state.context.notify();
-  }
-
-  /**
-   * Whether the screen centre meets the ground further ahead than the camera
-   * is high (a view tilted above 45°), or misses it.
-   */
-  function isTilted({ nadir, ahead }, height) {
-    if (!ahead) return true;
-    return metresBetween(nadir, ahead) > Math.max(1, height);
-  }
-
-  /** Recompute the tile set for the current camera and reconcile primitives. */
-  function refresh() {
-    const viewer = state.viewer;
-    if (!viewer || !state.context.isActive() || state.keyRequired) return;
-    if (state.statusKnown === false) return;
-    if (state.keyRejected || state.coverage.holdUntil > Date.now()) return;
-    const ground = groundUnderCamera(viewer, {
-      groundAt: state.context.groundCaster?.groundAt,
-    });
-    const cameraHeight = viewer.camera?.positionCartographic?.height;
-    const height = Number.isFinite(cameraHeight)
-      ? cameraHeight - (ground ?? 0)
-      : null;
-    const sequenceZoom = coverageZoomForHeight(height);
-    const overviewZoom = sequenceZoom ? null : overviewZoomForHeight(height);
-    const zoom = sequenceZoom ?? overviewZoom;
-    const kind = sequenceZoom ? 'sequence' : 'overview';
-    // At street zooms the rays meet the ground where it really is (1,600 m up
-    // in Denver; Google 3D hides the globe) and stop short of the horizon.
-    const ranged =
-      kind === 'sequence'
-        ? {
-            groundHeight: ground,
-            maxRange: Math.max(
-              SEQUENCE_VIEW_RANGE_MIN_M,
-              height * SEQUENCE_VIEW_RANGE_PER_HEIGHT,
-            ),
-          }
-        : {};
-    // Tilted street views rank tiles along the line of sight, from the ground
-    // under the camera to the ground at the centre of the screen.
-    const focus = kind === 'sequence' ? viewFocus(viewer, ranged) : null;
-    let bbox = visibleBbox(viewer, {
-      ...ranged,
-      // A tilted view's screen rows jump from the first metres to the horizon:
-      // keep the ground around the camera too. Looking down needs no help.
-      nearRange: focus && isTilted(focus, height) ? SEQUENCE_VIEW_NEAR_M : null,
-    });
-    if (kind === 'overview' && (!bbox || zoom <= 1))
-      bbox = [-180, -85, 180, 85];
-    if (zoom == null || !bbox) {
-      state.coverage.hint =
-        'Point the camera at the globe for street-level coverage';
-      clear();
-      notify();
-      return;
-    }
-    state.coverage.hint = '';
-    if (zoom !== state.coverage.zoom || kind !== state.coverage.kind) {
-      retire();
-      state.coverage.zoom = zoom;
-      state.coverage.kind = kind;
-    }
-    const { tiles } = tilesForBbox(bbox, zoom, {
-      limit:
-        kind === 'sequence' ? COVERAGE_MAX_TILES : COVERAGE_OVERVIEW_MAX_TILES,
-      focus: focus && { from: focus.nadir, to: focus.ahead },
-    });
-    const wanted = new Set(tiles.map(tileKey));
-    for (const key of [...state.coverage.tiles.keys()])
-      if (!wanted.has(key)) removeTile(key);
-    for (const [key, controller] of [...state.coverage.pending])
-      if (!wanted.has(key)) {
-        // The aborted request no longer owns its key, so its `finally` will
-        // not settle it: settle it here.
-        controller.abort();
-        state.coverage.pending.delete(key);
-      }
-    for (const tile of tiles) loadTile(tile, kind);
-    if (!state.coverage.pending.size) purgeStale();
-    // The camera moved: cells that were out of the sampler's range may not be,
-    // and lines left draped by a failed, partial or dropped cast get another try.
-    if (terrainMode())
-      for (const entry of state.coverage.tiles.values()) {
-        if (entry.castRequested) requestMesh(entry);
-        if (entry.drapedLines) castTile(entry, { retry: true });
-      }
-    notify();
-  }
-
-  function scheduleRefresh() {
-    clearTimeout(state.coverage.debounceTimer);
-    state.coverage.debounceTimer = setTimeout(
-      refresh,
-      COVERAGE_MOVE_DEBOUNCE_MS,
-    );
-  }
-
-  function attach(viewer) {
-    detach();
-    const remove = viewer.camera.changed.addEventListener(scheduleRefresh);
-    const removeEnd = viewer.camera.moveEnd.addEventListener(scheduleRefresh);
-    state.coverage.removeCameraListener = () => {
-      remove();
-      removeEnd();
-    };
-    refresh();
-  }
-
-  function detach() {
-    clearTimeout(state.coverage.debounceTimer);
-    state.coverage.debounceTimer = null;
-    state.coverage.removeCameraListener?.();
-    state.coverage.removeCameraListener = null;
-  }
-
-  function clear() {
-    for (const controller of state.coverage.pending.values())
-      controller.abort();
-    state.coverage.pending.clear();
-    for (const key of [...state.coverage.tiles.keys()]) removeTile(key);
-    purgeStale();
-    state.coverage.zoom = null;
-    state.coverage.kind = null;
-    clearTimeout(state.coverage.remeshTimer);
-    state.coverage.remeshTimer = null;
-    state.coverage.remeshDirty.clear();
-    stopSelectionWatch();
-    horizon.stop();
-    requestRender();
-  }
-
-  /** Rebuild every loaded tile from its decoded cache (after a filter change). */
-  function rebuild() {
-    purgeStale();
-    for (const entry of state.coverage.tiles.values()) {
-      cancelCast(entry);
-      entry.castRequested = false;
-      entry.meshParts = null;
-      detachPrimitive(entry);
-      attachPrimitive(entry);
-    }
-    requestRender();
-    notify();
-  }
-
-  /**
-   * Redraw tiles draped or cast for the new surface mode, then re-pick the
-   * zoom, since the ground height under the camera may have changed.
-   */
-  function setSurface() {
-    if (!state.context.isActive()) return;
-    rebuild();
-    refresh();
-  }
-
-  /** Recolour every part of a sequence in one ready primitive. */
-  function recolorInstances(primitive, sequence, selected) {
-    const value = sequenceColor({ selected });
-    for (const instanceId of partIds(sequence)) {
-      try {
-        const attributes = primitive.getGeometryInstanceAttributes(instanceId);
-        if (attributes)
-          attributes.color = Cesium.ColorGeometryInstanceAttribute.toValue(
-            value,
-            attributes.color,
-          );
-      } catch {
-        /* instance not in this primitive */
-      }
-    }
-  }
-
-  /** Every tile on the globe: the current zoom's and the stale zoom's. */
-  function drawnEntries() {
-    return [...state.coverage.tiles.values(), ...state.coverage.stale.values()];
-  }
-
-  /** A tile's primitives on the globe: its own, and the ones a swap still shows. */
-  function drawnRecords(entry) {
-    const records = entry.primitives || [];
-    return entry.swap ? [...records, ...entry.swap.old] : records;
-  }
-
-  /** Recolour one sequence, every part of it, in place (selection highlight). */
-  function recolorSequence(id, selected) {
-    for (const entry of drawnEntries()) {
-      const sequence = entry.sequences.get(id);
-      if (!sequence) continue;
-      for (const record of drawnRecords(entry)) {
-        // Still building: `syncSelection` catches it up once it is ready.
-        if (!record.primitive.ready) continue;
-        recolorInstances(record.primitive, sequence, selected);
-        if (selected) record.selectedId = id;
-        else if (record.selectedId === id) record.selectedId = null;
-      }
-    }
-    requestRender();
-  }
-
-  /**
-   * Bring a ready primitive's highlight up to the current selection, when
-   * it was built with another one (or none). True when it changed.
-   */
-  function syncSelection(entry, record) {
-    const current = state.sequence.selectedId ?? null;
-    if (record.selectedId === current || !record.primitive.ready) return false;
-    const previous =
-      record.selectedId && entry.sequences.get(record.selectedId);
-    if (previous) recolorInstances(record.primitive, previous, false);
-    const next = current && entry.sequences.get(current);
-    if (next) recolorInstances(record.primitive, next, true);
-    record.selectedId = current;
-    return true;
-  }
-
-  /**
-   * A primitive cannot be recoloured until it is ready, so while any is
-   * building, catch each one up with the selection as it becomes ready.
-   */
-  function watchSelection() {
-    const scene = state.viewer?.scene;
-    if (state.coverage.stopSelectionWatch || !scene?.postRender) return;
-    const stop = scene.postRender.addEventListener(() => {
-      let building = false;
-      let changed = false;
-      for (const entry of drawnEntries()) {
-        for (const record of entry.primitives || []) {
-          if (!record.primitive.ready) building = true;
-          else if (syncSelection(entry, record)) changed = true;
-        }
-        // Lines a swap still shows were ready (or never show): catch up only.
-        for (const record of entry.swap?.old || [])
-          if (syncSelection(entry, record)) changed = true;
-      }
-      if (changed) requestRender();
-      if (!building) stopSelectionWatch();
-    });
-    state.coverage.stopSelectionWatch = stop;
-  }
-
-  function stopSelectionWatch() {
-    state.coverage.stopSelectionWatch?.();
-    state.coverage.stopSelectionWatch = null;
-  }
-
-  /**
-   * Sequences (or overview points) drawn. A sequence that crosses a tile
-   * edge is in both tiles' lists, so sequences count once by id.
-   */
-  function sequenceCount() {
-    const ids = new Set();
-    let points = 0;
-    for (const entry of state.coverage.tiles.values())
-      if (entry.kind === 'sequence')
-        for (const id of entry.sequences.keys()) ids.add(id);
-      else points += entry.count;
-    return ids.size + points;
-  }
-
-  return {
-    attach,
-    detach,
-    refresh,
-    clear,
-    resetErrors,
-    rebuild,
-    setSurface,
-    recolorSequence,
-    sequenceCount,
-  };
 }

src/layers/streetLevel/providers/mapillary/coverageFixture.mjs

@@ -1,6 +1,6 @@
 import { PbfWriter } from 'pbf';
 
-const zigzag = (value) => (value << 1) ^ (value >> 31);
+export const zigzag = (value) => (value << 1) ^ (value >> 31);
 
 /** Tile-local [x, y] (0..extent) of a lon/lat inside tile (x, y, z). */
 export function lonLatToTileLocal([lon, lat], { x, y, z }, extent = 4096) {
@@ -13,7 +13,7 @@ export function lonLatToTileLocal([lon, lat], { x, y, z }, extent = 4096) {
 }
 
 /** One MVT layer writer with deduplicated keys and appended values. */
-function layerWriter(name, extent) {
+export function layerWriter(name, extent) {
   const keys = new Map();
   const values = [];
   const features = [];
@@ -62,7 +62,7 @@ function layerWriter(name, extent) {
 }
 
 /** MVT MoveTo/LineTo commands; the cursor carries over between parts. */
-function lineGeometry(parts) {
+export function lineGeometry(parts) {
   const out = [];
   let cx = 0;
   let cy = 0;

src/layers/streetLevel/providers/mapillary/policy.js

@@ -55,8 +55,6 @@ export const COVERAGE_LINE_WIDTH_PX = 2.5;
 
 /** Per-sequence image cones after a sequence is selected. */
 export const SEQUENCE_IMAGES_LIMIT = 2000;
-export const IMAGE_CONE_SIZE_PX = 26;
-export const IMAGE_CONE_MIN_SPACING_M = 3;
 
 /** Images asked for in a nearest-image search (radius: NEAREST_RADIUS_M). */
 export const NEAREST_LIMIT = 8;

src/layers/streetLevel/providers/mapillary/sequences.js

@@ -1,20 +1,7 @@
-import * as Cesium from 'cesium';
-import { imageConeGlyph } from '../../glyphs.js';
-import { passesImageryFilter } from '../../filter.js';
-import { refineHeights } from '../../groundCast.js';
-import { createHorizonCull, metresBetween } from '../../view.js';
-import { meshCellKey } from '../../meshSampler.js';
-import {
-  COLORS,
-  IMAGE_CONE_MIN_SPACING_M,
-  IMAGE_CONE_SIZE_PX,
-  PICK_PREFIX,
-} from './policy.js';
+import { createSequenceCones, thinImages } from '../../sequenceCones.js';
+import { COLORS, PICK_PREFIX } from './policy.js';
 
-const SPRITE_ID = 'street-level:mapillary-cones';
-
-/** How many recently viewed sequences keep their image list in memory. */
-const SEQUENCE_CACHE_SIZE = 40;
+export { thinImages } from '../../sequenceCones.js';
 
 /** Normalize a graph image record into the shape the cones use. */
 export function normalizeSequenceImage(record) {
@@ -33,290 +20,24 @@ export function normalizeSequenceImage(record) {
   };
 }
 
