Add the changelog entry for #1576

Over a city with no feed or system (London, Tokyo) both rows read
"ON · — · never", the same as a feed that never answered. Transit already
computed a coverage note but put it only in `coverage`, which the row does
not show; Bike Share reported nothing at all.

Both layers now report a `zoom-in` guidance status with a `statusMessage`:
"Fly below 3,000 km to a covered region" / "No feed here yet · N regions
available" for Transit, and "Fly below 48 km to a covered city" / "No bike
share here yet · N systems available" for Bike Share. A loading or failed
Bike Share city keeps its own text. Leaving coverage clears the layer's
last-update time, so the row no longer dates data it no longer draws.

The coverage-note translations move from the voice card into
`translateStatusMessage` (ui/statusText.js), which the Layers row and the
voice card now share.

.env.example

@@ -61,8 +61,15 @@ CESIUM_ION_TOKEN=
 # ChatGPT/Codex OAuth session; the browser still receives only a short-lived
 # Realtime client secret. Do not prefix with VITE_.
 OPENAI_API_KEY=
-# Optional: forbid API-key voice sessions. Select ChatGPT OAuth in Provider
-# Settings; missing or expired Codex sign-in then fails closed.
+# Typed chat uses Chat Completions, independently of the voice model. It can
+# only bill OPENAI_API_KEY, so GEV_PREFER_CODEX_OAUTH below turns it off.
+OPENAI_CHAT_MODEL=gpt-4.1-mini
+# Typed chat requests (/api/openai/chat) per IP per minute, counted apart from
+# voice. Unset, it takes GEV_RATELIMIT_OPENAI_PER_MIN's cap; 0 disables it.
+# Not a billing cap.
+# GEV_RATELIMIT_OPENAI_CHAT_PER_MIN=30
+# Optional: forbid API-key voice sessions and OpenAI typed chat. Select ChatGPT
+# OAuth in Provider Settings; missing or expired Codex sign-in then fails closed.
 # GEV_PREFER_CODEX_OAUTH=true
 OPENAI_REALTIME_MODEL=gpt-realtime-2
 # Cheaper voice tier, used when the GEV MIC panel's MINI toggle is on.
@@ -256,6 +263,9 @@ AISSTREAM_API_KEY=
 # CCTV_TAIWAN_ENABLED=1                                # set 0 to skip Taiwan Freeway Bureau (MOTC) road cameras
 # CCTV_TAIWAN_MAX_SOURCES=600                          # cap Taiwan freeway cameras (1-2000); no API key required
 # CCTV_TAIWAN_URL=                                     # override the Freeway Bureau MOTC 2.0 CCTV.xml URL
+# CCTV_HOUSTON_ENABLED=                                # off by default; set 1 to load Houston TranStar cameras only if you hold TxDOT's written permission (TranStar's Content Usage terms prohibit copying, distributing or framing its images without it; see DATA_SOURCES.md)
+# CCTV_HOUSTON_MAX_SOURCES=250                         # cap cameras loaded from the Houston TranStar catalog (nearest metro cores first)
+# CCTV_HOUSTON_CAMERAS_URL=                            # override the Houston TranStar catalog URL
 # CCTV_A22_ENABLED=1                                   # set 0 to disable the Autostrada del Brennero (A22, Italy) webcams
 # CCTV_A22_URL=                                        # override the Open Data Hub A22 webcam catalog URL
 # CCTV_MAX_SOURCES=4000                                # catalog-wide ceiling, shared round-robin across packs
@@ -263,6 +273,7 @@ AISSTREAM_API_KEY=
 # CCTV_FORCE_AUSTIN=                                   # force live default sources when a source-pack JSON is configured
 
 # Optional: comma-separated Overpass URLs; use only instances you run or pay for.
+# Also enables voice place search (osm_query, "hospitals in Kathmandu").
 OVERPASS_UPSTREAMS=
 
 # Optional: place-lookup endpoints. Lookups try bundled data first, then the
@@ -296,6 +307,12 @@ OVERPASS_UPSTREAMS=
 # Unset, no page may frame it. Other pages of the app can never be framed.
 # GEV_EMBED_FRAME_ANCESTORS=
 
+# Gemini typed chat uses generateContent; voice continues to use Gemini Live.
+GEMINI_CHAT_MODEL=gemini-3.5-flash-lite
+# Typed chat requests (/api/gemini/chat) per IP per minute. Unset, it takes
+# GEV_RATELIMIT_GEMINI_PER_MIN's cap (default 30); 0 disables it.
+# GEV_RATELIMIT_GEMINI_CHAT_PER_MIN=30
+
 # Optional keyless Radio Browser coverage: up to 8 ISO alpha-2 countries.
 # Each reserves up to 40 stations within the existing 750-station directory.
 # Restart after changing. Leave blank for the existing global selection.

DATA_SOURCES.md

@@ -40,6 +40,7 @@ How to read this:
 | **NIFC WFIGS** (Wildland Fire Interagency Geospatial Services, ArcGIS feature service) | Fire Perimeters layer: current interagency wildfire incident perimeters, containment, and incident facts | U.S. public domain (interagency wildland-fire data published through the [NIFC Open Data portal](https://data-nifc.opendata.arcgis.com/)); fetched keyless through `/api/fire-perimeters` (5-minute server cache) with `exceededTransferLimit` paging | "Wildfire perimeters: National Interagency Fire Center (WFIGS)" |
 | **S2 Underground GhostMaps** (`github.com/s2underground/GhostMaps`) | S2 GhostMaps layer: the current edition of S2's KMZ intel products (Common Intelligence Picture, 30-day kinetic pull, Border Crisis Map, Iran and Yemen products, newest incident drop). Keyless. `/api/ghostmaps` reads the branch head from git's ref advertisement every 15 s (`GHOSTMAPS_POLL_SECONDS`, minimum 5 s), lists the tree through the GitHub REST API only when the head changes (optional `GITHUB_TOKEN`), downloads files by commit-pinned raw URLs into `.gev-cache/ghostmaps/` and pushes new catalogs to browsers over server-sent events | [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) (repository README: "S2 Underground © 2025 by S2A1"); non-commercial, attribution required; files are fetched at runtime, never stored in this repository | "S2 GhostMaps intel products: S2 Underground © by S2A1, CC BY-NC-SA 4.0" — shown in-app |
 | **InciWeb** (inciweb.wildfire.gov)                                    | Per-incident "InciWeb ↗" card links to official incident pages (narratives, evacuation/closure notices) | U.S. government public incident information. Links are matched best-effort by incident name and state, with incident page origin and update times checked on selection. Same-origin `/api/fire-perimeters/inciweb` routes cache the catalog for 1 hour and publication metadata for 30 minutes; linked pages remain InciWeb content | "Incident information: InciWeb (inciweb.wildfire.gov)" |
+| **FAA Special Use Airspace** (`services6.arcgis.com` FeatureServer `Special_Use_Airspace`) | Prohibited & Restricted Airspace layer: US prohibited (P) and restricted (R) special-use airspace polygons (not the UAS Facility Map or UAS flight restrictions), altitude limits from the `*_VAL`/`*_UOM`/`*_CODE` fields, times of use, and controlling agency | U.S. public domain (FAA aeronautical data published through the [FAA AIS Open Data portal](https://adds-faa.opendata.arcgis.com/)); fetched keyless through `/api/drone-airspace` (1-hour server cache). Informational only — not a substitute for official UAS flight-planning tools | "Prohibited & restricted airspace: FAA Special Use Airspace" |
 | **OpenFreeMap / OpenMapTiles** | Vector tiles | OpenStreetMap data under ODbL 1.0 | OpenFreeMap © OpenMapTiles |
 | **Overture Maps Foundation** | Military area names pack | [ODbL 1.0](https://opendatacommons.org/licenses/odbl/1-0/) | Overture Maps Foundation |
 | **TomTom Traffic API** (flow vector tiles)                            | Traffic roads and live congestion (optional, BYOK)                                                                     | [TomTom for Developers terms](https://docs.tomtom.com/legal/terms-and-conditions) (proprietary, your own key; free tier currently 200K tile requests/month — see [current pricing](https://docs.tomtom.com/pricing/))                                                                                                                                                       | "Traffic flow data © TomTom" — registered when live mode activates                                                                          |
@@ -69,6 +70,7 @@ How to read this:
 | **Kartverket** (`ws.geonorge.no/hoydedata/v1/punkt`)               | Terrain heights (NN2000) used as the ground prior for Statens vegvesen cameras                                                     | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — attribution REQUIRED | "© Kartverket", modified (heights over water set to 0 m, rounded to 0.1 m) |
 | **NYC DOT Traffic Management Center** (`webcams.nyctmc.org`) | CCTV camera catalog + frames, New York City five boroughs | NYC DOT requires developers to sign a [data-sharing agreement](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) for the camera feed. **Off by default**; enable only under your own agreement | "NYC DOT Traffic Management Center" + NYC DOT's required application disclaimer (in the Data attribution popover) |
 | **City of Toronto Open Data** (`opendata.toronto.ca`)                 | CCTV camera catalog + frames, Toronto city streets                                                                                  | [Open Government Licence – Toronto](https://www.toronto.ca/city-government/data-research-maps/open-data/open-data-licence/) — attribution REQUIRED                                                                                                                                                                                                    | "Contains information licensed under the Open Government Licence – Toronto"                                                                 |
+| **Houston TranStar** (`traffic.houstontranstar.org`, frames `www.houstontranstar.org`) | CCTV camera catalog + frames, Greater Houston | No licence. The [TranStar disclaimer](https://traffic.houstontranstar.org/disclaimer.aspx) (Content Usage) prohibits copying or distribution, and external framing or linking to specific images, without TxDOT's prior written permission. **Off by default**; enable only if you hold TxDOT's written permission | "Houston TranStar" (courtesy) |
 | **Autostrada del Brennero (A22)** (catalog `tourism.api.opendatahub.com`, frames `www.autobrennero.it/WebCamImg/`) | CCTV camera catalog + frames, A22 Brenner–Modena motorway, Italy | Public Autobrennero webcam images; camera list republished by the Open Data Hub, whose records are tagged CC0 (`ClosedData: false`, licence holder Autobrennero); Autobrennero publishes no terms of its own for the images | "Webcam images © Autostrada del Brennero S.p.A., via the Open Data Hub (NOI Techpark)" (courtesy) |
 | **GBFS (Lyft / BCycle / Social Bicycles / PBSC)**                     | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                                   |
 | **Bike Share Toronto** (`toronto.publicbikesystem.net`) | Bikeshare station availability, Toronto | Operator GBFS feed. No licence is published: the City's open-data package declares none and the feed has no `license_url`. Attribution is given to the operator. | "Bike Share Toronto (Toronto Parking Authority)" |
@@ -180,6 +182,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Kartverket ground heights for Statens vegvesen cameras.** The camera feed's points are 2D, so the loader asks Kartverket's keyless point-height API (`ws.geonorge.no/hoydedata/v1/punkt`, CC BY 4.0) for the terrain height at each camera. Requests carry 20 points: the API accepts 50, but above ~20 it answers the extra points from contour lines (`hoydekurver`, metres to ~20 m off) or not at all. Eight requests run at a time, about 36 for the whole country: a cold lookup took 6–13 s in testing (single requests 0.6–9.5 s). Answers are matched by the coordinates the API echoes and recorded only for points that request asked about. Over water the API returns the sea-floor depth (`dybdekurver` or `Havflate`), which is replaced by 0 m, the water surface; for the ~14 bridge cameras that is below the deck, but much closer than the sea floor or the flat prior. Heights are cached in memory by position for the life of the server, and points with no height (a few ferry quays and bridges, or a point a 200 answer leaves out) for 6 h, so the 15-minute catalog refresh only asks about new or moved cameras. The first failing request (a 408, 429 or 5xx, a network error, a request over 10 s, or an unreadable or oversized body) stops the lookup, with no retries, and no new lookup starts until the backoff ends (Retry-After when sent, else 30 min, longer than the refresh; bounded to 1 min–1 h). Any other 4xx marks that request's points as having no height and the lookup carries on. The whole lookup has a 30 s deadline; a lookup cut short by it resumes on the next refresh without a backoff. The lane waits at most 12 s, counted from the start of the loader, and only when more than 10% of the cameras have no answer yet; a few new cameras or expired misses are looked up in the background. A slower lookup keeps filling the cache, and the cameras it had not reached keep the flat prior until the next 15-minute refresh (about 190 of 865 on one slow first run). Only coordinates are sent, with the same User-Agent as the other CCTV requests. `CCTV_VEGVESEN_HEIGHTS=0` turns the lookup off. The Kartverket credit, with a note that heights over water are set to 0 m and heights are rounded to 0.1 m, is shown beside the Statens vegvesen entry in the Data attribution popover.
 - **NYC DOT Traffic Management Center cameras.** Off by default. NYC DOT's [developer data feeds page](https://www.nyc.gov/html/dot/html/about/datafeeds.shtml) asks developers who want the camera feed to contact `[email protected]` and sign a data-sharing agreement. This project does not hold one that covers downstream installations, so the pack loads only when an operator who holds their own agreement sets `CCTV_NYC_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to NYC DOT. The endpoint needs no key. The camera list is the public `webcams.nyctmc.org/api/cameras` catalog (~980 cameras across the five boroughs); frames are stills at `webcams.nyctmc.org/api/cameras/<uuid>/image`, synthesized from a validated UUID rather than taken from the payload, and only that host is registered. Cameras the feed reports as offline are dropped. The catalog publishes no camera facing, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. Once enabled, the 250 cameras nearest the borough cores load; `CCTV_NYC_MAX_SOURCES` (8–400) changes the cap. Frames are fetched at request time and never stored or redistributed. NYC DOT asks every application that uses its data to carry its disclaimer; it is registered verbatim in the Data attribution popover.
 - **City of Toronto RESCU cameras.** Keyless. The camera list is the City's public `tmcearthcameras.json` on `opendata.toronto.ca` (dataset "Traffic Cameras", Transportation Services), served as JSONP and unwrapped with an anchored pattern. This is the municipal network the Ontario 511 pack does not carry: downtown arterials plus the Gardiner, DVP, Allen and Lake Shore. The list publishes no frame URL, so frame URLs are BUILT from the documented `CameraImages/loc####.jpg` convention and a strictly-digits camera number, pinning the frame proxy to the portal origin by construction; the list fetch refuses redirects and bounds the body it buffers. Frames are fetched at request time and never stored or redistributed. The dataset publishes no camera facing: the `D1`-`D4` fields are the directions of the *comparison* images (static reference stills captured in 2016 under a different path), not a bearing for the live pan-tilt-zoom frame, so headings use the shared id-hash fallback at low confidence and are corrected with the in-app calibration gizmo. A camera that is temporarily out of service still answers 200 with a byte-identical "Image Unavailable" placeholder rather than an error (about 6% of the network at any moment), so such a camera reads as healthy; the frame it shows is the agency's, not a synthesized one. The licence requires the attribution statement above. Disable with `CCTV_TORONTO_ENABLED=0`.
+- **Houston TranStar cameras.** Keyless. The camera list is the public `traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js` catalog (~1,000 cameras across Greater Houston); frames are stills at `www.houstontranstar.org/snapshots/cctv/<id>.jpg`, synthesized from a validated numeric id rather than taken from the payload, and only that host is registered. Cameras whose catalog id is `0` (a different, non-snapshot class) and cameras outside Greater Houston are dropped. TranStar's `dir` field is the side of the freeway the camera sits on, not the way it faces: TranStar's own map shows it as "Traffic closest to the camera is traveling …" (South → eastbound, North → westbound, West → southbound, East → northbound). That travel direction (90°, 270°, 180°, 0°) seeds the heading as a low-confidence prior with the low-confidence pose; `None` or an unknown value uses the shared id-hash fallback at low confidence. Headings are corrected with the in-app calibration gizmo. Off by default. TranStar's [Content Usage terms](https://traffic.houstontranstar.org/disclaimer.aspx) prohibit copying or distributing the site's information, and external framing or linking to specific images, without TxDOT's prior written permission; its FAQ grants permission-free use only for the RSS feeds. This project does not hold that permission for downstream installations, so the pack loads only when an operator who holds TxDOT's written permission sets `CCTV_HOUSTON_ENABLED=1`; with the flag unset, empty or any other value, the server makes no request to TranStar. Once enabled, it loads the 250 cameras nearest downtown, Uptown, the Medical Center, IAH and Galveston; `CCTV_HOUSTON_MAX_SOURCES` (8–400) changes the cap. Snapshots update about every 3 minutes, which is also the ambient still cadence. Frames are fetched from TranStar and relayed to the browser on demand, buffered only transiently per request, sent with `Cache-Control: no-store`, and not archived.
 - **Autostrada del Brennero (A22) webcams.** Keyless. The camera list is one request to the Open Data Hub tourism API (`tourism.api.opendatahub.com/v1/WebcamInfo?source=a22`), run by NOI Techpark in South Tyrol, which republishes Autobrennero's own list of 13 motorway webcams with coordinates and kilometre markers. Frames are the operator's stills on `www.autobrennero.it/WebCamImg/km<N>.jpg`, refreshed about once a minute, and only the exact image for each camera's kilometre is registered. The feed names no bearing, so headings use the id-hash fallback at low confidence. The road climbs from about 20 m in the Po valley to about 1,370 m at the Brenner Pass, so each camera's ground elevation comes from a per-kilometre table sampled from the Copernicus GLO-90 DEM (via Open-Meteo's elevation API); a camera not in the table uses a 200 m prior. The Open Data Hub tags every record CC0 (`ClosedData: false`, Autobrennero as licence holder), but that tag is the aggregator's metadata and Autobrennero publishes no terms of its own for the images, so they are credited to the operator as a courtesy and are not redistributed. Frames are fetched at request time and never stored. Disable with `CCTV_A22_ENABLED=0`.
 - **Camera frame content.** Public camera frames can contain people, vehicles and license plates, and the camera layer does nothing with them beyond putting them on the map. A successful upstream response is relayed as the provider served it: nothing in the camera pipeline blurs, redacts, enhances or restores it, and nothing there runs face, plate or object detection or otherwise recognises or classifies what is in the picture. (The ALPR layer described below maps where plate-reader cameras are, from locations contributors tagged in OpenStreetMap; it reads nothing from any camera frame.) When an upstream has no frame for a camera, what you see instead is a Google Street View still or the app's own placeholder card; the panel's source badge names which of them you are looking at, and a refresh that fails after a frame has arrived leaves the last good picture on screen rather than replacing it. The browser resamples each frame for display: onto a fixed 1920x1080 surface for the camera's projection plane in the scene, and onto a 192x108 canvas for the small ambient card. That scaling is the only change made to the picture, and the only pixels the camera layer reads back are a 64x36 downscale hashed to tell whether the picture has changed. Live streams are piped through; the still path reads the image into memory to pass it on — TxDOT wraps its JPEG in a JSON envelope, which is decoded there — and no frame is written to disk (the disk cache, `.gev-cache/`, holds feed JSON for other layers and never camera imagery). Outside that pipeline, the voice assistant is the one feature that sends imagery anywhere: when it answers a question about what is in view it may attach a downscaled screenshot of the rendered scene — including any camera plane on screen — to the request it sends to the voice model. Frames are fetched only from server-registered camera URLs — a client cannot hand the proxy a URL (see [SECURITY.md](SECURITY.md)). What the app does stays inside the line README draws: no named-person search, no face recognition, no tracking individuals.
 - **Transit (GTFS-Realtime).** The proxy requests only registered operator feeds, validates redirects, bounds responses, and uses conditional requests, short snapshot caching and failure backoff. All sixteen registered regions are live-enabled; each can be disabled independently. Vehicles use delayed playback between reports, with report age and waiting states shown separately. Session-local selected trails are available for every feed. MBTA additionally retains up to 15 minutes of recently observed positions in the running proxy, so available history can survive a browser reload; server restart clears it. History reads never fetch upstream, and other feeds have no proxy retention. Nothing is archived to disk or collected in the background. Operator text credits are included as a courtesy and do not imply endorsement. Heights are aligned to work with Google 3D tiles; subway markers are shown at street level because these feeds do not supply depth. The TTC feed is BusTime, the surface system: it carries buses and streetcars and no subway at all. About four in ten of its vehicles report no route at all (unassigned or deadheading), and those are shown with the feed default rather than a route-established mode. It sends no ETag or Last-Modified, so its conditional requests fall through to the ordinary snapshot cache. Three Golden Horseshoe neighbours run alongside it — MiWay, Hamilton HSR and Durham Region Transit — each bus-only and each polled only near its own region. Durham Region Transit publishes no bearing on any vehicle, so those sprites take their heading from observed movement like any other feed that omits it. Guelph, Kingston and Barrie extend the same pattern eastward and north. Hamilton, Guelph, Burlington and YRT publish route ids that are not the number on the vehicle, so those entries carry a route-name table taken from each operator’s own published GTFS; any id missing from a table renders unchanged rather than blank. A label is never invented: YRT runs a route `9101` that appears nowhere in its published routes, so it stays as the feed sends it. Burlington’s is the one that cannot be shortcut: `351` is route 1 while `3510` is route 10, so the table is a real join rather than a trimmed prefix. GO Transit / Metrolinx is deliberately absent: its REALTIME feed requires an API key issued by manual review, which the keyless admission rule excludes (its static schedule download is keyless, but carries no vehicle positions). Barrie and YRT/Viva each invite acceptance of their licence through a form, and each licence also states that using the data is itself acceptance; this deployment relies on that clause, which is recorded in both entries. Grand River Transit in Waterloo is absent for a different reason: it answers, but its feed header was months stale and it publishes no per-vehicle timestamps, so it would render vehicles that look live and are not. Ottawa’s OC Transpo falls to the same keyless admission rule as GO Transit — its realtime feed requires an API key. London Transit and Thunder Bay Transit publish vehicle positions over plain HTTP with no HTTPS endpoint available. Every other Ontario system — Brampton, Oakville, Niagara, Milton, Windsor, Greater Sudbury, UP Express and a dozen smaller operators — publishes static GTFS schedules only, with no realtime vehicle positions to register. Between the nine included and these exclusions, every Ontario realtime vehicle-position feed catalogued in the Mobility Database is accounted for.
@@ -190,9 +193,11 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 - **Routing (OSRM / FOSSGIS).** `/api/route` proxies the public OSRM instances FOSSGIS e.V. runs for the OpenStreetMap community (car, bike, foot profiles). They are keyless and intended for fair, interactive use — the proxy rate-limits clients (60/min, 200/min total), caps route span and response size, caches each route for 10 minutes, and identifies itself in the User-Agent. Heavy or automated use must run its own OSRM. Routes are computed from OpenStreetMap data (ODbL); the Directions layer and voice routes never redistribute them. A route the router cannot find is reported as such; the Directions layer draws nothing in that case, and voice routes fall back to a clearly labeled straight line.
 - **Re:Earth Terrain.** Keyless (no API key). Used two ways: (1) `src/mapStackController.js` swaps in a `Cesium.CesiumTerrainProvider` pointed at Re:Earth's `cesium-mesh/ellipsoid` quantized-mesh endpoint for globe stacks without a Cesium ion token (e.g. OSM), replacing a flat `EllipsoidTerrainProvider`; falls back to the flat provider if the endpoint can't be reached. (2) The server-side `/api/terrain/heights` proxy (disk-cached, serve-stale) resolves per-point ellipsoidal ground height for entity placement. Both are best-effort with a keyless-safe fallback (bundled EGM96 geoid math) if Re:Earth is unreachable.
 - **OSRM on the FOSSGIS routing servers.** Keyless (no API key). Every route is requested by a person: clicking A and B in the Directions layer, or a voice "route from A to B". The server-side `/api/route` proxy sends an identifying `User-Agent`, pins the upstream host, accepts 2-12 coordinates, rejects any leg over 600 km or a total over 2,500 km, caps the buffered response at 8 MB, times the upstream out at 12 s, rate-limits per client, caches each route for 10 minutes, and coalesces identical requests that are in flight at the same time. Turn-by-turn maneuvers are asked for only when a caller wants them (`steps=1`), so the callers that do not read them send the smaller request. The "fix the map" link the policy asks for is in the Data attribution popover beside the OpenStreetMap credit.
+- **FAA Special Use Airspace.** Keyless. `/api/drone-airspace` queries the public FAA AIS FeatureServer for prohibited (P) and restricted (R) zones only — not MOAs, TFRs or other SUA types — with simplified geometry, a body cap, paging, a one-hour cache and stale-on-error. The layer is US coverage, informational only, and is not a substitute for B4UFLY, LAANC or a preflight briefing. Data is fetched at request time and never stored or redistributed. US government public domain; courtesy attribution is registered in the Data attribution popover.
 - **Mapped installations.** OpenFreeMap military polygons use a bundled Overture/OSM name index; wide views show named points. Optional operator-configured Overpass and explicit Google Places searches keep their own source paths. Mapped data does not establish current activity or complete coverage.
 - **Place search.** Named-place fly-to uses Google Geocoding when a Maps key is configured, then Photon (`PHOTON_URL`; unset uses the public instance, empty disables it), then `/api/geocode` (Nominatim search) when neither answers. `/api/geocode` and the voice outline route `/api/geocode/outline` share one Nominatim queue (`NOMINATIM_URL`; unset, empty and invalid values disable it; an operator must explicitly select an authorized endpoint): one request at a time at least 1.1 s apart, an identifying `User-Agent` and `Referer`, a short queue that refuses a burst, a pause after 429/403/5xx answers (honouring `Retry-After` in full), at most one retry after a network failure, and a per-install daily cap on public-instance requests (`NOMINATIM_DAILY_CAP`, default 50). Processes using the same installation state file hold one lock through the actual fetch invocation and recording the next public start, with the daily slot persisted before invocation; restarts share that count, spacing and any pause. An unfinished dispatch marker fails closed until operator recovery; it is never automatically reclaimed. Public access fails closed if the state file cannot be read, locked, written or semantically validated. This coordination does not span independent installations or state directories and does not establish an application-wide public-service allowance or authorize public use. An operator-selected non-public endpoint is outside the public cap, spacing and durable-state requirement; an upstream cooldown is kept with the endpoint that returned it rather than leaking across operator URLs. Answers are cached on disk (outlines 90 days, places 30 days, no-results 24 hours); failures are not cached. Outlines are looked up only for an explicit ask, after bundled data and any configured Overpass, and only results whose type suits the ask are used. Administrative outline responses expose country/admin-1/admin-2 identity only when the selected Nominatim row has a recognized, unambiguous address type consistent with its own name; numeric rank, ambiguous types, missing fields and contradictory names do not manufacture identity. It is not used for systematic or bulk queries.
 - **Street and building outlines.** Voice street highlights, pointed-at buildings and grounds use the OpenFreeMap vector tiles the traffic layer already loads. Traffic and outlines share one bounded pending fetch/decode owner per immutable XYZ tile; materialized outline geometry is charged to the retained-byte ceiling and capped by coordinate count. Consumer result caches and request lifetimes remain independent, while eviction or explicit teardown cancels queued idle projections and releases their decoded owner. No Overpass request is made unless `OVERPASS_UPSTREAMS` is configured. Named grounds require a returned name matching the selected place, except that an ask whose head noun names a kind of grounds (a school, university or college, hospital, cemetery, stadium or zoo) may use the part of the smallest unnamed tile area of that class that holds the resolved place; a differently named area never answers. Other anonymous landcover polygons cannot establish identity, so unsupported grounds stay unavailable rather than borrowing a nearby POI name.
+- **Voice areas and place search.** Voice areas (`resolve_area`) use the same outline sources as voice outlines. Voice place search (`osm_query`, `/api/osm/features`) runs only on an operator-configured Overpass: a fixed list of kinds, a bounded box and result count, one query at a time, answers cached for a day. It never uses Nominatim.
 - **Cockpit regional briefing.** `/api/regional-brief` rounds aircraft coordinates into 0.1° cache cells, caches results for five minutes, and resolves physical regions from bundled public-domain Natural Earth polygons without reverse-geocoding requests. Google News RSS is queried with the resolved locality/region first; GDELT is used only when that RSS query fails or is empty. Google's published Google News terms restrict that source to personal, noncommercial use, so commercial deployments must disable/replace it or obtain separate permission; GDELT permits commercial dataset use with citation. The Data attribution popover identifies the active headline sources; article links retain publisher attribution. Headlines are location-query matches, not verified incidents, risk rankings, or evidence that a location is safe. Empty, partial, stale, and unavailable source states remain distinct. Open-Meteo supplies current conditions independently of the news source. `WX OFF` disables cockpit weather rendering only; the Local Info briefing still fetches its source-backed weather values and displays the required linked Open-Meteo credit.
 - **Dynamic weather presentation.** While cockpit mode is active, `/api/weather-effects` requests current Open-Meteo observations for the aircraft/camera location, rounds coordinates into 0.1° cache cells, caches results for five minutes, and may retain a stale observation for up to 30 minutes during a transient outage. WMO condition code selects the visual family; observed cloud cover, precipitation, visibility, wind speed, and wind direction bound its strength and motion. Missing or expired weather renders no synthetic atmospheric effect, and normal globe view never renders the weather overlay.
 
@@ -219,7 +224,7 @@ The [Bhote Koshi event pack](public/events/bhote-koshi-2026/README.md), under `p
 | **Yale Bright Star Catalogue** (9,096 stars, sky background)                | `sky/`                            | **Public domain**                                                                                         | ✅ (no restrictions)                             | "Yale Bright Star Catalogue (Hoffleit & Warren, via CDS)" (courtesy credit) |
 | **ESO Milky Way panorama** (eso0932a, blurred cube map, sky background)     | `sky/`                            | **CC BY 4.0**                                                                                             | ✅ (attribution; changes stated)                 | "ESO/S. Brunier"                                                            |
 | **CCTV ground heights** (3,445 cameras)                                     | `cctv_ground_heights/`            | Precomputed camera placement heights, aligned to work with Google Photorealistic 3D Tiles (folder README) | —                                                | —                                                                           |
-| **CCTV Camera Database** model-enrichment extract v2.26.0 (17 camera-model records) | `src/layers/cctv/modelSpecs.js` | **CC0-1.0** (public domain dedication) | ✅ (no restrictions) | "Specs: cctv-database.com" (courtesy — not legally required) |
+| **CCTV Camera Database** model-enrichment extract v2.26.0 + v2.29.0 (20 camera-model records) | `src/layers/cctv/modelSpecs.js` | **CC0-1.0** (public domain dedication) | ✅ (no restrictions) | "Specs: cctv-database.com" (courtesy — not legally required) |
 
 ### ⚠️ TeleGeography is bundled but NonCommercial
 
@@ -247,13 +252,16 @@ fixtures retain their provenance in `src/data/fixtures/README.md`.
 
 ### CCTV Camera Database (`src/layers/cctv/modelSpecs.js`)
 
-The CCTV layer's hardware-model specs are a small verbatim extract (v2.26.0) of the
+The CCTV layer's hardware-model specs are a small extract (v2.26.0, plus the Bosch MIC
+records from v2.29.0) of the
 [CCTV Camera Database](https://github.com/ch-bas/cctv-camera-database), an open dataset of
 camera models transcribed from manufacturer datasheets, dedicated to the public domain under
-**CC0-1.0**. Only the records for hardware that the integrated public catalogs name (King
-County, Sarasota County and Sioux Falls) are bundled, compiled into the module. Nothing is
-fetched at runtime. The records describe camera products (optics, resolution, night vision)
-only, never endpoints, stream paths or access data. CC0 requires no attribution; the CCTV HUD
+**CC0-1.0**. Only records for hardware named by the integrated public catalogs (King County,
+Sarasota County and Sioux Falls) or by the City of Amsterdam register proposed in
+[#251](https://github.com/bilawalsidhu/gods-eye-view/pull/251) are bundled, compiled into the
+module. Nothing is fetched at runtime. The MIC records keep their specification fields; their
+titles are shortened to model codes and colour aliases are added. The records describe camera
+products (optics, resolution, night vision) only, never endpoints, stream paths or access data. CC0 requires no attribution; the CCTV HUD
 credits it anyway as `SPECS: CCTV-DATABASE.COM` beside any spec line it renders.
 
 ### Bundled OpenStreetMap data

README.md

@@ -362,9 +362,11 @@ _Why cockpit mode exists: you're riding a real aircraft over real terrain — an
 
 ## 🎙️ Talk to It
 
-The standalone app offers **OpenAI** and **Gemini** in the GEV MIC provider chooser. OpenAI is the initial default; your choice is saved in this browser. To use Gemini, add `GEMINI_API_KEY` in Provider Settings or your local `.env` file, then select Gemini. `GEMINI_LIVE_MODEL` defaults to `gemini-3.8-live`. The permanent key stays on the local server, which issues a constrained, single-use session credential.
+The standalone app offers **OpenAI** and **Gemini** under **AI Provider** in Settings, one choice shared by voice and chat. OpenAI is the initial default; your choice is saved in this browser. To use Gemini, add `GEMINI_API_KEY` in Provider Settings or your local `.env` file, then select Gemini. `GEMINI_LIVE_MODEL` defaults to `gemini-3.8-live`. The permanent key stays on the local server, which issues a constrained, single-use session credential.
 
-Changing provider ends the current conversation. If voice is on, the new provider starts with the same open-mic or push-to-talk mode; a held Space key is not carried over. Gemini uses the same map actions and captions, but has no OpenAI cost meter or MINI tier. When Gemini reports that its session has expired, start voice again for a new conversation. The provider chooser does not change the OpenAI-backed AI HUD summary.
+Changing provider ends the current conversation. If voice is on, the new provider starts with the same open-mic or push-to-talk mode; a held Space key is not carried over. Gemini uses the same map actions and captions, but has no OpenAI cost meter or MINI tier. When Gemini reports that its session has expired, start voice again for a new conversation. The AI Provider setting does not change the OpenAI-backed AI HUD summary.
+
+Next to the mic, **CHAT** opens a typed chat with silent replies. It uses the selected provider and the same map actions, and never asks for the microphone. OpenAI chat needs an API key (`OPENAI_CHAT_MODEL`), so it is off while `GEV_PREFER_CODEX_OAUTH` pins OpenAI to ChatGPT OAuth; Gemini chat uses a separate text model (`GEMINI_CHAT_MODEL`). Chat and voice panels share the left panels' glass surface and sit above the dock or dock to the right.
 
 > Voice can use an **OpenAI API key** or, on the same machine, an opt-in signed-in **ChatGPT/Codex OAuth** session. The API-key path remains the default. Selecting ChatGPT OAuth in Provider Settings reuses an existing local sign-in or starts the Codex browser sign-in flow and selects OAuth when it completes. The OpenAI key still drives the **AI HUD summary**: a terse, five-word intelligence-style readout of the current view that regenerates as you move.
 
@@ -424,7 +426,7 @@ _Ask for radio near anywhere and the globe starts broadcasting — every station
 
 ## 🛰️ What's on the Globe
 
-Twenty layers and map sources. **Eighteen have a keyless path.** Some offer additional capabilities with a provider key. (🟢 no key · 🟡 free key · 🔴 metered.)
+Twenty-one layers and map sources. **Nineteen have a keyless path.** Some offer additional capabilities with a provider key. (🟢 no key · 🟡 free key · 🔴 metered.)
 
 | Layer                       | What you get                                                                                                                                                                                                                                                                                                                                                                        | Source                                  | Auth                                                                                                |
 | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | --------------------------------------------------------------------------------------------------- |
@@ -438,23 +440,25 @@ Twenty layers and map sources. **Eighteen have a keyless path.** Some offer addi
 | 🌍 **Earthquakes**          | Global seismic activity, last 24h                                                                                                                                                                                                                                                                                                                                                   | USGS                                    | 🟢                                                                                                  |
 | ◍ **Air quality**           | Live AQHI on the published 1–10+ health-risk scale, with a Weather-panel card showing the band legend and the highest readings in view. **Canada only** — ECCC is the first registered provider | ECCC MSC GeoMet                          | 🟢                                                                                                  |
 | 🚗 **Traffic**              | Simulated vehicles on OSM roads. With TomTom, live flow speeds drive the simulation and congestion colors below ~8 km; individual vehicle positions are not live observations                                                                                                                                                                                                       | TomTom + OSM                            | 🟢 simulation · 🟡 live flow speeds                                                                 |
-| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC) · Italy (A22 Brennero motorway), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed) and opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
+| 📹 **CCTV Mesh**            | ~4,000 public cameras (shared cap) projected _into_ the 3D space — Austin · Texas (TxDOT) · California (Caltrans) · London (TfL) · Ontario (511, free developer key) · Finland (Fintraffic) · British Columbia (DriveBC) · Estonia (Tallinn, Tarktee) · Delaware (DelDOT live video) · New South Wales (Live Traffic NSW) · Calgary · Norway (Statens vegvesen) · Toronto · King County (WA) · Washington (WSDOT) · Catalonia (Servei Català de Trànsit) · Hong Kong (Transport Department) · Taiwan (Freeway Bureau, MOTC) · Italy (A22 Brennero motorway), plus opt-in New York City (NYC DOT TMC, needs your own NYC DOT agreement), opt-in Lithuania (Via Lietuva / Eismoinfo, photo licence unconfirmed), opt-in Florida (FL511, individual personal use only; other use needs FDOT's written consent) and opt-in Houston (TranStar, enable only with TxDOT's written permission per TranStar's Content Usage terms). Positions are published; poses are estimated priors **you calibrate by dragging a gizmo on the camera itself** | City APIs                               | 🟢                                                                                                  |
 | 📷 **Mapped ALPR Cameras**  | License-plate-reader camera locations tagged by OpenStreetMap contributors, loaded one city-sized view at a time, with **SHOW NEAREST**. Locations and tags only: no plate data, no video                                                                                                                                                                                           | OpenStreetMap (incl. DeFlock mapping)   | 🟢                                                                                                  |
 | 📷 **Street Level**         | Street-level photos behind one panel, one chip per provider: coverage on the streets, image cones, an embedded viewer with full-screen **EXPAND**. Mapillary, Google Street View, KartaView and Panoramax | Mapillary · Google · KartaView · Panoramax | 🟢 KartaView, Panoramax · 🟡 Mapillary token · 🔴 Google Maps key |
 | 📻 **Radio**                | Geolocated world radio with an **analog tuner** — drag the needle across up to 750 stations and the globe flies to each broadcaster                                                                                                                                                                                                                                                 | Radio Browser / broadcasters            | 🟢                                                                                                  |
 | 🚌 **Transit**              | Live buses, trams, metros, trains and ferries with delayed playback between reports, selected-vehicle trails, and mode-coloured DETECT labels — Boston, Austin, Minneapolis, Helsinki, the Netherlands, Norway, South East Queensland, and nine in Ontario: Toronto (surface vehicles; the subway publishes no positions), Mississauga, Hamilton, Durham Region, York Region, Guelph, Burlington, Barrie and Kingston                                                                                                                                               | Operator GTFS-Realtime feeds            | 🟢                                                                                                  |
 | 🚲 **Bikeshare**            | Live station availability                                                                                                                                                                                                                                                                                                                                                           | GBFS                                    | 🟢                                                                                                  |
 | 🧭 **Directions**           | Click A and B on the globe for a street-following drive, walk or cycle route draped on the terrain with turn-by-turn steps — then FLY the camera along it. No key, no geocoder, no mic                                                                                                                                                                                              | OSRM on FOSSGIS servers (OpenStreetMap) | 🟢                                                                                                  |
+| ⌖ **OSM Places**           | Voice place search ("hospitals in Kathmandu") from OpenStreetMap, drawn as numbered points that follow-up questions can filter. Needs your own Overpass server (`OVERPASS_UPSTREAMS`); off otherwise                                                                                                                                                                                                                                                                                                                               |
 | 🔥 **Active Fires**         | Live NASA FIRMS detections, trailing 24h                                                                                                                                                                                                                                                                                                                                            | NASA FIRMS                              | 🟡                                                                                                  |
 | 🚀 **Space Missions**       | Rolling 30-day launches with payload, stage, and recovery detail                                                                                                                                                                                                                                                                                                                    | Launch Library 2                        | 🟢 (🔴 optional paid token raises the allowance)                                                         |
 | 🎖️ **Mapped Installations** | Viewport-bounded military-site context from community mapping — incomplete by nature, and labeled that way                                                                                                                                                                                                                                                                          | OpenStreetMap                           | 🟢                                                                                                  |
+| 🚫 **Prohibited & Restricted Airspace** | FAA prohibited (P) and restricted (R) special-use airspace as ground polygons, with name, altitude range and times of use on select. Not the UAS Facility Map or UAS flight restrictions; informational only, not for flight planning | FAA SUA                                 | 🟢                                                                                                  |
 | 🌬️ **Wind**                 | Animated 10 m forecast wind with an optional speed, temperature or pressure color field and a reading at map center                                                                                                                                                                                                                                                                 | NOAA GFS / ECMWF IFS                    | 🟢                                                                                                  |
 | 🌦️ **Observed Weather**     | Rain radar (contiguous US), Satellite clouds (GOES regional or global infrared, Clouds only or Full image) and Lightning density (Americas and Pacific) on one history timeline                                                                                                                                                                                                     | NOAA nowCOAST                           | 🟢                                                                                                  |
 | 🌀 **Cyclones**             | Advisory positions, forecast tracks and uncertainty cones for the Atlantic and eastern/central North Pacific                                                                                                                                                                                                                                                                        | NOAA NHC / CPHC                         | 🟢                                                                                                  |
 
 **Weather, keyless.** **Wind** animates 10 m forecast flow from NOAA GFS or ECMWF IFS, with an optional color field and a reading at map center. **Rain radar**, **Satellite clouds** and **Lightning density** are observations on one history timeline in the **WEATHER** panel (step back, **Play**, **Latest**); **Cyclone advisories** draw NHC and CPHC positions, forecast tracks and cones. On Google 3D Tiles the observed layers float above the city as translucent shells, sharpened around your view.
 
-In the app, **Data Layers** groups them as Movement, Cameras, Infrastructure, Events, Weather and Audio; Directions sits in the separate **Utilities** panel with Draw and Import.
+In the app, **Data Layers** groups them as Movement, Cameras, Infrastructure, Events, Weather and Audio; Directions and OSM Places sit in the separate **Utilities** panel with Draw and Import.
 
 **The basemap ladder — what each tier buys you:**
 

SECURITY.md

@@ -74,17 +74,19 @@ The data proxies under `server/providers/` are written so the browser cannot tur
 - **No verbatim client headers upstream.** The CCTV media route is the one route that relays a request header (`Range`, for video seeking). It is parsed and canonicalized before it is forwarded: one `bytes=` range only, with every accepted form — explicit span, open-ended and suffix — bounded to the same 64 MiB ceiling the relay applies to a declared response body. Multi-range, malformed, inverted and non-`bytes` values are dropped and the request proceeds without a `Range`, as RFC 7233 §3.1 prescribes. Bounding the request bounds what is asked for: a response that declares no length — live streamed media, or a chunked body from an upstream that ignores the `Range` — has no ceiling. An upstream request the browser has stopped waiting for is cancelled rather than left running, whether the viewer leaves before the headers arrive or during the body.
 - **Transit fetches registered feeds only.** `/api/transit/vehicles/<id>` resolves the id against `src/data/transitFeeds.js`; the browser never supplies a URL, and a feed that is registered but disabled does not resolve at all. Redirects are followed manually and each hop is validated against the feed's own https origin before it is requested, so an off-origin or downgraded hop is refused rather than contacted. Bodies are capped at 8 MB, the protobuf is decoded server-side under entity-count and string-length ceilings, a differential feed is refused, and snapshots live 15 s in memory with no disk cache. A per-feed admission limiter and a failure cooldown ladder bound what this process can ask of any operator.
 - **Local receiver feeds are operator-configured and local-only.** `/api/local-receivers/aircraft` reads only the `aircraft.json` URLs in the server's `LOCAL_RECEIVER_FEEDS`; the browser never supplies an address. Each host must pass the shared tap address rule (`src/data/tapAddress.js`: loopback, RFC1918, `localhost`, `*.local`; no link-local, IPv6 or other names), the scheme must be http(s), the path must end in `aircraft.json`, and credentials, queries and fragments are refused. Invalid entries are logged at startup and never fetched. Reads use a 2 s timeout, refuse redirects, cap bodies at 2 MB and share one read per second; responses name each feed by band only and never carry upstream error text.
+- **Voice place search runs only on the operator's Overpass.** `/api/osm/features` answers only when `OVERPASS_UPSTREAMS` is set and never falls back to a public instance. The client sends a curated preset id, a box, a mode and a limit; the server writes and quotes the Overpass query itself, so no client or model text reaches it. Boxes are capped (36 deg² for a count, 4 deg² for a listing), as are the feature limit, the Overpass timeout and memory, and the response bytes read. Each client (IPv6 clients keyed by /64, as on `/api/overpass`) runs one search at a time and two run at once in all, under a per-client rate limit (12/min) and a global one (30/min); a search gets 22 s across every configured endpoint in turn (Overpass itself is told 20 s), which ends before the voice answer stops waiting at 25 s. The route sits behind the cross-site gate below. Answers are cached in memory and on disk (`.gev-cache/osm-features/`, at most 400 entries and 256 MB, kept a day), keyed to the configured instance so a repointed `OVERPASS_UPSTREAMS` never serves the old one's answers; a malformed answer is never cached.
 - **Validated response formats.** Proxied bodies are relayed only in the format the route serves. CCTV frames and the Street View fallback accept JPEG, PNG, GIF, WebP and AVIF only, sent under their canonical type; any other type falls through to the next fallback. Live CCTV media must match its feed kind (`video/mp4`, `video/webm`, or `multipart/x-mixed-replace` with a boundary) before it is relayed or the camera counts as healthy, and its redirects stay on the registered origin. GBFS bodies must parse as JSON and are re-serialized as `application/json; charset=utf-8`. Camera catalog URLs are pinned by parsed URL — scheme, exact host, no credentials, default port, and a normalized path inside the agency's image directory — and a redirect on a pinned host must stay inside the same directory. Every `/api/cctv` route uses the keyless cross-site checks described below, so cameras stay reachable behind a reverse proxy; a request carrying forwarding headers never reaches the key-bearing Street View fallback and gets the placeholder frame instead, as when no key is configured.
 - **Consistent API response headers.** Every `/api` response, including errors, partial content, Host refusals and unknown routes, carries `Content-Security-Policy: default-src 'none'; sandbox` and `X-Content-Type-Options: nosniff` (`apiResponseHeadersPlugin` in `build/vite.js`, installed ahead of the Host check). A route that sets its own policy adds it as a further policy; it never replaces this one.
 - **Response-size caps and timeouts** on proxied responses.
 - **Sanitized errors** — internal error details are not echoed back to clients.
 - **Coalesced OAuth refresh** and cached successful responses only (OpenSky).
 - **Redacted debug logging.** The voice debug log (`.gev-logs/`, gitignored) strips API keys, bearer tokens, client secrets, and image data URLs before writing.
-- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights` and `/api/overpass`) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map needs both to render behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
+- **Cross-site gate on cost/log endpoints.** The cost-bearing (`/api/realtime/token`, `/api/openai/hud-summary`, `/api/google/nearby-places`, `/api/google/text-search`), quota-bearing (`/api/mapillary/*`, with a per-IP limit on tiles, and `/api/tomtom/*`, backed by its persistent daily tile budget) and log (`/api/realtime/debug-log`) endpoints refuse cross-site browser requests: a foreign or opaque `Origin`, a `Sec-Fetch-Site` other than `same-origin`/`none` (this is what blocks an `<img>`/navigation that carries no `Origin`), or any reverse-proxy/CDN forwarding header returns `403`. Non-browser loopback tools (the repo QA harnesses POST the token endpoint with no `Origin`) and the explicit `HOST=0.0.0.0` LAN opt-in keep working — the gate deliberately does not require a loopback remote address; that stricter requirement belongs only to the credential panel (`admitKeySetupRequest`). The Host check (`allowedHosts`, applied by `hostCheckPlugin` ahead of every route, since Vite's own check runs only after plugin middleware) rejects a rebinding `Host` before any handler runs, in every mode, and the gate is defense in depth behind it: the LAN opt-in keeps that check and accepts only IP addresses, `localhost` and names listed in `GEV_ALLOWED_HOSTS`. **Limit:** a name you list there is trusted like the app's own address, so list only names you control. The keyless map routes (`/api/terrain/heights`, `/api/drone-airspace`, `/api/overpass` and voice place search's `/api/osm/features`, which spends the same operator Overpass) use the same cross-site checks, minus the forwarding-header refusal: they guard only per-client quotas and caches, not a key or a bill, and the map and voice need them to work behind a reverse proxy. `/api/overpass` also admits at most 300 POSTs a minute per peer (IPv6 peers keyed by /64) and 900 a minute across all remote peers before it reads a body. A direct loopback request — a loopback socket with none of the forwarding headers `hasProxySignals` checks (`Forwarded`, `Via`, `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Port`, `X-Forwarded-Proto`, `X-Real-IP`, `CF-Connecting-IP`, `CF-Ray`) — draws on its own per-peer admission window, so remote peers cannot exhaust the owner's admission. A reverse proxy on the same machine must add at least one of those headers (Caddy and Cloudflare do by default; nginx needs `proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`, plus `proxy_set_header Host $http_host;` and `proxy_set_header X-Forwarded-Proto $scheme;` so the `Origin` check matches), or its traffic is indistinguishable from the owner's and shares the owner's window. With one, its requests are then counted as remote, in one bucket per proxy socket — the forwarded client address is never trusted as identity — so all users behind one proxy share 300/min. The isolation needs a loopback socket: under the default Docker bridge network every host-side client, the owner included, arrives from the container gateway and is one remote peer. **Limit:** this isolates admission only. The upstream budget (90 requests/min per client key, 300/min across all clients) is shared, so once remote traffic has used the global upstream budget, an owner request that misses the cache can still get `429`, or `503` when remote misses hold every upstream concurrency slot; cache hits are unaffected. The CCTV routes (`/api/cctv/*`) use the same keyless checks; their one key-bearing step, the Street View fallback, is skipped for any request with forwarding headers.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads and the Maps JavaScript API that Street View runs on, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
 
 Allowing `maps.googleapis.com` in `script-src` also trusts its JSONP endpoints, which can bypass the script allowlist if an HTML-injection bug exists; this is an accepted limitation of loading the Maps JavaScript API, alongside the existing `'unsafe-eval'` allowance.
 - **Full Content-Security-Policy.** The dev and preview servers send a real CSP (`script-src 'self' 'unsafe-eval' blob:` plus the YouTube, Facebook and X scripts the Nepal event's embedded media loads, with a matching `frame-src` for their players and posts: no inline script and no other script origin; `blob:` covers the object URLs Cesium's bundled workers bootstrap through in the built app), alongside the existing `X-Frame-Options: DENY` and `frame-ancestors 'none'`. `'unsafe-eval'` stays because Knockout, bundled inside Cesium's widgets package, resolves the global object with `eval` at load time and the globe does not initialize without it; styles permit `'unsafe-inline'` and Google Fonts because Vite's dev client injects `<style>` elements.
+- **Typed chat spends the provider keys.** `/api/openai/chat` and `/api/gemini/chat` send the conversation to OpenAI Chat Completions or Gemini `generateContent` with the server's `OPENAI_API_KEY` or `GEMINI_API_KEY`. They require a same-site `Origin` (the Gemini request check), cap request bodies at 512 KB, refuse upstream redirects, cut the upstream call off after 60 s and return only sanitized errors. OpenAI chat can only bill `OPENAI_API_KEY`, so while `GEV_PREFER_CODEX_OAUTH` pins OpenAI to ChatGPT OAuth it refuses with `503` (`CODEX_OAUTH_REQUIRED`) rather than spend the key. After the provider refuses the key or account (a `401`, a `403`, Gemini's `400` `API_KEY_INVALID` or OpenAI's `429` `insufficient_quota`), a route stops sending that key upstream for a minute, or until the key changes.
 - **ChatGPT OAuth voice reuses the local Codex sign-in.** `/api/realtime/oauth-status`, `/api/realtime/oauth-login` and `/api/realtime/token?auth=oauth` answer only loopback connections, behind the same cross-site gate as the token endpoint; the login route also refuses a foreign `Origin`. None of them returns the access token. The login route runs `codex login` (or the executable named by `CODEX_BIN`) with an allowlisted environment that leaves out GEV's provider keys, keeps one attempt pending at a time and cancels it after two minutes or when the server stops. **Limits:** any program on this machine that can reach the server can mint Realtime sessions on the signed-in ChatGPT account, as it can with the API key; a local reverse proxy that hides the client's address defeats the loopback check; and OpenAI has not documented this use of Codex credentials for Realtime, so it may stop working or fall outside the account's terms.
 
 ## Network exposure — the operator threat model
@@ -93,7 +95,7 @@ The dev server is a **key broker**: every server-side key above is spendable by
 
 - **Local-only by default.** `./scripts/dev-fresh.sh` (and the Vite config itself) bind to `localhost`, so only your machine can reach the server — and only local names are accepted (`allowedHosts` stays restricted, which also blunts DNS-rebinding tricks). Binding to all interfaces keeps that restriction: IP addresses and `localhost` work, and LAN hostnames must be listed in `GEV_ALLOWED_HOSTS` (for example `GEV_ALLOWED_HOSTS=globe.lan`); suffix and wildcard entries are ignored.
 - **LAN exposure is an explicit opt-in**: `HOST=0.0.0.0 ./scripts/dev-fresh.sh`. The launcher prints a prominent warning plus your LAN URL. Understand what opting in means: **every device on that network can drive the proxies and spend your OpenAI / Google / OpenSky / AISStream / TomTom / FIRMS quota** for as long as the server runs. Do this only on networks you trust.
-- **App-level throttles (on by default):** `GEV_RATELIMIT_OPENAI_PER_MIN` (default `30`) and `GEV_RATELIMIT_GOOGLE_PER_MIN` (default `120`) — the values the Pinokio build already ships — cap the cost-bearing endpoints per client IP per minute (over-limit requests receive a sanitized `429`). Both defaults sit well above what the app itself generates; set either to exactly `0` to run unthrottled. They are **per-IP, process-local, in-memory guards** — they reset on restart, a caller with several addresses gets a bucket per address, and they are **not billing caps**.
+- **App-level throttles (on by default):** `GEV_RATELIMIT_OPENAI_PER_MIN` (default `30`) and `GEV_RATELIMIT_GOOGLE_PER_MIN` (default `120`) — the values the Pinokio build already ships — cap the cost-bearing endpoints per client IP per minute (over-limit requests receive a sanitized `429`). Typed chat keeps its own per-IP window, set by `GEV_RATELIMIT_OPENAI_CHAT_PER_MIN` and `GEV_RATELIMIT_GEMINI_CHAT_PER_MIN`; left unset, each takes its provider's resolved cap (`GEV_RATELIMIT_OPENAI_PER_MIN`, or `GEV_RATELIMIT_GEMINI_PER_MIN`, default `30`), so lowering a provider throttle lowers chat too, while an explicit chat value, including `0`, wins. Both defaults sit well above what the app itself generates; set either to exactly `0` to run unthrottled. They are **per-IP, process-local, in-memory guards** — they reset on restart, a caller with several addresses gets a bucket per address, and they are **not billing caps**.
 - **Docker trusts one address, and only because the port is on loopback.**
   Docker delivers the host's own browser to the container from the container
   network's gateway, never from `127.0.0.1`, so a loopback-only Provider

changelog.d/1086-prohibited-restricted-airspace.md

@@ -0,0 +1,8 @@
+- Add a Prohibited & Restricted Airspace layer for FAA prohibited (P) and
+  restricted (R) special-use airspace. The keyless `/api/drone-airspace` proxy
+  pages the public SUA FeatureServer, keeps a one-hour snapshot, and serves
+  stale data when a refresh fails. Zones draw as ground polygons (red
+  prohibited, orange restricted); selection shows name, altitude range, times
+  of use and agency, and the row legend states the layer is informational only
+  and does not include the UAS Facility Map or UAS flight restrictions. Off by
+  default; share-link token `8` (mvanhorn, #1086).

changelog.d/1125-houston-cctv-pack.md

@@ -0,0 +1,18 @@
+- Add Houston traffic cameras from Houston TranStar as a CCTV pack. The camera
+  list is one keyless JSON request to
+  `traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js`; frames are
+  stills synthesized from each numeric camera id on `www.houstontranstar.org`,
+  so a catalog field cannot steer the proxy off-host. Cameras without a
+  snapshot id, and cameras outside Greater Houston, are dropped. TranStar's
+  `dir` field (the side of the freeway the camera sits on) seeds a
+  low-confidence heading along the nearest lanes' travel direction. TranStar's
+  Content Usage terms (traffic.houstontranstar.org/disclaimer.aspx) prohibit
+  copying, distribution and external framing of its images without TxDOT's
+  written permission, so the pack is off by default; operators should set
+  `CCTV_HOUSTON_ENABLED=1` only if they hold that permission. Frames are
+  relayed on demand with `no-store` and not archived. Once enabled, it loads
+  the 250 cameras nearest downtown, Uptown, the Medical Center, IAH and
+  Galveston; `CCTV_HOUSTON_MAX_SOURCES` changes that cap.
+  Snapshots update about every 3 minutes. The catalog-wide ceiling is
+  unchanged; extra cameras share it round-robin with the other packs
+  (mvanhorn, #1125).

changelog.d/1319-cctv-bosch-mic-specs.md

@@ -0,0 +1,3 @@
+- Vendor the Bosch MIC PTZ datasheet records that the City of Amsterdam camera
+  register names (MIC-7522, MIC-7502, MIC-7130), with the register's `x` colour
+  wildcard as an alias, from the CCTV Camera Database v2.29.0 (ch-bas, #1319).

changelog.d/1426-fire-intensity-filter.md

@@ -0,0 +1,12 @@
+- Color every Active Fires detection by fire radiative power on a six-stop
+  ember → white-hot ramp (ember · red · flame · orange · gold · white-hot at
+  0 · 5 · 20 · 50 · 100 · 300 MW, brighter as power rises), and add a
+  log-scale minimum-FRP slider whose track is the ramp, an All / Nominal+ /
+  High confidence switch and an "N of M shown" counter to the layer row. Far
+  zoom shows a Snap Map–style heatmap in the same colors instead of squares,
+  one distinct spot per fire, empty where nothing burns, and cross-fades with
+  the markers around 4,500 km with no gap, keeping weak fires as markers. The filter applies once before
+  rendering, so markers, cards, the heatmap, context and the top-fires query
+  agree; share links keep it (`w` token: `f`, `c`), and `get_active_fires`
+  takes matching `min_frp_mw` and `confidence` arguments. Default 0 MW / All
+  (gekh, #1426).

changelog.d/1464-infrastructure-ground-sample-in-view.md

@@ -0,0 +1,4 @@
+- Ground-sample Data Centers and Dams markers only when the camera sees the
+  ground under them. Unseen ground read through the Earth and retried every
+  2 s; over Ashburn, Virginia on the Esri map, slow frames reached 2 s
+  (quanticsoul4772, #1464).

changelog.d/1495-traffic-paired-sides.md

@@ -0,0 +1,4 @@
+- Street Traffic gives the two TomTom `one_side` lines of one two-way street
+  a two-way direction's half share of simulated vehicles each, so the street
+  is no longer drawn twice as dense as the same street from OpenStreetMap
+  (quanticsoul4772, #1495).

changelog.d/1507-typed-ai-chat.md

@@ -0,0 +1,9 @@
+- Add a typed AI chat beside the voice mic in the command dock. Replies are
+  silent and never use the microphone; messages run the same map actions as
+  voice through OpenAI Chat Completions (`OPENAI_CHAT_MODEL`) or Gemini
+  `generateContent` (`GEMINI_CHAT_MODEL`). Chat is throttled per IP by
+  `GEV_RATELIMIT_OPENAI_CHAT_PER_MIN` or `GEV_RATELIMIT_GEMINI_CHAT_PER_MIN`,
+  which default to that provider's voice throttle, and `GEV_PREFER_CODEX_OAUTH`
+  turns OpenAI chat off. The chat and voice panels minimize to a bar or dock
+  beside the right rail, and step aside for the Location and Visual Presets
+  trays (Manjunath, @manjunath22466, with Darren Dignam, @darrendignam, #1507).

changelog.d/1518-range-ring-visibility.md

@@ -0,0 +1,4 @@
+- Draw the Global Context 250 km range ring as a 4 px line with a dark halo,
+  so it stays visible over desert, snow, ocean and forest and under the FLIR,
+  NVG and CRT styles, where the old 1 px outline disappeared (manjunath22466,
+  #1518).

changelog.d/1519-range-ring-sonar-pulses.md

@@ -0,0 +1,8 @@
+- The Global Context range ring pulses like a sonar: three dim rings with a
+  soft inward glow grow from the subject to 250 km, and the ring flashes as
+  each one arrives. Flights, military aircraft and AIS vessels a pulse crosses
+  get a brief echo around their brackets. The pulses run for about 9 s after
+  a selection or camera move, dimming the ring between flashes, then rest
+  with the ring steady on screen, so a parked view stops repainting. Under
+  reduced motion there are no pulses and the ring stays on screen
+  (manjunath22466, #1519).

changelog.d/1522-zoom-out-runaway.md

@@ -0,0 +1,5 @@
+- Keep the globe on screen when zooming out from a tilted view. User zoom is
+  capped at 40,000 km, and above 300 km outward zoom pitches the view down so
+  Earth stays framed. Correction finishes when zoom stops, respects tilt
+  gestures and stricter host limits, and yields to other camera actions
+  (asturksever, #1522).

changelog.d/1523-minimal-hud-bottom-banner.md

@@ -1,3 +0,0 @@
-- The Minimal HUD layout no longer draws the centred MGRS / LAT / LON banner
-  across the globe; the bottom-left readout still shows the same position, and
-  now sits clear of the map attribution row instead of overlapping it (Said Turksever, #1523).

changelog.d/1535-fires-empty-heat-reenable.md

@@ -0,0 +1,2 @@
+- Keep retained Active Fires heat imagery hidden when an empty filtered layer is
+  re-enabled while a new snapshot is pending (radianx, #1535).

changelog.d/1545-typed-chat-translations.md

@@ -0,0 +1,5 @@
+- Finish the typed AI chat translations. The "Reset to globe view" and "Show
+  earthquakes" quick commands are now translated, Traditional Chinese follows
+  Simplified Chinese again, Arabic docks the panel to the side it actually
+  lands on, and the new strings use each language's glossary terms
+  (German, @gekh, #1545).

changelog.d/1561-chat-autocomplete-arabic-marks.md

@@ -0,0 +1,3 @@
+- Chat autocomplete finds Arabic suggestions typed without short vowels or
+  shadda, so «تتبع» now suggests «اعرض تتبّع الرحلات المباشر»
+  (German, @gekh, #1561).

changelog.d/1576-transit-bikeshare-coverage-prompt.md

@@ -0,0 +1,6 @@
+- Say why Transit and Bike Share are empty outside coverage. Over a city with
+  no feed or system (London, Tokyo) their Layers rows read
+  `No feed here yet · 16 regions available` and
+  `No bike share here yet · 61 systems available`, or how low to fly, instead
+  of `never`; leaving coverage clears the last-update time (German, @gekh,
+  #1576).

changelog.d/846-voice-geometry.md

@@ -0,0 +1,15 @@
+- Voice can reuse what it outlines. `resolve_area` turns a named place into a
+  reusable area, keeping every part and hole, from the same sources as voice
+  outlines; a name several countries or states share ("Georgia", "Punjab") is
+  asked about unless the view is inside one of them. "Draw an area around
+  <landmark>" outlines the mapped area enclosing it, or a 250 m buffer marked
+  approximate. `analyst_query` counts inside an area, the area you drew or an
+  outline on the map, and `find_imagery` shows the best recent acquisition for
+  an area, the view or the spot under the pointer (manjunath22466, #846).
+- `osm_query` ("hospitals in Kathmandu") lists places of one kind into a
+  session-only OSM Places layer. It is offered only when `OVERPASS_UPSTREAMS`
+  is set, and `/api/osm/features` refuses before fetching otherwise; public
+  Nominatim is never used for it (manjunath22466, #846).
+- Analyst counts that combine flights, military aircraft and local ADS-B are
+  named "aircraft". Follow-ups keep the displayed scope and the loaded-data
+  caveat until a new scope replaces them (manjunath22466, #846).

docs/CURRENT-STATE.md

@@ -44,6 +44,27 @@ pinching traverses globe and street scales with fewer gestures. Cesium retains
 its distance-aware zoom, collision handling and minimum/maximum distance limits.
 Fine-pointer desktop mouse and trackpad sensitivity is unchanged.
 
+User zoom is capped at 40,000 km (or a stricter host limit). Explicit camera
+flight, share-link and story destinations can go farther; from there, user zoom
+can't climb any higher and zooms in gradually from the current height, with no
+jump to the cap. Cesium can still use the limit when it computes an automatic
+bounding-sphere framing distance.
+Above 300 km, outward movement from the controller's configured zoom bindings
+(wheel, pinch distance and unmodified right-drag by default) pitches the camera
+down towards 8° below the Earth's limb. Large steps reach the limb immediately;
+the remaining margin eases into place, including after zooming stops or reaches
+the ceiling. Continuous outward inertia remains guarded without a time cutoff.
+Two-finger tilts, modifier-specific tilts and other camera gestures cancel the
+correction. A two-finger gesture counts as a pinch zoom only while the finger
+spacing changes more than the fingers move up or down, so spacing drift during
+a tilt is ignored. Explicit navigation handoffs, including toolbar tilt,
+cancel it before animation begins. Zooming in, disabled zoom/input, non-3D modes, tracked
+transforms and flights also cancel it; external pose changes cancel stationary
+settling. Oblique views below 300 km are left alone.
+
+`QA_BASE_URL=http://localhost:4173 node scripts/qa-zoom-out-guard.mjs` exercises
+the real browser controller at desktop and phone widths with keyless fixtures.
+
 Analyst region queries resolve unique Natural Earth names offline without
 geocoding, so Gold Coast and Ivory Coast name the West African natural regions.
 Duplicate names require a geocoded containment anchor; when several entries for
@@ -77,6 +98,27 @@ across the antimeridian, so they cannot use the strict ±180 check as-is, and
 `src/sources/adsbRecords.js` and `server/providers/common/geo.js` keep their own
 implementations.
 
+## Prohibited & Restricted Airspace — FAA special-use airspace
+
+The Infrastructure group includes **Prohibited & Restricted Airspace** (`drone-airspace`,
+share-link token `8`), off by default. `/api/drone-airspace` pages the public
+FAA Special Use Airspace FeatureServer for `TYPE_CODE` P (prohibited) and R
+(restricted), simplifies geometry, caches for an hour, and serves the last
+good snapshot as stale when a refresh fails. The globe draws ground-clamped
+outlines with a translucent fill: red for prohibited, orange for restricted.
+Selecting a zone shows name, an altitude range built from the
+`LOWER_*`/`UPPER_*` value, unit and reference fields (for example `SFC to
+5,000 ft MSL` or `20,000 ft MSL to Unlimited`), times of use and controlling
+agency,
+plus a notice that the layer is informational only and not a substitute for
+official UAS flight-planning tools. Pick ownership is unregistered so sibling
+layer cards still work over a zone. Voice is off for this layer for now
+(`VOICE_OFF_LAYERS`: the Realtime prompt has no room), so neither voice nor the
+analyst can toggle or query it. The layer covers FAA prohibited and restricted
+special-use airspace only, not the UAS Facility Map / LAANC grids, National
+Security UAS Flight Restrictions or TFRs; the label and legend say so.
+See the live-layers table below.
+
 Vessel sources can report healthy empty coverage using a current, complete
 snapshot with zero raw rows, a healthy transport and a positive last-message
 time. This clears obsolete contacts and settles startup without manufacturing
@@ -263,14 +305,6 @@ that names Operator restores the default Tactical layout. Operator was the
 only layout that showed the HUD's top banner bar, so its markup and styles are
 removed too.
 
-Minimal no longer shows the centred MGRS / LAT / LON bar near the bottom of the
-globe (November 3, 2026, #1523): the bottom-left readout already carries the
-same position, and the bar sat across the globe. That readout now sits 7.25rem
-(plus 2vh) up, clear of the Cesium / Esri attribution row it used to overlap,
-with Scope on or off. `scripts/qa-scope-hud.mjs` checks the hidden banner and
-clearance above the rendered attribution row at desktop and intermediate
-widths in both Scope modes, plus the existing compact phone treatment.
-
 ## Cyber HUD — September 30, 2026
 
 Display > HUD > Layout includes Cyber, also available through the HUD voice
@@ -693,6 +727,52 @@ announces the reason.
 
 Automatic Voice Preview uses output from the active mounted provider, including late replies that may answer an older request. Manual panel choices remain until genuine local input rearms automatic presentation. Preview stays off when disabled, remains hidden in Cockpit, and retires on Stop or provider replacement. Display events do not grant command authority.
 
