From 428a6d733222a2ec286052ce5a7295b6e3e82a8f Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:13:39 -0500
Subject: [PATCH 01/10] docs(cctv): state what the app does with camera frames
 (#511)

Supersedes #357 by @Lob26, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: Pedro Lobato <69770518+Lob26@users.noreply.github.com>
---
 CHANGELOG.md    | 9 +++++++++
 DATA_SOURCES.md | 1 +
 2 files changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0242199c9..d31b48611 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -223,6 +223,15 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 ### Fixed
 
+- `DATA_SOURCES.md` states what the project does with camera frame content: a
+  successful upstream response is relayed as the provider served it, nothing in
+  the camera pipeline enhances it or recognises what is in it, resampling for
+  display is the only change made to the picture, and no frame is written to disk.
+  It also names what a viewer sees when an upstream has no frame — including a
+  last good picture kept after a failed refresh — and the one feature that sends
+  imagery anywhere: the voice assistant's viewport screenshot. Contributed by
+  Lob26 (#357).
+
 - Extract panel disclosure and hover/focus controls into a reusable module;
   cancel their listeners and pending work during replacement and teardown.
 
diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md
index 08a3d662e..f0bc95cb5 100644
--- a/DATA_SOURCES.md
+++ b/DATA_SOURCES.md
@@ -63,6 +63,7 @@ How to read this:
 - **Tarktee / Transpordiamet.** Estonia road-weather camera locations and current JPEG URLs come from keyless DATEX2 endpoints on `tarktee.transpordiamet.ee` (`/api/v1/datex/roadCameraLocations` + `roadCameraImages`). Frame URLs rotate with each capture; the 15-minute CCTV source cache refreshes them. Only `https://tarktee.transpordiamet.ee/images/…` URLs are registered. Disable with `CCTV_TARKTEE_ENABLED=0`.
 - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`.
 - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`.
+- **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
 - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and malformed or empty successful payloads are rejected atomically. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply.
 - **TomTom Traffic.** Optional and BYOK: without `TOMTOM_API_KEY` the traffic layer runs its built-in simulation and no TomTom data (or attribution) appears. With a key, flow vector tiles are fetched through the server-side `/api/tomtom` proxy (120 s cache + a daily tile-budget governor — `TOMTOM_DAILY_TILE_BUDGET`, default 40,000, a configurable application safety ceiling, not a guarantee of staying within TomTom's monthly free allowance; TomTom's [current pricing](https://docs.tomtom.com/pricing/) lists 200K free tile requests per month) and the "Traffic flow data © TomTom" credit is registered in the Data attribution popover the moment live mode activates. TomTom data is served live and cached only transiently (≤120 s TTL under `.gev-cache/`, gitignored) — it is not bundled or redistributed. One 23 KB point-in-time tile snapshot is committed as a decode-test fixture (`src/data/fixtures/`, © TomTom, never served to the app).
 - **Re:Earth Terrain.** Keyless (no API key). Used two ways: (1) `src/mapStackController.js` swaps in a `Cesium.CesiumTerrainProvider` pointed at Re:Earth's `cesium-mesh/ellipsoid` quantized-mesh endpoint for globe stacks without a Cesium ion token (e.g. OSM), replacing a flat `EllipsoidTerrainProvider`; falls back to the flat provider if the endpoint can't be reached. (2) The server-side `/api/terrain/heights` proxy (disk-cached, serve-stale) resolves per-point ellipsoidal ground height for entity placement. Both are best-effort with a keyless-safe fallback (bundled EGM96 geoid math) if Re:Earth is unreachable.

From da700be77f2864f7794d3acc09f6fcc956e2441c Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:17:52 -0500
Subject: [PATCH 02/10] fix(cctv): bound the Range header and release abandoned
 camera streams (#512)

Supersedes #253 by @Maher-Reven, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: Maher Kurdi <72787268+Maher-Reven@users.noreply.github.com>
---
 CHANGELOG.md                     |  18 +
 SECURITY.md                      |   1 +
 scripts/format-scope.json        |   4 +-
 scripts/package-boundaries.json  |   1 +
 server/providers/cctv.js         |  25 +-
 server/providers/cctv/media.js   |  63 ++++
 server/providers/cctv/range.js   |  81 +++++
 src/data/cctvMediaRange.test.mjs | 588 +++++++++++++++++++++++++++++++
 8 files changed, 779 insertions(+), 2 deletions(-)
 create mode 100644 server/providers/cctv/range.js
 create mode 100644 src/data/cctvMediaRange.test.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d31b48611..41ba9bee0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -212,6 +212,24 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 ### Security
 
+- The CCTV media route no longer forwards a client `Range` header to the upstream
+  camera host as it arrived. A single `bytes=` range is canonicalized and
+  forwarded, with every accepted form — explicit span, open-ended and suffix —
+  bounded to 64 MiB, the ceiling the relay already applies to a response that
+  declares its length. A response that declares no length has no ceiling — live
+  streamed media, and anything an upstream sends chunked while ignoring the
+  `Range` — which is unchanged. Multi-range, malformed, inverted, non-`bytes` and
+  unsafe-integer values are dropped and the request proceeds without a `Range`,
+  as RFC 7233 §3.1 prescribes; a multi-range value previously invited a
+  `multipart/byteranges` answer, whose parts nothing here reads. A value carrying
+  CR or LF made the outbound request throw, and the route recorded the thrown
+  message — which contains the caller's own string — as that camera's entry in
+  the health report. A request the browser has stopped waiting for is now
+  released: whether the viewer leaves while the camera is still answering or
+  part-way through the picture, the upstream request is cancelled rather than
+  left running, and neither case marks the camera degraded. Ordinary seeking is
+  unaffected. Contributed by Maher-Reven (#253).
+
 - Validate configured Google Places coordinates and text queries before rate
   limiting or upstream requests; preserve the keyless capability response.
 - Bound CCTV media response headers to 15 seconds and cancel error bodies.
diff --git a/SECURITY.md b/SECURITY.md
index 20fee1a36..9bf718b74 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -63,6 +63,7 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 
 - **No arbitrary-URL fetching.** The CCTV frame proxy fetches only server-registered camera/frame URLs — clients cannot pass an upstream URL to fetch (SSRF mitigation). Other proxies target fixed upstream hosts.
 - **Radio is not an audio relay.** `/api/radio/stations` contacts only allowlisted Radio Browser HTTPS hosts and paths, rejects redirects, rejects any hostname with a loopback/private/link-local/metadata/non-public A or AAAA result, and pins each TLS connection to a validated address. It returns normalized public HTTPS stream URLs; `/api/radio/click/:uuid` applies the same destination policy and accepts only station IDs from the current bounded catalog. The browser then connects directly to the broadcaster after an explicit playback action, so the broadcaster sees the listener's IP address. GEV never proxies, caches, records, or redistributes audio.
+- **No verbatim client headers upstream.** The CCTV media route is the one route that relays a request header (`Range`, for video seeking). It is parsed and canonicalized before it is forwarded: one `bytes=` range only, with every accepted form — explicit span, open-ended and suffix — bounded to the same 64 MiB ceiling the relay applies to a declared response body. Multi-range, malformed, inverted and non-`bytes` values are dropped and the request proceeds without a `Range`, as RFC 7233 §3.1 prescribes. Bounding the request bounds what is asked for: a response that declares no length — live streamed media, or a chunked body from an upstream that ignores the `Range` — has no ceiling. An upstream request the browser has stopped waiting for is cancelled rather than left running, whether the viewer leaves before the headers arrive or during the body.
 - **Response-size caps and timeouts** on proxied responses.
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 5f27f229c..41dfb629b 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -612,5 +612,7 @@
   "src/layers/vessels/snapshotRenderer.js",
   "src/layers/vessels/records.test.mjs",
   "src/layers/vessels/ingestion.test.mjs",
-  "src/cityPresets.test.mjs"
+  "src/cityPresets.test.mjs",
+  "server/providers/cctv/range.js",
+  "src/data/cctvMediaRange.test.mjs"
 ]
diff --git a/scripts/package-boundaries.json b/scripts/package-boundaries.json
index 202159eab..8801d5c47 100644
--- a/scripts/package-boundaries.json
+++ b/scripts/package-boundaries.json
@@ -152,6 +152,7 @@
       "server/providers/cctv/constants.js",
       "server/providers/cctv/media.js",
       "server/providers/cctv/normalize.js",
+      "server/providers/cctv/range.js",
       "server/providers/cctv/sources.js",
       "src/data/directionText.js",
       "server/providers/common/geo.js",
diff --git a/server/providers/cctv.js b/server/providers/cctv.js
index e1c2d8f85..5f601532f 100644
--- a/server/providers/cctv.js
+++ b/server/providers/cctv.js
@@ -10,11 +10,13 @@ import {
   fetchCctvImageFromUpstream,
   fetchTxdotSnapshot,
   fetchCctvMediaUpstream,
+  watchDownstreamClose,
 } from './cctv/media.js';
 import {
   CCTV_FRAME_FETCH_TIMEOUT_MS,
   CCTV_MAX_SOURCES_CEILING,
 } from './cctv/constants.js';
+import { sanitizeCctvRangeHeader } from './cctv/range.js';
 import { googleServerApiKey } from './places/google-key.js';
 export { CCTV_FRAME_FETCH_TIMEOUT_MS, fetchCctvImageFromUpstream };
 /**
@@ -218,15 +220,31 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) {
             return;
           }
 
+          // Bound before the request goes out: most of the wait is before any
+          // header arrives, and a viewer who leaves during it must take the
+          // upstream request with them.
+          const downstream = watchDownstreamClose(res);
           try {
             const upstreamHeaders = {
               'User-Agent': 'gods-eye-view-cctv-proxy/1.0',
             };
-            const requestRange = req.headers?.range;
+            // Never forward the client's own string: a Range this proxy does
+            // not accept is dropped and the request proceeds without one.
+            const requestRange = sanitizeCctvRangeHeader(req.headers?.range);
             if (requestRange) upstreamHeaders.Range = requestRange;
             const upstream = await fetchCctvMediaUpstream(mediaUrl, {
               headers: upstreamHeaders,
+              signal: downstream.signal,
             });
+            if (downstream.closed) {
+              // The headers arrived for a viewer who is no longer there.
+              try {
+                await upstream.body?.cancel();
+              } catch {
+                /* already closed */
+              }
+              return;
+            }
             const contentType = upstream.headers.get('content-type') || '';
             if (!upstream.ok) {
               try {
@@ -283,6 +301,11 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) {
             });
             return;
           } catch (error) {
+            if (downstream.closed) {
+              // The viewer left mid-request. That is not a camera fault and
+              // there is nobody to answer.
+              return;
+            }
             const timedOut =
               error?.name === 'AbortError' || error?.name === 'TimeoutError';
             setHealth(cameraId, {
diff --git a/server/providers/cctv/media.js b/server/providers/cctv/media.js
index 87e982f3b..d652f7150 100644
--- a/server/providers/cctv/media.js
+++ b/server/providers/cctv/media.js
@@ -156,9 +156,65 @@ export async function proxyMediaResponse(
   stream.on('error', () => {
     if (!res.writableEnded) res.end();
   });
+
+  // A live camera feed has no end of its own. When the viewer goes away the
+  // upstream connection must go with it, or every abandoned view leaves a
+  // stream open against the camera host for as long as that host will hold it.
+  let released = false;
+  const releaseUpstream = () => {
+    if (released) return;
+    released = true;
+    stream.unpipe(res);
+    // Destroying the Node stream cancels the web body it wraps; the direct
+    // cancel covers a body that was never wrapped, and rejects harmlessly when
+    // the reader is already held.
+    stream.destroy();
+    try {
+      const cancelled = upstream.body?.cancel?.();
+      if (typeof cancelled?.catch === 'function') cancelled.catch(() => {});
+    } catch {
+      /* already closed */
+    }
+  };
+  res.once('close', () => {
+    if (!res.writableEnded) releaseUpstream();
+  });
+  res.once('error', releaseUpstream);
+  stream.once('end', () => {
+    released = true;
+  });
   stream.pipe(res);
 }
 
+/**
+ * Watch a client response for an early goodbye.
+ *
+ * Bound BEFORE the upstream request goes out, because most of the waiting
+ * happens before any header comes back: a viewer who closes the tab while a
+ * slow camera is still thinking would otherwise leave that request running with
+ * nobody to receive it.
+ *
+ * @param {import('http').ServerResponse} res - The client response.
+ * @returns {{signal: AbortSignal, closed: boolean}} `signal` cancels the
+ *   upstream request; `closed` says the client left before the response ended.
+ */
+export function watchDownstreamClose(res) {
+  const controller = new AbortController();
+  const state = {
+    signal: controller.signal,
+    closed: false,
+  };
+  const onClose = () => {
+    // A response that ended normally also emits close; only an early one counts.
+    if (res.writableEnded) return;
+    state.closed = true;
+    controller.abort();
+  };
+  res.once?.('close', onClose);
+  res.once?.('error', onClose);
+  return state;
+}
+
 /** Read a snapshot incrementally, retaining at most maxBytes of owned chunks. */
 async function readCappedResponseBytes(upstream, maxBytes) {
   const declared = Number(upstream.headers.get('content-length'));
@@ -229,14 +285,21 @@ export async function fetchCctvMediaUpstream(
     headers = {},
     fetchImpl = fetch,
     timeoutMs = CCTV_MEDIA_FETCH_TIMEOUT_MS,
+    signal: downstream = null,
   } = {},
 ) {
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  // The client going away cancels the upstream request, not just the response
+  // to it.
+  const onDownstreamAbort = () => controller.abort();
+  if (downstream?.aborted) controller.abort();
+  else downstream?.addEventListener?.('abort', onDownstreamAbort);
   try {
     return await fetchImpl(url, { headers, signal: controller.signal });
   } finally {
     clearTimeout(timeoutId);
+    downstream?.removeEventListener?.('abort', onDownstreamAbort);
   }
 }
 
diff --git a/server/providers/cctv/range.js b/server/providers/cctv/range.js
new file mode 100644
index 000000000..d21e7dba5
--- /dev/null
+++ b/server/providers/cctv/range.js
@@ -0,0 +1,81 @@
+import { CCTV_MEDIA_MAX_BODY_BYTES } from './constants.js';
+
+/** Digits allowed per Range position — bounds parse cost and absurd offsets. */
+const RANGE_MAX_DIGITS = 16;
+
+/**
+ * Validate, canonicalize and bound a client `Range` header before the media
+ * route forwards it to a third-party camera host.
+ *
+ * The route used to copy `req.headers.range` through verbatim. Two things
+ * follow from that. A multi-range value makes the upstream answer
+ * `multipart/byteranges`: when that body declares its length the relay's
+ * ceiling still applies to it, but the parts inside are the upstream's to
+ * choose and nothing here reads them, and a multipart body sent without a
+ * declared length streams through uncapped like any other length-less body.
+ * And a value the outbound request refuses to carry — anything with CR or LF
+ * in it — made `fetch` throw, and the route recorded that error text, which
+ * contains the client's own string, as the camera's health message.
+ *
+ * Bounding the Range bounds what is ASKED FOR, not what arrives: an upstream
+ * that ignores the Range and answers with a length-less chunked body still
+ * streams without a ceiling. That is how live feeds are served and is not
+ * changed here. What is bounded is the request's lifetime: it is cancelled when
+ * the viewer goes away, before the headers arrive as well as during the body.
+ *
+ * Anything that is not a single well-formed `bytes=` range is DROPPED and the
+ * request proceeds with no Range, which is what RFC 7233 §3.1 prescribes for a
+ * Range a server cannot understand: the client gets the whole body rather than
+ * an error it did not ask for. Accepted forms are `bytes=<first>-<last>`,
+ * `bytes=<first>-` and `bytes=-<suffix>`.
+ *
+ * Every accepted form is bounded to {@link CCTV_MEDIA_MAX_BODY_BYTES}, the same
+ * ceiling the relay applies to a declared response body — including the
+ * open-ended and suffix forms, which otherwise ask an upstream for a whole file
+ * of unknown size. A player that wants more than one bound's worth asks for the
+ * next range, which is ordinary partial-content behavior.
+ *
+ * @param {*} value - Raw `req.headers.range`.
+ * @param {number} [maxBytes] - Ceiling for the requested span.
+ * @returns {string} Canonical `bytes=...` value, or '' to send no Range.
+ */
+export function sanitizeCctvRangeHeader(
+  value,
+  maxBytes = CCTV_MEDIA_MAX_BODY_BYTES,
+) {
+  if (typeof value !== 'string') return '';
+  const raw = value.trim();
+  if (!raw) return '';
+
+  // The unit is case-insensitive (RFC 7233 §2.1) and `bytes` is the only one
+  // this proxy understands. A comma anywhere fails this pattern, which is how
+  // multi-range is refused.
+  const match = /^bytes=(\d*)-(\d*)$/i.exec(raw);
+  if (!match) return '';
+
+  const [, firstText, lastText] = match;
+  if (firstText.length > RANGE_MAX_DIGITS || lastText.length > RANGE_MAX_DIGITS)
+    return '';
+  // "bytes=-" carries neither position and is meaningless.
+  if (!firstText && !lastText) return '';
+
+  // Suffix form: the final N bytes. N === 0 is unsatisfiable by definition.
+  if (!firstText) {
+    const suffix = Number(lastText);
+    if (!Number.isSafeInteger(suffix) || suffix <= 0) return '';
+    return `bytes=-${Math.min(suffix, maxBytes)}`;
+  }
+
+  const first = Number(firstText);
+  if (!Number.isSafeInteger(first) || first < 0) return '';
+
+  const ceiling = first + maxBytes - 1;
+  if (!Number.isSafeInteger(ceiling)) return '';
+
+  // Open-ended: everything from `first` on, bounded to one span.
+  if (!lastText) return `bytes=${first}-${ceiling}`;
+
+  const last = Number(lastText);
+  if (!Number.isSafeInteger(last) || last < first) return '';
+  return `bytes=${first}-${Math.min(last, ceiling)}`;
+}
diff --git a/src/data/cctvMediaRange.test.mjs b/src/data/cctvMediaRange.test.mjs
new file mode 100644
index 000000000..3e71d3e17
--- /dev/null
+++ b/src/data/cctvMediaRange.test.mjs
@@ -0,0 +1,588 @@
+// Client `Range` handling for the CCTV media proxy. The route used to relay
+// req.headers.range verbatim to a third-party upstream; these pin what is now
+// allowed through, both as string policy and through the mounted route with an
+// injected upstream.
+//
+// Run with: npm test   (node --test)
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import { Readable } from 'node:stream';
+import { cctvProxy } from '../../server/providers/cctv.js';
+import { sanitizeCctvRangeHeader } from '../../server/providers/cctv/range.js';
+import { CCTV_MEDIA_MAX_BODY_BYTES as CAP } from '../../server/providers/cctv/constants.js';
+
+test('single well-formed byte ranges pass through canonicalized', () => {
+  assert.equal(sanitizeCctvRangeHeader('bytes=0-1023'), 'bytes=0-1023');
+  // A single range that names the same byte twice is legal.
+  assert.equal(sanitizeCctvRangeHeader('bytes=7-7'), 'bytes=7-7');
+  // The unit is case-insensitive (RFC 7233 §2.1); surrounding space is legal.
+  assert.equal(sanitizeCctvRangeHeader('  BYTES=0-99  '), 'bytes=0-99');
+});
+
+test('multi-range is dropped so the upstream never answers multipart/byteranges', () => {
+  // The relay forwards Content-Length/Content-Range and caps on a single
+  // declared body; a multipart response defeats that accounting.
+  assert.equal(sanitizeCctvRangeHeader('bytes=0-1,2-3'), '');
+  assert.equal(sanitizeCctvRangeHeader('bytes=0-1, 100-200, 300-'), '');
+});
+
+test('malformed, non-byte and CR/LF-bearing values are dropped, not forwarded', () => {
+  for (const bad of [
+    'bytes=abc-def',
+    'bytes=',
+    'bytes=-',
+    'bytes=1-2-3',
+    '0-100', // no unit
+    'items=0-100', // a unit the proxy does not understand
+    'bytes=1.5-2',
+    'bytes=-0', // zero-length suffix is unsatisfiable
+    'bytes=0x10-0x20',
+    'bytes=+5-10',
+    'bytes=-5-10',
+    // An outbound request refuses to carry these, and the failure used to be
+    // written into the camera's health message.
+    'bytes=0-10\r\nX-Injected: 1',
+    'bytes=0-10\nHost: evil.example',
+  ]) {
+    assert.equal(
+      sanitizeCctvRangeHeader(bad),
+      '',
+      `expected drop: ${JSON.stringify(bad)}`,
+    );
+  }
+});
+
+test('non-string and empty inputs yield no Range header', () => {
+  // req.headers.range is undefined on a normal GET, and Node hands back an
+  // array when a client sends the header twice.
+  assert.equal(sanitizeCctvRangeHeader(undefined), '');
+  assert.equal(sanitizeCctvRangeHeader(null), '');
+  assert.equal(sanitizeCctvRangeHeader(''), '');
+  assert.equal(sanitizeCctvRangeHeader('   '), '');
+  assert.equal(sanitizeCctvRangeHeader(['bytes=0-1', 'bytes=2-3']), '');
+  assert.equal(sanitizeCctvRangeHeader(42), '');
+});
+
+test('every accepted form is bounded to the relay body cap', () => {
+  // Explicit span.
+  assert.equal(
+    sanitizeCctvRangeHeader('bytes=0-999999999999'),
+    `bytes=0-${CAP - 1}`,
+  );
+  assert.equal(
+    sanitizeCctvRangeHeader('bytes=1000-999999999999'),
+    `bytes=1000-${1000 + CAP - 1}`,
+  );
+  // Open-ended: bounded too, rather than asking an upstream for a whole file
+  // of unknown size.
+  assert.equal(
+    sanitizeCctvRangeHeader('bytes=500-'),
+    `bytes=500-${500 + CAP - 1}`,
+  );
+  // Suffix: bounded to one span of the tail.
+  assert.equal(sanitizeCctvRangeHeader('bytes=-500'), 'bytes=-500');
+  assert.equal(sanitizeCctvRangeHeader('bytes=-999999999999'), `bytes=-${CAP}`);
+  // Exactly at the cap, and comfortably under it, are untouched.
+  assert.equal(
+    sanitizeCctvRangeHeader(`bytes=0-${CAP - 1}`),
+    `bytes=0-${CAP - 1}`,
+  );
+  assert.equal(sanitizeCctvRangeHeader('bytes=0-1048575'), 'bytes=0-1048575');
+});
+
+test('inverted and unsafe-integer positions are dropped', () => {
+  assert.equal(sanitizeCctvRangeHeader('bytes=500-100'), '');
+  // Beyond Number.MAX_SAFE_INTEGER the arithmetic silently loses precision.
+  assert.equal(sanitizeCctvRangeHeader('bytes=99999999999999999-'), '');
+  // Absurd digit counts are refused before any Number() conversion.
+  assert.equal(sanitizeCctvRangeHeader(`bytes=0-${'9'.repeat(64)}`), '');
+});
+
+// ---------------------------------------------------------------------------
+// The mounted route, with the upstream injected through globalThis.fetch.
+// ---------------------------------------------------------------------------
+
+const CAMERA = {
+  id: 'range-fixture',
+  name: 'Range fixture',
+  lat: 30.27,
+  lon: -97.74,
+  feedType: 'video',
+  url: 'https://upstream.invalid/live.mp4',
+};
+
+/** A minimal upstream Response with a streaming body. */
+function upstreamResponse({ status = 206, headers = {}, body = 'payload' }) {
+  const store = new Map(
+    Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]),
+  );
+  return {
+    ok: status >= 200 && status < 300,
+    status,
+    headers: { get: (name) => store.get(String(name).toLowerCase()) ?? null },
+    body:
+      body === null
+        ? null
+        : Readable.toWeb(Readable.from([Buffer.from(String(body))])),
+    arrayBuffer: async () => Buffer.from(String(body)),
+  };
+}
+
+/** Collects what a handler wrote, the way a Node ServerResponse would. */
+function recordingResponse() {
+  const chunks = [];
+  let finished;
+  const done = new Promise((resolve) => {
+    finished = resolve;
+  });
+  const res = {
+    statusCode: 0,
+    headers: {},
+    writableEnded: false,
+    body: '',
+    writeHead(status, headers) {
+      res.statusCode = status;
+      res.headers = headers || {};
+    },
+    write(chunk) {
+      chunks.push(Buffer.from(chunk));
+      return true;
+    },
+    end(chunk) {
+      if (chunk) chunks.push(Buffer.from(chunk));
+      res.writableEnded = true;
+      res.body = Buffer.concat(chunks).toString('utf8');
+      finished();
+    },
+    on() {},
+    once() {},
+    emit() {},
+    destroy() {},
+  };
+  return { res, done };
+}
+
+/**
+ * Mount the real provider, serve one camera, and answer its upstream from the
+ * supplied function.
+ */
+function mount(t, respond) {
+  const before = {
+    json: process.env.CCTV_SOURCES_JSON,
+    file: process.env.CCTV_SOURCES_FILE,
+    austin: process.env.CCTV_FORCE_AUSTIN,
+  };
+  process.env.CCTV_SOURCES_JSON = JSON.stringify([CAMERA]);
+  process.env.CCTV_SOURCES_FILE = 'absent-source-file.json';
+  process.env.CCTV_FORCE_AUSTIN = '0';
+  const nativeFetch = globalThis.fetch;
+  const requests = [];
+  globalThis.fetch = async (url, init = {}) => {
+    requests.push({
+      url: String(url),
+      headers: init.headers || {},
+      signal: init.signal || null,
+    });
+    return respond({ url: String(url), init });
+  };
+  t.after(() => {
+    globalThis.fetch = nativeFetch;
+    for (const [name, value] of [
+      ['CCTV_SOURCES_JSON', before.json],
+      ['CCTV_SOURCES_FILE', before.file],
+      ['CCTV_FORCE_AUSTIN', before.austin],
+    ]) {
+      if (value === undefined) delete process.env[name];
+      else process.env[name] = value;
+    }
+  });
+
+  let handler = null;
+  const plugin = cctvProxy();
+  plugin.configureServer({
+    middlewares: {
+      use: (_route, fn) => {
+        handler = fn;
+      },
+    },
+  });
+  assert.ok(handler, 'the CCTV provider must mount a middleware');
+
+  /** Drive one request through the mounted handler. */
+  const call = async (path, headers = {}) => {
+    const { res, done } = recordingResponse();
+    await handler({ url: path, headers, method: 'GET', on() {} }, res);
+    await done;
+    return res;
+  };
+  /** Read the camera's current health entry. */
+  const health = async () => {
+    const res = await call('/health');
+    return JSON.parse(res.body).cameras.find(({ id }) => id === CAMERA.id);
+  };
+  return { call, health, requests, handler: (req, res) => handler(req, res) };
+}
+
+test('a canonical range reaches the upstream and its 206 is passed through', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 206,
+      headers: {
+        'content-type': 'video/mp4',
+        'content-range': 'bytes 0-1023/4096',
+        'content-length': '1024',
+        'accept-ranges': 'bytes',
+      },
+      body: 'partial',
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, { range: 'bytes=0-1023' });
+  assert.equal(app.requests.at(-1).headers.Range, 'bytes=0-1023');
+  assert.equal(res.statusCode, 206);
+  assert.equal(res.headers['Content-Range'], 'bytes 0-1023/4096');
+  assert.equal(res.headers['Accept-Ranges'], 'bytes');
+  assert.equal(res.body, 'partial');
+});
+
+test('an unbounded seek is bounded before it is forwarded', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 206,
+      headers: { 'content-type': 'video/mp4' },
+      body: 'tail',
+    }),
+  );
+  await app.call(`/media/${CAMERA.id}`, { range: 'bytes=500-' });
+  assert.equal(app.requests.at(-1).headers.Range, `bytes=500-${500 + CAP - 1}`);
+});
+
+test('a rejected range is dropped and the request proceeds without one', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 200,
+      headers: { 'content-type': 'video/mp4' },
+      body: 'whole body',
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, {
+    range: 'bytes=0-10\r\nX-Injected: 1',
+  });
+  // Documented choice: drop the header rather than answer 400, so a client
+  // that sends something this proxy will not carry still gets its media.
+  assert.equal(app.requests.at(-1).headers.Range, undefined);
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body, 'whole body');
+});
+
+test('a rejected range leaves the camera health report untouched', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 200,
+      headers: { 'content-type': 'video/mp4' },
+      body: 'whole body',
+    }),
+  );
+  await app.call(`/media/${CAMERA.id}`, {
+    range: 'bytes=0-10\r\nX-Injected: 1',
+  });
+  const entry = await app.health();
+  assert.equal(entry.status, 'ok');
+  // The client's own string must never appear in a report other callers read.
+  assert.doesNotMatch(JSON.stringify(entry), /X-Injected/);
+});
+
+test('a multi-range request is served whole rather than as multipart', async (t) => {
+  const app = mount(t, ({ init }) =>
+    upstreamResponse({
+      status: init?.headers?.Range ? 206 : 200,
+      headers: {
+        'content-type': init?.headers?.Range
+          ? 'multipart/byteranges; boundary=x'
+          : 'video/mp4',
+      },
+      body: 'whole body',
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, {
+    range: 'bytes=0-1,2-3',
+  });
+  assert.equal(app.requests.at(-1).headers.Range, undefined);
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['Content-Type'], 'video/mp4');
+});
+
+test('an upstream 416 is reported as the upstream status, not as a proxy error', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 416,
+      headers: { 'content-range': 'bytes */1024' },
+      body: null,
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, {
+    range: `bytes=${2 ** 40}-${2 ** 40 + 10}`,
+  });
+  assert.equal(res.statusCode, 416);
+  assert.match(res.body, /416/);
+  const entry = await app.health();
+  assert.equal(entry.status, 'degraded');
+  assert.equal(entry.message, 'Upstream HTTP 416');
+});
+
+test('an upstream that ignores the range still serves its whole body', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 200,
+      headers: { 'content-type': 'video/mp4', 'content-length': '10' },
+      body: 'whole body',
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, { range: 'bytes=0-1023' });
+  assert.equal(app.requests.at(-1).headers.Range, 'bytes=0-1023');
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.body, 'whole body');
+});
+
+test('an oversized declared body is refused even when a bounded range asked for it', async (t) => {
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 206,
+      headers: {
+        'content-type': 'video/mp4',
+        'content-length': String(CAP + 1),
+      },
+      body: 'too big',
+    }),
+  );
+  const res = await app.call(`/media/${CAMERA.id}`, { range: 'bytes=0-1023' });
+  assert.equal(res.statusCode, 502);
+  assert.match(res.body, /exceeds size cap/);
+});
+
+test('a client that disconnects mid-stream stops the upstream read', async (t) => {
+  // A live feed with no end of its own, counting what it is asked to produce.
+  let produced = 0;
+  let stopped = false;
+  const endlessBody = () =>
+    Readable.toWeb(
+      Readable.from(
+        (async function* () {
+          try {
+            for (;;) {
+              produced += 1;
+              yield Buffer.from('frame-chunk-');
+              await new Promise((resolve) => setTimeout(resolve, 10));
+            }
+          } finally {
+            stopped = true;
+          }
+        })(),
+      ),
+    );
+  const app = mount(t, () => ({
+    ok: true,
+    status: 206,
+    headers: {
+      get: (name) =>
+        String(name).toLowerCase() === 'content-type' ? 'video/mp4' : null,
+    },
+    body: endlessBody(),
+    arrayBuffer: async () => Buffer.alloc(0),
+  }));
+
+  const server = http.createServer((req, res) => {
+    req.url = req.url.replace('/api/cctv', '') || '/';
+    Promise.resolve(app.handler(req, res)).catch(() => {});
+  });
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+
+  const failures = [];
+  const onUncaught = (error) => failures.push(error);
+  process.on('uncaughtException', onUncaught);
+  t.after(() => process.off('uncaughtException', onUncaught));
+
+  await new Promise((resolve, reject) => {
+    const request = http.get(
+      {
+        host: '127.0.0.1',
+        port,
+        path: `/media/${CAMERA.id}`.replace(/^/, '/api/cctv'),
+        headers: { Range: 'bytes=0-1023' },
+      },
+      (response) => {
+        response.once('data', () => {
+          // Walk away mid-body, the way a browser does when the operator
+          // switches camera.
+          request.destroy();
+          resolve();
+        });
+        response.on('error', () => resolve());
+      },
+    );
+    request.on('error', reject);
+  });
+
+  await new Promise((resolve) => setTimeout(resolve, 150));
+  const afterDisconnect = produced;
+  await new Promise((resolve) => setTimeout(resolve, 400));
+  // The point: the camera host is no longer being read from. Without the
+  // release this counter keeps climbing for as long as the upstream will feed.
+  assert.equal(
+    produced,
+    afterDisconnect,
+    `the upstream was still being read after the client left (${afterDisconnect} → ${produced} chunks)`,
+  );
+  assert.equal(stopped, true, 'the upstream body was never released');
+  assert.deepEqual(
+    failures.map((error) => error?.message),
+    [],
+    'a client walking away must not fault the server',
+  );
+  const entry = await app.health();
+  // The camera was serving fine; the client left. Nothing about that is a
+  // camera fault other viewers should see.
+  assert.equal(entry.status, 'ok');
+});
+
+test('a client that leaves before the headers arrive cancels the upstream request', async (t) => {
+  // The camera is slow, or dead: nothing comes back until the request is
+  // cancelled. Everything worth testing here happens before any header.
+  let aborted = false;
+  const app = mount(t, ({ init }) => {
+    return new Promise((_resolve, reject) => {
+      init.signal.addEventListener('abort', () => {
+        aborted = true;
+        reject(Object.assign(new Error('aborted'), { name: 'AbortError' }));
+      });
+    });
+  });
+
+  const server = http.createServer((req, res) => {
+    req.url = req.url.replace('/api/cctv', '') || '/';
+    Promise.resolve(app.handler(req, res)).catch(() => {});
+  });
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+
+  const failures = [];
+  const onUncaught = (error) => failures.push(error);
+  process.on('uncaughtException', onUncaught);
+  t.after(() => process.off('uncaughtException', onUncaught));
+
+  const request = http.get({
+    host: '127.0.0.1',
+    port,
+    path: `/api/cctv/media/${CAMERA.id}`,
+    headers: { Range: 'bytes=0-1023' },
+  });
+  request.on('error', () => {});
+  // Let the route reach its upstream request, then walk away before it answers.
+  await new Promise((resolve) => setTimeout(resolve, 150));
+  assert.equal(app.requests.length, 1, 'the upstream request went out');
+  assert.equal(aborted, false, 'nothing was cancelled while the client waited');
+  request.destroy();
+  await new Promise((resolve) => setTimeout(resolve, 250));
+
+  assert.equal(aborted, true, 'the upstream request outlived the client');
+  assert.deepEqual(
+    failures.map((error) => error?.message),
+    [],
+    'a client leaving early must not fault the server',
+  );
+  // The camera did nothing wrong; the viewer left.
+  const entry = await app.health();
+  assert.notEqual(entry?.status, 'degraded');
+});
+
+test('a folded CR/LF range never reaches the upstream through a real client', async (t) => {
+  // Node's own parser, not a hand-built headers object, so the reachability of
+  // this shape through an ordinary HTTP request is shown rather than assumed.
+  const app = mount(t, () =>
+    upstreamResponse({
+      status: 200,
+      headers: { 'content-type': 'video/mp4' },
+      body: 'whole body',
+    }),
+  );
+  const server = http.createServer((req, res) => {
+    req.url = req.url.replace('/api/cctv', '') || '/';
+    Promise.resolve(app.handler(req, res)).catch(() => {});
+  });
+  t.after(() => new Promise((resolve) => server.close(resolve)));
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+
+  // A client can fold a value across a continuation line; Node's parser
+  // rejoins it, so what the route sees contains whitespace a header cannot
+  // carry back out.
+  const raw = await new Promise((resolve, reject) => {
+    const socket = net.connect(port, '127.0.0.1', () => {
+      socket.write(
+        `GET /api/cctv/media/${CAMERA.id} HTTP/1.1\r\n` +
+          'Host: 127.0.0.1\r\n' +
+          'Range: bytes=0-10\r\n\tX-Injected: 1\r\n' +
+          'Connection: close\r\n\r\n',
+      );
+    });
+    let text = '';
+    socket.on('data', (chunk) => {
+      text += chunk.toString('utf8');
+    });
+    socket.on('end', () => resolve(text));
+    socket.on('error', reject);
+  });
+
+  // Either Node's parser refuses the request outright, or it reaches the route
+  // and the route drops the value — but it must never be forwarded.
+  const reachedRoute = app.requests.length > 0;
+  assert.match(raw, /^HTTP\/1\.1 (200|400)/);
+  if (reachedRoute) {
+    assert.equal(
+      app.requests.at(-1).headers.Range,
+      undefined,
+      'nothing was forwarded',
+    );
+    assert.match(raw, /^HTTP\/1\.1 200/);
+  } else {
+    assert.match(raw, /^HTTP\/1\.1 400/);
+  }
+  console.log(
+    `    [range] folded CR/LF request ${reachedRoute ? 'reached the route and was dropped' : 'was refused by the HTTP parser'}`,
+  );
+  const entry = await app.health();
+  assert.doesNotMatch(JSON.stringify(entry ?? {}), /X-Injected/);
+});
+
+test('two sequential seeks are served as two partial responses', async (t) => {
+  const app = mount(t, ({ init }) => {
+    const range = init?.headers?.Range || '';
+    const [, first, last] = /bytes=(\d+)-(\d+)/.exec(range) || [];
+    return upstreamResponse({
+      status: 206,
+      headers: {
+        'content-type': 'video/mp4',
+        'content-range': `bytes ${first}-${last}/4096`,
+        'content-length': String(Number(last) - Number(first) + 1),
+        'accept-ranges': 'bytes',
+      },
+      body: `chunk-${first}`,
+    });
+  });
+  const first = await app.call(`/media/${CAMERA.id}`, { range: 'bytes=0-99' });
+  const second = await app.call(`/media/${CAMERA.id}`, {
+    range: 'bytes=100-199',
+  });
+  assert.equal(app.requests[0].headers.Range, 'bytes=0-99');
+  assert.equal(app.requests[1].headers.Range, 'bytes=100-199');
+  assert.equal(first.statusCode, 206);
+  assert.equal(second.statusCode, 206);
+  assert.equal(first.headers['Content-Range'], 'bytes 0-99/4096');
+  assert.equal(second.headers['Content-Range'], 'bytes 100-199/4096');
+  assert.equal(first.body, 'chunk-0');
+  assert.equal(second.body, 'chunk-100');
+});

From 8702458cf626629cf319f494a1f17b23025f3fb6 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:21:38 -0500
Subject: [PATCH 03/10] perf: subset the icon font and drop the unused second
 family (#513)

Supersedes #239 by @mml-studio, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: Memel <255658710+mml-studio@users.noreply.github.com>
---
 CHANGELOG.md                       |   9 +++
 index.html                         |   7 +-
 scripts/format-scope.json          |   3 +-
 src/materialSymbolsSubset.test.mjs | 111 +++++++++++++++++++++++++++++
 4 files changed, 127 insertions(+), 3 deletions(-)
 create mode 100644 src/materialSymbolsSubset.test.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41ba9bee0..a55642c7e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -292,6 +292,15 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 
 ### Changed
+
+- The interface asks Google Fonts for only the icon glyphs it draws, instead of
+  the whole variable icon font, and no longer requests a second icon family that
+  nothing renders. A check fails when a source names a glyph the request is
+  missing, because an absent glyph does not draw a placeholder — the element
+  renders the glyph's name as text. The check reads the panel templates as well
+  as the scripts, and reads glyph names written as literals, so a glyph chosen
+  through a variable has to be added to the request by hand. Contributed by
+  mml-studio (#239).
 - Separate explicit browser build settings from standalone environment loading
   and local provider middleware. Preserve provider behavior and root named exports.
 - Rename standalone browser startup to `src/standalone/` and add a Node-only
diff --git a/index.html b/index.html
index 4ab989de7..2e630c4a8 100644
--- a/index.html
+++ b/index.html
@@ -9,8 +9,11 @@
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
   <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@300;400;500;600;700&family=Inter:wght@300;400;500;600&display=swap" rel="stylesheet" />
-  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,400,0,0" rel="stylesheet" />
-  <link href="https://fonts.googleapis.com/icon?family=Material+Icons+Round" rel="stylesheet" />
+  <!-- Icon font subset to the glyphs this app renders. Keep `icon_names` in sync
+       with the sources: src/materialSymbolsSubset.test.mjs fails when a source
+       names a glyph this list is missing, because a missing glyph does not draw
+       a box — the ligature never forms and the element renders the literal word. -->
+  <link href="https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@20,400,0,0&icon_names=adjust,arrow_drop_down,arrow_forward,arrow_left,arrow_right,bolt,chevron_left,chevron_right,close,close_fullscreen,dark_mode,draw,east,flare,flight,layers_clear,light_mode,local_fire_department,my_location,navigation,normal,on,open_in_full,public,radar,radio,right_panel_close,right_panel_open,rocket_launch,skip_next,skip_previous,view_in_ar" rel="stylesheet" />
 </head>
 <body>
   <!-- gev:template scene-chrome -->
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 41dfb629b..7c192c15e 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -614,5 +614,6 @@
   "src/layers/vessels/ingestion.test.mjs",
   "src/cityPresets.test.mjs",
   "server/providers/cctv/range.js",
-  "src/data/cctvMediaRange.test.mjs"
+  "src/data/cctvMediaRange.test.mjs",
+  "src/materialSymbolsSubset.test.mjs"
 ]
diff --git a/src/materialSymbolsSubset.test.mjs b/src/materialSymbolsSubset.test.mjs
new file mode 100644
index 000000000..ec9ffe2f0
--- /dev/null
+++ b/src/materialSymbolsSubset.test.mjs
@@ -0,0 +1,111 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SRC_ROOT = fileURLToPath(new URL('.', import.meta.url));
+const REPO_ROOT = path.resolve(SRC_ROOT, '..');
+const INDEX_HTML = path.join(REPO_ROOT, 'index.html');
+
+/** The glyph written as element text: `<span class="material-symbols-outlined">radar</span>`. */
+const SPAN_TEXT =
+  /class="[^"]*material-symbols-outlined[^"]*"[^>]*>\s*([a-z0-9_]+)\s*</g;
+/** A whole `textContent =` statement, across lines, so a multi-line ternary is read once. */
+const TEXT_ASSIGNMENT = /(?:textContent|innerText)\s*=\s*([^;]{0,400})/gs;
+const STRING_LITERAL = /['"`]([a-z0-9_]{2,})['"`]/g;
+
+/**
+ * Files that SHIP markup. Tests assert on markup, they do not render it.
+ *
+ * The panel markup lives in `src/ui/templates/*.html`, so HTML under `src` is
+ * read as well: a glyph named only in a template is still a glyph the font has
+ * to carry.
+ */
+function sourceFiles(directory = SRC_ROOT) {
+  const files = [];
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    const absolute = path.join(directory, entry.name);
+    if (entry.isDirectory()) files.push(...sourceFiles(absolute));
+    else if (
+      entry.isFile() &&
+      /\.(js|mjs|html)$/.test(entry.name) &&
+      !entry.name.endsWith('.test.mjs')
+    ) {
+      files.push(absolute);
+    }
+  }
+  return [...files.sort(), INDEX_HTML];
+}
+
+/**
+ * Glyph names the sources ask the icon font for.
+ *
+ * Errs WIDE on purpose. A name the font does not carry costs nothing — Google
+ * ignores an unknown `icon_names` entry and still returns 200 — while a glyph
+ * the subset is missing breaks the interface SILENTLY: the ligature never
+ * forms, so the element renders the literal word `right_panel_open` instead of
+ * falling back to a visible box.
+ *
+ * A literal to the LEFT of a `?` is the condition being tested, not the text
+ * being shown, so it is dropped: `status === 'loading' ? …` must not enrol
+ * `loading`. Optional chaining is neutralised first — `payload?.newsStatus`
+ * is not a ternary, and splitting on its `?` would keep the condition.
+ * @returns {Map<string, string>} glyph -> the first file that names it.
+ */
+function referencedGlyphs() {
+  const found = new Map();
+  for (const file of sourceFiles()) {
+    const source = readFileSync(file, 'utf8');
+    const relative = path.relative(REPO_ROOT, file).split(path.sep).join('/');
+    const add = (glyph) => {
+      if (!found.has(glyph)) found.set(glyph, relative);
+    };
+    for (const match of source.matchAll(SPAN_TEXT)) add(match[1]);
+    for (const match of source.matchAll(TEXT_ASSIGNMENT)) {
+      const statement = match[1].replaceAll('?.', '.');
+      const assigned = statement.includes('?')
+        ? statement.slice(statement.indexOf('?') + 1)
+        : statement;
+      for (const literal of assigned.matchAll(STRING_LITERAL)) add(literal[1]);
+    }
+  }
+  return found;
+}
+
+/** The `icon_names` list index.html asks Google for. */
+function subsettedGlyphs(html = readFileSync(INDEX_HTML, 'utf8')) {
+  const match =
+    /Material\+Symbols\+Outlined[^"]*[?&]icon_names=([a-z0-9_,]+)/.exec(html);
+  assert.ok(
+    match,
+    'index.html must request Material Symbols with an icon_names subset',
+  );
+  return new Set(match[1].split(','));
+}
+
+test('every glyph the sources render is in the icon_names subset', () => {
+  const subset = subsettedGlyphs();
+  const missing = [...referencedGlyphs()]
+    .filter(([glyph]) => !subset.has(glyph))
+    .map(([glyph, file]) => `${glyph} (${file})`);
+
+  assert.deepEqual(
+    missing,
+    [],
+    'Glyphs named by the sources but absent from the index.html icon_names list. ' +
+      'Add them there — an unlisted glyph renders as its own name on screen: ' +
+      missing.join(', '),
+  );
+});
+
+test('the unused Material Icons Round family is not loaded', () => {
+  // A second icon font, 173 kB, for a family no source ever uses — and
+  // src/cockpitMarkup.test.mjs already asserts the markup must not use it.
+  const html = readFileSync(INDEX_HTML, 'utf8');
+  assert.doesNotMatch(
+    html,
+    /Material\+Icons\+Round/,
+    'index.html loads an icon font nothing renders',
+  );
+});

From 1c9a55e2f994829b869b99576506096addf82681 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:26:19 -0500
Subject: [PATCH 04/10] docs: drop two retired CCTV client flags from the env
 template (#503)

Supersedes #283 by @dajiaohuang, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: dajiaohuang <mikewushuwen@outlook.com>
---
 .env.example | 2 --
 CHANGELOG.md | 3 +++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index 1a8830ed0..e537dfb16 100644
--- a/.env.example
+++ b/.env.example
@@ -171,5 +171,3 @@ AISSTREAM_API_KEY=
 # CCTV_MAX_SOURCES=4000                                # catalog-wide ceiling, shared round-robin across packs
 # CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
 # CCTV_FORCE_AUSTIN=                                   # force live default sources when a source-pack JSON is configured
-# CCTV_AUTO_CALIBRATE=1                                # auto-calibrate camera projection (client flag)
-# CCTV_DRAPE_MESH=1                                    # drape frames onto 3D geometry (client flag)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a55642c7e..556c5349a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -328,6 +328,9 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   whoever adds the next destination; it passes on the current entries and makes
   no claim about how well any destination is framed. Contributed by daikaginza
   (#168).
+- Drop `CCTV_AUTO_CALIBRATE` and `CCTV_DRAPE_MESH` from `.env.example`. Nothing
+  reads either name; the features they once switched no longer exist, so setting
+  them did nothing. Contributed by dajiaohuang (#283).
 
 - Extract application lifecycle and viewer exports. Split standalone startup into
   scene setup, controls, layer registration, tools and loading UI. Startup failure

From b00f8353411708e053b9866010304d5a103a7a66 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:29:45 -0500
Subject: [PATCH 05/10] ci: pin GitHub Actions to commit SHAs (#505)

Supersedes #309 by @SurefireStudios, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: SurefireStudios <123013554+SurefireStudios@users.noreply.github.com>
---
 .github/workflows/ci.yml | 8 ++++----
 CHANGELOG.md             | 4 ++++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 167ea65a8..8c1677b25 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,12 +26,12 @@ jobs:
       GEV_REQUIRE_ALLOCATION_GATE: ${{ matrix.node == '24.14.0' && '1' || '0' }}
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
@@ -63,12 +63,12 @@ jobs:
       GEV_REQUIRE_ALLOCATION_GATE: '0'
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24.14.0
           cache: npm
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 556c5349a..a5a229e13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -229,6 +229,10 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   part-way through the picture, the upstream request is cancelled rather than
   left running, and neither case marks the camera degraded. Ordinary seeking is
   unaffected. Contributed by Maher-Reven (#253).
+- CI pins `actions/checkout` and `actions/setup-node` to the commits their
+  `v4.4.0` tags name, so a repointed tag cannot change what runs in CI. The
+  version stays in a trailing comment, and moving to a later release is a
+  deliberate edit. Contributed by SurefireStudios (#309).
 
 - Validate configured Google Places coordinates and text queries before rate
   limiting or upstream requests; preserve the keyless capability response.

From 70dca86bc11c483289ada854d0bbd16b87d87885 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:34:23 -0500
Subject: [PATCH 06/10] fix(pinokio): disclose incoming changes before Update
 pulls and installs (#507)

Supersedes #356 by @Lob26, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: Pedro Lobato <69770518+Lob26@users.noreply.github.com>
---
 CHANGELOG.md                      |  10 +
 scripts/format-scope.json         |   4 +-
 scripts/pinokio-update.mjs        | 240 +++++++++++++++-
 src/pinokioUpdatePreview.test.mjs | 447 ++++++++++++++++++++++++++++++
 4 files changed, 697 insertions(+), 4 deletions(-)
 create mode 100644 src/pinokioUpdatePreview.test.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5a229e13..790aa2740 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -253,6 +253,16 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   last good picture kept after a failed refresh — and the one feature that sends
   imagery anywhere: the voice assistant's viewport screenshot. Contributed by
   Lob26 (#357).
+- Pinokio's Update shows what it is about to install before it installs it: the
+  tracking branch, the remote it fetched from, the incoming commits and their
+  diffstat. The remote is printed as host and path — a password or token in the
+  URL's user field is replaced and any query string dropped, though a secret
+  spelled as an ordinary path segment cannot be told from a repository name. It
+  fetches once and applies exactly the revision it named, so a commit that lands
+  mid-update cannot be installed unannounced. A git read it cannot complete is
+  reported as such instead of as "already up to date", and if the revision to
+  apply cannot be resolved at all the update stops without installing anything
+  and exits unsuccessfully. Contributed by Lob26 (#356).
 
