Serve the document from a Django backend, split into three tiers

Step 9. The tier split was the work; Django was the easy half.

Tier 1 — the authored scene — is the document, and it is addressed as
independently versioned leaves rather than saved whole, so one vertex drag
cannot clobber a collaborator's keying. `domain/leaf` is the document as
path -> value; `domain/wire` puts it on the wire as transit, because JSON
has neither integer map keys nor keywords and a save would quietly turn
`{0 v}` into `{"0" v}`.

Tier 2 — the dense channel blocks — is content-addressed by a hash over
every input, with the detector version inside every key through the
analysis the block descriptor names. `flow/address`'s `block-knobs` is the
invalidation table, and `address-test` does not trust it: it re-freezes the
take once per knob and asserts the biconditional, that a block's bytes
changed if and only if its key changed. That found `brow-pos` not depending
on `contour-avg` — the brow ring is smoothed, the raise is not.

Tier 3 — frames and audio — is served by the hash of its bytes out of the
same store. A manifest now names frames and carries a URL for each, so the
frame layout stopped being a shared secret between a shell script and a
ClojureScript namespace, and the `?v=` cache-buster went with it: a blob's
name is the hash of its contents, so a stale copy is not a thing that can
happen. The synthetic take's `audio.wav` moved to `static/arthur/` — an
asset the project owns, not an extraction that churns.

The server verifies rather than trusting a name it was handed: it
recomputes every key from the descriptor stored beside it, refuses an
analysis that declares no detector version, and refuses a document naming
blocks it does not hold. It hashes the descriptor TEXT, because JS prints
an integral double as `1` and Python as `1.0`, and a scheme where both ends
re-render the numbers disagrees on the first parameter that happens to be
whole.

Two loose ends from step 8 closed on the way. `pack` no longer takes a
`(track, frame)` predicate whose call sites each re-derived a feature from
an index — every track names the feature it follows, which deleted five
hand-maintained mappings. And `:dev-http` is gone: Django serves the page,
shadow-cljs only builds into the staticfiles tree.

227 CLJS tests, 31 Django tests, green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -16,13 +16,38 @@ modern conveniences belong in the workflow, not the output. See
 
 ## ClojureScript port
 
-The active port has reached [step 7 of the port plan](docs/port-plan.md): it plays
-the synthetic take and can load extracted real footage with mouth, eyes, brows,
-and pixel-derived teeth. The step 8 data model now represents persistent feature
-IDs, eye pairs and feature-level observation gaps; its controls are still pending.
-See [frontend/README.md](frontend/README.md) for setup and the **load frames**
-workflow. The rest of this README describes the older JS prototype, which still
-runs separately on port 8777.
+The active port has reached [step 9 of the port plan](docs/port-plan.md): it plays
+the synthetic take, loads real footage with mouth, eyes, brows and pixel-derived
+teeth, and now has a Django backend that persists the document. The step 8 data
+model represents persistent feature IDs, eye pairs and feature-level observation
+gaps; its controls are still pending.
+
+```sh
+mise install                                        # both halves
+pip install -r requirements.txt
+mise exec -- python manage.py migrate
+mise exec -- python manage.py runserver 8778        # then open localhost:8778
+cd frontend && mise exec -- npx shadow-cljs watch app
+```
+
+See [frontend/README.md](frontend/README.md) for the **load frames** and **save**
+workflows. Anything under "## Run" and below describes the older JS prototype,
+which still runs separately on port 8777.
+
+### How it is stored
+
+Three tiers, cut by mutability and size — the full argument is in
+[docs/architecture.md](docs/architecture.md):
+
+| Tier | What | Where |
+| --- | --- | --- |
+| 1 **authored** | the scene: nodes, channels, features, time maps | the database, as independently addressed leaves. Kilobytes |
+| 2 **derived** | the dense channel blocks | `var/blobs`, content-addressed by a hash over every input — including the detector version |
+| 3 **source** | frames and audio | the same blob store, by the hash of their bytes |
+
+Only tier 1 is the document. Tier 2 is a pure function of tiers 1 and 3, so a
+saved project names its blocks rather than carrying them, and a knob change gives
+a block a new name rather than overwriting an old one.
 
 ## Run
 
@@ -383,3 +408,16 @@ performer→character calibration (currently identity, fitting the face oval to
 canvas); the override layer; anything on the Animator Pro side. The plate is a
 face-oval polygon per kept frame — it exists so the mouth has a face to read
 against, not to look good.
+
+In the port specifically: the parameter UI and scoped regeneration (the model is
+built, the controls are not); automatic per-feature detection, so presence still
+comes from the full-face mask plus a manifest annotation; multiplayer, for which
+step 9 built the addressing and none of the socket; and in-browser extraction, so
+`extract.sh` plus `manage.py ingest_bundle` is still how footage arrives.
+
+Two smaller things that are known and undecided. `measure/brows` takes no
+`presence` where `measure/eyes` does, so an occluded brow affects the freeze mask
+but not brow measurement, and occluded landmarks still enter contour smoothing —
+asymmetric with the eyes, and it is not settled which way is right. And `open`
+takes the most recently updated project and shows its first clip: there is no
+project browser, and the runtime store holds one clip at a time.