Merge main into feat/docs-reconcile; defer to main on two overlapping fixes

main advanced 13 commits while this documentation audit ran — the
location-override work was merged into the outer repo — and it independently
fixed two of the audit's findings. Without this merge the branch would have
REVERTED them, which is the worst outcome for a cleanup pass because it arrives
disguised as an improvement.

Both conflicts resolved in main's favour; main's wording was better informed:

- CLAUDE.md, the single-map-path rule: main's carve-out (829325c) states the
  exception as its own top-level bullet, names MAP_STYLE as the one shared
  thing, and spells out both prohibitions ("do not fold it into initEntryMap",
  "do not add a third path"). Taken verbatim over the version drafted here.
- 2026-07-23-post-form-location-override.md: main (a517331) had already set the
  status to Complete, with far richer detail — the multi-agent review findings,
  the green-run numbers, the DEL4 regression still open, and the merge SHAs.
  Taken in full; the audit's claim that the status "lagged" was dropped, since
  it was true only of this branch's older branch point.

Submodule pin: main bumped user/ to dd19995 and this merge preserves that. The
audit's own no-gitlink-commit discipline applies to bumping the pin as a side
effect of routine work, not to discarding a bump main already made.

main touched none of the other nine corrected documents, so the remaining 18
findings stand unchanged.

Audit notes corrected to match reality rather than left overstated:

- superseded-decisions.md R13 now dates the carve-out to 2026-07-24 (829325c)
  rather than implying this pass introduced it.
- The reconciliation spec gains an "audit baseline moved twice" section: the
  submodule pin lagged real HEAD, and then the base branch advanced mid-audit.
- The compounded learning's section 6 is rewritten from "audit the current
  state" to "re-check the baseline before publishing, not only before starting",
  with the two habits that actually follow: merge the base branch in before
  opening the PR and read conflicts as findings, and when the incoming version
  is better, take it wholesale. An audit has no special authority over the work
  it audits.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/working/specs/2026-07-23-post-form-location-override-design.md

@@ -64,8 +64,8 @@ Backend sanitization has already been added (`user/plugins/cache-on-save/cache-o
 ### Error handling
 
 - No search results: inline message under the search box, map/pin untouched.
-- Search network failure: silent-ish degrade (consistent with existing weather/reverse-geocode error handling in `post-form.js`), fields untouched.
-- Invalid manual `lat`/`lng` text: no client-side hard block (the map preview and eventual server-side `cleanCoordinate()` are the safety nets); this UI's whole point is to make that failure mode rare in practice, not to duplicate the backend validator client-side.
+- Search network failure: fields untouched, and an inline hint says the lookup service could not be reached (distinct from the no-results message, which means the service answered). **Revised in code review 2026-07-24** — this originally said "silent-ish degrade", which in practice left the DOM byte-identical to the pre-click state, so a traveller on flaky mobile data could not tell a failed lookup from a broken button. A non-2xx response is also now treated as a failure rather than parsed as an empty result set.
+- Invalid manual `lat`/`lng` text: the visual mismatch flag is the primary feedback, **and** an unresolved flag blocks submit. **Revised in code review 2026-07-24** — this originally said "no client-side hard block", on the stated grounds that server-side `cleanCoordinate()` was already the safety net. It was not: `cleanCoordinate()` had never been committed, so nothing validated coordinates anywhere. It now ships (`cache-on-save.php`, both the `/post` and Admin2 paths), so the two are genuine defence in depth rather than one imaginary net. Client-side parsing is deliberately *stricter* than the server's `is_numeric` (whole-value decimals only), which is the safe direction for a mismatch.
 - Geolocation permission denied: unchanged existing behavior (`#location-status` error message).
 
 ## Out of scope / explicitly deferred

docs/working/specs/2026-07-25-docs-reconciliation-design.md

@@ -102,8 +102,22 @@ Claims were checked against, not assumed from:
 | `entry-actions` routes | `user/plugins/entry-actions/entry-actions.php:63-73` |
 | `make` targets + env guard | `Makefile` (`guard-env:41-43`, `make-env-target:45-46`) |
 | `travel-memories` removal | `git log -- services/` → `a80b0a9`; `docker compose build` failure |
-| Plan status vs reality | `user/` HEAD `dd19995` |
 
-The `user/` submodule was moved off the outer repo's pin to its real HEAD (`dd19995`) before
-auditing, because the pin lagged and would have produced findings against a state that is no longer
-current.
+## The audit baseline moved twice
+
+Both times, auditing the convenient state rather than the real one would have produced wrong findings.
+
+**The submodule pin lagged.** A fresh worktree checks out the `user/` commit the outer repo pins, not
+`user/`'s real HEAD. The pin predated the merged location-override work, so auditing it would have
+reported a feature as unbuilt and missed two new source files. `user/` was moved to its real HEAD
+(`dd19995`) before auditing, and the gitlink deliberately not committed.
+
+**The outer `main` advanced 13 commits mid-audit.** The location-override branch was merged into the
+outer repo while this pass was running, which independently fixed two of the findings — the
+single-map-path carve-out (`829325c`) and the plan's `Status:` line (`a517331`). Merging `main` in
+before opening the PR was what surfaced that; without it this branch would have **reverted** both.
+`main`'s wording was better than the replacement drafted here and was kept in full. `main` touched none
+of the other nine corrected documents, so the remaining findings stand unchanged.
+
+The general rule: **re-check the baseline before publishing, not only before starting.** A long audit
+races the work it is auditing.