Deploy AIOS web (React glide grid + FastAPI slice)

RELEASES.json

@@ -1,6 +1,12 @@
 {
- "current": "v45 (0b2b501)",
+ "current": "v46 (a8dc531)",
  "releases": [
+  {
+   "version": "v46",
+   "sha": "a8dc531",
+   "date": "2026-08-23",
+   "subject": "release v46"
+  },
   {
    "version": "v45",
    "sha": "0b2b501",

VERSION

@@ -1 +1 @@
-v45 (0b2b501)
+v46 (a8dc531)

api/routes_geo.py

@@ -1,348 +1,407 @@
-"""routes_geo.py — the MAP PROVIDER SEAM (wave 37, R3/R14, tickets T35/T36/T37).
-
-⭐ WHY THIS FILE EXISTS AT ALL, and why the map does not simply call a vendor.
-
-R14 (owner, 2026-08-19): no Google Maps API key this wave. The map work is not dropped, it is
-retargeted to providers that need no key: OpenStreetMap tiles, OSRM routing, Nominatim geocoding.
-The deferral only holds if swapping a paid vendor back in is a CONFIG change rather than a rewrite,
-so every provider is a (base URL + attribution) pair read from the environment and served from ONE
-door. The renderer receives a URL template and a credit line; it knows nothing about who is behind
-them. That is the seam.
-
-    tiles     AIOS_MAP_TILE_URL           default  https://tile.openstreetmap.org/{z}/{x}/{y}.png
-    geocode   AIOS_GEOCODE_URL            default  https://nominatim.openstreetmap.org/search
-    routing   AIOS_ROUTE_URL              default  https://router.project-osrm.org/route/v1/driving/
-
-⛔ R3'S ON-DEMAND RULE, AND WHY IT IS STRUCTURAL HERE RATHER THAN A COMMENT.
-R3 forbids geocoding a whole table automatically. Under R14 the reason moves from money to manners
-and gets sharper: Nominatim's usage policy allows roughly one request per second and explicitly
-forbids bulk harvesting, so a loop over 3,636 customers does not produce a bill, it produces a
-BLOCKED tenant. Three mechanisms enforce it, none of them advisory:
-
-  1. `/geo/geocode` takes an explicit LIST OF ADDRESSES from the caller. It cannot read a table, so
-     there is no code path from "a database exists" to "its rows were geocoded". Somebody had to
-     choose the records.
-  2. `MAX_BATCH` refuses an oversized list with a named error rather than truncating it. The client
-     drives the loop and can therefore SHOW the wait, which is the half of the ticket a comment
-     cannot satisfy.
-  3. `_throttle()` blocks in-process until the minimum interval has elapsed, so even a caller that
-     ignores everything above cannot exceed the published rate.
-
-⭐ AND A CACHE, because the policy asks for one: an address geocoded once is answered from memory
-for the rest of the container's life. It is the cheapest way to be a good citizen and it makes a
-re-run of the same records free rather than merely legal.
-
-⚠ NOTHING HERE PROXIES TILES. Tiles are fetched by the BROWSER, straight from the provider, which
-is what every OSM client does and what the tile policy expects. Proxying them through this app
-would put a free tier in the path of every pan and would breach the same policy it looks like it is
-respecting. This door serves the tile URL, never the tile.
-"""
-import os
-import re
-import threading
-import time
-from collections import OrderedDict
-
-import requests
-from fastapi import APIRouter, Body, Depends
-
-from deps import Session, err, require_session
-
-router = APIRouter(prefix="/api/v1")
-
-# --------------------------------------------------------------------- the seam
-#
-# Every value below is an environment override with a keyless default. Pointing the map at a paid
-# vendor is three variables on the Space and no code change, which is what makes R14 a deferral.
-
-_TILE_URL_DEFAULT = "https://tile.openstreetmap.org/{z}/{x}/{y}.png"
-_TILE_CREDIT_DEFAULT = "© OpenStreetMap contributors"
-_TILE_CREDIT_HREF_DEFAULT = "https://www.openstreetmap.org/copyright"
-_GEOCODE_URL_DEFAULT = "https://nominatim.openstreetmap.org/search"
-_ROUTE_URL_DEFAULT = "https://router.project-osrm.org/route/v1/driving/"
-
-#: Both policies require a real, identifying User-Agent. A generic one is how a shared service
-#: decides an application is a scraper, so this carries the product name and a contact URL.
-_UA_DEFAULT = "AIOS-Loopable/1.0 (+https://runloopable.com)"
-
-#: Nominatim publishes one request per second. 1100 ms leaves room for clock jitter rather than
-#: sitting exactly on the published edge.
-_MIN_INTERVAL_MS_DEFAULT = 1100
-
-#: The most addresses one call may carry. Small on purpose: the client loops and shows progress,
-#: and no single request can sit on the connection for a minute waiting out the throttle.
+"""routes_geo.py — the MAP PROVIDER SEAM (wave 37, R3/R14, tickets T35/T36/T37).
+
+⭐ WHY THIS FILE EXISTS AT ALL, and why the map does not simply call a vendor.
+
+R14 (owner, 2026-08-19): no Google Maps API key this wave. The map work is not dropped, it is
+retargeted to providers that need no key: OpenStreetMap tiles, OSRM routing, Nominatim geocoding.
+The deferral only holds if swapping a paid vendor back in is a CONFIG change rather than a rewrite,
+so every provider is a (base URL + attribution) pair read from the environment and served from ONE
+door. The renderer receives a URL template and a credit line; it knows nothing about who is behind
+them. That is the seam.
+
+    tiles     AIOS_MAP_TILE_URL           default  https://tile.openstreetmap.org/{z}/{x}/{y}.png
+    geocode   AIOS_GEOCODE_URL            default  https://nominatim.openstreetmap.org/search
+    routing   AIOS_ROUTE_URL              default  https://router.project-osrm.org/route/v1/driving/
+    walking   AIOS_ROUTE_URL_WALKING      default  https://routing.openstreetmap.de/routed-foot/route/v1/driving/
+
+⛔ R3'S ON-DEMAND RULE, AND WHY IT IS STRUCTURAL HERE RATHER THAN A COMMENT.
+R3 forbids geocoding a whole table automatically. Under R14 the reason moves from money to manners
+and gets sharper: Nominatim's usage policy allows roughly one request per second and explicitly
+forbids bulk harvesting, so a loop over 3,636 customers does not produce a bill, it produces a
+BLOCKED tenant. Three mechanisms enforce it, none of them advisory:
+
+  1. `/geo/geocode` takes an explicit LIST OF ADDRESSES from the caller. It cannot read a table, so
+     there is no code path from "a database exists" to "its rows were geocoded". Somebody had to
+     choose the records.
