Bogotá's and Santiago's PBSC feeds list depot stations in São Paulo and
Madrid as installed and renting, so activating either city drew live
docks thousands of kilometres away and counted them in the layer total.
Station information is now limited to the city's registered load radius;
every other registered feed already sits inside its radius (checked live
2026-10-16), so nothing else changes.
Adds a Bogotá/Santiago registry test matching the Brazilian and Barcelona
ones: proxy allowlist, outermost-station activation and radius reach, and
the depot filter through the real ingestion path.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
`--write` wrote CHANGELOG.md and then removed fragments one by one, so a
failure after the write left surviving fragments that a rerun spliced in
a second time.
The write is now staged. The assembled file goes into
changelog.d/.assembling/, the fragments are renamed in beside it, and
renaming the assembled file over CHANGELOG.md is the single commit
point. A run that fails rolls itself back when it can; otherwise the next
`npm run changelog` reads the staging directory and either restores the
fragments (assembled file still staged) or deletes the leftovers (batch
landed). `--check` reports a staged batch instead of reporting past it.
A failure-injection test makes every filesystem call in a `--write` fail
in turn, both as a one-off error and as a crash with no in-process
rollback. It asserts the retry produces exactly the uninterrupted
CHANGELOG.md, with each entry once and an empty directory. The test
fails against the previous write-then-delete and against delete-first.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Image loading (photoViewer.js)
- One AbortController per open: a new open, close or unmount stops the
previous photo's first and sharper downloads (an <img> by src = '').
A collapsed viewer never falls back to the original; Panoramax's flat
fallback is the thumbnail. A superseded open resolves quietly.
- Flat HD tracked as "loading" and "shown" apart: a discarded response no
longer blocks later upgrades, and resizes while it loads ask once.
- No upgrade of the photo still shown while another opens.
- Size limits before decoding: imageSize.js reads JPEG/PNG/WebP/GIF
headers; more than 64 MP or 16,384 px a side is refused undecoded, an
<img> that decodes larger is refused and let go, flat HD needs a known
width of at most 8,192 px, and panoramas always decode with a resize.
Panoramax provider
- Retry-After parsed as seconds or an HTTP date; the browser cannot read
it here, so busy answers back off 5 s doubling to 300 s, reset once
answered.
- Headers timed, then the body by an idle timeout (15 s of silence), so a
slow link still gets its megabyte tiles.
- Cones centre only on the picture shown (onShowing), never on a late
lookup; lookups nobody waits for are aborted (shared, refcounted).
- onReopen: a GPU reset redraws in the viewer, not through the core.
- Cones draw the home z15 tile at once and add neighbours as they arrive;
a neighbour that failed is not counted as drawn.
- Coverage tiles decode in ~8 ms slices (a 2 MB z10 tile over Paris was
one ~85-200 ms task); sorted by measured length without a Map.
- Box search asks for 20, not 100 (the API returns them nearest first).
- looksLikeEmail checks every '@'; creatorOf de-duplicates with a Set.
lineCoverage.js
- A redraw while a swap still builds keeps what is on screen (the swap's
old lines and its ready new ones) and drops only the unready ones.
Tests for each (mutation-checked), two vacuous tests made real, the
cones' pictures lane and readable()'s busy/timeout paths covered; the
fixture's box search is nearest first. Docs: README filters and share
links, CHANGELOG HD wording, CURRENT-STATE.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From the maintainer review of #1134 (approve with follow-ups):
- lineCoverage: a share is judged against the cap the tile was last drawn
with, not against later shares that redrew nothing, so small increases
add up (a retained tile stayed at 100 points after its share grew to
116). A rebuild's measuring pass no longer counts as a draw.
- photoViewer: a picture refused for its size (bytes, streamed bytes or
decoded side) is marked `tooLarge`, and the viewer never loads that file
again by any path; the flat fallback had retried an oversized SD file
through an <img>, which has no size limit.
