fix: close California play and asset acceptance gaps

BUILD_PLAN.md

@@ -88,7 +88,8 @@ Status: **implemented and integrated**. City actors and office walkers share the
 same profile-derived appearance and journey identity; anonymous visitors change
 from crow outdoors to dog indoors, while signed-in members remain humanoid.
 
-- First-/third-person walker against the existing `Plan.blocked` wall segments.
+- Third-person walker against the existing `Plan.blocked` wall segments. A
+  first-person office camera is not implemented or required for this release.
 - Door traversal and city ↔ office identity handoff.
 - Customizable procedural humanoid for signed-in members.
 - Anonymous office visitor is a dog; anonymous Tera visitor is a crow.
@@ -100,23 +101,29 @@ soak produces no stuck or out-of-bounds actor.
 
 ## M4 — authoritative multiplayer
 
-Status: **core hosted actor, vehicle, and aircraft presence is implemented**.
+Status: **core hosted actor, vehicle, and aircraft presence is implemented and
+covered by deterministic client/service tests; live two-browser acceptance is
+still an operator QA gate**.
 The service uses short-lived rotating grants, exact interest cells, bounded
 10 Hz publishing, strict motion validation, reconnect snapshots, and aggregate-
 only presence UI. Deterministic two-client and bounded-service acceptance tests
 cover convergence, late join, cell isolation, ownership, revocation, cleanup,
 and speed-hack rejection.
 
-- Dedicated realtime session service; do not merge it into the control plane.
+- Dedicated in-memory realtime module inside the optional Tera Fastify API;
+  game-state and media signaling remain separate services and protocols.
 - Server-authoritative actor/vehicle poses, input validation, interpolation,
   reconnect, and interest zones keyed by Tera cell / Office / Floor / Room.
-- `lumbridgecorp` issues short-lived launch grants and revalidates membership.
+- The Tera API issues short-lived rotating session grants after the configured
+  deployment auth adapter resolves a signed-in subject.
 - Delta snapshots around 10–15 Hz for nearby dynamic actors; media never rides
   on this socket.
 
-Exit gate: two browsers converge within the declared latency; reconnect restores
-the right cell; revocation ejects promptly; malformed and speed-hack state is
-rejected; selected cell concurrency passes a repeatable load test.
+Automated gate: two logical clients converge; reconnect restores the right cell;
+revocation ejects promptly; malformed and speed-hack state is rejected; bounded
+service soak/capacity tests pass. A real two-browser, two-network convergence and
+revocation smoke remains required before calling a particular hosted deployment
+production-ready.
 
 ## M5 — profile and webcam faces
 
@@ -129,19 +136,24 @@ is torn down on Stop, track end, revocation, or page exit.
 - Generated profile face is the default.
 - Webcam face is opt-in and ephemeral: explicit contextual permission, active
   indicator, one-click stop, no recording/storage by default.
-- Server-enforced visibility capabilities; unauthorized clients never receive
-  the private object or track.
+- Webcam pixels are local to the current browser and are never placed on the
+  realtime or office-screen signaling paths. Remote webcam-face publication has
+  no implementation in this release.
 
-Exit gate: revocation and tab close stop every track; anonymous/unapproved peers
-cannot subscribe; the full product works without a camera.
+Exit gate: Stop, permission cancellation, track end, membership revocation and
+`pagehide` stop every app-owned track; anonymous users receive no camera control;
+the full product works without a camera. There is no webcam subscription API for
+an unauthorized peer to reach.
 
 ## M6 — office media surfaces
 
-Status: **implemented and integrated for peer-to-peer hosted sharing**. Authored
+Status: **implemented and integrated for bounded peer-to-peer hosted sharing at
+the application layer; internet-grade relay deployment is not enabled**. Authored
 Three.js monitors remain dark until an authorized viewer explicitly opts in;
 presenters choose a tab/window through the browser prompt and have an immediate
-kill switch. Signaling grants, TURN grants, video textures, late join, reconnect,
-and revoke lifecycle are bounded and tested. Presenter encoding defaults to
+kill switch. Signaling grants, conditional TURN credential issuance, video
+textures, late join, reconnect, and revoke lifecycle are bounded and tested.
+Presenter encoding defaults to
 1280×720 at 15 fps and 1.5 Mbps with capability-safe browser fallback.
 
