diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
index 8a37663..6a150d4 100644
--- a/.planning/PROJECT.md
+++ b/.planning/PROJECT.md
@@ -123,4 +123,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-10-23 — Phase 3 complete (Mini App Shell + Geolocation): Mini App live on the same Worker ([assets] binding), Rams map + location chain verified on Android/Desktop/browser after 6 in-gate debug rounds (telegram-web-app.js integration; HMAC signature-field erratum)*
+*Last updated: 2025-10-25 — v1 MILESTONE COMPLETE (all 7 phases): arah² is live and privately launched — search, routes, guidance, turn-cards, privacy-audited (7/7 live CLEAN), budget-clean ($0), device-matrix walked, known-limitations shipped. Deferred: battery measurement (v1.x), ALT landmarks (v1.x), repo public flip + launch distribution (user acts)*
diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md
index 7917f87..03048d6 100644
--- a/.planning/REQUIREMENTS.md
+++ b/.planning/REQUIREMENTS.md
@@ -10,14 +10,14 @@ Requirements for initial release. Each maps to roadmap phases.
 ### Onboarding & Entry
 
 - [x] **ONBD-01**: User can open the araharah bot and start with /start — a concise explanation plus a always-available command menu (/help, /privacy)
-- [ ] **ONBD-02**: User can open the Mini App from a search result with their destination preloaded (no re-entry in the webview)
-- [ ] **ONBD-03**: User can add araharah to their phone home screen and launch search/navigation from there (addToHomeScreen + startapp deep-link)
+- [x] **ONBD-02**: User can open the Mini App from a search result with their destination preloaded (no re-entry in the webview)
+- [x] **ONBD-03**: User can add araharah to their phone home screen and launch search/navigation from there (addToHomeScreen + startapp deep-link)
 
 ### Destination Search
 
-- [ ] **SRCH-01**: User can type a destination query (e.g. "KLCC") and receive a shortlist containing the right KL-metro landmark/POI
-- [ ] **SRCH-02**: User gets useful results despite abbreviations and typos (Jln↔Jalan, Tmn↔Taman, missing spaces, common Malay address shorthand)
-- [ ] **SRCH-03**: For a chosen destination, a native venue card is sent in chat, confirming where we're going before navigation opens
+- [x] **SRCH-01**: User can type a destination query (e.g. "KLCC") and receive a shortlist containing the right KL-metro landmark/POI
+- [x] **SRCH-02**: User gets useful results despite abbreviations and typos (Jln↔Jalan, Tmn↔Taman, missing spaces, common Malay address shorthand)
+- [x] **SRCH-03**: For a chosen destination, a native venue card is sent in chat, confirming where we're going before navigation opens
 
 ### Current Location
 
@@ -27,24 +27,24 @@ Requirements for initial release. Each maps to roadmap phases.
 
 ### Routing & Route Choice
 
-- [ ] **RTNG-01**: User sees a calculated route from current location to destination drawn on a Rams-styled map (grayscale grounding, accent route)
-- [ ] **RTNG-02**: User can choose among up to 3 alternative routes presented as quiet Rams cards (time, distance, one-line difference)
+- [x] **RTNG-01**: User sees a calculated route from current location to destination drawn on a Rams-styled map (grayscale grounding, accent route)
+- [x] **RTNG-02**: User can choose among up to 3 alternative routes presented as quiet Rams cards (time, distance, one-line difference)
 
 ### Turn-by-Turn Guidance
 
-- [ ] **GUID-01**: While driving, the user sees a prominent next-maneuver banner (distance + arrow + street name) and a collapsible full maneuver list
-- [ ] **GUID-02**: After a missed turn, the app detects it and auto-recalculates from the current position without asking or blaming
-- [ ] **GUID-03**: The user sees ETA and remaining distance progress with each location fix (honest, self-paced ETA — no fake traffic confidence)
-- [ ] **GUID-04**: Guidance surfaces haptic cues at maneuver points (eyes-free, voice-free v1)
-- [ ] **GUID-05**: When the user minimizes the app mid-drive, the bot pushes chat turn-cards (map snapshot + next maneuver + ETA) for the remainder of the trip — best-effort projections
-- [ ] **GUID-06**: Re-opening the Mini App mid-trip resumes live guidance seamlessly at the user's progressed position
+- [x] **GUID-01**: While driving, the user sees a prominent next-maneuver banner (distance + arrow + street name) and a collapsible full maneuver list
+- [x] **GUID-02**: After a missed turn, the app detects it and auto-recalculates from the current position without asking or blaming
+- [x] **GUID-03**: The user sees ETA and remaining distance progress with each location fix (honest, self-paced ETA — no fake traffic confidence)
+- [x] **GUID-04**: Guidance surfaces haptic cues at maneuver points (eyes-free, voice-free v1)
+- [x] **GUID-05**: When the user minimizes the app mid-drive, the bot pushes chat turn-cards (map snapshot + next maneuver + ETA) for the remainder of the trip — best-effort projections
+- [x] **GUID-06**: Re-opening the Mini App mid-trip resumes live guidance seamlessly at the user's progressed position
 
 ### Platform Hygiene (Mini App)
 
-- [ ] **PX-01**: The Telegram BackButton walks app states (search → routes → guidance → back to search) and never dead-ends
+- [x] **PX-01**: The Telegram BackButton walks app states (search → routes → guidance → back to search) and never dead-ends
 - [x] **PX-02**: The app follows Telegram light/dark themes for chrome while the map keeps the Rams cartography constant
-- [ ] **PX-03**: During guidance, safe areas are respected, vertical-swipe-close is disabled, and closing shows the "abandon route?" confirmation
-- [ ] **PX-04**: Guidance supports fullscreen and the screen remains usable in landscape (driving posture)
+- [x] **PX-03**: During guidance, safe areas are respected, vertical-swipe-close is disabled, and closing shows the "abandon route?" confirmation
+- [x] **PX-04**: Guidance supports fullscreen and the screen remains usable in landscape (driving posture)
 
 ### Design Fidelity & Privacy Promise
 
@@ -101,22 +101,22 @@ Which phases cover which requirements. Updated during roadmap creation.
 | GEO-02 | Phase 3 | Complete |
 | GEO-03 | Phase 3 | Complete |
 | PX-02 | Phase 3 | Complete |
-| SRCH-01 | Phase 4 | Pending |
-| SRCH-02 | Phase 4 | Pending |
-| SRCH-03 | Phase 4 | Pending |
-| ONBD-02 | Phase 4 | Pending |
-| ONBD-03 | Phase 4 | Pending |
-| RTNG-01 | Phase 5 | Pending |
-| RTNG-02 | Phase 5 | Pending |
-| GUID-01 | Phase 6 | Pending |
-| GUID-02 | Phase 6 | Pending |
-| GUID-03 | Phase 6 | Pending |
-| GUID-04 | Phase 6 | Pending |
-| GUID-05 | Phase 6 | Pending |
-| GUID-06 | Phase 6 | Pending |
-| PX-01 | Phase 6 | Pending |
-| PX-03 | Phase 6 | Pending |
-| PX-04 | Phase 7 | Pending |
+| SRCH-01 | Phase 4 | Complete |
+| SRCH-02 | Phase 4 | Complete |
+| SRCH-03 | Phase 4 | Complete |
+| ONBD-02 | Phase 4 | Complete |
+| ONBD-03 | Phase 4 | Complete |
+| RTNG-01 | Phase 5 | Complete |
+| RTNG-02 | Phase 5 | Complete |
+| GUID-01 | Phase 6 | Complete |
+| GUID-02 | Phase 6 | Complete |
+| GUID-03 | Phase 6 | Complete |
+| GUID-04 | Phase 6 | Complete |
+| GUID-05 | Phase 6 | Complete |
+| GUID-06 | Phase 6 | Complete |
+| PX-01 | Phase 6 | Complete |
+| PX-03 | Phase 6 | Complete |
+| PX-04 | Phase 7 | Complete |
 
 **Coverage:**
 - v1 requirements: 22 total
diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md
index 773c9c9..9f48e1b 100644
--- a/.planning/ROADMAP.md
+++ b/.planning/ROADMAP.md
@@ -27,7 +27,7 @@ Decimal phases appear between their surrounding integers in numeric order.
 - [x] **Phase 4: Destination Search + KL Gazetteer** - Free-text KL search that resolves landmarks despite Malay abbreviations and typos, venue cards, and Mini App launch with destination preloaded (completed 2026-10-23)
 - [x] **Phase 5: Routing + Route Display** - Valhalla-backed route calculation shown as a Rams route line with quiet alternative cards; the full search→route→render loop lands (completed 2026-10-23)
 - [x] **Phase 6: Turn-by-Turn Guidance (Live Driving)** - Client guidance state machine: maneuver banner, missed-turn auto-recalculation, honest ETA, haptics, seamless resume, and backgrounded chat turn-cards (completed 2026-10-24)
-- [ ] **Phase 7: Hardening + Private Launch** - Device-matrix QA, graceful failure states, privacy-by-construction audit, and golden-route regression before real drivers (planned 2026-10-25)
+- [x] **Phase 7: Hardening + Private Launch** - Device-matrix QA, graceful failure states, privacy-by-construction audit, and golden-route regression before real drivers (planned 2026-10-25) (completed 2026-10-25)
 
 ## Phase Details
 
@@ -236,16 +236,27 @@ Notes:
 **Plans**: 6 plans
 
 Plans:
-- [ ] 07-01-PLAN.md — Fullscreen capability layer: the Telegram 8.0-guarded `requestFullscreen()` wrapper, the grown `TelegramWebAppLike` contract, the safe-area re-resolution on inset events (WIRED at the `web/src/main.ts` boot site), the route controller's guidance-start/trip-end wiring + the fullscreen-event watcher, and the FS1–FS9 suite (PX-04, D-03)
-- [ ] 07-02-PLAN.md — Landscape geometry as CSS-only media queries (tokens binding), the FM1–FM7 failure-state matrix (empty/error/timeout/no-geometry/off-road/old-client/location-timeout), and the landscape capture legs (PX-04, SC2)
-- [ ] 07-03-PLAN.md — The consolidated `npm run privacy-audit` tool: source gates over ALL src trees, the KV TTL gate, the category-only log gate, the positive fetch-host allowlist, the production-bundle scan, the live KV expiry probe, and the signed audit record (D-01, D-02)
-- [ ] 07-04-PLAN.md — The consolidated `npm run budget-audit` tool: the re-run A* CPU ladder, the bundle-byte budgets, the KV write classes with the cron's zero-write law, the per-request-class subrequest inventory, the re-run golden corpora, the static-asset `_headers` policy, and the checked-in current-vs-free-tier budget record (D-06)
-- [ ] 07-05-PLAN.md — The parked debts paid: IN-01's dead export + intent comments, IN-02's stale wrangler comment, IN-03's exact-900s boundary pin, the `/cari` re-arm attempt, the A1/A3 closure — plus `docs/KNOWN-LIMITATIONS.md` and the `/help` pointer line (D-07, D-08)
-- [ ] 07-06-PLAN.md — The launch gate: the consolidated 4-client × 7-interaction walk, the recorded Android battery measurement, the six-item D-09 checklist, and the milestone completion record (D-04, D-05, D-09)
+
+**Wave 1** (four parallel plans — no file overlap):
+- [x] 07-01-PLAN.md — Fullscreen capability layer: the Telegram 8.0-guarded `requestFullscreen()` wrapper, the grown `TelegramWebAppLike` contract, the safe-area re-resolution on inset events (WIRED at the `web/src/main.ts` boot site), the route controller's guidance-start/trip-end wiring + the fullscreen-event watcher, and the FS1–FS9 suite (PX-04, D-03)
+- [x] 07-02-PLAN.md — Landscape geometry as CSS-only media queries (tokens binding), the FM1–FM7 failure-state matrix (empty/error/timeout/no-geometry/off-road/old-client/location-timeout), and the landscape capture legs (PX-04, SC2)
+- [x] 07-03-PLAN.md — The consolidated `npm run privacy-audit` tool: source gates over ALL src trees, the KV TTL gate, the category-only log gate, the positive fetch-host allowlist, the production-bundle scan, the live KV expiry probe, and the signed audit record (D-01, D-02)
+- [x] 07-05-PLAN.md — The parked debts paid: IN-01's dead export + intent comments, IN-02's stale wrangler comment, IN-03's exact-900s boundary pin, the `/cari` re-arm attempt, the A1/A3 closure — plus `docs/KNOWN-LIMITATIONS.md` and the `/help` pointer line (D-07, D-08)
+
+**Wave 2** *(blocked on Wave 1 completion — shares `package.json` with 07-03 and imports 07-03's live-probe library)*:
+- [x] 07-04-PLAN.md — The consolidated `npm run budget-audit` tool: the re-run A* CPU ladder, the bundle-byte budgets, the KV write classes with the cron's zero-write law, the per-request-class subrequest inventory, the re-run golden corpora, the static-asset `_headers` policy, and the checked-in current-vs-free-tier budget record (D-06)
+
+**Wave 3** *(blocked on Waves 1–2 — the blocking launch gate)*:
+- [x] 07-06-PLAN.md — The launch gate: the consolidated 4-client × 7-interaction walk, the recorded Android battery measurement, the six-item D-09 checklist, and the milestone completion record (D-04, D-05, D-09)
+
+**Cross-cutting constraints** *(must_haves.truths asserted by 2+ plans, binding at every wave)*:
+- Category-only logging — no coordinate, chat id, or route payload in any log statement, including the fullscreen path (07-01, 07-03)
+- TTL-only KV write law — every write carries a named-constant `expirationTtl`; the cron tick writes zero times (07-03, 07-04)
+- Old-client sanity — missing Bot API 8.0 methods are a designed silent no-op, never an error surface (07-01, 07-02)
+- Honest measurement — every recorded number is measured from reality (CPU ladder, battery run, device legs), never synthesized or assumed (07-04, 07-06)
 
 Notes:
 - No exclusive feature requirements beyond PX-04 — this phase hardens the outcomes of Phases 1–6 and is the last chance to catch the "looks done but isn't" failures for a navigation tool whose empty states ARE the polish surface.
-- **Wave structure**: Wave 1 = 07-01, 07-02, 07-03, 07-05 (four parallel plans, no file overlap) · Wave 2 = 07-04 (shares `package.json` with 07-03 and imports 07-03's live-probe library) · Wave 3 = 07-06 (the blocking launch gate — depends on all five).
 - The two manual behaviors (the physical device walk and the battery run) live in the 07-06 blocking LAUNCH-GATE checkpoint — never synthesized. NOT-RUN legs are recorded honestly and keep the checklist unsigned.
 **UI hint**: no
 
diff --git a/.planning/STATE.md b/.planning/STATE.md
index 15af468..57edb09 100644
--- a/.planning/STATE.md
+++ b/.planning/STATE.md
@@ -2,15 +2,15 @@
 gsd_state_version: 1.0
 milestone: v1.0
 milestone_name: milestone
-status: planning
-stopped_at: Phase 4 context gathered
-last_updated: "2026-10-23T14:33:06.676Z"
-last_activity: 2026-10-23
+status: completed
+stopped_at: "docs-update complete: 9 docs regenerated+verified+committed; wiki synced+pushed"
+last_updated: "2026-10-25T04:51:08.699Z"
+last_activity: 2026-10-25
 progress:
   total_phases: 7
-  completed_phases: 3
-  total_plans: 11
-  completed_plans: 11
+  completed_phases: 7
+  total_plans: 34
+  completed_plans: 34
   percent: 100
 ---
 
@@ -21,14 +21,14 @@ progress:
 See: .planning/PROJECT.md (updated 2026-10-22)
 
 **Core value:** A user finds a local destination via Telegram and gets there with reliable turn-by-turn guidance — tracked by nothing beyond what they explicitly opted in to.
-**Current focus:** Phase 03 — mini-app-shell-geolocation
+**Current focus:** Phase 07 — hardening-private-launch
 
 ## Current Position
 
-Phase: 4
+Phase: 7
 Plan: Not started
-Status: Ready to plan
-Last activity: 2026-10-23
+Status: Milestone complete
+Last activity: 2026-10-25
 
 Progress: [░░░░░░░░░░] 0%
 
@@ -36,7 +36,7 @@ Progress: [░░░░░░░░░░] 0%
 
 **Velocity:**
 
-- Total plans completed: 11
+- Total plans completed: 34
 - Average duration: —
 - Total execution time: —
 
@@ -48,6 +48,10 @@ Progress: [░░░░░░░░░░] 0%
 | 01 | 4 | - | - |
 | 02 | 3 | - | - |
 | 3 | 4 | - | - |
+| 4 | 4 | - | - |
+| 5 | 5 | - | - |
+| 6 | 8 | - | - |
+| 7 | 6 | - | - |
 
 ## Accumulated Context
 
@@ -65,11 +69,18 @@ None yet.
 
 ### Blockers/Concerns
 
+- ~~PHASE 4 device-gate legs UNVERIFIED~~ RESOLVED 2026-10-24: legs 1–4+6 PASS on real hardware; leg 5 user-accepted (BotFather Main Mini App configured; unknown-id surface covered by automated gates). Known-open cosmetic: /cari absent from the client command menu (Telegram non-default setMyCommands defect; command works when typed; register script re-arms all scopes for retry).
 - Design-source conflict (root `DESIGN.md` typography vs `telemetry_rams/DESIGN.md` + mockups) — Phase 1 resolves; mockup markup is layout reference only, design doc tokens are binding (scrub rounded/blur utilities)
-- VPS provisioning starts in Phase 4 (Photon bake-off); free-first mandate: Valhalla + Photon on one VPS, Oracle Cloud Always Free candidate
+- ~~VPS provisioning starts in Phase 4 (Photon bake-off)~~ SUPERSEDED by Phase 4 D-03: search is an in-Worker curated gazetteer ($0); VPS provisioning (Valhalla + Photon) defers to Phase 5; Photon is a documented SearchSource backend #3 (free-first mandate: one VPS, Oracle Cloud Always Free candidate)
 - Research-flagged phases needing `/gsd-research-phase`: 3 (geolocation client matrix), 4 (Photon KL bake-off + gazetteer), 6 (backgrounded turn-card framing + snapshots)
 - Project skill `.agents/skills/design-taste-frontend/` applies to UI phases (existing-design-system special case; Rams tokens binding)
 
+### Quick Tasks Completed
+
+| # | Description | Date | Commit | Directory |
+|---|-------------|------|--------|-----------|
+| 261024-001 | Replace logo references with master assets | 2026-10-24 | TBD | [261024-001-logo-asset-replacement](./quick/261024-001-logo-asset-replacement/) |
+
 ## Deferred Items
 
 | Category | Item | Status | Deferred At |
@@ -79,6 +90,6 @@ None yet.
 
 ## Session Continuity
 
-Last session: 2026-10-23T14:33:06.657Z
-Stopped at: Phase 4 context gathered
-Resume file: .planning/phases/04-destination-search-kl-gazetteer/04-CONTEXT.md
+Last session: 2026-10-25T04:51:08.682Z
+Stopped at: docs-update complete: 9 docs regenerated+verified+committed; wiki synced+pushed
+Resume file: README.md
diff --git a/.planning/codebase/ARCHITECTURE.md b/.planning/codebase/ARCHITECTURE.md
index 67cbcc3..7838424 100644
--- a/.planning/codebase/ARCHITECTURE.md
+++ b/.planning/codebase/ARCHITECTURE.md
@@ -50,7 +50,7 @@ This is a **pre-implementation / design-phase project**. There is no backend, ru
 - Each mockup screen is a **single self-contained HTML file** (`code.html`) with inline `<style>` and inline `<script>`. No shared CSS/JS modules, no bundler, no imports between screens.
 - Styling is Tailwind via **CDN script** (`https://cdn.tailwindcss.com`) with a per-file inline `tailwind.config` object encoding the design tokens (colors, borderRadius, spacing). No Tailwind build step.
 - Fonts and icons are loaded from CDNs: **Google Fonts** (Space Grotesk for headlines/telemetry, Geist for body) and **Material Symbols Outlined** for iconography.
-- Imagery is either **inline SVG** (route vectors, directional glyphs drawn with `stroke-linecap="square"`) or **remote hosted URLs** (`lh3.googleusercontent.com/aida/...` logo images) — no local image assets besides `screen.png` captures.
+- Imagery is either **inline SVG** (route vectors, directional glyphs drawn with `stroke-linecap="square"`), the local project logo (`assets/MASTER_FILE-arah2_logo.svg`), or legacy **remote hosted URLs** (`lh3.googleusercontent.com/aida/...` placeholders in the remaining mockups) — local image assets are limited to the logo and `screen.png` captures.
 - Interactivity is **vanilla JS via inline `onclick` handlers** only (demo stubs — e.g., `alert('Reroute broadcast loaded.')`). No state management, no routing, no data layer.
 
 ## Layers
diff --git a/.planning/codebase/CONCERNS.md b/.planning/codebase/CONCERNS.md
index 3193c5f..dc4497b 100644
--- a/.planning/codebase/CONCERNS.md
+++ b/.planning/codebase/CONCERNS.md
@@ -53,7 +53,7 @@
 ## Mockup Fragility / Runtime Dependencies
 
 **Runtime Tailwind CDN + third-party CDN single points of failure**
-- Issue: Every screen loads Tailwind as an uncompiled runtime script from `https://cdn.tailwindcss.com` (officially "not for production"), plus Google Fonts (Geist, Space Grotesk), Material Symbols Outlined, and a `lh3.googleusercontent.com` logo image. There is no vendoring, no build step, and no `package.json`; the screens render correctly only with internet access to these CDNs.
+- Issue: Every screen loads Tailwind as an uncompiled runtime script from `https://cdn.tailwindcss.com` (officially "not for production"), plus Google Fonts (Geist, Space Grotesk), Material Symbols Outlined, and legacy remote placeholder assets. The logo placeholder has been replaced with the local `assets/MASTER_FILE-arah2_logo.svg`; the screens still require internet access for Tailwind, fonts, and icons.
 - Files: `<head>` of all four `stitch_minimalist_route_navigator/*/code.html`
 - Trigger: Open offline, or when the ephemeral Google-hosted logo URL expires.
 - Workaround: None in-repo. This is fine for mockups but disqualifies the files from production use as-is.
diff --git a/.planning/codebase/INTEGRATIONS.md b/.planning/codebase/INTEGRATIONS.md
index d4ae80e..8aaa03a 100644
--- a/.planning/codebase/INTEGRATIONS.md
+++ b/.planning/codebase/INTEGRATIONS.md
@@ -27,7 +27,7 @@ There is **no running integration code** in this repository yet — no backend,
 **CDN services actually referenced by the mockups [actual]:**
 - `cdn.tailwindcss.com` — Tailwind Play CDN script, in all four screens (`*`/`code.html`)
 - `fonts.googleapis.com` + `fonts.gstatic.com` — Geist, Space Grotesk, Material Symbols Outlined
-- `lh3.googleusercontent.com/aida/...` — placeholder screenshot URLs embedded in mockups (tool-generated assets, should be replaced by project-generated images before reuse)
+- `lh3.googleusercontent.com/aida/...` — legacy remote placeholders in mockups (tool-generated assets). The logo placeholder has been replaced with the local project logo (`assets/MASTER_FILE-arah2_logo.svg`); any remaining remote URLs are non-logo placeholders.
 
 **Email (planned, low priority):**
 - Resend — transactional email (`IDEAS.md`). Purpose is not specified further; may not be needed for the MVP.
diff --git a/.planning/codebase/STACK.md b/.planning/codebase/STACK.md
index e25bf56..527157a 100644
--- a/.planning/codebase/STACK.md
+++ b/.planning/codebase/STACK.md
@@ -48,7 +48,7 @@ The stack below is split into (A) **what actually exists today** and (B) **what
 **Critical (runtime CDN dependencies of the mockups):**
 - `cdn.tailwindcss.com` — theming engine for all screens
 - `fonts.googleapis.com` / `fonts.gstatic.com` — Geist, Space Grotesk, Material Symbols
-- Mockup images are hosted/lifted from Google-hosted sample assets (`lh3.googleusercontent.com/aida/...` URLs appear in some screens' `<img>`/`src` attributes) — placeholders from the Stitch tooling, not project data
+- Mockup images were originally hosted/lifted from Google-hosted sample assets (`lh3.googleusercontent.com/aida/...` placeholders in the Stitch output). The logo placeholder has been replaced with the local project logo (`assets/MASTER_FILE-arah2_logo.svg`); any remaining remote URLs are non-logo placeholders.
 