- Regressions for both: cumulative share growth below the threshold, and a
refused SD panorama that is not fetched again as a flat photo.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The pill step read #sl-status straight after the credit wait. Tiles
requested while Cesium painted the credit can flip it back to LOADING,
which failed CI on PR #1038 (actual 'BUTTON:LOADING:true'). Wait for
coverage to settle and the pill to read ON before asserting.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Reverse geocoding now goes to /api/google/reverse-geocode on the app
server, so the harness stub for maps.googleapis.com never matched and a
keyed run would reach Google live. Answer both proxy routes with
ZERO_RESULTS instead.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Node always sets statusCode on client responses, but keeping the
fallback stops a missing status from reading as 200, as main did.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Resolve SECURITY.md against the Street View provider (#966): the browser
key now loads the Maps JavaScript API as well as Map Tiles, so the
'Map Tiles only' guidance becomes 'Map Tiles + Maps JavaScript API'
here and in CHANGELOG, CURRENT-STATE and google-key.js. The CHANGELOG
entry moves to [Unreleased]; its old section shipped in 0.2.0.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
CHANGELOG: keep both new [Unreleased] entries (Panoramax, and the
emergency-transponder highlight from #856).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The merge from main replaced the NYC DOT opt-in pack entry instead of
adding the Bing entry above it.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The round-3 verification found the shared point budget rebuilding a dense
tile by removing its lines before the new ones were built, so central
Paris vanished for 1–2 s after every pan:
- Tiles redrawn for a new share, or for a selected line the cap had left
out, go through the swap path: the old lines stay until the new ones
are ready.
- A share must move by 10% to redraw a tile (a 1.6% change rebuilt it).
- The selected line, admitted past the cap, is not counted against it,
so its tile no longer redraws on every settle.
- A selection the imagery filter hides is not redrawn for.
- Shares are recomputed when a refresh ends loading without a tile
finishing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
KartaView's later viewer changes are carried into the shared
photoViewer.js: the camera bearing (`bearingOf`), redrawing the same
photo after a GPU reset through `onReopen`, no pose while a lost context
recovers, the 2,560 px flat version only once the viewer outgrows
1,280 px, `refreshPose`, and one sharper-panorama load at a time with a
second look once it lands. Its tile cache's `keyOf` and `clear` move to
the shared tileCache.js. KartaView gets `onEscape` beside `onReopen`.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From the round-2 verification (approve with follow-ups), all follow-ups:
- The point budget is shared across the tiles in view once loading
settles (water-filling): a sparse tile keeps what it has, a dense city
centre takes the rest instead of drawing thinner than its suburbs. The
selected sequence is always drawn, and selecting one a cap had left out
draws it.
- The cones' picture-list cache keeps only finished lists: a re-centre
while the cones loaded inherited the aborted load's tiles and drew
none in them.
- Douglas–Peucker measures to the segment, so dead ends and U-turns keep
their far end.
- Switching Panoramax off lets its decoded tiles and lists go.
- Picture downloads are counted while they stream (a host sending no
length cannot fill memory before the cap).
- Comments on the via caption and the simplification tolerance match the
code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Esc moved to the viewer's box (`.sl-viewer-wrap`) in the last commit, but
without one it was a second keydown listener on the root; Esc is now taken
by the root's own handler there. format-scope.json listed
panorama.test.mjs twice, which made the formatter refuse the scope; the
files it skipped are formatted.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From a five-lens IC8 review (correctness, security, tests with mutation
testing, performance, UX):
- P0: over Paris at 12–60 km the unsimplified z10–z12 lines sent ~2M
points to Cesium's ground-polyline builder (gigabytes of geometry; the
tab hung). decode.js now simplifies lines (Douglas–Peucker, 4 tile
units: 6–10% of the points), and lineCoverage gains an opt-in point
budget (`maxPoints`, 10,000 a tile for Panoramax).
- Decoded coverage tiles are kept (KartaView's tile cache moves to the
shared tileCache.js); a sequence's z15 picture lists are kept and load
on their own connection; cones know their tiles from the start of a
load, so a picture opening meanwhile re-centres them and ‹ › no longer
restarts the load.
- The HD panorama loads only for the expanded viewer (a docked one on a
dense screen asked for 3 MB originals) and is aborted when another
photo opens; picture files over 48 MB or 16,384 px are refused; a
bitmap no renderer took after a context loss is closed.
- A nearest lookup survives one of its two searches failing; only a
timeout is retried; offline reads as unreachable; Retry-After is
capped at five minutes; the search box stays on the map at ±180°;
cones near both edges of a narrow (high-latitude) tile read both.
- Every producer is credited (app and photographer); with none to name,
the caption says "via <instance>" rather than crediting the host.
- Esc anywhere in the docked viewer (toolbar, caption) clears the
sequence before the panel takes it. A filter that hides every density
dot says so; wording aligned ("coverage", "photo").
