fix(cctv): harden the Kartverket height lookup for Vegvesen cameras

- Default backoff is 30 min, longer than the 15-minute catalog refresh, so a failing Kartverket costs one attempt per backoff, not per refresh. - A point a 200 answer leaves out is cached as no height (6 h TTL) instead of being asked again, and waited on, every refresh. - Only 408, 429 and 5xx stop the lookup; any other 4xx marks that request's points as no height and the lookup carries on. - Each request has its own 10 s timeout inside the shared 30 s deadline; a lookup cut short only by the deadline resumes without a backoff. - The lane waits only on a cold cache (>10% of cameras missing); a few new cameras or expired misses are looked up in the background. - applyVegvesenGroundHeights skips cameras without finite coordinates, so it really never throws. - clearKartverketHeightCache bumps a generation, so a lookup started before a clear cannot write to the cache, backoff or pending slot. - Credit and DATA_SOURCES note the modification (water set to 0 m, rounded to 0.1 m) as CC BY 4.0 asks; docs match the stop rules. - Tests for the deadline being shared, per-request timeouts, 503, oversized and non-JSON bodies, 4xx, left-out points, Retry-After end to end, overlapping refreshes, the warm-cache wait, bad coordinates, the cache-clear generation and the loader's wait budget. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-11-04 10:24:02 +00:00 · 2026-10-19 17:03:50 +01:00
1 parent 4999f6dc60
commit c808bfe609
@@ -64,7 +64,7 @@ How to read this:
 | **King County Road Services** (`services.arcgis.com`, King County GIS) | CCTV camera catalog + frames, unincorporated King County WA road network                                                            | [KCGIS Center terms](https://kingcounty.gov/en/dept/kcit/data-information-services/gis-center/about/terms-conditions-copyrights) — attribution required; public ArcGIS layer                                                                                                                                                                          | "King County Road Services" (partner-city cameras name their owner)                                                                         |
 | **WSDOT** (`data.wsdot.wa.gov`)                                       | CCTV camera catalog + frames, Washington State highways                                                                             | [WSDOT travel information disclaimer](https://wsdot.wa.gov/about/policies/travel-information-disclaimer) — public "low volume" feed; catalog cached, frames on WSDOT's own image host only                                                                                                                                                            | "Washington State Department of Transportation (Travel Center)" (courtesy)                                                                  |
 | **Statens vegvesen** (catalog `ogckart-sn1.atlas.vegvesen.no`, frames `kamera.atlas.vegvesen.no`, HLS `kamera.vegvesen.no`) | CCTV camera catalog + frames + live HLS video, Norway road cameras                                                                                   | [NLOD 2.0](https://data.norge.no/nlod/en/2.0) — attribution REQUIRED | "Contains data under the Norwegian licence for Open Government data (NLOD) distributed by Statens vegvesen" |
-| **Kartverket** (`ws.geonorge.no/hoydedata/v1/punkt`)               | Terrain heights (NN2000) used as the ground prior for Statens vegvesen cameras                                                     | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — attribution REQUIRED | "© Kartverket" |
+| **Kartverket** (`ws.geonorge.no/hoydedata/v1/punkt`)               | Terrain heights (NN2000) used as the ground prior for Statens vegvesen cameras                                                     | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — attribution REQUIRED | "© Kartverket", modified (heights over water set to 0 m, rounded to 0.1 m) |
 | **NYC DOT Traffic Management Center** (`webcams.nyctmc.org`) | CCTV camera catalog + frames, New York City five boroughs | NYC DOT requires developers to sign a [data-sharing agreement](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) for the camera feed. **Off by default**; enable only under your own agreement | "NYC DOT Traffic Management Center" + NYC DOT's required application disclaimer (in the Data attribution popover) |
 | **City of Toronto Open Data** (`opendata.toronto.ca`)                 | CCTV camera catalog + frames, Toronto city streets                                                                                  | [Open Government Licence – Toronto](https://www.toronto.ca/city-government/data-research-maps/open-data/open-data-licence/) — attribution REQUIRED                                                                                                                                                                                                    | "Contains information licensed under the Open Government Licence – Toronto"                                                                 |
 | **GBFS (Lyft / BCycle / Social Bicycles / PBSC)**                     | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                                   |
@@ -169,7 +169,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **King County road cameras.** Keyless. The camera list is one public ArcGIS FeatureServer GeoJSON query (King County DOT Road Services, "King County and WSDOT Traffic Cameras"). The `outFields` list is explicit on purpose: the layer also carries asset-administration columns — including staff names — that are never fetched. Only live, active cameras with frames on the county's own `info.kingcounty.gov` image handler are registered (the feed writes `http://`; the handler serves HTTPS, so URLs are upgraded and pinned before registration). WSDOT-owned rows in the layer are skipped because their frames are WSDOT-hosted, outside the pinned image origin; partner-city cameras hosted on the county image handler (e.g. Newcastle) name their owner as the per-camera credit. The layer publishes no facing, so headings use the shared id-hash fallback at low confidence. Uniquely, the county publishes each camera's hardware `Manufacturer`/`Model` (Cohu 3950/3965, Bosch AUTODOME, Axis PTZ domes); both are carried on the source (and served by `/api/cctv/sources`) as `model` and `manufacturer` for identified-hardware consumers (vendor-generic strings such as `PTZ` name no model and are omitted). Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_KINGCOUNTY_ENABLED=0`.