 - Extract panel disclosure and hover/focus controls into a reusable module;
   cancel their listeners and pending work during replacement and teardown.
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 7c192c15e..10a18fd63 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -615,5 +615,7 @@
   "src/cityPresets.test.mjs",
   "server/providers/cctv/range.js",
   "src/data/cctvMediaRange.test.mjs",
-  "src/materialSymbolsSubset.test.mjs"
+  "src/materialSymbolsSubset.test.mjs",
+  "scripts/pinokio-update.mjs",
+  "src/pinokioUpdatePreview.test.mjs"
 ]
diff --git a/scripts/pinokio-update.mjs b/scripts/pinokio-update.mjs
index 22d19b886..1259179c7 100644
--- a/scripts/pinokio-update.mjs
+++ b/scripts/pinokio-update.mjs
@@ -1,5 +1,239 @@
 #!/usr/bin/env node
-import { installPinokioDependencies, runChecked } from './pinokio-install.mjs';
+/**
+ * Pinokio "Update": disclose what is about to land, then fast-forward and reinstall.
+ *
+ * Update is a fixed menu item aimed at people who only want to run the app, and
+ * it executes install scripts from whatever the configured remote serves. It
+ * cannot ask for confirmation — Pinokio drives it non-interactively — so the
+ * safety it can offer is disclosure: fetch once, print the remote it fetched
+ * from plus the incoming commits and their diffstat, and then apply that exact
+ * revision. Someone who sees an unfamiliar remote or an unexpected set of
+ * commits can close the window before any install script runs.
+ *
+ * @module scripts/pinokio-update
+ */
+import { realpathSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  installPinokioDependencies,
+  isDirectInvocation,
+  runChecked,
+} from './pinokio-install.mjs';
 
-runChecked('git', ['pull', '--ff-only']);
-installPinokioDependencies();
+const MODULE_PATH = fileURLToPath(import.meta.url);
+const ROOT = realpathSync(path.resolve(path.dirname(MODULE_PATH), '..'));
+
+/**
+ * Read a git value.
+ *
+ * @param {string[]} args - git arguments.
+ * @param {object} [options]
+ * @param {string} [options.cwd] - Repository to read.
+ * @returns {string|null} Trimmed stdout, `''` when git succeeded with no
+ *   output, or null when git failed (no upstream, detached HEAD, not a
+ *   checkout). Callers must keep those two apart: an empty range and an
+ *   unreadable one mean very different things to someone about to install.
+ */
+export function readGit(args, { cwd = ROOT } = {}) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (result.error || result.status !== 0) return null;
+  return result.stdout.trim();
+}
+
+/**
+ * Remove credentials from a remote URL before it is printed.
+ *
+ * A remote can carry a password or an access token in its userinfo
+ * (`https://token@host/org/repo.git`) or in a query parameter
+ * (`?access_token=…`). The point of printing the remote is to show WHERE the
+ * update comes from, which the host and path already say — so the userinfo is
+ * replaced and the query string and fragment are dropped whole, rather than
+ * matched against a list of parameter names that would miss the next one.
+ *
+ * A secret spelled as an ordinary path segment is not detected; nothing here
+ * can tell one of those from a repository name.
+ *
+ * @param {string|null|undefined} url - Remote URL as git reports it.
+ * @returns {string|null} Printable URL, or null when there is nothing to print.
+ */
+export function redactRemoteUrl(url) {
+  if (typeof url !== 'string' || url.length === 0) return null;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    // Not a URL: scp-style `git@host:org/repo.git`, or a local path. Neither
+    // has a userinfo field to hide.
+    return url;
+  }
+  const hadUserinfo = Boolean(parsed.username || parsed.password);
+  const hadQuery = Boolean(parsed.search || parsed.hash);
+  if (!hadUserinfo && !hadQuery) return url;
+  parsed.password = '';
+  if (hadUserinfo) parsed.username = '***';
+  parsed.search = '';
+  parsed.hash = '';
+  return parsed.toString();
+}
+
+/**
+ * Print the remote, the commits about to be applied, and their diffstat.
+ *
+ * @param {object} [io] - Injection seam for tests.
+ * @param {string} [io.cwd] - Repository to inspect.
+ * @param {(line: string) => void} [io.log] - Normal output.
+ * @param {(line: string) => void} [io.warn] - Degraded-path output.
+ * @param {(remote: string) => void} [io.fetchRemote] - Fetch step; throws or
+ *   exits on failure, because a report built on a stale remote ref describes
+ *   the wrong changes.
+ * @param {(args: string[]) => (string|null)} [io.read] - git reader.
+ * @returns {{apply: string|null, fallback: boolean, stopped?: boolean}}
+ *   `apply` is the exact revision that was disclosed and must now be applied.
+ *   `fallback` asks the caller to run the plain pull so git itself reports
+ *   whatever went wrong, and is only ever set before anything has been fetched.
+ *   `stopped` means the update gave up: nothing can be shown, so nothing is
+ *   applied.
+ */
+export function reportIncomingChanges(io = {}) {
+  const {
+    cwd = ROOT,
+    log = (line) => console.log(line),
+    warn = (line) => console.warn(line),
+    fetchRemote = (remote) => runChecked('git', ['fetch', '--quiet', remote]),
+    read = (args) => readGit(args, { cwd }),
+  } = io;
+
+  const upstream = read([
+    'rev-parse',
+    '--abbrev-ref',
+    '--symbolic-full-name',
+    '@{u}',
+  ]);
+  // The full ref name is what later reads resolve, so a remote whose own name
+  // contains a slash (`team/origin`) cannot be mistaken for a path segment.
+  const upstreamRef = read(['rev-parse', '--symbolic-full-name', '@{u}']);
+  const branch = read(['rev-parse', '--abbrev-ref', 'HEAD']);
+  const remote =
+    branch && branch !== 'HEAD'
+      ? read(['config', '--get', `branch.${branch}.remote`])
+      : null;
+  if (!upstream || !upstreamRef || !remote) {
+    warn('[update] No upstream branch is configured — cannot preview changes.');
+    warn('[update] Continuing; `git pull --ff-only` will report the problem.');
+    return { apply: null, fallback: true };
+  }
+
+  log(`[update] Tracking ${upstream}`);
+  if (remote === '.') {
+    // The upstream is another branch in this same checkout; there is nothing
+    // to fetch and no remote URL to disclose.
+    log('[update] Upstream is a local branch — nothing to fetch.');
+  } else {
+    const url = redactRemoteUrl(read(['remote', 'get-url', remote]));
+    log(`[update] Fetching from ${url || remote}`);
+    // Fetch once, here. Everything below describes and then applies the
+    // revision this fetch brought in; a second fetch inside `git pull` could
+    // apply something newer than what was printed.
+    fetchRemote(remote);
+  }
+
+  const target = read(['rev-parse', upstreamRef]);
+  const head = read(['rev-parse', 'HEAD']);
+  if (!target || !head) {
+    // Stop. Falling through to `git pull` here would fetch a second time and
+    // could install a revision this run never resolved, let alone disclosed.
+    warn(`[update] Could not resolve ${upstream} after fetching.`);
+    warn(
+      '[update] Stopping: nothing is applied, because nothing can be shown.',
+    );
+    return { apply: null, fallback: false, stopped: true };
+  }
+  if (target === head) {
+    log('[update] Already up to date — reinstalling dependencies only.');
+    return { apply: null, fallback: false };
+  }
+
+  const commits = read([
+    'log',
+    '--oneline',
+    '--no-decorate',
+    `${head}..${target}`,
+  ]);
+  if (commits === null) {
+    // A read that failed is not an empty range. Saying "up to date" here would
+    // tell someone nothing is arriving while a revision is about to be applied.
+    warn(`[update] Could not list the commits in ${head}..${target}.`);
+    warn(
+      `[update] Applying ${target} anyway; it is the revision that was fetched.`,
+    );
+    return { apply: target, fallback: false };
+  }
+
+  const lines = commits.length > 0 ? commits.split('\n') : [];
+  if (lines.length > 0) {
+    log(`\n[update] ${lines.length} incoming commit(s):`);
+    for (const line of lines) log(`  ${line}`);
+  } else {
+    log(
+      `\n[update] ${upstream} is at ${target}, which is not ahead of this checkout.`,
+    );
+  }
+
+  const stat = read(['diff', '--stat', `${head}..${target}`]);
+  if (stat === null) {
+    warn(`[update] Could not read the diffstat for ${head}..${target}.`);
+  } else if (stat) {
+    log('\n[update] Files affected:');
+    for (const line of stat.split('\n')) log(`  ${line}`);
+  }
+  log(`\n[update] Applying ${target}, then reinstalling dependencies.\n`);
+  return { apply: target, fallback: false };
+}
+
+/**
+ * Disclose, then apply exactly what was disclosed.
+ *
+ * @param {object} [io] - Same seam as {@link reportIncomingChanges}, plus
+ *   `apply`, which runs one git command and must fail loudly.
+ * @returns {{apply: string|null, fallback: boolean}} What the report decided.
+ */
+export function updateFromRemote(io = {}) {
+  const { apply = (args) => runChecked('git', args) } = io;
+  const plan = reportIncomingChanges(io);
+  // `merge --ff-only <revision>` applies the object the report named. A second
+  // `pull` would fetch again and could land a different one.
+  if (plan.apply) apply(['merge', '--ff-only', plan.apply]);
+  else if (plan.fallback) apply(['pull', '--ff-only']);
+  return plan;
+}
+
+/**
+ * What running this script does: disclose, apply, install.
+ *
+ * @param {object} [io] - The seam above, plus `install` and `fail`.
+ * @returns {{apply: string|null, fallback: boolean, stopped?: boolean}} The plan.
+ */
+export function runPinokioUpdate(io = {}) {
+  const {
+    install = installPinokioDependencies,
+    fail = (code) => process.exit(code),
+  } = io;
+  const plan = updateFromRemote(io);
+  if (plan.stopped) {
+    // Nothing could be shown, so nothing was applied. Reinstalling now would
+    // run install scripts under the banner of an update that did not happen,
+    // and report success for it.
+    fail(1);
+    return plan;
+  }
+  install();
+  return plan;
+}
+
+// Guarded like pinokio-start.mjs so the report above can be exercised without
+// pulling and reinstalling as an import side effect.
+if (isDirectInvocation(process.argv[1], MODULE_PATH)) {
+  runPinokioUpdate();
+}
diff --git a/src/pinokioUpdatePreview.test.mjs b/src/pinokioUpdatePreview.test.mjs
new file mode 100644
index 000000000..ca3cc7688
--- /dev/null
+++ b/src/pinokioUpdatePreview.test.mjs
@@ -0,0 +1,447 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync, writeFileSync } from 'node:fs';
+import { mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import {
+  readGit,
+  redactRemoteUrl,
+  reportIncomingChanges,
+  runPinokioUpdate,
+  updateFromRemote,
+} from '../scripts/pinokio-update.mjs';
+
+const source = readFileSync(
+  new URL('../scripts/pinokio-update.mjs', import.meta.url),
+  'utf8',
+);
+
+/** Run git in a fixture repository, failing the test on a git error. */
+function git(cwd, args) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  assert.equal(
+    result.status,
+    0,
+    `git ${args.join(' ')} failed: ${result.stderr || result.error}`,
+  );
+  return result.stdout.trim();
+}
+
+/** Escape a path so it can be matched literally inside a RegExp. */
+const literal = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/**
+ * Build a disposable origin repository and a clone that tracks it.
+ *
+ * Everything is on disk and driven through real git, so the assertions are
+ * about what the update path does to a checkout rather than about a transcript
+ * of injected strings.
+ *
+ * @param {import('node:test').TestContext} t - Owns the fixture's cleanup.
+ */
+async function fixture(t) {
+  const scratch = await realpath(
+    await mkdtemp(path.join(tmpdir(), 'gev-update-')),
+  );
+  t.after(() => rm(scratch, { recursive: true, force: true }));
+  const origin = path.join(scratch, 'origin');
+  const clone = path.join(scratch, 'clone');
+
+  git(scratch, ['init', '--quiet', '--initial-branch=main', origin]);
+  git(origin, ['config', 'user.email', 'fixture@example.invalid']);
+  git(origin, ['config', 'user.name', 'Fixture']);
+  await writeFile(path.join(origin, 'README.md'), 'first\n');
+  git(origin, ['add', 'README.md']);
+  git(origin, ['commit', '--quiet', '-m', 'first commit']);
+
+  git(scratch, ['clone', '--quiet', origin, clone]);
+  git(clone, ['config', 'user.email', 'fixture@example.invalid']);
+  git(clone, ['config', 'user.name', 'Fixture']);
+
+  /** Add one commit to the origin repository. */
+  const push = async (message, contents) => {
+    await writeFile(path.join(origin, 'README.md'), contents);
+    git(origin, ['add', 'README.md']);
+    git(origin, ['commit', '--quiet', '-m', message]);
+    return git(origin, ['rev-parse', 'HEAD']);
+  };
+
+  /** Same, from a synchronous callback (used to move the remote mid-update). */
+  const pushSync = (message, contents) => {
+    writeFileSync(path.join(origin, 'README.md'), contents);
+    git(origin, ['add', 'README.md']);
+    git(origin, ['commit', '--quiet', '-m', message]);
+    return git(origin, ['rev-parse', 'HEAD']);
+  };
+
+  const out = [];
+  const io = {
+    cwd: clone,
+    log: (line) => out.push(String(line)),
+    warn: (line) => out.push(String(line)),
+    fetchRemote: (remote) => git(clone, ['fetch', '--quiet', remote]),
+    apply: (args) => git(clone, args),
+  };
+
+  return {
+    scratch,
+    origin,
+    clone,
+    push,
+    pushSync,
+    io,
+    out,
+    text: () => out.join('\n'),
+  };
+}
+
+test('a checkout with no upstream is reported and left to the plain pull', async (t) => {
+  const app = await fixture(t);
+  git(app.clone, ['checkout', '--quiet', '-b', 'local-only']);
+  let fetched = null;
+  const plan = reportIncomingChanges({
+    ...app.io,
+    fetchRemote: (remote) => {
+      fetched = remote;
+    },
+  });
+  assert.deepEqual(plan, { apply: null, fallback: true });
+  assert.match(app.text(), /No upstream branch is configured/);
+  assert.equal(fetched, null, 'nothing is fetched without an upstream');
+});
+
+test('the tracking branch and the remote it fetches from are printed', async (t) => {
+  const app = await fixture(t);
+  await app.push('second commit', 'second\n');
+  reportIncomingChanges(app.io);
+  assert.match(app.text(), /Tracking origin\/main/);
+  assert.match(app.text(), new RegExp(`Fetching from ${literal(app.origin)}`));
+});
+
+test('the incoming commits and their diffstat are printed, and the report alone applies nothing', async (t) => {
+  const app = await fixture(t);
+  const before = git(app.clone, ['rev-parse', 'HEAD']);
+  await app.push('second commit', 'second\n');
+  await app.push('third commit', 'third\n');
+  const plan = reportIncomingChanges(app.io);
+  const text = app.text();
+  assert.match(text, /2 incoming commit\(s\)/);
+  assert.match(text, /second commit/);
+  assert.match(text, /third commit/);
+  assert.match(text, /README\.md \| 2 \+-/);
+  assert.equal(plan.fallback, false);
+  assert.equal(
+    git(app.clone, ['rev-parse', 'HEAD']),
+    before,
+    'the report must not move the checkout',
+  );
+});
+
+test('the revision that is applied is the revision that was disclosed', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  const plan = reportIncomingChanges(app.io);
+  // Something lands on the remote between the disclosure and the apply. A
+  // second fetch would install it without ever naming it.
+  await app.push('a commit nobody was shown', 'fourth\n');
+  assert.equal(plan.apply, disclosed);
+  app.io.apply(['merge', '--ff-only', plan.apply]);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), disclosed);
+  assert.match(app.text(), new RegExp(`Applying ${disclosed}`));
+});
+
+test('the whole update applies exactly one disclosed revision', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  const plan = updateFromRemote(app.io);
+  assert.equal(plan.apply, disclosed);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), disclosed);
+});
+
+test('a remote that moves during the update does not change what is applied', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  let later = null;
+  const plan = updateFromRemote({
+    ...app.io,
+    fetchRemote: (remote) => {
+      git(app.clone, ['fetch', '--quiet', remote]);
+      // The remote gains a commit after the one fetch this update makes. Only
+      // a second fetch — which there must not be — could reach it.
+      later = app.pushSync('a commit nobody was shown', 'fourth\n');
+    },
+  });
+  assert.equal(plan.apply, disclosed);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), disclosed);
+  assert.notEqual(git(app.clone, ['rev-parse', 'HEAD']), later);
+});
+
+test('an up-to-date checkout says so and applies nothing', async (t) => {
+  const app = await fixture(t);
+  const before = git(app.clone, ['rev-parse', 'HEAD']);
+  const plan = updateFromRemote(app.io);
+  assert.deepEqual(plan, { apply: null, fallback: false });
+  assert.match(app.text(), /Already up to date/);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), before);
+});
+
+test('an unreadable commit range is reported as unreadable, not as up to date', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  const plan = reportIncomingChanges({
+    ...app.io,
+    read: (args) =>
+      args[0] === 'log' ? null : readGit(args, { cwd: app.clone }),
+  });
+  const text = app.text();
+  assert.doesNotMatch(text, /Already up to date/);
+  assert.match(text, /Could not list the commits/);
+  assert.equal(plan.apply, disclosed, 'the fetched revision is still applied');
+});
+
+test('an upstream that cannot be resolved after fetching stops the update', async (t) => {
+  const app = await fixture(t);
+  const before = git(app.clone, ['rev-parse', 'HEAD']);
+  await app.push('second commit', 'second\n');
+  const plan = updateFromRemote({
+    ...app.io,
+    // The target ref resolves to nothing after the fetch — a tracking ref
+    // pruned out from under the run.
+    read: (args) =>
+      args[0] === 'rev-parse' &&
+      args.length === 2 &&
+      args[1].startsWith('refs/')
+        ? null
+        : readGit(args, { cwd: app.clone }),
+  });
+  assert.deepEqual(plan, { apply: null, fallback: false, stopped: true });
+  assert.doesNotMatch(app.text(), /Already up to date/);
+  assert.match(app.text(), /Could not resolve origin\/main after fetching/);
+  assert.match(app.text(), /Stopping/);
+  // Nothing may be applied: a fallback pull here would fetch again and could
+  // install a revision this run never resolved.
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), before);
+});
+
+test('a remote whose name contains a slash is read correctly', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  git(app.clone, ['remote', 'rename', 'origin', 'team/origin']);
+  git(app.clone, ['fetch', '--quiet', 'team/origin']);
+  git(app.clone, ['branch', '--set-upstream-to=team/origin/main', 'main']);
+  const plan = updateFromRemote({
+    ...app.io,
+    fetchRemote: (remote) => {
+      assert.equal(remote, 'team/origin');
+      git(app.clone, ['fetch', '--quiet', remote]);
+    },
+  });
+  assert.equal(plan.apply, disclosed);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), disclosed);
+  assert.match(app.text(), new RegExp(`Fetching from ${literal(app.origin)}`));
+});
+
+test('a diffstat that cannot be read is reported, and the commits still are', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  const plan = reportIncomingChanges({
+    ...app.io,
+    read: (args) =>
+      args[0] === 'diff' ? null : readGit(args, { cwd: app.clone }),
+  });
+  assert.equal(plan.apply, disclosed);
+  assert.match(app.text(), /1 incoming commit\(s\)/);
+  assert.match(app.text(), /Could not read the diffstat/);
+  assert.doesNotMatch(app.text(), /Files affected/);
+});
+
+test('diverged history is refused rather than applied', async (t) => {
+  const app = await fixture(t);
+  await app.push('second commit', 'second\n');
+  await writeFile(path.join(app.clone, 'README.md'), 'local work\n');
+  git(app.clone, ['add', 'README.md']);
+  git(app.clone, ['commit', '--quiet', '-m', 'local commit']);
+  const before = git(app.clone, ['rev-parse', 'HEAD']);
+  const plan = reportIncomingChanges(app.io);
+  const refused = spawnSync('git', ['merge', '--ff-only', plan.apply], {
+    cwd: app.clone,
+    encoding: 'utf8',
+  });
+  assert.notEqual(refused.status, 0, 'a fast-forward-only merge must refuse');
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), before);
+});
+
+test('a remote that is behind this checkout is named, not announced as incoming', async (t) => {
+  const app = await fixture(t);
+  await writeFile(path.join(app.clone, 'README.md'), 'ahead\n');
+  git(app.clone, ['add', 'README.md']);
+  git(app.clone, ['commit', '--quiet', '-m', 'local commit']);
+  const plan = reportIncomingChanges(app.io);
+  assert.match(app.text(), /is not ahead of this checkout/);
+  assert.doesNotMatch(app.text(), /incoming commit/);
+  assert.ok(plan.apply, 'the fetched revision is still named');
+});
+
+test('a stop means nothing is installed, and the script fails', async (t) => {
+  const app = await fixture(t);
+  const before = git(app.clone, ['rev-parse', 'HEAD']);
+  await app.push('second commit', 'second\n');
+  const installs = [];
+  const failures = [];
+  const plan = runPinokioUpdate({
+    ...app.io,
+    read: (args) =>
+      args[0] === 'rev-parse' &&
+      args.length === 2 &&
+      args[1].startsWith('refs/')
+        ? null
+        : readGit(args, { cwd: app.clone }),
+    install: () => installs.push('install'),
+    fail: (code) => failures.push(code),
+  });
+  assert.equal(plan.stopped, true);
+  // Installing here would run install scripts and report success for an update
+  // that never happened.
+  assert.deepEqual(installs, []);
+  assert.deepEqual(failures, [1]);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), before);
+});
+
+test('an ordinary update installs once and does not fail', async (t) => {
+  const app = await fixture(t);
+  const disclosed = await app.push('second commit', 'second\n');
+  const installs = [];
+  const failures = [];
+  const plan = runPinokioUpdate({
+    ...app.io,
+    install: () => installs.push('install'),
+    fail: (code) => failures.push(code),
+  });
+  assert.equal(plan.apply, disclosed);
+  assert.equal(git(app.clone, ['rev-parse', 'HEAD']), disclosed);
+  assert.deepEqual(installs, ['install']);
+  assert.deepEqual(failures, []);
+});
+
+test('an up-to-date checkout still reinstalls', async (t) => {
+  const app = await fixture(t);
+  const installs = [];
+  const plan = runPinokioUpdate({
+    ...app.io,
+    install: () => installs.push('install'),
+    fail: () => assert.fail('an up-to-date checkout is not a failure'),
+  });
+  assert.deepEqual(plan, { apply: null, fallback: false });
+  assert.deepEqual(installs, ['install']);
+});
+
+test('the entrypoint is what the direct invocation runs', () => {
+  const guarded = source.slice(source.indexOf('if (isDirectInvocation('));
+  assert.match(guarded, /runPinokioUpdate\(\);/);
+  // The install must not sit beside it in the guard, where a stop could not
+  // prevent it.
+  assert.doesNotMatch(guarded, /installPinokioDependencies\(\)/);
+});
+
+test('a password in the remote URL is not printed', () => {
+  assert.equal(
+    redactRemoteUrl('https://someone:ghp_secret@github.com/org/repo.git'),
+    'https://***@github.com/org/repo.git',
+  );
+});
+
+test('a bare token in the remote URL is not printed', () => {
+  const redacted = redactRemoteUrl(
+    'https://ghp_secret@github.com/org/repo.git',
+  );
+  assert.doesNotMatch(redacted, /ghp_secret/);
+  assert.match(redacted, /github\.com\/org\/repo\.git/);
+});
+
+test('a credential in a query parameter is not printed', () => {
+  assert.equal(
+    redactRemoteUrl('https://host.example/org/repo.git?access_token=secret'),
+    'https://host.example/org/repo.git',
+  );
+  // The whole query goes, so a parameter name nobody thought of goes with it.
+  assert.equal(
+    redactRemoteUrl('https://host.example/org/repo.git?sneaky=secret&x=1#frag'),
+    'https://host.example/org/repo.git',
+  );
+  assert.equal(
+    redactRemoteUrl('https://user:pw@host.example/org/repo.git?token=secret'),
+    'https://***@host.example/org/repo.git',
+  );
+});
+
+test('an ordinary remote URL is printed unchanged', () => {
+  const url = 'https://github.com/bilawalsidhu/gods-eye-view.git';
+  assert.equal(redactRemoteUrl(url), url);
+  assert.equal(
+    redactRemoteUrl('git@github.com:bilawalsidhu/gods-eye-view.git'),
+    'git@github.com:bilawalsidhu/gods-eye-view.git',
+  );
+  assert.equal(redactRemoteUrl(null), null);
+  assert.equal(redactRemoteUrl(''), null);
+});
+
+test('a credential-bearing remote is redacted in the printed report', async (t) => {
+  const app = await fixture(t);
+  await app.push('second commit', 'second\n');
+  reportIncomingChanges({
+    ...app.io,
+    read: (args) =>
+      args[0] === 'remote'
+        ? 'https://someone:ghp_secret@github.com/org/repo.git'
+        : readGit(args, { cwd: app.clone }),
+  });
+  assert.doesNotMatch(app.text(), /ghp_secret/);
+  assert.match(
+    app.text(),
+    /Fetching from https:\/\/\*\*\*@github\.com\/org\/repo\.git/,
+  );
+});
+
+test('a failed git read is null, and an empty successful read is an empty string', async (t) => {
+  const app = await fixture(t);
+  assert.equal(
+    readGit(['rev-parse', '--verify', 'refs/heads/absent'], { cwd: app.clone }),
+    null,
+  );
+  assert.equal(
+    readGit(['log', '--oneline', 'HEAD..HEAD'], { cwd: app.clone }),
+    '',
+  );
+});
+
+test('the update and reinstall stay behind the direct-invocation guard', () => {
+  // Without the guard, importing this module to test it would update the
+  // checkout and run npm ci as an import side effect.
+  assert.match(
+    source,
+    /if \(isDirectInvocation\(process\.argv\[1\], MODULE_PATH\)\) \{/,
+  );
+  const entrypoint = source.slice(
+    source.indexOf('export function runPinokioUpdate'),
+  );
+  // Order is the whole point of the fix: disclose and apply, then install.
+  assert.ok(
+    entrypoint.indexOf('updateFromRemote(io)') <
+      entrypoint.indexOf('install()'),
+    'the update must be disclosed and applied before dependencies are installed',
+  );
+});
+
+test('the disclosed revision is applied by merge, not by a second pull', () => {
+  const applier = source.slice(
+    source.indexOf('export function updateFromRemote'),
+  );
+  assert.match(applier, /apply\(\['merge', '--ff-only', plan\.apply\]\)/);
+  // The plain pull remains, but only on the path where nothing was disclosed.
+  assert.match(
+    applier,
+    /else if \(plan\.fallback\) apply\(\['pull', '--ff-only'\]\)/,
+  );
+});

From 94f5e4dd4584e52d2c39df074abd9a898fc3f6fb Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:38:28 -0500
Subject: [PATCH 07/10] fix(windows): isolate the ACL verifier from the
 PowerShell 7 module path (#508)

Supersedes #161 by @michaelhan1208, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: michaelhan1208 <hanming1208@qq.com>
---
 .github/workflows/ci.yml       |   2 +-
 CHANGELOG.md                   |  10 +++
 src/keySetupHardening.mjs      |  33 ++++++++-
 src/keySetupHardening.test.mjs | 126 +++++++++++++++++++++++++++++++++
 4 files changed, 169 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8c1677b25..9ea5f599a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -83,7 +83,7 @@ jobs:
         run: npm run check:boundaries
 
       - name: Run focused onboarding tests
-        run: node --test src/setupDoctor.test.mjs src/pinokioEnvironment.test.mjs src/pinokioPreflight.test.mjs src/pinokioLauncherContract.test.mjs src/mapStartup.test.mjs src/hudSummaryResponse.test.mjs
+        run: node --test src/setupDoctor.test.mjs src/pinokioEnvironment.test.mjs src/pinokioPreflight.test.mjs src/pinokioLauncherContract.test.mjs src/keySetupHardening.test.mjs src/mapStartup.test.mjs src/hudSummaryResponse.test.mjs
 
       - name: Build production bundle
         run: npm run build
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 790aa2740..6d29756ee 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -263,6 +263,16 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   reported as such instead of as "already up to date", and if the revision to
   apply cannot be resolved at all the update stops without installing anything
   and exits unsuccessfully. Contributed by Lob26 (#356).
+- On Windows, the credential-file hardening step verifies the file's permissions
+  through the system PowerShell. A side-by-side PowerShell 7 install prepends its
+  own module directories, which the 5.1 verifier cannot load, so the check failed
+  and the credential was refused. The verify script now sets its module path from
+  the running interpreter's own home, and the environment it is launched with
+  carries that one value and no differently cased alias of it. The tests that
+  cover it drive a stubbed process launcher, so what they check is the command
+  and environment the code builds; the Windows onboarding CI job now also runs
+  this file, where its one Windows-only case exercises the real hardener against
+  real native tools. Contributed by michaelhan1208 (#161).
 
 - Extract panel disclosure and hover/focus controls into a reusable module;
   cancel their listeners and pending work during replacement and teardown.
diff --git a/src/keySetupHardening.mjs b/src/keySetupHardening.mjs
index 86b77b7c8..64d807292 100644
--- a/src/keySetupHardening.mjs
+++ b/src/keySetupHardening.mjs
@@ -9,6 +9,12 @@ import {
 /** PowerShell verification for the exact owner-only Windows credential DACL. */
 const WINDOWS_ACL_VERIFY_SCRIPT = [
   "$ErrorActionPreference = 'Stop'",
+  // Load Microsoft.PowerShell.Security (Get-Acl) from the module tree of the
+  // interpreter that is actually running. $PSHOME is that interpreter's own
+  // physical directory, so this is correct even when the executable was named
+  // through the Sysnative bridge, and it cannot be steered by anything the
+  // parent environment set.
+  "$env:PSModulePath = Join-Path $PSHOME 'Modules'",
   '$acl = Get-Acl -LiteralPath $env:GEV_ACL_FILE',
   'if (-not $acl.AreAccessRulesProtected) { exit 2 }',
   "$allowed = @($env:GEV_ACL_USER_SID, 'S-1-5-18', 'S-1-5-32-544')",
@@ -143,15 +149,40 @@ export function hardenCredentialFile(filepath, {
     // accept only three explicit FullControl allow principals, with inheritance
     // disabled. Any unexpected rule, right, command error, or missing principal
     // fails closed before the secret reaches disk.
+    //
+    // The verify process must load Microsoft.PowerShell.Security (Get-Acl)
+    // from the Windows PowerShell system module tree ONLY. A side-by-side
+    // PowerShell 7 install prepends its own module trees to PSModulePath at
+    // startup; inherited into a 5.1 process, the incompatible 7.x manifest
+    // cannot be autoloaded and the verify step fails. The script itself sets
+    // the path from $PSHOME; this is the same value computed ahead of time, so
+    // nothing inherited is in force even for the moment before it runs. The
+    // Sysnative spelling is a 32-bit caller's bridge and not a directory the
+    // launched native process can read, so the physical name is used.
+    const powershellModuleDirectory = path.win32.join(
+      path.win32
+        .dirname(tools.powershell)
+        .replace(/\\Sysnative\\/i, '\\System32\\'),
+      'Modules',
+    );
+    // Windows environment names are case-insensitive, and a child can end up
+    // carrying a differently cased alias alongside the value set here. Drop
+    // every spelling before setting the trusted one.
+    const verifyEnvironment = Object.fromEntries(
+      Object.entries(environment).filter(
+        ([name]) => name.toLowerCase() !== 'psmodulepath',
+      ),
+    );
     const verified = spawn(tools.powershell, [
       '-NoProfile',
       '-NonInteractive',
       '-Command', WINDOWS_ACL_VERIFY_SCRIPT,
     ], {
       env: {
-        ...environment,
+        ...verifyEnvironment,
         GEV_ACL_FILE: filepath,
         GEV_ACL_USER_SID: sid,
+        PSModulePath: powershellModuleDirectory,
       },
       stdio: 'ignore',
       windowsHide: true,
diff --git a/src/keySetupHardening.test.mjs b/src/keySetupHardening.test.mjs
index ec7bcdffc..1ea9b3a8c 100644
--- a/src/keySetupHardening.test.mjs
+++ b/src/keySetupHardening.test.mjs
@@ -126,6 +126,132 @@ test('Windows hardening applies and then verifies the exact restricted DACL', ()
   assert.match(calls[2].args.at(-1), /seen\.Count -ne 3/);
 });
 
+test('Windows hardening isolates the verify PowerShell from a pwsh7-polluted PSModulePath', () => {
+  const calls = [];
+  // Exactly what a side-by-side PowerShell 7 install prepends at startup:
+  // its own user Documents\PowerShell, Program Files\PowerShell, and
+  // Program Files\PowerShell\7 module trees all shadow the 5.1 system path.
+  const pollutedModulePath = [
+    'C:\\Users\\alice\\Documents\\PowerShell\\Modules',
+    'C:\\Program Files\\PowerShell\\Modules',
+    'c:\\program files\\powershell\\7\\Modules',
+    'C:\\Program Files\\WindowsPowerShell\\Modules',
+    'C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\Modules',
+  ].join(';');
+  const result = hardenCredentialFile('C:\\GEV\\ENVIRONMENT.tmp', {
+    platform: 'win32',
+    environment: {
+      SYSTEMROOT: WINDOWS_ROOT,
+      PSModulePath: pollutedModulePath,
+    },
+    fileSystem: windowsFileSystem(),
+    spawn(command, args, options) {
+      calls.push({ command, args, options });
+      if (command.endsWith('\\whoami.exe')) {
+        return { status: 0, signal: null, stdout: `"WORKSTATION\\alice","${USER_SID}"\r\n` };
+      }
+      return { status: 0, signal: null };
+    },
+  });
+  assert.equal(result, true);
+  const verify = calls.find(({ command }) => command.endsWith('powershell.exe'));
+  assert.ok(verify, 'the ACL verify powershell must be spawned');
+  const modulePath = verify.options.env.PSModulePath;
+  // Fail closed: the verification interpreter must never inherit pwsh7's
+  // module trees — a 7.x Microsoft.PowerShell.Security manifest cannot be
+  // autoloaded by 5.1, and an untrusted tree must not shadow Get-Acl at all.
+  assert.ok(!/Documents\\PowerShell\\Modules/i.test(modulePath), 'user pwsh7 module tree must be stripped');
+  assert.ok(!/Program Files\\PowerShell\\Modules/i.test(modulePath), 'Program Files pwsh7 module tree must be stripped');
+  assert.ok(!/Program Files\\PowerShell\\7\\Modules/i.test(modulePath), 'pwsh7 install module tree must be stripped');
+  // ... but the 5.1 system module directory (where Get-Acl lives) must remain.
+  assert.match(modulePath, /System32\\WindowsPowerShell\\v1\.0\\Modules/i);
+});
+
+test('the verify script takes its module path from the running interpreter', () => {
+  const calls = [];
+  const result = hardenCredentialFile('C:\\GEV\\ENVIRONMENT.tmp', {
+    platform: 'win32',
+    environment: { SYSTEMROOT: WINDOWS_ROOT },
+    fileSystem: windowsFileSystem(),
+    spawn(command, args, options) {
+      calls.push({ command, args, options });
+      if (command.endsWith('\\whoami.exe')) {
+        return { status: 0, signal: null, stdout: `"WORKSTATION\\alice","${USER_SID}"` };
+      }
+      return { status: 0, signal: null };
+    },
+  });
+  assert.equal(result, true);
+  const verify = calls.find(({ command }) => command.endsWith('powershell.exe'));
+  const script = verify.args.at(-1);
+  // $PSHOME is the interpreter's own physical directory, so this holds even
+  // where the executable was named through a bridge path.
+  assert.match(script, /\$env:PSModulePath = Join-Path \$PSHOME 'Modules'/);
+  // ...and it is the first thing the script does, before Get-Acl is resolved.
+  assert.ok(
+    script.indexOf('PSModulePath') < script.indexOf('Get-Acl'),
+    'the module path must be set before Get-Acl is invoked',
+  );
+});
+
+test('a 32-bit caller passes the physical module directory, not the Sysnative bridge', () => {
+  const calls = [];
+  const result = hardenCredentialFile('C:\\GEV\\ENVIRONMENT.tmp', {
+    platform: 'win32',
+    architecture: 'ia32',
+    environment: { SYSTEMROOT: WINDOWS_ROOT },
+    fileSystem: windowsFileSystem({ systemDirectory: 'Sysnative' }),
+    spawn(command, args, options) {
+      calls.push({ command, args, options });
+      if (command.endsWith('\\whoami.exe')) {
+        return { status: 0, signal: null, stdout: `"WORKSTATION\\alice","${USER_SID}"` };
+      }
+      return { status: 0, signal: null };
+    },
+  });
+  assert.equal(result, true);
+  const verify = calls.find(({ command }) => command.endsWith('powershell.exe'));
+  // The executable is still named through the bridge the 32-bit caller needs.
+  assert.match(verify.command, /\\Sysnative\\/);
+  // The module directory is not: Sysnative is not a directory the launched
+  // native process can read.
+  assert.doesNotMatch(verify.options.env.PSModulePath, /Sysnative/i);
+  assert.match(
+    verify.options.env.PSModulePath,
+    /^C:\\Windows\\System32\\WindowsPowerShell\\v1\.0\\Modules$/i,
+  );
+});
+
+test('differently cased PSModulePath aliases do not survive into the verify process', () => {
+  const calls = [];
+  const result = hardenCredentialFile('C:\\GEV\\ENVIRONMENT.tmp', {
+    platform: 'win32',
+    environment: {
+      SYSTEMROOT: WINDOWS_ROOT,
+      // Windows environment names are case-insensitive; a child can keep a
+      // differently cased alias alongside the value set for it.
+      PSMODULEPATH: 'C:\\Program Files\\PowerShell\\7\\Modules',
+      psmodulepath: 'C:\\Users\\alice\\Documents\\PowerShell\\Modules',
+      PsModulePath: 'C:\\attacker\\Modules',
+    },
+    fileSystem: windowsFileSystem(),
+    spawn(command, args, options) {
+      calls.push({ command, args, options });
+      if (command.endsWith('\\whoami.exe')) {
+        return { status: 0, signal: null, stdout: `"WORKSTATION\\alice","${USER_SID}"` };
+      }
+      return { status: 0, signal: null };
+    },
+  });
+  assert.equal(result, true);
+  const verify = calls.find(({ command }) => command.endsWith('powershell.exe'));
+  const aliases = Object.keys(verify.options.env).filter(
+    (name) => name.toLowerCase() === 'psmodulepath',
+  );
+  assert.deepEqual(aliases, ['PSModulePath'], 'exactly one spelling may reach the child');
+  assert.doesNotMatch(verify.options.env.PSModulePath, /PowerShell\\7|Documents|attacker/i);
+});
+
 test('Windows hardening bypasses PATH-shadowed native ACL tools', () => {
   const commands = [];
   const result = hardenCredentialFile('D:\\GEV\\ENVIRONMENT.tmp', {

From a04502559e07c31dcec7245e89bddcb556c97be8 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:42:24 -0500
Subject: [PATCH 08/10] docs(cctv): correct the panel reset instructions to the
 current storage key (#509)

Supersedes #408 by @vegettto, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: vegettto <vegettto@gmail.com>
---
 CHANGELOG.md                          |   9 ++
 docs/CURRENT-STATE.md                 |   2 +-
 docs/KNOWN-ISSUES.md                  |  27 +++--
 scripts/dev-fresh.sh                  |   4 +-
 scripts/format-scope.json             |   1 +
 src/tooling/panelStorageDocs.test.mjs | 148 ++++++++++++++++++++++++++
 6 files changed, 182 insertions(+), 9 deletions(-)
 create mode 100644 src/tooling/panelStorageDocs.test.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6d29756ee..83fd11a75 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -273,6 +273,15 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
   and environment the code builds; the Windows onboarding CI job now also runs
   this file, where its one Windows-only case exercises the real hardener against
   real native tools. Contributed by michaelhan1208 (#161).
+- The panel-recovery instructions in `docs/KNOWN-ISSUES.md`, `docs/CURRENT-STATE.md`
+  and `scripts/dev-fresh.sh` describe what the interface does. The rails lay panels
+  out themselves and write no stored position, so a CCTV panel that looks missing
+  is collapsed or its layer is off; the collapsed-state key is what opens it, and
+  the value to store is `'0'`, since removing the key returns the panel to its
+  default, which is collapsed. A view opened from a share link is laid out from
+  the link and ignores the stored value, so the console workaround is for ordinary
+  loads only. A check keeps the documented keys and outcomes in step with the
+  code. Contributed by vegettto (#408).
 
 - Extract panel disclosure and hover/focus controls into a reusable module;
   cancel their listeners and pending work during replacement and teardown.
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index ba03ad08a..fb0339a95 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -3305,7 +3305,7 @@ easier to meet (detection is now on more often), but does not create it.
   samples and constant elevation during E/N drag; one shared-floor resolution on
   release; late one-shot shared-cell work is permitted during viewshed idle. The
   A+B harness intentionally excludes citywide LOD assertions.
-- Draggable panel positions persist at `godsEyeView.v7.panelPos.<panel-id>` (collapsed states at `godsEyeView.v6.panelCollapsed.<panel-id>`).
+- Panel positions have a versioned storage name, `godsEyeView.v8.panelPos.<panel-id>`, but the current rails lay panels out adaptively and write none. Collapsed state does persist for every panel at `godsEyeView.v6.panelCollapsed.<panel-id>` (`'0'` open, `'1'` closed, absent means the panel's own default).
 - Legacy draggable-panel position keys may remain in local storage for backward compatibility, but the map-mode right rail ignores them; collapsed states still persist at `godsEyeView.v6.panelCollapsed.<panel-id>`.
 - Flight/military tracked entities cache dead-reckoned positions per frame to avoid callback desync flicker.
 - Aircraft 3D-model and tracking invariants are covered by `npm run test:track`; run this before touching `flights.js`, `militaryFlights.js`, `detection.js`, or `trackedReadout.js`.
diff --git a/docs/KNOWN-ISSUES.md b/docs/KNOWN-ISSUES.md
index 33c665f39..92c92c1f9 100644
--- a/docs/KNOWN-ISSUES.md
+++ b/docs/KNOWN-ISSUES.md
@@ -30,21 +30,36 @@ Next iteration candidates:
 
 ---
 
-### CCTV panel can appear "missing" after layout refactors
+### CCTV panel can appear "missing"
 Status: Open (workaround available)
 
 Context:
-- Panel positions are persisted in local storage and can restore off-screen after UI changes.
+- The rails lay their panels out themselves. No panel is dragged into place at
+  startup and no stored position is read, so a panel that looks missing is
+  collapsed or its layer is off rather than parked off-screen. The CCTV panel
+  starts collapsed and stays that way until you open it or a camera activates.
 
 Workaround:
-- In browser console:
-  - `localStorage.removeItem('godsEyeView.v6.panelPos.cctv-panel');`
+- Check that the CCTV layer is enabled in the Layers panel, then open the panel
+  from its header control; it also opens on its own when a camera activates.
+- To force it open on an ordinary load, store the expanded state and reload. In
+  the browser console:
+  - `localStorage.setItem('godsEyeView.v6.panelCollapsed.cctv-panel', '0');`
+  - `location.reload();`
+- Removing that key instead returns the panel to its default, which is collapsed:
   - `localStorage.removeItem('godsEyeView.v6.panelCollapsed.cctv-panel');`
   - `location.reload();`
+- Neither console line changes anything when the page was opened from a share
+  link: a shared view is laid out from the link, not from what this browser has
+  stored, so open the panel from its header control instead.
 
 Related keys (current versions):
-- Panel positions: `godsEyeView.v7.panelPos.<panel-id>` (re-versioned 2026-06-10)
-- Panel collapsed state: `godsEyeView.v6.panelCollapsed.<panel-id>`
+- Panel collapsed state: `godsEyeView.v6.panelCollapsed.<panel-id>` — `'0'` open,
+  `'1'` closed, absent means the panel's own default. A view opened from a share
+  link ignores the stored value entirely.
+- Panel positions: `godsEyeView.v8.panelPos.<panel-id>` — the versioned name for a
+  stored position. The current layout writes none, so deleting one changes
+  nothing.
 - CCTV calibration: `godsEyeView.cctv.calibration.v2`
 
 ---
diff --git a/scripts/dev-fresh.sh b/scripts/dev-fresh.sh
index 6ec989ed6..2f9454401 100755
--- a/scripts/dev-fresh.sh
+++ b/scripts/dev-fresh.sh
@@ -306,8 +306,8 @@ case "${HOST}" in
 esac
 echo "Google Maps key source: ${GOOGLE_MAPS_API_KEY_SOURCE}"
 echo "Tip: after server starts, hard refresh browser (Cmd+Shift+R)."
-echo "If panels are still missing, run this once in browser console:"
-echo "localStorage.removeItem('godsEyeView.v6.panelPos.cctv-panel'); location.reload();"
+echo "The CCTV panel starts collapsed; open it from its header, or in browser console:"
+echo "localStorage.setItem('godsEyeView.v6.panelCollapsed.cctv-panel', '0'); location.reload();"
 echo "OpenSky auth mode: ${OPENSKY_AUTH_MODE}"
 if [[ -n "${OPENSKY_CREDENTIALS_FILE}" ]]; then
   if [[ -f "${OPENSKY_CREDENTIALS_FILE}" ]]; then
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 10a18fd63..5813b3a58 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -10,6 +10,7 @@
   "src/tooling/fixtureRoot.mjs",
   "src/tooling/fixtureRoot.test.mjs",
   "src/tooling/format.test.mjs",
+  "src/tooling/panelStorageDocs.test.mjs",
   "src/tooling/packageBoundaries.test.mjs",
   "src/data/infrastructure.js",
   "src/data/infrastructure.test.mjs",
diff --git a/src/tooling/panelStorageDocs.test.mjs b/src/tooling/panelStorageDocs.test.mjs
new file mode 100644
index 000000000..5af18b96c
--- /dev/null
+++ b/src/tooling/panelStorageDocs.test.mjs
@@ -0,0 +1,148 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const root = fileURLToPath(new URL('../..', import.meta.url));
+
+// Documentation consistency only: that every storage key a document spells out
+// is the key the code writes. Whether deleting one has the effect the document
+// claims is not checked here.
+const DOCUMENTED_KEYS = [
+  ['docs/KNOWN-ISSUES.md', 'godsEyeView.{layout}.panelCollapsed.cctv-panel'],
+  ['docs/KNOWN-ISSUES.md', 'godsEyeView.{layout}.panelCollapsed.<panel-id>'],
+  ['docs/KNOWN-ISSUES.md', 'godsEyeView.{position}.panelPos.<panel-id>'],
+  ['scripts/dev-fresh.sh', 'godsEyeView.{layout}.panelCollapsed.cctv-panel'],
+  ['docs/CURRENT-STATE.md', 'godsEyeView.{position}.panelPos.<panel-id>'],
+  ['docs/CURRENT-STATE.md', 'godsEyeView.{position}.panelPos.<id>'],
+  ['docs/CURRENT-STATE.md', 'godsEyeView.{layout}.panelCollapsed.<panel-id>'],
+];
+
+test('documented panel storage keys are the keys the code writes', async () => {
+  const source = await readFile(
+    path.join(root, 'src/ui/panelPositionControls.js'),
+    'utf8',
+  );
+  const version = (name) => {
+    const [, found] =
+      source.match(new RegExp(`const ${name} = '([^']+)';`)) || [];
+    assert.ok(found, `panelPositionControls.js must declare ${name}`);
+    return found;
+  };
+  const position = version('PANEL_POSITION_STORAGE_VERSION');
+  const layout = version('PANEL_LAYOUT_STORAGE_VERSION');
+
+  const seen = new Map();
+  for (const [file, shape] of DOCUMENTED_KEYS) {
+    if (!seen.has(file))
+      seen.set(file, await readFile(path.join(root, file), 'utf8'));
+    const expected = shape
+      .replace('{position}', position)
+      .replace('{layout}', layout);
+    assert.ok(
+      seen.get(file).includes(expected),
+      `${file} must use ${expected}`,
+    );
+  }
+
+  // A document that still names a superseded version sends the reader to a key
+  // nothing writes.
+  for (const [file, content] of seen) {
+    const stalePositions = [
+      ...content.matchAll(/godsEyeView\.(v\d+)\.panelPos/g),
+    ]
+      .map(([, found]) => found)
+      .filter((found) => found !== position);
+    assert.deepEqual(
+      stalePositions,
+      [],
+      `${file} names superseded position keys`,
+    );
+    const staleCollapsed = [
+      ...content.matchAll(/godsEyeView\.(v\d+)\.panelCollapsed/g),
+    ]
+      .map(([, found]) => found)
+      .filter((found) => found !== layout);
+    assert.deepEqual(
+      staleCollapsed,
+      [],
+      `${file} names superseded collapsed-state keys`,
+    );
+  }
+});
+
+test('the documented outcomes hold: default, stored open, stored shut, and a shared view', async () => {
+  // The instructions promise two different outcomes; both are exercised here
+  // against the code that decides them.
+  const { PanelPositionControls } =
+    await import('../ui/panelPositionControls.js');
+  const html = await readFile(
+    path.join(root, 'src/ui/templates/layer-panels.html'),
+    'utf8',
+  );
+  assert.match(
+    html,
+    /<div id="cctv-panel" class="panel-collapsible collapsed"/,
+    'the CCTV panel starts collapsed in the markup',
+  );
+
+  const saved = {
+    document: globalThis.document,
+    localStorage: globalThis.localStorage,
+  };
+  const classes = new Set(['panel-collapsible', 'collapsed']);
+  const panel = {
+    classList: {
+      contains: (name) => classes.has(name),
+      toggle: (name, active) =>
+        active ? classes.add(name) : classes.delete(name),
+      add: (name) => classes.add(name),
+      remove: (name) => classes.delete(name),
+    },
+  };
+  const store = new Map();
+  globalThis.document = { getElementById: () => panel };
+  globalThis.localStorage = {
+    getItem: (key) => (store.has(key) ? store.get(key) : null),
+    setItem: (key, value) => store.set(key, String(value)),
+    removeItem: (key) => store.delete(key),
+  };
+  try {
+    const controls = new PanelPositionControls({
+      syncPanelCollapseButton: () => {},
+      layoutRightPanels: () => {},
+      syncCctvPanelViewport: () => {},
+      showToast: () => {},
+    });
+
+    // Nothing stored: the markup default wins, and the panel is collapsed. So
+    // deleting the key is a reset, not a way to open the panel.
+    controls._restorePanelCollapsedState('cctv-panel');
+    assert.equal(classes.has('collapsed'), true);
+
+    // The value the documents tell a reader to set.
+    store.set('godsEyeView.v6.panelCollapsed.cctv-panel', '0');
+    controls._restorePanelCollapsedState('cctv-panel');
+    assert.equal(classes.has('collapsed'), false);
+
+    // ...and the opposite value keeps it shut, so '0' is doing the work.
+    store.set('godsEyeView.v6.panelCollapsed.cctv-panel', '1');
+    controls._restorePanelCollapsedState('cctv-panel');
+    assert.equal(classes.has('collapsed'), true);
+
+    // A view opened from a share link is laid out from the link: the shell
+    // restores with allowStored false, and the stored value is not consulted.
+    // This is why the console workaround is documented for ordinary loads only.
+    store.set('godsEyeView.v6.panelCollapsed.cctv-panel', '0');
+    controls._restorePanelCollapsedState('cctv-panel', { allowStored: false });
+    assert.equal(
+      classes.has('collapsed'),
+      true,
+      'a shared view must ignore the stored open state',
+    );
+  } finally {
+    globalThis.document = saved.document;
+    globalThis.localStorage = saved.localStorage;
+  }
+});

From 409e27d7f901a636db3feab6abc162908f4ab8f1 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:45:52 -0500
Subject: [PATCH 09/10] feat(cctv): add the Open Calgary camera pack (#514)

Supersedes #438 by @rileygramlich, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Co-authored-by: rileygramlich <gramlichriley@gmail.com>
---
 .env.example                                  |    3 +
 CHANGELOG.md                                  |    9 +
 DATA_SOURCES.md                               |    2 +
 README.md                                     |    2 +-
 docs/CURRENT-STATE.md                         |    2 +-
 scripts/dev-fresh.sh                          |    7 +-
 scripts/format-scope.json                     |    1 +
 scripts/package-boundaries.json               |    1 +
 server/providers/cctv/catalog.js              |    6 +
 server/providers/cctv/constants.js            |   16 +
 server/providers/cctv/normalize.js            |   11 +
 server/providers/cctv/sources.js              |  205 +
 src/data/cctvCalgary.test.mjs                 |  389 ++
 src/data/dataCredits.js                       |    6 +
 .../cctv_ground_heights.json                  | 4087 ++++++++++++++++-
 15 files changed, 4743 insertions(+), 4 deletions(-)
 create mode 100644 src/data/cctvCalgary.test.mjs

diff --git a/.env.example b/.env.example
index e537dfb16..5bc02df9c 100644
--- a/.env.example
+++ b/.env.example
@@ -168,6 +168,9 @@ AISSTREAM_API_KEY=
 # CCTV_WARENDORF_ENABLED=1                             # set 0 to disable the Warendorf (Germany) municipal webcams
 # CCTV_NSW_ENABLED=1                                   # set 0 to disable the Live Traffic NSW (Australia) cameras
 # CCTV_NSW_MAX_SOURCES=250                             # cap cameras loaded from Live Traffic NSW
+# CCTV_CALGARY_ENABLED=1                               # set 0 to disable the Open Calgary (Alberta) cameras
+# CCTV_CALGARY_MAX_SOURCES=220                         # cap cameras loaded from the Open Calgary catalog
+# CCTV_CALGARY_ROWS_URL=                               # override the Open Calgary catalog URL
 # CCTV_MAX_SOURCES=4000                                # catalog-wide ceiling, shared round-robin across packs
 # CCTV_PREFER_AUSTIN=1                                 # prioritize Austin cameras in the registry
 # CCTV_FORCE_AUSTIN=                                   # force live default sources when a source-pack JSON is configured
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 83fd11a75..44e6431c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -123,6 +123,15 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 ### Added
 
