tests: pause-add rotation corruption + dup-id, log bugs to TODO

- turn.pause-add.test.js: 3 tests isolating addParticipant+pause/resume
  interaction. Clean minimal repro passes (bug needs more state than
  single add+pause). Audit authoritative repro.
- turn.characterization.test.js: RED 'addParticipant rejects duplicate id'.
  Validates current allow-dup behavior.
- TODO.md: BUG-1 (add+pause rotation corruption, 32/100 audit violations),
  BUG-2 (dup id allow). Both confirmed real, NOT fixed.

Audit bisect: dmg+heal+cond+toggle+remove+add+pause = 32 violations.
add+pause alone = 0. Combo needs full state.

No feature code changed.

TODO.md

@@ -22,6 +22,31 @@
 - UI button: "Make This Turn"
 - Backend action: new endpoint or via generic doc patch.
 
+## Confirmed bugs (tests written, NOT fixed)
+
+### BUG-1: addParticipant + pause/resume corrupts turn rotation
+- Audit: 32/100 rounds violate rotation when `addParticipant` + other state
+  changes fire while paused.
+- Repro in replay round 10+: current stuck on one participant forever,
+  nextTurn returns same id, round never advances.
+- Clean minimal repro (turn.pause-add.test.js) PASSES = combo needs more
+  state than one add+pause. Audit is authoritative repro.
+- Togglepause resume rebuilds turnOrderIds via sort but leaves
+  currentTurnParticipantId stale. After enough adds/toggles the stale
+  pointer lands wrong → nextTurn repeats.
+- Test: `shared/turn.pause-add.test.js` (3 tests, all green currently —
+  document when bug DOES NOT trigger. Audit catches it.)
+- Real repro = run `scripts/audit-rotation.js` with all ops enabled.
+
+### BUG-2: addParticipant allows duplicate id
+- `addParticipant(enc, dup)` appends same id to participants[] twice.
+- togglePause resume rebuilds order → id appears twice in turnOrderIds →
+  nextTurn stuck repeating that id.
+- Reachable in normal app? App uses crypto.randomUUID (fresh ids) so
+  unlikely. But no guard exists — defensive bug.
+- Test: `shared/turn.characterization.test.js` 'addParticipant rejects
+  duplicate id' — RED currently (validates current allow-dup behavior).
+
 ## Pipeline
 - [ ] Red test: dead participant still in turnOrderIds, turn still advances to them
 - [ ] Fix `shared/turn.js`: don't drop dead from turn order