Merge branch 'main' into feat/datacenters-norway-refresh

DATA_SOURCES.md

@@ -41,6 +41,8 @@ How to read this:
 | **S2 Underground GhostMaps** (`github.com/s2underground/GhostMaps`) | S2 GhostMaps layer: the current edition of S2's KMZ intel products (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran and Yemen products, newest incident drop). Keyless. `/api/ghostmaps` reads the branch head from git's ref advertisement every 15 s (`GHOSTMAPS_POLL_SECONDS`, minimum 5 s), lists the tree through the GitHub REST API only when the head changes (optional `GITHUB_TOKEN`), downloads files by commit-pinned raw URLs into `.gev-cache/ghostmaps/` and pushes new catalogs to browsers over server-sent events | [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) (repository README: "S2 Underground © 2025 by S2A1"); non-commercial, attribution required; files are fetched at runtime, never stored in this repository | "S2 GhostMaps intel products: S2 Underground © by S2A1, CC BY-NC-SA 4.0" — shown in-app |
 | **InciWeb** (inciweb.wildfire.gov)                                    | Per-incident "InciWeb ↗" card links to official incident pages (narratives, evacuation/closure notices) | U.S. government public incident information. Links are matched best-effort by incident name and state, with incident page origin and update times checked on selection. Same-origin `/api/fire-perimeters/inciweb` routes cache the catalog for 1 hour and publication metadata for 30 minutes; linked pages remain InciWeb content | "Incident information: InciWeb (inciweb.wildfire.gov)" |
 | **FAA Special Use Airspace** (`services6.arcgis.com` FeatureServer `Special_Use_Airspace`) | Prohibited & Restricted Airspace layer: US prohibited (P) and restricted (R) special-use airspace polygons (not the UAS Facility Map or UAS flight restrictions), altitude limits from the `*_VAL`/`*_UOM`/`*_CODE` fields, times of use, and controlling agency | U.S. public domain (FAA aeronautical data published through the [FAA AIS Open Data portal](https://adds-faa.opendata.arcgis.com/)); fetched keyless through `/api/drone-airspace` (1-hour server cache). Informational only — not a substitute for official UAS flight-planning tools | "Prohibited & restricted airspace: FAA Special Use Airspace" |
+| **iNaturalist API** (`api.inaturalist.org/v2/observations`, `/v1/grid/{z}/{x}/{y}.grid.json`) | Wildlife Sightings layer: verifiable wildlife observed within the last 48 h (whales 7 d), by observation time, in the current view, with taxon, observation time, quality grade and eligible photo | Per-record licences; observations default CC BY-NC. Photos CC0/BY/BY-SA/BY-NC/BY-NC-SA shown; ND and all-rights-reserved photos link-only. Keyless via `/api/inaturalist/observations` (5-min cache; global sample 10 min; stale ≤ 1 h; 60 requests/min and 8,000/day upstream caps). **NonCommercial content:** commercial redistributors must filter to CC0/BY/BY-SA or remove the layer. No AI training on this content | "Wildlife sightings: iNaturalist contributors (licences per record; photos credited on each card)" |
+| **Acartia** (`acartia.io/api/v1/sightings/current`) | Wildlife Sightings layer: Salish Sea marine mammal reports with validated species, observation time, reporting provider and trust flag; WHALES includes only the frozen cetacean list | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), each provider credited per sighting. Keyless via `/api/acartia/sightings` (10-min cache; stale ≤ 24 h). Positions rounded to 0.01° on the server; free-text comments excluded. Marine-conservation use; Be Whale Wise | "Wildlife sightings: Acartia (CC BY 4.0; each provider credited per sighting) · Be Whale Wise" |
 | **OpenFreeMap / OpenMapTiles** | Vector tiles | OpenStreetMap data under ODbL 1.0 | OpenFreeMap © OpenMapTiles |
 | **Overture Maps Foundation** | Military area names pack | [ODbL 1.0](https://opendatacommons.org/licenses/odbl/1-0/) | Overture Maps Foundation |
 | **TomTom Traffic API** (flow vector tiles)                            | Traffic roads and live congestion (optional, BYOK)                                                                     | [TomTom for Developers terms](https://docs.tomtom.com/legal/terms-and-conditions) (proprietary, your own key; free tier currently 200K tile requests/month — see [current pricing](https://docs.tomtom.com/pricing/))                                                                                                                                                       | "Traffic flow data © TomTom" — registered when live mode activates                                                                          |
@@ -195,6 +197,9 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Re:Earth Terrain.** Keyless (no API key). Used two ways: (1) `src/mapStackController.js` swaps in a `Cesium.CesiumTerrainProvider` pointed at Re:Earth's `cesium-mesh/ellipsoid` quantized-mesh endpoint for globe stacks without a Cesium ion token (e.g. OSM), replacing a flat `EllipsoidTerrainProvider`; falls back to the flat provider if the endpoint can't be reached. (2) The server-side `/api/terrain/heights` proxy (disk-cached, serve-stale) resolves per-point ellipsoidal ground height for entity placement. Both are best-effort with a keyless-safe fallback (bundled EGM96 geoid math) if Re:Earth is unreachable.
 - **OSRM on the FOSSGIS routing servers.** Keyless (no API key). Every route is requested by a person: clicking A and B in the Directions layer, or a voice "route from A to B". The server-side `/api/route` proxy sends an identifying `User-Agent`, pins the upstream host, accepts 2-12 coordinates, rejects any leg over 600 km or a total over 2,500 km, caps the buffered response at 8 MB, times the upstream out at 12 s, rate-limits per client, caches each route for 10 minutes, and coalesces identical requests that are in flight at the same time. Turn-by-turn maneuvers are asked for only when a caller wants them (`steps=1`), so the callers that do not read them send the smaller request. The "fix the map" link the policy asks for is in the Data attribution popover beside the OpenStreetMap credit.
 - **FAA Special Use Airspace.** Keyless. `/api/drone-airspace` queries the public FAA AIS FeatureServer for prohibited (P) and restricted (R) zones only — not MOAs, TFRs or other SUA types — with simplified geometry, a body cap, paging, a one-hour cache and stale-on-error. The layer is US coverage, informational only, and is not a substitute for B4UFLY, LAANC or a preflight briefing. Data is fetched at request time and never stored or redistributed. US government public domain; courtesy attribution is registered in the Data attribution popover.
+- **iNaturalist.** Keyless. `/api/inaturalist/observations` returns cached random view samples (newest first globally), at most 200 per request. Recency uses observation time: the v1 `d1` filter and a rolling 48 h cutoff (whales 7 d); date-only rows qualify when their day starts within the window. Observation caches last 5 min (global 10 min), with stale fallback ≤1 h. `/api/inaturalist/grid` supplies density counts, cached 15 min. Both share a paced queue capped at 60/min and 8,000/day; only request counters persist in `.gev-cache/`. The server caches projected records, never raw responses. Private records are excluded; obscured coordinates become 0.2° cells. Observer identity is retained only for photo attribution. Eligible photos load directly from `inaturalist-open-data.s3.amazonaws.com`, with creator credit on ambient cards and creator/licence on selection. Per-record licences and noncommercial restrictions apply as listed above. Attribution appears in the layer row and Data attribution popover. Coverage follows community observations, not a census; Acartia adds Salish Sea marine mammals.
+- **iNaturalist grid (cell schema risk).** `/api/inaturalist/grid` shares observation-date, taxa, quality, pacing and budget rules with observations. A strict 64×64 UTFGrid schema guard fails closed; only logical-cell keys, counts and coordinates survive projection. Raw tiles, observation identifiers and free text are not retained. Projected tiles use a 400-entry LRU, 15-minute freshness and at most one hour of stale fallback. Views request at most six tiles; cached and adjacent-zoom coverage publishes before network waits, independently of observation pages. Cells supply a noninteractive density glow ranked within the view, from teal to amber with mono/CRT support. Every sighting badge comes from a real observation at its public position. Counts describe observations, not a population census. The endpoint is documented in the v1 and v2 API docs as “Grid Tiles UTFGrid” (`/grid/{z}/{x}/{y}.grid.json`), but its per-cell records are not specified; schema drift disables grids until revalidated. See `docs/KNOWN-ISSUES.md`.
+- **Acartia.** Keyless. `/api/acartia/sightings` reads the current 7-day marine-mammal feed for ALL, MAMMALS and WHALES views intersecting 45.5–50.5° N, 126–121° W in the Salish Sea. WHALES accepts recognized cetaceans; other identified marine mammals appear under ALL/MAMMALS. The server rounds positions to 0.01° and drops comments before caching projected records (10 min fresh, stale ≤24 h); raw responses are not retained. Selected text cards credit the reporting provider under CC BY 4.0 and show Be Whale Wise guidance. `/sightings/current` answers without a key today, but Acartia's README asks API users to create an account and generate an API key on the [Acartia dashboard](https://acartia.io/) and to follow its [community guidelines](https://acartia.io/register). Attribution also appears in the layer row and Data attribution popover. Opportunistic sightings, not a census.
 - **Mapped installations.** OpenFreeMap military polygons use a bundled Overture/OSM name index; wide views show named points. Optional operator-configured Overpass and explicit Google Places searches keep their own source paths. Mapped data does not establish current activity or complete coverage.
 - **Place search.** Named-place fly-to uses Google Geocoding when a Maps key is configured, then Photon (`PHOTON_URL`; unset uses the public instance, empty disables it), then `/api/geocode` (Nominatim search) when neither answers. `/api/geocode` and the voice outline route `/api/geocode/outline` share one Nominatim queue (`NOMINATIM_URL`; unset, empty and invalid values disable it; an operator must explicitly select an authorized endpoint): one request at a time at least 1.1 s apart, an identifying `User-Agent` and `Referer`, a short queue that refuses a burst, a pause after 429/403/5xx answers (honouring `Retry-After` in full), at most one retry after a network failure, and a per-install daily cap on public-instance requests (`NOMINATIM_DAILY_CAP`, default 50). Processes using the same installation state file hold one lock through the actual fetch invocation and recording the next public start, with the daily slot persisted before invocation; restarts share that count, spacing and any pause. An unfinished dispatch marker fails closed until operator recovery; it is never automatically reclaimed. Public access fails closed if the state file cannot be read, locked, written or semantically validated. This coordination does not span independent installations or state directories and does not establish an application-wide public-service allowance or authorize public use. An operator-selected non-public endpoint is outside the public cap, spacing and durable-state requirement; an upstream cooldown is kept with the endpoint that returned it rather than leaking across operator URLs. Answers are cached on disk (outlines 90 days, places 30 days, no-results 24 hours); failures are not cached. Outlines are looked up only for an explicit ask, after bundled data and any configured Overpass, and only results whose type suits the ask are used. Administrative outline responses expose country/admin-1/admin-2 identity only when the selected Nominatim row has a recognized, unambiguous address type consistent with its own name; numeric rank, ambiguous types, missing fields and contradictory names do not manufacture identity. It is not used for systematic or bulk queries.
 - **Street and building outlines.** Voice street highlights, pointed-at buildings and grounds use the OpenFreeMap vector tiles the traffic layer already loads. Traffic and outlines share one bounded pending fetch/decode owner per immutable XYZ tile; materialized outline geometry is charged to the retained-byte ceiling and capped by coordinate count. Consumer result caches and request lifetimes remain independent, while eviction or explicit teardown cancels queued idle projections and releases their decoded owner. No Overpass request is made unless `OVERPASS_UPSTREAMS` is configured. Named grounds require a returned name matching the selected place, except that an ask whose head noun names a kind of grounds (a school, university or college, hospital, cemetery, stadium or zoo) may use the part of the smallest unnamed tile area of that class that holds the resolved place; a differently named area never answers. Other anonymous landcover polygons cannot establish identity, so unsupported grounds stay unavailable rather than borrowing a nearby POI name.

README.md

@@ -426,7 +426,7 @@ _Ask for radio near anywhere and the globe starts broadcasting — every station
 
 ## 🛰️ What's on the Globe
 
-Twenty-one layers and map sources. **Nineteen have a keyless path.** Some offer additional capabilities with a provider key. (🟢 no key · 🟡 free key · 🔴 metered.)
+Twenty-two layers and map sources. **Twenty have a keyless path.** Some offer additional capabilities with a provider key. (🟢 no key · 🟡 free key · 🔴 metered.)
 
 | Layer                       | What you get                                                                                                                                                                                                                                                                                                                                                                        | Source                                  | Auth                                                                                                |
 | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------- |
@@ -452,6 +452,7 @@ Twenty-one layers and map sources. **Nineteen have a keyless path.** Some offer
 | 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🔴 optional paid token raises the allowance)                                                         |
 | 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way                                                                                                                                                                                                                                                                          | OpenStreetMap                           | 🟢                                                                                                  |
 | 🚫 **Prohibited & Restricted Airspace** | FAA prohibited (P) and restricted (R) special-use airspace as ground polygons, with name, altitude range and times of use on select. Not the UAS Facility Map or UAS flight restrictions; informational only, not for flight planning | FAA SUA                                 | 🟢                                                                                                  |
+| 🦉 **Wildlife Sightings** | Wildlife observed within 48 h (whales 7 d): density glow, taxon badges and anchored photo cards with creator/licence credit. Salish Sea marine mammals via Acartia; sensitive locations shown as 0.2° cells. Not a census | iNaturalist, Acartia | 🟢 |
 | 🌬️ **Wind**                 | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center                                                                                                                                                                                                                                                                 | NOAA GFS / ECMWF IFS                    | 🟢                                                                                                  |
 | 🌦️ **Observed Weather**     | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline                                                                                                                                                                                                     | NOAA nowCOAST                           | 🟢                                                                                                  |
 | 🌀 **Cyclones**             | Advisory positions, forecast tracks and uncertainty cones for the Atlantic and eastern/central North Pacific                                                                                                                                                                                                                                                                        | NOAA NHC / CPHC                         | 🟢                                                                                                  |

SECURITY.md

@@ -81,7 +81,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
 - **Redacted debug logging.** The voice debug log (`.gev-logs/`, gitignored) strips API keys, bearer tokens, client secrets, and image data URLs before writing.
-- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights`, `/api/drone-airspace`, `/api/overpass` and voice place search's `/api/osm/features`, which spends the same operator Overpass) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map and voice need them to work behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
+- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights`, `/api/drone-airspace`, `/api/inaturalist/observations`, `/api/acartia/sightings`, `/api/overpass` and voice place search's `/api/osm/features`, which spends the same operator Overpass) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map and voice need them to work behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads and the Maps JavaScript API that Street View runs on, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
 
 Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance.

changelog.d/1520-voice-camera-tilt.md

@@ -0,0 +1,6 @@
+- Voice "tilt the camera" works from the top-down view a fly-to lands on: the
+  camera swings about the place under the crosshair, keeps its heading, and can
+  tilt to a spoken angle ("tilt 45 degrees") or a default oblique view. A tilt,
+  orbit, pan or rotate said with a fly-to ("fly to Paris and orbit it") now
+  waits for the flight to land, and is dropped if you move the map meanwhile
+  (Manjunath, @manjunath22466, #1520).

changelog.d/1532-globe-in-view.md

@@ -0,0 +1,11 @@
+- Keep the globe in view from orbit. Cesium's free look (Shift+drag) turned
+  the camera in place, so a few drags from the whole-globe view left only
+  stars, and the pose stayed in the share link. Free look now works only below
+  1,000 km, and above it a drag that starts on the stars orbits the globe
+  instead of turning the camera; a camera move that ends above it with no
+  planet surface in view (inside the scope keyhole when the scope is on) turns
+  straight down; and voice tilt and turns from orbit stop while the planet is
+  still on screen and say so instead of reporting a turn they could not make.
+  Thanks to [Chad Elliott](https://github.com/THEtheChad) for the review that
+  closed the drag path and kept authored scenes framed (Manjunath,
+  @manjunath22466, #1532).

changelog.d/1546-chat-provider-switch.md

@@ -0,0 +1,5 @@
+- Keep typed chat's view when switching AI Provider: Settings opened from
+  chat stay chat's Settings for the new provider instead of falling back to
+  voice and widening the dock. Opening chat or closing the
+  voice panel now also clears a voice error left on the dock (Manjunath,
+  @manjunath22466, #1546).

changelog.d/1556-cockpit-own-layer-entry.md

@@ -0,0 +1,6 @@
+- Enter Cockpit with only the ridden aircraft's layer on. Contacts is no longer
+  required, and ending Contacts mid-session keeps the view and the layer it
+  rides; turning off the aircraft's own feed ends the view, a missing other
+  feed reads `… FEED OFF · PARTIAL PICTURE`, and double-clicking the followed
+  aircraft or the entry beside its readout enters it (Denis Groshev, @ZloyS,
+  #1556).

changelog.d/1591-wildlife-sightings.md

@@ -0,0 +1,12 @@
+- Add Wildlife Sightings in the Wildlife layer group, off by default, using
+  keyless iNaturalist observations within 48 h (whales 7 d) and Acartia Salish
+  Sea marine mammals. CONFIRMED and taxa filters share via token `9`.
+  A noninteractive density glow accompanies real-sighting taxon badges,
+  decluttered species labels and credited ambient photos. Selection stays
+  pinned across camera and sample changes and opens an anchored photo card
+  with a contained image, creator/licence and one iNaturalist source link.
+  Obscured and Acartia sightings use text-only cards; private records and
+  Acartia comments are excluded. Attribution appears in the layer row and
+  Data attribution popover. Cached progressive tiles, bounded image/billboard
+  work and a paced queue preserve iNaturalist's 60/minute and 8,000/day limits.
+  All 11 locales supported. (lyehe, #1591)

docs/CURRENT-STATE.md

@@ -65,6 +65,59 @@ settling. Oblique views below 300 km are left alone.
 `QA_BASE_URL=http://localhost:4173 node scripts/qa-zoom-out-guard.mjs` exercises
 the real browser controller at desktop and phone widths with keyless fixtures.
 
+Cesium's free look (Shift+drag, which turns the camera in place) works only
+below 1,000 km. Above that height a few drags could turn the whole planet out of
+frame and leave only stars, so Shift+drag does nothing there. Cesium also turns
+the camera in place for a drag that starts on the stars below its trackball
+height (7,500 km by default); that height is lowered to 1,000 km, so such a drag
+orbits the globe above it, as it does higher up, and a tilt (drag or touch)
+while the screen centre is on the stars there tilts about the planet's edge or
+does nothing, wherever it starts. Rotation drags that start on the planet, and
+zoom, are unchanged. How much of the frame shows the planet's surface is
+measured by casting a 32×18 grid of view rays at the ellipsoid; while the scope
+mask is on (the default) only the rays inside its keyhole count, since the mask
+hides or dims the rest. Voice tilt and in-place turns of a free 3D camera above
+1,000 km stop when about a tenth of the frame still shows the surface (or about
+as much as it showed when it started), never less than about 1% of the visible
+frame, and a view that already shows less only keeps or gains what it has. A
+turn that cannot go half a degree further without crossing that limit is refused
+with a reason instead of reported as done, and a turn it accepts turns at least
+that half degree. A voice tilt to an angle (or a bare tilt, to -45°) that the
+limit stops short of is aimed at the angle where it stops, and its result names
+that angle (`pitchDeg`) with a `note`. A turn that keeps or gains surface is not refused, even after
+the window has been resized, except that near the limit, where the planet's edge
+crosses the sample grid, sampling wobble can occasionally refuse one (most often
+above about 15,000 km and on phone or ultrawide frames); nothing then turns away
+from the planet. A turn that starts where the last voice turn left the camera
+keeps that turn's limit, or a higher one if the planet now fills more, so
+repeating the request does not take any more; once anything else has moved or
+turned the camera, a turn is measured from what is on screen. When a camera move
+ends above 1,000 km with no ray on the surface, the camera turns straight down
+at the same position and heading. The end of a move is taken from Cesium's
+move-end event and from a check of its own that samples the pose every 250 ms
+after a move starts and acts once it has held for half a second, because at some
+of these poses the camera drifts by a rounding error every frame and Cesium
+never sees it stop. That check keeps watching until move-end arrives, recovering
+once after each move that comes to rest, and gives up five minutes after the
+camera last moved. Limb glow, and a surface sliver up to about one grid cell
+thick (some 50 px on a 900 px tall frame), can count as out of view. The
+zoom-out guard above keeps wheel and pinch zoom-outs in view; this catches the
+other ways a move can end looking away, such as a saved or shared view that did.
+Views with more surface than that, such as the oblique orbital Director shots,
+are left as they are, and so are tracked or locked cameras, a camera flight in
+progress, a Director scene while it plays (holds included), a pointer held
+down on the globe (a drag held still; with several fingers down, until the
+last is released) and the 2D and Columbus modes; a check a flight, scene or
+held pointer defers runs once it ends. A release outside the window that the
+page never sees counts as given once the window loses focus, the page is
+hidden, the canvas loses the pointer's capture, or the pointer moves with no
+button down. A Director
+shot loaded or replayed outside a run is not a playing scene. A view that loses
+its surface without a camera move (a resize, or turning the scope on) is left as
+it is until the next move. A voice turn requested while the camera is tracked is
+judged by the pose voice's release of the follow camera will leave, before that
+release, so a refused turn keeps the tracking.
+
 Analyst region queries resolve unique Natural Earth names offline without
 geocoding, so Gold Coast and Ivory Coast name the West African natural regions.
 Duplicate names require a geocoded containment anchor; when several entries for
@@ -98,6 +151,106 @@ across the antimeridian, so they cannot use the strict ±180 check as-is, and
 `src/sources/adsbRecords.js` and `server/providers/common/geo.js` keep their own
 implementations.
 
+## Wildlife Sightings — iNaturalist and Acartia
+
+**Wildlife Sightings** (`wildlife-sightings`, share-link token `9`) is off by
+default in the Wildlife group between Events and Weather. CONFIRMED and six
+taxa presets round-trip in share links. Voice is off for this layer for now;
+it is outside analyst queries and DETECT. Community observations are not a
+census; private records are excluded.
+
+`/api/inaturalist/observations` requests verifiable wildlife in view within
+48 h (whales 7 d). Recency uses observation time: the `d1` date filter and a
+strict rolling cutoff. Date-only rows qualify only when their day starts
+within the window. Close views use a cached random sample of at most 200 rows;
+global samples use newest observations first. Observation caches last five
+minutes (global ten minutes), with stale fallback for at most one hour.
+
+Observations and grid tiles share a paced priority queue: a four-call burst,
+then one request per second, at most four in flight, ≤60/minute and a persisted
+8,000/day budget. Superseded consumers leave before dispatch. The recovered
+queue tail isolates failures; ordinary grid failures do not fail observations.
+Provider 429 cooldown is shared; 5xx cooldown is resource-specific. Failed tiles
+retain good cells for at most one hour. Stale replies carry `X-Data-Stale` and
+known `Retry-After`. Failures keep filters and drawn rows, reporting DEGRADED
+with retry timing; logs exclude request URLs and upstream exception text.
+A partial failure still draws what arrived: a failed iNaturalist request, or
+one failed half of an antimeridian view, keeps a good Acartia reply and the
+other half, retains that area's last iNaturalist rows and reports DEGRADED.
+The update fails outright only when every requested source failed. Each failed
+source keeps its HTTP status and `Retry-After` (the HTTP status counts when no
+`X-Upstream-Status` is sent), and the next request waits out the longest 429 or
+5xx cooldown among them. One update requests both sources, so the cooldown
+holds the whole layer; a fully successful refresh clears it.
+
+`/api/acartia/sightings` adds Salish Sea marine mammals within 45.5–50.5° N,
+126–121° W, cached ten minutes and stale for at most 24 h. A valid empty
+snapshot, including one whose rows all fall outside coverage or the species
+checks, is a fresh success that clears earlier rows; only a malformed or failed
+upstream reply serves stale and starts a retry cooldown. WHALES accepts only
+recognized cetaceans; other identified marine mammals appear under ALL or
+MAMMALS. Sensitive iNaturalist locations remain 0.2° privacy cells; Acartia
+positions are rounded to 0.01° on the server. Acartia comments are never retained.
+Observer identity is retained only for photo attribution.
+
+`/api/inaturalist/grid` supplies a dedicated, nonpickable billboard density glow,
+with a view-relative density ramp from cool teal to warm amber. Overlapping
+Gaussian splats span four logical cell widths; mono and CRT styles follow map
+and cockpit vision changes. Empty snapshots paint nothing. Full footprints
+stay inside the globe limb with a 5% radius margin; opacity fades from full at
+3,000 km to zero at 8,000 km camera altitude. Culling and cached coordinates
+add no per-frame work and leave sighting counts intact.
+
+Only real sampled observation rows produce taxon badges at their public
+positions. The badges use 28 px screen buckets, a 22 px overlap check and a
+5,000-observation cap. Tinted circles have a white Material Symbols glyph and
+1.5 px dark outline, remaining 12–22 px at all distances, including selection.
+Glyphs: birds `raven`, mammals `pets`, reptiles `egg_alt`, amphibians
+`water_drop`, fishes `set_meal`, insects `bug_report`, arachnids `pest_control`,
+plants `eco`, fungi `umbrella`, other animals `category`, unknown `question_mark`.
+A plain circle displays while the icon font loads. Row counts read
+“{n} sightings in view”, using visible grid totals when available.
+
+Views request at most six tiles, coarsening zoom for complete coverage. Server
+and client keep bounded 400-tile caches for 15 minutes. Cached, stale and
+adjacent-zoom tiles publish before network waits; each arriving tile replaces
+its covered area, including healthy empty tiles. Grid tiles publish even while
+the independent observation request is pending or failed. Enable waits for one
+camera settle; camera acquisition uses moveEnd with a 600 ms debounce. The
+documented UTFGrid endpoint's unspecified cell records have a schema guard;
+see `KNOWN-ISSUES.md`.
+
+Ambient cards use a fixed 96 px image width and a short creator name credit,
+with a bounded frame cache. New cards fill free screen regions; visible cards
+survive a random sample refresh until they leave the view or observation
+window. The 110/125 km show/hide thresholds provide hysteresis; cards scale
+and fade gradually through 120 km. Only painted photos suppress their own
+badge and label. Labels yield to painted cards, then compete by ambient score;
+repeated translated names within 80 screen pixels yield to higher-priority
+content. At most 150 labels enter the host. Titles prefer a word boundary for
+ellipses; accessible names remain complete. Selected thumbnails or names use
+the shared selected chrome and paint lane, with no canvas source link.
+
+Clicking a badge, label or photo flies to its supplied position and opens a
+compact anchored photo card. Selection stays pinned across camera, filter and
+sample changes until explicit deselection or layer disable. Its medium image
+uses `object-fit: contain`, with names, compact observed age and creator/licence.
+The card is the single source link to iNaturalist. Obscured sightings also stay
+text-only; Acartia stays text-only with provider credit and whale guidance,
+and its source link is always `https://acartia.io/`, never a contributed URL.
+Placement avoids actual HUD, toolbar and rail rectangles, panning only when
+necessary while preserving zoom. Escape, close or an outside click closes the
+card and clears selection. Camera/layout changes reposition the card without
+an idle frame listener; shell teardown also removes its host and subscription.
+
+Attribution appears in the layer row and Data attribution popover:
+“iNaturalist contributors · licences per record”, plus Acartia when drawn.
+Disable/destroy releases the glow collection, texture atlas, timers, queues and
+style listeners. Synthetic fixtures cover privacy, acquisition, rendering,
+selection and card placement. Deterministic operation checks run in `npm test`;
+wall-clock budgets run in `npm run test:perf`. All 11 locales are supported.
+
+
 ## Prohibited & Restricted Airspace — FAA special-use airspace
 
 The Infrastructure group includes **Prohibited & Restricted Airspace** (`drone-airspace`,
@@ -766,9 +919,12 @@ each side, and the empty Voice Preview suggests things to say until voice
 starts. Settings opened from chat keep chat's frame and show the shared AI
 provider, the quick-commands option and then the voice preferences (Voice
 Preview, inactivity timeout and model tier), so they stay in reach while
-Preview is off, with Back to chat; voice Settings show Back to voice. Escape steps back from either Settings view, closes Voice
+Preview is off, with Back to chat; voice Settings show Back to voice. Switching
+AI Provider keeps that view: Settings opened from chat stay chat's Settings,
+in chat's frame, for the new provider. Escape steps back from either Settings view, closes Voice
 Preview, and does nothing in chat. Closing chat ends a typed session, and the
-voice panel's close turns voice off. Asking the assistant from chat to open
+voice panel's close turns voice off. Opening chat or closing the voice panel
+also clears a voice error left on the dock. Asking the assistant from chat to open
 Voice Settings or Voice Preview puts chat away, minimized or not, and shows the
 voice panel; the typed conversation and its running reply carry on, and the
 chat button brings them back.
@@ -1541,6 +1697,8 @@ are owned by a renderer-free panel component. The layer manager supplies current
 snapshots, lifecycle actions and row descriptors. Remount and teardown remove
 listeners and row subscriptions; obsolete completions do not repaint old rows.
 The clear control presents busy state while its existing action owns the transaction.
+The Wildlife group follows Events and precedes Weather; Wildlife Sightings
+provides its confirmed toggle, taxa presets and fixed-order, nonempty legend.
 
 ## Sky background
 
@@ -4212,6 +4370,7 @@ its criteria cannot be silently ignored.
 | Ski Pistes ⛷ (`ski-pistes`) | OpenSnowMap piste raster tiles (keyless; CC BY-SA tiles, OSM data ODbL; no bulk download) | `src/data/osmOverlays.js` | — (browser-direct tiles) | on view (Cesium tile requests; no polling) |
 | Fire Perimeters 🔥 | NIFC WFIGS current interagency perimeters (keyless, paged past the 2000-record cap); InciWeb catalog + incident page origin and update time checks for verified incident-page links | `src/layers/perimeters/` via `src/app/layers/perimeters.js` | `/api/fire-perimeters` + `/api/fire-perimeters/inciweb/*` | 5 min (server caches: catalog 1 h; publication 30 min) |
 | Prohibited & Restricted Airspace 🚫 | FAA Special Use Airspace prohibited (P) and restricted (R) zones (keyless FeatureServer, simplified geometry) | `src/layers/droneAirspace/` via `src/app/layers/droneAirspace.js` | `/api/drone-airspace` | 1 h (server cache 1 h; stale-on-error) |
+| Wildlife Sightings 🦉 | iNaturalist wildlife observed within 48 h (whales 7 d), per view; Acartia Salish Sea marine mammal coverage (keyless) | `src/layers/wildlifeSightings/` via `src/app/layers/wildlifeSightings.js` | `/api/inaturalist/observations`, `/api/inaturalist/grid`, `/api/acartia/sightings` | camera moveEnd (600 ms debounce; enable settles 300 ms) + 5 min (observations 5 / 10 min; tiles 15 min; stale ≤ 1 h / 24 h) |
 
 GNSS Integrity samples a 250 nm circle around the Earth point under the screen
 centre. Camera reads debounce for 600 ms with a monotonic 2.5 s minimum gap;
@@ -4856,7 +5015,7 @@ cannot claim full acceptance.
 
 **Lifecycle and proxy.** Contacts temporarily disables Transit and restores its
 prior state on exit; Space Missions refuses enablement while isolating replay
-data. Cockpit enters through Contacts and does not independently enable Transit.
+data. Cockpit does not need Contacts and does not independently enable Transit.
 The proxy fetches registered URLs only, validates redirect origins, bounds
 responses and decoding, caches successful snapshots, and backs off after failed
 refreshes. A 304 confirms contact without appending history. Missing vehicles
@@ -5587,7 +5746,7 @@ and unreachable upstream (502/504) separately from road geometry.
 > branch: **2,281 on Node 25.6.1** (allocation suites skipped) = 2,255 on
 > `main` + 26 route pins; the same tree on Node 24 reports 2,295.
 
-- **Camera verbs** (`src/cameraVerbs.js`) — one motion slot, driven per clock tick. `move_camera` orbits/pans/tilts/rotates; `fly_route` is a cinematic dolly along an existing route annotation. `rotate_globe` rotates the world-space camera rigidly around Earth's center using its screen-up axis, preserving geocentric range and framing. Left/right describe visible globe motion, while `rotate` turns the camera in place. Omitted globe direction/mode default to right/continuous; explicit values prevail. Other camera motions keep their once default. Admission requires 3D, no Cockpit/tracking owner and the whole globe inside the existing keyhole circle, using the shared keyhole/projection geometry and vertical camera FOV with a rotation-local bounding-sphere cone for off-axis containment. Canvas-edge clipping alone does not block a rigid rotation or its unchanged Globe View preset. There is no altitude cutoff. An already smaller, fully framed globe rotates directly; repeated nudges, direction and speed changes recheck current framing without demanding a reset merely because ellipsoid altitude varied. A close-up or overlap refuses without moving the camera. When the unchanged Globe View preset fits, voice says “Globe rotation isn’t available from this view. You can say ‘Reset to Globe View and rotate the globe.’” without asking a permission question or automatically resetting. Explicit Reset/Show Globe View commands remain direct; an explicit reset-and-rotate request waits for reset success before requesting rotation. If OpenAI dispatches both tools together, rotation waits for earlier same-response resets and is skipped if any fails or is cancelled. OpenAI rejects later tool calls in the same response after a globe refusal, including calls arriving while globe admission is pending, and preserves response-scoped `tool_choice: none` for the refusal follow-up; Gemini rejects further tool execution, including queued sibling calls, until fresh typed input or admitted speech. Model interruption, advisory captions and microphone toggles do not release that guard. There is no pending Yes/No offer. Outside the refused response, explicit-command interpretation and avoiding repeated resets remain model-guided; a distinct model-issued reset call is not an app-enforced proof of user intent. A failed standalone reset can still be retried by the model, and a reset result does not guarantee the camera has fully settled. Before suggesting a reset, a cloned camera checks the unchanged Globe View destination against the same keyhole/depth rules without moving the live camera. If that preset cannot fit, `globe-reset-unavailable` asks for further zoom and the refusal instructs further zoom instead of a reset; this also covers ultrawide views. Unsupported view geometry or non-WGS84 projection assumptions fail closed without the closer-zoom instruction. Supported camera inputs/navigation intents cancel rotation before their action. Finite radius greater than the ellipsoid's maximum radius proves whole-arc clearance at constant centre-distance; no low-altitude swept solver is needed. The unchanged Globe View reset preset remains 18,000,000 m. Terrain and buildings remain outside the guarantee.
+- **Camera verbs** (`src/cameraVerbs.js`) — one motion slot, driven per clock tick. `move_camera` orbits/pans/tilts/rotates; `fly_route` is a cinematic dolly along an existing route annotation. `rotate_globe` rotates the world-space camera rigidly around Earth's center using its screen-up axis, preserving geocentric range and framing. Left/right describe visible globe motion, while `rotate` turns the camera in place. `tilt` swings the camera about the ground under the crosshair, so the place stays centred and the heading is kept. It tilts in place instead with no ground under the crosshair, from beyond 1,000 km of range, or while an entity is tracked (voice releases the follow camera before moving, so a voice tilt from a tracked view still pivots); pitch stays within -89° to -5°, clamped only in the direction of travel so a top-down (-90°) view can tilt up out of it. Angles and limits are the camera's own pitch; at regional range the pivot's pitch is up to about 8° shallower (the Earth curves away), so the swing solves for the pivot pitch that gives the camera the angle asked for. A pivot swing toward the horizon lowers the camera (height above the pivot is range × sin|pitch|), so the swing stops lowering it at 150 m above the pivot (not above the terrain behind the camera) and the rest of the tilt happens in place. Beyond about 17 km of range the swing never hands over to an in-place tilt (that would lift the crosshair onto the sky); it keeps the camera at least 0.5° above the place's own horizon, which from roughly 500 km stops it short of -5° with the place still centred: a tilt to an angle beyond that stops at the angle reached and says so (`pitchDeg` is the angle reached, with a `note`), a continuous tilt stops there, and a further tilt up is refused as at the limit. A zoom during a pivoting tilt scales the range it holds, as for orbit, but a zoom in stops at the range that keeps that 150 m clearance; a zoom that can move no further (that floor, the 80 m floor, or the cap: 1,000 km for a tilt, where pivoting stops, and 5,000 km for an orbit) is reported as not zoomed. A zoom during a tilt to an angle re-judges the place's horizon limit at the new range: when that moves where the tilt ends, the tilt eases from where it is to the new end (holding the camera's pitch through the range change; a camera the zoom leaves past the new range's limit steps down to it with the zoom, since past it the place would drop behind the Earth), and the zoom's result names that angle (`pitchDeg`) with a `note`. Once the tilt continues in place, a zoom moves the camera like any zoom. A tilt with `pitchDeg` (or with neither angle nor direction, which means -45°) eases to that angle; a positive angle means the same angle below the horizon. `pitchDeg` is absolute, not a step: sent with a `direction` it contradicts, the tilt is refused. An angle the camera already holds answers `unchanged` but still takes navigation, so it stops a running motion and releases the follow camera. A tilt left or right is refused. A voice tilt, orbit, pan or rotate sent while a voice `fly_to_location` is still looking up or flying ("fly to London and tilt the camera" or "fly to Paris and orbit it" arrives as two sibling calls) waits for that flight to land, up to 15 s (moving to a later fly-to in the same reply as soon as it begins, whatever the earlier one reports), so it neither cancels the flight nor gets replaced by it; if the flight is cancelled, finds nothing or times out, the user grabs, touches or scrolls the map during it, or another navigation (a location-panel search, share link or file import, which leave the flight flying) takes the camera during it, the motion is not run and says so. A motion that runs after a fly-to of the same reply has already found nothing (Gemini runs one turn's calls one by one, and passes its turn as the reply) is refused the same way rather than moving the old view; a motion in a later reply runs. `stop` and `rotate_globe` do not wait, and a motion sent before its fly-to is not reordered: it runs at once, and the fly-to's result names the motion it stopped (`stoppedMotion`). Orbit still arms (`armed: 'waiting-for-arrival'`) when it starts during any other camera flight, and captures its target once the tween queue has been quiet for 0.8 s. Omitted globe direction/mode default to right/continuous; explicit values prevail. Other camera motions keep their once default. Admission requires 3D, no Cockpit/tracking owner and the whole globe inside the existing keyhole circle, using the shared keyhole/projection geometry and vertical camera FOV with a rotation-local bounding-sphere cone for off-axis containment. Canvas-edge clipping alone does not block a rigid rotation or its unchanged Globe View preset. There is no altitude cutoff. An already smaller, fully framed globe rotates directly; repeated nudges, direction and speed changes recheck current framing without demanding a reset merely because ellipsoid aLine truncated
   - **The route dolly is shaped, not linear** (2026-08-20). A trapezoid speed profile (smoothstep up, cruise, smoothstep down, distance taken as the closed-form integral) eases both ends without changing the pace — duration is still `totalM / ROUTE_M_S[speed]`, with one exception: a 0.5 s minimum keeps a degenerate route from being an instant teleport, so routes under 10 m (slow) / 20 m (normal) / 45 m (fast) fly SLOWER than the speed word, never faster. Turns bank up to **10°** (a 90° street corner settles near 7.5°), measured as a triangular pulse over a 4 s window centred on the camera so the roll leads in and unwinds after. Altitude breathes ±20 m around the 260 m mean and lifts up to 26 m into turns. Pitch is LOCKED at −32°; heading comes from a gaze that leads the path by 6.5 s of travel. `prefers-reduced-motion` zeroes the roll and the altitude shaping and keeps the easing.
   - **Invariants — do not "fix" these.** (1) **Every** release levels the roll: completion unwinds it through the ease-out envelope, and `interruptCameraMotion` zeroes it synchronously (heading/pitch/position preserved). Cesium keeps the last up vector it was handed, so skipping this leaves the user holding a tilted horizon. (2) Heading is interpolated as an ANGLE about the local up, never as a Cartesian lerp — a lerp cannot cross an antipodal pair, so an out-and-back route looked backwards for the entire return leg; `signedTurnRad` branches the exact-180° case deterministically because the cross product's sign there is a floating-point coin toss. (3) A COLD floor cell is missing data, not flat ground: route vertices carry height 0, so trusting them flew a mountain corridor at 260 m above the ELLIPSOID. The corridor warm is fire-and-forget, so the dolly ARMS — camera untouched, no teleport onto the route — for up to 1.2 s waiting for real floor data, falls back to a rendered-mesh probe (`scene.sampleHeight`) when the DEM stays cold — latched to ONE firing per flight, for exactly the cells the cache could not answer, so a route costs at most 8 `sampleHeight` calls however long it arms — and otherwise holds the launch altitude for the whole route. A corridor is only RESOLVED when every cell is accounted for: one warm cell says nothing about the ground under the other seven, and treating it as an answer let the dolly descend to 460 m over a 1,600 m rendered surface. The probe reads the rendered surface at the current LOD (rooftops and primitives included) — a better estimate than nothing, not a guaranteed upper bound. Never descend blind. The floor is SMOOTHED in both directions for the ride while the hard clearance clamp reads the RAW sample, so a cell boundary cannot pop the eye but a cliff is still cleared on the frame it is seen. A pre-departure floor is adopted whole; one arriving mid-flight is eased onto, and the eye's descent rate is capped.
   - Pins: `src/routeCinematics.test.mjs` (26 tests), with `scripts/qa-flyroute-mutations.mjs` reverting each fix individually to prove they are load-bearing (19 named defects); rendered proof `scripts/qa-flyroute-cinema.mjs` (drives the real voice runner, measures the real Cesium camera every frame, writes a labelled contact sheet).
@@ -6079,12 +6238,21 @@ apply to `public/` assets or built-preview serving.
 - Panoptic mode shows labels on ALL items (no stride skipping). Tracked/selected items keep bounding box but suppress label (skipLabel flag). Tracked items get enlarged bounding boxes (56×44 vs default 22×14).
 - The 3D aircraft toggle reveals `Proximity` and `All` modes and drives both commercial and military aircraft layers. It ships ON in `Proximity`, so the button paints lit and the mode row paints open from markup; the panel is therefore ~36 px taller than before, which Cockpit's Display/Radio strip absorbs through its existing primary-only corridor solver.
 - The host-painted tracked-target readout sits above the post-FX layer and follows tracked aircraft/satellites or selected mapped installations using each layer's display-position contract.
-- Cockpit entry is gated to the operational Contacts context bundle. The
-  Context chooser must be in Contacts mode, Live Flights and Military Flights must both
-  be enabled, and a civilian or military aircraft must be tracked. The visible
-  Cockpit actions and the `C` shortcut use the same gate, so ordinary standalone
-  flight-layer selection cannot enter a context-dependent cockpit.
-- **Aircraft cockpit view:** selecting a commercial or military aircraft reveals a `COCKPIT` action (`C`). Cockpit mode temporarily releases Cesium's orbit-follow transform and drives a first-person camera from the tracked aircraft's existing smoothed display position and course. Its concave helmet-visor HUD shows callsign, UTC time, coordinates, curved roll/pitch guides, and a seven-division heading tape. Ambient commercial and military AIR contacts use a Cockpit near/far band selected by the shared Display 3D mode: Proximity admits at 150 km and retains to 185 km; All admits at 400 km and retains to 450 km. The shared 3D toggle now applies in Cockpit: Off keeps in-range contacts as rotating 2D aircraft silhouettes, while On lets a ready admitted glTF take over without a drawing gap. The Cockpit model cap remains 60 and can only lower the map budget; in-range contacts that are capped or still loading remain 2D silhouettes instead of degrading to out-of-range dots. Contacts outside the selected band use small rotation-free cyan-white pips for civilian aircraft and amber pips for military. The pilot's own airframe is not drawn in first person, and exiting clears the Cockpit band and restores normal map silhouettes/models. The normal left accordion remains available for Layers and Authoring and keeps the same 26vh HUD-aligned anchor used in map mode, independent of whether the bottom-left Contact card is expanded or collapsed; the right-rail CCTV and Context chooser are hidden to avoid duplicating or overlapping the cockpit presentation. When the intelligence HUD is enabled, its classification, scene summary, collection/orbit metadata, coordinates, and imaging-status text remain visible as reduced peripheral cockpit telemetry; the optical center and flight instruments stay clear, and turning the HUD off still hides it. Ground speed, exact heading, and rendered altitude form one compact lower-center instrument cluster, keeping the horizon and peripheral view open. A second live altitude tape hugs the inside-right visor rim: its rail and nine moving ticks are derived from the same responsive keyhole radius, remain 20 px inside the circular edge even on wide displays, fade deeply at both vertical ends, and move continuously behind a fixed current-altitude pointer; its interval tightens automatically near the surface and it is suppressed on narrow screens. Cockpit mode also has a weather-backed transparent volumetric-cloud pass derived from the supplied FBM/domain-warped R&D shader. It renders at no more than 520×320, uses 24 ray steps/three FBM octaves at 12 FPS, is clipped to the visor, fails clear when Open-Meteo is unavailable, and stops its animation completely on cockpit exit. It does not restore the prior CPU weather canvases, precipitation, scene fog, or any map-mode effect. When Contacts is active for the tracked aircraft, the compact `CONTACT` rail adds the 250 km subject window, four cohort counts, nearest observed/mapped example with relative bearing and distance, freshness, explicit uncertainty, and Previous and Next controls plus its own collapse control. The mirrored right rail is a three-page **cockpit briefing carousel**: source-backed live signals, location-matched regional headlines, and physical-region/current-weather context from bundled Natural Earth polygons and Open-Meteo. It is manual-first: Previous, Next, and direct page controls are always available, and the visible `CYCLE OFF` / `CYCLE ON` control starts or stops the nine-second page cycle. The cycle pauses on hover or keyboard focus and stops while collapsed, hidden, or outside cockpit mode; live signal data continues refreshing either way. Empty news matches and unavailable news use compact text states rather than reserving an empty media frame; partial local data remains explicit. Article links open their original publisher, and no headline is treated as verified risk intelligence. On desktop both cockpit rails use the same width and share a bottom-aligned safe baseline in opposite corners above the peripheral MGRS/GSD/time telemetry, leaving both that text and the lower-center instrument cluster readable. They collapse independently to slim tabs without stopping live data updates. Narrow screens use separated top/bottom fallbacks. Empty-space globe clicks are inert while cockpit owns the camera; `C`, `Escape`, or `EXIT COCKPIT` explicitly exits and restores the same tracked entity and standard follow camera. Unknown feeds remain unknown, selection loss still exits safely without inventing a replacement track, and the cockpit never presents the summary as threat scoring or an all-clear. This is a desktop first-person presentation, not a WebXR session.
+- Cockpit entry needs only the layer of the aircraft it rides and that aircraft
+  tracked: Live Flights for a civilian, Military Flights for a military aircraft
+  (the tracked info's `layerId`; `cockpitEntryAllowed` in
+  `src/contextModePolicy.js`). Contacts is not required, and the other aircraft
+  layer, Live AIS Vessels and every other layer may be turned on or off before
+  or during a session. A Context mode change still in flight blocks entry until
+  it settles. Turning off the layer the view rides ends it. Riding an aircraft
+  while Contacts is on adopts its layer as the user's own, as a direct selection
+  does (`adoptLayerVisibility`), so Contacts ending, by its own switch or one of
+  its layers going off, restores the pre-Contacts layers but keeps the ridden
+  one and the view; Live Signals then drops the rows Contacts built and shows
+  `CONTEXT STANDBY`. The visible Cockpit actions, the `C` shortcut and voice use
+  the same gate; voice entry still opens Contacts first, as its layer-targeted
+  entry navigates through Contacts.
+- **Aircraft cockpit view:** selecting a commercial or military aircraft reveals a `COCKPIT` action (`C`) once that aircraft's own layer is on; Contacts is not required. The action shows in Contacts (`#cockpit-entry`) and under the Intel HUD's bottom-right readout (`#cockpit-entry-readout`, with the HUD on, in its Tactical and Cyber layouts), so entry needs no Contacts panel. Turning off the ridden aircraft's layer ends the view (the layer clears its tracking). When an air feed the surrounding picture uses is off, the Cockpit says so instead of blocking: Live Signals leads with `MILITARY FEED OFF · PARTIAL PICTURE` or `FLIGHTS FEED OFF · PARTIAL PICTURE`, and the Contact card shows that line in place of its inputs status, so a partial picture is never presented as complete. `control_cockpit` refuses entry with `entryBlockedReason` `contacts-starting` (a Context change in flight), `subject-layer-off` (the aircraft's layer, or with none tracked any aircraft layer, is off) or `no-tracked-aircraft`. Cockpit mode temporarily releases Cesium's orbit-follow transform and drives a first-person camera from the tracked aircraft's existing smoothed display position and course. Its concave helmet-visor HUD shows callsign, UTC time, coordinates, curved roll/pitch guides, and a seven-division heading tape. Ambient commercial and military AIR contacts use a Cockpit near/far band selected by the shared Display 3D mode: Proximity admits at 150 km and retains to 185 km; All admits at 400 km and retains to 450 km. The shared 3D toggle now applies in Cockpit: Off keeps in-range contacts as rotating 2D aircraft silhouettes, while On lets a ready admitted glTF take over without a drawing gap. The Cockpit model cap remains 60 and can only lower the map budget; in-range contacts that are capped or still loading remain 2D silhouettes instead of degrading to out-of-range dots. Contacts outside the selected band use small rotation-free cyan-white pips for civilian aircraft and amber pips for military. The pilot's own airframe is not drawn in first person, and exiting clears the Cockpit band and restores normal map silhouettes/models. The normal left accordion remains available for Layers and Authoring and keeps the same 26vh HUD-aligned anchor used in map mode, independent of whether the bottom-left Contact card is expanded or collapsed; the right-rail CCTV and Context chooser are hidden to avoid duplicating or overlapping the cockpit presentation. When the intelligence HUD is enabled, its classification, scene summary, collection/orbit metadata, coordinates, and imaging-status text remain visible as reduced peripheral cockpit telemetry; the optical center and flight instruments stay clear, and turning the HUD off still hides it. Ground speed, exact heading, and rendered altitude form one compact lower-center instrument cluster, keeping the horizon and peripheral view open. A second live altitude tape hugs the inside-right visor rim: its rail and nine moving ticks are derived from the same responsive keyhole radius, remain 20 px inside the circular edge even on wide displays, fade deeply at both vertical ends, and move continuously behind a fixed current-altitude pointer; its interval tightens automatically near the surface and it is suppressed on narrow screens. Cockpit mode also has a weather-backed transparent volumetric-cloud pass derived from the supplied FBM/domain-warped R&D shader. It renders at no more than 520×320, uses 24 ray steps/three FBM octaves at 12 FPS, is clipped to the visor, fails clear when Open-Meteo is unavailable, and stops its animation completely on cockpit exit. It does not restore the prior CPU weather canvases, precipitation, scene fog, or any map-mode effect. When Contacts is active for the tracked aircraft, the compact `CONTACT` rail adds the 250 km subject window, four cohort counts, nearest observed/mapped example with relative bearing and distance, freshness, explicit uncertainty, and Previous and Next controls plus its own collapse control. The mirrored right rail is a three-page **cockpit briefing carousel**: source-backed live signals, location-matched regional headlines, and physical-region/current-weather context from bundled Natural Earth polygons and Open-Meteo. It is manual-first: Previous, Next, and direct page controls are always available, and the visible `CYCLE OFF` / `CYCLE ON` control starts or stops the nine-second page cycle. The cycle pauses on hover or keyboard focus and stops while collapsed, hidden, or outside cockpit mode; live signal data continues refreshing either way. Empty news matches and unavailable news use compact text states rather than reserving an empty media frame; partial local data remains explicit. Article links open their original publisher, and no headline is treated as verified risk intelligence. On desktop both cockpit rails use the same width and share a bottom-aligned safe baseline in opposite corners above the peripheral MGRS/GSD/time telemetry, leavinLine truncated
 - **Cockpit left-panel clearance:** the Cockpit Contact card and peripheral HUD participate in the adaptive left accordion's live obstacle measurements, including live viewport-height changes. Expanding Layers or Authoring keeps the active panel in the available upper-left corridor with internal scrolling; it does not cover the Contact card, lower Cockpit controls, or Cesium credit line. Outside Cockpit the hidden card does not alter the normal corridor.
 - **Cockpit Context scope:** the 250 km radius applies to the air/sea proximity cohorts. Installation counts come only from the currently loaded viewport and are labeled `CURRENT VIEWPORT ONLY` in the cockpit as well as the normal Context panel; neither surface presents them as a complete 250 km installation survey.
 - **Cockpit camera anchor:** first-person mode does not write feed-boundary corrections directly into the camera. A cockpit-only inertial anchor advances from the selected aircraft's displayed course and speed, then converges toward the authoritative delayed track with correction capped below forward motion. The displayed kinematics are derived from the same consecutive fix segment as the rendered position, with raw feed speed/course used only as fallback; a transient zero/missing feed speed therefore cannot freeze a visibly moving aircraft after layer enable or a map/cockpit handoff. Rendered altitude continues to come from that interpolated track position. Late ADS-B fixes and short render stalls can remove drift without accelerating or reversing the view. Camera placement runs before scene update/culling at a bounded 20 Hz so a moving cockpit does not force Photoreal 3D Tiles to retraverse on every display frame; textual instruments update at 10 Hz and context/layout work at 4 Hz. Every far Cockpit contact pip shares one stable Cesium texture-atlas entry and skips unused screen-projected course calculations, while only in-range 2D aircraft silhouettes pay the screen-projected rotation cost; ambient glTF collections are hidden/retained rather than synchronously destroyed at cockpit entry, and context rails lay out only on explicit content/state changes and viewport resize. The deliberate 15/30-second layer interpolation delays and per-Cesium-frame position caches remain unchanged.

docs/KNOWN-ISSUES.md

@@ -10,6 +10,24 @@ For the roadmap and open backlog, see the repository issue tracker.
 
 ## Open
 
+### Wildlife grid relies on the iNaturalist UTFGrid cell schema
+
+Status: Open (guarded fallback)
+
+The `/v1/grid/{z}/{x}/{y}.grid.json` endpoint is documented in the v1 and v2
+API docs (“Grid Tiles UTFGrid”), but the documented response only defines the
+UTFGrid `grid`, `keys` and `data` members; the per-cell records are not
+specified. Its 64×64 UTFGrid shape, keys and cell records
+are validated in full at the allow-list proxy. A schema change or unavailable
+tile retains its last good cells for at most one hour; a cold unavailable grid
+uses sampled observations with the same badges and screen buckets, without
+claiming complete worldwide coverage. Tests use
+synthetic fixtures with the locally inspected tile's exact structure. Retest
+and update the schema guard before accepting an upstream shape change. Grid
+and observation calls share the paced queue, provider budget and 429 cooldown;
+ordinary tile failures do not block observation queries.
+
+
 ### Street traffic can be slow/uneven when panning across dense city blocks
 Status: Open (partially mitigated)
 

index.html

@@ -26,7 +26,7 @@
        with the sources: src/materialSymbolsSubset.test.mjs fails when a source
        names a glyph this list is missing, because a missing glyph does not draw
        a box — the ligature never forms and the element renders the literal word. -->
-  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,400,0,0&icon_names=adjust,arrow_drop_down,arrow_forward,arrow_left,arrow_right,bolt,chevron_left,chevron_right,close,close_fullscreen,dark_mode,draw,east,flare,flight,handyman,layers,layers_clear,light_mode,local_fire_department,location_on,more_horiz,movie,my_location,navigation,normal,on,open_in_full,partly_cloudy_day,pentagon,public,radar,radio,right_panel_close,right_panel_open,rocket_launch,satellite_alt,search,settings,skip_next,skip_previous,streetview,timeline,tune,upload_file,videocam,view_in_ar,visibility,visibility_off" rel="stylesheet" />
+  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,400,0,0&icon_names=adjust,arrow_drop_down,arrow_forward,arrow_left,arrow_right,bolt,bug_report,category,chevron_left,chevron_right,close,close_fullscreen,dark_mode,draw,east,eco,egg_alt,flare,flight,handyman,layers,layers_clear,light_mode,local_fire_department,location_on,more_horiz,movie,my_location,navigation,normal,on,open_in_full,partly_cloudy_day,pentagon,pest_control,pets,public,question_mark,radar,radio,raven,right_panel_close,right_panel_open,rocket_launch,satellite_alt,search,set_meal,settings,skip_next,skip_previous,streetview,timeline,tune,umbrella,upload_file,videocam,view_in_ar,visibility,visibility_off,water_drop" rel="stylesheet" />
 </head>
 <body>
   <div class="gev-view" data-gev-view="scene-chrome"></div>

package.json

@@ -2,7 +2,7 @@
   "name": "gods-eye-view",
   "private": true,
   "version": "0.3.0",
-  "description": "A real-time intelligence console for planet Earth — photorealistic 3D globe, live aircraft/ships/satellites/earthquakes/CCTV, and hands-free voice control. Runs in a browser.",
+  "description": "A real-time intelligence console for planet Earth \u2014 photorealistic 3D globe, live aircraft/ships/satellites/earthquakes/CCTV, and hands-free voice control. Runs in a browser.",
   "type": "module",
   "license": "MIT",
   "author": "Bilawal Sidhu",
@@ -47,6 +47,7 @@
     "build:panel": "node scripts/build-panel.mjs",
     "preview": "vite preview",
     "test": "node scripts/run-unit-tests.mjs",
+    "test:perf": "node scripts/run-perf-tests.mjs",
     "test:track": "node scripts/track-regression.mjs",
     "qa:map-source-tray": "node scripts/qa-map-source-tray.mjs",
     "qa:street-level": "node scripts/qa-street-level.mjs",
@@ -292,6 +293,8 @@
     "./tools/panel": "./src/tools/panel.js",
     "./tools/services": "./src/tools/services.js",
     "./view": "./src/view/index.js",
-    "./agent/world-packet": "./src/agent/worldPacket.js"
+    "./agent/world-packet": "./src/agent/worldPacket.js",
+    "./layers/wildlife-sightings": "./src/layers/wildlifeSightings/index.js",
+    "./layers/wildlife-sightings/source": "./src/layers/wildlifeSightings/source.js"
   }
 }

scripts/format-scope.json

@@ -1127,6 +1127,8 @@
   "scripts/qa-status-badges.mjs",
   "src/dockerTrustedPeers.test.mjs",
   "src/cameraGlobeRotation.test.mjs",
+  "src/cameraTilt.test.mjs",
+  "src/ui/shellFacade.test.mjs",
   "src/voice/globeResetConfirmation.test.mjs",
   "src/hudDms.test.mjs",
   "src/hudSummaryGate.test.mjs",
@@ -1268,5 +1270,89 @@
   "src/voice/geminiTextChat.js",
   "src/voice/panelLayout.js",
   "src/voice/textChat.js",
-  "src/voice/textProtocol.js"
+  "src/voice/textProtocol.js",
+  "src/app/sourceComposition.js",
+  "src/app/sourceComposition.test.mjs",
+  "src/data/dataCredits.js",
+  "src/data/layerState.js",
+  "src/data/layerState.test.mjs",
+  "src/data/spriteOrder.js",
+  "src/i18n/locales/ar.json",
+  "src/i18n/locales/de.json",
+  "src/i18n/locales/es.json",
+  "src/i18n/locales/fr.json",
+  "src/i18n/locales/it.json",
+  "src/i18n/locales/ja.json",
+  "src/i18n/locales/pt.json",
+  "src/i18n/locales/ru.json",
+  "src/i18n/locales/uk.json",
+  "src/i18n/locales/zh-CN.json",
+  "src/i18n/locales/zh-Hant.json",
+  "src/i18n/same-as-english.json",
+  "src/navigationPolicy.js",
+  "src/overlays/worldOverlayDraw.js",
+  "src/overlays/worldOverlayDraw.test.mjs",
+  "src/sources/rateLimit.js",
+  "src/ui/layerNames.js",
+  "src/ui/styles/cyber.css",
+  "src/voice/layerManifest.js",
+  "src/worldFocus.js",
+  "src/worldFocus.test.mjs",
+  "server/providers/acartia.js",
+  "server/providers/acartia.test.mjs",
+  "server/providers/common/userAgent.js",
+  "server/providers/inaturalist/client.js",
+  "server/providers/inaturalist/observations.js",
+  "server/providers/inaturalist/observations.test.mjs",
+  "src/app/layers/wildlifeSightings.js",
+  "src/layers/wildlifeSightings/cards.js",
+  "src/layers/wildlifeSightings/cards.test.mjs",
+  "src/layers/wildlifeSightings/controls.js",
+  "src/layers/wildlifeSightings/docs.test.mjs",
+  "src/layers/wildlifeSightings/index.js",
+  "src/layers/wildlifeSightings/lifecycle.js",
+  "src/layers/wildlifeSightings/model.js",
+  "src/layers/wildlifeSightings/model.test.mjs",
+  "src/layers/wildlifeSightings/ownership.test.mjs",
+  "src/layers/wildlifeSightings/photos.js",
+  "src/layers/wildlifeSightings/photos.test.mjs",
+  "src/layers/wildlifeSightings/policy.js",
+  "src/layers/wildlifeSightings/records.js",
+  "src/layers/wildlifeSightings/records.test.mjs",
+  "src/layers/wildlifeSightings/rendering.js",
+  "src/layers/wildlifeSightings/selection.js",
+  "src/layers/wildlifeSightings/source.js",
+  "src/layers/wildlifeSightings/source.test.mjs",
+  "src/layers/wildlifeSightings/viewport.js",
+  "src/layers/wildlifeSightings/viewport.test.mjs",
+  "src/sources/rateLimit.test.mjs",
+  "src/layers/wildlifeSightings/bounds.js",
+  "src/layers/wildlifeSightings/acartiaTaxa.js",
+  "src/layers/wildlifeSightings/acquisition.test.mjs",
+  "server/providers/inaturalist/client.test.mjs",
+  "src/layers/wildlifeSightings/acartiaTaxa.test.mjs",
+  "src/ui/wildlifeSightingCard.test.mjs",
+  "src/overlays/wildlifeSightingOverlay.test.mjs",
+  "scripts/run-perf-tests.mjs",
+  "src/perfTestRunner.test.mjs",
+  "src/testSupport/wildlifeBillboardModel.mjs",
+  "src/layers/wildlifeSightings/gridViewport.test.mjs",
+  "src/layers/wildlifeSightings/rendering.test.mjs",
+  "src/layers/wildlifeSightings/sprites.test.mjs",
+  "src/layers/wildlifeSightings/performance.test.mjs",
+  "src/layers/wildlifeSightings/model.perf.test.mjs",
+  "src/ui/wildlifeSightingPlacement.js",
+  "server/providers/inaturalist/queue.js",
+  "server/providers/inaturalist/queue.test.mjs",
+  "server/providers/inaturalist/grid.js",
+  "server/providers/inaturalist/grid.test.mjs",
+  "server/providers/inaturalist/grid.fixture.mjs",
+  "src/layers/wildlifeSightings/performance.js",
+  "src/layers/wildlifeSightings/renderPerformanceFixtures.mjs",
+  "server/providers/inaturalist/speed.test.mjs",
+  "src/layers/wildlifeSightings/render.perf.test.mjs",
+  "src/layers/wildlifeSightings/cache.integration.test.mjs",
+  "src/layers/wildlifeSightings/density.test.mjs",
+  "src/layers/wildlifeSightings/selection.test.mjs",
+  "server/providers/inaturalist/proxy.fixture.mjs"
 ]

scripts/package-boundaries.json

@@ -39,6 +39,9 @@
       "src/ui/views/panels/CockpitBriefing.vue",
       "src/ui/views/panels/CockpitContext.vue",
       "src/ui/views/panels/CockpitRoute.vue",
+      "src/ui/cockpitPresentation.js",
+      "src/data/headingDegrees.js",
+      "src/data/distanceFormat.js",
       "src/ui/views/panels/CockpitRollingValue.vue",
       "src/ui/views/panels/CockpitSignalList.vue",
       "src/ui/views/panels/CockpitUtilityControls.vue",
@@ -151,7 +154,8 @@
       "src/ui/views/panels/GlobeCompass.vue",
       "src/ui/stores/recording.js",
       "src/ui/styleParameters.js",
-      "src/ui/i18n.js"
+      "src/ui/i18n.js",
+      "src/ui/surfaceKeyboard.js"
     ],
     "external": ["vue", "pinia", "vue-i18n"]
   },
@@ -160,6 +164,7 @@
     "modules": [
       "src/app/viewer.js",
       "src/app/atmosphereCompat.js",
+      "src/globeInView.js",
       "src/sky/starrySky.js",
       "src/sky/stars.js",
       "src/data/bundledJson.js",
@@ -199,7 +204,22 @@
       "src/data/aisStreamAdapter.js",
       "src/data/aisWatchdog.js",
       "src/sources/httpBody.js",
-      "src/i18n/marker.js"
+      "src/i18n/marker.js",
+      "server/providers/acartia.js",
+      "server/providers/common/rate-limit.js",
+      "server/providers/common/same-site.js",
+      "server/providers/common/userAgent.js",
+      "server/providers/inaturalist/client.js",
+      "server/providers/inaturalist/observations.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/localRequestGate.mjs",
+      "src/sources/rateLimit.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "server/providers/inaturalist/grid.js",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "server/providers/inaturalist/queue.js"
     ],
     "external": ["ws"]
   },
@@ -869,6 +889,7 @@
       "src/ui/cockpitDisplayPortal.js",
       "src/ui/displayPanelScroll.js",
       "src/ui/cockpitInput.js",
+      "src/data/inputOwnership.js",
       "src/ui/cockpitInstruments.js",
       "src/ui/cockpitLayout.js",
       "src/ui/cockpitPresentation.js",
@@ -997,6 +1018,7 @@
       "src/ui/cockpitDisplayPortal.js",
       "src/ui/displayPanelScroll.js",
       "src/ui/cockpitInput.js",
+      "src/data/inputOwnership.js",
       "src/ui/cockpitInstruments.js",
       "src/ui/cockpitLayout.js",
       "src/ui/cockpitPresentation.js",
@@ -1149,7 +1171,14 @@
       "src/ui/stores/globeActions.js",
       "src/ui/stores/recording.js",
       "src/ui/i18n.js",
-      "src/ui/kit/UiSegmented.vue"
+      "src/ui/kit/UiSegmented.vue",
+      "src/ui/wildlifeSightingCard.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/ui/views/panels/WildlifeSightingCard.vue",
+      "src/ui/wildlifeSightingPlacement.js",
+      "src/overlays/worldOverlayChrome.js",
+      "src/layers/wildlifeSightings/photoText.js"
     ],
     "external": ["cesium", "vue", "pinia", "vue-i18n"]
   },
@@ -2335,6 +2364,7 @@
       "src/camera.js",
       "src/cameraGroundGuard.js",
       "src/cameraVerbs.js",
+      "src/globeInView.js",
       "src/cctvFocusPolicy.js",
       "src/cctvFocusRequest.js",
       "src/celestialRing.js",
@@ -3263,7 +3293,32 @@
       "src/voice/osmActions.js",
       "src/layers/osmPlaces/index.js",
       "src/app/layers/osmPlaces.js",
-      "src/voice/areaActions.js"
+      "src/voice/areaActions.js",
+      "src/app/layers/wildlifeSightings.js",
+      "src/layers/wildlifeSightings/cards.js",
+      "src/layers/wildlifeSightings/controls.js",
+      "src/layers/wildlifeSightings/index.js",
+      "src/layers/wildlifeSightings/lifecycle.js",
+      "src/layers/wildlifeSightings/model.js",
+      "src/layers/wildlifeSightings/photos.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/rendering.js",
+      "src/layers/wildlifeSightings/density.js",
+      "src/layers/wildlifeSightings/selection.js",
+      "src/layers/wildlifeSightings/source.js",
+      "src/layers/wildlifeSightings/viewport.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/ui/wildlifeSightingCard.js",
+      "src/ui/views/panels/WildlifeSightingCard.vue",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "src/layers/wildlifeSightings/billboardModel.js",
+      "src/layers/wildlifeSightings/sprites.js",
+      "src/ui/wildlifeSightingPlacement.js",
+      "src/overlays/worldOverlayChrome.js",
+      "src/layers/wildlifeSightings/photoText.js",
+      "src/layers/wildlifeSightings/performance.js"
     ],
     "external": [
       "hls.js",
@@ -3666,6 +3721,9 @@
       "src/annotations/worldAnnotationRenderer.js",
       "src/cameraGroundGuard.js",
       "src/cameraVerbs.js",
+      "src/globeInView.js",
+      "src/scopeMaskPolicy.js",
+      "src/scopeMask.js",
       "src/services/groundFloor.js",
       "src/data/routeSteps.js",
       "src/layers/directions/index.js",
@@ -3886,7 +3944,30 @@
       "src/data/local_data/wof_neighborhoods/files.js",
       "src/layers/osmPlaces/model.js",
       "src/layers/osmPlaces/index.js",
-      "src/app/layers/osmPlaces.js"
+      "src/app/layers/osmPlaces.js",
+      "src/app/layers/wildlifeSightings.js",
+      "src/layers/wildlifeSightings/cards.js",
+      "src/layers/wildlifeSightings/controls.js",
+      "src/layers/wildlifeSightings/index.js",
+      "src/layers/wildlifeSightings/lifecycle.js",
+      "src/layers/wildlifeSightings/model.js",
+      "src/layers/wildlifeSightings/photos.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/rendering.js",
+      "src/layers/wildlifeSightings/density.js",
+      "src/layers/wildlifeSightings/selection.js",
+      "src/layers/wildlifeSightings/source.js",
+      "src/layers/wildlifeSightings/viewport.js",
+      "src/ui/rail/utcClock.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "src/layers/wildlifeSightings/billboardModel.js",
+      "src/layers/wildlifeSightings/sprites.js",
+      "src/overlays/worldOverlayChrome.js",
+      "src/layers/wildlifeSightings/photoText.js",
+      "src/layers/wildlifeSightings/performance.js"
     ],
     "external": [
       "hls.js",
@@ -4422,7 +4503,15 @@
       "src/layers/airQuality/model.js",
       "src/layers/airQuality/source.js",
       "src/layers/droneAirspace/source.js",
-      "src/layers/droneAirspace/records.js"
+      "src/layers/droneAirspace/records.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/source.js",
+      "src/layers/wildlifeSightings/viewport.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "src/layers/wildlifeSightings/performance.js"
     ],
     "external": []
   },
@@ -4573,7 +4662,8 @@
       "src/i18n/locales/ru.json",
       "src/i18n/locales/uk.json",
       "src/i18n/locales/zh-CN.json",
-      "src/i18n/locales/zh-Hant.json"
+      "src/i18n/locales/zh-Hant.json",
+      "src/overlays/worldOverlayChrome.js"
     ],
     "external": ["cesium", "egm96-universal", "pbf"]
   },
@@ -5055,5 +5145,68 @@
       "src/i18n/marker.js"
     ],
     "external": ["cesium"]
+  },
+  "wildlife-sightings": {
+    "exports": ["./layers/wildlife-sightings"],
+    "modules": [
+      "src/data/dataCredits.js",
+      "src/data/iconOrientation.js",
+      "src/i18n/index.js",
+      "src/i18n/locale.js",
+      "src/i18n/locales/ar.json",
+      "src/i18n/locales/de.json",
+      "src/i18n/locales/es.json",
+      "src/i18n/locales/fr.json",
+      "src/i18n/locales/it.json",
+      "src/i18n/locales/ja.json",
+      "src/i18n/locales/pt.json",
+      "src/i18n/locales/ru.json",
+      "src/i18n/locales/uk.json",
+      "src/i18n/locales/zh-CN.json",
+      "src/i18n/locales/zh-Hant.json",
+      "src/i18n/marker.js",
+      "src/layers/wildlifeSightings/cards.js",
+      "src/layers/wildlifeSightings/controls.js",
+      "src/layers/wildlifeSightings/index.js",
+      "src/layers/wildlifeSightings/lifecycle.js",
+      "src/layers/wildlifeSightings/model.js",
+      "src/layers/wildlifeSightings/photos.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/rendering.js",
+      "src/layers/wildlifeSightings/density.js",
+      "src/layers/wildlifeSightings/selection.js",
+      "src/layers/wildlifeSightings/source.js",
+      "src/layers/wildlifeSightings/viewport.js",
+      "src/overlays/worldOverlayDraw.js",
+      "src/overlays/worldOverlayTokens.js",
+      "src/sources/httpBody.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/ui/statusText.js",
+      "src/ui/layerNames.js",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "src/layers/wildlifeSightings/billboardModel.js",
+      "src/layers/wildlifeSightings/sprites.js",
+      "src/layers/wildlifeSightings/photoText.js",
+      "src/layers/wildlifeSightings/performance.js"
+    ],
+    "external": ["cesium"]
+  },
+  "wildlife-sightings-source": {
+    "exports": ["./layers/wildlife-sightings/source"],
+    "modules": [
+      "src/i18n/marker.js",
+      "src/layers/wildlifeSightings/policy.js",
+      "src/layers/wildlifeSightings/records.js",
+      "src/layers/wildlifeSightings/source.js",
+      "src/layers/wildlifeSightings/viewport.js",
+      "src/sources/httpBody.js",
+      "src/layers/wildlifeSightings/bounds.js",
+      "src/layers/wildlifeSightings/acartiaTaxa.js",
+      "src/layers/wildlifeSightings/gridViewport.js",
+      "src/layers/wildlifeSightings/performance.js"
+    ],
+    "external": []
   }
 }

scripts/qa-voice-routing.mjs

@@ -2321,9 +2321,11 @@ async function runBehaviorLayer() {
       `result=${JSON.stringify(r)?.slice(0, 120)} state=${JSON.stringify(contextExited)?.slice(0, 80)}`,
     );
 
-    // (9f) With Contacts OFF the entry gate is shut. Entry must refuse with the
-    // reason rather than produce the half-entered state the operator saw: a
-    // plane anchored under the camera with no HUD and no exit control.
+    // (9f) Cockpit needs only the tracked aircraft's own layer, not Contacts.
+    // With Contacts OFF, status must explain a shut gate without blaming
+    // Contacts, and entry must either enter cleanly or refuse with the reason
+    // rather than produce the half-entered state the operator saw: a plane
+    // anchored under the camera with no HUD and no exit control.
     r = await run('control_cockpit', { action: 'status' });
     const gateReport = r?.state || {};
     const cockpitBeforeGate = await page.evaluate(() =>
@@ -2331,10 +2333,13 @@ async function runBehaviorLayer() {
     );
     report(
       gateReport.active === false &&
-        gateReport.entryAllowed === false &&
-        gateReport.entryBlockedReason === 'contacts-inactive' &&
+        (gateReport.entryAllowed === true
+          ? gateReport.entryBlockedReason === null
+          : ['subject-layer-off', 'no-tracked-aircraft'].includes(
+              gateReport.entryBlockedReason,
+            )) &&
         !cockpitBeforeGate,
-      'behavior: cockpit status names why entry is blocked with Contacts off',
+      'behavior: cockpit status explains its gate without requiring Contacts',
       `state=${JSON.stringify(gateReport)?.slice(0, 150)}`,
     );
 
