feat: real fire on the boards, the LA office as a twin, and a night sky worth reading

The world stops being a simulation of California and starts being California.

**THE PROMOTION GATE WAS THE FIRST COMMIT, BEFORE ANY ORANGE PIXEL EXISTED.**
On today's live store the SoCal board contains 22 incidents. Every one has NULL
acreage and fifteen are nameless LA County dispatch numbers. Drawn naively that
is 22 orange marks over Los Angeles on a day nothing is burning — in a frame that
contains no other warm colour, so one glyph would be the most salient object on
the board and twenty-two would spend its credibility permanently.

`acres >= 10 AND contained < 80 AND type != 'RX' AND last_seen = max(last_seen)`
returns 0 on SoCal, exactly 5 on California, 0 on the Bay — same body, same day,
three correct answers. The empty board is a deliverable, not a fallback: it says
"No active fire on this board — CAL FIRE and WFIGS, just now", states that 21
records were gated and why, lists the largest fires burning OUTSIDE the frame
with distances, and counts the hot pixels it is deliberately not drawing.

**The privacy leak is structurally impossible rather than carefully avoided.**
cloud-1 serves a projection; the four home-relative columns never leave that box.
`observations.threat` was the one that nearly got through — it is
`(16/distance)^2 x log10(acres) x momentum x containment x wind-alignment`, so
with acreage and containment public it inverts to a distance circle around a
house and three fires give an intersection. A grep of the built bundle for
distance_km, bearing_deg, threat, 7762 and the street name returns nothing.

**Deliberately not used, and both would have produced a confident wrong answer:**
the store's `air` table retains only the last parameter of each poll, so all 78
rows read "Good" while the live feed reports ozone 101 "Unhealthy for Sensitive
Groups" — haze driven off it would clear the sky during a smoke event. And
`weather` is written only inside the NWS alerts loop, so a quiet day stores no
wind at all. Tera's own per-region NWS wind is already correct and already what
the clouds drift on.

Satellite detections are drawn as evidence and never as incidents. The permanent
industrial heat source 4.7 km from the owner's house is flagged persistent and
dropped, asserted by a test that first proves it is present in the fixture.
MODIS integer confidence and VIIRS string confidence are branched on `sat`.

**The LA office is a twin.** Its entire authored second storey — Model Loft,
Model Bay, The Materials Room, 430 lines nobody had ever stood in — is reachable
on foot: a walker crosses level-1 to level-2 in 73 fixed steps, floorY 0 to 5,
verified against the real pack rather than a synthetic plan. Its two studio
devices read real hardware through a field-allowlisted bridge: mute, volume and
reachability only. Never level, because there is no passive level upstream and
obtaining one would record a room with people in it. Never dB, because upstream
is gainPct across four different native scales. The bridge refuses all writes.

Fixed at its root: an anonymous visitor was getting permanently at-rest
instruments backing off against a 401. The tier moves into `createDeviceSource`,
so anon gets the living simulator three file headers already promised.

**Item 8 is closed, not fixed, and the correction is the point.** The Bay Area
"stutter" was GPU power management — the card sat at 500 MHz of 2725 through
every run that reproduced it, 4096/2048/1024/256 shadow maps all render in
1.21-1.31 ms, and two consecutive runs over a byte-identical dist gave 33.4 then
16.7. The allowance is removed and the cell is back to 16.7. Geometry is the
gate; frame time is advisory.

Item 7 was re-scoped after measuring: 1,069,006 of the Bay Area's 2,265,056
triangles were the second submission of the same buildings into the shadow pass.
Mobile now has its own triangle caps and bay-area mobile draws 1,266,096.

Also: bridges and the freeway corridor light up at night as emission, not lights
— 1,614 deck lamps and 18 tower heads on the Bay in two draw calls. The single
change that made US-101 legible was moving its edge lines from the lit material
to the unlit one: retroreflective paint, the argument the SFO night frame already
makes. California went 21,991 lamps to 4,051, clustered at the 17 town districts,
because a rural interurban corridor genuinely is unlit.

