Give features stable identity, eye pairs and per-feature presence

Step 8's data model, ahead of its controls. Nothing here is a UI.

domain/params holds every knob's definition once — default, applicable area,
value constraints and the areas a change would force to regenerate. flow/take's
literal knob map becomes a view of it, so the take's defaults and the future
parameter panel cannot drift apart.

domain/feature adds subjects, features and groups as document data the renderer
never reads. A feature ID is stable for the whole clip, across occlusion: a run
of visible frames is not a new identity. An eye pair is an explicit group of one
or two eyes of the same subject, so a profile view with one identified eye needs
no invented partner. Settings resolve area -> subject -> group -> feature, and
dropping an eye from a pair materialises its effective values first so playback
does not jump. scene/problems now validates all of it.

Presence becomes per-feature rather than per-subject. freeze's :absent predicate
takes a track as well as a frame, so one occluded eye can be absent while its
partner still has a value; a full-face miss still marks everything absent. A
manifest may annotate known gaps as one-based inclusive intervals, which ingest
expands into observation tracks before measurement. An unobserved eye then gets
no vote in the iris pairing and cannot steer the shared gaze — gaze falls back to
whichever eye is visible. Temporal filters still see a sample on every frame,
held from the last observed one, because the numbers are a rectangular buffer;
the state mask, not the buffer, is what says the frame has no value.

js/app.js gets the same occlusion lesson: leading nulls from a face that starts
occluded used to throw away the whole take, and the neutral frame could be chosen
from a held duplicate pose.

Parameter editing, scoped regeneration and a feature-level detector remain. Until
one exists, footage without annotations falls back to the full-face mask rather
than claiming occlusions it cannot see.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B87NVmiU36qQmN9gmFYnJ9

frontend/README.md

@@ -110,11 +110,20 @@ landmarks and the teeth from source pixels, then freezes them into channels,
 and adds a button for the footage clip. Detection happens once when you load;
 playback only resolves channels and paints. Frames without a detection remain
 marked absent even though their neighbouring poses are used to condition the
-track. The stage stays 320×200 regardless of the footage dimensions. Real
+track. The scene now records stable subject and feature IDs and explicit eye
+pairs; dense channels can mark one feature absent while another is observed.
+Current MediaPipe loading supplies only the full-face detection mask. The stage
+stays 320×200 regardless of the footage dimensions. Real
 footage starts at the source picture rate. The **picture fps** buttons sample the
 frozen roto at lower rates while the source track, duration and audio clock stay
 unchanged. Picking frames to trace into cels is a separate future editing step.
 
+For known occlusion intervals, an extracted manifest may add
+`"feature-absence": {"eye-r": [[10, 14]]}`. Frame numbers are one-based and
+inclusive, matching PNG filenames. The eye remains the same feature when it
+reappears; the other eye and the mouth continue through the gap. This is an
+input annotation, with no UI for editing it yet.
+
 MediaPipe's JS, wasm and model are under `public/mediapipe/` and served locally.
 No CDN is used by this app. See that directory's README for provenance.