Merge the Transit provider fix and current main; fix the Bike Share test harness

The provider/globe identity check from #1688 moves into the shared terrain
reader, so every layer gets it; Transit shows the reader the flat provider
with observe(), since it answers a flat globe itself.

The Bike Share height test kept one array entry per event-loop turn and
spread it into Math.max, which overflowed the stack on slow CI runners. It
now keeps a running maximum.

Both found in review by kvnloo.

Co-Authored-By: Claude Fable 5.2 <[email protected]>

DATA_SOURCES.md

@@ -1,13 +1,13 @@
 # Data Sources & Attribution
 
-God's Eye View's **code** is [MIT](LICENSE)-licensed. **The MIT grant covers the source code only — it does NOT extend to third-party data or visual assets.** Every third-party source keeps its own license and terms. This file documents the live and bundled data sources. The bundled 3D models are the project's own procedural fleet models, MIT-licensed with the code ([`public/models/README.md`](public/models/README.md)).
+God's Eye View's **code** is [MIT](LICENSE)-licensed. **The MIT grant covers the source code only — it does NOT extend to third-party data or visual assets.** Every third-party source keeps its own license and terms. This file documents the live and bundled data sources; bundled 3D-model provenance is recorded in [`public/models/README.md`](public/models/README.md).
 
 How to read this:
 
 - **The non-permissive datasets are carved out, not omitted.** Some bundled data (e.g. TeleGeography, CC BY-NC-SA) isn't MIT-compatible. Rather than hide it, we **bundle it with a clear license carve-out** so the app works out of the box — but it stays under the provider's terms.
 - **If your use doesn't fit a dataset's license, remove that dataset.** Most importantly: TeleGeography is **NonCommercial** — commercial users must delete it (or license it from TeleGeography). It's one self-contained folder.
 - **Attribution is shown in-app** and listed here. Keep it intact. The required Google/Cesium credit renders on the on-globe credit line (bottom-left, `#cesium-credits`), and every per-layer credit below is registered into the expandable **"Data attribution"** lightbox on that line (`src/data/dataCredits.js` → `viewer.creditDisplay.addStaticCredit`). Both stay visible in clean-view and recording modes.
-- **The bundled 3D models are the project's own.** Every model under `public/models/` is a procedural fleet model generated by the project maintainers and covered by the repository's MIT license; [`public/models/README.md`](public/models/README.md) describes the set.
+- **Bundled model attribution lives beside the model files.** [`public/models/README.md`](public/models/README.md) records each shipped model's creator, source, license, and modification status.
 
 ---
 
@@ -31,7 +31,6 @@ How to read this:
 | **adsb.lol**                                                          | Military flights + aircraft traces                                                                                                  | ODbL 1.0                                                                                                                                                                                                                                                                                                                                              | "adsb.lol" (ODbL)                                                                                                                           |
 | **adsbdb** (`api.adsbdb.com`) | Aircraft type, model name and registration by ICAO hex for enriched flights; airline and origin/destination airports for the tracked flight's callsign | No licence or rate limit is published for the service. Its own credits: aircraft data from PlaneBase, ICAO-to-N-number conversion by Guillaume Michel, and flight route data that "is the work of David Taylor, Edinburgh and Jim Mason, Glasgow, and may not be copied, published, or incorporated into other databases without the explicit permission of David J Taylor, Edinburgh" | "adsbdb — api.adsbdb.com" (courtesy); route data credited to David Taylor, Edinburgh, and Jim Mason, Glasgow |
 | **Planespotters.net** (`api.planespotters.net/pub/photos/hex/{hex}`) | One thumbnail photo of the tracked aircraft, by ICAO hex, in the CONTEXT panel's CONTACTS view under the tracked flight's name | [Planespotters photo API terms](https://www.planespotters.net/photo/api); each photo remains the copyright of its photographer. Thumbnails may be hotlinked on the condition that the photographer is named next to the photo and the photo links to its Planespotters page with a followable link | "Photo © {photographer}" beside every photo that names one, linked to its Planespotters page; "Planespotters.net" in Data attribution |
-| **Open Vessel Photos** (`openvesselphotos.org/v1/mmsi/{mmsi}`) | One photo of the selected vessel, by MMSI, in the CONTEXT panel's CONTACTS view under the vessel's name and MMSI | Free, keyless public API ([README](https://github.com/louptheron/openvesselphotos)); each photo keeps the open licence its author chose (CC BY, CC BY-SA, CC0, or public domain), given with it in the API | "Photo: {photographer} · {licence}" beside every photo, linked to the vessel's Open Vessel Photos page; "Open Vessel Photos" in Data attribution |
 | **AISStream.io**                                                      | Live vessels (AIS)                                                                                                                  | Free, beta, no formal ToS; AIS is a public broadcast                                                                                                                                                                                                                                                                                                  | "AISStream.io" (courtesy)                                                                                                                   |
 | **CelesTrak**                                                         | Satellite TLEs (SGP4) and SATCAT records (object type, operational status, owner) that file each satellite under a class                                                                                                            | US-government-origin data, no license; citation requested                                                                                                                                                                                                                                                                                             | "CelesTrak (celestrak.org), Dr. T.S. Kelso"                                                                                                 |
 | **The Space Devs — Launch Library 2 v2.3**                            | Recent launch, payload, stage, and recovery metadata for Space Missions (30d)                                                       | [The Space Devs terms of use](https://github.com/TheSpaceDevs/Tutorials/blob/main/faqs/faq_TSD.md#terms-of-use): data may be used and shared in any form; avoid forwarding it without added value; attribution is encouraged (not mandatory). [Official API limits](https://ll.thespacedevs.com/docs/): 15 unauthenticated calls/hour; optional token | "Launch Library 2 — The Space Devs" (courtesy attribution)                                                                                  |
@@ -239,8 +238,7 @@ The optional Local ADS-B layer and the broadcast-FM receiver use radio you recei
 