-/** Drop images closer than the spacing to the previous kept one. */
-export function thinImages(images, spacingM = IMAGE_CONE_MIN_SPACING_M) {
-  const kept = [];
-  let last = null;
-  for (const image of images) {
-    if (!last || metresBetween(last, image) >= spacingM) {
-      kept.push(image);
-      last = image;
-    }
-  }
-  return kept;
-}
-
-/** Image cones for one selected sequence. */
+/** Image cones for the selected Mapillary sequence, its line highlighted. */
 export function createSequences({ state, source, parts }) {
-  const { render, sprites } = state.services;
-
-  function requestRender() {
-    render?.governorRequestRender?.('mapillary-sequence');
-  }
-
-  function notify() {
-    state.context.notify();
-  }
-
-  const nothingDrawn = () => ({ images: [], cones: [], cells: new Set() });
-  /** Drawn cones, plus the mesh cells under them, so a sample moves only those. */
-  let drawn = nothingDrawn();
-
-  // The cones skip the depth test: hide the ones behind the globe.
-  const horizon = createHorizonCull({
-    getViewer: () => state.viewer,
-    items: () => drawn.cones.map((cone) => cone.billboard),
-    onChange: requestRender,
-  });
-
-  function ensureCollections(viewer) {
-    if (state.sequence.collection) return;
-    state.sequence.collection = new Cesium.BillboardCollection({
-      scene: viewer.scene,
-    });
-    viewer.scene.primitives.add(state.sequence.collection);
-    sprites?.registerSpriteCollection?.(SPRITE_ID, state.sequence.collection);
-  }
-
-  function clearCones() {
-    state.sequence.collection?.removeAll();
-    state.sequence.images = [];
-    drawn = nothingDrawn();
-    horizon.stop();
-  }
-
-  /** Where a cone stands: at `height`, or clamped to the ground when null. */
-  function placement(image, height) {
-    return {
-      position: Cesium.Cartesian3.fromDegrees(
-        image.lon,
-        image.lat,
-        height ?? 0,
-      ),
-      heightReference:
-        height === null
-          ? Cesium.HeightReference.CLAMP_TO_GROUND
-          : Cesium.HeightReference.NONE,
-    };
-  }
-
-  /**
-   * Terrain-mode cone heights on the street, not on roofs: bare earth refined
-   * by mesh samples. Null when draped or while terrain heights are fetched.
-   */
-  function coneHeights(images, { request = true } = {}) {
-    const ground = state.context.groundCaster;
-    if (state.context.getSurface?.() !== 'terrain' || !ground) return null;
-    const dems = images.map((image) => ground.groundAt(image.lon, image.lat));
-    if (dems.includes(null)) {
-      ground
-        .prepare(images.map((image) => [image.lon, image.lat]))
-        .then((ready) => {
-          if (ready && state.sequence.images === images) renderCones(images);
-        });
-      return null;
-    }
-    const sampler = state.context.meshSampler;
-    if (request)
-      sampler?.request(images.map((image) => [image.lon, image.lat]));
-    return refineHeights(
-      images.map((image, i) => ({
-        dem: dems[i],
-        mesh: sampler?.meshAt(image.lon, image.lat),
-      })),
-    );
-  }
-
-  function renderCones(images) {
-    const collection = state.sequence.collection;
-    if (!collection) return;
-    collection.removeAll();
-    drawn = { ...nothingDrawn(), images };
-    const heights = coneHeights(images);
-    // One colour per source; 360° images keep the ring shape.
-    const cone = imageConeGlyph({ size: 32, color: COLORS.coverage });
-    const ring = imageConeGlyph({
-      size: 32,
-      color: COLORS.coverage,
-      pano: true,
-    });
-    // Resolved now, so a "since N days" window keeps up with the clock.
-    const filter = state.context.getFilter();
-    images.forEach((image, index) => {
-      if (!passesImageryFilter(image, filter)) return;
-      const height = heights?.[index] ?? null;
-      const billboard = collection.add({
-        id: `${PICK_PREFIX.image}${image.id}`,
-        ...placement(image, height),
-        image: image.isPano ? ring : cone,
-        imageId: image.isPano ? 'mly-cone-pano' : 'mly-cone',
-        width: IMAGE_CONE_SIZE_PX,
-        height: IMAGE_CONE_SIZE_PX,
-        rotation: -Cesium.Math.toRadians(image.compassAngle),
-        alignedAxis: Cesium.Cartesian3.UNIT_Z,
-        disableDepthTestDistance: Number.POSITIVE_INFINITY,
-        verticalOrigin: Cesium.VerticalOrigin.CENTER,
-        scaleByDistance: new Cesium.NearFarScalar(200, 1.1, 6000, 0.35),
-      });
-      drawn.cones.push({ index, billboard, height });
-      drawn.cells.add(meshCellKey(image.lon, image.lat));
-    });
-    horizon.update();
-    requestRender();
-  }
-
-  /**
-   * Re-place cones whose height new mesh samples changed. A sample can move
-   * a neighbour too, so every height is recomputed but only moved cones touched.
-   */
-  function onMeshSampled(batch) {
-    if (state.context.getSurface?.() !== 'terrain' || !drawn.cones.length)
-      return;
-    if (!batch.some(([lon, lat]) => drawn.cells.has(meshCellKey(lon, lat))))
-      return;
-    const { images, cones } = drawn;
-    // Already asked for when drawn; a missing terrain cell redraws them all.
-    const heights = coneHeights(images, { request: false });
-    if (!heights) return;
-    const moved = [];
-    for (const cone of cones) {
-      const height = heights[cone.index] ?? null;
-      if (height === cone.height) continue;
-      cone.height = height;
-      const { position, heightReference } = placement(
-        images[cone.index],
-        height,
-      );
-      cone.billboard.heightReference = heightReference;
-      cone.billboard.position = position;
-      moved.push(cone.billboard);
-    }
-    if (!moved.length) return;
-    horizon.update(moved);
-    requestRender();
-  }
-
-  function remember(sequenceId, images) {
-    const { cache } = state.sequence;
-    cache.delete(sequenceId);
-    cache.set(sequenceId, images);
-    while (cache.size > SEQUENCE_CACHE_SIZE)
-      cache.delete(cache.keys().next().value);
-  }
-
-  /** Select a sequence: highlight its line and load its image cones. */
-  async function select(sequenceId) {
-    if (!sequenceId || !state.viewer) return;
-    // Already on screen, or already on its way.
-    if (
-      state.sequence.selectedId === sequenceId &&
-      (state.sequence.images.length || state.sequence.abort)
-    )
-      return;
-    if (state.sequence.selectedId && state.sequence.selectedId !== sequenceId)
-      parts.coverage.recolorSequence(state.sequence.selectedId, false);
-    state.sequence.abort?.abort();
-    state.sequence.selectedId = sequenceId;
-    parts.coverage.recolorSequence(sequenceId, true);
-    const cached = state.sequence.cache.get(sequenceId);
-    if (cached) {
-      state.sequence.abort = null;
-      state.sequence.loading = false;
-      state.sequence.images = cached;
-      renderCones(cached);
-      state.context.actions.reportError(null);
-      notify();
-      return;
-    }
-    // The previous sequence's cones must not stay clickable under the new
-    // highlight while this one loads, nor after its load fails.
-    clearCones();
-    requestRender();
-    const controller = new AbortController();
-    state.sequence.abort = controller;
-    state.sequence.loading = true;
-    notify();
-    try {
-      const records = await source.getSequenceImages(sequenceId, {
-        signal: controller.signal,
-      });
-      if (controller.signal.aborted) return;
-      const images = thinImages(
+  return createSequenceCones({
+    state,
+    async loadImages(sequenceId, { signal }) {
+      const records = await source.getSequenceImages(sequenceId, { signal });
+      return thinImages(
         records
           .map(normalizeSequenceImage)
           .filter(Boolean)
           .sort((a, b) => a.capturedAt - b.capturedAt),
       );
-      remember(sequenceId, images);
-      state.sequence.images = images;
-      renderCones(images);
-      state.context.actions.reportError(null);
-    } catch (error) {
-      if (!controller.signal.aborted) {
-        // Nothing to show: drop the highlight, so a click asks again.
-        parts.coverage.recolorSequence(sequenceId, false);
-        state.sequence.selectedId = null;
-        state.context.actions.reportError(
-          error?.message || 'Sequence images unavailable',
-        );
-      }
-    } finally {
-      if (state.sequence.abort === controller) {
-        state.sequence.loading = false;
-        state.sequence.abort = null;
-      }
-      notify();
-    }
-  }
-
-  function clearSelection() {
-    state.sequence.abort?.abort();
-    state.sequence.abort = null;
-    if (state.sequence.selectedId)
-      parts.coverage.recolorSequence(state.sequence.selectedId, false);
-    state.sequence.selectedId = null;
-    state.sequence.loading = false;
-    clearCones();
-    // An error about the sequence goes with it.
-    state.context.actions.reportError(null);
-    requestRender();
-    notify();
-  }
-
-  /** Re-draw the current sequence's cones (after an imagery filter change). */
-  function rerender() {
-    if (state.sequence.images.length) renderCones(state.sequence.images);
-  }
-
-  // New mesh samples may move the cones onto (or off) the road surface.
-  const stopMeshListener = state.context.meshSampler?.onSampled(onMeshSampled);
-
-  function setVisible(visible) {
-    if (state.sequence.collection) state.sequence.collection.show = visible;
-    requestRender();
-  }
-
-  function destroy(viewer) {
-    state.sequence.abort?.abort();
-    horizon.stop();
-    drawn = nothingDrawn();
-    stopMeshListener?.();
-    const collection = state.sequence.collection;
-    if (collection) {
-      sprites?.unregisterSpriteCollection?.(SPRITE_ID, collection);
-      viewer?.scene?.primitives?.remove(collection);
-      state.sequence.collection = null;
-    }
-    state.sequence.images = [];
-    state.sequence.selectedId = null;
-  }
-
-  return {
-    ensureCollections,
-    select,
-    clearSelection,
-    rerender,
-    setVisible,
-    destroy,
-  };
+    },
+    colors: COLORS,
+    pickPrefix: PICK_PREFIX.image,
+    spriteId: 'street-level:mapillary-cones',
+    renderKey: 'mapillary-sequence',
+    onHighlight: (sequenceId, selected) =>
+      parts.coverage.recolorSequence(sequenceId, selected),
+  });
 }

src/layers/streetLevel/providers/panoramax/decode.js

@@ -0,0 +1,291 @@
+import { PbfReader } from 'pbf';
+import { VectorTile } from '@mapbox/vector-tile';
+import { tileLocalToLonLat } from '../../tileMath.js';
+import {
+  DECODE_SLICE_MS,
+  OVERVIEW_BINS_PER_AXIS,
+  SIMPLIFY_TOLERANCE_UNITS,
+  panoramaxTimeMs,
+} from './policy.js';
+
+/**
+ * Douglas–Peucker in tile units: the points of `line` ({x, y}) that keep
+ * it within `tolerance` of the original (measured to each segment, so
+ * dead ends and U-turns stay), first and last always kept.
+ * Iterative, so a long track cannot overflow the stack.
+ */
+export function simplifyLine(line, tolerance) {
+  if (line.length < 3 || !(tolerance > 0)) return line;
+  const keep = new Uint8Array(line.length);
+  keep[0] = 1;
+  keep[line.length - 1] = 1;
+  const spans = [[0, line.length - 1]];
+  while (spans.length) {
+    const [from, to] = spans.pop();
+    const a = line[from];
+    const b = line[to];
+    const dx = b.x - a.x;
+    const dy = b.y - a.y;
+    const span2 = dx * dx + dy * dy;
+    let far = -1;
+    let farthest = tolerance;
+    for (let i = from + 1; i < to; i++) {
+      const p = line[i];
+      // Distance to the segment, not the infinite line: a dead end or a
+      // U-turn (a point beyond the chord's ends) is kept.
+      const t = span2
+        ? Math.max(
+            0,
+            Math.min(1, ((p.x - a.x) * dx + (p.y - a.y) * dy) / span2),
+          )
+        : 0;
+      const d = Math.hypot(p.x - (a.x + t * dx), p.y - (a.y + t * dy));
+      if (d > farthest) {
+        farthest = d;
+        far = i;
+      }
+    }
+    if (far === -1) continue;
+    keep[far] = 1;
+    spans.push([from, far], [far, to]);
+  }
+  return line.filter((_, i) => keep[i]);
+}
+
+/** Epoch ms of a sequence's day ('2025-08-11'), or 0 when undated. */
+function dayMs(value) {
+  return panoramaxTimeMs(typeof value === 'string' ? value : '') ?? 0;
+}
+
+/**
+ * Decode a Panoramax coverage tile (`/api/map/{z}/{x}/{y}.mvt`).
+ *
+ * - `sequences` (z7–15): one line per sequence, its parts kept apart so no
+ *   segment is drawn across a gap, with its day and camera type; longest
+ *   first, so a cap on lines drawn drops the shortest.
+ * - `grid` (z0–6): picture-density cells, as overview points binned to at
+ *   most OVERVIEW_BINS_PER_AXIS² a tile (a z0 tile holds ~70,000 cells). A
+ *   cell has 360° and flat counts but no date.
+ * - `pictures` (z15) is left for `decodePictures`.
+ *
+ * In one go; `decodeCoverageTileSliced` gives the page a turn between
+ * slices.
+ * @param {Uint8Array} bytes
+ * @param {{x: number, y: number, z: number}} address
+ * @returns {{sequences: Array<{id: string, parts: Array<Array<[number, number]>>, capturedAt: number, isPano: boolean}>, overview: Array<{id: string, lon: number, lat: number, capturedAt: null, isPano: boolean, hasPano: boolean, hasFlat: boolean, weight: number}>}}
+ */
+export function decodeCoverageTile(bytes, address) {
+  const steps = coverageSteps(bytes, address);
+  let step = steps.next();
+  while (!step.done) step = steps.next();
+  return step.value;
+}
+
+/** Give the page a turn: input and rendering run before the next slice. */
+function nextTask() {
+  if (typeof globalThis.scheduler?.yield === 'function')
+    return globalThis.scheduler.yield();
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+/**
+ * `decodeCoverageTile` in slices of about `sliceMs`, the page getting a
+ * turn between them: a 2 MB z10 tile over Paris is ~200 ms of decoding on
+ * a fast laptop, more on a phone, and would freeze the globe while the
+ * camera approaches. Stops at the next slice once `signal` aborts.
+ * @param {Uint8Array} bytes
+ * @param {{x: number, y: number, z: number}} address
+ * @param {{signal?: AbortSignal, sliceMs?: number, pause?: () => Promise<void>, now?: () => number}} [options]
+ */
+export async function decodeCoverageTileSliced(
+  bytes,
+  address,
+  {
+    signal,
+    sliceMs = DECODE_SLICE_MS,
+    pause = nextTask,
+    now = () => performance.now(),
+  } = {},
+) {
+  const steps = coverageSteps(bytes, address);
+  let started = now();
+  let step = steps.next();
+  while (!step.done) {
+    if (now() - started >= sliceMs) {
+      await pause();
+      signal?.throwIfAborted();
+      started = now();
+    }
+    step = steps.next();
+  }
+  return step.value;
+}
+
+/** The decode, a step a feature (see `decodeCoverageTile`). */
+function* coverageSteps(bytes, address) {
+  const result = { sequences: [], overview: [] };
+  if (!bytes || !bytes.length) return result;
+  const tile = new VectorTile(new PbfReader(bytes));
+  const { x, y, z } = address;
+
+  const sequences = tile.layers.sequences;
+  if (sequences) {
+    const measured = [];
+    for (let i = 0; i < sequences.length; i++) {
+      const feature = sequences.feature(i);
+      const props = feature.properties || {};
+      const parts = [];
+      let length = 0;
+      const tolerance = (SIMPLIFY_TOLERANCE_UNITS * sequences.extent) / 4096;
+      for (const line of feature.loadGeometry()) {
+        if (line.length < 2) continue;
+        for (let k = 1; k < line.length; k++)
+          length += Math.hypot(
+            line[k].x - line[k - 1].x,
+            line[k].y - line[k - 1].y,
+          );
+        // Simplified before anything else: GPS tracks carry a point every
+        // few metres, and each becomes ~8 ground-line vertices on the GPU.
+        parts.push(
+          simplifyLine(line, tolerance).map((point) =>
+            tileLocalToLonLat(point.x, point.y, sequences.extent, x, y, z),
+          ),
+        );
+      }
+      if (!parts.length || props.id == null) continue;
+      const sequence = {
+        id: String(props.id),
+        parts,
+        capturedAt: dayMs(props.date),
+        // A sequence with no camera type is neither (the filters keep it).
+        isPano:
+          props.type === 'equirectangular'
+            ? true
+            : props.type === 'flat'
+              ? false
+              : null,
+      };
+      measured.push({ sequence, length });
+      yield;
+    }
+    // A turn before the sort: over a city it is thousands of lines.
+    yield;
+    measured.sort((a, b) => b.length - a.length);
+    result.sequences = measured.map(({ sequence }) => sequence);
+  }
+
+  const grid = tile.layers.grid;
+  if (grid) {
+    const bins = new Map();
+    const size = grid.extent / OVERVIEW_BINS_PER_AXIS;
+    for (let i = 0; i < grid.length; i++) {
+      const feature = grid.feature(i);
+      const props = feature.properties || {};
+      const point = feature.loadGeometry()?.[0]?.[0];
+      if (i % 64 === 63) yield;
+      if (!point) continue;
+      const pano = Number(props.nb_360_pictures) || 0;
+      const flat = Number(props.nb_flat_pictures) || 0;
+      const weight = Number(props.nb_pictures) || pano + flat;
+      if (weight <= 0) continue;
+      const key = `${Math.floor(point.x / size)}:${Math.floor(point.y / size)}`;
+      const bin = bins.get(key);
+      if (!bin) {
+        bins.set(key, { point, weight, pano, flat, top: weight });
+        continue;
+      }
+      // The bin sits on its busiest cell and counts them all.
+      bin.weight += weight;
+      bin.pano += pano;
+      bin.flat += flat;
+      if (weight > bin.top) {
+        bin.top = weight;
+        bin.point = point;
+      }
+    }
+    for (const [key, bin] of bins) {
+      const [lon, lat] = tileLocalToLonLat(
+        bin.point.x,
+        bin.point.y,
+        grid.extent,
+        x,
+        y,
+        z,
+      );
+      result.overview.push({
+        id: `${z}/${x}/${y}/${key}`,
+        lon,
+        lat,
+        capturedAt: null,
+        isPano: bin.pano > bin.flat,
+        hasPano: bin.pano > 0,
+        hasFlat: bin.flat > 0,
+        weight: bin.weight,
+      });
+    }
+  }
+  return result;
+}
+
+/** A picture's sequence ids: the tile stores them as a JSON array in a string. */
+function sequenceIdsOf(props) {
+  const raw = props.sequences;
+  if (typeof raw === 'string' && raw.startsWith('[')) {
+    try {
+      const ids = JSON.parse(raw);
+      if (Array.isArray(ids)) return ids.map(String);
+    } catch {
+      /* fall through to the first sequence */
+    }
+  }
+  return props.first_sequence != null ? [String(props.first_sequence)] : [];
+}
+
+/**
+ * The pictures of a z15 tile that belong to `sequenceId`, as cones draw
+ * them (unsorted).
+ * @param {Uint8Array} bytes
+ * @param {{x: number, y: number, z: number}} address
+ * @param {string} sequenceId
+ * @returns {Array<{id: string, lon: number, lat: number, compassAngle: number, capturedAt: number, isPano: boolean}>}
+ */
+export function decodePictures(bytes, address, sequenceId) {
+  if (!bytes || !bytes.length) return [];
+  const tile = new VectorTile(new PbfReader(bytes));
+  const layer = tile.layers.pictures;
+  if (!layer) return [];
+  const { x, y, z } = address;
+  const wanted = String(sequenceId);
+  const out = [];
+  for (let i = 0; i < layer.length; i++) {
+    const feature = layer.feature(i);
+    const props = feature.properties || {};
+    // A cheap test first: most pictures in a tile are other sequences'.
+    if (
+      typeof props.sequences === 'string' &&
+      !props.sequences.includes(wanted)
+    )
+      continue;
+    if (!sequenceIdsOf(props).includes(wanted) || props.id == null) continue;
+    const point = feature.loadGeometry()?.[0]?.[0];
+    if (!point) continue;
+    const [lon, lat] = tileLocalToLonLat(
+      point.x,
+      point.y,
+      layer.extent,
+      x,
+      y,
+      z,
+    );
+    const heading = Number(props.heading);
+    out.push({
+      id: String(props.id),
+      lon,
+      lat,
+      compassAngle: Number.isFinite(heading) ? heading : 0,
+      capturedAt: panoramaxTimeMs(String(props.ts ?? '')) ?? 0,
+      isPano: props.type === 'equirectangular',
+    });
+  }
+  return out;
+}

