gods-eye-view/CHANGELOG.md

Changelog

Traffic and bikeshare components

• Separate traffic loading, animation, styling and lifecycle into factory-owned components.
• Give each flow source its own bounded decode cache and cancellation checks.
• Separate bikeshare registry, station requests, rendering, selection and proximity handling.

Installation and context components

• Separate mapped-site requests, records, placement, selection and viewport lifecycle.
• Separate proximity queries, subject tracking, navigation/history, panel and direction rendering.
• Retain source and ground-floor ownership in standalone composition; reject malformed installation snapshots and ignore failures from cancelled requests.

Satellite and mission layer components

• Separate catalog loading, orbit calculations, display, tracking and interaction into instance-owned satellite components.
• Separate mission ingestion, paths, placement, cards, roster, replay and camera operations, retaining existing layer controls and satellite coordination.
• Cancel late mission source work and reject malformed launch snapshots.

Fire layer components

• Split fire source loading, state, rendering, cards, selection and viewport work into reusable components with application-owned scene services.
• Cancel late refreshes, retain good data after malformed responses, and preserve selection identity without repeating a user-selection notification on refresh.

Earthquake components

• Separate earthquake snapshot loading, record validation, and display ownership.
• Cancel pending earthquake refreshes on disable or destruction, retaining the last good snapshot after malformed or failed refreshes.

September 8, 2026

Earthquake refreshes validate the complete feed and construct replacement entities before clearing the previous snapshot. Malformed rows and duplicate rendered IDs retain the last good entities, overlays, count and timestamp and report a malformed response; unknown magnitude is excluded from M2.5+ rendering.

Non-object or array-valued properties reject the response instead of being treated as an unknown magnitude.

Launch payloads with missing records now say PAYLOAD DATA UNAVAILABLE. Missing names use Unnamed payload; absent or invalid mass stays unknown instead of appearing as 0 KG.

This changelog records public product changes. For the authoritative description of current runtime behavior, see docs/CURRENT-STATE.md.

[Unreleased]

Fixed

• Traffic now retries a failed destination after city navigation without a layer toggle. Camera departure cancels pending work, arrival checks the final view, and superseded requests cannot keep a newer view loading.

• Extract vessel feed, store, rendering, selection, trail and card components with explicit source and scene services.

• Bound contact retention for incomplete vessel observations, preserve source freshness and refresh history references in place.

• Cancel pending vessel history during selection and layer teardown.

• Split military flights into instance-owned state, ingestion, motion, rendering, tracking and query components. Share the existing aircraft calculations and give military classification an explicit source and cleanup lifecycle. Preserve known military identities even when the source has no position for them.

• Split civil flights into instance-owned state, ingestion, motion, rendering, tracking and query components. Cancel enrichment on teardown and resolve model assets through the application.

• Separate aircraft/vessel transport and normalization from layer rendering, preserving observation timestamps, altitude datums and optional history.

• Retain absent aircraft during partially admitted snapshots and bound source error messages.

• Drive share updates, Location feedback and Scene controls through immutable state snapshots and disposable subscriptions.

• Keep stale lookup/load completions from publishing accepted results and retain shot rows during playback progress updates.

• Export the existing Scene director with explicit playback and editing outcomes.

• Separate UI assembly from standalone engine wiring, with dedicated panel layout, position, notice and recording owners.

• Stop pending UI presentation and drag work during disposal; preserve accessible status text when stopping its decoration.

• Organize component styles behind the same ordered stylesheet entry and include 3D model controls in the current-state snapshot.

• Separate Scene controls and text presentation from project/playback operations; revoke replaced row listeners and suppress stale completion feedback.

• Preserve shot-label identity on selection so double-click rename can complete.

• Split Cockpit camera/controller, instruments, briefing, signals and layout into focused modules with explicit application operations.

• Give Display portal moves cancellable focus/scroll restoration and stop Cockpit work before asynchronous UI teardown.

• Separate Context controls, mode transitions and layer restoration; release tab listeners and suppress late panel/search feedback after disposal.

• Separate camera-panel controls, frame loading, calibration editing and status display; cancel stale image and calibration work on camera changes or disposal.