+Typed chat sits beside voice in the dock. Chat replies are silent and never
+request microphone access. The first message connects with the selected
+provider and runs the same map actions as voice through each provider's text
+API: OpenAI uses `OPENAI_CHAT_MODEL` (default `gpt-4.1-mini`) and needs an API
+key; Gemini sends a text-only `generateContent` request with
+`GEMINI_CHAT_MODEL` (default `gemini-3.5-flash-lite`) and never starts Live.
+Only one mode runs at a time: the microphone closes chat, and opening chat
+stops voice. Enter sends, Shift+Enter adds a line, and Up or Down at the start
+of the field recall recent messages and restore the draft. Attachments are up
+to four map-layer references or UTF-8 TXT, Markdown, CSV, JSON and GeoJSON
+files, 10 KB in total, sent only with the message; a layer reference names
+the layer without exporting its records. The conversation and recent commands
+stay in memory for the page.
+
+The chat routes answer a missing key with `503` and code `API_KEY_MISSING`.
+OpenAI chat can only bill `OPENAI_API_KEY`, so while `GEV_PREFER_CODEX_OAUTH`
+pins OpenAI to ChatGPT OAuth it answers `503` with code `CODEX_OAUTH_REQUIRED`
+instead; Gemini chat is unaffected. An upstream `429` or `503` keeps its status
+and passes on a `Retry-After` given in seconds, capped at an hour; the chat
+names the wait, and a throttled reply carries code `RATE_LIMITED`. A refused
+key or account stops reaching the provider for a minute, unless the configured
+key changes: `API_KEY_REJECTED` for a `401` or Gemini's `400` with reason
+`API_KEY_INVALID`, `ACCESS_DENIED` for a `403`, and `QUOTA_EXCEEDED` for
+OpenAI's `429` `insufficient_quota`. Each refusal answers `502` with its code,
+and the chat shows a matching message.
+
+Chat and the voice panel sit above the dock or dock into the right rail's lane,
+which hides the rail until the panel minimizes or closes, or a rail panel opens.
+Minimized panels always sit as a bar centred above the dock; restoring returns a
+docked panel to the lane. A centred panel steps down to its bar when the pointer
+reaches the Location or Visual Presets button and rests above an open tray,
+without moving keyboard focus. Expanded over an open tray, it docks into the
+lane until the trays close; a panel that stepped down expands in the centre
+again once the trays close and the pointer leaves the wings. Panel height animates when one panel replaces the
+other or the voice view changes. Minimized voice shows the last sentence from
+each side, and the empty Voice Preview suggests things to say until voice
+starts. Settings opened from chat keep chat's frame and show the shared AI
+provider, the quick-commands option and then the voice preferences (Voice
+Preview, inactivity timeout and model tier), so they stay in reach while
+Preview is off, with Back to chat; voice Settings show Back to voice. Escape steps back from either Settings view, closes Voice
+Preview, and does nothing in chat. Closing chat ends a typed session, and the
+voice panel's close turns voice off. Asking the assistant from chat to open
+Voice Settings or Voice Preview puts chat away, minimized or not, and shows the
+voice panel; the typed conversation and its running reply carry on, and the
+chat button brings them back.
+
 Contacts nearest-aircraft follow-ups retain the snapshot's distance basis even
 after the camera moves. An explicit new scope replaces that basis. Provider
 instructions require an analyst query for requested lists and use the requested
@@ -705,8 +785,9 @@ ordinary tool-card limits are unchanged.
 Voice speech: `src/voice/speech.js` adds `{ say, display, referents?, schedule? }`
 to layer toggles, fly_to_location, frame_overhead, select_nearest_aircraft,
 get_entity_context, annotate_map and analyst_query. Analyst speech and the card
-share one deterministic count/scope headline; lower bounds use "At least" and
-partial answers name the unanswered layers. `get_current_view_state` lists enabled layers only.
+share one bounded, lossless count/scope headline; combined flight, military and
+local ADS-B answers use the shared noun "aircraft"; lower bounds use "At least"
+and partial answers name the unanswered layers. `get_current_view_state` lists enabled layers only.
 FIRMS and ALPR entity labels remain English in shared context and tool data;
 voice-card titles and pointer presentation translate those known labels at display
 time, while arbitrary names and callsigns remain unchanged.
@@ -834,9 +915,11 @@ Source factories have dedicated `layers/<family>/source` exports. ALPR and earth
 
 Voice controls bind to a protocol-independent session factory. The default WebRTC adapter preserves the existing Realtime connection, push-to-talk, cost controls and radio handoff. Session subscriptions expose state, transcript, action call/progress/result, interruption, completion and turn-metrics events; stopping or replacing a session cancels pending actions. An active session's normal Stop publishes one idle transition, including adapters that emit their own terminal state; a restart triggered by that transition keeps ownership of its new startup state. Alternate adapters can use the same controls and action runner.
 
-The standalone app offers OpenAI and Gemini Live through an explicit provider chooser. Gemini keeps its permanent API key on the local server and mints a short-lived, single-use credential with server-owned instructions and the standalone action catalog. Its native WebSocket adapter supports open microphone and push-to-talk input, streaming audio, captions and the existing action runner. In push-to-talk, a tool call that arrives with no input, reply or tool result outstanding is answered with a failure and never runs, and neither does any other call in the reply it starts; open-microphone turns start on Gemini's server-side activity detection, which reports no boundary to check. Switching providers ends the old conversation and releases its microphone and connection; only the input mode carries over. Gemini uses bounded shutdown draining and explicit manual restart, without automatic reconnection or a promise of uninterrupted session duration. Hosts that do not opt into the provider facade retain their existing default or custom adapter.
+The standalone app offers OpenAI and Gemini Live through the **AI Provider** setting, shared by voice and typed chat. Gemini keeps its permanent API key on the local server and mints a short-lived, single-use credential with server-owned instructions and the standalone action catalog. Its native WebSocket adapter supports open microphone and push-to-talk input, streaming audio, captions and the existing action runner. In push-to-talk, a tool call that arrives with no input, reply or tool result outstanding is answered with a failure and never runs, and neither does any other call in the reply it starts; open-microphone turns start on Gemini's server-side activity detection, which reports no boundary to check. Switching providers ends the old conversation and releases its microphone and connection; only the input mode carries over. Gemini uses bounded shutdown draining and explicit manual restart, without automatic reconnection or a promise of uninterrupted session duration. Hosts that do not opt into the provider facade retain their existing default or custom adapter.
 
-Voice action argument schemas have one portable owner under `src/voice/actionSchemas.js`. The Realtime provider builds 30 tools using separate description-only metadata. Description customization cannot replace argument types, enum values or required fields.
+Voice action argument schemas have one portable owner under `src/voice/actionSchemas.js`. The Realtime provider builds 33 tools using separate description-only metadata; a session is offered 32 of them unless `OVERPASS_UPSTREAMS` is set, which adds `osm_query` and its one prompt sentence (`server/providers/openai/tools.js`). Description customization cannot replace argument types, enum values or required fields.
+
+Voice areas live in a store owned by the action runner for the page (`src/data/areaStore.js`); the model gets an `areaId`, a rounded bounding box and a summary, never geometry. `resolve_area` (`src/voice/areaActions.js`, `src/data/areaResolver.js`) checks the store, bundled Natural Earth regions, then bundled countries and states by name — a name several prominent units share returns up to four candidates unless the view is inside exactly one — and then the annotation outline ladder (`resolveAnnotationTarget`: bundled counties, Census places and neighborhoods, the guarded `/api/geocode/outline`, and Overpass only when configured). Administrative geometry is stored only when its source identity agrees with the requested unit, by name or by a form the bundled matcher reads as that unit at its level ("State of Texas", "Province of Bagmati", "USA", "UK"; not "Great Britain" or "Korea"); stale, mismatched, synthesized or otherwise unverified administrative boundaries are refused rather than relabelled. Clarification IDs use the bounded `ne:<kind>:<slug>` grammar and are accepted only from the current resolver's candidate memory. A lookup past 8 s answers `AREA_TIMEOUT` and keeps filling the caches. `around=true` asks the same ladder for the grounds enclosing a landmark (Nominatim, then the OpenFreeMap area holding it) and otherwise stores a 250 m buffer marked approximate. `analyst_query` scopes add `area`, `drawn` (newest draw-tool outline) and `annotation` (newest or named outline); region scopes use the same resolver within 3 s. Drawn outlines are a simplified copy (≤1,200 vertices); counting reads the stored geometry (`src/data/areaGeometry.js`). `find_imagery` (`src/voice/imageryActions.js`) sets the Recent Imagery box from an area, the view or the turn's pointer snapshot and pins the best acquisition; any hand change to the panel or explicit layer OFF while it searches ends the request (`DISPLACED`) without pinning or success narration. `osm_query` asks `/api/osm/features` for one curated preset in a bounded box; the route answers `OVERPASS_NOT_CONFIGURED` without an operator Overpass. Results go to the session-only `osm-places` layer and become the analyst's last answer; a list capped at its limit stays incomplete in follow-ups, which keep its "listed the first N" caveat and report counts as floors. An explicit OSM Places OFF while the provider is pending aborts the work and prevents re-enable, result, credit and follow-up-memory commits. The voice answer deadline also aborts the client provider request, so the caller does not leave a timed-out request without a cancellation owner. The server's whole search (22 s across every configured endpoint, with Overpass told 20 s) ends before that 25 s deadline, because a browser that stops waiting cancels the upstream query and leaves nothing cached for a retry.
 
 `createGevActionRunner` routes `control_cctv` enable/disable through the shared
 layer visibility lifecycle. Results distinguish successful changes from
@@ -904,10 +987,9 @@ voice disposes the runner.
 Analyst result memory is committed only after any Contacts-window projection
 finishes and the call is still current. Cancelled or superseded queries cannot
 return success or replace follow-up memory; Contacts follow-ups filter the same
-cohort that was shown, and partial/unanswered coverage remains attached when a
-remembered result is narrowed.
-The narrowed answer retains the remembered scope label and detail, including
-the Contacts-window attribution, unless the follow-up supplies a new scope.
+cohort that was shown and retain its displayed scope and loaded-data note unless
+the follow-up supplies a new scope. Partial/unanswered coverage remains attached
+when a remembered result is narrowed.
 
 Application startup constructs fresh layer instances from explicit source objects.
 Standalone composition selects the existing providers. Controls, launch orbit
@@ -1404,6 +1486,33 @@ By default the 250 cameras nearest downtown Vancouver and Victoria load.
 The Open Government Licence – British Columbia attribution is registered in the
 Data attribution popover.
 
+## Houston TranStar CCTV source pack
+
+The CCTV catalog adds Greater Houston traffic cameras from Houston TranStar
+alongside the other live packs. The server reads the keyless camera list at
+`https://traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js` and
+keeps cameras with a numeric snapshot id inside the metro bounding box. Frame
+URLs are built from each camera id under
+`https://www.houstontranstar.org/snapshots/cctv/<id>.jpg`; they are never taken
+from the payload. TranStar's `dir` is the side of the freeway the camera sits
+on, not the way it faces; TranStar's own map reads it as the direction of the
+nearest traffic (South → eastbound, North → westbound, West → southbound,
+East → northbound). That travel direction seeds a low-confidence heading with
+the low-confidence pose, and `None` or an unknown value uses the shared id-hash
+fallback; both stay marked as estimated.
+Gate: `src/data/cctvHouston.test.mjs`.
+
+TranStar's Content Usage terms (https://traffic.houstontranstar.org/disclaimer.aspx)
+prohibit copying, distribution and external framing of specific images without
+TxDOT's prior written permission. The pack is off by default; operators should
+set `CCTV_HOUSTON_ENABLED=1` only if they hold that permission. Frames are
+fetched and relayed on demand, buffered only transiently per request, sent with
+`Cache-Control: no-store`, and not archived. Once enabled, it loads the 250
+cameras nearest downtown, Uptown, the Medical Center, IAH and Galveston.
+`CCTV_HOUSTON_MAX_SOURCES` sets the pack cap (8–400). Snapshots update about
+every 3 minutes. The catalog-wide ceiling stays at 4,000 and is shared
+round-robin, so adding this pack does not silently drop another region.
+
 ## Location control ownership
 
 City/POI rows, search/reset bindings, location readouts and the orbit indicator
@@ -1708,6 +1817,19 @@ Mapped-installation zoom guidance appears in the layer row without counting as
 a global loading failure. Guidance statuses do not suppress independent refresh
 errors.
 
+Transit and Bike Share report the same kind of guidance when no feed or system
+covers the view, instead of an undated `never`. Above their altitude gates the
+rows read `GTFS-RT · Fly below 3,000 km to a covered region` and
+`GBFS · Fly below 48 km to a covered city`; lower down over a city neither
+covers (London, Tokyo) they read `GTFS-RT · No feed here yet · N regions
+available` and `GBFS · No bike share here yet · N systems available`, N being
+the enabled feeds and the catalogued systems. The
+chip stays ON. A Bike Share city that is loading or failed keeps its own
+loading or error text. Leaving every covered feed or system clears the layer's
+last-update time, so the row never dates data it no longer draws. The same
+English notes are the voice analyst's empty-result notes; both surfaces show
+them translated through `translateStatusMessage` (`src/ui/statusText.js`).
+
 ## Places and CCTV request bounds
 
 With a Google key configured, nearby and text search reject missing, blank,
@@ -1723,6 +1845,12 @@ unaffected. `GEV_RATELIMIT_OPENAI_PER_MIN` and `GEV_RATELIMIT_GOOGLE_PER_MIN` ov
 those; exactly `0` disables the limiter, while a value that cannot be read as a
 number falls back to the default rather than to unlimited. Over-limit requests
 receive a sanitized `429` with `Retry-After: 5` and never reach the provider.
+Typed chat (`/api/openai/chat`, `/api/gemini/chat`) counts in its own window,
+set by `GEV_RATELIMIT_OPENAI_CHAT_PER_MIN` and `GEV_RATELIMIT_GEMINI_CHAT_PER_MIN`.
+Left unset, each takes its provider's resolved cap — `GEV_RATELIMIT_OPENAI_PER_MIN`
+or `GEV_RATELIMIT_GEMINI_PER_MIN`, both 30 by default — so lowering a provider
+throttle lowers chat too; an explicit chat value, including `0`, wins. Its
+over-limit reply carries `Retry-After: 60`.
 The client key is the socket peer address only — a forwarded-for header is not
 trusted, so a proxied deployment shares one bucket per upstream hop.
 
@@ -2076,7 +2204,12 @@ during continuous motion. Disable/re-enable resets selection cleanly.
 Close-up stem sizing uses camera-to-feature distance without a 5 km minimum.
 Unchanged overlay entries do not request another frame; moved positions,
 changed membership and re-enabling still publish. Ground sampling waits for
-visible globe tiles to settle and uses valid loaded terrain as a floor while
+visible globe tiles to settle, and skips markers whose ground the camera
+cannot see (unseen ground reads through the Earth and would retry every 2 s).
+Ground is tested at loaded globe terrain, or across -9,000 to 9,000 m when the
+globe is hidden, so photoreal views skip only ground well out of view. Until it is
+seen, a stem keeps its unsampled height, which can show for a stem whose base
+is just off screen. Sampling uses valid loaded terrain as a floor while
 retaining rooftop and below-sea-level elevations. A hidden globe does not
 constrain photoreal geometry, and retry work remains bounded. Already sampled
 nearby markers follow higher settled terrain on existing bounded walks, without
@@ -2203,6 +2336,62 @@ Generated style sliders use the same name as their visible parameter label.
 The first-run suppression checkbox keeps its native wrapping label, so its
 accessible name remains "Don't show this again". Control behavior is unchanged.
 
+## Active Fires intensity filter and color ramp
+
+Every FIRMS detection is colored by fire radiative power on a six-stop ember →
+white-hot ramp: dark ember from 0 MW, red from 5, flame from 20, orange from
+50, gold from 100 and pale white-hot from 300 MW (`FRP_RAMP` in
+`src/data/firmsIntensity.js`). Each stop is lighter than the one below and
+none is a cold hue, so the brightest marks are the strongest fires; ~90% of
+detections are under 20 MW and stay dim red. Glow sprites and fire-card
+accents read that ramp; confidence and brightness do not affect the color.
+
+At far zoom (camera above ~4,500 km) the layer drapes a Snap Map–style
+heatmap instead of individual markers: the shown detections are linearly binned
+(each detection's weight shared between the four nearest pixel centres, so spots
+sit at the true position and stay round) on a
+global 4096 × 2048 grid (≈10 km per pixel), each weighted by its FRP in megawatts (so heat is
+radiated power, and raising the FRP slider does not dim areas where strong fires
+burn, and a cluster of detections reads brighter than one), Gaussian-blurred by one
+pixel so each fire stays a distinct spot about the size of its marker,
+normalized on a log scale against the 99.5th percentile and mapped through the
+same hues, from a bright red edge through orange and gold to a pale
+white-hot core. The edge starts more than half opaque, so regions far below
+the hottest ones still read over forest and savanna imagery. Nothing is painted where
+nothing burns (`src/data/firmsHeatRaster.js`). It is one full-globe imagery
+tile on the active imagery host (`src/layers/firms/heatImagery.js`), rebuilt
+on each data refresh or filter change (the first far-band paint at once,
+later ones 150 ms after the last change). Heatmap and markers are both kept
+built at every zoom and cross-fade by camera height between 3,600 and
+5,400 km, every frame, so a fast zoom never shows a gap: the heatmap fades by
+imagery `alpha` (a hidden Cesium imagery layer is unmapped from the globe
+tiles and re-mapped late when shown), the markers by sprite alpha, and the
+marker collection is hidden once the heatmap is whole. The 750–4,500 km
+markers band draws up to 40,000 detections (the strongest in the padded
+view), so the weak fires the heatmap shows stay on screen as markers when it
+fades out; it reads each marker's already-built anchor instead of the ground
+floor cache, which only the close band warms. "N FIRES" cards from a 2° / 1° aggregation still label the hottest
+areas; their accent is the strongest fire's FRP color.
+Re-enabling Active Fires keeps the retained heat imagery hidden when the current
+filtered set is empty, including while a new snapshot is pending.
+
+The Active Fires row carries a "Fire intensity (FRP)" slider on a log scale
+whose track is painted with the ramp and ticked at the same six values (its
+value reads "All" or "≥ N MW"), a "Confidence" switch with All / Nominal+ /
+High, and an "N of M shown" counter. The default is 0 MW and
+All, because many of the strongest detections are rated low confidence. The
+filter runs once in `ingestion.applyFilter()` before rendering, so markers,
+cards, the heatmap, the shared context store, the top-fires query and the
+analyst records all see one filtered set; a selected fire that no longer passes
+is deselected. The layer state keeps both options under the `w` (`local-firms`)
+share token as `f` (whole megawatts, 0–10,000) and `c` (`a`, `n`, `h`),
+including the short share codec; a link without them restores the defaults.
+
+The `get_active_fires` tool accepts its own `min_frp_mw` and `confidence`
+(`all`, `nominal`, `high`) arguments, independent of the panel's setting, and
+names the applied criteria in its notes. Stale-snapshot and missing-source
+reporting are unchanged.
+
 ## FIRMS source status
 
 The FIRMS CSV parser rejects impossible acquisition calendar dates before the proxy filters records to the trailing 24 hours, while retaining valid UTC acquisition times.
@@ -4019,7 +4208,7 @@ its criteria cannot be silently ignored.
 | Satellites             | CelesTrak                                                                                                                                                                                       | `src/data/satellites.js`                              | `/api/celestrak`                                         | 120s                                                                              |
 | Space Missions (30d)   | Launch Library 2 + CelesTrak                                                                                                                                                                    | `src/data/rocketLaunches.js`                          | `/api/launches` + `/api/celestrak/active`                | 5 min                                                                             |
 | Traffic | Selectable TomTom / OpenStreetMap / Hybrid roads; optional TomTom flow (BYOK) | `src/data/traffic.js` | browser-direct OpenFreeMap tiles; `/api/tomtom` for flow | viewport-driven; capped tile cache |
-| CCTV                   | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Statens vegvesen (NO, stills + live HLS, Kartverket ground heights) + King County (WA) Open Data + WSDOT (WA) Open Data + NYC DOT TMC (opt-in) + City of Toronto RESCU + Catalonia (Servei Català de Trànsit) + Hong Kong Transport Department + FL511 (FL, opt-in) + Freeway Bureau, MOTC (Taiwan) + Autostrada del Brennero (IT, A22 stills) + Street View fallback | `src/data/cctv.js`                                    | `/api/cctv`                                              | 10s (active)                                                                      |
+| CCTV                   | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Statens vegvesen (NO, stills + live HLS, Kartverket ground heights) + King County (WA) Open Data + WSDOT (WA) Open Data + NYC DOT TMC (opt-in) + City of Toronto RESCU + Catalonia (Servei Català de Trànsit) + Hong Kong Transport Department + FL511 (FL, opt-in) + Freeway Bureau, MOTC (Taiwan) + Houston TranStar (opt-in) + Autostrada del Brennero (IT, A22 stills) + Street View fallback | `src/data/cctv.js`                                    | `/api/cctv`                                              | 10s (active)                                                                      |
 | Radio                  | Radio Browser (public-domain station directory)                                                                                                                                                 | `src/data/radio.js`                                   | `/api/radio/stations`, `/api/radio/click/:uuid`          | 45 min directory refresh                                                          |
 | Transit 🚌             | Operator GTFS-Realtime VehiclePositions (7 keyless regions, `src/data/transitFeeds.js`)                                                                                                         | `src/layers/transit/` via `src/app/layers/transit.js` | `/api/transit`                                           | 15s (poll + delayed playback)                                                     |
 | Bikeshare 🚲           | GBFS (Lyft + BCycle + Social Bicycles + PBSC incl. Bike Share Toronto, Bike Itaú (Brazil), Bicing (Barcelona) and seven other Spanish cities + Urban Sharing, Entur, JCDecaux (Lillestrøm, Valencia, Seville) + nextbike (AMBici))                                                                                                                                        | `src/data/bikeshare.js`                               | `/api/gbfs`                                              | 60s                                                                               |
@@ -4035,6 +4224,7 @@ its criteria cannot be silently ignored.
 | Sea Marks ⚓ (`sea-marks`) | OpenSeaMap seamark raster tiles (keyless; CC BY-SA 2.0 tiles, OSM data ODbL) | `src/data/osmOverlays.js` | — (browser-direct tiles) | on view (Cesium tile requests; no polling) |
 | Ski Pistes ⛷ (`ski-pistes`) | OpenSnowMap piste raster tiles (keyless; CC BY-SA tiles, OSM data ODbL; no bulk download) | `src/data/osmOverlays.js` | — (browser-direct tiles) | on view (Cesium tile requests; no polling) |
 | Fire Perimeters 🔥 | NIFC WFIGS current interagency perimeters (keyless, paged past the 2000-record cap); InciWeb catalog + incident page origin and update time checks for verified incident-page links | `src/layers/perimeters/` via `src/app/layers/perimeters.js` | `/api/fire-perimeters` + `/api/fire-perimeters/inciweb/*` | 5 min (server caches: catalog 1 h; publication 30 min) |
+| Prohibited & Restricted Airspace 🚫 | FAA Special Use Airspace prohibited (P) and restricted (R) zones (keyless FeatureServer, simplified geometry) | `src/layers/droneAirspace/` via `src/app/layers/droneAirspace.js` | `/api/drone-airspace` | 1 h (server cache 1 h; stale-on-error) |
 
 GNSS Integrity samples a 250 nm circle around the Earth point under the screen
 centre. Camera reads debounce for 600 ms with a monotonic 2.5 s minimum gap;
@@ -4062,6 +4252,20 @@ by `scripts/qa-emergency-squawk.mjs`. Both accept `--timeout-ms` for slow boot.
 
 Fire Perimeters uses capped, timed server reads with stale-on-error caching and a per-client limit. A stale snapshot is served for at most 24 hours; the layer row then reads STALE, dated by that snapshot's fetch, and `get_fire_perimeters` returns `stale` and `retrieved_at` with "(data may be stale)" in its summary. Unchanged snapshots retain geometry; link checks cancel on disable or selection change, and the row legend shows reported containment.
 
+Prohibited & Restricted Airspace is off by default (share-link token `8`) and sits in
+Infrastructure. The proxy pages `TYPE_CODE IN ('P','R')` from the FAA SUA
+FeatureServer, caps the body, and reuses a one-hour snapshot, serving the last
+good payload as stale for at most 24 hours when a refresh fails; the layer row
+then reads STALE, dated by that snapshot's fetch. An answer with no valid zone, or
+paging that ends while the service still flags more records, counts as a
+failed refresh. Client-supplied URLs are ignored. The route uses the keyless
+same-site checks: a cross-site browser request gets `403` before it spends the
+per-client quota or starts a refresh, and the app still works behind a reverse
+proxy.
+Polygons keep holes; pick ownership is deliberately unregistered so sibling
+cards still work over a zone. The row legend and selected card state that the
+layer is informational only and not a substitute for B4UFLY / LAANC.
+
 Street Level is a docked, collapsible right-rail panel (`#street-level-panel`,
 layer token `0`, option owner `street-level`, panel `ui` token `t`) that starts
 collapsed. It opens itself only when the user, voice or a tool switches the
@@ -4982,6 +5186,7 @@ silently demoting every later lookup for the session.
 - Enabled Data Layer controls report normalized feed health on the button (`LOADING`, `DEGRADED`, `STALE`, `FALLBACK`, or `UNAVAILABLE`) while the metadata line retains the source and reason. A partial CelesTrak group failure keeps the usable catalog and reports `DEGRADED`; a total outage keeps last-good catalog data visible but reports `UNAVAILABLE`.
 - On activation it focuses the nearest currently observed aircraft across the civilian and military feeds, with military winning an exact distance tie; if none are available, it focuses an observed AIS vessel. The aircraft search is deliberately uncapped and one refresh-tick retry handles initially empty feeds. This is an attention-priority navigation shortcut, not a high-risk, affiliation, or threat classification.
 - A selected aircraft, AIS vessel, or mapped installation gets a 250 km **context window** with nearby cohort counts, nearest examples, source labels, and stale/unavailable reasons. It emits `NEARBY` or `UNKNOWN`; no detection, engagement, affiliation, or sensor-activity conclusion is calculated.
+- The window's edge is drawn on the globe as a 250 km range ring: a 4 px polyline with a 2 px Context-blue core inside a 1 px dark halo on each side, 2.5 km above the ellipsoid (`AWARENESS_RANGE_RING_STYLE` in `src/layers/awareness/policy.js`). The halo keeps it legible over bright desert and snow, dark ocean and forest, and under the FLIR, NVG and CRT styles, where the earlier 1 px ellipse outline disappeared. It is a polyline because WebGL draws ellipse outlines at 1 px whatever width is asked for, drawn as an unpickable primitive rather than an entity so a click or tap on its edge reaches the contact underneath (headless viewers without a primitive collection get a static entity instead); it is rebuilt when the subject moves. Three dim sonar pulses (3 px with a 1 px dark outline, same colours, at most 60% opacity) grow slowly from the subject at constant speed, one every 3 s and each taking 9 s, and arrive at the ring at about a third of that. Behind each pulse a radial gradient in the same blue fades inward over 35% of the radius. One unpickable 250 km disc draws both the pulse lines and the gradient, its shader reading the pulse radii and opacities each frame, so a click or tap near a pulse still reaches the contact underneath; the disc follows the subject by a model-matrix rotation and is rebuilt only after the subject moves 20 km, and not at all while the pulses rest. While the camera is below the disc's 2.5 km height, where it would sweep across the sky, the pulses rest: the disc is hidden and there is no ring flash, no echo and no frame request. Terrain or 3D tiles higher than 2.5 km (the Alps, Andes, Rockies) still cut through the disc and the ring when seen from above, as the ring alone already did; the height check uses the camera's height above the ellipsoid, not above the ground. While pulses run, the ring dims to 40% and flashes to full strength as each pulse reaches it, fading over 1.8 s. As a pulse front crosses a flight, military aircraft or AIS vessel, the detection overlay draws a second bracket around that contact's own bracket, in the pulse blue on the default detection style and in the style's own line colour under NVG, FLIR and CRT, which spreads outward as it fades over 1.4 s (`AWARENESS_RANGE_ECHO`, read through `src/awarenessEcho.js`; no layer's icon is restyled, and mapped installations have no detection bracket). Pulses are born 5 km out, so the subject itself and anything nearer never echo. Pulses run for 9 s (three ring flashes) after a selection or a camera move, fading in and out over 1.2 s, then rest: the ring stays on screen at full strength, the pulses, gradient and echoes are hidden, and nothing asks for frames, so a parked Contacts view is quiet again. Only a camera move within 1.5 s of the user handling the map (pointer, wheel or touch on the Cesium canvas, which covers a drag's inertia, and a drag or touch begun there keeps counting until its last finger or button lifts, even outside the canvas, unless the window loses focus or the page is hidden first; keys typed elsewhere do not count, nor does input while Cesium's camera controls are off, as in the cockpit view, and a gesture still pending when the cockpit or another owner takes the camera is dropped) wakes them; a moving subject and the app's own camera moves (a tracked aircraft, the cockpit view, an orbit, a fly-to) do not, since they move on every refresh. While they run they never hold continuous rendering: each drawn frame arms one render request 80 ms later (the Cyber sonar cadence, `CYBER_SONAR_RENDER_INTERVAL_MS`), so they repaint at about 12.5 fps and never beat the detection lane's 80 ms gate. Under `prefers-reduced-motion`, or in a scene without primitives or preRender and postRender hooks, there are no pulses or echoes and the ring stays on screen; changing the preference mid-session rebuilds the ring. The ring follows a moving subject once it has moved 250 m.
 - For a selected live aircraft or vessel, the context window refreshes from the existing tracker/feed position every 750 ms, so nearest distances and cohort counts follow the subject without introducing a duplicate poll loop.
 - Aircraft cohort membership uses every locally loaded, selectable contact inside the 250 km window, including a plane hidden only by horizon culling or because its 3D model owns the visual. Counts and navigation therefore do not change with the current camera angle or billboard/model handoff.
 - Nearby examples in the context panel are focus controls: they use their owning layer's existing selection/tracking path, then frame that contact. Static-installation distances use ellipsoidal surface distance so the count matches the ground-projected context disk.
@@ -5024,6 +5229,10 @@ silently demoting every later lookup for the session.
   multi-sensor datasheets publish a capability range, not the lens's current zoom, so those
   cameras keep their estimate and show `SPEC FOV min–max° (CAPABILITY)` beside it. Public
   camera state carries `fovSource`, `specFovMinDeg`, `specFovMaxDeg` and `spec` (#452).
+  The table also has Bosch MIC-7130, MIC-7502 and MIC-7522 records for the Amsterdam
+  register proposed in #251, with its `x` colour aliases (#1319). Their datasheet FOV names
+  no axis, so it neither gives a capability range nor replaces the estimate. The records
+  alone do not enable that source pack.
 - **FIRMS**: no ground clamping (zero 3D-tiles height sampling), ≤18 screen-decluttered ambient labels, click-to-inspect detail card, 2.5k/3k sprite budgets viewport-clipped by FRP. Fire-power labels share display rounding before localization: one decimal below the rounded 10 MW boundary, then whole megawatts (for example, 9.96 MW reads 10 MW).
 - **CCTV v2 foundation:** a pitched
   frustum wireframe (4 corner rays + far-cap rectangle) with a monitor plane at the frustum's
@@ -5817,7 +6026,7 @@ apply to `public/` assets or built-preview serving.
 - Panel POSITION keys are versioned `v8` (`godsEyeView.v8.panelPos.<id>`); collapsed-state keys remain `v6`. The one-time position reset clears stale DISPLAY placements that could overlap the Context rail.
 - Map Source lives in the bottom Visual Presets tray. The left accordion contains no MAP STACK panel, and the `k` panel token that addressed it is gone from the share registry, so legacy `ui=k...` state takes the ordinary unknown-token skip.
 - A dock popover (Visual Presets, Location) auto-dismisses on mouse-away unless pinned. Focus inside the tray defers that dismissal only when the browser reports `:focus-visible` — keyboard focus and typed-into fields hold the tray open; a mouse-clicked tile does not, because Chromium focuses a `<button>` on press.
-- GEV MIC control is a glass capsule (var(--glass-bg), blur(24px) saturate(1.4), 999px radius; panel radius in error state).
+- The voice and chat panels share the left panels' glass surface (`--glass-bg`, `--glass-border`, blur(24px) saturate(1.4); `src/ui/styles/ai-chat.css`). The docked voice control draws its own blur on a layer behind it, so the panels inside it still blur the map. Cyber keeps its own surfaces.
 - The desktop right rail (`#right-context-rail`) owns `DISPLAY`, `CCTV`, its active parameter controls, and `GLOBAL CONTEXT` as one fixed responsive stack in that order. Its compact buttons use the same 176 px width as the left accordion and one consistent 50 px height, share the left stack's 52 px edge inset and measured top baseline across HUD variants, then constrain themselves against visible HUD/chrome rectangles and the remaining vertical corridor. `DISPLAY` is no longer draggable and legacy saved coordinates are ignored.
 - The right rail is labeled **DISPLAY** (formerly "MOVE") and groups, in order, HUD, DETECT, Bloom, Sharpen, 3D, Clean-UI (HUD + DETECT promoted to the top). Its expanded controls retain the same compact 176 px width as the right-side tabs instead of growing to the wider Context detail-card width. It starts expanded on first run and respects the user's later `v6` collapse choice. Collapses/expands with directional chevrons (`◀` collapsed, `▶` expanded).
 - Display and Context use matching 330 px expanded widths and matching compact tab dimensions. The parameter panel is part of Display's expanded content. One right-rail panel is open at a time in every HUD layout and collapsed launchers are hidden; the panel rail beside the stack switches between them (see Panel rails). The most recently opened right-rail panel owns the lane even when it appears later in DOM order; passive restoration and automatic disclosure do not replace that explicit owner. When the open panel exceeds the measured corridor, it scrolls internally.
@@ -6068,6 +6277,11 @@ easier to meet (detection is now on more often), but does not create it.
   TomTom draws only flow-tile lines with their own flow; roads without flow
   are not drawn and the status says so. A `full`-coverage flow line carries
   both travel directions, a `one_side` line the direction it is drawn in.
+  When an opposite-direction `one_side` line runs within 5 m of at least two
+  of three points a quarter, half and three quarters along a `one_side` line,
+  the two are one street's directions and each
+  gets a two-way direction's half share of dots, so the street is as dense as
+  one `full` line (#1455).
   OSM draws OpenFreeMap roads with flow matched onto them (below). Hybrid
   draws eligible TomTom motor-road lines and adds OpenFreeMap roads only where no eligible TomTom line
   runs within 35 m in the same travel direction (30 degrees), tested every

docs/VOICE-OWNERSHIP.md

@@ -20,7 +20,7 @@ The session adapter, action runner and backend interfaces remain unchanged.
 | `pointerContext.js` | Pointer position, dwell pick and the current turn's pointer snapshot (session-scoped) |
 | `referents.js` | Numbered items from the latest result for `referent:n` (session-scoped) |
 | `resultDisplay.js` | What the voice card shows for a result and which items it numbers (read by the card and `referents.js`) |
-| `gevActions.js` runner | Analyst follow-up memory (session: `resetConversation()` on stop, `dispose()` on removal) |
+| `gevActions.js` runner | Area handles (page lifetime); analyst follow-up memory (session: `resetConversation()` on stop, `dispose()` on removal) |
 
 The backend is replaceable per deployment: `realtimeController.js` accepts it as a
 `backend` option and falls back to `createRealtimeBackend()`. Its two method

package.json

@@ -176,6 +176,7 @@
     "./layers/perimeters": "./src/layers/perimeters/index.js",
     "./layers/gnss": "./src/layers/gnss/index.js",
     "./layers/ghostmaps": "./src/layers/ghostMaps/index.js",
+    "./layers/drone-airspace": "./src/layers/droneAirspace/index.js",
     "./sources/firms-csv": "./src/data/firmsCsv.js",
     "./layers/firms": "./src/layers/firms/index.js",
     "./layers/satellites": "./src/layers/satellites/index.js",
@@ -255,6 +256,7 @@
     "./layers/perimeters/source": "./src/layers/perimeters/source.js",
     "./layers/gnss/source": "./src/layers/gnss/source.js",
     "./layers/ghostmaps/source": "./src/layers/ghostMaps/source.js",
+    "./layers/drone-airspace/source": "./src/layers/droneAirspace/source.js",
     "./layers/firms/source": "./src/layers/firms/source.js",
     "./layers/installations/source": "./src/layers/installations/source.js",
     "./layers/launches/source": "./src/layers/launches/source.js",

pinokio/_ENVIRONMENT

@@ -30,3 +30,7 @@ PINOKIO_SHARE_VAR=__gev_sharing_disabled__
 # App-level guards, not billing caps. Provider-side budgets remain authoritative.
 GEV_RATELIMIT_OPENAI_PER_MIN=30
 GEV_RATELIMIT_GOOGLE_PER_MIN=120
+# Typed chat follows the OpenAI cap above, or Gemini voice's default of 30,
+# unless set here; 0 disables it.
+# GEV_RATELIMIT_OPENAI_CHAT_PER_MIN=
+# GEV_RATELIMIT_GEMINI_CHAT_PER_MIN=

pinokio/install.js

@@ -28,6 +28,8 @@ module.exports = {
           LL2_API_TOKEN: '{{env.LL2_API_TOKEN || ""}}',
           GEV_RATELIMIT_OPENAI_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_PER_MIN || ""}}',
           GEV_RATELIMIT_GOOGLE_PER_MIN: '{{env.GEV_RATELIMIT_GOOGLE_PER_MIN || ""}}',
+          GEV_RATELIMIT_OPENAI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_CHAT_PER_MIN || ""}}',
+          GEV_RATELIMIT_GEMINI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_GEMINI_CHAT_PER_MIN || ""}}',
         },
         message: 'node scripts/pinokio-install.mjs',
       },

pinokio/start.js

@@ -23,6 +23,8 @@ module.exports = {
           PINOKIO_SHARE_VAR: '{{env.PINOKIO_SHARE_VAR || "__gev_sharing_disabled__"}}',
           GEV_RATELIMIT_OPENAI_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_PER_MIN || ""}}',
           GEV_RATELIMIT_GOOGLE_PER_MIN: '{{env.GEV_RATELIMIT_GOOGLE_PER_MIN || ""}}',
+          GEV_RATELIMIT_OPENAI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_CHAT_PER_MIN || ""}}',
+          GEV_RATELIMIT_GEMINI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_GEMINI_CHAT_PER_MIN || ""}}',
         },
         message: 'node scripts/pinokio-start.mjs',
         on: [{

pinokio/update.js

@@ -19,6 +19,8 @@ module.exports = {
           LL2_API_TOKEN: '{{env.LL2_API_TOKEN || ""}}',
           GEV_RATELIMIT_OPENAI_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_PER_MIN || ""}}',
           GEV_RATELIMIT_GOOGLE_PER_MIN: '{{env.GEV_RATELIMIT_GOOGLE_PER_MIN || ""}}',
+          GEV_RATELIMIT_OPENAI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_OPENAI_CHAT_PER_MIN || ""}}',
+          GEV_RATELIMIT_GEMINI_CHAT_PER_MIN: '{{env.GEV_RATELIMIT_GEMINI_CHAT_PER_MIN || ""}}',
         },
         message: 'node scripts/pinokio-update.mjs',
       },

scripts/format-scope.json

@@ -57,6 +57,9 @@
   "src/app/mapLifecycle.test.mjs",
   "src/app/startupCamera.test.mjs",
   "src/app/viewer.js",
+  "src/app/zoomOutGuard.test.mjs",
+  "src/app/controls.test.mjs",
+  "scripts/qa-zoom-out-guard.mjs",
   "src/app/atmosphereCompat.test.mjs",
   "src/standalone/application.js",
   "src/standalone/controls.js",
@@ -402,12 +405,22 @@
   "src/layers/perimeters/cards.test.mjs",
   "src/layers/perimeters/inciweb.test.mjs",
   "src/layers/perimeters/ownership.test.mjs",
+  "src/layers/droneAirspace/index.js",
+  "src/layers/droneAirspace/records.js",
+  "src/layers/droneAirspace/source.js",
+  "src/layers/droneAirspace/cards.js",
+  "src/layers/droneAirspace/records.test.mjs",
+  "src/layers/droneAirspace/source.test.mjs",
+  "src/layers/droneAirspace/cards.test.mjs",
+  "src/layers/droneAirspace/ownership.test.mjs",
+  "src/layers/droneAirspace/docs.test.mjs",
   "src/data/firmsHeatmap.js",
   "src/data/fireAnchors.js",
   "src/layers/firms/anchors.js",
   "src/layers/firms/cards.js",
   "src/layers/firms/index.js",
   "src/layers/firms/ingestion.js",
+  "src/layers/firms/heatVisibility.test.mjs",
   "src/layers/firms/lifecycle.js",
   "src/layers/firms/model.js",
   "src/layers/firms/policy.js",
@@ -569,6 +582,7 @@
   "src/data/cctvVegvesen.test.mjs",
   "src/data/cctvA22.test.mjs",
   "src/data/cctvNyc.test.mjs",
+  "src/data/cctvHouston.test.mjs",
   "src/data/cctvNswSource.test.mjs",
   "src/data/cctvTxdotSource.test.mjs",
   "src/layers/cctv/source.test.mjs",
@@ -681,6 +695,7 @@
   "src/app/layers/radio.js",
   "src/app/layers/earthquakes.js",
   "src/app/layers/perimeters.js",
+  "src/app/layers/droneAirspace.js",
   "src/app/layers/cctv.js",
   "src/app/layers/firms.js",
   "src/app/layers/satellites.js",
@@ -866,6 +881,7 @@
   "src/layers/weather/imageryOrder.test.mjs",
   "server/providers/cyclones.js",
   "server/providers/firePerimeters.js",
+  "server/providers/droneAirspace.js",
   "src/data/cyclonesProxy.test.mjs",
   "src/data/firePerimetersProxy.test.mjs",
   "server/providers/gnssIntegrity.js",
@@ -890,6 +906,7 @@
   "src/layers/ghostMaps/records.test.mjs",
   "src/layers/ghostMaps/lifecycle.test.mjs",
   "scripts/qa-ghostmaps.mjs",
+  "src/data/droneAirspaceProxy.test.mjs",
   "src/layers/cyclones/index.js",
   "src/layers/cyclones/rendering.js",
   "src/layers/cyclones/labels.js",
@@ -1111,5 +1128,144 @@
   "src/cameraGlobeRotation.test.mjs",
   "src/voice/globeResetConfirmation.test.mjs",
   "src/hudDms.test.mjs",
-  "server/providers/common/rateLimitKeys.test.mjs"
+  "src/hudSummaryGate.test.mjs",
+  "src/hudSummaryLine.test.mjs",
+  "src/testSupport/stubMgrs.mjs",
+  "src/tools/queries/hud-caption-feed-state.test.mjs",
+  "src/voice/hudPlaceLabels.test.mjs",
+  "src/voice/panel/preferences.test.mjs",
+  "src/voice/panel/preferencesView.test.mjs",
+  "src/voice/voiceControlView.test.mjs",
+  "src/voice/panel/host.test.mjs",
+  "src/voice/panel/manualPanel.test.mjs",
+  "src/voice/panel/nativeActivity.test.mjs",
+  "src/voice/panel/inactivity.test.mjs",
+  "src/voice/panel/actionObserver.test.mjs",
+  "src/voice/realtimeCostPanel.test.mjs",
+  "docs/SHARE-LINK-FORMAT.md",
+  "src/share/wire.test.mjs",
+  "src/share/viewCodec.test.mjs",
+  "src/share/legacyShareState.test.mjs",
+  "src/testSupport/shareViewFixtures.mjs",
+  "src/ui/shareLinks.test.mjs",
+  "src/ui/shareButton.test.mjs",
+  "src/share/shareLinkPath.test.mjs",
+  "src/ui/kit/UiRail.test.mjs",
+  "src/ui/kit/UiSegmented.vue",
+  "src/ui/kit/UiSegmented.test.mjs",
+  "src/ui/kit/UiSlider.js",
+  "src/ui/kit/UiSlider.test.mjs",
+  "src/ui/kit/UiButton.vue",
+  "src/ui/kit/UiButton.test.mjs",
+  "src/ui/kit/UiChip.vue",
+  "src/ui/kit/UiChip.test.mjs",
+  "src/ui/globeActions.test.mjs",
+  "src/ui/safeFrameView.test.mjs",
+  "src/ui/kit/UiSelect.js",
+  "src/ui/kit/UiSelect.test.mjs",
+  "src/ui/kit/UiBadge.vue",
+  "src/ui/kit/UiBadge.test.mjs",
+  "src/ui/kit/UiEmpty.vue",
+  "src/ui/rail/RailChips.vue",
+  "src/ui/displayPanelActions.test.mjs",
+  "src/testSupport/vueDom.mjs",
+  "build/vueLoader.js",
+  "build/registerVue.js",
+  "src/ui/panelNavigation.test.mjs",
+  "src/ui/stores/owners.js",
+  "src/ui/stores/owners.test.mjs",
+  "src/ui/stores/panels.test.mjs",
+  "src/ui/stores/status.js",
+  "src/ui/statusChipsView.test.mjs",
+  "src/ui/statusChipOwners.test.mjs",
+  "src/ui/toast.js",
+  "src/ui/toastView.test.mjs",
+  "src/ui/stores/sceneInteractions.js",
+  "src/scenes/dataPacks/presentationView.test.mjs",
+  "src/ui/stores/dataPacks.js",
+  "src/scenes/interactionsView.test.mjs",
+  "src/layers/wind/inspectionMarker.js",
+  "src/layers/wind/inspectionMarker.test.mjs",
+  "src/ui/stores/windInspection.js",
+  "src/ui/stores/missionReplay.js",
+  "src/layers/launches/replayOverlay.test.mjs",
+  "src/ui/stores/bhoteKoshiPanel.js",
+  "src/data/bhoteKoshiPanelView.test.mjs",
+  "src/ui/stores/celestialRing.js",
+  "src/celestialRingView.test.mjs",
+  "src/ui/stores/screenAnnotations.js",
+  "src/ui/stores/worldOverlayActions.js",
+  "src/overlays/worldOverlayActionsView.test.mjs",
+  "src/ui/stores/awarenessDirection.js",
+  "src/layers/awareness/directionOverlay.test.mjs",
+  "src/awarenessEcho.js",
+  "src/awarenessEcho.test.mjs",
+  "src/data/detectionAwarenessEcho.test.mjs",
+  "src/hudReadouts.js",
+  "src/ui/stores/hud.js",
+  "src/ui/views/intelHudView.test.mjs",
+  "src/testSupport/hudReadouts.mjs",
+  "src/ui/stores/firstRun.js",
+  "src/firstRunLauncherView.test.mjs",
+  "src/firstRunCopy.js",
+  "src/data/headingDegrees.test.mjs",
+  "src/data/distanceFormat.test.mjs",
+  "src/sources/adsbFields.test.mjs",
+  "src/data/firmsIntensity.js",
+  "src/data/firmsIntensity.test.mjs",
+  "src/ui/layerPanel/RowSwitch.vue",
+  "src/ui/layerPanel/RowSlider.vue",
+  "src/sources/phaseTiming.test.mjs",
+  "scripts/build-census-places.mjs",
+  "src/data/placeBoundaries.test.mjs",
+  "src/data/boundaryLabels.test.mjs",
+  "src/data/packGeometry.test.mjs",
+  "src/annotations/placeOutline.test.mjs",
+  "src/annotations/outlineIdentity.test.mjs",
+  "src/annotations/outlineRungs.test.mjs",
+  "src/annotations/outlineRungsFallback.test.mjs",
+  "src/search/photonSetting.test.mjs",
+  "src/sources/nominatimOutlines.test.mjs",
+  "src/sources/openFreeMapOutlines.test.mjs",
+  "src/sources/openFreeMapOutlinesEdges.test.mjs",
+  "src/standalone/layerSources.test.mjs",
+  "src/tooling/nominatimGuardLifecycle.test.mjs",
+  "src/tooling/nominatimLockOwnership.test.mjs",
+  "src/tooling/nominatimOutlineRoute.test.mjs",
+  "server/providers/common/rateLimitKeys.test.mjs",
+  "src/voice/areaCandidateContract.js",
+  "src/voice/layerActionOwnership.js",
+  "src/data/areaGeometry.test.mjs",
+  "src/data/areaResolver.test.mjs",
+  "src/sources/osmFeatures.test.mjs",
+  "src/layers/osmPlaces/index.test.mjs",
+  "src/tooling/boundedCache.test.mjs",
+  "src/tooling/osmFeaturesRoute.test.mjs",
+  "src/voice/areaActions.test.mjs",
+  "src/voice/imageryActions.test.mjs",
+  "src/voice/osmActions.test.mjs",
+  "src/voice/realtimeProtocol.test.mjs",
+  "src/layers/awareness/rangeRing.test.mjs",
+  "src/voice/voiceMiniPreview.js",
+  "src/voice/voiceMiniPreview.test.mjs",
+  "src/voice/chatPreferences.test.mjs",
+  "src/voice/textChat.test.mjs",
+  "src/voice/chatAttachments.test.mjs",
+  "src/voice/chatControlView.test.mjs",
+  "src/textChatServer.test.mjs",
+  "src/geminiChatServer.test.mjs",
+  "src/voice/geminiTextChat.test.mjs",
+  "server/providers/common/textChat.js",
+  "server/providers/common/textInstructions.js",
+  "server/providers/common/textTools.js",
+  "server/providers/gemini/chat.js",
+  "server/providers/openai/chat.js",
+  "src/ui/styles/ai-chat.css",
+  "src/voice/chatAttachments.js",
+  "src/voice/chatControl.js",
+  "src/voice/chatPreferences.js",
+  "src/voice/geminiTextChat.js",
+  "src/voice/panelLayout.js",
+  "src/voice/textChat.js",
+  "src/voice/textProtocol.js"
 ]

scripts/package-boundaries.json

@@ -30,6 +30,8 @@
       "src/ui/views/panels/LocalePicker.vue",
       "src/ui/views/panels/SceneDialog.vue",
       "src/ui/views/panels/VoiceControl.vue",
+      "src/ui/views/panels/ChatPanel.vue",
+      "src/ui/views/panels/PanelLayoutButtons.vue",
       "src/ui/views/panels/VoiceCard.vue",
       "src/ui/views/panels/VoiceVisualizer.vue",
       "src/ui/localePicker.js",
@@ -416,7 +418,11 @@
       "src/sources/httpBody.js",
       "src/i18n/marker.js",
       "src/sources/overpass.js",
-      "src/sources/rateLimit.js"
+      "src/sources/rateLimit.js",
+      "server/providers/common/boundedCache.js",
+      "src/data/osmPresets.js",
+      "server/providers/overpass/osmFeatures.js",
+      "server/providers/overpass/osmFeaturesRoute.js"
     ],
     "external": []
   },
@@ -490,6 +496,15 @@
       "server/providers/common/rate-limit.js",
       "server/providers/common/request.js",
       "server/providers/common/source-root.js",
+      "server/providers/common/textChat.js",
+      "server/providers/common/textInstructions.js",
+      "server/providers/common/textTools.js",
+      "server/providers/openai/chat.js",
+      "server/providers/gemini/request.js",
+      "build/allowedHosts.js",
+      "src/tools/schema.js",
+      "src/sources/requestDeadline.js",
+      "src/sources/httpBody.js",
       "server/providers/openai.js",
       "server/providers/openai/codex-auth.js",
       "server/providers/openai/constants.js",
@@ -508,9 +523,11 @@
       "server/providers/common/same-site.js",
       "src/localRequestGate.mjs",
       "src/voice/actionSchemas.js",
+      "src/voice/areaCandidateContract.js",
       "src/voice/layerManifest.js",
       "server/providers/openai/toolDescriptions.js",
-      "src/sources/rateLimit.js"
+      "src/sources/rateLimit.js",
+      "server/providers/overpass/constants.js"
     ],
     "external": []
   },
@@ -668,6 +685,8 @@
       "src/ui/rail/classToggle.js",
       "src/ui/rail/focusSafeChildren.js",
       "src/ui/layerPanel/RowText.vue",
+      "src/ui/layerPanel/RowSwitch.vue",
+      "src/ui/layerPanel/RowSlider.vue",
       "src/ui/railTimeline.js",
       "src/ui/clearLayersControl.js",
       "src/loadingFeedback.js",
@@ -705,7 +724,8 @@
       "src/ui/kit/UiButton.vue",
       "src/ui/kit/UiBadge.vue",
       "src/ui/rail/fieldValue.js",
-      "src/ui/kit/UiSlider.js"
+      "src/ui/kit/UiSlider.js",
+      "src/ui/kit/UiSegmented.vue"
     ],
     "external": ["vue"]
   },
@@ -929,6 +949,7 @@
       "src/data/detectionPolicy.js",
       "src/data/installationFeedback.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateCoordinator.js",
       "src/data/layerStateTokenReservations.json",
@@ -1001,6 +1022,8 @@
       "src/ui/rail/classToggle.js",
       "src/ui/rail/focusSafeChildren.js",
       "src/ui/layerPanel/RowText.vue",
+      "src/ui/layerPanel/RowSwitch.vue",
+      "src/ui/layerPanel/RowSlider.vue",
       "src/ui/railTimeline.js",
       "src/ui/layers.js",
       "src/ui/leftPanelRail.js",
@@ -1124,7 +1147,8 @@
       "src/ui/kit/UiBadge.vue",
       "src/ui/stores/globeActions.js",
       "src/ui/stores/recording.js",
-      "src/ui/i18n.js"
+      "src/ui/i18n.js",
+      "src/ui/kit/UiSegmented.vue"
     ],
     "external": ["cesium", "vue", "pinia", "vue-i18n"]
   },
@@ -1293,6 +1317,7 @@
       "src/data/contactMatch.js",
       "src/data/iconOrientation.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateTokenReservations.json",
       "src/data/modelVisualAnchor.js",
@@ -1355,6 +1380,7 @@
       "src/data/contactMatch.js",
       "src/data/iconOrientation.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateTokenReservations.json",
       "src/data/modelVisualAnchor.js",
@@ -1408,6 +1434,7 @@
       "src/data/contactMatch.js",
       "src/data/iconOrientation.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateCoordinator.js",
       "src/data/layerStateTokenReservations.json",
@@ -1509,6 +1536,8 @@
     "exports": ["./layers/firms"],
     "modules": [
       "src/data/firmsAdapt.js",
+      "src/data/firmsIntensity.js",
+      "src/data/firmsHeatRaster.js",
       "src/data/firmsLabels.js",
       "src/data/iconOrientation.js",
       "src/layers/firms/anchors.js",
@@ -1520,6 +1549,7 @@
       "src/layers/firms/policy.js",
       "src/layers/firms/queries.js",
       "src/layers/firms/rendering.js",
+      "src/layers/firms/heatImagery.js",
       "src/layers/firms/selection.js",
       "src/layers/firms/source.js",
       "src/layers/firms/state.js",
@@ -1678,6 +1708,7 @@
       "src/data/distanceFormat.js",
       "src/i18n/marker.js",
       "src/cyberSonar.js",
+      "src/awarenessEcho.js",
       "src/cockpitMath.js",
       "src/data/iconOrientation.js",
       "src/data/militaryAwarenessEngine.js",
@@ -1982,6 +2013,7 @@
     "modules": [
       "src/data/iconOrientation.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateTokenReservations.json",
       "src/data/radioCountry.js",
@@ -2133,6 +2165,14 @@
       "src/voice/realtimeBackend.js",
       "src/voice/cloudVoiceAuth.js",
       "src/voice/control.js",
+      "src/voice/chatControl.js",
+      "src/voice/geminiTextChat.js",
+      "src/voice/textChat.js",
+      "src/voice/textProtocol.js",
+      "src/voice/chatAttachments.js",
+      "src/voice/chatPreferences.js",
+      "src/voice/panelLayout.js",
+      "src/voice/voiceMiniPreview.js",
       "src/voice/layerSummary.js",
       "src/voice/voiceCost.js",
       "src/voice/commands.js",
@@ -2228,6 +2268,7 @@
       "src/ui/placeNames.js",
       "src/cyberSonarScene.js",
       "src/cyberSonar.js",
+      "src/awarenessEcho.js",
       "src/hudLayouts.js",
       "src/hudLayoutPolicy.js",
       "src/ui/radioPanelPlacement.js",
@@ -2274,6 +2315,7 @@
       "src/app/layers/traffic.js",
       "src/app/operations.js",
       "src/app/scene.js",
+      "src/app/zoomOutGuard.js",
       "src/sources/sourceSlot.js",
       "src/app/sources.js",
       "src/app/startupChrome.js",
@@ -2344,6 +2386,8 @@
       "src/data/fireAnchors.js",
       "src/data/firmsAdapt.js",
       "src/data/firmsHeatmap.js",
+      "src/data/firmsIntensity.js",
+      "src/data/firmsHeatRaster.js",
       "src/data/firmsLabels.js",
       "src/data/flights.js",
       "src/data/flowMatch.js",
@@ -2505,6 +2549,7 @@
       "src/layers/firms/policy.js",
       "src/layers/firms/queries.js",
       "src/layers/firms/rendering.js",
+      "src/layers/firms/heatImagery.js",
       "src/layers/firms/selection.js",
       "src/layers/firms/source.js",
       "src/layers/firms/state.js",
@@ -2766,6 +2811,8 @@
       "src/ui/rail/classToggle.js",
       "src/ui/rail/focusSafeChildren.js",
       "src/ui/layerPanel/RowText.vue",
+      "src/ui/layerPanel/RowSwitch.vue",
+      "src/ui/layerPanel/RowSlider.vue",
       "src/ui/railTimeline.js",
       "src/ui/layers.js",
       "src/ui/leftPanelRail.js",
@@ -2814,6 +2861,14 @@
       "src/voice/panel/nativeActivity.js",
       "src/voice/panel/preferences.js",
       "src/voice/control.js",
+      "src/voice/chatControl.js",
+      "src/voice/geminiTextChat.js",
+      "src/voice/textChat.js",
+      "src/voice/textProtocol.js",
+      "src/voice/chatAttachments.js",
+      "src/voice/chatPreferences.js",
+      "src/voice/panelLayout.js",
+      "src/voice/voiceMiniPreview.js",
       "src/voice/gevActions.js",
       "src/agent/worldPacket.js",
       "src/voice/speech.js",
@@ -2884,6 +2939,11 @@
       "src/layers/ghostMaps/records.js",
       "src/layers/ghostMaps/kml.js",
       "src/layers/ghostMaps/source.js",
+      "src/app/layers/droneAirspace.js",
+      "src/layers/droneAirspace/index.js",
+      "src/layers/droneAirspace/source.js",
+      "src/layers/droneAirspace/records.js",
+      "src/layers/droneAirspace/cards.js",
       "src/layers/cctv/sourcePolicy.js",
       "src/sources/reference.js",
       "src/search/nominatim.js",
@@ -3184,7 +3244,20 @@
       "src/data/placeBoundaries.js",
       "src/data/placeNames.js",
       "src/data/local_data/us_census_places/files.js",
-      "src/data/local_data/wof_neighborhoods/files.js"
+      "src/data/local_data/wof_neighborhoods/files.js",
+      "src/sources/osmFeatures.js",
+      "src/voice/imageryActions.js",
+      "src/voice/layerActionOwnership.js",
+      "src/data/areaGeometry.js",
+      "src/layers/osmPlaces/model.js",
+      "src/data/areaStore.js",
+      "src/data/areaResolver.js",
+      "src/voice/areaCandidateContract.js",
+      "src/data/osmPresets.js",
+      "src/voice/osmActions.js",
+      "src/layers/osmPlaces/index.js",
+      "src/app/layers/osmPlaces.js",
+      "src/voice/areaActions.js"
     ],
     "external": [
       "hls.js",
@@ -3213,6 +3286,7 @@
       "src/data/headingDegrees.js",
       "src/data/distanceFormat.js",
       "src/cyberSonar.js",
+      "src/awarenessEcho.js",
       "src/data/approxDistance.js",
       "src/data/bhoteKoshiEvent.js",
       "src/ui/imagerySplit.js",
@@ -3278,6 +3352,8 @@
       "src/data/detectionDraw.js",
       "src/data/detectionPolicy.js",
       "src/data/firmsAdapt.js",
+      "src/data/firmsIntensity.js",
+      "src/data/firmsHeatRaster.js",
       "src/data/firmsLabels.js",
       "src/data/flowMatch.js",
       "src/data/focusDeemphasis.js",
@@ -3409,6 +3485,7 @@
       "src/layers/firms/policy.js",
       "src/layers/firms/queries.js",
       "src/layers/firms/rendering.js",
+      "src/layers/firms/heatImagery.js",
       "src/layers/firms/selection.js",
       "src/layers/firms/source.js",
       "src/layers/firms/state.js",
@@ -3613,6 +3690,11 @@
       "src/layers/ghostMaps/records.js",
       "src/layers/ghostMaps/kml.js",
       "src/layers/ghostMaps/source.js",
+      "src/app/layers/droneAirspace.js",
+      "src/layers/droneAirspace/index.js",
+      "src/layers/droneAirspace/source.js",
+      "src/layers/droneAirspace/records.js",
+      "src/layers/droneAirspace/cards.js",
       "src/layers/cctv/sourcePolicy.js",
       "src/search/nominatim.js",
       "src/nominatimGeocode.js",
@@ -3792,7 +3874,10 @@
       "src/data/placeBoundaries.js",
       "src/data/placeNames.js",
       "src/data/local_data/us_census_places/files.js",
-      "src/data/local_data/wof_neighborhoods/files.js"
+      "src/data/local_data/wof_neighborhoods/files.js",
+      "src/layers/osmPlaces/model.js",
+      "src/layers/osmPlaces/index.js",
+      "src/app/layers/osmPlaces.js"
     ],
     "external": [
       "hls.js",
@@ -3924,6 +4009,7 @@
       "src/i18n/marker.js",
       "src/data/installationFeedback.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateCoordinator.js",
       "src/data/layerStateTokenReservations.json",
@@ -4157,6 +4243,7 @@
     "exports": ["./voice/action-schemas"],
     "modules": [
       "src/voice/actionSchemas.js",
+      "src/voice/areaCandidateContract.js",
       "src/voice/layerManifest.js",
       "src/hudLayoutPolicy.js"
     ],
@@ -4174,6 +4261,15 @@
       "src/voice/sessionCommands.js",
       "src/voice/session.js",
       "src/voice/control.js",
+      "src/voice/chatControl.js",
+      "src/voice/cloudVoiceAuth.js",
+      "src/voice/geminiTextChat.js",
+      "src/voice/textChat.js",
+      "src/voice/textProtocol.js",
+      "src/voice/chatAttachments.js",
+      "src/voice/chatPreferences.js",
+      "src/voice/panelLayout.js",
+      "src/voice/voiceMiniPreview.js",
       "src/voice/voiceCard.js",
       "src/voice/voiceCardPresentation.js",
       "src/voice/resultDisplay.js",
@@ -4315,7 +4411,9 @@
       "src/layers/submarineCables/bundledSource.js",
       "src/layers/gnss/source.js",
       "src/layers/airQuality/model.js",
-      "src/layers/airQuality/source.js"
+      "src/layers/airQuality/source.js",
+      "src/layers/droneAirspace/source.js",
+      "src/layers/droneAirspace/records.js"
     ],
     "external": []
   },
@@ -4629,6 +4727,7 @@
       "src/styles/surveillance.js",
       "src/styles/thermal.js",
       "src/view/index.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateTokenReservations.json",
       "src/data/idSwitches.js",
@@ -4695,6 +4794,41 @@
     ],
     "external": []
   },
+  "drone-airspace": {
+    "exports": ["./layers/drone-airspace"],
+    "modules": [
+      "src/layers/droneAirspace/index.js",
+      "src/sources/httpBody.js",
+      "src/layers/droneAirspace/source.js",
+      "src/layers/droneAirspace/records.js",
+      "src/i18n/marker.js",
+      "src/layers/droneAirspace/cards.js",
+      "src/i18n/index.js",
+      "src/i18n/locale.js",
+      "src/i18n/locales/ar.json",
+      "src/i18n/locales/de.json",
+      "src/i18n/locales/es.json",
+      "src/i18n/locales/fr.json",
+      "src/i18n/locales/it.json",
+      "src/i18n/locales/ja.json",
+      "src/i18n/locales/pt.json",
+      "src/i18n/locales/ru.json",
+      "src/i18n/locales/uk.json",
+      "src/i18n/locales/zh-CN.json",
+      "src/i18n/locales/zh-Hant.json"
+    ],
+    "external": ["cesium"]
+  },
+  "drone-airspace-source": {
+    "exports": ["./layers/drone-airspace/source"],
+    "modules": [
+      "src/layers/droneAirspace/records.js",
+      "src/sources/httpBody.js",
+      "src/layers/droneAirspace/source.js",
+      "src/i18n/marker.js"
+    ],
+    "external": []
+  },
   "tools": {
     "exports": ["./tools"],
     "modules": [
@@ -4715,6 +4849,8 @@
       "src/tools/queries/brief.js",
       "src/tools/queries/maritime.js",
       "src/tools/queries/share.js",
+      "src/data/firmsIntensity.js",
+      "src/data/firmsAdapt.js",
       "src/data/idSwitches.js",
       "src/data/vesselTypes.js",
       "src/data/layerState.js",
@@ -4849,6 +4985,7 @@
     "modules": [
       "src/view/index.js",
       "src/data/idSwitches.js",
+      "src/data/firmsIntensity.js",
       "src/data/layerState.js",
       "src/data/layerStateTokenReservations.json",
       "src/visualStylePolicy.js"

scripts/pinokio-environment.mjs

@@ -19,6 +19,8 @@ export const PINOKIO_CONFIG_FIELDS = Object.freeze([
   'LL2_API_TOKEN',
   'GEV_RATELIMIT_OPENAI_PER_MIN',
   'GEV_RATELIMIT_GOOGLE_PER_MIN',
+  'GEV_RATELIMIT_OPENAI_CHAT_PER_MIN',
+  'GEV_RATELIMIT_GEMINI_CHAT_PER_MIN',
   'PINOKIO_SHARE_CLOUDFLARE',
   'PINOKIO_SHARE_LOCAL',
   'PINOKIO_SHARE_VAR',

scripts/qa-scope-hud.mjs

@@ -5,8 +5,7 @@
  * Optional: QA_BASE_URL, QA_SCREENSHOT_DIR (screenshots stay outside the repo).
  * Proves a fresh boot defaults to Scope ON at 100%, native checkbox click/Space,
  * feather 0/11/100/200, layout independence,
- * share/scene restore, visible text backing including rotated metadata,
- * and Minimal's banner removal and coordinate/attribution clearance.
+ * share/scene restore, and visible text backing including rotated metadata.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -667,79 +666,6 @@ try {
     await settleTextBackings(false);
     checkSceneChrome(`narrow ${layout}`, before, await readSceneChrome());
   }
-  await page.select('#hud-layout-select', 'minimal');
-  for (const viewport of [
-    { width: 1600, height: 900 },
-    { width: 1024, height: 700 },
-    { width: 820, height: 700 },
-    { width: 390, height: 844 },
-  ]) {
-    await page.setViewport(viewport);
-    for (const enabled of [true, false]) {
-      await page.evaluate(
-        (enabled) =>
-          window.__godsEyeView.styleManager.applyVisualState({
-            scope: { enabled },
-          }),
-        enabled,
-      );
-      await settleTextBackings(enabled);
-      // Wait for the responsive shell and the real attribution logo to settle.
-      await page.waitForFunction(
-        (mobile) =>
-          document.body.classList.contains('mobile-shell') === mobile &&
-          [...document.querySelectorAll('#cesium-credits img')].some(
-            (img) => img.complete && img.naturalWidth > 0,
-          ),
-        {},
-        viewport.width <= 720,
-      );
-      const geometry = await page.evaluate(() => {
-        const banner = document.querySelector('#intel-hud .hud-bottom-bar');
-        const coordinates = document.querySelector(
-          '#intel-hud .hud-bottom-left',
-        );
-        // The fixed host has zero size; Cesium positions its actual row inside it.
-        const credits = document.querySelector(
-          '#cesium-credits .cesium-widget-credits',
-        );
-        const coordinateBox = coordinates.getBoundingClientRect();
-        const creditBox = credits.getBoundingClientRect();
-        return {
-          bannerHidden: getComputedStyle(banner).display === 'none',
-          coordinatesVisible:
-            coordinateBox.width > 0 && coordinateBox.height > 0,
-          coordinatesHidden: getComputedStyle(coordinates).display === 'none',
-          creditsVisible: creditBox.width > 0 && creditBox.height > 0,
-          gap: creditBox.top - coordinateBox.bottom,
-          bottom: getComputedStyle(coordinates).bottom,
-        };
-      });
-      const name = `Minimal ${viewport.width}px Scope ${enabled ? 'ON' : 'OFF'}`;
-      check(
-        `${name}: centred coordinate banner stays hidden`,
-        geometry.bannerHidden,
-        geometry,
-      );
-      if (viewport.width <= 720) {
-        check(
-          `${name}: phone keeps its compact HUD treatment`,
-          geometry.coordinatesHidden &&
-            geometry.creditsVisible &&
-            geometry.bottom === 'auto',
-          geometry,
-        );
-      } else {
-        check(
-          `${name}: coordinate block clears the full attribution row`,
-          geometry.coordinatesVisible &&
-            geometry.creditsVisible &&
-            geometry.gap >= 7.5,
-          geometry,
-        );
-      }
-    }
-  }
   check('runtime has no uncaught browser errors', errors.length === 0, errors);
 } finally {
   await browser.close();

scripts/qa-voice-routing.mjs

@@ -29,6 +29,7 @@
  *   node scripts/qa-voice-routing.mjs --layer behavior --deixis-only --headful --shots qa-shots/point-and-ask
  *   node scripts/qa-voice-routing.mjs --layer deixis --budget 12      # pointer_context routing (model turns)
  *   node scripts/qa-voice-routing.mjs --layer deixis-live --url ...   # in-app text turns (model turns)
+ *   node scripts/qa-voice-routing.mjs --layer behavior --behavior geometry   # areas, drawn counts, imagery
  *
  * House gotchas honored: camera.cancelFlight() before every teleport; puppeteer
  * suites must run sequentially with other harnesses (SwiftShader saturation);
@@ -75,7 +76,7 @@ const LAYER = getOpt('--layer', 'all'); // routing | behavior | all | deixis | d
 const TURN_BUDGET = Number(getOpt('--budget', '120'));
 const PHRASES_PER_SESSION = Number(getOpt('--batch', '6'));
 const ONLY = getOpt('--only', null); // substring filter on phrase text
-const BEHAVIOR = getOpt('--behavior', 'all'); // all | outlines | acceptance
+const BEHAVIOR = getOpt('--behavior', 'all'); // all | outlines | acceptance | geometry
 const DEIXIS_ONLY = process.argv.includes('--deixis-only'); // behavior: point-and-ask block only
 const HEADFUL = process.argv.includes('--headful'); // real GPU, visible window
 const SHOT_DIR = getOpt('--shots', null); // point-and-ask evidence screenshots
@@ -164,7 +165,11 @@ async function mintSession() {
     throw new Error(
       `token mint returned no client secret: ${JSON.stringify(body).slice(0, 160)}`,
     );
-  return { value, model };
+  // The tools this server offered (osm_query only with an operator Overpass).
+  const tools = new Set(
+    (body?.session?.tools || []).map((tool) => tool?.name).filter(Boolean),
+  );
+  return { value, model, tools };
 }
 
 /** One Realtime WS session that can run several text turns sequentially. */
@@ -371,8 +376,10 @@ async function runRoutingLayer() {
     }
     const batch = list.slice(i, i + PHRASES_PER_SESSION);
     let session;
+    let offered = new Set();
     try {
-      const { value, model } = await mintSession();
+      const { value, model, tools } = await mintSession();
+      offered = tools;
       session = new RoutingSession(value, model, evidence);
       await session.connect();
     } catch (e) {
@@ -390,6 +397,14 @@ async function runRoutingLayer() {
         skipped(`route: "${p.phrase}"`, 'turn budget exhausted');
         continue;
       }
+      const missing = (p.requires || []).filter((name) => !offered.has(name));
+      if (missing.length) {
+        skipped(
+          `route: "${p.phrase}"`,
+          `${missing.join(', ')} not offered (no configured Overpass)`,
+        );
+        continue;
+      }
       turnsUsed += 1;
       let calls = [];
       try {
@@ -1361,7 +1376,11 @@ async function runBehaviorLayer() {
     // The point-and-ask block skips the first-run launcher so its evidence
     // screenshots show the map; the full run keeps the historical URL.
     const behaviorUrl = new URL(APP_URL);
-    if (DEIXIS_ONLY || BEHAVIOR === 'acceptance')
+    if (
+      DEIXIS_ONLY ||
+      BEHAVIOR === 'acceptance' ||
+      BEHAVIOR === 'geometry'
+    )
       behaviorUrl.searchParams.set('welcome', '0');
     await page.goto(behaviorUrl.href, {
       waitUntil: 'domcontentloaded',
@@ -1420,6 +1439,10 @@ async function runBehaviorLayer() {
       await runOutlineAcceptance({ page, run, settle, overpassRequests });
       return;
     }
+    if (BEHAVIOR === 'geometry') {
+      await runGeometryScenarios({ page, run, settle, overpassRequests });
+      return;
+    }
 
