chore(deps): bump the python-deps group across 1 directory with 5 updates

Bumps the python-deps group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [croniter](https://github.com/pallets-eco/croniter) | `6.2.2` | `6.2.3` |
| [numpy](https://github.com/numpy/numpy) | `2.5.0` | `2.5.1` |
| [opencv-python-headless](https://github.com/opencv/opencv-python) | `4.13.0.92` | `5.0.0.93` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [nvidia-cudnn-cu12](https://developer.nvidia.com/cuda-zone) | `9.23.2.1` | `9.24.0.43` |



Updates `croniter` from 6.2.2 to 6.2.3
- [Release notes](https://github.com/pallets-eco/croniter/releases)
- [Changelog](https://github.com/pallets-eco/croniter/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pallets-eco/croniter/compare/6.2.2...6.2.3)

Updates `numpy` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](https://github.com/numpy/numpy/compare/v2.5.0...v2.5.1)

Updates `opencv-python-headless` from 4.13.0.92 to 5.0.0.93
- [Release notes](https://github.com/opencv/opencv-python/releases)
- [Commits](https://github.com/opencv/opencv-python/commits)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0)

Updates `nvidia-cudnn-cu12` from 9.23.2.1 to 9.24.0.43

---
updated-dependencies:
- dependency-name: croniter
  dependency-version: 6.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: numpy
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-deps
- dependency-name: opencv-python-headless
  dependency-version: 5.0.0.93
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-deps
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
- dependency-name: nvidia-cudnn-cu12
  dependency-version: 9.24.0.43
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-deps
...

Signed-off-by: dependabot[bot] <support@github.com>

.env.example

@@ -4,42 +4,49 @@ API_KEY=your-immich-api-key
 FRIGATE_URL=http://192.168.1.10:5000
 
 # ── Mode & Strategy ───────────────────────────────────────────────────────────
-AUTO_MODE=true
-# TRAINING_MODE: face = upload to Frigate face recognition API
-#                object = save crops to output dir for manual Frigate placement
-TRAINING_MODE=face
-# STRATEGY: auto = objective diversity (recommended), standard = 30 imgs, broad = 100 imgs
-STRATEGY=auto
+# Auto mode is active by default when no TTY is present (Docker/cron).
+# Set AUTO_MODE=true to force auto mode even in an interactive terminal.
+# AUTO_MODE=true
+# VERBOSE=true                # Enable DEBUG-level console output (log file is always DEBUG)
+# STRATEGY: adaptive = embedding diversity (recommended), standard = 30 imgs, broad = 100 imgs
+STRATEGY=adaptive
 # LIMIT=50                    # Custom image count; overrides STRATEGY preset
-# OBJECT_CLASS=dog            # Object label for object mode (e.g. dog, cat, car)
 
 # ── People Filtering ──────────────────────────────────────────────────────────
 # ONLY_PEOPLE=John,Jane       # Comma-separated; process only these people
 # SKIP_PEOPLE=Unknown         # Comma-separated; skip these people
-# MIN_FACE_COUNT=5            # Skip people with fewer than N assets in Immich
+# MIN_FACE_COUNT=3            # Skip people with fewer than N assets in Immich (default: 3)
 # YEARS_FILTER=10             # Only include images from the last N years (default: 10)
+# MERGE_DUPLICATE_PEOPLE=false  # Merge duplicate Immich person records permanently (default: false — warn and skip)
 
 # ── Image Quality ─────────────────────────────────────────────────────────────
-# MIN_FACE_WIDTH=50           # Minimum face width in pixels (default: 50)
+# MIN_FACE_WIDTH=90           # Minimum face width in pixels (default: 90, guarantees ≥8,100px crop)
 # FACE_MARGIN=0.15            # Padding around face crop as fraction (default: 0.15)
 # ENABLE_FACE_ALIGNMENT=true  # Align face before cropping (default: true)
 # USE_FULL_RESOLUTION=true    # Use full-res images vs thumbnails (default: true)
 # MIN_CONFIDENCE=0.7          # Minimum face detection confidence (default: 0.7)
-# BLUR_THRESHOLD=100.0        # Laplacian blur threshold; lower = accept more blur (default: 100.0)
-# MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 80)
+# BLUR_THRESHOLD=120.0        # Laplacian blur threshold; lower = accept more blur (default: 120.0)
+# MAX_AUTO_IMAGES=20          # Hard cap on auto-diversity selection (default: 20)
+# QUALITY_REPLACEMENT=true    # At cap, replace a weaker tracked image with a better candidate (default: true)
+# FRIGATE_SCORE_CEILING=      # Below-cap novelty gate: unset = dynamic (default), 0 = disabled, e.g. 0.85 = fixed ceiling
+# ENABLE_FRIGATE_SCORES=true  # Call Frigate's recognize endpoint pre-upload to store diversity scores (default: true; adds ~200ms per upload)
 
 # ── Caching & Models ──────────────────────────────────────────────────────────
-FORCE_CPU=false
-ENABLE_CACHE=true
-CACHE_DIR=/app/.if_cache
-HF_HOME=/models/huggingface
+# FORCE_CPU=true              # Disable GPU, fall back to CPU
+# ENABLE_CACHE=false          # Disable embedding cache (default: true)
+DATA_DIR=/app/data
 INSIGHTFACE_HOME=/models/.insightface
 
 # ── Tracker overrides (one-shot — remove after use) ───────────────────────────
 # DRY_RUN=true                # Preview selection without downloading/uploading
 # RETRY_REJECTED=true         # Re-attempt previously rejected images
-# RESET_PERSON=John           # Clear uploaded+rejected history for one person
+# RESET_PERSON=John           # Clear uploaded+rejected history for one person (use * for all)
 
 # ── Scheduling ────────────────────────────────────────────────────────────────
-# Cron expression (unset = run once and exit)
-CRON_SCHEDULE=0 3 * * 0     # Every Sunday at 3 AM
+# CRON_SCHEDULE controls container lifetime:
+#   unset          — run once on startup, then exit
+#   empty string   — stay alive, run nothing (trigger manually: docker exec -it winnow winnow)
+#   cron expression — run on startup, then on schedule
+# CRON_SCHEDULE=              # Manual mode (keep alive, no auto-run)
+# CRON_SCHEDULE=0 3 * * 0    # Every Sunday at 3 AM
+# CRON_SCHEDULE=0 3 1 * *    # First of every month

.githooks/pre-commit

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if git diff --cached --name-only | grep -q "^pyproject\.toml$"; then
+    uv lock
+    git add uv.lock
+fi

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,81 @@
+name: Bug Report
+description: Something isn't working as expected
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Before filing, check the [Troubleshooting wiki](https://github.com/sudolulo/winnow/wiki/Troubleshooting) and [existing issues](https://github.com/sudolulo/winnow/issues).
+
+  - type: dropdown
+    id: image-tag
+    attributes:
+      label: Image tag
+      description: Which winnow image are you running?
+      options:
+        - ":latest (NVIDIA CUDA)"
+        - ":rocm (AMD)"
+        - ":intel (Intel Arc / iGPU)"
+        - ":cpu (CPU only)"
+        - "Local install (uv)"
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: winnow version
+      description: Output of `docker inspect ghcr.io/sudolulo/winnow:<tag> | grep org.opencontainers.image.version` or the version in `pyproject.toml`.
+      placeholder: "0.2.13"
+    validations:
+      required: true
+
+  - type: input
+    id: immich-version
+    attributes:
+      label: Immich version
+      placeholder: "v1.110.0"
+    validations:
+      required: false
+
+  - type: input
+    id: frigate-version
+    attributes:
+      label: Frigate version
+      placeholder: "0.16.0"
+    validations:
+      required: false
+
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant log output
+      description: Paste logs from `docker logs winnow` or `winnow.log`. Set `VERBOSE=true` for more detail.
+      render: text
+    validations:
+      required: false
+
+  - type: textarea
+    id: compose
+    attributes:
+      label: Relevant compose / env config
+      description: Paste your `services.winnow` block. Redact your API key.
+      render: yaml
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or help request
+    url: https://github.com/sudolulo/winnow/discussions
+    about: Ask questions and get help in GitHub Discussions
+  - name: Wiki / Documentation
+    url: https://github.com/sudolulo/winnow/wiki
+    about: Setup, troubleshooting, and FAQ

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,36 @@
+name: Feature Request
+description: Suggest an improvement or new capability
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the use case or limitation you're running into.
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: What would you like winnow to do? New env var, different behaviour, etc.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Any workarounds you've tried or other approaches you considered.
+    validations:
+      required: false
+
+  - type: checkboxes
+    id: checklist
+    attributes:
+      label: Checklist
+      options:
+        - label: I checked existing issues and this hasn't been requested before.
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,26 @@
+## What does this PR do?
+
+<!-- One or two sentences. -->
+
+## Why?
+
+<!-- Link to the issue this addresses, or explain the motivation if there isn't one. -->
+
+Closes #
+
+## Changes
+
+<!-- Bullet list of the meaningful changes. -->
+
+-
+
+## Testing
+
+<!-- How did you verify this works? New tests added? Manual test steps? -->
+
+## Checklist
+
+- [ ] Targets the `dev` branch (not `main`)
+- [ ] `uv run pytest` passes
+- [ ] `uv run ruff check` passes
+- [ ] `CHANGELOG.md` `[Unreleased]` section updated

.github/workflows/docker-publish.yml

@@ -2,43 +2,44 @@ name: Publish Docker Image
 
 on:
   push:
-    branches: ["main", "dev"]
+    branches: ["dev"]
     paths-ignore:
       - "**.md"
       - "docs/**"
+      - ".github/ISSUE_TEMPLATE/**"
+      - ".github/PULL_REQUEST_TEMPLATE.md"
       - ".github/workflows/release.yml"
       - ".github/workflows/lint.yml"
       - ".github/dependabot.yml"
+      - "uv.lock"
+  workflow_call:
+    inputs:
+      tag:
+        type: string
+        required: false
+        description: "Release tag, e.g. v0.4.1 — triggers :latest + versioned image tags"
+      version:
+        type: string
+        required: false
+        description: "Version string without v prefix, e.g. 0.4.1"
+
+concurrency:
+  group: docker-${{ github.ref }}
+  cancel-in-progress: true
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: sudolulo/winnow
 
 jobs:
-  verify-lockfile:
-    name: Verify uv.lock is current
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-
-      - name: Check lockfile is up to date
-        run: uv lock --check
-
   build:
-    name: Build (${{ matrix.platform }})
-    needs: verify-lockfile
-    runs-on: ${{ matrix.runner }}
+    name: Build (linux/amd64)
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         include:
           - platform: linux/amd64
             runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-latest
     permissions:
       contents: read
       packages: write
@@ -46,36 +47,44 @@ jobs:
     steps:
       - name: Free up disk space
         run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
+          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
+          docker system prune -af
+          df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Set up QEMU
-        if: matrix.platform == 'linux/arm64'
-        uses: docker/setup-qemu-action@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
           platforms: ${{ matrix.platform }}
+          build-args: VERSION=${{ steps.version.outputs.value }}
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -88,9 +97,9 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          name: digest-amd64
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -105,17 +114,17 @@ jobs:
 
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: /tmp/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -124,20 +133,282 @@ jobs:
       - name: Determine image tags
         id: tags
         run: |
-          if [ "${{ github.ref_name }}" = "dev" ]; then
-            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev" >> "$GITHUB_OUTPUT"
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            echo "tag_args=-t ${IMAGE}:latest -t ${IMAGE}:${INPUT_TAG}" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
           else
-            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> "$GITHUB_OUTPUT"
+            echo "tag_args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
         run: |
           docker buildx imagetools create \
-            -t ${{ steps.tags.outputs.tags }} \
+            ${{ steps.tags.outputs.tag_args }} \
             $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
 
       - name: Inspect image
         run: |
-          docker buildx imagetools inspect ${{ steps.tags.outputs.tags }}
+          docker buildx imagetools inspect ${{ steps.tags.outputs.inspect_tag }}
 
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-cpu:
+    name: Build CPU (amd64 + arm64)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
+          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
+          docker system prune -af
+          df -h
+
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine CPU image tags
+        id: cpu-tags
+        run: |
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:cpu" "${IMAGE}:${INPUT_TAG}-cpu"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:cpu" >> "$GITHUB_OUTPUT"
+          else
+            echo "tags=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push CPU image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            VARIANT=cpu
+            VERSION=${{ steps.version.outputs.value }}
+          cache-from: type=gha,scope=cpu
+          cache-to: type=gha,mode=max,scope=cpu
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: ${{ steps.cpu-tags.outputs.tags }}
+
+      - name: Inspect CPU image
+        run: |
+          docker buildx imagetools inspect ${{ steps.cpu-tags.outputs.inspect_tag }}
+
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-rocm:
+    name: Build ROCm / AMD GPU (amd64)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
+          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
+          docker system prune -af
+          df -h
+
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine ROCm image tags
+        id: rocm-tags
+        run: |
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:rocm" "${IMAGE}:${INPUT_TAG}-rocm"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:rocm" >> "$GITHUB_OUTPUT"
+          else
+            echo "tags=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push ROCm image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          build-args: |
+            VARIANT=rocm
+            VERSION=${{ steps.version.outputs.value }}
+          cache-from: type=gha,scope=linux/amd64-rocm
+          cache-to: type=gha,mode=max,scope=linux/amd64-rocm
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: ${{ steps.rocm-tags.outputs.tags }}
+
+      - name: Inspect ROCm image
+        run: |
+          docker buildx imagetools inspect ${{ steps.rocm-tags.outputs.inspect_tag }}
+
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-intel:
+    name: Build Intel GPU (amd64)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL /usr/share/swift
+          sudo rm -rf "/usr/local/share/boost" "$AGENT_TOOLSDIRECTORY"
+          docker system prune -af
+          df -h
+
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ inputs.tag || github.ref }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Log in to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Determine Intel image tags
+        id: intel-tags
+        run: |
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:intel" "${IMAGE}:${INPUT_TAG}-intel"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:intel" >> "$GITHUB_OUTPUT"
+          else
+            echo "tags=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push Intel image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/amd64
+          build-args: |
+            VARIANT=intel
+            VERSION=${{ steps.version.outputs.value }}
+          cache-from: type=gha,scope=linux/amd64-intel
+          cache-to: type=gha,mode=max,scope=linux/amd64-intel
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: ${{ steps.intel-tags.outputs.tags }}
+
+      - name: Inspect Intel image
+        run: |
+          docker buildx imagetools inspect ${{ steps.intel-tags.outputs.inspect_tag }}
+
+      - name: Ensure package is public
+        run: |
+          gh api -X PATCH /user/packages/container/winnow \
+            -f visibility=public || true
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/lint.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
@@ -21,10 +23,10 @@ jobs:
           echo "Disk space freed."
 
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Run Ruff
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
         with:
           args: "check"
 

.github/workflows/release.yml

@@ -14,26 +14,14 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  verify-lockfile:
-    name: Verify uv.lock is current
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-
-      - name: Check lockfile is up to date
-        run: uv lock --check
-
   release:
-    name: Create GitHub Release & Build Image
-    needs: verify-lockfile
+    name: Create GitHub Release
     runs-on: ubuntu-latest
     permissions:
       contents: write
-      packages: write
+    outputs:
+      tag: ${{ steps.tag.outputs.TAG }}
+      version: ${{ steps.tag.outputs.VERSION }}
     steps:
       - name: Free up disk space
         run: |
@@ -44,15 +32,26 @@ jobs:
           echo "Disk space freed."
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Install uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Verify release branch
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          if [ "${{ github.ref_name }}" != "main" ]; then
+            echo "::error::Releases must be dispatched from main (current: ${{ github.ref_name }})"
+            exit 1
+          fi
+
+      - name: Ensure lockfile is current
+        run: uv lock
 
       - name: Resolve tag name
         id: tag
@@ -101,7 +100,7 @@ jobs:
           fi
 
       - name: Create GitHub Release
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           RELEASE_TAG: ${{ steps.tag.outputs.TAG }}
           RELEASE_NOTES: ${{ steps.changelog.outputs.NOTES }}
@@ -109,6 +108,15 @@ jobs:
           script: |
             const tag = process.env.RELEASE_TAG;
             const notes = (process.env.RELEASE_NOTES || '').trim();
+            try {
+              const existing = await github.rest.repos.getReleaseByTag({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag: tag,
+              });
+              console.log(`Release ${tag} already exists (id ${existing.data.id}), skipping creation.`);
+            } catch (err) {
+              if (err.status !== 404) throw err;
               await github.rest.repos.createRelease({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
@@ -118,24 +126,16 @@ jobs:
                 draft: false,
                 prerelease: false,
               });
+            }
 
-      - name: Log in to GHCR
-        uses: docker/login-action@v3
+  build-images:
+    name: Build and push Docker images
+    needs: release
+    uses: ./.github/workflows/docker-publish.yml
     with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: |
-            ghcr.io/sudolulo/winnow:latest
-            ghcr.io/sudolulo/winnow:${{ steps.tag.outputs.TAG }}
-
+      tag: ${{ needs.release.outputs.tag }}
+      version: ${{ needs.release.outputs.version }}
+    secrets: inherit
+    permissions:
+      packages: write
+      contents: read

.github/workflows/test.yml

@@ -9,18 +9,23 @@ on:
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install 3.13
+
+      - name: Check lockfile is up to date
+        run: uv lock --check
 
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --extra cpu
 
       - name: Run tests
         run: uv run pytest

.github/workflows/update-lockfile.yml

@@ -1,53 +0,0 @@
-# .github/workflows/update-lockfile.yml
-name: Update uv.lock
-
-on:
-  push:
-    paths:
-      - 'pyproject.toml'
-  workflow_dispatch:
-
-jobs:
-  update-lockfile:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v4
-
-      - name: Set up Python
-        run: uv python install 3.12
-
-      - name: Regenerate lockfile
-        run: uv lock
-
-      - name: Check for changes
-        id: diff
-        run: |
-          if git diff --quiet uv.lock; then
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Commit and push updated lockfile
-        if: steps.diff.outputs.changed == 'true'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add uv.lock
-          git commit -m "chore: update uv.lock"
-          git push
-

.gitignore

@@ -1,239 +1,36 @@
-# Custom
+# Output and runtime artefacts
 frigate_train/
 *.log
 runs/
+
+# Model and cache files
 yolov9c.pt
 .insightface/
 .huggingface/
-.cache/huggingface
 .if_cache/
-
 .immich_config.json
-# Python-generated files
-__pycache__/
-*.py[oc]
-build/
-dist/
-wheels/
-*.egg-info
 
-# Virtual environments
-.venv
-
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[codz]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-#   Usually these files are written by a python script from a template
-#   before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py.cover
-.hypothesis/
-.pytest_cache/
-cover/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-.pybuilder/
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-#   For a library or package, you might want to ignore these files since the code is
-#   intended to run in multiple environments; otherwise, check them in:
-# .python-version
-
-# pipenv
-#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
-#   However, in case of collaboration, if having platform-specific dependencies or dependencies
-#   having no cross-platform support, pipenv may install dependencies that don't work, or not
-#   install all needed dependencies.
-# Pipfile.lock
-
-# UV
-#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-# uv.lock
-
-# poetry
-#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
-#   This is especially recommended for binary packages to ensure reproducibility, and is more
-#   commonly ignored for libraries.
-#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
-# poetry.lock
-# poetry.toml
-
-# pdm
-#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
-#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
-#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
-# pdm.lock
-# pdm.toml
-.pdm-python
-.pdm-build/
-
-# pixi
-#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
-# pixi.lock
-#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
-#   in the .venv directory. It is recommended not to include this directory in version control.
-.pixi
-
-# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# Redis
-*.rdb
-*.aof
-*.pid
-
-# RabbitMQ
-mnesia/
-rabbitmq/
-rabbitmq-data/
-
-# ActiveMQ
-activemq-data/
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
+# Secrets
 .env
 .envrc
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
 
-# Spyder project settings
-.spyderproject
-.spyproject
+# Python
+__pycache__/
+*.py[oc]
+*.so
+.Python
 
-# Rope project settings
-.ropeproject
+# Packaging
+build/
+dist/
+*.egg-info/
+wheels/
 
-# mkdocs documentation
-/site
+# Virtual environments
+.venv/
 
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
-
-# Pyre type checker
-.pyre/
-
-# pytype static type analyzer
-.pytype/
-
-# Cython debug symbols
-cython_debug/
-
-# PyCharm
-#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
-#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
-#   and can be added to the global gitignore or merged into this file.  For a more nuclear
-#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
-# .idea/
-
-# Abstra
-#   Abstra is an AI-powered process automation framework.
-#   Ignore directories containing user credentials, local state, and settings.
-#   Learn more at https://abstra.io/docs
-.abstra/
-
-# Visual Studio Code
-#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
-#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
-#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
-#   you could uncomment the following to ignore the entire vscode folder
-# .vscode/
-
-# Ruff stuff:
+# Tools
 .ruff_cache/
-
-# PyPI configuration file
-.pypirc
-
-# Marimo
-marimo/_static/
-marimo/_lsp/
-__marimo__/
-
-# Streamlit
-.streamlit/secrets.toml
-compose.override.yml
+.pytest_cache/
+.mypy_cache/
+.python-version

