Require judgement anywhere, and evidence that never becomes a verdict

Rating and flagging were reachable from the grid alone, so a photograph
opened in develop could not be judged without leaving it; FR-UI-5 said
"rating" without qualifying the view and was built as though it had.
And FR-UI-1's expanded row has said "filmstrip" since it was written
while the roll stayed on demand in both classes. Both are amended to
say what they meant: judgement follows the photograph, without
auto-advance outside the culling mode, and the roll is open by default
where there is room for it.

The larger change is a rule. Per-face signals — eye state from a
classifier, head pose from the five landmarks the detector already
yields — are worth having for culling, and §3.9.1 excluded detecting a
blink outright. The exclusion was always of judgement, not of knowing:
a blink is a fact about a frame of the same kind as a clipped
highlight. FR-CULL-8a specifies the two signals; FR-CULL-13 says what
any signal may do (be shown, filtered, sorted, propose a burst
representative) and what none may (write a rating or flag without a
user action between). R7 states the same thing as a user need.

Licensing was read before either was written. OCEC's eye-state weights
are MIT with a clean data chain; every open gaze model is trained on
Gaze360 or its peers, whose licences restrict derived models by name,
so gaze is deferred in §7 and head pose stands in for it. D13 records
both so they are not re-searched.

Replacing a closed-eyed face from a neighbouring frame was raised and
is written down as D17 rather than built: it is the multi-source schema
question §7 already defers for panorama and HDR, with its non-goals —
never automatic, provenance declared — fixed now.

Traceability regenerated: three new IDs, none yet tagged.

docs/traceability.md

@@ -11,17 +11,17 @@ Denominators are parsed from [`requirements.md`](requirements.md) at run time, n
 |---|---|
 | Source files scanned | 354 |
 | TRACES tags found | 1495 |
-| Requirements defined | 191 |
+| Requirements defined | 194 |
 | Requirements covered | 140 |
-| **Coverage** | **73.3%** (140/191) |
+| **Coverage** | **72.2%** (140/194) |
 
 ### By type
 
 | Type | Covered | Defined |
 |---|---|---|
-| FR | 105 | 136 |
+| FR | 105 | 138 |
 | NFR | 32 | 49 |
-| R | 3 | 6 |
+| R | 3 | 7 |
 
 ## Orphan tags
 
@@ -176,13 +176,15 @@ _None._
 
 ## Not yet tagged
 
-51 of 191 requirements have no implementation tag. Expected while the codebase is young; each should gain one as it is built.
+54 of 194 requirements have no implementation tag. Expected while the codebase is young; each should gain one as it is built.
 
 <details><summary>Show untagged requirements</summary>
 
 - FR-CAT-14
+- FR-CULL-13
 - FR-CULL-6
 - FR-CULL-7
+- FR-CULL-8a
 - FR-DEV-19
 - FR-DEV-3g
 - FR-DSP-2
@@ -231,5 +233,6 @@ _None._
 - R1
 - R2
 - R5
+- R7
 
 </details>