src/layers/streetLevel/providers/panoramax/decode.test.mjs

@@ -0,0 +1,317 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  decodeCoverageTile,
+  decodeCoverageTileSliced,
+  decodePictures,
+  simplifyLine,
+} from './decode.js';
+import { OVERVIEW_BINS_PER_AXIS } from './policy.js';
+import { encodePanoramaxTile } from '../../../../testSupport/panoramaxFixtures.mjs';
+import { tileCentre } from '../../../../testSupport/streetLevelFakes.mjs';
+
+const near = (a, b, eps = 1e-4) => Math.abs(a - b) < eps;
+
+test('sequence lines keep their parts apart, with their day and camera type', () => {
+  const { tile, lon, lat } = tileCentre(2.35, 48.85);
+  const bytes = encodePanoramaxTile(tile, {
+    sequences: [
+      {
+        id: 'pano-seq',
+        type: 'equirectangular',
+        date: '2024-03-05',
+        parts: [
+          [
+            [lon - 0.001, lat],
+            [lon, lat],
+          ],
+          [
+            [lon + 0.0005, lat],
+            [lon + 0.001, lat],
+          ],
+        ],
+      },
+      {
+        id: 'flat-seq',
+        parts: [
+          [
+            [lon, lat - 0.001],
+            [lon, lat],
+          ],
+        ],
+      },
+    ],
+  });
+  const { sequences, overview } = decodeCoverageTile(bytes, tile);
+  assert.equal(overview.length, 0);
+  assert.equal(sequences.length, 2);
+  const pano = sequences.find((s) => s.id === 'pano-seq');
+  const flat = sequences.find((s) => s.id === 'flat-seq');
+  assert.equal(pano.isPano, true);
+  assert.equal(pano.capturedAt, Date.UTC(2024, 2, 5));
+  assert.equal(pano.parts.length, 2, 'the gap is not bridged');
+  assert.ok(near(pano.parts[1][1][0], lon + 0.001));
+  assert.equal(flat.isPano, false);
+  const untyped = decodeCoverageTile(
+    encodePanoramaxTile(tile, {
+      sequences: [
+        {
+          id: 'u',
+          type: '',
+          parts: [
+            [
+              [lon, lat],
+              [lon + 0.001, lat],
+            ],
+          ],
+        },
+      ],
+    }),
+    tile,
+  ).sequences[0];
+  assert.equal(untyped.isPano, null, 'no camera type: neither');
+});
+
+test('density cells bin to a bounded number of points that keep the counts and kinds', () => {
+  const tile = { x: 0, y: 0, z: 0 };
+  // Two cells in one bin (3.75° wide at z0) far enough apart to tell
+  // which it sits on, one far away, one empty.
+  const grid = [
+    { lon: 0.3, lat: 48.85, pano: 0, flat: 5 },
+    { lon: 3.4, lat: 48.85, pano: 30, flat: 0 },
+    { lon: -73.9, lat: 40.7, pano: 1, flat: 0 },
+    { lon: 10, lat: 10, pano: 0, flat: 0 },
+  ];
+  const { overview } = decodeCoverageTile(
+    encodePanoramaxTile(tile, { grid }),
+    tile,
+  );
+  assert.equal(overview.length, 2, 'Paris cells share a bin; empty cells go');
+  const paris = overview.find((p) => p.lon > 0);
+  assert.equal(paris.weight, 35);
+  assert.equal(paris.hasPano, true);
+  assert.equal(paris.hasFlat, true);
+  assert.equal(paris.isPano, true, 'mostly 360°');
+  assert.equal(paris.capturedAt, null, 'cells are undated');
+  assert.ok(
+    near(paris.lon, 3.4, 0.2),
+    `sits on the busiest cell: ${paris.lon}`,
+  );
+  const nyc = overview.find((p) => p.lon < 0);
+  assert.deepEqual([nyc.hasPano, nyc.hasFlat, nyc.weight], [true, false, 1]);
+});
+
+test('lines come longest first, so a cap on lines drawn drops the shortest', () => {
+  const { tile, lon, lat } = tileCentre(2.35, 48.85);
+  const span = (id, metres) => ({
+    id,
+    parts: [
+      [
+        [lon, lat],
+        [lon + metres / 73_000, lat],
+      ],
+    ],
+  });
+  const { sequences } = decodeCoverageTile(
+    encodePanoramaxTile(tile, {
+      sequences: [span('short', 20), span('long', 900), span('mid', 300)],
+    }),
+    tile,
+  );
+  assert.deepEqual(
+    sequences.map((s) => s.id),
+    ['long', 'mid', 'short'],
+  );
+});
+
+test('a dense grid tile never draws more than the bins allow', () => {
+  const tile = { x: 0, y: 0, z: 0 };
+  const grid = [];
+  for (let i = 0; i < 300; i++)
+    for (let j = 0; j < 60; j++)
+      grid.push({ lon: -170 + i * 1.1, lat: -60 + j * 2 });
+  const { overview } = decodeCoverageTile(
+    encodePanoramaxTile(tile, { grid }),
+    tile,
+  );
+  assert.ok(overview.length <= OVERVIEW_BINS_PER_AXIS ** 2);
+  assert.ok(overview.length > 1000);
+  assert.equal(
+    overview.reduce((sum, p) => sum + p.weight, 0),
+    grid.length,
+    'every picture is still counted',
+  );
+});
+
+/** A tile with many lines and a dense grid, for the sliced decode. */
+function busyTile() {
+  const { tile, lon, lat } = tileCentre(2.35, 48.85);
+  const sequences = Array.from({ length: 200 }, (_, i) => ({
+    id: `s${i}`,
+    parts: [
+      [
+        [lon, lat + i / 1e6],
+        [lon + (i + 1) / 73_000, lat + i / 1e6],
+      ],
+    ],
+  }));
+  const grid = Array.from({ length: 500 }, (_, i) => ({
+    lon: lon + (i % 25) / 1e4,
+    lat: lat + Math.floor(i / 25) / 1e4,
+  }));
+  return { tile, bytes: encodePanoramaxTile(tile, { sequences, grid }) };
+}
+
+test('a sliced decode gives the page turns and decodes the same as one in one go', async () => {
+  const { tile, bytes } = busyTile();
+  let clock = 0;
+  let pauses = 0;
+  const sliced = await decodeCoverageTileSliced(bytes, tile, {
+    sliceMs: 8,
+    // Each step "takes" a millisecond: a turn every eight features.
+    now: () => clock++,
+    pause: async () => {
+      pauses++;
+    },
+  });
+  assert.ok(pauses > 20, `${pauses} turns`);
+  assert.deepEqual(sliced, decodeCoverageTile(bytes, tile));
+});
+
+test('a sliced decode stops at the next turn once aborted', async () => {
+  const { tile, bytes } = busyTile();
+  const controller = new AbortController();
+  let clock = 0;
+  let pauses = 0;
+  await assert.rejects(
+    decodeCoverageTileSliced(bytes, tile, {
+      signal: controller.signal,
+      now: () => (clock += 10),
+      pause: async () => {
+        if (++pauses === 2) controller.abort();
+      },
+    }),
+    { name: 'AbortError' },
+  );
+  assert.equal(pauses, 2, 'no work after the abort');
+});
+
+test('a fast sliced decode takes no turns', async () => {
+  const { tile, bytes } = busyTile();
+  let pauses = 0;
+  await decodeCoverageTileSliced(bytes, tile, {
+    now: () => 0,
+    pause: async () => {
+      pauses++;
+    },
+  });
+  assert.equal(pauses, 0);
+});
+
+test('an empty tile decodes to nothing', () => {
+  for (const bytes of [new Uint8Array(0), null, undefined])
+    assert.deepEqual(decodeCoverageTile(bytes, { x: 0, y: 0, z: 0 }), {
+      sequences: [],
+      overview: [],
+    });
+  assert.deepEqual(
+    decodePictures(new Uint8Array(0), { x: 0, y: 0, z: 15 }, 's'),
+    [],
+  );
+});
+
+test('a z15 tile’s pictures of one sequence become cones; other sequences’ are skipped', () => {
+  const { tile, lon, lat } = tileCentre(2.35, 48.85, 15);
+  const bytes = encodePanoramaxTile(tile, {
+    pictures: [
+      {
+        id: 'a',
+        lon,
+        lat,
+        sequenceId: 's1',
+        heading: 45,
+        type: 'equirectangular',
+        ts: '2023-12-12 07:56:37+00',
+      },
+      { id: 'b', lon: lon + 0.0001, lat, sequenceId: 's2' },
+      { id: 'c', lon: lon + 0.0002, lat, sequenceId: 's1' },
+    ],
+  });
+  const images = decodePictures(bytes, tile, 's1');
+  assert.deepEqual(
+    images.map((i) => i.id),
+    ['a', 'c'],
+  );
+  assert.equal(images[0].compassAngle, 45);
+  assert.equal(images[0].isPano, true);
+  assert.equal(images[0].capturedAt, Date.UTC(2023, 11, 12, 7, 56, 37));
+  assert.ok(near(images[1].lon, lon + 0.0002));
+  assert.deepEqual(decodePictures(bytes, tile, 'nope'), []);
+  // A tile without pictures (below z15) has none to give.
+  const lines = encodePanoramaxTile(tile, {
+    sequences: [
+      {
+        id: 's1',
+        parts: [
+          [
+            [lon, lat],
+            [lon + 0.001, lat],
+          ],
+        ],
+      },
+    ],
+  });
+  assert.deepEqual(decodePictures(lines, tile, 's1'), []);
+});
+
+test('lines are simplified within a few tile units, ends and corners kept', () => {
+  const zigzag = Array.from({ length: 1000 }, (_, i) => ({
+    x: i,
+    y: i % 2 ? 1 : 0,
+  }));
+  assert.deepEqual(
+    simplifyLine(zigzag, 4),
+    [zigzag[0], zigzag.at(-1)],
+    'a 1-unit wobble goes',
+  );
+  const corner = [
+    { x: 0, y: 0 },
+    { x: 50, y: 1 },
+    { x: 100, y: 0 },
+    { x: 100, y: 100 },
+  ];
+  assert.deepEqual(simplifyLine(corner, 4), [corner[0], corner[2], corner[3]]);
+  assert.equal(simplifyLine(corner.slice(0, 2), 4).length, 2);
+  // A loop back to its start (no chord) keeps its far point.
+  const loop = [
+    { x: 0, y: 0 },
+    { x: 40, y: 0 },
+    { x: 0, y: 0 },
+  ];
+  assert.equal(simplifyLine(loop, 4).length, 3);
+  assert.equal(simplifyLine(zigzag, 0).length, 1000, 'no tolerance, no change');
+  // A dead end: out to 100 and back to 50 keeps its far end.
+  const deadEnd = [
+    { x: 0, y: 0 },
+    { x: 100, y: 0 },
+    { x: 50, y: 0 },
+  ];
+  assert.deepEqual(simplifyLine(deadEnd, 4), deadEnd);
+});
+
+test('a decoded GPS track keeps a fraction of its points', () => {
+  const { tile, lon, lat } = tileCentre(2.35, 48.85);
+  const track = Array.from({ length: 500 }, (_, i) => [
+    lon - 0.004 + i * 0.000016,
+    lat + Math.sin(i / 40) * 0.0004,
+  ]);
+  const [sequence] = decodeCoverageTile(
+    encodePanoramaxTile(tile, { sequences: [{ id: 'gps', parts: [track] }] }),
+    tile,
+  ).sequences;
+  assert.ok(
+    sequence.parts[0].length < 100,
+    `${sequence.parts[0].length} points`,
+  );
+  assert.ok(sequence.parts[0].length > 5);
+});