 
 - **adsbdb enrichment.** `/api/adsbdb` resolves an ICAO hex to aircraft type, model name and registration, and the tracked flight's callsign to an airline and an origin/destination pair. Fan-out is deliberately small because adsbdb is a free community API that publishes no quota: at most 4 requests in flight, dispatches dripped to roughly 5/s, and each key asked for at most once per session (for the flights layer's enrichment, a lookup that failed temporarily, such as an outage, a timeout, a rate limit or an authorization refusal that may clear, may be asked again after a 60-second cool-down; an answer, found or not, and a permanent refusal such as a 404 are final; Local ADS-B lookups are asked once), with route lookups reserved for the tracked aircraft. The dev-server proxy caches each key for 24 hours in `.gev-cache/adsbdb.json`, negative answers included, so fresh entries survive server restarts. That gitignored cache remains local to the deployment and is not bundled with this repo. adsbdb publishes no general service license; its README says the route data may not be copied, published, or incorporated into other databases without the explicit permission of David J Taylor, Edinburgh. Deployers are responsible for obtaining any permission their use requires. Enrichment is best-effort and fail-silent — a flight that gets no answer keeps what the flight feed already gave it.
-- **Planespotters photos.** When you track an aircraft, the browser asks `https://api.planespotters.net/pub/photos/hex/{hex}` directly (the API answers cross-origin, so no key and no server proxy are involved) for that aircraft only, once per hex per session, through the same enrichment queue as adsbdb, with an 8-second timeout. A miss is remembered for the session; a request that failed temporarily (an outage, the timeout or a rate limit) may be asked again after a 60-second cool-down while the aircraft stays tracked, as for the flights layer's other enrichment. Either way no photo shows meanwhile. The first photo whose image is an `https://` URL on `*.plnspttrs.net`, and whose page is an `https://www.planespotters.net` URL is shown in the CONTEXT panel's CONTACTS view, under the tracked flight's name (`src/ui/views/panels/AwarenessPanel.vue`), and nowhere else; a vessel (see Open Vessel Photos below), an installation, a military aircraft or a converted TR-3B has none, and a military aircraft or TR-3B is never looked up. Anything else is dropped, so the app never shows or links outside Planespotters (`src/data/planespottersPhoto.js`, also exported as `gods-eye-view/sources/planespotters` for servers that cache the lookup). The photo follows the attribution rules: the thumbnail is hotlinked from the URL the API gives (never copied or re-hosted), the photographer's name, when the answer gives one, is visible text next to it ("Photo © {photographer}"; a photo whose answer names no one shows no credit line), and the photo and credit are a plain link to the photo's Planespotters page with `target="_blank" rel="noopener"` and never `rel="nofollow"`. If the image fails to load, the photo and its credit are hidden.
-- **Open Vessel Photos.** When you select a vessel with a nine-digit MMSI, the browser asks `https://openvesselphotos.org/v1/mmsi/{mmsi}` directly (the API is keyless and answers cross-origin, so no key and no server proxy are involved; account credentials are never sent) for that vessel only, once per MMSI per session, with an 8-second timeout. A miss (a 404 or a vessel without photos) is remembered for the session; a failed request may be asked again after five minutes. The first photo whose image is an `https://openvesselphotos.org` URL and which names a licence is shown, at the 800 px size, in the CONTEXT panel's CONTACTS view under the vessel's name and MMSI (`src/ui/views/panels/AwarenessPanel.vue`), and nowhere else (`src/data/openVesselPhoto.js`, `src/layers/vessels/photos.js`). The image is hotlinked from the URL the API gives (never copied or re-hosted); the photographer and licence are visible text next to it ("Photo: {photographer} · {licence}", or "Photo · {licence}" when the answer names no one), and the photo and credit link to the vessel's Open Vessel Photos page with `target="_blank" rel="noopener"`. If the image fails to load, the photo and its credit are hidden.
+- **Planespotters photos.** When you track an aircraft, the browser asks `https://api.planespotters.net/pub/photos/hex/{hex}` directly (the API answers cross-origin, so no key and no server proxy are involved) for that aircraft only, once per hex per session, through the same enrichment queue as adsbdb, with an 8-second timeout. A miss is remembered for the session; a request that failed temporarily (an outage, the timeout or a rate limit) may be asked again after a 60-second cool-down while the aircraft stays tracked, as for the flights layer's other enrichment. Either way no photo shows meanwhile. The first photo whose image is an `https://` URL on `*.plnspttrs.net`, and whose page is an `https://www.planespotters.net` URL is shown in the CONTEXT panel's CONTACTS view, under the tracked flight's name (`src/ui/views/panels/AwarenessPanel.vue`), and nowhere else; a vessel, an installation, a military aircraft or a converted TR-3B has none, and a military aircraft or TR-3B is never looked up. Anything else is dropped, so the app never shows or links outside Planespotters (`src/data/planespottersPhoto.js`, also exported as `gods-eye-view/sources/planespotters` for servers that cache the lookup). The photo follows the attribution rules: the thumbnail is hotlinked from the URL the API gives (never copied or re-hosted), the photographer's name, when the answer gives one, is visible text next to it ("Photo © {photographer}"; a photo whose answer names no one shows no credit line), and the photo and credit are a plain link to the photo's Planespotters page with `target="_blank" rel="noopener"` and never `rel="nofollow"`. If the image fails to load, the photo and its credit are hidden.
 - **Launch Library 2.** `/api/launches` makes a server-side rolling-30-day query against the supported v2.3 detailed launch endpoint, caches successful responses for 15 minutes in memory and on disk, and serves the last successful response during a throttle or transient outage. Anonymous access is limited to 15 calls/hour; deployments can provide `LL2_API_TOKEN` for authenticated access. The Space Devs' published terms permit using and sharing the API data in any form, ask users not to forward it without adding value, disclaim complete accuracy, and encourage—but do not require—attribution. This app keeps a courtesy credit. Payload and stage/recovery records are shown only when supplied. Failed launches expose their source status and never receive fallback orbit geometry or a live/estimated marker. LL2 supplies launch context and event timing, not continuous ascent telemetry or live orbital state.
 - **TfL JamCams.** The camera list comes from the keyless `api.tfl.gov.uk` endpoint (an optional `TFL_APP_KEY` raises its rate limit); frames come from TfL's public S3 bucket. The "Powered by TfL Open Data" attribution is required by TfL's terms and is registered in the Data attribution popover.
 - **Ontario 511 CCTV.** The camera list comes from the `511on.ca/api/v2/get/cameras` endpoint, which now requires a free developer key (`ONTARIO_511_API_KEY`: sign up at 511on.ca/my511/register, then request it while logged in at 511on.ca/developers/doc; throttled to 10 calls a minute). Without the key the pack is skipped. Frames are server-registered still images under `511on.ca/map/Cctv/`. The source is live-fetched at runtime and attributed under the Open Government Licence - Ontario. Access is governed by Ontario 511's Developer's Access Agreement (511on.ca/developers/resources): the data stays under the Open Government Licence - Ontario unless otherwise specified; key requests are reviewed case by case and ask for the intended use and any third parties that will receive the data; attribution by link to 511on.ca is encouraged, and the Ontario 511 logo may not be altered or used to imply endorsement (this app links and shows no logo); and the data is provided "as is", a disclaimer distributors should pass on, which the credit does.
@@ -688,4 +686,4 @@ NOAA density imagery with the raw GLM product.
 
 ## In-app attribution
 
-The required Google Maps / Cesium credit renders on the on-globe credit line (`#cesium-credits`, bottom-left) and must stay visible — including in clean-view and recording modes (the whole line, logo + "Google Maps" + the "Data attribution" link, stays on screen; only the GEV panels/HUD fade). The layer-specific credits (adsb.lol, adsbdb, Planespotters.net, Open Vessel Photos, TeleGeography, OSM datacenters/dams/roads, NASA FIRMS, CelesTrak, USGS, City of Austin, Fintraffic, GBFS, Radio Browser, OpenSky, AISStream) are registered into the expandable **"Data attribution"** popover on that credit line via `viewer.creditDisplay.addStaticCredit(new Cesium.Credit(html, /* showOnScreen */ false))` — see `src/data/dataCredits.js`. When you add a new data source, add its license and attribution to this file **and** append an entry to `DATA_CREDITS` in `src/data/dataCredits.js` so it surfaces in the app.
+The required Google Maps / Cesium credit renders on the on-globe credit line (`#cesium-credits`, bottom-left) and must stay visible — including in clean-view and recording modes (the whole line, logo + "Google Maps" + the "Data attribution" link, stays on screen; only the GEV panels/HUD fade). The layer-specific credits (adsb.lol, adsbdb, Planespotters.net, TeleGeography, OSM datacenters/dams/roads, NASA FIRMS, CelesTrak, USGS, City of Austin, Fintraffic, GBFS, Radio Browser, OpenSky, AISStream) are registered into the expandable **"Data attribution"** popover on that credit line via `viewer.creditDisplay.addStaticCredit(new Cesium.Credit(html, /* showOnScreen */ false))` — see `src/data/dataCredits.js`. When you add a new data source, add its license and attribution to this file **and** append an entry to `DATA_CREDITS` in `src/data/dataCredits.js` so it surfaces in the app.

LICENSE

@@ -56,6 +56,7 @@ In short: the MIT grant does not extend to any third-party data. See
 DATA_SOURCES.md for the full per-source license + attribution summary, and
 remove any dataset whose terms don't fit your use.
 
-The 3D models under public/models/ are the project's procedural fleet
-models, generated from code by the project maintainers, and are covered by
-the MIT license above like the source code. See public/models/README.md.
+The 3D models under public/models/ are also third-party works and are NOT
+licensed under MIT. They remain under their individual licenses. See
+public/models/README.md for the author, source, license, modification notice,
+and attribution covering each model file.

README.md

@@ -60,7 +60,7 @@ Start with the included data sources, then add your own. Each layer is a separat
 - **📡 Contacts:** A 250 km roster of everything near your target — step through live aircraft and drop into any cockpit.
 - **🎯 Click-to-track anything:** Camera locks on, draws a fading trail, surfaces full metadata — and a tracked fire or vessel hands you off to the nearest live camera in one click.
 - **🖊️ Voice whiteboard:** Speak annotations onto the world — real boundary polygons, marks, and routes.
-- **🛫 3D fleet:** 122 procedural models drawn life size by type — airliners, business jets, helicopters, drones, ships, buses, trams and trains — and every contact swaps from glyph to 3D model as you close in.
+- **🛫 3D hangar:** Real per-class aircraft models — 787, ATR-72, Citation, Bell 206, MQ-9 — and a tracked contact swaps from glyph to 3D model as you close in.
 - **🎨 Reskin reality:** GLSL sensor looks over the normal globe — CRT, NVG, FLIR/thermal, Noir.
 - **🟩 Detection overlay:** Screen-space bounding boxes and IDs on everything in view.
 - **🎖️ Military HUD:** Tactical heads-up display with intelligence-style telemetry.

changelog.d/1579-render-failure-notice.md

@@ -1,6 +0,0 @@
-- When the globe stops drawing after a render error or a lost WebGL context,
-  an alert dialog says so instead of leaving a frozen or black globe behind
-  working controls. Retry restarts drawing (Reload after a lost context), and
-  Reset view reopens the app without the view restored from the address bar.
-  Cesium's "Rendering has stopped" panel no longer appears in the app
-  (German, @gekh, #1579).