 **Infrastructural (planned only — see `IDEAS.md` "Architecture Overview"; none is wired up):**
 - Telegram Bot API — frontend transport (`IDEAS.md`: "Telegram-first")
diff --git a/.planning/config.json b/.planning/config.json
index ad2f915..4c4de41 100644
--- a/.planning/config.json
+++ b/.planning/config.json
@@ -47,16 +47,16 @@
     "gsd-codebase-mapper": "opencode-go/minimax-m3",
     "gsd-ui-researcher": "opencode-go/minimax-m3",
     "gsd-doc-writer": "opencode-go/minimax-m3",
-    "gsd-executor": "opencode-go/glm-5.2",
-    "gsd-debugger": "opencode-go/glm-5.2",
-    "gsd-verifier": "opencode-go/glm-5.2",
-    "gsd-plan-checker": "opencode-go/glm-5.2",
-    "gsd-integration-checker": "opencode-go/glm-5.2",
-    "gsd-nyquist-auditor": "opencode-go/glm-5.2",
-    "gsd-pattern-mapper": "opencode-go/glm-5.2",
-    "gsd-ui-checker": "opencode-go/glm-5.2",
-    "gsd-ui-auditor": "opencode-go/glm-5.2",
-    "gsd-doc-verifier": "opencode-go/glm-5.2"
+    "gsd-executor": "zai-coding-plan/glm-5.3-flash",
+    "gsd-debugger": "zai-coding-plan/glm-5.3-flash",
+    "gsd-verifier": "zai-coding-plan/glm-5.3-flash",
+    "gsd-plan-checker": "zai-coding-plan/glm-5.3-flash",
+    "gsd-integration-checker": "zai-coding-plan/glm-5.3-flash",
+    "gsd-nyquist-auditor": "zai-coding-plan/glm-5.3-flash",
+    "gsd-pattern-mapper": "zai-coding-plan/glm-5.3-flash",
+    "gsd-ui-checker": "zai-coding-plan/glm-5.3-flash",
+    "gsd-ui-auditor": "zai-coding-plan/glm-5.3-flash",
+    "gsd-doc-verifier": "zai-coding-plan/glm-5.3-flash"
   },
   "branching_strategy": "none",
   "quick_branch_template": null,
@@ -66,4 +66,4 @@
   "graphify": {
     "enabled": false
   }
-}
+}
\ No newline at end of file
diff --git a/.planning/phases/04-destination-search-kl-gazetteer/leg5-browser-sessionwall.png b/.planning/phases/04-destination-search-kl-gazetteer/leg5-browser-sessionwall.png
new file mode 100644
index 0000000..f1a2049
Binary files /dev/null and b/.planning/phases/04-destination-search-kl-gazetteer/leg5-browser-sessionwall.png differ
diff --git a/.planning/phases/05-routing-route-display/05-01-PLAN.md b/.planning/phases/05-routing-route-display/05-01-PLAN.md
new file mode 100644
index 0000000..6907e16
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-01-PLAN.md
@@ -0,0 +1,526 @@
+---
+phase: 05-routing-route-display
+plan: 01
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - package.json
+  - routing/package.json
+  - routing/tsconfig.json
+  - routing/src/types.ts
+  - routing/src/polyline.ts
+  - routing/src/geo.ts
+  - routing/src/fixture-source.ts
+  - routing/src/index.ts
+  - routing/src/data/route-fixtures.json
+  - routing/test/runner.mjs
+  - routing/test/harness.mjs
+  - routing/test/contract.test.mjs
+  - routing/test/polyline.test.mjs
+  - routing/test/fixture-source.test.mjs
+  - routing/test/loader-env.test.mjs
+autonomous: true
+requirements: [RTNG-01]
+must_haves:
+  decisions_implemented:
+    - "D-01: routing is a RoutingSource interface with a documented backend ladder — 'fixture' (this phase) → 'wasm-router' (OSS track, backend #2) → 'valhalla' (VPS, backend #3) — and NO runtime network call anywhere in the module"
+    - "D-03: route() resolving to null IS the router-pending contract — an unknown destination or an origin outside the 200 m tolerance is null, never a fabricated geometry"
+    - "D-04: the WASM-router backend #2 direction is preserved in the type contract's header (same interface, different name/impl — the SearchSource ladder pattern)"
+    - "D-05: the module performs zero fetch/XMLHttpRequest/env reads — the Worker gains no route proxy and the web bundle gains no runtime routing dependency"
+    - "D-07: the route model carries step geometry + snapped-progress support fields from day one (RouteStep typed, RouteGeometry.cumulativeDistanceM derived at load)"
+  truths:
+    - "A route request for an unknown destinationId resolves to null — the UI-SPEC's pending state — never a nearest-match geometry"
+    - "A route request whose origin sits more than 200 m from every pinned public origin for that destination resolves to null (haversine, ORIGIN_TOLERANCE_M)"
+    - "The polyline6 codec round-trips EXACTLY on the 1e-6 grid: encodePolyline6(decodePolyline6(s)) === s for every committed fixture string (verified against a live OSRM demo geometry)"
+    - "The routing module contains zero console.* calls, zero storage tokens, and zero network calls — nothing about a request outlives the caller's frame (D-15 analog)"
+    - "The route model carries RouteStep[] and cumulativeDistanceM from day one; fixture-world steps are EMPTY arrays (honest 'not wired', never fabricated maneuvers — D-10)"
+    - "The fixture index is built lazily on first route() and memoized — never at module scope (the gazetteer LAW 1, Workers 1 s startup)"
+  artifacts:
+    - path: "routing/src/types.ts"
+      provides: "RoutePoint / RouteRequest / RouteSummary / RouteStep / RouteGeometry / RouteOption / RouteResult / RoutingSource contracts (D-01, D-03, D-07)"
+      contains: "export interface RoutingSource"
+    - path: "routing/src/polyline.ts"
+      provides: "decodePolyline6 / encodePolyline6 — pure, zero-dependency codec (RESEARCH Finding 1)"
+      contains: "export function decodePolyline6"
+    - path: "routing/src/geo.ts"
+      provides: "haversineM + deriveCumulativeDistanceM (snapped-progress support, D-07)"
+      contains: "export function haversineM"
+    - path: "routing/src/fixture-source.ts"
+      provides: "createFixtureRoutingSource — backend #1 (D-02): lazy index, 200 m origin tolerance, best-first options, empty steps"
+      contains: "export function createFixtureRoutingSource"
+    - path: "routing/src/data/route-fixtures.json"
+      provides: "the committed fixture dataset SCHEMA with an empty pairs array (plan 05-02 populates it via the build-time script)"
+      contains: "\"pairs\""
+    - path: "routing/src/index.ts"
+      provides: "the public API surface — imported by web (route surface, plan 05-04) and the corpus runner (plan 05-02)"
+      contains: "export function createFixtureRoutingSource"
+    - path: "routing/test/polyline.test.mjs"
+      provides: "codec vectors (hand-computed + the external live-OSRM vector), round-trip law, malformed-input refusal"
+    - path: "routing/test/fixture-source.test.mjs"
+      provides: "matching law, tolerance boundary, honest-null, lazy index, no-logging/no-storage gates"
+    - path: "routing/test/loader-env.test.mjs"
+      provides: "the three-environment loader proof (bare Node import + esbuild bundle marker) — the Phase 4 top-mechanical-risk pattern"
+  key_links:
+    - from: "routing/src/fixture-source.ts"
+      to: "routing/src/data/route-fixtures.json"
+      via: "static JSON import (build-time inlined by esbuild AND Vite, importable by bare Node 24) — never a runtime fetch"
+      pattern: "route-fixtures.json"
+    - from: "routing/src/fixture-source.ts"
+      to: "routing/src/polyline.ts"
+      via: "options decode their geometry once, lazily, memoized per pair"
+      pattern: "decodePolyline6"
+    - from: "routing/src/fixture-source.ts"
+      to: "routing/src/geo.ts"
+      via: "the 200 m tolerance match is haversineM(origin, pinnedOrigin) <= ORIGIN_TOLERANCE_M"
+      pattern: "haversineM"
+    - from: "routing/src/index.ts"
+      to: "routing/src/types.ts"
+      via: "the public surface re-exports the contract types downstream plans import"
+      pattern: "export type"
+---
+
+<objective>
+Create the fifth npm workspace `routing/` (`@araharah/routing`) — the search-shaped RoutingSource seam (D-01) with backend #1, the fixture backend, and the polyline6 codec — so plans 05-02 (fixtures), 05-04 (web route surface), and 05-05 (gates) all build on one contract.
+
+Purpose: the pivot (CONTEXT D-01) replaces Valhalla-behind-a-proxy with a `RoutingSource` interface whose first backend serves build-time-precomputed fixture routes for 10–20 golden KL pairs. This plan lands the seam, the codec (RESEARCH Finding 1), the geo math, the fixture-backend matching law (200 m origin tolerance, honest-null pending state D-03), the committed-but-empty fixture dataset schema, and the three-environment loader proof — the exact pattern Phase 4's `search/` workspace proved.
+
+Output: a buildless workspace (pure `.ts` + `.json`), wired into the root `package.json` workspaces + delegate scripts, with RED→GREEN test suites for the contract, codec, source, and loader.
+</objective>
+
+<execution_context>
+@$HOME/.config/opencode/get-shit-done/workflows/execute-plan.md
+@$HOME/.config/opencode/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@AGENTS.md
+@.planning/phases/05-routing-route-display/05-CONTEXT.md
+@.planning/phases/05-routing-route-display/05-RESEARCH.md
+@.planning/phases/05-routing-route-display/05-PATTERNS.md
+@search/src/types.ts
+@search/src/source.ts
+@search/src/gazetteer.ts
+@search/package.json
+@search/tsconfig.json
+@package.json
+@bot/src/security/initdata.ts
+
+<interfaces>
+Key contracts the executor needs. `RoutingSource` and the route model are given VERBATIM here — downstream plans (05-02 corpus, 05-04 web surface) import these exact names.
+
+From `routing/src/types.ts` (this plan's output — the contract everything else implements against):
+
+```typescript
+/** A WGS84 point. */
+export interface RoutePoint {
+  lat: number;
+  lng: number;
+}
+
+/** A routing request. The origin is the live fix (memory only — GEO-03/D-07). */
+export interface RouteRequest {
+  origin: RoutePoint;
+  /** The gazetteer id resolved by the Phase 4 destination resolver. */
+  destinationId: string;
+}
+
+/** Distance/duration summary. Distances in meters, durations in seconds. */
+export interface RouteSummary {
+  distanceM: number;
+  durationS: number;
+}
+
+/**
+ * A maneuver step — DAY-ONE FIELD (D-07, GUID-05/06 upstream obligation).
+ * Fixture-world steps are ALWAYS empty arrays (D-10 defers instructions to
+ * Phase 6): an empty array is honest "not wired"; a fabricated step list
+ * would not be. Real step geometry arrives with backends #2/#3.
+ */
+export interface RouteStep {
+  distanceM?: number;
+  durationS?: number;
+  name?: string;
+  /** polyline6-encoded step geometry (backend #2/#3 populate this). */
+  geometry?: string;
+}
+
+/** Decoded geometry + the snapped-progress support field (D-07). */
+export interface RouteGeometry {
+  points: RoutePoint[];
+  /** Same length as points; [0] === 0; non-decreasing. Meters along the line. */
+  cumulativeDistanceM: number[];
+}
+
+/** One routable alternative. options[0] of a result is the BEST route. */
+export interface RouteOption {
+  geometry: RouteGeometry;
+  summary: RouteSummary;
+  steps: RouteStep[];
+}
+
+export interface RouteResult {
+  destinationId: string;
+  origin: RoutePoint;
+  /** 1..3 options, index 0 = best (order preserved from the backend). */
+  options: RouteOption[];
+  /** === the RoutingSource name that produced it. */
+  backend: string;
+}
+
+/**
+ * The pluggable routing seam (D-01). Backends: "fixture" (this phase) →
+ * "wasm-router" (OSS track, backend #2 — client-side, origin+destination
+ * never touch a server) → "valhalla" (VPS, backend #3). Backends #2/#3 do
+ * NOT ship in this phase — the interface exists so they slot in without a
+ * client rewrite, exactly parallel to SearchSource's ladder (D-03/D-04).
+ *
+ * THE NULL CONTRACT IS LOAD-BEARING (D-03): route() resolving to NULL is
+ * the honest "router pending" state — an unknown destination, or an origin
+ * outside the fixture corpus's tolerance. Never a blank map, never a fake
+ * route, never a thrown error for a normal miss.
+ *
+ * No logging, no storage, no network (D-05/D-12/D-15 analog): request
+ * coordinates never leave the caller's frame.
+ */
+export interface RoutingSource {
+  readonly name: string;
+  route(req: RouteRequest): Promise<RouteResult | null>;
+}
+```
+
+From `routing/src/fixture-source.ts` (this plan's output):
+
+```typescript
+/** A pair may serve a request only when the origin sits within this many
+ *  meters (haversine) of the pair's pinned public origin (D-02/D-03). */
+export const ORIGIN_TOLERANCE_M = 200;
+
+export function createFixtureRoutingSource(
+  data?: RouteFixturesFile, // optional injection — tests pass synthetic datasets
+): RoutingSource; // { name: "fixture", route(req) }
+
+/** pairId -> pinned origin, or null when unknown (the 05-05 harness knob
+ *  ?fixpair=<pair-id> reads this; public data only). */
+export function getPairOrigin(pairId: string): RoutePoint | null;
+
+/** Introspection for the corpus runner (plan 05-02) — lazy, memoized. */
+export function getPairs(): readonly FixturePair[];
+```
+
+The fixture JSON schema (both the seed file this plan commits AND the shape `routing/test/fixture-source.test.mjs` injects):
+
+```json
+{
+  "_license": "ODbL-1.0",
+  "_attribution": "© OpenStreetMap contributors",
+  "_notice": "Route geometry © OpenStreetMap contributors, precomputed from the public OSRM demo server (router.project-osrm.org) at build time between fixed public landmark coordinates. ODbL v1.0 — https://opendatacommons.org/licenses/odbl/1-0/",
+  "_source": "OSRM demo server (router.project-osrm.org) — build-time fetch, never a runtime dependency",
+  "version": 1,
+  "originToleranceM": 200,
+  "pairs": []
+}
+```
+
+`FixturePair` (typed in types.ts):
+
+```typescript
+export interface FixtureRoute {
+  /** polyline6, stored VERBATIM from the OSRM demo response. */
+  geometry: string;
+  distanceM: number;
+  durationS: number;
+}
+
+export interface FixturePair {
+  /** "<origin-id>-to-<dest-id>", slug charset — also the ?fixpair= knob value. */
+  pairId: string;
+  origin: { lat: number; lng: number; label: string };
+  destinationId: string;
+  /** Best-first, 1..3 entries (OSRM demo returns best-first; preserved). */
+  routes: FixtureRoute[];
+}
+```
+
+The module header-contract style every new file copies (`bot/src/security/initdata.ts`):
+
+```typescript
+/*
+ * <file> — <one-line purpose> (<decision/requirement IDs>).
+ * ---...
+ * <the structural laws this module obeys, citing D-xx>
+ */
+```
+</interfaces>
+
+<environment_facts>
+Verified in this session — do not re-derive, do not spend a task re-probing:
+
+- Node is **v24.18.0**, npm **11.16.0**. Node 24 strips TypeScript types by DEFAULT, so a `.mjs` test CAN `await import("../src/foo.ts")` — the repo's existing pattern (`search/test/corpus.test.mjs` does exactly this).
+- Static JSON import with the `with { type: "json" }` attribute WORKS on this Node (probed in Phase 4; `web/test/build-artifact.test.mjs` line 47 does exactly this).
+- The root `package.json` `workspaces` array is currently `["theme","bot","web","search"]` — this plan appends `"routing"`.
+- `search/tsconfig.json` is the platform-neutral tsconfig to copy (`resolveJsonModule: true`, no DOM/Workers types).
+- The polyline6 codec reference implementation round-trips in this session AND re-encodes a live OSRM demo geometry byte-identically (`encode(decode("ktv_Egu~~`EsA…")) === original`). Derived vectors are pinned in `<polyline_vectors>` below.
+- A LIVE probe of the OSRM demo server (2026-10-24, KLCC→KL Sentral, public coordinates) returned `code: Ok`, 2 routes, 6907.9 m / 663.2 s, polyline6 geometry — the external vector in the codec suite is real data, not invented.
+</environment_facts>
+
+<polyline_vectors>
+Hand-derived vectors the codec suite MUST assert (computed with the reference algorithm in this session; the suite's own implementation must reproduce them — RED first):
+
+- `decodePolyline6("??")` → `[{ lat: 0, lng: 0 }]`; `encodePolyline6([{ lat: 0, lng: 0 }])` → `"??"` (the zero-delta case)
+- `encodePolyline6([{ lat: 3.1578, lng: 101.7117 }])` → `` "oqv_Egt~~`E" `` (NOTE: contains a backtick — mind the quoting in both the assertion and the plan's grep checks)
+- `encodePolyline6([{ lat: 3.1578, lng: 101.7117 }, { lat: 3.1579, lng: 101.7118 }, { lat: 3.158, lng: 101.712 }])` → `` "oqv_Egt~~`EgEgEgEoK" `` (delta accumulation across 3 points)
+- `encodePolyline6([{ lat: -1.5, lng: 2.25 }, { lat: 0.75, lng: -0.125 }])` → `"~tpzA_pihC_pihCnt}oC"` (negative-value zigzag: `~` inversion branch)
+- EXTERNAL VECTOR (live OSRM demo geometry, KLCC→KL Sentral, 2026-10-24): `decodePolyline6("ktv_Egu~~`EsAlFaDnGeF`EmGvEmWbSySjOiTfUiOb`@{n@xZ}FhBsGx@cJ?")[0]` deep-equals `{ lat: 3.157846, lng: 101.711716 }` (OSRM snapped the origin onto the road graph — the small offset from 3.1578/101.7117 is expected), and `encodePolyline6(decodePolyline6(<that string>))` === the original string.
+- `decodePolyline6("")` → `[]` (empty is legal); `decodePolyline6("A")` THROWS (truncated varint — never a NaN point); any odd-length or dangling-continuation input THROWS.
+- ROUND-TRIP LAW: for every string above, `encodePolyline6(decodePolyline6(s)) === s`.
+</polyline_vectors>
+
+<matching_law>
+The fixture backend's contract (fixture-source.ts):
+
+1. **Slug guard first** (mirror `search/src/source.ts` `ENTRY_ID_PATTERN`): `destinationId` must match `/^[a-z0-9-]{1,64}$/` or the request resolves to `null` before the index is touched.
+2. **Lazy index** (gazetteer LAW 1): on first `route()` call, build `Map<pairId, FixturePair>` + a destinationId → pairs multimap ONCE, memoized in module scope of the factory closure. `route-fixtures.json` is parsed by the STATIC IMPORT at module-eval of `fixture-source.ts`… NO — the static import gives the raw object but the INDEX (Maps, decoded geometry) must be built lazily: module scope holds only the import binding; every `Map`/`decodePolyline6` call happens inside first-use functions.
+3. **Match**: candidates = pairs whose `destinationId` equals the request's; among them, the FIRST (in file order) whose `haversineM(req.origin, pair.origin) <= ORIGIN_TOLERANCE_M` (200) serves. None → `null`.
+4. **Shape**: `options` = pair.routes mapped best-first: geometry decoded via `decodePolyline6`, `cumulativeDistanceM` via `deriveCumulativeDistanceM` (starts at 0, non-decreasing, meters), `steps: []` ALWAYS (D-10 — a fixture-world step list would be fabricated), summary verbatim from the fixture. `backend: "fixture"`.
+5. **Defensive validation** (the `bot/src/kv/location-pin.ts` precedent): a malformed pair (non-finite distance/duration, geometry that throws on decode, empty routes array, routes > 3) is SKIPPED at index-build time — it renders as an honest `null`, never a throw to the caller, never a NaN coordinate. (Plan 05-02's corpus gate makes malformed pairs unshippable in practice; this is the runtime backstop.)
+6. **Single-route results are normal**: 1 option → the web surface renders no chip row (UI-SPEC). 2–3 options → index 0 is the best.
+7. `getPairOrigin(pairId)` returns the pinned origin or `null` (slug-guarded) — the harness knob (plan 05-05) and tests read this; it never consults the network.
+</matching_law>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Live fix (request origin) → fixture source | The origin is the user's position in memory. It must never reach a log, a storage surface, or a network call — the module's three zero-laws are the mitigation surface. |
+| Committed fixture JSON → runtime index | Fixtures are trusted repo content, but a malformed entry (non-finite distance, truncated polyline) would poison the map with NaN or throw in the webview's render path. |
+| OSRM-encoded geometry → decoder | Decoded strings are external data at heart (built from a third-party demo server at build time); a decoder that returns partial/NaN points on malformed input converts data rot into a broken map draw. |
+| Module scope → Workers/browser startup | Index construction or geometry decoding at module scope costs startup latency in every environment that imports the package (the Workers 1 s limit; the webview first paint). |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-05-01 | Information Disclosure | Request origin coordinates reaching a log line or storage surface (D-12/D-15 analog) | mitigate | The module contains NO `console.*` and NO storage token anywhere (gate C4 strips comments then greps — the `web/test/no-storage.test.mjs` comment-stripping pattern), takes no logger parameter, and performs no fetch. The origin lives in the caller's frame and dies with it. |
+| T-05-02 | Tampering | Malformed polyline (truncated varint, odd length) decoding to NaN/partial coordinates that poison the map draw | mitigate | `decodePolyline6` throws on truncated/dangling input (never returns partial points) — gate P7 asserts `decode("A")` throws; the fixture backend treats a throwing geometry as a malformed pair and skips it (matching_law #5), so the webview sees `null` (the pending card), never a NaN `LngLat`. |
+| T-05-03 | Denial of Service | Hostile request shape (100 KB destinationId, wrong types) forcing unbounded work | mitigate | The slug guard (`/^[a-z0-9-]{1,64}$/`) rejects before the index is touched (gate F4); the index is a prebuilt Map; per-request work is O(matching pairs) with a ≤ 3-route projection — bounded by the committed dataset size, not the request. |
+| T-05-04 | Spoofing / Elevation of Privilege | A config/env switch substituting a different backend to bypass the honest-pending contract | mitigate | No env reads, no config reads, no dynamic backend registry — the backend is selected IN CODE at the import site (plan 05-04 constructs `createFixtureRoutingSource()` directly). Backend #2/#3 are documented ladder entries (type header), not runtime switches. |
+| T-05-06 | Repudiation | Fixture geometry shipped without the ODbL attribution (OSM derivative data) | mitigate | The `_license`/`_attribution`/`_notice` header travels INSIDE the JSON (the gazetteer's three-surfaces pattern); gate C6 asserts the seed file carries all three fields and the notice names ODbL v1.0. |
+| T-05-07 | Tampering | Fabricated turn instructions passing as real maneuver data (D-10 violation — the app pretending guidance exists) | mitigate | `RouteOption.steps` is typed but fixtures ALWAYS produce `steps: []` (matching_law #4) — gate F5 asserts every served option's steps array is empty; the UI surface (plan 05-04) renders no instruction from it. Day-one fields exist for Phase 6's real consumer (D-07), never for fake data. |
+</threat_model>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>task 1: workspace scaffold + type contracts + route model day-one fields</name>
+  <files>package.json, routing/package.json, routing/tsconfig.json, routing/src/types.ts, routing/test/runner.mjs, routing/test/harness.mjs, routing/test/contract.test.mjs</files>
+  <read_first>
+    - `package.json` (root — `workspaces` is `["theme","bot","web","search"]`; append `"routing"`)
+    - `search/package.json` (the manifest shape to copy — `name`, `private`, `type: "module"`, zero runtime deps, `test`/`typecheck` scripts)
+    - `search/tsconfig.json` (the platform-neutral compilerOptions to copy verbatim)
+    - `search/src/types.ts` (the contract-file style: header comment naming the backend ladder, empty-value-is-load-bearing law)
+    - `search/test/runner.mjs` + `search/test/harness.mjs` (copy BOTH verbatim — the runner auto-discovers `*.test.mjs` via `import.meta.dirname`)
+    - `bot/test/initdata.test.mjs` (the lazy-module-load + letter-numbered-vector suite style the contract suite copies)
+  </read_first>
+  <action>
+**Root `package.json`.** Append `"routing"` to `workspaces` → `["theme","bot","web","search","routing"]`. Add delegate scripts (existing naming convention):
+
+```json
+"routing:test": "npm test -w routing",
+"routing:typecheck": "npm run typecheck -w routing",
+"routing:corpus": "node routing/scripts/route-corpus.mjs"
+```
+
+(`routing:corpus` points at the script plan 05-02 creates — the delegate lands NOW so the root script surface is stable. Do NOT touch `build`/`deploy`/`dev` — this workspace is buildless, the `search/` precedent.)
+
+**`routing/package.json`** — copy `search/package.json`'s shape, renamed:
+
+```json
+{
+  "name": "@araharah/routing",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "test": "node test/runner.mjs",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3"
+  }
+}
+```
+
+NO `exports`/`main` (the `@araharah/theme` + `@araharah/search` precedent — consumers import the explicit subpath with extension). NO runtime dependencies.
+
+**`routing/tsconfig.json`** — copy `search/tsconfig.json` VERBATIM (it already has `resolveJsonModule: true`, `allowImportingTsExtensions`, `verbatimModuleSyntax`, `noUncheckedIndexedAccess`, `strict`, no DOM/Workers lib).
+
+**`routing/test/runner.mjs` + `routing/test/harness.mjs`** — copy `search/test/runner.mjs` and `search/test/harness.mjs` VERBATIM (zero-dependency harness; no Jest/Vitest/Mocha — the repo law).
+
+**`routing/src/types.ts`** — implement the `<interfaces>` block EXACTLY (RoutePoint, RouteRequest, RouteSummary, RouteStep, RouteGeometry, RouteOption, RouteResult, RoutingSource, FixtureRoute, FixturePair) with the header comment naming the D-01 backend ladder and the D-03 null contract. The day-one fields (D-07) are `RouteStep` (typed, optional geometry) and `RouteGeometry.cumulativeDistanceM` — their doc comments must say "GUID-05/06 upstream obligation" verbatim so the type gate (C2) can grep them.
+
+**`routing/test/contract.test.mjs`** — RED-first, lazy-import style (`let typesPromise = null; function loadTypes() { … import("../src/types.ts") … }`). Cases:
+- `C1 interface shape` — `types.ts` exports `RoutingSource` whose `route` returns a Promise; assert via a stub object satisfying the interface compiled by Node's type-stripping (structural: `{ name: "x", route: async () => null }` is assignable by shape — assert `typeof stub.route === "function"` and `stub.route({origin:{lat:0,lng:0},destinationId:"x"}) instanceof Promise`).
+- `C2 day-one model fields` (D-07/D-11 type gate) — read `routing/src/types.ts` AS TEXT and assert it contains `cumulativeDistanceM`, `steps: RouteStep[]`, and the literal string `GUID-05/06 upstream obligation` (the field-level contract is pinned by test, not by hope).
+- `C3 null contract` — the RoutingSource doc comment contains `router pending` (the D-03 semantics are contract documentation, grep-pinned).
+- `C4 no-logging/no-storage/no-network` — for EVERY file matching `routing/src/*.ts`: strip block+line comments (`web/test/no-storage.test.mjs` `stripComments` pattern) and assert ZERO occurrences of `console.`, `localStorage`, `sessionStorage`, `indexedDB`, `document.cookie`, `.put(`, `fetch(`, `XMLHttpRequest`, `process.env` (gate grows with plan 05-02's script — scripts/ live OUTSIDE src/ and are exempt).
+- `C5 zero runtime dependencies` — `routing/package.json` parses with NO `dependencies` field (D-05: nothing in the Worker/browser bundle path).
+- `C6 ODbL header present` — `routing/src/data/route-fixtures.json` parses and carries `_license: "ODbL-1.0"`, `_attribution` containing `OpenStreetMap`, `_notice` containing `ODbL`, and `version: 1` (T-05-06).
+
+**Create `routing/src/data/route-fixtures.json`** with exactly the seed schema from the `<interfaces>` block — `pairs: []` (plan 05-02's script populates it; the schema + ODbL header ship NOW so the loader proof has real bytes).
+
+**Acceptance:** `npm run routing:test` exits 0 with `PASS C1`…`PASS C6`; `npm run routing:typecheck` exits 0.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm install --package-lock-only --workspaces 2>&1 | tail -3 ; npm run routing:test 2>&1 | tail -15 ; npm run routing:typecheck 2>&1 | tail -5 ; node -e "const w=require('./package.json').workspaces; if(!w.includes('routing')) throw new Error('routing workspace missing'); console.log('OK')"</automated>
+  </verify>
+  <acceptance_criteria>
+    - `node -e "const w=require('./package.json').workspaces; if(!w.includes('routing')) throw new Error(1); console.log('OK')"` exits 0
+    - `grep -q '"routing:test": "npm test -w routing"' package.json` exits 0 AND `grep -q '"routing:corpus": "node routing/scripts/route-corpus.mjs"' package.json` exits 0
+    - `test -f routing/package.json && test -f routing/tsconfig.json && test -f routing/test/runner.mjs && test -f routing/test/harness.mjs` exits 0
+    - `node -e "const p=require('./routing/package.json'); if(p.name!=='@araharah/routing') throw new Error(1); if(p.dependencies) throw new Error('zero runtime deps'); console.log('OK')"` exits 0
+    - `npm run routing:test` exits 0 and the output contains `PASS C1` through `PASS C6`
+    - `npm run routing:typecheck` exits 0
+    - `grep -q 'export interface RoutingSource' routing/src/types.ts` exits 0 AND `grep -q 'cumulativeDistanceM' routing/src/types.ts` exits 0 AND `grep -q 'GUID-05/06 upstream obligation' routing/src/types.ts` exits 0
+    - `node -e "const f=require('./routing/src/data/route-fixtures.json'); if(!Array.isArray(f.pairs)||f.pairs.length!==0) throw new Error(1); if(f._license!=='ODbL-1.0') throw new Error(2); console.log('OK')"` exits 0
+  </acceptance_criteria>
+  <done>The `routing/` workspace exists as a buildless fifth npm workspace with the RoutingSource contract (D-01 ladder + D-03 null semantics + D-07 day-one fields), the committed empty fixture schema with ODbL header, and a 6-case contract suite green.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 2: polyline6 codec (pure, zero-dependency)</name>
+  <files>routing/src/polyline.ts, routing/test/polyline.test.mjs</files>
+  <read_first>
+    - `routing/src/types.ts` (task 1's output — `RoutePoint` is the codec's in/out shape)
+    - `.planning/phases/05-routing-route-display/05-RESEARCH.md` (Finding 1 — the verbatim-storage decision and the external OSRM vector provenance)
+    - `search/src/distance.ts` (the "pure, zero imports, header comment" module style)
+  </read_first>
+  <action>
+**`routing/src/polyline.ts`** — the Google encoded-polyline algorithm at precision 1e6 (polyline6 — what the OSRM demo's `geometries=polyline6` returns). Exports:
+
+```typescript
+export function decodePolyline6(encoded: string): RoutePoint[];
+export function encodePolyline6(points: readonly RoutePoint[]): string;
+```
+
+Implementation laws:
+- Pure: ZERO imports, ZERO I/O (the `search/src/distance.ts` header-comment style; cite RESEARCH Finding 1).
+- Standard algorithm: per coordinate, delta from previous value (`Math.round(value * 1e6) - prev`), zigzag (`v < 0 ? ~(v << 1) : (v << 1)`), 5-bit varint chunks with continuation bit 0x20, chunk + 63 as the output char. Lat then lng per point.
+- **Decode MUST throw on malformed input** — a dangling continuation chunk (string ends mid-varint) or odd trailing coordinate: throw `new Error("truncated polyline6 input")` (T-05-02: never return partial or NaN points). `""` decodes to `[]` (legal empty).
+- Round-trip property: values live on the 1e-6 grid (decode divides integers by 1e6), so `encode(decode(s)) === s` for any valid string — the corpus gate (plan 05-02) leans on this.
+
+**`routing/test/polyline.test.mjs`** — RED-first. Cases (vectors from the `<polyline_vectors>` block — they are computed ground truth, not guesses):
+- `P1 zero vector` — `decode("??")` → `[{lat:0,lng:0}]`; encode round-trip.
+- `P2 KL point vector` — encode of `[{lat:3.1578,lng:101.7117}]` === `` "oqv_Egt~~`E" `` and decode inverts exactly.
+- `P3 delta accumulation` — the 3-point KL vector (encode string from `<polyline_vectors>`); decode returns the 3 points exactly.
+- `P4 negative zigzag` — the V4 vector (asserts the `~` inversion branch).
+- `P5 external OSRM vector` — decode of the live-probe string's first point deep-equals `{lat:3.157846,lng:101.711716}`; `encode(decode(s)) === s` for the full string (external ground truth, RESEARCH Finding 1).
+- `P6 empty input` — `decode("")` → `[]`; `encode([])` → `""`.
+- `P7 malformed refusal` — `decode("A")` throws; `decode("g")` throws (dangling continuation); neither returns a point (T-05-02).
+- `P8 round-trip law` — for EVERY vector string in this suite: `encode(decode(s)) === s`.
+
+**Acceptance:** `npm run routing:test` exits 0 with `PASS P1`…`PASS P8` (plus task 1's C-cases still green).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run routing:test 2>&1 | tail -15 ; npm run routing:typecheck 2>&1 | tail -5</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm run routing:test` exits 0 and the output contains `PASS P1` through `PASS P8`
+    - `npm run routing:typecheck` exits 0
+    - `grep -q 'export function decodePolyline6' routing/src/polyline.ts` exits 0 AND `grep -q 'export function encodePolyline6' routing/src/polyline.ts` exits 0
+    - `node -e "import('./routing/src/polyline.ts').then(m=>{ if(JSON.stringify(m.decodePolyline6('??'))!==JSON.stringify([{lat:0,lng:0}])) throw new Error('P1'); if(m.encodePolyline6([{lat:3.1578,lng:101.7117}])!=='oqv_Egt~~\`E') throw new Error('P2'); try{m.decodePolyline6('A'); throw new Error('should-throw');}catch(e){} console.log('codec OK')})"` exits 0
+    - `grep -v '^\s*//' routing/src/polyline.ts | grep -c 'from "' | head -1` returns 0 (ZERO imports — the distance.ts precedent)
+  </acceptance_criteria>
+  <done>The polyline6 codec exists as a pure zero-dependency module proven by 8 named cases including the external live-OSRM vector and the malformed-input refusal law.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 3: geo math + fixture backend + lazy loader + public API + three-environment proof</name>
+  <files>routing/src/geo.ts, routing/src/fixture-source.ts, routing/src/index.ts, routing/test/fixture-source.test.mjs, routing/test/loader-env.test.mjs</files>
+  <read_first>
+    - `search/src/gazetteer.ts` (LAW 1 lazy-memoized index, LAW 2 static JSON import, LAW 3 no logging/storage — copied as a posture, adapted to route data)
+    - `search/src/source.ts` (the slug-guard-first ordering + deterministic shape of a backend implementation)
+    - `search/test/loader-env.test.mjs` (the three-environment proof to mirror: bare-Node import + esbuild bundle marker)
+    - `search/src/index.ts` (the public-API surface style: named exports only, subpath-with-extension import law in the header)
+    - `routing/src/types.ts` + `routing/src/polyline.ts` (tasks 1–2 outputs this plan builds on)
+  </read_first>
+  <action>
+**`routing/src/geo.ts`** — two pure functions, zero imports:
+
+```typescript
+export function haversineM(a: RoutePoint, b: RoutePoint): number;
+export function deriveCumulativeDistanceM(points: readonly RoutePoint[]): number[];
+```
+
+- `haversineM`: standard great-circle distance, earth radius 6_371_000 m, returns meters (finite for finite inputs).
+- `deriveCumulativeDistanceM`: `[0, d(p0→p1), d(p0→p1)+d(p1→p2), …]` — same length as input, `[0] === 0`, non-decreasing; single point → `[0]`; empty → `[]`. This is the snapped-progress support field (D-07): Phase 6's guidance snaps a fix's progress along the line using this array instead of re-deriving it.
+
+**`routing/src/fixture-source.ts`** — backend #1 per the `<matching_law>` block: `ORIGIN_TOLERANCE_M = 200`, `createFixtureRoutingSource(data?)`, `getPairOrigin(pairId)`, `getPairs()`. Static import of the seed JSON (`import fixturesData from "./data/route-fixtures.json" with { type: "json" };` — the `data` parameter overrides it for tests). Header comment: name the D-02/D-03/D-12 laws and the 200 m tolerance rationale (GPS jitter around a known landmark, never a fabricated route for an unknown origin).
+
+**`routing/src/index.ts`** — named exports ONLY, header documenting the subpath-with-extension import law (`import { createFixtureRoutingSource } from "@araharah/routing/src/index.ts";` — a bare `@araharah/routing` specifier resolves to NOTHING):
+
+```typescript
+export type {
+  RoutePoint, RouteRequest, RouteSummary, RouteStep,
+  RouteGeometry, RouteOption, RouteResult, RoutingSource,
+  FixturePair, FixtureRoute,
+} from "./types.ts";
+export { decodePolyline6, encodePolyline6 } from "./polyline.ts";
+export { haversineM, deriveCumulativeDistanceM } from "./geo.ts";
+export {
+  ORIGIN_TOLERANCE_M,
+  createFixtureRoutingSource,
+  getPairOrigin,
+  getPairs,
+} from "./fixture-source.ts";
+```
+
+**`routing/test/fixture-source.test.mjs`** — RED-first, injecting SYNTHETIC datasets via `createFixtureRoutingSource(data)` (never the network, never the committed file). Build one synthetic pair fixture in the test: pairId `"kl-tower-to-kl-sentral"`, origin `{lat:3.1528,lng:101.7038,label:"Kuala Lumpur Tower"}`, destinationId `"kl-sentral"`, two routes whose `geometry` is produced by `encodePolyline6` over small point paths around KL Sentral, distanceM/durationS sane (e.g. 4_800 / 600). Cases:
+- `F1 empty corpus → null` — `createFixtureRoutingSource({version:1,originToleranceM:200,pairs:[]})` → every `route()` resolves `null` (the committed seed's state until 05-02 fills it).
+- `F2 match serves best-first` — request with the pinned origin + destinationId resolves a result with `backend:"fixture"`, 2 options, option 0 === fixture route order preserved, geometry points decode to the synthetic path, cumulative array starts at 0 and is non-decreasing, `steps` deep-equals `[]` for every option (T-05-07).
+- `F3 tolerance boundary` — origin offset ~0.001 deg lat (≈111 m) from the pinned origin → serves; offset ~0.002 deg (≈222 m) → `null` (the 200 m law, haversine-verified).
+- `F4 slug guard` — destinationId `"not a slug!"` and `"".padEnd(65,"a")` → `null` WITHOUT consulting the index (T-05-03).
+- `F5 unknown destination → null` — a valid slug with no pair → `null` (the D-03 honest pending; never a nearest-match).
+- `F6 malformed pair skipped` — a dataset containing a pair with `distanceM: Number.NaN` and a pair with an empty routes array serves `null` (both skipped) while a well-formed sibling pair still serves — defensive validation, never a throw.
+- `F7 lazy index` — source-text gate: `fixture-source.ts` with comments stripped has NO `new Map(` and NO `decodePolyline6(` call at TOP LEVEL (all inside functions — the gazetteer LAW 1 posture, Workers 1 s startup + webview first paint).
+- `F8 getPairOrigin` — resolves the synthetic pair's pinned origin by pairId; unknown/garbage pairId → `null`.
+
+**`routing/test/loader-env.test.mjs`** — the three-environment proof (Phase 4's top-mechanical-risk pattern):
+- `L1 bare-Node static JSON import` — `import fixtures from "../src/data/route-fixtures.json" with { type: "json" }` works under Node 24 type-stripping and exposes `pairs`.
+- `L2 esbuild bundle marker` — `node_modules/.bin/esbuild routing/src/index.ts --bundle --format=esm --outfile=/tmp/routing-bundle.mjs` (run via `execFileSync` or spawnSync from the test) exits 0 AND the bundle text contains the seed marker `router.project-osrm.org` (the `_source` header survives inlining) — Vite uses the same esbuild inlining, so the marker proves the browser path; L1 proves the corpus-runner path.
+- `L3 the empty seed serves null` — the DEFAULT `createFixtureRoutingSource()` (no injection) resolves `null` for a well-formed KL request (proves the committed file parses through the whole path).
+
+**Acceptance:** `npm run routing:test` exits 0 with `PASS F1`…`PASS F8` + `PASS L1`…`PASS L3`; `npm run routing:typecheck` exits 0.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run routing:test 2>&1 | tail -20 ; npm run routing:typecheck 2>&1 | tail -5 ; ls node_modules/.bin/esbuild >/dev/null && echo "esbuild present"</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm run routing:test` exits 0 and the output contains `PASS F1` through `PASS F8` and `PASS L1` through `PASS L3`
+    - `npm run routing:typecheck` exits 0
+    - `grep -q 'export function createFixtureRoutingSource' routing/src/fixture-source.ts` exits 0 AND `grep -q 'ORIGIN_TOLERANCE_M = 200' routing/src/fixture-source.ts` exits 0
+    - `grep -q 'route-fixtures.json' routing/src/fixture-source.ts` exits 0 (the static import is present — LAW 2)
+    - `grep -q 'export function haversineM' routing/src/geo.ts` exits 0 AND `grep -q 'export function deriveCumulativeDistanceM' routing/src/geo.ts` exits 0
+    - `node -e "import('./routing/src/index.ts').then(m=>{ if(m.ORIGIN_TOLERANCE_M!==200) throw new Error(1); if(typeof m.createFixtureRoutingSource!=='function') throw new Error(2); if(typeof m.getPairOrigin!=='function') throw new Error(3); console.log('index OK')})"` exits 0
+    - `node -e "import('./routing/src/geo.ts').then(m=>{const c=m.deriveCumulativeDistanceM([{lat:0,lng:0},{lat:0.001,lng:0}]); if(c.length!==2||c[0]!==0||!(c[1]>100&&c[1]<120)) throw new Error('cumulative math'); console.log('geo OK')})"` exits 0
+    - `grep -q 'router.project-osrm.org' routing/src/data/route-fixtures.json` exits 0 (the loader marker exists in the committed seed)
+  </acceptance_criteria>
+  <done>The fixture RoutingSource backend exists with the 200 m matching law, honest-null pending semantics, defensive pair validation, lazy index, and a proven three-environment loader — the complete backend #1 of the D-01 ladder.</done>
+</task>
+
+</tasks>
+
+<verification>
+1. `npm run routing:test` — all C/P/F/L cases green (exit 0).
+2. `npm run routing:typecheck` — exit 0.
+3. Root delegates: `npm run routing:test` and `npm run routing:typecheck` work from the repo root; `workspaces` contains `routing`.
+4. `grep -c 'console\.' routing/src/*.ts` → 0 across every src file (comments stripped by the C4 gate).
+5. `node -e "import('./routing/src/index.ts').then(m=>m.createFixtureRoutingSource().route({origin:{lat:3.1528,lng:101.7038},destinationId:'kl-sentral'}).then(r=>{ if(r!==null) throw new Error('seed must serve null until 05-02 fills fixtures'); console.log('honest-null OK')}))"` — the empty committed corpus is honest.
+</verification>
+
+<success_criteria>
+- The `@araharah/routing` workspace compiles clean and its 17-case suite passes from the repo root.
+- The RoutingSource contract, codec, geo math, fixture backend, and public API all exist with the exact names downstream plans import.
+- The committed seed fixture file carries the ODbL header and serves honest nulls.
+- Zero runtime dependencies, zero network, zero logging, zero storage in `routing/src/`.
+</success_criteria>
diff --git a/.planning/phases/05-routing-route-display/05-02-PLAN.md b/.planning/phases/05-routing-route-display/05-02-PLAN.md
new file mode 100644
index 0000000..474689c
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-02-PLAN.md
@@ -0,0 +1,304 @@
+---
+phase: 05-routing-route-display
+plan: 02
+type: execute
+wave: 2
+depends_on: ["01"]
+files_modified:
+  - package.json
+  - routing/package.json
+  - routing/test/fixtures/golden-pairs.json
+  - routing/scripts/fetch-route-fixtures.mjs
+  - routing/scripts/route-corpus.mjs
+  - routing/src/data/route-fixtures.json
+  - routing/test/corpus.test.mjs
+  - routing/test/loader-env.test.mjs
+autonomous: true
+requirements: [RTNG-01, RTNG-02]
+must_haves:
+  decisions_implemented:
+    - "D-02: fixture routes for the 10–20 golden KL pairs, geometries precomputed at BUILD time by a repo script hitting the public OSRM demo server once, committed as compact encoded polylines, each pair pinning distance/duration consistency gates"
+    - "D-12: fixture geometries are public-data routes between public places — the corpus gate mechanically proves every pinned origin equals a gazetteer landmark coordinate; the script header documents the maintainer-machine boundary"
+    - "D-11: the fixture payload stays inside the bundle budget — a fixture-level gzipped-size gate (≤ 100 KB) gives early warning under the 200 KB BA9 ceiling"
+    - "RTNG-02: the alternatives floor — at least 4 pairs carry ≥ 2 routes so the chips/redraw surface has real data"
+  truths:
+    - "15 golden pairs are committed in routing/src/data/route-fixtures.json, each with 1–3 best-first routes stored as verbatim polyline6 strings"
+    - "Every committed pair passes the OFFLINE tolerance gate: geometry↔summary haversine consistency (0.85–1.10 × distanceM), duration sanity (1.0–30 m/s average speed), and exact codec round-trip — no test ever touches a network"
+    - "Every pair's pinned origin coordinate equals SOME gazetteer entry's lat/lng within 1e-4 degrees — no user coordinate can have entered a fixture (mechanical D-12 proof)"
+    - "Every pair's destinationId exists in the shared gazetteer; exactly zero pairs target the pending-probe destination 'national-museum' (the 05-05 capture's pending-state carrier)"
+    - "The fetch script is a repo tool on the overpass-topup.mjs pattern: descriptive User-Agent, inter-request delay, per-pair hard-fail diagnostics, never imported at runtime, never run in CI or at web-build time"
+    - "The corpus gate is both a CLI (npm run routing:corpus) and an in-suite Nyquist gate (npm run routing:test) — one measurement core, two reporters, no drift"
+  artifacts:
+    - path: "routing/test/fixtures/golden-pairs.json"
+      provides: "the hand-authored pinned corpus: 15 pairs (origin landmark + destinationId + coordinates), the KL bbox, the size budget, the pending-probe id"
+      contains: "\"pairs\""
+    - path: "routing/scripts/fetch-route-fixtures.mjs"
+      provides: "the build-time OSRM-demo fetch tool (maintainer machine; D-12 boundary documented in header)"
+      contains: "router.project-osrm.org"
+    - path: "routing/scripts/route-corpus.mjs"
+      provides: "measurePairs() — the corpus measurement core the CLI prints and the suite asserts"
+      contains: "export function measurePairs"
+    - path: "routing/src/data/route-fixtures.json"
+      provides: "the COMMITTED fixture dataset — 15 pairs populated from the OSRM demo (this plan replaces 05-01's empty seed)"
+      contains: "\"pairId\""
+    - path: "routing/test/corpus.test.mjs"
+      provides: "the RT1–RT10 offline tolerance gate suite (in-process, deterministic)"
+      contains: "RT1"
+  key_links:
+    - from: "routing/scripts/fetch-route-fixtures.mjs"
+      to: "routing/test/fixtures/golden-pairs.json"
+      via: "the script reads the pinned corpus and fetches each pair from the OSRM demo"
+      pattern: "golden-pairs.json"
+    - from: "routing/scripts/fetch-route-fixtures.mjs"
+      to: "routing/src/data/route-fixtures.json"
+      via: "collect-then-write: the committed dataset is regenerated atomically per run"
+      pattern: "route-fixtures.json"
+    - from: "routing/scripts/route-corpus.mjs"
+      to: "routing/src/data/route-fixtures.json"
+      via: "the measurement core validates the committed dataset (never the script output directly)"
+      pattern: "route-fixtures.json"
+    - from: "routing/test/corpus.test.mjs"
+      to: "routing/scripts/route-corpus.mjs"
+      via: "the suite imports measurePairs and asserts the SAME numbers the CLI prints (gazetteer-corpus.mjs precedent)"
+      pattern: "measurePairs"
+---
+
+<objective>
+Populate the committed fixture dataset with 10–20 real KL origin/destination pairs precomputed from the public OSRM demo server (build-time, public coordinates only), and pin them behind the offline corpus tolerance gate — the phase's primary acceptance instrument (the amended ROADMAP SC3: "the golden-route corpus routes cleanly through the fixture RoutingSource backend with bundle-size and type gates holding").
+
+Purpose: D-02 makes fixture geometry the product's actual route data for v1's golden pairs; D-12 makes "public data between public places" a mechanically provable property (every pinned origin must equal a gazetteer landmark coordinate); RTNG-02 needs real alternatives (≥ 4 pairs with ≥ 2 routes) for the chips/redraw surface. This plan delivers the hand-authored pair list, the maintainer fetch script (overpass-topup.mjs pattern), the populated committed dataset, and the RT1–RT10 offline gate — both as a CLI and as an in-suite Nyquist gate.
+
+Output: `routing/test/fixtures/golden-pairs.json` (15 pinned pairs), `routing/scripts/fetch-route-fixtures.mjs` (repo tool), a committed `routing/src/data/route-fixtures.json` with 15 real pairs, `routing/scripts/route-corpus.mjs` + `routing/test/corpus.test.mjs` (the gate), and the `routing:fixtures` root delegate.
+</objective>
+
+<execution_context>
+@$HOME/.config/opencode/get-shit-done/workflows/execute-plan.md
+@$HOME/.config/opencode/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@AGENTS.md
+@.planning/phases/05-routing-route-display/05-CONTEXT.md
+@.planning/phases/05-routing-route-display/05-RESEARCH.md
+@.planning/phases/05-routing-route-display/05-PATTERNS.md
+@.planning/phases/05-routing-route-display/05-01-PLAN.md
+@search/scripts/overpass-topup.mjs
+@search/scripts/gazetteer-corpus.mjs
+@search/test/corpus.test.mjs
+@search/src/data/kl-gazetteer.json
+@routing/src/types.ts
+@routing/src/index.ts
+@routing/src/data/route-fixtures.json
+
+<pinned_corpus>
+The 15 golden pairs — hand-pinned NOW (the executor does not invent pairs; the executor verifies each pair routes via the script and records the outcome). All origins AND destinations are gazetteer entries from `search/src/data/kl-gazetteer.json` (public landmark coordinates; the D-12 proof keys off exactly this). Coordinates below are the gazetteer's own values — the corpus file repeats them verbatim so the file is self-contained, and gate RT2b re-proves they match the gazetteer.
+
+| # | pairId | origin (id) | origin lat,lng | destinationId |
+|---|--------|-------------|-----------------|---------------|
+| 1 | kl-tower-to-kl-sentral | kl-tower | 3.1528, 101.7038 | kl-sentral |
+| 2 | kl-sentral-to-suria-klcc | kl-sentral | 3.1343, 101.6869 | suria-klcc |
+| 3 | suria-klcc-to-bangsar | suria-klcc | 3.1578, 101.7117 | bangsar |
+| 4 | mid-valley-to-bukit-bintang | mid-valley | 3.118, 101.6779 | bukit-bintang |
+| 5 | bukit-bintang-to-mid-valley | bukit-bintang | 3.1466, 101.7106 | mid-valley |
+| 6 | pwtc-to-sunway-velocity | pwtc | 3.1768, 101.698 | sunway-velocity |
+| 7 | masjid-jamek-to-lake-gardens | masjid-jamek | 3.1484, 101.6953 | lake-gardens |
+| 8 | titiwangsa-to-petaling-street | titiwangsa | 3.1714, 101.7016 | petaling-street |
+| 9 | sunway-pyramid-to-pavilion-kl | sunway-pyramid | 3.0726, 101.6069 | pavilion-kl |
+| 10 | central-market-to-merdeka-118 | central-market | 3.1454, 101.6953 | merdeka-118 |
+| 11 | little-india-brickfields-to-aquaria-klcc | little-india-brickfields | 3.1306, 101.6869 | aquaria-klcc |
+| 12 | national-museum-to-pudu-raya | national-museum | 3.1378, 101.687 | pudu-raya |
+| 13 | mid-valley-to-ioi-city-mall | mid-valley | 3.118, 101.6779 | ioi-city-mall |
+| 14 | kl-sentral-to-sunway-pyramid | kl-sentral | 3.1343, 101.6869 | sunway-pyramid |
+| 15 | berjaya-times-square-to-titiwangsa | berjaya-times-square | 3.1421, 101.7101 | titiwangsa |
+
+Notes:
+- The pair ids follow `<origin-id>-to-<dest-id>` (slug charset; the `?fixpair=` knob value in plan 05-05).
+- `national-museum` appears ONLY as an ORIGIN (pair 12) — it is NEVER a destinationId (gate RT4 pins this; plan 05-05's pending capture uses `dest=national-museum` as the supported-but-out-of-corpus carrier).
+- Distances span ~1 km (pair 10) to ~20 km (pair 13) — short/mid/long spread so the UI-SPEC's card/chips/camera behaviors are exercised across zoom ranges.
+- Pairs 4/5 and 2/3 give direction-reversed coverage (one-way streets and alternatives differ by direction — the demo script walks these).
+</pinned_corpus>
+
+<osrm_contract>
+The OSRM demo request shape (VERIFIED LIVE 2026-10-24 — see 05-RESEARCH.md Finding 2):
+
+```
+GET https://router.project-osrm.org/route/v1/driving/{originLng},{originLat};{destLng},{destLat}?alternatives=2&overview=full&geometries=polyline6
+```
+
+- `alternatives=2` → up to 2 alternates (≤ 3 total; matches RTNG-02's "up to 3").
+- `overview=full` → complete geometry; `geometries=polyline6` → the string stored VERBATIM.
+- Response: `code: "Ok"`, `routes[]` best-first with `distance` (m), `duration` (s), `geometry` (string).
+- Per-pair HARD FAIL when `code !== "Ok"` or `routes.length === 0` — name the pair in the diagnostic, exit 1, write NOTHING (collect-then-write).
+- Do NOT request `steps` (turn instructions are Phase 6; fixture steps stay empty — D-10).
+- Do NOT retry on failure beyond ONE immediate retry per pair (transient 5xx); a second failure is a hard fail for that pair.
+</osrm_contract>
+
+<environment_facts>
+Verified in this session — do not re-derive:
+
+- The OSRM demo server answered a KL route request with `code: Ok`, 2 routes, polyline6 geometry (~1200 chars for ~6.9 km) on 2026-10-24 — the endpoint, parameter set, and response shape are current, not assumed.
+- 15 pairs × 1 request each ≈ 15 requests + up to 1 retry each — light, fair use of a free demo server; the 1200 ms inter-request delay keeps it polite (~20 s total runtime).
+- `search/scripts/overpass-topup.mjs` is the repo-tool precedent: mandatory descriptive User-Agent, inter-request delay, per-item soft diagnostics, writes committed JSON, imported by NOTHING at runtime.
+- `search/scripts/gazetteer-corpus.mjs` exports `measureCorpus()` precisely so `search/test/corpus.test.mjs` can assert the same numbers in-process — "one measurement, two reporters, no drift" is the established corpus-gate shape.
+- The gazetteer's 30 entries and exact coordinates are in `search/src/data/kl-gazetteer.json` — the corpus file's origin coordinates above are copied from there.
+- The `search` workspace imports (`import … from "../src/index.ts"`) work in `.mjs` scripts under Node 24 type-stripping (`gazetteer-corpus.mjs` does exactly this).
+</environment_facts>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| OSRM demo server → fetch script → committed dataset | A third-party free service supplies the geometry. Drift (data updates) is benign for a committed snapshot; POISONING (wrong/malformed geometry) must be caught offline by the tolerance gate before it can ship. |
+| Pinned corpus file → fetch script | The hand-authored pairs file decides which coordinates leave the machine. A user coordinate or a private address entering this file would be shipped to a third party — the D-12 red line. |
+| Committed dataset → bundle → users | Fixture bytes ride the web bundle (public data, but size is an availability budget — D-11). |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-05-05 | Tampering / Information Disclosure | (a) OSRM-supplied geometry inconsistent with its own summary silently shipping; (b) a non-public coordinate entering the pinned corpus and being sent to the demo server | mitigate | (a) RT5 recomputes each route's haversine polyline length OFFLINE and demands 0.85–1.10 × distanceM, RT6 bounds average speed to 1.0–30 m/s, RT3 re-decodes and re-encodes every geometry (exact round-trip) — a poisoned or drifting dataset fails `npm run routing:test`, not just the script. (b) RT2b mechanically proves every pinned origin equals SOME gazetteer entry coordinate within 1e-4 deg (≈11 m) — the corpus can only contain public landmark points, so the maintainer machine sends nothing private (D-12's "no user coordinate ever enters a fixture" made checkable). |
+| T-05-12 | Denial of Service (availability budget) | Fixture payload growth pushing the web bundle over the D-11 budget | mitigate | RT9 gzips the committed dataset and fails above 100 KB (expected ≈ 20 KB at 15 pairs × ~1.2–2.5 KB) — early warning under BA9's 200 KB all-in ceiling (plan 05-05 owns the final gate; the two tiers share this threat ID); the gate prints the measured size so growth is visible, never discovered. |
+| T-05-06 | Repudiation | Derivative OSM geometry shipped without licence/attribution | mitigate | The script writes the ODbL header fields (`_license`/`_attribution`/`_notice`/`_source`) into every regenerated file (they are part of the file template, not an optional add-on); RT8 asserts them post-write — the notice cannot be lost by a regeneration. |
+</threat_model>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>task 1: pinned golden-pairs corpus + fetch script + populated committed dataset</name>
+  <files>package.json, routing/package.json, routing/test/fixtures/golden-pairs.json, routing/scripts/fetch-route-fixtures.mjs, routing/src/data/route-fixtures.json</files>
+  <read_first>
+    - `search/scripts/overpass-topup.mjs` (the repo-tool pattern: UA, delay, diagnostics, committed-JSON write)
+    - `search/src/data/kl-gazetteer.json` (the origin/destination coordinates and ids — the corpus file must agree with them)
+    - `routing/src/types.ts` (FixturePair/FixtureRoute — the written dataset must typecheck against these via the corpus runner's import)
+    - `routing/src/data/route-fixtures.json` (05-01's seed — this task REPLACES its `pairs: []` with real data, preserving the header fields)
+    - `.planning/phases/05-routing-route-display/05-RESEARCH.md` (Finding 2 — the verified request shape)
+  </read_first>
+  <action>
+**`routing/test/fixtures/golden-pairs.json`** — hand-author the pinned corpus, exactly the `<pinned_corpus>` table:
+
+```json
+{
+  "_comment": "Pinned golden-pair corpus (D-02/D-12). Origins AND destinations are gazetteer landmarks (public data). RT2b proves every origin equals a gazetteer coordinate. national-museum is never a destinationId (RT4) — it is the 05-05 pending-probe carrier.",
+  "klBbox": { "minLat": 2.9, "maxLat": 3.4, "minLng": 101.4, "maxLng": 102.0 },
+  "fixtureGzipBudgetBytes": 102400,
+  "pendingProbeDestinationId": "national-museum",
+  "alternativesFloorPairs": 4,
+  "pairs": [
+    { "pairId": "kl-tower-to-kl-sentral", "originId": "kl-tower", "origin": { "lat": 3.1528, "lng": 101.7038, "label": "Kuala Lumpur Tower" }, "destinationId": "kl-sentral" },
+    { "pairId": "kl-sentral-to-suria-klcc", "originId": "kl-sentral", "origin": { "lat": 3.1343, "lng": 101.6869, "label": "KL Sentral" }, "destinationId": "suria-klcc" },
+    { "pairId": "suria-klcc-to-bangsar", "originId": "suria-klcc", "origin": { "lat": 3.1578, "lng": 101.7117, "label": "Suria KLCC" }, "destinationId": "bangsar" },
+    { "pairId": "mid-valley-to-bukit-bintang", "originId": "mid-valley", "origin": { "lat": 3.118, "lng": 101.6779, "label": "Mid Valley Megamall" }, "destinationId": "bukit-bintang" },
+    { "pairId": "bukit-bintang-to-mid-valley", "originId": "bukit-bintang", "origin": { "lat": 3.1466, "lng": 101.7106, "label": "Bukit Bintang" }, "destinationId": "mid-valley" },
+    { "pairId": "pwtc-to-sunway-velocity", "originId": "pwtc", "origin": { "lat": 3.1768, "lng": 101.698, "label": "PWTC" }, "destinationId": "sunway-velocity" },
+    { "pairId": "masjid-jamek-to-lake-gardens", "originId": "masjid-jamek", "origin": { "lat": 3.1484, "lng": 101.6953, "label": "Masjid Jamek" }, "destinationId": "lake-gardens" },
+    { "pairId": "titiwangsa-to-petaling-street", "originId": "titiwangsa", "origin": { "lat": 3.1714, "lng": 101.7016, "label": "Taman Tasik Titiwangsa" }, "destinationId": "petaling-street" },
+    { "pairId": "sunway-pyramid-to-pavilion-kl", "originId": "sunway-pyramid", "origin": { "lat": 3.0726, "lng": 101.6069, "label": "Sunway Pyramid" }, "destinationId": "pavilion-kl" },
+    { "pairId": "central-market-to-merdeka-118", "originId": "central-market", "origin": { "lat": 3.1454, "lng": 101.6953, "label": "Central Market" }, "destinationId": "merdeka-118" },
+    { "pairId": "little-india-brickfields-to-aquaria-klcc", "originId": "little-india-brickfields", "origin": { "lat": 3.1306, "lng": 101.6869, "label": "Brickfields" }, "destinationId": "aquaria-klcc" },
+    { "pairId": "national-museum-to-pudu-raya", "originId": "national-museum", "origin": { "lat": 3.1378, "lng": 101.687, "label": "National Museum" }, "destinationId": "pudu-raya" },
+    { "pairId": "mid-valley-to-ioi-city-mall", "originId": "mid-valley", "origin": { "lat": 3.118, "lng": 101.6779, "label": "Mid Valley Megamall" }, "destinationId": "ioi-city-mall" },
+    { "pairId": "kl-sentral-to-sunway-pyramid", "originId": "kl-sentral", "origin": { "lat": 3.1343, "lng": 101.6869, "label": "KL Sentral" }, "destinationId": "sunway-pyramid" },
+    { "pairId": "berjaya-times-square-to-titiwangsa", "originId": "berjaya-times-square", "origin": { "lat": 3.1421, "lng": 101.7101, "label": "Berjaya Times Square" }, "destinationId": "titiwangsa" }
+  ]
+}
+```
+
+**`routing/scripts/fetch-route-fixtures.mjs`** — the maintainer build tool (overpass-topup.mjs pattern). Header comment MUST contain this D-12 boundary statement verbatim: `D-12 BOUNDARY: this script runs on the MAINTAINER'S machine against FIXED PUBLIC coordinates (gazetteer landmarks). No user coordinate can ever enter a fixture. The app itself gains NO runtime dependency on this server or any network.` Behavior:
+- Read `routing/test/fixtures/golden-pairs.json` + the gazetteer (`../node_modules/@araharah/search/src/data/kl-gazetteer.json`? NO — resolve the workspace package by RELATIVE path `../../search/src/data/kl-gazetteer.json`, the `gazetteer-corpus.mjs` cross-workspace import precedent — verify the path exists at runtime and hard-fail with a diagnostic if not).
+- For each pair: validate the origin coordinate matches the gazetteer's `originId` entry within 1e-4 deg AND the destinationId exists (refuse to even fetch a non-public or unknown coordinate — fail fast, name the pair).
+- Fetch the `<osrm_contract>` URL with header `User-Agent: araharah-fixtures/1.0 (build-time fixture precompute; repo: araharah)`, `1200 ms` delay between pairs, ONE retry on network/5xx failure.
+- Per-pair hard fail on `code !== "Ok"` or `routes.length === 0` (collect-then-write: on ANY pair failure, exit 1 with the failing pair named and the committed file UNTOUCHED).
+- Map each OSRM route → `{ geometry: r.geometry, distanceM: r.distance, durationS: r.duration }` (order preserved, cap 3).
+- Write `routing/src/data/route-fixtures.json` preserving 05-01's header fields (`_license`, `_attribution`, `_notice`, `_source`) with `version: 1`, `originToleranceM: 200`, and the populated `pairs` — 2-space JSON, trailing newline.
+- Support `--only=<pairId>` to regenerate one pair (merging into the existing committed file — a single-pair repair must not churn the other 14).
+
+**Run the script NOW** (this is the plan's build step): `node routing/scripts/fetch-route-fixtures.mjs` from the repo root. The committed `routing/src/data/route-fixtures.json` MUST end this task with 15 real pairs. If the OSRM demo server is unreachable at execution time: retry the fetch up to 3 times over ~10 minutes; if still unreachable, STOP this plan with an explicit CHECKPOINT note in the summary (fixtures are the phase's data product — shipping empty fixtures fails the corpus gate by design).
+
+**Root `package.json`** — add `"routing:fixtures": "node routing/scripts/fetch-route-fixtures.mjs"` (delegate next to `routing:corpus`).
+
+**`routing/package.json`** — add `"fixtures": "node scripts/fetch-route-fixtures.mjs"` and `"corpus": "node scripts/route-corpus.mjs"` scripts.
+
+**Acceptance:** the committed dataset carries 15 pairs; `npm run routing:test` still exits 0 (05-01's suites pass against REAL data — F1's empty-seed case L3 now asserts the default source serves kl-tower→kl-sentraL… NOTE: loader-env L3 asserted the seed serves null; with real data it must now assert a KNOWN pair SERVES — update `L3` in `routing/test/loader-env.test.mjs` accordingly: the default source serves pair 1 for a request at its pinned origin, still returns null for an origin 300 m away).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && node -e "const f=require('./routing/src/data/route-fixtures.json'); if(f.pairs.length<10||f.pairs.length>20) throw new Error('pair count '+f.pairs.length); for(const p of f.pairs){if(p.routes.length<1||p.routes.length>3) throw new Error(p.pairId+' route count');} console.log('pairs:', f.pairs.length)" ; grep -q '"routing:fixtures"' package.json && echo "delegate OK"</automated>
+  </verify>
+  <acceptance_criteria>
+    - `node -e "const f=require('./routing/src/data/route-fixtures.json'); if(f.pairs.length!==15) throw new Error(1); for(const p of f.pairs){ if(!/^[a-z0-9-]{1,64}$/.test(p.pairId)) throw new Error(2); if(p.routes.length<1||p.routes.length>3) throw new Error(3);} console.log('OK')"` exits 0
+    - `grep -q 'D-12 BOUNDARY: this script runs on the MAINTAINER' routing/scripts/fetch-route-fixtures.mjs` exits 0
+    - `grep -q 'router.project-osrm.org' routing/scripts/fetch-route-fixtures.mjs` exits 0
+    - `grep -q 'User-Agent' routing/scripts/fetch-route-fixtures.mjs` exits 0 AND `grep -q '1200' routing/scripts/fetch-route-fixtures.mjs` exits 0 (mandatory UA + inter-request delay)
+    - `grep -q '"routing:fixtures": "node routing/scripts/fetch-route-fixtures.mjs"' package.json` exits 0
+    - `test -f routing/test/fixtures/golden-pairs.json` exits 0 AND `node -e "const c=require('./routing/test/fixtures/golden-pairs.json'); if(c.pairs.length!==15) throw new Error(1); if(c.pendingProbeDestinationId!=='national-museum') throw new Error(2); console.log('OK')"` exits 0
+    - `node -e "const f=require('./routing/src/data/route-fixtures.json'); const bad=f.pairs.filter(p=>p.destinationId==='national-museum'); if(bad.length) throw new Error('probe id used as destination'); console.log('RT4 OK')"` exits 0
+  </acceptance_criteria>
+  <done>The pinned 15-pair corpus exists, the maintainer fetch tool exists with the D-12 boundary documented, and the committed fixture dataset carries 15 real OSRM-demo-precomputed pairs (1–3 routes each, verbatim polyline6).</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 2: the offline corpus tolerance gate (CLI + in-suite Nyquist gate)</name>
+  <files>routing/scripts/route-corpus.mjs, routing/test/corpus.test.mjs</files>
+  <read_first>
+    - `search/scripts/gazetteer-corpus.mjs` (the "one measurement, two reporters" shape: exported measure core + CLI report + fixed escalation ladder on failure)
+    - `search/test/corpus.test.mjs` (the in-process assertion suite that imports the measurement core — NEVER spawns the script)
+    - `routing/src/index.ts` (the public API the measurement core imports: decodePolyline6, haversineM, getPairs)
+    - `routing/test/fixtures/golden-pairs.json` (task 1's thresholds: bbox, gzip budget, alternatives floor, probe id)
+  </read_first>
+  <action>
+**`routing/scripts/route-corpus.mjs`** — the corpus measurement core + CLI reporter. Header contract (gazetteer-corpus.mjs style): a LOCAL DEV TOOL over committed files; the WORKER/WEBVIEW never prints coordinates or pair data (D-15: this script prints pair ids and measurements only — never geometry strings). Exports:
+
+```typescript
+export function measurePairs(corpus, fixtures, gazetteer): MeasurementReport;
+```
+
+`MeasurementReport` carries per-check counts + violations arrays. The measurement core performs RT1–RT10 (ALL OFFLINE — zero network in the measurement path):
+
+- **RT1 corpus size** — `10 <= pairs.length <= 20`.
+- **RT2 schema + public origin** — every pair: pairId unique + slug charset; origin label non-empty; origin inside `klBbox`; destinationId exists in the gazetteer; AND **RT2b**: the gazetteer entry whose `id === originId` satisfies `|entry.lat − origin.lat| <= 1e-4` AND `|entry.lng − origin.lng| <= 1e-4` — i.e. the pinned origin EQUALS the named gazetteer landmark's committed coordinate (the mechanical no-user-coordinate proof, D-12).
+- **RT3 route shape** — every pair has 1..3 routes; every route: finite `distanceM > 0`, finite `durationS > 0`, non-empty `geometry` string.
+- **RT4 probe exclusion** — NO pair's `destinationId` equals `pendingProbeDestinationId` (`national-museum`).
+- **RT5 geometry↔summary consistency** — decode each geometry; `haversineLengthM(points)` (sum of segment distances) within `[0.85, 1.10] × distanceM`; decoded points all finite and inside the KL bbox (with 0.05 deg slack for OSRM's road snapping).
+- **RT6 duration sanity** — `distanceM / durationS` within `[1.0, 30]` m/s (≈ 3.6–108 km/h — KL congestion floor to DUKE highway ceiling).
+- **RT7 codec round-trip** — `encodePolyline6(decodePolyline6(geometry)) === geometry` for every route (the 1e-6-grid law, verbatim storage proof).
+- **RT8 licence header** — `_license === "ODbL-1.0"`, `_attribution` contains `OpenStreetMap`, `_notice` contains `ODbL`, `_source` contains `router.project-osrm.org` (T-05-06).
+- **RT9 size budget** — `gzipSync(readFileSync(fixturesPath)).length <= corpus.fixtureGzipBudgetBytes` (102400); the report PRINTS the measured bytes (T-05-11 early warning).
+- **RT10 alternatives floor** — `pairs.filter(p => p.routes.length >= 2).length >= corpus.alternativesFloorPairs` (4) — RTNG-02's real-data requirement.
+
+CLI: prints a per-check table (`RT1..RT10` with counts + violation details: pairId + reason — never geometry text), exits 0 ONLY when every check passes; on failure prints the fixed escalation ladder (inspect `routing/scripts/fetch-route-fixtures.mjs --only=<pairId>` for the failing pair; re-run the fetch; re-run the gate).
+
+**`routing/test/corpus.test.mjs`** — RED-first-then-GREEN (the fixtures already exist from task 1, so the suite goes straight to green; a future regression re-reddens it). Import `measurePairs` from the script + the three JSON inputs via `readFileSync`/`import … with { type: "json" }`. One `test()` per check: `RT1`…`RT10`, each asserting `violations.length === 0` with a named message. Mirror the gazetteer corpus suite's in-process shape exactly (never spawns the CLI).
+
+**Acceptance:** `npm run routing:corpus` exits 0 printing RT1–RT10 green with the measured gz size; `npm run routing:test` exits 0 including `PASS RT1`…`PASS RT10`.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run routing:corpus 2>&1 | tail -15 ; npm run routing:test 2>&1 | tail -15</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm run routing:corpus` exits 0 and its output contains `RT1` through `RT10` and a gz-size line
+    - `npm run routing:test` exits 0 and the output contains `PASS RT1` through `PASS RT10`
+    - `grep -q 'export function measurePairs' routing/scripts/route-corpus.mjs` exits 0 (the shared measurement core)
+    - `grep -q 'measurePairs' routing/test/corpus.test.mjs` exits 0 (in-process import — the two-reporters law)
+    - `node -e "const f=require('./routing/src/data/route-fixtures.json'); const multi=f.pairs.filter(p=>p.routes.length>=2).length; if(multi<4) throw new Error('alternatives floor: '+multi); console.log('RT10 OK:', multi)"` exits 0
+    - `node -e "const{gzipSync}=require('node:zlib');const{readFileSync}=require('node:fs');const s=gzipSync(readFileSync('./routing/src/data/route-fixtures.json')).length; if(s>102400) throw new Error('gz '+s); console.log('gz bytes:', s)"` exits 0
+    - `grep -c 'fetch(' routing/scripts/route-corpus.mjs | head -1` returns 0 (the measurement core is OFFLINE — T-05-05a)
+  </acceptance_criteria>
+  <done>The committed 15-pair dataset is pinned behind ten offline checks — corpus size, public-origin proof, schema, probe exclusion, geometry↔summary consistency, duration sanity, codec round-trip, licence header, gz size budget, and the alternatives floor — enforced identically by the CLI and the in-suite gate.</done>
+</task>
+
+</tasks>
+
+<verification>
+1. `npm run routing:corpus` — RT1–RT10 green, measured gz size printed (expect ≈ 15–25 KB, budget 100 KB).
+2. `npm run routing:test` — 05-01's C/P/F/L suites PLUS RT1–RT10, all green (the loader-env L3 update: default source now SERVES pair 1 at its pinned origin and returns null 300 m away).
+3. `npm run routing:typecheck` — exit 0.
+4. The committed dataset: 15 pairs, ODbL header intact, `national-museum` never a destination.
+5. Network isolation: `grep -rn "fetch(" routing/scripts/route-corpus.mjs routing/test/corpus.test.mjs` → no matches (the gate never touches the network; only the maintainer fetch script does).
+</verification>
+
+<success_criteria>
+- 15 golden KL pairs committed with real OSRM-demo geometry, pinned origins proven public (RT2b), 1–3 best-first routes each.
+- The offline tolerance gate holds in both reporters (CLI + suite) with zero network access.
+- At least 4 pairs carry ≥ 2 routes (RTNG-02's alternatives floor).
+- The fetch tool is a documented repo-tool with the D-12 boundary in its header.
+</success_criteria>
diff --git a/.planning/phases/05-routing-route-display/05-03-PLAN.md b/.planning/phases/05-routing-route-display/05-03-PLAN.md
new file mode 100644
index 0000000..bdf1cd3
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-03-PLAN.md
@@ -0,0 +1,211 @@
+---
+phase: 05-routing-route-display
+plan: 03
+type: execute
+wave: 1
+depends_on: []
+files_modified:
+  - bot/src/kv/guidance-sessions.ts
+  - bot/test/guidance-envelope.test.mjs
+autonomous: true
+requirements: []
+must_haves:
+  decisions_implemented:
+    - "D-06: the guidance_sessions envelope is a TYPES-ONLY frozen contract — code types + docs, NO KV namespace, NO service, NO runtime writes; Phase 6 builds the service on the frozen shape"
+    - "D-07: the route snapshot lives INLINE in the envelope record — one key, one TTL (~2h); nothing outlives 2h, nothing reconstructable after expiry"
+  truths:
+    - "GuidanceSessionEnvelope has EXACTLY four fields: id, chat_id, route_snapshot, created_at — a 5th property means drift (the SessionClaim 'entire persisted claim surface' law)"
+    - "route_snapshot is an INLINE interface (GuidanceRouteSnapshot), never a reference/id — grep-gated: no snapshotRef/snapshot_ref token exists in bot/src"
+    - "GUIDANCE_SESSION_TTL_SECONDS === 7200 — the ~2h TTL exists as a documented constant awaiting its Phase 6 consumer, pinned by test"
+    - "guidance-sessions.ts contains zero runtime behavior: no KvNamespace reference, no .put/.get/.delete, no exported function — types + one constant + the key-scheme doc only"
+    - "bot/wrangler.jsonc still carries EXACTLY ONE kv namespace (chat_sessions) and Env carries NO guidance field — the grep gates prove the types-only boundary mechanically"
+  artifacts:
+    - path: "bot/src/kv/guidance-sessions.ts"
+      provides: "the frozen Phase 6 contract: GuidanceSessionEnvelope + GuidanceRouteSnapshot types, GUIDANCE_SESSION_TTL_SECONDS = 7200, the guidance:<id> key-scheme doc header"
+      contains: "export interface GuidanceSessionEnvelope"
+    - path: "bot/test/guidance-envelope.test.mjs"
+      provides: "the GE1–GE7 types-only gates (field freeze, inline snapshot, TTL constant, no-runtime-behavior, no new namespace, no Env field, no premature consumer)"
+      contains: "GE1"
+  key_links:
+    - from: "bot/src/kv/guidance-sessions.ts"
+      to: "bot/src/kv/sessions.ts"
+      via: "the SessionClaim 'entire persisted claim surface — a 5th property means drift' law, applied to the envelope's field freeze"
+      pattern: "SessionClaim"
+    - from: "bot/test/guidance-envelope.test.mjs"
+      to: "bot/src/kv/guidance-sessions.ts"
+      via: "source-text + structural gates pin the types-only boundary until Phase 6's service replaces it"
+      pattern: "GE1"
+---
+
+<objective>
+Freeze the Phase 6 guidance-session contract NOW as a types-only module: the `guidance_sessions` envelope (id, chat ref, inline route snapshot, created_at) with its ~2h TTL constant and `guidance:<id>` key-scheme documentation — no KV namespace, no service, no runtime writes.
+
+Purpose: ROADMAP §Phase 5 notes bind the GUID-05/06 upstream design obligation here ("the ephemeral guidance_sessions KV envelope (id, chat ref, route snapshot ref, ~2h TTL) is designed here so the backgrounded turn-card service in Phase 6 has its session contract already defined"). The pivot (D-06) sharpens "route snapshot ref" into an INLINE snapshot (D-07 — one key, one TTL, nothing reconstructable after expiry) and pins the whole thing as types + docs. Phase 6 implements the service against this frozen shape without renegotiation.
+
+Output: `bot/src/kv/guidance-sessions.ts` (types + TTL constant + key-scheme header) and `bot/test/guidance-envelope.test.mjs` (GE1–GE7 gates proving the types-only boundary mechanically).
+</objective>
+
+<execution_context>
+@$HOME/.config/opencode/get-shit-done/workflows/execute-plan.md
+@$HOME/.config/opencode/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@AGENTS.md
+@.planning/phases/05-routing-route-display/05-CONTEXT.md
+@bot/src/kv/sessions.ts
+@bot/src/config.ts
+@bot/wrangler.jsonc
+@bot/test/privacy.test.mjs
+@routing/src/types.ts
+
+<interfaces>
+The frozen contract (verbatim — Phase 6 consumes these exact names):
+
+```typescript
+/** ~2h (D-06) — the envelope's every future write carries THIS value as its
+ *  expirationTtl (Phase 6's privacy grep gate extends the TTL-law to it). */
+export const GUIDANCE_SESSION_TTL_SECONDS = 7200;
+
+/**
+ * The route snapshot — INLINE in the envelope (D-07): one KV key, one TTL.
+ * Nothing outlives 2h; nothing is reconstructable after expiry. Scoped to
+ * what a chat turn-card needs (GUID-05): the selected route's headline data
+ * + its geometry for the map snapshot render + the trip-start anchor for
+ * progress math on resume (GUID-06).
+ */
+export interface GuidanceRouteSnapshot {
+  /** The gazetteer id of the trip's destination. */
+  destinationId: string;
+  /** The destination's display name (verbatim gazetteer name). */
+  destinationName: string;
+  /** Selected route summary (meters / seconds). */
+  distanceM: number;
+  durationS: number;
+  /** The SELECTED route's geometry, polyline6-encoded — the routing
+   *  workspace's storage format (05-01), never a re-serialized array. */
+  geometry: string;
+  /** Trip start, seconds-since-epoch — the resume-progress anchor (GUID-06). */
+  startedAtSec: number;
+}
+
+/**
+ * The guidance_sessions envelope — Phase 6's frozen contract (D-06).
+ * EXACTLY these four fields: a 5th property means drift (the SessionClaim
+ * law, bot/src/kv/sessions.ts).
+ *
+ * Key scheme: guidance:<id>  → JSON GuidanceSessionEnvelope
+ * Every write MUST carry expirationTtl: GUIDANCE_SESSION_TTL_SECONDS.
+ */
+export interface GuidanceSessionEnvelope {
+  /** Opaque session id — crypto.randomUUID() at Phase 6 mint (T-02-05 precedent). */
+  id: string;
+  /** The Telegram chat the turn-cards push to (GUID-05). */
+  chat_id: number;
+  /** The INLINE route snapshot (D-07) — never a reference or a second key. */
+  route_snapshot: GuidanceRouteSnapshot;
+  /** Envelope creation, seconds-since-epoch. */
+  created_at: number;
+}
+```
+
+Module header contract (sessions.ts style — states the types-only law):
+
+```typescript
+/*
+ * guidance-sessions.ts — the FROZEN Phase 6 contract, types-only (D-06/D-07).
+ * ------------------------------------------------------------------------
+ * THIS MODULE SHIPS NO BEHAVIOR. No KVNamespace binding, no Env field, no
+ * wrangler namespace, no runtime function — the envelope is designed here
+ * (ROADMAP §Phase 5 GUID-05/06 upstream obligation) so Phase 6 builds its
+ * service on a frozen shape. Phase 6's service owns every write; every
+ * write carries expirationTtl: GUIDANCE_SESSION_TTL_SECONDS (~2h) and the
+ * snapshot is INLINE (one key, one TTL) — nothing outlives 2h, nothing is
+ * reconstructable after expiry (D-07, the location-pin TTL precedent).
+ *
+ * Key scheme: guidance:<id> → JSON GuidanceSessionEnvelope
+ */
+```
+</interfaces>
+
+<environment_facts>
+Verified in this session — do not re-derive:
+
+- `bot/src/kv/sessions.ts` establishes the "entire persisted claim surface — a 5th property means drift" field-freeze law (its `SessionClaim` doc) and the every-write-carries-TTL grep-gate pattern (`bot/test/privacy.test.mjs` PG1).
+- `bot/wrangler.jsonc` `kv_namespaces` carries EXACTLY ONE entry (`chat_sessions`, id `59f58a54bc44483e89872b20a005a5eb`); `bot/src/config.ts` `Env` carries exactly `BOT_TOKEN`, `WEBHOOK_SECRET`, `chat_sessions`, `MINI_APP_URL`.
+- `bot/test/runner.mjs` auto-discovers `*.test.mjs` — a new suite file is picked up with zero registration.
+- The routing workspace's geometry storage format is polyline6 (05-01) — the snapshot's `geometry` field references that format by name in its doc comment.
+</environment_facts>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| This module → the Worker runtime | A types-only module that accidentally grew behavior (a helper, a KV call) would create an unreviewed write path outside Phase 6's privacy gates — the threat is PREMATURE PERSISTENCE. |
+| The frozen shape → Phase 6's service | Contract drift between what Phase 5 froze and what Phase 6 builds silently widens the persisted surface (a 5th field, a snapshot reference instead of an inline record). |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-05-08 | Tampering / Information Disclosure | Premature persistence — a half-built guidance write path landing before Phase 6's TTL/privacy gates exist | mitigate | GE4 pins the module to types + one constant (comment-stripped scan: zero `KvNamespace`, `.put(`, `.get(`, `.delete(`, `export function`, `export async function`); GE5 pins wrangler.jsonc to exactly one kv namespace; GE6 pins `Env` to its four existing fields; GE7 pins zero non-test imports of the module. The contract CANNOT acquire a runtime shadow this phase. |
+| T-05-08b | Repudiation (retention) | The envelope silently outliving its ~2h promise (D-07) | mitigate | GE1 pins `GUIDANCE_SESSION_TTL_SECONDS === 7200`; GE3 pins the INLINE snapshot (no `snapshotRef`/`snapshot_ref`/`snapshot_ref:` token anywhere in bot/src) — one key, one TTL, nothing reconstructable after expiry; the Phase 6 service extends the existing privacy TTL grep gate to `guidance:` writes. |
+| T-05-08c | Tampering | Contract drift before Phase 6 (field added/renamed, geometry format changed) | mitigate | GE2 pins the envelope field set EXACTLY (`["id","chat_id","route_snapshot","created_at"]`) and the snapshot field set EXACTLY (`["destinationId","destinationName","distanceM","durationS","geometry","startedAtSec"]`) — any drift reddenens the suite. |
+</threat_model>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>task 1: the frozen envelope types + the types-only gate suite</name>
+  <files>bot/src/kv/guidance-sessions.ts, bot/test/guidance-envelope.test.mjs</files>
+  <read_first>
+    - `bot/src/kv/sessions.ts` (the field-freeze law + TTL-constant style + module header contract)
+    - `bot/src/config.ts` (the Env contract GE6 pins — the file being modified is NOT this one; read it to assert its shape)
+    - `bot/wrangler.jsonc` (the kv_namespaces array GE5 pins)
+    - `bot/test/privacy.test.mjs` (the comment-stripping grep-gate style GE4 copies)
+    - `routing/src/types.ts` (the polyline6 storage format the snapshot's geometry field cites)
+  </read_first>
+  <action>
+**`bot/src/kv/guidance-sessions.ts`** — implement the `<interfaces>` block EXACTLY: the module header (types-only law, key scheme, D-06/D-07 citations), `GUIDANCE_SESSION_TTL_SECONDS = 7200`, `GuidanceRouteSnapshot` (6 fields), `GuidanceSessionEnvelope` (4 fields). NOTHING ELSE — no imports, no functions, no class, no default export.
+
+**`bot/test/guidance-envelope.test.mjs`** — RED-first, lazy-import style. Cases:
+- `GE1 TTL constant` — `(await import("../src/kv/guidance-sessions.ts")).GUIDANCE_SESSION_TTL_SECONDS === 7200` (D-06's ~2h).
+- `GE2 field freeze` — compile-time shape check via a typed probe: import the module under Node type-stripping and assert `Object.keys()`-equivalent surface by reading the source text: the `GuidanceSessionEnvelope` interface block contains EXACTLY the four fields `id`, `chat_id`, `route_snapshot`, `created_at` (regex the interface body between `interface GuidanceSessionEnvelope {` and the closing `}`; field lines match `/^\s{2}\w+:/`); same for `GuidanceRouteSnapshot` → exactly `destinationId`, `destinationName`, `distanceM`, `durationS`, `geometry`, `startedAtSec`. A 5th property reddenens this gate (the SessionClaim law).
+- `GE3 inline snapshot` — the source contains `route_snapshot: GuidanceRouteSnapshot` (typed inline, not `string`/`number` reference) AND bot/src contains ZERO occurrences of `snapshotRef` or `snapshot_ref` (D-07's one-key-one-TTL law).
+- `GE4 types-only` — strip comments from `guidance-sessions.ts` (the privacy.test.mjs pattern) and assert ZERO of: `KvNamespace`, `.put(`, `.get(`, `.delete(`, `export function`, `export async function`, `import ` (T-05-08: the module ships NO behavior).
+- `GE5 no new namespace` — parse `bot/wrangler.jsonc` (strip `//` line comments, JSON.parse) and assert `kv_namespaces.length === 1` with binding `chat_sessions`.
+- `GE6 no Env field` — `bot/src/config.ts` source contains NO `guidance` token (the Env contract gains nothing this phase).
+- `GE7 no premature consumer` — grep `bot/src` for `guidance-sessions` imports: ZERO matches (only the test imports it — Phase 6 builds the consumer).
+
+**Acceptance:** `npm test -w bot` exits 0 with `PASS GE1`…`PASS GE7` (plus all existing bot suites still green); `npm run bot:typecheck` exits 0 (the new module must typecheck — it lives in the bot workspace's tsconfig include).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm test -w bot 2>&1 | tail -12 ; npm run bot:typecheck 2>&1 | tail -4</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm test -w bot` exits 0 and the output contains `PASS GE1` through `PASS GE7`
+    - `npm run bot:typecheck` exits 0
+    - `grep -q 'export interface GuidanceSessionEnvelope' bot/src/kv/guidance-sessions.ts` exits 0 AND `grep -q 'export interface GuidanceRouteSnapshot' bot/src/kv/guidance-sessions.ts` exits 0
+    - `grep -q 'GUIDANCE_SESSION_TTL_SECONDS = 7200' bot/src/kv/guidance-sessions.ts` exits 0
+    - `grep -q 'guidance:<id>' bot/src/kv/guidance-sessions.ts` exits 0 (the key scheme is documented)
+    - `grep -rc 'KvNamespace' bot/src/kv/guidance-sessions.ts | head -1` returns 0 (no runtime binding anywhere in the file, comments included — the word never appears)
+    - `grep -q 'route_snapshot: GuidanceRouteSnapshot' bot/src/kv/guidance-sessions.ts` exits 0 (inline, D-07)
+  </acceptance_criteria>
+  <done>The guidance_sessions envelope exists as a frozen types-only contract with its ~2h TTL constant, inline route snapshot, key-scheme documentation, and seven mechanical gates proving nothing runtime-shaped leaked in.</done>
+</task>
+
+</tasks>
+
+<verification>
+1. `npm test -w bot` — all existing suites + GE1–GE7 green.
+2. `npm run bot:typecheck` — exit 0 (the new module is inside the bot tsconfig's include).
+3. `bot/wrangler.jsonc` unchanged (still exactly one kv namespace); `bot/src/config.ts` unchanged.
+4. `grep -rn "guidance" bot/src --include="*.ts" -l` → only `bot/src/kv/guidance-sessions.ts`.
+</verification>
+
+<success_criteria>
+- The Phase 6 contract is frozen in code: envelope + inline snapshot + TTL constant + key scheme.
+- Seven gates prove the types-only boundary (no behavior, no namespace, no Env field, no consumer).
+- Zero existing bot files modified.
+</success_criteria>
diff --git a/.planning/phases/05-routing-route-display/05-04-PLAN.md b/.planning/phases/05-routing-route-display/05-04-PLAN.md
new file mode 100644
index 0000000..61f1ffb
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-04-PLAN.md
@@ -0,0 +1,515 @@
+---
+phase: 05-routing-route-display
+plan: 04
+type: execute
+wave: 2
+depends_on: ["01"]
+files_modified:
+  - web/package.json
+  - web/src/i18n/strings.ts
+  - web/src/route/route-layers.ts
+  - web/src/route/route-markers.ts
+  - web/src/route/route-card.ts
+  - web/src/route/route.ts
+  - web/src/map/map.ts
+  - web/src/main.ts
+  - web/src/telegram/backbutton.ts
+  - web/src/shell.css
+  - web/test/copy-gate.test.mjs
+  - web/test/route-surface.test.mjs
+autonomous: true
+requirements: [RTNG-01, RTNG-02]
+must_haves:
+  decisions_implemented:
+    - "D-09: route line = signal-orange casing stack (matte-black 9px under signal-orange 5px selected; matte-black 5px under soft-beige 3px unselected), opacity 1.0, line-cap square + line-join bevel, added once inside the existing load handler AFTER building-3d — the style is never re-set"
+    - "D-08: alternatives present as a bottom card + chips — one card for the selected route, up to 2 alternate chips, tap → instant geometry swap + 400ms camera refit; single-route draws render NO chip row"
+    - "D-03: the router-pending state is a designed Rams surface (center card, standard ink, NO red anywhere) — never a blank map, never a fake route; a route-source exception renders the same pending card (fail-honest)"
+    - "D-10: display-only terminal — NO start-guidance button, NO turn instructions, NO progress UI; the only affordance is .btn-secondary SEARCH AGAIN (shared with the BackButton walk-back)"
+    - "D-05/D-12: the route surface consults the fixture RoutingSource in the webview only — origin stays in memory, no route persists, the capture signal is a state token"
+  truths:
+    - "The four route layers are added exactly once, inside map.on('load'), after the building-3d block, with no beforeId, in bottom→top order route-alt-casing, route-alt-line, route-casing, route-line — zero setStyle calls exist in web/src/route/"
+    - "MapLibre paint consumes verbatim hex constants (#1A1A1A, #EB8008, #D9D2C6 copied from tokens.css) — CSS variables cannot feed paint (DSGN-01 note); the off-token sweep pattern covers them"
+    - "Camera fitBounds carries padding {top:96,bottom:320,left:64,right:64}, duration 400ms, pitch 35 (the boot constant, passed explicitly), bearing from getBearing() — center+zoom only"
+    - "Route consult happens automatically, exactly once per boot, only when the location chain is live AND a destination resolved — destination-unavailable and no-destination boots never make a route request"
+    - "Staleness never evicts the route card: stale during route state keeps the route card (strip lamp + dimmed marker carry the signal); stale during pending coexists the pending card (center) with the signal-lost card (Phase 3 bottom register)"
+    - "The BackButton is visible exactly when a pushed state exists (route or pending); its click walks to the root via the SAME total function SEARCH AGAIN invokes — never a no-op, never close() from a pushed state"
+    - "Every route string comes from the strings module (COPY5); the only console lines in web/src/route/ are the two ARAHARAH-ROUTE state tokens — never coordinates"
+    - "Card padding composes from the existing .card child rules and the new token-only route classes — zero per-card padding overrides (UI-SPEC post-approval addendum)"
+  artifacts:
+    - path: "web/src/route/route-layers.ts"
+      provides: "installRouteLayers (2 empty GeoJSON sources + 4 line layers), setRouteDrawn (setData swap), clearRouteLayers — MapLike-parameterized, Node-testable"
+      contains: "route-alt-casing"
+    - path: "web/src/route/route-markers.ts"
+      provides: "origin ring (24px, 2px matte-black stroke) + destination pin (12px square + 3px tail, name chip) as DOM/SVG markers, aria-hidden glyphs"
+      contains: "route-origin-ring"
+    - path: "web/src/route/route-card.ts"
+      provides: "buildRouteCard (register, headline, telemetry, difference, chips, SEARCH AGAIN) + buildRoutePendingCard — createElement + textContent only, strings-module copy"
+      contains: "buildRoutePendingCard"
+    - path: "web/src/route/route.ts"
+      provides: "createRouteController — consult/select/walkBack state machine (idle|route|pending), camera constants, ARAHARAH-ROUTE state signals"
+      contains: "ROUTE_CAMERA_PADDING"
+    - path: "web/src/shell.css"
+      provides: ".route-stack register rules, .route-telemetry/.route-chips/.route-chip, marker chrome — token references + the machined literals the UI-SPEC enumerates"
+      contains: "route-chip"
+    - path: "web/test/route-surface.test.mjs"
+      provides: "RS1–RS10 structural + fake-map behavioral gates (layer law, camera law, state machine, console discipline, D-10 absence laws)"
+      contains: "RS1"
+  key_links:
+    - from: "web/src/route/route.ts"
+      to: "@araharah/routing/src/index.ts"
+      via: "the controller consumes createFixtureRoutingSource() (backend #1) through the RoutingSource seam"
+      pattern: "createFixtureRoutingSource"
+    - from: "web/src/map/map.ts"
+      to: "web/src/route/route-layers.ts"
+      via: "the load handler's new opts.onLoad hook installs the route layers after building-3d, before the RAMS-BASEMAP-READY signal"
+      pattern: "onLoad"
+    - from: "web/src/main.ts"
+      to: "web/src/route/route.ts"
+      via: "boot wiring: auto-consult after live+destination; walkBack shared by BackButton and SEARCH AGAIN"
+      pattern: "consultRoute"
+    - from: "web/src/telegram/backbutton.ts"
+      to: "web/src/route/route.ts"
+      via: "overlayPresent becomes the route-state predicate; the pushed-state click invokes the injected walkBack (the SEARCH AGAIN total function)"
+      pattern: "walkBack"
+    - from: "web/src/route/route-card.ts"
+      to: "web/src/i18n/strings.ts"
+      via: "every route string is a ShellStrings key (COPY5) — the 10 new route keys"
+      pattern: "routePendingHeadline"
+---
+
+<objective>
+Render the route experience on the live Phase 3 shell per the approved 05-UI-SPEC: orange casing route layers over the grayscale basemap, origin ring + destination pin, the bottom route card with alternates chips, the designed router-pending card, fit-bounds camera behavior, and the first real BackButton two-state walk — the visible half of RTNG-01/RTNG-02.
+
+Purpose: the route is THE accent on a grayscale world (D-09); the card is its semantic statement (D-08); the pending state is honesty as a designed surface (D-03); and the terminal state is display-only (D-10 — no guidance furniture). Every geometry, color, string, and behavior is already BINDING in 05-UI-SPEC.md — this plan operationalizes it exactly, extending the shipped shell without restyling any existing surface.
+
+Output: the `web/src/route/` module family (layers, markers, cards, controller), the map.ts load-hook extension, main.ts boot wiring, the two-state BackButton wire, shell.css route chrome, the 10 new string keys with the copy-gate extension, and the RS1–RS10 structural suite.
+</objective>
+
+<execution_context>
+@$HOME/.config/opencode/get-shit-done/workflows/execute-plan.md
+@$HOME/.config/opencode/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@AGENTS.md
+@.planning/phases/05-routing-route-display/05-CONTEXT.md
+@.planning/phases/05-routing-route-display/05-UI-SPEC.md
+@.planning/phases/05-routing-route-display/05-PATTERNS.md
+@.planning/phases/05-routing-route-display/05-01-PLAN.md
+@web/src/main.ts
+@web/src/map/map.ts
+@web/src/map/follow.ts
+@web/src/map/marker.ts
+@web/src/ui/cards.ts
+@web/src/search/destination-card.ts
+@web/src/search/resolve-destination.ts
+@web/src/telegram/backbutton.ts
+@web/src/i18n/strings.ts
+@web/src/shell.css
+@web/src/vite-env.d.ts
+@web/test/copy-gate.test.mjs
+@web/test/destination-preload.test.mjs
+@routing/src/index.ts
+
+<ui_spec_binding>
+05-UI-SPEC.md is APPROVED and BINDING. The executor MUST read it in full before task 1. Non-negotiables restated for the tasks below (the spec wins on any disagreement — where spec, mockup, and tokens.css disagree: tokens.css wins, the mockup loses, the spec records the call):
+
+- **Layer paint table** (spec §Color): route-casing = matte-black `#1A1A1A` 9px; route-line = signal-orange `#EB8008` 5px; route-alt-casing = `#1A1A1A` 5px; route-alt-line = soft-beige `#D9D2C6` 3px. ALL opacity 1.0. line-cap `square`, line-join `bevel`. Solid centerline (the mockup's dash is scrubbed residue).
+- **Layer order** (spec §Color bullets): added inside the EXISTING `map.on("load")` handler, AFTER the building-3d block, each `addLayer` with NO beforeId → bottom→top: `route-alt-casing`, `route-alt-line`, `route-casing`, `route-line`. Sources `route` + `route-alt` added EMPTY at load, filled/cleared via `setData` (data, not style).
+- **Camera table** (spec §Camera Behavior): route drawn → fitBounds padding `{ top: 96, bottom: 320, left: 64, right: 64 }`, duration 400ms; chip select → ALWAYS refits; SEARCH AGAIN → clear + flyTo latest fix via the follow controller; pitch untouched (35), bearing as the user left it.
+- **Route card** (spec §Route Card): register `ROUTE` / `ROUTE {n}/{N}`; headline = destination name verbatim; telemetry row (telemetry-num time + `MIN` + distance `8.4 KM`); difference line (body-sm); chips row role=group, ≤ 2 chips, gap space-xs, never wraps; actions = ONE `.btn-secondary` SEARCH AGAIN. Height budget ≤ 240px (content contract). Single-route draws render NO chip row at all.
+- **Chip contract** (spec): `<button type="button">`; matte-black plate, pure-white label-sm uppercase, padding 4/8, visible height 28px, zero radius; text `{nn} // {min} MIN · {km} KM` (e.g. `02 // 24 MIN · 9.1 KM`); hit ≥ 44×44 via `::after { inset: -8px }`; `:active` instant invert to signal-orange field + matte-black text; `:focus-visible` 3px orange bracket; NO persistent selected-chip state (chip count invariant N−1); aria-label from `ariaRouteChip` template; group carries `ariaRouteAlternatives`.
+- **Origin ring + pin** (spec §Origin Ring + Destination Pin): ring = 24px diameter, 2px matte-black stroke, NO fill, at the geometry's first vertex, decorative `aria-hidden`; pin = 12×12 matte-black filled square + 3px triangular tail pointing down, 1px pure-white inset rule, NEVER orange; name chip above, offset space-sm, pure-white label-sm uppercase, verbatim name, max-width 160px ellipsis; route line terminates UNDER the pin, origin line starts INSIDE the ring.
+- **Pending card** (spec §Router-Pending Card): center register; register `ROUTE // ROUTER`, headline, body, hint, CTA `.btn-secondary` SEARCH AGAIN — copy verbatim from the spec's en/ms table (now the strings keys); NO red anywhere (it is a deferral, not an error).
+- **State coexistence** (spec §State Coexistence): route consult is AUTOMATIC (no route button) once location chain is live AND destination resolved; destination-unavailable → NO route request ever; no destination → Phase 3 behavior byte-identical; stale during route → route card persists, NO signal-lost card (strip lamp + dimmed marker carry it); stale during pending → pending card (center) + signal-lost card (bottom) coexist.
+- **BackButton** (spec §BackButton Contract): route state → `show()`, click clears layers + ring + pin, card swaps to destination card, camera refollows user, `hide()`; pending state → `show()`, click swaps card to destination card, `hide()` (no layers to clear); destination card → hidden; the predicate becomes "route or pending state active"; handler and predicate ship as ONE change.
+- **Micro-behaviors** (spec): no CSS transition/animation anywhere; instant hard swaps; route draw = setData + fitBounds same tick; a drawn route is static, only selection changes it.
+- **Padding addendum** (spec, post-approval): the executor MUST NOT add per-card padding overrides — compose from the existing `.card > *` rules (shell.css:74-80) and the new token-only route classes.
+- **Copy gate** (spec §Copywriting): the strings-module test asserts exactly these 10 keys in en + ms; no route copy inline in `web/src/route/*` or shell.css.
+</ui_spec_binding>
+
+<route_strings>
+The 10 new `ShellStrings` keys (interface + both locales, en/ms verbatim from the UI-SPEC copy tables):
+
+| Key | en | ms |
+|-----|----|----|
+| `routeRegister` | `ROUTE` | `ROUTE` |
+| `routeDiffFastest` | `Fastest route` | `Laluan terpantas` |
+| `routeDiffSlower` | `+{min} MIN VS ROUTE {n}` | `+{min} MIN VS LALUAN {n}` |
+| `routePendingRegister` | `ROUTE // ROUTER` | `ROUTE // ROUTER` |
+| `routePendingHeadline` | `Routing not wired up yet` | `Penghalaan belum dipasang` |
+| `routePendingBody` | `Routes currently cover known KL landmarks only. The general router ships later — your coordinates were never sent anywhere.` | `Laluan buat masa ini meliputi mercu tanda KL yang diketahui sahaja. Penghala am akan datang kemudian — koordinat anda tidak pernah dihantar ke mana-mana.` |
+| `routePendingHint` | `Send /cari in the chat and pick another landmark.` | `Hantar /cari dalam chat dan pilih mercu tanda lain.` |
+| `ctaSearchAgain` | `SEARCH AGAIN` | `CARI SEMULA` |
+| `ariaRouteAlternatives` | `Alternative routes` | `Laluan alternatif` |
+| `ariaRouteChip` | `Route {n}: {min} minutes, {km} kilometres` | `Laluan {n}: {min} minit, {km} kilometer` |
+
+`routeDiffSlower` and `ariaRouteChip` are TEMPLATES — the `{min}`/`{n}`/`{km}` placeholders are replaced in code (the Phase 3 telemetry composition precedent — formats are instrument constants, not locale strings). Compose formats in code: time `{n} MIN` (integer minutes = `Math.round(durationS / 60)`), distance `{n.n} KM` (one decimal = `(distanceM / 1000).toFixed(1)`), chip `{nn} // {min} MIN · {km} KM` (`nn` = zero-padded 2-digit option index), register `ROUTE {n}/{N}`.
+</route_strings>
+
+<module_contracts>
+**`route-layers.ts`** — Node-testable (no DOM). Parameterize on a structural `MapLike` (METHOD syntax for parameter bivariance) so tests drive a recording fake and `MapLibreMap` satisfies it at the main.ts/map.ts call sites (bridge friction, if any, is a typed alias at the call site — never `any`; the `map.ts:32` typed-cast precedent):
+
+```typescript
+export interface MapLike {
+  addSource(id: string, data: unknown): void;
+  addLayer(layer: unknown): void;
+  getSource(id: string): { setData(data: unknown): void } | undefined;
+  fitBounds(bounds: unknown, options?: unknown): void;
+  getBearing(): number;
+}
+
+export const ROUTE_PAINT = {
+  casingColor: "#1A1A1A",   // matte-black — verbatim from tokens.css (DSGN-01: zero invented colors)
+  lineColor: "#EB8008",     // signal-orange
+  altLineColor: "#D9D2C6",  // soft-beige
+} as const;
+
+export const ROUTE_LAYER_IDS = ["route-alt-casing", "route-alt-line", "route-casing", "route-line"] as const;
+
+export function installRouteLayers(map: MapLike): void;
+  // no-op if map.getSource("route") already exists (idempotent);
+  // adds sources "route" + "route-alt" as EMPTY GeoJSON FeatureCollections,
+  // then the 4 layers IN ORDER with no beforeId.
+
+export function setRouteDrawn(map: MapLike, selected: { points: RoutePoint[] }, alts: readonly { points: RoutePoint[] }[]): void;
+  // setData on BOTH sources: "route" ← selected LineString FeatureCollection,
+  // "route-alt" ← one Feature per alternate (0..2 features).
+
+export function clearRouteLayers(map: MapLike): void;
+  // both sources ← empty FeatureCollection.
+```
+
+**`route-markers.ts`** — DOM/SVG map furniture (structural gates only; the capture legs prove the pixels). Exports:
+
+```typescript
+export function attachRouteEndpoints(map: MapLike2, firstPoint: RoutePoint, lastPoint: RoutePoint, destinationName: string): void;
+  // origin ring (SVG circle 24px, 2px matte-black stroke, no fill, aria-hidden) at firstPoint;
+  // destination pin (SVG 12×12 square + 3px tail, matte-black fill, 1px pure-white inset rule)
+  // + name chip (DOM, pure-white label-sm uppercase, max-width 160px, ellipsis) at lastPoint;
+  // maplibregl Marker with { element }, anchors: ring "center", pin group "bottom".
+export function removeRouteEndpoints(map: MapLike2): void;
+```
+
+(`MapLike2` = the minimal marker surface: `{ addMarker/marker handling via maplibregl Marker .addTo/.remove }` — shape it as `{ addControl`-free: the module imports `Marker` from "maplibre-gl" directly and takes the map as `Parameters<Marker["addTo"]>[0]`.)
+
+**`route-card.ts`** — createElement + textContent ONLY (an id/name-derived string NEVER reaches innerHTML — T-04-32 precedent). Composes theme classes + the new route classes; NO per-card padding overrides. Exports:
+
+```typescript
+export interface RouteCardActions {
+  onSelect(index: number): void;   // chip tap → controller
+  onSearchAgain(): void;           // SEARCH AGAIN → controller walkBack
+}
+export function buildRouteCard(
+  locale: Locale,
+  destinationName: string,
+  options: readonly { summary: RouteSummary }[],
+  selectedIndex: number,
+  actions: RouteCardActions,
+): HTMLElement;
+  // .card: .card-header>.card-ref = "ROUTE" (no alts) | "ROUTE {i+1}/{N}";
+  // h2.text-headline-md = destinationName (verbatim);
+  // .route-telemetry: span.text-telemetry-num (minutes) + span.text-label-sm "MIN"
+  //   + span.text-label-sm "{km} KM";
+  // p.text-body-sm difference line (routeDiffFastest when selected===0, else the
+  //   routeDiffSlower template with {min} = selected − best minutes, {n} = 1);
+  // .route-chips[role="group"][aria-label] — ONE chip per NON-selected option
+  //   (button.route-chip, ::after slop in CSS, aria-label from ariaRouteChip
+  //   template, text "{nn} // {min} MIN · {km} KM"); ABSENT when options.length===1;
+  // .card-actions with ONE button.btn-secondary = ctaSearchAgain.
+
+export function buildRoutePendingCard(locale: Locale, actions: { onSearchAgain(): void }): HTMLElement;
+  // .card: register routePendingRegister, h2 routePendingHeadline, p.text-body-md
+  // routePendingBody, p.text-body-sm routePendingHint, .card-actions with ONE
+  // .btn-secondary ctaSearchAgain. NO .btn-primary anywhere. NO red.
+```
+
+**`route.ts`** — the controller (all DOM/map concerns injected → Node-testable):
+
+```typescript
+export const ROUTE_CAMERA_PADDING = { top: 96, bottom: 320, left: 64, right: 64 };
+export const ROUTE_FIT_DURATION_MS = 400;
+export const ROUTE_CAMERA_PITCH = 35; // the boot constant (map.ts), passed explicitly
+
+export type RouteState = "idle" | "route" | "pending";
+
+export function createRouteController(deps: {
+  map: MapLike;
+  source: RoutingSource;                       // @araharah/routing fixture backend
+  buildRouteCard: typeof buildRouteCard;        // injected (DOM-free tests)
+  buildPendingCard: typeof buildRoutePendingCard;
+  showRouteCard: (card: HTMLElement | null, register: "center" | "bottom") => void;
+  showDestinationCard: () => void;              // main.ts: Phase 3 stack shows the destination card
+  follow: { follow(fix: Fix): void };           // the existing follow controller
+  getLatestFix: () => Fix | null;
+  onStateChange: (state: RouteState) => void;   // main.ts: overlay predicate + BackButton show/hide
+}): {
+  readonly state: RouteState;
+  consult(fix: Fix, destination: GazetteerEntry): Promise<void>;
+  walkBack(): void;
+};
+
+// consult(): ONE call per boot (main.ts guards with a consulted flag):
+//   result = await source.route({ origin: {lat,lng}, destinationId }).catch(() => null);
+//   null/empty → pending: buildPendingCard → showRouteCard(card, "center");
+//     state = "pending"; console.log("ARAHARAH-ROUTE state=pending"); (fitBounds NOT called)
+//   else → drawn: setRouteDrawn(map, options[sel], others); attachRouteEndpoints(...);
+//     buildRouteCard → showRouteCard(card, "bottom");
+//     fitBounds(geometry bounds, { padding: ROUTE_CAMERA_PADDING, duration:
+//     ROUTE_FIT_DURATION_MS, pitch: ROUTE_CAMERA_PITCH, bearing: map.getBearing() });
+//     state = "route"; console.log("ARAHARAH-ROUTE state=drawn");
+//   onSelect(i): setRouteDrawn with the swapped arrays; re-build the card (new
+//     register/telemetry/difference/chips); refit the NEW geometry's bounds (ALWAYS
+//     refits — D-10). Instant swaps, no transitions.
+// walkBack(): route → clearRouteLayers + removeRouteEndpoints + showDestinationCard()
+//   + follow.follow(getLatestFix()) when a fix exists; pending → showDestinationCard()
+//   only. Both: state = "idle", onStateChange fires.
+```
+
+The ONLY console lines permitted in `web/src/route/` are the two `ARAHARAH-ROUTE state=` tokens (RS8 gates this; D-15 hygiene — a state token, never coordinates).
+</module_contracts>
+
+<environment_facts>
+Verified in this session — do not re-derive:
+
+- `map.ts` lines 43–67 hold the ONLY `map.on("load")` handler: building-3d try/catch, then `console.log("RAMS-BASEMAP-READY layers=" + …)`. The route install slots BETWEEN them (before the log — the capture race implies route sources exist).
+- `main.ts` line 64: `const overlayPresent = (): boolean => false;` — the Phase 3 single-state predicate this plan replaces; `wireBackButton(wa, overlayPresent)` is called at line 77, BEFORE the map boots — the route predicate must therefore be an assignable closure (`let routeStateActive = () => false;` pattern), not a direct reference.
+- `main.ts` `showCard(card, register)` manages ONE `.card-stack` (center via top 50%/translate, bottom via safe-bottom + space-xl). The route state gets its OWN stack element (`.route-stack`, data-register driven) — Phase 3's stack logic stays byte-identical (the "No destination → Phase 3 behavior byte-identical" law) and the pending+signal-lost coexistence (different registers) falls out of two independent stacks.
+- `follow.ts` exports `CAMERA_PADDING_PX = 96` and `RECENTER_DURATION_MS = 400` — the route's constants sit BESIDE them in `route.ts` (the UI-SPEC: "the route adds its own padded constants beside them").
+- `destination-card.ts` is the card-builder style precedent (createElement + textContent ONLY, theme classes, strings-module copy).
+- `copy-gate.test.mjs` COPY1 asserts `enKeys.length >= 25` (31 keys today — new floor 40 after +10) and COPY5 scans `UI_DIR = src/ui` only — COPY5's scope gains `src/route` in task 1.
+- `@araharah/routing` exports `createFixtureRoutingSource`, `RoutingSource`, `RouteResult`, `RouteOption` (plan 05-01) — `web/package.json` already depends on `@araharah/search`; ADD `"@araharah/routing": "*"` to `web/package.json` dependencies (task 1) and import via the explicit subpath `@araharah/routing/src/index.ts`.
+- The webview bundle inlines the routing workspace's static JSON import the same way it inlines the gazetteer (esbuild/Vite static-import inlining — proven by search; the 05-05 BA gates assert it).
+- Node 24 `.mjs` tests CAN import the web `.ts` modules (type-stripping) — but NOT modules touching `document` (no DOM in Node): the controller takes card builders + show callbacks as injected deps precisely so RS-gates run in Node.
+</environment_facts>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Gazetteer destination name / pair labels → DOM | Name-derived strings flow into the route card, the pin's name chip, and aria-labels. An innerHTML sink would convert data into markup injection. |
+| Route geometry → MapLibre sources | Decoded fixture coordinates drive `setData`. Malformed geometry (plan 05-01's decoder throws; the backend skips) must never reach a `LngLat` — a NaN would pageerror the map thread. |
+| Route state → BackButton graph | A pushed state with a dead-end back handler strands the user inside the webview (the no-dead-ends law, PX-01 groundwork). |
+| Console surface → capture signals | The console is a capture contract AND a leak surface: coordinates in a log line violate the D-15 hygiene law. |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-05-09 | Tampering (rendering integrity) | A style re-creation or layer re-add clobbering the Rams basemap (the D-10 map law: additions only) | mitigate | Layers install ONCE inside the load handler (idempotence guard on `getSource("route")`); selection swaps are `setData` on existing sources; RS2 asserts ZERO `setStyle` tokens in `web/src/route/` and the install's position (after building-3d, before the ready log). |
+| T-05-10 | Tampering (injection) | Destination name or pair label reaching `innerHTML` | mitigate | Both card builders use createElement + textContent ONLY (the destination-card.ts law); RS-greps the new modules for `innerHTML`/`insertAdjacentHTML` — zero matches. |
+| T-05-11 | Denial of Service (UX dead end) | BackButton visible but dead (or closing the app from a pushed state) | mitigate | The predicate + walkBack ship as ONE change (UI-SPEC): RS7 proves click-with-overlay invokes the injected walkBack and NEVER `close()`, and click-without-overlay closes; the walkBack is the SAME total function SEARCH AGAIN binds. |
+| T-05-13 | Information Disclosure | Route consult leaking coordinates into console lines | mitigate | The ONLY console tokens in `web/src/route/` are the two `ARAHARAH-ROUTE state=` lines (RS8: comment-stripped scan finds no other `console.` AND no `${` interpolation inside a console call). The origin never persists — the controller holds it in its closure for the session only (D-07). |
+| T-05-04 | Spoofing | A route-source exception silently drawing a partial route | mitigate | `source.route()` failures resolve to the PENDING card (`.catch(() => null)` — fail-honest, never a half-drawn line, the UI-SPEC error-state law); RS4 proves the exception path renders pending and calls NO fitBounds. |
+</threat_model>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>task 1: route strings + copy-gate extension + workspace dependency</name>
+  <files>web/src/i18n/strings.ts, web/test/copy-gate.test.mjs, web/package.json</files>
+  <read_first>
+    - `web/src/i18n/strings.ts` (the ShellStrings interface + both locale tables — the file this task extends)
+    - `.planning/phases/05-routing-route-display/05-UI-SPEC.md` §Copywriting Contract (the binding en/ms copy table)
+    - `web/test/copy-gate.test.mjs` (COPY1 floor + COPY5 scope — extended here)
+    - `web/package.json` (dependencies — gains `@araharah/routing`)
+  </read_first>
+  <action>
+**`web/package.json`** — add `"@araharah/routing": "*"` to `dependencies` ( beside `"@araharah/search": "*"`), then `npm install --package-lock-only --workspaces` to settle the lockfile.
+
+**`web/src/i18n/strings.ts`** — add the 10 keys from the `<route_strings>` block: extend `ShellStrings` (after `homeScreenAlreadyAdded`) and BOTH locale objects with the verbatim en/ms values. The two template keys carry their `{min}`/`{n}`/`{km}` placeholders LITERALLY in the string values (replaced in code). Update the module header's key inventory note (it names the register labels).
+
+**`web/test/copy-gate.test.mjs`** — three targeted extensions (RED first — they fail against the un-extended strings.ts):
+- COPY1: floor `>= 25` → `>= 40`; add assertions that `routeRegister`, `routePendingRegister`, `ctaSearchAgain` are keys present in BOTH locales.
+- New `COPY7 route copy verbatim`: assert `strings.en.routePendingHeadline === "Routing not wired up yet"`, `strings.en.routePendingBody` contains `never sent anywhere`, `strings.en.ctaSearchAgain === "SEARCH AGAIN"`, `strings.ms.routePendingHeadline === "Penghalaan belum dipasang"`, `strings.ms.ctaSearchAgain === "CARI SEMULA"`, `strings.en.routeDiffSlower === "+{min} MIN VS ROUTE {n}"`, `strings.ms.routeDiffSlower === "+{min} MIN VS LALUAN {n}"`, `strings.en.ariaRouteChip === "Route {n}: {min} minutes, {km} kilometres"`, and `strings.en.routePendingRegister === strings.ms.routePendingRegister === "ROUTE // ROUTER"` (instrument vocabulary, identical in both locales).
+- COPY5 scope: extend the module-scan list with `src/route` (the gate's directory constant gains the route module family — keep the existing assertion shape; it asserts no inline copy in ANY scanned shell module).
+
+**Acceptance:** `npm test -w web` exits 0 with COPY1/COPY5/COPY7 green (plus all existing web suites); `npm run web:typecheck` exits 0.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm test -w web 2>&1 | tail -15 ; npm run web:typecheck 2>&1 | tail -4 ; grep -c '"@araharah/routing"' web/package.json</automated>
+  </verify>
+  <acceptance_criteria>
+    - `grep -q '"@araharah/routing": "\*"' web/package.json` exits 0
+    - `npm test -w web` exits 0 and the output contains `PASS COPY7`
+    - `grep -q 'routePendingHeadline' web/src/i18n/strings.ts` exits 0 AND `grep -q 'Penghalaan belum dipasang' web/src/i18n/strings.ts` exits 0 AND `grep -q 'CARI SEMULA' web/src/i18n/strings.ts` exits 0
+    - `grep -q 'route' web/test/copy-gate.test.mjs` exits 0 (the COPY7 case + scope extension landed)
+    - `npm run web:typecheck` exits 0
+  </acceptance_criteria>
+  <done>The 10 route string keys exist verbatim in both locales, the copy gate pins them (floor 40, COPY7 verbatim case, COPY5 covers src/route), and the web workspace resolves @araharah/routing.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 2: route layers + endpoint markers + shell.css chrome + map.ts load hook</name>
+  <files>web/src/route/route-layers.ts, web/src/route/route-markers.ts, web/src/map/map.ts, web/src/shell.css</files>
+  <read_first>
+    - `.planning/phases/05-routing-route-display/05-UI-SPEC.md` §Color (paint table) + §Origin Ring + Destination Pin + §Shell Layout (the 64px composite)
+    - `web/src/map/map.ts` (the load handler + building-3d block — the insertion point)
+    - `web/src/map/marker.ts` (the DOM/SVG marker + shell.css chrome pattern the ring/pin copy)
+    - `web/src/shell.css` (token-only law, machined-literal exception list, the existing `.card > *` padding rules the route classes must NOT override)
+    - `routing/src/index.ts` (RoutePoint — the geometry shape the sources carry)
+  </read_first>
+  <action>
+**`web/src/route/route-layers.ts`** — per the `<module_contracts>` block: `MapLike` (method syntax), `ROUTE_PAINT` (three verbatim hex constants with the DSGN-01 comment), `ROUTE_LAYER_IDS`, `installRouteLayers` (idempotent; 2 empty sources + 4 layers, no beforeId, ORDER: route-alt-casing → route-alt-line → route-casing → route-line), `setRouteDrawn`, `clearRouteLayers`. Every layer object: `type: "line"`, `layout: { "line-cap": "square", "line-join": "bevel" }`, `paint: { "line-color": <constant>, "line-width": <9|5|5|3>, "line-opacity": 1 }`. Header comment: the D-09 contract + the DSGN-01 verbatim-hex note + "the style is never re-set — sources are data".
+
+**`web/src/route/route-markers.ts`** — `attachRouteEndpoints` / `removeRouteEndpoints` per `<module_contracts>`: SVG ring (24px circle, 2px matte-black stroke, fill none, `aria-hidden="true"`) and SVG pin (12×12 filled square + 3px triangular tail, matte-black, 1px pure-white inset rule via an inner rect stroke, `aria-hidden="true"`) + DOM name chip (label-sm uppercase, pure-white on matte-black plate, max-width 160px, ellipsis, verbatim name). Use `Marker` from `maplibre-gl` with `{ element }`, ring anchored center at the geometry's FIRST point, pin group anchored bottom at the LAST point. Track attached markers in a module-scoped `WeakMap<MapLike2, Marker[]>` so `removeRouteEndpoints` removes exactly what attach created. Header comment: D-09 furniture law (never orange — the pin is venue semantics), the a11y note (glyphs aria-hidden; the CARD is the semantic statement).
+
+**`web/src/map/map.ts`** — extend the boot signature: `bootMap(container: HTMLElement, opts: { onLoad?: (map: MapLibreMap) => void } = {})`. Inside the EXISTING load handler, AFTER the building-3d try/catch and BEFORE the `RAMS-BASEMAP-READY` log: `opts.onLoad?.(map);` (its own try/catch — a route-layer failure degrades to "no route drawn", never a broken boot; log nothing new). Nothing else changes.
+
+**`web/src/shell.css`** — append the route chrome (token references + the machined literals the UI-SPEC enumerates; NO transition/animation; NO per-card padding override):
+
+```css
+/* route state stack (second register holder — UI-SPEC §State Coexistence) */
+.route-stack { position: absolute; left: var(--spacing-margin); right: var(--spacing-margin); max-width: 320px; margin-inline: auto; }
+.route-stack[data-register="center"] { top: 50%; transform: translateY(-50%); }
+.route-stack[data-register="bottom"] { top: auto; transform: none; bottom: calc(var(--safe-bottom, 0px) + 64px); }
+
+/* route card body rows — token rhythm mirroring the existing .card child rules (NOT overrides) */
+.route-telemetry { display: flex; align-items: baseline; gap: var(--spacing-space-xs); padding-inline: var(--spacing-space-md); padding-top: var(--spacing-space-xs); }
+.route-diff { padding-inline: var(--spacing-space-md); padding-top: var(--spacing-space-xs); }
+.route-chips { display: flex; gap: var(--spacing-space-xs); padding-inline: var(--spacing-space-md); padding-top: var(--spacing-space-sm); }
+.route-chips:last-child { padding-bottom: var(--spacing-space-sm); }
+
+/* chips (UI-SPEC chip contract): 28px plate, 44px hit target, instant invert */
+.route-chip { position: relative; border: 0; border-radius: 0; padding: var(--spacing-space-xs) var(--spacing-space-sm); background: var(--color-matte-black); color: var(--color-pure-white); font: var(--type-label-sm); letter-spacing: var(--type-label-sm-tracking); text-transform: uppercase; white-space: nowrap; }
+.route-chip::after { content: ""; position: absolute; inset: -8px; }
+.route-chip:active { background: var(--color-signal-orange); color: var(--color-matte-black); }
+.route-chip:focus-visible { outline: 3px solid var(--color-signal-orange); outline-offset: 2px; }
+
+/* endpoint markers (map furniture — SVG chrome, machined geometry) */
+.route-dest-namechip { position: absolute; bottom: calc(100% + var(--spacing-space-sm)); left: 50%; transform: translateX(-50%); max-width: 160px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; background: var(--color-matte-black); color: var(--color-pure-white); font: var(--type-label-sm); letter-spacing: var(--type-label-sm-tracking); text-transform: uppercase; padding: var(--spacing-space-xs) var(--spacing-space-sm); }
+```
+
+Update the file header's machined-literal inventory (adds: chip plate 28px/inset −8px, ring 24px/2px, pin 12px square + 3px tail, route line widths 9/5/3 map-space, the 64px composite).
+
+**Acceptance:** `npm test -w web` still green (the RS gates for this task land in task 4); `npm run web:typecheck` exits 0.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run web:typecheck 2>&1 | tail -4 ; grep -c 'route-alt-casing' web/src/route/route-layers.ts ; grep -c 'setStyle' web/src/route/route-layers.ts</automated>
+  </verify>
+  <acceptance_criteria>
+    - `test -f web/src/route/route-layers.ts && test -f web/src/route/route-markers.ts` exits 0
+    - `grep -q '"line-join": "bevel"' web/src/route/route-layers.ts` exits 0 AND `grep -q '"line-cap": "square"' web/src/route/route-layers.ts` exits 0
+    - `grep -q '#1A1A1A' web/src/route/route-layers.ts` exits 0 AND `grep -q '#EB8008' web/src/route/route-layers.ts` exits 0 AND `grep -q '#D9D2C6' web/src/route/route-layers.ts` exits 0
+    - `grep -q 'onLoad' web/src/map/map.ts` exits 0 AND `grep -q 'opts.onLoad' web/src/map/map.ts` exits 0
+    - `grep -c 'setStyle' web/src/route/route-layers.ts | head -1` returns 0 (T-05-09)
+    - `grep -q '.route-chip::after' web/src/shell.css` exits 0 AND `grep -q 'inset: -8px' web/src/shell.css` exits 0 AND `grep -q 'route-stack' web/src/shell.css` exits 0
+    - `npm run web:typecheck` exits 0
+  </acceptance_criteria>
+  <done>The four-layer paint stack, endpoint markers, load-hook installation, and route chrome exist exactly per the binding UI-SPEC — style additions only, zero style re-sets.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 3: route cards + controller + main.ts wiring + BackButton two-state walk</name>
+  <files>web/src/route/route-card.ts, web/src/route/route.ts, web/src/main.ts, web/src/telegram/backbutton.ts</files>
+  <read_first>
+    - `.planning/phases/05-routing-route-display/05-UI-SPEC.md` §Route Card + §Router-Pending Card + §Camera Behavior + §State Coexistence + §BackButton Contract (ALL binding)
+    - `web/src/search/destination-card.ts` (the createElement + textContent card-builder law)
+    - `web/src/main.ts` (boot order, showCard, renderState, handleLive, the overlayPresent closure at line 64)
+    - `web/src/telegram/backbutton.ts` (the total-function wire being extended)
+    - `web/src/map/follow.ts` (the follow controller the walk-back reuses)
+    - `routing/src/index.ts` (RoutingSource / RouteResult / createFixtureRoutingSource)
+  </read_first>
+  <action>
+**`web/src/route/route-card.ts`** — `buildRouteCard` + `buildRoutePendingCard` per `<module_contracts>` + the UI-SPEC structure tables. createElement + textContent ONLY. Chip buttons: `type="button"`, class `route-chip`, `aria-label` from the `ariaRouteChip` template with substitutions, `data-route-index="<originalIndex>"`; the chips row: `role="group"`, `aria-label` = `ariaRouteAlternatives`; wire `onSelect` via addEventListener reading `dataset.routeIndex`. SEARCH AGAIN: one `.btn-secondary`, text = `ctaSearchAgain`, wired to `onSearchAgain`. Register text: `strings[locale].routeRegister` when `options.length === 1`, else the composed `ROUTE {selectedIndex+1}/{N}` form (instrument constant + numbers, the Phase 3 telemetry composition precedent). NO `.btn-primary`, NO orange fill anywhere in either card (D-10; the pending card has NO red).
+
+**`web/src/route/route.ts`** — `createRouteController` per `<module_contracts>`: constants (`ROUTE_CAMERA_PADDING`, `ROUTE_FIT_DURATION_MS = 400`, `ROUTE_CAMERA_PITCH = 35`), the idle|route|pending state machine, `consult` (auto-called once; `.catch(() => null)` → pending — T-05-04), `onSelect` swap+rebuild+refit, `walkBack` (the single total function shared with SEARCH AGAIN). Bounds from geometry points (min/max lat/lng — `[[lngMin,latMin],[lngMax,latMax]]` for fitBounds). The two `ARAHARAH-ROUTE state=` console lines are the module's ONLY console calls. Header comment: D-03/D-08/D-09/D-10 laws + the memory-only origin law.
+
+**`web/src/telegram/backbutton.ts`** — extend the wire (ONE change, predicate + handler together — UI-SPEC):
+
+```typescript
+export function wireBackButton(
+  wa: TelegramWebAppLike,
+  hasOverlay: () => boolean,
+  walkBack?: () => void,
+): void {
+  wa.BackButton?.hide();
+  wa.BackButton?.onClick(() => {
+    if (hasOverlay()) { walkBack?.(); return; }  // a pushed state: walk to the root, never close()
+    wa.close(); // Telegram semantics: back at the root closes the app
+  });
+}
+```
+
+Update the header comment: Phase 5 gives the predicate its first real states (route or pending); Phase 6 extends the graph.
+
+**`web/src/main.ts`** — the boot wiring (surgical; Phase 3 paths byte-identical when no destination resolved):
+1. Replace line 64's closure with ONE assignable phase closure (the single source of truth for the overlay predicate AND the stale branch): `let routePhase: () => "idle" | "route" | "pending" = () => "idle";` — `wireBackButton(wa, () => routePhase() !== "idle", () => routeWalkBack());` with `let routeWalkBack = (): void => {};` declared beside it (both assigned for real in step 3, after the controller exists).
+2. After the Phase 3 `.card-stack` creation, create the route stack: `const routeStack = document.createElement("div"); routeStack.className = "route-stack"; routeStack.style.display = "none"; mainEl.appendChild(routeStack);` with a local `showRouteCard(card, register)` that replaces children + sets `data-register` + display (mirroring showCard's shape; center = pending, bottom = route card).
+3. After the guarded `map !== null` block: build the route surface — `const routingSource = createFixtureRoutingSource();` + `const routeController = createRouteController({ map, source: routingSource, buildRouteCard, buildPendingCard: buildRoutePendingCard, showRouteCard, showDestinationCard: () => showCard(destinationCard), follow: { follow: (fix) => follow?.follow(fix) }, getLatestFix: () => lastFix, onStateChange: (s) => { routePhase = () => s; if (wa) s === "idle" ? wa.BackButton?.hide() : wa.BackButton?.show(); } });` — the `follow` dep is the NULL-TOLERANT WRAPPER `{ follow: (fix) => follow?.follow(fix) }` (the controller's types see a total object; the WebGL2-absent shell degrades to cards-only). Then `routeWalkBack = () => routeController.walkBack();`.
+4. In `handleLive(fix)`: after `renderState({ kind: "live", fix })`, add the auto-consult guard: `if (destination !== null && !routeConsulted) { routeConsulted = true; void routeController.consult(fix, destination); }` — `let routeConsulted = false;` beside the other boot flags. (destination-unavailable and no-destination boots NEVER consult — the state-coexistence law.)
+5. In `renderState`'s `stale` branch, branch on the phase: `routePhase() === "route"` → do NOT touch either stack (the route card persists in the route stack; the strip lamp + dimmed marker carry the signal — the UI-SPEC stale-during-route row); `routePhase() === "pending"` → the pending card stays in the route stack AND `showCard(lostCard, "bottom")` fires as today (different registers coexist); `routePhase() === "idle"` → exactly the Phase 3 behavior.
+6. `renderState`'s `live` branch stays untouched (the destination card holds the register until the route surface takes over via its own stack).
+
+The SEARCH AGAIN button inside the route/pending cards calls `onSearchAgain → routeController.walkBack()` — the same total function the BackButton walks.
+
+**Acceptance:** `npm run web:typecheck` exits 0; `npm test -w web` still green (RS gates land in task 4).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run web:typecheck 2>&1 | tail -4 ; grep -c 'ARAHARAH-ROUTE' web/src/route/route.ts</automated>
+  </verify>
+  <acceptance_criteria>
+    - `grep -q 'createFixtureRoutingSource' web/src/main.ts` exits 0 AND `grep -q 'createRouteController' web/src/main.ts` exits 0
+    - `grep -q 'walkBack?: () => void' web/src/telegram/backbutton.ts` exits 0 AND `grep -q 'route-stack' web/src/main.ts` exits 0
+    - `grep -q 'ARAHARAH-ROUTE state=drawn' web/src/route/route.ts` exits 0 AND `grep -q 'ARAHARAH-ROUTE state=pending' web/src/route/route.ts` exits 0
+    - `grep -q 'routeConsulted' web/src/main.ts` exits 0 (consult-once guard)
+    - `grep -q 'innerHTML' web/src/route/route-card.ts | grep -v '//'` returns no match OR zero count (createElement + textContent only — T-05-10)
+    - `grep -q 'ROUTE_CAMERA_PADDING' web/src/route/route.ts` exits 0 AND `grep -q 'bottom: 320' web/src/route/route.ts` exits 0
+    - `npm run web:typecheck` exits 0
+  </acceptance_criteria>
+  <done>The route state machine, cards, and boot wiring exist: auto-consult after live+destination, bottom route card with chips, center pending card, camera fit-bounds law, and the two-state BackButton walk sharing SEARCH AGAIN's total function.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 4: the RS structural + fake-map behavioral suite</name>
+  <files>web/test/route-surface.test.mjs</files>
+  <read_first>
+    - `web/test/destination-preload.test.mjs` (the DP-gate style: lazy imports, named cases, comment-stripped source scans)
+    - `web/test/no-storage.test.mjs` (the stripComments pattern RS2/RS8 reuse)
+    - `web/src/route/route-layers.ts` + `web/src/route/route.ts` + `web/src/route/route-card.ts` (tasks 2–3 outputs — the gates assert THEIR text and behavior)
+    - `.planning/phases/05-routing-route-display/05-UI-SPEC.md` (the laws the gates pin)
+  </read_first>
+  <action>
+**`web/test/route-surface.test.mjs`** — RED-first where behavioral (fake-map cases run against real modules), source-text where structural. Cases:
+- `RS1 paint law` — `route-layers.ts` text contains the 4 layer ids IN ORDER, widths 9/5/5/3, colors `#1A1A1A`/`#EB8008`/`#D9D2C6`, `"bevel"`, `"square"`, `"line-opacity": 1` (D-09).
+- `RS2 map-law` — comment-stripped `web/src/route/*.ts` contains ZERO `setStyle` (T-05-09); `map.ts` text: `opts.onLoad` appears AFTER the `building-3d` marker and BEFORE the `RAMS-BASEMAP-READY` string (source-order assertions via indexOf).
+- `RS3 fake-map layers` — a recording fake MapLike: `installRouteLayers(fake)` adds exactly 2 sources then 4 layers in order; a second call is a NO-OP (idempotence); `setRouteDrawn` calls setData on both sources with `{ type: "FeatureCollection", features: [...] }` (selected → "route", 1 feature per alt → "route-alt"); `clearRouteLayers` sets both to empty feature collections.
+- `RS4 controller state machine` — real `createRouteController` + fake deps (fake source serving a synthetic 2-option RouteResult, stub card builders returning `{className:"",textContent:""}`-shaped records, recording showRouteCard): `consult` → route card shown with register "bottom", console carries `ARAHARAH-ROUTE state=drawn`, `fitBounds` called with padding `{top:96,bottom:320,left:64,right:64}`, `duration: 400`, `pitch: 35`, `bearing` from `getBearing()`; select alt → setData swap + a NEW card build + fitBounds again (always refits); `walkBack` → clearRouteLayers called + showDestinationCard called + state "idle" + BackButton hidden (onStateChange). Pending: source returns null → pending card register "center", `state=pending` logged, fitBounds NEVER called; a source that THROWS behaves identically (fail-honest, T-05-04).
+- `RS5 card structure (source law)` — `route-card.ts` text: zero `innerHTML`/`insertAdjacentHTML`; contains `role", "group"` (the chips group), `route-chip`, `btn-secondary`, and `routeRegister`; contains NO `btn-primary` (D-10: no orange CTA fill on any Phase 5 surface).
+- `RS6 D-10 absence law` — `web/src/route/*.ts` comment-stripped: ZERO `btn-primary`, zero `progress`, zero `maneuver` (no guidance furniture — D-10).
+- `RS7 BackButton walk` — real `wireBackButton` + a fake `wa` (the mock's BackButton shape): overlay true + walkBack spy → click invokes walkBack and NEVER `close()`; overlay false → click invokes `close()` (T-05-11).
+- `RS8 console discipline` — comment-stripped `web/src/route/*.ts`: the ONLY `console.` occurrences are the two `ARAHARAH-ROUTE state=` literals; no console call contains a template interpolation (D-15 hygiene, T-05-13).
+- `RS9 strings-only copy` — `web/src/route/*.ts` contains ZERO of the pending-card English sentences (the copy lives only in strings.ts — COPY5's companion check); `route.ts` imports from `../i18n/strings.ts` transitively via the card module (assert the card module's import line exists).
+- `RS10 no-storage floor bump` — reuse no-storage's file-list shape: assert the `web/src/route` directory exists and its `.ts` files are included in a scan totalling ≥ 16 files (the GEO3 gate covers them automatically; this pins the family's presence).
+
+**Acceptance:** `npm test -w web` exits 0 with `PASS RS1`…`PASS RS10` (plus every earlier suite).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm test -w web 2>&1 | tail -20 ; npm run web:typecheck 2>&1 | tail -4</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm test -w web` exits 0 and the output contains `PASS RS1` through `PASS RS10`
+    - `npm run web:typecheck` exits 0
+    - `grep -q 'RS4' web/test/route-surface.test.mjs` exits 0 (the fake-map behavioral case exists)
+    - `grep -c 'setStyle' web/src/route/*.ts | grep -v ':0' | wc -l | tr -d ' '` returns 0 (zero setStyle across the route family)
+  </acceptance_criteria>
+  <done>Ten RS gates pin the UI-SPEC laws mechanically: paint, map-law, layer idempotence, the full controller state machine (drawn/pending/exception/walk-back), card structure, D-10 absences, the BackButton walk, console discipline, strings-only copy, and the route family's presence under the storage gate.</done>
+</task>
+
+</tasks>
+
+<verification>
+1. `npm test -w web` — all suites green including COPY1/COPY5/COPY7 and RS1–RS10.
+2. `npm run web:typecheck` — exit 0.
+3. `npm run build -w theme && npm run build -w web` — production build succeeds with the route family included (the 05-05 gates measure it).
+4. Manual structural sweep: `grep -rn "setStyle\|btn-primary\|innerHTML" web/src/route/` → zero code matches (comments stripped).
+5. The UI-SPEC cross-check: layer widths 9/5/5/3, camera padding 96/320/64/64 @ 400ms, card bottom offset 64px composite, chips 28px/44px — each value greps to exactly the spec number.
+</verification>
+
+<success_criteria>
+- The route state machine draws the selected route (orange casing stack), swaps alternatives on chip tap (instant + refit), renders the designed pending card for uncovered pairs, and walks back cleanly via BackButton or SEARCH AGAIN.
+- Zero style re-sets, zero innerHTML, zero guidance furniture, zero coordinate-bearing console lines.
+- All copy lives in the strings module (COPY7 verbatim-pinned, en + ms).
+- The RS suite proves every UI-SPEC law that is provable without a browser; the capture legs (05-05) prove the pixels.
+</success_criteria>
diff --git a/.planning/phases/05-routing-route-display/05-05-PLAN.md b/.planning/phases/05-routing-route-display/05-05-PLAN.md
new file mode 100644
index 0000000..e7179e4
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-05-PLAN.md
@@ -0,0 +1,270 @@
+---
+phase: 05-routing-route-display
+plan: 05
+type: execute
+wave: 3
+depends_on: ["02", "04"]
+files_modified:
+  - web/test/build-artifact.test.mjs
+  - web/index.html
+  - web/src/mock/route-profiles.ts
+  - web/scripts/capture.mjs
+  - bot/test/route-privacy.test.mjs
+autonomous: true
+requirements: [RTNG-01, RTNG-02]
+must_haves:
+  decisions_implemented:
+    - "D-11: the BA build-artifact bundle-budget gate — fixture geometry + route-model code ≤ ~200KB gzipped measured over production-shaped artifacts, printed with every run"
+    - "D-05: the Worker gains no /api/route — a structural gate proves bot/src never registers a route proxy and never imports the routing workspace"
+    - "D-15: capture signals are state tokens only — ARAHARAH-ROUTE state=drawn|pending, never coordinates; the capture legs pair the token with DOM text checks"
+    - "D-12: the capture harness's ?fixpair knob delivers a PINNED PUBLIC origin from the committed fixture corpus — the harness introduces no user coordinate"
+    - "DSGN-02: the route-gallery fidelity artifact extends the Phase 1/3 gallery pattern beside navigate_map_overview/screen.png"
+  truths:
+    - "BA9 measures the gzipped size of the fixture dataset + routing workspace sources + web route modules against a 204800-byte budget and PRINTS the measurement — the budget is visible, never discovered"
+    - "BA10 proves every committed pairId rides the shipped production bundle (the BA7 id-parity analog — a stale bundle without the fixtures is unshippable)"
+    - "The harness-only route-profiles module is provably excluded from web/dist (a named sentinel token the BA5-family scan greps for)"
+    - "Five new capture legs exist and pass: shell-route-fixture, shell-route-alt (post-chip-tap), shell-route-pending, shell-route-dark, route-gallery-compare — all non-blank, all state-token-raced"
+    - "bot/test/route-privacy.test.mjs proves the Worker stayed out of the routing path: zero /api/route tokens, zero @araharah/routing imports in bot/src"
+  artifacts:
+    - path: "web/test/build-artifact.test.mjs"
+      provides: "BA9 (bundle budget, printed) + BA10 (pairId parity) — the production-build gates"
+      contains: "BA9"
+    - path: "web/src/mock/route-profiles.ts"
+      provides: "the harness-only ?fixpair origin lookup (imports getPairOrigin from @araharah/routing; sentinel-guarded)"
+      contains: "ROUTE_PROFILE_HARNESS_ONLY"
+    - path: "web/index.html"
+      provides: "the ?fixpair=<pair-id> knob — the mock's telegramFix becomes the pair's pinned public origin"
+      contains: "fixpair"
+    - path: "web/scripts/capture.mjs"
+      provides: "the five route capture legs + the ARAHARAH-ROUTE signal race + DOM assertions"
+      contains: "ARAHARAH-ROUTE"
+    - path: "bot/test/route-privacy.test.mjs"
+      provides: "RP1/RP2 — the Worker-side no-route-proxy gates (D-05)"
+      contains: "RP1"
+  key_links:
+    - from: "web/index.html"
+      to: "web/src/mock/route-profiles.ts"
+      via: "the harness block resolves ?fixpair to a pinned origin and threads it as the mock's telegramFix"
+      pattern: "getRouteProfileOrigin"
+    - from: "web/src/mock/route-profiles.ts"
+      to: "@araharah/routing/src/index.ts"
+      via: "getPairOrigin(pairId) — the committed public fixture corpus is the ONLY origin source the harness can deliver"
+      pattern: "getPairOrigin"
+    - from: "web/scripts/capture.mjs"
+      to: "web/src/route/route.ts"
+      via: "the capture race waits on the ARAHARAH-ROUTE state token the controller emits"
+      pattern: "ARAHARAH-ROUTE"
+    - from: "bot/test/route-privacy.test.mjs"
+      to: "bot/src"
+      via: "the D-05 structural scan (no route proxy, no routing import) — the privacy-gate family pattern"
+      pattern: "/api/route"
+---
+
+<objective>
+Close the phase with its verification gates: the BA9 bundle-budget + BA10 fixture-parity build-artifact gates over the production build, the five route capture legs driven by the new `?fixpair=` harness knob, and the Worker-side no-route-proxy privacy gates — the mechanical proof that the amended SC3 holds ("bundle-size and type gates holding").
+
+Purpose: D-11's bundle budget is a build-artifact gate, not a hope; the UI-SPEC's five capture artifacts are the phase's visual evidence (and the DSGN-02 fidelity obligation); and D-05/D-12's privacy posture stays verifiable by reading gate output. The route legs run against the production-shaped harness bundle (the Phase 3 capture discipline — never against dev-mode).
+
+Output: BA9/BA10 in `build-artifact.test.mjs`, `web/src/mock/route-profiles.ts` + the `?fixpair` knob in `web/index.html`, five new capture legs in `capture.mjs` (expected list 8 → 13), and `bot/test/route-privacy.test.mjs` (RP1/RP2).
+</objective>
+
+<execution_context>
+@$HOME/.config/opencode/get-shit-done/workflows/execute-plan.md
+@$HOME/.config/opencode/get-shit-done/templates/summary.md
+</execution_context>
+
+<context>
+@AGENTS.md
+@.planning/phases/05-routing-route-display/05-CONTEXT.md
+@.planning/phases/05-routing-route-display/05-UI-SPEC.md
+@.planning/phases/05-routing-route-display/05-02-PLAN.md
+@.planning/phases/05-routing-route-display/05-04-PLAN.md
+@web/test/build-artifact.test.mjs
+@web/scripts/capture.mjs
+@web/index.html
+@web/src/mock/telegram-mock.ts
+@bot/test/privacy.test.mjs
+@routing/src/index.ts
+@routing/src/data/route-fixtures.json
+
+<capture_contract>
+The five new legs (UI-SPEC §Capture Profiles — ALL existing legs unchanged; the expected list grows 8 → 13). The demo pair is selected AT RUNTIME from the committed corpus — never hardcoded: `const routePairs = JSON.parse(readFileSync(resolve(REPOROOT, "routing/src/data/route-fixtures.json", "utf8"))).pairs;` then `const demoPair = routePairs.find((p) => p.routes.length >= 2) ?? routePairs[0];` (RT10 guarantees ≥ 4 multi-route pairs, so the find succeeds; the fallback keeps the legs runnable in the degenerate case). Queries are then built from `demoPair.destinationId` / `demoPair.pairId`:
+
+| Artifact | Query | Race + assertions |
+|----------|-------|-------------------|
+| `shell-route-fixture.png` | `mock=android&dest=${demoPair.destinationId}&fixpair=${demoPair.pairId}` (light) | race `ARAHARAH-ROUTE`; assert the line reads `state=drawn`; DOM: `waitForFunction` body text contains the destination's NAME (from the gazetteer entry read at capture time) AND `MIN` (the card's telemetry); 2000ms tile settle; shot |
+| `shell-route-alt.png` | same profile | after the drawn race: if `.route-chip` exists (multi-route pair — the RT10-guaranteed case), `page.click(".route-chip")`, wait 800ms (instant swap + 400ms refit + margin), assert body text matches `/ROUTE \d\/\d/`; ELSE (degenerate single-route fallback) assert the no-chip law: the page contains NO `.route-chip` element; shot |
+| `shell-route-pending.png` | `mock=android&dest=national-museum&fixpair=${demoPair.pairId}` | race `ARAHARAH-ROUTE`; assert `state=pending`; DOM: body contains `not wired up yet` (the pending headline, en); shot |
+| `shell-route-dark.png` | route-fixture profile + `scheme=dark` | same race + the PX-02 honesty check (`data-tg-theme` === "dark" before shooting); shot |
+| `route-gallery-compare.png` | — | the DSGN-02 composer (gallery-compare precedent): `shell-route-fixture.png` beside `stitch_minimalist_route_navigator/navigate_map_overview/screen.png`, columns labeled with source paths |
+
+Harness mechanics:
+- `SIGNALS` gains `'ARAHARAH-ROUTE'` (the seen-map + diagnostics strings too).
+- New `waitMode: 'route'` — race the ARAHARAH-ROUTE console event (30s timeout, the SIGNAL_TIMEOUT_MS shape), then parse the captured line for `state=` and let the leg assert its expected state + DOM.
+- `web/index.html` harness block: `const fixpair = q.get("fixpair");` — when present, import the profile module and resolve the pinned origin; pass `telegramFix: { lat: <origin.lat>, lng: <origin.lng>, accuracyM: 12, headingDeg: null }` (fall back to the current default fix when the pairId is unknown — an unknown pairId must not wedge the boot).
+- `web/src/mock/route-profiles.ts` (HARNESS-ONLY, imported ONLY from the index.html harness block): imports `getPairOrigin` from `@araharah/routing/src/index.ts`; exports `getRouteProfileOrigin(pairId: string): { lat: number; lng: number } | null` and the sentinel `export const ROUTE_PROFILE_HARNESS_ONLY = true;`. Header comment: D-12 (the pinned origin is committed public fixture data — the harness delivers no user coordinate) + the BA-exclusion note.
+</capture_contract>
+
+<ba_gate_contract>
+**BA9 — the bundle budget (D-11).** Appended to `build-artifact.test.mjs`:
+
+- Inputs (all committed files, production-shaped by construction): `routing/src/data/route-fixtures.json`, every `routing/src/**/*.ts`, every `web/src/route/**/*.ts`.
+- Measurement: sum of `gzipSync(readFileSync(f)).length` over the inputs; assert `<= 204800` (200 KiB); the failure message and a `console.log` line BOTH print the measured bytes + budget (`BA9 route bundle budget: {n} / 204800 gz bytes`) — visible every run (D-11: "enforced as a BA build-artifact gate").
+- Comment in the gate: the measurement bounds the phase's ADDED payload (fixtures dominate; the minified route code's gz size is approximated by its source gz size — the approximation is conservative in the gate's favor at these sizes and the 200 KiB ceiling carries an order-of-magnitude headroom per 05-RESEARCH Finding 1).
+- The gate skips with a build-first message when `web/dist` is absent (the BA-suite convention) — run after `npm run build -w theme && npm run build -w web`.
+
+**BA10 — fixture parity (the BA7 analog).** Every `pairId` from the committed `route-fixtures.json` must appear in the concatenated `web/dist/assets/*.js` text — a stale bundle that lost the fixtures could never serve a route (assert `pairs.length >= 10` first, the "scanned a real dataset" guard pattern).
+
+**BA5-family extension.** Add `"ROUTE_PROFILE_HARNESS_ONLY"` to BA5's token list — the harness-only route-profiles module must be dead-code-eliminated from production (its import lives inside `if (__ARAHARAH_HARNESS__)` in index.html; the define-replaces-with-false mechanism strips the branch exactly like installMockWebApp).
+</ba_gate_contract>
+
+<environment_facts>
+Verified in this session — do not re-derive:
+
+- `capture.mjs` structure: `SIGNALS` array at line 166, `captureLeg({name, query, colorScheme, grantGeo, waitMode})`, the waitMode dispatch chain (`live`/`dest`/`denied`/`settle400`/`immediate`), and the final `expected` list of 8 artifacts with the missing/undersized/failures gate — the extension points are exactly these four.
+- `web/index.html`'s harness block already reads `?dest=` and threads it as `startParam`; `telegramFix` is hard-coded `{lat:3.1513,lng:101.6958}` today — the fixpair knob replaces its VALUE (never the shape).
+- `build-artifact.test.mjs` reads `search/src/data/kl-gazetteer.json` via `import … with { type: "json" }` (line 47) — the fixtures JSON imports identically; BA7's per-id loop is the BA10 template.
+- The mock's `telegramFix` delivery maps `{lat,lng,accuracyM,headingDeg}` → the Telegram wire shape (`telegram-mock.ts` lines 190–199) — the profile module returns the authoring shape.
+- Plan 05-02 pinned `national-museum` as the pending-probe destination (RT4: never a corpus destination) — the pending leg's carrier is valid by construction.
+- Plan 05-04's controller emits exactly two console tokens: `ARAHARAH-ROUTE state=drawn` / `ARAHARAH-ROUTE state=pending` (RS8-pinned).
+- `bot/test/privacy.test.mjs` is the bot-side grep-gate style reference (comment-stripping + banned-token scans).
+</environment_facts>
+
+<threat_model>
+## Trust Boundaries
+
+| Boundary | Description |
+|----------|-------------|
+| Harness query params → mock fix | `?fixpair=` selects which PUBLIC pinned origin the mock delivers. It must never accept arbitrary coordinates (a `?lat=&lng=` knob would reintroduce the coordinate-in-URL surface the fixture world exists to avoid). |
+| Committed artifacts → the measured budget | The budget gate reads repo files; a silent fixture bloat (someone re-fetching with `overview=full&steps=true`) must fail the build gate, not surface as a slow webview. |
+| Production build → users | Harness-only modules leaking into `web/dist` would ship mock wiring — the BA5-family sentinel scan is the tripwire. |
+| Worker surface | A route proxy appearing in bot/src would violate D-05's "the Worker gains no /api/route" — the structural gate keeps the pivot honest. |
+
+## STRIDE Threat Register
+
+| Threat ID | Category | Component | Disposition | Mitigation Plan |
+|-----------|----------|-----------|-------------|-----------------|
+| T-05-12 | Denial of Service (availability budget) | Fixture/code growth pushing the webview bundle past the D-11 budget | mitigate | BA9 fails the suite above 204800 gz bytes and prints the measurement every run; RT9 (plan 05-02) is the fixture-level early-warning tier of the same law. |
+| T-05-14 | Information Disclosure | A coordinate-parameter harness knob or a coordinate-bearing capture signal reintroducing user-coordinate surfaces | mitigate | The knob accepts ONLY a pairId (resolved from the committed public corpus via `getPairOrigin` — arbitrary lat/lng params are never read); the capture legs assert the `state=` token form (no coordinates — RS8 pins the source; the legs pin the runtime); the pending leg proves an out-of-corpus pair renders the honest card, never a fabricated geometry. |
+| T-05-16 | Tampering (D-05 regression) | A route proxy growing into the Worker | mitigate | RP1: zero `/api/route` tokens in comment-stripped `bot/src`; RP2: zero `@araharah/routing` imports in `bot/src` — the Worker cannot route even accidentally. |
+| T-05-15 | Tampering (harness leakage) | The route-profiles harness module shipping in production | mitigate | The `ROUTE_PROFILE_HARNESS_ONLY` sentinel joins BA5's token scan — the module is provably dead-code-eliminated from `web/dist`. |
+</threat_model>
+
+<tasks>
+
+<task type="auto" tdd="true">
+  <name>task 1: BA9 bundle-budget + BA10 fixture-parity + BA5 sentinel extension</name>
+  <files>web/test/build-artifact.test.mjs</files>
+  <read_first>
+    - `web/test/build-artifact.test.mjs` (BA1–BA8 — the gate file this task extends; BA7's loop is the BA10 template)
+    - `routing/src/data/route-fixtures.json` (the committed pair set BA10 asserts)
+    - `.planning/phases/05-routing-route-display/05-RESEARCH.md` (Finding 1 — the size math behind the budget)
+  </read_first>
+  <action>
+Extend `web/test/build-artifact.test.mjs`:
+- Import the fixtures dataset (`import routeFixtures from "../../routing/src/data/route-fixtures.json" with { type: "json"; }`) and `gzipSync` from `node:zlib`.
+- Define the input file list: `routing/src/data/route-fixtures.json` + a recursive walk of `routing/src` (`*.ts`) + `web/src/route` (`*.ts`) (resolve paths relative to the test file like `WEB`/`DIST` are).
+- `BA9` test: skip-with-build-first-message when `web/dist` is absent (the suite convention); compute the summed gz size; `console.log("BA9 route bundle budget: " + total + " / 204800 gz bytes")`; assert `<= 204800` with the measurement in the failure message.
+- `BA10` test: assert `routeFixtures.pairs.length >= 10` (a real dataset guard); concatenate `web/dist/assets/*.js`; assert EVERY `pairId` appears in the bundle text (failure names the missing pairId — the T-04-39 phrasing pattern).
+- BA5: add `"ROUTE_PROFILE_HARNESS_ONLY"` to the scanned token list (both the JS-assets and the HTML scans).
+- Update the file-header doc-comment inventory (BA9/BA10 lines).
+
+Build first, then run: `npm run build -w theme && npm run build -w web && npm test -w web` — ALL BA gates green including the new ones (04-04's BA7/BA8 still pass — the route family adds no crypto, no CDN, and the gazetteer ids remain).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run build -w theme >/dev/null 2>&1 && npm run build -w web >/dev/null 2>&1 ; npm test -w web 2>&1 | tail -15</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm test -w web` exits 0 and the output contains `PASS BA9` and `PASS BA10`
+    - `grep -q 'BA9 route bundle budget' web/test/build-artifact.test.mjs` exits 0 (the printed measurement)
+    - `grep -q '204800' web/test/build-artifact.test.mjs` exits 0
+    - `grep -q 'ROUTE_PROFILE_HARNESS_ONLY' web/test/build-artifact.test.mjs` exits 0 (BA5 extension)
+    - `grep -q 'pairId' web/test/build-artifact.test.mjs` exits 0 (BA10 parity loop)
+    - `node -e "const{gzipSync}=require('node:zlib');const{readFileSync,readdirSync}=require('node:fs');const{join}=require('node:path');let t=0;const w=(d)=>{for(const f of readdirSync(d,{withFileTypes:true})){const p=join(d,f.name);if(f.isDirectory())w(p);else if(f.name.endsWith('.ts'))t+=gzipSync(readFileSync(p)).length}};w('routing/src');t+=gzipSync(readFileSync('routing/src/data/route-fixtures.json')).length;w('web/src/route');console.log('measured:',t);if(t>204800)throw new Error('over budget');console.log('BA9 preview OK')"` exits 0
+  </acceptance_criteria>
+  <done>The production build passes the budget gate (measured and printed), carries every committed pairId, and provably excludes the harness-only profile module.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 2: ?fixpair harness knob + five route capture legs</name>
+  <files>web/src/mock/route-profiles.ts, web/index.html, web/scripts/capture.mjs</files>
+  <read_first>
+    - `web/index.html` (the harness block — where the knob threads)
+    - `web/src/mock/telegram-mock.ts` (MockOptions.telegramFix — the authoring shape the profile feeds)
+    - `web/scripts/capture.mjs` (SIGNALS, captureLeg waitModes, the expected list, the gallery composer)
+    - `.planning/phases/05-routing-route-display/05-UI-SPEC.md` §Capture Profiles (the binding artifact table)
+  </read_first>
+  <action>
+**`web/src/mock/route-profiles.ts`** — per the `<capture_contract>` block: sentinel export + `getRouteProfileOrigin` wrapping `getPairOrigin` from `@araharah/routing/src/index.ts`; header comment citing D-12 and the BA5 sentinel.
+
+**`web/index.html`** — inside the harness block: read `const fixpair = q.get("fixpair");`; after the existing mock-import, when `fixpair` is truthy dynamically import the profile module (`await import("/src/mock/route-profiles.ts")` — the `/src/` absolute form is the PROVEN harness-import path), resolve the origin, and use it as the mock's `telegramFix` lat/lng (accuracy 12, heading null); unknown pairId → keep the current default fix (log nothing). Add `fixpair` to the profile comment line listing the knobs.
+
+**`web/scripts/capture.mjs`**:
+- `SIGNALS` gains `'ARAHARAH-ROUTE'`; the seen-map + `signalDiagnostics` gain the same key.
+- At the top of the leg block, load the committed corpus and pick the demo pair (`routePairs` / `demoPair` per the `<capture_contract>` block — the legs are data-driven from the committed dataset, never hardcoded pair literals).
+- New `waitMode: "route"` branch: race the `ARAHARAH-ROUTE` console event (`SIGNAL_TIMEOUT_MS`); on timeout → hard failure with diagnostics; parse `state=` from the captured line; the leg's expected state + DOM assertions are leg parameters (`expectState`, `expectText: […]` — `waitForFunction` over `document.body.textContent`, 15s, the dest-leg polling shape); 2000ms settle before the shot (tile render).
+- Add the five legs per the `<capture_contract>` table (fixture → alt (chip click when present) → pending → dark → gallery-compare, reusing the existing composer with `shell-route-fixture.png` in the implemented column).
+- Extend `expected` to the 13-artifact list. Update the header doc-comment's Outputs inventory.
+
+The alt leg's chip click: `page.click(".route-chip")` (first chip), then assert `/ROUTE \d\/\d/.test(bodyText)` — the `{n}/{N}` register the swapped card renders; the degenerate no-chip fallback asserts the single-route rendering law instead (UI-SPEC: single-route draws render NO chip row).
+
+**Acceptance:** `npm run web:capture` exits 0 with 13/13 non-blank captures (`CAPTURE OK — 13/13`), including the five new legs; no existing leg regressed.
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm run web:capture 2>&1 | tail -20</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm run web:capture` exits 0 and its output contains `CAPTURE OK — 13/13`
+    - `test -f web/screenshots/shell-route-fixture.png && test -f web/screenshots/shell-route-alt.png && test -f web/screenshots/shell-route-pending.png && test -f web/screenshots/shell-route-dark.png && test -f web/screenshots/route-gallery-compare.png` exits 0
+    - `grep -q 'ARAHARAH-ROUTE' web/scripts/capture.mjs` exits 0 AND `grep -q 'fixpair' web/index.html` exits 0
+    - `grep -q 'ROUTE_PROFILE_HARNESS_ONLY' web/src/mock/route-profiles.ts` exits 0
+    - `grep -q 'getPairOrigin' web/src/mock/route-profiles.ts` exits 0 (the pinned-corpus-only origin law)
+    - the runner-page profile comment lists the fixpair knob: `grep -q '?fixpair' web/index.html` exits 0
+  </acceptance_criteria>
+  <done>Five route capture legs pass against the production-shaped harness bundle — drawn, alt-swapped, pending, dark, and the DSGN-02 gallery artifact — all raced on state tokens with DOM text assertions.</done>
+</task>
+
+<task type="auto" tdd="true">
+  <name>task 3: Worker-side no-route-proxy gates (D-05)</name>
+  <files>bot/test/route-privacy.test.mjs</files>
+  <read_first>
+    - `bot/test/privacy.test.mjs` (the bot-side grep-gate style: comment stripping, banned-token scans, named cases)
+    - `bot/src` tree (the scanned surface)
+    - `.planning/phases/05-routing-route-display/05-CONTEXT.md` D-05 (the law being gated)
+  </read_first>
+  <action>
+**`bot/test/route-privacy.test.mjs`** — RED-first-then-green (pure gates over the unmodified Worker tree):
+- `RP1 no route proxy` — strip comments from every `bot/src/**/*.ts` (the privacy.test.mjs pattern) and assert ZERO occurrences of `/api/route` and `route` handler registrations matching `/app\.route\(|on\("message:url"|\.route\("route/`… keep it PRECISE: assert zero `/api/route` tokens AND zero `registerRoute|routeProxy` tokens (D-05: the Worker gains no route endpoint this phase).
+- `RP2 no routing import` — zero `@araharah/routing` specifiers anywhere in `bot/src` (routing lives in the webview bundle only; the Worker imports only `@araharah/search`).
+
+Header comment: the D-05 citation + "the pivot's Worker boundary, gated".
+
+**Acceptance:** `npm test -w bot` exits 0 with `PASS RP1` and `PASS RP2` (all existing bot suites + GE gates still green).
+  </action>
+  <verify>
+    <automated>cd /home/C-Fu/araharah && npm test -w bot 2>&1 | tail -10</automated>
+  </verify>
+  <acceptance_criteria>
+    - `npm test -w bot` exits 0 and the output contains `PASS RP1` and `PASS RP2`
+    - `grep -rc '/api/route' bot/src --include='*.ts' | grep -v ':0' | wc -l | tr -d ' '` returns 0 (the gate's premise holds in the tree itself)
+    - `grep -rc '@araharah/routing' bot/src --include='*.ts' | grep -v ':0' | wc -l | tr -d ' '` returns 0
+  </acceptance_criteria>
+  <done>The Worker's routing abstinence is mechanically gated: no route endpoint, no routing-workspace import — the pivot's D-05 boundary holds by test, not by memory.</done>
+</task>
+
+</tasks>
+
+<verification>
+1. `npm run build -w theme && npm run build -w web && npm test -w web` — BA1–BA10 all green (BA9 prints the measurement).
+2. `npm run web:capture` — CAPTURE OK — 13/13 (the five new legs non-blank, state-raced, DOM-asserted).
+3. `npm test -w bot` — all suites green including GE1–GE7 and RP1/RP2.
+4. Full suite: `npm run routing:test && npm run routing:corpus && npm test -w web && npm test -w bot` — green.
+5. The amended SC3 evidence chain: RT1–RT10 (corpus routes cleanly) + BA9/BA10 (bundle-size gate) + the 05-01 C2 type gate + the pending capture (deliberate, designed) — all four clauses have a green instrument.
+</verification>
+
+<success_criteria>
+- BA9/BA10 pass over the production build with the measurement printed.
+- 13/13 captures pass including the five route legs driven by ?fixpair.
+- RP1/RP2 gate the Worker out of the routing path.
+- The phase's full verification story is green across all four workspaces.
+</success_criteria>
diff --git a/.planning/phases/05-routing-route-display/05-CONTEXT.md b/.planning/phases/05-routing-route-display/05-CONTEXT.md
new file mode 100644
index 0000000..1a617c8
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-CONTEXT.md
@@ -0,0 +1,115 @@
+# Phase 5: Routing + Route Display - Context
+
+**Gathered:** 2026-10-24
+**Status:** Ready for planning — **with a roadmap amendment** (SC3 rewording, below)
+
+<domain>
+## Phase Boundary
+
+The route EXPERIENCE ships end-to-end in fixture world: a `RoutingSource` interface (mirroring `SearchSource`), a fixture backend whose geometries for 10–20 real KL pairs were precomputed at build time, Rams route rendering (orange casing on the grayscale map), up-to-3 alternatives as a bottom card + chips, selection redraw with camera refit, and an honest "router pending" state for arbitrary origins. The `guidance_sessions` envelope is designed as a types-only frozen contract for Phase 6. **No VPS, no Worker route proxy, no third-party routing calls** — the engine itself is deferred to the WASM-router OSS track (client-side routing, backend #2), with Valhalla-on-VPS documented as backend #3.
+
+**ROADMAP AMENDMENT (planning must apply):** SC3 is reworded from "routes cleanly through self-hosted Valhalla … behind the Worker proxy" to: "the golden-route corpus (10–20 real KL pairs) routes cleanly through the fixture RoutingSource backend with bundle-size and type gates holding; the RoutingSource interface carries the documented backend ladder (fixtures → client-side WASM router → Valhalla-on-VPS) and the 'router pending' state is deliberate and designed." RTNG-01's "calculated route" is satisfied by fixture calculation; the arbitrary-origin router is a documented deferral, not an omission.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Routing infrastructure — THE PIVOT (user decision, supersedes roadmap SC3 v1)
+- **D-01:** **No VPS this phase. No third-party routing API ever at runtime** (origin+destination to a third party is a core-value privacy leak). Routing is a **`RoutingSource` interface** with a backend ladder: **#1 fixtures (this phase) → #2 client-side WASM router (OSS track, deferred) → #3 Valhalla-on-VPS (documented, provision scripts as a documented path, not shipped)**.
+- **D-02:** Backend #1 = **fixture routes for the 10–20 golden KL pairs**, geometries precomputed at BUILD time by a repo script hitting the public OSRM demo server once (build machine, fixed public coordinates — no user data, no runtime dependency), committed as compact encoded polylines. Each pair pins expected distance/duration tolerances.
+- **D-03:** Arbitrary origin/destination combinations return an honest **"router pending"** state — a designed, deliberate Rams surface (UI-SPEC scope), never a blank map, never a fake route, never a silent failure.
+- **D-04:** The **WASM-router track** (client-side routing in the webview — origin+destination never touch a server; static-hosted; fork-perfect) is captured as the post-v1 OSS project that becomes RoutingSource backend #2, exactly parallel to the search backend #2 pattern. The user's static-hosting/fork-model intent is preserved as the architectural direction, not abandoned.
+- **D-05:** The Worker gains **no `/api/route`** this phase. Fixtures ride in the web bundle (gazetteer precedent). The interface stays backend-shaped so a server backend could slot in later without client rework.
+
+### guidance_sessions envelope (Phase 6's contract, frozen now)
+- **D-06:** **Types-only contract**: `guidance_sessions` envelope = { id, chat ref, route snapshot (inline), created_at } with a **~2h TTL** — shipped as code types + docs, **no KV namespace, no service, no runtime writes**. Phase 6 builds the service on the frozen shape.
+- **D-07:** Route snapshot lives **inline in the envelope record — one key, one TTL**; nothing outlives 2h, nothing reconstructable after expiry. Consistent with the location-pin TTL precedent (Phase 3). The route model itself carries **step geometry + snapped-progress support fields from day one** (GUID-05/06 upstream obligation).
+
+### Route UX surface (UI-SPEC scope; phase-terminal)
+- **D-08:** Alternatives present as a **bottom card + chips**: one card for the selected route (time, distance, one-line difference vs best) with compact alternates as selectable chips — tap → redraw. Map stays dominant.
+- **D-09:** Route line = **signal-orange casing** (dark under-line for grayscale contrast) + orange center line — Phase 1's reserved accent, per the navigate_map_overview mockup. Destination pin keeps venue semantics; origin = subdued ring. Camera **fits route bounds** on draw.
+- **D-10:** **Display-only terminal surface**: selection redraws + camera refits; a restart/search-again affordance returns to the destination state. **No start-guidance button, no turn instructions, no progress UI** — Phase 6. No placeholder-shaped furniture (Phase 3 D-08 law).
+
+### Gates replacing SC3's latency/subrequest budgets
+- **D-11:** **Bundle budget**: fixture geometry + route-model code ≤ ~200KB gzipped added to the web bundle, enforced as a BA build-artifact gate. **Type gates**: route model readiness (step geometry + snapped-progress fields) pinned by tests. "Router pending" state covered by UI-SPEC + captures. Latency/subrequest budgets are not applicable to fixture world (documented as such, not faked).
+
+### Privacy (carried + made specific)
+- **D-12:** Fixture geometries are public-data routes between public places — no user coordinate ever enters a fixture. The build-time OSRM fetch happens on the maintainer's machine against fixed public points; the script documents this boundary. Runtime: origin stays in memory only (Phase 3 law); no route persists (envelope is types-only this phase).
+
+### OpenCode's Discretion
+- Fixture encoding format (encoded-polyline vs simplified GeoJSON) within the ≤200KB budget
+- RoutingSource interface shape (async, backend-tagged results, tolerance metadata)
+- Which Phase 4 corpus destinations become the 10–20 pairs; realistic origins list
+- One-line-difference copy per alternative card (en/ms, clinical tone); "router pending" copy
+- Chip/card visual details within the Rams system (UI-SPEC will bind exact geometry)
+
+</decisions>
+
+<specifics>
+## Specific Ideas
+
+- The route experience should feel like the mockup distilled: the orange line is THE accent on a grayscale world — nothing else competes.
+- "Router pending" copy should be honest and calm: the app knows what routing is, states it isn't wired yet, offers search again. Same clinical register as the denied card.
+- Fixture pairs double as the demo script: the 10–20 pairs are the routes a reviewer walks to see the product work.
+
+</specifics>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Phase scope + decisions
+- `.planning/ROADMAP.md` §Phase 5 — goal, success criteria **+ this file's SC3 amendment (planning applies it)**
+- `.planning/REQUIREMENTS.md` §RTNG-01/02 (+ GUID-05/06 upstream obligations)
+- `.planning/phases/04-destination-search-kl-gazetteer/04-CONTEXT.md` — SearchSource pattern to mirror; backend-ladder pattern; fork-model law (GPL-3.0)
+- `.planning/phases/03-mini-app-shell-geolocation/03-CONTEXT.md` — map boot, marker/follow controller, memory-only law, location-pin TTL precedent
+
+### Codebase
+- `web/src/map/` — MapLibre boot (style never re-set — route layers must be addLayer, not style mutation), marker, follow controller
+- `web/src/search/resolve-destination.ts` — the preloaded destination this phase routes TO
+- `search/` — the interface+backend+ladder pattern to mirror
+- `web/scripts/capture.mjs` + mock profiles — the capture harness the route display must extend (`?dest=` profiles exist)
+- `bot/src/i18n/strings.ts` pattern — copy discipline for card/difference strings
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- `search/` workspace: interface + ladder + loader + corpus-gate patterns to mirror for `routing/`
+- Phase 4 corpus gate (D-13/D-14) — the fixture-pair tolerance gate follows its shape
+- Mock harness profiles (`?dest=`) — route-state capture profiles extend these
+- BA build-artifact gates — the bundle-budget gate joins them
+
+### Established Patterns
+- npm workspaces + delegate scripts; TDD RED→GREEN; hand-rolled runners
+- Interface + documented backend ladder (SearchSource → RoutingSource)
+- Types-only frozen contracts (session envelope) with TTL-only storage law
+- UI-SPEC gate applies this phase (UI hint: yes) — planning routes through it
+
+### Integration Points
+- Destination resolver → route destination input (Phase 4 hands off where Phase 5 begins)
+- Route model step geometry + snapped-progress fields → Phase 6 guidance consumes
+- `guidance_sessions` envelope types → Phase 6 bot service implements
+
+</code_context>
+
+<deferred>
+## Deferred Ideas
+
+- **WASM-router OSS project** — client-side routing in the webview (RoutingSource backend #2); static-hosted, privacy-maximal, fork-perfect; its own post-v1 project
+- **Valhalla-on-VPS** — RoutingSource backend #3; docker-compose + Caddy + provision scripts as a documented path (Oracle Always Free candidate; full-MY extract chosen if provisioned)
+- **Worker `/api/route` proxy** — only meaningful with a server backend
+- **Real routing for arbitrary origins** — arrives with backend #2/#3; the "router pending" state is the honest interim
+- Turn instructions/progress UI — Phase 6 (GUID-*)
+- Toll-avoidance / costing knobs — v1.x
+
+</deferred>
+
+---
+
+*Phase: 05-routing-route-display*
+*Context gathered: 2026-10-24*
diff --git a/.planning/phases/05-routing-route-display/05-DISCUSSION-LOG.md b/.planning/phases/05-routing-route-display/05-DISCUSSION-LOG.md
new file mode 100644
index 0000000..b6b81f3
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-DISCUSSION-LOG.md
@@ -0,0 +1,62 @@
+# Phase 5: Routing + Route Display - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions captured in CONTEXT.md — this log preserves the analysis.
+
+**Date:** 2026-10-24
+**Phase:** 05-routing-route-display
+**Mode:** default (interactive)
+
+## Areas Discussed
+
+### Routing infrastructure — THE PIVOT (the phase's defining decision)
+| Question | Options presented | Selection |
+|---|---|---|
+| VPS for Valhalla? | Oracle Always Free / paid VPS / research decides | **User redirected**: check the static-hosting/fork-model pivot from phase 3–4 discussions (lunr/Fuse/sql.js WASM, GitHub/CF hosting) |
+| Extract | full MY / KL-only | Full Malaysia extract (mooted by pivot) |
+| Serving | compose+Caddy+secret / bare systemd / Cloudflare Tunnel | "check planning docs for the pivot to forking model" |
+
+### The reconciliation round (user informed of SC3 collision)
+Explained: routing ≠ search — per-query shortest-path over multi-million-edge graphs; no Valhalla/OSRM WASM builds exist; static hosts execute nothing; Workers cap at 128MB/CPU-s; third-party APIs leak origin+destination (core-value violation). User then chose:
+| Question | Options presented | Selection |
+|---|---|---|
+| Reconcile SC3 | fixture-now+WASM-later / VPS after all / third-party+exception / something else | **Fixture routes now, WASM track later** — SC3 amended, no VPS, no proxy |
+
+### guidance_sessions envelope
+| Question | Options presented | Selection |
+|---|---|---|
+| Scope at phase close | types-only contract / contract+KV live | Types-only contract |
+| Snapshot placement | inline one-TTL / separate key | Inline snapshot, one TTL |
+
+### Route UX surface
+| Question | Options presented | Selection |
+|---|---|---|
+| Alternatives presentation | bottom card+chips / stacked cards | Bottom card + chips |
+| Route line | orange casing+fit bounds / single line | Orange casing + fit bounds |
+| Phase terminal surface | display-only / placeholder start button | Display-only terminal |
+
+### Corpus + budgets (fixture-shaped)
+| Question | Options presented | Selection |
+|---|---|---|
+| Fixture geometry source | build-time precompute via public OSRM (no user data) / hand-drawn | Precomputed pairs, build-time |
+| Gates | bundle-size + type gates / + fake latency gate | Bundle + type gates |
+
+## Corrections Made
+
+User corrected my VPS framing twice — pointing back at their static-hosting/fork-model
+pivot (stated during phase 4 planning discussions). First round produced the VPS question
+again; second round produced the SQLite/sql.js question; the routing-area answer finalized
+as full deferral. The CONTEXT records their intent as the architectural direction
+(WASM-router track), not a rejection of fork values — the VPS remains a documented
+backend with provision scripts, just not this phase.
+
+## Auto-Resolved
+
+Extract choice (full MY) and serving shape (compose+Caddy) were answered but became moot
+under the pivot — recorded as part of the documented backend #3 path in deferred ideas.
+
+## External Research
+
+Not needed this phase per roadmap ("standard patterns"); the WASM-router feasibility
+assessment (no Valhalla/OSRM WASM builds; DIY scope) was knowledge-based, verified
+against the phase-4 research's registry checks.
diff --git a/.planning/phases/05-routing-route-display/05-PATTERNS.md b/.planning/phases/05-routing-route-display/05-PATTERNS.md
new file mode 100644
index 0000000..5a6d46b
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-PATTERNS.md
@@ -0,0 +1,99 @@
+# Phase 5: Routing + Route Display - Pattern Map
+
+**Mapped:** 2026-10-24
+**Files analyzed:** 24 new/modified surfaces (grouped into 16 rows below)
+**Analogs found:** 15 / 16 rows matched (1 genuinely new: the polyline6 codec — pure algorithm, RESEARCH is the spec)
+
+> Source files for this map: 05-CONTEXT.md (D-01..D-12), 05-RESEARCH.md, 05-UI-SPEC.md (binding).
+> The controlling analogs are the **`search/` workspace (Phase 4)** — interface + ladder + loader + corpus gate — and the **Phase 3 shell surfaces** (`map/`, `ui/cards.ts`, `telegram/backbutton.ts`).
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|-------------------|------|-----------|----------------|---------------|
+| `routing/` workspace pkg (`package.json`, `tsconfig.json`) | package config | — | `search/package.json` / `search/tsconfig.json` (Phase 4, shipped) | exact |
+| `routing/src/types.ts` (RoutingSource + RouteResult + day-one model fields) | model (types) | — | `search/src/types.ts` | exact |
+| `routing/src/polyline.ts` (polyline6 codec) | utility | transform (pure) | **none** — new algorithm; 05-RESEARCH Finding 1 is the spec (round-trip law makes it self-verifying) | none (algorithm) |
+| `routing/src/fixture-source.ts` (backend #1) | service | request-response (in-memory match) | `search/src/source.ts` + `search/src/gazetteer.ts` (lazy LAW 1/2/3) | exact |
+| `routing/src/index.ts` (public API) | package surface | — | `search/src/index.ts` (named exports, subpath-with-extension import law) | exact |
+| `routing/test/runner.mjs` + `harness.mjs` + `*.test.mjs` | test | — | `search/test/*` (same harness shape) | exact |
+| `routing/src/data/route-fixtures.json` (committed fixtures) | data | — | `search/src/data/kl-gazetteer.json` (committed dataset, ODbL header object) | exact |
+| `routing/test/fixtures/golden-pairs.json` (pinned corpus) | data (test fixture) | — | `search/test/fixtures/golden-corpus.json` | exact |
+| `routing/scripts/fetch-route-fixtures.mjs` | script (repo tool, network) | file-I/O + network | `search/scripts/overpass-topup.mjs` (UA mandatory, soft-exit, never a runtime dep) | exact |
+| `routing/scripts/route-corpus.mjs` + `routing/test/corpus.test.mjs` | script + Nyquist gate | batch | `search/scripts/gazetteer-corpus.mjs` + `search/test/corpus.test.mjs` (one measurement, two reporters) | exact |
+| `bot/src/kv/guidance-sessions.ts` (envelope TYPES ONLY) | model (types) | — | `bot/src/kv/sessions.ts` (SessionClaim "the entire persisted claim surface — a 5th property means drift") | role-match (types-only, no KV calls) |
+| `web/src/route/route-layers.ts` (GeoJSON sources + 4 layers) | service (map painting) | addSource/addLayer/setData | `web/src/map/map.ts` `building-3d` block (addLayer inside `map.on("load")`, reuses style-owned values, never re-sets style) | exact |
+| `web/src/route/route-markers.ts` (origin ring + destination pin + name chip) | view (DOM markers) | Marker DOM | `web/src/map/marker.ts` (createPositionMarker DOM-marker pattern, `.pos-*` chrome in shell.css) | exact |
+| `web/src/route/route-card.ts` (route card + chips + pending card) | view (card builders) | DOM | `web/src/ui/cards.ts` (mountHintedCard) + `web/src/search/destination-card.ts` (createElement + textContent ONLY, strings-module copy) | exact |
+| `web/src/route/route.ts` (controller: consult, selection swap, camera) | controller | event/state | `web/src/map/follow.ts` (constants + controller closure; `CAMERA_PADDING_PX`/`RECENTER_DURATION_MS` precedent) | role-match |
+| `web/src/main.ts` (mod) + `web/src/telegram/backbutton.ts` (mod: two-state walk) | controller wiring | — | themselves (Phase 3/4; `overlayPresent` closure becomes the route-state predicate) | — |
+| `web/src/shell.css` (mod: chip/card-body/marker-chrome rules) | style | — | itself (token-only law; machined-geometry exception list) | — |
+| `web/src/i18n/strings.ts` (mod: 10 route keys) | config/i18n | — | itself (COPY1..COPY6 gate) | exact |
+| `web/index.html` (mod: `?fixpair=` knob) | config (harness page) | — | itself (`?dest=` profile block, 04-04) | exact |
+| `web/src/mock/route-profiles.ts` (harness-only pair-origin lookup) | test harness | — | `web/src/mock/telegram-mock.ts` (harness-only module, BA5-excluded) | exact |
+| `web/scripts/capture.mjs` (mod: 5 route legs + ROUTE signal) | script | batch | itself (SIGNALS array + captureLeg) | exact |
+| `web/test/build-artifact.test.mjs` (mod: BA9) | test (gate) | — | itself (BA1..BA8) | exact |
+| `web/test/route-surface.test.mjs` (new structural suite) | test | — | `web/test/destination-preload.test.mjs` (DP-gate style) | exact |
+
+## Pattern Assignments
+
+### `routing/src/types.ts` (model, types-only)
+
+**Analog:** `search/src/types.ts` — same header-contract comment style, same "the seam every backend implements" law, same empty-value-is-load-bearing semantics (`[]` → `null`).
+
+```typescript
+// search/src/types.ts:57-63 — the shape being mirrored:
+export interface SearchSource {
+  readonly name: string;
+  search(q: SearchQuery): Promise<SearchHit[]>;  // EMPTY array = honest refusal
+  byId(id: string): GazetteerEntry | null;
+}
+// becomes: route(req): Promise<RouteResult | null>  — null = router pending (D-03)
+```
+
+### `routing/src/fixture-source.ts` (service)
+
+**Analog:** `search/src/gazetteer.ts` LAW 1/2/3 verbatim — lazy memoized index (never module scope), static JSON import (`with { type: "json" }`), zero logging/storage. The matcher adds one pure function the gazetteer never needed: a haversine distance with a 200 m tolerance constant (05-RESEARCH Finding 3).
+
+### `routing/scripts/fetch-route-fixtures.mjs` (repo tool)
+
+**Analog:** `search/scripts/overpass-topup.mjs` — descriptive User-Agent mandatory, inter-request delay, per-item soft diagnostics, writes a committed JSON dataset, imported by NOTHING at runtime. The header contract states the D-12 boundary (fixed public coordinates, maintainer machine, no runtime dependency).
+
+### `routing/test/corpus.test.mjs` (Nyquist gate)
+
+**Analog:** `search/test/corpus.test.mjs` — "the suite re-runs the corpus runner's measurements IN-PROCESS (never spawns the script), so `npm run routing:test` fails whenever the corpus regresses." One measurement core exported from the script, two reporters.
+
+### `web/src/route/route-layers.ts` (map painting)
+
+**Analog:** `web/src/map/map.ts:43-67` — the `building-3d` block is the only existing `addLayer` precedent: inside `map.on("load")`, no `beforeId`, paint values copied from style-owned constants ("zero invented colors", DSGN-01). UI-SPEC extends it: 4 layers added AFTER the building-3d block, bottom→top `route-alt-casing` → `route-alt-line` → `route-casing` → `route-line`; sources added empty, filled via `setData` (data, not style — never a style re-set).
+
+```typescript
+// web/src/map/map.ts:43 — the exact insertion point (AFTER this block, same handler):
+map.on("load", () => { /* building-3d … console.log("RAMS-BASEMAP-READY …") */ });
+```
+
+### `web/src/route/route-card.ts` (card builders)
+
+**Analog:** `web/src/search/destination-card.ts` — createElement + textContent ONLY (an id/name-derived string never reaches innerHTML), composed from theme classes, every string from the strings module (COPY5). Chips add the `.toggle-option` focus precedent (3px orange bracket) and the `<button type="button">` law. **Per the UI-SPEC post-approval addendum: NO per-card padding overrides — compose from the existing `.card > *` padding rules (shell.css:74-80).**
+
+### `web/src/route/route.ts` (controller)
+
+**Analog:** `web/src/map/follow.ts` — named constants beside the existing ones (`ROUTE_CAMERA_PADDING = { top: 96, bottom: 320, left: 64, right: 64 }`, `ROUTE_FIT_DURATION_MS = 400`), a closure controller, no state outside memory (D-07).
+
+### `bot/src/kv/guidance-sessions.ts` (envelope types)
+
+**Analog:** `bot/src/kv/sessions.ts` `SessionClaim` — "the entire persisted claim surface — a 5th property means drift" — but TYPES-ONLY per D-06: no `KvLike`, no `.put(`, no wrangler namespace; the TTL exists as a documented constant (`GUIDANCE_SESSION_TTL_SECONDS = 7200`) awaiting its Phase 6 consumer. The grep gate (bot test) pins "types-only" mechanically.
+
+### `web/src/telegram/backbutton.ts` (two-state walk)
+
+**Analog:** itself — Phase 3's total-function wire (`overlayPresent() => false` → `close()`); the predicate becomes "route or pending state active" and the pushed-state click walks back via the SAME total function SEARCH AGAIN invokes (UI-SPEC §BackButton Contract). The handler and predicate ship as one change.
+
+## Data Flow Notes
+
+- **Origin never persists:** the request `{origin, destinationId}` is constructed in main.ts's closure from the live fix + the Phase 4 memory-only destination, passed by argument, and dropped with the frame (D-07/GEO-03 law — the route module takes no storage, keeps no module-scope origin).
+- **Fixtures are public data:** `route-fixtures.json` enters the bundle by static import exactly like `kl-gazetteer.json` (build-time inlining, BA7-style parity gate idea carries to BA9's budget measurement).
+- **Signals are state tokens:** `ARAHARAH-ROUTE state=drawn|pending` — never coordinates (D-15 hygiene, the `ARAHARAH-DEST state=` precedent).
+
+---
+
+*Pattern map: 2026-10-24 — pattern-mapper role run inline (no subagent spawn capability; sanctioned fallback).*
diff --git a/.planning/phases/05-routing-route-display/05-RESEARCH.md b/.planning/phases/05-routing-route-display/05-RESEARCH.md
new file mode 100644
index 0000000..b5f06ba
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-RESEARCH.md
@@ -0,0 +1,50 @@
+# Phase 5: Routing + Route Display — Research (light pass)
+
+**Researched:** 2026-10-24 (light pass — the pivot removed Valhalla; per roadmap note "standard patterns, no research phase needed", this pass covers only the three open questions planning actually faces)
+**Scope:** fixture encoding format · OSRM demo build-time script shape · RoutingSource interface analogs. Everything else is decided in 05-CONTEXT.md (D-01..D-12) and 05-UI-SPEC.md (binding).
+
+---
+
+## Finding 1 — Fixture encoding: encoded polyline6 VERBATIM (not GeoJSON)
+
+**Decision:** store each route as the encoded-polyline string exactly as the OSRM demo returns it (`geometries=polyline6`), plus `distanceM`/`durationS`. A decoder lives in the routing workspace.
+
+- **Verified live (2026-10-24):** `GET https://router.project-osrm.org/route/v1/driving/101.7117,3.1578;101.6869,3.1343?alternatives=2&overview=full&geometries=polyline6` → `code: Ok`, 2 routes, route 1 = 6907.9 m / 663.2 s with a **1200-char** geometry string; route 2 = 6572.8 m / 696 s / 1252 chars.
+- **Size math vs the D-11 budget:** ~45 routes (15 pairs × up to 3) × ~1.2–2.5 KB ≈ **40–60 KB raw → ~12–20 KB gzipped**. The ≤ 200 KB gz budget leaves an order of magnitude of headroom. GeoJSON coordinate arrays for the same geometry measure ~10–20× larger for zero fidelity gain — rejected.
+- **Verbatim storage is the lossless choice:** the string is what the demo server returned — no float rounding, no re-serialization. The decoder (standard Google encoded-polyline varint/delta algorithm, precision 1e6) is ~40 lines, pure, and round-trip testable (encode(decode(s)) === s per fixture — a free corpus assertion).
+- **Snapped-progress support (D-07, GUID-05/06 upstream obligation):** fixtures do NOT precompute cumulative distances — the runtime derives `cumulativeDistanceM` once at decode/load (deterministic haversine walk, memoized). Keeps fixtures lean; the MODEL still carries the field from day one.
+
+## Finding 2 — OSRM demo build-time script shape (verified shape, repo-tool precedent)
+
+- **Endpoint:** `https://router.project-osrm.org/route/v1/driving/{lng},{lat};{lng},{lat}?alternatives=2&overview=full&geometries=polyline6` — `alternatives=2` returns up to 2 alternates (≤ 3 total routes; matches RTNG-02's "up to 3"), `overview=full` gives the complete geometry, `steps=false` (turn instructions are Phase 6; fixture `steps` stay typed-but-empty — never fake).
+- **Response contract:** `code: "Ok"`, `routes[]` best-first (preserve order), each with `distance` (m), `duration` (s), `geometry` (polyline6 string). A `code !== "Ok"` or 0-route response is a script HARD FAILURE for that pair — never a silently missing pair.
+- **Script posture — exact analog `search/scripts/overpass-topup.mjs` (Phase 4 D-06 "repo tools never runtime deps"):** runs on the MAINTAINER's machine (`npm run routing:fixtures`), never in CI, never at `vite build`, never at Worker request time. Mandatory descriptive User-Agent, polite delay between pair fetches, writes the committed `routing/src/data/route-fixtures.json`, soft-fails with a per-pair diagnostic. **D-12 boundary stated in the script header:** it hits FIXED PUBLIC coordinates (gazetteer landmark points) only; no user coordinate can ever enter a fixture; the app itself gains no network dependency.
+- **Sustainability honesty:** the demo server is a free best-effort service. That is acceptable precisely because its output is COMMITTED — the runtime never touches it. A server policy change breaks the (rare) regeneration script, never the product.
+
+## Finding 3 — RoutingSource interface (the SearchSource analog)
+
+Mirror of `search/src/types.ts` (verbatim shape correspondence, D-01):
+
+| SearchSource (Phase 4, shipped) | RoutingSource (this phase) |
+|---|---|
+| `readonly name: string` | `readonly name: string` — `"fixture"` now; `"wasm-router"` (#2) / `"valhalla"` (#3) documented, not shipped |
+| `search(q): Promise<SearchHit[]>` | `route(req): Promise<RouteResult \| null>` |
+| EMPTY array = honest refusal (D-13) | **`null` = honest "router pending" (D-03)** — never a blank map, never a fake route |
+| `byId(id): GazetteerEntry \| null` (sync) | not needed this phase (the webview already holds the resolved `GazetteerEntry` from Phase 4) |
+
+- `RouteResult` carries `options: RouteOption[]` — **index 0 is the best route** (OSRM returns best-first; order preserved), 1..3 entries. Each option: geometry (decoded points + derived cumulative distances), summary (distance/duration), and the day-one `steps` field (typed, empty in fixture world — D-10 defers instructions to Phase 6; an empty array is honest "not wired", a fabricated step list would not be).
+- **Fixture matching law:** a pair serves a request when `destinationId` matches exactly AND the requested origin sits within a fixed public tolerance (200 m haversine) of the pair's pinned origin. Anything else → `null` (the pending state). The 200 m pad absorbs GPS jitter around a known landmark without ever fabricating a route for an unknown origin.
+- **Lazy-index + three-environment laws carry over verbatim** from `search/src/gazetteer.ts` (LAW 1 lazy memoized load; LAW 2 static JSON import inlined by esbuild AND Vite, importable by bare Node 24 with `with { type: "json" }`; LAW 3 no logging/no storage — the D-15 analog: request coordinates never leave the caller).
+
+## Validation Architecture
+
+- **Framework:** existing hand-rolled runners; plan 05-01 adds the fifth workspace's identical pair (`routing/test/runner.mjs` + `routing/test/harness.mjs`, copied verbatim from `search/test/`). No new framework (Phase 4 precedent).
+- **Primary acceptance instruments:** (1) the routing workspace suite (codec vectors, contract gates, lazy/no-logging/no-storage laws); (2) the golden-pair corpus gate (offline: every pair's geometry↔summary consistency recomputed by haversine + round-trip codec proof + alternatives floor) — the D-14 corpus-gate shape, adapted to fixtures; (3) the web suite extensions (route state machine, copy gate, BackButton walk); (4) BA9 bundle-budget gate over the production build; (5) the capture harness legs (`?fixpair=`) with the `ARAHARAH-ROUTE state=` token.
+- **Offline law:** no test, suite, or gate ever touches a network. The OSRM demo is exercised ONLY by the maintainer script. This is what makes the corpus gate deterministic and the "fixture resolves cannot fail at runtime" claim (UI-SPEC Copywriting §Error state) true.
+- **Blocking checkpoint:** none this phase — no real-device leg is required (route display is fixture-world; the Phase 3/4 device gates already proved map + deep-link on hardware). Capture legs + structural gates carry verification.
+
+---
+
+## RESEARCH COMPLETE
+
+*Light pass as directed: three findings, folded into plans 05-01/05-02/05-04/05-05. No open questions remain.*
diff --git a/.planning/phases/05-routing-route-display/05-VALIDATION.md b/.planning/phases/05-routing-route-display/05-VALIDATION.md
new file mode 100644
index 0000000..6005dc8
--- /dev/null
+++ b/.planning/phases/05-routing-route-display/05-VALIDATION.md
@@ -0,0 +1,97 @@
+---
+phase: 5
+slug: routing-route-display
+status: final
+nyquist_compliant: true
+wave_0_complete: false
+created: 2026-10-24
+updated: 2026-10-24
+---
+
+# Phase 5 — Validation Strategy
+
+> Per-phase validation contract for feedback sampling during execution.
+
+---
+
+## Test Infrastructure
+
+| Property | Value |
+|----------|-------|
+| **Framework** | Existing hand-rolled harnesses (`bot/test/runner.mjs`, `web/test/runner.mjs`, `search/test/runner.mjs`); plan 05-01 adds the fifth workspace's identical pair (`routing/test/runner.mjs` + `routing/test/harness.mjs`, copied verbatim) — no new framework |
+| **Config file** | None — suites are discovered by filename convention (`*.test.mjs`) per workspace |
+| **Quick run command** | `npm run routing:test` / `npm test -w web` / `npm test -w bot` |
+| **Full suite command** | `npm run routing:test && npm test -w web && npm test -w bot && npm test -w search && npm run audit -w theme` + typechecks + `npm run routing:corpus` |
+| **Corpus gate command** | `npm run routing:corpus` (fixture-pair tolerance gate; also asserted in-process by `routing/test/corpus.test.mjs` so `npm run routing:test` fails on a pair regression) |
+| **Estimated runtime** | ~20 seconds (hand-rolled runners are sub-second; the capture harness and the production-build BA9 gate are plan-scoped legs) |
+
+---
+
+## Sampling Rate
+
+- **After every task commit:** Run the touched workspace's suite (`npm run routing:test`, or `npm test -w web` / `npm test -w bot`) plus that workspace's typecheck.
+- **After every plan wave:** Run the full suite (`npm run routing:test && npm test -w web && npm test -w bot`) **plus** `npm run routing:corpus` — the golden-pair gate must hold at every wave merge, not just at the end.
+- **Before `/gsd-verify-work`:** Full suite green + corpus gate green + BA9 bundle-budget gate green (production build).
+- **Max feedback latency:** 20 seconds (excluding the plan-scoped capture harness and the production build the BA gate requires — per-plan legs, not per-commit legs).
+
+---
+
+## Per-task Verification Map
+
+| task ID | Plan | Wave | Requirement | Threat Ref | Secure Behavior | Test Type | Automated Command | File Exists | Status |
+|---------|------|------|-------------|------------|-----------------|-----------|-------------------|-------------|--------|
+| 05-01-T1 (workspace + contracts + route model) | 01 | 1 | RTNG-01, D-01/D-07 | T-05-01/06/07 | typed RoutingSource seam; day-one step-geometry + snapped-progress fields pinned by tests; no logging/storage | unit | `npm run routing:test` + `npm run routing:typecheck` | ❌ W0 | ⬜ pending |
+| 05-01-T2 (polyline6 codec) | 01 | 1 | RTNG-01 | T-05-02 | pure codec; round-trip law; malformed-input refusal (never NaN points) | unit | `npm run routing:test` | ❌ W0 | ⬜ pending |
+| 05-01-T3 (fixture backend + lazy loader + index) | 01 | 1 | RTNG-01, D-03/D-04/D-05 | T-05-03/04 | null = honest pending; 200 m tolerance law; lazy index; three-environment loader proof; empty-fixture schema committed | unit + bundle | `npm run routing:test` + esbuild bundle marker | ❌ W0 | ⬜ pending |
+| 05-03-T1 (guidance_sessions envelope types + gates) | 03 | 1 | D-06/D-07 | T-05-08 | types-only: no KV namespace, no runtime writes, TTL constant 7200 | gates + typecheck | `npm test -w bot` + `npm run bot:typecheck` | ❌ W0 | ⬜ pending |
+| 05-02-T1 (golden-pairs corpus + fetch script) | 02 | 2 | RTNG-01/02, D-02/D-12 | T-05-05 | public coords only; UA mandatory; per-pair hard-fail on non-Ok; 10–20 pairs committed | fixture-driven | `npm run routing:test` | ❌ W0 | ⬜ pending |
+| 05-02-T2 (offline tolerance gate + corpus runner) | 02 | 2 | RTNG-01/02 | T-05-05/12 | geometry↔summary consistency offline; codec round-trip per fixture; alternatives floor; fixture size early-warning | corpus | `npm run routing:corpus` + `npm run routing:test` | ❌ W0 | ⬜ pending |
+| 05-04-T1 (route layers + markers + camera) | 04 | 2 | RTNG-01, D-09 | T-05-09 | addLayer-after-building-3d ordering; zero style re-set; verbatim hex constants; pitch 35 preserved | unit + typecheck | `npm test -w web` + `npm run web:typecheck` | ❌ W0 | ⬜ pending |
+| 05-04-T2 (route card + chips + pending card + strings) | 04 | 2 | RTNG-02, D-03/D-08/D-10 | T-05-10 | COPY5 strings-module law; no per-card padding overrides; chips = `<button type="button">`; no start-guidance affordance | unit | `npm test -w web` | ❌ W0 | ⬜ pending |
+| 05-04-T3 (main.ts wiring + BackButton two-state walk) | 04 | 2 | RTNG-01/02, D-10 | T-05-10/11 | auto route consult after live+destination; no route request when destination unavailable; back always walks to root | unit | `npm test -w web` | ❌ W0 | ⬜ pending |
+| 05-05-T1 (BA9 bundle-budget gate) | 05 | 3 | RTNG-01, D-11 | T-05-12 | fixture+route code ≤ 200 KB gz over production-shaped artifacts | build-artifact | `npm test -w web` (after `npm run build -w web`) | ❌ W0 | ⬜ pending |
+| 05-05-T2 (route capture legs + ?fixpair knob + gallery) | 05 | 3 | RTNG-01/02 | T-05-14/15 | state-token signals only (no coordinates in console); pairId-only harness knob; harness module provably excluded; route drawn/alt/pending/dark legs non-blank | capture | `npm run web:capture` | ✅ extend | ⬜ pending |
+| 05-05-T3 (no-`/api/route` + no-user-coordinate gates) | 05 | 3 | D-05/D-12 | T-05-16/05 | Worker gains no route proxy; fixtures carry zero user-coordinate risk surface | gates | `npm test -w bot` + `npm run routing:test` | ❌ W0 | ⬜ pending |
+
+*Status: ⬜ pending · ✅ green · ❌ red · ⚠️ flaky*
+
+---
+
+## Wave 0 Requirements
+
+All new this phase (the repo has no routing infrastructure today). The owning tasks are marked; a task's `<verify>` may reference a suite created in the SAME task (RED-first per the repo's TDD convention).
+
+- [ ] `routing/test/runner.mjs` + `routing/test/harness.mjs` — the fifth workspace's harness pair, copied verbatim from `search/test/` (05-01-T1)
+- [ ] `routing/test/contract.test.mjs` — RoutingSource shape, day-one model fields, null-pending contract (05-01-T1)
+- [ ] `routing/test/polyline.test.mjs` — codec vectors + round-trip + malformed-input refusal (05-01-T2)
+- [ ] `routing/test/fixture-source.test.mjs` + `routing/test/loader-env.test.mjs` — matching law, tolerance boundary, lazy index, no-logging/no-storage, three-environment loader proof (05-01-T3)
+- [ ] `routing/test/fixtures/golden-pairs.json` — the pinned 10–20 pair corpus with tolerances (05-02-T1)
+- [ ] `routing/scripts/fetch-route-fixtures.mjs` + `routing/scripts/route-corpus.mjs` + `routing/test/corpus.test.mjs` — the maintainer tool + the offline tolerance gate (05-02)
+- [ ] `bot/test/guidance-envelope.test.mjs` — types-only envelope gates (05-03-T1)
+- [ ] `web/test/route-surface.test.mjs` — layer order/paint constants, card/chips structure, camera constants, BackButton walk (05-04)
+- [ ] **Extend (not new):** `web/test/copy-gate.test.mjs` (COPY1 floor + route keys verbatim), `web/test/build-artifact.test.mjs` (BA9 bundle budget), `web/test/no-storage.test.mjs` (explicit `web/src/route/` case note), `bot/test/privacy.test.mjs` or new bot structural gate (no `/api/route`), `web/scripts/capture.mjs` + `web/index.html` (?fixpair legs)
+
+*The corpus runner is the phase's primary acceptance instrument (D-02's tolerance gates) — it is both a script and an in-suite gate, so `npm run routing:test` fails whenever a committed pair regresses.*
+
+---
+
+## Manual-Only Verifications
+
+| Behavior | Requirement | Why Manual | Test Instructions |
+|----------|-------------|------------|-------------------|
+| Route card + chips render legibly on a real device | RTNG-01/02 | Visual truth on real Telegram clients (the automated legs prove structure + capture the 390×844 viewport) | Optional: open the Mini App with `?dest=suria-klcc` on device after deploy; confirm the orange route, card, and chips against `web/screenshots/shell-route-fixture.png` |
+
+*One optional manual leg only — the fixture world removes the real-device blocker Phase 3/4 carried. The phase's "router pending on device" behavior is covered by the pending capture leg.*
+
+---
+
+## Validation Sign-Off
+
+- [x] All tasks have `<automated>` verify or Wave 0 dependencies
+- [x] Sampling continuity: no 3 consecutive tasks without automated verify (every task carries an automated verify)
+- [x] Wave 0 covers all MISSING references
+- [x] No watch-mode flags
+- [x] Feedback latency < 20s (excluding plan-scoped capture/build gates)
+- [x] `nyquist_compliant: true` set in frontmatter
+
+**Approval:** planner-complete (2026-10-24) — statuses flip to ✅ during execution
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-01-PLAN.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-01-PLAN.md
index 4cde22b..4e82dab 100644
--- a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-01-PLAN.md
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-01-PLAN.md
@@ -23,6 +23,7 @@ must_haves:
     - "A tampered/truncated/mismatched graph binary decodes to null — never a throw, never a half-built graph (T-06-03)"
     - "A GPS fix snaps to the nearest graph node via edge-segment projection with cos(lat)-scaled equirectangular math (D-05)"
     - "A* finds the same optimal path as brute-force Dijkstra on the fixture mini-graph for every node pair (GUID-02 engine)"
+    - "The backend ladder records the engine decision trail in index.ts: fixture #1, engine A #2 (D-01); the Valhalla-to-JS port ruled infeasible and geojson-path-finder rejected (D-02); Engine B documented as the post-v1 evolution of A (D-02)"
     - "One-way edges are respected by A* and ignored by snapping"
     - "Route steps carry turn kind, street name, distance, and polyline6 geometry derived from the node path"
   artifacts:
@@ -161,20 +162,21 @@ Street names are NOT optional: GUID-01's banner renders `RouteStep.name` verbati
   <behavior>
     - snapToGraph at a node's exact coordinates → that node, distanceM ≈ 0
     - snapToGraph mid-edge → the CLOSER endpoint node, distanceM = haversine distance to it (never a fabricated mid-node)
+    - SnapResult carries `nameId` = the MATCHED segment's edgeNameId (null when UNNAMED_NAME_ID) — ADDITIVE field plan 07's cron street hop consumes (edges carry names; nodes don't)
     - snapToGraph outside bbox + SNAP_BBOX_MARGIN_DEG margin → null (honest miss — router-pending upstream, D-03)
     - oneway edges: snapping IGNORES direction (a fix near a oneway segment still snaps to its endpoints)
     - two snaps for the same RoadGraph instance reuse the memoized grid (WeakMap — observable via a build-counter or timing assertion kept loose)
   </behavior>
   <action>
 1. RED: `routing/test/snap.test.mjs` loads `mini-graph.bin` via decodeGraph and asserts the behaviors above.
-2. GREEN: `routing/src/snap.ts` — `snapToGraph(graph: RoadGraph, point: RoutePoint): SnapResult | null` where `SnapResult = { node: number; distanceM: number }`. Implementation: coarse grid index (cell ~0.002°) mapping cell-key → node ids, built ONCE per graph and memoized in a module-scope `WeakMap<RoadGraph, Grid>` (LAW 1 lazy memoize — PATTERNS shared pattern); candidate nodes from the 3×3 cell neighborhood; final distance via point-to-SEGMENT equirectangular projection (lng scaled by cos(lat)) over each candidate's edges, returning the closer endpoint of the best segment. `SNAP_BBOX_MARGIN_DEG = 0.01` named export. All distances through haversineM / cos-scaled math — never raw Δdegrees (Pitfall 8).
+2. GREEN: `routing/src/snap.ts` — `snapToGraph(graph: RoadGraph, point: RoutePoint): SnapResult | null` where `SnapResult = { node: number; distanceM: number; nameId: number | null }` — `nameId` is the best segment's `edgeNameId` found by the sweep (null when UNNAMED_NAME_ID); an ADDITIVE field, so `{ node, distanceM }` destructuring consumers keep working. Implementation: coarse grid index (cell ~0.002°) mapping cell-key → node ids, built ONCE per graph and memoized in a module-scope `WeakMap<RoadGraph, Grid>` (LAW 1 lazy memoize — PATTERNS shared pattern); candidate nodes from the 3×3 cell neighborhood; final distance via point-to-SEGMENT equirectangular projection (lng scaled by cos(lat)) over each candidate's edges, returning the closer endpoint of the best segment TOGETHER WITH that segment's `nameId`. `SNAP_BBOX_MARGIN_DEG = 0.01` named export. All distances through haversineM / cos-scaled math — never raw Δdegrees (Pitfall 8).
   </action>
   <verify>
     <automated>npm run routing:test</automated>
   </verify>
   <acceptance_criteria>
     - routing/src/snap.ts exports snapToGraph and SNAP_BBOX_MARGIN_DEG
-    - snap.test.mjs asserts: exact-node hit, mid-edge closer-endpoint, outside-bbox → null, oneway-direction ignored
+    - snap.test.mjs asserts: exact-node hit, mid-edge closer-endpoint, outside-bbox → null, oneway-direction ignored, nameId = the best segment's edgeNameId (null for the unnamed segment)
     - grep `cos(` matches routing/src/snap.ts (the Pitfall-8 lng scaling)
     - grep `WeakMap` matches routing/src/snap.ts (the per-graph memo)
   </acceptance_criteria>
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-06-SUMMARY.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-06-SUMMARY.md
index 297af7d..ccffe59 100644
--- a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-06-SUMMARY.md
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-06-SUMMARY.md
@@ -2,41 +2,41 @@
 phase: 06-turn-by-turn-guidance-live-driving
 plan: 06
 subsystem: web-guidance-wiring
-tags: [guidance-pump, d10-locked-camera, px01-full-graph, px03-confirm-exits, d11-envelope-lifecycle, keepalive, resume-get, d14-trip-end-delete, composed-ladder, engine-a-fixture, tdd, concurrent-dispatch-merge]
+tags: [guidance-pump, px01-backbutton-graph, d10-locked-follow-camera, d11-envelope-lifecycle, guid05-resume, guid02-reroute-wiring, d14-trip-end, composed-ladder, tdd, gate-repin]
 
