Audit Phase 1: correctness and scheduling safety

Implements every P0 from AUDIT.md plus four P1s, across both halves of the
pipeline. Verified by CPU-only self-checks and the orchestrator test suite.
No GPU work ran and no pipeline ran.

workpc:
- worker_scene: read speaker_ref, not the rewritten speaker field. Every line
  narrated as "Someone" before this. Emit `actions` for the verifier.
- worker_script: declare beat + verifier_feedback (pydantic dropped both, so
  the retry was blind) and render them as a repair prompt.
- worker_vision: gate face->identity pairing on containment, assign globally
  shortest-first, map an out-of-range resolver index to `unresolved` instead
  of minting a character, parse JSON with raw_decode.
- session_manager: tear down a server whose lease vanished mid-load, and spawn
  the supervisor respawn unlocked.

orchestrator (edited in place, NOT committed there):
- tracklets: canonicalize gender, add co-presence cannot-links, block
  transitive bridges across a hard constraint.
- correctness: stop failing valid narration on sentence-initial capitals and
  short quotes; read action evidence from the singular key.
- db: stop orphan flags leaking into every chapter; resolve by flag id.
- service: TTS returns instead of raising under GATES, auto-resolves under
  autonomous mode; job admission control; registry names on dialogue resume.
- session_proxy: queue on 409 instead of stealing the lease; run heartbeats.

Docs restructured per the repo-structure layout: CLAUDE.md is a pointer table,
NEXT.md replaces HANDOFF.md, plus ROADMAP.md, JOURNAL.md, decisions/ and
caveats/. AUDIT.md now points at those instead of restating them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XD7cAy81MZrc7gCr6aZGWr

NEXT.md

@@ -0,0 +1,42 @@
+# NEXT
+
+Updated 2026-08-11. Replaces the old `HANDOFF.md`.
+
+## State
+
+Audit Phase 1 is implemented and green. Nothing is half-finished.
+
+Changed on workpc: `worker_scene.py`, `worker_script.py`, `worker_vision.py`, `session_manager.py`.
+Changed on homesrv (`/mnt/server/home/kami/docker-apps/manga-infra/orchestrator/`): `tracklets.py`,
+`correctness.py`, `db.py`, `service.py`, `session_proxy.py`, `test_script_verify.py`,
+`test_name_binding.py`.
+
+What landed and why: `decisions/audit-phase1.md`. What was left open: `caveats/audit-open.md`.
+
+Verification: CPU-only self-checks and the orchestrator test suite. 108 orchestrator tests pass
+(`test_api.py` is excluded on workpc because fastapi is not installed in this venv). No GPU work ran
+and no pipeline ran, so none of this is confirmed against a real chapter.
+
+The orchestrator changes are edited in place on the SSHFS mount and are NOT committed. Its git root is
+`/mnt/server/home/kami/docker-apps`. Its container also needs a rebuild or restart to pick them up.
+
+## Next
+
+1. Commit the orchestrator half in `/mnt/server/home/kami/docker-apps` and restart the container.
+2. Run one labeled chapter end to end and record the baseline numbers from `ROADMAP.md`, especially the
+   share of narrated lines with a named speaker. That number is the check on the largest Phase 1 fix.
+3. Start Phase 2 from `ROADMAP.md`. Set SQLite `busy_timeout` before any concurrency work
+   (`caveats/audit-open.md#sqlite-locking`).
+
+## Open questions
+
+Four Phase 1 items have no Vikunja task and were not created, because writing to the tracker was not
+asked for: the speaker contract fix, the verifier rules, the tracklet constraints, and the flag
+resolution path. Only [#203] existed and is now closed by `decisions/audit-phase1.md#unlocked-model-load`.
+
+Three audit items are deliberately not done and are recorded as caveats rather than silently dropped:
+honest stage clearing, ComfyUI under the session mutex, and reversible identity merges. Each needs a
+design decision, not a patch.
+
+Carried over from the reconstruction: `.venv` needs the ROCm torch wheel reinstalled, and `dots.tts/`,
+`legacy/`, `RESUME_SPEC.md`, `pipeline-design-notes.md`, `spec-v2.md` are unrecoverable.