+  2. `MAX_BATCH` refuses an oversized list with a named error rather than truncating it. The client
+     drives the loop and can therefore SHOW the wait, which is the half of the ticket a comment
+     cannot satisfy.
+  3. `_throttle()` blocks in-process until the minimum interval has elapsed, so even a caller that
+     ignores everything above cannot exceed the published rate.
+
+⭐ AND A CACHE, because the policy asks for one: an address geocoded once is answered from memory
+for the rest of the container's life. It is the cheapest way to be a good citizen and it makes a
+re-run of the same records free rather than merely legal.
+
+⚠ NOTHING HERE PROXIES TILES. Tiles are fetched by the BROWSER, straight from the provider, which
+is what every OSM client does and what the tile policy expects. Proxying them through this app
+would put a free tier in the path of every pan and would breach the same policy it looks like it is
+respecting. This door serves the tile URL, never the tile.
+"""
+import os
+import re
+import threading
+import time
+from collections import OrderedDict
+
+import requests
+from fastapi import APIRouter, Body, Depends
+
+from deps import Session, err, require_session
+
+router = APIRouter(prefix="/api/v1")
+
+# --------------------------------------------------------------------- the seam
+#
+# Every value below is an environment override with a keyless default. Pointing the map at a paid
+# vendor is three variables on the Space and no code change, which is what makes R14 a deferral.
+
+_TILE_URL_DEFAULT = "https://tile.openstreetmap.org/{z}/{x}/{y}.png"
+_TILE_CREDIT_DEFAULT = "© OpenStreetMap contributors"
+_TILE_CREDIT_HREF_DEFAULT = "https://www.openstreetmap.org/copyright"
+_GEOCODE_URL_DEFAULT = "https://nominatim.openstreetmap.org/search"
+_ROUTE_URL_DEFAULT = "https://router.project-osrm.org/route/v1/driving/"
+
+#: ⭐⭐ WALKING IS A DIFFERENT SERVER, NOT A DIFFERENT PATH SEGMENT, and that was MEASURED rather
+#: than assumed. The obvious implementation is to swap `driving` for `foot` in the URL above,
+#: because that is what the OSRM API signature says. It returns HTTP 200 and it is a LIE: the
+#: public demo server has only the car profile loaded and serves it for every profile in the path.
+#: Probed 2026-08-23 over the same two New York points, `/driving/` and `/foot/` both answered
+#: 10571.1 m in 969.1 s — 39 km/h, which is nobody walking. A walking toggle built that way would
+#: have shipped driving minutes under a walking label, on a screen a person plans a day from.
+#: FOSSGIS runs a genuinely separate foot-profile instance: the same two points come back 8429.7 m
+#: in 6745.8 s = 4.5 km/h. So the mode selects a BASE URL, and each one is overridable on its own.
+_ROUTE_URL_WALKING_DEFAULT = "https://routing.openstreetmap.de/routed-foot/route/v1/driving/"
+
+#: The travel modes this door answers, each mapped to the env var holding its base URL and the
+#: env var holding its credit line. A mode whose base URL resolves empty is REPORTED as
+#: unavailable rather than silently falling back to another profile's numbers.
+_ROUTE_MODES = {
+    "driving": ("AIOS_ROUTE_URL", _ROUTE_URL_DEFAULT,
+                "AIOS_ROUTE_ATTRIBUTION", "Routing by OSRM"),
+    "walking": ("AIOS_ROUTE_URL_WALKING", _ROUTE_URL_WALKING_DEFAULT,
+                "AIOS_ROUTE_ATTRIBUTION_WALKING", "Walking routes by OSRM / FOSSGIS"),
+}
+
+
+def _route_mode(raw):
+    """Normalise the requested travel mode, defaulting to driving."""
+    mode = str(raw or "driving").strip().lower()
+    return mode if mode in _ROUTE_MODES else "driving"
+
+
+def route_mode_config(mode):
+    """`(base_url, attribution)` for a travel mode, both environment-overridable."""
+    url_var, url_default, credit_var, credit_default = _ROUTE_MODES[mode]
+    return _env(url_var, url_default).strip(), _env(credit_var, credit_default)
+
+#: Both policies require a real, identifying User-Agent. A generic one is how a shared service
+#: decides an application is a scraper, so this carries the product name and a contact URL.
+_UA_DEFAULT = "AIOS-Loopable/1.0 (+https://runloopable.com)"
+
+#: Nominatim publishes one request per second. 1100 ms leaves room for clock jitter rather than
+#: sitting exactly on the published edge.
+_MIN_INTERVAL_MS_DEFAULT = 1100
+
+#: The most addresses one call may carry. Small on purpose: the client loops and shows progress,
+#: and no single request can sit on the connection for a minute waiting out the throttle.
 MAX_BATCH = 25
 # OSRM accepts substantially more route coordinates than the geocoder batch. Keep routing useful
 # for a normal customer day (including the 32-stop route that exposed the old failure) without
 # allowing an unbounded request to occupy the provider.
 MAX_ROUTE_STOPS = 100
-
-#: Tile zoom the provider actually serves. OSM stops at 19.
-_TILE_MAX_Z_DEFAULT = 19
-
-_CACHE_MAX = 4096
-
-
-def _env(name, default):
-    return (os.environ.get(name) or "").strip() or default
-
-
-def _env_int(name, default):
-    try:
-        n = int((os.environ.get(name) or "").strip())
-        return n if n > 0 else default
-    except (TypeError, ValueError):
-        return default
-
-
-def provider_config():
-    """The whole seam as one dict. `GET /geo/providers` serves it and the gate reads it."""
-    return {
-        "tiles": {
-            "url": _env("AIOS_MAP_TILE_URL", _TILE_URL_DEFAULT),
-            "attribution": _env("AIOS_MAP_TILE_ATTRIBUTION", _TILE_CREDIT_DEFAULT),
-            "attributionUrl": _env("AIOS_MAP_TILE_ATTRIBUTION_URL", _TILE_CREDIT_HREF_DEFAULT),
-            "maxZoom": _env_int("AIOS_MAP_TILE_MAX_Z", _TILE_MAX_Z_DEFAULT),
-        },
-        "geocode": {
-            "available": True,
-            "maxBatch": MAX_BATCH,
-            "minIntervalMs": _env_int("AIOS_GEOCODE_MIN_INTERVAL_MS", _MIN_INTERVAL_MS_DEFAULT),
-            # ⭐⭐ THE NUMBER THE SURFACE MUST QUOTE, AND IT IS NOT THE RATE LIMIT.
