Questions for Kim

Anyone can browse everything without an account. Joining is optional, asks for an adult confirmation and nothing about children, and every welcome step can be skipped. Anyone can suggest a place through the public form; nothing publishes until a steward checks it. A joined person can ask to become a contributor; a steward grants it by hand.

Closing the map to members changes the public-access promise in your brief. Opening adding to everyone without review is already ruled out by the brief (submissions never auto-publish).

No person is mapped. Listings carry an organisation's public phone or website only. Accounts hold adult-chosen settings (age bands, budget, step-free, community) that never leave the account. The audit log records who verified what, by username, for stewards only.

Any person-level presence needs explicit, revocable consent on the server, a coarse location at most (the H3 public ceiling is res 8, about 0.7 km² cells, with counts under five suppressed), and a decision about minors, who should never be linkable.

A demo is on the Explore map: press Fog mode, choose where to begin, and a little explorer walks real footpaths and roads (from our OpenStreetMap basemap) between places you pick, clearing the fog as it goes. The trail stays on the device. Saved places exist (private to the account). The map already renders exact H3 cells per venue and a halo one grid step wide, which is the natural unit for clearing fog. No visit history is stored, and no location is read from the device.

Fog can be built from saved places with no new data about where anyone actually went: a person marks a place as visited, and the cell clears. Automatic clearing from the phone's location is out, because the brief forbids covert location collection.

Steward accounts (the Moderators group), starting with the founding stewards Kim, Sasha, Daniel and Bill, approve publication and can edit the published constants without code changes. Editors draft and verify but cannot publish. Every publish, verification and Lumen answer is written to a hash-chained audit log that anyone with admin access can verify. The maths and policy are published in the repository.

The proposal's monthly loop (listen, review, decide, change, report) can be run by whoever you name; the audit log and the decision records are the material for that report. Nothing in the AI can grant itself or anyone else a new power.

Lumen is read-only and lives in the site. It answers only from verified records, shows where every answer came from, and can draft a suggestion for a steward when a signed-in person asks. No messaging channel is connected; the proposal's WhatsApp Business plan is logged as a separate, optional project with its own cost.

Messaging means a third-party platform, a per-message cost outside the $500–$1,000 a year allowance, consent for every recipient, and a duplicate-aware ledger so nobody is messaged twice. It would need written approval before any build.

Trails, beaches, rivers and visitor centres are listed from official sources. Species and nesting or den sites are not mapped; the system has a 'sensitive' flag that keeps a place out of every fine-grained view and only ever shows it in coarse aggregates. The brief rules out exposing sensitive species sites.

Species-level content would need a data-rights log for each source (iNaturalist, CDFW, the parks), a rule for which records are too sensitive to place at all, and a steward who knows the ground. Habitat-level notes on existing listings cost nothing and risk nothing.

Fifty-eight places are live, each summarised from an official website and placed from an authoritative source (the state school directory, agency pages, or OpenStreetMap features in our own map tiles). Every one is labelled 'checked online, not visited'. None counts toward the forty until a person has confirmed it; the admin review queue orders that work by the value of each check.

A pilot group with contributor rights can confirm, correct or reject each of the fifty-eight from their own knowledge, and add what is missing, inside the moderation workflow that already exists. That turns the online checks into the human-verified listings the brief asks for.

Every listing shows its source, how it was located, the date it was checked and a plain-language freshness band. Places that fail the recommendation test are shown with their status rather than hidden. The crescent logo is a gauge of the directory's own confidence. The footer and the home page say the map never claims to be a complete picture.

We could add a 'what is not here yet' panel listing categories with few or no verified entries, and let stewards mark a place as 'disputed' or 'closed, kept for the record'. Public access itself remains your decision; the private preview can become public without code changes.