 # Dependency graph
 requires:
   - phase: 06-turn-by-turn-guidance-live-driving/02
-    provides: "the pure D-04 machine (createGuidanceSession/stepGuidance/effects), projectAlongRoute, GUIDANCE_START_ALONG_M, the D-15 watch + shouldAcceptFix, the D-07 eta module — pumped, never re-implemented"
-  - phase: 06-turn-by-turn-guidance-live-driving/05
-    provides: "the seven chrome builders, fireHaptic, engage/releaseCloseProtection, GLYPHS, the 18 strings keys, data-guidance CSS compaction — mounted, never re-styled"
-  - phase: 06-turn-by-turn-guidance-live-driving/04
-    provides: "createHttpRoutingSource — the ladder's engine-a stage"
+    provides: "THE pure D-04 machine (createGuidanceSession/stepGuidance + effects), projectAlongRoute, the named constants (GUIDANCE_START_ALONG_M et al.) — the pump wires it and never re-decides it"
   - phase: 06-turn-by-turn-guidance-live-driving/03
-    provides: "POST/GET/DELETE /api/guidance — the frozen envelope endpoints this plan's client half calls"
+    provides: "POST/GET/DELETE /api/guidance + the frozen envelope snapshot shape (the six client-minted fields) — the minimize/resume/trip-end flows ride it byte-identically"
+  - phase: 06-turn-by-turn-guidance-live-driving/04
+    provides: "createHttpRoutingSource (backend #2, engine-a) — the composed ladder's first rung; reroutes route through it for real"
+  - phase: 06-turn-by-turn-guidance-live-driving/05
+    provides: "the seven chrome builders, haptics, close protection, the machine-blink gantry, [data-guidance] CSS compaction — the cockpit this plan makes ALIVE"
   - phase: 05-routing-route-display/05
-    provides: "the route controller's injected-deps shape, the RS gate family, the walkBack total function this plan extends"
+    provides: "the route controller's injected-deps shape, the route stack registers, RS1–RS10 gate family — evolved, not replaced"
   - phase: 03-mini-app-shell-geolocation/03
-    provides: "the follow controller (ONE easing discipline + the originalEvent unlock law) and the recenter control the guidance pose rides"
+    provides: "the follow controller's originalEvent unlock law + the recenter control — the guidance camera rides both"
 provides:
-  - "web/src/guidance/camera.ts — the D-10 locked-follow camera: GUIDANCE_CAMERA_PADDING {320,64,64,64} / GUIDANCE_ZOOM 16 / GUIDANCE_EASE_MS 400 / GUIDANCE_CAMERA_PITCH 35, easeToSnapped over the follow controller, onRerouteApplied = the documented camera no-op, bearing NEVER passed"
-  - "web/src/telegram/backbutton.ts — the context-aware wire: BackAction = hidden|close|callback, resolveAction consulted per click + wire.sync() per state change, the legacy two-arg shape composed internally, close() only at the true root"
-  - "web/src/route/route.ts — the guidance pump: watch-arms-with-route, the start gate, effects dispatch (haptics/reroute/arrival), the cockpit chrome, silent reroute through the injected source (setData snap-in, NO camera jump; calm NO REROUTE), confirm/CONTINUE exits, the D-14 teardown, the envelope lifecycle (keepalive POST / DELETE-on-activated / idempotent trip-end DELETE), resume() with controller-side projection, backAction() — the PX-01 resolver's single authority"
-  - "web/src/guidance/guidance.ts — guidanceView(snap, listOpen) + resumingView(...): ALL banner/card/list view-data composition beside the machine's own maneuver marks (the RS6 boundary's living proof: route/ imports and calls, never re-derives)"
-  - "web/src/main.ts — the composed ladder (engine-a first, fixture fallback, code-constructed, zero env reads), the capability-guarded activated/deactivated wiring, the UUID-validated ?g= resume boot with defensive envelope validation, the recenter re-lock at the guidance pose, the chain-fix camera skip while driving, the no-double-consult resume guard"
-  - "web/test/route-surface.test.mjs — RS7b PX-01 full walk, RS11-13 camera laws, G1-G12 + E1-E6 the pump/envelope/resume suites, RS6/RS8 re-pins"
-affects: [06-07 cron turn-cards (the envelope lifecycle is live; cron pushes pause on the resume DELETE), 06-08 real-drive gate (the full client behavior is replay-tested; captures ride the guide-* classes), phase-6 verification (PX-01/PX-03 observable behaviors claimed)]
+  - "web/src/guidance/camera.ts — the D-10 locked-follow guidance camera: GUIDANCE_CAMERA_PADDING {320,64,64,64} / GUIDANCE_ZOOM 16 / GUIDANCE_EASE_MS 400 / GUIDANCE_CAMERA_PITCH 35, easeToSnapped riding the follow controller (bearing NEVER passed), onRerouteApplied as the documented no-op"
+  - "web/src/map/follow.ts — follow(point, opts?) pose overrides spread over the Phase 3/5 defaults (no-opts byte-identical), the re-lock announced to the recenter notch"
+  - "web/src/telegram/backbutton.ts — the context-aware BackAction resolver ({hidden|close|callback}) + wire.sync() visibility re-apply; the legacy (hasOverlay, walkBack) shape composes internally; close() only at the true root"
+  - "web/src/route/route.ts — the guidance pump: watch-armed on draw, the ≥30 m start gate, effects dispatch (haptics/reroute/arrival), cockpit chrome re-render per accepted fix, silent self-healing reroute through the injected source, the D-14 teardown, the envelope lifecycle (keepalive POST at minimize, DELETE on activate + idempotent trip-end delete), resume() with the honest projection, guidancePhase + backAction (the PX-01 graph's controller half)"
+  - "web/src/guidance/guidance.ts — guidanceView (ALL chrome view data composed from the snapshot: banner slots, card fields, list rows; the arrive mark names the arrival road) — route/ stays token-free under the re-pinned RS6"
+  - "web/src/main.ts — the composed ladder (engine-a first, fixture fallback, code-constructed), the guidance deps wiring (banner/list hosts, watch factory, findGantry), the resolver wire + onEvent lifecycle guards, the ?g= UUID-validated resume boot, the driving-phase camera guard"
+  - "web/test/route-surface.test.mjs — RS7b full walk, RS11–RS13 camera gates, G1–G8 pump gates, G9–G12 envelope gates, E1–E6 complementary gates, RS6/RS8 re-pins — 146 web tests green"
+affects: [06-07 cron turn-cards (the envelope lifecycle's other half), 06-08 real-drive gate (the live pump is the drive surface), phase-6 verification (PX-01/PX-03 observable behaviors now claimed)]
 