-            # T37 asks for the estimated wait to be shown BEFORE a run. The obvious source is
-            # `minIntervalMs`, and it is wrong: 1.1 s is a floor on POLITENESS, not a prediction of
-            # LATENCY. One real lookup was MEASURED at 3.28 s end to end on 2026-08-19. Quoting the
-            # limit would promise a minute and take three, and a progress estimate that runs out
-            # before the work does reads as a hang rather than as a wait.
-            "secondsPerAddress": float(_env("AIOS_GEOCODE_SECONDS_EACH", "3.3")),
-            "attribution": _env("AIOS_GEOCODE_ATTRIBUTION", _TILE_CREDIT_DEFAULT),
-        },
-        "route": {
-            "available": True,
-            "attribution": _env("AIOS_ROUTE_ATTRIBUTION", "Routing by OSRM"),
-        },
-    }
-
-
-# ------------------------------------------------------------------ the throttle
-#
-# ⚠ ONE lock and ONE timestamp for the whole process, shared by geocoding and routing, because the
-# rate limit belongs to the SERVICE and not to the endpoint. Two independent throttles would each
-# stay honest and together double the published rate.
-
-_gate = threading.Lock()
-_last_call = [0.0]
-
-
-def _throttle(min_interval_ms):
-    """Block until the minimum interval since the last outbound call has elapsed.
-
-    Returns the seconds actually waited, so a caller can report the wait rather than hide it."""
-    wait = 0.0
-    with _gate:
-        gap = min_interval_ms / 1000.0
-        now = time.monotonic()
-        due = _last_call[0] + gap
-        if now < due:
-            wait = due - now
-            time.sleep(wait)
-        _last_call[0] = time.monotonic()
-    return wait
-
-
-# --------------------------------------------------------------------- the cache
-
-_cache = OrderedDict()
-_cache_lock = threading.Lock()
-
-
-def _cache_key(q, country):
-    return (re.sub(r"\s+", " ", str(q or "")).strip().lower(), str(country or "").strip().lower())
-
-
-def _cache_get(key):
-    with _cache_lock:
-        if key not in _cache:
-            return None
-        _cache.move_to_end(key)
-        return _cache[key]
-
-
-def _cache_put(key, value):
-    with _cache_lock:
-        _cache[key] = value
-        _cache.move_to_end(key)
-        while len(_cache) > _CACHE_MAX:
-            _cache.popitem(last=False)
-
-
-def geocode_one(address, country=None, timeout=12):
-    """One address to {lat, lon, label} or None.
-
-    ⛔ THE ONLY PLACE AN OUTBOUND GEOCODE HAPPENS. `ai_enrich.py`'s geocode field calls this rather
-    than reaching for `requests` itself, so the throttle and the cache cannot be walked around by a
-    second caller. A cache hit costs no request and no wait."""
-    q = re.sub(r"\s+", " ", str(address or "")).strip()
-    if not q:
-        return None
-    key = _cache_key(q, country)
-    hit = _cache_get(key)
-    if hit is not None:
-        return dict(hit) if hit else None
-
-    cfg = provider_config()["geocode"]
-    _throttle(cfg["minIntervalMs"])
-    params = {"q": q, "format": "jsonv2", "limit": 1}
-    if country:
-        params["countrycodes"] = str(country).strip().lower()
+
+#: Tile zoom the provider actually serves. OSM stops at 19.
+_TILE_MAX_Z_DEFAULT = 19
+
+_CACHE_MAX = 4096
+
+
+def _env(name, default):
+    return (os.environ.get(name) or "").strip() or default
+
+
+def _env_int(name, default):
+    try:
+        n = int((os.environ.get(name) or "").strip())
+        return n if n > 0 else default
+    except (TypeError, ValueError):
+        return default
+
+
+def provider_config():
+    """The whole seam as one dict. `GET /geo/providers` serves it and the gate reads it."""
+    return {
+        "tiles": {
+            "url": _env("AIOS_MAP_TILE_URL", _TILE_URL_DEFAULT),
+            "attribution": _env("AIOS_MAP_TILE_ATTRIBUTION", _TILE_CREDIT_DEFAULT),
+            "attributionUrl": _env("AIOS_MAP_TILE_ATTRIBUTION_URL", _TILE_CREDIT_HREF_DEFAULT),
+            "maxZoom": _env_int("AIOS_MAP_TILE_MAX_Z", _TILE_MAX_Z_DEFAULT),
+        },
+        "geocode": {
+            "available": True,
+            "maxBatch": MAX_BATCH,
+            "minIntervalMs": _env_int("AIOS_GEOCODE_MIN_INTERVAL_MS", _MIN_INTERVAL_MS_DEFAULT),
+            # ⭐⭐ THE NUMBER THE SURFACE MUST QUOTE, AND IT IS NOT THE RATE LIMIT.
+            # T37 asks for the estimated wait to be shown BEFORE a run. The obvious source is
+            # `minIntervalMs`, and it is wrong: 1.1 s is a floor on POLITENESS, not a prediction of
+            # LATENCY. One real lookup was MEASURED at 3.28 s end to end on 2026-08-19. Quoting the
+            # limit would promise a minute and take three, and a progress estimate that runs out
+            # before the work does reads as a hang rather than as a wait.
+            "secondsPerAddress": float(_env("AIOS_GEOCODE_SECONDS_EACH", "3.3")),
+            "attribution": _env("AIOS_GEOCODE_ATTRIBUTION", _TILE_CREDIT_DEFAULT),
+        },
+        "route": {
+            "available": True,
+            "attribution": _env("AIOS_ROUTE_ATTRIBUTION", "Routing by OSRM"),
+            # ⭐ THE CLIENT ASKS WHAT IS ANSWERABLE RATHER THAN OFFERING EVERY MODE AND HOPING.
+            # A picker that lists a mode this deployment has no router for spends a click to earn
+            # an error ([[permitted-is-not-answerable]]), so only the modes whose base URL is
+            # actually configured are named here, and the map disables the rest in place.
+            "modes": [
+                {"key": mode,
+                 "label": "Walking" if mode == "walking" else "Driving",
+                 "available": bool(route_mode_config(mode)[0]),
+                 "attribution": route_mode_config(mode)[1]}
+                for mode in _ROUTE_MODES
+            ],
+        },
+    }
+
+
+# ------------------------------------------------------------------ the throttle
+#
+# ⚠ ONE lock and ONE timestamp for the whole process, shared by geocoding and routing, because the
+# rate limit belongs to the SERVICE and not to the endpoint. Two independent throttles would each
+# stay honest and together double the published rate.