     // (1) fly_to_location lands near the target. Annotations follow IMMEDIATELY
     // while the camera is local — the resolver's proximity gate rejects far
@@ -2340,6 +2363,8 @@ async function runBehaviorLayer() {
       resolverLog,
       packTimes,
     });
+    // Voice geometry last: it moves the camera and turns layers off.
+    await runGeometryScenarios({ page, run, settle, overpassRequests });
 
     const shotDir = path.join(ROOT, 'qa-shots');
     fs.mkdirSync(shotDir, { recursive: true });
@@ -2483,6 +2508,193 @@ const OUTLINE_ASKS = [
     { entityKind: 'building', latitude: 30.27472, longitude: -97.74035 }, 'building'],
 ].map(([group, target, lat, lon, height, extra = {}, shot = null]) => ({ group, target, lat, lon, height, extra, shot }));
 
+/**
+ * Voice geometry, runner-driven: reusable areas, drawn-area counts, a
+ * landmark area and recent imagery, all without a default Overpass request.
+ * Public Nominatim use is read from the server's daily count.
+ */
+async function runGeometryScenarios({ page, run, settle, overpassRequests }) {
+  const shotDir = path.join(ROOT, 'qa-shots', 'pr-geometry');
+  fs.mkdirSync(shotDir, { recursive: true });
+  const shot = (name) => page.screenshot({ path: path.join(shotDir, `${name}.png`) }).catch(() => {});
+  const nominatimStart = nominatimCount();
+  const overpassStart = overpassRequests.length;
+  const teleport = (lat, lon, height, pitch = -90) => page.evaluate(({ lat, lon, height, pitch }) => {
+    const { viewer } = window.__godsEyeView;
+    viewer.camera.cancelFlight();
+    viewer.camera.setView({
+      destination: viewer.scene.globe.ellipsoid.cartographicToCartesian({
+        longitude: (lon * Math.PI) / 180, latitude: (lat * Math.PI) / 180, height,
+      }),
+      orientation: { heading: 0, pitch: (pitch * Math.PI) / 180, roll: 0 },
+    });
+  }, { lat, lon, height, pitch });
+  const timings = {};
+
+  // (G1) "Outline Bagmati, then count fires inside it".
+  await teleport(27.7, 85.4, 400_000);
+  await settle(1500);
+  let t0 = Date.now();
+  const bagmati = await run('resolve_area', { query: 'Bagmati province', draw: true, flyTo: false });
+  timings.bagmatiMs = Date.now() - t0;
+  const bagmatiRefused = [
+    'AREA_IDENTITY_MISMATCH',
+    'AREA_IDENTITY_UNVERIFIED',
+  ].includes(bagmati?.code);
+  const bagmatiVerified =
+    bagmati?.ok === true &&
+    bagmati?.drawn === true &&
+    bagmati?.level === 'admin1' &&
+    bagmati?.name === 'Bagmati Province' &&
+    bagmati?.sourceIdentity === 'Bagmati Province';
+  report(
+    bagmatiVerified || bagmatiRefused,
+    'geometry: "outline Bagmati province" uses verified current identity or refuses honestly',
+    `areaId=${bagmati?.areaId} name=${bagmati?.name} sourceIdentity=${bagmati?.sourceIdentity} source=${bagmati?.source} km2=${bagmati?.areaKm2} ms=${timings.bagmatiMs} code=${bagmati?.code || ''} ${bagmati?.error || ''}`,
+  );
+  await settle(3000);
+  await shot('bagmati-outline');
+  t0 = Date.now();
+  let r = await run('resolve_area', { query: 'Bagmati province' });
+  report(
+    bagmatiVerified
+      ? r?.ok === true &&
+          r?.cached === true &&
+          r?.ms < 300 &&
+          r?.sourceIdentity === 'Bagmati Province'
+      : bagmatiRefused &&
+          r?.ok === false &&
+          r?.code === bagmati?.code &&
+          !r?.areaId,
+    'geometry: a repeated Bagmati request reuses only verified identity, never refused geometry',
+    `ok=${r?.ok} code=${r?.code || ''} areaId=${r?.areaId || ''} sourceIdentity=${r?.sourceIdentity || ''} cached=${r?.cached} ms=${r?.ms} roundTrip=${Date.now() - t0}`,
+  );
+  // A city no bundled pack holds: the guarded Nominatim outline route.
+  t0 = Date.now();
+  const kathmandu = await run('resolve_area', { query: 'Kathmandu', draw: true, flyTo: false });
+  timings.kathmanduMs = Date.now() - t0;
+  report(kathmandu?.ok === true && kathmandu?.drawn === true && kathmandu?.source === 'osm' && kathmandu?.areaKm2 > 10 && kathmandu?.areaKm2 < 2000,
+    'geometry: "outline Kathmandu" comes from the guarded Nominatim outline',
+    `areaId=${kathmandu?.areaId} source=${kathmandu?.source} km2=${kathmandu?.areaKm2} parts=${kathmandu?.parts} ms=${timings.kathmanduMs} err=${kathmandu?.code || ''} ${kathmandu?.error || ''}`);
+  await settle(2500);
+  await shot('kathmandu-outline');
+  r = await run('resolve_area', { query: 'Georgia' });
+  report(r?.ok === false && r?.needsClarification === true && (r?.candidates || []).length >= 2,
+    'geometry: an ambiguous area asks with candidates instead of guessing',
+    `candidates=${(r?.candidates || []).map((c) => `${c.name}/${c.level}/${c.country || ''}`).join(', ')}`,
+  );
+  if (bagmatiVerified) {
+    await run('set_layer_visibility', {
+      layerId: 'local-firms',
+      enabled: true,
+    });
+    let fires = null;
+    for (let attempt = 0; attempt < 10; attempt += 1) {
+      fires = await run('analyst_query', {
+        layers: ['local-firms'],
+        scope: { kind: 'area', areaId: bagmati.areaId },
+      });
+      if (fires?.ok || !['NOT_READY', 'LAYER_OFF'].includes(fires?.code)) break;
+      await settle(4000);
+    }
+    if (fires?.code === 'FEED_UNAVAILABLE') {
+      skipped(
+        'geometry: "count fires inside it" counts inside the verified Bagmati area',
+        `fires feed unavailable: ${fires?.error}`,
+      );
+    } else {
+      report(
+        fires?.ok === true &&
+          Number.isFinite(fires?.count) &&
+          /Bagmati/i.test(fires?.scopeLabel || '') &&
+          fires?.coverage?.scope === `area:${bagmati.areaId}`,
+        'geometry: "count fires inside it" counts inside the verified Bagmati area',
+        `count=${fires?.count} scopeLabel="${fires?.scopeLabel}" scope=${fires?.coverage?.scope} err=${fires?.error || ''}`,
+      );
+    }
+    await run('set_layer_visibility', {
+      layerId: 'local-firms',
+      enabled: false,
+    });
+  } else {
+    skipped(
+      'geometry: fire count waits for a verified Bagmati area',
+      `boundary refused with ${bagmati?.code || 'unknown error'}`,
+    );
+  }
+
+  // (G2) "Count flights inside the area I drew": the draw tool's own spec.
+  await teleport(30.27, -97.74, 600_000);
+  await run('set_layer_visibility', { layerId: 'flights', enabled: true });
+  for (let attempt = 0; attempt < 12; attempt += 1) {
+    r = await run('analyst_query', { layers: ['flights'], scope: { kind: 'anywhere' } });
+    if (r?.ok && r.count > 0) break;
+    await settle(5000);
+  }
+  const drawnBox = [[-99, 29], [-96.5, 29], [-96.5, 31.5], [-99, 31.5], [-99, 29]];
+  await page.evaluate((ring) => window.__gevAnnotations.annotate([{ type: 'area', manual: true, ring, label: 'QA drawn box' }]), drawnBox);
+  r = await run('analyst_query', { layers: ['flights'], scope: { kind: 'drawn' } });
+  const loaded = await run('analyst_query', { layers: ['flights'], scope: { kind: 'anywhere' } });
+  report(r?.ok === true && r?.scopeLabel === 'inside QA drawn box' && Number.isFinite(r?.count) && r.count <= (loaded?.count ?? Infinity),
+    'geometry: "count flights inside the area I drew" counts inside the drawn outline',
+    `count=${r?.count} of ${loaded?.count} loaded scopeLabel="${r?.scopeLabel}" err=${r?.error || ''}`);
+  await settle(2500);
+  await shot('drawn-area-count');
+  // Thousands of aircraft starve a SwiftShader page; the landmark lookup
+  // below has a 10 s budget.
+  await run('set_layer_visibility', { layerId: 'flights', enabled: false });
+  await run('clear_annotations', {});
+
+  // (G3) "Draw an area around the Ferry Building": the enclosing mapped area
+  // (Nominatim grounds, then the OpenFreeMap area holding it), else an
+  // approximate buffer — either way a drawn, reusable area.
+  await teleport(37.7955, -122.3937, 2500, -60);
+  await settle(1500);
+  t0 = Date.now();
+  const ferry = await run('resolve_area', { query: 'Ferry Building, San Francisco', around: true, flyTo: false });
+  timings.ferryMs = Date.now() - t0;
+  const ferryNear = Array.isArray(ferry?.bbox) && Math.abs(ferry.bbox[1] - 37.795) < 0.05 && Math.abs(ferry.bbox[0] + 122.394) < 0.05;
+  report(ferry?.ok === true && ferry?.drawn === true && ferryNear && (ferry?.approximate === true || ['osm', 'openfreemap'].includes(ferry?.source)),
+    'geometry: "draw an area around the Ferry Building" draws a reusable landmark area',
+    `areaId=${ferry?.areaId} source=${ferry?.source} approximate=${ferry?.approximate} basis=${ferry?.display?.basis} km2=${ferry?.areaKm2} ms=${timings.ferryMs} err=${ferry?.error || ''}`);
+  await settle(3000);
+  await shot('ferry-building-area');
+
+  // (G4) "Find recent imagery of this area": the Recent Imagery catalog for
+  // that area, the best acquisition pinned through the layer itself.
+  t0 = Date.now();
+  r = await run('find_imagery', { areaId: ferry?.areaId || 'missing' });
+  timings.imageryMs = Date.now() - t0;
+  const pinned = await page.evaluate(() => window.__godsEyeView.dataManager.layers.get('recent-imagery')?.module?.getSnapshot?.().pins?.a?.key || null);
+  if (r?.code === 'CATALOG_UNAVAILABLE' || r?.code === 'SEARCH_TIMEOUT') {
+    skipped('geometry: "find recent imagery of this area" pins the best acquisition', `catalog: ${r?.error}`);
+  } else {
+    report(r?.ok === true && (r?.count === 0 ? r?.shown === null : Boolean(r?.shown?.date) && String(pinned).endsWith(`:${r.shown.date}`)),
+      'geometry: "find recent imagery of this area" pins the best acquisition',
+      `count=${r?.count} shown=${JSON.stringify(r?.shown)} pinned=${pinned} ms=${timings.imageryMs} err=${r?.error || ''}`);
+  }
+  await settle(4000);
+  await shot('recent-imagery-area');
+  await run('set_layer_visibility', { layerId: 'recent-imagery', enabled: false });
+
+  // (G5) Bulk place search without an operator Overpass: a plain refusal.
+  const configured = await page.evaluate(() => fetch('/api/overpass/status').then((res) => res.json()).catch(() => null));
+  r = await run('osm_query', { what: 'hospitals' });
+  if (configured?.configured) {
+    skipped('geometry: place search without an operator Overpass is refused', 'this server has OVERPASS_UPSTREAMS');
+  } else {
+    report(r?.ok === false && r?.code === 'OVERPASS_NOT_CONFIGURED',
+      'geometry: place search without an operator Overpass is refused', `code=${r?.code} error=${r?.error}`);
+  }
+
+  const nominatimUsed = nominatimCount() - nominatimStart;
+  const overpass = overpassRequests.slice(overpassStart);
+  console.log(`  geometry timings: ${JSON.stringify(timings)}; public Nominatim requests: ${nominatimUsed}`);
+  report(overpass.length === 0, 'geometry: no Overpass request', overpass.slice(0, 3).join(' | ') || 'none');
+  report(nominatimUsed <= 15, 'geometry: public Nominatim requests within budget (15)', `used=${nominatimUsed}`);
+  await run('clear_annotations', {});
+}
+
 const NOMINATIM_STATE = path.join(ROOT, '.gev-cache', 'nominatim', 'state.json');
 function nominatimCount() {
   try {

scripts/qa-zoom-out-guard.mjs

@@ -0,0 +1,333 @@
+#!/usr/bin/env node
+/** Real-app zoom and tilt regression. Start a dev server, then run this file. */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import puppeteer from 'puppeteer';
+
+const origin = process.env.QA_BASE_URL || 'http://localhost:4173';
+const browser = await puppeteer.launch({
+  headless: true,
+  args: [
+    '--no-sandbox',
+    ...(process.platform === 'darwin'
+      ? ['--use-angle=metal', '--enable-gpu']
+      : [
+          '--use-gl=angle',
+          '--use-angle=swiftshader',
+          '--enable-unsafe-swiftshader',
+        ]),
+  ],
+  protocolTimeout: 120_000,
+});
+const errors = [];
+try {
+  const page = await browser.newPage();
+  page.on('pageerror', (error) => errors.push(error.message));
+  await page.setViewport({ width: 1200, height: 800 });
+  await page.goto(`${origin}/?welcome=0`, { waitUntil: 'domcontentloaded' });
+  await page.waitForFunction(
+    () =>
+      window.__godsEyeView?.viewer &&
+      window.__godsEyeView.viewer.scene.screenSpaceCameraController
+        .enableInputs &&
+      document.getElementById('loading-screen')?.classList.contains('hidden'),
+    { timeout: 90_000 },
+  );
+  const renderer = await page.evaluate(async () => {
+    const C = await import('/node_modules/cesium/Build/Cesium/index.js');
+    const { maxPitchForHeight } = await import('/src/app/zoomOutGuard.js');
+    const { readCameraTargetFrame } =
+      await import('/src/ui/cameraOrientationControls.js');
+    const viewer = window.__godsEyeView.viewer;
+    viewer.camera.cancelFlight();
+    viewer.trackedEntity = undefined;
+    // Explicit real renders make each gesture independent of host frame rate.
+    viewer.useDefaultRenderLoop = false;
+    const controller = viewer.scene.screenSpaceCameraController;
+    controller.inertiaZoom = 0;
+    controller.inertiaSpin = 0;
+    const original = viewer.camera.setView.bind(viewer.camera);
+    const qa = {
+      viewer,
+      guardWrites: 0,
+      targetPitch: () => readCameraTargetFrame(viewer)?.pitch,
+      history: [],
+      frame() {
+        viewer.scene.requestRender();
+        viewer.render();
+        qa.history.push({
+          height: viewer.camera._positionCartographic.height,
+          guardWrites: qa.guardWrites,
+          position: { ...viewer.camera.position },
+        });
+        if (qa.history.length > 80) qa.history.shift();
+      },
+      pose() {
+        return {
+          height: viewer.camera.positionCartographic.height,
+          pitch: viewer.camera.pitch,
+          maxPitch: maxPitchForHeight(
+            viewer.camera.positionCartographic.height,
+          ),
+          guardWrites: qa.guardWrites,
+        };
+      },
+      reset(height = 1_000_000, pitch = -35) {
+        viewer.camera.cancelFlight();
+        viewer.camera.lookAtTransform(C.Matrix4.IDENTITY);
+        original({
+          destination: C.Cartesian3.fromDegrees(0, 0, height),
+          orientation: { heading: 0, pitch: C.Math.toRadians(pitch), roll: 0 },
+        });
+        qa.frame();
+        qa.guardWrites = 0;
+      },
+    };
+    viewer.camera.setView = (options) => {
+      // Cesium itself also calls setView while processing touch movement.
+      if (new Error().stack.includes('/src/app/zoomOutGuard.js'))
+        qa.guardWrites++;
+      return original(options);
+    };
+    window.__zoomGuardQa = qa;
+    const gl = viewer.scene.context._gl;
+    const debug = gl.getExtension('WEBGL_debug_renderer_info');
+    return gl.getParameter(debug ? debug.UNMASKED_RENDERER_WEBGL : gl.RENDERER);
+  });
+  console.log(`[INFO] WebGL renderer: ${renderer}`);
+  const frame = (count = 1) =>
+    page.evaluate(async (n) => {
+      for (let i = 0; i < n; i++) {
+        window.__zoomGuardQa.frame();
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      }
+      return window.__zoomGuardQa.pose();
+    }, count);
+  const reset = (height, pitch) =>
+    page.evaluate((h, p) => window.__zoomGuardQa.reset(h, p), height, pitch);
+  const session = await page.createCDPSession();
+  for (const viewport of [
+    { width: 1200, height: 800 },
+    { width: 390, height: 844 },
+  ]) {
+    await page.setViewport(viewport);
+    await page.evaluate(() => window.__zoomGuardQa.viewer.resize());
+    const x = Math.round(viewport.width / 2);
+    const y = Math.round(viewport.height / 2);
+    await reset(1_000_000, -25);
+    await page.mouse.move(x, y);
+    await page.evaluate(
+      ({ x, y }) => {
+        window.__zoomGuardQa.viewer.canvas.dispatchEvent(
+          new WheelEvent('wheel', {
+            deltaY: 2400,
+            clientX: x,
+            clientY: y,
+            bubbles: true,
+            cancelable: true,
+          }),
+        );
+      },
+      { x, y },
+    );
+    const first = await frame();
+    console.log(`[INFO] ${viewport.width}px wheel delivered`);
+    const settled = await frame(40);
+    assert.ok(first.height > 1_000_000, 'wheel must move the real camera');
+    assert.ok(settled.guardWrites > 0, 'zoom guard must run');
+    assert.ok(
+      settled.pitch <= settled.maxPitch + 1e-6,
+      `stationary pitch must finish easing: ${JSON.stringify(settled)}`,
+    );
+    for (let i = 0; i < 12; i++) {
+      await page.evaluate(
+        ({ x, y }) => {
+          window.__zoomGuardQa.viewer.canvas.dispatchEvent(
+            new WheelEvent('wheel', {
+              deltaY: 2400,
+              clientX: x,
+              clientY: y,
+              bubbles: true,
+              cancelable: true,
+            }),
+          );
+        },
+        { x, y },
+      );
+      await frame();
+    }
+    const ceiling = await frame(40);
+    assert.ok(ceiling.height <= 40_000_001, 'user zoom respects the ceiling');
+    assert.ok(
+      ceiling.height > 39_000_000,
+      'exercise the ceiling, not a low orbit',
+    );
+    assert.ok(
+      ceiling.pitch <= ceiling.maxPitch + 1e-6,
+      `ceiling must settle: ${JSON.stringify(await page.evaluate(() => window.__zoomGuardQa.history))}`,
+    );
+    console.log(
+      `[PASS] ${viewport.width}px wheel, stationary easing and ceiling`,
+    );
+    if (process.env.QA_SCREENSHOT_DIR) {
+      fs.mkdirSync(process.env.QA_SCREENSHOT_DIR, { recursive: true });
+      await page.screenshot({
+        path: path.join(
+          process.env.QA_SCREENSHOT_DIR,
+          `zoom-ceiling-${viewport.width}.png`,
+        ),
+      });
+    }
+
+    await reset();
+    await page.mouse.move(x, y);
+    await page.keyboard.down('Control');
+    await page.mouse.down({ button: 'right' });
+    for (let i = 1; i <= 6; i++) {
+      await page.mouse.move(x, y + i * 3);
+      await frame();
+    }
+    await page.mouse.up({ button: 'right' });
+    await page.keyboard.up('Control');
+    const tilted = await frame(3);
+    assert.equal(
+      tilted.guardWrites,
+      0,
+      'Ctrl+right tilt must not trigger guard',
+    );
+    assert.ok(Math.abs(tilted.height - 1_000_000) > 1, 'tilt must move camera');
+
+    await reset();
+    const touches = (dy) => [
+      { x: x - 60, y: y + dy, id: 1 },
+      { x: x + 60, y: y + dy, id: 2 },
+    ];
+    await session.send('Input.dispatchTouchEvent', {
+      type: 'touchStart',
+      touchPoints: touches(0),
+    });
+    await frame();
+    for (let i = 1; i <= 6; i++) {
+      await session.send('Input.dispatchTouchEvent', {
+        type: 'touchMove',
+        touchPoints: touches(i * 3),
+      });
+      await frame();
+    }
+    await session.send('Input.dispatchTouchEvent', {
+      type: 'touchEnd',
+      touchPoints: [],
+    });
+    const translated = await frame(3);
+    assert.equal(
+      translated.guardWrites,
+      0,
+      'parallel two-finger tilt must not trigger guard',
+    );
+    assert.ok(
+      Math.abs(translated.height - 1_000_000) > 1,
+      'touch tilt must move camera',
+    );
+    console.log(
+      `[PASS] ${viewport.width}px Ctrl+right and parallel touch tilt`,
+    );
+    await reset(1_000_000, -35);
+    await page.evaluate(
+      ({ x, y }) => {
+        window.__zoomGuardQa.viewer.canvas.dispatchEvent(
+          new WheelEvent('wheel', {
+            deltaY: 120,
+            clientX: x,
+            clientY: y,
+            bubbles: true,
+            cancelable: true,
+          }),
+        );
+      },
+      { x, y },
+    );
+    const beforeTilt = await frame();
+    assert.ok(
+      beforeTilt.guardWrites > 0,
+      'wheel correction must be pending before UI tilt',
+    );
+    const targetPitchBeforeClick = await page.evaluate(() =>
+      window.__zoomGuardQa.targetPitch(),
+    );
+    assert.ok(
+      Number.isFinite(targetPitchBeforeClick),
+      'UI tilt fixture must have a ground target under the canvas center',
+    );
+    // Programmatic fixture resets precede moveEnd, so the button's published
+    // aria state may still describe the previous view. The action toggles the
+    // current target frame: angles shallower than -60 degrees are tilted.
+    const wasTilted = targetPitchBeforeClick > -Math.PI / 3;
+    await page.click('#tilt-map-view');
+    const uiTilt = await page.evaluate(
+      async (desiredDegrees) => {
+        const qa = window.__zoomGuardQa;
+        const desired = (desiredDegrees * Math.PI) / 180;
+        const started = performance.now();
+        const deadline = started + 3000;
+        while (performance.now() < deadline) {
+          qa.frame();
+          // The 650 ms animator can be numerically near its destination
+          // before it releases preUpdate. Finish its lifetime before resetting.
+          if (
+            performance.now() - started >= 700 &&
+            Math.abs(qa.targetPitch() - desired) < 1e-5
+          )
+            return { settled: true, guardWrites: qa.guardWrites };
+          await new Promise((resolve) => setTimeout(resolve, 16));
+        }
+        return {
+          settled: false,
+          guardWrites: qa.guardWrites,
+          pitch: qa.targetPitch(),
+        };
+      },
+      wasTilted ? -89 : -35,
+    );
+    assert.ok(
+      uiTilt.settled,
+      `UI tilt must reach its destination: ${JSON.stringify(uiTilt)}`,
+    );
+    assert.equal(
+      uiTilt.guardWrites,
+      beforeTilt.guardWrites,
+      'UI navigation handoff must cancel pending zoom correction',
+    );
+    console.log(
+      `[PASS] ${viewport.width}px UI tilt takes over a pending wheel correction`,
+    );
+
+    await reset(1_000_000, -25);
+    await session.send('Input.dispatchTouchEvent', {
+      type: 'touchStart',
+      touchPoints: touches(0),
+    });
+    await frame();
+    await session.send('Input.dispatchTouchEvent', {
+      type: 'touchMove',
+      touchPoints: [
+        { x: x - 35, y, id: 1 },
+        { x: x + 35, y, id: 2 },
+      ],
+    });
+    await frame();
+    await session.send('Input.dispatchTouchEvent', {
+      type: 'touchEnd',
+      touchPoints: [],
+    });
+    const pinched = await frame(40);
+    assert.ok(pinched.height > 1_000_000, 'pinch-out must move camera outward');
+    assert.ok(pinched.guardWrites > 0, 'pinch-out must trigger the guard');
+    assert.ok(pinched.pitch <= pinched.maxPitch + 1e-6);
+    console.log(`[PASS] ${viewport.width}px pinch-out settles below the limb`);
+  }
+  assert.deepEqual(errors, [], 'no JavaScript page errors');
+  console.log('[PASS] no JavaScript page errors');
+} finally {
+  await browser.close();
+}

scripts/voice-bench/phrases.mjs

@@ -90,8 +90,11 @@ export const CORE_PHRASES = Object.freeze([
 
   // — annotations —
   { phrase: 'Annotate the Texas State Capitol and its grounds', expect: 'annotate_map', typedArgs: [where('annotate_map', (a) => (a.annotations || []).some((x) => x.type === 'area'))] },
-  { phrase: 'Outline the state of Texas', expect: 'annotate_map', typedArgs: [where('annotate_map', (a) => (a.annotations || []).some((x) => x.type === 'area'))] },
-  { phrase: 'Outline Lady Bird Lake', expect: 'annotate_map', typedArgs: [where('annotate_map', (a) => (a.annotations || []).some((x) => x.type === 'area'))] },
+  // A named boundary outlines through resolve_area (a reusable handle the
+  // user can count or search inside); annotate_map is for marks.
+  { phrase: 'Outline the state of Texas', expect: 'resolve_area', args: { draw: true }, typedArgs: [where('resolve_area', (a) => a.draw === true)] },
+  // A lake is a water footprint as much as a boundary: either tool draws it.
+  { phrase: 'Outline Lady Bird Lake', expect: { oneOf: ['annotate_map', 'resolve_area'] }, typedArgs: [(c) => c.name === 'resolve_area' || (c.name === 'annotate_map' && (c.args?.annotations || []).some((x) => x.type === 'area'))] },
   { phrase: 'Draw the walking route from the Capitol to Zilker Park', expect: 'annotate_map', typedArgs: [where('annotate_map', (a) => (a.annotations || []).some((x) => x.type === 'route' && (x.mode ?? 'walking') === 'walking'))] },
   { phrase: 'How far is the Eiffel Tower from the Louvre?', expect: 'annotate_map', typedArgs: [where('annotate_map', (a) => (a.annotations || []).some((x) => x.type === 'arrow'))] },
   { phrase: 'Clear the map', expect: 'clear_annotations' },
@@ -219,7 +222,7 @@ export const COVERAGE_PROBE = Object.freeze([
   },
   {
     id: 'recent-imagery',
-    v2: { supported: true, correct: [[call('set_layer_visibility', { layerId: 'recent-imagery', enabled: true })]] },
+    v2: { supported: true, correct: [[call('find_imagery')], [call('set_layer_visibility', { layerId: 'recent-imagery', enabled: true })]] },
     utterance: 'Show recent satellite imagery of this area',
     scene: 'Austin',
     expect: 'enable recent-imagery for current view (no tool today) — must NOT toggle satellites data layer or silently switch basemap',
@@ -250,13 +253,8 @@ export const COVERAGE_PROBE = Object.freeze([
   },
   {
     id: 'fires-in-drawn-area',
-    // There is no drawn-area scope yet; the prompt says to say so. Any count
-    // presented as inside the drawn area is a faked capability.
-    v2: {
-      supported: false,
-      correct: [],
-      hallucinated: [where('analyst_query', (a) => (a.layers || []).includes('local-firms'))],
-    },
+    // The drawn-area scope exists: a count must be scoped to it.
+    v2: { supported: true, correct: [[where('analyst_query', (a) => (a.layers || []).includes('local-firms') && ['drawn', 'annotation', 'area'].includes(a.scope?.kind))]] },
     utterance: 'Count the fires inside the area I drew',
     scene: 'Los Angeles, fires layer on, an area drawn around Angeles National Forest',
     expect: 'analyst_query local-firms scoped to the drawn polygon (no polygon scope today)',
@@ -548,14 +546,42 @@ export function dialogueResult(dialogue, toolName, turn) {
   return byTurn[turn] ?? null;
 }
 
-// ── New capabilities (point-and-ask, layer reach) ─────────────────────────
+// ── New capabilities (voice geometry, point-and-ask, layer reach) ─────────
 //
-// ROUTING_PHRASES is the qa-voice-routing table, so that harness runs exactly
-// its own table. The benchmark runs CAPABILITY_EXTRAS as the separate
-// `capability` suite so the core suite stays comparable across tool versions.
+// ROUTING_PHRASES is the qa-voice-routing table (core + geometry + place
+// search), so that harness runs exactly its own table. The benchmark runs
+// CAPABILITY_EXTRAS as the separate `capability` suite so the core suite
+// stays comparable across tool versions.
+
+/** Areas, drawn-area counts and imagery: offered in every session. */
+export const GEOMETRY_PHRASES = Object.freeze([
+  { phrase: 'Outline Bagmati province', expect: 'resolve_area', args: { query: 'bagmati', draw: true } },
+  { phrase: 'Outline Kathmandu district', expect: 'resolve_area', args: { query: 'kathmandu' } },
+  { phrase: 'Show me the border of Punjab', expect: 'resolve_area', args: { query: 'punjab' } },
+  { phrase: 'Draw an area around the Ferry Building in San Francisco', expect: 'resolve_area', args: { around: true } },
+  { phrase: 'Count the fires inside Bagmati province', expect: { oneOf: ['analyst_query', 'resolve_area'] } },
+  { phrase: 'How many flights are inside the area I drew?', expect: 'analyst_query', typedArgs: [where('analyst_query', (a) => a.scope?.kind === 'drawn')] },
+  { phrase: 'How many ships are inside the area you just outlined?', expect: 'analyst_query', typedArgs: [where('analyst_query', (a) => a.scope?.kind === 'annotation' || a.scope?.kind === 'area')] },
+  { phrase: 'Show me recent satellite imagery of this area', expect: 'find_imagery' },
+  { phrase: 'Find the latest cloud-free satellite image here', expect: 'find_imagery', typedArgs: [where('find_imagery', (a) => typeof a.maxCloudPct === 'number' && a.maxCloudPct <= 20)] },
+  { phrase: 'Get me recent imagery of Kathmandu', expect: { oneOf: ['find_imagery', 'resolve_area'] } },
+]);
+
+/**
+ * Bulk place search: osm_query is offered only when the server has an
+ * operator Overpass, so the routing harness skips these otherwise.
+ */
+export const OVERPASS_PHRASES = Object.freeze([
+  { phrase: 'Show me all the hospitals in Kathmandu', expect: { oneOf: ['resolve_area', 'osm_query'] }, requires: ['osm_query'] },
+  { phrase: 'Find the police stations in view', expect: 'osm_query', args: { what: 'police' }, requires: ['osm_query'] },
+]);
 
 /** The full qa-voice-routing table. */
-export const ROUTING_PHRASES = CORE_PHRASES;
+export const ROUTING_PHRASES = Object.freeze([
+  ...CORE_PHRASES,
+  ...GEOMETRY_PHRASES,
+  ...OVERPASS_PHRASES,
+]);
 
 // Pointer context items in the app's own format (src/voice/pointerContext.js
 // output), sent as an inert system item just before the user's words.
@@ -569,6 +595,7 @@ const GROUND_POINTER = {
   ground: { lat: 30.2849, lon: -97.7341 }, screen: { x: 0.427, y: 0.547 },
 };
 const isPointer = (v) => String(v || '').toLowerCase() === 'pointer';
+const bagmati = { ok: true, areaId: 'area-1', name: 'Bagmati Province', level: 'admin1', drawn: true, say: 'Bagmati Province — about 20,000 km²' };
 const flightsInView = {
   ok: true,
   count: 3,
@@ -593,6 +620,14 @@ export const CAPABILITY_EXTRAS = Object.freeze([
   { phrase: 'Turn on the weather radar', expect: 'set_layer_visibility', typedArgs: [where('set_layer_visibility', (a) => a.layerId === 'weather-radar' && a.enabled === true)] },
   { phrase: 'Are there any hurricanes right now?', expect: { oneOf: ['analyst_query', 'set_layer_visibility'] }, typedArgs: [(c) => (c.args?.layers || []).includes('weather-cyclones') || c.args?.layerId === 'weather-cyclones'] },
   { phrase: 'Which bus is closest to the middle of the screen?', expect: 'analyst_query', typedArgs: [where('analyst_query', (a) => (a.layers || []).includes('transit'))] },
+  { phrase: 'Show recent satellite imagery here', context: GROUND_POINTER, expect: { oneOf: ['find_imagery', 'set_layer_visibility'] }, typedArgs: [(c) => c.name === 'find_imagery' || (c.name === 'set_layer_visibility' && c.args?.layerId === 'recent-imagery')] },
+  {
+    id: 'bagmati-then-fires',
+    turns: ['Outline Bagmati province', 'Count the fires inside it'],
+    results: { resolve_area: [bagmati] },
+    first: { expect: 'resolve_area' },
+    second: { expect: 'analyst_query', typedArgs: [where('analyst_query', (a) => (a.layers || []).includes('local-firms') && a.scope?.kind === 'area' && a.scope?.areaId === 'area-1')] },
+  },
   {
     id: 'flights-then-second',
     turns: ['How many flights are in view?', 'Track the second one'],

server/providers/cctv/catalog.js

@@ -28,6 +28,7 @@ import {
   loadNycSourcesFromOpenData,
   loadTorontoSourcesFromOpenData,
   loadFloridaSourcesFromOpenData,
+  loadHoustonSourcesFromOpenData,
   loadA22SourcesFromOpenDataHub,
 } from './sources.js';
 
@@ -166,6 +167,11 @@ const LIVE_PACKS = [
     enabled: () => envEnabled('CCTV_TAIWAN_ENABLED'),
     load: loadTaiwanSources,
   },
+  {
+    name: 'houston',
+    enabled: () => envOptIn('CCTV_HOUSTON_ENABLED'),
+    load: loadHoustonSourcesFromOpenData,
+  },
   {
     name: 'a22',
     enabled: () => envEnabled('CCTV_A22_ENABLED'),

server/providers/cctv/constants.js

@@ -443,6 +443,37 @@ export const NYC_ANCHORS = [
   { lat: 40.5795, lon: -74.1502 }, // Staten Island
 ];
 
+/** Houston TranStar cameras: one keyless JSON list for the metro (~1,000
+ * cameras with a numeric id). Frames are stills synthesized from that id on
+ * the city's snapshot host — never taken from the payload. The catalog is
+ * served as `application/javascript`; asking for `application/json` gets HTTP
+ * 406, so the loader accepts any media type. */
+export const HOUSTON_CAMERAS_URL =
+  'https://traffic.houstontranstar.org/data/layers/cctvSnapshots_json.js';
+/** The only origin Houston camera frames may come from. The catalog's `url`
+ * is a `showWin(...)` viewer helper and is ignored; the registered path is
+ * always this origin plus `/snapshots/cctv/<id>.jpg`. */
+export const HOUSTON_IMAGE_ORIGIN = 'https://www.houstontranstar.org/';
+export const HOUSTON_IMAGE_URL = (id) =>
+  `${HOUSTON_IMAGE_ORIGIN}snapshots/cctv/${id}.jpg`;
+/** Numeric TranStar snapshot ids: 3–5 digits, no leading zero. Id `0` is a
+ * different (non-snapshot) camera class in the same list. */
+export const HOUSTON_CAMERA_ID_RE = /^[1-9]\d{2,4}$/;
+export const DEFAULT_HOUSTON_MAX_SOURCES = 250;
+export const HOUSTON_MAX_CATALOG_BYTES = 4 * 1024 * 1024;
+/** Ground-elevation prior in metres. The TranStar payload carries none, and
+ * Houston sits a few metres above sea level. */
+export const HOUSTON_GROUND_ELEVATION_M = 15;
+/** Downtown Houston (Main @ Texas): the primary prioritization anchor. */
+export const HOUSTON_DOWNTOWN = { lat: 29.7604, lon: -95.3698 };
+export const HOUSTON_ANCHORS = [
+  { lat: 29.7604, lon: -95.3698 }, // Downtown
+  { lat: 29.739, lon: -95.461 }, // Uptown / Galleria
+  { lat: 29.71, lon: -95.398 }, // Texas Medical Center
+  { lat: 29.9902, lon: -95.3368 }, // IAH
+  { lat: 29.3013, lon: -94.7977 }, // Galveston
+];
+
 /** Autostrada del Brennero (A22, Brenner–Modena) webcams: the keyless Open
  * Data Hub (NOI Techpark, South Tyrol) tourism API republishes Autobrennero's
  * own camera list with coordinates, one request for the whole motorway

server/providers/cctv/normalize.js

@@ -410,6 +410,18 @@ export function isLikelyHongKongCoordinate(lat, lon) {
   );
 }
 
+/** Greater Houston (the Woodlands to Galveston, Katy to Baytown). Farther
+ * TranStar partners (Dallas, Columbus) are out of this city pack. */
+export function isLikelyHoustonCoordinate(lat, lon) {
+  return (
+    isPlausibleLatLon(lat, lon) &&
+    lat >= 29.2 &&
+    lat <= 30.35 &&
+    lon >= -96.05 &&
+    lon <= -94.7
+  );
+}
+
 /** Mainland Norway, with slack for the coast and the Finnmark border. */
 export function isLikelyNorwayCoordinate(lat, lon) {
   return (

server/providers/cctv/sources.js

@@ -127,6 +127,13 @@ import {
   A22_MAX_CATALOG_BYTES,
   A22_GROUND_ELEVATION_BY_KM,
   A22_DEFAULT_GROUND_ELEVATION_M,
+  HOUSTON_CAMERAS_URL,
+  HOUSTON_IMAGE_URL,
+  HOUSTON_CAMERA_ID_RE,
+  DEFAULT_HOUSTON_MAX_SOURCES,
+  HOUSTON_MAX_CATALOG_BYTES,
+  HOUSTON_GROUND_ELEVATION_M,
+  HOUSTON_ANCHORS,
 } from './constants.js';
 import {
   toFiniteNumber,
@@ -147,6 +154,7 @@ import {
   isLikelyCataloniaCoordinate,
   decodeNumericEntities,
   isLikelyNycCoordinate,
+  isLikelyHoustonCoordinate,
   isLikelyHongKongCoordinate,
   isLikelyNorwayCoordinate,
   isLikelyTorontoCoordinate,
@@ -3771,3 +3779,162 @@ export async function loadA22SourcesFromOpenDataHub() {
     return [];
   }
 }
+
+/**
+ * Label for one Houston TranStar camera: the interchange an operator
+ * recognises ("10 EAST @ SAN JACINTO").
+ *
+ * @param {object} record - Raw TranStar camera row.
+ * @param {string} cameraId - Derived stable id.
+ * @returns {string}
+ */
+export function houstonCameraName(record, cameraId) {
+  const name = String(record?.location ?? '').trim();
+  if (name) return name;
+  const short = String(cameraId || '').replace(/^houston-/, '');
+  return short ? `Houston Camera ${short}` : 'Houston Camera';
+}
+
+/**
+ * TranStar `dir` (the camera's side of the freeway) -> the travel direction
+ * of the nearest lanes, as TranStar's map script `translateCameraDirection`
+ * reads it. Only these four values are mapped; anything else is unknown.
+ */
+const HOUSTON_TRAVEL_HEADING_BY_SIDE = Object.freeze({
+  south: 90,
+  north: 270,
+  west: 180,
+  east: 0,
+});
+
+/**
+ * One Houston TranStar camera row -> one catalog source, or null.
+ *
+ * Frame URLs are synthesized from a validated numeric id on the pinned
+ * snapshot origin. The payload's `url` is a `showWin(...)` viewer helper
+ * and is ignored so a catalog edit cannot steer the frame proxy off-host.
+ * TranStar's `dir` is the side of the freeway the camera sits on, not the
+ * way it faces: TranStar's own map labels it "Traffic closest to the camera
+ * is traveling …" (South→Eastbound, North→Westbound, West→Southbound,
+ * East→Northbound). That travel direction is only a low-confidence prior
+ * for the view, so the heading stays estimated with the low-confidence
+ * pose; `None`, blank or unknown values fall back to the shared id-hash
+ * heading.
+ *
+ * @param {object} record - Raw TranStar camera row.
+ * @returns {?object}
+ */
+export function houstonCameraToSource(record) {
+  if (!record || typeof record !== 'object') return null;
+
+  const lat = toFiniteNumber(record.lat);
+  const lon = toFiniteNumber(record.lng);
+  if (!isLikelyHoustonCoordinate(lat, lon)) return null;
+
+  const rawId = String(record.id ?? '').trim();
+  if (!HOUSTON_CAMERA_ID_RE.test(rawId)) return null;
+  const cameraId = `houston-${rawId}`;
+  const imageUrl = HOUSTON_IMAGE_URL(rawId);
+  const name = houstonCameraName(record, cameraId);
+  const travelHeading =
+    HOUSTON_TRAVEL_HEADING_BY_SIDE[
+      String(record.dir ?? '')
+        .trim()
+        .toLowerCase()
+    ];
+
+  return {
+    id: cameraId,
+    name,
+    city: 'Houston',
+    cityId: 'houston',
+    provider: 'Houston TranStar',
+    lat,
+    lon,
+    headingDeg: Number.isFinite(travelHeading)
+      ? travelHeading
+      : fallbackHeadingFromId(cameraId),
+    headingConfidence: 'low',
+    pitchDeg: -18,
+    fovDeg: 44,
+    rangeM: 145,
+    mountHeightM: 8,
+    groundElevationM: HOUSTON_GROUND_ELEVATION_M,
+    feedType: 'image',
+    url: imageUrl,
+    snapshotUrl: imageUrl,
+    sourceKind: 'houston-transtar',
+    license:
+      'TranStar disclaimer — redistribution and external framing need TxDOT written permission',
+    code: cameraDisplayCode(name.toUpperCase()),
+  };
+}
+
+/**
+ * Fetch Houston TranStar cameras from the keyless `cctvSnapshots_json.js`
+ * catalog. Frames are stills on `www.houstontranstar.org`, registered from
+ * a validated numeric id rather than from the payload URL. The catalog host
+ * answers `Accept: application/json` with HTTP 406, so this request accepts
+ * any media type.
+ *
+ * @returns {Promise<Array<object>>} Normalized camera source objects.
+ */
+export async function loadHoustonSourcesFromOpenData() {
+  try {
+    const endpoint =
+      process.env.CCTV_HOUSTON_CAMERAS_URL || HOUSTON_CAMERAS_URL;
+    const resp = await fetch(endpoint, {
+      headers: { Accept: '*/*' },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(CCTV_SOURCE_FETCH_TIMEOUT_MS),
+    });
+    const discard = async () => {
+      try {
+        await resp.body?.cancel();
+      } catch {
+        /* no-op */
+      }
+      return [];
+    };
+    if (resp.status >= 300 && resp.status < 400) {
+      console.warn(
+        '[CCTV] Houston catalog redirected; redirects are not followed',
+      );
+      return discard();
+    }
+    if (!resp.ok) {
+      console.warn('[CCTV] Houston camera download failed:', resp.status);
+      return discard();
+    }
+    const payload = await readResponseJsonCapped(
+      resp,
+      HOUSTON_MAX_CATALOG_BYTES,
+    );
+    const rows = Array.isArray(payload?.cameras) ? payload.cameras : [];
+    const cameras = [];
+    const seen = new Set();
+    for (const record of rows) {
+      const camera = houstonCameraToSource(record);
+      if (!camera || seen.has(camera.id)) continue;
+      seen.add(camera.id);
+      cameras.push(camera);
+    }
+    const maxRaw = Number(
+      process.env.CCTV_HOUSTON_MAX_SOURCES || DEFAULT_HOUSTON_MAX_SOURCES,
+    );
+    const maxCount = Number.isFinite(maxRaw)
+      ? Math.max(8, Math.min(400, Math.floor(maxRaw)))
+      : DEFAULT_HOUSTON_MAX_SOURCES;
+    const prioritized = prioritizeSources(cameras, maxCount, HOUSTON_ANCHORS);
+    console.log(
+      `[CCTV] Loaded Houston camera sources: ${cameras.length} (using nearest ${prioritized.length})`,
+    );
+    return prioritized;
+  } catch (error) {
+    console.warn(
+      '[CCTV] Houston camera download error:',
+      error?.message || error,
+    );
+    return [];
+  }
+}

server/providers/common/boundedCache.js

@@ -0,0 +1,137 @@
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { promises as fsp } from 'node:fs';
+
+/**
+ * A bounded two-level cache for JSON answers: memory (entry count) and disk
+ * (entry count, total bytes, age). Every memory insertion goes through one
+ * function, so a disk hit is bounded like a fresh answer; disk writes are
+ * followed by a prune that removes expired files first, then the oldest,
+ * until both quotas hold.
+ *
+ * @param {object} options
+ * @param {string|null} options.dir Disk directory; null keeps memory only.
+ * @param {number} options.ttlMs Age past which an entry is not served.
+ * @param {number} [options.maxMemoryEntries]
+ * @param {number} [options.maxDiskEntries]
+ * @param {number} [options.maxDiskBytes]
+ * @param {() => number} [options.now]
+ */
+export function createBoundedCache({
+  dir,
+  ttlMs,
+  maxMemoryEntries = 60,
+  maxDiskEntries = 400,
+  maxDiskBytes = 256 * 1024 * 1024,
+  now = () => Date.now(),
+}) {
+  const memory = new Map();
+  let pruning = null;
+  let prunePending = false;
+
+  const fileFor = (key) =>
+    path.join(dir, `${createHash('sha1').update(key).digest('hex')}.json`);
+
+  function remember(key, entry) {
+    memory.delete(key);
+    memory.set(key, entry);
+    while (memory.size > maxMemoryEntries)
+      memory.delete(memory.keys().next().value);
+  }
+
+  async function prune() {
+    if (!dir) return;
+    let names;
+    try {
+      names = (await fsp.readdir(dir)).filter((name) => name.endsWith('.json'));
+    } catch {
+      return;
+    }
+    const files = [];
+    for (const name of names) {
+      const file = path.join(dir, name);
+      try {
+        const stat = await fsp.stat(file);
+        files.push({ file, size: stat.size, mtime: stat.mtimeMs });
+      } catch {
+        /* removed meanwhile */
+      }
+    }
+    const cutoff = now() - ttlMs;
+    const keep = [];
+    for (const entry of files) {
+      if (entry.mtime < cutoff) await fsp.rm(entry.file, { force: true });
+      else keep.push(entry);
+    }
+    keep.sort((a, b) => a.mtime - b.mtime);
+    let bytes = keep.reduce((sum, entry) => sum + entry.size, 0);
+    while (
+      keep.length &&
+      (keep.length > maxDiskEntries || bytes > maxDiskBytes)
+    ) {
+      const oldest = keep.shift();
+      bytes -= oldest.size;
+      await fsp.rm(oldest.file, { force: true });
+    }
+  }
+
+  /** Run one prune at a time; a request during a prune schedules one more. */
+  function schedulePrune() {
+    if (pruning) {
+      prunePending = true;
+      return pruning;
+    }
+    pruning = prune()
+      .catch(() => {})
+      .finally(() => {
+        pruning = null;
+        if (prunePending) {
+          prunePending = false;
+          schedulePrune();
+        }
+      });
+    return pruning;
+  }
+
+  return {
+    /** The cached value, or undefined. A disk hit is re-inserted into memory. */
+    async get(key) {
+      const held = memory.get(key);
+      if (held && now() - held.cachedAt <= ttlMs) return held.value;
+      if (held) memory.delete(key);
+      if (!dir) return undefined;
+      try {
+        const entry = JSON.parse(await fsp.readFile(fileFor(key), 'utf8'));
+        if (!Number.isFinite(entry?.cachedAt) || now() - entry.cachedAt > ttlMs)
+          return undefined;
+        remember(key, entry);
+        return entry.value;
+      } catch {
+        return undefined;
+      }
+    },
+    /** Store a value in memory and, when a directory is set, on disk. */
+    async set(key, value) {
+      const entry = { value, cachedAt: now() };
+      remember(key, entry);
+      if (!dir) return;
+      try {
+        await fsp.mkdir(dir, { recursive: true });
+        await fsp.writeFile(fileFor(key), JSON.stringify(entry));
+      } catch {
+        return;
+      }
+      // In the background: an answer never waits on a 400-file directory scan.
+      // `prune()` returns the pending pass for callers that need it done.
+      schedulePrune();
+    },
+    /** Run a prune and wait until no pass is running or queued. */
+    async prune() {
+      schedulePrune();
+      while (pruning) await pruning;
+    },
+    get memorySize() {
+      return memory.size;
+    },
+  };
+}

server/providers/common/textChat.js

@@ -0,0 +1,221 @@
+import { readRequestBody } from './request.js';
+import {
+  clientKey,
+  makeCostRateLimiter,
+  resolvePerMinuteCap,
+} from './rate-limit.js';
+import { waitForSignal } from '../../../src/sources/requestDeadline.js';
+import { readResponseJsonCapped } from '../../../src/sources/httpBody.js';
+import { isGeminiRequestOriginAllowed } from '../gemini/request.js';
+import { parseUsage } from './textTools.js';
+
+const MAX_BYTES = 512 * 1024;
+const FAILURE = 'Could not connect. Try again.';
+// A rejected key is not retried upstream for this long, unless the key changes.
+const REJECTED_KEY_COOLDOWN_MS = 60_000;
+
+// What an upstream failure says about the key or the account. Gemini answers
+// an invalid key with 400 and an ErrorInfo reason, not 401; OpenAI answers an
+// account without credit with 429 insufficient_quota, which waiting won't fix.
+// A 403 is the key's project, region or permissions, so it cools down too but
+// does not blame the key. Only small error bodies are read.
+async function upstreamRefusal(response, signal) {
+  const { status } = response;
+  if (status === 401) return 'API_KEY_REJECTED';
+  if (status === 403) return 'ACCESS_DENIED';
+  if (![400, 429].includes(status)) return null;
+  let error;
+  try {
+    error = (await readResponseJsonCapped(response, 16 * 1024, signal))?.error;
+  } catch {
+    return null;
+  }
+  if (
+    status === 400 &&
+    Array.isArray(error?.details) &&
+    error.details.some((detail) => detail?.reason === 'API_KEY_INVALID')
+  )
+    return 'API_KEY_REJECTED';
+  if (status === 429 && error?.code === 'insufficient_quota')
+    return 'QUOTA_EXCEEDED';
+  return null;
+}
+
+// Pass through only a delay in whole seconds, capped at an hour.
+function upstreamRetryAfter(response) {
+  const value = String(response.headers?.get?.('retry-after') ?? '').trim();
+  if (!/^\d{1,6}$/.test(value)) return null;
+  return String(Math.min(Math.max(Number(value), 1), 3600));
+}
+
+export function createTextChatHandler({
+  provider,
+  prepare,
+  parse,
+  fetchImpl = (...args) => fetch(...args),
+  resolveApiKey,
+  resolveHost = () => process.env.HOST,
+  resolveAllowedHosts = () => process.env.GEV_ALLOWED_HOSTS,
+  resolveRateLimit = () =>
+    process.env[`GEV_RATELIMIT_${provider.toUpperCase()}_CHAT_PER_MIN`],
+  // An unset chat throttle follows the provider's own cost throttle.
+  resolveProviderRateLimit = () => undefined,
+  providerPerMin = 30,
+  // Returns { error, code } when the route must refuse before any key is used.
+  refuse = () => null,
+  now = Date.now,
+  timeoutMs = 60000,
+} = {}) {
+  let limiter;
+  let rejected = null;
+  return async (req, res) => {
+    if (req.aborted || res.destroyed || res.writableEnded) return;
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', 'application/json; charset=utf-8');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    const reply = (status, value, code) => {
+      if (req.aborted || res.destroyed || res.writableEnded) return;
+      res.statusCode = status;
+      if (status >= 400) res.setHeader('Connection', 'close');
+      res.end(
+        JSON.stringify(
+          typeof value === 'string'
+            ? { error: value, ...(code ? { code } : {}) }
+            : value,
+        ),
+      );
+    };
+    if (req.method !== 'POST') {
+      res.setHeader('Allow', 'POST');
+      return reply(405, 'Method not allowed');
+    }
+    const lifetime = new AbortController();
+    const disconnect = () => {
+      if (!res.writableEnded) lifetime.abort();
+    };
+    req.once('aborted', disconnect);
+    res.once('close', disconnect);
+    const timer = setTimeout(() => lifetime.abort(), timeoutMs);
+    timer.unref?.();
+    let response;
+    let usage = null;
+    try {
+      if (
+        !isGeminiRequestOriginAllowed(req, resolveHost(), resolveAllowedHosts())
+      )
+        return reply(403, FAILURE);
+      const refusal = refuse();
+      if (refusal) return reply(503, refusal.error, refusal.code);
+      const apiKey = String(resolveApiKey() || '').trim();
+      if (!apiKey)
+        return reply(
+          503,
+          'Add an API key in Provider Settings',
+          'API_KEY_MISSING',
+        );
+      if (rejected && (rejected.key !== apiKey || now() >= rejected.until))
+        rejected = null;
+      if (rejected) {
+        res.setHeader(
+          'Retry-After',
+          String(Math.max(1, Math.ceil((rejected.until - now()) / 1000))),
+        );
+        return reply(502, FAILURE, rejected.code);
+      }
+      if (limiter === undefined)
+        limiter = makeCostRateLimiter(
+          resolveRateLimit(),
+          resolvePerMinuteCap(resolveProviderRateLimit(), providerPerMin),
+        );
+      if (limiter && !limiter(clientKey(req))) {
+        res.setHeader('Retry-After', '60');
+        return reply(429, FAILURE, 'RATE_LIMITED');
+      }
+      if (
+        !/^application\/json(?:\s*;|$)/i.test(req.headers['content-type'] || '')
+      )
+        return reply(415, FAILURE);
+      if (Number(req.headers['content-length']) > MAX_BYTES)
+        return reply(413, FAILURE);
+      const raw = await readRequestBody(req, MAX_BYTES, lifetime.signal);
+      let input;
+      try {
+        input = JSON.parse(raw);
+      } catch {
+        return reply(400, FAILURE);
+      }
+      const prepared = prepare(input);
+      if (!prepared) return reply(400, FAILURE);
+      if (prepared.errorStatus) return reply(prepared.errorStatus, FAILURE);
+      const { endpoint, body, headers } = prepared;
+      lifetime.signal.throwIfAborted();
+      const acquisition = Promise.resolve(
+        fetchImpl(endpoint, {
+          method: 'POST',
+          redirect: 'error',
+          signal: lifetime.signal,
+          headers: { 'Content-Type': 'application/json', ...headers(apiKey) },
+          body: JSON.stringify(body),
+        }),
+      );
+      void acquisition.then(
+        (late) => {
+          response = late;
+          if (lifetime.signal.aborted) void late.body?.cancel().catch(() => {});
+        },
+        () => {},
+      );
+      response = await waitForSignal(acquisition, lifetime.signal);
+      lifetime.signal.throwIfAborted();
+      if (response.redirected || (response.url && response.url !== endpoint))
+        throw new Error('Unexpected destination');
+      if (!response.ok) {
+        const refusal = await upstreamRefusal(response, lifetime.signal);
+        if (refusal) {
+          void response.body?.cancel().catch(() => {});
+          rejected = {
+            key: apiKey,
+            code: refusal,
+            until: now() + REJECTED_KEY_COOLDOWN_MS,
+          };
+          return reply(502, FAILURE, refusal);
+        }
+        void response.body?.cancel().catch(() => {});
+        if (![429, 503].includes(response.status)) return reply(502, FAILURE);
+        const retryAfter = upstreamRetryAfter(response);
+        if (retryAfter) res.setHeader('Retry-After', retryAfter);
+        return reply(
+          response.status,
+          FAILURE,
+          response.status === 429 ? 'RATE_LIMITED' : undefined,
+        );
+      }
+      const data = await readResponseJsonCapped(
+        response,
+        MAX_BYTES,
+        lifetime.signal,
+      );
+      lifetime.signal.throwIfAborted();
+      usage = parseUsage(provider, data);
+      const result = parse(data);
+      if (!result || JSON.stringify(result).includes(apiKey))
+        return reply(502, { error: FAILURE, usage });
+      reply(200, { ...result, usage });
+    } catch (error) {
+      reply(
+        error?.code === 'BODY_TOO_LARGE'
+          ? 413
+          : lifetime.signal.aborted
+            ? 504
+            : 502,
+        { error: FAILURE, usage },
+      );
+    } finally {
+      if (lifetime.signal.aborted)
+        void response?.body?.cancel().catch(() => {});
+      clearTimeout(timer);
+      req.off('aborted', disconnect);
+      res.off('close', disconnect);
+    }
+  };
+}

server/providers/common/textInstructions.js

@@ -0,0 +1,32 @@
+import { realtimeDirectives } from '../openai/instructions.js';
+
+// Voice wording in the shared directives and its written form. A test checks
+// each phrase still occurs in the directives, so rewording one there fails
+// rather than leaking spoken wording into chat.
+export const TEXT_WORDING = Object.freeze([
+  ['without speaking first', 'without writing a preamble'],
+  ['before speaking', 'before confirming'],
+  ['may first say ONE sentence', 'may first write ONE sentence'],
+  ["speak the result's say line", "write the result's say line"],
+  ['on the voice card: speak a caveat', 'in the tool result: include a caveat'],
+  ['as you talk', 'as you write'],
+  ['you can read aloud', 'you can report'],
+]);
+
+// Shared-manual adaptation follows Darren Dignam's GEV COMMAND approach (#976).
+// Keep our Radio handoff and annotation outcome policies from the shared manual.
+// `options.overpass` matches the tools offered, as for voice.
+export function textInstructions(annotationGuidance, options) {
+  return realtimeDirectives(annotationGuidance, options)
+    .map((line, index) => {
+      if (index === 0)
+        return "You are GEV Chat, a concise text assistant for a Cesium geospatial app called God's Eye View.";
+      if (index === 1)
+        return 'Have a natural written conversation. This is text-only chat; no microphone or generated audio is used.';
+      return TEXT_WORDING.reduce(
+        (text, [spoken, written]) => text.replace(spoken, written),
+        line,
+      );
+    })
+    .join('\n');
+}

server/providers/common/textTools.js

@@ -0,0 +1,54 @@
+import { validateValue } from '../../../src/tools/schema.js';
+
+export function invalidCalls(calls, tools) {
+  const schemas = new Map(tools.map((tool) => [tool.name, tool.parameters]));
+  return calls.flatMap((call, index) => {
+    const schema = schemas.get(call.name);
+    const errors = !schema
+      ? ['Unknown tool']
+      : call.parseError
+        ? ['Arguments must be valid JSON']
+        : validateValue(schema, call.args === undefined ? {} : call.args);
+    return errors.length
+      ? [{ index, error: errors.slice(0, 4).join('; ').slice(0, 1000) }]
+      : [];
+  });
+}
+
+// Missing usage stays unknown, never an invented zero-cost request.
+export function parseUsage(provider, data) {
+  const raw = provider === 'gemini' ? data?.usageMetadata : data?.usage;
+  const number = (value) =>
+    Number.isSafeInteger(value) && value >= 0 ? value : null;
+  const inputTokens = number(
+    provider === 'gemini' ? raw?.promptTokenCount : raw?.prompt_tokens,
+  );
+  const candidateTokens = number(
+    provider === 'gemini' ? raw?.candidatesTokenCount : raw?.completion_tokens,
+  );
+  const totalTokens = number(
+    provider === 'gemini' ? raw?.totalTokenCount : raw?.total_tokens,
+  );
+  if (inputTokens === null || candidateTokens === null || totalTokens === null)
+    return null;
+  const reasoningTokens =
+    number(
+      provider === 'gemini'
+        ? raw?.thoughtsTokenCount
+        : raw?.completion_tokens_details?.reasoning_tokens,
+    ) ?? 0;
+  const outputTokens =
+    candidateTokens + (provider === 'gemini' ? reasoningTokens : 0);
+  return {
+    inputTokens,
+    outputTokens,
+    totalTokens,
+    reasoningTokens,
+    cachedInputTokens:
+      number(
+        provider === 'gemini'
+          ? raw?.cachedContentTokenCount
+          : raw?.prompt_tokens_details?.cached_tokens,
+      ) ?? 0,
+  };
+}

server/providers/droneAirspace.js

@@ -0,0 +1,157 @@
+import { normalizeDroneAirspaceSnapshot } from '../../src/layers/droneAirspace/records.js';
+import { readResponseJsonCapped, coalesceProxyRequest } from './common/http.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
+import { admitSameSiteKeyless } from './common/same-site.js';
+
+// FAA Special Use Airspace (public, keyless). TYPE_CODE P (prohibited) and
+// R (restricted) only — the small, always-in-force slice of the national
+// SUA table. maxAllowableOffset trades ~100 m of boundary fidelity for a
+// payload small enough to refresh (~330 KB for the current P+R set).
+const API_URL =
+  'https://services6.arcgis.com/ssFJjBXIUyZDrSYZ/arcgis/rest/services/' +
+  'Special_Use_Airspace/FeatureServer/0/query?' +
+  new URLSearchParams({
+    where: "TYPE_CODE IN ('P','R')",
+    outFields: [
+      'NAME',
+      'TYPE_CODE',
+      'UPPER_VAL',
+      'UPPER_UOM',
+      'UPPER_CODE',
+      'LOWER_VAL',
+      'LOWER_UOM',
+      'LOWER_CODE',
+      'TIMESOFUSE',
+      'CONT_AGENT',
+      'CITY',
+      'STATE',
+      'OBJECTID',
+    ].join(','),
+    maxAllowableOffset: '0.001',
+    outSR: '4326',
+    f: 'geojson',
+  }).toString();
+
+const MAX_PAGES = 5;
+const MIB = 1024 * 1024;
+const SNAPSHOT_TTL_MS = 3_600_000;
+/** Longest a failed refresh keeps serving the last snapshot, marked stale. */
+const STALE_MAX_MS = 24 * 60 * 60 * 1000;
+
+const exceededTransferLimit = (payload) =>
+  payload?.exceededTransferLimit === true ||
+  payload?.properties?.exceededTransferLimit === true;
+
+/** Fixed-origin, bounded FAA SUA routes for dev and preview. */
+export function droneAirspaceProxy({
+  fetchImpl = (...args) => globalThis.fetch(...args),
+  now = () => Date.now(),
+} = {}) {
+  const cache = new Map();
+  const inFlight = new Map();
+  const allow = makeRateLimiter({ windowMs: 60_000, max: 60, globalMax: 1200 });
+
+  async function upstream(url, cap, timeout) {
+    const signal = AbortSignal.timeout(timeout);
+    const response = await fetchImpl(url, {
+      signal,
+      redirect: 'error',
+    });
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new Error('upstream_unavailable');
+    }
+    return readResponseJsonCapped(response, cap, signal);
+  }
+
+  // A snapshot is accepted only once the service says it is complete. A page
+  // limit reached while still flagged, a flagged page that adds nothing, or
+  // no valid zone at all is a failed refresh, so the last good snapshot stays.
+  async function fetchZones() {
+    const features = [];
+    let complete = false;
+    for (let page = 0; page < MAX_PAGES; page++) {
+      const url =
+        page === 0 ? API_URL : `${API_URL}&resultOffset=${features.length}`;
+      const payload = await upstream(url, 8 * MIB, 30_000);
+      if (!Array.isArray(payload?.features))
+        throw new Error('invalid_snapshot');
+      features.push(...payload.features);
+      if (!exceededTransferLimit(payload)) {
+        complete = true;
+        break;
+      }
+      if (!payload.features.length) break;
+    }
+    if (!complete) throw new Error('incomplete_snapshot');
+    const rows = normalizeDroneAirspaceSnapshot({ features });
+    if (!rows?.length) throw new Error('invalid_snapshot');
+    return { fetchedAt: now(), rows };
+  }
+
+  async function acquire(key, ttl, load) {
+    const previous = cache.get(key);
+    if (previous && now() - previous.savedAt < ttl)
+      return { value: previous.value, stale: false };
+    if (!inFlight.has(key) && inFlight.size >= 256)
+      throw Object.assign(new Error('busy'), { status: 429 });
+    try {
+      const { promise } = coalesceProxyRequest(inFlight, key, async () => {
+        const value = await load();
+        cache.set(key, { value, savedAt: now() });
+        return value;
+      });
+      return { value: await promise, stale: false };
+    } catch (error) {
+      // A failed refresh serves the last snapshot, marked stale, for a day.
+      if (previous && now() - previous.savedAt <= STALE_MAX_MS)
+        return { value: previous.value, stale: true };
+      throw error;
+    }
+  }
+
+  async function handler(req, res) {
+    const json = (status, value, stale = false) => {
+      if (res.destroyed) return;
+      res.writeHead(status, {
+        'Content-Type': 'application/json',
+        'Cache-Control': 'no-store',
+        ...(status === 405 ? { Allow: 'GET' } : {}),
+        ...(status === 429 ? { 'Retry-After': '60' } : {}),
+        ...(stale ? { 'X-Data-Stale': 'true' } : {}),
+      });
+      res.end(JSON.stringify(value));
+    };
+    // Keyless and needed to render the layer: refuse cross-site browsers
+    // before they spend a client's quota or start a refresh, but keep the
+    // documented reverse-proxy deployment working.
+    if (admitSameSiteKeyless(req, res)) return;
+    if (req.method !== 'GET') return json(405, { error: 'method_not_allowed' });
+    const path = (req.url || '/').split('?')[0];
+    if (path !== '/' && path !== '')
+      return json(404, { error: 'unknown_route' });
+    if (!allow(clientKey(req))) return json(429, { error: 'rate_limited' });
+    try {
+      const { value, stale } = await acquire(
+        'zones',
+        SNAPSHOT_TTL_MS,
+        fetchZones,
+      );
+      json(200, stale ? { ...value, stale: true } : value, stale);
+    } catch (error) {
+      json(error.status === 429 ? 429 : 502, {
+        error: 'drone_airspace_unavailable',
+      });
+    }
+  }
+
+  return {
+    name: 'drone-airspace',
+    configureServer({ middlewares }) {
+      middlewares.use('/api/drone-airspace', handler);
+    },
+    configurePreviewServer({ middlewares }) {
+      middlewares.use('/api/drone-airspace', handler);
+    },
+  };
+}

server/providers/gemini.js

@@ -1,8 +1,13 @@
+import { createGeminiChatHandler } from './gemini/chat.js';
 import { createGeminiTokenHandler } from './gemini/realtime.js';
 