changelog.d/1686-cockpit-subjects.md

@@ -1,12 +0,0 @@
-- Let an application add its own Cockpit subjects through
-  `services.cockpitSubjects`. A provider supplies the subject's position,
-  heading and HUD (in the page's language, via `getLocale` and
-  `onLocaleChange` from `./i18n`); the camera can follow it without the
-  ground clamp, anchored exactly on it, and a generic HUD adds source rows, a
-  banner, a veil (off under reduced motion) and a bottom progress line. The
-  Rail and Transit layers expose read and hold APIs so a selected train or
-  vehicle can be ridden, and `./layers/rail/paths` is exported; that export
-  and the read APIs are experimental. `docs/APPLICATION.md` shows a minimal
-  provider. GEV itself registers none, and entry to the built-in aircraft,
-  satellite and vessel views is unchanged; a provider's subject takes entry
-  when it was selected after them (Denis Groshev, @ZloyS, #1686).

changelog.d/1688-transit-terrain-height-cache.md

@@ -0,0 +1,7 @@
+- Fix the page freezing for seconds at a time with Transit on over a terrain
+  globe, most visibly while zooming over a large fleet. Every reread asked the
+  terrain for the height of every trail fix of every vehicle in view; heights
+  are now kept per point, read again only while the camera moves or tiles
+  load, and read within a time budget that puts vehicle positions first.
+  Switching the terrain provider or globe starts the kept heights afresh
+  (mazy1998, review by kvnloo, #1688).

changelog.d/1689-shared-terrain-surface.md

@@ -0,0 +1,5 @@
+- Read terrain heights through one shared, cached and budgeted reader
+  (`src/services/terrainSurface.js`) in Transit, Rail, Bike Share and the local
+  data layers. Opening Data Centers no longer blocks the page for over two
+  seconds, opening Bike Share for most of a second, and Rail asks the terrain
+  about a twentieth as often (mazy1998, #1689).

changelog.d/1693-cctv-frame-no-flash.md

@@ -1,2 +0,0 @@
-- Show a new CCTV camera's frame the moment it is decoded, with no fade, so
-  switching cameras no longer lingers on an empty preview (samehkhamis, #1693).

changelog.d/1694-cctv-globe-plane-clamp.md

@@ -1,3 +0,0 @@
-- End a CCTV camera's monitor plane where its view meets the ground on globe
-  maps too, instead of a kilometre-wide plane hundreds of metres up
-  (samehkhamis, #1694).

changelog.d/1695-vessel-photos.md

@@ -1,3 +0,0 @@
-- Show a selected vessel's photo from Open Vessel Photos, credited with its
-  photographer and open licence, and its MMSI beside its name in the CONTACTS
-  view (samehkhamis, #1695).

changelog.d/1696-i18n-entry.md

@@ -1,3 +0,0 @@
-- Add an `./i18n` entry so an application with its own language menu can
-  start, follow and switch the interface language as the globe picker does
-  (samehkhamis, #1696).

changelog.d/1698-new-strings-translations.md

@@ -1,5 +0,0 @@
-- Fix the translations of the strings added since the last review (News,
-  Data Library, Wildlife Sightings, Shipwrecks, Rail, the vessel and orbital
-  cockpits) in all twelve languages: neutral side labels and counts no longer
-  break the sentence, terms follow each glossary, and Traditional Chinese
-  follows Simplified Chinese again (German, @gekh, #1698).

changelog.d/1714-fleet-models.md

@@ -1,8 +0,0 @@
-- Draw every 3D model from the project's procedural fleet set: 121 models
-  (about 2 MB, MIT like the code) chosen per vehicle by type and drawn life
-  size, replacing the eight third-party aircraft models. Flights, Military
-  Flights and Local ADS-B pick a model by ICAO type, class and emitter
-  category; Vessels, Transit and Rail now draw models too, under the same 3D
-  toggle and distances, a ship at its AIS length and beam and a tram, bus or
-  train in its mode or category colour. The whole set loads once when a layer
-  starts (samehkhamis, #1714).

changelog.d/1715-vessel-typical-length.md

@@ -1,3 +0,0 @@
-- Draw a vessel whose feed sends no length at its ship type's typical size, so
-  a cruise ship or container ship no longer shows as its type's smallest model
-  (samehkhamis, #1715).

changelog.d/1723-cctv-panel-collapse-on-disable.md

@@ -1,5 +0,0 @@
-- Collapse the CCTV panel when the layer is switched off. It stayed open with
-  an empty frame and a meta line that still described the last camera; the
-  meta line of a disabled layer now reads the catalog count. Contacts, Space
-  Missions and Clear selected data layers leave the panel as it is
-  (asturksever, #1723).

changelog.d/1729-fleet-ground-vehicles.md

@@ -1,5 +0,0 @@
-- Draw airport ground vehicles and ground stations as what they are instead of
-  the generic plane. An airport vehicle (type `ZVEH`) is a fire truck, pushback
-  tug, van or car by its callsign, a ground station (`GRND`) is a new 11.8 m
-  radio mast, and one with no altitude stands on the ground instead of at the
-  10 km airborne default (samehkhamis, #1729).

changelog.d/1730-airport-vehicle-models.md

@@ -1,4 +0,0 @@
-- Draw airport ground vehicles as real shapes instead of stacked boxes: the
-  car is an operations SUV, the van a high-roof panel van, the fire truck an
-  airport crash tender with turrets and the pushback a low tug with a glazed
-  cab, all on the ground at their built size (samehkhamis, #1730).