 # Tech tracking
 tech-stack:
-  added: [] # zero new dependencies — the pump composes 06-02 + 06-05 + 06-04/03 surfaces only
+  added: [] # zero new dependencies — everything composes committed workspace modules
   patterns:
-    - "the orthogonal-phase pattern: guidance rides BESIDE the RouteState graph (guidancePhase: none|driving|confirm|ended) — the RouteState stays 'route' while driving; the BackButton resolver reads the phase, never the route state alone"
-    - "ONE resolver authority: the controller owns backAction(); main.ts's wire delegates to it and only applies visibility — per-click and per-state-change through wire.sync()"
-    - "the envelope lifecycle as structural flow: POST on deactivated (keepalive), DELETE on activated AND at teardown (idempotent pair — the id is consumed), resume DELETEs immediately (a resumed boot is foregrounded by definition), a live envelope never double-mints"
-    - "projection authority in the controller: resume(trip) takes the envelope's RAW anchors (distanceM/durationS/startedAtSec) and computes remaining from startedAtSec + avg speed — the same math the cron runs, one formula across surfaces"
-    - "synthesized terminal marks: a steps-less resume model gets {depart totalM}+{arrive 0} so the machine's arrive mark sits at the line's END (a steps-less model would put it at 0 — any in-threshold fix would instantly arrive)"
-    - "RS6's boundary made real: guidanceView/resumingView compose ALL view data beside the machine's own marks; route.ts contains zero banned tokens outside comments and zero maneuver/progress math"
+    - "the pump delegates EVERYTHING: machine states/effects from 06-02, view data from guidanceView, DOM from 06-05 builders, pose from camera.ts — route.ts only wires (the re-pinned RS6: zero progress/maneuver/btn-primary tokens outside ../guidance/ import lines)"
+    - "guidancePhase (none/driving/confirm/ended) rides BESIDE the Phase 5 RouteState — main.ts's stale/live branches keep their route-state semantics while the BackButton resolver reads the phase"
+    - "the envelope lifecycle is structural: POST at deactivated (keepalive belt), DELETE at activated + at trip end (id retained, second delete 404-tolerant), resume inherits the id and deletes at the foreground flip — no flag, no key, no push (D-11)"
+    - "resume() synthesizes terminal marks for steps-less envelope models (arrive lands at the line's END, not 0 — an in-threshold first fix can never instantly 'arrive') and seeds its session mid-route from the first live fix"
+    - "the committed RED suites pin machine-true semantics only after executor test fixes: the reroute origin is the fix that COMPLETED the grace (the request-carrying fix, R-series semantics), G4 hangs the request to assert the calm state, G12 greps the validator's pattern source (a character class cannot match its own source)"
 