.python-version

@@ -1 +0,0 @@
-3.12

CHANGELOG.md

@@ -7,6 +7,506 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.6] - 2026-06-18
+
+### Changed
+
+- **`MAX_AUTO_IMAGES` default lowered from 20 to 5** — existing users who have not set this variable and already have more than 5 winnow-managed images in Frigate will find themselves at cap on the next run. With `QUALITY_REPLACEMENT=true` (the default), winnow will attempt to swap weaker images rather than uploading new ones. Set `MAX_AUTO_IMAGES=20` to restore the previous behaviour.
+
+## [0.6.5] - 2026-06-17
+
+### Added
+
+- **Version displayed in startup banner**: winnow now prints its installed version at launch.
+
+### Fixed
+
+- **GPU image: `CUDAExecutionProvider` missing due to parallel install race**: `insightface` declares `onnxruntime` (CPU) as a dependency, causing `uv sync` to install both `onnxruntime` and `onnxruntime-gpu` in parallel — both packages claim the same `pybind11_state.so` binary. On GitHub Actions the CPU binary consistently won the race, leaving the GPU build without CUDA support at runtime despite all CUDA libraries being present. Fixed by reinstalling `onnxruntime-gpu` sequentially after `uv sync` to guarantee its GPU binary is on disk.
+
+- **GPU extra was missing three required nvidia pip packages**: `onnxruntime-gpu` 1.26.0 gates CUDA EP loading on the Python-importability of `nvidia-cuda-runtime-cu12`, `nvidia-cufft-cu12`, and `nvidia-curand-cu12`. These packages were not declared in the `gpu` extra and were absent on fresh installs, silently disabling GPU inference.
+
+- **`_handle_duplicate_people` raises `KeyError` on id-less person records**: bare `p["id"]` subscripts in the auto-merge loop and `_smaller_duplicate_ids` raised `KeyError` when Immich returned a person dict without an `id` field (e.g. unconfirmed face clusters). Fixed by using `p.get("id")` and filtering `None` from `skip_ids`.
+
+- **`_smaller_duplicate_ids` could include `None` in the skip set**: `p.get("id")` without a `None` guard populated `skip_ids` with `None`, causing `p.get("id") not in skip_ids` to pass for every id-less person, so unnamed face clusters were silently re-included in all return paths.
+
+- **`_handle_duplicate_people` dead code removed**: guards `if not survivor_id` and `if not merge_ids` became unreachable after the id-gate fix; their presence suggested they still ran.
+
+- **`_valid_people` in `jobs.py` used wrong name filter**: whitespace-only names (e.g. `"  "`) passed the `p.get("name")` truthiness check and were included in the person list. Fixed using `(p.get("name") or "").strip()` consistent with the cli.py gate.
+
+- **`interactive_configure` queued-marker check was O(N²)**: `[j for j in jobs if j["person"]["id"] == p.get("id")]` ran a full scan over jobs for every person in the display loop. Replaced with a `queued_ids` set hoisted before the loop.
+
+- **`executor.py` slot restore did not clear `min_quality_score_for_slot`**: when a replacement upload failed all retries after a deletion, `effective_count` was restored but the stale quality-score floor from the deleted file remained, blocking the next candidate from filling the slot.
+
+- **`get_immich_version` swallowed `KeyError` on unexpected schema**: bare `data["major"]` / `data["minor"]` / `data["patch"]` subscripts were silently caught by the surrounding `except Exception`, returning `None` without logging. Replaced with `.get()` calls that log a debug warning on unexpected schemas.
+
+- **Face embedding selects nearest face to crop centre, not largest by area**: a 25 % margin on the crop window can pull a larger neighbouring face into the bounding box; selecting the biggest face by area then embeds the wrong person. Centre-proximity is now used instead.
+
+- **Zero-norm face embeddings skipped before diversity selection**: InsightFace occasionally returns a zero vector for low-quality detections; zero embeddings pass deduplication with similarity 0 and score distance 1.0, causing them to be selected first as maximally diverse.
+
+- **`executor.py` slot restore did not clear `min_quality_score_for_slot`**: stale quality floor from the deleted file blocked the next candidate from filling the restored slot in quality-replacement mode.
+
+## [0.6.4] - 2026-06-17
+
+### Fixed
+
+- **Face bbox scaled to thumbnail space before quality filtering**: `assess_quality` now receives coordinates in thumbnail-pixel space rather than detection-image space. Previously, a face detected on a full-resolution image (e.g. 4000 px wide) was compared against `MIN_FACE_WIDTH` using its original pixel dimensions, causing faces that appear small on the thumbnail to pass the quality filter — and faces that appear large to be incorrectly rejected.
+
+- **`conf_array` default restored to 1.0 for faces with missing confidence**: the default was incorrectly set to 0.5, causing images with no `score` field in the Immich faces API response to receive a 1.7× FPS diversity boost and be selected ahead of genuinely high-confidence detections. The default is now 1.0 (no boost), treating missing confidence as neutral.
+
+- **`hard_weight` computed once outside FPS loop**: `conf_array` is constant after initialisation; moving the `np.where` call outside the `while` loop eliminates one O(n) numpy pass per selected image.
+
+- **`has_frigate_model` snapshot prevents mid-batch `recognize_face` calls on first run**: `effective_count` is incremented inside the upload loop, so using it as the `recognize_face` gate would incorrectly trigger scoring after the first upload on a first run. A boolean snapshot is now taken before the loop.
+
+- **`person_has_fscores` only set when tracker write succeeds**: the flag was moved outside the `try/except else` block, causing at-cap replacement to switch into Frigate-score mode even when the score was never written to the tracker — `get_most_redundant_mapped_file` then returned `None` and all replacement candidates were silently skipped. The flag is now set only in the `else` branch.
+
+- **`STRATEGY=skip` honoured before embedding and limit checks**: the strategy was silently converted to `auto` when InsightFace was available, because two early-returns in `_resolve_strategy` ran before the `strategy_map` lookup.
+
+- **`limit="auto"` preserved on first run**: switching to `limit = capacity` unconditionally caused the FPS adaptive early-stop to never fire on a person's first upload run. `limit="auto"` is now kept when `already_uploaded == 0`.
+
+- **`EmbeddingCache.get` falls back gracefully on all load errors**: a `MemoryError` during `np.load` of a cached embedding was re-raised, crashing the entire diversity-selection batch for that person. Cache-read failures of any kind now return `None` so the embedding is recomputed fresh.
+
+- **`get_people` returns `[]` when Immich sends `{"people": null}`**: `.get("people", [])` only uses the default when the key is absent, not when its value is `null`. Changed to `data.get("people") or []` so null-valued responses are handled the same as missing keys.
+
+- **`get_people` and `fetch_all_assets` guard against non-dict responses**: a proxy or CDN returning a JSON array (or other non-dict body) previously caused an `AttributeError` from `.get()`. Both functions now check `isinstance(data, dict)` and return an empty result with an error log.
+
+- **`filter_recent_assets` counts and logs assets with missing or unparseable timestamps** instead of silently dropping them.
+
+- **`_suppress_output` fd cleanup restructured**: the context manager now initialises `devnull_fd`, `saved_out`, and `saved_err` to `None` before the `try` block, so the `finally` can close only the descriptors that were successfully opened. Each `os.close` is wrapped in its own `try/except OSError` so a failed close cannot prevent subsequent descriptors from being released. `OSError` from `os.dup2` restore is logged at DEBUG rather than silently swallowed.
+
+- **`blur_score_from_image` copies the image before thumbnail resize**: `Image.thumbnail` modifies the image in-place. When the caller's image was already in RGB mode (no convert copy), the resize would have mutated the caller's object. A copy is now made when `score_img is img`.
+
+- **`imageWidth`/`imageHeight` zero-value treated as missing** in `image_processing.py`: the old `or img_w` fallback silently set `scale = 1.0` for a zero-valued dimension (correct) but also for `None` (also correct) with no distinction. The explicit `scale = img_w / meta_w if meta_w else 1.0` form matches the pattern used in the new `_scale_bbox_to_thumbnail` helper and makes the fallback intent clear.
+
+- **`_mark` and `update_frigate_count` copy before mutate**: both functions now create a shallow copy of the top-level tracker dict before assigning into `by_person`, so a failed `_save` cannot leave the in-memory cache ahead of the on-disk file.
+
+- **`reset_person` flat-list guard only warns when cleanup would have run**: the `isinstance(data[flat_key], list)` check previously emitted a warning even when `person_ids` was empty (a no-op call). The warning is now gated behind `person_ids and`, matching the guard on the cleanup branch.
+
+- **`_handle_duplicate_people` uses `p.get("id")` consistently**: all four return-path filter comprehensions and the `_smaller_duplicate_ids` set comprehension now use `.get("id")` instead of bare `p["id"]`, preventing a `KeyError` if the Immich API returns a person record without an `id` field.
+
+- **`K-Medoids` non-medoid membership test is O(1)**: `non_medoids` now filters against `set(medoids)` instead of the list, eliminating an O(k) scan per candidate on each outer iteration.
+
+## [0.6.3] - 2026-06-16
+
+### Fixed
+
+- **`record_frigate_files_batch` no longer mutates the tracker cache before write**: the function shared the same cache-corruption-on-write-failure bug that was fixed in `remove_frigate_files_batch` in v0.6.1 — `data.setdefault("by_person", {})` mutated the cached dict in-place, so a disk-full or permission error left the in-memory cache ahead of the on-disk file. Now uses the same copy-before-mutate pattern (shallow copies of the top-level dict and `by_person` sub-dict) so a failed write leaves cache and disk in sync.
+
+- **`tracker_ok` boolean flag replaced with try/else**: the intermediate boolean was a misleading placeholder — the `True` initial value suggested success before the operation ran. The control flow is now expressed directly with a try/except/else block.
+
+- **`LIMIT` env var guard simplified**: the two adjacent `if custom_limit is not None` checks in `_resolve_strategy` are collapsed into a single `if custom_limit is not None:` with nested branches, removing redundant evaluation.
+
+## [0.6.2] - 2026-06-16
+
+### Changed
+
+- **Flat `uploaded_asset_ids` / `rejected_asset_ids` lists dropped as primary storage**: asset IDs are now derived on read from `by_person` entries, which are the single source of truth. The legacy flat lists in existing tracker files are still read (union) so no assets become re-eligible after upgrading. New writes no longer maintain the flat lists. This removes the dual-representation sync hazard and paves the way for multi-instance support (per-instance `by_person` keying in a future release).
+
+- **Tracker writes batched per person**: `mark_uploaded` calls inside the per-person upload loop are now accumulated in memory (`begin_batch`) and flushed in a single `os.replace` write at the end of each person's loop (`flush_batch`), reducing N tracker writes per person to 1. Benefits users on slow storage (NAS, SD card, spinning disks).
+
+- **`RESET_PERSON=*` is now O(1) disk writes**: replaced the per-person `reset_person` loop with `reset_all_people()`, which makes one Frigate API call per person for file deletion and then clears both tracker files in two writes. Previously it was O(P²) iterations and 2P writes.
+
+- **`blur_score_from_image` inlines Laplacian computation**: replaced the `assess_quality()` call (which ran grayscale, exposure, and confidence checks whose results were discarded) with a direct `cv2.Laplacian` computation. The function is now self-contained and does not silently inherit future costs added to the full quality pipeline.
+
+## [0.6.1] - 2026-06-16
+
+### Fixed
+
+- **Corrupt or truncated full-res thumbnails now marked rejected**: `OSError` (truncated file) is caught alongside `PIL.UnidentifiedImageError` in the thumbnail path so persistently bad assets are tombstoned instead of retried forever. Full-res download failures (`USE_FULL_RESOLUTION=true`) remain transient — not marked rejected — so a Immich blip doesn't permanently blacklist valid assets.
+
+- **Quality replacement mode no longer flips mid-loop**: `person_has_fscores` was re-evaluated after each file deletion, which could switch the remaining replacements from Frigate-score mode to blur-score mode if the deleted file was the last scored one. The mode is now fixed for the duration of the upload loop.
+
+- **`reset_person` no longer removes shared asset IDs**: the flat `uploaded_asset_ids` list is now rebuilt from all remaining `by_person` entries rather than subtracting the reset person's IDs. Previously, resetting Alice could remove an asset ID that also appeared under Bob, making it re-eligible for upload.
+
+- **`_save` cache updated only after successful write**: the in-memory tracker cache is now updated after `os.replace` succeeds rather than before. A disk-full or permission error no longer leaves the cache permanently ahead of the on-disk file.
+
+- **Stale Frigate file cleanup batched**: the per-file `remove_frigate_file` loop is replaced with a single `remove_frigate_files_batch` call, reducing N tracker writes to 1 when stale mappings are cleaned up.
+
+- **`_migrate_entry` no longer mutates the cache through nested dict aliases**: all five nested dicts (`asset_ids`, `scores`, `frigate_scores`, `frigate_files`, `crop_dims`) are now individually copied so `.pop()` calls in write paths cannot reach the in-memory cache.
+
+- **`find_by_crop_dimension` and `_pick_mapped_file` now agree on duplicate asset→file handling**: both use first-seen-wins when the same `asset_id` maps to multiple Frigate filenames, preventing inconsistent replacement decisions.
+
+- **Non-atomic JSON write**: tracker files are written to a `.tmp` sibling then renamed with `os.replace` so a crash mid-write never leaves a truncated file.
+
+- **`get_person_summary` uses `_migrate_entry`**: replaced three ad-hoc `isinstance` guards with a single `_migrate_entry` call, making old-format (list) entries consistent with every other read path.
+
+- **Quality replacement floor check**: a candidate with a `None` blur score (PIL error during scoring) no longer blocks a freed slot — the `<=` floor comparison is only applied when a score is actually available.
+
+- **`executor.py` syntax error**: the `if img is None:` block in the full-res download path was comment-only and would have raised `IndentationError` on import. Added `pass`.
+
+- **Duplicate `if stale:` guard**: two consecutive identical guards around stale-cleanup and its log print were merged into one.
+
+- **`_flat_key` uses constant equality** instead of substring match, removing a latent routing bug for any filename that happens to contain "uploaded".
+
+- **`remove_frigate_file` no longer creates ghost entries**: returns early when the person is absent rather than writing an empty stub.
+
+- **`skip_ids` extracted to helper**: the identical set comprehension in `_handle_duplicate_people` that appeared in three branches is now a single `_smaller_duplicate_ids()` inner function.
+
+- **`blur_score_from_image` returns `None` on error** instead of `0.0`, so callers can distinguish a failed measurement from a legitimately near-zero Laplacian variance score.
+
+## [0.6.0] - 2026-06-15
+
+### Changed
+
+- **Upload tracker reverted to JSON storage**: the SQLite-based tracker introduced in v0.5.0 produced 17 bug-fix releases in two days due to data-loss risks in the migration layer, schema primary key conflicts, tracker isolation races, and disk-full retry storms. The JSON backend (`frigate_uploaded_ids.json` / `frigate_rejected_ids.json` in `DATA_DIR`) is restored. It is simpler, has no migration layer, and carries no external dependency. If you ran any v0.5.x version, delete `frigate_tracker.db` from your `DATA_DIR` once you confirm the JSON files look correct. JSON files from before v0.5.0 are read automatically with no changes required.
+
+- **`CACHE_DIR` env var accepted as `DATA_DIR` alias**: the rename introduced in v0.5.1 is preserved — `CACHE_DIR` still works with a deprecation warning. The default data path remains `data` (Docker: `/app/data`).
+
+- **Config file now lives in `DATA_DIR`**: `.immich_config.json` resolves to `DATA_DIR/.immich_config.json` so it persists across container restarts. The legacy CWD location is still checked as a fallback for existing setups.
+
+- **Diversity selector receives capacity as its limit directly**: instead of selecting up to `MAX_AUTO_IMAGES` and then slicing to the remaining capacity, the selector now runs with the actual remaining slot count as its budget.
+
+### Fixed
+
+- **Immich v2.7.5 compatibility**: `auto_configure` no longer pre-filters people by `assetCount` from `/api/people`, which Immich v2.7.5 dropped. The `MIN_FACE_COUNT` check now runs after `fetch_all_assets` using the actual fetched count.
+
+- **`fetch_face_data` no longer falls back to a wrong person's bounding box**: when `person_id` is provided but not found in the Immich `/api/faces` response, the function now returns `None` instead of using `faces[0]`. Previously a group photo where the target person's face entry was missing would inject a different person's bounding box into the crop.
+
+- **Corrupt thumbnail permanently rejected**: when `resp.ok=True` but `PIL.UnidentifiedImageError` is raised (Pillow cannot identify the image format), the asset is now marked rejected so it isn't re-downloaded on every future run. Transient `OSError`/truncation errors are intentionally not caught here — those are retried normally.
+
+- **`mark_uploaded` tracker failure no longer aborts the upload loop**: a tracker write failure after a successful Frigate POST is logged and the loop continues; the asset will be re-uploaded on the next run rather than the current run dying mid-job.
+
+- **`progress.remove_task` now in `finally` block**: the progress bar task is cleaned up even when a job exits via an exception, preventing orphaned progress rows in the terminal.
+
+- **`SKIP_PEOPLE`/`ONLY_PEOPLE` now strip whitespace**: `"Alice, Bob".split(",")` produces `[" Bob"]`; the leading space now stripped so comma-separated values with spaces work as expected.
+
+- **`FRIGATE_URL` with trailing slash no longer produces double-slash paths**: all Frigate API calls now use `_get_frigate_url()` for URL normalization rather than reading `FRIGATE_URL` inline.
+
+- **Frigate version `v`-prefix now stripped**: `v0.16.0`-style version strings are correctly parsed.
+
+- **Invalid numeric env var values warn and use defaults**: a typo such as `YEARS_FILTER=10 ` (trailing space) or `MIN_FACE_WIDTH=auto` now logs a `WARNING` and falls back to the documented default instead of raising `ValueError` at startup. Affects `YEARS_FILTER`, `MIN_FACE_WIDTH`, `MIN_FACE_COUNT`, `MAX_AUTO_IMAGES`, `BLUR_THRESHOLD`, `MIN_CONFIDENCE`, and `FACE_MARGIN`.
+
