@@ -33,10 +33,12 @@ TRENITALIA_REGION=5
 # RT_TRIP_UPDATES_URL=https://romamobilita.it/wp-content/uploads/shared/rome_rtgtfs_trip_updates_feed.pb
 RT_POLL_SECS=30
 
-# FL NeTEx→GTFS (worker): the official Lazio NeTEx is placed at GATEWAY_NETEX_PATH
-# (the CCISS NAP is login-gated), or fetched from NETEX_URL if reachable.
+# FL NeTEx→GTFS (worker): auto-downloads the Lazio NeTEx from the Italian NAP
+# (CCISS public endpoint, no auth) by default — RAP Lazio L2. Set NETEX_URL=
+# (empty) to disable the fetch and use a file placed at GATEWAY_NETEX_PATH, or
+# point it at another NAP asset.
+# NETEX_URL=https://www.cciss.it/nap/mmtis/public/api/v1/download/blob/Asset/663391/checkedResource
 # GATEWAY_NETEX_PATH=/data/netex/trenitalia-fl.netex.xml.gz
-# NETEX_URL=
 
 # ─── Observability (operator-local; never phones home) ───────────────────────
 ITER_LOG=info
 
@@ -62,9 +62,10 @@ Commit history.
   concave-hulls + per-direction platform strips + named exits).
 - **Worker** — a graceful-shutdown job scheduler. **FL NeTEx→GTFS** (`fl-gtfs`):
   a streaming `quick-xml` parser (over a `flate2` gunzip) converts the official
-  Lazio NeTEx into a routable GTFS the OTP graph build consumes — proven on the
-  real ~58 MB CCISS dataset (450 stops, 5 routes, 1,594 trips, 20,617 stop_times,
-  zero loss; ADR 0016). Plus **GTFS-RT ingestion** (`rt-reliability`): polls
+  Lazio NeTEx into a routable GTFS the OTP graph build consumes, auto-downloaded
+  from the Italian NAP (CCISS public endpoint) — proven on the real ~58 MB
+  dataset (450 stops, 5 routes, 1,594 trips, 20,617 stop_times, zero loss; ADR
+  0016). Plus **GTFS-RT ingestion** (`rt-reliability`): polls
   ATAC's trip-updates feed,
   decodes it with a vendored `prost` GTFS-RT subset (no `protoc`), and derives
   validated stop-delay events keyed on the stable (route, direction, stop,
 
@@ -17,7 +17,7 @@ Sources: `concept doc 29` §4 and
 | **GTFS — ATAC / Roma Servizi** (static + realtime) | CC-BY 3.0 | `CC-BY-3.0` | `Roma Servizi per la Mobilità S.r.l.` |
 | **GTFS — COTRAL** (Lazio extra-urban bus) | **TBD / undeclared** 🔴 | — | — (must be cleared before public production) |
 | **GTFS — COTRAL-FERRO** (Lazio regional railways) | **TBD / undeclared** 🔴 | — | — (must be cleared before public production) |
-| **Trenitalia FL** (regional trains, NeTEx via CCISS NAP) | **TBD / undeclared** 🔴 | — | — (must be cleared before public production) |
+| **Trenitalia FL** (regional trains, NeTEx via CCISS NAP) | **`no_licence_no_contract`** 🔴 | — | open access via the NAP (EU MMTIS regime) but no explicit reuse/redistribution grant — clear with Regione Lazio before public production |
 | **House numbers (civici)** — Overture / ANNCSU | CC-BY 4.0 | `CC-BY-4.0` | double: `Overture / OpenAddresses` **and** `ISTAT / Agenzia delle Entrate — ANNCSU` |
 | **Glyphs (Noto Sans)** | SIL OFL 1.1 | `OFL-1.1` | bundle license + copyright with the served font files |
 | **Komoot Photon** Italy geocoding dump (derives from OSM) | ODbL 1.0 | `ODbL-1.0` | `© OpenStreetMap contributors` |
 
@@ -33,14 +33,13 @@ impl Job for FlGtfsBuild {
     }
 
     async fn run(&self) -> anyhow::Result<()> {
-        // Optionally fetch the NeTEx; a failure is a warning (we fall back to a
-        // previously-placed file).
-        if !exists(&self.netex_path).await
-            && let Some(url) = &self.netex_url
-        {
+        // When a URL is set, refresh the NeTEx on every run (the daily cadence
+        // is the refresh) — a failure is a warning, and we fall back to a
+        // previously-placed/fetched file.
+        if let Some(url) = &self.netex_url {
             tracing::info!(url, "fl-gtfs: fetching NeTEx");
             if let Err(e) = download(&self.http, url, &self.netex_path).await {
-                tracing::warn!(error = %e, "fl-gtfs: NeTEx download failed");
+                tracing::warn!(error = %e, "fl-gtfs: NeTEx download failed; using existing file");
             }
         }
 