+
+_gate = threading.Lock()
+_last_call = [0.0]
+
+
+def _throttle(min_interval_ms):
+    """Block until the minimum interval since the last outbound call has elapsed.
+
+    Returns the seconds actually waited, so a caller can report the wait rather than hide it."""
+    wait = 0.0
+    with _gate:
+        gap = min_interval_ms / 1000.0
+        now = time.monotonic()
+        due = _last_call[0] + gap
+        if now < due:
+            wait = due - now
+            time.sleep(wait)
+        _last_call[0] = time.monotonic()
+    return wait
+
+
+# --------------------------------------------------------------------- the cache
+
+_cache = OrderedDict()
+_cache_lock = threading.Lock()
+
+
+def _cache_key(q, country):
+    return (re.sub(r"\s+", " ", str(q or "")).strip().lower(), str(country or "").strip().lower())
+
+
+def _cache_get(key):
+    with _cache_lock:
+        if key not in _cache:
+            return None
+        _cache.move_to_end(key)
+        return _cache[key]
+
+
+def _cache_put(key, value):
+    with _cache_lock:
+        _cache[key] = value
+        _cache.move_to_end(key)
+        while len(_cache) > _CACHE_MAX:
+            _cache.popitem(last=False)
+
+
+def geocode_one(address, country=None, timeout=12):
+    """One address to {lat, lon, label} or None.
+
+    ⛔ THE ONLY PLACE AN OUTBOUND GEOCODE HAPPENS. `ai_enrich.py`'s geocode field calls this rather
+    than reaching for `requests` itself, so the throttle and the cache cannot be walked around by a
+    second caller. A cache hit costs no request and no wait."""
+    q = re.sub(r"\s+", " ", str(address or "")).strip()
+    if not q:
+        return None
+    key = _cache_key(q, country)
+    hit = _cache_get(key)
+    if hit is not None:
+        return dict(hit) if hit else None
+
+    cfg = provider_config()["geocode"]
+    _throttle(cfg["minIntervalMs"])
+    params = {"q": q, "format": "jsonv2", "limit": 1}
+    if country:
+        params["countrycodes"] = str(country).strip().lower()
     try:
         r = requests.get(
-            _env("AIOS_GEOCODE_URL", _GEOCODE_URL_DEFAULT),
-            params=params,
-            headers={"User-Agent": _env("AIOS_GEO_USER_AGENT", _UA_DEFAULT),
-                     "Accept": "application/json"},
-            timeout=timeout,
-        )
-        r.raise_for_status()
-        rows = r.json()
-    except Exception:
-        # ⚠ A transport failure is NOT cached. Caching it would turn one bad minute into a
-        # permanently empty column that no re-run could ever repair.
-        return None
-    if not isinstance(rows, list) or not rows:
-        # A genuine "no such place" IS cached, as a negative: asking again gets the same answer and
-        # spends another second of a shared service's budget to hear it.
-        _cache_put(key, {})
-        return None
-    top = rows[0] or {}
-    try:
-        lat = float(top.get("lat"))
-        lon = float(top.get("lon"))
-    except (TypeError, ValueError):
-        _cache_put(key, {})
-        return None
-    if not (-90 <= lat <= 90) or not (-180 <= lon <= 180):
-        _cache_put(key, {})
-        return None
-    out = {"lat": lat, "lon": lon, "label": str(top.get("display_name") or q)}
-    _cache_put(key, out)
-    return dict(out)
-
-
-# ---------------------------------------------------------------------- the doors
-
-
-@router.get("/geo/providers")
-def geo_providers(session: Session = Depends(require_session)):
-    """What the map should draw with, and who to credit for it.
-
-    Session gated like every other door here. The values are not secret, but an unauthenticated
-    endpoint on this app is a door somebody eventually hangs something else on."""
-    return provider_config()
-
-
-@router.post("/geo/geocode")
-def geo_geocode(body: dict = Body(...), session: Session = Depends(require_session)):
-    """Turn a bounded list of addresses into coordinates.
-
-    ⛔ Takes ADDRESSES, never a table key, a view id or a filter. There is deliberately no shape of
-    request that means "geocode everything", which is R3 expressed as an API rather than as a
-    warning."""
-    items = body.get("addresses")
-    # ⭐ THE SECOND SHAPE, AND IT EXISTS TO KEEP ONE COMPOSER. A caller may send whole RECORDS plus
-    # the geocode field's config instead of finished address strings, and the server builds the
-    # query with `ai_enrich.geocode_query`. The alternative was a TypeScript twin of that function
-    # on the client, and an address composer that exists twice will disagree the first time either
-    # copy learns about a new column ([[one-question-two-normalizers]]) -- which is exactly the trap
-    # B's measured `New York (US)` suffix would spring, silently, in whichever copy forgot.
-    if items is None:
-        records = body.get("records")
-        cfg = body.get("config") or {}
-        if isinstance(records, list) and records:
-            import ai_enrich
-            items = []
-            for rec in records:
-                if not isinstance(rec, dict):
-                    continue
-                q = ai_enrich.geocode_query(rec.get("row") or {}, cfg)
-                # ⛔ A record with no usable address is REPORTED, not dropped: it comes back
-                # `found: false` with an empty address, so the caller can name it on screen instead
-                # of quietly returning fewer answers than it asked questions.
-                items.append({"key": rec.get("key"), "address": q})
-            if not body.get("country") and cfg.get("country"):
-                body = {**body, "country": cfg.get("country")}
-    if not isinstance(items, list) or not items:
-        raise err(400, "no_addresses", "Send at least one address to look up.")
-    if len(items) > MAX_BATCH:
-        raise err(
-            400,
-            "batch_too_large",
-            f"Look up at most {MAX_BATCH} addresses per request. "
-            f"The map sends them in batches of {MAX_BATCH} so the wait stays visible.",
-        )
-    country = body.get("country")
-    out = []
-    started = time.monotonic()
-    for raw in items:
-        if isinstance(raw, dict):
-            key, addr = raw.get("key"), raw.get("address")
-        else:
-            key, addr = None, raw
-        # ⛔ AN EMPTY QUERY COSTS NO REQUEST AND CARRIES ITS OWN REASON. Nominatim's policy is a
-        # budget shared with everyone else using it, and asking it to place "" would spend a second
-        # of that budget to be told nothing. `reason` is what lets the surface say "no address on
-        # file" rather than "not found", which are different facts and want different actions.
