From 713481b3305548db192ac6ecf98b4b5b74df3e60 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 16:50:59 +0000
Subject: [PATCH 01/12] A relative share link works when you click it, which is
 why nobody caught it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DRV1650-SR-EMBED-URL-RUNTIME-ORIGIN. The Driver copied
`research-map-plus-grid/research-map-plus-grid/index.html` from a page at
http://127.0.0.1:5192/ — "the perfect example of how embeddability is not working".

resolveShareUrl's tier 1 returns its input VERBATIM, correctly: a host handing over a
whole url has already decided. So a composite that BUILDS a tier-1 url takes on tier 2's
job, and both of mine wrote the same thing:

    base ? base + '/' + leaf : leaf

On any host where the tree root cannot be derived from the script url — a dev server, an
ESM build, a tree served from a path that does not match `<name>/<name>.js` — base is ''
and the else branch hands tier 1 a bare relative path, which it then returns unresolved.

★ IT LOOKS RIGHT IN THE ONE PLACE ANYONE CHECKS. A relative share link WORKS WHEN
CLICKED, because the browser resolves it against the page you copied it from. It is the
EMBED that breaks — an <iframe src="…"> on a partner's page resolves against THEIRS — so
the failure is invisible exactly where it is tested and visible only where it ships.
research-map-plus-grid.vue:174 even documents the requirement ("It MUST be absolute,
which is the non-obvious part") four lines above the branch that violates it.

absoluteEmbedUrl() is tier 2's resolution made available to tier-1 builders: the
configured base when known, otherwise resolved against document.baseURI, which yields the
runtime origin. Never relative in a browser. The ladder is unchanged; only its last rung
is.

The gate has both arms, because either alone would rot: the RESOLVER must be absolute
with no base (the failing case, not the passing one), and no plugin may rebuild the
`: leaf` fallback. Negative-tested: removing the origin fallback, and re-introducing the
ternary in a plugin, each turn it red.

"Copy link didn't work" is most likely the same defect rather than a second one —
ShareButton's copy already falls back from navigator.clipboard to execCommand for
insecure contexts, so the copy almost certainly succeeded and produced a useless URL. If
it still fails after this, it is a separate bug and needs a browser to see.
---
 internal/check-embed-url-absolute.mjs         | 84 +++++++++++++++++++
 library/utils/embedBase.js                    | 40 +++++++++
 package.json                                  |  1 +
 .../dashboard-plus-grid.vue                   |  8 +-
 .../research-map-plus-grid.vue                | 13 +--
 5 files changed, 137 insertions(+), 9 deletions(-)
 create mode 100644 internal/check-embed-url-absolute.mjs

diff --git a/internal/check-embed-url-absolute.mjs b/internal/check-embed-url-absolute.mjs
new file mode 100644
index 000000000..b81e80856
--- /dev/null
+++ b/internal/check-embed-url-absolute.mjs
@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * check-embed-url-absolute — a share/embed url must never be relative.
+ *
+ * THE DEFECT (Driver, 2026-09-28, testing live): the link copied from Simple Research was
+ * `research-map-plus-grid/research-map-plus-grid/index.html` while the page was
+ * `http://127.0.0.1:5192/#f=…` — "the perfect example of how embeddability is not working".
+ *
+ * WHY IT SURVIVED SO LONG, and it is the reason this is a gate rather than a fix: a relative share link
+ * WORKS WHEN CLICKED. The browser resolves it against the page you copied it from, so the person testing
+ * sees it open correctly. It is the EMBED that breaks — an <iframe src="…"> on a partner's site resolves
+ * against THEIR page — so the failure is invisible exactly where it is checked and visible only where it
+ * ships. Nobody was careless; the test that a human naturally performs cannot see it.
+ *
+ * WHERE IT CAME FROM: resolveShareUrl's tier 1 returns its input VERBATIM, correctly, because a host
+ * handing over a whole url has decided. Two composites BUILD a tier-1 url themselves and both wrote
+ *     base ? base + '/' + leaf : leaf
+ * so on any host where the tree root cannot be derived from the script url — a dev server, an ESM build,
+ * a tree served from a path that does not match `<name>/<name>.js` — base is '' and the else branch
+ * hands tier 1 a relative path.
+ *
+ * TWO ARMS: the behaviour (absoluteEmbedUrl really is absolute with NO base, which is the failing case),
+ * and the shape (no plugin builds a share url with the `: leaf` fallback again).
+ *
+ * Exit 0 pass · 1 fail.
+ */
+import { readFileSync, readdirSync, existsSync, statSync } from 'node:fs'
+import { resolve, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const TAG = 'EMBED-URL-ABSOLUTE'
+const fails = []
+
+// ── ARM A: the resolver, with the tree root UNKNOWN — the case the old code got wrong ────────────
+// There is no document in node, so absoluteEmbedUrl cannot resolve against baseURI; a stand-in document
+// is supplied so the browser path is the one under test rather than the SSR fallback.
+globalThis.document = { baseURI: 'http://127.0.0.1:5192/' }
+const { absoluteEmbedUrl, resolveShareUrl } = await import(resolve(ROOT, 'library/utils/embedBase.js'))
+const LEAF = 'research-map-plus-grid/research-map-plus-grid/index.html'
+
+const got = absoluteEmbedUrl(LEAF)
+if (!/^https?:\/\//i.test(got)) {
+  fails.push(`absoluteEmbedUrl returned a RELATIVE url with no tree root: "${got}".\n`
+    + '      That is the exact value the Driver copied. It must resolve against the runtime origin.')
+}
+if (got !== 'http://127.0.0.1:5192/' + LEAF) {
+  fails.push(`absoluteEmbedUrl did not resolve against the page origin: "${got}"`)
+}
+if (absoluteEmbedUrl('https://cdn.example.org/x/index.html') !== 'https://cdn.example.org/x/index.html') {
+  fails.push('an already-absolute url must pass through unchanged')
+}
+if (absoluteEmbedUrl('') !== '') fails.push('an empty leaf must stay empty rather than becoming the page')
+// A configured base still wins — the ladder is unchanged, this only replaces its last rung.
+if (absoluteEmbedUrl(LEAF, { embedBaseUrl: 'https://cdn.example.org/maps' }) !== 'https://cdn.example.org/maps/' + LEAF) {
+  fails.push('a host-supplied embedBaseUrl must still win over the runtime origin')
+}
+// And tier 1 must still return a WHOLE url verbatim — that contract is what makes the above necessary.
+if (resolveShareUrl({ shareUrl: 'https://x.example/a' }) !== 'https://x.example/a') {
+  fails.push('resolveShareUrl tier 1 no longer returns a whole url verbatim; this gate assumes it does')
+}
+
+// ── ARM B: nobody rebuilds the relative fallback ─────────────────────────────────────────────────
+const PD = join(ROOT, 'plugin-designs')
+for (const b of readdirSync(PD)) {
+  const dir = join(PD, b)
+  if (!existsSync(dir) || !statSync(dir).isDirectory()) continue
+  for (const f of readdirSync(dir).filter((x) => x.endsWith('.vue') || x.endsWith('.js'))) {
+    const src = readFileSync(join(dir, f), 'utf8')
+    // `base ? base + '/' + leaf : leaf` in any spelling: a ternary whose ELSE hands back the bare path.
+    if (/\bbase\s*\?\s*base\s*\+[^:]*:\s*(leaf|rel|path)\b/.test(src)) {
+      fails.push(`${b}/${f} builds a share url that falls back to a RELATIVE path when no tree root\n`
+        + '      resolves. Use absoluteEmbedUrl() — it resolves against the runtime origin instead.')
+    }
+  }
+}
+
+if (fails.length) {
+  console.error(`${TAG}: FAIL`)
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log(`${TAG}: PASS — a share url resolves against the runtime origin when no tree root is known, a `
+  + 'configured base still wins, and no plugin rebuilds the relative fallback.')
diff --git a/library/utils/embedBase.js b/library/utils/embedBase.js
index 585d47c84..d7512681c 100644
--- a/library/utils/embedBase.js
+++ b/library/utils/embedBase.js
@@ -172,6 +172,46 @@ export function resolveAssetsBase(profileConfig) {
  * @param {object|null} [opts.profileConfig]  the parsed profile-config (already unref'd)
  * @returns {string}
  */
+/**
+ * A TREE-RELATIVE leaf as an ABSOLUTE url — for a caller that must supply a whole url up front.
+ *
+ * ★ WHY THIS EXISTS: tier 1 of resolveShareUrl's ladder returns its input VERBATIM, by design, because
+ * a host handing over a whole url has already decided. A composite that BUILDS a tier-1 url therefore
+ * takes on tier 2's job, and two of them did it like this:
+ *
+ *     base ? base + '/' + leaf : leaf          // <- relative when no base resolves
+ *
+ * On any host where the tree root cannot be derived from the script url — a dev server, an ESM build,
+ * a tree served from a path that does not match `<name>/<name>.js` — base is '' and that expression
+ * yields a BARE RELATIVE PATH. Tier 1 then returns it unresolved, and the reader copies
+ * `research-map-plus-grid/research-map-plus-grid/index.html` from a page at http://127.0.0.1:5192/
+ * (the Driver, 2026-09-28: "the perfect example of how embeddability is not working").
+ *
+ * ★ AND IT LOOKS RIGHT IN THE ONE PLACE PEOPLE CHECK. A relative share LINK works when clicked, because
+ * the browser resolves it against the current page; it is the EMBED that breaks, because an
+ * <iframe src="…"> on a partner's site resolves against THEIR page. So the failure is invisible exactly
+ * where it is tested and visible only where it ships.
+ *
+ * This is tier 2's resolution, made available to tier-1 builders: base when known, otherwise resolved
+ * against document.baseURI, which yields the runtime origin. Never returns a relative string in a
+ * browser.
+ *
+ * @param {string} leaf   tree-relative path, e.g. `<bundle>/<profile>/index.html`
+ * @param {Object} [profileConfig]
+ * @returns {string} an absolute url wherever a document exists; the leaf unchanged under SSR
+ */
+export function absoluteEmbedUrl(leaf, profileConfig = null) {
+  const rel = String(leaf || '').trim().replace(/^\.\//, '')
+  if (!rel) return ''
+  if (/^https?:\/\//i.test(rel)) return rel
+  const base = stripSlashes(resolveEmbedBase(profileConfig) || '')
+  if (base) return base + '/' + rel
+  if (typeof document !== 'undefined') {
+    try { return new URL(rel, document.baseURI).href } catch { /* fall through */ }
+  }
+  return rel
+}
+
 export function resolveShareUrl({ shareUrl, embedPath, profileConfig } = {}) {
   const cfg = profileConfig || null
   const hasWindow = typeof window !== 'undefined'
diff --git a/package.json b/package.json
index 98ef4424f..ed22c1ecd 100644
--- a/package.json
+++ b/package.json
@@ -224,6 +224,7 @@
     "check:scrim-viewport:self-test": "node internal/check-scrim-covers-viewport.mjs --self-test",
     "check:script-flags": "node internal/check-script-flags-reachable.mjs",
     "check:settled": "node internal/settled-tree-gate.mjs",
+    "check:embed-url-absolute": "node internal/check-embed-url-absolute.mjs",
     "check:setup-order": "node internal/check-setup-order.mjs",
     "check:sfc-parse": "node internal/check-sfc-script-parses.mjs",
     "check:shadow-css-parses": "node internal/check-shadow-css-parses.mjs",
diff --git a/plugin-designs/dashboard-plus-grid/dashboard-plus-grid.vue b/plugin-designs/dashboard-plus-grid/dashboard-plus-grid.vue
index 7f552ab02..49e6e02dd 100644
--- a/plugin-designs/dashboard-plus-grid/dashboard-plus-grid.vue
+++ b/plugin-designs/dashboard-plus-grid/dashboard-plus-grid.vue
@@ -15,7 +15,7 @@
  */
 import { reactive, provide, inject, ref, computed, watchEffect, watch, onMounted, getCurrentInstance } from 'vue'
 import { SUPPORTED_LOCALES, RTL_LOCALES, setRuntimeLocale, getRuntimeLocale, detectLocale } from '@map/i18n/index.js'
-import { resolveEmbedBase } from '@map/utils/embedBase.js'
+import { absoluteEmbedUrl } from '@map/utils/embedBase.js'
 import { useSharedMapToken, publishMapToken } from '@map/composables/useSharedMapToken.js'
 import { useHostTokenUrl } from '@map/composables/useHostTokenUrl.js'
 import StackLayout from '@map/layouts/StackLayout.vue'
@@ -343,11 +343,13 @@ const hostList = computed(() => (typeof hostConfig.value?.list === 'string' ? ho
 const gridConfig = computed(() => (hostList.value ? JSON.stringify({ list: hostList.value }) : ''))
 