@@ -2348,12 +2353,16 @@ async function runBehaviorLayer() {
       Boolean(window.__godsEyeView?.styleManager?.cockpitView?.active),
     );
     report(
-      gated?.ok === false &&
-        /contacts/i.test(gated?.error || '') &&
-        !cockpitAfterGate,
-      'behavior: cockpit entry with Contacts off is refused, not half-entered',
+      gated?.ok === true
+        ? cockpitAfterGate
+        : !cockpitAfterGate && !/contacts/i.test(gated?.error || ''),
+      'behavior: cockpit entry with Contacts off follows the own-layer gate, never half-entered',
       `ok=${gated?.ok} error=${String(gated?.error || '').slice(0, 90)} active=${cockpitAfterGate}`,
     );
+    if (cockpitAfterGate)
+      await page.evaluate(() =>
+        window.__godsEyeView?.styleManager?.controlCockpit?.('exit'),
+      );
 
     await runBundledOutlineScenarios({
       page,

scripts/run-perf-tests.mjs

@@ -0,0 +1,59 @@
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import {
+  discoverUnitTestFiles,
+  UNIT_TEST_NODE_FLAGS,
+} from './run-unit-tests.mjs';
+
+/** Discover every layer/provider benchmark, including those added by other branches. */
+export function discoverPerfTestFiles(root = process.cwd()) {
+  return discoverUnitTestFiles(root).filter((file) =>
+    file.endsWith('.perf.test.mjs'),
+  );
+}
+
+/** Shared by benchmarks so normal unit runs visibly skip timing assertions. */
+export function perfBudgetTestOptions(env = process.env) {
+  return {
+    skip:
+      env.GEV_PERF_BUDGETS === '1'
+        ? false
+        : 'Timing budgets are opt-in; run npm run test:perf (GEV_PERF_BUDGETS=1). Deterministic delta/write checks still run in the normal suite.',
+  };
+}
+
+/** Build a serial invocation so benchmarks do not compete for CPU time. */
+export function perfTestArgs(files) {
+  // A single serial test process keeps benchmark files from competing with
+  // each other; the normal suite still discovers them and reports their skips.
+  return [
+    ...UNIT_TEST_NODE_FLAGS,
+    '--test',
+    '--test-concurrency=1',
+    '--test-isolation=none',
+    ...files,
+  ];
+}
+
+/** Run discovered benchmarks with wall-clock budgets enabled. */
+export function runPerfTests({
+  root = process.cwd(),
+  env = process.env,
+  run = spawnSync,
+} = {}) {
+  const files = discoverPerfTestFiles(root);
+  if (!files.length) throw new Error('No *.perf.test.mjs benchmarks found');
+  const result = run(process.execPath, perfTestArgs(files), {
+    cwd: root,
+    stdio: 'inherit',
+    env: { ...env, GEV_PERF_BUDGETS: '1' },
+  });
+  if (result.error) throw result.error;
+  return result.status ?? 1;
+}
+
+const invoked = process.argv[1]
+  ? pathToFileURL(path.resolve(process.argv[1])).href
+  : '';
+if (import.meta.url === invoked) process.exitCode = runPerfTests();

server/providers/acartia.js

@@ -0,0 +1,181 @@
+import { normalizeAcartiaSightings } from '../../src/layers/wildlifeSightings/records.js';
+import { coalesceProxyRequest, readResponseJsonCapped } from './common/http.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import { admitSameSiteKeyless } from './common/same-site.js';
+import { providerUserAgent } from './common/userAgent.js';
+
+const API_URL = 'https://acartia.io/api/v1/sightings/current';
+// All views share the provider's seven-day snapshot.
+const TTL_MS = 600_000;
+const STALE_MAX_MS = 24 * 60 * 60_000;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const TIMEOUT_MS = 15_000;
+const COOLDOWN_MS = 60_000;
+const COOLDOWN_MIN_MS = 5000;
+const COOLDOWN_MAX_MS = 60 * 60_000;
+const FAILURE_COOLDOWN_MS = 15_000;
+
+/** Bound upstream Retry-After seconds or dates to five seconds–one hour. */
+export function acartiaRetryCooldownMs(raw, nowMs) {
+  const value = typeof raw === 'string' ? raw.trim() : '';
+  if (value) {
+    const seconds = /^\d+(?:\.\d+)?$/.test(value) ? Number(value) : NaN;
+    const deadline =
+      !Number.isFinite(seconds) && /[a-z]/i.test(value)
+        ? Date.parse(value)
+        : NaN;
+    const delay = Number.isFinite(seconds) ? seconds * 1000 : deadline - nowMs;
+    if (Number.isFinite(delay) && delay >= 0)
+      return Math.min(COOLDOWN_MAX_MS, Math.max(COOLDOWN_MIN_MS, delay));
+  }
+  return COOLDOWN_MS;
+}
+
+/** Salish Sea coverage. Precise coordinates and comments never enter cache. */
+export function acartiaProxy({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+  cache = new Map(),
+  warn = (...args) => console.warn(...args),
+} = {}) {
+  const inFlight = new Map();
+  const allow = makeRateLimiter({
+    windowMs: 60_000,
+    max: 60,
+    globalMax: 600,
+    now,
+  });
+  let cooldownUntil = 0;
+  let cooldownStatus = 429;
+  let warnedClamp = false;
+
+  const retrySeconds = () =>
+    Math.max(1, Math.ceil((cooldownUntil - now()) / 1000));
+  const unavailable = (status = 502) =>
+    Object.assign(new Error('acartia_unavailable'), {
+      status,
+      retryAfterS: retrySeconds(),
+    });
+
+  function coolDown(status, delay) {
+    const until = now() + delay;
+    if (until > cooldownUntil) {
+      cooldownUntil = until;
+      cooldownStatus = status;
+    } else if (status === 429 && now() < cooldownUntil) cooldownStatus = 429;
+  }
+
+  async function load() {
+    if (now() < cooldownUntil) throw unavailable(cooldownStatus);
+    const signal = AbortSignal.timeout(TIMEOUT_MS);
+    try {
+      const response = await fetchImpl(API_URL, {
+        signal,
+        redirect: 'error',
+        headers: {
+          Accept: 'application/json',
+          'User-Agent': providerUserAgent('wildlife-sightings'),
+        },
+      });
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => {});
+        if (response.status === 429) {
+          const delay = acartiaRetryCooldownMs(
+            response.headers.get('retry-after'),
+            now(),
+          );
+          if (delay === COOLDOWN_MAX_MS && !warnedClamp) {
+            warnedClamp = true;
+            warn('[acartia-proxy] upstream cooldown capped at one hour');
+          }
+          coolDown(429, delay);
+          throw unavailable(429);
+        }
+        throw unavailable();
+      }
+      // This endpoint documents a JSON array, not a results/data envelope.
+      const payload = await readResponseJsonCapped(
+        response,
+        MAX_RESPONSE_BYTES,
+        signal,
+      );
+      const rows = normalizeAcartiaSightings(payload, now());
+      // Only a non-array is malformed. A quiet feed, or one whose rows all fall
+      // outside coverage or the species checks, is a valid empty snapshot.
+      if (!rows) throw new Error('invalid_snapshot');
+      return { fetchedAt: now(), rows };
+    } catch (error) {
+      if (error.status !== 429) coolDown(502, FAILURE_COOLDOWN_MS);
+      warn('[acartia-proxy] upstream refresh failed');
+      throw unavailable(error.status === 429 ? 429 : 502);
+    }
+  }
+
+  function age(entry) {
+    if (!entry) return Infinity;
+    const elapsed = now() - entry.savedAt;
+    return elapsed < 0 ? Infinity : elapsed;
+  }
+
+  async function acquire() {
+    const previous = cache.get('sightings');
+    if (age(previous) < TTL_MS) return { value: previous.value, stale: false };
+    if (age(previous) > STALE_MAX_MS) cache.delete('sightings');
+    try {
+      const { promise } = coalesceProxyRequest(
+        inFlight,
+        'sightings',
+        async () => {
+          const value = await load();
+          cache.set('sightings', { value, savedAt: now() });
+          return value;
+        },
+      );
+      return { value: await promise, stale: false };
+    } catch (error) {
+      if (age(previous) <= STALE_MAX_MS)
+        return { value: previous.value, stale: true };
+      throw error;
+    }
+  }
+
+  async function handler(req, res) {
+    const json = (status, value, { stale = false, retryAfterS } = {}) => {
+      if (res.destroyed) return;
+      res.writeHead(status, {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+        ...(status === 405 ? { Allow: 'GET' } : {}),
+        ...(retryAfterS ? { 'Retry-After': String(retryAfterS) } : {}),
+        ...(stale ? { 'X-Data-Stale': 'true' } : {}),
+      });
+      res.end(JSON.stringify(value));
+    };
+    if (admitSameSiteKeyless(req, res)) return;
+    if (req.method !== 'GET') return json(405, { error: 'method_not_allowed' });
+    const pathname = (req.url || '/').split('?')[0];
+    if (pathname !== '/sightings') return json(404, { error: 'unknown_route' });
+    if (!allow(clientKey(req)))
+      return json(429, { error: 'rate_limited' }, { retryAfterS: 60 });
+    try {
+      const { value, stale } = await acquire();
+      return json(200, stale ? { ...value, stale: true } : value, { stale });
+    } catch (error) {
+      return json(
+        error.status === 429 ? 429 : 502,
+        { error: 'acartia_unavailable' },
+        { retryAfterS: error.retryAfterS },
+      );
+    }
+  }
+
+  return {
+    name: 'acartia',
+    configureServer({ middlewares }) {
+      middlewares.use('/api/acartia', handler);
+    },
+    configurePreviewServer({ middlewares }) {
+      middlewares.use('/api/acartia', handler);
+    },
+  };
+}

server/providers/acartia.test.mjs

@@ -0,0 +1,419 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { acartiaProxy, acartiaRetryCooldownMs } from './acartia.js';
+
+const NOW = Date.parse('2026-11-04T18:05:00Z');
+const sighting = (id = 'synthetic-1') => ({
+  entry_id: id,
+  latitude: 48.12345,
+  longitude: -123.12345,
+  created: '2026-11-04 17:00:00',
+  type: 'Orca',
+  no_sighted: '5',
+  photo_url: 'https://provider.example/photos/synthetic.jpg',
+  data_source_name: 'Synthetic Whale Network',
+  data_source_entity: 'Community reports',
+  trusted: true,
+  data_source_comments: '[email protected] +1-555-000-0000',
+});
+
+function install(options = {}, hook = 'configureServer') {
+  let handler;
+  const plugin = acartiaProxy({ now: () => NOW, warn() {}, ...options });
+  assert.equal(plugin.name, 'acartia');
+  assert.equal(typeof plugin.configureServer, 'function');
+  assert.equal(typeof plugin.configurePreviewServer, 'function');
+  plugin[hook]({
+    middlewares: {
+      use(mount, callback) {
+        assert.equal(mount, '/api/acartia');
+        handler = callback;
+      },
+    },
+  });
+  return async (
+    url = '/sightings',
+    { method = 'GET', peer = 'local', headers = {} } = {},
+  ) => {
+    const res = {
+      headers: {},
+      writeHead(status, headers) {
+        this.status = status;
+        this.headers = headers;
+      },
+      setHeader(key, value) {
+        this.headers[key] = value;
+      },
+      end(value) {
+        this.status ??= this.statusCode;
+        this.body = JSON.parse(value);
+      },
+    };
+    await handler(
+      { url, method, headers, socket: { remoteAddress: peer } },
+      res,
+    );
+    return res;
+  };
+}
+
+test('cache stores only supported marine mammals inside the coverage box', async () => {
+  const cache = new Map();
+  const request = install({
+    cache,
+    fetchImpl: async () =>
+      Response.json([
+        sighting('orca'),
+        { ...sighting('seal'), type: 'Harbor seal' },
+        { ...sighting('unknown'), type: 'Unknown' },
+        { ...sighting('fish'), type: 'Whale shark' },
+        { ...sighting('outside'), latitude: 37.8 },
+        { ...sighting('rounded-edge'), latitude: 45.49999 },
+      ]),
+  });
+  const result = await request();
+  assert.equal(result.status, 200);
+  for (const rows of [result.body.rows, cache.get('sightings').value.rows]) {
+    assert.deepEqual(
+      rows.map((row) => [row.stableId, row.cetacean]),
+      [
+        ['acartia:orca', true],
+        ['acartia:seal', false],
+      ],
+    );
+  }
+});
+
+for (const hook of ['configureServer', 'configurePreviewServer']) {
+  test(`${hook}: documented array is normalized and coarsened before caching`, async () => {
+    const cache = new Map();
+    let calls = 0;
+    const request = install(
+      {
+        cache,
+        fetchImpl: async (url, options) => {
+          calls += 1;
+          assert.equal(url, 'https://acartia.io/api/v1/sightings/current');
+          assert.equal(options.redirect, 'error');
+          assert.ok(options.signal instanceof AbortSignal);
+          assert.equal(options.headers.Accept, 'application/json');
+          assert.equal(
+            options.headers['User-Agent'],
+            'gods-eye-view-wildlife-sightings-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
+          );
+          return Response.json([sighting()]);
+        },
+      },
+      hook,
+    );
+    assert.equal(calls, 0);
+    assert.equal(cache.size, 0);
+    const result = await request(
+      '/sightings?url=https://attacker.example&latitude=1',
+    );
+    assert.equal(result.status, 200);
+    assert.equal(result.headers['Cache-Control'], 'no-store');
+    assert.equal(result.body.fetchedAt, NOW);
+    assert.equal(result.body.rows[0].stableId, 'acartia:synthetic-1');
+    assert.equal(result.body.rows[0].lat, 48.12);
+    assert.equal(result.body.rows[0].lon, -123.12);
+    assert.equal(result.body.rows[0].provider.name, 'Synthetic Whale Network');
+    const retained = cache.get('sightings');
+    assert.equal(retained.value.rows[0].lat, 48.12);
+    assert.equal(retained.value.rows[0].lon, -123.12);
+    for (const value of [result.body, [...cache.values()]])
+      assert.doesNotMatch(
+        JSON.stringify(value),
+        /private-observer|555|data_source_comments|48\.12345|123\.12345/,
+      );
+    assert.equal(calls, 1);
+  });
+}
+
+test('gate, method and fixed route run before cache or upstream', async () => {
+  const cache = new Map();
+  let calls = 0;
+  const request = install({
+    cache,
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json([sighting()]);
+    },
+  });
+  for (let i = 0; i < 65; i += 1) {
+    assert.equal(
+      (
+        await request('/sightings', {
+          headers: {
+            host: 'localhost:5173',
+            origin: 'https://foreign.example',
+            'sec-fetch-site': 'cross-site',
+          },
+        })
+      ).status,
+      403,
+    );
+  }
+  const method = await request('/sightings', { method: 'POST' });
+  assert.equal(method.status, 405);
+  assert.equal(method.headers.Allow, 'GET');
+  for (const route of ['/', '/unknown', '/sightings/extra']) {
+    const result = await request(route);
+    assert.equal(result.status, 404);
+    assert.equal(result.body.error, 'unknown_route');
+  }
+  assert.equal(calls, 0);
+  assert.equal(cache.size, 0);
+  const sameOrigin = await request('/sightings', {
+    headers: {
+      host: 'gev.example',
+      origin: 'https://gev.example',
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-proto': 'https',
+      'x-forwarded-for': '203.0.113.9',
+    },
+  });
+  assert.equal(sameOrigin.status, 200);
+});
+
+test('request 61 is locally limited even with a fresh cache', async () => {
+  let calls = 0;
+  const request = install({
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json([sighting()]);
+    },
+  });
+  for (let i = 0; i < 60; i += 1) assert.equal((await request()).status, 200);
+  const limited = await request();
+  assert.equal(limited.status, 429);
+  assert.equal(limited.body.error, 'rate_limited');
+  assert.equal(limited.headers['Retry-After'], '60');
+  assert.equal(calls, 1);
+});
+
+test('one global snapshot single-flights and stays fresh for ten minutes', async () => {
+  let at = NOW;
+  let calls = 0;
+  let release;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      calls += 1;
+      if (calls === 1)
+        await new Promise((resolve) => {
+          release = resolve;
+        });
+      return Response.json([sighting()]);
+    },
+  });
+  const first = request();
+  const concurrent = request();
+  await new Promise(setImmediate);
+  assert.equal(calls, 1);
+  release();
+  assert.deepEqual((await first).body, (await concurrent).body);
+  at += 599_999;
+  await request();
+  assert.equal(calls, 1);
+  at += 1;
+  await request();
+  assert.equal(calls, 2);
+});
+
+test('a valid empty or fully filtered snapshot is a fresh success that clears old rows', async () => {
+  for (const quiet of [
+    [],
+    [null],
+    [{ ...sighting(), data_source_name: '' }],
+    [{ ...sighting(), latitude: 37.8 }],
+    [{ ...sighting(), type: 'Unknown' }],
+  ]) {
+    let at = NOW;
+    let calls = 0;
+    let empty = false;
+    const cache = new Map();
+    const request = install({
+      cache,
+      now: () => at,
+      fetchImpl: async () => {
+        calls += 1;
+        return Response.json(empty ? quiet : [sighting()]);
+      },
+    });
+    assert.equal((await request()).body.rows.length, 1);
+    empty = true;
+    at += 600_001;
+    const result = await request();
+    assert.equal(result.status, 200);
+    assert.deepEqual(result.body, { fetchedAt: at, rows: [] });
+    assert.equal(result.headers['X-Data-Stale'], undefined);
+    assert.equal(result.headers['Retry-After'], undefined);
+    assert.deepEqual(cache.get('sightings').value.rows, []);
+    // The quiet feed keeps the normal ten-minute cadence, not a failure retry.
+    at += 599_999;
+    assert.equal((await request()).status, 200);
+    assert.equal(calls, 2);
+    at += 1;
+    await request();
+    assert.equal(calls, 3);
+    const cold = install({ fetchImpl: async () => Response.json(quiet) });
+    const coldResult = await cold();
+    assert.equal(coldResult.status, 200);
+    assert.deepEqual(coldResult.body, { fetchedAt: NOW, rows: [] });
+  }
+});
+
+test('an invented wrapped snapshot never replaces the cache', async () => {
+  const bad = { results: [sighting()] };
+  let at = NOW;
+  let fail = false;
+  const cache = new Map();
+  const request = install({
+    cache,
+    now: () => at,
+    fetchImpl: async () => Response.json(fail ? bad : [sighting()]),
+  });
+  const fresh = await request();
+  const retained = cache.get('sightings');
+  fail = true;
+  at += 600_001;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.headers['X-Data-Stale'], 'true');
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, fresh.body.fetchedAt);
+  assert.equal(cache.get('sightings'), retained);
+  const coldCache = new Map();
+  const cold = install({
+    cache: coldCache,
+    fetchImpl: async () => Response.json(bad),
+  });
+  const result = await cold();
+  assert.equal(result.status, 502);
+  assert.equal(result.body.error, 'acartia_unavailable');
+  assert.equal(result.headers['Retry-After'], '15');
+  assert.equal(coldCache.size, 0);
+});
+
+test('failure serves stale for at most 24 hours and never reports a cold success', async () => {
+  let at = NOW;
+  let fail = false;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      if (fail) throw new Error('private upstream detail');
+      return Response.json([sighting()]);
+    },
+  });
+  const first = await request();
+  fail = true;
+  at += 23 * 60 * 60_000 + 59 * 60_000;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, first.body.fetchedAt);
+  at += 2 * 60_000;
+  const expired = await request();
+  assert.equal(expired.status, 502);
+  assert.deepEqual(expired.body, { error: 'acartia_unavailable' });
+});
+
+test('upstream 429 honors Retry-After, caps it, and spends no requests while cooling down', async () => {
+  assert.equal(acartiaRetryCooldownMs('2', NOW), 5000);
+  assert.equal(acartiaRetryCooldownMs('999999', NOW), 3_600_000);
+  assert.equal(
+    acartiaRetryCooldownMs(new Date(NOW + 120_000).toUTCString(), NOW),
+    120_000,
+  );
+  assert.equal(acartiaRetryCooldownMs(null, NOW), 60_000);
+  let at = NOW;
+  let calls = 0;
+  const warnings = [];
+  const request = install({
+    now: () => at,
+    warn: (message) => warnings.push(message),
+    fetchImpl: async () => {
+      calls += 1;
+      return new Response('limit', {
+        status: 429,
+        headers: { 'Retry-After': '999999' },
+      });
+    },
+  });
+  const first = await request();
+  assert.equal(first.status, 429);
+  assert.equal(first.body.error, 'acartia_unavailable');
+  assert.equal(first.headers['Retry-After'], '3600');
+  at += 5000;
+  const cooling = await request();
+  assert.equal(cooling.headers['Retry-After'], '3595');
+  assert.equal(calls, 1);
+  assert.equal(
+    warnings.filter((message) => message.includes('capped')).length,
+    1,
+  );
+  at += 3_600_000;
+  await request();
+  assert.equal(calls, 2);
+  assert.equal(
+    warnings.filter((message) => message.includes('capped')).length,
+    1,
+  );
+});
+
+test('upstream 429 also serves a prior snapshot stale', async () => {
+  let at = NOW;
+  let fail = false;
+  let calls = 0;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      calls += 1;
+      return fail
+        ? new Response('limit', { status: 429 })
+        : Response.json([sighting()]);
+    },
+  });
+  const first = await request();
+  fail = true;
+  at += 600_001;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, first.body.fetchedAt);
+  at += 1000;
+  assert.equal((await request()).body.stale, true);
+  assert.equal(calls, 2);
+});
+
+test('bad JSON, 5xx and capped bodies start a 15 second failure cooldown', async () => {
+  for (const bad of [
+    () => new Response('{malformed'),
+    () => new Response('private upstream message', { status: 503 }),
+    () =>
+      new Response('{}', {
+        headers: { 'Content-Length': String(2 * 1024 * 1024 + 1) },
+      }),
+  ]) {
+    let at = NOW;
+    let calls = 0;
+    const request = install({
+      now: () => at,
+      fetchImpl: async () => {
+        calls += 1;
+        return calls === 1 ? bad() : Response.json([sighting()]);
+      },
+    });
+    const first = await request();
+    assert.equal(first.status, 502);
+    assert.deepEqual(first.body, { error: 'acartia_unavailable' });
+    assert.equal(first.headers['Retry-After'], '15');
+    at += 14_999;
+    assert.equal((await request()).headers['Retry-After'], '1');
+    assert.equal(calls, 1);
+    at += 1;
+    assert.equal((await request()).status, 200);
+    assert.equal(calls, 2);
+  }
+});

server/providers/common/userAgent.js

@@ -0,0 +1,4 @@
+/** Identify each provider while keeping the project contact URL consistent. */
+export function providerUserAgent(name) {
+  return `gods-eye-view-${name}-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)`;
+}

server/providers/inaturalist/client.js

@@ -0,0 +1,370 @@
+import path from 'node:path';
+import { promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { normalizeInatObservations } from '../../../src/layers/wildlifeSightings/records.js';
+import { readResponseJsonCapped } from '../common/http.js';
+import { clampInt } from '../common/query.js';
+import { providerUserAgent } from '../common/userAgent.js';
+import { projectInatGrid, validInatGridTile } from './grid.js';
+import { createInatQueue } from './queue.js';
+
+const DAILY_BUDGET = 8000;
+const DAY_MS = 24 * 60 * 60_000;
+// One page is capped independently of upstream Content-Length.
+const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const TIMEOUT_MS = 20_000;
+const API_URL = 'https://api.inaturalist.org/v1';
+// Request only the fields used by the public observation projection.
+const OBSERVATIONS_URL = 'https://api.inaturalist.org/v2/observations';
+const OBSERVATION_FIELDS =
+  '(id:!t,uri:!t,location:!t,geojson:all,geoprivacy:!t,taxon_geoprivacy:!t,' +
+  'obscured:!t,quality_grade:!t,observed_on:!t,' +
+  'time_observed_at:!t,faves_count:!t,' +
+  'num_identification_agreements:!t,' +
+  'photos:(url:!t,attribution:!t,license_code:!t),' +
+  'taxon:(name:!t,preferred_common_name:!t,iconic_taxon_name:!t,' +
+  'threatened:!t))';
+const COOLDOWN_MS = 60_000;
+const FAILURE_COOLDOWN_MS = 15_000;
+
+/** Seconds and HTTP dates are accepted; a missing value earns one minute. */
+export function inatRetryCooldownMs(raw, nowMs) {
+  const value = typeof raw === 'string' ? raw.trim() : '';
+  if (value) {
+    const seconds = /^\d+(?:\.\d+)?$/.test(value) ? Number(value) : NaN;
+    const deadline =
+      !Number.isFinite(seconds) && /[a-z]/i.test(value)
+        ? Date.parse(value)
+        : NaN;
+    const delay = Number.isFinite(seconds) ? seconds * 1000 : deadline - nowMs;
+    if (Number.isFinite(delay) && delay >= 0) return delay;
+  }
+  return COOLDOWN_MS;
+}
+
+function upstreamError(code, status, retryAfterS, upstreamStatus) {
+  return Object.assign(new Error(code), {
+    code,
+    status,
+    retryAfterS,
+    upstreamStatus,
+  });
+}
+
+function observationFilters(params) {
+  const query = new URLSearchParams({
+    verifiable: 'true',
+    captive: 'false',
+    // d1 is an observation DATE, unlike creation-time created_d1.
+    d1: params.observedD1,
+  });
+  if (params.taxa !== 'whales') query.set('photos', 'true');
+  if (params.quality === 'research') query.set('quality_grade', 'research');
+  if (params.taxa === 'whales') query.set('taxon_id', '152871');
+  else if (['Aves', 'Mammalia', 'Insecta', 'Plantae'].includes(params.taxa))
+    query.set('iconic_taxa', params.taxa);
+  return query;
+}
+
+/**
+ * Shared iNaturalist governor. Only request counters are persisted; observation
+ * payloads are projected immediately and are never written to disk.
+ */
+export function createInatClient({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+  cacheDir = path.join(process.cwd(), '.gev-cache', 'inaturalist'),
+  warn = (...args) => console.warn(...args),
+  queueOptions,
+} = {}) {
+  const enqueue = createInatQueue(queueOptions);
+  let budget = null;
+  let budgetLoaded = false;
+  let budgetTail = Promise.resolve();
+  let cooldownUntil = 0;
+  // An unavailable UTFGrid tile must never place observation queries into a
+  // 502 cooldown. Only an upstream 429 is a provider-wide restriction.
+  const failures = new Map();
+
+  function dailyLimit() {
+    return clampInt(
+      process.env.INATURALIST_DAILY_BUDGET,
+      1,
+      Number.MAX_SAFE_INTEGER,
+      DAILY_BUDGET,
+    );
+  }
+
+  function day() {
+    return new Date(now()).toISOString().slice(0, 10);
+  }
+
+  function currentBudget() {
+    const date = day();
+    if (budget?.date !== date) budget = { date, count: 0 };
+    return budget;
+  }
+
+  async function readBudgetOnce() {
+    if (budgetLoaded) return;
+    budgetLoaded = true;
+    if (cacheDir === null) return;
+    try {
+      const value = JSON.parse(
+        await fs.readFile(path.join(cacheDir, 'budget.json'), 'utf8'),
+      );
+      if (
+        typeof value?.date === 'string' &&
+        /^\d{4}-\d{2}-\d{2}$/.test(value.date) &&
+        Number.isSafeInteger(value.count) &&
+        value.count >= 0
+      )
+        budget = { date: value.date, count: value.count };
+    } catch (error) {
+      if (error.code !== 'ENOENT')
+        warn('[inaturalist-proxy] budget read failed');
+    }
+  }
+
+  async function persistBudget(value) {
+    if (cacheDir === null) return;
+    const destination = path.join(cacheDir, 'budget.json');
+    const temporary = `${destination}.${randomUUID()}.tmp`;
+    try {
+      await fs.mkdir(cacheDir, { recursive: true });
+      await fs.writeFile(temporary, JSON.stringify(value), 'utf8');
+      await fs.rename(temporary, destination);
+    } catch {
+      await fs.rm(temporary, { force: true }).catch(() => {});
+      warn('[inaturalist-proxy] budget write failed');
+    }
+  }
+
+  function retrySeconds(until = cooldownUntil) {
+    return Math.max(0, Math.ceil((until - now()) / 1000));
+  }
+
+  function checkCooldown(resource) {
+    if (now() < cooldownUntil)
+      throw upstreamError('inaturalist_rate_limited', 429, retrySeconds(), 429);
+    const failure = failures.get(resource);
+    if (failure && now() < failure.until)
+      throw upstreamError(
+        'inaturalist_unavailable',
+        502,
+        retrySeconds(failure.until),
+        failure.status,
+      );
+    failures.delete(resource);
+  }
+
+  // Reserve and atomically persist one attempt before issuing it. A recovered
+  // tail prevents one disk/reservation failure from poisoning future calls.
+  function reserveAttempt(signal, resource) {
+    const result = budgetTail.then(async () => {
+      signal?.throwIfAborted();
+      checkCooldown(resource);
+      await readBudgetOnce();
+      signal?.throwIfAborted();
+      checkCooldown(resource);
+      const value = currentBudget();
+      if (value.count >= dailyLimit()) {
+        const retry = Math.max(
+          1,
+          Math.ceil((Date.parse(`${day()}T00:00:00Z`) + DAY_MS - now()) / 1000),
+        );
+        throw upstreamError('inaturalist_budget_exhausted', 503, retry);
+      }
+      value.count += 1;
+      await persistBudget({ ...value });
+    });
+    budgetTail = result.catch(() => {});
+    return result;
+  }
+
+  async function requestProjected(url, project, resource, { signal } = {}) {
+    signal?.throwIfAborted();
+    checkCooldown(resource);
+    return enqueue(() => dispatch(url, project, resource, signal), {
+      signal,
+      priority: resource === 'observations' ? 0 : 1,
+    });
+  }
+
+  async function dispatch(url, project, resource, signal) {
+    signal?.throwIfAborted();
+    await reserveAttempt(signal, resource);
+    signal?.throwIfAborted();
+    checkCooldown(resource);
+    const timeout = AbortSignal.timeout(TIMEOUT_MS);
+    const requestSignal = signal ? AbortSignal.any([signal, timeout]) : timeout;
+    let upstreamStatus;
+    let retryDelay = FAILURE_COOLDOWN_MS;
+    try {
+      const response = await fetchImpl(url, {
+        signal: requestSignal,
+        redirect: 'error',
+        headers: {
+          Accept: 'application/json',
+          'User-Agent': providerUserAgent('wildlife-sightings'),
+        },
+      });
+      upstreamStatus = response.status;
+      if (!response.ok) {
+        await response.body?.cancel().catch(() => {});
+        if (response.status === 429) {
+          const delay = inatRetryCooldownMs(
+            response.headers.get('retry-after'),
+            now(),
+          );
+          cooldownUntil = Math.max(cooldownUntil, now() + delay);
+          throw upstreamError(
+            'inaturalist_rate_limited',
+            429,
+            retrySeconds(),
+            429,
+          );
+        }
+        if (response.headers.has('retry-after'))
+          retryDelay = inatRetryCooldownMs(
+            response.headers.get('retry-after'),
+            now(),
+          );
+        throw upstreamError('inaturalist_unavailable', 502);
+      }
+      const payload = await readResponseJsonCapped(
+        response,
+        MAX_RESPONSE_BYTES,
+        requestSignal,
+      );
+      return project(payload);
+    } catch (error) {
+      // Log only safe diagnostic categories, never a URL, body, status text or
+      // exception message (each can contain request/private information).
+      const reason = signal?.aborted
+        ? 'abort'
+        : timeout.aborted || error.name === 'TimeoutError'
+          ? 'timeout'
+          : upstreamStatus && upstreamStatus >= 400
+            ? 'http'
+            : error.code === 'RESPONSE_TOO_LARGE'
+              ? 'response-too-large'
+              : upstreamStatus
+                ? 'invalid-payload'
+                : 'network';
+      warn(
+        `[inaturalist-proxy] upstream refresh failed resource=${resource} status=${upstreamStatus ?? 'none'} reason=${reason}`,
+      );
+      if (signal?.aborted) throw error;
+      // Network, abort, schema and size failures are not upstream cooldown
+      // signals. A later healthy request may recover immediately.
+      if (upstreamStatus >= 500)
+        failures.set(resource, {
+          until: now() + retryDelay,
+          status: upstreamStatus,
+        });
+      const failure = failures.get(resource);
+      throw upstreamError(
+        error.status === 429
+          ? 'inaturalist_rate_limited'
+          : 'inaturalist_unavailable',
+        error.status === 429 ? 429 : 502,
+        error.status === 429
+          ? retrySeconds()
+          : failure
+            ? retrySeconds(failure.until)
+            : undefined,
+        upstreamStatus === 429 || upstreamStatus >= 500
+          ? upstreamStatus
+          : undefined,
+      );
+    }
+  }
+
+  /** Request one bounded observation sample and project its public fields. */
+  async function getObservations(params, options = {}) {
+    const query = observationFilters(params);
+    // View samples stay stable in the route cache until their TTL expires.
+    query.set('order_by', params.scope === 'view' ? 'random' : 'observed_on');
+    if (params.scope !== 'view') query.set('order', 'desc');
+    query.set('per_page', '200');
+    query.set('fields', OBSERVATION_FIELDS);
+    if (params.scope === 'view') {
+      query.set('swlat', String(params.box.south));
+      query.set('swlng', String(params.box.west));
+      query.set('nelat', String(params.box.north));
+      query.set('nelng', String(params.box.east));
+    }
+    return requestProjected(
+      `${OBSERVATIONS_URL}?${query}`,
+      (payload) => {
+        if (
+          !Array.isArray(payload?.results) ||
+          !Number.isSafeInteger(payload.total_results) ||
+          payload.total_results < 0
+        )
+          throw upstreamError('inaturalist_unavailable', 502);
+        const rows = normalizeInatObservations(payload.results, {
+          nowMs: now(),
+          windowMs: (params.taxa === 'whales' ? 7 : 2) * DAY_MS,
+        });
+        // Empty views need total_results: 0. A wholly invalid page must not
+        // replace good data. Valid rows excluded by the finer rolling-time
+        // cutoff are a healthy empty result of the upstream DATE over-fetch.
+        if (
+          !rows ||
+          (!rows.length &&
+            (payload.results.length || payload.total_results) &&
+            !normalizeInatObservations(payload.results)?.length)
+        )
+          throw upstreamError('inaturalist_unavailable', 502);
+        return {
+          rows,
+          totalResults: payload.total_results,
+          ...(payload.total_results > payload.results.length
+            ? { partial: true, rawRowCount: payload.total_results }
+            : {}),
+        };
+      },
+      'observations',
+      options,
+    );
+  }
+
+  /** Decode one validated density tile without observation identifiers. */
+  async function getGrid(params, options = {}) {
+    if (!validInatGridTile(params)) throw new TypeError('Invalid grid tile');
+    const query = observationFilters(params);
+    return requestProjected(
+      `${API_URL}/grid/${params.z}/${params.x}/${params.y}.grid.json?${query}`,
+      (payload) => projectInatGrid(payload, params),
+      'grid',
+      options,
+    );
+  }
+
+  return {
+    getObservations,
+    getGrid,
+    /** Current provider-wide or resource-specific retry information. */
+    cooldownState(resource) {
+      if (now() < cooldownUntil)
+        return {
+          upstreamStatus: 429,
+          retryAfterS: retrySeconds(),
+        };
+      const failure = failures.get(resource);
+      if (failure && now() < failure.until)
+        return {
+          upstreamStatus: failure.status,
+          retryAfterS: retrySeconds(failure.until),
+        };
+      return undefined;
+    },
+    /** The current UTC day's reserved upstream attempts and configured limit. */
+    budgetState() {
+      const value = currentBudget();
+      return { ...value, budget: dailyLimit() };
+    },
+  };
+}

server/providers/inaturalist/client.test.mjs

@@ -0,0 +1,163 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createInatClient } from './client.js';
+import { syntheticGrid } from './grid.fixture.mjs';
+
+const NOW = Date.parse('2026-11-04T18:05:00Z');
+const observation = (id, time) => ({
+  id,
+  geojson: { coordinates: [-122.3, 47.6] },
+  quality_grade: 'research',
+  time_observed_at: time,
+  observed_on: time.slice(0, 10),
+  // Upload age does not determine whether an observation is recent.
+  created_at: '2026-11-04T18:00:00Z',
+  taxon: { name: 'Synthetic taxon', iconic_taxon_name: 'Aves' },
+});
+
+function clientFor(results) {
+  return createInatClient({
+    now: () => NOW,
+    cacheDir: null,
+    queueOptions: { intervalMs: 0 },
+    warn() {},
+    fetchImpl: async () =>
+      Response.json({ results, total_results: results.length }),
+  });
+}
+
+test('iNaturalist drops ancient and boundary-expired observations uploaded today', async () => {
+  const client = clientFor([
+    observation(1, '2010-11-04T18:00:00Z'),
+    observation(2, '2026-11-02T18:04:59Z'),
+    observation(3, '2026-11-02T18:05:00Z'),
+  ]);
+  const result = await client.getObservations({
+    scope: 'global',
+    taxa: 'all',
+    observedD1: '2026-11-02',
+  });
+  assert.deepEqual(
+    result.rows.map((row) => row.stableId),
+    ['inat:3'],
+  );
+});
+
+test('a valid date-filtered page can be empty after the exact recency cutoff', async () => {
+  const client = clientFor([observation(1, '2026-11-02T06:00:00Z')]);
+  const result = await client.getObservations({
+    scope: 'global',
+    taxa: 'all',
+    observedD1: '2026-11-02',
+  });
+  assert.deepEqual(result.rows, []);
+  assert.equal(result.totalResults, 1);
+});
+
+const params = {
+  scope: 'view',
+  box: { south: 47, west: -123, north: 48, east: -122 },
+  taxa: 'all',
+  observedD1: '2026-11-02',
+};
+
+test('observations and tiles share pacing, and observation priority wins a cold burst', async () => {
+  let at = 0;
+  const calls = [];
+  const client = createInatClient({
+    cacheDir: null,
+    now: () => NOW + at,
+    queueOptions: {
+      now: () => at,
+      wait: async (ms) => {
+        at += ms;
+      },
+    },
+    fetchImpl: async (url) => {
+      const isGrid = new URL(url).pathname.includes('/grid/');
+      calls.push([isGrid ? 'grid' : 'observations', at]);
+      return Response.json(
+        isGrid ? syntheticGrid() : { results: [], total_results: 0 },
+      );
+    },
+  });
+  const tiles = Array.from({ length: 3 }, (_, x) =>
+    client.getGrid({ ...params, z: 2, x, y: 1 }),
+  );
+  await Promise.all([...tiles, client.getObservations(params)]);
+  assert.deepEqual(calls, [
+    ['observations', 0],
+    ['grid', 0],
+    ['grid', 0],
+    ['grid', 0],
+  ]);
+  assert.equal(client.budgetState().count, 4);
+});
+
+test('upstream status and safe failure reasons are logged without upstream messages or URLs', async () => {
+  for (const [response, expected] of [
+    [
+      () =>
+        new Response('request-secret', {
+          status: 503,
+          statusText: 'request-secret',
+        }),
+      /status=503 reason=http/,
+    ],
+    [
+      () => Promise.reject(new DOMException('request-secret', 'TimeoutError')),
+      /status=none reason=timeout/,
+    ],
+    [
+      () => Response.json({ unexpected: 'request-secret' }),
+      /status=200 reason=invalid-payload/,
+    ],
+  ]) {
+    const warnings = [];
+    const client = createInatClient({
+      cacheDir: null,
+      now: () => NOW,
+      queueOptions: { intervalMs: 0 },
+      warn: (message) => warnings.push(message),
+      fetchImpl: response,
+    });
+    await assert.rejects(client.getObservations(params), { status: 502 });
+    assert.equal(warnings.length, 1);
+    assert.match(warnings[0], expected);
+    assert.doesNotMatch(warnings[0], /request-secret|https?:|swlat|d1=/);
+  }
+});
+
+test('a dispatched abort is diagnosed, spends only its attempt, and leaves the next request healthy', async () => {
+  const warnings = [];
+  const controller = new AbortController();
+  let started;
+  const didStart = new Promise((resolve) => {
+    started = resolve;
+  });
+  let calls = 0;
+  const client = createInatClient({
+    cacheDir: null,
+    now: () => NOW,
+    queueOptions: { intervalMs: 0 },
+    warn: (message) => warnings.push(message),
+    fetchImpl: async (url, { signal }) => {
+      calls += 1;
+      if (calls > 1) return Response.json({ results: [], total_results: 0 });
+      started();
+      return new Promise((resolve, reject) =>
+        signal.addEventListener('abort', () => reject(signal.reason), {
+          once: true,
+        }),
+      );
+    },
+  });
+  const pending = client.getObservations(params, { signal: controller.signal });
+  const failed = assert.rejects(pending, { name: 'AbortError' });
+  await didStart;
+  controller.abort();
+  await failed;
+  assert.match(warnings[0], /resource=observations status=none reason=abort/);
+  await client.getObservations(params);
+  assert.equal(calls, 2);
+});

server/providers/inaturalist/grid.fixture.mjs

@@ -0,0 +1,51 @@
+/** Build a synthetic UTFGrid with logical cell counts and repeated hit pixels. */
+export function syntheticGrid({
+  z = 2,
+  x = 1,
+  y = 1,
+  cells = [
+    { row: 1, column: 51, count: 6, iconic: 3 },
+    { row: 3, column: 49, count: 12, iconic: 47170 },
+  ],
+} = {}) {
+  const pixels = Array.from({ length: 64 }, () => Array(64).fill(' '));
+  const keys = [''];
+  const data = {};
+  cells.forEach((cell, index) => {
+    const key = String(900_000_000 + index);
+    keys.push(key);
+    const value = index + 1;
+    let code = value + 32;
+    if (code >= 34) code += 1;
+    if (code >= 92) code += 1;
+    const character = String.fromCharCode(code);
+    for (const [row, column] of [
+      [cell.row, cell.column],
+      [cell.row - 1, cell.column],
+      [cell.row + 1, cell.column],
+      [cell.row, cell.column - 1],
+      [cell.row, cell.column + 1],
+    ]) {
+      if (row >= 0 && row < 64 && column >= 0 && column < 64)
+        pixels[row][column] = character;
+    }
+    data[key] = {
+      captive: null,
+      cellCount: cell.count,
+      geoprivacy: null,
+      id: Number(key),
+      latitude:
+        (Math.atan(
+          Math.sinh(Math.PI * (1 - 2 * ((y + cell.row / 64) / 2 ** z))),
+        ) *
+          180) /
+        Math.PI,
+      longitude: ((x + cell.column / 64) / 2 ** z) * 360 - 180,
+      private_location: null,
+      quality_grade: 'needs_id',
+      'taxon.iconic_taxon_id': cell.iconic,
+      uuid: `00000000-0000-4000-8000-${String(index).padStart(12, '0')}`,
+    };
+  });
+  return { grid: pixels.map((row) => row.join('')), keys, data };
+}

server/providers/inaturalist/grid.js

@@ -0,0 +1,127 @@
+// iNaturalist's operational /v1/grid/{z}/{x}/{y}.grid.json endpoint is not
+// covered by its v1 Swagger contract. Validate the entire UTFGrid shape before
+// accepting any cell; callers preserve the last good sample on schema drift.
+import {
+  wildlifeGridCellId,
+  WILDLIFE_GRID_MAX_ZOOM,
+} from '../../../src/layers/wildlifeSightings/gridViewport.js';
+
+const INAT_GRID_SIZE = 64;
+export const INAT_GRID_DECODE_MEASURE = 'wildlife:server:tile-decode';
+const grades = new Set(['research', 'needs_id', 'casual']);
+const object = (value) =>
+  !!value && typeof value === 'object' && !Array.isArray(value);
+
+/** Accept only integer XYZ coordinates within the supported zoom range. */
+export function validInatGridTile({ z, x, y } = {}) {
+  return (
+    Number.isInteger(z) &&
+    z >= 0 &&
+    z <= WILDLIFE_GRID_MAX_ZOOM &&
+    Number.isInteger(x) &&
+    Number.isInteger(y) &&
+    x >= 0 &&
+    y >= 0 &&
+    x < 2 ** z &&
+    y < 2 ** z
+  );
+}
+
+/** Pure allow-list projection. A UTFGrid key is an observation identifier and
+ * its repeated pixels form a dilated hit area, not additional occupied cells.
+ * Neither those keys nor representative/private fields cross this boundary. */
+export function projectInatGrid(payload, tile) {
+  const start = `${INAT_GRID_DECODE_MEASURE}:start`;
+  const end = `${INAT_GRID_DECODE_MEASURE}:end`;
+  performance.mark(start);
+  try {
+    return decodeInatGrid(payload, tile);
+  } finally {
+    performance.mark(end);
+    // Keep the latest sample inspectable without retaining every tile forever.
+    // PerformanceObservers still receive each individual decode measurement.
+    performance.clearMeasures(INAT_GRID_DECODE_MEASURE);
+    performance.measure(INAT_GRID_DECODE_MEASURE, start, end);
+    performance.clearMarks(start);
+    performance.clearMarks(end);
+  }
+}
+
+function decodeInatGrid(payload, tile) {
+  const invalid = () => {
+    throw new TypeError('Invalid iNaturalist UTFGrid');
+  };
+  if (
+    !validInatGridTile(tile) ||
+    !object(payload) ||
+    !Array.isArray(payload.grid) ||
+    payload.grid.length !== INAT_GRID_SIZE ||
+    !payload.grid.every(
+      (row) => typeof row === 'string' && row.length === INAT_GRID_SIZE,
+    ) ||
+    !Array.isArray(payload.keys) ||
+    !payload.keys.length ||
+    payload.keys.length > INAT_GRID_SIZE ** 2 + 1 ||
+    payload.keys[0] !== '' ||
+    !payload.keys.every(
+      (key) => typeof key === 'string' && key.length <= 128,
+    ) ||
+    new Set(payload.keys).size !== payload.keys.length ||
+    !object(payload.data)
+  )
+    invalid();
+  const dataKeys = Object.keys(payload.data);
+  if (dataKeys.length !== payload.keys.length - 1) invalid();
+  for (const key of payload.keys.slice(1)) {
+    if (!key || !Object.hasOwn(payload.data, key)) invalid();
+    const value = payload.data[key];
+    if (
+      !object(value) ||
+      !Number.isSafeInteger(value.cellCount) ||
+      value.cellCount <= 0 ||
+      !Number.isFinite(value.latitude) ||
+      Math.abs(value.latitude) > 90 ||
+      !Number.isFinite(value.longitude) ||
+      Math.abs(value.longitude) > 180 ||
+      !grades.has(value.quality_grade) ||
+      !(
+        value['taxon.iconic_taxon_id'] === null ||
+        (Number.isSafeInteger(value['taxon.iconic_taxon_id']) &&
+          value['taxon.iconic_taxon_id'] > 0)
+      )
+    )
+      invalid();
+  }
+  const occupied = new Set();
+  for (const line of payload.grid) {
+    for (let column = 0; column < INAT_GRID_SIZE; column += 1) {
+      let code = line.charCodeAt(column);
+      if (code < 32 || code === 34 || code === 92) invalid();
+      if (code >= 93) code -= 1;
+      if (code >= 35) code -= 1;
+      const index = code - 32;
+      if (index < 0 || index >= payload.keys.length) invalid();
+      if (index) occupied.add(payload.keys[index]);
+    }
+  }
+  if (occupied.size !== dataKeys.length) invalid();
+  const cells = new Map();
+  for (const key of occupied) {
+    const value = payload.data[key];
+    const id = wildlifeGridCellId(value.latitude, value.longitude, tile.z);
+    const cell = {
+      id,
+      cellCount: value.cellCount,
+      lat: value.latitude,
+      lon: value.longitude,
+    };
+    // Two different representatives claiming one logical cell are a contract
+    // change; summing or choosing one silently would fabricate the count.
+    if (cells.has(id)) invalid();
+    cells.set(id, cell);
+  }
+  const rows = [...cells.values()];
+  const totalResults = rows.reduce((total, cell) => total + cell.cellCount, 0);
+  if (!Number.isSafeInteger(totalResults)) invalid();
+  return { cells: rows, totalResults };
+}

server/providers/inaturalist/grid.test.mjs

@@ -0,0 +1,374 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { projectInatGrid } from './grid.js';
+import { syntheticGrid } from './grid.fixture.mjs';
+import { installInatProxy, NOW } from './proxy.fixture.mjs';
+import { createInatClient } from './client.js';
+
+const tile = { z: 2, x: 1, y: 1 };
+const gridUrl = '/grid?z=2&x=1&y=1&taxa=Aves&quality=research';
+const install = (options, hook) => installInatProxy(gridUrl, options, hook);
+
+test('UTFGrid projection validates the full shape and counts each logical occupied cell once', () => {
+  const raw = syntheticGrid();
+  const projected = projectInatGrid(raw, tile);
+  assert.equal(raw.grid.length, 64);
+  assert.ok(raw.grid.every((row) => row.length === 64));
+  assert.equal(
+    raw.grid.join('').split('!').length - 1,
+    5,
+    'one key is repeated by its hit area',
+  );
+  assert.equal(projected.cells.length, 2);
+  assert.equal(projected.totalResults, 18);
+  assert.deepEqual(projected.cells[0], {
+    id: 'grid:2/1/1:1:51',
+    cellCount: 6,
+    lat: raw.data[raw.keys[1]].latitude,
+    lon: raw.data[raw.keys[1]].longitude,
+  });
+  for (const cell of projected.cells)
+    assert.deepEqual(Object.keys(cell).sort(), [
+      'cellCount',
+      'id',
+      'lat',
+      'lon',
+    ]);
+  for (const privateField of [
+    '900000000',
+    'uuid',
+    'geoprivacy',
+    'private_location',
+    'captive',
+    'quality_grade',
+  ])
+    assert.ok(!JSON.stringify(projected).includes(privateField));
+});
+
+test('legitimate blank grid and null/unknown iconic ids remain safe', () => {
+  assert.deepEqual(projectInatGrid(syntheticGrid({ cells: [] }), tile), {
+    cells: [],
+    totalResults: 0,
+  });
+  const raw = syntheticGrid({
+    cells: [{ row: 1, column: 1, count: 1, iconic: null }],
+  });
+  const projected = projectInatGrid(raw, tile);
+  assert.equal(projected.cells[0].cellCount, 1);
+  raw.data[raw.keys[1]]['taxon.iconic_taxon_id'] = 999999;
+  assert.deepEqual(projectInatGrid(raw, tile), projected);
+});
+
+test('schema drift anywhere fails closed, including unused, malformed and orphan cells', () => {
+  const changes = [
+    (raw) => {
+      raw.grid.pop();
+    },
+    (raw) => {
+      raw.grid[0] = '';
+    },
+    (raw) => {
+      raw.grid[0] = '~'.repeat(64);
+    },
+    (raw) => {
+      raw.keys[0] = 'not-empty';
+    },
+    (raw) => {
+      raw.keys.push(raw.keys[1]);
+    },
+    (raw) => {
+      delete raw.data[raw.keys[1]];
+    },
+    (raw) => {
+      raw.data.extra = {};
+    },
+    (raw) => {
+      raw.data[raw.keys[1]].cellCount = -1;
+    },
+    (raw) => {
+      raw.data[raw.keys[1]].latitude = '47';
+    },
+    (raw) => {
+      raw.data[raw.keys[1]].longitude = 181;
+    },
+    (raw) => {
+      raw.data[raw.keys[1]].quality_grade = 'new-grade';
+    },
+    (raw) => {
+      delete raw.data[raw.keys[1]]['taxon.iconic_taxon_id'];
+    },
+    (raw) => {
+      raw.data[raw.keys[1]]['taxon.iconic_taxon_id'] = 'Aves';
+    },
+    (raw) => {
+      raw.grid = Array(64).fill(' '.repeat(64));
+    },
+  ];
+  for (const change of changes) {
+    const raw = syntheticGrid();
+    change(raw);
+    assert.throws(
+      () => projectInatGrid(raw, tile),
+      /Invalid iNaturalist UTFGrid/,
+    );
+  }
+});
+
+for (const hook of ['configureServer', 'configurePreviewServer']) {
+  test(`${hook}: fixed grid URL shares filters, caps and allow-list cache`, async () => {
+    const calls = [];
+    const cache = new Map();
+    const request = install(
+      {
+        cache,
+        fetchImpl: async (url, options) => {
+          calls.push(new URL(url));
+          assert.equal(options.redirect, 'error');
+          assert.ok(options.signal instanceof AbortSignal);
+          assert.match(
+            options.headers['User-Agent'],
+            /^gods-eye-view-wildlife-sightings-proxy/,
+          );
+          return Response.json(syntheticGrid());
+        },
+      },
+      hook,
+    );
+    assert.equal(calls.length, 0);
+    const response = await request(
+      `${gridUrl}&url=https://attacker.test&per_page=999`,
+    );
+    assert.equal(response.status, 200);
+    assert.equal(response.body.cells.length, 2);
+    assert.equal(response.body.fetchedAt, NOW);
+    assert.equal(response.headers['Cache-Control'], 'no-store');
+    assert.equal(
+      calls[0].origin + calls[0].pathname,
+      'https://api.inaturalist.org/v1/grid/2/1/1.grid.json',
+    );
+    assert.deepEqual(Object.fromEntries(calls[0].searchParams), {
+      verifiable: 'true',
+      captive: 'false',
+      d1: '2026-11-02',
+      photos: 'true',
+      quality_grade: 'research',
+      iconic_taxa: 'Aves',
+    });
+    await request(gridUrl);
+    assert.equal(calls.length, 1, 'fresh stable tile/filter key is cached');
+    assert.ok(!JSON.stringify([...cache]).includes('private_location'));
+    assert.ok(!JSON.stringify([...cache]).includes('900000000'));
+    const whale = await request('/grid?z=2&x=1&y=1&taxa=whales&confirmed=true');
+    assert.equal(whale.status, 200);
+    assert.equal(calls[1].searchParams.get('taxon_id'), '152871');
+    assert.equal(calls[1].searchParams.get('d1'), '2026-10-28');
+    assert.equal(calls[1].searchParams.has('photos'), false);
+  });
+}
+
+test('grid admission rejects cross-site/method/path/tile before acquisition', async () => {
+  const request = install({
+    fetchImpl() {
+      assert.fail('invalid grid request acquired');
+    },
+  });
+  assert.equal(
+    (
+      await request(gridUrl, {
+        headers: {
+          host: 'localhost:5173',
+          origin: 'https://other.test',
+          'sec-fetch-site': 'cross-site',
+        },
+      })
+    ).status,
+    403,
+  );
+  assert.equal((await request('/grid', { method: 'POST' })).status, 405);
+  assert.equal((await request('/grid/extra')).status, 404);
+  for (const query of [
+    '',
+    'z=2&x=4&y=0',
+    'z=-1&x=0&y=0',
+    'z=23&x=0&y=0',
+    'z=2&x=1.5&y=0',
+    'z=2&x=&y=0',
+    'z=2&x=0&y=4',
+  ]) {
+    const result = await request(`/grid?${query}`);
+    assert.equal(result.status, 400, query);
+    assert.equal(result.body.error, 'invalid_tile');
+  }
+});
+
+test('grid refresh single-flight, stale fallback and hour-key expiry keep the original age', async () => {
+  let time = NOW;
+  let calls = 0;
+  let resolve;
+  let mode = 'pending';
+  const request = install({
+    now: () => time,
+    fetchImpl: async () => {
+      calls += 1;
+      if (mode === 'pending')
+        return new Promise((done) => {
+          resolve = done;
+        });
+      if (mode === 'bad') return Response.json({ grid: [] });
+      return Response.json(syntheticGrid());
+    },
+  });
+  const first = request();
+  const second = request();
+  for (let i = 0; i < 100 && !resolve; i += 1) await new Promise(setImmediate);
+  assert.equal(calls, 1);
+  resolve(Response.json(syntheticGrid()));
+  assert.equal((await first).status, 200);
+  assert.equal((await second).status, 200);
+  time += 900_001;
+  mode = 'bad';
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, NOW);
+  assert.equal(stale.headers['X-Data-Stale'], 'true');
+  time = NOW + 3_600_001;
+  const expired = await request();
+  assert.equal(expired.status, 502);
+  assert.equal(expired.body.error, 'inaturalist_unavailable');
+});
+
+test('grid and observations share the upstream cooldown and daily reservations', async () => {
+  let calls = 0;
+  const client = createInatClient({
+    now: () => NOW,
+    cacheDir: null,
+    queueOptions: { intervalMs: 0 },
+    warn() {},
+    fetchImpl: async () => {
+      calls += 1;
+      return new Response('', {
+        status: 429,
+        headers: { 'Retry-After': '120' },
+      });
+    },
+  });
+  await assert.rejects(
+    client.getGrid({ ...tile, taxa: 'all', observedD1: '2026-11-02' }),
+    (error) => error.status === 429 && error.retryAfterS === 120,
+  );
+  await assert.rejects(
+    client.getObservations({
+      scope: 'global',
+      taxa: 'all',
+      observedD1: '2026-11-02',
+    }),
+    (error) => error.status === 429,
+  );
+  assert.equal(calls, 1);
+  assert.equal(client.budgetState().count, 1);
+});
+
+test('grid body cap and upstream failures return fixed errors; only real 5xx cools down', async () => {
+  for (const [response, retryAfter] of [
+    [() => new Response('x'.repeat(8 * 1024 * 1024 + 1)), undefined],
+    [() => new Response('', { status: 503 }), '15'],
+  ]) {
+    const request = install({ fetchImpl: async () => response() });
+    const result = await request();
+    assert.equal(result.status, 502);
+    assert.deepEqual(result.body, { error: 'inaturalist_unavailable' });
+    assert.equal(result.headers['Retry-After'], retryAfter);
+  }
+});
+
+test('a failed tile preserves last good cells and cannot send unrelated observations into 502', async () => {
+  let at = NOW;
+  let failGrid = false;
+  const calls = [];
+  const warnings = [];
+  const request = install({
+    now: () => at,
+    warn: (message) => warnings.push(message),
+    fetchImpl: async (url) => {
+      const isGrid = new URL(url).pathname.includes('/grid/');
+      calls.push(isGrid ? 'grid' : 'observations');
+      if (isGrid && failGrid)
+        return new Response('private upstream text', {
+          status: 503,
+          headers: { 'Retry-After': '45' },
+        });
+      return Response.json(
+        isGrid ? syntheticGrid() : { results: [], total_results: 0 },
+      );
+    },
+  });
+  const first = await request();
+  at += 900_001;
+  failGrid = true;
+  const failed = await request();
+  assert.equal(failed.status, 200);
+  assert.equal(failed.headers['X-Data-Stale'], 'true');
+  assert.equal(failed.body.stale, true);
+  assert.equal(failed.body.fetchedAt, first.body.fetchedAt);
+  assert.deepEqual(failed.body.cells, first.body.cells);
+  assert.equal(
+    (await request('/observations?scope=global&taxa=whales')).status,
+    200,
+  );
+  assert.deepEqual(calls, ['grid', 'grid', 'observations']);
+  assert.match(warnings[0], /resource=grid status=503 reason=http/);
+  assert.doesNotMatch(warnings[0], /private upstream text/);
+  // The tile cooldown also preserves its data without another upstream try.
+  const cooling = await request();
+  assert.equal(cooling.body.stale, true);
+  assert.equal(cooling.headers['Retry-After'], '45');
+  assert.equal(cooling.headers['X-Upstream-Status'], '503');
+  assert.equal(calls.length, 3);
+  at += 45_000;
+  failGrid = false;
+  const refreshing = await request();
+  assert.equal(refreshing.body.stale, true);
+  await new Promise(setImmediate);
+  const recovered = await request();
+  assert.equal(recovered.status, 200);
+  assert.equal(recovered.body.stale, undefined);
+  assert.equal(
+    calls.length,
+    4,
+    'a failed queue task does not poison later tile work',
+  );
+});
+
+test('twelve queued tiles leave observation capacity and give the next dispatch to observations', async () => {
+  const calls = [];
+  let release;
+  const request = install({
+    fetchImpl: (url) => {
+      const path = new URL(url).pathname;
+      calls.push(path);
+      if (calls.length === 1)
+        return new Promise((resolve) => {
+          release = resolve;
+        });
+      return Response.json(
+        path.includes('/grid/')
+          ? syntheticGrid()
+          : { results: [], total_results: 0 },
+      );
+    },
+  });
+  const first = request('/grid?z=4&x=0&y=1');
+  for (let i = 0; i < 100 && !release; i += 1) await new Promise(setImmediate);
+  assert.ok(release);
+  const tiles = Array.from({ length: 11 }, (_, i) =>
+    request(`/grid?z=4&x=${i + 1}&y=1`),
+  );
+  const observation = request('/observations?scope=global');
+  const queuedTile = request('/grid?z=4&x=12&y=1');
+  release(Response.json(syntheticGrid()));
+  const results = await Promise.all([first, observation, ...tiles, queuedTile]);
+  assert.ok(results.every((result) => result.status === 200));
+  assert.equal(calls.length, 14);
+  assert.equal(calls[1], '/v2/observations');
+});

server/providers/inaturalist/observations.js

@@ -0,0 +1,343 @@
+import { createInatClient } from './client.js';
+import { coalesceProxyRequest } from '../common/http.js';
+import { admitSameSiteKeyless } from '../common/same-site.js';
+import { requiredFiniteQueryNumber } from '../common/query.js';
+import { snapWildlifeBox } from '../../../src/layers/wildlifeSightings/bounds.js';
+import { validInatGridTile } from './grid.js';
+
+// The upstream advertises five-minute freshness; global samples cost less often.
+const TTL_MS = 300_000;
+const GLOBAL_TTL_MS = 600_000;
+const INAT_GRID_CACHE_TTL_MS = 15 * 60_000;
+const STALE_MAX_MS = 3_600_000;
+const INAT_CACHE_MAX = 400;
+const HOUR_MS = 3_600_000;
+const TAXA = Object.freeze([
+  'all',
+  'Aves',
+  'Mammalia',
+  'Insecta',
+  'Plantae',
+  'whales',
+]);
+
+function requestParams(pathname, query, nowMs) {
+  const grid = pathname === '/grid';
+  const scope = grid ? 'grid' : (query.get('scope') ?? 'view');
+  if (!grid && scope !== 'view' && scope !== 'global')
+    return { error: 'invalid_scope' };
+  const quality =
+    query.get('quality') === 'research' ||
+    (grid && query.get('confirmed') === 'true')
+      ? 'research'
+      : 'all';
+  const taxa = TAXA.includes(query.get('taxa')) ? query.get('taxa') : 'all';
+  let box = null;
+  let tile;
+  if (grid) {
+    tile = Object.fromEntries(
+      ['z', 'x', 'y'].map((name) => [
+        name,
+        requiredFiniteQueryNumber(query, name),
+      ]),
+    );
+    if (!validInatGridTile(tile)) return { error: 'invalid_tile' };
+  } else if (scope === 'view') {
+    const south = requiredFiniteQueryNumber(query, 'south');
+    const west = requiredFiniteQueryNumber(query, 'west');
+    const north = requiredFiniteQueryNumber(query, 'north');
+    const east = requiredFiniteQueryNumber(query, 'east');
+    box = snapWildlifeBox({ south, west, north, east });
+    if (!box) return { error: 'invalid_bbox' };
+  }
+  const windowMs = (taxa === 'whales' ? 7 * 24 : 48) * HOUR_MS;
+  const windowKey = new Date(Math.floor((nowMs - windowMs) / HOUR_MS) * HOUR_MS)
+    .toISOString()
+    .replace('.000Z', 'Z');
+  const bounds = box ? `${box.south},${box.west},${box.north},${box.east}` : '';
+  const baseKey = grid
+    ? `grid:v1:${tile.z}/${tile.x}/${tile.y}:${quality}:${taxa}`
+    : `v1:${scope}:${bounds}:${quality}:${taxa}`;
+  return {
+    scope,
+    ...(grid
+      ? { ...tile, waitForFresh: query.get('refresh') === 'wait' }
+      : { box }),
+    quality,
+    taxa,
+    observedD1: windowKey.slice(0, 10),
+    baseKey,
+    key: `${baseKey}:${windowKey}`,
+  };
+}
+
+/** A shared-provider route for dev and preview; acquisition starts on demand. */
+export function inaturalistProxy({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+  cacheDir,
+  cache = new Map(),
+  warn = (...args) => console.warn(...args),
+  queueOptions,
+} = {}) {
+  const inFlight = new Map();
+  const consumers = new Map();
+  let client = null;
+
+  function age(entry) {
+    if (!entry) return Infinity;
+    const elapsed = now() - entry.savedAt;
+    return elapsed < 0 ? Infinity : elapsed;
+  }
+
+  function joinFlight(promise, group, signal) {
+    group.count += 1;
+    return new Promise((resolve, reject) => {
+      let released = false;
+      function release() {
+        if (released) return;
+        released = true;
+        signal?.removeEventListener('abort', abort);
+        group.count -= 1;
+        if (!group.count && !group.background && !group.settled) {
+          group.controller.abort();
+          // A fresh consumer must not join an abandoned queued generation.
+          if (inFlight.get(group.key) === promise) inFlight.delete(group.key);
+          if (consumers.get(group.key) === group) consumers.delete(group.key);
+        }
+      }
+      function abort() {
+        release();
+        reject(signal.reason);
+      }
+      signal?.addEventListener('abort', abort, { once: true });
+      if (signal?.aborted) abort();
+      promise.then(
+        (value) => {
+          release();
+          resolve(value);
+        },
+        (error) => {
+          release();
+          reject(error);
+        },
+      );
+    });
+  }
+
+  function refresh(params, background = false) {
+    // Global samples share pending refreshes across hourly window changes.
+    const flightKey = params.scope === 'global' ? params.baseKey : params.key;
+    let group = consumers.get(flightKey);
+    if (!group) {
+      group = {
+        key: flightKey,
+        controller: new AbortController(),
+        count: 0,
+        settled: false,
+        background,
+      };
+      consumers.set(flightKey, group);
+    }
+    group.background ||= background;
+    const { promise, shared } = coalesceProxyRequest(
+      inFlight,
+      flightKey,
+      async () => {
+        client ??= createInatClient({
+          fetchImpl,
+          now,
+          cacheDir,
+          warn,
+          queueOptions,
+        });
+        const options = { signal: group.controller.signal };
+        const result = await (params.scope === 'grid'
+          ? client.getGrid(params, options)
+          : client.getObservations(params, options));
+        const value = {
+          fetchedAt: now(),
+          ...(params.scope === 'grid'
+            ? {}
+            : { scope: params.scope, box: params.box }),
+          ...result,
+        };
+        cache.delete(params.key);
+        cache.set(params.key, {
+          value,
+          savedAt: now(),
+          baseKey: params.baseKey,
+        });
+        while (cache.size > INAT_CACHE_MAX)
+          cache.delete(cache.keys().next().value);
+        return value;
+      },
+    );
+    if (!shared) {
+      const settle = () => {
+        group.settled = true;
+        if (consumers.get(flightKey) === group) consumers.delete(flightKey);
+      };
+      void promise.then(settle, settle);
+    }
+    return { promise, group };
+  }
+
+  async function acquire(params, signal) {
+    signal?.throwIfAborted();
+    for (const [key, entry] of cache) {
+      if (age(entry) > STALE_MAX_MS) cache.delete(key);
+    }
+    const current = cache.get(params.key);
+    const ttl =
+      params.scope === 'grid'
+        ? INAT_GRID_CACHE_TTL_MS
+        : params.scope === 'global'
+          ? GLOBAL_TTL_MS
+          : TTL_MS;
+    if (current && age(current) < ttl) {
+      cache.delete(params.key);
+      cache.set(params.key, current);
+      return { value: current.value, stale: false };
+    }
+    // Window-hour rollover can reuse prior cells without claiming a new age.
+    let previous = current;
+    let previousKey = params.key;
+    if (!previous) {
+      for (const [key, entry] of cache) {
+        if (
+          entry.baseKey === params.baseKey &&
+          (!previous || entry.savedAt > previous.savedAt)
+        ) {
+          previous = entry;
+          previousKey = key;
+        }
+      }
+    }
+    if (params.scope === 'global' && age(previous) < GLOBAL_TTL_MS)
+      return { value: previous.value, stale: false };
+    if (
+      params.scope === 'grid' &&
+      !params.waitForFresh &&
+      age(previous) <= STALE_MAX_MS
+    ) {
+      cache.delete(previousKey);
+      cache.set(previousKey, previous);
+      // Retain one background consumer after this HTTP response closes. A stale
+      // tile is useful immediately; waiting for the token queue defeats SWR.
+      const cooling = client?.cooldownState('grid');
+      if (!cooling) {
+        const { promise } = refresh(params, true);
+        void promise.catch(() => {});
+      }
+      return {
+        value: previous.value,
+        stale: true,
+        ...cooling,
+      };
+    }
+    try {
+      const { promise, group } = refresh(params);
+      return { value: await joinFlight(promise, group, signal), stale: false };
+    } catch (error) {
+      if (signal?.aborted) throw error;
+      if (age(previous) <= STALE_MAX_MS)
+        return {
+          value: previous.value,
+          stale: true,
+          retryAfterS: error.retryAfterS,
+          upstreamStatus: error.upstreamStatus,
+        };
+      throw error;
+    }
+  }
+
+  async function handler(req, res) {
+    const json = (
+      status,
+      value,
+      { stale = false, retryAfterS, upstreamStatus } = {},
+    ) => {
+      if (res.destroyed) return;
+      res.writeHead(status, {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+        ...(status === 405 ? { Allow: 'GET' } : {}),
+        ...(Number.isFinite(retryAfterS)
+          ? { 'Retry-After': String(retryAfterS) }
+          : {}),
+        ...(upstreamStatus
+          ? { 'X-Upstream-Status': String(upstreamStatus) }
+          : {}),
+        ...(stale ? { 'X-Data-Stale': 'true' } : {}),
+      });
+      res.end(JSON.stringify(value));
+    };
+    if (admitSameSiteKeyless(req, res)) return;
+    if (req.method !== 'GET') return json(405, { error: 'method_not_allowed' });
+    const url = String(req.url || '/');
+    const queryAt = url.indexOf('?');
+    const pathname = queryAt < 0 ? url : url.slice(0, queryAt);
+    if (pathname !== '/observations' && pathname !== '/grid')
+      return json(404, { error: 'unknown_route' });
+    const params = requestParams(
+      pathname,
+      new URLSearchParams(queryAt < 0 ? '' : url.slice(queryAt + 1)),
+      now(),
+    );
+    if (params.error) return json(400, { error: params.error });
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    // IncomingMessage.close also fires after a complete request body. The
+    // response close identifies the abandoned browser fetch, while aborted
+    // covers a request cut short before it reached the response stage.
+    req.once?.('aborted', abort);
+    res.once?.('close', abort);
+    try {
+      const { value, stale, retryAfterS, upstreamStatus } = await acquire(
+        params,
+        controller.signal,
+      );
+      return json(200, stale ? { ...value, stale: true } : value, {
+        stale,
+        retryAfterS,
+        upstreamStatus,
+      });
+    } catch (error) {
+      if (controller.signal.aborted) return;
+      const status =
+        error.code === 'inaturalist_budget_exhausted'
+          ? 503
+          : error.status === 429
+            ? 429
+            : 502;
+      const code =
+        error.code === 'inaturalist_budget_exhausted'
+          ? error.code
+          : status === 429
+            ? 'inaturalist_rate_limited'
+            : 'inaturalist_unavailable';
+      return json(
+        status,
+        { error: code },
+        {
+          retryAfterS: error.retryAfterS,
+          upstreamStatus: error.upstreamStatus,
+        },
+      );
+    } finally {
+      req.removeListener?.('aborted', abort);
+      res.removeListener?.('close', abort);
+    }
+  }
+
+  return {
+    name: 'inaturalist',
+    configureServer({ middlewares }) {
+      middlewares.use('/api/inaturalist', handler);
+    },
+    configurePreviewServer({ middlewares }) {
+      middlewares.use('/api/inaturalist', handler);
+    },
+  };
+}