-        if not str(addr or "").strip():
-            out.append({"key": key, "address": "", "found": False, "lat": None, "lon": None,
-                        "label": None, "reason": "no_address"})
-            continue
-        hit = geocode_one(addr, country=country)
-        out.append({"key": key, "address": str(addr or ""), "found": bool(hit),
-                    "reason": None if hit else "not_found",
-                    "lat": hit["lat"] if hit else None,
-                    "lon": hit["lon"] if hit else None,
-                    "label": hit["label"] if hit else None})
-    elapsed = time.monotonic() - started
-    return {"results": out,
-            "found": sum(1 for r in out if r["found"]),
-            "asked": len(out),
-            "secondsElapsed": round(elapsed, 2),
-            "attribution": provider_config()["geocode"]["attribution"]}
-
-
-@router.post("/geo/route")
-def geo_route(body: dict = Body(...), session: Session = Depends(require_session)):
-    """Road distance, duration and the drawn line, for stops ALREADY put in order.
-
-    ⭐ THE ORDERING IS NOT DONE HERE. `mapProjection.planRoute` sequences the stops on the client,
-    for free, and keeps working when this service does not answer. This door adds the half that
-    arithmetic cannot produce: what the ROADS actually cost. Splitting it that way is why the Start
-    picker and the round-trip toggle keep working with no network at all."""
-    stops = body.get("stops")
-    if not isinstance(stops, list) or len(stops) < 2:
-        raise err(400, "too_few_stops", "A route needs at least two stops with a location.")
+            _env("AIOS_GEOCODE_URL", _GEOCODE_URL_DEFAULT),
+            params=params,
+            headers={"User-Agent": _env("AIOS_GEO_USER_AGENT", _UA_DEFAULT),
+                     "Accept": "application/json"},
+            timeout=timeout,
+        )
+        r.raise_for_status()
+        rows = r.json()
+    except Exception:
+        # ⚠ A transport failure is NOT cached. Caching it would turn one bad minute into a
+        # permanently empty column that no re-run could ever repair.
+        return None
+    if not isinstance(rows, list) or not rows:
+        # A genuine "no such place" IS cached, as a negative: asking again gets the same answer and
+        # spends another second of a shared service's budget to hear it.
+        _cache_put(key, {})
+        return None
+    top = rows[0] or {}
+    try:
+        lat = float(top.get("lat"))
+        lon = float(top.get("lon"))
+    except (TypeError, ValueError):
+        _cache_put(key, {})
+        return None
+    if not (-90 <= lat <= 90) or not (-180 <= lon <= 180):
+        _cache_put(key, {})
+        return None
+    out = {"lat": lat, "lon": lon, "label": str(top.get("display_name") or q)}
+    _cache_put(key, out)
+    return dict(out)
+
+
+# ---------------------------------------------------------------------- the doors
+
+
+@router.get("/geo/providers")
+def geo_providers(session: Session = Depends(require_session)):
+    """What the map should draw with, and who to credit for it.
+
+    Session gated like every other door here. The values are not secret, but an unauthenticated
+    endpoint on this app is a door somebody eventually hangs something else on."""
+    return provider_config()
+
+
+@router.post("/geo/geocode")
+def geo_geocode(body: dict = Body(...), session: Session = Depends(require_session)):
+    """Turn a bounded list of addresses into coordinates.
+
+    ⛔ Takes ADDRESSES, never a table key, a view id or a filter. There is deliberately no shape of
+    request that means "geocode everything", which is R3 expressed as an API rather than as a
+    warning."""
+    items = body.get("addresses")
+    # ⭐ THE SECOND SHAPE, AND IT EXISTS TO KEEP ONE COMPOSER. A caller may send whole RECORDS plus
+    # the geocode field's config instead of finished address strings, and the server builds the
+    # query with `ai_enrich.geocode_query`. The alternative was a TypeScript twin of that function
+    # on the client, and an address composer that exists twice will disagree the first time either
+    # copy learns about a new column ([[one-question-two-normalizers]]) -- which is exactly the trap
+    # B's measured `New York (US)` suffix would spring, silently, in whichever copy forgot.
+    if items is None:
+        records = body.get("records")
+        cfg = body.get("config") or {}
+        if isinstance(records, list) and records:
+            import ai_enrich
+            items = []
+            for rec in records:
+                if not isinstance(rec, dict):
+                    continue
+                q = ai_enrich.geocode_query(rec.get("row") or {}, cfg)
+                # ⛔ A record with no usable address is REPORTED, not dropped: it comes back
+                # `found: false` with an empty address, so the caller can name it on screen instead
+                # of quietly returning fewer answers than it asked questions.
+                items.append({"key": rec.get("key"), "address": q})
+            if not body.get("country") and cfg.get("country"):
+                body = {**body, "country": cfg.get("country")}
+    if not isinstance(items, list) or not items:
+        raise err(400, "no_addresses", "Send at least one address to look up.")
+    if len(items) > MAX_BATCH:
+        raise err(
+            400,
+            "batch_too_large",
+            f"Look up at most {MAX_BATCH} addresses per request. "
+            f"The map sends them in batches of {MAX_BATCH} so the wait stays visible.",
+        )
+    country = body.get("country")
+    out = []
+    started = time.monotonic()
+    for raw in items:
+        if isinstance(raw, dict):
+            key, addr = raw.get("key"), raw.get("address")
+        else:
+            key, addr = None, raw
+        # ⛔ AN EMPTY QUERY COSTS NO REQUEST AND CARRIES ITS OWN REASON. Nominatim's policy is a
+        # budget shared with everyone else using it, and asking it to place "" would spend a second
+        # of that budget to be told nothing. `reason` is what lets the surface say "no address on
+        # file" rather than "not found", which are different facts and want different actions.
+        if not str(addr or "").strip():
+            out.append({"key": key, "address": "", "found": False, "lat": None, "lon": None,
+                        "label": None, "reason": "no_address"})
+            continue
+        hit = geocode_one(addr, country=country)
+        out.append({"key": key, "address": str(addr or ""), "found": bool(hit),
+                    "reason": None if hit else "not_found",
+                    "lat": hit["lat"] if hit else None,
+                    "lon": hit["lon"] if hit else None,
+                    "label": hit["label"] if hit else None})
+    elapsed = time.monotonic() - started
+    return {"results": out,
+            "found": sum(1 for r in out if r["found"]),
+            "asked": len(out),
+            "secondsElapsed": round(elapsed, 2),
+            "attribution": provider_config()["geocode"]["attribution"]}
+
+
+@router.post("/geo/route")
+def geo_route(body: dict = Body(...), session: Session = Depends(require_session)):
+    """Road distance, duration and the drawn line, for stops ALREADY put in order.