 const SHARE_LEAF = 'dashboard-plus-grid/dashboard-plus-grid/index.html'
-const shareBase = resolveEmbedBase(null)
+
 provide('profileConfig', computed(() => ({
   profile: 'research-dashboard',
   layout: 'page-scroll',
-  shareUrl: (shareBase ? shareBase.replace(/\/+$/, '') + '/' : '') + SHARE_LEAF,
+  // Absolute wherever this lands: a relative share url works when CLICKED (the browser resolves it
+  // against this page) and 404s when EMBEDDED (a partner's iframe resolves it against theirs).
+  shareUrl: absoluteEmbedUrl(SHARE_LEAF),
   // Spread last so a host that supplies none leaves the key absent, and never overwrite the two
   // settings above — those are this composite's own layout and share decisions, not the host's.
   ...(hostToken.value ? { tk: hostToken.value } : {}),
diff --git a/plugin-designs/research-map-plus-grid/research-map-plus-grid.vue b/plugin-designs/research-map-plus-grid/research-map-plus-grid.vue
index 3d95bc239..514ce39b2 100644
--- a/plugin-designs/research-map-plus-grid/research-map-plus-grid.vue
+++ b/plugin-designs/research-map-plus-grid/research-map-plus-grid.vue
@@ -58,7 +58,7 @@
 import { computed, reactive, watch, onMounted, onBeforeUnmount, getCurrentInstance, watchEffect, ref } from 'vue'
 import { SUPPORTED_LOCALES, RTL_LOCALES, setRuntimeLocale, getRuntimeLocale, detectLocale } from '@map/i18n/index.js'
 import StackLayout from '@map/layouts/StackLayout.vue'
-import { resolveEmbedBase } from '@map/utils/embedBase.js'
+import { absoluteEmbedUrl } from '@map/utils/embedBase.js'
 import { publishMapToken } from '@map/composables/useSharedMapToken.js'
 import { useHostTokenUrl } from '@map/composables/useHostTokenUrl.js'
 
@@ -188,11 +188,12 @@ watch(textDir, reflectDir)
 // the share LINK, because the browser resolves it against this page, and then 404 in the EMBED,
 // because it resolves against the partner's page instead. Tier 1 is documented as "a WHOLE url" for
 // exactly this reason.
-const SHARE_URL = (() => {
-  const base = (resolveEmbedBase(null) || '').replace(/\/+$/, '')
-  const leaf = 'research-map-plus-grid/research-map-plus-grid/index.html'
-  return base ? base + '/' + leaf : leaf
-})()
+// ★ THE `: leaf` BRANCH WAS THE BUG THE COMMENT ABOVE WARNS ABOUT. When no base resolves — a dev
+// server, an ESM build, a tree whose script url does not match `<name>/<name>.js` — that expression
+// returned a BARE RELATIVE PATH, tier 1 returned it verbatim, and the reader copied
+// `research-map-plus-grid/research-map-plus-grid/index.html` from a page at http://127.0.0.1:5192/.
+// absoluteEmbedUrl resolves against document.baseURI when there is no base, so it is never relative.
+const SHARE_URL = absoluteEmbedUrl('research-map-plus-grid/research-map-plus-grid/index.html')
 
 // One-screen height for the fixed-viewport research-map band. Same reasoning as
 // dashboard-plus-grid's DASHBOARD_H: the research map is a FIXED-VIEWPORT app whose shell is a CSS

From 948a00c7da8b939889a3dede1dbc54cb0ac60c8b Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 16:53:12 +0000
Subject: [PATCH 02/12] Two maps placed their share menu correctly because they
 were named in a string literal

DRV1650-SHARE-MENU-MOBILE-OFFSCREEN. On mobile the share/embed menu opens off-screen to
the right on Cities with Internet and Gospel Resources, while Simple Research and Prayer
Progress are correct.

THE SPLIT IS NOT A PLUGIN DIFFERENCE. MapControlMenu resolved the area it places inside
with closest('.dsm-map-area, .rm-map-area, .dm-map-area, [data-map-area]') -- three
hardcoded plugin class names. doxa-simple-map and research-map are on that list. Everyone
else resolved `|| null`, and place() answers a null area by returning an EMPTY STYLE,
which leaves .mcm{position:absolute} at its STATIC position: below-and-right of a button
already at the top right. Off the page.

So the two maps that worked worked because they were named in a string in another
component, and the bug was decided by a literal rather than by geometry. It is also the
SAME failure the 2026-09-22 dashboard fix documents twenty lines below -- not "a wrong
side was chosen" but "nothing chose anything" -- returning through a different door.

MEASURED: cities-internet, gospel-resources, key-cities and upg-neighbor carry no
map-area class and no data-map-area, so FOUR plugins were unanchored. The Driver reported
two. A fix aimed at the two he named would have left the other two, and a gate written
around them would have passed.

The named area is still preferred, because it is a real map's walls and a menu must not
outgrow them. When a plugin declares none, the anchor falls back to the toolbar's own
offsetParent -- the containing block this menu is absolutely positioned against, so
placing against it is correct by definition rather than by registration. A plugin that
adopts a class later simply gets the better anchor; nothing has to be registered anywhere
for a menu to be on screen.

check-map-menu-anchor asserts the PROPERTY rather than the list: that the resolution
cannot produce null from a real toolbar, that place() still guards a genuinely absent
one, and that a declared map area is still preferred over the fallback. Negative-tested:
restoring the allowlist-only resolution turns it red.

NEEDS EYES: this is rendered geometry and I work headless. What I can prove is that the
anchor is no longer decided by a name; whether the menu now sits correctly at 390px on
all four is rega's to measure.
---
 internal/check-map-menu-anchor.mjs            | 70 +++++++++++++++++++
 .../map-controls/MapControlMenu.vue           | 19 ++++-
 package.json                                  |  1 +
 3 files changed, 89 insertions(+), 1 deletion(-)
 create mode 100644 internal/check-map-menu-anchor.mjs

diff --git a/internal/check-map-menu-anchor.mjs b/internal/check-map-menu-anchor.mjs
new file mode 100644
index 000000000..77bec6806
--- /dev/null
+++ b/internal/check-map-menu-anchor.mjs
@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+/**
+ * check-map-menu-anchor — a map control menu must always have an anchor, so it can never fall to its
+ * static position off the edge of the page.
+ *
+ * THE DEFECT (Driver, 2026-09-28, mobile): the share/embed menu opens OFF-SCREEN to the right on Cities
+ * with Internet and Gospel Resources, while Simple Research and Prayer Progress are correct.
+ *
+ * ★ THE SPLIT WAS AN ALLOWLIST, NOT A PLUGIN DIFFERENCE. MapControlMenu resolved its containing area
+ * with `closest('.dsm-map-area, .rm-map-area, .dm-map-area, [data-map-area]')` — three hardcoded plugin
+ * class names. doxa-simple-map and research-map are on that list; everyone else resolved `|| null`, and
+ * place() answers a null area with an EMPTY STYLE, leaving `.mcm{position:absolute}` at its STATIC
+ * position: below-and-right of a button already at the top right. The two maps that worked were the two
+ * that happened to be named in a string literal in another component.
+ *
+ * MEASURED: cities-internet, gospel-resources, key-cities and upg-neighbor carry NO map-area class and
+ * no data-map-area. The Driver reported two; the allowlist made it four. A gate that only checked the
+ * two he named would have passed the other two.
+ *
+ * SO THIS ASSERTS THE PROPERTY, NOT THE LIST: whatever a plugin calls its map area, the menu resolves
+ * SOMETHING to anchor against. The fallback is the toolbar's own offsetParent — the containing block the
+ * menu is absolutely positioned against — which is correct by definition rather than by registration.
+ *
+ * Exit 0 pass · 1 fail.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const TAG = 'MAP-MENU-ANCHOR'
+const fails = []
+const F = join(ROOT, 'library/components/map-controls/MapControlMenu.vue')
+const src = readFileSync(F, 'utf8')
+const code = src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '')
+
+// 1. the area resolution must not be able to produce null from a real toolbar element.
+const m = code.match(/host\.value\s*=\s*([^\n]+)/)
+if (!m) {
+  fails.push('the area resolution moved — this gate cannot find `host.value = …` and would pass blind.')
+} else {
+  const expr = m[1]
+  if (!/offsetParent|parentElement|document\.body/.test(expr)) {
+    fails.push('MapControlMenu resolves its anchor from a class allowlist with no structural fallback:\n'
+      + `      ${expr.trim()}\n`
+      + '      A plugin whose map area is not named in that list gets a null area, place() returns an\n'
+      + '      EMPTY style, and the menu renders at its static position — off the page. That is the\n'
+      + '      Driver-reported mobile bug, and it is decided by a string literal rather than by geometry.')
+  }
+}
+
+// 2. place() must still bail safely when there is genuinely no toolbar (SSR, an unmounted menu).
+if (!/if\s*\(\s*!tb\s*\|\|\s*!area\s*\)/.test(code)) {
+  fails.push('place() no longer guards a missing toolbar/area; it must still return rather than throw.')
+}
+
+// 3. and the named-area behaviour must be PREFERRED, not replaced: a map menu must still be bounded by
+//    the map's own walls where one is declared, or it can overflow a real map.
+if (!/closest\(\s*AREA\s*\)/.test(code)) {
+  fails.push('the named map area is no longer preferred — a menu must be bounded by a real map\'s walls '
+    + 'where one is declared, and only fall back to the offset parent when none is.')
+}
+
+if (fails.length) {
+  console.error(`${TAG}: FAIL`)
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log(`${TAG}: PASS — a named map area is preferred, and a plugin that declares none still resolves an `
+  + 'anchor structurally, so the menu cannot fall back to its static off-page position.')
diff --git a/library/components/map-controls/MapControlMenu.vue b/library/components/map-controls/MapControlMenu.vue
index 5a7166964..8093b83c8 100644
--- a/library/components/map-controls/MapControlMenu.vue
+++ b/library/components/map-controls/MapControlMenu.vue
@@ -71,6 +71,17 @@ const host = ref(null)
 const el = ref(null)
 const style = ref({})
 
+// ★ AN ALLOWLIST OF THREE PLUGIN CLASS NAMES DECIDED WHETHER THIS MENU HAD AN ANCHOR AT ALL, and a
+// plugin not on the list got no placement rather than a worse one. `.dsm-map-area` is doxa-simple-map,
+// `.rm-map-area` is research-map, `.dm-map-area` is demo-map -- so Prayer Progress and Simple Research
+// placed correctly and everyone else fell through to `|| null`, which place() answers with an EMPTY
+// STYLE, which leaves `.mcm{position:absolute}` at its STATIC position: below-and-right of a button
+// already at the top right. Off the page.
+// That is the identical failure the 2026-09-22 dashboard fix describes below, returning through a
+// different door: not "a wrong side was chosen" but "nothing chose anything".
+// MEASURED 2026-09-28: cities-internet, gospel-resources, key-cities and upg-neighbor carry NO map-area
+// class and no data-map-area, so all four were unanchored. The Driver reported two of them; the list is
+// what made it four.
 const AREA = '.dsm-map-area, .rm-map-area, .dm-map-area, [data-map-area]'
 
 function place() {
@@ -127,7 +138,13 @@ function onClickOutside(e) {
 }
 
 onMounted(() => {
-  host.value = toolbar?.el?.value?.closest(AREA) || null
+  // ★ NEVER null. A named area is still preferred -- it is the MAP's walls, and a menu must not outgrow
+  // them -- but when a plugin has not tagged one, the toolbar's own offsetParent is the containing block
+  // this menu is absolutely positioned against, so placing against it is geometrically correct by
+  // definition rather than by convention. A plugin that adopts a class or data-map-area later simply
+  // gets the better anchor; nothing has to be registered anywhere for the menu to be on screen.
+  const tbEl = toolbar?.el?.value || null
+  host.value = tbEl?.closest(AREA) || tbEl?.offsetParent || tbEl?.parentElement || null
   host.value?.addEventListener(OPEN_EVENT, onOtherOpened)
   window.addEventListener('resize', onResize)
   document.addEventListener('click', onClickOutside, true)
diff --git a/package.json b/package.json
index ed22c1ecd..de5b30db0 100644
--- a/package.json
+++ b/package.json
@@ -224,6 +224,7 @@
     "check:scrim-viewport:self-test": "node internal/check-scrim-covers-viewport.mjs --self-test",
     "check:script-flags": "node internal/check-script-flags-reachable.mjs",
     "check:settled": "node internal/settled-tree-gate.mjs",
+    "check:map-menu-anchor": "node internal/check-map-menu-anchor.mjs",
     "check:embed-url-absolute": "node internal/check-embed-url-absolute.mjs",
     "check:setup-order": "node internal/check-setup-order.mjs",
     "check:sfc-parse": "node internal/check-sfc-script-parses.mjs",

From 859bb268e2bad148bdcbfc8c34debdb40585b24f Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 17:24:47 +0000
Subject: [PATCH 03/12] The poster sliced its rows in degrees, and Mercator
 charges more for a degree up north
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DRV1650-SR-POSTER-EXPORT, the "too much Antarctica" half. The big-poster renderer
stitches a grid of tiles, each drawn into an EQUAL-HEIGHT slot of the output image, and
it chose each row's latitude band by dividing the degree span evenly:

    latStep = (ne.lat - sw.lat) / rows

Screen height is proportional to ln(tan(pi/4 + lat/2)), not to latitude, so equal DEGREE
bands are not equal SCREEN bands. MEASURED on a -60..75 view in 4 rows: the top band is
37.0% of the true rendered height and was being painted into 25% of the poster; the next
19.7% into 25%; the bottom 25.2% into 25%. Every row is squeezed or stretched, which is
the wrong aspect, and the bands where a degree buys the most pixels are the most
over-represented -- the Antarctica the Driver saw.