server/providers/inaturalist/observations.test.mjs

@@ -0,0 +1,893 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, readdir, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { installInatProxy, NOW } from './proxy.fixture.mjs';
+import { createInatClient, inatRetryCooldownMs } from './client.js';
+
+const observation = (id = 1) => ({
+  id,
+  uri: `https://www.inaturalist.org/observations/${id}`,
+  geojson: { coordinates: [-122.351, 47.613] },
+  time_observed_at: '2026-11-04T17:00:00Z',
+  observed_on: '2026-11-04',
+  created_at: '2026-11-04T17:01:00Z',
+  quality_grade: 'research',
+  license_code: 'cc-by',
+  positional_accuracy: 12,
+  faves_count: 2,
+  num_identification_agreements: 3,
+  taxon: {
+    name: 'Calypte anna',
+    preferred_common_name: "Anna's hummingbird",
+    iconic_taxon_name: 'Aves',
+  },
+  photos: [
+    {
+      url: 'https://inaturalist-open-data.s3.amazonaws.com/photos/123/square.jpeg',
+      license_code: 'cc-by',
+      attribution: 'Synthetic photographer, CC BY',
+    },
+  ],
+  user: { login: 'must-never-leave-server' },
+});
+const envelope = (rows = [observation()], total = rows.length) => ({
+  total_results: total,
+  page: 1,
+  per_page: 200,
+  results: rows,
+});
+const boxUrl = (index = 0, extra = '') =>
+  `/observations?south=47.51&west=${-122.49 + index * 0.2}&north=47.69&east=${-122.31 + index * 0.2}${extra}`;
+
+function install(options = {}, hook = 'configureServer') {
+  return installInatProxy(
+    boxUrl(),
+    {
+      // Serial dispatch makes queued cancellation and coalescing observable.
+      queueOptions: { intervalMs: 0, windowMs: 0, maxInFlight: 1 },
+      ...options,
+    },
+    hook,
+  );
+}
+
+async function until(check) {
+  for (let i = 0; i < 100; i += 1) {
+    if (check()) return;
+    await new Promise(setImmediate);
+  }
+  assert.fail('expected fake upstream calls were not dispatched');
+}
+
+for (const hook of ['configureServer', 'configurePreviewServer']) {
+  test(`${hook}: actual v2 envelope, fixed query, projection and privacy`, async () => {
+    const calls = [];
+    const cache = new Map();
+    const request = install(
+      {
+        cache,
+        fetchImpl: async (url, options) => {
+          calls.push(new URL(url));
+          assert.equal(options.redirect, 'error');
+          assert.ok(options.signal instanceof AbortSignal);
+          assert.equal(options.headers.Accept, 'application/json');
+          assert.equal(
+            options.headers['User-Agent'],
+            'gods-eye-view-wildlife-sightings-proxy/1.0 (+https://github.com/bilawalsidhu/gods-eye-view)',
+          );
+          return Response.json(envelope());
+        },
+      },
+      hook,
+    );
+    assert.equal(calls.length, 0, 'construction and mounting do not acquire');
+    const result = await request(
+      boxUrl(0, '&url=https://attacker.example&per_page=999'),
+    );
+    assert.equal(result.status, 200);
+    assert.equal(result.headers['Cache-Control'], 'no-store');
+    assert.equal(result.body.rows[0].stableId, 'inat:1');
+    assert.equal(result.body.fetchedAt, NOW);
+    assert.equal(result.body.scope, 'view');
+    assert.deepEqual(result.body.box, {
+      south: 47.5,
+      west: -122.5,
+      north: 47.7,
+      east: -122.3,
+    });
+    const query = calls[0].searchParams;
+    assert.equal(
+      calls[0].origin + calls[0].pathname,
+      'https://api.inaturalist.org/v2/observations',
+    );
+    // Only the projected fields are requested, never user or identification data.
+    assert.match(query.get('fields'), /^\(id:!t,uri:!t,.*photos:\(url:!t/);
+    assert.doesNotMatch(query.get('fields'), /user|identifications/);
+    assert.equal(query.get('swlat'), '47.5');
+    assert.equal(query.get('swlng'), '-122.5');
+    assert.equal(query.get('nelat'), '47.7');
+    assert.equal(query.get('nelng'), '-122.3');
+    assert.equal(query.get('d1'), '2026-11-02');
+    assert.equal(query.has('created_d1'), false);
+    assert.equal(query.get('per_page'), '200');
+    assert.equal(query.get('verifiable'), 'true');
+    assert.equal(query.get('photos'), 'true');
+    assert.equal(query.get('captive'), 'false');
+    assert.equal(query.get('order_by'), 'random');
+    assert.equal(query.has('order'), false);
+    assert.doesNotMatch(
+      JSON.stringify(result.body),
+      /must-never-leave-server|"user"/,
+    );
+    assert.doesNotMatch(
+      JSON.stringify([...cache.values()]),
+      /must-never-leave-server|"user"/,
+    );
+  });
+}
+
+test('gate, method, route and query validation run before quota, cache or upstream', async () => {
+  const cache = new Map();
+  let calls = 0;
+  const request = install({
+    cache,
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  for (let i = 0; i < 32; i += 1) {
+    const response = await request('/observations?scope=global', {
+      headers: {
+        host: 'localhost:5173',
+        origin: 'https://foreign.example',
+        'sec-fetch-site': 'cross-site',
+      },
+    });
+    assert.equal(response.status, 403);
+  }
+  const method = await request('/observations', { method: 'POST' });
+  assert.equal(method.status, 405);
+  assert.equal(method.headers.Allow, 'GET');
+  for (const route of ['/', '/unknown', '/observations/extra', '//[invalid'])
+    assert.equal((await request(route)).body.error, 'unknown_route');
+  assert.equal(
+    (await request('/observations?scope=planet')).body.error,
+    'invalid_scope',
+  );
+  for (const query of [
+    '',
+    'south=NaN&west=0&north=1&east=1',
+    'south=&west=0&north=1&east=1',
+    'south=0&west=0&north=0&east=1',
+    'south=0&west=1&north=1&east=0',
+    'south=-91&west=0&north=1&east=1',
+    'south=0&west=-181&north=1&east=1',
+    'south=0&west=0&north=41&east=1',
+    'south=0&west=0&north=1&east=41',
+  ]) {
+    const result = await request(`/observations?${query}`);
+    assert.equal(result.status, 400, query);
+    assert.equal(result.body.error, 'invalid_bbox', query);
+  }
+  assert.equal(cache.size, 0);
+  assert.equal(calls, 0);
+  const allowed = await request('/observations?scope=global', {
+    headers: {
+      host: 'gev.example',
+      origin: 'https://gev.example',
+      'sec-fetch-site': 'same-origin',
+      'x-forwarded-proto': 'https',
+      'x-forwarded-for': '203.0.113.9',
+    },
+  });
+  assert.equal(allowed.status, 200);
+});
+
+test('cached requests never exhaust a local request admission limiter', async () => {
+  let calls = 0;
+  const request = install({
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  for (let i = 0; i < 30; i += 1) assert.equal((await request()).status, 200);
+  const cached = await request();
+  assert.equal(cached.status, 200);
+  assert.equal(cached.headers['Retry-After'], undefined);
+  assert.equal(calls, 1);
+});
+
+test('proxy rejects oversized snapped spans before acquisition and preserves canonical client boxes', async () => {
+  const urls = [];
+  const request = install({
+    fetchImpl: async (url) => {
+      urls.push(new URL(url));
+      return Response.json(envelope());
+    },
+  });
+  for (const query of [
+    'south=10.2&west=0&north=50.1&east=1',
+    'south=0&west=10.2&north=1&east=50.1',
+  ]) {
+    const result = await request(`/observations?${query}`);
+    assert.equal(result.status, 400);
+    assert.equal(result.body.error, 'invalid_bbox');
+  }
+  assert.equal(urls.length, 0);
+  const canonical =
+    '/observations?south=47.4&west=-122.3&north=47.6&east=-122.1';
+  const first = await request(canonical);
+  assert.equal(first.status, 200);
+  assert.deepEqual(first.body.box, {
+    south: 47.4,
+    west: -122.3,
+    north: 47.6,
+    east: -122.1,
+  });
+  assert.equal(urls[0].searchParams.get('swlat'), '47.4');
+  assert.equal(urls[0].searchParams.get('swlng'), '-122.3');
+  const second = await request(canonical);
+  assert.deepEqual(second.body, first.body);
+  assert.equal(urls.length, 1, 'canonical boxes share their cache key');
+});
+
+test('view snapping, whales, research and global queries obey the requested policy', async () => {
+  const urls = [];
+  const request = install({
+    fetchImpl: async (url) => {
+      urls.push(new URL(url));
+      return Response.json(envelope());
+    },
+  });
+  await request(
+    '/observations?south=40.2&west=-123.7&north=46.1&east=-121.4&quality=research&taxa=Aves',
+  );
+  assert.equal(urls[0].searchParams.get('swlat'), '40');
+  assert.equal(urls[0].searchParams.get('nelat'), '47');
+  assert.equal(urls[0].searchParams.get('per_page'), '200');
+  assert.equal(urls[0].searchParams.get('quality_grade'), 'research');
+  assert.equal(urls[0].searchParams.get('iconic_taxa'), 'Aves');
+  await request(boxUrl(0, '&taxa=whales'));
+  const whales = urls[1].searchParams;
+  assert.equal(whales.get('taxon_id'), '152871');
+  assert.equal(whales.get('d1'), '2026-10-28');
+  assert.equal(whales.has('created_d1'), false);
+  assert.equal(whales.has('photos'), false);
+  assert.equal(whales.has('iconic_taxa'), false);
+  await request('/observations?scope=global&quality=typo&taxa=typo&south=bad');
+  const global = urls[2].searchParams;
+  for (const field of [
+    'swlat',
+    'swlng',
+    'nelat',
+    'nelng',
+    'quality_grade',
+    'iconic_taxa',
+  ])
+    assert.equal(global.has(field), false, field);
+  assert.equal(global.get('per_page'), '200');
+  assert.equal(global.get('d1'), '2026-11-02');
+  assert.equal(global.has('created_d1'), false);
+  assert.equal(global.get('order_by'), 'observed_on');
+  assert.equal(global.get('order'), 'desc');
+  await request('/observations?scope=global&taxa=whales');
+  const globalWhales = urls[3].searchParams;
+  assert.equal(globalWhales.get('d1'), '2026-10-28');
+  assert.equal(globalWhales.has('created_d1'), false);
+  assert.equal(globalWhales.get('order_by'), 'observed_on');
+  assert.equal(globalWhales.get('order'), 'desc');
+});
+
+test('fresh cache hits and global ten-minute TTL spend no upstream quota', async () => {
+  let at = NOW;
+  let calls = 0;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  const first = await request();
+  at += 299_999;
+  assert.deepEqual((await request()).body, first.body);
+  at += 1;
+  await request();
+  assert.equal(calls, 2);
+  await request('/observations?scope=global');
+  at += 599_999;
+  await request('/observations?scope=global');
+  assert.equal(calls, 3);
+  at += 1;
+  await request('/observations?scope=global');
+  assert.equal(calls, 4);
+});
+
+test('the same snapped view and window hour returns one cached random sample until expiry', async () => {
+  let at = NOW;
+  let draws = 0;
+  const cache = new Map();
+  const request = install({
+    cache,
+    now: () => at,
+    fetchImpl: async (url) => {
+      const query = new URL(url).searchParams;
+      assert.equal(query.get('order_by'), 'random');
+      assert.equal(query.get('per_page'), '200');
+      return Response.json(envelope([observation(++draws)]));
+    },
+  });
+  const first = await request();
+  for (const elapsed of [1, 1000, 60_000, 299_999]) {
+    at = NOW + elapsed;
+    const next = await request();
+    assert.deepEqual(next.body, first.body);
+  }
+  assert.equal(draws, 1);
+  assert.match(cache.keys().next().value, /2026-11-02T18:00:00Z$/);
+  at = NOW + 300_000;
+  const refresh = await request();
+  assert.equal(refresh.body.rows[0].stableId, 'inat:2');
+  assert.equal(draws, 2);
+});
+
+test('disconnected queued views are dropped while a remaining coalesced consumer keeps its request', async () => {
+  const calls = [];
+  const releases = [];
+  const cache = new Map();
+  const request = install({
+    cache,
+    fetchImpl: (url, { signal }) => {
+      calls.push({ url: new URL(url), signal });
+      return new Promise((resolve) => releases.push(resolve));
+    },
+  });
+  const first = request(boxUrl(0));
+  await until(() => releases.length === 1);
+  const superseded = new AbortController();
+  const oldView = request(boxUrl(1), { signal: superseded.signal });
+  const oneConsumer = new AbortController();
+  const one = request(boxUrl(2), { signal: oneConsumer.signal });
+  const other = request(boxUrl(2));
+  superseded.abort();
+  oneConsumer.abort();
+  await Promise.all([oldView, one]);
+  // Rejoining the abandoned key creates a healthy generation; the old
+  // coalescing promise must not later delete or cancel this replacement.
+  const replacement = request(boxUrl(1));
+  releases[0](Response.json(envelope()));
+  await until(() => releases.length === 2);
+  assert.equal(calls[1].url.searchParams.get('swlng'), '-122.1');
+  assert.equal(calls[1].signal.aborted, false);
+  releases[1](Response.json(envelope([observation(2)])));
+  await until(() => releases.length === 3);
+  assert.equal(calls[2].url.searchParams.get('swlng'), '-122.3');
+  releases[2](Response.json(envelope([observation(3)])));
+  const results = await Promise.all([first, other, replacement]);
+  assert.ok(results.every((result) => result.status === 200));
+  assert.equal(
+    calls.length,
+    3,
+    'the abandoned queued generation never dispatched',
+  );
+  assert.equal(cache.size, 3);
+  assert.equal(results[1].body.rows[0].stableId, 'inat:2');
+  assert.equal(results[2].body.rows[0].stableId, 'inat:3');
+});
+
+test('observation windows reject old sightings uploaded today and keep recent observations', async () => {
+  for (const [taxa, recentTime, expectedD1] of [
+    ['all', '2026-11-04T17:00:00Z', '2026-11-02'],
+    ['whales', '2026-10-30T17:00:00Z', '2026-10-28'],
+  ]) {
+    let upstreamQuery;
+    const request = install({
+      fetchImpl: async (url) => {
+        upstreamQuery = new URL(url).searchParams;
+        return Response.json(
+          envelope([
+            {
+              ...observation(80),
+              time_observed_at: '2010-06-01T12:00:00Z',
+              observed_on: '2010-06-01',
+            },
+            {
+              ...observation(81),
+              time_observed_at: recentTime,
+              observed_on: recentTime.slice(0, 10),
+            },
+          ]),
+        );
+      },
+    });
+    const result = await request(boxUrl(0, `&taxa=${taxa}`));
+    assert.equal(result.status, 200, taxa);
+    assert.equal(upstreamQuery.get('d1'), expectedD1);
+    assert.equal(upstreamQuery.has('created_d1'), false);
+    assert.equal(upstreamQuery.get('order_by'), 'random');
+    assert.deepEqual(
+      result.body.rows.map((row) => row.stableId),
+      ['inat:81'],
+    );
+  }
+});
+
+test('same-key requests single-flight and a seventeenth distinct in-flight key queues', async () => {
+  const releases = [];
+  const request = install({
+    fetchImpl: () => new Promise((resolve) => releases.push(resolve)),
+  });
+  const a = request();
+  const b = request();
+  await until(() => releases.length === 1);
+  releases.shift()(Response.json(envelope()));
+  assert.deepEqual((await a).body, (await b).body);
+  const pending = Array.from({ length: 16 }, (_, i) => request(boxUrl(i + 1)));
+  await until(() => releases.length === 1);
+  pending.push(request(boxUrl(18)));
+  for (let i = 0; i < 17; i += 1) {
+    await until(() => releases.length > i);
+    releases[i](Response.json(envelope()));
+  }
+  assert.ok((await Promise.all(pending)).every(({ status }) => status === 200));
+});
+
+test('a fresh global sample survives the hourly observation-window rollover without another fetch', async () => {
+  let at = Date.parse('2026-11-04T18:59:00Z');
+  let calls = 0;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  const first = await request('/observations?scope=global');
+  at += 60_000;
+  const nextHour = await request('/observations?scope=global');
+  assert.deepEqual(nextHour.body, first.body);
+  assert.equal(nextHour.body.stale, undefined);
+  assert.equal(calls, 1);
+  at += 9 * 60_000;
+  await request('/observations?scope=global');
+  assert.equal(calls, 2);
+});
+
+test('pending global refresh coalesces across the hourly observation-window rollover with a busy queue', async () => {
+  let at = Date.parse('2026-11-04T18:59:59Z');
+  const releases = [];
+  const cache = new Map();
+  const request = install({
+    cache,
+    now: () => at,
+    fetchImpl: (url) =>
+      new Promise((resolve) =>
+        releases.push({
+          resolve,
+          url: new URL(url),
+        }),
+      ),
+  });
+  const first = request(
+    '/observations?scope=global&quality=research&taxa=Aves',
+  );
+  const views = Array.from({ length: 15 }, (_, i) => request(boxUrl(i)));
+  await until(() => releases.length === 1);
+  assert.equal(releases[0].url.searchParams.get('d1'), '2026-11-02');
+  at = Date.parse('2026-11-04T19:00:01Z');
+  const nextHour = request(
+    '/observations?scope=global&quality=research&taxa=Aves',
+  );
+  await new Promise(setImmediate);
+  assert.equal(
+    releases.length,
+    1,
+    'the same global query joins the pending refresh',
+  );
+  const distinct = request(
+    '/observations?scope=global&quality=research&taxa=Mammalia',
+  );
+  for (let i = 0; i < 17; i += 1) {
+    await until(() => releases.length > i);
+    releases[i].resolve(Response.json(envelope()));
+  }
+  const [original, joined] = await Promise.all([first, nextHour]);
+  assert.equal(original.status, 200);
+  assert.equal((await distinct).status, 200);
+  assert.deepEqual(joined.body, original.body);
+  assert.ok((await Promise.all(views)).every(({ status }) => status === 200));
+  const globalEntries = [...cache.entries()].filter(
+    ([, entry]) => entry.value.scope === 'global',
+  );
+  assert.equal(globalEntries.length, 2);
+  assert.match(globalEntries[0][0], /2026-11-02T18:00:00Z$/);
+  assert.equal(
+    (await request('/observations?scope=global&quality=research&taxa=Aves'))
+      .status,
+    200,
+  );
+  assert.equal(
+    releases.length,
+    17,
+    'the accepted global answer keeps its ten-minute freshness',
+  );
+});
+
+test('view refreshes retain distinct hourly keys while a previous-hour request is pending', async () => {
+  let at = Date.parse('2026-11-04T18:59:59Z');
+  const releases = [];
+  const request = install({
+    now: () => at,
+    fetchImpl: () => new Promise((resolve) => releases.push(resolve)),
+  });
+  const first = request();
+  await until(() => releases.length === 1);
+  at = Date.parse('2026-11-04T19:00:01Z');
+  const nextHour = request();
+  await new Promise(setImmediate);
+  assert.equal(
+    releases.length,
+    1,
+    'the next view queues behind the current call',
+  );
+  releases[0](Response.json(envelope()));
+  await until(() => releases.length === 2);
+  releases[1](Response.json(envelope()));
+  assert.ok(
+    (await Promise.all([first, nextHour])).every(
+      ({ status }) => status === 200,
+    ),
+  );
+});
+
+test('upstream minute ceiling waits for request 61 across client addresses', async () => {
+  let at = NOW;
+  let calls = 0;
+  const request = install({
+    now: () => at,
+    queueOptions: {
+      now: () => at,
+      intervalMs: 0,
+      wait: async (ms) => {
+        at += ms;
+      },
+    },
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  for (let i = 0; i < 60; i += 1)
+    assert.equal(
+      (await request(boxUrl(i), { peer: `10.0.0.${i}` })).status,
+      200,
+    );
+  const queued = await request(boxUrl(60), { peer: '10.0.1.1' });
+  assert.equal(queued.status, 200);
+  assert.equal(queued.headers['Retry-After'], undefined);
+  assert.equal(at, NOW + 60_000);
+  assert.equal(calls, 61);
+});
+
+test('views refresh after many prior requests without fabricating an upstream limit', async () => {
+  let at = NOW;
+  let calls = 0;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  });
+  const first = await request();
+  at += 300_001;
+  for (let i = 1; i <= 60; i += 1)
+    await request(boxUrl(i), { peer: `10.0.0.${i}` });
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, undefined);
+  assert.notEqual(stale.body.fetchedAt, first.body.fetchedAt);
+  assert.equal(calls, 62);
+});
+
+test('bounded samples preserve partial metadata, and well-formed empty views are valid', async () => {
+  let at = NOW;
+  let fail = false;
+  const request = install({
+    now: () => at,
+    fetchImpl: async () =>
+      fail
+        ? new Response('unavailable', { status: 503 })
+        : Response.json(envelope([observation()], 500)),
+  });
+  const first = await request();
+  assert.equal(first.body.partial, true);
+  assert.equal(first.body.rawRowCount, 500);
+  fail = true;
+  at += 59 * 60_000;
+  const stale = await request();
+  assert.equal(
+    stale.status,
+    200,
+    'hourly window changes still permit stale fallback',
+  );
+  assert.equal(stale.headers['X-Data-Stale'], 'true');
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, first.body.fetchedAt);
+  assert.equal(stale.body.partial, true);
+  at += 2 * 60_000;
+  const expired = await request();
+  assert.equal(expired.status, 502);
+  assert.equal(expired.body.error, 'inaturalist_unavailable');
+  const empty = install({
+    fetchImpl: async () => Response.json(envelope([], 0)),
+  });
+  const result = await empty();
+  assert.equal(result.status, 200);
+  assert.deepEqual(result.body.rows, []);
+});
+
+test('bad envelopes, JSON and capped bodies fail closed without inventing a cooldown', async () => {
+  for (const bad of [
+    () => Response.json({ total_results: 1, results: {} }),
+    () => Response.json({ total_results: 1, observations: [observation()] }),
+    () => Response.json({ total_results: '1', results: [observation()] }),
+    () => Response.json(envelope([], 1)),
+    () => Response.json(envelope([{ ...observation(), id: null }], 1)),
+    () => new Response('{malformed'),
+    () =>
+      new Response('{}', {
+        headers: { 'Content-Length': String(8 * 1024 * 1024 + 1) },
+      }),
+  ]) {
+    let at = NOW;
+    let calls = 0;
+    const request = install({
+      now: () => at,
+      fetchImpl: async () => {
+        calls += 1;
+        return calls === 1 ? bad() : Response.json(envelope());
+      },
+    });
+    const first = await request();
+    assert.equal(first.status, 502);
+    assert.equal(first.body.error, 'inaturalist_unavailable');
+    assert.equal(first.headers['Retry-After'], undefined);
+    assert.equal((await request(boxUrl(1))).status, 200);
+    assert.equal(calls, 2);
+  }
+});
+
+test('a wholly invalid iNat page cannot replace a previously valid snapshot', async () => {
+  let at = NOW;
+  let fail = false;
+  const cache = new Map();
+  const request = install({
+    cache,
+    now: () => at,
+    fetchImpl: async () =>
+      Response.json(
+        fail
+          ? envelope([{ ...observation(), quality_grade: 'casual' }])
+          : envelope(),
+      ),
+  });
+  const first = await request();
+  const original = cache.values().next().value;
+  fail = true;
+  at += 300_001;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, first.body.fetchedAt);
+  assert.equal(cache.values().next().value, original);
+});
+
+test('429 cooldown honors seconds, HTTP dates, and long upstream deadlines', async () => {
+  assert.equal(inatRetryCooldownMs(null, NOW), 60_000);
+  assert.equal(inatRetryCooldownMs('0', NOW), 0);
+  assert.equal(inatRetryCooldownMs('2', NOW), 2000);
+  assert.equal(inatRetryCooldownMs('999999', NOW), 999_999_000);
+  assert.equal(inatRetryCooldownMs('7200', NOW), 7_200_000);
+  assert.equal(
+    inatRetryCooldownMs(new Date(NOW + 7_200_000).toUTCString(), NOW),
+    7_200_000,
+  );
+  let at = NOW;
+  const releases = [];
+  const warnings = [];
+  const request = install({
+    now: () => at,
+    warn: (message) => warnings.push(message),
+    fetchImpl: () => new Promise((resolve) => releases.push(resolve)),
+  });
+  const first = request();
+  const later = request(boxUrl(1));
+  await until(() => releases.length === 1);
+  releases[0](
+    new Response('limit', {
+      status: 429,
+      headers: { 'Retry-After': '999999' },
+    }),
+  );
+  assert.equal((await first).headers['Retry-After'], '999999');
+  assert.equal((await later).headers['Retry-After'], '999999');
+  at += 1000;
+  assert.equal((await request(boxUrl(1))).headers['Retry-After'], '999998');
+  at += 5000;
+  const cooling = await request(boxUrl(2));
+  assert.equal(cooling.status, 429);
+  assert.equal(cooling.headers['Retry-After'], '999993');
+  assert.equal(
+    releases.length,
+    1,
+    'queued calls do not dispatch during cooldown',
+  );
+  assert.equal(
+    warnings.filter((message) => message.includes('capped')).length,
+    0,
+  );
+});
+
+for (const [upstreamStatus, expectedStatus, code, retryAfterS] of [
+  [429, 429, 'inaturalist_rate_limited', 120],
+  [503, 502, 'inaturalist_unavailable', 120],
+]) {
+  test(`concurrent reservations honor an immediate upstream ${upstreamStatus} before dispatch`, async () => {
+    let calls = 0;
+    const warnings = [];
+    const client = createInatClient({
+      now: () => 0,
+      cacheDir: null,
+      queueOptions: { intervalMs: 0 },
+      warn: (message) => warnings.push(message),
+      fetchImpl: async () => {
+        calls += 1;
+        return new Response('synthetic failure', {
+          status: upstreamStatus,
+          headers: { 'Retry-After': '120' },
+        });
+      },
+    });
+    const params = {
+      scope: 'global',
+      quality: 'all',
+      taxa: 'all',
+      observedD1: '1969-12-30',
+    };
+    const results = await Promise.allSettled(
+      Array.from({ length: 3 }, () => client.getObservations(params)),
+    );
+    assert.equal(
+      calls,
+      1,
+      'pending reservations must not dispatch during cooldown',
+    );
+    for (const result of results) {
+      assert.equal(result.status, 'rejected');
+      assert.equal(result.reason.status, expectedStatus);
+      assert.equal(result.reason.code, code);
+      assert.equal(result.reason.retryAfterS, retryAfterS);
+    }
+    assert.equal(
+      warnings.length,
+      1,
+      'only the dispatched refresh logs a failure',
+    );
+    await assert.rejects(client.getObservations(params), {
+      status: expectedStatus,
+      code,
+      retryAfterS,
+    });
+    assert.equal(calls, 1);
+  });
+}
+
+test('budget is read lazily, persisted as counters only, enforced across restart and UTC rollover', async (t) => {
+  const parent = await mkdtemp(path.join(os.tmpdir(), 'gev-inat-budget-'));
+  t.after(() => rm(parent, { recursive: true, force: true }));
+  const cacheDir = path.join(parent, 'not-created');
+  const before = process.env.INATURALIST_DAILY_BUDGET;
+  process.env.INATURALIST_DAILY_BUDGET = '2';
+  t.after(() =>
+    before === undefined
+      ? delete process.env.INATURALIST_DAILY_BUDGET
+      : (process.env.INATURALIST_DAILY_BUDGET = before),
+  );
+  let at = NOW;
+  let calls = 0;
+  const options = {
+    now: () => at,
+    cacheDir,
+    warn() {},
+    fetchImpl: async () => {
+      calls += 1;
+      return Response.json(envelope());
+    },
+  };
+  const client = createInatClient(options);
+  assert.deepEqual(
+    await readdir(parent),
+    [],
+    'construction performs no directory write',
+  );
+  const params = {
+    scope: 'global',
+    quality: 'all',
+    taxa: 'all',
+    observedD1: '2026-11-02',
+  };
+  await Promise.all([
+    client.getObservations(params),
+    client.getObservations(params),
+  ]);
+  assert.deepEqual(
+    JSON.parse(await readFile(path.join(cacheDir, 'budget.json'), 'utf8')),
+    { date: '2026-11-04', count: 2 },
+  );
+  assert.deepEqual(
+    await readdir(cacheDir),
+    ['budget.json'],
+    'atomic temporary files are retired',
+  );
+  const restarted = createInatClient(options);
+  await assert.rejects(restarted.getObservations(params), {
+    status: 503,
+    code: 'inaturalist_budget_exhausted',
+  });
+  assert.equal(calls, 2);
+  at = Date.parse('2026-11-05T00:00:00Z');
+  await restarted.getObservations(params);
+  assert.deepEqual(restarted.budgetState(), {
+    date: '2026-11-05',
+    count: 1,
+    budget: 2,
+  });
+  assert.deepEqual(
+    JSON.parse(await readFile(path.join(cacheDir, 'budget.json'), 'utf8')),
+    { date: '2026-11-05', count: 1 },
+  );
+  assert.equal(calls, 3);
+});
+
+test('memory cache is an LRU bounded to 400 projected entries', async () => {
+  let at = NOW;
+  const cache = new Map();
+  const request = install({
+    cache,
+    now: () => at,
+    fetchImpl: async () => Response.json(envelope()),
+  });
+  for (let i = 0; i < 400; i += 1) {
+    if (i && i % 20 === 0) at += 61_000;
+    await request(boxUrl(i), { peer: String(i) });
+  }
+  assert.equal(cache.size, 400);
+  const firstKey = cache.keys().next().value;
+  const secondKey = [...cache.keys()][1];
+  await request(boxUrl(0));
+  await request(boxUrl(400));
+  assert.equal(cache.size, 400);
+  assert.equal(cache.has(firstKey), true);
+  assert.equal(cache.has(secondKey), false);
+});
+
+test('aborted client calls spend no budget and never fetch', async () => {
+  const controller = new AbortController();
+  controller.abort();
+  const client = createInatClient({
+    now: () => NOW,
+    cacheDir: null,
+    queueOptions: { intervalMs: 0 },
+    fetchImpl: () => assert.fail('aborted call fetched'),
+  });
+  await assert.rejects(
+    client.getObservations({}, { signal: controller.signal }),
+    { name: 'AbortError' },
+  );
+  assert.equal(client.budgetState().count, 0);
+});

server/providers/inaturalist/proxy.fixture.mjs

@@ -0,0 +1,70 @@
+import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
+import { inaturalistProxy } from './observations.js';
+
+export const NOW = Date.parse('2026-11-04T18:05:00Z');
+
+/** Mount the proxy over synthetic HTTP objects, without opening a socket. */
+export function installInatProxy(
+  defaultUrl,
+  options = {},
+  hook = 'configureServer',
+) {
+  let handler;
+  const plugin = inaturalistProxy({
+    now: () => NOW,
+    cacheDir: null,
+    queueOptions: { intervalMs: 0, windowMs: 0 },
+    warn() {},
+    ...options,
+  });
+  assert.equal(plugin.name, 'inaturalist');
+  assert.equal(typeof plugin.configureServer, 'function');
+  assert.equal(typeof plugin.configurePreviewServer, 'function');
+  plugin[hook]({
+    middlewares: {
+      use(mount, callback) {
+        assert.equal(mount, '/api/inaturalist');
+        handler = callback;
+      },
+    },
+  });
+  return async (
+    url = defaultUrl,
+    { method = 'GET', peer = 'local', headers = {}, signal } = {},
+  ) => {
+    const res = Object.assign(new EventEmitter(), {
+      headers: {},
+      writeHead(status, headers) {
+        this.status = status;
+        Object.assign(this.headers, headers);
+      },
+      setHeader(key, value) {
+        this.headers[key] = value;
+      },
+      end(value) {
+        this.status ??= this.statusCode;
+        this.body = JSON.parse(value);
+      },
+    });
+    const abort = () => {
+      res.destroyed = true;
+      res.emit('close');
+    };
+    signal?.addEventListener('abort', abort, { once: true });
+    try {
+      await handler(
+        Object.assign(new EventEmitter(), {
+          url,
+          method,
+          headers,
+          socket: { remoteAddress: peer },
+        }),
+        res,
+      );
+    } finally {
+      signal?.removeEventListener('abort', abort);
+    }
+    return res;
+  };
+}

server/providers/inaturalist/queue.js

@@ -0,0 +1,109 @@
+import { setTimeout as delay } from 'node:timers/promises';
+
+// A four-request burst keeps a cold view responsive; thereafter every provider
+// call shares the same one-per-second token supply. The rolling minute ceiling
+// queues the few requests a token bucket alone could allow above 60/min.
+const INAT_INTERVAL_MS = 1000;
+const INAT_BURST = 4;
+const INAT_WINDOW_MS = 60_000;
+const INAT_MAX_PER_WINDOW = 60;
+const INAT_MAX_IN_FLIGHT = 4;
+
+/** Observation queries outrank tiles waiting for a token. Aborted consumers
+ * leave the queue before an attempt or daily-budget reservation is spent. */
+export function createInatQueue({
+  now = () => performance.now(),
+  wait = (ms) => delay(ms),
+  intervalMs = INAT_INTERVAL_MS,
+  burst = INAT_BURST,
+  windowMs = INAT_WINDOW_MS,
+  maxInFlight = INAT_MAX_IN_FLIGHT,
+} = {}) {
+  const pending = [];
+  const dispatchedAt = [];
+  let tokens = burst;
+  let refilledAt = null;
+  let running = false;
+  let inFlight = 0;
+  let slotFreed = null;
+
+  function refill() {
+    const at = now();
+    if (refilledAt !== null && intervalMs > 0)
+      tokens = Math.min(
+        burst,
+        tokens + Math.max(0, at - refilledAt) / intervalMs,
+      );
+    if (intervalMs <= 0) tokens = burst;
+    refilledAt = at;
+  }
+
+  function schedule() {
+    if (running) return;
+    running = true;
+    // A microtask also lets same-turn observation queries take priority.
+    void Promise.resolve().then(drain);
+  }
+
+  async function drain() {
+    try {
+      while (pending.length) {
+        if (inFlight >= maxInFlight) {
+          await new Promise((resolve) => (slotFreed = resolve));
+          continue;
+        }
+        refill();
+        const at = now();
+        while (dispatchedAt.length && dispatchedAt[0] <= at - windowMs)
+          dispatchedAt.shift();
+        const tokenWait = tokens < 1 ? (1 - tokens) * intervalMs : 0;
+        const windowWait =
+          windowMs > 0 && dispatchedAt.length >= INAT_MAX_PER_WINDOW
+            ? dispatchedAt[0] + windowMs - at
+            : 0;
+        if (tokenWait > 0 || windowWait > 0) {
+          await wait(Math.ceil(Math.max(tokenWait, windowWait)));
+          continue;
+        }
+        // Stable sorting preserves FIFO order within each priority.
+        pending.sort((a, b) => a.priority - b.priority);
+        const job = pending.shift();
+        job.signal?.removeEventListener('abort', job.abort);
+        if (job.signal?.aborted) {
+          job.reject(job.signal.reason);
+          continue;
+        }
+        tokens -= 1;
+        if (windowMs > 0) dispatchedAt.push(at);
+        inFlight += 1;
+        // A rejected task releases its slot without stopping the queue.
+        void new Promise((resolve) => resolve(job.task()))
+          .then(job.resolve, job.reject)
+          .finally(() => {
+            inFlight -= 1;
+            const wake = slotFreed;
+            slotFreed = null;
+            wake?.();
+          });
+      }
+    } finally {
+      running = false;
+    }
+  }
+
+  return function enqueue(task, { signal, priority = 1 } = {}) {
+    if (signal?.aborted) return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+      const job = { task, signal, priority, resolve, reject };
+      job.abort = () => {
+        const index = pending.indexOf(job);
+        if (index >= 0) pending.splice(index, 1);
+        signal.removeEventListener('abort', job.abort);
+        reject(signal.reason);
+      };
+      signal?.addEventListener('abort', job.abort, { once: true });
+      pending.push(job);
+      schedule();
+    });
+  };
+}

server/providers/inaturalist/queue.test.mjs

@@ -0,0 +1,111 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createInatQueue } from './queue.js';
+
+async function until(check) {
+  for (let i = 0; i < 100; i += 1) {
+    if (check()) return;
+    await new Promise(setImmediate);
+  }
+  assert.fail('queue did not reach its expected state');
+}
+
+test('shared governor paces a four-call burst within the rolling minute ceiling', async () => {
+  let at = 0;
+  const waits = [];
+  const queue = createInatQueue({
+    now: () => at,
+    wait: async (ms) => {
+      waits.push(ms);
+      at += ms;
+    },
+  });
+  const dispatched = [];
+  await Promise.all(
+    Array.from({ length: 65 }, () => queue(() => dispatched.push(at))),
+  );
+  assert.equal(dispatched.length, 65);
+  assert.deepEqual(dispatched.slice(0, 7), [0, 0, 0, 0, 1000, 2000, 3000]);
+  assert.deepEqual(waits.slice(0, 3), [1000, 1000, 1000]);
+  for (const time of dispatched)
+    assert.ok(
+      dispatched.filter((other) => other > time - 60_000 && other <= time)
+        .length <= 60,
+    );
+  assert.equal(dispatched[60], 60_000);
+});
+
+test('an observation arriving during the pacing wait overtakes queued tiles', async () => {
+  let at = 0;
+  const waits = [];
+  const queue = createInatQueue({
+    burst: 1,
+    now: () => at,
+    wait: (ms) => new Promise((resolve) => waits.push({ ms, resolve })),
+  });
+  const dispatched = [];
+  await queue(() => dispatched.push('first tile'));
+  const tile = queue(() => dispatched.push('waiting tile'));
+  await until(() => waits.length === 1);
+  const observation = queue(() => dispatched.push('observation'), {
+    priority: 0,
+  });
+  at += waits[0].ms;
+  waits[0].resolve();
+  await observation;
+  assert.deepEqual(dispatched, ['first tile', 'observation']);
+  await until(() => waits.length === 2);
+  at += waits[1].ms;
+  waits[1].resolve();
+  await tile;
+  assert.deepEqual(dispatched, ['first tile', 'observation', 'waiting tile']);
+});
+
+test('superseded tasks leave before dispatch, and a rejection cannot poison the tail', async () => {
+  const queue = createInatQueue({ intervalMs: 0 });
+  const dispatched = [];
+  let release;
+  const first = queue(
+    () =>
+      new Promise((resolve) => {
+        release = resolve;
+      }),
+  );
+  await until(() => release);
+  const controller = new AbortController();
+  const superseded = queue(() => assert.fail('superseded tile dispatched'), {
+    signal: controller.signal,
+  });
+  const dropped = assert.rejects(superseded, { name: 'AbortError' });
+  controller.abort();
+  await dropped;
+  const failed = queue(() => {
+    dispatched.push('failed');
+    throw new Error('synthetic');
+  });
+  const failure = assert.rejects(failed, /synthetic/);
+  const succeeding = queue(() => dispatched.push('recovered'));
+  release();
+  await Promise.all([first, failure, succeeding]);
+  assert.deepEqual(dispatched, ['failed', 'recovered']);
+});
+
+test('a slow call does not hold later calls; at most four run at once', async () => {
+  const queue = createInatQueue({ intervalMs: 0, windowMs: 0 });
+  const releases = [];
+  const started = [];
+  const slow = (id) => () =>
+    new Promise((resolve) => {
+      started.push(id);
+      releases.push(() => resolve(id));
+    });
+  const jobs = [1, 2, 3, 4, 5].map((id) => queue(slow(id)));
+  await until(() => started.length === 4);
+  assert.deepEqual(started, [1, 2, 3, 4], 'four start without waiting');
+  releases[1]();
+  assert.equal(await jobs[1], 2, 'a later call finishes before the first');
+  await until(() => started.length === 5);
+  assert.deepEqual(started, [1, 2, 3, 4, 5], 'a freed slot starts the next');
+  for (const release of releases) release();
+  assert.deepEqual(await Promise.all(jobs), [1, 2, 3, 4, 5]);
+});

server/providers/inaturalist/speed.test.mjs

@@ -0,0 +1,218 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createInatClient } from './client.js';
+import { installInatProxy, NOW } from './proxy.fixture.mjs';
+import { syntheticGrid } from './grid.fixture.mjs';
+import { INAT_GRID_DECODE_MEASURE } from './grid.js';
+
+const gridUrl = '/grid?z=2&x=1&y=1&taxa=Aves';
+const params = {
+  scope: 'global',
+  taxa: 'all',
+  observedD1: '2026-11-02',
+};
+const tick = () => new Promise(setImmediate);
+
+const install = (options, hook) => installInatProxy(gridUrl, options, hook);
+
+test('tile cache lasts fifteen minutes, then returns stale before revalidation finishes', async () => {
+  let at = NOW;
+  let calls = 0;
+  let release;
+  const request = install({
+    now: () => at,
+    fetchImpl: () => {
+      calls += 1;
+      return calls === 1
+        ? Response.json(syntheticGrid())
+        : new Promise((resolve) => {
+            release = resolve;
+          });
+    },
+  });
+  const first = await request();
+  at += 899_999;
+  const freshPromise = request();
+  await tick();
+  assert.equal(calls, 1, 'a fresh tile never spends another upstream attempt');
+  assert.deepEqual((await freshPromise).body, first.body);
+  at += 1;
+  const stalePromise = request();
+  let resolved = false;
+  void stalePromise.then(() => {
+    resolved = true;
+  });
+  await tick();
+  try {
+    assert.equal(
+      resolved,
+      true,
+      'stale cells publish while refresh is pending',
+    );
+    const stale = await stalePromise;
+    assert.equal(stale.body.stale, true);
+    assert.equal(stale.body.fetchedAt, NOW);
+    assert.deepEqual(stale.body.cells, first.body.cells);
+    await request();
+    assert.equal(calls, 2, 'all stale consumers share one background refresh');
+    const refreshPromise = request(`${gridUrl}&refresh=wait`);
+    let refreshed = false;
+    void refreshPromise.then(() => {
+      refreshed = true;
+    });
+    await tick();
+    assert.equal(
+      refreshed,
+      false,
+      'a background consumer can await the same refresh',
+    );
+    release(Response.json(syntheticGrid()));
+    const fresh = await refreshPromise;
+    assert.equal(fresh.body.stale, undefined);
+    assert.equal(fresh.body.fetchedAt, at);
+    assert.equal(
+      calls,
+      2,
+      'waiting for fresh cells never duplicates upstream work',
+    );
+    release = null;
+  } finally {
+    release?.(Response.json(syntheticGrid()));
+  }
+});
+
+test('more than sixteen queued views and thirty local requests never report local rate limiting', async () => {
+  let release;
+  let calls = 0;
+  const request = install({
+    fetchImpl: async () => {
+      calls += 1;
+      if (calls === 1)
+        await new Promise((resolve) => {
+          release = resolve;
+        });
+      return Response.json(syntheticGrid());
+    },
+  });
+  const pending = Array.from({ length: 40 }, (_, x) =>
+    request(`/grid?z=6&x=${x}&y=1`),
+  );
+  await tick();
+  release();
+  const results = await Promise.all(pending);
+  assert.ok(results.every((result) => result.status === 200));
+  assert.equal(calls, 40);
+});
+
+test('only real upstream 429 or 5xx failures start cooldown', async () => {
+  for (const bad of [
+    () => Promise.reject(new Error('network')),
+    () => Response.json({ malformed: true }),
+    () => new Response('', { status: 404 }),
+  ]) {
+    let calls = 0;
+    const client = createInatClient({
+      now: () => NOW,
+      cacheDir: null,
+      queueOptions: { intervalMs: 0, windowMs: 0 },
+      warn() {},
+      fetchImpl: () => {
+        calls += 1;
+        return calls === 1
+          ? bad()
+          : Response.json({ results: [], total_results: 0 });
+      },
+    });
+    await assert.rejects(client.getObservations(params), { status: 502 });
+    await client.getObservations(params);
+    assert.equal(
+      calls,
+      2,
+      'a non-cooldown failure must not hold the next attempt',
+    );
+  }
+});
+
+test('actual upstream cooldown is marked separately from a local budget stop', async () => {
+  for (const upstream of [429, 503]) {
+    let calls = 0;
+    const request = install({
+      fetchImpl: () => {
+        calls += 1;
+        return new Response('', {
+          status: upstream,
+          headers: { 'Retry-After': '120' },
+        });
+      },
+    });
+    const first = await request();
+    assert.equal(first.headers['X-Upstream-Status'], String(upstream));
+    assert.equal(first.headers['Retry-After'], '120');
+    await request();
+    assert.equal(calls, 1);
+  }
+});
+
+test('upstream Retry-After zero survives the HTTP response and permits an immediate next request', async () => {
+  for (const upstream of [429, 503]) {
+    let calls = 0;
+    const request = install({
+      fetchImpl: () => {
+        calls += 1;
+        return calls === 1
+          ? new Response('', {
+              status: upstream,
+              headers: { 'Retry-After': '0' },
+            })
+          : Response.json(syntheticGrid());
+      },
+    });
+    const first = await request();
+    assert.equal(first.headers['X-Upstream-Status'], String(upstream));
+    assert.equal(first.headers['Retry-After'], '0');
+    assert.equal((await request()).status, 200);
+    assert.equal(calls, 2);
+  }
+});
+
+test('a local daily budget stop has a distinct code and no upstream cooldown marker', async (t) => {
+  const before = process.env.INATURALIST_DAILY_BUDGET;
+  process.env.INATURALIST_DAILY_BUDGET = '1';
+  t.after(() => {
+    if (before === undefined) delete process.env.INATURALIST_DAILY_BUDGET;
+    else process.env.INATURALIST_DAILY_BUDGET = before;
+  });
+  let calls = 0;
+  const request = install({
+    fetchImpl: () => {
+      calls += 1;
+      return Response.json(syntheticGrid());
+    },
+  });
+  assert.equal((await request()).status, 200);
+  const stopped = await request('/grid?z=2&x=0&y=1');
+  assert.equal(stopped.status, 503);
+  assert.equal(stopped.body.error, 'inaturalist_budget_exhausted');
+  assert.equal(stopped.headers['X-Upstream-Status'], undefined);
+  assert.equal((await request()).status, 200, 'cached data remains available');
+  assert.equal(calls, 1);
+});
+
+test('cached tiles avoid UTFGrid decode and decode timing entries stay bounded', async () => {
+  const request = install({
+    fetchImpl: () => Response.json(syntheticGrid()),
+  });
+  await request();
+  const sample = performance.getEntriesByName(INAT_GRID_DECODE_MEASURE)[0];
+  assert.ok(sample.duration >= 0);
+  for (let i = 0; i < 10; i += 1) await request();
+  assert.equal(
+    performance.getEntriesByName(INAT_GRID_DECODE_MEASURE)[0],
+    sample,
+  );
+  for (let x = 0; x < 4; x += 1) await request(`/grid?z=3&x=${x}&y=1`);
+  assert.equal(
+    performance.getEntriesByName(INAT_GRID_DECODE_MEASURE).length,
+    1,
+  );
+});

server/providers/local.js

@@ -29,6 +29,8 @@ import { firePerimetersProxy } from './firePerimeters.js';
 import { gnssIntegrityProxy } from './gnssIntegrity.js';
 import { ghostMapsProxy } from './ghostMaps.js';
 import { droneAirspaceProxy } from './droneAirspace.js';
+import { inaturalistProxy } from './inaturalist/observations.js';
+import { acartiaProxy } from './acartia.js';
 import { cycloneProxy } from './cyclones.js';
 import { windProxy } from './wind.js';
 
@@ -81,6 +83,8 @@ function localProviderPlugins({
     gnssIntegrityProxy(),
     ghostMapsProxy(),
     droneAirspaceProxy(),
+    inaturalistProxy(),
+    acartiaProxy(),
     keySetupEndpoint(),
   ];
 }

server/providers/openai/toolDescriptions.js

@@ -135,7 +135,7 @@ export const ACTION_DESCRIPTIONS = {
   },
   control_cockpit: {
     description:
-      'Explicit Cockpit requests only: enter from a selected/tracked aircraft (establishes Contacts itself; no set_context_mode), exit, status, or next/previous. Explicit exit-and-show voice: voicePanel preview/settings (Voice Settings), no confirmation.',
+      'Explicit Cockpit requests only: enter from a selected/tracked aircraft (needs only its own Flights/Military layer on, not Contacts; opens Contacts itself, no set_context_mode), exit, status, or next/previous. Explicit exit-and-show voice: voicePanel preview/settings (Voice Settings), no confirmation.',
     $position: 1,
     parameters: {
       properties: {
@@ -523,7 +523,7 @@ export const ACTION_DESCRIPTIONS = {
       properties: {
         direction: {
           description:
-            'Required for pan/tilt/rotate; orbit/rotate_globe default right.',
+            'Pan/rotate/tilt steps; orbit/rotate_globe default right.',
           $position: 2,
         },
         mode: {
@@ -531,6 +531,10 @@ export const ACTION_DESCRIPTIONS = {
             'once = bounded eased nudge; continuous = until stop/manual input. rotate_globe defaults continuous; other motions default once.',
           $position: 2,
         },
+        pitchDeg: {
+          description: 'Absolute; -45 default, -89 top-down.',
+          $position: 1,
+        },
       },
     },
   },

src/app/application.test.mjs

@@ -2,7 +2,20 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { createApplication } from './application.js';
-import { installTrackpadPinchZoom } from './viewer.js';
+import { KEYHOLE_OUTER_RADIUS } from '../celestialRing.js';
+import * as Cesium from 'cesium';
+import {
+  installFreeLookHeightLimit,
+  installGlobeInViewRecovery,
+  installTrackpadPinchZoom,
+} from './viewer.js';
+import {
+  FREE_LOOK_MAX_HEIGHT_METERS,
+  globeFrameShare,
+  globeOutOfFrame,
+  lookAngleWithinFrame,
+  lookStepLosesGlobe,
+} from '../globeInView.js';
 
 const phases = ['Scene', 'Controls', 'Data', 'Tools'];
 function fixture(overrides = {}) {
@@ -343,3 +356,652 @@ test('trackpad pinch falls back to the original event when relay construction fa
   assert.equal(event.propagationStopped, false);
   assert.equal(f.relayed.length, 0);
 });
+
+function freeLookFixture({ enableLook = true, height = 0 } = {}) {
+  const listeners = new Set();
+  const controller = { enableLook, minimumTrackBallHeight: 7_500_000 };
+  const camera = { positionCartographic: { height } };
+  const viewer = {
+    camera,
+    scene: {
+      screenSpaceCameraController: controller,
+      preUpdate: {
+        addEventListener(listener) {
+          listeners.add(listener);
+          return () => listeners.delete(listener);
+        },
+      },
+    },
+  };
+  const frame = (nextHeight) => {
+    camera.positionCartographic = { height: nextHeight };
+    for (const listener of listeners) listener();
+  };
+  return { viewer, controller, listeners, frame };
+}
+
+test('free look follows camera height and is restored on dispose', () => {
+  const f = freeLookFixture({ height: 500 });
+  const dispose = installFreeLookHeightLimit(f.viewer);
+  assert.equal(f.controller.enableLook, true);
+
+  f.frame(FREE_LOOK_MAX_HEIGHT_METERS + 1);
+  assert.equal(f.controller.enableLook, false);
+  f.frame(FREE_LOOK_MAX_HEIGHT_METERS);
+  assert.equal(f.controller.enableLook, true);
+  f.frame(Number.NaN);
+  assert.equal(f.controller.enableLook, true);
+
+  f.frame(FREE_LOOK_MAX_HEIGHT_METERS * 20);
+  dispose();
+  dispose();
+  assert.equal(f.controller.enableLook, true);
+  assert.equal(f.listeners.size, 0);
+});
+
+test('drags that start on the stars orbit above the free-look height', () => {
+  // Below Cesium's trackball height such a drag turns the camera in place.
+  const f = freeLookFixture({ height: 500 });
+  const dispose = installFreeLookHeightLimit(f.viewer);
+  assert.equal(
+    f.controller.minimumTrackBallHeight,
+    FREE_LOOK_MAX_HEIGHT_METERS,
+  );
+  dispose();
+  assert.equal(f.controller.minimumTrackBallHeight, 7_500_000);
+
+  const lower = freeLookFixture({ height: 500 });
+  lower.controller.minimumTrackBallHeight = 500_000;
+  const disposeLower = installFreeLookHeightLimit(lower.viewer);
+  assert.equal(
+    lower.controller.minimumTrackBallHeight,
+    500_000,
+    'never raised',
+  );
+  disposeLower();
+  assert.equal(lower.controller.minimumTrackBallHeight, 500_000);
+
+  const later = freeLookFixture({ height: 500 });
+  const disposeLater = installFreeLookHeightLimit(later.viewer);
+  later.controller.minimumTrackBallHeight = 2_000_000;
+  disposeLater();
+  assert.equal(
+    later.controller.minimumTrackBallHeight,
+    2_000_000,
+    'dispose keeps a value set after install',
+  );
+});
+
+test('free look keeps a setting other code makes after it is installed', () => {
+  const f = freeLookFixture({ height: 500 });
+  const dispose = installFreeLookHeightLimit(f.viewer);
+  f.controller.enableLook = false;
+  f.frame(10);
+  assert.equal(f.controller.enableLook, false, 'turned off stays off');
+  f.frame(FREE_LOOK_MAX_HEIGHT_METERS * 20);
+  f.frame(10);
+  assert.equal(f.controller.enableLook, false, 'and stays off after orbit');
+  f.controller.enableLook = true;
+  f.frame(10);
+  assert.equal(f.controller.enableLook, true, 'turned back on');
+  f.frame(FREE_LOOK_MAX_HEIGHT_METERS * 20);
+  assert.equal(f.controller.enableLook, false, 'still limited from orbit');
+  f.frame(10);
+  f.controller.enableLook = false;
+  dispose();
+  assert.equal(f.controller.enableLook, false, 'dispose keeps a later setting');
+});
+
+test('free look stays off when the viewer had it disabled', () => {
+  const f = freeLookFixture({ enableLook: false, height: 500 });
+  installFreeLookHeightLimit(f.viewer);
+  f.frame(10);
+  assert.equal(f.controller.enableLook, false);
+});
+
+// A real Cesium camera on the smallest scene its constructor reads, so the
+// frustum test runs on Cesium's own view math rather than a stub.
+function realCamera({ width = 1600, height = 900, mode } = {}) {
+  const scene = {
+    canvas: { clientWidth: width, clientHeight: height },
+    drawingBufferWidth: width,
+    drawingBufferHeight: height,
+    mapProjection: new Cesium.GeographicProjection(),
+    mode: mode ?? Cesium.SceneMode.SCENE3D,
+    pixelRatio: 1,
+    ellipsoid: Cesium.Ellipsoid.WGS84,
+    mapMode2D: Cesium.MapMode2D.INFINITE_SCROLL,
+    tweens: new Cesium.TweenCollection(),
+    renders: 0,
+    requestRender() {
+      this.renders += 1;
+    },
+  };
+  const camera = new Cesium.Camera(scene);
+  camera.frustum.aspectRatio = width / height;
+  return { camera, scene, viewer: { camera, scene } };
+}
+
+function aim(
+  camera,
+  { lon = -94.69, lat = 18.87, alt, heading = 0, pitch, roll = 0 },
+) {
+  camera.setView({
+    destination: Cesium.Cartesian3.fromDegrees(lon, lat, alt),
+    orientation: {
+      heading: Cesium.Math.toRadians(heading),
+      pitch: Cesium.Math.toRadians(pitch),
+      roll: Cesium.Math.toRadians(roll),
+    },
+  });
+}
+
+const reportedStuckView = {
+  alt: 17_996_811,
+  heading: 180,
+  pitch: -42,
+  roll: 180,
+};
+// Oblique poses that still show part of the planet: Director recipe shots
+// (Global Flights Radar, Omniscience Pullback) and a voice tilt from orbit.
+const partialGlobeViews = [
+  { lon: -30, lat: 20, alt: 19_000_000, pitch: -65 },
+  { lon: 2, lat: 46, alt: 8_000_000, pitch: -52 },
+  { lon: 110, lat: 20, alt: 9_500_000, pitch: -66 },
+  { lon: 0, lat: 0, alt: 2_000_000, pitch: -30 },
+];
+
+// Stars and a few pixels of limb, no surface: where a frame limit measured
+// against a sphere of the planet's largest radius used to stop a voice tilt.
+const limbOnlyView = { alt: 18_000_000, pitch: -56.75 };
+
+/**
+ * An oracle independent of the code under test: the share of an 80×45 grid of
+ * Cesium pick rays across the canvas that hit the ellipsoid surface.
+ */
+function surfacePixelShare(camera, width, height, { keyhole = false } = {}) {
+  const radius = (KEYHOLE_OUTER_RADIUS * height) / 2;
+  let hits = 0;
+  let counted = 0;
+  for (let row = 0; row < 45; row += 1) {
+    for (let column = 0; column < 80; column += 1) {
+      const x = ((column + 0.5) * width) / 80;
+      const y = ((row + 0.5) * height) / 45;
+      if (keyhole && Math.hypot(x - width / 2, y - height / 2) > radius)
+        continue;
+      counted += 1;
+      const ray = camera.getPickRay(new Cesium.Cartesian2(x, y));
+      if (Cesium.IntersectionTests.rayEllipsoid(ray, Cesium.Ellipsoid.WGS84))
+        hits += 1;
+    }
+  }
+  return hits / counted;
+}
+
+test('the globe is out of frame only when no surface is on screen', () => {
+  const cases = [
+    [reportedStuckView, 1225, 923, true],
+    [limbOnlyView, 1600, 900, true],
+    [{ alt: 17_996_811, pitch: -90 }, 1225, 923, false],
+    ...partialGlobeViews.map((view) => [view, 1600, 900, false]),
+  ];
+  for (const [view, width, height, out] of cases) {
+    const { camera } = realCamera({ width, height });
+    aim(camera, view);
+    const label = JSON.stringify(view);
+    assert.equal(globeOutOfFrame(camera), out, label);
+    assert.equal(surfacePixelShare(camera, width, height) === 0, out, label);
+    assert.ok(
+      Math.abs(
+        globeFrameShare(camera) - surfacePixelShare(camera, width, height),
+      ) < 0.03,
+      `${label}: the frame share matches the pick-ray oracle`,
+    );
+  }
+});
+
+test('a move that ends with the globe out of frame turns back to nadir', () => {
+  const { camera, scene, viewer } = realCamera({ width: 1225, height: 923 });
+  const dispose = installGlobeInViewRecovery(viewer);
+  aim(camera, reportedStuckView);
+  const position = Cesium.Cartesian3.clone(camera.positionWC);
+  const heading = camera.heading;
+  camera.moveEnd.raiseEvent();
+  assert.ok(Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6));
+  assert.ok(Cesium.Math.equalsEpsilon(camera.heading, heading, 1e-6));
+  assert.ok(
+    Cesium.Cartesian3.equalsEpsilon(camera.positionWC, position, 0, 1e-3),
+  );
+  assert.equal(globeOutOfFrame(camera), false);
+  assert.equal(scene.renders, 1);
+
+  // Looking up near the ground, then zoomed out past the limit.
+  aim(camera, { alt: 3_834_000, pitch: 10 });
+  camera.moveEnd.raiseEvent();
+  assert.ok(Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6));
+
+  // Only the limb on a 16:9 screen still counts as lost.
+  const wide = realCamera({ width: 1600, height: 900 });
+  const disposeWide = installGlobeInViewRecovery(wide.viewer);
+  aim(wide.camera, limbOnlyView);
+  wide.camera.moveEnd.raiseEvent();
+  assert.ok(Cesium.Math.equalsEpsilon(wide.camera.pitch, -Math.PI / 2, 1e-6));
+  disposeWide();
+
+  dispose();
+  dispose();
+  aim(camera, reportedStuckView);
+  camera.moveEnd.raiseEvent();
+  assert.equal(globeOutOfFrame(camera), true, 'disposed recovery is inert');
+});
+
+// True when a moveEnd leaves the camera's view direction as it was.
+function moveEndKeepsView(camera) {
+  const direction = Cesium.Cartesian3.clone(camera.directionWC);
+  camera.moveEnd.raiseEvent();
+  return Cesium.Cartesian3.equalsEpsilon(camera.directionWC, direction, 1e-9);
+}
+
+test('globe recovery leaves partial, low, locked and 2D views alone', () => {
+  for (const view of partialGlobeViews) {
+    const { camera, viewer } = realCamera();
+    installGlobeInViewRecovery(viewer);
+    aim(camera, view);
+    assert.ok(moveEndKeepsView(camera), JSON.stringify(view));
+  }
+
+  const low = realCamera();
+  installGlobeInViewRecovery(low.viewer);
+  aim(low.camera, { alt: 900_000, pitch: 85 });
+  assert.equal(globeOutOfFrame(low.camera), true);
+  assert.ok(moveEndKeepsView(low.camera), 'below the limit');
+
+  // Locked on a point in space, between it and the planet, facing away.
+  const locked = realCamera();
+  installGlobeInViewRecovery(locked.viewer);
+  locked.camera.lookAtTransform(
+    Cesium.Matrix4.fromTranslation(new Cesium.Cartesian3(30_000_000, 0, 0)),
+    new Cesium.Cartesian3(-1_000_000, 0, 0),
+  );
+  assert.equal(globeOutOfFrame(locked.camera), true);
+  assert.ok(moveEndKeepsView(locked.camera), 'locked camera');
+
+  // Tracking an entity that has no position yet keeps an identity transform.
+  const tracked = realCamera();
+  tracked.viewer.trackedEntity = { id: 'pending-fix' };
+  installGlobeInViewRecovery(tracked.viewer);
+  aim(tracked.camera, reportedStuckView);
+  assert.ok(moveEndKeepsView(tracked.camera), 'tracked camera');
+
+  const flat = realCamera({ mode: Cesium.SceneMode.COLUMBUS_VIEW });
+  installGlobeInViewRecovery(flat.viewer);
+  flat.scene.mode = Cesium.SceneMode.SCENE3D;
+  aim(flat.camera, reportedStuckView);
+  flat.scene.mode = Cesium.SceneMode.COLUMBUS_VIEW;
+  assert.ok(moveEndKeepsView(flat.camera), 'Columbus view');
+});
+
+test('the look limit from orbit tolerates grid noise and never reaches zero', () => {
+  const radians = Cesium.Math.toRadians;
+  // About 2% of a 16:9 frame on the planet, below the 10% limit.
+  const sliver = { alt: 18_000_000, pitch: -60 };
+  const { camera } = realCamera();
+  aim(camera, sliver);
+  const start = surfacePixelShare(camera, 1600, 900);
+  assert.ok(start > 0 && start < 0.1, `starts below the limit: ${start}`);
+
+  // Sideways across the sliver: the share wobbles by a cell, the planet stays.
+  assert.equal(lookStepLosesGlobe(camera, 'lookLeft', radians(0.5)), false);
+  const startShare = globeFrameShare(camera);
+  for (let i = 0; i < 20; i += 1) {
+    const step = lookAngleWithinFrame(camera, 'lookLeft', radians(0.25), {
+      startShare,
+    });
+    assert.equal(step, radians(0.25), `sideways step ${i + 1}`);
+    camera.lookLeft(step);
+  }
+  assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+
+  // Toward the planet is always allowed.
+  aim(camera, sliver);
+  assert.equal(
+    lookAngleWithinFrame(camera, 'lookDown', radians(10)),
+    radians(10),
+  );
+
+  // Away from it stops short of losing it.
+  aim(camera, sliver);
+  const away = lookAngleWithinFrame(camera, 'lookUp', radians(30));
+  assert.ok(away < radians(30));
+  camera.lookUp(away);
+  assert.ok(globeFrameShare(camera) > 0);
+  assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+});
+
+test('the look limit leaves a view with no surface to the move-end recovery', () => {
+  const { camera } = realCamera({ width: 1225, height: 923 });
+  aim(camera, reportedStuckView);
+  assert.equal(
+    lookAngleWithinFrame(camera, 'lookUp', Cesium.Math.toRadians(5)),
+    Cesium.Math.toRadians(5),
+  );
+});
+
+// Surface only in the corners of a 16:9 frame, all of it outside the scope's
+// keyhole: the full frame shows some planet, the scope shows none.
+const cornerOnlyView = { alt: 18_000_000, pitch: -52, roll: 60 };
+
+test('with a scope keyhole, surface hidden in the masked corners counts as none', () => {
+  const { camera } = realCamera();
+  aim(camera, cornerOnlyView);
+  const keyhole = { keyholeRadius: KEYHOLE_OUTER_RADIUS };
+  assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+  assert.equal(surfacePixelShare(camera, 1600, 900, { keyhole: true }), 0);
+  assert.equal(globeOutOfFrame(camera), false);
+  assert.equal(globeOutOfFrame(camera, keyhole), true);
+  aim(camera, { alt: 18_000_000, pitch: -90 });
+  assert.ok(
+    Math.abs(
+      globeFrameShare(camera, keyhole) -
+        surfacePixelShare(camera, 1600, 900, { keyhole: true }),
+    ) < 0.03,
+    'the keyhole share matches the pick-ray oracle',
+  );
+});
+
+test('the recovery follows the scope: corner-only views are turned back only behind it', () => {
+  for (const [scopeOn, expectRecovery] of [
+    [true, true],
+    [false, false],
+  ]) {
+    const { camera, viewer } = realCamera();
+    installGlobeInViewRecovery(viewer, {
+      keyholeRadius: () => (scopeOn ? KEYHOLE_OUTER_RADIUS : 0),
+    });
+    aim(camera, cornerOnlyView);
+    camera.moveEnd.raiseEvent();
+    assert.equal(
+      Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6),
+      expectRecovery,
+      `scope ${scopeOn ? 'on' : 'off'}`,
+    );
+  }
+});
+
+test('the recovery leaves a camera flight and an authored scene alone', () => {
+  let playing = true;
+  const { camera, scene, viewer } = realCamera({ width: 1225, height: 923 });
+  scene.camera = camera;
+  scene.screenSpaceCameraController = { enableInputs: true };
+  installGlobeInViewRecovery(viewer, { paused: () => playing });
+  aim(camera, reportedStuckView);
+  camera.moveEnd.raiseEvent();
+  assert.equal(globeOutOfFrame(camera), true, 'a playing scene is left alone');
+  playing = false;
+
+  // A flight that pauses looking away is left alone until it ends.
+  camera.flyTo({
+    destination: Cesium.Cartesian3.fromDegrees(10, 20, 18_000_000),
+    duration: 5,
+  });
+  camera.moveEnd.raiseEvent();
+  assert.equal(globeOutOfFrame(camera), true, 'a flight is left alone');
+  camera.cancelFlight();
+  camera.moveEnd.raiseEvent();
+  assert.ok(Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6));
+});
+
+test('a check a scene or flight defers runs once it ends', () => {
+  for (const viaMoveEnd of [false, true]) {
+    let playing = true;
+    const timers = fakeTimers();
+    const { camera, viewer } = realCamera({ width: 1225, height: 923 });
+    installGlobeInViewRecovery(viewer, {
+      paused: () => playing,
+      ...timers,
+    });
+    aim(camera, reportedStuckView);
+    camera.moveStart.raiseEvent();
+    // A hold on a stars-only shot: quiet, with or without Cesium's moveEnd.
+    for (let i = 0; i < 4; i += 1) timers.tick();
+    if (viaMoveEnd) camera.moveEnd.raiseEvent();
+    // Longer than the settle check's five-minute bound.
+    for (let i = 0; i < 1500; i += 1) timers.tick();
+    assert.equal(globeOutOfFrame(camera), true, 'left alone while it plays');
+    assert.equal(timers.pending(), 1, 'still watching');
+    playing = false;
+    timers.tick();
+    assert.ok(
+      Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6),
+      `recovered once the scene ends (${viaMoveEnd ? 'after moveEnd' : 'no moveEnd'})`,
+    );
+  }
+});
+
+// Holding a drag still for half a second on a view that already showed no
+// surface looked like a settled camera, and the view was turned down under
+// the user's hand.
+test('the recovery waits while a pointer is held on the globe', () => {
+  const timers = fakeTimers();
+  const { camera, scene, viewer } = realCamera({ width: 1225, height: 923 });
+  const document = new EventTarget();
+  scene.canvas = Object.assign(new EventTarget(), {
+    clientWidth: 1225,
+    clientHeight: 923,
+    ownerDocument: document,
+  });
+  const dispose = installGlobeInViewRecovery(viewer, timers);
+  aim(camera, reportedStuckView);
+  scene.canvas.dispatchEvent(new Event('pointerdown'));
+  camera.moveStart.raiseEvent();
+  for (let i = 0; i < 8; i += 1) timers.tick();
+  camera.moveEnd.raiseEvent();
+  for (let i = 0; i < 8; i += 1) timers.tick();
+  assert.equal(globeOutOfFrame(camera), true, 'left alone while held');
+  document.dispatchEvent(new Event('pointerup'));
+  for (let i = 0; i < 3; i += 1) timers.tick();
+  assert.ok(
+    Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6),
+    'recovered once the pointer is released',
+  );
+  dispose();
+  aim(camera, reportedStuckView);
+  scene.canvas.dispatchEvent(new Event('pointerdown'));
+  document.dispatchEvent(new Event('pointerup'));
+  assert.equal(timers.pending(), 0, 'disposed recovery holds no listeners');
+});
+
+/** A held-pointer recovery over a canvas in a document in a window. */
+function heldPointerRecovery() {
+  const timers = fakeTimers();
+  const { camera, scene, viewer } = realCamera({ width: 1225, height: 923 });
+  const window = new EventTarget();
+  const document = Object.assign(new EventTarget(), {
+    defaultView: window,
+    visibilityState: 'visible',
+  });
+  scene.canvas = Object.assign(new EventTarget(), {
+    clientWidth: 1225,
+    clientHeight: 923,
+    ownerDocument: document,
+  });
+  const dispose = installGlobeInViewRecovery(viewer, timers);
+  const pointer = (target, type, pointerId, init = {}) =>
+    target.dispatchEvent(
+      Object.assign(new Event(type), { pointerId, ...init }),
+    );
+  /** Press, move and hold still: the check defers while a pointer is held. */
+  const holdStill = () => {
+    aim(camera, reportedStuckView);
+    camera.moveStart.raiseEvent();
+    for (let i = 0; i < 8; i += 1) timers.tick();
+    camera.moveEnd.raiseEvent();
+    for (let i = 0; i < 8; i += 1) timers.tick();
+  };
+  const settle = () => {
+    for (let i = 0; i < 3; i += 1) timers.tick();
+  };
+  const recovered = () =>
+    Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6);
+  return {
+    camera,
+    document,
+    window,
+    dispose,
+    pointer,
+    holdStill,
+    settle,
+    recovered,
+    canvas: scene.canvas,
+  };
+}
+
+// Releasing one of two fingers cleared the held flag, and the recovery
+// turned the view down under the finger still on the glass.
+test('the recovery waits until every held pointer is released', () => {
+  const h = heldPointerRecovery();
+  h.pointer(h.canvas, 'pointerdown', 1);
+  h.pointer(h.canvas, 'pointerdown', 2);
+  h.holdStill();
+  h.pointer(h.document, 'pointerup', 1);
+  h.settle();
+  assert.equal(h.recovered(), false, 'left alone under the second finger');
+  assert.equal(globeOutOfFrame(h.camera), true);
+  h.pointer(h.document, 'pointercancel', 2);
+  h.settle();
+  assert.equal(h.recovered(), true, 'recovered once both are released');
+  h.dispose();
+});
+
+// A release the page never sees (the pointer let go outside the window)
+// must not hold the recovery off for good.
+for (const [label, lose] of [
+  ['the window loses focus', (h) => h.window.dispatchEvent(new Event('blur'))],
+  [
+    'the page is hidden',
+    (h) => {
+      h.document.visibilityState = 'hidden';
+      h.document.dispatchEvent(new Event('visibilitychange'));
+    },
+  ],
+  [
+    'the canvas loses the pointer capture',
+    (h) => h.pointer(h.canvas, 'lostpointercapture', 1),
+  ],
+  [
+    'the pointer moves with no button down',
+    (h) => h.pointer(h.document, 'pointermove', 1, { buttons: 0 }),
+  ],
+]) {
+  test(`a held pointer whose release is lost stops deferring when ${label}`, () => {
+    const h = heldPointerRecovery();
+    h.pointer(h.canvas, 'pointerdown', 1);
+    h.holdStill();
+    h.pointer(h.document, 'pointermove', 1, { buttons: 1 });
+    h.settle();
+    assert.equal(h.recovered(), false, 'left alone while held');
+    lose(h);
+    h.settle();
+    assert.equal(h.recovered(), true, 'recovered once the hold is let go');
+    h.dispose();
+  });
+}
+
+function fakeTimers() {
+  let next = 1;
+  const pending = new Map();
+  return {
+    setTimeout: (callback) => {
+      const id = next++;
+      pending.set(id, callback);
+      return id;
+    },
+    clearTimeout: (id) => pending.delete(id),
+    pending: () => pending.size,
+    /** Run the earliest pending callback, as 250 ms passing would. */
+    tick() {
+      const [id, callback] = pending.entries().next().value ?? [];
+      if (id === undefined) return false;
+      pending.delete(id);
+      callback();
+      return true;
+    },
+  };
+}
+
+test('a stuck view is recovered once it has held still, without waiting for moveEnd', () => {
+  // At this pose the camera can drift by a rounding error every frame, so
+  // Cesium never sees it stop and never raises moveEnd for it.
+  const timers = fakeTimers();
+  const { camera, viewer } = realCamera({ width: 1225, height: 923 });
+  installGlobeInViewRecovery(viewer, timers);
+  aim(camera, reportedStuckView);
+  camera.moveStart.raiseEvent();
+  timers.tick();
+  assert.equal(globeOutOfFrame(camera), true, 'one quiet sample is not enough');
+  // A rounding-error drift between samples still counts as at rest.
+  camera.lookUp(1e-15);
+  timers.tick();
+  assert.ok(Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6));
+  // Under that drift Cesium raises no new moveStart, so a later move that
+  // ends looking away is caught by the same check.
+  aim(camera, reportedStuckView);
+  timers.tick();
+  timers.tick();
+  assert.equal(globeOutOfFrame(camera), true, 'not yet at rest');
+  timers.tick();
+  assert.ok(Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6));
+  camera.moveEnd.raiseEvent();
+  assert.equal(timers.pending(), 0, 'moveEnd ends the check');
+});
+
+test('the settle check follows a long move and gives up five minutes after the last one', () => {
+  // A drag of half a minute that stops at a stuck pose is still recovered.
+  const long = fakeTimers();
+  const dragged = realCamera({ width: 1225, height: 923 });
+  installGlobeInViewRecovery(dragged.viewer, long);
+  aim(dragged.camera, reportedStuckView);
+  dragged.camera.moveStart.raiseEvent();
+  for (let i = 0; i < 120; i += 1) {
+    dragged.camera.moveLeft(0.01);
+    long.tick();
+  }
+  assert.equal(globeOutOfFrame(dragged.camera), true, 'still moving');
+  while (long.tick());
+  assert.ok(
+    Cesium.Math.equalsEpsilon(dragged.camera.pitch, -Math.PI / 2, 1e-6),
+    'recovered once it stopped',
+  );
+
+  // A camera that keeps moving is followed, and left alone, for as long as it
+  // moves; once it rests the check gives up five minutes later.
+  const timers = fakeTimers();
+  const { camera, viewer } = realCamera({ width: 1225, height: 923 });
+  installGlobeInViewRecovery(viewer, timers);
+  aim(camera, reportedStuckView);
+  camera.moveStart.raiseEvent();
+  for (let i = 0; i < 2000; i += 1) {
+    camera.moveLeft(0.01);
+    timers.tick();
+  }
+  assert.equal(timers.pending(), 1, 'still following after eight minutes');
+  assert.equal(globeOutOfFrame(camera), true, 'a moving camera is left alone');
+  let idleSamples = 0;
+  while (timers.tick()) idleSamples += 1;
+  assert.ok(
+    Cesium.Math.equalsEpsilon(camera.pitch, -Math.PI / 2, 1e-6),
+    'recovered once it stopped',
+  );
+  assert.ok(
+    idleSamples >= 1200 && idleSamples <= 1205,
+    `gave up ${idleSamples} samples after it stopped`,
+  );
+
+  const disposed = fakeTimers();
+  const other = realCamera({ width: 1225, height: 923 });
+  const dispose = installGlobeInViewRecovery(other.viewer, disposed);
+  aim(other.camera, reportedStuckView);
+  other.camera.moveStart.raiseEvent();
+  dispose();
+  assert.equal(disposed.pending(), 0, 'dispose cancels the pending check');
+});

src/app/catalog.js

@@ -5,6 +5,7 @@ const CONTROL_LAYER_IDS = Object.freeze({
   satellitesLayer: 'satellites',
   cctvLayer: 'cctv',
   streetLevelLayer: 'street-level',
+  wildlifeSightingsLayer: 'wildlife-sightings',
   radioLayer: 'radio',
   bikeshareLayer: 'bikeshare',
   transitLayer: 'transit',

src/app/catalog.test.mjs

@@ -139,6 +139,7 @@ test('controls bind catalog instances rather than similarly named defaults', ()
     'rocket-launches',
     'street-level',
     'local-adsb',
+    'wildlife-sightings',
   ];
   const layers = ids.map((id) => ({ id }));
   const catalog = createLayerCatalog(layers, metadata(layers));
@@ -147,6 +148,7 @@ test('controls bind catalog instances rather than similarly named defaults', ()
   assert.equal(services.transitLayer, layers[7]);
   assert.equal(services.aisLiveVesselsLayer, layers[8]);
   assert.equal(services.localAdsbLayer, layers[13]);
+  assert.equal(services.wildlifeSightingsLayer, layers[14]);
   assert.equal(new Set(Object.values(services)).size, layers.length);
   assert.throws(
     () => catalogControlServices(createLayerCatalog([], [])),

src/app/constructCatalog.js

@@ -30,6 +30,7 @@ import { createApplicationFirePerimeters } from './layers/perimeters.js';
 import { createApplicationGnssIntegrity } from './layers/gnss.js';
 import { createApplicationGhostMaps } from './layers/ghostMaps.js';
 import { createApplicationDroneAirspace } from './layers/droneAirspace.js';
+import { createApplicationWildlifeSightings } from './layers/wildlifeSightings.js';
 import { createApplicationCables } from './layers/submarineCables.js';
 import { createOsmOverlayLayers } from '../data/osmOverlays.js';
 import { createApplicationStreetLevel } from './layers/streetLevel.js';
@@ -137,6 +138,10 @@ export function createApplicationCatalog({
         createApplicationDroneAirspace({
           source: sources['drone-airspace'],
         }),
+        createApplicationWildlifeSightings({
+          source: sources['wildlife-sightings'],
+          groundFloor: surface.groundFloor,
+        }),
         createApplicationAlpr({ surface, source: sources.alpr }),
         createApplicationStreetLevel({
           surface,

src/app/constructCatalog.test.mjs

@@ -40,7 +40,7 @@ test('catalogs construct distinct layers and classification from their supplied
     signal: b.signal,
     surface: fixtureSurface(b.signal),
   });
-  assert.equal(first.layers.length, 37);
+  assert.equal(first.layers.length, 38);
   assert.ok(first.get('local-adsb'), 'Local ADS-B is registered');
   assert.deepEqual(
     first.metadata.find(({ id }) => id === 'osm-places'),
@@ -161,7 +161,7 @@ test('Mapillary can be omitted or replaced without changing catalog membership',
     surface: fixtureSurface(lifetime.signal),
   };
   const catalog = createApplicationCatalog(options);
-  assert.equal(catalog.layers.length, 37);
+  assert.equal(catalog.layers.length, 38);
   assert.deepEqual(catalog.get('street-level').providerIds, []);
   assert.equal(
     catalogControlServices(catalog).streetLevelLayer,

src/app/layers/wildlifeSightings.js

@@ -0,0 +1,30 @@
+import * as Cesium from 'cesium';
+import { createWildlifeSightingsLayer } from '../../layers/wildlifeSightings/index.js';
+import * as picking from '../../data/pickRegistry.js';
+import * as overlays from '../../overlays/worldOverlay.js';
+import * as sprites from '../../data/spriteOrder.js';
+import * as render from '../../renderGovernor.js';
+import * as context from '../../data/contextStore.js';
+import * as focus from '../../worldFocus.js';
+import { isPointerFree } from '../../data/inputOwnership.js';
+
+/** Bind the wildlife layer to the application's scene and selection owners. */
+export function createApplicationWildlifeSightings(options) {
+  return createWildlifeSightingsLayer({
+    overlayHost: {
+      setEntries: overlays.setOverlayEntries,
+      setVisible: overlays.setOverlaySourceVisible,
+      clearSource: overlays.clearOverlaySource,
+      hitTest: overlays.hitTestWorldOverlay,
+    },
+    screenSpaceEventHandlerFactory: (viewer) =>
+      new Cesium.ScreenSpaceEventHandler(viewer.scene.canvas),
+    picking,
+    pointer: { isPointerFree },
+    sprites,
+    render,
+    context,
+    focus,
+    ...options,
+  });
+}

src/app/scene.js

@@ -2,6 +2,7 @@ import { createApplicationOperations } from './operations.js';
 import * as Cesium from 'cesium';
 import {
   createApplicationViewer,
+  installFreeLookHeightLimit,
   installTrackpadPinchZoom,
 } from '../app/viewer.js';
 import { registerDataCredits } from '../data/dataCredits.js';
@@ -58,6 +59,7 @@ export async function createApplicationScene({
     if (!viewer.isDestroyed()) viewer.destroy();
   });
   defer(installTrackpadPinchZoom(viewer));
+  defer(installFreeLookHeightLimit(viewer));
   registerDataCredits(viewer, credits);
   configureCreditKeyboardAccess(document);
   defer(onLocaleChange(() => configureCreditKeyboardAccess(document)));

src/app/sourceComposition.js

@@ -50,6 +50,7 @@ export const CATALOG_SOURCE_CONTRACTS = Object.freeze({
   'gnss-integrity': contract(['gnss-integrity'], ['getSnapshot']),
   's2-ghostmaps': contract(['s2-ghostmaps'], ['getCatalog', 'getFile']),
   'drone-airspace': contract(['drone-airspace'], ['getSnapshot']),
+  'wildlife-sightings': contract(['wildlife-sightings'], ['getSnapshot']),
   cables: contract(['telegeography-submarine-cables'], ['fetch']),
   transit: contract(['transit'], ['requestSnapshot', 'getHistory']),
 });

src/app/sourceComposition.test.mjs

@@ -37,7 +37,7 @@ test('every acquisition source can be omitted without losing catalog membership'
 
 test('all acquisition sources may be absent, and enable fails before initializing or fetching', async (t) => {
   const actual = catalog({}, t);
-  assert.equal(actual.layers.length, 37);
+  assert.equal(actual.layers.length, 38);
   const manager = new LayerLifecycle(
     {},
     { getSourceAvailability: actual.getSourceAvailability },

src/app/tools.js

@@ -8,7 +8,13 @@ import { initImageryBoxTool } from '../ui/imageryBoxTool.js';
 import { createRecentImageryPanel } from '../ui/recentImagery.js';
 import { initGevVoiceCommands } from '../voice/gevRealtime.js';
 import { installViews, isEmbeddedInline } from './embed.js';
-import { installScopeMask, destroyScopeMask } from '../scopeMask.js';
+import {
+  installScopeMask,
+  destroyScopeMask,
+  isScopeMaskEnabled,
+} from '../scopeMask.js';
+import { KEYHOLE_OUTER_RADIUS } from '../celestialRing.js';
+import { installGlobeInViewRecovery } from './viewer.js';
 import { installLayerReleaseTrim } from '../sceneCommandRelease.js';
 import {
   installRenderGovernor,
@@ -44,6 +50,14 @@ export function createApplicationTools({
     .get('bhote-koshi-2026')
     ?.module.attachSceneController(sceneDirector);
   defer(() => sceneDirector.destroy());
+  defer(
+    installGlobeInViewRecovery(viewer, {
+      // The scope mask hides everything outside its keyhole.
+      keyholeRadius: () => (isScopeMaskEnabled() ? KEYHOLE_OUTER_RADIUS : 0),
+      // An authored scene frames its own shots, holds included.
+      paused: () => sceneDirector.running,
+    }),
+  );
   onSceneDirector?.(sceneDirector);
   const annotations = initAnnotations({
     viewer,

src/app/viewer.js

@@ -1,6 +1,11 @@
 import * as Cesium from 'cesium';
 import { applyModelAtmosphereWorkaround } from './atmosphereCompat.js';
 import { StarrySky } from '../sky/starrySky.js';
+import {
+  FREE_LOOK_MAX_HEIGHT_METERS,
+  globeOutOfFrame,
+  isFreeGlobeCamera,
+} from '../globeInView.js';
 
 const PINCH_ZOOM_MULTIPLIER = 8;
 const MAX_PINCH_PIXEL_DELTA = 120;
@@ -103,6 +108,231 @@ export function installTrackpadPinchZoom(
   };
 }
 
