diff --git a/CLAUDE.md b/CLAUDE.md
index fb1ef72..55463c0 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -185,6 +185,139 @@ revisions were fetched only *after* its basemap loaded, behind an early return,
 so a floor whose only revisions were candidates listed none of them and **the
 first promotion on any floor could never be made from a browser**.
 
+## Fleet: editing a candidate's zones
+
+The write half of that pane (`ui/zone_editor.mjs`, route `POST /v1/sites/<site>/
+floors/<floor>/zones`, operator flow `docs/fleet/README.md` §11, contract
+`fleet-api.md`): drag vertices, poses and whole zones on the map, double-click
+an edge or vertex to add or remove one, and name the places. **The whole design
+is one rule: editing is a derivation, never a mutation.** Saving re-packs *the revision under review* with the submitted zones
+and accepts the result as an ordinary candidate — same `accept()` as a robot's
+upload, inert until promoted — so a stored revision's bytes never change, which
+is what the announced digests depend on, and promotion stays the only write that
+moves a floor. Five things are load-bearing. **The edit names a source
+revision**, which is what makes an *unpromoted* map editable: `segment-map`
+hands over `zone_01`..`zone_07`, and deriving only from the canonical revision
+meant promoting those placeholders in order to be allowed to fix them —
+publishing a map because it was wrong — besides rebinding coordinates drawn on
+one frame onto another's. **A derivation is held to `promote`'s bar, not the
+upload's** (`accept(require_posegraph=…)`): a revision with no posegraph cannot
+be extended, which is an error for a robot's upload where the session can be
+re-run and a *warning* on something already stored, so the strict bar put an
+`edit zones` button beside a `promotable` verdict that could only ever fail
+(found in a browser; every sim bundle is such a revision). **It lives in the
+review pane and nowhere else** — the operations canvas draws the *published*
+basemap, so an editor there could only ever edit the published revision, and
+"which map are these coordinates against" must have one answer. That also
+retires the MVP's frozen-overlay workaround: after a save the pane selects the
+new candidate and re-reads its zones, so what is on screen is the saved set from
+the server rather than a held-over copy of what was typed. **`navigable` is
+written only when it deviates from the kind**, because every zone arrives from
+the server with the field filled in (`bundle.zone_term` defaults it) and writing
+it back verbatim would carry a `keepout`'s `false` onto a zone just changed to
+`room` — a room nothing can be dispatched to, with nothing on screen to say why.
+And the editor **refuses client-side exactly what the robot's loader refuses**:
+a non-dispatchable name, and two zones answering one query (`ambiguities`
+mirrors `bundle.ambiguities` — names and aliases, not display names), since a
+stored candidate no robot will load is worse than a rejected save. Editing is a
+*mode*: the floor picker, the revision list and promote are disabled while it is
+up, there is no autosave, and `cancel` discards. One pre-existing defect fell
+out and is fixed: the map pane's review button was hidden unless the floor on
+screen had candidates, and above 760 px the tab bar is hidden too — so the pane
+built for floors no robot is reporting was reachable only through a floor a robot
+was reporting.
+
+**What the operator can see is the other half of it**, and the first build of
+this editor failed it in four ways an operator found in one sitting. **One
+`hitTest` answers what a press will take** — the drag reads it, the cursor reads
+it, and the hover highlight draws it — because three targets (vertex, pose, zone
+body) plus a fourth meaning "this drag pans the map" is unguessable from a
+static canvas, and three copies of that ordering would eventually disagree with
+each other. Its highlight ring is *ink*, not white: a canvas gets no cascade, and
+the surface under it is not the theme's background but the basemap, whose free
+space is white in both themes (measured: white moved 1.5% of the pixels around a
+handle, ink moves 12%). **A row is a list, not a form** — it carries what is
+compared *across* zones (name, kind, shape) and the rest of zone/v0
+(`display_name`, `aliases`, `navigable`, `parent`, `tags`, `description`) edits
+in a panel for the *selected* zone, so a new spec field costs no column, and a
+2560 px monitor no longer stretches a twelve-character zone name into a text box
+the size of a paragraph (rows cap at 640 px). **There is one list, not two**:
+one renderer draws a revision's zones read-only and editable alike, `edit zones`
+putting controls into the same cells — two renderers were two layouts that
+drifted, and the read-only one had stranded the kind half a screen from the
+name. Nothing in that column moves when editing opens (asserted in
+`browser_check.mjs`), the editing surface has no border of its own, and a zone
+is always selected: an empty panel needs a caption, and any caption for it
+("select a zone to name it") names one of the several things it is for. And a control exists only where dragging cannot
+reach — `⌖` (place a pose) appears **only** for a zone that has none, a
+`segment-map` room being an outline with no `x`/`y` and so no cross to drag; a
+row's name is a *button*, because in a list the name is what you select by and
+an input there put a caret where a click meant "this one" (renaming moved into
+the panel, beside the zone's other fields). Two controls were built and then cut
+for failing that test: a `+ area`/`− area` cell, and a paragraph of instructions
+standing in for the hover feedback before it existed. **A control sits at the
+level of the thing it acts on**, which three buttons in one row denied: `save as
+candidate` and `cancel` end the mode, so they take the place of `edit zones`
+above the list rather than standing beside a control that adds one zone, and
+`add zone` is the list's last line. The save's message moved with them, out
+of the column of fields for one zone and under the list it is about — with no
+height until there is something to say, since a strip reserved for the longest
+message (the refusal quoting both zones that answer one query) is a gap over the
+first zone that nothing explains. The room comes out of the list instead, the
+one thing in that box which scrolls, so nothing above the message moves. It
+carries what a save *did*, not that one is happening: the outcome used to be set
+on the pane's own line in the far column while this one was cleared, so the only
+thing appearing where the work was happening was `saving…`, lasting as long as
+the request. The mode's banner is gone with it — `save as candidate` says what
+saving does, and the one thing a banner was needed for, the shift modifier, is a
+`title` on the surface it applies to.
+
+**A place is named once.** While a zone's machine name is still one nobody
+chose (`zone_03`), typing its display name sets it through `slugify` — "The
+Kitchen" gives `the_kitchen`, "Café" gives `cafe` (the letter survives, not just
+the accent). It is a proposal in a visible field, and it never rewrites a name
+an operator has chosen, since `goto` takes that name and a fetch may be scripted
+against it; a spelling that cannot become a name at all ("3rd floor") proposes
+nothing rather than mangling one. The field also marks an invalid name *as it is
+typed*: the rule is the loader's and the save enforces it, but a field that looks
+like free text until a save fails does not look like a field with a rule. That
+leaves three naming fields doing two jobs — an identifier, a label, and the
+other spellings `zones.resolve` will also match.
+
+A zone is drawn under `map.zoneLabel` — `display_name` if it has one, else the
+machine name — by the operations map and the editor's own overlay alike, so a
+place cannot answer to one name in the list and another while it is being
+edited. `color-scheme` is declared per theme in the stylesheet for the same
+class of reason: a `select`'s dropdown, a checkbox and a scrollbar are the
+browser's to paint, and left to the *system* preference while the page follows
+its own, a dark page grows a white dropdown list.
+
+**Every coordinate an edit writes lands on a pixel centre** (`snapToPixel`;
+shift is the way off it, chosen over alt because a desktop's window manager
+takes alt-drag and a modifier the page never receives is no modifier at all).
+The map's resolution is the precision available, so a free-hand vertex is digits
+nothing can back — and two zones meant to share a wall land millimetres apart,
+differently every time. Three consequences: a *body* drag snaps its delta rather
+than each vertex (`snapDelta`), so a room traced onto its walls keeps its shape,
+and it is measured from the grab rather than accumulated per move, which would
+drift the zone behind the pointer by whatever each rounding threw away; the
+outline `withKind` invents starts on the grid, while the **pose stays where it
+was taught** — that number was measured by driving a robot there; and nothing
+re-snaps a coordinate the operator did not touch.
+
+**The kind decides whether a zone is a point or an area, and `withKind` makes
+the geometry follow** (`bundle.POINT_KINDS`: dock, charger, pickup, dropoff,
+home). Editing the two separately is what leaves a `dropoff` carrying an outline
+nothing reads and a `room` with no extent `zones.containing` can never match —
+so naming a bare pose an area gives it a square to drag onto the walls (which is
+how an area is drawn in the UI at all), and naming an outlined zone a point
+drops the outline and keeps the pose. Two things fall out. The classification is
+**guidance, not validation**: `bundle` does not refuse an outline on a charger,
+because that would refuse maps taught before the rule existed. And the
+point-ward move is **refused** when the outline's centroid lies outside it (a
+concave hallway) rather than putting the pose in a wall — `poseFor` returns null
+and the select reverts.
+
 ## Fleet: the zone vocabulary
 
 The API served the roster, the basemaps and dispatch, but not the one thing a
diff --git a/docs/fleet/README.md b/docs/fleet/README.md
index 516ae34..8d48324 100644
--- a/docs/fleet/README.md
+++ b/docs/fleet/README.md
@@ -663,12 +663,15 @@ outline for a `polygon`, a cross for a bare waypoint, each labelled — so the
 `goto <zone>` targets you can type are the ones you can see. They come from the
 canonical revision, in that revision's map frame.
 
-Beside the map's floor label is the **canonical revision** it is showing, and,
-when the floor has candidates waiting, a button into the **review** pane —
-which is where a candidate is looked at and promoted (§11). The map pane keeps
-no promote control of its own: this canvas draws robots on the *published*
-basemap, so promoting from beside it would mean promoting a map you have not
-seen.
+Beside the map's floor label is the **canonical revision** it is showing, and a
+button into the **review** pane — which is where a candidate is looked at, its
+zones named, and the map promoted (§11). It says how many candidates the floor
+on screen has when it knows, and it is there either way: above 760 px the tab
+bar is hidden, so a button that appeared only for a floor with candidates was
+the sole door to a pane whose whole point is the floors *no robot is reporting*.
+The map pane keeps no promote control of its own: this canvas draws robots on
+the *published* basemap, so promoting from beside it would mean promoting a map
+you have not seen.
 
 ![The dashboard on a phone](../images/fleet-ui-phone.webp)
 
@@ -893,16 +896,123 @@ which appears whenever the floor on screen has something waiting. It shows:
   revision came from, when it was mapped, its size and resolution, the free/
   occupied/unknown split, whether it carries a posegraph (i.e. whether mapping
   can be continued in this frame), its bytes and digest.
-- **The zones in it**, and — the part that is easy to miss — whether they are
-  the revision's own or **inherited from the floor**. Inherited zones were
-  taught in a previous session's frame: they draw perfectly over the new map and
-  are wrong by however far the two origins differ. The pane says so in words,
-  because the canvas cannot.
+- **The zones in it**, and — the part that is easy to miss — an `inherited`
+  mark beside the heading when they are not the revision's own. A revision that
+  carries no zones is drawn with the floor's, taught in a previous session's
+  frame: they draw perfectly over the new map and are out by however far the two
+  origins differ, which the canvas cannot show. Zones that belong to the map
+  they are drawn on are marked nothing at all — that is what "zones" means.
 - **The promote button**, which is the same audited flip `fleetctl promote`
   makes.
 
-Everything except that button is a read. Nothing you do here changes any floor
-until you promote.
+Everything except that button and the zone editor below is a read. Nothing you
+do here changes any floor until you promote.
+
+### Naming the rooms on it, before you promote it
+
+`pixi run segment-map` finds the rooms of a map but cannot know what they are
+called, so a fresh revision arrives with `zone_01`..`zone_07`. **`edit zones`**,
+beside the zone list, is where they get their names — on the candidate's own map,
+where you can see which room is which.
+
+The controls are the map and the list together:
+
+- **On the map**: drag a vertex to follow a wall, drag a zone to move footprint
+  and pose together, drag a pose cross to move where the robot is sent,
+  double-click an edge to add a vertex or a vertex to remove it. A polygon needs
+  three, so the last removal is refused rather than quietly making a line.
+  **Whatever the next press would take is highlighted under the pointer**, and
+  the cursor says which it is: a crosshair over a vertex, a move cursor over a
+  pose or a zone body, and the map's own grab cursor everywhere else — where a
+  drag pans instead of editing.
+- **Everything you drag lands on a pixel centre** — the map's own grid, so two
+  zones meant to share a wall share the same numbers, and a coordinate never
+  claims precision the map does not have. A whole zone moves by whole pixels, so
+  a traced room keeps its shape. **Hold shift to move freely**, for the rare
+  case that wants a coordinate between two pixels. Only what you drag is
+  snapped: a pose taught by driving a robot there is a measurement, and it is
+  left exactly where the robot said, while an outline this editor invents starts
+  on the grid.
+- **It is the same list either way.** The zones of a revision are listed under
+  the map whether or not you are editing them — name, kind, shape — and
+  `edit zones` puts controls into those rows rather than replacing them with a
+  second list. Nothing moves when you click it: the rows stay where they are and
+  the fields open beside them.
+- **A row is a list you pick from**: the name selects that zone, beside it the
+  **kind**, then the shape it has. `⌖` appears only for a zone with no pose at
+  all (a segmented room is an outline, so there is no cross to drag) and arms
+  the next map click as its pose. `×` deletes the zone; **`add zone`**, the last
+  line of the list, drops a square at the view centre to be dragged into shape
+  and named.
+- **Where a control sits says what it acts on.** `save as candidate` and
+  `cancel` take the place of `edit zones` above the list, because they end the
+  edit that button began; `add zone` is in the list, because that is what it
+  adds to. What the save says — a refusal, or the candidate it wrote — appears
+  under the list, in room the list gives up as the message arrives, and stays
+  until another revision is opened.
+- **Selecting a row** opens that zone's own fields beside the list — and a zone
+  is always selected, so they are always showing something: its **name**
+  (renaming is a deliberate act, not a side effect of clicking the list), the
+  **display name** an operator reads — and which the map is labelled with, here
+  and in the operations view, as soon as it is set — **also called** (the other spellings
+  `goto` should accept — an MCP dispatcher turning "the galley" into a command
+  matches these), **navigable**, the zone it is **inside**, **tags**, and a
+  **description**. They live here rather than in the row because they belong to
+  one zone at a time, and because a column each would make the list unreadable
+  long before zone/v0 ran out of fields.
+
+**The kind decides whether a zone is a point or an area, and the geometry
+follows it.** A `charger`, `dock`, `pickup`, `dropoff` or `home` is a pose to
+drive to; everything else — `room`, `corridor`, `keepout`, `slow`, a plain
+`area` — is a place with extent, and "am I in it" is the question it exists to
+answer. So changing the kind changes the shape: call a taught waypoint a `room`
+and it gets an outline to drag onto the walls; call an outlined zone a `charger`
+and the outline goes, leaving the pose. That is how an area is drawn here, and
+it is one decision rather than two that can contradict each other.
+
+The one refusal: an outline whose centre falls outside it (a concave hallway)
+cannot become a point on its own, because there is no pose to fall back on —
+place one with `⌖` first.
+
+A zone taught by driving reads as an `area` until you say otherwise: `save-zone`
+writes no kind, and `bundle.zone_term` defaults a missing one to `area` rather
+than inventing one. Beyond geometry, three kinds change what a robot does today
+— `keepout` and `slow` are not destinations (`goto` and `fetch` both refuse
+them), and `segment-map` writes `room` — the rest are vocabulary a planner may
+read over `/v1/zones`.
+
+**You should not have to name a place twice.** A machine name is what `goto`
+takes (lowercase, digits, `_`, and the field says so as you type rather than at
+save), and a display name is what a person reads — so while the machine name is
+still one nobody chose (`zone_03`, as `segment-map` and `add zone` mint them),
+typing a display name sets it: "The Kitchen" gives `the_kitchen`, "Café" gives
+`cafe`. It is a proposal, in the field, editable; a name you have already chosen
+is never rewritten, because `goto` takes it and a `fetch` may be scripted
+against it. **Aliases** are the third naming field and a different job: other
+spellings a dispatcher may *say* for the same place, which `goto` also matches.
+
+Two names the same is refused before it is saved — the robot's loader refuses a
+vocabulary where one query answers to two zones rather than picking by luck, so
+the editor must not produce one. A name a dispatcher cannot type (`Café`, `Drop
+Off`) is refused the same way.
+
+**Saving derives a new candidate**: `save as candidate` sends the edited set,
+and the server re-packs the revision you were editing with those zones in place
+of its own. The revision you edited is untouched — including when it is the
+published one — and the new candidate is selected in the pane, so the zones on
+screen afterwards are the saved ones read back from the server. Promote it when
+it looks right. Two consequences worth knowing:
+
+- **Iterating costs a candidate each save.** Editing a candidate derives from
+  *it*, so a floor's list grows while you work; the registry keeps the canonical
+  revision plus the five newest candidates, so the intermediates fall off on
+  their own.
+- **A revision that inherited the floor's zones stops inheriting.** The saved
+  candidate carries them, which is what you want: inherited zones were taught in
+  another session's frame, and dragging them onto this map is the correction.
+
+`cancel` discards the edit. There is no autosave and nothing is written until
+you save, so an edit you are unsure about costs nothing to abandon.
 
 **A floor with nothing published yet works the same way** — which was not always
 true: the dashboard used to fetch a floor's revisions only after its basemap had
diff --git a/docs/fleet/fleet-api.md b/docs/fleet/fleet-api.md
index fb42e4e..4cf23e2 100644
--- a/docs/fleet/fleet-api.md
+++ b/docs/fleet/fleet-api.md
@@ -101,6 +101,8 @@ GET      …/revisions/<rev>/map.json      that revision's own transform + size
 GET      …/revisions/<rev>/map.png       that revision's own image
 GET      …/revisions/<rev>/zones.json    that revision's own zone binding
 POST     …/revisions/<rev>/promote       make it canonical (an operator)
+POST /v1/sites/<site>/floors/<floor>/zones  edited zones of a revision ->
+                                         a new candidate (an operator)
 GET  /                                   the operator UI (static files)
 ```
 
@@ -499,6 +501,69 @@ frame.
 All three are reads, so like every other read route they take no operator token;
 M7 changes that for all of them at once.
 
+### `POST /v1/sites/<site>/floors/<floor>/zones`
+
+Operator token required. The edited zone set, and the revision it was edited
+against:
+
+```json
+{"schema": 1, "revision": "20260802T145731",
+ "zones": {"kitchen": {"x": 1.0, "y": -3.0, "yaw": 0.0, "kind": "room",
+                       "display_name": "The Kitchen", "aliases": ["galley"],
+                       "polygon": [[0.0,-4.0],[2.0,-4.0],[2.0,-2.0],[0.0,-2.0]]}}}
+```
+
+`zones` is the `zones.yaml` shape — keyed by name, both halves of zone/v0 in one
+entry — and it **replaces** that revision's set rather than patching it. An entry
+may echo its key as `name`, which is dropped: the file keys by name and carries
+no second copy.
