Design decisions
- Users only. Organisations are users; venue addresses stay with GatherPress, which already stores and geocodes them.
- Network-wide tables, because users are network-wide. Per-site access is expressed by uses, never by per-site tables.
- Membership, not account, is the grant. LH Addresses does not know what membership is; LH Membership answers the read filter.
- Geocoding lives in LH Places as a provider-agnostic service; LH Addresses only queues requests and stores the points, so its member-and-capability gate also covers the points.
- Organisations see exact points for the addresses they were given. Rounding would protect nothing, since the full street address is already visible to them.
- No MCP abilities of its own: address fields and near-point search belong in LH Profile Page’s user search, behind the same gate.
commerceguys/addressing
Version 2.3. AddressFormat::getRequiredFields() is documented as returning AddressField[] but returns the class’s string constant values, so validate() carries an inline @var string[] for static analysis. Subdivision mapping first matches the code or full name, then a prefix of the name without spaces (Vic, Qld).
Migration from lh_profile-* meta
Planned in lh-tasks #148769: backfill each flat address as the member’s own residential address plus a use for every site they belong to; mirror the flat keys from the member’s own residential address while callers move to the API; a logged catch-all for direct meta writers and a daily drift check; retire the mirrors once nothing reads them.