feat: land on a real place, and let a wheel notch cross the seam

The owner has now asked four times why there are three boards, and the last
answer missed the point: reconciling the packs made them draw one California,
but you still *arrived* on the coarsest tier the product owns and still changed
boards by picking a name off a list. This changes both.

**The behaviour was already built and behind a second flag defaulted off.**
`handover()` in `ladder.ts` — promote/demote by camera stand-off, hysteresis at
0.9/1.15, a drag guard so a board never swaps under a finger — was pure, tested
and shipped a round ago, with `?handover=1` as the only way to see it. It is on
now, `?handover=0` turns it off. Measured on the deployed bundle first:
promotion into the Bay Area fired at the sixteenth wheel notch in from the state
pose, arrival clean, no boot card, no tab, no click on a name.

**And it did not work, for a reason worth writing down.** Landing on the Bay
with the flag on bounced straight back to the state board with no input at all.
Two wrong diagnoses on the way, both from reasoning instead of measuring:

  1. "sf's ceiling equals its own widest pose, so the band is too tight." It is
     not — `chapterStandoffMetres` puts the resting pose at 71.2 km against a
     demote threshold of 81.9 km.
  2. "the arrival flight carries the camera through the threshold, so guard on
     `arriving()`." Right about the cause, wrong about the mechanism: the guard
     went in and the bounce survived it.

A trajectory log settled it in one run. The handover tick arrived *before* the
first `arriving=true` sample, at 108,316 m — 1.5x sf's resting stand-off, which
is `arrivalStart`'s own offset. `arrive()` read:

    kit.setPose(from);
    arrival = { from, to: rest, elapsed: 0 };

`setPose` drives `OrbitControls`, which fires `change` **synchronously**, and
`main.ts` listens on that event. So the listener ran on the line *between* those
two statements: camera already 1.5x out, `arriving()` still false. A one-frame
ordering race, and the guard could not fire because the flag it reads was set one
statement too late. The assignment now goes first.

The guard stays, because the inequality behind it is structural rather than
incidental: `ARRIVAL_STANDOFF` is 1.5 and `DEMOTE` is 1.15, both global, so the
opening frame of *every* board sits outside that board's own retention band.
`handoverArrivalGuard.test.ts` asserts that relation and drives the real rule
through the opening stand-off to watch it demote, so neither the guard nor either
constant can be quietly simplified.

**The landing board is `DEFAULT_CITY_ID`, and it is the Bay Area.** It was
`CITIES[0]` in three places, which meant the state tier: seventeen districts over
1063x930 km at 1,919 m per unit, no city legible, and a left column whose first
offer is somewhere else to go. The detailed boards carry 52 and 47 districts at
94 and 391 m per unit. With free handover on, the state tier stops being a
destination and becomes what you get when you pull back — the role it is good at,
since it is the only board drawing 97.4% of California. A named constant rather
than reordering `CITIES`, because that array's order is the `?city=` fallback and
is read positionally by other consumers.

**Which caught a silent break in the capture harness, and this is the part that
would have cost a week.** `shots.mjs` and `films.mjs` built `?city=` only when a
shot declared one — and 4 of 21 shots and 1 of 4 films declare none, so they
inherited the app's default. Moving that default would have re-pointed five
pieces of marketing imagery at a different place while every filename, caption
and alt text stayed as it was. Both harnesses now name `california` themselves.
`performance-budget.mjs`'s `california` and `california-drive` cells had no query
at all for the same reason; `signature` would have failed them loudly rather than
mismeasuring, which is the harness working, but a harness that depends on an app
default reports someone else's change as its own flake.

Every harness also pins `handover=0`. A planted pose wider than a board's
retention band would otherwise demote to the coarser tier while the shutter is
open, and the frame that comes back is a real photograph of the wrong board.

Verified: bare URL lands on the Bay Area and stays there; `?city=california` and
`?city=socal` still deep-link; `?handover=0` stays put; zooming out from the Bay
demotes to the state tier at the second notch. 1,694 tests pass. All ten budget
cells pass with no cap raised, and every cell now measures the board it names.

Still true and now a decision rather than a doubt: 97.4% of California has no
board below 242 km of stand-off, so zooming into the middle of the state lands on
coarse ground. That picture has been looked at. Authoring Sacramento, Fresno and
the Central Valley is what retires it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/brand-assets/capture.mjs

