Theseus map picker

Approved: 17 September 2026 (#155)

After Wantok unlock and a live site QR, Theseus lists locations and floors from the paired install and shows the chosen floor’s deployment map. Beacon confirm is BLE confirm. Graph edit is route authoring. This is not Ariadne public navigation.

HTTP contracts stay in field APIs. Pairing stays in site pairing. Unlock stays in layer-1 unlock.

No operator-actions row. Maps come from the customer box. Do not commit hospital rasters or mar.json.

Gate

The picker is the Site map tool on the start screen. Locked Theseus never sees the picker. Unpaired Theseus, and a pairing whose session is checking, revoked, or failed, does not fetch snapshot and does not open the map screen: the card is disabled and says why.

Sync and map

• One GET /api/v1/theseus/navigation/snapshot when the map screen opens. No Ariadne catalog-SHA incremental sync in this item.
• Authorization: Bearer th_… only. Never X-Mobile-Api-Key, JWT, or ops tk_.
• Floor image is the deployment raster (GET …/floor/:id/map with no type=enduser).
• Bytes stay in memory for the session. No on-disk cache.

Viewer

Location dropdown, then floor dropdown. InteractiveViewer + in-memory PNG. No Flame. Beacon hear + tap-to-confirm is BLE confirm. Node overlay + save is route authoring.

Bundle models are a copy of Ariadne navigation_data.dart inside theseus/. No shared Dart package.

Non-goals

Flame, catalog SHA sync, end-user maps, POI / pathfind, FCM, staff ntfy, safecall-ops changes.