feat: real fire on the boards, the LA office as a twin, and a night sky worth reading

The world stops being a simulation of California and starts being California.

**THE PROMOTION GATE WAS THE FIRST COMMIT, BEFORE ANY ORANGE PIXEL EXISTED.**
On today's live store the SoCal board contains 22 incidents. Every one has NULL
acreage and fifteen are nameless LA County dispatch numbers. Drawn naively that
is 22 orange marks over Los Angeles on a day nothing is burning — in a frame that
contains no other warm colour, so one glyph would be the most salient object on
the board and twenty-two would spend its credibility permanently.

`acres >= 10 AND contained < 80 AND type != 'RX' AND last_seen = max(last_seen)`
returns 0 on SoCal, exactly 5 on California, 0 on the Bay — same body, same day,
three correct answers. The empty board is a deliverable, not a fallback: it says
"No active fire on this board — CAL FIRE and WFIGS, just now", states that 21
records were gated and why, lists the largest fires burning OUTSIDE the frame
with distances, and counts the hot pixels it is deliberately not drawing.

**The privacy leak is structurally impossible rather than carefully avoided.**
cloud-1 serves a projection; the four home-relative columns never leave that box.
`observations.threat` was the one that nearly got through — it is
`(16/distance)^2 x log10(acres) x momentum x containment x wind-alignment`, so
with acreage and containment public it inverts to a distance circle around a
house and three fires give an intersection. A grep of the built bundle for
distance_km, bearing_deg, threat, 7762 and the street name returns nothing.

**Deliberately not used, and both would have produced a confident wrong answer:**
the store's `air` table retains only the last parameter of each poll, so all 78
rows read "Good" while the live feed reports ozone 101 "Unhealthy for Sensitive
Groups" — haze driven off it would clear the sky during a smoke event. And
`weather` is written only inside the NWS alerts loop, so a quiet day stores no
wind at all. Tera's own per-region NWS wind is already correct and already what
the clouds drift on.

Satellite detections are drawn as evidence and never as incidents. The permanent
industrial heat source 4.7 km from the owner's house is flagged persistent and
dropped, asserted by a test that first proves it is present in the fixture.
MODIS integer confidence and VIIRS string confidence are branched on `sat`.

**The LA office is a twin.** Its entire authored second storey — Model Loft,
Model Bay, The Materials Room, 430 lines nobody had ever stood in — is reachable
on foot: a walker crosses level-1 to level-2 in 73 fixed steps, floorY 0 to 5,
verified against the real pack rather than a synthetic plan. Its two studio
devices read real hardware through a field-allowlisted bridge: mute, volume and
reachability only. Never level, because there is no passive level upstream and
obtaining one would record a room with people in it. Never dB, because upstream
is gainPct across four different native scales. The bridge refuses all writes.

Fixed at its root: an anonymous visitor was getting permanently at-rest
instruments backing off against a 401. The tier moves into `createDeviceSource`,
so anon gets the living simulator three file headers already promised.

**Item 8 is closed, not fixed, and the correction is the point.** The Bay Area
"stutter" was GPU power management — the card sat at 500 MHz of 2725 through
every run that reproduced it, 4096/2048/1024/256 shadow maps all render in
1.21-1.31 ms, and two consecutive runs over a byte-identical dist gave 33.4 then
16.7. The allowance is removed and the cell is back to 16.7. Geometry is the
gate; frame time is advisory.

Item 7 was re-scoped after measuring: 1,069,006 of the Bay Area's 2,265,056
triangles were the second submission of the same buildings into the shadow pass.
Mobile now has its own triangle caps and bay-area mobile draws 1,266,096.

Also: bridges and the freeway corridor light up at night as emission, not lights
— 1,614 deck lamps and 18 tower heads on the Bay in two draw calls. The single
change that made US-101 legible was moving its edge lines from the lit material
to the unlit one: retroreflective paint, the argument the SFO night frame already
makes. California went 21,991 lamps to 4,051, clustered at the 17 town districts,
because a rural interurban corridor genuinely is unlit.