docs/APPLICATION.md

@@ -224,131 +224,7 @@ leaving out `command-dock` the voice control and its pointer reticle;
 leaving out `context` the Bhote Koshi reconstruction panel; and leaving out
 `intel-hud` the Intel HUD overlay (`#intel-hud`), whose readouts the HUD
 implementation publishes to the `gev-hud` store. An unknown
-view name is an error. An application that offers its own language choice
-starts and switches the language with the `./i18n` entry (`startPageLocale`,
-`followPageLocale`, `switchLocale`; see [I18N.md](./I18N.md)) and passes
+view name is an error. A host that does not initialize Core's locale passes
 `localePicker: false` to `createApplicationControls` instead of editing the
 markup. Node tests that import application modules register the component
 loader with `node --import=<core package>/build/register-vue`.
-
-### Cockpit subjects
-
-Core's Cockpit rides a tracked aircraft, the tracked satellite and the
-selected AIS vessel. An application adds kinds of its own with
-`services.cockpitSubjects` on `createApplicationControls`: a list of
-providers, checked once when the controls are built
-(`src/cockpitSubjectProviders.js`). A malformed provider, or one with a member
-that throws when read (a getter), is left out with a warning and the rest are
-kept. A provider's subject takes entry when it was selected after every
-built-in subject present (a tracked aircraft or satellite, a selected vessel),
-whose own fixed order is unchanged, and needs the provider's `layerId` on; the
-provider then holds its subject, hands the camera a frame and the generic HUD
-a view model on every update, and releases it on exit. Provider methods are
-synchronous and are called on the provider, so a class instance's methods keep
-their `this`; one that throws or returns a promise is treated as having
-failed. What a method returns may carry getters: one that throws when read
-makes a candidate none, a frame malformed (the view ends) and a HUD view keep
-the last; a worded member (labels, entry face, look) that throws keeps its
-last good words.
-
-```js
-import { getLocale, onLocaleChange } from 'gods-eye-view/i18n';
-import { pointAtS } from 'gods-eye-view/layers/rail/paths';
-
-const words = {
-  en: { view: 'Ride view', exit: 'Exit ride view', exitText: 'EXIT RIDE' },
-  de: {
-    view: 'Fahrtansicht',
-    exit: 'Fahrtansicht verlassen',
-    exitText: 'VERLASSEN',
-  },
-};
-
-/** Ride the Rail layer's selected train; `rail` is its layer instance. */
-const ride = {
-  kind: 'example-ride',
-  layerId: 'rail',
-  entryFace: { icon: 'train', label: 'RIDE' },
-  // A function is read again when the page's language changes.
-  labels: () => words[getLocale()] ?? words.en,
-  candidate() {
-    const train = rail.getSelectedTrain();
-    return (
-      train && {
-        id: train.key,
-        name: train.label,
-        selectedAt: train.selectedAtMs,
-      }
-    );
-  },
-  // Only a train bound to its line can be ridden: read() needs its path.
-  isEntryAllowed: () => Boolean(rail.getSelectedTrain()?.path),
-  hold: (id) => rail.setCockpitSubject(id),
-  read(nowMs, ctx) {
-    const train = rail.getCockpitSubject();
-    if (!train?.path) return null; // ends the view
-    const point = pointAtS(train.path.line, train.path.s);
-    return {
-      id: train.key,
-      latitude: point.lat,
-      longitude: point.lon,
-      heightM: train.position.railHeightM, // null stands it on the shared floor
-      name: train.label,
-      headingDeg:
-        train.path.direction < 0 ? point.bearingDeg + 180 : point.bearingDeg,
-      speedMps: train.motion.reportedSpeedMps ?? train.motion.derivedSpeedMps,
-      // The layer already moves the train smoothly: sit on it.
-      anchor: 'exact',
-      eye: { upM: 3.5 },
-    };
-  },
-  hud: (frame) => ({ title: frame.name }),
-  release(id, { restore }) {
-    rail.setCockpitSubject(null);
-    if (restore) rail.focusTrain(id);
-  },
-};
-
-createApplicationControls({ /* ... */ services: { cockpitSubjects: [ride] } });
-```
-
-The `./i18n` entry gives `getLocale()` and `onLocaleChange()`:
-Core translates only its own strings, so a provider words its labels, entry
-face and HUD for the page's language (labels may be functions, as above; the
-HUD is read again on a change). `gods-eye-view/layers/rail/paths` is the
-Rail layer's pure path module (`createRailPath`, `pointAtS`, `projectOnPath`)
-for a provider placing a train along its line. The frame, HUD view and
-candidate fields are documented in `src/cockpitSubjectProviders.js`; the Rail
-and Transit read APIs in `src/layers/rail/cockpitSubject.js` and
-`src/layers/transit/cockpitSubject.js`. A snapshot read again while nothing in
-it changed is the one read before, so `read` may take one on every update; a
-train's `path.line` is a frozen copy of its line, for `pointAtS` and
-`projectOnPath`. The `layers/rail/paths` export and the
-Rail and Transit read APIs (`getSelectedTrain`, `getSelectedVehicle`,
-`getCockpitSubject` and the snapshots they return, `path.line` among them)
-are experimental and may change without notice.
-
-A candidate's `selectedAt` is a token that changes each time the user selects
-the subject, even the same one again, so entry counts it as selected then; a
-new `id` under the same token is the same selection (a train's selection
-moving to another feed's copy of it). The Rail and Transit snapshots give one,
-`selectedAtMs`: when the user last selected the train or vehicle by a click or
-`focusTrain`/`focusVehicle`. It is null after a deselection and for one
-selected only by a hold, since a hold is not the user's selection.
-
-A frame with `heightM: null` stands on the shared floor, or where it last
-stood while that floor is cold. If no height has been known since entry, the
-view waits, showing ACQUIRING SURFACE, for at most five seconds
-(`COCKPIT_GROUND_WAIT_TIMEOUT_MS`), then ends and releases the subject.
-
-`hold(id)` returns `true` once it holds the subject, or `false` to refuse
-entry; any other answer, `undefined` included, refuses entry too, with one
-warning. A refused hold, and one that throws or returns a promise, is followed
-by `release(id, { restore: false })`, again once a returned promise settles,
-so `release` must be harmless for a subject it does not hold and when called
-more than once.
-
-Leaving the view does not track again an aircraft that was tracked before
-entry, as with the bridge and orbital views: when the user leaves by the exit
-control, the map goes back to the ridden subject through
-`release(id, { restore: true })`.

docs/CURRENT-STATE.md

@@ -1706,7 +1706,7 @@ Applications supply the existing floor/snap, geoid, picking, sprite, camera,
 trail, focus, readout, context, aircraft presentation and render services.
 The factory never constructs a second application registry. Configure a source
 before initialization; replacing it while initialized is rejected. Model loads
-use the supplied asset resolver, including the up-front fleet set load. Enrichment receives
+use the supplied asset resolver, including the preload path. Enrichment receives
 an abort signal and cannot update a later lifecycle after destruction. Existing
 camera, terrain floor, trail, selection and measured model-size policies remain.
 
@@ -2208,83 +2208,6 @@ the subject (tracking stopped, Satellites off) or tracking another target
 ends the view without refocusing. `src/ui/cockpitOrbitalView.test.mjs`
 covers entry, camera, zoom, look, HUD and exit.
 
-### Application subjects
-
-An application can add its own first-person subjects beside the aircraft,
-vessel and satellite: `services.cockpitSubjects` to `createApplicationControls`,
-a list of subject providers (`src/cockpitSubjectProviders.js`, checked once by
-the coordinator; a malformed one, or one with a member that throws when read,
-is left out with a warning and the rest are kept). A provider names
-its layer, an entry face and labels in the page's language, and supplies four
-operations: `candidate()` (what entry would ride now), `hold(id)`,
-`read(nowMs, ctx)` (a camera frame each update) and `hud(frame, ctx)` (a HUD
-view model), with `release(id, {restore})` on exit. Entry needs the provider's
-layer on, no Context change in flight and the provider's own
-`isEntryAllowed(candidate)`; voice stays aircraft-only and is refused, with
-the reason, while a provider's view is in use.
-
-The built-in kinds keep their fixed entry order (a tracked aircraft, then the
-tracked satellite, then the selected vessel), so without providers entry is
-unchanged. A provider's candidate takes entry only when it was selected after
-every built-in subject present, by when the Cockpit first saw it or saw it
-selected again (its `selectedAt` changing): a train picked after an aircraft
-was tracked takes entry, and an aircraft tracked after it takes it back.
-Providers' candidates are ordered most recently selected first, then by
-priority; one first seen together with a built-in subject comes after it. The
-first in that order decides alone: when its gate is shut there is no entry
-rather than the next subject's.
-
-A frame places the eye `eye.upM` above `heightM` (the shared floor where the
-frame gives none, or where it last stood while that floor is cold; with
-neither, the camera stays where it is and the HUD reads ACQUIRING SURFACE for
-at most `COCKPIT_GROUND_WAIT_TIMEOUT_MS`, after which the view ends and the
-subject is released: no height stands in for a floor never read), slews toward `headingDeg` at the provider's rate, and may
-turn off the floor clamps (`groundClamp: false`, for a subject inside a
-structure) or keep the anchor exactly on the subject (`anchor: 'exact'`, for a
-layer that already moves it smoothly; a frame with no `speedMps` is always
-exact, since an inertial anchor runs on at the frame's speed); `cameraIntervalMs: 0` updates the
-camera every rendered frame. A frame that is null, malformed or for another
-subject ends the view (`restoreTracking: false`), as an aircraft tracked
-meanwhile and the provider's layer turning off do; the exit control asks the
-provider to restore its subject. The generic HUD shows the provider's kicker,
-title, meta line, speed with its unit and tag, readout cards, always-visible
-source rows, banner, route card and Live Signals rows, a veil that darkens the
-picture under the HUD (with passing light streaks, which stop under reduced
-motion), arrow-key look-around when the provider asks for it, and a progress
-line along the bottom edge (`src/cockpitProgress.js`: close ticks merge,
-labels never overlap). Core translates none of the provider's text: a host
-words it for the page's language (`gods-eye-view/i18n`:
-`getLocale`, `onLocaleChange`). Its entry face, labels and look may be
-functions, read again when they are shown and on a change of language, as the
-HUD view is.
-
-The Rail layer offers a read API for such a view: `getSelectedTrain()` and
-`getCockpitSubject()` (a snapshot of the train: where it is along its line,
-which way it runs (`pathBinding.js` learns it), its rail height, speed as
-reported or derived, position source, feed credit and stops, and
-`selectedAtMs`, when the user last selected it by a click or `focusTrain`,
-even again; null after a deselection and for a train only a hold selected),
-`setCockpitSubject(key)` (its marker, 3D model and card hidden, the selection kept, its
-feed held, clicks and Escape left to the view; the held copy stays the one
-drawn of its train while held, another feed's copy hidden, and it keeps
-moving, still selected, when its category is turned off) and
-`focusTrain(key)` (false for a train the layer does not draw); its pure path
-module is exported as `gods-eye-view/layers/rail/paths`. That export
-and these read APIs are experimental and may change without notice. A snapshot read again while nothing in it changed is
-the one read before, and its `path.line` is a frozen copy. Transit
-offers the same for a vehicle (`getSelectedVehicle`, `getCockpitSubject`,
-`setCockpitSubject`, `focusVehicle`): a held vehicle keeps playing when it is
-out of the camera's view, and its sprite, 3D model, card, trail and detection
-box are hidden; released, it is out of play until a visibility sweep finds it in
-view. Its snapshot's `position.groundHeightM` is the floor where playback draws
-it (the drawn marker's height while it is placed, else its segment's two
-reports' floors at the playback fraction), not the newest report's, and null while that floor is unknown. Rail's `path.direction` is the
-way the drawn train runs: once playback has placed it, a report that runs back
-turns it only when playback reaches that report. `docs/APPLICATION.md` (Cockpit subjects) shows a minimal provider. `src/ui/cockpitSubjectView.test.mjs`,
-`src/cockpitSubjectProviders.test.mjs`, `src/cockpitProgress.test.mjs`,
-`src/layers/rail/cockpitSubject.test.mjs` and the Transit lifecycle tests
-cover them.
-
 ## Context coordination
 
 Context controls own Contacts/Space Missions state, entry and exit transactions,
@@ -2301,22 +2224,9 @@ Frame loading, calibration editing and status display have separate modules;
 providers, camera placement and navigation policy retain their existing owners.
 Changing cameras invalidates old image callbacks and cancels an unfinished
 calibration edit. Failed refreshes preserve settled pixels for the same camera,
-while a newly selected camera never shows the prior camera's image. A frame is
-shown without a fade once it is decoded (or after one second if its decode never
-settles), so a new camera's preview is blank only while its frame loads. Disposal
+while a newly selected camera never shows the prior camera's image. Disposal
 releases listeners, subscriptions, image handlers, summary timers and chip-hide timers.
 