+- Add Open Calgary traffic cameras as a keyless CCTV source pack (thanks
+  @rileygramlich): the public City of Calgary catalog, frames pinned to the
+  city's own host and upgraded to HTTPS, with the Open Government Licence –
+  City of Calgary attribution. The dataset publishes no camera facing — its
+  quadrant field and the quadrant suffix on each camera name are Calgary's
+  address grid — so headings use the shared id-hash fallback at low confidence
+  and are corrected with the calibration gizmo. `CCTV_CALGARY_MAX_SOURCES` sets
+  the cap and `CCTV_CALGARY_ENABLED=0` turns the pack off.
+
 - Add Ontario 511 as a keyless CCTV source pack, including Kitchener-area
   highway cameras, with server-registered still URLs and attribution.
 - CCTV Mesh adds Finland: Fintraffic road weather cameras, keyless, nationwide, 300 by default. Each camera view of a station is placed separately; ambient stills refresh on the source's 10-minute cadence (the active camera keeps the usual 10-second refresh).
diff --git a/DATA_SOURCES.md b/DATA_SOURCES.md
index f0bc95cb5..6d9e14caf 100644
--- a/DATA_SOURCES.md
+++ b/DATA_SOURCES.md
@@ -44,6 +44,7 @@ How to read this:
 | **Ontario 511**                                                       | CCTV camera catalog + frames, Ontario highways including Kitchener-area routes                                                      | [Open Government Licence – Ontario](https://www.ontario.ca/page/open-government-licence-ontario)                                                                                                                                                                                                                                                      | "Ontario 511" plus Open Government Licence - Ontario                                                                                        |
 | **Fintraffic / Digitraffic (weathercams)**                            | CCTV camera catalog + frames, Finland                                                                                               | [CC BY 4.0](https://www.digitraffic.fi/en/terms-of-service/) — attribution REQUIRED                                                                                                                                                                                                                                                                   | "Fintraffic / digitraffic.fi, license CC BY 4.0"                                                                                            |
 | **DriveBC** (Government of British Columbia)                          | CCTV camera catalog + frames, British Columbia highways                                                                             | [Open Government Licence – British Columbia](https://www2.gov.bc.ca/gov/content/data/open-data/open-government-licence-bc) — attribution REQUIRED                                                                                                                                                                                                     | "DriveBC. Contains information licensed under the Open Government Licence – British Columbia"                                               |
+| **Open Calgary** (`data.calgary.ca`)                                  | CCTV camera catalog + frames, Calgary                                                                                               | [Open Government Licence – City of Calgary](https://data.calgary.ca/stories/s/Open-Calgary-Terms-of-Use/u45n-7awa) — attribution REQUIRED                                                                                                                                                                                                             | "Contains information licensed under the Open Government Licence – City of Calgary"                                                         |
 | **GBFS (Lyft / BCycle)**                                              | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                |
 | **Radio Browser**                                                     | Geolocated internet-radio station directory and station-level tags                                                                  | Public-domain directory data under PDDL 1.0; individual broadcaster stream terms apply                                                                                                                                                                                                                                                                | "Radio Browser" plus a link to the selected broadcaster                                                                                     |
 | **Re:Earth Terrain** (Mapterhorn)                                     | Terrain (keyless globe stacks — OSM etc. — + `/api/terrain/heights` ellipsoidal-height lookups)                                     | Terrain mesh: CC BY 4.0; geoid: EGM2008 (NGA, public domain)                                                                                                                                                                                                                                                                                          | "Terrain (keyless globe stacks): Re:Earth Terrain / Mapterhorn (CC BY 4.0) / EGM2008 (NGA)"                                                 |
@@ -63,6 +64,7 @@ How to read this:
 - **Tarktee / Transpordiamet.** Estonia road-weather camera locations and current JPEG URLs come from keyless DATEX2 endpoints on `tarktee.transpordiamet.ee` (`/api/v1/datex/roadCameraLocations` + `roadCameraImages`). Frame URLs rotate with each capture; the 15-minute CCTV source cache refreshes them. Only `https://tarktee.transpordiamet.ee/images/…` URLs are registered. Disable with `CCTV_TARKTEE_ENABLED=0`.
 - **Warendorf webcam.** The Stadt Warendorf Marktplatz webcam, registered from the curated `config/cctv_sources.warendorf.json` (the Kreis Warendorf registration-office cameras from the contributing PR are indoor waiting rooms and were left out); only the municipal image host is proxied, frames are fetched at request time and never stored or redistributed. Disable with `CCTV_WARENDORF_ENABLED=0`.
 - **Live Traffic NSW cameras.** The camera list is the keyless public `data.livetraffic.com/cameras/traffic-cam.json` feed (Transport for NSW open data, CC BY 4.0); frames are stills on `webcams.transport.nsw.gov.au`, and only that host is registered. That image host answers non-browser clients with an HTML placeholder, so the proxy identifies as a browser for that one host and as itself everywhere else. Frames are fetched at request time and never stored or redistributed. Disable with `CCTV_NSW_ENABLED=0`.
+- **Open Calgary traffic cameras.** Keyless. The camera list is the public Socrata dataset `k7p9-kppz` on `data.calgary.ca`; frames are stills on the city's own `trafficcam.calgary.ca` host, and only that host is registered. Most rows publish an `http://` frame URL and the host redirects those to HTTPS, so URLs are upgraded and pinned to that origin before registration. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `quadrant` field and the quadrant suffix on each camera name are Calgary's address grid, not a bearing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. The licence requires the attribution statement above. Disable with `CCTV_CALGARY_ENABLED=0`.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
 - **Radio Browser.** `/api/radio/stations` discovers official API mirrors, makes bounded and coalesced healthy/geolocated HTTPS-station queries, caches the normalized public-domain directory for 45 minutes, and may serve the last good catalog for up to seven days during an outage. Refreshes must meet minimum accepted-query and station coverage before replacing a warm catalog; schema-valid responses whose rows all fail the product's health policy do not count as successful queries. A usable partial cold catalog is explicitly `DEGRADED`, and malformed or empty successful payloads are rejected atomically. Every directory and click-count request rejects redirects, validates all resolved addresses as globally routable (including reserved/documentation IPv4 and special/non-global IPv6 exclusions), and pins the TLS connection to a validated address. Only MP3/AAC non-HLS directory rows with public HTTPS stream targets are returned; favicons are intentionally omitted. Pressing play connects one browser audio element directly to the selected broadcaster and calls the directory's click counter through known-ID-only `POST /api/radio/click/:uuid`. GEV never proxies, caches, records, bundles, or redistributes audio. Radio Browser supplies station-level tags, not dependable current-song or upcoming-program metadata, so Radio filtering never claims either. Direct playback exposes the listener's IP address to the broadcaster, whose own stream terms apply.
 - **TomTom Traffic.** Optional and BYOK: without `TOMTOM_API_KEY` the traffic layer runs its built-in simulation and no TomTom data (or attribution) appears. With a key, flow vector tiles are fetched through the server-side `/api/tomtom` proxy (120 s cache + a daily tile-budget governor — `TOMTOM_DAILY_TILE_BUDGET`, default 40,000, a configurable application safety ceiling, not a guarantee of staying within TomTom's monthly free allowance; TomTom's [current pricing](https://docs.tomtom.com/pricing/) lists 200K free tile requests per month) and the "Traffic flow data © TomTom" credit is registered in the Data attribution popover the moment live mode activates. TomTom data is served live and cached only transiently (≤120 s TTL under `.gev-cache/`, gitignored) — it is not bundled or redistributed. One 23 KB point-in-time tile snapshot is committed as a decode-test fixture (`src/data/fixtures/`, © TomTom, never served to the app).
diff --git a/README.md b/README.md
index af5121e2c..b169189cc 100644
--- a/README.md
+++ b/README.md
@@ -275,7 +275,7 @@ Thirteen layers and map sources. **Eleven have a keyless path.** Some offer addi
 | 🛰️ **Satellites** | 838-object catalog, color-coded by class with a live legend — the **DENSE** chip drops in the whole Starlink shell | CelesTrak | 🟢 |
 | 🌍 **Earthquakes** | Global seismic activity, last 24h | USGS | 🟢 |
 | 🚗 **Traffic** | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations | TomTom + OSM | 🟢 simulation · 🟡 live flow speeds |
-| 📹 **CCTV Mesh** | ~3,400 public cameras projected *into* the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · New South Wales (Live Traffic NSW). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs | 🟢 |
+| 📹 **CCTV Mesh** | ~3,600 public cameras projected *into* the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · New South Wales (Live Traffic NSW) · Calgary. Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs | 🟢 |
 | 📻 **Radio** | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster | Radio Browser / broadcasters | 🟢 |
 | 🚲 **Bikeshare** | Live station availability | GBFS | 🟢 |
 | 🔥 **Active Fires** | Live NASA FIRMS detections, trailing 24h | NASA FIRMS | 🟡 |
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index fb0339a95..bc79b0098 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2367,7 +2367,7 @@ its criteria cannot be silently ignored.
 | Satellites | CelesTrak | `src/data/satellites.js` | `/api/celestrak` | 120s |
 | Space Missions (30d) | Launch Library 2 + CelesTrak | `src/data/rocketLaunches.js` | `/api/launches` + `/api/celestrak/active` | 5 min |
 | Traffic | OSM Overpass (+ optional TomTom live flow) | `src/data/traffic.js` | `/api/overpass` + `/api/tomtom` | viewport-driven |
-| CCTV | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW Open Data + Street View fallback | `src/data/cctv.js` | `/api/cctv` | 10s (active) |
+| CCTV | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Street View fallback | `src/data/cctv.js` | `/api/cctv` | 10s (active) |
 | Radio | Radio Browser (public-domain station directory) | `src/data/radio.js` | `/api/radio/stations`, `/api/radio/click/:uuid` | 45 min directory refresh |
 | Bikeshare 🚲 | GBFS (Lyft + BCycle) | `src/data/bikeshare.js` | `/api/gbfs` | 60s |
 | Datacenters ▣ | OSM extract (bundled) | `src/data/localLayers.js` | — | static |
diff --git a/scripts/dev-fresh.sh b/scripts/dev-fresh.sh
index 2f9454401..d3e175050 100755
--- a/scripts/dev-fresh.sh
+++ b/scripts/dev-fresh.sh
@@ -16,7 +16,8 @@ HOST="${HOST:-localhost}"
 # including Kitchener-area highways), and Fintraffic Finland weathercams
 # (~2,260 live presets). Caps keep the densest cores per pack; override
 # per-run for lighter/heavier loads. Kill switches: CCTV_CALTRANS_DISTRICTS='',
-# CCTV_TFL_ENABLED=0, CCTV_ONTARIO_ENABLED=0 and CCTV_FINTRAFFIC_ENABLED=0.
+# CCTV_TFL_ENABLED=0, CCTV_ONTARIO_ENABLED=0, CCTV_FINTRAFFIC_ENABLED=0 and
+# CCTV_CALGARY_ENABLED=0 (Open Calgary, ~215 live upstream).
 CCTV_AUSTIN_MAX_SOURCES="${CCTV_AUSTIN_MAX_SOURCES:-250}"
 # Use `-` not `:-` so an explicit empty string (the documented kill switch)
 # is preserved rather than replaced by the default. Still set-u-safe when unset.
@@ -41,6 +42,8 @@ CCTV_TARKTEE_MAX_SOURCES="${CCTV_TARKTEE_MAX_SOURCES:-179}"
 CCTV_WARENDORF_ENABLED="${CCTV_WARENDORF_ENABLED:-1}"
 CCTV_NSW_ENABLED="${CCTV_NSW_ENABLED:-1}"
 CCTV_NSW_MAX_SOURCES="${CCTV_NSW_MAX_SOURCES:-250}"
+CCTV_CALGARY_ENABLED="${CCTV_CALGARY_ENABLED:-1}"
+CCTV_CALGARY_MAX_SOURCES="${CCTV_CALGARY_MAX_SOURCES:-220}"
 CCTV_MAX_SOURCES="${CCTV_MAX_SOURCES:-4000}"
 
 # Capture which provider credentials genuinely came from the parent shell
@@ -402,6 +405,8 @@ put_env CCTV_TARKTEE_MAX_SOURCES "${CCTV_TARKTEE_MAX_SOURCES}"
 put_env CCTV_WARENDORF_ENABLED "${CCTV_WARENDORF_ENABLED}"
 put_env CCTV_NSW_ENABLED "${CCTV_NSW_ENABLED}"
 put_env CCTV_NSW_MAX_SOURCES "${CCTV_NSW_MAX_SOURCES}"
+put_env CCTV_CALGARY_ENABLED "${CCTV_CALGARY_ENABLED}"
+put_env CCTV_CALGARY_MAX_SOURCES "${CCTV_CALGARY_MAX_SOURCES}"
 put_env CCTV_MAX_SOURCES "${CCTV_MAX_SOURCES}"
 put_env OPENSKY_AUTH_MODE "${OPENSKY_AUTH_MODE}"
 put_env_if_set OPENSKY_CREDENTIALS_FILE "${OPENSKY_CREDENTIALS_FILE}"
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index 5813b3a58..a3225a0c0 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -468,6 +468,7 @@
   "src/data/cctvFootprint.test.mjs",
   "src/data/cctvEstonia.test.mjs",
   "src/data/cctvWarendorf.test.mjs",
+  "src/data/cctvCalgary.test.mjs",
   "src/data/cctvNswSource.test.mjs",
   "src/data/cctvTxdotSource.test.mjs",
   "src/layers/cctv/source.test.mjs",
diff --git a/scripts/package-boundaries.json b/scripts/package-boundaries.json
index 8801d5c47..6003bbdce 100644
--- a/scripts/package-boundaries.json
+++ b/scripts/package-boundaries.json
@@ -154,6 +154,7 @@
       "server/providers/cctv/normalize.js",
       "server/providers/cctv/range.js",
       "server/providers/cctv/sources.js",
+      "server/providers/common/http.js",
       "src/data/directionText.js",
       "server/providers/common/geo.js",
       "server/providers/places/google-key.js",
diff --git a/server/providers/cctv/catalog.js b/server/providers/cctv/catalog.js
index 68c5f974b..a8519c85c 100644
--- a/server/providers/cctv/catalog.js
+++ b/server/providers/cctv/catalog.js
@@ -16,6 +16,7 @@ import {
   loadTarkteeSourcesFromDatex,
   loadWarendorfSourcesFromCatalog,
   loadNswSourcesFromOpenData,
+  loadCalgarySourcesFromOpenData,
 } from './sources.js';
 
 /** Env kill switch: unset or anything but "0" means enabled. */
@@ -80,6 +81,11 @@ const LIVE_PACKS = [
     enabled: () => envEnabled('CCTV_NSW_ENABLED'),
     load: loadNswSourcesFromOpenData,
   },
+  {
+    name: 'calgary',
+    enabled: () => envEnabled('CCTV_CALGARY_ENABLED'),
+    load: loadCalgarySourcesFromOpenData,
+  },
 ];
 /**
  * Load CCTV sources from a local JSON file (CCTV_SOURCES_FILE env or default).
diff --git a/server/providers/cctv/constants.js b/server/providers/cctv/constants.js
index 4c149eb5a..d66806e45 100644
--- a/server/providers/cctv/constants.js
+++ b/server/providers/cctv/constants.js
@@ -220,6 +220,22 @@ export const NSW_IMAGE_USER_AGENT =
  * out around 120 characters.
  */
 export const NSW_MAX_VIEW_LABEL = 140;
+/** Open Calgary traffic cameras: one keyless Socrata endpoint for the whole
+ * city; frames are stills on a City of Calgary host. */
+export const DEFAULT_CALGARY_ROWS_URL =
+  'https://data.calgary.ca/resource/k7p9-kppz.json?$limit=500';
+/** The only origin Calgary camera frames may come from. The catalog publishes
+ * most rows as `http://`; that host serves HTTPS and 301-redirects to it, so
+ * URLs are upgraded and then pinned here before registration. */
+export const CALGARY_IMAGE_ORIGIN = 'https://trafficcam.calgary.ca/';
+export const DEFAULT_CALGARY_MAX_SOURCES = 220;
+/** Centre Street / 7 Avenue: the prioritization anchor. */
+export const CALGARY_DOWNTOWN = { lat: 51.0461, lon: -114.0626 };
+/** Hard ceiling on the Calgary catalog body. The whole city is ~215 rows and
+ * under 100 KB; this only exists so an upstream that streams an unbounded
+ * body cannot be buffered without limit. */
+export const CALGARY_MAX_CATALOG_BYTES = 4 * 1024 * 1024;
+
 /** Camera CATALOGS change rarely; 15 min keeps multi-megabyte upstream list refetches (Austin rows.json + 4 Caltrans districts + TfL + Ontario 511) infrequent. Frames are fetched per-request and are unaffected. */
 export const CCTV_SOURCE_CACHE_MS = 15 * 60 * 1000;
 /** Per-provider catalog-fetch timeout. Bounds the worst-case refresh so one
diff --git a/server/providers/cctv/normalize.js b/server/providers/cctv/normalize.js
index 9677ca661..ffe025b30 100644
--- a/server/providers/cctv/normalize.js
+++ b/server/providers/cctv/normalize.js
@@ -380,6 +380,17 @@ export function isLikelyNswCoordinate(lat, lon) {
   );
 }
 