 /** Mint constrained Live API credentials; the permanent key stays on Node. */
 function geminiLiveProxy({ annotationGuidance, realtime = {} } = {}) {
   function install(middlewares) {
+    middlewares.use(
+      '/api/gemini/chat',
+      createGeminiChatHandler({ ...realtime, annotationGuidance }),
+    );
     middlewares.use(
       '/api/gemini/token',
       createGeminiTokenHandler({ ...realtime, annotationGuidance }),

server/providers/gemini/chat.js

@@ -0,0 +1,188 @@
+import { createTextChatHandler } from '../common/textChat.js';
+import { invalidCalls } from '../common/textTools.js';
+import { textInstructions } from '../common/textInstructions.js';
+import { GEV_REALTIME_TOOLS, offeredTools } from '../openai/tools.js';
+import { resolveOverpassUpstreams } from '../overpass/constants.js';
+import { normalizeGeminiModel } from './config.js';
+
+// The Gemini token route's throttle default (GEV_RATELIMIT_GEMINI_PER_MIN).
+export const GEMINI_DEFAULT_PER_MIN = 30;
+
+const object = (value) =>
+  value && typeof value === 'object' && !Array.isArray(value);
+const keys = (value, allowed) =>
+  Object.keys(value).every((key) => allowed.includes(key));
+
+// Only text and function exchanges may cross this route, never media or config.
+export function validChatContents(contents, names) {
+  return (
+    Array.isArray(contents) &&
+    contents.length > 0 &&
+    contents.length <= 96 &&
+    contents.every(
+      (content) =>
+        object(content) &&
+        keys(content, ['role', 'parts']) &&
+        ['user', 'model'].includes(content.role) &&
+        Array.isArray(content.parts) &&
+        content.parts.length > 0 &&
+        content.parts.length <= 32 &&
+        content.parts.every((part) => {
+          if (
+            !object(part) ||
+            !keys(part, [
+              'text',
+              'functionCall',
+              'functionResponse',
+              'thoughtSignature',
+            ])
+          )
+            return false;
+          if (
+            part.thoughtSignature !== undefined &&
+            (typeof part.thoughtSignature !== 'string' ||
+              part.thoughtSignature.length > 32000 ||
+              content.role !== 'model')
+          )
+            return false;
+          if (Object.hasOwn(part, 'text'))
+            return (
+              keys(part, ['text', 'thoughtSignature']) &&
+              typeof part.text === 'string'
+            );
+          const call = part.functionCall ?? part.functionResponse;
+          if (
+            !object(call) ||
+            typeof call.name !== 'string' ||
+            call.name.length > 128 ||
+            (names && !names.has(call.name)) ||
+            (call.id !== undefined &&
+              (typeof call.id !== 'string' || call.id.length > 1024))
+          )
+            return false;
+          if (part.functionCall)
+            return (
+              content.role === 'model' &&
+              keys(part, ['functionCall', 'thoughtSignature']) &&
+              keys(call, ['name', 'args', 'id']) &&
+              (call.args === null || object(call.args ?? {}))
+            );
+          return (
+            content.role === 'user' &&
+            keys(part, ['functionResponse']) &&
+            keys(call, ['name', 'response', 'id']) &&
+            object(call.response)
+          );
+        }),
+    )
+  );
+}
+
+export function createGeminiChatHandler({
+  annotationGuidance,
+  tools = GEV_REALTIME_TOOLS,
+  // osm_query is offered, and the prompt names it, only with Overpass, as
+  // for voice.
+  overpassConfigured = () => resolveOverpassUpstreams().length > 0,
+  resolveChatModel = () =>
+    process.env.GEMINI_CHAT_MODEL || 'gemini-3.5-flash-lite',
+  resolveApiKey = () => process.env.GEMINI_API_KEY,
+  resolveProviderRateLimit = () => process.env.GEV_RATELIMIT_GEMINI_PER_MIN,
+  ...options
+} = {}) {
+  return createTextChatHandler({
+    ...options,
+    provider: 'gemini',
+    resolveApiKey,
+    resolveProviderRateLimit,
+    providerPerMin: GEMINI_DEFAULT_PER_MIN,
+    prepare(input) {
+      const model = normalizeGeminiModel(resolveChatModel());
+      if (!model || /live|audio|tts/i.test(model)) return { errorStatus: 503 };
+      if (
+        !object(input) ||
+        !keys(input, ['contents']) ||
+        !validChatContents(input.contents, null)
+      )
+        return null;
+      if (!pairedContents(input.contents)) return null;
+      const overpass = overpassConfigured();
+      return {
+        endpoint: `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent`,
+        headers: (key) => ({ 'x-goog-api-key': key }),
+        body: {
+          contents: input.contents,
+          systemInstruction: {
+            parts: [
+              { text: textInstructions(annotationGuidance, { overpass }) },
+            ],
+          },
+          tools: [
+            {
+              functionDeclarations: offeredTools(tools, { overpass }).map(
+                ({ name, description, parameters }) => ({
+                  name,
+                  description,
+                  parametersJsonSchema: parameters,
+                }),
+              ),
+            },
+          ],
+          generationConfig: {
+            responseModalities: ['TEXT'],
+            maxOutputTokens: 4096,
+            thinkingConfig: { thinkingLevel: 'LOW' },
+          },
+        },
+      };
+    },
+    parse(data) {
+      const candidate = data?.candidates?.[0];
+      const content = candidate?.content;
+      if (
+        !content ||
+        !validChatContents([content], null) ||
+        content.role !== 'model'
+      )
+        return null;
+      const calls = content.parts
+        .filter((part) => part.functionCall)
+        .map((part) => part.functionCall);
+      return {
+        content,
+        finishReason: candidate.finishReason,
+        invalidCalls: invalidCalls(
+          calls,
+          offeredTools(tools, { overpass: overpassConfigured() }),
+        ),
+      };
+    },
+  });
+}
+
+// Never forward an orphan result or an unfinished batch in browser history.
+function pairedContents(contents) {
+  let pending = [];
+  for (const content of contents) {
+    const calls = content.parts
+      .filter((part) => part.functionCall)
+      .map((part) => part.functionCall);
+    const results = content.parts
+      .filter((part) => part.functionResponse)
+      .map((part) => part.functionResponse);
+    if (pending.length) {
+      if (
+        calls.length ||
+        results.length !== pending.length ||
+        results.some(
+          (result, i) =>
+            result.name !== pending[i].name || result.id !== pending[i].id,
+        )
+      )
+        return false;
+      pending = [];
+    } else if (results.length) return false;
+    if (calls.length) pending = calls;
+  }
+  return !pending.length;
+}

server/providers/gemini/config.js

@@ -1,5 +1,5 @@
 import { realtimeInstructions } from '../openai/instructions.js';
-import { GEV_REALTIME_TOOLS } from '../openai/tools.js';
+import { GEV_REALTIME_TOOLS, offeredTools } from '../openai/tools.js';
 
 export const GEMINI_LIVE_MODEL_DEFAULT = 'gemini-3.8-live';
 export const GEMINI_TOKEN_ENDPOINT =
@@ -14,22 +14,26 @@ export function normalizeGeminiModel(value) {
   return /^gemini-[a-z0-9][a-z0-9.-]{0,119}$/.test(model) ? model : null;
 }
 
-/** REST BidiGenerateContentSetup fields, excluding its model resource name. */
+/**
+ * REST BidiGenerateContentSetup fields, excluding its model resource name.
+ * `overpass` says an operator configured Overpass, which `osm_query` needs.
+ */
 export function createGeminiLiveConfig(
   annotationGuidance,
   inputMode = 'open-mic',
   tools = GEV_REALTIME_TOOLS,
+  { overpass = false } = {},
 ) {
   if (!['open-mic', 'push-to-talk'].includes(inputMode))
     throw new Error('Invalid Gemini input mode');
   const config = {
     generationConfig: { responseModalities: ['AUDIO'] },
     systemInstruction: {
-      parts: [{ text: realtimeInstructions(annotationGuidance) }],
+      parts: [{ text: realtimeInstructions(annotationGuidance, { overpass }) }],
     },
     tools: [
       {
-        functionDeclarations: tools.map(
+        functionDeclarations: offeredTools(tools, { overpass }).map(
           ({ name, description, parameters }) => ({
             name,
             description,

server/providers/gemini/realtime.js

@@ -12,6 +12,7 @@ import {
   isGeminiRequestOriginAllowed,
   readGeminiTokenRequest,
 } from './request.js';
+import { resolveOverpassUpstreams } from '../overpass/constants.js';
 
 const UPSTREAM_RESPONSE_BYTES = 32 * 1024;
 const MINT_FAILURE = 'Gemini voice could not connect. Try again.';
@@ -19,6 +20,8 @@ const MINT_FAILURE = 'Gemini voice could not connect. Try again.';
 export function createGeminiTokenHandler({
   annotationGuidance,
   tools,
+  // osm_query is offered only when an operator configured Overpass.
+  overpassConfigured = () => resolveOverpassUpstreams().length > 0,
   fetchImpl = (...args) => fetch(...args),
   resolveApiKey = () => process.env.GEMINI_API_KEY,
   resolveModel = () =>
@@ -104,6 +107,7 @@ export function createGeminiTokenHandler({
         annotationGuidance,
         inputMode,
         tools,
+        { overpass: overpassConfigured() },
       );
       const issuedAt = now();
       // REST uses bidiGenerateContentSetup. liveConnectConstraints is the SDK

server/providers/local.js

@@ -28,6 +28,7 @@ import { weatherProxy } from './weather.js';
 import { firePerimetersProxy } from './firePerimeters.js';
 import { gnssIntegrityProxy } from './gnssIntegrity.js';
 import { ghostMapsProxy } from './ghostMaps.js';
+import { droneAirspaceProxy } from './droneAirspace.js';
 import { cycloneProxy } from './cyclones.js';
 import { windProxy } from './wind.js';
 
@@ -79,6 +80,7 @@ function localProviderPlugins({
     firePerimetersProxy(),
     gnssIntegrityProxy(),
     ghostMapsProxy(),
+    droneAirspaceProxy(),
     keySetupEndpoint(),
   ];
 }

server/providers/openai.js

@@ -1,3 +1,4 @@
+import { createOpenAiChatHandler } from './openai/chat.js';
 import { defaultSourceRoot } from './common/source-root.js';
 import { handleHudSummary } from './openai/hud-summary.js';
 import { createDebugLogHandler } from './openai/debug-log.js';
@@ -22,6 +23,10 @@ function openAiRealtimeProxy({
 } = {}) {
   const oauthLogin = createCodexOAuthLogin(realtime);
   function install(middlewares) {
+    middlewares.use(
+      '/api/openai/chat',
+      createOpenAiChatHandler({ ...realtime, annotationGuidance }),
+    );
     // Cost-bearing and log endpoints refuse cross-site browser requests
     // (see server/providers/common/same-site.js and SECURITY.md).
     middlewares.use('/api/openai/hud-summary', sameSiteGated(handleHudSummary));

server/providers/openai/chat.js

@@ -0,0 +1,169 @@
+import { createTextChatHandler } from '../common/textChat.js';
+import { preferCodexOAuth } from './codex-auth.js';
+import { OPENAI_DEFAULT_PER_MIN } from './rate-limit.js';
+import { invalidCalls } from '../common/textTools.js';
+import { textInstructions } from '../common/textInstructions.js';
+import { GEV_REALTIME_TOOLS, offeredTools } from './tools.js';
+import { resolveOverpassUpstreams } from '../overpass/constants.js';
+
+const object = (value) =>
+  value && typeof value === 'object' && !Array.isArray(value);
+const keys = (value, allowed) =>
+  Object.keys(value).every((key) => allowed.includes(key));
+const callShape = (call) =>
+  object(call) &&
+  keys(call, ['id', 'type', 'function']) &&
+  typeof call.id === 'string' &&
+  call.id.length > 0 &&
+  call.id.length <= 1024 &&
+  call.type === 'function' &&
+  object(call.function) &&
+  keys(call.function, ['name', 'arguments']) &&
+  typeof call.function.name === 'string' &&
+  call.function.name.length <= 128 &&
+  typeof call.function.arguments === 'string';
+function assistantShape(message) {
+  return (
+    object(message) &&
+    keys(message, ['role', 'content', 'tool_calls']) &&
+    message.role === 'assistant' &&
+    (message.content == null || typeof message.content === 'string') &&
+    (message.tool_calls === undefined ||
+      (Array.isArray(message.tool_calls) &&
+        message.tool_calls.length > 0 &&
+        message.tool_calls.length <= 32 &&
+        message.tool_calls.every(callShape) &&
+        new Set(message.tool_calls.map((call) => call.id)).size ===
+          message.tool_calls.length))
+  );
+}
+function validMessages(messages) {
+  if (!Array.isArray(messages) || !messages.length || messages.length > 96)
+    return false;
+  let pending = [];
+  for (const message of messages) {
+    if (!object(message)) return false;
+    if (pending.length) {
+      if (
+        !keys(message, ['role', 'content', 'tool_call_id']) ||
+        message.role !== 'tool' ||
+        typeof message.content !== 'string' ||
+        message.tool_call_id !== pending.shift()
+      )
+        return false;
+    } else if (message.role === 'user') {
+      if (
+        !keys(message, ['role', 'content']) ||
+        typeof message.content !== 'string'
+      )
+        return false;
+    } else if (assistantShape(message)) {
+      pending = (message.tool_calls || []).map((call) => call.id);
+    } else return false;
+  }
+  return !pending.length;
+}
+
+export function createOpenAiChatHandler({
+  annotationGuidance,
+  tools = GEV_REALTIME_TOOLS,
+  // osm_query is offered, and the prompt names it, only with Overpass, as
+  // for voice.
+  overpassConfigured = () => resolveOverpassUpstreams().length > 0,
+  resolveApiKey = () => process.env.OPENAI_API_KEY,
+  resolveChatModel = () => process.env.OPENAI_CHAT_MODEL || 'gpt-4.1-mini',
+  resolveProviderRateLimit = () => process.env.GEV_RATELIMIT_OPENAI_PER_MIN,
+  environment = process.env,
+  ...options
+} = {}) {
+  return createTextChatHandler({
+    ...options,
+    provider: 'openai',
+    resolveApiKey,
+    resolveProviderRateLimit,
+    providerPerMin: OPENAI_DEFAULT_PER_MIN,
+    // Chat can only bill the API key, which this operator lock forbids.
+    refuse() {
+      let error =
+        'ChatGPT OAuth is required by GEV_PREFER_CODEX_OAUTH, and typed OpenAI chat needs an API key.';
+      try {
+        if (!preferCodexOAuth(environment)) return null;
+      } catch (invalid) {
+        error = invalid.message;
+      }
+      return { error, code: 'CODEX_OAUTH_REQUIRED' };
+    },
+    prepare(input) {
+      const model = String(resolveChatModel()).trim();
+      if (
+        !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,119}$/.test(model) ||
+        /realtime|audio|tts/i.test(model)
+      )
+        return { errorStatus: 503 };
+      if (
+        !object(input) ||
+        !keys(input, ['messages']) ||
+        !validMessages(input.messages)
+      )
+        return null;
+      const overpass = overpassConfigured();
+      return {
+        endpoint: 'https://api.openai.com/v1/chat/completions',
+        headers: (key) => ({ Authorization: `Bearer ${key}` }),
+        body: {
+          model,
+          n: 1,
+          stream: false,
+          store: false,
+          max_completion_tokens: 4096,
+          messages: [
+            {
+              role: 'system',
+              content: textInstructions(annotationGuidance, { overpass }),
+            },
+            ...input.messages,
+          ],
+          tools: offeredTools(tools, { overpass }).map(
+            ({ name, description, parameters }) => ({
+              type: 'function',
+              function: { name, description, parameters, strict: false },
+            }),
+          ),
+        },
+      };
+    },
+    parse(data) {
+      const choice = data?.choices?.[0];
+      const raw = choice?.message;
+      if (!raw) return null;
+      const content = {
+        role: raw.role,
+        content: raw.content ?? null,
+        ...(raw.tool_calls?.length ? { tool_calls: raw.tool_calls } : {}),
+      };
+      if (
+        !assistantShape(content) ||
+        (!content.content && !content.tool_calls?.length)
+      )
+        return null;
+      const calls = (content.tool_calls || []).map((call) => {
+        try {
+          return {
+            name: call.function.name,
+            args: JSON.parse(call.function.arguments),
+          };
+        } catch {
+          return { name: call.function.name, parseError: true };
+        }
+      });
+      return {
+        content,
+        finishReason: choice.finish_reason,
+        invalidCalls: invalidCalls(
+          calls,
+          offeredTools(tools, { overpass: overpassConfigured() }),
+        ),
+      };
+    },
+  });
+}

server/providers/openai/instructions.js

@@ -1,8 +1,14 @@
 const DEFAULT_ANNOTATION_GUIDANCE =
   'Put related places in one annotate_map call. Set flyTo true only when the user is not already looking at the place (off-screen marks auto-frame, so when unsure leave it false). Do not say you are drawing or annotating — talk about the places while the marks appear. Marks ACCUMULATE AND PERSIST across flights and topics so the user can build up the map: never pass clearPrevious, and call clear_annotations ONLY when the user EXPLICITLY asks to clear or reset the map.';
 
-function realtimeInstructions(
+/**
+ * The Realtime session directives, one per line. `overpass` says an operator
+ * configured Overpass, which is what offers osm_query (see tools.js); without
+ * it the prompt never mentions the tool.
+ */
+function realtimeDirectives(
   annotationGuidance = DEFAULT_ANNOTATION_GUIDANCE,
+  { overpass = false } = {},
 ) {
   return [
     "You are GEV Voice Control, a concise voice controller for a Cesium geospatial app called God's Eye View.",
@@ -21,16 +27,20 @@ function realtimeInstructions(
     'For a request to enable an aircraft layer and SELECT or FIND the nearest/closest aircraft near a named place — for example, "Turn on flights and select the closest aircraft to Austin" — call select_nearest_aircraft once. It atomically turns on the requested aircraft layer first, waits for location arrival, refreshes that layer for the destination viewport, filters out landed/on-ground records, and selects the nearest airborne result. A healthy fallback feed is valid data, never an enable failure. Do not also call fly_to_location, set_layer_visibility, analyst_query, track_entity, set_context_mode, or control_cockpit for the same request.',
     'For ANALYTICAL questions about loaded layer data — how many / which / fastest / highest / biggest / nearest / next flights, ships, fires, earthquakes, satellites, launches, storms, transit, bikes, bases, datacenters or dams ("how many flights over Texas", "anything above 40,000 feet") — call analyst_query, not get_entity_context. Always set scope by WHERE: "around here" or "near this" while pointing is kind pointer, never view. Filter on the attribute the user names ("MODIS" → sensor eq MODIS). Say the count with its scope in a few words ("37 loaded flights over Texas") plus one or two examples by name. If the needed layer is off, say so and offer to turn it on. "Which of THOSE…" about the last answer → followUp=true with only the new filter/sort.',
     'WORLD QUERIES — the query tools (get_weather, get_wind, search_places, places_nearby, plan_route, get_cyclones, get_fire_perimeters, get_bike_share, get_transit_vehicles, get_traffic_flow, situation_brief, military_awareness and the other get_* and find_* tools you have) look up data anywhere in the world without changing the map and without any layer being on. Use them when the user asks about a place they are not looking at or data whose layer is off ("what is the weather in Tokyo", "how do I drive from Austin to Dallas", "any wildfires in California"). For aircraft, ships, earthquakes, active fires, datacenters, dams and satellites overhead, use analyst_query over the layers instead, turning the layer on first when the user wants it. Use analyst_query and get_entity_context for what the app has loaded or what is on screen. Answer from the result summary and data, mention its source when it has one, and never claim the map changed. If the user also wants to SEE it, use the matching app action (fly_to_location, set_layer_visibility) as well.',
-    'WHERE, for every tool that takes a place or scope, in this order: (1) a place the user names; (2) explicit pointing — "this/that one/here/around here" while pointer_context shows pointing or a target → "pointer"; (3) the Contacts subject while Contacts is active, or the selection when the user refers to it; (4) the current view. A selected datacenter, dam, fire or cable never silently becomes the centre.',
+    'WHERE, for every tool that takes a place or scope, in this order: (1) a place the user names, or an areaId you already have; (2) explicit pointing — "this/that one/here/around here" while pointer_context shows pointing or a target → "pointer"; (3) the Contacts subject while Contacts is active, or the selection when the user refers to it; (4) the current view. A selected datacenter, dam, fire or cable never silently becomes the centre.',
+    'AREAS: resolve_area turns a named boundary (country, state, province, county, city, district, natural region) into an areaId; to outline it pass draw=true; annotate_map is for marks, not boundaries. Count inside it → analyst_query kind=area with the areaId (or kind=region); "the area I drew" → kind=drawn; "the area you outlined" → kind=annotation. Imagery of a place → resolve_area, then find_imagery. Ambiguous name: call resolve_area; on needsClarification ask which, never guess.' +
+      (overpass
+        ? ' "All hospitals/schools/… in <place>" → resolve_area, then osm_query; in view → osm_query alone; follow-ups → analyst_query layers [osm-places], scope anywhere.'
+        : ''),
     'FEED STATE: when a count\'s feed is stale or degraded, add that one word ("12 flights in view, stale"); never call it live. If unavailable, give no number: say the feed is unavailable. Fallback feeds are valid data; name them only if asked.',
     'COUNTING CONTRACT — what "near" means. (1) While Contacts is ACTIVE, a bare "near / nearby / how many aircraft" means the settled Contacts subject window: its count is contactsWindow.aircraft. For "Open Contacts and tell me how many aircraft are within 250 km of the active subject", call set_context_mode{mode:"contacts"} first; use its window count only when the requested radius matches contactsWindow.radiusKm. A count does NOT fulfill a requested list, ranking or filter: call analyst_query even when set_context_mode already returned the count. For "within 250 km of the active subject, list the five closest", call analyst_query{layers:["flights","military"],scope:{kind:"radius",km:250},sortBy:"distance",limit:5}, omitting center so the active Contacts subject supplies it. Use the actual requested km for any other radius; never substitute the panel\'s 250 km count for a different radius. Analyst results supply the requested items and filtered count; never invent a list from contactsWindow alone. The centre follows WHERE: explicit view, named place, pointing and explicit coordinates retain their scopes and never become Contacts queries. Never invent center coordinates such as 0,0. With Contacts active but no subject yet, use the view and name that scope. (2) With Contacts OFF, "nearby" means in view; "near <place>" means a radius around that place. (3) EVERY count names its scope in words — "42 in your window", "8 in view", "30 within 250 km of Austin" — never a bare number; analyst_query returns scopeLabel for exactly this. Two numbers with named scopes are not a contradiction; say both if asked. (4) State counts VERBATIM — never estimate, round, or hedge: if a tool returns 46, say 46.',
     'When the target layer is unknown, OMIT layerId in track_entity so it searches all enabled layers. Passing the wrong layerId ("flights" for a military contact) returns "Nothing matched" even though the contact is loaded.',
     'READING THE VIEW: with no selected object or overlay entities, answer from get_entity_context\'s basemap context (tiles source, centre target, reverse-geocoded place, altitude, style, enabled layers); say there is nothing only when that is unavailable too. Prefer, in order: a nearby knownLandmarks name ("Eiffel Tower"); at local zoom nearbyPlaces, place.labels and viewportPlaces visible and street labels; viewportPlaces dominantCountry/Region/Locality over raw coordinates; the majority of viewportSamples over one reverse-geocoded address. Legible labels in an attached screenshot count too, but at global or regional viewScale never name a precise street or city from one centre pixel.',
     'Do not mention disabled layers or stale selections.',
-    'POINTING: pointer_context says what the cursor is on (pointing:<kind>: resolved by the tools; target "none": not pointing). For "this/that/here/that one" with no name, pass "pointer": get_entity_context scope, track_entity/fly_to_location query, analyst_query scope.kind ("around here" is pointer, not view), annotate_map target. "The second/last one" is referent:n from the last numbered list. Without a pointer, ask or follow WHERE.',
-    'PREAMBLES: for instant commands (layers, styles, HUD, detection, zoom, panels, basemap, radio controls, camera nudges, and lookups such as get_entity_context) call the tool without speaking first. Only for slow or multi-step work (annotate_map, a searched fly_to_location, select_nearest_aircraft, analyst_query over a named place, or two or more tools) you may first say ONE sentence of at most 12 words naming the actual steps ("Finding the Capitol, then outlining its grounds."), then call the tools at once in the same response.',
+    'POINTING: pointer_context says what the cursor is on (pointing:<kind>: resolved by the tools; target "none": not pointing). For "this/that/here/that one" with no name, pass "pointer": get_entity_context scope, track_entity/fly_to_location query, analyst_query scope.kind ("around here" is pointer, not view), annotate_map target, find_imagery area. "The second/last one" is referent:n from the last numbered list. Without a pointer, ask or follow WHERE.',
+    'PREAMBLES: for instant commands (layers, styles, HUD, detection, zoom, panels, basemap, radio controls, camera nudges, and lookups such as get_entity_context) call the tool without speaking first. Only for slow or multi-step work (annotate_map, resolve_area, find_imagery, a searched fly_to_location, select_nearest_aircraft, analyst_query over a named place, or two or more tools) you may first say ONE sentence of at most 12 words naming the actual steps ("Finding the Capitol, then outlining its grounds."), then call the tools at once in the same response.',
     'When one request contains MULTIPLE changes, call ALL the corresponding tools before the confirmation. Never confirm a partial subset; if one fails, say which.',
-    'AFTER TOOLS: speak the result\'s say line once, lightly rephrased at most, never repeating your preamble. For a requested analyst list or ranking, also name up to three returned items with the relevant returned values; keep their order. A count alone does not answer that request; if say is null, finish any remaining requested tools before confirming. Never add a count, list or action claim that the executed tool results do not support. Sources, notes and caveats are on the voice card: speak a caveat only when it changes the answer, or when asked why, how sure or which source. Lower bounds ("at least 500"), partial answers and stale, degraded or unavailable feed states in say are part of the answer — always preserve them. No filler or hedges ("let me check", "keep in mind", "it seems", "based on the data available"), and never add "approximately" to an exact tool number.',
+    'AFTER TOOLS: speak the result\'s say line once, lightly rephrased at most, never repeating your preamble. For a requested analyst list or ranking, also name up to three returned items with the relevant returned values; keep their order. A count alone does not answer that request; if say is null, finish any remaining requested tools before confirming. Never add a count, list or action claim that the executed tool results do not support. Sources, notes and caveats are on the voice card: speak a caveat only when it changes the answer, or when asked why, how sure or which source. Lower bounds ("at least 500"), partial answers, approximate outlines and stale, degraded or unavailable feed states in say are part of the answer — always preserve them. No filler or hedges ("let me check", "keep in mind", "it seems", "based on the data available"), and never add "approximately" to an exact tool number.',
     'For "show/open/turn on" layer requests, enable the matching layer. For "hide/close/turn off", disable it.',
     // INSTRUCTION-ONLY mapping for the two globe-scale named views.
     //
@@ -60,11 +70,15 @@ function realtimeInstructions(
     'For country and city destinations, omit rangeM so GEV frames the whole country or city in view. For landmarks and buildings, omit rangeM so GEV chooses a close landmark view.',
     'Only supply rangeM when the user asks for a particular numeric height, distance, closer view, or wider view.',
     'For relative requests such as "zoom out a little", "pull back", "zoom in more", or "get closer", always call adjust_camera_zoom. But "globe view", "whole earth", "the whole planet", or "zoom all the way out" is an ABSOLUTE framing: call zoom_to_globe once instead — repeated adjust_camera_zoom calls can never reach the globe. Never claim the camera moved without the tool returning ok=true.',
-    'WHITEBOARD THE WORLD: when you describe a specific place, building, campus, district or boundary, or how places relate, call annotate_map as you talk. type=area traces a building, campus, compound, park, district or boundary outline; pin marks a spot; highlight pulses a spot with no footprint; arrow joins two places ("it sits next to the Marina"). Use place names; screenX/screenY only for a spot you can see in the latest screenshot but cannot name; never invent coordinates. Set entityKind whenever you know what the target is.',
+    'WHITEBOARD THE WORLD: when you describe a specific place, building, campus or district, or how places relate, call annotate_map as you talk. type=area traces a building, campus, compound, park or district footprint; pin marks a spot; highlight pulses a spot with no footprint; arrow joins two places ("it sits next to the Marina"). Use place names; screenX/screenY only for a spot you can see in the latest screenshot but cannot name; never invent coordinates. Set entityKind whenever you know what the target is.',
     annotationGuidance,
     'annotate_map results: work any say line in naturally (places not found, a straight-line fallback with no travel time, or a full map — then ask before clearing). outlinePending means the boundary is still being traced: never claim it is drawn. A later map_annotation_outline system item reports each outcome; use it to quietly confirm or correct yourself.',
     'ROUTES vs DISTANCES: "walking/driving route from A to B" → type=route with the ordered points and the mode; the app draws the street path and reports distance and time you can read aloud. "How far is X from Y" or "X is next to Y" → type=arrow (straight-line distance), never route.',
-  ].join('\n');
+  ];
 }
 
-export { realtimeInstructions };
+function realtimeInstructions(annotationGuidance, options) {
+  return realtimeDirectives(annotationGuidance, options).join('\n');
+}
+
+export { realtimeInstructions, realtimeDirectives };

server/providers/openai/realtime.js

@@ -13,7 +13,8 @@ import {
   OPENAI_REALTIME_TRANSCRIBE_MODEL_DEFAULT,
 } from './constants.js';
 import { realtimeInstructions } from './instructions.js';
-import { GEV_REALTIME_TOOLS } from './tools.js';
+import { GEV_REALTIME_TOOLS, offeredTools } from './tools.js';
+import { resolveOverpassUpstreams } from '../overpass/constants.js';
 import {
   preferCodexOAuth,
   readCodexOAuthAccessToken,
@@ -136,6 +137,8 @@ function createRealtimeTokenHandler({
   environment = process.env,
   models = {},
   tools = GEV_REALTIME_TOOLS,
+  // osm_query is offered only when an operator configured Overpass.
+  overpassConfigured = () => resolveOverpassUpstreams().length > 0,
 } = {}) {
   return async (req, res) => {
     res.setHeader('Cache-Control', 'no-store');
@@ -273,6 +276,7 @@ function createRealtimeTokenHandler({
       transcribeModel.toLowerCase() === 'off'
         ? {}
         : { transcription: { model: transcribeModel } };
+    const overpass = overpassConfigured();
     const sessionConfig = {
       session: {
         type: 'realtime',
@@ -298,8 +302,8 @@ function createRealtimeTokenHandler({
           },
           output: { voice },
         },
-        instructions: realtimeInstructions(annotationGuidance),
-        tools,
+        instructions: realtimeInstructions(annotationGuidance, { overpass }),
+        tools: offeredTools(tools, { overpass }),
         tool_choice: 'auto',
       },
     };

server/providers/openai/toolDescriptions.js

@@ -405,7 +405,7 @@ export const ACTION_DESCRIPTIONS = {
   },
   annotate_map: {
     description:
-      'Mark places on the 3D map as you talk about them (see WHITEBOARD): pins, highlights, footprints and boundaries, arrows, routes and labels. Give place names (or explicit lat/lng); the app resolves real positions and outlines. Several places may go in one call.',
+      'Mark places on the 3D map as you talk about them (see WHITEBOARD): pins, highlights, footprints, arrows, routes and labels. Give place names (or explicit lat/lng); the app resolves real positions and outlines. Several places may go in one call.',
     $position: 1,
     parameters: {
       properties: {
@@ -547,9 +547,48 @@ export const ACTION_DESCRIPTIONS = {
       },
     },
   },
+  resolve_area: {
+    description:
+      'Named place → reusable areaId for analyst_query scope {kind:area} and other area tools. draw=true outlines it ("outline Bagmati province"); around=true is "an area around <landmark>": its enclosing mapped area, else a buffer marked approximate. needsClarification: ask which, then call again with its candidateId. AREA_TIMEOUT: retry once.',
+    $position: 1,
+    parameters: {
+      properties: {
+        query: {
+          description: 'The place as said, with any kind word.',
+          $position: 1,
+        },
+        level: {
+          description: 'Only when the user names the kind.',
+          $position: 1,
+        },
+        within: {
+          description: 'Country or state the user added.',
+          $position: 1,
+        },
+      },
+    },
+  },
+  find_imagery: {
+    description:
+      'Recent satellite imagery (Sentinel-2/Landsat 30 m, VIIRS daily; last 30 days): pins the best acquisition in the Recent Imagery panel. areaId from resolve_area; area=pointer for "this spot"; omit for the view. BOX_REFUSED: offer to zoom in. DISPLACED: leave it.',
+    $position: 1,
+    parameters: {
+      properties: {
+        maxCloudPct: {
+          description: '"cloud-free" → 10.',
+          $position: 1,
+        },
+      },
+    },
+  },
+  osm_query: {
+    description:
+      'OpenStreetMap places of one kind ("hospitals in Kathmandu"). areaId from resolve_area; omit for the view. Shows them in OSM Places with numbered referents; they become the last answer. countScope bounding-box means an approximate count. OSM_TIMEOUT: retry once.',
+    $position: 1,
+  },
   analyst_query: {
     description:
-      'Counts, lists, superlatives and attribute filters over records loaded by ENABLED layers — "how many flights over Texas", "biggest fire near LA", "ships headed to Oakland", "next rocket launch". A requested list or ranking requires this tool even after set_context_mode returned a Contacts count; that count alone has no requested items. complete:false means the count is a floor ("at least") and rankings cover the records examined; partial names unanswered layers. Items carry lat/lon for a follow-up fly_to_location. ok:false codes: LAYER_OFF (offer to enable), NOT_READY (loading), FOLLOW_UP_MISMATCH (ask again without followUp), UNKNOWN_FIELD/UNKNOWN_SCOPE/BAD_VALUE (retry with the allowed values). Aircraft emergency fields describe broadcasts, not confirmed incidents: narrate emergencyBroadcast with emergencySource. emergencyKind values are general, unlawful, nordo, downed, minfuel and lifeguard; GEV treats the last two as priorities (emergency:false). lastContactAtMs says when the transponder was last heard, not when the status arrived.',
+      'Counts, lists, superlatives and attribute filters over records loaded by ENABLED layers — "how many flights over Texas", "biggest fire near LA", "ships headed to Oakland", "next rocket launch". A requested list or ranking requires this tool even after set_context_mode returned a Contacts count; that count alone has no requested items. complete:false means the count is a floor ("at least") and rankings cover the records examined; partial names unanswered layers. Items carry lat/lon for a follow-up fly_to_location. ok:false codes: LAYER_OFF (offer to enable), NOT_READY (loading), NEEDS_CLARIFICATION (ask which), FOLLOW_UP_MISMATCH (ask again without followUp), UNKNOWN_FIELD/UNKNOWN_SCOPE/BAD_VALUE (retry with the allowed values). Aircraft emergency fields describe broadcasts, not confirmed incidents: narrate emergencyBroadcast with emergencySource. emergencyKind values are general, unlawful, nordo, downed, minfuel and lifeguard; GEV treats the last two as priorities (emergency:false). lastContactAtMs says when the transponder was last heard, not when the status arrived.',
     $position: 1,
     parameters: {
       properties: {
@@ -560,7 +599,7 @@ export const ACTION_DESCRIPTIONS = {
         },
         scope: {
           description:
-            'Always set it (see WHERE). Explicit "in view" uses view; "nearby" uses view when Contacts is off. Around the active Contacts subject uses radius with the requested km and center omitted, never view: the five closest within 250 km use scope:{kind:"radius",km:250}, sortBy:"distance", limit:5. For another requested radius use its actual km, not 250. pointer = "around here/this" while pointing (radius at the cursor); region = "over Texas"; radius with center {lat, lon} = "near <place>" or explicit coordinates; anywhere = no place ("biggest anywhere", "today"). Preserve explicit view, named place, pointer and explicit center even while Contacts is active; never invent coordinates. There is no drawn-area scope yet: say so rather than answering for the view.',
+            'Always set it (see WHERE). Explicit "in view" uses view; "nearby" uses view when Contacts is off. Around the active Contacts subject uses radius with the requested km and center omitted, never view: the five closest within 250 km use scope:{kind:"radius",km:250}, sortBy:"distance", limit:5. For another requested radius use its actual km, not 250. pointer = "around here/this" while pointing (radius at the cursor); region = "over Texas"; radius with center {lat, lon} = "near <place>" or explicit coordinates; anywhere = no place ("biggest anywhere", "today"); area + areaId from resolve_area; drawn = "the area I drew"; annotation = "the area you outlined". Preserve explicit view, named place, pointer and explicit center even while Contacts is active; never invent coordinates.',
           $position: 2,
           properties: {
             name: {

server/providers/openai/tools.js

@@ -1,6 +1,7 @@
 import { createActionTools } from '../../../src/voice/actionSchemas.js';
 import { ACTION_DESCRIPTIONS } from './toolDescriptions.js';
 
+/** Every voice tool, as the Realtime session describes them. */
 export const GEV_REALTIME_TOOLS = createActionTools(ACTION_DESCRIPTIONS);
 
 /**
@@ -14,3 +15,27 @@ export function realtimeSessionTools(additional = []) {
     ...additional.filter((tool) => !names.has(tool.name)),
   ];
 }
+
+/** Tools that need an operator-configured Overpass (OVERPASS_UPSTREAMS). */
+export const OVERPASS_ONLY_TOOLS = Object.freeze(['osm_query']);
+
+/**
+ * The tools one session is offered. Bulk OpenStreetMap place search runs
+ * only on an operator's Overpass, so without one `osm_query` is left out
+ * rather than offered and refused.
+ * @param {Array<{name: string}>} tools
+ * @param {{overpass?: boolean}} [options]
+ */
+export function offeredTools(tools, { overpass = false } = {}) {
+  return overpass
+    ? tools
+    : tools.filter((tool) => !OVERPASS_ONLY_TOOLS.includes(tool.name));
+}
+
+/**
+ * The app actions one session is offered.
+ * @param {{overpass?: boolean}} [options]
+ */
+export function realtimeTools({ overpass = false } = {}) {
+  return offeredTools(GEV_REALTIME_TOOLS, { overpass });
+}

server/providers/overpass.js

@@ -28,6 +28,7 @@ import {
   overpassNotConfigured,
 } from './overpass/transport.js';
 import { installRouteMiddleware } from './places/routes.js';
+import { installOsmFeaturesRoute } from './overpass/osmFeaturesRoute.js';
 
 /** @type {Map<string,Promise>} In-flight Overpass requests keyed by normalized query body. */
 const _overpassInFlight = new Map();
@@ -274,6 +275,7 @@ function overpassProxy({ routing = {} } = {}) {
     });
 
     installRouteMiddleware(server.middlewares, routing);
+    installOsmFeaturesRoute(server.middlewares);
   };
   return {
     name: 'overpass-proxy',

server/providers/overpass/osmFeatures.js

@@ -0,0 +1,205 @@
+import { OSM_PRESETS } from '../../../src/data/osmPresets.js';
+
+/**
+ * Bounded, typed OpenStreetMap feature search: one preset from the curated
+ * table inside a bounding box.
+ *
+ * The request carries a preset id, a box, a mode and a limit — never query
+ * text. The server writes the Overpass query itself and bounds it: box size
+ * per mode (a count may cover more ground than a fetch), result count,
+ * Overpass timeout and memory, response bytes, and one query in flight. It
+ * runs only against the operator's `OVERPASS_UPSTREAMS`; the generic
+ * `/api/overpass` guard is untouched.
+ *
+ * There is deliberately no boundary (`area`) filter: Overpass servers differ
+ * in whether they hold area data, and one without it answers zero rather than
+ * failing. The browser filters the box's features by the exact area geometry
+ * instead, so a count inside a province is exact and a box count is labelled
+ * as a box count.
+ */
+export const OSM_FEATURE_LIMITS = Object.freeze({
+  /** Largest box a fetch may cover, in square degrees (~200 × 200 km at the equator). */
+  maxFetchDeg2: 4,
+  /** Largest box a count may cover. */
+  maxCountDeg2: 36,
+  /** Most features one fetch returns. */
+  maxLimit: 1000,
+  /** Overpass server-side timeout, seconds: it gives up before we stop waiting. */
+  timeoutS: 20,
+  /** Overpass server-side memory cap, bytes. */
+  maxsize: 64 * 1024 * 1024,
+  /** Response bytes read from the upstream. */
+  maxResponseBytes: 16 * 1024 * 1024,
+  /** Per-upstream wait: the Overpass timeout plus transfer time. */
+  upstreamTimeoutMs: 22_000,
+  /**
+   * The whole search, across every configured endpoint in turn. It ends
+   * before the voice answer's own deadline (`OSM_QUERY_LIMITS.budgetMs` in
+   * `src/voice/osmActions.js`, 25 s): a browser that gives up first closes
+   * the request, which cancels the upstream query, so nothing would be
+   * cached for the retry.
+   */
+  upstreamBudgetMs: 22_000,
+});
+
+/** Tags a returned feature keeps, besides the preset's own. */
+const KEPT_TAGS = [
+  'name',
+  'name:en',
+  'operator',
+  'brand',
+  'opening_hours',
+  'wheelchair',
+  'emergency',
+  'healthcare',
+  'addr:street',
+  'addr:city',
+];
+
+const quote = (text) =>
+  `"${String(text).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+
+/**
+ * Parse and bound a request. Returns the compiled query or a refusal.
+ * @param {{preset: string, bbox: string|number[], mode?: string, limit?: string|number}} request
+ * @returns {{ok: true, ql: string, mode: string, preset: object, limit: number, boxes: number[][]}|{ok: false, code: string, error: string}}
+ */
+export function compileOsmFeatureQuery(request = {}) {
+  const refuse = (code, error) => ({ ok: false, code, error });
+  const presetId = String(request.preset || '');
+  const preset = Object.hasOwn(OSM_PRESETS, presetId)
+    ? OSM_PRESETS[presetId]
+    : null;
+  if (!preset) return refuse('UNKNOWN_PRESET', 'Unknown feature kind.');
+  const mode = request.mode === 'count' ? 'count' : 'features';
+  const parts = (
+    Array.isArray(request.bbox)
+      ? request.bbox
+      : String(request.bbox || '').split(',')
+  ).map(Number);
+  if (parts.length !== 4 || !parts.every(Number.isFinite))
+    return refuse('BAD_BOX', 'bbox needs west,south,east,north.');
+  const [west, south, east, north] = parts;
+  if (
+    Math.abs(west) > 180 ||
+    Math.abs(east) > 180 ||
+    south < -90 ||
+    north > 90 ||
+    south >= north ||
+    west === east
+  )
+    return refuse('BAD_BOX', 'bbox edges are out of range.');
+  // A box crossing the antimeridian is searched as its two halves.
+  const boxes =
+    west < east
+      ? [[south, west, north, east]]
+      : [
+          [south, west, north, 180],
+          [south, -180, north, east],
+        ];
+  const deg2 = boxes.reduce((sum, [s, w, n, e]) => sum + (n - s) * (e - w), 0);
+  const cap =
+    mode === 'count'
+      ? OSM_FEATURE_LIMITS.maxCountDeg2
+      : OSM_FEATURE_LIMITS.maxFetchDeg2;
+  if (deg2 > cap)
+    return refuse(
+      'AREA_TOO_LARGE',
+      mode === 'count'
+        ? 'That area is too large to search; narrow it down.'
+        : 'That area is too large to list; count first or narrow it down.',
+    );
+  // An absent or empty limit is the default, not Number(null) = 0.
+  const requested =
+    request.limit === null ||
+    request.limit === undefined ||
+    String(request.limit).trim() === ''
+      ? NaN
+      : Number(request.limit);
+  const limit = Math.max(
+    1,
+    Math.min(
+      OSM_FEATURE_LIMITS.maxLimit,
+      Number.isFinite(requested) ? Math.trunc(requested) : 500,
+    ),
+  );
+  const selectors = [];
+  for (const [key, value] of preset.tags)
+    for (const [s, w, n, e] of boxes)
+      selectors.push(
+        `nwr[${quote(key)}=${quote(value)}](${s},${w},${n},${e});`,
+      );
+  const ql =
+    `[out:json][timeout:${OSM_FEATURE_LIMITS.timeoutS}][maxsize:${OSM_FEATURE_LIMITS.maxsize}];` +
+    `(${selectors.join('')});` +
+    (mode === 'count' ? 'out count;' : `out center tags ${limit};`);
+  return { ok: true, ql, mode, preset, limit, boxes };
+}
+
+/**
+ * Overpass JSON → the compact answer the browser gets.
+ * @param {object} payload Parsed Overpass JSON.
+ * @param {{mode: string, preset: object, limit: number}} compiled
+ */
+export function summarizeOsmFeatures(payload, compiled) {
+  if (!Array.isArray(payload?.elements))
+    throw new TypeError('Malformed Overpass feature response');
+  const elements = payload.elements;
+  if (compiled.mode === 'count') {
+    const tags = elements.find((el) => el?.type === 'count')?.tags;
+    const rawTotal = tags?.total;
+    const total = Number(rawTotal);
+    if (
+      !tags ||
+      !Object.hasOwn(tags, 'total') ||
+      !['string', 'number'].includes(typeof rawTotal) ||
+      String(rawTotal).trim() === '' ||
+      !Number.isSafeInteger(total) ||
+      total < 0
+    )
+      throw new TypeError('Malformed Overpass count response');
+    return {
+      mode: 'count',
+      preset: compiled.preset.id,
+      count: total,
+      nodes: Number(tags.nodes) || 0,
+      ways: Number(tags.ways) || 0,
+      relations: Number(tags.relations) || 0,
+    };
+  }
+  const features = [];
+  let unplaced = 0;
+  for (const el of elements) {
+    if (
+      !['node', 'way', 'relation'].includes(el?.type) ||
+      (!Number.isFinite(Number(el?.id)) && typeof el?.id !== 'string')
+    ) {
+      unplaced += 1;
+      continue;
+    }
+    const lat = Number.isFinite(el?.lat) ? el.lat : el?.center?.lat;
+    const lon = Number.isFinite(el?.lon) ? el.lon : el?.center?.lon;
+    if (!Number.isFinite(lat) || !Number.isFinite(lon)) {
+      unplaced += 1;
+      continue;
+    }
+    const tags = {};
+    for (const key of [...KEPT_TAGS, ...compiled.preset.tags.map(([k]) => k)])
+      if (typeof el.tags?.[key] === 'string')
+        tags[key] = el.tags[key].slice(0, 120);
+    features.push({ id: `${el.type}/${el.id}`, lat, lon, tags });
+  }
+  // A genuinely empty `elements` array is authoritative. A non-empty answer
+  // whose every row is unusable is a schema failure, not "zero places"; do
+  // not let the route cache that as current state for a day.
+  if (elements.length && features.length === 0)
+    throw new TypeError('Overpass feature response has no usable rows');
+  return {
+    mode: 'features',
+    preset: compiled.preset.id,
+    count: features.length,
+    features,
+    truncated: elements.length >= compiled.limit,
+    ...(unplaced ? { unplaced } : {}),
+  };
+}

server/providers/overpass/osmFeaturesRoute.js

@@ -0,0 +1,252 @@
+import path from 'node:path';
+import { makeRateLimiter, clientNetworkKey } from '../common/rate-limit.js';
+import { admitSameSiteKeyless } from '../common/same-site.js';
+import { createBoundedCache } from '../common/boundedCache.js';
+import {
+  compileOsmFeatureQuery,
+  OSM_FEATURE_LIMITS,
+  summarizeOsmFeatures,
+} from './osmFeatures.js';
+import {
+  resolveOverpassUpstreams,
+  resolveOverpassUpstreamTag,
+} from './constants.js';
+import { fetchOverpassPayload, overpassPayloadIsData } from './transport.js';
+
+/** Places of interest change slowly: answers are kept a day. */
+const OSM_FEATURES_TTL_MS = 86_400_000;
+/** Upstream searches at once, across all clients (one per client). */
+const OSM_MAX_RUNNING = 2;
+/** Cache-key version; nothing cached under another version is reused. */
+const CACHE_VERSION = 'v2';
+
+/** Never simplify: these answers are points and counts, not drawings. */
+const keepBody = (body) => body;
+
+const jsonError = (status, error, extra = {}) => ({
+  status,
+  body: JSON.stringify({ error, ...extra }),
+});
+
+/**
+ * One upstream Overpass query at a time, with identical requests sharing it
+ * and answers in a bounded memory + disk cache.
+ */
+function createOverpassAnswerer({
+  fetchPayload,
+  cache,
+  maxResponseBytes,
+  upstreamTimeoutMs,
+  upstreamBudgetMs,
+  maxRunning = OSM_MAX_RUNNING,
+}) {
+  const inFlight = new Map();
+  // One search per client, a few in all: one client can't hold the route.
+  const runningBy = new Map();
+  let running = 0;
+  return async function answer(key, ql, summarize, signal = null, owner = '') {
+    signal?.throwIfAborted?.();
+    const held = await cache.get(key);
+    signal?.throwIfAborted?.();
+    if (typeof held === 'string')
+      return { status: 200, body: held, cache: 'HIT' };
+    let operation = inFlight.get(key);
+    if (operation?.controller.signal.aborted) {
+      inFlight.delete(key);
+      operation = null;
+    }
+    if (!operation) {
+      if (runningBy.get(owner) || running >= maxRunning)
+        return {
+          ...jsonError(
+            503,
+            runningBy.get(owner)
+              ? 'Your previous map search is still running — try again shortly.'
+              : 'Another map search is running — try again shortly.',
+          ),
+          retryAfter: '3',
+        };
+      running += 1;
+      runningBy.set(owner, (runningBy.get(owner) || 0) + 1);
+      const controller = new AbortController();
+      // The whole search, every configured endpoint in turn, gets one budget.
+      const budget = AbortSignal.timeout(upstreamBudgetMs);
+      operation = { controller, waiters: 0, settled: false, promise: null };
+      const owned = operation;
+      owned.promise = (async () => {
+        try {
+          const payload = await fetchPayload(
+            `data=${encodeURIComponent(ql)}`,
+            maxResponseBytes,
+            {
+              simplify: keepBody,
+              timeoutMs: upstreamTimeoutMs,
+              signal: AbortSignal.any([controller.signal, budget]),
+            },
+          );
+          if (!overpassPayloadIsData(payload))
+            return {
+              ...jsonError(
+                payload?.rateLimited ? 429 : 503,
+                'OpenStreetMap search is unavailable right now.',
+              ),
+              retryAfter: '10',
+            };
+          let parsed;
+          try {
+            parsed = JSON.parse(payload.body);
+          } catch {
+            return jsonError(
+              502,
+              'OpenStreetMap returned an unreadable answer.',
+            );
+          }
+          const body = JSON.stringify(summarize(parsed));
+          controller.signal.throwIfAborted();
+          await cache.set(key, body);
+          controller.signal.throwIfAborted();
+          return { status: 200, body, cache: 'MISS' };
+        } catch {
+          return budget.aborted && !controller.signal.aborted
+            ? jsonError(504, 'OpenStreetMap took too long to answer.')
+            : jsonError(502, 'OpenStreetMap search failed.');
+        } finally {
+          owned.settled = true;
+          running -= 1;
+          const left = (runningBy.get(owner) || 1) - 1;
+          if (left > 0) runningBy.set(owner, left);
+          else runningBy.delete(owner);
+          if (inFlight.get(key) === owned) inFlight.delete(key);
+        }
+      })();
+      inFlight.set(key, owned);
+    }
+
+    operation.waiters += 1;
+    let abort = null;
+    const abandoned = signal
+      ? new Promise((_, reject) => {
+          abort = () => {
+            operation.waiters -= 1;
+            if (operation.waiters === 0 && !operation.settled)
+              operation.controller.abort();
+            reject(signal.reason ?? new DOMException('Aborted', 'AbortError'));
+          };
+          signal.addEventListener('abort', abort, { once: true });
+          if (signal.aborted) abort();
+        })
+      : null;
+    try {
+      return await (abandoned
+        ? Promise.race([operation.promise, abandoned])
+        : operation.promise);
+    } finally {
+      if (signal && abort) signal.removeEventListener('abort', abort);
+      if (!signal?.aborted) operation.waiters -= 1;
+    }
+  };
+}
+
+function sender(res) {
+  return ({ status, body, cache, retryAfter }) => {
+    if (res.writableEnded) return;
+    res.writeHead(status, {
+      'Content-Type': 'application/json',
+      'Cache-Control': 'no-store',
+      ...(cache ? { 'X-OSM-Cache': cache } : {}),
+      ...(retryAfter ? { 'Retry-After': retryAfter } : {}),
+    });
+    res.end(body);
+  };
+}
+
+/**
+ * Install `GET /api/osm/features?preset=&bbox=w,s,e,n[&mode=count][&limit=]`:
+ * one curated preset inside a box, answered by the operator's Overpass
+ * (`OVERPASS_UPSTREAMS`). With none configured the route answers
+ * `OVERPASS_NOT_CONFIGURED` and fetches nothing; public Nominatim is never a
+ * substitute for bulk place search.
+ *
+ * @param {{use: Function}} middlewares
+ * @param {{fetchPayload?: Function, featuresCache?: object, cacheRoot?: string|null, configured?: () => boolean, upstreamTag?: () => string}} [deps]
+ */
+export function installOsmFeaturesRoute(
+  middlewares,
+  {
+    fetchPayload = fetchOverpassPayload,
+    configured = () => resolveOverpassUpstreams().length > 0,
+    // Keys each answer to the instance that gave it, as the other Overpass
+    // caches do, so repointing OVERPASS_UPSTREAMS never serves the old one's.
+    upstreamTag = resolveOverpassUpstreamTag,
+    upstreamBudgetMs = OSM_FEATURE_LIMITS.upstreamBudgetMs,
+    cacheRoot = path.join(process.cwd(), '.gev-cache'),
+    featuresCache = createBoundedCache({
+      dir: cacheRoot ? path.join(cacheRoot, 'osm-features') : null,
+      ttlMs: OSM_FEATURES_TTL_MS,
+      maxMemoryEntries: 60,
+      maxDiskEntries: 400,
+      maxDiskBytes: 256 * 1024 * 1024,
+    }),
+  } = {},
+) {
+  const limiter = makeRateLimiter({ windowMs: 60_000, max: 12, globalMax: 30 });
+  const features = createOverpassAnswerer({
+    fetchPayload,
+    cache: featuresCache,
+    maxResponseBytes: OSM_FEATURE_LIMITS.maxResponseBytes,
+    upstreamTimeoutMs: OSM_FEATURE_LIMITS.upstreamTimeoutMs,
+    upstreamBudgetMs,
+  });
+
+  middlewares.use('/api/osm/features', async (req, res) => {
+    const send = sender(res);
+    if (req.method !== 'GET') return send(jsonError(405, 'Method Not Allowed'));
+    // A page elsewhere must not spend the operator's Overpass. The keyless
+    // gate, as on /api/overpass: voice works behind a reverse proxy too.
+    if (admitSameSiteKeyless(req, res)) return undefined;
+    if (!configured())
+      return send(
+        jsonError(503, 'Place search needs a configured Overpass server.', {
+          code: 'OVERPASS_NOT_CONFIGURED',
+          retryable: false,
+        }),
+      );
+    const url = new URL(req.url || '', 'http://localhost');
+    const compiled = compileOsmFeatureQuery({
+      preset: url.searchParams.get('preset'),
+      bbox: url.searchParams.get('bbox'),
+      mode: url.searchParams.get('mode'),
+      limit: url.searchParams.get('limit'),
+    });
+    if (!compiled.ok)
+      return send(jsonError(400, compiled.error, { code: compiled.code }));
+    // IPv6 peers by /64, as /api/overpass does: rotating addresses inside
+    // one prefix earns neither a second rate bucket nor a second slot.
+    const client = clientNetworkKey(req);
+    if (!limiter(client))
+      return send({
+        ...jsonError(429, 'Rate limit exceeded'),
+        retryAfter: '10',
+      });
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    req.once?.('aborted', abort);
+    res.once?.('close', abort);
+    try {
+      const answer = await features(
+        `${CACHE_VERSION}|features|${upstreamTag()}|${compiled.ql}`,
+        compiled.ql,
+        (parsed) => summarizeOsmFeatures(parsed, compiled),
+        controller.signal,
+        client,
+      );
+      if (!controller.signal.aborted) send(answer);
+    } catch {
+      if (!controller.signal.aborted)
+        send(jsonError(502, 'OpenStreetMap search failed.'));
+    } finally {
+      req.removeListener?.('aborted', abort);
+      res.removeListener?.('close', abort);
+    }
+  });
+}

server/providers/overpass/transport.js

@@ -124,6 +124,8 @@ async function fetchOverpassPayload(
     readBody = readResponseTextCapped,
     simplify = simplifyOverpassPayloadBody,
     now = Date.now,
+    timeoutMs = OVERPASS_TIMEOUT_MS,
+    signal = null,
   } = {},
 ) {
   if (!endpoints.length) return overpassNotConfigured();
@@ -135,7 +137,10 @@ async function fetchOverpassPayload(
       continue;
     }
     const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), OVERPASS_TIMEOUT_MS);
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    const requestSignal = signal
+      ? AbortSignal.any([signal, controller.signal])
+      : controller.signal;
     try {
       const requestUrl = new URL(endpoint);
       const authorization =
@@ -156,7 +161,7 @@ async function fetchOverpassPayload(
           ...(authorization ? { Authorization: authorization } : {}),
         },
         body,
-        signal: controller.signal,
+        signal: requestSignal,
       });
       const responseBody = await readBody(upstream, maxResponseBytes);
       const parsed = parseJson(responseBody);
@@ -207,7 +212,12 @@ async function fetchOverpassPayload(
         upstreams: resolveOverpassUpstreamTag(),
         rateLimited: false,
       };
-    } catch {
+    } catch (error) {
+      // A route whose last requester disconnected owns this cancellation. It
+      // is not evidence that the configured upstream is unhealthy, so do not
+      // put the endpoint on cooldown or translate the abort into a response
+      // that a now-gone client could cache.
+      if (signal?.aborted) throw signal.reason ?? error;
       const failures = (previous?.failures || 0) + 1;
       const delay = retryDelay(null, failures - 1, now());
       cooldowns.set(endpoint, { until: now() + delay, failures, status: 502 });

server/providers/regional/outlineSelect.js

@@ -204,6 +204,97 @@ const ADMIN_EVIDENCE = Object.freeze({
   },
 });
 
+/**
+ * Nominatim address types whose meaning is stable enough for the area consumer's
+ * country/admin1/admin2 contract. `region`, `district` and numeric admin levels
+ * vary by country, so they remain unverified instead of being guessed.
+ */
+const VERIFIED_ADMIN_LEVEL = Object.freeze({
+  country: 'country',
+  state: 'admin1',
+  province: 'admin1',
+  county: 'admin2',
+  state_district: 'admin2',
+});
+
+const EXPLICIT_NAME_LEVEL = Object.freeze({
+  country: 'country',
+  nation: 'country',
+  province: 'admin1',
+  state: 'admin1',
+  region: 'admin1',
+  oblast: 'admin1',
+  prefecture: 'admin1',
+  canton: 'admin1',
+  governorate: 'admin1',
+  county: 'admin2',
+  district: 'admin2',
+  department: 'admin2',
+  zone: 'retired',
+});
+
+function explicitNameEvidence(value) {
+  const normalized = String(value || '')
+    .normalize('NFKC')
+    .toLocaleLowerCase()
+    .replace(/[^\p{L}\p{M}\p{N}]+/gu, ' ')
+    .trim();
+  const prefix = normalized.match(
+    /^(country|nation|province|state|region|zone|oblast|prefecture|canton|governorate|county|district|department)\s+of\b/,
+  )?.[1];
+  const suffix = normalized.match(
+    /\b(country|nation|province|state|region|zone|oblast|prefecture|canton|governorate|county|district|department)$/,
+  )?.[1];
+  const levels = new Set(
+    [prefix, suffix]
+      .filter(Boolean)
+      .map((type) => EXPLICIT_NAME_LEVEL[type])
+      .filter(Boolean),
+  );
+  if (levels.size > 1) return { contradictory: true, level: null };
+  return { contradictory: false, level: levels.values().next().value || null };
+}
+
+/**
+ * Verified administrative identity carried by the selected result itself.
+ * Never infer it from the request, desired kind, rank, or a separate geocoder
+ * anchor. A retired name is preserved without a level so downstream policy can
+ * reject it explicitly; every other contradiction stays wholly unverified.
+ */
+function selectedAdminIdentity(kind, row) {
+  if (kind !== 'admin') return null;
+  const adminLevel =
+    VERIFIED_ADMIN_LEVEL[String(row?.addresstype || '').toLowerCase()];
+  const authoritativeAdminArea = String(row?.name || '').trim();
+  if (!adminLevel || !authoritativeAdminArea) return null;
+  // Validate the complete authoritative name. `adminArea` is truncated only
+  // for display after every prefix/suffix signal has been considered.
+  const { contradictory, level: nameLevel } = explicitNameEvidence(
+    authoritativeAdminArea,
+  );
+  if (contradictory) return null;
+  const adminArea = authoritativeAdminArea.slice(0, 160);
+  if (nameLevel === 'retired') {
+    // Nepal replaced its zones in 2015, but zones are current units elsewhere
+    // (Ethiopia). Without a country the name stays retired.
+    if (!zoneIsCurrentIn(row)) return { adminArea };
+    return { adminArea, adminLevel };
+  }
+  if (nameLevel && nameLevel !== adminLevel) return null;
+  return { adminArea, adminLevel };
+}
+
+/** Whether the row names a country (last display_name part) other than Nepal. */
+function zoneIsCurrentIn(row) {
+  const country = String(row?.display_name || '')
+    .split(',')
+    .slice(1)
+    .pop()
+    ?.trim()
+    .toLocaleLowerCase();
+  return Boolean(country) && country !== 'nepal';
+}
+
 /** Whether supplied administrative evidence contradicts the accepted identity. */
 function adminLevelFits(kind, row) {
   const evidence = ADMIN_EVIDENCE[kind];
@@ -584,6 +675,7 @@ export function selectOutlineResult(rows, { kind, query }) {
           row.osm_type && row.osm_id != null
             ? `${row.osm_type}/${row.osm_id}`
             : null,
+        ...(selectedAdminIdentity(kind, row) || {}),
         polygons,
       },
     });

src/annotations/annotationEngine.js

@@ -406,6 +406,8 @@ export function createAnnotationEngine({
    * @param {boolean} [opts.clearPrevious]
    * @param {boolean} [opts.persist]  Keep until cleared (default true).
    * @param {boolean} [opts.flyTo]    Frame the first resolved annotation.
+   * @param {AbortSignal} [opts.signal] Caller lifetime for this mutation.
+   * @param {() => boolean} [opts.isCurrent] Whether the caller still owns the board mutation.
    * @returns {Promise<{ok, drawn, failed, ids, results}>}
    */
   async function annotate(requests, opts = {}) {
@@ -426,9 +428,15 @@ export function createAnnotationEngine({
     const persist = opts.persist !== false;
     // Per-call cancellation: bumped/aborted by any later clear() or destroy().
     const controller = new AbortController();
+    const abortFromCaller = () => controller.abort(opts.signal?.reason);
+    opts.signal?.addEventListener?.('abort', abortFromCaller, { once: true });
+    if (opts.signal?.aborted) abortFromCaller();
     retainController(controller);
     const myGen = generation;
-    const superseded = () => myGen !== generation || controller.signal.aborted;
+    const superseded = () =>
+      myGen !== generation ||
+      controller.signal.aborted ||
+      (typeof opts.isCurrent === 'function' && !opts.isCurrent());
 
     const results = [];
     const ids = [];
@@ -847,6 +855,7 @@ export function createAnnotationEngine({
         firstAnchor = annotations.get(ids[0]) || null;
       }
     } finally {
+      opts.signal?.removeEventListener?.('abort', abortFromCaller);
       releaseController(controller);
     }
 
@@ -1520,6 +1529,18 @@ export function createAnnotationEngine({
       // Every part with its holes ([outer, ...holes][]), when the outline has
       // more than the main ring (Hawaii's islands, Berlin inside Brandenburg).
       polygons: resolved.polygons || null,
+      // A voice area handle's id: counting reads the handle's full geometry,
+      // never this drawing (see voice/areaActions.js).
+      areaId:
+        typeof spec?.areaId === 'string' ? spec.areaId.slice(0, 120) : null,
+      // Who made the outline: the draw tool, a voice area handle, or a voice
+      // annotation resolved from a name.
+      origin:
+        spec?.manual === true
+          ? spec.origin === 'area'
+            ? 'area'
+            : 'drawn'
+          : 'voice',
       footprintKind: resolved.footprintKind || null, // 'building' | 'area'
       outlineCredit: resolved.outlineCredit || null,
       buildingHeight: resolved.buildingHeight || null, // meters, for extruded volume
@@ -1809,6 +1830,12 @@ export function createAnnotationEngine({
     },
     fadeOutAll,
     count: () => annotations.size,
+    /**
+     * The board generation: advanced by every clear. A caller that resolves
+     * something before drawing captures it first and draws only while it is
+     * unchanged, so a clear during a slow lookup is never undone.
+     */
+    generation: () => generation,
     list: () => Array.from(annotations.values()),
 
     /**
@@ -2200,13 +2227,40 @@ function isManualSpec(spec, type) {
   if (!spec || spec.manual !== true) return false;
   if (type === 'route')
     return Array.isArray(spec.path) && spec.path.length >= 2;
-  if (type === 'area') return Array.isArray(spec.ring) && spec.ring.length >= 3;
+  if (type === 'area')
+    return (
+      (Array.isArray(spec.ring) && spec.ring.length >= 3) ||
+      (spec.origin === 'area' && Array.isArray(spec.polygons))
+    );
   return (
     Number.isFinite(Number(spec.latitude)) &&
     Number.isFinite(Number(spec.longitude))
   );
 }
 
+/**
+ * Parts of a voice area handle, `[[outer, ...holes], …]` of [lon, lat] pairs.
+ * Longitudes may run to ±540 (a part unwrapped across the antimeridian draws
+ * as one shape). Null when no part has a usable outer ring.
+ */
+function areaPolygons(list) {
+  const ringOf = (ring) =>
+    (Array.isArray(ring) ? ring : []).filter(
+      (p) =>
+        Array.isArray(p) &&
+        Number.isFinite(p[0]) &&
+        Number.isFinite(p[1]) &&
+        Math.abs(p[0]) <= 540 &&
+        Math.abs(p[1]) <= 90,
+    );
+  const polygons = (Array.isArray(list) ? list : [])
+    .slice(0, 64)
+    .map((rings) => (Array.isArray(rings) ? rings.map(ringOf) : []))
+    .filter((rings) => rings[0]?.length >= 3)
+    .map(([outer, ...holes]) => [outer, ...holes.filter((h) => h.length >= 3)]);
+  return polygons.length ? polygons : null;
+}
+
 /** [lon, lat] pairs or {lon, lat} objects → [lon, lat] pairs, invalid entries dropped. */
 function manualPairs(list) {
   return (Array.isArray(list) ? list : [])
@@ -2253,7 +2307,9 @@ function resolveManualSpec(spec, type, viewer) {
     };
   }
   if (type === 'area') {
-    const ring = manualPairs(spec.ring);
+    const polygons =
+      spec.origin === 'area' ? areaPolygons(spec.polygons) : null;
+    const ring = polygons ? polygons[0][0] : manualPairs(spec.ring);
     if (ring.length < 3)
       throw new Error('a drawn area needs at least 3 points');
     // Averaged through ringCentroid, which unwraps longitudes first: a ring
@@ -2270,9 +2326,11 @@ function resolveManualSpec(spec, type, viewer) {
       lat,
       height: sampleGroundHeight(viewer, lon, lat),
       ring,
+      ...(polygons ? { polygons } : {}),
       footprintKind: 'area',
       buildingHeight: null,
-      synthesized: false,
+      // An approximate area (a buffer around a landmark) draws dashed.
+      synthesized: spec.approximate === true,
       source: 'manual',
     };
   }

src/annotations/annotationEngine.test.mjs

@@ -43,11 +43,21 @@ function scriptedResolver(outcomes) {
 // Instant fake wait that records the requested backoff delays.
 function fakeWait() {
   const delays = [];
-  const waitFn = async (ms) => { delays.push(ms); };
+  const waitFn = async (ms) => {
+    delays.push(ms);
+  };
   return { waitFn, delays };
 }
 
-const FP = { ring: [[0, 0], [0, 1], [1, 1], [0, 0]], footprintKind: 'area' };
+const FP = {
+  ring: [
+    [0, 0],
+    [0, 1],
+    [1, 1],
+    [0, 0],
+  ],
+  footprintKind: 'area',
+};
 
 function installAnimationFrameStubs(t) {
   const originalRequestAnimationFrame = globalThis.requestAnimationFrame;
@@ -55,9 +65,11 @@ function installAnimationFrameStubs(t) {
   globalThis.requestAnimationFrame = () => 1;
   globalThis.cancelAnimationFrame = () => {};
   t.after(() => {
-    if (originalRequestAnimationFrame === undefined) delete globalThis.requestAnimationFrame;
+    if (originalRequestAnimationFrame === undefined)
+      delete globalThis.requestAnimationFrame;
     else globalThis.requestAnimationFrame = originalRequestAnimationFrame;
-    if (originalCancelAnimationFrame === undefined) delete globalThis.cancelAnimationFrame;
+    if (originalCancelAnimationFrame === undefined)
+      delete globalThis.cancelAnimationFrame;
     else globalThis.cancelAnimationFrame = originalCancelAnimationFrame;
   });
 }
@@ -67,9 +79,15 @@ function fakeRenderer() {
   return {
     calls,
     renderer: {
-      add() { calls.add += 1; },
-      update() { calls.update += 1; },
-      remove() { calls.remove += 1; },
+      add() {
+        calls.add += 1;
+      },
+      update() {
+        calls.update += 1;
+      },
+      remove() {
+        calls.remove += 1;
+      },
       sync() {},
     },
   };
@@ -83,14 +101,19 @@ function httpFailure(status, retryAfter = null) {
   return {
     ok: false,
     status,
-    headers: { get: (name) => (name.toLowerCase() === 'retry-after' ? retryAfter : null) },
+    headers: {
+      get: (name) => (name.toLowerCase() === 'retry-after' ? retryAfter : null),
+    },
   };
 }
 
 test('retry: first-try footprint returns immediately, no retry, no waiting', async () => {
   const { resolve, calls } = scriptedResolver([FP]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, FP);
   assert.equal(calls.count, 1);
   assert.deepEqual(delays, []);
@@ -99,7 +122,10 @@ test('retry: first-try footprint returns immediately, no retry, no waiting', asy
 test('retry: a DEFINITIVE miss (null) is never retried — the honest point stands', async () => {
   const { resolve, calls } = scriptedResolver([null, FP]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, null);
   assert.equal(calls.count, 1);
   assert.deepEqual(delays, []);
@@ -108,7 +134,10 @@ test('retry: a DEFINITIVE miss (null) is never retried — the honest point stan
 test('retry: a TRANSIENT miss (undefined) re-runs after the first backoff and can succeed', async () => {
   const { resolve, calls } = scriptedResolver([undefined, FP]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, FP);
   assert.equal(calls.count, 2);
   assert.deepEqual(delays, [8000]); // waited once, succeeded on attempt 2
@@ -117,16 +146,27 @@ test('retry: a TRANSIENT miss (undefined) re-runs after the first backoff and ca
 test('retry: a transient retry can still conclude with a definitive miss (no third run)', async () => {
   const { resolve, calls } = scriptedResolver([undefined, null]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, null);
   assert.equal(calls.count, 2);
   assert.deepEqual(delays, [8000]);
 });
 
 test('retry: persistent transients exhaust the backoff schedule and give up as transient', async () => {
-  const { resolve, calls } = scriptedResolver([undefined, undefined, undefined, FP]);
+  const { resolve, calls } = scriptedResolver([
+    undefined,
+    undefined,
+    undefined,
+    FP,
+  ]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, undefined); // never found within budget — mark honestly stays a point
   assert.equal(calls.count, 3); // initial + one per backoff entry
   assert.deepEqual(delays, [8000, 25000]);
@@ -138,7 +178,10 @@ test('retry: a stale board (clear/supersede during backoff) stops retrying immed
   let stale = false;
   const fp = await resolveOutlineWithRetry(resolve, {
     delaysMs: [8000, 25000],
-    waitFn: async (ms) => { await waitFn(ms); stale = true; }, // goes stale mid-wait
+    waitFn: async (ms) => {
+      await waitFn(ms);
+      stale = true;
+    }, // goes stale mid-wait
     isStale: () => stale,
   });
   assert.equal(fp, undefined);
@@ -149,7 +192,10 @@ test('retry: a stale board (clear/supersede during backoff) stops retrying immed
 test('retry: a thrown resolver is a definitive miss (no retry), matching the old catch→point path', async () => {
   const { resolve, calls } = scriptedResolver([new Error('boom'), FP]);
   const { waitFn, delays } = fakeWait();
-  const fp = await resolveOutlineWithRetry(resolve, { delaysMs: [8000, 25000], waitFn });
+  const fp = await resolveOutlineWithRetry(resolve, {
+    delaysMs: [8000, 25000],
+    waitFn,
+  });
   assert.equal(fp, null);
   assert.equal(calls.count, 1);
   assert.deepEqual(delays, []);
@@ -171,43 +217,65 @@ test('outline queue: an 8-spec batch keeps at most two FIFO upgrades in flight',
       label: target,
       source: 'fake',
       ring: null,
-      resolveOutline: () => new Promise((resolve) => {
-        started.push(target);
-        inFlight += 1;
-        maxInFlight = Math.max(maxInFlight, inFlight);
-        releases.set(target, () => {
-          inFlight -= 1;
-          resolve({
-            ring: [[index, index], [index + 0.1, index], [index, index + 0.1], [index, index]],
-            footprintKind: 'area',
-            lat: index,
-            lon: index,
-            height: 0,
+      resolveOutline: () =>
+        new Promise((resolve) => {
+          started.push(target);
+          inFlight += 1;
+          maxInFlight = Math.max(maxInFlight, inFlight);
+          releases.set(target, () => {
+            inFlight -= 1;
+            resolve({
+              ring: [
+                [index, index],
+                [index + 0.1, index],
+                [index, index + 0.1],
+                [index, index],
+              ],
+              footprintKind: 'area',
+              lat: index,
+              lon: index,
+              height: 0,
+            });
           });
-        });
-      }),
+        }),
     };
   };
-  const engine = createAnnotationEngine({ viewer: {}, renderer, resolveTarget });
+  const engine = createAnnotationEngine({
+    viewer: {},
+    renderer,
+    resolveTarget,
+  });
   let completed = 0;
-  const allCompleted = new Promise((resolve) => engine.onOutlineEvent(() => {
-    completed += 1;
-    if (completed === 8) resolve();
-  }));
+  const allCompleted = new Promise((resolve) =>
+    engine.onOutlineEvent(() => {
+      completed += 1;
+      if (completed === 8) resolve();
+    }),
+  );
 