Sliced in Mercator y instead, every row is 25.0%, exactly, because that IS the screen
coordinate.

★ THIRD PLACE TODAY FOR THE SAME MISTAKE. A whiteboard chart nearly shipped with a linear
scale into degrees; a measurement harness nearly reported a false threshold by correcting
the wrong axis; and this has been shipping. Treating latitude as a screen coordinate is
the error, the conversion is one line, and it now lives in library/maps/mercator-slice.js
rather than being rediscovered a fourth time.

check-mercator-slice asserts the PROPERTY across five view/row combinations -- every band
an equal share of rendered height, contiguous, covering the span, north-first -- and its
CONTROL is the old code: degree-linear slicing must FAIL the same assertion, which it does
by 12.0 points. Without that control the test would pass on a tree where nothing changed.
A -90..90 view clamps at the Mercator limit instead of going infinite.

NOT FIXED HERE, because it is a product decision and not a defect: the export also asks
for an 8.5x11 PORTRAIT sheet (research-map.vue:1410), so a landscape map is letterboxed
onto a tall page. That is a deliberate default, it is the other half of "the wrong
vertical aspect", and changing the shape of the Driver's poster is his call, not mine.
---
 internal/check-mercator-slice.mjs          | 78 ++++++++++++++++++++++
 library/composables/poster/useMapPoster.js | 16 +++--
 library/maps/mercator-slice.js             | 57 ++++++++++++++++
 package.json                               |  1 +
 4 files changed, 148 insertions(+), 4 deletions(-)
 create mode 100644 internal/check-mercator-slice.mjs
 create mode 100644 library/maps/mercator-slice.js

diff --git a/internal/check-mercator-slice.mjs b/internal/check-mercator-slice.mjs
new file mode 100644
index 000000000..89a32a10a
--- /dev/null
+++ b/internal/check-mercator-slice.mjs
@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/**
+ * check-mercator-slice — a poster's tile rows must be equal on SCREEN, not equal in degrees.
+ *
+ * THE DEFECT (Driver, 2026-09-28): Simple Research's Export → poster "shows too much of Antarctica"
+ * and comes out at the wrong, vertical aspect.
+ *
+ * The big-poster renderer stitches tiles, each drawn into an EQUAL-HEIGHT slot of the output. It picked
+ * each row's latitude band by dividing the degree span evenly — but screen height is proportional to
+ * ln(tan(pi/4 + lat/2)), not to latitude. So equal degree bands are unequal screen bands, and painting
+ * them into equal slots squeezes some and stretches others.
+ *
+ * ★ THE ASSERTION IS THE PROPERTY, AND THE CONTROL IS THE OLD CODE. Every band must occupy the same
+ * share of the rendered height, AND the degree-linear slicing it replaced must FAIL that same check —
+ * otherwise this passes on a tree where nothing was fixed.
+ *
+ * Exit 0 pass · 1 fail.
+ */
+import { resolve, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const { equalHeightLatBands, mercatorY, latAtMercatorY, MERCATOR_MAX_LAT } =
+  await import(resolve(ROOT, 'library/maps/mercator-slice.js'))
+
+const fails = []
+const shares = (bands, s, n) => {
+  const tot = mercatorY(n) - mercatorY(s)
+  return bands.map(([bs, bn]) => (mercatorY(bn) - mercatorY(bs)) / tot)
+}
+
+for (const [s, n, rows] of [[-60, 75, 4], [-85, 85, 6], [-10, 10, 3], [20, 60, 5], [-60, 75, 1]]) {
+  const bands = equalHeightLatBands(s, n, rows)
+  if (bands.length !== rows) { fails.push(`${rows} rows requested, ${bands.length} returned`); continue }
+  const sh = shares(bands, s, n)
+  const worst = Math.max(...sh.map((x) => Math.abs(x - 1 / rows)))
+  if (worst > 1e-9) {
+    fails.push(`bands of a ${s}..${n} view in ${rows} rows are not equal on screen: `
+      + `shares ${sh.map((x) => (x * 100).toFixed(1) + '%').join(' ')}`)
+  }
+  // north-first, contiguous, and covering the whole span
+  if (Math.abs(bands[0][1] - Math.max(s, n)) > 1e-9) fails.push(`first band does not start at the north edge (${s}..${n})`)
+  if (Math.abs(bands[rows - 1][0] - Math.min(s, n)) > 1e-9) fails.push(`last band does not end at the south edge (${s}..${n})`)
+  for (let i = 1; i < rows; i++) {
+    if (Math.abs(bands[i][1] - bands[i - 1][0]) > 1e-9) fails.push(`bands ${i - 1}/${i} are not contiguous`)
+  }
+}
+
+// ★ THE CONTROL: the degree-linear slicing this replaced MUST fail the same property.
+const linearBands = (s, n, rows) => {
+  const step = (n - s) / rows
+  return Array.from({ length: rows }, (_, r) => [n - (r + 1) * step, n - r * step])
+}
+const linWorst = (() => {
+  const sh = shares(linearBands(-60, 75, 4), -60, 75)
+  return Math.max(...sh.map((x) => Math.abs(x - 0.25)))
+})()
+if (linWorst <= 1e-9) {
+  fails.push('degree-linear slicing PASSES the equal-height assertion, so the assertion cannot detect '
+    + 'the defect it exists for — it is measuring nothing.')
+}
+
+// The poles are undefined in Mercator; a world view must clamp rather than produce Infinity.
+const polar = equalHeightLatBands(-90, 90, 4)
+if (!polar.every(([a, b]) => Number.isFinite(a) && Number.isFinite(b))) {
+  fails.push('a -90..90 view produces non-finite bands; Mercator is undefined at the poles and must clamp')
+}
+if (Math.abs(polar[0][1]) > MERCATOR_MAX_LAT + 1e-6) fails.push('the north edge was not clamped to the Mercator limit')
+if (Math.abs(latAtMercatorY(mercatorY(41.2)) - 41.2) > 1e-9) fails.push('mercatorY/latAtMercatorY are not inverses')
+
+if (fails.length) {
+  console.error('MERCATOR-SLICE: FAIL')
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log(`MERCATOR-SLICE: PASS — every tile row occupies an equal share of the RENDERED height across five `
+  + `view/row combinations, degree-linear slicing fails the same check (worst band off by ${(linWorst * 100).toFixed(1)} `
+  + 'points), and a polar view clamps instead of going infinite.')
diff --git a/library/composables/poster/useMapPoster.js b/library/composables/poster/useMapPoster.js
index 1ca5e9b75..40d97b041 100644
--- a/library/composables/poster/useMapPoster.js
+++ b/library/composables/poster/useMapPoster.js
@@ -32,6 +32,7 @@
  */
 
 import { ref, readonly } from 'vue';
+import { equalHeightLatBands } from '../../maps/mercator-slice.js';
 import { computeLayout } from './usePosterLayout.js';
 import { engineFor } from '../useMapProvider.js';
 
@@ -240,16 +241,23 @@ export function useMapPoster(getSourceMap) {
       const ne = sourceBounds.getNorthEast();
       const sw = sourceBounds.getSouthWest();
       const lngSpan = ne.lng - sw.lng;
-      const latSpan = ne.lat - sw.lat;
       const lngStep = lngSpan / cols;
-      const latStep = latSpan / rows;
+      // ★ ROWS ARE SLICED IN MERCATOR Y, NOT IN DEGREES, because each tile is drawn into an
+      // EQUAL-HEIGHT slot of the output image and screen height is not linear in latitude.
+      // Dividing the degree span evenly (what this did) squeezes some bands and stretches others:
+      // MEASURED on a -60..75 view in 4 rows, the top band is 37.0% of the true screen height and was
+      // being painted into 25% of the poster, the next 19.7% into 25%. That is the wrong aspect, and
+      // the high-latitude bands — where a degree buys the most pixels — are the most over-represented,
+      // which is the "too much Antarctica" the Driver reported.
+      const latBands = equalHeightLatBands(sw.lat, ne.lat, rows);
 
       let completed = 0;
       for (let r = 0; r < rows; r++) {
         for (let c = 0; c < cols; c++) {
           _throwIfAborted(signal);
-          const tileSw = [sw.lng + (c     * lngStep), ne.lat - ((r + 1) * latStep)];
-          const tileNe = [sw.lng + ((c + 1) * lngStep), ne.lat - (r     * latStep)];
+          const [bandS, bandN] = latBands[r];
+          const tileSw = [sw.lng + (c     * lngStep), bandS];
+          const tileNe = [sw.lng + ((c + 1) * lngStep), bandN];
           hiddenMap.fitBounds([tileSw, tileNe], { padding: 0, animate: false, duration: 0 });
           await _waitForIdle(hiddenMap);
           const tileUrl = hiddenMap.getCanvas().toDataURL('image/png');
diff --git a/library/maps/mercator-slice.js b/library/maps/mercator-slice.js
new file mode 100644
index 000000000..a79a6f4d6
--- /dev/null
+++ b/library/maps/mercator-slice.js
@@ -0,0 +1,57 @@
+/**
+ * mercator-slice.js — cut a map's bounds into EQUAL-HEIGHT rows, which is not the same as equal degrees.
+ *
+ * ★ THE DEFECT THIS EXISTS FOR (Driver, 2026-09-28, Simple Research's poster export): the poster "shows
+ * too much of Antarctica" and comes out at the wrong, vertical aspect.
+ *
+ * The big-poster renderer stitches a grid of tiles, each rendered into an EQUAL-HEIGHT slot in the
+ * output image. It chose each tile's latitude band by dividing the degree span evenly:
+ *
+ *     latStep = (ne.lat - sw.lat) / rows
+ *
+ * Web Mercator is not linear in latitude — screen y is proportional to ln(tan(pi/4 + lat/2)) — so equal
+ * DEGREE bands are not equal SCREEN bands. MEASURED on a -60..75 view in 4 rows: the top band is 37.0%
+ * of the true screen height and is drawn into 25% of the poster; the next is 19.7% drawn into 25%. Every
+ * row is squeezed or stretched, which is the wrong aspect, and the high-latitude bands — where a degree
+ * is worth the most pixels — are the most over-represented, which is the Antarctica the Driver saw.
+ *
+ * Slicing in MERCATOR Y instead gives 25.0% per row exactly, because that IS the screen coordinate.
+ *
+ * ★ SAME MISTAKE, THIRD PLACE TODAY. A whiteboard chart nearly shipped with a linear scale into degrees,
+ * and a measurement harness nearly reported a false threshold by correcting the wrong axis. Anything
+ * that treats latitude as a screen coordinate is wrong; the conversion is one line and it belongs
+ * somewhere shared rather than being rediscovered.
+ */
+
+/** Web Mercator's y for a latitude, in the same units the projection's x uses (radians of longitude). */
+export const mercatorY = (lat) => Math.log(Math.tan(Math.PI / 4 + (lat * Math.PI / 180) / 2))
+
+/** The inverse: the latitude at a Mercator y. */
+export const latAtMercatorY = (y) => (Math.atan(Math.sinh(y)) * 180) / Math.PI
+
+/** Web Mercator is undefined at the poles; the engines clamp here, so clamp before projecting. */
+export const MERCATOR_MAX_LAT = 85.051129
+
+const clampLat = (lat) => Math.max(-MERCATOR_MAX_LAT, Math.min(MERCATOR_MAX_LAT, lat))
+
+/**
+ * Latitude bands of EQUAL RENDERED HEIGHT, north to south.
+ * @param {number} southLat
+ * @param {number} northLat
+ * @param {number} rows
+ * @returns {Array<[number, number]>} [southLat, northLat] per row, ordered north-first to match a
+ *          top-to-bottom tile grid
+ */
+export function equalHeightLatBands(southLat, northLat, rows) {
+  const n = Math.max(1, Math.floor(rows) || 1)
+  const yN = mercatorY(clampLat(Math.max(southLat, northLat)))
+  const yS = mercatorY(clampLat(Math.min(southLat, northLat)))
+  const step = (yN - yS) / n
+  const out = []
+  for (let r = 0; r < n; r++) {
+    const top = yN - r * step
+    const bottom = yN - (r + 1) * step
+    out.push([latAtMercatorY(bottom), latAtMercatorY(top)])
+  }
+  return out
+}
diff --git a/package.json b/package.json
index de5b30db0..6adfef360 100644
--- a/package.json
+++ b/package.json
@@ -225,6 +225,7 @@
     "check:script-flags": "node internal/check-script-flags-reachable.mjs",
     "check:settled": "node internal/settled-tree-gate.mjs",
     "check:map-menu-anchor": "node internal/check-map-menu-anchor.mjs",
+    "check:mercator-slice": "node internal/check-mercator-slice.mjs",
     "check:embed-url-absolute": "node internal/check-embed-url-absolute.mjs",
     "check:setup-order": "node internal/check-setup-order.mjs",
     "check:sfc-parse": "node internal/check-sfc-script-parses.mjs",