-The panel opens when a camera becomes active and collapses when the layer is
-switched off, from its own switch or anywhere else. The panel chrome applies
-the collapse, so a panel the desktop accordion only folded has its saved and
-shared state closed too. Clear selected data layers and Context isolation
-(Contacts, Space Missions) switch the layer off without the user asking: the
-panel and its share preference stay as they are, and the layer comes back to an
-open panel. Only the switch-off isolation makes counts (`suspendsLayer`, true
-while `_clearLayersOutsideContextMode` switches the layer off): the user
-switching CCTV off inside Contacts closes the panel as anywhere else. A panel opened by hand while the layer is off stays open, and its
-meta line reads the catalog count, not the last active camera.
-
 ## UI disposal
 
 UI disposal releases the CCTV subscription, command-dock observer, legacy drag
@@ -2508,9 +2418,8 @@ is validated against Cesium 1.138.0 and must be revalidated on upgrades.
 
 `scripts/qa-anime-sky.mjs` checks asset readiness, visible Normal sky and
 Anime band coverage against a Vite dev server.
-`scripts/qa-sky-model-lighting.mjs` compares a lit fleet airliner
-(`public/models/fleet/aircraft/a320.glb`) against black and white environment
-maps in isolated scenes.
+`scripts/qa-sky-model-lighting.mjs` compares a lit `airplane.glb` against
+black and white environment maps in isolated scenes.
 
 ## Model atmosphere on Apple Metal
 
@@ -2531,53 +2440,6 @@ future driver fix restores the effect with no code change; iOS/iPadOS platform
 detection is the backstop for when no probe context can be created. Applied
 during viewer construction, before any tile builds a draw command.
 
-## Render failure notice
-
-When the globe stops drawing, the scene chrome says so instead of leaving a
-black globe behind working controls. `installRenderFailureNotice()`
-(`src/ui/renderFailure.js`) listens for Cesium's `renderError` and the canvas'
-`webglcontextlost`, logs the error, and publishes a notice that
-`RenderFailure.vue` shows as an alert dialog with focus on its first action.
-The app's viewer uses `showRenderLoopErrors: false`, so Cesium's dead-end
-"Rendering has stopped" panel no longer appears; `applicationViewerOptions()`
-keeps it by default for other callers.
-
-- **Retry** restarts the render loop. The notice stays until a frame starts
-  and ends without an error: Cesium raises `postRender` after a failed frame
-  too.
-- **Reload**, after a lost context, reloads the page; the address keeps the
-  view.
-- **Reset view** opens `appRootUrl()`, without the hash or `/share/<code>`
-  path; the query, such as `?lang=`, is kept.
-
-Pitfalls:
-
-- An error thrown outside Scene's error handling (a frame listener, `onTick`,
-  a resize) stops the loop without a `renderError`. The notice wraps the
-  widget's `render()` and `resize()` and raises it as one, once even with
-  `rethrowRenderErrors`.
-- A throwing listener leaves its Cesium event mid-raise, with listener changes
-  only queued. The wrapper finishes those raises first (`finishRaise()` over
-  `frameEvents()`), so a layer turned off or on meanwhile behaves.
-- A render error marks the loop stopped while its next frame is still queued.
-  The wrapper keeps the loop marked running, so a Retry or a shown tab
-  (`src/app/tools.js`) before that frame starts no second loop.
-- After a lost context, later render errors are only logged, so the notice
-  keeps saying why. The listener neither prevents nor restores the loss.
-- When the globe draws again, focus goes back where it was, or to the globe's
-  canvas, which the map's keys read as the map; the canvas is focusable only
-  until focus leaves or the globe is pressed. Focus the user moved stays put.
-- The notice sits above floating panels such as the Québec camera viewer, and
-  its buttons are 44 px tall on touch screens.
-
-An inline conversation panel never reloads or navigates its host's page: it
-offers Retry after a render error only, and no notice after a lost context,
-where the panel runtime's own notice applies (`src/app/globePanelRuntime.js`).
-Its timer (`keepPanelRendering()`) draws only while the render loop is on and
-logs nothing itself, so each render error is logged once, by the notice. An
-error a timer frame throws is caught there: it has already been raised as a
-render error.
-
 ## Map Source control ownership
 
 Map Source controls own chip listeners, source-state subscriptions and selection
@@ -3337,15 +3199,6 @@ stays in view or tracked; an answer, found or not, and a permanent refusal
 stay final for the session. A route belongs to the callsign it was looked up
 for, so a callsign change drops the old route. See `DATA_SOURCES.md`.
 