Tests 1137 -> 1340, server 280. All ten budget cells pass on first attempt with
no cap raised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/engine/scenekit.ts

@@ -396,6 +396,24 @@ export function createSceneKit(options: SceneKitOptions): SceneKit {
        * glow that fades out with the daylight it belongs to.
        */
       u.uSunGlow!.value = Math.min(1, Math.max(0, state.sun.intensity / SUN_GLOW_FULL_INTENSITY));
+
+      /**
+       * The moon, if this rig carries one. See `LightingMoon`.
+       *
+       * A drawn object and nothing else: no light is constructed here, no light
+       * is modified here, and the key after dark is already `state.sun`, which
+       * `atmosphere.ts` handed to the moon. Absent or `null` sets the visibility
+       * to zero and the shader's branch never runs, which is what an office rig
+       * and the hard-coded fallback both get.
+       */
+      const moon = state.moon ?? null;
+      u.uMoonVisibility!.value = moon ? Math.min(1, Math.max(0, moon.visibility)) : 0;
+      if (moon) {
+        (u.uMoonDirection!.value as THREE.Vector3).fromArray(moon.direction).normalize();
+        (u.uMoonLimb!.value as THREE.Vector3).fromArray(moon.brightLimb).normalize();
+        u.uMoonRadius!.value = Math.max(1e-4, moon.angularRadius * MOON_ANGULAR_EXAGGERATION);
+        u.uMoonPhase!.value = Math.min(1, Math.max(0, moon.illuminated));
+      }
     } else if (domeAttached) {
       scene.remove(dome);
       domeAttached = false;
@@ -678,6 +696,41 @@ export function createSceneKit(options: SceneKitOptions): SceneKit {
  */
 const SUN_GLOW_FULL_INTENSITY = 1.9;
 
+/**
+ * The moon's own colour, and how much of the dark side earthshine leaves visible.
+ *
+ * Not white. The full moon measures around 4100 K to the eye — a warm grey, and
+ * a pure-white disc against a deep blue night sky is the single most common tell
+ * of a synthetic sky. 0.045 for the earthshine is roughly what a young crescent
+ * over a cloudy earth actually shows, and it is what makes the *whole* disc
+ * findable at a thin phase instead of just the sliver.
+ */
+const MOON_COLOR = 0xf2ecdc;
+const MOON_EARTHSHINE = 0.045;
+
+/**
+ * How much larger than life the disc is drawn.
+ *
+ * The moon is half a degree across. At this camera's 42-degree vertical field
+ * over a 1000-pixel viewport that is nine pixels — smaller than the aeroplane
+ * glyphs, smaller than a satellite dot at some sizes, and indistinguishable from
+ * a stuck pixel. Drawn true, the four hundred lines of Meeus behind its position
+ * buy a picture of nothing.
+ *
+ * So it is exaggerated, and this is the same trade the rest of this codebase
+ * already makes and writes down: `clouds.ts` draws stratocumulus five to twelve
+ * kilometres wide because an honest cumulus is two pixels, `flights.ts` draws an
+ * aeroplane glyph hundreds of times its true span, and `atmosphere.ts` floors
+ * visibility at 4.5 km because honest fog is a white rectangle. A map is looked
+ * at from outside the sky it is depicting.
+ *
+ * 2.6 rather than more, because the *phase* is the information here and a phase
+ * is legible well before a disc becomes a cartoon: at 2.6 the disc is about
+ * 24 pixels of a 1000-pixel frame, a crescent is unmistakable, and nobody reads
+ * it as a second sun.
+ */
+const MOON_ANGULAR_EXAGGERATION = 2.6;
+
 /**
  * The sky, as a mesh in the world rather than a gradient on the screen.
  *
@@ -741,6 +794,13 @@ function makeSkyDome(): THREE.Mesh<THREE.SphereGeometry, THREE.ShaderMaterial> {
       uSunDirection: { value: new THREE.Vector3(0, 1, 0) },
       uSunColor: { value: new THREE.Color(0xffffff) },
       uSunGlow: { value: 0 },
+      uMoonDirection: { value: new THREE.Vector3(0, 1, 0) },
+      uMoonLimb: { value: new THREE.Vector3(1, 0, 0) },
+      uMoonRadius: { value: 0.012 },
+      uMoonPhase: { value: 1 },
+      /** 0 draws nothing, and is what an office and a fallback rig get. */
+      uMoonVisibility: { value: 0 },
+      uMoonColor: { value: new THREE.Color(MOON_COLOR) },
     },
     vertexShader: `
 varying vec3 vDirection;
@@ -757,6 +817,12 @@ uniform vec3 uHorizon;
 uniform vec3 uSunDirection;
 uniform vec3 uSunColor;
 uniform float uSunGlow;
+uniform vec3 uMoonDirection;
+uniform vec3 uMoonLimb;
+uniform float uMoonRadius;
+uniform float uMoonPhase;
+uniform float uMoonVisibility;
+uniform vec3 uMoonColor;
 varying vec3 vDirection;
 
