docs(handoff): bitrate diagnosis, four-unit plan, unit 1 landed

Records the 5.1-vs-8 finding as an args defect (no -rc, so NVENC ran VBR) rather
than a machine or ingest limit, the four units that follow, and two new landmines.

Assets/starting-background.jpg stays out of this commit: it is the creator's
replacement art, still awaiting the visual check recorded in the landmines.

HANDOFF.md

@@ -1,38 +1,39 @@
-# HANDOFF — 2026-11-11 (recovery fixes + alert settings; metric cues next)
+# HANDOFF — 2026-11-12 (bitrate correction, 4 units; unit 1 landed)
 
 ## State
 
-- `main`; `b265d42` is the latest pushed commit. Recovery fixes and alert-setting changes are committed
-  locally, verified, and not pushed yet.
+- `main`; `b265d42` is the latest pushed commit. `1e3a4f7` and everything after are local.
 - **Done:** TASK 35 scene-linked audio, TASK 55 disk hygiene, TASK 65 replay clips, TASK 37 defaults/current split.
-- TASK 37: SQLite keeps an immutable default snapshot beside build-stamped current rows; App Settings can
-  restore the staged scene or all scenes, offline only. Webcam identity survives both restore paths.
-- TASK 14·15 mic input gain was closed by creator test (−2.6 dB, works great); slices 16–18 remain.
-- Recovery incident: private test hit step-down on 85% loss; encoder restart reused a broken audio pipe.
-  Step-down now closes/recreates audio in order; recovery notifications/stops marshal to the dispatcher.
-- App Settings now controls slide-out toast position (six left/right × top/center/bottom positions).
-- App Settings can keep all slide-out alerts until clicked/closed; default off preserves existing timers.
-- Verification: **618 tests green, clean build with 0 warnings** (`FAST=1 ./scripts/verify.sh`). Creator test
-  was stable (~5.1 Mbps, 31 fps, 0.2% drop); its log showed no step-down/reconnect event.
-- Steam remains blocked on Valve identity/tax review; no app IDs or store page.
+- Recovery fixes: step-down closes/recreates audio in order; recovery notifications/stops marshal to the dispatcher.
+- App Settings: six toast positions; sticky/click-to-dismiss alerts (off by default preserves timers).
+- **`1e3a4f7`:** `OutputProfile.EntitlementEnforced = false` — Release builds can select 60 fps pre-release,
+  and the licence indicator row is suppressed while nothing is limited. Flip at launch.
+- Creator test was stable (~31 fps, 0.2% drop) but **the stream's own readout averaged ~5.1 Mbps against an
+  @8 target**: the args pass `-b:v/-maxrate/-bufsize` with no `-rc`, so `h264_nvenc` ran its default VBR
+  and undershot. Not a machine limit (1.8 ms render, 0 stalls) and not a YouTube step-down (no step-down
+  logged). Diagnosis is args, not ingest.
+- Verification: **667 tests green, clean build with 0 warnings** (`./scripts/verify.sh`).
 
 ## Next action
 
-- Next: creator-directed **3) core-metric change cues**, one test/commit. Then resume
-  **40·A/C/D → Move → 9·5 → 14·16/17/18 → 66 → 67 →
-  68 → 69 → 70 → 36**.
-- Ask creator before TASK 68 about first-run ON-AIR default; before gold pass, settle the Release
-  single-instance mutex behavior.
-- TASK 34 scheduling and TASK 50 recording publish are retired; YouTube owns those surfaces.
+- Unit 2 of 4: **explicit CBR** in `Services/Encoder/FfmpegArgs.cs`, spelled per encoder (NVENC/AMF `-rc cbr`;
+  QSV and OpenH264 differ — verify, do not guess). One test/commit.
+- Unit 3: rate presets + free-form Mbps per tier (min/rec/max from YouTube's H.264 table; default 12 at
+  1080p60, 10 at 1080p30, 6 at 720p), tier minimum becomes the step-down floor.
+- Unit 4: local per-tier history; propose a rate change between sessions only, ≥10% above a zero-step
+  high-water mark across 5 sessions, or repeated step-downs downward; explicit consent, "keep mine" remembered.
+- Then resume **40·A/C/D → Move → 9·5 → 14·16/17/18 → 66 → 67 → 68 → 69 → 70 → 36**.
 - Do not push app commits absent a checkpoint request.
 
 ## Landmines
 
+- `Assets/starting-background.jpg` is modified in the working tree, **awaiting the creator's visual check** —
+  do not commit it as part of another unit.
+- `ChromaKeyRealClipTests.RealClip_PlaysAtItsNativeRate` failed once in a full run and passed alone: a
+  load-sensitive flake, not the known pre-existing pair. Watch it; do not chase it as a regression.
+- Early step-down path reuses `ChangeEncoderAsync`, so every rate change is a full encoder relaunch.
 - Preview frame-source layers need a `PreviewPane` DataTrigger; pin each new type with a visibility test.
-- Bundled-art healing compares bytes (`LayoutStore.AssetMatches`); a compiled version constant races its resource.
-- Pack URIs for bundled assets must be assembly-qualified (`/LlamaCasty;component/Assets/…`).
 - Media sessions are keyed by path + look; never acquire by raw path.
 - Audio pipe allows one server per name; DEBUG suffixes it, Release does not.
 - Any test constructing `MainWindow` must use a temporary `LayoutPathOverride` and clear it in `finally`.
 - Build with the Windows `dotnet.exe` host from WSL; read render numbers in Release.
-- Bundled FFmpeg stays outside the single-file exe (`ExcludeFromSingleFile="true"`).