src/layers/streetLevel/providers/panoramax/index.js

@@ -0,0 +1,642 @@
+import { createLineCoverage, sequenceIdFromPick } from '../../lineCoverage.js';
+import { createSequenceCones, thinImages } from '../../sequenceCones.js';
+import { passesImageryFilter } from '../../filter.js';
+import {
+  lonToTileX,
+  latToTileY,
+  overviewZoomForHeight,
+  tileBounds,
+} from '../../tileMath.js';
+import { metresBetween } from '../../view.js';
+import { createLru, createTileCache } from '../../tileCache.js';
+import { decodeCoverageTileSliced, decodePictures } from './decode.js';
+import { createPanoramaxSource } from './source.js';
+import { createPanoramaxViewer } from './viewer.js';
+import {
+  COLORS,
+  COVERAGE_LINES_BELOW_M,
+  COVERAGE_TUNING,
+  COVERAGE_Z11_BELOW_M,
+  COVERAGE_Z12_BELOW_M,
+  COVERAGE_Z13_BELOW_M,
+  COVERAGE_Z14_BELOW_M,
+  GONE_MESSAGE,
+  LINE_CLICK_HINT,
+  LINE_CLICK_RADIUS_MAX_M,
+  LINE_CLICK_RADIUS_PER_HEIGHT,
+  NEAREST_LIMIT,
+  NEAREST_RADIUS_M,
+  FILTERED_HINT,
+  NO_COVERAGE_HINT,
+  OVERVIEW_HINT,
+  PANORAMAX_CREDIT_HTML,
+  PANORAMAX_LABEL,
+  PANORAMAX_NAME,
+  PANORAMAX_PROVIDER_ID,
+  PICK_PREFIX,
+  PICTURE_TILE_EDGE_M,
+  PICTURE_TILE_ZOOM,
+  RATE_LIMITED_MESSAGE,
+  UNREADABLE_TILE_MESSAGE,
+  normalizeItem,
+} from './policy.js';
+
+export { PANORAMAX_PROVIDER_ID } from './policy.js';
+
+/**
+ * A tile's bytes decoded by `decode`; a body that is not a vector tile
+ * (an HTML error page, a cut-off answer) reads as such, not as a parser's
+ * "Unimplemented type: 4".
+ */
+async function readable(decode) {
+  try {
+    return await decode();
+  } catch (error) {
+    if (error?.name === 'AbortError' || error?.status !== undefined)
+      throw error;
+    throw new Error(UNREADABLE_TILE_MESSAGE);
+  }
+}
+
+/**
+ * A density dot's size: busier places draw bigger (2.5 px for one picture,
+ * 8 px from a few hundred thousand), so a city does not read like farmland.
+ */
+export function overviewPointSize(point) {
+  const weight = Math.max(1, Number(point?.weight) || 1);
+  return Math.min(8, 2.5 + Math.log10(weight));
+}
+
+/** Pictures kept in memory by id (lookups and ‹ › fill it). */
+const PHOTO_CACHE_SIZE = 2000;
+/** Sequences whose cone centre is remembered. */
+const ANCHOR_CACHE_SIZE = 50;
+/** Decoded coverage tiles kept (a simplified dense z10 tile is ~4 MB). */
+const COVERAGE_TILE_CACHE_SIZE = 16;
+/** One sequence's pictures in a z15 tile, kept for re-centring. */
+const PICTURE_LIST_CACHE_SIZE = 32;
+
+/**
+ * Sequence lines at z10–14 below 60 km; above, the density grid at z5 and
+ * coarser.
+ */
+export function panoramaxZoomFor(heightM) {
+  if (!Number.isFinite(heightM)) return null;
+  if (heightM <= COVERAGE_LINES_BELOW_M) {
+    const zoom =
+      heightM <= COVERAGE_Z14_BELOW_M
+        ? 14
+        : heightM <= COVERAGE_Z13_BELOW_M
+          ? 13
+          : heightM <= COVERAGE_Z12_BELOW_M
+            ? 12
+            : heightM <= COVERAGE_Z11_BELOW_M
+              ? 11
+              : 10;
+    return { zoom, kind: 'sequence' };
+  }
+  return {
+    zoom: Math.min(5, overviewZoomForHeight(heightM) ?? 5),
+    kind: 'overview',
+  };
+}
+
+/**
+ * The imagery filter for lines and grid cells. A cell (undated, with 360°
+ * and flat counts) stays while it holds pictures of the kind asked for. A
+ * line is dated by its sequence's first day, so a sequence still growing
+ * may hide under "since" while its newer pictures can be opened; a line
+ * with no camera type or no day is kept (a click finds out).
+ */
+export function passesCoverage(record, filter) {
+  if (!filter) return true;
+  if ('hasPano' in record) {
+    if (filter.pano === 'pano') return record.hasPano;
+    if (filter.pano === 'flat') return record.hasFlat;
+    return true;
+  }
+  return passesImageryFilter(record, {
+    pano: typeof record.isPano === 'boolean' ? filter.pano : 'all',
+    sinceMs: record.capturedAt ? filter.sinceMs : null,
+  });
+}
+
+/** The z15 tile holding a point. */
+function pictureTileOf({ lon, lat }) {
+  const z = PICTURE_TILE_ZOOM;
+  return { x: lonToTileX(lon, z), y: latToTileY(lat, z), z };
+}
+
+/**
+ * The z15 tiles whose pictures surround a point: its own first, and the
+ * neighbours it sits within PICTURE_TILE_EDGE_M of (at most nine).
+ */
+export function pictureTilesAround(point) {
+  const home = pictureTileOf(point);
+  const box = tileBounds(home.x, home.y, home.z);
+  const near = (lon, lat) =>
+    metresBetween(point, { lon, lat }) <= PICTURE_TILE_EDGE_M;
+  // Near both edges at once where tiles are narrow (high latitudes).
+  const dxs = [0];
+  if (near(box.west, point.lat)) dxs.push(-1);
+  if (near(box.east, point.lat)) dxs.push(1);
+  const dys = [0];
+  if (near(point.lon, box.north)) dys.push(-1);
+  if (near(point.lon, box.south)) dys.push(1);
+  const max = 2 ** home.z;
+  const tiles = [];
+  for (const dy of dys)
+    for (const dx of dxs) {
+      const y = home.y + dy;
+      if (y < 0 || y >= max) continue;
+      tiles.push({ x: (home.x + dx + max) % max, y, z: home.z });
+    }
+  return tiles;
+}
+
+const tileKey = ({ x, y, z }) => `${z}/${x}/${y}`;
+
+/**
+ * Panoramax Street Level provider: the federated, keyless, open
+ * street-level commons. Coverage from its vector tiles (density points
+ * from orbit, sequence lines near the ground); a click on a line opens that
+ * sequence's picture nearest the click, with cones along the sequence
+ * around it and ‹ › to step through it. Flat pictures show as photos, 360°
+ * ones on the shared WebGL panorama.
+ * @param {{source?: ReturnType<typeof createPanoramaxSource>, viewerOptions?: object}} [options]
+ * @returns {import('../../registry.js').StreetLevelProvider}
+ */
+export function createPanoramaxProvider({
+  source = createPanoramaxSource(),
+  viewerOptions = {},
+} = {}) {
+  return Object.freeze({
+    id: PANORAMAX_PROVIDER_ID,
+    name: PANORAMAX_NAME,
+    label: PANORAMAX_LABEL,
+    requiresKeyId: null,
+    pickPrefix: PICK_PREFIX.root,
+    colors: COLORS,
+    credit: Object.freeze({ html: PANORAMAX_CREDIT_HTML }),
+    defaultOn: false,
+    coverageLabel: Object.freeze({
+      noun: 'sequences',
+      action: LINE_CLICK_HINT,
+    }),
+
+    create(context) {
+      const state = {
+        context,
+        services: context.services,
+        viewer: null,
+        keyRequired: false,
+        keyRejected: false,
+        statusKnown: true,
+        coverage: {
+          zoom: null,
+          tiles: new Map(),
+          stale: new Map(),
+          staleTimer: null,
+          pending: new Map(),
+          lastError: null,
+          holdUntil: 0,
+          holdTimer: null,
+          debounceTimer: null,
+          removeCameraListener: null,
+          terrainReady: null,
+          hint: '',
+          kind: null,
+        },
+        sequence: {
+          selectedId: null,
+          images: [],
+          cache: new Map(),
+          collection: null,
+          loading: false,
+          abort: null,
+        },
+      };
+      const photos = createLru(PHOTO_CACHE_SIZE);
+      /** Where each sequence's cones centre: the picture last opened in it, or a click. */
+      const anchors = createLru(ANCHOR_CACHE_SIZE);
+      /** The z15 tiles the cones were drawn from. */
+      let drawn = null;
+      /** A line click: its sequence's pictures win the next nearest lookup there. */
+      let preferred = null;
+
+      function remember(item) {
+        const photo = normalizeItem(item);
+        if (photo) photos.set(photo.id, photo);
+        return photo;
+      }
+
+      /**
+       * Lookups in flight, shared: ‹ › and the viewer ask for the same
+       * picture. A lookup stops once every caller waiting on it has given up
+       * (its search would hold one of the two API connections for nothing).
+       */
+      const inflight = new Map();
+      function getPhoto(photoId, { signal } = {}) {
+        const id = String(photoId);
+        const cached = photos.get(id);
+        if (cached) return Promise.resolve(cached);
+        if (signal?.aborted) return Promise.reject(signal.reason);
+        let lookup = inflight.get(id);
+        if (!lookup) {
+          const controller = new AbortController();
+          lookup = { controller, waiting: 0 };
+          lookup.promise = source
+            .getItem(id, { signal: controller.signal })
+            .catch((error) => {
+              // Ids are UUIDs: the API answers 400 to anything else.
+              if (error?.status === 400) return null;
+              throw error;
+            })
+            .then((item) => {
+              const photo = item && remember(item);
+              if (!photo) throw new Error(GONE_MESSAGE);
+              return photo;
+            })
+            .finally(() => {
+              if (inflight.get(id) === lookup) inflight.delete(id);
+            });
+          lookup.promise.catch(() => {});
+          inflight.set(id, lookup);
+        }
+        const shared = lookup;
+        shared.waiting++;
+        if (!signal) shared.waiting = Infinity;
+        return new Promise((resolve, reject) => {
+          const leave = () => {
+            reject(signal.reason);
+            shared.waiting--;
+            // A caller in the same tick (the same photo opened again) may
+            // still join: stop only if nobody has.
+            queueMicrotask(() => {
+              if (shared.waiting > 0) return;
+              shared.controller.abort(signal.reason);
+              if (inflight.get(id) === shared) inflight.delete(id);
+            });
+          };
+          signal?.addEventListener('abort', leave, { once: true });
+          shared.promise.then(
+            (photo) => {
+              signal?.removeEventListener('abort', leave);
+              resolve(photo);
+            },
+            (error) => {
+              signal?.removeEventListener('abort', leave);
+              reject(error);
+            },
+          );
+        });
+      }
+
+      /**
+       * How far from a line click its sequence's pictures are looked for:
+       * from high up the click may land tens of metres off the line.
+       */
+      function lineClickRadius() {
+        const height = state.viewer?.camera?.positionCartographic?.height;
+        if (!Number.isFinite(height)) return NEAREST_RADIUS_M;
+        return Math.min(
+          LINE_CLICK_RADIUS_MAX_M,
+          Math.max(NEAREST_RADIUS_M, height * LINE_CLICK_RADIUS_PER_HEIGHT),
+        );
+      }
+
+      /** The picture `delta` along its sequence, from its own links (null at an end). */
+      async function step(photo, delta) {
+        if (!photo?.sequenceId) return null;
+        return (delta < 0 ? photo.prevId : photo.nextId) || null;
+      }
+
+      // Decoded tiles, kept a while: panning back, or across a zoom band and
+      // back, neither fetches nor decodes them again.
+      const coverageTiles = createTileCache({
+        size: COVERAGE_TILE_CACHE_SIZE,
+        load: (tile, { signal }) =>
+          readable(async () =>
+            decodeCoverageTileSliced(
+              await source.getTile(tile, { signal }),
+              tile,
+              { signal },
+            ),
+          ),
+      });
+      /** A z15 tile's pictures of one sequence, by `z/x/y:sequence`. */
+      const pictureLists = createLru(PICTURE_LIST_CACHE_SIZE);
+      /**
+       * Only finished lists are kept: a load in flight belongs to its own
+       * selection, whose abort (a re-centre) must not empty the next one's.
+       */
+      async function picturesIn(tile, sequenceId, signal) {
+        const key = `${tileKey(tile)}:${sequenceId}`;
+        const kept = pictureLists.get(key);
+        if (kept) return kept;
+        const list = await readable(async () =>
+          decodePictures(
+            await source.getTile(tile, { signal, lane: 'pictures' }),
+            tile,
+            sequenceId,
+          ),
+        );
+        pictureLists.set(key, list);
+        return list;
+      }
+
+      const coverage = createLineCoverage({
+        state,
+        fetchTile: (tile, options) => coverageTiles.get(tile, options),
+        zoomFor: panoramaxZoomFor,
+        colors: COLORS,
+        pickPrefix: PICK_PREFIX.sequence,
+        renderKey: 'panoramax-coverage',
+        tuning: COVERAGE_TUNING,
+        messages: { rateLimited: RATE_LIMITED_MESSAGE },
+        passes: passesCoverage,
+        overviewPointSize,
+      });
+
+      const cones = createSequenceCones({
+        state,
+        async loadImages(sequenceId, { signal }) {
+          const anchor = anchors.get(sequenceId);
+          if (!anchor) return [];
+          const tiles = pictureTilesAround(anchor);
+          // Known from the start: a picture opening while these load is
+          // judged against them (re-centred if outside, left alone inside).
+          const covering = { sequenceId, tiles: new Set(tiles.map(tileKey)) };
+          drawn = covering;
+          const conesOf = (lists) =>
+            thinImages(
+              [
+                ...new Map(
+                  lists.flat().map((image) => [image.id, image]),
+                ).values(),
+              ].sort((a, b) => a.capturedAt - b.capturedAt),
+            );
+          const keyOf = (tile) => `${tileKey(tile)}:${sequenceId}`;
+          // The home tile is needed now (it holds the open picture).
+          const home = await picturesIn(tiles[0], sequenceId, signal);
+          signal?.throwIfAborted();
+          // Neighbours already read draw with it; the rest (each up to
+          // 1.4 MB in central Paris) join the cones as they arrive.
+          const neighbours = tiles.slice(1);
+          const kept = neighbours
+            .map((tile) => pictureLists.get(keyOf(tile)))
+            .filter(Boolean);
+          const missing = neighbours.filter(
+            (tile) => !pictureLists.get(keyOf(tile)),
+          );
+          if (missing.length)
+            Promise.allSettled(
+              missing.map((tile) => picturesIn(tile, sequenceId, signal)),
+            ).then((lists) => {
+              if (signal?.aborted || drawn !== covering) return;
+              dropFailed(covering, missing, lists);
+              // Only a tile that arrived now redraws (no loop on failures).
+              if (lists.some((list) => list.status === 'fulfilled'))
+                cones.select(sequenceId, { force: true });
+            });
+          return conesOf([home, ...kept]);
+        },
+        colors: COLORS,
+        pickPrefix: PICK_PREFIX.image,
+        spriteId: 'street-level:panoramax-cones',
+        renderKey: 'panoramax-sequence',
+        onHighlight: (sequenceId, selected) =>
+          coverage.recolorSequence(sequenceId, selected),
+      });
+
+      /**
+       * A tile that failed is not covered: a picture opening in it later
+       * re-centres the cones there (and asks for the tile again).
+       */
+      function dropFailed(covering, tiles, lists) {
+        lists.forEach((list, i) => {
+          if (list.status === 'rejected')
+            covering.tiles.delete(tileKey(tiles[i]));
+        });
+      }
+
+      /**
+       * The cones show the z15 tiles around one picture: once a picture of
+       * the selected sequence opens outside them (‹ ›, a cone), re-centre.
+       */
+      function recentreCones(photo) {
+        if (!photo?.sequenceId) return;
+        if (state.sequence.selectedId !== photo.sequenceId) return;
+        if (drawn?.sequenceId !== photo.sequenceId) return;
+        if (drawn.tiles.has(tileKey(pictureTileOf(photo)))) return;
+        cones.select(photo.sequenceId, { force: true });
+      }
+
+      const viewer = createPanoramaxViewer({
+        getPhoto,
+        // The cones centre on the picture actually shown, never on a
+        // lookup that came back after the user moved on.
+        onShowing: (photo) => {
+          if (photo.sequenceId) anchors.set(photo.sequenceId, photo);
+        },
+        // After a GPU reset the same picture is drawn again by the viewer
+        // itself: through the core it would cancel a lookup the user
+        // started. A failure still shows.
+        onReopen: (photoId) =>
+          viewer
+            .open(photoId)
+            .catch((error) =>
+              context.actions.reportError(
+                error?.message || 'The Panoramax photo could not be loaded',
+              ),
+            ),
+        step,
+        onStep: (photoId) =>
+          context.actions.openImage(photoId, { frame: false }),
+        onShown: recentreCones,
+        // Esc in the viewer clears the selected sequence, as the panel says.
+        onEscape: () => {
+          if (!state.sequence.selectedId) return false;
+          cones.clearSelection();
+          drawn = null;
+          return true;
+        },
+        render: context.services?.render,
+        ...viewerOptions,
+      });
+
+      /** Nearest of `items` within `radius` metres of a point, or null. */
+      function nearestOf(items, point, radius = NEAREST_RADIUS_M) {
+        let best = null;
+        for (const item of items) {
+          const photo = remember(item);
+          if (!photo) continue;
+          const metres = metresBetween(point, photo);
+          if (metres > radius) continue;
+          if (!best || metres < best.metres) best = { photo, metres };
+        }
+        return best?.photo ?? null;
+      }
+
+      return {
+        async status() {
+          return { configured: true };
+        },
+
+        init(cesiumViewer) {
+          state.viewer = cesiumViewer;
+          cones.ensureCollections(cesiumViewer);
+          cones.setVisible(false);
+        },
+
+        activate(cesiumViewer) {
+          state.viewer = cesiumViewer;
+          cones.setVisible(true);
+          coverage.attach(cesiumViewer);
+        },
+
+        deactivate() {
+          coverage.detach();
+          coverage.clear();
+          coverage.resetErrors();
+          cones.clearSelection();
+          cones.setVisible(false);
+          drawn = null;
+          preferred = null;
+          // Off: decoded tiles and lists go (several MB each over a city).
+          coverageTiles.clear();
+          pictureLists.clear();
+        },
+
+        destroy(cesiumViewer) {
+          coverage.detach();
+          coverage.clear();
+          coverage.resetErrors();
+          cones.destroy(cesiumViewer);
+        },
+
+        refreshCoverage: () => coverage.refresh(),
+
+        /** The filter changed: redraw. Each draw reads it from the context. */
+        setFilter() {
+          coverage.rebuild();
+          cones.rerender();
+        },
+
+        setSurface() {
+          coverage.setSurface();
+          cones.rerender();
+        },
+
+        coverageStats() {
+          const { kind } = state.coverage;
+          const lines = kind === 'sequence';
+          const shown = coverage.sequenceCount();
+          // Density dots are not sequences: they are not counted as such.
+          const count = lines ? shown : 0;
+          const loading = state.coverage.pending.size > 0;
+          const settled = !loading && !state.coverage.lastError;
+          let fallback = '';
+          // Tiles that held something the filter hid all of.
+          const filteredOut = [...state.coverage.tiles.values()].some(
+            (tile) => tile.total > 0,
+          );
+          if (kind === 'overview')
+            fallback =
+              shown > 0 || !settled
+                ? OVERVIEW_HINT
+                : filteredOut
+                  ? FILTERED_HINT
+                  : NO_COVERAGE_HINT;
+          else if (lines && settled && count === 0)
+            fallback = filteredOut ? FILTERED_HINT : NO_COVERAGE_HINT;
+          return {
+            count,
+            zoom: state.coverage.zoom,
+            kind: state.coverage.kind,
+            loading,
+            hint: state.coverage.hint || fallback,
+            error: state.coverage.lastError,
+            keyRequired: false,
+            keyRejected: false,
+          };
+        },
+
+        /**
+         * A line opens its sequence's picture nearest the click (the cones
+         * follow once it is on screen); a cone opens its picture.
+         */
+        handlePick(pickId, { groundPoint } = {}) {
+          if (pickId.startsWith(PICK_PREFIX.image)) {
+            context.actions.openImage(pickId.slice(PICK_PREFIX.image.length));
+            return true;
+          }
+          const sequenceId = sequenceIdFromPick(pickId, PICK_PREFIX.sequence);
+          if (!sequenceId) return false;
+          const point = groundPoint?.();
+          // No ground under the click (the sky beyond a line): nothing to open.
+          if (!point) return true;
+          anchors.set(sequenceId, { ...point, sequenceId });
+          preferred = {
+            sequenceId,
+            lon: point.lon,
+            lat: point.lat,
+            radius: lineClickRadius(),
+          };
+          context.actions.openNearest(point);
+          return true;
+        },
+
+        selectSequence: (sequenceId) =>
+          cones.select(sequenceId, { force: true }),
+        clearSequence: () => {
+          cones.clearSelection();
+          drawn = null;
+        },
+        sequenceStats: () => ({
+          selectedId: state.sequence.selectedId,
+          images: state.sequence.images.length,
+          loading: state.sequence.loading,
+        }),
+
+        /**
+         * The nearest picture within the search radius that passes the
+         * imagery filter, or null. After a click on a line, that line's
+         * sequence is asked first.
+         */
+        async nearestImage({ lat, lon }, { signal } = {}) {
+          const point = { lat, lon };
+          const filter = context.getFilter();
+          // Only the lookup the click itself asked for (the same point).
+          const wanted =
+            preferred && metresBetween(preferred, point) < 1 ? preferred : null;
+          preferred = null;
+          const ask = (collections, radius = NEAREST_RADIUS_M) =>
+            source.nearestItems(
+              {
+                lat,
+                lon,
+                radius,
+                limit: NEAREST_LIMIT,
+                collections,
+                pano: filter.pano,
+                sinceMs: filter.sinceMs,
+              },
+              { signal },
+            );
+          if (wanted) {
+            const hit = nearestOf(
+              await ask(wanted.sequenceId, wanted.radius),
+              point,
+              wanted.radius,
+            );
+            if (hit) return hit.id;
+          }
+          return nearestOf(await ask(null), point)?.id ?? null;
+        },
+
+        viewer,
+      };
+    },
+  });
+}