-  const result = await engine.annotate(Array.from({ length: 8 }, (_, i) => ({
-    type: 'area',
-    target: `queue-${i}`,
-    footprint: true,
-  })));
+  const result = await engine.annotate(
+    Array.from({ length: 8 }, (_, i) => ({
+      type: 'area',
+      target: `queue-${i}`,
+      footprint: true,
+    })),
+  );
 
   assert.equal(result.drawn, 8);
-  assert.equal(calls.add, 8, 'all point renders land before queued outlines finish');
+  assert.equal(
+    calls.add,
+    8,
+    'all point renders land before queued outlines finish',
+  );
   assert.deepEqual(started, ['queue-0', 'queue-1']);
   for (let next = 2; next < 8; next += 1) {
     releases.get(`queue-${next - 2}`)();
     await flushMicrotasks();
-    assert.equal(started[next], `queue-${next}`, 'queued upgrades start in ask order');
+    assert.equal(
+      started[next],
+      `queue-${next}`,
+      'queued upgrades start in ask order',
+    );
   }
   releases.get('queue-6')();
   releases.get('queue-7')();
@@ -292,7 +360,10 @@ test('retry: HTTP 429 Retry-After 5s gets one ladder-spaced retry; a second 429
   const originalWindow = globalThis.window;
   const originalFetch = globalThis.fetch;
   t.mock.timers.enable({ apis: ['setTimeout', 'Date'], now: 10_000 });
-  globalThis.window = { setTimeout: globalThis.setTimeout, clearTimeout: globalThis.clearTimeout };
+  globalThis.window = {
+    setTimeout: globalThis.setTimeout,
+    clearTimeout: globalThis.clearTimeout,
+  };
   const requestTimes = [];
   globalThis.fetch = async (url) => {
     // The one-time capability probe is not an outline request.
@@ -323,11 +394,16 @@ test('retry: HTTP 429 Retry-After 5s gets one ladder-spaced retry; a second 429
       waits.push(ms);
       return new Promise((resolve) => setTimeout(resolve, ms));
     },
-  })
-    .finally(() => { settled = true; });
+  }).finally(() => {
+    settled = true;
+  });
   while (waits.length === 0) await flushMicrotasks();
   assert.equal(requestTimes.length, 1);
-  assert.deepEqual(waits, [8000], 'the 8s ladder floor is longer than Retry-After: 5');
+  assert.deepEqual(
+    waits,
+    [8000],
+    'the 8s ladder floor is longer than Retry-After: 5',
+  );
 
   t.mock.timers.tick(7999);
   await flushMicrotasks();
@@ -342,8 +418,15 @@ test('retry: HTTP 429 Retry-After 5s gets one ladder-spaced retry; a second 429
   }
 
   assert.equal(requestTimes.length, 2);
-  assert.ok(requestTimes[1] - requestTimes[0] >= 5000, 'Retry-After is a hard minimum');
-  assert.equal(settled, true, 'a second 429 must not schedule the 25s ladder replay');
+  assert.ok(
+    requestTimes[1] - requestTimes[0] >= 5000,
+    'Retry-After is a hard minimum',
+  );
+  assert.equal(
+    settled,
+    true,
+    'a second 429 must not schedule the 25s ladder replay',
+  );
   assert.equal(await pending, undefined);
 });
 
@@ -351,7 +434,10 @@ test('retry: a plain HTTP 500 still exhausts the existing 8s/25s transient ladde
   const originalWindow = globalThis.window;
   const originalFetch = globalThis.fetch;
   t.mock.timers.enable({ apis: ['setTimeout', 'Date'], now: 100_000 });
-  globalThis.window = { setTimeout: globalThis.setTimeout, clearTimeout: globalThis.clearTimeout };
+  globalThis.window = {
+    setTimeout: globalThis.setTimeout,
+    clearTimeout: globalThis.clearTimeout,
+  };
   const requestTimes = [];
   globalThis.fetch = async (url) => {
     if (String(url).endsWith('/status'))
@@ -382,8 +468,9 @@ test('retry: a plain HTTP 500 still exhausts the existing 8s/25s transient ladde
       waits.push(ms);
       return new Promise((resolve) => setTimeout(resolve, ms));
     },
-  })
-    .finally(() => { settled = true; });
+  }).finally(() => {
+    settled = true;
+  });
   while (waits.length === 0) await flushMicrotasks();
   assert.equal(requestTimes.length, 1);
   assert.deepEqual(waits, [8000]);
@@ -400,7 +487,10 @@ test('retry: a plain HTTP 500 still exhausts the existing 8s/25s transient ladde
   await flushMicrotasks();
 
   assert.equal(requestTimes.length, 3);
-  assert.deepEqual(requestTimes.map((at) => at - requestTimes[0]), [0, 8000, 33_000]);
+  assert.deepEqual(
+    requestTimes.map((at) => at - requestTimes[0]),
+    [0, 8000, 33_000],
+  );
   assert.equal(settled, true);
   assert.equal(await pending, undefined);
 });
@@ -415,7 +505,10 @@ test('targetKey: trailing locality qualifiers are stripped so state names dedupe
 });
 
 test('targetKey: lowercases, trims, and keeps comma-free names intact', () => {
-  assert.equal(normalizeTargetKey('  Texas State Capitol  '), 'texas state capitol');
+  assert.equal(
+    normalizeTargetKey('  Texas State Capitol  '),
+    'texas state capitol',
+  );
   assert.equal(normalizeTargetKey('Lady Bird Lake'), 'lady bird lake');
 });
 
@@ -1031,7 +1124,9 @@ test('duplicate-replacement: a renderer throw leaves no phantom mark and no leak
     resolveTarget: async () => ({ ...FIXED_POINT }),
   });
 
-  const first = await engine.annotate([{ type: 'point', target: 'Texas Capitol', label: 'Capitol' }]);
+  const first = await engine.annotate([
+    { type: 'point', target: 'Texas Capitol', label: 'Capitol' },
+  ]);
   assert.equal(first.drawn, 1);
   assert.equal(engine.list().length, 1);
   assert.ok(
@@ -1046,12 +1141,25 @@ test('duplicate-replacement: a renderer throw leaves no phantom mark and no leak
   // branch for a point; see findDuplicate.)
   failAddOnce();
   const second = await engine.annotate([
-    { type: 'point', target: 'Texas Capitol', label: 'Capitol', color: 'amber' },
+    {
+      type: 'point',
+      target: 'Texas Capitol',
+      label: 'Capitol',
+      color: 'amber',
+    },
   ]);
 
-  assert.equal(second.drawn, 0, 'the failed swap is reported as a failure, not a draw');
+  assert.equal(
+    second.drawn,
+    0,
+    'the failed swap is reported as a failure, not a draw',
+  );
   assert.equal(second.failed, 1);
-  assert.equal(engine.list().length, 0, 'no phantom annotation survives the failed swap');
+  assert.equal(
+    engine.list().length,
+    0,
+    'no phantom annotation survives the failed swap',
+  );
   assert.ok(
     !getRenderGovernorDiagnostics().holds.includes('annotations'),
     'the annotations hold must be released — a leak defeats the idle governor permanently',
@@ -1071,10 +1179,16 @@ test('fresh path: a renderer throw is rolled back the same way', async (t) => {
   });
 
   failAddOnce();
-  const result = await engine.annotate([{ type: 'point', target: 'Texas Capitol', label: 'Capitol' }]);
+  const result = await engine.annotate([
+    { type: 'point', target: 'Texas Capitol', label: 'Capitol' },
+  ]);
 
   assert.equal(result.drawn, 0);
-  assert.equal(engine.list().length, 0, 'no phantom annotation from a failed first add');
+  assert.equal(
+    engine.list().length,
+    0,
+    'no phantom annotation from a failed first add',
+  );
   assert.ok(
     !getRenderGovernorDiagnostics().holds.includes('annotations'),
     'a never-rendered mark must not hold continuous render',
@@ -1096,14 +1210,21 @@ function partialStateRendererHarness() {
   let failNextAdd = false;
   return {
     live,
-    failAddOnce() { failNextAdd = true; },
+    failAddOnce() {
+      failNextAdd = true;
+    },
     renderer: {
       add(anno) {
         live.set(anno.id, anno); // partial renderer state exists NOW
-        if (failNextAdd) { failNextAdd = false; throw new Error('WebGL context lost'); }
+        if (failNextAdd) {
+          failNextAdd = false;
+          throw new Error('WebGL context lost');
+        }
       },
       update() {},
-      remove(anno) { live.delete(anno.id); },
+      remove(anno) {
+        live.delete(anno.id);
+      },
       sync() {},
     },
   };
@@ -1122,10 +1243,16 @@ test('fresh path: a throw AFTER partial renderer state leaves nothing on the boa
   });
 
   failAddOnce();
-  const failed = await engine.annotate([{ type: 'point', target: 'Texas Capitol', label: 'Capitol' }]);
+  const failed = await engine.annotate([
+    { type: 'point', target: 'Texas Capitol', label: 'Capitol' },
+  ]);
   assert.equal(failed.drawn, 0);
   assert.equal(engine.list().length, 0, 'no phantom annotation');
-  assert.equal(live.size, 0, 'the rollback must release what the renderer had already created');
+  assert.equal(
+    live.size,
+    0,
+    'the rollback must release what the renderer had already created',
+  );
   assert.ok(
     !getRenderGovernorDiagnostics().holds.includes('annotations'),
     'a never-rendered mark must not hold continuous render',
@@ -1133,9 +1260,15 @@ test('fresh path: a throw AFTER partial renderer state leaves nothing on the boa
 
   // The real cost of an orphan: re-annotating the same place stacks a second
   // mark on top of the one nothing owns.
-  const retry = await engine.annotate([{ type: 'point', target: 'Texas Capitol', label: 'Capitol' }]);
+  const retry = await engine.annotate([
+    { type: 'point', target: 'Texas Capitol', label: 'Capitol' },
+  ]);
   assert.equal(retry.drawn, 1);
-  assert.equal(live.size, 1, 'a re-annotate must draw ONE mark, not stack over an orphan');
+  assert.equal(
+    live.size,
+    1,
+    'a re-annotate must draw ONE mark, not stack over an orphan',
+  );
 });
 
 test('duplicate-replacement: a throw AFTER partial renderer state leaves nothing on the board', async (t) => {
@@ -1150,7 +1283,9 @@ test('duplicate-replacement: a throw AFTER partial renderer state leaves nothing
     resolveTarget: async () => ({ ...FIXED_POINT }),
   });
 
-  const first = await engine.annotate([{ type: 'point', target: 'Texas Capitol', label: 'Capitol' }]);
+  const first = await engine.annotate([
+    { type: 'point', target: 'Texas Capitol', label: 'Capitol' },
+  ]);
   assert.equal(first.drawn, 1);
   assert.equal(live.size, 1);
 
@@ -1158,10 +1293,19 @@ test('duplicate-replacement: a throw AFTER partial renderer state leaves nothing
   // creates its state and then throws.
   failAddOnce();
   const swap = await engine.annotate([
-    { type: 'point', target: 'Texas Capitol', label: 'Capitol', color: 'amber' },
+    {
+      type: 'point',
+      target: 'Texas Capitol',
+      label: 'Capitol',
+      color: 'amber',
+    },
   ]);
   assert.equal(swap.drawn, 0);
-  assert.equal(engine.list().length, 0, 'no phantom annotation survives the failed swap');
+  assert.equal(
+    engine.list().length,
+    0,
+    'no phantom annotation survives the failed swap',
+  );
   assert.equal(live.size, 0, 'and no half-swapped mark survives on the board');
   assert.ok(
     !getRenderGovernorDiagnostics().holds.includes('annotations'),
@@ -1169,23 +1313,38 @@ test('duplicate-replacement: a throw AFTER partial renderer state leaves nothing
   );
 
   const retry = await engine.annotate([
-    { type: 'point', target: 'Texas Capitol', label: 'Capitol', color: 'amber' },
+    {
+      type: 'point',
+      target: 'Texas Capitol',
+      label: 'Capitol',
+      color: 'amber',
+    },
   ]);
   assert.equal(retry.drawn, 1);
-  assert.equal(live.size, 1, 'the recoloured mark redraws once, with no orphan underneath');
+  assert.equal(
+    live.size,
+    1,
+    'the recoloured mark redraws once, with no orphan underneath',
+  );
 });
 
 test('destroy releases the renderer and prevents subsequent annotation work', async (t) => {
   installAnimationFrameStubs(t);
   const { renderer, calls } = fakeRenderer();
   let destroyed = 0;
-  renderer.destroy = () => { destroyed++; };
+  renderer.destroy = () => {
+    destroyed++;
+  };
   const engine = createAnnotationEngine({ viewer: {}, renderer });
-  const drawn = await engine.annotate([{ type: 'pin', longitude: -97.74, latitude: 30.27 }]);
+  const drawn = await engine.annotate([
+    { type: 'pin', longitude: -97.74, latitude: 30.27 },
+  ]);
   assert.equal(drawn.drawn, 1);
   engine.destroy();
   const additions = calls.add;
-  const result = await engine.annotate([{ type: 'pin', target: 'Must not resolve' }]);
+  const result = await engine.annotate([
+    { type: 'pin', target: 'Must not resolve' },
+  ]);
   assert.equal(result.error, 'destroyed');
   assert.equal(calls.add, additions);
   assert.equal(engine.count(), 0);
@@ -1201,10 +1360,13 @@ test('a late annotation resolver cannot redraw after destruction', async (t) =>
   let release;
   let signal;
   const engine = createAnnotationEngine({
-    viewer: {}, renderer,
+    viewer: {},
+    renderer,
     resolveTarget: (options) => {
       signal = options.signal;
-      return new Promise((resolve) => { release = resolve; });
+      return new Promise((resolve) => {
+        release = resolve;
+      });
     },
   });
   const pending = engine.annotate([{ type: 'pin', target: 'Pending place' }]);
@@ -1216,6 +1378,44 @@ test('a late annotation resolver cannot redraw after destruction', async (t) =>
   assert.equal(engine.count(), 0);
 });
 
+test('caller cancellation prevents a late annotation and camera mutation', async (t) => {
+  installAnimationFrameStubs(t);
+  const { renderer, calls } = fakeRenderer();
+  let release;
+  let resolverSignal;
+  let flights = 0;
+  const engine = createAnnotationEngine({
+    viewer: {
+      camera: {
+        flyToBoundingSphere() {
+          flights += 1;
+        },
+      },
+    },
+    renderer,
+    resolveTarget: ({ signal }) => {
+      resolverSignal = signal;
+      return new Promise((resolve) => {
+        release = resolve;
+      });
+    },
+  });
+  const controller = new AbortController();
+  const pending = engine.annotate([{ type: 'pin', target: 'Pending place' }], {
+    flyTo: true,
+    signal: controller.signal,
+    isCurrent: () => !controller.signal.aborted,
+  });
+  controller.abort();
+  assert.equal(resolverSignal.aborted, true);
+  release({ lon: -97.74, lat: 30.27, label: 'Pending place' });
+  const result = await pending;
+  assert.equal(result.aborted, true);
+  assert.equal(calls.add, 0);
+  assert.equal(flights, 0);
+  assert.equal(engine.count(), 0);
+});
+
 test('only an explicit navigation request permits resolving distant annotation targets', async (t) => {
   installAnimationFrameStubs(t);
   _resetRenderGovernorForTest();
@@ -1223,12 +1423,22 @@ test('only an explicit navigation request permits resolving distant annotation t
   const { renderer } = throwingRendererHarness();
   renderer.destroy = () => {};
   const received = [];
-  const engine = createAnnotationEngine({ viewer: {}, renderer,
-    resolveTarget: async (options) => { received.push(options); return null; },
+  const engine = createAnnotationEngine({
+    viewer: {},
+    renderer,
+    resolveTarget: async (options) => {
+      received.push(options);
+      return null;
+    },
   });
   await engine.annotate([{ type: 'point', target: 'Remote landmark' }]);
-  await engine.annotate([{ type: 'point', target: 'Remote landmark' }], { flyTo: true });
-  assert.deepEqual(received.map(options => options.allowDistant), [false, true]);
+  await engine.annotate([{ type: 'point', target: 'Remote landmark' }], {
+    flyTo: true,
+  });
+  assert.deepEqual(
+    received.map((options) => options.allowDistant),
+    [false, true],
+  );
   engine.destroy();
 });
 

src/annotations/outlineRungs.js

@@ -266,6 +266,8 @@ export function createOutlineRungs({
       heightM: null,
       synthesized: false,
       outlineName: outline.name,
+      adminArea: outline.adminArea || null,
+      adminLevel: outline.adminLevel || null,
     };
   }
 
@@ -288,6 +290,9 @@ export function createOutlineRungs({
       const patch = finish(fp, asScope);
       if (patch?.ring) {
         patch.outlineCredit = provider === 'openfreemap' ? 'tiles' : 'osm';
+        // Which source answered, so a stored area names it (OpenFreeMap or
+        // Nominatim) instead of defaulting to the Overpass rungs.
+        patch.outlineSource = provider;
         ctx.credit?.(patch.outlineCredit);
         // One line per answered outline, like the resolver's own trace.
         console.log(

src/annotations/outlineRungs.test.mjs

@@ -27,6 +27,7 @@ import {
   createGateStateStore,
   createNominatimGate,
 } from '../../server/providers/regional/nominatimGate.js';
+import { createVoiceAreas } from '../voice/areaActions.js';
 
 const TILES = [6745, 6746].map((y) =>
   decodeOpenFreeMapOutlineTile(
@@ -145,7 +146,7 @@ test('a street comes from tiles before the configured ladder, as merged ribbons'
   );
   assert.ok(result.ring.length > 6);
   assert.equal(result.polygons.length, 1);
-  assert.equal('outlineSource' in result, false);
+  assert.equal(result.outlineSource, 'openfreemap');
   assert.equal(run.calls.base, 0, 'the ladder is not consulted');
   assert.deepEqual(run.calls.finished, ['street']);
   assert.deepEqual(credits, ['tiles']);
@@ -415,6 +416,7 @@ test('a city with no configured Overpass is outlined by Nominatim', async () =>
   );
   assert.deepEqual(result.ring, ring);
   assert.equal(result.outlineCredit, 'osm');
+  assert.equal(result.outlineSource, 'nominatim');
   assert.deepEqual(nominatim.asks[0], {
     query: 'Toulouse',
     kind: 'city',
@@ -876,6 +878,19 @@ const NOMINATIM_ROWS = {
       geojson: { type: 'Polygon', coordinates: [square(40.78, -73.965, 0.01)] },
     },
   ],
+  'Bagmati Province': [
+    {
+      category: 'boundary',
+      type: 'administrative',
+      addresstype: 'province',
+      name: 'Bagmati Province',
+      lat: '27.7',
+      lon: '85.3',
+      osm_type: 'relation',
+      osm_id: 12345,
+      geojson: { type: 'Polygon', coordinates: [square(27.7, 85.3, 0.4)] },
+    },
+  ],
 };
 
 const PLACES = {
@@ -900,6 +915,13 @@ const PLACES = {
     label: 'Congress Ave, Austin',
     types: ['route'],
   },
+  'Bagmati Province': {
+    lat: 27.7,
+    lng: 85.3,
+    name: 'Bagmati Province',
+    label: 'Bagmati Province, Nepal',
+    types: ['administrative_area_level_1', 'political'],
+  },
 };
 
 const viewerAt = (lat, lon, height = 4000) => ({
@@ -977,6 +999,19 @@ test('default settings: outline, street and building asks send nothing to Overpa
     target: 'Central Park',
   });
 
+  const areas = createVoiceAreas({
+    viewer: viewerAt(27.7, 85.3, 40_000),
+    annotationResolver: resolver,
+    placeSearch,
+  });
+  const verified = await areas.resolveAreaAction({
+    query: 'Bagmati Province',
+    level: 'admin1',
+  });
+  assert.equal(verified.ok, true);
+  assert.equal(verified.sourceIdentity, 'Bagmati Province');
+  assert.equal(areas.store.get(verified.areaId).meta.adminLevel, 'admin1');
+
   const street = await resolve(viewerAt(30.27, -97.742), {
     target: 'Congress Avenue',
   });
@@ -1000,7 +1035,7 @@ test('default settings: outline, street and building asks send nothing to Overpa
   );
   assert.equal(
     upstream.length,
-    2,
+    3,
     'one upstream request per explicit ask that needed one',
   );
   assert.ok(!upstream.some((url) => /overpass/i.test(url)));

src/annotations/outlineRungsFallback.test.mjs

@@ -103,6 +103,48 @@ test('"around the Capitol grounds" is still a grounds ask', async () => {
   assert.equal(asks.length, 1);
 });
 
+test('Nominatim administrative identity survives the outline rung', async () => {
+  const boundary = {
+    polygons: [
+      [
+        [
+          [84.4, 26.9],
+          [86.6, 26.9],
+          [86.6, 28.4],
+          [84.4, 28.4],
+          [84.4, 26.9],
+        ],
+      ],
+    ],
+    class: 'boundary',
+    type: 'administrative',
+    adminArea: 'Bagmati Province',
+    adminLevel: 'admin1',
+  };
+  const { rungs } = setup(boundary);
+  const result = await rungs.resolve(
+    ctx({
+      scope: 'state',
+      target: 'Bagmati Province',
+      matchName: 'Bagmati Province',
+      lat: 27.7,
+      lon: 85.3,
+      view: { lat: 27.7, lon: 85.3 },
+    }),
+    {
+      base: async () => UNAVAILABLE,
+      finish: (fp) => ({
+        ring: fp.ring,
+        footprintKind: fp.kind,
+        adminArea: fp.adminArea,
+        adminLevel: fp.adminLevel,
+      }),
+    },
+  );
+  assert.equal(result.adminArea, 'Bagmati Province');
+  assert.equal(result.adminLevel, 'admin1');
+});
+
 test('named grounds around a building seed still require the original anchor', async () => {
   // A place-search anchor ~250 m from the dome, outside the Capitol lawn.
   const offLawn = { lat: 30.27265, lon: -97.73925 };

src/annotations/placeOutline.test.mjs

@@ -525,6 +525,46 @@ test('a coarse bundled admin-1 city waits for a finer outline', async () => {
   );
 });
 
+test('deferred outlines preserve provider administrative identity metadata', async () => {
+  const overParis = viewerAt(48.8566, 2.3522, 40_000);
+  const ring = square(48.8566, 2.3522, 0.05);
+  const { resolve } = harness(PARIS_PLACE, {
+    outlineRungs: rungsAnswering({
+      ring,
+      kind: 'area',
+      heightM: null,
+      adminArea: 'Île-de-France',
+      adminLevel: 'admin1',
+    }),
+  });
+  const outline = await (await resolve('Paris', overParis)).resolveOutline();
+  assert.equal(outline.adminArea, 'Île-de-France');
+  assert.equal(outline.adminLevel, 'admin1');
+});
+
+test('an explicitly distant area keeps its deferred outline', async () => {
+  const kathmandu = {
+    lat: 27.7172,
+    lng: 85.324,
+    label: 'Kathmandu, Nepal',
+    name: 'Kathmandu',
+    types: ['locality', 'political'],
+  };
+  const ring = square(27.7172, 85.324, 0.05);
+  const { resolve } = harness(kathmandu, {
+    outlineRungs: rungsAnswering({ ring, kind: 'area', heightM: null }),
+  });
+  const resolved = await resolve('Kathmandu', SAN_FRANCISCO, {
+    allowDistant: true,
+  });
+  assert.equal(resolved.source, 'geocode');
+  assert.deepEqual(
+    (await resolved.resolveOutline()).ring,
+    ring,
+    'the deferred centroid gate honors the same explicit distance policy as the anchor',
+  );
+});
+
 test('detailed admin-1 units and admin asks keep the bundled shape', async () => {
   const { resolve } = harness(null, { outlineRungs: rungsAnswering(null) });
   for (const [name, lat, lon] of [

src/annotations/resolver.js

@@ -588,6 +588,7 @@ export function createAnnotationResolver({
             buildingHeight: null,
             synthesized: false,
             naturalRegion: ne.name,
+            outlineSource: 'natural-earth',
             lat: neCentroid?.lat ?? lat,
             lon: neCentroid?.lon ?? lon,
             height: sampleGroundHeight(
@@ -857,6 +858,7 @@ export function createAnnotationResolver({
       if (
         fromGeocode &&
         !bypassNearViewGuards &&
+        !allowDistant &&
         gateDrift(centroid.lat, centroid.lon)
       )
         return null;
@@ -867,6 +869,8 @@ export function createAnnotationResolver({
         synthesized: Boolean(fp.synthesized),
         outlineCredit: fp.outlineCredit || null,
         ...(Array.isArray(fp.polygons) ? { polygons: fp.polygons } : {}),
+        ...(fp.adminArea ? { adminArea: fp.adminArea } : {}),
+        ...(fp.adminLevel ? { adminLevel: fp.adminLevel } : {}),
         lat: centroid.lat,
         lon: centroid.lon,
         height: sampleGroundHeight(viewer, centroid.lon, centroid.lat),
@@ -1119,6 +1123,7 @@ export function createAnnotationResolver({
       buildingHeight: null,
       synthesized: false,
       adminArea: admin.name,
+      outlineSource: admin.source,
       lat,
       lon,
       height: sampleGroundHeight(viewer, lon, lat),
@@ -1169,6 +1174,7 @@ export function createAnnotationResolver({
       buildingHeight: null,
       label: admin.name,
       source: 'bundled',
+      outlineSource: admin.source,
       synthesized: false,
       outlineUnavailable: false,
       viewport: {

src/app/constructCatalog.js

@@ -15,6 +15,7 @@ import { createApplicationTraffic } from './layers/traffic.js';
 import { createApplicationBikeshare } from './layers/bikeshare.js';
 import { createApplicationDirections } from './layers/directions.js';
 import { createApplicationRecentImagery } from './layers/recentImagery.js';
+import { createApplicationOsmPlaces } from './layers/osmPlaces.js';
 import { createApplicationTransit } from './layers/transit.js';
 import { createApplicationInstallations } from './layers/militaryInstallations.js';
 import { createApplicationSatellites } from './layers/satellites.js';
@@ -28,6 +29,7 @@ import { createApplicationAirQuality } from './layers/airQuality.js';
 import { createApplicationFirePerimeters } from './layers/perimeters.js';
 import { createApplicationGnssIntegrity } from './layers/gnss.js';
 import { createApplicationGhostMaps } from './layers/ghostMaps.js';
+import { createApplicationDroneAirspace } from './layers/droneAirspace.js';
 import { createApplicationCables } from './layers/submarineCables.js';
 import { createOsmOverlayLayers } from '../data/osmOverlays.js';
 import { createApplicationStreetLevel } from './layers/streetLevel.js';
@@ -42,6 +44,8 @@ import { createBhoteKoshiLocatorLayer } from '../data/bhoteKoshiLocator.js';
  */
 export const LOCAL_ONLY_LAYER_METADATA = Object.freeze([
   Object.freeze({ id: 'local-adsb', disposition: 'local-only' }),
+  // Voice search results belong to this session, like a receiver to this machine.
+  Object.freeze({ id: 'osm-places', disposition: 'local-only' }),
 ]);
 
 /** Serialization metadata for every layer the application catalog constructs. */
@@ -130,6 +134,9 @@ export function createApplicationCatalog({
           windowMs: sources['gnss-integrity'].windowMs,
         }),
         createApplicationGhostMaps({ source: sources['s2-ghostmaps'] }),
+        createApplicationDroneAirspace({
+          source: sources['drone-airspace'],
+        }),
         createApplicationAlpr({ surface, source: sources.alpr }),
         createApplicationStreetLevel({
           surface,
@@ -145,6 +152,7 @@ export function createApplicationCatalog({
         createApplicationBikeshare({ source: sources.bikeshare }),
         createApplicationDirections({ source: sources.directions }),
         createApplicationRecentImagery({ source: sources['recent-imagery'] }),
+        createApplicationOsmPlaces(),
         vessels,
         installations,
         createApplicationAwareness({

src/app/constructCatalog.test.mjs

@@ -40,8 +40,13 @@ test('catalogs construct distinct layers and classification from their supplied
     signal: b.signal,
     surface: fixtureSurface(b.signal),
   });
-  assert.equal(first.layers.length, 35);
+  assert.equal(first.layers.length, 37);
   assert.ok(first.get('local-adsb'), 'Local ADS-B is registered');
+  assert.deepEqual(
+    first.metadata.find(({ id }) => id === 'osm-places'),
+    { id: 'osm-places', disposition: 'local-only' },
+    'voice search results never enter share links or stored state',
+  );
   assert.deepEqual(
     first.metadata.find(({ id }) => id === 'local-adsb'),
     { id: 'local-adsb', disposition: 'local-only' },
@@ -62,6 +67,7 @@ test('catalogs construct distinct layers and classification from their supplied
   assert.ok(first.get('fire-perimeters'));
   assert.ok(first.get('gnss-integrity'));
   assert.ok(first.get('s2-ghostmaps'));
+  assert.ok(first.get('drone-airspace'));
   assert.ok(first.get('transit'));
   const order = first.layers.map(({ id }) => id);
   assert.deepEqual(
@@ -155,7 +161,7 @@ test('Mapillary can be omitted or replaced without changing catalog membership',
     surface: fixtureSurface(lifetime.signal),
   };
   const catalog = createApplicationCatalog(options);
-  assert.equal(catalog.layers.length, 35);
+  assert.equal(catalog.layers.length, 37);
   assert.deepEqual(catalog.get('street-level').providerIds, []);
   assert.equal(
     catalogControlServices(catalog).streetLevelLayer,

src/app/controls.js

@@ -1,6 +1,7 @@
 import { catalogControlServices } from './catalog.js';
 import { StyleManager } from '../ui/composition.js';
 import { flyToAustin } from '../camera.js';
+import { installZoomOutGuard } from './zoomOutGuard.js';
 import { initCockpitCloudEffects } from '../cockpitCloudEffects.js';
 import { t } from '../i18n/index.js';
 
@@ -41,6 +42,12 @@ export function createApplicationControls({
   defer(() => styleManager.orbitController.stop());
   defer(() => styleManager.hud.destroy());
   defer(() => styleManager.dispose());
+  defer(
+    installZoomOutGuard(viewer, {
+      subscribeCameraHandoff: (listener) =>
+        styleManager.subscribeCameraHandoff?.(listener),
+    }),
+  );
   // The previous multi-canvas weather compositor remains disabled. Cockpit
   // clouds use a separate, capped low-resolution GPU pass that never attaches
   // Cesium fog or post-process stages and is fully stopped in map mode.

src/app/controls.test.mjs

@@ -0,0 +1,68 @@
+import test, { after, before } from 'node:test';
+import assert from 'node:assert/strict';
+import * as Cesium from 'cesium';
+import '../testSupport/stubMgrs.mjs';
+import { installVueDom } from '../testSupport/vueDom.mjs';
+import { MAXIMUM_ZOOM_DISTANCE_M } from './zoomOutGuard.js';
+
+const { createApplicationControls } = await import('./controls.js');
+
+let uninstallDom;
+before(() => {
+  uninstallDom = installVueDom();
+});
+after(() => uninstallDom());
+
+test('application controls install the zoom-out guard and remove it on teardown', () => {
+  const canvas = document.createElement('canvas');
+  const controller = { maximumZoomDistance: Infinity };
+  const scene = {
+    mode: Cesium.SceneMode.SCENE3D,
+    screenSpaceCameraController: controller,
+    preRender: new Cesium.Event(),
+    postUpdate: new Cesium.Event(),
+  };
+  const camera = {
+    position: Cesium.Cartesian3.fromDegrees(0, 0, 1_000_000),
+    positionCartographic: { height: 1_000_000 },
+  };
+  const viewer = { scene, camera, canvas };
+  const handoffs = new Set();
+  class Controls {
+    hasShareState = true;
+    orbitController = { stop() {} };
+    hud = { destroy() {} };
+    dispose() {}
+    subscribeCameraHandoff(listener) {
+      handoffs.add(listener);
+      return () => handoffs.delete(listener);
+    }
+  }
+  const cleanups = [];
+  createApplicationControls({
+    scene: {
+      viewer,
+      mapStackController: {},
+      operations: {
+        surface: { controlServices: {} },
+        searchAndFlyTo() {},
+        requests: { regional: {}, weather: {} },
+      },
+    },
+    loaderStatus: {},
+    Controls,
+    catalog: { get: (id) => ({ id }) },
+    defer: (cleanup) => cleanups.push(cleanup),
+  });
+
+  assert.equal(controller.maximumZoomDistance, MAXIMUM_ZOOM_DISTANCE_M);
+  assert.equal(scene.preRender.numberOfListeners, 1);
+  assert.equal(scene.postUpdate.numberOfListeners, 1);
+  assert.equal(handoffs.size, 1);
+
+  for (const cleanup of cleanups.reverse()) cleanup();
+  assert.equal(controller.maximumZoomDistance, Infinity);
+  assert.equal(scene.preRender.numberOfListeners, 0);
+  assert.equal(scene.postUpdate.numberOfListeners, 0);
+  assert.equal(handoffs.size, 0);
+});

src/app/layers/droneAirspace.js

@@ -0,0 +1,22 @@
+import * as Cesium from 'cesium';
+import { createDroneAirspaceLayer } from '../../layers/droneAirspace/index.js';
+import * as picking from '../../data/pickRegistry.js';
+import * as overlays from '../../overlays/worldOverlay.js';
+import { isPointerFree } from '../../data/inputOwnership.js';
+
+/** Wire FAA special-use airspace into the application catalog. */
+export function createApplicationDroneAirspace(options) {
+  return createDroneAirspaceLayer({
+    overlayHost: {
+      setEntries: overlays.setOverlayEntries,
+      setVisible: overlays.setOverlaySourceVisible,
+      clearSource: overlays.clearOverlaySource,
+      hitTest: overlays.hitTestWorldOverlay,
+    },
+    screenSpaceEventHandlerFactory: (viewer) =>
+      new Cesium.ScreenSpaceEventHandler(viewer.scene.canvas),
+    picking,
+    pointer: { isPointerFree },
+    ...options,
+  });
+}

src/app/layers/osmPlaces.js

@@ -0,0 +1,7 @@
+import { createOsmPlacesLayer } from '../../layers/osmPlaces/index.js';
+import { overlayHost } from './overlayHost.js';
+
+/** Wire OSM Places labels to the application overlay host. */
+export function createApplicationOsmPlaces() {
+  return createOsmPlacesLayer({ overlayHost });
+}

src/app/sourceComposition.js

@@ -49,6 +49,7 @@ export const CATALOG_SOURCE_CONTRACTS = Object.freeze({
   'air-quality': contract(['air-quality'], ['getSnapshot']),
   'gnss-integrity': contract(['gnss-integrity'], ['getSnapshot']),
   's2-ghostmaps': contract(['s2-ghostmaps'], ['getCatalog', 'getFile']),
+  'drone-airspace': contract(['drone-airspace'], ['getSnapshot']),
   cables: contract(['telegeography-submarine-cables'], ['fetch']),
   transit: contract(['transit'], ['requestSnapshot', 'getHistory']),
 });

src/app/sourceComposition.test.mjs

@@ -37,7 +37,7 @@ test('every acquisition source can be omitted without losing catalog membership'
 
 test('all acquisition sources may be absent, and enable fails before initializing or fetching', async (t) => {
   const actual = catalog({}, t);
-  assert.equal(actual.layers.length, 35);
+  assert.equal(actual.layers.length, 37);
   const manager = new LayerLifecycle(
     {},
     { getSourceAvailability: actual.getSourceAvailability },

src/app/zoomOutGuard.js

@@ -0,0 +1,241 @@
+import * as Cesium from 'cesium';
+import { governorRequestRender } from '../renderGovernor.js';
+
+/** Whole-Earth input limit; explicit camera destinations can go farther. */
+export const MAXIMUM_ZOOM_DISTANCE_M = 40_000_000;
+/** Below this, oblique browsing is left alone. */
+export const PITCH_CLAMP_MIN_HEIGHT_M = 300_000;
+/** Look this far below the Earth's limb, so the globe stays on screen. */
+export const LIMB_MARGIN_RAD = Cesium.Math.toRadians(8);
+const PITCH_EASE = 0.35;
+const PITCH_SNAP_RAD = Cesium.Math.toRadians(0.1);
+const HEIGHT_EPSILON_M = 0.0001;
+const EARTH_RADIUS_M = 6_371_000;
+const INPUT_BINDINGS = Object.values(Cesium.CameraEventType).flatMap((type) =>
+  [undefined, ...Object.values(Cesium.KeyboardEventModifier)].map(
+    (modifier) => ({
+      type,
+      modifier,
+    }),
+  ),
+);
+
+/**
+ * The shallowest pitch (radians, negative is down) that still keeps the Earth
+ * framed from height `h`, or null where tilted views are left alone.
+ * The limb sits acos(R / (R + h)) below the local horizontal.
+ */
+export function maxPitchForHeight(h) {
+  if (!(h >= PITCH_CLAMP_MIN_HEIGHT_M)) return null;
+  const limb = Math.acos(EARTH_RADIUS_M / (EARTH_RADIUS_M + h));
+  return -Math.min(limb + LIMB_MARGIN_RAD, Cesium.Math.PI_OVER_TWO);
+}
+
+function matchesZoomBinding(bindings, type, modifier) {
+  if (Array.isArray(bindings))
+    return bindings.some((binding) =>
+      matchesZoomBinding(binding, type, modifier),
+    );
+  return typeof bindings === 'number'
+    ? bindings === type && modifier === undefined
+    : bindings?.eventType === type && bindings?.modifier === modifier;
+}
+
+function readInput(aggregator, bindings) {
+  let outward = false;
+  let cancel = false;
+  for (const { type, modifier } of INPUT_BINDINGS) {
+    if (!aggregator.isMoving(type, modifier)) continue;
+    const movement = aggregator.getMovement(type, modifier);
+    const pinch = type === Cesium.CameraEventType.PINCH;
+    const distance = pinch ? movement.distance : movement;
+    const delta = distance.endPosition.y - distance.startPosition.y;
+    // Cesium tilts by the fingers' midpoint while zooming by their spacing,
+    // both in the same quarter-pixel units. Fingers rarely keep a perfectly
+    // even spacing, so the larger of the two movements decides the gesture.
+    const tilt = pinch
+      ? movement.angleAndHeight.endPosition.y -
+        movement.angleAndHeight.startPosition.y
+      : 0;
+    if (
+      matchesZoomBinding(bindings, type, modifier) &&
+      Math.abs(delta) > Math.abs(tilt)
+    ) {
+      outward ||= delta < 0;
+      cancel ||= delta > 0;
+    } else {
+      // Includes modifier-specific tilts and parallel two-finger movement.
+      cancel = true;
+    }
+  }
+  aggregator.reset();
+  return { outward, cancel };
+}
+
+/**
+ * Keep outward user zooms bounded and framed, without taking camera ownership
+ * from tilts, tracked entities or flights. Returns an idempotent disposer.
+ */
+export function installZoomOutGuard(
+  viewer,
+  {
+    requestRender = governorRequestRender,
+    subscribeCameraHandoff,
+    createAggregator = (canvas) => new Cesium.CameraEventAggregator(canvas),
+  } = {},
+) {
+  const scene = viewer?.scene;
+  const controller = scene?.screenSpaceCameraController;
+  const camera = viewer?.camera;
+  const canvas = viewer?.canvas;
+  if (
+    !controller ||
+    !camera ||
+    !canvas ||
+    !scene.preRender ||
+    !scene.postUpdate
+  )
+    throw new TypeError('A complete Cesium viewer is required');
+
+  const aggregator = createAggregator(canvas);
+  const originalMaximumZoomDistance = controller.maximumZoomDistance;
+  const ownsCeiling = originalMaximumZoomDistance > MAXIMUM_ZOOM_DISTANCE_M;
+  let maximumZoomDistance = Math.min(
+    originalMaximumZoomDistance,
+    MAXIMUM_ZOOM_DISTANCE_M,
+  );
+  controller.maximumZoomDistance = maximumZoomDistance;
+  // Cesium clamps any zoom that starts above the limit to the limit, in either
+  // direction. A camera placed higher by a flight or share link keeps its own
+  // height as the limit, so it zooms in gradually and can't climb further.
+  const followCeiling = () => {
+    if (!ownsCeiling || controller.maximumZoomDistance !== maximumZoomDistance)
+      return;
+    // While tracking, Cesium measures zoom from the target, not the Earth, so
+    // the camera's altitude would lift the ceiling with every outward step.
+    const untracked =
+      scene.mode === Cesium.SceneMode.SCENE3D &&
+      Cesium.Matrix4.equals(camera.transform, Cesium.Matrix4.IDENTITY);
+    const height = untracked ? camera.positionCartographic?.height : undefined;
+    maximumZoomDistance =
+      height > MAXIMUM_ZOOM_DISTANCE_M ? height : MAXIMUM_ZOOM_DISTANCE_M;
+    controller.maximumZoomDistance = maximumZoomDistance;
+  };
+  followCeiling();
+
+  let lastHeight = camera.positionCartographic?.height;
+  let lastPosition = Cesium.Cartesian3.clone(camera.position);
+  let lastHeading = camera.heading;
+  let lastPitch = camera.pitch;
+  let lastRoll = camera.roll;
+  let zoomingOut = false;
+  let settling = false;
+  const cancel = () => {
+    zoomingOut = false;
+    settling = false;
+  };
+  const guard = () => {
+    const input = readInput(aggregator, controller.zoomEventTypes);
+    const height = camera.positionCartographic?.height;
+    const climbing = height > lastHeight + HEIGHT_EPSILON_M;
+    const descending = height < lastHeight - HEIGHT_EPSILON_M;
+    try {
+      if (
+        scene.mode !== Cesium.SceneMode.SCENE3D ||
+        controller.enableInputs === false ||
+        controller.enableZoom === false ||
+        !Cesium.Matrix4.equals(camera.transform, Cesium.Matrix4.IDENTITY) ||
+        // Cesium has no public running-flight flag.
+        camera._currentFlight ||
+        input.cancel ||
+        (descending && !settling)
+      ) {
+        cancel();
+        return;
+      }
+      if (input.outward) {
+        zoomingOut = true;
+        // A genuine outward gesture can be blocked by the controller's ceiling.
+        settling = true;
+      }
+      if (climbing) {
+        if (!zoomingOut) return;
+        settling = true;
+      } else {
+        zoomingOut = false;
+        // Outward inertia can lower altitude when Cesium clamps slant range at
+        // the ceiling. Finish that correction; fresh inward input cancels above.
+        // A stationary correction owns only the pose it last produced.
+        if (
+          !input.outward &&
+          ((!descending &&
+            !Cesium.Cartesian3.equals(camera.position, lastPosition)) ||
+            Math.abs(Cesium.Math.negativePiToPi(camera.heading - lastHeading)) >
+              1e-10 ||
+            Math.abs(camera.pitch - lastPitch) > 1e-10 ||
+            Math.abs(Cesium.Math.negativePiToPi(camera.roll - lastRoll)) >
+              1e-10)
+        )
+          settling = false;
+        if (!settling) return;
+      }
+      const maxPitch = maxPitchForHeight(height);
+      if (maxPitch === null || !(camera.pitch > maxPitch)) {
+        settling = false;
+      } else {
+        const error = maxPitch - camera.pitch;
+        const easedPitch =
+          Math.abs(error) <= PITCH_SNAP_RAD
+            ? maxPitch
+            : camera.pitch + error * PITCH_EASE;
+        // A large wheel step must not leave the view above the limb while easing.
+        const limbPitch = -Math.acos(
+          EARTH_RADIUS_M / (EARTH_RADIUS_M + height),
+        );
+        const pitch = Math.min(easedPitch, limbPitch);
+        camera.setView({
+          orientation: { heading: camera.heading, pitch, roll: camera.roll },
+        });
+        settling = pitch > maxPitch;
+      }
+      // Observe the end of inertia too; no arbitrary timeout cuts off a long zoom.
+      if (zoomingOut || settling) requestRender('zoom-out-guard');
+    } finally {
+      lastHeight = camera.positionCartographic?.height;
+      lastPosition = Cesium.Cartesian3.clone(camera.position, lastPosition);
+      lastHeading = camera.heading;
+      lastPitch = camera.pitch;
+      lastRoll = camera.roll;
+    }
+  };
+  const removePreRender = scene.preRender.addEventListener(guard);
+  // Fires every frame, after Cesium has applied this frame's input, while
+  // preRender fires only on frames that draw. Input that didn't move the camera
+  // (such as wheel at the ceiling) would otherwise wait for an unrelated frame.
+  const removePostUpdate = scene.postUpdate.addEventListener(() => {
+    followCeiling();
+    if (
+      INPUT_BINDINGS.some(({ type, modifier }) =>
+        aggregator.isMoving(type, modifier),
+      )
+    )
+      requestRender('zoom-out-guard');
+  });
+  const removeCameraHandoff = subscribeCameraHandoff?.(() => {
+    cancel();
+    // Discard input queued before an explicit navigation action took ownership.
+    aggregator.reset();
+  });
+
+  let active = true;
+  return () => {
+    if (!active) return;
+    active = false;
+    removeCameraHandoff?.();
+    removePreRender?.();
+    removePostUpdate?.();
+    aggregator.destroy();
+    if (controller.maximumZoomDistance === maximumZoomDistance)
+      controller.maximumZoomDistance = originalMaximumZoomDistance;
+  };
+}

src/app/zoomOutGuard.test.mjs

@@ -0,0 +1,764 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as Cesium from 'cesium';
+import {
+  installZoomOutGuard,
+  maxPitchForHeight,
+  MAXIMUM_ZOOM_DISTANCE_M,
+} from './zoomOutGuard.js';
+
+const deg = Cesium.Math.toDegrees;
+const { WHEEL, PINCH, RIGHT_DRAG, LEFT_DRAG, MIDDLE_DRAG } =
+  Cesium.CameraEventType;
+const { CTRL, SHIFT, ALT } = Cesium.KeyboardEventModifier;
+
+test('maxPitchForHeight leaves low-altitude tilt alone', () => {
+  assert.equal(maxPitchForHeight(0), null);
+  assert.equal(maxPitchForHeight(299_999), null);
+  assert.equal(maxPitchForHeight(NaN), null);
+  assert.equal(maxPitchForHeight(undefined), null);
+});
+
+test('maxPitchForHeight looks 8 degrees below the limb', () => {
+  assert.ok(Math.abs(deg(maxPitchForHeight(1_000_000)) + 38.19) < 0.01);
+  assert.equal(deg(maxPitchForHeight(1e12)), -90);
+});
+
+test('maxPitchForHeight steepens monotonically with height', () => {
+  let previous = 0;
+  for (let h = 300_000; h <= 100_000_000; h *= 1.5) {
+    const pitch = maxPitchForHeight(h);
+    assert.ok(pitch <= previous, `pitch at ${h} m`);
+    previous = pitch;
+  }
+});
+
+function guardFixture({ maximumZoomDistance = Infinity } = {}) {
+  const preRender = new Set();
+  const postUpdate = new Set();
+  const handoffs = new Set();
+  const container = new EventTarget();
+  const canvas = new EventTarget();
+  const movements = new Map();
+  const key = (type, modifier) => `${type}:${modifier}`;
+  const aggregator = {
+    resets: 0,
+    destroys: 0,
+    isMoving: (type, modifier) => movements.has(key(type, modifier)),
+    getMovement: (type, modifier) => movements.get(key(type, modifier)),
+    reset() {
+      movements.clear();
+      this.resets++;
+    },
+    destroy() {
+      this.destroys++;
+      movements.clear();
+    },
+  };
+  const camera = {
+    height: 170_000,
+    longitude: 0,
+    latitude: 0,
+    heading: 0.4,
+    pitch: Cesium.Math.toRadians(-25),
+    roll: 0,
+    transform: Cesium.Matrix4.clone(Cesium.Matrix4.IDENTITY),
+    views: [],
+    get positionCartographic() {
+      return {
+        height: this.height,
+        longitude: this.longitude,
+        latitude: this.latitude,
+      };
+    },
+    get position() {
+      return this.positionWC;
+    },
+    get positionWC() {
+      return Cesium.Cartesian3.fromRadians(
+        this.longitude,
+        this.latitude,
+        this.height,
+      );
+    },
+    setView({ orientation }) {
+      this.views.push(orientation);
+      this.heading = orientation.heading;
+      this.pitch = orientation.pitch;
+      this.roll = orientation.roll;
+    },
+  };
+  const controller = {
+    maximumZoomDistance,
+    enableInputs: true,
+    enableZoom: true,
+    zoomEventTypes: [
+      RIGHT_DRAG,
+      WHEEL,
+      PINCH,
+      { eventType: WHEEL, modifier: CTRL },
+    ],
+  };
+  const scene = {
+    mode: Cesium.SceneMode.SCENE3D,
+    screenSpaceCameraController: controller,
+    preRender: {
+      addEventListener(handler) {
+        preRender.add(handler);
+        return () => preRender.delete(handler);
+      },
+    },
+    postUpdate: {
+      addEventListener(handler) {
+        postUpdate.add(handler);
+        return () => postUpdate.delete(handler);
+      },
+    },
+  };
+  const renders = [];
+  const dispose = installZoomOutGuard(
+    { camera, container, canvas, scene },
+    {
+      subscribeCameraHandoff(listener) {
+        handoffs.add(listener);
+        return () => handoffs.delete(listener);
+      },
+      createAggregator(element) {
+        assert.equal(element, canvas);
+        return aggregator;
+      },
+      requestRender: (reason) => renders.push(reason),
+    },
+  );
+  // A frame Cesium skips drawing in request-render mode: no preRender.
+  const idleFrame = () => {
+    for (const handler of postUpdate) handler();
+  };
+  const frame = (height = camera.height) => {
+    camera.height = height;
+    idleFrame();
+    for (const handler of preRender) handler();
+  };
+  const movement = (type, deltaY, { modifier, tiltDeltaY = 0 } = {}) => {
+    const distance = {
+      startPosition: new Cesium.Cartesian2(0, 0),
+      endPosition: new Cesium.Cartesian2(0, deltaY),
+    };
+    movements.set(
+      key(type, modifier),
+      type === PINCH
+        ? {
+            distance,
+            angleAndHeight: {
+              startPosition: new Cesium.Cartesian2(0, 0),
+              endPosition: new Cesium.Cartesian2(0, tiltDeltaY),
+            },
+          }
+        : distance,
+    );
+    // Also exercise the former raw DOM path when running against the PR head.
+    const event = new Event(
+      type === WHEEL ? 'wheel' : type === PINCH ? 'touchmove' : 'pointermove',
+    );
+    Object.assign(event, {
+      buttons: type === RIGHT_DRAG ? 2 : type === MIDDLE_DRAG ? 4 : 1,
+      ctrlKey: modifier === CTRL,
+      shiftKey: modifier === SHIFT,
+      altKey: modifier === ALT,
+      touches: type === PINCH ? [1, 2] : [],
+    });
+    container.dispatchEvent(event);
+  };
+  return {
+    camera,
+    controller,
+    scene,
+    aggregator,
+    preRender,
+    postUpdate,
+    handoffs,
+    handoff: () => {
+      for (const listener of handoffs) listener();
+    },
+    renders,
+    dispose,
+    frame,
+    idleFrame,
+    movement,
+  };
+}
+
+test('a tilted wheel zoom-out pitches down and preserves heading and roll', () => {
+  const f = guardFixture();
+  f.frame();
+  f.movement(WHEEL, -10);
+  f.frame(1_000_000);
+  const target = maxPitchForHeight(1_000_000);
+  assert.ok(f.camera.pitch < Cesium.Math.toRadians(-25));
+  assert.ok(f.camera.pitch > target, 'eases rather than snapping');
+  assert.equal(f.camera.heading, 0.4);
+  assert.equal(f.camera.roll, 0);
+  for (let i = 1; i <= 40; i++) f.frame(1_000_000 + i);
+  assert.ok(
+    Math.abs(f.camera.pitch - maxPitchForHeight(f.camera.height)) < 1e-3,
+  );
+  assert.ok(f.renders.length > 0);
+});
+
+test('a large outward step immediately keeps the Earth limb in view', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(WHEEL, -100);
+  f.frame(20_000_000);
+  const limbPitch = -Math.acos(6_371_000 / (6_371_000 + 20_000_000));
+  assert.ok(f.camera.pitch <= limbPitch);
+  assert.ok(f.camera.pitch > maxPitchForHeight(20_000_000));
+});
+
+test('pinch, right-drag and configured Ctrl+wheel can zoom out', () => {
+  for (const [type, modifier] of [[PINCH], [RIGHT_DRAG], [WHEEL, CTRL]]) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(type, -10, { modifier });
+    f.frame(700_000);
+    assert.equal(f.camera.views.length, 1, `${type}:${modifier}`);
+    f.dispose();
+  }
+});
+
+test('Ctrl+right-drag tilt is left at the pose chosen by Cesium', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(RIGHT_DRAG, 3, { modifier: CTRL });
+  // Real Cesium's orbit tilt raises altitude with no zoom movement.
+  f.camera.pitch = Cesium.Math.toRadians(-26.07722459498313);
+  f.frame(529_392.3759876974);
+  assert.equal(f.camera.views.length, 0);
+  assert.equal(deg(f.camera.pitch), -26.07722459498313);
+});
+
+test('parallel two-finger tilt is not mistaken for pinch zoom', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(PINCH, 0, { tiltDeltaY: 3 });
+  f.frame(600_000);
+  assert.equal(f.camera.views.length, 0);
+});
+
+test('two-finger tilt with finger-spacing drift is left to Cesium', () => {
+  for (const [spacing, tilt] of [
+    [-0.01, 3],
+    [-2, 3],
+    [-3, -3],
+  ]) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(PINCH, spacing, { tiltDeltaY: tilt });
+    // Real Cesium's two-finger tilt climbs and picks its own pitch.
+    f.camera.pitch = Cesium.Math.toRadians(-26.07746);
+    f.frame(529_406);
+    assert.equal(f.camera.views.length, 0, `${spacing}, ${tilt}`);
+    f.dispose();
+  }
+});
+
+test('a pinch that closes the fingers more than it moves them still zooms out', () => {
+  // One finger still, the other sliding towards it: the midpoint moves half as far.
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(PINCH, -10, { tiltDeltaY: -5 });
+  f.frame(700_000);
+  assert.equal(f.camera.views.length, 1);
+  f.dispose();
+});
+
+test('unconfigured wheel modifiers and one-finger drag do not enable the guard', () => {
+  for (const [type, modifier] of [[WHEEL, SHIFT], [WHEEL, ALT], [LEFT_DRAG]]) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(type, -10, { modifier });
+    f.frame(600_000);
+    assert.equal(f.camera.views.length, 0, `${type}:${modifier}`);
+    f.dispose();
+  }
+});
+
+test('current controller zoom bindings are honored', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.controller.zoomEventTypes = { eventType: MIDDLE_DRAG, modifier: ALT };
+  f.movement(WHEEL, -10);
+  f.frame(600_000);
+  assert.equal(f.camera.views.length, 0);
+  f.movement(MIDDLE_DRAG, -10, { modifier: ALT });
+  f.frame(700_000);
+  assert.equal(f.camera.views.length, 1);
+});
+
+test('programmatic height changes alone never activate the guard', () => {
+  const f = guardFixture();
+  f.frame(170_000);
+  f.frame(2_000_000);
+  f.frame(3_000_000);
+  assert.equal(f.camera.views.length, 0);
+});
+
+test('inward zoom does not activate the guard even when altitude rises', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(WHEEL, 10);
+  f.frame(600_000);
+  assert.equal(f.camera.views.length, 0);
+});
+
+test('outward input with falling height does not alter pitch', () => {
+  const f = guardFixture();
+  f.frame(2_000_000);
+  f.movement(WHEEL, -10);
+  f.frame(1_500_000);
+  f.frame(1_500_000);
+  assert.equal(f.camera.views.length, 0);
+});
+
+test('pitch finishes settling when the zoom stops changing height', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(WHEEL, -10);
+  f.frame(2_000_000);
+  const firstPitch = f.camera.pitch;
+  for (let i = 0; i < 40; i++) f.frame();
+  assert.ok(f.camera.pitch < firstPitch);
+  assert.ok(Math.abs(f.camera.pitch - maxPitchForHeight(2_000_000)) < 1e-10);
+  const views = f.camera.views.length;
+  f.frame();
+  assert.equal(
+    f.camera.views.length,
+    views,
+    'settled pose does not keep rendering',
+  );
+});
+
+test('completed settling does not authorize a later programmatic climb', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(WHEEL, -10);
+  f.frame(700_000);
+  for (let i = 0; i < 40; i++) f.frame();
+  const views = f.camera.views.length;
+  f.frame(3_000_000);
+  assert.equal(f.camera.views.length, views);
+});
+
+test('a fresh inward zoom or unrelated gesture cancels pending correction', () => {
+  for (const [type, delta, options] of [
+    [WHEEL, 10, {}],
+    [RIGHT_DRAG, 3, { modifier: CTRL }],
+    [LEFT_DRAG, 3, {}],
+    [MIDDLE_DRAG, 3, {}],
+    [PINCH, 0, { tiltDeltaY: 3 }],
+  ]) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(WHEEL, -10);
+    f.frame(700_000);
+    const views = f.camera.views.length;
+    f.movement(type, delta, options);
+    f.frame(800_000);
+    f.frame(900_000);
+    assert.equal(f.camera.views.length, views, `${type}:${options.modifier}`);
+    f.dispose();
+  }
+});
+
+test('an external pose change at fixed height cancels pending correction', () => {
+  for (const field of ['heading', 'pitch', 'roll', 'longitude', 'latitude']) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(WHEEL, -10);
+    f.frame(700_000);
+    const views = f.camera.views.length;
+    f.camera[field] += 0.1;
+    f.frame();
+    f.frame(900_000);
+    assert.equal(f.camera.views.length, views, field);
+    f.dispose();
+  }
+});
+
+test('disabled controls, flights, tracked transforms and non-3D scenes cancel intent', () => {
+  const cases = [
+    (f) => {
+      f.controller.enableInputs = false;
+      return () => {
+        f.controller.enableInputs = true;
+      };
+    },
+    (f) => {
+      f.controller.enableZoom = false;
+      return () => {
+        f.controller.enableZoom = true;
+      };
+    },
+    (f) => {
+      f.camera._currentFlight = {};
+      return () => {
+        delete f.camera._currentFlight;
+      };
+    },
+    (f) => {
+      f.camera.transform = Cesium.Matrix4.fromTranslation(
+        new Cesium.Cartesian3(1, 2, 3),
+      );
+      return () => {
+        f.camera.transform = Cesium.Matrix4.clone(Cesium.Matrix4.IDENTITY);
+      };
+    },
+    (f) => {
+      f.scene.mode = Cesium.SceneMode.SCENE2D;
+      return () => {
+        f.scene.mode = Cesium.SceneMode.SCENE3D;
+      };
+    },
+  ];
+  for (const block of cases) {
+    const f = guardFixture();
+    f.frame(500_000);
+    f.movement(WHEEL, -10);
+    f.frame(700_000);
+    const views = f.camera.views.length;
+    const restore = block(f);
+    f.movement(WHEEL, -10);
+    f.frame(800_000);
+    restore();
+    f.frame(900_000);
+    assert.equal(f.camera.views.length, views);
+    f.movement(WHEEL, -10);
+    f.frame(1_000_000);
+    assert.equal(f.camera.views.length, views + 1);
+    f.dispose();
+  }
+});
+
+test('installer sets the ceiling and disposer releases aggregator and frame listener', () => {
+  const f = guardFixture();
+  assert.equal(f.controller.maximumZoomDistance, MAXIMUM_ZOOM_DISTANCE_M);
+  assert.equal(f.preRender.size, 1);
+  assert.equal(f.postUpdate.size, 1);
+  f.frame();
+  assert.ok(f.aggregator.resets > 0);
+  f.dispose();
+  f.dispose();
+  assert.equal(f.controller.maximumZoomDistance, Infinity);
+  assert.equal(f.aggregator.destroys, 1);
+  assert.equal(f.preRender.size, 0);
+  assert.equal(f.postUpdate.size, 0);
+  assert.equal(f.handoffs.size, 0);
+});
+
+test('installer preserves a stricter host zoom ceiling', () => {
+  const f = guardFixture({ maximumZoomDistance: 123 });
+  assert.equal(f.controller.maximumZoomDistance, 123);
+  f.dispose();
+  assert.equal(f.controller.maximumZoomDistance, 123);
+});
+
+test('disposer keeps a ceiling someone else changed later', () => {
+  const f = guardFixture();
+  f.controller.maximumZoomDistance = 5;
+  f.dispose();
+  assert.equal(f.controller.maximumZoomDistance, 5);
+});
+
+test('installer rejects an incomplete viewer', () => {
+  assert.throws(() => installZoomOutGuard({}), TypeError);
+});
+
+test('outward input at the ceiling reframes a deliberately tilted camera', () => {
+  const f = guardFixture();
+  f.frame(MAXIMUM_ZOOM_DISTANCE_M);
+  f.movement(WHEEL, -10);
+  f.frame();
+  for (let i = 0; i < 40; i++) f.frame();
+  assert.ok(
+    Math.abs(f.camera.pitch - maxPitchForHeight(MAXIMUM_ZOOM_DISTANCE_M)) <
+      1e-10,
+  );
+  f.dispose();
+});
+
+test('input that leaves the camera still requests a frame to read it', () => {
+  const f = guardFixture();
+  f.frame(MAXIMUM_ZOOM_DISTANCE_M);
+  f.idleFrame();
+  assert.deepEqual(f.renders, [], 'an idle scene stays idle');
+  // At the ceiling Cesium doesn't move the camera, so nothing would draw.
+  f.movement(WHEEL, -10);
+  f.idleFrame();
+  assert.deepEqual(f.renders, ['zoom-out-guard']);
+  f.frame();
+  assert.ok(f.camera.pitch < Cesium.Math.toRadians(-25), 'read that frame');
+  f.dispose();
+});
+
+test('equivalent heading and roll wraps do not cancel stationary settling', () => {
+  const f = guardFixture();
+  f.frame(500_000);
+  f.movement(WHEEL, -10);
+  f.frame(2_000_000);
+  f.camera.heading += Cesium.Math.TWO_PI;
+  f.camera.roll += Cesium.Math.TWO_PI;
+  for (let i = 0; i < 40; i++) f.frame();
+  assert.ok(Math.abs(f.camera.pitch - maxPitchForHeight(2_000_000)) < 1e-10);
+  f.dispose();
+});
+
+test('a real Cesium camera settles across the north heading wrap at Istanbul', () => {
+  const scene = {
+    canvas: { clientWidth: 1200, clientHeight: 800, width: 1200, height: 800 },
+    drawingBufferWidth: 1200,
+    drawingBufferHeight: 800,
+    mapProjection: new Cesium.GeographicProjection(),
+    globe: { ellipsoid: Cesium.Ellipsoid.WGS84 },
+    mapMode2D: Cesium.MapMode2D.INFINITE_SCROLL,
+    mode: Cesium.SceneMode.SCENE3D,
+    pixelRatio: 1,
+    preRender: new Cesium.Event(),
+    postUpdate: new Cesium.Event(),
+    screenSpaceCameraController: {
+      maximumZoomDistance: Infinity,
+      enableInputs: true,
+      zoomEventTypes: [WHEEL],
+    },
+  };
+  const camera = new Cesium.Camera(scene);
+  scene.camera = camera;
+  const setHeight = (height) =>
+    camera.setView({
+      destination: Cesium.Cartesian3.fromDegrees(28.9784, 41.0082, height),
+      orientation: { heading: 0, pitch: Cesium.Math.toRadians(-25), roll: 0 },
+    });
+  setHeight(1_000_000);
+  let outward = false;
+  const dispose = installZoomOutGuard(
+    { scene, camera, canvas: scene.canvas },
+    {
+      createAggregator: () => ({
+        isMoving: (type, modifier) =>
+          outward && type === WHEEL && modifier === undefined,
+        getMovement: () => ({
+          startPosition: { y: 0 },
+          endPosition: { y: -10 },
+        }),
+        reset: () => {
+          outward = false;
+        },
+        destroy() {},
+      }),
+      requestRender() {},
+    },
+  );
+  try {
+    setHeight(MAXIMUM_ZOOM_DISTANCE_M);
+    outward = true;
+    for (let i = 0; i < 40; i++) scene.preRender.raiseEvent(scene);
+    assert.ok(
+      Math.abs(
+        camera.pitch - maxPitchForHeight(camera.positionCartographic.height),
+      ) < 1e-8,
+    );
+  } finally {
+    dispose();
+  }
+});
+
+test('an outward inertia ceiling adjustment can descend while pitch settles', () => {
+  const f = guardFixture();
+  f.frame(39_000_000);
+  f.movement(WHEEL, -10);
+  f.frame(39_999_999);
+  const before = f.camera.pitch;
+  // Cesium limits slant range on an inertial pick, slightly below the altitude cap.
+  f.frame(39_997_258);
+  for (let i = 0; i < 40; i++) f.frame();
+  assert.ok(f.camera.pitch < before);
+  assert.ok(
+    Math.abs(f.camera.pitch - maxPitchForHeight(f.camera.height)) < 1e-10,
+  );
+  f.dispose();
+});
+
+test('a descending programmatic tilt cancels pending correction', () => {
+  const f = guardFixture();
+  f.frame(39_000_000);
+  f.movement(WHEEL, -10);
+  f.frame(39_999_999);
+  const count = f.camera.views.length;
+  f.camera.pitch += 0.1;
+  f.frame(39_997_258);
+  for (let i = 0; i < 40; i++) f.frame();
+  assert.equal(f.camera.views.length, count);
+  f.dispose();
+});
+
+test('explicit navigation cancels outward inertia before a climbing UI tilt', () => {
+  const f = guardFixture();
+  f.movement(WHEEL, -10);
+  f.frame(1_000_000);
+  f.movement(WHEEL, -10);
+  f.handoff();
+  const writes = f.camera.views.length;
+  f.camera.pitch = Cesium.Math.toRadians(-25);
+  f.frame(1_100_000);
+  f.frame(1_200_000);
+  assert.equal(f.camera.views.length, writes);
+  assert.equal(deg(f.camera.pitch), -25);
+  // A subsequent user zoom starts a new correction normally.
+  f.movement(WHEEL, -10);
+  f.frame(1_300_000);
+  assert.ok(f.camera.views.length > writes);
+  f.dispose();
+});
+
+// A real Cesium camera and controller, fed by DOM wheel events on the canvas.
+function realControllerScene(startHeight) {
+  const canvas = Object.assign(new EventTarget(), {
+    clientWidth: 1200,
+    clientHeight: 800,
+    width: 1200,
+    height: 800,
+    style: {},
+    // Keep Cesium's input handler off the missing `document`.
+    disableRootEvents: true,
+    onwheel: null,
+    getBoundingClientRect: () => ({
+      left: 0,
+      top: 0,
+      width: 1200,
+      height: 800,
+    }),
+  });
+  const scene = {
+    canvas,
+    drawingBufferWidth: 1200,
+    drawingBufferHeight: 800,
+    mapProjection: new Cesium.GeographicProjection(),
+    ellipsoid: Cesium.Ellipsoid.WGS84,
+    mapMode2D: Cesium.MapMode2D.INFINITE_SCROLL,
+    mode: Cesium.SceneMode.SCENE3D,
+    pixelRatio: 1,
+    verticalExaggeration: 1,
+    verticalExaggerationRelativeHeight: 0,
+    preRender: new Cesium.Event(),
+    postUpdate: new Cesium.Event(),
+  };
+  const camera = new Cesium.Camera(scene);
+  scene.camera = camera;
+  const controller = new Cesium.ScreenSpaceCameraController(scene);
+  controller.inertiaZoom = 0;
+  scene.screenSpaceCameraController = controller;
+  const setHeight = (h) =>
+    camera.setView({
+      destination: Cesium.Cartesian3.fromDegrees(28.9784, 41.0082, h),
+      orientation: { heading: 0, pitch: -Cesium.Math.PI_OVER_TWO, roll: 0 },
+    });
+  setHeight(startHeight);
+  const dispose = installZoomOutGuard(
+    { scene, camera, canvas },
+    { requestRender() {} },
+  );
+  // Scene.render order: the controller applies input, then postUpdate, then
+  // preRender on frames that draw.
+  const frame = () => {
+    controller.update();
+    scene.postUpdate.raiseEvent(scene);
+    scene.preRender.raiseEvent(scene);
+  };
+  const wheel = (deltaY) =>
+    canvas.dispatchEvent(
+      Object.assign(new Event('wheel'), {
+        deltaY,
+        deltaMode: 0,
+        clientX: 600,
+        clientY: 400,
+      }),
+    );
+  const height = () => camera.positionCartographic.height;
+  return {
+    scene,
+    camera,
+    controller,
+    setHeight,
+    frame,
+    wheel,
+    height,
+    dispose,
+  };
+}
+
+test('a camera placed above the ceiling cannot zoom out and zooms in without a jump', () => {
+  const s = realControllerScene(60_000_000);
+  try {
+    s.frame();
+    s.wheel(1);
+    s.frame();
+    assert.ok(Math.abs(s.height() - 60_000_000) < 1, `${s.height()} m`);
+    s.wheel(-1);
+    s.frame();
+    const firstStep = s.height();
+    assert.ok(firstStep < 60_000_000, 'zooms in');
+    assert.ok(firstStep > 50_000_000, `${firstStep} m is gradual`);
+    // The camera can no longer climb back above where it has descended to.
+    s.wheel(1);
+    s.frame();
+    assert.ok(Math.abs(s.height() - firstStep) < 1, `${s.height()} m`);
+    for (let i = 0; i < 40; i++) {
+      s.wheel(-100);
+      s.frame();
+    }
+    assert.ok(s.height() < MAXIMUM_ZOOM_DISTANCE_M);
+    assert.equal(s.controller.maximumZoomDistance, MAXIMUM_ZOOM_DISTANCE_M);
+    for (let i = 0; i < 80; i++) {
+      s.wheel(100);
+      s.frame();
+    }
+    assert.ok(Math.abs(s.height() - MAXIMUM_ZOOM_DISTANCE_M) < 1_000);
+  } finally {
+    s.dispose();
+  }
+  assert.equal(s.controller.maximumZoomDistance, Infinity);
+});
+
+test('a share-link view restored above the ceiling is honoured by later frames', () => {
+  const s = realControllerScene(1_000_000);
+  try {
+    s.frame();
+    s.setHeight(97_679_259);
+    s.frame();
+    s.wheel(100);
+    s.frame();
+    assert.ok(Math.abs(s.height() - 97_679_259) < 1, `${s.height()} m`);
+  } finally {
+    s.dispose();
+  }
+});
+
+test('a tracked camera cannot climb past the ceiling from its target', () => {
+  const s = realControllerScene(1_000_000);
+  try {
+    s.frame();
+    // In look-at mode Cesium measures zoom from the target, not the Earth.
+    s.camera.lookAt(
+      Cesium.Cartesian3.fromDegrees(0, 0, 35_786_000),
+      new Cesium.HeadingPitchRange(0, -0.5, 5_000_000),
+    );
+    for (let i = 0; i < 20; i++) {
+      s.wheel(100);
+      s.frame();
+    }
+    const range = Cesium.Cartesian3.magnitude(s.camera.position);
+    assert.ok(range <= MAXIMUM_ZOOM_DISTANCE_M + 1_000, `${range} m`);
+    assert.equal(s.controller.maximumZoomDistance, MAXIMUM_ZOOM_DISTANCE_M);
+  } finally {
+    s.dispose();
+  }
+});