+
+```json
+{"schema":1,"site":"home","floor":"ground","revision":"20260812T211029",
+ "derived_from":"20260802T145731","promoted":false,"warnings":[],"audit_id":31}
+```
+
+| Status | Meaning |
+|---|---|
+| `201` | stored as a candidate — `revision` is the new one, `derived_from` the edited one |
+| `400` | `zones` is not a mapping, or a name is not a directory name |
+| `401` | no usable operator token (recorded as an anonymous attempt) |
+| `404` | no such floor, or no such `revision` on it |
+| `409` | no `revision` given and the floor has nothing published to edit |
+| `422` | the edited set is not readable as a `zones.yaml`; `errors` says why |
+
+**Editing is a derivation, not a mutation.** The named revision's map bytes are
+re-packed with the submitted zones in place of its own and accepted as an
+ordinary candidate — validated by the same code as a robot's upload, listed by
+the floor route, promotable through the route above. Nothing already stored is
+written: a promoted revision's bytes back a digest the fleet has been told, and a
+candidate is immutable for the same reason an id is never reused. The response
+carries `promoted: false` because that stays a separate, audited decision.
+
+**`revision` is what makes an unpromoted map editable**, and that is the point
+rather than a convenience. A fresh build arrives carrying `zone_01`..`zone_07`
+from `segment-map`; without it the only thing an edit could derive from was the
+canonical revision, so renaming those placeholders meant promoting them first —
+publishing a map *because* it was wrong. It also keeps the coordinates in the
+frame they were drawn in: the operator is looking at that revision's own map.
+Omitted, the canonical revision is edited, which is the same thing for a floor
+whose published map is what is on screen.
+
+**The bar is the source's, not the upload's.** A revision with no posegraph is
+one mapping cannot be continued from — an error for a robot's upload, where the
+session can be re-run, and a *warning* on a stored revision, which navigates
+perfectly and which `promote` will accept. A derivation is therefore validated
+the way `promote` validates: holding an edit to a stricter bar than the revision
+it derives from would put an `edit zones` button beside a `promotable` verdict
+that could only ever fail.
+
+Two things this route deliberately does not do. It does not slugify or otherwise
+repair a name — a zone a dispatcher cannot type is stored with a warning, as
+everywhere else in the vocabulary (`problems` are reported, not enforced; the
+*robot's* loader is what refuses one). And it never publishes: the audit row
+names the actor, the floor and the revision edited, and the floor's `map`
+symlink is untouched.
+
 ---
 
 ## What the browser is allowed to do
@@ -511,7 +576,8 @@ omission, not by intention. M7 makes that structural on the broker side too,
 with a subscribe-only credential.
 
 **Reviewing a candidate is all GETs.** The review pane reads a revision's
-`map.json`, `map.png` and `zones.json` and writes nothing; its one write is the
-`promote` M4 already had, which is authorized and audited like any other. Zone
-*editing* is a separate write (`POST …/floors/<floor>/zones`) that derives a new
-candidate and still changes no published floor.
+`map.json`, `map.png` and `zones.json`; the two writes beside them are the
+`promote` M4 already had and the zone edit above, both operator-authorized and
+both audited. The edit is the only write in the fleet that produces a revision,
+and it produces an inert one: a candidate nobody is running, on a floor that has
+not moved.
diff --git a/mote_bringup/mote_bringup/bundle.py b/mote_bringup/mote_bringup/bundle.py
index afb4a25..531d4c1 100644
--- a/mote_bringup/mote_bringup/bundle.py
+++ b/mote_bringup/mote_bringup/bundle.py
@@ -104,6 +104,20 @@
 #: honoured — otherwise the flag would mean whatever the file last said.
 CONSTRAINT_KINDS = frozenset(("keepout", "slow"))
 
+#: Kinds that name a **pose** rather than a region: a charger is where the robot
+#: docks, not an area it may be anywhere inside of, and "am I in the dropoff" is
+#: not a question about it. Everything else in :data:`ZONE_KINDS` is a place with
+#: extent — a room, a corridor, a keepout — whose footprint is the point of it.
+#:
+#: This is a fact about the vocabulary and so lives beside it, but it is
+#: **guidance, not validation**: a bundle that carries an outline on a `charger`
+#: still loads, because a rule that refused one would refuse maps taught before
+#: the rule existed. What reads it is the zone editor, where changing a zone's
+#: kind is how an operator says which of the two a place is — and the geometry
+#: follows, rather than being toggled separately as though the two were
+#: unrelated.
+POINT_KINDS = frozenset(("dock", "charger", "pickup", "dropoff", "home"))
+
 #: A dispatchable zone name. The shared token a dispatcher types, so it is a
 #: machine name rather than a label: lowercase, no spaces, no punctuation to
 #: guess at. Anything an operator wants to *see* belongs in ``display_name``.
diff --git a/mote_fleet/README.md b/mote_fleet/README.md
index 0ae2542..fddb2ab 100644
--- a/mote_fleet/README.md
+++ b/mote_fleet/README.md
@@ -63,7 +63,7 @@ pixi run -e fleet fleetctl -- dispatch mote-01 goto kitchen
 | [`server/registry.py`](server/registry.py) | the SQLite row store: robots, enrollment tokens, operators, the audit log, transactional id allocation |
 | [`server/bundle_store.py`](server/bundle_store.py) | the map registry's byte store: candidate revisions, validation on the way in, the atomic flip that publishes one |
 | [`server/fleetctl.py`](server/fleetctl.py) | operator CLI: tokens, roster, dispatch, audit, watch |
-| [`server/ui/`](server/ui/) | the dashboard: `index.html`, `app.mjs`, `map.mjs` (basemap + the Q5 transform, pan/pinch), `mqtt.mjs` (a subscribe-only MQTT client), `layout.mjs` (one pane at a time on a phone) |
+| [`server/ui/`](server/ui/) | the dashboard: `index.html`, `app.mjs`, `map.mjs` (basemap + the Q5 transform, pan/pinch), `mqtt.mjs` (a subscribe-only MQTT client), `layout.mjs` (one pane at a time on a phone), `review.mjs` (see a candidate before promoting it), `zone_editor.mjs` (name its zones, saved as a new candidate) |
 | [`server/mosquitto.conf`](server/mosquitto.conf), [`broker.sh`](server/broker.sh) | the broker, its WebSocket listener, and where its state goes |
 | [`deploy/`](deploy/) | the deployed shape: an image for the API+UI, a compose file that runs it beside the broker, and `fleet-deploy.sh` (gated update, rollback, backup, restore) |
 
diff --git a/mote_fleet/server/bundle_store.py b/mote_fleet/server/bundle_store.py
index eecd31b..315a8d3 100644
--- a/mote_fleet/server/bundle_store.py
+++ b/mote_fleet/server/bundle_store.py
@@ -354,26 +354,44 @@ def read_vocabulary(self, site: str, floor: str) -> dict:
             raise StoreError(f"no zones for {site}/{floor}", 404)
         return bundle.vocabulary(bundle.read_zones(path), site, floor)
 
-    def derive_zones(self, site: str, floor: str, zones: dict, *, by: str):
-        """A new candidate revision: the canonical map's bytes, edited zones.
+    def derive_zones(
+        self, site: str, floor: str, zones: dict, *, by: str, source: str = ""
+    ):
+        """A new candidate revision: one revision's map bytes, edited zones.
 
         An operator's zone edit never touches a stored revision — a promoted
         revision's bytes back a digest the fleet has been told, and a candidate
         is immutable for the same reason one id is never reused. So an edit is
-        a *derivation*: pack the canonical revision with the submitted zones in
+        a *derivation*: pack the source revision with the submitted zones in
         place of its own, and accept the result as an ordinary candidate —
         validated by the same code as any upload, inert until promoted.
+
+        ``source`` is the revision being edited, defaulting to the canonical
+        one. Naming a candidate is what makes an unpromoted map editable: the
+        first build of a floor arrives with `zone_01`..`zone_07` from
+        `segment-map`, and defaulting to the canonical would have meant
+        promoting placeholder names in order to be allowed to fix them —
+        publishing a map *because* it was wrong. It also puts the edit in the
+        frame it was drawn in: the operator renaming rooms is looking at the
+        candidate's own map in the review pane, and rebinding those names onto
+        the published map's frame is exactly the trap the pane exists to name.
         Returns ``(stored_revision, report, derived_from)``.
         """
-        canonical = self.canonical(site, floor)
-        if not canonical:
+        source = source or self.canonical(site, floor)
+        if not source:
             raise StoreError(
                 f"{site}/{floor} has no published map to edit zones on", 409
             )
-        rev_dir = self.revision_dir(site, floor, canonical)
+        rev_dir = self.revision_dir(site, floor, source)
         previous = {}
-        zones_file = rev_dir / bundle.ZONES_YAML
-        if zones_file.is_file():
+        # The zones the operator was shown, which is what the edit is a delta
+        # of: `_zones_file` falls back to the floor's file for a revision
+        # carrying none, and so does the review pane that fed the editor. The
+        # `frame_id` and `vocabulary_revision` come from there for the same
+        # reason — an edit that silently reset the vocabulary revision would
+        # make a later carry-forward unable to tell which naming is newer.
+        zones_file = self._zones_file(site, floor, revision=source)
+        if zones_file is not None:
             try:
                 previous = bundle.read_zones(zones_file)
             except bundle.BundleError:
@@ -400,8 +418,9 @@ def derive_zones(self, site: str, floor: str, zones: dict, *, by: str):
             datetime.now(timezone.utc).strftime("%Y%m%dT%H%M%S"),
             blob,
             uploaded_by=by,
+            require_posegraph=False,
         )
-        return stored, report, canonical
+        return stored, report, source
 
     def vocabularies(self) -> list:
         """Every floor's vocabulary, for a dispatcher bootstrapping a whole
@@ -468,6 +487,7 @@ def accept(
         *,
         robot_id: str = "",
         uploaded_by: str = "",
+        require_posegraph: bool = True,
     ) -> tuple[str, bundle.Report]:
         """Store an uploaded revision as a **candidate**. Returns ``(id, report)``.
 
@@ -475,6 +495,16 @@ def accept(
         robot is running. That separation is the milestone's conflict story: a
         second robot's map of the same floor is kept beside the first, and an
         operator promotes one.
+
+        ``require_posegraph`` is what a *robot's upload* is held to and what a
+        derivation is not: a mapping session that produced no posegraph produced
+        a map nothing can extend, and that is worth refusing at the source. A
+        revision already in the registry has been judged by the looser rule
+        :meth:`promote` uses, so a derivation of one must not be held to a
+        stricter bar than the revision it came from — the review pane calls such
+        a revision promotable, and an `edit zones` button beside that verdict
+        that could only ever fail is worse than no button (observed: the sim's
+        own bundles carry no posegraph).
         """
         if not self.root:
             raise StoreError("this server stores no site bundles", 404)
@@ -491,7 +521,7 @@ def accept(
             except bundle.BundleError as exc:
                 raise StoreError(str(exc), 400) from exc
             try:
-                report = bundle.validate(staging)
+                report = bundle.validate(staging, require_posegraph=require_posegraph)
             except bundle.BundleError as exc:
                 # validate() documents that it reports rather than raises, and
                 # it is tested that way. Belt and braces: a validator that
diff --git a/mote_fleet/server/fleet_server.py b/mote_fleet/server/fleet_server.py
index 005a01a..6985d87 100644
--- a/mote_fleet/server/fleet_server.py
+++ b/mote_fleet/server/fleet_server.py
@@ -37,7 +37,8 @@
     GET      .../revisions/<rev>/map.png     that revision's own image
     GET      .../revisions/<rev>/zones.json  that revision's own zone binding
     POST     .../revisions/<rev>/promote     make it canonical (operator)
-    POST /v1/sites/<site>/floors/<floor>/zones  edited zones -> new candidate (operator)
+    POST /v1/sites/<site>/floors/<floor>/zones  edited zones of a revision ->
+                                             a new candidate (operator)
     GET  /                                   the operator UI (static files)
 
     pixi run fleet-server -- --db ~/fleet/registry.db --broker-host fleet-box
@@ -816,13 +817,19 @@ def _promote(self, rest: str, body: dict):
         )
 
     def _edit_zones(self, rest: str, body: dict):
-        """An operator's zone edit: derive a candidate from the canonical map.
+        """An operator's zone edit: derive a candidate from a revision.
 
         The edit writes nothing the fleet can see — the result is an ordinary
         candidate (same map bytes, new zones), validated like any upload and
         inert until the operator promotes it through the existing route. That
         keeps promoted revisions immutable, which the announced digests rely
         on, and keeps promotion the only write that changes a floor.
+
+        The body's optional ``revision`` is the revision being edited; without
+        one the canonical map is edited, as before. It is a body field rather
+        than a path segment because the edited revision is an *input* to the
+        derivation and never the thing written — the route's own resource is
+        the floor's zones, and the result is a revision id neither end chose.
         """
         parts = rest.split("/")
         if len(parts) != 3 or parts[1] != "floors":
@@ -844,23 +851,27 @@ def _edit_zones(self, rest: str, body: dict):
             )
             self._error(401, str(exc))
             return
-        if not self._names(site, floor):
+        source = str(body.get("revision") or "")
+        if not self._names(site, floor, *([source] if source else [])):
             return
         zones = body.get("zones")
         if not isinstance(zones, dict):
             self._error(400, "a zones mapping is required: {zones: {name: {...}}}")
             return
         actor = operator["name"]
+        # The audit row names what was edited, not only which floor: two
+        # candidates of one floor are two different maps, and "who renamed the
+        # rooms on this map" is unanswerable from the floor alone.
         entry = registry.record(
             actor=actor,
             action="map.zones",
-            command=target,
+            command=f"{target}/{source}" if source else target,
             result="editing",
             remote=self.address_string(),
         )
         try:
             stored, report, derived_from = self.server.store.derive_zones(
-                site, floor, zones, by=actor
+                site, floor, zones, by=actor, source=source
             )
         except StoreError as exc:
             registry.finish(entry["id"], "rejected", str(exc))
@@ -876,7 +887,9 @@ def _edit_zones(self, rest: str, body: dict):
             traceback.print_exc()
             self._error(500, "the zone edit could not be stored")
             return
-        registry.finish(entry["id"], "stored", f"candidate {stored}")
+        registry.finish(
+            entry["id"], "stored", f"candidate {stored} from {derived_from}"
+        )
         print(
             f"zone edit {target} by {actor}: candidate {stored} (from {derived_from})",
             file=sys.stderr,
diff --git a/mote_fleet/server/ui/app.mjs b/mote_fleet/server/ui/app.mjs
index 6d10675..4a5ef3e 100644
--- a/mote_fleet/server/ui/app.mjs
+++ b/mote_fleet/server/ui/app.mjs
@@ -14,7 +14,6 @@
 
 import { BrokerReader, parseTopic } from './mqtt.mjs';
 import { MapView } from './map.mjs';
-import { ZoneEditor } from './zone_editor.mjs';
 import { ReviewView } from './review.mjs';
 import { setupPanes } from './layout.mjs';
 
@@ -42,7 +41,6 @@ const state = {
 
 const dom = {};
 let mapView = null;
-let editor = null;
 let review = null;
 let panes = null;
 let pending = false;
@@ -182,10 +180,6 @@ async function ensureMap(record) {
   if (key === state.mapKey) return;
   state.mapKey = key;
   state.floor = null;
-  if (editor) {
-    editor.end();
-    dom.zonesEdit.disabled = false;
-  }
   setZones([]);
   renderRevisions();
   if (!key) {
@@ -255,10 +249,16 @@ function renderRevisions() {
   const candidates = floor
     ? floor.revisions.filter((revision) => !revision.canonical)
     : [];
-  dom.reviewJump.hidden = candidates.length === 0;
-  dom.reviewJump.textContent = `${candidates.length} candidate${
-    candidates.length === 1 ? '' : 's'
-  } — review`;
+  // Always reachable, and *not* conditional on this floor having candidates.
+  // The tab bar it shares the job with is hidden above 760 px, so while this
+  // was, a desk-width operator could reach the review pane only through a
+  // floor a robot was reporting — which is precisely the floor review is least
+  // needed for. The floor mapped last week by a robot since switched off, and
+  // the floor a build lands on with no robot near it, were both unreachable.
+  dom.reviewJump.hidden = false;
+  dom.reviewJump.textContent = candidates.length
+    ? `${candidates.length} candidate${candidates.length === 1 ? '' : 's'} — review`
+    : 'review maps';
 }
 
 // The zones of the floor on screen, as a `goto` the operator does not have to
@@ -295,42 +295,6 @@ function onPromoted() {
   scheduleRender();
 }
 
-// Editing starts from the zones on screen — the canonical floor's — and never
-// writes back to them: saving derives a fresh candidate revision server-side,
-// which the picker then promotes like any robot-published map.
-function onEditZones() {
-  if (!state.mapKey || !mapView.map) return;
-  editor.begin(state.zones);
-  dom.zonesEdit.disabled = true;
-}
-
-async function onSaveZones() {
-  const problem = editor.problems();
-  if (problem) {
-    dom.zoneNote.textContent = problem;
-    dom.zoneNote.className = 'note error';
-    return;
-  }
-  const [site, floor] = state.mapKey.split('/');
-  dom.zoneNote.textContent = 'saving\u2026';
-  dom.zoneNote.className = 'note';
-  try {
-    const body = await api(`/v1/sites/${site}/floors/${floor}/zones`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ schema: 1, zones: editor.payload() }),
-    });
-    editor.finish();
-    dom.zonesEdit.disabled = false;
-    dom.promoteNote.textContent = `zone candidate ${body.revision} saved \u2014 the zones shown are the candidate's; open review to see it and promote it`;
-    dom.promoteNote.className = 'note';
-    await loadFloor(site, floor, state.mapKey);
-  } catch (error) {
-    dom.zoneNote.textContent = error.message;
-    dom.zoneNote.className = 'note error';
-  }
-}
-
 // -- rendering -----------------------------------------------------------
 
 function scheduleRender() {
@@ -597,7 +561,6 @@ function bind() {
     mapLabel: 'map-label',
     mapRevision: 'map-revision',
     reviewJump: 'review-jump',
-    promoteNote: 'promote-note',
     canvas: 'map-canvas',
     follow: 'follow',
     fit: 'fit',
@@ -609,7 +572,6 @@ function bind() {
     reviewVerdictNotes: 'review-verdict-notes',
     reviewNotesLabel: 'review-notes-label',
     reviewProvenance: 'review-provenance',
-    reviewZones: 'review-zones',
     reviewZoneSource: 'review-zone-source',
     reviewCanvas: 'review-canvas',
     reviewMapLabel: 'review-map-label',
@@ -619,7 +581,7 @@ function bind() {
     zonesEdit: 'zones-edit',
     zoneEditor: 'zone-editor',
     zoneRows: 'zone-rows',
-    zoneAdd: 'zone-add',
+    zoneDetail: 'zone-detail',
     zoneSave: 'zone-save',
     zoneCancel: 'zone-cancel',
     zoneNote: 'zone-note',
@@ -655,12 +617,20 @@ export async function boot() {
       verdictNotes: dom.reviewVerdictNotes,
       notesLabel: dom.reviewNotesLabel,
       provenance: dom.reviewProvenance,
-      zones: dom.reviewZones,
       zoneSource: dom.reviewZoneSource,
       mapLabel: dom.reviewMapLabel,
       promote: dom.reviewPromote,
       fit: dom.reviewFit,
       note: dom.reviewNote,
+      // The zone editor's own controls. It lives in this pane because it edits
+      // the *selected revision's* zones over that revision's own map.