@@ -79,7 +78,14 @@ async fn download(client: &reqwest::Client, url: &str, dest: &Path) -> anyhow::R
     let mut tmp = dest.to_path_buf().into_os_string();
     tmp.push(".tmp");
     let tmp = PathBuf::from(tmp);
-    let mut resp = client.get(url).send().await?.error_for_status()?;
+    // The NAP `checkedResource` is large and slow to stream; override the
+    // client's short default with a generous per-request timeout.
+    let mut resp = client
+        .get(url)
+        .timeout(Duration::from_secs(300))
+        .send()
+        .await?
+        .error_for_status()?;
     let mut file = tokio::fs::File::create(&tmp).await?;
     while let Some(chunk) = resp.chunk().await? {
         file.write_all(&chunk).await?;
 
@@ -29,7 +29,14 @@ async fn main() -> anyhow::Result<()> {
             // The FL GTFS lands next to the other graph inputs (steps/gtfs.rs
             // skips netex feeds, leaving this slot for the worker).
             out_path: data_dir.join("graph/TRENITALIA-FL.gtfs.zip"),
-            netex_url: config::opt("NETEX_URL"),
+            // The FL NeTEx auto-downloads from the Italian NAP (CCISS) public
+            // endpoint — RAP Lazio L2 (the L1 superset). Override or set empty
+            // (NETEX_URL=) to use a file placed at GATEWAY_NETEX_PATH instead.
+            netex_url: Some(config::or(
+                "NETEX_URL",
+                "https://www.cciss.it/nap/mmtis/public/api/v1/download/blob/Asset/663391/checkedResource",
+            ))
+            .filter(|u| !u.is_empty()),
             http: http.clone(),
         }),
         Box::new(jobs::rt_reliability::RtReliability::from_env(http)),
 
@@ -31,8 +31,10 @@ deps):
 - emit a referentially-complete GTFS zip (agency/stops/routes/calendar/trips/
   stop_times), dropping only rows that can't resolve, written atomically to
   `<graph>/TRENITALIA-FL.gtfs.zip` where the OTP graph build picks it up;
-- the FL job runs on startup + daily; `NETEX_URL`, if set, fetches the file first,
-  else it's placed at `GATEWAY_NETEX_PATH`.
+- the FL job runs on startup + daily and **auto-downloads** the NeTEx from the
+  Italian NAP (CCISS) public endpoint on each run (`NETEX_URL`, default the RAP
+  Lazio L2 asset) — the daily cadence is the refresh; set `NETEX_URL=` empty to
+  use a file placed at `GATEWAY_NETEX_PATH` instead.
 
 ## Consequences
 
@@ -46,8 +48,12 @@ deps):
   window — it does **not** yet expand the `UicOperatingPeriod` bit-patterns into
   `calendar_dates` exceptions; for a single-week window this is faithful, but a
   longer feed with holiday exceptions would need that refinement.
-- **NAP auto-download is unsolved** (login-gated). The job fetches `NETEX_URL`
-  when reachable; otherwise the file is placed manually.
+- **NAP auto-download works**: the CCISS NAP serves the NeTEx over an
+  unauthenticated HTTP GET (no login), so the job fetches it directly. The
+  default pins a stable asset id; if the NAP rotates ids, resolving the asset by
+  filename from the NAP catalog JSON is the documented fallback. The data carries
+  `no_licence_no_contract` (NAP access regime, redistribution unstated — see
+  `DATA_LICENSES.md`).
 - Shapes (`shapes.txt`) are not stitched (OTP routes without them); a future
   refinement can derive them from OSM rail.
 
 
@@ -46,10 +46,9 @@ flagged per item.
 - **FL NeTEx→GTFS** ✅ done (ADR 0016) — the worker streams the official Lazio
   NeTEx (quick-xml over gunzip) into a routable GTFS the OTP graph build consumes;
   proven on the real ~58 MB CCISS dataset (450 stops / 5 routes / 1,594 trips /
-  20,617 stop_times, zero loss). **Remaining:** `UicOperatingPeriod` →
-  `calendar_dates` exceptions, `shapes.txt` stitching from OSM rail, and **NAP
-  auto-download** (login-gated; `NETEX_URL` fetches a reachable file, else it's
-  placed manually).
+  20,617 stop_times, zero loss). Auto-downloads from the Italian NAP (CCISS)
+  public endpoint each run. **Remaining:** `UicOperatingPeriod` →
+  `calendar_dates` exceptions and `shapes.txt` stitching from OSM rail.
   Design: concept doc 11 — gateway-and-external-providers · Decision: ADR 0016.
 
 ## 2. Remaining Rust capabilities