+
+    ⭐ THE ORDERING IS NOT DONE HERE. `mapProjection.planRoute` sequences the stops on the client,
+    for free, and keeps working when this service does not answer. This door adds the half that
+    arithmetic cannot produce: what the ROADS actually cost. Splitting it that way is why the Start
+    picker and the round-trip toggle keep working with no network at all."""
+    stops = body.get("stops")
+    if not isinstance(stops, list) or len(stops) < 2:
+        raise err(400, "too_few_stops", "A route needs at least two stops with a location.")
     if len(stops) > MAX_ROUTE_STOPS:
         raise err(400, "too_many_stops",
                    f"Route at most {MAX_ROUTE_STOPS} stops at once. Narrow the selection and try again.")
-    pairs = []
-    for s in stops:
-        try:
-            lat, lon = float(s["lat"]), float(s["lon"])
-        except (TypeError, ValueError, KeyError, IndexError):
-            raise err(400, "bad_stop", "Every stop needs a numeric latitude and longitude.")
-        if not (-90 <= lat <= 90) or not (-180 <= lon <= 180):
-            raise err(400, "bad_stop", "Every stop needs a latitude and longitude on the globe.")
-        pairs.append(f"{lon:.6f},{lat:.6f}")
-
-    base = _env("AIOS_ROUTE_URL", _ROUTE_URL_DEFAULT)
-    _throttle(_env_int("AIOS_GEOCODE_MIN_INTERVAL_MS", _MIN_INTERVAL_MS_DEFAULT))
-    try:
-        r = requests.get(
-            base.rstrip("/") + "/" + ";".join(pairs),
-            params={"overview": "simplified", "geometries": "geojson", "steps": "false"},
-            headers={"User-Agent": _env("AIOS_GEO_USER_AGENT", _UA_DEFAULT)},
-            timeout=20,
-        )
+    pairs = []
+    for s in stops:
+        try:
+            lat, lon = float(s["lat"]), float(s["lon"])
+        except (TypeError, ValueError, KeyError, IndexError):
+            raise err(400, "bad_stop", "Every stop needs a numeric latitude and longitude.")
+        if not (-90 <= lat <= 90) or not (-180 <= lon <= 180):
+            raise err(400, "bad_stop", "Every stop needs a latitude and longitude on the globe.")
+        pairs.append(f"{lon:.6f},{lat:.6f}")
+
+    # ⭐ THE MODE PICKS THE SERVER. See `_ROUTE_URL_WALKING_DEFAULT` for why it is not a path
+    # segment: the demo car server answers `/foot/` with car numbers, so substituting the profile
+    # would have shipped a walking label over driving minutes.
+    mode = _route_mode(body.get("mode"))
+    base, credit = route_mode_config(mode)
+    if not base:
+        raise err(400, "route_mode_unavailable",
+                  f"This deployment has no {'walking' if mode == 'walking' else 'driving'} "
+                  f"routing service configured, so a {'walking' if mode == 'walking' else 'driving'} "
+                  f"time cannot be worked out. The stop order and the straight-line estimate are "
+                  f"still on the map.")
+    # ⚠ ONE throttle across BOTH routers, deliberately. The lock is process-wide and the two modes
+    # are two different operators, so this over-waits rather than under-waits when a person flips
+    # the toggle. That is the safe direction for a courtesy limit on a free shared service, and it
+    # keeps the single-timestamp invariant the module header argues for.
+    _throttle(_env_int("AIOS_GEOCODE_MIN_INTERVAL_MS", _MIN_INTERVAL_MS_DEFAULT))
+    try:
+        r = requests.get(
+            base.rstrip("/") + "/" + ";".join(pairs),
+            params={"overview": "simplified", "geometries": "geojson", "steps": "false"},
+            headers={"User-Agent": _env("AIOS_GEO_USER_AGENT", _UA_DEFAULT)},
+            timeout=20,
+        )
         r.raise_for_status()
         data = r.json()
     except requests.Timeout:
@@ -363,25 +422,28 @@ def geo_route(body: dict = Body(...), session: Session = Depends(require_session
         raise err(502, "route_service_unavailable",
                    "OSRM routing could not be reached. The stop order and the straight-line "
                    "estimate are still on the map; try again shortly.")
-    routes = (data or {}).get("routes") or []
-    if not routes:
-        raise err(
-            502,
-            "no_route",
-            "No road route connects these stops. They may be on different land masses, or one of "
-            "them may be far from any road.",
-        )
-    top = routes[0]
-    geom = ((top.get("geometry") or {}).get("coordinates")) or []
-    line = []
-    for c in geom:
-        try:
-            line.append([float(c[0]), float(c[1])])
-        except (TypeError, ValueError, IndexError):
-            continue
-    return {
-        "km": round(float(top.get("distance") or 0.0) / 1000.0, 1),
-        "minutes": int(round(float(top.get("duration") or 0.0) / 60.0)),
-        "line": line,
-        "attribution": provider_config()["route"]["attribution"],
-    }
+    routes = (data or {}).get("routes") or []
+    if not routes:
+        raise err(
+            502,
+            "no_route",
+            "No road route connects these stops. They may be on different land masses, or one of "
+            "them may be far from any road.",
+        )
+    top = routes[0]
+    geom = ((top.get("geometry") or {}).get("coordinates")) or []
+    line = []
+    for c in geom:
+        try:
+            line.append([float(c[0]), float(c[1])])
+        except (TypeError, ValueError, IndexError):
+            continue
+    return {
+        "km": round(float(top.get("distance") or 0.0) / 1000.0, 1),
+        "minutes": int(round(float(top.get("duration") or 0.0) / 60.0)),
+        "line": line,
+        # The mode rides the answer so the client cannot label a driving route as a walk when a
+        # request is in flight and the toggle moves underneath it.
+        "mode": mode,
+        "attribution": credit,
+    }

web/src/customer-grid/map.css

@@ -1,109 +1,109 @@
-/* customer-grid/map.css — W37-T35/T36, the real-tile basemap and its credit line.
- *
- * ⛔ WHY THIS FILE EXISTS AND NOT A BLOCK IN index.css: contract C8. `index.css` is 12k+ lines and
- * belongs to lane A this wave, so every other lane adds styles in its own per-surface stylesheet
- * imported by its own component. `scriptView.css` and `navExtras.css` are the precedent.
