docs: record the second AR-024 exception, and that the invariant is now checked

The exceptions table gains the calibration's own near-duplicate dedup.
It is not a close call in either direction: at 1 - 1e-7 it tests vector
identity rather than similarity, and it runs on the fit's input, so a
calibrated comparison there would have to be calibrated by the fit it is
feeding.

More importantly, the invariant now has the enforcement its register row
always claimed. check_raw_cosine.py blocks in CI, and it caught a live
violation on its first run -- the identity matcher's no-calibration
fallback, which thresholded raw cosine distance and then fed
max(0, cosine) into the Bayesian accumulation as a posterior, past a
contract that says in terms it cannot be handed an uncalibrated number.

The note is explicit about what a pass does not prove: the check cannot
follow a cosine through a variable across statements, and says nothing
about the GEMM similarity matrix. Both remain conventions backed by
review. Writing that down is the point -- a checker trusted for more
than it does is how the raw-cosine fallback survived being read past.

TRACES: AR-024 | SR-002

CLAUDE.md

@@ -38,6 +38,18 @@ this reason include `track_max_embed_dist`, `cut_revive_sim`,
 | Where | Why |
 |---|---|
 | `GR-008` — distributional outlier check on an actor's own references | The sigmoid is a monotonic squash: right for *decisions*, wrong for characterising a *distribution*, since it compresses exactly the tails where outliers live. Shape is a property of the metric space. Scope is analysis only — every match decision still goes through the calibration. |
+| `calibrate_gallery` — per-actor near-duplicate dedup at `1 - 1e-7` | Two reasons, either sufficient. It asks whether two vectors are **the same vector** — at that threshold it catches one source image embedded twice, and no pair of distinct photographs lands there — so it is not a decision and there is nothing for a probability to mean. And structurally, it runs on the calibration fit's *input*: a calibrated comparison there would have to be calibrated by the fit it is feeding. |
+
+**The invariant is now enforced, not just asserted.**
+`scene-actor-extraction/scripts/ci/check_raw_cosine.py` runs in the traceability
+workflow and fails the build on a bare cosine with no recorded exception. It
+found one immediately — the identity matcher's no-calibration fallback, which
+thresholded raw cosine distance *and* fed `max(0, cosine)` into the Bayesian
+accumulation as a posterior.
+
+Know what it does not cover: it cannot follow a cosine through a variable across
+statements, and it says nothing about the GEMM similarity matrix. Those remain
+conventions backed by review. A pass is evidence, not proof.
 
 ### Every model gets the input it was trained for