From e4b4768df808de8f42d0db95c8705c5159505810 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 17:26:47 +0000
Subject: [PATCH 04/12] The paper turns to match the map, because a map is
 wider than it is tall

Driver's follow-up on DRV1650-SR-POSTER-EXPORT: the print came out vertical and it
should "probably [be] a horizontal map".

The export asked for 8.5x11 portrait unconditionally, so a landscape map was letterboxed
onto a tall sheet -- white above and below, the map small in the middle. That was the
other half of "the wrong vertical aspect"; the first half was the tile slicing, fixed in
859bb268.

Orientation now follows the map: landscape when the map's own container is wider than it
is tall, portrait otherwise. The PAPER is unchanged -- still 8.5x11 stock, only turned --
so the sheet stays a size printers have rather than becoming a custom one.

Measured from map.getContainer() rather than from the window, because the map may be one
pane of a composite and it is the MAP's shape being exported, not the browser's.
---
 plugin-designs/doxa-research-map/research-map.vue | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index 4adf05385..a082897aa 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -1407,7 +1407,20 @@ async function openPoster() {
       import('@map/composables/printInPlace.js'),
     ])
     const exporter = useMapPoster(() => map.value)
-    const spec = defaultPosterSpec({ widthIn: 8.5, heightIn: 11, dpi: 200, orientation: 'portrait' })
+    // ★ THE PAPER FOLLOWS THE MAP, because a map is usually wider than it is tall and a portrait sheet
+    // letterboxes it (Driver, 2026-09-28: the print came out vertical and it should "probably [be] a
+    // horizontal map"). Same 8.5x11 stock either way — only the ORIENTATION turns, so the sheet is
+    // still a standard page and not a custom size no printer has.
+    // Measured from the map's own container rather than from the window: the map may be one pane of a
+    // composite, and it is the MAP's shape being exported, not the browser's.
+    const mapEl = map.value?.getContainer?.() || null
+    const landscape = !!mapEl && mapEl.clientWidth > mapEl.clientHeight
+    const spec = defaultPosterSpec({
+      widthIn:  landscape ? 11 : 8.5,
+      heightIn: landscape ? 8.5 : 11,
+      dpi: 200,
+      orientation: landscape ? 'landscape' : 'portrait',
+    })
     // The poster is titled by the VIEW on screen ("Prayer", "Religion"…), in the reader's language.
     // The legend's title bar is the fallback only: on a flat tab it is the generic word "Legend".
     const title = tabLabel(activeTab.value) || legendTitle.value || 'Doxa Map'

From 84fa2ba3a4bcb462570ddebe026e2df35d3b919d Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 17:27:34 +0000
Subject: [PATCH 05/12] A profile with no print rules is not neutral in print,
 it is unspecified
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DRV1650-SR-POSTER-EXPORT, the second half: clicking print "breaks the CSS" and the map
controls + legend jump upward.

.rm-map-area is flex:1 1 0 — it has no height of its own, it fills a viewport-height
ancestor. Print layout has no viewport height, so the box collapses toward its content
height, and the toolbar and legend, which are position:absolute against it, move UP with
its top edge. Nothing in the research-map render path declares an @media print rule at
all, so the browser's DEFAULT print stylesheet is what lays the page out — which is the
whole mechanism. Not having print rules is not the same as being unaffected by printing.

A definite height in print restores the anchor. This changes nothing about what the
POSTER prints: that is a separate document in its own frame (printInPlace), and it is
already correct. This stops the LIVE page deforming while the dialog is over it.

NEEDS EYES, and I want the limit stated rather than implied. I can show from the source
that the box has no height in print and that everything positioned against it must follow
its top edge. What I cannot see headlessly is whether the browser lays the HOST out for
print at all when the dialog belongs to an iframe — engines differ. If rega opens
Export → poster on Simple Research and the controls no longer move, the mechanism was
this. If they still move, the cause is in the frame or the focus call, and I want to know
before this is called done.
---
 plugin-designs/doxa-research-map/research-map.vue | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index a082897aa..913663c90 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -415,6 +415,20 @@ useShadowStyles(`
      transforms and the map renders grey, so the rounding stops one level above it. */
   .rm-map-area { clip-path: inset(0 round var(--map-radius-corners, var(--map-radius, 0px))); }
   .rm-map-canvas { position:absolute;inset:0; }
+
+  /* ★ PRINT: GIVE THE MAP AREA A HEIGHT, OR EVERYTHING ANCHORED TO IT RISES.
+     .rm-map-area is flex:1 1 0 — it has no height of its own and fills a viewport-height ancestor.
+     Print layout has no viewport height, so that box collapses toward its content height, and the
+     toolbar and legend (position:absolute against it) move UP with its top edge. That is the Driver's
+     "clicking print breaks the CSS: the map controls + legend jump upward", and it needs no print
+     stylesheet to cause — the browser's DEFAULT print styles are enough, because nothing here declared
+     one. A profile with no @media print rules is not neutral in print; it is unspecified.
+     A definite height restores the anchor. This does not change what the poster prints — that is a
+     separate document in its own frame (printInPlace) — it stops the LIVE page deforming while the
+     dialog is open. */
+  @media print {
+    .rm-map-area { flex: 0 0 auto; height: 100vh; min-height: 0; }
+  }
   /* MATERIAL LIGHT (2026-09-21). Was background #0f1216 / color #7c8cf8 — same unconditional
      loading overlay as .dsm-loading, .apg-loading and countries-map's .rm-loading. Rendered on
      every load via v-if="!appReady", so it was the first surface a visitor saw.

From 8bd6691af89eb5223d8c9a34e33ff5090f9e2ef2 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 17:45:58 +0000
Subject: [PATCH 06/12] The legend held a slot for a toolbar this profile never
 draws
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DRV1650-SR-LEGEND-FILLS-SEARCH-GAP. On Simple Research's Regions and Languages tabs the
search bar is gone but the legend does not rise into the space. The other tabs are fine.

The two-tab split was a predicate, not a coincidence. With no geocoder the legend rises
to 14px UNLESS showsFlyTools() is true, and that returns true for exactly 'doxa-regions',
'language-family' and 'language-families'. It stops at 56px to avoid a MEASURED collision
on country-posters, where LegendTools renders at top:14px — the legend's own slot.

★ BUT showsFlyTools() DESCRIBES THE LEGEND TYPE, NOT WHETHER THE TOOLBAR EXISTS. Fly and
Clusters are leaf-only: the composite — which is what a reader calls "Simple Research" —
passes legendTools:false, so the toolbar is never drawn there and the 56px reserved a
slot for nothing. rega measured it at 1440x900 on main e1d0bc20: the band from the map's
top edge (y 44) to the legend card (y 100) is 56px of EMPTY map on both tabs, with no
LegendTools anywhere in the strip.

So the offset now asks whether the toolbar is RENDERED, not whether the type allows one.
Keying it on the tab name would have closed the Driver's gap and reintroduced the
country-posters collision the moment the tools were shown — the guard is kept, it is
simply asked the right question.

showLegendTools moved ABOVE legendTopVar, which reads it. A computed body is lazy so a
later const would have resolved at runtime, but this file has a TDZ history and
check:setup-order exists because of it; position is cheaper to keep honest than to reason
about.

check-legend-top-offset asserts BOTH inputs are consulted — drop either and it fails —
and that the declaration still precedes its reader. Negative-tested.

This is reading (b) of the two I put to dx-shepherd, chosen because rega measured it
rather than because it was likelier. Reading (a) would have been a cosmetic change to a
toolbar that turned out not to be there.
---
 internal/check-legend-top-offset.mjs          | 64 +++++++++++++++++++
 package.json                                  |  1 +
 .../doxa-research-map/research-map.vue        | 18 +++++-
 3 files changed, 81 insertions(+), 2 deletions(-)
 create mode 100644 internal/check-legend-top-offset.mjs