 - **WSDOT highway cameras.** Keyless. The camera list is the Esri JSON layer `data.wsdot.wa.gov/travelcenter/Cameras.json` — the same layer WSDOT's own Travel Center map consumes (~1,700 point features, EPSG:3857 geometry converted to WGS84 on load; the body carries Windows-1252 bytes and is decoded as such). Only frames on WSDOT's own `images.wsdot.wa.gov` host are registered — the catalog also lists ~70 partner cameras (Oregon DOT, City of Seattle, lodges, airports) whose own terms apply, and those are skipped rather than proxied. WSDOT's layer metadata marks the feed for "low volume" use (see WSDOT's [travel information disclaimer](https://wsdot.wa.gov/about/policies/travel-information-disclaimer)). The catalog is fetched once per CCTV catalog refresh (every 15 minutes), and a camera's frame is fetched only when that camera is viewed; frames are never stored or redistributed. The live feed's `CompassDirection` is a single cardinal (N/E/S/W), `B` (both directions — most rows), `O`, or null. A single cardinal gives a high-confidence heading (the diagonals NE/SE/SW/NW are mapped too should they appear); `B`, `O`, null, and any other code carry no single facing and use the shared id-hash fallback at low confidence. By default the 250 cameras nearest Seattle and Spokane load; `CCTV_WSDOT_MAX_SOURCES` changes the cap (8–1,200) and `CCTV_WSDOT_ENABLED=0` turns the pack off. A keyed WSDOT Traveler Information API serves the same population for higher-volume use and is deliberately not required here.
 - **Statens vegvesen road cameras.** Keyless. The camera list is one GeoJSON request to the OGC API Features view of the official DATEX 3.1 CCTV site table (`ogckart-sn1.atlas.vegvesen.no/ogc/features/v1/collections/datex_3_1:CctvSimple/items`), so no DATEX account is needed; frames are stills on `kamera.atlas.vegvesen.no/api/images/<cameraId>`, and only that exact path per camera is registered. Cameras the feed reports as faulty are dropped. About 135 working cameras also publish live HLS (`kamera.vegvesen.no/public/<cameraId>/manifest.m3u8`, MPEG-TS); those play as live video through the bounded in-memory HLS relay, with the still as the snapshot fallback, and only that exact manifest path per camera is registered. `CCTV_VEGVESEN_VIDEO=0` keeps every camera on stills. `orientationDescription` names the place a camera faces, not a bearing, so it goes into the label and headings use the id-hash fallback at low confidence. By default every live camera loads (~850); `CCTV_VEGVESEN_MAX_SOURCES` (8–1000) lowers the cap, keeping the cameras nearest Oslo, Bergen, Stavanger, Trondheim, Kristiansand, Bodø and Tromsø and `CCTV_VEGVESEN_ENABLED=0` turns the pack off. Frames are fetched at request time and never stored or redistributed. The NLOD attribution is registered in the Data attribution popover.
- **Kartverket ground heights for Statens vegvesen cameras.** The camera feed's points are 2D, so the loader asks Kartverket's keyless point-height API (`ws.geonorge.no/hoydedata/v1/punkt`, CC BY 4.0) for the terrain height at each camera. Requests carry 20 points: the API accepts 50, but above ~20 it answers the extra points from contour lines (`hoydekurver`, metres to ~20 m off) or not at all. Eight requests run at a time, about 36 for the whole country: a cold lookup took 6–13 s in testing (single requests 0.6–9.5 s). Answers are matched by the coordinates the API echoes and recorded only for points that request asked about. Over water the API returns the sea-floor depth (`dybdekurver` or `Havflate`), which is replaced by 0 m, the water surface; for the ~14 bridge cameras that is below the deck, but much closer than the sea floor or the flat prior. Heights are cached in memory by position for the life of the server, and points with no height (a few ferry quays and bridges) for 6 h, so the 15-minute catalog refresh only asks about new or moved cameras. The first 429, 5xx or network failure stops the lookup, with no retries, and no new lookup starts until the backoff ends (Retry-After when sent, else 10 min; bounded to 1 min–1 h). The lane waits at most 12 s, counted from the start of the loader; a slower lookup keeps filling the cache, and the cameras it had not reached keep the flat prior until the next 15-minute refresh (about 190 of 865 on one slow first run). Only coordinates are sent, with the same User-Agent as the other CCTV requests. `CCTV_VEGVESEN_HEIGHTS=0` turns the lookup off. The Kartverket credit is shown beside the Statens vegvesen entry in the Data attribution popover.
+- **Kartverket ground heights for Statens vegvesen cameras.** The camera feed's points are 2D, so the loader asks Kartverket's keyless point-height API (`ws.geonorge.no/hoydedata/v1/punkt`, CC BY 4.0) for the terrain height at each camera. Requests carry 20 points: the API accepts 50, but above ~20 it answers the extra points from contour lines (`hoydekurver`, metres to ~20 m off) or not at all. Eight requests run at a time, about 36 for the whole country: a cold lookup took 6–13 s in testing (single requests 0.6–9.5 s). Answers are matched by the coordinates the API echoes and recorded only for points that request asked about. Over water the API returns the sea-floor depth (`dybdekurver` or `Havflate`), which is replaced by 0 m, the water surface; for the ~14 bridge cameras that is below the deck, but much closer than the sea floor or the flat prior. Heights are cached in memory by position for the life of the server, and points with no height (a few ferry quays and bridges, or a point a 200 answer leaves out) for 6 h, so the 15-minute catalog refresh only asks about new or moved cameras. The first failing request (a 408, 429 or 5xx, a network error, a request over 10 s, or an unreadable or oversized body) stops the lookup, with no retries, and no new lookup starts until the backoff ends (Retry-After when sent, else 30 min, longer than the refresh; bounded to 1 min–1 h). Any other 4xx marks that request's points as having no height and the lookup carries on. The whole lookup has a 30 s deadline; a lookup cut short by it resumes on the next refresh without a backoff. The lane waits at most 12 s, counted from the start of the loader, and only when more than 10% of the cameras have no answer yet; a few new cameras or expired misses are looked up in the background. A slower lookup keeps filling the cache, and the cameras it had not reached keep the flat prior until the next 15-minute refresh (about 190 of 865 on one slow first run). Only coordinates are sent, with the same User-Agent as the other CCTV requests. `CCTV_VEGVESEN_HEIGHTS=0` turns the lookup off. The Kartverket credit, with a note that heights over water are set to 0 m and heights are rounded to 0.1 m, is shown beside the Statens vegvesen entry in the Data attribution popover.
 - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `[email protected]` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras/<uuid>/image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover.
 - **City of Toronto RESCU cameras.** Keyless. The camera list is the City's public `tmcearthcameras.json` on `opendata.toronto.ca` (dataset "Traffic Cameras", Transportation Services), served as JSONP and unwrapped with an anchored pattern. This is the municipal network the Ontario 511 pack does not carry: downtown arterials plus the Gardiner, DVP, Allen and Lake Shore. The list publishes no frame URL, so frame URLs are BUILT from the documented `CameraImages/loc####.jpg` convention and a strictly-digits camera number, pinning the frame proxy to the portal origin by construction; the list fetch refuses redirects and bounds the body it buffers. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `D1`-`D4` fields are the directions of the *comparison* images (static reference stills captured in 2016 under a different path), not a bearing for the live pan-tilt-zoom frame, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. A camera that is temporarily out of service still answers 200 with a byte-identical "Image Unavailable" placeholder rather than an error (about 6% of the network at any moment), so such a camera reads as healthy; the frame it shows is the agency's, not a synthesized one. The licence requires the attribution statement above. Disable with `CCTV_TORONTO_ENABLED=0`.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
@@ -7,9 +7,11 @@
  time; a cold lookup takes about 6–13 s. Cameras over water use the water
  surface rather than the sea-floor depth the API returns there; for bridge
  cameras that is still below the deck. Heights are cached for good and misses
-  for 6 h, so a refresh only asks about new or moved cameras. After a 429, a
-  5xx or a network failure the lookup stops and backs off (Retry-After, else
-  10 min). The lane waits at most 12 s from its start; a slower first lookup
-  leaves the cameras it had not reached on the flat prior until the next
-  15-minute refresh, and keeps filling the cache meanwhile.
+  for 6 h, so a refresh only asks about new or moved cameras. After a
+  failing request (a 408, 429 or 5xx, a network error, a request over 10 s or
+  an unreadable body) the lookup stops and backs off (Retry-After, else
+  30 min, longer than the refresh). The lane waits at most 12 s from its
+  start, and only on a cold cache; a slower first lookup leaves the cameras it
+  had not reached on the flat prior until the next 15-minute refresh, and
+  keeps filling the cache meanwhile.
  `CCTV_VEGVESEN_HEIGHTS=0` turns it off. Follow-up to #929 (trygvehhh, #945).
@@ -347,22 +347,32 @@ export const KARTVERKET_HEIGHT_URL =
 * extra points from contour lines (`hoydekurver`, metres to ~20 m off) or not
 * at all; at 20 nearly every camera resolves from the 1 m terrain model. */
 export const KARTVERKET_MAX_POINTS = 20;
-/** Requests in flight at once. The whole country is ~36 requests of ~1-2 s,
- * so a cold lookup takes ~6 s. */
+/** Requests in flight at once. The whole country is ~36 requests of
+ * 0.6-9.5 s each, so a cold lookup takes ~6-13 s. */
 export const KARTVERKET_CONCURRENCY = 8;
-/** Deadline for one complete lookup, shared by every request. */
+/** Deadline for one complete lookup, shared by every request. A lookup cut
+ * short by it is resumed on the next refresh, without a backoff. */
 export const KARTVERKET_LOOKUP_TIMEOUT_MS = 30 * 1000;
+/** One request that takes longer than this counts as a failing service. */
+export const KARTVERKET_REQUEST_TIMEOUT_MS = 10 * 1000;
 /** The Vegvesen lane's budget, measured from the start of the loader (catalog
 * fetch included), for waiting on heights. Under the 15 s per-provider fetch
 * timeout so this pack is never the catalog's slowest lane. A lookup still
 * running after it keeps filling the cache for the next refresh. */
 export const KARTVERKET_CATALOG_WAIT_MS = 12 * 1000;
+/** The lane only waits when more than this share of its cameras has no
+ * answer yet (a cold cache). A few new cameras or expired misses are looked
+ * up in the background instead of holding the refresh. */
+export const KARTVERKET_WAIT_MISSING_SHARE = 0.1;
 /** A point Kartverket has no height for (some ferry quays and bridges) is not
 * asked about again for this long. */
 export const KARTVERKET_NULL_TTL_MS = 6 * 60 * 60 * 1000;
-/** After a 429, a 5xx or a network failure, no lookup starts for this long,
- * or for the Retry-After the service sent, bounded to [1 min, 1 h]. */
-export const KARTVERKET_FAILURE_BACKOFF_MS = 10 * 60 * 1000;
+/** After a failing request (408, 429, 5xx, a network error, a request
+ * timeout or an unreadable body), no lookup starts for this long, or for the
+ * Retry-After the service sent, bounded to [1 min, 1 h]. Longer than the
+ * 15-minute catalog refresh (CCTV_SOURCE_CACHE_MS), so a failing service
+ * costs one attempt per backoff, not one per refresh. */
+export const KARTVERKET_FAILURE_BACKOFF_MS = 30 * 60 * 1000;
 export const KARTVERKET_MAX_BACKOFF_MS = 60 * 60 * 1000;
 export const KARTVERKET_MAX_RESPONSE_BYTES = 256 * 1024;