• Restore UI observer, resize-listener and CCTV subscription cleanup after Location extraction.

• Extract Radio controls and tuner presentation with explicit actions and complete listener/subscription cleanup.

• Extract Location controls and cancellable search presentation; preserve navigation handoff and prevent delayed POI expansion after closing the row.

• Separate Layers panel presentation and clear-control bindings from layer lifecycle operations; revoke listeners and subscriptions on replacement or teardown.

• Extract Map Source controls with listener cleanup and protection against obsolete selection feedback.

• Separate visual effects, presets and animation from Display controls, with explicit stage ownership and teardown.

• Extract Display control bindings with synchronous listener cleanup; preserve existing visual actions and native input behavior.

• Extract application shortcuts and shader-parameter controls into reusable UI components, preserving inputs and cleaning up listeners on rebuild/disposal.

• Extract adaptive panel rail placement and measurement into reusable UI modules, preserving obstacle clearance, responsive allocation, disclosure and scroll behavior.

• Extract shared surface keyboard handling for the welcome launcher and Provider Settings, preserving Tab/Escape behavior and releasing the listener on teardown.

Security

• Validate configured Google Places coordinates and text queries before rate limiting or upstream requests; preserve the keyless capability response.

• Bound CCTV media response headers to 15 seconds and cancel error bodies. Cap buffered snapshot downloads at 16 MiB while streaming.

• Cancel the active location lookup when its controls are disposed.

Fixed

• Extract panel disclosure and hover/focus controls into a reusable module; cancel their listeners and pending work during replacement and teardown.

• Reuse cached military aircraft during adsb.lol rate limits and server errors, honor bounded retry delays, and preserve cached observation times and stale indicators. Show installation zoom guidance without a false LOAD FAILED.

• GBFS rejects upstream redirects, caps streamed responses at 5 MiB, and keeps its deadline active through body reads. Rejected downloads are cancelled.

• Split Overpass/installation search, regional briefing/weather, local voice handlers and standalone key setup into focused modules. Preserve routes, source behavior, tool schemas and credential restrictions.

• Restore data-provider routes under local build preview and return JSON 404s for unmatched API requests. Credential editing remains development-only.

• Extract CCTV catalog/media and Radio Browser directory providers into focused Node modules, preserving their routes and policies and isolating CCTV catalogs by provider instance and application root.

• Simplify POWER UP to one Google Maps entry. Keep the optional server key available through environment configuration without a second setup row or missing-key reminder.

• Separate terrain, traffic, FIRMS and GBFS middleware into focused provider modules, preserving local configuration, routes and cache/error behavior.

• Split satellite and launch-feed server providers into focused modules with portable request URL builders, preserving routes and cache/error behavior.

• Keep landmark names when geocoding returns only address components, preventing the United States Capitol annotation from moving to a Washington hotel. Unrelated outlines leave the valid geocoded marker in place.

• Split aircraft and vessel server providers into focused modules for source fetching, AIS records/tracks and shared request helpers; preserve existing routes, local setup, fallback behavior and rendering.

Changed

• Separate explicit browser build settings from standalone environment loading and local provider middleware. Preserve provider behavior and root named exports.
• Rename standalone browser startup to src/standalone/ and add a Node-only gods-eye-view/build/vite export with checked package ownership.

Development

• Extract application lifecycle and viewer exports. Split standalone startup into scene setup, controls, layer registration, tools and loading UI. Startup failure and terminal shutdown release acquired resources and cancel delayed work.

• Adopt Prettier tooling contributed by RohanDaCoder (#227), with an explicit file scope, pinned formatter and Linux/Windows CI checks. Format the reusable infrastructure modules and their consumer tests. Package boundary checks keep those exports separate from app startup and local Node services.

Fixed

• Reduce terrain-height timeouts when Re:Earth slows down. Batches are sized against measured response latency on both browser and server to reduce request timeouts, and a partial upstream failure now keeps the heights that did resolve rather than discarding them. A position the upstream answers with no height is reported as an absent reading instead of a failed refresh, so the log distinguishes a slow or broken upstream from one that simply has no value for a coordinate.