+- **`IMMICH_URL` blank placeholder falls back to config file**: `IMMICH_URL=` (empty or blank) in `.env` is now treated as unset and falls through to `DATA_DIR/.immich_config.json`, matching pre-v0.5.0 behaviour.
+
+- **Reconciliation checks Frigate immediately before first sleep**: the poll loop now performs an immediate check after upload, then backs off with `(1, 2, 4, 8)` s delays only if needed.
+
+- **Dockerfile unknown `VARIANT` now fails loudly**: an unrecognised value now exits with an error instead of silently falling through to the cpu branch.
+
+- **Embedding cache writes are now atomic**: `.npy` files are written to a `.tmp` sibling and renamed into place with `os.replace`, preventing truncated cache entries on process kill.
+
+- **`EmbeddingCache` singleton re-creates when `DATA_DIR` changes**: prevents test runs from sharing cache state across different `DATA_DIR` values.
+
+### Added
+
+- **Diversity test suite** (PR #11): 33 tests covering k-medoids clustering, farthest-point sampling, adaptive threshold computation, near-duplicate deduplication, and time-spread selection. Total: 93 tests.
+
+## [0.4.11] - 2026-06-14
+
+### Removed
+
+- **Object mode pipeline fully removed**: YOLO object detection, SigLIP image classification, `TRAINING_MODE`, and `OBJECT_CLASS` env vars are gone. Frigate has no training API for objects; the ~2 GB model stack (torch, torchvision, transformers, ultralytics) was dead weight.
+- **Dead Immich embedding path removed**: `FaceData.embedding` field and the `immich_embedding` parameter to `get_embedding()` were never consumed by any caller. Both removed along with the NumPy import in `immich_api.py` that existed solely for that path.
+- **Dead `mode` config key removed**: `"mode": "face"` was written into job config dicts in `jobs.py` but never read after object mode removal.
+
+### Fixed
+
+- **InsightFace `FutureWarning` suppressed in crop-alignment path**: the `insightface_app.get()` call in `image_processing.py` now wraps the same `warnings.catch_warnings()` suppressor already present in `embeddings.py`, preventing scikit-image deprecation noise in logs.
+
+### Changed
+
+- **Variant pyproject files synced to current state**: `pyproject-rocm.toml`, `pyproject-cpu.toml`, `pyproject-intel.toml` were at v0.2.13 and still listed torch/transformers/ultralytics. Updated to v0.4.11 and cleaned to face-only deps. Note: corresponding lockfiles (uv-rocm.lock, uv-cpu.lock, uv-intel.lock) need regeneration in their respective platform environments.
+- **`MERGE_DUPLICATE_PEOPLE` documented**: README and wiki now explain the default warn-and-skip behaviour vs. setting `true` for a permanent Immich merge, with irreversibility callout.
+- **Wiki fully updated**: all five wiki pages rewritten to remove object mode references, correct model size (~300 MB InsightFace vs former ~1–2 GB HuggingFace+InsightFace), fix default values (`MAX_AUTO_IMAGES` 80→20, `MIN_FACE_COUNT` 0→3), add `MERGE_DUPLICATE_PEOPLE` coverage, and update GPU verification commands for current ONNX provider API.
+
+## [0.4.10] - 2026-06-14
+
+### Changed
+
+- **`MAX_AUTO_IMAGES` default lowered from `80` to `20`**: winnow is designed to fill the gap where manual Frigate training images don't exist — not to be the primary dataset. A conservative default ensures winnow-imported images remain secondary to hand-picked ones where both exist.
+
+## [0.4.9] - 2026-06-14
+
+### Changed
+
+- **`FRIGATE_SCORE_CEILING` is now dynamic by default**: previously defaulted to `0` (disabled). Now unset (default) enables a self-calibrating novelty gate — below-cap candidates are skipped if their pre-upload Frigate score exceeds the most-redundant tracked file's score. This catches conditions already covered by manually-added Frigate images that winnow cannot track. Set `FRIGATE_SCORE_CEILING=0` to disable entirely; set a positive value (e.g. `0.85`) for a fixed hard ceiling.
+- **Quality replacement branches consolidated**: the Frigate-score and blur-score replacement paths in the upload loop shared identical structure. Merged into a single code path parameterised by score source and comparison direction.
+- **`MIN_FACE_COUNT` default raised from `0` to `3`**: people with fewer than 3 tagged photos produce degenerate training sets; skipping them by default avoids noisy runs.
+- **`STRATEGY=adaptive`** is the new primary name for embedding-based diversity selection; `auto` remains a silent alias for backwards compatibility.
+- **`MERGE_DUPLICATE_PEOPLE` and `TRACE_CROP_SIZE`** added to the README env var table (were in the codebase but undocumented).
+- **CUDA version corrected** in the image tags table (was 13.3, actual base image is 12.8.1).
+
+## [0.4.8] - 2026-06-14
+
+### Changed
+
+- **Tracker write-through cache**: `upload_tracker` now keeps an in-memory copy of each JSON file keyed by its resolved path. All reads after the first hit the cache instead of disk; writes go to both disk and cache atomically. Cuts per-person disk I/O in the upload loop from ~90 reads to ~1, with no API or behaviour changes.
+
+## [0.4.7] - 2026-06-14
+
+### Changed
+
+- **`_dedup_embeddings` pre-allocated buffer**: replaced the grow-on-keep `np.vstack` pattern with a pre-allocated `(Q, D)` buffer filled row-by-row. Eliminates O(K²) copy work and the GC pressure from K intermediate heap allocations while keeping identical arithmetic for the similarity checks.
+- **`_kmedoids` cost computation vectorized**: the Python-level `sum(dist_matrix[i, medoids[labels[i]]] for i in range(n))` generator (called once per swap evaluation) is replaced with `dist_matrix[np.arange(n), np.array(medoids)[labels]].sum()` — a single numpy fancy-index + reduction, ~20–50× faster in the swap loop.
+- **`_reconcile_frigate_mappings` single-write batch**: previously called `record_frigate_file` once per uploaded file, each doing a full JSON load + save (O(L) disk round-trips per person). Now builds the full `{frigate_filename: asset_id}` mapping dict and writes it in one `record_frigate_files_batch` call (O(1) disk round-trip).
+
+## [0.4.6] - 2026-06-14
+
+### Fixed
+
+- **OOM when Immich returns many pages per person**: `fetch_all_assets` now stops fetching once 5000 assets have been collected — the diversity selection pool is already capped at 3000 items, so fetching up to 1,000,000 was wasteful and could exhaust memory on large libraries. 5000 provides ample headroom for the pool cap while bounding per-person memory to ~2 MB.
+- **Non-dict items in Immich asset pages silently skipped**: a malformed or partially-null Immich response page could include `null` or non-object items in the assets array. These are now filtered at fetch time rather than causing `AttributeError` downstream.
+
+## [0.4.5] - 2026-06-14
+
+### Fixed
+
+- **Near-duplicate dedup O(N²) allocation**: `np.vstack(kept_normed)` was rebuilt on every loop iteration even for candidates that would be dropped; the stack is now rebuilt only when a new item is kept, reducing memory pressure significantly for large pools.
+- **`quality_score` falsy-zero in dedup sort**: the sort key used `c.get("quality_score") or 0.0`, which treated a legitimate `quality_score=0.0` identically to a missing key. Changed to an explicit `None` check so zero is preserved as-is, and object-mode candidates (which have no `quality_score`) continue to sort stably to the back.
+- **Post-dedup pool not re-checked against limit**: after near-duplicate removal the pool could silently shrink below the requested limit with no warning. A second `len < limit` guard now fires after dedup and emits the same "Only N embeddings" warning that the pre-dedup guard does.
+- **`mark_rejected` could miss plain-text 400 bodies longer than 100 bytes**: `error_detail = resp.text[:100]` was being searched for the keyword `"face"` to gate `mark_rejected()`, so a response body with `"face"` after byte 100 would never mark the asset rejected and it would be retried on every future run. The `"face"` check now uses the full response body; truncation is kept only for the displayed snippet.
+- **`_safe_person_dir` raised ValueError for all person names when `output_dir` resolved to `/`**: `base + os.sep` produced `"//"` when base was `"/"`, and valid paths like `/alice` don't start with `"//"`. Fixed by using `base` directly as the prefix when `base == os.sep`.
+
+## [0.4.4] - 2026-06-14
+
+### Added
+
+- **`RESET_PERSON=*` bulk reset**: resets every tracked person at once (deletes their Frigate training files and clears tracker data). Any other value still resets that specific person by name. If a person is literally named `*` they are reset as part of the bulk operation, and a warning is printed to clarify this.
+- **Near-duplicate removal before diversity selection**: a greedy dedup pass now runs after embedding collection and before clustering. Candidates within 0.20 cosine distance of a higher-quality image are dropped, eliminating burst shots and same-event lookalike photos that produce redundant training images. The best-quality frame from each near-identical group is kept. Dropped count is logged per person.
+
+### Fixed
+
+- **HTTP 500 upload errors no longer show Frigate's misleading "Try restarting Frigate" message**: the response body is now logged at debug level only. HTTP 400 detail (e.g. "No face was detected") is still shown since it is actionable.
+- **`RuntimeWarning: Mean of empty slice`** when a person has only one image after quality filtering: `_compute_adaptive_threshold` now returns the floor value immediately when there are no pairwise distances to sample, and the k-medoids cluster count is floored at 1 to prevent `k=0`.
+- **Path traversal guard on output directory**: person names with `../` sequences or absolute paths (e.g. `/etc`) are now rejected before any filesystem operation, logging an error and skipping the job rather than writing outside the output tree.
+
+## [0.4.3] - 2026-06-14
+
+### Added
+
+- **InsightFace landmark-based face crop alignment**: face crops for Frigate training are now aligned using InsightFace's `norm_crop` (ArcFace 112×112 alignment with 5-point facial landmarks). Previously, Immich's API returned only bounding boxes with no landmarks, so `align_face()` was dead code and crops were plain bbox slices — resulting in misaligned or partial crops (e.g. foreheads). The fix runs InsightFace detection on an expanded region around the Immich bbox, finds the nearest face, and uses its keypoints for proper alignment. Controlled by `ENABLE_FACE_ALIGNMENT` (default `true`).
+- **Duplicate Immich person detection and handling**: when multiple Immich person records share the same name, winnow now detects this at startup and warns with a per-group summary. Without handling, two jobs would run for the same Frigate folder and overwrite each other's output. By default (`MERGE_DUPLICATE_PEOPLE=false`) only the first person per name is processed. Set `MERGE_DUPLICATE_PEOPLE=true` to permanently merge duplicate records inside Immich (keeps the person with the most assets).
+
+## [0.4.2] - 2026-06-13
+
+### Changed
+
+- **GPU image now uses CUDA 12.8.1** (was 13.3): CUDA 13.3 requires driver ≥ 575; driver 570 (the current stable release) was incorrectly rejected with "CUDA driver version is insufficient" at startup. The `:latest` image now works with any NVIDIA driver ≥ 570.
+
+### Added
+
+- **`scripts/benchmark.py`**: measures InsightFace and SigLIP inference latency and throughput across GPU and CPU modes. Run inside the container with `python /app/scripts/benchmark.py`. RTX 2070 SUPER results: InsightFace 12.8 ms / 78 img/s (8× CPU), SigLIP batch 32 at 5.4 ms/img / 187 img/s (33× CPU).
+
+## [0.4.1] - 2026-06-13
+
+### Fixed
+
+- **`RESET_PERSON` no longer creates duplicate Frigate files**: previously, resetting a person only wiped the local tracker — existing Frigate training files were left as unmanaged orphans, causing the next run to upload a full new batch on top of them. `reset_person` now deletes all winnow-managed files for that person from Frigate before clearing the tracker. Manually-added Frigate files are unaffected.
+- **No spurious warning when `FRIGATE_URL` is unset and `RESET_PERSON` is used**: the deletion step is now skipped silently at info level rather than logging a misleading "could not delete" warning.
+
+## [0.4.0] - 2026-06-13
+
+### Added
+
+- **Pre-upload Frigate recognition scores**: `recognize_face` is now called before each upload to measure how novel the candidate is relative to the existing training set. The score is stored in the tracker (`frigate_scores` field) and drives quality replacement in subsequent runs. Adds ~200 ms per upload.
+- **`ENABLE_FRIGATE_SCORES`** (default `true`): controls all pre-upload Frigate recognize calls. Set `false` to use blur-score replacement only and skip the Frigate round-trip entirely.
+- **`FRIGATE_SCORE_CEILING`** (default `0.0`): skip uploads whose pre-upload recognize score already exceeds this value — those face conditions are already well-covered by the training set. `0` disables (no ceiling); requires at least one prior run to have stored scores.
+- **`get_most_redundant_mapped_file()`**: new upload-tracker function that returns the mapped file with the highest Frigate pre-upload score. High score = the training set already covers that face condition well = the best deletion target for quality replacement.
+- **Cold-start notice**: first run (no existing Frigate model) now logs a clear message explaining why Frigate scores are unavailable and that they will populate on subsequent runs.
+- **4 new tests** for `get_most_redundant_mapped_file` covering score ordering, ties, excludes, and no-score cases.
+
+### Changed
+
+- **Quality replacement now uses Frigate scores**: when Frigate scores are available, at-cap replacement targets the _most redundant_ mapped file (highest pre-upload score) and replaces it only when the candidate is _more novel_ (lower score). Falls back to blur-score comparison when no Frigate scores have been stored yet.
+- **`recognize_face` returns `(face_name, score) | None`** instead of `float | None`: the caller now validates that the recognized person matches the expected person before using the score. Wrong-person scores no longer drive ceiling skips or replacement decisions.
+- **Bootstrap fix**: recognize was previously called below-cap only when `FRIGATE_SCORE_CEILING > 0`, so `frigate_scores` was never populated with default settings and the Frigate replacement path never activated. Recognize is now called for all below-cap uploads when `ENABLE_FRIGATE_SCORES=true`, seeding scores for future at-cap runs regardless of ceiling setting.
+- **Batch GET `/api/faces`**: Frigate file-count lookups are now batched to reduce round-trip overhead on runs with many people.
+- **Skip candidate download on low Frigate confidence**: candidates where the Immich detection confidence is below threshold are now filtered before the full-resolution download, saving bandwidth.
+
+### Removed
+
+- **Post-upload quality gate (`FRIGATE_SCORE_THRESHOLD`)**: enforcement of a Frigate score threshold after upload has been removed. Post-upload scores are taken after the image is already in the training set, so the model has already retrained on it — deleting it at that point is wasteful and disrupts the model for the next Frigate run. Pre-upload scoring (`FRIGATE_SCORE_CEILING`) provides a cleaner signal at the right moment.
+
+### Fixed
+
+- **Frigate replacement path never activated with default settings**: with `FRIGATE_SCORE_CEILING=0.0` (default), the bootstrap call to `recognize_face` was gated behind `CEILING > 0`, so `frigate_scores` stayed empty, `has_frigate_scores` was always False, and the Frigate replacement branch was permanently unreachable. Removing the ceiling guard from the below-cap recognize call breaks the circular dependency.
+- **Schema comment contradiction**: `upload_tracker.py` line-16 comment described `frigate_scores` as "post-upload" while the block comment on lines 22–24 said "pre-upload". Corrected to "pre-upload" throughout.
+- **README default values**: `MIN_FACE_WIDTH` was documented as `50` (actual default: `90`); `BLUR_THRESHOLD` was documented as `100.0` (actual default: `120.0`). Both corrected.
+- **README missing env vars**: `FRIGATE_SCORE_CEILING` and `ENABLE_FRIGATE_SCORES` were present in `config.py` and `.env.example` but absent from the README env var table. Both added.
+- **README quality-replacement description**: Step 8 and the `QUALITY_REPLACEMENT` row now document the dual-mode behaviour (Frigate-score path and blur-score fallback) instead of describing only the original blur-score path.
+
+## [0.3.3] - 2026-06-13
+
+### Fixed
+
+- **`MIN_FACE_WIDTH` default raised from 50 → 90px**: 50px crops produce 2,500–4,225 total pixels, well below Frigate's own camera capture range of 16k–50k px. 90px guarantees ≥8,100 total pixels even when face margins are fully clipped by image edges, keeping winnow training crops above the floor Frigate considers useful.
+
+## [0.3.2] - 2026-06-13
+
+### Added
+
+- **Crop dimension tracing**: winnow now records the pixel dimensions (width × height) of each face crop at upload time in the tracker (`crop_dims` field). Run `TRACE_CROP_SIZE=3848 winnow` to look up which Immich asset produced a crop with that pixel dimension — output includes person name, asset ID, Immich URL, blur score, and the Frigate filename. Useful for tracing low-quality or unexpected images visible in Frigate back to their source.
+
+## [0.3.1] - 2026-06-13
+
+### Fixed
+
+- **Lint**: split overly long line in `quality.py` (`E501`, 146 → ≤120 chars).
+- **CI — lockfile update workflow**: added `branches: ['**']` filter to `on.push` so tag pushes no longer trigger the job; tag checkouts land in detached HEAD and the subsequent `git push` had no branch target.
+- **CI — release workflow**: split four Docker image builds into parallel jobs (`build-gpu`, `build-cpu`, `build-rocm`, `build-intel`), each with its own runner. Previously all four ran in a single job; building the GPU and CPU multi-platform images exhausted disk, causing ROCm and Intel builds to be cancelled.
+
+## [0.3.0] - 2026-06-13
+
+### Added
+
+- **`get_tracked_frigate_filenames()`** — new upload-tracker function that returns the set of Frigate filenames currently mapped for a person. Used internally as a reconciliation baseline when the Frigate GET endpoint is unreachable; also available to callers that need the mapped filename set without a count.
+- **Community scaffolding**: `CONTRIBUTING.md`, `SECURITY.md`, GitHub issue templates (bug report, feature request), and pull request template.
+- **OCI image labels**: `org.opencontainers.image.*` labels added to the runtime stage of the Dockerfile so image metadata is surfaced by container registries.
+- **Additional tracker tests**: coverage added for `get_tracked_frigate_filenames` and for `get_lowest_quality_mapped_file` with the `exclude` parameter.
+
+### Fixed
+
+- **Quality score scale mismatch (USE_FULL_RESOLUTION=true)**: the time-spread quality-score fallback called `assess_quality` on the full-resolution download, while the embedding path always scores on preview thumbnails. Laplacian variance scales with image resolution, so the two paths produced incomparable scores for people with mixed-mode files. The fallback now caps the image at 1440 px before scoring to match the thumbnail scale.