src/layers/streetLevel/providers/panoramax/policy.js

@@ -0,0 +1,319 @@
+import { COLORS as SHARED_COLORS, PROVIDER_COLORS } from '../../policy.js';
+
+export { NEAREST_RADIUS_M } from '../../policy.js';
+
+/** Identity and tuning for the Panoramax street-level provider (keyless). */
+export const PANORAMAX_PROVIDER_ID = 'panoramax';
+export const PANORAMAX_NAME = 'Panoramax';
+export const PANORAMAX_LABEL = 'PANORAMAX';
+
+/**
+ * The Panoramax meta-catalogue: one keyless, CORS-enabled STAC API over
+ * every federated instance (OpenStreetMap France, IGN, MapComplete…). Its
+ * pictures are served by the instance that holds them.
+ */
+export const PANORAMAX_API = 'https://api.panoramax.xyz/api';
+/** The meta-catalogue's web viewer, where the caption link goes. */
+export const PANORAMAX_VIEWER = 'https://api.panoramax.xyz/';
+
+/** Stable id prefixes for picked primitives; every one starts with `pnx:`. */
+export const PICK_PREFIX = Object.freeze({
+  root: 'pnx:',
+  sequence: 'pnx:seq:',
+  image: 'pnx:img:',
+});
+
+export const COLORS = Object.freeze({
+  coverage: PROVIDER_COLORS.panoramax,
+  selected: SHARED_COLORS.selected,
+});
+
+/**
+ * Sequence lines come from z7–15 tiles; z10–14 are drawn below 60 km, as
+ * Mapillary's are (a dense tile over Paris: z10 ~2.1 MB and 8,600
+ * sequences, z11 ~1.4 MB, z12 ~800 kB). Higher up, the z0–5 `grid` layer's
+ * density cells (0.1°, ~10 km) draw as points: lower down they would be a
+ * handful of dots over a whole city, which reads as no coverage.
+ */
+export const COVERAGE_Z14_BELOW_M = 1_800;
+export const COVERAGE_Z13_BELOW_M = 5_000;
+export const COVERAGE_Z12_BELOW_M = 12_000;
+export const COVERAGE_Z11_BELOW_M = 30_000;
+export const COVERAGE_LINES_BELOW_M = 60_000;
+export const COVERAGE_TUNING = Object.freeze({
+  maxTiles: 9,
+  overviewMaxTiles: 6,
+  // Each tile draws at most 1,600 lines, its longest first (as decoded,
+  // `keepOrder`): a dense z11
+  // tile over Paris holds 3,800, and a lower cap left the city centre
+  // looking emptier than its suburbs. (KartaView draws as many.)
+  maxSequences: 14_400,
+  keepOrder: true,
+  // Points drawn at most, over every tile (each becomes ~8 ground-line
+  // vertices, ~1.4 kB of geometry): the simplified Paris z10 tile alone
+  // holds 57,000, unsimplified 750,000, which hung the tab.
+  maxPoints: 90_000,
+  lineWidthPx: 2.5,
+  overviewPointPx: 4,
+  moveDebounceMs: 320,
+  viewRangeMinM: 2_500,
+  viewRangePerHeight: 10,
+  viewNearM: 1_000,
+});
+/**
+ * Lines are simplified (Douglas–Peucker) to this many tile units of a
+ * 4,096 extent: about a pixel where each zoom is drawn (1.6 m at z14,
+ * within GPS noise), and 6–10% of the points GPS tracks carry.
+ */
+export const SIMPLIFY_TOLERANCE_UNITS = 4;
+
+/**
+ * Coverage tiles decode in slices of this many ms, the page getting a turn
+ * between them (decode.js `decodeCoverageTileSliced`): under a frame.
+ */
+export const DECODE_SLICE_MS = 8;
+
+/**
+ * Grid cells per overview tile, at most: a z0 tile holds ~70,000 cells
+ * (1.9 MB), drawn as this many binned points.
+ */
+export const OVERVIEW_BINS_PER_AXIS = 96;
+
+export const RATE_LIMITED_MESSAGE =
+  'Panoramax is busy — coverage resumes on its own';
+export const NO_COVERAGE_HINT = 'no Panoramax photos in view';
+/** Lines in view, all hidden by the imagery filter. */
+export const FILTERED_HINT = 'no Panoramax photos here match the filters';
+export const UNREADABLE_TILE_MESSAGE =
+  'Panoramax sent a map tile that could not be read';
+export const GONE_MESSAGE = 'This Panoramax photo is no longer available';
+/** From high up the dots are where pictures are, not sequences to click. */
+export const OVERVIEW_HINT = 'zoom in to see Panoramax coverage';
+
+/** Cones come from z15 tiles' `pictures` layer (~110 bytes a picture). */
+export const PICTURE_TILE_ZOOM = 15;
+/** Within this of a z15 tile's edge, the neighbouring tile's pictures join. */
+export const PICTURE_TILE_EDGE_M = 150;
+
+export const TILE_TIMEOUT_MS = 20_000;
+/**
+ * Once an answer has started, it may take as long as it keeps coming: a
+ * 2 MB tile on a slow link outlasts any whole-request timeout, so only a
+ * stream silent this long is given up.
+ */
+export const STREAM_IDLE_TIMEOUT_MS = 15_000;
+/** Busy (429/503) without a Retry-After the browser can read: back off from this. */
+export const BUSY_BACKOFF_BASE_SEC = 5;
+export const API_TIMEOUT_MS = 12_000;
+/** Real tiles are under 6 MB (z6 over France); refuse anything absurd. */
+export const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
+/**
+ * The meta-catalogue speaks HTTP/1.1 only, so the browser opens six
+ * connections to it: coverage tiles take three, searches two and the
+ * cones' tiles one, so a click's lookup never queues behind megabyte tiles
+ * (it timed out doing so).
+ */
+export const API_CONCURRENCY = 2;
+export const TILE_CONCURRENCY = 3;
+/** The selected sequence's z15 tiles (cones) take the sixth. */
+export const PICTURE_TILE_CONCURRENCY = 1;
+
+/** Pictures asked for around a point; the API returns them nearest first. */
+export const NEAREST_LIMIT = 10;
+/**
+ * The widest the API allows: the point may be beside a picture, but a
+ * picture looking away from it is still left out (the bounding-box search
+ * beside it has those).
+ */
+export const NEAREST_FOV_TOLERANCE_DEG = 180;
+/**
+ * Pictures in the bounding box around a click, at most. The API returns
+ * them roughly nearest first (the first ten of 100 are the first ten of
+ * 10), and the browser ranks them exactly: 20 is ~60 kB, 100 ~600 kB.
+ */
+export const NEAREST_BOX_LIMIT = 20;
+/**
+ * A line clicked from high up may be tens of metres off the click: its
+ * sequence is searched within the camera height / 100 (50–400 m).
+ */
+export const LINE_CLICK_RADIUS_PER_HEIGHT = 0.01;
+export const LINE_CLICK_RADIUS_MAX_M = 400;
+
+/** A full-resolution panorama is only fetched up to this width (memory). */
+export const PANO_HD_MAX_WIDTH = 8_192;
+/** An HD panorama can be several megabytes. */
+export const HD_TIMEOUT_MS = 30_000;
+/** Panoramax's SD derivative is 2,048 px wide, its thumbnail 500 px. */
+export const SD_WIDTH = 2_048;
+
+/** On-globe credit: licences are per picture, named in the caption. */
+export const PANORAMAX_CREDIT_HTML =
+  'Street Level: imagery © <a href="https://panoramax.fr" target="_blank" rel="noopener">Panoramax</a> contributors, licence per picture';
+
+export const LINE_CLICK_HINT = 'click a line for its nearest photo';
+
+/** Licence ids Panoramax uses, as the caption names them. */
+const LICENSE_LABELS = Object.freeze({
+  'CC-BY-SA-4.0': 'CC BY-SA 4.0',
+  'CC-BY-4.0': 'CC BY 4.0',
+  'CC0-1.0': 'CC0',
+  'etalab-2.0': 'Licence Ouverte 2.0',
+});
+
+/** The caption's licence name for a STAC licence id, or null. */
+export function licenseLabel(license) {
+  if (typeof license !== 'string' || !license.trim()) return null;
+  const id = license.trim();
+  if (id === 'proprietary' || id === 'other') return null;
+  return LICENSE_LABELS[id] || id.slice(0, 40);
+}
+
+/** Deep link to a picture in the Panoramax web viewer. */
+export function panoramaxPictureUrl(pictureId) {
+  const id = String(pictureId ?? '').trim();
+  if (!id) return PANORAMAX_VIEWER;
+  return `${PANORAMAX_VIEWER}#${new URLSearchParams({ pic: id, focus: 'pic' })}`;
+}
+
+/** Epoch ms for a capture time ('2023-12-12T07:54:47+00:00', '2023-12-12 07:56:37+00'), or null. */
+export function panoramaxTimeMs(value) {
+  if (typeof value !== 'string' || !value) return null;
+  // Tile timestamps are Postgres text: a space and an hour-only offset.
+  const iso = /\d[T ]\d/.test(value)
+    ? value
+        .replace(' ', 'T')
+        .replace(/([+-]\d{2})$/, '$1:00')
+        .replace(/\.(\d{3})\d+/, '.$1')
+    : value;
+  const ms = Date.parse(iso);
+  return Number.isFinite(ms) && ms > Date.UTC(1990, 0, 1) ? ms : null;
+}
+
+/** An https address, or null (asset links come from federated instances). */
+function httpsUrl(value) {
+  try {
+    const url = new URL(String(value));
+    return url.protocol === 'https:' ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Last path segment of an item's `rel` link: the linked picture's id. */
+function linkedId(item, rel) {
+  const href = item?.links?.find?.((link) => link?.rel === rel)?.href;
+  if (typeof href !== 'string') return null;
+  const id = href.split(/[?#]/)[0].split('/').filter(Boolean).pop();
+  if (!id) return null;
+  try {
+    return decodeURIComponent(id);
+  } catch {
+    // A malformed escape is no link, not a failed lookup.
+    return null;
+  }
+}
+
+/**
+ * An email address anywhere in a name, at any of its '@'s. Linear: names
+ * come from any instance, and each run between '@'s is scanned once.
+ */
+function looksLikeEmail(name) {
+  return /[^\s@]@[^\s@]+\.[^\s@]/.test(name);
+}
+
+/**
+ * Who took the picture. Producers are account names, and some accounts
+ * are named by an email address: those are not repeated in the caption.
+ */
+function creatorOf(item) {
+  const props = item.properties || {};
+  const names = [
+    props['geovisio:producer'],
+    ...(Array.isArray(item.providers)
+      ? item.providers
+          .filter((p) => p?.roles?.includes?.('producer'))
+          .map((p) => p.name)
+      : []),
+  ];
+  // Every producer is credited (an uploading app and its photographer),
+  // each name once, none that is an email address.
+  const credited = [];
+  const seen = new Set();
+  for (const value of names) {
+    if (typeof value !== 'string') continue;
+    const name = value.trim().slice(0, 80);
+    if (!name || looksLikeEmail(value)) continue;
+    const key = name.toLowerCase();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    credited.push(name);
+  }
+  return credited.length ? credited.join(', ').slice(0, 120) : null;
+}
+
+/** The federated instance holding a picture (its `via` link's host), or null. */
+function instanceOf(item) {
+  const href = item?.links?.find?.((link) => link?.rel === 'via')?.href;
+  try {
+    const url = new URL(String(href));
+    return url.protocol === 'https:' ? url.hostname.slice(0, 80) : null;
+  } catch {
+    return null;
+  }
+}
+
+/** A 360° picture: a full-sphere field of view or an equirectangular projection. */
+export function isEquirectangular(item) {
+  const props = item?.properties || {};
+  const orientation = props['pers:interior_orientation'];
+  if (Number(orientation?.field_of_view) >= 360) return true;
+  return props['pers:projection'] === 'equirectangular';
+}
+
+/**
+ * A STAC item (from search or a collection) in the shape the provider and
+ * viewer use, or null without an id or a position.
+ * @returns {{id: string, sequenceId: string|null, lon: number, lat: number, heading: number|null, isPano: boolean, capturedAt: number|null, creator: string|null, license: string|null, width: number|null, prevId: string|null, nextId: string|null, urls: {thumb: string|null, sd: string|null, hd: string|null}}|null}
+ */
+export function normalizeItem(item) {
+  if (!item || item.id == null) return null;
+  // Only numbers: Number(null) and Number('') would put a picture at 0,0.
+  const [lon, lat] = Array.isArray(item.geometry?.coordinates)
+    ? item.geometry.coordinates.map((value) =>
+        typeof value === 'number' ? value : NaN,
+      )
+    : [NaN, NaN];
+  if (!Number.isFinite(lat) || !Number.isFinite(lon)) return null;
+  if (Math.abs(lat) > 90 || Math.abs(lon) > 180) return null;
+  const props = item.properties || {};
+  const assets = item.assets || {};
+  const azimuth =
+    props['view:azimuth'] === '' || props['view:azimuth'] == null
+      ? NaN
+      : Number(props['view:azimuth']);
+  const width = Number(
+    props['pers:interior_orientation']?.sensor_array_dimensions?.[0],
+  );
+  return {
+    id: String(item.id),
+    sequenceId: item.collection != null ? String(item.collection) : null,
+    lon,
+    lat,
+    heading: Number.isFinite(azimuth) ? ((azimuth % 360) + 360) % 360 : null,
+    isPano: isEquirectangular(item),
+    capturedAt: panoramaxTimeMs(props.datetime),
+    creator: creatorOf(item),
+    // Licences ask for the source to be named: where no author can be
+    // named, the caption names the instance holding the picture.
+    via: instanceOf(item),
+    license: licenseLabel(props.license),
+    width: Number.isFinite(width) && width > 0 ? width : null,
+    prevId: linkedId(item, 'prev'),
+    nextId: linkedId(item, 'next'),
+    urls: {
+      thumb: httpsUrl(assets.thumb?.href),
+      sd: httpsUrl(assets.sd?.href),
+      hd: httpsUrl(assets.hd?.href),
+    },
+  };
+}

