Implement control pass: focus cone, action wheel, named inputs, boot fixes

- Venue-correct access artifacts (AccessLoadout) and screened-aware verify
- Cone focus on NPC heads with billboarded ring + display name (ADR-0008)
- Action wheel with de-escalation-first slices (ADR-0009); Esc/RMB cancel
- Procedural NPC face/hair/neck/shoes (ADR-0010); named input actions
- Fix GameManager parse error (radial typed as ActionRadial)
- Fix first-person camera height and guard spawning inside the building
- Move building volume back so the door/awning/marquee are visible
- Pull the event scheduler once per simulated second; cap live NPCs
- Regenerate README screenshots; update TODO/DONE/MEMORY/README; 77 tests

Adds src/test/smoke_focus_radial.gd for the windowed focus/radial smoke.

MEMORY.md

@@ -13,11 +13,41 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Shift length is the scenario's `shift_duration_s` (900 s in all three venues). Tests and the screenshot tool override elapsed time; they do not change the default.
 - RNG: NPC reactions and event scheduling are seedable for deterministic tests.
 
-## Current State
+## Handoff (read this first)
 
-- Next playable pass (planned, not coded): ADR-0007 locomotion/input layers, ADR-0008 cone focus +
-  head ring, ADR-0009 radial action menu, ADR-0010 procedural NPC presentation. Emergency stays on
-  `R`. Wand leaves `W`. Host sign-in follow-up is deferred. PLAN.md has the full pass notes.
+- Repo: `/run/media/system/DATA/Documents/06-games/security-game`. Godot: `~/.local/bin/godot` (4.3.stable).
+  Tests: `godot --headless --path . --script res://src/test/test_runner.gd` → **77/77**.
+  Windowed control smoke: `godot --path . --script res://src/test/smoke_focus_radial.gd` → exit 0.
+- `main` is **7 commits ahead of origin**, all committed locally, **not pushed**. The newest commit
+  is the control pass + boot/spawn fixes (access loadout, focus cone, action wheel, named input
+  actions, NPC rig, camera/building fixes, scheduler rate, NPC cap, screenshots, docs).
+- Nothing is left uncommitted. Ask before pushing if you did not author the earlier commits.
+- Next work, in order: (1) session shell in `TODO.md`; (2) world follow-ups listed at the top of
+  `TODO.md` (guard floats ~0.5 m, step colliders, skyline asset, marquee size); (3) push / release
+  when the user asks.
+- Do not re-open `override_access`. Do not bind wand to `W`. Do not remove the radio easter egg.
+
+## Current State
+- Access artifacts: `src/core/access_loadout.gd` builds from event `override_access` + venue policy.
+  Spawn signal is now `(profile, intent, npc_id, event)`. Recognition is not auto-attached to every
+  guest. `AccessVerifier.verify(..., already_screened=false)` so Joke Shop scoring uses
+  `controller.screened`. Joke Shop/Studio gained `sidewalk`/`steps_end` waypoints. Wand venues roll
+  `carried_items` per spawn (seeded). Tests in `src/test/tests/test_access_loadout.gd`.
+- Wand shortcut is **`C`**, not `W` (`W` is walk). `radio_emergency` input map no longer includes W.
+  `hud.controls` / `hud.screen_first` updated.
+- Control pass (in tree, uncommitted, smoke-tested): cone focus via `src/game/npc_focus.gd`,
+  accel/decel, gravity only airborne, `input_locked` freeze, Esc no longer on the guard.
+  `NpcAvatar` in group `npc`; neck/hair/eyes/shoes; torus head ring + `Label3D` name; `set_focus_visual`.
+  `src/game/ui/action_radial.gd` doughnut (LMB/Space open, A/D/arrows, Space/click confirm, Esc/RMB
+  cancel). Crosshair CanvasLayer. Emergency still `R` only. Number keys 1–6 when the wheel is closed.
+- Named input actions now exist and are used: `action_menu`, `confirm`, `cancel` (Esc + RMB),
+  `inspect` (E), `wand` (C). The old unused `interact` action was removed.
+- Runtime fixes from the smoke: `Head` is +1.6 above the guard root (root sits on the floor); guard
+  spawns in front of the door facing the street; building volume moved to z ∈ [-8,-4] so the door,
+  awning, and marquee are visible; step treads rise toward the door; `ShiftCoordinator` pulls the
+  event scheduler once per simulated second (was every physics frame → >1200 NPCs in seconds);
+  `GameManager.MAX_LIVE_NPCS = 16` caps live avatars; skyline backdrop removed (opaque black asset).
+- Host sign-in follow-up remains deferred. PLAN.md + ADRs 0007–0010 still describe the intended UX.
 - **Release v0.2.1 is LIVE** (2026-10-31): CI run 1110 built the NSIS installer + AppImage
   and published — installers/AppImage are on the releases page. Releasing = bump version → tag → push.
 - NSIS gotchas (validated in a local ubuntu:24.04 docker repro): makensis uses `-D` defines
@@ -39,12 +69,12 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
   public (HTTP 200). Caveat: anonymous **asset downloads** redirect to login on this host
   (host setting — tracked in TODO). Future releases = bump `config/version`, `git tag vX.Y.Z`,
   push. No local token needed.