+/**
+ * Allow Cesium's free look only below `maxHeight` and return its disposer.
+ * Orbit, tilt and zoom stay available at every height. A value other code
+ * sets later is kept as the one to allow below that height, and restored on
+ * dispose; a `false` written while the camera is above `maxHeight` cannot be
+ * told apart from this limit's own write, so dispose restores the earlier
+ * value then. `enableLook` gates the Shift+drag binding only: below its trackball
+ * height Cesium also turns the camera in place for a drag that starts on the
+ * stars. That height is lowered to `maxHeight` too, so above it such a drag
+ * orbits the globe, as it does above Cesium's own 7,500 km.
+ */
+export function installFreeLookHeightLimit(
+  viewer,
+  maxHeight = FREE_LOOK_MAX_HEIGHT_METERS,
+) {
+  const scene = viewer?.scene;
+  const controller = scene?.screenSpaceCameraController;
+  const camera = viewer?.camera;
+  if (!controller || !camera || !scene?.preUpdate)
+    throw new TypeError('A complete Cesium viewer is required');
+
+  const originalTrackBallHeight = controller.minimumTrackBallHeight;
+  const trackBallHeight = Math.min(originalTrackBallHeight, maxHeight);
+  controller.minimumTrackBallHeight = trackBallHeight;
+  let wanted = controller.enableLook;
+  let written;
+  const sync = () => {
+    if (written !== undefined && controller.enableLook !== written)
+      wanted = controller.enableLook;
+    const height = camera.positionCartographic?.height;
+    written = wanted && !(Number.isFinite(height) && height > maxHeight);
+    controller.enableLook = written;
+  };
+  sync();
+  const removeListener = scene.preUpdate.addEventListener(sync);
+
+  let active = true;
+  return () => {
+    if (!active) return;
+    active = false;
+    removeListener();
+    if (controller.enableLook === written) controller.enableLook = wanted;
+    if (controller.minimumTrackBallHeight === trackBallHeight)
+      controller.minimumTrackBallHeight = originalTrackBallHeight;
+  };
+}
+
+// How often a moving camera is sampled to see whether it has come to rest, how
+// far a pose may drift between samples and still count as at rest, and how
+// long after the camera last moved the check gives up if Cesium never raises
+// moveEnd.
+const SETTLE_SAMPLE_MS = 250;
+const SETTLE_POSITION_TOLERANCE_M = 1e-3;
+const SETTLE_DIRECTION_TOLERANCE = 1e-9;
+const SETTLE_GIVE_UP_MS = 5 * 60_000;
+
+/**
+ * Turn the camera back to the planet when a move ends above `minHeight` with
+ * no surface on screen (`globeOutOfFrame`: limb glow and slivers up to about
+ * one sample cell thick can count as none), and return the disposer. Views with
+ * more surface, such as an oblique orbital shot, are left as they are. This
+ * catches a saved or shared view that looked away, or any other move that ends
+ * looking away from the planet.
+ * Heading and position are kept. Tracked cameras, locked ones (non-identity
+ * transform), a camera flight in progress, a pointer held down on the canvas
+ * (a drag held still), the 2D and Columbus modes, and any time `paused`
+ * returns true (an authored scene playing) are left alone; a check they defer
+ * runs once they end, however long they last.
+ * `keyholeRadius`
+ * returns the radius of the visible circle when a scope mask hides the rest of
+ * the frame (see `globeFrameShare`), or 0; it is read at every check.
+ *
+ * Cesium's `moveEnd` alone is not enough: Cesium compares the camera with the
+ * last frame's to the last rounding error, and at some of these poses the
+ * camera drifts by a rounding error every frame, so Cesium never sees it stop.
+ * So each `moveStart` also starts a check of its own that samples the pose
+ * every 250 ms, with a tolerance for that drift, and once the pose has held
+ * for half a second after moving runs the same recovery. It keeps watching
+ * until Cesium raises `moveEnd`, since under that drift Cesium raises no new
+ * `moveStart` for a later move, and gives up five minutes after the camera
+ * last moved.
+ * `setTimeout` and `clearTimeout` can be injected for tests.
+ */
+export function installGlobeInViewRecovery(
+  viewer,
+  {
+    minHeight = FREE_LOOK_MAX_HEIGHT_METERS,
+    keyholeRadius = () => 0,
+    paused = () => false,
+    setTimeout: schedule = globalThis.setTimeout,
+    clearTimeout: unschedule = globalThis.clearTimeout,
+  } = {},
+) {
+  const scene = viewer?.scene;
+  const camera = viewer?.camera;
+  if (!scene || !camera?.moveEnd || !camera?.moveStart)
+    throw new TypeError('A complete Cesium viewer is required');
+
+  // A pointer held on the globe is a gesture in progress, even when it holds
+  // still for half a second: the check waits until every pointer pressed on
+  // it (each finger of a pinch) is released. A release the page never sees,
+  // outside the window, is taken as given when the window loses focus, the
+  // page is hidden, the canvas loses the pointer's capture, or the pointer
+  // moves with no button down.
+  const canvas = scene.canvas;
+  const releaseTarget = canvas?.ownerDocument ?? canvas;
+  const releaseWindow = canvas?.ownerDocument?.defaultView;
+  const heldPointers = new Set();
+  const onPointerDown = (event) => heldPointers.add(event?.pointerId);
+  const onPointerUp = (event) => heldPointers.delete(event?.pointerId);
+  const onPointerMove = (event) => {
+    if (event?.buttons === 0) heldPointers.delete(event.pointerId);
+  };
+  const releaseAll = () => heldPointers.clear();
+  const onVisibilityChange = () => {
+    if (canvas.ownerDocument.visibilityState === 'hidden') releaseAll();
+  };
+  const listeners = [
+    [canvas, 'pointerdown', onPointerDown],
+    [canvas, 'lostpointercapture', onPointerUp],
+    [releaseTarget, 'pointerup', onPointerUp],
+    [releaseTarget, 'pointercancel', onPointerUp],
+    [releaseTarget, 'pointermove', onPointerMove],
+    [canvas?.ownerDocument, 'visibilitychange', onVisibilityChange],
+    [releaseWindow, 'blur', releaseAll],
+  ];
+  for (const [target, type, listener] of listeners)
+    target?.addEventListener?.(type, listener);
+
+  // Returns false while a flight, a paused scene or a held pointer defers the
+  // check, so the caller can try again once it ends.
+  const recover = () => {
+    if (!isFreeGlobeCamera(viewer)) return true;
+    // Cesium has no public running-flight flag.
+    if (camera._currentFlight || paused() || heldPointers.size > 0)
+      return false;
+    const height = camera.positionCartographic?.height;
+    if (
+      !(height > minHeight) ||
+      !globeOutOfFrame(camera, { keyholeRadius: keyholeRadius() })
+    )
+      return true;
+    camera.setView({
+      orientation: {
+        heading: camera.heading,
+        pitch: -Cesium.Math.PI_OVER_TWO,
+        roll: 0,
+      },
+    });
+    scene.requestRender?.();
+    return true;
+  };
+
+  const lastPosition = new Cesium.Cartesian3();
+  const lastDirection = new Cesium.Cartesian3();
+  let settleTimer = null;
+  let settleElapsed = 0;
+  let restingSamples = 0;
+  let movedSinceCheck = false;
+  const stopSettling = () => {
+    if (settleTimer !== null) unschedule(settleTimer);
+    settleTimer = null;
+  };
+  const sample = () => {
+    settleTimer = null;
+    settleElapsed += SETTLE_SAMPLE_MS;
+    const atRest =
+      Cesium.Cartesian3.equalsEpsilon(
+        camera.positionWC,
+        lastPosition,
+        0,
+        SETTLE_POSITION_TOLERANCE_M,
+      ) &&
+      Cesium.Cartesian3.equalsEpsilon(
+        camera.directionWC,
+        lastDirection,
+        0,
+        SETTLE_DIRECTION_TOLERANCE,
+      );
+    restingSamples = atRest ? restingSamples + 1 : 0;
+    if (!atRest) {
+      movedSinceCheck = true;
+      settleElapsed = 0;
+    }
+    // Two quiet samples in a row after a move: at rest for half a second, as
+    // for moveEnd.
+    if (restingSamples >= 2 && movedSinceCheck) {
+      if (recover()) movedSinceCheck = false;
+      // A flight or a playing scene bounds its own deferral.
+      else settleElapsed = 0;
+    }
+    if (settleElapsed >= SETTLE_GIVE_UP_MS) return;
+    Cesium.Cartesian3.clone(camera.positionWC, lastPosition);
+    Cesium.Cartesian3.clone(camera.directionWC, lastDirection);
+    settleTimer = schedule(sample, SETTLE_SAMPLE_MS);
+  };
+  const startSettling = () => {
+    stopSettling();
+    settleElapsed = 0;
+    restingSamples = 0;
+    movedSinceCheck = true;
+    Cesium.Cartesian3.clone(camera.positionWC, lastPosition);
+    Cesium.Cartesian3.clone(camera.directionWC, lastDirection);
+    settleTimer = schedule(sample, SETTLE_SAMPLE_MS);
+  };
+  const removeMoveEnd = camera.moveEnd.addEventListener(() => {
+    if (recover()) stopSettling();
+    // Deferred: keep sampling so the check runs once the flight or scene ends.
+    else if (settleTimer === null) startSettling();
+  });
+  const removeMoveStart = camera.moveStart.addEventListener(startSettling);
+
+  let active = true;
+  return () => {
+    if (!active) return;
+    active = false;
+    stopSettling();
+    removeMoveEnd();
+    removeMoveStart();
+    for (const [target, type, listener] of listeners)
+      target?.removeEventListener?.(type, listener);
+    heldPointers.clear();
+  };
+}
+
 /** Cesium.Viewer options of the standard globe viewer. */
 export function applicationViewerOptions(creditContainer) {
   return {

src/cameraGlobeRotation.test.mjs

@@ -13,8 +13,16 @@ import {
   moveCamera,
 } from './cameraVerbs.js';
 import { getRenderGovernorDiagnostics } from './renderGovernor.js';
+import {
+  MIN_GLOBE_FRAME_SHARE,
+  globeFrameShare,
+  globeOutOfFrame,
+} from './globeInView.js';
+import { KEYHOLE_OUTER_RADIUS } from './celestialRing.js';
+import { setScopeMaskEnabled } from './scopeMask.js';
 
 const radians = Cesium.Math.toRadians;
+const degrees = Cesium.Math.toDegrees;
 const clone = (value) => Cesium.Cartesian3.clone(value);
 const longitude = (camera) =>
   Cesium.Cartographic.fromCartesian(camera.positionWC).longitude;
@@ -1347,3 +1355,664 @@ test('close-up ultrawide refusal does not offer an unfit reset or move the camer
   samePose(h.camera, before);
   assert.equal(hasRenderHold(), false);
 });
+
+/**
+ * An oracle independent of the code under test: the share of an 80×45 grid of
+ * Cesium pick rays across the canvas that hit the ellipsoid surface. With
+ * `keyhole`, only the pixels inside the scope's visible circle count.
+ */
+function surfacePixelShare(camera, width, height, { keyhole = false } = {}) {
+  const radius = (KEYHOLE_OUTER_RADIUS * height) / 2;
+  let hits = 0;
+  let counted = 0;
+  for (let row = 0; row < 45; row += 1) {
+    for (let column = 0; column < 80; column += 1) {
+      const x = ((column + 0.5) * width) / 80;
+      const y = ((row + 0.5) * height) / 45;
+      if (keyhole && Math.hypot(x - width / 2, y - height / 2) > radius)
+        continue;
+      counted += 1;
+      const ray = camera.getPickRay(new Cesium.Cartesian2(x, y));
+      if (Cesium.IntersectionTests.rayEllipsoid(ray, Cesium.Ellipsoid.WGS84))
+        hits += 1;
+    }
+  }
+  return hits / counted;
+}
+
+/** Run a test with the scope mask on or off, restoring the default after. */
+function withScope(t, enabled) {
+  setScopeMaskEnabled(enabled);
+  t.after(() => setScopeMaskEnabled(true));
+}
+
+// The frame limit is measured on a coarser grid than the oracle.
+const SHARE_SLACK = 0.02;
+// Far-out poses, height in metres and pitch in degrees, where a few tilts up
+// are accepted before the limit refuses the next one.
+const FAR_OUT_POSES = [
+  [35_884_000, -86.26],
+  [35_884_000, -89],
+  [30_000_000, -86],
+  [25_000_000, -80],
+  [40_000_000, -88],
+];
+
+test('voice tilt from orbit stops with the planet still on screen and then says so', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // Slightly off nadir: from straight down a tilt is clamped before it moves.
+  const { camera, finishOnce } = harness(t, {
+    pitch: -80,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  const results = [];
+  for (let i = 0; i < 4; i += 1) {
+    const result = moveCamera({
+      motion: 'tilt',
+      direction: 'up',
+      mode: 'once',
+    });
+    results.push(result);
+    if (result.ok) finishOnce();
+    assert.ok(
+      surfacePixelShare(camera, 1600, 900) >=
+        MIN_GLOBE_FRAME_SHARE - SHARE_SLACK,
+      `after tilt ${i + 1}`,
+    );
+  }
+  // From 18,000 km a 16:9 frame keeps a tenth of its area on the planet down
+  // to about -67°: the first tilt stops there, and later ones are refused.
+  assert.deepEqual(
+    results.map((result) => result.ok),
+    [true, false, false, false],
+  );
+  assert.match(results[1].error, /globe out of view/);
+  assert.ok(camera.pitch > radians(-68.5) && camera.pitch < radians(-66));
+});
+
+// The frame limit judges a tilt by the way its pitch moves, not by the
+// direction word: a tilt down or to a steeper angle turns toward the planet.
+for (const args of [{ direction: 'down' }, { pitchDeg: -80 }]) {
+  test(`a tilt ${JSON.stringify(args)} from the frame limit is judged as the look down it is`, (t) => {
+    withScope(t, false);
+    const { camera, finishOnce } = harness(t, {
+      pitch: -80,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    assert.equal(moveCamera({ motion: 'tilt', direction: 'up' }).ok, true);
+    finishOnce();
+    const atLimit = camera.pitch;
+    const result = moveCamera({ motion: 'tilt', ...args });
+    assert.equal(result.ok, true, result.error);
+    finishOnce();
+    assert.ok(camera.pitch < atLimit - radians(5), 'the tilt turned down');
+  });
+}
+
+for (const args of [{ pitchDeg: -10 }, {}]) {
+  test(`a tilt ${JSON.stringify(args)} up from the frame limit is refused, not reported as done`, (t) => {
+    withScope(t, false);
+    const { camera, finishOnce } = harness(t, {
+      pitch: -80,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    assert.equal(moveCamera({ motion: 'tilt', direction: 'up' }).ok, true);
+    finishOnce();
+    const atLimit = camera.pitch;
+    // A bare tilt means -45°: up from the -67° limit.
+    const result = moveCamera({ motion: 'tilt', ...args });
+    assert.equal(result.ok, false);
+    assert.match(result.error, /globe out of view/);
+    assert.equal(camera.pitch, atLimit);
+  });
+}
+
+// A tilt to an angle, or a bare tilt (-45°), from orbit turns in place like
+// a nudge and must keep the planet in frame the whole way, or the globe
+// recovery would snap the view back down.
+for (const [label, args, options] of [
+  ['a bare tilt', { motion: 'tilt' }, { pitch: -90 }],
+  ['a tilt to -10°', { motion: 'tilt', pitchDeg: -10 }, { pitch: -90 }],
+  [
+    'a continuous tilt up',
+    { motion: 'tilt', direction: 'up', mode: 'continuous' },
+    { pitch: -90 },
+  ],
+  [
+    'a tilt to -5° from 2,000 km',
+    { motion: 'tilt', pitchDeg: -5 },
+    { pitch: -90, height: 2_000_000 },
+  ],
+]) {
+  test(`${label} from top-down never turns the planet out of frame`, (t) => {
+    withScope(t, false);
+    const { camera, tick } = harness(t, {
+      ...options,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    const startPitch = camera.pitch;
+    const result = moveCamera(args);
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+      tick();
+      assert.ok(
+        surfacePixelShare(camera, 1600, 900) >=
+          MIN_GLOBE_FRAME_SHARE - SHARE_SLACK,
+        `frame ${i}: the planet left the frame`,
+      );
+    }
+    assert.equal(getActiveCameraMotion(), null, 'the tilt must stop');
+    assert.equal(globeOutOfFrame(camera), false, 'no snap-back');
+    if (result.ok) assert.ok(camera.pitch > startPitch, 'the tilt moved');
+  });
+}
+
+// The frame limit stops a tilt to an angle short of it: the reply names the
+// angle the camera reaches, not the one asked for (a tilt to -10° from
+// top-down reported -10° and ended at -66.5°).
+for (const [label, args, options] of [
+  ['a bare tilt', { motion: 'tilt' }, { pitch: -90 }],
+  ['a tilt to -10°', { motion: 'tilt', pitchDeg: -10 }, { pitch: -90 }],
+  [
+    'a tilt to -10° from -80°',
+    { motion: 'tilt', pitchDeg: -10 },
+    { pitch: -80 },
+  ],
+  [
+    'a tilt to -5° from 2,000 km',
+    { motion: 'tilt', pitchDeg: -5 },
+    { pitch: -90, height: 2_000_000 },
+  ],
+  // A rolled camera's look turns its pitch by less than the look angle:
+  // reported -25°, ended at -27.3°.
+  [
+    'a tilt to -5° from 2,000 km rolled 30°',
+    { motion: 'tilt', pitchDeg: -5 },
+    { pitch: -70, roll: 30, height: 2_000_000 },
+  ],
+]) {
+  test(`${label} from orbit reports the angle it reaches`, (t) => {
+    withScope(t, false);
+    const { camera, tick } = harness(t, {
+      ...options,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    const result = moveCamera(args);
+    assert.equal(result.ok, true, result.error);
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick();
+    assert.equal(getActiveCameraMotion(), null, 'the tilt must stop');
+    const reached = degrees(camera.pitch);
+    assert.ok(
+      Math.abs(reached - result.pitchDeg) < 1,
+      `reported ${result.pitchDeg}°, reached ${reached}°`,
+    );
+    const asked = args.pitchDeg ?? -45;
+    if (Math.abs(reached - asked) >= 1)
+      assert.match(result.note ?? '', /globe out of view/);
+    else assert.equal(result.note, undefined);
+  });
+}
+
+// A continuous tilt promises no angle: it runs until stopped or the frame
+// limit ends it.
+test('a continuous tilt up from orbit claims no angle it may not reach', (t) => {
+  withScope(t, false);
+  const { tick } = harness(t, {
+    pitch: -90,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  const result = moveCamera({
+    motion: 'tilt',
+    direction: 'up',
+    mode: 'continuous',
+  });
+  assert.equal(result.ok, true, result.error);
+  assert.equal('pitchDeg' in result, false);
+  assert.equal(result.mode, 'continuous');
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick();
+  assert.equal(getActiveCameraMotion(), null, 'the frame limit ends it');
+});
+
+test('voice turn in place from orbit stops with the planet still on screen', (t) => {
+  withScope(t, false); // the whole frame is visible
+  const { camera, tick } = harness(t, { pitch: -75 });
+  assert.equal(
+    moveCamera({ motion: 'rotate', direction: 'left', mode: 'continuous' }).ok,
+    true,
+  );
+  const heading = camera.heading;
+  for (let i = 0; i < 400 && getActiveCameraMotion(); i += 1) {
+    tick();
+    assert.ok(
+      surfacePixelShare(camera, 1280, 800) >=
+        MIN_GLOBE_FRAME_SHARE - SHARE_SLACK,
+      `tick ${i + 1}`,
+    );
+  }
+  assert.equal(getActiveCameraMotion(), null, 'the turn stops at the limit');
+  assert.notEqual(camera.heading, heading, 'the turn moved before stopping');
+});
+
+test('a long voice turn below the limit keeps the share it started with', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // About 2% of a 16:9 frame on the planet: the limit is that share, less two
+  // grid cells of sampling noise, for the whole motion rather than per step.
+  const { camera, tick } = harness(t, {
+    pitch: -60,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  const start = globeFrameShare(camera);
+  assert.ok(start > 0 && start < MIN_GLOBE_FRAME_SHARE);
+  assert.equal(
+    moveCamera({ motion: 'rotate', direction: 'left', mode: 'continuous' }).ok,
+    true,
+  );
+  for (let i = 0; i < 400 && getActiveCameraMotion(); i += 1) {
+    tick();
+    assert.ok(
+      globeFrameShare(camera) >= start - 2 / (32 * 18) - 1e-9,
+      `tick ${i + 1}`,
+    );
+  }
+  assert.equal(getActiveCameraMotion(), null, 'the turn stops at the limit');
+  assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+});
+
+test('repeated voice turns from one spot cannot each take a little more', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // About 2% of a 16:9 frame on the planet. Every turn from this position is
+  // measured against the same baseline, so asking again stops being allowed.
+  const { camera, finishOnce, tick } = harness(t, {
+    pitch: -60,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  const start = globeFrameShare(camera);
+  const floor = start - 2 / (32 * 18) - 1e-9;
+  const results = [];
+  for (const mode of ['once', 'once', 'continuous', 'once', 'continuous']) {
+    for (let i = 0; i < 4; i += 1) {
+      const result = moveCamera({ motion: 'rotate', direction: 'left', mode });
+      results.push(result.ok);
+      if (!result.ok) continue;
+      if (mode === 'once') finishOnce();
+      else for (let j = 0; j < 400 && getActiveCameraMotion(); j += 1) tick();
+      assert.ok(globeFrameShare(camera) >= floor, `${mode} turn ${i + 1}`);
+    }
+  }
+  assert.ok(results.includes(false), 'a turn at the limit is refused');
+  assert.equal(results.at(-1), false);
+  assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+});
+
+test('a voice turn after something else turned the camera starts over', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // The same spot, first framed straight down, then turned to about 2% of the
+  // frame by something other than voice: a turn left is measured from there.
+  const { camera, finishOnce } = harness(t, {
+    pitch: -90,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  assert.equal(
+    moveCamera({ motion: 'rotate', direction: 'left', mode: 'once' }).ok,
+    true,
+  );
+  finishOnce();
+  camera.setView({
+    orientation: { heading: 0, pitch: radians(-60), roll: 0 },
+  });
+  const start = globeFrameShare(camera);
+  assert.ok(start > 0 && start < MIN_GLOBE_FRAME_SHARE);
+  assert.equal(
+    moveCamera({ motion: 'rotate', direction: 'left', mode: 'once' }).ok,
+    true,
+  );
+  finishOnce();
+  assert.ok(globeFrameShare(camera) >= start - 2 / (32 * 18) - 1e-9);
+});
+
+test('nudging the camera between voice turns cannot take the planet below the 1% floor', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // A wheel notch or an orbit drag between requests starts each turn afresh;
+  // the 1% floor still holds, and below it a turn may only keep what it has.
+  for (const [nudge, pitch] of [
+    [(camera) => camera.moveBackward(2), -60],
+    [(camera) => camera.rotateRight(radians(0.2)), -60],
+    [(camera) => camera.moveBackward(2), -58],
+  ]) {
+    const { camera, tick } = harness(t, {
+      pitch,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    const start = globeFrameShare(camera);
+    const floor = Math.min(0.01, start) - 1e-9;
+    for (let i = 0; i < 12; i += 1) {
+      nudge(camera);
+      if (
+        moveCamera({ motion: 'rotate', direction: 'left', mode: 'continuous' })
+          .ok
+      )
+        for (let j = 0; j < 400 && getActiveCameraMotion(); j += 1) tick();
+      assert.ok(
+        globeFrameShare(camera) >= floor,
+        `start ${start}, turn ${i + 1}`,
+      );
+    }
+    assert.ok(surfacePixelShare(camera, 1600, 900) > 0);
+  }
+});
+
+test('after the frame changes size, a voice turn toward the planet is allowed', (t) => {
+  withScope(t, false); // the whole frame is visible
+  // A tilt stops at its limit; then the window widens at the same pose, so the
+  // frame shows less than the carried limit. Toward the planet must still go.
+  const { camera, canvas, viewer, finishOnce } = harness(t, {
+    pitch: -80,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  assert.equal(
+    moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' }).ok,
+    true,
+  );
+  finishOnce();
+  canvas.clientWidth = canvas.width = viewer.scene.drawingBufferWidth = 3200;
+  camera.frustum.aspectRatio = 3200 / 900;
+  const narrowed = globeFrameShare(camera);
+  assert.ok(narrowed < MIN_GLOBE_FRAME_SHARE, `frame now shows ${narrowed}`);
+
+  const down = moveCamera({ motion: 'tilt', direction: 'down', mode: 'once' });
+  assert.equal(down.ok, true, down.error);
+  finishOnce();
+  assert.ok(globeFrameShare(camera) > narrowed);
+  assert.equal(
+    moveCamera({ motion: 'tilt', direction: 'down', mode: 'once' }).ok,
+    true,
+  );
+  finishOnce();
+  const up = moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' });
+  if (up.ok) finishOnce();
+  assert.ok(surfacePixelShare(camera, 3200, 900) > 0);
+});
+
+test('with the scope on, a voice tilt stops while the keyhole still shows the planet', (t) => {
+  withScope(t, true);
+  const { camera, finishOnce } = harness(t, {
+    pitch: -80,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  const results = [];
+  for (let i = 0; i < 4; i += 1) {
+    const result = moveCamera({
+      motion: 'tilt',
+      direction: 'up',
+      mode: 'once',
+    });
+    results.push(result.ok);
+    if (result.ok) finishOnce();
+    assert.ok(
+      surfacePixelShare(camera, 1600, 900, { keyhole: true }) >=
+        MIN_GLOBE_FRAME_SHARE - SHARE_SLACK,
+      `after tilt ${i + 1}`,
+    );
+  }
+  assert.equal(results[0], true);
+  assert.equal(results.at(-1), false, 'a tilt past the limit is refused');
+});
+
+test('with the scope on, a voice turn cannot leave the planet only in the masked corners', (t) => {
+  // An oblique orbit view: turning in place swings the planet toward a corner,
+  // where the full frame still shows it but the scope mask hides it.
+  for (const [height, pitch] of [
+    [5_000_000, -70],
+    [3_000_000, -75],
+    [18_000_000, -80],
+  ]) {
+    withScope(t, true);
+    const { camera, tick } = harness(t, {
+      height,
+      pitch,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    assert.equal(
+      moveCamera({ motion: 'rotate', direction: 'left', mode: 'continuous' })
+        .ok,
+      true,
+    );
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick();
+    assert.equal(getActiveCameraMotion(), null, 'the turn stops at the limit');
+    assert.ok(
+      surfacePixelShare(camera, 1600, 900, { keyhole: true }) >=
+        MIN_GLOBE_FRAME_SHARE - SHARE_SLACK,
+      `${height / 1000} km at ${pitch}°`,
+    );
+  }
+});
+
+test('far out, a voice tilt is either refused or really moves, at display frame rates', (t) => {
+  // A small planet disc: its sampled share wobbles as it crosses the grid.
+  // Whatever the limit decides, "done" must mean the camera turned, and some
+  // of these tilts must be accepted for that to be checked at all.
+  let accepted = 0;
+  for (const [height, pitch] of FAR_OUT_POSES) {
+    withScope(t, true);
+    const { camera, tick } = harness(t, {
+      latitude: 45.37,
+      longitudeDeg: -33.33,
+      height,
+      heading: 89.9,
+      pitch,
+      viewportWidth: 1280,
+      viewportHeight: 1024,
+    });
+    for (let i = 0; i < 4; i += 1) {
+      const before = camera.pitch;
+      const result = moveCamera({
+        motion: 'tilt',
+        direction: 'up',
+        mode: 'once',
+      });
+      if (!result.ok) {
+        assert.match(result.error, /zoom in first/);
+        continue;
+      }
+      accepted += 1;
+      for (let j = 0; j < 600 && getActiveCameraMotion(); j += 1) tick(1 / 60);
+      assert.ok(
+        camera.pitch - before > radians(0.5) - 1e-9,
+        `${height / 1000} km at ${pitch}°: tilt ${i + 1} reported done but moved ${Cesium.Math.toDegrees(camera.pitch - before)}°`,
+      );
+    }
+    assert.ok(surfacePixelShare(camera, 1280, 1024, { keyhole: true }) > 0);
+  }
+  assert.ok(accepted > 0, 'no far-out tilt was accepted');
+});
+
+test('a voice turn reported as done turns at least the half degree its check proved', (t) => {
+  // A grazing sliver: the first frame's small step lands in a dip of the
+  // sampled share, which used to stop the turn before it moved at all.
+  for (const scope of [true, false]) {
+    withScope(t, scope);
+    const { camera, tick } = harness(t, {
+      latitude: 20,
+      longitudeDeg: 10,
+      height: 18_000_000,
+      pitch: -58,
+      heading: 37,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    const before = Cesium.Cartesian3.clone(camera.directionWC);
+    const result = moveCamera({
+      motion: 'rotate',
+      direction: 'left',
+      mode: 'once',
+    });
+    if (!result.ok) {
+      assert.match(result.error, /globe out of view/);
+      continue;
+    }
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick(1 / 60);
+    const turned = Cesium.Cartesian3.angleBetween(before, camera.directionWC);
+    assert.ok(
+      turned >= radians(0.5) - 1e-9,
+      `scope ${scope ? 'on' : 'off'}: turned ${Cesium.Math.toDegrees(turned)}°`,
+    );
+    assert.ok(surfacePixelShare(camera, 1600, 900, { keyhole: scope }) > 0);
+  }
+});
+
+/** Track an entity below `camera`, locking it into that entity's frame. */
+function trackFrom(viewer, camera) {
+  viewer.trackedEntity = { id: 'high-satellite' };
+  const below = Cesium.Cartesian3.fromDegrees(10, 20, 400_000);
+  camera.lookAtTransform(Cesium.Transforms.eastNorthUpToFixedFrame(below));
+}
+
+test('a voice turn that releases a tracked camera is checked as released', (t) => {
+  // Voice releases the follow camera inside the navigation that runs the
+  // motion, so the request is judged by the pose the release will leave.
+  let accepted = 0;
+  for (const [scope, direction, motion] of [
+    [true, 'up', 'tilt'],
+    [false, 'up', 'tilt'],
+    [false, 'left', 'rotate'],
+  ]) {
+    withScope(t, scope);
+    const { camera, viewer, tick } = harness(t, {
+      latitude: 20,
+      longitudeDeg: 10,
+      height: 18_000_000,
+      pitch: -58,
+      heading: 37,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    trackFrom(viewer, camera);
+    const releaseThenRun = (start) => {
+      viewer.trackedEntity = undefined;
+      camera.lookAtTransform(Cesium.Matrix4.IDENTITY);
+      return start();
+    };
+    const before = Cesium.Cartesian3.clone(camera.directionWC);
+    const result = moveCamera(
+      { motion, direction, mode: 'once' },
+      releaseThenRun,
+    );
+    const label = `${motion} ${direction}, scope ${scope ? 'on' : 'off'}`;
+    if (!result.ok) {
+      assert.match(result.error, /globe out of view/, label);
+      continue;
+    }
+    accepted += 1;
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick(1 / 60);
+    const turned = Cesium.Cartesian3.angleBetween(before, camera.directionWC);
+    assert.ok(turned >= radians(0.5) - 1e-9, `${label}: turned ${turned}`);
+    assert.ok(
+      surfacePixelShare(camera, 1600, 900, { keyhole: scope }) > 0,
+      `${label}: the planet stays on screen`,
+    );
+  }
+  assert.ok(accepted > 0, 'no released turn was accepted');
+});
+
+test('a refused voice turn leaves a tracked camera tracking', (t) => {
+  for (const scope of [true, false]) {
+    withScope(t, scope);
+    const { camera, viewer, tick } = harness(t, {
+      pitch: -80,
+      viewportWidth: 1600,
+      viewportHeight: 900,
+    });
+    // Tilt up to the limit untracked, then track from there.
+    for (let i = 0; i < 40; i += 1) {
+      if (!moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' }).ok)
+        break;
+      for (let j = 0; j < 600 && getActiveCameraMotion(); j += 1) tick(1 / 60);
+    }
+    trackFrom(viewer, camera);
+    const tracked = viewer.trackedEntity;
+    const transform = Cesium.Matrix4.clone(camera.transform);
+    let released = false;
+    const result = moveCamera(
+      { motion: 'tilt', direction: 'up', mode: 'once' },
+      (start) => {
+        released = true;
+        viewer.trackedEntity = undefined;
+        camera.lookAtTransform(Cesium.Matrix4.IDENTITY);
+        return start();
+      },
+    );
+    const label = `scope ${scope ? 'on' : 'off'}`;
+    assert.equal(result.ok, false, label);
+    assert.match(result.error, /globe out of view/, label);
+    assert.equal(released, false, label);
+    assert.equal(viewer.trackedEntity, tracked, label);
+    assert.ok(Cesium.Matrix4.equals(camera.transform, transform), label);
+  }
+});
+
+test('a turn proven at one position is checked again after a release moves the camera', (t) => {
+  withScope(t, false);
+  const { camera, tick } = harness(t, {
+    pitch: -80,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  // Tilt up to the limit, then check from 4,000 km closer along the same view
+  // direction, where the next tilt fits; the release moves the camera back.
+  for (let i = 0; i < 40; i += 1) {
+    if (!moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' }).ok)
+      break;
+    for (let j = 0; j < 600 && getActiveCameraMotion(); j += 1) tick(1 / 60);
+  }
+  camera.moveForward(4_000_000);
+  const result = moveCamera(
+    { motion: 'tilt', direction: 'up', mode: 'once' },
+    (start) => {
+      camera.moveBackward(4_000_000);
+      return start();
+    },
+  );
+  assert.equal(result.ok, false);
+  assert.match(result.error, /globe out of view/);
+});
+
+test('the voice frame limit leaves Columbus view alone', (t) => {
+  // At its limit in 3D a further tilt up is refused; the same tilt in Columbus
+  // view is not limited by the frame.
+  withScope(t, false);
+  const { viewer, finishOnce } = harness(t, {
+    pitch: -80,
+    viewportWidth: 1600,
+    viewportHeight: 900,
+  });
+  assert.equal(
+    moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' }).ok,
+    true,
+  );
+  finishOnce();
+  const refused = moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' });
+  assert.match(refused.error || '', /globe out of view/);
+  viewer.scene.mode = Cesium.SceneMode.COLUMBUS_VIEW;
+  const result = moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' });
+  assert.doesNotMatch(result.error || '', /globe out of view/);
+});
+
+test('voice tilt below the free-look height is not limited by the frame', (t) => {
+  const { camera, finishOnce } = harness(t, { height: 500_000, pitch: -60 });
+  const result = moveCamera({ motion: 'tilt', direction: 'up', mode: 'once' });
+  assert.equal(result.ok, true);
+  finishOnce();
+  near(camera.pitch, radians(-45), 1e-6, 'full 15° tilt');
+});

src/cameraHandoff.test.mjs

@@ -223,11 +223,20 @@ test('validated voice camera destinations share the UI navigation authority faca
     'move camera',
   );
   ordered(move, [
-    "if (!['orbit', 'pan', 'tilt', 'rotate', 'rotate_globe'].includes(motion))",
+    'if (argsError) return argsError;',
     'const start = () => {',
     /const preserveCameraFlight =\s*motion === 'orbit'/,
     'runNavigation(start, { preserveCameraFlight })',
   ], 'move validation before handoff');
+  const moveArgs = body(
+    cameraVerbs,
+    /export function moveCameraArgsError\(args = \{\}\) \{([\s\S]*?)\n\}/,
+    'move camera argument checks',
+  );
+  assert.ok(
+    moveArgs.includes("if (!['orbit', 'pan', 'tilt', 'rotate', 'rotate_globe'].includes(motion))"),
+    'unknown motions are refused before handoff',
+  );
 
   const route = body(
     cameraVerbs,

src/cameraTilt.test.mjs

@@ -0,0 +1,773 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import * as Cesium from 'cesium';
+import {
+  adjustOrbitRange,
+  getActiveCameraMotion,
+  initCameraVerbs,
+  interruptCameraMotion,
+  moveCamera,
+} from './cameraVerbs.js';
+import { createGevActionRunner } from './voice/gevActions.js';
+
+const radians = Cesium.Math.toRadians;
+const degrees = Cesium.Math.toDegrees;
+
+/** Real Cesium camera over London with no renderer: the voice fly-to frame. */
+function harness(
+  t,
+  { height = 4000, heading = 0, pitch = -90, pivot = true } = {},
+) {
+  const realPerformance = globalThis.performance;
+  let nowMs = 0;
+  globalThis.performance = { now: () => nowMs };
+  const canvas = Object.assign(new EventTarget(), {
+    clientWidth: 1280,
+    clientHeight: 800,
+    width: 1280,
+    height: 800,
+  });
+  const ellipsoid = Cesium.Ellipsoid.WGS84;
+  const scene = {
+    canvas,
+    drawingBufferWidth: 1280,
+    drawingBufferHeight: 800,
+    frameState: { mode: Cesium.SceneMode.SCENE3D },
+    mapProjection: new Cesium.GeographicProjection(ellipsoid),
+    globe: { ellipsoid },
+    mapMode2D: Cesium.MapMode2D.INFINITE_SCROLL,
+    mode: Cesium.SceneMode.SCENE3D,
+    pixelRatio: 1,
+    tweens: [],
+    requestRender() {},
+  };
+  const camera = new Cesium.Camera(scene);
+  scene.camera = camera;
+  camera.setView({
+    destination: Cesium.Cartesian3.fromDegrees(-0.1276, 51.5072, height),
+    orientation: { heading: radians(heading), pitch: radians(pitch), roll: 0 },
+  });
+  const viewer = {
+    camera,
+    scene,
+    trackedEntity: undefined,
+    trackedEntityChanged: new Cesium.Event(),
+    clock: { onTick: new Cesium.Event() },
+  };
+  // The app's view target: the ground point under the screen centre.
+  const viewTarget = () => {
+    const ray = new Cesium.Ray(camera.positionWC, camera.directionWC);
+    const hit = Cesium.IntersectionTests.rayEllipsoid(ray, ellipsoid);
+    return hit ? Cesium.Ray.getPoint(ray, hit.start) : undefined;
+  };
+  const target = viewTarget();
+  initCameraVerbs(viewer, pivot ? viewTarget : () => undefined);
+  t.after(() => {
+    interruptCameraMotion('test-cleanup');
+    globalThis.performance = realPerformance;
+  });
+  const tick = (seconds = 1 / 30) => {
+    nowMs += seconds * 1000;
+    viewer.clock.onTick.raiseEvent(viewer.clock);
+  };
+  const finish = () => {
+    for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) tick();
+    assert.equal(getActiveCameraMotion(), null, 'tilt must finish');
+  };
+  return { viewer, camera, target, tick, finish, viewTarget };
+}
+
+const pitchDeg = (camera) => degrees(camera.pitch);
+/** Tick until done() holds; a regression fails here instead of hanging. */
+const tickUntil = (h, done, frames = 600) => {
+  for (let i = 0; i < frames && !done(); i += 1) h.tick();
+  assert.ok(done(), `not reached in ${frames} frames`);
+};
+const headingDeg = (camera) =>
+  degrees(Cesium.Math.negativePiToPi(camera.heading));
+
+/** Metres between the original centre and the ground now under the crosshair. */
+function centreDrift(h) {
+  return Cesium.Cartesian3.distance(h.viewTarget(), h.target);
+}
+
+test('tilt up leaves a top-down view and keeps the place centred', (t) => {
+  const h = harness(t);
+  const result = moveCamera({ motion: 'tilt', direction: 'up' });
+  assert.equal(result.ok, true);
+  h.finish();
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -75) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+  assert.ok(centreDrift(h) < 5, `centre drifted ${centreDrift(h)} m`);
+  assert.ok(Cesium.Matrix4.equals(h.camera.transform, Cesium.Matrix4.IDENTITY));
+});
+
+test('continuous tilt up from top-down keeps moving', (t) => {
+  const h = harness(t);
+  assert.equal(
+    moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' }).ok,
+    true,
+  );
+  for (let i = 0; i < 30; i += 1) h.tick();
+  assert.equal(getActiveCameraMotion()?.kind, 'tilt');
+  assert.ok(pitchDeg(h.camera) > -82, `pitch ${pitchDeg(h.camera)}`);
+});
+
+test('a requested angle tilts to that pitch', (t) => {
+  const h = harness(t);
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -45 });
+  assert.equal(result.ok, true);
+  assert.equal(result.direction, 'up');
+  assert.equal(result.pitchDeg, -45);
+  h.finish();
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -45) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+  assert.ok(centreDrift(h) < 5, `centre drifted ${centreDrift(h)} m`);
+});
+
+test('a bare tilt settles on the default oblique angle', (t) => {
+  const h = harness(t);
+  const result = moveCamera({ motion: 'tilt' });
+  assert.equal(result.ok, true);
+  assert.equal(result.pitchDeg, -45);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -45) < 0.5);
+});
+
+test('a requested angle can tilt back down toward top-down', (t) => {
+  const h = harness(t, { pitch: -30 });
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -80 });
+  assert.equal(result.direction, 'down');
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -80) < 0.5);
+});
+
+test('requested angles clamp to the tilt limits', (t) => {
+  const h = harness(t);
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -2 }).pitchDeg, -5);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -5) < 0.5);
+});
+
+test('a positive angle is read as the same angle below the horizon', (t) => {
+  const h = harness(t);
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: 45 }).pitchDeg, -45);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -45) < 0.5);
+});
+
+for (const pitch of ['', null, false, ' ', 'steep'])
+  test(`a blank or non-numeric angle ${JSON.stringify(pitch)} is ignored`, (t) => {
+    harness(t);
+    const result = moveCamera({ motion: 'tilt', pitchDeg: pitch });
+    // No angle and no direction: the default oblique view, never the horizon.
+    assert.equal(result.pitchDeg, -45);
+  });
+
+test('a requested angle the camera already holds is a no-op', (t) => {
+  harness(t, { pitch: -45 });
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -45 });
+  assert.equal(result.ok, true);
+  assert.equal(result.unchanged, true);
+  assert.equal(getActiveCameraMotion(), null);
+});
+
+for (const pitch of [-90, -89]) {
+  test(`a top-down view asked for ${pitch}° stays put`, (t) => {
+    // The tool description calls -89 top-down; the clamp must not tilt a
+    // -90° view up 1° and report it as a move up.
+    const h = harness(t);
+    const before = pitchDeg(h.camera);
+    const result = moveCamera({ motion: 'tilt', pitchDeg: pitch });
+    assert.equal(result.ok, true);
+    assert.equal(result.unchanged, true);
+    assert.equal(result.pitchDeg, Math.round(before));
+    assert.equal(getActiveCameraMotion(), null);
+    assert.equal(pitchDeg(h.camera), before);
+  });
+}
+
+test('tilt down from top-down still refuses honestly', (t) => {
+  harness(t);
+  const result = moveCamera({ motion: 'tilt', direction: 'down' });
+  assert.equal(result.ok, false);
+  assert.match(result.error, /straight down/);
+});
+
+test('a tilt up nudge stops at the horizon limit', (t) => {
+  const h = harness(t, { pitch: -12 });
+  assert.equal(moveCamera({ motion: 'tilt', direction: 'up' }).ok, true);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -5) < 0.5);
+});
+
+test('without a ground pivot a tilt still leaves top-down in place', (t) => {
+  const h = harness(t, { pivot: false });
+  const before = Cesium.Cartesian3.clone(h.camera.positionWC);
+  assert.equal(moveCamera({ motion: 'tilt', direction: 'up' }).ok, true);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -75) < 0.5);
+  assert.ok(Cesium.Cartesian3.distance(h.camera.positionWC, before) < 1e-6);
+});
+
+for (const heading of [0, 30, -120])
+  test(`tilt from top-down keeps the ${heading}° heading`, (t) => {
+    const h = harness(t, { heading, height: 67000 });
+    // Top-down float noise must not pick a new heading for the pivot.
+    assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -45 }).ok, true);
+    h.finish();
+    assert.ok(
+      Math.abs(headingDeg(h.camera) - heading) < 1,
+      `heading ${headingDeg(h.camera)}`,
+    );
+    assert.ok(centreDrift(h) < 50, `centre drifted ${centreDrift(h)} m`);
+  });
+
+test('an oblique tilt keeps its heading toward the pivot', (t) => {
+  const h = harness(t, { heading: 75, pitch: -60 });
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -30 }).ok, true);
+  h.finish();
+  assert.ok(Math.abs(headingDeg(h.camera) - 75) < 0.5);
+  assert.ok(centreDrift(h) < 5, `centre drifted ${centreDrift(h)} m`);
+});
+
+test('a pivoting tilt yields when tracking takes the camera', (t) => {
+  const h = harness(t);
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -45 }).ok, true);
+  h.tick();
+  const entity = { id: 'tracked' };
+  h.viewer.trackedEntity = entity;
+  h.viewer.trackedEntityChanged.raiseEvent(entity);
+  assert.equal(getActiveCameraMotion(), null);
+});
+
+/** Metres between the camera and the point it pivots about. */
+const pivotRange = (h) =>
+  Cesium.Cartesian3.distance(h.camera.positionWC, h.target);
+const heightM = (camera) =>
+  Cesium.Cartographic.fromCartesian(camera.positionWC).height;
+
+test('a zoom during a pivoting tilt changes the range it holds', (t) => {
+  const h = harness(t);
+  assert.equal(
+    moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' }).ok,
+    true,
+  );
+  h.tick();
+  const before = pivotRange(h);
+  assert.deepEqual(
+    adjustOrbitRange(0.5),
+    { kind: 'tilt', changed: true },
+    'the tilt must take the zoom',
+  );
+  for (let i = 0; i < 5; i += 1) h.tick();
+  // The next frame's lookAt must not put the old range back.
+  assert.ok(
+    Math.abs(pivotRange(h) - before / 2) < 1,
+    `range ${pivotRange(h)} m, wanted ${before / 2} m`,
+  );
+});
+
+test('a zoom with no pivot to hold is left to the camera', (t) => {
+  harness(t, { pivot: false });
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  assert.equal(adjustOrbitRange(0.5), null);
+});
+
+test('a pivot tilt toward the horizon keeps its clearance above the ground', (t) => {
+  // A close top-down view: swinging 250 m of range to -5° would end ~22 m up.
+  const h = harness(t, { height: 250 });
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -5 }).ok, true);
+  let lowest = Infinity;
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    lowest = Math.min(lowest, heightM(h.camera));
+  }
+  assert.equal(getActiveCameraMotion(), null, 'tilt must finish');
+  assert.ok(lowest > 149, `camera dropped to ${lowest} m`);
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -5) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+  assert.ok(Cesium.Matrix4.equals(h.camera.transform, Cesium.Matrix4.IDENTITY));
+});
+
+test('a continuous tilt up from close in keeps its clearance', (t) => {
+  const h = harness(t, { height: 250 });
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    assert.ok(heightM(h.camera) > 149, `camera at ${heightM(h.camera)} m`);
+  }
+  assert.ok(Math.abs(pitchDeg(h.camera) - -5) < 0.5);
+});
+
+test('a city-scale pivot tilt keeps the place centred to the horizon limit', (t) => {
+  const h = harness(t);
+  moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  h.finish();
+  // 4 km of range clears the floor at every pitch: all pivot, no drift.
+  assert.ok(centreDrift(h) < 5, `centre drifted ${centreDrift(h)} m`);
+});
+
+test('pitchDeg against a contradicting direction is refused', (t) => {
+  harness(t, { pitch: -45 });
+  // "tilt down 10 degrees": -10° is an absolute angle, which is up from -45°.
+  const result = moveCamera({
+    motion: 'tilt',
+    direction: 'down',
+    pitchDeg: 10,
+  });
+  assert.equal(result.ok, false);
+  assert.match(result.error, /absolute angle/);
+  assert.equal(getActiveCameraMotion(), null);
+});
+
+test('pitchDeg with a direction that agrees still tilts', (t) => {
+  const h = harness(t, { pitch: -45 });
+  const result = moveCamera({
+    motion: 'tilt',
+    direction: 'down',
+    pitchDeg: -80,
+  });
+  assert.equal(result.ok, true);
+  assert.equal(result.direction, 'down');
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -80) < 0.5);
+});
+
+test('the pitchDeg and direction check uses the camera pitch', (t) => {
+  // At regional range the Earth curves away and the pivot pitch is a degree
+  // or two shallower than the camera's (-30°); -29° is still up from it.
+  harness(t, { height: 150000, pitch: -30 });
+  const down = moveCamera({ motion: 'tilt', direction: 'down', pitchDeg: -29 });
+  assert.equal(down.ok, false);
+  assert.match(down.error, /tilts up, not down/);
+  const up = moveCamera({ motion: 'tilt', direction: 'up', pitchDeg: -29 });
+  assert.equal(up.ok, true);
+  assert.equal(up.direction, 'up');
+});
+
+test('after a zoom in, a pivoting tilt never lowers the camera further', (t) => {
+  const h = harness(t, { height: 1000 });
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  tickUntil(h, () => pitchDeg(h.camera) >= -30);
+  adjustOrbitRange(1 / 2.4);
+  adjustOrbitRange(1 / 2.4);
+  h.tick();
+  const afterZoom = heightM(h.camera);
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    assert.ok(
+      heightM(h.camera) > afterZoom - 1,
+      `camera fell from ${afterZoom} m to ${heightM(h.camera)} m`,
+    );
+  }
+  assert.ok(Math.abs(pitchDeg(h.camera) - -5) < 0.5);
+});
+
+test('a zoom in during a close pivot tilt never pushes the camera out', (t) => {
+  // 62 m of range, under the 80 m zoom floor.
+  const h = harness(t, { height: 40, pitch: -40 });
+  moveCamera({ motion: 'tilt', direction: 'down', mode: 'continuous' });
+  h.tick();
+  const before = pivotRange(h);
+  assert.ok(before < 80, `range ${before} m`);
+  adjustOrbitRange(1 / 1.6);
+  h.tick();
+  assert.ok(pivotRange(h) <= before + 0.01, `range grew to ${pivotRange(h)} m`);
+});
+
+test('a zoom out during a far orbit never pulls the camera in', (t) => {
+  // 15,000 km up, beyond the 5,000 km zoom cap.
+  const h = harness(t, { height: 15_000_000 });
+  assert.equal(moveCamera({ motion: 'orbit', mode: 'continuous' }).ok, true);
+  h.tick();
+  const before = pivotRange(h);
+  assert.ok(before > 5_000_000, `range ${before} m`);
+  assert.deepEqual(adjustOrbitRange(2.4), { kind: 'orbit', changed: false });
+  h.tick();
+  assert.ok(pivotRange(h) >= before - 1, `range fell to ${pivotRange(h)} m`);
+});
+
+test('an out-of-range pitchDeg is clamped to the tilt limits', (t) => {
+  // The schema carries no range; 120 reads as 120° below the horizon.
+  const h = harness(t, { pitch: -45 });
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: 120 }).ok, true);
+  h.finish();
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -89) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+});
+
+test('a zoom in during a pivot tilt stops at the clearance', (t) => {
+  // 400 m of range at -40°, then "zoom in a lot" twice: unfloored, that left
+  // the camera about 107 m up, then at the 80 m zoom floor.
+  const h = harness(t, { height: 400 });
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  tickUntil(h, () => pitchDeg(h.camera) >= -40);
+  assert.deepEqual(adjustOrbitRange(1 / 2.4), { kind: 'tilt', changed: true });
+  // At -40° the floor is 150 / sin 40° ≈ 233 m, which the first zoom reached.
+  assert.deepEqual(adjustOrbitRange(1 / 2.4), { kind: 'tilt', changed: false });
+  // The camera must take that range, not just report it.
+  h.tick();
+  const floor = 150 / Math.sin(radians(40));
+  assert.ok(
+    Math.abs(pivotRange(h) - floor) < floor * 0.02,
+    `range ${pivotRange(h)} m, wanted about ${floor} m`,
+  );
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    assert.ok(heightM(h.camera) > 149, `camera at ${heightM(h.camera)} m`);
+  }
+  assert.ok(Math.abs(pitchDeg(h.camera) - -5) < 0.5);
+});
+
+test('a voice zoom during a pivot tilt says what it changed', async (t) => {
+  const h = harness(t, { height: 400 });
+  const runner = createGevActionRunner({
+    viewer: h.viewer,
+    styleManager: {},
+    dataManager: { layers: new Map(), getAll: () => [] },
+  });
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  h.tick();
+  const zoom = { direction: 'in', amount: 'lot' };
+  const first = await runner('adjust_camera_zoom', zoom);
+  assert.equal(first.ok, true);
+  assert.equal(first.tiltRangeAdjusted, true);
+  assert.equal('orbitRadiusAdjusted' in first, false);
+  // 400 m → 167 m → the 150 m clearance; a third zoom in moves nothing, and
+  // says so.
+  assert.equal((await runner('adjust_camera_zoom', zoom)).ok, true);
+  const third = await runner('adjust_camera_zoom', zoom);
+  assert.equal(third.ok, false);
+  assert.match(third.error, /tilt is already at its closest range/);
+});
+
+test('from globe range a tilt happens in place', (t) => {
+  // A pivot 2,000 km out would swing the camera thousands of km.
+  const h = harness(t, { height: 2_000_000 });
+  const before = Cesium.Cartesian3.clone(h.camera.positionWC);
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -45 }).ok, true);
+  h.finish();
+  assert.ok(Math.abs(pitchDeg(h.camera) - -45) < 0.5);
+  assert.ok(Cesium.Cartesian3.distance(h.camera.positionWC, before) < 1e-3);
+});
+
+for (const height of [100_000, 400_000])
+  test(`from ${height / 1000} km a tilt to -5° ends with the camera at -5°`, (t) => {
+    // The pivot pitch is shallower than the camera's by up to 4° at this
+    // range; the camera reached only -5.9° and -8.6° when the swing stopped
+    // at a pivot pitch of -5°.
+    const h = harness(t, { height });
+    const result = moveCamera({ motion: 'tilt', pitchDeg: 5 });
+    assert.equal(result.pitchDeg, -5);
+    h.finish();
+    assert.ok(
+      Math.abs(pitchDeg(h.camera) - -5) < 0.5,
+      `pitch ${pitchDeg(h.camera)}`,
+    );
+    assert.ok(heightM(h.camera) > 149, `camera at ${heightM(h.camera)} m`);
+    const nudge = moveCamera({ motion: 'tilt', direction: 'up' });
+    assert.equal(nudge.ok, false);
+    assert.match(nudge.error, /upper tilt limit/);
+  });
+
+// From 550 km out the camera's -5° lies beyond the place's own horizon: the
+// swing ran into its clearance, let go of the pivot and tilted the rest in
+// place, which put the crosshair on the sky (28 to 63 km up), and a return
+// to top-down then landed 600 to 900 km from the place.
+for (const height of [600_000, 700_000, 900_000]) {
+  test(`from ${height / 1000} km a tilt to -5° keeps the place centred`, (t) => {
+    const h = harness(t, { height });
+    const result = moveCamera({ motion: 'tilt', pitchDeg: 5 });
+    assert.equal(result.ok, true);
+    h.finish();
+    assert.ok(h.viewTarget(), 'the crosshair is on the sky');
+    assert.ok(centreDrift(h) < 100, `centre drifted ${centreDrift(h)} m`);
+    assert.ok(heightM(h.camera) > 149, `camera at ${heightM(h.camera)} m`);
+    // The reply names the angle the camera reached, not the one asked for.
+    assert.ok(result.pitchDeg < -5, `reported ${result.pitchDeg}°`);
+    assert.ok(
+      Math.abs(pitchDeg(h.camera) - result.pitchDeg) < 0.5,
+      `camera at ${pitchDeg(h.camera)}°, reported ${result.pitchDeg}°`,
+    );
+    assert.match(result.note, /horizon/);
+    const nudge = moveCamera({ motion: 'tilt', direction: 'up' });
+    assert.equal(nudge.ok, false);
+    assert.match(nudge.error, /upper tilt limit/);
+    assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -89 }).ok, true);
+    h.finish();
+    assert.ok(centreDrift(h) < 100, `centre drifted ${centreDrift(h)} m`);
+    // Back over the place at the range it began with (-89° is ~1° off nadir).
+    const range = Cesium.Cartesian3.distance(h.camera.positionWC, h.target);
+    assert.ok(
+      Math.abs(range - height) < height * 0.01,
+      `top-down ${range} m from the place`,
+    );
+  });
+
+  test(`a continuous tilt up from ${height / 1000} km stops with the place centred`, (t) => {
+    const h = harness(t, { height });
+    moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+    for (let i = 0; i < 1200 && getActiveCameraMotion(); i += 1) {
+      h.tick();
+      assert.ok(h.viewTarget(), `the crosshair is on the sky at frame ${i}`);
+    }
+    assert.equal(getActiveCameraMotion(), null, 'tilt must stop at its limit');
+    assert.ok(centreDrift(h) < 100, `centre drifted ${centreDrift(h)} m`);
+  });
+}
+
+test('a pitchDeg tilt toward the horizon limit says it is already there', (t) => {
+  const h = harness(t, { height: 900_000 });
+  moveCamera({ motion: 'tilt', pitchDeg: 5 });
+  h.finish();
+  const again = moveCamera({ motion: 'tilt', pitchDeg: 5 });
+  assert.equal(again.ok, false);
+  assert.match(again.error, /upper tilt limit/);
+});
+
+test('a regional tilt-up nudge goes to the camera horizon limit', (t) => {
+  // 20 km up at -7°: the pivot 186 km out sits at -5.3°, but the camera can
+  // still tilt up 2°.
+  const h = harness(t, { height: 20000, pitch: -7 });
+  assert.equal(moveCamera({ motion: 'tilt', direction: 'up' }).ok, true);
+  h.finish();
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -5) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+});
+
+test('a voice tilt from a tracked view judges its limit from the camera pitch', (t) => {
+  const h = harness(t, { height: 20000, pitch: -5.2 });
+  h.viewer.trackedEntity = { id: 'tracked' };
+  // Voice releases the follow camera before the motion starts.
+  const release = (start) => {
+    h.viewer.trackedEntity = undefined;
+    return start();
+  };
+  const result = moveCamera({ motion: 'tilt', direction: 'up' }, release);
+  assert.equal(result.ok, false);
+  assert.match(result.error, /upper tilt limit/);
+});
+
+test('a zoom out during a pivoting tilt stops at the pivot range limit', (t) => {
+  // 900 km top-down, "tilt to 10°", then "zoom out a lot" twice: capped at
+  // the orbit's 5,000 km, the swing reached 2,386 km up at a real -44°.
+  const h = harness(t, { height: 900_000 });
+  assert.equal(moveCamera({ motion: 'tilt', pitchDeg: -10 }).ok, true);
+  h.tick();
+  assert.deepEqual(adjustOrbitRange(2.4), { kind: 'tilt', changed: true });
+  assert.deepEqual(adjustOrbitRange(2.4), { kind: 'tilt', changed: false });
+  let farthest = 0;
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    farthest = Math.max(farthest, pivotRange(h));
+  }
+  assert.equal(getActiveCameraMotion(), null, 'tilt must finish');
+  assert.ok(farthest <= 1_000_001, `swung ${farthest} m from the pivot`);
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -10) < 0.5,
+    `pitch ${pitchDeg(h.camera)}`,
+  );
+});
+
+test('an unchanged angle still stops a running motion through navigation', (t) => {
+  const h = harness(t);
+  moveCamera({ motion: 'tilt', direction: 'up', mode: 'continuous' });
+  tickUntil(h, () => pitchDeg(h.camera) >= -45.3);
+  let handoffs = 0;
+  const navigate = (start) => {
+    handoffs += 1;
+    return start();
+  };
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -45 }, navigate);
+  assert.equal(result.ok, true);
+  assert.equal(result.unchanged, true);
+  assert.equal(handoffs, 1, 'the request must take navigation');
+  assert.equal(getActiveCameraMotion(), null, 'the tilt must stop');
+  const held = pitchDeg(h.camera);
+  for (let i = 0; i < 30; i += 1) h.tick();
+  assert.equal(pitchDeg(h.camera), held);
+});
+
+for (const direction of ['left', 'right'])
+  test(`a tilt ${direction} is refused`, (t) => {
+    harness(t, { pitch: -45 });
+    const result = moveCamera({ motion: 'tilt', direction });
+    assert.equal(result.ok, false);
+    assert.match(result.error, /tilt needs up or down/);
+    const angled = moveCamera({ motion: 'tilt', direction, pitchDeg: -30 });
+    assert.equal(angled.ok, false);
+    assert.match(angled.error, /pitchDeg alone/);
+    assert.equal(getActiveCameraMotion(), null);
+  });
+
+// The 1,000 km pivot cutoff includes its boundary: at exactly 1,000 km the
+// pivot range came back a hair over it, so the tilt ran in place and put the
+// crosshair on the sky.
+test('from exactly 1,000 km a tilt to -5° still pivots about the place', (t) => {
+  const h = harness(t, { height: 1_000_000 });
+  const result = moveCamera({ motion: 'tilt', pitchDeg: 5 });
+  assert.equal(result.ok, true);
+  h.finish();
+  assert.ok(h.viewTarget(), 'the crosshair is on the sky');
+  assert.ok(centreDrift(h) < 100, `centre drifted ${centreDrift(h)} m`);
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - result.pitchDeg) < 0.5,
+    `camera at ${pitchDeg(h.camera)}°, reported ${result.pitchDeg}°`,
+  );
+  assert.match(result.note, /horizon/);
+});
+
+// A zoom mid-tilt moves the pivot's horizon limit: the zoom's reply names the
+// angle the tilt now ends at, and the camera ends there.
+test('a zoom out during a tilt to an angle reports the angle it now ends at', (t) => {
+  const h = harness(t, { height: 400_000 });
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  assert.equal(result.pitchDeg, -5);
+  assert.equal(result.note, undefined);
+  for (let i = 0; i < 10; i += 1) h.tick();
+  const zoom = adjustOrbitRange(2.5);
+  assert.equal(zoom.kind, 'tilt');
+  assert.equal(zoom.changed, true);
+  h.finish();
+  assert.ok(h.viewTarget(), 'the crosshair is on the sky');
+  assert.ok(zoom.pitchDeg < -5, `zoom reported ${zoom.pitchDeg}°`);
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - zoom.pitchDeg) < 0.5,
+    `camera at ${pitchDeg(h.camera)}°, zoom reported ${zoom.pitchDeg}°`,
+  );
+  assert.match(zoom.note, /horizon/);
+});
+
+test('a zoom in during a horizon-limited tilt reports the angle it now reaches', (t) => {
+  const h = harness(t, { height: 900_000 });
+  const result = moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  assert.ok(result.pitchDeg < -5, `reported ${result.pitchDeg}°`);
+  for (let i = 0; i < 10; i += 1) h.tick();
+  const zoom = adjustOrbitRange(1 / 2.4);
+  assert.equal(zoom.changed, true);
+  h.finish();
+  assert.equal(zoom.pitchDeg, -5);
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - -5) < 0.5,
+    `camera at ${pitchDeg(h.camera)}°`,
+  );
+});
+
+test('a voice zoom during a tilt to an angle passes on the new end angle', async (t) => {
+  const h = harness(t, { height: 400_000 });
+  const runner = createGevActionRunner({
+    viewer: h.viewer,
+    styleManager: {},
+    dataManager: { layers: new Map(), getAll: () => [] },
+  });
+  moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  for (let i = 0; i < 10; i += 1) h.tick();
+  const zoom = await runner('adjust_camera_zoom', {
+    direction: 'out',
+    amount: 'lot',
+  });
+  assert.equal(zoom.ok, true);
+  assert.equal(zoom.tiltRangeAdjusted, true);
+  h.finish();
+  assert.ok(
+    Math.abs(pitchDeg(h.camera) - zoom.pitchDeg) < 0.5,
+    `camera at ${pitchDeg(h.camera)}°, zoom reported ${zoom.pitchDeg}°`,
+  );
+  assert.match(zoom.note, /horizon/);
+});
+
+// Late in the tilt the camera is already past the angle the new range's
+// horizon allows (from 400 km at -8°, a zoom out x2.5 reported -8°): past it
+// the place is behind the Earth, so the camera steps down to that limit with
+// the zoom, then holds it with no further jump, and the zoom's reply names
+// the angle it ends at, not the one it stood at.
+test('a late zoom out during a tilt steps to the new limit and reports it', (t) => {
+  const h = harness(t, { height: 400_000 });
+  moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  for (let i = 0; i < 70; i += 1) h.tick();
+  const zoom = adjustOrbitRange(2.5);
+  assert.equal(zoom.changed, true);
+  h.tick();
+  assert.equal(zoom.pitchDeg, Math.round(pitchDeg(h.camera)));
+  let last = pitchDeg(h.camera);
+  let maxStep = 0;
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    maxStep = Math.max(maxStep, Math.abs(pitchDeg(h.camera) - last));
+    last = pitchDeg(h.camera);
+  }
+  assert.equal(getActiveCameraMotion(), null, 'tilt must finish');
+  assert.ok(maxStep < 0.1, `pitch jumped ${maxStep}° in one frame`);
+  assert.ok(h.viewTarget(), 'the crosshair is on the sky');
+  // Replies give whole degrees: the reported angle is the reached one rounded.
+  assert.equal(
+    zoom.pitchDeg,
+    Math.round(pitchDeg(h.camera)),
+    `camera at ${pitchDeg(h.camera)}°, zoom reported ${zoom.pitchDeg}°`,
+  );
+  assert.match(zoom.note, /horizon/);
+});
+
+// Easing from the camera's old pitch at the zoomed-out range put the camera
+// below the place's horizon: the first frame's crosshair hit the ground
+// 186 km from London, and London stayed hidden for ~11 frames.
+test('a late zoom out during a tilt keeps the place under the crosshair', (t) => {
+  const h = harness(t, { height: 400_000 });
+  moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  for (let i = 0; i < 70; i += 1) h.tick();
+  const zoom = adjustOrbitRange(2.5);
+  assert.equal(zoom.changed, true);
+  for (let i = 0; i < 600 && getActiveCameraMotion(); i += 1) {
+    h.tick();
+    const hit = h.viewTarget();
+    assert.ok(hit, `frame ${i}: the crosshair is on the sky`);
+    const drift = centreDrift(h);
+    assert.ok(
+      drift < 100,
+      `frame ${i}: crosshair ${Math.round(drift)} m off the place`,
+    );
+  }
+  assert.equal(getActiveCameraMotion(), null, 'tilt must finish');
+  assert.ok(
+    Math.abs(pivotRange(h) - 1_000_000) < 1,
+    `range ${pivotRange(h)} m`,
+  );
+  assert.equal(
+    zoom.pitchDeg,
+    Math.round(pitchDeg(h.camera)),
+    `camera at ${pitchDeg(h.camera)}°, zoom reported ${zoom.pitchDeg}°`,
+  );
+  assert.match(zoom.note, /horizon/);
+});
+
+// The zoom out left the pivot pitch level with the place, so the zoom in's
+// clearance floor came out infinite and it was refused at 1,000 km.
+test('a zoom in right after a late zoom out brings the tilt back in', (t) => {
+  const h = harness(t, { height: 400_000 });
+  moveCamera({ motion: 'tilt', pitchDeg: -5 });
+  for (let i = 0; i < 70; i += 1) h.tick();
+  const range = pivotRange(h);
+  assert.equal(adjustOrbitRange(2.5).changed, true);
+  const zoomIn = adjustOrbitRange(0.4);
+  assert.equal(zoomIn.changed, true, 'the zoom in must not be refused');
+  h.finish();
+  assert.ok(
+    Math.abs(pivotRange(h) - range) < 1,
+    `range ${pivotRange(h)} m, wanted ${range} m`,
+  );
+  assert.ok(
+    centreDrift(h) < 100,
+    `crosshair ${centreDrift(h)} m off the place`,
+  );
+});

src/cameraVerbs.js

@@ -20,11 +20,19 @@
 
 import * as Cesium from 'cesium';
 import { GLOBE_VIEW } from './locations.js';
+import {
+  globeFrameShare,
+  isFreeGlobeCamera,
+  lookAngleWithinFrame,
+  lookStepLosesGlobe,
+} from './globeInView.js';
 import {
   projectEarthDiscToViewport,
   earthDiscScreenRadius,
   getKeyholeGeometry,
+  KEYHOLE_OUTER_RADIUS,
 } from './celestialRing.js';
+import { isScopeMaskEnabled } from './scopeMask.js';
 import {
   holdContinuousRender,
   releaseContinuousRender,
@@ -48,6 +56,33 @@ const ONCE = {
 };
 const PITCH_MIN = Cesium.Math.toRadians(-89);
 const PITCH_MAX = Cesium.Math.toRadians(-5);
+/** A bare "tilt the camera" / "oblique view" settles here. */
+const TILT_DEFAULT_PITCH_DEG = -45;
+/** °/s for a tilt to a requested angle; short ones keep the once duration. */
+const TILT_TO_DEG_S = 30;
+/**
+ * A pivoting tilt keeps the range, so its height above the pivot is
+ * range × sin|pitch|. It swings no lower than this; the rest tilts in place.
+ */
+const TILT_MIN_CLEARANCE_M = 150;
+/**
+ * Beyond this range a pivot would swing the camera thousands of km about the
+ * crosshair point, so the tilt happens in place instead.
+ */
+const TILT_PIVOT_MAX_RANGE_M = 1_000_000;
+/**
+ * A pivot range rebuilt from the camera's position comes back a hair off the
+ * range it was set at: a range this close past the cutoff still counts as on
+ * it.
+ */
+const TILT_PIVOT_RANGE_SLACK_M = 1;
+/**
+ * The shallowest a pivot swing goes when its clearance is not what stops it.
+ * From several hundred km the camera's own horizon limit lies past the
+ * place's horizon; tilting the rest in place there would lift the crosshair
+ * onto the sky, so the swing stops with the place this far above it.
+ */
+const TILT_MIN_PIVOT_ELEVATION = Cesium.Math.toRadians(0.5);
 
 /* ── Route dolly: cinematic tuning ──────────────────────────────────────────
  * Every knob an owner may want to retune lives in this block. The shaping is
@@ -966,6 +1001,17 @@ let _trackingRemover = null;
 let _inputRemovers = [];
 /** Monotonic id for the motion currently running; 0 means "no motion". */
 let _motionSeq = 0;
+/** Canvas grabs, touches and wheel turns since load. */
+let _manualInputCount = 0;
+
+/**
+ * Lets a caller holding a motion back (behind a fly-to) see whether the user
+ * took the camera meanwhile; Cesium does not cancel a flight on input.
+ * @returns {number} Manual camera inputs so far.
+ */
+export function manualCameraInputCount() {
+  return _manualInputCount;
+}
 
 /**
  * Install a motion and stamp it with a fresh id. The id is what lets a caller
@@ -1008,6 +1054,187 @@ export function interruptCameraMotionIfActive(
   return interruptCameraMotion(reason);
 }
 
+// The frame share that in-place voice turns measure their limit against, with
+// the pose the last voice turn left the camera in. A turn that starts where
+// the last one left off keeps that baseline (raised if the planet now fills
+// more of the frame), so repeating a request cannot take a little more each
+// time. Once anything else has moved or turned the camera, a turn starts over
+// from what is on screen.
+let _lookBaseline = null;
+
+// The pre-check's proof that a half-degree turn from this pose keeps the planet
+// in view: which way, from which position and direction. A motion that starts from that
+// pose turns at least that far, so a request reported as done really moves
+// even when a smaller first step lands in a dip of the sampled share.
+const PROVEN_TURN_RAD = Cesium.Math.toRadians(0.5);
+let _provenLook = null;
+
+/** The part of the frame a viewer can see: the scope keyhole when it is on. */
+function visibleFrame() {
+  return { keyholeRadius: isScopeMaskEnabled() ? KEYHOLE_OUTER_RADIUS : 0 };
+}
+
+/** The frame share an in-place turn from `cam`'s pose is limited against. */
+function lookBaselineShare(cam) {
+  const share = globeFrameShare(cam, visibleFrame());
+  const continues =
+    _lookBaseline &&
+    Cesium.Cartesian3.equalsEpsilon(
+      _lookBaseline.position,
+      cam.positionWC,
+      0,
+      1,
+    ) &&
+    Cesium.Cartesian3.equalsEpsilon(
+      _lookBaseline.direction,
+      cam.directionWC,
+      0,
+      1e-9,
+    );
+  _lookBaseline = {
+    position: Cesium.Cartesian3.clone(cam.positionWC),
+    direction: Cesium.Cartesian3.clone(cam.directionWC),
+    share: continues ? Math.max(_lookBaseline.share, share) : share,
+  };
+  return _lookBaseline.share;
+}
+
+/**
+ * One in-place look step of motion `m`. From orbit a free globe camera turns
+ * only as far as keeps the planet in frame, measured against the baseline the
+ * turn started from, then the motion ends there.
+ */
+function lookWithinFrame(cam, m, look, angle) {
+  let allowed = angle;
+  if (isFreeGlobeCamera(_viewer)) {
+    if (m.globeShareAtStart === undefined) {
+      m.globeShareAtStart = lookBaselineShare(cam);
+      m.provenTurnRad = lookProven(cam, look) ? PROVEN_TURN_RAD : 0;
+      m.turnedRad = 0;
+    }
+    _provenLook = null;
+    allowed = lookAngleWithinFrame(cam, look, angle, {
+      ...visibleFrame(),
+      startShare: m.globeShareAtStart,
+    });
+    const owed = Math.min(angle, m.provenTurnRad - m.turnedRad);
+    if (allowed < owed) allowed = owed;
+    m.turnedRad += allowed;
+  }
+  if (allowed > 0) cam[look](allowed);
+  // The pose this turn leaves, for a turn that continues from it.
+  if (_lookBaseline)
+    Cesium.Cartesian3.clone(cam.directionWC, _lookBaseline.direction);
+  if (allowed < angle) interruptCameraMotion('globe-out-of-frame');
+}
+
+/**
+ * The in-place look a pitch change from `fromPitch` to `goalPitch` makes:
+ * 'lookUp', 'lookDown', or null when it does not move. A tilt is judged by
+ * the way its pitch moves, whatever form or direction word it came in.
+ */
+function tiltLook(fromPitch, goalPitch) {
+  if (!Number.isFinite(fromPitch) || !Number.isFinite(goalPitch)) return null;
+  if (goalPitch > fromPitch) return 'lookUp';
+  return goalPitch < fromPitch ? 'lookDown' : null;
+}
+
+/** Tilt `m` in place to `goalPitch`, as far as the frame limit allows. */
+function tiltInPlaceWithinFrame(cam, m, goalPitch) {
+  const look = tiltLook(cam.pitch, goalPitch);
+  if (look) lookWithinFrame(cam, m, look, Math.abs(goalPitch - cam.pitch));
+}
+
+/**
+ * The pitch an in-place tilt from `cam`'s pose toward `goalPitch` reaches
+ * before the frame limit stops it, judged as its steps will be: `goalPitch`
+ * itself when the planet stays in frame the whole way, or the camera is not a
+ * free globe camera. The steps run on a copy of the camera, each looking by
+ * the pitch still to go as the tilt's frames do, because a rolled camera's
+ * look turns its pitch by less than the look angle.
+ */
+function tiltPitchWithinFrame(cam, goalPitch) {
+  const look = tiltLook(cam.pitch, goalPitch);
+  if (!look || !isFreeGlobeCamera(_viewer)) return goalPitch;
+  const frame = { ...visibleFrame(), startShare: lookBaselineShare(cam) };
+  // A proven half degree is turned whatever the sampled share says.
+  let owed = lookProven(cam, look) ? PROVEN_TURN_RAD : 0;
+  const probe = Cesium.Camera.clone(cam);
+  for (let i = 0; i < 32; i += 1) {
+    if (tiltLook(probe.pitch, goalPitch) !== look) return goalPitch;
+    const angle = Math.abs(goalPitch - probe.pitch);
+    if (angle < 1e-6) return goalPitch;
+    const allowed = Math.max(
+      lookAngleWithinFrame(probe, look, angle, frame),
+      Math.min(angle, owed),
+    );
+    owed -= allowed;
+    if (allowed > 0) probe[look](allowed);
+    if (allowed < angle) return probe.pitch;
+  }
+  return probe.pitch;
+}
+
+/** The reply's note for a tilt the frame limit stops short of its angle. */
+function tiltFrameNote(pitch) {
+  return `Stopped at ${Math.round(Cesium.Math.toDegrees(pitch))}°: from this height a shallower angle would turn the globe out of view. Zoom in to tilt further.`;
+}
+
+/** True when the pre-check proved a half-degree `look` from `cam`'s pose. */
+function lookProven(cam, look) {
+  return (
+    _provenLook?.look === look &&
+    Cesium.Cartesian3.equalsEpsilon(
+      _provenLook.position,
+      cam.positionWC,
+      0,
+      1,
+    ) &&
+    Cesium.Cartesian3.equalsEpsilon(
+      _provenLook.direction,
+      cam.directionWC,
+      0,
+      1e-9,
+    )
+  );
+}
+
+/**
+ * The check a voice in-place turn (`look`: 'lookUp', 'lookDown', 'lookLeft'
+ * or 'lookRight') must pass from orbit: refused when even half a degree would
+ * cross the frame limit, otherwise proven for that half degree from this pose.
+ * With `released`, the turn runs through a navigation that first releases a
+ * tracked or locked camera and keeps its world pose. The frame measure and the
+ * turn are the same in any reference frame, so such a camera is judged as it
+ * is, before the release, and a refusal leaves tracking as it was. Otherwise a
+ * camera that is not a free globe camera is not checked. Returns the refusal,
+ * or null.
+ */
+function checkLookFromOrbit(look, { released = false } = {}) {
+  _provenLook = null;
+  if (_viewer.scene.mode !== Cesium.SceneMode.SCENE3D) return null;
+  const cam = _viewer.camera;
+  if (!released && !isFreeGlobeCamera(_viewer)) return null;
+  if (
+    lookStepLosesGlobe(cam, look, PROVEN_TURN_RAD, {
+      ...visibleFrame(),
+      startShare: lookBaselineShare(cam),
+    })
+  )
+    return {
+      ok: false,
+      action: 'move_camera',
+      error:
+        'From this height that would turn the globe out of view — zoom in first, or turn the other way.',
+    };
+  _provenLook = {
+    look,
+    position: Cesium.Cartesian3.clone(cam.positionWC),
+    direction: Cesium.Cartesian3.clone(cam.directionWC),
+  };
+  return null;
+}
+
 function clearLookAt() {
   try {
     _viewer.camera.lookAtTransform(Cesium.Matrix4.IDENTITY);
@@ -1052,7 +1279,9 @@ export function interruptCameraMotion(reason = 'interrupt') {
   if (
     wasActive &&
     !tracking &&
-    (_active.kind === 'orbit' || _active.kind === 'route')
+    (_active.kind === 'orbit' ||
+      _active.kind === 'route' ||
+      (_active.kind === 'tilt' && _active.hpr))
   )
     clearLookAt();
   // Instant, not eased: the user grabbed the camera, or the flight is over.
@@ -1104,7 +1333,7 @@ function onTick() {
   let scale = 1;
   if (m.mode === 'once') {
     m.elapsed = (m.elapsed || 0) + dt;
-    const t = Math.min(1, m.elapsed / ONCE.durationS);
+    const t = Math.min(1, m.elapsed / (m.durationS || ONCE.durationS));
     scale = 1 - (1 - t) * (1 - t); // ease-out progress share
     if (t >= 1) {
       interruptCameraMotion('once-complete');
@@ -1173,30 +1402,20 @@ function onTick() {
       else if (m.direction === 'right') cam.moveRight(step);
       else if (m.direction === 'up') cam.moveUp(step);
       else cam.moveDown(step);
-    } else if (
-      m.kind === 'tilt' ||
-      m.kind === 'rotate' ||
-      m.kind === 'rotate_globe'
-    ) {
+    } else if (m.kind === 'tilt') {
+      tickTilt(cam, m, scale, dt);
+    } else if (m.kind === 'rotate' || m.kind === 'rotate_globe') {
       const degS = TILT_DEG_S[m.speed];
       const stepRad =
         m.mode === 'once'
-          ? Cesium.Math.toRadians(
-              m.kind === 'tilt' ? ONCE.tiltDeg : ONCE.rotateDeg,
-            ) *
-            (scale - (m.lastScale || 0))
+          ? Cesium.Math.toRadians(ONCE.rotateDeg) * (scale - (m.lastScale || 0))
           : Cesium.Math.toRadians(degS) * dt;
       m.lastScale = scale;
       if (m.kind === 'rotate_globe') {
         // Tracking can acquire the camera without going through navigation.
         // Yield without resetting its pose/frame: the world-space arc proof
         // only describes Cesium's rotation while the frame is identity.
-        if (
-          _viewer.scene.mode !== Cesium.SceneMode.SCENE3D ||
-          _viewer.trackedEntity ||
-          _isCockpitActive?.() ||
-          !Cesium.Matrix4.equals(cam.transform, Cesium.Matrix4.IDENTITY)
-        ) {
+        if (!isFreeGlobeCamera(_viewer) || _isCockpitActive?.()) {
           interruptCameraMotion('globe-camera-owner-changed');
           return;
         }
@@ -1218,18 +1437,14 @@ function onTick() {
           return;
         }
         cam.rotate(m.rotationAxis, angle);
-      } else if (m.kind === 'tilt') {
-        const up = m.direction === 'up';
-        // Clamp pitch to [-89°, -5°]: never through the ground, never at the sky.
-        const next = cam.pitch + (up ? stepRad : -stepRad);
-        if (next > PITCH_MAX || next < PITCH_MIN) {
-          interruptCameraMotion('tilt-clamp');
-          return;
-        }
-        if (up) cam.lookUp(stepRad);
-        else cam.lookDown(stepRad);
-      } else if (m.direction === 'left') cam.lookLeft(stepRad);
-      else cam.lookRight(stepRad);
+      } else {
+        lookWithinFrame(
+          cam,
+          m,
+          m.direction === 'left' ? 'lookLeft' : 'lookRight',
+          stepRad,
+        );
+      }
     } else if (m.kind === 'route') {
       // The dolly's shaping lives in advanceRouteFlight(); the tick only
       // applies the pose and honours the same completion path as before.
@@ -1252,6 +1467,186 @@ function onTick() {
   }
 }
 