+- **assess_quality failure left file permanently unreplaceable**: if `assess_quality` raised an exception (e.g. an RGBA image with an unsupported channel count), `score_map` kept `None` and `mark_uploaded(score=None)` skipped writing the score. The uploaded file was then permanently invisible to `get_lowest_quality_mapped_file` because it had no entry in `scores{}`. The fallback now converts the image to RGB before scoring and stores `0.0` on any exception, so every uploaded file is eligible for future quality replacement.
+- **Uploads during Frigate GET outage never mapped**: when `GET /api/faces` failed at upload start, the reconciliation guard (`_snapshot is not None`) correctly skipped the post-upload diff — but uploads that succeeded during the outage were never recorded in `frigate_files`, causing `get_tracked_frigate_file_count` to permanently under-report and Frigate to eventually exceed `MAX_AUTO_IMAGES`. The code now uses the tracker's mapped filenames as a pre-upload baseline when the live snapshot is unavailable, so reconciliation proceeds normally (the `>target` guard handles concurrent external uploads as before).
+- **Freed quality-replacement slot could be filled by a worse image**: when a replacement delete succeeded but the subsequent upload failed all retries, `effective_count` stayed decremented and the next file in the iteration uploaded unconditionally — it could have a lower quality score than the file that was deleted. A `min_quality_score_for_slot` variable now records the deleted file's score on a successful delete; any candidate that doesn't beat that floor is skipped until the slot is filled by a qualifying image or the run ends.
+- **CI multi-arch and lockfile bot**: hardened the build workflow — lockfile-update bot no longer races against Docker publish on the same push event; CPU image now builds for both `linux/amd64` and `linux/arm64`; `paths-ignore` prevents documentation-only pushes from triggering image builds.
+- **README pipeline diagram updated**: step 8 now explicitly documents the quality-replacement decision tree (`below cap → upload`, `at cap + enabled → swap if better`, `at cap + disabled → skip`).
+
+## [0.2.13] - 2026-06-13
+
+### Added
+
+- **Quality replacement**: when a person is at `MAX_AUTO_IMAGES`, winnow now checks each new candidate against the lowest-quality image already in Frigate and swaps it in if the new image scores higher. Only images winnow uploaded (tracked in `frigate_files`) are ever replaced — files added manually through Frigate's UI are left untouched permanently. Enabled by default; set `QUALITY_REPLACEMENT=false` to revert to the previous behaviour of skipping people at cap.
+- **Frigate filename mapping**: each successful upload now records the mapping from Frigate's assigned filename to the originating Immich asset ID and face confidence score in the tracker (`frigate_files` field). This is the foundation for quality replacement and future management of the Frigate training set.
+- **`QUALITY_REPLACEMENT` env var** (default `true`): controls whether at-cap people are eligible for quality replacement. When disabled, people at `MAX_AUTO_IMAGES` are skipped as before.
+- **NOTICES file**: third-party attribution for if_curator (MIT, Copyright © 2026 Sebastian) added to satisfy upstream license requirements.
+
+## [0.2.12] - 2026-06-13
+
+### Added
+
+- **ROCm (AMD GPU) support**: new `:rocm` image tag. InsightFace runs via `ROCmExecutionProvider`; SigLIP runs via PyTorch ROCm 6.3 (ROCm builds expose `torch.cuda.is_available() == True`, so the existing CUDA path is reused automatically). Requires `/dev/kfd` and `/dev/dri` device passthrough plus `video` and `render` group membership — see `compose.yml` for the snippet.
+- **Intel GPU support**: new `:intel` image tag. InsightFace runs via `OpenVINOExecutionProvider` from `onnxruntime-openvino`. By default OpenVINO targets CPU (no device passthrough needed); set `OPENVINO_DEVICE=GPU` to target Intel Arc discrete or integrated graphics. Intel's GPU compute runtime (Level Zero + OpenCL ICD) is installed automatically from Intel's official graphics repo in the image — no manual package installation required. SigLIP uses CPU inference for now (Intel Extension for PyTorch has no Python 3.13 wheels yet; the `torch.xpu` path is wired and will activate automatically when they ship).
+- **`OPENVINO_DEVICE` env var**: controls the OpenVINO execution provider device for the `:intel` variant. `CPU` (default) requires no device passthrough. `GPU` targets Intel Arc discrete and integrated graphics via Level Zero.
+- **AMD and Intel device passthrough snippets in `compose.yml`**: documented as commented-out alternatives to the NVIDIA `deploy:` block.
+- **`:rocm` and `:intel` CI jobs**: `docker-publish.yml` now builds and pushes `:rocm` / `:dev-rocm` and `:intel` / `:dev-intel` alongside `:latest` and `:cpu`. `release.yml` builds all four variants on tag push.
+
+### Fixed
+
+- **Interactive custom-count prompt firing for all choices**: in the no-embedding fallback path of the strategy selector, `IntPrompt.ask` was inside a dict literal and evaluated eagerly — users selecting Standard (30) or Broad (100) were still prompted to enter a custom image count. Each choice is now handled in a dedicated branch.
+
+## [0.2.11] - 2026-06-12
+
+### Fixed
+
+- **GPU broken on x86_64 Linux**: `insightface` 1.0.1 (pulled in by the 0.2.10 lock update) added a hard dependency on the CPU `onnxruntime` package. Combined with an incorrect `override-dependencies` entry introduced in 0.2.10, both `onnxruntime` (CPU) and `onnxruntime-gpu` were being installed into the same venv. The CPU package landed last and overwrote the GPU one, causing `CUDAExecutionProvider` to disappear from the provider list even when a GPU was present. Fixed by declaring `onnxruntime` and `onnxruntime-gpu` as conflicting packages in uv's resolver, ensuring only the correct one is installed per platform.
+- **OOM crash on large person libraries (CPU mode)**: All candidate thumbnails were downloaded into a single in-memory dict before any processing began. At ~5 MB per decoded preview image, a person with 472 candidates would accumulate ~2.4 GB of thumbnail data alone, exhausting a 4 GB container memory limit. Thumbnails are now downloaded and processed in batches of 32, with each image released immediately after embedding. Peak in-flight thumbnail memory is now bounded to ~256 MB regardless of candidate pool size. GPU users also benefit from lower host RAM pressure and faster time-to-first-result on large libraries.
+
+## [0.2.10] - 2026-06-12
+
+### Added
+
+- **`VERBOSE` env var**: set `VERBOSE=true` to enable DEBUG-level console output. The log file always captures DEBUG; this flag controls what appears on the terminal. Useful when diagnosing issues without a full shell into the container.
+- **`:cpu` Docker image tag**: a separate CPU-only image (`ghcr.io/sudolulo/winnow:cpu`) is now built and pushed alongside `:latest`. Uses `onnxruntime` instead of `onnxruntime-gpu`; ~2 GB smaller. Suitable for systems without an NVIDIA GPU.
+- **Empty `CRON_SCHEDULE` keeps container alive**: setting `CRON_SCHEDULE=` (empty string) starts the container without running immediately and without exiting — useful for `docker exec` ad-hoc runs on a long-lived container. Previously, an empty value was treated the same as unset (run once, then exit).
+
+### Changed
+
+- **TTY auto-detection replaces `AUTO_MODE`**: winnow now detects whether a TTY is attached (`sys.stdin.isatty()`) and switches between interactive and auto mode automatically. `AUTO_MODE=true` becomes an explicit override for forcing auto mode in a terminal session. No config change needed for normal Docker deployments.
+- **Logging levels audited**: internal algorithmic detail (clustering steps, asset fetch progress, per-page pagination) demoted from INFO to DEBUG. INFO now reflects meaningful pipeline milestones only (model ready, selection complete, quality filtered). Reduces noise in production logs without losing information.
+- **Model load logging improved**: SigLIP and InsightFace loading now reports cache hit/miss, download size estimate, device used, and load time.
+
+### Fixed
+
+- **GPU OOM crash loop (production)**: `CUDAExecutionProvider` was silently absent even with a GPU attached, causing InsightFace to run on CPU and exhaust RAM processing large person libraries. Root cause: CUDA/cuDNN libraries in nvidia pip packages were invisible to onnxruntime. Fixed by running `ldconfig` over all `nvidia-*/lib/` directories in the venv at image build time.
+- **ldconfig path now Python-version-agnostic**: the `find` command used to register nvidia pip libraries hardcoded `python3.13`; replaced with `python3.*` glob so the path survives a Python upgrade without silently producing an empty ldconfig config.
+- **`PYTHONPATH=/app` added to Dockerfile**: the entry point script sets `sys.path[0]` to the script directory, not `/app`. Since `uv sync` runs before `COPY winnow/`, the wheel has only dist-info in site-packages. `PYTHONPATH=/app` makes the `winnow` package importable without reverting to `python -m`.
+- **CPU fallback retrying broken GPU provider**: InsightFace CPU fallback omitted `providers=["CPUExecutionProvider"]`, causing onnxruntime to retry `CUDAExecutionProvider` on every inference call. Now explicitly sets the CPU provider and suppresses C-extension noise via fd-level redirect.
+- **`_suppress_output` stderr loss on fd exhaustion**: if the first `os.dup2` in the finally block raised `OSError`, the second call was skipped, permanently redirecting stderr to `/dev/null` for the process lifetime. Wrapped in nested `try/finally` so both restores are always attempted.
+- **Frigate `/api/faces` response parsing**: the response is `{person_name: [files], "train": [...]}` — `"train"` is a flat pending list, not a person. Previous code called `.items()` on the `"train"` value (a list), crashing with `AttributeError`. Now skips the `"train"` key explicitly.
+- **Immich 401 detection**: a stale or invalid API key now logs a clear error message (`Immich API key is invalid or expired (401 Unauthorized)`) instead of raising an unhandled exception.
+- **Falsy-zero detection confidence**: `face.get("score") or face.get("confidence")` treated a valid `score=0.0` as falsy, falling through to the `confidence` field (often `None`). Replaced with an explicit `None` check. Affected both quality filtering and hard-example weighting in diversity selection.
+- **Face crop using wrong person's image dimensions**: in multi-person assets, `_crop_face_from_thumbnail`'s scale-factor loop matched the first person with any face regardless of `person_id`, producing incorrectly scaled bounding box coordinates for the target person. Loop now applies the same `person_id` filter as `_get_face_bbox`.
+- **Adaptive stopping bypassed for partially-trained people**: in auto mode with `already_uploaded > 0`, `limit` was converted from `"auto"` to an integer, disabling the FPS adaptive threshold and early-stop check. Now keeps `limit="auto"` through selection and trims the result to the remaining capacity afterward.
+- **Embedding cache key mismatch**: HuggingFace cache path check hardcoded the model slug string; replaced with a derivation from `model_name` using `"models--" + model_name.replace("/", "--")` so the check stays correct if the model name changes.
+- **Scheduler: sleep until next run**: the loop slept a fixed 60 seconds regardless of schedule interval, causing runs to fire up to 59 seconds late and waking the process unnecessarily on long schedules (e.g. weekly). Now sleeps exactly until `next_run`.
+- **Scheduler swallowing `SystemExit`**: `except BaseException` in the run wrapper was replaced with `except Exception` (with `KeyboardInterrupt` re-raised above), so `sys.exit()` calls propagate correctly.
+- **Log handler leak**: `setup_logging` now closes and removes existing handlers before adding new ones, preventing file handle accumulation across repeated calls.
+- **`RETRY_REJECTED` silently applied in interactive mode**: the env var was applied unconditionally even in interactive sessions. Now used only as the default for the interactive prompt so users can override it per-run.
+- **`compose.yml` comment inverted**: a comment stated `-it` forces non-interactive mode; corrected to reflect that `-it` allocates a TTY (interactive mode).
+
+### Security
+
+- API key is no longer stored in any config file. All authentication uses environment variables or `.env` only.
+
+## [0.2.9] - 2026-06-12
+
+### Fixed
+
+- **arm64: `onnxruntime-gpu` has no arm64 wheels**: `onnxruntime-gpu` only publishes `manylinux_2_27_x86_64` and `manylinux_2_28_x86_64` wheels — `uv sync` on arm64 failed with exit code 2. Gated `onnxruntime-gpu` behind `sys_platform == 'linux' and platform_machine == 'x86_64'`; arm64 and non-Linux installs now get the CPU `onnxruntime` package instead.
+- **uv lockfile now covers arm64**: Added `required-environments` to `[tool.uv]` so the lockfile is solved for both `linux/x86_64` and `linux/aarch64`, preventing silent resolution gaps for the non-build platform.
+
+## [0.2.8] - 2026-06-12
+
+### Fixed
+
+- **Dockerfile: use `add-apt-repository` with isolated GNUPGHOME**: the `curl | gpg --dearmor` approach was silently failing — gpg exits 0 on bad/empty input, leaving an invalid keyring and causing apt to skip the deadsnakes PPA entirely. Reverted to `add-apt-repository ppa:deadsnakes/ppa` with `GNUPGHOME=$(mktemp -d)` to prevent gpg from touching any pre-existing agent socket (the original QEMU crash cause).
+- **arm64 base: removed `--platform=$BUILDPLATFORM`**: the Ubuntu 24.04 base for arm64 is now pulled for the target platform, so the arm64 image contains real arm64 binaries rather than amd64 binaries in an arm64 manifest.
+
+### Changed
+
+- **License changed from MIT to AGPLv3+**: source and network use of winnow now require derivative works to be open-sourced under the same terms.
+
+## [0.2.7] - 2026-06-12
+
+### Fixed
+
+- **arm64 base reverted to Ubuntu 24.04**: Ubuntu 26.04 ships Python 3.14, not 3.13 — `python3.13` was not locatable in its repos. Reverted arm64 base to `ubuntu:24.04`.
+- **Deadsnakes PPA now uses curl+gpg instead of `add-apt-repository`**: `add-apt-repository` spawns a gpg-agent which crashes under QEMU (arm64 CI). The PPA is now added by fetching the key via `curl` and piping through `gpg --dearmor` — no agent, works on both architectures.
+- **PPA conditional removed**: both amd64 (Ubuntu 22.04 CUDA) and arm64 (Ubuntu 24.04) now go through the same deadsnakes install path, eliminating the per-arch branching and the `ARG TARGETARCH` dependency in RUN commands.
+
+## [0.2.6] - 2026-06-12
+
+### Fixed
+
+- **Dockerfile: `ARG TARGETARCH` re-declared in each stage**: Docker's automatic platform ARGs are only in scope for `FROM` instructions, not `RUN` commands. The `$TARGETARCH` variable in the deadsnakes PPA conditional was silently empty, so the PPA was never added and `python3.13` could not be located on the Ubuntu 22.04 CUDA base. Adding `ARG TARGETARCH` at the top of both the `build` and `runtime` stage bodies fixes the amd64 build.
+
+## [0.2.5] - 2026-06-12
+
+### Changed
+
+- **CUDA base upgraded to 13.3.0**: amd64 base image bumped from `nvidia/cuda:12.9.2-cudnn-runtime-ubuntu22.04` to `nvidia/cuda:13.3.0-cudnn-runtime-ubuntu22.04`. Python packages (torch, onnxruntime-gpu) still target CUDA 12.6 via pip-installed libraries; the base image upgrade requires a host GPU driver that supports CUDA 13+.
+- **`torchvision>=0.27.0` added as explicit dependency**: routed through the `pytorch-cu126` index for linux/x86_64, ensuring it resolves to `0.27.0+cu126` (paired with `torch 2.12.0+cu126`) rather than being pulled from PyPI where the older `0.21.0` wheel would downgrade torch to 2.6.0.
+- **`torch>=2.12.0`** floor raised from 2.6.0 to prevent silent downgrade.
+- **`nvidia-cudnn-cu12>=9.0.0`** floor kept intentionally loose — torch pins an exact cuDNN ABI version (`9.10.2.21`) and must own that constraint.
+
+## [0.2.4] - 2026-06-12
+
+### Changed
+
+- **Python 3.13 across all platforms**: bumped from 3.12 to 3.13. amd64 installs Python 3.13 from the deadsnakes PPA on the Ubuntu 22.04 CUDA base; arm64 uses the Python 3.13 package available natively in Ubuntu 26.04. All confirmed dependencies (`insightface 1.0.1`, `onnxruntime-gpu 1.26.0`, `torch 2.12.0+cu126`) have Python 3.13 wheels.
+- **arm64 base: Ubuntu 26.04**: Python 3.12 was removed from Ubuntu 26.04's default repos; upgrading the base pulls Python 3.13 without a PPA.
+- **`requires-python = ">=3.13"`** and `target-version = "py313"` updated in `pyproject.toml`.
+- **CI updated to Python 3.13**: `test.yml` and `update-lockfile.yml` now install Python 3.13.
+- **`uv.lock` regenerated** for Python 3.13.5.
+
+## [0.2.3] - 2026-06-12
+
+### Fixed
+
+- **Clear-text API key storage**: `config.py` no longer writes `API_KEY` to `.immich_config.json`. The key must come from an environment variable or `.env` file. Interactive mode now prints a tip directing users to `.env`. Resolves CodeQL `py/clear-text-storage-sensitive-data`.
+
+### Changed
+
+- **CI workflow permissions**: `test.yml` and `lint.yml` now declare `permissions: contents: read`, following least-privilege principle and resolving `actions/missing-workflow-permissions` scanner alerts.
+- **CI lockfile race condition**: removed the `verify-lockfile` pre-job from `docker-publish.yml` and `release.yml`. The `update-lockfile.yml` bot maintains the lockfile; the verify step raced against it on the same push event and caused false failures. `release.yml` now runs `uv lock` inline so tag-triggered builds are always self-consistent.
+- **Docs moved to wiki**: `docs/` folder removed from the repository. Setup, Troubleshooting, and FAQ pages are now at the [GitHub wiki](https://github.com/sudolulo/winnow/wiki).
+
+## [0.2.2] - 2026-06-12
+
+### Added
+
+- **Confidence scores in upload tracker**: Immich face confidence scores are now stored per asset in `frigate_uploaded_ids.json` under `by_person[name].scores`. Lays the groundwork for future replacement logic (remove low-confidence uploads when better images are found).
+- **Frigate-authoritative capacity tracking**: At startup, `GET /api/faces` is queried on the Frigate host to retrieve the actual number of trained images per person from the `train` directory (pending/unclassified queue is excluded). This count is stored as `frigate_count` in the tracker JSON so it survives Frigate downtime.
+- **Lifetime cap uses Frigate count**: `MAX_AUTO_IMAGES` is now enforced against Frigate's live training image count rather than the local uploaded-asset tally. Fallback priority: live Frigate API → last cached `frigate_count` in JSON → local uploaded count.
+- **Startup summary shows Frigate count**: Tracker summary at startup now includes the last known Frigate training count per person (e.g. `78 uploaded, 2 rejected, 42 in Frigate`).
+- **`winnow/frigate_api.py`**: new module encapsulating Frigate API helpers; currently exposes `get_frigate_face_counts()`.
+
+### Changed
+
+- `upload_tracker.py`: `by_person` entries migrated from flat list to `{asset_ids, scores, frigate_count}` dict. Old list format is read and migrated transparently on first write.
+- `mark_uploaded()` now accepts an optional `score` keyword argument.
+- `get_person_summary()` now returns `frigate_count` and `scores` fields alongside `uploaded` and `rejected`.
+
 ## [0.2.1] - 2026-06-12
 