src/awarenessEcho.js

@@ -0,0 +1,172 @@
+/**
+ * @module awarenessEcho
+ * @description The Global Context sonar echo field. The awareness layer
+ * publishes it while its range pulses run; the detection overlay reads it to
+ * pulse the brackets of contacts a pulse front has just crossed. It holds no
+ * awareness policy of its own: the publisher passes radius, pulse timing and
+ * echo styling in, so the overlay never imports awareness internals.
+ */
+import * as Cesium from 'cesium';
+
+/**
+ * @typedef {object} AwarenessEchoField
+ * @property {Cesium.Cartesian3} center Subject's ground point. The publisher
+ *   may move it in place; it is read on every query.
+ * @property {number} radiusM Range the pulses grow to.
+ * @property {{count: number, periodMs: number, startFraction: number, fadeInFraction?: number}} pulse
+ * @property {{fadeMs: number, layerIds: string[]}} echo
+ * @property {(nowMs: number) => number} [level] How far the pulses are
+ *   switched on, 0 to 1; echoes scale with it, so they rest with the pulses.
+ */
+
+/** @type {AwarenessEchoField|null} */
+let field = null;
+let layerIds = new Set();
+const groundScratch = new Cesium.Cartesian3();
+
+/**
+ * Start (or replace) the echo field.
+ * @param {AwarenessEchoField} next
+ * @returns {void}
+ */
+export function setAwarenessEchoField(next) {
+  field = next;
+  layerIds = new Set(next.echo.layerIds);
+}
+
+/** Stop all echoes. Safe when none were set. */
+export function clearAwarenessEchoField() {
+  field = null;
+  layerIds = new Set();
+}
+
+/** @returns {AwarenessEchoField|null} The field the overlay styles from. */
+export function getAwarenessEchoField() {
+  return field;
+}
+
+/**
+ * Whether any echo can light at `nowMs`: a field is set and its pulses are
+ * running. The overlay checks this once per frame, so resting pulses cost no
+ * per-contact work.
+ * @param {number} nowMs Monotonic clock in milliseconds.
+ * @returns {boolean}
+ */
+export function awarenessEchoActive(nowMs) {
+  return Boolean(field) && (field.level?.(nowMs) ?? 1) > 0;
+}
+
+/**
+ * How lit a contact's echo is at `nowMs`: 1 the moment a pulse front reaches
+ * its distance, fading as (1 - elapsed / `fadeMs`) squared, 0 otherwise. The
+ * strongest pulse wins. A front that has wrapped back to the centre still
+ * counts for the contact it last crossed, so rim contacts fade out instead of
+ * cutting off. Nothing nearer than the birth ring `startFraction` out echoes,
+ * and within the pulse's `fadeInFraction` the echo is scaled down with it.
+ * @param {number} nowMs Monotonic clock in milliseconds.
+ * @param {number} distanceM Contact's distance from the subject.
+ * @param {number} radiusM Range the pulses grow to.
+ * @param {{count: number, periodMs: number, startFraction: number, fadeInFraction?: number}} pulse
+ * @param {{fadeMs: number}} echo
+ * @returns {number} 0 to 1.
+ */
+export function awarenessEchoStrength(nowMs, distanceM, radiusM, pulse, echo) {
+  // Pulses are born `startFraction` out, so nothing nearer (the subject
+  // itself, its wingmen) is ever crossed; without this it lit on every birth.
+  if (
+    !Number.isFinite(distanceM) ||
+    distanceM < radiusM * pulse.startFraction ||
+    distanceM > radiusM
+  )
+    return 0;
+  // The phase at which a pulse front sits at this distance.
+  const touchPhase =
+    (distanceM / radiusM - pulse.startFraction) / (1 - pulse.startFraction);
+  let strength = 0;
+  for (let index = 0; index < pulse.count; index++) {
+    const cycle = nowMs / pulse.periodMs + index / pulse.count;
+    let since = cycle - Math.floor(cycle) - touchPhase;
+    // Rounding at the exact crossing must not read as a whole period ago.
+    if (since < -1e-9) since += 1;
+    else if (since < 0) since = 0;
+    const elapsedMs = since * pulse.periodMs;
+    if (elapsedMs < echo.fadeMs)
+      strength = Math.max(strength, (1 - elapsedMs / echo.fadeMs) ** 2);
+  }
+  // A front still fading in over `fadeInFraction` of its travel echoes no
+  // brighter than it shows.
+  const fadeIn = pulse.fadeInFraction ?? 0;
+  return fadeIn > 0 ? strength * Math.min(1, touchPhase / fadeIn) : strength;
+}
+
+/**
+ * The echo for one contact of `layerId` at world `position`, or 0 when no
+ * field is set or the layer does not echo. Distance is measured between
+ * ground points, so an aircraft's altitude does not shift its echo.
+ * @param {string} layerId Owning layer of the contact.
+ * @param {Cesium.Cartesian3} position Contact's world position.
+ * @param {number} nowMs Monotonic clock in milliseconds.
+ * @returns {number} 0 to 1.
+ */
+export function awarenessEchoAt(layerId, position, nowMs) {
+  if (!field || !position || !layerIds.has(layerId)) return 0;
+  const level = field.level?.(nowMs) ?? 1;
+  if (!(level > 0)) return 0;
+  const ground = Cesium.Ellipsoid.WGS84.scaleToGeodeticSurface(
+    position,
+    groundScratch,
+  );
+  if (!ground) return 0;
+  return (
+    level *
+    awarenessEchoStrength(
+      nowMs,
+      Cesium.Cartesian3.distance(field.center, ground),
+      field.radiusM,
+      field.pulse,
+      field.echo,
+    )
+  );
+}
+
+/**
+ * The echo bracket the detection overlay draws around one contact, or null
+ * when it has no echo. `band` is the alpha band, 1 to `steps`, the echo's
+ * strength times the contact bracket's own `bracketAlpha` rounded to the
+ * nearest band, so an echo is never drawn brighter than its bracket; one
+ * that rounds to nothing is not drawn. `spreadPx` is how far the echo sits
+ * outside the contact's bracket, 0 as the front arrives, growing to the
+ * field's `spreadPx` as it fades.
+ * @param {string} layerId Owning layer of the contact.
+ * @param {Cesium.Cartesian3} position Contact's world position.
+ * @param {number} nowMs Monotonic clock in milliseconds.
+ * @param {number} bracketAlpha The contact bracket's drawn alpha, 0 to 1.
+ * @param {number} steps Alpha bands the overlay batches by.
+ * @returns {{band: number, spreadPx: number}|null}
+ */
+export function awarenessEchoBracket(
+  layerId,
+  position,
+  nowMs,
+  bracketAlpha,
+  steps,
+) {
+  const echo = awarenessEchoAt(layerId, position, nowMs);
+  if (!(echo > 0.01)) return null;
+  const band = Math.min(steps, Math.round(echo * bracketAlpha * steps));
+  if (!(band >= 1)) return null;
+  return { band, spreadPx: field.echo.spreadPx * (1 - echo) };
+}
+
+/**
+ * The echo's stroke colour: the field's own colour on the default detection
+ * style, and the style's line colour under the others (NVG, FLIR, CRT), so
+ * an echo never stands out of a monochrome palette.
+ * @param {string} styleLine The active detection style's line colour.
+ * @param {boolean} defaultStyle Whether the default detection style is active.
+ * @returns {string|null} Null when no field is set.
+ */
+export function awarenessEchoColor(styleLine, defaultStyle) {
+  if (!field) return null;
+  return defaultStyle ? field.echo.color : styleLine;
+}

src/awarenessEcho.test.mjs

@@ -0,0 +1,141 @@
+// src/awarenessEcho.test.mjs — the Global Context echo field: when a sonar
+// pulse front crosses a flight or vessel, its bracket echo lights and fades.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as Cesium from 'cesium';
+import {
+  awarenessEchoActive,
+  awarenessEchoAt,
+  awarenessEchoStrength,
+  clearAwarenessEchoField,
+  getAwarenessEchoField,
+  setAwarenessEchoField,
+} from './awarenessEcho.js';
+
+const R = 250_000;
+const pulse = { count: 3, periodMs: 9000, startFraction: 0.02 };
+const echo = { fadeMs: 1400, layerIds: ['flights', 'ais-live-vessels'] };
+const strength = (nowMs, distanceM) =>
+  awarenessEchoStrength(nowMs, distanceM, R, pulse, echo);
+/** The moment pulse 0's front sits at `distanceM`, in a later cycle. */
+const arrival = (distanceM) =>
+  ((distanceM / R - pulse.startFraction) / (1 - pulse.startFraction)) *
+    pulse.periodMs +
+  pulse.periodMs * 4;
+
+test('an echo lights as a pulse front reaches the contact, then fades', () => {
+  const d = 100_000;
+  const t0 = arrival(d);
+  assert.ok(Math.abs(strength(t0, d) - 1) < 1e-6);
+  assert.ok(Math.abs(strength(t0 + echo.fadeMs / 2, d) - 0.25) < 1e-6);
+  assert.equal(strength(t0 + echo.fadeMs + 1, d), 0);
+  assert.equal(strength(t0 - 50, d), 0, 'dark just before the front');
+  // Every pulse lights it once a period: `count` separate flashes in any
+  // one-period window that starts after a flash has faded.
+  let flashes = 0;
+  let wasLit = false;
+  const from = t0 + echo.fadeMs + 1;
+  for (let ms = 0; ms < pulse.periodMs; ms += 10) {
+    const lit = strength(from + ms, d) > 0.5;
+    if (lit && !wasLit) flashes++;
+    wasLit = lit;
+  }
+  assert.equal(flashes, pulse.count);
+});
+
+test('rim contacts fade out after the front wraps; outside the range never', () => {
+  const rim = R * 0.999;
+  assert.ok(strength(arrival(rim) + echo.fadeMs / 2, rim) > 0.2);
+  // Inside the ring pulses are born on, nothing is ever crossed: the
+  // subject and anything within 5 km never echo, at any moment.
+  const inner = R * pulse.startFraction;
+  for (let ms = 0; ms < pulse.periodMs; ms += 10) {
+    assert.equal(strength(ms, 0), 0, 'the subject itself');
+    assert.equal(strength(ms, inner - 1), 0);
+  }
+  assert.ok(strength(pulse.periodMs * 5, inner) > 0.99, 'the birth ring');
+  for (let ms = 0; ms < pulse.periodMs; ms += 50)
+    assert.equal(strength(ms, R + 1), 0);
+  assert.equal(strength(0, Number.NaN), 0);
+  assert.equal(strength(0, -1), 0);
+});
+
+test('awarenessEchoAt reads the published field, by layer, at ground level', (t) => {
+  t.after(clearAwarenessEchoField);
+  const contact = Cesium.Cartesian3.fromDegrees(3.5, 27, 0);
+  assert.equal(awarenessEchoAt('flights', contact, 0), 0, 'no field, no echo');
+  const center = Cesium.Cartesian3.fromDegrees(3, 27, 0);
+  setAwarenessEchoField({ center, radiusM: R, pulse, echo });
+  assert.ok(getAwarenessEchoField());
+  const d = Cesium.Cartesian3.distance(center, contact);
+  const t0 = arrival(d);
+  assert.ok(awarenessEchoAt('flights', contact, t0) > 0.99);
+  assert.ok(awarenessEchoAt('ais-live-vessels', contact, t0) > 0.99);
+  // Layers outside the echo list never light.
+  assert.equal(awarenessEchoAt('cctv', contact, t0), 0);
+  assert.equal(awarenessEchoAt('military-installations', contact, t0), 0);
+  // An aircraft 11 km up echoes with the ground point under it.
+  const aloft = Cesium.Cartesian3.fromDegrees(3.5, 27, 11_000);
+  assert.ok(
+    Math.abs(
+      awarenessEchoAt('flights', aloft, t0 + 300) -
+        awarenessEchoAt('flights', contact, t0 + 300),
+    ) < 0.01,
+  );
+  // The field's centre is read in place, so a moved subject moves the echo:
+  // about 50 km farther, the contact lights at its new distance's moment.
+  Cesium.Cartesian3.clone(Cesium.Cartesian3.fromDegrees(3.5, 26.1, 0), center);
+  const moved = Cesium.Cartesian3.distance(center, contact);
+  assert.ok(Math.abs(moved - d) > 1000);
+  assert.ok(awarenessEchoAt('flights', contact, arrival(moved)) > 0.99);
+  assert.equal(awarenessEchoAt('flights', null, t0), 0);
+  clearAwarenessEchoField();
+  assert.equal(getAwarenessEchoField(), null);
+  assert.equal(awarenessEchoAt('flights', contact, t0), 0);
+});
+
+test('echoes scale with the field level and rest with the pulses', (t) => {
+  t.after(clearAwarenessEchoField);
+  const center = Cesium.Cartesian3.fromDegrees(3, 27, 0);
+  // ~100 km east of the subject, on the ground.
+  const contact = Cesium.Cartesian3.fromDegrees(4.008, 27, 0);
+  let level = 1;
+  setAwarenessEchoField({
+    center,
+    radiusM: R,
+    pulse,
+    echo,
+    level: () => level,
+  });
+  const d = Cesium.Cartesian3.distance(center, contact);
+  const t0 = arrival(d);
+  const full = awarenessEchoAt('flights', contact, t0);
+  assert.ok(full > 0.99);
+  level = 0.5;
+  assert.ok(
+    Math.abs(awarenessEchoAt('flights', contact, t0) - full / 2) < 1e-9,
+  );
+  assert.equal(awarenessEchoActive(t0), true);
+  level = 0;
+  assert.equal(awarenessEchoAt('flights', contact, t0), 0);
+  // At rest the overlay skips echoes for the whole frame.
+  assert.equal(awarenessEchoActive(t0), false);
+  clearAwarenessEchoField();
+  assert.equal(awarenessEchoActive(t0), false);
+});
+
+test('near the subject an echo is no brighter than the fading-in front', () => {
+  const fading = { ...pulse, fadeInFraction: 0.08 };
+  const at = (distanceM) =>
+    awarenessEchoStrength(arrival(distanceM), distanceM, R, fading, echo);
+  // Born at 5 km, the front reaches full strength 8% of the way out.
+  const full = R * (fading.startFraction + 0.08 * (1 - fading.startFraction));
+  assert.equal(at(R * fading.startFraction), 0);
+  const halfway = (R * fading.startFraction + full) / 2;
+  assert.ok(Math.abs(at(halfway) - 0.5) < 0.01, `${at(halfway)}`);
+  assert.ok(at(full + 1) > 0.99);
+  assert.ok(
+    at(R * 0.999) > 0.99,
+    'the rim, and so the ring flash, is unchanged',
+  );
+});

src/costEndpointThrottle.test.mjs

@@ -2,9 +2,13 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { readFileSync } from 'node:fs';
+import { EventEmitter } from 'node:events';
 import { Readable } from 'node:stream';
 import { readPinokioEnvironment } from '../scripts/pinokio-environment.mjs';
 import { openAiRealtimeProxy } from 'gods-eye-view/server/providers/openai';
+import { geminiLiveProxy } from '../server/providers/gemini.js';
+import { GEMINI_DEFAULT_PER_MIN } from '../server/providers/gemini/chat.js';
 import {
   makeCostRateLimiter,
   resolvePerMinuteCap,
@@ -168,6 +172,92 @@ test('the realtime token route throttles by default, and says so in a 429', asyn
   );
 });
 
+function chatRequest(handler, input) {
+  const req = Readable.from([Buffer.from(JSON.stringify(input))]);
+  Object.assign(req, {
+    method: 'POST',
+    url: '/',
+    headers: {
+      host: 'localhost:4173',
+      origin: 'http://localhost:4173',
+      'content-type': 'application/json',
+    },
+    socket: { remoteAddress: '127.0.0.1' },
+  });
+  const headers = {};
+  const res = Object.assign(new EventEmitter(), {
+    statusCode: 200,
+    setHeader(name, value) {
+      headers[name.toLowerCase()] = value;
+    },
+  });
+  return new Promise((resolve, reject) => {
+    res.end = (body = '') => {
+      res.writableEnded = true;
+      resolve({ status: res.statusCode, headers, body: String(body) });
+    };
+    Promise.resolve(handler(req, res)).catch(reject);
+  });
+}
+
+test('typed chat follows each provider throttle by default, before upstream', async (t) => {
+  for (const name of [
+    'GEV_RATELIMIT_OPENAI_CHAT_PER_MIN',
+    'GEV_RATELIMIT_OPENAI_PER_MIN',
+    'GEV_RATELIMIT_GEMINI_CHAT_PER_MIN',
+    'GEV_RATELIMIT_GEMINI_PER_MIN',
+    'GEV_PREFER_CODEX_OAUTH',
+  ])
+    env(t, name, undefined);
+  env(t, 'OPENAI_API_KEY', 'fixture-upstream-secret');
+  env(t, 'GEMINI_API_KEY', 'fixture-upstream-secret');
+  let upstreamCalls = 0;
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    upstreamCalls += 1;
+    return Response.json(
+      String(url).includes('openai')
+        ? { choices: [{ message: { role: 'assistant', content: 'Hi' } }] }
+        : {
+            candidates: [
+              { content: { role: 'model', parts: [{ text: 'Hi' }] } },
+            ],
+          },
+    );
+  });
+  // The chat fallback must track the Gemini token route's own default.
+  const tokenDefault = readFileSync(
+    new URL('../server/providers/gemini/realtime.js', import.meta.url),
+    'utf8',
+  ).match(/GEV_RATELIMIT_GEMINI_PER_MIN \?\? '(\d+)'/)?.[1];
+  assert.equal(Number(tokenDefault), GEMINI_DEFAULT_PER_MIN);
+
+  for (const [route, handler, cap, input] of [
+    [
+      '/api/openai/chat',
+      install(openAiRealtimeProxy({})).get('/api/openai/chat'),
+      OPENAI_DEFAULT_PER_MIN,
+      { messages: [{ role: 'user', content: 'Hello' }] },
+    ],
+    [
+      '/api/gemini/chat',
+      install(geminiLiveProxy({})).get('/api/gemini/chat'),
+      GEMINI_DEFAULT_PER_MIN,
+      { contents: [{ role: 'user', parts: [{ text: 'Hello' }] }] },
+    ],
+  ]) {
+    upstreamCalls = 0;
+    const statuses = [];
+    for (let i = 0; i < cap; i += 1)
+      statuses.push((await chatRequest(handler, input)).status);
+    assert.deepEqual(statuses, Array(cap).fill(200), route);
+    const overLimit = await chatRequest(handler, input);
+    assert.equal(overLimit.status, 429, route);
+    assert.equal(overLimit.headers['retry-after'], '60');
+    assert.equal(overLimit.body.includes('fixture-upstream-secret'), false);
+    assert.equal(upstreamCalls, cap, `${route} refuses before upstream`);
+  }
+});
+
 test('the HUD summary route throttles the paid path, never the free one', async (t) => {
   env(t, 'OPENAI_API_KEY', 'fixture-upstream-secret');
   let upstreamCalls = 0;

src/data/adminBoundaries.js

@@ -421,6 +421,49 @@ const COUNTRY_TARGET_ALIASES = new Map([
   ['drc', 'democratic republic of the congo'],
 ]);
 
+/**
+ * Country aliases that are another name for the very same unit. "Great
+ * Britain" and "Britain" are islands, "America" is also two continents and
+ * "Korea" two countries, so those find a country without naming it.
+ */
+const COUNTRY_IDENTITY_ALIASES = new Set([
+  'usa',
+  'us',
+  'u s',
+  'u s a',
+  'united states',
+  'uk',
+  'u k',
+  'russian federation',
+  'czechia',
+  'tanzania',
+  'drc',
+]);
+
+/**
+ * The unit an ask names in the matcher's own terms, when its words differ
+ * from the unit's name: "State of Texas" names Texas at admin level 1, and
+ * "USA" or "Country of USA" names United States of America. Null when the
+ * ask is just a name. Names are folded with `normalizeAdminName`.
+ * @param {string} text
+ * @returns {{name: string, level: 'country'|'admin1'}|null}
+ */
+export function adminQueryIdentity(text) {
+  const parsed = parseAdminQuery(text);
+  if (!parsed?.name) return null;
+  if (parsed.kind === 'state' && parsed.form === 'prefix')
+    return { name: parsed.name, level: 'admin1' };
+  if (parsed.kind !== 'country' && parsed.kind !== 'any') return null;
+  if (COUNTRY_IDENTITY_ALIASES.has(parsed.name))
+    return {
+      name: COUNTRY_TARGET_ALIASES.get(parsed.name),
+      level: 'country',
+    };
+  return parsed.kind === 'country'
+    ? { name: parsed.name, level: 'country' }
+    : null;
+}
+
 const COUNTRY_ALIASES = new Map([
   ...COUNTRY_TARGET_ALIASES,
   ['england', 'united kingdom'],
@@ -796,6 +839,35 @@ export async function findAdminArea(query, { near = null } = {}) {
   return toResult(ranked[0], candidates.length);
 }
 
+/**
+ * Every prominent unit an ask's words could mean — countries, and states or
+ * provinces that would answer a bare name (see `stateCandidates`) — for a
+ * caller that asks the user which one ("Georgia", "Punjab") instead of
+ * letting the camera decide. Qualifiers narrow the list as in
+ * `findAdminArea`; minor units ("Kent", "Santa Barbara") are left out.
+ *
+ * @param {string} query
+ * @returns {Promise<AdminArea[]>} Largest first; empty when none.
+ */
+export async function findAdminCandidates(query) {
+  const parsed = parseAdminQuery(query);
+  if (!parsed?.name || parsed.kind === 'county') return [];
+  const prominent = ({ entry }) =>
+    entry.kind === 'country' ||
+    (entry.feature.rank ?? Infinity) <= BARE_NAME_MAX_RANK ||
+    Boolean(entry.feature.cityState);
+  const candidates = [
+    ...(await countryCandidates(parsed)),
+    ...(parsed.kind === 'country'
+      ? []
+      : await stateCandidates(parsed, { allowAmbiguous: true })),
+  ].filter(prominent);
+  const seen = new Set();
+  return rank(candidates, null)
+    .filter(({ entry }) => !seen.has(entry) && seen.add(entry))
+    .map((scored) => toResult(scored, candidates.length));
+}
+
 /**
  * Geocoder-confirmed lookup: the geocoder typed a country, state or
  * county, so the unit must carry one of `names` AND contain the geocoded

src/data/adminBoundaries.test.mjs

@@ -7,6 +7,7 @@ import {
   decodeRing,
   findAdminArea,
   findAdminAreaAt,
+  findAdminCandidates,
   normalizeAdminName,
   packLoads,
   parseAdminQuery,
@@ -247,6 +248,7 @@ test('geocoder-confirmed lookup: the named unit that contains the point', async
     ),
     null,
   );
+  assert.deepEqual(await findAdminCandidates('Bagmati Province'), []);
   // A county the geocoder typed, named without the county word.
   const travis = await findAdminAreaAt(
     ['Travis', 'Travis County'],

src/data/analystEngine.js

@@ -18,7 +18,11 @@
  *
  * Providers (injected — keeps the engine pure and node-testable):
  *   getRecords(layerKey) → Array<record>            (layer accessor snapshot)
- *   resolveRegionRing(name, signal?) → Promise<{ring, name}|{error:'region-timeout'}|null>
+ *   resolveRegionRing(name, {signal}?) → Promise<{name, geometry|ring, prepared?, source?}
+ *     |{error:'region-timeout'}|{needsClarification, candidates}|null>
+ *     (geometry = MultiPolygon coordinates; islands and holes all count)
+ *   resolveAreaScope(scope) → Promise<{ok:true, area:{areaId, name, prepared,
+ *     source, approximate}}|{ok:false, code, error}>  (area/drawn/annotation)
  *   getViewContext() → {lat, lon, viewRadiusKm, bounds?}  (camera-derived)
  *
  * @module data/analystEngine
@@ -26,6 +30,7 @@
 
 import { feedProvenanceEnvelope } from './layerSnapshot.js';
 import { pointInRing } from './naturalEarthRegions.js';
+import { pointInPreparedArea, prepareArea } from './areaGeometry.js';
 import { VOICE_LAYER_MANIFEST, voiceLayer } from '../voice/layerManifest.js';
 import { greatCircleKm } from '../geoDistance.js';
 
@@ -67,6 +72,9 @@ const ANALYST_SCOPE_KINDS = Object.freeze([
   'region',
   'radius',
   'anywhere',
+  'area',
+  'drawn',
+  'annotation',
 ]);
 
 /**
@@ -104,9 +112,14 @@ export function haversineKm(lat1, lon1, lat2, lon2) {
   return greatCircleKm({ lat: lat1, lon: lon1 }, { lat: lat2, lon: lon2 });
 }
 
-/** Scope records spatially. scope: {kind:'view'|'region'|'radius'|'anywhere', …}. */
+/** Scope records spatially. scope: {kind:'view'|'region'|'radius'|'anywhere'|'area', …}. */
 export function applyScope(records, scope, resolved) {
   if (!scope || scope.kind === 'anywhere') return records;
+  if (resolved?.prepared) {
+    return records.filter((r) =>
+      pointInPreparedArea(resolved.prepared, r.lat, r.lon),
+    );
+  }
   if (scope.kind === 'region' && resolved?.ring) {
     return records.filter(
       (r) =>
@@ -320,6 +333,24 @@ function normalizeSpec(spec, layerKeys) {
       return {
         refusal: refusal('BAD_SCOPE', 'A region scope needs a place name.'),
       };
+    if (
+      kind === 'area' &&
+      (typeof scope.areaId !== 'string' || !scope.areaId.trim())
+    )
+      return {
+        refusal: refusal(
+          'BAD_SCOPE',
+          'An area scope needs the areaId resolve_area returned.',
+        ),
+      };
+    if (
+      kind === 'annotation' &&
+      scope.id !== undefined &&
+      (typeof scope.id !== 'string' || !scope.id.trim())
+    )
+      return {
+        refusal: refusal('BAD_SCOPE', 'scope.id must be an annotation id.'),
+      };
     if (scope.center !== undefined && scope.center !== null) {
       if (!validLat(scope.center.lat) || !validLon(scope.center.lon))
         return {
@@ -456,7 +487,16 @@ const ANSWERABLE = new Set(['ok', 'empty']);
 
 /** Rows per scan slice before yielding to the page. */
 const SCAN_CHUNK = 20_000;
+/**
+ * A slice also ends after this long: a row inside a large area pays a ray
+ * cast over every edge (a 6,000-vertex outline takes ~200 ms per 20,000 rows),
+ * so the row count alone would still make long tasks.
+ */
+const SCAN_BUDGET_MS = 8;
+/** Rows between clock checks. */
+const SCAN_CLOCK_EVERY = 256;
 const yieldToPage = () => new Promise((resolve) => setTimeout(resolve, 0));
+const clockMs = () => globalThis.performance?.now?.() ?? Date.now();
 
 /**
  * Compile the filters into one predicate over (layerKey, row).
@@ -597,12 +637,19 @@ export async function selectAnalystRows(
   let min = Infinity;
   let max = -Infinity;
   let seen = 0;
+  let sliceStart = clockMs();
   for (const { key, rows } of groups) {
     const kept = [];
     for (const row of rows) {
-      if (++seen % SCAN_CHUNK === 0) {
+      seen += 1;
+      if (
+        seen % SCAN_CHUNK === 0 ||
+        (seen % SCAN_CLOCK_EVERY === 0 &&
+          clockMs() - sliceStart >= SCAN_BUDGET_MS)
+      ) {
         await yieldToPage();
         if (!isCurrent()) return null;
+        sliceStart = clockMs();
       }
       if (inScope && !inScope(row)) continue;
       if (!passes(key, row)) continue;
@@ -650,9 +697,8 @@ export function createAnalystEngine(providers) {
   /**
    * Run one query.
    * @param {object} spec Query arguments (see the analyst_query tool).
-   * @param {{isCurrent?: () => boolean, signal?: AbortSignal,
-   *   beforeCommit?: (result: object) => Promise<object|void>}} [options]
-   *   A query that is no longer current
+   * @param {{signal?: AbortSignal, isCurrent?: () => boolean, beforeCommit?: (result: object) =>
+   *   Promise<object|void>}} [options] A query that is no longer current
    *   (cancelled or superseded while awaiting a boundary or between scan
    *   slices) returns CANCELLED and never replaces the follow-up memory.
    *   `beforeCommit` lets a caller finish required async projection work and
@@ -662,7 +708,7 @@ export function createAnalystEngine(providers) {
    */
   async function query(
     spec = {},
-    { isCurrent = () => true, signal = undefined, beforeCommit = null } = {},
+    { signal = null, isCurrent = () => true, beforeCommit = null } = {},
   ) {
     const cancelled = () =>
       refusal('CANCELLED', 'This query was superseded.', { cancelled: true });
@@ -673,6 +719,7 @@ export function createAnalystEngine(providers) {
         { coverage: { layersQueried: [], scope: 'none' } },
       );
     const followUp = Boolean(spec.followUp);
+    const inheritsRememberedScope = followUp && spec.scope == null;
     // A follow-up re-filters the remembered set. Layers named explicitly
     // must be that set: "those hospitals" after an aircraft answer is a new
     // question, never a filter over the old aircraft.
@@ -815,25 +862,37 @@ export function createAnalystEngine(providers) {
     }
 
     // 2) Spatial scope
-    const rememberedScope =
-      followUp && !spec.scope ? lastResult.scopePresentation || null : null;
-    const rememberedDistanceOf =
-      followUp && !spec.scope ? lastResult.distanceOf || null : null;
+    const rememberedPresentation = inheritsRememberedScope
+      ? lastResult.presentation || null
+      : null;
+    const rememberedCoverageNote =
+      rememberedPresentation?.coverageNote ||
+      (inheritsRememberedScope ? lastResult.coverage?.note : null);
+    const rememberedDistanceOf = inheritsRememberedScope
+      ? lastResult.distanceOf || null
+      : null;
     let resolvedScope = null;
-    let scopeNote = rememberedScope?.coverage || 'anywhere';
-    let scopeSource = rememberedScope?.source || null;
+    let scopeNote =
+      rememberedPresentation?.coverageScope ||
+      (inheritsRememberedScope ? lastResult.coverage?.scope : null) ||
+      'anywhere';
+    let scopeSource =
+      rememberedPresentation?.coverageScopeSource ||
+      (inheritsRememberedScope ? lastResult.coverage?.scopeSource : null) ||
+      null;
     // Human phrasing for the same scope, so every spoken count can name what it
     // measured ("8 in view", "about 30 within 250 km of Austin") instead of
     // arriving as a bare number that contradicts the panel.
-    let scopeLabel = rememberedScope?.label || 'anywhere in the loaded data';
-    let scopeDetail = rememberedScope?.detail || scopeLabel;
+    let scopeLabel =
+      rememberedPresentation?.scopeLabel || 'anywhere in the loaded data';
+    let scopeDetail = rememberedPresentation?.display?.scope || scopeLabel;
     // A follow-up re-filters a set that was already scoped, so it only narrows
     // further when a new scope is given.
     const scope = spec.scope || { kind: followUp ? 'anywhere' : 'view' };
     if (scope.kind === 'region') {
       let region;
       try {
-        region = await providers.resolveRegionRing(scope.name, signal);
+        region = await providers.resolveRegionRing(scope.name, { signal });
       } catch (error) {
         // Cancellation belongs to the query owner, not an error's name: a
         // resource-local AbortError from a current lookup still propagates.
@@ -849,7 +908,32 @@ export function createAnalystEngine(providers) {
           coverage: { layersQueried, scope: `region:${scope.name}:timeout` },
         };
       }
-      if (!region?.ring) {
+      if (region?.needsClarification) {
+        return refusal(
+          'NEEDS_CLARIFICATION',
+          region.error ||
+            `"${scope.name}" names more than one place — ask which one.`,
+          {
+            needsClarification: true,
+            query: scope.name,
+            candidates: region.candidates || [],
+            // The way back once the user picks: count over that area.
+            then: 'After the user picks, call resolve_area with that candidateId, then analyst_query with scope {kind:"area", areaId}.',
+            coverage: {
+              layersQueried,
+              scope: `region:${scope.name}:ambiguous`,
+            },
+          },
+        );
+      }
+      const prepared =
+        region?.prepared ||
+        (region?.geometry
+          ? prepareArea(region.geometry)
+          : region?.ring
+            ? prepareArea([[region.ring]])
+            : null);
+      if (!prepared) {
         return {
           ok: false,
           code: 'REGION_UNRESOLVED',
@@ -857,11 +941,39 @@ export function createAnalystEngine(providers) {
           coverage: { layersQueried, scope: `region:${scope.name}:unresolved` },
         };
       }
-      resolvedScope = region;
+      resolvedScope = { ...region, prepared };
       scopeNote = `region:${region.name}`;
       scopeSource = region.source || null;
       scopeLabel = `over ${region.name}`;
-      scopeDetail = scopeLabel;
+      const regionSource = region.sourceLabel || region.source;
+      scopeDetail = `${scopeLabel}${region.approximate ? ' (approximate outline)' : ''}${regionSource ? ` · ${regionSource}` : ''}`;
+    } else if (
+      scope.kind === 'area' ||
+      scope.kind === 'drawn' ||
+      scope.kind === 'annotation'
+    ) {
+      const found = providers.resolveAreaScope
+        ? await providers.resolveAreaScope(scope)
+        : {
+            ok: false,
+            code: 'AREA_UNAVAILABLE',
+            error: 'Area scopes are not available here.',
+          };
+      if (!isCurrent()) return cancelled();
+      if (!found?.ok || !found.area?.prepared) {
+        return refusal(
+          found?.code || 'AREA_UNKNOWN',
+          found?.error || 'That area is not available.',
+          { coverage: { layersQueried, scope: `${scope.kind}:unresolved` } },
+        );
+      }
+      const area = found.area;
+      resolvedScope = { prepared: area.prepared, name: area.name };
+      scopeNote = `area:${area.areaId || scope.kind}`;
+      scopeLabel = `inside ${area.name}`;
+      const sourceLabel = area.sourceLabel || area.source;
+      scopeDetail = `${scopeLabel}${area.approximate ? ' (approximate outline)' : ''}${sourceLabel ? ` · ${sourceLabel}` : ''}`;
+      if (area.areaId) resolvedScope.areaId = area.areaId;
     } else if (scope.kind === 'radius') {
       // An explicit center always wins. Otherwise, when Contacts is active its
       // SUBJECT is the centre the operator is actually reasoning about: the
@@ -906,25 +1018,21 @@ export function createAnalystEngine(providers) {
       scopeLabel = 'in view';
       scopeDetail = `within ${Math.round(view.viewRadiusKm)} km of the view centre`;
     }
-    const inScope =
-      scope.kind === 'region' && resolvedScope?.ring
+    const inScope = resolvedScope?.prepared
+      ? (row) => pointInPreparedArea(resolvedScope.prepared, row.lat, row.lon)
+      : (scope.kind === 'radius' || scope.kind === 'view') &&
+          resolvedScope?.center &&
+          Number.isFinite(resolvedScope.km)
         ? (row) =>
             Number.isFinite(row.lat) &&
             Number.isFinite(row.lon) &&
-            pointInRing(resolvedScope.ring, row.lat, row.lon)
-        : (scope.kind === 'radius' || scope.kind === 'view') &&
-            resolvedScope?.center &&
-            Number.isFinite(resolvedScope.km)
-          ? (row) =>
-              Number.isFinite(row.lat) &&
-              Number.isFinite(row.lon) &&
-              haversineKm(
-                resolvedScope.center.lat,
-                resolvedScope.center.lon,
-                row.lat,
-                row.lon,
-              ) <= resolvedScope.km
-          : null;
+            haversineKm(
+              resolvedScope.center.lat,
+              resolvedScope.center.lon,
+              row.lat,
+              row.lon,
+            ) <= resolvedScope.km
+        : null;
 
     // 3) Filter, count and rank in one pass, yielding between slices.
     const selection = await selectAnalystRows(groups, {
@@ -992,15 +1100,25 @@ export function createAnalystEngine(providers) {
       // For on-screen text; the model speaks the count and scopeLabel only.
       display: {
         scope: scopeDetail,
-        ...(windows.length ? { window: windows.join('; ') } : {}),
-        ...(caveats.length ? { caveat: caveats.join('; ') } : {}),
+        ...(rememberedPresentation?.display?.window || windows.length
+          ? {
+              window:
+                rememberedPresentation?.display?.window || windows.join('; '),
+            }
+          : {}),
+        ...(rememberedPresentation?.display?.caveat || caveats.length
+          ? {
+              caveat:
+                rememberedPresentation?.display?.caveat || caveats.join('; '),
+            }
+          : {}),
       },
       coverage: {
         layersQueried,
         records: totals,
         scope: scopeNote,
         ...(scopeSource ? { scopeSource } : {}),
-        ...(rememberedScope?.note ? { note: rememberedScope.note } : {}),
+        ...(rememberedCoverageNote ? { note: rememberedCoverageNote } : {}),
         ...(queriedSnapshots.length
           ? { feedProvenance: feedProvenanceEnvelope(queriedSnapshots) }
           : {}),
@@ -1010,37 +1128,102 @@ export function createAnalystEngine(providers) {
       // than implying a view-centred answer.
       ...(resolvedScope?.centeredOn
         ? { centeredOn: resolvedScope.centeredOn }
+        : rememberedPresentation?.centeredOn
+          ? { centeredOn: rememberedPresentation.centeredOn }
+          : {}),
+      ...(rememberedPresentation?.window
+        ? { window: structuredClone(rememberedPresentation.window) }
         : {}),
+      ...(resolvedScope?.areaId
+        ? { areaId: resolvedScope.areaId }
+        : rememberedPresentation?.areaId
+          ? { areaId: rememberedPresentation.areaId }
+          : {}),
     };
     const memoryOverride =
       typeof beforeCommit === 'function'
         ? (await beforeCommit(result)) || null
         : null;
     if (!isCurrent()) return cancelled();
-    const committedCoverage = memoryOverride?.coverage || result.coverage;
     lastResult = {
       matched: memoryOverride?.matched || selection.matched,
       distanceOf: memoryOverride?.distanceOf || rememberedDistanceOf,
       layerKeys: [...(memoryOverride?.layerKeys || layers)],
-      coverage: committedCoverage,
+      coverage: memoryOverride?.coverage || result.coverage,
       unanswered: [
         ...(memoryOverride?.unanswered === undefined
           ? unanswered
           : memoryOverride.unanswered),
       ],
-      scopePresentation: {
-        label: memoryOverride?.scopeLabel || result.scopeLabel,
-        detail: memoryOverride?.scopeDetail || result.display.scope,
-        coverage: committedCoverage.scope,
-        source: committedCoverage.scopeSource || null,
-        note: committedCoverage.note || null,
-      },
+      presentation: structuredClone(
+        memoryOverride?.presentation || {
+          scopeLabel: result.scopeLabel,
+          display: result.display,
+          coverageScope: result.coverage?.scope,
+          ...(result.coverage?.scopeSource
+            ? { coverageScopeSource: result.coverage.scopeSource }
+            : {}),
+          ...(result.coverage?.note
+            ? { coverageNote: result.coverage.note }
+            : {}),
+          ...(result.centeredOn ? { centeredOn: result.centeredOn } : {}),
+          ...(result.window ? { window: result.window } : {}),
+          ...(result.areaId ? { areaId: result.areaId } : {}),
+        },
+      ),
     };
     return result;
   }
 
   return {
     query,
+    /**
+     * Make another tool's result set "the last answer" (osm_query's places),
+     * so a follow-up filters exactly what the user just heard about.
+     * @param {string} layerKey Queryable layer the rows belong to.
+     * @param {Array<object>} rows Records in that layer's analyst shape.
+     * @param {{scope?: string, presentation?: object|null, truncated?: boolean}} [options]
+     *   `presentation` is how the set was scoped ("inside Kathmandu"), so a
+     *   follow-up names the same scope instead of "anywhere". `truncated`
+     *   says the set is only the first part of a larger one, so follow-ups
+     *   stay incomplete (a count is a floor) rather than claiming the whole.
+     */
+    remember(
+      layerKey,
+      rows,
+      { scope = 'handoff', presentation = null, truncated = false } = {},
+    ) {
+      if (!ANALYST_LAYERS[layerKey] || !Array.isArray(rows)) return false;
+      const capped = truncated === true;
+      // A capped set's true size is unknown.
+      const total = capped ? null : rows.length;
+      lastResult = {
+        ...(presentation
+          ? { presentation: structuredClone(presentation) }
+          : {}),
+        matched: [{ key: layerKey, rows: rows.slice() }],
+        layerKeys: [layerKey],
+        coverage: {
+          layersQueried: [
+            {
+              layerKey,
+              status: rows.length ? 'ok' : 'empty',
+              returned: rows.length,
+              total,
+              truncated: capped,
+            },
+          ],
+          records: {
+            returned: rows.length,
+            total,
+            truncated: capped,
+          },
+          scope,
+          followUp: false,
+        },
+      };
+      return true;
+    },
     reset() {
       lastResult = null;
     },

src/data/analystEngine.test.mjs

@@ -275,14 +275,18 @@ for (const [label, committedScope, scopeSource] of [
           const { scopeSource: _originalSource, ...coverage } = result.coverage;
           return {
             matched: [{ key: 'flights', rows: [FLIGHTS[1]] }],
-            scopeLabel: 'the presented cohort',
-            scopeDetail: 'the presented cohort window',
             coverage: {
               ...coverage,
               scope: committedScope,
               ...(scopeSource ? { scopeSource } : {}),
               feedProvenance: { layers: [committedSnapshot] },
             },
+            presentation: {
+              scopeLabel: 'the presented cohort',
+              display: { scope: 'the presented cohort window' },
+              coverageScope: committedScope,
+              ...(scopeSource ? { coverageScopeSource: scopeSource } : {}),
+            },
           };
         },
       },
@@ -436,6 +440,87 @@ test('analyst: failed pre-commit work cannot replace follow-up memory', async ()
   assert.deepEqual(followUp.items.map((item) => item.id), ['SWA1']);
 });
 
+test('analyst: follow-ups preserve partial and unanswered coverage', async () => {
+  const eng = createAnalystEngine({
+    getRecords: (key) => (key === 'flights' ? FLIGHTS : []),
+    getLayerSnapshot: (key) => ({
+      enabled: key === 'flights',
+      feedState: key === 'flights' ? 'nominal' : 'off',
+    }),
+    getViewContext: () => ({ lat: 30.27, lon: -97.74, viewRadiusKm: 150 }),
+  });
+  const first = await eng.query({
+    layers: ['flights', 'military'],
+    scope: { kind: 'anywhere' },
+  });
+  assert.equal(first.partial, true);
+  assert.deepEqual(first.unanswered, ['military']);
+
+  const followUp = await eng.query({ followUp: true, limit: 1 });
+  assert.equal(followUp.partial, true);
+  assert.deepEqual(followUp.unanswered, ['military']);
+  assert.deepEqual(
+    followUp.coverage.layersQueried.map(({ layerKey, status }) => [
+      layerKey,
+      status,
+    ]),
+    first.coverage.layersQueried.map(({ layerKey, status }) => [
+      layerKey,
+      status,
+    ]),
+  );
+});
+
+test('analyst: cancelled pre-commit work cannot replace follow-up memory', async () => {
+  const eng = makeEngine();
+  await eng.query({
+    layers: ['flights'],
+    scope: { kind: 'anywhere' },
+    filters: [{ field: 'id', op: 'eq', value: 'SWA1' }],
+  });
+  let current = true;
+  const stale = await eng.query(
+    { layers: ['local-firms'], scope: { kind: 'anywhere' } },
+    {
+      isCurrent: () => current,
+      beforeCommit: async () => {
+        current = false;
+      },
+    },
+  );
+  assert.equal(stale.code, 'CANCELLED');
+  const followUp = await eng.query({ followUp: true });
+  assert.deepEqual(
+    followUp.items.map((item) => item.id),
+    ['SWA1'],
+  );
+});
+
+test('analyst: failed pre-commit work cannot replace follow-up memory', async () => {
+  const eng = makeEngine();
+  await eng.query({
+    layers: ['flights'],
+    scope: { kind: 'anywhere' },
+    filters: [{ field: 'id', op: 'eq', value: 'SWA1' }],
+  });
+  await assert.rejects(
+    eng.query(
+      { layers: ['local-firms'], scope: { kind: 'anywhere' } },
+      {
+        beforeCommit: async () => {
+          throw new Error('projection failed');
+        },
+      },
+    ),
+    /projection failed/,
+  );
+  const followUp = await eng.query({ followUp: true });
+  assert.deepEqual(
+    followUp.items.map((item) => item.id),
+    ['SWA1'],
+  );
+});
+
 test('analyst: unresolved region is an honest failure, not empty success', async () => {
   const r = await makeEngine().query({ layers: ['flights'], scope: { kind: 'region', name: 'Atlantis' } });
   assert.equal(r.ok, false);
@@ -460,7 +545,7 @@ test('analyst: region lookup receives and obeys the owning action signal', async
   let receivedSignal = null;
   const eng = createAnalystEngine({
     getRecords: () => FLIGHTS,
-    resolveRegionRing: async (_name, signal) => {
+    resolveRegionRing: async (_name, { signal }) => {
       receivedSignal = signal;
       await new Promise((resolve) =>
         signal.addEventListener('abort', resolve, { once: true }),
@@ -514,7 +599,7 @@ for (const [label, reason, trackAuthority] of [
     };
     const engine = createAnalystEngine({
       getRecords: () => FLIGHTS,
-      resolveRegionRing: (name, signal) => resolveRegionRingForQuery(
+      resolveRegionRing: (name, { signal } = {}) => resolveRegionRingForQuery(
         name, signal, placeSearch, { budgetMs: Infinity },
       ),
     });
@@ -720,7 +805,9 @@ test('unknown fields, operators, scopes and wrong-typed values are refused with
   assert.equal(num.code, 'BAD_VALUE');
   const scope = await engine.query({ layers: ['flights'], scope: { kind: 'polygon' } });
   assert.equal(scope.code, 'UNKNOWN_SCOPE');
-  assert.deepEqual(scope.allowed, ['view', 'region', 'radius', 'anywhere']);
+  assert.deepEqual(scope.allowed, ['view', 'region', 'radius', 'anywhere', 'area', 'drawn', 'annotation']);
+  const noId = await engine.query({ layers: ['flights'], scope: { kind: 'area' } });
+  assert.equal(noId.code, 'BAD_SCOPE', 'an area scope needs its areaId');
   const sort = await engine.query({ layers: ['flights'], sortBy: 'loudness' });
   assert.equal(sort.code, 'UNKNOWN_FIELD');
   assert.equal(engine.hasMemory(), false, 'refusals never become follow-up memory');
@@ -963,3 +1050,193 @@ test('analyst: a follow-up naming other layers than the last answer is refused',
   assert.equal(r.code, 'FOLLOW_UP_MISMATCH');
   assert.equal(engine.hasMemory(), true, 'the earlier answer is still the last answer');
 });
+
+// ── Area handles: region multipolygons and the area / drawn / annotation scopes ──
+
+const box = (w, s, e, n) => [[w, s], [e, s], [e, n], [w, n], [w, s]];
+
+function makeAreaEngine(overrides = {}) {
+  return createAnalystEngine({
+    getRecords: (key) => ({ flights: FLIGHTS, 'local-firms': FIRES }[key] || []),
+    resolveRegionRing: async () => null,
+    getViewContext: () => ({ lat: 30.27, lon: -97.74, viewRadiusKm: 150 }),
+    ...overrides,
+  });
+}
+
+test('analyst: a region counts every part of a multipolygon and skips its holes', async () => {
+  // Main part around Austin with a hole over the airport ground traffic, and a
+  // separate island over Oregon: the old largest-ring shortcut dropped N123.
+  const engine = makeAreaEngine({
+    resolveRegionRing: async () => ({
+      name: 'Archipelago',
+      geometry: [
+        [box(-100, 28, -94, 33), box(-97.7, 30.1, -97.6, 30.25)],
+        [box(-123, 44, -121, 46)],
+      ],
+      source: 'osm',
+    }),
+  });
+  const r = await engine.query({ layers: ['flights'], scope: { kind: 'region', name: 'Archipelago' }, limit: 10 });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.items.map((i) => i.id).sort(), ['N123', 'RCH01']);
+  assert.equal(r.count, 2, 'SWA1 and GND1 sit in the hole');
+  assert.match(r.display.scope, /over Archipelago · osm/);
+});
+
+test('analyst: an ambiguous region asks instead of counting', async () => {
+  const engine = makeAreaEngine({
+    resolveRegionRing: async () => ({
+      ok: false,
+      needsClarification: true,
+      candidates: [{ candidateId: 'osm:r1', name: 'Georgia', level: 'country' }],
+      error: '"Georgia" matches 2 places — ask which one.',
+    }),
+  });
+  const r = await engine.query({ layers: ['flights'], scope: { kind: 'region', name: 'Georgia' } });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'NEEDS_CLARIFICATION');
+  assert.equal(r.candidates.length, 1);
+  assert.match(r.then, /resolve_area.*candidateId.*analyst_query.*kind.*area/, 'the model gets a route back');
+  assert.equal(engine.hasMemory(), false);
+});
+
+test('analyst: region lookup receives the caller lifetime signal', async () => {
+  const controller = new AbortController();
+  let received;
+  const engine = makeAreaEngine({
+    resolveRegionRing: async (_name, options) => {
+      received = options?.signal;
+      return { error: 'region-timeout' };
+    },
+  });
+  const result = await engine.query(
+    {
+      layers: ['flights'],
+      scope: { kind: 'region', name: 'Signal Region' },
+    },
+    { signal: controller.signal },
+  );
+  assert.equal(received, controller.signal);
+  assert.equal(result.code, 'region-timeout');
+});
+
+test('analyst: an area scope counts inside the stored handle and names it', async () => {
+  const { prepareArea } = await import('./areaGeometry.js');
+  const prepared = prepareArea([[box(-99, 30, -97.5, 31)]]);
+  const seen = [];
+  const engine = makeAreaEngine({
+    resolveAreaScope: async (scope) => {
+      seen.push(scope);
+      if (scope.kind === 'area' && scope.areaId === 'osm:r42')
+        return { ok: true, area: { areaId: 'osm:r42', name: 'Hill Country', prepared, source: 'osm' } };
+      if (scope.kind === 'drawn')
+        return { ok: true, area: { areaId: 'anno:anno-7', name: 'the drawn area', prepared, source: 'drawn' } };
+      return { ok: false, code: 'AREA_UNKNOWN', error: 'No such area' };
+    },
+  });
+  const fires = await engine.query({ layers: ['local-firms'], scope: { kind: 'area', areaId: 'osm:r42' } });
+  assert.equal(fires.ok, true);
+  assert.equal(fires.count, 2);
+  assert.equal(fires.scopeLabel, 'inside Hill Country');
+  assert.equal(fires.areaId, 'osm:r42');
+  assert.equal(fires.coverage.scope, 'area:osm:r42');
+  const followUp = await engine.query({ followUp: true, limit: 1 });
+  assert.equal(followUp.scopeLabel, 'inside Hill Country');
+  assert.match(followUp.display.scope, /inside Hill Country/);
+  assert.equal(followUp.coverage.scope, 'area:osm:r42');
+  assert.equal(followUp.areaId, 'osm:r42');
+  const drawn = await engine.query({ layers: ['flights'], scope: { kind: 'drawn' } });
+  assert.equal(drawn.ok, true);
+  assert.equal(drawn.count, 2, 'SWA1 and GND1 sit inside the drawn box');
+  const missing = await engine.query({ layers: ['flights'], scope: { kind: 'area', areaId: 'osm:r0' } });
+  assert.equal(missing.ok, false);
+  assert.equal(missing.code, 'AREA_UNKNOWN');
+  assert.deepEqual(seen.map((s) => s.kind), ['area', 'drawn', 'area']);
+});
+
+test('analyst: an area scope superseded while resolving is cancelled and leaves no memory', async () => {
+  const { prepareArea } = await import('./areaGeometry.js');
+  let current = true;
+  const engine = makeAreaEngine({
+    resolveAreaScope: async () => {
+      current = false; // a newer turn arrived while the area was looked up
+      return { ok: true, area: { name: 'X', prepared: prepareArea([[box(-100, 28, -94, 33)]]) } };
+    },
+  });
+  const r = await engine.query(
+    { layers: ['flights'], scope: { kind: 'annotation' } },
+    { isCurrent: () => current },
+  );
+  assert.equal(r.code, 'CANCELLED');
+  assert.equal(engine.hasMemory(), false);
+});
+
+test('analyst: without an area provider the area scopes refuse plainly', async () => {
+  const r = await makeAreaEngine().query({ layers: ['flights'], scope: { kind: 'drawn' } });
+  assert.equal(r.ok, false);
+  assert.equal(r.code, 'AREA_UNAVAILABLE');
+});
+
+test('a follow-up on handed-off places keeps the area they were found in', async () => {
+  const rows = [
+    { id: 'node/1', lat: 27.7, lon: 85.3, name: 'Bir Hospital', kind: 'hospital', emergency: 'yes' },
+    { id: 'node/2', lat: 27.71, lon: 85.31, name: 'Teaching Hospital', kind: 'hospital', emergency: 'no' },
+  ];
+  const engine = createAnalystEngine({
+    getRecords: (key) => (key === 'osm-places' ? rows : []),
+    resolveRegionRing: async () => null,
+    getViewContext: () => ({ lat: 27.7, lon: 85.3, viewRadiusKm: 20 }),
+  });
+  assert.equal(
+    engine.remember('osm-places', rows, {
+      presentation: { scopeLabel: 'inside Kathmandu', coverageScope: 'area:area-1', areaId: 'area-1' },
+    }),
+    true,
+  );
+  const result = await engine.query({
+    layers: ['osm-places'],
+    followUp: true,
+    filters: [{ field: 'emergency', op: 'eq', value: 'yes' }],
+  });
+  assert.equal(result.count, 1);
+  assert.equal(result.scopeLabel, 'inside Kathmandu');
+  assert.equal(result.coverage.scope, 'area:area-1');
+});
+
+test('a follow-up on a capped handed-off set is not complete', async () => {
+  const rows = [
+    { id: 'node/1', lat: 27.7, lon: 85.3, name: 'Bir Hospital', kind: 'hospital', emergency: 'yes' },
+  ];
+  const engine = createAnalystEngine({
+    getRecords: (key) => (key === 'osm-places' ? rows : []),
+    resolveRegionRing: async () => null,
+    getViewContext: () => ({ lat: 27.7, lon: 85.3, viewRadiusKm: 20 }),
+  });
+  engine.remember('osm-places', rows, { truncated: true });
+  const result = await engine.query({ layers: ['osm-places'], followUp: true });
+  assert.equal(result.count, 1);
+  assert.equal(result.complete, false);
+  assert.equal(result.coverage.records.truncated, true);
+  assert.equal(result.coverage.records.total, null, 'the true size is unknown');
+});
+
+test('a slow scan yields on a time budget, not only every 20,000 rows', async () => {
+  // 4,000 rows that each cost ~0.05 ms to read: ~200 ms of work in one slice
+  // under a row-count budget alone.
+  const slow = () => {
+    const until = performance.now() + 0.05;
+    while (performance.now() < until);
+    return 5;
+  };
+  const rows = Array.from({ length: 4_000 }, (_, i) => ({ id: `S${i}`, lat: 0, lon: 0, get frp() { return slow(); } }));
+  const engine = createAnalystEngine({ getRecords: () => rows, getViewContext: () => ({ lat: 0, lon: 0, viewRadiusKm: 25 }) });
+  // Count the scan's yields (other timers run only when it yields), not wall
+  // gaps, so a loaded machine cannot fail it.
+  let ticks = 0;
+  const timer = setInterval(() => ticks++, 0);
+  const result = await engine.query({ layers: ['local-firms'], scope: { kind: 'anywhere' }, filters: [{ field: 'frp', op: 'gt', value: 1 }] });
+  clearInterval(timer);
+  assert.equal(result.count, 4_000);
+  assert.ok(ticks >= 5, `the scan yielded ${ticks} times in ~200 ms of work`);
+});

src/data/areaGeometry.js

@@ -0,0 +1,397 @@
+/**
+ * Area geometry for voice area handles: normalization, containment, size and
+ * display simplification over full MultiPolygons (islands and holes kept).
+ *
+ * Coordinates follow GeoJSON: a MultiPolygon is `Array<Polygon>`, a Polygon is
+ * `Array<Ring>` with the outer ring first and holes after it, a Ring is
+ * `Array<[lon, lat]>`.
+ *
+ * Counting uses the geometry exactly as resolved. Display simplification
+ * (`displayParts`) makes a separate copy for drawing and never feeds back into
+ * containment.
+ *
+ * Antimeridian: a ring whose consecutive longitudes jump by more than 180° is
+ * unwrapped into one continuous span (e.g. 170..190) when the jumps cancel
+ * out. Containment then tests the point at lon, lon + 360 and lon − 360. A ring
+ * that circles a pole (jumps that do not cancel) is used as given.
+ *
+ * Pure: no Cesium, DOM or network.
+ * @module data/areaGeometry
+ */
+
+const EARTH_RADIUS_KM = 6371;
+const toRad = (degrees) => (degrees * Math.PI) / 180;
+
+const validPair = (p) =>
+  Array.isArray(p) &&
+  Number.isFinite(p[0]) &&
+  Number.isFinite(p[1]) &&
+  Math.abs(p[0]) <= 540 &&
+  Math.abs(p[1]) <= 90;
+
+const samePoint = (a, b, eps = 1e-9) =>
+  Math.abs(a[0] - b[0]) <= eps && Math.abs(a[1] - b[1]) <= eps;
+
+/** A ring as closed [lon, lat] pairs, or null with fewer than 3 distinct points. */
+function cleanRing(ring) {
+  if (!Array.isArray(ring)) return null;
+  const out = [];
+  for (const p of ring) {
+    if (!validPair(p)) continue;
+    const pair = [Number(p[0]), Number(p[1])];
+    if (out.length && samePoint(out[out.length - 1], pair)) continue;
+    out.push(pair);
+  }
+  if (out.length && samePoint(out[0], out[out.length - 1])) out.pop();
+  if (out.length < 3) return null;
+  out.push([out[0][0], out[0][1]]);
+  return out;
+}
+
+/**
+ * GeoJSON Polygon/MultiPolygon geometry (or bare coordinates) → MultiPolygon
+ * coordinates with closed rings; null when nothing usable remains. Degenerate
+ * holes are dropped; a polygon whose outer ring is degenerate is dropped whole.
+ * @param {object|Array} geometry
+ * @returns {Array|null}
+ */
+export function normalizeMultiPolygon(geometry) {
+  let polygons;
+  if (Array.isArray(geometry)) {
+    // Bare coordinates: a ring, a polygon or a multipolygon, by nesting depth.
+    const depth = (value) => (Array.isArray(value) ? 1 + depth(value[0]) : 0);
+    const d = depth(geometry);
+    polygons = d === 2 ? [[geometry]] : d === 3 ? [geometry] : geometry;
+  } else if (geometry?.type === 'Polygon') polygons = [geometry.coordinates];
+  else if (geometry?.type === 'MultiPolygon') polygons = geometry.coordinates;
+  else return null;
+  const out = [];
+  for (const polygon of Array.isArray(polygons) ? polygons : []) {
+    if (!Array.isArray(polygon)) continue;
+    const outer = cleanRing(polygon[0]);
+    if (!outer) continue;
+    const holes = polygon.slice(1).map(cleanRing).filter(Boolean);
+    out.push([outer, ...holes]);
+  }
+  return out.length ? out : null;
+}
+
+/**
+ * Longitudes made continuous across the antimeridian. Returns the ring as
+ * given when it has no jump, or when its jumps do not cancel (a ring that
+ * circles a pole).
+ */
+export function unwrapRing(ring) {
+  let shift = 0;
+  let jumped = false;
+  const out = [[ring[0][0], ring[0][1]]];
+  for (let i = 1; i < ring.length; i += 1) {
+    const delta = ring[i][0] - ring[i - 1][0];
+    if (delta > 180) {
+      shift -= 360;
+      jumped = true;
+    } else if (delta < -180) {
+      shift += 360;
+      jumped = true;
+    }
+    out.push([ring[i][0] + shift, ring[i][1]]);
+  }
+  if (!jumped) return ring;
+  return shift === 0 ? out : ring;
+}
+
+function ringBbox(ring) {
+  let w = Infinity;
+  let s = Infinity;
+  let e = -Infinity;
+  let n = -Infinity;
+  for (const [lon, lat] of ring) {
+    if (lon < w) w = lon;
+    if (lon > e) e = lon;
+    if (lat < s) s = lat;
+    if (lat > n) n = lat;
+  }
+  return [w, s, e, n];
+}
+
+/** Even-odd ray cast. */
+function pointInRingXY(ring, lon, lat) {
+  let inside = false;
+  for (let i = 0, j = ring.length - 1; i < ring.length; j = i, i += 1) {
+    const xi = ring[i][0];
+    const yi = ring[i][1];
+    const xj = ring[j][0];
+    const yj = ring[j][1];
+    if (
+      yi > lat !== yj > lat &&
+      lon < ((xj - xi) * (lat - yi)) / (yj - yi) + xi
+    )
+      inside = !inside;
+  }
+  return inside;
+}
+
+const wrap180 = (lon) => ((((lon + 180) % 360) + 360) % 360) - 180;
+const wrap360 = (lon) => {
+  const wrapped = lon % 360;
+  return wrapped < 0 ? wrapped + 360 : wrapped;
+};
+
+/** The shortest circular longitude interval containing every outer-ring vertex. */
+function longitudeEnvelope(parts) {
+  const values = parts
+    .flatMap(({ outer }) => outer.map(([lon]) => wrap360(lon)))
+    .sort((a, b) => a - b);
+  if (values.length === 0) return null;
+  let gapIndex = values.length - 1;
+  let largestGap = values[0] + 360 - values.at(-1);
+  for (let i = 0; i < values.length - 1; i += 1) {
+    const gap = values[i + 1] - values[i];
+    if (gap > largestGap) {
+      largestGap = gap;
+      gapIndex = i;
+    }
+  }
+  const start = values[(gapIndex + 1) % values.length];
+  let end = values[gapIndex];
+  if (end < start) end += 360;
+  const span = end - start;
+  if (span >= 360 - 1e-9) return { west: -180, east: 180, crosses: false };
+  const west = start > 180 ? start - 360 : start;
+  const endOnCircle = end >= 360 ? end - 360 : end;
+  const east = endOnCircle > 180 ? endOnCircle - 360 : endOnCircle;
+  return { west, east, crosses: west > east };
+}
+
+/**
+ * Index a MultiPolygon for repeated containment tests: unwrapped rings with
+ * per-part bounding boxes, plus the overall bbox as [west, south, east, north]
+ * in −180..180 (west > east when it crosses the antimeridian).
+ * @param {Array} coordinates MultiPolygon coordinates.
+ * @returns {{parts: Array, bbox: number[], vertexCount: number, crossesAntimeridian: boolean}|null}
+ */
+export function prepareArea(coordinates) {
+  const multi = normalizeMultiPolygon(coordinates);
+  if (!multi) return null;
+  let vertexCount = 0;
+  let crosses = false;
+  const parts = multi.map((polygon) => {
+    const outer = unwrapRing(polygon[0]);
+    if (outer !== polygon[0]) crosses = true;
+    const holes = polygon.slice(1).map((ring) => {
+      let hole = unwrapRing(ring);
+      // Keep a hole in the same longitude frame as its outer ring.
+      const hb = ringBbox(hole);
+      const ob = ringBbox(outer);
+      const mid = (hb[0] + hb[2]) / 2;
+      if (mid < ob[0]) hole = hole.map(([x, y]) => [x + 360, y]);
+      else if (mid > ob[2]) hole = hole.map(([x, y]) => [x - 360, y]);
+      return hole;
+    });
+    for (const ring of polygon) vertexCount += ring.length;
+    return { outer, holes, bbox: ringBbox(outer) };
+  });
+  let south = Infinity;
+  let north = -Infinity;
+  for (const { bbox } of parts) {
+    south = Math.min(south, bbox[1]);
+    north = Math.max(north, bbox[3]);
+  }
+  const envelope = longitudeEnvelope(parts);
+  const bbox = [envelope.west, south, envelope.east, north];
+  crosses ||= envelope.crosses;
+  return { parts, bbox, vertexCount, crossesAntimeridian: crosses };
+}
+
+function inPart(part, lon, lat) {
+  const [w, s, e, n] = part.bbox;
+  if (lat < s || lat > n || lon < w || lon > e) return false;
+  if (!pointInRingXY(part.outer, lon, lat)) return false;
+  for (const hole of part.holes)
+    if (pointInRingXY(hole, lon, lat)) return false;
+  return true;
+}
+
+/**
+ * Whether a point lies inside the area: inside some part's outer ring and in
+ * none of that part's holes. Points exactly on an edge follow the ray-cast
+ * convention and may land either side.
+ * @param {object} prepared From prepareArea.
+ * @param {number} lat
+ * @param {number} lon
+ * @returns {boolean}
+ */
+export function pointInPreparedArea(prepared, lat, lon) {
+  if (!prepared || !Number.isFinite(lat) || !Number.isFinite(lon)) return false;
+  for (const part of prepared.parts) {
+    if (inPart(part, lon, lat)) return true;
+    if (inPart(part, lon + 360, lat)) return true;
+    if (inPart(part, lon - 360, lat)) return true;
+  }
+  return false;
+}
+
+/** Spherical-excess ring area in km² (unsigned). */
+export function ringAreaKm2(ring) {
+  const n = ring.length;
+  if (n < 3) return 0;
+  let sum = 0;
+  for (let i = 0; i < n - 1; i += 1) {
+    const [lon1, lat1] = ring[i];
+    const [lon2, lat2] = ring[i + 1];
+    sum +=
+      toRad(lon2 - lon1) * (2 + Math.sin(toRad(lat1)) + Math.sin(toRad(lat2)));
+  }
+  return Math.abs((sum * EARTH_RADIUS_KM * EARTH_RADIUS_KM) / 2);
+}
+
+/**
+ * Area of a MultiPolygon in km², holes subtracted.
+ * @param {Array} coordinates
+ * @returns {number}
+ */
+export function multiPolygonAreaKm2(coordinates) {
+  const multi = normalizeMultiPolygon(coordinates);
+  if (!multi) return 0;
+  let total = 0;
+  for (const polygon of multi) {
+    total += ringAreaKm2(unwrapRing(polygon[0]));
+    for (const hole of polygon.slice(1)) total -= ringAreaKm2(unwrapRing(hole));
+  }
+  return Math.max(0, total);
+}
+
+/** Counts of parts and holes. */
+export function multiPolygonCounts(coordinates) {
+  const multi = normalizeMultiPolygon(coordinates) || [];
+  return {
+    parts: multi.length,
+    holes: multi.reduce((sum, polygon) => sum + polygon.length - 1, 0),
+  };
+}
+
+/** Mean of the largest part's outer ring vertices, wrapped to −180..180. */
+export function areaAnchor(coordinates) {
+  const multi = normalizeMultiPolygon(coordinates);
+  if (!multi) return null;
+  let best = null;
+  let bestArea = -1;
+  for (const polygon of multi) {
+    const ring = unwrapRing(polygon[0]);
+    const area = ringAreaKm2(ring);
+    if (area > bestArea) {
+      bestArea = area;
+      best = ring;
+    }
+  }
+  let lon = 0;
+  let lat = 0;
+  const pts = best.slice(0, -1);
+  for (const [x, y] of pts) {
+    lon += x;
+    lat += y;
+  }
+  return { lon: wrap180(lon / pts.length), lat: lat / pts.length };
+}
+
+// ── Display copies ────────────────────────────────────────────
+
+function dpRing(ring, tol) {
+  const n = ring.length;
+  if (n <= 5) return ring;
+  const keep = new Uint8Array(n);
+  keep[0] = 1;
+  keep[n - 1] = 1;
+  const stack = [[0, n - 1]];
+  while (stack.length) {
+    const [a, b] = stack.pop();
+    if (b - a < 2) continue;
+    const [ax, ay] = ring[a];
+    const vx = ring[b][0] - ax;
+    const vy = ring[b][1] - ay;
+    const c2 = vx * vx + vy * vy;
+    let worst = -1;
+    let worstD = tol;
+    for (let i = a + 1; i < b; i += 1) {
+      const wx = ring[i][0] - ax;
+      const wy = ring[i][1] - ay;
+      const t =
+        c2 === 0 ? 0 : Math.max(0, Math.min(1, (vx * wx + vy * wy) / c2));
+      const d = Math.hypot(wx - t * vx, wy - t * vy);
+      if (d > worstD) {
+        worstD = d;
+        worst = i;
+      }
+    }
+    if (worst >= 0) {
+      keep[worst] = 1;
+      stack.push([a, worst], [worst, b]);
+    }
+  }
+  const out = [];
+  for (let i = 0; i < n; i += 1) if (keep[i]) out.push(ring[i]);
+  return out.length >= 4 ? out : ring;
+}
+
+/**
+ * A simplified copy of the area for drawing only: the largest `maxParts`
+ * parts, each ring Douglas-Peucker simplified until the whole copy fits in
+ * `maxVertices`. Rings keep their antimeridian-unwrapped longitudes so a
+ * crossing part draws as one shape.
+ * @param {Array} coordinates MultiPolygon coordinates.
+ * @param {{maxVertices?: number, maxParts?: number}} [options]
+ * @returns {{parts: Array<{outer: Array, holes: Array}>, drawnParts: number, totalParts: number}}
+ */
+export function displayParts(
+  coordinates,
+  { maxVertices = 6000, maxParts = 40 } = {},
+) {
+  const multi = normalizeMultiPolygon(coordinates) || [];
+  const ranked = multi
+    .map((polygon) => ({
+      rings: polygon.map((ring) => unwrapRing(ring)),
+      area: ringAreaKm2(unwrapRing(polygon[0])),
+    }))
+    .sort((a, b) => b.area - a.area)
+    .slice(0, maxParts);
+  const bbox = ranked.length ? ringBbox(ranked[0].rings[0]) : [0, 0, 0, 0];
+  let tol = Math.max(
+    1e-6,
+    Math.max(bbox[2] - bbox[0], bbox[3] - bbox[1]) / 1500,
+  );
+  let parts = [];
+  for (let attempt = 0; attempt < 12; attempt += 1) {
+    parts = ranked.map(({ rings }) => ({
+      outer: dpRing(rings[0], tol),
+      holes: rings.slice(1).map((ring) => dpRing(ring, tol)),
+    }));
+    const total = parts.reduce(
+      (sum, p) =>
+        sum + p.outer.length + p.holes.reduce((h, r) => h + r.length, 0),
+      0,
+    );
+    if (total <= maxVertices) break;
+    tol *= 2;
+  }
+  return { parts, drawnParts: parts.length, totalParts: multi.length };
+}
+
+/**
+ * A circle as a closed ring (planar metres around the centre — accurate for
+ * the few-kilometre buffers it is used for).
+ * @returns {Array<[number, number]>}
+ */
+export function circleRing(lat, lon, radiusM, segments = 48) {
+  const mPerDegLat = 111_320;
+  const mPerDegLon = mPerDegLat * Math.max(0.01, Math.cos(toRad(lat)));
+  const ring = [];
+  for (let i = 0; i < segments; i += 1) {
+    const a = (i / segments) * Math.PI * 2;
+    ring.push([
+      lon + (Math.cos(a) * radiusM) / mPerDegLon,
+      lat + (Math.sin(a) * radiusM) / mPerDegLat,
+    ]);
+  }
+  ring.push([ring[0][0], ring[0][1]]);
+  return ring;
+}