+/** Calgary's municipal extent, with slack for the ring road. */
+export function isLikelyCalgaryCoordinate(lat, lon) {
+  return (
+    isPlausibleLatLon(lat, lon) &&
+    lat >= 50.8 &&
+    lat <= 51.25 &&
+    lon >= -114.4 &&
+    lon <= -113.8
+  );
+}
+
 export function isLikelyFinlandCoordinate(lat, lon) {
   if (!Number.isFinite(lat) || !Number.isFinite(lon)) return false;
   return lat >= 59.5 && lat <= 70.5 && lon >= 19 && lon <= 32;
diff --git a/server/providers/cctv/sources.js b/server/providers/cctv/sources.js
index ef0ae64b8..41471f5ba 100644
--- a/server/providers/cctv/sources.js
+++ b/server/providers/cctv/sources.js
@@ -50,6 +50,11 @@ import {
   DEFAULT_NSW_MAX_SOURCES,
   SYDNEY_CENTER,
   NSW_MAX_VIEW_LABEL,
+  DEFAULT_CALGARY_ROWS_URL,
+  CALGARY_IMAGE_ORIGIN,
+  DEFAULT_CALGARY_MAX_SOURCES,
+  CALGARY_DOWNTOWN,
+  CALGARY_MAX_CATALOG_BYTES,
   CCTV_SOURCE_FETCH_TIMEOUT_MS,
 } from './constants.js';
 import {
@@ -67,11 +72,13 @@ import {
   isLikelyBcCoordinate,
   isLikelyTexasCoordinate,
   isLikelyNswCoordinate,
+  isLikelyCalgaryCoordinate,
   cameraDisplayCode,
   rowArrayToObject,
   prioritizeSources,
 } from './normalize.js';
 import { directionToHeading } from '../../../src/data/directionText.js';
+import { readResponseJsonCapped } from '../common/http.js';
 /**
  * Fetch and parse Austin traffic camera records from the city Open Data portal.
  *
@@ -1389,3 +1396,201 @@ export async function loadNswSourcesFromOpenData() {
     return [];
   }
 }
+
+/**
+ * Upgrade a catalog frame URL to HTTPS and pin it to the City of Calgary host.
+ *
+ * Most rows ship `http://`; the host answers HTTPS and 301-redirects there, so
+ * upgrading avoids a redirect on every frame fetch. Anything not on the
+ * official origin is refused rather than proxied, the same pin the TfL and
+ * Tarktee packs apply.
+ *
+ * @param {string|null|undefined} raw - `camera_url.url` from the dataset.
+ * @returns {?string} Pinned HTTPS URL, or null when unusable.
+ */
+export function normalizeCalgaryImageUrl(raw) {
+  const text = String(raw ?? '').trim();
+  if (!text) return null;
+  let parsed;
+  try {
+    parsed = new URL(text);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return null;
+  parsed.protocol = 'https:';
+  const upgraded = parsed.toString();
+  return upgraded.startsWith(CALGARY_IMAGE_ORIGIN) ? upgraded : null;
+}
+
+/**
+ * Stable camera id from a frame URL.
+ *
+ * The dataset carries no id column; the frame filename ("loc86.jpg") is the
+ * only stable per-camera token and is what the city keys on. Falls back to a
+ * slug of the whole path so a filename-scheme change degrades to a still-stable
+ * id rather than dropping the camera.
+ *
+ * @param {string} imageUrl - A normalized Calgary frame URL.
+ * @returns {?string} Provider-stable id, or null when underivable.
+ */
+export function calgaryCameraId(imageUrl) {
+  const text = String(imageUrl ?? '').trim();
+  if (!text) return null;
+  let path;
+  try {
+    path = new URL(text).pathname;
+  } catch {
+    return null;
+  }
+  const numbered = path.match(/loc(\d+)\.jpg$/i);
+  if (numbered) return `calgary-${numbered[1]}`;
+  const slug = path
+    .replace(/^\/+|\.[a-z0-9]+$/gi, '')
+    .replace(/[^a-zA-Z0-9]+/g, '-')
+    .toLowerCase();
+  return slug ? `calgary-${slug}` : null;
+}
+
+/**
+ * Label for one Calgary camera: the intersection an operator recognises
+ * ("Bow Trail / 37 Street SW"), used verbatim including its quadrant suffix,
+ * which is part of the street address. It must never be read as a facing.
+ *
+ * @param {object} record - Raw Socrata row.
+ * @param {string} cameraId - Derived stable id.
+ * @returns {string}
+ */
+export function calgaryCameraName(record, cameraId) {
+  const location = String(record?.camera_location ?? '').trim();
+  if (location) return location;
+  const described = String(record?.camera_url?.description ?? '').trim();
+  if (described) return described;
+  return `Calgary Camera ${String(cameraId).replace(/^calgary-/, '')}`;
+}
+
+/**
+ * One Open Calgary row -> one catalog source, or null.
+ *
+ * NO HEADING IS DERIVED FROM THE RECORD, and the fields that look like one are
+ * not. Every row carries a `quadrant` ("NE"/"NW"/"SE"/"SW", and combinations
+ * like "NW/NE") and a `camera_location` ending in the same token ("9 Avenue /
+ * 3 Street SE"). That is Calgary's address grid — the quarter of the city the
+ * intersection sits in — not a camera bearing. Handing either to
+ * directionToHeading() returns a confident compass bearing for every row and
+ * every one would be wrong. Headings therefore use the shared id-hash fallback
+ * at low confidence, exactly as headingless TfL and Fintraffic cameras do, and
+ * the operator corrects them with the calibration gizmo.
+ *
+ * @param {object} record - Raw Socrata row.
+ * @returns {?object}
+ */
+export function calgaryCameraToSource(record) {
+  if (!record || typeof record !== 'object') return null;
+  const coordinates = record?.point?.coordinates;
+  if (!Array.isArray(coordinates) || coordinates.length < 2) return null;
+  const lon = toFiniteNumber(coordinates[0]);
+  const lat = toFiniteNumber(coordinates[1]);
+  if (!isLikelyCalgaryCoordinate(lat, lon)) return null;
+
+  const imageUrl = normalizeCalgaryImageUrl(record?.camera_url?.url);
+  if (!imageUrl) return null;
+  const cameraId = calgaryCameraId(imageUrl);
+  if (!cameraId) return null;
+  const name = calgaryCameraName(record, cameraId);
+
+  return {
+    id: cameraId,
+    name,
+    city: 'Calgary',
+    cityId: 'calgary',
+    provider: 'The City of Calgary',
+    lat,
+    lon,
+    headingDeg: fallbackHeadingFromId(cameraId),
+    headingConfidence: 'low',
+    pitchDeg: -18,
+    fovDeg: 44,
+    rangeM: 145,
+    mountHeightM: 8,
+    // Calgary sits high on the prairie; the client's one-shot ground snap
+    // corrects this prior wherever 3D tiles are loaded.
+    groundElevationM: 1045,
+    feedType: 'image',
+    url: imageUrl,
+    snapshotUrl: imageUrl,
+    sourceKind: 'calgary-open-data',
+    license:
+      'Contains information licensed under the Open Government Licence – City of Calgary',
+    // Unselected-label code: the intersection, so a camera at rest reads as a
+    // place rather than as its id.
+    code: cameraDisplayCode(name.toUpperCase()),
+  };
+}
+
+/**
+ * Fetch City of Calgary traffic cameras from Open Calgary (Socrata dataset
+ * `k7p9-kppz`), keyless. Frames are stills on trafficcam.calgary.ca.
+ *
+ * @returns {Promise<Array<object>>} Normalized camera source objects.
+ */
+export async function loadCalgarySourcesFromOpenData() {
+  try {
+    const endpoint =
+      process.env.CCTV_CALGARY_ROWS_URL || DEFAULT_CALGARY_ROWS_URL;
+    const resp = await fetch(endpoint, {
+      headers: { Accept: 'application/json' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS),
+    });
+    // A response this loader will not read still owns its transport until the
+    // body is released, so every rejection path cancels before returning.
+    const discard = async () => {
+      try {
+        await resp.body?.cancel();
+      } catch {
+        /* no-op */
+      }
+      return [];
+    };
+    if (resp.status >= 300 && resp.status < 400) {
+      console.warn(
+        '[CCTV] Calgary catalog redirected; redirects are not followed',
+      );
+      return discard();
+    }
+    if (!resp.ok) {
+      console.warn('[CCTV] Calgary camera download failed:', resp.status);
+      return discard();
+    }
+    const rows = await readResponseJsonCapped(resp, CALGARY_MAX_CATALOG_BYTES);
+    if (!Array.isArray(rows)) return [];
+    const cameras = [];
+    const seen = new Set();
+    for (const record of rows) {
+      const camera = calgaryCameraToSource(record);
+      if (!camera || seen.has(camera.id)) continue;
+      seen.add(camera.id);
+      cameras.push(camera);
+    }
+    const maxRaw = Number(
+      process.env.CCTV_CALGARY_MAX_SOURCES || DEFAULT_CALGARY_MAX_SOURCES,
+    );
+    const maxCount = Number.isFinite(maxRaw)
+      ? Math.max(8, Math.min(400, Math.floor(maxRaw)))
+      : DEFAULT_CALGARY_MAX_SOURCES;
+    const prioritized = prioritizeSources(cameras, maxCount, [
+      CALGARY_DOWNTOWN,
+    ]);
+    console.log(
+      `[CCTV] Loaded Calgary camera sources: ${cameras.length} (using nearest ${prioritized.length})`,
+    );
+    return prioritized;
+  } catch (error) {
+    console.warn(
+      '[CCTV] Calgary camera download error:',
+      error?.message || error,
+    );
+    return [];
+  }
+}
diff --git a/src/data/cctvCalgary.test.mjs b/src/data/cctvCalgary.test.mjs
new file mode 100644
index 000000000..1295c536b
--- /dev/null
+++ b/src/data/cctvCalgary.test.mjs
@@ -0,0 +1,389 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  calgaryCameraId,
+  calgaryCameraName,
+  calgaryCameraToSource,
+  loadCalgarySourcesFromOpenData,
+  normalizeCalgaryImageUrl,
+} from '../../server/providers/cctv/sources.js';
+import {
+  CALGARY_IMAGE_ORIGIN,
+  CALGARY_MAX_CATALOG_BYTES,
+  DEFAULT_CALGARY_ROWS_URL,
+  DEFAULT_CCTV_MAX_SOURCES,
+} from '../../server/providers/cctv/constants.js';
+import { CAMERA_CODE_MAX_CHARS } from '../../server/providers/cctv/normalize.js';
+import { allocateSourceCap } from '../../server/providers/cctv/cap.js';
+import { createCctvCatalog } from '../../server/providers/cctv/catalog.js';
+import { directionToHeading } from './directionText.js';
+
+/**
+ * A response whose body is a live stream, plus a flag that flips when the
+ * stream is cancelled. A rejection path that returns without cancelling holds
+ * the transport open, so the flag is what the refusal tests actually assert.
+ */
+const streamingResponse = (init = {}) => {
+  const state = { cancelled: false };
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode('['));
+    },
+    cancel() {
+      state.cancelled = true;
+    },
+  });
+  return { response: new Response(body, init), state };
+};
+
+/** One Open Calgary row, shaped like the live `k7p9-kppz` payload. */
+const row = (overrides = {}) => ({
+  camera_url: {
+    url: 'http://trafficcam.calgary.ca/loc142.jpg',
+    description: 'Camera 143',
+  },
+  quadrant: 'SW',
+  camera_location: 'Bow Trail / 37 Street SW',
+  point: { type: 'Point', coordinates: [-114.1413616, 51.0453097] },
+  ...overrides,
+});
+
+test('a Calgary row maps to a source on the pinned HTTPS frame host', () => {
+  const source = calgaryCameraToSource(row());
+  assert.equal(source.id, 'calgary-142');
+  assert.equal(source.name, 'Bow Trail / 37 Street SW');
+  assert.equal(source.cityId, 'calgary');
+  assert.equal(source.provider, 'The City of Calgary');
+  assert.equal(source.lat, 51.0453097);
+  assert.equal(source.lon, -114.1413616);
+  assert.equal(source.feedType, 'image');
+  assert.equal(source.sourceKind, 'calgary-open-data');
+  assert.equal(
+    source.license,
+    'Contains information licensed under the Open Government Licence – City of Calgary',
+  );
+  // The catalog publishes http://; the registered URL is the upgraded one.
+  assert.equal(source.url, 'https://trafficcam.calgary.ca/loc142.jpg');
+  assert.equal(source.url, source.snapshotUrl);
+  assert.ok(source.url.startsWith(CALGARY_IMAGE_ORIGIN));
+});
+
+test('no heading is derived from the quadrant or the address suffix', () => {
+  // Both fields parse as a confident compass bearing, and both would be wrong
+  // for every camera in the city: they are Calgary's address grid, not a
+  // camera facing. Nobody may "fix" this by wiring either one up.
+  assert.equal(directionToHeading('SW', true), 225);
+  assert.equal(directionToHeading('Bow Trail / 37 Street SW', true), 225);
+
+  for (const quadrant of ['NE', 'NW', 'SE', 'SW', 'NW/NE', 'S']) {
+    const source = calgaryCameraToSource(row({ quadrant }));
+    assert.equal(source.headingConfidence, 'low');
+    assert.ok(Number.isFinite(source.headingDeg));
+    // Same id, same fallback heading, whatever the quadrant says.
+    assert.equal(source.headingDeg, calgaryCameraToSource(row()).headingDeg);
+  }
+});
+
+test('rows outside Calgary, off-host frames and unusable geometry are dropped', () => {
+  // Toronto: a plausible lat/lon, but not a Calgary camera.
+  assert.equal(
+    calgaryCameraToSource(
+      row({ point: { type: 'Point', coordinates: [-79.3832, 43.6532] } }),
+    ),
+    null,
+  );
+  // Null island, and the string coordinates that would become it.
+  assert.equal(
+    calgaryCameraToSource(
+      row({ point: { type: 'Point', coordinates: [0, 0] } }),
+    ),
+    null,
+  );
+  assert.equal(calgaryCameraToSource(row({ point: null })), null);
+  assert.equal(
+    calgaryCameraToSource(row({ point: { coordinates: [-114.14] } })),
+    null,
+  );
+  // A catalog edit cannot steer the frame proxy off the city host.
+  assert.equal(
+    calgaryCameraToSource(
+      row({ camera_url: { url: 'https://evil.example/loc1.jpg' } }),
+    ),
+    null,
+  );
+  assert.equal(
+    calgaryCameraToSource(
+      row({
+        camera_url: { url: 'https://trafficcam.calgary.ca.evil.test/1.jpg' },
+      }),
+    ),
+    null,
+  );
+  assert.equal(
+    calgaryCameraToSource(row({ camera_url: { url: 'file:///etc/passwd' } })),
+    null,
+  );
+  assert.equal(calgaryCameraToSource(row({ camera_url: null })), null);
+  assert.equal(calgaryCameraToSource(null), null);
+});
+
+test('frame URLs upgrade to HTTPS and ids stay stable', () => {
+  assert.equal(
+    normalizeCalgaryImageUrl('http://trafficcam.calgary.ca/loc86.jpg'),
+    'https://trafficcam.calgary.ca/loc86.jpg',
+  );
+  assert.equal(
+    normalizeCalgaryImageUrl('https://trafficcam.calgary.ca/loc86.jpg'),
+    'https://trafficcam.calgary.ca/loc86.jpg',
+  );
+  assert.equal(normalizeCalgaryImageUrl(''), null);
+  assert.equal(normalizeCalgaryImageUrl('not a url'), null);
+
+  assert.equal(
+    calgaryCameraId('https://trafficcam.calgary.ca/loc86.jpg'),
+    'calgary-86',
+  );
+  // A filename-scheme change degrades to a still-stable slug, not a dropped camera.
+  assert.equal(
+    calgaryCameraId('https://trafficcam.calgary.ca/cams/deerfoot_16av.jpg'),
+    'calgary-cams-deerfoot-16av',
+  );
+  assert.equal(calgaryCameraId(''), null);
+});
+
+test('a nameless row still gets a label', () => {
+  assert.equal(
+    calgaryCameraName(
+      { camera_location: '  9 Avenue / 3 Street SE ' },
+      'calgary-1',
+    ),
+    '9 Avenue / 3 Street SE',
+  );
+  assert.equal(
+    calgaryCameraName(
+      { camera_url: { description: 'Camera 12' } },
+      'calgary-11',
+    ),
+    'Camera 12',
+  );
+  assert.equal(calgaryCameraName({}, 'calgary-11'), 'Calgary Camera 11');
+});
+
+test('the loader reads the keyless catalog and collapses duplicate ids', async (t) => {
+  t.mock.method(console, 'log', () => {});
+  const requested = [];
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    requested.push(String(url));
+    return Response.json([
+      row(),
+      // Same frame file twice: one camera, not two.
+      row({ camera_location: 'Bow Trail / 37 Street SW (duplicate)' }),
+      row({
+        camera_url: { url: 'http://trafficcam.calgary.ca/loc86.jpg' },
+        camera_location: 'Stoney Trail / Deerfoot Trail SE',
+        point: { type: 'Point', coordinates: [-113.9766063, 50.9007257] },
+      }),
+      row({ camera_url: { url: 'https://evil.example/x.jpg' } }),
+    ]);
+  });
+  const cameras = await loadCalgarySourcesFromOpenData();
+  assert.deepEqual(requested, [DEFAULT_CALGARY_ROWS_URL]);
+  assert.deepEqual(
+    cameras.map((camera) => camera.id),
+    // Nearest downtown first: Bow Trail is inner-city, Stoney Trail is the ring road.
+    ['calgary-142', 'calgary-86'],
+  );
+  assert.equal(cameras[0].name, 'Bow Trail / 37 Street SW');
+});
+
+test('an upstream failure yields an empty pack and releases the response', async (t) => {
+  t.mock.method(console, 'warn', () => {});
+  // A 503 can still arrive with a streaming body; returning without cancelling
+  // it would hold the connection until the socket times out.
+  const failed = streamingResponse({ status: 503 });
+  t.mock.method(globalThis, 'fetch', async () => failed.response);
+  assert.deepEqual(await loadCalgarySourcesFromOpenData(), []);
+  assert.equal(failed.state.cancelled, true, 'the failed body is cancelled');
+
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    throw new Error('network down');
+  });
+  assert.deepEqual(await loadCalgarySourcesFromOpenData(), []);
+});
+
+test('the unselected label is the intersection, trimmed to the code width', () => {
+  assert.equal(calgaryCameraToSource(row()).code, 'BOW TRAIL / 37 STREET SW');
+  const long = calgaryCameraToSource(
+    row({
+      camera_location: 'Bow Trail & Old Banff Coach Rd SW / Strathcona Blvd SW',
+    }),
+  );
+  assert.equal(long.code.length, CAMERA_CODE_MAX_CHARS);
+  assert.ok(long.code.endsWith('…'));
+  assert.ok(long.code.startsWith('BOW TRAIL & OLD BANFF'));
+});
+
+test('the catalog fetch refuses redirects and oversized bodies', async (t) => {
+  t.mock.method(console, 'warn', () => {});
+  // A redirect is never followed: the list host cannot be steered. Its body is
+  // a live stream, so the test also proves the refusal releases the transport.
+  const seen = [];
+  const redirected = streamingResponse({
+    status: 302,
+    headers: { location: 'https://evil.example/rows.json' },
+  });
+  t.mock.method(globalThis, 'fetch', async (url, init) => {
+    seen.push([String(url), init.redirect]);
+    return redirected.response;
+  });
+  assert.deepEqual(await loadCalgarySourcesFromOpenData(), []);
+  assert.deepEqual(seen, [[DEFAULT_CALGARY_ROWS_URL, 'manual']]);
+  assert.equal(
+    redirected.state.cancelled,
+    true,
+    'the redirect body is cancelled',
+  );
+
+  // A body over the cap is refused rather than buffered.
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    const body = JSON.stringify([row()]);
+    return new Response(body, {
+      headers: {
+        'Content-Type': 'application/json',
+        'content-length': String(CALGARY_MAX_CATALOG_BYTES + 1),
+      },
+    });
+  });
+  assert.deepEqual(await loadCalgarySourcesFromOpenData(), []);
+
+  // So is a body that only declares its size once it is already too long.
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    const oversized = 'x'.repeat(CALGARY_MAX_CATALOG_BYTES + 1024);
+    return new Response(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode(oversized));
+          controller.close();
+        },
+      }),
+      { headers: { 'Content-Type': 'application/json' } },
+    );
+  });
+  assert.deepEqual(await loadCalgarySourcesFromOpenData(), []);
+});
+
+test('a reduced catalog cap thins every pack instead of dropping Calgary', () => {
+  // Calgary merges last in LIVE_PACKS, so a positional slice would delete it
+  // outright. The round-robin allocation must give it its share.
+  const lane = (name, count) => ({
+    name,
+    sources: Array.from({ length: count }, (_, i) => ({ id: `${name}-${i}` })),
+  });
+  const { sources, packs } = allocateSourceCap(
+    [lane('austin', 250), lane('nsw', 217), lane('calgary', 215)],
+    30,
+  );
+  assert.equal(sources.length, 30);
+  assert.deepEqual(
+    packs.map((p) => [p.name, p.kept]),
+    [
+      ['austin', 10],
+      ['nsw', 10],
+      ['calgary', 10],
+    ],
+  );
+  // Calgary contributes its own highest-priority cameras, in its own order.
+  assert.deepEqual(
+    sources.filter((s) => s.id.startsWith('calgary-')).map((s) => s.id),
+    Array.from({ length: 10 }, (_, i) => `calgary-${i}`),
+  );
+});
+
+/**
+ * Serve the Calgary catalog to the Calgary endpoint and an empty payload to
+ * every other pack, so one catalog refresh exercises the registration without
+ * reaching the network. Returns the URLs that were requested.
+ */
+const runCatalogWithMockedUpstreams = async (t) => {
+  const requested = [];
+  t.mock.method(console, 'log', () => {});
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    const href = String(url);
+    requested.push(href);
+    if (href.startsWith('https://data.calgary.ca/')) {
+      return Response.json([
+        row(),
+        row({
+          camera_url: { url: 'http://trafficcam.calgary.ca/loc86.jpg' },
+          camera_location: 'Stoney Trail / Deerfoot Trail SE',
+          point: { type: 'Point', coordinates: [-113.9766063, 50.9007257] },
+        }),
+      ]);
+    }
+    return Response.json([]);
+  });
+  // A source root with no curated catalogs or ground-height sidecar, so the
+  // file-based packs contribute nothing and only the live lanes are in play.
+  const sources = await createCctvCatalog({ sourceRoot: '/nonexistent' })();
+  return { requested, sources };
+};
+
+test('the Calgary lane is wired into the catalog and its loader runs', async (t) => {
+  const saved = { ...process.env };
+  try {
+    delete process.env.CCTV_SOURCES_FILE;
+    delete process.env.CCTV_SOURCES_JSON;
+    delete process.env.CCTV_CALGARY_ENABLED;
+    const { requested, sources } = await runCatalogWithMockedUpstreams(t);
+    assert.ok(
+      requested.includes(DEFAULT_CALGARY_ROWS_URL),
+      'the catalog refresh invokes the Calgary loader',
+    );
+    assert.deepEqual(
+      sources.filter((s) => s.cityId === 'calgary').map((s) => s.id),
+      ['calgary-142', 'calgary-86'],
+      'Calgary cameras reach the served catalog through the registered lane',
+    );
+  } finally {
+    for (const key of Object.keys(process.env)) {
+      if (!(key in saved)) delete process.env[key];
+    }
+    Object.assign(process.env, saved);
+  }
+});
+
+test('CCTV_CALGARY_ENABLED=0 keeps the lane from being loaded at all', async (t) => {
+  const saved = { ...process.env };
+  try {
+    delete process.env.CCTV_SOURCES_FILE;
+    delete process.env.CCTV_SOURCES_JSON;
+    process.env.CCTV_CALGARY_ENABLED = '0';
+    const { requested, sources } = await runCatalogWithMockedUpstreams(t);
+    assert.equal(
+      requested.includes(DEFAULT_CALGARY_ROWS_URL),
+      false,
+      'the disabled lane never reaches its upstream',
+    );
+    assert.deepEqual(
+      sources.filter((s) => s.cityId === 'calgary'),
+      [],
+    );
+  } finally {
+    for (const key of Object.keys(process.env)) {
+      if (!(key in saved)) delete process.env[key];
+    }
+    Object.assign(process.env, saved);
+  }
+});
+
+test('the shipped catalog ceiling is not raised to make room for this pack', () => {
+  assert.equal(DEFAULT_CCTV_MAX_SOURCES, 4000);
+});
diff --git a/src/data/dataCredits.js b/src/data/dataCredits.js
index 8fc891433..9642c95b5 100644
--- a/src/data/dataCredits.js
+++ b/src/data/dataCredits.js
@@ -163,6 +163,12 @@ export const DATA_CREDITS = [
       '<a href="https://www.digitraffic.fi/en/" target="_blank" rel="noopener">digitraffic.fi</a>, ' +
       'license CC BY 4.0',
   },
+  {
+    key: 'calgary-cctv',
+    html:
+      'Traffic cameras (Calgary): contains information licensed under the ' +
+      '<a href="https://data.calgary.ca/stories/s/Open-Calgary-Terms-of-Use/u45n-7awa" target="_blank" rel="noopener">Open Government Licence – City of Calgary</a>',
+  },
   {
     key: 'gbfs',
     html: 'Bikeshare availability: GBFS operator feeds (e.g. Austin BCycle)',
diff --git a/src/data/local_data/cctv_ground_heights/cctv_ground_heights.json b/src/data/local_data/cctv_ground_heights/cctv_ground_heights.json
index 902a69c72..bab2cd0af 100644
--- a/src/data/local_data/cctv_ground_heights/cctv_ground_heights.json
+++ b/src/data/local_data/cctv_ground_heights/cctv_ground_heights.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "provider": "google-3d-tiles",
   "heightReference": "WGS84-ellipsoid",
-  "generatedAt": "2026-09-14T01:42:02.486Z",
+  "generatedAt": "2026-09-14T04:04:45.702Z",
   "cameras": {
     "5": {
       "poseHash": "p1-kyfez8",
@@ -10454,6 +10454,4091 @@
         "tr": 176.89749451294594
       }
     },
+    "calgary-0": {
+      "poseHash": "p1-195joy4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:19.314Z",
+      "attempts": 1,
+      "mountGroundM": 1038.817061118294,
+      "supports": {
+        "bl": 1036.8468795558235,
+        "bm": 1035.8398202037843,
+        "br": 1035.496654573282,
+        "ml": 1036.7570795759968,
+        "mc": 1035.6039772969252,
+        "mr": 1036.022767541172,
+        "tl": 1043.5942708393704,
+        "tm": 1035.5808818108046,
+        "tr": 1034.9967841155963
+      }
+    },
+    "calgary-1": {
+      "poseHash": "p1-7n529m",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:26.277Z",
+      "attempts": 1,
+      "mountGroundM": 1031.877787177394,
+      "supports": {
+        "bl": 1032.6683845285825,
+        "bm": 1031.4132200360546,
+        "br": 1030.5340031305857,
+        "ml": 1032.6421663560222,
+        "mc": 1031.6361498968045,
+        "mr": 1030.4666034045415,
+        "tl": 1032.6608918253437,
+        "tm": 1032.1419254732511,
+        "tr": 1030.6407495368496
+      }
+    },
+    "calgary-10": {
+      "poseHash": "p1-gyxfk6",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:04.120Z",
+      "attempts": 1,
+      "mountGroundM": 1031.4723805661754,
+      "supports": {
+        "bl": 1024.2835562029532,
+        "bm": 1024.187299062153,
+        "br": 1023.5884687660221,
+        "ml": 1024.2816767929187,
+        "mc": 1023.9981378100123,
+        "mr": 1023.5415852152869,
+        "tl": 1024.209293204431,
+        "tm": 1023.9981205918513,
+        "tr": 1023.9469633384515
+      }
+    },
+    "calgary-100": {
+      "poseHash": "p1-7sy6oy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:40.022Z",
+      "attempts": 1,
+      "mountGroundM": 1085.353557501131,
+      "supports": {
+        "bl": 1073.6847230000217,
+        "bm": 1073.0937167346465,
+        "br": 1073.801434430099,
+        "ml": 1073.654888837818,
+        "mc": 1072.8700569664854,
+        "mr": 1073.5666430670117,
+        "tl": 1073.8705731848952,
+        "tm": 1072.0194510680556,
+        "tr": 1072.5998980349068
+      }
+    },
+    "calgary-101": {
+      "poseHash": "p1-mlpv6a",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:59.254Z",
+      "attempts": 1,
+      "mountGroundM": 1035.5324105597151,
+      "supports": {
+        "bl": 1029.6478863097846,
+        "bm": 1029.9665321118034,
+        "br": 1030.2717178020418,
+        "ml": 1029.4118906588421,
+        "mc": 1030.2342822435885,
+        "mr": 1030.0638904508926,
+        "tl": 1033.4812870264352,
+        "tm": 1038.3300180645674,
+        "tr": 1031.9454805838066
+      }
+    },
+    "calgary-103": {
+      "poseHash": "p1-e3efpk",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:25.130Z",
+      "attempts": 1,
+      "mountGroundM": 1038.6246029537024,
+      "supports": {
+        "bl": 1038.7244113089864,
+        "bm": 1055.2827551518885,
+        "br": 1041.0770044559385,
+        "ml": 1038.4922326439787,
+        "mc": 1052.3903970384836,
+        "mr": 1041.3741286440004,
+        "tl": 1038.4922444084755,
+        "tm": 1052.3904383672614,
+        "tr": 1052.4189850795638
+      }
+    },
+    "calgary-104": {
+      "poseHash": "p1-d3q4oy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:06.136Z",
+      "attempts": 1,
+      "mountGroundM": 1091.3278517149492,
+      "supports": {
+        "bl": 1092.7807078438436,
+        "bm": 1094.4334340853322,
+        "br": 1093.906826566112,
+        "ml": 1092.780711618014,
+        "mc": 1096.4870772113002,
+        "mr": 1093.9328520119282,
+        "tl": 1093.1078405931441,
+        "tm": 1097.8753618799974,
+        "tr": 1095.105687990778
+      }
+    },
+    "calgary-105": {
+      "poseHash": "p1-1lj109p",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:59.254Z",
+      "attempts": 1,
+      "mountGroundM": 1035.757846596028,
+      "supports": {
+        "bl": 1028.7677732868517,
+        "bm": 1028.6257333032954,
+        "br": 1027.657199696633,
+        "ml": 1028.7162974418202,
+        "mc": 1028.5620738361997,
+        "mr": 1028.3597413298517,
+        "tl": 1034.4974521508234,
+        "tm": 1028.6256871482228,
+        "tr": 1028.618349961483
+      }
+    },
+    "calgary-106": {
+      "poseHash": "p1-bhygsv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:22.527Z",
+      "attempts": 1,
+      "mountGroundM": 1067.0529246946423,
+      "supports": {
+        "bl": 1067.5654453397794,
+        "bm": 1067.2226665845455,
+        "br": 1073.500667652154,
+        "ml": 1067.641926943101,
+        "mc": 1067.4482190511792,
+        "mr": 1071.6459754692864,
+        "tl": 1067.7687463526452,
+        "tm": 1067.0326016823274,
+        "tr": 1068.968884266435
+      }
+    },
+    "calgary-107": {
+      "poseHash": "p1-ms9e4v",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1032.0449166554154,
+      "supports": {
+        "bl": 1048.5839104965696,
+        "bm": 1183.0658191694006,
+        "br": 1035.8799261886659,
+        "ml": 1031.7198012318104,
+        "mc": 1183.1635886786391,
+        "mr": 1032.0191603997569,
+        "tl": 1031.6959327268476,
+        "tm": 1183.877967452503,
+        "tr": 1032.2418560326978
+      }
+    },
+    "calgary-108": {
+      "poseHash": "p1-1b5pcdp",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:09.320Z",
+      "attempts": 1,
+      "mountGroundM": 1017.5331662084768,
+      "supports": {
+        "bl": 1018.07336411498,
+        "bm": 1016.6013431420506,
+        "br": 1024.4629521132924,
+        "ml": 1018.0114419967663,
+        "mc": 1016.6715443291183,
+        "mr": 1024.3091520998144,
+        "tl": 1018.0264513448002,
+        "tm": 1016.6715390583175,
+        "tr": 1024.4029364626406
+      }
+    },
+    "calgary-11": {
+      "poseHash": "p1-1wg8vhc",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:59.254Z",
+      "attempts": 1,
+      "mountGroundM": 1028.925252381737,
+      "supports": {
+        "bl": 1027.2089492028797,
+        "bm": 1027.7590594975038,
+        "br": 1028.8830218964636,
+        "ml": 1027.263262771952,
+        "mc": 1035.1070232730783,
+        "mr": 1028.8343406515953,
+        "tl": 1035.5685187069087,
+        "tm": 1038.8783608721083,
+        "tr": 1029.2689130812503
+      }
+    },
+    "calgary-110": {
+      "poseHash": "p1-1q9wp80",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:15.250Z",
+      "attempts": 1,
+      "mountGroundM": 1006.8289094252648,
+      "supports": {
+        "bl": 1003.784563978463,
+        "bm": 1004.2665129127964,
+        "br": 1012.2129898093458,
+        "ml": 1003.7281795793841,
+        "mc": 1004.5559415333037,
+        "mr": 1012.3895758684139,
+        "tl": 1003.6511053895624,
+        "tm": 1008.8424809173415,
+        "tr": 1008.6643372650399
+      }
+    },
+    "calgary-111": {
+      "poseHash": "p1-131ii7t",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:19.314Z",
+      "attempts": 1,
+      "mountGroundM": 1073.4077613564164,
+      "supports": {
+        "bl": 1067.4457027578585,
+        "bm": 1065.7228536296122,
+        "br": 1072.638844419004,
+        "ml": 1067.4456937190578,
+        "mc": 1073.3494091669866,
+        "mr": 1074.8384474456911,
+        "tl": 1072.3081630969193,
+        "tm": 1070.3640981185454,
+        "tr": 1065.6803535032534
+      }
+    },
+    "calgary-112": {
+      "poseHash": "p1-1s37bp6",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:23.562Z",
+      "attempts": 1,
+      "mountGroundM": 1093.7058050990638,
+      "supports": {
+        "bl": 1092.0457442499107,
+        "bm": 1104.5447207495142,
+        "br": 1090.5841139197316,
+        "ml": 1104.827338760409,
+        "mc": 1095.9659471297086,
+        "mr": 1090.2904376183667,
+        "tl": 1104.2907116147787,
+        "tm": 1090.6666473305122,
+        "tr": 1090.024626099893
+      }
+    },
+    "calgary-113": {
+      "poseHash": "p1-btzy5u",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:35.571Z",
+      "attempts": 1,
+      "mountGroundM": 1075.5732329031782,
+      "supports": {
+        "bl": 1076.166838190835,
+        "bm": 1076.2512631155223,
+        "br": 1076.6469472526392,
+        "ml": 1076.1830807808471,
+        "mc": 1076.5026578274424,
+        "mr": 1077.0959138616427,
+        "tl": 1076.1831023745158,
+        "tm": 1076.718660577401,
+        "tr": 1076.9506384393082
+      }
+    },
+    "calgary-114": {
+      "poseHash": "p1-e0e8rh",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:34.606Z",
+      "attempts": 1,
+      "mountGroundM": 1070.7975291250991,
+      "supports": {
+        "bl": 1069.16383167415,
+        "bm": 1073.2131436004086,
+        "br": 1072.7969022787715,
+        "ml": 1069.3997738885582,
+        "mc": 1073.213192994385,
+        "mr": 1073.5387205074092,
+        "tl": 1068.849886827112,
+        "tm": 1073.2411821630674,
+        "tr": 1073.6095324672135
+      }
+    },
+    "calgary-115": {
+      "poseHash": "p1-1pqs0dc",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:24.313Z",
+      "attempts": 1,
+      "mountGroundM": 1073.5189015175376,
+      "supports": {
+        "bl": 1065.9214737407913,
+        "bm": 1065.4266577221997,
+        "br": 1065.851121024597,
+        "ml": 1065.9569276805512,
+        "mc": 1066.0793719925978,
+        "mr": 1065.2522405914317,
+        "tl": 1065.9214924551761,
+        "tm": 1065.5991852534914,
+        "tr": 1064.9816930761249
+      }
+    },
+    "calgary-116": {
+      "poseHash": "p1-2cebt8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:59.254Z",
+      "attempts": 1,
+      "mountGroundM": 1030.9345217532573,
+      "supports": {
+        "bl": 1029.6691027852933,
+        "bm": 1028.9567544973338,
+        "br": 1029.2405663772595,
+        "ml": 1030.0342951030866,
+        "mc": 1028.9885822669007,
+        "mr": 1029.5478121891435,
+        "tl": 1030.3432927292768,
+        "tm": 1028.997865324935,
+        "tr": 1029.1450161383327
+      }
+    },
+    "calgary-117": {
+      "poseHash": "p1-9mymh2",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.762Z",
+      "attempts": 1,
+      "mountGroundM": 1019.7402558858777,
+      "supports": {
+        "bl": 1019.2639791737113,
+        "bm": 1019.9230514810603,
+        "br": 1022.0111266954437,
+        "ml": 1019.2658640527039,
+        "mc": 1019.7655010715484,
+        "mr": 1019.4123768108373,
+        "tl": 1019.500382253186,
+        "tm": 1023.5506784465255,
+        "tr": 1019.412369230448
+      }
+    },
+    "calgary-118": {
+      "poseHash": "p1-1gh4hqk",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:03.320Z",
+      "attempts": 1,
+      "mountGroundM": 1034.4800094625389,
+      "supports": {
+        "bl": 1026.9568007043538,
+        "bm": 1028.1750561500103,
+        "br": 1028.5874649740704,
+        "ml": 1027.2740695268271,
+        "mc": 1026.893093750859,
+        "mr": 1030.2044947470763,
+        "tl": 1027.49507090404,
+        "tm": 1026.706245304535,
+        "tr": 1029.8822010211165
+      }
+    },
+    "calgary-119": {
+      "poseHash": "p1-hqiytz",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:17.146Z",
+      "attempts": 1,
+      "mountGroundM": 1067.3662828769943,
+      "supports": {
+        "bl": 1063.3931903868672,
+        "bm": 1061.2232959176263,
+        "br": 1059.2301801989036,
+        "ml": 1062.936364923318,
+        "mc": 1059.7730228304888,
+        "mr": 1059.102666946491,
+        "tl": 1063.0054508911267,
+        "tm": 1060.827721271469,
+        "tr": 1059.1269511661035
+      }
+    },
+    "calgary-12": {
+      "poseHash": "p1-1r88slp",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:23.392Z",
+      "attempts": 1,
+      "mountGroundM": 1071.5270183159882,
+      "supports": {
+        "bl": 1072.332460645863,
+        "bm": 1072.306185595256,
+        "br": 1072.5282628871641,
+        "ml": 1071.8634530268425,
+        "mc": 1077.9718400304073,
+        "mr": 1076.3145637082996,
+        "tl": 1072.2976815631248,
+        "tm": 1072.624731122863,
+        "tr": 1073.3844725793667
+      }
+    },
+    "calgary-120": {
+      "poseHash": "p1-juayv5",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:07.069Z",
+      "attempts": 1,
+      "mountGroundM": 1069.457727963853,
+      "supports": {
+        "bl": 1074.3689947021994,
+        "bm": 1073.347661871743,
+        "br": 1070.3155227279408,
+        "ml": 1074.3689729882933,
+        "mc": 1073.0867271198154,
+        "mr": 1069.9762199346644,
+        "tl": 1074.2692975529437,
+        "tm": 1073.1091490411561,
+        "tr": 1069.183319935177
+      }
+    },
+    "calgary-121": {
+      "poseHash": "p1-wq73u7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1026.6409122342084,
+      "supports": {
+        "bl": 1022.3601700564847,
+        "bm": 1026.6846564046796,
+        "br": 1041.2593228902551,
+        "ml": 1022.3601239952986,
+        "mc": 1026.6376966785085,
+        "mr": 1048.7980069632254,
+        "tl": 1022.2050343498851,
+        "tm": 1026.6764613700966,
+        "tr": 1060.107874410982
+      }
+    },
+    "calgary-122": {
+      "poseHash": "p1-9txkar",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1031.0516477768483,
+      "supports": {
+        "bl": 1083.5934538459692,
+        "bm": 1030.736355458028,
+        "br": 1042.808705542313,
+        "ml": 1075.8733749391758,
+        "mc": 1031.23111884812,
+        "mr": 1042.976119957359,
+        "tl": 1071.3034787371823,
+        "tm": 1031.0902869715142,
+        "tr": 1043.1435178673732
+      }
+    },
+    "calgary-123": {
+      "poseHash": "p1-177bof4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:31.645Z",
+      "attempts": 1,
+      "mountGroundM": 1106.3612591608705,
+      "supports": {
+        "bl": 1113.2912649180118,
+        "bm": 1101.6964191354064,
+        "br": 1103.1676974208808,
+        "ml": 1105.011784455971,
+        "mc": 1102.4460445897796,
+        "mr": 1104.837752668836,
+        "tl": 1103.0921490366939,
+        "tm": 1102.3347653486205,
+        "tr": 1106.78427462223
+      }
+    },
+    "calgary-124": {
+      "poseHash": "p1-5m1g",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:43.024Z",
+      "attempts": 1,
+      "mountGroundM": 1056.9729701266217,
+      "supports": {
+        "bl": 1050.6928970590448,
+        "bm": 1059.1264887656287,
+        "br": 1058.5408034938196,
+        "ml": 1054.2213315915662,
+        "mc": 1059.4102602573084,
+        "mr": 1059.0878537746432,
+        "tl": 1054.0962770320268,
+        "tm": 1058.88199488204,
+        "tr": 1058.9683687505328
+      }
+    },
+    "calgary-125": {
+      "poseHash": "p1-1alcvtt",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:41.524Z",
+      "attempts": 1,
+      "mountGroundM": 1138.746267475122,
+      "supports": {
+        "bl": 1135.6864695374527,
+        "bm": 1140.887872189494,
+        "br": 1144.2916833045206,
+        "ml": 1135.5755973184916,
+        "mc": 1141.10590831462,
+        "mr": 1144.4478909813163,
+        "tl": 1135.8973885256578,
+        "tm": 1139.7552596462199,
+        "tr": 1145.8447245807904
+      }
+    },
+    "calgary-126": {
+      "poseHash": "p1-147bsx7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:26.659Z",
+      "attempts": 1,
+      "mountGroundM": 1128.5611113447158,
+      "supports": {
+        "bl": 1126.5000373404528,
+        "bm": 1129.2966833569392,
+        "br": 1128.853893131783,
+        "ml": 1128.0748942777886,
+        "mc": 1130.4828286826053,
+        "mr": 1127.4743288465986,
+        "tl": 1134.4532209106449,
+        "tm": 1141.7160116106427,
+        "tr": 1134.994095544858
+      }
+    },
+    "calgary-127": {
+      "poseHash": "p1-wd0pqb",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:12.532Z",
+      "attempts": 1,
+      "mountGroundM": 1061.9684112734078,
+      "supports": {
+        "bl": 1068.053688441989,
+        "bm": 1068.97618529315,
+        "br": 1061.5583020698973,
+        "ml": 1069.229456614062,
+        "mc": 1061.4330097689613,
+        "mr": 1061.4389510705178,
+        "tl": 1068.2888407853557,
+        "tm": 1061.5236884771475,
+        "tr": 1062.5488878137078
+      }
+    },
+    "calgary-128": {
+      "poseHash": "p1-1pnw53n",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:17.682Z",
+      "attempts": 1,
+      "mountGroundM": 1019.4162038889662,
+      "supports": {
+        "bl": 1016.181407335403,
+        "bm": 1016.7075902428289,
+        "br": 1017.6333134341987,
+        "ml": 1016.1438510523403,
+        "mc": 1016.7075906283459,
+        "mr": 1017.3968404703089,
+        "tl": 1016.213944779957,
+        "tm": 1016.4710547136934,
+        "tr": 1017.1134293942646
+      }
+    },
+    "calgary-129": {
+      "poseHash": "p1-1qoo0e8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1030.7904147478787,
+      "supports": {
+        "bl": 1032.1119153830564,
+        "bm": 1054.4356584646712,
+        "br": 1031.5098383330387,
+        "ml": 1033.0454570891811,
+        "mc": 1054.4858057016252,
+        "mr": 1038.6447989983662,
+        "tl": 1031.4238363857087,
+        "tm": 1054.6123579521507,
+        "tr": 1031.611882376286
+      }
+    },
+    "calgary-13": {
+      "poseHash": "p1-1t5gn1h",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.4320111954,
+      "supports": {
+        "bl": 1034.3756793576624,
+        "bm": 1039.8934310847706,
+        "br": 1034.182192324281,
+        "ml": 1034.6568794031487,
+        "mc": 1034.6874235142093,
+        "mr": 1034.0374089834024,
+        "tl": 1034.892824595297,
+        "tm": 1035.260245314753,
+        "tr": 1041.9487052887714
+      }
+    },
+    "calgary-130": {
+      "poseHash": "p1-18k8kv3",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:54.494Z",
+      "attempts": 1,
+      "mountGroundM": 1022.7176903282339,
+      "supports": {
+        "bl": 1030.1972057906682,
+        "bm": 1024.8777349206234,
+        "br": 1024.0511327378608,
+        "ml": 1034.720442849334,
+        "mc": 1024.7952963929672,
+        "mr": 1024.8422300938144,
+        "tl": 1023.5787029847911,
+        "tm": 1024.7109678482116,
+        "tr": 1025.4129926227663
+      }
+    },
+    "calgary-131": {
+      "poseHash": "p1-6s36r1",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:22.447Z",
+      "attempts": 1,
+      "mountGroundM": 1119.0094145617597,
+      "supports": {
+        "bl": 1115.5424675343975,
+        "bm": 1116.9805716619035,
+        "br": 1122.789688954792,
+        "ml": 1115.3315594680785,
+        "mc": 1116.8408903822976,
+        "mr": 1120.28775168373,
+        "tl": 1115.1907147834777,
+        "tm": 1116.7667687970018,
+        "tr": 1117.6829644922736
+      }
+    },
+    "calgary-132": {
+      "poseHash": "p1-i9zqgz",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:45.702Z",
+      "attempts": 1,
+      "mountGroundM": 1084.1618934256987,
+      "supports": {
+        "bl": 1082.499674211358,
+        "bm": 1074.0327251026247,
+        "br": 1076.1578912707644,
+        "ml": 1081.1755164119777,
+        "mc": 1074.032720160106,
+        "mr": 1075.5411900019133,
+        "tl": 1079.881180186506,
+        "tm": 1074.03269883776,
+        "tr": 1074.3141185950137
+      }
+    },
+    "calgary-133": {
+      "poseHash": "p1-16gal3s",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:25.158Z",
+      "attempts": 1,
+      "mountGroundM": 1093.5617862048402,
+      "supports": {
+        "bl": 1097.3897727480107,
+        "bm": 1091.968772889697,
+        "br": 1095.5599727758538,
+        "ml": 1097.5235236428853,
+        "mc": 1092.4111089557903,
+        "mr": 1096.0565785146764,
+        "tl": 1097.484489309698,
+        "tm": 1092.662033273592,
+        "tr": 1096.3829412542723
+      }
+    },
+    "calgary-134": {
+      "poseHash": "p1-la7bho",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:30.626Z",
+      "attempts": 1,
+      "mountGroundM": 1200.7496342470633,
+      "supports": {
+        "bl": 1190.662684269448,
+        "bm": 1189.6746986888609,
+        "br": 1189.701937320799,
+        "ml": 1191.2042854935137,
+        "mc": 1188.8393004841223,
+        "mr": 1189.2410815762476,
+        "tl": 1191.0665956053485,
+        "tm": 1188.841108732066,
+        "tr": 1189.241080219886
+      }
+    },
+    "calgary-135": {
+      "poseHash": "p1-1hl1psv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:37.893Z",
+      "attempts": 1,
+      "mountGroundM": 1245.9228388452855,
+      "supports": {
+        "bl": 1238.0797763944815,
+        "bm": 1240.3316725460609,
+        "br": 1242.7352503534844,
+        "ml": 1239.3000778229489,
+        "mc": 1239.0874838786062,
+        "mr": 1241.2364322701856,
+        "tl": 1240.8249777469134,
+        "tm": 1239.8190493106151,
+        "tr": 1241.103325238875
+      }
+    },
+    "calgary-136": {
+      "poseHash": "p1-iu0p11",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:44.219Z",
+      "attempts": 1,
+      "mountGroundM": 1110.5718002666285,
+      "supports": {
+        "bl": 1101.431095331843,
+        "bm": 1101.6199746566451,
+        "br": 1107.1019923889476,
+        "ml": 1101.564789599406,
+        "mc": 1101.7276921369876,
+        "mr": 1106.002072346585,
+        "tl": 1101.5203346833848,
+        "tm": 1101.4167958012313,
+        "tr": 1105.534399557827
+      }
+    },
+    "calgary-137": {
+      "poseHash": "p1-tmn63l",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:28.029Z",
+      "attempts": 1,
+      "mountGroundM": 1038.349798930455,
+      "supports": {
+        "bl": 1027.0780175405498,
+        "bm": 1027.956899322712,
+        "br": 1034.7727346730717,
+        "ml": 1027.8517041042055,
+        "mc": 1027.956898521438,
+        "mr": 1033.0050923447513,
+        "tl": 1028.0335442364606,
+        "tm": 1028.3036119251597,
+        "tr": 1031.537035512894
+      }
+    },
+    "calgary-138": {
+      "poseHash": "p1-dle3ax",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:30.545Z",
+      "attempts": 1,
+      "mountGroundM": 1143.2610394984229,
+      "supports": {
+        "bl": 1132.6415934476238,
+        "bm": 1139.6111352030948,
+        "br": 1129.991378519654,
+        "ml": 1132.2172643495924,
+        "mc": 1139.2102521937977,
+        "mr": 1129.4828025958475,
+        "tl": 1131.788532773711,
+        "tm": 1138.9183553095854,
+        "tr": 1130.360968908766
+      }
+    },
+    "calgary-139": {
+      "poseHash": "p1-b6i73y",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:57.889Z",
+      "attempts": 1,
+      "mountGroundM": 1070.8066834538963,
+      "supports": {
+        "bl": 1076.3262631728962,
+        "bm": 1071.1346513982844,
+        "br": 1078.3474368980874,
+        "ml": 1080.2259218259433,
+        "mc": 1070.970727913967,
+        "mr": 1078.4871566066415,
+        "tl": 1072.058593227289,
+        "tm": 1070.9204252391658,
+        "tr": 1077.4531237642295
+      }
+    },
+    "calgary-14": {
+      "poseHash": "p1-xu0q1k",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:37.909Z",
+      "attempts": 1,
+      "mountGroundM": 1049.2223451382717,
+      "supports": {
+        "bl": 1045.1643630334984,
+        "bm": 1043.6890897117312,
+        "br": 1042.6649563378671,
+        "ml": 1044.7808141529442,
+        "mc": 1043.1337095003444,
+        "mr": 1041.7508736040213,
+        "tl": 1043.6343088130538,
+        "tm": 1042.8906098910975,
+        "tr": 1041.2906886634205
+      }
+    },
+    "calgary-140": {
+      "poseHash": "p1-18lyzry",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:29.478Z",
+      "attempts": 1,
+      "mountGroundM": 1197.997456503762,
+      "supports": {
+        "bl": 1202.7237791481039,
+        "bm": 1199.173175919681,
+        "br": 1194.2848703260088,
+        "ml": 1199.4346162935901,
+        "mc": 1199.7853733650045,
+        "mr": 1194.084895677998,
+        "tl": 1203.1326957105582,
+        "tm": 1203.3595161318212,
+        "tr": 1193.8537142343725
+      }
+    },
+    "calgary-141": {
+      "poseHash": "p1-7nwe0p",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:12.385Z",
+      "attempts": 1,
+      "mountGroundM": 1068.7692674445464,
+      "supports": {
+        "bl": 1076.0467467759893,
+        "bm": 1077.7391126561188,
+        "br": 1068.3146444697063,
+        "ml": 1076.6537818429845,
+        "mc": 1078.2494547569067,
+        "mr": 1068.0855197520725,
+        "tl": 1075.1063734344273,
+        "tm": 1080.0933009375162,
+        "tr": 1069.6883390655112
+      }
+    },
+    "calgary-142": {
+      "poseHash": "p1-wytr4h",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:43.024Z",
+      "attempts": 1,
+      "mountGroundM": 1112.8226851133995,
+      "supports": {
+        "bl": 1111.9152361322042,
+        "bm": 1111.7289037702724,
+        "br": 1115.8765974422413,
+        "ml": 1112.0042076099232,
+        "mc": 1113.0166863913319,
+        "mr": 1112.452769987932,
+        "tl": 1112.293334385742,
+        "tm": 1115.9126675955342,
+        "tr": 1116.3147432593848
+      }
+    },
+    "calgary-143": {
+      "poseHash": "p1-nyl3bc",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1029.066337816229,
+      "supports": {
+        "bl": 1028.7872663854846,
+        "bm": 1038.0268248493107,
+        "br": 1135.875071612306,
+        "ml": 1028.8640715957533,
+        "mc": 1032.6583492862515,
+        "mr": 1139.1411977727932,
+        "tl": 1028.7854421832321,
+        "tm": 1032.6842770405237,
+        "tr": 1139.374491747171
+      }
+    },
+    "calgary-144": {
+      "poseHash": "p1-9ctiut",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:17.682Z",
+      "attempts": 1,
+      "mountGroundM": 1017.5411630853191,
+      "supports": {
+        "bl": 1018.754693630043,
+        "bm": 1017.0697523071915,
+        "br": 1016.8812691020238,
+        "ml": 1018.0592761252569,
+        "mc": 1016.7140255296669,
+        "mr": 1016.7836908922075,
+        "tl": 1018.3760694916049,
+        "tm": 1016.6915007903766,
+        "tr": 1016.7836981015118
+      }
+    },
+    "calgary-145": {
+      "poseHash": "p1-34zddf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:40.958Z",
+      "attempts": 1,
+      "mountGroundM": 1194.7931666502423,
+      "supports": {
+        "bl": 1195.451629486608,
+        "bm": 1193.5467492576774,
+        "br": 1197.4684496877808,
+        "ml": 1199.7055229148248,
+        "mc": 1193.3777545308951,
+        "mr": 1197.7471959684551,
+        "tl": 1194.8078151938214,
+        "tm": 1194.1259822408829,
+        "tr": 1198.9042365846485
+      }
+    },
+    "calgary-146": {
+      "poseHash": "p1-1byex75",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:42.853Z",
+      "attempts": 1,
+      "mountGroundM": 1078.3314082172924,
+      "supports": {
+        "bl": 1076.254985511173,
+        "bm": 1074.5331188527164,
+        "br": 1078.9734040044223,
+        "ml": 1077.9651070365999,
+        "mc": 1076.3905479357077,
+        "mr": 1079.2024914717788,
+        "tl": 1077.6092705797344,
+        "tm": 1078.5106427007477,
+        "tr": 1079.3351915675837
+      }
+    },
+    "calgary-147": {
+      "poseHash": "p1-1pixh6m",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:42.853Z",
+      "attempts": 1,
+      "mountGroundM": 1074.6615730114802,
+      "supports": {
+        "bl": 1075.1018935453014,
+        "bm": 1076.1495883221091,
+        "br": 1082.3986031081836,
+        "ml": 1075.1018858420393,
+        "mc": 1082.2947856800288,
+        "mr": 1082.8227614177695,
+        "tl": 1075.1525933329312,
+        "tm": 1075.654311437455,
+        "tr": 1075.8837818521513
+      }
+    },
+    "calgary-148": {
+      "poseHash": "p1-rd9hnm",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:29.791Z",
+      "attempts": 1,
+      "mountGroundM": 1082.0863485887496,
+      "supports": {
+        "bl": 1087.2041606340422,
+        "bm": 1082.302445169699,
+        "br": 1083.8542560735234,
+        "ml": 1087.3567537934575,
+        "mc": 1082.30056942682,
+        "mr": 1088.243804269969,
+        "tl": 1088.3268471659949,
+        "tm": 1082.3576148319116,
+        "tr": 1091.888164779023
+      }
+    },
+    "calgary-149": {
+      "poseHash": "p1-18tdqzj",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:40.022Z",
+      "attempts": 1,
+      "mountGroundM": 1136.461034385473,
+      "supports": {
+        "bl": 1139.2999492450028,
+        "bm": 1137.5910310158686,
+        "br": 1134.092564838026,
+        "ml": 1138.1879654987129,
+        "mc": 1137.7184740042562,
+        "mr": 1132.872291957897,
+        "tl": 1137.1147557173083,
+        "tm": 1137.9567150518064,
+        "tr": 1131.2488968726336
+      }
+    },
+    "calgary-15": {
+      "poseHash": "p1-14b37a3",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:23.562Z",
+      "attempts": 1,
+      "mountGroundM": 1090.3278467967634,
+      "supports": {
+        "bl": 1087.57347701668,
+        "bm": 1095.5949804393897,
+        "br": 1090.7404260905719,
+        "ml": 1087.143869321392,
+        "mc": 1095.7660175701171,
+        "mr": 1090.8331781753202,
+        "tl": 1086.0502607410504,
+        "tm": 1093.1799756779285,
+        "tr": 1090.4556807450563
+      }
+    },
+    "calgary-150": {
+      "poseHash": "p1-5rgbyo",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:28.242Z",
+      "attempts": 1,
+      "mountGroundM": 1120.6752512163991,
+      "supports": {
+        "bl": 1131.1418711650128,
+        "bm": 1130.6822195657069,
+        "br": 1133.170587472683,
+        "ml": 1130.460828511035,
+        "mc": 1131.175996465327,
+        "mr": 1134.5042709152738,
+        "tl": 1130.6565080393054,
+        "tm": 1131.9140673262732,
+        "tr": 1135.4695422813493
+      }
+    },
+    "calgary-151": {
+      "poseHash": "p1-12i8s26",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:21.878Z",
+      "attempts": 1,
+      "mountGroundM": 1074.2699119255765,
+      "supports": {
+        "bl": 1073.6079033989965,
+        "bm": 1074.7725590685445,
+        "br": 1072.7009672333395,
+        "ml": 1073.4439770590898,
+        "mc": 1075.484094617579,
+        "mr": 1072.7754836456281,
+        "tl": 1073.4439468741648,
+        "tm": 1073.3513252252176,
+        "tr": 1072.7009671049648
+      }
+    },
+    "calgary-152": {
+      "poseHash": "p1-mhj4ca",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1032.55971335767,
+      "supports": {
+        "bl": 1031.2857791831464,
+        "bm": 1045.061702657242,
+        "br": 1031.4829878226276,
+        "ml": 1031.2857914875592,
+        "mc": 1031.4644270653832,
+        "mr": 1031.7650729622164,
+        "tl": 1031.0986149923579,
+        "tm": 1038.348148245442,
+        "tr": 1032.1262411125288
+      }
+    },
+    "calgary-153": {
+      "poseHash": "p1-80hntg",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:32.324Z",
+      "attempts": 1,
+      "mountGroundM": 1232.7836112311518,
+      "supports": {
+        "bl": 1232.8072413485738,
+        "bm": 1233.8974352823127,
+        "br": 1235.1032562183334,
+        "ml": 1233.7876876611779,
+        "mc": 1233.724045866639,
+        "mr": 1233.9137922636482,
+        "tl": 1238.073290706236,
+        "tm": 1233.7240181502248,
+        "tr": 1237.3644304283519
+      }
+    },
+    "calgary-154": {
+      "poseHash": "p1-9wmsug",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:18.861Z",
+      "attempts": 1,
+      "mountGroundM": 1117.1956647671348,
+      "supports": {
+        "bl": 1131.2458400145251,
+        "bm": 1131.8136766328842,
+        "br": 1138.2136456522835,
+        "ml": 1132.1639540951485,
+        "mc": 1133.4948840147924,
+        "mr": 1138.9780253809051,
+        "tl": 1132.9872006965002,
+        "tm": 1134.576965021722,
+        "tr": 1139.2558188987618
+      }
+    },
+    "calgary-155": {
+      "poseHash": "p1-1vuhs6m",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:08.019Z",
+      "attempts": 1,
+      "mountGroundM": 1022.097620043783,
+      "supports": {
+        "bl": 1023.8657407325343,
+        "bm": 1040.4028278421215,
+        "br": 1026.3964945916237,
+        "ml": 1025.327961849093,
+        "mc": 1026.4604407506376,
+        "mr": 1025.0992273133832,
+        "tl": 1027.1744613616836,
+        "tm": 1026.053782010624,
+        "tr": 1024.86675520285
+      }
+    },
+    "calgary-156": {
+      "poseHash": "p1-i1l98g",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1027.4157408252947,
+      "supports": {
+        "bl": 1033.2841498861806,
+        "bm": 1028.6974605525295,
+        "br": 1027.6142957225693,
+        "ml": 1036.8742914126592,
+        "mc": 1027.6877876017347,
+        "mr": 1027.627381084611,
+        "tl": 1033.9164903680357,
+        "tm": 1030.059228600532,
+        "tr": 1027.7036221408416
+      }
+    },
+    "calgary-157": {
+      "poseHash": "p1-ycwed0",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1034.5790405258663,
+      "supports": {
+        "bl": 1034.7891611094449,
+        "bm": 1041.5428835509006,
+        "br": 1034.235238847511,
+        "ml": 1033.0992064022294,
+        "mc": 1034.3641892702867,
+        "mr": 1042.1479964848522,
+        "tl": 1047.577405474444,
+        "tm": 1033.6810347044595,
+        "tr": 1034.4887342116572
+      }
+    },
+    "calgary-158": {
+      "poseHash": "p1-185nnqs",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1026.914979091253,
+      "supports": {
+        "bl": 1063.5532860837986,
+        "bm": 1042.8053082438423,
+        "br": 1066.6932263318483,
+        "ml": 1063.3231916693076,
+        "mc": 1045.9573577821632,
+        "mr": 1066.7143271197128,
+        "tl": 1062.9770992129647,
+        "tm": 1042.6783789311296,
+        "tr": 1075.0771090492096
+      }
+    },
+    "calgary-16": {
+      "poseHash": "p1-xk6cqe",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:09.665Z",
+      "attempts": 1,
+      "mountGroundM": 1091.435358080193,
+      "supports": {
+        "bl": 1095.4728116998974,
+        "bm": 1094.8163465716937,
+        "br": 1089.9928059133063,
+        "ml": 1091.9283732380225,
+        "mc": 1102.7603153487478,
+        "mr": 1089.7864776447827,
+        "tl": 1091.7314758843747,
+        "tm": 1090.621527353908,
+        "tr": 1101.747562407627
+      }
+    },
+    "calgary-160": {
+      "poseHash": "p1-kau2bn",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1028.3860579681402,
+      "supports": {
+        "bl": 1032.7805153808154,
+        "bm": 1142.519486088942,
+        "br": 1029.1330104364706,
+        "ml": 1039.8232272582086,
+        "mc": 1138.6895299016028,
+        "mr": 1029.081500457997,
+        "tl": 1028.1614668669743,
+        "tm": 1034.6741595546962,
+        "tr": 1029.5651011056584
+      }
+    },
+    "calgary-161": {
+      "poseHash": "p1-kvz7r0",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1033.9620729255405,
+      "supports": {
+        "bl": 1036.899264205228,
+        "bm": 1041.7898927378671,
+        "br": 1038.1215587222696,
+        "ml": 1034.2408147139004,
+        "mc": 1042.3479859842876,
+        "mr": 1034.9379096599755,
+        "tl": 1034.1416909708996,
+        "tm": 1034.5718109598322,
+        "tr": 1034.7053708568967
+      }
+    },
+    "calgary-162": {
+      "poseHash": "p1-1t2tjdi",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:32.344Z",
+      "attempts": 1,
+      "mountGroundM": 1034.21528657168,
+      "supports": {
+        "bl": 1035.017711168027,
+        "bm": 1033.7937271974663,
+        "br": 1037.0064439014511,
+        "ml": 1052.5521573048802,
+        "mc": 1033.7918782592678,
+        "mr": 1067.1897353905233,
+        "tl": 1050.972924854014,
+        "tm": 1033.902295178934,
+        "tr": 1067.0515455976622
+      }
+    },
+    "calgary-163": {
+      "poseHash": "p1-feal0m",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1028.2313779859328,
+      "supports": {
+        "bl": 1029.0779052953342,
+        "bm": 1162.3673162164803,
+        "br": 1170.0383301922257,
+        "ml": 1028.8418311586674,
+        "mc": 1162.367316775318,
+        "mr": 1186.9754968615157,
+        "tl": 1028.8418031108517,
+        "tm": 1150.5363495662646,
+        "tr": 1028.010112901908
+      }
+    },
+    "calgary-164": {
+      "poseHash": "p1-75vitw",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1040.9191627699577,
+      "supports": {
+        "bl": 1055.5860117143975,
+        "bm": 1034.8535884669886,
+        "br": 1040.4000700988524,
+        "ml": 1055.5860254620395,
+        "mc": 1034.8536005215667,
+        "mr": 1034.8255670323113,
+        "tl": 1055.5860228419956,
+        "tm": 1034.4232484528545,
+        "tr": 1034.3973424986455
+      }
+    },
+    "calgary-165": {
+      "poseHash": "p1-11lcdg7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:30.545Z",
+      "attempts": 1,
+      "mountGroundM": 1116.2646848003512,
+      "supports": {
+        "bl": 1115.4780043451478,
+        "bm": 1115.4854222035378,
+        "br": 1119.294566869563,
+        "ml": 1114.9037019356524,
+        "mc": 1115.4743328868392,
+        "mr": 1117.2424067897782,
+        "tl": 1120.242025825027,
+        "tm": 1114.888886696664,
+        "tr": 1130.0862890084165
+      }
+    },
+    "calgary-166": {
+      "poseHash": "p1-ey754z",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:40.341Z",
+      "attempts": 1,
+      "mountGroundM": 1215.3177192601663,
+      "supports": {
+        "bl": 1221.7173040265416,
+        "bm": 1216.5226759248683,
+        "br": 1216.4164064363301,
+        "ml": 1223.160358704447,
+        "mc": 1216.5464820152997,
+        "mr": 1216.416425082794,
+        "tl": 1224.5704760005701,
+        "tm": 1216.6160165968047,
+        "tr": 1216.6765842615628
+      }
+    },
+    "calgary-167": {
+      "poseHash": "p1-1r3v82z",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1024.7531736532649,
+      "supports": {
+        "bl": 1039.2336362356664,
+        "bm": 1025.007016132883,
+        "br": 1024.9637239413196,
+        "ml": 1025.3059772760837,
+        "mc": 1041.1995851886206,
+        "mr": 1025.0855464115969,
+        "tl": 1025.7687376097479,
+        "tm": 1042.791499209496,
+        "tr": 1025.1548733090353
+      }
+    },
+    "calgary-168": {
+      "poseHash": "p1-khkxfe",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1031.3155417574815,
+      "supports": {
+        "bl": 1031.279816931042,
+        "bm": 1057.542233845055,
+        "br": 1032.0503202665532,
+        "ml": 1031.8470787783165,
+        "mc": 1050.3990152349938,
+        "mr": 1032.2152849917904,
+        "tl": 1031.2487348236884,
+        "tm": 1039.1858347504246,
+        "tr": 1032.628736811258
+      }
+    },
+    "calgary-17": {
+      "poseHash": "p1-g5nyxy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:06.349Z",
+      "attempts": 1,
+      "mountGroundM": 1031.8414820934934,
+      "supports": {
+        "bl": 1034.6199266577582,
+        "bm": 1024.1802499037233,
+        "br": 1026.303356676765,
+        "ml": 1034.9576297574813,
+        "mc": 1024.2852000330986,
+        "mr": 1025.6966313367707,
+        "tl": 1034.9927038413493,
+        "tm": 1024.3301557860693,
+        "tr": 1025.2597963851358
+      }
+    },
+    "calgary-170": {
+      "poseHash": "p1-vcwgqh",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1031.2889742646303,
+      "supports": {
+        "bl": 1032.577266372045,
+        "bm": 1060.2668084701654,
+        "br": 1048.777695274312,
+        "ml": 1031.0734715266515,
+        "mc": 1068.9564958493847,
+        "mr": 1030.5517049915004,
+        "tl": 1040.1469921768917,
+        "tm": 1068.956512273172,
+        "tr": 1030.5516919516142
+      }
+    },
+    "calgary-172": {
+      "poseHash": "p1-jxcan4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:41.170Z",
+      "attempts": 1,
+      "mountGroundM": 1047.6038560231118,
+      "supports": {
+        "bl": 1061.0795517592333,
+        "bm": 1060.2316000804224,
+        "br": 1059.2834199675542,
+        "ml": 1059.74226740709,
+        "mc": 1060.8383010570753,
+        "mr": 1058.8228609756982,
+        "tl": 1060.245108138716,
+        "tm": 1059.701377020066,
+        "tr": 1057.8818762146334
+      }
+    },
+    "calgary-173": {
+      "poseHash": "p1-192uj19",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:08.049Z",
+      "attempts": 1,
+      "mountGroundM": 1223.3055605586555,
+      "supports": {
+        "bl": 1230.8616259872513,
+        "bm": 1225.9699651992362,
+        "br": 1229.9454351512138,
+        "ml": 1226.2400527357624,
+        "mc": 1225.445544831567,
+        "mr": 1225.975168169289,
+        "tl": 1221.788347768796,
+        "tm": 1232.2452453266817,
+        "tr": 1221.666800926849
+      }
+    },
+    "calgary-174": {
+      "poseHash": "p1-govra5",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:28.728Z",
+      "attempts": 1,
+      "mountGroundM": 1179.2260265735076,
+      "supports": {
+        "bl": 1176.1150152717819,
+        "bm": 1176.1973191104235,
+        "br": 1179.6467240345362,
+        "ml": 1176.0432943331584,
+        "mc": 1176.037256978295,
+        "mr": 1180.3664535980292,
+        "tl": 1176.0432958878189,
+        "tm": 1176.1108564624283,
+        "tr": 1178.1558925036163
+      }
+    },
+    "calgary-175": {
+      "poseHash": "p1-3eauck",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:55.357Z",
+      "attempts": 1,
+      "mountGroundM": 1038.3815453480709,
+      "supports": {
+        "bl": 1035.3107958727926,
+        "bm": 1032.5883764674654,
+        "br": 1030.7471582036392,
+        "ml": 1034.6202279743104,
+        "mc": 1032.9185111211646,
+        "mr": 1030.7431587505012,
+        "tl": 1034.1549893814226,
+        "tm": 1033.019675442306,
+        "tr": 1031.2302762441127
+      }
+    },
+    "calgary-176": {
+      "poseHash": "p1-15ue1mc",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:10.751Z",
+      "attempts": 1,
+      "mountGroundM": 1013.6763621897684,
+      "supports": {
+        "bl": 1008.220911177265,
+        "bm": 1011.2134663124308,
+        "br": 1007.249678063618,
+        "ml": 1008.0818649164379,
+        "mc": 1011.3336290236833,
+        "mr": 1005.9508374571159,
+        "tl": 1008.8424201455056,
+        "tm": 1011.1514174394496,
+        "tr": 1006.8412394904802
+      }
+    },
+    "calgary-177": {
+      "poseHash": "p1-xg5f8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:33.790Z",
+      "attempts": 1,
+      "mountGroundM": 1062.6953582355675,
+      "supports": {
+        "bl": 1056.0416514672052,
+        "bm": 1058.8002766776642,
+        "br": 1062.9456748734383,
+        "ml": 1055.5373650637264,
+        "mc": 1058.1747600226474,
+        "mr": 1061.489658829322,
+        "tl": 1054.8593643604947,
+        "tm": 1057.7863580802375,
+        "tr": 1061.3870849816535
+      }
+    },
+    "calgary-178": {
+      "poseHash": "p1-ov8swt",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1026.4067213368314,
+      "supports": {
+        "bl": 1026.0465645881288,
+        "bm": 1055.331240617235,
+        "br": 1026.5609592481303,
+        "ml": 1027.5786261839323,
+        "mc": 1055.5609630937117,
+        "mr": 1026.5609538275771,
+        "tl": 1031.5492275814374,
+        "tm": 1058.6068839585985,
+        "tr": 1026.5609320082547
+      }
+    },
+    "calgary-179": {
+      "poseHash": "p1-173on4k",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:56.923Z",
+      "attempts": 1,
+      "mountGroundM": 1111.0755526813637,
+      "supports": {