+/**
+ * One frame of tilt. With a ground pivot the camera swings about it (lookAt),
+ * so the place under the crosshair stays centred; without one it looks up or
+ * down in place. Every angle and limit is the camera's own pitch, which at
+ * regional range is several degrees steeper than the pivot's (the Earth
+ * curves away), so the swing solves for the pivot pitch that gives it. Pitch
+ * is clamped to [-89°, -5°] only in the direction of travel: a top-down view
+ * sits at -90°, below the limit, and must still be able to tilt up out of it.
+ * A pivot swing toward the horizon lowers the camera, so it stops at
+ * TILT_MIN_CLEARANCE_M and the rest tilts in place. Farther out it stops with
+ * the camera TILT_MIN_PIVOT_ELEVATION above the place's horizon instead, and
+ * keeps the place centred: tilting in place there would lift the crosshair
+ * onto the sky.
+ */
+function tickTilt(cam, m, scale, dt) {
+  const from = cam.pitch;
+  const want =
+    m.mode === 'once'
+      ? m.startPitch + (m.goalPitch - m.startPitch) * scale
+      : from +
+        Cesium.Math.toRadians(TILT_DEG_S[m.speed]) *
+          dt *
+          (m.direction === 'up' ? 1 : -1);
+  const up = want > from;
+  const limited = up
+    ? Math.min(want, Math.max(from, PITCH_MAX))
+    : Math.max(want, Math.min(from, PITCH_MIN));
+  let atLimit = false;
+  if (m.hpr) {
+    // Apply a range a zoom set since the last frame, even when the pitch
+    // then has nowhere to go (a zoom in to the clearance ends the pivot).
+    cam.lookAt(m.target, m.hpr);
+    // Up toward the horizon the swing lowers the camera: hold the clearance,
+    // and keep the place below the horizon.
+    const cap = up
+      ? Math.max(m.hpr.pitch, tiltPivotPitchMax(m.hpr.range))
+      : Infinity;
+    for (let i = 0; i < 3 && Math.abs(limited - cam.pitch) > 1e-6; i += 1) {
+      const pitch = Math.min(
+        cap,
+        Math.max(-Cesium.Math.PI_OVER_TWO, m.hpr.pitch + limited - cam.pitch),
+      );
+      if (pitch === m.hpr.pitch) break;
+      m.hpr.pitch = pitch;
+      cam.lookAt(m.target, m.hpr);
+    }
+    // A once motion that just completed released the lookAt frame before
+    // this last step re-took it.
+    if (_active !== m) clearLookAt();
+    if (up && m.hpr.pitch >= cap && cam.pitch < limited - 1e-6) {
+      if (tiltClearanceBinds(m.hpr.range)) {
+        // Down to its clearance: let go of the pivot and tilt the rest in
+        // place, which keeps the height.
+        if (_active === m) clearLookAt();
+        m.hpr = null;
+        m.target = null;
+      } else {
+        // The place is at its horizon limit: stop here, still centred.
+        atLimit = true;
+      }
+    }
+  }
+  if (!m.hpr) tiltInPlaceWithinFrame(cam, m, limited);
+  if (m.mode !== 'once' && (limited !== want || atLimit))
+    interruptCameraMotion('tilt-clamp');
+}
+
+/** The refusal for a tilt up the camera has no room left for. */
+function tiltUpLimitRefusal() {
+  return {
+    ok: false,
+    action: 'move_camera',
+    error:
+      'Already at the upper tilt limit (near the horizon) — tilt down, or zoom/pan instead.',
+  };
+}
+
+/** Shallowest pivot pitch that keeps the clearance at this range. */
+function tiltPivotPitchMax(range) {
+  return Math.min(
+    -Math.asin(Math.min(1, TILT_MIN_CLEARANCE_M / range)),
+    -TILT_MIN_PIVOT_ELEVATION,
+  );
+}
+
+/**
+ * Whether the clearance, not the horizon, stops a swing at this range. Only
+ * then does the rest of the tilt happen in place: that close in (under ~17
+ * km) the camera's -5° limit stays well below its own horizon.
+ */
+function tiltClearanceBinds(range) {
+  return TILT_MIN_CLEARANCE_M / range >= Math.sin(TILT_MIN_PIVOT_ELEVATION);
+}
+
+/**
+ * The shallowest camera pitch a tilt starting from this frame can reach with
+ * the place under the crosshair still in view: PITCH_MAX, or less where a
+ * far pivot meets its horizon limit first.
+ */
+function tiltUpLimit({ target, pivot }) {
+  if (!pivot || tiltClearanceBinds(pivot.range)) return PITCH_MAX;
+  return Math.min(
+    PITCH_MAX,
+    pivotCameraPitch(
+      target,
+      pivot,
+      Math.max(pivot.pitch, tiltPivotPitchMax(pivot.range)),
+    ),
+  );
+}
+
+/** The camera pitch lookAt gives for this pivot at the given pivot pitch. */
+function pivotCameraPitch(target, { heading, range }, pitch) {
+  const offset = new Cesium.Cartesian3(
+    -range * Math.cos(pitch) * Math.sin(heading),
+    -range * Math.cos(pitch) * Math.cos(heading),
+    -range * Math.sin(pitch),
+  );
+  const eye = Cesium.Matrix4.multiplyByPoint(
+    Cesium.Transforms.eastNorthUpToFixedFrame(target),
+    offset,
+    new Cesium.Cartesian3(),
+  );
+  const look = Cesium.Cartesian3.subtract(target, eye, new Cesium.Cartesian3());
+  Cesium.Cartesian3.normalize(look, look);
+  const ellipsoid = _viewer.scene.globe?.ellipsoid ?? Cesium.Ellipsoid.WGS84;
+  const upAtEye = ellipsoid.geodeticSurfaceNormal(eye, new Cesium.Cartesian3());
+  return Math.asin(
+    Cesium.Math.clamp(Cesium.Cartesian3.dot(look, upAtEye), -1, 1),
+  );
+}
+
+/**
+ * Where a tilt starts. It swings about the ground under the crosshair so the
+ * place stays centred. It tilts in place with no ground there, from globe
+ * range, or while an entity is tracked (the follow camera owns that frame;
+ * voice releases it before moving, so a voice tilt still pivots).
+ */
+function tiltStartFrame(cam) {
+  const target = _viewer.trackedEntity ? null : _getTarget?.(_viewer);
+  let pivot = target ? tiltPivot(cam, target) : null;
+  if (pivot && !tiltPivotInReach(pivot.range)) pivot = null;
+  return { target, pivot, from: cam.pitch };
+}
+
+/** Whether a tilt may pivot at this range: up to and including the cutoff. */
+function tiltPivotInReach(range) {
+  return range <= TILT_PIVOT_MAX_RANGE_M + TILT_PIVOT_RANGE_SLACK_M;
+}
+
+/** The reply's note for a tilt the place's horizon stops short of its angle. */
+function tiltHorizonNote(pitch) {
+  return `Stopped at ${Math.round(Cesium.Math.toDegrees(pitch))}°: from this range a shallower angle puts the place past the horizon. Zoom in to tilt further.`;
+}
+
+/** Ground pivot for a tilt: heading, pitch and range in the target's own frame. */
+function tiltPivot(cam, target) {
+  const local = Cesium.Matrix4.multiplyByPoint(
+    Cesium.Matrix4.inverseTransformation(
+      Cesium.Transforms.eastNorthUpToFixedFrame(target),
+      new Cesium.Matrix4(),
+    ),
+    cam.positionWC,
+    new Cesium.Cartesian3(),
+  );
+  const range = Cesium.Cartesian3.magnitude(local);
+  if (!(range > 1) || local.z <= 0) return null;
+  // Near straight overhead the offset's heading is float noise (it flipped a
+  // north-up London view to south); keep the camera's own.
+  const heading =
+    Math.hypot(local.x, local.y) > range * 0.01
+      ? Math.atan2(-local.x, -local.y)
+      : cam.heading;
+  return new Cesium.HeadingPitchRange(
+    heading,
+    -Math.asin(Math.min(1, local.z / range)),
+    range,
+  );
+}
+
 /** Rigid origin-centred rotation stays outside the actual ellipsoid's bounding sphere. */
 function globeRotationHasClearance(position) {
   const ellipsoid = _viewer.scene.globe?.ellipsoid ?? Cesium.Ellipsoid.WGS84;
@@ -1413,6 +1808,7 @@ export function initCameraVerbs(
   _isCockpitActive =
     typeof isCockpitActive === 'function' ? isCockpitActive : null;
   _viewer = viewer;
+  _lookBaseline = null;
   if (_tickRemover) _tickRemover();
   _tickRemover = viewer.clock.onTick.addEventListener(onTick);
   if (_trackingRemover) _trackingRemover();
@@ -1421,18 +1817,108 @@ export function initCameraVerbs(
   _trackingRemover = viewer.trackedEntityChanged?.addEventListener((entity) => {
     if (entity && _active?.kind === 'rotate_globe')
       interruptCameraMotion('globe-camera-owner-changed');
+    // A pivoting tilt's lookAt would fight the follow camera every frame.
+    else if (entity && _active?.kind === 'tilt' && _active.hpr)
+      interruptCameraMotion('tilt-camera-owner-changed');
   });
   for (const rm of _inputRemovers) rm();
   _inputRemovers = [];
   const canvas = viewer.scene.canvas;
   // ANY manual camera input reclaims control — the cancelFlight reflex.
   for (const evt of ['pointerdown', 'touchstart', 'wheel']) {
-    const h = () => interruptCameraMotion('manual-input');
+    const h = () => {
+      _manualInputCount += 1;
+      interruptCameraMotion('manual-input');
+    };
     canvas.addEventListener(evt, h, { passive: true });
     _inputRemovers.push(() => canvas.removeEventListener(evt, h));
   }
 }
 
+/**
+ * A tilt's angle: the one asked for, the default oblique view when a bare
+ * "tilt the camera" names neither angle nor direction, or null for a nudge.
+ */
+function requestedTiltPitch(args, direction) {
+  // Only a real number or numeric text: Number('') and Number(null) are 0,
+  // which would swing the camera to the horizon.
+  const raw = args.pitchDeg;
+  const requested =
+    typeof raw === 'number' || (typeof raw === 'string' && raw.trim() !== '')
+      ? Number(raw)
+      : NaN;
+  // The camera never looks above the horizon, so a positive angle can only
+  // mean the same angle below it ("tilt 45 degrees" sent as 45).
+  if (Number.isFinite(requested))
+    return Cesium.Math.clamp(
+      Cesium.Math.toRadians(-Math.abs(requested)),
+      PITCH_MIN,
+      PITCH_MAX,
+    );
+  return direction === null
+    ? Cesium.Math.toRadians(TILT_DEFAULT_PITCH_DEG)
+    : null;
+}
+
+/**
+ * Argument errors move_camera refuses whatever the camera is doing, so a
+ * caller holding a motion back behind a flight can refuse it before waiting.
+ * @param {Object} args
+ * @returns {Object|null} The refusal, or null when the arguments are usable.
+ */
+export function moveCameraArgsError(args = {}) {
+  const motion = String(args.motion || '').toLowerCase();
+  const direction = args.direction
+    ? String(args.direction).toLowerCase()
+    : null;
+  if (motion === 'stop') return null;
+  if (!['orbit', 'pan', 'tilt', 'rotate', 'rotate_globe'].includes(motion)) {
+    return {
+      ok: false,
+      action: 'move_camera',
+      error: `Unknown motion "${args.motion}" — use orbit, pan, tilt, rotate, rotate_globe, or stop.`,
+    };
+  }
+  if (
+    motion !== 'orbit' &&
+    motion !== 'rotate_globe' &&
+    (motion !== 'tilt' || requestedTiltPitch(args, direction) === null) &&
+    !['left', 'right', 'up', 'down'].includes(direction)
+  ) {
+    return {
+      ok: false,
+      action: 'move_camera',
+      error: `${motion} needs a direction (${motion === 'tilt' ? 'up/down' : motion === 'rotate' ? 'left/right' : 'left/right/up/down'}).`,
+    };
+  }
+  if (motion === 'tilt' && (direction === 'left' || direction === 'right')) {
+    return {
+      ok: false,
+      action: 'move_camera',
+      error: 'tilt needs up or down, or pitchDeg alone for an angle.',
+    };
+  }
+  if (motion === 'rotate' && !['left', 'right'].includes(direction)) {
+    return {
+      ok: false,
+      action: 'move_camera',
+      error: 'rotate needs left or right.',
+    };
+  }
+  if (
+    motion === 'rotate_globe' &&
+    direction !== null &&
+    !['left', 'right'].includes(direction)
+  ) {
+    return {
+      ok: false,
+      action: 'move_camera',
+      error: 'rotate_globe needs left or right.',
+    };
+  }
+  return null;
+}
+
 /**
  * move_camera implementation. Returns the house result shape; rejections are
  * plain-English `ok:false` errors.
@@ -1465,54 +1951,66 @@ export function moveCamera(args = {}, runNavigation = null) {
     };
     return typeof runNavigation === 'function' ? runNavigation(stop) : stop();
   }
-  if (!['orbit', 'pan', 'tilt', 'rotate', 'rotate_globe'].includes(motion)) {
-    return {
-      ok: false,
-      action: 'move_camera',
-      error: `Unknown motion "${args.motion}" — use orbit, pan, tilt, rotate, rotate_globe, or stop.`,
-    };
-  }
-  if (
-    motion !== 'orbit' &&
-    motion !== 'rotate_globe' &&
-    !['left', 'right', 'up', 'down'].includes(direction)
-  ) {
-    return {
-      ok: false,
-      action: 'move_camera',
-      error: `${motion} needs a direction (left/right${motion !== 'rotate' ? '/up/down' : ''}).`,
-    };
-  }
-  if (motion === 'rotate' && !['left', 'right'].includes(direction)) {
-    return {
-      ok: false,
-      action: 'move_camera',
-      error: 'rotate needs left or right.',
-    };
-  }
-  if (
-    motion === 'rotate_globe' &&
-    direction !== null &&
-    !['left', 'right'].includes(direction)
-  ) {
-    return {
-      ok: false,
-      action: 'move_camera',
-      error: 'rotate_globe needs left or right.',
-    };
-  }
-  if (motion === 'tilt') {
-    // Honest limits: at the clamp a tilt is a no-op — say so instead of
-    // reporting success and letting the model gaslight itself (field test).
-    const pitch = _viewer.camera.pitch;
-    if (direction === 'up' && pitch >= PITCH_MAX - Cesium.Math.toRadians(0.5)) {
+  const argsError = moveCameraArgsError(args);
+  if (argsError) return argsError;
+  const tiltToPitch =
+    motion === 'tilt' ? requestedTiltPitch(args, direction) : null;
+  if (motion === 'tilt' && tiltToPitch !== null) {
+    // Angles and limits are the camera's own pitch, whatever the swing pivots
+    // about; releasing the follow camera does not change it.
+    const from = _viewer.camera.pitch;
+    // -89 or -90 means top-down, which a -90° view already is: the clamp
+    // must not tilt it up 1°.
+    const atTopDown = tiltToPitch <= PITCH_MIN && from <= PITCH_MIN;
+    if (
+      atTopDown ||
+      Math.abs(tiltToPitch - from) < Cesium.Math.toRadians(0.5)
+    ) {
+      // Still a camera request: it stops a running motion and releases the
+      // follow camera, as a tilt that moves would.
+      const hold = () => {
+        interruptCameraMotion('replaced');
+        return {
+          ok: true,
+          action: 'move_camera',
+          motion,
+          pitchDeg: Math.round(
+            Cesium.Math.toDegrees(atTopDown ? from : tiltToPitch),
+          ),
+          unchanged: true,
+        };
+      };
+      return typeof runNavigation === 'function' ? runNavigation(hold) : hold();
+    }
+    // pitchDeg is an absolute angle, not a step: "tilt down 10 degrees" sent
+    // as {direction:'down', pitchDeg:10} would tilt up from -45°.
+    const towards = tiltToPitch > from ? 'up' : 'down';
+    if ((direction === 'up' || direction === 'down') && direction !== towards) {
+      const target = Math.round(Cesium.Math.toDegrees(tiltToPitch));
+      const now = Math.round(Cesium.Math.toDegrees(from));
       return {
         ok: false,
         action: 'move_camera',
-        error:
-          'Already at the upper tilt limit (near the horizon) — tilt down, or zoom/pan instead.',
+        error: `pitchDeg is an absolute angle, not a step: ${target}° from ${now}° tilts ${towards}, not ${direction}. Send direction alone for a nudge, or pitchDeg alone for an angle.`,
       };
     }
+    if (
+      towards === 'up' &&
+      from >=
+        tiltUpLimit(tiltStartFrame(_viewer.camera)) - Cesium.Math.toRadians(0.5)
+    )
+      return tiltUpLimitRefusal();
+  } else if (motion === 'tilt') {
+    // Honest limits: at the clamp a tilt is a no-op — say so instead of
+    // reporting success and letting the model gaslight itself (field test).
+    const pitch = _viewer.camera.pitch;
+    if (
+      direction === 'up' &&
+      pitch >=
+        tiltUpLimit(tiltStartFrame(_viewer.camera)) - Cesium.Math.toRadians(0.5)
+    ) {
+      return tiltUpLimitRefusal();
+    }
     if (
       direction === 'down' &&
       pitch <= PITCH_MIN + Cesium.Math.toRadians(0.5)
@@ -1524,6 +2022,34 @@ export function moveCamera(args = {}, runNavigation = null) {
       };
     }
   }
+  // A tilt is judged by the way its pitch will move: toward its angle, or a
+  // nudge up or down; a rotate turns left only when told to, as it runs.
+  const look =
+    motion === 'tilt'
+      ? tiltLook(
+          _viewer.camera.pitch,
+          tiltToPitch ??
+            _viewer.camera.pitch +
+              Cesium.Math.toRadians(ONCE.tiltDeg) *
+                (direction === 'up' ? 1 : -1),
+        )
+      : motion === 'rotate'
+        ? direction === 'left'
+          ? 'lookLeft'
+          : 'lookRight'
+        : null;
+  // Honest limits from orbit too: a stopped turn rests within 0.05° of its
+  // limit, so one that cannot go half a degree further is refused rather than
+  // run and reported as done, and one that can is then turned at least that
+  // far. Near the limit the sampled share wobbles as the planet's edge crosses
+  // the grid, so a turn that would keep the planet can occasionally be refused
+  // too.
+  // A camera that is tracked or locked now is judged as the navigation that
+  // runs the turn will release it, so a refusal keeps the tracking.
+  const lookRefusal =
+    look &&
+    checkLookFromOrbit(look, { released: typeof runNavigation === 'function' });
+  if (lookRefusal) return lookRefusal;
   if (
     (motion === 'rotate_globe' ||
       (motion === 'orbit' && typeof runNavigation !== 'function')) &&
@@ -1607,14 +2133,70 @@ export function moveCamera(args = {}, runNavigation = null) {
         error: 'Globe rotation requires a clear ellipsoid bounding sphere.',
       };
   }
+  // The angle a tilt to an angle stops at short of it, and why.
+  let stoppedAt = null;
+  let stopNote = null;
   const start = () => {
     interruptCameraMotion('replaced');
+    // Checked again only if the release left the camera somewhere other than
+    // where the check above expected it.
+    if (look && !lookProven(_viewer.camera, look)) {
+      const refusal = checkLookFromOrbit(look);
+      if (refusal) return refusal;
+    }
     const state = {
       kind: motion,
       direction: direction || 'right',
       speed,
       mode,
     };
+    if (motion === 'tilt') {
+      const frame = tiltStartFrame(_viewer.camera);
+      const { target, pivot, from } = frame;
+      if (pivot) {
+        state.target = target;
+        state.hpr = pivot;
+      }
+      state.startPitch = from;
+      const upLimit = tiltUpLimit(frame);
+      if (tiltToPitch !== null) {
+        // From far out the place reaches its horizon before the camera
+        // reaches the asked angle: stop there, and say so.
+        let goal =
+          tiltToPitch > from
+            ? Math.min(tiltToPitch, Math.max(from, upLimit))
+            : tiltToPitch;
+        if (goal !== tiltToPitch) stopNote = tiltHorizonNote(goal);
+        // From orbit an in-place tilt stops where the planet would leave the
+        // frame: aim it there, and say so.
+        if (!pivot) {
+          const framed = tiltPitchWithinFrame(_viewer.camera, goal);
+          if (framed !== goal) {
+            goal = framed;
+            stopNote = tiltFrameNote(goal);
+          }
+        }
+        state.mode = 'once';
+        state.direction = goal > from ? 'up' : 'down';
+        state.goalPitch = goal;
+        // A zoom mid-tilt moves the horizon limit; it re-judges the goal
+        // against the angle asked for.
+        state.askedPitch = tiltToPitch;
+        state.durationS = Math.max(
+          ONCE.durationS,
+          Math.abs(Cesium.Math.toDegrees(goal - from)) / TILT_TO_DEG_S,
+        );
+        if (goal !== tiltToPitch) stoppedAt = goal;
+      } else {
+        // A nudge stops at the limit it travels toward.
+        const step =
+          Cesium.Math.toRadians(ONCE.tiltDeg) * (direction === 'up' ? 1 : -1);
+        state.goalPitch =
+          step > 0
+            ? Math.min(from + step, Math.max(from, upLimit))
+            : Math.max(from + step, Math.min(from, PITCH_MIN));
+      }
+    }
     if (motion === 'rotate_globe') {
       // Convert an inherited ground-target frame without changing the world
       // pose. Rotation must pivot about Earth, never the previous local target.
@@ -1633,9 +2215,11 @@ export function moveCamera(args = {}, runNavigation = null) {
     }
     if (motion === 'orbit') {
       if (_viewer.scene.tweens.length > 0) {
-        // A camera flight is in progress ("fly to X and orbit it") — ALWAYS arm
-        // and capture at the destination; a target existing right now is
-        // meaningless (the globe is always under the crosshair).
+        // A camera flight is in progress — ALWAYS arm and capture at the
+        // destination; a target existing right now is meaningless (the globe
+        // is always under the crosshair). The voice runner already holds an
+        // orbit until its own fly-to lands; this covers any other
+        // flight.
         setActiveMotion({
           kind: 'orbit',
           direction: direction || 'right',
@@ -1699,7 +2283,11 @@ export function moveCamera(args = {}, runNavigation = null) {
       motion,
       direction: state.direction,
       speed,
-      mode,
+      mode: state.mode,
+      ...(tiltToPitch !== null && {
+        pitchDeg: Math.round(Cesium.Math.toDegrees(stoppedAt ?? tiltToPitch)),
+      }),
+      ...(stopNote !== null && { note: stopNote }),
     };
   };
   const preserveCameraFlight =
@@ -1714,16 +2302,93 @@ export function moveCamera(args = {}, runNavigation = null) {
 /**
  * Zoom while orbiting: scale the orbit RADIUS instead of letting the zoom
  * fight the per-frame lookAt (field test: "zoom out did literally nothing").
+ * A tilt swinging about its pivot holds a range the same way.
  * @param {number} factor  >1 zooms out (radius grows), <1 zooms in.
- * @returns {boolean} true when an orbit consumed the zoom.
+ * @returns {{kind: string, changed: boolean, pitchDeg?: number,
+ *   note?: string}|null} the motion that consumed the zoom, and whether its
+ *   range moved; null when none did. A tilt to an angle whose end the new
+ *   range moves also names the angle it now ends at (pitchDeg), with a note.
  */
 export function adjustOrbitRange(factor) {
-  if (!_active || _active.kind !== 'orbit' || !_active.hpr) return false;
-  _active.hpr.range = Math.max(
-    80,
-    Math.min(5_000_000, _active.hpr.range * factor),
+  if (!_active || !['orbit', 'tilt'].includes(_active.kind) || !_active.hpr)
+    return null;
+  // A tilt's zoom in stops at the range that keeps its clearance. The limits
+  // never move a view the wrong way: a zoom in leaves a closer view in place,
+  // and a zoom out leaves a farther one.
+  const { kind, hpr } = _active;
+  const floor =
+    kind === 'tilt'
+      ? Math.max(80, TILT_MIN_CLEARANCE_M / Math.abs(Math.sin(hpr.pitch)))
+      : 80;
+  // A tilt pivots only within TILT_PIVOT_MAX_RANGE_M; farther out the swing
+  // would carry the camera thousands of km.
+  const ceiling = kind === 'tilt' ? TILT_PIVOT_MAX_RANGE_M : 5_000_000;
+  const range = hpr.range;
+  hpr.range = Math.max(
+    Math.min(floor, range),
+    Math.min(Math.max(ceiling, range), range * factor),
   );
-  return true;
+  // Under half a metre counts as not moved, as for a plain zoom.
+  const changed = Math.abs(hpr.range - range) >= 0.5;
+  return { kind, changed, ...(changed && retargetTiltAfterZoom(_active)) };
+}
+
+/**
+ * A zoom changed the range a tilt to an angle holds, and with it the place's
+ * horizon limit: aim the tilt at the angle asked for or the new limit,
+ * whichever comes first, from where the camera is now. The pivot pitch is
+ * re-solved so the new range keeps the camera's pitch, and a limit the camera
+ * is already past is eased down to rather than jumped to. Returns the end
+ * angle and a note for the reply when that end moved, otherwise nothing.
+ */
+function retargetTiltAfterZoom(m) {
+  if (m.kind !== 'tilt' || m.mode !== 'once' || m.askedPitch === undefined)
+    return {};
+  let from = _viewer.camera.pitch;
+  if (!(m.askedPitch > from)) return {};
+  if (m.hpr) {
+    // At the same pivot pitch a longer range looks down more steeply (the
+    // Earth curves away): find the pivot pitch that holds this camera pitch.
+    // It stays below the place's horizon limit (or where the pivot already
+    // was): past it the place drops behind the Earth, so a camera the zoom
+    // leaves past that limit steps down to it with the zoom.
+    const cap = Math.max(m.hpr.pitch, tiltPivotPitchMax(m.hpr.range));
+    for (let i = 0; i < 4; i += 1) {
+      const error = from - pivotCameraPitch(m.target, m.hpr, m.hpr.pitch);
+      if (Math.abs(error) < 1e-7) break;
+      const pitch = Cesium.Math.clamp(
+        m.hpr.pitch + error,
+        -Cesium.Math.PI_OVER_TWO,
+        cap,
+      );
+      if (pitch === m.hpr.pitch) break;
+      m.hpr.pitch = pitch;
+    }
+    from = Math.min(from, pivotCameraPitch(m.target, m.hpr, m.hpr.pitch));
+  }
+  const limit =
+    m.hpr && !tiltClearanceBinds(m.hpr.range)
+      ? Math.min(
+          PITCH_MAX,
+          pivotCameraPitch(m.target, m.hpr, tiltPivotPitchMax(m.hpr.range)),
+        )
+      : PITCH_MAX;
+  const goal = Math.min(m.askedPitch, limit);
+  if (Math.abs(goal - m.goalPitch) < 1e-6) return {};
+  m.goalPitch = goal;
+  m.startPitch = from;
+  m.elapsed = 0;
+  m.durationS = Math.max(
+    ONCE.durationS,
+    Math.abs(Cesium.Math.toDegrees(goal - from)) / TILT_TO_DEG_S,
+  );
+  const limited = goal !== m.askedPitch;
+  return {
+    pitchDeg: Math.round(Cesium.Math.toDegrees(goal)),
+    note: limited
+      ? tiltHorizonNote(goal)
+      : `The tilt now reaches ${Math.round(Cesium.Math.toDegrees(goal))}°.`,
+  };
 }
 
 /**

src/cockpitMarkup.test.mjs

@@ -1306,12 +1306,12 @@ test('voice Cockpit entry honours a requested contact layer before it enters', (
     ui.indexOf("if (normalized === 'exit') {"),
   );
   assert.ok(branch, 'cockpit enter branch is missing');
-  const gateIndex = branch.indexOf('isEntryAllowed?.()');
+  const gateIndex = branch.indexOf('this._cockpitEntryRefusal()');
   const retargetIndex = branch.indexOf('_retargetCockpitEntryLayer(');
   const enterIndex = branch.indexOf('enterCockpitWithTracking({');
   assert.ok(
     gateIndex >= 0,
-    'entry consults the same gate the manual chip uses',
+    'entry refuses on the gate it can check before tracking',
   );
   assert.ok(
     retargetIndex > gateIndex,
@@ -1362,9 +1362,21 @@ test('voice Cockpit entry refuses when the entry gate is shut', () => {
     ui.indexOf("if (normalized === 'enter') {"),
     ui.indexOf("if (normalized === 'exit') {"),
   );
-  assert.match(branch, /if \(!this\.cockpitView\.isEntryAllowed\?\.\(\)\) \{/);
-  assert.match(branch, /Contacts must be active to enter Cockpit/);
-  assert.match(branch, /Contacts is still starting up/);
+  // Contacts is not required: only a Context change in flight or no aircraft
+  // layer to ride shuts the gate before tracking, and the entry itself then
+  // applies the manual chip's gate to the aircraft it rides.
+  assert.match(
+    branch,
+    /const refusal = this\._cockpitEntryRefusal\(\);\s*if \(refusal\) \{/,
+  );
+  assert.doesNotMatch(branch, /Contacts must be active/);
+  const refusal = ui.slice(
+    ui.indexOf('  _cockpitEntryRefusal() {'),
+    ui.indexOf('  getCockpitState() {'),
+  );
+  assert.match(refusal, /Context is still changing/);
+  assert.match(refusal, /No aircraft layer is on/);
+  assert.doesNotMatch(refusal, /[Cc]ontacts/);
 });
 
 test('cockpit state cannot report entryAllowed while already active', () => {
@@ -1382,7 +1394,8 @@ test('cockpit state cannot report entryAllowed while already active', () => {
   );
   assert.match(state, /entryBlockedReason:/, 'and a refusal can be explained');
   assert.match(state, /'contacts-starting'/);
-  assert.match(state, /'contacts-inactive'/);
+  assert.match(state, /'subject-layer-off'/);
+  assert.doesNotMatch(state, /'contacts-inactive'/, 'Contacts is not required');
   assert.match(state, /'no-tracked-aircraft'/);
 });
 

src/cockpitSignalFocus.test.mjs

@@ -147,6 +147,40 @@ const snapshot = (distanceM = 2000) => ({
   ],
 });
 
+test('a feed-off row leads the rebuilt rows and the list stays five long', async (t) => {
+  const f = fixture(t);
+  const crowded = {
+    ...snapshot(),
+    cohorts: [
+      {
+        id: 'flights',
+        count: 6,
+        nearest: [1, 2, 3, 4, 5, 6].map((n) => ({
+          id: `n${n}`,
+          label: `N${n}`,
+          distanceM: n * 1000,
+        })),
+      },
+    ],
+  };
+  updateCockpitSignals.call(f.owner, crowded, 0, {
+    title: 'MILITARY FEED OFF · PARTIAL PICTURE',
+    detail: 'NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR',
+  });
+  await nextTick();
+  assert.equal(f.owner.signalItems.length, 5);
+  assert.equal(f.owner.signalItems[0].key, 'feed-status');
+  assert.equal(f.owner.signalItems[0].tone, 'warning');
+  assert.equal(f.owner.signalItems[0].target, null);
+  assert.match(f.list.textContent, /MILITARY FEED OFF · PARTIAL PICTURE/);
+  updateCockpitSignals.call(f.owner, crowded, 0);
+  assert.equal(
+    f.owner.signalItems.some((item) => item.key === 'feed-status'),
+    false,
+    'with the feed back, the row goes',
+  );
+});
+
 test('rows render the signals the controller presents', async (t) => {
   const f = fixture(t);
   await render(f, [

src/contextModePolicy.js

@@ -411,30 +411,37 @@ export function contextRestoreLayerIds(snapshot = {}) {
   return restored;
 }
 
+/** The layers an aircraft Cockpit subject can come from. */
+export const COCKPIT_AIRCRAFT_LAYER_IDS = Object.freeze([
+  'flights',
+  'military',
+]);
+
 /**
- * Cockpit entry belongs to the operational Contacts context bundle. A tracked
- * aircraft alone is not sufficient: both observed-flight feeds must still be
- * active so the cockpit's surrounding-contact picture is not presented as a
- * complete context view when one source is disabled.
+ * Cockpit entry needs only the aircraft it rides: that aircraft's own layer
+ * (Live Flights for a civilian, Military Flights for a military aircraft) must
+ * be on. Contacts and the other feeds are not required. When a source the
+ * surrounding picture uses is off, the Cockpit's Contact card and Live
+ * Signals say the picture is partial instead of blocking entry, so a partial
+ * picture is never presented as complete. A Context mode change in flight
+ * still owns the camera, so entry waits it out.
  *
- * @param {object} input Current context and dependency visibility.
- * @param {string|null} input.contextMode Active Context mode.
- * @param {boolean} input.contextModeChanging Whether the Context transaction is unsettled.
- * @param {boolean} input.flightsEnabled Whether Live Flights is enabled.
- * @param {boolean} input.militaryEnabled Whether Military Flights is enabled.
+ * @param {object} input Current subject and Context state.
+ * @param {string|null} input.subjectLayerId Layer of the tracked aircraft
+ *   ('flights' or 'military'), or null with none tracked.
+ * @param {boolean} input.subjectLayerEnabled Whether that layer is enabled.
+ * @param {boolean} input.contextModeChanging Whether a Context transaction is unsettled.
  * @returns {boolean} Whether cockpit entry may be offered or activated.
  */
 export function cockpitEntryAllowed({
-  contextMode,
+  subjectLayerId,
+  subjectLayerEnabled,
   contextModeChanging,
-  flightsEnabled,
-  militaryEnabled,
 }) {
   return (
-    contextMode === 'flights' &&
-    !contextModeChanging &&
-    Boolean(flightsEnabled) &&
-    Boolean(militaryEnabled)
+    COCKPIT_AIRCRAFT_LAYER_IDS.includes(subjectLayerId) &&
+    Boolean(subjectLayerEnabled) &&
+    !contextModeChanging
   );
 }
 

src/contextModePolicy.test.mjs

@@ -400,37 +400,32 @@ test('explicit layer intent finishing during restore overrides the stale queued
   }
 });
 
-test('cockpit entry requires Contacts context with both aircraft feeds enabled', () => {
+test("cockpit entry needs only the tracked aircraft's own layer", () => {
   assert.equal(cockpitEntryAllowed({
-    contextMode: 'flights',
+    subjectLayerId: 'flights',
+    subjectLayerEnabled: true,
     contextModeChanging: false,
-    flightsEnabled: true,
-    militaryEnabled: true,
-  }), true);
+  }), true, 'a civilian needs Live Flights alone: no Contacts, no Military');
   assert.equal(cockpitEntryAllowed({
-    contextMode: 'flights',
+    subjectLayerId: 'military',
+    subjectLayerEnabled: true,
+    contextModeChanging: false,
+  }), true, 'a military aircraft needs Military Flights alone');
+  assert.equal(cockpitEntryAllowed({
+    subjectLayerId: 'flights',
+    subjectLayerEnabled: true,
     contextModeChanging: true,
-    flightsEnabled: true,
-    militaryEnabled: true,
-  }), false, 'Cockpit remains unavailable until Contacts activation settles');
+  }), false, 'Cockpit remains unavailable until a Context mode change settles');
   assert.equal(cockpitEntryAllowed({
-    contextMode: null,
+    subjectLayerId: 'military',
+    subjectLayerEnabled: false,
     contextModeChanging: false,
-    flightsEnabled: true,
-    militaryEnabled: true,
-  }), false, 'ordinary layer selection is not an operational Contacts context');
+  }), false, "the ridden aircraft's own layer is required");
   assert.equal(cockpitEntryAllowed({
-    contextMode: 'flights',
+    subjectLayerId: null,
+    subjectLayerEnabled: false,
     contextModeChanging: false,
-    flightsEnabled: true,
-    militaryEnabled: false,
-  }), false, 'the military contact feed is required');
-  assert.equal(cockpitEntryAllowed({
-    contextMode: 'flights',
-    contextModeChanging: false,
-    flightsEnabled: false,
-    militaryEnabled: true,
-  }), false, 'the civilian contact feed is required');
+  }), false, 'there is no aircraft to ride');
 });
 
 test('context teardown guard restores coordination state after success and failure', async () => {

src/data/dataCredits.js

@@ -34,6 +34,14 @@ export const OPENMAPTILES_CREDIT = {
   html: 'Vector tiles: <a href="https://openfreemap.org" target="_blank" rel="noopener">OpenFreeMap</a> © <a href="https://openmaptiles.org" target="_blank" rel="noopener">OpenMapTiles</a>',
 };
 
+/** Conditional Salish Sea coverage; registered when its sightings first render. */
+export const ACARTIA_CREDIT = Object.freeze({
+  key: 'acartia',
+  html:
+    'Wildlife sightings: <a href="https://acartia.io" target="_blank" rel="noopener">Acartia</a> (CC BY 4.0; each provider credited per sighting) · ' +
+    '<a href="https://www.bewhalewise.org" target="_blank" rel="noopener">Be Whale Wise</a>',
+});
+
 const osmDisplays = new WeakMap();
 
 function updateOsmDisplay(viewer, state) {
@@ -188,6 +196,10 @@ export const DATA_CREDITS = [
       '<a href="https://adds-faa.opendata.arcgis.com/" target="_blank" rel="noopener">FAA Special Use Airspace</a>' +
       ' (prohibited and restricted zones; informational only)',
   },
+  {
+    key: 'inaturalist',
+    html: 'Wildlife sightings: <a href="https://www.inaturalist.org" target="_blank" rel="noopener">iNaturalist</a> contributors (licences per record; photos credited on each card)',
+  },
   OSM_CREDIT,
   OPENMAPTILES_CREDIT,
   {

src/data/layerState.js

@@ -312,6 +312,23 @@ const OPTION_GROUPS = Object.freeze({
       high: 'h',
     }),
   ]),
+  'wildlife-sightings': Object.freeze([
+    booleanOption('confirmed', 'c', false),
+    enumOption(
+      'taxa',
+      't',
+      'all',
+      ['all', 'Aves', 'Mammalia', 'whales', 'Insecta', 'Plantae'],
+      {
+        all: 'a',
+        Aves: 'b',
+        Mammalia: 'm',
+        whales: 'w',
+        Insecta: 'i',
+        Plantae: 'p',
+      },
+    ),
+  ]),
   traffic: Object.freeze([
     enumOption('roadMode', 'r', null, ['tomtom', 'osm', 'hybrid'], {
       tomtom: 't',
@@ -733,6 +750,12 @@ export const LAYER_STATE_REGISTRY = Object.freeze([
     disposition: 'enabled+options',
     optionOwner: 'weather-satellite',
   }),
+  Object.freeze({
+    id: 'wildlife-sightings',
+    token: '9',
+    disposition: 'enabled+options',
+    optionOwner: 'wildlife-sightings',
+  }),
   Object.freeze({
     id: 'wind',
     token: 'k',

src/data/layerState.test.mjs

@@ -203,8 +203,8 @@ function encode(state) {
 
 test('production registry is exact, canonical, and rejects incomplete contracts', async () => {
   assert.equal(validateLayerStateRegistry(), true);
-  assert.equal(REGISTERED_LAYER_IDS.length, 35);
-  assert.equal(new Set(REGISTERED_LAYER_IDS).size, 35);
+  assert.equal(REGISTERED_LAYER_IDS.length, 36);
+  assert.equal(new Set(REGISTERED_LAYER_IDS).size, 36);
   assert.ok(REGISTERED_LAYER_IDS.includes('transit'));
   assert.deepEqual(REGISTERED_LAYER_IDS, [...REGISTERED_LAYER_IDS].sort());
   assert.deepEqual(LEGACY_LAYER_STATE_TOKENS, {
@@ -243,7 +243,7 @@ test('production registry is exact, canonical, and rejects incomplete contracts'
   for (const [id, token] of Object.entries(LEGACY_LAYER_STATE_TOKENS)) {
     assert.equal(LAYER_STATE_TOKEN_RESERVATIONS[id], token);
   }
-  assert.equal(nextLayerStateToken(), '9');
+  assert.equal(nextLayerStateToken(), '00');
   assert.equal(
     nextLayerStateToken({
       ...LAYER_STATE_TOKEN_RESERVATIONS,
@@ -306,8 +306,8 @@ test('production registry is exact, canonical, and rejects incomplete contracts'
   assert.equal(
     validateLayerStateAllocations(LAYER_STATE_TOKEN_RESERVATIONS, {
       ...LAYER_STATE_TOKEN_RESERVATIONS,
-      future: '9',
-      next: '00',
+      future: '00',
+      next: '01',
     }),
     true,
   );
@@ -315,12 +315,13 @@ test('production registry is exact, canonical, and rejects incomplete contracts'
     () =>
       validateLayerStateAllocations(LAYER_STATE_TOKEN_RESERVATIONS, {
         ...LAYER_STATE_TOKEN_RESERVATIONS,
-        future: '00',
+        future: '01',
       }),
-    /next free token 9/,
+    /next free token 00/,
   );
   const beforeLastDigit = { ...digitsExhausted };
   delete beforeLastDigit['prior-9'];
+  delete beforeLastDigit['wildlife-sightings'];
   assert.equal(
     validateLayerStateAllocations(beforeLastDigit, {
       ...beforeLastDigit,
@@ -2695,6 +2696,32 @@ test('the recent-imagery split is share-link only: never stored locally, and a s
   );
 });
 
+test('wildlife confirmed and every taxa preset round-trip through the full share codec', () => {
+  assert.equal(
+    LAYER_STATE_REGISTRY.find(({ id }) => id === 'wildlife-sightings').token,
+    '9',
+  );
+  for (const taxa of [
+    'all',
+    'Aves',
+    'Mammalia',
+    'whales',
+    'Insecta',
+    'Plantae',
+  ]) {
+    const state = normalizeLayerState({
+      enabledLayerIds: ['wildlife-sightings'],
+      options: { 'wildlife-sightings': { confirmed: true, taxa } },
+    });
+    const encoded = encode(state);
+    assert.doesNotMatch(encoded, /undefined/);
+    assert.deepEqual(
+      decodeLayerStateParams(new URLSearchParams(encoded)),
+      state,
+    );
+  }
+});
+
 test('drone restrictions uses digit 8 without colliding with fire perimeters', () => {
   const decoded = decodeLayerStateParams(new URLSearchParams('v=2&l=8.2'));
   assert.deepEqual(decoded.enabledLayerIds, [

src/data/layerStateTokenLedger.test.mjs

@@ -97,6 +97,10 @@ function withPublishedBase(
   }
 }
 
+const preWildlifeRows = reservationRows.filter(
+  ([id]) => id !== 'wildlife-sightings',
+);
+
 function writeCodecFixture(cwd, rows, entries) {
   const providerCodec = path.join(cwd, 'src/data/idSwitches.js');
   mkdirSync(path.dirname(providerCodec), { recursive: true });
@@ -104,7 +108,12 @@ function writeCodecFixture(cwd, rows, entries) {
     providerCodec,
     readFileSync(new URL('./idSwitches.js', import.meta.url)),
   );
-  const source = readFileSync(CODEC_SOURCE_PATH, 'utf8');
+  let source = readFileSync(CODEC_SOURCE_PATH, 'utf8');
+  if (!rows.some(([id]) => id === 'wildlife-sightings'))
+    source = source.replace(
+      /  Object\.freeze\(\{\s*id: 'wildlife-sightings',[\s\S]*?\}\),\n/,
+      '',
+    );
   const registryEnd = ']);\n\nexport const REGISTERED_LAYER_IDS';
   assert.equal(source.split(registryEnd).length, 2);
   const additions = entries
@@ -128,7 +137,7 @@ test('reservation ledger is complete, pinned, and rejects duplicate or malformed
     { ...parseLayerStateTokenReservations(reservationRows) },
     { ...LAYER_STATE_TOKEN_RESERVATIONS },
   );
-  assert.equal(Object.keys(LAYER_STATE_TOKEN_RESERVATIONS).length, 35);
+  assert.equal(Object.keys(LAYER_STATE_TOKEN_RESERVATIONS).length, 36);
   assert.deepEqual(
     { ...LAYER_STATE_TOKEN_RESERVATIONS },
     {
@@ -140,6 +149,7 @@ test('reservation ledger is complete, pinned, and rejects duplicate or malformed
       'sea-marks': '6',
       'ski-pistes': '7',
       'drone-airspace': '8',
+      'wildlife-sightings': '9',
     },
   );
   assert.throws(
@@ -165,9 +175,9 @@ test('reservation ledger is complete, pinned, and rejects duplicate or malformed
     /Duplicate layer-state token reservation/,
   );
   assert.equal(
-    parseLayerStateTokenReservations([...reservationRows, ['future', '9']])
+    parseLayerStateTokenReservations([...reservationRows, ['future', '00']])
       .future,
-    '9',
+    '00',
   );
   assert.throws(
     () =>
@@ -185,7 +195,7 @@ test('reservation ledger is complete, pinned, and rejects duplicate or malformed
 
 test('published retired digits and competing PRs advance the merge-time allocation', () => {
   withPublishedBase(
-    { rows: [...reservationRows, ['retired-layer', '9']] },
+    { rows: [...preWildlifeRows, ['retired-layer', '9']] },
     (cwd) => {
       const published = readPublishedLayerStateReservations('HEAD', cwd);
       assert.equal(nextLayerStateToken(published), '00');
@@ -217,7 +227,7 @@ test('published retired digits and competing PRs advance the merge-time allocati
 });
 
 test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () => {
-  withPublishedBase({ rows: [...reservationRows, ['pr-a', '9']] }, (cwd) => {
+  withPublishedBase({ rows: [...preWildlifeRows, ['pr-a', '9']] }, (cwd) => {
     mkdirSync(path.join(cwd, 'scripts'));
     const fixtureChecker = path.join(
       cwd,
@@ -238,7 +248,7 @@ test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () =
 
     writeCodecFixture(
       cwd,
-      [...reservationRows, ['pr-b', '9']],
+      [...preWildlifeRows, ['pr-b', '9']],
       [{ id: 'pr-b', token: '9' }],
     );
     const beforeRebase = runCheck();
@@ -247,7 +257,7 @@ test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () =
 
     writeCodecFixture(
       cwd,
-      [...reservationRows, ['pr-a', '9'], ['pr-b', '9']],
+      [...preWildlifeRows, ['pr-a', '9'], ['pr-b', '9']],
       [
         { id: 'pr-a', token: '9' },
         { id: 'pr-b', token: '9' },
@@ -259,7 +269,7 @@ test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () =
 
     const published = readPublishedLayerStateReservations('HEAD', cwd);
     assert.equal(nextLayerStateToken(published), '00');
-    const validBaselineRows = [...reservationRows, ['pr-a', '9']];
+    const validBaselineRows = [...preWildlifeRows, ['pr-a', '9']];
     writeCodecFixture(cwd, validBaselineRows, [{ id: 'pr-a', token: '9' }]);
     const helper = spawnSync(
       process.execPath,
@@ -275,7 +285,7 @@ test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () =
     );
     writeCodecFixture(
       cwd,
-      [...reservationRows, ['pr-a', '9'], ['pr-b', '00']],
+      [...preWildlifeRows, ['pr-a', '9'], ['pr-b', '00']],
       [
         { id: 'pr-a', token: '9' },
         { id: 'pr-b', token: '00' },
@@ -290,7 +300,7 @@ test('PR B manually replaces provisional 9 with 00 after PR A publishes 9', () =
 test('allocation batches cross the last digit and base-36 pair boundaries in order', () => {
   const digitRows = [...'9'].map((digit) => [`retired-${digit}`, digit]);
   const allDigits = parseLayerStateTokenReservations([
-    ...reservationRows,
+    ...preWildlifeRows,
     ...digitRows,
   ]);
   const beforeNine = { ...allDigits };
@@ -349,7 +359,7 @@ test('an isolated valid two-character fixture round-trips an l field beyond the
       token,
     }));
     const fixtureRows = [
-      ...reservationRows,
+      ...preWildlifeRows,
       ...priorDigits,
       ...fixtureLayers.map(({ id, token }) => [id, token]),
     ];
@@ -358,13 +368,13 @@ test('an isolated valid two-character fixture round-trips an l field beyond the
     assert.equal(codec.validateLayerStateRegistry(), true);
     assert.equal(
       nextLayerStateToken(
-        parseLayerStateTokenReservations([...reservationRows, ...priorDigits]),
+        parseLayerStateTokenReservations([...preWildlifeRows, ...priorDigits]),
       ),
       '00',
     );
     assert.equal(
       validateLayerStateAllocations(
-        LAYER_STATE_TOKEN_RESERVATIONS,
+        parseLayerStateTokenReservations(preWildlifeRows),
         codec.LAYER_STATE_TOKEN_RESERVATIONS,
       ),
       true,
@@ -395,7 +405,7 @@ test('checker reads a complete future base ledger and rejects retired-token reus
     },
     (cwd) => {
       const published = readPublishedLayerStateReservations('HEAD', cwd);
-      assert.equal(Object.keys(published).length, 36);
+      assert.equal(Object.keys(published).length, 37);
       assert.equal(published['retired-layer'], '00');
       assert.throws(
         () =>

src/data/layerStateTokenReservations.json

@@ -33,5 +33,6 @@
   ["weather-lightning", "l"],
   ["weather-radar", "v"],
   ["weather-satellite", "o"],
+  ["wildlife-sightings", "9"],
   ["wind", "k"]
 ]

src/data/militaryAwareness.test.mjs

@@ -98,6 +98,7 @@ function installAwarenessRuntime({
   // status its module never emits guards nothing. See the settled-but-fetching
   // tests below, which use militaryInstallations' genuine first-fetch readout.
   layerStats = {},
+  subscribe = undefined,
 } = {}) {
   const originalWindow = globalThis.window;
   const originalDocument = globalThis.document;
@@ -215,6 +216,7 @@ function installAwarenessRuntime({
     setEnabled,
     getLayerLifecycleState,
     layers,
+    ...(subscribe ? { subscribe } : {}),
   });
   militaryAwarenessLayer.setParams({ passive: true });
   militaryAwarenessLayer.init(viewer);
@@ -383,6 +385,54 @@ test('Contacts does not claim a dependency already enabling for the user', async
   }
 });
 
+test('a dependency the user adopts stays on when Contacts turns off', async () => {
+  // A direct selection, or the Cockpit riding one of its aircraft, promotes a
+  // layer Contacts turned on into the user's own (adoptLayerVisibility). The
+  // coordinator must give it up, or its OFF release tears the layer down —
+  // and the track or the Cockpit with it — before Context restores it.
+  const calls = [];
+  const subscribers = new Set();
+  const runtime = installAwarenessRuntime({
+    isEnabled: () => false,
+    isEffectivelyEnabled: () => false,
+    setEnabled: (layerId, enabled) => {
+      calls.push({ layerId, enabled });
+      return Promise.resolve(true);
+    },
+    subscribe: (listener) => {
+      subscribers.add(listener);
+      return () => subscribers.delete(listener);
+    },
+  });
+
+  try {
+    militaryAwarenessLayer.setParams({ passive: false });
+    await nextTurn();
+    for (const listener of subscribers)
+      listener({
+        type: 'visibility',
+        layerId: 'flights',
+        enabled: true,
+        origin: 'user',
+        adopted: true,
+        adoptedFromSelection: true,
+      });
+    await militaryAwarenessLayer.disable();
+    const released = calls
+      .filter(({ enabled }) => !enabled)
+      .map(({ layerId }) => layerId)
+      .sort();
+    assert.deepEqual(
+      released,
+      AWARENESS_DEPENDENCIES.filter((layerId) => layerId !== 'flights').sort(),
+      'the adopted layer is the user\'s now; the rest are still released',
+    );
+  } finally {
+    runtime.restore();
+  }
+  assert.equal(subscribers.size, 0, 'destroy drops the manager subscription');
+});
+
 test('operational awareness becomes ready after aircraft while deferred sources keep loading', async () => {
   let enabled = false;
   let releaseAircraft;

src/data/spriteOrder.js

@@ -2,6 +2,7 @@
 export const SPRITE_LAYER_ORDER = Object.freeze([
   'cctv',
   'firms',
+  'wildlife-sightings',
   'bikeshare',
   'transit',
   'transit-motion',

src/data/traffic.test.mjs

@@ -30,6 +30,28 @@ test('a superseded flow fetch is not an outage', () => {
   assert.equal(deriveTrafficFlowError(undefined), null);
 });
 
+test('hosted account limits and service failures name their own reason', () => {
+  const failure = (status, code) =>
+    deriveTrafficFlowError(
+      Object.assign(new Error(`TomTom flow unavailable (HTTP ${status})`), {
+        status,
+        code,
+      }),
+    );
+  assert.equal(
+    failure(429, 'USAGE_LIMIT_REACHED'),
+    'Monthly traffic allowance used',
+  );
+  assert.equal(failure(429, 'RATE_LIMITED'), 'Traffic rate limit reached');
+  assert.equal(failure(429, 'budget'), 'TomTom daily budget reached');
+  assert.equal(failure(503, 'no_key'), 'TomTom key unavailable');
+  assert.equal(failure(503, null), 'TomTom key unavailable');
+  assert.equal(
+    failure(503, 'USAGE_UNAVAILABLE'),
+    'Traffic service unavailable',
+  );
+});
+
 test('flow failures map onto short, specific reasons', () => {
   const reason = (message) => deriveTrafficFlowError(new Error(message));
   assert.equal(reason('flow tile 12/1/1: HTTP 503'), 'TomTom key unavailable');

src/firstRunExperience.test.mjs

@@ -1020,6 +1020,14 @@ test('the voice TOOL SCHEMA matches the pinned contract — the mission mapping
     'noir',
   ]);
   visualStyle.enum = [...visualStyle.enum, 'snow'];
+  // Tilt to an angle adds pitchDeg and rewords direction; restore
+  // the legacy camera fields to keep the pin.
+  const camera = legacyTools.find((tool) => tool.name === 'move_camera')
+    .parameters.properties;
+  assert.equal(camera.pitchDeg.type, 'number');
+  delete camera.pitchDeg;
+  camera.direction.description =
+    'Required for pan/tilt/rotate; orbit/rotate_globe default right.';
   const block = JSON.stringify(legacyTools);
   // Re-derived for the voice layer manifest (generated layer enums, alias and
   // field hints), point-and-ask's pointer/referent arguments and the prompt
@@ -1039,10 +1047,11 @@ test('the voice TOOL SCHEMA matches the pinned contract — the mission mapping
   // The Utilities panel adds one set_panel_open target; Sea Marks and Ski
   // Pistes extend the generated layer enums and alias hint; voice geometry
   // adds the analyst area scopes and the osm-places layer.
-  assert.equal(block.length, 31318, 'serialized tool schema length drifted');
+  // control_cockpit states the own-layer entry rule (Contacts not required).
+  assert.equal(block.length, 31372, 'serialized tool schema length drifted');
   assert.equal(
     crypto.createHash('sha256').update(block).digest('hex'),
-    'f5b42f41c2f575838f979e88a1dbff615a77ccd85fdf8fcd0a0a47d02f7d3ddc',
+    '7f593e78c232db972b04441f830b6a60f93916a6e5bc5a68eca7422cd1035508',
     'the first-run missions must ride EXISTING tools: no schema edit, no cache bust',
   );
   const instructions = fs.readFileSync(

src/globeInView.js

@@ -0,0 +1,179 @@
+import * as Cesium from 'cesium';
+
+// Cesium's free look (Shift+drag) turns the camera in place. Near the ground
+// that surveys a city; from orbit a few drags turn the whole planet out of
+// frame and leave only stars.
+export const FREE_LOOK_MAX_HEIGHT_METERS = 1_000_000;
+
+// A voice turn from orbit stops when about this share of the frame still shows
+// the planet's surface.
+export const MIN_GLOBE_FRAME_SHARE = 0.1;
+
+/**
+ * A free globe camera: the viewer is in 3D, follows no tracked entity, and its
+ * camera is not locked to a reference frame.
+ */
+export function isFreeGlobeCamera(viewer) {
+  return (
+    viewer.scene.mode === Cesium.SceneMode.SCENE3D &&
+    !viewer.trackedEntity &&
+    Cesium.Matrix4.equals(viewer.camera.transform, Cesium.Matrix4.IDENTITY)
+  );
+}
+
+const GRID_COLUMNS = 32;
+const GRID_ROWS = 18;
+// A turn across a sliver of planet moves its edge through sample points, so
+// the share wobbles by a cell or two without the planet leaving.
+const GRID_NOISE_CELLS = 2;
+// Whatever the baseline, a voice turn never takes the planet below this share
+// of the frame; a view that already shows less may only keep what it has.
+const LOOK_ABSOLUTE_FLOOR_SHARE = 0.01;
+const sampleRay = new Cesium.Ray();
+const sampleOffset = new Cesium.Cartesian3();
+
+/**
+ * Cast a 32×18 grid of view rays, one through the centre of each cell, at the
+ * WGS84 ellipsoid. With `keyholeRadius` (a radius around the frame centre, in
+ * units of half the frame height) only the cells inside that circle count: the
+ * scope mask hides the rest. Returns the surface hits and the cells counted, or
+ * null for a frustum other than a perspective one.
+ */
+function sampleFrame(camera, keyholeRadius) {
+  const frustum = camera.frustum;
+  if (!(frustum instanceof Cesium.PerspectiveFrustum)) return null;
+  const aspect = frustum.aspectRatio;
+  const tanY = Math.tan(frustum.fovy / 2);
+  const tanX = tanY * aspect;
+  const keyholeSquared = keyholeRadius > 0 ? keyholeRadius * keyholeRadius : 0;
+  Cesium.Cartesian3.clone(camera.positionWC, sampleRay.origin);
+  let hits = 0;
+  let cells = 0;
+  for (let row = 0; row < GRID_ROWS; row += 1) {
+    const rowY = (2 * (row + 0.5)) / GRID_ROWS - 1;
+    for (let column = 0; column < GRID_COLUMNS; column += 1) {
+      const columnX = (2 * (column + 0.5)) / GRID_COLUMNS - 1;
+      if (
+        keyholeSquared &&
+        (columnX * aspect) ** 2 + rowY * rowY > keyholeSquared
+      )
+        continue;
+      cells += 1;
+      Cesium.Cartesian3.multiplyByScalar(
+        camera.rightWC,
+        columnX * tanX,
+        sampleOffset,
+      );
+      Cesium.Cartesian3.add(
+        camera.directionWC,
+        sampleOffset,
+        sampleRay.direction,
+      );
+      Cesium.Cartesian3.multiplyByScalar(
+        camera.upWC,
+        rowY * tanY,
+        sampleOffset,
+      );
+      Cesium.Cartesian3.add(
+        sampleRay.direction,
+        sampleOffset,
+        sampleRay.direction,
+      );
+      Cesium.Cartesian3.normalize(sampleRay.direction, sampleRay.direction);
+      if (
+        Cesium.IntersectionTests.rayEllipsoid(sampleRay, Cesium.Ellipsoid.WGS84)
+      )
+        hits += 1;
+    }
+  }
+  return { hits, cells };
+}
+
+/**
+ * Share of the frame, from 0 to 1, that shows the planet's surface: the
+ * fraction of a 32×18 grid of view rays, one through the centre of each cell,
+ * that hit the WGS84 ellipsoid. With `keyholeRadius` (see `sampleFrame`) it is
+ * the share of the visible circle instead. A frustum other than a perspective
+ * one counts as fully covered.
+ */
+export function globeFrameShare(camera, { keyholeRadius = 0 } = {}) {
+  const sample = sampleFrame(camera, keyholeRadius);
+  if (!sample || sample.cells === 0) return 1;
+  return sample.hits / sample.cells;
+}
+
+/** True when none of the planet's surface is in `camera`'s visible frame. */
+export function globeOutOfFrame(camera, options) {
+  return globeFrameShare(camera, options) === 0;
+}
+
+const lookProbes = new WeakMap();
+const LOOK_EDGE_TOLERANCE = Cesium.Math.toRadians(0.05);
+
+/**
+ * How much of one in-place look step (`lookUp`, `lookDown`, `lookLeft` or
+ * `lookRight` by a non-negative `angle` in radians) keeps the planet in frame
+ * from orbit. Above the free-look height the step may not leave less than
+ * `MIN_GLOBE_FRAME_SHARE` of the visible frame on the planet, or less than
+ * `startShare` when that is lower, give or take two grid cells of sampling
+ * noise. However the baseline was taken, it never leaves less than 1% of the
+ * frame, and a view that already shows less may only keep or gain what it has.
+ * `startShare` is the baseline the turn is measured against (the current share
+ * by default): callers pass one value to every step of a motion, and to every
+ * turn that continues from where the last one left off, so the limit cannot
+ * slide down a step or a command at a time. `keyholeRadius` limits the measure
+ * to the scope's visible circle, as in `globeFrameShare`.
+ * With nothing on screen the limit is nothing either, so the step is left to
+ * the move-end recovery. Returns `angle` when the whole step fits, otherwise a
+ * smaller angle that fits, found by bisection to within 0.05°, so a stopped
+ * motion rests at the limit. Steps are tried on a copy; `camera` is not moved.
+ */
+export function lookAngleWithinFrame(
+  camera,
+  look,
+  angle,
+  { startShare, keyholeRadius = 0 } = {},
+) {
+  if (
+    !(angle > 0) ||
+    !(camera.positionCartographic?.height > FREE_LOOK_MAX_HEIGHT_METERS)
+  )
+    return angle;
+  const sample = sampleFrame(camera, keyholeRadius);
+  if (!sample || sample.cells === 0) return angle;
+  const share = sample.hits / sample.cells;
+  const baseline = startShare ?? share;
+  // Capped at what is on screen now, so a step that keeps or gains surface is
+  // never refused, even when the frame has shrunk since the baseline was taken
+  // (a resized window or a turned phone).
+  const floor = Math.min(
+    share,
+    Math.max(
+      Math.min(MIN_GLOBE_FRAME_SHARE, baseline) -
+        GRID_NOISE_CELLS / sample.cells,
+      Math.min(LOOK_ABSOLUTE_FLOOR_SHARE, baseline),
+    ),
+  );
+  const fits = (step) => {
+    const probe = Cesium.Camera.clone(camera, lookProbes.get(camera));
+    lookProbes.set(camera, probe);
+    probe[look](step);
+    // Shares are whole grid cells; the epsilon keeps rounding in `floor` from
+    // costing a cell.
+    return globeFrameShare(probe, { keyholeRadius }) >= floor - 1e-9;
+  };
+  if (fits(angle)) return angle;
+  let inside = 0;
+  let outside = angle;
+  while (outside - inside > LOOK_EDGE_TOLERANCE) {
+    const middle = (inside + outside) / 2;
+    if (fits(middle)) inside = middle;
+    else outside = middle;
+  }
+  return inside;
+}
+
+/** True when an in-place look step of `angle` would lose part of its turn. */
+export function lookStepLosesGlobe(camera, look, angle, options) {
+  return lookAngleWithinFrame(camera, look, angle, options) < angle;
+}

src/i18n/locales/ar.json

@@ -1749,6 +1749,9 @@
   "Hybrid": "هجين",
   "TomTom key unavailable": "مفتاح TomTom غير متاح",
   "TomTom daily budget reached": "بلغت الحصة اليومية لـ TomTom",
+  "Monthly traffic allowance used": "تم استهلاك حصة حركة المرور الشهرية",
+  "Traffic rate limit reached": "تم بلوغ حد طلبات حركة المرور",
+  "Traffic service unavailable": "خدمة حركة المرور غير متاحة",
   "TomTom upstream unreachable": "تعذّر الوصول إلى خادم TomTom",
   "TomTom flow unavailable": "تدفق TomTom غير متاح",
   "SIMULATED — {reason}": "محاكى — {reason}",
@@ -2187,6 +2190,9 @@
   "{value} KM/H": "{value} كم/س",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · نطاق جو/بحر {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · المنشآت {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "مصدر البيانات العسكرية متوقف · صورة جزئية",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "مصدر الرحلات متوقف · صورة جزئية",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "قائمة الطائرات القريبة غير مكتملة · لا يعني أن الوضع آمن",
   "SQUAWK {code} · {status}": "SQUAWK {code} · {status}",
   "ADS-B PRIORITY · {status}": "أولوية ADS-B · {status}",
   "ADS-B EMERGENCY · {status}": "طوارئ ADS-B · {status}",
@@ -3404,5 +3410,61 @@
   "FAA prohibited and restricted special-use airspace only, not the UAS Facility Map or UAS flight restrictions. Informational only — not a substitute for official UAS flight-planning tools (B4UFLY / LAANC).": "المجال الجوي الخاص المحظور والمقيّد لدى FAA فقط، ولا يشمل UAS Facility Map أو قيود طيران UAS. للعلم فقط — ولا يغني عن الأدوات الرسمية لتخطيط رحلات UAS (B4UFLY / LAANC).",
   "Prohibited": "محظور",
   "Restricted": "مقيّد",
-  "Prohibited & Restricted Airspace": "المجال الجوي المحظور والمقيّد"
+  "Prohibited & Restricted Airspace": "المجال الجوي المحظور والمقيّد",
+  "SIGHTING": "مشاهدة",
+  "Show {name} sighting": "إظهار مشاهدة {name}",
+  "seen {age} ago": "شوهد قبل {age}",
+  "observed {age} ago": "رُصد قبل {age}",
+  "Be Whale Wise": "راقب الحيتان بمسؤولية",
+  "Reported by {name} ({entity})": "أبلغ عنه {name} ({entity})",
+  "Reported by {name}": "أبلغ عنه {name}",
+  "Salish Sea": "بحر ساليش",
+  "Birds": "الطيور",
+  "Mammals": "الثدييات",
+  "Reptiles": "الزواحف",
+  "Amphibians": "البرمائيات",
+  "Ray-finned fishes": "الأسماك شعاعية الزعانف",
+  "Insects": "الحشرات",
+  "Arachnids": "العنكبوتيات",
+  "Plants": "النباتات",
+  "Fungi": "الفطريات",
+  "Other animals": "حيوانات أخرى",
+  "Other or unknown": "أخرى أو غير معروفة",
+  "{label} {detail} — click to retry": "{label} {detail} — انقر لإعادة المحاولة",
+  "Wildlife sightings source unavailable": "مصدر مشاهدات الحياة البرية غير متاح",
+  "Show only community-confirmed (research-grade) sightings": "إظهار المشاهدات المؤكدة مجتمعياً (بدرجة بحثية) فقط",
+  "No recent sightings in view": "لا توجد مشاهدات حديثة في العرض",
+  "Acartia feed unavailable": "تعذر الوصول إلى مصدر Acartia",
+  "Show all taxa": "إظهار جميع المجموعات التصنيفية",
+  "BIRDS": "الطيور",
+  "Show only birds": "إظهار الطيور فقط",
+  "MAMMALS": "الثدييات",
+  "Show only mammals": "إظهار الثدييات فقط",
+  "WHALES": "الحيتان",
+  "Show only whales and dolphins (7 days)": "إظهار الحيتان والدلافين فقط (7 أيام)",
+  "INSECTS": "الحشرات",
+  "Show only insects": "إظهار الحشرات فقط",
+  "PLANTS": "النباتات",
+  "Show only plants": "إظهار النباتات فقط",
+  "All rights reserved": "جميع الحقوق محفوظة",
+  "Cetacean": "حوتي",
+  "Wildlife Sightings": "مشاهدات الحياة البرية",
+  "Exit cockpit to fly to a sighting": "اخرج من قمرة القيادة للانتقال إلى مشاهدة",
+  "Exit cockpit to fly to a sighting area": "اخرج من قمرة القيادة للانتقال إلى منطقة مشاهدة",
+  "Wildlife": "الحياة البرية",
+  "Zoom in for local sightings": "قرّب لرؤية المشاهدات المحلية",
+  "Loading photo...": "جارٍ تحميل الصورة…",
+  "Photo unavailable": "الصورة غير متاحة",
+  "Location obscured to a 0.2° cell": "الموقع مخفي ضمن خلية بمقدار 0.2°",
+  "Photo of {name}": "صورة {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} مشاهدة ضمن النطاق",
+  "Close sighting": "إغلاق المشاهدة",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "حياة برية شوهدت خلال 48 ساعة (الحيتان 7 أيام). يوضح اللون ورمز الشارة المجموعة التصنيفية. تُعرض الأنواع الحساسة في خلايا بحجم 0.2° فقط؛ وتُقرّب مشاهدات الثدييات البحرية في بحر ساليش عبر Acartia إلى 0.01°. ليست إحصاءً شاملاً.",
+  "Open {name} on iNaturalist": "فتح {name} على iNaturalist",
+  "Open {name} on Acartia": "فتح {name} على Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "مساهمو iNaturalist · التراخيص لكل سجل",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "مساهمو iNaturalist · Acartia {count} (بحر ساليش) · التراخيص لكل سجل"
 }

src/i18n/locales/de.json

@@ -1667,6 +1667,9 @@
   "Hybrid": "Hybrid",
   "TomTom key unavailable": "TomTom-Schlüssel nicht verfügbar",
   "TomTom daily budget reached": "TomTom-Tagesbudget erreicht",
+  "Monthly traffic allowance used": "Monatliches Verkehrskontingent aufgebraucht",
+  "Traffic rate limit reached": "Verkehrs-Anfragelimit erreicht",
+  "Traffic service unavailable": "Verkehrsdienst nicht verfügbar",
   "TomTom upstream unreachable": "TomTom-Upstream nicht erreichbar",
   "TomTom flow unavailable": "TomTom-Verkehrsfluss nicht verfügbar",
   "SIMULATED — {reason}": "SIMULIERT – {reason}",
@@ -2087,6 +2090,9 @@
   "{value} KM/H": "{value} KM/H",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · {radius} LUFT-/SEEFENSTER",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · ANLAGEN {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "MILITÄR-FEED AUS · UNVOLLSTÄNDIGES LAGEBILD",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "FLUG-FEED AUS · UNVOLLSTÄNDIGES LAGEBILD",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "FLUGZEUGE IN DER NÄHE UNVOLLSTÄNDIG · KEINE ENTWARNUNG",
   "SQUAWK {code} · {status}": "SQUAWK {code} · {status}",
   "ADS-B PRIORITY · {status}": "ADS-B-PRIORITÄT · {status}",
   "ADS-B EMERGENCY · {status}": "ADS-B-NOTFALL · {status}",
@@ -3104,5 +3110,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "Der Anbieter hat den API-Schlüssel abgelehnt. Den Schlüssel in den Anbieter-Einstellungen prüfen.",
   "Too many chat requests. Try again in {seconds} s.": "Zu viele Chat-Anfragen. In {seconds} s erneut versuchen.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "Der Anbieter hat den Zugriff für diesen Schlüssel verweigert. Projekt, Region oder Berechtigungen des Schlüssels prüfen.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "Das Anbieterkonto hat kein Guthaben mehr. Die Abrechnung prüfen oder in den Einstellungen einen anderen KI-Anbieter wählen."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "Das Anbieterkonto hat kein Guthaben mehr. Die Abrechnung prüfen oder in den Einstellungen einen anderen KI-Anbieter wählen.",
+  "SIGHTING": "BEOBACHTUNG",
+  "Show {name} sighting": "Beobachtung von {name} anzeigen",
+  "seen {age} ago": "vor {age} gesichtet",
+  "observed {age} ago": "vor {age} beobachtet",
+  "Be Whale Wise": "Wale respektvoll beobachten",
+  "Reported by {name} ({entity})": "Gemeldet von {name} ({entity})",
+  "Reported by {name}": "Gemeldet von {name}",
+  "Salish Sea": "Salish-See",
+  "Birds": "Vögel",
+  "Mammals": "Säugetiere",
+  "Reptiles": "Reptilien",
+  "Amphibians": "Amphibien",
+  "Ray-finned fishes": "Strahlenflosser",
+  "Insects": "Insekten",
+  "Arachnids": "Spinnentiere",
+  "Plants": "Pflanzen",
+  "Fungi": "Pilze",
+  "Other animals": "Andere Tiere",
+  "Other or unknown": "Andere oder unbekannt",
+  "{label} {detail} — click to retry": "{label} {detail} — zum Wiederholen klicken",
+  "Wildlife sightings source unavailable": "Quelle für Naturbeobachtungen nicht verfügbar",
+  "Show only community-confirmed (research-grade) sightings": "Nur gemeinschaftlich bestätigte Beobachtungen (Forschungsqualität) anzeigen",
+  "No recent sightings in view": "Keine aktuellen Beobachtungen im Ausschnitt",
+  "Acartia feed unavailable": "Acartia-Datenstrom nicht verfügbar",
+  "Show all taxa": "Alle Artengruppen anzeigen",
+  "BIRDS": "VÖGEL",
+  "Show only birds": "Nur Vögel anzeigen",
+  "MAMMALS": "SÄUGETIERE",
+  "Show only mammals": "Nur Säugetiere anzeigen",
+  "WHALES": "WALE",
+  "Show only whales and dolphins (7 days)": "Nur Wale und Delfine anzeigen (7 Tage)",
+  "INSECTS": "INSEKTEN",
+  "Show only insects": "Nur Insekten anzeigen",
+  "PLANTS": "PFLANZEN",
+  "Show only plants": "Nur Pflanzen anzeigen",
+  "All rights reserved": "Alle Rechte vorbehalten",
+  "Cetacean": "Wal oder Delfin",
+  "Wildlife Sightings": "Naturbeobachtungen",
+  "Exit cockpit to fly to a sighting": "Cockpit verlassen, um zu einer Beobachtung zu fliegen",
+  "Exit cockpit to fly to a sighting area": "Cockpit verlassen, um zu einem Beobachtungsgebiet zu fliegen",
+  "Wildlife": "Tierwelt",
+  "Zoom in for local sightings": "Für lokale Beobachtungen vergrößern",
+  "Loading photo...": "Foto wird geladen…",
+  "Photo unavailable": "Foto nicht verfügbar",
+  "Location obscured to a 0.2° cell": "Standort auf eine 0,2°-Rasterzelle verschleiert",
+  "Photo of {name}": "Foto von {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} Sichtungen im Ausschnitt",
+  "Close sighting": "Sichtung schließen",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "In den letzten 48 h beobachtete Wildtiere (Wale 7 Tage). Farbe und Abzeichensymbol zeigen die Artengruppe. Empfindliche Arten erscheinen nur als 0,2°-Zellen; Acartia-Meldungen zu Meeressäugern aus der Salish-See werden auf 0,01° gerundet. Keine Bestandszählung.",
+  "Open {name} on iNaturalist": "{name} auf iNaturalist öffnen",
+  "Open {name} on Acartia": "{name} auf Acartia öffnen",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "iNaturalist-Beitragende · Lizenzen je Eintrag",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "iNaturalist-Beitragende · Acartia {count} (Salish-See) · Lizenzen je Eintrag"
 }