+      zonesEdit: dom.zonesEdit,
+      editor: dom.zoneEditor,
+      editorRows: dom.zoneRows,
+      editorDetail: dom.zoneDetail,
+      editorNote: dom.zoneNote,
+      zoneSave: dom.zoneSave,
+      zoneCancel: dom.zoneCancel,
     },
   });
   // A canvas has no size until its pane is on screen, so each map is told when
@@ -686,18 +656,6 @@ export async function boot() {
     mapView.draw();
   });
   dom.dispatch.addEventListener('submit', onDispatch);
-  editor = new ZoneEditor(mapView, {
-    panel: dom.zoneEditor,
-    rows: dom.zoneRows,
-    note: dom.zoneNote,
-  });
-  dom.zonesEdit.addEventListener('click', onEditZones);
-  dom.zoneAdd.addEventListener('click', () => editor.addZone());
-  dom.zoneSave.addEventListener('click', onSaveZones);
-  dom.zoneCancel.addEventListener('click', () => {
-    editor.end();
-    dom.zonesEdit.disabled = false;
-  });
   document.getElementById('token-form').addEventListener('submit', onToken);
 
   state.config = await api('/v1/config');
diff --git a/mote_fleet/server/ui/index.html b/mote_fleet/server/ui/index.html
index 1a7bcdf..2749f03 100644
--- a/mote_fleet/server/ui/index.html
+++ b/mote_fleet/server/ui/index.html
@@ -44,27 +44,17 @@ <h2>map</h2>
           <span id="map-label" class="dim">—</span>
           <span id="map-revision" class="pill"></span>
           <!-- A candidate is a map a robot published; it changes nothing until
-               an operator promotes it. Promotion happens in the review pane,
-               where the candidate's own map is on screen — this is only the
-               signpost that says there is something to look at. -->
-          <button id="review-jump" type="button" hidden></button>
+               an operator promotes it. Promotion, and editing its zones, happen
+               in the review pane where that candidate's own map is on screen —
+               this is the way in. It is always here, and says how many
+               candidates the floor on screen has when it knows: above 760 px
+               the tab bar is hidden, so a conditional button was the only door
+               to a pane whose whole point is floors no robot is reporting. -->
+          <button id="review-jump" type="button">review maps</button>
           <label class="check"><input type="checkbox" id="follow" /> follow</label>
           <button id="fit" type="button">fit</button>
-          <button id="zones-edit" type="button">edit zones</button>
         </div>
         <canvas id="map-canvas"></canvas>
-        <p id="promote-note" class="note"></p>
-        <!-- Zone edits never touch the canonical revision: saving derives a
-             new candidate (same map, new zones) for the picker to promote. -->
-        <div id="zone-editor" class="zone-editor" hidden>
-          <div id="zone-rows" class="zone-rows"></div>
-          <div class="zone-actions">
-            <button id="zone-add" type="button">add zone</button>
-            <button id="zone-save" type="button">save as candidate</button>
-            <button id="zone-cancel" type="button">cancel</button>
-          </div>
-          <p id="zone-note" class="note"></p>
-        </div>
       </section>
 
       <!-- Candidate review. Addressed by floor rather than by robot: the floor
@@ -109,12 +99,49 @@ <h3>provenance</h3>
 
           <div class="review-map">
             <canvas id="review-canvas"></canvas>
-            <h3>zones</h3>
-            <!-- Which map frame these coordinates were taught in. A revision
-                 that carries no zones.yaml inherits the floor's, which is a
-                 different SLAM session's frame — the trap M4 named. -->
-            <p id="review-zone-source" class="dim"></p>
-            <div id="review-zones" class="zone-rows"></div>
+            <!-- One box, whichever mode is in it. The editing surface is taller
+                 than the list it replaces, and with the canvas taking the
+                 remaining height that difference came out of the map: clicking
+                 `edit zones` resized the thing being edited. -->
+            <div class="zones-panel">
+            <div class="zones-head">
+              <h3>zones</h3>
+              <!-- Which map frame these coordinates were taught in, said only
+                   when it is not this one: a revision carrying no zones is
+                   drawn with the floor's, which were taught on a different map.
+                   The trap M4 named, as a state rather than a caption. -->
+              <span id="review-zone-source" class="pill warn" hidden></span>
+              <!-- Editing is on the *selected revision*, which is why it is
+                   here and not on the operations map: a zone is a coordinate
+                   in one map frame, so the map under it has to be the map it
+                   belongs to. Saving derives a new candidate; the revision on
+                   screen is never written. -->
+              <button id="zones-edit" type="button" hidden>edit zones</button>
+              <!-- The edit ends where it began. These two replace `edit zones`
+                   in the same spot, because they are the same level of thing:
+                   what starts and finishes the whole edit. `add zone` is not —
+                   it acts on one item, so it lives at the foot of the items. -->
+              <button id="zone-save" type="button" hidden>save as candidate</button>
+              <button id="zone-cancel" type="button" hidden>cancel</button>
+            </div>
+            <!-- One list, whether or not it is being edited: the same rows with
+                 text where the controls go. Two renderers were two layouts that
+                 drifted, and the difference between looking and editing should
+                 be the controls rather than the page. -->
+            <div id="zone-rows" class="zone-rows"></div>
+            <!-- What the save says, under the list it is about. It has no
+                 height until there is something to say, so the room comes out
+                 of the one thing here that scrolls. -->
+            <p id="zone-note" class="note"></p>
+            <div id="zone-editor" class="zone-editor" hidden>
+              <div class="zones-head"><h3>details</h3></div>
+              <!-- The selected zone's vocabulary. A row per zone carries what
+                   you compare across zones; this carries what belongs to one
+                   of them, and is where a new zone/v0 field lands without
+                   costing every row a column. -->
+              <div id="zone-detail" class="zone-detail"></div>
+            </div>
+            </div>
           </div>
         </div>
       </section>
diff --git a/mote_fleet/server/ui/map.mjs b/mote_fleet/server/ui/map.mjs
index 96fd4ce..1f605dd 100644
--- a/mote_fleet/server/ui/map.mjs
+++ b/mote_fleet/server/ui/map.mjs
@@ -14,6 +14,15 @@
 // an accident of where SLAM started, so metres from one floor mean nothing on
 // another. The second hop is pan/zoom and belongs to the viewer alone.
 
+// What to call a zone on a map. `display_name` is the half meant for reading —
+// "The Kitchen" — and the machine name is the half meant for typing, so a zone
+// that has been given one is drawn with it. The editor draws its own overlay
+// and reads this too: a zone should not answer to one name in the list and
+// another the moment it is being edited.
+export function zoneLabel(zone) {
+  return (zone && (zone.display_name || zone.name)) || '';
+}
+
 // A zone as pixels on the basemap: a polygon's vertices, or a circle. Pure, so
 // the placement of a taught place is testable the same way a robot's is.
 export function zoneOutline(map, zone) {
@@ -440,7 +449,7 @@ export class MapView {
     // display_name is what an operator calls the place; the machine name is
     // what they would type. Prefer the former on the map, where this is a
     // label rather than a thing to copy.
-    ctx.fillText(zone.display_name || zone.name, point.x, point.y + 14);
+    ctx.fillText(zoneLabel(zone), point.x, point.y + 14);
   }
 
   _screenOf(pixel) {
diff --git a/mote_fleet/server/ui/review.mjs b/mote_fleet/server/ui/review.mjs
index 2673824..525068d 100644
--- a/mote_fleet/server/ui/review.mjs
+++ b/mote_fleet/server/ui/review.mjs
@@ -22,10 +22,13 @@
 //     here. The zone list below is deliberately a row per zone with its own
 //     cells, because that is where those controls go.
 //
-// The write surface does not grow: everything this view reads is a GET, and the
-// one thing it writes is the promote M4 already had.
+// Two writes leave this pane, and both are audited operator actions: the
+// promote M4 already had, and the zone edit beside it (`zone_editor.mjs`),
+// which derives a *new* candidate rather than touching the revision on screen.
+// Nothing here changes a floor until the promote.
 
 import { MapView } from './map.mjs';
+import { ZoneEditor } from './zone_editor.mjs';
 
 // -- routes ---------------------------------------------------------------
 
@@ -185,31 +188,28 @@ export function provenanceRows(revision) {
   ];
 }
 
-// Where the zones on screen came from, which the coordinates cannot say. A
-// revision that carries none inherits the floor's — taught in a *previous* SLAM
-// session's frame, and so wrong for this map by however far the two origins
-// differ. That is a reason to look before promoting, which is what this pane is
-// for, so it is said out loud rather than left to the validator's warning list.
+// Where the zones on screen came from, which the coordinates cannot say — as a
+// state beside the heading, in the idiom the rest of the page uses, rather than
+// a sentence of prose under it.
+//
+// **The ordinary case says nothing.** Zones that belong to the revision they are
+// drawn on are what "zones" already means; a caption announcing it is a label
+// for the absence of a problem, in words ("taught in this revision's own
+// frame") that only mean anything to someone who knows the problem. What is
+// worth a word is the exception: a revision carrying no zones of its own is
+// drawn with the *floor's*, taught in a previous SLAM session's frame and so
+// out by however far the two origins differ. `null` is "nothing to say".
 export function zoneSource(source, count) {
-  if (!count) return 'this revision carries no zones';
+  if (!count) return { tag: 'none', title: 'this revision carries no zones' };
   if (source === 'floor') {
-    return 'inherited from the floor — this revision carries none, so these were taught on another map frame';
-  }
-  return 'taught in this revision’s own frame';
-}
-
-// One zone's geometry in a phrase. The vocabulary half (kind, aliases) is shown
-// in its own cells; this is the binding half, which is the half that is only
-// true against the map beside it.
-export function zoneSummary(zone) {
-  if (zone.polygon && zone.polygon.length >= 3) {
-    return `polygon, ${zone.polygon.length} vertices`;
-  }
-  if (typeof zone.radius === 'number') return `circle, r ${zone.radius} m`;
-  if (zone.x !== undefined && zone.y !== undefined) {
-    return `waypoint ${zone.x.toFixed(2)}, ${zone.y.toFixed(2)}`;
+    return {
+      tag: 'inherited',
+      title:
+        'this revision carries no zones, so the floor’s are drawn: they were ' +
+        'taught on another map and line up only as far as the two frames do',
+    };
   }
-  return 'no footprint';
+  return null;
 }
 
 // -- the view -------------------------------------------------------------
@@ -240,13 +240,26 @@ export class ReviewView {
     // and an image decode; without this, clicking through two candidates draws
     // whichever finished last rather than the one selected.
     this.epoch = 0;
+    // The zones last loaded for the selected revision, which is what an edit
+    // starts from and what the map goes back to if the edit is cancelled.
+    this.zones = [];
+    this.editing = false;
     this.map = new MapView(dom.canvas);
+    this.editor = new ZoneEditor(this.map, {
+      panel: dom.editor,
+      rows: dom.editorRows,
+      detail: dom.editorDetail,
+      note: dom.editorNote,
+    });
     dom.floor.addEventListener('change', () => this.open(dom.floor.value));
     dom.promote.addEventListener('click', () => this.promote());
     dom.fit.addEventListener('click', () => {
       this.map.fit();
       this.map.draw();
     });
+    dom.zonesEdit.addEventListener('click', () => this.beginEdit());
+    dom.zoneSave.addEventListener('click', () => this.saveZones());
+    dom.zoneCancel.addEventListener('click', () => this.endEdit());
   }
 
   // The pane's canvas has no size until the pane is on screen, so a fit done
@@ -276,10 +289,16 @@ export class ReviewView {
   async open(key, revision = null) {
     const parsed = parseFloorKey(key);
     if (!parsed) return;
+    // An edit in progress owns the pane: re-opening a floor would reload the
+    // zones under it and drop the edit on the floor. The controls that lead
+    // here are disabled while editing; this covers the ones that arrive from
+    // elsewhere (the map pane's jump button).
+    if (this.editing) return;
     const epoch = (this.epoch += 1);
     this.key = key;
     this.dom.floor.value = key;
     this.note('');
+    this.editor.note('');
     try {
       this.detail = await this.api(floorPath(parsed.site, parsed.floor));
     } catch (error) {
@@ -344,6 +363,93 @@ export class ReviewView {
     }
   }
 
+  // -- editing ----------------------------------------------------------
+
+  // Editable when there is a revision selected and its map is on screen: the
+  // coordinates being dragged mean nothing except against that image, and a
+  // revision whose map failed to load has none.
+  editable() {
+    return Boolean(this.selected && this.map.map);
+  }
+
+  // Editing is a mode on the selected revision, so while it is on, the things
+  // that would swap that revision out from under it are disabled rather than
+  // racing it. There is no autosave: an unsaved edit is lost to `cancel`, and
+  // nothing else can reach it.
+  renderEditControls() {
+    // One control at a time in one place: `edit zones` is what is there to
+    // begin with, and while the edit is up its two endings stand in for it.
+    this.dom.zonesEdit.disabled = !this.editable();
+    this.dom.zonesEdit.hidden = this.editing || !this.editable();
+    this.dom.zoneSave.hidden = !this.editing;
+    this.dom.zoneCancel.hidden = !this.editing;
+    this.dom.floor.disabled = this.editing;
+    for (const row of this.dom.revisions.querySelectorAll('button')) {
+      row.disabled = this.editing;
+    }
+    if (this.editing) this.dom.promote.disabled = true;
+  }
+
+  beginEdit() {
+    if (!this.editable() || this.editing) return;
+    this.editing = true;
+    // The editor draws its own zones, handles and pose crosses on the canvas;
+    // leaving the read-only set under them would double every outline.
+    this.map.setZones([]);
+    this.editor.begin(this.zones);
+    this.renderEditControls();
+    // Not on the note line: that line is for what the operator has to read —
+    // a refusal, or what a save did — and a banner sitting in it for the whole
+    // edit would take its room from the list and say what `save as candidate`
+    // already says. The modifier has nowhere to be discovered but the surface
+    // it applies to.
+    this.dom.canvas.title = 'edits snap to the map’s pixels; hold shift to move freely';
+  }
+
+  endEdit() {
+    this.editing = false;
+    this.dom.canvas.title = '';
+    this.editor.note('');
+    this.editor.end();
+    this.map.setZones(this.zones);
+    this.renderEditControls();
+    this.renderVerdict();
+  }
+
+  // Saving does not write the revision on screen: the server packs that
+  // revision's map bytes with the submitted zones and stores the result as an
+  // ordinary candidate. So the pane then *selects* the new candidate, and the
+  // zones on screen afterwards are the saved ones read back from the server —
+  // rather than the frozen overlay this needed when the editor lived on the
+  // operations map, where the only thing to re-render was the stale set the
+  // edit was made from (which read as data loss, 2026-08-02).
+  async saveZones() {
+    if (!this.editing || !this.selected) return;
+    const problem = this.editor.problems();
+    if (problem) {
+      this.editor.note(problem, true);
+      return;
+    }
+    const { site, floor } = parseFloorKey(this.key);
+    const from = this.selected.revision;
+    this.editor.note('saving…');
+    let body;
+    try {
+      body = await this.api(`/v1/sites/${site}/floors/${floor}/zones`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ schema: 1, revision: from, zones: this.editor.payload() }),
+      });
+    } catch (error) {
+      this.editor.note(error.message, true);
+      return;
+    }
+    this.endEdit();
+    await this.loadFloors();
+    await this.open(this.key, body.revision);
+    this.editor.note(`candidate ${body.revision} saved from ${from}`);
+  }
+
   // -- rendering --------------------------------------------------------
 
   renderFloors() {
@@ -399,6 +505,7 @@ export class ReviewView {
         el('p', { class: 'empty', text: 'no revisions on this floor' }),
       );
     }
+    this.renderEditControls();
   }
 
   renderVerdict() {
@@ -423,20 +530,17 @@ export class ReviewView {
     );
   }
 
-  // One row per zone, three cells. Read-only here on purpose — the write half
-  // (rename, alias, kind, click-to-teach a pose) is task 346, and it edits
-  // exactly these rows.
