Warm transfers need dual readiness gates and latched terminal races

Observed 2026-09-08 while adapting a LiveKit/Pipecat warm transfer from a durable multi-runner design to a fixed single-call runner. Preserve causal safety rules even when the persistence layer cannot be ported: participant-connected or audio-subscribed events can arrive before an outbound SIP leg is answered because of early media, so start the broker briefing only after both the provider's wait-until-answered operation returns and the expected participant's audio track is subscribed. After participant movement, latch human departures before waiting on terminal locks so a disconnect cannot be overwritten by a late success. Reconcile destination and source after every move; retry only when the broker is conclusively still in the source room, and never restore bot audio when location is unknown. Without durable ownership/fencing, document process-restart recovery as unsupported rather than simulating it with process-local state.