Spaces: the inside of the world, and a sun that is actually where it should be

Ten agents wrote this in parallel against CONTRACT.md, which exists because the
five design agents before them collided on fifteen blocking points — four files
specified twice with incompatible contents, three separate backends for one box,
and `Environment` exported twice meaning different things.

What landed: a Stage owning only the renderer and the loop, with the city and an
office as two scenes over it. They cannot share one — San Francisco is ~94 m per
scene unit with 3.6x vertical exaggeration and an office is 1 unit = 1 m — and
the city is paused rather than disposed on the way in, because rebuilding its
336,864-point heightfield costs about a second on the way back out.

Offices are data. `src/offices/lumbridge-hq.ts` is fifteen rooms and seventy-six
seats, and it is the file a self-hoster copies. Walls are a segment list with
1-D openings, so doors and windows are holes punched in a wall rather than
placed objects, and the pass that splits a wall around its openings hands the
walk-mode collider its segments for free.

The sun is real. `solar.ts` is a NOAA/Meeus implementation with no imports at
all — not even three.js — so time of day keeps working on a laptop in a field.
Verified against known values: 75.45 degrees at the June solstice in SF, 28.79
at December, sunset at 03:15Z. The first screenshot after wiring it was a black
rectangle, which turned out to be correct: it was midnight in San Francisco.

Presence binds to a seat id and never to a coordinate. The pack knows where
`eng-04` is; who is sitting in it is private data behind an API. Same shape as
the marker rule, one level in.

Two corrections to ARCHITECTURE.md are in here. Containment does not discharge
ODbL — publishing OSM-derived coordinates is Public Use of a Derivative Database
wherever the rows live, so the rule is about the geocoder (US Census, public
domain) and not the storage. And a person at a desk is not a Marker; markers are
geographic.

One contract gap surfaced only in a screenshot: two agents read `height` on a
viewpoint differently, so the establishing shot aimed at empty air fourteen
metres above the roof. It now means what the same field means for a city.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ARCHITECTURE.md

@@ -136,14 +136,41 @@ So:
   Original expression, ours, Apache 2.0. This is already true for SF.
 - **Elevation**, when we want real terrain, comes from **USGS/SRTM**, which is
   US-government public domain. Not OSM.
-- **Geocoded company coordinates never enter this repo.** They live in Workie's
-  private database and arrive over the API at runtime.
+- **Geocoded company coordinates never enter this repo.** They live in a private
+  database and arrive over the API at runtime.
 
-Note where that lands: the licence constraint and the privacy constraint want
-exactly the same thing. Company positions and pipeline status both stay behind
-the API; the open-source repo holds the city and the renderer. That is a nice
-result and it should be defended, because the tempting shortcut — "just commit a
-`sf-companies.json`" — breaks both at once.
+There is a real result here: the licence constraint and the privacy constraint
+want the same thing. Company positions and pipeline status both stay behind the
+API; the open-source repo holds the city and the renderer. The tempting shortcut
+— "just commit an `sf-companies.json`" — breaks both at once.
+
+#### Correction: containment is not discharge
+
+An earlier version of this section stopped at the paragraph above, and it was
+**wrong** in a way worth recording rather than quietly fixing.
+
+Keeping OSM-derived coordinates out of the repo solves licence *mixing inside
+the repo*. It does not touch ODbL's actual trigger. Serving a snapshot of those
+coordinates from a public endpoint is **Publicly Using a Derivative Database**,
+which brings ODbL §4.3 attribution and §4.4 share-alike onto the served data
+**regardless of where the rows are stored**. Moving the table off-disk hides the
+obligation; it does not discharge it.
+
+So the rule is about the *geocoder*, not the storage:
+
+- The sanctioned geocoder is the **US Census Geocoder**
+  (`geocoding.geo.census.gov`) — a US Government work in the public domain,
+  keyless, covering every city planned here.
+- **Google, Mapbox and HERE do not solve this either.** Their terms restrict
+  storing and redistributing returned coordinates, which is precisely what a
+  public snapshot does. "Not OSM" is not the test; "may be redistributed" is.
+- Every synced row carries a **provenance** field, and the public-shape
+  assertion rejects any row whose provenance is not on a non-ODbL allowlist. The
+  gate that already checks field *names* now also checks where a coordinate
+  came from.
+
+Nothing had been built against the old reasoning when this was caught, which is
+the only reason it was cheap.
 
 ### 3.3 The engine takes no position on what a marker means
 
@@ -254,11 +281,24 @@ original, consistent, Apache-2.0 library of desks, chairs, partitions, screens,
 doors, lighting rigs, floor and wall materials. Built once, used by every
 Lumbridge world and by anyone else who wants one.
 
-Interiors share the engine's projection, camera and render loop, and swap the
-city layer for a floorplan layer. Same `Marker` type — a desk with a person at
-it is a marker with a different `colorKey`. The city view and the office view
-are the outside and the inside of one world, and moving between them is a camera
-transition, not a different application.
+Interiors reuse the engine's renderer, camera machinery and render loop, and
+swap the city layer for a floorplan layer. The city view and the office view are
+the outside and the inside of one world, and moving between them is a scene swap
+rather than a different application.
+
+Two claims that stood here earlier were wrong, and CONTRACT.md carries the
+resolutions:
+
+- **They do not share a `THREE.Scene`.** They cannot. San Francisco's `latScale`
+  puts one scene unit at ~94 m with 3.6× vertical exaggeration; an office renders
+  at 1 unit = 1 m. There are two scenes over one renderer, and the city scene is
+  *retained and paused* when you step inside rather than disposed — rebuilding
+  its 336,864-point heightfield costs about a second on the way back out.
+- **A person at a desk is not a `Marker`.** A marker is geographic — it has a
+  lat/lng. Presence binds to a **seat id** and never to a coordinate, which is
+  what lets the office geometry be public and open-source while who is sitting
+  in `eng-04` stays private data behind an API. Same shape as the marker rule,
+  one level in.
 
 Reference point: the per-office spatial products in this space (Simile and
 friends) are the shape to aim at. The difference Spaces is going for is that this