src/layers/streetLevel/providers/panoramax/policy.test.mjs

@@ -0,0 +1,281 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  COLORS,
+  PICK_PREFIX,
+  isEquirectangular,
+  licenseLabel,
+  normalizeItem,
+  panoramaxPictureUrl,
+  panoramaxTimeMs,
+} from './policy.js';
+import { PROVIDER_COLORS } from '../../policy.js';
+import { stacItem } from '../../../../testSupport/panoramaxFixtures.mjs';
+
+test('Panoramax draws in its own orange, and every pick id starts pnx:', () => {
+  assert.equal(COLORS.coverage, '#ff6f00');
+  assert.equal(PROVIDER_COLORS.panoramax, '#ff6f00');
+  for (const prefix of Object.values(PICK_PREFIX))
+    assert.ok(prefix.startsWith('pnx:'));
+  // One colour per source.
+  assert.equal(
+    new Set(Object.values(PROVIDER_COLORS)).size,
+    Object.keys(PROVIDER_COLORS).length,
+  );
+});
+
+test('capture times parse in the API’s ISO form, the tiles’ Postgres form, and as bare days', () => {
+  assert.equal(
+    panoramaxTimeMs('2023-12-12T07:54:47+00:00'),
+    Date.UTC(2023, 11, 12, 7, 54, 47),
+  );
+  assert.equal(
+    panoramaxTimeMs('2023-12-12 07:56:37+00'),
+    Date.UTC(2023, 11, 12, 7, 56, 37),
+  );
+  assert.equal(
+    panoramaxTimeMs('2025-08-13 07:45:51.98+00'),
+    Date.UTC(2025, 7, 13, 7, 45, 51, 980),
+  );
+  // Microseconds are cut to what Date.parse reads.
+  assert.equal(
+    panoramaxTimeMs('2025-08-03T14:38:51.838000+00:00'),
+    Date.UTC(2025, 7, 3, 14, 38, 51, 838),
+  );
+  // A sequence's day: its trailing "-11" is the day, not a UTC offset.
+  assert.equal(panoramaxTimeMs('2025-08-11'), Date.UTC(2025, 7, 11));
+  assert.equal(
+    panoramaxTimeMs('2025-08-13 09:00:00+02'),
+    Date.UTC(2025, 7, 13, 7),
+  );
+  for (const bad of ['', 'junk', '1970-01-01', null, 42])
+    assert.equal(panoramaxTimeMs(bad), null, String(bad));
+});
+
+test('a STAC item becomes a picture: position, heading, 360°, licence, links and assets', () => {
+  const photo = normalizeItem(
+    stacItem({
+      id: 'a',
+      lon: 2.35,
+      lat: 48.85,
+      sequenceId: 's',
+      heading: 370,
+      pano: true,
+      license: 'etalab-2.0',
+      prevId: 'p',
+      nextId: 'n',
+    }),
+  );
+  assert.deepEqual(
+    {
+      id: photo.id,
+      sequenceId: photo.sequenceId,
+      lon: photo.lon,
+      lat: photo.lat,
+      heading: photo.heading,
+      isPano: photo.isPano,
+      license: photo.license,
+      width: photo.width,
+      prevId: photo.prevId,
+      nextId: photo.nextId,
+      creator: photo.creator,
+    },
+    {
+      id: 'a',
+      sequenceId: 's',
+      lon: 2.35,
+      lat: 48.85,
+      heading: 10,
+      isPano: true,
+      license: 'Licence Ouverte 2.0',
+      width: 5760,
+      prevId: 'p',
+      nextId: 'n',
+      creator: 'tester',
+    },
+  );
+  assert.equal(
+    photo.urls.sd,
+    'https://panoramax.example.org/pictures/a/sd.jpg',
+  );
+  assert.equal(photo.capturedAt, Date.UTC(2025, 5, 1, 10));
+});
+
+test('a picture without links, heading or a usable position', () => {
+  const bare = normalizeItem({
+    id: 7,
+    geometry: { coordinates: [1, 2] },
+    properties: {},
+  });
+  assert.equal(bare.id, '7');
+  assert.equal(bare.heading, null);
+  assert.equal(bare.prevId, null);
+  assert.equal(bare.nextId, null);
+  assert.equal(bare.sequenceId, null);
+  assert.equal(bare.isPano, false);
+  assert.equal(bare.capturedAt, null);
+  assert.deepEqual(bare.urls, { thumb: null, sd: null, hd: null });
+  for (const item of [
+    null,
+    { geometry: { coordinates: [1, 2] } },
+    { id: 'x', geometry: { coordinates: ['a', 2] } },
+    { id: 'x', geometry: { coordinates: [181, 2] } },
+    { id: 'x', geometry: { coordinates: [1, 91] } },
+    { id: 'x' },
+  ])
+    assert.equal(normalizeItem(item), null, JSON.stringify(item));
+});
+
+test('asset links that are not https are dropped', () => {
+  const item = stacItem({ id: 'a', lon: 1, lat: 2 });
+  item.assets.sd.href = 'http://insecure.example/sd.jpg';
+  item.assets.hd.href = 'javascript:alert(1)';
+  const photo = normalizeItem(item);
+  assert.equal(photo.urls.sd, null);
+  assert.equal(photo.urls.hd, null);
+  assert.ok(photo.urls.thumb.startsWith('https://'));
+});
+
+test('an account named by an email address is not shown as the creator', () => {
+  const named = (producer) =>
+    normalizeItem(stacItem({ id: 'a', lon: 1, lat: 2, producer })).creator;
+  assert.equal(named('[email protected]'), null);
+  assert.equal(named('Robot8A'), 'Robot8A');
+  assert.equal(named('  padded  '), 'padded');
+  assert.equal(named('x'.repeat(200)).length, 80);
+  // The producer role among the providers serves when the property is missing.
+  const item = stacItem({ id: 'a', lon: 1, lat: 2 });
+  delete item.properties['geovisio:producer'];
+  item.providers = [
+    { name: 'host', roles: ['host'] },
+    { name: 'mapper', roles: ['producer'] },
+  ];
+  assert.equal(normalizeItem(item).creator, 'mapper');
+});
+
+test('360°: a full field of view, or the equirectangular projection', () => {
+  assert.equal(
+    isEquirectangular({
+      properties: { 'pers:interior_orientation': { field_of_view: 360 } },
+    }),
+    true,
+  );
+  assert.equal(
+    isEquirectangular({ properties: { 'pers:projection': 'equirectangular' } }),
+    true,
+  );
+  assert.equal(
+    isEquirectangular({
+      properties: { 'pers:interior_orientation': { field_of_view: 92 } },
+    }),
+    false,
+  );
+  assert.equal(isEquirectangular(null), false);
+});
+
+test('licences read as the caption names them', () => {
+  assert.equal(licenseLabel('CC-BY-SA-4.0'), 'CC BY-SA 4.0');
+  assert.equal(licenseLabel('etalab-2.0'), 'Licence Ouverte 2.0');
+  assert.equal(licenseLabel('CC0-1.0'), 'CC0');
+  assert.equal(licenseLabel('ODbL-1.0'), 'ODbL-1.0');
+  assert.equal(licenseLabel('proprietary'), null);
+  assert.equal(licenseLabel(''), null);
+  assert.equal(licenseLabel(undefined), null);
+  assert.equal(licenseLabel('x'.repeat(100)).length, 40);
+});
+
+test('the caption link opens the picture in the Panoramax viewer', () => {
+  assert.equal(
+    panoramaxPictureUrl('d5467bbb-4357'),
+    'https://api.panoramax.xyz/#pic=d5467bbb-4357&focus=pic',
+  );
+  assert.equal(panoramaxPictureUrl(''), 'https://api.panoramax.xyz/');
+  assert.equal(panoramaxPictureUrl(null), 'https://api.panoramax.xyz/');
+  assert.ok(panoramaxPictureUrl('a&b=c').includes('pic=a%26b%3Dc'));
+});
+
+test('hostile item data: a malformed link escape, null coordinates, a huge producer name', () => {
+  const item = stacItem({ id: 'a', lon: 1, lat: 2, nextId: 'n' });
+  item.links.push({
+    rel: 'prev',
+    href: 'https://api.panoramax.xyz/api/collections/s/items/%E0%A4%A',
+  });
+  const photo = normalizeItem(item);
+  assert.equal(photo.prevId, null, 'no link, no throw');
+  assert.equal(photo.nextId, 'n');
+  for (const coordinates of [[null, null], ['', ''], ['2.35', '48.85'], [2.35]])
+    assert.equal(
+      normalizeItem({ id: 'x', geometry: { coordinates } }),
+      null,
+      JSON.stringify(coordinates),
+    );
+  // A million characters without spaces is checked in linear time.
+  const started = Date.now();
+  const huge = normalizeItem(
+    stacItem({ id: 'a', lon: 1, lat: 2, producer: 'a'.repeat(1_000_000) }),
+  );
+  assert.ok(Date.now() - started < 500, `${Date.now() - started} ms`);
+  assert.equal(huge.creator.length, 80);
+  const named = (producer) =>
+    normalizeItem(stacItem({ id: 'a', lon: 1, lat: 2, producer })).creator;
+  assert.equal(named(`${'x'.repeat(200_000)}@example.org`), null);
+  assert.equal(
+    named('Carto@Cité'),
+    'Carto@Cité',
+    'an @ without a domain is a name',
+  );
+  // The address need not follow the first '@'.
+  assert.equal(named('@team [email protected]'), null);
+  assert.equal(named('Carto@Cité ([email protected])'), null);
+  assert.equal(named(`${'@'.repeat(100_000)}x`), `${'@'.repeat(80)}`);
+});
+
+test('thousands of producers are credited in linear time', () => {
+  const item = stacItem({ id: 'a', lon: 1, lat: 2 });
+  item.providers = Array.from({ length: 50_000 }, (_, i) => ({
+    name: `producer-${i}`,
+    roles: ['producer'],
+  }));
+  const started = performance.now();
+  const { creator } = normalizeItem(item);
+  assert.ok(performance.now() - started < 1000);
+  assert.ok(creator.startsWith('tester, producer-0, producer-1'));
+  assert.ok(creator.length <= 120);
+});
+
+test('the instance holding a picture is named (its via host), never as its author', () => {
+  const item = stacItem({
+    id: 'a',
+    lon: 1,
+    lat: 2,
+    producer: '[email protected]',
+  });
+  item.links.push({ rel: 'via', href: 'https://panoramax.ign.fr' });
+  assert.equal(normalizeItem(item).creator, null);
+  assert.equal(normalizeItem(item).via, 'panoramax.ign.fr');
+  item.links.at(-1).href = 'http://insecure.example';
+  assert.equal(normalizeItem(item).via, null);
+  item.links.at(-1).href = 'not a url';
+  assert.equal(normalizeItem(item).via, null);
+});
+
+test('every producer is credited once: the uploading app and its photographer', () => {
+  const item = stacItem({ id: 'a', lon: 1, lat: 2, producer: 'mapcomplete' });
+  item.providers = [
+    { name: 'mapcomplete', roles: ['producer'] },
+    { name: 'pyrog', roles: ['producer'] },
+    { name: 'MapComplete', roles: ['producer'] },
+    { name: '[email protected]', roles: ['producer'] },
+    { name: 'host', roles: ['host'] },
+  ];
+  assert.equal(normalizeItem(item).creator, 'mapcomplete, pyrog');
+  const hidden = stacItem({ id: 'b', lon: 1, lat: 2, producer: '[email protected]' });
+  hidden.providers = [{ name: '[email protected]', roles: ['producer'] }];
+  assert.equal(normalizeItem(hidden).creator, null);
+  const many = stacItem({ id: 'c', lon: 1, lat: 2 });
+  many.providers = Array.from({ length: 50 }, (_, i) => ({
+    name: `producer-${i}`,
+    roles: ['producer'],
+  }));
+  assert.ok(normalizeItem(many).creator.length <= 120);
+});