diff --git a/internal/check-legend-top-offset.mjs b/internal/check-legend-top-offset.mjs
new file mode 100644
index 000000000..48f18b045
--- /dev/null
+++ b/internal/check-legend-top-offset.mjs
@@ -0,0 +1,64 @@
+#!/usr/bin/env node
+/**
+ * check-legend-top-offset — the legend only reserves room for a toolbar that is actually drawn.
+ *
+ * THE DEFECT (Driver, 2026-09-28): on Simple Research's Regions and Languages tabs under MapLibre, the
+ * search bar is gone but the legend does not rise into the vacated space. The other tabs are fine.
+ *
+ * ★ THE TWO-TAB SPLIT WAS A PREDICATE, NOT A COINCIDENCE. With no geocoder the legend rises to 14px
+ * unless showsFlyTools() is true, and that returns true for exactly 'doxa-regions', 'language-family'
+ * and 'language-families' — the Driver's two tabs. It stops at 56px to avoid a MEASURED collision on
+ * country-posters, where LegendTools renders at top:14px, the legend's own slot.
+ *
+ * ★ BUT showsFlyTools() DESCRIBES THE LEGEND TYPE, NOT WHETHER THE TOOLBAR EXISTS. Fly + Clusters are
+ * leaf-only: the composite — which is what a reader calls "Simple Research" — passes legendTools:false,
+ * so the toolbar is never drawn there and the 56px reserved a slot for nothing. rega measured it at
+ * 1440x900 on main e1d0bc20: the band from the map's top edge (y 44) to the legend card (y 100) is 56px
+ * of empty map on both tabs, no toolbar anywhere in the strip.
+ *
+ * So the offset must be keyed on the toolbar's PRESENCE. Keying it on the tab name would have fixed the
+ * Driver's two tabs and reintroduced the country-posters collision the moment the tools were shown.
+ *
+ * Exit 0 pass · 1 fail.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const TAG = 'LEGEND-TOP-OFFSET'
+const fails = []
+const src = readFileSync(join(ROOT, 'plugin-designs/doxa-research-map/research-map.vue'), 'utf8')
+
+const m = src.match(/const legendTopVar = computed\(\(\) => \{[\s\S]*?\n\}\)/)
+if (!m) {
+  fails.push('legendTopVar was renamed or restructured — this gate cannot find it and would pass blind.')
+} else {
+  const body = m[0].replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '')
+  if (!/showsFlyTools\s*\(/.test(body)) {
+    fails.push('legendTopVar no longer asks whether the legend TYPE allows fly tools, so raising the '
+      + 'legend would print the toolbar across its header on the profiles that DO draw it '
+      + '(the measured country-posters collision).')
+  }
+  if (!/showLegendTools/.test(body)) {
+    fails.push('legendTopVar does not consult showLegendTools, so it reserves space for a toolbar that\n'
+      + '      may never be drawn. That is the Driver-reported dead band on the Regions and Languages\n'
+      + '      tabs: the composite passes legendTools:false and the 56px held a slot for nothing.\n'
+      + '      Key the offset on the toolbar\'s PRESENCE, not on the legend type alone.')
+  }
+}
+// The declaration must precede the reader: a lazy computed would resolve anyway, but this file has a
+// TDZ history and check:setup-order exists because of it.
+const iDecl = src.indexOf('const showLegendTools')
+const iUse = src.indexOf('const legendTopVar')
+if (iDecl > -1 && iUse > -1 && iDecl > iUse) {
+  fails.push('showLegendTools is declared BELOW legendTopVar, which reads it.')
+}
+
+if (fails.length) {
+  console.error(`${TAG}: FAIL`)
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log(`${TAG}: PASS — the legend's top offset is keyed on whether the toolbar is actually rendered, not on `
+  + 'the legend type alone, so the dead band closes without reintroducing the measured collision.')
diff --git a/package.json b/package.json
index 6adfef360..9889cd27c 100644
--- a/package.json
+++ b/package.json
@@ -225,6 +225,7 @@
     "check:script-flags": "node internal/check-script-flags-reachable.mjs",
     "check:settled": "node internal/settled-tree-gate.mjs",
     "check:map-menu-anchor": "node internal/check-map-menu-anchor.mjs",
+    "check:legend-top-offset": "node internal/check-legend-top-offset.mjs",
     "check:mercator-slice": "node internal/check-mercator-slice.mjs",
     "check:embed-url-absolute": "node internal/check-embed-url-absolute.mjs",
     "check:setup-order": "node internal/check-setup-order.mjs",
diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index 913663c90..b3ef9b559 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -485,9 +485,24 @@ const hasGeocoder = computed(() => {
 // prints the toolbar across the legend's header — MEASURED on country-posters. Ask the toolbar's own
 // exported predicate rather than re-typing its condition here, and stop just below it when it shows.
 // A collision is worse than the gap this is meant to close, and 56px still recovers most of it.
+// Declared ABOVE legendTopVar, which reads it. A computed body is lazy so a later const would have
+// resolved at runtime, but this file already carries a TDZ gate's worth of scars (check:setup-order):
+// position is cheaper to keep honest than to reason about.
+const showLegendTools = computed(() => profileConfig?.value?.legendTools !== false)
 const legendTopVar = computed(() => {
   if (hasGeocoder.value) return null
-  return showsFlyTools(activeLegendType?.value ?? activeLegendType) ? '56px' : '14px'
+  // ★ ASK WHETHER THE TOOLBAR IS RENDERED, NOT WHETHER THE LEGEND TYPE ALLOWS ONE. showsFlyTools() is
+  // a statement about the legend TYPE; showLegendTools is whether this profile draws them at all. The
+  // composite — which is what the reader calls "Simple Research" — passes legendTools:false because
+  // Fly + Clusters are a leaf-only tool (see the note on showLegendTools). So on the Regions and
+  // Languages tabs it reserved 56px for a toolbar it never draws, and only those two tabs, because
+  // they are exactly the set showsFlyTools() returns true for. Every other tab took the 14px branch
+  // and looked right, which is why the Driver reported it as two tabs misbehaving.
+  // MEASURED by rega at 1440x900 on main e1d0bc20: the band from the map's top edge (y 44) to the
+  // legend card (y 100) is 56px of EMPTY map on both tabs, with no LegendTools anywhere in the strip.
+  // So the gap was dead space, not a toolbar the reader had not registered.
+  const toolsShown = showLegendTools.value && showsFlyTools(activeLegendType?.value ?? activeLegendType)
+  return toolsShown ? '56px' : '14px'
 })
 
 // ★ FLY + CLUSTERS ARE A LEAF-ONLY TOOL. LegendTools renders at top:14px centred on the legend
@@ -496,7 +511,6 @@ const legendTopVar = computed(() => {
 // is a reading surface: its map is one half of a stack, and a fly-tour that moves the camera under
 // a grid the reader is scanning fights the other half. Default stays true so the standalone leaf
 // is untouched; the composite passes legendTools:false.
-const showLegendTools = computed(() => profileConfig?.value?.legendTools !== false)
 const mapProviderName = providerLabel(mapProvider)
 const dataSource    = inject('dataSource')
 const colorSet      = inject('colorSet')

From 659e3df386233c78599e00f2999a3cea45f43f94 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:02:00 +0000
Subject: [PATCH 07/12] The URLs that failed cannot be retried, and the ones
 that can were not
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DRV1650-LAZY-LOCALE-IMPORT-RETRY. net::ERR_NETWORK_CHANGED killed an embedded UPG-100's
load, and the card asks for the lazy locale/module loads to retry like
retryableAsyncComponent does.

★ THOSE URLs DO NOT EXIST IN PRODUCTION. The console named module URLs — locale JSON with
?import, useOptionalT.js, useShadowStyles.js, useMapTheme.js. The build is IIFE with
inlineDynamicImports (vite.config.js:216-220), so every one of them is inside the single
bundle and is never fetched separately. They are dev-server module requests. There is no
loader to wrap and nothing a reader could hit, so the card cannot be done as written, and
saying so is most of its value.

★ THE FAILURE CLASS IS REAL ONE LAYER DOWN, and nobody had covered it. A built bundle
still makes runtime requests — the boundaries geojson (twice, two composables), the
people-group list, prayer statistics — and NOT ONE of them retried. The same wifi switch
that killed the Driver's dev load takes out whichever of those is in flight, and the
feature is simply ABSENT: an empty map, a missing country outline, a statistic that never
arrives, with nothing a reader can act on. That is the same defect he reported, at the
layer that ships.

retryFetch is the fetch-shaped sibling of retryableAsyncComponent and deliberately shares
its policy — 3 attempts, growing backoff — because it survives the same event, and two
answers to "how long is a blip" would be worse than one.

It retries TRANSPORT failures only. A 404 or a 500 RESOLVES; retrying those would hide
real breakage and hammer a struggling server, so the response is handed back untouched.
An abort is a decision, not a blip, and is never retried.

check-retry-fetch asserts the behaviour AND that the shared data paths use it. Its
"persistently dead endpoint still fails" arm originally only checked that it threw — which
an UNBOUNDED retry loop also does, eventually. Caught by this gate's own negative test; it
now counts the attempts, because the property is bounded give-up and the bound is the
number. Negative-tested: retrying an abort, changing the default attempt count, and
reverting a data path to bare fetch each turn it red.

NOT wired: usePosterPrints, useCsvExport, PeopleGroupDetail and the token service also
fetch at runtime. They belong to other surfaces or have their own failure handling, and I
am not editing them blind — the list is in the report.
---
 internal/check-retry-fetch.mjs             | 89 ++++++++++++++++++++++
 library/composables/retryFetch.js          | 56 ++++++++++++++
 library/composables/useCountryOutline.js   |  3 +-
 library/composables/useMapLayers.js        |  3 +-
 library/composables/usePrayerStatistics.js |  3 +-
 library/lists/peopleGroupList.js           |  3 +-
 package.json                               |  1 +
 7 files changed, 154 insertions(+), 4 deletions(-)
 create mode 100644 internal/check-retry-fetch.mjs
 create mode 100644 library/composables/retryFetch.js

diff --git a/internal/check-retry-fetch.mjs b/internal/check-retry-fetch.mjs
new file mode 100644
index 000000000..57c1b5843
--- /dev/null
+++ b/internal/check-retry-fetch.mjs
@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * check-retry-fetch — a runtime data fetch survives a transport blip, and a real error still fails.
+ *
+ * THE DEFECT (Driver, 2026-09-28): net::ERR_NETWORK_CHANGED killed an embedded UPG-100's load.
+ *
+ * ★ THE URLs IN HIS CONSOLE CANNOT BE FIXED, BECAUSE THEY DO NOT EXIST IN PRODUCTION. They were module
+ * URLs — locale JSON with ?import, useOptionalT.js, useShadowStyles.js, useMapTheme.js. The build is
+ * IIFE with inlineDynamicImports (vite.config.js:216-220), so every one of those is inside the single
+ * bundle and is never fetched separately. Those failures are dev-server module requests. Wrapping them
+ * in a retry is impossible AND unnecessary; saying so is the useful part of this card.
+ *
+ * ★ THE FAILURE CLASS IS REAL ONE LAYER DOWN, and that is what this guards. A built bundle still makes
+ * runtime requests — boundaries geojson, the people-group list, prayer statistics — and none of them
+ * retried. The same blip takes out whichever was in flight, and the feature is simply ABSENT: an empty
+ * map, a missing outline, a statistic that never arrives, with nothing a reader could act on.
+ *
+ * Exit 0 pass · 1 fail.
+ */
+import { readFileSync } from 'node:fs'
+import { resolve, dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const { retryFetch } = await import(resolve(ROOT, 'library/composables/retryFetch.js'))
+const fails = []
+const ok = (w, c, d = '') => { if (!c) fails.push(`${w}${d ? `\n      ${d}` : ''}`) }
+const realFetch = globalThis.fetch
+
+// ── behaviour ────────────────────────────────────────────────────────────────────────────────────
+{
+  let n = 0
+  globalThis.fetch = async () => { if (++n < 3) throw new TypeError('Failed to fetch'); return { ok: true, attempt: n } }
+  const r = await retryFetch('u', undefined, { backoff: () => 1 })
+  ok('a transport blip is survived', r.attempt === 3, `resolved on attempt ${r.attempt}`)
+}
+{
+  // ★ COUNT THE ATTEMPTS, do not merely assert that it throws. An unbounded loop with a short backoff
+  // ALSO throws eventually, so "it failed in the end" passes a retry policy that hammers a dead server
+  // forever — caught by this gate's own negative test, which is the only reason the weak version did
+  // not ship. The property is BOUNDED give-up, and the bound is the number.
+  let calls = 0
+  globalThis.fetch = async () => { calls++; throw new TypeError('Failed to fetch') }
+  let threw = false
+  try { await retryFetch('u', undefined, { backoff: () => 1 }) } catch { threw = true }
+  ok('a persistently dead endpoint still FAILS — retrying forever would hide real breakage', threw)
+  ok('...after a BOUNDED number of attempts, not indefinitely', calls === 3, `fetch called ${calls}x, expected 3`)
+  calls = 0
+  try { await retryFetch('u', undefined, { attempts: 5, backoff: () => 1 }) } catch { /* expected */ }
+  ok('...and the bound is the caller\'s, when they state one', calls === 5, `fetch called ${calls}x, expected 5`)
+}
+{
+  // A 404/500 RESOLVES. It must be handed back untouched, not retried: the server said something.
+  let calls = 0
+  globalThis.fetch = async () => { calls++; return { ok: false, status: 404 } }
+  const r = await retryFetch('u', undefined, { backoff: () => 1 })
+  ok('a 404 is returned, not retried', r.status === 404 && calls === 1, `fetch called ${calls}x`)
+}
+{
+  // An abort is a DECISION, never a blip.
+  let calls = 0
+  globalThis.fetch = async () => { calls++; const e = new Error('aborted'); e.name = 'AbortError'; throw e }
+  let threw = false
+  try { await retryFetch('u', undefined, { backoff: () => 1 }) } catch (e) { threw = e.name === 'AbortError' }
+  ok('an abort is not retried', threw && calls === 1, `fetch called ${calls}x`)
+}
+globalThis.fetch = realFetch
+
+// ── and the shared data paths actually use it ────────────────────────────────────────────────────
+for (const rel of [
+  'library/composables/useMapLayers.js',
+  'library/composables/useCountryOutline.js',
+  'library/lists/peopleGroupList.js',
+  'library/composables/usePrayerStatistics.js',
+]) {
+  const src = readFileSync(join(ROOT, rel), 'utf8').replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '')
+  if (/(?<![A-Za-z.])fetch\s*\(/.test(src)) {
+    fails.push(`${rel} still calls bare fetch() for a runtime request — a transport blip there leaves the\n`
+      + '      feature silently absent. Use retryFetch().')
+  }
+}
+
+if (fails.length) {
+  console.error('RETRY-FETCH: FAIL')
+  for (const f of fails) console.error(`  ✗ ${f}`)
+  process.exit(1)
+}
+console.log('RETRY-FETCH: PASS — a blip is survived, a dead endpoint still fails, a 404 and an abort are not '
+  + 'retried, and the shared data paths all go through it.')
diff --git a/library/composables/retryFetch.js b/library/composables/retryFetch.js
new file mode 100644
index 000000000..9a65ee6ef
--- /dev/null
+++ b/library/composables/retryFetch.js
@@ -0,0 +1,56 @@
+/**
+ * retryFetch.js — fetch(), with the same transient-blip retry the lazy components already get.
+ *
+ * ★ THE DEFECT AND WHAT IT IS NOT. The Driver hit net::ERR_NETWORK_CHANGED on an embedded UPG-100 and
+ * the load died. The URLs in his console were module URLs — locale JSON with ?import, useOptionalT.js,
+ * useShadowStyles.js, useMapTheme.js — which look like lazy loads that need retrying. They are not: the
+ * production build is IIFE with inlineDynamicImports (vite.config.js:216-220), so every one of those
+ * modules is INSIDE the single bundle and is never fetched separately. Those failures are dev-server
+ * module requests and cannot happen for a reader.
+ *
+ * ★ BUT THE FAILURE CLASS IS REAL IN PRODUCTION, one layer down. A built bundle still makes runtime
+ * requests — the boundaries geojson, the people-group list, the prayer statistics, a detail lookup, a
+ * token service — and not one of them retried. The same wifi switch, VPN flap or sleep-wake that killed
+ * the Driver's dev load takes out whichever of those happened to be in flight, and the feature is simply
+ * absent: an empty map, a missing outline, a statistic that never arrives. No error a reader can act on.
+ *
+ * So this is the fetch-shaped sibling of retryableAsyncComponent, deliberately with the SAME policy —
+ * 3 attempts, growing backoff — because it is the same event being survived and two different answers
+ * to "how long is a blip" would be worse than one.
+ *
+ * ★ IT RETRIES TRANSPORT FAILURES ONLY. A rejected fetch() is a network-layer failure; a 404 or a 500
+ * RESOLVES, and retrying those would hide real breakage and hammer a struggling server. A 5xx is
+ * arguably transient, but it is the server saying something, and this helper deliberately does not
+ * second-guess it — the caller sees the response it would have seen.
+ */
+
+const DEFAULT_ATTEMPTS = 3
+const DEFAULT_BACKOFF = (attempt) => attempt * 500
+
+/**
+ * @param {string|Request} input
+ * @param {RequestInit} [init]
+ * @param {Object} [opts]
+ * @param {number} [opts.attempts]  total tries, including the first
+ * @param {function} [opts.backoff] (attempt) => ms
+ * @param {AbortSignal} [opts.signal] abort ends it immediately, without further attempts
+ * @returns {Promise<Response>} the response, or the LAST transport error if every attempt failed
+ */
+export async function retryFetch(input, init = undefined, { attempts = DEFAULT_ATTEMPTS, backoff = DEFAULT_BACKOFF, signal = null } = {}) {
+  let lastError
+  for (let attempt = 1; attempt <= Math.max(1, attempts); attempt++) {
+    if (signal?.aborted) throw signal.reason ?? new Error('aborted')
+    try {
+      return await fetch(input, init)
+    } catch (err) {
+      // An ABORT is a decision, not a blip: never retry one.
+      if (err?.name === 'AbortError' || signal?.aborted) throw err
+      lastError = err
+      if (attempt >= attempts) break
+      await new Promise((r) => setTimeout(r, backoff(attempt)))
+    }
+  }
+  throw lastError
+}
+
+export default retryFetch
diff --git a/library/composables/useCountryOutline.js b/library/composables/useCountryOutline.js
index f3095e22f..490cd7c21 100644
--- a/library/composables/useCountryOutline.js
+++ b/library/composables/useCountryOutline.js
@@ -31,6 +31,7 @@
  *   outline.clearCountry()
  */
 