 ### Fixed

CONTRIBUTING.md

@@ -0,0 +1,48 @@
+# Contributing to winnow
+
+Bug reports, feature requests, and pull requests are all welcome.
+
+## Before You Start
+
+- Check [existing issues](https://github.com/sudolulo/winnow/issues) to avoid duplicates.
+- For large changes, open an issue first to discuss the approach.
+- All PRs target the `dev` branch — never `main` directly.
+
+## Development Setup
+
+Requires Python 3.13+ and [uv](https://astral.sh/uv).
+
+```bash
+git clone https://github.com/sudolulo/winnow.git
+cd winnow
+git checkout dev
+uv sync
+git config core.hooksPath .githooks
+```
+
+The last line activates the project's git hooks. The pre-commit hook automatically runs `uv lock` and stages the result whenever `pyproject.toml` is part of a commit, keeping the lockfile in sync without any extra steps.
+
+## Running Tests and Lint
+
+```bash
+uv run pytest          # run the test suite
+uv run ruff check      # lint
+uv run ruff check --fix  # auto-fix lint issues
+```
+
+CI runs both on every push and PR to `main` and `dev`. PRs must pass before merging.
+
+## Pull Request Guidelines
+
+- One logical change per PR.
+- If you add behaviour, add a test for it.
+- Keep the `CHANGELOG.md` entry in the `[Unreleased]` section updated.
+- Commit messages should be plain English describing what changed and why.
+
+## Development Tooling
+
+Development uses Claude Code (Anthropic) for implementation assistance. All code is reviewed and the final call on design, behavior, and what ships is made by the maintainer. Contributions from humans are equally welcome.
+
+## License
+
+By submitting a contribution you agree that your work will be released under the project's [AGPLv3+ license](LICENSE).

Dockerfile

@@ -1,76 +1,136 @@
-# ── Platform-conditional base ─────────────────────────────────────────────
-#   amd64:  NVIDIA CUDA 12.6 (GPU acceleration when available, CPU fallback)
-#   arm64:  Plain Ubuntu (CPU-only, no CUDA on ARM)
+# ── Base images ───────────────────────────────────────────────────────────────
+#   amd64 + gpu:   NVIDIA CUDA 12.8 + cuDNN on Ubuntu 24.04 (highest Ubuntu NVIDIA publishes)
+#   amd64 + rocm:  Ubuntu 26.04 (AMD GPU via ROCm — pass /dev/kfd and /dev/dri)
+#   amd64 + intel: Ubuntu 22.04 (Intel Arc / iGPU via OpenVINO — pass /dev/dri)
+#                  Note: intel stays on 22.04 — Intel's GPU repo only publishes for jammy
+#   amd64 + cpu:   Ubuntu 26.04 (CPU-only, ~2 GB smaller image)
+#   arm64:         Ubuntu 24.04 (CPU-only; no CUDA/ROCm wheels on ARM)
 
-FROM --platform=$BUILDPLATFORM nvidia/cuda:12.9.2-cudnn-runtime-ubuntu22.04 AS base-amd64
-FROM --platform=$BUILDPLATFORM ubuntu:22.04 AS base-arm64
+ARG VARIANT=gpu
 
-# ── Build stage ───────────────────────────────────────────────────────────
+FROM --platform=$BUILDPLATFORM nvidia/cuda:12.9.2-cudnn-runtime-ubuntu24.04 AS base-amd64-gpu
+FROM ubuntu:26.04 AS base-amd64-rocm
+FROM ubuntu:22.04 AS base-amd64-intel
+FROM ubuntu:26.04 AS base-amd64-cpu
+FROM ubuntu:24.04 AS base-arm64-gpu
+FROM ubuntu:24.04 AS base-arm64-rocm
+FROM ubuntu:24.04 AS base-arm64-intel
+FROM ubuntu:24.04 AS base-arm64-cpu
+
+# ── Build stage ───────────────────────────────────────────────────────────────
 ARG TARGETARCH
 
-FROM base-${TARGETARCH} AS build
+FROM base-${TARGETARCH}-${VARIANT} AS build
 
+ARG VARIANT=gpu
 ENV DEBIAN_FRONTEND=noninteractive
 
+# All base images get Python 3.13 from the deadsnakes PPA (26.04 ships 3.14 natively;
+# 3.13 is used to keep dependencies tested and aligned). GNUPGHOME is isolated
+# so gpg never contacts an agent socket under QEMU.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    curl \
-    gnupg \
-    software-properties-common \
-    && add-apt-repository ppa:deadsnakes/ppa -y \
-    && apt-get update && apt-get install -y --no-install-recommends \
-    python3.12 python3.12-venv python3.12-dev \
+    ca-certificates curl gnupg software-properties-common \
+    && GNUPGHOME=$(mktemp -d) add-apt-repository ppa:deadsnakes/ppa -y \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+    python3.13 python3.13-venv python3.13-dev \
     libgl1 libglib2.0-0 libxext6 g++ \
     && rm -rf /var/lib/apt/lists/* \
-    && ln -sf /usr/bin/python3.12 /usr/bin/python3
+    && ln -sf /usr/bin/python3.13 /usr/bin/python3
 
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
-    && cp /root/.local/bin/uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.21 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
 COPY pyproject.toml uv.lock ./
-RUN uv sync --frozen --no-dev \
-    && uv cache clean
+RUN if [ "$VARIANT" = "cpu" ]; then \
+        uv sync --frozen --no-dev --extra cpu; \
+    elif [ "$VARIANT" = "rocm" ]; then \
+        uv sync --frozen --no-dev --extra rocm; \
+    elif [ "$VARIANT" = "intel" ]; then \
+        uv sync --frozen --no-dev --extra intel; \
+    elif [ "$VARIANT" = "gpu" ]; then \
+        uv sync --frozen --no-dev --extra gpu && \
+        ORT_GPU_VER=$(.venv/bin/python -c "import importlib.metadata; print(importlib.metadata.version('onnxruntime-gpu'))") && \
+        uv pip install --python .venv/bin/python --no-deps --reinstall "onnxruntime-gpu==$ORT_GPU_VER"; \
+    else \
+        echo "Unknown VARIANT: '$VARIANT'. Must be one of: cpu, rocm, intel, gpu" >&2; \
+        exit 1; \
+    fi && \
+    uv cache clean
 
 COPY winnow/ winnow/
 COPY entrypoint.sh scheduler.py ./
 RUN chmod +x /app/entrypoint.sh
 
-# ── Runtime stage ─────────────────────────────────────────────────────────
+# ── Runtime stage ─────────────────────────────────────────────────────────────
 #   Starts fresh from the base image — excludes build tools (g++,
-#   python3.12-dev, curl, gnupg) that are not needed at runtime.
+#   python3.13-dev, gnupg, software-properties-common) not needed at runtime.
 