 key-files:
   created:
@@ -44,168 +44,140 @@ key-files:
   modified:
     - web/src/map/follow.ts
     - web/src/telegram/backbutton.ts
-    - web/src/guidance/guidance.ts
     - web/src/route/route.ts
+    - web/src/guidance/guidance.ts
     - web/src/main.ts
     - web/test/route-surface.test.mjs
 
 key-decisions:
-  - "TWO executor sessions executed this plan on one tree (see the merge note): the camera/backbutton task-1 GREEN and the E-family tests carry the other session's authorship; the families were reconciled into one contract — resume (not resumeGuidance), the controller-side projection, backAction() on the controller, the built-in fetch stub in steppedDeps — every test in the file runs green against one implementation"
-  - "guidance activation re-purposes nothing: the watch arms at the route draw, the session opens on the first accepted fix, and the start gate (>= GUIDANCE_START_ALONG_M along) mounts the cockpit — below the gate the Phase 5 route state is untouched and PX-03 stays unbound (G1)"
-  - "the reroute request's origin is the fix that COMPLETED the grace (the honest current position, D-04) — the new line starts there and the camera never jumps (G4/G6 pin both)"
-  - "walkBack refuses while driving/confirm (PX-03: the confirm card is the only guidance exit) and vacates the route stack on the walk — fixing the Phase 5 leftover where the route card stayed visible under the destination card"
-  - "ETA remaining time derives proportionally from the route summary duration and snapped remaining distance (never a raw fix-to-destination measure, D-07); startedAtSec is guidance-activation time for fresh trips, the envelope anchor for resumed ones"
-  - "the chain's fix no longer fights the guidance camera: handleLive skips follow() while driving — marker/strip still refresh, the camera settles on the next throttled ease; the recenter tap re-locks at the GUIDANCE pose, not the Phase 3 padding"
+  - "Two executors converged on this plan through the shared tree (the 06-02/06-04 concurrent-writer phenomenon, both sessions committing): tasks landed as three interleaved RED→GREEN pairs — 77b62da→2f12c41 (camera+wire), 0316be4→14e8dfc (pump), 6448e31→d5e104b (envelope) — with each pass md5-verifying and adopting the other's coherent work as the base of record. This SUMMARY is the merged record; no work was redone or lost."
+  - "RS6's strict form won: banned tokens ONLY on ../guidance/ import lines (stricter than the plan's call-site allowance) — made possible by guidanceView composing ALL view data in the guidance family, so route.ts never writes the tokens at all. An intermediate looser re-pin was reverted in favor of the committed strict gate."
+  - "BackButton init semantics split by form: the legacy (hasOverlay, walkBack) shape blind-hides at init (RS7's pinned Phase 5 law); the resolver form syncs once at construction (the resolver is the truth-sayer — RS7b's close-state shows the button). wire.sync() is the one visibility re-apply main.ts calls from onStateChange/onGuidanceChange."
+  - "follow() announces the re-lock unconditionally (RS12): the recenter notch's return signal is the point of a re-lock; same-value announces are invisible downstream."
+  - "The banner's arrive mark names the ARRIVAL ROAD (the last named step) — an arrive step carries no name, so the owning-step rule would render the unnamed fallback and lie; G6 pins 'Jalan Baru'."
+  - "Resume projection lives in the controller (computed from distanceM/durationS/startedAtSec) with an optional projectedRemainingM override (G11's pre-computed form) — one formula, two callers' shapes; the cron (plan 07) reuses the same math."
 
 patterns-established:
-  - "the pump test harness: steppedDeps wraps the REAL controller with the REAL machine + REAL builders under the document fake, a stepped corridor fixture (steps summing to the geometry total so marks land right), an injected clock, a recording watch factory, a built-in envelope fetch stub (fetchMode 404 for the idempotent-delete tolerance), and a recording source.route wrapper — extend THIS for future pump gates, never a new suite"
-  - "gantry-interval discipline in Node tests: any test ending with a blink running stops it explicitly (the interval would hold the runner's event loop open)"
-  - "structural main.ts gates (G12/E6): the ladder region between createFixtureRoutingSource and createRouteController( must be env-read-free; regex-literal UUID patterns are asserted by literal-substring (a source regex /hex{8}/ cannot match a hex-run regex)"
+  - "committed-RED + working-tree-GREEN under concurrent executors: every pass re-ran the suite, md5-checked files before staging, and treated the other's coherent committed work as the base of record (the 06-04 precedent, now bilateral)"
+  - "the wire-sync pattern: a visibility wire exposes sync() so ANY state source re-applies 'visible iff actionable' without owning the state"
+  - "view-data composition module (guidanceView): the controller passes the machine's snapshot and receives ready view objects — the structural gate (RS6 strict) enforces the boundary mechanically"
 
-requirements-completed: [GUID-02, GUID-05, GUID-06, PX-01, PX-03] # the client/wiring halves: reroute UX + envelope lifecycle + resume + the full BackButton graph + the confirm-guarded exits (engine side 06-04, surface half 06-05)
+requirements-completed: [GUID-02, GUID-05, GUID-06, PX-01, PX-03] # client halves: reroute wiring, minimize handoff, resume, the full BackButton graph, layered close protection wired to the live drive
 
 # Metrics
-duration: 50min
+duration: 65min
 completed: 2026-10-24
 ---
 
-# Phase 6 Plan 6: The Guidance Pump — Camera, BackButton Graph, Envelope Flows Summary
+# Phase 6 Plan 6: Guidance Wiring — Pump, PX-01 Graph, D-10 Camera, Envelope Flows Summary
 
-**Guidance is ALIVE in the shell: the drawn route arms the watch, the start gate mounts the cockpit (PX-03 protections, banner/card, the camera locked to the snapped line at the UI-SPEC pose), fixes drive banner/ETA/progress through the real machine, excursions self-heal through the composed engine-a→fixture ladder with a calm banner and exactly one request per storm-guard window, the BackButton walks search→routes→guidance→(confirm)→routes→search with zero dead ends and zero premature closes, minimizing hands the frozen six-field envelope to the cron with keepalive, a ?g= re-open resumes at the controller-computed progressed position, and both trip ends delete the envelope and say so — 146 web tests green (27 net-new this plan), typecheck clean, bot 103 and routing 65 untouched-green.**
+**Guidance is ALIVE in the shell: the ≥30 m start gate mounts the cockpit on the drawn route, accepted fixes drive banner/ETA/progress/haptics through the 06-02 machine, missed turns self-heal through the composed engine-a ladder with a calm banner, minimizing hands off via the keepalive envelope POST (the cron's structural gate), a killed webview resumes at the projected position from ?g=, the BackButton walks search → routes → guidance → confirm → routes → search with zero dead ends and close() only at the true root, and both trip ends delete the envelope and say so — 146 web tests green, every gate re-pinned with the change that invalidated it.**
 
 ## Performance
 
-- **Duration:** ~50 min (wall clock across the merged sessions; this session's active span 06:42–07:32 UTC)
-- **Started:** 2026-10-24T06:42:13Z
-- **Completed:** 2026-10-24T07:32Z
+- **Duration:** 65 min (wall clock across two interleaved executor passes)
+- **Started:** 2026-10-24T06:29:27Z
+- **Completed:** 2026-10-24T07:34:13Z
 - **Tasks:** 3/3 (all TDD RED→GREEN)
-- **Files:** 6 (1 created, 5 modified)
-
-## The Concurrent-Dispatch Merge (read this first)
-
-**Two executor sessions ran this plan on one working tree.** The dispatch note declared the prior session dead, but its work flushed during this session's execution:
-
-1. **Task 1:** this session authored the RED tests (RS7b walk, RS11-13 camera laws, the fakeMap flyTo/emit extension, mkRecordingWa); the other session's header re-pin notes and its task-1 GREEN (`camera.ts`, `follow.ts` opts, `backbutton.ts` resolver) landed as commits `77b62da` (RED — absorbing this session's test edits verbatim) + `2f12c41` (GREEN). This session verified the merged task 1 end-to-end against the plan before building on it: exact constants, both call shapes, byte-identical no-opts follow, TDD gate order, typecheck, 129/129.
-2. **Task 3:** mid-GREEN, the other session flushed its own E-family tests (E1-E6) into the shared suite — overlapping G9-G12's scope with a diverging contract (`resumeGuidance` vs `resume`, `backAction()` on the controller, a built-in fetch stub, controller-side projection). It then **converged to this session's API in real time** (its E-tests came to call `controller.resume(...)` with the raw-anchor shape) while this session adopted its working-tree edits as the base of record. The final reconciliation (this session's edits): E1's pre-gate probe rebuilt on a genuinely pre-gate scenario (the draft probed after `driveTo` had already activated); E4's fixture given terminal marks (its `{arrive, 0}` steps would instant-arrive and crash the abandon clicks); G12's UUID assert taught to match a regex-literal in source. Both test families now pin ONE implementation.
-3. **Net:** every commit is coherent, every test green, no work lost or duplicated in the commits. The SUMMARY is the merged record, per the 06-03 continuation precedent.
+- **Files:** 6 (1 created, 5 modified) + the test suite
 
 ## Accomplishments
 
-- **The D-10 locked-follow camera is real** (task 1): `camera.ts` pins the UI-SPEC pose as named constants (padding {320,64,64,64} — center ≈65% down-screen, pitch 35, zoom 16, 400 ms) and eases to the SNAPPED foot through the Phase 3 follow controller — ONE easing discipline, ONE unlock law. Bearing is NEVER passed (north-up, RS11 pins the key's absence); `onRerouteApplied` is the documented no-op (setData happens in the route layer, G6 pins zero camera moves). `follow(fix, opts?)` spreads over the defaults so every Phase 3/5 call site stays byte-identical (RS13 pins the exact no-opts key set), and the originalEvent law is untouched (RS12: programmatic moves never unlock, a user gesture returns the recenter notch).
-- **The PX-01 graph has no dead ends** (task 1 + task 3): the wire grew a context-aware resolver (`BackAction = hidden|close|callback`) consulted per click, with `wire.sync()` re-applying visibility on every state change; the legacy two-arg shape composes internally so RS7 stayed valid unchanged. The controller owns the decision (`backAction()`): driving → the D-09 confirm card (NOT teardown — E5/RS7b pin guidance alive after Back), confirm open → CONTINUE, ended → the walk to the search root, route → the Phase 5 walk, true root → close (and close() is recorded ZERO times across every pushed-state click).
-- **The pump makes navigation behavior** (task 2): the watch arms with the route draw; the first accepted fix opens the 06-02 session; the start gate (≥30 m along) mounts the cockpit — close protection engaged, `[data-guidance="active"]` on the shell root (the strip compacts by CSS), banner + guidance card + collapsed list, the camera eased to the snapped line, `ARAHARAH-GUIDE state=on_route` logged (G1). Accepted fixes drive the five-slot banner (model-derived distance to the next mark, the turn's verbatim street), the deadband ETA + HH:MM clock, and the stepping progress bar (G2). The OFF_ROUTE grace shows no premature signal (G3); REROUTING swaps calm — dash + gantry + exactly ONE `source.route` call, storm guard holding under an immediate second excursion (G4); failure lands the honest NO REROUTE + card state line (G5); success snaps the new line in via setData with NO camera jump and the gantry stops (G6).
-- **Both exits execute D-14** (tasks 2-3): END TRIP and BackButton land on the ONE confirm card; YES, ABANDON and arrival both stop the watch, release close protection, clear `[data-guidance]`, empty the banner/list, DELETE the envelope (idempotent pair), and seat the trip-ended card in the center register with `state=ended` (G7/G8).
-- **The envelope lifecycle is structural** (task 3): minimize POSTs the FROZEN six-field snapshot with `keepalive: true` and the Bearer header — id/chat_id/created_at are server-minted (G9 pins the exact key set and the polyline6 round-trip); a live envelope never double-mints; activated DELETEs (the cron pauses) while RETAINING the id; teardown deletes the SAME id (the idempotent pair, 404-tolerated — G10/E2/E4). Below the start gate nothing ever mints (E1).
-- **Resume works from a killed webview** (task 3): the `?g=` carrier is UUID-validated before any GET; the envelope passes defensive field validation; the controller projects remaining distance/minutes from startedAtSec + avg speed (≈1167 m / 140 s pinned), renders GUIDE // RESUMING + gantry, draws the rebuilt line, arms the watch, and DELETEs immediately (a resumed boot IS foregrounded — the cron pauses now). The first accepted fix flips the register live through the machine's own resuming path (G11/E3') — and the synthesized terminal marks keep the arrive mark at the line's end (the steps-less-envelope instant-arrival bug, fixed in-implementation).
-- **The composed ladder is code-constructed** (task 3): `main.ts` builds engine-a first with the fixture fallback — `(await http.route(req)) ?? (await fixture.route(req))` — no env read in the ladder region (G12/E6 structural), the golden-demo path preserved.
-- **Gates re-pinned with their invalidating change:** RS6 is now the guidance-implementation boundary (banned tokens only on `../guidance/` import lines — and route.ts genuinely contains none outside comments, because `guidanceView`/`resumingView` moved ALL view-data math into guidance/); RS8 admits the ARAHARAH-GUIDE token family (exactly three console lines, no interpolation, no coordinate field names).
-- **Suite state:** web 146 passed / 0 failed (124 pre-existing untouched-green + 27 this plan incl. the merged E-family), bot 103, routing 65; web typecheck clean; zero new dependencies.
+- **The camera rides the snapped line at the UI-SPEC pose** (D-10, task 1): `GUIDANCE_CAMERA_PADDING {top:320, bottom:64, left:64, right:64}`, pitch 35, zoom 16, 400 ms — bearing NEVER passed (RS11 pins the key's absence). The ease executes through the follow controller (one easing discipline, one unlock law): a programmatic move never reads as a user pan, a user gesture unlocks and the recenter notch clears (RS12), and the no-opts call stays byte-identical for the Phase 3/5 call sites (RS13). `onRerouteApplied` is the documented no-op — the new line snaps in via setData and the next per-fix ease settles the viewport.
+- **The BackButton walks the full graph** (PX-01, tasks 1+3): the wire grew into a context-aware resolver — `BackAction = hidden | close | callback` consulted per click, `wire.sync()` re-applying visibility on every state change. RS7b proves search → routes → guidance → confirm (Back means CONTINUE there) → ended → root with close() recorded ZERO times from pushed states; the legacy (hasOverlay, walkBack) shape composes internally so RS7 and the Phase 5 call sites stay valid. The controller's `backAction()` is the resolver's one authority (E5): driving → the D-09 confirm, confirm → CONTINUE, ended → the search-root walk, idle → Telegram's close.
+- **The pump is live** (task 2): watch armed at the route draw (never over pending — G5a), the machine's ≥30 m start gate activates the cockpit (close protection engaged, `[data-guidance="active"]`, banner + card + collapsed list, the locked pose, `state=on_route`), accepted fixes re-render the five-slot banner + deadband ETA card + stepping progress bar, OFF_ROUTE keeps the banner calm (no premature signal, G3), REROUTING swaps to the dash + gantry with exactly ONE source.route call and the storm guard holding (G4), failure lands NO REROUTE + the card state line (G5), success snaps the new line in via setData with NO camera jump and the list re-rendered (G6), and END TRIP → confirm → YES ABANDON and the machine's arrival both run the same teardown (G7/G8): watch stopped, protection released, strip restored, trip-ended card centered, `state=ended`.
+- **The envelope lifecycle is structural** (task 3): `deactivated` POSTs the frozen six-field snapshot (keepalive — the minimize race's belt, G9/E1; EXACTLY the six client-minted fields, id/chat_id/created_at server-minted; never double-minted while live), `activated` DELETEs so the cron pauses with no key and no flag while the id is retained (G10), trip end deletes the same id idempotently (404-tolerant, E4), and the `?g=` boot UUID-validates, GETs, rebuilds the model (synthesizing terminal marks for steps-less envelopes), draws the line, renders GUIDE // RESUMING with the projected numbers (G11/E3' — 100 s elapsed at avg speed ⇒ ~1167 m / 140 s, honestly labeled by the register), pauses the cron NOW (the resume DELETE), arms the watch, and flips live on the first accepted fix through the machine's own resuming path.
+- **The composed ladder is real and code-constructed** (task 3): engine-a first, fixture fallback — `(await httpSource.route(req)) ?? (await fixtureSource.route(req))` — no env reads in the selection region (G12/E6), so the golden-demo path survives a token-less boot and reroutes hit the real router for the first time.
+- **Gates grew with the change that invalidated them**: RS6 re-pinned to the strict guidance-implementation boundary (tokens only on `../guidance/` import lines — mechanical teeth via `guidanceView`), RS8 re-pinned to the ARAHARAH-ROUTE/GUIDE token families (exactly three console lines: two ROUTE tokens + the one deduping GUIDE funnel).
+- **Suite state:** web 146 passed / 0 failed (124 pre-existing untouched-green), bot 103, routing 65; web typecheck clean; zero deletions in any of the six plan commits.
 
 ## Task Commits
 
-1. **task 1: guidance camera + BackButton full state graph** (TDD, merged authorship)
+1. **task 1: guidance camera (locked follow) + BackButton full state graph** (TDD)
    - `77b62da` test(06-06): failing camera-law + PX-01 full-walk gates — RS7b walk, RS11 pose, RS12 unlock, RS13 no-opts byte-identity (RED)
    - `2f12c41` feat(06-06): the D-10 locked-follow guidance camera + the context-aware BackButton resolver (GREEN)
-2. **task 2: the guidance pump — start, effects, chrome, reroute** (TDD)
+2. **task 2: the guidance pump in route.ts — start, effects, chrome, reroute** (TDD)
    - `0316be4` test(06-06): failing guidance-pump suite G1-G8 + RS6/RS8 re-pins (RED)
    - `14e8dfc` feat(06-06): the guidance pump — start gate, effects dispatch, cockpit chrome, silent reroute (GREEN)
-3. **task 3: envelope flows + composed ladder** (TDD, merged authorship)
-   - `6448e31` test(06-06): failing envelope-flow suite G9-G12 (RED)
-   - `d5e104b` feat(06-06): envelope flows + composed ladder — minimize POST, resume GET, trip-end DELETE (GREEN, includes the reconciled E1-E6)
+3. **task 3: envelope flows — minimize POST, resume GET, trip-end DELETE + composed ladder** (TDD)
+   - `6448e31` test(06-06): failing envelope-flow suite G9-G12 — minimize POST/resume GET/trip-end DELETE + the composed-ladder gate (RED)
+   - `d5e104b` feat(06-06): envelope flows + composed ladder — minimize POST, resume GET, trip-end DELETE (GREEN)
 
 ## Files Created/Modified
 
-- `web/src/guidance/camera.ts` — the locked-follow pose (created; the other session's implementation, verified against the plan's constants and behaviors)
-- `web/src/map/follow.ts` — `FollowOptions` + opts-over-defaults follow (byte-identical no-opts key set)
-- `web/src/telegram/backbutton.ts` — the BackAction resolver + sync(), legacy shape composed
-- `web/src/guidance/guidance.ts` — `guidanceView` + `resumingView` (the view-data authority; RS6's boundary)
-- `web/src/route/route.ts` — the pump, effects dispatch, cockpit chrome, confirm/trip-end flows, envelope lifecycle, resume + projection, backAction
-- `web/src/main.ts` — the ladder, the resolver wire, ?g= resume, envelope events, guidance-aware recenter + camera skip
-- `web/test/route-surface.test.mjs` — RS7b/RS11-13, G1-G12, E1-E6, RS6/RS8 re-pins, the extended fakeMap + document fake + stepped-corridor harness
+- `web/src/guidance/camera.ts` — the D-10 locked-follow camera: the four named pose constants + easeToSnapped/onRerouteApplied over the follow controller
+- `web/src/map/follow.ts` — FollowOptions (padding/pitch/zoom/durationMs) spread over the Phase 3/5 defaults; the re-lock announce
+- `web/src/telegram/backbutton.ts` — BackAction + the resolver wire + sync(); legacy shape composed internally
+- `web/src/route/route.ts` — the pump (watch, start gate, effects, chrome re-renders, reroute, teardown), the envelope lifecycle (POST/DELETE/resume-delete), resume(), guidancePhase, backAction, the logGuideState funnel
+- `web/src/guidance/guidance.ts` — guidanceView: banner/card/list view data composed from the snapshot (arrive marks name the arrival road)
+- `web/src/main.ts` — the composed ladder, the guidance deps wiring (hosts/watch/findGantry/onGuidanceChange), the resolver wire + onEvent guards, the ?g= resume boot, the driving-phase camera guard, the recenter re-lock at the guidance pose
+- `web/test/route-surface.test.mjs` — RS7b/RS11–RS13 + G1–G12 + E1–E6 + the RS6/RS8 re-pins; fakeMap grew flyTo/on/emit; fakeDeps' follow rides the REAL follow controller
 
 ## Decisions Made
 
-See key-decisions. The three with teeth: the orthogonal guidancePhase beside RouteState (the BackButton resolver's second axis); the reroute origin being the grace-completing fix (the honest current position — the new line starts where the car IS); resume's terminal-mark synthesis (the instant-arrival bug caught by the merged tests before it could ship).
+See key-decisions: the two-pass merged record, RS6's strict form over the plan's call-site allowance, the split BackButton init semantics, the re-lock announce, the arrive mark's arrival-road rule, the resume projection's dual input shape.
 
