spec 2: camera pivot — body-fixed navigation behind the pose seam

docs/BACKLOG.md

@@ -66,6 +66,13 @@ Items with a **→ details** link have a full write-up in [`backlog/`](backlog/)
 - [ ] **Fades pop instead of ramping after the render loop idles** `ready` — `fadeRegistry.fadeTo` stamps the ramp's start from the stale last-_rendered_-frame time, not a live clock. → [details](backlog/2026-08-20-fade-pop-after-idle.md)
 - [ ] **Liveness guards accept `undefined`; `NaN` alpha class in fixtures** `ready` — `zoneOfAvoidanceLiveness.ts`'s `=== null` guard lets `undefined` slip through, and `focusBlend`-omitting fixtures produce silent `NaN` alphas. → [details](backlog/2026-08-20-liveness-undefined-guards.md)
 - [ ] **`createTieredScfdFetcher` factory** `ready` — the Edenhofer dust fetcher will be the third hand-copied tiered-SCFD fetcher (after `mcpmFetcher` and polyphorm's); collapse the three into one `createTieredScfdFetcher(baseName)` factory on next touch.
+- [ ] **Body-arm entry doesn't adopt the arriving pose's tilt** `deferred` — disengage can pop up to 37°. → [details](backlog/2026-09-11-camera-arm-entry-adopts-arriving-tilt.md)
+- [ ] **World-arm wheel burst has no per-frame turn clamp** `awaiting-decision` — a 20-notch burst can roll 115° in one frame. → [details](backlog/2026-09-11-camera-absolute-arm-wheel-burst-unclamped.md)
+- [ ] **`deriveBodyStates`' key type is a pre-existing lie (14 casts)** `needs-design` — callers cast to an unrelated `BodyId` union. → [details](backlog/2026-09-11-derive-body-states-scene-body-id-type.md)
+- [ ] **Frame-tagged clip keyframes have no per-endpoint authoring validation** `needs-design` — a straddling channel tween silently freezes. → [details](backlog/2026-09-11-clip-per-endpoint-tag-authoring-validation.md)
+- [ ] **f32 half-ulp sightline nudge at the body-arm flip** `needs-verification` — ~4 mas, in two narrow `h/R` windows. → [details](backlog/2026-09-11-camera-f32-half-ulp-sightline-nudge-at-arm-flip.md)
+- [ ] **`bodyLikeFraming` ⇄ `focusFraming` import cycle** `ready` — a type-only back-edge; extract the type. → [details](backlog/2026-09-11-framing-import-cycle-bodyLikeFraming-focusFraming.md)
+- [ ] **Camera radar residuals: wake vote, channel expiry, authoredOverride** `ready` — three hand-restated facts from the wave-end radar. → [details](backlog/2026-09-11-camera-radar-residuals-h3-m4-m5.md)
 
 ## Rendering
 
@@ -179,6 +186,8 @@ Items with a **→ details** link have a full write-up in [`backlog/`](backlog/)
 - [ ] **Earth caption stamp out-picks occluders** `ready` — the forced-band 18 px Earth pick point punches through a transiting Moon. → [details](backlog/2026-07-29-earth-caption-stamp-outpicks-occluders.md)
 - [ ] **Touch picking selects the wrong galaxy** `needs-design` — the pick pad is in device px, so the clickable disc halves on retina/phone. → [details](backlog/2026-07-29-touch-pick-accuracy.md)
 - [ ] **Windows touchscreen pinch-zoom dead** `needs-repro` — works on mobile; gesture code is platform-uniform PointerEvents, so event delivery on Windows is the suspect; needs an on-device event log. → [details](backlog/2026-08-16-windows-touchscreen-pinch-zoom.md)
+- [ ] **Camera smooth wheel zoom + flick coast** `awaiting-decision` — Google Maps / Cesium feel via synthetic `InputStep`s in the aggregator; revises grill Q8 (no inertia), shape pre-ruled. Follow-up to #647. → [details](backlog/2026-09-09-camera-smooth-zoom-and-flick-coast.md)
+- [ ] **Wheel notch routed by last frame's winner** `needs-design` — the replay routes a notch before the frame has picked its winner; four defects follow. → [details](backlog/2026-09-10-wheel-notch-route-by-last-winner.md)
 - [ ] **Autorotate + mouse-move jitter** `needs-repro` — intermittent frame jitter seen on `refactor/debug-derivation`, diff-clean per investigation; falsify against base commit from a second worktree. → [details](backlog/2026-08-20-autorotate-mousemove-jitter.md)
 - [ ] **StatusBar mobile reflow** `ready` — reflow the StatusBar for narrow viewports (no media queries today). The InfoCard bottom-sheet + SettingsPanel collapse-launcher already shipped.
 - [ ] **SettingsPanel polish** `needs-design` — visual cleanup + section re-ordering + per-section icons; 2.3k lines of hand-coded text-only rows today. → [details](backlog/2026-07-22-settings-panel-polish.md)