@@ -203,7 +203,7 @@ try {
      * opens, so no flight is needed — but the label is checked anyway, because
      * "the chapter I did not click" is exactly as reorderable as the one I did.
      */
-    await shootApp(browser, "http://tera.lumbridgecorp.com:5210/?city=california", "art-tera.png", {
+    await shootApp(browser, "http://tera.lumbridgecorp.com:5210/?city=california&handover=0", "art-tera.png", {
       at: AFTERNOON,
       chapter: 0,
       expect: "State",

scripts/brand-assets/films.mjs

@@ -564,7 +564,23 @@ async function expose(page, instant) {
 
 async function film(browser, spec, dir) {
   const host = spec.door === "office" ? "office.lumbridgecorp.com" : "tera.lumbridgecorp.com";
-  const query = spec.city ? `?city=${spec.city}` : "";
+  /*
+   * **Both halves of this are explicit on purpose, and neither used to be.**
+   *
+   * `city` used to fall through to the app's own default when a shot did not
+   * declare one, and four of the twenty-one shots relied on that. The default
+   * then moved from the state board to the Bay Area, which would have re-pointed
+   * those four at a different place while every filename, caption and `alt`
+   * stayed exactly as it was — the silent kind of wrong this harness exists to
+   * prevent. So the fallback is named here rather than borrowed from the app.
+   *
+   * `handover=0` pins the free-camera tier promotion off. With it on, a planted
+   * pose wider than a board's retention band demotes to the coarser tier while
+   * the shutter is open, and the frame that comes back is a real photograph of
+   * the wrong board. A capture harness must not share a camera policy with a
+   * visitor.
+   */
+  const query = `?city=${spec.city ?? "california"}&handover=0`;
   const frames = frameOverride ?? spec.frames;
   const page = await browser.newPage({
     viewport: spec.viewport ?? VIEWPORT,

scripts/brand-assets/shots.mjs

@@ -1346,7 +1346,23 @@ async function serveFeed(page, name) {
 
 async function shoot(browser, shot, frame) {
   const host = shot.door === "office" ? "office.lumbridgecorp.com" : "tera.lumbridgecorp.com";
-  const query = shot.city ? `?city=${shot.city}` : "";
+  /*
+   * **Both halves of this are explicit on purpose, and neither used to be.**
+   *
+   * `city` used to fall through to the app's own default when a shot did not
+   * declare one, and four of the twenty-one shots relied on that. The default
+   * then moved from the state board to the Bay Area, which would have re-pointed
+   * those four at a different place while every filename, caption and `alt`
+   * stayed exactly as it was — the silent kind of wrong this harness exists to
+   * prevent. So the fallback is named here rather than borrowed from the app.
+   *
+   * `handover=0` pins the free-camera tier promotion off. With it on, a planted
+   * pose wider than a board's retention band demotes to the coarser tier while
+   * the shutter is open, and the frame that comes back is a real photograph of
+   * the wrong board. A capture harness must not share a camera policy with a
+   * visitor.
+   */
+  const query = `?city=${shot.city ?? "california"}&handover=0`;
   const page = await browser.newPage({
     viewport: VIEWPORT,
     deviceScaleFactor: preview ? 1 : 2,

scripts/performance-budget.mjs

@@ -49,11 +49,18 @@ const VIEWPORTS = {
 const SCENES = {
   california: {
     host: "tera.lumbridgecorp.com",
+    // Explicit, and it was implicit until the app's default board moved off the
+    // state tier. `signature` would have caught it — a board with no
+    // `california-overview` chapter never becomes ready — but a harness that
+    // depends on an app default is a harness that reports someone else's change
+    // as its own flake.
+    query: "?city=california&handover=0",
     signature: "california-overview",
     ready: () => document.getElementById("boot")?.hidden === true && document.querySelector("#chapters .chapter[data-view='california-overview']") !== null,
   },
   "california-drive": {
     host: "tera.lumbridgecorp.com",
+    query: "?city=california&handover=0",
     signature: "california-overview",
     ready: () => document.getElementById("boot")?.hidden === true && document.querySelector("#chapters .chapter[data-view='california-overview']") !== null && document.querySelector("#chapters .chapter[data-view='la-sf-us-101']") !== null,
     activate: () => {
@@ -66,7 +73,7 @@ const SCENES = {
     },
     active: () => document.querySelector("[data-control-mode='drive']")?.getAttribute("aria-pressed") === "true" && document.getElementById("play-hud")?.hidden === false,
   },
-  office: { host: "office.lumbridgecorp.com", ready: () => document.getElementById("boot")?.hidden === true && document.getElementById("enter")?.textContent?.includes("Back to the city") === true },
+  office: { host: "office.lumbridgecorp.com", query: "?handover=0", ready: () => document.getElementById("boot")?.hidden === true && document.getElementById("enter")?.textContent?.includes("Back to the city") === true },
   /*
    * The two metro boards, added after they became the boards with the most on
    * them and were still the boards nothing measured.
@@ -86,13 +93,13 @@ const SCENES = {
    */
   "bay-area": {
     host: "tera.lumbridgecorp.com",
-    query: "?city=sf",
+    query: "?city=sf&handover=0",
     signature: "hayes-valley",
     ready: () => document.getElementById("boot")?.hidden === true && document.querySelector("#chapters .chapter[data-view='hayes-valley']") !== null,
   },
   socal: {
     host: "tera.lumbridgecorp.com",
-    query: "?city=socal",
+    query: "?city=socal&handover=0",
     signature: "dtla",
     ready: () => document.getElementById("boot")?.hidden === true && document.querySelector("#chapters .chapter[data-view='dtla']") !== null,
   },