- *
- * ⚠ NOTHING HERE MAY ADD `vector-effect: non-scaling-stroke` TO A `.cg-map*` RULE. The map divides
- * every stroke by the zoom in the markup (`hairline`), so a CSS rule that also cancels the scale
- * double-compensates, and that is the wave-9 "blurry when zoomed in" bug. `map.test.ts` scans
- * `index.css` for it and cannot see this file, so `verify_map.py::css_scan` applies the same rule
- * here. A new stylesheet that escapes an existing gate is a gate quietly getting smaller.
- */
-
-/* --- the tile layer -------------------------------------------------------
- *
- * Tiles are <image> elements INSIDE the same transformed <g> the pins live in, so they pan and
- * zoom with the geography for free and no second camera can drift out of step with the first.
- */
-
-.cg-map-tiles {
-  /* A raster basemap is a photograph of a map, so it must never intercept a gesture: every
-     pointer event belongs to the pins and the marquee above it. */
-  pointer-events: none;
-  /* ⭐ THE DARK-MODE SEAM, and it is deliberately INERT today. This app ships no dark theme (there
-     is not one `prefers-color-scheme` rule in `index.css`), so an inverting media query here would
-     turn the basemap negative for anyone whose OS is dark while the rest of the product stayed
-     light, which is a defect rather than a feature. Setting `--cg-tile-filter` is one line on the
-     day a theme arrives. */
-  filter: var(--cg-tile-filter, none);
-}
-
-.cg-map-tile {
-  /* Tile edges are cut to the pixel, so any smoothing at the seam paints a visible grid over the
-     whole basemap. */
-  image-rendering: -webkit-optimize-contrast;
-}
-
-/* The tile the browser has not fetched yet. Without this a pan shows the page background through
-   the gaps, which reads as holes in the map rather than as loading. */
-.cg-map-tilebed {
-  fill: #eef2f7;
-}
-
-/* --- attribution ----------------------------------------------------------
- *
- * ⛔ THIS IS A LICENCE TERM, NOT DECORATION. OpenStreetMap's terms require visible credit wherever
- * its tiles are shown, and the same applies to whatever provider replaces it: the text and the
- * link both come from the server's provider config, so a swap carries its own credit with it and
- * cannot leave the previous one on screen.
- */
-
-.cg-map-credit {
-  position: absolute;
-  right: 6px;
-  bottom: 4px;
-  z-index: 2;
-  padding: 1px 6px;
-  border-radius: 4px;
-  background: rgba(255, 255, 255, 0.82);
-  /* ⛔ A TOKEN, NOT A LITERAL (R5, and A-53 caught the 10.5px this replaced). A hardcoded size
-     becomes THE size the day the type scale moves, so a stylesheet that invents one is a second
-     source of truth. `--lp-fs-4xs` is the 10px step, which is what a credit line wants. */
-  font: 400 var(--lp-fs-4xs)/1.5 Inter, system-ui, sans-serif;
-  color: #5b6270;
-  letter-spacing: 0.1px;
-}
-
-.cg-map-credit a {
-  color: #4a5568;
-  text-decoration: none;
-}
-
-.cg-map-credit a:hover {
-  text-decoration: underline;
-}
-
-/* --- the route line (T36) -------------------------------------------------
- *
- * The ROAD geometry, as distinct from `.cg-map-route-line`, which is the straight-line plan drawn
- * from arithmetic alone. Two different claims about the same stops, so two different looks: the
- * road route is solid and confident, the straight-line plan stays dashed and provisional.
- */
-
-.cg-map-road {
-  fill: none;
-  stroke: #1f4e78;
-  stroke-opacity: 0.85;
-  stroke-linecap: round;
-  stroke-linejoin: round;
-}
-
-.cg-map-road-halo {
-  fill: none;
-  stroke: #ffffff;
-  stroke-opacity: 0.75;
-  stroke-linecap: round;
-  stroke-linejoin: round;
-}
-
-/* --- the ordered stop list (T36) ------------------------------------------
- *
+/* customer-grid/map.css — W37-T35/T36, the real-tile basemap and its credit line.
+ *
+ * ⛔ WHY THIS FILE EXISTS AND NOT A BLOCK IN index.css: contract C8. `index.css` is 12k+ lines and
+ * belongs to lane A this wave, so every other lane adds styles in its own per-surface stylesheet
+ * imported by its own component. `scriptView.css` and `navExtras.css` are the precedent.
+ *
+ * ⚠ NOTHING HERE MAY ADD `vector-effect: non-scaling-stroke` TO A `.cg-map*` RULE. The map divides
+ * every stroke by the zoom in the markup (`hairline`), so a CSS rule that also cancels the scale
+ * double-compensates, and that is the wave-9 "blurry when zoomed in" bug. `map.test.ts` scans
+ * `index.css` for it and cannot see this file, so `verify_map.py::css_scan` applies the same rule
+ * here. A new stylesheet that escapes an existing gate is a gate quietly getting smaller.
+ */
+
+/* --- the tile layer -------------------------------------------------------
+ *
+ * Tiles are <image> elements INSIDE the same transformed <g> the pins live in, so they pan and
+ * zoom with the geography for free and no second camera can drift out of step with the first.
+ */
+
+.cg-map-tiles {
+  /* A raster basemap is a photograph of a map, so it must never intercept a gesture: every
+     pointer event belongs to the pins and the marquee above it. */
+  pointer-events: none;
+  /* ⭐ THE DARK-MODE SEAM, and it is deliberately INERT today. This app ships no dark theme (there
+     is not one `prefers-color-scheme` rule in `index.css`), so an inverting media query here would
+     turn the basemap negative for anyone whose OS is dark while the rest of the product stayed
+     light, which is a defect rather than a feature. Setting `--cg-tile-filter` is one line on the
+     day a theme arrives. */
+  filter: var(--cg-tile-filter, none);
+}
+
+.cg-map-tile {
+  /* Tile edges are cut to the pixel, so any smoothing at the seam paints a visible grid over the
+     whole basemap. */
+  image-rendering: -webkit-optimize-contrast;
+}
+
+/* The tile the browser has not fetched yet. Without this a pan shows the page background through
+   the gaps, which reads as holes in the map rather than as loading. */
+.cg-map-tilebed {
+  fill: #eef2f7;
+}
+
+/* --- attribution ----------------------------------------------------------
+ *
+ * ⛔ THIS IS A LICENCE TERM, NOT DECORATION. OpenStreetMap's terms require visible credit wherever
+ * its tiles are shown, and the same applies to whatever provider replaces it: the text and the
+ * link both come from the server's provider config, so a swap carries its own credit with it and
+ * cannot leave the previous one on screen.