- Tests for every surviving mutant (Esc consumed, keepOrder and dot-size
wiring, licence in the core, limiter aborts, radius floor, bbox corner,
first-producer-only, byte and size caps), a limiter test, and a gate
fixture that answers box searches and leaves out pictures facing away;
the gate now clicks over the other sequence's pictures, so only the
line click's own-sequence lookup can pass.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
KartaView's server filters by upload date only, so SINCE goes by it
throughout for KartaView: the lines (as before), the photo a click opens
and the cones, the cut-off taken as its UTC day as KartaView's startDate
(passesKartaViewFilter). Providers may declare sinceBasis: 'upload'
(validated); while one is lit the panel shows "KartaView: by upload date"
under the SINCE slider, read out with it. The gate checks the note, and
step 13's picks get 60 s on a loaded machine.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
KartaView filters coverage on its server only in its PNG tiles (its JSON
tiles come back empty with a filter), so a filtered tile's PNG is a mask
over the cached JSON segments: a segment stays when at least half the
points along it lie on drawn pixels. A filter change reloads the lines
(lineCoverage.reload keeps the drawn ones until the new ones are in);
masks are cached per filter and tile, and a filtered tile KartaView is
still drawing (504 or a timeout) is asked again, four tries in all.
The nearest lookup asks the photo API for the projection and date, and
the cones follow the filter like Mapillary's. The gate fixture draws
filtered PNG tiles and adds an older flat-only street; a new gate step
checks 360 and LAST YEAR thin KartaView's lines and ALL brings them back.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From a UX QA round in the browser against the live API:
- A line click could time out while coverage loaded: the meta-catalogue
speaks HTTP/1.1 only (six connections), and six tiles plus four
searches queued the lookup behind megabyte tiles. Tiles now take
three connections and searches two; a search that timed out is asked
once more.
- Between 30 and ~100 km Paris read as empty: the density grid is ~10 km
a cell. Lines now draw to 60 km (z10), as Mapillary's do; above, dots
grow with the pictures they stand for.
- Esc in the docked viewer collapsed the whole panel instead of clearing
the sequence the panel says it clears (shared photo viewer: KartaView
too). The viewer now offers Esc to the provider first; expanded, the
dialog keeps it.
- A picture whose producer is an email address is credited to the
instance holding it (its `via` host), so Licence Ouverte pictures name
their source.
- Empty states say why: "no Panoramax photos here match the filters"
when the filter hid every line, and nothing to zoom into over empty
sea. Wording follows KartaView's ("photos", "click a line for its
nearest photo").
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From an adversarial functional QA round against the live API:
- The nearest lookup missed pictures looking away from the click
(place_position leaves them out at any tolerance): it now runs a
bounding-box search beside it and ranks both by distance. A line
clicked from high up searches its sequence within height / 100
(50–400 m).
- The per-tile line cap kept the newest sequences, not the longest
(lineCoverage re-sorted them): providers can now keep their decoded
order (`keepOrder`).
- A long producer name froze the tab (quadratic email regex): linear
check. A malformed link escape no longer fails the lookup; null or
string coordinates no longer land at 0,0.
- A line with no camera type or day stays drawn under the filters.
- A sky click on a line changes nothing (as KartaView), instead of
selecting a sequence with no cones.
- An unreadable tile reads as such; a failed neighbour z15 tile only
thins the cones; unknown or refused ids say the picture is gone.
- Shared viewer: the sharp-panorama guard is per open (a late download
of the previous photo no longer lets a second one start); an HD-only
360° picture is shrunk or skipped like any original; panorama.js read
the bitmap size after closing it, so 2:1 power-of-two panoramas
clamped instead of wrapping.
- Tests for each, and for the gaps mutation testing found (preferred
point, cone order, no reload within drawn tiles, newest-first gate,
stale bitmap release, flat upgrade retry).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Panoramax, the open federated street-level commons, registers beside
Mapillary, Google Street View and KartaView. Its meta-catalogue
(api.panoramax.xyz) is keyless and CORS-open, so it runs in the browser:
- coverage from its vector tiles: sequence lines at z11–14 below 30 km
(longest first under the per-tile cap), and above that the grid layer's
density cells as binned points, not counted as sequences;
- a click on a line opens that sequence's picture nearest the click
(STAC search, any direction), without moving the camera, then any
sequence's if it has none within 50 m; the 360° and since filters go to
the lines and to the API;
- cones from the z15 tiles' pictures layer around the open picture
(~110 bytes a picture, against ~7.5 kB for a STAC item), re-centred when
a picture opens outside them; ‹ › follow the picture's prev/next links;
- the caption names the author (not an account named by an email
address) and the picture's licence (StreetPose `license`), and links to
the picture in the Panoramax viewer; the globe credits Panoramax.
KartaView's viewer becomes the shared photoViewer.js (flat <img>, 360° on
panorama.js, ‹ ›, keyboard, pinch, context loss), driven by a per-provider
PhotoSources table; the request limiter moves to limiter.js. Panoramax shows
the 2,048 px SD derivative and fetches the HD original only when the viewer
is wide enough, once, shrunk while it decodes (never above 8,192 px).