src/i18n/locales/es.json

@@ -1920,6 +1920,9 @@
   "N/A": "N/D",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · VENTANA AIRE/MAR {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · INSTALACIONES: {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "FUENTE MILITAR DESACTIVADA · PANORAMA PARCIAL",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "FUENTE DE VUELOS DESACTIVADA · PANORAMA PARCIAL",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "AERONAVES CERCANAS INCOMPLETAS · NO IMPLICA TODO DESPEJADO",
   "{source} · LOCATION QUERY · RECENT": "{source} · CONSULTA POR UBICACIÓN · RECIENTE",
   "ft": "ft",
   "kts": "kn",
@@ -2271,6 +2274,9 @@
   "SIMULATED — {reason}": "SIMULADO — {reason}",
   "TomTom key unavailable": "Clave de TomTom no disponible",
   "TomTom daily budget reached": "Se alcanzó el límite diario de TomTom",
+  "Monthly traffic allowance used": "Cupo mensual de tráfico agotado",
+  "Traffic rate limit reached": "Límite de solicitudes de tráfico alcanzado",
+  "Traffic service unavailable": "Servicio de tráfico no disponible",
   "TomTom upstream unreachable": "Servidor de TomTom inaccesible",
   "TomTom flow unavailable": "Flujo de TomTom no disponible",
   "API key rejected — check AISSTREAM_API_KEY": "Clave de API rechazada — revisa AISSTREAM_API_KEY",
@@ -3179,5 +3185,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "El proveedor rechazó la clave de API. Revísala en Ajustes de proveedores.",
   "Too many chat requests. Try again in {seconds} s.": "Demasiadas solicitudes de chat. Vuelve a intentarlo en {seconds} s.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "El proveedor denegó el acceso a esta clave. Revisa el proyecto, la región o los permisos de la clave.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "La cuenta del proveedor no tiene crédito. Revisa la facturación o elige otro proveedor de IA en Ajustes."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "La cuenta del proveedor no tiene crédito. Revisa la facturación o elige otro proveedor de IA en Ajustes.",
+  "SIGHTING": "AVISTAMIENTO",
+  "Show {name} sighting": "Mostrar avistamiento de {name}",
+  "seen {age} ago": "visto hace {age}",
+  "observed {age} ago": "observado hace {age}",
+  "Be Whale Wise": "Observa cetáceos con respeto",
+  "Reported by {name} ({entity})": "Reportado por {name} ({entity})",
+  "Reported by {name}": "Reportado por {name}",
+  "Salish Sea": "Mar de Salish",
+  "Birds": "Aves",
+  "Mammals": "Mamíferos",
+  "Reptiles": "Reptiles",
+  "Amphibians": "Anfibios",
+  "Ray-finned fishes": "Peces de aletas radiadas",
+  "Insects": "Insectos",
+  "Arachnids": "Arácnidos",
+  "Plants": "Plantas",
+  "Fungi": "Hongos",
+  "Other animals": "Otros animales",
+  "Other or unknown": "Otros o desconocidos",
+  "{label} {detail} — click to retry": "{label} {detail} — haz clic para reintentar",
+  "Wildlife sightings source unavailable": "Fuente de avistamientos no disponible",
+  "Show only community-confirmed (research-grade) sightings": "Mostrar solo observaciones confirmadas por la comunidad (grado de investigación)",
+  "No recent sightings in view": "No hay avistamientos recientes en la vista",
+  "Acartia feed unavailable": "Fuente Acartia no disponible",
+  "Show all taxa": "Mostrar todos los grupos taxonómicos",
+  "BIRDS": "AVES",
+  "Show only birds": "Mostrar solo aves",
+  "MAMMALS": "MAMÍFEROS",
+  "Show only mammals": "Mostrar solo mamíferos",
+  "WHALES": "CETÁCEOS",
+  "Show only whales and dolphins (7 days)": "Mostrar solo ballenas y delfines (7 días)",
+  "INSECTS": "INSECTOS",
+  "Show only insects": "Mostrar solo insectos",
+  "PLANTS": "PLANTAS",
+  "Show only plants": "Mostrar solo plantas",
+  "All rights reserved": "Todos los derechos reservados",
+  "Cetacean": "Cetáceo",
+  "Wildlife Sightings": "Avistamientos de fauna y flora",
+  "Exit cockpit to fly to a sighting": "Sal de la cabina para volar a un avistamiento",
+  "Exit cockpit to fly to a sighting area": "Sal de la cabina para volar a un área de avistamiento",
+  "Wildlife": "Vida silvestre",
+  "Zoom in for local sightings": "Acerca para ver avistamientos locales",
+  "Loading photo...": "Cargando foto…",
+  "Photo unavailable": "Foto no disponible",
+  "Location obscured to a 0.2° cell": "Ubicación oculta en una celda de 0,2°",
+  "Photo of {name}": "Foto de {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} avistamientos en la vista",
+  "Close sighting": "Cerrar avistamiento",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Fauna observada en las últimas 48 h (cetáceos 7 días). El color y el símbolo de la insignia indican el grupo taxonómico. Las especies sensibles solo se muestran en celdas de 0,2°; los informes de mamíferos marinos de Acartia en el mar de Salish se redondean a 0,01°. No es un censo.",
+  "Open {name} on iNaturalist": "Abrir {name} en iNaturalist",
+  "Open {name} on Acartia": "Abrir {name} en Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Colaboradores de iNaturalist · licencias por registro",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Colaboradores de iNaturalist · Acartia {count} (mar de Salish) · licencias por registro"
 }

src/i18n/locales/fr.json

@@ -1105,6 +1105,9 @@
   "Hybrid": "Hybride",
   "TomTom key unavailable": "Clé TomTom indisponible",
   "TomTom daily budget reached": "Quota quotidien TomTom atteint",
+  "Monthly traffic allowance used": "Quota mensuel de trafic épuisé",
+  "Traffic rate limit reached": "Limite de requêtes de trafic atteinte",
+  "Traffic service unavailable": "Service de trafic indisponible",
   "TomTom upstream unreachable": "Serveur TomTom injoignable",
   "TomTom flow unavailable": "Flux TomTom indisponible",
   "SIMULATED — {reason}": "SIMULÉ — {reason}",
@@ -1660,6 +1663,9 @@
   "REGIONAL NEWS": "ACTUS RÉGIONALES",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · AIR/MER {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · INSTALLATIONS : {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "FLUX MILITAIRE COUPÉ · SITUATION PARTIELLE",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "FLUX DES VOLS COUPÉ · SITUATION PARTIELLE",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "AÉRONEFS PROCHES INCOMPLETS · PAS UN FEU VERT",
   "CONTEXT STANDBY": "CONTEXTE EN VEILLE",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "ACTIVER LE CONTEXTE GLOBAL POUR LES PINGS DE PROXIMITÉ",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "CONTACT PERDU · DERNIER RELEVÉ CONNU · PAS UN FEU VERT",
@@ -3179,5 +3185,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "Le fournisseur a refusé la clé API. Vérifiez-la dans les paramètres des fournisseurs.",
   "Too many chat requests. Try again in {seconds} s.": "Trop de requêtes de discussion. Réessayez dans {seconds} s.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "Le fournisseur a refusé l'accès pour cette clé. Vérifiez le projet, la région ou les autorisations de la clé.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "Le compte du fournisseur n'a plus de crédit. Vérifiez la facturation ou choisissez un autre fournisseur d'IA dans les paramètres."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "Le compte du fournisseur n'a plus de crédit. Vérifiez la facturation ou choisissez un autre fournisseur d'IA dans les paramètres.",
+  "SIGHTING": "OBSERVATION",
+  "Show {name} sighting": "Afficher l’observation de {name}",
+  "seen {age} ago": "vu il y a {age}",
+  "observed {age} ago": "observé il y a {age}",
+  "Be Whale Wise": "Respectez les cétacés",
+  "Reported by {name} ({entity})": "Signalé par {name} ({entity})",
+  "Reported by {name}": "Signalé par {name}",
+  "Salish Sea": "Mer des Salish",
+  "Birds": "Oiseaux",
+  "Mammals": "Mammifères",
+  "Reptiles": "Reptiles",
+  "Amphibians": "Amphibiens",
+  "Ray-finned fishes": "Poissons à nageoires rayonnées",
+  "Insects": "Insectes",
+  "Arachnids": "Arachnides",
+  "Plants": "Plantes",
+  "Fungi": "Champignons",
+  "Other animals": "Autres animaux",
+  "Other or unknown": "Autres ou inconnus",
+  "{label} {detail} — click to retry": "{label} {detail} — cliquer pour réessayer",
+  "Wildlife sightings source unavailable": "Source des observations naturalistes indisponible",
+  "Show only community-confirmed (research-grade) sightings": "Afficher uniquement les observations confirmées par la communauté (qualité recherche)",
+  "No recent sightings in view": "Aucune observation récente dans la vue",
+  "Acartia feed unavailable": "Flux Acartia indisponible",
+  "Show all taxa": "Afficher tous les groupes taxonomiques",
+  "BIRDS": "OISEAUX",
+  "Show only birds": "Afficher uniquement les oiseaux",
+  "MAMMALS": "MAMMIFÈRES",
+  "Show only mammals": "Afficher uniquement les mammifères",
+  "WHALES": "CÉTACÉS",
+  "Show only whales and dolphins (7 days)": "Afficher uniquement les baleines et dauphins (7 jours)",
+  "INSECTS": "INSECTES",
+  "Show only insects": "Afficher uniquement les insectes",
+  "PLANTS": "PLANTES",
+  "Show only plants": "Afficher uniquement les plantes",
+  "All rights reserved": "Tous droits réservés",
+  "Cetacean": "Cétacé",
+  "Wildlife Sightings": "Observations naturalistes",
+  "Exit cockpit to fly to a sighting": "Quittez le cockpit pour rejoindre une observation",
+  "Exit cockpit to fly to a sighting area": "Quittez le cockpit pour rejoindre une zone d’observation",
+  "Wildlife": "Faune et flore",
+  "Zoom in for local sightings": "Zoomez pour les observations locales",
+  "Loading photo...": "Chargement de la photo…",
+  "Photo unavailable": "Photo indisponible",
+  "Location obscured to a 0.2° cell": "Localisation masquée dans une cellule de 0,2°",
+  "Photo of {name}": "Photo de {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} observations dans la vue",
+  "Close sighting": "Fermer l’observation",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Faune observée au cours des dernières 48 h (cétacés 7 jours). La couleur et le pictogramme du badge indiquent le groupe taxonomique. Les espèces sensibles sont limitées à des cellules de 0,2° ; les signalements de mammifères marins Acartia en mer des Salish sont arrondis à 0,01°. Pas un recensement.",
+  "Open {name} on iNaturalist": "Ouvrir {name} sur iNaturalist",
+  "Open {name} on Acartia": "Ouvrir {name} sur Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Contributeurs iNaturalist · licences par observation",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Contributeurs iNaturalist · Acartia {count} (mer des Salish) · licences par observation"
 }

src/i18n/locales/it.json

@@ -1105,6 +1105,9 @@
   "Hybrid": "Ibrido",
   "TomTom key unavailable": "Chiave TomTom non disponibile",
   "TomTom daily budget reached": "Budget giornaliero TomTom esaurito",
+  "Monthly traffic allowance used": "Quota mensile del traffico esaurita",
+  "Traffic rate limit reached": "Limite di richieste del traffico raggiunto",
+  "Traffic service unavailable": "Servizio traffico non disponibile",
   "TomTom upstream unreachable": "Servizio TomTom irraggiungibile",
   "TomTom flow unavailable": "Flusso TomTom non disponibile",
   "SIMULATED — {reason}": "SIMULATO: {reason}",
@@ -1660,6 +1663,9 @@
   "REGIONAL NEWS": "NOTIZIE REGIONALI",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · ARIA/MARE {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · SITI {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "FEED MILITARE DISATTIVATO · QUADRO PARZIALE",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "FEED VOLI DISATTIVATO · QUADRO PARZIALE",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "AEREI VICINI INCOMPLETI · NON È UN VIA LIBERA",
   "CONTEXT STANDBY": "CONTESTO IN ATTESA",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "ATTIVA IL CONTESTO GLOBALE PER I PING DI PROSSIMITÀ",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "CONTATTO PERSO · ULTIMA LETTURA NOTA · NON È UN VIA LIBERA",
@@ -3179,5 +3185,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "Il provider ha rifiutato la chiave API. Controllala in Impostazioni provider.",
   "Too many chat requests. Try again in {seconds} s.": "Troppe richieste di chat. Riprova tra {seconds} s.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "Il provider ha negato l'accesso per questa chiave. Controlla progetto, regione o autorizzazioni della chiave.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "L'account del provider ha esaurito il credito. Controlla la fatturazione o scegli un altro provider IA in Impostazioni."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "L'account del provider ha esaurito il credito. Controlla la fatturazione o scegli un altro provider IA in Impostazioni.",
+  "SIGHTING": "AVVISTAMENTO",
+  "Show {name} sighting": "Mostra avvistamento di {name}",
+  "seen {age} ago": "avvistato {age} fa",
+  "observed {age} ago": "osservato {age} fa",
+  "Be Whale Wise": "Rispetta i cetacei",
+  "Reported by {name} ({entity})": "Segnalato da {name} ({entity})",
+  "Reported by {name}": "Segnalato da {name}",
+  "Salish Sea": "Mare dei Salish",
+  "Birds": "Uccelli",
+  "Mammals": "Mammiferi",
+  "Reptiles": "Rettili",
+  "Amphibians": "Anfibi",
+  "Ray-finned fishes": "Pesci con pinne raggiate",
+  "Insects": "Insetti",
+  "Arachnids": "Aracnidi",
+  "Plants": "Piante",
+  "Fungi": "Funghi",
+  "Other animals": "Altri animali",
+  "Other or unknown": "Altri o sconosciuti",
+  "{label} {detail} — click to retry": "{label} {detail} — fai clic per riprovare",
+  "Wildlife sightings source unavailable": "Fonte degli avvistamenti non disponibile",
+  "Show only community-confirmed (research-grade) sightings": "Mostra solo osservazioni confermate dalla comunità (grado di ricerca)",
+  "No recent sightings in view": "Nessun avvistamento recente nella vista",
+  "Acartia feed unavailable": "Feed Acartia non disponibile",
+  "Show all taxa": "Mostra tutti i gruppi tassonomici",
+  "BIRDS": "UCCELLI",
+  "Show only birds": "Mostra solo uccelli",
+  "MAMMALS": "MAMMIFERI",
+  "Show only mammals": "Mostra solo mammiferi",
+  "WHALES": "CETACEI",
+  "Show only whales and dolphins (7 days)": "Mostra solo balene e delfini (7 giorni)",
+  "INSECTS": "INSETTI",
+  "Show only insects": "Mostra solo insetti",
+  "PLANTS": "PIANTE",
+  "Show only plants": "Mostra solo piante",
+  "All rights reserved": "Tutti i diritti riservati",
+  "Cetacean": "Cetaceo",
+  "Wildlife Sightings": "Avvistamenti naturalistici",
+  "Exit cockpit to fly to a sighting": "Esci dalla cabina per volare a un avvistamento",
+  "Exit cockpit to fly to a sighting area": "Esci dalla cabina per volare a un’area di avvistamento",
+  "Wildlife": "Natura",
+  "Zoom in for local sightings": "Ingrandisci per gli avvistamenti locali",
+  "Loading photo...": "Caricamento della foto…",
+  "Photo unavailable": "Foto non disponibile",
+  "Location obscured to a 0.2° cell": "Posizione oscurata in una cella di 0,2°",
+  "Photo of {name}": "Foto di {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} avvistamenti nella vista",
+  "Close sighting": "Chiudi avvistamento",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Fauna osservata nelle ultime 48 h (cetacei 7 giorni). Colore e simbolo del contrassegno indicano il gruppo tassonomico. Le specie sensibili sono mostrate solo in celle di 0,2°; le segnalazioni di mammiferi marini di Acartia nel mar dei Salish sono arrotondate a 0,01°. Non è un censimento.",
+  "Open {name} on iNaturalist": "Apri {name} su iNaturalist",
+  "Open {name} on Acartia": "Apri {name} su Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Contributori di iNaturalist · licenze per osservazione",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Contributori di iNaturalist · Acartia {count} (Mare dei Salish) · licenze per osservazione"
 }

src/i18n/locales/ja.json

@@ -1073,6 +1073,9 @@
   "Hybrid": "ハイブリッド",
   "TomTom key unavailable": "TomTomキーを利用できません",
   "TomTom daily budget reached": "TomTomの1日の上限に達しました",
+  "Monthly traffic allowance used": "今月の交通情報の上限に達しました",
+  "Traffic rate limit reached": "交通情報のリクエスト上限に達しました",
+  "Traffic service unavailable": "交通情報サービスを利用できません",
   "TomTom upstream unreachable": "TomTomのサービスに接続できません",
   "TomTom flow unavailable": "TomTomの交通流を利用できません",
   "SIMULATED — {reason}": "シミュレーション：{reason}",
@@ -1612,6 +1615,9 @@
   "REGIONAL NEWS": "地域ニュース",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · 航空機/船舶の範囲 {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · 施設 {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "軍用フィードオフ · 部分的な状況",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "フライトフィードオフ · 部分的な状況",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "付近の航空機情報は不完全 · 安全の保証ではありません",
   "CONTEXT STANDBY": "コンテキスト待機",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "グローバルコンテキストを有効にすると近接ピングを表示",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "コンタクト喪失 · 最終既知の値 · 安全の保証ではありません",
@@ -1684,7 +1690,7 @@
   "Restore real aircraft": "実際の航空機に戻す",
   "Reclassify as TR-3B": "TR-3Bに再分類",
   "TRACK ACQUIRED": "追跡開始",
-  "{label} · COURSE {heading}°": "{label} · 針路 {heading}°",
+  "{label} · COURSE {heading}°": "{label} · 対地針路 {heading}°",
   "Context could not restore every layer; try again": "コンテキストがすべてのレイヤーを復元できませんでした。もう一度お試しください",
   "No selected data layers": "選択中のデータレイヤーはありません",
   "{count} data layers could not be cleared": {
@@ -3029,5 +3035,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "プロバイダーがAPIキーを拒否しました。プロバイダー設定で確認してください。",
   "Too many chat requests. Try again in {seconds} s.": "チャットのリクエストが多すぎます。{seconds}秒後にもう一度お試しください。",
   "The provider refused access for this key. Check the key's project, region or permissions.": "プロバイダーがこのキーでのアクセスを拒否しました。キーのプロジェクト、リージョン、権限を確認してください。",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "プロバイダーアカウントのクレジットが不足しています。課金状況を確認するか、設定で別のAIプロバイダーを選んでください。"
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "プロバイダーアカウントのクレジットが不足しています。課金状況を確認するか、設定で別のAIプロバイダーを選んでください。",
+  "SIGHTING": "目撃情報",
+  "Show {name} sighting": "{name}の目撃情報を表示",
+  "seen {age} ago": "{age}前に目撃",
+  "observed {age} ago": "{age}前に観察",
+  "Be Whale Wise": "クジラに配慮しましょう",
+  "Reported by {name} ({entity})": "報告元 {name}（{entity}）",
+  "Reported by {name}": "報告元 {name}",
+  "Salish Sea": "セイリッシュ海",
+  "Birds": "鳥類",
+  "Mammals": "哺乳類",
+  "Reptiles": "爬虫類",
+  "Amphibians": "両生類",
+  "Ray-finned fishes": "条鰭類",
+  "Insects": "昆虫",
+  "Arachnids": "クモ類",
+  "Plants": "植物",
+  "Fungi": "菌類",
+  "Other animals": "その他の動物",
+  "Other or unknown": "その他・不明",
+  "{label} {detail} — click to retry": "{label} {detail} — クリックして再試行",
+  "Wildlife sightings source unavailable": "野生生物の目撃情報源を利用できません",
+  "Show only community-confirmed (research-grade) sightings": "コミュニティが確認した研究グレードの目撃情報のみ表示",
+  "No recent sightings in view": "表示範囲に最近の目撃情報はありません",
+  "Acartia feed unavailable": "Acartiaのフィードを利用できません",
+  "Show all taxa": "すべての分類群を表示",
+  "BIRDS": "鳥類",
+  "Show only birds": "鳥類のみ表示",
+  "MAMMALS": "哺乳類",
+  "Show only mammals": "哺乳類のみ表示",
+  "WHALES": "クジラ類",
+  "Show only whales and dolphins (7 days)": "クジラとイルカのみ表示（7日間）",
+  "INSECTS": "昆虫",
+  "Show only insects": "昆虫のみ表示",
+  "PLANTS": "植物",
+  "Show only plants": "植物のみ表示",
+  "All rights reserved": "無断転載禁止",
+  "Cetacean": "クジラ類",
+  "Wildlife Sightings": "野生生物の目撃情報",
+  "Exit cockpit to fly to a sighting": "目撃地点に移動するにはコックピットを終了",
+  "Exit cockpit to fly to a sighting area": "目撃範囲に移動するにはコックピットを終了",
+  "Wildlife": "野生生物",
+  "Zoom in for local sightings": "拡大して地域の目撃情報を表示",
+  "Loading photo...": "写真を読み込み中…",
+  "Photo unavailable": "写真を表示できません",
+  "Location obscured to a 0.2° cell": "位置は0.2°のセル内に秘匿されています",
+  "Photo of {name}": "{name}の写真",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "表示範囲に{count}件の目撃情報",
+  "Close sighting": "目撃情報を閉じる",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "過去48時間以内に観察された野生生物（クジラ類は7日間）。色とバッジのアイコンは分類群を表します。保護が必要な種は0.2°の区画のみ表示し、セイリッシュ海のAcartia海生哺乳類目撃情報は0.01°に丸めます。個体数調査ではありません。",
+  "Open {name} on iNaturalist": "iNaturalistで{name}を開く",
+  "Open {name} on Acartia": "Acartiaで{name}を開く",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "iNaturalist の投稿者 · ライセンスは記録ごと",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "iNaturalist の投稿者 · Acartia {count}（セイリッシュ海） · ライセンスは記録ごと"
 }

src/i18n/locales/pt.json

@@ -1103,6 +1103,9 @@
   "Hybrid": "Híbrido",
   "TomTom key unavailable": "Chave do TomTom indisponível",
   "TomTom daily budget reached": "Limite diário do TomTom atingido",
+  "Monthly traffic allowance used": "Cota mensal de trânsito esgotada",
+  "Traffic rate limit reached": "Limite de solicitações de trânsito atingido",
+  "Traffic service unavailable": "Serviço de trânsito indisponível",
   "TomTom upstream unreachable": "Servidor do TomTom inacessível",
   "TomTom flow unavailable": "Fluxo do TomTom indisponível",
   "SIMULATED — {reason}": "SIMULADO — {reason}",
@@ -1660,6 +1663,9 @@
   "REGIONAL NEWS": "NOTÍCIAS DA ÁREA",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · AR/MAR {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · INSTALAÇÕES: {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "FEED MILITAR DESLIGADO · QUADRO PARCIAL",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "FEED DE VOOS DESLIGADO · QUADRO PARCIAL",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "AERONAVES PRÓXIMAS INCOMPLETAS · NÃO GARANTE SEGURANÇA",
   "CONTEXT STANDBY": "CONTEXTO EM ESPERA",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "ATIVE O CONTEXTO GLOBAL PARA PINGS DE PROXIMIDADE",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "CONTATO PERDIDO · ÚLTIMA LEITURA CONHECIDA · NÃO GARANTE SEGURANÇA",
@@ -1736,7 +1742,7 @@
   "Restore real aircraft": "Restaurar a aeronave real",
   "Reclassify as TR-3B": "Reclassificar como TR-3B",
   "TRACK ACQUIRED": "RASTRO ADQUIRIDO",
-  "{label} · COURSE {heading}°": "{label} · CURSO {heading}°",
+  "{label} · COURSE {heading}°": "{label} · RUMO {heading}°",
   "Context could not restore every layer; try again": "O contexto não conseguiu restaurar todas as camadas; tente novamente",
   "No selected data layers": "Nenhuma camada de dados selecionada",
   "{count} data layers could not be cleared": {
@@ -3179,5 +3185,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "O provedor recusou a chave de API. Verifique-a em \"Configurações de provedores\".",
   "Too many chat requests. Try again in {seconds} s.": "Chat: limite de requisições atingido. Tente novamente em {seconds} s.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "O provedor negou o acesso para esta chave. Verifique o projeto, a região ou as permissões da chave.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "A conta do provedor está sem crédito. Verifique o faturamento ou escolha outro provedor de IA em \"Configurações\"."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "A conta do provedor está sem crédito. Verifique o faturamento ou escolha outro provedor de IA em \"Configurações\".",
+  "SIGHTING": "AVISTAMENTO",
+  "Show {name} sighting": "Mostrar avistamento de {name}",
+  "seen {age} ago": "visto há {age}",
+  "observed {age} ago": "observado há {age}",
+  "Be Whale Wise": "Respeite os cetáceos",
+  "Reported by {name} ({entity})": "Relatado por {name} ({entity})",
+  "Reported by {name}": "Relatado por {name}",
+  "Salish Sea": "Mar de Salish",
+  "Birds": "Aves",
+  "Mammals": "Mamíferos",
+  "Reptiles": "Répteis",
+  "Amphibians": "Anfíbios",
+  "Ray-finned fishes": "Peixes de nadadeiras raiadas",
+  "Insects": "Insetos",
+  "Arachnids": "Aracnídeos",
+  "Plants": "Plantas",
+  "Fungi": "Fungos",
+  "Other animals": "Outros animais",
+  "Other or unknown": "Outros ou desconhecidos",
+  "{label} {detail} — click to retry": "{label} {detail} — clique para tentar novamente",
+  "Wildlife sightings source unavailable": "Fonte de avistamentos indisponível",
+  "Show only community-confirmed (research-grade) sightings": "Mostrar apenas observações confirmadas pela comunidade (grau de pesquisa)",
+  "No recent sightings in view": "Nenhum avistamento recente na vista",
+  "Acartia feed unavailable": "Feed Acartia indisponível",
+  "Show all taxa": "Mostrar todos os grupos taxonômicos",
+  "BIRDS": "AVES",
+  "Show only birds": "Mostrar apenas aves",
+  "MAMMALS": "MAMÍFEROS",
+  "Show only mammals": "Mostrar apenas mamíferos",
+  "WHALES": "CETÁCEOS",
+  "Show only whales and dolphins (7 days)": "Mostrar apenas baleias e golfinhos (7 dias)",
+  "INSECTS": "INSETOS",
+  "Show only insects": "Mostrar apenas insetos",
+  "PLANTS": "PLANTAS",
+  "Show only plants": "Mostrar apenas plantas",
+  "All rights reserved": "Todos os direitos reservados",
+  "Cetacean": "Cetáceo",
+  "Wildlife Sightings": "Avistamentos de vida selvagem",
+  "Exit cockpit to fly to a sighting": "Saia da cabine para voar até um avistamento",
+  "Exit cockpit to fly to a sighting area": "Saia da cabine para voar até uma área de avistamento",
+  "Wildlife": "Vida selvagem",
+  "Zoom in for local sightings": "Amplie para ver avistamentos locais",
+  "Loading photo...": "Carregando foto…",
+  "Photo unavailable": "Foto indisponível",
+  "Location obscured to a 0.2° cell": "Localização ocultada em uma célula de 0,2°",
+  "Photo of {name}": "Foto de {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} avistamentos na vista",
+  "Close sighting": "Fechar avistamento",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Fauna observada nas últimas 48 h (cetáceos 7 dias). A cor e o símbolo do emblema indicam o grupo taxonômico. Espécies sensíveis aparecem apenas em células de 0,2°; os relatos de mamíferos marinhos da Acartia no mar de Salish são arredondados para 0,01°. Não é um censo.",
+  "Open {name} on iNaturalist": "Abrir {name} no iNaturalist",
+  "Open {name} on Acartia": "Abrir {name} no Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Colaboradores do iNaturalist · licenças por registro",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Colaboradores do iNaturalist · Acartia {count} (mar de Salish) · licenças por registro"
 }

src/i18n/locales/ru.json

@@ -458,7 +458,7 @@
   "SOURCE STATUS UNAVAILABLE": "СТАТУС ИСТОЧНИКА НЕДОСТУПЕН",
   "Select flight {title}": "Выбрать рейс {title}",
   "TRACK ACQUIRED": "ЦЕЛЬ ЗАХВАЧЕНА",
-  "{label} · COURSE {heading}°": "{label} · КУРС {heading}°",
+  "{label} · COURSE {heading}°": "{label} · ПУТЕВОЙ УГОЛ {heading}°",
   "Restore real aircraft": "Вернуть реальный самолёт",
   "Reclassify as TR-3B": "Переклассифицировать как TR-3B",
   "No selected data layers": "Нет выбранных слоёв данных",
@@ -1953,6 +1953,9 @@
   "N/A": "Н/Д",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · ОКНО ВОЗДУХ/МОРЕ {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · ОБЪЕКТЫ: {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "ВОЕННЫЙ ПОТОК ВЫКЛ · КАРТИНА НЕПОЛНАЯ",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "ПОТОК РЕЙСОВ ВЫКЛ · КАРТИНА НЕПОЛНАЯ",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "БЛИЖНИЕ ВОЗДУШНЫЕ СУДА: ДАННЫЕ НЕПОЛНЫЕ · ОТСУТСТВИЕ УГРОЗ НЕ ПОДТВЕРЖДЕНО",
   "{source} · LOCATION QUERY · RECENT": "{source} · ЗАПРОС ПО МЕСТУ · НЕДАВНИЕ",
   "ft": "фт",
   "kts": "уз",
@@ -2310,6 +2313,9 @@
   "SIMULATED — {reason}": "СИМУЛЯЦИЯ — {reason}",
   "TomTom key unavailable": "Ключ TomTom недоступен",
   "TomTom daily budget reached": "Исчерпан дневной лимит TomTom",
+  "Monthly traffic allowance used": "Месячный лимит данных о трафике исчерпан",
+  "Traffic rate limit reached": "Достигнут лимит запросов данных о трафике",
+  "Traffic service unavailable": "Сервис данных о трафике недоступен",
   "TomTom upstream unreachable": "Сервер TomTom не отвечает",
   "TomTom flow unavailable": "Поток TomTom недоступен",
   "API key rejected — check AISSTREAM_API_KEY": "Ключ API отклонён — проверьте AISSTREAM_API_KEY",
@@ -3254,5 +3260,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "Провайдер отклонил ключ API. Проверьте его в «Настройках провайдеров».",
   "Too many chat requests. Try again in {seconds} s.": "Слишком много запросов в чате. Повторите попытку через {seconds} с.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "Провайдер отказал этому ключу в доступе. Проверьте проект, регион или разрешения ключа.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "На вашем счёте у провайдера закончились средства. Проверьте оплату или выберите другого провайдера ИИ в настройках."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "На вашем счёте у провайдера закончились средства. Проверьте оплату или выберите другого провайдера ИИ в настройках.",
+  "SIGHTING": "НАБЛЮДЕНИЕ",
+  "Show {name} sighting": "Показать наблюдение: {name}",
+  "seen {age} ago": "замечено {age} назад",
+  "observed {age} ago": "наблюдалось {age} назад",
+  "Be Whale Wise": "Наблюдайте китов бережно",
+  "Reported by {name} ({entity})": "Сообщил: {name} ({entity})",
+  "Reported by {name}": "Сообщил: {name}",
+  "Salish Sea": "Селишское море",
+  "Birds": "Птицы",
+  "Mammals": "Млекопитающие",
+  "Reptiles": "Пресмыкающиеся",
+  "Amphibians": "Земноводные",
+  "Ray-finned fishes": "Лучепёрые рыбы",
+  "Insects": "Насекомые",
+  "Arachnids": "Паукообразные",
+  "Plants": "Растения",
+  "Fungi": "Грибы",
+  "Other animals": "Другие животные",
+  "Other or unknown": "Прочие или неизвестные",
+  "{label} {detail} — click to retry": "{label} {detail} — нажмите, чтобы повторить",
+  "Wildlife sightings source unavailable": "Источник наблюдений живой природы недоступен",
+  "Show only community-confirmed (research-grade) sightings": "Показать только подтверждённые сообществом наблюдения исследовательского уровня",
+  "No recent sightings in view": "Нет недавних наблюдений в области обзора",
+  "Acartia feed unavailable": "Лента Acartia недоступна",
+  "Show all taxa": "Показать все группы организмов",
+  "BIRDS": "ПТИЦЫ",
+  "Show only birds": "Показать только птиц",
+  "MAMMALS": "МЛЕКОПИТАЮЩИЕ",
+  "Show only mammals": "Показать только млекопитающих",
+  "WHALES": "КИТООБРАЗНЫЕ",
+  "Show only whales and dolphins (7 days)": "Показать только китов и дельфинов (7 дней)",
+  "INSECTS": "НАСЕКОМЫЕ",
+  "Show only insects": "Показать только насекомых",
+  "PLANTS": "РАСТЕНИЯ",
+  "Show only plants": "Показать только растения",
+  "All rights reserved": "Все права защищены",
+  "Cetacean": "Китообразное",
+  "Wildlife Sightings": "Наблюдения живой природы",
+  "Exit cockpit to fly to a sighting": "Выйдите из кабины, чтобы перейти к наблюдению",
+  "Exit cockpit to fly to a sighting area": "Выйдите из кабины, чтобы перейти к области наблюдения",
+  "Wildlife": "Живая природа",
+  "Zoom in for local sightings": "Приблизьте для местных наблюдений",
+  "Loading photo...": "Загрузка фото…",
+  "Photo unavailable": "Фото недоступно",
+  "Location obscured to a 0.2° cell": "Местоположение скрыто в ячейке 0,2°",
+  "Photo of {name}": "Фото {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} наблюдений в области просмотра",
+  "Close sighting": "Закрыть наблюдение",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Наблюдения дикой природы за 48 ч (китообразные — 7 дней). Цвет и символ значка обозначают таксономическую группу. Уязвимые виды показаны только ячейками 0,2°; сообщения Acartia о морских млекопитающих моря Селиш округлены до 0,01°. Не перепись.",
+  "Open {name} on iNaturalist": "Открыть {name} в iNaturalist",
+  "Open {name} on Acartia": "Открыть {name} в Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Участники iNaturalist · лицензия у каждой записи",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Участники iNaturalist · Acartia {count} (море Сэлиш) · лицензия у каждой записи"
 }

src/i18n/locales/uk.json

@@ -1120,6 +1120,9 @@
   "Hybrid": "Гібрид",
   "TomTom key unavailable": "Ключ TomTom недоступний",
   "TomTom daily budget reached": "Вичерпано денний ліміт TomTom",
+  "Monthly traffic allowance used": "Місячний ліміт даних про трафік вичерпано",
+  "Traffic rate limit reached": "Досягнуто ліміту запитів даних про трафік",
+  "Traffic service unavailable": "Сервіс даних про трафік недоступний",
   "TomTom upstream unreachable": "Сервер TomTom не відповідає",
   "TomTom flow unavailable": "Потік TomTom недоступний",
   "SIMULATED — {reason}": "ІМІТАЦІЯ — {reason}",
@@ -1683,6 +1686,9 @@
   "REGIONAL NEWS": "РЕГІОНАЛЬНІ НОВИНИ",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · РЕЙСИ / СУДНА · РАДІУС {radius}",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · ОБʼЄКТИ: {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "ВІЙСЬКОВИЙ ПОТІК ВИМК. · КАРТИНА НЕПОВНА",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "ПОТІК РЕЙСІВ ВИМК. · КАРТИНА НЕПОВНА",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "БЛИЗЬКІ ПОВІТРЯНІ СУДНА: ДАНІ НЕПОВНІ · НЕ ОЗНАЧАЄ «УСЕ ЧИСТО»",
   "CONTEXT STANDBY": "КОНТЕКСТ: ОЧІКУВАННЯ",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "УВІМКНІТЬ ГЛОБАЛЬНИЙ КОНТЕКСТ, ЩОБ БАЧИТИ КОНТАКТИ ПОБЛИЗУ",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "КОНТАКТ ВТРАЧЕНО · ОСТАННІ ВІДОМІ ПОКАЗНИКИ · НЕ ОЗНАЧАЄ «УСЕ ЧИСТО»",
@@ -1761,7 +1767,7 @@
   "Restore real aircraft": "Повернути справжній літак",
   "Reclassify as TR-3B": "Перекласифікувати як TR-3B",
   "TRACK ACQUIRED": "ТРЕК ЗАХОПЛЕНО",
-  "{label} · COURSE {heading}°": "{label} · КУРС {heading}°",
+  "{label} · COURSE {heading}°": "{label} · ШЛЯХОВИЙ КУТ {heading}°",
   "Context could not restore every layer; try again": "Не вдалося відновити всі шари контексту; спробуйте ще раз",
   "No selected data layers": "Шари даних не вибрано",
   "{count} data layers could not be cleared": {
@@ -3254,5 +3260,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "Постачальник відхилив ключ API. Перевірте його в «Налаштуваннях постачальників».",
   "Too many chat requests. Try again in {seconds} s.": "Забагато запитів до чату. Спробуйте ще раз через {seconds} с.",
   "The provider refused access for this key. Check the key's project, region or permissions.": "Постачальник відмовив цьому ключу в доступі. Перевірте проєкт, регіон або дозволи ключа.",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "На вашому рахунку в постачальника закінчилися кошти. Перевірте оплату або виберіть іншого постачальника ШІ в налаштуваннях."
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "На вашому рахунку в постачальника закінчилися кошти. Перевірте оплату або виберіть іншого постачальника ШІ в налаштуваннях.",
+  "SIGHTING": "СПОСТЕРЕЖЕННЯ",
+  "Show {name} sighting": "Показати спостереження: {name}",
+  "seen {age} ago": "помічено {age} тому",
+  "observed {age} ago": "спостерігалося {age} тому",
+  "Be Whale Wise": "Спостерігайте за китами дбайливо",
+  "Reported by {name} ({entity})": "Повідомив: {name} ({entity})",
+  "Reported by {name}": "Повідомив: {name}",
+  "Salish Sea": "Салішське море",
+  "Birds": "Птахи",
+  "Mammals": "Ссавці",
+  "Reptiles": "Плазуни",
+  "Amphibians": "Земноводні",
+  "Ray-finned fishes": "Променепері риби",
+  "Insects": "Комахи",
+  "Arachnids": "Павукоподібні",
+  "Plants": "Рослини",
+  "Fungi": "Гриби",
+  "Other animals": "Інші тварини",
+  "Other or unknown": "Інші або невідомі",
+  "{label} {detail} — click to retry": "{label} {detail} — натисніть, щоб повторити",
+  "Wildlife sightings source unavailable": "Джерело спостережень живої природи недоступне",
+  "Show only community-confirmed (research-grade) sightings": "Показати лише підтверджені спільнотою спостереження дослідницького рівня",
+  "No recent sightings in view": "Немає недавніх спостережень в області огляду",
+  "Acartia feed unavailable": "Стрічка Acartia недоступна",
+  "Show all taxa": "Показати всі групи організмів",
+  "BIRDS": "ПТАХИ",
+  "Show only birds": "Показати лише птахів",
+  "MAMMALS": "ССАВЦІ",
+  "Show only mammals": "Показати лише ссавців",
+  "WHALES": "КИТОПОДІБНІ",
+  "Show only whales and dolphins (7 days)": "Показати лише китів і дельфінів (7 днів)",
+  "INSECTS": "КОМАХИ",
+  "Show only insects": "Показати лише комах",
+  "PLANTS": "РОСЛИНИ",
+  "Show only plants": "Показати лише рослини",
+  "All rights reserved": "Усі права захищено",
+  "Cetacean": "Китоподібне",
+  "Wildlife Sightings": "Спостереження живої природи",
+  "Exit cockpit to fly to a sighting": "Вийдіть із кабіни, щоб перейти до спостереження",
+  "Exit cockpit to fly to a sighting area": "Вийдіть із кабіни, щоб перейти до області спостереження",
+  "Wildlife": "Жива природа",
+  "Zoom in for local sightings": "Наблизьте для місцевих спостережень",
+  "Loading photo...": "Завантаження фото…",
+  "Photo unavailable": "Фото недоступне",
+  "Location obscured to a 0.2° cell": "Місцеположення приховано в комірці 0,2°",
+  "Photo of {name}": "Фото {name}",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "{count} спостережень у полі зору",
+  "Close sighting": "Закрити спостереження",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "Спостереження дикої природи за 48 год (китоподібні — 7 днів). Колір і символ значка позначають таксономічну групу. Вразливі види показано лише клітинками 0,2°; повідомлення Acartia про морських ссавців моря Селіш округлено до 0,01°. Не перепис.",
+  "Open {name} on iNaturalist": "Відкрити {name} в iNaturalist",
+  "Open {name} on Acartia": "Відкрити {name} в Acartia",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "Учасники iNaturalist · ліцензія в кожного запису",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "Учасники iNaturalist · Acartia {count} (море Селіш) · ліцензія в кожного запису"
 }

src/i18n/locales/zh-CN.json

@@ -1049,6 +1049,9 @@
   "Hybrid": "混合",
   "TomTom key unavailable": "TomTom 密钥不可用",
   "TomTom daily budget reached": "已达 TomTom 每日配额",
+  "Monthly traffic allowance used": "本月交通流量额度已用完",
+  "Traffic rate limit reached": "已达到交通数据请求频率上限",
+  "Traffic service unavailable": "交通服务不可用",
   "TomTom upstream unreachable": "TomTom 上游服务无法连接",
   "TomTom flow unavailable": "TomTom 路况不可用",
   "SIMULATED — {reason}": "模拟——{reason}",
@@ -1588,6 +1591,9 @@
   "REGIONAL NEWS": "地区新闻",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · {radius} 空/海监视窗口",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · 设施 {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "军用数据源已关闭 · 态势不完整",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "航班数据源已关闭 · 态势不完整",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "附近航空器信息不完整 · 不代表安全无虞",
   "CONTEXT STANDBY": "态势待机",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "启用全局态势以接收邻近目标提醒",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "目标丢失 · 最后已知读数 · 不代表安全无虞",
@@ -1660,7 +1666,7 @@
   "Restore real aircraft": "恢复真实飞机",
   "Reclassify as TR-3B": "重新归类为 TR-3B",
   "TRACK ACQUIRED": "已获取航迹",
-  "{label} · COURSE {heading}°": "{label} · 航向 {heading}°",
+  "{label} · COURSE {heading}°": "{label} · 对地航向 {heading}°",
   "Context could not restore every layer; try again": "态势未能恢复所有图层，请重试",
   "No selected data layers": "没有已选数据图层",
   "{count} data layers could not be cleared": {
@@ -3029,5 +3035,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "服务商拒绝了 API 密钥。请在服务商设置中检查。",
   "Too many chat requests. Try again in {seconds} s.": "聊天请求过多。请在 {seconds} 秒后重试。",
   "The provider refused access for this key. Check the key's project, region or permissions.": "服务商拒绝了此密钥的访问请求。请检查该密钥所属的项目、区域或权限。",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "服务商账户余额不足。请检查账户的计费信息，或在设置中选择其他 AI 服务商。"
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "服务商账户余额不足。请检查账户的计费信息，或在设置中选择其他 AI 服务商。",
+  "SIGHTING": "目击",
+  "Show {name} sighting": "显示{name}目击",
+  "seen {age} ago": "{age}前目击",
+  "observed {age} ago": "{age}前观察",
+  "Be Whale Wise": "负责任地观鲸",
+  "Reported by {name} ({entity})": "报告方 {name}（{entity}）",
+  "Reported by {name}": "报告方 {name}",
+  "Salish Sea": "萨利希海",
+  "Birds": "鸟类",
+  "Mammals": "哺乳类",
+  "Reptiles": "爬行动物",
+  "Amphibians": "两栖动物",
+  "Ray-finned fishes": "辐鳍鱼类",
+  "Insects": "昆虫",
+  "Arachnids": "蛛形动物",
+  "Plants": "植物",
+  "Fungi": "真菌",
+  "Other animals": "其他动物",
+  "Other or unknown": "其他或未知",
+  "{label} {detail} — click to retry": "{label} {detail} — 点击重试",
+  "Wildlife sightings source unavailable": "野生生物目击来源不可用",
+  "Show only community-confirmed (research-grade) sightings": "仅显示社区确认（研究级）的目击",
+  "No recent sightings in view": "视野内无近期目击",
+  "Acartia feed unavailable": "Acartia数据源不可用",
+  "Show all taxa": "显示所有分类群",
+  "BIRDS": "鸟类",
+  "Show only birds": "仅显示鸟类",
+  "MAMMALS": "哺乳类",
+  "Show only mammals": "仅显示哺乳类",
+  "WHALES": "鲸类",
+  "Show only whales and dolphins (7 days)": "仅显示鲸和海豚（7天）",
+  "INSECTS": "昆虫",
+  "Show only insects": "仅显示昆虫",
+  "PLANTS": "植物",
+  "Show only plants": "仅显示植物",
+  "All rights reserved": "保留所有权利",
+  "Cetacean": "鲸类",
+  "Wildlife Sightings": "野生生物目击",
+  "Exit cockpit to fly to a sighting": "退出驾驶舱以飞往目击地点",
+  "Exit cockpit to fly to a sighting area": "退出驾驶舱以飞往目击区域",
+  "Wildlife": "野生生物",
+  "Zoom in for local sightings": "放大查看当地目击",
+  "Loading photo...": "正在加载照片…",
+  "Photo unavailable": "照片不可用",
+  "Location obscured to a 0.2° cell": "位置已模糊至0.2°网格",
+  "Photo of {name}": "{name}的照片",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "视野内有 {count} 次目击",
+  "Close sighting": "关闭目击记录",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "近48小时内观察到的野生生物（鲸类为7天）。颜色与徽章图标表示分类群。敏感物种仅以0.2°网格显示；Acartia提供的萨利希海海洋哺乳动物目击位置四舍五入到0.01°。并非种群普查。",
+  "Open {name} on iNaturalist": "在 iNaturalist 上打开 {name}",
+  "Open {name} on Acartia": "在 Acartia 上打开 {name}",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "iNaturalist 贡献者 · 各记录单独授权",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "iNaturalist 贡献者 · Acartia {count}（萨利希海） · 各记录单独授权"
 }

src/i18n/locales/zh-Hant.json

@@ -1044,6 +1044,9 @@
   "Hybrid": "混合",
   "TomTom key unavailable": "TomTom 密鑰不可用",
   "TomTom daily budget reached": "已達 TomTom 每日配額",
+  "Monthly traffic allowance used": "本月交通流量額度已用完",
+  "Traffic rate limit reached": "已達交通資料請求頻率上限",
+  "Traffic service unavailable": "交通服務無法使用",
   "TomTom upstream unreachable": "TomTom 上游服務無法連接",
   "TomTom flow unavailable": "TomTom 路況不可用",
   "SIMULATED — {reason}": "模擬——{reason}",
@@ -1578,6 +1581,9 @@
   "REGIONAL NEWS": "地區新聞",
   "{label} · {radius} AIR/SEA WINDOW": "{label} · {radius} 空/海監視窗口",
   "{scope} · INSTALLATIONS {coverage}": "{scope} · 設施 {coverage}",
+  "MILITARY FEED OFF · PARTIAL PICTURE": "軍用數據源已關閉 · 態勢不完整",
+  "FLIGHTS FEED OFF · PARTIAL PICTURE": "航班數據源已關閉 · 態勢不完整",
+  "NEARBY AIRCRAFT INCOMPLETE · NOT AN ALL-CLEAR": "附近航空器資訊不完整 · 不代表安全無虞",
   "CONTEXT STANDBY": "態勢待機",
   "ENABLE GLOBAL CONTEXT FOR PROXIMITY PINGS": "啟用全局態勢以接收鄰近目標提醒",
   "CONTACT LOST · LAST KNOWN READOUT · NOT AN ALL-CLEAR": "目標丟失 · 最後已知讀數 · 不代表安全無虞",
@@ -1650,7 +1656,7 @@
   "Restore real aircraft": "恢復真實飛機",
   "Reclassify as TR-3B": "重新歸類為 TR-3B",
   "TRACK ACQUIRED": "已獲取航跡",
-  "{label} · COURSE {heading}°": "{label} · 航向 {heading}°",
+  "{label} · COURSE {heading}°": "{label} · 對地航向 {heading}°",
   "Context could not restore every layer; try again": "態勢未能恢復所有圖層，請重試",
   "No selected data layers": "沒有已選數據圖層",
   "{count} data layers could not be cleared": {
@@ -3029,5 +3035,61 @@
   "The provider rejected the API key. Check it in Provider Settings.": "服務商拒絕了 API 密鑰。請在服務商設置中檢查。",
   "Too many chat requests. Try again in {seconds} s.": "聊天請求過多。請在 {seconds} 秒後重試。",
   "The provider refused access for this key. Check the key's project, region or permissions.": "服務商拒絕了此密鑰的訪問請求。請檢查該密鑰所屬的項目、區域或權限。",
-  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "服務商賬戶餘額不足。請檢查賬戶的計費信息，或在設置中選擇其他 AI 服務商。"
+  "The provider account is out of credit. Check its billing, or choose another AI Provider in Settings.": "服務商賬戶餘額不足。請檢查賬戶的計費信息，或在設置中選擇其他 AI 服務商。",
+  "SIGHTING": "目擊",
+  "Show {name} sighting": "顯示{name}目擊",
+  "seen {age} ago": "{age}前目擊",
+  "observed {age} ago": "{age}前觀察",
+  "Be Whale Wise": "負責任地賞鯨",
+  "Reported by {name} ({entity})": "通報方 {name}（{entity}）",
+  "Reported by {name}": "通報方 {name}",
+  "Salish Sea": "薩利希海",
+  "Birds": "鳥類",
+  "Mammals": "哺乳類",
+  "Reptiles": "爬行動物",
+  "Amphibians": "兩棲動物",
+  "Ray-finned fishes": "輻鰭魚類",
+  "Insects": "昆蟲",
+  "Arachnids": "蛛形動物",
+  "Plants": "植物",
+  "Fungi": "真菌",
+  "Other animals": "其他動物",
+  "Other or unknown": "其他或未知",
+  "{label} {detail} — click to retry": "{label} {detail} — 點擊重試",
+  "Wildlife sightings source unavailable": "野生生物目擊來源無法使用",
+  "Show only community-confirmed (research-grade) sightings": "僅顯示社群確認（研究級）的目擊",
+  "No recent sightings in view": "視野內無近期目擊",
+  "Acartia feed unavailable": "Acartia資料來源無法使用",
+  "Show all taxa": "顯示所有分類群",
+  "BIRDS": "鳥類",
+  "Show only birds": "僅顯示鳥類",
+  "MAMMALS": "哺乳類",
+  "Show only mammals": "僅顯示哺乳類",
+  "WHALES": "鯨類",
+  "Show only whales and dolphins (7 days)": "僅顯示鯨和海豚（7天）",
+  "INSECTS": "昆蟲",
+  "Show only insects": "僅顯示昆蟲",
+  "PLANTS": "植物",
+  "Show only plants": "僅顯示植物",
+  "All rights reserved": "保留所有權利",
+  "Cetacean": "鯨類",
+  "Wildlife Sightings": "野生生物目擊",
+  "Exit cockpit to fly to a sighting": "退出駕駛艙以飛往目擊地點",
+  "Exit cockpit to fly to a sighting area": "退出駕駛艙以飛往目擊區域",
+  "Wildlife": "野生生物",
+  "Zoom in for local sightings": "放大查看當地目擊",
+  "Loading photo...": "正在載入照片…",
+  "Photo unavailable": "照片無法使用",
+  "Location obscured to a 0.2° cell": "位置已模糊至0.2°網格",
+  "Photo of {name}": "{name}的照片",
+  "Acartia": "Acartia",
+  "CC BY 4.0": "CC BY 4.0",
+  "{count} sightings in view": "視野內有 {count} 次目擊",
+  "Close sighting": "關閉目擊紀錄",
+  "Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.": "近48小時內觀察到的野生生物（鯨類為7天）。顏色與徽章圖示表示分類群。敏感物種僅以0.2°網格顯示；Acartia提供的薩利希海海洋哺乳動物目擊位置四捨五入到0.01°。並非族群普查。",
+  "Open {name} on iNaturalist": "在 iNaturalist 上打開 {name}",
+  "Open {name} on Acartia": "在 Acartia 上打開 {name}",
+  "iNaturalist": "iNaturalist",
+  "iNaturalist contributors · licences per record": "iNaturalist 貢獻者 · 各紀錄個別授權",
+  "iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record": "iNaturalist 貢獻者 · Acartia {count}（薩利希海） · 各紀錄個別授權"
 }

src/i18n/same-as-english.json

@@ -4,10 +4,12 @@
     "978 MHz UAT",
     "AIS: --",
     "AIS: {name}",
+    "Acartia",
     "BRG {value}°",
     "BRG —",
     "CAL {value}",
     "CAL · {badge}",
+    "CC BY 4.0",
     "CCTV",
     "CRS {value}°",
     "CRT",
@@ -28,8 +30,11 @@
     "SRC {value}",
     "Sentinel-2",
     "WHOT/BHOT",
+    "acartia.io ↗",
     "dB",
     "hPa",
+    "iNaturalist",
+    "iNaturalist ↗",
     "{source} HTTP {status}",
     "▲ {frp} MW"
   ],
@@ -40,6 +45,7 @@
     "AIS: {name}",
     "ANIME",
     "AUTO",
+    "Acartia",
     "Alternative",
     "Ambient",
     "Anime",
@@ -50,6 +56,7 @@
     "Bloom",
     "Blues",
     "Bus",
+    "CC BY 4.0",
     "CCTV",
     "CHAT",
     "COCKPIT",
@@ -178,11 +185,14 @@
     "WSW",
     "Washington DC",
     "Wind",
+    "acartia.io ↗",
     "dB",
     "feed status|live",
     "fire behavior|Minimal",
     "ft",
     "hPa",
+    "iNaturalist",
+    "iNaturalist ↗",
     "km",
     "km/h",
     "min",
@@ -334,15 +344,24 @@
     "≥ {value} MW",
     "ΔE",
     "ΔN",
-    "▲ {frp} MW"
+    "▲ {frp} MW",
+    "ANIMAL · {name}",
+    "Acartia",
+    "CC BY 4.0",
+    "Reptiles",
+    "acartia.io ↗",
+    "iNaturalist ↗",
+    "iNaturalist"
   ],
   "fr": [
     "1090 MHz",
     "978 MHz UAT",
     "ALTITUDE",
     "ALTITUDE · FT",
+    "ANIMAL · {name}",
     "ANIME",
     "AUTO",
+    "Acartia",
     "Action",
     "Allocation",
     "Altitude {altitude}",
@@ -361,6 +380,7 @@
     "CALIBRATION",
     "CARGO",
     "CAUSE",
+    "CC BY 4.0",
     "CCTV",
     "CCTV OFF",
     "CCTV ON",
@@ -437,6 +457,7 @@
     "OK",
     "ON",
     "ON/OFF",
+    "Obs. {licence}",
     "Oldies",
     "PAUSE",
     "POSITION {age}",
@@ -452,8 +473,10 @@
     "RADAR · {units}",
     "RADIO",
     "REC",
+    "REPTILE · {name}",
     "Radio",
     "Reggae",
+    "Reptiles",
     "Rock",
     "S2 GhostMaps",
     "SAR",
@@ -488,10 +511,13 @@
     "VOLUME",
     "VS",
     "WHOT/BHOT",
+    "acartia.io ↗",
     "audio {state}",
     "dB",
     "ft",
     "hPa",
+    "iNaturalist",
+    "iNaturalist ↗",
     "image",
     "installation class|BASE",
     "installation class|INSTALLATION",
@@ -694,17 +720,24 @@
     "≥ {value} MW",
     "ΔE",
     "ΔN",
-    "▲ {frp} MW"
+    "▲ {frp} MW",
+    "Acartia",
+    "CC BY 4.0",
+    "acartia.io ↗",
+    "iNaturalist ↗",
+    "iNaturalist"
   ],
   "ja": [
     "1090 MHz",
     "978 MHz UAT",
     "AIS: --",
     "AIS: {name}",
+    "Acartia",
     "BRG {value}°",
     "BRG —",
     "CAL {value}",
     "CAL · {badge}",
+    "CC BY 4.0",
     "CCTV",
     "CH {index} / {total}",
     "CRS {value}°",
@@ -729,9 +762,12 @@
     "Sentinel-2",
     "USB {rate} msg/s",
     "WHOT/BHOT",
+    "acartia.io ↗",
     "dB",
     "ft",
     "hPa",
+    "iNaturalist",
+    "iNaturalist ↗",
     "km",
     "km/h",
     "kt",
@@ -877,11 +913,19 @@
     "{value} KM/S",
     "ΔN",
     "▲ {frp} MW",
-    "≥ {value} MW"
+    "≥ {value} MW",
+    "ANIMAL · {name}",
+    "Acartia",
+    "CC BY 4.0",
+    "acartia.io ↗",
+    "iNaturalist ↗",
+    "iNaturalist"
   ],
   "ru": [
     "AIS: --",
     "AIS: {name}",
+    "Acartia",
+    "CC BY 4.0",
     "CCTV",
     "CRT",
     "FLIR",
@@ -895,11 +939,16 @@
     "S2 GhostMaps",
     "S2 · {name}",
     "VS",
-    "WHOT/BHOT"
+    "WHOT/BHOT",
+    "acartia.io ↗",
+    "iNaturalist",
+    "iNaturalist ↗"
   ],
   "uk": [
     "AIS: --",
     "AIS: {name}",
+    "Acartia",
+    "CC BY 4.0",
     "CCTV",
     "CRT",
     "FLIR",
@@ -908,7 +957,10 @@
     "NVG",
     "REC",
     "S2 GhostMaps",
-    "WHOT/BHOT"
+    "WHOT/BHOT",
+    "acartia.io ↗",
+    "iNaturalist",
+    "iNaturalist ↗"
   ],
   "zh-CN": [
     "1090 MHz",
@@ -966,7 +1018,12 @@
     "≥ {value} MW",
     "ΔE",
     "ΔN",
-    "▲ {frp} MW"
+    "▲ {frp} MW",
+    "Acartia",
+    "CC BY 4.0",
+    "acartia.io ↗",
+    "iNaturalist ↗",
+    "iNaturalist"
   ],
   "zh-Hant": [
     "1090 MHz",
@@ -1024,6 +1081,11 @@
     "≥ {value} MW",
     "ΔE",
     "ΔN",
-    "▲ {frp} MW"
+    "▲ {frp} MW",
+    "Acartia",
+    "CC BY 4.0",
+    "acartia.io ↗",
+    "iNaturalist ↗",
+    "iNaturalist"
   ]
 }

src/layers/awareness/controls.js

@@ -23,6 +23,7 @@ export function createControls({ state: layerState, services, parts, source }) {
 
     attachDataManager(dataManager) {
       layerState.dataManager = dataManager;
+      parts.dependencies.watchAdoptions(dataManager);
     },
 
     setParams(params = {}) {

src/layers/awareness/dependencies.js

@@ -79,6 +79,25 @@ export function createDependencies({
     });
   }
 
+  /**
+   * Give up a dependency the user adopts. A direct selection, or the Cockpit
+   * riding one of its aircraft, promotes a layer Contacts turned on into the
+   * user's own (`DataLayerManager.adoptLayerVisibility`). Releasing it when
+   * Contacts goes off would tear down that track or Cockpit before the
+   * Context restore could put the layer back.
+   */
+  function relinquishAdoptedDependency(change) {
+    if (change?.type === 'visibility' && change.adopted && change.enabled)
+      layerState.ownedDependencies.delete(change.layerId);
+  }
+
+  /** Follow one manager's adoptions; null stops following. */
+  function watchAdoptions(dataManager) {
+    layerState.unwatchAdoptions?.();
+    layerState.unwatchAdoptions =
+      dataManager?.subscribe?.(relinquishAdoptedDependency) || null;
+  }
+
   function activateOperationalContext() {
     const activationId = ++layerState.activationId;
     layerState.autoFocusRetryPending = false;
@@ -113,6 +132,7 @@ export function createDependencies({
     refreshAfterDeferredDependency,
     enableDependencies,
     releaseOwnedDependencies,
+    watchAdoptions,
     activateOperationalContext,
   };
 }

src/layers/awareness/lifecycle.js

@@ -340,6 +340,7 @@ export function createLifecycle({
       layerState.clearListener = null;
       layerState.subjectClearListener = null;
       layerState.viewer = null;
+      parts.dependencies.watchAdoptions(null);
       layerState.dataManager = null;
     },
   };

src/layers/awareness/state.js

@@ -26,6 +26,8 @@ export function createState({ services }) {
     // layers activate only after Contacts is explicitly selected.
     passive: true,
     ownedDependencies: new Set(),
+    /** Stops following the manager's adoptions (see watchAdoptions). */
+    unwatchAdoptions: null,
     subject: null,
     results: null,
     visual: null,

src/layers/traffic/flow.js

@@ -38,7 +38,15 @@ export function createFlow({ state: layerState, services, parts, source }) {
     const status = Number.isFinite(error.status)
       ? error.status
       : Number(message.match(/HTTP (\d{3})/)?.[1]);
+    const code = typeof error.code === 'string' ? error.code : null;
     // English in state; trafficFeedPresentation translates it for the panel.
+    // A hosted deployment limits each account (code from the server); the
+    // local proxy has one daily budget (`budget`) and answers `no_key`.
+    if (code === 'USAGE_LIMIT_REACHED')
+      return msg('Monthly traffic allowance used');
+    if (code === 'RATE_LIMITED') return msg('Traffic rate limit reached');
+    if (status === 503 && code && code !== 'no_key')
+      return msg('Traffic service unavailable');
     if (status === 503) return msg('TomTom key unavailable');
     if (status === 429) return msg('TomTom daily budget reached');
     if (status === 502 || status === 504)

src/layers/traffic/flowSource.js

@@ -11,6 +11,26 @@ const FLOW_TILE_PATH = (z, x, y) => `/api/tomtom/flow/${z}/${x}/${y}.pbf`;
  * (STALE-BUDGET once the daily budget is spent, STALE-ERROR when TomTom
  * fails), and when the proxy fetched it.
  */
+/**
+ * The machine-readable reason a failed tile carries: `code` (hosted usage,
+ * e.g. USAGE_LIMIT_REACHED or RATE_LIMITED) or the local proxy's `error`
+ * (`no_key`, `budget`). Only short identifiers are kept; prose is ignored.
+ */
+async function failureCode(response) {
+  if (!/json/i.test(response.headers?.get?.('content-type') || '')) return null;
+  try {
+    const text = await response.text();
+    if (text.length > 4096) return null;
+    const body = JSON.parse(text);
+    const code = body?.code ?? body?.error;
+    return typeof code === 'string' && /^[A-Za-z_]{1,40}$/.test(code)
+      ? code
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 function tileFreshness(response) {
   const status = response.headers?.get?.('x-tomtom-cache') || '';
   const fetchedAt = Number(response.headers?.get?.('x-tomtom-fetched-at'));
@@ -60,7 +80,16 @@ export function createFlowTileSource({
     },
     fetchImpl: async (url, init) => {
       const response = await fetchImpl(url, init);
-      if (response.ok && !init.signal.aborted) {
+      if (!response.ok) {
+        const code = await failureCode(response);
+        await response.body?.cancel().catch(() => {});
+        throw Object.assign(
+          // Classified for display by deriveTrafficFlowError.
+          new Error(`TomTom flow unavailable (HTTP ${response.status})`),
+          { status: response.status, code },
+        );
+      }
+      if (!init.signal.aborted) {
         const path = String(url);
         const entry = {
           mark: tileFreshness(response),

src/layers/traffic/source.test.mjs

@@ -1050,3 +1050,29 @@ test('cancelling a flow body releases its freshness before a new request', async
   assert.equal(getEventListeners(requestSignal, 'abort').length, 0);
   assert.equal(source.getFlowSessionStats().cacheEntries, 0);
 });
+
+test('a failed flow tile carries the server reason for its label', async () => {
+  for (const [status, body, code] of [
+    [
+      429,
+      { error: 'Monthly usage limit reached', code: 'USAGE_LIMIT_REACHED' },
+      'USAGE_LIMIT_REACHED',
+    ],
+    [
+      429,
+      { error: 'Request rate limit reached', code: 'RATE_LIMITED' },
+      'RATE_LIMITED',
+    ],
+    [503, { error: 'no_key' }, 'no_key'],
+    [503, { error: 'Usage enforcement is temporarily unavailable' }, null],
+  ]) {
+    const source = createFlowTileSource({
+      fetchImpl: async () => Response.json(body, { status }),
+    });
+    await assert.rejects(source.fetchFlowForBounds(bounds), (error) => {
+      assert.equal(error.status, status);
+      assert.equal(error.code, code);
+      return true;
+    });
+  }
+});

src/layers/wildlifeSightings/acartiaTaxa.js

@@ -0,0 +1,155 @@
+// The regional feed includes sightings outside the layer's Salish Sea coverage.
+export const ACARTIA_GUARD_BOX = Object.freeze({
+  south: 45.5,
+  west: -126,
+  north: 50.5,
+  east: -121,
+});
+
+// Frozen, conservative cetacean species/alias list for this regional feed.
+// Exact normalized names only: an unfamiliar name must never become a whale
+// merely because it contains "whale", "dolphin" or a known species name.
+export const ACARTIA_CETACEAN_NAMES = Object.freeze([
+  'Orcinus orca',
+  'Orca',
+  'Killer whale',
+  'Southern resident killer whale',
+  'Northern resident killer whale',
+  'Resident killer whale',
+  "Bigg's killer whale",
+  'Transient killer whale',
+  'Offshore killer whale',
+  'Megaptera novaeangliae',
+  'Humpback whale',
+  'Humpback',
+  'Eschrichtius robustus',
+  'Gray whale',
+  'Grey whale',
+  'Balaenoptera acutorostrata',
+  'Common minke whale',
+  'Minke whale',
+  'Balaenoptera physalus',
+  'Fin whale',
+  'Finback whale',
+  'Balaenoptera musculus',
+  'Blue whale',
+  'Balaenoptera borealis',
+  'Sei whale',
+  'Eubalaena japonica',
+  'North Pacific right whale',
+  'Physeter macrocephalus',
+  'Sperm whale',
+  'Kogia breviceps',
+  'Pygmy sperm whale',
+  'Kogia sima',
+  'Dwarf sperm whale',
+  'Berardius bairdii',
+  "Baird's beaked whale",
+  'Ziphius cavirostris',
+  "Cuvier's beaked whale",
+  'Mesoplodon carlhubbsi',
+  "Hubbs' beaked whale",
+  'Mesoplodon stejnegeri',
+  "Stejneger's beaked whale",
+  'Mesoplodon ginkgodens',
+  'Ginkgo-toothed beaked whale',
+  'Phocoena phocoena',
+  'Harbor porpoise',
+  'Harbour porpoise',
+  'Phocoenoides dalli',
+  "Dall's porpoise",
+  'Lagenorhynchus obliquidens',
+  'Pacific white-sided dolphin',
+  'Lissodelphis borealis',
+  'Northern right whale dolphin',
+  'Grampus griseus',
+  "Risso's dolphin",
+  'Delphinus delphis',
+  'Short-beaked common dolphin',
+  'Common dolphin',
+  'Delphinus capensis',
+  'Long-beaked common dolphin',
+  'Tursiops truncatus',
+  'Common bottlenose dolphin',
+  'Bottlenose dolphin',
+  'Delphinapterus leucas',
+  'Beluga whale',
+  'Beluga',
+  'Pseudorca crassidens',
+  'False killer whale',
+  'Globicephala macrorhynchus',
+  'Short-finned pilot whale',
+]);
+
+// These names clearly identify a marine mammal but do not establish a species
+// in the cetacean list. Retain them for ALL/MAMMALS, never for WHALES.
+const OTHER_MARINE_MAMMAL_NAMES = Object.freeze([
+  'Phoca vitulina',
+  'Harbor seal',
+  'Harbour seal',
+  'Mirounga angustirostris',
+  'Northern elephant seal',
+  'Zalophus californianus',
+  'California sea lion',
+  'Eumetopias jubatus',
+  'Steller sea lion',
+  "Steller's sea lion",
+  'Callorhinus ursinus',
+  'Northern fur seal',
+  'Enhydra lutris',
+  'Sea otter',
+  'Seal',
+  'Unidentified seal',
+  'Sea lion',
+  'Unidentified sea lion',
+  'Pinniped',
+  'Unidentified pinniped',
+  'Marine mammal',
+  'Unidentified marine mammal',
+  'Unknown marine mammal',
+  'Cetacean',
+  'Unidentified cetacean',
+  'Unknown cetacean',
+  'Whale',
+  'Unidentified whale',
+  'Unknown whale',
+  'Dolphin',
+  'Unidentified dolphin',
+  'Unknown dolphin',
+  'Porpoise',
+  'Unidentified porpoise',
+  'Unknown porpoise',
+]);
+
+function speciesKey(value) {
+  return typeof value === 'string'
+    ? value
+        .trim()
+        .toLowerCase()
+        .replace(/[\u2018\u2019]/g, "'")
+        .replace(/[\u2010-\u2015]/g, '-')
+        .replace(/\s+/g, ' ')
+    : '';
+}
+
+const CETACEANS = new Set(ACARTIA_CETACEAN_NAMES.map(speciesKey));
+const OTHER_MARINE_MAMMALS = new Set(OTHER_MARINE_MAMMAL_NAMES.map(speciesKey));
+
+/** Classify exact normalized species names; ambiguous sightings stay noncetacean. */
+export function acartiaSpeciesGroup(value) {
+  const key = speciesKey(value);
+  if (CETACEANS.has(key)) return 'cetacean';
+  return OTHER_MARINE_MAMMALS.has(key) ? 'marine-mammal' : null;
+}
+
+/** Accept only positions inside the supported Salish Sea coverage. */
+export function inAcartiaCoverage(lat, lon) {
+  return (
+    Number.isFinite(lat) &&
+    Number.isFinite(lon) &&
+    lat >= ACARTIA_GUARD_BOX.south &&
+    lat <= ACARTIA_GUARD_BOX.north &&
+    lon >= ACARTIA_GUARD_BOX.west &&
+    lon <= ACARTIA_GUARD_BOX.east
+  );
+}

src/layers/wildlifeSightings/acartiaTaxa.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ACARTIA_CETACEAN_NAMES, acartiaSpeciesGroup } from './acartiaTaxa.js';
+
+test('frozen cetacean names accept only normalized exact species or aliases', () => {
+  assert.equal(Object.isFrozen(ACARTIA_CETACEAN_NAMES), true);
+  assert.throws(() => ACARTIA_CETACEAN_NAMES.push('Whale shark'), TypeError);
+  for (const name of ACARTIA_CETACEAN_NAMES) {
+    assert.equal(acartiaSpeciesGroup(name), 'cetacean');
+    assert.equal(acartiaSpeciesGroup(`  ${name.toUpperCase()}  `), 'cetacean');
+    assert.equal(acartiaSpeciesGroup(`${name} or another animal`), null);
+  }
+  assert.equal(acartiaSpeciesGroup('Dall’s porpoise'), 'cetacean');
+  assert.equal(acartiaSpeciesGroup('Pacific white–sided dolphin'), 'cetacean');
+  assert.equal(acartiaSpeciesGroup('  HARBOR  PORPOISE '), 'cetacean');
+});
+
+test('clearly marine mammal names remain distinct from validated cetacean species', () => {
+  for (const name of [
+    'Harbor seal',
+    'Phoca vitulina',
+    'Sea otter',
+    'Unidentified whale',
+  ]) {
+    assert.equal(acartiaSpeciesGroup(name), 'marine-mammal');
+  }
+  for (const name of [
+    'Unknown',
+    'Whale shark',
+    'Elephant',
+    '',
+    null,
+    { species: 'Orca' },
+  ]) {
+    assert.equal(acartiaSpeciesGroup(name), null);
+  }
+});

src/layers/wildlifeSightings/billboardModel.js

@@ -0,0 +1,114 @@
+import { drainWildlifeWork, WILDLIFE_WORK_UNIT } from './performance.js';
+import { wildlifeIconicGroup } from './model.js';
+
+/** Incremental billboard reconciliation, independent of Cesium and the DOM.
+ * A refresh changes only added/removed contacts and properties that differ.
+ * Position sampling and appearance construction run only for changed rows. */
+export function createWildlifeBillboardModel({
+  collection,
+  pointById,
+  positions,
+  positionForRow,
+  appearanceForGroup,
+}) {
+  const previous = new Map();
+
+  function update(rows, options = {}) {
+    return drainWildlifeWork(updateWork(rows, options));
+  }
+
+  function* updateWork(rows, { onOperations = null } = {}) {
+    const nextIds = new Set();
+    const result = { created: 0, removed: 0, updated: 0, writes: 0 };
+    let visits = 0;
+    for (const row of rows) {
+      if (visits++ % WILDLIFE_WORK_UNIT === 0) yield 'billboard-update';
+      const id = row.stableId;
+      if (nextIds.has(id)) continue;
+      nextIds.add(id);
+      const group = wildlifeIconicGroup(row.iconic);
+      const old = previous.get(id);
+      const point = pointById.get(id);
+      if (
+        old &&
+        point &&
+        old.lat === row.lat &&
+        old.lon === row.lon &&
+        old.group === group
+      )
+        continue;
+      const appearance =
+        old && old.group === group ? old.appearance : appearanceForGroup(group);
+      const positionChanged =
+        !old || old.lat !== row.lat || old.lon !== row.lon;
+      const position = positionChanged
+        ? positionForRow(row)
+        : positions.get(id);
+      if (!point) {
+        const options = { id: `wildlife:${id}`, position, ...appearance };
+        pointById.set(id, collection.add(options));
+        positions.set(id, position);
+        result.created += 1;
+        result.writes += Object.keys(options).length;
+      } else {
+        let writes = 0;
+        if (positionChanged) {
+          point.position = position;
+          positions.set(id, position);
+          writes += 1;
+        }
+        for (const key of Object.keys(appearance)) {
+          // Cesium clones Color and NearFarScalar values on assignment. Our
+          // last descriptor, rather than getter reference identity, records
+          // whether the appearance has actually changed.
+          if (old?.appearance?.[key] === appearance[key]) continue;
+          point[key] = appearance[key];
+          writes += 1;
+        }
+        result.writes += writes;
+        if (writes) result.updated += 1;
+      }
+      previous.set(id, {
+        lat: row.lat,
+        lon: row.lon,
+        group,
+        appearance,
+      });
+    }
+    for (const [id, point] of pointById) {
+      if (visits++ % WILDLIFE_WORK_UNIT === 0) yield 'billboard-update';
+      if (nextIds.has(id)) continue;
+      collection.remove(point);
+      pointById.delete(id);
+      positions.delete(id);
+      previous.delete(id);
+      result.removed += 1;
+    }
+    onOperations?.({ billboardVisits: visits, billboardWrites: result.writes });
+    return result;
+  }
+
+  function clear() {
+    collection.removeAll();
+    pointById.clear();
+    positions.clear();
+    previous.clear();
+  }
+
+  // Font readiness replaces just the cached texture. Never resample anchors,
+  // clear the collection or allocate replacement billboards for this swap.
+  function refreshImages(imageForGroup) {
+    let writes = 0;
+    for (const [id, old] of previous) {
+      const point = pointById.get(id);
+      const image = imageForGroup(old.group);
+      if (!point || old.appearance.image === image) continue;
+      point.image = image;
+      old.appearance = { ...old.appearance, image };
+      writes += 1;
+    }
+    return writes;
+  }
+
+  return { update, updateWork, clear, refreshImages };
+}