 /** Plausible Norwegian terrain: below sea level only at the shore, and no road
@@ -99,6 +99,8 @@ import {
  KARTVERKET_MAX_POINTS,
  KARTVERKET_CONCURRENCY,
  KARTVERKET_LOOKUP_TIMEOUT_MS,
+  KARTVERKET_REQUEST_TIMEOUT_MS,
+  KARTVERKET_WAIT_MISSING_SHARE,
  KARTVERKET_CATALOG_WAIT_MS,
  KARTVERKET_NULL_TTL_MS,
  KARTVERKET_FAILURE_BACKOFF_MS,
@@ -2506,12 +2508,20 @@ const KARTVERKET_CACHE_LIMIT = 5000;
 let kartverketPending = null;
 /** No lookup starts before this time (epoch ms) after a transport failure. */
 let kartverketBackoffUntil = 0;
+/** Bumped by clearKartverketHeightCache, so a lookup started before a clear
+ * can no longer write to the cache, the backoff or the pending slot. */
+let kartverketGeneration = 0;

 /** Cache key for one position, at the ~0.1 m precision the request sends. */
 const kartverketKey = (lon, lat) => `${lon.toFixed(6)},${lat.toFixed(6)}`;

+/** Statuses that say the service, not the request, is failing. */
+const isKartverketTransportStatus = (status) =>
+  status === 408 || status === 429 || status >= 500;
+
 /** Forget cached heights, the backoff and any lookup in flight. Tests only. */
 export function clearKartverketHeightCache() {
+  kartverketGeneration += 1;
  kartverketHeightCache.clear();
  kartverketPending = null;
  kartverketBackoffUntil = 0;
@@ -2541,26 +2551,36 @@ export function kartverketBackoffMs(retryAfter, now = Date.now()) {
 * matched back by the coordinates the API echoes, and only for points that
 * request asked about, then reported through `into.set(key, z)` as its
 * request lands, so a caller that stops waiting keeps what has arrived. `z` is
- * metres, or null when the API has no usable height there.
+ * metres, or null when the API has no usable height there. A point a 200
+ * answer leaves out is reported as null too, so it is not asked again on
+ * every refresh.
 *
 * Over water `/punkt` returns the depth of the sea floor (`datakilde:
 * dybdekurver`, `terreng: Havflate`; −547 m under Nordhordlandsbrua). Either
 * marker counts as 0 m, the water surface. For the ~14 bridge cameras that is
 * below the deck, but far closer than the sea floor or a flat prior.
 *
- * The first transport failure (a non-200 answer, a network error or the
+ * The first transport failure (a 408, 429 or 5xx, a network error, a request
+ * past KARTVERKET_REQUEST_TIMEOUT_MS, an unreadable or oversized body, or the
 * shared deadline) stops the lookup: no further requests start, and the
 * failure is returned so the caller can back off. Points in failed requests
- * are not reported, so they are asked again after the backoff.
+ * are not reported, so they are asked again later. Any other 4xx rejects that
+ * request's points, not the service: they are reported as null and the lookup
+ * carries on.
 *
 * @param {Array<{lon:number, lat:number}>} points
- * @param {{into?: {set: Function}, timeoutMs?: number}} [options]
- * @returns {Promise<{heights: Map<string, ?number>, failure: ?{status: ?number, retryAfter: ?string}}>}
+ * @param {{into?: {set: Function}, timeoutMs?: number, requestTimeoutMs?: number}} [options]
+ * @returns {Promise<{heights: Map<string, ?number>, failure: ?{status: ?number, retryAfter: ?string, deadline: boolean}}>}
 *   `heights` is `into` when it is a Map, else a Map of what was reported.
+ *   `failure.deadline` is true when only the shared deadline ran out.
 */
 export async function fetchKartverketHeights(
  points,
-  { into = new Map(), timeoutMs = KARTVERKET_LOOKUP_TIMEOUT_MS } = {},
+  {
+    into = new Map(),
+    timeoutMs = KARTVERKET_LOOKUP_TIMEOUT_MS,
+    requestTimeoutMs = KARTVERKET_REQUEST_TIMEOUT_MS,
+  } = {},
 ) {
  const heights = into instanceof Map ? into : new Map();
  const report = (key, z) => {
@@ -2580,7 +2600,7 @@ export async function fetchKartverketHeights(
  for (let i = 0; i < unique.length; i += KARTVERKET_MAX_POINTS) {
    batches.push(unique.slice(i, i + KARTVERKET_MAX_POINTS));
  }
-  const signal = AbortSignal.timeout(timeoutMs);
+  const deadline = AbortSignal.timeout(timeoutMs);
  const fetchBatch = async (batch) => {
    const asked = new Set(batch.map((p) => kartverketKey(p.lon, p.lat)));
    const url = new URL(KARTVERKET_HEIGHT_URL);
@@ -2597,7 +2617,10 @@ export async function fetchKartverketHeights(
        'User-Agent': KARTVERKET_USER_AGENT,
      },
      redirect: 'error',
-      signal,
+      signal: AbortSignal.any([
+        deadline,
+        AbortSignal.timeout(requestTimeoutMs),
+      ]),
    });
    if (!resp.ok) {
      try {
@@ -2605,6 +2628,13 @@ export async function fetchKartverketHeights(
      } catch {
        /* no-op */
      }
+      if (!isKartverketTransportStatus(resp.status)) {
+        console.warn(
+          `[CCTV] Kartverket rejected ${asked.size} points: HTTP ${resp.status}`,
+        );
+        for (const key of asked) report(key, null);
+        return;
+      }
      const error = new Error(`HTTP ${resp.status}`);
      error.status = resp.status;
      error.retryAfter = resp.headers.get('retry-after');
@@ -2643,6 +2673,8 @@ export async function fetchKartverketHeights(
        z <= KARTVERKET_HEIGHT_RANGE_M.max;
      report(key, usable ? z : null);
    }
+    // A 200 that leaves a point out has no height for it either.