+        "bl": 1109.27552587825,
+        "bm": 1098.3292515208398,
+        "br": 1099.7259740905504,
+        "ml": 1108.9155501828816,
+        "mc": 1098.62444968141,
+        "mr": 1100.1103588913795,
+        "tl": 1108.6427672647033,
+        "tm": 1098.0358823972085,
+        "tr": 1100.17904545447
+      }
+    },
+    "calgary-18": {
+      "poseHash": "p1-1inlxkm",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:37.909Z",
+      "attempts": 1,
+      "mountGroundM": 1021.1557287825459,
+      "supports": {
+        "bl": 1023.4666027150937,
+        "bm": 1023.9172940553678,
+        "br": 1024.298625019914,
+        "ml": 1028.1923235285062,
+        "mc": 1026.8020096315654,
+        "mr": 1025.3972811176036,
+        "tl": 1028.881695109775,
+        "tm": 1027.3241653705886,
+        "tr": 1020.3840986325274
+      }
+    },
+    "calgary-180": {
+      "poseHash": "p1-1doy829",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:11.629Z",
+      "attempts": 1,
+      "mountGroundM": 1067.7995290574645,
+      "supports": {
+        "bl": 1074.224975080035,
+        "bm": 1074.5766087338363,
+        "br": 1076.1473779470916,
+        "ml": 1073.0279913311342,
+        "mc": 1074.6305983716902,
+        "mr": 1077.7420792556773,
+        "tl": 1078.35948883009,
+        "tm": 1076.3228696793901,
+        "tr": 1083.0081132631415
+      }
+    },
+    "calgary-181": {
+      "poseHash": "p1-14dw0mv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1031.1136724391863,
+      "supports": {
+        "bl": 1031.4918431639317,
+        "bm": 1040.6367672244212,
+        "br": 1036.1368128003394,
+        "ml": 1031.497660655799,
+        "mc": 1037.8304201454364,
+        "mr": 1031.221281547251,
+        "tl": 1031.4661555975529,
+        "tm": 1031.6630937443333,
+        "tr": 1031.1843896987011
+      }
+    },
+    "calgary-182": {
+      "poseHash": "p1-17riwm4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1031.8914481746456,
+      "supports": {
+        "bl": 1040.3824326610272,
+        "bm": 1040.4190592902125,
+        "br": 1042.2829801653147,
+        "ml": 1032.1552627022052,
+        "mc": 1031.9691976339761,
+        "mr": 1062.6759496523775,
+        "tl": 1041.741115654082,
+        "tm": 1033.3341848363646,
+        "tr": 1066.6352296850214
+      }
+    },
+    "calgary-183": {
+      "poseHash": "p1-1mmsl3b",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:43.553Z",
+      "attempts": 1,
+      "mountGroundM": 1146.0653505691962,
+      "supports": {
+        "bl": 1150.682474175039,
+        "bm": 1142.4300153876015,
+        "br": 1142.340069376542,
+        "ml": 1143.9975865263482,
+        "mc": 1147.9929881241553,
+        "mr": 1138.921927236772,
+        "tl": 1143.9308810359535,
+        "tm": 1147.9078425469215,
+        "tr": 1138.7961401282491
+      }
+    },
+    "calgary-184": {
+      "poseHash": "p1-12er741",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1029.643224012535,
+      "supports": {
+        "bl": 1054.4716093121917,
+        "bm": 1029.3535530603426,
+        "br": 1037.7878947386755,
+        "ml": 1054.089897384677,
+        "mc": 1030.5502088494513,
+        "mr": 1030.712827588512,
+        "tl": 1053.937400816741,
+        "tm": 1029.25127922074,
+        "tr": 1028.8252038233354
+      }
+    },
+    "calgary-185": {
+      "poseHash": "p1-1iaf7fr",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.102324663371,
+      "supports": {
+        "bl": 1032.6676322178084,
+        "bm": 1032.3159469289317,
+        "br": 1032.5941888373206,
+        "ml": 1032.2838428650734,
+        "mc": 1033.5328695782323,
+        "mr": 1032.9915227990116,
+        "tl": 1032.291349173752,
+        "tm": 1033.8642226050274,
+        "tr": 1033.3066338205592
+      }
+    },
+    "calgary-186": {
+      "poseHash": "p1-77g7g4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:52.727Z",
+      "attempts": 1,
+      "mountGroundM": 1075.5316992504495,
+      "supports": {
+        "bl": 1076.2978698645143,
+        "bm": 1068.2775483458208,
+        "br": 1069.1644718979524,
+        "ml": 1073.9838149847048,
+        "mc": 1068.2775250246254,
+        "mr": 1068.9179425722668,
+        "tl": 1073.0596802163377,
+        "tm": 1068.2745888336378,
+        "tr": 1068.6234671425934
+      }
+    },
+    "calgary-187": {
+      "poseHash": "p1-170n6xe",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:28.242Z",
+      "attempts": 1,
+      "mountGroundM": 1054.9793624556412,
+      "supports": {
+        "bl": 1058.004019326897,
+        "bm": 1056.9750546158816,
+        "br": 1061.3586963851933,
+        "ml": 1058.5321248505181,
+        "mc": 1057.3957232307098,
+        "mr": 1061.3587114798531,
+        "tl": 1067.6584195741762,
+        "tm": 1057.4685779925949,
+        "tr": 1066.311207924345
+      }
+    },
+    "calgary-188": {
+      "poseHash": "p1-1ly08f4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:53.524Z",
+      "attempts": 1,
+      "mountGroundM": 1036.2116190551908,
+      "supports": {
+        "bl": 1029.9842659684964,
+        "bm": 1029.314429378205,
+        "br": 1028.2179347173387,
+        "ml": 1029.6451133265473,
+        "mc": 1029.3507845911442,
+        "mr": 1027.507642424243,
+        "tl": 1029.5158087378522,
+        "tm": 1029.2102306343581,
+        "tr": 1027.2490002252696
+      }
+    },
+    "calgary-189": {
+      "poseHash": "p1-1mlazao",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:05.535Z",
+      "attempts": 1,
+      "mountGroundM": 1109.2423556616368,
+      "supports": {
+        "bl": 1101.4235022385765,
+        "bm": 1106.4229545226435,
+        "br": 1105.1918139737202,
+        "ml": 1101.1025384841787,
+        "mc": 1103.004196894385,
+        "mr": 1105.848878330833,
+        "tl": 1102.558283611145,
+        "tm": 1100.6916037369913,
+        "tr": 1106.3731107422573
+      }
+    },
+    "calgary-19": {
+      "poseHash": "p1-geofsf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:37.909Z",
+      "attempts": 1,
+      "mountGroundM": 1042.3487232046193,
+      "supports": {
+        "bl": 1023.2749058176935,
+        "bm": 1018.3839064264956,
+        "br": 1018.0364291048928,
+        "ml": 1016.3691188823404,
+        "mc": 1016.0148686198926,
+        "mr": 1016.1230097918773,
+        "tl": 1016.0220175166293,
+        "tm": 1015.8779279094992,
+        "tr": 1016.122963971738
+      }
+    },
+    "calgary-190": {
+      "poseHash": "p1-1f7a9nw",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1029.2836529482004,
+      "supports": {
+        "bl": 1027.9761041121626,
+        "bm": 1029.5303894073886,
+        "br": 1035.2299087607116,
+        "ml": 1028.2122033292667,
+        "mc": 1029.4206194674355,
+        "mr": 1035.1026455596914,
+        "tl": 1027.8109239434032,
+        "tm": 1029.360764011603,
+        "tr": 1034.9266156763379
+      }
+    },
+    "calgary-191": {
+      "poseHash": "p1-6w2hkr",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:36.871Z",
+      "attempts": 1,
+      "mountGroundM": 1089.3083562154845,
+      "supports": {
+        "bl": 1088.8940692064493,
+        "bm": 1087.5717943311126,
+        "br": 1088.275801765094,
+        "ml": 1088.3211860646995,
+        "mc": 1087.9178382776443,
+        "mr": 1096.5545049292878,
+        "tl": 1094.6694461286158,
+        "tm": 1095.131897242198,
+        "tr": 1095.2212220465906
+      }
+    },
+    "calgary-192": {
+      "poseHash": "p1-8blaur",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:36.871Z",
+      "attempts": 1,
+      "mountGroundM": 1086.5164279558903,
+      "supports": {
+        "bl": 1084.5544417253243,
+        "bm": 1085.7489371062438,
+        "br": 1088.2309796038037,
+        "ml": 1084.5357780682978,
+        "mc": 1085.5312420124221,
+        "mr": 1090.3014806177405,
+        "tl": 1085.1108979122212,
+        "tm": 1085.1125808693075,
+        "tr": 1090.4317189202764
+      }
+    },
+    "calgary-193": {
+      "poseHash": "p1-1qw5tsf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:11.585Z",
+      "attempts": 1,
+      "mountGroundM": 1103.592716250914,
+      "supports": {
+        "bl": 1096.1628412440189,
+        "bm": 1097.3795161456105,
+        "br": 1097.0051614171678,
+        "ml": 1096.0084459034022,
+        "mc": 1097.8455196874854,
+        "mr": 1097.1872543937554,
+        "tl": 1096.2295181766658,
+        "tm": 1098.0163084731469,
+        "tr": 1097.2392642610753
+      }
+    },
+    "calgary-194": {
+      "poseHash": "p1-bwwppb",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:22.447Z",
+      "attempts": 1,
+      "mountGroundM": 1100.854670477858,
+      "supports": {
+        "bl": 1102.9524270228817,
+        "bm": 1093.806535357073,
+        "br": 1095.8546137554215,
+        "ml": 1102.6756879999123,
+        "mc": 1095.427403819041,
+        "mr": 1095.9140047583799,
+        "tl": 1102.367040916239,
+        "tm": 1096.2433994541302,
+        "tr": 1095.262521835074
+      }
+    },
+    "calgary-195": {
+      "poseHash": "p1-3cdws",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:16.033Z",
+      "attempts": 1,
+      "mountGroundM": 1017.0166943232875,
+      "supports": {
+        "bl": 1015.0453138149622,
+        "bm": 1015.3948864765662,
+        "br": 1016.3806630646759,
+        "ml": 1015.0584636342785,
+        "mc": 1015.4305753774422,
+        "mr": 1016.5025962620101,
+        "tl": 1015.347567616351,
+        "tm": 1014.9574911387158,
+        "tr": 1017.6466430391355
+      }
+    },
+    "calgary-196": {
+      "poseHash": "p1-1ktbr8o",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:08.769Z",
+      "attempts": 1,
+      "mountGroundM": 999.0776724790534,
+      "supports": {
+        "bl": 1005.5767485140489,
+        "bm": 1005.4061284194033,
+        "br": 1000.6312826906338,
+        "ml": 1006.6260896189341,
+        "mc": 999.7359942767176,
+        "mr": 1005.4568387577234,
+        "tl": 1002.786585464516,
+        "tm": 999.0081532253504,
+        "tr": 1006.0605708482587
+      }
+    },
+    "calgary-197": {
+      "poseHash": "p1-k63jpw",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:35.571Z",
+      "attempts": 1,
+      "mountGroundM": 1074.0332460718587,
+      "supports": {
+        "bl": 1073.537668086985,
+        "bm": 1072.2430439004504,
+        "br": 1083.393574098429,
+        "ml": 1074.3610747130856,
+        "mc": 1073.0351118459612,
+        "mr": 1083.410280458339,
+        "tl": 1074.3145145885069,
+        "tm": 1073.5606654912483,
+        "tr": 1083.952187345571
+      }
+    },
+    "calgary-198": {
+      "poseHash": "p1-z4tvoj",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:50.992Z",
+      "attempts": 1,
+      "mountGroundM": 1047.3906989196166,
+      "supports": {
+        "bl": 1048.1501026790056,
+        "bm": 1055.7386616068827,
+        "br": 1050.440283712785,
+        "ml": 1047.6174537612012,
+        "mc": 1056.6931615987949,
+        "mr": 1050.5195617560837,
+        "tl": 1047.8717607532492,
+        "tm": 1058.0716462663183,
+        "tr": 1050.809140309593
+      }
+    },
+    "calgary-199": {
+      "poseHash": "p1-88lt9w",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:32.324Z",
+      "attempts": 1,
+      "mountGroundM": 1169.958974166842,
+      "supports": {
+        "bl": 1169.9073902092775,
+        "bm": 1165.9740435342353,
+        "br": 1167.060973448741,
+        "ml": 1169.817187578031,
+        "mc": 1165.5706989419473,
+        "mr": 1167.0609519166328,
+        "tl": 1169.6809474484446,
+        "tm": 1165.443593002129,
+        "tr": 1166.6464869170827
+      }
+    },
+    "calgary-2": {
+      "poseHash": "p1-17v2pa4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:26.277Z",
+      "attempts": 1,
+      "mountGroundM": 1029.4722488190039,
+      "supports": {
+        "bl": 1027.4407017633116,
+        "bm": 1027.9512244961572,
+        "br": 1027.985017025052,
+        "ml": 1027.957773455577,
+        "mc": 1034.6640132352882,
+        "mr": 1028.142302487337,
+        "tl": 1027.712978171141,
+        "tm": 1031.868781244477,
+        "tr": 1030.7645957308066
+      }
+    },
+    "calgary-20": {
+      "poseHash": "p1-mss17x",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:37.909Z",
+      "attempts": 1,
+      "mountGroundM": 1036.7972296463208,
+      "supports": {
+        "bl": 1024.1196451624376,
+        "bm": 1023.5685444164842,
+        "br": 1031.574315702694,
+        "ml": 1024.1196492610018,
+        "mc": 1023.4262447562149,
+        "mr": 1031.287610954209,
+        "tl": 1024.75911023473,
+        "tm": 1023.491866717874,
+        "tr": 1031.741089812932
+      }
+    },
+    "calgary-200": {
+      "poseHash": "p1-os9j7l",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:21.431Z",
+      "attempts": 1,
+      "mountGroundM": 1012.6628359184875,
+      "supports": {
+        "bl": 1006.1696167258539,
+        "bm": 1006.1360514155125,
+        "br": 1005.5390582656054,
+        "ml": 1006.2062984124995,
+        "mc": 1005.8299905816247,
+        "mr": 1005.398064448482,
+        "tl": 1006.0240980790633,
+        "tm": 1005.627109634906,
+        "tr": 1005.6098096919953
+      }
+    },
+    "calgary-201": {
+      "poseHash": "p1-13l8upp",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:37.909Z",
+      "attempts": 1,
+      "mountGroundM": 1048.6057078178178,
+      "supports": {
+        "bl": 1056.031836181251,
+        "bm": 1059.867339133271,
+        "br": 1052.4515848510205,
+        "ml": 1057.8484205617383,
+        "mc": 1060.0262237544289,
+        "mr": 1051.5615233778456,
+        "tl": 1057.8129088499459,
+        "tm": 1047.2001312738107,
+        "tr": 1047.3461714789294
+      }
+    },
+    "calgary-202": {
+      "poseHash": "p1-gpkiwu",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1030.8559289424584,
+      "supports": {
+        "bl": 1031.8181276176792,
+        "bm": 1039.9878796878895,
+        "br": 1030.4758990267746,
+        "ml": 1031.3268258799035,
+        "mc": 1039.965423120424,
+        "mr": 1030.571114581577,
+        "tl": 1031.1964975071958,
+        "tm": 1031.5373931692461,
+        "tr": 1030.7552209404546
+      }
+    },
+    "calgary-203": {
+      "poseHash": "p1-wsroft",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:08.019Z",
+      "attempts": 1,
+      "mountGroundM": 1030.3374365236548,
+      "supports": {
+        "bl": 1038.2009606466133,
+        "bm": 1031.290052240127,
+        "br": 1033.4156882370246,
+        "ml": 1032.7430889017248,
+        "mc": 1031.6983989989965,
+        "mr": 1036.4572433370972,
+        "tl": 1033.5585002660962,
+        "tm": 1032.024313132721,
+        "tr": 1032.9234257971068
+      }
+    },
+    "calgary-204": {
+      "poseHash": "p1-1usi7kx",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:33.059Z",
+      "attempts": 1,
+      "mountGroundM": 1219.9597225410662,
+      "supports": {
+        "bl": 1223.3957820019377,
+        "bm": 1225.030815081862,
+        "br": 1225.0359068271812,
+        "ml": 1228.0771076027565,
+        "mc": 1223.9275245422502,
+        "mr": 1225.2770208432867,
+        "tl": 1223.5173623121134,
+        "tm": 1223.7156324953805,
+        "tr": 1225.21860090158
+      }
+    },
+    "calgary-205": {
+      "poseHash": "p1-123o7a1",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:31.645Z",
+      "attempts": 1,
+      "mountGroundM": 1085.6754462032804,
+      "supports": {
+        "bl": 1086.126823027246,
+        "bm": 1084.252535055876,
+        "br": 1082.050067730868,
+        "ml": 1087.8899256442123,
+        "mc": 1085.182954752566,
+        "mr": 1082.3199778887001,
+        "tl": 1089.3484306576863,
+        "tm": 1084.9553659908224,
+        "tr": 1082.674217200092
+      }
+    },
+    "calgary-207": {
+      "poseHash": "p1-1hdkvkr",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:55.357Z",
+      "attempts": 1,
+      "mountGroundM": 1036.5188624715308,
+      "supports": {
+        "bl": 1036.746673582438,
+        "bm": 1036.5471073668127,
+        "br": 1036.5557833222956,
+        "ml": 1036.6269053141561,
+        "mc": 1036.3243257952925,
+        "mr": 1036.9041193890246,
+        "tl": 1036.510864161661,
+        "tm": 1035.8674875332883,
+        "tr": 1035.1400993232326
+      }
+    },
+    "calgary-208": {
+      "poseHash": "p1-18yu30b",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:25.130Z",
+      "attempts": 1,
+      "mountGroundM": 1035.6024726881717,
+      "supports": {
+        "bl": 1035.618625424058,
+        "bm": 1042.5192132414188,
+        "br": 1033.6244656297276,
+        "ml": 1035.4707886993185,
+        "mc": 1035.0855310608688,
+        "mr": 1033.8639848625166,
+        "tl": 1035.596169182503,
+        "tm": 1043.1884580415888,
+        "tr": 1034.4034045048031
+      }
+    },
+    "calgary-209": {
+      "poseHash": "p1-1qk2aja",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:39.777Z",
+      "attempts": 1,
+      "mountGroundM": 1037.468696567508,
+      "supports": {
+        "bl": 1032.1887390451325,
+        "bm": 1032.6526829383183,
+        "br": 1031.9061299518783,
+        "ml": 1032.455160657326,
+        "mc": 1033.1170658257734,
+        "mr": 1031.5765375777191,
+        "tl": 1032.1929732498636,
+        "tm": 1033.2517415346604,
+        "tr": 1033.1870785009241
+      }
+    },
+    "calgary-21": {
+      "poseHash": "p1-hiqpwa",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:27.162Z",
+      "attempts": 1,
+      "mountGroundM": 1026.984953539361,
+      "supports": {
+        "bl": 1026.5208841994167,
+        "bm": 1027.5363432613392,
+        "br": 1036.9771871852813,
+        "ml": 1026.284773880365,
+        "mc": 1027.5925570519737,
+        "mr": 1036.977198178042,
+        "tl": 1026.391579380093,
+        "tm": 1027.772411856115,
+        "tr": 1036.977192808801
+      }
+    },
+    "calgary-211": {
+      "poseHash": "p1-1hvxdk5",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:38.953Z",
+      "attempts": 1,
+      "mountGroundM": 1234.2211415340905,
+      "supports": {
+        "bl": 1235.1391420053687,
+        "bm": 1244.2727763487187,
+        "br": 1244.9641026353686,
+        "ml": 1240.4817553971018,
+        "mc": 1240.4118439739073,
+        "mr": 1237.268362815663,
+        "tl": 1241.722526360571,
+        "tm": 1242.5237525653665,
+        "tr": 1236.361927046841
+      }
+    },
+    "calgary-212": {
+      "poseHash": "p1-hshpz7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:27.162Z",
+      "attempts": 1,
+      "mountGroundM": 1028.1878722404938,
+      "supports": {
+        "bl": 1025.2287662695185,
+        "bm": 1025.2027957454436,
+        "br": 1025.1624597773305,
+        "ml": 1025.2287932104682,
+        "mc": 1025.2028109487633,
+        "mr": 1025.8578987103192,
+        "tl": 1025.8304736662517,
+        "tm": 1025.5627308968046,
+        "tr": 1027.9070514989085
+      }
+    },
+    "calgary-213": {
+      "poseHash": "p1-1ixw713",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:01.371Z",
+      "attempts": 1,
+      "mountGroundM": 1016.9515234385505,
+      "supports": {
+        "bl": 1016.9233567461404,
+        "bm": 1023.1940177738816,
+        "br": 1015.4054395851521,
+        "ml": 1016.6494033735933,
+        "mc": 1023.3813205738068,
+        "mr": 1014.914165398974,
+        "tl": 1016.9665682740108,
+        "tm": 1016.9042468951698,
+        "tr": 1016.1818368430768
+      }
+    },
+    "calgary-214": {
+      "poseHash": "p1-1r69cqs",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1031.0306371677664,
+      "supports": {
+        "bl": 1030.2322050279245,
+        "bm": 1026.5658327373828,
+        "br": 1026.6589729282518,
+        "ml": 1030.1666245404292,
+        "mc": 1026.5658048190348,
+        "mr": 1026.5499523645753,
+        "tl": 1030.6865032228704,
+        "tm": 1026.5565286238548,
+        "tr": 1026.3291401937538
+      }
+    },
+    "calgary-215": {
+      "poseHash": "p1-dq53y7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:20.028Z",
+      "attempts": 1,
+      "mountGroundM": 1063.8013636096086,
+      "supports": {
+        "bl": 1052.169424687567,
+        "bm": 1060.5719737153395,
+        "br": 1061.629247062574,
+        "ml": 1052.2281576251357,
+        "mc": 1060.5309366510603,
+        "mr": 1061.7312715948851,
+        "tl": 1052.1310853457314,
+        "tm": 1060.4077776958106,
+        "tr": 1061.7238329864147
+      }
+    },
+    "calgary-216": {
+      "poseHash": "p1-17d3yf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.0703364542337,
+      "supports": {
+        "bl": 1038.9881957917896,
+        "bm": 1039.1019879038695,
+        "br": 1034.116880874092,
+        "ml": 1033.7572976494218,
+        "mc": 1038.9222781997157,
+        "mr": 1034.892798983861,
+        "tl": 1034.9687113178613,
+        "tm": 1039.102026943372,
+        "tr": 1034.8928203063253
+      }
+    },
+    "calgary-217": {
+      "poseHash": "p1-3e16vr",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:50.138Z",
+      "attempts": 1,
+      "mountGroundM": 1031.9699679766654,
+      "supports": {
+        "bl": 1047.102781053542,
+        "bm": 1043.8186206801245,
+        "br": 1035.060431380592,
+        "ml": 1044.729100396123,
+        "mc": 1041.4195159568308,
+        "mr": 1035.071857455618,
+        "tl": 1039.3853788346098,
+        "tm": 1043.980792150955,
+        "tr": 1035.5470844687347
+      }
+    },
+    "calgary-218": {
+      "poseHash": "p1-lp9ha3",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.450477945502,
+      "supports": {
+        "bl": 1033.1231837843095,
+        "bm": 1032.9980594601118,
+        "br": 1032.4694706195016,
+        "ml": 1033.319679045738,
+        "mc": 1032.9026198360025,
+        "mr": 1032.5238248716662,
+        "tl": 1042.0910811512178,
+        "tm": 1032.6162255097338,
+        "tr": 1032.523847960055
+      }
+    },
+    "calgary-219": {
+      "poseHash": "p1-rh64vu",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:26.659Z",
+      "attempts": 1,
+      "mountGroundM": 1142.8248972511299,
+      "supports": {
+        "bl": 1154.2917420591466,
+        "bm": 1167.5105443506452,
+        "br": 1156.1986083002746,
+        "ml": 1156.5645739153417,
+        "mc": 1159.5193438090494,
+        "mr": 1157.2199456271012,
+        "tl": 1158.4853156514225,
+        "tm": 1160.7406712091638,
+        "tr": 1157.8947182933173
+      }
+    },
+    "calgary-22": {
+      "poseHash": "p1-qy11wx",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:31.340Z",
+      "attempts": 1,
+      "mountGroundM": 1159.3821846579697,
+      "supports": {
+        "bl": 1152.7425281256287,
+        "bm": 1159.8998917128527,
+        "br": 1157.2287115083911,
+        "ml": 1154.4518340500372,
+        "mc": 1159.5588427771854,
+        "mr": 1158.5467075622807,
+        "tl": 1157.1425197660662,
+        "tm": 1159.4869386716227,
+        "tr": 1159.002753474344
+      }
+    },
+    "calgary-220": {
+      "poseHash": "p1-g961vv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:11.629Z",
+      "attempts": 1,
+      "mountGroundM": 1074.8691730400046,
+      "supports": {
+        "bl": 1074.7416324651906,
+        "bm": 1080.4692210208295,
+        "br": 1073.6246817974786,
+        "ml": 1074.7136805417285,
+        "mc": 1080.481098540235,
+        "mr": 1073.4943286812052,
+        "tl": 1074.5088079126806,
+        "tm": 1083.9196501199617,
+        "tr": 1073.3900262855398
+      }
+    },
+    "calgary-221": {
+      "poseHash": "p1-1w5fauq",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:56.240Z",
+      "attempts": 1,
+      "mountGroundM": 1019.7952691896446,
+      "supports": {
+        "bl": 1017.1077953792193,
+        "bm": 1016.160476759558,
+        "br": 1016.0762290155328,
+        "ml": 1016.4026347621915,
+        "mc": 1015.956276361412,
+        "mr": 1015.9767900458061,
+        "tl": 1016.3763677641293,
+        "tm": 1015.9156562727429,
+        "tr": 1015.8998490968496
+      }
+    },
+    "calgary-222": {
+      "poseHash": "p1-1fhtx15",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1029.5322944502445,
+      "supports": {
+        "bl": 1029.0110331241156,
+        "bm": 1030.9271595050382,
+        "br": 1030.203094827015,
+        "ml": 1030.4547841151423,
+        "mc": 1130.781342537985,
+        "mr": 1030.9592060568204,
+        "tl": 1030.8549549150714,
+        "tm": 1130.732521761686,
+        "tr": 1050.519303113865
+      }
+    },
+    "calgary-23": {
+      "poseHash": "p1-uj2zv8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:13.733Z",
+      "attempts": 1,
+      "mountGroundM": 1071.939525136094,
+      "supports": {
+        "bl": 1080.063949450784,
+        "bm": 1079.418587505627,
+        "br": 1078.6460009147524,
+        "ml": 1081.5547236675513,
+        "mc": 1078.091294919937,
+        "mr": 1080.5051172126987,
+        "tl": 1082.8030894775277,
+        "tm": 1081.4457977330826,
+        "tr": 1077.8854531584573
+      }
+    },
+    "calgary-24": {
+      "poseHash": "p1-zy7fay",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:13.733Z",
+      "attempts": 1,
+      "mountGroundM": 1053.906026086335,
+      "supports": {
+        "bl": 1058.3830856286731,
+        "bm": 1054.6358672625572,
+        "br": 1054.0596133845263,
+        "ml": 1053.630992414998,
+        "mc": 1053.2927450057248,
+        "mr": 1054.070848171246,
+        "tl": 1056.0490746401863,
+        "tm": 1056.276198839268,
+        "tr": 1054.0596509180461
+      }
+    },
+    "calgary-25": {
+      "poseHash": "p1-16mvdt1",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:02.103Z",
+      "attempts": 1,
+      "mountGroundM": 1016.7350366045042,
+      "supports": {
+        "bl": 1008.6497803919616,
+        "bm": 1007.254545583116,
+        "br": 1008.6933482191795,
+        "ml": 1008.5621283548257,
+        "mc": 1007.228260931699,
+        "mr": 1007.9812149341075,
+        "tl": 1008.7988845423524,
+        "tm": 1007.1343217035788,
+        "tr": 1007.1732348846873
+      }
+    },
+    "calgary-26": {
+      "poseHash": "p1-8o2ncl",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1038.855580059807,
+      "supports": {
+        "bl": 1061.8488758168887,
+        "bm": 1138.5023867578202,
+        "br": 1029.5167013204607,
+        "ml": 1029.4783717003222,
+        "mc": 1138.3597818038963,
+        "mr": 1029.4136062764828,
+        "tl": 1029.689875787072,
+        "tm": 1038.9697593568212,
+        "tr": 1029.5683231134733
+      }
+    },
+    "calgary-27": {
+      "poseHash": "p1-14iwmik",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:19.314Z",
+      "attempts": 1,
+      "mountGroundM": 1038.8357834708588,
+      "supports": {
+        "bl": 1042.9729819674467,
+        "bm": 1058.1201289272508,
+        "br": 1039.0906561356774,
+        "ml": 1043.0628154560536,
+        "mc": 1058.6805821192204,
+        "mr": 1040.994170629201,
+        "tl": 1042.3586169507978,
+        "tm": 1053.151112576918,
+        "tr": 1039.2324335841975
+      }
+    },
+    "calgary-29": {
+      "poseHash": "p1-1nlwlrx",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:09.902Z",
+      "attempts": 1,
+      "mountGroundM": 1014.9880760980368,
+      "supports": {
+        "bl": 1015.2785663091807,
+        "bm": 1014.2498480971337,
+        "br": 1014.6706025758372,
+        "ml": 1015.2898376247093,
+        "mc": 1014.5314526161781,
+        "mr": 1014.4979356125048,
+        "tl": 1015.3142341637655,
+        "tm": 1014.6910152458503,
+        "tr": 1014.7257772915896
+      }
+    },
+    "calgary-3": {
+      "poseHash": "p1-5su3h8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:07.366Z",
+      "attempts": 1,
+      "mountGroundM": 1048.0419316396528,
+      "supports": {
+        "bl": 1044.5258700088573,
+        "bm": 1044.4618753820764,
+        "br": 1045.2337658175416,
+        "ml": 1045.0194754400727,
+        "mc": 1044.0664569008086,
+        "mr": 1045.1726488021668,
+        "tl": 1044.1367941977066,
+        "tm": 1044.3207689786238,
+        "tr": 1045.021277167516
+      }
+    },
+    "calgary-30": {
+      "poseHash": "p1-leshil",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1026.2874530251386,
+      "supports": {
+        "bl": 1037.566718405775,
+        "bm": 1033.724604993521,
+        "br": 1027.8536490832907,
+        "ml": 1035.7408140444827,
+        "mc": 1032.5454052683422,
+        "mr": 1027.9810592388665,
+        "tl": 1037.5907302411215,
+        "tm": 1033.8513952898468,
+        "tr": 1031.7318926439425
+      }
+    },
+    "calgary-31": {
+      "poseHash": "p1-ccxpok",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:25.130Z",
+      "attempts": 1,
+      "mountGroundM": 1034.7627569948697,
+      "supports": {
+        "bl": 1028.228297012175,
+        "bm": 1027.528556543733,
+        "br": 1024.6652562383867,
+        "ml": 1027.6212762803536,
+        "mc": 1027.442385018913,
+        "mr": 1028.068512111674,
+        "tl": 1027.3758180467298,
+        "tm": 1027.2292682757638,
+        "tr": 1028.4525632084378
+      }
+    },
+    "calgary-32": {
+      "poseHash": "p1-1ir4r9",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1078.7145787973761,
+      "supports": {
+        "bl": 1029.0299823937505,
+        "bm": 1028.7398596941373,
+        "br": 1029.2163166054363,
+        "ml": 1029.0374643364169,
+        "mc": 1028.9646328973395,
+        "mr": 1029.4714814102606,
+        "tl": 1028.7111816508084,
+        "tm": 1028.8250867762624,
+        "tr": 1029.5644014797383
+      }
+    },
+    "calgary-33": {
+      "poseHash": "p1-wecxyl",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1025.7978278214193,
+      "supports": {
+        "bl": 1041.0665410444383,
+        "bm": 1041.2593253703055,
+        "br": 1026.000084444313,
+        "ml": 1045.7303961652615,
+        "mc": 1033.3579022546091,
+        "mr": 1026.2136958593733,
+        "tl": 1045.625659797734,
+        "tm": 1033.3557163406354,
+        "tr": 1026.4891262375734
+      }
+    },
+    "calgary-34": {
+      "poseHash": "p1-x0cdqy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1027.453388529234,
+      "supports": {
+        "bl": 1027.5311104875216,
+        "bm": 1027.4733969334557,
+        "br": 1027.798346890337,
+        "ml": 1027.8571556763302,
+        "mc": 1027.8068433015746,
+        "mr": 1027.8133371136103,
+        "tl": 1035.0885379675485,
+        "tm": 1027.4022385530961,
+        "tr": 1028.776151352547
+      }
+    },
+    "calgary-35": {
+      "poseHash": "p1-1g626u1",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1031.8699134652647,
+      "supports": {
+        "bl": 1027.017160156385,
+        "bm": 1026.8670716868135,
+        "br": 1031.431119942982,
+        "ml": 1027.431411885313,
+        "mc": 1026.8670606774253,
+        "mr": 1040.335261212129,
+        "tl": 1027.5382500074845,
+        "tm": 1026.805414329823,
+        "tr": 1027.3228351998937
+      }
+    },
+    "calgary-36": {
+      "poseHash": "p1-ecpqyw",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1027.3976486891956,
+      "supports": {
+        "bl": 1040.6848149509565,
+        "bm": 1027.0726210410546,
+        "br": 1027.619983579074,
+        "ml": 1040.606257043977,
+        "mc": 1026.9341574351658,
+        "mr": 1051.8849874209686,
+        "tl": 1040.6399014321091,
+        "tm": 1026.9341454271578,
+        "tr": 1060.0213533692533
+      }
+    },
+    "calgary-37": {
+      "poseHash": "p1-o93byd",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:17.945Z",
+      "attempts": 1,
+      "mountGroundM": 1100.471002000486,
+      "supports": {
+        "bl": 1098.0723066796575,
+        "bm": 1094.6650665256493,
+        "br": 1097.733959846715,
+        "ml": 1097.5176316870384,
+        "mc": 1094.8824835239654,
+        "mr": 1097.7000482507915,
+        "tl": 1097.0293928593649,
+        "tm": 1095.2987167990423,
+        "tr": 1096.3907943001357
+      }
+    },
+    "calgary-38": {
+      "poseHash": "p1-4lktna",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:14.896Z",
+      "attempts": 1,
+      "mountGroundM": 1072.0252102710467,
+      "supports": {
+        "bl": 1069.6225873111164,
+        "bm": 1067.197395785021,
+        "br": 1066.377860203414,
+        "ml": 1069.284993157276,
+        "mc": 1068.5625442202054,
+        "mr": 1066.633420108441,
+        "tl": 1067.895683575312,
+        "tm": 1068.9168301548998,
+        "tr": 1067.2937100848144
+      }
+    },
+    "calgary-39": {
+      "poseHash": "p1-15xupf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:11.629Z",
+      "attempts": 1,
+      "mountGroundM": 1073.7899402256678,
+      "supports": {
+        "bl": 1073.8997767197995,
+        "bm": 1073.8286859174693,
+        "br": 1072.9637398377447,
+        "ml": 1073.5907205499514,
+        "mc": 1074.7515358056166,
+        "mr": 1074.2433654620306,
+        "tl": 1073.3151610619466,
+        "tm": 1079.1137702432745,
+        "tr": 1074.2494167666362
+      }
+    },
+    "calgary-4": {
+      "poseHash": "p1-1vwi9gq",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:43.024Z",
+      "attempts": 1,
+      "mountGroundM": 1036.9483884445433,
+      "supports": {
+        "bl": 1039.8427663134585,
+        "bm": 1048.492295071736,
+        "br": 1039.4541995830195,
+        "ml": 1042.7323712625282,
+        "mc": 1044.724709882919,
+        "mr": 1039.474815114846,
+        "tl": 1046.9437146681726,
+        "tm": 1043.7486782738222,
+        "tr": 1039.439287210822
+      }
+    },
+    "calgary-40": {
+      "poseHash": "p1-1u8ppqo",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1045.5700044669195,
+      "supports": {
+        "bl": 1027.5780371363996,
+        "bm": 1026.7667675684118,
+        "br": 1025.3480574233483,
+        "ml": 1027.5780492055633,
+        "mc": 1025.8319397101584,
+        "mr": 1023.4259091218879,
+        "tl": 1026.620273233413,
+        "tm": 1023.1218025827231,
+        "tr": 1023.3021352123618
+      }
+    },
+    "calgary-41": {
+      "poseHash": "p1-1faoef1",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:07.366Z",
+      "attempts": 1,
+      "mountGroundM": 1060.5054114318605,
+      "supports": {
+        "bl": 1061.3256898046754,
+        "bm": 1072.261419045283,
+        "br": 1061.6256290842389,
+        "ml": 1061.6686402163261,
+        "mc": 1074.292915861066,
+        "mr": 1072.1826608213964,
+        "tl": 1071.192697675693,
+        "tm": 1072.290950975141,
+        "tr": 1062.9816242595896
+      }
+    },
+    "calgary-42": {
+      "poseHash": "p1-8amlka",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:40.620Z",
+      "attempts": 1,
+      "mountGroundM": 1075.3674130194584,
+      "supports": {
+        "bl": 1070.3654114997682,
+        "bm": 1074.006058347305,
+        "br": 1074.8854165375021,
+        "ml": 1070.5983910917575,
+        "mc": 1073.7047986494404,
+        "mr": 1074.8015500262488,
+        "tl": 1070.8518549276869,
+        "tm": 1073.7047700066723,
+        "tr": 1073.3536616050224
+      }
+    },
+    "calgary-43": {
+      "poseHash": "p1-y1u5lt",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:06.349Z",
+      "attempts": 1,
+      "mountGroundM": 1022.8199196306405,
+      "supports": {
+        "bl": 1023.8410241821439,
+        "bm": 1023.0495125112943,
+        "br": 1022.8991498609516,
+        "ml": 1032.1820807899057,
+        "mc": 1023.0997658830224,
+        "mr": 1021.7889474280914,
+        "tl": 1022.0848323483465,
+        "tm": 1023.0997620859395,
+        "tr": 1026.1801979376764
+      }
+    },
+    "calgary-44": {
+      "poseHash": "p1-1y140op",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:51.877Z",
+      "attempts": 1,
+      "mountGroundM": 1033.3441137254565,
+      "supports": {
+        "bl": 1031.5580201651094,
+        "bm": 1030.7037720450237,
+        "br": 1037.741000318151,
+        "ml": 1031.74148754898,
+        "mc": 1030.0820291242032,
+        "mr": 1038.1492148041607,
+        "tl": 1031.6472792112427,
+        "tm": 1030.1344694374927,
+        "tr": 1034.5725805004274
+      }
+    },
+    "calgary-45": {
+      "poseHash": "p1-zwhaqf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:23.392Z",
+      "attempts": 1,
+      "mountGroundM": 1071.6135173293633,
+      "supports": {
+        "bl": 1075.2499408341973,
+        "bm": 1082.8313500303664,
+        "br": 1076.6232234336962,
+        "ml": 1075.4454556194255,
+        "mc": 1078.8438048270584,
+        "mr": 1078.6161015850043,
+        "tl": 1078.1639478905506,
+        "tm": 1075.577092086729,
+        "tr": 1073.9392882356904
+      }
+    },
+    "calgary-46": {
+      "poseHash": "p1-h8omaq",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1034.3686059112638,
+      "supports": {
+        "bl": 1040.0937421612223,
+        "bm": 1042.1138241431615,
+        "br": 1035.2443620726415,
+        "ml": 1039.9965201252444,
+        "mc": 1036.0503356723277,
+        "mr": 1035.6786740369607,
+        "tl": 1039.9965555500576,
+        "tm": 1035.625447010013,
+        "tr": 1035.888327690722
+      }
+    },
+    "calgary-47": {
+      "poseHash": "p1-1dhwib",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:27.298Z",
+      "attempts": 1,
+      "mountGroundM": 1135.710666194923,
+      "supports": {
+        "bl": 1141.6987441458323,
+        "bm": 1128.8608301281095,
+        "br": 1130.5577824038164,
+        "ml": 1130.109456849301,
+        "mc": 1128.8064516638374,
+        "mr": 1130.1871009304502,
+        "tl": 1134.7204160929962,
+        "tm": 1128.8656647841508,
+        "tr": 1129.8225643775497
+      }
+    },
+    "calgary-48": {
+      "poseHash": "p1-adbccf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:13.733Z",
+      "attempts": 1,
+      "mountGroundM": 1040.8514951326617,
+      "supports": {
+        "bl": 1039.8433958650166,
+        "bm": 1039.4858324269546,
+        "br": 1040.1361148236101,
+        "ml": 1039.1121932540095,
+        "mc": 1043.9099738233645,
+        "mr": 1040.0406731713072,
+        "tl": 1039.0730039354994,
+        "tm": 1043.8613435662671,
+        "tr": 1040.1615428081914
+      }
+    },
+    "calgary-49": {
+      "poseHash": "p1-2h0xp4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:21.028Z",
+      "attempts": 1,
+      "mountGroundM": 1043.9186549382223,
+      "supports": {
+        "bl": 1039.6098190154767,
+        "bm": 1043.1715186400754,
+        "br": 1046.2965835916461,
+        "ml": 1041.8294156102183,
+        "mc": 1044.7420057878487,
+        "mr": 1046.79774448087,
+        "tl": 1045.3658366427073,
+        "tm": 1048.238244757965,
+        "tr": 1049.583374455015
+      }
+    },
+    "calgary-5": {
+      "poseHash": "p1-jlgdhj",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1032.638795137232,
+      "supports": {
+        "bl": 1032.526265959713,
+        "bm": 1041.8095668712137,
+        "br": 1027.7743381128819,
+        "ml": 1039.6032354742229,
+        "mc": 1027.8421751974445,
+        "mr": 1027.562577443688,
+        "tl": 1038.4949198897637,
+        "tm": 1027.132438731792,
+        "tr": 1027.6713182110368
+      }
+    },
+    "calgary-50": {
+      "poseHash": "p1-1drjp5y",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:13.299Z",
+      "attempts": 1,
+      "mountGroundM": 1031.0029649070127,
+      "supports": {
+        "bl": 1027.2241064291945,
+        "bm": 1027.2570089899618,
+        "br": 1027.490175151971,
+        "ml": 1029.3600509873152,
+        "mc": 1031.0061492798452,
+        "mr": 1030.286453370481,
+        "tl": 1031.1197117635952,
+        "tm": 1031.1972609524641,
+        "tr": 1030.679767129702
+      }
+    },
+    "calgary-51": {
+      "poseHash": "p1-3efv8w",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:21.028Z",
+      "attempts": 1,
+      "mountGroundM": 1050.9695719263036,
+      "supports": {
+        "bl": 1048.9527153193708,
+        "bm": 1043.9267022716629,
+        "br": 1042.605080295758,
+        "ml": 1049.4817716746059,
+        "mc": 1044.1019971155154,
+        "mr": 1042.2417056095474,
+        "tl": 1050.4464062904874,
+        "tm": 1044.0683316542736,
+        "tr": 1042.2492142446347
+      }
+    },
+    "calgary-52": {
+      "poseHash": "p1-9re7dd",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:20.781Z",
+      "attempts": 1,
+      "mountGroundM": 1014.8908066434265,
+      "supports": {
+        "bl": 1005.8063419333317,
+        "bm": 1007.732351906478,
+        "br": 1009.2658651294422,
+        "ml": 1006.0355441000033,
+        "mc": 1007.3395800175587,
+        "mr": 1009.5927641641157,
+        "tl": 1006.2215184035762,
+        "tm": 1007.3110810763694,
+        "tr": 1008.4578688664196
+      }
+    },
+    "calgary-53": {
+      "poseHash": "p1-pi43u0",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:50.138Z",
+      "attempts": 1,
+      "mountGroundM": 1035.4817369888654,
+      "supports": {
+        "bl": 1036.269174676619,
+        "bm": 1037.6604650341233,
+        "br": 1031.3038692620898,
+        "ml": 1037.6520861184767,
+        "mc": 1037.2618092507503,
+        "mr": 1031.4067687045683,
+        "tl": 1036.0007820526769,
+        "tm": 1037.5634066006082,
+        "tr": 1031.3463952757893
+      }
+    },
+    "calgary-54": {
+      "poseHash": "p1-ta0r1h",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1038.0445219869268,
+      "supports": {
+        "bl": 1037.4233933898906,
+        "bm": 1034.0332644803368,
+        "br": 1035.0067026315849,
+        "ml": 1040.3774697776366,
+        "mc": 1033.8160830763375,
+        "mr": 1035.592597485905,
+        "tl": 1040.6543619073868,
+        "tm": 1033.1494931479263,
+        "tr": 1036.013757654392
+      }
+    },
+    "calgary-55": {
+      "poseHash": "p1-1lajz7c",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.1156861614054,
+      "supports": {
+        "bl": 1040.2660370510273,
+        "bm": 1034.2306657382587,
+        "br": 1027.45031955052,
+        "ml": 1033.768218120834,
+        "mc": 1034.3821490057296,
+        "mr": 1027.5158594584016,
+        "tl": 1033.9884124557593,
+        "tm": 1034.3391023443737,
+        "tr": 1027.3889343669316
+      }
+    },
+    "calgary-56": {
+      "poseHash": "p1-1d26sbc",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1033.9872110945062,
+      "supports": {
+        "bl": 1027.784274105387,
+        "bm": 1028.2513652746957,
+        "br": 1028.0777015326169,
+        "ml": 1027.784256096974,
+        "mc": 1028.1463690017674,
+        "mr": 1027.8884193231934,
+        "tl": 1027.8443387278812,
+        "tm": 1028.0121203774884,
+        "tr": 1029.5638705304586
+      }
+    },
+    "calgary-57": {
+      "poseHash": "p1-1xxqib",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1032.2933165500483,
+      "supports": {
+        "bl": 1031.4618092962157,
+        "bm": 1040.6166676293726,
+        "br": 1031.5480303086717,
+        "ml": 1031.2952369760271,
+        "mc": 1035.219969619629,
+        "mr": 1031.253480522476,
+        "tl": 1044.4013645161508,
+        "tm": 1037.1761136446237,
+        "tr": 1031.4594148026138
+      }
+    },
+    "calgary-58": {
+      "poseHash": "p1-zrxfua",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1036.9761642627182,
+      "supports": {
+        "bl": 1032.0406774448018,
+        "bm": 1032.3428355727794,
+        "br": 1031.5804853417014,
+        "ml": 1032.1717216292611,
+        "mc": 1038.1420365695903,
+        "mr": 1031.4635384842477,
+        "tl": 1038.4737190990002,
+        "tm": 1032.0414958960725,
+        "tr": 1031.1959336505959
+      }
+    },
+    "calgary-59": {
+      "poseHash": "p1-1rcj34x",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:49.388Z",
+      "attempts": 1,
+      "mountGroundM": 1029.4874365308415,
+      "supports": {
+        "bl": 1039.8082320259864,
+        "bm": 1029.4257816328654,
+        "br": 1036.9387183097276,
+        "ml": 1039.3935522849567,
+        "mc": 1029.7739292424926,
+        "mr": 1029.5690875101366,
+        "tl": 1029.7217325252327,
+        "tm": 1032.141064483976,
+        "tr": 1037.7324051257967
+      }
+    },
+    "calgary-6": {
+      "poseHash": "p1-1g4iuv8",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:19.314Z",
+      "attempts": 1,
+      "mountGroundM": 1053.787948914514,
+      "supports": {
+        "bl": 1051.9648682634775,
+        "bm": 1057.2994862416035,
+        "br": 1051.8931248952001,
+        "ml": 1056.163662164541,
+        "mc": 1052.4508222195195,
+        "mr": 1051.8931780367654,
+        "tl": 1057.2605130111433,
+        "tm": 1056.2053937360308,
+        "tr": 1053.2773084445994
+      }
+    },
+    "calgary-60": {
+      "poseHash": "p1-11epkx0",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:20.216Z",
+      "attempts": 1,
+      "mountGroundM": 1049.011409554644,
+      "supports": {
+        "bl": 1044.2280303588766,
+        "bm": 1043.864400037064,
+        "br": 1046.6080103715738,
+        "ml": 1046.161858861668,
+        "mc": 1044.277655054862,
+        "mr": 1046.5762129084667,
+        "tl": 1046.6443850659127,
+        "tm": 1044.3119059104279,
+        "tr": 1046.7052219346633
+      }
+    },
+    "calgary-61": {
+      "poseHash": "p1-imgc8g",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:43.024Z",
+      "attempts": 1,
+      "mountGroundM": 1105.168998302989,
+      "supports": {
+        "bl": 1108.064800518084,
+        "bm": 1106.489846174745,
+        "br": 1111.8305397662748,
+        "ml": 1108.309658640616,
+        "mc": 1107.6587485024643,
+        "mr": 1106.0199544445427,
+        "tl": 1108.3355971046897,
+        "tm": 1106.904359827459,
+        "tr": 1105.940146265933
+      }
+    },
+    "calgary-62": {
+      "poseHash": "p1-73i9cn",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:04.687Z",
+      "attempts": 1,
+      "mountGroundM": 1016.4307825128195,
+      "supports": {
+        "bl": 1014.000270193042,
+        "bm": 1017.1476132382604,
+        "br": 1012.8069432563893,
+        "ml": 1014.4337970312115,
+        "mc": 1017.0612245508343,
+        "mr": 1012.8741108929869,
+        "tl": 1014.4469461783601,
+        "tm": 1017.0855877179415,
+        "tr": 1012.8741151517264
+      }
+    },
+    "calgary-63": {
+      "poseHash": "p1-che8wp",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:22.527Z",
+      "attempts": 1,
+      "mountGroundM": 1077.4133803038071,
+      "supports": {
+        "bl": 1072.7385716090448,
+        "bm": 1070.3409278228726,
+        "br": 1074.6778713380813,
+        "ml": 1073.808501708678,
+        "mc": 1072.7714377606876,
+        "mr": 1073.192630689744,
+        "tl": 1074.766783146778,
+        "tm": 1073.416331030038,
+        "tr": 1071.8825483755923
+      }
+    },
+    "calgary-64": {
+      "poseHash": "p1-10xyole",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:16.734Z",
+      "attempts": 1,
+      "mountGroundM": 1021.6504388802318,
+      "supports": {
+        "bl": 1023.4898056225621,
+        "bm": 1025.156463958413,
+        "br": 1022.1648326874058,
+        "ml": 1024.1441609869285,
+        "mc": 1025.2791938558614,
+        "mr": 1021.9979036642058,
+        "tl": 1023.5910409132699,
+        "tm": 1024.7618268313274,
+        "tr": 1022.6787438258436
+      }
+    },
+    "calgary-65": {
+      "poseHash": "p1-dfw2lh",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:12.532Z",
+      "attempts": 1,
+      "mountGroundM": 1062.0178757362773,
+      "supports": {
+        "bl": 1066.804890507949,
+        "bm": 1061.3051202609495,
+        "br": 1068.5989886029731,
+        "ml": 1065.2379778778864,
+        "mc": 1061.1956430174291,
+        "mr": 1061.5486650983687,
+        "tl": 1063.3119722498714,
+        "tm": 1061.201233680412,
+        "tr": 1061.3510622654553
+      }
+    },
+    "calgary-66": {
+      "poseHash": "p1-16k7cew",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:41.821Z",
+      "attempts": 1,
+      "mountGroundM": 1074.2800113842713,
+      "supports": {
+        "bl": 1067.4133568861312,
+        "bm": 1067.3477146609653,
+        "br": 1066.2417927800764,
+        "ml": 1066.811145536335,
+        "mc": 1066.7490376956666,
+        "mr": 1066.1373038415043,
+        "tl": 1068.2380432802106,
+        "tm": 1066.17272451922,
+        "tr": 1065.9187696266838
+      }
+    },
+    "calgary-67": {
+      "poseHash": "p1-hxsv2n",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:28.811Z",
+      "attempts": 1,
+      "mountGroundM": 1039.63824986591,
+      "supports": {
+        "bl": 1033.1420538127884,
+        "bm": 1031.101192133053,
+        "br": 1032.1815433417164,
+        "ml": 1033.1903496175057,
+        "mc": 1031.5105133796278,
+        "mr": 1032.1815414389766,
+        "tl": 1034.705673491079,
+        "tm": 1031.358739465838,
+        "tr": 1031.237528986826
+      }
+    },
+    "calgary-68": {
+      "poseHash": "p1-1qsb2v3",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:14.896Z",
+      "attempts": 1,
+      "mountGroundM": 1065.188032650293,
+      "supports": {
+        "bl": 1060.6423297791043,
+        "bm": 1061.9136484638825,
+        "br": 1061.9432876970795,
+        "ml": 1060.8890224943586,
+        "mc": 1061.2734723025053,
+        "mr": 1061.691333738399,
+        "tl": 1061.1176783518501,
+        "tm": 1061.48773811871,
+        "tr": 1061.3647009695112
+      }
+    },
+    "calgary-69": {
+      "poseHash": "p1-1n5ki62",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:15.250Z",
+      "attempts": 1,
+      "mountGroundM": 1007.8727337715214,
+      "supports": {
+        "bl": 1001.3872550857951,
+        "bm": 998.3109017158679,
+        "br": 999.6920495180603,
+        "ml": 1000.902174877475,
+        "mc": 998.2206261693507,
+        "mr": 999.8406112516352,
+        "tl": 1000.7592810549689,
+        "tm": 998.5705244005777,
+        "tr": 1000.0154803861632
+      }
+    },
+    "calgary-7": {
+      "poseHash": "p1-1wemkea",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:01.371Z",
+      "attempts": 1,
+      "mountGroundM": 1018.00830865289,
+      "supports": {
+        "bl": 1020.1987943872392,
+        "bm": 1013.871410791748,
+        "br": 1018.1059603981415,
+        "ml": 1015.7874915486507,
+        "mc": 1012.4592607820678,
+        "mr": 1017.7944650557821,
+        "tl": 1021.1004050912265,
+        "tm": 1011.2724773917867,
+        "tr": 1017.3422324858217
+      }
+    },
+    "calgary-70": {
+      "poseHash": "p1-1k45vvm",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:14.078Z",
+      "attempts": 1,
+      "mountGroundM": 1068.976263878387,
+      "supports": {
+        "bl": 1072.469235105405,
+        "bm": 1070.710921937869,
+        "br": 1068.1278858568603,
+        "ml": 1072.9128567322275,
+        "mc": 1070.5292610523131,
+        "mr": 1068.1620395118766,
+        "tl": 1073.2266753705098,
+        "tm": 1070.5032304695837,
+        "tr": 1069.0900017145213
+      }
+    },
+    "calgary-71": {
+      "poseHash": "p1-j6mlfk",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:14.369Z",
+      "attempts": 1,
+      "mountGroundM": 1024.011326580734,
+      "supports": {
+        "bl": 1027.5454157562501,
+        "bm": 1027.331866572981,
+        "br": 1026.207153411029,
+        "ml": 1027.2617923295093,
+        "mc": 1026.5299564266613,
+        "mr": 1026.8569663115886,
+        "tl": 1032.1316229336585,
+        "tm": 1027.0223318552596,
+        "tr": 1030.6301310947033
+      }
+    },
+    "calgary-72": {
+      "poseHash": "p1-1nv5vvf",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:38.953Z",
+      "attempts": 1,
+      "mountGroundM": 1228.9394885246602,
+      "supports": {
+        "bl": 1228.6730621676809,
+        "bm": 1227.0259528794109,
+        "br": 1223.9578850119165,
+        "ml": 1229.237119637832,
+        "mc": 1226.45188642626,
+        "mr": 1223.6252246885583,
+        "tl": 1230.8735997675083,
+        "tm": 1226.0007018809486,
+        "tr": 1223.2102987556866
+      }
+    },
+    "calgary-73": {
+      "poseHash": "p1-1jclemq",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:42.853Z",
+      "attempts": 1,
+      "mountGroundM": 1074.9642870965913,
+      "supports": {
+        "bl": 1073.311192982407,
+        "bm": 1074.0970049504049,
+        "br": 1073.7269181601941,
+        "ml": 1073.5460397509876,
+        "mc": 1074.3056993718724,
+        "mr": 1073.7866186098122,
+        "tl": 1073.7640971107842,
+        "tm": 1074.3056604996036,
+        "tr": 1073.6039935471208
+      }
+    },
+    "calgary-74": {
+      "poseHash": "p1-45v82z",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:11.629Z",
+      "attempts": 1,
+      "mountGroundM": 1068.205064800643,
+      "supports": {
+        "bl": 1082.5596466079824,
+        "bm": 1075.800856984077,
+        "br": 1070.9185016791148,
+        "ml": 1077.6775313233536,
+        "mc": 1076.7815885448845,
+        "mr": 1070.3168878526185,
+        "tl": 1071.3866728108771,
+        "tm": 1070.5022770241599,
+        "tr": 1070.315016413599
+      }
+    },
+    "calgary-75": {
+      "poseHash": "p1-f5hojv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1031.247068306882,
+      "supports": {
+        "bl": 1031.0675310932531,
+        "bm": 1037.3138438652802,
+        "br": 1039.2707918845615,
+        "ml": 1030.9229802409868,
+        "mc": 1039.1777766112873,
+        "mr": 1031.7042001284692,
+        "tl": 1031.1737159629085,
+        "tm": 1041.111961441946,
+        "tr": 1031.76315871323
+      }
+    },
+    "calgary-76": {
+      "poseHash": "p1-jo1cv6",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1031.3078069675348,
+      "supports": {
+        "bl": 1104.46539813959,
+        "bm": 1032.4975920866782,
+        "br": 1032.4058411223734,
+        "ml": 1034.12117345779,
+        "mc": 1032.578671966808,
+        "mr": 1039.9379631617894,
+        "tl": 1034.2289583564057,
+        "tm": 1032.6959270484085,
+        "tr": 1036.7302162574877
+      }
+    },
+    "calgary-77": {
+      "poseHash": "p1-pdkg0n",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:38.942Z",
+      "attempts": 1,
+      "mountGroundM": 1042.1494997787272,
+      "supports": {
+        "bl": 1056.379447806113,
+        "bm": 1046.7367954800145,
+        "br": 1042.339971779152,
+        "ml": 1042.646344904665,
+        "mc": 1049.1007740967339,
+        "mr": 1041.6942270246336,
+        "tl": 1042.6351248317042,
+        "tm": 1043.8565766704457,
+        "tr": 1041.4959880863578
+      }
+    },
+    "calgary-78": {
+      "poseHash": "p1-1fn315f",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:37.893Z",
+      "attempts": 1,
+      "mountGroundM": 1247.5318050025928,
+      "supports": {
+        "bl": 1250.0324093498064,
+        "bm": 1247.8375326244106,
+        "br": 1249.7747205445855,
+        "ml": 1249.4266258737146,
+        "mc": 1248.0092429965916,
+        "mr": 1249.466941439912,
+        "tl": 1262.6866753401398,
+        "tm": 1248.2131873905632,
+        "tr": 1249.3521844056534
+      }
+    },
+    "calgary-79": {
+      "poseHash": "p1-1cvfz9w",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:26.277Z",
+      "attempts": 1,
+      "mountGroundM": 1023.0218890505721,
+      "supports": {
+        "bl": 1032.453856184695,
+        "bm": 1033.206247281698,
+        "br": 1033.0999165391838,
+        "ml": 1032.498310093785,
+        "mc": 1033.1257286678529,
+        "mr": 1034.4931595741587,
+        "tl": 1031.8221603708212,
+        "tm": 1033.5321643615448,
+        "tr": 1035.0269740620656
+      }
+    },
+    "calgary-8": {
+      "poseHash": "p1-pdf0kv",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:13.733Z",
+      "attempts": 1,
+      "mountGroundM": 1035.0680863765626,
+      "supports": {
+        "bl": 1032.438126561213,
+        "bm": 1031.9171877398337,
+        "br": 1032.758474232389,
+        "ml": 1031.8304862293587,
+        "mc": 1033.7080850860525,
+        "mr": 1032.0993699104888,
+        "tl": 1031.5963422856191,
+        "tm": 1032.2431311576277,
+        "tr": 1032.8071920142531
+      }
+    },
+    "calgary-80": {
+      "poseHash": "p1-1730xla",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1027.0051694663664,
+      "supports": {
+        "bl": 1051.4396283537492,
+        "bm": 1027.0882258246668,
+        "br": 1026.4296960579188,
+        "ml": 1026.8538070802108,
+        "mc": 1026.94951867909,
+        "mr": 1026.8997432166814,
+        "tl": 1026.5396816132977,
+        "tm": 1026.9495090301955,
+        "tr": 1026.9345637385616
+      }
+    },
+    "calgary-81": {
+      "poseHash": "p1-lpv2uy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:35.076Z",
+      "attempts": 1,
+      "mountGroundM": 1030.7041257561048,
+      "supports": {
+        "bl": 1047.391945136165,
+        "bm": 1039.5736439894624,
+        "br": 1030.8484000425867,
+        "ml": 1040.8668284419327,
+        "mc": 1038.8379776354193,
+        "mr": 1030.9439246621814,
+        "tl": 1044.2901675229175,
+        "tm": 1036.3349352904033,
+        "tr": 1030.8598682988659
+      }
+    },
+    "calgary-82": {
+      "poseHash": "p1-1fp1g96",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:25.130Z",
+      "attempts": 1,
+      "mountGroundM": 1044.4847742152742,
+      "supports": {
+        "bl": 1044.355723420228,
+        "bm": 1042.9475778756607,
+        "br": 1042.2718308226188,
+        "ml": 1049.6408559544132,
+        "mc": 1042.9475875560765,
+        "mr": 1042.416755136281,
+        "tl": 1048.2499547211205,
+        "tm": 1042.2014607928274,
+        "tr": 1042.4130537339597
+      }
+    },
+    "calgary-83": {
+      "poseHash": "p1-1q2fsih",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:15.896Z",
+      "attempts": 1,
+      "mountGroundM": 1059.9850269666968,
+      "supports": {
+        "bl": 1051.4176458724282,
+        "bm": 1052.5588720084284,
+        "br": 1052.770999690397,
+        "ml": 1052.1362374025164,
+        "mc": 1061.6047753589821,
+        "mr": 1055.5567914818039,
+        "tl": 1053.7058041590606,
+        "tm": 1061.7297446840685,
+        "tr": 1057.2757313493378
+      }
+    },
+    "calgary-84": {
+      "poseHash": "p1-1j64lyn",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:44.902Z",
+      "attempts": 1,
+      "mountGroundM": 1065.9850530083613,
+      "supports": {
+        "bl": 1054.546530535849,
+        "bm": 1056.394812278251,
+        "br": 1059.8919048684022,
+        "ml": 1054.546524464836,
+        "mc": 1056.7371010191937,
+        "mr": 1061.345358865004,
+        "tl": 1054.6599738144575,
+        "tm": 1056.737125599253,
+        "tr": 1063.0712032598628
+      }
+    },
+    "calgary-85": {
+      "poseHash": "p1-1zsi1x",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:16.561Z",
+      "attempts": 1,
+      "mountGroundM": 1107.884912830277,
+      "supports": {
+        "bl": 1115.9839664419646,
+        "bm": 1110.3785841086242,
+        "br": 1105.6466292547236,
+        "ml": 1112.8925470580168,
+        "mc": 1108.1281676105984,
+        "mr": 1105.6465897883966,
+        "tl": 1109.7088504662838,
+        "tm": 1106.3599674281045,
+        "tr": 1105.764481045233
+      }
+    },
+    "calgary-86": {
+      "poseHash": "p1-b9bzw0",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:00.138Z",
+      "attempts": 1,
+      "mountGroundM": 1032.7984499639626,
+      "supports": {
+        "bl": 1025.5567293395893,
+        "bm": 1022.8549854792194,
+        "br": 1024.2174772251128,
+        "ml": 1017.9372375949697,
+        "mc": 1019.4908929297293,
+        "mr": 1022.6739001721984,
+        "tl": 1017.8153402334775,
+        "tm": 1017.7481696587802,
+        "tr": 1021.6404528840426
+      }
+    },
+    "calgary-87": {
+      "poseHash": "p1-usq9w7",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:20.216Z",
+      "attempts": 1,
+      "mountGroundM": 1033.2242650970277,
+      "supports": {
+        "bl": 1033.8579905372524,
+        "bm": 1033.3817617951966,
+        "br": 1033.6959430033069,
+        "ml": 1034.247261965597,
+        "mc": 1037.1233230764442,
+        "mr": 1033.9655196851588,
+        "tl": 1034.5878564562781,
+        "tm": 1043.5807379430735,
+        "tr": 1033.2455929664784
+      }
+    },
+    "calgary-88": {
+      "poseHash": "p1-15596b3",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:03.320Z",
+      "attempts": 1,
+      "mountGroundM": 1027.3300397907337,
+      "supports": {
+        "bl": 1026.1302446171023,
+        "bm": 1035.1094152831292,
+        "br": 1031.2753305830486,
+        "ml": 1026.8425397917604,
+        "mc": 1035.5795111117934,
+        "mr": 1031.1036440706182,
+        "tl": 1028.4281793557432,
+        "tm": 1031.144708500027,
+        "tr": 1031.8783091065648
+      }
+    },
+    "calgary-89": {
+      "poseHash": "p1-1t445xz",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:05.666Z",
+      "attempts": 1,
+      "mountGroundM": 1043.9497718872442,
+      "supports": {
+        "bl": 1054.5686846601882,
+        "bm": 1031.3178798367962,
+        "br": 1029.3206855779135,
+        "ml": 1055.055740685856,
+        "mc": 1030.8069133490173,
+        "mr": 1026.8311667838184,
+        "tl": 1055.3345156728328,
+        "tm": 1030.6326202503778,
+        "tr": 1026.7206385076727
+      }
+    },
+    "calgary-9": {
+      "poseHash": "p1-23jeb",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:03.320Z",
+      "attempts": 1,
+      "mountGroundM": 1025.6955583906238,
+      "supports": {
+        "bl": 1037.5162927286622,
+        "bm": 1026.1983941951955,
+        "br": 1027.5750243486023,
+        "ml": 1037.5163097825957,
+        "mc": 1026.1778118532923,
+        "mr": 1027.4382552020893,
+        "tl": 1037.516310478131,
+        "tm": 1026.204027606693,
+        "tr": 1027.57503778667
+      }
+    },
+    "calgary-90": {
+      "poseHash": "p1-157jww5",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:02:51.877Z",
+      "attempts": 1,
+      "mountGroundM": 1028.031792496348,
+      "supports": {
+        "bl": 1028.9220875011483,
+        "bm": 1028.9208817530837,
+        "br": 1029.7146009597368,
+        "ml": 1028.8996244625419,
+        "mc": 1028.9838432984382,
+        "mr": 1029.6883981084704,
+        "tl": 1028.6878493868041,
+        "tm": 1029.1881046731467,
+        "tr": 1029.8626427351558
+      }
+    },
+    "calgary-91": {
+      "poseHash": "p1-qfrizy",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1026.7597256340869,
+      "supports": {
+        "bl": 1031.3983229341006,
+        "bm": 1027.2766625121951,
+        "br": 1027.29922872025,
+        "ml": 1039.4770932096346,
+        "mc": 1027.429704875614,
+        "mr": 1027.2936046319358,
+        "tl": 1036.1087843832788,
+        "tm": 1029.4150389124436,
+        "tr": 1027.1549781147867
+      }
+    },
+    "calgary-92": {
+      "poseHash": "p1-1juvnyh",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:21.878Z",
+      "attempts": 1,
+      "mountGroundM": 1068.2865964891448,
+      "supports": {
+        "bl": 1069.826973993322,
+        "bm": 1070.0251430379146,
+        "br": 1069.1590836448702,
+        "ml": 1071.3262915637395,
+        "mc": 1070.0045118764676,
+        "mr": 1069.263448473046,
+        "tl": 1070.5312770284613,
+        "tm": 1070.1535838520274,
+        "tr": 1069.148396795173
+      }
+    },
+    "calgary-93": {
+      "poseHash": "p1-1y4kkqa",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:14.078Z",
+      "attempts": 1,
+      "mountGroundM": 1080.3241632926702,
+      "supports": {
+        "bl": 1073.0224014691444,
+        "bm": 1071.7484879962085,
+        "br": 1081.5790723051148,
+        "ml": 1072.4688805930741,
+        "mc": 1071.783861193194,
+        "mr": 1080.5193098707077,
+        "tl": 1072.43345411501,
+        "tm": 1072.599882793765,
+        "tr": 1079.7370451387087
+      }
+    },
+    "calgary-94": {
+      "poseHash": "p1-m1zysw",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:08.982Z",
+      "attempts": 1,
+      "mountGroundM": 1047.6802232476145,
+      "supports": {
+        "bl": 1055.2024936928406,
+        "bm": 1048.1509594717018,
+        "br": 1051.3316788296518,
+        "ml": 1048.8545434835908,
+        "mc": 1048.0780395488562,
+        "mr": 1053.0305223169419,
+        "tl": 1058.4882536336113,
+        "tm": 1052.334207802087,
+        "tr": 1051.1117039643811
+      }
+    },
+    "calgary-95": {
+      "poseHash": "p1-1kdamkk",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:59.236Z",
+      "attempts": 1,
+      "mountGroundM": 1026.6226763953564,
+      "supports": {
+        "bl": 1044.999493531985,
+        "bm": 1025.5420925967676,
+        "br": 1025.499779716642,
+        "ml": 1025.4349342287385,
+        "mc": 1040.8593507201485,
+        "mr": 1025.4997842740643,
+        "tl": 1025.3225746586995,
+        "tm": 1040.0258740636968,
+        "tr": 1025.6680306084647
+      }
+    },
+    "calgary-96": {
+      "poseHash": "p1-1n94cz4",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:20.028Z",
+      "attempts": 1,
+      "mountGroundM": 1048.1784705788396,
+      "supports": {
+        "bl": 1045.680731003348,
+        "bm": 1048.2872356449811,
+        "br": 1050.0488400261634,
+        "ml": 1047.9951157117928,
+        "mc": 1047.1606860821123,
+        "mr": 1050.5791567489616,
+        "tl": 1057.8578695839014,
+        "tm": 1047.1718805729215,
+        "tr": 1053.3109798771452
+      }
+    },
+    "calgary-97": {
+      "poseHash": "p1-k11iiq",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:04:18.861Z",
+      "attempts": 1,
+      "mountGroundM": 1110.9795755118057,
+      "supports": {
+        "bl": 1112.0160254290865,
+        "bm": 1106.0955551877194,
+        "br": 1115.0024929613264,
+        "ml": 1113.6263551721172,
+        "mc": 1108.8132210529916,
+        "mr": 1122.7776235246447,
+        "tl": 1111.9033822618874,
+        "tm": 1108.7557582061722,
+        "tr": 1120.9839080056859
+      }
+    },
+    "calgary-98": {
+      "poseHash": "p1-pddt1m",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:16.033Z",
+      "attempts": 1,
+      "mountGroundM": 1021.3930473207546,
+      "supports": {
+        "bl": 1021.1917674343435,
+        "bm": 1022.6290066680934,
+        "br": 1030.5496173471965,
+        "ml": 1021.2386830526458,
+        "mc": 1022.5633888795636,
+        "mr": 1030.583892260326,
+        "tl": 1021.39058148579,
+        "tm": 1022.3205446574533,
+        "tr": 1030.6570088963515
+      }
+    },
+    "calgary-99": {
+      "poseHash": "p1-kyoneg",
+      "status": "ok",
+      "misses": [],
+      "sampledAt": "2026-09-14T04:03:07.069Z",
+      "attempts": 1,
+      "mountGroundM": 1040.7811068419526,
+      "supports": {
+        "bl": 1035.1947781266167,
+        "bm": 1036.710712166393,
+        "br": 1037.200176415194,
+        "ml": 1034.7211922649112,
+        "mc": 1036.028890008064,
+        "mr": 1036.7620480236494,
+        "tl": 1035.14418959878,
+        "tm": 1035.2763931263894,
+        "tr": 1036.3576059090274
+      }
+    },
     "drivebc-1006": {
       "poseHash": "p1-1rfi42k",
       "status": "ok",