-- Core simulation, three scenarios, headless tests (**57 passing**), and a first-person prototype with interaction HUD, access inspection, radio (assist + emergency hold-to-confirm), debug overlay, and shift review are implemented and green.
+- Core simulation, three scenarios, v0.2.1 installers/AppImage, first-person prototype (inspect/wand/radio, shift review, Tab targeting, V venue cycle) are on local `main`. Tagged v0.2.1 was 57 tests; this working tree is **74/74**.
 - NPC avatars now walk to per-intent waypoints (`VenueScenario.waypoint_for_intent`): enter/trespass/deliver/arrive → entrance, photo/film/perform/wander/roam → sidewalk, sit → steps_end. `NpcAvatar.setup` takes an explicit `door_position`.
 - Returning-trespasser behavior: `NpcProfile.return_probability` (trespasser 0.6, mental-crisis 0.4, others 0). `NPCController._maybe_schedule_return()` moves a directed-away NPC to `LOITERING_DISTANT`; `tick_return(delta)` fires after 20-60s and transitions back to `APPROACH`. `NpcAvatar._advance_fsm` re-targets the door on return.
 - Perception pass: `NPCController.perceive_guard(distance)` returns `{noticed, band, reaction}` with bands `unaware` (>6m), `aware` (2-6m), `near` (<2m). Near + temperament ≥0.6 → ARGUE, else COMPLY. `GameManager._perception_pass()` feeds real guard distance each physics tick and logs first-time notice.
 - Responder dispatch: `RadioSystem` tracks `pending_calls` and decrements `arrival_delay_s` in `tick`; emits `responder_arrived` when a call's delay elapses. `RadioSystem.responder_outcome(call)` maps danger/weapons → command/restraint/evacuation/arrest. `GameManager._on_responder_arrived` spawns a `RESPONDER` avatar at the entrance and logs the outcome. HUD shows an emergency-radio cooldown label via `_update_radio_cooldown`.
-- Wand screening (Joke Shop): `WandScreener` (new `src/core/wand_screener.gd`) classifies carried items as prohibited (`weapon/knife/gun/blade`) vs false-alarm (`keys/belt/phone/coins/watch/buckle`) vs clear. `NpcProfile.carried_items` holds guest items. `GameManager` binds `W` to `_toggle_wand_screening` and `A`/`D` to `decide_wand`; `decide_access` blocks admission at wand venues until `controller.screened` is true. `VenueScenario.door_staff_lines` holds venue-specific door-staff dialogue (Joke Shop has id/ticket/wand/refusal/prohibited lines).
+- Wand screening (Joke Shop): `WandScreener` classifies carried items as prohibited vs false-alarm vs clear. `NpcProfile.carried_items` is filled at spawn on wand venues. `GameManager` binds **`C`** to `_toggle_wand_screening` and `A`/`D` to `decide_wand` while inspect/wand is open. `decide_access` still blocks admission until `controller.screened` is true, and `verify` now takes that flag. Door-staff lines log through GameManager.
 - Design change (2026-10-31): the selectable dialogue tone-of-voice system was **removed**.
   `Rules.Tone`/`TONE_NAMES`, `NpcProfile.tone_modifiers`, and the tone param on
   `NPCController.roll_reaction/apply_player_action` no longer exist; `NpcProfile.dialogue_lines`
@@ -119,8 +149,20 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 - Persistence tests write into the real `user://shift_results.json` (harmless local pollution of the demo history).
 - macOS export required `rendering/textures/vram_compression/import_etc2_astc=true` in `project.godot` (universal build demands ETC2 ASTC enabled).
 - Joke Shop `door_staff_lines` are logged through `GameManager` (inspect / wand / refuse). They are not a separate dialogue UI.
-- `GameManager._artifacts_for` ignores event `override_access` and maps artifacts by `NpcType`. Joke Shop guests currently inspect as recognized staff. Tracked in TODO "Access artifacts actually match the venue".
+- Access loadout is implemented in the working tree (see Current State); do not re-fix `override_access` as if it were still unread.
 - `Save.SETTINGS_FILE` is declared and unused; no mouse-sensitivity or pause menu yet.
+- Headless suite is **77/77**; the windowed focus/radial smoke passes. Remaining visual follow-ups are at the top of `TODO.md`.
+- Typed spawn signal extra args: handlers must accept the 4th `event: Dictionary` or Godot will not call them (`test_shift_coordinator_runs_a_shift` failed until `_on_spawn` took four args).
+- GDScript inference trap that broke the main scene: a `var` typed as a base class
+  (`radial: CanvasLayer`) exposes script members as `Variant`, so `var x := radial.is_open` is a
+  parse error. Type it as the script type (`ActionRadial`) or annotate the local explicitly.
+  `--check-only --script` cannot see the `Save` autoload; use a real boot (`--quit-after 180`) to
+  verify a full-scene compile.
+- Do not snapshot right after changing a transform in the same frame: `capture_screenshots.gd`
+  needs a state/frame gap or the capture uses the old camera orientation.
+- `EventScheduler` probabilities are per simulated second, not per call. Never poll it per frame.
+- Screenshot staging lives in `src/test/capture_screenshots.gd` (guard at z≈10.5 facing the door).
+  `docs/screenshots/` copies are manual: copy from `user://screenshots/`.
 