+    for (const key of asked) report(key, null);
  };
  let next = 0;
  const worker = async () => {
@@ -2655,6 +2687,7 @@ export async function fetchKartverketHeights(
          failure = {
            status: Number.isFinite(error?.status) ? error.status : null,
            retryAfter: error?.retryAfter ?? null,
+            deadline: deadline.aborted,
          };
          console.warn(
            '[CCTV] Kartverket height lookup failed:',
@@ -2675,23 +2708,35 @@ export async function fetchKartverketHeights(

 /**
 * Give each Vegvesen camera its own terrain height as the ground prior, in
- * place. Waits at most `waitMs` for positions it has no answer for; a lookup
- * still running then keeps filling the cache for the next catalog refresh.
- * Cameras without a height keep the flat prior. After a transport failure no
- * lookup starts until the backoff ends, so a failing Kartverket costs one
- * attempt, not one per refresh. Never throws. CCTV_VEGVESEN_HEIGHTS=0 turns it
- * off.
+ * place. Waits at most `waitMs` for positions it has no answer for, and only
+ * when more than KARTVERKET_WAIT_MISSING_SHARE of the cameras are missing
+ * (a cold cache); a few new cameras or expired misses are looked up in the
+ * background. A lookup still running when the wait ends keeps filling the
+ * cache for the next catalog refresh. Cameras without a height keep the flat
+ * prior. After a transport failure no lookup starts until the backoff ends,
+ * which outlasts the 15-minute catalog refresh, so a failing Kartverket costs
+ * one attempt per backoff, not one per refresh. A lookup cut short only by its
+ * shared deadline is resumed on the next refresh without a backoff. Cameras
+ * without finite coordinates are skipped. Never throws.
+ * CCTV_VEGVESEN_HEIGHTS=0 turns it off.
 *
 * @param {Array<object>} cameras - Sources from vegvesenCameraToSource().
- * @param {{waitMs?: number, now?: () => number}} [options]
+ * @param {{waitMs?: number, now?: () => number, timeoutMs?: number}} [options]
+ *   `timeoutMs` is the lookup's shared deadline.
 * @returns {Promise<number>} How many cameras got a terrain height.
 */
 export async function applyVegvesenGroundHeights(
  cameras,
-  { waitMs = KARTVERKET_CATALOG_WAIT_MS, now = Date.now } = {},
+  {
+    waitMs = KARTVERKET_CATALOG_WAIT_MS,
+    now = Date.now,
+    timeoutMs = KARTVERKET_LOOKUP_TIMEOUT_MS,
+  } = {},
 ) {
  if (String(process.env.CCTV_VEGVESEN_HEIGHTS || '1').trim() === '0') return 0;
-  const list = Array.isArray(cameras) ? cameras : [];
+  const list = (Array.isArray(cameras) ? cameras : []).filter(
+    (c) => Number.isFinite(c?.lon) && Number.isFinite(c?.lat),
+  );
  const startedAt = now();
  const missing = list.filter((c) => {
    const entry = kartverketHeightCache.get(kartverketKey(c.lon, c.lat));
@@ -2705,32 +2750,40 @@ export async function applyVegvesenGroundHeights(
    if (kartverketHeightCache.size + missing.length > KARTVERKET_CACHE_LIMIT) {
      kartverketHeightCache.clear();
    }
+    const generation = kartverketGeneration;
+    const current = () => generation === kartverketGeneration;
    const sink = {
-      set: (key, z) =>
+      set: (key, z) => {
+        if (!current()) return;
        kartverketHeightCache.set(key, {
          z,
          expires: z === null ? now() + KARTVERKET_NULL_TTL_MS : Infinity,
-        }),
+        });
+      },
    };
-    kartverketPending = fetchKartverketHeights(missing, { into: sink })
+    const pending = fetchKartverketHeights(missing, { into: sink, timeoutMs })
      .then(({ failure }) => {
-        if (failure) {
+        if (failure && !failure.deadline && current()) {
          kartverketBackoffUntil =
            now() + kartverketBackoffMs(failure.retryAfter, now());
        }
      })
      .catch((error) => {
-        kartverketBackoffUntil = now() + KARTVERKET_FAILURE_BACKOFF_MS;
+        if (current()) {
+          kartverketBackoffUntil = now() + KARTVERKET_FAILURE_BACKOFF_MS;
+        }
        console.warn(
          '[CCTV] Kartverket height lookup error:',
          error?.message || error,
        );
      })
      .finally(() => {
-        kartverketPending = null;
+        if (kartverketPending === pending) kartverketPending = null;
      });
+    kartverketPending = pending;
  }
-  if (missing.length && kartverketPending && waitMs > 0) {
+  const cold = missing.length > list.length * KARTVERKET_WAIT_MISSING_SHARE;
+  if (cold && kartverketPending && waitMs > 0) {
    let timer;
    await Promise.race([
      kartverketPending,
@@ -12,11 +12,14 @@ import {
 import {
  DEFAULT_VEGVESEN_CCTV_URL,
  KARTVERKET_HEIGHT_URL,
+  KARTVERKET_CATALOG_WAIT_MS,
  KARTVERKET_CONCURRENCY,
  KARTVERKET_FAILURE_BACKOFF_MS,
  KARTVERKET_MAX_POINTS,
+  KARTVERKET_MAX_RESPONSE_BYTES,
  KARTVERKET_NULL_TTL_MS,
  KARTVERKET_USER_AGENT,
+  CCTV_SOURCE_CACHE_MS,
  VEGVESEN_IMAGE_ORIGIN,
 } from '../../server/providers/cctv/constants.js';
 import { createCctvCatalog } from '../../server/providers/cctv/catalog.js';
@@ -141,9 +144,9 @@ test('the loader dedupes, and failures degrade to an empty pack', async (t) => {
  const cameras = await loadVegvesenSourcesFromOpenData();
  // The catalog first; the rest is the Kartverket height lookup.