Tests 1137 -> 1340, server 280. All ten budget cells pass on first attempt with
no cap raised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CONTRACT.md

@@ -177,6 +177,23 @@ constructed and mutated the same three lights.
   A sited office also gets a `sky` and a ground plane at `-site.elevation`, which
   is what makes 188 m up a tower feel different from 4 m above an airfield.
 
+  **A third input joined the adapter, and it is still not a second opinion about
+  the light.** `officeDaylight(state, site, smokeLoad)` takes a 0–1 scalar for
+  how much wildfire smoke is in this building's air, and moves the haze colour,
+  the haze near-distance and the sun's tint — three numbers the adapter already
+  computed. It is clamped at the boundary, bit-identical to today at zero, and it
+  changes nothing about who owns the rig: `Atmosphere` still decides the sun and
+  the sky, `daylight.ts` still only adapts what `apply()` returned, and the
+  scalar is handed *in* from `main.ts` rather than fetched. A room may not reach
+  into the fire layer and decide its own sky; that would be the second sun this
+  clause exists to prevent, arriving through a side door.
+
+  The fire layer itself constructs no light of any kind. A burning hillside at
+  night is emissive material plus one additive ground quad in the same instanced
+  mesh — the mechanism `nightlights.ts` uses for San Francisco's 12,038 street
+  lamps — because a `PointLight` per fire is exactly the case this clause forbids
+  and exactly the case that tempts one.
+
 ## 5. One server
 
 Three backends were designed for one box — three ports, three frameworks, three
@@ -209,6 +226,17 @@ when it is absent — which fails the very acceptance test they named.
 - A source set without a contact is a **demotion, not a fatality**: log one loud
   line and serve the `synthetic: true` clear-day body.
 - The `env -i` CI job is what keeps this honest.
+- **`TERA_FIRES_SOURCE` defaults to `none`, and `none` invents nothing.** The
+  asymmetry with the weather is deliberate and is the sharpest line this round
+  drew: an invented clear day is a defensible synthetic default, and an invented
+  wildfire is a claim that a named place is burning, made to somebody who may
+  live there. So `none` serves a real, empty body, and the board says how old its
+  last answer is rather than showing an all-clear it cannot support.
+- Off-by-default is a **choice**, not a misconfiguration, so an unset
+  `TERA_FIRES_SOURCE` appends nothing to `degraded[]` — which is one sentence per
+  *demotion*. `scripts/check-zero-config-boot.mjs` refuses to pass with any
+  demotion at all on an empty environment, and that is the gate that keeps the
+  distinction real: a stranger's clone is not a broken deployment.
 
 ### 5.2 Weather sources
 
@@ -233,6 +261,18 @@ Scope-corrected: no membership tables, no tenancy.
   reject every real token.
 - A private office returns **404, not 403**, so the endpoint cannot be used to
   enumerate what exists.
+- **A refused feed must produce a working instrument, not a dead one.** The
+  studio device route is members-only and answers 401 to an anonymous GET, which
+  is correct — the microphones and the camera behind it are hardware in
+  somebody's room. What is *not* correct is asking anyway. `Capabilities` now
+  carries `liveDevices` (`tier !== "anon"`) alongside `Feeds.devices`, and both
+  must be true before the API strategy is chosen; when either is false the
+  bundled fixed-step simulator runs in the tab instead. Passing only the
+  deployment's half is what shipped a permanently at-rest instrument panel to
+  every anonymous visitor on cloud-2, backing off exponentially against a
+  request that could never pass. This is the same anon-first rule
+  `SimulatedFlights` and `sample.ts` already follow, applied to the one feed
+  that had a real refusal behind it.
 - `@supabase/supabase-js` is a **real dependency**, and the "no surprise
   dependencies" CI check becomes an **allowlist naming why each is permitted**,
   not a count. A dynamic import of an uninstalled package fails the Vite build,