-FROM base-${TARGETARCH} AS runtime
+FROM base-${TARGETARCH}-${VARIANT} AS runtime
 
+ARG VARIANT=gpu
+ARG VERSION=dev
+LABEL org.opencontainers.image.title="winnow" \
+      org.opencontainers.image.description="Selects diverse, high-quality photos from Immich as training data for Frigate face recognition." \
+      org.opencontainers.image.source="https://github.com/sudolulo/winnow" \
+      org.opencontainers.image.licenses="AGPL-3.0-or-later" \
+      org.opencontainers.image.version="${VERSION}"
 ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    software-properties-common \
-    tini \
-    && add-apt-repository ppa:deadsnakes/ppa -y \
-    && apt-get update && apt-get install -y --no-install-recommends \
-    python3.12 python3.12-venv \
+    ca-certificates curl gnupg software-properties-common tini \
+    && GNUPGHOME=$(mktemp -d) add-apt-repository ppa:deadsnakes/ppa -y \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+    python3.13 python3.13-venv \
     libgl1 libglib2.0-0 libxext6 \
+    && apt-get purge -y --auto-remove curl gnupg software-properties-common \
     && rm -rf /var/lib/apt/lists/* \
-    && ln -sf /usr/bin/python3.12 /usr/bin/python3
+    && ln -sf /usr/bin/python3.13 /usr/bin/python3
 
 # Copy app (with .venv) and uv from build stage
 COPY --from=build /app /app
 COPY --from=build /usr/local/bin/uv /usr/local/bin/uv
 
-# Expose CUDA/cuDNN libraries from pip packages so onnxruntime-gpu
-# can find libcublasLt.so.12 and libcudnn.so.9 at runtime
-ENV LD_LIBRARY_PATH="/app/.venv/lib/python3.12/site-packages/nvidia/cudnn/lib:/app/.venv/lib/python3.12/site-packages/nvidia/cuda_runtime/lib:${LD_LIBRARY_PATH}"
+# NVIDIA: register pip-installed nvidia lib/ dirs with ldconfig so onnxruntime-gpu
+# and torch can find libcudnn, libcublas, etc. Skipped silently on other variants.
+RUN if [ "$VARIANT" = "gpu" ]; then \
+        find /app/.venv/lib/python3.*/site-packages/nvidia -type d -name "lib" \
+            2>/dev/null > /etc/ld.so.conf.d/nvidia-pip.conf && ldconfig || true; \
+    fi
+# Intel: install GPU compute runtime so OpenVINO EP can target Intel Arc / iGPU.
+# onnxruntime-openvino bundles OpenVINO itself; only the userspace GPU driver
+# (OpenCL ICD + Level Zero) is needed from the OS.
+# These packages aren't in Ubuntu 22.04 main, so this block adds Intel's
+# official GPU repo first, then installs. libze-intel-gpu1 was renamed to
+# level-zero in Intel's repo.
+RUN if [ "$VARIANT" = "intel" ]; then \
+        apt-get update \
+        && apt-get install -y --no-install-recommends curl gnupg \
+        && curl -fsSL https://repositories.intel.com/graphics/intel-graphics.key \
+           | gpg --dearmor > /usr/share/keyrings/intel-graphics.gpg \
+        && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/intel-graphics.gpg] \
+https://repositories.intel.com/graphics/ubuntu jammy flex" \
+           > /etc/apt/sources.list.d/intel-graphics.list \
+        && apt-get update \
+        && apt-get install -y --no-install-recommends \
+               intel-opencl-icd intel-level-zero-gpu level-zero \
+        && apt-get remove -y --autoremove curl gnupg \
+        && rm -rf /var/lib/apt/lists/*; \
+    fi
 
 RUN groupadd -g 568 apps && useradd -u 568 -g apps -m -s /bin/bash appuser \
-    && mkdir -p /models/.insightface /models/huggingface \
+    && mkdir -p /models/.insightface \
     && chown -R appuser:apps /app /models
 
 WORKDIR /app
 USER appuser
-ENV HF_HOME=/models/huggingface INSIGHTFACE_HOME=/models
+# PYTHONPATH=/app makes the winnow package importable from the entry point script.
+# uv sync builds the wheel before winnow/ is COPY'd, so site-packages has only
+# the dist-info. Explicitly adding /app lets Python find winnow/__init__.py there.
+ENV INSIGHTFACE_HOME=/models/.insightface PYTHONPATH=/app
 
-HEALTHCHECK CMD test -f /app/entrypoint.sh || exit 1
+HEALTHCHECK --interval=60s --timeout=5s --start-period=120s --retries=3 \
+    CMD sh -c 'if [ -f /tmp/winnow.pid ]; then kill -0 "$(cat /tmp/winnow.pid)"; fi'
 ENTRYPOINT ["tini", "--", "/app/entrypoint.sh"]

LICENSE

@@ -1,22 +1,661 @@
-MIT License
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
 
-Copyright (c) 2026 Holden Salomon
-Copyright (c) 2026 Sebastian
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+                            Preamble
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.

NOTICES

@@ -0,0 +1,23 @@
+winnow incorporates portions of if_curator (https://github.com/ds-sebastian/if_curator).
+
+    MIT License
+
+    Copyright (c) 2026 Sebastian
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+    THE SOFTWARE.

README.md

@@ -1,32 +1,24 @@
-[![Publish Docker Image](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml) [![Release](https://github.com/sudolulo/winnow/actions/workflows/release.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/release.yml) [![Lint](https://github.com/sudolulo/winnow/actions/workflows/lint.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/lint.yml) [![Test](https://github.com/sudolulo/winnow/actions/workflows/test.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/test.yml)
-[![Immich](https://img.shields.io/badge/Immich-v1.106%2B-violet?style=for-the-badge)](https://immich.app) [![Frigate](https://img.shields.io/badge/Frigate-Ready-green?style=for-the-badge)](https://frigate.video)
-
-**Docs:** [Setup Guide](docs/setup.md) · [Troubleshooting](docs/troubleshooting.md) · [FAQ](docs/faq.md)
-
 # winnow
 
-`winnow` pulls photos of people and objects from your [Immich](https://immich.app) library, selects the most diverse and highest-quality subset using AI embeddings, and delivers them as training data for [Frigate](https://frigate.video)'s face recognition and object classification models.
+[![Docker](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml) [![Test](https://github.com/sudolulo/winnow/actions/workflows/test.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/test.yml) [![GitHub release](https://img.shields.io/github/v/release/sudolulo/winnow)](https://github.com/sudolulo/winnow/releases/latest) [![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE) [![Immich](https://img.shields.io/badge/Immich-v1.106%2B-blueviolet)](https://immich.app) [![Frigate](https://img.shields.io/badge/Frigate-Ready-brightgreen)](https://frigate.video)
 
-It runs fully headless in Docker, is configured entirely through environment variables, and can run on a schedule — no interactive prompts, no manual steps.
+> **Note:** winnow's approach to training Frigate face recognition is not an officially documented workflow — results may vary.
 
----
+> **Early Development — Use With Caution**
+> winnow is in an unfinished state and maturing. Features that modify your Frigate training data — quality replacement, stale mapping cleanup — can remove images from your dataset and are not yet battle-tested at scale. Review the logs after each run and keep backups of your Frigate face training directory until you are confident in the results.
 
-## The Problem
+**Docs:** [Setup](https://github.com/sudolulo/winnow/wiki/Setup) · [Troubleshooting](https://github.com/sudolulo/winnow/wiki/Troubleshooting) · [FAQ](https://github.com/sudolulo/winnow/wiki/FAQ)
 
-Frigate's face recognition model (ArcFace) and object classifier are only as good as the training data you give them. The instinct is to feed them as many photos as possible, but volume is not what matters — **diversity is**.
+`winnow` pulls photos from your [Immich](https://immich.app) library, selects the most diverse and highest-quality subset using AI embeddings, and delivers them as training data for [Frigate](https://frigate.video)'s face recognition.
 
-If you upload 100 photos from the same week, the model learns the lighting in your living room and the jacket you wore that month. It struggles the moment anything changes. What you actually want is a spread: different years, different lighting conditions, different angles, different contexts.
+The best Frigate training data is images you curate manually — photos taken specifically for recognition, in controlled conditions, uploaded directly through Frigate's UI. Winnow is meant to supplement people in your library, not replace manual training. In some cases one has people they would like to recognize that do not occur in detections often enough to train a diverse dataset. This is meant to fill that gap.
 
-This is especially true for people who have never been to your property, or who visit rarely — family members, friends, anyone Frigate has never seen in person. Live detections alone will never build a reliable model for these people. Your photo library already has the data; winnow finds and delivers the right subset of it.
-
-Finding that spread manually across a library of thousands of photos is not practical. `winnow` does it automatically.
+> **winnow only touches files it uploaded.** Faces added to Frigate manually through its UI are never deleted, replaced, or modified — not by quality replacement, not by `RESET_PERSON`, not by stale cleanup. Your manually curated images are always the primary dataset; winnow only adds to it.
 
 ---
 
 ## How It Works
 
-For each person (or object) you configure, the tool runs this pipeline:
-
 ```
 Immich library
       │
@@ -34,86 +26,72 @@ Immich library
 1. Fetch all assets tagged with this person
       │
       ▼
-2. Filter by recency (configurable years window)
+2. Filter by recency (YEARS_FILTER) and skip already-uploaded
+   and rejected assets (persistent tracker in DATA_DIR)
       │
       ▼
-3. Skip already-uploaded assets (persistent tracker)
-      │
-      ▼
-4. Quality filter — reject:
+3. Quality filter — download preview thumbnails and reject:
    • Blurry images (Laplacian variance)
-   • Grayscale / infrared (channel similarity check)
+   • Grayscale / infrared (channel similarity)
    • Over- or underexposed
    • Low detection confidence
    • Face crops below minimum pixel size
       │
       ▼
-5. Compute embeddings for remaining candidates
-   • Faces   → InsightFace (ArcFace / Buffalo_L)
-   • Objects → SigLIP (Vision Transformer)
+4. Compute embeddings from the same preview thumbnails
+   • InsightFace (ArcFace / Buffalo_L) → 512-dim vector
+      │
+      ▼
+5. Near-duplicate removal — greedy cosine-distance pass drops burst shots
+   and near-identical photos before clustering runs; the highest-quality
+   image from each near-duplicate group is kept
       │
       ▼
 6. Diversity selection
-   • K-Medoids clustering to find natural groupings
-   • Farthest Point Sampling (FPS) to pick maximally spread representatives
-   • Hard example weighting — unusual angles, partial occlusions,
-     and low-confidence detections are biased toward selection
-   • Auto mode: keeps selecting until marginal diversity drops off
+   • K-Medoids clustering → one representative per natural group
+   • Farthest Point Sampling → fill remaining slots with maximally spread picks
+   • Hard example weighting — low-confidence detections get a distance boost
+     so unusual angles and harder looks are preferred over easy frontals
+   • Adaptive mode: stops when the next candidate is too similar to those already
+     selected (distance threshold = 20 % of median pairwise distance)
       │
       ▼
-7. Crop and export
-   • Face mode: aligned 112×112 crops (ArcFace standard input),
-     uploaded directly to Frigate's face training API
-   • Object mode: YOLO-detected crops saved to disk
+7. Download full-resolution originals from Immich
+      │
+      ▼
+8. Crop and process — EXIF-corrected, landmark-aligned 112×112 crop (ArcFace format)
+      │
+      ▼
+9. Deliver — upload crops to Frigate's face registration API
+   ↳ below MAX_AUTO_IMAGES — upload, unless the novelty gate
+     (FRIGATE_SCORE_CEILING) determines the candidate is already
+     covered by the current training set
+   ↳ at cap + QUALITY_REPLACEMENT=true — with Frigate scoring active,
+     swap the most redundant tracked image (highest pre-upload recognize
+     score) if the candidate is more novel (lower score); falling back to
+     blur-score comparison when no Frigate scores are available; manually
+     added files are never touched
+   ↳ at cap + QUALITY_REPLACEMENT=false — skip this person
 ```
 
-Uploaded asset IDs are recorded so the same image is never uploaded twice, even across runs weeks apart.
-
----
-
-## Note on Crop Quality
-
-winnow works well, but no automated pipeline is perfect. Occasionally a bad crop will slip through quality filtering — a partial face, someone in the background, a blurry frame. After a run it's worth a quick review in Frigate's face management UI to remove anything that doesn't belong.
-
-Issues and feedback welcome via [GitHub Issues](https://github.com/sudolulo/winnow/issues).
-
----
-
-## Modes
-
-### Face Mode (default)
-
-Extracts face crops using Immich's bounding box metadata, scales them to the source image resolution, applies EXIF orientation correction, then either aligns them to the standard ArcFace 112×112 format using 5-point facial landmarks or falls back to a margin-padded bounding box crop.
-
-Crops are uploaded directly to Frigate's face registration API (`POST /api/faces/{name}/register`). After each successful upload the asset ID is marked in the tracker so future runs skip it.
-
-### Object Mode
-
-Runs each full image through YOLOv9c to detect instances of a target class (dog, cat, car, etc.), then crops each detection and saves it to the output directory. Frigate has no API for uploading object training images, so the crops are saved for you to place into your Frigate data directory manually.
-
----
-
-## Diversity Selection in Detail
-
-The core of the tool is the embedding-based selection. Rather than picking images at random or evenly across time, it computes a vector embedding for each candidate image that encodes what the face or object actually looks like — the angle, lighting, expression, background context.
-
-It then:
-
-1. **Clusters** those embeddings using K-Medoids to find natural groups (e.g. "holiday photos", "outdoor summer shots", "indoor low light")
-2. **Selects one representative** from each cluster — the most central image in each group
-3. **Fills remaining slots** using Farthest Point Sampling, iteratively picking whichever image is most different from everything already selected
-4. **Weights toward hard examples** — images with unusual angles, partial occlusions, or borderline detection confidence are more likely to be picked, because those edge cases are where models fail
-
-In **Auto mode**, there is no fixed limit. The tool keeps selecting until the most-different remaining image is already close to something already in the set — at that point adding more would be redundant. This is capped at `MAX_AUTO_IMAGES` (default 80) as a safety limit.
-
-If the embedding model is unavailable, the tool falls back to **time spread**: evenly distributing picks across the date range of your photos.
+Uploaded and rejected asset IDs are persisted across runs in two JSON files (`frigate_uploaded_ids.json` and `frigate_rejected_ids.json` in `DATA_DIR`). The same image is never processed twice; rejected assets are permanently skipped unless `RETRY_REJECTED=true`.
 