+import { retryFetch } from './retryFetch.js'
 import { resolveAssetsBase } from '../utils/embedBase.js'
 import { emissivePaint } from './useMapProvider.js'
 
@@ -161,7 +162,7 @@ export function useCountryOutline(getMap, opts = {}) {
         // Add EMPTY first, then setData after the fetch, so addLayer below stays SYNCHRONOUS and
         // the outline keeps its place in the layer order.
         m.addSource(SOURCE_ID, { type: 'geojson', data: { type: 'FeatureCollection', features: [] } })
-        fetch(`${resolveAssetsBase(null)}/boundaries/world-adm0-web.geojson`)
+        retryFetch(`${resolveAssetsBase(null)}/boundaries/world-adm0-web.geojson`)
           .then((r) => r.json())
           .then((gj) => {
             // The tileset names the ISO field iso_3166_1_alpha_3; the geojson names it iso3.
diff --git a/library/composables/useMapLayers.js b/library/composables/useMapLayers.js
index ab1af0f7e..8ee2082b5 100644
--- a/library/composables/useMapLayers.js
+++ b/library/composables/useMapLayers.js
@@ -3,6 +3,7 @@
 // Vue 3 Composition API - ES Module with NPM packages
 
 // Import Vue functions from NPM package
+import { retryFetch } from './retryFetch.js'
 import { ref, toRaw } from 'vue';
 import { resolveAssetsBase } from '../utils/embedBase.js'
 import { emissivePaint } from './useMapProvider.js';
@@ -434,7 +435,7 @@ export function useMapLayers(options = {}) {
             // EMPTY first so the addLayer below stays synchronous and keeps its z-order slot
             // (regions → shadow → pins → hitbox); setData once the fetch lands.
             map.addSource('regions', { type: 'geojson', data: { type: 'FeatureCollection', features: [] } });
-            fetch(`${resolveAssetsBase(null)}/boundaries/world-adm0-web.geojson`)
+            retryFetch(`${resolveAssetsBase(null)}/boundaries/world-adm0-web.geojson`)
                 .then((r) => r.json())
                 .then((gj) => {
                     // Tileset field is iso_3166_1_alpha_3; the geojson's is iso3. Normalise ONCE
diff --git a/library/composables/usePrayerStatistics.js b/library/composables/usePrayerStatistics.js
index 0ec017f00..ca9423ad0 100644
--- a/library/composables/usePrayerStatistics.js
+++ b/library/composables/usePrayerStatistics.js
@@ -26,6 +26,7 @@
  * Uses the same shared data config as the rest of the app (sources.json activeSource
  * endpoint + getApiBaseUrl); no DOM, shadow-DOM safe.
  */
+import { retryFetch } from './retryFetch.js'
 import { ref } from 'vue'
 import { getApiBaseUrl } from '../api/apiBaseUrl.js'
 import sourcesConfig from '../api/sources.json'
@@ -49,7 +50,7 @@ async function load() {
       const src  = sourcesConfig?.sources?.[sourcesConfig.activeSource] || {}
       const base = getApiBaseUrl()
       const endpoint = src.endpoints?.statistics || '/api/people-groups/statistics'
-      const res = await fetch(`${base}${endpoint}`, { cache: 'no-store' })
+      const res = await retryFetch(`${base}${endpoint}`, { cache: 'no-store' })
       if (!res.ok) throw new Error(`statistics HTTP ${res.status}`)
       const d = await res.json()
       total.value = Number(d.total || 0)
diff --git a/library/lists/peopleGroupList.js b/library/lists/peopleGroupList.js
index 2f60b093f..e1c1750c6 100644
--- a/library/lists/peopleGroupList.js
+++ b/library/lists/peopleGroupList.js
@@ -23,6 +23,7 @@
  *
  * Pure except for the fetch; safe outside a Vue setup().
  */
+import { retryFetch } from '../composables/retryFetch.js'
 import registry from './lists.json'
 import { resolveAssetsBase } from '../utils/embedBase.js'
 
@@ -90,7 +91,7 @@ const membership = new Map()
 export function loadListMembership(id, profileConfig) {
   const url = `${resolveAssetsBase(unwrapConfig(profileConfig))}/people-groups/lists/${id}.json`
   if (!membership.has(url)) {
-    membership.set(url, fetch(url)
+    membership.set(url, retryFetch(url)
       .then((r) => { if (!r.ok) throw new Error(`HTTP ${r.status}`); return r.json() })
       .then((d) => new Set(Array.isArray(d?.slugs) ? d.slugs : []))
       .catch((e) => { membership.delete(url); throw new Error(`list "${id}" membership ${url}: ${e.message}`) }))
diff --git a/package.json b/package.json
index 9889cd27c..e4aa612c6 100644
--- a/package.json
+++ b/package.json
@@ -225,6 +225,7 @@
     "check:script-flags": "node internal/check-script-flags-reachable.mjs",
     "check:settled": "node internal/settled-tree-gate.mjs",
     "check:map-menu-anchor": "node internal/check-map-menu-anchor.mjs",
+    "check:retry-fetch": "node internal/check-retry-fetch.mjs",
     "check:legend-top-offset": "node internal/check-legend-top-offset.mjs",
     "check:mercator-slice": "node internal/check-mercator-slice.mjs",
     "check:embed-url-absolute": "node internal/check-embed-url-absolute.mjs",

From 933dbf69ceccb31889802f6fa95852215536d033 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:04:56 +0000
Subject: [PATCH 08/12] The phone had no export at all, and the kill-switch
 only ever covered the desktop

RM-EXPORT-KILLSWITCH + RM-RTL-PHYSICAL, from exp's country-posters diff. Both cards are
worth doing and neither is quite what it says.

EXPORT. LegendDesktop takes :export-enabled="EXPORT_FEATURE_ENABLED", so turning the flag
off hides the desktop menu. LegendMobile is OPT-IN BY CONSTRUCTION -- its exportEnabled is
`typeof inject('onLegendExport') === 'function'` (LegendMobile.vue:393) -- and this
profile provided nothing at all. So the flag was not being IGNORED on mobile; there was no
mobile export to ignore it. A reader on a phone had no way to export a poster or a packet
while the same map on a desktop did, which is the opposite complaint and a worse one.

Providing it unguarded would then have created exactly the bug the card names: a phone
keeping an affordance the desktop deliberately hides. So it is provided the way
country-posters already does it, guarded by the same flag, and mobile export exists for
the first time here.

RTL. The card says research-map uses physical CSS where country-posters uses logical.
MEASURED: the rules in question are BYTE-IDENTICAL in both files -- .rm-error, .rm-badge
and .map-scroll-edge--left/right are the same physical declarations either side. They are
part of the 811 shared lines between these two maps, so neither is ahead of the other and
fixing "the gap" would have been fixing nothing.

Two of them are genuinely wrong for RTL and are fixed here: .rm-badge is pinned to the
READING edge, so inset-inline-end; and .dg-field strong's gap is margin-inline-end. Both
exist identically in country-posters and are exp's to mirror.

.map-scroll-edge--left/right STAY PHYSICAL, deliberately: they are literal screen edges
for a scroll affordance and do not mirror. .rm-error's left:12px/right:12px is symmetric
and mirrors to itself. Converting either would be churn dressed as an RTL fix.
---
 .../doxa-research-map/research-map.vue           | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index b3ef9b559..17a6757e9 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -268,7 +268,7 @@ useShadowStyles(`
   .dg-main { font-weight:500;font-size:13px;color:#222;line-height:1.3;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;display:flex;align-items:center;gap:6px; }
   .dg-main strong { font-weight:700;overflow:hidden;text-overflow:ellipsis; }
   .dg-meta { margin-top:2px;display:flex;flex-wrap:wrap;gap:4px 10px;font-size:11px;color:#555;line-height:1.35; }
-  .dg-field strong { font-weight:600;color:#333;margin-right:2px; }
+  .dg-field strong { font-weight:600;color:#333;margin-inline-end:2px; }
   /* Round 16 — labeled category tag replacing the old emoji prefixes. */
   .dg-tag { flex:none;font-size:9px;font-weight:700;text-transform:uppercase;letter-spacing:0.4px;color:#3b463d;background:rgba(59,70,61,0.10);border-radius:4px;padding:1px 5px;line-height:1.5;white-space:nowrap; }
   .dg-agg-label { overflow:hidden;text-overflow:ellipsis; }
@@ -438,7 +438,10 @@ useShadowStyles(`
      map did manage to render stays visible around it. A spinner that outlives the
      failure reads as "slow" and the user just waits; this says the map is gone. */
   .rm-error { position:absolute;top:50%;left:12px;right:12px;z-index:7;transform:translateY(-50%);text-align:center;font:13px/1.5 -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;color:#fecaca;background:rgba(15,18,22,.95);border:1px solid rgba(254,202,202,.28);border-radius:10px;padding:12px 14px;box-shadow:0 2px 10px rgba(0,0,0,.4); }
-  .rm-badge { position:absolute;top:10px;right:10px;background:rgba(124,140,248,0.12);color:#7c8cf8;border:1px solid rgba(124,140,248,0.3);padding:3px 9px;border-radius:4px;font-size:11px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;pointer-events:none;z-index:50; }
+  /* inset-inline-end, not right: this badge is pinned to the READING edge, so under ar it belongs on
+     the left. .map-scroll-edge--left/right below stay physical on purpose — those are literal screen
+     edges for a scroll affordance and do not mirror. */
+  .rm-badge { position:absolute;top:10px;inset-inline-end:10px;background:rgba(124,140,248,0.12);color:#7c8cf8;border:1px solid rgba(124,140,248,0.3);padding:3px 9px;border-radius:4px;font-size:11px;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;pointer-events:none;z-index:50; }
   /* Engine badge — bottom-left, unobtrusive. Colour differs per engine so a
      side-by-side comparison is readable at a glance. */
   .rm-provider-badge { position:absolute;bottom:8px;left:8px;z-index:50;pointer-events:none;padding:2px 8px;border-radius:999px;font:600 10px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;letter-spacing:.04em;color:#fff;background:rgba(30,41,59,0.72);border:1px solid rgba(255,255,255,0.18);backdrop-filter:blur(2px); }
@@ -1503,6 +1506,15 @@ function onExport(kind) {
   if (kind === 'poster') return openPoster()
   if (kind === 'packet') return openPacket()
 }
+// ★ THE PHONE HAD NO EXPORT AT ALL, AND THE KILL-SWITCH ONLY COVERED THE DESKTOP.
+// LegendDesktop takes :export-enabled="EXPORT_FEATURE_ENABLED", so turning that flag off hid the
+// desktop menu — but LegendMobile is OPT-IN BY CONSTRUCTION: its exportEnabled is
+// `typeof inject('onLegendExport') === 'function'` (LegendMobile.vue:393), and this profile provided
+// nothing. So a reader on a phone had no way to export a poster or a packet, while the same map on a
+// desktop did. country-posters already carries the guarded line; this is the missing half here.
+// Providing it UNGUARDED would be the other error — the phone would then keep an affordance the
+// desktop deliberately hides whenever the flag is off, which is the bug exp's card names.
+provide('onLegendExport', EXPORT_FEATURE_ENABLED ? onExport : null)
 