-A selected vessel gets a photo the same way. The browser asks Open Vessel
-Photos for it by MMSI (`fetchOpenVesselPhoto` in
-`src/sources/live/standalone.js`, read by `src/data/openVesselPhoto.js`), once
-per MMSI (`src/layers/vessels/photos.js`), and the CONTACTS view shows it under
-the vessel's name and MMSI ("NAME · MMSI 366999709") with the photographer,
-the photo's open licence and a link to the vessel's page. A vessel without an
-MMSI is never looked up; a miss stays final for the session, and a failed
-lookup is asked again after five minutes.
-
 `gods-eye-view/server/providers/live` is a Node-only entry for the existing
 plugins and shared request helpers. Importing it starts no sockets or timers.
 The existing aircraft normalizer is separately available through the portable
@@ -3742,22 +3595,20 @@ This is the current runtime/source-of-truth snapshot for the project.
 >   24.09 m aft (70 % of the model's rendered envelope, so inside it), 2.22 m
 >   below centre (6 %), and 2e-9 m off the centreline.
 > - **The tracked trail attaches to REAL HULL, aft and below (2026-08-23):**
->   `FLEET_TRAIL_ANCHORS` (`src/data/fleetTrailAnchors.js`, generated by
->   `scripts/measure-fleet-trail-anchors.mjs`) holds, per fleet aircraft and
->   helicopter model and in RAW glTF coordinates (see the transform-chain entry
->   below), the point of the hull's CENTRELINE PROFILE (its centreline slice)
->   closest to the aft-belly AABB corner. It is NOT the corner: a bounding-box
->   corner is empty space (4.80 m off the nearest triangle on the airliner
->   asset this was first measured on, 6.14 m on the jet), so the trail ended in
->   mid air beside the aircraft. The head segment
+>   `MODEL_TRAIL_ANCHOR_NATIVE` (`src/data/modelVisualAnchor.js`) holds, per GLB
+>   and in RAW glTF coordinates (see the transform-chain entry below), the point
+>   of the hull's CENTRELINE PROFILE (its y = 0 slice) closest to the aft-belly
+>   AABB corner. It is NOT the corner: a bounding-box corner is empty
+>   space, 4.80 m off the nearest triangle on `airplane.glb` and 6.14 m on
+>   `jet.glb`, so the trail ended in mid air beside the aircraft. The head segment
 >   is drawn from a point behind the aircraft to this anchor, so the anchor must
 >   stay aft (83–96 % of each aft extreme) or the segment enters at the tail and
->   stops inside the fuselage. `fleetModels.test.mjs` reads the POSITION BUFFERS —
+>   stops inside the fuselage. `modelScale.test.mjs` reads the POSITION BUFFERS —
 >   real vertices and triangles, because accessor min/max cannot tell a corner
 >   from a surface — and re-derives on-hull, aft, lowest-at-its-station,
 >   on-centreline, and the construction itself. Re-measure, never re-guess.
 > - **The trail anchor rides CESIUM'S transform chain, not a hand-rolled one
->   (2026-08-23 regression fix):** `FLEET_TRAIL_ANCHORS` stores RAW
+>   (2026-08-23 regression fix):** `MODEL_TRAIL_ANCHOR_NATIVE` stores RAW
 >   glTF coordinates and `modelAnchorWorld()` assembles
 >   `modelMatrix × components.transform × axisCorrection` — the same chain
 >   `ModelSceneGraph` renders with, built from Cesium's own exported
@@ -3792,7 +3643,7 @@ This is the current runtime/source-of-truth snapshot for the project.
 >   ENVELOPE, and between them the drawn start slides along the segment so the
 >   visible length grows CONTINUOUSLY from zero. Three earlier cuts are recorded
 >   because their shape matters: testing segment LENGTH against the radius HID
->   real trail (58 m aft of an airliner's 34.41 m envelope gives a 33.98 m
+>   real trail (58 m aft of `airplane.glb`'s 34.41 m envelope gives a 33.98 m
 >   segment, suppressed, though ~23.6 m of it is open air); CLIPPING at the
 >   envelope and keeping only what lay outside stopped a moving trail visibly
 >   SHORT of the aircraft, since a bounding sphere encloses a lot of empty space
@@ -4968,9 +4819,8 @@ activeCameraCardEnabled: true })` may publish it through the retained
 > - **Flights 3D/cockpit hardening:** the destination-direction cue is an
 >   inline SVG rather than a remotely loaded Material Icons ligature, so a
 >   blocked or late font can no longer expand the literal word `navigation`
->   across the cockpit. A grounded aircraft stands its fleet model's scaled
->   clearance (the catalog's `clearance`, measured below the model's origin)
->   above the ground.
+>   across the cockpit. The grounded `airplane.glb` belly offset is calibrated
+>   to the current asset's measured Y-up bounds (`0.063` native units).
 >   Contact Previous/Next and Live Signals aircraft handoffs now
 >   re-seed the first-person camera anchor at the selected flight immediately;
 >   bounded feed-correction smoothing remains scoped to the same aircraft.
@@ -5219,10 +5069,6 @@ Shipped locales: **en** (source and fallback), **ar**, **de**, **es**, **fr**, *
   views re-render, code that published translated text words it again through
   `onLocaleChange`, and `<html lang>`/`dir` and the page's `data-i18n` markup
   follow. Nothing is lost; a toast already on screen keeps its words.
-  An application that offers the language elsewhere (a menu) uses the
-  `./i18n` entry (`src/i18n/page.js`): `startPageLocale` at boot,
-  `followPageLocale` for the markup and `switchLocale`, which does what a
-  picker choice does, with `localePicker: false`.
 - **Right to left.** Arabic (`ar`) and Hebrew (`he`) are in `RTL_LOCALES`, so
   `<html dir="rtl">`: the title, style indicator, both panel stacks and their
   icon rails swap sides through logical properties (`inset-inline-*`,
@@ -5960,6 +5806,39 @@ Noir samples also exclude its deliberately vignetted outer field, using shader
 settings and screen position rather than observed brightness. Selected-trail
 diagnostics report every condition even when selection fails.
 