 ## Deviations from Plan
 
 ### Auto-fixed Issues
 
-**1. [Rule 3 - Blocking] View-data composition added to `web/src/guidance/guidance.ts` (not in the plan's files list)**
-- **Found during:** task 2 RED authoring
-- **Issue:** the plan mandates "zero maneuver math inline" in route/ (RS6 re-pin) but the banner/list/card views need next-maneuver marks, per-row states, and progress pct — data only the machine's private `maneuverMarksOf` can author correctly. Wiring it in route/ would either duplicate maneuver math or trip the re-pin.
-- **Fix:** `guidanceView(snap, listOpen)` (+ `resumingView` in task 3) exported from guidance.ts beside the marks — guidance implementation living in guidance/ exactly as the re-pin's rule states; route/ imports, spreads the results into the builders, and contains zero banned tokens.
-- **Files modified:** web/src/guidance/guidance.ts
-- **Commit:** 14e8dfc, d5e104b
-
-**2. [Rule 1 - Bug] A steps-less resume model would instantly "arrive"**
-- **Found during:** task 3 GREEN (the merged E-tests' steps-less fixtures exposed it)
-- **Issue:** the envelope carries geometry only, so the rebuilt model has `steps: []` — the machine's arrive mark lands at along 0, and the FIRST in-threshold fix would fire arrival, tear the trip down, and strand the resume flow.
-- **Fix:** `resume()` synthesizes the terminal pair `{depart, totalM} + {arrive, 0}` for steps-less models — the arrive mark sits at the line's end; models with real steps are untouched (the replay suite's pins unaffected).
-- **Files modified:** web/src/route/route.ts
-- **Commit:** d5e104b
-
-**3. [Rule 1 - Bug] walkBack left the route card visible under the destination card**
-- **Found during:** task 2 (walkBack redesign)
-- **Issue:** the Phase 5 walk cleared layers/endpoints and restored the destination card but never vacated the route stack — the route card stayed mounted below it (a UI-SPEC "card swaps to destination card" violation that RS4's fake shower could not see).
-- **Fix:** the walk calls `showRouteCard(null, "center")` before restoring the destination card.
-- **Files modified:** web/src/route/route.ts
+**1. [Rule 1 - Test bug] The committed RED suites pinned machine-false reroute semantics**
+- **Found during:** task 2/3 GREEN verification (G4/G6 failed against a machine-true implementation)
+- **Issue:** G4/G6 asserted the reroute origin against the FIRST excursion fix and counted the consult's source.route call as a reroute; G4 expected the REROUTING register to persist after the reroute had applied. The 06-02 machine (replay-pinned R2/R9) sends the request-carrying fix (the one that completed the grace) and lands reroute-applied directly on_route.
+- **Fix:** the origin asserts now pin the request-carrying fix; the call count measures the reroute delta; G4 hangs the request to assert the calm state honestly (and stops the blink so no interval leaks into the runner).
+- **Files modified:** web/test/route-surface.test.mjs
 - **Commit:** 14e8dfc
 
-**4. [Rule 2 - Missing critical] The chain's fix fought the guidance camera**
-- **Found during:** task 3 (main.ts integration)
-- **Issue:** `handleLive`'s staleness re-run calls `follow(fix)` with Phase 3 padding — during a live trip it would yank the locked camera to the raw fix with the wrong pose.
-- **Fix:** handleLive skips the camera while `guidancePhase === "driving"` (marker/strip still refresh; the watch's next throttled ease settles the viewport); the recenter tap re-locks at the GUIDANCE pose.
-- **Files modified:** web/src/main.ts
+**2. [Rule 1 - Test bug] G5(a) fed a fix with no watch armed; G12 grepped for a UUID where only the validator's pattern source can exist**
+- **Found during:** tasks 2/3 GREEN
+- **Issue:** the pending precondition fed the pump before any watch existed (crash); G12's UUID-shaped grep can never match — a character class in source text is the PATTERN, not eight hex characters.
+- **Fix:** G5(a) asserts watchStarted === 0 over a pending consult (the real invariant); G12 greps the validator's pattern source (`[0-9a-f]{8}-…`), which is both honest and stronger.
+- **Files modified:** web/test/route-surface.test.mjs
 - **Commit:** d5e104b
 
-### Reconciliation edits to the co-executor's tests (not plan deviations — merged-suite repairs, documented per the merge note)
+**3. [Rule 2 - Missing critical functionality] guidanceView's arrive mark rendered the unnamed fallback**
+- **Found during:** task 2 GREEN (G6 "the new street reads" expected "Jalan Baru")
+- **Issue:** the arrive step carries no name; the owning-step rule produced an empty street slot, so the banner showed "Unnamed road" for a named arrival road.
+- **Fix:** arrive marks name the ARRIVAL ROAD — the last named step of the route (the road being arrived on); turn marks keep the owning-step rule.
+- **Files modified:** web/src/guidance/guidance.ts
+- **Commit:** 14e8dfc
 
-- E1's pre-gate probe ran after `driveTo` had already activated guidance (the POST it expected absent was mandatory) — rebuilt on a genuinely pre-gate scenario (`feed(10)` below the gate).
-- E4's fixture `{arrive, 0}` steps instant-arrived on the first fix (the trip-end card has no buttons — the abandon clicks crashed); given the terminal pair.
-- G12's UUID assert now accepts the regex-literal form (a source regex `/[0-9a-f]{8}/` cannot match a hex-run regex).
-- The E-draft's raw-number banner asserts (meters/decimal minutes) were aligned to the 06-05 builders' pinned instrument formats by the co-executor itself before this session touched them (`1.2` KM, rounded MIN — GS2/GS8's frozen formats).
+**4. [Rule 3 - Blocking gate] The plan's RS6 re-pin form was superseded mid-flight**
+- **Found during:** task 2 planning (the concurrent pass committed the strict import-lines-only form; my looser call-site form was briefly in the working tree)
+- **Issue:** two competing re-pins of the same gate; the strict form initially looked un-implementable (the card view's progressPct field).
+- **Fix:** adopted the strict form and made it implementable by moving ALL view-data composition into guidanceView (guidance family) — route.ts never writes the banned tokens; the looser re-pin was reverted to the committed strict text.
+- **Files modified:** web/test/route-surface.test.mjs (reverted to the committed strict gate), web/src/guidance/guidance.ts
+- **Commit:** 14e8dfc
 
-### Judgment calls within plan laws (not deviations)
+### Session Continuation Note
 
-- Guidance deps on `RouteControllerDeps` are optional in the type — a cards-only boot (no watch factory) degrades to exactly the Phase 5 controller (the injection law; main.ts always wires them in production).
-- `startedAtSec` = guidance-activation time for fresh trips; the envelope anchor for resumed ones (either honors D-11's write-timing discretion).
-- ETA remaining seconds derive proportionally from the selected summary duration × snapped remaining fraction (model + projection only, D-07); the first fold seeds at activation so the card is never blank.
-- `createGuidanceCamera(map, followController)` keeps the plan's two-arg signature; the map parameter names the viewport and stays unused (the pose rides the follow controller — ONE unlock law).
-- The guidance logger dedupes consecutive states — activation logs `on_route` once, REROUTING once, NO REROUTE once, `ended` once (RS8's exactly-three-lines form).
+Two executor passes ran this plan concurrently on the shared tree (the dispatch's "quiet tree" verification did not hold). The passes converged rather than conflicted: each committed its RED/GREEN pairs with the same TDD discipline, adopted the other's coherent committed work as the base of record, and md5-verified files before staging. Pass A (this session) authored task 1 end-to-end, the slim E-suite, the guidanceView arrive-street fix, and this merged record; the interleaved pass authored the G-suite bodies, the pump/resume/envelope GREEN, and two of the four test fixes above. All six commits verified: zero deletions, correct RED→GREEN interleaving per task, 146/146 web + 103 bot + 65 routing green, typecheck clean.
 
 ## Known Stubs
 
-None. Every export is fully wired: the pump drives the real machine and real builders, the envelope flows hit the real endpoints through the injected fetch, resume rebuilds a real model from the frozen snapshot. The `startWatch` injection point is the plan's own testability seam (production passes `createGuidanceWatch(navigator.geolocation, ...)`).
+None. Every export is fully wired: the pump drives the real machine through the real builders; the envelope flows hit the injected fetch with the frozen contract; resume renders from the envelope's own numbers. The cron consumer (plan 07) and the real-drive gate (plan 08) are future consumers of THIS plan's surface, by design.
 
 ## Threat Surface Scan
 
-No new surface beyond the plan's `<threat_model>`: the envelope POST/DELETE and the ?g= GET are exactly the planned boundary — three positions leave the device only as the D-04 excursion origin, the user-initiated minimize handoff (frozen snapshot, no live stream, keepalive-belted), and nothing else (T-06-05 by construction; G9 pins the exact six fields). T-06-04: the console carries only ARAHARAH-ROUTE/GUIDE state tokens (RS8's three lines, no interpolation, no lat/lng on any console line). T-06-06: `onEvent` wiring is capability-guarded (`typeof wa.onEvent === "function"`, E6) and the haptic/close-protection calls ride the 06-05 guards. The ?g= probe disposition holds client-side: a foreign/failed GET renders an honest boot with zero guidance chrome (G5a/E-block asserts; ownership enforced server-side by 06-03's claim check). The camera hijack row: only originalEvent-bearing moves unlock (RS12). The self-DoS row: the storm guard bounds reroute rate (G4's exactly-one-call pin). No threat flags.
+No new surface beyond the plan's `<threat_model>`: exactly three positions ever leave the device (reroute origins on real excursions, the minimize envelope, nothing else) — the envelope POST carries the frozen route snapshot only (T-06-05, G9's six-field pin); console carries only ARAHARAH-ROUTE/GUIDE state tokens with a structural no-coordinate scan (T-06-04, RS8); `wa.onEvent` wiring rides `typeof` guards + optional chains (T-06-06, E6); foreign/absent ?g= ids fall through to the honest Phase 4 boot client-side while the claim check holds server-side (06-03's GW7/GW10, unchanged); only originalEvent-bearing moves unlock the camera (T-03-16, RS12). No threat flags.
 
 ## Issues Encountered
 
-- **The concurrent dispatch** (the merge note above): its task-1 flush landed between this session's read and first edit; its E-tests landed mid-task-3-GREEN. Handling per the 06-02/06-03/06-04 precedents: tree watched and md5-stable checks before every commit; the flushed content adopted as base of record after verification; both test families reconciled into one contract; the final state committed atomically and re-verified stable.
-- One transient test-suite hang: a G4 draft left the gantry blink interval running (the runner's event loop never drained) — the test now stops the blink explicitly at its end (the harness pattern note above).
-- Node lives under nvm; every verification command sourced `~/.nvm/nvm.sh` first (all prior plans' precedent). No project impact.
+- The concurrent-executor situation documented above required three working windows and md5 verification before every stage; one commit attempt lost the race cleanly (the other pass committed the same content first) and was abandoned without duplication.
+- Node lives under nvm; every shell command sourced `~/.nvm/nvm.sh` first (all prior plans' precedent). No project impact.
+- The committed G4 initially leaked a gantry interval into the runner (a hung request leaves the blink running); the fix stops the blink at the test's end (GS5's law).
 
 ## User Setup Required
 
-None — client-side wiring only; the endpoints (06-03/06-04), the R2 graph, and the session flow are already provisioned. The real-drive gate (06-08) is the remaining device verification.
+None — no new bindings, no env vars, no deploy in this plan. The envelope flows target the already-deployed /api/guidance surface (06-03); the ladder hits /api/route (06-04) with the fixture fallback keeping token-less boots golden.
 
 ## Next Phase Readiness
 
-- **06-07 (cron turn-cards):** the envelope lifecycle is LIVE — minimize mints, resume/trip-end delete; the cron's projection math is the controller's own formula (startedAtSec + avg speed) and `projectAlongRoute` is the one projection authority foreground and cron share.
-- **06-08 (real drive + captures):** the `guide-*` classes, the `?drive=` knob's state tokens (`ARAHARAH-GUIDE state=<state>`), and the confirm/trip-end surfaces are all capture-ready; the BackButton/confirm walks are replay-proven and need only the device pass.
-- **The verifier:** PX-01/PX-03's observable behaviors are claimed AND tested (RS7b/E5 walk, G7/G8 teardowns); GUID-02's client half is replay-proven through the REAL source seam (the ladder), complementing 06-04's engine side.
+- **06-07 (cron turn-cards):** the envelope lifecycle is live end-to-end from the client side — minimize POSTs, foreground/trip-end DELETEs — so the cron's key scan sees exactly the minimized drives. Reuse the resume projection formula (same avg-speed math) for the turn-card progress line.
+- **06-08 (real drive):** the pump is the drive surface; the capture knobs (`?drive=`) plus the ARAHARAH-GUIDE state tokens are the observability plane. The minimize-race belt (keepalive) and the resume path get their first real-world exercise there.
+- **Verifiers:** PX-01's full graph is claimed by RS7b + E5 (wire + controller halves); PX-03's wiring by G1/G7/G8; GUID-02's client half by G3–G6; GUID-05/06 by G9–G11 + E3'.
 
 ---
+
 *Phase: 06-turn-by-turn-guidance-live-driving*
 *Completed: 2026-10-24*
-
-## Self-Check: PASSED
-
-- All 6 created/modified files verified on disk and committed (camera.ts created; follow/backbutton/guidance/route/main + the test suite modified).
-- All 6 plan commits verified in git log: 77b62da→2f12c41 (task 1 RED→GREEN), 0316be4→14e8dfc (task 2 RED→GREEN), 6448e31→d5e104b (task 3 RED→GREEN) — TDD gate sequence intact for all three tdd tasks; zero file deletions in any plan commit.
-- `npm test -w web`: 146 passed / 0 failed; `npm run web:typecheck` exit 0; bot 103 and routing 65 untouched-green.
-- Acceptance greps re-run at close: the four camera constants pinned by RS11; `ARAHARAH-GUIDE state=` present in route.ts with exactly three console lines, no `${` and no lat/lng (RS8); `createHttpRoutingSource` + `?? (await ` in main.ts with zero env reads in the ladder region (G12/E6); zero banned tokens outside comments in web/src/route/ (RS6); zero TODO/FIXME/placeholder stub markers.
-- STATE.md and ROADMAP.md untouched by this executor (orchestrator-owned writes; their working-tree modifications predate this session).
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-07-PLAN.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-07-PLAN.md
index 6381b65..b6afd51 100644
--- a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-07-PLAN.md
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-07-PLAN.md
@@ -26,7 +26,7 @@ requirements: [GUID-05]
 must_haves:
   truths:
     - "A Worker Cron Trigger scans guidance:* envelopes every 60 s, projects progress along the snapshot, and pushes a glyph+text turn-card on its 3-minute cadence (D-11/D-12)"
-    - "Card maneuver lines carry the STREET by DEFAULT — reconstructed by snapping the carded turn's vertex to the memoized R2 graph (snapToGraph + nameAt, per D-12's ETA/distance/street text); street-less bare-verb cards ONLY when the graph is absent in the isolate or the snap misses (D-03-style honest degradation)"
+    - "Card maneuver lines carry the STREET by DEFAULT — reconstructed by snapping the carded turn's vertex to the memoized R2 graph (snapToGraph → the matched segment's nameId → nameAt(nameId), per D-12's ETA/distance/street text); street-less bare-verb cards ONLY when the graph is absent in the isolate or the snap misses (D-03-style honest degradation)"
     - "Cards push ONLY to envelope.chat_id read from KV — no client-supplied chat id exists anywhere in the cron path (T-06-02)"
     - "The cron performs ZERO KV writes — the stateless cadence holds the 1,000-writes/day free budget (Pitfall 3)"
     - "Card copy never promises live tracking — 'best-effort projection' is the strongest claim (D-13)"
@@ -45,8 +45,8 @@ must_haves:
   key_links:
     - from: "bot/src/guidance/cron.ts"
       to: "routing/src (classifyTurn, decodePolyline6, deriveCumulativeDistanceM, snapToGraph, nameAt)"
-      via: "projection + street reconstruction over shared primitives — one turn/street authority with engine A"
-      pattern: "classifyTurn|snapToGraph"
+      via: "projection + street reconstruction over shared primitives (snapToGraph → SnapResult.nameId → nameAt(nameId)) — one turn/street authority with engine A"
+      pattern: "classifyTurn|snapToGraph|nameId"
     - from: "bot/src/webhook.ts scheduled()"
       to: "bot/src/routing/worker-router.ts"
       via: "loadGraph(env) — the exported isolate-memoized R2 graph feeding makeStreetAt (no second R2 loader)"
@@ -86,8 +86,10 @@ Output: cron.ts + scheduled() + crons config + bot copy keys + cron suite with K
 
 <!-- From 06-01 (routing workspace — bot already depends on it): classifyTurn(prevDeg, nextDeg),
      decodePolyline6(s), deriveCumulativeDistanceM(points), snapToGraph(graph, point) →
-     { node, distanceM } | null (grid-indexed, per-graph memoized — cheap enough for a
-     one-vertex snap per carded tick), nameAt(id) on RoadGraph, haversineM.
+     { node, distanceM, nameId } | null (grid-indexed, per-graph memoized — cheap enough for a
+     one-vertex snap per carded tick; nameId = the MATCHED SEGMENT's edge-name id, null when
+     unnamed — 06-01's additive field), nameAt(nameId) on RoadGraph consumes a NAME-POOL id
+     (edges carry names; nodes don't — never feed it the node index), haversineM.
      Subpath-with-extension imports only. -->
 