docs/backlog/2026-09-09-camera-smooth-zoom-and-flick-coast.md

@@ -0,0 +1,85 @@
+# Camera: smooth wheel zoom + flick coast (Google Maps / Cesium feel)
+
+**Raised:** 2026-09-09, user, on the spec-2 camera-pivot branch (PR #647).
+Investigated, not built. Follow-up PR after #647 lands.
+
+## Ask
+
+Google Maps and Cesium animate a wheel notch instead of jumping, and a short
+drag that ends fast coasts a little after release. skymap does neither: a
+notch is applied whole in the frame it fired, and release stops the camera dead.
+
+## Ruling context
+
+Grill Q8 (`docs/grill-sessions/globe-camera-pivot-2026-08-24.md`) ruled **no
+inertia in the first landing**, and pre-ruled the only acceptable later shape:
+Cesium's flick-only synthetic replay, no persistent velocity, cross-cancel on
+any new input, replayed in the body-fixed frame. Building this is a Q8
+revision and needs the user's word; the shape is already fixed.
+
+## Why it is cheap here
+
+Every camera motion is an `InputStep` (`src/@types/camera/InputStep.d.ts`)
+that `inputAggregator` (`src/services/engine/subsystems/inputAggregator.ts`)
+collapses per frame and `replayInput` (`src/services/engine/camera/replayInput.ts`)
+replays through one path — the surface controller in a body arm, the world-arm
+fold otherwise. `gestureEnd` is the single commit site: it bakes the register,
+drops the surface latch, and clears `dragging`. Nothing downstream can tell a
+synthesized step from a real one. Both features therefore live in the
+aggregator, with `nowMs` passed into `drain()`. No change to the controller,
+the drivers, the fold, or the authored/displayed two-box.
+
+## A. Smooth zoom
+
+Today: `factor = e^(deltaY·k)` per notch, applied whole; notches in one frame
+multiply (`foldZoom`).
+
+Shape: the aggregator keeps a remaining log-factor plus the latest cursor
+pixel, and each frame emits a synthetic zoom step releasing a fraction of it
+(exponential approach, ~150–250 ms, retargeting as notches arrive). Cursor
+anchoring, `anchoredZoomStep`, the roll ride, the tilt mapping and the floor
+come for free.
+
+Two consequences to decide up front:
+
+- The orientation settle's decay is defined **per input step**. Ten small
+  steps per notch decay unauthored deviation faster than one big step. Make
+  the step law "per unit of log-zoom" in the settle un-braid rather than
+  accept a silent feel change.
+- At-rest zoom commits to the store per step. Treat the ease as a gesture
+  (`duringGesture: true` + a synthetic `gestureEnd`) so it commits once.
+
+Trackpads already deliver continuous small deltas (`WHEEL_GESTURE_GAP_MS`
+handles their momentum bursts); keep the ease short or they feel laggy.
+
+Estimate: 40–60 lines + two tests (retargeting mid-ease; single commit).
+
+## B. Flick coast
+
+Shape (Cesium `maintainInertia` / `decay`, see
+`docs/research/2026-08-24-camera-pivot/cesium-notes.md` §2.9): on release
+after a hold under ~400 ms, hold the last drag motion and emit a synthetic
+drag step per frame with the motion scaled by `exp(−(1−c)·25·t)`, c ≈ 0.9;
+stop under 0.5 px; **only then** emit `gestureEnd`. Deferring `gestureEnd`
+keeps the surface latch and the frozen anchor alive and the orbit-drag driver
+rendering the register. Any pointer or wheel event cancels the coast (the
+aggregator sees it first). Body-fixed replay falls out of the anchored drag
+rotation re-solving the ground under the synthetic cursor.
+
+Pan and orbit modes only. Cesium gives tilt and look no inertia, and a
+coasting tilt would keep writing the remembered-tilt memory (ruling 12).
+
+Estimate: 80–100 lines + three tests (flick vs hold threshold; decay stops;
+cross-cancel).
+
+## Shared hook
+
+The same per-frame synthetic-step emitter would host the gesture-end settle
+tween proposed for the jarring tilt-up + zoom-out (SDD ledger, 2026-09-03
+ideas list, item 1).
+
+## Sequencing
+
+After the settle un-braid on #647 lands, so the per-step vs per-unit decay
+question is answered in one place. Feel constants (ease τ, decay c, flick
+threshold) go in `src/data/camera/`.