src/data/areaGeometry.test.mjs

@@ -0,0 +1,178 @@
+// Area geometry: containment over full MultiPolygons (islands, holes, the
+// antimeridian), OSM relation assembly and display copies that never touch the
+// counting geometry.
+//
+// Run with: npm test
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  circleRing,
+  displayParts,
+  multiPolygonAreaKm2,
+  multiPolygonCounts,
+  normalizeMultiPolygon,
+  pointInPreparedArea,
+  prepareArea,
+} from './areaGeometry.js';
+
+const square = (w, s, e, n) => [
+  [w, s],
+  [e, s],
+  [e, n],
+  [w, n],
+  [w, s],
+];
+
+test('a point on an island counts, not only on the largest part', () => {
+  // Mainland 0..10, island 20..22: the old largest-ring shortcut dropped the island.
+  const area = prepareArea([[square(0, 0, 10, 10)], [square(20, 0, 22, 2)]]);
+  assert.equal(pointInPreparedArea(area, 5, 5), true);
+  assert.equal(pointInPreparedArea(area, 1, 21), true);
+  assert.equal(pointInPreparedArea(area, 1, 15), false);
+});
+
+test('a point inside a hole is outside the area', () => {
+  const area = prepareArea([[square(0, 0, 10, 10), square(4, 4, 6, 6)]]);
+  assert.equal(pointInPreparedArea(area, 5, 5), false);
+  assert.equal(pointInPreparedArea(area, 2, 2), true);
+  // An island inside the hole (an enclave within an enclave) counts again.
+  const nested = prepareArea([
+    [square(0, 0, 10, 10), square(3, 3, 7, 7)],
+    [square(4, 4, 6, 6)],
+  ]);
+  assert.equal(pointInPreparedArea(nested, 5, 5), true);
+  assert.equal(pointInPreparedArea(nested, 3.5, 3.5), false);
+});
+
+test('a ring crossing the antimeridian contains points on both sides', () => {
+  // 175E → 175W as one continuous ring (a drawn box over Fiji).
+  const ring = [
+    [175, -20],
+    [-175, -20],
+    [-175, -15],
+    [175, -15],
+    [175, -20],
+  ];
+  const area = prepareArea([[ring]]);
+  assert.equal(area.crossesAntimeridian, true);
+  assert.equal(pointInPreparedArea(area, -17, 178), true);
+  assert.equal(pointInPreparedArea(area, -17, -178), true);
+  assert.equal(pointInPreparedArea(area, -17, 0), false);
+  assert.equal(pointInPreparedArea(area, -17, 170), false);
+  // bbox is west > east across the line.
+  assert.deepEqual(area.bbox, [175, -20, -175, -15]);
+  // Area of a 10°×5° box near 17°S, not the 350° long way round.
+  const km2 = multiPolygonAreaKm2([[ring]]);
+  assert.ok(km2 > 500_000 && km2 < 620_000, `area ${km2}`);
+});
+
+test('a multipolygon split at ±180 keeps a tight bbox', () => {
+  const area = prepareArea([
+    [square(177, -19, 180, -16)],
+    [square(-180, -19, -178, -16)],
+  ]);
+  assert.equal(area.crossesAntimeridian, true);
+  assert.deepEqual(area.bbox, [177, -19, -178, -16]);
+  assert.equal(pointInPreparedArea(area, -17, -179), true);
+  assert.equal(pointInPreparedArea(area, -17, 179), true);
+});
+
+test('a crossing part and a separate island share one tight longitude frame', () => {
+  const crossing = [
+    [175, -20],
+    [-175, -20],
+    [-175, -15],
+    [175, -15],
+    [175, -20],
+  ];
+  const area = prepareArea([[crossing], [square(-170, -19, -160, -16)]]);
+  assert.equal(area.crossesAntimeridian, true);
+  assert.deepEqual(area.bbox, [175, -20, -160, -15]);
+  assert.equal(pointInPreparedArea(area, -17, 178), true);
+  assert.equal(pointInPreparedArea(area, -17, -165), true);
+  assert.equal(pointInPreparedArea(area, -17, 0), false);
+});
+
+test('normalization closes rings and drops degenerate parts', () => {
+  const multi = normalizeMultiPolygon({
+    type: 'Polygon',
+    coordinates: [
+      [
+        [0, 0],
+        [1, 0],
+        [1, 1],
+      ],
+      [
+        [0.2, 0.2],
+        [0.2, 0.2],
+      ],
+    ],
+  });
+  assert.equal(multi.length, 1);
+  assert.equal(multi[0].length, 1, 'degenerate hole dropped');
+  assert.deepEqual(multi[0][0][0], multi[0][0][3]);
+  assert.equal(
+    normalizeMultiPolygon({ type: 'LineString', coordinates: [] }),
+    null,
+  );
+  assert.equal(
+    normalizeMultiPolygon([
+      [
+        [0, 0],
+        [1, 1],
+      ],
+    ]),
+    null,
+  );
+});
+
+test('area subtracts holes and counts parts', () => {
+  const coords = [
+    [square(0, 0, 1, 1), square(0.25, 0.25, 0.75, 0.75)],
+    [square(5, 5, 6, 6)],
+  ];
+  const whole = multiPolygonAreaKm2([[square(0, 0, 1, 1)]]);
+  const km2 = multiPolygonAreaKm2(coords);
+  assert.ok(km2 < whole * 2 && km2 > whole * 1.7, `${km2} vs ${whole}`);
+  assert.deepEqual(multiPolygonCounts(coords), { parts: 2, holes: 1 });
+});
+
+test('display copies are bounded and leave the counting geometry intact', () => {
+  const dense = [];
+  for (let i = 0; i < 20_000; i += 1) {
+    const a = (i / 20_000) * Math.PI * 2;
+    dense.push([
+      Math.cos(a) * (1 + 0.01 * Math.sin(a * 200)),
+      Math.sin(a) * (1 + 0.01 * Math.sin(a * 200)),
+    ]);
+  }
+  dense.push(dense[0].slice());
+  const coords = [[dense]];
+  const snapshot = JSON.stringify(coords);
+  const shown = displayParts(coords, { maxVertices: 2000 });
+  const total = shown.parts.reduce((sum, p) => sum + p.outer.length, 0);
+  assert.ok(total <= 2000, `${total} vertices`);
+  assert.equal(JSON.stringify(coords), snapshot, 'input untouched');
+  // A point the simplified copy might shave off still counts on the original.
+  const area = prepareArea(coords);
+  assert.equal(pointInPreparedArea(area, 0, 0), true);
+});
+
+test('display copies keep the largest parts first', () => {
+  const coords = [
+    [square(0, 0, 1, 1)],
+    [square(10, 10, 15, 15)],
+    [square(20, 20, 20.1, 20.1)],
+  ];
+  const shown = displayParts(coords, { maxParts: 2 });
+  assert.equal(shown.totalParts, 3);
+  assert.equal(shown.drawnParts, 2);
+  assert.equal(shown.parts[0].outer[0][0], 10);
+});
+
+test('a circle ring is closed and about the requested radius', () => {
+  const ring = circleRing(37.8, -122.39, 500);
+  assert.deepEqual(ring[0], ring[ring.length - 1]);
+  const km2 = multiPolygonAreaKm2([[ring]]);
+  assert.ok(Math.abs(km2 - Math.PI * 0.25) < 0.02, `${km2}`);
+});

src/data/areaResolver.js

@@ -0,0 +1,668 @@
+/**
+ * Named place → area handle, through the outline ladder that needs no public
+ * Overpass:
+ *
+ *   1. the area store (a query already resolved this session);
+ *   2. bundled Natural Earth physical/marine regions;
+ *   3. bundled countries and states/provinces by name — a name several
+ *      prominent units share ("Georgia", "Punjab") asks which one, unless
+ *      the view is inside exactly one of them;
+ *   4. the annotation outline ladder (`resolveNamedOutline`): bundled
+ *      counties, US Census places and neighbourhood packs, then the guarded
+ *      Nominatim outline route, then Overpass only when an operator
+ *      configured it.
+ *
+ * Providers are injected, so the ladder runs under node:test:
+ *   findNaturalRegion(query) → {name, polygons, kind}|null
+ *   findAdminCandidates(query) → Array<AdminArea> (see data/adminBoundaries.js)
+ *   resolveNamedOutline(query, {level, levelHint, signal}) →
+ *     {ok:true, name, polygons, source, rung, approximate?, country?}
+ *     |{ok:false, code, error}
+ *   viewCenter() → {lat, lon}|null
+ *
+ * @module data/areaResolver
+ */
+
+import { AREA_LEVELS } from './areaStore.js';
+import { pointInPreparedArea, prepareArea } from './areaGeometry.js';
+import { adminQueryIdentity, normalizeAdminName } from './adminBoundaries.js';
+import {
+  isAreaCandidateId,
+  MAX_AREA_CANDIDATE_ID_LENGTH,
+} from '../voice/areaCandidateContract.js';
+export {
+  AREA_CANDIDATE_ID_PATTERN,
+  isAreaCandidateId,
+  MAX_AREA_CANDIDATE_ID_LENGTH,
+} from '../voice/areaCandidateContract.js';
+
+/** Most candidates a clarification offers. */
+export const MAX_AREA_CANDIDATES = 4;
+/** Candidates remembered for a follow-up `candidateId`. */
+const CANDIDATE_MEMORY = 24;
+
+/**
+ * A place name as a cache and matching key: case-folded and NFKC-normalized,
+ * punctuation dropped, letters, marks and digits in every script kept (東京
+ * and 大阪 are different keys). Empty when the text names nothing.
+ */
+export function normalizeAreaQuery(text) {
+  return String(text || '')
+    .normalize('NFKC')
+    .toLowerCase()
+    .replace(/[^\p{L}\p{M}\p{N} ]+/gu, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/^the /, '');
+}
+
+/** Words that name the kind of area rather than the area. */
+const LEVEL_WORDS = [
+  [/\b(province|state|region|oblast|prefecture|canton|governorate)$/, 'admin1'],
+  [/\b(county|district|department)$/, 'admin2'],
+  [/\b(city|town|municipality|metropolitan city)$/, 'city'],
+  [/\b(neighbou?rhood|borough|suburb|quarter)$/, 'district'],
+  [/\b(country|nation)$/, 'country'],
+];
+
+/**
+ * Strip a trailing level word ("Bagmati province" → "bagmati", admin1). The
+ * word is kept as a hint, not a filter, since names often contain it.
+ */
+export function splitLevelWord(query) {
+  const norm = normalizeAreaQuery(query);
+  for (const [re, level] of LEVEL_WORDS) {
+    if (re.test(norm)) {
+      const bare = norm.replace(re, '').trim();
+      if (bare) return { bare, level };
+    }
+  }
+  return { bare: norm, level: null };
+}
+
+/** Area level of a bundled admin unit. */
+const ADMIN_LEVEL = Object.freeze({
+  country: 'country',
+  state: 'admin1',
+  county: 'admin2',
+  natural: 'natural',
+});
+
+/**
+ * One of several same-name natural places as a clarification choice, located
+ * by its rough centre ("39 N 31 W") since it has no country.
+ */
+function naturalCandidate(place, kind) {
+  const { lat, lon } = place.center || {};
+  const locator = Number.isFinite(lat)
+    ? `${Math.abs(Math.round(lat))} ${lat >= 0 ? 'N' : 'S'} ${Math.abs(Math.round(lon))} ${lon >= 0 ? 'E' : 'W'}`
+    : '';
+  return {
+    kind: 'natural',
+    name: place.name,
+    country: '',
+    regionCode: locator,
+    polygons: place.polygons.map((ring) => [ring]),
+    source: 'natural-earth',
+    meta: { kind },
+  };
+}
+
+const ADMIN_NAME_LEVEL = Object.freeze({
+  country: 'country',
+  nation: 'country',
+  province: 'admin1',
+  state: 'admin1',
+  region: 'admin1',
+  oblast: 'admin1',
+  prefecture: 'admin1',
+  canton: 'admin1',
+  governorate: 'admin1',
+  county: 'admin2',
+  district: 'admin2',
+  department: 'admin2',
+});
+
+/**
+ * Drop accents from Latin letters only, for comparing names: speech often
+ * loses them ("Quebec" for "Québec"), while a Thai or Devanagari mark changes
+ * the name and is kept.
+ */
+export function foldLatinMarks(text) {
+  return String(text || '')
+    .normalize('NFD')
+    .replace(/(\p{Script=Latin})\p{M}+/gu, '$1')
+    .normalize('NFC');
+}
+
+function explicitAdminName(text) {
+  const normalized = normalizeAreaQuery(String(text).split(',')[0]);
+  const match = normalized.match(
+    /\b(country|nation|province|state|region|zone|oblast|prefecture|canton|governorate|county|district|department)$/,
+  );
+  return {
+    normalized,
+    bare: foldLatinMarks(
+      match ? normalized.slice(0, -match[0].length).trim() : normalized,
+    ),
+    word: match?.[1] || null,
+    level: match ? ADMIN_NAME_LEVEL[match[1]] || null : null,
+  };
+}
+
+/**
+ * Fail closed when a bundled unit's own name contradicts the requested unit.
+ * With `aliases`, an ask the administrative matcher reads as naming this very
+ * unit at its level ("State of Texas", "USA") also matches; the natural-region
+ * check leaves it off, since "Great Britain" is not the United Kingdom.
+ */
+function bundledAdminIdentityRefusal(
+  admin,
+  query,
+  wantedLevel,
+  { aliases = true } = {},
+) {
+  const source = explicitAdminName(admin?.name || '');
+  const requested = explicitAdminName(query);
+  const expectedLevel = wantedLevel || requested.level;
+  const emittedLevel = ADMIN_LEVEL[admin?.kind] || null;
+  if (!source.normalized || source.word === 'zone')
+    return {
+      ok: false,
+      code: 'AREA_IDENTITY_UNVERIFIED',
+      error: `The bundled boundary is ${admin?.name || 'an unverified administrative unit'}, not a verified current match for "${query}".`,
+    };
+  const alias = aliases ? adminQueryIdentity(query) : null;
+  const named =
+    source.bare === requested.bare ||
+    Boolean(
+      alias &&
+      alias.level === emittedLevel &&
+      alias.name === normalizeAdminName(admin.name),
+    );
+  if (
+    !named ||
+    (source.level && expectedLevel && source.level !== expectedLevel) ||
+    (expectedLevel && emittedLevel !== expectedLevel)
+  )
+    return {
+      ok: false,
+      code: 'AREA_IDENTITY_MISMATCH',
+      error: `The bundled boundary is ${admin.name}, not the requested administrative area "${query}".`,
+    };
+  return null;
+}
+
+function stableCandidateHash(value) {
+  let hash = 0x811c9dc5;
+  for (const char of String(value)) {
+    hash ^= char.codePointAt(0);
+    hash = Math.imul(hash, 0x01000193);
+  }
+  return (hash >>> 0).toString(16).padStart(8, '0');
+}
+
+function candidateIdOf(admin) {
+  const prefix = `ne:${admin.kind}:`;
+  // The region code keeps same-named units apart: "Washington" is both WA
+  // and DC, which would otherwise share one candidate and one stored area.
+  const slug = normalizeAreaQuery(
+    `${admin.country} ${admin.name} ${admin.regionCode || ''}`,
+  ).replace(/ /g, '-');
+  const full = `${prefix}${slug}`;
+  if (full.length <= MAX_AREA_CANDIDATE_ID_LENGTH) return full;
+  const suffix = `-${stableCandidateHash(slug)}`;
+  let shortened = '';
+  for (const char of slug) {
+    if (
+      `${prefix}${shortened}${char}${suffix}`.length >
+      MAX_AREA_CANDIDATE_ID_LENGTH
+    )
+      break;
+    shortened += char;
+  }
+  return `${prefix}${shortened.replace(/-+$/u, '')}${suffix}`;
+}
+
+/** Short, speakable identity for a clarification choice. */
+function describeCandidate(admin) {
+  return {
+    candidateId: candidateIdOf(admin),
+    name: admin.name,
+    level: ADMIN_LEVEL[admin.kind] || null,
+    // Tells same-named units apart when spoken: Washington WA vs DC.
+    ...(admin.regionCode && admin.kind !== 'country'
+      ? { region: String(admin.regionCode) }
+      : {}),
+    ...(admin.country && admin.kind !== 'country'
+      ? { country: admin.country }
+      : {}),
+  };
+}
+
+/**
+ * Distinct places among bundled candidates. Within one country, the country
+ * itself stands for its same-named state ("Mexico" is the country, not the
+ * State of Mexico); across countries each name is its own place.
+ */
+/** A coarse ~2° cell of the view, or "none", for keying view-picked answers. */
+function viewCell(center) {
+  if (!Number.isFinite(center?.lat) || !Number.isFinite(center?.lon))
+    return 'none';
+  return `${Math.floor(center.lat / 2)},${Math.floor(center.lon / 2)}`;
+}
+
+export function distinctAdminPlaces(candidates) {
+  const byCountry = new Map();
+  for (const admin of candidates) {
+    const list = byCountry.get(admin.country) || [];
+    list.push(admin);
+    byCountry.set(admin.country, list);
+  }
+  const out = [];
+  for (const list of byCountry.values()) {
+    const country = list.find((admin) => admin.kind === 'country');
+    out.push(...(country ? [country] : list));
+  }
+  return out;
+}
+
+/**
+ * Create a resolver bound to an area store and providers.
+ * @param {object} options
+ */
+export function createAreaResolver({
+  store,
+  findNaturalRegion = async () => null,
+  findAdminCandidates = async () => [],
+  resolveNamedOutline = async () => ({
+    ok: false,
+    code: 'AREA_UNAVAILABLE',
+    error: 'Boundary lookup is unavailable here.',
+  }),
+  viewCenter = () => null,
+  onCredit = () => {},
+  now = () => Date.now(),
+  maxInFlight = 8,
+} = {}) {
+  if (!store) throw new TypeError('An area store is required');
+  /** candidateId → bundled unit and original ask, for a clarification answered later. */
+  const candidateMemory = new Map();
+  /** query key → in-flight lookup, so a repeat joins the first. */
+  const inFlight = new Map();
+  const lifetime = new AbortController();
+  const inFlightLimit = Number.isFinite(maxInFlight)
+    ? Math.max(1, Math.floor(maxInFlight))
+    : 8;
+  let activeLookups = 0;
+  let disposed = false;
+
+  const assertActive = () => lifetime.signal.throwIfAborted();
+
+  const remember = (admin, identity) => {
+    const id = candidateIdOf(admin);
+    candidateMemory.delete(id);
+    candidateMemory.set(id, { admin, identity });
+    while (candidateMemory.size > CANDIDATE_MEMORY)
+      candidateMemory.delete(candidateMemory.keys().next().value);
+  };
+
+  function storeAdmin(admin, confidence, identity) {
+    assertActive();
+    const refused = bundledAdminIdentityRefusal(
+      admin,
+      identity?.query,
+      identity?.wantedLevel,
+    );
+    if (refused) return refused;
+    const record = store.put({
+      geometry: admin.polygons,
+      name: admin.name,
+      level: ADMIN_LEVEL[admin.kind] || null,
+      source: admin.source,
+      sourceId: candidateIdOf(admin),
+      meta: {
+        ...(admin.kind !== 'country' && admin.country
+          ? { country: admin.country }
+          : {}),
+        rung: 'bundled',
+      },
+    });
+    if (!record)
+      return {
+        ok: false,
+        code: 'AREA_NOT_FOUND',
+        error: `The boundary for ${admin.name} is not a usable polygon.`,
+      };
+    onCredit(admin.source);
+    return { ok: true, record, confidence, rung: 'bundled' };
+  }
+
+  async function lookup({ query, level, within }, { signal }) {
+    const { level: levelHint } = splitLevelWord(query);
+    const searchText = within ? `${query}, ${within}` : query;
+    let bundledRefusal = null;
+    // Offline first: a named natural region, unless an admin level or a
+    // country/state qualifier was given (the pack cannot check `within`).
+    if ((!level || level === 'natural') && !within) {
+      const ne = await findNaturalRegion(query, { signal }).catch(() => null);
+      signal?.throwIfAborted?.();
+      // A region named like a country or state ("India" the peninsula,
+      // "Punjab" the desert) never hides it; asked for by level, it answers.
+      // Only a unit that really has this name counts: "Great Britain" finds
+      // the United Kingdom by alias, which is not a Great Britain.
+      // A feature split into parts is one place with every part; distant
+      // namesakes (Flores in the Azores and Indonesia) are asked about.
+      const places = ne?.places?.length
+        ? ne.places
+        : ne?.polygons?.length
+          ? [{ name: ne.name, polygons: ne.polygons }]
+          : [];
+      const shadowsAdmin =
+        places.length > 0 &&
+        level !== 'natural' &&
+        (await findAdminCandidates(query, { signal }).catch(() => [])).some(
+          (admin) =>
+            !bundledAdminIdentityRefusal(admin, query, null, {
+              aliases: false,
+            }),
+        );
+      signal?.throwIfAborted?.();
+      if (places.length > 1 && !shadowsAdmin) {
+        const offered = places
+          .slice(0, MAX_AREA_CANDIDATES)
+          .map((place) => naturalCandidate(place, ne.kind));
+        const identity = { query, wantedLevel: 'natural' };
+        offered.forEach((admin) => remember(admin, identity));
+        return {
+          ok: false,
+          needsClarification: true,
+          code: 'AMBIGUOUS_AREA',
+          candidates: offered.map(describeCandidate),
+          error: `"${query}" names ${offered.length} places — ask which one.`,
+        };
+      }
+      if (places.length === 1 && !shadowsAdmin) {
+        const record = store.put({
+          geometry: places[0].polygons.map((ring) => [ring]),
+          name: ne.name,
+          level: 'natural',
+          source: 'natural-earth',
+          sourceId: `ne:${normalizeAreaQuery(ne.name).replace(/ /g, '-')}`,
+          meta: { kind: ne.kind, rung: 'bundled' },
+        });
+        if (record) {
+          onCredit('natural-earth');
+          return { ok: true, record, confidence: 0.95, rung: 'bundled' };
+        }
+      }
+    }
+    signal?.throwIfAborted?.();
+    // Bundled countries and states by name. A name prominent units share is
+    // asked about, never guessed — except when the view is inside one.
+    const wanted = level || levelHint;
+    if (!wanted || wanted === 'country' || wanted === 'admin1') {
+      let admins = await findAdminCandidates(searchText, { signal }).catch(
+        () => [],
+      );
+      signal?.throwIfAborted?.();
+      if (wanted) admins = admins.filter((a) => ADMIN_LEVEL[a.kind] === wanted);
+      let places = distinctAdminPlaces(admins);
+      const identity = { query, wantedLevel: wanted };
+      const checked = places.map((admin) => ({
+        admin,
+        refused: bundledAdminIdentityRefusal(admin, query, wanted),
+      }));
+      places = checked
+        .filter(({ refused }) => !refused)
+        .map(({ admin }) => admin);
+      if (!places.length && checked.length) {
+        const refused = checked.find((entry) => entry.refused)?.refused;
+        // A retired or unverifiable unit is final. A different unit that
+        // merely shares the name ("Azad Kashmir" for "Kashmir") is not an
+        // answer, so the outline ladder still gets to look.
+        if (refused?.code !== 'AREA_IDENTITY_MISMATCH') return refused;
+        bundledRefusal = refused;
+      }
+      if (places.length === 1) {
+        return storeAdmin(places[0], 0.95, identity);
+      }
+      if (places.length > 1) {
+        const center = viewCenter();
+        const holding = center
+          ? places.filter((admin) => {
+              const prepared = prepareArea(admin.polygons);
+              return (
+                prepared &&
+                pointInPreparedArea(prepared, center.lat, center.lon)
+              );
+            })
+          : [];
+        // Chosen by the view, so never remembered for the name: asked again
+        // over the other one, it answers the other one.
+        if (holding.length === 1)
+          return { ...storeAdmin(holding[0], 0.85, identity), byView: true };
+        const offered = places.slice(0, MAX_AREA_CANDIDATES);
+        offered.forEach((admin) => remember(admin, identity));
+        return {
+          ok: false,
+          needsClarification: true,
+          code: 'AMBIGUOUS_AREA',
+          candidates: offered.map(describeCandidate),
+          error: `"${query}" names ${offered.length} places — ask which one.`,
+        };
+      }
+    }
+    signal?.throwIfAborted?.();
+    // Everything else: the annotation outline ladder.
+    const outline = await resolveNamedOutline(searchText, {
+      level,
+      levelHint,
+      signal,
+    });
+    signal?.throwIfAborted?.();
+    if (!outline?.ok)
+      return (
+        bundledRefusal || {
+          ok: false,
+          code: outline?.code || 'AREA_NOT_FOUND',
+          error: outline?.error || `No boundary found for "${query}".`,
+        }
+      );
+    const record = store.put({
+      geometry: outline.polygons,
+      name: outline.name || query,
+      level: level || levelHint || outline.adminLevel || null,
+      source: outline.approximate ? 'approximate' : outline.source,
+      approximate: Boolean(outline.approximate),
+      meta: {
+        ...(outline.country ? { country: outline.country } : {}),
+        ...(outline.adminName ? { adminName: outline.adminName } : {}),
+        ...(outline.adminLevel ? { adminLevel: outline.adminLevel } : {}),
+        rung: outline.rung || null,
+        ...(outline.basis ? { basis: outline.basis } : {}),
+      },
+    });
+    if (!record)
+      return {
+        ok: false,
+        code: 'AREA_NOT_FOUND',
+        error: `The boundary for ${query} is not a usable polygon.`,
+      };
+    return {
+      ok: true,
+      record,
+      confidence: outline.approximate ? 0.5 : 0.8,
+      rung: outline.rung || null,
+    };
+  }
+
+  /**
+   * Resolve a place to an area handle.
+   * @param {{query?: string, level?: string, within?: string, candidateId?: string}} args
+   * @param {{signal?: AbortSignal, budgetMs?: number}} [options] Past the
+   *   budget the call answers AREA_TIMEOUT while the lookup continues and
+   *   fills the caches, so asking again shortly is fast.
+   * @returns {Promise<object>}
+   */
+  async function resolve(args = {}, { signal, budgetMs = 8000 } = {}) {
+    const started = now();
+    const level = AREA_LEVELS.includes(args.level) ? args.level : null;
+    const within = String(args.within || '').trim();
+    const candidateId = String(args.candidateId || '').trim();
+    const finish = (result, cached = false) => ({
+      ...result,
+      cached,
+      ms: now() - started,
+    });
+
+    if (disposed)
+      return finish({
+        ok: false,
+        code: 'CANCELLED',
+        cancelled: true,
+        error: 'Area resolver has been disposed.',
+      });
+
+    if (candidateId) {
+      if (!isAreaCandidateId(candidateId))
+        return finish({
+          ok: false,
+          code: 'BAD_CANDIDATE',
+          error:
+            'candidateId is malformed or too long. Resolve the name again.',
+        });
+      const remembered = candidateMemory.get(candidateId);
+      if (!remembered)
+        return finish({
+          ok: false,
+          code: 'UNKNOWN_CANDIDATE',
+          error: `Unknown candidateId "${candidateId}". Resolve the name again.`,
+        });
+      if (signal?.aborted)
+        return finish({
+          ok: false,
+          code: 'CANCELLED',
+          cancelled: true,
+          error: 'This request was superseded.',
+        });
+      return finish(storeAdmin(remembered.admin, 0.9, remembered.identity));
+    }
+
+    const query = String(args.query || '').trim();
+    if (!query)
+      return finish({
+        ok: false,
+        code: 'BAD_AREA',
+        error: 'Name a place to resolve.',
+      });
+    const nameKey = normalizeAreaQuery(query);
+    // The outline ladder and geocoder pick by the view ("Springfield" over
+    // Illinois), so an answer is reused or shared only within the same
+    // ~2° view cell. A name that normalizes to nothing is never cached.
+    const key = nameKey
+      ? `${nameKey}|${level || ''}|${normalizeAreaQuery(within)}|${viewCell(viewCenter())}`
+      : null;
+    const recalled = key ? store.recallQuery(key) : null;
+    if (recalled)
+      return finish(
+        { ok: true, record: recalled, confidence: 0.95, rung: 'store' },
+        true,
+      );
+
+    let pending = key ? inFlight.get(key) : null;
+    if (!pending) {
+      if (activeLookups >= inFlightLimit)
+        return finish({
+          ok: false,
+          code: 'AREA_BUSY',
+          error:
+            'Too many area lookups are already running — try again shortly.',
+        });
+      // The shared lookup outlives any one caller's signal: a superseded turn
+      // must not cancel the answer a repeat is waiting on. The resolver's own
+      // lifetime still owns the provider work, so final teardown stops it.
+      activeLookups += 1;
+      pending = lookup({ query, level, within }, { signal: lifetime.signal })
+        .then((result) => {
+          assertActive();
+          if (result.ok && key && !result.byView)
+            store.rememberQuery(key, result.record.areaId);
+          return result;
+        })
+        .catch((error) =>
+          lifetime.signal.aborted
+            ? {
+                ok: false,
+                code: 'CANCELLED',
+                cancelled: true,
+                error: 'Area resolver has been disposed.',
+              }
+            : {
+                ok: false,
+                code: 'AREA_UNAVAILABLE',
+                error: error?.message || 'Boundary lookup failed.',
+              },
+        )
+        .finally(() => {
+          activeLookups -= 1;
+          if (key) inFlight.delete(key);
+        });
+      if (key) inFlight.set(key, pending);
+    }
+    let timer;
+    const racers = [pending];
+    if (Number.isFinite(budgetMs))
+      racers.push(
+        new Promise((resolveTimeout) => {
+          timer = setTimeout(
+            () =>
+              resolveTimeout({
+                ok: false,
+                code: 'AREA_TIMEOUT',
+                error: `Looking up "${query}" is taking a while — ask again in a moment.`,
+              }),
+            budgetMs,
+          );
+        }),
+      );
+    // Detached once this call settles: a caller's long-lived signal must not
+    // collect one listener per completed lookup.
+    let cancelled = null;
+    if (signal)
+      racers.push(
+        new Promise((resolveAbort) => {
+          const superseded = {
+            ok: false,
+            code: 'CANCELLED',
+            cancelled: true,
+            error: 'Superseded.',
+          };
+          if (signal.aborted) return resolveAbort(superseded);
+          cancelled = () => resolveAbort(superseded);
+          signal.addEventListener?.('abort', cancelled, { once: true });
+          return undefined;
+        }),
+      );
+    try {
+      return finish(await Promise.race(racers));
+    } finally {
+      clearTimeout(timer);
+      if (cancelled) signal.removeEventListener?.('abort', cancelled);
+    }
+  }
+
+  function dispose() {
+    if (disposed) return;
+    disposed = true;
+    lifetime.abort();
+    inFlight.clear();
+    candidateMemory.clear();
+  }
+
+  return {
+    resolve,
+    dispose,
+    candidate: (id) => candidateMemory.get(id) || null,
+  };
+}

src/data/areaResolver.test.mjs

@@ -0,0 +1,896 @@
+// Area handles: the session store and the resolution ladder (bundled Natural
+// Earth regions → bundled countries and states → the annotation outline
+// ladder), with every rung mocked. Pins the clarification contract for
+// ambiguous names and the fast cached path.
+//
+// Run with: npm test
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createAreaStore, summarizeArea } from './areaStore.js';
+import {
+  AREA_CANDIDATE_ID_PATTERN,
+  createAreaResolver,
+  distinctAdminPlaces,
+  isAreaCandidateId,
+  MAX_AREA_CANDIDATE_ID_LENGTH,
+  splitLevelWord,
+} from './areaResolver.js';
+import { pointInPreparedArea } from './areaGeometry.js';
+import { findAdminCandidates } from './adminBoundaries.js';
+
+const square = (w, s, e, n) => [
+  [w, s],
+  [e, s],
+  [e, n],
+  [w, n],
+  [w, s],
+];
+
+const admin = (kind, name, country, box, extra = {}) => ({
+  kind,
+  name,
+  country,
+  source: 'natural-earth',
+  polygons: [[square(...box)]],
+  ...extra,
+});
+const GEORGIA_COUNTRY = admin(
+  'country',
+  'Georgia',
+  'Georgia',
+  [40, 41, 46.7, 43.6],
+);
+const GEORGIA_STATE = admin(
+  'state',
+  'Georgia',
+  'United States of America',
+  [-85.6, 30.4, -80.8, 35],
+);
+const PUNJAB_IN = admin('state', 'Punjab', 'India', [73.8, 29.5, 77, 32.5]);
+const PUNJAB_PK = admin('state', 'Punjab', 'Pakistan', [69.3, 27.7, 73.7, 34]);
+const TEXAS = admin(
+  'state',
+  'Texas',
+  'United States of America',
+  [-106, 26, -94, 36],
+);
+
+const BAGMATI = {
+  ok: true,
+  name: 'Bagmati Province',
+  polygons: [[square(84.4, 26.9, 86.6, 28.4), square(85.3, 27.6, 85.4, 27.7)]],
+  source: 'osm',
+  rung: 'nominatim',
+  adminName: 'Bagmati Province',
+};
+
+function makeResolver(overrides = {}) {
+  const store = createAreaStore();
+  const calls = { outline: [], natural: 0, admin: 0 };
+  const resolver = createAreaResolver({
+    store,
+    findNaturalRegion: async (q) => {
+      calls.natural += 1;
+      return /alps/i.test(q)
+        ? {
+            name: 'Alps',
+            kind: 'natural',
+            polygons: [square(5, 44, 16, 48), square(17, 44, 18, 45)],
+          }
+        : null;
+    },
+    findAdminCandidates: async (q) => {
+      calls.admin += 1;
+      if (/^georgia$/i.test(q)) return [GEORGIA_STATE, GEORGIA_COUNTRY];
+      if (/^georgia, united states/i.test(q)) return [GEORGIA_STATE];
+      if (/^punjab$/i.test(q)) return [PUNJAB_PK, PUNJAB_IN];
+      if (/^punjab, pakistan/i.test(q)) return [PUNJAB_PK];
+      if (/^texas$/i.test(q)) return [TEXAS];
+      return [];
+    },
+    resolveNamedOutline: async (q, options) => {
+      calls.outline.push({ q, ...options, signal: undefined });
+      if (/bagmati/i.test(q)) return BAGMATI;
+      return {
+        ok: false,
+        code: 'AREA_NOT_FOUND',
+        error: `No boundary found for "${q}".`,
+      };
+    },
+    ...overrides,
+  });
+  return { store, resolver, calls };
+}
+
+test('the store keeps geometry local and summarizes without coordinates', () => {
+  const store = createAreaStore({ maxEntries: 2 });
+  const a = store.put({
+    geometry: [[square(0, 0, 1, 1)]],
+    name: 'A',
+    source: 'drawn',
+    level: 'drawn',
+  });
+  const b = store.put({
+    geometry: [[square(2, 2, 3, 3)]],
+    name: 'B',
+    source: 'us-census',
+    sourceId: 'place:1',
+  });
+  assert.equal(b.areaId, 'place:1');
+  assert.equal(b.source, 'us-census');
+  store.get(a.areaId); // A is now the most recently used
+  store.put({ geometry: [[square(4, 4, 5, 5)]], name: 'C', source: 'osm' });
+  assert.equal(store.has('place:1'), false, 'least recently used evicted');
+  assert.ok(store.get(a.areaId));
+  const summary = summarizeArea(a);
+  assert.deepEqual(
+    Object.keys(summary).sort(),
+    [
+      'areaId',
+      'areaKm2',
+      'bbox',
+      'holes',
+      'level',
+      'name',
+      'parts',
+      'source',
+    ].sort(),
+  );
+  assert.equal(JSON.stringify(summary).includes('geometry'), false);
+  assert.equal(
+    store.put({
+      geometry: [
+        [
+          [0, 0],
+          [1, 1],
+        ],
+      ],
+      name: 'bad',
+    }),
+    null,
+  );
+});
+
+test('query aliases have their own LRU bound even for one stable area', () => {
+  const store = createAreaStore({ maxEntries: 2, maxQueryEntries: 3 });
+  const area = store.put({
+    geometry: [[square(0, 0, 1, 1)]],
+    name: 'Stable',
+    source: 'osm',
+    sourceId: 'osm:stable',
+  });
+  for (let i = 0; i < 50; i += 1)
+    store.rememberQuery(`alias-${i}`, area.areaId);
+  assert.equal(store.recallQuery('alias-0'), null, 'old aliases are evicted');
+  assert.equal(store.recallQuery('alias-46'), null, 'the bound is independent');
+  assert.equal(store.recallQuery('alias-47')?.areaId, area.areaId);
+  assert.equal(store.recallQuery('alias-49')?.areaId, area.areaId);
+  assert.equal(store.size, 1, 'alias churn does not evict the area record');
+});
+
+test('a stable source keeps one handle when stored again', () => {
+  const store = createAreaStore();
+  for (let i = 0; i < 2; i += 1)
+    store.put({
+      geometry: [[square(0, 0, 1, 1)]],
+      name: 'X',
+      source: 'natural-earth',
+      sourceId: 'ne:state:x',
+    });
+  assert.equal(store.size, 1);
+});
+
+test('a named natural region resolves offline with every part', async () => {
+  const { resolver, calls } = makeResolver();
+  const result = await resolver.resolve({ query: 'the Alps' });
+  assert.equal(result.ok, true);
+  assert.equal(result.record.source, 'natural-earth');
+  assert.equal(result.record.parts, 2);
+  assert.equal(calls.outline.length, 0, 'no lookup');
+  assert.ok(result.ms < 300);
+});
+
+test('a bundled state resolves by name with no lookup', async () => {
+  const { resolver, calls } = makeResolver();
+  const result = await resolver.resolve({ query: 'Texas' });
+  assert.equal(result.ok, true);
+  assert.equal(result.rung, 'bundled');
+  assert.equal(result.record.level, 'admin1');
+  assert.equal(result.record.source, 'natural-earth');
+  assert.equal(result.record.meta.country, 'United States of America');
+  assert.equal(calls.outline.length, 0);
+});
+
+test('Bagmati goes to the outline ladder and keeps its hole', async () => {
+  const { resolver, calls } = makeResolver();
+  const result = await resolver.resolve({ query: 'Bagmati province' });
+  assert.equal(result.ok, true);
+  assert.equal(result.rung, 'nominatim');
+  assert.equal(result.record.source, 'osm');
+  assert.equal(result.record.level, 'admin1', 'the level word is kept');
+  assert.equal(result.record.holes, 1);
+  assert.equal(pointInPreparedArea(result.record.prepared, 27.2, 85), true);
+  assert.equal(
+    pointInPreparedArea(result.record.prepared, 27.65, 85.35),
+    false,
+    'inside the hole',
+  );
+  assert.equal(calls.outline[0].levelHint, 'admin1');
+});
+
+test('a legacy bundled zone is never stored as the requested current province', async () => {
+  const legacy = admin(
+    'state',
+    'Bagmati Zone',
+    'Nepal',
+    [84.645, 27.357, 86.055, 28.335],
+  );
+  const { store, resolver } = makeResolver({
+    findAdminCandidates: async () => [legacy],
+  });
+  const result = await resolver.resolve({ query: 'Bagmati province' });
+  assert.equal(result.ok, false);
+  assert.equal(result.code, 'AREA_IDENTITY_UNVERIFIED');
+  assert.equal(result.record, undefined);
+  assert.equal(store.size, 0);
+  const repeated = await resolver.resolve({ query: 'Bagmati province' });
+  assert.equal(repeated.code, 'AREA_IDENTITY_UNVERIFIED');
+  assert.equal(repeated.cached, false);
+  assert.equal(store.size, 0);
+});
+
+test('legacy zone identity cannot escape through view choice or candidate memory', async () => {
+  const nepal = admin(
+    'state',
+    'Bagmati Zone',
+    'Nepal',
+    [84.645, 27.357, 86.055, 28.335],
+  );
+  const namesake = admin(
+    'state',
+    'Bagmati Zone',
+    'Elsewhere',
+    [10, 10, 11, 11],
+  );
+  const { store, resolver } = makeResolver({
+    findAdminCandidates: async () => [nepal, namesake],
+    viewCenter: () => ({ lat: 27.7, lon: 85.3 }),
+  });
+  const result = await resolver.resolve({ query: 'Bagmati province' });
+  assert.equal(result.ok, false);
+  assert.equal(result.code, 'AREA_IDENTITY_UNVERIFIED');
+  assert.equal(result.needsClarification, undefined);
+  assert.equal(result.candidates, undefined);
+  assert.equal(store.size, 0);
+  assert.equal(
+    (await resolver.resolve({ candidateId: 'ne:state:nepal-bagmati-zone' }))
+      .code,
+    'UNKNOWN_CANDIDATE',
+  );
+  assert.equal(store.size, 0);
+});
+
+test('a repeat is answered from the store without a lookup', async () => {
+  const { resolver, calls } = makeResolver();
+  await resolver.resolve({ query: 'Bagmati' });
+  const again = await resolver.resolve({ query: 'bagmati' });
+  assert.equal(again.ok, true);
+  assert.equal(again.cached, true);
+  assert.equal(calls.outline.length, 1);
+});
+
+test('an ambiguous name asks instead of guessing, and the choice resolves', async () => {
+  const { resolver, calls } = makeResolver();
+  const result = await resolver.resolve({ query: 'Georgia' });
+  assert.equal(result.ok, false);
+  assert.equal(result.needsClarification, true);
+  assert.equal(result.candidates.length, 2);
+  assert.deepEqual(result.candidates[0], {
+    candidateId: 'ne:state:united-states-of-america-georgia',
+    name: 'Georgia',
+    level: 'admin1',
+    country: 'United States of America',
+  });
+  assert.equal(result.candidates[1].level, 'country');
+  assert.equal(calls.outline.length, 0, 'no lookup spent on a question');
+  const chosen = await resolver.resolve({
+    candidateId: result.candidates[0].candidateId,
+  });
+  assert.equal(chosen.ok, true);
+  assert.equal(chosen.record.meta.country, 'United States of America');
+});
+
+test('an already-aborted clarification choice does not persist page state', async () => {
+  const { store, resolver } = makeResolver();
+  const result = await resolver.resolve({ query: 'Georgia' });
+  const controller = new AbortController();
+  controller.abort();
+  const chosen = await resolver.resolve(
+    { candidateId: result.candidates[0].candidateId },
+    { signal: controller.signal },
+  );
+  assert.equal(chosen.code, 'CANCELLED');
+  assert.equal(chosen.cancelled, true);
+  assert.equal(store.size, 0);
+});
+
+test('candidate IDs accept every emitted choice and reject malformed or oversized input', async () => {
+  const { store, resolver } = makeResolver();
+  const result = await resolver.resolve({ query: 'Georgia' });
+  const grammar = new RegExp(AREA_CANDIDATE_ID_PATTERN, 'u');
+  for (const choice of result.candidates) {
+    assert.ok(choice.candidateId.length <= MAX_AREA_CANDIDATE_ID_LENGTH);
+    assert.match(choice.candidateId, grammar);
+    assert.equal(isAreaCandidateId(choice.candidateId), true);
+    assert.equal(
+      (await resolver.resolve({ candidateId: choice.candidateId })).ok,
+      true,
+    );
+  }
+  assert.equal(result.candidates[0].candidateId.length, 41);
+
+  store.put({
+    geometry: [[square(0, 0, 1, 1)]],
+    name: 'Not a candidate',
+    source: 'osm',
+    sourceId: 'area-1',
+  });
+  for (const bad of [
+    'area-1',
+    'ne:state:bad slug',
+    'ne:state:../../etc',
+    'ne:state:!!!',
+    'ne:state:a_b',
+    'ne:planet:earth',
+    `ne:state:${'a'.repeat(MAX_AREA_CANDIDATE_ID_LENGTH)}`,
+  ]) {
+    const rejected = await resolver.resolve({ candidateId: bad });
+    assert.equal(rejected.code, 'BAD_CANDIDATE');
+  }
+});
+
+test('long bundled names produce bounded, distinct candidate handles', async () => {
+  const name = 'A'.repeat(70);
+  const candidates = [
+    admin('state', name, `B${'b'.repeat(70)}`, [0, 0, 1, 1]),
+    admin('state', name, `C${'c'.repeat(70)}`, [2, 2, 3, 3]),
+  ];
+  const { resolver } = makeResolver({
+    findAdminCandidates: async () => candidates,
+  });
+  const result = await resolver.resolve({ query: name });
+  assert.equal(result.needsClarification, true);
+  assert.equal(
+    new Set(result.candidates.map((choice) => choice.candidateId)).size,
+    2,
+  );
+  for (const choice of result.candidates) {
+    assert.equal(isAreaCandidateId(choice.candidateId), true);
+    assert.ok(choice.candidateId.length <= MAX_AREA_CANDIDATE_ID_LENGTH);
+    assert.equal(
+      (await resolver.resolve({ candidateId: choice.candidateId })).ok,
+      true,
+    );
+  }
+});
+
+test('within or level settles an ambiguous name', async () => {
+  const { resolver } = makeResolver();
+  const state = await resolver.resolve({
+    query: 'Georgia',
+    within: 'United States',
+  });
+  assert.equal(state.ok, true);
+  assert.equal(state.record.level, 'admin1');
+  const country = await resolver.resolve({
+    query: 'Georgia',
+    level: 'country',
+  });
+  assert.equal(country.ok, true);
+  assert.equal(country.record.level, 'country');
+  const both = await resolver.resolve({ query: 'Punjab', level: 'admin1' });
+  assert.equal(both.needsClarification, true, 'both Punjabs are admin1');
+  const pk = await resolver.resolve({ query: 'Punjab', within: 'Pakistan' });
+  assert.equal(pk.record.meta.country, 'Pakistan');
+});
+
+test('the view settles an ambiguous name only when it is inside one of them', async () => {
+  const { resolver } = makeResolver({
+    viewCenter: () => ({ lat: 31, lon: 75.5 }),
+  });
+  const result = await resolver.resolve({ query: 'Punjab' });
+  assert.equal(result.ok, true);
+  assert.equal(result.record.meta.country, 'India');
+  const away = makeResolver({ viewCenter: () => ({ lat: 0, lon: 0 }) });
+  const asked = await away.resolver.resolve({ query: 'Punjab' });
+  assert.equal(asked.needsClarification, true);
+  // A choice the view made is not remembered for the name.
+  let view = { lat: 31, lon: 75.5 };
+  const moving = makeResolver({ viewCenter: () => view });
+  await moving.resolver.resolve({ query: 'Punjab' });
+  view = { lat: 31, lon: 71 };
+  const again = await moving.resolver.resolve({ query: 'Punjab' });
+  assert.equal(again.record.meta.country, 'Pakistan');
+});
+
+test('a qualifier skips the natural-region pack, which cannot check it', async () => {
+  const { resolver, calls } = makeResolver();
+  await resolver.resolve({ query: 'the Alps', within: 'Austria' });
+  assert.equal(calls.natural, 0);
+  assert.equal(calls.outline.length, 1);
+});
+
+test('the area just stored survives eviction even when every other area is pinned', () => {
+  const store = createAreaStore({ maxEntries: 2, isPinned: () => true });
+  for (let i = 0; i < 3; i += 1)
+    store.put({
+      geometry: [[square(i, 0, i + 0.5, 0.5)]],
+      name: `A${i}`,
+      source: 'drawn',
+    });
+  const last = store.put({
+    geometry: [[square(9, 0, 9.5, 0.5)]],
+    name: 'new',
+    source: 'drawn',
+  });
+  assert.ok(store.get(last.areaId), 'the new handle is usable');
+});
+
+test('a country stands for its same-named state; namesakes abroad are rivals', () => {
+  const mexico = admin('country', 'Mexico', 'Mexico', [-118, 14, -86, 33]);
+  const state = admin(
+    'state',
+    'State of Mexico',
+    'Mexico',
+    [-100, 18, -98, 20],
+  );
+  assert.deepEqual(distinctAdminPlaces([state, mexico]), [mexico]);
+  assert.equal(distinctAdminPlaces([PUNJAB_IN, PUNJAB_PK]).length, 2);
+});
+
+test('bundled candidates: shared prominent names list every unit, minor ones none', async () => {
+  const names = async (q) =>
+    (await findAdminCandidates(q)).map((a) => `${a.kind}:${a.country}`);
+  assert.deepEqual((await names('Punjab')).sort(), [
+    'state:India',
+    'state:Pakistan',
+  ]);
+  assert.deepEqual((await names('Georgia')).sort(), [
+    'country:Georgia',
+    'state:United States of America',
+  ]);
+  assert.deepEqual(await names('Punjab, India'), ['state:India']);
+  assert.deepEqual(await names('Kent'), [], 'minor units are the geocoder’s');
+});
+
+test('an outline ladder refusal passes through with its code', async () => {
+  const { resolver } = makeResolver();
+  const miss = await resolver.resolve({ query: 'Nowhere Province' });
+  assert.equal(miss.ok, false);
+  assert.equal(miss.code, 'AREA_NOT_FOUND');
+  const down = makeResolver({
+    resolveNamedOutline: async () => ({
+      ok: false,
+      code: 'AREA_UNAVAILABLE',
+      error: 'No outline source can trace it here.',
+    }),
+  });
+  const failed = await down.resolver.resolve({ query: 'Kathmandu' });
+  assert.equal(failed.code, 'AREA_UNAVAILABLE');
+});
+
+test('an approximate outline is stored and labelled as such', async () => {
+  const { resolver } = makeResolver({
+    resolveNamedOutline: async () => ({
+      ok: true,
+      name: 'Mission',
+      polygons: [[square(0, 0, 0.01, 0.01)]],
+      source: 'osm',
+      rung: 'overpass',
+      approximate: true,
+      basis: 'buffer sized to the place',
+    }),
+  });
+  const result = await resolver.resolve({ query: 'the Mission' });
+  assert.equal(result.record.approximate, true);
+  assert.equal(result.record.source, 'approximate');
+  assert.equal(result.record.meta.basis, 'buffer sized to the place');
+});
+
+test('a slow lookup times out but keeps filling the cache', async () => {
+  let release;
+  const gate = new Promise((r) => {
+    release = r;
+  });
+  const { resolver } = makeResolver({
+    resolveNamedOutline: async () => {
+      await gate;
+      return BAGMATI;
+    },
+  });
+  const first = await resolver.resolve({ query: 'Bagmati' }, { budgetMs: 20 });
+  assert.equal(first.code, 'AREA_TIMEOUT');
+  release();
+  await new Promise((r) => setTimeout(r, 10));
+  const second = await resolver.resolve({ query: 'Bagmati' }, { budgetMs: 20 });
+  assert.equal(second.ok, true);
+  assert.equal(second.cached, true);
+});
+
+test('a cancelled caller returns at once without cancelling the shared lookup', async () => {
+  const { resolver } = makeResolver();
+  const controller = new AbortController();
+  controller.abort();
+  const result = await resolver.resolve(
+    { query: 'Bagmati' },
+    { signal: controller.signal },
+  );
+  assert.equal(result.code, 'CANCELLED');
+  await new Promise((r) => setTimeout(r, 5));
+  const again = await resolver.resolve({ query: 'Bagmati' });
+  assert.equal(again.ok, true);
+});
+
+test('distinct area lookups are hard-bounded while same-key callers still coalesce', async () => {
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  let calls = 0;
+  const { resolver } = makeResolver({
+    maxInFlight: 1,
+    resolveNamedOutline: async (query) => {
+      calls += 1;
+      await gate;
+      return { ...BAGMATI, name: query };
+    },
+  });
+  const first = resolver.resolve({ query: 'First Area' });
+  const joined = resolver.resolve({ query: 'First Area' });
+  const refused = await resolver.resolve({ query: 'Second Area' });
+  assert.equal(refused.code, 'AREA_BUSY');
+  release();
+  const [a, b] = await Promise.all([first, joined]);
+  assert.equal(calls, 1, 'the same key shares the one live provider lookup');
+  assert.equal(a.ok, true);
+  assert.equal(b.ok, true);
+});
+
+test("settled lookups leave no listener on the caller's signal", async () => {
+  const { resolver } = makeResolver();
+  const controller = new AbortController();
+  let added = 0;
+  let removed = 0;
+  const add = controller.signal.addEventListener.bind(controller.signal);
+  const remove = controller.signal.removeEventListener.bind(controller.signal);
+  controller.signal.addEventListener = (...args) => {
+    if (args[0] === 'abort') added += 1;
+    return add(...args);
+  };
+  controller.signal.removeEventListener = (...args) => {
+    if (args[0] === 'abort') removed += 1;
+    return remove(...args);
+  };
+  for (const query of ['Texas', 'Bagmati', 'Nowhere at all'])
+    await resolver.resolve({ query }, { signal: controller.signal });
+  assert.ok(added > 0, 'the lookups listened while running');
+  assert.equal(removed, added, 'every listener is detached once settled');
+
+  const aborted = AbortSignal.abort();
+  let attached = 0;
+  aborted.addEventListener = () => {
+    attached += 1;
+  };
+  const late = await resolver.resolve(
+    { query: 'Punjab, Pakistan' },
+    { signal: aborted },
+  );
+  assert.equal(late.code, 'CANCELLED');
+  assert.equal(attached, 0, 'an aborted signal gets no listener');
+});
+
+test('resolver disposal aborts provider lifetime and prevents late store/cache writes', async () => {
+  let release;
+  let providerSignal;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const { resolver, store } = makeResolver({
+    resolveNamedOutline: async (_query, { signal }) => {
+      providerSignal = signal;
+      await gate; // Deliberately ignores abort until it returns.
+      return BAGMATI;
+    },
+  });
+  const pending = resolver.resolve({ query: 'Late Area' });
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  resolver.dispose();
+  assert.equal(providerSignal.aborted, true);
+  release();
+  const result = await pending;
+  assert.equal(result.ok, false);
+  assert.equal(store.size, 0, 'late provider data never reaches the store');
+  const after = await resolver.resolve({ query: 'Late Area' });
+  assert.equal(after.code, 'CANCELLED');
+});
+
+test('level words map to area levels', () => {
+  assert.deepEqual(splitLevelWord('Bagmati Province'), {
+    bare: 'bagmati',
+    level: 'admin1',
+  });
+  assert.deepEqual(splitLevelWord('Kathmandu'), {
+    bare: 'kathmandu',
+    level: null,
+  });
+});
+
+test('non-Latin names are distinct keys: 東京 then 大阪 looks up both', async () => {
+  const asked = [];
+  const { resolver } = makeResolver({
+    resolveNamedOutline: async (q) => {
+      asked.push(q);
+      return { ...BAGMATI, name: q };
+    },
+  });
+  const first = await resolver.resolve({ query: '東京' });
+  const second = await resolver.resolve({ query: '大阪' });
+  assert.notEqual(first.record.areaId, second.record.areaId);
+  assert.equal(second.cached, false, 'not the cached Tokyo');
+  assert.deepEqual(asked, ['東京', '大阪']);
+  // The same name with a different `within` is a different question.
+  await resolver.resolve({ query: '東京', within: '日本' });
+  assert.equal(asked.length, 3);
+  assert.equal((await resolver.resolve({ query: '東京' })).cached, true);
+});
+
+test('a name that normalizes to nothing is never cached or shared', async () => {
+  let calls = 0;
+  const { resolver } = makeResolver({
+    resolveNamedOutline: async () => {
+      calls += 1;
+      return BAGMATI;
+    },
+  });
+  await resolver.resolve({ query: '!!!' });
+  await resolver.resolve({ query: '???' });
+  assert.equal(calls, 2, 'two punctuation-only asks are two lookups');
+});
+
+test('a natural region never hides a country or state of the same name', async () => {
+  const desert = {
+    name: 'Punjab',
+    kind: 'natural',
+    polygons: [square(70, 28, 76, 33)],
+  };
+  const { resolver } = makeResolver({
+    findNaturalRegion: async (q) => (/^punjab$/i.test(q) ? desert : null),
+  });
+  const bare = await resolver.resolve({ query: 'Punjab' });
+  assert.equal(bare.ok, false);
+  assert.equal(bare.code, 'AMBIGUOUS_AREA', 'the two states are asked about');
+  const natural = await resolver.resolve({ query: 'Punjab', level: 'natural' });
+  assert.equal(natural.ok, true);
+  assert.equal(natural.record.level, 'natural', 'asked for, the region wins');
+});
+
+test('same-named states in one country get their own candidate and area', async () => {
+  const wa = admin(
+    'state',
+    'Washington',
+    'United States of America',
+    [-124, 45.5, -117, 49],
+    { regionCode: 'WA' },
+  );
+  const dc = admin(
+    'state',
+    'Washington',
+    'United States of America',
+    [-77.2, 38.8, -76.9, 39],
+    { regionCode: 'DC' },
+  );
+  const { resolver } = makeResolver({
+    findAdminCandidates: async (q) => (/^washington$/i.test(q) ? [wa, dc] : []),
+  });
+  const asked = await resolver.resolve({ query: 'Washington' });
+  assert.equal(asked.code, 'AMBIGUOUS_AREA');
+  const ids = asked.candidates.map((c) => c.candidateId);
+  assert.equal(new Set(ids).size, 2, `distinct ids: ${ids.join(', ')}`);
+  assert.deepEqual(
+    asked.candidates.map((c) => c.region),
+    ['WA', 'DC'],
+    'the choices can be told apart',
+  );
+  const picked = await Promise.all(
+    ids.map((candidateId) => resolver.resolve({ candidateId })),
+  );
+  assert.ok(picked.every((p) => p.ok));
+  assert.notEqual(
+    picked[0].record.areaId,
+    picked[1].record.areaId,
+    'two areas, not one overwritten',
+  );
+  assert.equal(
+    pointInPreparedArea(picked[0].record.prepared, 47, -120),
+    true,
+    'Washington State',
+  );
+  assert.equal(
+    pointInPreparedArea(picked[1].record.prepared, 38.9, -77),
+    true,
+    'District of Columbia',
+  );
+});
+
+test('a bundled name mismatch falls through to the outline ladder', async () => {
+  const azad = admin('state', 'Azad Kashmir', 'Pakistan', [73, 33, 75, 35.5]);
+  const kashmir = {
+    ok: true,
+    name: 'Kashmir',
+    polygons: [[square(73, 32, 80, 37)]],
+    source: 'osm',
+    rung: 'nominatim',
+  };
+  let outlineOk = true;
+  const { resolver } = makeResolver({
+    findAdminCandidates: async (q) => (/^kashmir$/i.test(q) ? [azad] : []),
+    resolveNamedOutline: async () =>
+      outlineOk
+        ? kashmir
+        : { ok: false, code: 'AREA_NOT_FOUND', error: 'none' },
+  });
+  const found = await resolver.resolve({ query: 'Kashmir' });
+  assert.equal(found.ok, true, found.error);
+  assert.equal(found.record.name, 'Kashmir');
+  outlineOk = false;
+  const { resolver: offline } = makeResolver({
+    findAdminCandidates: async () => [azad],
+    resolveNamedOutline: async () => ({
+      ok: false,
+      code: 'AREA_NOT_FOUND',
+      error: 'none',
+    }),
+  });
+  const refused = await offline.resolve({ query: 'Kashmir' });
+  assert.equal(
+    refused.code,
+    'AREA_IDENTITY_MISMATCH',
+    'the bundled refusal is kept',
+  );
+});
+
+test('a view-picked outline answer is not reused for the same name elsewhere', async () => {
+  let view = { lat: 39.8, lon: -89.6 }; // Springfield, Illinois
+  const springfield = (center) => ({
+    ok: true,
+    name:
+      center.lon < -80 ? 'Springfield, Illinois' : 'Springfield, Massachusetts',
+    polygons: [
+      [
+        square(
+          center.lon - 0.1,
+          center.lat - 0.1,
+          center.lon + 0.1,
+          center.lat + 0.1,
+        ),
+      ],
+    ],
+    source: 'osm',
+    rung: 'nominatim',
+  });
+  const { resolver } = makeResolver({
+    viewCenter: () => view,
+    resolveNamedOutline: async () => springfield(view),
+  });
+  const illinois = await resolver.resolve({ query: 'Springfield' });
+  assert.equal(illinois.record.name, 'Springfield, Illinois');
+  const again = await resolver.resolve({ query: 'Springfield' });
+  assert.equal(again.cached, true, 'the same view still reuses it');
+  view = { lat: 42.1, lon: -72.6 }; // Springfield, Massachusetts
+  const massachusetts = await resolver.resolve({ query: 'Springfield' });
+  assert.equal(massachusetts.cached, false);
+  assert.equal(massachusetts.record.name, 'Springfield, Massachusetts');
+});
+
+test('a name spoken without accents matches its accented unit, Latin letters only', async () => {
+  const quebec = admin('state', 'Québec', 'Canada', [-79.8, 45, -57.1, 62.6]);
+  const cordobaAr = admin(
+    'state',
+    'Córdoba',
+    'Argentina',
+    [-65.8, -35, -61.8, -29.5],
+  );
+  const cordobaEs = admin('state', 'Córdoba', 'Spain', [-5.6, 37.2, -4, 38.7]);
+  const thai = admin('state', 'ป่าย', 'Thailand', [98, 19, 99, 20]);
+  const { resolver } = makeResolver({
+    findAdminCandidates: async (q) =>
+      /^quebec$/i.test(q)
+        ? [quebec]
+        : /^cordoba$/i.test(q)
+          ? [cordobaAr, cordobaEs]
+          : q === 'ปาย'
+            ? [thai]
+            : [],
+  });
+  const qc = await resolver.resolve({ query: 'Quebec' });
+  assert.equal(qc.ok, true, qc.error);
+  assert.equal(qc.record.name, 'Québec');
+  const cordoba = await resolver.resolve({ query: 'Cordoba' });
+  assert.equal(cordoba.code, 'AMBIGUOUS_AREA', 'both Córdobas are asked about');
+  assert.equal(cordoba.candidates.length, 2);
+  const tone = await resolver.resolve({ query: 'ปาย' });
+  assert.equal(tone.ok, false, 'a Thai tone mark still tells names apart');
+});
+
+test('a natural name for two distant places is asked about, and the choice resolves', async () => {
+  const azores = {
+    name: 'Flores',
+    featurecla: 'Island',
+    polygons: [square(-31.3, 39.4, -31.1, 39.5)],
+    areaKm2: 140,
+    center: { lat: 39.45, lon: -31.2 },
+  };
+  const indonesia = {
+    name: 'Flores',
+    featurecla: 'Island',
+    polygons: [square(119.8, -8.9, 123, -8.1)],
+    areaKm2: 14000,
+    center: { lat: -8.5, lon: 121.4 },
+  };
+  const { resolver } = makeResolver({
+    findNaturalRegion: async (q) =>
+      /^flores$/i.test(q)
+        ? {
+            name: 'Flores',
+            kind: 'natural',
+            polygons: indonesia.polygons,
+            places: [indonesia, azores],
+          }
+        : null,
+  });
+  const asked = await resolver.resolve({ query: 'Flores' });
+  assert.equal(asked.code, 'AMBIGUOUS_AREA');
+  assert.equal(asked.candidates.length, 2);
+  assert.ok(asked.candidates.every((c) => c.level === 'natural' && c.region));
+  const picked = await resolver.resolve({
+    candidateId: asked.candidates[1].candidateId,
+  });
+  assert.equal(picked.ok, true, picked.error);
+  assert.equal(picked.record.level, 'natural');
+  assert.equal(
+    pointInPreparedArea(picked.record.prepared, 39.45, -31.2),
+    true,
+    'the Azores Flores',
+  );
+});
+
+test('a natural feature in several parts is stored whole', async () => {
+  const north = square(33.7, 2.4, 44.2, 15.4);
+  const south = square(28.9, -15.6, 35.8, 2.4);
+  const { resolver } = makeResolver({
+    findNaturalRegion: async (q) =>
+      /rift/i.test(q)
+        ? {
+            name: 'Great Rift Valley',
+            kind: 'natural',
+            polygons: [north],
+            places: [
+              {
+                name: 'Great Rift Valley',
+                featurecla: 'Valley',
+                polygons: [north, south],
+                areaKm2: 2,
+                center: { lat: 0, lon: 36 },
+              },
+            ],
+          }
+        : null,
+  });
+  const rift = await resolver.resolve({ query: 'Great Rift Valley' });
+  assert.equal(rift.ok, true);
+  assert.equal(
+    pointInPreparedArea(rift.record.prepared, -10, 33),
+    true,
+    'the southern part counts',
+  );
+});

src/data/areaStore.js

@@ -0,0 +1,212 @@
+/**
+ * Session-scoped store of area handles. A voice turn refers to an area by its
+ * `areaId`; the geometry itself stays here and never goes to the model.
+ *
+ * Records are immutable once stored. A source with a stable identity (an OSM
+ * relation, a Natural Earth region, an annotation) keeps the same id when it
+ * is stored again, so repeating "outline Bagmati" does not mint new handles.
+ * Least recently used records are evicted past `maxEntries`, except those
+ * `isPinned` reports as still in use.
+ *
+ * Pure: no Cesium, DOM or network.
+ * @module data/areaStore
+ */
+
+import {
+  multiPolygonAreaKm2,
+  multiPolygonCounts,
+  normalizeMultiPolygon,
+  prepareArea,
+} from './areaGeometry.js';
+
+/** Where an area came from, as the model and the panel name it. */
+export const AREA_SOURCES = Object.freeze([
+  'natural-earth',
+  'us-census',
+  'wof',
+  'datasf',
+  'osm',
+  'openfreemap',
+  'annotation',
+  'drawn',
+  'approximate',
+]);
+
+/** Levels a resolved area can have. */
+export const AREA_LEVELS = Object.freeze([
+  'country',
+  'admin1',
+  'admin2',
+  'city',
+  'district',
+  'natural',
+  'site',
+  'drawn',
+]);
+
+const round = (value, digits) => {
+  const f = 10 ** digits;
+  return Math.round(value * f) / f;
+};
+
+/**
+ * Create an area store.
+ * @param {{maxEntries?: number, maxQueryEntries?: number, now?: () => number, isPinned?: (areaId: string) => boolean}} [options]
+ */
+export function createAreaStore({
+  maxEntries = 32,
+  maxQueryEntries = Math.max(32, maxEntries * 8),
+  now = () => Date.now(),
+  isPinned = () => false,
+} = {}) {
+  /** Insertion order doubles as recency: get() re-inserts. */
+  const records = new Map();
+  /** query key → areaId, for cached resolutions. */
+  const queries = new Map();
+  let seq = 0;
+
+  function forgetRecordQueries(areaId) {
+    for (const [key, queried] of queries)
+      if (queried === areaId) queries.delete(key);
+  }
+
+  /**
+   * Drop least recently used records past the bound, skipping pinned ones
+   * (an area an outline on the map still refers to keeps its geometry for as
+   * long as the outline exists; the annotation cap bounds how many that is).
+   */
+  function evict(keep) {
+    if (records.size <= maxEntries) return;
+    for (const id of [...records.keys()]) {
+      if (records.size <= maxEntries) break;
+      // The record just stored is always kept; pinned ones may exceed the bound.
+      if (id === keep || isPinned(id)) continue;
+      records.delete(id);
+      forgetRecordQueries(id);
+    }
+  }
+
+  /**
+   * Store an area. Returns the stored record, or null when the geometry is
+   * unusable.
+   * @param {object} input
+   * @param {object|Array} input.geometry GeoJSON Polygon/MultiPolygon or coordinates.
+   * @param {string} input.name
+   * @param {string} input.source One of AREA_SOURCES.
+   * @param {string} [input.sourceId] Stable identity, e.g. `ne:state:india-punjab`.
+   * @param {string} [input.level]
+   * @param {boolean} [input.approximate]
+   * @param {object} [input.meta] Extra facts (country, license, completeness).
+   * @returns {object|null}
+   */
+  function put(input) {
+    const geometry = normalizeMultiPolygon(input?.geometry);
+    if (!geometry) return null;
+    const prepared = prepareArea(geometry);
+    if (!prepared) return null;
+    const areaId = input.sourceId
+      ? String(input.sourceId)
+      : `area-${(seq += 1)}`;
+    const counts = multiPolygonCounts(geometry);
+    const record = Object.freeze({
+      areaId,
+      name: String(input.name || 'Unnamed area').slice(0, 160),
+      level: AREA_LEVELS.includes(input.level) ? input.level : null,
+      source: AREA_SOURCES.includes(input.source)
+        ? input.source
+        : 'approximate',
+      approximate: Boolean(input.approximate),
+      geometry,
+      prepared,
+      bbox: prepared.bbox,
+      areaKm2: multiPolygonAreaKm2(geometry),
+      parts: counts.parts,
+      holes: counts.holes,
+      meta: Object.freeze({ ...(input.meta || {}) }),
+      storedAt: now(),
+    });
+    records.delete(areaId);
+    records.set(areaId, record);
+    evict(areaId);
+    return record;
+  }
+
+  /** The record for an id, marking it recently used; null when unknown or evicted. */
+  function get(areaId) {
+    const record = records.get(String(areaId ?? ''));
+    if (!record) return null;
+    records.delete(record.areaId);
+    records.set(record.areaId, record);
+    return record;
+  }
+
+  return {
+    put,
+    get,
+    has: (areaId) => records.has(String(areaId ?? '')),
+    /** Remember which area a query resolved to. */
+    rememberQuery(key, areaId) {
+      if (!key || !records.has(areaId)) return;
+      queries.delete(key);
+      queries.set(key, areaId);
+      while (queries.size > maxQueryEntries)
+        queries.delete(queries.keys().next().value);
+    },
+    /** The area a query resolved to earlier, if still stored. */
+    recallQuery(key) {
+      const id = queries.get(key);
+      const record = id ? get(id) : null;
+      if (!record) {
+        queries.delete(key);
+        return null;
+      }
+      queries.delete(key);
+      queries.set(key, id);
+      return record;
+    },
+    /** Newest first. */
+    list: () => [...records.values()].reverse(),
+    /** The most recently stored or used record matching `predicate`. */
+    latest(predicate = () => true) {
+      return [...records.values()].reverse().find(predicate) || null;
+    },
+    delete(areaId) {
+      const id = String(areaId ?? '');
+      const deleted = records.delete(id);
+      if (deleted) forgetRecordQueries(id);
+      return deleted;
+    },
+    clear() {
+      records.clear();
+      queries.clear();
+    },
+    get size() {
+      return records.size;
+    },
+  };
+}
+
+/**
+ * The model-facing summary of an area: identity, size and provenance, never
+ * coordinates beyond a rounded bbox.
+ * @param {object} record
+ * @returns {object}
+ */
+export function summarizeArea(record) {
+  if (!record) return null;
+  return {
+    areaId: record.areaId,
+    name: record.name,
+    level: record.level,
+    source: record.source,
+    ...(record.meta.country ? { country: record.meta.country } : {}),
+    bbox: record.bbox.map((v) => round(v, 3)),
+    areaKm2:
+      record.areaKm2 >= 100
+        ? Math.round(record.areaKm2)
+        : round(record.areaKm2, 2),
+    parts: record.parts,
+    holes: record.holes,
+    ...(record.approximate ? { approximate: true } : {}),
+  };
+}