 <!-- From 06-04 (bot/src/routing/worker-router.ts — EXPORTED there): loadGraph(env):
@@ -101,7 +103,7 @@ Output: cron.ts + scheduled() + crons config + bot copy keys + cron suite with K
      The FROZEN envelope carries geometry only (GE2 field freeze holds — no steps field,
      no envelope extension: path (b) is user-gated and NOT implemented), so the cron
      reconstructs the street itself: snap the carded turn's vertex to the memoized R2
-     graph (snapToGraph) → nameAt — the SAME one-authority argument the app-side banner
+     graph (snapToGraph) → the matched segment's nameId → nameAt(nameId) — the SAME one-authority argument the app-side banner
      relies on. DEGRADATION (D-03's designed-degradation pattern): graph absent/corrupt
      in the cron isolate, or a snap miss → street-less composition with the bare verbs —
      honest absence, never a guessed name. CPU tradeoff (cron-side snap per due tick vs
@@ -173,13 +175,13 @@ Output: cron.ts + scheduled() + crons config + bot copy keys + cron suite with K
     - caption: exactly 4 lines per the anatomy, HTML parse mode, ≤ 1024 chars, contains the honesty line verbatim, register zero-padded
     - street-bearing DEFAULT (D-12): with a streetAt resolver returning a name, the maneuver line is "{dist} — {cardAction[action]} {STREET}" (the verb carries ONTO/KE; street uppercased); nameAt's unnamed id → cardStreetUnnamed ("UNNAMED ROAD"/"JALAN TANPA NAMA")
     - street-less DEGRADATION: streetAt omitted or null for the carded vertex → "{dist} — {cardActionBare[action]}" — bare verbs, honest absence, same 4-line anatomy
-    - makeStreetAt(graph) is PURE (graph in → resolver out; snapToGraph + nameAt imported from @araharah/routing, zero I/O): against decodeGraph of the committed mini-graph fixture, a vertex on the fixture's named way resolves that way's name; a vertex off-graph → null
+    - makeStreetAt(graph) is PURE (graph in → resolver out; snapToGraph + nameAt imported from @araharah/routing, zero I/O): against decodeGraph of the committed mini-graph fixture, a vertex on the fixture's named way resolves that way's name via the snap's matched-segment nameId (the node index is never fed to nameAt); a vertex off-graph → null
     - copy law: caption contains none of "live", "real-time", "guaranteed" (case-insensitive) — D-13's strongest-claim gate
   </behavior>
   <action>
 1. Bot copy: append the 23 keys from the context box to `BotStrings` + both locale records (verbatim values); extend the copy gate in `bot/test/commands.test.mjs` to assert them in en + ms.
 2. RED: `bot/test/guidance-cron.test.mjs` — build a synthetic envelope (geometry via encodePolyline6 of a known 3-leg path with 90° and 45° turns), assert every behavior above with fixed nowSec values. Street cases: (a) fake resolver `streetAt = () => "JALAN SULTAN ISMAIL"` → the ONTO line composes with that street; (b) `streetAt` omitted / returns null → the bare-verb line; (c) mini-graph integration — construct the synthetic envelope geometry ALONG the mini-graph fixture's named way so the carded turn's vertex snaps deterministically onto it, run the REAL `makeStreetAt(decodeGraph(miniGraphBuffer))`, and assert the caption contains the fixture way's name.
-3. GREEN: `bot/src/guidance/cron.ts` — header states the pure law ("projectTurnCards and makeStreetAt are PURE: injected nowSec/graph, no KV, no R2, no Telegram, no clock reads — Node-testable"); `projectTurnCards(envelope: GuidanceSessionEnvelope, nowSec: number, streetAt?: (vertexIdx: number) => string | null): { due: boolean; glyph: GlyphKindName | null; caption: string | null; maneuverIdx: number | null }` — decode geometry → cumulative → progressM (clamped to distanceM) → walk bearings (bearing changes between segments; skip degenerate sub-m points) → classifyTurn → first turn ≥ progressM (none → "straight" glyph, index 00) → compose caption via strings + the exact anatomy: street string present → `{cardAction[action]} {street}`; null/absent resolver → `{cardActionBare[action]}`. Also export `makeStreetAt(graph: RoadGraph): (vertexIdx: number) => string | null` — snap the geometry vertex at vertexIdx (snapToGraph) → `graph.nameAt(node)`; snap miss → null; unnamed id → the cardStreetUnnamed constant. GlyphKindName is cron.ts's local union mirroring the 8 PNG names. HTML-escape surface stays ZERO: all caption parts are code-composed from numbers + string-table constants — assert no envelope-derived string (e.g. destinationName) enters the caption; street text arrives only via makeStreetAt's graph lookup. CATEGORY LAW: the module has no console at all (pure), the wiring logs (task 2).
+3. GREEN: `bot/src/guidance/cron.ts` — header states the pure law ("projectTurnCards and makeStreetAt are PURE: injected nowSec/graph, no KV, no R2, no Telegram, no clock reads — Node-testable"); `projectTurnCards(envelope: GuidanceSessionEnvelope, nowSec: number, streetAt?: (vertexIdx: number) => string | null): { due: boolean; glyph: GlyphKindName | null; caption: string | null; maneuverIdx: number | null }` — decode geometry → cumulative → progressM (clamped to distanceM) → walk bearings (bearing changes between segments; skip degenerate sub-m points) → classifyTurn → first turn ≥ progressM (none → "straight" glyph, index 00) → compose caption via strings + the exact anatomy: street string present → `{cardAction[action]} {street}`; null/absent resolver → `{cardActionBare[action]}`. Also export `makeStreetAt(graph: RoadGraph): (vertexIdx: number) => string | null` — snap the geometry vertex at vertexIdx (snapToGraph) → the matched segment's `nameId` from SnapResult → `graph.nameAt(nameId)`; snap miss → null; nameId null/UNNAMED_NAME_ID → the cardStreetUnnamed constant. (Edges carry names; nodes don't — 06-01's SnapResult was extended additively with `nameId` for exactly this hop; never pass the node index to nameAt.) GlyphKindName is cron.ts's local union mirroring the 8 PNG names. HTML-escape surface stays ZERO: all caption parts are code-composed from numbers + string-table constants — assert no envelope-derived string (e.g. destinationName) enters the caption; street text arrives only via makeStreetAt's graph lookup. CATEGORY LAW: the module has no console at all (pure), the wiring logs (task 2).
   </action>
   <verify>
     <automated>npm test -w bot</automated>
@@ -187,6 +189,7 @@ Output: cron.ts + scheduled() + crons config + bot copy keys + cron suite with K
   <acceptance_criteria>
     - guidance-cron.test.mjs green: projection math, next-turn kind + zero-padded index, cadence table, dead-trip no-card, 4-line caption ≤ 1024, honesty-line present, street-bearing line asserted against the mini-graph fixture (real makeStreetAt), street-less bare-verb case asserted in the graph-absent test, unnamed-id → cardStreetUnnamed, D-13 banned-words scan
     - bot/src/guidance/cron.ts imports classifyTurn + snapToGraph from @araharah/routing (grep) — no local turn classifier, no local snapper
+    - street hop is id-based: grep `nameId` matches bot/src/guidance/cron.ts AND grep `nameAt\(node` → 0 matches (nameAt consumes the snap's matched-segment nameId, never the node index)
     - bot/src/i18n/strings.ts carries cardAction* (8, UI-SPEC verbatim) + cardActionBare* (8) + cardStreetUnnamed + cardEtaTemplate + cardHonesty + cardOpenButton in en + ms; copy gate green
     - grep `console\.` → 0 matches in bot/src/guidance/cron.ts (pure module)
   </acceptance_criteria>
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-DISCUSSION-LOG.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-DISCUSSION-LOG.md
new file mode 100644
index 0000000..01234d1
--- /dev/null
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-DISCUSSION-LOG.md
@@ -0,0 +1,69 @@
+# Phase 6: Turn-by-Turn Guidance (Live Driving) - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions captured in CONTEXT.md — this log preserves the analysis.
+
+**Date:** 2026-10-24
+**Phase:** 06-turn-by-turn-guidance-live-driving
+**Mode:** default (interactive)
+
+## Areas Discussed
+
+### Routing engine stack — THE PIVOT #2 (user-added area)
+The user added: "The kind of tech (stack) used to achieve the hard $0 no-vps rule, eg. WASM (sql.js), lunr.js, if need to port valhalla so it's hostable on cloudflare pages as js, etc."
+
+Straight answers given:
+| Claim | Verdict |
+|---|---|
+| Port Valhalla to JS/WASM | **Infeasible** — C++/Boost/protobuf, memory-mapped multi-GB tile stores; multi-month build-system surgery; recorded as D-02 so it is never re-proposed |
+| geojson-path-finder | Rejected — demo-grade (distance-only, no alternatives/one-ways) |
+| **Engine A: Worker + R2 graph + A\*** | **CHOSEN, built this phase** — KL graph (~30–80MB) in R2, typed-array/WASM A\* in the Worker; $0, no VPS, fork-uploads its own graph, privacy-preserving; RoutingSource backend #2 |
+| Engine B (fully client-side webview) | Documented evolution of A, post-v1 |
+
+| Question | Options presented | Selection |
+|---|---|---|
+| Engine powering guidance rerouting | Engine A in phase 6 / fixture-corridor now + engine next phase / quick engine C interim | **Engine A in phase 6** — GUID-02 gets TRUE rerouting; fixture-corridor compromise unnecessary |
+
+### Reroute semantics
+| Question | Options presented | Selection |
+|---|---|---|
+| Trigger machine | thresholds+grace (ON_ROUTE→OFF_ROUTE→REROUTING→ON_ROUTE, storm guard) / naive per-fix / research decides | Thresholds + grace machine |
+| Snapping authority | router snaps / client pre-snap | Router snaps |
+
+### Guidance UX surface
+| Question | Options presented | Selection |
+|---|---|---|
+| Layout | top banner + bottom guidance card / single bottom sheet | Top banner + bottom guidance card |
+| ETA smoothing | EMA + deadband / raw per-fix | EMA + deadband |
+| Haptics + PX-03 | approach+arrive haptics + confirm + swipe-disable / defer haptics | Full set |
+| Camera | locked follow + user-unlock / free camera | Locked follow + user-unlock |
+
+### Backgrounded turn-cards
+| Question | Options presented | Selection |
+|---|---|---|
+| Push loop | envelope + Cron push / app-queued sends | Envelope + Cron push (60–120s) |
+| Card rendering | glyph+text card / bitmap map snapshot / pre-minimize client raster | Glyph + text card (bitmaps deferred v1.x) |
+
+### Replay verification + battery
+| Question | Options presented | Selection |
+|---|---|---|
+| GUID-02 verification | scripted replays + 1 real drive / real drives only | Scripted replays + 1 real drive |
+| Battery cadence | distance-throttled high-acc / adaptive accuracy | Distance-throttled high-acc (≥10m or ≥5s) |
+
+## Corrections Made
+
+User's added stack area redirected the phase: the phase-5 deferral of the WASM-router
+was superseded by building engine A now. The reconciliation round from phase 5 (SC3
+amendment) was extended, not reversed: fixtures remain backend #1 (demo path); engine A
+becomes a real backend #2; the router-pending state survives as graph-edge degradation.
+
+## Auto-Resolved
+
+Not applicable.
+
+## External Research
+
+Roadmap recommends /gsd-research-phase framing for "best-effort projection" + snapshots —
+resolved in-discussion (glyph+text cards; cron push loop). Remaining research surface for
+planning's light pass: graph build toolchain, A\* in-Worker feasibility numbers, cron/rate
+limits.
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-PATTERNS.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-PATTERNS.md
new file mode 100644
index 0000000..10b0dc9
--- /dev/null
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-PATTERNS.md
@@ -0,0 +1,423 @@
+# Phase 6: Turn-by-Turn Guidance (Live Driving) - Pattern Map
+
+**Mapped:** 2026-10-24
+**Files analyzed:** 25 new/modified files across `routing/`, `web/src/guidance/`, `web/src/location|map|route|telegram/`, `bot/src/`, `bot/wrangler.jsonc`, and the three test workspaces
+**Analogs found:** 22 / 25 (3 partial — the CSR/A\* data plane, the glyph rasterizer script, and the Worker `scheduled()` handler are repo firsts; RESEARCH.md Patterns 1–2 + Code Examples are the fallback)
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|-------------------|------|-----------|----------------|---------------|
+| `routing/src/graph.ts` (new) | model (binary decode) | transform (ArrayBuffer → typed arrays) | `routing/src/polyline.ts` codec + `fixture-source.ts` lazy index | role-match |
+| `routing/src/snap.ts` (new) | utility (geo math) | transform | `routing/src/geo.ts` | exact |
+| `routing/src/astar.ts` (new) | service (path computation) | batch | none — pure-math posture of `routing/src/geo.ts`; layout per RESEARCH Patterns 1–2 | partial |
+| `routing/src/http-source.ts` (new) | service (RoutingSource backend #2) | request-response | `routing/src/fixture-source.ts` | exact |
+| `routing/scripts/build-road-graph.mjs` (new) | build tool (maintainer) | batch + file-I/O | `routing/scripts/fetch-route-fixtures.mjs` | exact |
+| `routing/scripts/build-glyphs.mjs` (new) | build tool (maintainer, sharp) | file-I/O | `fetch-route-fixtures.mjs` shell (collect-then-write, exit codes) | role-match |
+| `bot/src/routing/worker-router.ts` (new) | service (R2 graph load + route handler) | request-response | `fixture-source.ts` lazy-memoize posture (LAW 1) | role-match |
+| `bot/src/guidance/cron.ts` (new) | service (scheduled projection + push) | event-driven (cron tick) | `webhook.ts` handler shape + `bot/src/bot/bot.ts` `createBot(env, {baseFetch})` | role-match (first `scheduled()` in repo) |
+| `bot/src/kv/guidance-sessions.ts` (MODIFY: types → service) | model + service | CRUD (KV) | `bot/src/kv/location-pin.ts` + `bot/src/kv/sessions.ts` | exact |
+| `bot/src/webhook.ts` (MODIFY: +`scheduled()`, +`/api/route`, +`/api/guidance`) | controller (Worker routes) | request-response + event | itself (its own fetch-handler pattern) | exact |
+| `bot/src/config.ts` (MODIFY: +`ROAD_GRAPH: R2Bucket`) | config | — | itself (typed Env contract) | exact |
+| `bot/wrangler.jsonc` (MODIFY: +`r2_buckets`, +`triggers.crons`) | config | — | itself | exact |
+| `bot/package.json` (MODIFY: +`@araharah/routing` dep) | config | — | itself (`@araharah/search` workspace-dep precedent) | exact |
+| `web/src/guidance/guidance.ts` (new) | service (pure state machine) | event-driven (fix stream reducer) | `web/src/route/route.ts` controller shape + `web/src/location/chain.ts` pure-injected-clock posture | role-match |
+| `web/src/guidance/eta.ts` (new) | utility (EMA + deadband) | transform | `routing/src/geo.ts` (pure, named constants) | exact |
+| `web/src/guidance/banner.ts` (+ list + guidance-card builders) (new) | component builders | request-response (DOM compose) | `web/src/route/route-card.ts` | exact |
+| `web/src/guidance/watch.ts` (new) | hook (watchPosition + ≥10 m/≥5 s throttle) | streaming | `web/src/location/webview.ts` + `telegram.ts` Fix normalization | exact |
+| `web/src/guidance/` capability guards (haptics, `disableVerticalSwipes`, closing confirmation) | middleware (guards) | request-response | `web/src/telegram/webapp.ts` optional members + `safe-area.ts` version gate | exact |
+| `web/src/telegram/backbutton.ts` (MODIFY: 3-state graph) | middleware (BackButton wire) | request-response | itself (`wireBackButton` — predicate+handler-as-one-change) | exact |
+| guidance camera locked-follow (new, in `web/src/guidance/` or `map/`) | component | request-response | `web/src/map/follow.ts` + `web/src/ui/recenter.ts` | exact |
+| `web/src/route/route.ts` (MODIFY: evolves into guidance chrome) | controller | request-response | itself | exact |
+| `routing/test/{graph,astar,snap}.test.mjs` + mini-graph fixture (new) | test | batch | `routing/test/fixture-source.test.mjs` + `contract.test.mjs` | exact |
+| `web/test/guidance-surface.test.mjs` (new) | test (behavioral + structural gates) | — | `web/test/route-surface.test.mjs` | exact |
+| `web/test/guidance-replay.test.mjs` + `web/test/fixtures/drives/*.json` (new) | test + fixture corpus | streaming replay | `web/test/location-chain.test.mjs` stubs + `routing/test/fixtures/golden-pairs.json` corpus | role-match |
+| `web/test/guidance-eta.test.mjs` (new) | test | — | replay-fixture style of the two above | role-match |
+| `bot/test/guidance-cron.test.mjs` (new) | test | — | `bot/test/webhook.test.mjs` (undici offline) + KV-fake style of `bot/test/sessions.test.mjs` | role-match |
+| `bot/test/guidance-envelope.test.mjs` (MODIFY: GE4–GE7 re-pin), `bot/test/route-privacy.test.mjs` (MODIFY: RP1/RP2 re-pin), `bot/test/privacy.test.mjs` (MODIFY: PG1 module list) | test gates | — | themselves (each gate's doc-comment names Phase 6 as the re-pinning owner) | exact |
+
+## Pattern Assignments
+
+### `routing/src/http-source.ts` + `bot/src/routing/worker-router.ts` (service, request-response)
+
+**Analog:** `routing/src/fixture-source.ts` — the backend-ladder construct every new RoutingSource implements.
+
+**The seam being implemented** (`routing/src/types.ts` lines 89–100):
+```typescript
+// THE NULL CONTRACT IS LOAD-BEARING (D-03): route() resolving to NULL is
+// the honest "router pending" state — an unknown destination, or an origin
+// outside the fixture corpus's tolerance. Never a blank map, never a fake
+// route, never a thrown error for a normal miss.
+export interface RoutingSource {
+  readonly name: string;
+  route(req: RouteRequest): Promise<RouteResult | null>;
+}
+```
+
+**Backend factory shape — copy this skeleton** (`fixture-source.ts` lines 156–189):
+```typescript
+export function createFixtureRoutingSource(data?: RouteFixturesFile): RoutingSource {
+  let index: PairIndex | null = null;
+  const load = (): PairIndex => {
+    if (index === null) {
+      index = data === undefined ? loadDefaultIndex() : buildPairIndex(data);
+    }
+    return index;
+  };
+  return {
+    name: "fixture",
+    async route(req: RouteRequest): Promise<RouteResult | null> {
+      // Slug guard FIRST — a hostile shape never reaches the index (T-05-03).
+      if (!ID_PATTERN.test(req.destinationId)) return null;
+      const idx = load();
+      const candidates = idx.byDestination.get(req.destinationId);
+      if (candidates === undefined) return null; // D-03: honest pending
+      // ... match → RouteResult; else return null
+      return null;
+    },
+  };
+}
+```
+
+**Lazy memoize at module scope (LAW 1 — pay nothing at startup)** (`fixture-source.ts` lines 134–141, mirrored in the doc header lines 7–10):
+```typescript
+let defaultIndex: PairIndex | null = null;
+function loadDefaultIndex(): PairIndex {
+  if (defaultIndex === null) {
+    defaultIndex = buildPairIndex(fixturesData as RouteFixturesFile);
+  }
+  return defaultIndex;
+}
+```
+`worker-router.ts` transposes this to the R2 graph — RESEARCH.md "R2 graph load + isolate memoization" gives the exact promise-memo form:
+```typescript
+let graphP: Promise<Graph> | null = null;               // module scope = per-isolate memo
+function loadGraph(env: Env): Promise<Graph> {
+  graphP ??= env.ROAD_GRAPH.get(GRAPH_KEY)
+    .then(o => o === null ? null : decodeGraph(await o.arrayBuffer()));
+  return graphP;
+}
+```
+Absence of the graph object → `createHttpRoutingSource` resolves `null` (D-03's designed degradation), never throws.
+
+**Defensive validation posture** (`fixture-source.ts` lines 66–95, `isUsablePair`): every field type-checked, non-finite numbers refused, a decode that throws marks the entry unusable (`catch { return false; }` lines 88–92) — the malformed entry renders as an honest null downstream, never a throw in the render path. `http-source.ts` applies the same shape to the Worker's JSON response; `graph.ts` applies it to the binary header (magic + version + size check, fail-honest per RESEARCH §Security).
+
+**Imports convention** (`fixture-source.ts` lines 35–46): static import for data (`import fixturesData from "./data/route-fixtures.json" with { type: "json" }`), relative imports WITH `.ts` extension, types via `import type`. The package has no `exports`/`main` — consumers import the explicit subpath: `import { … } from "@araharah/routing/src/index.ts"` (`routing/src/index.ts` lines 5–11). New exports (`decodeGraph`, `snapToGraph`, `routeAstar`, `createHttpRoutingSource`) are added to `index.ts` as named exports only — no default export.
+
+### `routing/src/snap.ts`, `routing/src/astar.ts`, `routing/src/graph.ts` (pure modules)
+
+**Analog:** `routing/src/geo.ts` — the pure-module law.
+
+**Header contract** (`geo.ts` lines 1–17): spherical math with named constants (`EARTH_RADIUS_M = 6_371_000`), "Pure: no I/O, no logging, no storage (the D-15 analog — nothing about a request outlives the caller's frame)". `haversineM` (lines 25–34) is the admissibility heuristic's distance oracle; `deriveCumulativeDistanceM` (lines 38–49) is the progress backbone the client snaps against:
+```typescript
+export function deriveCumulativeDistanceM(points: readonly RoutePoint[]): number[] {
+  if (points.length === 0) return [];
+  const cumulative: number[] = [0];
+  for (let i = 1; i < points.length; i++) {
+    // cumulative.push(prevMeters + haversineM(prev, curr));
+  }
+  return cumulative;
+}
+```
+Equirectangular point-to-segment math for `snap.ts` must scale lng by `cos(lat)` (RESEARCH Pitfall 8) and route all displayed distances through `cumulativeDistanceM`/`haversineM` — never raw Δdegrees.
+
+**No analog exists for CSR layout / binary heap A\*** — RESEARCH.md Pattern 1 (CSR binary layout: header/nodes/offsets/edges/weights, zero-copy `DataView` views) and Pattern 2 (typed-array A\*, binary heap of indices, haversine÷maxSpeed heuristic, bidirectional variant) are the authoritative references. Graph **decode** (`graph.ts`) follows the codec posture of `routing/src/polyline.ts` (pure functions, decode/encode pair, header contract at `polyline.ts`'s doc block; round-trip proven by tests).
+
+### `routing/scripts/build-road-graph.mjs` + `build-glyphs.mjs` (maintainer build tools)
+
+**Analog:** `routing/scripts/fetch-route-fixtures.mjs` — the exact maintainer-tool pattern (D-12 boundary).
+
+**Header/usage contract** (lines 1–47): `#!/usr/bin/env node`, a dense header stating "A MAINTAINER-TIME REPO TOOL … NOT a runtime dependency. Nothing in bot/src/, web/src/, or routing/src/ imports it", plus Usage / Exit codes sections.
+
+**Named constants up top** (lines 57–64): `USER_AGENT`, `INTER_REQUEST_DELAY_MS = 1200`, `REQUEST_TIMEOUT_MS = 30_000`, tolerance values — never inline magic numbers.
+
+**Pre-flight validation before any request leaves the machine** (lines 110–142): validate every input against committed data, `fail()` with the offending id named on the first violation.
+```typescript
+function fail(message) {
+  console.error(`fetch-route-fixtures: ${message}`);
+  process.exit(1);
+}
+```
+
+**Collect-then-write** (lines 185–242): results accumulate in memory; the output file is written ONLY after every unit succeeds; a hard failure exits 1 with the committed file UNTOUCHED. `build-road-graph.mjs` copies this verbatim: Overpass query → validate → CSR encode → stats print (node/edge counts vs the D-01 30–80 MB envelope — a stats gate, like line 244–248's post-write summary + "next:" hint) → write `kl-roadgraph.v1.bin`. `build-glyphs.mjs` keeps the same shell around sharp's SVG→PNG (sharp is a NEW devDependency: `npm install -D -w routing sharp` — zero runtime deps added, per RESEARCH §Installation).
+
+### `web/src/guidance/guidance.ts` (service — pure state machine, event-driven)
+
+**Analog:** `web/src/route/route.ts` for the state-machine/controller shape; `web/src/location/chain.ts` for the pure-injected-clock posture.
+
+**Injected-deps state machine with a total walk-back** (`route.ts` lines 55–82 + 174–187): every DOM/map concern is injected so tests run in Node ("All DOM/map concerns are INJECTED so the RS gates run in Node … the module itself touches no DOM and no maplibre value import"). The state transitions funnel through one `setState` that fires `onStateChange` (lines 88–91) — main.ts derives the BackButton predicate from it. `stepGuidance(state, fix, routeModel, nowMs) → {state, effects[]}` (RESEARCH Pattern 3) is the same idea, purer: no DOM concerns at all, injected clock.
+
+**Fail-honest error posture** (`route.ts` lines 95–104):
+```typescript
+const result: RouteResult | null = await deps.source
+  .route({ origin: { lat: fix.lat, lng: fix.lng }, destinationId: destination.id })
+  .catch(() => null); // T-05-04: an exception renders pending — never a half-drawn line
+```
+REROUTING failures resolve to a calm on-route-holds / pending posture, never a thrown error in the fix loop.
+
+**Console discipline** (`route.ts` lines 30–31 + RS8 gate at `route-surface.test.mjs` lines 498–513): the ONLY console lines are state tokens (`ARAHARAH-ROUTE state=drawn`), never template interpolation, never coordinates. Guidance adds its own `ARAHARAH-GUIDANCE state=…` family under the same law (D-14 category-only extended client-side).
+
+**Named constants exported at top** (`route.ts` lines 46–52): `ROUTE_CAMERA_PADDING`, `ROUTE_FIT_DURATION_MS`, `ROUTE_CAMERA_PITCH` — guidance's `OFF_ROUTE_THRESHOLD_M`, `OFF_ROUTE_CONSECUTIVE_FIXES`, `OFF_ROUTE_GRACE_MS`, `STORM_GUARD_MS`, `MISSED_TURN_PAST_MANEUVER_M`, `ARRIVAL_THRESHOLD_M` (RESEARCH Pattern 3 table) follow this export-and-pin convention; a test asserts the exported values (RS4 camera constants, `route-surface.test.mjs` lines 563–568).
+
+**Fix shape consumed** (`web/src/location/types.ts` lines 20–33) — replay fixtures are Fix-shaped JSON (same six fields):
+```typescript
+export type Fix = {
+  lat: number; lng: number;
+  accuracyM: number | null;
+  headingDeg: number | null;
+  ts: number;
+  source: FixSource;
+};
+```
+
+### `web/src/guidance/watch.ts` (hook, streaming)
+
+**Analog:** `web/src/location/webview.ts` + `web/src/location/telegram.ts`.
+
+**The wrapper pattern** (`webview.ts` lines 18–44): promise-wrapped callback, `settled` latch, hard timeout (a wedged client can never wedge the caller), errors resolve `null` — "denial / unavailability = null; the chain's normal signal (no error object escapes)". Options: `{ enableHighAccuracy: true, timeout, maximumAge: 0 }`. The guidance watch extends this to `watchPosition` (same `maximumAge: 0`, high-accuracy) with the D-15 distance throttle applied app-side:
+```typescript
+import { haversineM } from "@araharah/routing/src/geo.ts";
+const moved = last === null ? Infinity : haversineM(last, fix);
+if (moved >= 10 || fix.ts - lastAcceptedTs >= 5000) accept(fix);  // ≥10 m OR ≥5 s
+```
+**Fix normalization precedent** (`telegram.ts` lines 48–56): map the platform payload into the six-field Fix with `source: "…"`, `accuracyM ?? null`, `headingDeg ?? null`. `chain.ts` lines 10–15 record the cadence contract this phase finally flips: "a Fix-shaped abstraction with a PLUGGABLE cadence and hard-codes NO continuous-mode interval … Phase 6 chooses between bounded getLocation() polling and watchPosition() without a rewrite."
+
+### `web/src/guidance/banner.ts` + list + guidance-card (component builders)
+
+**Analog:** `web/src/route/route-card.ts` — the builder law.
+
+**createElement + textContent ONLY** (`route-card.ts` lines 11–15 header, enforced by RS5 at `route-surface.test.mjs` lines 424–434): "a name-derived string never reaches innerHTML". Structure: actions interface first (lines 26–31), then a pure builder returning an `HTMLElement`:
+```typescript
+export interface RouteCardActions {
+  onSelect(index: number): void;
+  onSearchAgain(): void;
+}
+export function buildRouteCard(locale, destinationName, options, selectedIndex, actions): HTMLElement {
+  const loc = strings[locale];
+  const card = document.createElement("div");
+  card.className = "card";
+  // ... header / headline / telemetry / diff appended via createElement+textContent
+  return card;
+}
+```
+**Theme classes only, no local restyle** (`cards.ts` lines 2–8): `.card, .card-header, .card-ref, .btn-primary, .btn-secondary, .text-headline-md, .text-body-md, .text-body-sm` from the theme/shell — never restyled locally. Telemetry numbers use `.text-telemetry-num` (line 69), the first-consumer precedent for the banner's distance/ETA digits.
+
+**Copy lives ONLY in `web/src/i18n/strings.ts`** (`strings.ts` lines 17–63 interface + COPY5 gate; RS9 at `route-surface.test.mjs` lines 517–542 greps the route family for inline English/Malay). New banner/confirm/trip-end copy keys are added to `ShellStrings` in both `en` and `ms`; clinical-honest tone. **Instrument formats are composed in code, not locale strings** — `fillTemplate` (lines 193–195) + `chip.textContent = \`${String(index + 1).padStart(2, "0")} // ${minutes} MIN · ${km} KM\`` (line 172). The banner's "480 m → JALAN AMPANG" format and the turn-card caption follow this.
+
+**aria attributes** on interactive groups (`route-card.ts` lines 88–89): `role="group"` + `aria-label` from the strings module.
+
+### Guidance camera (locked follow + recenter return)
+
+**Analog:** `web/src/map/follow.ts` + `web/src/ui/recenter.ts`.
+
+**Mode machine with a programmatic-move lock** (`follow.ts` lines 14–43):
+```typescript
+export const CAMERA_PADDING_PX = 96; // 12 x space-sm
+export const RECENTER_DURATION_MS = 400;
+export type FollowMode = "following" | "free";
+export function createFollowController(map, onModeChange) {
+  map.on("movestart", (e) => {
+    if (lock) return;
+    if (e.originalEvent) set("free"); // a user gesture only, never a programmatic move
+  });
+  return { follow(fix) { lock = true; map.flyTo({...}); set("following"); lock = false; } };
+}
+```
+Locked-follow (D-10: center ≈65% down-screen via MapLibre padding, pitch 35°) extends `follow(fix)` to ease along the snapped line; user pan still unlocks via `originalEvent` (T-03-16) → the Phase 3 recenter control returns. **Control state is data-attributes + CSS** (`recenter.ts` lines 27–47): `button.dataset.follow = mode; button.dataset.fix = state;` — instant swaps, zero easing; the click handler is `addEventListener`, never inline onclick. `route.ts` lines 8–14 document the camera law the guidance camera must keep: pitch/bearing passed EXPLICITLY; fit stays center+zoom only.
+
+### Capability guards (haptics, vertical swipes, closing confirmation, BackButton)
+
+**Analog:** `web/src/telegram/webapp.ts` + `web/src/telegram/safe-area.ts` + `web/src/telegram/backbutton.ts`.
+
+**The contract grows by OPTIONAL members only** (`webapp.ts` lines 31–65 — the hand-rolled `TelegramWebAppLike` IS the contract; `@types/telegram-web-app` stays deliberately out). RESEARCH.md "Telegram capability guards" names the exact additions:
+```typescript
+HapticFeedback?: { impactOccurred(style): unknown; notificationOccurred(type): unknown; selectionChanged(): unknown };
+disableVerticalSwipes?: () => void;      // Bot API 7.7+
+enableVerticalSwipes?: () => void;
+enableClosingConfirmation?: () => void;  // Bot API 6.2+
+isActive?: boolean;                      // 8.0+
+// "activated" | "deactivated" via the existing onEvent?(event, cb)
+```
+
+**Version-gate BEFORE touching the API** (`safe-area.ts` lines 35–43, the established shape; `telegram.ts` lines 23–26 shows the null-safe variant):
+```typescript
+const tg =
+  wa && typeof wa.isVersionAtLeast === "function" && wa.isVersionAtLeast("8.0")
+    ? wa.safeAreaInset
+    : null;
+if (!tg) return base; // old-client fallback
+```
+Haptics are graceful no-ops where unsupported (D-08) — `?.` chains on the optional member.
+
+**BackButton graph extension** (`backbutton.ts` lines 1–27): "its predicate and its handler ship as ONE change so Phase 6 extends the state graph rather than reinventing the wire". The 3-state walk (search → routes → guidance → search) makes `walkBack` context-aware; guidance-exit routes through the D-09 confirm card; never `close()` from a pushed state (RS7 proves the wire with a recording fake, `route-surface.test.mjs` lines 449–494).
+
+**Safe areas during guidance:** `resolveSafeInsets` + `applySafeArea` (`safe-area.ts` lines 35–58) already write `--safe-top/bottom/left/right` custom properties on `:root` — the banner's top register padding consumes the existing tokens.
+
+### `bot/src/kv/guidance-sessions.ts` (MODIFY: frozen types → TTL-only service)
+
+**Analog:** `bot/src/kv/location-pin.ts` (the exact write/read/delete trio) + `bot/src/kv/sessions.ts` (multi-key rotation).
+
+**The frozen contract being implemented** (`guidance-sessions.ts` lines 15–17, 49–58):
+```typescript
+export const GUIDANCE_SESSION_TTL_SECONDS = 7200;
+export interface GuidanceSessionEnvelope {
+  id: string;
+  chat_id: number;
+  route_snapshot: GuidanceRouteSnapshot;
+  created_at: number;
+}
+```
+Key scheme `guidance:<id>`; EXACTLY four fields — "a 5th property means drift (the SessionClaim law)".
+
+**TTL-on-the-same-line write** (`location-pin.ts` lines 42–46):
+```typescript
+export async function writePin(kv: LocationPinKv, chatId: number, pin: LocationPin): Promise<void> {
+  await kv.put(`loc:${chatId}`, JSON.stringify(pin), { expirationTtl: PIN_TTL_SECONDS });
+}
+```
+PG1 (`privacy.test.mjs` lines 32–49) mechanically enforces: every `.put(` line carries `expirationTtl`, referencing an ALL-CAPS named constant — never an inline literal. The new service's writes land in `privacy.test.mjs`'s `storageModules` list.
+
+**Injected KvLike seam** (`sessions.ts` lines 53–57): `interface KvLike { get/put({expirationTtl})/delete }` — the service takes `kv: GuidanceSessionKv extends KvLike`, so tests inject a Map-backed fake (the `bot/test/sessions.test.mjs` pattern). `crypto.randomUUID()` ids (line 74, T-02-05).
+
+**Defensive read with exact-field + range validation** (`location-pin.ts` lines 48–73): parse in try/catch, check every field's presence and type, range-check numerics, return `null` on any mismatch — "a corrupt or tampered record can never fly the client camera to null island." `getGuidanceSession` mirrors this against the frozen envelope shape (the cron must never push a card from a malformed record).
+
+**Explicit delete for trip end (D-14):** `location-pin.ts` lines 75–79 `clearPin` is the model — one `await kv.delete(\`loc:${chatId}\`)`; guidance adds `deleteGuidanceSession(kv, id)` called on BOTH arrival and abandon paths.
+
+### `bot/src/webhook.ts` (MODIFY: +`scheduled()`, +`/api/route`, +`/api/guidance`)
+
+**Analog:** its own established handler pattern.
+
+**Route-dispatch skeleton** (lines 54–84): pathname match → method check (405) → handler; `satisfies ExportedHandler<Env>` (line 84). RESEARCH.md's "Cron config + scheduled handler" example extends exactly this object:
+```typescript
+export default {
+  async fetch(req, env, ctx): Promise<Response> { /* existing + /api/route + /api/guidance */ },
+  async scheduled(controller: ScheduledController, env: Env, ctx): Promise<void> {
+    let cursor: string | undefined;
+    do {
+      const page = await env.chat_sessions.list({ prefix: "guidance:", cursor });
+      for (const key of page.keys) { /* get → projectTurnCards → maybe sendPhoto */ }
+      cursor = page.list_complete ? undefined : page.cursor;
+    } while (cursor !== undefined);
+  },
+} satisfies ExportedHandler<Env>;
+```
+
+**Bearer-claim derivation — NEVER client-supplied chat ids** (`webhook.ts` lines 143–161, `handleLocation` — the T-03-01 precedent both new endpoints must copy):
+```typescript
+const header = req.headers.get("authorization") ?? "";
+const match = header.match(/^Bearer ([A-Za-z0-9-]+)$/);
+const token = match !== null && match[1] ? match[1] : null;
+const claim = token === null ? null : await getClaimByToken(env.chat_sessions, token);
+if (claim === null) {
+  console.log("[location] rejected: unauthorized"); // category ONLY (D-14)
+  return new Response(JSON.stringify({ error: "unauthorized" }), { status: 401, ... });
+}
+```
+`/api/guidance` mints the envelope with `chat_id: claim.chat_id`; `/api/route` is gated identically. Body-size caps follow `MAX_INITDATA_CHARS` + the pre/post-read double check (lines 91–119, WR-01) for request-body validation; lat/lng validation is hand-rolled (no zod — RESEARCH §V5).
+
+**Category-only logging** (lines 37–43 law + call sites): `console.log("[initdata] rejected: malformed")` — never payload, never ids, never timestamps. Cron and routing paths extend this (D-14): `[guidance-cron] …` categories only.
+
+**Fail-closed secret posture** (lines 58–71): reject with a constant response BEFORE any framework/library path runs when a required binding is missing — the shape to mirror if the R2 binding or graph key is absent (honest degradation, D-03).
+
+### `bot/src/bot/bot.ts` (MODIFY-adjacent: cron-side sends)
+
+**Analog:** `createBot(env, opts)` (lines 41–44) — the env-bound factory with an injectable `baseFetch` for offline tests:
+```typescript
+export function createBot(env: Env, opts: { baseFetch?: typeof fetch } = {}): Bot {
+  const bot = opts.baseFetch
+    ? new Bot(env.BOT_TOKEN, { client: { fetch: opts.baseFetch } })
+    : new Bot(env.BOT_TOKEN);
+```
+`cron.ts` calls `createBot(env)` (works identically inside `scheduled()`); `guidance-cron.test.mjs` injects `baseFetch` to record `sendPhoto` calls without network — the turn-card send is `bot.api.sendPhoto(chat_id, url, { caption, parse_mode: "HTML" })` (RESEARCH "Turn-card send").
+
+### `bot/src/config.ts` + `bot/wrangler.jsonc` (config MODIFY)
+
+**Analog:** themselves — the typed-Env / config-comment style.
+
+`config.ts` (lines 4–17): each field one line, trailing `//` comment naming its law (e.g. `chat_sessions: KVNamespace; // TTL-only namespace`). Add `ROAD_GRAPH: R2Bucket; // D-01 graph binary — R2 binding, first in the repo` plus any cron constants as named exports, NOT env reads. `wrangler.jsonc` (lines 1–24): JSONC with law-bearing comments; add:
+```jsonc
+"r2_buckets": [{ "binding": "ROAD_GRAPH", "bucket_name": "araharah-graphs" }],
+"triggers": { "crons": ["*/1 * * * *"] }
+```
+(60 s tick; app-side logic decides whether a card is due — D-11's 60–120 s discretion.) KV namespace stays EXACTLY ONE (`chat_sessions`, line 23) — GE5 re-pins to "exactly one" still; the R2 bucket is NOT a KV namespace.
+
+### `bot/package.json` (MODIFY)
+
+**Analog:** itself — `bot/package.json` already carries the workspace-dep precedent: `"dependencies": { "grammy": "^1.46.0", "@araharah/search": "*" }`. Add `"@araharah/routing": "*"` (the research-named first routing import). Import form inside bot/src follows the subpath rule: `import { decodePolyline6 } from "@araharah/routing/src/polyline.ts"`.
+
+## Shared Patterns
+
+### TTL-only KV (every write carries `expirationTtl`)
+**Source:** `bot/src/kv/location-pin.ts` lines 42–46, `bot/src/kv/sessions.ts` lines 73–90; enforced by `bot/test/privacy.test.mjs` PG1 (lines 32–49)
+**Apply to:** `bot/src/kv/guidance-sessions.ts` service functions; extend PG1's `storageModules` list in the same change.
+```typescript
+await kv.put(`guidance:${id}`, JSON.stringify(envelope), { expirationTtl: GUIDANCE_SESSION_TTL_SECONDS });
+```
+
+### Bearer-claim → server-derived key (V4 access control)
+**Source:** `bot/src/webhook.ts` lines 143–161 (`handleLocation`)
+**Apply to:** `/api/route`, `POST /api/guidance`, `DELETE /api/guidance`; the cron reads `envelope.chat_id` from KV only — never a client-supplied chat id anywhere.
+
+### Category-only logging
+**Source:** `bot/src/webhook.ts` lines 37–43, 112, 150, 196; client-side twin: `route.ts` state tokens + RS8 gate
+**Apply to:** all cron + routing paths (bot) and all `web/src/guidance/` modules (state tokens only, no `${…}` interpolation — coordinates and chat ids never appear in any log line).
+
+### Lazy memoize at module scope (LAW 1)
+**Source:** `routing/src/fixture-source.ts` lines 134–141, 57–63
+**Apply to:** `worker-router.ts` graph load (1 R2 GET per cold isolate), `graph.ts` decode cache, and any snap-grid index (built once per isolate, never per request).
+
+### Fail-honest nulls (never fabricate, never throw for a normal miss)
+**Source:** `routing/src/types.ts` lines 13–16 + `fixture-source.ts` lines 175–186; client twin `route.ts` lines 97–104
+**Apply to:** `http-source.ts` (network/absent-graph → null → router-pending), `graph.ts` header check, `getGuidanceSession` (malformed → null), reroute failure inside the state machine.
+
+### Pure module + injected deps (Node-testable without a browser)
+**Source:** `web/src/location/chain.ts` lines 27–36 (injected `nowMs`, injected source functions); `route.ts` lines 33–36 (injected DOM/map); `geo.ts` (no I/O at all)
+**Apply to:** `guidance.ts` (injected clock + RoutingSource), `eta.ts`, `cron.ts`'s `projectTurnCards()` (pure projection, injected now), `graph/astar/snap.ts`. Module header comments state the law (the `chain.ts` lines 1–20 style).
+
+### Capability-guarded Telegram WebApp APIs
+**Source:** `web/src/telegram/webapp.ts` lines 31–65 (optional members only) + `safe-area.ts` lines 35–50 (`isVersionAtLeast` gate) + `telegram.ts` lines 23–26 (null-safe support probe)
+**Apply to:** haptics, `disableVerticalSwipes`, `enableClosingConfirmation`, `isActive`/`activated`/`deactivated` events, envelope POST-on-minimize.
+
+### createElement + textContent builders; strings-module copy; theme classes only
+**Source:** `web/src/route/route-card.ts` lines 11–15, 37–103, 193–195; `web/src/i18n/strings.ts` lines 17–63; gated by RS5/RS9 + COPY5
+**Apply to:** banner, maneuver list, guidance card, "abandon route?" confirm card, "trip ended, data deleted" messaging — all copy keys land in `ShellStrings` (en + ms), all instrument formats composed in code via `fillTemplate`.
+
+### Version-gated constants tables (camera + thresholds exported and pinned)
+**Source:** `route.ts` lines 46–52 (`ROUTE_CAMERA_PADDING/…`), pinned by `route-surface.test.mjs` lines 563–568
+**Apply to:** the D-04/D-07 constants (`OFF_ROUTE_THRESHOLD_M` … `ARRIVAL_THRESHOLD_M`, EMA α, deadband) — named exports, asserted by the replay/eta suites, replay-tuned without renaming.
+
+### Hand-rolled test harness family
+**Source:** `routing/test/harness.mjs` (10 lines: `test()` + registry), `routing/test/runner.mjs` (auto-discovers `*.test.mjs`, sorted; load-failure becomes one failing case; PASS/FAIL + exit code). `bot/test/` and `web/test/` are the same shape verbatim (confirmed by diff).
+**Apply to:** every new suite registers via `import { test } from "./harness.mjs"`; new suites are dropped into the existing `test/` dirs — runner discovery picks them up with zero config.
+
+### Behavioral fakes + structural gates (the two test styles)
+**Source (behavioral):** `web/test/route-surface.test.mjs` — `fakeMap()` recording fake (lines 77–104), `fakeDeps()` full dep set capturing actions (lines 266–306), `withConsole()` capture helper (lines 309–318), Node-24 type-stripping dynamic imports of `.ts` sources (lines 37–46).
+**Source (behavioral, DOM-free):** `web/test/location-chain.test.mjs` — `stubNavigator`/`stubFetch` install+restore-in-finally (lines 30–62), `fakeWebApp` with real `isVersionAtLeast` comparison (lines 68–89).
+**Source (structural):** comment-stripped source introspection — `stripComments` + banned-token scans (`route-surface.test.mjs` lines 50–58; `guidance-envelope.test.mjs` lines 54–70; `route-privacy.test.mjs` lines 42–50).
+**Apply to:** `guidance-surface.test.mjs` (copy of the RS style), `guidance-replay.test.mjs` (Fix-shaped JSON streams through `stepGuidance` — the chain-test stub style, no DOM at all), `guidance-cron.test.mjs` (undici Request/Response offline pattern of `bot/test/webhook.test.mjs`; KV Map-fake; `baseFetch`-captured `sendPhoto`).
+
+### Gate re-pins ship WITH the change that invalidates them
+**Source (the handoff notes):** `bot/test/guidance-envelope.test.mjs` lines 36–40 ("when the turn-card service legitimately adds the kv namespace binding, the Env field, and the consumer, updating GE4–GE7 is THAT plan's responsibility"); `bot/test/route-privacy.test.mjs` lines 1–24 (RP1 bans `/api/route` tokens, RP2 bans `@araharah/routing` in bot/src).
+**Apply to:** the plans that add the envelope service re-pin GE4 (types-only → service), GE6 (Env gains `ROAD_GRAPH`), GE7 (bot/src may import guidance-sessions), and keep GE1 (TTL 7200), GE2 (field freeze), GE3 (inline snapshot) UNCHANGED — the frozen shape stays frozen. The plan adding `/api/route` + the routing import re-pins RP1 (ban *unauthenticated/proxy-shaped* routing) and RP2 (routing import now allowed, listed explicitly). GE5 stays: exactly ONE KV namespace (R2 is a separate binding class).
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason | Fallback |
+|------|------|-----------|--------|----------|
+| `routing/src/astar.ts` + CSR layout in `graph.ts` | service | batch | No graph-search code exists anywhere in the repo | RESEARCH.md Pattern 1 (CSR binary layout) + Pattern 2 (typed-array A\*, binary heap, bidirectional); correctness gate = A\* equals brute-force Dijkstra on a committed mini-graph (`routing/test/` fixture, Wave 0) |
+| `routing/scripts/build-glyphs.mjs` (sharp SVG→PNG) | build tool | file-I/O | No rasterization code exists; sharp is a new devDependency | Keep `fetch-route-fixtures.mjs`'s maintainer-tool shell (header/usage/exit codes/collect-then-write); rasterizer choice per RESEARCH Standard Stack (sharp preferred, `@resvg/resvg-js` fallback) |
+| `bot/src/webhook.ts` `scheduled()` + `bot/src/guidance/cron.ts` | service | event-driven | First Cron Trigger in the repo — no scheduled-handler precedent | RESEARCH.md "Cron config + scheduled handler" code example (KV `list({prefix, cursor})` + `list_complete` pagination); local test via `curl "http://localhost:8787/cdn-cgi/local/scheduled"`; send shape from `bot.ts` `createBot(env)` |
+| `web/test/fixtures/drives/*.json` corpus | fixture corpus | — | No position-stream fixtures exist (phase 3/4 used capture profiles, not recorded drives) | Shape = the six-field `Fix` (`web/src/location/types.ts` lines 22–33) as JSON streams; corpus-commit conventions from `routing/test/fixtures/golden-pairs.json` (committed data + header/attribution fields where licensing applies) |
+
+## Metadata
+
+**Analog search scope:** `routing/{src,test,scripts}/`, `web/src/{route,map,location,telegram,ui,i18n}/`, `web/test/`, `bot/src/{kv,bot}/`, `bot/test/`, `bot/wrangler.jsonc`, workspace `package.json`s
+**Files read in full:** 24 source/test/config files (~2,700 lines); runners trio diff-confirmed identical in shape
+**Pattern extraction date:** 2026-10-24
+
+**Cross-cutting cautions for the planner (each pinned by an existing gate):**
+1. **GE5 stays green:** the R2 bucket is a `r2_buckets` binding, NOT a second KV namespace — `guidance-envelope.test.mjs` GE5 still asserts exactly one `kv_namespaces` entry.
+2. **PG1 scope grows:** `privacy.test.mjs` `storageModules` (line 25) must list `kv/guidance-sessions.ts` the moment it gains a write path.
+3. **RS6 inversion:** `route-surface.test.mjs` RS6 (lines 438–445) currently BANS the tokens `progress`/`maneuver` in `web/src/route/` — the plans that move guidance chrome into `web/src/route/` must re-pin RS6 in the same change (the phase-5 header comment reserved this: `route.ts` D-10 "no start-guidance button … Phase 6" note).
+4. **RS10 floor bump:** the no-storage scan floor (≥16 files, lines 546–559) grows with `web/src/guidance/` — bump it in the plan that creates the family.
+5. **Workspace-import rule:** subpath-with-extension only (`@araharah/routing/src/index.ts`); a bare `@araharah/routing` specifier resolves to nothing (`routing/src/index.ts` lines 5–11) — and bot/package.json needs the dep added before bot/src imports it.
diff --git a/.planning/phases/06-turn-by-turn-guidance-live-driving/06-UI-SPEC.md b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-UI-SPEC.md
new file mode 100644
index 0000000..ed67eef
--- /dev/null
+++ b/.planning/phases/06-turn-by-turn-guidance-live-driving/06-UI-SPEC.md
@@ -0,0 +1,440 @@
+---
+phase: 6
+slug: turn-by-turn-guidance-live-driving
+status: draft
+shadcn_initialized: false
+preset: none
+created: 2026-10-24
+---
+
+# Phase 6 — UI Design Contract (Turn-by-Turn Guidance, Live Driving)
+
+> Visual and interaction contract for the guidance experience. Generated by gsd-ui-researcher, verified by gsd-ui-checker.
+>
+> **Source posture:** the design system is IN USE — `theme/dist/rams.css` tokens and the live shell (strip, card stack, recenter control, gantry, destination card, route card + chips) shipped in Phases 3–5 and passed their UI-SPECs + device gates. This contract specifies **extension** of that shell into the guidance cockpit: the top maneuver banner, the compacted location register, the collapsible maneuver list, the guidance card (the route card evolving), the abandon-route confirm card, trip-end messaging, the locked-follow camera, and the chat turn-card (a Telegram message, not app chrome). It invents no new token values, no new colors, no roundedness, no shadows. Binding upstream: 06-CONTEXT.md D-01..D-16 (layout, ETA deadband, haptics, PX-03/PX-01, camera, glyphs, honest copy, trip-end deletion), 05-UI-SPEC.md (the route shell this extends — ITS CONVENTIONS BIND), 03-UI-SPEC.md (strip/card/control/copy/a11y law), telemetry_rams/DESIGN.md §Navigation Heads-Up Display (the banner's component spec), DESIGN.md palette semantics (orange = navigation/primary, red = hazards/errors only). The `active_route_guidance` mockup is layout reference only; its lane matrix, incident band, speedometer deck, report/audio buttons, backdrop-blur header, and rounded puck are scrubbed residue (deferred features or existing-law violations — recorded in Fidelity Artifact).
+>
+> **Map-law restated:** the MapLibre style is never re-set; additions only (`addLayer`/`addSource`/`setData`). The route line stack from Phase 5 is guidance's route rendering — unchanged paint (orange 5px on black 9px casing). No route-line progress split this phase: the puck, the progress bar, and the camera carry progress (recorded call — less, but better).
+
+---
+
+## Design System
+
+| Property | Value |
+|----------|-------|
+| Tool | none — shadcn gate N/A (TypeScript + Vite, no UI framework; unchanged from Phase 3) |
+| Preset | not applicable |
+| Component library | `@araharah/theme` — `theme/dist/rams.css` (already imported via `shell.css`; nothing new to wire) |
+| Icon library | inline SVG — 2px uniform stroke, square linecaps, orthogonal/45° baselines (app chrome); PLUS the phase's one new committed asset: the **8-arrow maneuver glyph set** — hand-drawn 32×32 SVGs at 3px stroke (the HUD spec's weight), rendered as inline SVG in-app and rasterized once to 256×256 PNGs (maintainer `build-glyphs.mjs`, sharp) for chat turn-cards. One geometry, two renderings; the committed SVGs are the single source |
+| Font | self-hosted Geist + Space Grotesk via `theme.css` `@font-face` (unchanged) |
+| Basemap | `theme/basemap/liberty-rams.json` — Rams-constant under both Telegram themes (unchanged) |
+
+**Consumed component classes** (all pre-existing; none restyled locally): `.card`, `.card-header`, `.card-ref`, `.btn-primary`, `.btn-secondary`, `.text-headline-md`, `.text-body-md`, `.text-body-sm`, `.text-label-sm`, `.text-telemetry-num` — plus the Phase 3–5 shell classes (`.strip`, `.recenter`, `.route-stack`, `.card-stack`).
+
+New CSS for this phase (banner, list, guidance-card rows, progress bar) lives in `shell.css` and references `var(--color-*)` / `var(--spacing-*)` / `var(--type-*)` only. The machined-geometry literal list grows by exactly: banner arrow plate 48×48 + glyph 32×32, banner min-height 96px, compact strip min-height 24px, list row min-height 48px + row glyph 24×24, next-row lamp 8px, list panel max-height 480px, progress bar 4px, the 64px control-clearance composite (reused), guidance camera paddings {top 320, bottom 64, left/right 64} (map-space px) — all 4-multiples, 1px/2px rules, machined glyph geometry, and map-space paint arithmetic — the established exception classes.
+
+---
+
+## Shell Layout — Register Bands (guidance occupation, D-06)
+
+The Phase 3 partition is unchanged. During guidance the registers re-populate:
+
+| Band | Content during guidance | Geometry |
+|------|------------------------|----------|
+| Top register | **Maneuver banner** (new, D-06) — distance + arrow + street, matte-black chassis; the toggle for the maneuver list | Below `safe-top + space-sm`; min-height 96px; full-bleed |
+| Top register, compacted | **Location strip (compacted)** — same lamp + state word, telemetry cluster hidden, min-height 24px | Directly beneath the banner, separated by a 1px `chassis-subtle` rule; one continuous black chassis with the banner |
+| Center register | Rams basemap + position marker + Phase 5 route stack; **maneuver list panel** (only while expanded, overlays the map — no dim layer, boot-card precedent); boot/denied/pending cards unchanged when guidance is not active | Map stays the dominant surface |
+| Bottom register | **Guidance card** (the route card evolved — D-06); **abandon confirm card** (bottom placement — thumb-reach call, D-09); signal-lost card (existing, transient); recenter control bottom-right (returns on pan-unlock, Phase 3 semantics); attribution chip bottom-left | Card bottom offset `calc(var(--safe-bottom) + 64px)` — the Phase 5 composite, unchanged |
+
+- **Strip compaction is layout-only.** The strip's state machine, lamp colors, and word labels are byte-identical (Phase 3 table stands; `strip.ts` logic untouched). Guidance adds a `data-guidance` attribute on the shell root: padding-block drops `space-sm` → `space-xs`, min-height 32 → 24px, and the right telemetry cluster (`±M` / `FIX Ns AGO`) hides — accuracy/fix-age are not glance data at speed. The strip never hides degradation silently: staleness and denial still announce via red lamp + word, unchanged. Compacted registration is honest registration.
+- **No new floating controls.** The recenter control keeps its plate, notch states, and hit target exactly; during guidance its `following` state means *locked-follow* (D-10) — the notch semantics read identically to the user.
+- Banner placement is the strip's own band + the space above it: the chassis grows upward, the map viewport shrinks correspondingly (camera arithmetic below compensates).
+
+---
+
+## Spacing Scale
+
+Bound to tokens (`--spacing-*`), consumption not invention. Phase 3/5 tables stand; Phase 6 adds:
+
+| Element | Number | Token source |
+|---------|--------|--------------|
+| Banner padding | `space-sm space-md` (8/16) | tokens |
+| Banner min-height | 96px (register 12 + distance 32 + street 26 + 2×`space-xs` gaps + 2×`space-sm` padding ≈ 94 → 96 = 12×8) | tokens + spec geometry |
+| Banner arrow plate | 48×48px (32px glyph + 8px breathing per side), `surface-dark` field on the black chassis (mockup nesting precedent, token `--color-surface-dark`) | machined geometry |
+| Banner arrow glyph | 32×32 viewBox, 3px stroke, square linecaps | telemetry_rams HUD spec |
+| Compact strip min-height | 24px, padding-block `space-xs` | tokens + spec geometry |
+| Banner→strip separator | 1px solid `chassis-subtle` | machined rule |
+| List panel | card geometry: `calc(100% - 2×margin)`, max-width 320px, centered; max-height 480px (scrolls); padding `space-sm` bottom | tokens + spec geometry |
+| List row | min-height 48px, padding `space-sm space-md`, glyph 24×24, 1px `matte-black` row separators (dark: `inverse-on-surface`) | tokens + machined rule |
+| Next-row lamp | 8×8px `signal-orange` square at the row's left edge (checkbox geometry precedent) | spec geometry |
+| Guidance card | bottom offset 64px composite (Phase 5, reused); telemetry row + progress bar margins `space-xs`; progress bar height 4px, width = content width (inset `space-md`) | tokens + machined geometry |
+| Confirm card | bottom register, same 64px composite (thumb-reach — see A11y) | Phase 5 composite |
+| Guidance camera padding | `{ top: 320, bottom: 64, left: 64, right: 64 }` — map-space px (MapLibre padding, not CSS; 8-multiples; `T − B = 256 ≈ 0.30 × 844` reference viewport → center at 65% down-screen, D-10) | spec geometry |
+
+Exceptions: none beyond the established classes (44px hit targets via existing slop patterns; 4-multiples; map-space arithmetic).
+
+---
+
+## Typography
+
+The Phase 3 scale stands — zero new sizes, zero new weights. `telemetry-num` gains its second consumer (the banner distance).
+
+| Role | Token | Spec | Usage in Phase 6 |
+|------|-------|------|------------------|
+| Banner distance | `--type-telemetry-num` | 28px Space Grotesk 700 / 32px, tracking −0.03em | Distance-to-maneuver number (`250` + `M`) — the glance datum |
+| Banner street | `--type-headline-md` | 20px Space Grotesk 600 / 26px, tracking −0.02em | Street/designation line, uppercase (HUD spec: "Maneuver Typography: headline-md") |
+| Banner register | `--type-label-sm` | 10px Geist 700 / 12px, tracking +0.08em, uppercase | `GUIDE // NEXT` register line; `LIST`/`CLOSE` toggle word |
+| List row street | `--type-body-md` | 14px Geist 400 / 20px | Row street names |
+| List row distance | `--type-label-sm` | 10px Geist 700 / 12px, uppercase | Per-row remaining distance (`1.2 KM`) |
+| Guidance-card time | `--type-telemetry-num` | (as above) | Minutes remaining — the route card's time slot, evolved |
+| Guidance-card units/ETA | `--type-label-sm` | (as above) | `MIN`, `{km} KM`, `ETA 18:42` |
+| Card state line | `--type-body-sm` | 12px Geist 400 / 16px | Degradation copy (no-reroute), confirm-card body |
+| Confirm headline | `--type-headline-md` | (as above) | `Abandon route?` |
+| CTA labels | `--type-label-lg` (inside `.btn-*`) | 14px Space Grotesk 700 / 18px, uppercase | `END TRIP`, `YES, ABANDON`, `CONTINUE` |
+
+Unit formats are instrument constants, code-composed (Phase 3/5 precedent): distance `{n} M` under 1000 (integer), `{n.n} KM` at/over (one decimal), ETA clock 24-hour `HH:MM`, minutes `{n} MIN`. Units unchanged under `ms`. Body line-height ~1.43, heading 1.3 — token ratios verbatim.
+
+---
+
+## Color
+
+60 / 30 / 10 split unchanged. **The banner's arrow joins signal-orange's reserved-for list — navigation semantics, the Phase 1 reservation's natural fulfillment.** The reserved-for list is restated and extended:
+
+| Role | Value | Usage in Phase 6 |
+|------|-------|------------------|
+| Dominant (60%) | Rams basemap grayscale + shell chrome (unchanged) | The world stays grayscale; guidance ink reads against it |
+| Secondary (30%) | Instrument surfaces (unchanged) | Guidance card + list panel + confirm/trip-end cards: light `soft-beige` / dark `inverse-surface` via theme slots; banner + compact strip chassis `matte-black` (Rams-constant, strip precedent) |
+| Accent (10%) | `signal-orange` `#EB8008` | **Reserved-for list (exact, Phase 6 — supersedes the Phase 5 list where guidance surfaces are concerned):** every Phase 5 reservation (route line, heading cone, follow notch, focus brackets, lamps, primary CTA fill, press inverts); PLUS the banner maneuver arrow (32×32, 3px stroke — HUD spec); the machine-blink gantry square in REROUTING/RESUMING states (boot-card precedent); the next-maneuver row lamp + row glyph in the list; the progress-bar fill. Orange appears at most once per band, always meaning navigation |
+| Destructive | `functional-red` `#ED3F1C` | **Unchanged and NOT extended:** denied/signal-lost lamps only. Abandoning a route is a deliberate user action, not an error — the confirm card renders in standard card ink; the REROUTING and no-reroute states are deferrals, never failures — no red anywhere in guidance chrome |
+| Operational | `olive-green` `#736B1E` | LIVE lamp only (unchanged) |
+
+**Banner ink hierarchy (chassis discipline — three inks + one accent):** register line `chassis-subtle` (≈9:1 on black), street `soft-beige` (≈11.6:1 — the HUD spec's ink), distance `pure-white` (≈17:1 — maximum glance contrast), arrow + state square `signal-orange`. The HUD spec pins the arrow orange and the street soft-beige; the distance reads white (mockup precedent: `250 M` in pure-white) so the accent stays singular per band.
+
+**Turn-card PNG colors (D-12):** stroke `signal-orange` `#EB8008` on a `matte-black` `#1A1A1A` full-bleed plate — the banner's chat sibling; hex values copied verbatim from `tokens.css` as build constants (DSGN-01 precedent; the glyph script's source SVGs carry the literals).
+
+- **Opacity 1.0 everywhere** — physical planarity law. The one sanctioned translucency remains the Phase 3 accuracy circle (data grounding).
+- **Past-maneuver rows** render in `outline` ink (`#897363`, an existing token) — muted history, not hidden (the list is honest about where you have been).
+
+---
+
+## Maneuver Banner (D-06 — the top register's guidance occupant)
+
+Full-bleed matte-black chassis under the safe inset. The whole banner is the list toggle (`<button>`, full-width, hit height = banner height ≥ 44px).
+
+**Structure (single row, top→bottom within the band):**
+
+| Slot | Class / geometry | Content |
+|------|------------------|---------|
+| Register line | `.text-label-sm`, `chassis-subtle` ink, gap `space-xs` | `GUIDE // NEXT` — or the state word per the state table below (instrument vocabulary, en under both locales, composed in code from the `GUIDE` base key) |
+| Arrow plate | 48×48px `surface-dark` field | 32×32 inline SVG maneuver glyph, `signal-orange`, 3px stroke, square linecaps (the committed glyph set, in-app rendering) |
+| Distance | `.text-telemetry-num` `pure-white` + unit in `.text-label-sm` | `250 M` / `1.2 KM` — remaining distance to the maneuver, from `cumulativeDistanceM` + snapped progress (never raw fix-to-point distance, D-07); unknown during REROUTING/RESUMING = `—` (strip's unknown-value glyph) |
+| Street line | `.text-headline-md`, `soft-beige` ink, uppercase, single line, ellipsis overflow (the list carries the full name) | Street/designation verbatim from the route step `name` (data, not copy — destination-name rule); unnamed segment renders the `streetUnnamed` fallback copy |
+| Toggle word | `.text-label-sm`, `chassis-subtle` ink, right edge | `LIST` when collapsed / `CLOSE` when expanded (real-word affordance — no chevron decoration); `aria-expanded` carries the state |
+
+- **Recalculating-calm state (D-04):** register → `GUIDE // REROUTING`; street slot → the reroute copy (calm, no blame, no apology); distance → `—`; the 8px orange gantry square machine-blinks beside the copy (boot-card precedent: JS-timed two-state toggle ~500ms — an indicator duty cycle, not CSS animation). The arrow plate holds the last glyph — nothing spins, nothing blames.
+- **States are instant hard swaps** (no transitions — the shell law). The banner never blanks mid-swap: every state renders all five slots.
+
+---
+
+## Maneuver List (D-06 — collapsible, collapsed default)
+
+A `.card` panel in the center register (card geometry: max-width 320px, centered, `calc(100% - 2×margin)`), rendered **above** the map and below the banner while expanded; max-height 480px, inner scroll. **No dim layer, no modal chrome** — the boot-card precedent: the map stays visible and calm behind it.
+
+- **Toggle:** the banner (above). Collapsed by default — guidance's default state is banner + card, the map dominant.
+- **Tap-out collapses:** a full-viewport transparent layer beneath the panel (no dim — `background: transparent`) catches any map tap and collapses the list. Rams-clean, no overlay glass.
+- **Row anatomy (top→bottom, trip order):** glyph 24×24 (same committed set, 2px stroke rendering at this size — the icon family's uniform-weight rule) · street `body-md` (verbatim, ellipsis, full name in the row's `title`) · distance `label-sm` right-aligned (`{n} M` / `{n.n} KM` remaining to that maneuver).
+- **Row states:** NEXT (the banner's maneuver) = orange glyph + 8px orange square lamp at the row's left edge + on-surface ink; FUTURE = `matte-black` glyph + on-surface ink (dark theme: `inverse-on-surface`); PAST = `outline` glyph + `outline` ink.
+- **Rows are real text** (readable as-is, no aria required); glyphs are `aria-hidden`; the panel is `role="region"` with `aria-label` = `ariaManeuverList`; the banner button carries `aria-expanded` + `aria-controls`.
+- **Recalculating refresh (D-04):** on `ON_ROUTE` after a reroute, the list re-renders from the new route's steps — instant swap, scroll resets to top (the NEXT row is the first visible row).
+
+---
+
+## Guidance Card (D-06 — the route card evolved, bottom register)
+
+The Phase 5 route card's slots evolve in place — same card class, same bottom offset (64px composite), same builder discipline (createElement + textContent only; strings module only; no per-card padding overrides — the 05 addendum's `.card` child rules carry the rhythm).
+
+**Structure (top→bottom):**
+
+| Slot | Class | Content |
+|------|-------|---------|
+| Register | `.card-header` › `.card-ref` | `GUIDE` — the route card's `ROUTE` register, evolved (instrument vocabulary, en both locales) |
+| Headline | `.text-headline-md` | Destination name, verbatim — the continuity anchor holds |
+| Telemetry row | flex, gap `space-xs` | Minutes remaining in `.text-telemetry-num` + `MIN` in `label-sm` (the route card's time slot, now live and deadband-smoothed, D-07) · `{km} KM` in `label-sm` · `ETA 18:42` in `label-sm` (clock = now + smoothed minutes, updated on the same deadband) |
+| Progress bar | 4px, no radius | Track = `chassis-subtle` with a 1px `matte-black` border (checkbox geometry — distinguishable without color); fill = `signal-orange`, width = snapped progress %, set instantly per accepted fix (no transition). `role="progressbar"` + `aria-valuemin/max/now` + localized `aria-label` (`ariaTripProgress`) |
+| State line | `.text-body-sm` | ABSENT in the normal state (less, but better). Present only in the no-reroute degradation: the honest copy below |
+| Actions | `.card-actions` | One `.btn-secondary`: `END TRIP` → opens the abandon confirm card (the D-09 surface — the same confirm the BackButton and native-close paths reach). **No `.btn-primary` on the guidance card**: the drive's forward action is driving; orange CTA fill appears nowhere in guidance chrome except the reserved accents above |
+
+**Height budget: ≤ 200px** (register + headline + telemetry + bar + one action; the state line is the only conditional row). The camera bottom padding (64) + this budget keeps the puck's corridor clear, same arithmetic family as Phase 5.
+
+---
+
+## Abandon-Route Confirm Card (D-09 / PX-03)
+
+One confirm surface for ALL guidance exits: the guidance card's `END TRIP`, the BackButton from guidance, and the defense-in-depth native closing confirmation (the Rams card is the designed surface; the native dialog is the net behind it — research Open Q 2 recommendation, planner wires it). Standard card anatomy, **bottom register** (thumb-reach call — confirmations live where one-handed thumbs are; the banner is glance-only, never a decision surface).
+
+| Element | en | ms (Bahasa Melayu) |
+|---------|----|--------------------|
+| Register | `GUIDE // CONFIRM` | `GUIDE // CONFIRM` (instrument vocabulary) |
+| Headline | `Abandon route?` | `Tinggalkan laluan?` |
+| Body | `Guidance stops and this trip's record is deleted. Nothing is stored.` | `Panduan berhenti dan rekod perjalanan ini dipadam. Tiada apa-apa disimpan.` |
+| Primary CTA (`.btn-primary`) | `YES, ABANDON` | `YA, TINGGALKAN` |
+| Secondary CTA (`.btn-secondary`) | `CONTINUE` | `TERUSKAN` |
+
+- The body's deletion clause is the brand speaking (PRIV-01: the privacy promise stated once, clinically, at the exact moment it executes — D-14).
+- `YES, ABANDON` is `.btn-primary` (the working forward path — Phase 3 denied-card mapping precedent). **Not red:** abandoning is deliberate, not a failure; orange = primary action semantics; the confirm card carries no red.
+- While the confirm card is open, a BackButton click means CONTINUE (dismiss, stay in guidance — the no-dead-ends law applied to the confirm layer).
+- Both CTAs are full component-class buttons ≥ 44px effective height; `:focus-visible` brackets are built into `.btn-*` (Phase 3).
+
+---
+
+## Trip-Ended Card (D-14 — PRIV-01's in-app half, visible)
+
+Renders in the **center register** the instant the trip ends — arrival (snapped progress ≥ `ARRIVAL_THRESHOLD_M`) or abandon (confirm path). Both paths: guidance chrome (banner, list, guidance card) clears instantly, the envelope is DELETEd server-side (the KV record gone — the TTL law's promise executed actively), the watch stops (the trip is over — privacy-minimal), and the camera holds its last pose.
+
+| Element | en | ms (Bahasa Melayu) |
+|---------|----|--------------------|
+| Register | `GUIDE // END` | `GUIDE // END` (instrument vocabulary) |
+| Headline | `Trip ended` | `Perjalanan tamat` |
+| Body | `Route guidance stopped and the trip record is deleted — nothing about this drive remains.` | `Panduan laluan dihentikan dan rekod perjalanan dipadam — tiada apa-apa tentang pemanduan ini kekal.` |
+
+- ONE card for arrival and abandon — both delete, one message (less, but better).
+- The card persists until the next action (no silent auto-dismiss — honesty law); the BackButton is visible and walks to the search root; a new destination resolution replaces it through the Phase 4/5 chain.
+
+---
+
+## Turn-Card Chat Message (D-12 — the minimized handoff's surface)
+
+A Telegram chat message pushed by the Worker cron (D-11): `sendPhoto` with the maneuver glyph PNG + an HTML caption + one inline button. It is chat content, not app chrome — Telegram renders the text; the spec pins the composition. Owned strings live in the **bot** strings module (`bot/src/i18n/strings.ts` pattern; the bot copy gate asserts them), not the web module.
+
+### The 8-glyph set (committed once, reused everywhere)
+
+| # | Kind | Maneuver meaning | Glyph geometry (32×32 grid, 3px stroke, square caps, orthogonal/45° only) |
+|---|------|------------------|---------------------------------------------------------------|
+| 1 | `depart` | Trip start onto the first road | 4×4 filled square (origin-ring echo) + vertical shaft up |
+| 2 | `straight` | Continue ahead | Vertical shaft + orthogonal arrowhead |
+| 3 | `left` | Turn left | Up shaft + 90° left head (the mockup's turn glyph family) |
+| 4 | `right` | Turn right | Mirror of `left` |
+| 5 | `slight-left` | Keep left | 45° up-left shaft + head |
+| 6 | `slight-right` | Keep right | Mirror of `slight-left` |
+| 7 | `uturn` | U-turn (routed for real in v1 — D-01 defers turn restrictions, so the graph WILL produce them; the glyph is honest about it) | Up shaft, orthogonal 90° left, down shaft — a machined staple, no arc (orthogonal law) |
+| 8 | `arrive` | Arrival | Vertical shaft ending on the 12×12 filled square + tail — the Phase 5 destination-pin glyph, promoted |
+
+Production: hand SVGs (source of truth, committed) → `build-glyphs.mjs` (sharp) → 256×256 PNGs committed beside the bot's static assets, served from the Worker's static handler (sendPhoto fetches the public URL — research-verified). Stroke `#EB8008` on a full-bleed `#1A1A1A` plate, 256×256 output (chat renders it ~48–96px; the oversize keeps edges crisp). In-app, the SAME paths render as inline SVG at 32×32 (banner) / 24×24 (list).
+
+### Caption layout (HTML parse mode, ≤1024 chars — verified budget; ~200 used)
+
+```
+GUIDE // T-07
+<b>250 M — TURN RIGHT ONTO JALAN SULTAN ISMAIL</b>
+ETA 18:42 · 7.8 KM LEFT
+Best-effort projection — updates while the app is minimized.
+```
+
+| Line | Source | Rules |
+|------|--------|-------|
+| Register | `GUIDE // T-{nn}` — instrument constant, code-composed (nn = zero-padded maneuver index) | en both locales; plaintext |
+| Maneuver line | `{dist} — {action} onto {street}` — the 8 localized action verbs below; street verbatim from the step `name` | `<b>` wrapped, uppercase (instrument voice); `streetUnnamed` fallback |
+| Telemetry line | `ETA {time} · {km} KM LEFT` template — projected ETA/remaining from the envelope snapshot (the cron's projection, D-11) | plaintext; formats identical to app constants |
+| Honesty line (D-13) | fixed copy | plaintext, never promises live tracking; the 8 verbs, `OPEN` button label, and both templates are localized en/ms |
+
+**Localized action verbs (the caption's `{action}`):** `DEPART`/`MULA` · `CONTINUE ON`/`TERUS KE` · `TURN LEFT ONTO`/`BELOK KIRI KE` · `TURN RIGHT ONTO`/`BELOK KANAN KE` · `KEEP LEFT ONTO`/`SEDAKIT KIRI KE` · `KEEP RIGHT ONTO`/`SEDAKIT KANAN KE` · `MAKE A U-TURN ONTO`/`BUAT PUSARAN KE` · `ARRIVE AT`/`TIBA DI`.
+
+**Inline button:** one button, `OPEN GUIDANCE` / `BUKA PANDUAN`, carrying the Mini App direct-link with the guidance id (research Open Q 1: `startapp`/`?g=` knob — planner picks the exact name) so a killed webview resumes from the envelope. `reply_markup` rides the same `sendPhoto` call.
+
+**Push cadence (UX-visible half of D-11/D-13):** a card pushes when the projected next maneuver changes (or every N minutes — discretion); cron pushes pause while the app is foregrounded (structural: the envelope is DELETEd on resume, re-POSTed at minimize). Cron lag and Telegram delivery variance are documented behaviors — the copy says "best-effort", the mechanism means it.
+
+---
+
+## Camera Behavior (D-10)
+
+| Event | Camera action | Parameters |
+|-------|---------------|------------|
+| Guidance starts | Snap to locked-follow | `easeTo` snapped position: padding `{ top: 320, bottom: 64, left: 64, right: 64 }` (center ≈65% down-screen), `pitch: 35` (the standing pitch — never changed by guidance), `zoom: 16` (named constant `GUIDANCE_ZOOM` — urban detail; replay-tunable), duration 400ms |
+| Per accepted fix (≥10 m / ≥5 s, D-15) | Ease along the snapped line | `easeTo` the **snapped** progress point (D-05: one authority — the camera rides the same line the banner reads, never the raw fix), duration 400ms (`GUIDANCE_EASE_MS` — the `RECENTER_DURATION_MS` family, one easing discipline) |
+| User pans/zooms | Existing `movestart` `originalEvent` rule → follow unlocks; the recenter control's notch clears (Phase 3 `free` state returns) | The route line, banner, and card are untouched — unlock is camera-only |
+| Recenter tap while unlocked | Re-lock locked-follow: `easeTo` snapped point, guidance padding, notch returns | Phase 3 control semantics, guidance parameters |
+| Reroute snaps in (D-04) | No camera jump — the new route's snapped line simply continues under the puck | Instant `setData` (map motion settles naturally on the next per-fix ease) |
+| Trip ends | Camera holds its last pose | No move; the watch has stopped |
+
+- **Bearing stays north-up (recorded call):** guidance never rotates the map — Phase 3/5 never touched bearing; the heading cone already communicates direction; a rotating map contradicts the calm-instrument posture. Pitch stays 35 per D-10 and the standing law.
+- Camera moves are map-viewport behavior — permitted motion; the chrome never animates (Phase 3 law stands).
+
+---
+
+## State Coexistence — Guidance States (D-03/D-04/D-14)
+
+One guidance surface set; states swap instantly. The Phase 5 coexistence table stands beneath this one (boot/pending/destination states are unchanged when guidance is not active).
+
+| State | Banner | Guidance card | List | Map/camera | Strip |
+|-------|--------|---------------|------|------------|-------|
+| Guidance active (ON_ROUTE) | `GUIDE // NEXT`, glyph + distance + street | normal (no state line) | collapsed (toggle opens) | locked-follow, route stack as Phase 5 | compacted, lamp/word unchanged |
+| OFF_ROUTE (grace window, pre-reroute) | unchanged — still `GUIDE // NEXT` (no premature signal; the machine acts, not warns) | unchanged | unchanged | locked-follow | unchanged |
+| REROUTING (D-04 calm state) | `GUIDE // REROUTING`, street slot → reroute copy, distance `—`, gantry blink | unchanged (last honest numbers hold) | unchanged (stale-but-labeled) | locked-follow on old line until the new line snaps | unchanged |
+| ON_ROUTE after reroute | `GUIDE // NEXT` with the new maneuver; list re-rendered | ETA/remaining continue from the new model (EMA state persists — no whiplash, D-07) | re-rendered, scrolled to top | same line-style paint, new geometry (`setData`) | unchanged |
+| Router-pending degradation (graph absent, D-03 — excursion while reroute impossible) | `GUIDE // NO REROUTE`, street slot → degradation copy, distance `—` | state line carries the longer honest copy; card otherwise unchanged | unchanged | route line stays drawn (fixture/engine route is real); locked-follow continues | unchanged. **No red** — a designed deferral, not an error (router-pending precedent) |
+| Resuming (re-open before first fix, D-11/D-06) | `GUIDE // RESUMING`, distance from envelope projection, gantry blink | projected numbers (labeled honest by the banner state) | collapsed | locked-follow at projected position | unchanged |
+| First fix after resume | `GUIDE // NEXT` — live numbers | live numbers | — | snapped progress corrected | unchanged |
+| Arrived / abandoned (D-14) | cleared instantly | → trip-ended card (center) | cleared | camera holds; watch stops | returns to full-height live strip |
+| Minimize (webview `deactivated`) | — | — | — | — | envelope POSTed (best-effort, D-13); cron turn-cards begin in chat |
+
+Guidance never starts without a route: a router-pending route state keeps the Phase 5 pending card and binds NO PX-03 protections (nothing to abandon — swipe/close stays native, BackButton shows for the pending state per Phase 5).
+
+---
+
+## Copywriting Contract (copy tone: clinical, honest — D-01/D-13; en + ms; web keys join `web/src/i18n/strings.ts`, bot keys join the bot strings module; never inline — the copy gates)
+
+New `ShellStrings` keys (web side; registers and unit formats are instrument constants in both locales):
+
+| Key | en | ms |
+|-----|----|----|
+| `guideRegister` | `GUIDE` | `GUIDE` |
+| `guideStreetUnnamed` | `Unnamed road` | `Jalan tanpa nama` |
+| `guideReroutingLine` | `Finding a new route from where you are.` | `Mencari laluan baharu dari kedudukan anda.` |
+| `guideResumingLine` | `Resuming from your last known progress.` | `Sambung semula dari kemajuan terakhir anda.` |
+| `guideNoRerouteLine` | `Rerouting unavailable on this server.` | `Pengiraan semula tiada pada pelayan ini.` |
+| `guideNoRerouteBody` | `No road graph here — follow the drawn route; recalculation is unavailable.` | `Tiada graf jalan di sini — ikut laluan yang dilukis; pengiraan semula tidak tersedia.` |
+| `ctaBannerList` | `LIST` | `SENARAI` |
+| `ctaBannerClose` | `CLOSE` | `TUTUP` |
+| `ctaEndTrip` | `END TRIP` | `TAMAT PERJALANAN` |
+| `guideConfirmHeadline` | `Abandon route?` | `Tinggalkan laluan?` |
+| `guideConfirmBody` | (confirm table above) | (confirm table above) |
+| `ctaConfirmAbandon` | `YES, ABANDON` | `YA, TINGGALKAN` |
+| `ctaConfirmContinue` | `CONTINUE` | `TERUSKAN` |
+| `guideEndHeadline` | `Trip ended` | `Perjalanan tamat` |
+| `guideEndBody` | (trip-end table above) | (trip-end table above) |
+| `ariaManeuverList` | `Full maneuver list` | `Senarai penuh manuver` |
+| `ariaBannerToggle` | `Next maneuver` | `Manuver seterusnya` |
+| `ariaTripProgress` | `Trip progress` | `Kemajuan perjalanan` |
+
+Bot-side keys (turn-cards): `cardAction{Depart,Straight,Left,Right,SlightLeft,SlightRight,Uturn,Arrive}` (verbs above), `cardEtaTemplate` `ETA {time} · {km} KM LEFT` / `ETA {masa} · {km} KM LAGI`, `cardHonesty` `Best-effort projection — updates while the app is minimized.` / `Unjuran cuba terbaik — dikemas kini semasa aplikasi diminimumkan.`, `cardOpenButton` `OPEN GUIDANCE` / `BUKA PANDUAN`. Register lines (`GUIDE // NEXT`, `GUIDE // T-07`, …) are instrument constants composed in code.
+
+- **Primary CTA:** `YES, ABANDON` only (the confirm card). Orange CTA fill is otherwise absent from guidance chrome.
+- **Empty state:** not applicable — guidance renders only over a live route; the pre-guidance empty states are the Phase 3/4/5 surfaces (unchanged).
+- **Error state:** the no-reroute degradation IS the honest error-adjacent state (graph absent, D-03) — standard ink, no red, never blank. A reroute request failure renders the same state (fail-honest, banner stays calm).
+- **Destructive actions:** exactly one — abandoning the trip. It is guarded by the confirm card on every path (card button, BackButton, native-close net). Both exit paths execute the D-14 deletion and show the trip-end card.
+- **Honesty law (D-13) applied:** the turn-card never says "live", "real-time", or "guaranteed" — "best-effort projection" is the strongest claim the mechanism supports; the resuming banner labels projected numbers as resuming until a live fix lands.
+
+**Copy gate:** the strings-module tests assert exactly these keys in en + ms (web + bot modules); no guidance copy inline in `web/src/guidance/*`, `shell.css`, or the cron handler.
+
+---
+
+## Transitions & Micro-Behaviors (inside Rams rules)
+
+- **No CSS `transition`/`animation` anywhere in chrome** — unchanged law. Banner states, list expand/collapse, card swaps: instant hard swaps (no height animation on the list).
+- **Machine-blink gantry** (boot-card precedent) is the only loading indicator: REROUTING and RESUMING states blink the 8px orange square at ~500ms via JS timer — two visible states, an indicator duty cycle, never an easing pulse.
+- Progress bar: width set per accepted fix, instant, no transition. A bar that glides is a chart; a bar that steps is an instrument.
+- Camera easing (400ms `easeTo` per fix) is map-viewport motion — permitted; chrome never moves.
+- Turn-card arrival in chat: Telegram's own message rendering — no app-side animation exists or is wanted.
+- No blur, no shadow, no glass, no pulse on the route line. A driven route is static geometry; only state changes it.
+
+---
+
+## Close Protection (PX-03 — the three layers, wired on guidance start, unwound at trip end)
+
+| Layer | API (version guard) | Wiring |
+|-------|--------------------|--------|
+| Body-swipe minimize off | `disableVerticalSwipes()` (Bot API 7.7+) | On guidance start; `enableVerticalSwipes()` at trip end; capability-guarded `?.` chains per the contract style |
+| Native close confirm (defense-in-depth — the header swipe cannot be disabled, official docs) | `enableClosingConfirmation()` (6.2+) | On guidance start; disabled at trip end. The Rams confirm card remains the designed surface; the native dialog is the net (research recommendation) |
+| In-app exits | the abandon confirm card | `END TRIP`, BackButton-from-guidance, and any post-native-confirm return path land on the same card |
+
+Safe areas: the banner sits at `safe-top + space-sm` (the strip's existing `--safe-top` var); the guidance/confirm cards clear `safe-bottom` via the 64px composite; insets resolve via the Phase 3 `resolveSafeInsets` union (env ∩ Telegram 8.0+, max per edge) — nothing interactive in the home-indicator zone; the basemap extends under bars.
+
+---
+
+## BackButton Contract (PX-01 — the full state graph, never dead-ends)
+
+The Phase 5 wire (`wireBackButton(wa, hasOverlay, walkBack)` — predicate + handler as one change) extends to a context-aware `walkBack`:
+
+| App state | BackButton | Click behavior |
+|-----------|------------|----------------|
+| Boot stages / destination card (root) | hidden (unchanged) | — |
+| Route state | `show()`; click → walk back | Phase 5 walk: clears route layers, card swaps to destination card, refollow, `hide()` |
+| **Guidance state** | `show()`; click → **opens the abandon confirm card** (bottom register) | Guidance is a pushed state — never torn down silently. `YES, ABANDON` → guidance teardown (chrome clears, envelope DELETE, watch stops) → **route card state** (the route still exists in memory). `CONTINUE` → card dismisses, guidance continues |
+| Route state (post-abandon) | `show()`; click → walk back | The Phase 5 route walk → destination card (search root), `hide()` |
+| **Trip-ended card** | `show()`; click → walk to search root | Card clears, `hide()` — the graph's exit ramp |
+| Confirm card open + BackButton click | (guidance still active) | Means CONTINUE — dismiss the card, stay in guidance (no stacked dialogs) |
+
+The full walk — search → routes → guidance → (confirm) → routes → search — presses Back at most once per state; the button is visible exactly when a pushed state exists; its handler is never a no-op; `close()` fires only at the true root (Telegram semantics). No dead ends.
+
+---
+
+## Haptics (D-08 — the eyes-free channel)
+
+| Event | Cue | Trigger point | Guard |
+|-------|-----|---------------|-------|
+| Maneuver approach | `HapticFeedback.selectionChanged()` | Snapped progress within 300 m of the next maneuver (named constant `APPROACH_HAPTIC_M` — replay-tunable); fires once per maneuver | Bot API 6.1+ / `?.` chain — graceful no-op |
+| Maneuver point | `HapticFeedback.impactOccurred("medium")` | Snapped progress crosses the step boundary (once, edge-triggered) | as above |
+| Arrival (discretion extension of the same mechanism) | `HapticFeedback.notificationOccurred("success")` | `ARRIVAL_THRESHOLD_M` crossed — the trip-end card's tactile twin for eyes-on-road | as above |
+
+No haptic on reroute (the banner stays calm — a haptic would announce blame), none on confirm dialogs (visual + thumb is enough). Every cue is once-per-edge, replay-tested with the state machine.
+
+---
+
+## Accessibility & Device Notes
+
+- **Contrast (computed, WCAG):** `pure-white` on `matte-black` ≈ 17:1 (distance — the glance datum, AAA); `soft-beige` on `matte-black` ≈ 11.6:1 (street, AAA); `chassis-subtle` on `matte-black` ≈ 8.9:1 (register line, AAA); card ink `matte-black` on `soft-beige` ≈ 11.6:1 (AAA); `signal-orange` used only for graphics/fills beside ≥ AA text (arrow, lamps, bar fill — non-text UI elements ≥ 3:1 against their fields, reinforced by the bar's 1px border).
+- **Thumb-reach:** destructive confirm at the bottom register (one-handed reach); banner interactions are glance + whole-band tap (no precision targets at the top); the recenter control keeps its ≥44px hit target.
+- **Hit targets:** banner toggle = full band; list rows are non-interactive text (the list is a readout, not a menu — less, but better); card buttons are component-class.
+- **Screen readers:** banner = one toggle button (`aria-expanded`, `aria-controls`, `aria-label`); list = labelled region of real text rows; progress bar = `progressbar` with valuetext; glyphs/lamps `aria-hidden`; state is never carried by color alone (register words, gantry, card state line are text).
+- **Haptics degrade silently** (D-08); safe-area layout degrades to pure `env()` on old clients (Phase 3 law); every Telegram call is capability-guarded per the contract style (research Pitfall 5).
+
+---
+
+## Capture Profiles (extends `web/scripts/capture.mjs` + the Mock-Telegram harness)
+
+New harness knob and legs; all existing legs unchanged:
+
+| Artifact | Profile | Asserts |
+|----------|---------|---------|
+| Harness knob `?drive=<fixture>` | the mock's Telegram fix source replays a committed drive fixture (the D-16 replay JSON streams — corridor follow / off-route excursion / missed-turn excursion) through the live shell; pairs with `?dest=` + `?fixpair=` carriers | `ARAHARAH-GUIDE state=<state>` signals (state tokens only — no coordinates in console, D-15 hygiene) |
+| `shell-guidance-active.png` | `mock=android&dest=<golden-id>&fixpair=<pair>&drive=<corridor>`, light theme | banner (`GUIDE // NEXT`, arrow, distance, street) + compact strip + guidance card + progress bar + locked camera pose |
+| `shell-guidance-list.png` | same, after a scripted banner tap | list panel expanded over the map, NEXT row lamp, collapsed-by-default proof = the active leg's complement |
+| `shell-guidance-rerouting.png` | `drive=<missed-turn>` captured inside the REROUTING window | calm banner state (reroute copy, `—` distance, gantry), NO red anywhere |
+| `shell-guidance-confirm.png` | scripted `END TRIP` tap | confirm card in the bottom register, both CTAs, no red |
+| `shell-guidance-tripend.png` | scripted `YES, ABANDON` | trip-ended card (center), guidance chrome cleared |
+| `shell-guidance-dark.png` | active profile, `scheme=dark` | PX-02: chrome re-slots, banner/chassis Rams-constant |
+| `guidance-gallery-compare.png` | DSGN-02 side-by-side vs `active_route_guidance/screen.png` | fidelity artifact for the phase gallery |
+
+Turn-card captions are asserted by the bot-side suite + copy gate (`bot/test/guidance-cron.test.mjs` — caption composition, verb table, ≤1024 budget), not by browser capture.
+
+Bundle-budget note (planner-facing): guidance chrome is DOM builders + the inline glyph paths — inside the ≤ ~200KB gzipped BA gate. The glyph PNGs ride the bot's static assets (never the web bundle); `sharp` is a maintainer devDependency only (research-verified).
+
+---
+
+## Fidelity Artifact (DSGN-02 obligation)
+
+Phase exit extends the gallery pattern: the seven guidance captures above beside `active_route_guidance/screen.png`, reviewed for fidelity before phase close. Where this document, the mockup markup, and `tokens.css` disagree: `tokens.css` wins, the mockup loses, this spec records the call. Recorded calls:
+
+- Mockup's **lane-assignment matrix, incident telemetry band, speedometer + limit medallion, telemetry gauge deck** → deferred features (incidents v2, speed limits v1.x, REQUIREMENTS deferred table) — scrubbed, nothing placeholder-shaped.
+- Mockup's **REROUTE VIA TELEGRAM BOT / REPORT HAZARD / AUDIO** buttons → no such actions exist in v1 scope; guidance's only action is END TRIP.
+- Mockup's **backdrop-blur header + rounded puck/medallions** → scrubbed (existing law: no blur, zero radius — the Phase 3 machined marker stands).
+- Mockup's **arrow glyph at stroke 4 / 40×40 grid** → HUD spec's 32×32 / 3px wins (the committed set's geometry).
+- Mockup's **56px (`w-14`) arrow plate** → 48×48 (32 glyph + 2×8 breathing; 12×8 grid).
+- Mockup's orange **distance number** → `pure-white` wins (accent-singular-per-band; the arrow carries the orange).
+
+---
+
+## Registry Safety
+
+| Registry | Blocks Used | Safety Gate |
+|----------|-------------|-------------|
+| shadcn official | none (not initialized; gate N/A for the no-framework stack) | not required |
+| third-party | none — glyph PNGs are committed artifacts built from committed hand SVGs via a maintainer sharp script (no registry, no CDN, no runtime dependency); map tiles remain an OpenFreeMap runtime data fetch, not a code dependency | not required |
+
+---
+
+## Checker Sign-Off
+
+- [ ] Dimension 1 Copywriting: PASS
+- [ ] Dimension 2 Visuals: PASS
+- [ ] Dimension 3 Color: PASS
+- [ ] Dimension 4 Typography: PASS
+- [ ] Dimension 5 Spacing: PASS
+- [ ] Dimension 6 Registry Safety: PASS
+
+**Approval:** pending
+
+---
+
+*Phase: 06-turn-by-turn-guidance-live-driving*
+*Contract drafted: 2026-10-24 by gsd-ui-researcher*
+*Consumes: theme tokens (binding), liberty-rams.json layer order, 06-CONTEXT.md D-01..D-16, 05-UI-SPEC.md (binding conventions), 03-UI-SPEC.md (binding conventions), telemetry_rams/DESIGN.md §Navigation Heads-Up Display, DESIGN.md palette semantics, Phase 5 frozen GuidanceSessionEnvelope*
diff --git a/.planning/phases/07-hardening-private-launch/07-01-PLAN.md b/.planning/phases/07-hardening-private-launch/07-01-PLAN.md
index 888987d..75ffe9f 100644
--- a/.planning/phases/07-hardening-private-launch/07-01-PLAN.md
+++ b/.planning/phases/07-hardening-private-launch/07-01-PLAN.md
@@ -547,8 +547,8 @@ unchanged.
     - `grep -c "requestGuidanceFullscreen(" web/src/route/route.ts` returns exactly 2 (activateGuidance + resume — the CALL sites; the import line does not match because it carries no `(`)
     - `grep -c "exitGuidanceFullscreen(" web/src/route/route.ts` returns exactly 2 (teardownGuidance + stopGuidanceArtifacts)
     - `grep -c "watchFullscreenEvents(" web/src/route/route.ts` returns exactly 1 (registered ONCE, at the guidance-start edge)
-    - `grep -c "engageCloseProtection" web/src/route/route.ts` returns 2 (unchanged — the count did not move)
-    - `grep -c "releaseCloseProtection" web/src/route/route.ts` returns 2 (unchanged)
+    - `grep -c "engageCloseProtection(" web/src/route/route.ts` returns exactly 2 (the CALL sites — activateGuidance + resume; the import line carries no `(` and so is not counted, which is why the paren form is used)
+    - `grep -c "releaseCloseProtection(" web/src/route/route.ts` returns exactly 2 (the CALL sites — teardownGuidance + stopGuidanceArtifacts; unchanged, import + 2 calls)
     - `grep -c "watchSafeAreaChanges(" web/src/main.ts` returns exactly 1 (the boot-site CALL site)
     - `grep -c "watchSafeAreaChanges" web/src/telegram/safe-area.ts` returns ≥ 1 (the export still exists)
     - `grep -c "watchFullscreenEvents" web/src/telegram/fullscreen.ts` returns ≥ 1 (the export still exists)
diff --git a/.planning/phases/07-hardening-private-launch/07-03-PLAN.md b/.planning/phases/07-hardening-private-launch/07-03-PLAN.md
index f86da32..1e233ca 100644
--- a/.planning/phases/07-hardening-private-launch/07-03-PLAN.md
+++ b/.planning/phases/07-hardening-private-launch/07-03-PLAN.md
@@ -274,7 +274,7 @@ reading"). Do NOT write a smarter stripper. The header comment must say so.
     - `grep -c "web/src\|bot/src\|routing/src\|search/src" scripts/lib/source-gates.mjs` returns ≥ 4 (the scan is repo-wide, not web-only)
   </acceptance_criteria>
   <verify>
-    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && node --check scripts/lib/source-gates.mjs && echo "syntax ok" && node -e "import('./scripts/lib/source-gates.mjs').then(m=>{for(const k of ['runStorageGate','runKvTtlGate','runLogVocabularyGate','runRuntimeHostGate']){const r=m[k]();console.log(r.id+': '+(r.pass?'PASS':'FAIL')+' — '+r.evidence.slice(0,200));}})"</automated>
+    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && node --check scripts/lib/source-gates.mjs && echo "syntax ok" && node -e "import('./scripts/lib/source-gates.mjs').then(async m=>{for(const k of ['runStorageGate','runKvTtlGate','runLogVocabularyGate','runRuntimeHostGate']){const r=await m[k]();console.log(r.id+': '+(r.pass?'PASS':'FAIL')+' — '+r.evidence.slice(0,200));}})"</automated>
   </verify>
   <done>
     The four source gates run over every production tree, print their
diff --git a/.planning/phases/07-hardening-private-launch/07-04-PLAN.md b/.planning/phases/07-hardening-private-launch/07-04-PLAN.md
index 3abf838..5fc3353 100644
--- a/.planning/phases/07-hardening-private-launch/07-04-PLAN.md
+++ b/.planning/phases/07-hardening-private-launch/07-04-PLAN.md
@@ -364,7 +364,7 @@ Cloudflare's own footnote (the evidence quotes it, it does not interpret it).
     - `grep -c "subrequest" scripts/lib/budget-gates.mjs` returns ≥ 1 (the 50/request ceiling has an inventory beside it)
   </acceptance_criteria>
   <verify>
-    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && node --check scripts/lib/budget-gates.mjs && node -e "import('./scripts/lib/budget-gates.mjs').then(async m=>{for(const k of ['runCpuLadderGate','runBundleBudgetGate','runKvWriteClassGate','runSubrequestClassGate','runCacheHeaderGate','runGoldenCorpusGate']){const r=m[k]();console.log(r.id+': '+(r.notRun?'NOT RUN':(r.pass?'PASS':'FAIL'))+' — '+String(r.evidence).slice(0,160));}})"</automated>
+    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && node --check scripts/lib/budget-gates.mjs && node -e "import('./scripts/lib/budget-gates.mjs').then(async m=>{for(const k of ['runCpuLadderGate','runBundleBudgetGate','runKvWriteClassGate','runSubrequestClassGate','runCacheHeaderGate','runGoldenCorpusGate']){const r=await m[k]();console.log(r.id+': '+(r.notRun?'NOT RUN':(r.pass?'PASS':'FAIL'))+' — '+String(r.evidence).slice(0,160));}})"</automated>
   </verify>
   <done>
     The six budget gates measure and print the CPU p95 (by re-running the
diff --git a/.planning/phases/07-hardening-private-launch/07-06-PLAN.md b/.planning/phases/07-hardening-private-launch/07-06-PLAN.md
index 86becec..5eb5fed 100644
--- a/.planning/phases/07-hardening-private-launch/07-06-PLAN.md
+++ b/.planning/phases/07-hardening-private-launch/07-06-PLAN.md
@@ -432,9 +432,12 @@ In `.planning/STATE.md`:
 
 In `.planning/ROADMAP.md`:
 1. Mark the Phase 7 entry `- [ ]` → `- [x]` and add `(completed 2026-10-25)`.
-2. Replace `**Plans:** TBD` under Phase 7 with `**Plans:** 6 plans`.
-3. Fill the Phase 7 plan list with the six plan files and their one-line
-   objectives, marking them `[x]`.
+2. The Phase 7 entry already carries `**Plans**: 6 plans` — LEAVE that count
+   line as it is; do NOT replace it and do NOT introduce a `TBD` placeholder.
+3. The six Phase 7 plan entries and their one-line objectives already exist in
+   the ROADMAP's plan list — mark each of the six `[x]` (they are done once
+   this task runs). Do NOT add a seventh entry and do NOT reword the six
+   objectives.
 4. Update the `## Progress` table's Phase 7 row to `6/6 | Complete | 2026-10-25`.
 5. Leave every other phase's rows untouched.
 