+ */
+
+.cg-map-credit {
+  position: absolute;
+  right: 6px;
+  bottom: 4px;
+  z-index: 2;
+  padding: 1px 6px;
+  border-radius: 4px;
+  background: rgba(255, 255, 255, 0.82);
+  /* ⛔ A TOKEN, NOT A LITERAL (R5, and A-53 caught the 10.5px this replaced). A hardcoded size
+     becomes THE size the day the type scale moves, so a stylesheet that invents one is a second
+     source of truth. `--lp-fs-4xs` is the 10px step, which is what a credit line wants. */
+  font: 400 var(--lp-fs-4xs)/1.5 Inter, system-ui, sans-serif;
+  color: #5b6270;
+  letter-spacing: 0.1px;
+}
+
+.cg-map-credit a {
+  color: #4a5568;
+  text-decoration: none;
+}
+
+.cg-map-credit a:hover {
+  text-decoration: underline;
+}
+
+/* --- the route line (T36) -------------------------------------------------
+ *
+ * The ROAD geometry, as distinct from `.cg-map-route-line`, which is the straight-line plan drawn
+ * from arithmetic alone. Two different claims about the same stops, so two different looks: the
+ * road route is solid and confident, the straight-line plan stays dashed and provisional.
+ */
+
+.cg-map-road {
+  fill: none;
+  stroke: #1f4e78;
+  stroke-opacity: 0.85;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+
+.cg-map-road-halo {
+  fill: none;
+  stroke: #ffffff;
+  stroke-opacity: 0.75;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
+
+/* --- the ordered stop list (T36) ------------------------------------------
+ *
  * The route's stops are a vertical stack of numbered chips with move controls in the route rail
  * beside View. The map remains visible beside the rail, so reordering is still done while looking
  * at the picture without putting route chrome across its header.
- */
-
+ */
+
 .cg-map-stoplist {
   display: flex;
   flex-direction: column;
@@ -117,76 +117,99 @@
   padding-bottom: 2px;
   scrollbar-width: thin;
 }
-
+
+/* ⭐ OWNER ITEM 8/9 (2026-08-23) — TOKENS, NOT HEXES. Every colour in this block was a literal
+   (`#dfe3ea`, `#2c3340`, `#1f4e78`, `#6b7280`, `#eef2f7`), which /design §8 names as a slop tell
+   and DESIGN.md §5 makes concrete: a hex that lives in one file drifts with nothing noticing,
+   and `verify_icons.read_tokens` cannot see a value written this way at all. The rows also grew
+   a third control this pass, so they are sized for three rather than two. */
 .cg-map-stopitem {
   display: flex;
   align-items: center;
   gap: 2px;
   min-width: 0;
   width: 100%;
-  padding: 1px 2px 1px 4px;
-  border: 1px solid #dfe3ea;
-  border-radius: 11px;
-  background: #fff;
-  font: 500 var(--lp-fs-3xs)/1.6 Inter, system-ui, sans-serif;
-  color: #2c3340;
-}
-
-.cg-map-stopn {
-  display: inline-grid;
-  place-items: center;
-  width: 15px;
-  height: 15px;
-  border-radius: 50%;
-  background: #1f4e78;
-  color: #fff;
-  font-size: var(--lp-fs-5xs);
-  font-weight: 600;
-}
-
+  padding: 2px 3px 2px 5px;
+  border: 1px solid var(--lp-line);
+  border-radius: var(--lp-r-md);
+  background: var(--cg-white);
+  font: 500 var(--lp-fs-3xs)/1.6 Inter, system-ui, sans-serif;
+  color: var(--cg-text);
+}
+
+.cg-map-stopitem:hover { background: var(--cg-soft); }
+
+.cg-map-stopn {
+  display: inline-grid;
+  place-items: center;
+  flex: 0 0 auto;
+  width: 16px;
+  height: 16px;
+  border-radius: 50%;
+  background: var(--lp-primary);
+  /* ⚠ The light ink is declared in the SAME rule as the dark fill (/design §8). */
+  color: var(--cg-white);
+  font-size: var(--lp-fs-5xs);
+  font-weight: 600;
+}
+
 .cg-map-stopname {
   min-width: 0;
   max-width: none;
   flex: 1 1 auto;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.cg-map-stopmove {
-  display: inline-grid;
-  place-items: center;
-  width: 15px;
-  height: 15px;
-  padding: 0;
-  border: 0;
-  border-radius: 3px;
-  background: none;
-  color: #6b7280;
-  cursor: pointer;
-}
-
-.cg-map-stopmove:hover:not(:disabled) {
-  background: #eef2f7;
-  color: #1f4e78;
-}
-
-.cg-map-stopmove:disabled {
-  /* Visible but inert at the ends of the list. Removing the control instead would make the row
-     change width as a stop moves, so the button you are aiming at walks away from the cursor. */
-  opacity: 0.28;
-  cursor: default;
-}
-
-.cg-map-stopmove svg {
-  width: 11px;
-  height: 11px;
-  fill: none;
-  stroke: currentColor;
-  stroke-width: 1.7;
-  stroke-linecap: round;
-  stroke-linejoin: round;
-}
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.cg-map-stopmove {
+  display: inline-grid;
+  place-items: center;
+  flex: 0 0 auto;
+  width: 17px;
+  height: 17px;
+  padding: 0;
+  border: 0;
+  border-radius: 4px;
+  background: none;
+  color: var(--lp-muted);
+  cursor: pointer;
+}
+
+.cg-map-stopmove:hover:not(:disabled) {
+  background: var(--lp-blue-tint);
+  color: var(--lp-blue-deep);
+}
+
+.cg-map-stopmove:focus-visible {
+  outline: 2px solid var(--lp-blue-deep);
+  outline-offset: -1px;
+}
+
+/* ⭐ OWNER ITEM 9 — TAKE THIS STOP OFF THE ROUTE. It hovers in the DANGER hue rather than the
+   blue the move controls use, because the two arrows rearrange a day and this one shortens it;
+   painting all three alike is how a person removes a customer while meaning to reorder one. */
+.cg-map-stopdrop:hover:not(:disabled) {
+  background: var(--lp-red-tint);
+  color: var(--lp-red-deep);
+}
+
+.cg-map-stopmove:disabled {
+  /* Visible but inert at the ends of the list. Removing the control instead would make the row
+     change width as a stop moves, so the button you are aiming at walks away from the cursor. */
+  opacity: 0.28;
+  cursor: default;
+}
+
+.cg-map-stopmove svg {
+  width: 11px;
+  height: 11px;
+  fill: none;
+  stroke: currentColor;
+  stroke-width: 1.7;
+  stroke-linecap: round;
+  stroke-linejoin: round;
+}
 
 /* --- the address lookup (T37) ---------------------------------------------
  *