  assert.equal(requested[0], DEFAULT_VEGVESEN_CCTV_URL);
-  assert.ok(
-    requested.slice(1).every((url) => url.startsWith(KARTVERKET_HEIGHT_URL)),
-  );
+  // Two unique positions: one Kartverket request.
+  assert.equal(requested.length, 2);
+  assert.ok(requested[1].startsWith(KARTVERKET_HEIGHT_URL));
  // Nearest-to-anchor first: Oslo leads.
  assert.deepEqual(
    cameras.map((c) => c.id),
@@ -258,6 +261,8 @@ test('Kartverket heights come in batches of 20, matched by echoed coordinates',
    requested.push(String(url));
    assert.ok(String(url).startsWith(KARTVERKET_HEIGHT_URL));
    assert.equal(init.headers['User-Agent'], KARTVERKET_USER_AGENT);
+    // Redirects are refused, so a request can never leave the fixed host.
+    assert.equal(init.redirect, 'error');
    // Reply in reverse order: matching must not depend on list position.
    const response = kartverketResponse(url, (x) =>
      x > 7.04 ? null : Math.round((x - 7) * 10000),
@@ -402,26 +407,138 @@ test('a transport failure stops the lookup: no retries, no new requests', async
  // after it starts, and no point is resent.
  assert.equal(calls, KARTVERKET_CONCURRENCY);
  assert.equal(heights.size, 0);
-  assert.deepEqual(failure, { status: 429, retryAfter: '120' });
+  assert.deepEqual(failure, {
+    status: 429,
+    retryAfter: '120',
+    deadline: false,
+  });
 });

+/** A fetch that never answers, and rejects only when its signal aborts. */
+const hangingFetch = (url, init) => {
+  assert.ok(init.signal instanceof AbortSignal);
+  return new Promise((_, reject) => {
+    init.signal.addEventListener('abort', () => reject(init.signal.reason));
+  });
+};
+
 test('the lookup deadline bounds a hanging service', async (t) => {
  withHeightsEnv(t);
-  t.mock.method(
-    globalThis,
-    'fetch',
-    (url, init) =>
-      new Promise((_, reject) => {
-        init.signal.addEventListener('abort', () => reject(init.signal.reason));
-      }),
-  );
+  t.mock.method(globalThis, 'fetch', hangingFetch);
  const started = Date.now();
  const { heights, failure } = await fetchKartverketHeights([cameraAt(0)], {
    timeoutMs: 30,
  });
-  assert.ok(Date.now() - started < 2000);
+  const elapsed = Date.now() - started;
+  assert.ok(elapsed >= 25 && elapsed < 2000, `elapsed ${elapsed} ms`);
  assert.equal(heights.size, 0);
-  assert.equal(failure.status, null);
+  assert.deepEqual(failure, { status: null, retryAfter: null, deadline: true });
+});
+
+test('one hanging request times out on its own, as a failing service', async (t) => {
+  withHeightsEnv(t);
+  t.mock.method(globalThis, 'fetch', hangingFetch);
+  const { failure } = await fetchKartverketHeights([cameraAt(0)], {
+    timeoutMs: 60_000,
+    requestTimeoutMs: 20,
+  });
+  assert.deepEqual(failure, {
+    status: null,
+    retryAfter: null,
+    deadline: false,
+  });
+});
+
+test('the deadline is shared: later requests do not get a fresh one', async (t) => {
+  withHeightsEnv(t);
+  let calls = 0;
+  t.mock.method(globalThis, 'fetch', (url, init) => {
+    calls += 1;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () => resolve(kartverketResponse(url, () => 1)),
+        40,
+      );
+      init.signal.addEventListener('abort', () => {
+        clearTimeout(timer);
+        reject(init.signal.reason);
+      });
+    });
+  });
+  // Five waves of 40 ms against a 100 ms deadline for the whole lookup.