 void main() {
@@ -800,6 +866,65 @@ void main() {
   float band = exp( - abs( height ) * 6.0 ) * pow( azimuth, 2.5 ) * 0.18;
 
   color += uSunColor * uSunGlow * ( aureole + band );
+
+  /*
+   * The moon, drawn.
+   *
+   * Everything here is angular, which is what the dome preserves and the only
+   * reason this can live in the sky shader at all: direction is a unit vector
+   * and so is uMoonDirection, so the offset between them, projected onto the
+   * two axes of the visible disc, is the position on that disc in radians. Over
+   * half a degree the small-angle approximation is exact to eight decimal
+   * places, so no trigonometry is needed and none is done.
+   *
+   * uMoonLimb is perpendicular to the moon and points at the middle of the lit
+   * side — the sun's true direction with the moon's own component removed, which
+   * atmosphere.ts computes because it is the one module holding an unfloored
+   * sun. du is therefore measured along the phase and dv across it.
+   */
+  if ( uMoonVisibility > 0.0 ) {
+    vec3 across = cross( uMoonDirection, uMoonLimb );
+    float du = dot( direction, uMoonLimb ) / uMoonRadius;
+    float dv = dot( direction, across ) / uMoonRadius;
+    float onThisSide = step( 0.0, dot( direction, uMoonDirection ) );
+    float rr = du * du + dv * dv;
+
+    /*
+     * The terminator is an ellipse, not a line, and the whole of it is one
+     * expression: the boundary sits at du = (1 - 2k) * sqrt(1 - dv^2), which
+     * is a straight line through the centre at half phase, the full limb at
+     * full, and nothing at new. Softened over a fifteenth of the disc because a
+     * hard step on an object sixty pixels across aliases into a staircase, and
+     * because the real terminator is a lit horizon rather than an edge.
+     */
+    float boundary = ( 1.0 - 2.0 * uMoonPhase ) * sqrt( max( 0.0, 1.0 - dv * dv ) );
+    float lit = smoothstep( boundary - 0.07, boundary + 0.07, du );
+
+    /*
+     * Limb darkening, and earthshine.
+     *
+     * The moon is not a flat disc: brightness falls toward the edge as the
+     * surface turns away, which is what stops it reading as a sticker. And the
+     * dark side is not black — it is lit by a full earth, which is why the whole
+     * disc of a young crescent is visible on a clear night. Both are cheap and
+     * both are the difference between a moon and a circle.
+     */
+    float curve = sqrt( max( 0.0, 1.0 - rr ) );
+    float shading = mix( ${MOON_EARTHSHINE.toFixed(3)}, 0.55 + 0.45 * curve, lit );
+    // The disc's own edge, feathered by the same amount as the terminator.
+    float disc = ( 1.0 - smoothstep( 0.86, 1.0, rr ) ) * onThisSide;
+    color += uMoonColor * uMoonVisibility * shading * disc;
+
+    /*
+     * A halo, because a moon with a hard edge and nothing around it reads as a
+     * decal. Kept to a twentieth of the disc's own brightness and to a few
+     * degrees of sky: the failure mode this file is downstream of is a night
+     * layer that lifts the whole frame, and a wide bloom is exactly that.
+     */
+    float toMoon = max( dot( direction, uMoonDirection ), 0.0 );
+    color += uMoonColor * uMoonVisibility * pow( toMoon, 400.0 ) * 0.05;
+  }
+
   gl_FragColor = vec4( color, 1.0 );
 }
 `,