+  // The zones of the selected revision, drawn by the editor whether or not it
+  // is editing them: `edit zones` puts controls in these rows rather than
+  // replacing them with a second list of its own.
   renderZones(zones, source = '') {
-    this.dom.zoneSource.textContent = zoneSource(source, zones.length);
-    this.dom.zones.replaceChildren(
-      ...zones.map((zone) =>
-        el('div', { class: 'zone-row' }, [
-          el('span', { class: 'zone-name', text: zone.display_name || zone.name }),
-          el('span', { class: 'zone-kind', text: zone.kind || 'area' }),
-          el('span', { class: 'dim', text: zoneSummary(zone) }),
-        ]),
-      ),
-    );
+    this.zones = zones;
+    const origin = zoneSource(source, zones.length);
+    this.dom.zoneSource.hidden = !origin;
+    this.dom.zoneSource.textContent = origin ? origin.tag : '';
+    this.dom.zoneSource.title = origin ? origin.title : '';
+    this.editor.show(zones);
+    this.renderEditControls();
   }
 
   note(text, bad = false) {
@@ -469,7 +573,7 @@ export class ReviewView {
       await this.open(this.key, revision);
       this.note(
         body.announced
-          ? `${site}/${floor} is on ${body.revision}; robots will pull it`
+          ? `${site}/${floor} is on ${body.revision}`
           : `promoted, but not announced: ${body.detail}`,
         !body.announced,
       );
diff --git a/mote_fleet/server/ui/style.css b/mote_fleet/server/ui/style.css
index 78b28ed..9f39023 100644
--- a/mote_fleet/server/ui/style.css
+++ b/mote_fleet/server/ui/style.css
@@ -3,6 +3,12 @@
    roster (who), map (where), detail (what, and send it somewhere). */
 
 :root {
+  /* The browser draws the parts of a control we do not: a `select`'s dropdown
+     list, a checkbox, a scrollbar. Without this it draws them from the *system*
+     preference while the page is on its own, so a dark page grows a white
+     dropdown. Declared per theme rather than as `light dark`, because these
+     blocks are what decides the theme. */
+  color-scheme: dark;
   --bg: #0d1117;
   --panel: #161b22;
   --line: #30363d;
@@ -20,6 +26,7 @@
 
 @media (prefers-color-scheme: light) {
   :root {
+    color-scheme: light;
     --bg: #f6f8fa;
     --panel: #ffffff;
     --line: #d0d7de;
@@ -144,6 +151,7 @@ h3 {
 }
 
 input,
+select,
 button,
 .button {
   font: inherit;
@@ -208,20 +216,6 @@ main {
   padding: 0 14px 10px;
 }
 
-.revisions {
-  display: flex;
-  gap: 6px;
-  align-items: center;
-}
-
-.revisions select {
-  max-width: 220px;
-}
-
-#promote-note {
-  padding: 0 14px 8px;
-}
-
 #map-canvas {
   flex: 1;
   width: 100%;
@@ -598,15 +592,14 @@ main {
 /* -- zone editor ---------------------------------------------------------- */
 
 /* A class that sets display defeats the hidden attribute (the M3 promote-
-   picker lesson), so the guard is explicit. */
+   picker lesson), so the guard is explicit. The editing surface is otherwise
+   plain: it had a border and a padded box of its own, which meant clicking
+   `edit zones` drew a frame around a part of the page that had not moved. */
 .zone-editor {
   display: flex;
   flex-direction: column;
-  gap: 6px;
-  margin: 6px 0 0;
-  padding: 8px;
-  border: 1px solid var(--line);
-  border-radius: 6px;
+  gap: 8px;
+  min-width: 0;
 }
 .zone-editor[hidden] {
   display: none;
@@ -616,10 +609,18 @@ main {
   display: flex;
   flex-direction: column;
   gap: 4px;
-  max-height: 180px;
+  min-height: 0;
   overflow-y: auto;
 }
 
+/* The same lesson again, one element along: the read-only zone list is hidden
+   while the editable one is up, and a class that sets `display` outranks the
+   `hidden` attribute — leaving both lists on screen, each disagreeing with the
+   other about what the zones are. */
+.zone-rows[hidden] {
+  display: none;
+}
+
 .zone-row {
   display: grid;
   grid-template-columns: 1fr 1fr auto;
@@ -629,8 +630,45 @@ main {
   border-radius: 4px;
 }
 
-.zone-row.selected {
-  outline: 1px solid var(--accent);
+/* A row is picked, so it has to look pickable and then look picked — but only
+   when there is something to pick it for. Without this the only thing that
+   changed on selection was a panel to the side and an outline on the map,
+   neither of which is where the pointer is. */
+.zone-rows.editing .zone-row {
+  cursor: pointer;
+}
+
+.zone-rows.editing .zone-row:hover {
+  background: var(--bg);
+}
+
+.zone-rows.editing .zone-row.selected {
+  outline: none;
+  border-color: var(--accent);
+  background: var(--bg);
+}
+
+/* The name is the target: it fills its cell, reads as text rather than as a
+   control competing with the kind beside it, and takes the accent when its row
+   is the selected one. */
+.zone-name {
+  text-align: left;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  background: transparent;
+  border-color: transparent;
+}
+
+.zone-row.selected .zone-name {
+  color: var(--accent);
+}
+
+/* The row is the target, not the word in it: the shared `button:hover` rule
+   would draw a box around the name and make one cell look like the control. */
+.zone-name:hover {
+  border-color: transparent;
+  color: var(--accent);
 }
 
 .zone-row input {
@@ -638,11 +676,158 @@ main {
   min-width: 0;
 }
 
-.zone-actions {
+/* One row shape, edited or not: name, kind, shape, place-pose, delete. The
+   cells do not move when the controls arrive in them — a list that relaid
+   itself on `edit zones` made looking and editing two different pages.
+
+   `minmax(0, 1fr)` on the name rather than `1fr`, because a grid track's
+   automatic minimum is its content and a long name would otherwise widen the
+   row past the pane instead of ellipsing inside its cell. The `max-width` is
+   the same problem from the other end: on a 2560 px monitor the pane is wide
+   enough to strand the kind and the shape half a screen from the name, and to
+   stretch a twelve-character name into a text box the size of a paragraph. */
+.zone-rows .zone-row {
+  grid-template-columns: minmax(0, 1fr) 10ch minmax(0, 21ch) 4ch 4ch;
+  max-width: 640px;
+  border: 1px solid transparent;
+}
+
+.zone-rows .zone-row > span {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+/* The name cell, whichever it is: the button and the text line up, so entering
+   edit mode does not shift the word. */
+.zone-name,
+.zone-name-text {
+  text-align: left;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  padding: 4px 10px;
+  border: 1px solid transparent;
+}
+
+/* The selected zone's own fields. */
+.zone-detail {
   display: flex;
+  flex-direction: column;
   gap: 6px;
 }
 
+.zone-detail h4 {
+  margin: 2px 0;
+  font-size: 12px;
+  color: var(--dim);
+  text-transform: uppercase;
+  letter-spacing: 0.08em;
+}
+
+.zone-field {
+  display: grid;
+  grid-template-columns: 13ch minmax(0, 1fr);
+  gap: 8px;
+  align-items: center;
+  font-size: 12px;
+}
+
+.zone-field-name {
+  color: var(--dim);
+}
+
+.zone-rename {
+  font-weight: 600;
+}
+
+/* A name the robot's loader would refuse, said while it is typed. The save
+   refuses it too — this is so that the rule is visible before then. */
+.zone-rename.bad {
+  border-color: var(--fault);
+  color: var(--fault);
+}
+
+.zone-field input[type='checkbox'] {
+  justify-self: start;
+  width: 16px;
+  height: 16px;
+}
+
+/* Fixed, so the cells line up down the list: each row is its own grid, and an
+   `auto` track sized to "4 vertices" in one row and "waypoint" in the next
+   would step in and out. */
+/* Fixed, and held even when the cell is empty: `⌖` is offered only to a zone
+   with no pose to drag, and a column that collapsed when it was absent would
+   step the delete buttons in and out down the list. */
+.zone-editor .zone-row .place {
+  width: 4ch;
+  padding: 4px 0;
+  text-align: center;
+}
+
+.zone-rows .zone-row select,
+.zone-rows .zone-row .zone-del {
+  font: 12px ui-monospace, monospace;
+  min-width: 0;
+}
+
+/* Armed: the next click on the map is this zone's pose. The state has to be
+   visible on the button that armed it — the pointer is about to be somewhere
+   else entirely, and a click that silently moved a pose would be worse than
+   no feature. */
+.zone-row button.armed {
+  border-color: var(--accent);
+  color: var(--accent);
+}
+
+/* The last item in the list, and shaped like one: a full-width control at the
+   foot of what it adds to, dashed so it reads as a place for a zone rather
+   than a zone. */
+.zone-add {
+  flex: none;
+  border-style: dashed;
+  color: var(--dim);
+  text-align: left;
+}
+
+/* Editing holds the selected revision still, so the controls that would swap it
+   are disabled — and have to *look* disabled, or the pane reads as ignoring
+   clicks. */
+.zones-head button:disabled,
+.revision-row:disabled {
+  opacity: 0.5;
+  cursor: not-allowed;
+}
+
+/* The heading and the controls for the whole edit. They sit with the zones
+   rather than in the pane head, because they act on the list under them and not
+   on the pane — and `save as candidate`/`cancel` sit exactly where `edit zones`
+   was, so the mode begins and ends at one place. The details column carries the
+   same head, so the two columns are announced the same way and their headings
+   line up. */
+.zones-head {
+  display: flex;
+  align-items: baseline;
+  gap: 10px;
+  min-height: 28px;
+}
+
+/* What the save is doing, or the rule it is refusing on. Under the list rather
+   than above it, and no height of its own: an empty message reserving two lines
+   is a gap over the first zone that nothing explains, while here the list — the
+   one thing in the box that scrolls — gives up the room as the message arrives
+   and nothing above it moves. */
+.zones-panel > .note {
+  grid-column: 1;
+  grid-row: 3;
+  margin: 0;
+}
+
+.zones-head h3 {
+  margin-bottom: 0;
+}
+
 /* -- candidate review ----------------------------------------------------- */
 
 /* Review is a *mode*, not a fourth column. The fleet-operations panes stand
@@ -691,6 +876,48 @@ main:has(.review-pane.active) > .pane:not(.review-pane) {
   margin: 4px 0 0;
 }
 
+/* The zones half of the pane, reserved at one height so that entering and
+   leaving edit mode does not resize the map above it. The editing surface is
+   the taller of the two, so it sets the height and the read-only list sits in
+   the same box with room to spare; a floor with more zones than fit scrolls
+   inside it rather than pushing the canvas about. */
+.zones-panel {
+  flex: none;
+  height: 300px;
+  overflow: auto;
+  display: grid;
+  grid-template-columns: minmax(0, 640px) minmax(0, 26em);
+  grid-template-rows: auto 1fr auto;
+  align-content: start;
+  gap: 6px 24px;
+}
+
+.zones-head,
+.zone-rows {
+  grid-column: 1;
+}
+
+.zones-panel > .zone-rows {
+  grid-row: 2;
+  height: 100%;
+}
+
+/* A pill in the page's own idiom, and the only one that is a warning: it says
+   these coordinates were taught somewhere else. */
+.pill.warn {
+  border-color: var(--degraded);
+  color: var(--degraded);
+}
+
+/* Beside the list rather than under it, and spanning the rows above so that
+   nothing in the left column moves when it appears. */
+.zone-editor {
+  grid-column: 2;
+  grid-row: 1 / span 3;
+  border-left: 1px solid var(--line);
+  padding-left: 20px;
+}
+
 #review-canvas {
   flex: 1;
   width: 100%;
@@ -794,20 +1021,6 @@ main:has(.review-pane.active) > .pane:not(.review-pane) {
   display: none;
 }
 
-/* The editor's row grid ends in an `auto` column sized to a button; here the
-   third cell is a phrase of arbitrary length, which would push the row wider
-   than the pane. Task 346 replaces these cells with controls and inherits the
-   row shape either way. */
-#review-zones .zone-row {
-  grid-template-columns: minmax(0, 1fr) 72px minmax(0, 1fr);
-}
-
-#review-zones .zone-row > span {
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
 button.promote {
   align-self: flex-start;
 }
@@ -845,4 +1058,42 @@ button.promote:disabled {
     flex: none;
     height: 46vh;
   }
+
+  /* The pane itself scrolls on a phone, so a second scrolling box inside it is
+     a trap: the height comes off the reservation and goes back to the content,
+     and the two columns go back to one. */
+  .zones-panel {
+    height: auto;
+    overflow: visible;
+    display: flex;
+    flex-direction: column;
+  }
+
+  .zone-editor {
+    border-left: none;
+    border-top: 1px solid var(--line);
+    padding: 8px 0 0;
+  }
+
+  .zone-rows .zone-row {
+    display: flex;
+    flex-wrap: wrap;
+  }
+
+  .zone-editor .zone-row input,
+  .zone-editor .zone-row select {
+    flex: 1 1 45%;
+  }
+
+  /* Nor anything to reserve: with the pane scrolling, a message that arrives
+     can have the height it needs. */
+  .zones-panel > .note {
+    min-height: 0;
+  }
+
+  /* No reserved box here, so no height to fill: the list is as long as it is
+     and the pane scrolls, which is what a phone does with everything else. */
+  .zones-panel > .zone-rows {
+    height: auto;
+  }
 }
diff --git a/mote_fleet/server/ui/zone_editor.mjs b/mote_fleet/server/ui/zone_editor.mjs
index 251e42b..296c291 100644
--- a/mote_fleet/server/ui/zone_editor.mjs
+++ b/mote_fleet/server/ui/zone_editor.mjs
@@ -1,16 +1,25 @@
-// Zone editing on the fleet map: drag a vertex, drag a zone, drag a pose,
-// rename, add, delete — then save the lot as a *candidate* revision.
+// Zone editing on a map revision: drag a vertex, drag a zone, place a pose,
+// rename, name the kind, add aliases, add, delete — then save the lot as a
+// *candidate* revision.
 //
-// The editor never writes to the floor it is looking at. Saving POSTs the
-// edited set to the server, which derives a new candidate from the canonical
-// revision (same map bytes, new zones); the operator then promotes it through
-// the picker exactly like a robot-published map. Promoted revisions stay
-// immutable, which the announced digests rely on.
+// The editor never writes to the revision it is looking at. Saving POSTs the
+// edited set to the server, which derives a new candidate from that revision
+// (same map bytes, new zones); the operator then promotes it exactly like a
+// robot-published map. Stored revisions stay immutable, which the announced
+// digests rely on, and promotion stays the only write that changes a floor.
 //
-// Geometry lives in pure functions over zone objects in *world* metres, so
-// every edit operation is testable under node with no canvas and no DOM.
+// It lives in the review pane (`review.mjs`) because a zone is a coordinate in
+// one map frame: the map under the zones has to be the map they belong to, and
+// only that pane draws a *candidate's* own map. Editing a candidate is the
+// point — a fresh build arrives with `zone_01`..`zone_07` from `segment-map`,
+// and an editor that could only edit the published map would have required
+// promoting those placeholder names in order to be allowed to fix them.
+//
+// Geometry and the vocabulary rules live in pure functions over zone objects in
+// *world* metres, so every edit operation is testable under node with no canvas
+// and no DOM.
 
-import { pixelToWorld, worldToPixel } from './map.mjs';
+import { pixelToWorld, worldToPixel, zoneLabel } from './map.mjs';
 
 // Ray-cast membership over [[x, y], ...]. Concave polygons are fine, which
 // matters because the hallway is one.
@@ -57,6 +66,43 @@ export function nearestEdge(zone, x, y) {
   return best;
 }
 
+// What the pointer is over, in the order a drag claims it: a vertex first (it
+// is the smallest target and sits on top of its own zone), then a pose cross,
+// then the zone's interior. `null` means the map — which is why the same
+// function draws the hover: an operator who cannot tell a vertex drag from a
+// zone drag from a map pan is guessing, and this is the one answer all three
+// read.
+export function hitTest(zones, x, y, reach) {
+  for (const zone of zones) {
+    const vertex = zone.polygon ? nearestVertex(zone, x, y) : null;
+    if (vertex && vertex.distance <= reach) {
+      return { kind: 'vertex', zone: zone.name, index: vertex.index };
+    }
+  }
+  for (const zone of zones) {
+    if (typeof zone.x !== 'number') continue;
+    // A pose is a cross rather than a corner to aim at, so it is given a
+    // little more reach than a vertex.
+    if (Math.hypot(zone.x - x, zone.y - y) <= reach * 1.2) {
+      return { kind: 'pose', zone: zone.name };
+    }
+  }
+  for (const zone of zones) {
+    if (zone.polygon && pointInPolygon(zone.polygon, x, y)) {
+      return { kind: 'zone', zone: zone.name };
+    }
+  }
+  return null;
+}
+
+// The cursor for a target — the half of the answer that arrives before the
+// pointer has touched anything.
+export function cursorFor(target, placing = false) {
+  if (placing) return 'crosshair';
+  if (!target) return ''; // the stylesheet's `grab`: this drag pans the map
+  return target.kind === 'vertex' ? 'crosshair' : 'move';
+}
+
 export function withVertex(zone, index, x, y) {
   const polygon = zone.polygon.map((point, i) =>
     i === index ? [round(x), round(y)] : point,
@@ -114,18 +160,237 @@ export function freshZone(existing, cx, cy, half = 1.0) {
   };
 }
 
+// A default outline, one metre either side of the pose, for a zone that has
+// just been called a room and has no extent yet. It is a starting shape to drag
+// onto the walls, not a guess at the room.
+function squareAround(zone, map, half = 1.0) {
+  // On the grid, like every other coordinate this editor writes. The *pose* is
+  // left where it is — it was measured by driving a robot there, and moving it
+  // two centimetres to tidy a number would be inventing data — but the outline
+  // is this editor's own, so it starts where the next drag would put it.
+  const corner = (x, y) => {
+    const point = snapToPixel(map, x, y);
+    return [point.x, point.y];
+  };
+  return [
+    corner(zone.x - half, zone.y - half),
+    corner(zone.x + half, zone.y - half),
+    corner(zone.x + half, zone.y + half),
+    corner(zone.x - half, zone.y + half),
+  ];
+}
+
+// A pose for a zone that has only an outline. The robot's loader derives one
+// the same way when it loads a polygon-only zone; here it is needed when an
+// outline is about to be dropped, so that the zone is left with a position at
+// all. Concave outlines whose centroid falls outside them get `null`, and the
+// caller refuses the change rather than inventing a pose in a wall.
+export function poseFor(zone) {
+  if (typeof zone.x === 'number' && typeof zone.y === 'number') {
+    return { x: zone.x, y: zone.y };
+  }
+  if (!zone.polygon || !zone.polygon.length) return null;
+  const sum = zone.polygon.reduce((acc, [x, y]) => [acc[0] + x, acc[1] + y], [0, 0]);
+  const centre = { x: round(sum[0] / zone.polygon.length), y: round(sum[1] / zone.polygon.length) };
+  return pointInPolygon(zone.polygon, centre.x, centre.y) ? centre : null;
+}
+
+// **The kind decides whether a zone is a point or an area, and the geometry
+// follows it.** A `charger` is a pose to dock at; a `room` is a place with
+// walls, and "am I in it" is the question it exists to answer. Editing them as
+// two independent things — a kind here, an outline toggled over there — is what
+// leaves a `dropoff` carrying a seven-vertex outline nothing reads, and a room
+// with no extent that `zones.containing` can never match.
+//
+// So: naming a bare pose an area gives it a starting outline to drag onto the
+// walls, and naming an outlined zone a point drops the outline and keeps the
+// pose. Returns `null` if that second move would leave the zone with no
+// position at all, which is a zone the robot's loader refuses.
+export function withKind(zone, kind, map = null) {
+  const next = { ...zone, kind };
+  if (isAreaKind(kind)) {
+    if (!next.polygon && typeof next.radius !== 'number' && typeof next.x === 'number') {
+      next.polygon = squareAround(next, map);
+    }
+    return next;
+  }
+  if (!next.polygon && typeof next.radius !== 'number') return next;
+  const pose = poseFor(next);
+  if (!pose) return null;
+  delete next.polygon;
+  delete next.radius;
+  return { ...next, x: pose.x, y: pose.y };
+}
+
+// The map's own pixel grid, in world metres. A vertex dropped anywhere inside a
+// pixel covers exactly the same cells as one at its centre, so the free-hand
+// coordinate is precision the map does not have — and two zones meant to share
+// a wall end up a few millimetres apart, differently each time. Snapping to
+// centres (half a pixel off the origin, which is a pixel *edge*) makes "the
+// same place" the same number.
+export function snapToPixel(map, x, y) {
+  if (!map || !map.resolution) return { x: round(x), y: round(y) };
+  const axis = (value, origin) =>
+    round(origin + (Math.floor((value - origin) / map.resolution) + 0.5) * map.resolution);
+  return { x: axis(x, map.origin[0]), y: axis(y, map.origin[1]) };
+}
+
+// A whole number of pixels, for dragging a zone bodily: snapping each vertex
+// would pull the shape about, and snapping the *movement* keeps it rigid — a
+// room traced onto its walls stays traced when it is nudged.
+export function snapDelta(map, delta) {
+  if (!map || !map.resolution) return delta;
+  return round(Math.round(delta / map.resolution) * map.resolution);
+}
+
+// One zone's geometry in a phrase: the binding half, which is the half that is
+// only true against the map beside it. Shown in the list whether or not the
+// list is being edited — the shape is a fact about the zone, not a control.