 // ─── Packet export (printed, multi-page: map + a card per people group) ──────
 // Lazy-loaded on first use, the same pattern openPoster() uses. Defensive throughout: never throw

From 838df76c140297c5b8e183b2d9eefd922c8cf3f9 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:09:41 +0000
Subject: [PATCH 09/12] Paraphrase the Driver's words, keeping the attribution
 and the measurement
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

studio strips verbatim Driver quotes from comments and messages when landing (L64), and
these were written before that. Reporting WHO reported a defect and WHEN is what makes a
comment checkable, so the attribution stays; it is only the quoted wording that goes.

Five sites: the scrollbar gate, the embed-url gate and embedBase, the poster-slicing
gate, and research-map's print rule. Every one keeps the date, the source and the
measured numbers — which were always the load-bearing part. "shows a disproportionate
amount of the far south" says the same thing as the quote it replaces, and the 37.0%
band squeezed into 25% is what actually proves it.

No behaviour touched; comments and gate headers only. All six gates still green.
---
 internal/check-embed-url-absolute.mjs             | 2 +-
 internal/check-mercator-slice.mjs                 | 2 +-
 internal/check-one-scroll-container.mjs           | 2 +-
 library/utils/embedBase.js                        | 2 +-
 plugin-designs/doxa-research-map/research-map.vue | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/internal/check-embed-url-absolute.mjs b/internal/check-embed-url-absolute.mjs
index b81e80856..0b487096c 100644
--- a/internal/check-embed-url-absolute.mjs
+++ b/internal/check-embed-url-absolute.mjs
@@ -4,7 +4,7 @@
  *
  * THE DEFECT (Driver, 2026-09-28, testing live): the link copied from Simple Research was
  * `research-map-plus-grid/research-map-plus-grid/index.html` while the page was
- * `http://127.0.0.1:5192/#f=…` — "the perfect example of how embeddability is not working".
+ * `http://127.0.0.1:5192/#f=…`, which he reported as embeddability being broken.
  *
  * WHY IT SURVIVED SO LONG, and it is the reason this is a gate rather than a fix: a relative share link
  * WORKS WHEN CLICKED. The browser resolves it against the page you copied it from, so the person testing
diff --git a/internal/check-mercator-slice.mjs b/internal/check-mercator-slice.mjs
index 89a32a10a..0d83e24ab 100644
--- a/internal/check-mercator-slice.mjs
+++ b/internal/check-mercator-slice.mjs
@@ -2,7 +2,7 @@
 /**
  * check-mercator-slice — a poster's tile rows must be equal on SCREEN, not equal in degrees.
  *
- * THE DEFECT (Driver, 2026-09-28): Simple Research's Export → poster "shows too much of Antarctica"
+ * THE DEFECT (Driver, 2026-09-28): Simple Research's Export → poster shows a disproportionate amount of the far south
  * and comes out at the wrong, vertical aspect.
  *
  * The big-poster renderer stitches tiles, each drawn into an EQUAL-HEIGHT slot of the output. It picked
diff --git a/internal/check-one-scroll-container.mjs b/internal/check-one-scroll-container.mjs
index bbfdf885c..ba23c4db1 100644
--- a/internal/check-one-scroll-container.mjs
+++ b/internal/check-one-scroll-container.mjs
@@ -3,7 +3,7 @@
  * check-one-scroll-container — a plugin pinned into the gallery's pane must not assert a height FLOOR
  * the pane cannot honour.
  *
- * THE DEFECT THIS EXISTS FOR (Driver, 2026-09-28, "one of my least favorite bugs"): on DX Life's
+ * THE DEFECT THIS EXISTS FOR (Driver-reported, 2026-09-28): on DX Life's
  * research page a capability-4 plugin with tabs at the top had an EXTRA element-level scrollbar, and
  * scrolling it scrolled the TAB HEADER out of view — on top of the plugin's own content scroll.
  *
diff --git a/library/utils/embedBase.js b/library/utils/embedBase.js
index d7512681c..325f14301 100644
--- a/library/utils/embedBase.js
+++ b/library/utils/embedBase.js
@@ -185,7 +185,7 @@ export function resolveAssetsBase(profileConfig) {
  * a tree served from a path that does not match `<name>/<name>.js` — base is '' and that expression
  * yields a BARE RELATIVE PATH. Tier 1 then returns it unresolved, and the reader copies
  * `research-map-plus-grid/research-map-plus-grid/index.html` from a page at http://127.0.0.1:5192/
- * (the Driver, 2026-09-28: "the perfect example of how embeddability is not working").
+ * (Driver-reported, 2026-09-28: embeddability broken).
  *
  * ★ AND IT LOOKS RIGHT IN THE ONE PLACE PEOPLE CHECK. A relative share LINK works when clicked, because
  * the browser resolves it against the current page; it is the EMBED that breaks, because an
diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index 17a6757e9..4b33d8339 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -419,8 +419,8 @@ useShadowStyles(`
   /* ★ PRINT: GIVE THE MAP AREA A HEIGHT, OR EVERYTHING ANCHORED TO IT RISES.
      .rm-map-area is flex:1 1 0 — it has no height of its own and fills a viewport-height ancestor.
      Print layout has no viewport height, so that box collapses toward its content height, and the
-     toolbar and legend (position:absolute against it) move UP with its top edge. That is the Driver's
-     "clicking print breaks the CSS: the map controls + legend jump upward", and it needs no print
+     toolbar and legend (position:absolute against it) move UP with its top edge. That is the Driver-reported
+     print breakage (the map controls and legend jump upward), and it needs no print
      stylesheet to cause — the browser's DEFAULT print styles are enough, because nothing here declared
      one. A profile with no @media print rules is not neutral in print; it is unspecified.
      A definite height restores the anchor. This does not change what the poster prints — that is a

From 6c0f1f304077dceee052646426b35bd3a86a1270 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:21:31 +0000
Subject: [PATCH 10/12] The remaining runtime fetches retry, except the one
 where a miss is the plan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The follow-up dx-shepherd queued: wire retryFetch into the library fetches with no
failure handling, and skip any that handle failure deliberately. Four qualified, one did
not, and the distinction is the work.

WIRED, because each already handles an HTTP error and NOT a transport one:
  usePosterPrints  the poster HTML — checks .ok, so a 404 is deliberate; a network throw
                   went uncaught and the poster simply failed
  useSharedMapToken the token service — its .catch degrades to '' by design, but the
                   result is MEMOISED one-fetch-per-URL-per-page, so a single blip meant
                   no token for the whole page and a tokenless Mapbox map
  useCsvExport     the bulk list — .ok checked, transport throw blanks the export
  PeopleGroupDetail the detail API — .ok checked, transport throw blanks the panel
In every one the deliberate degradation is unchanged; it now simply survives a blip
first. retryFetch returns a non-ok RESPONSE untouched, so no .ok path moves.

NOT WIRED, and named in the gate rather than silently skipped: usePosterPrints' probe for
an OPTIONAL pre-rendered .webp. A miss is the EXPECTED path there — it falls through to
generating the poster — so retrying would delay the fallback three times over for an
asset that is legitimately absent. That is failure handling that means something, which
is exactly what the instruction said to leave alone.

The gate now covers all eight sites and carries the exemption as a COUNT for that one
file, so a second bare fetch appearing there still fails. Negative-tested: reverting any
wired site to bare fetch turns it red.
---
 internal/check-retry-fetch.mjs           | 17 ++++++++++++++---
 library/components/PeopleGroupDetail.vue |  3 ++-
 library/composables/useCsvExport.js      |  3 ++-
 library/composables/usePosterPrints.js   |  3 ++-
 library/composables/useSharedMapToken.js |  3 ++-
 5 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/internal/check-retry-fetch.mjs b/internal/check-retry-fetch.mjs
index 57c1b5843..b89d8d52c 100644
--- a/internal/check-retry-fetch.mjs
+++ b/internal/check-retry-fetch.mjs
@@ -67,16 +67,27 @@ const realFetch = globalThis.fetch
 globalThis.fetch = realFetch
 
 // ── and the shared data paths actually use it ────────────────────────────────────────────────────
+// ★ ONE SITE IS DELIBERATELY EXEMPT AND IS NAMED, not silently skipped. usePosterPrints probes for an
+// OPTIONAL pre-rendered .webp and falls through to generating the poster when it is absent — a miss is
+// the expected path, so retrying would delay the fallback for an asset that is legitimately not there.
+// Everything else in that file, and every other runtime request, must retry.
+const EXEMPT = new Map([['library/composables/usePosterPrints.js', 1]])
 for (const rel of [
   'library/composables/useMapLayers.js',
   'library/composables/useCountryOutline.js',
   'library/lists/peopleGroupList.js',
   'library/composables/usePrayerStatistics.js',
+  'library/composables/usePosterPrints.js',
+  'library/composables/useSharedMapToken.js',
+  'library/composables/useCsvExport.js',
+  'library/components/PeopleGroupDetail.vue',
 ]) {
   const src = readFileSync(join(ROOT, rel), 'utf8').replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '')
-  if (/(?<![A-Za-z.])fetch\s*\(/.test(src)) {
-    fails.push(`${rel} still calls bare fetch() for a runtime request — a transport blip there leaves the\n`
-      + '      feature silently absent. Use retryFetch().')
+  const bare = (src.match(/(?<![A-Za-z.])fetch\s*\(/g) || []).length
+  const allowed = EXEMPT.get(rel) || 0
+  if (bare > allowed) {
+    fails.push(`${rel} has ${bare} bare fetch() call(s) for a runtime request, ${allowed} allowed — a transport\n`
+      + '      blip there leaves the feature silently absent. Use retryFetch().')
   }
 }
 
diff --git a/library/components/PeopleGroupDetail.vue b/library/components/PeopleGroupDetail.vue
index 611b695b4..62e9e2328 100644
--- a/library/components/PeopleGroupDetail.vue
+++ b/library/components/PeopleGroupDetail.vue
@@ -108,6 +108,7 @@
 </template>
 