From 9fc8d1966b92e43d0d67d1aa40c7dbcd552b0cb5 Mon Sep 17 00:00:00 2001
From: Bilawal Sidhu <106619546+bilawalsidhu@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:59:26 -0500
Subject: [PATCH 10/10] feat(annotations): draw on the world by hand (#547)

Supersedes #235 by @cora-fresh-labs, ported onto the current component layout with fixes from review.

Verified before merge: format, package boundaries, unit suite, build, and the browser tracking suite; a browser harness for the change where one applies; adversarial review applied.

Future work (not in this PR): hand-drawn marks do not persist across a reload today, and neither do spoken annotations; there is no storage layer for marks. The natural home is Scenes: a drawing that belongs to a shot and persists per shot, so a scene animation can carry its own marks. Needs an owner.
Co-authored-by: Clint Borle <clintborle@gmail.com>
---
 CHANGELOG.md                               |  22 +
 README.md                                  |   2 +
 docs/CURRENT-STATE.md                      |  17 +
 scripts/format-scope.json                  |   7 +
 scripts/package-boundaries.json            |  50 +-
 scripts/qa-draw-tool.mjs                   | 876 +++++++++++++++++++++
 src/annotations/annotationEngine.js        |  68 +-
 src/annotations/annotationResolver.js      |   2 +-
 src/annotations/drawMode.js                | 303 +++++++
 src/annotations/drawMode.test.mjs          | 332 ++++++++
 src/annotations/drawTool.js                | 546 +++++++++++++
 src/annotations/drawTool.test.mjs          | 218 +++++
 src/annotations/drawToolBehaviour.test.mjs | 467 +++++++++++
 src/annotations/resolver.js                |  12 +
 src/annotations/worldAnnotationRenderer.js |  15 +-
 src/app/tools.js                           |   6 +
 src/data/cctvGizmo.js                      |   3 +
 src/data/inputOwnership.js                 | 104 +++
 src/data/inputOwnership.test.mjs           | 176 +++++
 src/data/localGeojsonCore.js               |   3 +
 src/data/trackingClickGesture.js           |   4 +
 src/layers/alpr/presentation.js            |   3 +
 src/layers/bikeshare/selection.js          |   3 +
 src/layers/firms/selection.js              |   3 +
 src/layers/installations/selection.js      |   3 +
 src/layers/launches/lifecycle.js           |   3 +
 src/layers/radio/interaction.js            |   3 +
 src/layers/satellites/interaction.js       |   3 +
 src/layers/submarineCables/interaction.js  |   3 +
 src/layers/vessels/selection.js            |   3 +
 src/ui/styles/controls.css                 |  46 ++
 src/ui/templates/display-controls.html     |  26 +
 32 files changed, 3313 insertions(+), 19 deletions(-)
 create mode 100644 scripts/qa-draw-tool.mjs
 create mode 100644 src/annotations/drawMode.js
 create mode 100644 src/annotations/drawMode.test.mjs
 create mode 100644 src/annotations/drawTool.js
 create mode 100644 src/annotations/drawTool.test.mjs
 create mode 100644 src/annotations/drawToolBehaviour.test.mjs
 create mode 100644 src/data/inputOwnership.js
 create mode 100644 src/data/inputOwnership.test.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 44e6431c3..fc5df3599 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -115,8 +115,30 @@ of current runtime behavior, see [`docs/CURRENT-STATE.md`](docs/CURRENT-STATE.md
 
 - Separate submarine cable sources and rendering components, and export bundled geography lookup modules.
 
+### Added
+
+- DISPLAY ▸ Draw: draw on the world by hand. Pick Area, Line or Pin, click the
+  vertices, double-click or press Enter to finish, label and colour it; Backspace
+  undoes a vertex, Esc cancels the shape and a second Esc leaves draw mode, and
+  Clear wipes the board. Drawn shapes go through the same annotation engine as
+  spoken ones, so they render with the whiteboard look, persist, de-dup and clear
+  together. While you are drawing, the draw tool owns the pointer and no layer
+  selects what you click through (#235 — thanks @cora-fresh-labs).
+
 ### Fixed
 
+- Draped annotation geometry — area fills and outlines, routes and arrows —
+  classifies onto terrain as well as 3D tiles. On a keyless boot, where Cesium's
+  own globe carries the imagery, marks previously rendered their labels and no
+  geometry at all. This affected spoken annotations as much as hand-drawn ones.
+
+- A finished drawn area closes its ring, so its outline no longer misses the
+  edge back to the first vertex.
+
+- Areas measured and anchored across the antimeridian use unwrapped longitudes:
+  a shape straddling 180° reported an area thousands of times too large and
+  placed its label on the opposite side of the world.
+
 - Traffic now retries a failed destination after city navigation without a layer
   toggle. Camera departure cancels pending work, arrival checks the final view,
   and superseded requests cannot keep a newer view loading.
diff --git a/README.md b/README.md
index b169189cc..fa2945eee 100644
--- a/README.md
+++ b/README.md
@@ -243,6 +243,8 @@ Twenty-eight tools, four jobs — the commands below come straight from the prod
 **🖊️ Annotate it** — a whiteboard over the real world:
 > 🗣️ *"Outline the state of Texas."* · *"Annotate the Texas State Capitol and its grounds"* — it draws the **actual enclosing boundary**, not a circle. · *"How far is the Eiffel Tower from the Louvre?"* — a connector arrow appears and it speaks the distance. Everything persists until you say *"clear the map."*
 
+**✍️ Or draw it yourself** — DISPLAY ▸ **Draw**: pick Area, Line or Pin, click the vertices on the real world, double-click to finish, label it. Same whiteboard, same persistence, no microphone needed.
+
 ![Zilker Park and Lady Bird Lake drawing onto the 3D city as persistent vector annotations, by voice](docs/media/01-voice-annotate-zilker.gif)
 
 ![A spoken distance measurement spanning an airport, inspected from orbit](docs/media/04-airport-distance.gif)
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index bc79b0098..33cda95b5 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -3002,6 +3002,23 @@ are omitted rather than framing the wrong part of the globe.
 - Console/dev API: `window.__gevAnnotations.tour()`, `.demo()`, `.annotate()`, `.clear()`, `.count()`, and `.list()` are the deterministic no-mic test surface.
 - Current known resolver gap: mall/lifestyle districts such as "The Domain, Austin" can prefer a named building over the broader retail envelope. Product decision is that districts should become envelope + key buildings, but the scoring change still needs a careful multi-case validation pass.
 
+### Manual Whiteboard Drawing (September 2026)
+
+- DISPLAY ▸ **Draw** turns the globe into a whiteboard drawn by hand. Pick a shape (Area, Line, Pin), click the vertices on the real world, type an optional label and pick a colour, and finish. **Keyboard contract, live only while Draw is on and never while you are typing in another field:** Enter finishes the shape (as does a double-click, and the two cannot both submit it — the session is replaced before the annotate call is awaited); Backspace removes the last vertex; Esc cancels the shape in progress, and a second Esc — Esc on an empty session — leaves draw mode. Typing in the label field keeps Backspace; Enter there also finishes. **Clear** wipes the board (the shape in progress and every placed mark), so removing marks does not require the console or the microphone.
+- Runtime entry: `createApplicationTools` (`src/app/tools.js`, behind the `src/standalone/tools.js` shim) calls `initDrawTool({ viewer, annotations })` after `initAnnotations` and defers its `destroy()`, so disposing the shell returns every DOM listener, the Cesium handler, the preview data source, the borrowed click actions and the `window.__gevDrawTool` handle. Its markup is a DISPLAY-rail component template (`src/ui/templates/display-controls.html`), assembled into `index.html` at build time. That handle (`setActive`, `setShape`, `addVertex(lon, lat)`, `finish`, `cancel`, `clearAll`, `diagnostics`) is the no-mouse test seam.
+- Contract: a finished shape is submitted through the SAME `annotationEngine.annotate()` the voice agent uses, with geometry supplied and `manual: true` (`type: area` + `ring`, `type: route` + `path`, `type: pin` + coordinates). `resolveSpec` short-circuits manual specs (`resolveManualSpec`) so no geocoder, Places or Overpass call is made. A drawn area is a real (not synthesized) outline and drapes solid; a drawn line is a `route` with `mode: 'manual'`, labelled with its length and never a travel time; a pin is a point. Drawn marks therefore render with the whiteboard look, persist, de-dup, appear in `.list()`, and clear with `clear_annotations` / `.clear()`.
+- **A vertex is a lon/lat, and the mark is DRAPED.** Clicks are picked through `pickWorldFromScreen` — one of two scene helpers the annotation resolver factory (`src/annotations/resolver.js`) exposes alongside `sampleGroundHeight`, so the app has ONE depth-aware pick cascade rather than a second written beside it — which returns the height the pick landed on as well as the coordinate, so the live preview hangs on the roof or hillside under the pointer instead of sinking to sea level. The world renderer draws areas and routes with `clampToGround`, so the height is dropped at finish in one place (`finishSpec`) rather than being carried downstream and discarded silently: what you get is the outline you drew, lying on the surface beneath it.
+- **Draped marks classify onto `ClassificationType.BOTH`** — terrain AND 3D tiles — not onto 3D tiles alone. With only `CESIUM_3D_TILE`, every area fill, area outline, route and arrow rendered to nothing on a keyless boot, where Cesium's own globe carries Esri/OSM imagery and there are no tiles to classify against; the labels appeared and the geometry did not. That hit spoken annotations exactly as hard as hand-drawn ones. `scripts/qa-draw-tool.mjs` counts the mark's own colour in the rendered frame before and after a shape is finished, on a keyed AND a keyless server, so "the board says there is a mark" can no longer pass for "the mark is on screen".
+- **A finished area is a CLOSED ring.** The fill polygon closes itself but the outline beside it is a polyline, so an open ring drew every edge except the one back to the first vertex — a triangle with two sides. `finishSpec` repeats the first position at the end. A line is never closed: joining its ends would invent a segment nobody drew.
+- **Measurements and centres are computed on unwrapped longitudes** (`unwrapLongitudes` / `wrapLongitude` in `drawMode.js`, used by `ringAreaM2`, `ringCentroid` and the engine's manual-area anchor). A ~50,000 m² rectangle straddling the antimeridian reads its 0.002° width as 359.998° under raw arithmetic: it measured thousands of square kilometres and anchored on the Greenwich meridian, half a world from the shape. Path length was already safe — haversine is periodic in the longitude delta — and a test pins that so a "fix" cannot break it.
+- **Bounds.** One shape holds at most `MAX_VERTICES` = 512 points; two clicks within 0.5 m are one vertex (that is what makes a double-click finish without leaving a stray point); a vertex that is not a finite on-globe coordinate is refused. A shape that encloses nothing is refused rather than placed: three collinear points are not an area and a line under a metre long is not a line, and the hint says which.
+- Pointer ownership: while a session is open the tool holds the single pointer claim (`claimPointer('draw')`, `src/data/inputOwnership.js`) and **every** ambient scene selection handler — the shared tracking click gesture behind flights, military and CCTV, plus vessels, satellites, launches, fires, installations, bikeshare, radio, submarine cables, the bundled GeoJSON layers and the CCTV calibration gizmo — returns before picking. A vertex over an aircraft is a vertex, not a selection.
+- **The claim is a LEASE.** `claimPointer(owner)` returns an opaque token or `null`; `releasePointer(lease)` takes that token. A second claim fails even under the same owner name, because two live instances of one tool — an old one mid-teardown and its replacement — are two owners; releasing by name let the old instance free the claim its successor was holding, and every layer started selecting through the live session's vertices. A superseded lease now releases nothing.
+- **Cesium's own click actions are borrowed too.** The Viewer binds a selecting LEFT_CLICK and a tracking LEFT_DOUBLE_CLICK on its own handler, outside every layer and therefore outside the shared claim — guarding the layers alone still left a drawn vertex selecting the entity under it. Both are removed for the session and restored, as the same function objects, when it ends or the tool is destroyed.
+- **Enter belongs to whatever has the keyboard.** The finish key is taken only from the canvas, the page body and the tool's own label field. With a control focused — Clear, a shape button — Enter activates that control, as a keyboard user expects; it does not quietly finish the shape.
+- Pure half: `src/annotations/drawMode.js` (session, minimum vertices, double-click de-dup at 0.5 m, vertex ceiling, degenerate-geometry refusal, ring closing, dateline-safe length/area/centroid, hint text). Regression surface: `src/annotations/drawMode.test.mjs` and `src/data/inputOwnership.test.mjs` (pure), `src/annotations/drawToolBehaviour.test.mjs` (the tool driven against DOM and viewer doubles — leases, borrowed input actions, teardown, the Enter key, preview heights), `src/annotations/drawTool.test.mjs` (structural: where files live, which ids the markup carries, what the docs may claim), and the rendered harness `scripts/qa-draw-tool.mjs`.
+- The annotation tree is a declared ownership group: `./annotations` → `src/annotations/index.js` in `package.json`, with its module graph listed in `scripts/package-boundaries.json`, so an annotation module reaching outside that graph is a gate failure rather than a surprise in a layer's bundle. `drawMode.js`, `drawTool.js` and their tests are in `scripts/format-scope.json`.
+
 ### 3D Aircraft + Tracking (June 2026)
 
 - **The TRACKED contact's 2D↔3D handoff is DEFAULT behaviour (2026-08-19), driven by camera distance alone.** It does NOT consult the DISPLAY-rail `3D` toggle, which continues to own the FLEET (the un-instanced draw-call budget stays the operator's decision). Policy lives in `src/data/trackedModelRegime.js` and is shared by both layers: enter below `TRACKED_MODEL_ENTER_ALT_M` = 150,000 m and hand back to the billboard only above `TRACKED_MODEL_EXIT_ALT_M` = 172,500 m. **The swap distance was set by playtesting on 2026-08-20:** a first pass at 1,000,000 m switched too early; 2D reads correctly at ~600 km and the handoff belongs at ~150 km. **Consequence, recorded on purpose:** the tracked contact now enters 3D NEARER than the FLEET does (`MODEL_ALT_CEIL_M` = 800,000 m, unchanged), so with the DISPLAY-rail `3D` toggle on, 150–800 km draws surrounding contacts as models while the selected one is still a glyph. Nothing double-draws (the fleet pass skips the tracked icao) and aligning the two is a fleet-side decision, deliberately out of scope. **The two thresholds are asymmetric on purpose:** a single threshold makes a tracked orbit sitting ON the boundary strobe billboard↔model as the camera's altitude wobbles across it. Do not collapse them. The latch is scoped per selection, so a new target re-evaluates against the ENTER ceiling rather than inheriting the previous target's exit band. Exactly ONE model is involved; it loads on demand when the regime opens, is HIDDEN (not released) on regime exit so re-entry has no load gap, and is released by the existing teardown on deselect/re-track/destroy. Cockpit and TR-3B suppression are unchanged. **Two invariants around it:** (a) the hysteresis latch AND the load-failure latch are per-selection state cleared by `_resetTrackedSelectionState()` in the tracking lifecycle (deselect / re-track / cross-layer / init / destroy) — the predicate's icao-change guard is defence only, since it needs a drawn frame while nothing is selected and the render governor's idle mode does not promise one; (b) on-demand loading is bounded at 3 attempts per selection with a 1.5 s backoff and one console warning naming the asset — the driver runs every `scene.preUpdate`, so an unbounded catch means a missing GLB spins load→reject at frame rate. The billboard stays the visual throughout a failed load.
diff --git a/scripts/format-scope.json b/scripts/format-scope.json
index a3225a0c0..64d89d4c0 100644
--- a/scripts/format-scope.json
+++ b/scripts/format-scope.json
@@ -16,6 +16,12 @@
   "src/data/infrastructure.test.mjs",
   "src/data/localGeojsonCore.js",
   "src/data/localGeojsonLod.js",
+  "src/data/inputOwnership.js",
+  "src/annotations/drawMode.js",
+  "src/annotations/drawMode.test.mjs",
+  "src/annotations/drawTool.js",
+  "src/annotations/drawTool.test.mjs",
+  "src/data/inputOwnership.test.mjs",
   "docs/CODE-BOUNDARIES.md",
   "src/main.js",
   "docs/APPLICATION.md",
@@ -156,6 +162,7 @@
   "src/styles/noir.js",
   "src/styles/snow.js",
   "scripts/qa-visual-effects.mjs",
+  "scripts/qa-draw-tool.mjs",
   "src/ui/mapSource.js",
   "src/ui/mapSourceControls.js",
   "src/ui/mapSourceControls.test.mjs",
diff --git a/scripts/package-boundaries.json b/scripts/package-boundaries.json
index 6003bbdce..74ec4b078 100644
--- a/scripts/package-boundaries.json
+++ b/scripts/package-boundaries.json
@@ -8,7 +8,8 @@
     "modules": [
       "src/data/infrastructure.js",
       "src/data/localGeojsonCore.js",
-      "src/data/localGeojsonLod.js"
+      "src/data/localGeojsonLod.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -628,7 +629,8 @@
       "src/layers/flights/tracking.js",
       "src/layers/flights/records.js",
       "src/layers/flights/recordPolicy.js",
-      "src/layers/flights/snapshotRenderer.js"
+      "src/layers/flights/snapshotRenderer.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -662,7 +664,8 @@
       "src/layers/military/tracking.js",
       "src/layers/military/records.js",
       "src/layers/military/recordPolicy.js",
-      "src/layers/military/snapshotRenderer.js"
+      "src/layers/military/snapshotRenderer.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -685,7 +688,8 @@
       "src/data/trackedModelRegime.js",
       "src/data/trackingClickGesture.js",
       "src/layers/aircraft/classification.js",
-      "src/layers/aircraft/index.js"
+      "src/layers/aircraft/index.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -708,7 +712,8 @@
       "src/data/vesselLabels.js",
       "src/layers/vessels/records.js",
       "src/layers/vessels/recordPolicy.js",
-      "src/layers/vessels/snapshotRenderer.js"
+      "src/layers/vessels/snapshotRenderer.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -739,7 +744,8 @@
       "src/layers/firms/selection.js",
       "src/layers/firms/source.js",
       "src/layers/firms/state.js",
-      "src/layers/firms/viewport.js"
+      "src/layers/firms/viewport.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -761,7 +767,8 @@
       "src/layers/satellites/source.js",
       "src/layers/satellites/state.js",
       "src/layers/satellites/testing.js",
-      "src/layers/satellites/tracking.js"
+      "src/layers/satellites/tracking.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium", "satellite.js"]
   },
@@ -786,7 +793,8 @@
       "src/layers/launches/selection.js",
       "src/layers/launches/source.js",
       "src/layers/launches/state.js",
-      "src/layers/launches/testing.js"
+      "src/layers/launches/testing.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -805,7 +813,8 @@
       "src/layers/installations/selection.js",
       "src/layers/installations/source.js",
       "src/layers/installations/state.js",
-      "src/layers/installations/viewport.js"
+      "src/layers/installations/viewport.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -879,7 +888,8 @@
       "src/layers/bikeshare/source.js",
       "src/layers/bikeshare/state.js",
       "src/layers/bikeshare/testing.js",
-      "src/layers/bikeshare/viewport.js"
+      "src/layers/bikeshare/viewport.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -916,7 +926,8 @@
       "src/layers/cctv/state.js",
       "src/layers/cctv/testing.js",
       "src/overlays/worldOverlayTokens.js",
-      "src/data/cctvFootprint.js"
+      "src/data/cctvFootprint.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -927,7 +938,8 @@
       "src/layers/alpr/model.js",
       "src/layers/alpr/policy.js",
       "src/layers/alpr/presentation.js",
-      "src/layers/alpr/source.js"
+      "src/layers/alpr/source.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -959,7 +971,8 @@
       "src/layers/radio/tuning.js",
       "src/layers/radio/tuningNoise.js",
       "src/layers/radio/volume.js",
-      "src/ui/radioTunerModel.js"
+      "src/ui/radioTunerModel.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -975,7 +988,8 @@
       "src/layers/submarineCables/policy.js",
       "src/layers/submarineCables/rendering.js",
       "src/layers/submarineCables/state.js",
-      "src/layers/submarineCables/surface.js"
+      "src/layers/submarineCables/surface.js",
+      "src/data/inputOwnership.js"
     ],
     "external": ["cesium"]
   },
@@ -1557,7 +1571,10 @@
       "src/layers/military/snapshotRenderer.js",
       "src/layers/vessels/records.js",
       "src/layers/vessels/recordPolicy.js",
-      "src/layers/vessels/snapshotRenderer.js"
+      "src/layers/vessels/snapshotRenderer.js",
+      "src/data/inputOwnership.js",
+      "src/annotations/drawMode.js",
+      "src/annotations/drawTool.js"
     ],
     "external": [
       "@mapbox/vector-tile",
@@ -1889,7 +1906,8 @@
       "src/layers/military/snapshotRenderer.js",
       "src/layers/vessels/records.js",
       "src/layers/vessels/recordPolicy.js",
-      "src/layers/vessels/snapshotRenderer.js"
+      "src/layers/vessels/snapshotRenderer.js",
+      "src/data/inputOwnership.js"
     ],
     "external": [
       "cesium",
diff --git a/scripts/qa-draw-tool.mjs b/scripts/qa-draw-tool.mjs
new file mode 100644
index 000000000..a5a16af1d
--- /dev/null
+++ b/scripts/qa-draw-tool.mjs
@@ -0,0 +1,876 @@
+#!/usr/bin/env node
+/** Rendered acceptance for DISPLAY ▸ Draw: real clicks, real keys, real teardown. */
+import fs from 'node:fs';
+import path from 'node:path';
+import puppeteer from 'puppeteer';
+
+const BASE_URL = process.env.QA_BASE_URL || 'http://localhost:4173';
+const SHOT_DIR = process.env.QA_SHOT_DIR || 'qa-shots/draw';
+const SHOT_PREFIX = process.env.QA_SHOT_PREFIX || '';
+const HEADFUL = process.env.QA_HEADFUL === '1';
+// A dense, recognisable grid: neighbourhood blocks to enclose and a straight
+// road to trace along.
+const VIEW = {
+  lon: -122.4194,
+  lat: 37.7749,
+  height: 900,
+  heading: 0,
+  pitch: -85,
+};
+
+const browser = await puppeteer.launch({
+  headless: !HEADFUL,
+  ...(HEADFUL
+    ? {
+        executablePath:
+          '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+      }
+    : {}),
+  args: [
+    '--no-sandbox',
+    '--disable-background-timer-throttling',
+    '--disable-renderer-backgrounding',
+    ...(HEADFUL ? ['--window-size=1280,860'] : []),
+    ...(process.platform === 'darwin'
+      ? ['--use-angle=metal', '--enable-gpu']
+      : ['--use-gl=angle', '--use-angle=swiftshader']),
+  ],
+});
+const page = await browser.newPage();
+const errors = [];
+page.on('pageerror', (error) => errors.push(`pageerror: ${error.message}`));
+let failures = 0;
+function check(name, passed, detail = '') {
+  console.log(
+    `[${passed ? 'PASS' : 'FAIL'}] ${name}${detail ? ` — ${detail}` : ''}`,
+  );
+  if (!passed) failures++;
+}
+fs.mkdirSync(SHOT_DIR, { recursive: true });
+const shot = (name) =>
+  page.screenshot({
+    path: path.join(SHOT_DIR, `${SHOT_PREFIX}${name}.jpg`),
+    type: 'jpeg',
+    quality: 82,
+  });
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/** A clip of the globe canvas, clear of the panels on every side. */
+const CANVAS_CLIP = { x: 340, y: 200, width: 560, height: 380 };
+
+/**
+ * How many amber pixels the clip contains. The drawn area's stroke and fill are
+ * the only amber in this scene, so the count going UP after a shape is finished
+ * is the shape actually painting — which is what CESIUM_3D_TILE-only
+ * classification failed to do on a keyless boot while still reporting a mark on
+ * the board. Decoding happens in the page because Node here has no image
+ * decoder.
+ */
+async function amberPixels() {
+  const shot64 = await page.screenshot({
+    clip: CANVAS_CLIP,
+    type: 'png',
+    encoding: 'base64',
+  });
+  return page.evaluate(async (base64) => {
+    const bitmap = await createImageBitmap(
+      await (await fetch(`data:image/png;base64,${base64}`)).blob(),
+    );
+    const canvas = new OffscreenCanvas(bitmap.width, bitmap.height);
+    const context = canvas.getContext('2d');
+    context.drawImage(bitmap, 0, 0);
+    const { data } = context.getImageData(0, 0, bitmap.width, bitmap.height);
+    let amber = 0;
+    for (let i = 0; i < data.length; i += 4) {
+      const r = data[i];
+      const g = data[i + 1];
+      const b = data[i + 2];
+      // Warm and saturated: the amber mark (#ffb547) blended over imagery.
+      if (r > 150 && g > 90 && g < 220 && b < 130 && r - b > 70 && r - g > 20)
+        amber += 1;
+    }
+    return amber;
+  }, shot64);
+}
+
+/**
+ * Press Enter as the person drawing does — with the map focused, not a button.
+ * Enter on a focused control means "press this control", so the tool ignores it
+ * there; the harness has to move focus the way a user would before using the
+ * finish key.
+ */
+async function pressFinish() {
+  await page.evaluate(() => document.activeElement?.blur?.());
+  await page.keyboard.press('Enter');
+}
+
+/** One click on the globe canvas, the way a person makes one. */
+async function clickWorld(x, y, options = {}) {
+  await page.mouse.click(x, y, options);
+  await wait(options.settle ?? 140);
+}
+
+const drawState = () =>
+  page.evaluate(() => {
+    const tool = window.__gevDrawTool;
+    return {
+      ...tool.diagnostics(),
+      shape: tool.shape,
+      vertices: tool.session?.vertices?.length ?? null,
+      hint: document.getElementById('draw-hint')?.textContent || '',
+      marks: window.__gevAnnotations.count(),
+    };
+  });
+
+const marks = () =>
+  page.evaluate(() =>
+    window.__gevAnnotations.list().map((mark) => ({
+      type: mark.type,
+      label: mark.label,
+      color: mark.color,
+      source: mark.source ?? null,
+    })),
+  );
+
+/** Wait until the board has settled at `expected` marks (annotate is async). */
+async function waitForMarks(expected, timeout = 15_000) {
+  try {
+    await page.waitForFunction(
+      (want) => window.__gevAnnotations.count() === want,
+      { timeout },
+      expected,
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+try {
+  await page.setViewport({ width: 1280, height: 860 });
+  await page.goto(`${BASE_URL}/?welcome=0`, { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(
+    () =>
+      window.__gevDrawTool &&
+      window.__gevAnnotations &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 90_000 },
+  );
+  await page.evaluate((view) => {
+    const viewer = window.__godsEyeView.viewer;
+    viewer.camera.cancelFlight?.();
+    viewer.scene.tweens?.removeAll?.();
+    viewer.camera.setView({
+      destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+        longitude: (view.lon * Math.PI) / 180,
+        latitude: (view.lat * Math.PI) / 180,
+        height: view.height,
+      }),
+      orientation: {
+        heading: (view.heading * Math.PI) / 180,
+        pitch: (view.pitch * Math.PI) / 180,
+        roll: 0,
+      },
+    });
+    viewer.scene.requestRender();
+  }, VIEW);
+  const settled = await page
+    .waitForFunction(
+      () => {
+        const primitives = window.__godsEyeView.viewer.scene.primitives;
+        for (let index = 0; index < primitives.length; index++) {
+          const primitive = primitives.get(index);
+          if (
+            typeof primitive.tilesLoaded === 'boolean' &&
+            !primitive.tilesLoaded
+          )
+            return false;
+        }
+        return true;
+      },
+      { timeout: 90_000 },
+    )
+    .then(
+      () => true,
+      () => false,
+    );
+  check('visible tile content settles before drawing', settled);
+
+  // The DISPLAY rail starts collapsed on a first run: open it the way a user does.
+  await page.evaluate(() => {
+    const rail = document.getElementById('pp-toggles');
+    if (rail?.classList.contains('collapsed'))
+      document
+        .querySelector('.panel-collapse-btn[data-collapse-target="pp-toggles"]')
+        ?.click();
+  });
+  await page.waitForFunction(
+    () =>
+      document.getElementById('draw-toggle')?.getBoundingClientRect().width > 0,
+    { timeout: 10_000 },
+  );
+  check(
+    'the Draw control is on the DISPLAY rail and starts off',
+    await page.evaluate(() => {
+      const toggle = document.getElementById('draw-toggle');
+      return (
+        toggle?.getAttribute('aria-pressed') === 'false' &&
+        !document.getElementById('draw-mode-row')?.classList.contains('visible')
+      );
+    }),
+  );
+
+  // The viewer's OWN click actions, captured before the tool ever runs. Both
+  // must be absent while drawing and back — as the SAME functions — after.
+  await page.evaluate(() => {
+    const Cesium = window.__CESIUM__;
+    const stock = window.__godsEyeView.viewer.screenSpaceEventHandler;
+    window.__qaStock = {
+      click:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK) || null,
+      double:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK) ||
+        null,
+    };
+  });
+  const stockActions = () =>
+    page.evaluate(() => {
+      const Cesium = window.__CESIUM__;
+      const stock = window.__godsEyeView.viewer.screenSpaceEventHandler;
+      const live = {
+        click:
+          stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK) || null,
+        double:
+          stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK) ||
+          null,
+      };
+      return {
+        clickPresent: Boolean(live.click),
+        doublePresent: Boolean(live.double),
+        clickIsOriginal: live.click === window.__qaStock.click,
+        doubleIsOriginal: live.double === window.__qaStock.double,
+        hadClick: Boolean(window.__qaStock.click),
+        hadDouble: Boolean(window.__qaStock.double),
+      };
+    });
+
+  // ── enable / disable cycles leave nothing behind ────────────────────────
+  const before = await drawState();
+  for (let cycle = 0; cycle < 3; cycle += 1) {
+    await page.click('#draw-toggle');
+    await wait(120);
+    await page.click('#draw-toggle');
+    await wait(120);
+  }
+  const after = await drawState();
+  check(
+    'three enable/disable cycles add no listener, handler or preview data source',
+    after.domListeners === before.domListeners &&
+      after.previewDataSources === 1 &&
+      before.previewDataSources === 1 &&
+      after.sceneHandler === false &&
+      after.pointerOwner === null &&
+      after.stockDoubleClick === before.stockDoubleClick,
+    `listeners ${before.domListeners}→${after.domListeners}, previews ${after.previewDataSources}, ` +
+      `handler ${after.sceneHandler}, owner ${after.pointerOwner}, stock dblclick ${after.stockDoubleClick}`,
+  );
+
+  // ── the viewer's own click actions are borrowed, then given back ────────
+  await page.click('#draw-toggle');
+  const duringDraw = await stockActions();
+  check(
+    "Cesium's own selecting click and tracking double-click are both borrowed while drawing",
+    duringDraw.clickPresent === false && duringDraw.doublePresent === false,
+    `click present ${duringDraw.clickPresent}, double present ${duringDraw.doublePresent} ` +
+      `(viewer had click ${duringDraw.hadClick}, double ${duringDraw.hadDouble})`,
+  );
+  await page.click('#draw-toggle');
+  const afterDraw = await stockActions();
+  check(
+    'and both are restored as the SAME functions, not replacements',
+    afterDraw.clickPresent === duringDraw.hadClick &&
+      afterDraw.doublePresent === duringDraw.hadDouble &&
+      afterDraw.clickIsOriginal &&
+      afterDraw.doubleIsOriginal,
+    JSON.stringify(afterDraw),
+  );
+
+  // ── a pin, finished with Enter ──────────────────────────────────────────
+  await page.click('#draw-toggle');
+  await page.click('.pp-mode-btn[data-shape="pin"]');
+  await page.click('#draw-label-input');
+  await page.keyboard.type('Pin one');
+  await clickWorld(520, 330);
+  check(
+    'the pointer is claimed while a session is open',
+    (await drawState()).pointerOwner === 'draw',
+  );
+  await page.keyboard.press('Enter');
+  check(
+    'a pin placed by mouse and finished with Enter lands on the board',
+    await waitForMarks(1),
+  );
+
+  // ── a line along a road, with Backspace ─────────────────────────────────
+  await page.click('.pp-mode-btn[data-shape="line"]');
+  await clickWorld(360, 300);
+  await clickWorld(470, 380);
+  await clickWorld(600, 470);
+  const beforeBackspace = (await drawState()).vertices;
+  await page.keyboard.press('Backspace');
+  await wait(120);
+  const afterBackspace = (await drawState()).vertices;
+  check(
+    'Backspace removes the last vertex only',
+    beforeBackspace === 3 && afterBackspace === 2,
+    `${beforeBackspace} → ${afterBackspace}`,
+  );
+  await clickWorld(640, 500);
+  await page.click('#draw-label-input');
+  await page.keyboard.type('Market St');
+  await page.keyboard.press('Enter');
+  check(
+    'a line finished from the label field lands on the board',
+    await waitForMarks(2),
+  );
+  const lineMark = (await marks()).find((mark) =>
+    mark.label?.startsWith('Market St'),
+  );
+  check(
+    'a drawn line reports its length and never a travel time',
+    Boolean(lineMark) &&
+      /\d/.test(lineMark.label) &&
+      !/min|walk|drive/i.test(lineMark.label),
+    lineMark?.label,
+  );
+  await shot('02-line-along-a-road');
+
+  // ── an area, coloured and labelled, finished with a double-click ────────
+  await page.click('.pp-mode-btn[data-shape="area"]');
+  await page.select('#draw-color-select', 'amber');
+  const amberBefore = await amberPixels();
+  await page.click('#draw-label-input');
+  await page.keyboard.type('Civic Center block');
+  await clickWorld(400, 280);
+  await clickWorld(700, 290);
+  await clickWorld(720, 520);
+  await clickWorld(410, 500);
+  const areaVertices = (await drawState()).vertices;
+  check(
+    'four clicks on the globe are four vertices',
+    areaVertices === 4,
+    `${areaVertices} vertices`,
+  );
+  await page.mouse.click(410, 500, { count: 2 });
+  const areaLanded = await waitForMarks(3);
+  await wait(900);
+  const afterDoubleClick = await page.evaluate(() =>
+    window.__gevAnnotations.count(),
+  );
+  check('an area finished by double-click lands on the board', areaLanded);
+  check(
+    'a double-click finishes the shape exactly once',
+    afterDoubleClick === 3,
+    `${afterDoubleClick} marks`,
+  );
+  const areaMark = (await marks()).find(
+    (mark) => mark.label === 'Civic Center block',
+  );
+  check(
+    'the label and colour chosen in the panel are what is drawn',
+    areaMark?.color === 'amber',
+    JSON.stringify(areaMark),
+  );
+  await wait(1200);
+  const amberAfter = await amberPixels();
+  check(
+    'the finished area actually PAINTS — amber pixels appear on this surface',
+    amberAfter - amberBefore > 500,
+    `${amberBefore} → ${amberAfter} amber pixels (+${amberAfter - amberBefore})`,
+  );
+  await shot('01-area-with-label');
+  await shot('03-pins-and-shapes');
+
+  // ── Escape cancels the shape, a second Escape leaves draw mode ──────────
+  await page.evaluate(() => window.__gevDrawTool.cancel());
+  await clickWorld(500, 300);
+  await clickWorld(560, 340);
+  check('a new shape is in progress', (await drawState()).vertices === 2);
+  await page.keyboard.press('Escape');
+  await wait(150);
+  const afterFirstEscape = await drawState();
+  check(
+    'Escape cancels the shape in progress and stays in draw mode',
+    afterFirstEscape.vertices === 0 && afterFirstEscape.active === true,
+    `vertices ${afterFirstEscape.vertices}, active ${afterFirstEscape.active}`,
+  );
+  await page.keyboard.press('Escape');
+  await wait(150);
+  const afterSecondEscape = await drawState();
+  check(
+    'a second Escape leaves draw mode and gives the pointer back',
+    afterSecondEscape.active === false &&
+      afterSecondEscape.pointerOwner === null &&
+      afterSecondEscape.sceneHandler === false,
+    JSON.stringify(afterSecondEscape),
+  );
+  check(
+    'cancelling never removes a mark already on the board',
+    afterSecondEscape.marks === 3,
+    `${afterSecondEscape.marks} marks`,
+  );
+
+  // ── a click that would select something selects nothing while drawing ───
+  const target = await findClickableTarget();
+  check(
+    'a selectable layer entity is on screen to test click ownership against',
+    Boolean(target),
+    target
+      ? `${target.layer} at ${target.x},${target.y}`
+      : 'no CCTV camera or bundled site could be reached — the ownership case cannot be proved',
+  );
+  if (target) {
+    await clickWorld(target.x, target.y, { settle: 900 });
+    const selectedNormally = await page.evaluate(() =>
+      Boolean(window.__godsEyeView.viewer.selectedEntity),
+    );
+    check(
+      `clicking a ${target.layer} selects it when nothing owns the pointer`,
+      selectedNormally,
+    );
+    await page.evaluate(() => {
+      window.__godsEyeView.viewer.selectedEntity = undefined;
+    });
+    await page.click('#draw-toggle');
+    await page.click('.pp-mode-btn[data-shape="area"]');
+    await clickWorld(target.x, target.y, { settle: 900 });
+    const whileDrawing = await drawState();
+    const selectedWhileDrawing = await page.evaluate(() =>
+      Boolean(window.__godsEyeView.viewer.selectedEntity),
+    );
+    check(
+      `clicking the same ${target.layer} while drawing adds a vertex and selects nothing`,
+      whileDrawing.vertices === 1 && selectedWhileDrawing === false,
+      `vertices ${whileDrawing.vertices}, selected ${selectedWhileDrawing}`,
+    );
+    await page.keyboard.press('Escape');
+    await page.keyboard.press('Escape');
+    await wait(150);
+  }
+
+  // ── what a reload actually does ─────────────────────────────────────────
+  const beforeReload = await page.evaluate(() =>
+    window.__gevAnnotations.count(),
+  );
+  await page.reload({ waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(
+    () =>
+      window.__gevAnnotations &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 90_000 },
+  );
+  const afterReload = await page.evaluate(() =>
+    window.__gevAnnotations.count(),
+  );
+  check(
+    'a reload starts an empty board — marks live for the session, not across reloads',
+    beforeReload > 0 && afterReload === 0,
+    `${beforeReload} before, ${afterReload} after`,
+  );
+
+  // ── Clear wipes the board ───────────────────────────────────────────────
+  await page.evaluate(() => {
+    const rail = document.getElementById('pp-toggles');
+    if (rail?.classList.contains('collapsed'))
+      document
+        .querySelector('.panel-collapse-btn[data-collapse-target="pp-toggles"]')
+        ?.click();
+  });
+  await page.waitForFunction(
+    () =>
+      document.getElementById('draw-toggle')?.getBoundingClientRect().width > 0,
+    { timeout: 10_000 },
+  );
+  // The reload built a new page context: re-capture the viewer's own click
+  // actions so the identity comparisons below still mean something.
+  await page.evaluate(() => {
+    const Cesium = window.__CESIUM__;
+    const stock = window.__godsEyeView.viewer.screenSpaceEventHandler;
+    window.__qaStock = {
+      click:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK) || null,
+      double:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK) ||
+        null,
+    };
+  });
+  await page.evaluate((view) => {
+    const viewer = window.__godsEyeView.viewer;
+    viewer.camera.cancelFlight?.();
+    viewer.camera.setView({
+      destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+        longitude: (view.lon * Math.PI) / 180,
+        latitude: (view.lat * Math.PI) / 180,
+        height: view.height,
+      }),
+      orientation: { heading: 0, pitch: (view.pitch * Math.PI) / 180, roll: 0 },
+    });
+  }, VIEW);
+  await wait(2500);
+  await page.click('#draw-toggle');
+  await page.click('.pp-mode-btn[data-shape="area"]');
+  await clickWorld(420, 280);
+  await clickWorld(700, 300);
+  await clickWorld(660, 520);
+  await pressFinish();
+  const drewAgain = await waitForMarks(1);
+  check('a shape can be drawn again after a reload', drewAgain);
+
+  // Enter belongs to whatever the keyboard is on. With Clear focused it must
+  // PRESS CLEAR — the shape in progress goes, and so does the mark already on
+  // the board — and it must NOT quietly finish a second shape.
+  await clickWorld(430, 300);
+  await clickWorld(690, 320);
+  await clickWorld(670, 500);
+  const beforeButtonEnter = await drawState();
+  await page.focus('#draw-clear');
+  await page.keyboard.press('Enter');
+  await wait(600);
+  const afterButtonEnter = await drawState();
+  check(
+    'Enter on a keyboard-focused button activates the button, it does not finish the shape',
+    beforeButtonEnter.vertices === 3 &&
+      beforeButtonEnter.marks === 1 &&
+      afterButtonEnter.marks === 0 &&
+      afterButtonEnter.vertices === 0,
+    `before ${beforeButtonEnter.vertices} vertices / ${beforeButtonEnter.marks} marks, ` +
+      `after ${afterButtonEnter.vertices} / ${afterButtonEnter.marks} ` +
+      '(a finish would have made it 2 marks)',
+  );
+
+  // Put one back so the Clear BUTTON check below has something to remove.
+  await clickWorld(420, 280);
+  await clickWorld(700, 300);
+  await clickWorld(660, 520);
+  await pressFinish();
+  check(
+    'a shape can be drawn after the board was cleared from the keyboard',
+    await waitForMarks(1),
+  );
+  await page.click('#draw-clear');
+  await wait(400);
+  const cleared = await drawState();
+  check(
+    'Clear removes every mark from the board',
+    cleared.marks === 0,
+    `${cleared.marks} marks left`,
+  );
+  await shot('04-after-clear');
+
+  // ── a shape that describes nothing is refused, not placed ───────────────
+  const degenerateVertices = await page.evaluate(() => {
+    const tool = window.__gevDrawTool;
+    tool.cancel();
+    // Three points on one line, placed through the same addVertex the clicks use.
+    tool.addVertex(-122.42, 37.77);
+    tool.addVertex(-122.42, 37.771);
+    tool.addVertex(-122.42, 37.772);
+    return tool.session?.vertices?.length ?? null;
+  });
+  check(
+    'three collinear vertices are accepted into the session',
+    degenerateVertices === 3,
+    `${degenerateVertices} vertices`,
+  );
+  await pressFinish();
+  await wait(600);
+  const degenerate = await drawState();
+  check(
+    'three points in a line are refused with a reason, not placed',
+    degenerate.marks === 0 && /in a line/.test(degenerate.hint),
+    `${degenerate.marks} marks, hint "${degenerate.hint}"`,
+  );
+
+  // ── a shape drawn across the antimeridian lands where it was drawn ──────
+  await page.evaluate(() => {
+    const viewer = window.__godsEyeView.viewer;
+    viewer.camera.cancelFlight?.();
+    viewer.camera.setView({
+      destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+        longitude: (179.9995 * Math.PI) / 180,
+        latitude: 0,
+        height: 3000,
+      }),
+      orientation: { heading: 0, pitch: (-88 * Math.PI) / 180, roll: 0 },
+    });
+    viewer.scene.requestRender();
+  });
+  await wait(2500);
+  await page.evaluate(() => {
+    const tool = window.__gevDrawTool;
+    tool.cancel();
+    tool.setShape('area');
+    // A ~200 m square straddling 180.
+    tool.addVertex(179.999, -0.001);
+    tool.addVertex(-179.999, -0.001);
+    tool.addVertex(-179.999, 0.001);
+    tool.addVertex(179.999, 0.001);
+  });
+  await pressFinish();
+  const datelineLanded = await waitForMarks(1);
+  const datelineAnchor = await page.evaluate(() => {
+    const mark = window.__gevAnnotations.list()[0];
+    return mark ? { lon: mark.anchor?.lon, lat: mark.anchor?.lat } : null;
+  });
+  check(
+    'a shape drawn across the antimeridian anchors there, not on the Greenwich meridian',
+    datelineLanded &&
+      datelineAnchor &&
+      Math.abs(Math.abs(datelineAnchor.lon) - 180) < 0.1 &&
+      Math.abs(datelineAnchor.lat) < 0.1,
+    JSON.stringify(datelineAnchor),
+  );
+  await page.evaluate(() => window.__gevAnnotations.clear());
+
+  await page.click('#draw-toggle');
+  await wait(200);
+  const finalState = await drawState();
+  check(
+    'leaving draw mode gives back the pointer, the handler and the double-click',
+    finalState.active === false &&
+      finalState.pointerOwner === null &&
+      finalState.sceneHandler === false &&
+      finalState.previewDataSources === 1,
+    JSON.stringify(finalState),
+  );
+  // ── destroy(): the shell disposing the tool leaves nothing behind ───────
+  const beforeDestroy = await page.evaluate(
+    () => window.__godsEyeView.viewer.dataSources.length,
+  );
+  await page.click('#draw-toggle'); // destroy from an ACTIVE session: the harder case
+  await wait(200);
+  const destroyed = await page.evaluate(async () => {
+    const tool = window.__gevDrawTool;
+    const wasActive = tool.active;
+    await tool.destroy();
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    const Cesium = window.__CESIUM__;
+    const viewer = window.__godsEyeView.viewer;
+    const stock = viewer.screenSpaceEventHandler;
+    let previews = 0;
+    for (let i = 0; i < viewer.dataSources.length; i += 1)
+      if (viewer.dataSources.get(i)?.name === 'gev-draw-preview') previews += 1;
+    return {
+      wasActive,
+      diagnostics: tool.diagnostics(),
+      previews,
+      dataSources: viewer.dataSources.length,
+      handleGone: window.__gevDrawTool === undefined,
+      clickRestored:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK) ===
+        window.__qaStock.click,
+      doubleRestored:
+        stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK) ===
+        window.__qaStock.double,
+      drawingClass: document.body.classList.contains('gev-drawing'),
+    };
+  });
+  check(
+    'destroy() from an active session releases the pointer, handler and listeners',
+    destroyed.wasActive === true &&
+      destroyed.diagnostics.destroyed === true &&
+      destroyed.diagnostics.pointerOwner === null &&
+      destroyed.diagnostics.sceneHandler === false &&
+      destroyed.diagnostics.domListeners === 0 &&
+      destroyed.drawingClass === false,
+    JSON.stringify(destroyed.diagnostics),
+  );
+  check(
+    'destroy() detaches the preview data source and gives the window handle back',
+    destroyed.previews === 0 &&
+      destroyed.dataSources === beforeDestroy - 1 &&
+      destroyed.handleGone,
+    `previews ${destroyed.previews}, dataSources ${beforeDestroy} → ${destroyed.dataSources}, handle gone ${destroyed.handleGone}`,
+  );
+  check(
+    "destroy() returns Cesium's own click actions",
+    destroyed.clickRestored && destroyed.doubleRestored,
+    `click ${destroyed.clickRestored}, double ${destroyed.doubleRestored}`,
+  );
+
+  check(
+    'no uncaught page errors across the run',
+    errors.length === 0,
+    errors.join(' | '),
+  );
+} finally {
+  await browser.close();
+}
+console.log(`RESULT: ${failures} failures`);
+process.exitCode = failures ? 1 : 0;
+
+/**
+ * Find something on screen that a layer would select on click, so the ownership
+ * guard can be proved against a real selection rather than a stub. Bundled
+ * infrastructure first (no network, works keyless); CCTV cameras if they are up.
+ */
+async function findClickableTarget() {
+  // CCTV first: it is the layer the brief names, and it goes through the shared
+  // tracking click gesture that flights and military use too.
+  const camera = await page
+    .evaluate(async () => {
+      const manager = window.__godsEyeView.dataManager;
+      await manager.setEnabled('cctv', true, { origin: 'user' });
+      const module = manager.layers.get('cctv')?.module;
+      if (!module?.getUIState) return null;
+      for (let attempt = 0; attempt < 40; attempt += 1) {
+        const cameras = module.getUIState()?.cameras || [];
+        const found = cameras.find((entry) => {
+          const lat = entry.lat ?? entry.latitude;
+          const lon = entry.lon ?? entry.longitude;
+          return Number.isFinite(lat) && Number.isFinite(lon);
+        });
+        if (found)
+          return {
+            id: found.id,
+            lat: found.lat ?? found.latitude,
+            lon: found.lon ?? found.longitude,
+          };
+        await new Promise((resolve) => setTimeout(resolve, 500));
+      }
+      return null;
+    })
+    .catch(() => null);
+
+  if (camera) {
+    await page.evaluate((spot) => {
+      const viewer = window.__godsEyeView.viewer;
+      viewer.camera.cancelFlight?.();
+      viewer.camera.setView({
+        destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+          longitude: (spot.lon * Math.PI) / 180,
+          latitude: (spot.lat * Math.PI) / 180,
+          height: 600,
+        }),
+        orientation: { heading: 0, pitch: (-80 * Math.PI) / 180, roll: 0 },
+      });
+      viewer.scene.requestRender();
+    }, camera);
+    await wait(4000);
+    const spot = await onScreen(
+      (entity) => typeof entity.id === 'string' && entity.id.startsWith('CAM-'),
+    );
+    if (spot) return { ...spot, layer: 'CCTV camera' };
+  }
+
+  // Bundled infrastructure as the keyless fallback: a different guarded handler,
+  // the same shared claim, and always present without a key.
+  const site = await page
+    .evaluate(async () => {
+      const viewer = window.__godsEyeView.viewer;
+      await window.__godsEyeView.dataManager.setEnabled(
+        'local-datacenters',
+        true,
+        {
+          origin: 'user',
+        },
+      );
+      const centreOf = (entity) => {
+        const time = viewer.clock.currentTime;
+        const point = entity.position?.getValue?.(time);
+        if (point) return point;
+        const hierarchy = entity.polygon?.hierarchy?.getValue?.(time);
+        if (hierarchy?.positions?.length) return hierarchy.positions[0];
+        const line = entity.polyline?.positions?.getValue?.(time);
+        return line?.length ? line[0] : null;
+      };
+      for (let attempt = 0; attempt < 40; attempt += 1) {
+        for (let i = 0; i < viewer.dataSources.length; i += 1) {
+          for (const entity of viewer.dataSources.get(i).entities.values) {
+            if (entity.__localLayerId !== 'local-datacenters') continue;
+            const point = centreOf(entity);
+            if (!point) continue;
+            const carto = window.Cesium
+              ? window.Cesium.Cartographic.fromCartesian(point)
+              : viewer.scene.globe.ellipsoid.cartesianToCartographic(point);
+            if (!carto) continue;
+            return {
+              lon: (carto.longitude * 180) / Math.PI,
+              lat: (carto.latitude * 180) / Math.PI,
+            };
+          }
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500));
+      }
+      return null;
+    })
+    .catch(() => null);
+  if (!site) return null;
+  await page.evaluate((spot) => {
+    const viewer = window.__godsEyeView.viewer;
+    viewer.camera.cancelFlight?.();
+    viewer.camera.setView({
+      destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+        longitude: (spot.lon * Math.PI) / 180,
+        latitude: (spot.lat * Math.PI) / 180,
+        height: 2500,
+      }),
+      orientation: { heading: 0, pitch: (-88 * Math.PI) / 180, roll: 0 },
+    });
+    viewer.scene.requestRender();
+  }, site);
+  await wait(4000);
+  const spot = await onScreen(
+    (entity) => entity.__localLayerId === 'local-datacenters',
+  );
+  return spot ? { ...spot, layer: 'data centre' } : null;
+}
+
+/**
+ * Canvas coordinates of the first entity matching `belongs` that is on screen
+ * and clear of the side panels. Annotation marks and the draw tool's own
+ * preview vertices are on screen too, so the predicate has to be specific.
+ */
+async function onScreen(belongs, timeout = 20_000) {
+  return page
+    .waitForFunction(
+      (belongsSource) => {
+        // eslint-disable-next-line no-new-func
+        const belongsTo = new Function(`return (${belongsSource})`)();
+        const viewer = window.__godsEyeView.viewer;
+        const scene = viewer.scene;
+        const collections = [viewer.entities];
+        for (let i = 0; i < viewer.dataSources.length; i += 1) {
+          const source = viewer.dataSources.get(i);
+          if (source?.name === 'gev-draw-preview') continue;
+          collections.push(source.entities);
+        }
+        for (const source of collections) {
+          for (const entity of source.values) {
+            if (!belongsTo(entity)) continue;
+            const position = entity.position?.getValue?.(
+              viewer.clock.currentTime,
+            );
+            if (!position) continue;
+            const window2d = scene.cartesianToCanvasCoordinates(position);
+            if (!window2d) continue;
+            const { x, y } = window2d;
+            if (!(x > 300 && x < 900 && y > 180 && y < 600)) continue;
+            // Projecting into the window is not the same as being clickable:
+            // the entity may be beyond the horizon or behind a building. Only a
+            // spot where the scene actually picks it proves the control case.
+            const hit = scene.pick({ x: Math.round(x), y: Math.round(y) });
+            if (!hit?.id || !belongsTo(hit.id)) continue;
+            return { x: Math.round(x), y: Math.round(y) };
+          }
+        }
+        return false;
+      },
+      { timeout, polling: 500 },
+      belongs.toString(),
+    )
+    .then(
+      (handle) => handle.jsonValue(),
+      () => null,
+    );
+}
diff --git a/src/annotations/annotationEngine.js b/src/annotations/annotationEngine.js
index 7c9e59583..e9f19c69f 100644
--- a/src/annotations/annotationEngine.js
+++ b/src/annotations/annotationEngine.js
@@ -1,7 +1,8 @@
 import { defaultGeospatial } from '../search/defaults.js';
 import * as Cesium from 'cesium';
 import { holdContinuousRender, releaseContinuousRender } from '../renderGovernor.js';
-import { isRateLimitedOutcome, resolveAnnotationTarget } from './annotationResolver.js';
+import { isRateLimitedOutcome, resolveAnnotationTarget, sampleGroundHeight } from './annotationResolver.js';
+import { ringCentroid } from './drawMode.js';
 