+export function zoneSummary(zone) {
+  if (zone.polygon && zone.polygon.length >= 3) {
+    return `polygon, ${zone.polygon.length} vertices`;
+  }
+  if (typeof zone.radius === 'number') return `circle, r ${zone.radius} m`;
+  if (zone.x !== undefined && zone.y !== undefined) {
+    return `waypoint ${zone.x.toFixed(2)}, ${zone.y.toFixed(2)}`;
+  }
+  return 'no footprint';
+}
+
 // A machine name a dispatcher can type — the same rule the robot's loader and
 // the bundle validator enforce, applied here so a bad rename fails in the
 // input rather than at save.
 export const NAME_RE = /^[a-z][a-z0-9_]*$/;
 
+// The machine name a display name implies: "The Kitchen" -> `the_kitchen`,
+// "Café" -> `cafe`. Two fields for one place is a chore, and the operator is
+// naming a room, not authoring an identifier — so the identifier follows.
+//
+// It is a *proposal*, not a rule: the result is put in the name field where it
+// can be seen and changed, and it is only ever offered while the name is still
+// one nobody chose (see `isGeneratedName`). Renaming a zone an operator has
+// already named would break the `goto` that names it, which is the opposite of
+// a convenience. A spelling that cannot become a name at all (`3rd floor`)
+// yields '' and nothing is proposed.
+export function slugify(text) {
+  const slug = String(text || '')
+    .normalize('NFD')
+    .replace(/[\u0300-\u036f]/g, '') // é -> e, rather than dropping the letter
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '');
+  return NAME_RE.test(slug) ? slug : '';
+}
+
+// A name nobody has chosen: what `segment-map` mints for a room it found and
+// what `add zone` mints for a new one. These are the names the editor exists to
+// replace, so they are the ones it may replace on its own.
+export function isGeneratedName(name) {
+  return /^zone_\d+$/.test(String(name || ''));
+}
+
+// zone/v0's kinds, in the spec's order. Mirrored from `bundle.ZONE_KINDS`
+// rather than fetched, because this is a `<select>`'s options and a dropdown
+// that cannot be drawn until a request comes back is a worse thing than a list
+// held in step by a test (`ui_test.mjs` reads bundle.py and compares).
+export const ZONE_KINDS = [
+  'area',
+  'room',
+  'corridor',
+  'doorway',
+  'threshold',
+  'elevator',
+  'stair',
+  'dock',
+  'charger',
+  'pickup',
+  'dropoff',
+  'staging',
+  'home',
+  'keepout',
+  'slow',
+];
+
+// Kinds that say where a robot may not go, and so are not destinations.
+export const CONSTRAINT_KINDS = new Set(['keepout', 'slow']);
+
+// Kinds that name a *pose* rather than a region — a charger is where the robot
+// docks, not somewhere it may be anywhere inside of. Mirrors
+// `bundle.POINT_KINDS`, which carries the reasoning.
+export const POINT_KINDS = new Set(['dock', 'charger', 'pickup', 'dropoff', 'home']);
+
+export const isAreaKind = (kind) => !POINT_KINDS.has(kind || 'area');
+
+// Whether a zone of this kind may be dispatched to, absent an explicit say-so.
+export const navigableByDefault = (kind) => !CONSTRAINT_KINDS.has(kind || 'area');
+
+// A comma-separated field, which is how an operator writes a short list
+// without a list widget — aliases and tags are both this. Blank entries are
+// dropped and a spelling repeated in one field is kept once: a duplicate inside
+// a single zone is a typo, not the collision `ambiguities` is about.
+export function parseList(text) {
+  const seen = new Set();
+  const aliases = [];
+  for (const raw of String(text || '').split(',')) {
+    const alias = raw.trim();
+    if (!alias) continue;
+    const key = normaliseAlias(alias);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    aliases.push(alias);
+  }
+  return aliases;
+}
+
+export function formatList(items) {
+  return (items || []).join(', ');
+}
+
+// The comparison zone/v0's resolver uses, and therefore the only one collision
+// detection may use: case-insensitive and whitespace-normalised, matching
+// `bundle.normalise_alias`.
+export function normaliseAlias(text) {
+  return String(text).split(/\s+/).filter(Boolean).join(' ').toLowerCase();
+}
+
+// Two zones answering one query, which the robot's loader *refuses* to load —
+// so an editor that can produce one produces a map no robot will take. Mirrors
+// `bundle.ambiguities`: names and aliases, never display names.
+export function ambiguities(zones) {
+  const claimed = new Map();
+  const problems = [];
+  for (const zone of zones) {
+    for (const spelling of [zone.name, ...(zone.aliases || [])]) {
+      const key = normaliseAlias(spelling);
+      if (!key) continue;
+      const owner = claimed.get(key);
+      if (owner !== undefined && owner !== zone.name) {
+        problems.push(`"${owner}" and "${zone.name}" both answer to "${key}"`);
+      } else {
+        claimed.set(key, zone.name);
+      }
+    }
+  }
+  return problems;
+}
+
 // The wire shape: keyed by name, no echoed `name` field, no empty extras.
+//
+// `navigable` is dropped when it is what the kind already implies, which is
+// what makes the kind editable at all: every zone arrives from the server with
+// the field filled in (`bundle.zone_term` defaults it), so writing it back
+// verbatim would carry a `keepout`'s `navigable: false` onto a zone just
+// changed to `room` and quietly leave a room nothing can be dispatched to. A
+// value that genuinely deviates from its kind is kept, because that one was
+// meant.
 export function zonesPayload(zones) {
   const payload = {};
   for (const zone of zones) {
     const entry = {};
     for (const [key, value] of Object.entries(zone)) {
       if (key === 'name' || value === null || value === undefined || value === '') continue;
+      if (Array.isArray(value) && value.length === 0) continue;
+      if (key === 'navigable' && value === navigableByDefault(zone.kind)) continue;
       entry[key] = value;
     }
     payload[zone.name] = entry;
@@ -135,51 +400,95 @@ export function zonesPayload(zones) {
 
 const round = (value) => Math.round(value * 1000) / 1000;
 
+function el(tag, attributes = {}, children = []) {
+  const node = document.createElement(tag);
+  for (const [key, value] of Object.entries(attributes)) {
+    if (key === 'class') node.className = value;
+    else if (key === 'text') node.textContent = value;
+    else node.setAttribute(key, value);
+  }
+  for (const child of [].concat(children)) if (child) node.append(child);
+  return node;
+}
+
+// One labelled control. The label is a real `<label>` so that clicking it
+// reaches the input, which on a phone is most of the target.
+function field(name, control) {
+  const row = document.createElement('label');
+  row.className = 'zone-field';
+  row.append(el('span', { class: 'zone-field-name', text: name }), control);
+  return row;
+}
+
 const HANDLE = 'rgba(240, 130, 34, 1)';
 const EDIT_STROKE = 'rgba(240, 130, 34, 0.9)';
 const EDIT_FILL = 'rgba(240, 130, 34, 0.08)';
 const SELECTED_FILL = 'rgba(240, 130, 34, 0.18)';
+// Hover is deliberately louder than selection: selection says which row you are
+// looking at, hover says what the next press will move — and only one of those
+// is about to change the map.
+const HOVER_FILL = 'rgba(240, 130, 34, 0.3)';
+// Ink, not white. A canvas gets no cascade, so the theme cannot supply this —
+// and the surface under it is not the theme's background but the *basemap*,
+// whose free space is white in both themes. A white ring was invisible on
+// exactly the floor an operator is editing over (measured: it moved 1.5% of the
+// pixels around the handle; this moves 12%).
+const HOVER_RING = 'rgba(13, 17, 23, 0.9)';
 
 export class ZoneEditor {
   constructor(mapView, dom, { onSave, onExit } = {}) {
     this.mapView = mapView;
-    this.dom = dom; // { panel, rows, add, save, cancel, note }
+    this.dom = dom; // { panel, rows, detail, note }
     this.onSave = onSave || (() => {});
     this.onExit = onExit || (() => {});
     this.active = false;
     this.zones = [];
     this.selected = null;
     this._drag = null;
+    // What a press here and now would grab. Kept because it is drawn, not
+    // because it is needed to grab: `_down` re-runs the same hit test.
+    this._hover = null;
     this._bind();
   }
 
+  // The list, not being edited: the same rows the editor draws, with text where
+  // its controls are. One renderer, because two of them are two layouts that
+  // drift apart — and because the difference between looking and editing should
+  // be the controls, not the page.
+  show(zones) {
+    if (this.active) return;
+    this.zones = zones || [];
+    this.selected = null;
+    this._render();
+  }
+
   begin(zones) {
     this.zones = (zones || []).map((zone) => JSON.parse(JSON.stringify(zone)));
-    this.selected = null;
+    // Something is always selected, so the panel always has a zone in it: an
+    // empty panel is a state that has to be explained, and the explanation
+    // ("select a zone to…") can only ever name one of the things it is for.
+    this.selected = this.zones.length ? this.zones[0].name : null;
     this.active = true;
+    this._drag = null;
+    this._placing = null;
+    this._hover = null;
     this.dom.panel.hidden = false;
     this.dom.note.textContent = '';
     this.mapView.overlay = (ctx) => this._draw(ctx);
-    this._renderRows();
+    this._render();
     this.mapView.draw();
   }
 
   end() {
     this.active = false;
-    this.dom.panel.hidden = true;
-    this.mapView.overlay = null;
-    this.mapView.draw();
-  }
-
-  // Saving succeeded: stop editing but keep the saved zones on screen. The
-  // canonical zones the map would otherwise re-render are the *old* ones —
-  // the edits live in an unpreviewable candidate until it is promoted, and a
-  // save that makes your work vanish reads as data loss (it did, 2026-08-02).
-  finish() {
-    this.active = false;
-    this.dom.panel.hidden = true;
     this._drag = null;
+    this._placing = null;
+    this._hover = null;
     this.selected = null;
+    this._cursor('');
+    this.dom.panel.hidden = true;
+    this.mapView.overlay = null;
+    this._render();
     this.mapView.draw();
   }
 
@@ -194,6 +503,9 @@ export class ZoneEditor {
     const up = (event) => this._up(event);
     canvas.addEventListener('pointerup', up, true);
     canvas.addEventListener('pointercancel', up, true);
+    // Not in the capture phase and not stopped: leaving the canvas is the
+    // map's business too, and all this does is drop a highlight.
+    canvas.addEventListener('pointerleave', () => this._hoverAt(null));
     canvas.addEventListener('dblclick', (event) => this._dblclick(event), true);
   }
 
@@ -207,6 +519,16 @@ export class ZoneEditor {
     return pixelToWorld(this.mapView.map, px, py);
   }
 
+  // Where a press *writes*, as against where it landed: on the pixel grid,
+  // unless Shift is held. Shift rather than Alt because a desktop's window
+  // manager takes Alt-drag for moving windows, and a modifier the page never
+  // receives is a modifier that does not exist.
+  _point(event) {
+    const world = this._world(event);
+    if (event.shiftKey) return world;
+    return snapToPixel(this.mapView.map, world.x, world.y);
+  }
+
   // Hit reach in metres at the current zoom: 10 screen px, whatever the scale.
   _reach() {
     const view = this.mapView.view;
@@ -215,33 +537,69 @@ export class ZoneEditor {
 
   _down(event) {
     if (!this.active || !this.mapView.map) return;
+    // The hit test asks where the pointer *is*; every write below asks where it
+    // should land, which is `_point`.
     const point = this._world(event);
     const reach = this._reach();
 
-    for (const zone of this.zones) {
-      const vertex = zone.polygon ? nearestVertex(zone, point.x, point.y) : null;
-      if (vertex && vertex.distance <= reach) {
-        this._grab(event, { kind: 'vertex', zone: zone.name, index: vertex.index });
-        return;
-      }
+    // Placing a pose: the next click *is* the pose, wherever it lands, so it
+    // takes precedence over every hit test below. This is the one way to give
+    // a pose to a zone that has none — a `segment-map` room is a polygon with
+    // no `x`/`y`, so it draws no cross to drag and the robot derives a
+    // centroid to drive to, which lands wherever the outline's middle is
+    // rather than where you would send a robot in that room.
+    if (this._placing) {
+      const name = this._placing;
+      this._placing = null;
+      event.stopPropagation();
+      event.preventDefault();
+      const placed = this._point(event);
+      this._update(name, (zone) => withPose(zone, placed.x, placed.y));
+      this.selected = name;
+      this.note('');
+      this._cursor(cursorFor(this._hover, false));
+      this._render();
+      this.mapView.draw();
+      return;
     }
-    for (const zone of this.zones) {
-      if (typeof zone.x !== 'number') continue;
-      if (Math.hypot(zone.x - point.x, zone.y - point.y) <= reach * 1.2) {
-        this._grab(event, { kind: 'pose', zone: zone.name });
-        return;
-      }
-    }
-    for (const zone of this.zones) {
-      if (zone.polygon && pointInPolygon(zone.polygon, point.x, point.y)) {
-        this._grab(event, { kind: 'zone', zone: zone.name, last: point });
-        return;
-      }
+
+    const target = hitTest(this.zones, point.x, point.y, reach);
+    if (target) {
+      this._grab(
+        event,
+        target.kind === 'zone'
+          ? { ...target, from: point, before: this.zones.find((z) => z.name === target.zone) }
+          : target,
+      );
+      return;
     }
     this.selected = null;
-    this._renderRows();
+    this._render();
     this.mapView.draw();
-    // Nothing hit: let the map pan.
+    // Nothing hit: let the map pan. Which is what the cursor has been saying
+    // since the pointer arrived here — a press that pans when the operator
+    // meant to drag a zone is the surprise the hover exists to prevent.
+  }
+
+  // The hover, and the cursor that goes with it. Only a *change* redraws: this
+  // runs on every pointer move over the canvas, and the map underneath is a
+  // full repaint.
+  _hoverAt(target) {
+    const before = this._hover;
+    const same =
+      (!before && !target) ||
+      (before &&
+        target &&
+        before.kind === target.kind &&
+        before.zone === target.zone &&
+        before.index === target.index);
+    this._hover = target;
+    this._cursor(cursorFor(target, Boolean(this._placing)));
+    if (!same) this.mapView.draw();
+  }
+
+  _cursor(value) {
+    this.mapView.canvas.style.cursor = value;
   }
 
   _grab(event, drag) {
@@ -250,22 +608,39 @@ export class ZoneEditor {
     this.mapView.canvas.setPointerCapture(event.pointerId);
     this._drag = drag;
     this.selected = drag.zone;
-    this._renderRows();
+    this._render();
     this.mapView.draw();
   }
 
   _move(event) {
-    if (!this.active || !this._drag) return;
+    if (!this.active || !this.mapView.map) return;
+    if (!this._drag) {
+      const point = this._world(event);
+      this._hoverAt(hitTest(this.zones, point.x, point.y, this._reach()));
+      return;
+    }
     event.stopPropagation();
-    const point = this._world(event);
     const drag = this._drag;
-    this._update(drag.zone, (zone) => {
-      if (drag.kind === 'vertex') return withVertex(zone, drag.index, point.x, point.y);
-      if (drag.kind === 'pose') return withPose(zone, point.x, point.y);
-      const moved = translated(zone, point.x - drag.last.x, point.y - drag.last.y);
-      drag.last = point;
-      return moved;
-    });
+    if (drag.kind === 'vertex' || drag.kind === 'pose') {
+      const point = this._point(event);
+      this._update(drag.zone, (zone) =>
+        drag.kind === 'vertex'
+          ? withVertex(zone, drag.index, point.x, point.y)
+          : withPose(zone, point.x, point.y),
+      );
+    } else {
+      // Measured from the grab, against the zone as it was then: rounding each
+      // step's delta instead would leave the zone drifting behind the pointer
+      // by whatever the rounding threw away.
+      const point = this._world(event);
+      let dx = point.x - drag.from.x;
+      let dy = point.y - drag.from.y;
+      if (!event.shiftKey) {
+        dx = snapDelta(this.mapView.map, dx);
+        dy = snapDelta(this.mapView.map, dy);
+      }
+      this._update(drag.zone, () => translated(drag.before, dx, dy));
+    }
     this.mapView.draw();
   }
 
@@ -278,6 +653,7 @@ export class ZoneEditor {
   _dblclick(event) {
     if (!this.active || !this.mapView.map) return;
     const point = this._world(event);
+    const placed = this._point(event);
     const reach = this._reach();
     for (const zone of this.zones) {
       if (!zone.polygon) continue;
@@ -294,7 +670,7 @@ export class ZoneEditor {
       const edge = nearestEdge(zone, point.x, point.y);
       if (edge && edge.distance <= reach) {
         event.stopPropagation();
-        this._update(zone.name, (z) => withInsertedVertex(z, edge.index, point.x, point.y));
+        this._update(zone.name, (z) => withInsertedVertex(z, edge.index, placed.x, placed.y));
         this.mapView.draw();
         return;
       }
@@ -310,11 +686,12 @@ export class ZoneEditor {
   addZone() {
     const view = this.mapView.view;
     const rect = this.mapView.canvas.getBoundingClientRect();
-    const centre = pixelToWorld(this.mapView.map, (rect.width / 2 - view.tx) / view.scale, (rect.height / 2 - view.ty) / view.scale);
+    const middle = pixelToWorld(this.mapView.map, (rect.width / 2 - view.tx) / view.scale, (rect.height / 2 - view.ty) / view.scale);
+    const centre = snapToPixel(this.mapView.map, middle.x, middle.y);
     const zone = freshZone(this.zones, centre.x, centre.y);
     this.zones = [...this.zones, zone];
     this.selected = zone.name;
-    this._renderRows();
+    this._render();
     this.mapView.draw();
   }
 
@@ -322,9 +699,29 @@ export class ZoneEditor {
     return zonesPayload(this.zones);
   }
 
-  // Every rename is checked against the same name rule the robot enforces,
-  // and against the other zones: two zones answering one name is exactly what
-  // the loader refuses, so the editor must not produce it.
+  // Arm the next map click as this zone's pose. Nothing is changed until that
+  // click, so arming and thinking better of it costs nothing.
+  placePose(name) {
+    this._placing = this._placing === name ? null : name;
+    this.selected = name;
+    this.note(this._placing ? `click the map to place ${name}’s pose` : '');
+    this._cursor(cursorFor(this._hover, Boolean(this._placing)));
+    this._render();
+    this.mapView.draw();
+  }
+
+  note(text, bad = false) {
+    this.dom.note.textContent = text;
+    // One line, so the list under it never moves — the whole message is on the
+    // hover for the rare one that outruns the width.
+    this.dom.note.title = text;
+    this.dom.note.className = `note ${bad ? 'error' : ''}`;
+  }
+
+  // Every rename is checked against the same rules the robot's loader enforces
+  // — the name shape, and two zones answering one query — because the loader
+  // *refuses* an ambiguous vocabulary rather than resolving it by dict order.