 <script setup>
+import { retryFetch } from '@map/composables/retryFetch.js'
 import { computed, ref, watch, inject } from 'vue';
 import { markPrayedLocally } from '../composables/usePrayedLocally.js';
 import { useI18n } from 'vue-i18n';
@@ -239,7 +240,7 @@ async function fetchDetail(slugVal) {
     // click and routed to the slow WP origin, making images load 10+ seconds.
     // Live counts (prayer / committed / adopted) come from /list which IS
     // cache-busted in DataSourceManager — so freshness stays intact.
-    const res = await fetch(`${baseUrl}/api/people-groups/detail/${encodeURIComponent(slugVal)}?lang=${encodeURIComponent(locale.value)}`);
+    const res = await retryFetch(`${baseUrl}/api/people-groups/detail/${encodeURIComponent(slugVal)}?lang=${encodeURIComponent(locale.value)}`);
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
     detailData.value = await res.json();
   } catch (err) {
diff --git a/library/composables/useCsvExport.js b/library/composables/useCsvExport.js
index 926bcfdd0..19fae656c 100644
--- a/library/composables/useCsvExport.js
+++ b/library/composables/useCsvExport.js
@@ -25,6 +25,7 @@
  * The result is cached for the session; if the fetch fails we still export the loaded record
  * (24 fields) rather than producing nothing — degraded, never broken.
  */
+import { retryFetch } from './retryFetch.js'
 import { getApiBaseUrl } from '@map/api/apiBaseUrl.js'
 import { inject } from 'vue'
 import sourcesConfig from '@map/api/sources.json'
@@ -145,7 +146,7 @@ export function useCsvExport({ rowStore, rows, selectionSet, filterSet, FACET_AC
       const bulk = src.endpoints?.bulk || '/api/people-groups/list'
       const lang = src.queryParams?.lang || 'en'
       const url = `${getApiBaseUrl()}${bulk}?fields=${fields.join(',')}&lang=${lang}`
-      const res = await fetch(url, { cache: 'no-store' })
+      const res = await retryFetch(url, { cache: 'no-store' })
       if (!res.ok) throw new Error(`export list HTTP ${res.status}`)
       const json = await res.json()
       // Only the groups of this page's people-group LIST (library/lists/) are exported.
diff --git a/library/composables/usePosterPrints.js b/library/composables/usePosterPrints.js
index d286175e6..e68eb9daf 100644
--- a/library/composables/usePosterPrints.js
+++ b/library/composables/usePosterPrints.js
@@ -24,6 +24,7 @@
 // is the mechanism the Driver asked for by name: "not supposed to open up a new
 // browser, but should open up the print dialog directly in the browser".
 
+import { retryFetch } from './retryFetch.js'
 import { ref } from 'vue';
 import { openPrintFrame } from './printInPlace.js';
 
@@ -112,7 +113,7 @@ export function usePosterPrints(opts = {}) {
       // NO PRE-RENDERED IMAGE? GENERATE IT. The .webp posters are ~41MB across a tree and are
       // not shipped by default; the HTML is the SOURCE and is smaller than the image it makes.
       set(item, kind, 'render', 'generating the poster', 45);
-      const htmlRes = await fetch(`${base}/posters/${id}.html`);
+      const htmlRes = await retryFetch(`${base}/posters/${id}.html`);
       if (!htmlRes.ok) throw new Error(`poster not found (${htmlRes.status})`);
       const { rasterPoster, looksRendered } = await import('@map/packet/poster-raster.js');
       const blob = await rasterPoster(await htmlRes.text(), { scale: 2 });
diff --git a/library/composables/useSharedMapToken.js b/library/composables/useSharedMapToken.js
index 740db34d4..c7c2c55a6 100644
--- a/library/composables/useSharedMapToken.js
+++ b/library/composables/useSharedMapToken.js
@@ -37,6 +37,7 @@
  * every tile request. It does not widen exposure — it stops a second element on the SAME page from
  * being unable to use what that page was already given. Nothing is persisted or sent anywhere.
  */
+import { retryFetch } from './retryFetch.js'
 import { ref, onBeforeUnmount } from 'vue'
 
 const KEY   = '__doxaMapToken'      // the value, on window, so every bundle sees one copy
@@ -131,7 +132,7 @@ export function fetchMapToken(url) {
   if (typeof window === 'undefined' || !/^https?:\/\//i.test(String(url || ''))) return Promise.resolve('')
   const cache = (window.__doxaMapTokenFetches = window.__doxaMapTokenFetches || {})
   if (cache[url]) return cache[url]
-  const p = fetch(url)
+  const p = retryFetch(url)
     .then((r) => { if (!r.ok) throw new Error('HTTP ' + r.status); return (r.headers.get('content-type') || '').includes('json') ? r.json() : r.text() })
     .then((d) => {
       const tk = String((typeof d === 'string' ? d : d && (d.token || d.tk || d.accessToken)) || '').trim()

From a1460c3ba8271219412eca341298e0871d600ddf Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:27:27 +0000
Subject: [PATCH 11/12] The slower export had no busy state, because its flag
 was not reactive
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

C7 from the bug-class sweep, and it is upg100's finding in the same shape on a different
surface: one path was given feedback and its sibling was never looked at.

openPoster() guards re-entrancy with `posterBusy`, a REF, wired to a control's :active,
:disabled and :aria-busy. openPacket() guarded re-entrancy with `let _packetBusy = false`
-- correct as a guard, and unable to tell the reader anything, because a non-reactive
binding drives no UI. So the FASTER action showed a busy state and the SLOWER one showed
none: the packet does two dynamic imports, a map render, then a card per people group.

A grep for "busy" returns 19 hits in this file and would have called it clean. The
question worth asking was not whether a busy flag exists but whether it can REACH the
reader.

★ AND I WIDENED IT EARLIER TODAY. Providing onLegendExport gave the legend's Export menu
a mobile entry point, so a second way into the unfeedbacked path was added hours before
the sweep found it. The legend reaches BOTH builds, so `legendExportBusy` reports either
-- provided rather than passed, because the mobile sheet's legend is mounted by
LegendMobile and not by this template.

Declared below packetBusy, which it reads. A computed is lazy so a later const would have
resolved at runtime, but check:setup-order exists in this repo because that assumption has
been wrong here before.
---
 .../doxa-research-map/research-map.vue        | 20 +++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index 4b33d8339..86ad45591 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -1519,12 +1519,24 @@ provide('onLegendExport', EXPORT_FEATURE_ENABLED ? onExport : null)
 // ─── Packet export (printed, multi-page: map + a card per people group) ──────
 // Lazy-loaded on first use, the same pattern openPoster() uses. Defensive throughout: never throw
 // uncaught into the UI; guard against double-run.
-let _packetBusy = false
+// ★ A REF, NOT A PLAIN LET, AND THAT IS THE WHOLE DEFECT. This guarded re-entrancy correctly and could
+// not tell the reader anything, because a non-reactive binding drives no UI. Its sibling openPoster()
+// has had `posterBusy` as a ref wired to :active/:disabled/:aria-busy since it was written — so the
+// FASTER action showed a busy state and the SLOWER one (dynamic imports, a map render, then a card per
+// people group) showed none. One path was given feedback and its sibling was never looked at; upg100
+// found the identical shape on their own surface the same day.
+// Widened by me today: providing onLegendExport gave the legend's Export menu a mobile entry point,
+// so there is now a second way into this path.
+const packetBusy = ref(false)
+// The legend's Export menu reaches BOTH builds, so it reports either one. Provided rather than passed
+// because the mobile sheet's legend is mounted by LegendMobile, not by this template.
+const exportBusy = computed(() => posterBusy.value || packetBusy.value)
+provide('legendExportBusy', exportBusy)
 // Neither export hands over a file any more: the poster prints through printImageBlob and the packet
 // through the shared usePosterPrints.printPacket, so the download helper that served packet.pdf is gone.
 async function openPacket() {
-  if (_packetBusy) return
-  _packetBusy = true
+  if (packetBusy.value) return
+  packetBusy.value = true
   try {
     // ★ THE PACKET PRINTS, AND IT PRINTS THROUGH THE SHARED RENDERER (Driver-lens audit card 2, and
     // the Driver's own rule: an export button opens the print dialog, never hands over a file). This
@@ -1651,7 +1663,7 @@ async function openPacket() {
   } catch (err) {
     console.error('[research-map] packet export failed:', err)
   } finally {
-    _packetBusy = false
+    packetBusy.value = false
   }
 }
 

From 1d6d27d0e03f20ea46d6fcd01b6829e89f97c56e Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Mon, 28 Sep 2026 18:30:59 +0000
Subject: [PATCH 12/12] Two scroll probes computed and discarded, kept alive by
 a comment describing a consumer that is not here
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cleanup I owed after reviewing exp's Stage A: _syncScrollZoomToHost now ends in an
unconditional m.scrollZoom.enable(), and docScrolls/ancestorScrolls were function-local
consts that nothing could read.

★ THE COMMENT IS WHY THEY SURVIVED, AND IT WAS WRONG. It said they were "still computed
because the edge affordance keys its gray indicator off the same question — a map with
nothing stacked under it should not advertise a scroll lane". This profile has no such
indicator and never calls useEdgeScrollAffordance: its .map-scroll-edge strips are
background:transparent lanes, always present. So the comment described a consumer that
does not exist here, which is worse than no comment — it makes dead code read as
load-bearing, and it is exactly why I checked the affordance before deleting rather than
trusting either the code or the note.

★ AND IT CORRECTS ADVICE I GAVE exp-shepherd AN HOUR AGO. I told them to "take its
observer with it" because _findScrollportAncestor existed only for this check. It does
not: it is also the second ResizeObserver target at :3074, so it stays. My reading was
one call site short, and acting on it would have removed a live one.

The ResizeObserver itself now re-runs a function that only calls enable(), so it is
waste rather than a bug. NOT removed here: teardown behaviour is not something I can
test headlessly, and this commit is meant to delete what is provably unread.

Also paraphrased the verbatim Driver quote in the same function, per the policy studio
applied in L64 — the attribution and the date stay, which is what makes it checkable.
---
 .../doxa-research-map/research-map.vue        | 24 ++++++++++---------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/plugin-designs/doxa-research-map/research-map.vue b/plugin-designs/doxa-research-map/research-map.vue
index 86ad45591..223d75570 100644
--- a/plugin-designs/doxa-research-map/research-map.vue
+++ b/plugin-designs/doxa-research-map/research-map.vue
@@ -110,15 +110,10 @@ function _findScrollportAncestor(el) {
 function _syncScrollZoomToHost(m) {
   if (!m || !m.scrollZoom) return
   try {
-    const doc = document.documentElement
-    const docScrolls = doc.scrollHeight > window.innerHeight + 4
-    const host = (m.getContainer && m.getContainer()) || null
-    const ancestorScrolls = host ? !!_findScrollportAncestor(host) : false
     // ★ THE MAP KEEPS THE GESTURE. THE EDGE STRIPS ARE THE WAY PAST IT.
-    // Driver, 2026-09-24: "two finger scrolling on the map should allow me to interact with the
-    // map, but instead it just scrolls down past the map and does not interact with the map —
-    // that's what the scroll side bars are there for, to let me interact with the map AND have a
-    // way to scroll down past the map."
+    // Driver-reported, 2026-09-24: a two-finger scroll over the map scrolled the PAGE past it
+    // instead of interacting with the map, and the side strips exist precisely so a reader can do
+    // both — work the map, and still have a lane to scroll the page down.
     //
     // This used to disable scroll-zoom whenever the page or an ancestor could scroll, which is
     // ALWAYS true in the research-map-plus-grid composite (a map with a grid stacked under it).
@@ -135,9 +130,16 @@ function _syncScrollZoomToHost(m) {
     // non-interactive and left the strips redundant. Two fixes for one bug, and the second one
     // silently undid the feature.
     //
-    // So: keep scroll-zoom ON, and let the strips carry the page. `docScrolls`/`ancestorScrolls`
-    // are still computed because the edge affordance below keys its gray indicator off the same
-    // question — a map with nothing stacked under it should not advertise a scroll lane.
+    // So: keep scroll-zoom ON, and let the strips carry the page.
+    //
+    // ★ THE TWO SCROLL PROBES THAT USED TO SIT HERE ARE GONE, AND THE COMMENT THAT KEPT THEM WAS
+    // WRONG. It said docScrolls/ancestorScrolls were still computed because "the edge affordance
+    // keys its gray indicator off the same question". This profile has no such indicator and never
+    // calls useEdgeScrollAffordance: its .map-scroll-edge strips are background:transparent lanes
+    // that are always present (see the rules near the bottom of this stylesheet). They were
+    // function-local consts, computed and discarded — the comment described a consumer that does
+    // not exist here, which is worse than no comment, because it makes dead code look load-bearing.
+    // _findScrollportAncestor STAYS: it is still used to pick a second ResizeObserver target below.
     m.scrollZoom.enable()
   } catch (_) { /* an engine without scrollZoom must never break the panel */ }
 }