• Separate optional Google server credentials for Places and Street View from the browser key, contributed by Tom-Neverwinter (#110). Provider Settings, Pinokio's app-specific credential handling and setup diagnostics recognize both keys. The Street View tool prefers the server key across environment and .env sources. Existing single-key and keyless setups remain supported.

• Complete the first-run, view-target prewarm, cockpit-plates and floor-hold browser harness renderer portability fixes contributed by Tom-Neverwinter. macOS retains Metal; other platforms default to SwiftShader. Cockpit renderer assertions and evidence labels follow the actual selected mode. Floor-hold explicitly selects its measured 2D billboard mode and keeps its mesh and terrain assertions; software runs are not real-GPU evidence. First-run QA now checks the existing attribution Escape-close/focus-return behavior while preserving the launcher-underneath regression checks.

• Datacenter and dam factories are available through scoped package exports with explicit context, overlay and render callbacks. The standalone app uses the same implementation and bundled datasets.

• Local GeoJSON layers share concurrent loads, cancel pending fetches on destruction, discard late results, and remove their entity-context records on teardown.

• Unchanged local infrastructure overlays no longer sustain idle rendering. Ground samples wait for visible terrain to settle and cannot place a marker below its loaded surface; roofs and valid below-sea-level heights are retained. Already sampled markers also follow higher terrain as close-up tiles refine.

• Datacenter and dam marker stems use bounded, zoom-dependent active sets with stable selection during camera motion. Close-up stems scale to the actual camera distance; source totals and submarine cables remain unchanged.

• Keyboard focus rings now survive active/selected button styles across the interface. Visual Styles, Location cities and points of interest, search, Context/mission actions, Cockpit utilities, and sliders retain a distinct focus indicator.

• A short Space press activates a focused control only on key release. Holding Space for 500 ms blurs that control before push-to-talk starts, and release is then consumed so it cannot also activate the old control. The same hold works from the map or page background; text-entry controls remain protected.

• The Location disclosure is reachable with Tab and shows keyboard focus; its city, point-of-interest, and search controls do too. Escape from inside the tray returns focus to its disclosure and discards any unfinished search; Escape on the disclosure itself closes the tray and clears that focus.

• Data Layers ON/OFF buttons show a keyboard focus ring independently of their enabled and feed-status colors.

• Display buttons, layout selectors, mode buttons, and sliders show a visible keyboard focus ring, including the controls used in Cockpit Display. Enabled CCTV camera dropdowns also show keyboard focus.

• Context tabs keep a distinct keyboard ring when selected. Their existing Left/Right arrow navigation continues to switch Contacts and Space Missions, and both choices remain reachable through ordinary Tab navigation.

• Tabbing through the Space Missions roster now drives the same temporary globe rotation and mission-marker highlight as pointer hover, without selecting the mission. Keyboard and pointer previews no longer cancel each other.

• Radio power controls, Search Nearby Sites, and Clear Selected Layers retain keyboard focus while their async work is busy. They expose that busy state to assistive technology and ignore repeated activation until the work settles.

• Live Contacts results retain keyboard focus by contact identity when counts, distance order, or pages refresh. If a focused contact departs or rotates off the visible page, focus moves to the named explanatory note at the end of the list and survives later refreshes there, so the next Tab proceeds beyond the list instead of restarting at Contacts or silently selecting another contact.

• Cockpit Live Signals retains keyboard focus during live updates and contact reordering, allowing Tab to continue to Display and Radio. If the focused contact leaves the list, focus moves to the current briefing tab.

• Cockpit-only Display and Radio launchers show complete inset focus rings.

• Escape collapses the nearest expanded panel containing keyboard focus and returns focus to that panel's disclosure when closing from its contents. Escape on the disclosure itself closes without leaving the collapsed control focused. Cockpit Contact and Live Signals panels follow the same nesting rule.

• Cesium's bottom-left Data attribution control and lightbox Close control are in the Tab order and support Enter and Space. Close, Escape, and backdrop dismissal restore focus and synchronize the disclosure state.

• CCTV testing uses the normal launcher for keyless startup, credential loading, localhost binding, and explicit LAN-exposure warnings while retaining its smaller source-pack limits.