+  // A set this editor is willing to save is a set a robot will load.
   problems() {
     const seen = new Set();
     for (const zone of this.zones) {
@@ -332,51 +729,262 @@ export class ZoneEditor {
       if (seen.has(zone.name)) return `two zones named "${zone.name}"`;
       seen.add(zone.name);
     }
-    if (!this.zones.length) return 'no zones — delete the floor’s zones by editing on the robot instead';
+    const ambiguous = ambiguities(this.zones);
+    if (ambiguous.length) return ambiguous[0];
+    if (!this.zones.length) return 'no zones to save';
     return null;
   }
 
+  _render() {
+    this._renderRows();
+    this._renderDetail();
+  }
+
   _renderRows() {
     const rows = this.dom.rows;
     rows.replaceChildren();
+    rows.classList.toggle('editing', this.active);
+    if (!this.active) {
+      for (const zone of this.zones) {
+        rows.append(
+          el('div', { class: 'zone-row' }, [
+            el('span', { class: 'zone-name-text', text: zoneLabel(zone) }),
+            el('span', { class: 'zone-kind', text: zone.kind || 'area' }),
+            el('span', { class: 'dim zone-shape', text: zoneSummary(zone) }),
+            el('span', { class: 'place' }),
+            el('span', { class: 'zone-del' }),
+          ]),
+        );
+      }
+      return;
+    }
     for (const zone of this.zones) {
       const row = document.createElement('div');
-      row.className = 'zone-row' + (zone.name === this.selected ? ' selected' : '');
-      const name = document.createElement('input');
-      name.value = zone.name;
-      name.title = 'machine name (goto <name>)';
-      name.addEventListener('change', () => {
-        this._update(zone.name, (z) => ({ ...z, name: name.value.trim() }));
-        this.selected = name.value.trim();
-        this._renderRows();
+      const chosen = zone.name === this.selected;
+      row.className = 'zone-row' + (chosen ? ' selected' : '');
+      // The name is what you *pick* the zone by, so it is a button and looks
+      // like one being pressed. It was a text input, which put a caret where a
+      // click was meant to select — the row is a list, and renaming is a
+      // deliberate act that belongs with the zone's other fields.
+      const name = document.createElement('button');
+      name.type = 'button';
+      name.className = 'zone-name';
+      name.textContent = zone.name;
+      name.setAttribute('aria-pressed', String(chosen));
+      name.title = `select ${zone.name}`;
+      // The row carries what you scan *across* zones — which place, what sort of
+      // place, what shape — and nothing else. Every other field belongs to one
+      // zone at a time and edits in the panel below, which is what lets zone/v0
+      // grow a field without costing every row a column (and the operator a
+      // text box they will not fill).
+      const kind = document.createElement('select');
+      for (const option of ZONE_KINDS) {
+        const node = document.createElement('option');
+        node.value = option;
+        node.textContent = option;
+        kind.append(node);
+      }
+      kind.value = zone.kind || 'area';
+      kind.title = 'zone/v0 kind: a point (charger, dock, pickup, dropoff, home) or an area';
+      kind.addEventListener('change', () => {
+        const reshaped = withKind(zone, kind.value, this.mapView.map);
+        if (!reshaped) {
+          kind.value = zone.kind || 'area';
+          this.note(`${zone.name} has no pose inside its outline; place one with ⌖`, true);
+          return;
+        }
+        const lost = Boolean((zone.polygon || zone.radius) && !reshaped.polygon && !reshaped.radius);
+        this._update(zone.name, () => reshaped);
+        this.selected = zone.name;
+        this.note(lost ? `${zone.name} is a ${kind.value}: outline dropped` : '');
+        this._render();
         this.mapView.draw();
       });
-      const display = document.createElement('input');
-      display.value = zone.display_name || '';
-      display.placeholder = 'display name';
-      display.addEventListener('change', () => {
-        this._update(zone.name, (z) => ({ ...z, display_name: display.value.trim() }));
-      });
+      const placed = typeof zone.x === 'number';
+      // Only for a zone with no pose to drag. Everything else on the map is
+      // moved by dragging it, and a button that duplicates a drag is a second
+      // way to do one thing; this is the case dragging cannot reach, because
+      // a `segment-map` room is an outline with no `x`/`y` and so draws no
+      // cross to take hold of. Once placed, the cross is the control.
+      const pose = document.createElement(placed ? 'span' : 'button');
+      pose.className = 'place';
+      if (!placed) {
+        pose.type = 'button';
+        pose.textContent = '⌖';
+        if (this._placing === zone.name) pose.classList.add('armed');
+        pose.title = 'no pose: click here, then click the map';
+        pose.addEventListener('click', (event) => {
+          event.stopPropagation();
+          this.placePose(zone.name);
+        });
+      }
+      const shape = el('span', { class: 'dim zone-shape', text: zoneSummary(zone) });
       const del = document.createElement('button');
       del.type = 'button';
+      del.className = 'zone-del';
       del.textContent = '×';
       del.title = 'delete zone';
-      del.addEventListener('click', () => {
+      del.addEventListener('click', (event) => {
+        event.stopPropagation();
+        const index = this.zones.findIndex((z) => z.name === zone.name);
         this.zones = this.zones.filter((z) => z.name !== zone.name);
-        if (this.selected === zone.name) this.selected = null;
-        this._renderRows();
+        if (this.selected === zone.name) {
+          // The neighbour, so the panel stays occupied and the operator stays
+          // where they were in the list.
+          const next = this.zones[Math.min(index, this.zones.length - 1)];
+          this.selected = next ? next.name : null;
+        }
+        if (this._placing === zone.name) this._placing = null;
+        this._render();
         this.mapView.draw();
       });
       row.addEventListener('click', () => {
         if (this.selected !== zone.name) {
           this.selected = zone.name;
-          this._renderRows();
+          this._render();
           this.mapView.draw();
         }
       });
-      row.append(name, display, del);
+      row.append(name, kind, shape, pose, del);
       rows.append(row);
     }
+    // Adding a zone acts on the list, so it is the end of the list — not a
+    // third button beside the two that begin and end the whole edit, which is
+    // where it sat and read as one of them. Inside the scroll box, so a floor
+    // with twenty zones and one with two put the same geometry on screen.
+    const add = document.createElement('button');
+    add.type = 'button';
+    add.className = 'zone-add';
+    add.textContent = '+ add zone';
+    add.title = 'add a zone at the middle of the view';
+    add.addEventListener('click', () => this.addZone());
+    rows.append(add);
+  }
+
+  // -- the selected zone --------------------------------------------------
+
+  // Everything a zone carries that is not its identity or its shape: one zone
+  // at a time, as a form. zone/v0 already has seven vocabulary fields and will
+  // have more; a column each would make the list unreadable long before the
+  // spec ran out, and would put a paragraph-wide text box on every row for a
+  // field most zones leave empty.
+  _renderDetail() {
+    const panel = this.dom.detail;
+    if (!panel) return;
+    const zone = this.zones.find((entry) => entry.name === this.selected);
+    panel.replaceChildren();
+    if (!zone) {
+      panel.append(el('p', { class: 'dim', text: 'no zones on this revision yet' }));
+      return;
+    }
+    // Renaming is here rather than in the row for the same reason the row
+    // stopped being a form: in the list, the name is what you select by. A
+    // rename is a deliberate act on the zone you have selected, and this is
+    // where that zone's fields are.
+    const rename = document.createElement('input');
+    rename.className = 'zone-rename';
+    rename.value = zone.name;
+    rename.title = 'what goto takes: lowercase letters, digits and _';
+    // Said while it is being typed, not at save. The rule is real — the robot's
+    // loader refuses a name it cannot be told to drive to — but a field that
+    // looks like free text until a save fails is a field that does not look
+    // like it has a rule at all.
+    rename.addEventListener('input', () => {
+      rename.classList.toggle('bad', !NAME_RE.test(rename.value.trim()));
+    });
+    rename.addEventListener('change', () => {
+      const renamed = rename.value.trim();
+      this._update(zone.name, (z) => ({ ...z, name: renamed }));
+      this.selected = renamed;
+      this._render();
+      this.mapView.draw();
+    });
+
+    const text = (key, placeholder, title) => {
+      const input = document.createElement('input');
+      input.value = zone[key] || '';
+      input.placeholder = placeholder;
+      input.title = title;
+      input.addEventListener('change', () => {
+        const value = input.value.trim();
+        this._update(zone.name, (z) => ({ ...z, [key]: value }));
+        // Naming a room is one act, so the identifier follows the label while
+        // the identifier is still one nobody chose. `zone_03` becoming
+        // `the_kitchen` when the operator types "The Kitchen" is the whole
+        // point of the pane; a name they have already set is theirs.
+        if (key === 'display_name' && isGeneratedName(this.selected)) {
+          const derived = slugify(value);
+          if (derived && !this.zones.some((other) => other.name === derived)) {
+            this._update(this.selected, (z) => ({ ...z, name: derived }));
+            this.selected = derived;
+            this._render();
+          }
+        }
+        this.mapView.draw();
+      });
+      return input;
+    };
+
+    const list = (key, placeholder, title) => {
+      const input = document.createElement('input');
+      input.value = formatList(zone[key]);
+      input.placeholder = placeholder;
+      input.title = title;
+      input.addEventListener('change', () => {
+        const parsed = parseList(input.value);
+        input.value = formatList(parsed);
+        this._update(zone.name, (z) => ({ ...z, [key]: parsed }));
+        this.mapView.draw();
+      });
+      return input;
+    };
+
+    // The box shows what the robot will do, which for a zone that has never
+    // said is what its kind implies. Ticking it back to that is not a decision
+    // that needs storing — `zonesPayload` drops it — so a `keepout` changed to
+    // `room` becomes navigable rather than staying silently undispatchable.
+    const navigable = document.createElement('input');
+    navigable.type = 'checkbox';
+    navigable.checked =
+      typeof zone.navigable === 'boolean'
+        ? zone.navigable
+        : navigableByDefault(zone.kind);
+    navigable.title = 'whether a robot may be dispatched here';
+    navigable.addEventListener('change', () => {
+      this._update(zone.name, (z) => ({ ...z, navigable: navigable.checked }));
+      this._render();
+    });
+
+    // A picker rather than a text box: a parent must name a zone on this floor,
+    // and typing one is the only way to name one that is not.
+    const parent = document.createElement('select');
+    parent.title = 'the zone this one is inside';
+    parent.append(el('option', { value: '', text: '—' }));
+    for (const other of this.zones) {
+      if (other.name === zone.name) continue;
+      parent.append(el('option', { value: other.name, text: other.name }));
+    }
+    parent.value = zone.parent || '';
+    parent.addEventListener('change', () => {
+      this._update(zone.name, (z) => ({ ...z, parent: parent.value }));
+    });
+
+    // No example placeholders. A grey "The Kitchen" in the display-name box of a
+    // zone called `pickup` reads as a value that is already there, and the
+    // label beside it already says what the field is; the only hint worth
+    // giving is the one about punctuation.
+    panel.append(
+      field('name', rename),
+      field('display name', text('display_name', '', 'what an operator reads')),
+      field(
+        'also called',
+        list('aliases', 'comma separated', 'other spellings goto should accept'),
+      ),
+      field('navigable', navigable),
+      field('inside', parent),
+      field('tags', list('tags', 'comma separated', 'free labels for whatever needs them')),
+      field('description', text('description', '', 'a note for whoever reads this next')),
+    );
   }
 
   // -- drawing ------------------------------------------------------------
@@ -388,12 +996,15 @@ export class ZoneEditor {
       const pixel = worldToPixel(this.mapView.map, x, y);
       return { x: pixel.x * view.scale + view.tx, y: pixel.y * view.scale + view.ty };
     };
+    const hover = this._hover;
     for (const zone of this.zones) {
       const selected = zone.name === this.selected;
+      const over = hover && hover.zone === zone.name ? hover.kind : '';
       ctx.save();
       ctx.strokeStyle = EDIT_STROKE;
-      ctx.fillStyle = selected ? SELECTED_FILL : EDIT_FILL;
-      ctx.lineWidth = selected ? 2.5 : 1.5;
+      ctx.fillStyle =
+        over === 'zone' ? HOVER_FILL : selected ? SELECTED_FILL : EDIT_FILL;
+      ctx.lineWidth = selected || over === 'zone' ? 2.5 : 1.5;
       if (zone.polygon) {
         ctx.beginPath();
         zone.polygon.forEach(([x, y], index) => {
@@ -404,26 +1015,45 @@ export class ZoneEditor {
         ctx.closePath();
         ctx.fill();
         ctx.stroke();
-        for (const [x, y] of zone.polygon) {
+        zone.polygon.forEach(([x, y], index) => {
           const point = toScreen(x, y);
+          const grabbed = over === 'vertex' && hover.index === index;
+          const half = grabbed ? 6 : 4;
           ctx.fillStyle = HANDLE;
-          ctx.fillRect(point.x - 4, point.y - 4, 8, 8);
-        }
+          ctx.fillRect(point.x - half, point.y - half, half * 2, half * 2);
+          if (grabbed) {
+            // A ring rather than only a bigger square: on a dark basemap the
+            // square alone grows into the wall it is sitting on.
+            ctx.strokeStyle = HOVER_RING;
+            ctx.lineWidth = 2;
+            ctx.strokeRect(point.x - half, point.y - half, half * 2, half * 2);
+            ctx.strokeStyle = EDIT_STROKE;
+          }
+        });
       }
       if (typeof zone.x === 'number') {
         const point = toScreen(zone.x, zone.y);
+        const grabbed = over === 'pose';
         ctx.strokeStyle = HANDLE;
-        ctx.lineWidth = 2;
+        ctx.lineWidth = grabbed ? 3 : 2;
         ctx.beginPath();
         ctx.moveTo(point.x - 7, point.y);
         ctx.lineTo(point.x + 7, point.y);
         ctx.moveTo(point.x, point.y - 7);
         ctx.lineTo(point.x, point.y + 7);
         ctx.stroke();
+        if (grabbed) {
+          ctx.strokeStyle = HOVER_RING;
+          ctx.lineWidth = 2;
+          ctx.beginPath();
+          ctx.arc(point.x, point.y, 9, 0, Math.PI * 2);
+          ctx.stroke();
+          ctx.strokeStyle = HANDLE;
+        }
         ctx.font = '11px ui-monospace, monospace';
         ctx.textAlign = 'center';
         ctx.fillStyle = HANDLE;
-        ctx.fillText(zone.name, point.x, point.y - 10);
+        ctx.fillText(zoneLabel(zone), point.x, point.y - 10);
       }
       ctx.restore();
     }
diff --git a/mote_fleet/test/browser_check.mjs b/mote_fleet/test/browser_check.mjs
index 84b3f54..c408231 100644
--- a/mote_fleet/test/browser_check.mjs
+++ b/mote_fleet/test/browser_check.mjs
@@ -299,7 +299,7 @@ try {
 
   const zoneRows = await settle(
     session,
-    `document.querySelectorAll('#review-zones .zone-row').length`,
+    `document.querySelectorAll('#zone-rows .zone-row').length`,
     (rows) => rows > 0,
   );
   check('the candidate’s zones are listed beside it', zoneRows > 0, `${zoneRows} rows`);
@@ -320,6 +320,247 @@ try {
   writeFileSync(reviewShot, Buffer.from(reviewPng.data, 'base64'));
   console.log(`screenshot: ${reviewShot}`);
 
+  // -- editing the candidate's zones --------------------------------------
+  //
+  // The other half of the review decision: a build's rooms arrive as `zone_01`
+  // ..`zone_07`, and naming them is done here, against the candidate's own map,
+  // by an operator who can see which room is which. Saving derives a *new*
+  // candidate from the one on screen — so the map the coordinates were drawn on
+  // is the map they are stored against, and nothing published moves.
+
+  if (token) {
+    // The map must not move when the editor opens: the editing surface is
+    // taller than the list it replaces, and with the canvas taking whatever
+    // height was left, clicking `edit zones` resized the thing being edited.
+    const shapeOf = `(() => {
+      const rows = [...document.querySelectorAll('#zone-rows .zone-row')];
+      return JSON.stringify({
+        map: Math.round(document.getElementById('review-canvas').getBoundingClientRect().height),
+        rows: rows.map(row => Math.round(row.getBoundingClientRect().height)),
+        top: rows.length ? Math.round(rows[0].getBoundingClientRect().top) : 0,
+        cells: rows.length ? rows[0].children.length : 0,
+      });
+    })()`;
+    const shapeBefore = await session.evaluate(shapeOf);
+    const mapBefore = JSON.parse(shapeBefore).map;
+    const editing = await session.evaluate(`(() => {
+      document.getElementById('zones-edit').click();
+      const rows = document.getElementById('zone-rows');
+      const shown = (id) => !document.getElementById(id).hidden;
+      return {
+        rows: document.querySelectorAll('#zone-rows .zone-row').length,
+        // One list in both modes: the rows that were text now hold controls.
+        controls: document.querySelectorAll('#zone-rows select').length,
+        listLocked: [...document.querySelectorAll('#review-revisions button')]
+          .every(button => button.disabled),
+        promoteLocked: document.getElementById('review-promote').disabled,
+        // The edit ends where it began, and adding a zone is the end of the
+        // list rather than a third button beside the two that end the edit.
+        ends: !shown('zones-edit') && shown('zone-save') && shown('zone-cancel'),
+        adds: rows.lastElementChild && rows.lastElementChild.className === 'zone-add',
+      };
+    })()`);
+    check(
+      'editing opens on the selected revision’s zones and holds it still',
+      editing.rows > 0 &&
+        editing.controls === editing.rows &&
+        editing.listLocked &&
+        editing.promoteLocked,
+      JSON.stringify(editing),
+    );
+    check(
+      'the edit ends where it began, and `add zone` is part of the list',
+      editing.ends && editing.adds,
+      JSON.stringify({ ends: editing.ends, adds: editing.adds }),
+    );
+
+    // One list, one shape: the rows are the same rows, in the same place, the
+    // same height, with the same cells — `edit zones` puts controls in them and
+    // changes nothing else. Every part of that has been wrong at least once: a
+    // second list with its own columns, a box drawn round the editing one, and
+    // a selection border that grew every row by two pixels.
+    const shapeDuring = await session.evaluate(shapeOf);
+    check(
+      'the list and the map are the same shape, edited or not',
+      shapeBefore === shapeDuring && JSON.parse(shapeBefore).map > 0,
+      `${shapeBefore} then ${shapeDuring}`,
+    );
+
+    // A row carries identity and shape; everything else is a form for the one
+    // selected zone, which is what lets zone/v0 grow a field without giving
+    // every row another column.
+    const selected = await session.evaluate(`(() => {
+      document.querySelectorAll('#zone-rows .zone-name')[0].click();
+      const row = document.querySelectorAll('#zone-rows .zone-row')[0];
+      return {
+        cells: row.children.length,
+        marked: row.classList.contains('selected'),
+        inputsInRow: row.querySelectorAll('input').length,
+        fields: [...document.querySelectorAll('#zone-detail .zone-field-name')]
+          .map(node => node.textContent).join(','),
+      };
+    })()`);
+    check(
+      'picking a zone by name marks the row and opens its fields',
+      selected.cells === 5 &&
+        selected.marked &&
+        selected.inputsInRow === 0 &&
+        selected.fields.startsWith('name,'),
+      JSON.stringify(selected),
+    );
+
+    // A vocabulary the robot's loader would *refuse* — two zones answering one
+    // query — must not leave the browser: it would be stored as a candidate
+    // that looks fine and cannot be loaded. The alias is set through the panel
+    // the row selects, which is where every field but identity and shape lives.