 // Dev convenience: expose the app's Cesium instance for console/preview probing
 // (single shared module instance — avoids dual-Cesium state bugs when testing).
@@ -387,6 +388,9 @@ export function createAnnotationEngine({
 
   async function resolveSpec(spec, signal, allowDistant = false) {
     const type = normalizeType(spec?.type);
+    // MANUAL geometry (drawTool.js): the person clicked the vertices, so there is
+    // nothing to resolve. Same record shapes as a resolved spec, source 'manual'.
+    if (isManualSpec(spec, type)) return resolveManualSpec(spec, type, viewer);
     if (type === 'route') {
       const points = Array.isArray(spec.points) ? spec.points : [];
       if (points.length < 2) throw new Error('a route needs at least 2 waypoints');
@@ -1103,6 +1107,67 @@ function round5(n) {
   return Number.isFinite(n) ? Math.round(n * 1e5) / 1e5 : null;
 }
 
+/** A spec whose geometry was supplied by hand (drawTool.js) rather than by a name. */
+function isManualSpec(spec, type) {
+  if (!spec || spec.manual !== true) return false;
+  if (type === 'route') return Array.isArray(spec.path) && spec.path.length >= 2;
+  if (type === 'area') return Array.isArray(spec.ring) && spec.ring.length >= 3;
+  return Number.isFinite(Number(spec.latitude)) && Number.isFinite(Number(spec.longitude));
+}
+
+/** [lon, lat] pairs or {lon, lat} objects → [lon, lat] pairs, invalid entries dropped. */
+function manualPairs(list) {
+  return (Array.isArray(list) ? list : [])
+    .map((p) => (Array.isArray(p) ? [Number(p[0]), Number(p[1])] : [Number(p?.lon ?? p?.longitude), Number(p?.lat ?? p?.latitude)]))
+    .filter(([lon, lat]) => Number.isFinite(lon) && Number.isFinite(lat) && Math.abs(lat) <= 90 && Math.abs(lon) <= 180);
+}
+
+/**
+ * Resolve a hand-drawn spec without any fetch. An area keeps its ring as a real
+ * (not synthesized) outline so it drapes solid; a line is a `route` with mode
+ * 'manual', its length as distance and no travel time; a pin is a point.
+ */
+function resolveManualSpec(spec, type, viewer) {
+  if (type === 'route') {
+    // height 0 is a placeholder, not a placement: the world renderer draws a
+    // route with clampToGround + CESIUM_3D_TILE classification, so the line is
+    // draped onto the photoreal surface whatever this number says.
+    const pts = manualPairs(spec.path).map(([lon, lat]) => ({ lon, lat, height: 0 }));
+    if (pts.length < 2) throw new Error('a drawn line needs at least 2 points');
+    let distanceM = 0;
+    for (let i = 1; i < pts.length; i += 1) distanceM += greatCircleM(pts[i - 1], pts[i]);
+    return { path: pts, distanceM, durationS: null, mode: 'manual', source: 'manual', fallback: false };
+  }
+  if (type === 'area') {
+    const ring = manualPairs(spec.ring);
+    if (ring.length < 3) throw new Error('a drawn area needs at least 3 points');
+    // Averaged through ringCentroid, which unwraps longitudes first: a ring
+    // straddling the antimeridian has coordinates like [179.999, -179.999], and
+    // a raw mean of those puts the anchor on the Greenwich meridian, half a
+    // world from the shape it belongs to. A repeated closing vertex is dropped
+    // so it does not weight its own corner twice.
+    const distinct = closedRingWithoutRepeat(ring);
+    const centre = ringCentroid(distinct.map(([lon, lat]) => ({ lon, lat })));
+    const lon = centre.lon;
+    const lat = centre.lat;
+    return {
+      lon, lat, height: sampleGroundHeight(viewer, lon, lat),
+      ring, footprintKind: 'area', buildingHeight: null, synthesized: false, source: 'manual',
+    };
+  }
+  const lon = Number(spec.longitude);
+  const lat = Number(spec.latitude);
+  return { lon, lat, height: sampleGroundHeight(viewer, lon, lat), ring: null, source: 'manual' };
+}
+
+/** The ring's distinct positions: a closing vertex that repeats the first is dropped. */
+function closedRingWithoutRepeat(ring) {
+  if (ring.length < 2) return ring;
+  const [firstLon, firstLat] = ring[0];
+  const [lastLon, lastLat] = ring[ring.length - 1];
+  return firstLon === lastLon && firstLat === lastLat ? ring.slice(0, -1) : ring;
+}
+
 function normalizeMode(m) {
   const t = String(m || '').toLowerCase();
   if (t === 'car' || t === 'drive' || t === 'driving') return 'car';
@@ -1138,6 +1203,7 @@ function composeRouteLabel(baseLabel, distM, durS, mode, fallback) {
   if (!dist) return baseLabel;
   const min = Number.isFinite(durS) ? Math.max(1, Math.round(durS / 60)) : null;
   const word = mode === 'car' ? 'drive' : mode === 'bike' ? 'ride' : 'walk';
+  if (mode === 'manual') return baseLabel ? `${baseLabel} — ${dist}` : dist;
   // Fallback = routing was unavailable, so we drew a straight line: label it as a
   // direct line with no travel time (never claim an "X min walk" we didn't compute).
   let metrics;
diff --git a/src/annotations/annotationResolver.js b/src/annotations/annotationResolver.js
index 960ea3a39..cfdba190a 100644
--- a/src/annotations/annotationResolver.js
+++ b/src/annotations/annotationResolver.js
@@ -1,4 +1,4 @@
 import { createAnnotationResolver } from './resolver.js';
 import { applicationServices } from '../services/application.js';
 const resolver = createAnnotationResolver({ boundarySource: applicationServices.boundaries });
-export const { resolveAnnotationTarget, refineScope, isRateLimitedOutcome, isGroundsLikeAsk, selectFootprint, viewportBias, placesNearViewRecovery, resolveRegionRingForQuery } = resolver;
+export const { resolveAnnotationTarget, refineScope, isRateLimitedOutcome, isGroundsLikeAsk, selectFootprint, viewportBias, placesNearViewRecovery, resolveRegionRingForQuery, pickWorldFromScreen, sampleGroundHeight } = resolver;
diff --git a/src/annotations/drawMode.js b/src/annotations/drawMode.js
new file mode 100644
index 000000000..f28a7ae6f
--- /dev/null
+++ b/src/annotations/drawMode.js
@@ -0,0 +1,303 @@
+/**
+ * Manual whiteboard drawing: the pure half.
+ *
+ * The voice whiteboard resolves NAMES to geometry. This module is for the other
+ * way in: a person clicks the vertices themselves. It holds a draw session (the
+ * shape being drawn and its vertices), decides when a shape is finishable, and
+ * turns a finished session into the SAME annotation spec the engine already
+ * accepts (`type: area | route | pin`, geometry supplied, `manual: true`), so a
+ * hand-drawn mark renders, persists, de-dups and clears exactly like a spoken
+ * one.
+ *
+ * A vertex is a lon/lat and nothing more. The world renderer drapes every mark
+ * onto the photoreal surface (`clampToGround` + `CESIUM_3D_TILE`), so there is
+ * no such thing as a vertex at a height here: the height under the click is
+ * used for the live preview and is deliberately dropped at finish.
+ *
+ * No Cesium, no DOM — importable under `node --test`. The Cesium/DOM half is
+ * `drawTool.js`.
+ */
+
+export const DRAW_SHAPES = Object.freeze(['area', 'line', 'pin']);
+export const MIN_VERTICES = Object.freeze({ area: 3, line: 2, pin: 1 });
+/**
+ * Hard ceiling on vertices in one shape. Every vertex is a live preview entity
+ * and a position in the finished geometry, so a stuck mouse button or a script
+ * must not be able to grow one shape without limit.
+ */
+export const MAX_VERTICES = 512;
+/** Two clicks closer than this are one vertex: a double-click to finish must not add a stray point. */
+export const MIN_VERTEX_SEPARATION_M = 0.5;
+/** A line shorter than this, or an area thinner than this, is a mis-click rather than a shape. */
+export const MIN_PATH_LENGTH_M = 1;
+export const MIN_AREA_M2 = 1;
+
+/** @param {string} shape @returns {'area'|'line'|'pin'} */
+export function normalizeShape(shape) {
+  const s = String(shape || '').toLowerCase();
+  if (s === 'line' || s === 'path' || s === 'route') return 'line';
+  if (s === 'pin' || s === 'point' || s === 'marker') return 'pin';
+  return 'area';
+}
+
+/** @param {string} [shape] @returns {{shape: 'area'|'line'|'pin', vertices: Array<{lon:number, lat:number, height?:number}>}} */
+export function createDrawSession(shape = 'area') {
+  return { shape: normalizeShape(shape), vertices: [] };
+}
+
+/** Great-circle distance in metres between two {lon, lat} points. */
+export function greatCircleM(a, b) {
+  const R = 6371000;
+  const toRad = (d) => (d * Math.PI) / 180;
+  const dLat = toRad(b.lat - a.lat);
+  const dLon = toRad(b.lon - a.lon);
+  const h =
+    Math.sin(dLat / 2) ** 2 +
+    Math.cos(toRad(a.lat)) * Math.cos(toRad(b.lat)) * Math.sin(dLon / 2) ** 2;
+  return 2 * R * Math.asin(Math.sqrt(Math.min(1, h)));
+}
+
+/**
+ * Add a vertex. A vertex that is not a finite lon/lat is refused; one within
+ * MIN_VERTEX_SEPARATION_M of the previous vertex is treated as the same click
+ * (the second half of a double-click) and refused as a duplicate. A pin holds
+ * exactly one vertex: a later click moves it.
+ * @returns {{added: boolean, reason?: 'invalid'|'duplicate'}}
+ */
+export function addVertex(
+  session,
+  vertex,
+  { minSeparationM = MIN_VERTEX_SEPARATION_M } = {},
+) {
+  if (!session || !isFiniteCoordinate(vertex))
+    return { added: false, reason: 'invalid' };
+  const v = {
+    lon: vertex.lon,
+    lat: vertex.lat,
+    height: Number.isFinite(vertex.height) ? vertex.height : 0,
+  };
+  if (session.shape === 'pin') {
+    session.vertices = [v];
+    return { added: true };
+  }
+  if (session.vertices.length >= MAX_VERTICES)
+    return { added: false, reason: 'full' };
+  const last = session.vertices[session.vertices.length - 1];
+  if (last && greatCircleM(last, v) < minSeparationM)
+    return { added: false, reason: 'duplicate' };
+  session.vertices.push(v);
+  return { added: true };
+}
+
+/** A usable click position: finite, and on the globe rather than past its edges. */
+export function isFiniteCoordinate(vertex) {
+  if (!vertex) return false;
+  const { lon, lat } = vertex;
+  return (
+    Number.isFinite(lon) &&
+    Number.isFinite(lat) &&
+    Math.abs(lon) <= 180 &&
+    Math.abs(lat) <= 90
+  );
+}
+
+/** Remove the last vertex. @returns {boolean} whether one was removed */
+export function removeLastVertex(session) {
+  if (!session?.vertices?.length) return false;
+  session.vertices.pop();
+  return true;
+}
+
+/**
+ * Why a session can or cannot become an annotation.
+ * - `too-few`: not enough vertices yet.
+ * - `degenerate`: enough vertices, but they describe nothing — three collinear
+ *   points enclose no area, and a line that doubles back on itself has no
+ *   length. Drawing one of those and calling it a mark would put an invisible
+ *   entity on the board that the person cannot see, select or explain.
+ * @returns {'ok'|'too-few'|'degenerate'|'invalid'}
+ */
+export function finishReason(session) {
+  if (!session || !Array.isArray(session.vertices)) return 'invalid';
+  if (session.vertices.some((vertex) => !isFiniteCoordinate(vertex)))
+    return 'invalid';
+  if (session.vertices.length < (MIN_VERTICES[session.shape] || 1))
+    return 'too-few';
+  if (
+    session.shape === 'line' &&
+    pathLengthM(session.vertices) < MIN_PATH_LENGTH_M
+  )
+    return 'degenerate';
+  if (session.shape === 'area' && ringAreaM2(session.vertices) < MIN_AREA_M2)
+    return 'degenerate';
+  return 'ok';
+}
+
+/** @returns {boolean} whether the session can become an annotation right now */
+export function canFinish(session) {
+  return finishReason(session) === 'ok';
+}
+
+/** Length of an open path in metres. */
+export function pathLengthM(vertices) {
+  let m = 0;
+  for (let i = 1; i < (vertices?.length || 0); i += 1)
+    m += greatCircleM(vertices[i - 1], vertices[i]);
+  return m;
+}
+
+/**
+ * The same vertices with longitudes made CONTINUOUS relative to the first one,
+ * so planar maths does not tear at the antimeridian. A small shape straddling
+ * 180° has longitudes like [179.999, -179.999]; subtracting those raw gives
+ * 359.998° of width instead of 0.002°, which is how a 25,000 m² rectangle
+ * measured 4,461 km² and reported its centre on the Greenwich meridian.
+ *
+ * Values may leave the [-180, 180] range on purpose — that is what "continuous"
+ * means. Re-wrap with `wrapLongitude` before handing one back as a coordinate.
+ * @param {Array<{lon:number, lat:number}>} vertices
+ */
+export function unwrapLongitudes(vertices) {
+  if (!vertices?.length) return [];
+  const reference = vertices[0].lon;
+  return vertices.map((vertex) => {
+    let lon = vertex.lon;
+    while (lon - reference > 180) lon -= 360;
+    while (lon - reference < -180) lon += 360;
+    return { ...vertex, lon };
+  });
+}
+
+/** A continuous longitude brought back into [-180, 180]. */
+export function wrapLongitude(lon) {
+  if (!Number.isFinite(lon)) return lon;
+  // A value already in range is returned UNCHANGED rather than pushed through
+  // the modulo, which is only exact in binary for some inputs: 0.0005 came back
+  // as 0.0004999999999881766. The seam is the only place the arithmetic is
+  // needed, so it is the only place that pays for it.
+  if (lon >= -180 && lon < 180) return lon;
+  const value = ((((lon + 180) % 360) + 360) % 360) - 180;
+  return Object.is(value, -0) ? 0 : value;
+}
+
+/** Planar shoelace area of a ring in square metres (local metre grid; fine at whiteboard scale). */
+export function ringAreaM2(vertices) {
+  if (!vertices || vertices.length < 3) return 0;
+  const ring = unwrapLongitudes(vertices);
+  const lat0 = ring.reduce((s, v) => s + v.lat, 0) / ring.length;
+  const kx = 111320 * Math.cos((lat0 * Math.PI) / 180);
+  const ky = 111320;
+  let twice = 0;
+  for (let i = 0; i < ring.length; i += 1) {
+    const a = ring[i];
+    const b = ring[(i + 1) % ring.length];
+    twice += a.lon * kx * (b.lat * ky) - b.lon * kx * (a.lat * ky);
+  }
+  return Math.abs(twice) / 2;
+}
+
+/** Vertex-average centroid of a ring, {lon, lat}, safe across the antimeridian. */
+export function ringCentroid(vertices) {
+  if (!vertices?.length) return null;
+  const ring = unwrapLongitudes(vertices);
+  return {
+    lon: wrapLongitude(ring.reduce((s, v) => s + v.lon, 0) / ring.length),
+    lat: ring.reduce((s, v) => s + v.lat, 0) / ring.length,
+  };
+}
+
+/** Distance or area, formatted for a label suffix. */
+export function formatMeasure(session) {
+  if (!session) return '';
+  if (session.shape === 'line') {
+    const m = pathLengthM(session.vertices);
+    return m >= 1000
+      ? `${(m / 1000).toFixed(m >= 10000 ? 0 : 1)} km`
+      : `${Math.round(m)} m`;
+  }
+  if (session.shape === 'area') {
+    const m2 = ringAreaM2(session.vertices);
+    if (m2 >= 1e6) return `${(m2 / 1e6).toFixed(2)} km²`;
+    if (m2 >= 1e4) return `${(m2 / 1e4).toFixed(1)} ha`;
+    return `${Math.round(m2)} m²`;
+  }
+  return '';
+}
+
+/**
+ * The annotation spec for a finished session, in the shape `annotationEngine.annotate()`
+ * takes. Null when the session cannot finish. Geometry is supplied outright and
+ * `manual: true` tells the engine to skip name resolution.
+ *
+ * The per-vertex height from the click is dropped here, deliberately and in one
+ * place: the world renderer drapes areas and routes onto the photoreal surface,
+ * so a height carried this far would be discarded further downstream instead,
+ * silently. What the person gets is the outline they drew, lying on the
+ * surface under it.
+ * @param {object} session
+ * @param {{label?: string, color?: string}} [opts]
+ */
+export function finishSpec(session, { label = '', color = 'primary' } = {}) {
+  if (!canFinish(session)) return null;
+  const text = String(label || '').trim();
+  const pts = session.vertices.map((v) => [v.lon, v.lat]);
+  if (session.shape === 'area') {
+    // CLOSED explicitly. A polygon fill closes itself, but the outline beside it
+    // is a polyline, and an open ring draws every edge except the one back to
+    // the first vertex — the shape reads as a shape with one side missing.
+    return {
+      type: 'area',
+      manual: true,
+      ring: closeRing(pts),
+      label: text || null,
+      color,
+    };
+  }
+  if (session.shape === 'line') {
+    return {
+      type: 'route',
+      manual: true,
+      path: pts,
+      label: text || null,
+      color,
+    };
+  }
+  const [lon, lat] = pts[0];
+  return {
+    type: 'pin',
+    manual: true,
+    latitude: lat,
+    longitude: lon,
+    label: text || null,
+    color,
+  };
+}
+
+/** A ring whose last position repeats its first, so an outline has no gap. */
+export function closeRing(pairs) {
+  if (!Array.isArray(pairs) || pairs.length < 3) return pairs;
+  const [firstLon, firstLat] = pairs[0];
+  const [lastLon, lastLat] = pairs[pairs.length - 1];
+  if (firstLon === lastLon && firstLat === lastLat) return pairs;
+  return [...pairs, [firstLon, firstLat]];
+}
+
+/** One line of guidance for the person drawing, by state. */
+export function drawHint(session) {
+  if (!session) return 'Pick a shape, then click the map.';
+  const n = session.vertices.length;
+  if (session.shape === 'pin')
+    return n
+      ? 'Enter to place the pin, Esc to cancel.'
+      : 'Click where the pin goes.';
+  const need = MIN_VERTICES[session.shape] - n;
+  if (need > 0) return `Click ${need} more point${need === 1 ? '' : 's'}.`;
+  if (finishReason(session) === 'degenerate') {
+    return session.shape === 'area'
+      ? 'Those points are in a line — move one off it to enclose an area.'
+      : 'That line has no length — click somewhere further away.';
+  }
+  const full =
+    n >= MAX_VERTICES ? ` · ${MAX_VERTICES}-point limit reached` : '';
+  return `${formatMeasure(session)} · double-click or Enter to finish, Backspace undoes, Esc cancels.${full}`;
+}
diff --git a/src/annotations/drawMode.test.mjs b/src/annotations/drawMode.test.mjs
new file mode 100644
index 000000000..50475cc9e
--- /dev/null
+++ b/src/annotations/drawMode.test.mjs
@@ -0,0 +1,332 @@
+// Pure tests for the manual draw session. Run with: npm test (node --test). No Cesium, no DOM.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  createDrawSession,
+  addVertex,
+  removeLastVertex,
+  canFinish,
+  finishSpec,
+  normalizeShape,
+  pathLengthM,
+  ringAreaM2,
+  ringCentroid,
+  formatMeasure,
+  drawHint,
+  finishReason,
+  isFiniteCoordinate,
+  closeRing,
+  unwrapLongitudes,
+  wrapLongitude,
+  MAX_VERTICES,
+  MIN_VERTICES,
+} from './drawMode.js';
+
+test('shapes normalize to area, line or pin, and unknown words fall back to area', () => {
+  assert.equal(normalizeShape('route'), 'line');
+  assert.equal(normalizeShape('marker'), 'pin');
+  assert.equal(normalizeShape('polygon'), 'area');
+  assert.equal(normalizeShape(undefined), 'area');
+});
+
+test('an area needs three vertices, a line two, a pin one', () => {
+  const area = createDrawSession('area');
+  addVertex(area, { lon: -97.74, lat: 30.27 });
+  addVertex(area, { lon: -97.73, lat: 30.27 });
+  assert.equal(canFinish(area), false);
+  addVertex(area, { lon: -97.73, lat: 30.28 });
+  assert.equal(canFinish(area), true);
+  assert.equal(MIN_VERTICES.line, 2);
+  assert.equal(MIN_VERTICES.pin, 1);
+});
+
+test('a second click within half a metre is the tail of a double-click, not a vertex', () => {
+  const line = createDrawSession('line');
+  assert.deepEqual(addVertex(line, { lon: 0, lat: 0 }), { added: true });
+  assert.deepEqual(addVertex(line, { lon: 0.000001, lat: 0 }), {
+    added: false,
+    reason: 'duplicate',
+  });
+  assert.deepEqual(addVertex(line, { lon: 'x', lat: 0 }), {
+    added: false,
+    reason: 'invalid',
+  });
+  assert.equal(line.vertices.length, 1);
+});
+
+test('a pin keeps exactly one vertex: a later click moves it', () => {
+  const pin = createDrawSession('pin');
+  addVertex(pin, { lon: 1, lat: 1 });
+  addVertex(pin, { lon: 2, lat: 2 });
+  assert.equal(pin.vertices.length, 1);
+  assert.deepEqual(pin.vertices[0], { lon: 2, lat: 2, height: 0 });
+});
+
+test('backspace removes the last vertex and reports whether it did', () => {
+  const s = createDrawSession('line');
+  assert.equal(removeLastVertex(s), false);
+  addVertex(s, { lon: 0, lat: 0 });
+  assert.equal(removeLastVertex(s), true);
+  assert.equal(s.vertices.length, 0);
+});
+
+test('finishSpec yields the engine spec shapes with manual geometry, or null when unfinished', () => {
+  const area = createDrawSession('area');
+  assert.equal(finishSpec(area), null);
+  [
+    [-97.74, 30.27],
+    [-97.73, 30.27],
+    [-97.73, 30.28],
+  ].forEach(([lon, lat]) => addVertex(area, { lon, lat }));
+  assert.deepEqual(finishSpec(area, { label: ' Zilker ', color: 'amber' }), {
+    type: 'area',
+    manual: true,
+    // CLOSED: the last position repeats the first so the outline polyline
+    // draws all three sides of the triangle, not two.
+    ring: [
+      [-97.74, 30.27],
+      [-97.73, 30.27],
+      [-97.73, 30.28],
+      [-97.74, 30.27],
+    ],
+    label: 'Zilker',
+    color: 'amber',
+  });
+  const line = createDrawSession('line');
+  addVertex(line, { lon: 0, lat: 0 });
+  addVertex(line, { lon: 0.01, lat: 0 });
+  assert.deepEqual(finishSpec(line), {
+    type: 'route',
+    manual: true,
+    path: [
+      [0, 0],
+      [0.01, 0],
+    ],
+    label: null,
+    color: 'primary',
+  });
+  const pin = createDrawSession('pin');
+  addVertex(pin, { lon: 151.2, lat: -33.9 });
+  assert.deepEqual(finishSpec(pin, { label: 'A shed' }), {
+    type: 'pin',
+    manual: true,
+    latitude: -33.9,
+    longitude: 151.2,
+    label: 'A shed',
+    color: 'primary',
+  });
+});
+
+test('length and area come out in metres on a local grid', () => {
+  const km = pathLengthM([
+    { lon: 0, lat: 0 },
+    { lon: 0, lat: 0.009 },
+  ]);
+  assert.ok(km > 990 && km < 1010, `1 km of latitude, got ${km}`);
+  const square = [
+    { lon: 0, lat: 0 },
+    { lon: 0.001, lat: 0 },
+    { lon: 0.001, lat: 0.001 },
+    { lon: 0, lat: 0.001 },
+  ];
+  const m2 = ringAreaM2(square);
+  assert.ok(m2 > 12000 && m2 < 12800, `~111 m square, got ${m2}`);
+  assert.deepEqual(ringCentroid(square), { lon: 0.0005, lat: 0.0005 });
+});
+
+test('the measure and the hint follow the shape and the vertex count', () => {
+  const area = createDrawSession('area');
+  assert.equal(drawHint(area), 'Click 3 more points.');
+  [
+    { lon: 0, lat: 0 },
+    { lon: 0.01, lat: 0 },
+    { lon: 0.01, lat: 0.01 },
+  ].forEach((v) => addVertex(area, v));
+  assert.match(formatMeasure(area), /ha$|km²$|m²$/);
+  assert.match(drawHint(area), /double-click or Enter to finish/);
+  const pin = createDrawSession('pin');
+  assert.equal(drawHint(pin), 'Click where the pin goes.');
+  assert.equal(drawHint(null), 'Pick a shape, then click the map.');
+});
+
+test('a vertex must be a finite coordinate on the globe', () => {
+  assert.equal(isFiniteCoordinate({ lon: 12, lat: -4 }), true);
+  assert.equal(isFiniteCoordinate({ lon: 0, lat: 90 }), true);
+  for (const bad of [
+    null,
+    {},
+    { lon: NaN, lat: 0 },
+    { lon: 0, lat: Infinity },
+    { lon: 181, lat: 0 },
+    { lon: 0, lat: -90.5 },
+    { lon: '10', lat: 10 },
+  ]) {
+    assert.equal(isFiniteCoordinate(bad), false, JSON.stringify(bad));
+  }
+  const line = createDrawSession('line');
+  assert.deepEqual(addVertex(line, { lon: 200, lat: 0 }), {
+    added: false,
+    reason: 'invalid',
+  });
+  assert.equal(line.vertices.length, 0);
+});
+
+test('one shape holds at most MAX_VERTICES points', () => {
+  const line = createDrawSession('line');
+  for (let i = 0; i < MAX_VERTICES + 25; i += 1)
+    addVertex(line, { lon: i * 0.001, lat: 0 });
+  assert.equal(line.vertices.length, MAX_VERTICES);
+  assert.deepEqual(addVertex(line, { lon: 99, lat: 1 }), {
+    added: false,
+    reason: 'full',
+  });
+  assert.match(drawHint(line), /512-point limit reached/);
+
+  // A pin replaces its one vertex forever: the ceiling cannot strand it.
+  const pin = createDrawSession('pin');
+  for (let i = 0; i < MAX_VERTICES + 5; i += 1)
+    assert.equal(addVertex(pin, { lon: i * 0.01, lat: 0 }).added, true);
+  assert.equal(pin.vertices.length, 1);
+});
+
+test('a shape that encloses nothing is refused, with a reason', () => {
+  // Three points on one meridian are not an area.
+  const collinear = createDrawSession('area');
+  for (const lat of [0, 0.001, 0.002]) addVertex(collinear, { lon: 0, lat });
+  assert.equal(collinear.vertices.length, 3);
+  assert.equal(finishReason(collinear), 'degenerate');
+  assert.equal(canFinish(collinear), false);
+  assert.equal(finishSpec(collinear), null);
+  assert.match(drawHint(collinear), /in a line/);
+
+  // Moving one point off that line makes it a shape again.
+  collinear.vertices[2].lon = 0.001;
+  assert.equal(finishReason(collinear), 'ok');
+  assert.ok(finishSpec(collinear));
+
+  // A line whose two ends are a handful of centimetres apart has no length.
+  const stub = createDrawSession('line');
+  addVertex(stub, { lon: 0, lat: 0 });
+  addVertex(stub, { lon: 0.000007, lat: 0 }, { minSeparationM: 0.01 });
+  assert.equal(stub.vertices.length, 2);
+  assert.equal(finishReason(stub), 'degenerate');
+  assert.equal(finishSpec(stub), null);
+  assert.match(drawHint(stub), /no length/);
+
+  // And the states in between are named, not lumped together.
+  assert.equal(finishReason(createDrawSession('area')), 'too-few');
+  assert.equal(finishReason(null), 'invalid');
+});
+
+test('a finished area is a CLOSED ring, so its outline has no missing side', () => {
+  const area = createDrawSession('area');
+  for (const [lon, lat] of [
+    [-97.74, 30.27],
+    [-97.73, 30.27],
+    [-97.73, 30.28],
+  ])
+    addVertex(area, { lon, lat });
+
+  const spec = finishSpec(area);
+  assert.equal(
+    spec.ring.length,
+    4,
+    'three clicked vertices become four ring positions',
+  );
+  assert.deepEqual(
+    spec.ring.at(-1),
+    spec.ring[0],
+    'the last position repeats the first',
+  );
+  // The renderer draws the outline as a polyline over exactly these positions:
+  // an open ring would draw two of the triangle's three sides.
+  assert.equal(spec.ring.length - 1, area.vertices.length);
+
+  // A line is NOT closed — it is a path, and joining its ends would invent a
+  // segment the person never drew.
+  const line = createDrawSession('line');
+  addVertex(line, { lon: 0, lat: 0 });
+  addVertex(line, { lon: 0.01, lat: 0 });
+  assert.equal(finishSpec(line).path.length, 2);
+
+  // closeRing is idempotent: finishing an already-closed ring adds nothing.
+  const closed = closeRing([
+    [0, 0],
+    [1, 0],
+    [1, 1],
+    [0, 0],
+  ]);
+  assert.equal(closed.length, 4);
+});
+
+test('a shape straddling the antimeridian measures what it looks like', () => {
+  // 0.002 degrees square at the equator — about 223 m a side, so ~49,600 m2 —
+  // sitting across 180. Raw longitude arithmetic reads that 0.002-degree width
+  // as 359.998 degrees: the area came out in the thousands of square
+  // kilometres and the centroid landed on the Greenwich meridian, half a world
+  // from the shape it belongs to.
+  const rectangle = [
+    { lon: 179.999, lat: -0.001 },
+    { lon: -179.999, lat: -0.001 },
+    { lon: -179.999, lat: 0.001 },
+    { lon: 179.999, lat: 0.001 },
+  ];
+  const area = ringAreaM2(rectangle);
+  assert.ok(
+    area > 45_000 && area < 55_000,
+    `a ~223 m x ~223 m patch is ~49,600 m2, got ${Math.round(area)} m2`,
+  );
+  assert.ok(area < 1e6, 'and nowhere near a square kilometre');
+
+  const centre = ringCentroid(rectangle);
+  assert.ok(
+    Math.abs(Math.abs(centre.lon) - 180) < 0.01,
+    `the centre belongs on the antimeridian, got lon ${centre.lon}`,
+  );
+  assert.ok(Math.abs(centre.lat) < 0.01, `got lat ${centre.lat}`);
+
+  // Length was already safe — haversine is periodic in the longitude delta —
+  // and this pins that so a "fix" cannot break it.
+  const across = pathLengthM([
+    { lon: 179.999, lat: 0 },
+    { lon: -179.999, lat: 0 },
+  ]);
+  assert.ok(
+    across > 150 && across < 300,
+    `about 222 m, got ${Math.round(across)} m`,
+  );
+
+  // The same shape away from the seam still measures the same.
+  const inland = rectangle.map((v) => ({ lon: v.lon - 179.999, lat: v.lat }));
+  assert.ok(
+    Math.abs(ringAreaM2(inland) - area) < 1,
+    'position must not change size',
+  );
+
+  // And the ordinary case is untouched.
+  const austin = [
+    { lon: -97.75, lat: 30.26 },
+    { lon: -97.74, lat: 30.26 },
+    { lon: -97.74, lat: 30.27 },
+  ];
+  const centroid = ringCentroid(austin);
+  assert.ok(Math.abs(centroid.lon + 97.7433) < 0.001);
+  assert.ok(Math.abs(centroid.lat - 30.2633) < 0.001);
+});
+
+test('longitude unwrapping is continuous and re-wraps to one canonical range', () => {
+  const unwrapped = unwrapLongitudes([
+    { lon: 179.9, lat: 0 },
+    { lon: -179.9, lat: 0 },
+  ]);
+  assert.equal(unwrapped[0].lon, 179.9);
+  assert.ok(
+    Math.abs(unwrapped[1].lon - 180.1) < 1e-9,
+    `continuous neighbour, got ${unwrapped[1].lon}`,
+  );
+  assert.equal(wrapLongitude(180.1).toFixed(4), (-179.9).toFixed(4));
+  assert.equal(wrapLongitude(-190), 170);
+  assert.equal(wrapLongitude(10), 10);
+  assert.equal(wrapLongitude(180), -180);
+  assert.equal(unwrapLongitudes([]).length, 0);
+});
diff --git a/src/annotations/drawTool.js b/src/annotations/drawTool.js
new file mode 100644
index 000000000..7f164b54f
--- /dev/null
+++ b/src/annotations/drawTool.js
@@ -0,0 +1,546 @@
+/**
+ * Manual whiteboard drawing: the Cesium + DOM half.
+ *
+ * DISPLAY ▸ Draw turns the globe into a whiteboard you draw on by hand: pick a
+ * shape (area, line or pin), click the vertices on the real world, double-click
+ * or press Enter to finish, type a label. Each finished shape goes through the
+ * SAME `annotationEngine.annotate()` the voice agent uses, with its geometry
+ * supplied and `manual: true`, so it renders with the whiteboard look,
+ * persists, de-dups, shows up in `.list()`, and clears with the board.
+ *
+ * Two ownership rules make it safe to share the scene with the layers:
+ *
+ * - While a session is open the tool HOLDS THE POINTER
+ *   (`src/data/inputOwnership.js`), and every ambient selection handler yields,
+ *   so a vertex clicked on top of an aircraft or a camera is a vertex and
+ *   nothing else. It is one claim consulted by all of them, not a list of
+ *   exceptions inside each.
+ * - Cesium's Viewer binds its OWN left click (select the entity under the
+ *   pointer) and double click (track it) on the viewer's handler, outside every
+ *   layer and therefore outside the shared claim. Both are borrowed for the
+ *   session and given back on the way out, and `destroy()` gives back every
+ *   listener, the Cesium handler, the preview data source and the window
+ *   handle, so the tool can be turned off or the shell disposed without leaving
+ *   anything behind.
+ *
+ * A vertex carries the height the click landed on — a roof, a hillside — and
+ * that height is what the live preview hangs on, so the rubber band follows the
+ * surface under the pointer instead of sinking to sea level. The world renderer
+ * drapes finished areas and routes onto the surface, so the height is dropped
+ * at finish, deliberately and in one place — see `finishSpec` in drawMode.js.
+ */
+import * as Cesium from 'cesium';
+import { pickWorldFromScreen } from './annotationResolver.js';
+import {
+  claimPointer,
+  pointerOwner,
+  releasePointer,
+} from '../data/inputOwnership.js';
+import {
+  DRAW_SHAPES,
+  MAX_VERTICES,
+  addVertex,
+  createDrawSession,
+  drawHint,
+  finishReason,
+  finishSpec,
+  normalizeShape,
+  removeLastVertex,
+} from './drawMode.js';
+
+/** The id this tool claims the pointer under. */
+export const DRAW_POINTER_OWNER = 'draw';
+const PREVIEW_DATA_SOURCE_NAME = 'gev-draw-preview';
+
+const COLORS = ['primary', 'amber', 'cyan', 'green', 'red'];
+const PREVIEW = {
+  primary: '#8be9ff',
+  amber: '#ffb547',
+  cyan: '#39d0ff',
+  green: '#5dff9f',
+  red: '#ff6b6b',
+};
+
+/**
+ * Wire the Draw control. Returns a handle with a `destroy()` the application
+ * lifetime owns, plus the console/test seam (`window.__gevDrawTool`).
+ * @param {{viewer: Cesium.Viewer, annotations: {annotate: Function, clear: Function}}} deps
+ * @returns {{destroy: Function}|null}
+ */
+export function initDrawTool({ viewer, annotations }) {
+  const toggle = document.getElementById('draw-toggle');
+  const modeRow = document.getElementById('draw-mode-row');
+  const labelRow = document.getElementById('draw-label-row');
+  const labelInput = document.getElementById('draw-label-input');
+  const colorSelect = document.getElementById('draw-color-select');
+  const clearButton = document.getElementById('draw-clear');
+  const hint = document.getElementById('draw-hint');
+  if (!viewer || !annotations || !toggle) return null;
+
+  let active = false;
+  let destroyed = false;
+  let session = null;
+  let shape = 'area';
+  let color = 'primary';
+  let handler = null;
+  let lease = null;
+  let savedDoubleClick = null;
+  let savedSingleClick = null;
+  let cursor = null; // last mouse position on the canvas, for the rubber band
+  // Bumped by anything that supersedes an in-flight finish: cancelling, clearing
+  // the board, leaving draw mode, teardown. An `annotate()` that resolves after
+  // one of those must not write its outcome over the newer state.
+  let generation = 0;
+  const previewEntities = [];
+  // Every DOM listener this tool adds, so teardown is one loop rather than a
+  // list that can fall out of step with the bindings below.
+  const domListeners = [];
+  const listen = (target, type, listener, options) => {
+    if (!target) return;
+    target.addEventListener(type, listener, options);
+    domListeners.push([target, type, listener, options]);
+  };
+
+  const dataSource = new Cesium.CustomDataSource(PREVIEW_DATA_SOURCE_NAME);
+  // `add()` resolves on the NEXT tick, so an init-then-immediate-destroy would
+  // remove a source that had not been attached yet and leave the attachment to
+  // land afterwards — a preview data source nobody owns. Chain the removal onto
+  // the attachment instead of racing it.
+  let attaching = Promise.resolve(viewer.dataSources.add(dataSource)).catch(
+    () => null,
+  );
+
+  const setHint = (text) => {
+    if (hint) hint.textContent = text;
+  };
+
+  // ---- preview ---------------------------------------------------------
+  const vertexPositions = () =>
+    session.vertices.map((v) =>
+      Cesium.Cartesian3.fromDegrees(v.lon, v.lat, v.height || 0),
+    );
+  const previewLine = dataSource.entities.add({
+    show: false,
+    polyline: {
+      positions: new Cesium.CallbackProperty(() => {
+        if (!session) return [];
+        const pts = vertexPositions();
+        if (cursor && session.shape !== 'pin') pts.push(cursor);
+        if (session.shape === 'area' && pts.length >= 3) pts.push(pts[0]);
+        return pts;
+      }, false),
+      width: 3,
+      material: new Cesium.PolylineDashMaterialProperty({
+        color: Cesium.Color.fromCssColorString(PREVIEW.primary).withAlpha(0.9),
+        dashLength: 16,
+      }),
+      depthFailMaterial: new Cesium.PolylineDashMaterialProperty({
+        color: Cesium.Color.fromCssColorString(PREVIEW.primary).withAlpha(0.35),
+        dashLength: 16,
+      }),
+      clampToGround: false,
+    },
+  });
+  const syncPreview = () => {
+    if (destroyed) return;
+    previewEntities.forEach((e) => dataSource.entities.remove(e));
+    previewEntities.length = 0;
+    if (!session) {
+      previewLine.show = false;
+      setHint(drawHint(null));
+      viewer.scene.requestRender();
+      return;
+    }
+    const stroke = Cesium.Color.fromCssColorString(
+      PREVIEW[color] || PREVIEW.primary,
+    );
+    previewLine.polyline.material = new Cesium.PolylineDashMaterialProperty({
+      color: stroke.withAlpha(0.9),
+      dashLength: 16,
+    });
+    previewLine.show = session.shape !== 'pin';
+    for (const v of session.vertices) {
+      previewEntities.push(
+        dataSource.entities.add({
+          position: Cesium.Cartesian3.fromDegrees(v.lon, v.lat, v.height || 0),
+          point: {
+            pixelSize: 8,
+            color: stroke,
+            outlineColor: Cesium.Color.BLACK.withAlpha(0.6),
+            outlineWidth: 2,
+            disableDepthTestDistance: Number.POSITIVE_INFINITY,
+          },
+        }),
+      );
+    }
+    setHint(drawHint(session));
+    viewer.scene.requestRender();
+  };
+
+  // ---- vertices from clicks --------------------------------------------
+  const worldAt = (position) => {
+    const canvas = viewer.scene.canvas;
+    const w = canvas.clientWidth || canvas.width || 1;
+    const h = canvas.clientHeight || canvas.height || 1;
+    return pickWorldFromScreen(viewer, position.x / w, position.y / h);
+  };
+  const onClick = (event) => {
+    if (!session || destroyed) return;
+    const p = worldAt(event.position);
+    if (!p) return;
+    const { added, reason } = addVertex(session, p);
+    if (added) {
+      syncPreview();
+      return;
+    }
+    // A click that changed nothing still deserves an answer when the reason is
+    // a limit rather than the harmless tail of a double-click.
+    if (reason === 'full')
+      setHint(
+        `That shape already has ${MAX_VERTICES} points — finish it or press Backspace.`,
+      );
+    else if (reason === 'invalid')
+      setHint('That point is off the globe — click on the world.');
+  };
+  const onMove = (event) => {
+    if (!session || session.shape === 'pin' || destroyed) return;
+    const p = worldAt(event.endPosition);
+    cursor = p
+      ? Cesium.Cartesian3.fromDegrees(p.lon, p.lat, p.height || 0)
+      : null;
+    viewer.scene.requestRender();
+  };
+
+  // ---- finish / cancel -------------------------------------------------
+  const finish = async () => {
+    if (destroyed || !session) return null;
+    const reason = finishReason(session);
+    if (reason !== 'ok') {
+      // 'too-few' is just "keep clicking" and the hint already says so;
+      // a degenerate or off-globe shape needs to be told why it was refused.
+      if (reason !== 'too-few') setHint(drawHint(session));
+      return null;
+    }
+    const spec = finishSpec(session, { label: labelInput?.value || '', color });
+    if (!spec) return null;
+    // Start a fresh session BEFORE awaiting, so a second Enter or the second
+    // half of a double-click cannot submit the same shape twice.
+    session = createDrawSession(shape);
+    cursor = null;
+    syncPreview();
+    if (labelInput) labelInput.value = '';
+    const attempt = generation;
+    try {
+      const result = await annotations.annotate([spec], {
+        persist: true,
+        flyTo: false,
+      });
+      if (destroyed || attempt !== generation) return result;
+      if (result?.drawn === 0) setHint('That shape could not be placed.');
+      return result;
+    } catch (error) {
+      if (destroyed || attempt !== generation) return null;
+      setHint(`Could not place the shape: ${error?.message || error}`);
+      return null;
+    }
+  };
+  const cancel = () => {
+    if (!session) return;
+    generation += 1;
+    session = createDrawSession(shape);
+    cursor = null;
+    syncPreview();
+  };
+  /** Wipe the board: the shape in progress AND every mark already placed. */
+  const clearAll = () => {
+    generation += 1;
+    cursor = null;
+    if (session) session = createDrawSession(shape);
+    annotations.clear();
+    syncPreview();
+    if (!destroyed && !active) setHint('Board cleared.');
+  };
+
+  // ---- keys: only while drawing, never while typing in another field ----
+  const typingElsewhere = (event) => {
+    const t = event.target;
+    if (!t || t === labelInput) return false;
+    return (
+      t.tagName === 'INPUT' || t.tagName === 'TEXTAREA' || t.isContentEditable
+    );
+  };
+  /**
+   * Enter is the finish key, but on a focused control Enter means "press this
+   * control". Keyboard-focusing Clear and pressing Enter must clear the board,
+   * not finish the shape — so the finish key is only taken from the canvas,
+   * the page body, or the label field this tool owns.
+   */
+  const enterBelongsToDrawing = (event) => {
+    const t = event.target;
+    if (!t || t === labelInput) return true;
+    if (
+      typeof t.closest === 'function' &&
+      t.closest('button, a, select, [role="button"], [role="radio"]')
+    )
+      return false;
+    return (
+      t === document.body || t === viewer.scene.canvas || t.tagName === 'CANVAS'
+    );
+  };
+  const onKey = (event) => {
+    if (!active || destroyed || typingElsewhere(event)) return;
+    // Enter goes to finish() once a shape has been started; finish() owns the
+    // decision and says WHY it refused. Swallowing the key on a degenerate
+    // shape left the person pressing Enter at a silent panel. A focused button
+    // keeps its own Enter — see enterBelongsToDrawing.
+    if (event.key === 'Enter') {
+      if (session?.vertices?.length && enterBelongsToDrawing(event)) {
+        event.preventDefault();
+        void finish();
+      }
+      return;
+    }
+    if (event.key === 'Escape') {
+      event.preventDefault();
+      event.stopImmediatePropagation();
+      if (session?.vertices.length) cancel();
+      else setActive(false);
+      return;
+    }
+    if (event.key === 'Backspace' && event.target !== labelInput) {
+      if (removeLastVertex(session)) {
+        event.preventDefault();
+        syncPreview();
+      }
+    }
+  };
+
+  // ---- mode on / off -----------------------------------------------------
+  function setActive(next) {
+    if (destroyed || next === active) return active;
+    if (next) {
+      lease = claimPointer(DRAW_POINTER_OWNER);
+      if (!lease) {
+        // Somebody else is using the pointer — possibly an older instance of
+        // this same tool that has not finished tearing down. Say so instead of
+        // half-starting.
+        setHint(`${pointerOwner()} is using the pointer — close it first.`);
+        return active;
+      }
+    }
+    active = next;
+    toggle.classList.toggle('active', active);
+    toggle.setAttribute('aria-pressed', String(active));
+    modeRow?.classList.toggle('visible', active);
+    labelRow?.classList.toggle('visible', active);
+    document.body.classList.toggle('gev-drawing', active);
+    if (active) {
+      session = createDrawSession(shape);
+      bindSceneHandler();
+      syncPreview();
+    } else {
+      generation += 1;
+      session = null;
+      cursor = null;
+      releaseSceneHandler();
+      releasePointer(lease);
+      lease = null;
+      syncPreview();
+    }
+    return active;
+  }
+
+  function bindSceneHandler() {
+    if (handler) return;
+    handler = new Cesium.ScreenSpaceEventHandler(viewer.scene.canvas);
+    handler.setInputAction(onClick, Cesium.ScreenSpaceEventType.LEFT_CLICK);
+    handler.setInputAction(onMove, Cesium.ScreenSpaceEventType.MOUSE_MOVE);
+    handler.setInputAction(() => {
+      void finish();
+    }, Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK);
+    // Cesium's Viewer binds BOTH stock click actions on its own handler: the
+    // single click picks an entity into `viewer.selectedEntity`, the double
+    // click tracks it. Neither goes through a layer, so neither can be fixed by
+    // the shared pointer claim — they have to be borrowed outright for the
+    // session and given back on the way out. Borrowing the single click is what
+    // stops a vertex placed on a contact from also selecting it.
+    const stock = viewer.screenSpaceEventHandler;
+    savedSingleClick =
+      stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK) || null;
+    savedDoubleClick =
+      stock.getInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK) ||
+      null;
+    stock.removeInputAction(Cesium.ScreenSpaceEventType.LEFT_CLICK);
+    stock.removeInputAction(Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK);
+    listen(document, 'keydown', onKey, true);
+  }
+
+  function releaseSceneHandler() {
+    if (handler) {
+      handler.destroy();
+      handler = null;
+    }
+    if (savedSingleClick) {
+      viewer.screenSpaceEventHandler.setInputAction(
+        savedSingleClick,
+        Cesium.ScreenSpaceEventType.LEFT_CLICK,
+      );
+      savedSingleClick = null;
+    }
+    if (savedDoubleClick) {
+      viewer.screenSpaceEventHandler.setInputAction(
+        savedDoubleClick,
+        Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK,
+      );
+      savedDoubleClick = null;
+    }
+    // Drop just the keydown listener bound alongside this handler; the control
+    // listeners below outlive a session and come off in destroy().
+    for (let i = domListeners.length - 1; i >= 0; i -= 1) {
+      const [target, type, listener, options] = domListeners[i];
+      if (listener !== onKey) continue;
+      target.removeEventListener(type, listener, options);
+      domListeners.splice(i, 1);
+    }
+  }
+
+  listen(toggle, 'click', () => setActive(!active));
+  const shapeButtons = [
+    ...(modeRow?.querySelectorAll('.pp-mode-btn[data-shape]') || []),
+  ];
+  for (const btn of shapeButtons) {
+    listen(btn, 'click', () => {
+      shape = normalizeShape(btn.dataset.shape);
+      for (const other of shapeButtons) {
+        const on = other === btn;
+        other.classList.toggle('active', on);
+        other.setAttribute('aria-checked', String(on));
+      }
+      if (active) {
+        generation += 1;
+        session = createDrawSession(shape);
+        cursor = null;
+        syncPreview();
+      }
+    });
+  }
+  listen(colorSelect, 'change', () => {
+    color = COLORS.includes(colorSelect.value) ? colorSelect.value : 'primary';
+    syncPreview();
+  });
+  listen(clearButton, 'click', clearAll);
+  listen(labelInput, 'keydown', (event) => {
+    if (event.key === 'Enter' && session?.vertices?.length) {
+      event.preventDefault();
+      void finish();
+    }
+  });
+  setHint(drawHint(null));
+
+  const api = {
+    get active() {
+      return active;
+    },
+    get shape() {
+      return shape;
+    },
+    get session() {
+      return session;
+    },
+    setActive,
+    setShape(next) {
+      const btn = modeRow?.querySelector(
+        `.pp-mode-btn[data-shape="${normalizeShape(next)}"]`,
+      );
+      btn?.click();
+    },
+    /** Test seam: add a vertex from lon/lat as if it had been clicked. */
+    addVertex(lon, lat, height = 0) {
+      if (!session) return false;
+      const r = addVertex(session, { lon, lat, height });
+      if (r.added) syncPreview();
+      return r.added;
+    },
+    finish,
+    cancel,
+    clearAll,
+    shapes: DRAW_SHAPES,
+    /** What this tool currently holds — for teardown and leak assertions. */
+    diagnostics() {
+      return {
+        active,
+        destroyed,
+        sceneHandler: Boolean(handler),
+        domListeners: domListeners.length,
+        previewDataSources: countPreviewDataSources(viewer),
+        previewEntities: destroyed ? 0 : dataSource.entities.values.length,
+        pointerOwner: pointerOwner(),
+        // The viewer's OWN click actions. While a session is open both are
+        // borrowed (absent here); after it closes both are back. A harness can
+        // compare the restored functions by identity with what it captured
+        // before, which is the only way to prove they were given back rather
+        // than replaced.
+        stockSingleClick: Boolean(
+          viewer.screenSpaceEventHandler?.getInputAction?.(
+            Cesium.ScreenSpaceEventType.LEFT_CLICK,
+          ),
+        ),
+        stockDoubleClick: Boolean(
+          viewer.screenSpaceEventHandler?.getInputAction?.(
+            Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK,
+          ),
+        ),
+      };
+    },
+    /** Resolves once every deferred teardown step has run. */
+    whenSettled() {
+      return attaching;
+    },
+    destroy() {
+      if (destroyed) return attaching;
+      // Supersede any finish still in flight before anything is torn down.
+      generation += 1;
+      if (active) setActive(false);
+      destroyed = true;
+      releaseSceneHandler();
+      releasePointer(lease);
+      lease = null;
+      for (const [target, type, listener, options] of domListeners.splice(0)) {
+        target.removeEventListener(type, listener, options);
+      }
+      previewEntities.length = 0;
+      dataSource.entities.removeAll();
+      // Wait for the pending add() before removing: a destroy() in the same
+      // tick as init would otherwise remove nothing and let the attachment land
+      // behind it.
+      attaching = attaching.then(() => {
+        try {
+          viewer.dataSources.remove(dataSource, true);
+        } catch {
+          /* viewer already disposed — nothing to detach from */
+        }
+      });
+      document.body.classList.remove('gev-drawing');
+      toggle.classList.remove('active');
+      toggle.setAttribute('aria-pressed', 'false');
+      modeRow?.classList.remove('visible');
+      labelRow?.classList.remove('visible');
+      if (hint) hint.textContent = '';
+      if (window.__gevDrawTool === api) delete window.__gevDrawTool;
+      return attaching;
+    },
+  };
+  window.__gevDrawTool = api;
+  return api;
+}
+
+/** How many draw previews are attached — more than one means a leaked tool. */
+function countPreviewDataSources(viewer) {
+  const sources = viewer?.dataSources;
+  if (!sources) return 0;
+  let found = 0;
+  for (let index = 0; index < sources.length; index += 1) {
+    if (sources.get(index)?.name === PREVIEW_DATA_SOURCE_NAME) found += 1;
+  }
+  return found;
+}
diff --git a/src/annotations/drawTool.test.mjs b/src/annotations/drawTool.test.mjs
new file mode 100644
index 000000000..e6ce2e9f3
--- /dev/null
+++ b/src/annotations/drawTool.test.mjs
@@ -0,0 +1,218 @@
+// STRUCTURAL contracts only: where files live, which ids the markup carries,
+// what the docs may claim. Things a running test cannot observe.
+//
+// Everything about the tool's BEHAVIOUR — the pointer lease, borrowing and
+// restoring the viewer's own click actions, teardown, the Enter key, preview
+// heights, Clear — is asserted against the running module in
+// `drawToolBehaviour.test.mjs`, not by reading this file's source.
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+  '..',
+);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const tool = () => read('src/annotations/drawTool.js');
+
+test('the application composition wires the draw tool and owns its teardown', () => {
+  const tools = read('src/app/tools.js');
+  const engineAt = tools.indexOf('const annotations = initAnnotations({');
+  const drawAt = tools.indexOf(
+    'const drawTool = initDrawTool({ viewer, annotations });',
+  );
+  assert.ok(engineAt >= 0, 'initAnnotations call missing');
+  assert.ok(
+    drawAt > engineAt,
+    'initDrawTool must follow initAnnotations and receive its engine',
+  );
+  assert.match(
+    tools,
+    /import \{ initDrawTool \} from '\.\.\/annotations\/drawTool\.js';/,
+  );
+  // The tool holds a pointer claim, DOM listeners and a data source, so the
+  // application lifetime disposes it — not whoever last pressed the button.
+  const deferAt = tools.indexOf('defer(() => drawTool?.destroy());');
+  assert.ok(deferAt > drawAt, 'the shell must defer the draw tool teardown');
+});
+
+test('the engine resolves manual geometry before any name resolution', () => {
+  const engine = read('src/annotations/annotationEngine.js');
+  const resolveAt = engine.indexOf(
+    'async function resolveSpec(spec, signal) {',
+  );
+  const manualAt = engine.indexOf(
+    'if (isManualSpec(spec, type)) return resolveManualSpec(spec, type, viewer);',
+    resolveAt,
+  );
+  const routeAt = engine.indexOf("if (type === 'route') {", resolveAt);
+  assert.ok(
+    manualAt > resolveAt && manualAt < routeAt,
+    'manual specs must short-circuit ahead of the route/arrow/area resolvers',
+  );
+  assert.match(
+    engine,
+    /if \(mode === 'manual'\) return baseLabel \? `\$\{baseLabel\} — \$\{dist\}` : dist;/,
+    'a drawn line reports length, never a walk time',
+  );
+});
+
+test('the Draw control markup carries the ids the tool binds to', () => {
+  // The DISPLAY rail is a component template now, assembled into index.html at
+  // build time — the markup is not in index.html any more.
+  const html = read('src/ui/templates/display-controls.html');
+  const ids = [
+    'draw-toggle',
+    'draw-mode-row',
+    'draw-label-row',
+    'draw-label-input',
+    'draw-color-select',
+    'draw-clear',
+    'draw-hint',
+  ];
+  for (const id of ids) {
+    assert.match(
+      html,
+      new RegExp(`id="${id}"`),
+      `#${id} missing from index.html`,
+    );
+  }
+  for (const shape of ['area', 'line', 'pin']) {
+    assert.match(
+      html,
+      new RegExp(`data-shape="${shape}"`),
+      `shape button ${shape} missing`,
+    );
+  }
+  for (const id of ids) {
+    assert.match(
+      tool(),
+      new RegExp(`getElementById\\('${id}'\\)`),
+      `drawTool must bind #${id}`,
+    );
+  }
+});
+
+test('the DISPLAY rail styles live in their current owner, not the shim', () => {
+  // The PR this came from was written against the pre-refactor layout, where
+  // these rules lived in the root style.css. That file is an import shim now,
+  // and putting rules back into it would silently undo the split.
+  const shim = read('style.css');
+  assert.ok(
+    shim.split('\n').length < 40,
+    'style.css is an import shim, not a stylesheet',
+  );
+  assert.doesNotMatch(
+    shim,
+    /draw-hint|pp-text-input/,
+    'draw styles belong to a component stylesheet',
+  );
+  const controls = read('src/ui/styles/controls.css');
+  for (const rule of [
+    '#draw-mode-row',
+    '#draw-label-row',
+    '.pp-text-input',
+    '.draw-clear-btn',
+    '.draw-hint',
+    'body.gev-drawing',
+  ]) {
+    assert.ok(
+      controls.includes(rule),
+      `${rule} must live in src/ui/styles/controls.css`,
+    );
+  }
+});
+
+test('nothing promises a GeoJSON export for drawn shapes', () => {
+  for (const file of [
+    'src/annotations/drawTool.js',
+    'src/annotations/drawMode.js',
+  ]) {
+    assert.doesNotMatch(
+      read(file),
+      /GeoJSON/i,
+      `${file} still claims a GeoJSON export`,
+    );
+  }
+  for (const file of ['README.md', 'CHANGELOG.md', 'docs/CURRENT-STATE.md']) {
+    const source = read(file);
+    const at = source.indexOf('DISPLAY ▸ **Draw**');
+    const start = at >= 0 ? at : source.indexOf('DISPLAY ▸ Draw');
+    assert.ok(start >= 0, `${file} should describe the Draw control`);
+    const section = source.slice(start, start + 1200);
+    assert.doesNotMatch(
+      section,
+      /GeoJSON/i,
+      `${file} still claims a GeoJSON export for drawn shapes`,
+    );
+  }
+});
+
+test('the docs do not promise a vertex height the renderer would discard', () => {
+  // Areas and routes are DRAPED, so a per-vertex height is not a placement.
+  // That the finished spec actually drops it is asserted against the running
+  // module in drawToolBehaviour.test.mjs; this only guards the wording.
+  assert.doesNotMatch(tool(), /lands on the roof/);
+  assert.doesNotMatch(
+    read('docs/CURRENT-STATE.md'),
+    /a vertex on a roof lands on the roof/,
+  );
+});
+
+test('draped marks classify onto terrain as well as 3D tiles', () => {
+  // CESIUM_3D_TILE alone rendered nothing on a keyless boot, where Cesium's own
+  // globe carries the imagery and there are no tiles to classify against. The
+  // rendered proof is in scripts/qa-draw-tool.mjs, which counts stroke pixels
+  // against a keyless server; this stops the constant being narrowed again.
+  const renderer = read('src/annotations/worldAnnotationRenderer.js');
+  assert.match(renderer, /const CLASSIFY = Cesium\.ClassificationType\.BOTH;/);
+  assert.doesNotMatch(
+    renderer,
+    /classificationType: Cesium\.ClassificationType\.CESIUM_3D_TILE/,
+  );
+});
+
+test('the draw modules are registered for formatting and boundary checks', () => {
+  const formatScope = JSON.parse(read('scripts/format-scope.json'));
+  for (const file of [
+    'src/annotations/drawMode.js',
+    'src/annotations/drawMode.test.mjs',
+    'src/annotations/drawTool.js',
+    'src/annotations/drawTool.test.mjs',
+    'src/data/inputOwnership.js',
+  ]) {
+    assert.ok(
+      formatScope.includes(file),
+      `${file} must be in the formatting scope`,
+    );
+  }
+  const boundaries = JSON.parse(read('scripts/package-boundaries.json'));
+  const owners = (file) =>
+    Object.entries(boundaries)
+      .filter(([, group]) => group.modules?.includes(file))
+      .map(([name]) => name);
+  for (const file of [
+    'src/annotations/drawMode.js',
+    'src/annotations/drawTool.js',
+    'src/data/inputOwnership.js',
+  ]) {
+    assert.ok(
+      owners(file).length > 0,
+      `${file} must be owned by at least one boundary group`,
+    );
+  }
+  // Every layer that consults the shared claim has to own the module it reads,
+  // or its bundle fails the boundary check.
+  for (const group of ['alpr-cameras', 'vessel-layer', 'satellites-layer']) {
+    assert.ok(
+      boundaries[group]?.modules.includes('src/data/inputOwnership.js'),
+      `${group} consults the pointer claim and must own the module`,
+    );
+  }
+  const exports = JSON.parse(read('package.json')).exports;
+  assert.equal(exports['./annotations'], './src/annotations/index.js');
+});
diff --git a/src/annotations/drawToolBehaviour.test.mjs b/src/annotations/drawToolBehaviour.test.mjs
new file mode 100644
index 000000000..6da4c91af
--- /dev/null
+++ b/src/annotations/drawToolBehaviour.test.mjs
@@ -0,0 +1,467 @@
+// Behavioural tests for the draw tool: the module is driven against fake DOM
+// and viewer doubles and its OBSERVABLE effects are asserted — which lease it
+// holds, which viewer input actions it borrowed and gave back, what it leaves
+// behind when destroyed. Nothing here reads the module's source text.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import * as Cesium from 'cesium';
+import { initDrawTool } from './drawTool.js';
+import {
+  isPointerFree,
+  pointerOwner,
+  claimPointer,
+  releasePointer,
+  resetPointerOwnership,
+} from '../data/inputOwnership.js';
+
+/* ── DOM doubles ───────────────────────────────────────────────────────── */
+
+class FakeClassList {
+  constructor() {
+    this.names = new Set();
+  }
+  add(...names) {
+    for (const n of names) this.names.add(n);
+  }
+  remove(...names) {
+    for (const n of names) this.names.delete(n);
+  }
+  contains(name) {
+    return this.names.has(name);
+  }
+  toggle(name, force) {
+    const on = force === undefined ? !this.names.has(name) : Boolean(force);
+    if (on) this.names.add(name);
+    else this.names.delete(name);
+    return on;
+  }
+}
+
+class FakeElement {
+  constructor(tagName = 'DIV', id = '') {
+    this.tagName = tagName.toUpperCase();
+    this.id = id;
+    this.classList = new FakeClassList();
+    this.dataset = {};
+    this.attributes = new Map();
+    this.textContent = '';
+    this.value = '';
+    this.children = [];
+    this.listeners = [];
+  }
+  setAttribute(name, value) {
+    this.attributes.set(name, String(value));
+  }
+  getAttribute(name) {
+    return this.attributes.get(name) ?? null;
+  }
+  addEventListener(type, listener, options) {
+    this.listeners.push({ type, listener, options });
+  }
+  removeEventListener(type, listener) {
+    const at = this.listeners.findIndex(
+      (entry) => entry.type === type && entry.listener === listener,
+    );
+    if (at >= 0) this.listeners.splice(at, 1);
+  }
+  querySelectorAll(selector) {
+    if (selector === '.pp-mode-btn[data-shape]')
+      return this.children.filter((child) => child.dataset.shape);
+    const shape = /\.pp-mode-btn\[data-shape="([a-z]+)"\]/.exec(selector)?.[1];
+    if (shape) return this.children.filter((child) => child.dataset.shape === shape);
+    return [];
+  }
+  querySelector(selector) {
+    return this.querySelectorAll(selector)[0] ?? null;
+  }
+  click() {
+    return this.emit('click');
+  }
+  closest(selector) {
+    // Only what the tool asks: "am I inside an activatable control?"
+    const activatable = ['button', 'a', 'select', '[role="button"]', '[role="radio"]'];
+    if (!activatable.some((part) => selector.includes(part))) return null;
+    return this.tagName === 'BUTTON' || this.tagName === 'A' || this.tagName === 'SELECT'
+      ? this
+      : null;
+  }
+  /** Deliver an event to this element's own listeners. */
+  emit(type, event = {}) {
+    const payload = {
+      type,
+      target: this,
+      preventDefault() {},
+      stopImmediatePropagation() {},
+      ...event,
+    };
+    for (const entry of [...this.listeners])
+      if (entry.type === type) entry.listener(payload);
+    return payload;
+  }
+}
+
+function fakeDom() {
+  const byId = new Map();
+  const make = (id, tagName = 'DIV') => {
+    const element = new FakeElement(tagName, id);
+    byId.set(id, element);
+    return element;
+  };
+  make('draw-toggle', 'BUTTON');
+  const modeRow = make('draw-mode-row');
+  for (const shape of ['area', 'line', 'pin']) {
+    const button = new FakeElement('BUTTON');
+    button.dataset.shape = shape;
+    modeRow.children.push(button);
+  }
+  make('draw-label-row');
+  make('draw-label-input', 'INPUT');
+  make('draw-color-select', 'SELECT');
+  make('draw-clear', 'BUTTON');
+  make('draw-hint', 'SPAN');
+
+  const body = new FakeElement('BODY');
+  const documentDouble = {
+    body,
+    getElementById: (id) => byId.get(id) ?? null,
+    listeners: [],
+    addEventListener(type, listener, options) {
+      this.listeners.push({ type, listener, options });
+    },
+    removeEventListener(type, listener) {
+      const at = this.listeners.findIndex(
+        (entry) => entry.type === type && entry.listener === listener,
+      );
+      if (at >= 0) this.listeners.splice(at, 1);
+    },
+    emit(type, event = {}) {
+      const payload = {
+        type,
+        target: body,
+        preventDefault() {},
+        stopImmediatePropagation() {},
+        ...event,
+      };
+      for (const entry of [...this.listeners])
+        if (entry.type === type) entry.listener(payload);
+      return payload;
+    },
+  };
+  return { byId, documentDouble };
+}
+
+/* ── viewer double ─────────────────────────────────────────────────────── */
+
+function fakeViewer() {
+  const canvas = new FakeElement('CANVAS');
+  canvas.clientWidth = 800;
+  canvas.clientHeight = 600;
+  const actions = new Map();
+  const stockHandler = {
+    getInputAction: (type) => actions.get(type),
+    setInputAction: (action, type) => actions.set(type, action),
+    removeInputAction: (type) => actions.delete(type),
+  };
+  const attached = [];
+  const pendingAdds = [];
+  const dataSources = {
+    get length() {
+      return attached.length;
+    },
+    get: (index) => attached[index],
+    add(source) {
+      // Cesium resolves this on a later tick — the whole point of finding 7.
+      const promise = Promise.resolve().then(() => {
+        attached.push(source);
+        return source;
+      });
+      pendingAdds.push(promise);
+      return promise;
+    },
+    remove(source) {
+      const at = attached.indexOf(source);
+      if (at >= 0) attached.splice(at, 1);
+      return at >= 0;
+    },
+  };
+  return {
+    scene: { canvas, requestRender() {} },
+    screenSpaceEventHandler: stockHandler,
+    dataSources,
+    _attached: attached,
+    _actions: actions,
+  };
+}
+
+function fakeAnnotations() {
+  const calls = { annotate: [], clear: 0 };
+  return {
+    calls,
+    async annotate(specs, options) {
+      calls.annotate.push({ specs, options });
+      return { drawn: specs.length };
+    },
+    clear() {
+      calls.clear += 1;
+    },
+  };
+}
+
+/** Stand up a tool against fresh doubles, with globals restored afterwards. */
+function harness() {
+  resetPointerOwnership();
+  const { byId, documentDouble } = fakeDom();
+  const viewer = fakeViewer();
+  const annotations = fakeAnnotations();
+  const previousDocument = globalThis.document;
+  const previousWindow = globalThis.window;
+  globalThis.document = documentDouble;
+  globalThis.window = globalThis.window || {};
+  const tool = initDrawTool({ viewer, annotations });
+  return {
+    tool,
+    viewer,
+    annotations,
+    byId,
+    documentDouble,
+    element: (id) => byId.get(id),
+    restore() {
+      resetPointerOwnership();
+      if (previousDocument === undefined) delete globalThis.document;
+      else globalThis.document = previousDocument;
+      if (previousWindow === undefined) delete globalThis.window;
+      else globalThis.window = previousWindow;
+    },
+  };
+}
+
+const LEFT_CLICK = Cesium.ScreenSpaceEventType.LEFT_CLICK;
+const LEFT_DOUBLE_CLICK = Cesium.ScreenSpaceEventType.LEFT_DOUBLE_CLICK;
+
+/* ── the tests ─────────────────────────────────────────────────────────── */
+
+test('turning Draw on takes a lease and turning it off gives it back', async () => {
+  const h = harness();
+  try {
+    assert.equal(isPointerFree(), true);
+    h.element('draw-toggle').emit('click');
+    assert.equal(pointerOwner(), 'draw', 'the session owns the pointer');
+    assert.equal(h.tool.active, true);
+
+    h.element('draw-toggle').emit('click');
+    assert.equal(isPointerFree(), true, 'leaving draw mode frees the pointer');
+    assert.equal(h.tool.active, false);
+  } finally {
+    h.restore();
+  }
+});
+
+test('Draw refuses to start when something else holds the pointer', async () => {
+  const h = harness();
+  try {
+    const other = claimPointer('directions');
+    h.element('draw-toggle').emit('click');
+    assert.equal(h.tool.active, false, 'it must not half-start');
+    assert.equal(pointerOwner(), 'directions', 'and must not steal the claim');
+    assert.match(h.element('draw-hint').textContent, /directions/);
+    assert.equal(h.tool.diagnostics().sceneHandler, false, 'no handler was bound');
+
+    releasePointer(other);
+    h.element('draw-toggle').emit('click');
+    assert.equal(h.tool.active, true, 'and it starts once the pointer is free');
+  } finally {
+    h.restore();
+  }
+});
+
+test('a destroyed instance cannot free the pointer its replacement holds', async () => {
+  const first = harness();
+  try {
+    first.element('draw-toggle').emit('click');
+    assert.equal(pointerOwner(), 'draw');
+    // The replacement takes over before the old one finishes tearing down.
+    first.tool.setActive(false);
+    const second = harness();
+    try {
+      second.element('draw-toggle').emit('click');
+      assert.equal(pointerOwner(), 'draw');
+      await first.tool.destroy();
+      assert.equal(
+        pointerOwner(),
+        'draw',
+        'the live session still owns the pointer after the old one is destroyed',
+      );
+      assert.equal(second.tool.active, true);
+    } finally {
+      second.restore();
+    }
+  } finally {
+    first.restore();
+  }
+});
+
+test('both stock viewer click actions are borrowed for the session and given back', async () => {
+  const h = harness();
+  try {
+    const stockClick = () => 'viewer picks and selects';
+    const stockDouble = () => 'viewer tracks';
+    h.viewer.screenSpaceEventHandler.setInputAction(stockClick, LEFT_CLICK);
+    h.viewer.screenSpaceEventHandler.setInputAction(stockDouble, LEFT_DOUBLE_CLICK);
+
+    h.element('draw-toggle').emit('click');
+    assert.equal(
+      h.viewer.screenSpaceEventHandler.getInputAction(LEFT_CLICK),
+      undefined,
+      "the viewer's own selecting click must not run while drawing",
+    );
+    assert.equal(
+      h.viewer.screenSpaceEventHandler.getInputAction(LEFT_DOUBLE_CLICK),
+      undefined,
+    );
+
+    h.element('draw-toggle').emit('click');
+    assert.equal(
+      h.viewer.screenSpaceEventHandler.getInputAction(LEFT_CLICK),
+      stockClick,
+      'the exact function is restored, not a replacement',
+    );
+    assert.equal(
+      h.viewer.screenSpaceEventHandler.getInputAction(LEFT_DOUBLE_CLICK),
+      stockDouble,
+    );
+  } finally {
+    h.restore();
+  }
+});
+
+test('Enter finishes from the canvas and the label field, never from a focused button', async () => {
+  const h = harness();
+  try {
+    h.element('draw-toggle').emit('click');
+    h.tool.setShape('area');
+    h.tool.addVertex(-97.75, 30.26);
+    h.tool.addVertex(-97.74, 30.26);
+    h.tool.addVertex(-97.74, 30.27);
+
+    // Enter while the Clear button has keyboard focus means "press Clear".
+    h.documentDouble.emit('keydown', { key: 'Enter', target: h.element('draw-clear') });
+    await Promise.resolve();
+    assert.equal(
+      h.annotations.calls.annotate.length,
+      0,
+      'a focused button keeps its own Enter',
+    );
+    assert.equal(h.tool.session.vertices.length, 3, 'and the shape is untouched');
+
+    // Enter from the page body (the canvas has focus in practice) finishes it.
+    h.documentDouble.emit('keydown', { key: 'Enter', target: h.documentDouble.body });
+    await Promise.resolve();
+    await Promise.resolve();
+    assert.equal(h.annotations.calls.annotate.length, 1, 'Enter on the map finishes');
+    assert.equal(h.annotations.calls.annotate[0].specs[0].type, 'area');
+  } finally {
+    h.restore();
+  }
+});
+
+test('the live preview hangs at the height the click landed on', async () => {
+  const h = harness();
+  try {
+    h.element('draw-toggle').emit('click');
+    h.tool.setShape('line');
+    h.tool.addVertex(-97.75, 30.26, 187.5);
+    h.tool.addVertex(-97.74, 30.26, 212.25);
+
+    await h.tool.whenSettled();
+    const source = h.viewer._attached[0] ?? null;
+    assert.ok(source, 'the preview data source is attached');
+    const points = source.entities.values.filter((entity) => entity.point);
+    assert.equal(points.length, 2, 'one preview dot per vertex');
+    const heights = points.map((entity) => {
+      const position = entity.position.getValue(Cesium.JulianDate.now());
+      return Cesium.Cartographic.fromCartesian(position).height;
+    });
+    assert.ok(Math.abs(heights[0] - 187.5) < 0.5, `got ${heights[0]}`);
+    assert.ok(Math.abs(heights[1] - 212.25) < 0.5, `got ${heights[1]}`);
+
+    // …and the finished shape is still flattened, deliberately: the renderer
+    // drapes, so a height carried further would be discarded out of sight.
+    h.documentDouble.emit('keydown', { key: 'Enter', target: h.documentDouble.body });
+    await Promise.resolve();
+    await Promise.resolve();
+    const spec = h.annotations.calls.annotate[0].specs[0];
+    assert.deepEqual(spec.path, [
+      [-97.75, 30.26],
+      [-97.74, 30.26],
+    ]);
+  } finally {
+    h.restore();
+  }
+});
+
+test('destroy in the same tick as init still removes the preview data source', async () => {
+  const h = harness();
+  try {
+    // Nothing has been attached yet — dataSources.add() resolves later.
+    assert.equal(h.viewer._attached.length, 0, 'the add is still pending');
+    await h.tool.destroy();
+    await Promise.resolve();
+    assert.equal(
+      h.viewer._attached.length,
+      0,
+      'the preview must not be left attached behind the teardown',
+    );
+  } finally {
+    h.restore();
+  }
+});
+
+test('destroy releases the pointer, the handler, the listeners and the stock actions', async () => {
+  const h = harness();
+  try {
+    const stockClick = () => 'viewer picks and selects';
+    h.viewer.screenSpaceEventHandler.setInputAction(stockClick, LEFT_CLICK);
+    h.element('draw-toggle').emit('click');
+    h.tool.addVertex(-97.75, 30.26);
+    assert.equal(pointerOwner(), 'draw');
+    assert.ok(h.tool.diagnostics().domListeners > 0);
+
+    await h.tool.destroy();
+    await Promise.resolve();
+
+    assert.equal(isPointerFree(), true, 'the pointer is free');
+    const after = h.tool.diagnostics();
+    assert.equal(after.destroyed, true);
+    assert.equal(after.sceneHandler, false, 'the Cesium handler is gone');
+    assert.equal(after.domListeners, 0, 'every DOM listener came off');
+    assert.equal(h.documentDouble.listeners.length, 0, 'including the keydown');
+    assert.equal(h.element('draw-toggle').listeners.length, 0);
+    assert.equal(
+      h.viewer.screenSpaceEventHandler.getInputAction(LEFT_CLICK),
+      stockClick,
+      'the viewer got its selecting click back',
+    );
+    assert.equal(h.viewer._attached.length, 0, 'the preview data source is detached');
+
+    // Idempotent: a second destroy is harmless.
+    await h.tool.destroy();
+  } finally {
+    h.restore();
+  }
+});
+
+test('Clear wipes the board and the shape in progress', async () => {
+  const h = harness();
+  try {
+    h.element('draw-toggle').emit('click');
+    h.tool.addVertex(-97.75, 30.26);
+    h.tool.addVertex(-97.74, 30.26);
+    assert.equal(h.tool.session.vertices.length, 2);
+
+    h.element('draw-clear').emit('click');
+    assert.equal(h.annotations.calls.clear, 1, 'placed marks are removed');
+    assert.equal(h.tool.session.vertices.length, 0, 'and so is the shape in progress');
+  } finally {
+    h.restore();
+  }
+});
diff --git a/src/annotations/resolver.js b/src/annotations/resolver.js
index a76c271e8..7f0807d83 100644
--- a/src/annotations/resolver.js
+++ b/src/annotations/resolver.js
@@ -2226,6 +2226,11 @@ export function createAnnotationResolver({
     return {
       lat: Cesium.Math.toDegrees(carto.latitude),
       lon: Cesium.Math.toDegrees(carto.longitude),
+      // The height the pick actually landed on — a roof, a hillside, or 0 on
+      // the ellipsoid. Callers that only want a coordinate ignore it; the draw
+      // tool's live preview needs it, or the rubber band sinks to sea level
+      // while the pointer is on a hill.
+      height: Number.isFinite(carto.height) ? carto.height : 0,
     };
   }
 