+Heights of the terrain globe's loaded surface come from one shared reader,
+`src/services/terrainSurface.js`, which the ground service hands to every layer
+(`groundFloor.terrainSurface`). `globe.getHeight` is a ray cast against the
+drawn tile's mesh, so the reader keeps each answer per point, about a metre
+apart. While the camera moves or tiles load a kept height is read again after
+2 s; a height read once both have been still for 5 s is kept until either
+changes. Reads are budgeted at 16 ms per 200 ms window across all layers, 12 ms
+of it for re-reads, longest-kept first. A request ranks as a marker (always
+read), drawn geometry, or background (a quarter of each budget). Past the
+budget a kept point keeps its last height and a new point takes the last
+height read in its ~111 m floor cell or waits.
+
+- Transit asks for every vehicle and trail fix: vehicle positions as markers,
+  the path a marker is drawn along next, the undrawn trail history of
+  unselected vehicles as background, and its reread cycle continues until no
+  point waits. Before this, every reread cast a ray for every trail fix of
+  every vehicle in view, which blocked the page for up to 19 s at a time over
+  a 650-vehicle fleet while zooming.
+- Rail asks for each train every frame on a grid about 4 m apart, as a marker,
+  so a moving train reads a few times a second and a standing one not at all.
+- Local data layers (Data Centers, Dams) read terrain floors through it, and
+  their depth samples (`scene.sampleHeight`, a GPU render) stop at 8 ms a
+  frame per layer and continue on the next frames.
+- Bike Share draws a city's stations at once at the fallback height and finds
+  their ground heights afterwards in 4 ms steps, from the terrain reader on a
+  terrain globe and from depth samples where the globe is hidden.
+
+Verified in the browser on a keyless terrain globe only: Boston for Transit,
+Rail and Bike Share, northern Virginia for Data Centers. Not checked there:
+photorealistic 3D Tiles, a terrain globe with a building tileset on top, Dams,
+and any city steeper than Boston. Street Traffic keeps its own height cache
+and ALPR cameras their own sample budget.
+
 Transit brackets use the normal-composite overlay surface: a 1.25 px mode-colour
 stroke over 3.25 px dark backing. Other contact themes retain their existing
 behavior. The selected trail uses a 3 px core over 5 px backing, mode-coloured
@@ -6724,10 +6603,6 @@ silently demoting every later lookup for the session.
   far cap, retargeting the existing video/canvas texture pipeline. Stills are drawn at their source aspect, centered on the placeholder dark (`#01070c`), instead of being stretched to the 16:9 canvas. Manual calibration only —
   auto-calibration and the drape mesh pipeline are deleted. A one-shot activation obstruction
   probe (`pickFromRay` on camera activation, clamping the plane short of the first hit) remains;
-  a hit at or beyond the camera's range counts as a miss, and on a globe map the plane also clamps
-  short of the globe's terrain along the axis (flat ground at the mount's ground when terrain is
-  missed or met beyond the range), whichever is nearer, so it never stands at the full range there
-  (about a kilometre wide and hundreds of metres up);
   ground placement is superseded by the shared-floor v3 behavior below. Calibration persists to
   `godsEyeView.cctv.calibration.v2` (wiped clean, no v1 import); a panel-only CAL badge shows
   `CALIBRATED`/`CURATED`/`RAW PRIOR` (no in-world tint). Panel is titled "CCTV" (not "CCTV
@@ -7429,9 +7304,8 @@ pins and share links already supply complete boxes.
   normal four-samples-per-250-ms budget. Retry timestamps more than the maximum
   30-second backoff ahead of the current clock are ignored. A smaller rollback
   can retain a bounded retry delay of up to 30 seconds.
-- Commercial and military aircraft use the same high-level FLEET model regime: 2D billboards when zoomed out, optional glTF models when closer, controlled by the DISPLAY rail `3D` toggle and `Proximity` / `All` modes. Every model is one of the project's procedural fleet models (`public/models/fleet/`, MIT, 122 GLBs, about 2 MB in all; `public/models/README.md`), chosen per aircraft by `aircraftModelSpec` (`src/data/fleetModels.js`): the first of its ICAO type's callsign rules in `types.json` (`aircraft_callsign`) its callsign matches, else its type's entry, else the model of its `classifyAircraft` class for a type the map lacks, else its ADS-B emitter category's, else the default airliner. It is drawn LIFE SIZE: the type's published length over the model's built length (`src/layers/flights/modelSpec.js`, shared by Flights, Military Flights and Local ADS-B), and a grounded aircraft stands the model's scaled clearance above the ground. An airport ground vehicle (feed type `ZVEH`) is a fire truck (`FIRE…`), pushback tug (`PUSH…`, `TUG…`), van (`DEICER…`, `SQUID…`, `SQB…`) or else a car by its callsign, and a ground station (`GRND`) is an 11.8 m radio mast; these models (catalog category `other`) are drawn at their built size, and such a contact with no altitude stands on the ground instead of at the airborne default (`src/layers/flights/records.js`). `classifyAircraft` still picks the 2D icons. The whole set loads once, up front, when a layer that draws it starts (`loadFleetModelSet`, which logs `[Fleet] N/122 models (X MB) loaded in N ms`); models are built from those bytes, never fetched mid-session, and an aircraft stays its billboard until the set has loaded. Textured civilians carry a HEAVY tint, not a light one: `MODEL_COLOR_BLEND_AMOUNT` is `0.94` in BOTH layers under Cesium's `ColorBlendMode.MIX`, so the class colour supplies 94% of the surface and the model's own vertex colour ~6%; military models are flat amber, or emergency red. IR boost raises the blend to a full `1.0`. Under NVG/FLIR (map preset or Cockpit vision) models render unlit flat-white at full alpha and scene fog is disabled (fog otherwise blacks out distant models with the globe hidden); state restores on exit.
-- Vessels, Transit and Rail draw fleet models under the same DISPLAY rail `3D` toggle, at the same altitude ceiling, caps and add/keep radii as the aircraft (`FLEET_MODEL_POLICY`, `src/layers/flights/policy.js`; `createFleetModelLayer`, `src/data/fleetModelInstances.js`). A vessel's model follows its AIS ship type and is drawn at its reported length and beam (AIS static dimensions A+B and C+D, now carried on vessel rows as `length` and `beam`), standing at the sea surface, heading by true heading then course. A transit vehicle's model follows its layer mode (bus, tram, subway, rail or ferry; a vehicle of `unknown` mode keeps its icon), a train's its rail category and mode (rail, metro or tram). Neither the transit nor the rail sources carry a GTFS `route_type` or a finer mode (monorail, gondola, funicular, cable car), so the set's models for those and their `transit.elevation` lifts are not reached by any live source today. Both stand on the road or rail top they are drawn on, without the 1.5 m `GROUND_FLOOR_LIFT_M` their icons carry, and are painted in their mode or category colour where the model's `_TINT` attribute marks it. A vessel model is clipped at its waterline (one clipping plane per model, at the model origin's horizontal plane), so its hull below the water never shows through a plain globe, which Cesium does not depth-test models against. Under the NVG/FLIR styles (the Flights `irBoost` parameter) these models render unlit flat white, as aircraft models do. Each vehicle's icon stays the visual until its model is loaded, ready and placed; a model is picked as its icon is, and a vehicle drawn as its model keeps its selection card and its place in the detection overlay.
-- **Aircraft models skip Cesium's dynamic environment map (2026-10-24).** Flights, Military Flights and Local ADS-B pass `environmentMapOptions: AIRCRAFT_ENVIRONMENT_MAP_OPTIONS` (`{ enabled: false }`, `src/data/aircraftModelLighting.js`) to every drawn model. Otherwise each `Model` renders the sky around it and reads it back from the GPU (`readPixels`) when it is first placed, and again whenever it moves more than 1 km, the scene's atmosphere settings change, or (under sunlight dynamic lighting) an hour of scene time passes (`DynamicEnvironmentMapManager`, Cesium 1.138). With the class colour supplying 94% of the surface, the models are lit from Cesium's default spherical harmonics instead, with no specular environment map, so the sky's model-lighting cube map no longer reaches aircraft. `src/data/aircraftModelLighting.test.mjs` pins the option at every drawn model call; every model is built from the fleet set loaded up front, so there is no separate preload.
+- Commercial and military aircraft use the same high-level FLEET model regime: 2D billboards when zoomed out, optional glTF models when closer, controlled by the DISPLAY rail `3D` toggle and `Proximity` / `All` modes. Since 2026-08-16 (Hangar fleet) models are PER-CLASS: real CC-BY GLBs for light/bizjet/turboprop/widebody/helicopter/uav (`CLASS_MODEL_REAL` in `src/data/aircraftClass.js` — meters-baked, scale 1, per-model belly/radius; provenance in `public/models/README.md`), the shared `airplane.glb` for the remaining civilian classes, and the military layer maps weight classes (real GLBs / 747 heavies / `jet.glb` fastjets, per-model heading offsets, flat amber or emergency red). Textured civilians carry a HEAVY tint, not a light one: `MODEL_COLOR_BLEND_AMOUNT` is `0.94` in BOTH layers under Cesium's `ColorBlendMode.MIX`, so the class colour supplies 94% of the surface and the asset's own texture ~6%. The visual direction is clean light silhouettes with only a weak diffuse contribution from the approved textures, so liveries deliberately do NOT read. IR boost raises the blend to a full `1.0`. Under NVG/FLIR (map preset or Cockpit vision) models render unlit flat-white at full alpha and scene fog is disabled (fog otherwise blacks out distant models with the globe hidden); state restores on exit.
+- **Aircraft models skip Cesium's dynamic environment map (2026-10-24).** Flights, Military Flights and Local ADS-B pass `environmentMapOptions: AIRCRAFT_ENVIRONMENT_MAP_OPTIONS` (`{ enabled: false }`, `src/data/aircraftModelLighting.js`) to every drawn model. Otherwise each `Model` renders the sky around it and reads it back from the GPU (`readPixels`) when it is first placed, and again whenever it moves more than 1 km, the scene's atmosphere settings change, or (under sunlight dynamic lighting) an hour of scene time passes (`DynamicEnvironmentMapManager`, Cesium 1.138). With the class colour supplying 94% of the surface, the models are lit from Cesium's default spherical harmonics instead, with no specular environment map, so the sky's model-lighting cube map no longer reaches aircraft. `src/data/aircraftModelLighting.test.mjs` pins the option at every drawn model call; the two preload calls only warm the glTF cache and are never drawn.
 - The DISPLAY-rail `3D` toggle is the user-facing activation path for both aircraft layers. Their small approved GLBs build their render resources without Cesium's frame-spread job queue, preventing continuous Photorealistic 3D Tiles streaming from starving model readiness; model caps, tracking, camera, and fallback billboards are unchanged.
 - **The `3D` toggle DEFAULTS ON in `proximity` on a first run.** Proximity is itself the budget — models appear only below `MODEL_ALT_CEIL_M` and only for the nearest `MODEL_MAX` in view — so the default costs nothing at globe scale, and `all` remains a deliberate opt-in. A fresh boot runs NO layer-state restoration (`LayerStateCoordinator.start()` returns early with neither a share payload nor stored state), so four independent initializers decide what a first-run operator sees and must agree: `booleanOption('models3d', 'e', true)` in `src/data/layerState.js`, `_models3dEnabled = true` in BOTH flight layers, `this._models3dEnabled = true` in `src/ui/aircraftDisplay.js`, and the `active` / `visible` classes on `#models3d-toggle` / `#models3d-mode-row` in `index.html`. All four are pinned together in `src/data/layerState.test.mjs`. Explicit state still wins: because the codec omits default-valued options, `models3d: false` is now what travels in a link (`lo=…f.e.0`) and restores OFF at both aircraft layers. **Consequence for returning users:** a stored `gev:layer-state:v2` blob is a FULL options snapshot, so a session that wrote one before this change carries `models3d:false` and keeps 3D off until the operator flips it (or clears the key) — the durable snapshot is treated as the recipient's own state, by design.
 - **Consequence of the flip on the recorded tracked/fleet inversion:** the 150–800 km band where surrounding contacts draw as models while the SELECTED one is still a glyph is now what an operator sees WITHOUT arming anything. The inversion itself is unchanged and still deliberate (see `src/data/trackedModelRegime.js`); only its reachability changed.

docs/I18N.md

@@ -59,30 +59,6 @@ The language picker switches in place, without a reload. A view that calls `t()`
 
 A toast already on screen keeps its words.
 
-## An application with its own language choice
-
-An application that composes Core and offers the language somewhere else (a menu, a settings page) imports the `./i18n` entry (`src/i18n/page.js`) and passes `localePicker: false` to `createApplicationControls`:
-
-```js
-import {
-  LOCALES,
-  LOCALE_NAMES,
-  followPageLocale,
-  getLocale,
-  onLocaleChange,
-  startPageLocale,
-  switchLocale,
-} from '<core package>/i18n';
-
-startPageLocale(document); // before any view renders: ?lang=, stored choice, browser, English; translates data-i18n markup
-const stopFollowing = followPageLocale(document); // <html lang>/dir and data-i18n markup follow each switch
-
-for (const code of LOCALES) addMenuItem(LOCALE_NAMES[code], code === getLocale());
-menu.onChoose = (code) => switchLocale(code); // switched in place and stored (in ?lang when storage is blocked)
-```
-
-`switchLocale` does what a choice in the globe picker does, and returns `'unchanged'` for the active language. `onLocaleChange` tells the application's own menu to mark the new language.
-
 ## Rules
 