+  const { heights, failure } = await fetchKartverketHeights(
+    Array.from({ length: 5 * KARTVERKET_CONCURRENCY * 20 }, (_, i) =>
+      cameraAt(i),
+    ),
+    { timeoutMs: 100 },
+  );
+  assert.equal(failure?.deadline, true);
+  assert.ok(heights.size < 5 * KARTVERKET_CONCURRENCY * 20);
+  assert.ok(calls < 5 * KARTVERKET_CONCURRENCY, `calls ${calls}`);
+});
+
+test('a 503, an unreadable or an oversized body stops the lookup', async (t) => {
+  withHeightsEnv(t);
+  const answers = {
+    503: () => new Response('down', { status: 503 }),
+    'not json': () =>
+      new Response('<html>maintenance</html>', {
+        headers: { 'Content-Type': 'text/html' },
+      }),
+    oversized: () =>
+      Response.json({
+        punkter: [],
+        pad: 'x'.repeat(KARTVERKET_MAX_RESPONSE_BYTES + 1),
+      }),
+  };
+  for (const [label, answer] of Object.entries(answers)) {
+    clearKartverketHeightCache();
+    let calls = 0;
+    t.mock.method(globalThis, 'fetch', async () => {
+      calls += 1;
+      return answer();
+    });
+    const { heights, failure } = await fetchKartverketHeights(
+      Array.from({ length: 400 }, (_, i) => cameraAt(i)),
+    );
+    assert.equal(calls, KARTVERKET_CONCURRENCY, label);
+    assert.equal(heights.size, 0, label);
+    assert.equal(failure?.deadline, false, label);
+    assert.equal(failure?.status, label === '503' ? 503 : null, label);
+  }
+});
+
+test('a 4xx rejects that request only: its points get no height, the rest go on', async (t) => {
+  withHeightsEnv(t);
+  t.mock.method(globalThis, 'fetch', async (url) =>
+    sentPoints(url)[0][0] === 7
+      ? new Response('bad point', { status: 400 })
+      : kartverketResponse(url, () => 42),
+  );
+  const { heights, failure } = await fetchKartverketHeights(
+    Array.from({ length: 40 }, (_, i) => cameraAt(i)),
+  );
+  assert.equal(failure, null);
+  assert.equal(heights.size, 40);
+  assert.equal(heights.get('7.000000,60.000000'), null);
+  assert.equal(heights.get('7.020000,60.020000'), 42);
+});
+
+test('a point a 200 answer leaves out is cached as no height', async (t) => {
+  withHeightsEnv(t);
+  const fetchMock = t.mock.method(globalThis, 'fetch', async (url) => {
+    const points = sentPoints(url).slice(1); // drop the first point
+    return Response.json({
+      koordsys: 4258,
+      punkter: points.map(([x, y]) => ({ x, y, z: 7 })),
+    });
+  });
+  const cameras = [cameraAt(0), cameraAt(1)];
+  assert.equal(await applyVegvesenGroundHeights(cameras), 1);
+  assert.equal(cameras[0].groundElevationM, 150);
+  // The next refresh asks nothing: the left-out point is a cached miss.
+  assert.equal(await applyVegvesenGroundHeights([cameraAt(0), cameraAt(1)]), 1);
+  assert.equal(fetchMock.mock.callCount(), 1);
 });

 test('Retry-After sets the backoff, bounded to [1 min, 1 h]', () => {
@@ -478,8 +595,12 @@ test('after a failure no lookup starts until the backoff ends', async (t) => {
  assert.equal(cameras[0].groundElevationM, 150);
  assert.equal(fetchMock.mock.callCount(), 1);

-  // Refreshes inside the backoff cost nothing.
-  clock += KARTVERKET_FAILURE_BACKOFF_MS - 1;
+  // The default backoff outlasts the catalog refresh, so the next refresh
+  // and every one inside the backoff cost nothing.
+  assert.ok(KARTVERKET_FAILURE_BACKOFF_MS > CCTV_SOURCE_CACHE_MS);
+  clock += CCTV_SOURCE_CACHE_MS;
+  assert.equal(await applyVegvesenGroundHeights([cameraAt(0)], { now }), 0);
+  clock += KARTVERKET_FAILURE_BACKOFF_MS - CCTV_SOURCE_CACHE_MS - 1;
  assert.equal(await applyVegvesenGroundHeights([cameraAt(0)], { now }), 0);
  assert.equal(fetchMock.mock.callCount(), 1);

@@ -494,6 +615,143 @@ test('after a failure no lookup starts until the backoff ends', async (t) => {
  assert.equal(fetchMock.mock.callCount(), 2);
 });

+test('a 429 backs off for its Retry-After, not the default', async (t) => {
+  withHeightsEnv(t);
+  let clock = 1_000_000;
+  const now = () => clock;
+  const retryAfterS = 50 * 60;
+  const fetchMock = t.mock.method(
+    globalThis,
+    'fetch',
+    async () =>
+      new Response('busy', {
+        status: 429,
+        headers: { 'Retry-After': String(retryAfterS) },
+      }),
+  );
+  await applyVegvesenGroundHeights([cameraAt(0)], { now });
+  assert.equal(fetchMock.mock.callCount(), 1);
+  clock += KARTVERKET_FAILURE_BACKOFF_MS + 1;
+  await applyVegvesenGroundHeights([cameraAt(0)], { now });
+  assert.equal(fetchMock.mock.callCount(), 1);
+  clock += retryAfterS * 1000 - KARTVERKET_FAILURE_BACKOFF_MS;
+  await applyVegvesenGroundHeights([cameraAt(0)], { now });
+  assert.equal(fetchMock.mock.callCount(), 2);
+});
+
+test('a lookup cut short by its deadline resumes on the next refresh', async (t) => {
+  withHeightsEnv(t);
+  let clock = 1_000_000;
+  const now = () => clock;
+  t.mock.method(globalThis, 'fetch', hangingFetch);
+  // The lookup runs out of time; that is not a failing service.