src/data/cctvHouston.test.mjs

@@ -0,0 +1,403 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+  houstonCameraName,
+  houstonCameraToSource,
+  loadHoustonSourcesFromOpenData,
+} from '../../server/providers/cctv/sources.js';
+import {
+  DEFAULT_CCTV_MAX_SOURCES,
+  DEFAULT_HOUSTON_MAX_SOURCES,
+  HOUSTON_CAMERAS_URL,
+  HOUSTON_GROUND_ELEVATION_M,
+  HOUSTON_IMAGE_ORIGIN,
+  HOUSTON_IMAGE_URL,
+  HOUSTON_MAX_CATALOG_BYTES,
+} from '../../server/providers/cctv/constants.js';
+import {
+  CAMERA_CODE_MAX_CHARS,
+  isLikelyHoustonCoordinate,
+} from '../../server/providers/cctv/normalize.js';
+import { createCctvCatalog } from '../../server/providers/cctv/catalog.js';
+
+/**
+ * A response whose body is a live stream, plus a flag that flips when the
+ * stream is cancelled. A rejection path that returns without cancelling holds
+ * the transport open, so the flag is what the refusal tests actually assert.
+ */
+const streamingResponse = (init = {}) => {
+  const state = { cancelled: false };
+  const body = new ReadableStream({
+    start(controller) {
+      controller.enqueue(new TextEncoder().encode('{'));
+    },
+    cancel() {
+      state.cancelled = true;
+    },
+  });
+  return { response: new Response(body, init), state };
+};
+
+const DOWNTOWN_ID = '1002';
+const GALLERIA_ID = '2001';
+
+/** One TranStar camera row, shaped like the live `cctvSnapshots_json.js` payload. */
+const row = (overrides = {}) => ({
+  location: '10 EAST @ SAN JACINTO',
+  id: DOWNTOWN_ID,
+  lat: '29.76824',
+  lng: '-95.355711',
+  dir: 'South',
+  fc: '6',
+  fp: '300',
+  url: "showWin('/layers/gc.aspx?cam=1002&loc=IH-10_East_at_SAN_JACINTO')",
+  ...overrides,
+});
+
+test('a Houston row maps to a source on the pinned HTTPS frame host', () => {
+  const source = houstonCameraToSource(row());
+  assert.equal(source.id, `houston-${DOWNTOWN_ID}`);
+  assert.equal(source.name, '10 EAST @ SAN JACINTO');
+  assert.equal(source.city, 'Houston');
+  assert.equal(source.cityId, 'houston');
+  assert.equal(source.provider, 'Houston TranStar');
+  assert.equal(source.lat, 29.76824);
+  assert.equal(source.lon, -95.355711);
+  assert.equal(source.feedType, 'image');
+  assert.equal(source.sourceKind, 'houston-transtar');
+  assert.equal(
+    source.license,
+    'TranStar disclaimer — redistribution and external framing need TxDOT written permission',
+  );
+  assert.equal(source.groundElevationM, HOUSTON_GROUND_ELEVATION_M);
+  assert.equal(source.url, HOUSTON_IMAGE_URL(DOWNTOWN_ID));
+  assert.equal(source.url, source.snapshotUrl);
+  assert.ok(source.url.startsWith(HOUSTON_IMAGE_ORIGIN));
+  // dir South = the camera sits south of I-10; the nearest lanes run east.
+  assert.equal(source.headingConfidence, 'low');
+  assert.equal(source.headingDeg, 90);
+});
+
+test('frame URLs are synthesized from the numeric id; the payload URL is ignored', () => {
+  const source = houstonCameraToSource(
+    row({ url: 'https://evil.example/cameras/x/image' }),
+  );
+  assert.equal(source.url, HOUSTON_IMAGE_URL(DOWNTOWN_ID));
+  assert.equal(source.snapshotUrl, source.url);
+});
+
+test('zero ids, off-city geometry and unusable ids are dropped', () => {
+  assert.equal(houstonCameraToSource(row({ id: '0' })), null);
+  assert.equal(houstonCameraToSource(row({ id: '00' })), null);
+  assert.equal(houstonCameraToSource(row({ id: '../etc/passwd' })), null);
+  assert.equal(houstonCameraToSource(row({ id: '12' })), null);
+  assert.equal(houstonCameraToSource(row({ id: '1002/../x' })), null);
+  // Dallas: a plausible lat/lon, but not a Houston camera.
+  assert.equal(
+    houstonCameraToSource(row({ lat: '32.7767', lng: '-96.797' })),
+    null,
+  );
+  assert.equal(houstonCameraToSource(row({ lat: '0', lng: '0' })), null);
+  assert.equal(houstonCameraToSource(null), null);
+  // 3-digit and 5-digit snapshot ids stay.
+  assert.equal(houstonCameraToSource(row({ id: '102' })).id, 'houston-102');
+  assert.equal(houstonCameraToSource(row({ id: '13711' })).id, 'houston-13711');
+});
+
+test('dir is the side of the road: it gives a low-confidence travel heading', () => {
+  // TranStar's map reads dir as "Traffic closest to the camera is traveling":
+  // South -> Eastbound, North -> Westbound, West -> Southbound, East -> Northbound.
+  const expected = { South: 90, North: 270, West: 180, East: 0, south: 90 };
+  for (const [dir, heading] of Object.entries(expected)) {
+    const source = houstonCameraToSource(row({ dir }));
+    assert.equal(source.headingDeg, heading, `dir ${dir}`);
+    assert.equal(source.headingConfidence, 'low', `dir ${dir}`);
+    assert.equal(source.pitchDeg, -18, `dir ${dir}`);
+    assert.equal(source.fovDeg, 44, `dir ${dir}`);
+    assert.equal(source.rangeM, 145, `dir ${dir}`);
+    assert.equal(source.mountHeightM, 8, `dir ${dir}`);
+  }
+
+  const none = houstonCameraToSource(row({ dir: 'None' }));
+  assert.equal(none.headingConfidence, 'low');
+  assert.ok(Number.isFinite(none.headingDeg));
+  assert.equal(
+    none.headingDeg,
+    houstonCameraToSource(row({ dir: '' })).headingDeg,
+  );
+  for (const dir of ['Northeast', 'constructor', '__proto__', undefined]) {
+    assert.equal(
+      houstonCameraToSource(row({ dir })).headingDeg,
+      none.headingDeg,
+      `dir ${dir} falls back to the id hash`,
+    );
+  }
+});
+
+test('a nameless row still gets a label', () => {
+  assert.equal(
+    houstonCameraName({ location: '  45 GULF @ WEST DALLAS ' }, 'houston-102'),
+    '45 GULF @ WEST DALLAS',
+  );
+  assert.equal(houstonCameraName({}, 'houston-102'), 'Houston Camera 102');
+  assert.equal(houstonCameraName({}, ''), 'Houston Camera');
+});
+
+test('the unselected label is the interchange, trimmed to the code width', () => {
+  assert.equal(houstonCameraToSource(row()).code, '10 EAST @ SAN JACINTO');
+  const long = houstonCameraToSource(
+    row({
+      location:
+        'IH-10 Katy Managed Lanes Eastbound at a very long interchange name that must truncate',
+    }),
+  );
+  assert.equal(long.code.length, CAMERA_CODE_MAX_CHARS);
+  assert.ok(long.code.endsWith('…'));
+});
+
+test('the loader reads the keyless catalog and collapses duplicate ids', async (t) => {
+  t.mock.method(console, 'log', () => {});
+  const requested = [];
+  t.mock.method(globalThis, 'fetch', async (url, init) => {
+    requested.push([String(url), init.headers.Accept, init.redirect]);
+    return Response.json({
+      cameras: [
+        row(),
+        row({ location: '10 EAST @ SAN JACINTO (duplicate)' }),
+        row({
+          id: GALLERIA_ID,
+          location: '610 WEST LOOP @ SAN FELIPE',
+          lat: '29.749',
+          lng: '-95.461',
+          dir: 'North',
+        }),
+        row({ url: 'https://evil.example/x.jpg', id: '0' }),
+      ],
+    });
+  });
+  const cameras = await loadHoustonSourcesFromOpenData();
+  assert.deepEqual(requested, [[HOUSTON_CAMERAS_URL, '*/*', 'manual']]);
+  assert.deepEqual(
+    cameras.map((camera) => camera.id),
+    [`houston-${GALLERIA_ID}`, `houston-${DOWNTOWN_ID}`],
+    'nearest-to-anchor first: Uptown sits closer to its pin than downtown does',
+  );
+  assert.equal(cameras[1].name, '10 EAST @ SAN JACINTO');
+});
+
+test('an upstream failure yields an empty pack and releases the response', async (t) => {
+  t.mock.method(console, 'warn', () => {});
+  const failed = streamingResponse({ status: 503 });
+  t.mock.method(globalThis, 'fetch', async () => failed.response);
+  assert.deepEqual(await loadHoustonSourcesFromOpenData(), []);
+  assert.equal(failed.state.cancelled, true, 'the failed body is cancelled');
+
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    throw new Error('network down');
+  });
+  assert.deepEqual(await loadHoustonSourcesFromOpenData(), []);
+});
+
+test('the catalog fetch refuses redirects and oversized bodies', async (t) => {
+  t.mock.method(console, 'warn', () => {});
+  const seen = [];
+  const redirected = streamingResponse({
+    status: 302,
+    headers: { location: 'https://evil.example/cameras.js' },
+  });
+  t.mock.method(globalThis, 'fetch', async (url, init) => {
+    seen.push([String(url), init.redirect]);
+    return redirected.response;
+  });
+  assert.deepEqual(await loadHoustonSourcesFromOpenData(), []);
+  assert.deepEqual(seen, [[HOUSTON_CAMERAS_URL, 'manual']]);
+  assert.equal(
+    redirected.state.cancelled,
+    true,
+    'the redirect body is cancelled',
+  );
+
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    const body = JSON.stringify({ cameras: [row()] });
+    return new Response(body, {
+      headers: {
+        'Content-Type': 'application/javascript',
+        'content-length': String(HOUSTON_MAX_CATALOG_BYTES + 1),
+      },
+    });
+  });
+  assert.deepEqual(await loadHoustonSourcesFromOpenData(), []);
+
+  t.mock.restoreAll();
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async () => {
+    // Valid JSON with a usable camera, so only the byte cap can refuse it.
+    const oversized = JSON.stringify({
+      cameras: [row()],
+      padding: 'x'.repeat(HOUSTON_MAX_CATALOG_BYTES + 1024),
+    });
+    return new Response(
+      new ReadableStream({
+        start(controller) {
+          controller.enqueue(new TextEncoder().encode(oversized));
+          controller.close();
+        },
+      }),
+      { headers: { 'Content-Type': 'application/javascript' } },
+    );
+  });
+  assert.deepEqual(await loadHoustonSourcesFromOpenData(), []);
+});
+
+test('a reduced pack cap keeps cameras nearest the metro anchors', async (t) => {
+  t.mock.method(console, 'log', () => {});
+  const saved = process.env.CCTV_HOUSTON_MAX_SOURCES;
+  t.after(() => {
+    if (saved === undefined) delete process.env.CCTV_HOUSTON_MAX_SOURCES;
+    else process.env.CCTV_HOUSTON_MAX_SOURCES = saved;
+  });
+  process.env.CCTV_HOUSTON_MAX_SOURCES = '8';
+  const rows = [
+    ...[29.32, 29.322, 29.324, 29.326, 29.328, 29.33].map((lat, i) =>
+      row({
+        id: String(3000 + i),
+        lat: String(lat),
+        lng: '-94.80',
+        location: `Galveston ${i}`,
+        dir: 'East',
+      }),
+    ),
+    ...[29.76, 29.759, 29.758, 29.757, 29.756, 29.755].map((lat, i) =>
+      row({
+        id: String(4000 + i),
+        lat: String(lat),
+        lng: '-95.3698',
+        location: `Downtown ${i}`,
+        dir: 'North',
+      }),
+    ),
+  ];
+  t.mock.method(globalThis, 'fetch', async () =>
+    Response.json({ cameras: rows }),
+  );
+  const cameras = await loadHoustonSourcesFromOpenData();
+  assert.equal(cameras.length, 8);
+  assert.deepEqual(
+    cameras.map((camera) => camera.name.slice(0, 8)),
+    [
+      'Downtown',
+      'Downtown',
+      'Downtown',
+      'Downtown',
+      'Downtown',
+      'Downtown',
+      'Galvesto',
+      'Galvesto',
+    ],
+    'downtown fills first; the Galveston anchor still keeps a share',
+  );
+});
+
+/**
+ * Serve the Houston catalog to the Houston endpoint and an empty payload to
+ * every other pack, so one catalog refresh exercises the registration without
+ * reaching the network.
+ */
+const runCatalogWithMockedUpstreams = async (t) => {
+  const requested = [];
+  t.mock.restoreAll();
+  t.mock.method(console, 'log', () => {});
+  t.mock.method(console, 'warn', () => {});
+  t.mock.method(globalThis, 'fetch', async (url) => {
+    const href = String(url);
+    requested.push(href);
+    if (href === HOUSTON_CAMERAS_URL) {
+      return Response.json({
+        cameras: [
+          row(),
+          row({
+            id: GALLERIA_ID,
+            location: '610 WEST LOOP @ SAN FELIPE',
+            lat: '29.749',
+            lng: '-95.461',
+            dir: 'West',
+          }),
+        ],
+      });
+    }
+    return Response.json([]);
+  });
+  const sources = await createCctvCatalog({ sourceRoot: '/nonexistent' })();
+  return { requested, sources };
+};
+
+test('the Houston lane is wired into the catalog and its loader runs', async (t) => {
+  const saved = { ...process.env };
+  try {
+    delete process.env.CCTV_SOURCES_FILE;
+    delete process.env.CCTV_SOURCES_JSON;
+    process.env.CCTV_HOUSTON_ENABLED = '1';
+    const { requested, sources } = await runCatalogWithMockedUpstreams(t);
+    assert.ok(
+      requested.includes(HOUSTON_CAMERAS_URL),
+      'the catalog refresh invokes the Houston loader',
+    );
+    assert.deepEqual(
+      sources.filter((s) => s.cityId === 'houston').map((s) => s.id),
+      [`houston-${GALLERIA_ID}`, `houston-${DOWNTOWN_ID}`],
+      'Houston cameras reach the served catalog through the registered lane',
+    );
+  } finally {
+    for (const key of Object.keys(process.env)) {
+      if (!(key in saved)) delete process.env[key];
+    }
+    Object.assign(process.env, saved);
+  }
+});
+
+test('Houston stays unloaded unless CCTV_HOUSTON_ENABLED=1', async (t) => {
+  const saved = { ...process.env };
+  try {
+    delete process.env.CCTV_SOURCES_FILE;
+    delete process.env.CCTV_SOURCES_JSON;
+    for (const value of [undefined, '0']) {
+      if (value === undefined) delete process.env.CCTV_HOUSTON_ENABLED;
+      else process.env.CCTV_HOUSTON_ENABLED = value;
+      const { requested, sources } = await runCatalogWithMockedUpstreams(t);
+      assert.equal(
+        requested.includes(HOUSTON_CAMERAS_URL),
+        false,
+        'the pack reaches TranStar only after an explicit opt-in',
+      );
+      assert.deepEqual(
+        sources.filter((s) => s.cityId === 'houston'),
+        [],
+      );
+    }
+  } finally {
+    for (const key of Object.keys(process.env)) {
+      if (!(key in saved)) delete process.env[key];
+    }
+    Object.assign(process.env, saved);
+  }
+});
+
+test('the shipped catalog ceiling is not raised to make room for this pack', () => {
+  assert.equal(DEFAULT_CCTV_MAX_SOURCES, 4000);
+  assert.equal(DEFAULT_HOUSTON_MAX_SOURCES, 250);
+});
+
+test('isLikelyHoustonCoordinate spans the metro and rejects the rest', () => {
+  assert.equal(isLikelyHoustonCoordinate(29.7604, -95.3698), true); // Downtown
+  assert.equal(isLikelyHoustonCoordinate(29.3013, -94.7977), true); // Galveston
+  assert.equal(isLikelyHoustonCoordinate(29.9902, -95.3368), true); // IAH
+  assert.equal(isLikelyHoustonCoordinate(32.7767, -96.797), false); // Dallas
+  assert.equal(isLikelyHoustonCoordinate(30.2672, -97.7431), false); // Austin
+  assert.equal(isLikelyHoustonCoordinate(0, 0), false);
+  assert.equal(isLikelyHoustonCoordinate(NaN, -95.37), false);
+});

src/data/cctvLod.js

@@ -34,6 +34,8 @@ const PROVIDER_STATIC_REFRESH_MS = Object.freeze({
   'ontario 511': 3 * 60 * 1000,
   // TxDOT publishes roughly once a minute; 3 min matches the other highway packs.
   txdot: 3 * 60 * 1000,
+  // TranStar says snapshots update about every 3 minutes.
+  'houston transtar': 3 * 60 * 1000,
   // Digitraffic publishes a new weathercam frame on each station's
   // collectionInterval, 600 s for every station sampled; polling faster only
   // re-fetches the same JPEG.

src/data/cctvLod.test.mjs

@@ -639,6 +639,7 @@ test('staticFrameRefreshMs follows known pack cadences and bounds explicit value
   assert.equal(staticFrameRefreshMs({ provider: 'Caltrans' }), 180_000);
   assert.equal(staticFrameRefreshMs({ provider: 'Ontario 511' }), 180_000);
   assert.equal(staticFrameRefreshMs({ provider: 'TxDOT' }), 180_000);
+  assert.equal(staticFrameRefreshMs({ provider: 'Houston TranStar' }), 180_000);
   // Digitraffic publishes one weathercam frame per 600 s collection interval.
   assert.equal(staticFrameRefreshMs({ provider: 'Fintraffic' }), 600_000);
   assert.equal(

src/data/dataCredits.js

@@ -181,6 +181,13 @@ export const DATA_CREDITS = [
       ' · Incident information: ' +
       '<a href="https://inciweb.wildfire.gov/" target="_blank" rel="noopener">InciWeb</a>',
   },
+  {
+    key: 'faa-sua',
+    html:
+      'Prohibited & restricted airspace: ' +
+      '<a href="https://adds-faa.opendata.arcgis.com/" target="_blank" rel="noopener">FAA Special Use Airspace</a>' +
+      ' (prohibited and restricted zones; informational only)',
+  },
   OSM_CREDIT,
   OPENMAPTILES_CREDIT,
   {
@@ -311,6 +318,14 @@ export const DATA_CREDITS = [
       '<a href="https://kingcounty.gov/en/dept/kcit/data-information-services/gis-center/about/terms-conditions-copyrights" target="_blank" rel="noopener">KCGIS Center terms</a>. ' +
       'Partner-city cameras hosted on the county image handler (e.g. Newcastle) name their owner in the CCTV panel.',
   },
+  {
+    key: 'houston-cctv',
+    html:
+      'CCTV cameras &amp; frames (Houston, when enabled): ' +
+      '<a href="https://traffic.houstontranstar.org/cctv/transtar/" target="_blank" rel="noopener">Houston TranStar</a>. ' +
+      "Copying, distributing or framing its images needs TxDOT's written permission under the " +
+      '<a href="https://traffic.houstontranstar.org/disclaimer.aspx" target="_blank" rel="noopener">TranStar Content Usage terms</a>',
+  },
   {
     key: 'hk-cctv',
     html:
@@ -572,6 +587,15 @@ export const WOF_CREDIT = {
     '<a href="https://github.com/bilawalsidhu/gods-eye-view/blob/main/src/data/local_data/wof_neighborhoods/ATTRIBUTION.md" target="_blank" rel="noopener">sources and licences</a>)',
 };
 
+/** Registered when a voice place search (a configured Overpass) first shows places. */
+export const OSM_PLACES_CREDIT = {
+  key: 'osm-places',
+  html:
+    'Places found by voice: ' +
+    '<a href="https://www.openstreetmap.org/copyright" target="_blank" rel="noopener">© OpenStreetMap contributors</a> ' +
+    '(ODbL 1.0)',
+};
+
 /**
  * Per-feed transit credit, registered the first time that feed's vehicles
  * render (see `src/data/transitFeeds.js` for the license of each).

src/data/dataCredits.test.mjs

@@ -129,6 +129,18 @@ test('the NYC camera credit carries NYC DOT’s requested disclaimer', () => {
   assert.match(credit.html, /observe posted signage/);
 });
 
+test("the Houston camera credit names TranStar's terms and the permission they require", () => {
+  const credit = DATA_CREDITS.find((entry) => entry.key === 'houston-cctv');
+  assert.ok(credit, 'Houston TranStar camera frames must be credited');
+  assert.match(credit.html, /\(Houston, when enabled\)/);
+  assert.ok(
+    credit.html.includes(
+      'href="https://traffic.houstontranstar.org/disclaimer.aspx"',
+    ),
+  );
+  assert.match(credit.html, /TxDOT's written permission/);
+});
+
 test('every Street Level imagery source is in the attribution lightbox', () => {
   for (const key of [
     'mapillary',

src/data/detection.js

@@ -53,6 +53,12 @@ import {
   isCyberContactSonarActive as isCyberSonarActive,
   isCyberContactThemeActive as isCyberMapThemeActive,
 } from '../cyberSonar.js';
+import {
+  awarenessEchoActive,
+  awarenessEchoBracket,
+  awarenessEchoColor,
+  getAwarenessEchoField,
+} from '../awarenessEcho.js';
 
 /**
  * @module detection
@@ -103,6 +109,8 @@ const SPARSE_ZONE_FRACTION = 0.5;
 const LABEL_SOLVE_INTERVAL_MS = 125;
 /** Alpha bands retain bracket batching while approximating a continuous radial fade. */
 const BRACKET_ALPHA_STEPS = 4;
+/** Finer bands for Global Context echo brackets, whose fade is animated. */
+const ECHO_ALPHA_STEPS = 8;
 /** Stable per-layer candidate safety cap; independent of density and camera bearing. */
 const LAYER_CANDIDATE_CAP = 2600;
 const LAYER_WEIGHTS = Object.freeze({
@@ -1335,6 +1343,11 @@ function _drawOverlay(frame) {
   const tiers = _theme.tiers || null;
   const colorFor = (key) => (tiers && tiers[key]) || _theme.line;
   const bracketPaths = new Map();
+  // Global Context sonar echoes: a second bracket, banded by strength, around
+  // each flight or vessel a pulse front has just crossed.
+  // Resting pulses light nothing, so the per-contact echo work is skipped.
+  const echoField = awarenessEchoActive(now) ? getAwarenessEchoField() : null;
+  const echoPaths = echoField ? new Array(ECHO_ALPHA_STEPS + 1) : null;
   const pathFor = (map, color, alpha) => {
     const band = Math.max(
       1,
@@ -1437,6 +1450,24 @@ function _drawOverlay(frame) {
         halfH,
       );
       visibleCount++;
+      if (echoPaths) {
+        // Starts on the contact's bracket and spreads outward as it fades.
+        const echo = awarenessEchoBracket(
+          obj._layerId,
+          obj.position,
+          now,
+          bracketAlpha,
+          ECHO_ALPHA_STEPS,
+        );
+        if (echo)
+          appendCornerBracket(
+            (echoPaths[echo.band] ??= new Path2D()),
+            sx,
+            sy,
+            halfW + echo.spreadPx,
+            halfH + echo.spreadPx,
+          );
+      }
       if (obj.type === 'AIR')
         aircraftBracketSectors[detectionHorizontalSector(sx, width)]++;
       if (bracketAlpha >= 1) bracketOpacityCounts.full++;
@@ -1576,6 +1607,20 @@ function _drawOverlay(frame) {
       _ctx.stroke(entry.path);
     }
   }
+  if (echoPaths) {
+    _ctx.lineWidth = echoField.echo.lineWidth;
+    _ctx.strokeStyle = awarenessEchoColor(
+      _theme.line,
+      _theme === THEME_MAP._default,
+    );
+    for (let band = 1; band <= ECHO_ALPHA_STEPS; band++) {
+      if (!echoPaths[band]) continue;
+      _ctx.globalAlpha =
+        fade * (band / ECHO_ALPHA_STEPS) * bracketPresentationOpacity;
+      _ctx.stroke(echoPaths[band]);
+    }
+    _ctx.lineWidth = bracketWidth;
+  }
 
   const renderEntries = _labelArbiter.renderEntries(candidateMap, now);
   const fadingCount = countFadingRenderEntries(renderEntries);

src/data/detectionAwarenessEcho.test.mjs

@@ -0,0 +1,107 @@
+// src/data/detectionAwarenessEcho.test.mjs — Global Context sonar echoes pulse
+// a contact's own detection bracket: a second bracket that starts on it and
+// spreads outward as it fades, in the detection style's own colour.
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import * as Cesium from 'cesium';
+import {
+  awarenessEchoBracket,
+  awarenessEchoColor,
+  clearAwarenessEchoField,
+  setAwarenessEchoField,
+} from '../awarenessEcho.js';
+import { DETECTION_THEME_MAP } from '../overlays/worldOverlayTokens.js';
+
+const STEPS = 8;
+const pulse = { count: 3, periodMs: 9000, startFraction: 0.02 };
+const echo = {
+  fadeMs: 1400,
+  layerIds: ['flights', 'military', 'ais-live-vessels'],
+  spreadPx: 8,
+  color: 'rgb(98, 181, 255)',
+};
+const center = Cesium.Cartesian3.fromDegrees(3, 27, 0);
+const field = { center, radiusM: 250_000, pulse, echo };
+
+/** The moment pulse 0's front reaches the ground under `position`. */
+function arrivalAt(position) {
+  const ground = Cesium.Ellipsoid.WGS84.scaleToGeodeticSurface(position);
+  const d = Cesium.Cartesian3.distance(center, ground);
+  return (
+    ((d / 250_000 - pulse.startFraction) / (1 - pulse.startFraction)) *
+      pulse.periodMs +
+    pulse.periodMs * 3
+  );
+}
+
+test('the echo bracket pulses outward from the contact bracket and fades', (t) => {
+  t.after(clearAwarenessEchoField);
+  setAwarenessEchoField(field);
+  const position = Cesium.Cartesian3.fromDegrees(3.5, 27, 10_000);
+  const arrival = arrivalAt(position);
+  const at = (nowMs, bracketAlpha = 1) =>
+    awarenessEchoBracket('flights', position, nowMs, bracketAlpha, STEPS);
+
+  // The moment the front arrives: on the bracket, strongest band.
+  const fresh = at(arrival);
+  assert.ok(fresh);
+  assert.ok(Math.abs(fresh.spreadPx) < 0.01, `${fresh.spreadPx}`);
+  assert.equal(fresh.band, STEPS);
+  // Half way through the fade: dimmer and spread outward, but not past
+  // the field's spread.
+  const half = at(arrival + echo.fadeMs / 2);
+  assert.ok(half.spreadPx > echo.spreadPx * 0.5);
+  assert.ok(half.spreadPx < echo.spreadPx);
+  assert.ok(half.band < STEPS && half.band >= 1);
+  // The bracket's own dimming (keyhole fade, Cyber sonar sweep) carries
+  // over, and the echo is never drawn brighter than its bracket: a bracket
+  // too dim for even one band draws no echo.
+  assert.equal(at(arrival, 0.25).band, 2);
+  assert.equal(at(arrival, 0.05), null);
+  for (let alpha = 0.05; alpha <= 1; alpha += 0.05) {
+    const echoed = at(arrival + echo.fadeMs / 3, alpha);
+    if (echoed)
+      assert.ok(
+        echoed.band / STEPS <= alpha + 0.5 / STEPS + 1e-9,
+        `band ${echoed.band} for a bracket at ${alpha}`,
+      );
+  }
+  // Faded out, or between fronts: no echo bracket.
+  assert.equal(at(arrival + echo.fadeMs + 5), null);
+});
+
+test('no echo field, or a layer that does not echo, draws nothing extra', (t) => {
+  t.after(clearAwarenessEchoField);
+  const position = Cesium.Cartesian3.fromDegrees(3.01, 27, 0);
+  clearAwarenessEchoField();
+  for (let now = 0; now < pulse.periodMs; now += 25)
+    assert.equal(
+      awarenessEchoBracket('flights', position, now, 1, STEPS),
+      null,
+    );
+  setAwarenessEchoField(field);
+  for (let now = 0; now < pulse.periodMs; now += 25)
+    for (const layerId of ['cctv', 'satellites', 'traffic'])
+      assert.equal(
+        awarenessEchoBracket(layerId, position, now, 1, STEPS),
+        null,
+      );
+});
+
+test('echoes take the detection style colour except on the default style', (t) => {
+  t.after(clearAwarenessEchoField);
+  assert.equal(
+    awarenessEchoColor(DETECTION_THEME_MAP._default.line, true),
+    null,
+  );
+  setAwarenessEchoField(field);
+  assert.equal(
+    awarenessEchoColor(DETECTION_THEME_MAP._default.line, true),
+    echo.color,
+  );
+  // CRT, NVG and FLIR keep their monochrome palettes.
+  for (const style of ['retro', 'surveillance', 'thermal']) {
+    const { line } = DETECTION_THEME_MAP[style];
+    assert.equal(awarenessEchoColor(line, false), line, style);
+  }
+});

src/data/detectionHost.test.mjs

@@ -24,6 +24,10 @@ import {
   setOverlayEntries,
 } from '../overlays/worldOverlay.js';
 import { DETECTION_THEME_MAP } from '../overlays/worldOverlayTokens.js';
+import {
+  clearAwarenessEchoField,
+  setAwarenessEchoField,
+} from '../awarenessEcho.js';
 import { composeLabel, resolveTier } from './detectionDraw.js';
 
 test('detection diagnostics count rendered fading rows instead of absent selected identities', () => {
@@ -50,8 +54,9 @@ class MockEvent {
 }
 
 class MockPath2D {
-  moveTo() {}
-  lineTo() {}
+  constructor() { this.points = []; }
+  moveTo(x, y) { this.points.push([x, y]); }
+  lineTo(x, y) { this.points.push([x, y]); }
   roundRect() {}
   arcTo() {}
   closePath() {}
@@ -98,7 +103,7 @@ function mockContext(target, trace) {
     // set at some point during the frame. globalAlpha rides along for the same
     // reason: the backdrop feather is an alpha, not a colour.
     fill(path) { record('fill', path, this.fillStyle, this.globalAlpha); },
-    stroke(path) { record('stroke', path, this.strokeStyle, this.lineWidth); },
+    stroke(path) { record('stroke', path, this.strokeStyle, this.lineWidth, this.globalAlpha); },
     fillRect(...args) { record('fillRect', ...args); },
     fillText(...args) { record('fillText', ...args); },
     drawImage(...args) { record('drawImage', ...args); },
@@ -627,6 +632,231 @@ test('surveillance military tier reaches the dedicated render target as shipped
   }
 });
 
+test('Global Context echo brackets reach the canvas in the detection style colour', () => {
+  const env = installEnvironment();
+  // Fronts every millisecond with a long fade, so the contact is lit on
+  // whatever frame paints; a distinctive width picks the echo stroke out.
+  const echo = {
+    layerIds: ['military'],
+    fadeMs: 60_000,
+    color: 'rgb(1, 2, 3)',
+    spreadPx: 8,
+    lineWidth: 3.25,
+  };
+  const echoStrokes = () =>
+    env.detectionCtx.calls
+      .filter(([name, , , width]) => name === 'stroke' && width === echo.lineWidth)
+      .map(([, , style]) => style);
+  try {
+    setAwarenessEchoField({
+      center: Cesium.Cartesian3.fromDegrees(0, 89, 0),
+      radiusM: 250_000,
+      pulse: { count: 1000, periodMs: 1000, startFraction: 0 },
+      echo,
+    });
+    initWorldOverlay(env.viewer);
+    initDetection(env.viewer, [militaryLayer()], () => {});
+    setMode('DENSE');
+    setDetectionStyle('normal');
+    settleFrame(env);
+    assert.ok(echoStrokes().length > 0, 'the echo bracket is painted');
+    assert.ok(echoStrokes().every((style) => style === echo.color));
+
+    // CRT, NVG and FLIR keep their own palettes.
+    for (const style of ['retro', 'surveillance', 'thermal']) {
+      env.detectionCtx.calls.length = 0;
+      setDetectionStyle(style);
+      settleFrame(env);
+      const strokes = echoStrokes();
+      assert.ok(strokes.length > 0, style);
+      assert.ok(
+        strokes.every((stroke) => stroke === DETECTION_THEME_MAP[style].line),
+        `${style} echoes take the style line colour, got ${strokes}`,
+      );
+    }
+
+  } finally {
+    clearAwarenessEchoField();
+    env.cleanup();
+  }
+});
+
+test('a Global Context echo bracket is drawn outside its contact bracket and dimmer than it', () => {
+  const env = installEnvironment();
+  const echo = {
+    layerIds: ['military'],
+    fadeMs: 60_000,
+    color: 'rgb(1, 2, 3)',
+    spreadPx: 8,
+    lineWidth: 3.25,
+  };
+  // Fronts every millisecond keep the echo at full strength; a level of 0.5
+  // halves it, so it sits 4 px out and draws at half the bracket's alpha.
+  try {
+    setAwarenessEchoField({
+      center: Cesium.Cartesian3.fromDegrees(0, 89, 0),
+      radiusM: 250_000,
+      pulse: { count: 1000, periodMs: 1000, startFraction: 0 },
+      echo,
+      level: () => 0.5,
+    });
+    initWorldOverlay(env.viewer);
+    initDetection(env.viewer, [militaryLayer()], () => {});
+    setMode('DENSE');
+    setDetectionStyle('normal');
+    settleFrame(env);
+    env.detectionCtx.calls.length = 0;
+    settleFrame(env);
+    const strokes = env.detectionCtx.calls.filter(([name]) => name === 'stroke');
+    const echoStroke = strokes.find(([, , style, width]) => style === echo.color && width === echo.lineWidth);
+    assert.ok(echoStroke, 'the echo bracket is painted');
+    const bracketStroke = strokes.find(([, path, style, width]) =>
+      path instanceof MockPath2D && path.points.length && width !== echo.lineWidth && style !== echo.color);
+    assert.ok(bracketStroke, 'the contact bracket is painted');
+    const extent = (path) => {
+      const xs = path.points.map(([x]) => x);
+      const ys = path.points.map(([, y]) => y);
+      return { halfW: (Math.max(...xs) - Math.min(...xs)) / 2, halfH: (Math.max(...ys) - Math.min(...ys)) / 2 };
+    };
+    const echoBox = extent(echoStroke[1]);
+    const bracketBox = extent(bracketStroke[1]);
+    assert.ok(Math.abs(echoBox.halfW - bracketBox.halfW - echo.spreadPx / 2) < 1e-3,
+      `echo ${echoBox.halfW} vs bracket ${bracketBox.halfW}`);
+    assert.ok(Math.abs(echoBox.halfH - bracketBox.halfH - echo.spreadPx / 2) < 1e-3);
+    const echoAlpha = echoStroke[4];
+    const bracketAlpha = bracketStroke[4];
+    assert.ok(echoAlpha > 0 && echoAlpha < bracketAlpha, `${echoAlpha} vs ${bracketAlpha}`);
+    assert.ok(Math.abs(echoAlpha - bracketAlpha / 2) < 1e-6, `${echoAlpha} vs ${bracketAlpha}`);
+  } finally {
+    clearAwarenessEchoField();
+    env.cleanup();
+  }
+});
+
+test('under the Cyber sonar sweep an echo is never brighter than its own bracket', () => {
+  const env = installEnvironment();
+  // The cyber theme with its HUD open turns the contact sonar on; its sweep
+  // dims brackets it is not passing over.
+  env.document.documentElement = {
+    // The lowest sweep floor, so dimmed brackets drop a whole alpha band.
+    dataset: { uiTheme: 'cyber', cyberSonarOpacity: '35' },
+    style: { setProperty() {}, removeProperty() {} },
+  };
+  const hud = env.document.createElement('div');
+  hud.id = 'intel-hud';
+  hud.classList = { contains: (name) => name === 'active' };
+  env.document.body.appendChild(hud);
+  const echo = {
+    layerIds: ['military'],
+    fadeMs: 60_000,
+    color: 'rgb(1, 2, 3)',
+    spreadPx: 8,
+    lineWidth: 3.25,
+  };
+  const contact = {
+    id: 'military',
+    getDetectableObjects: () => [{
+      position: new Cesium.Cartesian3(0.5, 0.3, 6_356_752),
+      sourceId: 'sonar-pin',
+      id: 'SONAR',
+      metric: 'FL300',
+      type: 'AIR',
+      tier: 'military',
+    }],
+  };
+  try {
+    setAwarenessEchoField({
+      center: Cesium.Cartesian3.fromDegrees(0, 89, 0),
+      radiusM: 250_000,
+      pulse: { count: 1000, periodMs: 1000, startFraction: 0 },
+      echo,
+      level: () => 1,
+    });
+    initWorldOverlay(env.viewer);
+    initDetection(env.viewer, [contact], () => {});
+    setMode('DENSE');
+    setDetectionStyle('normal');
+    settleFrame(env);
+    let dimmed = 0;
+    let compared = 0;
+    for (let frame = 0; frame < 40; frame++) {
+      env.detectionCtx.calls.length = 0;
+      settleFrame(env);
+      const strokes = env.detectionCtx.calls.filter(([name]) => name === 'stroke');
+      const echoStroke = strokes.find(([, , style, width]) => style === echo.color && width === echo.lineWidth);
+      const bracketStroke = strokes.find(([, path, style, width]) =>
+        path instanceof MockPath2D && path.points.length && width !== echo.lineWidth && style !== echo.color);
+      if (!bracketStroke) continue;
+      const bracketAlpha = bracketStroke[4];
+      if (bracketAlpha < 0.99) dimmed++;
+      if (!echoStroke) continue;
+      compared++;
+      assert.ok(
+        echoStroke[4] <= bracketAlpha + 1e-9,
+        `echo ${echoStroke[4]} over bracket ${bracketAlpha} on frame ${frame}`,
+      );
+    }
+    assert.ok(dimmed > 0, 'the sweep dimmed the bracket on some frame');
+    assert.ok(compared > 0, 'an echo was painted');
+  } finally {
+    clearAwarenessEchoField();
+    env.cleanup();
+  }
+});
+
+test('resting Global Context pulses skip echo work for the whole frame, not per contact', () => {
+  const env = installEnvironment();
+  // Six echo-eligible flights on screen; the identity camera maps x/y
+  // straight to device coordinates.
+  const flights = Array.from({ length: 6 }, (_, index) => ({
+    position: new Cesium.Cartesian3(-0.5 + index * 0.2, 0, 6_356_752),
+    sourceId: `flight-${index}`,
+    id: `ECHO${index}`,
+    metric: `FL${300 + index}`,
+    type: 'AIR',
+  }));
+  const layer = { id: 'flights', getDetectableObjects: () => flights };
+  let levelCalls = 0;
+  try {
+    setAwarenessEchoField({
+      center: Cesium.Cartesian3.fromDegrees(0, 89, 0),
+      radiusM: 250_000,
+      pulse: { count: 1000, periodMs: 1000, startFraction: 0 },
+      echo: {
+        layerIds: ['flights'],
+        fadeMs: 60_000,
+        color: 'rgb(1, 2, 3)',
+        spreadPx: 8,
+        lineWidth: 3.25,
+      },
+      level: () => {
+        levelCalls++;
+        return 0;
+      },
+    });
+    initWorldOverlay(env.viewer);
+    initDetection(env.viewer, [layer], () => {});
+    setMode('DENSE');
+    settleFrame(env);
+    levelCalls = 0;
+    settleFrame(env);
+    const painted = getDetectionDiagnostics().visibleCount;
+    assert.equal(painted, flights.length, 'every flight is on screen');
+    // One check per painted frame, however many contacts are on screen.
+    assert.ok(levelCalls >= 1, 'the frame asks whether echoes are live');
+    assert.ok(levelCalls < painted, `${levelCalls} level checks for ${painted} contacts`);
+    assert.ok(
+      !env.detectionCtx.calls.some(
+        ([name, , style]) => name === 'stroke' && style === 'rgb(1, 2, 3)',
+      ),
+      'no echoes while the pulses rest',
+    );
+  } finally {
+    clearAwarenessEchoField();
+    env.cleanup();
+  }
+});
+
 test('pathological detection paint holds alternate frames without freezing shared lanes', () => {
   // Opts into the telemetry banner: the held-frame assertions count banner paints.
   const env = installEnvironment({ search: '?detectDebug=1' });

src/data/droneAirspaceProxy.test.mjs

@@ -0,0 +1,292 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { droneAirspaceProxy } from '../../server/providers/droneAirspace.js';
+
+const feature = (id = 310, type = 'P') => ({
+  properties: {
+    NAME: `${type}-${id}`,
+    TYPE_CODE: type,
+    OBJECTID: id,
+    UPPER_DESC: 'TNI',
+  },
+  geometry: {
+    type: 'Polygon',
+    coordinates: [
+      [
+        [-77, 38],
+        [-76, 38],
+        [-76, 39],
+        [-77, 38],
+      ],
+    ],
+  },
+});
+
+function install(options = {}, hook = 'configureServer') {
+  let handler;
+  const plugin = droneAirspaceProxy(options);
+  assert.equal(typeof plugin.configureServer, 'function');
+  assert.equal(typeof plugin.configurePreviewServer, 'function');
+  plugin[hook]({
+    middlewares: {
+      use(path, callback) {
+        assert.equal(path, '/api/drone-airspace');
+        handler = callback;
+      },
+    },
+  });
+  return async (url = '/', method = 'GET', peer = 'local', headers = {}) => {
+    const res = {
+      headers: {},
+      writeHead(status, headers) {
+        this.status = status;
+        this.headers = headers;
+      },
+      setHeader(name, value) {
+        this.headers[name] = value;
+      },
+      end(body) {
+        this.status ??= this.statusCode;
+        this.body = JSON.parse(body);
+      },
+    };
+    await handler(
+      { url, method, headers, socket: { remoteAddress: peer } },
+      res,
+    );
+    return res;
+  };
+}
+
+for (const hook of ['configureServer', 'configurePreviewServer']) {
+  test(`${hook}: paging follows offsets and normalizes the combined snapshot`, async () => {
+    const calls = [];
+    const request = install(
+      {
+        now: () => 1234,
+        fetchImpl: async (url, options) => {
+          calls.push(new URL(url));
+          assert.ok(options.signal instanceof AbortSignal);
+          assert.equal(options.redirect, 'error');
+          return Response.json({
+            features: [feature(calls.length)],
+            exceededTransferLimit: calls.length < 3,
+          });
+        },
+      },
+      hook,
+    );
+    const res = await request('/?url=https://invalid.example&resultOffset=999');
+    assert.equal(res.status, 200);
+    assert.equal(res.body.fetchedAt, 1234);
+    assert.equal(res.body.rows.length, 3);
+    assert.equal(calls.length, 3);
+    assert.equal(calls[0].searchParams.get('where'), "TYPE_CODE IN ('P','R')");
+    assert.equal(calls[0].searchParams.get('f'), 'geojson');
+    assert.equal(calls[0].searchParams.has('resultOffset'), false);
+    assert.equal(calls[1].searchParams.get('resultOffset'), '1');
+  });
+}
+
+/**
+ * Serve one good snapshot, then let the upstream answer `bad` after the TTL:
+ * the bad answer must not replace it, so the client gets the last good rows
+ * marked stale, and a cold proxy answers 502 rather than caching the bad one.
+ */
+async function assertRejectedSnapshot(bad) {
+  let now = 1000;
+  let broken = false;
+  let calls = 0;
+  const request = install({
+    now: () => now,
+    fetchImpl: async () => {
+      calls += 1;
+      return broken ? bad(calls) : Response.json({ features: [feature(7)] });
+    },
+  });
+  const first = await request();
+  assert.equal(first.status, 200);
+  broken = true;
+  now += 3_600_001;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.headers['X-Data-Stale'], 'true');
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, first.body.fetchedAt);
+  assert.deepEqual(
+    stale.body.rows.map((row) => row.stableId),
+    ['7'],
+  );
+  calls = 0;
+  const cold = install({ fetchImpl: async () => bad(++calls) });
+  const res = await cold();
+  assert.equal(res.status, 502);
+  assert.equal(res.body.error, 'drone_airspace_unavailable');
+}
+
+test('an empty upstream snapshot keeps the last good one', () =>
+  assertRejectedSnapshot(() => Response.json({ features: [] })));
+
+test('a page whose every feature is invalid keeps the last good one', () =>
+  assertRejectedSnapshot(() =>
+    Response.json({
+      features: [
+        {
+          ...feature(8),
+          properties: { ...feature(8).properties, TYPE_CODE: 'W' },
+        },
+        { ...feature(9), geometry: null },
+      ],
+    }),
+  ));
+
+test('paging that exhausts its page limit still flagged keeps the last good one', () =>
+  assertRejectedSnapshot((call) =>
+    Response.json({
+      features: [feature(100 + call)],
+      exceededTransferLimit: true,
+    }),
+  ));
+
+test('a flagged page that adds no features keeps the last good one', () =>
+  assertRejectedSnapshot((call) =>
+    Response.json(
+      call % 2
+        ? { features: [feature(100 + call)], exceededTransferLimit: true }
+        : { features: [], properties: { exceededTransferLimit: true } },
+    ),
+  ));
+
+test('a cached snapshot is reused until TTL, then refreshed', async () => {
+  let now = 1000;
+  let fetches = 0;
+  const request = install({
+    now: () => now,
+    fetchImpl: async () => {
+      fetches += 1;
+      return Response.json({ features: [feature(fetches)] });
+    },
+  });
+  const first = await request();
+  now += 3_599_000;
+  const cached = await request();
+  now += 2000;
+  const refreshed = await request();
+  assert.equal(first.body.rows[0].stableId, '1');
+  assert.equal(cached.body.rows[0].stableId, '1');
+  assert.equal(refreshed.body.rows[0].stableId, '2');
+  assert.equal(fetches, 2);
+});
+
+test('a failed refresh serves the last good snapshot as stale', async () => {
+  let now = 1000;
+  let fail = false;
+  const request = install({
+    now: () => now,
+    fetchImpl: async () => {
+      if (fail) return new Response('nope', { status: 503 });
+      return Response.json({ features: [feature(7)] });
+    },
+  });
+  const first = await request();
+  fail = true;
+  now += 3_600_001;
+  const stale = await request();
+  assert.equal(first.status, 200);
+  assert.equal(stale.status, 200);
+  assert.equal(stale.headers['X-Data-Stale'], 'true');
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.rows[0].stableId, '7');
+});
+
+test('method, unknown routes and rate limits are rejected', async () => {
+  const request = install({
+    fetchImpl: async () => Response.json({ features: [feature()] }),
+  });
+  assert.equal((await request('/', 'POST')).status, 405);
+  assert.equal((await request('/nope')).status, 404);
+  const limited = install({
+    fetchImpl: async () => Response.json({ features: [feature()] }),
+  });
+  let last;
+  for (let i = 0; i < 61; i++) last = await limited('/', 'GET', '10.0.0.9');
+  assert.equal(last.status, 429);
+});
+
+test('a cold upstream failure is 502, not an empty snapshot', async () => {
+  const request = install({
+    fetchImpl: async () => new Response('nope', { status: 503 }),
+  });
+  const res = await request();
+  assert.equal(res.status, 502);
+  assert.equal(res.body.error, 'drone_airspace_unavailable');
+});
+
+test('a stale snapshot is served for at most a day, then refused', async () => {
+  let now = 1_000_000_000;
+  let up = true;
+  const request = install({
+    now: () => now,
+    fetchImpl: async () => {
+      if (!up) throw new Error('FAA unreachable');
+      return Response.json({ features: [feature(7)] });
+    },
+  });
+  const fresh = await request();
+  assert.equal(fresh.status, 200);
+  up = false;
+  now += 23 * 60 * 60 * 1000;
+  const stale = await request();
+  assert.equal(stale.status, 200);
+  assert.equal(stale.body.stale, true);
+  assert.equal(stale.body.fetchedAt, fresh.body.fetchedAt);
+  now += 2 * 60 * 60 * 1000;
+  assert.equal((await request()).status, 502, 'a day-old snapshot is refused');
+});
+
+test('a cross-site page is refused before it spends quota or reaches FAA', async () => {
+  let fetches = 0;
+  const request = install({
+    fetchImpl: async () => {
+      fetches += 1;
+      return Response.json({ features: [feature()] });
+    },
+  });
+  const host = 'localhost:5173';
+  const refused = [
+    { host, 'sec-fetch-site': 'cross-site' },
+    { host, origin: 'https://evil.example' },
+    { host, origin: 'https://evil.example', 'sec-fetch-site': 'cross-site' },
+    { host, 'x-forwarded-for': '203.0.113.9', 'sec-fetch-site': 'cross-site' },
+  ];
+  // More refusals than the 60/min per-client quota, all from one peer.
+  for (let i = 0; i < 64; i++) {
+    const headers = refused[i % refused.length];
+    const res = await request('/', 'GET', '10.0.0.5', headers);
+    assert.equal(res.status, 403, JSON.stringify(headers));
+  }
+  assert.equal(fetches, 0, 'refusals cost no upstream call');
+  const app = await request('/', 'GET', '10.0.0.5', {
+    host,
+    origin: `http://${host}`,
+    'sec-fetch-site': 'same-origin',
+  });
+  assert.equal(app.status, 200, 'the app keeps its full quota');
+  assert.equal(fetches, 1);
+});
+
+test('the app served behind a reverse proxy still gets the zones', async () => {
+  const request = install({
+    fetchImpl: async () => Response.json({ features: [feature()] }),
+  });
+  const host = 'gev.example.com';
+  const res = await request('/', 'GET', '127.0.0.1', {
+    host,
+    origin: `https://${host}`,
+    'sec-fetch-site': 'same-origin',
+    'x-forwarded-for': '203.0.113.9',
+    'x-forwarded-proto': 'https',
+  });
+  assert.equal(res.status, 200);
+  assert.equal(res.body.rows.length, 1);
+});

src/data/firmsCards.test.mjs

@@ -45,7 +45,7 @@ test('buildFireCard: title carries FRP, detail carries conf/age/satellite', () =
   assert.equal(card.details.length, 1);
   assert.equal(card.details[0], 'high · 2h · N20');
   assert.equal(card.selected, false);
-  assert.equal(card.accent, accentForSeverity('red'), 'FRP 1520 is red-hot');
+  assert.equal(card.accent, accentForSeverity('white-hot'), 'FRP 1520 is white-hot');
   assert.deepEqual(card.position, { x: 1, y: 2, z: 3 }, 'uses the candidate position untouched');
 });
 
@@ -69,11 +69,27 @@ test('buildFireCard: power that rounds to 10 MW drops the decimal', () => {
   assert.equal(selected.title, 'FIRE · 10 MW');
 });
 
-test('buildFireCard: SNPP satellite code renders as SNPP, weak fire is not red', () => {
+test('buildFireCard: SNPP satellite code renders as SNPP, weak fire is an ember', () => {
   const card = buildFireCard({ fire: fire({ satellite: 'N', frp: 0.8, confidence: 0.3 }), position: {} }, NOW);
   assert.match(card.details[0], /SNPP$/);
   assert.equal(card.title, '▲ 0.8 MW');
-  assert.notEqual(card.accent, accentForSeverity('red'));
+  assert.equal(card.accent, accentForSeverity('ember'));
+});
+
+test('buildFireCard: accent steps through the FRP ramp at 5 · 20 · 50 · 100 · 300 MW', () => {
+  const accentAt = (frp) =>
+    buildFireCard({ fire: fire({ frp }), position: {} }, NOW).accent;
+  assert.equal(accentAt(4.9), accentForSeverity('ember'));
+  assert.equal(accentAt(5), accentForSeverity('red'));
+  assert.equal(accentAt(20), accentForSeverity('flame'));
+  assert.equal(accentAt(50), accentForSeverity('orange'));
+  assert.equal(accentAt(100), accentForSeverity('gold'));
+  assert.equal(accentAt(300), accentForSeverity('white-hot'));
+  // Confidence never moves the color: a low-confidence 864 MW fire stays red.
+  assert.equal(
+    buildFireCard({ fire: fire({ frp: 864, confidence: 0.3 }), position: {} }, NOW).accent,
+    accentForSeverity('white-hot'),
+  );
 });
 
 test('buildSelectedFireCard: full detail card with coords, selected flag, no fade', () => {
@@ -93,12 +109,12 @@ test('buildCellCard: plural noun, max FRP and newest age, accent passthrough', (
   const candidate = {
     cell: { count: 14, maxFrp: 210.4, newestAcqMs: NOW - 3 * H, night: 2 },
     position: { x: 0, y: 0, z: 0 },
-    accent: accentForSeverity('orange'),
+    accent: accentForSeverity('gold'),
   };
   const card = buildCellCard(candidate, NOW);
   assert.equal(card.title, '14 FIRES');
   assert.equal(card.details[0], 'max 210 MW · new 3h');
-  assert.equal(card.accent, accentForSeverity('orange'));
+  assert.equal(card.accent, accentForSeverity('gold'));
 });
 
 test('buildCellCard: the count picks the plural form of the language', () => {
@@ -150,7 +166,7 @@ test('buildCellCard: singular noun and missing-age omission', () => {
   const card = buildCellCard(candidate, NOW);
   assert.equal(card.title, '1 FIRE');
   assert.equal(card.details[0], 'max 9.9 MW');
-  assert.equal(card.accent, accentForSeverity('yellow'), 'missing accent defaults to yellow');
+  assert.equal(card.accent, accentForSeverity('ember'), 'missing accent defaults to the weakest stop');
 });
 
 test('FIRMS host policy keeps ambient cards bounded and selected cards protected', () => {

src/data/firmsHeatRaster.js

@@ -0,0 +1,209 @@
+/**
+ * Snap Map–style heat raster for the Active Fires far-zoom bands: detections
+ * are linearly binned on an equirectangular grid (row 0 = north, column
+ * 0 = 180°W), blurred, normalized on a log scale and mapped through
+ * HEAT_PALETTE. Pure: no Cesium, no DOM, so the whole pipeline is unit-tested
+ * in node.
+ */
+
+/** Below this normalized heat nothing is painted: empty land stays empty. */
+export const HEAT_FLOOR = 0.03;
+
+/**
+ * The FRP marker ramp as a continuous glow, from a red edge through orange
+ * and gold to a pale white-hot core. The edge is a bright red, not the
+ * markers' dark ember, and starts more than half opaque: most of the world
+ * sits low on a scale set by the hottest regions, and a dark translucent red
+ * vanishes into forest and savanna imagery.
+ */
+export const HEAT_PALETTE = Object.freeze([
+  { at: 0.0, rgb: [232, 58, 30], alpha: 0 },
+  { at: 0.08, rgb: [232, 58, 30], alpha: 0.58 },
+  { at: 0.25, rgb: [242, 86, 34], alpha: 0.7 },
+  { at: 0.45, rgb: [248, 122, 40], alpha: 0.76 },
+  { at: 0.65, rgb: [252, 166, 52], alpha: 0.82 },
+  { at: 0.82, rgb: [254, 208, 92], alpha: 0.87 },
+  { at: 1.0, rgb: [255, 245, 190], alpha: 0.92 },
+]);
+
+export function heatColorAt(t) {
+  if (!(t > HEAT_FLOOR)) return [0, 0, 0, 0];
+  const v = Math.min(1, t);
+  let i = 1;
+  while (i < HEAT_PALETTE.length - 1 && HEAT_PALETTE[i].at < v) i += 1;
+  const a = HEAT_PALETTE[i - 1];
+  const b = HEAT_PALETTE[i];
+  const k = (v - a.at) / (b.at - a.at || 1);
+  const mix = (p, q) => Math.round(p + (q - p) * k);
+  return [
+    mix(a.rgb[0], b.rgb[0]),
+    mix(a.rgb[1], b.rgb[1]),
+    mix(a.rgb[2], b.rgb[2]),
+    Math.round((a.alpha + (b.alpha - a.alpha) * k) * 255),
+  ];
+}
+
+/** Weight of a detection with no or zero FRP, in megawatts. */
+export const HEAT_MIN_WEIGHT_MW = 0.5;
+
+/**
+ * Heat is radiated power, not a head count: each detection adds its FRP in
+ * megawatts. Weak fires carry little power, so raising the minimum-FRP slider
+ * removes most detections without dimming the areas where strong fires burn
+ * (a count-based heat collapsed there and the hot spots faded).
+ */
+const defaultWeight = (fire) =>
+  Math.max(HEAT_MIN_WEIGHT_MW, Number(fire.frp) || 0);
+
+/**
+ * Linear binning (Wand 1994): each detection's weight is shared between the
+ * four pixel centres around it in proportion to closeness, instead of
+ * dropping whole into one pixel. Spots then sit at the true position rather
+ * than snapping by up to half a pixel (~10 km), and a lone weak fire blurs
+ * into a round spot instead of a square or a plus sign. Longitude wraps;
+ * rows beyond the poles fold back onto the edge row.
+ */
+export function binFires(fires, { width, height, weight = defaultWeight }) {
+  const grid = new Float32Array(width * height);
+  const row = (y) => Math.min(height - 1, Math.max(0, y)) * width;
+  const col = (x) => ((x % width) + width) % width;
+  for (const fire of fires) {
+    if (!Number.isFinite(fire.lat) || !Number.isFinite(fire.lon)) continue;
+    const fx = ((fire.lon + 180) / 360) * width - 0.5;
+    const fy = ((90 - fire.lat) / 180) * height - 0.5;
+    const x0 = Math.floor(fx);
+    const y0 = Math.floor(fy);
+    const tx = fx - x0;
+    const ty = fy - y0;
+    const w = weight(fire);
+    const top = row(y0);
+    const bottom = row(y0 + 1);
+    const left = col(x0);
+    const right = col(x0 + 1);
+    grid[top + left] += w * (1 - tx) * (1 - ty);
+    grid[top + right] += w * tx * (1 - ty);
+    grid[bottom + left] += w * (1 - tx) * ty;
+    grid[bottom + right] += w * tx * ty;
+  }
+  return grid;
+}
+
+function kernel(sigma) {
+  const radius = Math.max(1, Math.ceil(sigma * 3));
+  const k = new Float32Array(radius * 2 + 1);
+  let sum = 0;
+  for (let i = -radius; i <= radius; i++) {
+    k[i + radius] = Math.exp(-(i * i) / (2 * sigma * sigma));
+    sum += k[i + radius];
+  }
+  for (let i = 0; i < k.length; i++) k[i] /= sum;
+  return { k, radius };
+}
+
+export function blurGaussian(grid, width, height, sigma) {
+  const { k, radius } = kernel(sigma);
+  const tmp = new Float32Array(grid.length);
+  const out = new Float32Array(grid.length);
+  for (let y = 0; y < height; y++) {
+    const row = y * width;
+    for (let x = 0; x < width; x++) {
+      const v = grid[row + x];
+      if (v === 0) continue;
+      for (let i = -radius; i <= radius; i++) {
+        const xx = (((x + i) % width) + width) % width; // longitude wraps
+        tmp[row + xx] += v * k[i + radius];
+      }
+    }
+  }
+  for (let y = 0; y < height; y++) {
+    for (let x = 0; x < width; x++) {
+      const v = tmp[y * width + x];
+      if (v === 0) continue;
+      for (let i = -radius; i <= radius; i++) {
+        const yy = Math.min(height - 1, Math.max(0, y + i)); // poles clamp
+        out[yy * width + x] += v * k[i + radius];
+      }
+    }
+  }
+  return out;
+}
+
+/** Bins of the log-density histogram used to find the reference quantile. */
+const QUANTILE_BINS = 4096;
+
+/**
+ * The p-quantile of the non-zero values, from a histogram of log1p(value):
+ * one linear pass instead of sorting ~350k burning pixels (a sort cost
+ * 200 ms+ and dominated the build). Bin width on the log axis is
+ * max/4096, far finer than the 256-step palette it feeds.
+ */
+function percentileOfNonZero(values, p) {
+  let count = 0;
+  let max = 0;
+  for (let i = 0; i < values.length; i++) {
+    const v = values[i];
+    if (v > 0) {
+      count += 1;
+      if (v > max) max = v;
+    }
+  }
+  if (!count) return 0;
+  const logMax = Math.log1p(max);
+  const bins = new Uint32Array(QUANTILE_BINS);
+  const toBin = (QUANTILE_BINS - 1) / logMax;
+  for (let i = 0; i < values.length; i++) {
+    const v = values[i];
+    if (v > 0) bins[Math.floor(Math.log1p(v) * toBin)] += 1;
+  }
+  const target = Math.floor(p * (count - 1));
+  let seen = 0;
+  for (let b = 0; b < QUANTILE_BINS; b++) {
+    seen += bins[b];
+    if (seen > target) return Math.expm1((b + 1) / toBin);
+  }
+  return max;
+}
+
+/** HEAT_PALETTE sampled at 256 steps, so the per-pixel walk is one lookup. */
+const LUT_STEPS = 256;
+let paletteLut = null;
+function heatLut() {
+  if (!paletteLut) {
+    paletteLut = new Uint8ClampedArray(LUT_STEPS * 4);
+    for (let i = 0; i < LUT_STEPS; i++) {
+      paletteLut.set(heatColorAt(i / (LUT_STEPS - 1)), i * 4);
+    }
+  }
+  return paletteLut;
+}
+
+export function buildHeatRaster(
+  fires,
+  { width, height, sigmaPx, percentile = 0.995 },
+) {
+  const density = blurGaussian(
+    binFires(fires, { width, height }),
+    width,
+    height,
+    sigmaPx,
+  );
+  const reference = percentileOfNonZero(density, percentile);
+  const rgba = new Uint8ClampedArray(width * height * 4);
+  if (reference > 0) {
+    const lut = heatLut();
+    const scale = (LUT_STEPS - 1) / Math.log1p(reference);
+    for (let i = 0; i < density.length; i++) {
+      const d = density[i];
+      if (d <= 0) continue;
+      const step = Math.min(LUT_STEPS - 1, Math.round(Math.log1p(d) * scale));
+      const l = step * 4;
+      if (lut[l + 3] === 0) continue;
+      const o = i * 4;
+      rgba[o] = lut[l];
+      rgba[o + 1] = lut[l + 1];
+      rgba[o + 2] = lut[l + 2];
+      rgba[o + 3] = lut[l + 3];
+    }
+  }
+  return { width, height, rgba, reference };
+}

src/data/firmsHeatRaster.test.mjs

@@ -0,0 +1,118 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  HEAT_MIN_WEIGHT_MW,
+  HEAT_PALETTE,
+  heatColorAt,
+  binFires,
+  blurGaussian,
+  buildHeatRaster,
+} from './firmsHeatRaster.js';
+
+const fire = (lat, lon, frp = 10) => ({ lat, lon, frp });
+
+test('palette runs ember to white-hot and starts fully transparent', () => {
+  assert.equal(HEAT_PALETTE[0].at, 0);
+  assert.equal(HEAT_PALETTE.at(-1).at, 1);
+  assert.deepEqual(heatColorAt(0), [0, 0, 0, 0]);
+  assert.equal(heatColorAt(0.01)[3], 0, 'below the floor nothing is painted');
+  const low = heatColorAt(0.15);
+  const high = heatColorAt(1);
+  assert.ok(low[0] > low[1] && low[1] > low[2], 'low heat is red');
+  assert.ok(low[3] >= 0.5 * 255, 'low heat stays visible on any imagery');
+  assert.ok(high[1] > low[1] && high[2] > low[2], 'the core is paler');
+  assert.ok(high[3] > low[3], 'hotter is more opaque');
+  for (let i = 1; i <= 100; i++) {
+    const [r, , b] = heatColorAt(i / 100);
+    assert.ok(r >= b, `no cold hue at ${i}%`);
+  }
+});
+
+test('binFires puts a detection at a pixel centre wholly in that pixel', () => {
+  // 4×2 grid: pixel centres at lon −135/−45/45/135, lat ±45.
+  const grid = binFires([fire(45, -135, 1), fire(-45, 135, 1)], {
+    width: 4,
+    height: 2,
+  });
+  assert.equal(grid[0], 1, 'north-west pixel');
+  assert.equal(grid[7], 1, 'south-east pixel');
+  assert.equal(
+    grid.reduce((a, b) => a + b, 0),
+    2,
+  );
+});
+
+test('binFires shares a detection between the pixels around it', () => {
+  const between = binFires([fire(45, 0, 1)], { width: 4, height: 2 });
+  assert.equal(between[1], 0.5, 'half to the pixel west of it');
+  assert.equal(between[2], 0.5, 'half to the pixel east of it');
+  const quarter = binFires([fire(45, -112.5, 1)], { width: 4, height: 2 });
+  assert.equal(quarter[0], 0.75, 'closer centre takes more');
+  assert.equal(quarter[1], 0.25);
+  const wrapped = binFires([fire(45, 180, 1)], { width: 4, height: 2 });
+  assert.equal(wrapped[3], 0.5, 'the antimeridian wraps');
+  assert.equal(wrapped[0], 0.5);
+  const polar = binFires([fire(90, -135, 1)], { width: 4, height: 2 });
+  assert.equal(polar[0], 1, 'beyond the last row folds back onto it');
+});
+
+test('binFires weights each detection by its radiative power', () => {
+  const grid = binFires(
+    [fire(45, 45, 250), fire(45, 45, 0), fire(45, 45, Number.NaN)],
+    { width: 4, height: 2 },
+  );
+  assert.equal(grid[2], 250 + 2 * HEAT_MIN_WEIGHT_MW);
+});
+
+test('filtering out weak fires keeps a strong fire hot', () => {
+  const strong = fire(0.1, 0.1, 300);
+  const weak = Array.from({ length: 40 }, () => fire(0.1, 0.1, 2));
+  const reference = Array.from({ length: 10 }, () => fire(20.1, 20.1, 100));
+  const options = { width: 360, height: 180, sigmaPx: 2 };
+  const pixel = ((90 - 0.1) | 0) * 360 + ((0.1 + 180) | 0);
+  const red = (r) => r.rgba[pixel * 4];
+  const alpha = (r) => r.rgba[pixel * 4 + 3];
+  const unfiltered = buildHeatRaster([strong, ...weak, ...reference], options);
+  const filtered = buildHeatRaster([strong, ...reference], options);
+  assert.ok(alpha(filtered) > 0);
+  assert.ok(
+    alpha(filtered) >= alpha(unfiltered) * 0.9,
+    `alpha ${alpha(unfiltered)} -> ${alpha(filtered)}`,
+  );
+  assert.ok(
+    red(filtered) >= red(unfiltered) * 0.9,
+    `red ${red(unfiltered)} -> ${red(filtered)}`,
+  );
+});
+
+test('blurGaussian keeps mass and wraps across the antimeridian', () => {
+  const w = 16;
+  const h = 8;
+  const grid = new Float32Array(w * h);
+  grid[3 * w + 0] = 1;
+  const out = blurGaussian(grid, w, h, 1.5);
+  const sum = out.reduce((a, b) => a + b, 0);
+  assert.ok(Math.abs(sum - 1) < 1e-3, `mass ${sum}`);
+  assert.ok(out[3 * w + (w - 1)] > 0, 'spills to the east edge');
+});
+
+test('buildHeatRaster is transparent where there are no fires', () => {
+  const r = buildHeatRaster([fire(40, -120), fire(40.1, -120.1)], {
+    width: 360,
+    height: 180,
+    sigmaPx: 2,
+  });
+  assert.equal(r.rgba.length, 360 * 180 * 4);
+  const alphaAt = (lat, lon) => {
+    const x = Math.floor(((lon + 180) / 360) * 360);
+    const y = Math.floor(((90 - lat) / 180) * 180);
+    return r.rgba[(y * 360 + x) * 4 + 3];
+  };
+  assert.ok(alphaAt(40, -120) > 0, 'blob over the fires');
+  assert.equal(alphaAt(-30, 60), 0, 'empty far away');
+});
+
+test('buildHeatRaster with no fires is fully transparent', () => {
+  const r = buildHeatRaster([], { width: 8, height: 4, sigmaPx: 1 });
+  assert.ok(r.rgba.every((v) => v === 0));
+});