src/layers/wildlifeSightings/bounds.js

@@ -0,0 +1,51 @@
+// Shared by browser viewport queries and the provider's cache-key validation.
+export const WILDLIFE_MAX_VIEW_DEGREES = 40;
+
+const cleanDegree = (value) => Math.round(value * 1e8) / 1e8;
+const spanOf = (box) => Math.max(box.north - box.south, box.east - box.west);
+
+/** Snap non-crossing boxes outward to one canonical grid. Validate the final
+ * span too: a legal raw box may expand past the supported query size. */
+export function snapWildlifeBox(box) {
+  if (
+    !box ||
+    !['south', 'west', 'north', 'east'].every((key) =>
+      Number.isFinite(box[key]),
+    ) ||
+    box.south < -90 ||
+    box.north > 90 ||
+    box.west < -180 ||
+    box.east > 180 ||
+    box.north <= box.south ||
+    box.east <= box.west ||
+    spanOf(box) > WILDLIFE_MAX_VIEW_DEGREES + 1e-8
+  )
+    return null;
+  let grid = spanOf(box) > 5 ? 1 : 0.1;
+  const snap = () => ({
+    south: Math.max(
+      -90,
+      cleanDegree(Math.floor((box.south + 1e-10) / grid) * grid),
+    ),
+    west: Math.max(
+      -180,
+      cleanDegree(Math.floor((box.west + 1e-10) / grid) * grid),
+    ),
+    north: Math.min(
+      90,
+      cleanDegree(Math.ceil((box.north - 1e-10) / grid) * grid),
+    ),
+    east: Math.min(
+      180,
+      cleanDegree(Math.ceil((box.east - 1e-10) / grid) * grid),
+    ),
+  });
+  let snapped = snap();
+  // Crossing the five-degree boundary while snapping must pick the same grid
+  // on the browser and proxy, and on every subsequent snap of this box.
+  if (grid === 0.1 && spanOf(snapped) > 5 + 1e-8) {
+    grid = 1;
+    snapped = snap();
+  }
+  return spanOf(snapped) <= WILDLIFE_MAX_VIEW_DEGREES ? snapped : null;
+}

src/layers/wildlifeSightings/cache.integration.test.mjs

@@ -0,0 +1,111 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { inaturalistProxy } from '../../../server/providers/inaturalist/observations.js';
+import { syntheticGrid } from '../../../server/providers/inaturalist/grid.fixture.mjs';
+import {
+  createWildlifeSightingsSource,
+  WILDLIFE_GRID_TTL_MS,
+} from './source.js';
+
+// Exercise both real cache owners through their projected response contract.
+// Only the HTTP transport and upstream data are synthetic; no socket is needed.
+test('client and proxy share stale revalidation and publish its fresh result in the same view', async () => {
+  let now = Date.parse('2026-11-04T18:05:00Z');
+  let upstreamCalls = 0;
+  let proxyCalls = 0;
+  let finishRefresh;
+  let handler;
+  inaturalistProxy({
+    now: () => now,
+    cacheDir: null,
+    queueOptions: { intervalMs: 0, windowMs: 0 },
+    warn() {},
+    fetchImpl() {
+      upstreamCalls++;
+      return upstreamCalls === 1
+        ? Response.json(syntheticGrid())
+        : new Promise((resolve) => {
+            finishRefresh = resolve;
+          });
+    },
+  }).configureServer({
+    middlewares: {
+      use(_mount, middleware) {
+        handler = middleware;
+      },
+    },
+  });
+  const source = createWildlifeSightingsSource({
+    now: () => now,
+    async fetchImpl(url) {
+      proxyCalls++;
+      let status;
+      let headers;
+      let response;
+      await handler(
+        {
+          method: 'GET',
+          url: url.slice('/api/inaturalist'.length),
+          headers: {},
+          socket: { remoteAddress: 'synthetic' },
+        },
+        {
+          writeHead(code, values) {
+            status = code;
+            headers = values;
+          },
+          end(body) {
+            response = new Response(body, { status, headers });
+          },
+        },
+      );
+      return response;
+    },
+  });
+  const options = { tiles: [{ z: 2, x: 1, y: 1 }], taxa: 'Aves' };
+  const first = await source.getGridSnapshot(options);
+  assert.equal(first.cells.length, 2);
+  await source.getGridSnapshot(options);
+  assert.equal(upstreamCalls, 1);
+  assert.equal(proxyCalls, 1, 'client hits do not even call the proxy');
+  now += WILDLIFE_GRID_TTL_MS;
+  const publications = [];
+  let settled = false;
+  const refreshing = source
+    .getGridSnapshot({
+      ...options,
+      onTile: (value) => publications.push(value),
+    })
+    .then((value) => {
+      settled = true;
+      return value;
+    });
+  try {
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(settled, false, 'revalidation is still waiting for upstream');
+    assert.equal(
+      publications[0]?.stale,
+      true,
+      'old cells already reached the renderer',
+    );
+    assert.deepEqual(publications[0].cells, first.cells);
+    assert.equal(
+      upstreamCalls,
+      2,
+      'normal stale GET and refresh=wait share one upstream attempt',
+    );
+    finishRefresh(Response.json(syntheticGrid()));
+    const fresh = await refreshing;
+    assert.equal(fresh.stale, false);
+    assert.equal(fresh.fetchedAt, now);
+    assert.equal(publications.at(-1).fetchedAt, now);
+    assert.notEqual(publications.at(-1).stale, true);
+    const before = proxyCalls;
+    await source.getGridSnapshot(options);
+    assert.equal(proxyCalls, before);
+    assert.equal(upstreamCalls, 2);
+  } finally {
+    finishRefresh?.(Response.json(syntheticGrid()));
+    await refreshing;
+  }
+});

src/layers/wildlifeSightings/cards.js

@@ -0,0 +1,281 @@
+import { photoCreator } from './photoText.js';
+import { getLocale, t, translateKnown } from '../../i18n/index.js';
+import { CCTV_THUMBNAIL_STYLE } from '../../overlays/worldOverlayTokens.js';
+import { truncateOverlayTitle } from '../../overlays/worldOverlayDraw.js';
+import { isOpenPhoto } from './records.js';
+import { compareWildlifeIds, wildlifeIconicGroup } from './model.js';
+import {
+  ICONIC_TINTS,
+  WILDLIFE_CARD_LIMIT,
+  WILDLIFE_CARD_MIN_SEP_PX,
+  WILDLIFE_CARD_REGION_COLUMNS,
+  WILDLIFE_CARD_REGION_ROWS,
+  WILDLIFE_CARD_ALTITUDE_SCALE,
+  WILDLIFE_CARD_FADE_LOW_METERS,
+  WILDLIFE_CARD_FADE_HIGH_METERS,
+  WILDLIFE_SELECTED_LABEL_FADE_LOW_METERS,
+  WILDLIFE_SELECTED_LABEL_FADE_HIGH_METERS,
+  WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+  WILDLIFE_CARD_MAX_DISTANCE_METERS,
+  WILDLIFE_LABEL_LIMIT,
+} from './policy.js';
+
+export const WILDLIFE_OVERLAY_SOURCE_ID = 'wildlife-sightings';
+export const WILDLIFE_LABEL_SOURCE_ID = 'wildlife-sightings-labels';
+export const WILDLIFE_SELECTED_SOURCE_ID = 'wildlife-sightings-selected';
+export const WILDLIFE_LABEL_SOURCE_OPTIONS = Object.freeze({
+  cohortLimit: WILDLIFE_LABEL_LIMIT,
+  collisionCapacity: WILDLIFE_LABEL_LIMIT,
+  moving: false,
+});
+export const WILDLIFE_OVERLAY_SOURCE_OPTIONS = Object.freeze({
+  cohortLimit: WILDLIFE_CARD_LIMIT,
+  collisionCapacity: WILDLIFE_CARD_LIMIT,
+  moving: false,
+});
+export const WILDLIFE_SELECTED_SOURCE_OPTIONS = Object.freeze({
+  cohortLimit: 1,
+  collisionCapacity: 1,
+  moving: false,
+});
+
+/** Match cards and labels to the sighting sprite's taxon tint. */
+export function wildlifeAccent(iconic) {
+  return ICONIC_TINTS[wildlifeIconicGroup(iconic)];
+}
+
+/** Importance score for open, non-sensitive iNaturalist photos. Other rows
+ * cannot consume a slot, even if an accidental photo field reaches a caller. */
+export function ambientScore(row, nowMs) {
+  if (row?.obscured || !isOpenPhoto(row?.photo) || !photoCreator(row.photo))
+    return -Infinity;
+  const nonnegative = (n) => (Number.isFinite(n) ? Math.max(0, n) : 0);
+  const time = Number.isFinite(row.observedAt)
+    ? row.observedAt
+    : Date.parse(row.observedOn);
+  const ageH =
+    Number.isFinite(time) && Number.isFinite(nowMs)
+      ? Math.max(0, (nowMs - time) / 3_600_000)
+      : Infinity;
+  return (
+    (row.quality === 'research' ? 2 : 0) +
+    (row.threatened ? 1 : 0) +
+    Math.log1p(nonnegative(row.favesCount)) +
+    0.5 * Math.log1p(nonnegative(row.identificationAgreements)) +
+    2 * 0.5 ** (ageH / 12)
+  );
+}
+
+/** Named rows without eligible photos rank below eligible photo rows. */
+export function wildlifeLabelScore(row, nowMs) {
+  const score = ambientScore(row, nowMs);
+  return Number.isFinite(score) ? score : -1;
+}
+
+/** Visible incumbents own their slots until they leave the view/window. A new
+ * random sample or a higher-scoring challenger can only fill a free slot. */
+function rankWildlifeAmbientRows(rows, currentIds, nowMs) {
+  const incumbent = new Map(currentIds.map((id, index) => [id, index]));
+  const scored = rows
+    .map((row) => ({
+      row,
+      score: ambientScore(row, nowMs),
+      current: incumbent.get(row.stableId),
+    }))
+    .filter((item) => Number.isFinite(item.score));
+  scored.sort((a, b) => {
+    if (a.current !== undefined || b.current !== undefined) {
+      if (a.current === undefined) return 1;
+      if (b.current === undefined) return -1;
+      return a.current - b.current;
+    }
+    return (
+      b.score - a.score || compareWildlifeIds(a.row.stableId, b.row.stableId)
+    );
+  });
+  return scored.map((item) => item.row);
+}
+
+/** Spread newly admitted cards over screen regions. Once shown, a card stays
+ * even when a pan moves it into another incumbent's region; region quotas only
+ * govern free slots, so a camera movement never replaces a visible photo. */
+export function selectWildlifeAmbientRows(
+  rows,
+  currentIds = [],
+  nowMs,
+  limit = WILDLIFE_CARD_LIMIT,
+  { screens = null, width = 0, height = 0 } = {},
+) {
+  const incumbent = new Set(currentIds);
+  const accepted = [];
+  const regions = new Set();
+  const regionFor = (screen) =>
+    `${Math.min(WILDLIFE_CARD_REGION_COLUMNS - 1, Math.floor((screen.x / width) * WILDLIFE_CARD_REGION_COLUMNS))}:${Math.min(WILDLIFE_CARD_REGION_ROWS - 1, Math.floor((screen.y / height) * WILDLIFE_CARD_REGION_ROWS))}`;
+  for (const row of rankWildlifeAmbientRows(rows, currentIds, nowMs)) {
+    if (accepted.length >= Math.max(0, limit)) break;
+    const screen = screens?.get(row.stableId);
+    const region = screen && width > 0 && height > 0 ? regionFor(screen) : null;
+    if (!incumbent.has(row.stableId)) {
+      if (region !== null && regions.has(region)) continue;
+      if (
+        screen &&
+        accepted.some((other) => {
+          const prior = screens.get(other.stableId);
+          return (
+            prior &&
+            Math.hypot(prior.x - screen.x, prior.y - screen.y) <
+              WILDLIFE_CARD_MIN_SEP_PX
+          );
+        })
+      )
+        continue;
+    }
+    accepted.push(row);
+    if (region !== null) regions.add(region);
+  }
+  return accepted;
+}
+
+function nameFor(row) {
+  return translateKnown(row.commonName || row.scientificName) || t('SIGHTING');
+}
+
+/** Return a trimmed common name, or null for unnamed observations. */
+export function wildlifeCommonName(row) {
+  const name = row.commonName;
+  return typeof name === 'string' && name.trim() ? name.trim() : null;
+}
+
+/** Full translated display name, shared by titles and screen-space deduping. */
+export function wildlifeDisplayName(row) {
+  const commonName = wildlifeCommonName(row);
+  const name = commonName ? translateKnown(commonName).trim() : '';
+  return name.replace(/\s+/g, ' ').trim().toLocaleUpperCase(getLocale());
+}
+
+function compactName(row) {
+  return truncateOverlayTitle(
+    wildlifeDisplayName(row),
+    WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+  );
+}
+
+/** One-line common names for identified observations. The caller adds the
+ * Cartesian anchor after ranking and front-side/screen-space filtering. */
+export function buildWildlifeLabelEntry(
+  row,
+  { select, hasRow, nowMs = Date.now() } = {},
+) {
+  if (!wildlifeCommonName(row)) return null;
+  return {
+    id: `wildlife-sightings-label:${row.stableId}`,
+    variant: 'label',
+    title: compactName(row),
+    accent: wildlifeAccent(row.iconic),
+    priority: wildlifeLabelScore(row, nowMs),
+    collisionGroup: 'ambient-label',
+    // The host checks actual card placements, including sticky/fading cards,
+    // before spending the remaining space on labels in score order.
+    yieldToCollisionGroup: 'ambient-card',
+    stateless: true,
+    paintLane: 'ambient-label',
+    gapPx: 15,
+    verticalOnly: true,
+    placement: 'above',
+    horizonCull: true,
+    edgeFade: 'keyhole',
+    interactive: false,
+    accessibilityLabel: nameFor(row),
+    ...selectionAction(row, { select, hasRow }),
+  };
+}
+
+function selectionAction(row, { select, hasRow } = {}) {
+  if (typeof select !== 'function') return {};
+  return {
+    interactive: true,
+    accessibilityLabel: t('Show {name} sighting', { name: nameFor(row) }),
+    activate() {
+      if (typeof hasRow === 'function' && !hasRow(row.stableId)) return false;
+      return select(row.stableId) !== false;
+    },
+  };
+}
+
+/** Build an attributed ambient photo; the runtime supplies the decoded image. */
+export function buildWildlifeThumbnailEntry(
+  row,
+  nowMs,
+  { image = null, select, hasRow, selected = false } = {},
+) {
+  const score = ambientScore(row, nowMs);
+  if (!Number.isFinite(score)) return null;
+  return {
+    id: `sighting:${row.stableId}`,
+    variant: 'thumbnail',
+    title: nameFor(row),
+    image,
+    requireImage: true,
+    accent: wildlifeAccent(row.iconic),
+    interactive: false,
+    accessibilityLabel: t('Show {name} sighting', { name: nameFor(row) }),
+    collisionGroup: 'ambient-card',
+    horizonCull: true,
+    edgeFade: 'keyhole',
+    verticalOnly: true,
+    gapPx: 15,
+    thumbnailPadX: CCTV_THUMBNAIL_STYLE.padding,
+    thumbnailPadTop: CCTV_THUMBNAIL_STYLE.padding,
+    thumbnailPadBottom: CCTV_THUMBNAIL_STYLE.padding,
+    thumbnailTitleGap: 2,
+    thumbnailTitleHeight: CCTV_THUMBNAIL_STYLE.titleHeight,
+    thumbnailTitleChars: CCTV_THUMBNAIL_STYLE.titleChars,
+    thumbnailTitleWordBoundary: true,
+    thumbnailBackground: CCTV_THUMBNAIL_STYLE.background,
+    thumbnailTitleColor: CCTV_THUMBNAIL_STYLE.titleColor,
+    thumbnailTitleFont: CCTV_THUMBNAIL_STYLE.titleFont,
+    thumbnailLeaderColor: CCTV_THUMBNAIL_STYLE.leader,
+    thumbnailRuleColor: CCTV_THUMBNAIL_STYLE.rule,
+    thumbnailRuleHeight: CCTV_THUMBNAIL_STYLE.ruleHeight,
+    thumbnailRadius: CCTV_THUMBNAIL_STYLE.radius,
+    ...selectionAction(row, { select, hasRow }),
+    // i18n-ignore: the creator is verbatim feed attribution with a copyright mark
+    details: [`© ${photoCreator(row.photo)}`],
+    thumbnailFixedWidth: true,
+    thumbnailFit: 'contain',
+    thumbnailWidth: 96,
+    thumbnailHeight: 72,
+    priority: selected ? Number.MAX_SAFE_INTEGER : score,
+    minAnchorSeparationPx: WILDLIFE_CARD_MIN_SEP_PX,
+    maxDistance: WILDLIFE_CARD_MAX_DISTANCE_METERS,
+    altitudeScale: WILDLIFE_CARD_ALTITUDE_SCALE,
+    altitudeFadeStart: WILDLIFE_CARD_FADE_LOW_METERS,
+    altitudeFadeEnd: WILDLIFE_CARD_FADE_HIGH_METERS,
+    ...(selected ? { selected: true, paintLane: 'selected' } : {}),
+  };
+}
+
+/** A bounded selected name uses the host's shared selected card treatment. */
+export function buildWildlifeSelectedLabel(row) {
+  if (!wildlifeCommonName(row)) return null;
+  return {
+    id: `wildlife-sightings-label:${row.stableId}`,
+    variant: 'label',
+    selected: true,
+    protected: true,
+    yieldToCollisionGroup: 'ambient-card',
+    paintLane: 'selected',
+    priority: Number.MAX_SAFE_INTEGER,
+    title: compactName(row),
+    accent: wildlifeAccent(row.iconic),
+    gapPx: 15,
+    verticalOnly: true,
+    placement: 'above',
+    horizonCull: true,
+    edgeFade: 'keyhole',
+    interactive: false,
+    accessibilityLabel: nameFor(row),
+    altitudeFadeStart: WILDLIFE_SELECTED_LABEL_FADE_LOW_METERS,
+    altitudeFadeEnd: WILDLIFE_SELECTED_LABEL_FADE_HIGH_METERS,
+  };
+}

src/layers/wildlifeSightings/cards.test.mjs

@@ -0,0 +1,627 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  ambientScore,
+  selectWildlifeAmbientRows,
+  buildWildlifeThumbnailEntry,
+  buildWildlifeLabelEntry,
+  buildWildlifeSelectedLabel,
+  wildlifeAccent,
+  WILDLIFE_OVERLAY_SOURCE_OPTIONS,
+  WILDLIFE_LABEL_SOURCE_ID,
+  WILDLIFE_LABEL_SOURCE_OPTIONS,
+  WILDLIFE_SELECTED_SOURCE_OPTIONS,
+} from './cards.js';
+import { CCTV_THUMBNAIL_STYLE } from '../../overlays/worldOverlayTokens.js';
+import {
+  WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+  WILDLIFE_CARD_SHOW_MAX_METERS,
+  WILDLIFE_CARD_HIDE_MAX_METERS,
+  WILDLIFE_LABEL_LIMIT,
+} from './policy.js';
+import { formatAge } from './photoText.js';
+import { createSelection } from './selection.js';
+import { setLocale } from '../../i18n/index.js';
+import {
+  altitudeFade,
+  altitudeScale,
+  measureOverlayEntry,
+} from '../../overlays/worldOverlayDraw.js';
+
+const now = Date.UTC(2026, 10, 4, 18, 40);
+const hour = 3_600_000;
+const photo = {
+  square:
+    'https://inaturalist-open-data.s3.amazonaws.com/photos/123/square.jpeg',
+  medium:
+    'https://inaturalist-open-data.s3.amazonaws.com/photos/123/medium.jpeg',
+  licence: 'cc-by-nc',
+  attribution: '(c) Synthetic Photographer, some rights reserved',
+};
+const row = (overrides = {}) => ({
+  stableId: 'inat:123',
+  origin: 'inaturalist',
+  lat: 47.6,
+  lon: -122.3,
+  observedAt: now - 2 * hour,
+  observedOn: '2026-11-04',
+  obscured: false,
+  cell: null,
+  quality: 'research',
+  accuracyM: 12,
+  commonName: "Anna's Hummingbird",
+  scientificName: 'Calypte anna',
+  iconic: 'Aves',
+  threatened: false,
+  conservation: null,
+  count: null,
+  provider: null,
+  obsLicence: 'cc-by-nc',
+  link: 'https://www.inaturalist.org/observations/123',
+  photo,
+  favesCount: 0,
+  identificationAgreements: 0,
+  ...overrides,
+});
+const acartia = (overrides = {}) =>
+  row({
+    stableId: 'acartia:abc',
+    origin: 'acartia',
+    iconic: 'Mammalia',
+    commonName: 'Orca',
+    scientificName: null,
+    accuracyM: null,
+    count: 5,
+    provider: { name: 'Synthetic Network', entity: 'Whale Alert' },
+    obsLicence: null,
+    photo: null,
+    link: 'https://acartia.io',
+    ...overrides,
+  });
+
+test('ambient photo score prioritizes grade, threat, appreciation and recency exactly', () => {
+  const base = row({ quality: 'needs_id' });
+  assert.ok(
+    Math.abs(ambientScore(row(), now) - ambientScore(base, now) - 2) < 1e-12,
+  );
+  assert.equal(
+    ambientScore(row({ threatened: true, observedAt: now }), now) -
+      ambientScore(row({ observedAt: now }), now),
+    1,
+  );
+  assert.ok(
+    ambientScore(row({ favesCount: 8 }), now) >
+      ambientScore(row({ favesCount: 1 }), now),
+  );
+  assert.ok(
+    Math.abs(
+      ambientScore(row({ identificationAgreements: 3 }), now) -
+        ambientScore(row(), now) -
+        0.5 * Math.log1p(3),
+    ) < 1e-12,
+  );
+  assert.ok(
+    ambientScore(row({ quality: 'needs_id', observedAt: now - hour }), now) >
+      ambientScore(
+        row({ quality: 'needs_id', observedAt: now - 48 * hour }),
+        now,
+      ),
+  );
+  for (const input of [
+    row({ obscured: true }),
+    row({ photo: null }),
+    row({ photo: { ...photo, licence: 'cc-by-nd' } }),
+  ])
+    assert.equal(ambientScore(input, now), -Infinity);
+});
+
+test('ambient ranking ties by stable id and never replaces a visible incumbent', () => {
+  const a = row({ stableId: 'inat:a' });
+  const b = row({ stableId: 'inat:b' });
+  assert.deepEqual(
+    selectWildlifeAmbientRows([b, a], [], now).map((item) => item.stableId),
+    ['inat:a', 'inat:b'],
+  );
+  const slightlyBetter = row({ stableId: 'inat:b', observedAt: now - hour });
+  assert.ok(ambientScore(slightlyBetter, now) - ambientScore(a, now) < 0.5);
+  assert.equal(
+    selectWildlifeAmbientRows([a, slightlyBetter], ['inat:a'], now, 1)[0]
+      .stableId,
+    'inat:a',
+  );
+  assert.equal(
+    selectWildlifeAmbientRows(
+      [a, row({ stableId: 'inat:b', threatened: true })],
+      ['inat:a'],
+      now,
+      1,
+    )[0].stableId,
+    'inat:a',
+  );
+  assert.equal(
+    selectWildlifeAmbientRows([a], ['gone'], now, 24)[0].stableId,
+    a.stableId,
+  );
+});
+
+test('ambient entries are stable, accessible and select in place until their row is gone', () => {
+  const selected = [];
+  let exists = true;
+  const entry = buildWildlifeThumbnailEntry(row(), now, {
+    select(id) {
+      selected.push(id);
+    },
+    hasRow: () => exists,
+  });
+  assert.equal(entry.id, 'sighting:inat:123');
+  assert.equal(entry.interactive, true);
+  assert.equal(entry.accessibilityLabel, "Show Anna's Hummingbird sighting");
+  assert.equal(entry.activate(), true);
+  assert.deepEqual(selected, ['inat:123']);
+  exists = false;
+  assert.equal(entry.activate(), false);
+  assert.equal(selected.length, 1);
+  assert.equal(buildWildlifeThumbnailEntry(row({ obscured: true }), now), null);
+});
+
+test('all wildlife name labels prefer a complete word before their ellipsis and retain the full accessible name', () => {
+  const commonName =
+    'Great Blue Heron With An Unusually Lengthy Synthetic Common Name';
+  for (const build of [buildWildlifeLabelEntry, buildWildlifeSelectedLabel]) {
+    const entry = build(row({ commonName }));
+    assert.equal(entry.title, 'GREAT BLUE HERON WITH AN UNUSUALLY…');
+    assert.ok(
+      Array.from(entry.title).length <= WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+    );
+    assert.ok(entry.accessibilityLabel.includes(commonName));
+    const unbroken = build(row({ commonName: '𓅃'.repeat(60) }));
+    assert.equal(
+      Array.from(unbroken.title).length,
+      WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+    );
+    assert.ok(unbroken.title.endsWith('…'));
+    assert.ok(!unbroken.title.includes('\ufffd'));
+  }
+});
+
+test('thumbnail entries use every shared thumbnail token and wildlife altitude curves', () => {
+  const entry = buildWildlifeThumbnailEntry(row(), now);
+  assert.deepEqual([entry.thumbnailWidth, entry.thumbnailHeight], [96, 72]);
+  for (const key of ['thumbnailPadX', 'thumbnailPadTop', 'thumbnailPadBottom'])
+    assert.equal(entry[key], CCTV_THUMBNAIL_STYLE.padding);
+  const mapping = {
+    thumbnailTitleHeight: 'titleHeight',
+    thumbnailTitleChars: 'titleChars',
+    thumbnailBackground: 'background',
+    thumbnailTitleColor: 'titleColor',
+    thumbnailTitleFont: 'titleFont',
+    thumbnailLeaderColor: 'leader',
+    thumbnailRuleColor: 'rule',
+    thumbnailRuleHeight: 'ruleHeight',
+    thumbnailRadius: 'radius',
+  };
+  for (const [field, token] of Object.entries(mapping))
+    assert.equal(entry[field], CCTV_THUMBNAIL_STYLE[token]);
+  assert.equal(entry.altitudeScale.fullEnd, 20_000);
+  assert.equal(entry.altitudeScale.midEnd, 120_000);
+  assert.equal(entry.altitudeFadeStart, 70_000);
+  assert.equal(entry.altitudeFadeEnd, 125_000);
+  assert.equal(entry.maxDistance, 600_000);
+  assert.equal(entry.minAnchorSeparationPx, 112);
+  assert.equal(entry.accent, wildlifeAccent('Aves'));
+  assert.equal(entry.horizonCull, true);
+  assert.equal(entry.requireImage, true);
+  assert.deepEqual(entry.details, ['© Synthetic Photographer']);
+  assert.equal(entry.thumbnailFixedWidth, true);
+  assert.equal(entry.thumbnailFit, 'contain');
+  assert.deepEqual(JSON.parse(JSON.stringify(entry)), entry);
+  assert.equal(entry.interactive, false);
+  assert.equal(Object.isFrozen(WILDLIFE_OVERLAY_SOURCE_OPTIONS), true);
+  assert.equal(WILDLIFE_OVERLAY_SOURCE_OPTIONS.cohortLimit, 24);
+  assert.equal(WILDLIFE_SELECTED_SOURCE_OPTIONS.cohortLimit, 1);
+  assert.equal(WILDLIFE_SELECTED_SOURCE_OPTIONS.collisionCapacity, 1);
+});
+
+test('ambient cards retain only the credited creator and leave names for host truncation', () => {
+  const commonName = 'An extremely long synthetic organism name';
+  for (const [attribution, creator] of [
+    [
+      '(c) Synthetic Photographer, some rights reserved (CC BY-NC)',
+      'Synthetic Photographer',
+    ],
+    ['© Doe, Jane, some rights reserved (CC BY)', 'Doe, Jane'],
+    ['(c) Synthetic Observer, no rights reserved (CC0)', 'Synthetic Observer'],
+    ['Doe, Jane, CC BY', 'Doe, Jane'],
+    ['Synthetic Photographer, CC BY-NC', 'Synthetic Photographer'],
+    ['© Synthetic Photographer (CC BY-SA 4.0)', 'Synthetic Photographer'],
+    ['Synthetic Photographer, CC0', 'Synthetic Photographer'],
+    ['Synthetic Photographer', 'Synthetic Photographer'],
+  ]) {
+    const input = row({ commonName, photo: { ...photo, attribution } });
+    const entry = buildWildlifeThumbnailEntry(input, now);
+    assert.equal(
+      entry.title,
+      commonName,
+      'the overlay host truncates the title',
+    );
+    assert.equal(entry.thumbnailFixedWidth, true);
+    assert.deepEqual(entry.details, [`© ${creator}`]);
+    assert.doesNotMatch(
+      entry.details.join(' '),
+      /Photo:|reserved|CC BY|Not a census/,
+    );
+  }
+  for (const attribution of [
+    'some rights reserved (CC BY)',
+    '(c) ',
+    'CC BY',
+    'CC-BY-NC',
+    '© (CC BY)',
+  ]) {
+    assert.equal(
+      buildWildlifeThumbnailEntry(
+        row({ photo: { ...photo, attribution } }),
+        now,
+      ),
+      null,
+      'a missing creator never becomes a made-up ambient credit',
+    );
+  }
+});
+
+test('ambient cards fade and scale gradually through the 120 km height band', () => {
+  const entry = buildWildlifeThumbnailEntry(row(), now);
+  const options = {
+    fadeStart: entry.altitudeFadeStart,
+    fadeEnd: entry.altitudeFadeEnd,
+  };
+  assert.equal(altitudeFade(70_000, options), 1);
+  assert.ok(altitudeFade(100_000, options) > altitudeFade(120_000, options));
+  assert.ok(altitudeFade(120_000, options) > 0);
+  assert.equal(altitudeFade(125_000, options), 0);
+  assert.equal(altitudeScale(20_000, entry.altitudeScale), 1);
+  assert.equal(altitudeScale(120_000, entry.altitudeScale), 0.9);
+  assert.ok(
+    Math.abs(
+      altitudeScale(119_999, entry.altitudeScale) -
+        altitudeScale(120_001, entry.altitudeScale),
+    ) < 0.001,
+  );
+});
+
+test('selected rows use the shared selected treatment without duplicating photo content', () => {
+  for (const input of [
+    row(),
+    row({ photo: null }),
+    row({ obscured: true, observedAt: null, accuracyM: null }),
+    acartia(),
+  ]) {
+    const label = buildWildlifeSelectedLabel(input);
+    assert.equal(label.id, `wildlife-sightings-label:${input.stableId}`);
+    assert.equal(label.title, input.commonName.toLocaleUpperCase('en'));
+    assert.equal(label.variant, 'label');
+    assert.equal(label.placement, 'above');
+    assert.equal(label.verticalOnly, true);
+    assert.equal(label.protected, true);
+    assert.equal(label.paintLane, 'selected');
+    assert.equal(label.priority, Number.MAX_SAFE_INTEGER);
+    assert.equal(label.interactive, false);
+    assert.equal(label.selected, true);
+    assert.equal(label.details, undefined, 'no link line on canvas cards');
+    assert.equal(label.horizonCull, true);
+    assert.equal(label.edgeFade, 'keyhole');
+    assert.equal(label.accent, wildlifeAccent(input.iconic));
+    for (const field of ['image', 'thumbnailWidth', 'pinned', 'activate'])
+      assert.equal(
+        Object.hasOwn(label, field),
+        false,
+        `${field} is absent from the selected name label`,
+      );
+    assert.deepEqual(JSON.parse(JSON.stringify(label)), label);
+  }
+  const ctx = { measureText: (value) => ({ width: String(value).length * 6 }) };
+  const measured = measureOverlayEntry(ctx, buildWildlifeSelectedLabel(row()));
+  assert.equal(
+    measured.titleH,
+    15,
+    'selected names use the shared selected title metrics',
+  );
+  assert.equal(measured.padX, 12);
+  assert.equal(measured.padY, 8);
+});
+
+test('selected labels normalize one bounded common-name line and stay absent when unnamed', () => {
+  const label = buildWildlifeSelectedLabel(
+    row({
+      commonName: `Synthetic\n  ${'organism '.repeat(10)}`,
+    }),
+  );
+  assert.doesNotMatch(label.title, /\n|  /);
+  assert.ok(
+    Array.from(label.title).length <= WILDLIFE_SELECTED_LABEL_MAX_CHARS,
+  );
+  assert.equal(label.title, 'SYNTHETIC ORGANISM ORGANISM ORGANISM…');
+  assert.ok(label.title.endsWith('…'));
+  assert.equal(buildWildlifeSelectedLabel(row({ commonName: null })), null);
+  assert.equal(
+    buildWildlifeSelectedLabel(row({ commonName: null, scientificName: null })),
+    null,
+  );
+});
+
+test('detail labels show only common names, with no age, grade, accuracy or photo details', () => {
+  const label = buildWildlifeLabelEntry(row());
+  assert.equal(label.id, 'wildlife-sightings-label:inat:123');
+  assert.equal(label.title, "ANNA'S HUMMINGBIRD");
+  assert.equal(label.variant, 'label');
+  assert.equal(label.collisionGroup, 'ambient-label');
+  assert.equal(label.yieldToCollisionGroup, 'ambient-card');
+  assert.equal(
+    label.stateless,
+    true,
+    'labels never retain overlapping incumbent or exit placements',
+  );
+  assert.equal(label.paintLane, 'ambient-label');
+  assert.equal(label.horizonCull, true);
+  assert.equal(label.edgeFade, 'keyhole');
+  assert.equal(label.interactive, false);
+  assert.equal(label.accent, wildlifeAccent('Aves'));
+  for (const field of [
+    'details',
+    'image',
+    'accuracyM',
+    'quality',
+    'observedAt',
+    'maxDistance',
+    'altitudeFadeStart',
+    'altitudeFadeEnd',
+    'selected',
+  ])
+    assert.equal(Object.hasOwn(label, field), false, field);
+  assert.equal(WILDLIFE_LABEL_SOURCE_ID, 'wildlife-sightings-labels');
+  assert.equal(WILDLIFE_LABEL_LIMIT, 150);
+  assert.equal(Object.isFrozen(WILDLIFE_LABEL_SOURCE_OPTIONS), true);
+  assert.equal(WILDLIFE_LABEL_SOURCE_OPTIONS.cohortLimit, WILDLIFE_LABEL_LIMIT);
+  assert.equal(
+    WILDLIFE_LABEL_SOURCE_OPTIONS.collisionCapacity,
+    WILDLIFE_LABEL_LIMIT,
+  );
+  assert.deepEqual(JSON.parse(JSON.stringify(label)), label);
+});
+
+test('unnamed observations have no ambient label and names come only from the row', () => {
+  for (const commonName of [null, undefined, '', ' \n\t '])
+    assert.equal(buildWildlifeLabelEntry({ ...row(), commonName }), null);
+  assert.equal(
+    buildWildlifeLabelEntry({ ...row(), commonName: 'Red-tailed hawk' }).title,
+    'RED-TAILED HAWK',
+  );
+});
+
+test('ambient names select in place and reject activation after their row disappears', () => {
+  let selectedId = null;
+  let exists = true;
+  const label = buildWildlifeLabelEntry(row(), {
+    select(id) {
+      selectedId = id;
+    },
+    hasRow: () => exists,
+  });
+  assert.equal(label.interactive, true);
+  assert.equal(label.accessibilityLabel, "Show Anna's Hummingbird sighting");
+  assert.equal(label.activate(), true);
+  assert.equal(selectedId, 'inat:123');
+  exists = false;
+  assert.equal(label.activate(), false);
+});
+
+test('selected name labels retain the existing altitude fade through 400 km', () => {
+  for (const input of [row(), row({ photo: null }), acartia()]) {
+    const entry = buildWildlifeSelectedLabel(input);
+    const options = {
+      fadeStart: entry.altitudeFadeStart,
+      fadeEnd: entry.altitudeFadeEnd,
+    };
+    assert.equal(altitudeFade(30_000, options), 1);
+    assert.ok(altitudeFade(300_000, options) > 0);
+    assert.equal(altitudeFade(400_000, options), 0);
+    assert.equal(altitudeFade(5_000_000, options), 0);
+  }
+});
+
+test('compact ages follow shared translated minute, hour and day forms', () => {
+  assert.equal(formatAge(59_999), '1m');
+  assert.equal(formatAge(60 * 60_000), '1h');
+  assert.equal(formatAge(2 * 24 * hour), '2d');
+  assert.equal(formatAge(-1), null);
+  assert.equal(formatAge(NaN), null);
+  assert.equal(wildlifeAccent('Protozoa'), '#9aa7b3');
+});
+
+function ambientFixture(rows, screens) {
+  const state = {
+    enabled: true,
+    renderedRows: rows,
+    ambientRows: [],
+    ambientIds: [],
+    labelRows: [],
+    selectedId: null,
+    positions: new Map(
+      rows.map((row) => [row.stableId, screens.get(row.stableId)]),
+    ),
+    pointById: new Map(),
+    rowById: new Map(rows.map((row) => [row.stableId, row])),
+    viewer: {
+      scene: { canvas: { clientWidth: 1200, clientHeight: 900 } },
+      camera: { positionCartographic: { height: 30_000 } },
+    },
+  };
+  const photos = [];
+  const painted = [];
+  const entries = new Map();
+  let cardSourceOptions;
+  const selection = createSelection({
+    state,
+    services: {
+      now: () => now,
+      project: (_scene, position) => position,
+      overlayHost: {
+        setEntries(id, _entries, options) {
+          entries.set(id, _entries);
+          if (id === 'wildlife-sightings') cardSourceOptions = options;
+        },
+      },
+    },
+    parts: {
+      rendering: {
+        occluder: () => null,
+        requestRender() {},
+        setPhotoCardVisibility: (ids) => painted.push([...ids]),
+      },
+      photos: { get: () => null, setAmbient: (rows) => photos.push(rows) },
+    },
+  });
+  return {
+    state,
+    selection,
+    photos,
+    painted,
+    entries,
+    get cardSourceOptions() {
+      return cardSourceOptions;
+    },
+  };
+}
+
+test('label candidates and host priorities use ambientScore before the candidate cap', () => {
+  const rows = Array.from({ length: WILDLIFE_LABEL_LIMIT + 20 }, (_, i) =>
+    row({
+      stableId: `inat:${String(i).padStart(3, '0')}`,
+      commonName: `Synthetic bird ${i}`,
+      favesCount: i,
+    }),
+  );
+  const f = ambientFixture(
+    rows,
+    new Map(
+      rows.map((r, i) => [
+        r.stableId,
+        { x: 10 + (i % 40) * 28, y: 200 + Math.floor(i / 40) * 28 },
+      ]),
+    ),
+  );
+  f.selection.refreshAmbient();
+  const entries = f.entries.get('wildlife-sightings-labels');
+  assert.equal(entries.length, WILDLIFE_LABEL_LIMIT);
+  assert.deepEqual(
+    entries.map((entry) => entry.id),
+    rows
+      .slice(20)
+      .reverse()
+      .map((r) => `wildlife-sightings-label:${r.stableId}`),
+  );
+  for (const r of f.state.labelRows)
+    assert.equal(
+      buildWildlifeLabelEntry(r, { nowMs: now }).priority,
+      ambientScore(r, now),
+    );
+});
+
+test('ambient source forwards actual painted membership to badge visibility', () => {
+  const r = row();
+  const f = ambientFixture([r], new Map([[r.stableId, { x: 150, y: 150 }]]));
+  f.selection.refreshAmbient();
+  assert.deepEqual(f.painted, [], 'a queued photo is not a painted card');
+  f.cardSourceOptions.onVisibilityChange(new Set([`sighting:${r.stableId}`]));
+  assert.deepEqual(f.painted, [[`sighting:${r.stableId}`]]);
+  f.cardSourceOptions.onVisibilityChange(new Set());
+  assert.deepEqual(f.painted.at(-1), []);
+});
+
+test('new ambient cards admit at most one highest-score photo per screen region', () => {
+  const rows = Array.from({ length: 24 }, (_, i) =>
+    row({ stableId: `inat:${i}`, favesCount: i }),
+  );
+  const screens = new Map(
+    rows.map((row, i) => [
+      row.stableId,
+      {
+        x: 150 + (Math.floor(i / 2) % 4) * 300,
+        y: 150 + Math.floor(i / 8) * 300,
+      },
+    ]),
+  );
+  const f = ambientFixture(rows, screens);
+  f.selection.refreshAmbient();
+  assert.equal(f.state.ambientRows.length, 12);
+  assert.ok(
+    f.state.ambientRows.every(
+      (row) => Number(row.stableId.split(':')[1]) % 2 === 1,
+    ),
+  );
+  assert.equal(
+    new Set(
+      f.state.ambientRows.map((row) => {
+        const p = screens.get(row.stableId);
+        return `${Math.floor(p.x / 300)}:${Math.floor(p.y / 300)}`;
+      }),
+    ).size,
+    12,
+  );
+});
+
+test('pans retain every on-screen photo and refreshes only fill free slots', () => {
+  const a = row({ stableId: 'inat:a' });
+  const b = row({ stableId: 'inat:b' });
+  const c = row({ stableId: 'inat:c', favesCount: 1000 });
+  const screens = new Map([
+    [a.stableId, { x: 150, y: 150 }],
+    [b.stableId, { x: 450, y: 150 }],
+    [c.stableId, { x: 170, y: 150 }],
+  ]);
+  const f = ambientFixture([a, b], screens);
+  f.selection.refreshAmbient();
+  const initial = f.state.ambientIds.slice();
+  // This pan moves the two incumbents into one region. Neither may be evicted.
+  f.state.positions.set(b.stableId, { x: 200, y: 160 });
+  f.selection.refreshAmbient();
+  assert.deepEqual(f.state.ambientIds, initial);
+  f.state.rowById.set(c.stableId, c);
+  f.state.positions.set(c.stableId, screens.get(c.stableId));
+  // A new random sample can omit both incumbent rows from the rendered batch.
+  f.state.renderedRows = [c];
+  f.selection.refreshAmbient();
+  assert.deepEqual(f.state.ambientIds, initial);
+  assert.deepEqual(
+    new Set(f.selection.retainedAmbientRows().map((row) => row.stableId)),
+    new Set(initial),
+  );
+  f.state.positions.set(a.stableId, { x: -1, y: 150 });
+  assert.deepEqual(
+    f.selection.retainedAmbientRows().map((row) => row.stableId),
+    [b.stableId],
+  );
+});
+
+test('ambient show/hide thresholds have hysteresis without small-zoom toggles', () => {
+  const a = row();
+  const f = ambientFixture([a], new Map([[a.stableId, { x: 150, y: 150 }]]));
+  const height = f.state.viewer.camera.positionCartographic;
+  height.height = WILDLIFE_CARD_SHOW_MAX_METERS - 1;
+  f.selection.refreshAmbient();
+  assert.equal(f.state.ambientRows.length, 1);
+  for (const altitude of [110_001, 119_999, 120_001, 124_999, 110_001]) {
+    height.height = altitude;
+    f.selection.refreshAmbient();
+    assert.equal(f.state.ambientRows.length, 1);
+  }
+  height.height = WILDLIFE_CARD_HIDE_MAX_METERS;
+  f.selection.refreshAmbient();
+  assert.equal(f.state.ambientRows.length, 0);
+  height.height = WILDLIFE_CARD_HIDE_MAX_METERS - 1;
+  f.selection.refreshAmbient();
+  assert.equal(f.state.ambientRows.length, 0);
+  height.height = WILDLIFE_CARD_SHOW_MAX_METERS;
+  f.selection.refreshAmbient();
+  assert.equal(f.state.ambientRows.length, 1);
+});

src/layers/wildlifeSightings/controls.js

@@ -0,0 +1,250 @@
+import { t, formatNumber, translateKnown } from '../../i18n/index.js';
+import { msg } from '../../i18n/marker.js';
+import { translateFeedError } from '../../ui/statusText.js';
+import { wildlifeIconicGroup } from './model.js';
+import { formatAge } from './photoText.js';
+import {
+  ICONIC_TINTS,
+  ICONIC_LEGEND_ORDER,
+  TAXA_PRESETS,
+  WILDLIFE_CONFIRMED_CHIP_ID,
+  WILDLIFE_GRID_HEIGHT_METERS,
+  WILDLIFE_UPDATE_INTERVAL_MS,
+} from './policy.js';
+
+const LEGEND_LABELS = Object.freeze({
+  Aves: msg('Birds'),
+  Mammalia: msg('Mammals'),
+  Reptilia: msg('Reptiles'),
+  Amphibia: msg('Amphibians'),
+  Actinopterygii: msg('Ray-finned fishes'),
+  Insecta: msg('Insects'),
+  Arachnida: msg('Arachnids'),
+  Plantae: msg('Plants'),
+  Fungi: msg('Fungi'),
+  Animalia: msg('Other animals'),
+  Unknown: msg('Other or unknown'),
+});
+
+/** Own layer-row descriptors and serializable filter options. */
+export function createControls({ state, services, parts }) {
+  function notify() {
+    try {
+      state.controlsListener?.();
+    } catch {
+      /* repaint listeners are optional */
+    }
+  }
+
+  function chip({ id, label, title, params, key, value }) {
+    const pending =
+      state.pendingParams?.keys.includes(key) &&
+      (key === 'confirmed' || state.pendingParams[key] === value);
+    const failedKey = state.failedParams?.keys.includes(key);
+    const failed =
+      failedKey && (key === 'confirmed' || state.failedParams[key] === value);
+    const active =
+      !pending &&
+      (failedKey
+        ? state[key] === value
+        : !!state.drawnParams && state.drawnParams[key] === value);
+    return {
+      id,
+      label: `${label}${pending ? ' ···' : failed ? ' ✕' : ''}`,
+      title: failed
+        ? t('{label} {detail} — click to retry', {
+            label,
+            detail: translateFeedError(
+              state.error || msg('Wildlife sightings source unavailable'),
+            ),
+          })
+        : title,
+      active,
+      busy: !!pending,
+      disabled: !!pending,
+      state: pending
+        ? 'loading'
+        : failed
+          ? 'error'
+          : active
+            ? 'active'
+            : 'idle',
+      params,
+    };
+  }
+
+  const methods = {
+    id: 'wildlife-sightings',
+    name: 'Wildlife Sightings',
+    icon: '🦉',
+    source: 'iNaturalist',
+    updateInterval: WILDLIFE_UPDATE_INTERVAL_MS,
+
+    /** Route camera refreshes through the application's lifecycle manager. */
+    attachDataManager(manager) {
+      state.manager = manager;
+    },
+    /** Connect the layer row's repaint listener. */
+    setRowControlsListener(listener) {
+      state.controlsListener = typeof listener === 'function' ? listener : null;
+    },
+    /** Snapshot the requested filters for share links and restoration. */
+    getParams() {
+      return { confirmed: state.confirmed, taxa: state.taxa };
+    },
+    /** Apply filters while retaining the last accepted display until success. */
+    setParams(params = {}) {
+      const next = {
+        confirmed:
+          typeof params.confirmed === 'boolean'
+            ? params.confirmed
+            : state.confirmed,
+        taxa: TAXA_PRESETS.some((preset) => preset.value === params.taxa)
+          ? params.taxa
+          : state.taxa,
+      };
+      const changed = ['confirmed', 'taxa'].filter(
+        (key) => next[key] !== state[key],
+      );
+      if (!changed.length && !state.failedParams) return true;
+      // Compare with the displayed filters so disjoint edits stay pending.
+      // Initially taxa awaits data while the default-off toggle remains idle.
+      const drawn = state.drawnParams || { confirmed: false, taxa: null };
+      const keys = ['confirmed', 'taxa'].filter(
+        (key) => next[key] !== drawn[key],
+      );
+      if (!changed.length && state.failedParams) {
+        for (const key of state.failedParams.keys) {
+          if (!keys.includes(key)) keys.push(key);
+        }
+      }
+      state.confirmed = next.confirmed;
+      state.taxa = next.taxa;
+      state.pendingParams = keys.length ? { ...next, keys } : null;
+      state.failedParams = null;
+      // Replace the LRU with the accepted result so taxa never get mixed.
+      state.pendingClear = true;
+      state.lastQueryKey = null;
+      state.request?.abort();
+      state.background?.abort();
+      parts.lifecycle.scheduleRefresh();
+      notify();
+      return true;
+    },
+    /** Describe filter chips, nonempty legend groups and provider attribution. */
+    getRowControls() {
+      const confirmedFailed = state.failedParams?.keys.includes('confirmed');
+      const chips = [
+        chip({
+          id: WILDLIFE_CONFIRMED_CHIP_ID,
+          label: t('CONFIRMED'),
+          title: t('Show only community-confirmed (research-grade) sightings'),
+          params: {
+            confirmed: confirmedFailed ? state.confirmed : !state.confirmed,
+          },
+          key: 'confirmed',
+          value: true,
+        }),
+        ...TAXA_PRESETS.map((preset) =>
+          chip({
+            id: preset.id,
+            label: translateKnown(preset.label),
+            title: translateKnown(preset.title),
+            params: { taxa: preset.value },
+            key: 'taxa',
+            value: preset.value,
+          }),
+        ),
+      ];
+      const counts = new Map();
+      for (const row of state.renderedRows) {
+        const group = wildlifeIconicGroup(row.iconic);
+        counts.set(group, (counts.get(group) || 0) + 1);
+      }
+      const legend = ICONIC_LEGEND_ORDER.filter((key) => counts.has(key)).map(
+        (key, index) => ({
+          label: translateKnown(LEGEND_LABELS[key]),
+          color: ICONIC_TINTS[key],
+          count: counts.get(key),
+          ...(index === 0
+            ? {
+                blurb: t(
+                  'Wildlife observed within 48 h (whales 7 d). Color and badge glyph show the taxon group. Sensitive species are shown only as 0.2° cells; Salish Sea marine mammal reports via Acartia are rounded to 0.01°. Not a census.',
+                ),
+              }
+            : {}),
+        }),
+      );
+      if (!state.lastUpdate && !legend.length) return { chips, legend: [] };
+      const acartiaCount = state.renderedRows.filter(
+        (row) => row.origin === 'acartia',
+      ).length;
+      const info = acartiaCount
+        ? t(
+            'iNaturalist contributors · Acartia {count} (Salish Sea) · licences per record',
+            { count: formatNumber(acartiaCount) },
+          )
+        : t('iNaturalist contributors · licences per record');
+      return { chips, legend, info };
+    },
+    /** Report the visible count, feed state and retry guidance. */
+    getStats() {
+      const grid = state.gridAvailable === true;
+      const count =
+        state.sightingCount ??
+        (grid ? (state.gridTotal ?? 0) : state.renderedRows.length);
+      const loading = state.loading && !state.lastUpdate;
+      const refreshing = state.loading && !!state.lastUpdate;
+      const age = state.lastUpdate
+        ? formatAge(services.now() - state.lastUpdate)
+        : '';
+      const minutes = state.lastUpdate
+        ? Math.max(0, (services.now() - state.lastUpdate) / 60_000)
+        : 0;
+      const liveAge =
+        minutes < 1
+          ? t('<1m ago')
+          : minutes < 90
+            ? t('{count}m ago', { count: Math.floor(minutes) })
+            : t('{count}h ago', { count: Math.round(minutes / 60) });
+      const stats = {
+        count,
+        lastUpdate: state.lastUpdate,
+        error: state.error,
+        stale: state.stale,
+        loading,
+        refreshing,
+        countLabel: t('{count} sightings in view', {
+          count: formatNumber(count),
+        }),
+        loadingLabel: loading
+          ? t('loading...')
+          : refreshing
+            ? t('refreshing...')
+            : state.stale
+              ? t('STALE · cached {age}', { age })
+              : state.lastUpdate
+                ? t('LIVE · updated {age}', { age: liveAge })
+                : '',
+      };
+      if (
+        !state.error &&
+        !state.query &&
+        state.viewer?.camera?.positionCartographic?.height >
+          WILDLIFE_GRID_HEIGHT_METERS
+      ) {
+        // i18n-ignore: feed-state protocol value
+        stats.status = 'zoom-in';
+        stats.statusMessage = msg('Zoom in for local sightings');
+      } else if (!state.error && state.lastUpdate && !count) {
+        // i18n-ignore: feed-state protocol value
+        stats.status = 'empty';
+        stats.statusMessage = msg('No recent sightings in view');
+      }
+      if (state.retryAt > services.now())
+        stats.retryInSec = Math.ceil((state.retryAt - services.now()) / 1000);
+      return stats;
+    },
+  };
+  return { methods, notify };
+}

src/layers/wildlifeSightings/density.js

@@ -0,0 +1,462 @@
+import { wildlifeGridCellBounds } from './gridViewport.js';
+import {
+  createWildlifeWorkQueue,
+  drainWildlifeWork,
+  WILDLIFE_WORK_UNIT,
+} from './performance.js';
+
+export const WILDLIFE_DENSITY_OVERLAP = 4;
+const KERNEL_SIGMA = 0.7;
+export const WILDLIFE_DENSITY_MAX_ALPHA = 0.34;
+const DENSITY_MIN_ALPHA = 0.012;
+const DENSITY_RAMP_GAMMA = 3;
+const METERS_PER_DEGREE = (2 * Math.PI * 6378137) / 360;
+const FADE_STEPS = 3;
+const FADE_STEP_MS = 60;
+const SPRITE_SIZE = 128;
+// Fade coarse splats before they read as haze across the whole Earth disc.
+const ALTITUDE_FADE_START = 3_000_000;
+const ALTITUDE_FADE_END = 8_000_000;
+// Sparse cells read cool teal; hotspots warm toward amber. Sensor styles keep
+// one neutral or phosphor tint.
+const NORMAL_TINT = { low: [0.3, 0.8, 0.78], high: [1, 0.78, 0.38] };
+const MONO_TINT = { low: [0.96, 0.96, 0.96], high: [0.96, 0.96, 0.96] };
+const CRT_TINT = { low: [0.48, 1, 0.72], high: [0.48, 1, 0.72] };
+
+/** View-relative alpha keeps hotspots distinct as cell counts grow on zoom-out. */
+export function wildlifeDensityIntensity(rank) {
+  if (!(rank > 0) || !Number.isFinite(rank)) return 0;
+  return (
+    DENSITY_MIN_ALPHA +
+    (WILDLIFE_DENSITY_MAX_ALPHA - DENSITY_MIN_ALPHA) *
+      Math.min(1, rank) ** DENSITY_RAMP_GAMMA
+  );
+}
+
+/** Rank function over the snapshot's positive counts: the share of cells with
+ * a count at or below the given one. */
+export function wildlifeDensityRanks(cells = []) {
+  const counts = [];
+  for (const cell of cells)
+    if (Number.isSafeInteger(cell?.cellCount) && cell.cellCount > 0)
+      counts.push(cell.cellCount);
+  counts.sort((a, b) => a - b);
+  return (count) => {
+    if (!counts.length || !(count > 0)) return 0;
+    let low = 0;
+    let high = counts.length;
+    while (low < high) {
+      const mid = (low + high) >>> 1;
+      if (counts[mid] <= count) low = mid + 1;
+      else high = mid;
+    }
+    return low / counts.length;
+  };
+}
+
+/** Truncated Gaussian in source-cell widths; overlapping splats hide the grid. */
+export function wildlifeDensityKernel(distance) {
+  const radius = WILDLIFE_DENSITY_OVERLAP / 2;
+  if (!Number.isFinite(distance) || distance < 0 || distance >= radius)
+    return 0;
+  const edge = Math.exp(-(radius ** 2) / (2 * KERNEL_SIGMA ** 2));
+  return (
+    (Math.exp(-(distance ** 2) / (2 * KERNEL_SIGMA ** 2)) - edge) / (1 - edge)
+  );
+}
+
+const DENSITY_IMAGE = `data:image/svg+xml,${encodeURIComponent(
+  `<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128"><defs><radialGradient id="g">${Array.from(
+    { length: 33 },
+    (_, i) =>
+      `<stop offset="${i / 32}" stop-color="white" stop-opacity="${wildlifeDensityKernel(((i / 32) * WILDLIFE_DENSITY_OVERLAP) / 2).toFixed(5)}"/>`,
+  ).join(
+    '',
+  )}</radialGradient></defs><circle cx="64" cy="64" r="64" fill="url(#g)"/></svg>`,
+)}`;
+
+function tintForStyle(style) {
+  if (['mono', 'surveillance', 'thermal', 'noir', 'nvg'].includes(style))
+    return MONO_TINT;
+  return ['crt', 'retro'].includes(style) ? CRT_TINT : NORMAL_TINT;
+}
+
+function intersects(bounds, boxes, padding = 0) {
+  if (!boxes?.length) return true;
+  const latitude = (bounds.north - bounds.south) * padding;
+  const longitude = (bounds.east - bounds.west) * padding;
+  for (const box of boxes) {
+    if (
+      bounds.north + latitude < box.south ||
+      bounds.south - latitude > box.north
+    )
+      continue;
+    // Both a padded splat and the viewport can straddle the antimeridian.
+    const east = box.east < box.west ? box.east + 360 : box.east;
+    const left = bounds.west - longitude;
+    const right = bounds.east + longitude;
+    if (
+      (right >= box.west && left <= east) ||
+      (right + 360 >= box.west && left + 360 <= east) ||
+      (right - 360 >= box.west && left - 360 <= east)
+    )
+      return true;
+  }
+  return false;
+}
+
+// Fit the entire kernel inside the globe's tangent cone, plus 5% of its radius.
+// A visible centre alone lets a depth-free billboard bleed across the limb.
+// The inscribed sphere is conservative for WGS84 and needs no projections.
+function horizonTest(cameraPosition, radius) {
+  const { x, y, z } = cameraPosition || {};
+  const distance = Math.hypot(x, y, z);
+  if (!Number.isFinite(distance) || distance <= radius) return null;
+  const nx = x / distance;
+  const ny = y / distance;
+  const nz = z / distance;
+  const sinAngle = radius / distance;
+  const cosAngleSquared = 1 - sinAngle ** 2;
+  const horizonPlane = radius * sinAngle;
+  return (position, kernelRadius) => {
+    const along = position.x * nx + position.y * ny + position.z * nz;
+    if (along <= horizonPlane) return false;
+    const clearance = sinAngle * (distance - along) - kernelRadius * 1.05;
+    const acrossSquared = Math.max(
+      0,
+      position.x ** 2 + position.y ** 2 + position.z ** 2 - along ** 2,
+    );
+    return clearance > 0 && acrossSquared * cosAngleSquared < clearance ** 2;
+  };
+}
+
+/** Own noninteractive, world-sized glow splats, arrival fades and style changes. */
+/** A world-sized kernel fills the screen once the camera is inside it, e.g.
+ * while flying in before the closer view's tiles arrive. Cesium fades it on the
+ * GPU: gone within half its width, full beyond twice its width. */
+export const WILDLIFE_DENSITY_NEAR_FADE = Object.freeze({ near: 0.5, far: 2 });
+
+export function createWildlifeDensity({
+  cesium: C,
+  viewer,
+  positionForCell = (cell) => C.Cartesian3.fromDegrees(cell.lon, cell.lat),
+  requestRender = () => {},
+  setTimer = (fn, delay) => setTimeout(fn, delay),
+  clearTimer = (timer) => clearTimeout(timer),
+  requestIdle,
+  cancelIdle,
+  eventTarget = globalThis.window,
+  documentRef = globalThis.document,
+} = {}) {
+  let collection = null;
+  const nearFade = (width) =>
+    new C.NearFarScalar(
+      width * WILDLIFE_DENSITY_NEAR_FADE.near,
+      0,
+      width * WILDLIFE_DENSITY_NEAR_FADE.far,
+      1,
+    );
+  let metadata = new WeakMap();
+  const entries = new Map();
+  const fading = new Set();
+  let fadeTimer = null;
+  let destroyed = false;
+  let generation = 0;
+  let cockpitVision = false;
+  let tint = tintForStyle(documentRef?.documentElement?.dataset?.gevStyle);
+  let listening = false;
+  const fadeQueue = createWildlifeWorkQueue({ requestIdle, cancelIdle });
+  const styleQueue = createWildlifeWorkQueue({ requestIdle, cancelIdle });
+
+  // BillboardCollection does not implement Primitive's allowPicking option.
+  // Skipping its public pick update prevents its translucent quads from
+  // intercepting observations, including pixels with a faint glow alpha.
+  class DensityCollection extends C.BillboardCollection {
+    constructor() {
+      // Cesium's TRANSLUCENT-only option writes depth and occludes badges.
+      super();
+      this.allowPicking = false;
+    }
+    update(frameState) {
+      if (frameState.passes?.pick) return;
+      return super.update(frameState);
+    }
+  }
+
+  function color(entry) {
+    const mix = (i) => tint.low[i] + (tint.high[i] - tint.low[i]) * entry.rank;
+    return new C.Color(
+      mix(0),
+      mix(1),
+      mix(2),
+      (wildlifeDensityIntensity(entry.rank) * entry.opacity * entry.fade) /
+        FADE_STEPS,
+    );
+  }
+
+  function* styleWork() {
+    let visits = 0;
+    for (const entry of entries.values()) {
+      if (visits++ % WILDLIFE_WORK_UNIT === 0) yield 'density-style';
+      entry.point.color = color(entry);
+    }
+  }
+
+  function setStyle(style) {
+    const next = tintForStyle(style);
+    if (next === tint) return;
+    tint = next;
+    if (entries.size)
+      styleQueue.start(styleWork(), () => requestRender('density-style'));
+  }
+
+  function onStyle(event) {
+    if (!cockpitVision) setStyle(event?.detail?.style);
+  }
+
+  function onVision(event) {
+    cockpitVision = event?.detail?.cockpit === true;
+    setStyle(event?.detail?.style);
+  }
+
+  function ensureCollection() {
+    if (collection) return;
+    collection = new DensityCollection();
+    viewer.scene.primitives.add(collection);
+    if (!listening) {
+      tint = tintForStyle(documentRef?.documentElement?.dataset?.gevStyle);
+      eventTarget?.addEventListener?.('gev:style-change', onStyle);
+      eventTarget?.addEventListener?.('gev:vision-change', onVision);
+      listening = true;
+    }
+  }
+
+  function* fadeWork() {
+    let visits = 0;
+    for (const entry of fading) {
+      if (visits++ % WILDLIFE_WORK_UNIT === 0) yield 'density-fade';
+      entry.fade++;
+      entry.point.color = color(entry);
+      if (entry.fade >= FADE_STEPS) fading.delete(entry);
+    }
+  }
+
+  function scheduleFade() {
+    if (fadeTimer !== null || fadeQueue.pending || !fading.size || destroyed)
+      return;
+    fadeTimer = setTimer(() => {
+      fadeTimer = null;
+      fadeQueue.start(fadeWork(), () => {
+        requestRender('density-fade');
+        scheduleFade();
+      });
+    }, FADE_STEP_MS);
+  }
+
+  function dataForCell(cell, operations) {
+    if (
+      !cell ||
+      !Number.isFinite(cell.lat) ||
+      Math.abs(cell.lat) > 90 ||
+      !Number.isFinite(cell.lon) ||
+      Math.abs(cell.lon) > 180 ||
+      !Number.isSafeInteger(cell.cellCount) ||
+      cell.cellCount <= 0
+    )
+      return null;
+    const old = metadata.get(cell);
+    if (
+      old?.id === cell.id &&
+      old.lat === cell.lat &&
+      old.lon === cell.lon &&
+      old.count === cell.cellCount
+    )
+      return old;
+    const bounds =
+      old?.id === cell.id ? old.bounds : wildlifeGridCellBounds(cell.id);
+    if (!bounds) return null;
+    const samePosition = old?.lat === cell.lat && old?.lon === cell.lon;
+    const data = {
+      id: cell.id,
+      lat: cell.lat,
+      lon: cell.lon,
+      count: cell.cellCount,
+      bounds,
+      width:
+        WILDLIFE_DENSITY_OVERLAP *
+        METERS_PER_DEGREE *
+        Math.max(
+          (bounds.east - bounds.west) * Math.cos((cell.lat * Math.PI) / 180),
+          bounds.north - bounds.south,
+        ),
+      position: samePosition ? old.position : positionForCell(cell),
+    };
+    operations.densityMetadataBuilds++;
+    if (!samePosition) operations.densityPositionBuilds++;
+    metadata.set(cell, data);
+    return data;
+  }
+
+  /** Reconcile the authoritative snapshot, including successful empty tiles. */
+  function* updateWork(
+    cells = [],
+    { boxes, isPointVisible, onOperations = () => {} } = {},
+  ) {
+    const token = ++generation;
+    const operations = {
+      densityVisits: 0,
+      densityRetirementVisits: 0,
+      densityMetadataBuilds: 0,
+      densityPositionBuilds: 0,
+      densityWrites: 0,
+      densityCreated: 0,
+      densityRemoved: 0,
+    };
+    let sightingCount = 0;
+    let changed = false;
+    const height = viewer.camera?.positionCartographic?.height ?? 0;
+    const opacity = Math.max(
+      0,
+      Math.min(
+        1,
+        (ALTITUDE_FADE_END - height) /
+          (ALTITUDE_FADE_END - ALTITUDE_FADE_START),
+      ),
+    );
+    const insideHorizon = horizonTest(
+      viewer.camera?.positionWC,
+      C.Ellipsoid?.WGS84?.minimumRadius ?? 6_356_752.314245,
+    );
+    const rankOf = wildlifeDensityRanks(cells);
+    for (const cell of cells) {
+      if (operations.densityVisits++ % WILDLIFE_WORK_UNIT === 0) {
+        yield 'density';
+        if (destroyed || token !== generation)
+          return { sightingCount: 0, changed: false, size: entries.size };
+      }
+      const data = dataForCell(cell, operations);
+      if (
+        !data ||
+        !intersects(data.bounds, boxes, (WILDLIFE_DENSITY_OVERLAP - 1) / 2) ||
+        isPointVisible?.(data.position) === false
+      )
+        continue;
+      if (intersects(data.bounds, boxes))
+        sightingCount = Math.min(
+          Number.MAX_SAFE_INTEGER,
+          sightingCount + data.count,
+        );
+      // These are visual decisions only; counts retain every visible cell.
+      if (
+        opacity === 0 ||
+        insideHorizon?.(data.position, data.width / 2) === false
+      )
+        continue;
+      const rank = rankOf(data.count);
+      let entry = entries.get(data.id);
+      if (!entry) {
+        ensureCollection();
+        entry = { data, rank, opacity, fade: 1, seen: token, point: null };
+        entry.point = collection.add({
+          position: data.position,
+          image: DENSITY_IMAGE,
+          // Cesium packs width in 16 bits even for meter-sized billboards.
+          // Put the world diameter in its unrestricted scale attribute so
+          // continental kernels never clamp into thin vertical ellipses.
+          width: SPRITE_SIZE,
+          height: SPRITE_SIZE,
+          scale: data.width / SPRITE_SIZE,
+          sizeInMeters: true,
+          color: color(entry),
+          disableDepthTestDistance: Number.POSITIVE_INFINITY,
+          translucencyByDistance: nearFade(data.width),
+        });
+        entries.set(data.id, entry);
+        fading.add(entry);
+        operations.densityCreated++;
+        changed = true;
+      } else {
+        entry.seen = token;
+        if (entry.data.position !== data.position) {
+          entry.point.position = data.position;
+          operations.densityWrites++;
+          changed = true;
+        }
+        if (entry.data.width !== data.width) {
+          entry.point.scale = data.width / SPRITE_SIZE;
+          entry.point.translucencyByDistance = nearFade(data.width);
+          operations.densityWrites++;
+          changed = true;
+        }
+        if (entry.rank !== rank || entry.opacity !== opacity) {
+          entry.rank = rank;
+          entry.opacity = opacity;
+          entry.point.color = color(entry);
+          operations.densityWrites++;
+          changed = true;
+        }
+        entry.data = data;
+      }
+    }
+    for (const [id, entry] of entries) {
+      if (operations.densityRetirementVisits++ % WILDLIFE_WORK_UNIT === 0) {
+        yield 'density';
+        if (destroyed || token !== generation)
+          return { sightingCount: 0, changed: false, size: entries.size };
+      }
+      if (entry.seen === token) continue;
+      collection.remove(entry.point);
+      fading.delete(entry);
+      entries.delete(id);
+      operations.densityRemoved++;
+      changed = true;
+    }
+    if (!entries.size && collection) clear(true);
+    else scheduleFade();
+    if (changed) requestRender('density');
+    onOperations(operations);
+    return { sightingCount, changed, size: entries.size };
+  }
+
+  /** Release the texture atlas, billboards, cached coordinates and all work. */
+  function clear(keepMetadata = false) {
+    generation++;
+    fadeQueue.cancel();
+    styleQueue.cancel();
+    if (fadeTimer !== null) clearTimer(fadeTimer);
+    fadeTimer = null;
+    entries.clear();
+    fading.clear();
+    if (!keepMetadata) metadata = new WeakMap();
+    if (collection) {
+      if (
+        viewer.scene.primitives.remove(collection) !== true &&
+        !collection.isDestroyed?.()
+      )
+        collection.destroy();
+      collection = null;
+    }
+    if (listening) {
+      eventTarget?.removeEventListener?.('gev:style-change', onStyle);
+      eventTarget?.removeEventListener?.('gev:vision-change', onVision);
+      listening = false;
+    }
+    cockpitVision = false;
+  }
+
+  return {
+    updateWork,
+    update: (cells, options) => drainWildlifeWork(updateWork(cells, options)),
+    clear,
+    destroy() {
+      clear();
+      destroyed = true;
+    },
+    get collection() {
+      return collection;
+    },
+    get size() {
+      return entries.size;
+    },
+  };
+}