docs/backlog/2026-09-10-wheel-notch-route-by-last-winner.md

@@ -0,0 +1,103 @@
+# Camera: a wheel notch is routed by LAST frame's winner
+
+**Raised:** 2026-09-10, during PR #647's final review. User ruled: later, own change.
+
+Two pre-existing defects with one cause, and it is stage order: the replay runs
+BEFORE the winner is picked, so `replayInput` has nothing to route a notch by
+except `cameraRuntime.register.winner` — last frame's answer
+(`src/services/engine/camera/replayInput.ts:215`, `:242`). A third case (c) has
+the same shape one stage later: the replay routes by the STORED arm, not the arm
+the fold resolves this frame.
+
+## (a) The notch on a follow→spin hand-off frame is dropped
+
+On the exact frame `followApproach` saturates and hands off to `autoRotate`, the
+notch resolves into follow memory (`isFollowDriverId(winnerLastFrame)`) that the
+winning spin never adopts. Pinned by the driver golden trace at
+`tests/services/engine/frame/driverGoldenTrace.test.ts:189` — "This notch lands on
+the hand-off frame and is DROPPED (routed by last frame's winner into follow memory
+the spin never adopts)" — the marker added by `e0985c5d4`.
+
+Splitting the follow driver into `followApproach`/`followHold` gave every spin-on
+focus a hand-off frame, so this went from rare to once per focus.
+
+## (b) The notch on a spin-OFF frame zooms a frozen base
+
+`spin: { owns: winnerLastFrame === 'autoRotate', … }` still reads true on the frame
+autoRotate goes off, so the notch is applied to the pre-spin `base` the spin froze,
+and `commitOnEdge` (`src/services/engine/camera/commitOnEdge.ts`) bakes that stale
+pose on the same edge.
+
+## (c) The notch on a fly-to's pre-fold frame takes the other zoom
+
+Raised by T19's review (2026-09-10). `routeToSurface` gates on `camera.base.frame`
+(`replayInput.ts:104-106`), and the fly-to saga now commits a body arm from
+anywhere. Launched from OUTSIDE the band, `base` is a body arm for the one frame
+before `projectFramePose` disengages it, so an at-rest notch in that frame runs
+`surfaceStep`/`anchoredZoomStep` (and commits its own body arm) where the orbit
+zoom was due. Same when the body arm names a body other than the focused one
+(`regimeArmFor` rejects it). One notch's scaling in a ≤ 16 ms window, no pose
+discontinuity; the fix is routing on the RESOLVED regime, not the stored one —
+gating the saga on the band would put the band predicate back in the instrument
+(spec §9).
+
+## Fix shape
+
+Route the notch by THIS frame's winner. The routing stage is the replay, so the
+winner has to be known above it — and today the pick cannot simply move up, because
+both of its arguments are replay OUTPUTS:
+
+- `pickWinner(drivers, rootState, approachDone)` reads the POST-replay EFFECTIVE
+  `rootState` — the snapshot with the replay's own actions folded through the camera
+  reducer (`src/services/engine/camera/stepCameraRuntime.ts:89-95`). That is
+  load-bearing, not incidental: the drivers must see this frame's commits, `endDrag`
+  above all, or `orbitDrag` wins one frame too long.
+- `approachDone` is `drained.follow.saturated` (`stepCameraRuntime.ts:100-101`) —
+  the replay's follow memory.
+
+Not a blocker, contrary to first appearances: the epochs. `pickWinner` takes none
+(`src/services/engine/camera/cameraDrivers.ts:38-42`), and `advanceEpochs` already
+runs AFTER the pick, consuming `winner.epoch` (`stepCameraRuntime.ts:104-112`).
+
+Two directions, neither worked through:
+
+- Pick from the PRE-replay snapshot and re-establish the `endDrag` guarantee some
+  other way — the gesture-end edge is present in the drained steps themselves,
+  before the replay folds it.
+- Split the pick in two: a ROUTE decision above the replay, needing only the
+  pre-replay intent plus last frame's follow memory, with the existing post-replay
+  pick kept for the pose. Whether a correct route can be decided on that much is
+  the open question.
+
+Either way, re-record `tests/fixtures/camera/driverGoldenTrace.json` with a
+parse-compared cell diff in the commit body, and drop the marker at the leg.
+
+## (d) The spin phase the notch zooms off is advanced twice, under two rules
+
+Raised by the wave-end entanglement radar (2026-09-10, finding M3). Same family:
+the replay needs a fact the frame has not resolved yet, so it resolves a private
+copy.
+
+`replayInput.ts:236-239` advances the autoRotate epoch locally —
+`advanceEpoch(ctx.autoRotateEpoch, active ? camera.base : null, nowMs)` — reads
+`elapsedMs` off it for `applyWheelZoom`'s `spinElapsedMs`, and throws the row
+away (handing it to `advanceEpochs` would keep a fold-time reset the frame's own
+rule declines). The frame's advance
+(`stepCameraRuntime.ts:106` → `cameraEpochs.ts:59-67`) replays `prev.ref` — a
+guaranteed no-op — on every frame the winner is not `autoRotate`.
+
+The two disagree by construction on any frame some other driver wins while
+auto-rotate is on: the local advance re-bases on a changed `camera.base` (a
+commit from earlier in the same drain) where the frame's does nothing. On that
+frame `applyWheelZoom` zooms off a spin position the renderer never showed, and
+the commit bakes it — a yaw pop on a wheel notch during auto-rotate, which is
+the bug `applyWheelZoom`'s header says it fixed, re-entered through the other
+door.
+
+Fix shape: make the spin phase a VALUE rather than a place read twice — resolve
+`(base ref, nowMs) → spinElapsedMs` once, above the replay, and let both the
+replay and `advanceEpochs` take it. The equivalent: advance the real row before
+the replay and let the winner gate only the RESET, never the read. Either
+removes the discard, and with it the comment at `replayInput.ts:236-237` that
+exists to teach the discard. Golden-trace re-record likely — this moves a phase
+the `driverGoldenTrace` fixtures sample.