 ## Open Questions
 
@@ -130,13 +172,15 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 ## Plan vs code (re-evaluated)
 
-Shipped and tested: simulation core, three venues, 57 headless tests, v0.2.1 installers/AppImage,
-procedural world, HUD inspect/wand/radio, shift review (summary only), Tab targeting, V venue cycle.
+On local `main` (6 commits not on origin): v0.2.1 packages, ADRs 0007–0010, asset pipeline wired to
+`assets/textures/ai/game_ready/`, screenshots refreshed.
 
-Still missing (now in `TODO.md`, control pass first): ADR-0007–0010 input/focus/radial/NPC face;
-venue-correct access artifacts (`override_access` unread); startup/pause/settings; eye contact,
-recognize-as-verb, body-cam toggle, real blocking, request-reason; crowd rubberneck; emergency
-aftermath; body-cam replay timeline; sit/photo/film poses; real crowd audio; a few Joke Shop /
-Studio scripted cases; README test-count drift (says 52).
+Uncommitted: `AccessLoadout`, control pass (cone, ring, radial, NPC face, named input actions),
+and boot/spawn fixes. Headless 77/77; windowed smoke passes. Access-artifact and control-pass
+sections moved to `DONE.md`.
+
+Still in `TODO.md`: world follow-ups (guard float, step colliders, skyline asset, marquee size);
+session shell; leftover PLAN verbs; crowd rubberneck; emergency aftermath; body-cam replay;
+sit/photo/film poses; real crowd audio; Joke Shop/Studio extra events; PLAN.md says GUT/GitHub.
 
 <!-- b64: RWFzdGVyIGVnZzogYSByYXJlIHJhZGlvIHRyYW5zbWlzc2lvbiAiwr9Ew7NuZGUgZXN0w6EgbGEgbW90YT8iIGZpcmVzIHZpYSBHYW1lTWFuYWdlci5fbWF5YmVfcmFkaW9fZWFzdGVyX2VnZyAoMi41JSBjaGFuY2UgYWZ0ZXIgYSBzdWNjZXNzZnVsIHJhZGlvIGNhbGwpLiBTdHJpbmcga2V5IHJhZGlvLmVhc3Rlcl9lZ2cgaW4gY29udGVudC9zdHJpbmdzLmVuLmpzb24uIERvIG5vdCByZW1vdmUu -->