src/layers/wildlifeSightings/density.test.mjs

@@ -0,0 +1,508 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import * as Cesium from 'cesium';
+import { wildlifeGridCellBounds } from './gridViewport.js';
+import {
+  createWildlifeDensity,
+  wildlifeDensityIntensity,
+  wildlifeDensityRanks,
+  wildlifeDensityKernel,
+  WILDLIFE_DENSITY_MAX_ALPHA,
+  WILDLIFE_DENSITY_NEAR_FADE,
+  WILDLIFE_DENSITY_OVERLAP,
+} from './density.js';
+import { WILDLIFE_WORK_UNIT } from './performance.js';
+
+function cell(column, count = 1, options = {}) {
+  const id = `grid:3/4/2:31:${column * 2 + 1}`;
+  const bounds = wildlifeGridCellBounds(id);
+  return {
+    id,
+    lat: (bounds.south + bounds.north) / 2,
+    lon: (bounds.west + bounds.east) / 2,
+    cellCount: count,
+    ...options,
+  };
+}
+
+function harness({ documentStyle = 'normal', camera = {} } = {}) {
+  const counts = { positions: 0, writes: 0, created: 0, updates: 0 };
+  class BillboardCollection extends Cesium.BillboardCollection {
+    add(options) {
+      counts.created++;
+      const point = super.add(options);
+      return new Proxy(point, {
+        get: (target, key) => Reflect.get(target, key, target),
+        set(target, key, value) {
+          counts.writes++;
+          return Reflect.set(target, key, value, target);
+        },
+      });
+    }
+    update() {
+      counts.updates++;
+    }
+  }
+  const primitives = new Cesium.PrimitiveCollection();
+  let handle = 0;
+  const timers = new Map();
+  const idle = new Map();
+  const renders = [];
+  const listeners = new Map();
+  const eventTarget = {
+    addEventListener(name, listener) {
+      if (!listeners.has(name)) listeners.set(name, new Set());
+      listeners.get(name).add(listener);
+    },
+    removeEventListener(name, listener) {
+      listeners.get(name)?.delete(listener);
+    },
+    emit(name, detail) {
+      for (const listener of listeners.get(name) || []) listener({ detail });
+    },
+  };
+  const density = createWildlifeDensity({
+    cesium: { ...Cesium, BillboardCollection },
+    viewer: { scene: { primitives }, camera },
+    positionForCell(row) {
+      counts.positions++;
+      return Cesium.Cartesian3.fromDegrees(row.lon, row.lat);
+    },
+    requestRender: (reason) => renders.push(reason),
+    setTimer(fn) {
+      timers.set(++handle, fn);
+      return handle;
+    },
+    clearTimer: (id) => timers.delete(id),
+    requestIdle(fn) {
+      idle.set(++handle, fn);
+      return handle;
+    },
+    cancelIdle: (id) => idle.delete(id),
+    eventTarget,
+    documentRef: { documentElement: { dataset: { gevStyle: documentStyle } } },
+  });
+  function flushIdle() {
+    while (idle.size) {
+      const [id, fn] = idle.entries().next().value;
+      idle.delete(id);
+      fn();
+    }
+  }
+  function fadeStep() {
+    for (const [id, fn] of [...timers]) {
+      timers.delete(id);
+      fn();
+    }
+    flushIdle();
+  }
+  return {
+    density,
+    primitives,
+    counts,
+    renders,
+    timers,
+    idle,
+    listeners,
+    eventTarget,
+    flushIdle,
+    fadeStep,
+    settle() {
+      while (timers.size || idle.size) {
+        fadeStep();
+        flushIdle();
+      }
+    },
+  };
+}
+
+test('density intensity rises with view rank, is bounded, and leaves no background for zero data', () => {
+  for (const empty of [0, -1, null, undefined, NaN, Infinity])
+    assert.equal(wildlifeDensityIntensity(empty), 0);
+  const ranks = [0.01, 0.1, 0.25, 0.5, 0.75, 0.9, 1];
+  const values = ranks.map(wildlifeDensityIntensity);
+  assert.ok(values[0] > 0, 'the sparsest cell still leaves a trace');
+  assert.ok(values[0] < 0.02, 'sparse cells stay a trace, not a haze');
+  for (let i = 1; i < values.length; i++) assert.ok(values[i] > values[i - 1]);
+  assert.equal(values.at(-1), WILDLIFE_DENSITY_MAX_ALPHA);
+  assert.ok(
+    values[3] < WILDLIFE_DENSITY_MAX_ALPHA / 3,
+    'a median cell is well below a hotspot',
+  );
+});
+
+test('density ranks are relative to the view, so hotspots stay distinct at any zoom', () => {
+  const cells = (counts) => counts.map((cellCount) => ({ cellCount }));
+  const near = wildlifeDensityRanks(cells([1, 2, 3, 40]));
+  const far = wildlifeDensityRanks(cells([100, 200, 300, 4000]));
+  assert.equal(near(40), 1);
+  assert.equal(far(4000), 1, 'the top cell is brightest whatever its count');
+  assert.equal(near(1), far(100), 'the same position ranks the same');
+  assert.equal(wildlifeDensityRanks(cells([0, -1]))(5), 0);
+  assert.equal(wildlifeDensityRanks([])(5), 0);
+});
+
+test('an empty density snapshot creates no glow', () => {
+  const h = harness();
+  assert.deepEqual(h.density.update([]), {
+    sightingCount: 0,
+    changed: false,
+    size: 0,
+  });
+  h.density.update([
+    cell(0, 0),
+    cell(1, -1),
+    cell(2, 0.5),
+    cell(3, 1, { id: 'invalid' }),
+  ]);
+  assert.equal(h.density.collection, null);
+  assert.equal(h.primitives.length, 0);
+  assert.equal(h.timers.size, 0);
+  h.density.destroy();
+});
+
+test('uniform occupied cells make a continuous field with no visible lattice', () => {
+  assert.ok(WILDLIFE_DENSITY_OVERLAP >= 1.5);
+  assert.equal(wildlifeDensityKernel(0), 1);
+  assert.equal(wildlifeDensityKernel(WILDLIFE_DENSITY_OVERLAP / 2), 0);
+  const samples = [];
+  for (let x = 0; x < 1; x += 0.1)
+    for (let y = 0; y < 1; y += 0.1) {
+      let value = 0;
+      for (let dx = -3; dx <= 3; dx++)
+        for (let dy = -3; dy <= 3; dy++)
+          value += wildlifeDensityKernel(Math.hypot(x - dx, y - dy));
+      samples.push(value);
+    }
+  const modulation =
+    (Math.max(...samples) - Math.min(...samples)) / Math.max(...samples);
+  assert.ok(modulation < 0.007, `${(100 * modulation).toFixed(3)}% modulation`);
+});
+
+test('each glow kernel fades on the GPU as the camera comes inside it, scaled to its own width', () => {
+  const h = harness();
+  h.density.update([cell(0, 4), cell(1, 9)]);
+  const collection = h.density.collection;
+  assert.equal(collection.length, 2);
+  for (let i = 0; i < collection.length; i++) {
+    const point = collection.get(i);
+    const width = point.scale * point.width;
+    const fade = point.translucencyByDistance;
+    assert.ok(fade, 'no screen-filling kernel when zoomed inside it');
+    assert.ok(
+      Math.abs(fade.near - width * WILDLIFE_DENSITY_NEAR_FADE.near) < 1e-6,
+    );
+    assert.equal(fade.nearValue, 0);
+    assert.ok(
+      Math.abs(fade.far - width * WILDLIFE_DENSITY_NEAR_FADE.far) < 1e-6,
+    );
+    assert.equal(fade.farValue, 1);
+  }
+  h.density.destroy();
+});
+
+test('occupied grid counts produce unlabelled world-sized glow billboards that never enter Cesium picking', () => {
+  const h = harness();
+  const rows = [cell(0, 1), cell(1, 100), cell(2, 1000000)];
+  const result = h.density.update(rows);
+  assert.equal(result.sightingCount, 1000101);
+  assert.equal(h.primitives.length, 1);
+  const collection = h.density.collection;
+  assert.equal(collection.allowPicking, false);
+  assert.equal(collection.length, 3);
+  const first = collection.get(0);
+  assert.equal(
+    first.id,
+    undefined,
+    'density has no sighting identity or pick payload',
+  );
+  assert.equal(first.sizeInMeters, true);
+  assert.equal(first.scaleByDistance, undefined);
+  assert.match(decodeURIComponent(first.image), /radialGradient/);
+  assert.doesNotMatch(decodeURIComponent(first.image), /text|badge|raven/);
+  const bounds = wildlifeGridCellBounds(rows[0].id);
+  const logicalHeight =
+    (((bounds.north - bounds.south) * Math.PI) / 180) * 6378137;
+  assert.ok(first.width * first.scale >= 1.5 * logicalHeight);
+  assert.equal(first.width, first.height);
+  assert.ok(
+    first.width <= 65536,
+    'encoded dimensions fit Cesium width packing',
+  );
+  assert.ok(
+    first.width * first.scale > 65536,
+    'continental splats retain their true footprint through scale',
+  );
+  collection.update({ passes: { pick: true } });
+  assert.equal(
+    h.counts.updates,
+    0,
+    'the real public pick update is suppressed',
+  );
+  collection.update({ passes: { render: true } });
+  assert.equal(h.counts.updates, 1);
+  h.settle();
+  const rankOf = wildlifeDensityRanks(rows);
+  for (let i = 0; i < collection.length; i++)
+    assert.ok(
+      Math.abs(
+        collection.get(i).color.alpha -
+          wildlifeDensityIntensity(rankOf(rows[i].cellCount)),
+      ) < 1e-12,
+    );
+  h.density.destroy();
+});
+
+test('progressive tile arrival fades only new cells and reuses existing glow without flashing', () => {
+  const h = harness();
+  const one = cell(0, 4);
+  const two = cell(1, 10);
+  h.density.update([one]);
+  const first = h.density.collection.get(0);
+  const starting = first.color.alpha;
+  h.fadeStep();
+  assert.ok(first.color.alpha > starting);
+  const middle = first.color.alpha;
+  h.density.update([one, two]);
+  // The arriving tile re-ranks the incumbent (alone it was the hotspot; now
+  // it is the median) but its fade progress is kept, not restarted.
+  const progress = middle / wildlifeDensityIntensity(1);
+  assert.ok(
+    Math.abs(first.color.alpha - wildlifeDensityIntensity(0.5) * progress) <
+      1e-12,
+    'a streamed tile re-ranks but does not restart incumbents',
+  );
+  assert.equal(h.density.collection.get(0), first);
+  assert.equal(h.density.size, 2);
+  h.settle();
+  const settled = first.color.alpha;
+  h.density.update([one, two]);
+  assert.equal(first.color.alpha, settled);
+  h.density.update([two]);
+  assert.equal(h.density.size, 1);
+  assert.equal(h.density.collection.length, 1);
+  h.density.update([]);
+  assert.equal(h.density.size, 0);
+  assert.equal(
+    h.density.collection,
+    null,
+    'empty data releases the atlas and collection',
+  );
+  assert.equal(
+    h.primitives.length,
+    0,
+    'no full-view fill remains over empty data',
+  );
+  h.density.destroy();
+});
+
+test('visibility and antimeridian padding are applied on data/moveEnd work only', () => {
+  const h = harness();
+  const west = cell(1);
+  const east = cell(28);
+  const box = { ...wildlifeGridCellBounds(west.id) };
+  assert.equal(h.density.update([west, east], { boxes: [box] }).size, 1);
+  assert.equal(
+    h.density.update([west], { boxes: [box], isPointVisible: () => false })
+      .size,
+    0,
+  );
+  const id = 'grid:3/0/2:31:1';
+  const bounds = wildlifeGridCellBounds(id);
+  const wrapped = {
+    ...west,
+    id,
+    lat: (bounds.south + bounds.north) / 2,
+    lon: -179.3,
+  };
+  const crossed = {
+    south: bounds.south,
+    north: bounds.north,
+    west: 179,
+    east: -179,
+  };
+  assert.equal(h.density.update([wrapped], { boxes: [crossed] }).size, 1);
+  h.density.destroy();
+});
+
+test('density culls far-side cells and front-side kernels that would spill over the limb', () => {
+  const camera = {
+    positionWC: Cesium.Cartesian3.fromDegrees(0, 0, 5_000_000),
+    positionCartographic: { height: 5_000_000 },
+  };
+  const h = harness({ camera });
+  const occluder = new Cesium.EllipsoidalOccluder(
+    Cesium.Ellipsoid.WGS84,
+    camera.positionWC,
+  );
+  const cells = [
+    cell(0, 1, { lat: 0, lon: 0 }),
+    cell(1, 2, { lat: 0, lon: 54 }),
+    cell(2, 4, { lat: 0, lon: 110 }),
+  ];
+  assert.equal(
+    occluder.isPointVisible(Cesium.Cartesian3.fromDegrees(54, 0)),
+    true,
+    'the limb fixture has a visible centre but an overflowing footprint',
+  );
+  const result = h.density.update(cells, {
+    isPointVisible: (anchor) => occluder.isPointVisible(anchor),
+  });
+  assert.equal(result.size, 1, 'only the fully front-side kernel can glow');
+  assert.equal(
+    result.sightingCount,
+    3,
+    'visual limb padding never removes visible counts',
+  );
+  h.density.destroy();
+});
+
+test('density fades from regional detail to a clear whole-globe view without frame work or count loss', () => {
+  const camera = { positionCartographic: { height: 3_000_000 } };
+  const h = harness({ camera });
+  const cells = [cell(0, 12)];
+  h.density.update(cells);
+  h.settle();
+  const point = h.density.collection.get(0);
+  const fullAlpha = point.color.alpha;
+  camera.positionCartographic.height = 5_500_000;
+  h.density.update(cells);
+  assert.equal(h.density.collection.get(0), point);
+  assert.ok(Math.abs(point.color.alpha - fullAlpha / 2) < 1e-12);
+  const writes = h.counts.writes;
+  h.density.update(cells);
+  assert.equal(h.counts.writes, writes, 'unchanged height writes nothing');
+  camera.positionCartographic.height = 8_000_000;
+  assert.equal(h.density.update(cells).sightingCount, 12);
+  assert.equal(h.density.collection, null);
+  assert.equal(h.timers.size, 0, 'no invisible fade or frame loop');
+  const positions = h.counts.positions;
+  camera.positionCartographic.height = 3_000_000;
+  h.density.update(cells);
+  h.settle();
+  assert.equal(
+    h.counts.positions,
+    positions,
+    'altitude changes reuse decoded positions',
+  );
+  assert.equal(h.density.collection.get(0).color.alpha, fullAlpha);
+  h.density.destroy();
+});
+
+test('styles follow persisted mono/CRT and cockpit vision overrides, without adding a second ramp', () => {
+  const h = harness({ documentStyle: 'thermal' });
+  h.density.update([cell(0)]);
+  h.settle();
+  const point = h.density.collection.get(0);
+  assert.equal(point.color.red, point.color.green);
+  assert.equal(point.color.green, point.color.blue);
+  const alpha = point.color.alpha;
+  h.eventTarget.emit('gev:style-change', { style: 'retro' });
+  h.flushIdle();
+  assert.ok(point.color.green > point.color.red);
+  h.eventTarget.emit('gev:vision-change', { cockpit: true, style: 'nvg' });
+  h.flushIdle();
+  assert.equal(point.color.red, point.color.green);
+  h.eventTarget.emit('gev:style-change', { style: 'normal' });
+  h.flushIdle();
+  assert.equal(
+    point.color.red,
+    point.color.green,
+    'cockpit vision wins while active',
+  );
+  h.eventTarget.emit('gev:vision-change', { cockpit: false, style: 'normal' });
+  h.flushIdle();
+  assert.notEqual(point.color.red, point.color.green);
+  assert.equal(point.color.alpha, alpha);
+  h.density.destroy();
+});
+
+test('clear/disable and destroy release the atlas, primitives, coordinates, timers and listeners', () => {
+  const h = harness();
+  const row = cell(0);
+  h.density.update([row]);
+  const old = h.density.collection;
+  assert.equal(h.timers.size, 1);
+  h.fadeStep();
+  h.density.clear();
+  assert.equal(old.isDestroyed(), true);
+  assert.equal(h.density.collection, null);
+  assert.equal(h.density.size, 0);
+  assert.equal(h.primitives.length, 0);
+  assert.equal(h.timers.size, 0);
+  assert.equal(h.idle.size, 0);
+  for (const values of h.listeners.values()) assert.equal(values.size, 0);
+  const priorPositions = h.counts.positions;
+  h.density.update([row]);
+  assert.equal(
+    h.counts.positions,
+    priorPositions + 1,
+    'disable released cached coordinates',
+  );
+  const work = h.density.updateWork([cell(2)]);
+  work.next();
+  h.density.destroy();
+  assert.equal(
+    work.next().done,
+    true,
+    'obsolete data work cannot resurrect a destroyed layer',
+  );
+  assert.equal(h.density.collection, null);
+  assert.equal(h.primitives.length, 0);
+  assert.equal(h.timers.size, 0);
+  assert.equal(h.idle.size, 0);
+});
+
+test('dense six-tile updates have a deterministic linear operation budget and no warmed writes/projections', (t) => {
+  const h = harness();
+  const cells = [];
+  for (let x = 1; x < 3; x++)
+    for (let y = 1; y < 4; y++)
+      for (let row = 1; row < 64; row += 2)
+        for (let column = 1; column < 64; column += 2) {
+          const id = `grid:3/${x}/${y}:${row}:${column}`;
+          const box = wildlifeGridCellBounds(id);
+          cells.push({
+            id,
+            lat: (box.south + box.north) / 2,
+            lon: (box.west + box.east) / 2,
+            cellCount: row * 64 + column,
+          });
+        }
+  let operations;
+  h.density.update(cells, {
+    onOperations: (value) => {
+      operations = value;
+    },
+  });
+  h.settle();
+  assert.equal(operations.densityVisits, 6144);
+  assert.equal(operations.densityMetadataBuilds, 6144);
+  assert.equal(operations.densityPositionBuilds, 6144);
+  assert.equal(operations.densityCreated, 6144);
+  const positions = h.counts.positions;
+  const writes = h.counts.writes;
+  let units = 0;
+  const work = h.density.updateWork(cells, {
+    onOperations: (value) => {
+      operations = value;
+    },
+  });
+  while (!work.next().done) units++;
+  assert.deepEqual(operations, {
+    densityVisits: 6144,
+    densityRetirementVisits: 6144,
+    densityMetadataBuilds: 0,
+    densityPositionBuilds: 0,
+    densityWrites: 0,
+    densityCreated: 0,
+    densityRemoved: 0,
+  });
+  assert.equal(units, Math.ceil(6144 / WILDLIFE_WORK_UNIT) * 2);
+  assert.equal(h.counts.positions, positions);
+  assert.equal(h.counts.writes, writes);
+  t.diagnostic(
+    `6,144 occupied cells: ${units} bounded units, 12,288 linear visits, zero warmed metadata/Cartesian builds, projections or billboard writes`,
+  );
+  h.density.destroy();
+});

src/layers/wildlifeSightings/docs.test.mjs

@@ -0,0 +1,129 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { VOICE_OFF_LAYERS } from '../../voice/layerManifest.js';
+import { ANALYST_LAYERS } from '../../data/analystEngine.js';
+
+const read = (path) =>
+  readFileSync(new URL(`../../../${path}`, import.meta.url), 'utf8');
+const current = read('docs/CURRENT-STATE.md');
+const start = current.indexOf('## Wildlife Sightings —');
+const section = current
+  .slice(start, current.indexOf('\n## ', start + 1))
+  .replace(/\s+/g, ' ');
+
+test('Wildlife docs name the permanent token, voice policy and coverage limits', () => {
+  const token = JSON.parse(
+    read('src/data/layerStateTokenReservations.json'),
+  ).find(([id]) => id === 'wildlife-sightings')?.[1];
+  assert.ok(token);
+  assert.match(section, new RegExp(`share-link token \`${token}\``));
+  assert.match(section, /Voice is off for this layer for now/);
+  assert.ok(Object.hasOwn(VOICE_OFF_LAYERS, 'wildlife-sightings'));
+  assert.ok(!Object.hasOwn(ANALYST_LAYERS, 'wildlife-sightings'));
+  assert.match(section, /not a census/i);
+  assert.match(section, /Salish Sea/);
+  assert.match(section, /0\.01°/);
+  assert.match(section, /private records are excluded/);
+});
+
+test('Wildlife documentation defines recency by observation time and compact ambient credit', () => {
+  assert.match(section, /observation time/i);
+  assert.match(section, /\bd1\b/);
+  assert.match(section, /48 h/);
+  assert.match(section, /96 px/);
+  assert.match(section, /creator name/i);
+  assert.match(section, /110\/125 km/);
+  assert.match(section, /120 km/);
+  assert.match(section, /random sample/);
+  assert.match(section, /bounded frame cache/);
+  assert.match(read('DATA_SOURCES.md'), /observation time/i);
+});
+
+test('Wildlife docs describe direct photo selection and text-only privacy rows', () => {
+  assert.match(section, /compact anchored\s+photo card/);
+  assert.match(section, /object-fit: contain/);
+  assert.match(section, /preserving zoom/);
+  assert.match(section, /compact observed\s+age/);
+  assert.match(section, /Obscured sightings also stay\s+text-only/);
+  assert.match(section, /Acartia stays text-only/);
+  assert.match(section, /closes the card and clears selection/);
+  assert.match(
+    section,
+    /shell teardown also removes its host and subscription/,
+  );
+  assert.doesNotMatch(
+    section,
+    /opens\s+the \*\*Sighting\*\* panel|Clicking the panel photo/,
+  );
+});
+
+test('Wildlife docs record queue failure isolation and the complete badge mapping', () => {
+  assert.match(section, /recovered queue tail/);
+  assert.match(section, /ordinary grid failures/);
+  assert.match(section, /DEGRADED/);
+  assert.match(section, /1.5 px dark outline/);
+  for (const glyph of [
+    'raven',
+    'pets',
+    'egg_alt',
+    'water_drop',
+    'set_meal',
+    'bug_report',
+    'pest_control',
+    'eco',
+    'umbrella',
+    'category',
+    'question_mark',
+  ])
+    assert.ok(section.includes('`' + glyph + '`'), glyph);
+});
+
+test('Wildlife docs separate density from real observation icons and define persistent selection', () => {
+  assert.match(section, /dedicated, nonpickable billboard/);
+  assert.match(section, /view-relative density ramp/);
+  assert.match(section, /four logical cell widths/);
+  assert.match(
+    section,
+    /Only real sampled observation rows produce taxon badges/,
+  );
+  assert.match(
+    section,
+    /Grid tiles publish even while the independent observation/,
+  );
+  assert.match(section, /until explicit\s+deselection or layer disable/);
+  assert.match(
+    section,
+    /releases\s+the glow collection, texture atlas, timers, queues and style listeners/,
+  );
+  assert.doesNotMatch(section, /grid badge|Clicking a grid cell/);
+});
+
+test('Wildlife docs describe one source link, name declutter and globe glow limits', () => {
+  assert.match(section, /selected chrome and paint lane/);
+  assert.match(section, /single source link/);
+  assert.match(section, /80 screen pixels/);
+  assert.match(section, /word boundary/);
+  assert.match(section, /3,000 km/);
+  assert.match(section, /8,000 km/);
+  assert.match(section, /5% radius margin/);
+  assert.match(section, /add no per-frame work/);
+});
+
+test('Wildlife docs cite the documented UTFGrid endpoint and the Acartia key request', () => {
+  for (const path of [
+    'docs/KNOWN-ISSUES.md',
+    'DATA_SOURCES.md',
+    'docs/CURRENT-STATE.md',
+  ]) {
+    const text = read(path);
+    assert.doesNotMatch(text, /undocumented (iNaturalist|UTFGrid) endpoint/i);
+    assert.doesNotMatch(text, /grid \(undocumented/i);
+  }
+  for (const path of ['docs/KNOWN-ISSUES.md', 'DATA_SOURCES.md'])
+    assert.match(read(path), /Grid Tiles UTFGrid/);
+  assert.match(
+    read('DATA_SOURCES.md'),
+    /create an account and generate an API key/,
+  );
+});

src/layers/wildlifeSightings/gridViewport.js

@@ -0,0 +1,178 @@
+// Observation icons share 28px screen buckets. The density glow uses finer
+// 8–14px logical cells, coarsened until the complete view fits the tile budget.
+export const WILDLIFE_GRID_TARGET_SPACING_PX = 28;
+export const WILDLIFE_GRID_SAMPLE_SPACING_PX = 14;
+export const WILDLIFE_GRID_TILE_CAP = 6;
+export const WILDLIFE_GRID_MAX_ZOOM = 22;
+// The 64×64 UTFGrid is a hit mask: each logical 8px observation bin
+// occupies 2×2 of its 4px pixels, plus a dilated hit outline. Returned centres
+// are at odd pixel coordinates. Count logical bins once, not hit-mask pixels.
+export const WILDLIFE_GRID_LOGICAL_SIZE = 32;
+const MAX_LATITUDE = 85.0511287798066;
+const degrees = (radians) => (radians * 180) / Math.PI;
+const latitudeY = (latitude) => {
+  const radians =
+    (Math.max(-MAX_LATITUDE, Math.min(MAX_LATITUDE, latitude)) * Math.PI) / 180;
+  return (1 - Math.asinh(Math.tan(radians)) / Math.PI) / 2;
+};
+const yLatitude = (value) =>
+  degrees(Math.atan(Math.sinh(Math.PI * (1 - 2 * value))));
+const validBox = (box) =>
+  !!box &&
+  ['south', 'west', 'north', 'east'].every((key) =>
+    Number.isFinite(box[key]),
+  ) &&
+  box.south >= -90 &&
+  box.north <= 90 &&
+  box.north > box.south &&
+  box.west >= -180 &&
+  box.west <= 180 &&
+  box.east >= -180 &&
+  box.east <= 180 &&
+  box.west !== box.east;
+
+function normalizedBoxes(boxes) {
+  if (!Array.isArray(boxes) || !boxes.length || !boxes.every(validBox))
+    return [];
+  return boxes
+    .flatMap((box) =>
+      box.west < box.east
+        ? [box]
+        : [
+            { ...box, east: 180 },
+            { ...box, west: -180 },
+          ],
+    )
+    .filter((box) => box.east > box.west);
+}
+
+function tileRanges(boxes, z) {
+  const count = 2 ** z;
+  const index = (value) => Math.max(0, Math.min(count - 1, Math.floor(value)));
+  return normalizedBoxes(boxes).map((box) => ({
+    left: index(((box.west + 180) / 360) * count),
+    right: index(((box.east + 180) / 360) * count - 1e-9),
+    top: index(latitudeY(box.north) * count),
+    bottom: index(latitudeY(box.south) * count - 1e-9),
+  }));
+}
+
+function tileCount(boxes, z) {
+  // Split antimeridian ranges cannot overlap except at z=0. Counting that
+  // shared tile twice merely makes the request cap slightly conservative.
+  return tileRanges(boxes, z).reduce(
+    (sum, range) =>
+      sum + (range.right - range.left + 1) * (range.bottom - range.top + 1),
+    0,
+  );
+}
+
+/** Choose the finest glow spacing whose full viewport fits the tile budget. */
+export function chooseWildlifeGridZoom({ boxes, width, height } = {}) {
+  const visible = normalizedBoxes(boxes);
+  if (!visible.length || !(width > 0) || !(height > 0)) return 0;
+  const horizontalSpan = Math.min(
+    1,
+    visible.reduce((sum, box) => sum + (box.east - box.west) / 360, 0),
+  );
+  const verticalSpan = Math.max(
+    ...visible.map((box) => latitudeY(box.south) - latitudeY(box.north)),
+  );
+  const pixelsPerWorld = Math.min(
+    width / horizontalSpan,
+    height / Math.max(1e-9, verticalSpan),
+  );
+  let z = Math.max(
+    0,
+    Math.min(
+      WILDLIFE_GRID_MAX_ZOOM,
+      Math.ceil(
+        Math.log2(
+          pixelsPerWorld /
+            (WILDLIFE_GRID_LOGICAL_SIZE * WILDLIFE_GRID_SAMPLE_SPACING_PX),
+        ) - 1e-9,
+      ),
+    ),
+  );
+  while (z > 0 && tileCount(visible, z) > WILDLIFE_GRID_TILE_CAP) z -= 1;
+  return z;
+}
+
+/** Only intersecting tiles, in stable XYZ order, with no neighboring padding.
+ * Direct oversized requests fail closed; zoom selection coarsens beforehand. */
+export function wildlifeGridTiles({ boxes, z } = {}) {
+  if (!Number.isInteger(z) || z < 0 || z > WILDLIFE_GRID_MAX_ZOOM) return [];
+  if (tileCount(boxes, z) > WILDLIFE_GRID_TILE_CAP) return [];
+  const tiles = new Map();
+  for (const range of tileRanges(boxes, z)) {
+    for (let x = range.left; x <= range.right; x += 1) {
+      for (let y = range.top; y <= range.bottom; y += 1) {
+        tiles.set(`${x}/${y}`, { z, x, y });
+      }
+    }
+  }
+  return [...tiles.values()].sort((a, b) => a.x - b.x || a.y - b.y);
+}
+
+/** Unlike detail-row viewport queries, grids cover full globe views too. */
+export function wildlifeGridViewportBoxes(viewer) {
+  const rectangle = viewer?.camera?.computeViewRectangle?.(
+    viewer?.scene?.globe?.ellipsoid,
+  );
+  if (!rectangle) return [];
+  return normalizedBoxes([
+    Object.fromEntries(
+      ['south', 'west', 'north', 'east'].map((key) => [
+        key,
+        Math.round(degrees(rectangle[key]) * 1e8) / 1e8,
+      ]),
+    ),
+  ]);
+}
+
+/** Return the geographic footprint of one logical occupied cell. */
+export function wildlifeGridCellBounds(id) {
+  const match = /^grid:(\d+)\/(\d+)\/(\d+):(\d+):(\d+)$/.exec(id);
+  if (!match) return null;
+  const [z, x, y, row, column] = match.slice(1).map(Number);
+  const count = 2 ** z;
+  if (
+    z > WILDLIFE_GRID_MAX_ZOOM ||
+    x >= count ||
+    y >= count ||
+    row >= 64 ||
+    column >= 64
+  )
+    return null;
+  return {
+    south: yLatitude((y + (Math.floor(row / 2) + 1) / 32) / count),
+    west: ((x + Math.floor(column / 2) / 32) / count) * 360 - 180,
+    north: yLatitude((y + Math.floor(row / 2) / 32) / count),
+    east: ((x + (Math.floor(column / 2) + 1) / 32) / count) * 360 - 180,
+  };
+}
+
+/** Shared with the proxy and cached-coverage matching. A tile's hit area can
+ * bleed into its neighbor; the geographic owner makes ids stable. */
+export function wildlifeGridCellId(lat, lon, z) {
+  if (
+    !Number.isFinite(lat) ||
+    Math.abs(lat) > 90 ||
+    !Number.isFinite(lon) ||
+    Math.abs(lon) > 180 ||
+    !Number.isInteger(z) ||
+    z < 0 ||
+    z > WILDLIFE_GRID_MAX_ZOOM
+  )
+    return null;
+  const count = 2 ** z;
+  const worldX = ((((lon + 180) / 360) % 1) + 1) % 1;
+  const worldY = Math.max(0, Math.min(1 - Number.EPSILON, latitudeY(lat)));
+  const tileX = Math.min(count - 1, Math.floor(worldX * count));
+  const tileY = Math.min(count - 1, Math.floor(worldY * count));
+  const column =
+    Math.min(31, Math.floor((worldX * count - tileX) * 32 + 1e-8)) * 2 + 1;
+  const row =
+    Math.min(31, Math.floor((worldY * count - tileY) * 32 + 1e-8)) * 2 + 1;
+  return `grid:${z}/${tileX}/${tileY}:${row}:${column}`;
+}

src/layers/wildlifeSightings/gridViewport.test.mjs

@@ -0,0 +1,142 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  chooseWildlifeGridZoom,
+  wildlifeGridTiles,
+  wildlifeGridViewportBoxes,
+  wildlifeGridCellBounds,
+  wildlifeGridCellId,
+  WILDLIFE_GRID_LOGICAL_SIZE,
+  WILDLIFE_GRID_TILE_CAP,
+} from './gridViewport.js';
+
+const globe = [
+  { south: -85.0511287798066, west: -180, north: 85.0511287798066, east: 180 },
+];
+const regional = [{ south: 0, west: 0, north: 40.979898069620134, east: 45 }];
+
+test('glow sampling uses roughly 8–14px cells independently of the 28px icon buckets', () => {
+  for (const [boxes, width, height, expected] of [
+    [globe, 448, 448, 0],
+    [regional, 448, 448, 3],
+    [
+      [{ south: 0, west: 0, north: 0.08789059053082508, east: 0.087890625 }],
+      448,
+      448,
+      12,
+    ],
+  ]) {
+    const zoom = chooseWildlifeGridZoom({ boxes, width, height });
+    assert.equal(zoom, expected);
+    const worldPixels = (width * 360) / (boxes[0].east - boxes[0].west);
+    const spacing = worldPixels / 2 ** zoom / WILDLIFE_GRID_LOGICAL_SIZE;
+    assert.ok(spacing >= 8 && spacing <= 14, `${zoom}: ${spacing}px`);
+    assert.ok(
+      wildlifeGridTiles({ boxes, z: zoom }).length <= WILDLIFE_GRID_TILE_CAP,
+    );
+  }
+});
+
+test('the named six-tile budget preserves complete coverage for common views', () => {
+  for (const [boxes, width, height, expected] of [
+    [globe, 896, 896, 1],
+    [regional, 896, 896, 4],
+    [[{ south: 7, west: -168, north: 72, east: -48 }], 1400, 900, 2],
+    [globe, 4000, 4000, 1],
+    [globe, 30_000, 400, 0],
+  ]) {
+    const z = chooseWildlifeGridZoom({ boxes, width, height });
+    assert.equal(z, expected);
+    const tiles = wildlifeGridTiles({ boxes, z });
+    assert.ok(tiles.length > 0 && tiles.length <= WILDLIFE_GRID_TILE_CAP);
+  }
+});
+
+test('tile ranges contain only intersecting tiles, no offscreen neighbors or duplicate boundary tiles', () => {
+  assert.deepEqual(wildlifeGridTiles({ boxes: regional, z: 3 }), [
+    { z: 3, x: 4, y: 3 },
+  ]);
+  assert.deepEqual(wildlifeGridTiles({ boxes: globe, z: 0 }), [
+    { z: 0, x: 0, y: 0 },
+  ]);
+  const crossing = [{ south: 10, west: 179, north: 12, east: -178 }];
+  const split = [
+    { south: 10, west: 179, north: 12, east: 180 },
+    { south: 10, west: -180, north: 12, east: -178 },
+  ];
+  const z = chooseWildlifeGridZoom({
+    boxes: crossing,
+    width: 896,
+    height: 600,
+  });
+  assert.deepEqual(
+    wildlifeGridTiles({ boxes: crossing, z }),
+    wildlifeGridTiles({ boxes: split, z }),
+  );
+  assert.ok(
+    wildlifeGridTiles({ boxes: crossing, z }).every(
+      (tile) =>
+        ((tile.x + 1) / 2 ** z) * 360 - 180 > 179 ||
+        (tile.x / 2 ** z) * 360 - 180 < -178,
+    ),
+  );
+});
+
+test('tile cap degrades zoom to preserve complete coverage and oversized direct requests fail closed', () => {
+  const z = chooseWildlifeGridZoom({
+    boxes: globe,
+    width: 30_000,
+    height: 400,
+  });
+  assert.ok(
+    wildlifeGridTiles({ boxes: globe, z }).length <= WILDLIFE_GRID_TILE_CAP,
+  );
+  assert.deepEqual(wildlifeGridTiles({ boxes: globe, z: 12 }), []);
+  assert.equal(chooseWildlifeGridZoom({ boxes: [], width: 0, height: 0 }), 0);
+  assert.deepEqual(wildlifeGridTiles({ boxes: [], z: 2 }), []);
+});
+
+test('grid camera viewport supports globe and antimeridian without detail-query degree limits', () => {
+  const radians = (value) => (value * Math.PI) / 180;
+  const viewer = {
+    camera: {
+      computeViewRectangle: () => ({
+        south: radians(-80),
+        west: radians(120),
+        north: radians(80),
+        east: radians(-120),
+      }),
+    },
+  };
+  const boxes = wildlifeGridViewportBoxes(viewer);
+  assert.equal(boxes.length, 2);
+  assert.ok(Math.abs(boxes[0].west - 120) < 1e-8);
+  assert.equal(boxes[0].east, 180);
+  assert.equal(boxes[1].west, -180);
+  assert.deepEqual(wildlifeGridViewportBoxes({}), []);
+});
+
+test('logical cell ids and bounds share geographic coverage and wrap antimeridian', () => {
+  const id = wildlifeGridCellId(65.94004866768753, -18.28125, 2);
+  assert.equal(id, 'grid:2/1/1:1:51');
+  const bounds = wildlifeGridCellBounds(id);
+  assert.equal(bounds.west, -19.6875);
+  assert.equal(bounds.east, -16.875);
+  assert.ok(bounds.south < 65.94 && bounds.north > 65.94);
+  assert.equal(
+    wildlifeGridCellId(
+      (bounds.south + bounds.north) / 2,
+      (bounds.west + bounds.east) / 2,
+      2,
+    ),
+    id,
+  );
+  assert.equal(wildlifeGridCellId(0, 180, 2), wildlifeGridCellId(0, -180, 2));
+  for (const invalid of [
+    'bad',
+    'grid:23/0/0:1:1',
+    'grid:2/4/0:1:1',
+    'grid:2/0/0:64:1',
+  ])
+    assert.equal(wildlifeGridCellBounds(invalid), null);
+});

src/layers/wildlifeSightings/index.js

@@ -0,0 +1,130 @@
+import * as Cesium from 'cesium';
+import { horizonOccluder } from '../../data/iconOrientation.js';
+import { createPhotoSlots } from './photos.js';
+import { createRendering } from './rendering.js';
+import { createSelection } from './selection.js';
+import { createControls } from './controls.js';
+import { createLifecycle } from './lifecycle.js';
+
+/** Compose recent wildlife observations without acquiring data at construction. */
+export function createWildlifeSightingsLayer({
+  source,
+  overlayHost = null,
+  screenSpaceEventHandlerFactory = null,
+  picking = null,
+  pointer = null,
+  sprites = null,
+  badgeSprites = null,
+  render = null,
+  context = null,
+  focus = null,
+  groundFloor = null,
+  now = () => Date.now(),
+  setTimer = (fn, delay) => setTimeout(fn, delay),
+  clearTimer = (timer) => clearTimeout(timer),
+  requestIdleCallback,
+  cancelIdleCallback,
+  imageFactory,
+  eventTarget = globalThis.window,
+  cesium = Cesium,
+  project = (scene, position) =>
+    Cesium.SceneTransforms.worldToWindowCoordinates(scene, position),
+  occluderFactory = horizonOccluder,
+} = {}) {
+  if (typeof source?.getSnapshot !== 'function')
+    throw new TypeError('Wildlife sightings require a snapshot source');
+  const state = {
+    viewer: null,
+    enabled: false,
+    destroyed: false,
+    manager: null,
+    request: null,
+    background: null,
+    cameraTimer: null,
+    removeCamera: null,
+    removeContext: null,
+    clickHandler: null,
+    rows: new Map(),
+    renderedRows: [],
+    rowById: new Map(),
+    points: null,
+    pointById: new Map(),
+    positions: new Map(),
+    cells: [],
+    staging: null,
+    selectedId: null,
+    selectedRow: null,
+    carriers: new Map(),
+    contextIds: new Set(),
+    publishingContext: false,
+    ambientIds: [],
+    ambientRows: [],
+    confirmed: false,
+    taxa: 'all',
+    drawnParams: null,
+    pendingParams: null,
+    failedParams: null,
+    controlsListener: null,
+    lastUpdate: null,
+    error: null,
+    stale: false,
+    loading: false,
+    gridCells: [],
+    gridParams: null,
+    gridAvailable: false,
+    gridTotal: 0,
+    labelRows: [],
+    query: null,
+    band: null,
+    lastQueryKey: null,
+    retryAt: 0,
+    failures: 0,
+  };
+  const parts = {};
+  const services = {
+    source,
+    overlayHost,
+    screenSpaceEventHandlerFactory,
+    picking,
+    pointer,
+    sprites,
+    badgeSprites,
+    render,
+    context,
+    focus,
+    groundFloor,
+    now,
+    setTimer,
+    clearTimer,
+    requestIdleCallback,
+    cancelIdleCallback,
+    eventTarget,
+    cesium,
+    project,
+    occluderFactory,
+  };
+  const owner = { state, services, parts };
+  parts.photos = createPhotoSlots({
+    imageFactory,
+    now,
+    setTimer,
+    clearTimer,
+    onChange() {
+      if (!state.enabled) return;
+      parts.selection.publishAmbient();
+    },
+  });
+  parts.rendering = createRendering(owner);
+  parts.selection = createSelection(owner);
+  parts.controls = createControls(owner);
+  parts.lifecycle = createLifecycle(owner);
+  return Object.assign({}, parts.controls.methods, parts.lifecycle.methods, {
+    selectSighting: parts.selection.selectAndFocus,
+    clearSightingSelection: parts.selection.clearAndRebuild,
+    subscribeSelection: parts.selection.subscribe,
+    /** Return the current surface anchor for a retained observation. */
+    getSightingPosition(id) {
+      return state.positions.get(id) || null;
+    },
+  });
+}

src/layers/wildlifeSightings/lifecycle.js

@@ -0,0 +1,851 @@
+import { msg } from '../../i18n/marker.js';
+import { getWildlifeHeightBand, rowInWildlifeBoxes } from './model.js';
+import {
+  combineWildlifeGridSnapshots,
+  preferredWildlifeFailure,
+  wildlifeFailureDelayMs,
+  wildlifeFailures,
+  wildlifeRetryAfterMs,
+} from './source.js';
+import { wildlifeMeasure } from './performance.js';
+import { isRecentWildlifeSighting } from './records.js';
+import {
+  wildlifeGridViewportBoxes,
+  chooseWildlifeGridZoom,
+  wildlifeGridTiles,
+  wildlifeGridCellId,
+} from './gridViewport.js';
+import { wildlifeViewportBoxes, snapWildlifeBox } from './viewport.js';
+import {
+  WILDLIFE_DEBOUNCE_MS,
+  WILDLIFE_MAX_ROWS,
+  WILDLIFE_GRID_HEIGHT_METERS,
+} from './policy.js';
+
+/** Manager-owned acquisition with camera debounce and guarded transactions. */
+export function createLifecycle({ state, services, parts }) {
+  let requestQueryKey = null;
+  let removeManagerListener = null;
+  let lifetimeEpoch = 0;
+  let initialCameraDeadline = 0;
+  let initialSettle = null;
+  // The manager invokes update immediately after enable. Settle startup camera
+  // events before dispatching anything, then acquire only the resulting view.
+  const INITIAL_CAMERA_SETTLE_MS = 300;
+
+  function settleInitialCamera(signal) {
+    if (!initialCameraDeadline || services.now() >= initialCameraDeadline) {
+      initialCameraDeadline = 0;
+      return Promise.resolve();
+    }
+    return new Promise((resolve) => {
+      const finish = () => {
+        services.clearTimer(state.cameraTimer);
+        state.cameraTimer = null;
+        initialSettle = null;
+        initialCameraDeadline = 0;
+        signal?.removeEventListener('abort', finish);
+        resolve();
+      };
+      initialSettle = {
+        schedule() {
+          services.clearTimer(state.cameraTimer);
+          state.cameraTimer = services.setTimer(
+            finish,
+            Math.max(0, initialCameraDeadline - services.now()),
+          );
+        },
+        finish,
+      };
+      signal?.addEventListener('abort', finish, { once: true });
+      initialSettle.schedule();
+    });
+  }
+
+  function renderBatch(fn) {
+    parts.rendering.beginBatch?.();
+    try {
+      return fn();
+    } finally {
+      parts.rendering.endBatch?.();
+    }
+  }
+
+  function clearPending() {
+    if (!state.pendingParams) return;
+    if (state.error) state.failedParams = state.pendingParams;
+    state.pendingParams = null;
+    parts.controls.notify();
+  }
+
+  function failParams(params) {
+    // An acquisition can fail during an ordinary refresh, when no option is
+    // pending. Keep the chosen taxa visible and retryable in that case too.
+    state.failedParams = {
+      ...params,
+      keys: [
+        ...new Set([
+          ...(state.pendingParams?.keys || []),
+          'taxa',
+          ...(params.confirmed ? ['confirmed'] : []),
+        ]),
+      ],
+    };
+    state.pendingParams = null;
+  }
+
+  function applyRetry(
+    errors,
+    retryAfterSec = null,
+    previousMs = state.failures || 0,
+  ) {
+    // Only 429/5xx failures impose cooldown; client, network and schema
+    // errors retry on pan. Several requests can fail together: wait for the
+    // longest effective delay among them.
+    const delays = [
+      ...wildlifeFailures(errors).map((error) =>
+        wildlifeFailureDelayMs(error, previousMs),
+      ),
+      wildlifeRetryAfterMs(retryAfterSec),
+    ].filter((delay) => delay !== null);
+    if (!delays.length) {
+      state.failures = 0;
+      state.retryAt = 0;
+      return;
+    }
+    const backoff = Math.max(...delays);
+    state.failures = backoff;
+    state.retryAt = services.now() + backoff;
+  }
+
+  function pageHidden() {
+    return (
+      services.eventTarget?.document?.hidden || globalThis.document?.hidden
+    );
+  }
+
+  function currentQuery() {
+    const height = state.viewer?.camera?.positionCartographic?.height;
+    state.band = getWildlifeHeightBand(height ?? Infinity, state.band);
+    const boxes =
+      state.band === 'global'
+        ? null
+        : wildlifeViewportBoxes(state.viewer)?.map((box) =>
+            snapWildlifeBox(box),
+          );
+    const visibleBoxes = wildlifeGridViewportBoxes(state.viewer);
+    const scope =
+      state.band === 'global' ||
+      (!boxes && (height ?? Infinity) > WILDLIFE_GRID_HEIGHT_METERS)
+        ? 'global'
+        : 'view';
+    if (scope === 'view' && (!boxes?.length || boxes.some((box) => !box)))
+      return null;
+    const baseKey = JSON.stringify([
+      scope,
+      scope === 'global' ? null : boxes,
+      state.confirmed,
+      state.taxa,
+    ]);
+    const canvas = state.viewer?.scene?.canvas;
+    const zoom = visibleBoxes?.length
+      ? chooseWildlifeGridZoom({
+          boxes: visibleBoxes,
+          width: canvas?.clientWidth || 1400,
+          height: canvas?.clientHeight || 900,
+        })
+      : 0;
+    const tiles = visibleBoxes?.length
+      ? wildlifeGridTiles({ boxes: visibleBoxes, z: zoom })
+      : [];
+    return {
+      scope,
+      boxes: scope === 'global' ? null : boxes,
+      visibleBoxes,
+      tiles,
+      key: JSON.stringify([baseKey, tiles]),
+    };
+  }
+
+  function refreshView() {
+    const query = currentQuery();
+    const superseded = state.query?.key !== query?.key;
+    state.query = query;
+    if (superseded) {
+      state.request?.abort();
+      state.background?.abort();
+    }
+    // Keep the previous validated display while changing filters. Its rows
+    // and parameter chips are replaced together when acquisition succeeds.
+    renderBatch(() => {
+      const pending =
+        !state.pendingClear && parts.rendering.rebuild() === 'pending';
+      parts.rendering.cull();
+      if (pending) return;
+      parts.selection.refreshAmbient();
+      parts.selection.refreshContexts();
+      parts.selection.syncCredits();
+    });
+    return query;
+  }
+
+  async function refresh() {
+    if (!state.enabled || pageHidden()) {
+      clearPending();
+      return;
+    }
+    const controller = new AbortController();
+    const pendingParams = state.pendingParams;
+    state.background?.abort();
+    state.background = controller;
+    try {
+      if (state.manager)
+        await state.manager.refreshLayer('wildlife-sightings', {
+          signal: controller.signal,
+        });
+      else await methods.update(undefined, { signal: controller.signal });
+    } catch {
+      // update exposes expected source errors through stats; manager failures
+      // already have their own normalized status path.
+    } finally {
+      if (state.background === controller) {
+        state.background = null;
+        // A manager may decline acquisition while it is enabling, or the view
+        // may disappear before update. Only queued/in-flight work is busy.
+        if (
+          state.pendingParams === pendingParams &&
+          !state.loading &&
+          state.cameraTimer == null
+        )
+          clearPending();
+      }
+    }
+  }
+
+  function scheduleRefresh() {
+    services.clearTimer(state.cameraTimer);
+    state.cameraTimer = null;
+    if (!state.enabled || pageHidden()) {
+      clearPending();
+      return;
+    }
+    if (initialSettle) {
+      initialSettle.schedule();
+      return;
+    }
+    const query = currentQuery();
+    if (!query || query.key === state.lastQueryKey) {
+      clearPending();
+      return;
+    }
+    if (
+      query.key === requestQueryKey &&
+      state.request &&
+      !state.request.signal.aborted
+    )
+      return;
+    state.cameraTimer = services.setTimer(
+      () => {
+        state.cameraTimer = null;
+        if (!state.enabled || pageHidden()) {
+          clearPending();
+          return;
+        }
+        const query = currentQuery();
+        if (!query || query.key === state.lastQueryKey) {
+          clearPending();
+          return;
+        }
+        if (
+          query.key === requestQueryKey &&
+          state.request &&
+          !state.request.signal.aborted
+        )
+          return;
+        if (services.now() < state.retryAt) {
+          scheduleRefresh();
+          return;
+        }
+        void refresh();
+      },
+      Math.max(WILDLIFE_DEBOUNCE_MS, state.retryAt - services.now()),
+    );
+  }
+
+  function applyAccepted({
+    snapshot,
+    grid,
+    gridError,
+    query,
+    params,
+    request,
+    signal,
+    epoch,
+    previousFailures,
+    replaceRows = true,
+  }) {
+    const current = currentQuery();
+    if (
+      !state.enabled ||
+      state.destroyed ||
+      epoch !== lifetimeEpoch ||
+      request.signal.aborted ||
+      signal?.aborted ||
+      params.taxa !== state.taxa ||
+      params.confirmed !== state.confirmed ||
+      current?.key !== query.key
+    )
+      return;
+    renderBatch(() => {
+      const sameParams =
+        params.taxa === state.drawnParams?.taxa &&
+        params.confirmed === state.drawnParams?.confirmed;
+      const gridParams = state.gridParams || state.drawnParams;
+      const sameGridParams =
+        params.taxa === gridParams?.taxa &&
+        params.confirmed === gridParams?.confirmed;
+      // Tiles may beat a slow observation page. Publish their density without
+      // replacing observations or claiming their filter transaction succeeded.
+      // A pending filter keeps its previous display until both paths agree.
+      if (!snapshot) {
+        if (state.drawnParams && !sameParams) return;
+        if (grid) {
+          state.gridCells = grid.cells || [];
+          state.gridParams = params;
+          state.gridAvailable = true;
+          state.gridTotal = grid.totalResults || 0;
+          if (state.lastUpdate == null)
+            state.lastUpdate = Number.isFinite(grid.fetchedAt)
+              ? grid.fetchedAt
+              : services.now();
+          const pendingRender = parts.rendering.rebuild() === 'pending';
+          if (!pendingRender) {
+            parts.selection.refreshAmbient();
+            parts.selection.publishSelected();
+            parts.selection.refreshContexts();
+            parts.selection.syncCredits();
+          }
+          parts.controls.notify();
+        }
+        return;
+      }
+      if (replaceRows) {
+        if (state.selectedId && !state.selectedRow)
+          state.selectedRow =
+            state.rowById.get(state.selectedId) ||
+            state.rows.get(state.selectedId) ||
+            null;
+        const retainedRows = sameParams
+          ? (parts.selection.retainedAmbientRows?.() || []).filter(
+              (row) =>
+                state.rows.has(row.stableId) &&
+                isRecentWildlifeSighting(row, services.now(), params.taxa),
+            )
+          : [];
+        const retainedIds = new Set(retainedRows.map((row) => row.stableId));
+        if (state.selectedRow) retainedIds.add(state.selectedRow.stableId);
+        if (state.pendingClear || state.loadedScope !== query.scope)
+          state.rows.clear();
+        state.loadedScope = query.scope;
+        state.pendingClear = false;
+        // A successful page replaces this queried area, including a healthy
+        // empty page. Keep only other visited areas in the bounded LRU. Areas
+        // whose iNaturalist request failed keep their last iNaturalist rows.
+        const inat = snapshot.sources?.inaturalist;
+        const failedInatBoxes =
+          inat?.ok === false ? inat.failedBoxes || query.boxes : null;
+        for (const [id, row] of state.rows) {
+          if (
+            failedInatBoxes &&
+            row.origin === 'inaturalist' &&
+            rowInWildlifeBoxes(row, failedInatBoxes, 0)
+          )
+            continue;
+          if (rowInWildlifeBoxes(row, query.boxes, 0)) state.rows.delete(id);
+        }
+        for (const row of snapshot.rows) {
+          state.rows.delete(row.stableId);
+          state.rows.set(row.stableId, row);
+          if (row.stableId === state.selectedId) state.selectedRow = row;
+        }
+        // Selection owns a real observation until explicit deselection. It is
+        // independent of sample/window/filter and ambient-card eligibility.
+        if (state.selectedRow && !state.rows.has(state.selectedId))
+          state.rows.set(state.selectedId, state.selectedRow);
+        // Random samples may omit a photograph already displayed. Its bounded
+        // incumbent row stays selectable until the card leaves the view/window.
+        for (const row of retainedRows) {
+          if (!state.rows.has(row.stableId)) state.rows.set(row.stableId, row);
+        }
+        if (state.rows.size > WILDLIFE_MAX_ROWS) {
+          for (const id of state.rows.keys()) {
+            if (!retainedIds.has(id)) state.rows.delete(id);
+            if (state.rows.size <= WILDLIFE_MAX_ROWS) break;
+          }
+        }
+        if (state.rows.size > WILDLIFE_MAX_ROWS) {
+          for (const id of state.rows.keys()) {
+            if (id !== state.selectedId) state.rows.delete(id);
+            if (state.rows.size <= WILDLIFE_MAX_ROWS) break;
+          }
+        }
+      }
+      const failedStale = [snapshot, grid].filter(
+        (value) =>
+          value?.stale === true &&
+          Number.isFinite(value.retryAfterSec) &&
+          (value.upstreamStatus === undefined ||
+            value.upstreamStatus === 429 ||
+            value.upstreamStatus >= 500),
+      );
+      // The filter above admits only 429/5xx or an unmarked stale answer.
+      const staleError = failedStale.length
+        ? Object.assign(
+            new Error(msg('Wildlife sightings source unavailable')),
+            {
+              upstreamStatus: Math.max(
+                ...failedStale.map((value) => value.upstreamStatus || 503),
+              ),
+              retryAfterSec: Math.max(
+                ...failedStale.map((value) => value.retryAfterSec),
+              ),
+            },
+          )
+        : null;
+      const inat = snapshot.sources?.inaturalist;
+      const acartia = snapshot.sources?.acartia;
+      // Keep each failed request's status and Retry-After; the displayed
+      // error is the one whose effective delay sets the cooldown.
+      const sourceErrors = [
+        gridError,
+        staleError,
+        inat?.ok === false
+          ? inat.error ||
+            new Error(msg('Wildlife sightings source unavailable'))
+          : null,
+        acartia?.ok === false
+          ? Object.assign(new Error(msg('Acartia feed unavailable')), {
+              ...(acartia.error?.status
+                ? { status: acartia.error.status }
+                : {}),
+              ...(acartia.error?.upstreamStatus
+                ? { upstreamStatus: acartia.error.upstreamStatus }
+                : {}),
+              ...(Number.isFinite(acartia.error?.retryAfterSec)
+                ? { retryAfterSec: acartia.error.retryAfterSec }
+                : {}),
+            })
+          : null,
+      ].filter(Boolean);
+      const sourceError = preferredWildlifeFailure(
+        sourceErrors,
+        previousFailures,
+      );
+      state.stale =
+        !sourceError && (snapshot.stale === true || grid?.stale === true);
+      const fetchedAt = [snapshot.fetchedAt, grid?.fetchedAt].filter(
+        Number.isFinite,
+      );
+      state.lastUpdate =
+        (snapshot.stale === true || grid?.stale === true) && fetchedAt.length
+          ? Math.min(...fetchedAt)
+          : services.now();
+      state.error = sourceError?.message || null;
+      state.drawnParams = params;
+      const retryAfter = [snapshot, grid]
+        .filter(
+          (value) =>
+            value &&
+            (value.upstreamStatus === undefined ||
+              value.upstreamStatus === 429 ||
+              value.upstreamStatus >= 500),
+        )
+        .map((value) => value.retryAfterSec)
+        .filter(Number.isFinite);
+      if (sourceError) {
+        failParams(params);
+        applyRetry(
+          sourceErrors,
+          retryAfter.length ? Math.max(...retryAfter) : null,
+          previousFailures,
+        );
+      } else {
+        state.pendingParams = null;
+        state.failedParams = null;
+        state.retryAt = retryAfter.length
+          ? services.now() + wildlifeRetryAfterMs(Math.max(...retryAfter))
+          : 0;
+        state.failures = 0;
+      }
+      state.query = currentQuery();
+      if (grid !== undefined || !sameGridParams) {
+        state.gridCells = grid?.cells || [];
+        state.gridParams = grid ? params : null;
+        state.gridAvailable = !!grid;
+        state.gridTotal = grid?.totalResults || 0;
+      }
+      const pendingRender = parts.rendering.rebuild() === 'pending';
+      if (pendingRender) {
+        state.lastQueryKey = sourceError ? null : state.query?.key || query.key;
+        parts.controls.notify();
+        return;
+      }
+      parts.selection.refreshAmbient();
+      parts.selection.publishSelected();
+      parts.selection.notify();
+      parts.selection.refreshContexts();
+      parts.selection.syncCredits();
+      state.lastQueryKey = sourceError ? null : state.query?.key || query.key;
+      parts.controls.notify();
+    });
+  }
+
+  function disable() {
+    lifetimeEpoch += 1;
+    initialSettle?.finish();
+    initialCameraDeadline = 0;
+    state.enabled = false;
+    services.clearTimer(state.cameraTimer);
+    state.cameraTimer = null;
+    state.request?.abort();
+    state.request = null;
+    requestQueryKey = null;
+    state.background?.abort();
+    state.background = null;
+    state.loading = false;
+    clearPending();
+    state.removeCamera?.();
+    state.removeCamera = null;
+    parts.rendering.deactivate?.();
+    removeManagerListener?.();
+    removeManagerListener = null;
+    parts.selection.remove();
+    services.picking?.unregisterPickOwner?.('wildlife-sightings');
+    parts.rendering.clear();
+    parts.photos.clear();
+    parts.controls.notify();
+    parts.rendering.requestRender('disable');
+    return true;
+  }
+
+  const methods = {
+    /** Attach this layer's Cesium resources to one viewer. */
+    init(viewer, { signal } = {}) {
+      if (state.viewer)
+        throw new Error('Wildlife sightings layer is already initialized');
+      if (state.destroyed || signal?.aborted) return false;
+      state.viewer = viewer;
+      parts.rendering.init();
+      return true;
+    },
+    /** Show retained observations and acquire the settled camera view. */
+    enable(_viewer, { signal } = {}) {
+      if (state.destroyed || signal?.aborted) return false;
+      if (!state.viewer)
+        throw new Error('Wildlife sightings layer must be initialized');
+      if (state.enabled) return true;
+      state.enabled = true;
+      initialCameraDeadline = services.now() + INITIAL_CAMERA_SETTLE_MS;
+      parts.rendering.activate?.();
+      state.points.show = true;
+      refreshView();
+      for (const id of parts.selection.sourceIds)
+        services.overlayHost?.setVisible?.(id, true);
+      parts.selection.install();
+      services.picking?.registerPickOwner?.(
+        'wildlife-sightings',
+        (id) =>
+          typeof id === 'string' &&
+          id.startsWith('wildlife:') &&
+          state.rowById.has(id.slice(9)),
+      );
+      state.removeCamera = state.viewer.camera?.moveEnd?.addEventListener?.(
+        () => {
+          if (!state.enabled) return;
+          wildlifeMeasure('moveEnd', () => {
+            if (
+              initialCameraDeadline &&
+              services.now() < initialCameraDeadline
+            ) {
+              initialCameraDeadline = services.now() + INITIAL_CAMERA_SETTLE_MS;
+              refreshView();
+              initialSettle?.schedule();
+            } else {
+              refreshView();
+              scheduleRefresh();
+            }
+            parts.controls.notify();
+          });
+        },
+      );
+      // A debounce can expire while the manager is still enabling and cannot
+      // accept refreshLayer yet. Its settled visibility event is the one
+      // catch-up edge; completed initial queries are skipped by their key.
+      removeManagerListener =
+        state.manager?.subscribe?.((change) => {
+          if (
+            change.type === 'visibility' &&
+            change.layerId === 'wildlife-sightings' &&
+            change.enabled === true &&
+            state.enabled
+          )
+            scheduleRefresh();
+        }) || null;
+      if (services.sprites?.restoreSpriteOrderOnEnable)
+        services.sprites.restoreSpriteOrderOnEnable(
+          'wildlife-sightings',
+          state.viewer,
+        );
+      else services.sprites?.restoreSpriteOrder?.(state.viewer);
+      return true;
+    },
+    /** Refresh observations and density independently for the current filters. */
+    async update(_viewer, { signal } = {}) {
+      if (
+        !state.enabled ||
+        !state.points ||
+        state.destroyed ||
+        signal?.aborted
+      ) {
+        if (!state.request) clearPending();
+        return false;
+      }
+      if (initialCameraDeadline && services.now() < initialCameraDeadline)
+        await settleInitialCamera(signal);
+      initialCameraDeadline = 0;
+      if (!state.enabled || state.destroyed || signal?.aborted) return false;
+      const query = currentQuery();
+      state.query = query;
+      if (!query || pageHidden()) {
+        clearPending();
+        return true;
+      }
+      if (services.now() < state.retryAt) {
+        if (state.pendingParams && state.cameraTimer == null) scheduleRefresh();
+        return true;
+      }
+      if (
+        requestQueryKey === query.key &&
+        state.request &&
+        !state.request.signal.aborted
+      )
+        return true;
+      state.request?.abort();
+      const request = new AbortController();
+      const requestLifetime = lifetimeEpoch;
+      // One acquisition publishes several times (tiles, rows, final grid).
+      // Each derives its default backoff from the backoff before it started.
+      const previousFailures = state.failures || 0;
+      const supersededResult = () =>
+        state.enabled &&
+        !state.destroyed &&
+        lifetimeEpoch === requestLifetime &&
+        !signal?.aborted;
+      state.request = request;
+      requestQueryKey = query.key;
+      const onAbort = () => request.abort(signal.reason);
+      signal?.addEventListener?.('abort', onAbort, { once: true });
+      const params = { confirmed: state.confirmed, taxa: state.taxa };
+      state.loading = true;
+      if (!state.pendingParams) {
+        const drawn = state.drawnParams || { confirmed: false, taxa: null };
+        const keys = ['confirmed', 'taxa'].filter(
+          (key) => params[key] !== drawn[key],
+        );
+        if (keys.length) state.pendingParams = { ...params, keys };
+      }
+      parts.controls.notify();
+      let received = false;
+      let gridPending = false;
+      let acceptedSnapshot = null;
+      let gridRequest = null;
+      let gridResult = null;
+      const tileSnapshots = new Map();
+      const gridParams = state.gridParams || state.drawnParams;
+      const retainedGrid =
+        params.taxa === gridParams?.taxa &&
+        params.confirmed === gridParams?.confirmed
+          ? state.gridCells || []
+          : [];
+      function aggregateTiles(complete = false) {
+        if (!tileSnapshots.size) return undefined;
+        const grid = combineWildlifeGridSnapshots([...tileSnapshots.values()]);
+        if (!complete && retainedGrid.length) {
+          const zoom = query.tiles[0]?.z;
+          const covered = new Set(tileSnapshots.keys());
+          const retained = retainedGrid.filter(
+            (cell) =>
+              !covered.has(
+                wildlifeGridCellId(cell.lat, cell.lon, zoom)?.split(':')[1],
+              ),
+          );
+          return combineWildlifeGridSnapshots([
+            { ...grid, cells: [...retained, ...grid.cells] },
+          ]);
+        }
+        return grid;
+      }
+      function completedGrid(value) {
+        if (!value) return value;
+        const aggregate = aggregateTiles(!value.error);
+        return aggregate
+          ? combineWildlifeGridSnapshots([aggregate, value], value.error)
+          : value;
+      }
+      function publish(grid, gridError = null, replaceRows = false) {
+        applyAccepted({
+          snapshot: acceptedSnapshot,
+          grid,
+          gridError,
+          replaceRows,
+          query,
+          params,
+          request,
+          signal,
+          epoch: requestLifetime,
+          previousFailures,
+        });
+      }
+      function finishTiles() {
+        signal?.removeEventListener?.('abort', onAbort);
+        if (state.request === request) {
+          state.request = null;
+          requestQueryKey = null;
+          state.loading = false;
+          if (request.signal.aborted && state.cameraTimer == null)
+            clearPending();
+          parts.controls.notify();
+        }
+      }
+      function continueTiles() {
+        if (!gridRequest || gridResult) return;
+        gridPending = true;
+        void gridRequest
+          .then((result) => {
+            if (
+              acceptedSnapshot &&
+              !request.signal.aborted &&
+              state.request === request &&
+              state.enabled
+            )
+              publish(result?.value, result?.error || result?.value?.error);
+          })
+          .finally(finishTiles);
+      }
+      try {
+        const options = {
+          signal: request.signal,
+          boxes: query.boxes,
+          box: query.boxes?.[0] || null,
+          scope: query.scope,
+          ...params,
+        };
+        // Observation requests enter the shared proxy queue first. A slow tile
+        // never holds the manager's initial enable or the first observations.
+        const observationRequest =
+          typeof services.source.getSnapshotDetail === 'function'
+            ? services.source.getSnapshotDetail(options)
+            : Promise.resolve(services.source.getSnapshot(options)).then(
+                (rows) => ({ rows, stale: false, fetchedAt: services.now() }),
+              );
+        const hasGrid =
+          typeof services.source.getGridSnapshot === 'function' &&
+          query.tiles.length;
+        gridRequest = hasGrid
+          ? services.source
+              .getGridSnapshot({
+                signal: request.signal,
+                tiles: query.tiles,
+                ...params,
+                onTile(value, { tile }) {
+                  if (request.signal.aborted || state.request !== request)
+                    return;
+                  tileSnapshots.set(`${tile.z}/${tile.x}/${tile.y}`, value);
+                  publish(aggregateTiles());
+                },
+              })
+              .then(
+                (value) => {
+                  gridResult = { value: completedGrid(value) };
+                  if (!acceptedSnapshot)
+                    publish(gridResult.value, value?.error);
+                  return gridResult;
+                },
+                (error) => (gridResult = { error }),
+              )
+          : null;
+        const snapshot = await observationRequest;
+        if (
+          request.signal.aborted ||
+          state.request !== request ||
+          !state.enabled
+        )
+          return supersededResult();
+        if (!Array.isArray(snapshot?.rows))
+          throw new Error('Malformed iNaturalist response');
+        received = true;
+        acceptedSnapshot = snapshot;
+        publish(
+          gridResult?.value || aggregateTiles(),
+          gridResult?.error || gridResult?.value?.error,
+          true,
+        );
+        if (hasGrid && !gridResult) {
+          continueTiles();
+        } else if (gridResult && !gridResult.value && gridResult.error) {
+          // Observation rows remain visible when the first tile set fails.
+          publish(undefined, gridResult.error);
+        }
+        return true;
+      } catch (error) {
+        if (
+          request.signal.aborted ||
+          state.request !== request ||
+          !state.enabled
+        )
+          return supersededResult();
+        if (received) throw error;
+        // Observation failures must not cancel independent density tiles.
+        continueTiles();
+        state.stale = false;
+        state.error =
+          preferredWildlifeFailure(error, previousFailures)?.message ||
+          msg('Wildlife sightings source unavailable');
+        failParams(params);
+        state.lastQueryKey = null;
+        requestQueryKey = null;
+        applyRetry(error, null, previousFailures);
+        console.warn('[Data:WildlifeSightings] Update failed:', state.error);
+        return true;
+      } finally {
+        if (!gridPending) finishTiles();
+      }
+    },
+    /** Stop acquisition and release visible resources while retaining filters. */
+    disable,
+    /** Release requests, subscriptions, caches and scene resources. */
+    destroy() {
+      if (state.destroyed) return;
+      disable();
+      state.destroyed = true;
+      parts.selection.destroy();
+      parts.photos.destroy();
+      parts.rendering.destroy();
+      state.rows.clear();
+      state.lastUpdate = null;
+      state.error = null;
+      state.stale = false;
+      state.drawnParams = null;
+      state.gridParams = null;
+      state.pendingParams = null;
+      state.failedParams = null;
+      state.controlsListener = null;
+      state.manager = null;
+      state.viewer = null;
+    },
+  };
+  return {
+    methods,
+    scheduleRefresh,
+  };
+}

src/layers/wildlifeSightings/model.js

@@ -0,0 +1,208 @@
+import {
+  WILDLIFE_HEIGHT_BANDS,
+  WILDLIFE_HEIGHT_HYSTERESIS,
+  WILDLIFE_RENDER_LIMIT,
+  WILDLIFE_VIEW_PADDING,
+} from './policy.js';
+import { WILDLIFE_GRID_TARGET_SPACING_PX } from './gridViewport.js';
+import { drainWildlifeWork, WILDLIFE_WORK_UNIT } from './performance.js';
+
+const BAND_ORDER = Object.freeze(['cards', 'cells', 'regional', 'global']);
+const BAND_THRESHOLDS = Object.freeze([
+  WILDLIFE_HEIGHT_BANDS.cards,
+  WILDLIFE_HEIGHT_BANDS.cells,
+  WILDLIFE_HEIGHT_BANDS.global,
+]);
+
+/** A previous band is retained until a boundary is crossed by ten percent. */
+export function getWildlifeHeightBand(heightM, previous) {
+  const height = Number.isFinite(heightM) ? Math.max(0, heightM) : 0;
+  let index = BAND_ORDER.indexOf(previous);
+  if (index < 0)
+    return BAND_ORDER[
+      BAND_THRESHOLDS.filter((boundary) => height > boundary).length
+    ];
+  while (
+    index < BAND_ORDER.length - 1 &&
+    height > BAND_THRESHOLDS[index] * (1 + WILDLIFE_HEIGHT_HYSTERESIS)
+  )
+    index += 1;
+  while (
+    index > 0 &&
+    height < BAND_THRESHOLDS[index - 1] * (1 - WILDLIFE_HEIGHT_HYSTERESIS)
+  )
+    index -= 1;
+  return BAND_ORDER[index];
+}
+
+/** Share the legend's animal grouping and unknown fallback with sprites. */
+export function wildlifeIconicGroup(iconic) {
+  if (iconic === 'Mollusca' || iconic === 'Animalia') return 'Animalia';
+  return [
+    'Aves',
+    'Mammalia',
+    'Reptilia',
+    'Amphibia',
+    'Actinopterygii',
+    'Insecta',
+    'Arachnida',
+    'Plantae',
+    'Fungi',
+  ].includes(iconic)
+    ? iconic
+    : 'Unknown';
+}
+
+function validIconPosition(row) {
+  return (
+    Number.isFinite(row?.lat) &&
+    Math.abs(row.lat) <= 90 &&
+    Number.isFinite(row?.lon) &&
+    Math.abs(row.lon) <= 180
+  );
+}
+
+/** Compare provider IDs consistently across locales. */
+export function compareWildlifeIds(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+/** Prefer a selected/identified recent contact when a population exceeds its
+ * cap. Density is never converted into a larger billboard. */
+export function wildlifeIconRelevance(row, selectedId = null) {
+  return (
+    (row.stableId === selectedId ? 1e15 : 0) +
+    (row.commonName ? 1e13 : 0) +
+    (row.quality === 'research' ? 1e12 : 0) +
+    (Number.isFinite(row.observedAt) ? row.observedAt / 1000 : 0)
+  );
+}
+
+/** Real observations alone compete for 28px screen buckets. Density is an
+ * independent visual and can never supply or suppress a sighting's identity.
+ * A selected observation keeps its slot even outside the new camera view. */
+export function buildWildlifeIconModel(options = {}) {
+  return drainWildlifeWork(wildlifeIconModelWork(options));
+}
+
+/** Yield bounded units while selecting real observations for screen buckets. */
+export function* wildlifeIconModelWork({
+  rows = [],
+  boxes = null,
+  selectedId = null,
+  selectedRow = null,
+  preferredIds = [],
+  limit = WILDLIFE_RENDER_LIMIT,
+  projectRow = null,
+  onOperations = null,
+} = {}) {
+  const operations = {
+    observationVisits: 0,
+    projections: 0,
+    rankComparisons: 0,
+  };
+  const preferred = new Set(preferredIds);
+  const seen = new Set();
+  const buckets = new Map();
+  let sightingCount = 0;
+  let acartiaCount = 0;
+  const score = (row) =>
+    wildlifeIconRelevance(row, selectedId) +
+    (preferred.has(row.stableId) ? 1e14 : 0);
+  const candidates =
+    selectedRow && !rows.includes(selectedRow) ? [...rows, selectedRow] : rows;
+  yield 'bucket';
+  for (const row of candidates) {
+    if (
+      operations.observationVisits &&
+      operations.observationVisits % WILDLIFE_WORK_UNIT === 0
+    )
+      yield 'bucket';
+    operations.observationVisits++;
+    if (
+      typeof row?.stableId !== 'string' ||
+      !row.stableId.length ||
+      !validIconPosition(row) ||
+      seen.has(row.stableId)
+    )
+      continue;
+    seen.add(row.stableId);
+    const selected = row.stableId === selectedId;
+    const inView = rowInWildlifeBoxes(row, boxes, 0);
+    if (!selected && !inView) continue;
+    let key = row.stableId;
+    let visible = inView;
+    if (typeof projectRow === 'function') {
+      operations.projections++;
+      const screen = projectRow(row);
+      visible &&=
+        !!screen && Number.isFinite(screen.x) && Number.isFinite(screen.y);
+      if (!visible && !selected) continue;
+      if (visible) {
+        const x = Math.floor(screen.x / WILDLIFE_GRID_TARGET_SPACING_PX);
+        const y = Math.floor(screen.y / WILDLIFE_GRID_TARGET_SPACING_PX);
+        key =
+          Math.abs(x) < 1048576 && Math.abs(y) < 1048576
+            ? x * 2097152 + y
+            : `${x}:${y}`;
+      }
+    }
+    if (visible) {
+      sightingCount++;
+      if (row.origin === 'acartia') acartiaCount++;
+    }
+    const incumbent = buckets.get(key);
+    if (
+      !incumbent ||
+      score(row) > score(incumbent) ||
+      (score(row) === score(incumbent) && row.stableId < incumbent.stableId)
+    )
+      buckets.set(key, row);
+  }
+  yield 'rank';
+  const population = [...buckets.values()];
+  const cap = Math.max(selectedId ? 1 : 0, Math.floor(limit));
+  const saturated = population.length > cap;
+  if (saturated)
+    population.sort((a, b) => {
+      operations.rankComparisons++;
+      return score(b) - score(a) || compareWildlifeIds(a.stableId, b.stableId);
+    });
+  onOperations?.(operations);
+  return {
+    rows: saturated ? population.slice(0, cap) : population,
+    saturated,
+    totalPoints: population.length,
+    sightingCount,
+    acartiaCount,
+  };
+}
+
+/** Test the padded view in degrees, including across the antimeridian. Null
+ * boxes are the global sample, whose rows all remain candidates. */
+export function rowInWildlifeBoxes(
+  row,
+  boxes,
+  padding = WILDLIFE_VIEW_PADDING,
+) {
+  if (!Number.isFinite(row?.lat) || !Number.isFinite(row?.lon)) return false;
+  if (!Array.isArray(boxes)) return true;
+  for (const box of boxes) {
+    const latPad = (box.north - box.south) * padding;
+    const width =
+      box.east >= box.west ? box.east - box.west : 360 - box.west + box.east;
+    const lonPad = width * padding;
+    if (
+      row.lat < Math.max(-90, box.south - latPad) ||
+      row.lat > Math.min(90, box.north + latPad)
+    )
+      continue;
+    const relative = row.lon - box.west;
+    if (relative >= -lonPad && relative <= width + lonPad) return true;
+    if (relative + 360 >= -lonPad && relative + 360 <= width + lonPad)
+      return true;
+    if (relative - 360 >= -lonPad && relative - 360 <= width + lonPad)
+      return true;
+  }
+  return false;
+}

src/layers/wildlifeSightings/model.perf.test.mjs

@@ -0,0 +1,76 @@
+import assert from 'node:assert/strict';
+import { performance } from 'node:perf_hooks';
+import test from 'node:test';
+import { perfBudgetTestOptions } from '../../../scripts/run-perf-tests.mjs';
+import {
+  harness,
+  syntheticRows,
+  changePositions,
+  WILDLIFE_BENCHMARK_REFRESHES,
+} from '../../testSupport/wildlifeBillboardModel.mjs';
+
+// Pure model and incremental reconciliation, measured after warmup.
+// The 2,000-contact allowance is a fraction of one 60Hz frame; the 5,000 cap
+// gets a proportional allowance. No renderer, network or real sightings run.
+const WILDLIFE_MODEL_UPDATE_BUDGET_MS = Object.freeze({
+  500: 4,
+  2000: 8,
+  5000: 20,
+});
+test(
+  '500 / 2,000 / 5,000 icon model updates stay within their named timing budgets',
+  perfBudgetTestOptions(),
+  (t) => {
+    // Warm the same pure hot paths before recording CPU time.
+    const warm = harness();
+    let warmRows = syntheticRows(2000);
+    warm.apply(warmRows);
+    for (let i = 0; i < 25; i++) {
+      warmRows = changePositions(warmRows, i);
+      warm.apply(warmRows);
+    }
+    for (const n of [500, 2000, 5000]) {
+      const h = harness();
+      let rows = syntheticRows(n);
+      const start = performance.now();
+      const initial = h.apply(rows);
+      const initialMs = performance.now() - start;
+      assert.equal(initial.created, n);
+      const durations = [];
+      for (let refresh = 0; refresh < WILDLIFE_BENCHMARK_REFRESHES; refresh++) {
+        rows = changePositions(rows, refresh);
+        const before = performance.now();
+        const update = h.apply(rows);
+        durations.push(performance.now() - before);
+        assert.deepEqual(update, {
+          created: 0,
+          removed: 0,
+          updated: n / 10,
+          writes: n / 10,
+        });
+      }
+      const meanMs =
+        durations.reduce((sum, value) => sum + value, 0) / durations.length;
+      const maxMs = Math.max(...durations);
+      assert.ok(
+        maxMs <= WILDLIFE_MODEL_UPDATE_BUDGET_MS[n],
+        `${n}: ${maxMs.toFixed(3)}ms update exceeds ${WILDLIFE_MODEL_UPDATE_BUDGET_MS[n]}ms`,
+      );
+      const before = { ...h.counters };
+      assert.deepEqual(h.apply([...rows].reverse()), {
+        created: 0,
+        removed: 0,
+        updated: 0,
+        writes: 0,
+      });
+      assert.deepEqual(
+        h.counters,
+        before,
+        'unchanged content performs zero billboard writes or allocations',
+      );
+      t.diagnostic(
+        `N=${n}; initial=${initialMs.toFixed(3)}ms; incremental10% mean=${meanMs.toFixed(3)}ms, max=${maxMs.toFixed(3)}ms; budget=${WILDLIFE_MODEL_UPDATE_BUDGET_MS[n]}ms; unchanged writes=0`,
+      );
+    }
+  },
+);

src/layers/wildlifeSightings/model.test.mjs

@@ -0,0 +1,162 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  wildlifeIconicGroup,
+  rowInWildlifeBoxes,
+  buildWildlifeIconModel,
+} from './model.js';
+import { ICONIC_TINTS, ICONIC_LEGEND_ORDER, TAXA_PRESETS } from './policy.js';
+
+const row = {
+  stableId: 'inat:1',
+  lat: 47.6,
+  lon: -122.3,
+  cell: null,
+  iconic: 'Aves',
+  quality: 'research',
+  count: null,
+  obscured: false,
+};
+
+test('unknown groups are slate and molluscs fold into other animals', () => {
+  assert.equal(wildlifeIconicGroup('Mollusca'), 'Animalia');
+  for (const iconic of ['Unknown', 'Protozoa', 'Chromista', undefined])
+    assert.equal(wildlifeIconicGroup(iconic), 'Unknown');
+  assert.equal(ICONIC_TINTS.Unknown, '#9aa7b3');
+  assert.equal(ICONIC_LEGEND_ORDER.at(-1), 'Unknown');
+  assert.equal(ICONIC_LEGEND_ORDER.length, 11);
+  assert.equal(TAXA_PRESETS.length, 6);
+  assert.equal(TAXA_PRESETS.filter((item) => item.label === 'ALL').length, 1);
+  assert.equal(Object.isFrozen(ICONIC_TINTS), true);
+  assert.equal(Object.isFrozen(TAXA_PRESETS[0]), true);
+});
+
+test('view filtering includes padding and both sides of the antimeridian', () => {
+  const boxes = [{ south: 47, west: -123, north: 48, east: -122 }];
+  assert.equal(rowInWildlifeBoxes(row, boxes), true);
+  assert.equal(rowInWildlifeBoxes({ ...row, lat: 48.2 }, boxes), true);
+  assert.equal(rowInWildlifeBoxes({ ...row, lat: 48.4 }, boxes), false);
+  assert.equal(
+    rowInWildlifeBoxes({ ...row, lat: 10.5, lon: -179.9 }, [
+      { south: 10, west: 179, north: 11, east: 180 },
+    ]),
+    true,
+  );
+  assert.equal(rowInWildlifeBoxes(row, null), true);
+  assert.equal(rowInWildlifeBoxes(row, []), false);
+});
+
+test('grid cells never enter the observation icon model', () => {
+  const cells = [
+    { id: 'grid:2/0/0:1:1', lat: 47.6, lon: -122.3, cellCount: 999 },
+  ];
+  assert.deepEqual(buildWildlifeIconModel({ rows: cells }).rows, []);
+  assert.deepEqual(buildWildlifeIconModel({ rows: [...cells, row] }).rows, [
+    row,
+  ]);
+});
+
+test('screen buckets retain incumbent photos at their real sighting positions', () => {
+  const incumbent = {
+    ...row,
+    commonName: 'Incumbent',
+    photo: { square: 'synthetic.jpg' },
+  };
+  const challenger = {
+    ...row,
+    stableId: 'inat:2',
+    commonName: 'Challenger',
+    observedAt: Date.UTC(2026, 10, 4),
+  };
+  const distant = { ...row, stableId: 'inat:3', lon: row.lon + 1 };
+  const model = buildWildlifeIconModel({
+    rows: [challenger, incumbent, distant],
+    preferredIds: [incumbent.stableId],
+    projectRow: (item) => ({ x: (item.lon - row.lon) * 28 + 14, y: 14 }),
+  });
+  assert.deepEqual(model.rows, [incumbent, distant]);
+  assert.equal(model.sightingCount, 3);
+  assert.equal(model.rows[0].photo, incumbent.photo);
+});
+
+test('visible observation counts precede per-area and global caps', () => {
+  const rows = Array.from({ length: 6000 }, (_, i) => ({
+    ...row,
+    stableId: `inat:${i}`,
+    lon: -160 + i * 0.01,
+  }));
+  let projections = 0;
+  const model = buildWildlifeIconModel({
+    rows,
+    projectRow(item) {
+      projections++;
+      return { x: (item.lon + 160) * 5600 + 14, y: 14 };
+    },
+  });
+  assert.equal(projections, 6000);
+  assert.equal(model.rows.length, 5000);
+  assert.equal(model.totalPoints, 6000);
+  assert.equal(model.saturated, true);
+  assert.equal(model.sightingCount, 6000);
+});
+
+test('selected observations win their bucket and survive a sample, viewport and projection change', () => {
+  const selected = { ...row, commonName: 'Selected sighting' };
+  const challenger = {
+    ...row,
+    stableId: 'inat:2',
+    commonName: 'Newer',
+    observedAt: Date.UTC(2026, 10, 4),
+  };
+  const input = {
+    selectedId: row.stableId,
+    selectedRow: selected,
+    rows: [challenger],
+    limit: 1,
+  };
+  assert.deepEqual(
+    buildWildlifeIconModel({ ...input, projectRow: () => ({ x: 14, y: 14 }) })
+      .rows,
+    [selected],
+  );
+  const offscreen = buildWildlifeIconModel({
+    ...input,
+    boxes: [{ south: 0, west: 0, north: 1, east: 1 }],
+    projectRow: () => null,
+  });
+  assert.deepEqual(offscreen.rows, [selected]);
+  assert.equal(
+    offscreen.sightingCount,
+    0,
+    'an offscreen pin is not a visible observation',
+  );
+});
+
+test('observation reduction is stable under input order, selected priority and visible filtering', () => {
+  const named = { ...row, stableId: 'inat:2', commonName: 'Known bird' };
+  const outside = { ...row, stableId: 'inat:3', lat: 0 };
+  const input = {
+    boxes: [{ south: 47, west: -123, north: 48, east: -122 }],
+    limit: 1,
+  };
+  const model = buildWildlifeIconModel({
+    ...input,
+    rows: [row, named, outside],
+  });
+  assert.equal(model.saturated, true);
+  assert.equal(model.totalPoints, 2);
+  assert.equal(model.sightingCount, 2);
+  assert.deepEqual(model.rows, [named]);
+  assert.deepEqual(
+    buildWildlifeIconModel({ ...input, rows: [outside, named, row] }),
+    model,
+  );
+  assert.deepEqual(
+    buildWildlifeIconModel({
+      ...input,
+      rows: [named, row],
+      selectedId: row.stableId,
+    }).rows,
+    [row],
+  );
+});