Implement control pass: focus cone, action wheel, named inputs, boot fixes

- Venue-correct access artifacts (AccessLoadout) and screened-aware verify
- Cone focus on NPC heads with billboarded ring + display name (ADR-0008)
- Action wheel with de-escalation-first slices (ADR-0009); Esc/RMB cancel
- Procedural NPC face/hair/neck/shoes (ADR-0010); named input actions
- Fix GameManager parse error (radial typed as ActionRadial)
- Fix first-person camera height and guard spawning inside the building
- Move building volume back so the door/awning/marquee are visible
- Pull the event scheduler once per simulated second; cap live NPCs
- Regenerate README screenshots; update TODO/DONE/MEMORY/README; 77 tests

Adds src/test/smoke_focus_radial.gd for the windowed focus/radial smoke.

TODO.md

@@ -1,76 +1,25 @@
 # TODO
 
-Checked against `PLAN.md`, ADRs 0001–0010, `README.md`, `DONE.md`, and `src/` (Godot 4.3
-prototype, release **v0.2.1**, 57 headless tests). Do the control pass first; it unblocks
-everything that uses focus or verbs.
+Godot 4.3 prototype. Release **v0.2.1** is live on the host. The working tree (uncommitted)
+has the access-loadout fix and the ADR-0007–0010 control pass; headless suite **77/77** and a
+windowed focus/radial smoke pass.
 
 Host `REQUIRE_SIGNIN_VIEW` stays deferred.
 
-## Player control, focus ring, and radial action menu
+## World and presentation follow-ups (found during the control smoke)
 
-Design: `PLAN.md` → "Player Control, Focus, and Action Menu" and ADRs 0007–0010.
-
-### Locomotion
-
-- [ ] Stop stealing WASD: wand off `W` (wheel + optional `C`); allow/deny `A`/`D` only while
-      inspect/wand is open; polite direction off `Q` as a required bind.
-- [ ] Accel/decel on walk; gravity only when airborne; `floor_snap_length` for the steps.
-- [ ] Mouse look only while captured and no modal UI is open. Freeze walk+look while the radial
-      (and inspect/wand opened from it) is up. Recapture on close.
-- [ ] `Esc` closes the top modal first; with nothing open it still toggles mouse capture.
-
-### Focus and head ring
-
-- [ ] Replace the 8 m hairline ray as the primary picker with a focus cone (range ~10 m, head
-      inside a ~90 px / 10° circle around the crosshair; closest to center wins; occluded heads
-      skipped). Keep `Tab` as the 12 m cycle.
-- [ ] Small grace so walk-bob does not drop focus.
-- [ ] Billboarded ring on the focused avatar `Head`; gold idle, brighter while the radial is open;
-      one at a time. Optional `display_name` under the ring. No internal type name in the world.
-- [ ] Add a small screen-center crosshair so the focus circle has a visible origin.
-
-### Radial HUD
-
-- [ ] New `src/game/ui/action_radial.gd` doughnut: open on LMB or `Space` when someone is focused.
-      Opening click does not pick a slice. Slices (top, clockwise, de-escalation first): raise
-      hand, point, head shake, polite direction, inspect, wand (grey if no wand), warning, block,
-      radio assist. Emergency stays on `R` only.
-- [ ] Highlight by mouse angle, or `A`/`D` / arrows. Click slice or `Space` confirms. `Esc` / RMB
-      closes with no action and no recorder event.
-- [ ] Inspect / wand / radio slices close the wheel then open the existing panels. Freeze until
-      that panel closes.
-- [ ] Number keys `1`–`6` may remain as closed-menu shortcuts; they must not fire while the wheel
-      is open.
-
-### NPC display
-
-- [ ] Procedural rig: neck, shoes, hair cap from seed, two eye spheres so the head has a front.
-      Keep props, height variation, walk bob, notice-head-turn. Collision capsule matches height.
-      Named `Head` node stays the attach point.
-
-### Input, copy, tests
-
-- [ ] Update `project.godot` input map (`action_menu`, `confirm`, `cancel` includes RMB, wand on
-      `C`). Update `hud.controls` and the README table + smoke checklist.
-- [ ] Headless tests `src/test/tests/test_focus_and_radial.gd`: cone picks the centered head;
-      highlight wrap; cancel writes no recorder event; `W` does not open wand.
-
-## Access artifacts actually match the venue
-
-`GameManager._artifacts_for` maps `NpcType` → a wristband or free `RECOGNITION`. Joke Shop
-events set `override_access` `{has_ticket, has_id}` and nobody reads it, so club guests inspect
-as "recognized staff" instead of ID/ticket. Studio counterfeit/follow events have the same hole.
-
-- [ ] Build artifacts from the event (`override_access`, carried items) and the venue policy,
-      not from `NpcType` alone.
-- [ ] Joke Shop: valid ID+ticket, ID without ticket, expired/mismatched/missing ID, no ID when
-      required. Recognition must not auto-grant on every `AUTHORIZED_GUEST`.
-- [ ] Give some guests `carried_items` (keys / belt / phone / prohibited) so wand alerts are not
-      always clear.
-- [ ] Studio: counterfeit wristband/credential and "follow authorized guest" use the scripted
-      event data, not the generic type map.
-- [ ] Headless tests: Joke Shop `guest_no_id` is not granted by recognition; `guest_valid`
-      grants only with ID+ticket; wand venues still require `controller.screened`.
+- [ ] The skyline backdrop was removed: `assets/textures/ai/game_ready/skyline.png` has an
+      opaque black background, so the planes rendered as black slabs with window dots. Re-add
+      the backdrop only with a transparent asset or a keyed shader.
+- [ ] Guard settles ~0.5 m above the ground after spawning on the landing. Check the capsule
+      offset and the spawn `y`, and verify eye height while walking the steps.
+- [ ] Steps and the landing are visual-only (no collider). The guard walks through them; add
+      simple step colliders or restage the landing so it does not intersect the walk path.
+- [ ] Marquee text (`STEP LINE`) is tiny from the sidewalk. Scale the Label3D up.
+- [ ] Focus ring and name tag are small at 2–3 m. Consider a larger torus / font after a
+      real playtest.
+- [ ] NPC crowd cap (`MAX_LIVE_NPCS`) silently drops routine traffic at 16. Add a short
+      despawn/lifetime for ordinary guests so the entrance does not fill up with standers.
 
