feat: complete actor handoff and piloted aircraft presence

BUILD_PLAN.md

@@ -34,16 +34,22 @@ ahead; realtime/media must not jump ahead of the actor and access contracts.
 
 ## M0 — contracts and provenance
 
-Status: **in progress**.
+Status: **implemented**.
 
 - Tera/Spaces is the renderer; `lumbridgecorp` is the control plane.
 - Apache-2.0 remains the outbound code license.
 - Every copied asset/data item gets a pinned source, license, hash, and intake
   note. Original procedural assets record their design lineage.
-- Add an automated asset-manifest gate, dependency license allowlist, and SBOM.
+- `PROVENANCE.json` plus `npm run provenance` hash-gates every tracked
+  distribution artifact, rejects undeclared copied items and remote/bundled
+  fonts, and records original procedural/data lineage.
+- `npm run licenses` enforces the reviewed dependency-license allowlist and
+  registry integrity pins; `npm run sbom` emits SPDX 2.3 from the lockfile.
 
 Exit gate: a clean clone builds and tests without private services or binary
-art; every shipped dependency, route, font, and asset has recorded provenance.
+runtime art; every shipped dependency, route, font, and asset has recorded
+provenance. The only tracked raster art is the two generated social cards in
+`public/`, both source-reproducible and SHA-256 pinned in the manifest.
 
 ## M1 — California roads and passive Model X traffic
 
@@ -78,8 +84,9 @@ tunneling, or tab-resume jumps; a recorded input trace replays identically.
 
 ## M3 — walkable offices and actors
 
-Status: **collision/controller foundation and procedural actor assets
-implemented; office camera/input integration and identity handoff pending**.
+Status: **implemented and integrated**. City actors and office walkers share the
+same profile-derived appearance and journey identity; anonymous visitors change
+from crow outdoors to dog indoors, while signed-in members remain humanoid.
 
 - First-/third-person walker against the existing `Plan.blocked` wall segments.
 - Door traversal and city ↔ office identity handoff.
@@ -93,6 +100,13 @@ soak produces no stuck or out-of-bounds actor.
 
 ## M4 — authoritative multiplayer
 
+Status: **core hosted actor, vehicle, and aircraft presence is implemented**.
+The service uses short-lived rotating grants, exact interest cells, bounded
+10 Hz publishing, strict motion validation, reconnect snapshots, and aggregate-
+only presence UI. Deterministic two-client and bounded-service acceptance tests
+cover convergence, late join, cell isolation, ownership, revocation, cleanup,
+and speed-hack rejection.
+
 - Dedicated realtime session service; do not merge it into the control plane.
 - Server-authoritative actor/vehicle poses, input validation, interpolation,
   reconnect, and interest zones keyed by Tera cell / Office / Floor / Room.
@@ -128,6 +142,11 @@ textures; bandwidth adaptation and safe public placeholders work.
 
 ## M7 — playable aircraft
 
+Status: **solo and hosted multiplayer play are implemented**. The original
+procedural electric V-tail has deterministic assisted/manual control, chase
+camera, California bounds, and an authoritative geographic wire adapter; remote
+clients render its bank, control surfaces, and fan phase from validated state.
+
 Keep today's aircraft ambient until vehicle, actor, camera, and network
 abstractions are proven. A later `PlayableAircraft` reuses flight-source data for
 the world but owns a separate controller and authority model.