docs/backlog/2026-09-11-camera-absolute-arm-wheel-burst-unclamped.md

@@ -0,0 +1,56 @@
+# World-arm wheel burst has no per-frame turn clamp
+
+**Raised:** 2026-09-10/11, F1 fix rounds on PR #647 (`f1-fix1-report.md` concern
+1; `f1-decay-review.md` finding F2). User ruled: backlog, not this PR.
+
+The body arm's zoom settle prices its per-notch turn on `u = |ln
+spentZoomFactor(factor)|`, where `spentZoomFactor` (`src/utils/camera/spentZoomFactor.ts`)
+folds a frame's wheel events through a `[0.5, 2]` altitude-step clamp before
+the turn is computed — a burst can never buy more settle than it bought zoom.
+The world (absolute) arm has no equivalent clamp: `u` is the raw folded
+`logZoom`, unbounded.
+
+## Where
+
+- `src/data/camera/orientDecay.ts:7-8` still documents the no-whip property
+  ("a reference move beyond `rideBoundRad` in ONE notch is unauthored") — true
+  of the ride, not of the decay.
+- `src/utils/camera/orientStepRad.ts:12` caps at `capRadPerLogZoom · u` with no
+  ceiling on `u` itself; `src/services/engine/camera/levelledPose.ts:32` same.
+- `src/services/engine/camera/replayInput.ts:161,213` pass the raw folded
+  factor into the world-arm path; nothing clamps it before
+  `frameAlignedRoll`/`orientStepRad` see it.
+- `zoomedDistance.ts:17-35` clamps only at the collision/recession envelope,
+  which does not bound a large in-band burst.
+
+## Measured consequence
+
+`f1-decay-review.md` F2: a 20-event burst that folds to `e²` gives
+`frameAlignedRoll` a `u = 2.0` cap — a 115° one-frame roll, versus the
+pre-change bound of `rideBoundRad + capRad ≈ 0.4` rad. The standing "Δscreen-up
+never exceeds 23° across 16,000 fuzzed notches" guarantee (H4) no longer holds
+on the world arm.
+
+## Why the obvious fix doesn't transfer
+
+The body-arm util (`spentZoomFactor`, an eye-distance ratio) is not reusable
+here: the world arm's zoom factor applies to **altitude above the pivot's
+surface** (`zoomedDistance.ts:17-35`, `distance′ = radiusMpc + (distance −
+radiusMpc)·factor`), not to `distance` itself, and which quantity is right
+depends on `pivot.radiusMpc` — a fact only the caller (`replayInput`, three
+call sites) has. `frameAlignedRoll` cannot derive `u` from its own arguments;
+deriving it correctly needs a pivot-aware `spentDistanceFactor(pre, post,
+pivot)` util threaded from those three sites — a larger artifact than the
+current single threaded parameter, and it was explicitly flagged for a
+controller ruling rather than implemented in the fix round.
+
+## Fix shape
+
+Author `spentDistanceFactor(pre, post, pivot)` (mirrors `zoomedDistance`'s
+altitude-vs-plain-distance branch on `pivot.radiusMpc`), thread it through
+`replayInput`'s three world-arm call sites in place of the raw folded factor,
+and drop the now-redundant `Math.abs(Math.log(step.factor))` duplication
+(`f1-fix1-report.md` §"Not collected"). Re-verify `driverGoldenTrace.json` —
+`f1-fix1-report.md` measured `displayed[6]` moving at the 1e-17 level under the
+naive distance-ratio approach, so the correct pivot-aware form needs its own
+fixture check.