• CelesTrak, Launch Library, terrain-height, and aircraft-enrichment failures return generic error messages. Related diagnostics omit raw exception details and upstream error bodies; response statuses and cache fallback remain intact. Includes the security fixes contributed by Tom-Neverwinter in PR #171.

Fixed

• Map Source keyboard opening retries focus until the selected tile is visible. Leaving the disclosure, pointer interaction, or closing the tray cancels the pending handoff so delayed work cannot pull focus back.

• Scope, Bloom, Sharpen, location search and generated style sliders expose explicit accessible names. The first-run checkbox retains its native label.

• FIRMS records a source as successful only after appending its rows, avoiding contradictory success/failure status if aggregation throws.

• Radio country filtering and voice country requests now resolve common English names and exonyms that Intl.DisplayNames' primary label omits, so requests like "play radio in Turkey" no longer fail closed (Turkey → Türkiye, plus Myanmar/Burma, UAE, Holland, Swaziland, East Timor, Cabo Verde, Vatican). Ambiguous names such as a bare "Congo" or "Korea" still fail closed.

• Mapped-site outages show their scheduled retry countdown and distinguish known Overpass rate limits, timeouts, and query failures. Search feedback no longer claims a refresh succeeded while the layer is unavailable or loading.

• Mapped installations retain valid ways and relations that provide bounds but no center. Invalid, inverted, and excessively wide bounds are rejected.

• Clicking a selected installation again or clicking elsewhere clears its selection; later refreshes no longer reclaim it after a click-away.

• Visual presets explain their effects on hover. Unavailable map sources name missing credentials and Provider Settings, while configured-but-failed Google 3D routes explain the failure without asking for another key.

• The Overpass proxy now rotates to the next mirror on any non-2xx upstream response, not only on 5xx. overpass-api.de and its lz4 alias answer 406 to the proxy's User-Agent while two of the configured mirrors answer 200 to the identical request, so the fan-out stopped at the first refusal with healthy mirrors untried. The refusal was also cached to memory and disk and served as data — boundary-class queries hold a month-long TTL — which affected every Overpass-backed feature: road geometry, annotation outlines and place lookup.

• Existing cached refusals are now ignored immediately, including during stale-data fallback. Concurrent identical requests share the same last-good fallback when all mirrors refuse, without duplicating upstream requests.

• A keyless place lookup no longer remembers a network failure as "no such place". A blip while Photon was answering used to be memoized for the rest of the session, so the query kept returning not-found from memory on a network that had since recovered. A miss is now cached only when every source consulted actually returned a verdict.

Added

• Keyless place search. The LOCATION search box and the fly_to_location voice tool now resolve place names through Photon (komoot, over OpenStreetMap) when no Google Maps key is configured — previously the lookup threw. Google stays the primary path and is unchanged when it answers; the fallback also covers a key whose Geocoding API is not enabled, which Google reports as HTTP 200 with REQUEST_DENIED, so an empty result is the detector rather than an error.

• The same keyless fallback now covers the remaining two place lookups: map annotations ("annotate the botanical garden") and the Radio layer's "near <place>" selection. Radio previously threw without a key, which surfaced as a failed voice turn rather than as a station it could not place; annotations silently failed to anchor. Annotation footprints match OSM on the resolved feature's canonical name, so locality words in the request cannot pull the outline onto a neighbouring building.

• Refresh vulnerable transitive dependencies and update browser/image tooling to Puppeteer 25.10.0 and Sharp 0.35.4. Cesium remains on 1.138.0. Browser QA awaits the new asynchronous executable-path lookup.

[0.1.1] — 2026-09-01 — Installation and live-data fixes

Changed

• Tightened the README opening around keyless setup, source freshness, modeled experiences, and the accessibility of the provider stack.