 ## Session shell
 
@@ -85,11 +34,13 @@ The game boots into a live 900 s shift. `Save` declares `settings.json` and neve
 - [ ] Shift review "Run another shift" returns to the venue menu, not a silent restart of the
       same scenario.
 
-## Remaining PLAN verbs (after the radial exists)
+## Remaining PLAN verbs (radial exists)
 
-- [ ] Eye contact as a Level 1 action (PLAN / glossary). Distinct from raise-hand.
+- [ ] Eye contact as a Level 1 action (PLAN / glossary). Distinct from raise-hand. Add a
+      radial slice if it ships.
 - [ ] "I recognize this person" is a player decision recorded as evidence, not a pre-attached
-      artifact on every staff/guest type.
+      artifact on every staff/guest type. Staff still auto-recognize when `override_access` is
+      empty (`AccessLoadout`).
 - [ ] Formal warning can activate the body-camera / security-light flag (PLAN Level 2). Overlay
       is currently always on; toggling should write an incident event.
 - [ ] Blocking stations the guard between the person and the door (PLAN Level 3). Today it only
@@ -122,10 +73,11 @@ wants evacuation, a closed street, and an investigation when the call was unjust
 
 ## NPC theater
 
-Intents `sit` / `photo` / `film` / `perform` already pick waypoints. Bodies still idle-stand.
+Intents `sit` / `photo` / `film` / `perform` already pick waypoints. ADR-0010 rig (face/hair)
+is in the working tree. Bodies still idle-stand at those spots.
 
 - [ ] Sit pose at `steps_end`. Photo: brief raise of the influencer/tourist prop. Performer
-      stays put and plays the hat/sign. After the ADR-0010 rig pass, not before.
+      stays put and plays the hat/sign.
 
 ## Audio
 
@@ -151,12 +103,11 @@ Intents `sit` / `photo` / `film` / `perform` already pick waypoints. Bodies stil
 
 ## Documentation drift
 
-- [ ] README Development Status: test count is **57**, not 52. "Not yet implemented" should
-      match this file (control pass, artifact wiring, session shell, replay, crowd presentation).
+- [x] README controls table, smoke checklist, test count, and implemented/not-yet lists
+      refreshed for the control pass (77 tests).
 - [ ] `PLAN.md` Tech Stack / Planned Commands still say GUT and GitHub Actions; the project
       uses `src/test/test_runner.gd` and `.gitea/workflows/build.yml`.
-- [ ] MEMORY: drop "door_staff_lines not surfaced" (they log through `GameManager`) and the
-      obsolete "prototype defaults to 300 s" decision.
+- [x] MEMORY: door_staff_lines log through `GameManager`; 300 s default removed.
 
 ## Distribution follow-up (host config, deferred)
 
@@ -164,15 +115,10 @@ Verified via API+host credentials (2026-10-31):
 
 - [x] Repo is **public** (`private:false`) and account has admin rights.
 - [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
-      AppImage) — the two installers were missing after CI publish (script uploaded only the
-      portables); `tools/publish_release.sh` fixed to include them and re-uploaded via API.
+      AppImage).
 - [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
-      anonymous browsing/downloads redirect to login (API-confirmed repo is public; this is a
-      server `app.ini` setting, not an API or repo option).
-      Advised path for the host admin: set `REQUIRE_SIGNIN_VIEW = false` in `app.ini` under
-      `[service]`, restart Gitea, then verify `curl -sI https://git.allucanget.biz/zwitschi/security-game/releases/tag/v0.2.1`
-      returns 200 (not a login redirect) and an anonymous asset download succeeds. Alternative:
-      mirror downloads (Itch.io / GitHub Releases) for anonymous users.
+      anonymous browsing/downloads redirect to login. Host admin: `REQUIRE_SIGNIN_VIEW = false`
+      under `[service]` in `app.ini`, restart Gitea. Alternative: mirror downloads.
 
 ## Open Polish
 
@@ -182,4 +128,3 @@ Verified via API+host credentials (2026-10-31):
 
 - [ ] IDE/editor-based GUT integration. Until then the custom headless runner stays.
 - [ ] Optional later: author venues as `.tres` resources instead of `ScenarioFactory` functions.
-      Not required for the control pass.