src/layers/streetLevel/providers/panoramax/source.js

@@ -0,0 +1,301 @@
+import { createLimiter } from '../../limiter.js';
+import {
+  API_CONCURRENCY,
+  API_TIMEOUT_MS,
+  BUSY_BACKOFF_BASE_SEC,
+  MAX_RESPONSE_BYTES,
+  NEAREST_BOX_LIMIT,
+  NEAREST_FOV_TOLERANCE_DEG,
+  NEAREST_LIMIT,
+  NEAREST_RADIUS_M,
+  PANORAMAX_API,
+  PICTURE_TILE_CONCURRENCY,
+  STREAM_IDLE_TIMEOUT_MS,
+  TILE_CONCURRENCY,
+  TILE_TIMEOUT_MS,
+} from './policy.js';
+
+/** Longest wait a Retry-After (or the backoff) asks for. */
+const RETRY_AFTER_MAX_SEC = 300;
+
+/** An HTTP or API failure; `retryAfterSec` is set while Panoramax is busy. */
+export class PanoramaxSourceError extends Error {
+  constructor(message, { status = 0, retryAfterSec = null } = {}) {
+    super(message);
+    this.name = 'PanoramaxSourceError';
+    this.status = status;
+    this.retryAfterSec = retryAfterSec;
+  }
+}
+
+const NO_ANSWER = 'Panoramax did not answer in time — try again';
+const UNREACHABLE = 'Panoramax could not be reached — check the connection';
+
+/**
+ * Seconds from a Retry-After header (delay seconds or an HTTP date), or
+ * null. The meta-catalogue exposes no headers to the browser, so in the
+ * app this is usually null and the caller backs off on its own.
+ */
+export function retryAfterSeconds(response, now = Date.now()) {
+  const header = response.headers?.get?.('retry-after');
+  if (header == null || header === '') return null;
+  let value = Number(header);
+  if (!Number.isFinite(value)) {
+    const at = Date.parse(header);
+    if (!Number.isFinite(at)) return null;
+    value = Math.ceil((at - now) / 1000);
+  }
+  if (value < 0) return null;
+  // A maintenance page's hour must not freeze coverage for an hour.
+  return Math.min(RETRY_AFTER_MAX_SEC, Math.max(1, value));
+}
+
+/**
+ * The body as bytes, refusing more than MAX_RESPONSE_BYTES whatever the
+ * headers say. `onChunk` hears each piece arrive (the idle timeout).
+ */
+async function readBounded(response, onChunk = () => {}) {
+  const tooMuch = () =>
+    new PanoramaxSourceError('Panoramax sent too much data', {
+      status: response.status,
+    });
+  const length = Number(response.headers?.get?.('content-length'));
+  if (length > MAX_RESPONSE_BYTES) throw tooMuch();
+  const reader = response.body?.getReader?.();
+  if (!reader) {
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > MAX_RESPONSE_BYTES) throw tooMuch();
+    return bytes;
+  }
+  const chunks = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    onChunk();
+    total += value.byteLength;
+    if (total > MAX_RESPONSE_BYTES) {
+      reader.cancel().catch(() => {});
+      throw tooMuch();
+    }
+    chunks.push(value);
+  }
+  const body = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body;
+}
+
+/**
+ * Every network path the Panoramax provider uses, browser-side and keyless:
+ * the meta-catalogue allows any origin. Vector tiles for coverage and
+ * cones, STAC search for single pictures and nearest ones.
+ * @param {{fetchImpl?: typeof fetch, api?: string}} [options]
+ */
+export function createPanoramaxSource({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  api = PANORAMAX_API,
+} = {}) {
+  const root = api.replace(/\/+$/, '');
+  const apiLimiter = createLimiter(API_CONCURRENCY, { lifo: true });
+  const tileLimiter = createLimiter(TILE_CONCURRENCY);
+  // The cones' z15 tiles have their own connection: a selection never
+  // waits behind coverage tiles.
+  const pictureLimiter = createLimiter(PICTURE_TILE_CONCURRENCY, {
+    lifo: true,
+  });
+
+  /** Busy answers in a row with no readable Retry-After (the backoff grows). */
+  let busyStreak = 0;
+
+  /**
+   * GET: its headers within `timeoutMs`, then a body that may take as long
+   * as it keeps arriving (silent for STREAM_IDLE_TIMEOUT_MS is given up).
+   * The caller's abort wins over both.
+   */
+  async function get(url, { signal, timeoutMs, empty = [] }) {
+    const controller = new AbortController();
+    const onAbort = () => controller.abort(signal.reason);
+    if (signal?.aborted) throw signal.reason;
+    signal?.addEventListener('abort', onAbort, { once: true });
+    const giveUp = () => controller.abort(new PanoramaxSourceError(NO_ANSWER));
+    let timer = setTimeout(giveUp, timeoutMs);
+    try {
+      const response = await fetchImpl(url, { signal: controller.signal });
+      if (empty.includes(response.status)) {
+        busyStreak = 0;
+        return null;
+      }
+      if (response.status === 429 || response.status === 503) {
+        const told = retryAfterSeconds(response);
+        // Not told how long: back off, longer each time (5, 10, 20… 300 s).
+        const wait =
+          told ??
+          Math.min(
+            RETRY_AFTER_MAX_SEC,
+            BUSY_BACKOFF_BASE_SEC * 2 ** Math.min(busyStreak, 8),
+          );
+        busyStreak++;
+        throw new PanoramaxSourceError('Panoramax is busy', {
+          status: response.status,
+          retryAfterSec: wait,
+        });
+      }
+      if (!response.ok)
+        throw new PanoramaxSourceError(
+          `Panoramax answered HTTP ${response.status}`,
+          { status: response.status },
+        );
+      busyStreak = 0;
+      // The answer has begun: from here only silence is timed.
+      clearTimeout(timer);
+      timer = setTimeout(giveUp, STREAM_IDLE_TIMEOUT_MS);
+      return await readBounded(response, () => {
+        clearTimeout(timer);
+        timer = setTimeout(giveUp, STREAM_IDLE_TIMEOUT_MS);
+      });
+    } catch (error) {
+      if (signal?.aborted) throw signal.reason;
+      if (controller.signal.aborted) throw controller.signal.reason;
+      if (error instanceof PanoramaxSourceError) throw error;
+      // Offline, or a CORS or TLS failure: not a timeout, not worth a retry.
+      throw new PanoramaxSourceError(UNREACHABLE);
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+    }
+  }
+
+  /**
+   * A STAC search, through the API gate (newest request first). One that
+   * timed out is asked once more: a search is quick once the connection
+   * is free.
+   */
+  async function search(params, { signal } = {}) {
+    const url = `${root}/search?${new URLSearchParams(params)}`;
+    const once = () =>
+      apiLimiter.run(() => get(url, { signal, timeoutMs: API_TIMEOUT_MS }), {
+        signal,
+      });
+    let bytes;
+    try {
+      bytes = await once();
+    } catch (error) {
+      if (signal?.aborted || error?.message !== NO_ANSWER) throw error;
+      bytes = await once();
+    }
+    let payload;
+    try {
+      payload = JSON.parse(new TextDecoder().decode(bytes));
+    } catch {
+      throw new PanoramaxSourceError('Panoramax sent an unreadable answer');
+    }
+    return Array.isArray(payload?.features) ? payload.features : [];
+  }
+
+  return {
+    api: root,
+
+    /** Raw vector-tile bytes; an empty array where there is no coverage. */
+    async getTile({ x, y, z }, { signal, lane = 'coverage' } = {}) {
+      const url = `${root}/map/${z}/${x}/${y}.mvt`;
+      const gate = lane === 'pictures' ? pictureLimiter : tileLimiter;
+      const bytes = await gate.run(
+        () =>
+          get(url, { signal, timeoutMs: TILE_TIMEOUT_MS, empty: [204, 404] }),
+        { signal },
+      );
+      return bytes ?? new Uint8Array(0);
+    },
+
+    /** One picture (a STAC item) by id, or null. */
+    async getItem(id, { signal } = {}) {
+      const [item] = await search({ ids: String(id), limit: '1' }, { signal });
+      return item && String(item.id) === String(id) ? item : null;
+    },
+
+    /**
+     * Pictures within `radius` metres of a point, unranked: the caller ranks
+     * them by distance. Two searches side by side, since neither finds them
+     * all: `place_position` (nearest first) leaves out pictures looking
+     * away from the point, whatever the tolerance; a bounding box has them,
+     * roughly nearest first (not exactly: the caller ranks the union).
+     * `collections` keeps one sequence's, `pano` and `sinceMs` filter as
+     * the imagery filter does.
+     */
+    async nearestItems(
+      {
+        lat,
+        lon,
+        radius = NEAREST_RADIUS_M,
+        limit = NEAREST_LIMIT,
+        collections = null,
+        pano = 'all',
+        sinceMs = null,
+      },
+      { signal } = {},
+    ) {
+      const metres = Math.min(1000, Math.max(1, Math.round(radius)));
+      const shared = {};
+      if (collections) shared.collections = String(collections);
+      if (pano === 'pano') shared.filter = 'field_of_view=360';
+      else if (pano === 'flat') shared.filter = 'field_of_view<360';
+      if (Number.isFinite(sinceMs) && sinceMs > 0)
+        shared.datetime = `${new Date(sinceMs).toISOString()}/..`;
+      const dLat = metres / 111_320;
+      const dLon =
+        metres / (111_320 * Math.max(0.01, Math.cos((lat * Math.PI) / 180)));
+      // Clamped to the map: the API finds nothing in a box past ±180°.
+      const box = [
+        Math.max(-180, lon - dLon),
+        Math.max(-90, lat - dLat),
+        Math.min(180, lon + dLon),
+        Math.min(90, lat + dLat),
+      ].map((v) => v.toFixed(7));
+      // One search failing (busy, no answer) leaves the other's pictures;
+      // only both failing fails the lookup. The caller's abort stops both.
+      const both = new AbortController();
+      const onAbort = () => both.abort(signal.reason);
+      if (signal?.aborted) throw signal.reason;
+      signal?.addEventListener('abort', onAbort, { once: true });
+      const run = (params) =>
+        search(params, { signal: both.signal }).catch((error) => {
+          if (!both.signal.aborted && !signal?.aborted) failures.push(error);
+          throw error;
+        });
+      const failures = [];
+      let settled;
+      try {
+        settled = await Promise.allSettled([
+          run({
+            place_position: `${Number(lon).toFixed(7)},${Number(lat).toFixed(7)}`,
+            place_distance: `0-${metres}`,
+            place_fov_tolerance: String(NEAREST_FOV_TOLERANCE_DEG),
+            limit: String(Math.min(100, Math.max(1, limit))),
+            ...shared,
+          }),
+          run({
+            bbox: box.join(','),
+            limit: String(NEAREST_BOX_LIMIT),
+            ...shared,
+          }),
+        ]);
+      } finally {
+        signal?.removeEventListener('abort', onAbort);
+      }
+      if (signal?.aborted) throw signal.reason;
+      const found = settled
+        .filter((result) => result.status === 'fulfilled')
+        .map((result) => result.value);
+      if (!found.length) throw failures[0] ?? settled[0].reason;
+      const byId = new Map();
+      for (const item of found.flat())
+        if (item?.id != null && !byId.has(String(item.id)))
+          byId.set(String(item.id), item);
+      return [...byId.values()];
+    },
+  };
+}