Orange #ff6f00 (Panoramax's own), off by default, share option
0.m.0_0.r.panoramax-1. The MCP panel allows the meta-catalogue and the
biggest instances. Tests: policy, decode, source, viewer, provider, and a
Panoramax fixture in the hermetic browser gate.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
- Viewer: resizes while a sharper photo loads start no second load (the
last size is looked at once it lands); decoded bitmaps nobody will draw
(an overtaken preview or upgrade) are closed.
- Cones: a photo opened while the drive's first page loads is the one
they centre on.
- A sequence page that lands while a lost WebGL context recovers keeps
its cones: no pose is emitted without a renderer, and a viewer error
never rejects page data.
- Source: an answer turned away unread (HTTP error, 429, length past the
cap) aborts its request and cancels its body, freeing the connection.
- Gate: findPickPoint no longer picks each centre five times at radius 0,
aims step 13's cone pick at the drawn billboards, and caps each
evaluation at 4 s, resuming from a cursor on the next poll, so a slow
machine cannot spend a whole wait in one evaluation.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Marker and direction (reported on the PR):
- KartaView has its own marker, a purple view cone (Street View's is
blue), not GEV's default pin that Mapillary uses.
- The camera direction (marker, cones, FOLLOW, a panorama's centre) is
the direction of travel to the next photo a few metres on. KartaView's
heading is the device compass: whole drives read 0 (no compass) and
others sit a steady ~110° off. Until the drive loads the compass stands
in (0 = unknown), and the pose is sent again once the course is known.
Remaining P4s from the review of #1121:
- Segment chaining is linear (a per-point cursor) and capped at 20,000
segments a tile and 5,000 points a line: a hostile tile of 60k segments
sharing one point took 1.5 s, now tens of ms.
- Decoded tiles are dropped when KartaView is switched off.
- No network / a refused request says so and is not retried as a timeout;
an unreadable answer says so.
- A docked flat photo skips the 2,560 px download until the viewer grows.
- The panel counts the drive's photos (countActivePhotos), not the thinned
page of cones (2,250, not 217).
- After a GPU reset the viewer redraws the photo itself, so a lookup the
user started is not cancelled; a failure is still reported.
- The gate's keyless page lights KartaView and checks it draws with no key;
the fixture answers the sequence count; the line-click step checks the
camera looks along the drive when the compass says 200°.
- README/CHANGELOG show the share-link form the app writes.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
NYC DOT asks developers who use its camera feed to sign a data-sharing
agreement, and this project does not hold one that covers downstream
installs. The pack now loads only when CCTV_NYC_ENABLED=1; unset, empty
or any other value makes no request to webcams.nyctmc.org (tested).
The NYC credit carries NYC DOT's requested application disclaimer
verbatim, and DATA_SOURCES, README, CHANGELOG, CURRENT-STATE and
.env.example describe the prerequisite.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From the IC8 review of #1121 (2 P2, 7 P3; each with a test that fails on
the old code):
P2
- A WebGL context lost while a newer panorama loaded left a black viewer
and a 'successful' open: the panorama now builds on the new canvas (or
falls back to its front view).
- The streaming body read every real answer takes was tested with one
chunk only: answers split mid-character are reassembled; the shared test
fake now streams, so every source test runs the production path.
P3
- Lighting another source by its chip (params) now stops a running lookup
and clears its spinner and error, as setProviderEnabled did; a restore
that changes nothing leaves them alone.
- Panoramas decode off the main thread (ImageBitmap, RGBA upload: ~90 ms →
~15 ms at 4,096 px on a phone-class CPU) and are 2,048 px docked, 4,096
once the viewer grows; a closed viewer keeps a 1×1 texture.
- The lit KARTAVIEW chip label is #8f8aff (~6:1; #635bff was 3.7:1).
- The viewer's keyboard focus ring is drawn above the photo.
- Tests: a second context loss and a drag on the new canvas; the look
direction kept across a loss; a page's 30 s first try.
- The browser gate loses a real WebGL context in the 360° step and checks
the 429 lookup was asked again (the fixture counter is reset first).
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From the second IC8 pass (launch ready; P3s closed here):
- A lost WebGL context is redrawn on a new canvas (the old one only gives
back its lost context), through the core, and only if no newer photo is
opening; verified live with WEBGL_lose_context, twice.
- The 16 MB answer cap counts bytes while reading: KartaView sends
chunked answers with no Content-Length, so the header check never fired.
- A lookup gets 8 s, then 15 s once more: KartaView sometimes sits on a
lookup for 11 s and answers the same one in 3 s.