docs/backlog/2026-09-11-camera-arm-entry-adopts-arriving-tilt.md

@@ -0,0 +1,51 @@
+# Body-arm entry doesn't adopt the arriving pose's tilt
+
+**Raised:** 2026-09-10/11, orientation-unbraid design pass on PR #647 (design B7).
+User ruled: backlog, not this PR.
+
+A pose that _arrives_ at the body arm with more tilt than the arm's own mapping
+implies — a fly-to, a clip end, a body switch that wiped the tilt memory — does
+not get adopted into `SurfaceMemory`'s remembered tilt on entry. `display =
+remembered × bodyUpWeight(h/R)` (ruling 12) reads only what got explicitly
+written by a drag or the decay; an arriving pose's actual tilt is not one of
+those writes.
+
+## The symptom
+
+A body-arm disengage that started from an unbacked tilt pops by as much as 37°
+on the frame it hands off. `orientation-unbraid-design.md` §4 B2 and §5 T-G
+(`.superpowers/sdd/2026-09-01-camera-pivot/orientation-unbraid-design.md:405-410,545`)
+name this the standing "unbacked tilt pops at disengage" symptom, present
+before this branch and explicitly _unchanged_, not worsened, by the branch's
+orientation work.
+
+## Second route (drag-authored, near-disengage)
+
+`docs/superpowers/specs/2026-09-01-camera-pivot.md` §6 (lines ~465-479)
+documents a second way to reach the same unbacked state: a tilt drag authors
+display tilt directly, at any altitude; above `zeroHR` `unmappedTiltRad`'s
+`w > 1e-6` guard skips the write back to `remembered`, so the drag-authored
+tilt is unbacked even though it was interactively set. Held at the flip, it
+crosses onto the absolute arm as roll/tilt — "the B7 symptom's second route."
+
+## Why B7 (adopt-on-entry) is not the fix
+
+Design B7 (`orientation-unbraid-design.md:424-428`) considered making arm
+_entry_ adopt the arriving pose's tilt into `remembered`, which would make the
+pop unrepresentable. Rejected for this pass: it clobbers a kept memory
+whenever the world arm was not itself projecting the tilt (focus null,
+`pivotsOnFocusedBody` false) — a case that needs its own ruling on what
+"clobber" should mean before B7 can land safely.
+
+## Readiness note
+
+T22's feel gate (post-branch) attested no visible pop at the shipped tilt-band
+defaults (`0.45`/`0.9`). The defect is real and reachable (both routes above),
+but not observed at current tuning — readiness is `deferred`, not `ready`.
+
+## Fix shape
+
+Rule the "focus null / non-projecting world arm" case first, then let entry
+adopt `remembered := display-implied tilt from the arriving pose` only when
+the world arm was projecting it. Needs a design pass before a plan; not a
+mechanical fix.