Fixed

• Pinokio now recognizes its nested successful-install marker, so a completed one-click install exposes Start instead of returning to Install.
• The keyless dev-fresh.sh startup summary now names Esri World Imagery with keyless terrain and identifies OpenStreetMap as the fallback.
• All three VIIRS sources now reach the Active Fires layer. Merging a source's detections used argument spread, which exceeds the engine's argument limit on the two largest sources and dropped them entirely — leaving roughly a third of global detections while reporting each dropped source twice, once as successful with its real count and once as failed.
• ./scripts/dev-fresh.sh no longer crashes on stock macOS bash 3.2 when no provider keys are exported: expanding the empty external-keys provenance array under set -u was fatal there. Launches with exported keys are unchanged.

Security

• GBFS proxy body-size cap now measures the response in bytes (Buffer.byteLength) instead of JavaScript string length, so the GBFS_MAX_BODY_BYTES limit holds for multi-byte payloads and cannot be overrun by non-ASCII upstream responses.

[0.1.0] — 2026-08-31 — One-click install, keyless boot, Provider Settings

Added

• One-click install via Pinokio. Keyless boot lands on a live Esri World Imagery satellite globe with keyless terrain; OSM takes over automatically if Esri is unreachable, and the globe continues without terrain if its source is unavailable.
• Provider Settings (the POWER UP panel): add, replace, or remove API keys inside the app. Credential files are made owner-only before any secret is written — verified on macOS and Windows — and keys configured outside the panel are shown read-only, never rewritten.
• Keyless capability responses: the optional HUD summary and place-search endpoints return a deliberate "not configured" success instead of errors, and never consume rate-limit quota.
• .gitattributes normalizes line endings, so Windows clones pass the full test suite out of the box (#81 — thanks @ethanstoner).

Changed

• README rewritten keyless-first around the provider ladder: zero keys → free Cesium ion (eligible personal, non-commercial use) → billing-enabled Google Maps.
• Browser-built data modules no longer import node:fs; a repo-wide boundary scan test keeps it that way (#83 — thanks @ethanstoner).
• Aircraft-identity voice answers explicitly cover operator, type, and route, and say so plainly when enrichment is unavailable instead of guessing.

Security

• Provider Settings answers only local, unproxied requests and disables itself entirely whenever the server is shared. Public datacenter and dam datasets omit contact-oriented fields (see the dataset READMEs).

Pre-release development history

The dated entries and internal milestone numbers below predate the first tagged GitHub Release. They are retained as project history and do not represent previously published GitHub Releases.

[Unreleased] — 2026-08-24

Added

• Added honest aircraft identity narration: callsign, operator, registration, type, and route come only from selected-contact context, and missing operator, route, or type enrichment is named explicitly.
• Added local, publication-compatible copies of the two README PNGs, with source records and third-party-license boundaries in docs/media/README.md.
• Added regression coverage for aircraft identity narration and optional-key loading feedback.

Changed

• First-run presentation now opens with Detection DENSE at 75%, ELASTIC allocation, Fade 7%, Outside 1%, scope feather 11%, and aircraft 3D models in PROXIMITY. Stored state and share links still override these baselines.
• The 17 selected README GIFs remain unchanged and are documented separately from the two owner-published PNGs.
• Bundled datacenter and dam snapshots now omit contact-oriented fields and note values containing email or phone identifiers. Feature geometry, names, operator/capacity/river metadata, counts, and ODbL terms are unchanged.
• Public documentation and the L9 release matrix no longer reference non-public planning material or repository history.

Fixed

• A missing optional FIRMS key no longer turns the complete Environmental mission into LOAD FAILED. The FIRMS row still reports KEY REQUIRED, while earthquakes continue to load. Real lifecycle and fetch failures retain failure priority.
• The mapped-installations layer retries after an unavailable request when it is enabled or the camera settles.
• Aircraft trails attach to the rendered aircraft transform and remain near the rear center across headings. Parked aircraft do not draw a moving head segment.
• Grounded aircraft keep validated floor evidence through temporary terrain outages and wait for measured photoreal-surface evidence before a 3D model takes over from its billboard.
• Cockpit altitude uses aviation MSL data rather than Cesium render height.

Security

• Production transitive dependencies resolve to patched DOMPurify and protobufjs releases without changing the Cesium version or application APIs.
• Production dependency audit reports no known advisories; remaining audit findings are confined to development and QA tooling.

[Unreleased] — 2026-08-23

Added

• Added a first-run mission launcher for Contacts, Space Missions, Environmental, and manual exploration.
• Added terrain-validity gating and bounded last-known placement for grounded aircraft models.

Changed

• Environmental consistently presents both earthquakes and NASA FIRMS fires, with honest optional-key degradation.
• The tracked aircraft trail acceptance bar is visual: roughly rear-center, stable across headings, with minor hull overlap allowed and no conspicuous top, bottom, or lateral projection.

[Unreleased] — 2026-08-18 to 2026-08-22

Added

• Added the four-source Map Source tray, share-link v2 state, cockpit/context voice parity, MSL altitude readouts, and close-range tracked aircraft models.
• Added the L9 release-candidate matrix, AIS feed watchdog, voice cost controls, satellite classes, and the shared world-overlay host.
• Added deterministic first-run, map-source, floor, overlay, tracking, and aircraft-model regression harnesses.

Changed

• Consolidated world labels, cards, tracked readouts, CCTV thumbnails, cable labels, mission labels, and detection presentation under shared allocation and lifecycle rules.
• Reduced idle rendering through the render governor and explicit scope mask.
• Improved cockpit layout, context restoration, keyless feed honesty, and aircraft 2D/3D handoffs.

Fixed

• Fixed degenerate depth picks, map-source restore states, route-camera motion, bright-ground label readability, grounded display flooring, and cross-layer tracking cleanup.
• Fixed stale overlay callbacks, parked-idle render leaks, cable-label sweep starvation, and several share-link state conflicts.

[Unreleased] — 2026-08-02 to 2026-08-16

Added

• Added Global Context modes, Cockpit briefing surfaces, Radio context, satellite mission replay, and real per-class aircraft models with adjacent provenance records.
• Added a shared screen-space overlay system with bounded allocation for labels, cards, callouts, detection brackets, and selected-object presentation.

Changed

• Unified right-side product controls and responsive cockpit/map layouts.
• Migrated public-safe neighborhood geometry to DataSF and tightened safe local development defaults.
• Improved proxy resilience, annotation outline bounds, CCTV enable pacing, contact de-emphasis, and deterministic visual stacking.

[Unreleased] — July 2026

Added

• Added live NASA FIRMS fires, optional live TomTom traffic, Caltrans and TfL CCTV packs, CCTV viewsheds and direct-manipulation calibration, citywide CCTV cards, Natural Earth regions, analyst queries, and voice routing QA.
• Added the end-to-end vertical-datum system for aircraft, vessels, CCTV, annotations, trails, and terrain-aware rendering.
• Added aircraft class silhouettes, path-derived display heading, ADSBDB enrichment, cached CelesTrak TLE lookup, and next-ISS-pass prediction.

Fixed

• Fixed elevated-airport aircraft placement, vessel sea-surface placement, close-zoom FIRMS anchors, antimeridian region framing, annotation resolution, cross-layer tracking ownership, and CCTV projection lifecycle issues.

[Unreleased] — June 2026

Added

• Added OpenAI Realtime voice control, scene-aware entity context, viewport image grounding, the AI HUD summary, live AIS vessels, infrastructure layers, map source switching, free-text navigation, and server-side data proxies.
• Added hybrid map annotations, 3D aircraft, panoptic detection, tracking harnesses, and public data attribution.
• Added MIT source licensing, security guidance, contribution guidance, data source notices, and third-party asset boundaries.

Changed

• Removed the experimental AI video-edit style and retained seven deterministic visual styles.
• Moved Realtime text-history trimming to the server-side retention policy while keeping only the latest viewport image in conversation context.

[0.7.0] — 2026-02-18

• Added the Bikeshare Pulse layer and panoptic label improvements.
• Improved tracked-item boxes, post-render alignment, and CCTV projection quality.
• Removed the experimental shift-drag CCTV calibration interaction.

[0.6.0] — 2026-02-10

• Added the initial multi-layer 3D globe experience, visual styles, live aircraft, satellites, earthquakes, CCTV, traffic, FIRMS, infrastructure, and performance controls.
• Added entity inspection, tracking, scenes, keyboard controls, and shareable views.

[0.1.0] — 2026-02-09

• Initial project version.