Left as follow-ups: cancelling abandoned sequence pages; finding a page
by binary search on the index when thousands of photos are missing.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
A mutation review (91, then 130 mutants) found tests that could not fail
(quick presses with synchronous fakes, a no-flight check with a provider
that never posed), and untested paths. New and rewritten tests kill 123 of
130 mutants; the 7 survivors are equivalent or harmless redraws.
- viewer: held-back loads for quick presses, stale sharp/flat loads,
close mid-load, ends checks for an older photo, WebGL retried per mount,
focus handed back, look direction kept on ›.
- provider: id-ordered pages with out-of-order indexes, page and probe
failures retried, overtaken lookups, cones re-centred on ‹ ›, leftover
imagery filters hide no line or cone, coverage hints, tile cache.
- source: 429 backoff and Retry-After under mock timers, hang timeouts,
the nearest query's parameters. policy: storage-host injection, FOV 360,
longitudes past ±180. panorama: a stub WebGL context (angles, lost
context, re-measuring). lineCoverage.test.mjs: tooHigh hint, passes().
- core: openImage({frame:false}) and openNearest leave the camera
(with a posing provider and a default-open control), KartaView's legend
and wording end to end; viewerHost supportsRenderModes.
- Fixed tick-count waits replaced by an until() poll.
- Browser gate fixture: odd photos archived (409 at storage2, served by
the proxy), the first lookup rate-limited (429, Retry-After: 0); the
line-click step asserts the camera stays and › skips the archived photo.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
P1s from the correctness review, each with a regression test:
- Cones showed the wrong page of a long sequence (cache keyed by
sequence; no re-centre after a close or a same-drive line click):
KartaView always reselects, and re-centres whenever a photo of the
selected sequence opens on another page.
- A 360° photo's first frame was one colour: the canvas was sized while
hidden (1×1). It is shown first, and re-measured every frame.
P2/P3s: a storage timeout or 5xx is not remembered as archived (only
403/404/409/410 are); dense z13 tiles draw up to 1,600 lines (a third of
downtown Detroit was cut); decoded tiles are kept 10 min; a timed-out tile
is asked once more; pages are 250 photos and the newest page request goes
first; a photo far past deleted ones, or unlisted at a page edge, still
finds its neighbours; a step that gets no answer is not the end; a lost
WebGL context redraws the photo, and a failed one is retried on the next
mount; the first flat image comes from the proxy (KartaView's own can be
1.7 MB); fileurl fallbacks must be https storage hosts; oversized answers
are refused; keyboard (Shift+← →, ↑ ↓, + −) and pinch look around a
panorama; focus stays in the viewer when a step button disables. Docs:
share links with 0.m.0, keyless count, CURRENT-STATE matched to the code.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Six candidates at once on photo storage (not the API host): the nearest
showable one wins. Jakarta line clicks opened 5/8 (0/5 before the QA
round; the rest are archived and say so), Detroit 8/8.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
From two agentic QA passes (UX and failure modes):
- A line click opens the nearest photo that can be shown: archived photos
(409; a HEAD says 200) and records without files are skipped, a few at
most, else 'KartaView's photos here are archived'. ‹ › skip them too.
- api.kartaview.org is HTTP/1.1 (six connections): tiles take three,
lookups two, sequence pages one, so a lookup never times out behind
tiles; a timed-out lookup is asked once more; waits are capped at 10 s.
- Sequence pages follow photo ids, not the index: a photo's page is found
by search, a neighbour page joins near an edge, so ‹ › neither skip at
page edges nor loop past gaps. Pages are 500 photos (~1.2 MB).
- ‹ › open through the core without framing: loading, errors and cones
behave as for any open; presses step on from the photo on its way; the
ends disable up front.
- Cones ignore the hidden IMAGERY / SINCE filters; no 'Selected' swatch
for a source whose lines never highlight; 'no KartaView photos in view';
an unreadable tile is not cached as empty; a 0,0 fix is no photo; a
failed lookup's error goes when another source is lit; the link goes
through the image proxy; a stalled panorama shows its front view after
15 s instead of 60.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The fixture gate answers api.kartaview.org, cdn.kartaview.org and
*.openstreetcam.org from fixtures (a drive with a 360° photo, stored on
storage2 while the API names storage1) and adds three steps: keyless
coverage with its credit and hidden filters, a line click opening the
nearest photo with cones and ›, and a 360° photo on the panorama without
FIT / FILL. The Street View share-link check reads the switch field instead
of one exact entry, since a chip click records every provider's switch.
README, DATA_SOURCES, CHANGELOG and CURRENT-STATE describe KartaView.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Said Turksever