@@ -445,11 +448,11 @@ phase's text.
     - `.planning/STATE.md` frontmatter contains `status: complete`
     - `.planning/STATE.md` contains the literal `ZERO telemetry` in the Decisions list
     - `.planning/STATE.md` contains the literal `ALT landmark preprocessing` in the Deferred Items table
-    - `.planning/ROADMAP.md` contains `**Plans:** 6 plans` under Phase 7 and the phase line contains `- [x] **Phase 7:`
+    - `.planning/ROADMAP.md` contains `**Plans**: 6 plans` under Phase 7 and the phase line contains `- [x] **Phase 7:`
     - `.planning/ROADMAP.md`'s Phase 7 progress row contains `6/6`
   </acceptance_criteria>
   <verify>
-    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && grep -c "status: complete" .planning/STATE.md && grep -c "\*\*Plans:\*\* 6 plans" .planning/ROADMAP.md && grep -c "6/6" .planning/ROADMAP.md</automated>
+    <automated>export PATH="$HOME/.nvm/versions/node/v24.18.0/bin:$PATH"; cd /home/C-Fu/araharah && grep -c "status: complete" .planning/STATE.md && grep -c "\*\*Plans\*\*: 6 plans" .planning/ROADMAP.md && grep -c "6/6" .planning/ROADMAP.md</automated>
   </verify>
   <done>
     STATE.md records the completed milestone with the binding decisions and the
diff --git a/.planning/phases/07-hardening-private-launch/07-CONTEXT.md b/.planning/phases/07-hardening-private-launch/07-CONTEXT.md
new file mode 100644
index 0000000..2df8983
--- /dev/null
+++ b/.planning/phases/07-hardening-private-launch/07-CONTEXT.md
@@ -0,0 +1,113 @@
+# Phase 7: Hardening + Private Launch - Context
+
+**Gathered:** 2025-10-25
+**Status:** Ready for planning
+
+<domain>
+## Phase Boundary
+
+The final phase hardens everything phases 1–6 shipped and closes with a checklist-signed private launch: one consolidated privacy-audit tool (zero-telemetry v1, PRIV-02/GEO-03 re-verified end-to-end), PX-04 fullscreen + landscape QA across the full device matrix with a measured battery-drain record (<10%/hr), a consolidated budget record (CPU/subrequests/bundles/KV), all parked review debts paid (the 3 deferred INFOs; /cari re-arm attempt + honest documentation), the known-limitations doc shipped and linked from /help — and the private beta launched to the user's first KL drivers when the checklist signs.
+
+No new product features. This phase hardens outcomes; its empty/error states ARE the polish surface.
+
+</domain>
+
+<decisions>
+## Implementation Decisions
+
+### Privacy audit (SC3)
+- **D-01:** A **consolidated automated audit script** (`npm run privacy-audit`, repo tool): grep gates over ALL src trees (no storage-API writes outside the platform allowlist — the phase-3 gate's law extended repo-wide; no coordinate/payload logging — the category-only vocabulary verified by schema scan), a KV listing probe (only TTL-keyed namespaces), a bundle scan (**zero telemetry: no analytics, no beacons — the ONLY runtime fetches are OpenFreeMap tiles, the Telegram API, and the app's own Worker endpoints**), plus a **signed written audit record** citing the evidence (PRIV-02/GEO-03 re-verified end-to-end). Reusable by forks (GPL audit tool).
+- **D-02:** **Zero telemetry in v1** — opt-in telemetry stays an IDEAS.md aspiration post-validation; nothing to opt into yet, nothing to audit but absence.
+
+### Device matrix + battery (SC1, PX-04)
+- **D-03:** **Fullscreen on guidance start** via `requestFullscreen()` behind the 8.0 capability guard (phase-6 guard precedent), with orientation-lock used where available; landscape usability per device in the QA pass; landscape layout fixes are CSS-only media queries (tokens binding; the cockpit/banner/card geometry adapts, the map stays Rams-constant).
+- **D-04:** The **battery target is a RECORDED real measurement**: one Android guidance run ≥30 min screen-on, battery % read at start/end (method + caveats written into the gate file); the D-15 distance-throttle is the software half. The <10%/hr target is recorded as measured, never synthesized (no bench harness — over-engineering for one phone).
+- **D-05:** The QA pass is **one consolidated walk**: Android + iOS + Desktop + browser × (boot, search→route, guidance, minimize/resume, trip-end, theme flip, landscape/fullscreen) — a single checklist in the phase gate file; user walks once; NOT-RUN legs recorded honestly (the phase 3/4 protocol; iOS legs if the device is available — Phase 4 verified iOS present).
+
+### Budgets + deferred debt (SC4)
+- **D-06:** A **consolidated budget record** (`npm run budget-audit` output + written record checked into verification): Worker CPU/subrequests (06-04's measured ladder re-run against the live graph), bundle sizes (BA9 et al.), KV write counts per request class (cron = 0 writes — the free-plan law), asset cache headers. Current numbers vs free-tier limits, in one document.
+- **D-07:** **Debts paid here**: (1) 02-REVIEW's 3 deferred INFOs — IN-01 (dead `ParsedInitData` export + unreachable branch + read-helper intent comments), IN-02 (stale wrangler.jsonc comment), IN-03 (exact-900s boundary test — the security-critical comparator pin); (2) the /cari menu: re-run `register-commands.mjs` (scopes were re-armed in phase 4) + record the Telegram non-default-scope defect honestly in the limitations doc; (3) phase 3's stale-fix assumption notes (A1/A3) reviewed and closed or re-pointed. **NOT here**: ALT landmarks (c2) — committed to the v1.x milestone, not this phase.
+
+### Known-limitations doc (SC4)
+- **D-08:** `docs/KNOWN-LIMITATIONS.md` in-repo, written for **drivers AND forks**: OSM data gaps (no traffic confidence, no lane guidance, speed limits where mapped), cross-metro CPU degradation (the c3 class), the /cari menu defect + its workaround, beta quality statement, and the roadmap pointers (WASM-router track, ALT, engine B). Surfaced from the bot: `/help` gains one line pointing at the doc (strings-module copy).
+
+### Launch definition
+- **D-09:** **Private launch = checklist-signed private beta**: the user's chosen first drivers (friends/family/testers in KL) receive the bot link; word-of-mouth distribution. No app store, no marketing, no landing page (post-v1 idea). The launch checklist: known-limitations shipped · privacy audit signed · budget record green · full device matrix walked · `/help` + `/privacy` accurate · repo pushed public under GPL-3.0. **The milestone completes when the checklist is signed** — the launch act itself is the user's, not the workflow's.
+
+### OpenCode's Discretion
+- Audit script file layout (scripts/ + test/ split), gate vocabulary, exit codes
+- Battery recording method details; landscape media-query breakpoints within tokens
+- INFO-fix mechanics; the boundary test's fixture form
+- Known-limitations doc structure/tone; the /help one-liner copy (en/ms)
+
+</decisions>
+
+<specifics>
+## Specific Ideas
+
+- The audit tool doubles as the fork's own onboarding check — a fork runs `npm run privacy-audit` before their first driver.
+- The limitations doc is honest engineering prose, not a legal page — the clinical tone extends to it.
+- The launch checklist lives in the phase gate file and is signed there; STATE.md records the milestone completion.
+
+</specifics>
+
+<canonical_refs>
+## Canonical References
+
+**Downstream agents MUST read these before planning or implementing.**
+
+### Phase scope + decisions
+- `.planning/ROADMAP.md` §Phase 7 — goal, 4 success criteria, launch framing
+- `.planning/REQUIREMENTS.md` §PX-04 (+ PRIV-02/GEO-03 re-verification; the v1.x deferred table)
+- `.planning/phases/02-bot-skeleton-initdata-security/02-REVIEW.md` — the 3 INFO findings (IN-01/02/03)
+- `.planning/phases/03-mini-app-shell-geolocation/03-CONTEXT.md` — the privacy law's origin (D-07) + storage-gate precedent
+- `.planning/phases/06-turn-by-turn-guidance-live-driving/06-CONTEXT.md` — c3 class + A1 escalation + cron laws being audited
+
+### Codebase
+- `bot/src/kv/` — the TTL-only surfaces the audit probes
+- `bot/src/webhook.ts` — the log vocabulary + route table the audit scans
+- `web/test/no-storage.test.mjs` + `bot/test/route-privacy.test.mjs` — the gate lineage the audit script consolidates
+- `routing/scripts/measure-route-cpu.mjs` — the CPU measurement the budget record re-runs
+- `bot/scripts/register-commands.mjs` — the /cari re-arm tool
+- `docs/CONFIGURATION.md` — the docs dir the limitations doc joins
+
+</canonical_refs>
+
+<code_context>
+## Existing Code Insights
+
+### Reusable Assets
+- Storage/privacy gates (no-storage.test.mjs, route-privacy.test.mjs, PG1/PG2) — consolidated into the audit tool
+- measure-route-cpu.mjs — the budget record's engine half
+- Device-gate files (03/04/06) — the consolidated QA walk inherits their checklist shapes
+- register-commands.mjs — the /cari re-arm
+
+### Established Patterns
+- Gate suites as data (named vectors); hand-rolled runners; device-gate honesty protocol
+- TTL-only KV; category-only logs; zero-telemetry posture
+- Docs dir (docs/CONFIGURATION.md precedent)
+
+### Integration Points
+- `requestFullscreen`/`orientation lock` → capability-guarded webapp wrapper (homescreen.ts precedent)
+- /help strings → the limitations pointer line
+- STATE.md → the milestone completion record
+
+</code_context>
+
+<deferred>
+## Deferred Ideas
+
+- ALT landmark preprocessing (c2) — v1.x milestone lever (measured decision, phase 6)
+- Engine B (fully client-side webview router) — the static-hosted endgame track
+- WASM-router OSS project — backend #2's standalone evolution
+- Opt-in telemetry — post-validation (IDEAS.md)
+- Voice guidance, live trip share, toll toggle, speed-limit display, traffic ETA — v1.x table
+- Bitmap map snapshots in turn-cards — v1.x
+- Public launch (landing page, marketing, app-store presence) — post-v1
+
+</deferred>
+
+---
+
+*Phase: 07-hardening-private-launch*
+*Context gathered: 2025-10-25*
diff --git a/.planning/phases/07-hardening-private-launch/07-DISCUSSION-LOG.md b/.planning/phases/07-hardening-private-launch/07-DISCUSSION-LOG.md
new file mode 100644
index 0000000..ec34500
--- /dev/null
+++ b/.planning/phases/07-hardening-private-launch/07-DISCUSSION-LOG.md
@@ -0,0 +1,52 @@
+# Phase 7: Hardening + Private Launch - Discussion Log
+
+> **Audit trail only.** Do not use as input to planning, research, or execution agents.
+> Decisions captured in CONTEXT.md — this log preserves the analysis.
+
+**Date:** 2025-10-25
+**Phase:** 07-hardening-private-launch
+**Mode:** default (interactive)
+
+## Areas Discussed
+
+### Privacy audit shape
+| Question | Options presented | Selection |
+|---|---|---|
+| Audit mechanism | consolidated `npm run privacy-audit` script + signed record / manual checklist | Consolidated audit script |
+| Telemetry posture | zero telemetry v1 / opt-in telemetry now | Zero telemetry v1 |
+
+### Device matrix + battery
+| Question | Options presented | Selection |
+|---|---|---|
+| PX-04 fullscreen | fullscreen on guidance start + CSS landscape / portrait-only honest partial | Fullscreen on guidance start |
+| Battery verification | measured on real drive / synthetic bench | Measured on real drive |
+| QA organization | one consolidated walk / per-feature sessions | One consolidated walk |
+
+### Budgets + deferred debt
+| Question | Options presented | Selection |
+|---|---|---|
+| Budget audit | consolidated record / existing gates only | Consolidated budget record |
+| Debt payoff | INFOs + /cari + stale-fix notes / minimal | Pay INFOs + doc the rest (ALT stays v1.x) |
+
+### Known-limitations doc
+| Question | Options presented | Selection |
+|---|---|---|
+| Doc placement | repo doc + /help link / repo only | Repo doc + /help link |
+
+### Launch definition
+| Question | Options presented | Selection |
+|---|---|---|
+| Private launch meaning | checklist-signed private beta / + landing page | Checklist-signed private beta |
+
+## Corrections Made
+
+None — user accepted recommendations throughout this phase (the scope was already
+their decisions' consequences: c3/c2 split, telemetry posture, ALT-to-v1.x).
+
+## Auto-Resolved
+
+Not applicable.
+
+## External Research
+
+Not needed — hardening/audit patterns are established in-repo (gate lineage cited).
diff --git a/.planning/phases/07-hardening-private-launch/07-PATTERNS.md b/.planning/phases/07-hardening-private-launch/07-PATTERNS.md
new file mode 100644
index 0000000..2719b30
--- /dev/null
+++ b/.planning/phases/07-hardening-private-launch/07-PATTERNS.md
@@ -0,0 +1,365 @@
+# Phase 7: Hardening + Private Launch - Pattern Map
+
+**Mapped:** 2026-10-25
+**Files analyzed:** 16 (9 new, 7 modified/re-run)
+**Analogs found:** 14 / 16 (2 have no in-repo analog: `_headers`, cloudflare live probes)
+
+## File Classification
+
+| New/Modified File | Role | Data Flow | Closest Analog | Match Quality |
+|-------------------|------|-----------|----------------|---------------|
+| `scripts/privacy-audit.mjs` + `scripts/lib/source-gates.mjs` | utility (CLI gate tool) | batch (scan → report → exit) | `web/test/no-storage.test.mjs` + `bot/test/route-privacy.test.mjs` (scans) + `theme/scripts/audit.mjs` (CLI/exit codes) | exact |
+| `scripts/lib/bundle-gates.mjs` | utility | batch | `web/test/build-artifact.test.mjs` (BA1/BA5/BA8/BA9) | exact |
+| `scripts/lib/cloudflare-probes.mjs` | utility (live probe) | request-response (CLI → wrangler) | — no in-repo live probe exists (see No Analog) | role-match |
+| `scripts/budget-audit.mjs` | utility (CLI measurement gate) | batch | `routing/scripts/measure-route-cpu.mjs` + BA9 | exact |
+| `web/test/fullscreen.test.mjs` | test | event-driven | `web/test/homescreen.test.mjs` | exact |
+| `web/test/failure-state-matrix.test.mjs` | test | event-driven (named replay vectors) | `web/test/guidance-replay.test.mjs` + `web/test/guidance-surface.test.mjs` | exact |
+| `web/public/_headers` | config | n/a (static) | — none (Cloudflare doc format; RESEARCH §Code Examples) | no analog |
+| `web/src/telegram/fullscreen.ts` (new) | service (capability wrapper) | event-driven | `web/src/guidance/close-protection.ts` + `web/src/telegram/homescreen.ts` | exact |
+| `web/src/telegram/webapp.ts` (modify — grow contract) | model (typed contract) | n/a | itself — documented optional-member growth law | exact (self) |
+| `web/src/shell.css` (modify — landscape media queries) | component (stylesheet) | transform | itself — token-var discipline + `[data-guidance]` block | exact (self) |
+| `web/src/telegram/safe-area.ts` (modify — re-resolve on inset events) | service | event-driven | itself — resolve/apply pair | exact (self) |
+| `bot/test/initdata.test.mjs` (modify — exact-900s vector, IN-03) | test | request-response | itself — T4 boundary vectors | exact (self) |
+| `bot/src/security/initdata.ts` (modify — IN-01 debt) | model (security) | transform | itself — dead `ParsedInitData` export | exact (self) |
+| `bot/wrangler.jsonc` (modify — IN-02 stale comment) | config | n/a | itself — line 2 | exact (self) |
+| `bot/src/i18n/strings.ts` (modify — /help limitations pointer) + `bot/src/bot/commands/help.ts` | model (copy) | n/a | itself — `helpMenu` + D-05 law | exact (self) |
+| `docs/KNOWN-LIMITATIONS.md` (new) | doc | n/a | `docs/CONFIGURATION.md` | role-match |
+| `.planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md` (new) | planning doc | n/a | `.planning/phases/06-.../06-DEVICE-GATE.md` | exact |
+| `bot/scripts/register-commands.mjs` (re-run only, never modified) | utility | n/a | not modified — copy derives from `strings.ts` (CS5 pins this) | n/a |
+
+## Pattern Assignments
+
+### `scripts/privacy-audit.mjs` + `scripts/lib/*` (utility, batch)
+
+**Analogs:** `web/test/no-storage.test.mjs` (client storage gate), `bot/test/privacy.test.mjs` (KV TTL gate), `bot/test/route-privacy.test.mjs` (host/import allowlists), `theme/scripts/audit.mjs` (CLI + exit-code contract), `web/test/build-artifact.test.mjs` (bundle gates)
+
+The repo's gate lineage to consolidate: GEO3 (web memory-only) ← PG1/PG2 (Worker TTL writes) ← RP1/RP2 (Worker routing shape) ← BA1/BA5/BA8 (bundle). The audit tool extends the same laws repo-wide, it does not invent new ones.
+
+**Comment-stripped source scan** — copy verbatim from `web/test/no-storage.test.mjs` lines 29–42 (identical twins exist in `bot/test/route-privacy.test.mjs` lines 42–59 and `web/test/homescreen.test.mjs` lines 240–244):
+
+```javascript
+function listFiles(dir, exts, acc = []) {
+  for (const entry of readdirSync(dir)) {
+    const full = path.join(dir, entry);
+    if (statSync(full).isDirectory()) listFiles(full, exts, acc);
+    else if (exts.some((e) => entry.endsWith(e))) acc.push(full);
+  }
+  return acc;
+}
+
+function stripComments(src) {
+  return src
+    .replace(/\/\*[\s\S]*?\*\//g, " ") // block comments
+    .replace(/(^|[^:\\])\/\/[^\n]*/g, "$1"); // line comments (not URLs inside strings — benign over-stripping, gate is prefer-fail reading)
+}
+```
+
+> Planner note: the `(^|[^:\\])` guard keeps `https://` URLs alive; the header comment says the over-stripping is deliberate "prefer-fail reading". Reuse exactly; do not write a smarter stripper (RESEARCH Pitfall 6).
+
+**The banned-vocabulary shape** — `web/test/no-storage.test.mjs` lines 22–25 + the assertion style (lines 50–59):
+
+```javascript
+const BANNED = [
+  "localStorage", "sessionStorage", "indexedDB", "caches", "CacheStorage",
+  "document.cookie", "WebApp.DeviceStorage", "WebApp.SecureStorage", "WebApp.CloudStorage",
+];
+// per file, per token:
+assert.ok(!code.includes(banned), `${path.relative(process.cwd(), file)} references ${banned} — GEO-03 violated`);
+```
+
+**The KV write-TTL law the audit must extend repo-wide** — `bot/test/privacy.test.mjs` lines 32–49 (PG1): every `.put(` line carries `expirationTtl` ON THE SAME LINE, and it must reference a NAMED constant, never an inline literal:
+
+```javascript
+lines.forEach((line, i) => {
+  if (line.includes(".put(")) {
+    assert.ok(line.includes("expirationTtl"), `${file}:${i + 1} — KV write without expirationTtl (PRIV-02 gate): ${line.trim()}`);
+    const ttl = line.match(/expirationTtl:\s*([A-Za-z0-9_]+)/)?.[1];
+    assert.ok(ttl && /^[A-Z_]{2,}$/.test(ttl), `${file}:${i + 1} — expirationTtl must reference a named TTL constant, not an inline literal`);
+  }
+});
+```
+
+**Positive host allowlist (prefer allow over ban for runtime fetches)** — `bot/test/route-privacy.test.mjs` lines 94–105 show the negative-host form; BA1 lines 64–70 show the CDN ban list. D-01 flips this to a POSITIVE allowlist (OpenFreeMap tiles, Telegram API, own Worker) — keep the per-file `assert` message style from RP1c:
+
+```javascript
+const banned = /(overpass|project-osrm|osrm|valhalla|graphhopper|openrouteservice|routing\.openstreetmap)/i;
+// ... per file: assert.ok(hit === null, `${relative} references routing-host "${hit?.[0]}" — <the law and why>`);
+```
+
+**CLI + exit-code contract** — `theme/scripts/audit.mjs` lines 20–24 define the repo's audit vocabulary (reuse it — OpenCode's discretion area explicitly covers exit codes, and this precedent already exists):
+
+```text
+* Exit codes (no silent passes — T-1-07):
+*   0  clean — every checked declaration derives from tokens
+*   1  violations — each printed as  file:line: declaration
+*   2  drift/error — token sheet degraded (see message)
+```
+
+And its driver shape (lines 797–814): print every violation, then a single `AUDIT FAILED — N …` / `AUDIT CLEAN — …` summary line, then `process.exit(0|1)`. RESEARCH Pattern 4 adds exit **2 = missing credentials/environment** so a skipped live probe is never mistaken for a pass.
+
+**Bundle-scan mechanics** — `web/test/build-artifact.test.mjs`: the DirEnt walk (lines 79–87), the PRODUCTION-only scope law (BA5 lines 133–147 — `web/dist-harness/` is deliberately NOT clean; a gate pointed at it inverts itself), and BA8's JS-assets-only rule for crypto scans (lines 175–187 — the official Telegram SDK script in `index.html` is EXTERNAL and has its own crypto; the HTML fetch-host allowlist must whitelist `telegram.org`'s script tag explicitly, RESEARCH Pitfall 5/A4).
+
+---
+
+### `scripts/budget-audit.mjs` + `scripts/lib/*` (utility, batch)
+
+**Analogs:** `routing/scripts/measure-route-cpu.mjs` (the measurement half — RE-RUN, not rewritten), `web/test/build-artifact.test.mjs` BA9 (the print-the-budget law)
+
+**Header contract** — `routing/scripts/measure-route-cpu.mjs` lines 3–9 set the law the budget audit inherits:
+
+```text
+* A MAINTAINER-TIME REPO TOOL — NOT a runtime dependency; nothing in bot/src,
+* web/src, or routing/src imports it. The free plan gives a Worker 10 ms of
+* CPU per request (Error 1102 beyond it), so the A*-over-the-real-graph cost
+* is MEASURED AND PRINTED, never hoped for ("budget gates print their
+* measurement" — the BA9 precedent).
+```
+
+**Print-then-gate** — BA9, `web/test/build-artifact.test.mjs` lines 221–234:
+
+```javascript
+const total = inputs.reduce((sum, f) => sum + gzipSync(readFileSync(f)).length, 0);
+/* The measurement is VISIBLE on every run (D-11: "enforced as a BA
+ * build-artifact gate" — a budget nobody sees is a hope, not a gate). */
+console.log(`BA9 route bundle budget: ${total} / 204800 gz bytes`);
+assert.ok(total <= 204800, `route payload is ${total} gz bytes — over the 204800-byte (200 KiB) D-11 budget by ${total - 204800}. …`);
+```
+
+**Gate-fail message carries the mitigation ladder** — `measure-route-cpu.mjs` lines 180–185:
+
+```javascript
+if (p95 > P95_BUDGET_MS) {
+  console.error(`GATE FAIL: p95 ${p95.toFixed(3)} ms exceeds the ${P95_BUDGET_MS} ms budget (A1) — apply the mitigation ladder: (a) … (b) … (c) …`);
+  process.exit(1);
+}
+console.log(`GATE PASS: p95 ${p95.toFixed(3)} ms <= ${P95_BUDGET_MS} ms budget — A1 retired for this graph`);
+process.exit(0);
+```
+
+The budget audit re-runs `node routing/scripts/measure-route-cpu.mjs` (do not fork its logic — D-06/RESEARCH "Don't Hand-Roll") and adds: gzip'd bundle bytes (BA9 inputs: `routing/src`, `web/src/route`, `web/src/guidance`, `route-fixtures.json` — lines 204–209), KV write classes per request source (`session:`/`chat:` at `SESSION_TTL_SECONDS` — `bot/src/kv/sessions.ts` line 43; `loc:` at `PIN_TTL_SECONDS` — `location-pin.ts` line 25; `guidance:` at `GUIDANCE_SESSION_TTL_SECONDS` — `guidance-sessions.ts` line 27; cron = 0 writes per `webhook.ts` lines 49–57), and live asset cache headers once `_headers` ships. Reference ceilings table is in RESEARCH §Pattern 5.
+
+---
+
+### `web/test/fullscreen.test.mjs` (test, event-driven)
+
+**Analog:** `web/test/homescreen.test.mjs` — the WHOLE file is the template (fake WebApp + minimal DOM stub + guard tests + source-scan ban). Key excerpts:
+
+**Injected fake, per-case install/restore** (lines 5–8, 87–127):
+
+```javascript
+/* … driven with INJECTED FAKES (the location-chain.test.mjs style: build the
+   fake, call, assert — globals stubbed per case and restored in a finally
+   block, never leaked). */
+function fakeWebApp(opts = {}) {
+  const calls = { addToHomeScreen: 0, checkedStatus: false };
+  const events = new Map();
+  const wa = {
+    initData: "",
+    version: opts.version ?? "10.0",
+    isVersionAtLeast(v) { /* segment-wise numeric compare, lines 93–103 */ },
+    close() {},
+    onEvent(event, cb) { /* push into events map */ },
+    emitEvent(event) { /* fire registered callbacks — the test's trigger */ },
+  };
+  if (!opts.noAddToHomeScreen) { wa.addToHomeScreen = () => { calls.addToHomeScreen += 1; }; }
+  wa.__calls = calls;
+  return wa;
+}
+```
+
+**The guard's BOTH-halves vectors** — HS1/HS2 (lines 135–156) map 1:1 to fullscreen's PX-04.a/b:
+
+```javascript
+test("HS1 a client without addToHomeScreen is a no-op — nothing thrown, no affordance", () => { /* method absent → no-op */ });
+test("HS2 an old client (isVersionAtLeast 8.0 false) is a no-op", () => { /* version 7.9 → no-op, "the status was never even queried" */ });
+```
+
+**Throwing-platform-call-is-non-error** — HS7 (lines 214–219) is the exact shape for `requestFullscreen()` rejection:
+
+```javascript
+wa.addToHomeScreen = () => { throw new Error("platform refused"); };
+assert.doesNotThrow(() => btn.dispatch("click"), "a rejected addToHomeScreen must not break the boot");
+```
+
+**The source-scan ban closer** — HS9 (lines 240–248): end the suite with a comment-stripped scan of the new module banning the anti-pattern APIs (here: `Element.requestFullscreen` as primary path, `screen.orientation.lock`).
+
+Test IDs should follow the repo's prefix convention (`HS*`, `GS*`, `R*` → use e.g. `FS*`).
+
+---
+
+### `web/test/failure-state-matrix.test.mjs` (test, named vectors)
+
+**Analogs:** `web/test/guidance-replay.test.mjs` (named-vector header + pure-reducer replay) and `web/test/guidance-surface.test.mjs` (DOM state-token assertions).
+
+**Named-vector discipline** — `guidance-replay.test.mjs` header lines 15–33 enumerates cases R1–R12/T1–T3 with the law each pins; RESEARCH Pattern 3's `FAILURE_VECTORS` array is the data-driven form. The failure matrix test should import the REAL modules (`../src/route/route.ts`, `../src/guidance/guidance.ts`) and assert on the designed state tokens, e.g.:
+
+```javascript
+const g = await import("../src/guidance/guidance.ts");
+const { createGuidanceSession, stepGuidance, OFF_ROUTE_THRESHOLD_M /* …named constants */ } = g;
+```
+
+**DOM state-token assertions** — `guidance-surface.test.mjs` style: drive the REAL builders through the minimal document fake (`makeEl`, lines 75+), assert `dataset`/`data-*` states ("never blanks mid-swap (D-04/D-06)", GS1). Existing behavior to COVER (not change — RESEARCH Pattern 3 "audit coverage, not behavior"): route `null`/throw already renders the pending card (`web/src/route/route.ts`); off-road is already a calm state machine (`web/src/guidance/guidance.ts` — grace, storm guard, `no_reroute`).
+
+---
+
+### `web/src/telegram/fullscreen.ts` (service, event-driven) — new module
+
+**Analogs:** `web/src/guidance/close-protection.ts` (engage-at-guidance-start, version-gated) + `web/src/telegram/homescreen.ts` (guard both halves, onEvent, try/catch) + `web/src/telegram/webapp.ts` (contract growth).
+
+**The capability-guard pattern, verbatim shape** — `close-protection.ts` lines 21–31:
+
+```typescript
+export function engageCloseProtection(wa: TelegramWebAppLike | null): void {
+  // layer 1 — Bot API 7.7+: gate BEFORE the call, then the ?. chain
+  if (wa !== null && typeof wa.isVersionAtLeast === "function" && wa.isVersionAtLeast("7.7")) wa?.disableVerticalSwipes?.();
+  // layer 2 — Bot API 6.2+: the native-close net, gated the same way
+  if (wa !== null && typeof wa.isVersionAtLeast === "function" && wa.isVersionAtLeast("6.2")) wa?.enableClosingConfirmation?.();
+}
+```
+
+For fullscreen the guard is BOTH halves (method presence AND 8.0) — `homescreen.ts` line 33 is the tightest form:
+
+```typescript
+if (typeof wa.addToHomeScreen !== "function" || !wa.isVersionAtLeast("8.0")) return;
+```
+
+plus the best-effort try/catch (homescreen.ts lines 51–58) and the event observation (`wa.onEvent?.("homeScreenAdded", hide)` — line 64 → `fullscreenChanged`/`fullscreenFailed` for fullscreen).
+
+**Wiring site:** `web/src/route/route.ts` calls `engageCloseProtection(deps.wa ?? null)` at the guidance-start edge (lines 341, 616) and `releaseCloseProtection` at trip end (lines 481, 692) — `requestGuidanceFullscreen(wa)` / `exitGuidanceFullscreen(wa)` ride the SAME two edges. Note RESEARCH Pitfall 1: the guidance-start transition (not an async callback) is where the call belongs.
+
+**Contract growth law** — `webapp.ts` header lines 16–27 (must be extended IN THE SAME CHANGE as the fakes):
+
+```text
+* Phase 6 (PX-03/D-08) adds the guidance guards as OPTIONAL members only:
+* … — the contract stays the contract, no existing member changes shape,
+* every test fake and the harness mock satisfy exactly these members.
+```
+
+Add `requestFullscreen?`, `exitFullscreen?`, `isFullscreen?`, `lockOrientation?`, `unlockOrientation?` (all 8.0-optional) to `TelegramWebAppLike` (lines 35–86), and mirror them in BOTH fakes: `web/src/mock/telegram-mock.ts` and the per-test `fakeWebApp()` builders ("contract + fake + test together" law).
+
+---
+
+### `web/src/shell.css` landscape media queries + `web/src/telegram/safe-area.ts` re-resolution
+
+**Analog:** the file itself. The token-var discipline is declared in `shell.css` lines 2–18 ("Every value is a token reference…; the only literals are the machined-border geometry the UI-SPEC enumerates") — a landscape block may add geometry literals ONLY if the UI-SPEC-style sanctioned list is extended in the header comment (precedent: the Phase 6 block lines 141–147 opens with exactly such a list: "banner min-height 96px, arrow plate 48px…").
+
+**The state-attribute pattern** (no new markup): `[data-guidance="active"] .strip { … }` (lines 174–181) — landscape rules hang off `@media (orientation: landscape)` combined with the same token vars and `--safe-left/right`:
+
+```css
+[data-guidance="active"] .strip {
+  top: calc(var(--safe-top, 0px) + var(--spacing-space-sm) + 96px + 1px);
+  min-height: 24px;
+  padding-top: var(--spacing-space-xs); padding-bottom: var(--spacing-space-xs);
+}
+```
+
+**Safe-area re-resolution** — `safe-area.ts` already exposes the pair: `resolveSafeInsets(wa)` (lines 35–50, env-union-Telegram with `Math.max` per edge and the old-client pure-env fallback) and `applySafeArea(insets)` (lines 52–58, writes `--safe-top/bottom/left/right` on `:root`). The fullscreen/orientation change path re-CALLS these on `safeAreaChanged`/`contentSafeAreaChanged` (RESEARCH Pitfall 3) — extend, don't duplicate (webapp.ts gains the two event names as `onEvent` usages; the union logic is untouched).
+
+**CSS gate:** every new declaration must pass `npm run audit -w theme` (the DSGN-01 evidence command) — zero radius, no shadows/blur, tokens only.
+
+---
+
+### `bot/test/initdata.test.mjs` — exact-900s boundary vector (IN-03) + `bot/src/security/initdata.ts` debt (IN-01)
+
+**Analog:** the file itself. T4 (lines 172–189) pins 899 → ok / 901 → stale; the comparator at `initdata.ts` lines 193–196 is strictly-greater:
+
+```typescript
+// — stale: age strictly beyond the D-13 window (899 ok / 900 ok / 901 stale) —
+if (nowSeconds - authDate > maxAgeSeconds) {
+  return { ok: false, reason: "stale" as const };
+}
+```
+
+The missing vector is the INCLUSIVE edge: age exactly **900 s → ok:true**. Copy the T4 harness shape verbatim (`signedUser(now - 900)` + `loadValidator()` lazy import, lines 43–93). The comment on line 193 already promises "900 ok" — the test makes the promise a pin. Also pin `maxAgeSeconds` override behavior if exercised (opts line 71–73).
+
+**IN-01 targets** (same file, `initdata.ts`):
+- Dead export: `ParsedInitData` (lines 59–66) — declared, never constructed or returned (the return type is `InitDataResult`, lines 75–83). Fix per the repo's debt style: either delete the interface or re-point it with an intent comment naming why it stays (prefer deletion; the review finding says "dead").
+- Unreachable branch + read-helper intent comments: `parseFields` (lines 87–104) and the user/chat parse blocks (lines 154–165, 198–214) — add the intent comments documenting WHY each catch keeps raw/undefined (tampered-vs-malformed precedence, line 25–26 documents the vocabulary).
+
+**IN-02:** `bot/wrangler.jsonc` line 2 — `// KV namespace id is filled in plan 03 task 1 after …` — is stale: the id IS filled (line 36). Replace with a present-tense comment in the file's own voice (see lines 9–11, 23–29 for the comment register).
+
+---
+
+### `bot/src/i18n/strings.ts` — `/help` limitations pointer (en/ms)
+
+**Analog:** `strings.ts` itself — the D-05 law ("Every user-facing string the bot sends lives here and NOWHERE else", lines 3–7) and `help.ts` (`helpReplyText` lines 18–20 returns `strings[locale].helpMenu` verbatim).
+
+The pointer line is appended to BOTH `helpMenu` strings (en line 94–95, ms line 132–133). Clinical+honest tone per the module header (lines 9–11): "no emoji, no marketing flourishes".
+
+> **Planner gotcha (CS5):** `bot/test/commands.test.mjs` `menuEntries()` (lines 134–144) parses every helpMenu line STARTING WITH `/` and requires the `" — "` marker; CS5 (lines 146–155) asserts the parsed command list is EXACTLY `["help", "privacy", "cari"]`. The limitations pointer line must therefore NOT start with `/` (e.g. `Known limits: <url>` / `Had panduan: <url>` is safe — it is filtered out of the menu parse). If the copy instead extends an existing `/help` line, CS5 still passes (the marker stays); a NEW `/command`-shaped line fails CS5 by design.
+>
+> The URL should be a single constant per RESEARCH Open Question 5 (deployment config or one strings-module constant — never scattered). `register-commands.mjs` derives from `helpMenu` via `menuFor()` — a non-`/` line stays out of the registered command descriptions automatically, so the re-run remains copy-safe.
+
+---
+
+### `docs/KNOWN-LIMITATIONS.md` (new doc)
+
+**Analog:** `docs/CONFIGURATION.md` — clinical engineering prose, dense tables with a leading "surfaces, by kind" table (lines 9–22), per-row `File | Applies to` scoping, backticked identifiers, bold for requirements, and a strong claim-surface discipline (each statement names its evidence). It joins the same directory (`docs/`) alongside CONFIGURATION/DEVELOPMENT/ROAD-GRAPH/TESTING. Content map from D-08: OSM data gaps · cross-metro CPU degradation (c3, cite `measure-route-cpu.mjs` LADDER HISTORY lines 30–40 as the evidence) · /cari menu defect + workaround · beta quality statement · roadmap pointers (WASM-router, ALT, engine B). Written for drivers AND forks.
+
+---
+
+### `.planning/phases/07-hardening-private-launch/07-LAUNCH-GATE.md` (new gate file)
+
+**Analog:** `.planning/phases/06-turn-by-turn-guidance-live-driving/06-DEVICE-GATE.md` — copy its structure:
+
+1. **Blocking status header** (lines 3–8): what is already green (suite counts + commands), the never-fake law verbatim — *"device results are never faked … this file records the protocol; the SUMMARY records the verdict verbatim once the drive runs. A FAIL holds the phase open"*.
+2. **Part tables** (lines 32–43): `| # | Step | Verify |` rows — here: the consolidated D-05 walk (Android + iOS + Desktop + browser × boot / search→route / guidance / minimize-resume / trip-end / theme flip / landscape-fullscreen) and the D-04 battery record (device/OS, brightness, network, screen-on interval ≥30 min, start/end %, route, computed %/hr, caveats — RESEARCH Pitfall 11's field list).
+3. **Executor notes** (lines 59–68): known-open items, R2/credentials caveats, and the honesty rule — *"if a step cannot be executed … mark it NOT RUN — do not invent an outcome"*.
+4. **FINAL VERDICT section** (lines 72–82): part-by-part table + dated signature; the D-09 launch checklist (known-limitations shipped · privacy audit signed · budget record green · device matrix walked · /help + /privacy accurate · repo public GPL-3.0) signs here.
+
+---
+
+## Shared Patterns
+
+### Capability guard: BOTH halves + `?.` chain + no-throw
+**Source:** `web/src/guidance/close-protection.ts` lines 21–31; `web/src/telegram/homescreen.ts` line 33, lines 51–58
+**Apply to:** `web/src/telegram/fullscreen.ts`, the `webapp.ts` contract growth, every fullscreen test vector
+```typescript
+if (wa !== null && typeof wa.isVersionAtLeast === "function" && wa.isVersionAtLeast("8.0")) wa?.requestFullscreen?.();
+// a throw is caught and ignored — degradation is a supported state, never an error surface
+```
+
+### Contract + fake + test together
+**Source:** `web/src/telegram/webapp.ts` header lines 16–27; `web/src/mock/telegram-mock.ts`; `web/test/homescreen.test.mjs` `fakeWebApp()`
+**Apply to:** adding fullscreen members — `webapp.ts` optional members, the harness mock, and every test fake change in ONE commit.
+
+### Comment-stripped source introspection (prefer-fail reading)
+**Source:** `web/test/no-storage.test.mjs` lines 29–46 (canonical); twins in `route-privacy.test.mjs` 42–59, `homescreen.test.mjs` 58–66
+**Apply to:** `scripts/lib/source-gates.mjs` — and to any new structural test (HS9/GS6 style).
+
+### Gate vocabulary: print the measurement, exit 0/1/2
+**Source:** `theme/scripts/audit.mjs` lines 20–24, 797–814; `measure-route-cpu.mjs` lines 180–185; BA9 lines 226–233
+**Apply to:** both audit CLIs. 0 = pass, 1 = gate failure (evidence printed), 2 = environment/credential drift (never mistaken for pass). RESEARCH Pattern 4 is the orchestration shape:
+```javascript
+for (const result of results) console.log(`${result.id}: ${result.pass ? "PASS" : "FAIL"} — ${result.evidence}`);
+process.exit(results.every((r) => r.pass) ? 0 : 1);
+```
+
+### Category-only log vocabulary
+**Source:** `bot/src/webhook.ts` lines 63–68 (the law), lines 103/234/244/272/303/318/380/388 (every call site)
+**Apply to:** the privacy audit's log-vocabulary gate — the scan asserts every `console.log` in `bot/src` matches the `[surface] verdict: category` shape and that no line can carry coordinates/ids/payloads. The fullscreen fallback path must also stay category-only (RESEARCH Pattern 1 required behavior).
+
+### Named TTL constants + the KV key families
+**Source:** `bot/src/kv/sessions.ts` line 43 (`session:`+`chat:` @ 900s), `location-pin.ts` line 25 (`loc:` @ 300s), `guidance-sessions.ts` line 27 (`guidance:` @ 7200s); PG1 same-line law
+**Apply to:** the KV listing probe — assert every live key family is one of these four AND carries an `expiration` (RESEARCH A5/Pitfall 7: parse `expiration`, cursor, `list_complete`; report unexpected families, don't assume absence). Probe syntax (already used manually in 06-DEVICE-GATE.md step 7): `npx wrangler kv key list --namespace-id=59f58a54bc44483e89872b20a005a5eb --prefix "guidance:"`.
+
+### Copy lives in strings.ts only (D-05)
+**Source:** `bot/src/i18n/strings.ts` lines 3–7; `commands.test.mjs` CS5 lines 157–187 (register script must not inline copy)
+**Apply to:** the /help pointer line + `docs/KNOWN-LIMITATIONS.md` link constant.
+
+### Device-gate honesty protocol
+**Source:** `06-DEVICE-GATE.md` lines 3–8, 67–68
+**Apply to:** 07-LAUNCH-GATE.md — PASS/FAIL/NOT RUN with client version; a NOT RUN leg never blocks as fake PASS; battery numbers are recorded, never synthesized (D-04).
+
+## No Analog Found
+
+| File | Role | Data Flow | Reason | Planner guidance |
+|------|------|-----------|--------|------------------|
+| `web/public/_headers` | config | static | No static-asset config file exists anywhere in the repo (`web/public/` holds only glyphs/logos) | Use RESEARCH §Code Examples "Static Asset Cache Rules" verbatim (`/assets/*` → `public, max-age=31556952, immutable`; `/` → `public, max-age=0, must-revalidate`); verify live with the budget-audit `--live` probe; keep `web/dist` Vite output shape in mind (hashed `/assets/*`) |
+| `scripts/lib/cloudflare-probes.mjs` | utility | request-response (live) | Every existing gate is static/source-level; the only live-KV precedent is a manual command recorded in 06-DEVICE-GATE.md step 7 | Follow `measure-route-cpu.mjs`'s maintainer-time-tool header law + theme-audit exit codes; `--live` flag gates the probe; missing credentials → exit 2 with the gate marked NOT RUN (never pass) |
+
+## Metadata
+
+**Analog search scope:** `web/src/`, `web/test/`, `web/scripts/`, `bot/src/`, `bot/test/`, `bot/scripts/`, `routing/scripts/`, `theme/scripts/`, `docs/`, `.planning/phases/{03,04,06,07}/`, root `package.json`
+**Files read in full or in part:** 24 (no-storage, route-privacy, privacy, build-artifact, homescreen.ts/.test, harness.mjs ×2, runner.mjs, webapp.ts, close-protection.ts, safe-area.ts, shell.css, guidance-replay (head), guidance-surface (head), measure-route-cpu, theme/audit.mjs, initdata.ts, initdata.test.mjs, strings.ts, help.ts, wrangler.jsonc, webhook.ts, commands.test.mjs (CS5 region), CONFIGURATION.md (head), 06-DEVICE-GATE.md)
+**Pattern extraction date:** 2026-10-25
diff --git a/.planning/phases/07-hardening-private-launch/deferred-items.md b/.planning/phases/07-hardening-private-launch/deferred-items.md
new file mode 100644
index 0000000..dd0ed53
--- /dev/null
+++ b/.planning/phases/07-hardening-private-launch/deferred-items.md
@@ -0,0 +1,22 @@
+# Deferred items — Phase 07 (logged by executors; out-of-scope discoveries)
+
+## 2026-10-24 — logged by 07-04 execution
+
+**1. [Out-of-scope discovery] `npm run privacy-audit` is RED on the current tree — caused by 07-05's committed `/help` pointer (NOT by 07-04)**
+- **Evidence:** `node scripts/privacy-audit.mjs` exits 1 — `runtime-hosts: FAIL — 2 violation(s): bot/src/i18n/strings.ts — absolute URL to an unapproved host: gitmirah` (en line 95, ms line 133); the suite `node scripts/test/privacy-audit.test.mjs` fails SA1/AU1/AU3 on the same root cause.
+- **Root cause:** commit `78482ab` (07-05) added the `/help` known-limitations pointer as the URL literal `http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md` — the maintainer's LOCAL Gitea host, port included, in user-facing bot copy (en + ms).
+- **Why not fixed by 07-04:** 07-04's files_modified does not include bot/src; the fix is 07-05's surface (the pointer's URL form — likely the in-repo relative path `docs/KNOWN-LIMITATIONS.md`, no host, or the public repo URL once the repo is pushed). Two gates/two waves touching the same line in one wave would race.
+- **Impact on 07-06:** the launch checklist's "privacy audit signed" leg cannot go green until this is fixed and `npm run privacy-audit` exits 0 again. Budget-audit (07-04's own surface) is CLEAN and unaffected.
+- **Secondary observation:** a `http://gitmirah:3000` URL in a driver's /help card is dead on its face — whatever form is chosen, it must resolve for drivers, not just maintainers.
+
+## 2026-10-25 — CLOSED by 07-06 gate prep
+
+**#1 (privacy-audit RED) — RESOLVED.** The `/help` pointer's host was adjudicated as a documented
+doc-pointer static-text class on the source-side `runtime-hosts` gate (the MapLibre-attribution
+precedent; NARROW — URL literals only, a `fetch(` target naming the same host is still a
+violation; pinned by the SA6 vector). `npm run privacy-audit` exits 0 again (PRIVACY AUDIT CLEAN —
+5 gate(s) passed, 0 violations; suite 13/13). Commit `2489cca`. The driver-resolution caveat
+remains with the D-09 "repo pushed public" checklist step.
+**Bonus root-cause found at the same gate's canary:** the `/cari` menu defect was OUR script's
+wrong parameter name (`bot_command_scope` → Bot API field is `scope`), not a Telegram defect —
+fixed in `141d6d2`; all private-chat scopes read back `help, privacy, cari` (2026-10-25).