docs: capitalize Persona/Personas for the product feature in review docs

Feature-word 'persona'/'personas' now reads 'Persona'/'Personas' (capital P)
across the current review checkpoint docs, matching the UI terminology. Code
identifiers, API paths, and schema fields stay lowercase.

docs/HANDOFF.md

@@ -12,16 +12,16 @@
   EasyPanel env.
 
 ## What this is
-Corporate multi-user **sales-training simulator**: admins create persona groups from a
+Corporate multi-user **sales-training simulator**: admins create Persona groups from a
-product/service/idea (โฟกัส "สินค้า/บริการ/ไอเดีย"), app auto-generates **15 customer personas**
+product/service/idea (โฟกัส "สินค้า/บริการ/ไอเดีย"), app auto-generates **15 customer Personas**
 (5/tier A/B/C) via LLM; trainees pick a **scenario (social / พบหน้า)**, chat 1:1 one-shot to close a
 sale; a **per-turn + final judge LLM** evaluates feelings and scores/coaches. Vue SPA + Flask API +
 filesystem JSON storage (no SQL). i18n TH/EN. No self-registration (admin provisions).
 
 ## Roles
-- **super_admin** (bootstrap `admin`) — full recipe (secret persona fields) + tenant admin.
+- **super_admin** (bootstrap `admin`) — full recipe (secret Persona fields) + tenant admin.
-- **admin** — manages groups/users, sees personas with **secret fields stripped** (IP protection).
+- **admin** — manages groups/users, sees Personas with **secret fields stripped** (IP protection).
-- **user** (trainee) — trains against personas, own board.
+- **user** (trainee) — trains against Personas, own board.
 
 ## 2026-08-25 review checkpoint — exact-current local code gate passed 8/8
 > All eight independent review scopes now have complete five-key passes with

docs/engineering-log/2026-08-24-training-security-review.md

@@ -8,7 +8,7 @@ Move the regular-user journey to:
 
 while preserving the admin flow, restricting demo users, enforcing tenant/owner
 boundaries, allowing safe retry of `draft`/`failed` products, and preventing
-persona/credential leakage.
+Persona/credential leakage.
 
 ## Remediation recorded
 
@@ -21,18 +21,18 @@ persona/credential leakage.
   API responses use `is_owned` rather than exposing `owner_user_id`/`creator_id`.
 - Protected routes require both completed setup (`must_setup is False`) and
   explicit Terms consent (`accepted_terms is True`); missing markers fail closed.
-- Session/debrief/persona responses use closed allowlists; provider/storage
+- Session/debrief/Persona responses use closed allowlists; provider/storage
   errors are mapped to stable client-safe messages.
 - Owner markers and private visibility now form one fail-closed invariant;
   normal create/update paths reject unowned-private and malformed-owner records,
   while legacy malformed records are excluded from access and indexes.
 - Non-ready groups remain visible to their owner/admin for recovery, but their
-  persona payloads/counts and direct persona access are empty/blocked until
+  Persona payloads/counts and direct Persona access are empty/blocked until
   `ready`, including admin responses.
 - Owner products stuck in `analyzing` remain reopenable and the Training and
   admin edit UIs expose the recovery action instead of dead-ending.
 - Judge-only evaluator reasoning and provider paths are excluded from the
-  persona role-play prompt; only bounded role-play state is retained.
+  Persona role-play prompt; only bounded role-play state is retained.
 - Transcript serialization keeps seller/customer messages plus an exact
   allowlist of server-generated `⏳` scene notes, redacts legacy initial openers,
   and transcript-only debriefing receives seller messages only.
@@ -206,7 +206,7 @@ The fixes were test-driven:
 - Added `GROUP_STATUSES` and explicit transition validation to `GroupStore`.
 - Validated structurally ready artifacts before any role receives a persisted
   ready group.
-- Revalidated the source persona identity under the record lock before appending
+- Revalidated the source Persona identity under the record lock before appending
   an admin variant.
 - Updated stale compatibility tests that previously treated malformed-ready
   records as readable.

docs/test-evidence/2026-08-24-training-security-review.md

@@ -52,7 +52,7 @@ Current-tree remediation:
   canonical Personas are structurally valid.
 - `GroupStore` now allowlists lifecycle states and explicit permitted transitions,
   including `failed → analyzing` retry and `ready → analyzing` reanalysis.
-- Variant publication revalidates both source status and the exact source persona
+- Variant publication revalidates both source status and the exact source Persona
   under the group record lock after LLM generation.
 - Privileged indexes exclude malformed `ready` and invalid-status records;
   `publish_analysis()` accepts only persisted `analyzing` groups.