+  assert.equal(
+    await applyVegvesenGroundHeights([cameraAt(0)], {
+      now,
+      timeoutMs: 10,
+      waitMs: 1000,
+    }),
+    0,
+  );
+  const fetchMock = t.mock.method(globalThis, 'fetch', async (url) =>
+    kartverketResponse(url, () => 64),
+  );
+  clock += CCTV_SOURCE_CACHE_MS;
+  const cameras = [cameraAt(0)];
+  assert.equal(await applyVegvesenGroundHeights(cameras, { now }), 1);
+  assert.equal(cameras[0].groundElevationM, 64);
+  assert.equal(fetchMock.mock.callCount(), 1);
+});
+
+test('overlapping refreshes share one lookup', async (t) => {
+  withHeightsEnv(t);
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const fetchMock = t.mock.method(globalThis, 'fetch', async (url) => {
+    await gate;
+    return kartverketResponse(url, () => 3);
+  });
+  await Promise.all([
+    applyVegvesenGroundHeights([cameraAt(0)], { waitMs: 5 }),
+    applyVegvesenGroundHeights([cameraAt(0)], { waitMs: 5 }),
+  ]);
+  assert.equal(fetchMock.mock.callCount(), 1);
+  release();
+});
+
+test('a warm cache does not wait for a few new cameras', async (t) => {
+  withHeightsEnv(t);
+  const cameras = Array.from({ length: 20 }, (_, i) => cameraAt(i));
+  t.mock.method(globalThis, 'fetch', async (url) =>
+    kartverketResponse(url, () => 500),
+  );
+  assert.equal(await applyVegvesenGroundHeights(cameras), 20);
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const fetchMock = t.mock.method(globalThis, 'fetch', async (url) => {
+    await gate;
+    return kartverketResponse(url, () => 600);
+  });
+  const refresh = [...cameras, cameraAt(20)];
+  const started = Date.now();
+  assert.equal(
+    await applyVegvesenGroundHeights(refresh, { waitMs: 5_000 }),
+    20,
+  );
+  assert.ok(Date.now() - started < 1000);
+  assert.equal(fetchMock.mock.callCount(), 1);
+  // The background lookup fills the cache for the next refresh.
+  release();
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  const next = [...cameras, cameraAt(20)];
+  assert.equal(await applyVegvesenGroundHeights(next), 21);
+  assert.equal(next[20].groundElevationM, 600);
+});
+
+test('cameras without numeric coordinates are skipped, never thrown on', async (t) => {
+  withHeightsEnv(t);
+  t.mock.method(globalThis, 'fetch', async (url) =>
+    kartverketResponse(url, () => 9),
+  );
+  const cameras = [
+    { id: 'no-coordinates' },
+    null,
+    { id: 'strings', lat: '60', lon: '7' },
+    cameraAt(0),
+  ];
+  assert.equal(await applyVegvesenGroundHeights(cameras), 1);
+  assert.equal(cameras[3].groundElevationM, 9);
+});
+
+test('a lookup started before a cache clear cannot write after it', async (t) => {
+  withHeightsEnv(t);
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    await gate;
+    return kartverketResponse(url, () => 111);
+  });
+  await applyVegvesenGroundHeights([cameraAt(0)], { waitMs: 5 });
+  clearKartverketHeightCache();
+  t.mock.method(globalThis, 'fetch', async (url) =>
+    kartverketResponse(url, () => 222),
+  );
+  const fresh = [cameraAt(0)];
+  assert.equal(await applyVegvesenGroundHeights(fresh), 1);
+  assert.equal(fresh[0].groundElevationM, 222);
+  release();
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  const later = [cameraAt(0)];
+  await applyVegvesenGroundHeights(later, { waitMs: 0 });
+  assert.equal(later[0].groundElevationM, 222);
+});
+
 test('CCTV_VEGVESEN_HEIGHTS=0 skips the lookup', async (t) => {
  withHeightsEnv(t);
  const fetchMock = t.mock.method(globalThis, 'fetch', async (url) =>
@@ -541,3 +799,24 @@ test('the loader applies Kartverket heights to the cameras it returns', async (t
    [['no-vegvesen-3000063_1', 987.6]],
  );
 });
+
+test('the loader budgets the height wait from its own start', async (t) => {
+  withHeightsEnv(t);
+  const realNow = Date.now.bind(Date);
+  let offset = 0;
+  t.mock.method(Date, 'now', () => realNow() + offset);
+  t.mock.method(globalThis, 'fetch', (url, init) => {
+    if (String(url).startsWith(KARTVERKET_HEIGHT_URL)) {
+      return hangingFetch(url, init);
+    }
+    // The catalog fetch uses up all but 10 ms of the lane's budget.
+    offset += KARTVERKET_CATALOG_WAIT_MS - 10;
+    return Promise.resolve(
+      Response.json({ type: 'FeatureCollection', features: [feature()] }),
+    );
+  });
+  const started = performance.now();
+  const cameras = await loadVegvesenSourcesFromOpenData();
+  assert.ok(performance.now() - started < 1000);
+  assert.equal(cameras[0].groundElevationM, 150);
+});
@@ -295,7 +295,8 @@ export const DATA_CREDITS = [
      '<a href="https://data.norge.no/nlod/en/2.0" target="_blank" rel="noopener">Norwegian licence for Open Government data (NLOD)</a> ' +
      'distributed by Statens vegvesen · camera ground heights © ' +
      '<a href="https://kartverket.no/en/api-and-data/terrengdata" target="_blank" rel="noopener">Kartverket</a> ' +
-      '(<a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="noopener">CC BY 4.0</a>)',
+      '(<a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="noopener">CC BY 4.0</a>); ' +
+      'modified: heights over water set to 0 m and rounded to 0.1 m',
  },
  {
    key: 'nyc-cctv',