Yes, with no location at all
On 2026-10-01 Dad was driving and asked whether he was on the right road. Pippa said yes. She had no location whatsoever. Dad caught it and turned the moment into two todos and one ruling over both: build the location capability once, in the family's shared kit, so every app gets it, and give Pippa a location tool of her own in cwkPippa and in every app that talks to her. Places, travel times and routes go through the Apple Maps Server API, his pick over a web search. Live navigation went to its own app, Pathfinder.
The shape that came out of that afternoon is worth stating whole: one fix shape, one sampler, one store, one tool, many reporters. The fix shape and the sampler live in the kit (GeoFix, ForegroundLocation). The store is services/dad_location.py, which keeps each reporter's latest fix and a 40-fix trail. The tool is location, a family door every vessel carries: where, nearby, find, eta, route, trail. The reporters are the phone (a fix rides every message it sends), the watch (through the phone), sibling engines like Waystone and Spark, Pathfinder, and the office Mac through a small signed helper app, because macOS grants location to an app's identity and never to the conda Python the server runs as.
The rules, in the order they bite
- No claim without a fix. The tool's description and the per-turn block both say it: never say where Dad is, which road he is on, or that he is going the right way without a fix, and say how old and how precise it is. No fix means ask him.
- A fix is evidence of where a device was. It is never re-dated. The phone takes it at Send, so a message that waits out a tunnel in the outbox still says where it was spoken. "Current" means at most 120 seconds old, the same number Waystone measured.
- When In Use, with one stated exception. Every fix a message carries is taken while the app is in use. The phone's one background use is keeping itself awake while a hands-free talk runs on the watch; those positions are counted and thrown away, never sent, and the purpose string the user grants says exactly that.
- Coordinates go to the model and the store, never onto a screen. The phone shows a pin when a fix will ride along and a slashed pin when iOS refused.
- A private conversation's fix serves its turn and is forgotten: not in the store, not in the trail.
- The office Mac is a place, not Dad. Its reporter label says so, and the store prefers anything Dad carries over it.
- On the route is what Pathfinder says, with its age. While Pathfinder guides a drive, its report is the one evidence for "am I on the right road?", and a report older than 120 seconds is not a drive in progress.
His clock is his device's word
The same layer fixed a quieter mistake. The office runs on Korean time, and when Dad travels, "now" for him is somewhere else. On 2026-10-07 a model converting the time itself read a Madrid evening as a Seoul night. Now every chat route carries device_timezone, the zone Dad's own device reports, and the prompt's time line shows his local time under the office clock when the two differ. Nothing server-side reports a zone, and the model never converts on its own.
A place rides with a map
When a reply names a place with a maps.apple.com link, the reply carries one Apple map of those places. That is the licence's own requirement for showing Apple's place data, and it turned out to be the better answer anyway: Dad asked about a place, and the map card is the place, with its name and a link out. The card is a map response part on the reply, so the WebUI and the phone both receive it.
The two clients draw that part differently. The web card is an Apple Maps Web Snapshot pinned at zoom 15; the phone's is a live SwiftUI map. The phone's first version opened its map on the automatic framing, which fits the markers and nothing else, and around a single marker that is MapKit's closest zoom: the card filled with one building's footprint and a giant label and read as a broken placeholder, though every tile had loaded. Since build 134 the phone opens on an explicit region around its places, never tighter than about 1.6 km north to south (todo #409). A card can look broken while every part of it works; the fix was the framing, not a fallback.
Two more pieces finish the layer. Pathfinder reports its drive beside its fixes, and Pippa's navigate hands it a destination: it starts guidance when idle and asks Dad first during a drive, and Pippa says which. And pin saves a place she recommended without starting any guidance, grouped by trip, so a recommendation from chat can wait in Pathfinder until Dad wants it.