@@ -2331,5 +2336,12 @@ export function createAnnotationResolver({
     viewportBias,
     placesNearViewRecovery,
     resolveRegionRingForQuery,
+    // Scene helpers, not resolution: the manual draw tool turns a click into a
+    // world point with the same depth-aware cascade the agent's pixel fallback
+    // uses, and the engine samples the surface under a hand-placed mark. Both
+    // are exposed so there is ONE pick cascade in the app, not a second one
+    // written beside it.
+    pickWorldFromScreen,
+    sampleGroundHeight,
   };
 }
diff --git a/src/annotations/worldAnnotationRenderer.js b/src/annotations/worldAnnotationRenderer.js
index 235bf0a0c..64a7df241 100644
--- a/src/annotations/worldAnnotationRenderer.js
+++ b/src/annotations/worldAnnotationRenderer.js
@@ -30,7 +30,20 @@ const PALETTE = {
   red: '#ff6b6b',
 };
 
-const CLASSIFY = Cesium.ClassificationType.CESIUM_3D_TILE;
+/**
+ * What a draped mark is allowed to paint onto.
+ *
+ * This was CESIUM_3D_TILE, which is right with Google's photoreal tiles under
+ * the camera and wrong everywhere else: on a keyless boot (Esri or OSM imagery
+ * on Cesium's own globe) there are no 3D tiles to classify against, so every
+ * area fill, area outline, route and arrow rendered to nothing. The labels
+ * showed and the geometry did not, which reads as a broken feature rather than
+ * an unsupported surface — and it hit spoken annotations exactly as hard as
+ * hand-drawn ones.
+ *
+ * BOTH paints onto terrain AND onto 3D tiles, so one value covers both worlds.
+ */
+const CLASSIFY = Cesium.ClassificationType.BOTH;
 const CLAMP = Cesium.HeightReference.CLAMP_TO_GROUND;
 
 export function createWorldAnnotationRenderer(viewer) {
diff --git a/src/app/tools.js b/src/app/tools.js
index 6384d1805..956a26bb6 100644
--- a/src/app/tools.js
+++ b/src/app/tools.js
@@ -1,5 +1,6 @@
 import { SceneDirector } from '../scenes/director.js';
 import { initAnnotations } from '../annotations/index.js';
+import { initDrawTool } from '../annotations/drawTool.js';
 import { initGevVoiceCommands } from '../voice/gevRealtime.js';
 import { installScopeMask, destroyScopeMask } from '../scopeMask.js';
 import {
@@ -39,6 +40,11 @@ export function createApplicationTools({
     if (window.__gevAnnotations === annotations) delete window.__gevAnnotations;
     annotations.destroy();
   });
+  // DISPLAY ▸ Draw: the same whiteboard, drawn by hand. It claims the pointer
+  // while a session is open, so its teardown belongs to the application
+  // lifetime rather than to whoever last pressed the button.
+  const drawTool = initDrawTool({ viewer, annotations });
+  defer(() => drawTool?.destroy());
   if (startChrome)
     defer(startChrome({ loadingScreen, styleManager, dataManager, signal }));
   // Idle render governor: flips the scene into requestRenderMode whenever
diff --git a/src/data/cctvGizmo.js b/src/data/cctvGizmo.js
index 841cc2df3..a1ce70b16 100644
--- a/src/data/cctvGizmo.js
+++ b/src/data/cctvGizmo.js
@@ -24,6 +24,7 @@
  * invariant is untouched.
  */
 import * as Cesium from 'cesium';
+import { isPointerFree } from './inputOwnership.js';
 
 // Grazing guard (spec §5): reject plane intersections when the view ray is
 // nearly parallel to the constraint plane — the hit point races to infinity
@@ -506,6 +507,8 @@ export function createCalibrationGizmo({ viewer, getActiveRecord, applyPatch, en
   }
 
   handler.setInputAction((event) => {
+    // A tool owns the pointer (src/data/inputOwnership.js): yield the press.
+    if (!isPointerFree()) return;
     if (!enabled) return;
     const part = pickGizmoPart(event.position);
     debugLog('LEFT_DOWN', event.position, 'part:', part);
diff --git a/src/data/inputOwnership.js b/src/data/inputOwnership.js
new file mode 100644
index 000000000..4b6a2adea
--- /dev/null
+++ b/src/data/inputOwnership.js
@@ -0,0 +1,104 @@
+/**
+ * Who owns the pointer over the globe.
+ *
+ * Most layers bind their own `ScreenSpaceEventHandler` to the same canvas and
+ * select whatever is under a left click. That is right when nothing else is
+ * going on, and wrong the moment a tool needs the pointer for itself: a draw
+ * session placing a vertex on top of an aircraft must not also track the
+ * aircraft, and the next such tool must not have to be added to a list inside
+ * every layer.
+ *
+ * So there is one claim, held by at most one owner at a time:
+ *
+ * - A TOOL that needs the pointer calls `claimPointer('draw')` when it turns on
+ *   and gets back a LEASE — an opaque token. It releases with
+ *   `releasePointer(lease)` when it turns off. It does not consult anyone;
+ *   holding the claim is what makes it the owner.
+ * - An AMBIENT SELECTION HANDLER — anything that picks an entity because the
+ *   user clicked — early-returns while `isPointerFree()` is false. It never
+ *   claims.
+ *
+ * Claims do not stack and are never stolen: while one owner holds the pointer,
+ * a second `claimPointer` returns null rather than displacing it — and so does
+ * a second claim under the SAME name, because two live instances of one tool
+ * (an old one mid-teardown, its replacement already running) are two owners,
+ * not one. The lease is what tells them apart: releasing takes the token that
+ * was issued, so a superseded instance calling `releasePointer` with its own
+ * stale lease frees nothing and its successor keeps the pointer.
+ *
+ * Ownership is page-scoped, like the layers and handlers it arbitrates.
+ */
+
+/** @typedef {{owner: string, id: number}} PointerLease */
+
+/** @type {PointerLease|null} */
+let currentLease = null;
+let nextLeaseId = 1;
+
+/**
+ * Take the pointer for `owner`.
+ * @param {string} owner Stable identifier for the claiming tool, e.g. 'draw'.
+ * @returns {PointerLease|null} The lease to release with, or null if the
+ *   pointer is already held — including by another instance of the same tool.
+ */
+export function claimPointer(owner) {
+  const name = normalizeOwner(owner);
+  if (!name) return null;
+  if (currentLease !== null) return null;
+  currentLease = Object.freeze({ owner: name, id: nextLeaseId++ });
+  return currentLease;
+}
+
+/**
+ * Give the pointer back. Only the exact lease that took it can release it, so a
+ * superseded instance cannot free the claim its replacement now holds.
+ * @param {PointerLease|null} lease The token `claimPointer` returned.
+ * @returns {boolean} Whether this call released the claim.
+ */
+export function releasePointer(lease) {
+  if (!currentLease || !lease || lease.id !== currentLease.id) return false;
+  currentLease = null;
+  return true;
+}
+
+/** @returns {string|null} The current owner's name, or null when free. */
+export function pointerOwner() {
+  return currentLease ? currentLease.owner : null;
+}
+
+/** @returns {boolean} True when no tool holds the pointer. */
+export function isPointerFree() {
+  return currentLease === null;
+}
+
+/**
+ * @param {string} owner
+ * @returns {boolean} True when a tool of that name is holding the pointer.
+ */
+export function isPointerOwnedBy(owner) {
+  const name = normalizeOwner(owner);
+  return Boolean(name) && pointerOwner() === name;
+}
+
+/**
+ * @param {PointerLease|null} lease
+ * @returns {boolean} True when THIS lease is the live one.
+ */
+export function isLeaseCurrent(lease) {
+  return Boolean(currentLease && lease && lease.id === currentLease.id);
+}
+
+/**
+ * Drop any claim. For tests and for application teardown, which cannot rely on
+ * a half-disposed tool to release its own lease.
+ * @returns {string|null} The owner that was holding it, if any.
+ */
+export function resetPointerOwnership() {
+  const previous = pointerOwner();
+  currentLease = null;
+  return previous;
+}
+
+function normalizeOwner(owner) {
+  return typeof owner === 'string' && owner.trim() ? owner.trim() : null;
+}
diff --git a/src/data/inputOwnership.test.mjs b/src/data/inputOwnership.test.mjs
new file mode 100644
index 000000000..9b20f3ad4
--- /dev/null
+++ b/src/data/inputOwnership.test.mjs
@@ -0,0 +1,176 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  claimPointer,
+  isLeaseCurrent,
+  isPointerFree,
+  isPointerOwnedBy,
+  pointerOwner,
+  releasePointer,
+  resetPointerOwnership,
+} from './inputOwnership.js';
+
+const ROOT = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+  '..',
+);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+test.beforeEach(() => resetPointerOwnership());
+
+test('the pointer starts free and a claim hands back a lease', () => {
+  assert.equal(isPointerFree(), true);
+  assert.equal(pointerOwner(), null);
+
+  const lease = claimPointer('draw');
+  assert.ok(lease, 'a successful claim returns a lease, not a boolean');
+  assert.equal(isPointerFree(), false);
+  assert.equal(pointerOwner(), 'draw');
+  assert.equal(isPointerOwnedBy('draw'), true);
+  assert.equal(isPointerOwnedBy('directions'), false);
+  assert.equal(isLeaseCurrent(lease), true);
+});
+
+test('a claim is never stolen — not even by the same tool name', () => {
+  const first = claimPointer('draw');
+  assert.ok(first);
+
+  assert.equal(
+    claimPointer('directions'),
+    null,
+    'another tool must not displace it',
+  );
+  assert.equal(
+    claimPointer('draw'),
+    null,
+    'a SECOND instance of the same tool is a second owner, not a no-op',
+  );
+  assert.equal(pointerOwner(), 'draw');
+  assert.equal(isLeaseCurrent(first), true);
+});
+
+test('a replaced instance cannot free its successor’s claim', () => {
+  // The bug this rule exists for. An old Draw instance is torn down while a new
+  // one is already running; the old teardown calls releasePointer. Under
+  // release-by-name that freed the LIVE claim and every layer started selecting
+  // through the new instance's vertices.
+  const stale = claimPointer('draw');
+  assert.ok(releasePointer(stale), 'the old instance gives the pointer back');
+
+  const live = claimPointer('draw');
+  assert.ok(live, 'the replacement takes it');
+  assert.notEqual(live.id, stale.id, 'a fresh claim is a fresh lease');
+
+  assert.equal(releasePointer(stale), false, 'the stale lease frees nothing');
+  assert.equal(pointerOwner(), 'draw', 'the replacement still holds it');
+  assert.equal(isLeaseCurrent(stale), false);
+  assert.equal(isLeaseCurrent(live), true);
+
+  assert.equal(releasePointer(live), true);
+  assert.equal(isPointerFree(), true);
+});
+
+test('release ignores anything that is not the live lease', () => {
+  const lease = claimPointer('draw');
+  for (const bad of [
+    null,
+    undefined,
+    'draw',
+    {},
+    { owner: 'draw', id: lease.id + 99 },
+  ]) {
+    assert.equal(releasePointer(bad), false, JSON.stringify(bad));
+    assert.equal(pointerOwner(), 'draw');
+  }
+  assert.equal(releasePointer(lease), true);
+  assert.equal(releasePointer(lease), false, 'releasing twice changes nothing');
+});
+
+test('a claim needs a real owner id', () => {
+  for (const bad of ['', '   ', null, undefined, 7, {}]) {
+    assert.equal(claimPointer(bad), null, JSON.stringify(bad));
+    assert.equal(isPointerFree(), true);
+  }
+  const lease = claimPointer('  draw  ');
+  assert.ok(lease, 'ids are trimmed, not rejected for padding');
+  assert.equal(pointerOwner(), 'draw');
+  assert.equal(releasePointer(lease), true);
+});
+
+test('reset reports who was holding it, for teardown', () => {
+  assert.equal(resetPointerOwnership(), null);
+  const lease = claimPointer('draw');
+  assert.equal(resetPointerOwnership(), 'draw');
+  assert.equal(isPointerFree(), true);
+  assert.equal(isLeaseCurrent(lease), false);
+});
+
+test('every scene click handler consults ownership before it picks', () => {
+  // This is the whole point of a shared contract: a new tool must not have to
+  // find and edit each of these. If a layer grows a click handler it has to
+  // appear here too.
+  const guarded = [
+    ['src/data/trackingClickGesture.js', 'onClick(click, gesture);'],
+    ['src/data/localGeojsonCore.js', 'viewer.scene.pick(click.position)'],
+    ['src/data/cctvGizmo.js', 'pickGizmoPart(event.position)'],
+    ['src/layers/alpr/presentation.js', 'viewer.scene.pick(click.position)'],
+    ['src/layers/bikeshare/selection.js', 'viewer.scene.pick(click.position)'],
+    ['src/layers/firms/selection.js', 'scene.pick(click.position)'],
+    [
+      'src/layers/installations/selection.js',
+      'viewer.scene.pick(click.position)',
+    ],
+    ['src/layers/launches/lifecycle.js', 'drillPick(movement.position'],
+    ['src/layers/radio/interaction.js', 'pickedRadioStationAt(click.position)'],
+    [
+      'src/layers/satellites/interaction.js',
+      'viewer.scene.pick(click.position)',
+    ],
+    [
+      'src/layers/submarineCables/interaction.js',
+      'viewer.scene.pick(click.position)',
+    ],
+    ['src/layers/vessels/selection.js', 'viewer.scene.pick(click.position)'],
+  ];
+  for (const [file, firstPick] of guarded) {
+    const source = read(file);
+    assert.match(
+      source,
+      /import \{ isPointerFree \} from '[^']*inputOwnership\.js';/,
+      `${file} must consult the shared pointer claim`,
+    );
+    const guardAt = source.indexOf('if (!isPointerFree()) return;');
+    const pickAt = source.indexOf(firstPick);
+    assert.ok(guardAt >= 0, `${file} is missing the guard`);
+    assert.ok(
+      pickAt >= 0,
+      `${file}: could not find its pick call (${firstPick})`,
+    );
+    assert.ok(
+      guardAt < pickAt,
+      `${file} must yield before it picks, not after`,
+    );
+  }
+});
+
+test('ambient selection handlers never claim the pointer themselves', () => {
+  // Claiming from a selection handler would deadlock every other layer the
+  // moment a user clicked anything. Only tools claim.
+  for (const file of [
+    'src/data/trackingClickGesture.js',
+    'src/data/localGeojsonCore.js',
+    'src/data/cctvGizmo.js',
+    'src/layers/vessels/selection.js',
+    'src/layers/satellites/interaction.js',
+  ]) {
+    assert.doesNotMatch(
+      read(file),
+      /claimPointer\(/,
+      `${file} must not claim the pointer`,
+    );
+  }
+});
diff --git a/src/data/localGeojsonCore.js b/src/data/localGeojsonCore.js
index 764005568..edb246fdf 100644
--- a/src/data/localGeojsonCore.js
+++ b/src/data/localGeojsonCore.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from './inputOwnership.js';
 import {
   selectInfraLod,
   applyInfraEvictionGrace,
@@ -768,6 +769,8 @@ export function createLocalGeoJsonLayer(
                 viewer.scene.canvas,
               );
               _clickHandler.setInputAction((click) => {
+                // A tool owns the pointer (src/data/inputOwnership.js).
+                if (!isPointerFree()) return;
                 if (!_enabled) return;
                 const picked = viewer.scene.pick(click.position);
 
diff --git a/src/data/trackingClickGesture.js b/src/data/trackingClickGesture.js
index 67959bf98..d8bb4211d 100644
--- a/src/data/trackingClickGesture.js
+++ b/src/data/trackingClickGesture.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from './inputOwnership.js';
 
 export const MAX_TRACKING_CLICK_TRAVEL_PX = 6;
 export const MAX_TRACKING_CLICK_DURATION_MS = 400;
@@ -95,6 +96,9 @@ export function bindTrackingClickGesture(handler, onClick, options = {}) {
     if (pressActive) finishPress(click?.position);
     const gesture = completedGesture || { travelPx: 0, durationMs: 0 };
     completedGesture = null;
+    // A tool owns the pointer: a draw vertex placed over an aircraft is a
+    // vertex, not a track request (src/data/inputOwnership.js).
+    if (!isPointerFree()) return;
     onClick(click, gesture);
   }, eventTypes.LEFT_CLICK);
 }
diff --git a/src/layers/alpr/presentation.js b/src/layers/alpr/presentation.js
index f56787c79..508d923ed 100644
--- a/src/layers/alpr/presentation.js
+++ b/src/layers/alpr/presentation.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import {
   LAYER_ID,
   MAX_VIEWPORT_DEGREES,
@@ -376,6 +377,8 @@ export function createAlprPresentation({ state, services, source }) {
       viewer.scene.canvas,
     );
     state.clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!state.enabled) return;
       const picked = viewer.scene.pick(click.position);
       const id = typeof picked?.id?.id === 'string' ? picked.id.id : null;
diff --git a/src/layers/bikeshare/selection.js b/src/layers/bikeshare/selection.js
index 74e540230..0c948281b 100644
--- a/src/layers/bikeshare/selection.js
+++ b/src/layers/bikeshare/selection.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import {
   BIKESHARE_SELECTED_OVERLAY_SOURCE_ID,
   BIKESHARE_SELECTED_OVERLAY_SOURCE_OPTIONS,
@@ -153,6 +154,8 @@ export function createSelection({
       viewer.scene.canvas,
     );
     layerState._clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       const picked = viewer.scene.pick(click.position);
 
       if (picked) {
diff --git a/src/layers/firms/selection.js b/src/layers/firms/selection.js
index 4cec52c69..5665c615a 100644
--- a/src/layers/firms/selection.js
+++ b/src/layers/firms/selection.js
@@ -3,6 +3,7 @@ import {
   fireDetectionKey,
 } from '../../data/firmsLabels.js';
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import { CONTEXT_TOP_N } from './policy.js';
 
 export function createSelection({
@@ -35,6 +36,8 @@ export function createSelection({
       layerState._viewer,
     );
     layerState._clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       const picked = layerState._viewer.scene.pick(click.position);
       const fire = pickedFire(picked);
       if (fire) {
diff --git a/src/layers/installations/selection.js b/src/layers/installations/selection.js
index ace9124cb..5599d5fdb 100644
--- a/src/layers/installations/selection.js
+++ b/src/layers/installations/selection.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import { LAYER_ID } from './policy.js';
 
 export function createSelection({
@@ -24,6 +25,8 @@ export function createSelection({
       viewer.scene.canvas,
     );
     layerState.clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!layerState.enabled) return;
       const picked = viewer.scene.pick(click.position);
       const id = typeof picked?.id?.id === 'string' ? picked.id.id : null;
diff --git a/src/layers/launches/lifecycle.js b/src/layers/launches/lifecycle.js
index 2eea788d0..58d70d34b 100644
--- a/src/layers/launches/lifecycle.js
+++ b/src/layers/launches/lifecycle.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 
 export function createLifecycle({
   state: layerState,
@@ -26,6 +27,8 @@ export function createLifecycle({
         viewer.scene.canvas,
       );
       layerState._clickHandler.setInputAction((movement) => {
+        // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+        if (!isPointerFree()) return;
         if (!layerState._enabled || !layerState._dataSource?.show) return;
         const entity = viewer.scene
           .drillPick(movement.position, 12)
diff --git a/src/layers/radio/interaction.js b/src/layers/radio/interaction.js
index da8ff558a..11a22b9dd 100644
--- a/src/layers/radio/interaction.js
+++ b/src/layers/radio/interaction.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import {
   RADIO_PREFIX,
   RADIO_PICK_OFFSETS,
@@ -117,6 +118,8 @@ export function createInteraction({
       layerState._viewer.scene.canvas,
     );
     layerState._clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!radioPresentationAllowed()) return;
       const stationId = pickedRadioStationAt(click.position);
       if (!stationId) return;
diff --git a/src/layers/satellites/interaction.js b/src/layers/satellites/interaction.js
index 5944beaa5..7ef8816c6 100644
--- a/src/layers/satellites/interaction.js
+++ b/src/layers/satellites/interaction.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 
 export function createInteraction({
   state: layerState,
@@ -46,6 +47,8 @@ export function createInteraction({
       viewer.scene.canvas,
     );
     layerState._clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!layerState._enabled) return;
       const picked = viewer.scene.pick(click.position);
 
diff --git a/src/layers/submarineCables/interaction.js b/src/layers/submarineCables/interaction.js
index 08e3384ed..aaa4f8aad 100644
--- a/src/layers/submarineCables/interaction.js
+++ b/src/layers/submarineCables/interaction.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 
 export function createInteraction({ state, screenSpaceEventHandlerFactory }) {
   function registerPickEntity(entity, info) {
@@ -10,6 +11,8 @@ export function createInteraction({ state, screenSpaceEventHandlerFactory }) {
     if (state._clickHandler) return;
     state._clickHandler = screenSpaceEventHandlerFactory(viewer.scene.canvas);
     state._clickHandler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!state._enabled) return;
       const picked = viewer.scene.pick(click.position);
       const record = resolvePickRecord(picked);
diff --git a/src/layers/vessels/selection.js b/src/layers/vessels/selection.js
index 56c59a16b..c7696e63c 100644
--- a/src/layers/vessels/selection.js
+++ b/src/layers/vessels/selection.js
@@ -1,4 +1,5 @@
 import * as Cesium from 'cesium';
+import { isPointerFree } from '../../data/inputOwnership.js';
 import { VESSEL_OVERLAY_SOURCE_ID } from '../../data/vesselLabels.js';
 
 export function createSelection({
@@ -33,6 +34,8 @@ export function createSelection({
   function bindVesselInteraction(viewer, handler, keyTarget) {
     state.clickHandler = handler;
     handler.setInputAction((click) => {
+      // A tool owns the pointer (src/data/inputOwnership.js): yield the click.
+      if (!isPointerFree()) return;
       if (!state.feed.enabled) return;
       const picked = viewer.scene.pick(click.position);
       const pickedId = resolvePickId(picked);
diff --git a/src/ui/styles/controls.css b/src/ui/styles/controls.css
index 9e3e71bb6..c86be98f1 100644
--- a/src/ui/styles/controls.css
+++ b/src/ui/styles/controls.css
@@ -822,6 +822,52 @@
   outline: none;
 }
 
+/* DISPLAY ▸ Draw: shape segment, label field, colour, and the one-line hint */
+#draw-mode-row {
+  min-width: 184px;
+}
+#draw-label-row {
+  flex-wrap: wrap;
+  row-gap: 6px;
+}
+.pp-text-input {
+  flex: 1 1 110px;
+  min-width: 0;
+  height: 24px;
+  background: rgba(255, 255, 255, 0.06);
+  border: 1px solid rgba(255, 255, 255, 0.14);
+  border-radius: 6px;
+  color: var(--text-primary);
+  font-family: var(--font-mono);
+  font-size: 10px;
+  letter-spacing: 0.6px;
+  padding: 2px 6px;
+  outline: none;
+}
+.pp-text-input:focus {
+  border-color: var(--accent);
+}
+.draw-color-select {
+  flex: 0 0 74px;
+}
+.draw-clear-btn {
+  flex: 0 0 auto;
+  padding: 0 8px;
+  border: 1px solid rgba(255, 255, 255, 0.14);
+  border-radius: 6px;
+}
+.draw-hint {
+  flex-basis: 100%;
+  font-family: var(--font-mono);
+  font-size: 8px;
+  letter-spacing: 0.6px;
+  color: var(--text-dim);
+  line-height: 1.4;
+}
+body.gev-drawing #cesiumContainer canvas {
+  cursor: crosshair;
+}
+
 /* Proximity / All segmented control under the 3D toggle */
 #models3d-mode-row {
   min-width: 184px;
diff --git a/src/ui/templates/display-controls.html b/src/ui/templates/display-controls.html
index 5ed677b5b..6bc9068f5 100644
--- a/src/ui/templates/display-controls.html
+++ b/src/ui/templates/display-controls.html
@@ -89,6 +89,32 @@
         <span class="pp-slider-value" id="scope-feather-value">11%</span>
       </div>
     </div>
+    <div class="pp-toggle-group">
+      <button class="pp-toggle-btn" id="draw-toggle" title="Draw on the world — click vertices, double-click or Enter to finish, Esc to cancel" aria-pressed="false">
+        <span class="pp-icon material-symbols-outlined" aria-hidden="true">draw</span>
+        <span class="pp-label">Draw</span>
+      </button>
+      <div class="pp-slider-row" id="draw-mode-row">
+        <span class="pp-slider-mini-label">Shape</span>
+        <div class="pp-mode-seg" role="radiogroup" aria-label="Shape to draw">
+          <button class="pp-mode-btn active" data-shape="area" role="radio" aria-checked="true">Area</button>
+          <button class="pp-mode-btn" data-shape="line" role="radio" aria-checked="false">Line</button>
+          <button class="pp-mode-btn" data-shape="pin" role="radio" aria-checked="false">Pin</button>
+        </div>
+      </div>
+      <div class="pp-slider-row" id="draw-label-row">
+        <input type="text" class="pp-text-input" id="draw-label-input" maxlength="120" placeholder="Label (optional)" aria-label="Label for the drawn shape" autocomplete="off" spellcheck="false">
+        <select class="pp-select draw-color-select" id="draw-color-select" aria-label="Colour of the drawn shape">
+          <option value="primary">Primary</option>
+          <option value="amber">Amber</option>
+          <option value="cyan">Cyan</option>
+          <option value="green">Green</option>
+          <option value="red">Red</option>
+        </select>
+        <button class="pp-mode-btn draw-clear-btn" id="draw-clear" type="button" title="Remove every mark from the board">Clear</button>
+        <span class="draw-hint" id="draw-hint" aria-live="polite"></span>
+      </div>
+    </div>
     <div class="pp-toggle-group">
       <button class="pp-toggle-btn" id="celestial-toggle" title="Celestial ring — reveal the full globe" aria-pressed="false">
         <span class="pp-icon material-symbols-outlined" aria-hidden="true">flare</span>