 - `MediaSurface` records identify office/room/screen, ACL, source, and state.
@@ -152,7 +164,12 @@ and revoke lifecycle are bounded and tested. Presenter encoding defaults to
   presenter kill switch, late join and reconnect.
 
 Exit gate: no unauthorized subscription; revoke ends tracks and disposes GPU
-textures; bandwidth adaptation and safe public placeholders work.
+textures; bandwidth adaptation and safe public placeholders work. The current
+server authorization boundary is a signed-in deployment member, not tenant or
+office membership. Tenant-isolated use requires an authoritative office-
+membership provider. Public TURN remains disabled until the operator completes
+the relay-only, cross-network, firewall, certificate, quota and revocation
+acceptance plan in `deploy/coturn/README.md`.
 
 ## M7 — playable aircraft
 
@@ -161,9 +178,8 @@ procedural electric V-tail has deterministic assisted/manual control, chase
 camera, California bounds, and an authoritative geographic wire adapter; remote
 clients render its bank, control surfaces, and fan phase from validated state.
 
-Keep today's aircraft ambient until vehicle, actor, camera, and network
-abstractions are proven. A later `PlayableAircraft` reuses flight-source data for
-the world but owns a separate controller and authority model.
+Ambient ADS-B rendering remains a separate source and authority path from the
+playable aircraft controller.
 
 Exit gate: route/altitude bounds, camera and control handoff, multiplayer
 validation, and no regression to ambient live ADS-B rendering.
@@ -183,27 +199,31 @@ budgets are not raised.
 
 - Named benchmark scenes: p95 frame at or below 16.7 ms desktop and 33.3 ms on
   the selected supported mobile tier.
-- Hard budgets per scale for resident cells, triangles, draw calls, dynamic
-  actors, GPU memory, and media textures.
+- Enforced browser budgets currently cover p95 frame interval, draw calls and
+  triangles. Resident-cell, dynamic-actor, GPU-memory and live-media-texture
+  budgets remain future instrumentation and are not release claims.
 - Fixed simulation tick separated from rendering; instancing, LOD, pooling,
   frustum/distance culling, and explicit resource disposal.
 - Degrade shadows, traffic density, and far detail before input, access control,
   identity, or privacy enforcement.
 
-## Immediate parallel build
+## Release boundary and operator gates
 
-The California driving vertical slice now proves the transport, vehicle,
-controller, input, camera, and responsive UI contracts. Continue in these lanes:
+M0–M7 describe the repository implementation, not an assertion that every
+optional hosted facility is enabled on every deployment. The static/public
+California and Office experience, solo actors/vehicles/aircraft, procedural art,
+and local media placeholders remain the release baseline.
 
-1. **World:** corridor cell streaming, origin rebasing, city/office destination
-   transitions, and deterministic route-completion scenarios.
-2. **Office:** integrate the walker with first-/third-person cameras, doors,
-   actor possession, and identity-preserving city ↔ office transitions.
-3. **Assets:** add driver-view interior hints and animation/state adapters for
-   the existing humanoid, dog, and crow rigs; keep the code-only asset pipeline.
-4. **Platform:** define versioned launch-grant, session, interest-zone, actor,
-   vehicle, and media-capability schemas plus their threat model—without coupling
-   the renderer to a hosted service.
-5. **Quality:** add repeatable frame-time/draw-call budgets, screenshot baselines,
-   long-route and office soak tests, asset-manifest CI, and cross-browser input
-   coverage.
+Before enabling hosted tenant use or advertising internet-grade screen sharing:
+
+1. Provide authoritative tenant/office membership; current realtime/media auth
+   proves only deployment membership.
+2. Complete a real two-browser/two-network realtime and media acceptance run,
+   including revocation and reconnect.
+3. Keep TURN ports and `TERA_ICE_URLS`/`TERA_TURN_SHARED_SECRET` disabled until
+   every mandatory gate in `deploy/coturn/README.md` passes.
+4. Apply and verify the documented CSP and Permissions-Policy on both entry
+   hosts. Browser capture permission is contextual and does not replace the
+   application's explicit opt-in and visible Stop controls.
+5. Treat narrower CSP allowlists, GPU/media memory budgets and Firefox/WebKit
+   browser automation as hardening/follow-up work, not already-passed gates.