feat(media): the verdict splits what the database alone cannot

"No row at the destination" was one number, and it conflated three different
things: a sidecar the server never indexes, a file a later pass renamed again,
and a file that never left its source — the last one being actual damage. The
runbook already named the four classes; the tool never computed them, so an
operator reading `missing from the DB: 1851` had no way to tell a booklet.pdf
from a lost album and might have run a rollback over a false alarm.

`missing` rows are now stat'd on both paths and reported as
`on disk at dst, no row names it` / `REAL — file still at src` /
`gone — at neither path`, with offenders listed in that order. A row still
naming `src` stays a separate line: that is the server's own stale pointer, a
phantom, and it costs a re-scan rather than a restore.

Two new tests (REAL, and gone-vs-sidecar) plus two existing layout assertions
loosened from line positions to content. 14/14 in tests/media_verify.bats.

scripts/media-verify.py

@@ -27,9 +27,14 @@ beside a running scanner can even fail as "database disk image is malformed".
 
 Neither server holds a row for everything the journal renames: a `.log`, `.cue`
 or cover image has no row to land in, so its absence is not a fault. The report
-therefore breaks the missing rows down by extension, and `--ignore-ext` names
-the extensions this server does not index, which are then counted separately and
-kept out of the verdict.
+therefore breaks the missing rows down by extension, and `--ignore-ext` names the
+extensions this server does not index, which are then counted separately and kept
+out of the verdict. What is left is split by what the filesystem says, because
+the database alone cannot: a file still at its `src` is `REAL` (this pass's own
+damage), a file at neither path is `gone` (a later pass or the server renamed it),
+and a file sitting at its `dst` with no row naming it is simply something the
+server does not index. A row that still names `src` is none of these: it is the
+server's own stale pointer — a phantom — and it costs a re-scan, never a restore.
 
 Exit codes: 0 every move landed; 1 something is stale or missing (the details are
 printed); 2 the journal or the database is not usable at all.
@@ -174,20 +179,37 @@ def main():
         if at_src:
             stale.append(src)
         if not at_dst:
-            missing.append(dst)
+            missing.append((src, dst))
+
+    # The database cannot tell a lost file from one it never indexes: both read
+    # as "no row at the destination". Stat both paths, so the report separates
+    # the classes the runbook names — `REAL` is the only one that is this pass's
+    # own damage, and `gone` is a later pass or the server's own rename.
+    on_disk, real, gone = [], [], []
+    for src, dst in missing:
+        if os.path.exists(dst):
+            on_disk.append(dst)
+        elif os.path.exists(src):
+            real.append(src)
+        else:
+            gone.append(dst)
 
     print(f"{args.db_kind}: {len(moves)} moves checked")
     print(f"landed: {landed}")
     print(f"still at src: {len(stale)}")
     print(f"missing from the DB: {len(missing)}")
+    print(f"  on disk at dst, no row names it: {len(on_disk)}")
+    print(f"  REAL — file still at src: {len(real)}")
+    print(f"  gone — at neither path: {len(gone)}")
     if ignored:
         print(f"not indexed (extension ignored): {ignored}")
     if missing:
         exts = Counter(os.path.splitext(d)[1].lower() or "(no extension)"
-                       for d in missing)
+                       for _, d in missing)
         print("missing by extension: "
               + ", ".join(f"{e} {n}" for e, n in sorted(exts.items())))
-    for label, items in (("stale", stale), ("missing", missing)):
+    for label, items in (("real", real), ("gone", gone), ("missing", on_disk),
+                         ("stale", stale)):
         for path in items[:args.show]:
             print(f"  {label}: {path}")
         if len(items) > args.show: