Sync stable with the deployed racing, track creator and VR release

.github/workflows/android-test.yml

@@ -3,10 +3,39 @@ name: Android test package
 on:
   workflow_dispatch:
     inputs:
+      native_live:
+        description: Verify native account SDK with the owned temporary staging identity
+        type: boolean
+        default: false
+      native_only:
+        description: Run only the live SDK journey, reusing existing widget evidence
+        type: boolean
+        default: false
+      dependency_proposal:
+        description: Resolve proposed new SDK locks/checksums for review (not release verification)
+        type: boolean
+        default: false
       launch_check:
         description: Verify native cold launch, offline recovery and retry
         type: boolean
         default: true
+      widget_check:
+        description: Verify the native Portal widget and Trail in an owned emulator
+        type: boolean
+        default: false
+      layout_stage:
+        description: Current layout checkpoint to collect
+        type: choice
+        options: [all, compact]
+        default: all
+      layout_only:
+        description: Collect widget layouts only; reuses separately accepted functional checks
+        type: boolean
+        default: false
+      widget_only:
+        description: Check only debug widget interactions (does not verify a release package)
+        type: boolean
+        default: false
   push:
     branches: [steven/android-testing]
     paths: ['android/**', '.github/workflows/android-test.yml']
@@ -19,7 +48,36 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  dependency-proposal:
+    if: github.event_name == 'workflow_dispatch' && inputs.dependency_proposal
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
+        with:
+          distribution: temurin
+          java-version: '21'
+      - name: Install the targeted Android platform
+        run: '"${ANDROID_HOME:?}/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"'
+      - name: Resolve proposed dependency metadata and compile for review
+        working-directory: android
+        run: ./gradlew --no-daemon --max-workers=2 --write-verification-metadata sha256 --write-locks :app:lintRelease :app:assembleRelease :app:assembleDebug
+      - name: Retain dependency proposal and compile diagnostics
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: android-dependency-proposal
+          path: |
+            android/app/gradle.lockfile
+            android/gradle/verification-metadata.xml
+            android/app/build/reports/lint-results-release.*
+          retention-days: 30
+          if-no-files-found: error
   android:
+    if: github.event_name != 'workflow_dispatch' || !inputs.dependency_proposal
     runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
@@ -32,10 +90,19 @@ jobs:
           java-version: '21'
       - name: Install the targeted Android platform
         run: '"${ANDROID_HOME:?}/cmdline-tools/latest/bin/sdkmanager" "platforms;android-36" "build-tools;36.0.0"'
+      - name: Validate diagnostic layout selection
+        if: github.event_name == 'workflow_dispatch' && inputs.layout_only
+        env:
+          VALID_LAYOUT_SELECTION: ${{ inputs.widget_only && inputs.widget_check && !inputs.launch_check && !inputs.native_live && !inputs.native_only }}
+        run: test "$VALID_LAYOUT_SELECTION" = true
+      - name: Verify shared native presentation tokens
+        run: node scripts/build-native-roam-theme.mjs --check
       - name: Build and lint unsigned packages
+        if: github.event_name != 'workflow_dispatch' || !inputs.widget_only
         working-directory: android
         run: ./gradlew --no-daemon --max-workers=2 --dependency-verification strict :app:lintRelease :app:bundleRelease :app:assembleRelease
       - name: Prepare package evidence and local signing tool
+        if: github.event_name != 'workflow_dispatch' || !inputs.widget_only
         run: |
           mkdir -p android-artifacts
           cp android/app/build/outputs/bundle/release/app-release.aab android-artifacts/
@@ -47,8 +114,29 @@ jobs:
           "$ANDROID_HOME/build-tools/36.0.0/aapt2" dump badging android-artifacts/app-release-unsigned.apk > android-artifacts/package-badging.txt
           git rev-parse HEAD > android-artifacts/source-commit.txt
           (cd android-artifacts && sha256sum * > SHA256SUMS)
+      - name: Build the native widget verification host
+        if: github.event_name == 'workflow_dispatch' && inputs.widget_check
+        working-directory: android
+        run: ./gradlew --no-daemon --max-workers=2 --dependency-verification strict :app:assembleDebug
+      - name: Verify native Portal widgets
+        if: github.event_name == 'workflow_dispatch' && inputs.widget_check
+        timeout-minutes: 12
+        env:
+          WE3D_PORTAL_ANDROID_ACCEPTANCE: ${{ inputs.native_live && secrets.WE3D_PORTAL_ANDROID_ACCEPTANCE || '' }}
+          WE3D_PORTAL_NATIVE_ONLY: ${{ inputs.native_only }}
+          WE3D_PORTAL_LAYOUT_ONLY: ${{ inputs.layout_only }}
+          WE3D_PORTAL_LAYOUT_STAGE: ${{ inputs.layout_stage }}
+        run: bash scripts/verification/android-portal-widget.sh
+      - name: Preserve native widget evidence
+        if: always() && github.event_name == 'workflow_dispatch' && inputs.widget_check
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: android-widget-evidence
+          path: android-widget-evidence/
+          retention-days: 30
+          if-no-files-found: warn
       - name: Verify Android launch and connection recovery
-        if: github.event_name != 'workflow_dispatch' || inputs.launch_check
+        if: github.event_name != 'workflow_dispatch' || (inputs.launch_check && !inputs.widget_only)
         timeout-minutes: 12
         run: bash scripts/verification/android-cold-launch.sh
       - name: Preserve Android launch evidence
@@ -60,6 +148,7 @@ jobs:
           retention-days: 30
           if-no-files-found: warn
       - name: Retain the exact unsigned package and evidence
+        if: always() && (github.event_name != 'workflow_dispatch' || !inputs.widget_only)
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: world-explorer-android-${{ github.sha }}

.github/workflows/apple-portal.yml

@@ -0,0 +1,79 @@
+name: Apple Portal native acceptance
+
+on:
+  workflow_dispatch:
+    inputs:
+      app_only:
+        description: Run changed native app views; reuse accepted widget checks
+        type: boolean
+        default: false
+      widget_only:
+        description: Run widget layouts and Home Screen journey; reuse accepted app checks
+        type: boolean
+        default: false
+      native_live:
+        description: Exercise native SDK ownership with the owned temporary staging identity
+        type: boolean
+        default: false
+  push:
+    branches: [steven/living-portal-vr]
+    paths: ['apple/**', 'scripts/verification/apple-portal.sh', '.github/workflows/apple-portal.yml']
+
+permissions:
+  contents: read
+concurrency:
+  group: apple-portal-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  native:
+    # The push trigger registers this feature-branch workflow. Native acceptance
+    # itself is dispatched deliberately so each committed change is tested once.
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: macos-26
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Verify the pinned project generator
+        run: |
+          node scripts/build-native-roam-theme.mjs --check
+          curl --fail --location --silent --show-error https://github.com/yonaskolb/XcodeGen/releases/download/2.46.0/xcodegen.zip -o "$RUNNER_TEMP/xcodegen.zip"
+          printf '%s  %s\n' '4d9e34b62172d645eed6457cac13fc222569974098ef4ee9c3368bedf0196806' "$RUNNER_TEMP/xcodegen.zip" | shasum -a 256 -c -
+          unzip -q "$RUNNER_TEMP/xcodegen.zip" -d "$RUNNER_TEMP/xcodegen"
+          "$RUNNER_TEMP/xcodegen/xcodegen/bin/xcodegen" generate --spec apple/project.yml
+      - name: Restore pinned SDK compilation
+        id: apple_sdk_cache
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          key: apple-sdk-${{ runner.os }}-${{ runner.arch }}-xcode26.6-v1-${{ hashFiles('apple/Package.resolved', 'apple/project.yml') }}
+          path: |
+            ${{ runner.temp }}/we3d-apple-packages
+            ${{ runner.temp }}/we3d-apple-derived/Build
+            ${{ runner.temp }}/we3d-apple-derived/ModuleCache.noindex
+            ${{ runner.temp }}/we3d-apple-derived/SDKStatCaches.noindex
+      - name: Build and exercise the native app in one owned simulator
+        id: native
+        env:
+          WE3D_PORTAL_APPLE_ACCEPTANCE: ${{ inputs.native_live && secrets.WE3D_PORTAL_APPLE_ACCEPTANCE || '' }}
+          WE3D_PORTAL_APPLE_WIDGET_ONLY: ${{ inputs.widget_only }}
+          WE3D_PORTAL_APPLE_APP_ONLY: ${{ inputs.app_only }}
+        run: bash scripts/verification/apple-portal.sh
+      - name: Retain compiled SDKs after a completed build
+        if: always() && steps.native.outputs.sdk_built == 'true' && steps.apple_sdk_cache.outputs.cache-hit != 'true' && !inputs.native_live
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          key: ${{ steps.apple_sdk_cache.outputs.cache-primary-key }}
+          path: |
+            ${{ runner.temp }}/we3d-apple-packages
+            ${{ runner.temp }}/we3d-apple-derived/Build
+            ${{ runner.temp }}/we3d-apple-derived/ModuleCache.noindex
+            ${{ runner.temp }}/we3d-apple-derived/SDKStatCaches.noindex
+      - name: Retain bounded diagnostics, pins and native screenshots
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: apple-portal-evidence
+          path: apple-portal-evidence/
+          retention-days: 30
+          if-no-files-found: warn

.github/workflows/release-verify.yml

@@ -66,6 +66,9 @@ jobs:
       - name: Install backend dependencies
         run: npm ci --prefix functions
 
+      - name: Install racing service dependencies
+        run: npm ci --prefix services/racing
+
       - name: Install Firebase release tooling
         run: npm install --global [email protected]
 

.github/workflows/runtime-verify.yml

@@ -38,6 +38,9 @@ jobs:
       - name: Install backend dependencies
         run: npm ci --prefix functions
 
+      - name: Install racing service dependencies
+        run: npm ci --prefix services/racing
+
       - name: Bounded pull-request verification
         run: npm run verify:pr
 
@@ -79,6 +82,9 @@ jobs:
       - name: Install backend dependencies
         run: npm ci --prefix functions
 
+      - name: Install racing service dependencies
+        run: npm ci --prefix services/racing
+
       - name: Verify patched Python and pip
         run: |
           python -c "import sys; assert (3, 13, 17) <= sys.version_info[:3] < (3, 14, 0), 'Patched Python 3.13.17 or later 3.13 required'"

ATTRIBUTION.md

@@ -11,6 +11,11 @@ This is the concise public attribution index. Asset-level details are in `app/as
 - ESA WorldCover 2021: contains modified Copernicus Sentinel data processed by the ESA WorldCover consortium, CC BY 4.0. <https://esa-worldcover.org/>
 - GEBCO Compilation Group bathymetry: CC BY 4.0. <https://www.gebco.net/>
 - Mapzen Terrarium elevation service and upstream elevation sources: provider terms apply.
+- Environment Agency LIDAR Composite 2022 terrain: Environment Agency copyright
+  and/or database right 2022. All rights reserved. Modified under the
+  [Open Government Licence v3](https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).
+  Source, normalization and precision evidence is retained in each ground manifest.
+- Racing geographic packs: [source-level attribution and adapted-data recipes](app/assets/racing/ATTRIBUTION.md).
 
 ### DeFlock Hunt
 

CHANGELOG.md

@@ -2,6 +2,26 @@
 
 Notable user-facing changes are recorded here. Git history and GitHub releases contain the complete change record.
 
+## Racing and track creation — deployed 2026-10-31
+
+- Added complete Silverstone GP and pit access, full Nordschleife T13, and
+  Daytona tri-oval with its pit branch; other researched venue packs are deferred.
+- Added the real BMW M3 E46, BMW M3 E92 race car and Porsche 911 Carrera 4S
+  models with existing garage ownership, upgrades and condition.
+- Repaired driving/camera frame interpolation and verified steady held input.
+- Connected racing barrier damage, condition-dependent handling, reconnect
+  and garage handback through the existing vehicle owners.
+- Added one creator workspace for overhead road selection, drive recording
+  and supported roadless tracks, with editable clean layouts and continuous
+  highlights and event barriers.
+- Added current-room track sharing and unranked Journal results, while
+  retaining reviewed public competition, class leaderboards and reward rules.
+- Deployed and verified the coordinated racing service, protected account
+  APIs, required indexes and all three venue catalogues with normal production
+  App Check and authenticated WebSocket access.
+
+[Player guide and release notes](RELEASE_NOTES_RACING.md).
+
 ## [5.6.1] - 2026-10-19
 
 - Local road-detail recovery keeps the selected world and player in place.

CONTRIBUTING.md

@@ -110,10 +110,26 @@ dependency locks in Git. Their workflows build in owned emulators/simulators.
 Release signing material and temporary live-test identities stay outside Git;
 they must never enter screenshots, uploaded logs or build artifacts.
 
+`scripts/verification/web-startup-current.mjs` checks a failed essential file,
+explicit reload and slow startup in one selected browser engine. Run it through
+`scripts/verification/attested-source-check.mjs` with authorized staging access.
+`WE3D_STARTUP_WORLD=1` adds one city entry; `WE3D_STARTUP_PHASE=world-only` reuses
+accepted startup checks when only a world journey needs investigation. Optional
+allocation profiling and regional settling are diagnostics, not phone performance
+acceptance. Keep their output private and reuse applicable successful results.
+
 ## 8. OSM-Facing Quality Bar
 
 For map/data path changes:
 
 - keep OSM attribution visible and accurate
 - avoid exaggerated performance or coverage claims
 - document known tradeoffs/limitations explicitly
+
+For an admitted mobile context change, reuse accepted startup cases with
+`WE3D_STARTUP_WORLD=1 WE3D_STARTUP_PHASE=world-only WE3D_STARTUP_SETTLE=1
+WE3D_STARTUP_LOAD_PLAN=1` and the same attested wrapper. This runs one real
+Baltimore load, input, complete regional publication, nearby location replacement
+and owned world release. It checks the shared mobile context boundary; it does
+not qualify physical-phone performance. Do not combine this release flag with
+the independent graphics-loss journey, which needs an active world.

README.md

@@ -1,6 +1,6 @@
 # World Explorer 3D
 
-[5.6.1 release notes](RELEASE_NOTES_5.6.1.md) · [Known limitations](KNOWN_ISSUES.md) · [Roadmap](ROADMAP.md)
+[Racing update](RELEASE_NOTES_RACING.md) · [5.6.1 release notes](RELEASE_NOTES_5.6.1.md) · [Known limitations](KNOWN_ISSUES.md) · [Roadmap](ROADMAP.md)
 
 [![Play in your browser](https://img.shields.io/badge/Play-in_your_browser-1677ff?style=flat-square)](https://worldexplorer3d.io/app/)
 [![Latest release](https://img.shields.io/github/v/release/RRG314/WorldExplorer3D?sort=date&style=flat-square&label=release)](https://github.com/RRG314/WorldExplorer3D/releases/latest)
@@ -26,6 +26,27 @@ remain part of the same game.
   · <a href="ROADMAP.md">Roadmap</a>
 </p>
 
+## Race real places and create your own tracks
+
+The racing update is live. Drive Silverstone's full GP loop and pit lane,
+the full Nordschleife T13 layout, or Daytona's tri-oval and pit branch. The
+BMW M3 E46, BMW M3 E92 race car and Porsche 911 Carrera 4S share your existing
+garage, upgrades and vehicle condition. Barrier damage affects handling and
+returns with the car to your garage.
+
+Open **Racing → Create track** to choose connected roads on the overhead map,
+record a drive, or place a clean marked circuit on supported open ground.
+Preview, edit and test the layout, save it locally, or share it with your
+current multiplayer room. Room-created tracks are unranked; reviewed public
+races keep their separate leaderboards and reward rules.
+
+Practice results go to your Journal. Room racing, rivals and crews use the
+same Explorer account, vehicles and progression. Existing location-based play,
+optional continuous exploration, buildings, Ocean, Space and saves remain
+available.
+
+[Read the racing update and how to start](RELEASE_NOTES_RACING.md).
+
 ## Explore by land, sea, air and space
 
 Search for a city, landmark, airport, harbor or coordinates. Walk its streets,