 - **Pass literals.** `t('Close')`, not `t(label)` (unless `label` holds a `msg()` value) and never a template literal with `${…}`.
@@ -133,7 +109,6 @@ Icons (`aria-hidden="true"`, Material Symbols), comments, CSS values and lowerca
 | `src/ui/i18n.js`                | the page's vue-i18n instance: the active locale and the catalogs               |
 | `src/i18n/marker.js`            | `msg` alone, for modules the server or tools import (no catalogs)              |
 | `src/i18n/locale.js`            | shipped languages, their names, choosing the language at boot                  |
-| `src/i18n/page.js`              | the `./i18n` entry: start, follow and switch the page's language               |
 | `src/i18n/locales/<code>.json`  | one catalog per language, keyed by English text                                |
 | `src/i18n/same-as-english.json` | per language, the entries that stay as in English on purpose                   |
 | `scripts/i18n.mjs`              | `npm run i18n`: extracts messages, checks the catalogs, finds unmarked UI text |

docs/INFRASTRUCTURE-LAYERS.md

@@ -34,6 +34,7 @@ const layers = createInfrastructureLayers({
 | `clearSelectedEntityContextForLayer` | `(layerId)`; clear selection only if owned by this layer |
 | `removeEntityContextsForLayer` | `(layerId)`; remove records owned by the layer on destruction or failed setup |
 | `governorRequestRender` | `(reason)`; request a frame through the existing render scheduler |
+| `terrainSurface` | Optional. The application's shared terrain surface (`groundFloor.terrainSurface`), so its layers read each terrain height once; without it each layer keeps its own |
 
 Each returned layer supports `init(viewer)`, `enable(viewer)`, `disable(viewer)`,
 `update(viewer)`, `destroy(viewer)`, `getStats()`, `getLodDiagnostics()` and

docs/translations/zh-Hant.md

@@ -4,7 +4,7 @@ Catalog: `src/i18n/locales/zh-Hant.json`. General rules: [TRANSLATORS.md](../TRA
 
 `zh-Hant` is the Simplified Chinese catalog (`zh-CN`, credited to abiyeenzo, #914, and EDIT-Aeterna, #979) written in Traditional characters with OpenCC character conversion. Wording and terminology are the same as in `zh-CN`: change a term in [zh-CN.md](./zh-CN.md) and the `zh-CN` catalog first, then convert. Only the script differs.
 
-After `s2tw` conversion, fix the characters OpenCC picks wrongly: 年曆史 → 年歷史, 下遊 → 下游, 並道 → 併道, 發佈 → 發布, 公佈 → 公布, 控制檯 → 控制台, and 周 → 週 where it means a week (1 週/秒).
+After `s2tw` conversion, fix the characters OpenCC picks wrongly: 年曆史 → 年歷史, 下遊 → 下游, 並道 → 併道, 發佈 → 發布, 公佈 → 公布.
 
 ## Style
 

package.json

@@ -99,7 +99,6 @@
     "./application": "./src/app/application.js",
     "./application/viewer": "./src/app/viewer.js",
     "./time": "./src/time/worldClock.js",
-    "./i18n": "./src/i18n/page.js",
     "./build/vite": {
       "node": "./build/vite.js"
     },
@@ -298,7 +297,6 @@
     },
     "./sources/rail-service": "./src/sources/railService.js",
     "./layers/rail/source": "./src/layers/rail/source.js",
-    "./layers/rail/paths": "./src/data/railPaths.js",
     "./sources/map-features": "./src/sources/overpassFeatures.js",
     "./server/providers/mapillary": {
       "node": "./server/providers/mapillary.js"

public/models/README.md

@@ -1,33 +1,20 @@
-# Bundled 3D Models
+# Bundled 3D Model Attribution
 
-Every 3D model shipped in this directory is one of the project's procedural
-fleet models under [`fleet/`](fleet/): aircraft, helicopters, ships, buoys,
-transit and rail vehicles, and a few other airborne and ground objects. They
-are generated from code by the project maintainers, contain no third-party
-artwork, and are covered by the repository's [MIT license](../../LICENSE)
-like the source code.
+The model files in this directory are third-party visual assets. They are not
+covered by the repository's MIT source-code license; each remains available
+under the license listed below.
 
-| Path | What it holds |
-|---|---|
-| `fleet/catalog.json` | Every model by name: its file, category, built length, beam and bounds (metres, in Cesium's Z-up model frame: x along the length with the nose toward −X, y across the beam, z up), the clearance below its origin, and its 2D icon class. |
-| `fleet/types.json` | Which model draws which vehicle, and at what length: ICAO aircraft and helicopter type codes, ADS-B emitter categories, AIS ship-type and length ranges, GTFS route types, transit modes and rail categories, with the defaults. |
-| `fleet/aircraft/`, `fleet/helicopters/`, `fleet/ships/`, `fleet/buoys/`, `fleet/transit/`, `fleet/other/` | The models, one GLB each (EXT_meshopt_compression and KHR_mesh_quantization, vertex colours, no textures). |
+| File | Original work and creator | Source | License | Project modifications |
+|---|---|---|---|---|
+| `airplane.glb` | “boeing 747” by [zairiq-123](https://sketchfab.com/zairiq-123) | [Sketchfab model](https://sketchfab.com/3d-models/boeing-747-9b16672038ba48f98e6d80a159044ed9) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Substantially modified and optimized for God's Eye View, including geometry/material simplification and coordinate/orientation preparation. The former 24× runtime calibration is baked into the mesh; location, rotation, and scale are applied; the bounding-box centre is at the origin; and the model uses glTF +Y-up with its nose toward local −X. Geometry remains uncompressed so the aircraft asset does not compete with photogrammetry for Draco worker capacity. |
+| `jet.glb` | “Private Jet” by [Nick the Name](https://sketchfab.com/Nick_The_Name) | [Sketchfab model](https://sketchfab.com/3d-models/private-jet-cbdd1de6ced9461e950eafaa302cc82b) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Repackaged as a glTF binary for the project's military-flight visualization. Imported hierarchy transforms are baked into the meshes; location, rotation, and scale are applied; the bounding-box centre is at the origin; and the model uses meter scale, glTF +Y-up, and the shared nose −X convention. Existing materials are preserved. |
+| `bell206.glb` | “Bell 206 JetRanger” by [terran4627](https://sketchfab.com/terran4627) | [Sketchfab model](https://sketchfab.com/3d-models/bell-206-jetranger-d2f7ba1d671549d4b26aaf834139a1dd) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures resized to 256 px WebP, orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
+| `c172.glb` | “Cessna 172” by [e737](https://sketchfab.com/e0057537) | [Sketchfab model](https://sketchfab.com/3d-models/cessna-172-64cddaee5aff470682659a8c08525046) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures resized to 256 px WebP, orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
+| `citation2.glb` | “1990 Cessna Citation, Texture Detailed, Exterior” by [BlenderCommunityHead](https://sketchfab.com/aboodgoudagad) | [Sketchfab model](https://sketchfab.com/3d-models/1990-cessna-citation-texture-detailed-exterior-a78839624fe64900a8352cb23462350a) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures resized to 256 px WebP, orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
+| `mq9.glb` | “MQ-9” by [IProZenoN](https://sketchfab.com/IProZenoN) | [Sketchfab model](https://sketchfab.com/3d-models/mq-9-fabe963feb354c5584b51f9c470c3f7e) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures resized to 256 px WebP, orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
+| `b789.glb` | “Boeing 787-9” by [Nobilis 2](https://sketchfab.com/nobilishornet2) | [Sketchfab model](https://sketchfab.com/3d-models/boeing-787-9-b6711e2e698e4e469675c1154a50b7a3) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures resized to 256 px WebP, orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
+| `atr72.glb` | “ATR 72 - 600” by [Oyan3D](https://sketchfab.com/oyan3D) | [Sketchfab model](https://sketchfab.com/3d-models/atr-72-600-1e1a7186f7444d288675262fcee44744) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) | Optimized for God's Eye View: geometry/material simplification, textures removed with dominant material colors baked into PBR factors (flat “abstracted” style), orientation/scale vertex-baked to real-world meters (Y-up, nose −X), origin centered. |
 
-How the layers use them:
-
-- Each layer draws a vehicle with the model its type selects, scaled to the
-  type's published length (a vessel to its reported AIS length and beam), so
-  every model is drawn life size. Ground objects, balloons and obstacles in
-  the `other` category are drawn at the size they are built.
-- An aircraft model's origin is its axis; it stands that model's scaled
-  clearance above the ground. A ship's origin is its waterline, and a transit
-  or rail vehicle's the road or rail top (a monorail or gondola is raised by
-  its `transit.elevation` entry, for a source that names those modes).
-- Transit and rail models carry a `_TINT` vertex attribute that marks where
-  the route or category colour is painted.
-- The whole set loads once, up front, when a layer that draws it starts; no
-  model is fetched while a session runs.
-
-`src/data/fleetModels.js` reads the set and chooses each vehicle's model;
-`src/data/fleetModels.test.mjs` checks that every model `types.json` names is
-in the catalog and on disk, and that no GLB exceeds 3 MB.
+CC BY 4.0 permits sharing and adaptation, including commercial use, provided
+appropriate credit is retained, the license is linked, and modifications are
+identified. These credits do not imply endorsement by the original creators.