+    const refused = await session.evaluate(`(() => {
+      const rows = [...document.querySelectorAll('#zone-rows .zone-row')];
+      const first = rows[0].querySelector('.zone-name').textContent;
+      rows[1].querySelector('.zone-name').click();
+      const field = [...document.querySelectorAll('#zone-detail .zone-field')]
+        .find(row => row.textContent.startsWith('also called'));
+      const aliases = field.querySelector('input');
+      aliases.value = first.toUpperCase();
+      aliases.dispatchEvent(new Event('change'));
+      const note = document.getElementById('zone-note');
+      const top = () => Math.round(document.querySelector('#zone-rows .zone-row').getBoundingClientRect().top);
+      const before = { top: top(), note: Math.round(note.getBoundingClientRect().height) };
+      document.getElementById('zone-save').click();
+      return {
+        note: note.textContent,
+        field: !!field,
+        before,
+        // The message takes its room from the list, which is the one thing in
+        // the box that scrolls — so nothing above it moves, and an empty one
+        // leaves no gap over the first zone.
+        after: { top: top(), note: Math.round(note.getBoundingClientRect().height) },
+        whole: note.scrollHeight <= note.clientHeight,
+      };
+    })()`);
+    check(
+      'an ambiguous vocabulary is refused in the browser, not stored',
+      /both answer to/.test(refused.note),
+      refused.note,
+    );
+    check(
+      'the refusal is readable in full and moves nothing above it',
+      refused.before.note === 0 &&
+        refused.after.note > 0 &&
+        refused.before.top === refused.after.top &&
+        refused.whole,
+      JSON.stringify({ ...refused.before, ...refused.after, whole: refused.whole }),
+    );
+
+    await session.evaluate(`(() => {
+      const detailField = (label) =>
+        [...document.querySelectorAll('#zone-detail .zone-field')]
+          .find(row => row.textContent.startsWith(label))
+          .querySelector('input, select');
+      const set = (label, value) => {
+        const control = detailField(label);
+        control.value = value;
+        control.dispatchEvent(new Event('change'));
+      };
+      set('also called', '');                       // undo the clash above
+      const rows = [...document.querySelectorAll('#zone-rows .zone-row')];
+      rows[0].querySelector('.zone-name').click();  // the row is a list, so pick
+      const name = document.querySelector('.zone-rename');
+      const renamed = name.value + '_named';
+      name.value = renamed;                         // and rename in the panel
+      name.dispatchEvent(new Event('change'));
+      const fresh = [...document.querySelectorAll('#zone-rows .zone-row')][0];
+      fresh.querySelector('select').value = 'room';
+      fresh.querySelector('select').dispatchEvent(new Event('change'));
+      set('display name', 'A Named Room');
+      document.getElementById('zone-save').click();
+      return renamed;
+    })()`);
+    const derived = await settle(
+      session,
+      `(() => ({
+        // The line under the zones, which is where the work was: what the save
+        // did outlives the save, rather than a flash of 'saving...' here with
+        // the result reported in the far column.
+        note: document.getElementById('zone-note').textContent,
+        label: document.getElementById('review-map-label').textContent,
+        // Hidden means the zones belong to the revision they are drawn on,
+        // which is the ordinary case and says nothing.
+        inherited: !document.getElementById('review-zone-source').hidden,
+        zones: [...document.querySelectorAll('#zone-rows .zone-row')]
+          .map(row => row.textContent).join(' '),
+        editorHidden: document.getElementById('zone-editor').hidden,
+        // And the head is back to the one control that starts an edit.
+        editVisible: !document.getElementById('zones-edit').hidden,
+      }))()`,
+      (state) => /saved from \d{8}T\d{6}/.test(state.note),
+    );
+    check(
+      'saving derives a candidate from the revision under review',
+      /saved from \d{8}T\d{6}/.test(derived.note),
+      derived.note,
+    );
+    // The edited set is on screen afterwards because it was *read back* from the
+    // new candidate — not held over as an overlay of what was typed. And the
+    // zone renamed above went in as a bare waypoint and comes back as a
+    // polygon, because calling it a `room` is what gave it an outline: the kind
+    // and the geometry are one decision, made once.
+    check(
+      'the pane then shows the saved candidate’s own zones',
+      derived.editorHidden &&
+        derived.editVisible &&
+        derived.zones.includes('A Named Room') &&
+        !derived.inherited,
+      JSON.stringify(derived),
+    );
+    check(
+      'calling a bare pose a room gave it an outline, all the way to the server',
+      /A Named Roomroom\s*polygon/.test(derived.zones),
+      derived.zones,
+    );
+
+    // And that outline is on the map's own pixel grid. A vertex anywhere inside
+    // a pixel covers the same cells as one at its centre, so free-hand
+    // coordinates are precision the map cannot back — and two zones meant to
+    // share a wall land millimetres apart, differently each time.
+    const onGrid = await session.evaluate(`(async () => {
+      const label = document.getElementById('review-map-label').textContent;
+      const [floor, revision] = label.split(' · ');
+      const base = '/v1/sites/' + floor.replace('/', '/floors/') + '/revisions/' + revision;
+      const [map, zones] = await Promise.all([
+        fetch(base + '/map.json').then(r => r.json()),
+        fetch(base + '/zones.json').then(r => r.json()),
+      ]);
+      const centred = (value, origin) => {
+        const cells = (value - origin) / map.resolution - 0.5;
+        return Math.abs(cells - Math.round(cells)) < 1e-6;
+      };
+      const drawn = zones.zones.filter(zone => zone.polygon);
+      const off = drawn.flatMap(zone => (zone.polygon || [])
+        .filter(([x, y]) => !(centred(x, map.origin[0]) && centred(y, map.origin[1])))
+        .map(point => zone.name + ' ' + point.join(',')));
+      return { outlines: drawn.length, off };
+    })()`);
+    check(
+      'the outline it drew sits on the map’s pixel grid',
+      onGrid.outlines > 0 && onGrid.off.length === 0,
+      JSON.stringify(onGrid),
+    );
+    check(
+      'the edited revision is still a candidate: nothing published moved',
+      !new RegExp(`${derived.label.split(' · ')[1]}`).test(
+        await session.evaluate(`document.getElementById('review-canonical').textContent`),
+      ),
+      `canonical: ${await session.evaluate(
+        `document.getElementById('review-canonical').textContent`,
+      )}`,
+    );
+
+    const editShot = shot.replace(/(\.png)?$/, '-zones.png');
+    const editPng = await session.send('Page.captureScreenshot', { format: 'png' });
+    writeFileSync(editShot, Buffer.from(editPng.data, 'base64'));
+    console.log(`screenshot: ${editShot}`);
+  }
+
   // -- the first promotion on a floor -------------------------------------
   //
   // A floor whose only revisions are candidates. Its detail used to be fetched
diff --git a/mote_fleet/test/test_zone_edit.py b/mote_fleet/test/test_zone_edit.py
index cabb4d3..0b8d636 100644
--- a/mote_fleet/test/test_zone_edit.py
+++ b/mote_fleet/test/test_zone_edit.py
@@ -3,13 +3,27 @@
 The dashboard's zone editor saves by POSTing the edited set to
 ``/v1/sites/<site>/floors/<floor>/zones``. What must hold: the result is an
 ordinary *candidate* (validated like any upload, listed by the floor route,
-promotable through the existing route), the canonical revision's bytes are
+promotable through the existing route), the source revision's bytes are
 untouched (the announced digest depends on that), and a set the robot's own
 loader would refuse — a bad name, a colliding alias — is refused here with the
 reasons rather than stored.
+
+The body's ``revision`` is what makes an *unpromoted* map editable, which is the
+case the pipeline is built around: a fresh build arrives carrying `zone_01`..
+`zone_07` from `segment-map`, and an edit that could only derive from the
+canonical revision would have meant promoting those placeholder names in order
+to be allowed to fix them.
 """
 
-from api_harness import expect_error, get, post
+import yaml
+from api_harness import (
+    expect_error,
+    get,
+    packed_revision,
+    post,
+    post_bytes,
+    write_revision,
+)
 
 from mote_bringup import bundle
 from mote_fleet import protocol
@@ -24,19 +38,37 @@
         "yaw": 0.0,
         "kind": "room",
         "display_name": "Kitchen",
+        "aliases": ["galley"],
         "polygon": [[0.0, -4.0], [2.0, -4.0], [2.0, -2.0], [0.0, -2.0]],
     },
     "office": {"x": 0.5, "y": 0.5, "yaw": 0.0, "kind": "room"},
 }
 
 
-def edit(server, zones, token, floor=FLOOR):
-    return post(
+def edit(server, zones, token, floor=FLOOR, revision=None):
+    body = {"schema": protocol.SCHEMA, "zones": zones}
+    if revision is not None:
+        body["revision"] = revision
+    return post(server, f"/v1/sites/{SITE}/floors/{floor}/zones", body, token=token)
+
+
+def upload_candidate(server, tmp_path, revision="20260801T090000", **kwargs):
+    """A candidate on the fixture's floor, as a robot publishes one. Needs the
+    ``robot`` fixture, since an upload names an enrolled robot."""
+    blob = packed_revision(tmp_path, name=revision, **kwargs)
+    status, body = post_bytes(
         server,
-        f"/v1/sites/{SITE}/floors/{floor}/zones",
-        {"schema": protocol.SCHEMA, "zones": zones},
-        token=token,
+        f"/v1/sites/{SITE}/floors/{FLOOR}/revisions/{revision}?robot_id=mote-01",
+        blob,
+        content_type="application/gzip",
     )
+    assert status == 201, body
+    return body["revision"]
+
+
+def stored_zones(server, revision):
+    path = server.maps / SITE / "floors" / FLOOR / "maps" / revision / "zones.yaml"
+    return bundle.read_zones(path), yaml.safe_load(path.read_text())
 
 
 def test_edit_derives_a_candidate_and_leaves_the_canonical_alone(server):
@@ -55,16 +87,13 @@ def test_edit_derives_a_candidate_and_leaves_the_canonical_alone(server):
     assert server.store.pack(SITE, FLOOR, CANONICAL) == before
 
     # The candidate carries the submitted zones, keyed by name, no echo.
-    zones_file = server.maps / SITE / "floors" / FLOOR / "maps" / stored / "zones.yaml"
-    parsed = bundle.read_zones(zones_file)
+    parsed, raw = stored_zones(server, stored)
     assert set(parsed["zones"]) == {"kitchen", "office"}
     kitchen = parsed["zones"]["kitchen"]
     assert [list(point) for point in kitchen["polygon"]] == ZONES["kitchen"]["polygon"]
+    assert kitchen["aliases"] == ["galley"]
     # The file keys by name and carries no redundant copy inside the entry
     # (read_zones adds one when parsing; the raw file must not).
-    import yaml
-
-    raw = yaml.safe_load(zones_file.read_text())
     assert "name" not in raw["zones"]["office"]
 
     # And the floor route lists it as a promotable candidate.
@@ -74,6 +103,116 @@ def test_edit_derives_a_candidate_and_leaves_the_canonical_alone(server):
     assert stored in listed and listed[stored]["ok"]
 
 
+def test_a_candidates_zones_can_be_edited_without_promoting_it(server, tmp_path, robot):
+    """The case the pipeline is built around: rename the rooms of a map that is
+    not published, and keep it unpublished. The derived candidate must carry the
+    *edited* candidate's map bytes, not the canonical one's — the operator drew
+    those coordinates on the candidate's map, and the two frames differ."""
+    token = server.registry.new_operator(name="editor")
+    candidate = upload_candidate(server, tmp_path, width=64, height=48)
+    before = server.store.pack(SITE, FLOOR, candidate)
+
+    status, body = edit(server, ZONES, token, revision=candidate)
+    assert status == 201, body
+    stored = body["revision"]
+    assert body["derived_from"] == candidate
+
+    # Nothing was promoted, and neither source was touched.
+    _, floor = get(server, f"/v1/sites/{SITE}/floors/{FLOOR}")
+    assert floor["canonical"] == CANONICAL
+    assert server.store.pack(SITE, FLOOR, candidate) == before
+
+    # The map under the edited zones is the candidate's, which its size proves:
+    # the fixture's canonical revision is 40x30 and this one is 64x48.
+    status, meta = get(
+        server, f"/v1/sites/{SITE}/floors/{FLOOR}/revisions/{stored}/map.json"
+    )
+    assert (meta["width"], meta["height"]) == (64, 48)
+
+
+def test_editing_a_candidate_on_a_floor_with_nothing_published(server, tmp_path, robot):
+    """A floor whose only revision is a candidate is exactly the floor whose
+    zones most need renaming, and it has no canonical revision to derive from."""
+    token = server.registry.new_operator(name="editor")
+    blob = packed_revision(tmp_path, name="attic-rev")
+    status, body = post_bytes(
+        server,
+        f"/v1/sites/{SITE}/floors/attic/revisions/20260801T101010?robot_id=mote-01",
+        blob,
+        content_type="application/gzip",
+    )
+    assert status == 201, body
+    candidate = body["revision"]
+
+    status, body = edit(server, ZONES, token, floor="attic", revision=candidate)
+    assert status == 201, body
+    assert body["derived_from"] == candidate
+    _, floor = get(server, f"/v1/sites/{SITE}/floors/attic")
+    assert floor["canonical"] is None  # still nothing published
+
+
+def test_the_vocabulary_revision_advances_from_the_edited_revision(
+    server, tmp_path, robot
+):
+    """A carry-forward has to be able to tell which naming is newer, so the
+    counter continues from the revision that was edited rather than restarting.
+    The fixture's zones.yaml is at 4."""
+    token = server.registry.new_operator(name="editor")
+    _, body = edit(server, ZONES, token)
+    first = body["revision"]
+    assert stored_zones(server, first)[1]["vocabulary_revision"] == 5
+
+    # Editing the result again continues from *it*, not from the canonical.
+    _, body = edit(server, ZONES, token, revision=first)
+    assert stored_zones(server, body["revision"])[1]["vocabulary_revision"] == 6
+
+
+def test_a_revision_with_no_posegraph_can_still_have_its_zones_edited(
+    server, tmp_path, robot
+):
+    """A derivation is held to the bar its source already cleared, not to the
+    upload's. A revision with no posegraph is one nothing can extend, which is a
+    *warning* the review pane shows beside a `promotable` verdict — so an edit of
+    one must succeed, or that pane offers a button that can only fail. (It did,
+    in a browser: every sim site bundle is such a revision, and so is any floor
+    seeded by rsync from before the registry existed — which is why this one is
+    written straight onto disk, an upload being refused for the same reason.)"""
+    token = server.registry.new_operator(name="editor")
+    seeded = "20260801T090000"
+    write_revision(
+        server.maps / SITE / "floors" / FLOOR / "maps" / seeded, posegraph=False
+    )
+
+    status, body = edit(server, ZONES, token, revision=seeded)
+    assert status == 201, body
+    assert any("posegraph" in warning for warning in body["warnings"])
+
+    # And the bar for a robot's *upload* is unchanged: a mapping session that
+    # produced no posegraph produced a map that cannot be extended, and that is
+    # still refused where the session can still be re-run.
+    expect_error(
+        lambda: post_bytes(
+            server,
+            f"/v1/sites/{SITE}/floors/{FLOOR}/revisions/20260803T090000?robot_id=mote-01",
+            packed_revision(tmp_path, name="no-graph", posegraph=False),
+            content_type="application/gzip",
+        ),
+        422,
+    )
+
+
+def test_an_unknown_source_revision_is_a_404(server):
+    token = server.registry.new_operator(name="editor")
+    expect_error(lambda: edit(server, ZONES, token, revision="20990101T000000"), 404)
+
+
+def test_a_source_revision_that_is_not_a_name_is_refused(server):
+    # The revision reaches the filesystem as a path component, so the traversal
+    # story is the same one `_names` tells for site and floor.
+    token = server.registry.new_operator(name="editor")
+    expect_error(lambda: edit(server, ZONES, token, revision="../../etc"), 400)
+
+
 def test_edited_candidate_promotes_through_the_existing_route(server):
     token = server.registry.new_operator(name="editor")
     _, body = edit(server, ZONES, token)
diff --git a/mote_fleet/test/ui_test.mjs b/mote_fleet/test/ui_test.mjs
index 42b5b51..f4d00e7 100644
--- a/mote_fleet/test/ui_test.mjs
+++ b/mote_fleet/test/ui_test.mjs
@@ -33,6 +33,7 @@ import {
   pinchUpdate,
   pixelToWorld,
   worldToPixel,
+  zoneLabel,
   zoneOutline,
 } from '../server/ui/map.mjs';
 import { NARROW_MAX_PX } from '../server/ui/layout.mjs';
@@ -195,6 +196,31 @@ test('a radius zone becomes a circle in pixels, not in metres', () => {
   assert.deepEqual(outline.centre, worldToPixel(map, 1, 1));
 });
 
+test('a zone is drawn under the name a person reads', () => {
+  // `display_name` is the half meant for reading and the machine name is the
+  // half meant for typing, so a zone given one is labelled with it — on the
+  // fleet map and under the editor's own handles alike, or a zone would answer
+  // to one name in the list and another the moment it was being edited.
+  assert.equal(zoneLabel({ name: 'zone_01', display_name: 'Kitchen' }), 'Kitchen');
+  assert.equal(zoneLabel({ name: 'zone_01', display_name: '' }), 'zone_01');
+  assert.equal(zoneLabel({ name: 'zone_01' }), 'zone_01');
+  assert.equal(zoneLabel(null), '');
+});
+
+test('the browser is told which theme to draw its own controls in', () => {
+  // A `select`'s dropdown, a checkbox and a scrollbar are the browser's to
+  // paint. Left to the *system* preference while the page follows its own, a
+  // dark page grows a white dropdown list — which is what a select in the zone
+  // editor looked like.
+  const css = read('style.css');
+  const dark = css.slice(css.indexOf(':root {'));
+  assert.match(dark.slice(0, dark.indexOf('}')), /color-scheme:\s*dark/);
+  const light = css.slice(css.indexOf('@media (prefers-color-scheme: light)'));
+  assert.match(light.slice(0, light.indexOf('}')), /color-scheme:\s*light/);
+  // And the element itself, which the shared control rule used to miss.
+  assert.match(css, /input,\s*select,\s*button,\s*\.button \{/);
+});
+
 test('a bare waypoint has no outline to draw', () => {
   const map = { resolution: 0.05, origin: [0, 0, 0], width: 100, height: 100 };
   assert.equal(zoneOutline(map, { name: 'pickup', x: 1, y: 1 }), null);
@@ -281,9 +307,37 @@ test('both map canvases take their own touch gestures', () => {
 // editor's geometry is tested here with no canvas: the browser only adds
 // pointer events on top of exactly these.
