feat: real fire on the boards, the LA office as a twin, and a night sky worth reading

The world stops being a simulation of California and starts being California.

**THE PROMOTION GATE WAS THE FIRST COMMIT, BEFORE ANY ORANGE PIXEL EXISTED.**
On today's live store the SoCal board contains 22 incidents. Every one has NULL
acreage and fifteen are nameless LA County dispatch numbers. Drawn naively that
is 22 orange marks over Los Angeles on a day nothing is burning — in a frame that
contains no other warm colour, so one glyph would be the most salient object on
the board and twenty-two would spend its credibility permanently.

`acres >= 10 AND contained < 80 AND type != 'RX' AND last_seen = max(last_seen)`
returns 0 on SoCal, exactly 5 on California, 0 on the Bay — same body, same day,
three correct answers. The empty board is a deliverable, not a fallback: it says
"No active fire on this board — CAL FIRE and WFIGS, just now", states that 21
records were gated and why, lists the largest fires burning OUTSIDE the frame
with distances, and counts the hot pixels it is deliberately not drawing.

**The privacy leak is structurally impossible rather than carefully avoided.**
cloud-1 serves a projection; the four home-relative columns never leave that box.
`observations.threat` was the one that nearly got through — it is
`(16/distance)^2 x log10(acres) x momentum x containment x wind-alignment`, so
with acreage and containment public it inverts to a distance circle around a
house and three fires give an intersection. A grep of the built bundle for
distance_km, bearing_deg, threat, 7762 and the street name returns nothing.

**Deliberately not used, and both would have produced a confident wrong answer:**
the store's `air` table retains only the last parameter of each poll, so all 78
rows read "Good" while the live feed reports ozone 101 "Unhealthy for Sensitive
Groups" — haze driven off it would clear the sky during a smoke event. And
`weather` is written only inside the NWS alerts loop, so a quiet day stores no
wind at all. Tera's own per-region NWS wind is already correct and already what
the clouds drift on.

Satellite detections are drawn as evidence and never as incidents. The permanent
industrial heat source 4.7 km from the owner's house is flagged persistent and
dropped, asserted by a test that first proves it is present in the fixture.
MODIS integer confidence and VIIRS string confidence are branched on `sat`.

**The LA office is a twin.** Its entire authored second storey — Model Loft,
Model Bay, The Materials Room, 430 lines nobody had ever stood in — is reachable
on foot: a walker crosses level-1 to level-2 in 73 fixed steps, floorY 0 to 5,
verified against the real pack rather than a synthetic plan. Its two studio
devices read real hardware through a field-allowlisted bridge: mute, volume and
reachability only. Never level, because there is no passive level upstream and
obtaining one would record a room with people in it. Never dB, because upstream
is gainPct across four different native scales. The bridge refuses all writes.

Fixed at its root: an anonymous visitor was getting permanently at-rest
instruments backing off against a 401. The tier moves into `createDeviceSource`,
so anon gets the living simulator three file headers already promised.

**Item 8 is closed, not fixed, and the correction is the point.** The Bay Area
"stutter" was GPU power management — the card sat at 500 MHz of 2725 through
every run that reproduced it, 4096/2048/1024/256 shadow maps all render in
1.21-1.31 ms, and two consecutive runs over a byte-identical dist gave 33.4 then
16.7. The allowance is removed and the cell is back to 16.7. Geometry is the
gate; frame time is advisory.

Item 7 was re-scoped after measuring: 1,069,006 of the Bay Area's 2,265,056
triangles were the second submission of the same buildings into the shadow pass.
Mobile now has its own triangle caps and bay-area mobile draws 1,266,096.

Also: bridges and the freeway corridor light up at night as emission, not lights
— 1,614 deck lamps and 18 tower heads on the Bay in two draw calls. The single
change that made US-101 legible was moving its edge lines from the lit material
to the unlit one: retroreflective paint, the argument the SFO night frame already
makes. California went 21,991 lamps to 4,051, clustered at the 17 town districts,
because a rural interurban corridor genuinely is unlit.

Tests 1137 -> 1340, server 280. All ten budget cells pass on first attempt with
no cap raised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/access.ts

@@ -111,6 +111,30 @@ export interface Capabilities {
    * against a server set to `members` earns a 401 and nothing else.
    */
   liveMarkers: boolean;
+  /**
+   * Read this deployment's **real** device route, rather than the simulator
+   * bundled in the tab.
+   *
+   * `false` for an anonymous visitor, and that is not a restriction on what
+   * they see — it is what makes the studio work for them at all. The route is
+   * `members`-only and answers 401 to an anonymous GET, which is correct: the
+   * mics and the camera in it are hardware in somebody's room. What was wrong
+   * was the *client*, which asked anyway. `serverHasDevices` was the only gate
+   * on the API strategy, so on the production box — where `/health` reports
+   * `devices: "sim"` — an anonymous visitor took the API path, was refused,
+   * rendered every instrument permanently at rest, and backed off exponentially
+   * against a request it could never pass. The panel beside it promised a
+   * locally simulated studio.
+   *
+   * So this is the second half of a decision that already had a first half.
+   * `Feeds.devices` asks "has this deployment got a device source at all"; this
+   * asks "may *this viewer* read it". Both have to be true before a request is
+   * worth making, and when either is false the answer is the same and it is a
+   * good one: run the fixed-step simulator in this tab, which is what
+   * `adapter.ts`, `routes/devices.ts` and `devicePanel.ts` have all documented
+   * as the anonymous experience since they were written.
+   */
+  liveDevices: boolean;
   /** Debug overlays: frame time, draw calls, chapter poses, the solar readout. */
   debug: boolean;
 }
@@ -152,6 +176,19 @@ export interface Feeds {
    */
   satellites: boolean;
   markers: boolean;
+  /**
+   * A wildfire projection, from `TERA_FIRES_SOURCE`.
+   *
+   * Off on a clone and off on this repo's own default, which is the important
+   * half: a board with no fire feed behind it must draw nothing and say nothing
+   * rather than poll `/fires` every ten minutes forever to be told the same
+   * empty body. There is deliberately no `can.` twin — a wildfire is a public
+   * agency record and an account cannot grant you one — and there is
+   * deliberately no synthetic fallback anywhere beneath it. An invented
+   * aeroplane is a plausible aeroplane; an invented fire is a claim that a named
+   * place is burning, made to somebody who may live there.
+   */
+  fires: boolean;
 }
 
 export interface Access {
@@ -222,6 +259,10 @@ export function capabilitiesFor(tier: Tier): Capabilities {
     // is the correct place for that decision to be enforced and the only place
     // it can be enforced at all.
     liveMarkers: true,
+    // The one feed where an anonymous "no" is better than an anonymous "ask".
+    // See the field. The refusal is real, it is correct, and the simulator on
+    // the other side of it is a working studio rather than a consolation.
+    liveDevices: tier !== "anon",
     debug: tier === "god",
   };
 }
@@ -359,6 +400,7 @@ function feedsFrom(raw: unknown): Feeds {
     satellites: wired("satellites"),
     markers: wired("markers"),
     devices: wired("devices"),
+    fires: wired("fires"),
   };
 }