src/layers/streetLevel/providers/panoramax/source.test.mjs

@@ -0,0 +1,513 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  PanoramaxSourceError,
+  createPanoramaxSource,
+  retryAfterSeconds,
+} from './source.js';
+import {
+  MAX_RESPONSE_BYTES,
+  NEAREST_BOX_LIMIT,
+  STREAM_IDLE_TIMEOUT_MS,
+  TILE_TIMEOUT_MS,
+} from './policy.js';
+
+/** A fetch answering from `respond(url)`, recording every URL asked. */
+function fakeFetch(respond) {
+  const urls = [];
+  const fetchImpl = async (url, { signal } = {}) => {
+    urls.push(url);
+    const answer = await respond(url, signal);
+    if (answer instanceof Response) return answer;
+    const { status = 200, body = '', headers = {} } = answer;
+    return new Response(status === 204 ? null : body, { status, headers });
+  };
+  return { urls, fetchImpl };
+}
+
+const json = (value) => ({ body: JSON.stringify(value) });
+
+test('a tile is the raw vector-tile bytes; 204 and 404 mean no coverage', async () => {
+  const { urls, fetchImpl } = fakeFetch((url) =>
+    url.includes('/14/')
+      ? { body: new Uint8Array([1, 2, 3]) }
+      : { status: 204 },
+  );
+  const source = createPanoramaxSource({ fetchImpl });
+  assert.deepEqual(
+    [...(await source.getTile({ x: 8299, y: 5634, z: 14 }))],
+    [1, 2, 3],
+  );
+  assert.equal(urls[0], 'https://api.panoramax.xyz/api/map/14/8299/5634.mvt');
+  assert.equal((await source.getTile({ x: 1, y: 1, z: 13 })).length, 0);
+  const missing = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({ status: 404 })).fetchImpl,
+  });
+  assert.equal((await missing.getTile({ x: 1, y: 1, z: 13 })).length, 0);
+});
+
+test('a busy API says so and when to come back; other failures name the status', async () => {
+  const busy = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({
+      status: 429,
+      headers: { 'retry-after': '12' },
+    })).fetchImpl,
+  });
+  await assert.rejects(busy.getTile({ x: 0, y: 0, z: 0 }), (error) => {
+    assert.ok(error instanceof PanoramaxSourceError);
+    assert.equal(error.status, 429);
+    assert.equal(error.retryAfterSec, 12);
+    return true;
+  });
+  const down = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({ status: 503 })).fetchImpl,
+  });
+  await assert.rejects(down.getTile({ x: 0, y: 0, z: 0 }), (error) => {
+    assert.equal(error.retryAfterSec, 5, 'a default wait without the header');
+    return true;
+  });
+  const broken = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({ status: 500 })).fetchImpl,
+  });
+  await assert.rejects(broken.getItem('x'), /HTTP 500/);
+});
+
+test('an oversized answer is refused while it streams', async () => {
+  let pulled = 0;
+  const huge = new ReadableStream({
+    pull(controller) {
+      pulled++;
+      controller.enqueue(new Uint8Array(4 * 1024 * 1024));
+    },
+  });
+  const source = createPanoramaxSource({
+    fetchImpl: async () => new Response(huge, { status: 200 }),
+  });
+  await assert.rejects(source.getTile({ x: 0, y: 0, z: 0 }), /too much data/);
+  assert.ok(pulled * 4 * 1024 * 1024 <= MAX_RESPONSE_BYTES + 8 * 1024 * 1024);
+  // A declared length over the cap is refused before reading.
+  const declared = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({
+      body: 'x',
+      headers: { 'content-length': String(MAX_RESPONSE_BYTES + 1) },
+    })).fetchImpl,
+  });
+  await assert.rejects(declared.getItem('a'), /too much data/);
+});
+
+test('a picture by id is a STAC search; another id in the answer is not taken for it', async () => {
+  const { urls, fetchImpl } = fakeFetch((url) =>
+    url.includes('ids=good')
+      ? json({ features: [{ id: 'good' }] })
+      : json({ features: [{ id: 'other' }] }),
+  );
+  const source = createPanoramaxSource({ fetchImpl });
+  assert.deepEqual(await source.getItem('good'), { id: 'good' });
+  assert.equal(await source.getItem('bad'), null);
+  const asked = new URL(urls[0]);
+  assert.equal(asked.pathname, '/api/search');
+  assert.equal(asked.searchParams.get('ids'), 'good');
+  assert.equal(asked.searchParams.get('limit'), '1');
+});
+
+test('nearest pictures: a place search and a box search side by side, both filtered as the imagery filter asks', async () => {
+  const { urls, fetchImpl } = fakeFetch(() => json({ features: [] }));
+  const source = createPanoramaxSource({ fetchImpl });
+  await source.nearestItems({ lat: 48.85, lon: 2.35 });
+  await source.nearestItems({
+    lat: 48.85,
+    lon: 2.35,
+    collections: 'seq',
+    pano: 'pano',
+    sinceMs: Date.UTC(2025, 0, 1),
+    radius: 5000,
+    limit: 500,
+  });
+  await source.nearestItems({ lat: 48.85, lon: 2.35, pano: 'flat' });
+  const asked = urls.map((u) => new URL(u).searchParams);
+  assert.equal(asked.length, 6, 'two searches a lookup');
+  const place = asked.filter((q) => q.has('place_position'));
+  const box = asked.filter((q) => q.has('bbox'));
+  assert.equal(place.length, 3);
+  assert.equal(box.length, 3);
+  const [plain, filtered, flat] = place;
+  assert.equal(plain.get('place_position'), '2.3500000,48.8500000');
+  assert.equal(plain.get('place_distance'), '0-50');
+  assert.equal(plain.get('place_fov_tolerance'), '180');
+  assert.equal(plain.get('collections'), null);
+  assert.equal(plain.get('filter'), null);
+  assert.equal(plain.get('datetime'), null);
+  assert.equal(filtered.get('collections'), 'seq');
+  assert.equal(filtered.get('filter'), 'field_of_view=360');
+  assert.equal(filtered.get('datetime'), '2025-01-01T00:00:00.000Z/..');
+  assert.equal(filtered.get('place_distance'), '0-1000', 'capped');
+  assert.equal(filtered.get('limit'), '100', 'capped');
+  assert.equal(flat.get('filter'), 'field_of_view<360');
+  // The box spans the radius each way, and carries the same filters.
+  const [w, s, e, n] = box[0].get('bbox').split(',').map(Number);
+  assert.ok(Math.abs((n - s) * 111_320 - 100) < 1, `${n - s}°`);
+  assert.ok(
+    Math.abs((e - w) * 111_320 * Math.cos((48.85 * Math.PI) / 180) - 100) < 1,
+  );
+  assert.equal(box[1].get('collections'), 'seq');
+  assert.equal(box[1].get('filter'), 'field_of_view=360');
+  assert.equal(box[1].get('datetime'), '2025-01-01T00:00:00.000Z/..');
+  assert.equal(box[2].get('filter'), 'field_of_view<360');
+});
+
+test('a picture both searches find is listed once', async () => {
+  const source = createPanoramaxSource({
+    fetchImpl: fakeFetch((url) =>
+      url.includes('bbox')
+        ? json({ features: [{ id: 'b' }, { id: 'a' }, { id: null }] })
+        : json({ features: [{ id: 'a' }] }),
+    ).fetchImpl,
+  });
+  const items = await source.nearestItems({ lat: 1, lon: 2 });
+  assert.deepEqual(
+    items.map((i) => i.id),
+    ['a', 'b'],
+  );
+});
+
+test('the newest search goes first when the API gate is full', async () => {
+  const waiting = [];
+  const order = [];
+  const source = createPanoramaxSource({
+    fetchImpl: async (url) => {
+      order.push(new URL(url).searchParams.get('ids'));
+      await new Promise((resolve) => waiting.push(resolve));
+      return new Response(JSON.stringify({ features: [] }));
+    },
+  });
+  const all = ['1', '2', '3', '4', '5', '6'].map((id) => source.getItem(id));
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.deepEqual(order, ['1', '2'], 'two at once');
+  waiting.shift()();
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.equal(order.at(-1), '6', 'the latest waiting one next');
+  let done = false;
+  Promise.allSettled(all).then(() => (done = true));
+  while (!done) {
+    waiting.splice(0).forEach((go) => go());
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+});
+
+test('an unreadable search answer, or one with no features, is handled', async () => {
+  const garbled = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({ body: '<html>' })).fetchImpl,
+  });
+  await assert.rejects(garbled.getItem('a'), /unreadable/);
+  const empty = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => json({ type: 'FeatureCollection' })).fetchImpl,
+  });
+  assert.deepEqual(await empty.nearestItems({ lat: 0, lon: 0 }), []);
+});
+
+test('the caller’s abort wins; a silent API times out with a readable message', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  const hang = (url, signal) =>
+    new Promise((_, reject) =>
+      signal.addEventListener('abort', () => reject(signal.reason)),
+    );
+  const source = createPanoramaxSource({
+    fetchImpl: fakeFetch(hang).fetchImpl,
+  });
+  const controller = new AbortController();
+  const asked = source.getItem('a', { signal: controller.signal });
+  await Promise.resolve();
+  controller.abort(new Error('overtaken'));
+  await assert.rejects(asked, /overtaken/);
+  const slow = source.getTile({ x: 0, y: 0, z: 0 });
+  // Let the request start before the clock runs out.
+  for (let i = 0; i < 5; i++) await Promise.resolve();
+  t.mock.timers.tick(60_000);
+  await assert.rejects(slow, /did not answer in time/);
+});
+
+test('a network failure reads as unreachable, not as a stack trace', async () => {
+  const source = createPanoramaxSource({
+    fetchImpl: async () => {
+      throw new TypeError('Failed to fetch');
+    },
+  });
+  await assert.rejects(source.getTile({ x: 0, y: 0, z: 0 }), (error) => {
+    assert.ok(error instanceof PanoramaxSourceError);
+    assert.match(error.message, /could not be reached/);
+    return true;
+  });
+});
+
+test('a search that timed out is asked once more; a second timeout is reported', async (t) => {
+  t.mock.timers.enable({ apis: ['setTimeout'] });
+  let calls = 0;
+  const hang = (signal) =>
+    new Promise((_, reject) =>
+      signal.addEventListener('abort', () => reject(signal.reason)),
+    );
+  const source = createPanoramaxSource({
+    fetchImpl: async (url, { signal }) => {
+      calls++;
+      if (calls === 1) return hang(signal);
+      return new Response(JSON.stringify({ features: [{ id: 'a' }] }));
+    },
+  });
+  const asked = source.getItem('a');
+  for (let i = 0; i < 5; i++) await Promise.resolve();
+  t.mock.timers.tick(60_000);
+  assert.deepEqual(await asked, { id: 'a' });
+  assert.equal(calls, 2);
+  const stuck = createPanoramaxSource({
+    fetchImpl: async (url, { signal }) => hang(signal),
+  });
+  const never = stuck.getItem('b');
+  for (let round = 0; round < 2; round++) {
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    t.mock.timers.tick(60_000);
+  }
+  await assert.rejects(never, /did not answer in time/);
+});
+
+test('the HTTP/1.1 API never gets more than five requests at once: three tiles, two searches', async () => {
+  const { API_CONCURRENCY, TILE_CONCURRENCY } = await import('./policy.js');
+  assert.ok(API_CONCURRENCY + TILE_CONCURRENCY <= 5);
+  let open = 0;
+  let most = 0;
+  const waiting = [];
+  const source = createPanoramaxSource({
+    fetchImpl: async (url) => {
+      open++;
+      most = Math.max(most, open);
+      await new Promise((resolve) => waiting.push(resolve));
+      open--;
+      return url.includes('/map/')
+        ? new Response(null, { status: 204 })
+        : new Response(JSON.stringify({ features: [] }));
+    },
+  });
+  const all = [
+    ...Array.from({ length: 8 }, (_, i) =>
+      source.getTile({ x: i, y: 0, z: 14 }),
+    ),
+    ...Array.from({ length: 4 }, (_, i) => source.getItem(String(i))),
+  ];
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  assert.equal(most, 5);
+  let done = false;
+  Promise.allSettled(all).then(() => (done = true));
+  while (!done) {
+    waiting.splice(0).forEach((go) => go());
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  assert.equal(most, 5, 'never more');
+});
+
+test('one of the two nearest searches failing leaves the other’s pictures; both failing fails the lookup', async () => {
+  const half = createPanoramaxSource({
+    fetchImpl: fakeFetch((url) =>
+      url.includes('bbox')
+        ? { status: 503 }
+        : json({ features: [{ id: 'facing' }] }),
+    ).fetchImpl,
+  });
+  assert.deepEqual(
+    (await half.nearestItems({ lat: 1, lon: 2 })).map((i) => i.id),
+    ['facing'],
+  );
+  const none = createPanoramaxSource({
+    fetchImpl: fakeFetch(() => ({ status: 503 })).fetchImpl,
+  });
+  await assert.rejects(none.nearestItems({ lat: 1, lon: 2 }), /busy/);
+});
+
+test('only a timeout is asked again: a busy or failing API is asked once, an unreachable one says so', async () => {
+  for (const status of [429, 500, 503]) {
+    const { urls, fetchImpl } = fakeFetch(() => ({ status }));
+    const source = createPanoramaxSource({ fetchImpl });
+    await assert.rejects(source.getItem('a'));
+    assert.equal(urls.length, 1, `HTTP ${status}: one fetch`);
+  }
+  let calls = 0;
+  const offline = createPanoramaxSource({
+    fetchImpl: async () => {
+      calls++;
+      throw new TypeError('Failed to fetch');
+    },
+  });
+  await assert.rejects(offline.getItem('a'), /could not be reached/);
+  assert.equal(calls, 1, 'not retried');
+});
+
+test('a Retry-After is honoured up to five minutes', async () => {
+  const wait = async (header) => {
+    const source = createPanoramaxSource({
+      fetchImpl: fakeFetch(() => ({
+        status: 503,
+        headers: { 'retry-after': header },
+      })).fetchImpl,
+    });
+    return source
+      .getTile({ x: 0, y: 0, z: 0 })
+      .catch((error) => error.retryAfterSec);
+  };
+  assert.equal(await wait('3600'), 300);
+  assert.equal(await wait('99999999999'), 300);
+  assert.equal(await wait('0'), 1);
+  assert.equal(await wait('12'), 12);
+});
+
+test('a Retry-After may be an HTTP date', () => {
+  const now = Date.parse('2026-10-15T12:00:00Z');
+  const response = (value) =>
+    new Response(null, { status: 429, headers: { 'retry-after': value } });
+  assert.equal(
+    retryAfterSeconds(response('Thu, 15 Oct 2026 12:01:00 GMT'), now),
+    60,
+  );
+  assert.equal(
+    retryAfterSeconds(response('Thu, 15 Oct 2026 14:00:00 GMT'), now),
+    300,
+  );
+  assert.equal(
+    retryAfterSeconds(response('Thu, 15 Oct 2026 11:00:00 GMT'), now),
+    null,
+    'a date already past',
+  );
+  assert.equal(retryAfterSeconds(response('soon'), now), null);
+  assert.equal(
+    retryAfterSeconds(new Response(null, { status: 429 }), now),
+    null,
+  );
+});
+
+test('busy without a readable Retry-After (the browser hides it): the wait doubles, and resets once answered', async () => {
+  let busy = true;
+  const source = createPanoramaxSource({
+    fetchImpl: fakeFetch(() =>
+      busy ? { status: 429 } : { body: new Uint8Array([1]) },
+    ).fetchImpl,
+  });
+  const wait = () =>
+    source.getTile({ x: 0, y: 0, z: 0 }).then(
+      () => 'ok',
+      (error) => error.retryAfterSec,
+    );
+  const waits = [];
+  for (let i = 0; i < 9; i++) waits.push(await wait());
+  assert.deepEqual(waits, [5, 10, 20, 40, 80, 160, 300, 300, 300]);
+  busy = false;
+  assert.equal(await wait(), 'ok');
+  busy = true;
+  assert.equal(await wait(), 5, 'back to the first wait');
+});
+
+test(
+  'a body that keeps arriving is not cut off by the request timeout; one that stalls is',
+  { timeout: 10_000 },
+  async (t) => {
+    t.mock.timers.enable({ apis: ['setTimeout'] });
+    const settle = async () => {
+      for (let i = 0; i < 20; i++) await Promise.resolve();
+    };
+    // Headers at once, then a chunk every 10 s for twice the tile timeout.
+    const chunks = Math.ceil((2 * TILE_TIMEOUT_MS) / 10_000);
+    let push;
+    const slowBody = (signal) =>
+      new Response(
+        new ReadableStream({
+          start(controller) {
+            push = (last) => {
+              controller.enqueue(new Uint8Array([7]));
+              if (last) controller.close();
+            };
+            signal.addEventListener('abort', () =>
+              controller.error(signal.reason),
+            );
+          },
+        }),
+        { status: 200 },
+      );
+    const source = createPanoramaxSource({
+      fetchImpl: async (url, { signal }) => slowBody(signal),
+    });
+    const slow = source.getTile({ x: 0, y: 0, z: 0 });
+    await settle();
+    for (let i = 1; i <= chunks; i++) {
+      t.mock.timers.tick(10_000);
+      push(i === chunks);
+      await settle();
+    }
+    assert.equal((await slow).length, chunks, 'every chunk read');
+    const stalled = source.getTile({ x: 0, y: 0, z: 0 });
+    await settle();
+    push(false);
+    await settle();
+    t.mock.timers.tick(STREAM_IDLE_TIMEOUT_MS);
+    await assert.rejects(stalled, /did not answer in time/);
+  },
+);
+
+test('the box search asks for a few pictures: the API returns them nearest first', async () => {
+  const { urls, fetchImpl } = fakeFetch(() => json({ features: [] }));
+  const source = createPanoramaxSource({ fetchImpl });
+  await source.nearestItems({ lon: 2.35, lat: 48.85 });
+  const box = urls
+    .map((url) => new URL(url))
+    .find((url) => url.searchParams.has('bbox'));
+  assert.ok(box, 'a box search');
+  assert.equal(box.searchParams.get('limit'), String(NEAREST_BOX_LIMIT));
+  assert.ok(NEAREST_BOX_LIMIT <= 20);
+});
+
+test('the cones’ tiles have their own connection: never behind coverage tiles, the newest first', async () => {
+  const { PICTURE_TILE_CONCURRENCY, TILE_CONCURRENCY } =
+    await import('./policy.js');
+  assert.equal(PICTURE_TILE_CONCURRENCY, 1);
+  const held = new Map();
+  const asked = [];
+  const source = createPanoramaxSource({
+    fetchImpl: (url) => {
+      asked.push(url.replace(/^.*\/map\//, ''));
+      return new Promise((resolve) =>
+        held.set(url.replace(/^.*\/map\//, ''), () =>
+          resolve(new Response(null, { status: 204 })),
+        ),
+      );
+    },
+  });
+  const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+  // Coverage fills its lane and queues.
+  const coverage = Array.from({ length: TILE_CONCURRENCY + 2 }, (_, i) =>
+    source.getTile({ x: i, y: 0, z: 10 }),
+  );
+  await settle();
+  assert.equal(asked.length, TILE_CONCURRENCY);
+  // A cone tile goes at once; two more wait, the newer first.
+  const pictures = [1, 2, 3].map((x) =>
+    source.getTile({ x, y: 9, z: 15 }, { lane: 'pictures' }),
+  );
+  await settle();
+  assert.deepEqual(asked.slice(TILE_CONCURRENCY), ['15/1/9.mvt']);
+  held.get('15/1/9.mvt')();
+  await settle();
+  assert.deepEqual(asked.slice(TILE_CONCURRENCY), ['15/1/9.mvt', '15/3/9.mvt']);
+  for (let round = 0; round < 6; round++) {
+    for (const go of held.values()) go();
+    await settle();
+  }
+  await Promise.all([...coverage, ...pictures]);
+});
+
+test('a lookup near the antimeridian keeps its box on the map', async () => {
+  const { urls, fetchImpl } = fakeFetch(() => json({ features: [] }));
+  const source = createPanoramaxSource({ fetchImpl });
+  await source.nearestItems({ lat: -16, lon: 179.9999 });
+  const box = urls
+    .map((u) => new URL(u).searchParams.get('bbox'))
+    .find(Boolean)
+    .split(',')
+    .map(Number);
+  assert.equal(box[2], 180);
+  assert.ok(box[0] < 180);
+});

src/layers/streetLevel/providers/panoramax/viewer.js

@@ -0,0 +1,97 @@
+import {
+  PANO_FULL_SIZE,
+  createPhotoViewer,
+  loadImage,
+} from '../../photoViewer.js';
+import {
+  HD_TIMEOUT_MS,
+  PANORAMAX_NAME,
+  PANORAMAX_PROVIDER_ID,
+  PANO_HD_MAX_WIDTH,
+  SD_WIDTH,
+  panoramaxPictureUrl,
+} from './policy.js';
+
+/** An HD original small enough to decode (its width is known and under the cap). */
+function hdDecodable(photo) {
+  return Boolean(
+    photo.urls.hd && photo.width && photo.width <= PANO_HD_MAX_WIDTH,
+  );
+}
+
+/**
+ * Where Panoramax pictures come from: the instance holding each one serves
+ * a 2,048 px SD derivative (equirectangular for a 360° picture) and the HD
+ * original. SD shows first; HD only once the viewer is wide enough to use
+ * it. A 360° original is shrunk to the texture size while it decodes.
+ * @type {import('../../photoViewer.js').PhotoSources}
+ */
+export const PANORAMAX_SOURCES = Object.freeze({
+  hasPano: (photo) =>
+    Boolean(photo.isPano && (photo.urls.sd || hdDecodable(photo))),
+  // Without an SD derivative the original goes straight to the texture size.
+  panoFirst: (photo) => {
+    // Decoded at SD's own size, whatever the host actually serves.
+    if (photo.urls.sd)
+      return {
+        url: photo.urls.sd,
+        width: SD_WIDTH,
+        resize: [SD_WIDTH, SD_WIDTH / 2],
+      };
+    if (!hdDecodable(photo)) return null;
+    const width = Math.min(photo.width, PANO_FULL_SIZE[0]);
+    return { url: photo.urls.hd, width, resize: [width, width / 2] };
+  },
+  // The original is several megabytes with no server to shrink it: only
+  // for the expanded viewer (a docked one on a dense screen asks too).
+  panoSharp: (photo, size, { expanded = false } = {}) => {
+    const width = photo.width || 0;
+    if (!expanded || !photo.urls.hd || !photo.urls.sd) return null;
+    // An original no wider than the SD one adds nothing; a huge one would
+    // take hundreds of megabytes to decode.
+    if (width <= SD_WIDTH || width > PANO_HD_MAX_WIDTH) return null;
+    const target = Math.min(size[0], width);
+    return {
+      url: photo.urls.hd,
+      resize: [target, target / 2],
+      timeoutMs: HD_TIMEOUT_MS,
+    };
+  },
+  // A 360° picture shown flat (no WebGL) is its whole equirectangular image.
+  // When SD fails the thumbnail stands in; the original (megabytes) only
+  // for the expanded viewer, and only one of a size it may decode.
+  flatFirst: (photo, { expanded = false } = {}) => [
+    photo.urls.sd,
+    expanded && hdDecodable(photo) ? photo.urls.hd : null,
+    photo.urls.thumb,
+  ],
+  // The original once the viewer is wider than SD, if its width is known
+  // and decodable (a 200 MP phone photo is 16,000 px across).
+  flatSharp: (photo, pixels) =>
+    photo.urls.sd && hdDecodable(photo) && pixels > SD_WIDTH
+      ? photo.urls.hd
+      : null,
+  describe: (photo) => ({
+    // Where no author can be named, the instance holding the photo is.
+    title: !photo.creator && photo.via ? `via ${photo.via}` : null,
+    creator: photo.creator,
+    license: photo.license,
+    externalUrl: panoramaxPictureUrl(photo.id),
+  }),
+});
+
+/**
+ * Viewer adapter for Panoramax pictures: flat in an <img>, 360° on the
+ * shared WebGL panorama, ‹ › along the sequence (photoViewer.js).
+ * @param {object} options   See photoViewer.js `createPhotoViewer`.
+ * @returns {import('../../registry.js').ViewerAdapter}
+ */
+export function createPanoramaxViewer({ load = loadImage, ...options }) {
+  return createPhotoViewer({
+    providerId: PANORAMAX_PROVIDER_ID,
+    name: PANORAMAX_NAME,
+    sources: PANORAMAX_SOURCES,
+    load,
+    ...options,
+  });
+}