Ship each crop's embedding so a resolver NONE can mint

Two identity fixes, neither yet run on a GPU.

has_face, the extras gate: fixing the bbox coordinate space made extras worse,
because crops finally landed on their subjects and a background extra bound to
the lead at 1.00. /vision stamps has_face per character using face_detect and
_pair_faces_to_present, so containment and its margin match the speaker path.
Identity skips has_face is False before it crops or embeds. Fails open on a
missing or raising detector, and gates on `is False` so an older vision blob
behaves as before.

The NONE mint: /identity/resolve now writes each crop's embedding to the crop's
key with a .npy suffix and returns emb_uri. The orchestrator cannot compute an
embedding of its own (siglip and gemma cannot both be resident), which is why it
was clearing a deliberate NONE instead of minting an anonymous character.

Also: audit_registry.py, and the tmux respawn-window trap, which
leaves a bare shell rather than re-running the window command.

decisions/identity-bbox.md#face-gates-enrollment
decisions/identity-bbox.md#none-mints-an-anonymous-character

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

NEXT.md

@@ -39,10 +39,12 @@ One number sets the agenda:
       checked by eye on panel 7, where five of six converted boxes land on their subject
       (`decisions/identity-bbox.md#bbox-is-normalized`). `person_1` still frames an empty window mullion,
       which is (c).
-   b. **Let identity abstain and stay abstained.** The colleague has no name in the story and was
-      labelled `Choi Haeseon` at 0.9. An unnamed recurring person needs a stable anonymous identity so
-      narration says "the colleague" every time. `match()` already returns `None` below threshold. Check
-      whether the Tier-2 gemma resolver can answer "none of these"; that was not verified.
+   b. ~~Let identity abstain and stay abstained.~~ **Done 2026-08-12, not yet run on a GPU**
+      (`decisions/identity-bbox.md#none-mints-an-anonymous-character`). The resolver could always answer
+      "none of these". The orchestrator was discarding the answer: it read only `character_id`, so a
+      deliberate NONE and a hallucinated index both unassigned every crop of the tracklet. A NONE now
+      mints an anonymous character from the crop, using the embedding `/identity/resolve` ships beside
+      it as `emb_uri`. Deployed: image rebuilt, `resolve_outcome` verified inside the container.
    c. **Separate extra from cast.** Four of the six detections on panel 7 are background extras or
       nothing at all, and all six reach identity as equal candidates.
    d. Only then merge `Seonho` into `Lim Seonho` and split `character_afa7623b`, which still needs the
@@ -113,7 +115,11 @@ Read the state, or clear a stage and resume:
 /usr/bin/ssh kami@192.168.1.104 "curl -s -X POST 'http://127.0.0.1:9090/job/resume?job_id=778297bc-e7ce-439d-91b5-8a027060d17f'"
 ```
 
-Traps: plain `ssh` is the kitty ssh kitten and refuses non-interactive stdin, so use `/usr/bin/ssh`.
+Traps: `tmux respawn-window -k` does NOT re-run the window's command, it drops to a bare shell and the
+worker stays down. Restart one worker by re-sending the `send-keys` line from `start_workers.sh`, and
+confirm with `/health` plus `./check_stale.sh`. `docker compose up --build orchestrator` recreates the
+container, which drops any `docker cp`'d script such as `audit_registry.py`.
+Plain `ssh` is the kitty ssh kitten and refuses non-interactive stdin, so use `/usr/bin/ssh`.
 `mc` aliases on homesrv are `homesrv` and `mio`. `local` returns Access Denied and `rfs` is the empty
 rustfs. `cp` is aliased to `cp -i` and hangs on overwrite, so use `/usr/bin/cp -f`.