v1.0.1

Fixed

• The pin that marks the spot you picked on a new report showed as a broken image. It was Leaflet's own marker graphic, served from the same CDN as its stylesheet, and the app's image policy does not allow that host. The pin is now drawn in CSS like the ones on the map, so there is nothing left to fetch and nothing left to block.
• Filing a report with no signal could not set a location. The map library loads from a CDN, so with no network it was not there, and the script that fills in the coordinates stopped on its first line — leaving nothing that could put a position into the form, and the server rightly refused a report without one. The picker now expects the map to be missing, keeps working without it, and is stored on the device with the rest of the offline pages. Your position still comes from GPS, which is a sensor and does not need a network.
• Pressing Use My Location and being refused, or waiting past a timeout, did nothing visible. It now says which happened, and gives the location a longer window to arrive, because a cold GPS fix outdoors is not instant.
• The coordinates you picked are now announced to a screen reader rather than only shown.
• The map went grey a moment after it loaded, and stayed grey as you moved around it. The service worker was forbidden from fetching map tiles by our own security policy: a worker is governed by the headers on its own script, and everything it fetches is judged as a network connection rather than as an image, so the rule that lets the page draw tiles did not apply to it. The worker now carries its own policy, narrower than the page's, that permits exactly the tiles and nothing else. Until the worker took over the page fetched its own tiles, which is why it always looked fine for the first second.
• Map tiles were never actually being kept. Tiles come back in a form the app is not allowed to read — deliberately, since we never asked for permission to read them — and the check for a good response treated every one of them as a failure. The map worked anyway with a connection, so an empty cache looked exactly like a full one, right up until somebody lost signal. Tiles you have already seen are now stored, which is what this was always documented to do.
• Both spellings of the OpenStreetMap tile address are now permitted, so the map will not break on the day they finish retiring the older one.
• A report could be filed at a place that does not exist. Nothing checked that a latitude was a latitude, so a coordinate off the globe was stored, counted in the totals, listed in the feed, and drawn nowhere — the report was real everywhere except the map. Locations outside the world are now refused, and the poles and the antimeridian, which are real places, still work.
• Getting anything wrong on the report form threw away everything you had typed. Somebody who wrote out a situation and forgot to set the location got the blank form back and had to write it again. The form now comes back with your words, your priority, and your pin still in it.
• On the report form, four fields had labels that were not attached to them, so a screen reader announced an unnamed text box and left the placeholder as the only clue — and placeholders vanish the moment you type. The title above the location picker was a label pointing at nothing at all, which is its own kind of lie. The breaths-per-minute question in triage had no name either.
• The small print explaining how each form works was the same colour as the card behind it — 1.4:1, where 4.5:1 is the readable minimum. It was the text that tells a first-time user what to do, including the normal breathing range the triage question cannot be answered without.