 
-const { pointInPolygon, nearestVertex, nearestEdge, withVertex, withInsertedVertex, withoutVertex, translated, withPose, freshZone, zonesPayload, NAME_RE } = await import(
-  '../server/ui/zone_editor.mjs'
-);
+const {
+  CONSTRAINT_KINDS,
+  NAME_RE,
+  POINT_KINDS,
+  ZONE_KINDS,
+  ambiguities,
+  cursorFor,
+  formatList,
+  freshZone,
+  hitTest,
+  isAreaKind,
+  isGeneratedName,
+  poseFor,
+  nearestEdge,
+  nearestVertex,
+  navigableByDefault,
+  normaliseAlias,
+  parseList,
+  pointInPolygon,
+  slugify,
+  zoneSummary,
+  snapDelta,
+  snapToPixel,
+  translated,
+  withInsertedVertex,
+  withKind,
+  withPose,
+  withVertex,
+  withoutVertex,
+  zonesPayload,
+} = await import('../server/ui/zone_editor.mjs');
 
 const square = {
   name: 'kitchen',
@@ -327,6 +381,81 @@ test('vertex edits replace, insert after the edge start, and refuse a triangle c
   assert.equal(withoutVertex(triangle, 0), null);
 });
 
+test('the hit test claims a vertex, then a pose, then the zone under it', () => {
+  // One function, because the hover highlight, the cursor and the drag all read
+  // it: an operator who cannot tell which of the three a press will take — or
+  // that it will pan the map instead — is guessing, and three copies of this
+  // ordering would eventually disagree about the answer.
+  const zones = [square, { name: 'home', x: 5, y: 5 }];
+  assert.deepEqual(hitTest(zones, 0.05, 0.05, 0.2), {
+    kind: 'vertex',
+    zone: 'kitchen',
+    index: 0,
+  });
+  // The pose sits inside its own footprint; the pose wins.
+  assert.deepEqual(hitTest(zones, 1, 1, 0.2), { kind: 'pose', zone: 'kitchen' });
+  assert.deepEqual(hitTest(zones, 1.6, 0.4, 0.2), { kind: 'zone', zone: 'kitchen' });
+  // A waypoint zone is reachable with no footprint at all, and beyond it is the
+  // map: `null` is what makes a drag pan rather than edit.
+  assert.deepEqual(hitTest(zones, 5.1, 5, 0.2), { kind: 'pose', zone: 'home' });
+  assert.equal(hitTest(zones, 40, 40, 0.2), null);
+});
+
+test('the cursor says which of those it is before anything is pressed', () => {
+  assert.equal(cursorFor(null), ''); // the stylesheet's grab: this pans
+  assert.equal(cursorFor({ kind: 'vertex' }), 'crosshair');
+  assert.equal(cursorFor({ kind: 'zone' }), 'move');
+  assert.equal(cursorFor({ kind: 'pose' }), 'move');
+  // Arming a pose overrides everything: the next click lands wherever it is.
+  assert.equal(cursorFor(null, true), 'crosshair');
+  assert.equal(cursorFor({ kind: 'zone' }, true), 'crosshair');
+});
+
+test('edits land on pixel centres, and never move more than half a pixel', () => {
+  // The map is the limit of the precision available: a vertex anywhere inside a
+  // pixel covers the same cells as one at its centre, so free-hand coordinates
+  // are digits the map cannot back — and two zones meant to share a wall land a
+  // few millimetres apart, differently every time.
+  const grid = { resolution: 0.05, origin: [-10.935, -5.958, 0], width: 500, height: 300 };
+  const centred = (value, origin) => {
+    const cells = (value - origin) / grid.resolution - 0.5;
+    return Math.abs(cells - Math.round(cells)) < 1e-9;
+  };
+  for (const [x, y] of [
+    [0, 0],
+    [-10.9, -5.9],
+    [3.14159, -2.71828],
+    [-10.935, -5.958], // the origin itself, which is a pixel *edge*
+  ]) {
+    const snapped = snapToPixel(grid, x, y);
+    assert.ok(centred(snapped.x, grid.origin[0]), `${snapped.x} is not a pixel centre`);
+    assert.ok(centred(snapped.y, grid.origin[1]), `${snapped.y} is not a pixel centre`);
+    assert.ok(Math.abs(snapped.x - x) <= grid.resolution / 2 + 1e-9);
+    assert.ok(Math.abs(snapped.y - y) <= grid.resolution / 2 + 1e-9);
+    // Idempotent, or a zone would creep every time it was touched.
+    assert.deepEqual(snapToPixel(grid, snapped.x, snapped.y), snapped);
+  }
+
+  // A body drag moves by whole pixels instead, so the shape it moves keeps its
+  // shape: snapping every vertex would pull a traced room off its walls.
+  assert.equal(snapDelta(grid, 0.03), 0.05);
+  assert.equal(snapDelta(grid, 0.02), 0);
+  assert.equal(snapDelta(grid, -0.12), -0.1);
+  const room = { ...square, polygon: [[0.013, 0.017], [2.013, 0.017], [2.013, 2.017]] };
+  const nudged = translated(room, snapDelta(grid, 0.31), snapDelta(grid, -0.07));
+  assert.deepEqual(
+    nudged.polygon.map(([x, y], i) => [
+      Math.round((x - room.polygon[i][0]) * 1000),
+      Math.round((y - room.polygon[i][1]) * 1000),
+    ]),
+    [
+      [300, -50],
+      [300, -50],
+      [300, -50],
+    ],
+  );
+});
+
 test('moving a zone carries footprint and pose together', () => {
   const moved = translated(square, 1, -1);
   assert.deepEqual(moved.polygon[0], [1, -1]);
@@ -355,12 +484,237 @@ test('the zone editor panel hides when hidden, whatever its class sets', () => {
   // class sets `display`, so the stylesheet must say so explicitly.
   const css = read('style.css');
   assert.match(css, /\.zone-editor\[hidden\]\s*\{\s*display:\s*none/);
+  // And the read-only list it stands in for, which is a flex container: with
+  // both on screen there would be two disagreeing accounts of the zones.
+  assert.match(css, /\.zone-rows\[hidden\]\s*\{\s*display:\s*none/);
   const html = read('index.html');
-  for (const id of ['zone-editor', 'zone-rows', 'zone-add', 'zone-save', 'zone-cancel', 'zones-edit']) {
+  for (const id of ['zone-editor', 'zone-rows', 'zone-save', 'zone-cancel', 'zones-edit']) {
     assert.ok(html.includes(`id="${id}"`), `index.html is missing #${id}`);
   }
 });
 
+test('an action sits at the level of the thing it acts on', () => {
+  // Three buttons in one row said they were three of a kind. Two of them begin
+  // and end the whole edit, and belong where `edit zones` was; the third adds
+  // one item, and belongs at the end of the items.
+  const html = read('index.html');
+  const head = html.slice(html.indexOf('<div class="zones-head">'), html.indexOf('id="zone-rows"'));
+  for (const id of ['zones-edit', 'zone-save', 'zone-cancel']) {
+    assert.ok(head.includes(`id="${id}"`), `#${id} belongs with the zones heading`);
+  }
+  assert.ok(!html.includes('id="zone-add"'), 'adding a zone is rendered into the list');
+  // And what the save says is under the save, not in the column of fields for
+  // one zone — where it sat while reporting on all of them.
+  const panel = html.slice(html.indexOf('<div class="zones-panel">'), html.indexOf('id="zone-editor"'));
+  assert.ok(panel.includes('id="zone-note"'), 'the save\'s note belongs with the save');
+  const editor = read('zone_editor.mjs');
+  const rows = editor.slice(editor.indexOf('_renderRows() {'), editor.indexOf('_renderDetail() {'));
+  assert.match(rows, /className = 'zone-add'/);
+  assert.match(rows, /rows\.append\(add\)/);
+});
+
+test('a name the loader would refuse is marked while it is typed', () => {
+  // The rule is real and the save enforces it; this is so that a field with a
+  // rule does not look like free text until the save fails.
+  const css = read('style.css');
+  assert.match(css, /\.zone-rename\.bad \{[^}]*border-color:\s*var\(--fault\)/);
+  const editor = read('zone_editor.mjs');
+  assert.match(editor, /addEventListener\('input'[^)]*\)[^]*?classList\.toggle\('bad'/);
+});
+
+test('a zone row reads as something you pick, and as picked', () => {
+  // Selection drives the panel and the map highlight, so a row that gave no
+  // sign of being selectable left the operator clicking a text box instead —
+  // and only while it is editable, since a row that cannot be picked must not
+  // invite it.
+  const css = read('style.css');
+  const rows = css.slice(css.indexOf('.zone-rows.editing .zone-row {'));
+  assert.match(rows.slice(0, rows.indexOf('}')), /cursor:\s*pointer/);
+  assert.match(
+    css,
+    /\.zone-rows\.editing \.zone-row\.selected \{[^}]*border-color:\s*var\(--accent\)/,
+  );
+  // One list, one row shape: the cells must not move when the controls arrive.
+  assert.match(css, /\.zone-rows \.zone-row \{[^}]*grid-template-columns/);
+  assert.ok(!css.includes('#review-zones'), 'the second zone list is gone');
+});
+
+test('the editor lives in the review pane, over the revision it edits', () => {
+  // Editing anywhere else edits zones against a map they may not belong to: the
+  // operations canvas draws the *published* basemap, so an editor on it could
+  // only ever derive from the published revision — which is what made renaming
+  // a candidate's rooms require promoting the placeholder names first.
+  const html = read('index.html');
+  const review = html.slice(
+    html.indexOf('class="pane review-pane"'),
+    html.indexOf('class="pane detail-pane"'),
+  );
+  for (const id of ['zones-edit', 'zone-editor', 'zone-rows', 'zone-save']) {
+    assert.ok(review.includes(`id="${id}"`), `#${id} must be in the review pane`);
+  }
+  const map = html.slice(
+    html.indexOf('class="pane map-pane"'),
+    html.indexOf('class="pane review-pane"'),
+  );
+  assert.ok(!map.includes('zone-editor'), 'the operations map must not edit zones');
+});
+
+// -- the vocabulary half --------------------------------------------------
+//
+// Names, not coordinates: the part of a zone that is true for every robot at
+// the site. The rules are the robot's, so what these hold is that this editor
+// cannot save a set the robot would refuse to load.
+
+test('the kind decides whether a zone is a point or an area', () => {
+  // The two are one decision, not two: a `charger` is a pose to dock at, and a
+  // `room` is a place with walls whose whole job is answering "am I in it".
+  // Edited separately, they drift into a dropoff carrying an outline nothing
+  // reads and a room with no extent `zones.containing` can ever match.
+  assert.ok(isAreaKind('room'));
+  assert.ok(isAreaKind('keepout'));
+  assert.ok(!isAreaKind('charger'));
+
+  // Naming a bare pose an area gives it something to drag onto the walls.
+  const waypoint = { name: 'home', kind: 'home', x: 2, y: 3 };
+  const room = withKind(waypoint, 'room');
+  assert.equal(room.polygon.length, 4);
+  assert.ok(pointInPolygon(room.polygon, waypoint.x, waypoint.y));
+
+  // And naming an area a point drops the outline, keeping the pose.
+  const back = withKind(room, 'charger');
+  assert.equal(back.polygon, undefined);
+  assert.deepEqual([back.x, back.y], [2, 3]);
+  assert.equal(withKind({ name: 'x', x: 0, y: 0, radius: 1.5 }, 'dock').radius, undefined);
+
+  // A zone that is *only* an outline gets the pose the robot's loader would
+  // derive — and if that centre is not inside it, the change is refused rather
+  // than putting the pose in a wall.
+  const ward = { name: 'ward', polygon: square.polygon };
+  assert.deepEqual(withKind(ward, 'dock'), { name: 'ward', kind: 'dock', x: 1, y: 1 });
+  const ell = {
+    name: 'hall',
+    polygon: [
+      [0, 0],
+      [6, 0],
+      [6, 1],
+      [1, 1],
+      [1, 6],
+      [0, 6],
+    ],
+  };
+  assert.equal(poseFor(ell), null);
+  assert.equal(withKind(ell, 'charger'), null);
+
+  // An area kind never disturbs an outline that is already there.
+  assert.deepEqual(withKind(square, 'corridor').polygon, square.polygon);
+});
+
+test('the kind list is the one the bundle validator will accept', () => {
+  // A kind outside `bundle.ZONE_KINDS` is refused at the parse, so a dropdown
+  // offering one would be an option that fails on save. Read out of the python
+  // rather than duplicated in a fixture, so adding a kind there fails here.
+  const bundle = readFileSync(
+    new URL('../../mote_bringup/mote_bringup/bundle.py', import.meta.url),
+    'utf8',
+  );
+  const kinds = (source, name) =>
+    source
+      .slice(source.indexOf(`${name} = (`) + name.length + 4)
+      .split(')')[0]
+      .match(/"[a-z]+"/g)
+      .map((quoted) => quoted.slice(1, -1));
+  assert.deepEqual(ZONE_KINDS, kinds(bundle, 'ZONE_KINDS'));
+  const constraints = bundle
+    .slice(bundle.indexOf('CONSTRAINT_KINDS = frozenset(('))
+    .split('))')[0]
+    .match(/"[a-z]+"/g)
+    .map((quoted) => quoted.slice(1, -1));
+  assert.deepEqual([...CONSTRAINT_KINDS].sort(), constraints.sort());
+
+  // And the point/area split, which decides what geometry an edit gives a zone.
+  const points = bundle
+    .slice(bundle.indexOf('POINT_KINDS = frozenset(('))
+    .split('))')[0]
+    .match(/"[a-z]+"/g)
+    .map((quoted) => quoted.slice(1, -1));
+  assert.deepEqual([...POINT_KINDS].sort(), points.sort());
+});
+
+test('aliases and tags round-trip through one comma-separated field', () => {
+  assert.deepEqual(parseList(' galley , The Kitchen ,, galley '), [
+    'galley',
+    'The Kitchen',
+  ]);
+  assert.equal(formatList(['galley', 'The Kitchen']), 'galley, The Kitchen');
+  assert.deepEqual(parseList(''), []);
+  // The resolver's comparison, so collision detection agrees with it.
+  assert.equal(normaliseAlias('The  Kitchen'), 'the kitchen');
+});
+
+test('the machine name a display name implies', () => {
+  // Three name fields is two too many to *type*: an operator names a room, and
+  // the identifier follows. It follows as a proposal — put in the name field,
+  // visible and editable — because `goto` takes it and a rename nobody asked
+  // for breaks the command that names the place.
+  assert.equal(slugify('The Kitchen'), 'the_kitchen');
+  assert.equal(slugify('Café'), 'cafe'); // the letter survives, not just the accent
+  assert.equal(slugify('  spare  room '), 'spare_room');
+  assert.equal(slugify('Ward 3B'), 'ward_3b');
+  // A name has to start with a letter, so there is nothing to propose here and
+  // the placeholder is left alone rather than mangled into one.
+  assert.equal(slugify('3rd floor'), '');
+  assert.equal(slugify(''), '');
+  for (const text of ['The Kitchen', 'Café', 'Ward 3B']) {
+    assert.ok(NAME_RE.test(slugify(text)), `${text} did not produce a usable name`);
+  }
+
+  // And it only ever replaces a name nobody chose: what `segment-map` mints for
+  // a room it found, and what `add zone` mints for a new one.
+  assert.ok(isGeneratedName('zone_01'));
+  assert.ok(isGeneratedName('zone_07'));
+  assert.ok(!isGeneratedName('kitchen'));
+  assert.ok(!isGeneratedName('zone_kitchen'));
+});
+
+test('two zones answering one query are caught before they are saved', () => {
+  // The robot's loader refuses an ambiguous vocabulary outright rather than
+  // resolving `goto` by dict order, so a save that produced one would produce a
+  // map no robot will load. Display names are not queries and do not collide.
+  const clash = ambiguities([
+    { name: 'kitchen', aliases: [] },
+    { name: 'galley', aliases: ['Kitchen'] },
+  ]);
+  assert.equal(clash.length, 1);
+  assert.match(clash[0], /kitchen/);
+  assert.deepEqual(
+    ambiguities([
+      { name: 'kitchen', display_name: 'The Kitchen', aliases: ['galley'] },
+      { name: 'office', display_name: 'The Kitchen', aliases: [] },
+    ]),
+    [],
+  );
+});
+
+test('navigable is written only when it deviates from the kind', () => {
+  // Every zone arrives from the server with `navigable` filled in from its kind
+  // (`bundle.zone_term`), so writing it back verbatim would carry a keepout's
+  // `false` onto a zone just changed to `room` — a room nothing can be sent to,
+  // with nothing on screen to say why.
+  assert.ok(navigableByDefault('room'));
+  assert.ok(!navigableByDefault('keepout'));
+  const payload = zonesPayload([
+    { name: 'kitchen', kind: 'room', navigable: true, x: 0, y: 0, aliases: [] },
+    { name: 'sluice', kind: 'keepout', navigable: false, x: 1, y: 1, tags: [] },
+    { name: 'workshop', kind: 'room', navigable: false, x: 2, y: 2 },
+  ]);
+  assert.ok(!('navigable' in payload.kitchen));
+  assert.ok(!('navigable' in payload.sluice));
+  assert.equal(payload.workshop.navigable, false); // deviant, so it was meant
+  // Empty lists say nothing the default does not.
+  assert.ok(!('aliases' in payload.kitchen));
+  assert.ok(!('tags' in payload.sluice));
+});
+
 // -- candidate review -----------------------------------------------------
 //
 // The read half of the review pane. Its canvas needs a browser like every other
@@ -380,7 +734,6 @@ const {
   provenanceRows,
   revisionPath,
   zoneSource,
-  zoneSummary,
 } = await import('../server/ui/review.mjs');
 
 test('a candidate is read from its own routes, never the canonical basemap', () => {
@@ -560,13 +913,16 @@ test('a zone row says which of the three footprints it is', () => {
   assert.equal(zoneSummary({ name: 'pickup', x: 1, y: 2 }), 'waypoint 1.00, 2.00');
 });
 
-test('inherited zones are called inherited, because coordinates cannot say so', () => {
+test('inherited zones are called inherited, and the ordinary case is silent', () => {
   // A revision carrying no zones.yaml inherits the floor's, taught in another
   // SLAM session's frame. They draw perfectly and are wrong by however far the
-  // two map origins differ — invisible on the canvas, so it is said in words.
-  assert.match(zoneSource('floor', 3), /inherited from the floor/);
-  assert.match(zoneSource('revision', 3), /own frame/);
-  assert.match(zoneSource('revision', 0), /carries no zones/);
+  // two map origins differ — invisible on the canvas, so it is said.
+  assert.equal(zoneSource('floor', 3).tag, 'inherited');
+  assert.match(zoneSource('floor', 3).title, /taught on another map/);
+  assert.equal(zoneSource('revision', 0).tag, 'none');
+  // And zones that belong to the map they are drawn on are just zones: a label
+  // for the absence of a problem is a label nobody can act on.
+  assert.equal(zoneSource('revision', 3), null);
 });
 
 test('review is a mode: opening it stands the operations panes down', () => {
@@ -593,7 +949,6 @@ test('the review pane has every element app.mjs binds to it', () => {
     'review-verdict-notes',
     'review-notes-label',
     'review-provenance',
-    'review-zones',
     'review-zone-source',
     'review-canvas',
     'review-map-label',