zebra-spaces: leave + step-down chimes

Two more Web Audio tones, completing the doorman set:
- playToneLeave: E5 -> C5 descending major third (mirror of join's
  C5 -> E5 ascending). Fires on peer-left (any role leaves the
  room post hiccup-grace) and peer-booted (mod kicks someone),
  skipping self on the boot case.
- playToneStepDown: single G4 low sine blip — softer than the
  arrival/departure pair. Fires on role-change for OTHER peers
  when canSpeak(prev) && !canSpeak(next): they're still in the
  room, just lost mic privileges.

Full notification ladder:
  C5 -> E5     guest arrived
  A5 (triangle) hand raised
  G4            speaker stepped down (still here)
  E5 -> C5     guest left / was kicked

web/zebra-spaces.html

@@ -2945,6 +2945,18 @@ function playToneRaise(){
   /* single A5 bell-ish tone — light, attention-getting */
   playToneBlip(880.0, 260, 'triangle');
 }
+function playToneLeave(){
+  /* E5 → C5 descending major third — mirror of playToneJoin, conveys
+   * 'departed'. Fires on peer-left + peer-booted. */
+  playToneBlip(659.25, 140, 'sine');
+  setTimeout(() => playToneBlip(523.25, 200, 'sine'), 120);
+}
+function playToneStepDown(){
+  /* single G4 low blip — softer than join/leave, conveys 'still here
+   * but stepped off the stage'. Fires on canSpeak -> listener role
+   * transitions for other peers. */
+  playToneBlip(392.0, 220, 'sine');
+}
 
 /* ==================================================================
  * room state mirror (server is source of truth, we mirror locally for
@@ -3164,6 +3176,9 @@ async function handleSignal(raw){
         const left = members.get(m.uuid);
         const pub = pubHexFromMsg(m, 'pubkey') || (left && left.pubkey ? pubHexFromMsg({pubkey:left.pubkey}, 'pubkey') : '');
         if (left || pub) logLine('', idTag(m.uuid, pub)+' left');
+        /* doorman chime — someone actually left (post hiccup-grace).
+         * server never sends peer-left for self so no self-filter. */
+        playToneLeave();
         /* if they were sharing screen or camera, drop the tiles */
         if (left && left.pubkey){
           try { const h = hex(unb64(left.pubkey)); removeScreenTile(h); removeCameraTile(h); } catch(_){}
@@ -3293,6 +3308,9 @@ async function handleSignal(raw){
                 removeCameraTile(subjPub);
                 removeVideoTile('gameshare', subjPub);
               } catch(_){}
+              /* 'stepped off the stage' chime — they're still in the
+               * room but lost mic privileges. */
+              playToneStepDown();
             }
           }
           renderRoom();
@@ -3308,6 +3326,8 @@ async function handleSignal(raw){
           || (mm && mm.pubkey ? pubHexFromMsg({pubkey:mm.pubkey},'pubkey') : '');
         const byPub   = pubHexFromMsg(m, 'by_pubkey');
         logLine('', idTag(m.uuid, victPub)+' was removed by '+(by||byPub?idTag(m.by, byPub):'a mod'));
+        /* same departure chime as peer-left — they're gone either way. */
+        if (m.uuid !== myUUID) playToneLeave();
         if (m.uuid === myUUID){
           /* server will close our socket; surface a clear notice and prevent
            * the WS reconnect loop from auto-rejoining into a boot loop. Tear
@@ -4097,8 +4117,8 @@ logLine('', 'ready — pick a handle, type a rendezvous code, enter the space');
 
 <footer style="margin:2.2rem auto 0;font-size:0.65rem;color:#999;line-height:1.7;word-break:break-all;font-family:monospace">
   <span id="pi-seal" style="color:#777;cursor:default;user-select:none" title="">page integrity</span> &nbsp;·&nbsp; built <span class="stamp-date">2026-06-03</span><br>
-  md5 <span class="stamp-md5">52efb36e064b33523d89ed5d4669c095</span><br>
-  sha256 <span class="stamp-sha">e8c6ff205eed77ea3501a0fcc86a9378c6c20578bad013de4cd7d1acfc01ce88</span><br>
+  md5 <span class="stamp-md5">035e4670e83b8d40571bdfa0ba74b1af</span><br>
+  sha256 <span class="stamp-sha">99b85839b097b71b054a68440c2ede0e2e208881dd1a0cc60788039fd523cff1</span><br>
   <span style="color:#bbb">hashes are of this page with these two fields zeroed — to verify, blank them and re-hash</span><br>
   <span style="color:#bbb">one self-contained file — <strong>save a copy</strong> and verify against these hashes; point at your own servers with ?signal= and ?turncred=, or <a href="host-your-own.html" style="color:#999">host your own community</a></span>
 </footer>