# ROADMAP

Ordered outcomes past the current one. Phase 1 landed on 2026-08-11 and moved to
`decisions/audit-phase1.md`. The reasoning behind every phase is in `AUDIT.md`.

Approval boundary from the audit: ship Phase 2 and measure it. Then decide whether Phase 3 and 4 are
worth the size of the change.

## Phase 2: safe throughput

Unblocks: a chapter that finishes in a fraction of the current wall time without changing any model.
Done when: the same labeled chapter runs with two gemma loads instead of seven. The acceptance numbers
below are recorded in a report.

- Two-phase gemma lease schedule, so the model stays resident across compatible stages.
- JSON-schema-constrained generation for detect, dialogue, roster, direction, same-person, and resolve.
- `--media-path /dev/shm` and `file://` image paths instead of base64 data URIs.
- An ephemeral `/dev/shm` cache keyed by S3 URI plus etag, and reused direction downloads.
- Batched siglip embeddings, one forward pass per bounded image batch.
- Batched scene construction and SQLite writes. Set `busy_timeout` first
  (`caveats/audit-open.md#sqlite-locking`).
- Bounded fetch and framed-page crop concurrency.
- Images before the differing instruction in every multi-call prompt, so llama-server reuses its KV
  cache prefix across the two direction passes.

## Phase 3: multi-view constrained identity

Unblocks: an identity that survives a reviewer disagreeing with it.
Done when: false merges and false splits are reported per labeled chapter and the resolver beats the
Phase 1 baseline on both.

- Chapter-local tracklets persisted as a resumable homesrv artifact, not worker memory.
- Face and body galleries with crop-quality selection, and 2-4 query views per tracklet.
- Global constraints at resolution: must-link inside a tracklet, cannot-link for co-presence, gender
  and species gates, manual locks, one appearance per character per panel.
- Name claims separated from visual identity. Roster names stay candidate vocabulary.
- Reversible merges: a cluster with `canonical_id`, `member_ids`, and `cannot_link`, replacing the
  destructive delete (`caveats/audit-open.md#destructive-reconcile`).
- Identity evaluation extended to purity, fragmentation, name binding, and speaker accuracy.

## Phase 4: evidence-ledger narration

Unblocks: narration that can be checked against the panel rather than trusted.
Done when: every beat carries an evidence artifact and the verifier reports quote grounding, action
coverage, and future-fact leakage against it.

- Ordered beat evidence: panels, actions, chronology, dialogue ids, typed speaker refs, uncertainty.
- Scene-scoped story and turn-taking state, reset on location and time changes.
- Script chunks of 6-12 consecutive beats per text-only call, returning evidence ids.
- Confidence-aware wording: a weak speaker becomes `someone`, not a confident name.
- Targeted per-beat repair driven by the exact failures.

## Acceptance criteria

Capture a baseline and compare the same labeled chapter after every phase.

- Stage wall time and model-load time.
- Gemma call count and repair call count.
- MinIO bytes moved, prompt-evaluation and generation timings.
- Tracklet false merges and splits, identity accuracy.
- Name and speaker accuracy, unresolved correctness flags.
- Script repetition, unsupported facts, verifier retry rate.
- The share of narrated lines whose speaker is a named character rather than `Someone`. That one
  number would have caught `decisions/audit-phase1.md#speaker-ref-is-canonical` the day it landed.

Read `caveats/audit-open.md#inconsistent-stage-policy` before trusting any per-stage count.