 ---
 
 ## Running in Docker
 
+### Image Tags
+
+| Tag | Arch | Acceleration |
+| :-- | :-- | :-- |
+| `:latest` | amd64 | NVIDIA CUDA 12.8 · requires [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html) |
+| `:rocm` | amd64 | AMD ROCm · pass `/dev/kfd` + `/dev/dri` |
+| `:intel` | amd64 | Intel Arc / iGPU via OpenVINO · pass `/dev/dri`, set `OPENVINO_DEVICE=GPU` |
+| `:cpu` | amd64 + arm64 | CPU only · ~2 GB smaller · no GPU required |
+
 ### Quick Start
 
+**NVIDIA:**
 ```yaml
 services:
   winnow:
@@ -122,11 +100,10 @@ services:
       - IMMICH_URL=http://192.168.1.10:2283
       - API_KEY=your-immich-api-key
       - FRIGATE_URL=http://192.168.1.10:5000
-      - AUTO_MODE=true
-      - CRON_SCHEDULE=0 3 * * 0   # Every Sunday at 3 AM
+      - CRON_SCHEDULE=0 3 * * 0
     volumes:
-      - /path/to/models:/models
-      - /path/to/cache:/app/.if_cache
+      - /path/to/models:/models    # INSIGHTFACE_HOME — persists Buffalo_L model (~300 MB)
+      - /path/to/data:/app/data
       - /path/to/output:/app/frigate_train
     deploy:
       resources:
@@ -137,80 +114,127 @@ services:
               capabilities: [gpu]
 ```
 
-See [compose.yml](compose.yml) for the full annotated example.
+**AMD (`:rocm`):** use `image: ghcr.io/sudolulo/winnow:rocm` and replace the `deploy:` block with:
+```yaml
+    devices:
+      - /dev/kfd
+      - /dev/dri
+    group_add:
+      - video
+      - render
+```
 
-### Scheduling Behaviour
+**Intel (`:intel`):** use `image: ghcr.io/sudolulo/winnow:intel` and replace the `deploy:` block with:
+```yaml
+    devices:
+      - /dev/dri
+    group_add:
+      - render
+    environment:
+      - OPENVINO_DEVICE=GPU   # omit to run OpenVINO inference on CPU (default)
+```
 
-On startup the container always runs once immediately. If `CRON_SCHEDULE` is set, it then starts a scheduler that fires on the defined interval, keeping the process (and loaded models) alive between runs. Without `CRON_SCHEDULE` the container exits after the first run.
+**CPU (`:cpu`):** use `image: ghcr.io/sudolulo/winnow:cpu`, remove the `deploy:` block, and add `mem_limit: 2g` to prevent OOM on large libraries.
 
-The first run after a fresh install downloads the embedding models (~1-2 GB). Subsequent runs use the cached models from the mounted volume and start immediately.
+See [compose.yml](compose.yml) for the full annotated example with all options.
+
+### Scheduling
+
+`CRON_SCHEDULE` controls container lifetime:
+
+| `CRON_SCHEDULE` value | Behaviour |
+| :-- | :-- |
+| *(unset)* | Run once on startup, then exit |
+| *(empty string)* | Stay alive, run nothing — trigger manually with `docker exec -it winnow winnow` |
+| Cron expression | Run on startup, then repeat on schedule |
+
+In scheduled mode the process (and loaded models) stays resident between runs. The first run after a fresh install downloads InsightFace Buffalo_L (~300 MB); subsequent runs use the cached model from the mounted volume.
 
 ---
 
 ## Environment Variables
 
-### Mode & Strategy
-
-| Variable | Default | Description |
-| :--- | :--- | :--- |
-| `AUTO_MODE` | `false` | Run without interactive prompts — required for Docker/cron use |
-| `TRAINING_MODE` | `face` | `face` — upload crops to Frigate API; `object` — save crops to disk |
-| `STRATEGY` | `auto` | `auto` (adaptive), `standard` (30 images), `broad` (100 images) |
-| `LIMIT` | *(unset)* | Exact image count — overrides `STRATEGY` |
-| `OBJECT_CLASS` | `dog` | Target class for object mode (any YOLO class: `dog`, `cat`, `car`, etc.) |
-
-### People Filtering
-
-| Variable | Default | Description |
-| :--- | :--- | :--- |
-| `ONLY_PEOPLE` | *(unset)* | Comma-separated whitelist — only these people are processed |
-| `SKIP_PEOPLE` | *(unset)* | Comma-separated list of people to skip |
-| `MIN_FACE_COUNT` | `0` | Skip people with fewer than N tagged assets in Immich |
-| `YEARS_FILTER` | `10` | Ignore images older than N years |
-
 ### Connection
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
 | `IMMICH_URL` | *(required)* | Full URL to your Immich instance |
 | `API_KEY` | *(required)* | Immich API key |
-| `FRIGATE_URL` | *(unset)* | Frigate URL — required for face upload; omit to skip upload |
+| `FRIGATE_URL` | *(unset)* | Frigate URL — required for face upload; omit to skip |
+
+### Mode & Strategy
+
+| Variable | Default | Description |
+| :--- | :--- | :--- |
+| `STRATEGY` | `adaptive` | `adaptive` — embedding-based diversity selection, stops when candidates become redundant; `standard` — fixed 30 images; `broad` — fixed 100 images |
+| `LIMIT` | *(unset)* | Exact image count — overrides `STRATEGY` |
+| `AUTO_MODE` | *(auto)* | Skip interactive prompts and process all people unattended — auto-detected when no TTY is present (Docker, cron); set `true` to force in a terminal |
+| `VERBOSE` | `false` | Enable DEBUG-level console output (log file is always DEBUG) |
+
+### People Filtering
+
+| Variable | Default | Description |
+| :--- | :--- | :--- |
+| `ONLY_PEOPLE` | *(unset)* | Comma-separated whitelist — process only these people |
+| `SKIP_PEOPLE` | *(unset)* | Comma-separated list — skip these people |
+| `MIN_FACE_COUNT` | `3` | Skip people with fewer than N tagged assets in Immich |
+| `MERGE_DUPLICATE_PEOPLE` | `false` | When Immich has duplicate entries for the same person (same face split across multiple names), merge their asset pools before processing. Without this, each duplicate group emits a warning and is skipped |
+| `YEARS_FILTER` | `10` | Ignore images older than N years |
+
+> **Duplicate people detection** — winnow warns at startup if the same name appears on multiple Immich person records (a common side-effect of Immich's face clustering creating separate pools for the same individual). By default (`false`) it logs the duplicates, keeps only the person with the most assets, and skips the rest — no data is changed. Set `MERGE_DUPLICATE_PEOPLE=true` to permanently merge each duplicate group inside Immich (the person with the most assets absorbs the others). **This modifies Immich and cannot be undone.** Only enable it once you've verified the duplicates are actually the same person.
 
 ### Image Quality
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `MIN_FACE_WIDTH` | `50` | Minimum face crop width in pixels |
-| `FACE_MARGIN` | `0.15` | Padding added around the bounding box crop (fraction of face size) |
-| `ENABLE_FACE_ALIGNMENT` | `true` | Align to ArcFace 112×112 format using facial landmarks |
-| `USE_FULL_RESOLUTION` | `true` | Download full-resolution originals rather than preview thumbnails |
-| `MIN_CONFIDENCE` | `0.7` | Minimum Immich face detection confidence |
-| `BLUR_THRESHOLD` | `100.0` | Laplacian variance threshold — lower accepts more blur |
-| `MAX_AUTO_IMAGES` | `80` | Maximum images in auto-diversity mode |
+| `MAX_AUTO_IMAGES` | `5` | Maximum training images per person in Frigate |
+| `QUALITY_REPLACEMENT` | `true` | When at cap, swap a weaker tracked image for a better candidate. With Frigate scoring active, targets the most redundant image (highest pre-upload recognize score); otherwise uses blur score. Never touches manually added Frigate files. Set `false` to skip people at cap |
 
-### Caching & Models
+#### Advanced Tuning *(calibrated — do not adjust)*
+
+These defaults are tuned for Frigate's ArcFace requirements. winnow will warn on launch if any are set. Image quality issues caused by non-default values will not be investigated.
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `FORCE_CPU` | `false` | Disable GPU — fall back to CPU for embedding computation |
-| `ENABLE_CACHE` | `false` | Cache computed embeddings to disk (speeds up re-runs on the same library) |
-| `CACHE_DIR` | `.if_cache` | Path for embedding cache and upload tracker files |
-| `HF_HOME` | *(system)* | HuggingFace model cache location (SigLIP) |
-| `INSIGHTFACE_HOME` | *(system)* | InsightFace model cache location (Buffalo_L) |
+| `ENABLE_FRIGATE_SCORES` | `true` | Call Frigate's recognize endpoint pre-upload to store diversity scores used for quality replacement. Adds ~200 ms per upload. Disabling also disables the below-cap novelty gate |
+| `FRIGATE_SCORE_CEILING` | *(unset)* | Below-cap novelty gate. Unset: dynamic — skips candidates whose Frigate score exceeds the most-redundant tracked file's score, auto-calibrates each run. `0`: disable entirely. Positive value (e.g. `0.85`): fixed hard ceiling |
+| `MIN_FACE_WIDTH` | `90` | Minimum face crop width in pixels |
+| `FACE_MARGIN` | `0.15` | Padding around bounding box crop (fraction of face size) |
+| `ENABLE_FACE_ALIGNMENT` | `true` | Align to ArcFace 112×112 format using facial landmarks |
+| `USE_FULL_RESOLUTION` | `true` | Download full-resolution originals rather than preview thumbnails |
+| `MIN_CONFIDENCE` | `0.7` | Minimum Immich face detection confidence |
+| `BLUR_THRESHOLD` | `120.0` | Laplacian variance threshold — lower accepts more blur |
+
+### GPU & Models
+
+| Variable | Default | Description |
+| :--- | :--- | :--- |
+| `FORCE_CPU` | `false` | Disable GPU — fall back to CPU for all inference |
+| `OPENVINO_DEVICE` | `CPU` | Intel variant only: set `GPU` to use Arc or iGPU; default runs on CPU |
+| `ENABLE_CACHE` | `true` | Cache computed embeddings to disk (speeds up re-runs on the same library) |
+| `DATA_DIR` | `data` | Path for embedding cache and upload tracker JSON files |
+| `INSIGHTFACE_HOME` | *(system)* | InsightFace model cache path (Buffalo_L) |
+
+### Output
+
+| Variable | Default | Description |
+| :--- | :--- | :--- |
+| `OUTPUT_DIR` | `./frigate_train` | Directory where face crops are staged before upload and where `winnow.log` is written. In Docker, set this via the volume mount instead. |
 
 ### Tracker Overrides *(one-shot — remove after use)*
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `DRY_RUN` | `false` | Show what would be selected and uploaded without doing it |
-| `RETRY_REJECTED` | `false` | Re-attempt assets previously rejected by Frigate |
-| `RESET_PERSON` | *(unset)* | Clear upload and rejection history for one person by name |
+| `DRY_RUN` | `false` | Preview selection without downloading or uploading |
+| `RETRY_REJECTED` | `false` | Re-attempt all previously rejected assets (low-confidence skips, Frigate rejections, and other permanent exclusions) |
+| `RESET_PERSON` | *(unset)* | Set to a person's name to clear their upload history and delete their winnow-managed Frigate training files so the next run starts fresh. Set to `*` to reset all tracked people at once. Manually added Frigate files are never touched |
+| `TRACE_CROP_SIZE` | *(unset)* | Debug: print all tracked crops whose width or height matches this pixel value, then exit |
 
 ### Scheduling
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `CRON_SCHEDULE` | *(unset)* | Cron expression for recurring runs — unset exits after first run |
+| `CRON_SCHEDULE` | *(unset)* | Unset = run once and exit; empty = stay alive; cron expression = scheduled |
 
 ---
 
@@ -223,16 +247,26 @@ uv sync
 uv run winnow
 ```
 
-Requires Python 3.12+ and [uv](https://astral.sh/uv/). An NVIDIA GPU is strongly recommended — CPU mode works but embedding computation is significantly slower.
+Requires Python 3.13+ and [uv](https://astral.sh/uv). An NVIDIA, AMD, or Intel GPU is recommended — CPU mode works but embedding computation is slower.
+
+When run with a terminal attached, winnow starts an interactive session: select which people to process and choose a strategy (adaptive, standard, broad, or a custom count) per person. Without a TTY — Docker, cron, or `AUTO_MODE=true` — it processes all people unattended using the configured defaults.
 
 ---
 
 ## Requirements
 
 - **Immich** v1.106+
-- **Frigate** v0.16+ (face mode only — object mode has no Frigate API dependency)
-- **NVIDIA GPU** recommended (CUDA 12.x)
-- **Python 3.12+**
+- **Frigate** v0.16+
+- **GPU** recommended: NVIDIA (CUDA), AMD (ROCm), or Intel (Arc / iGPU via OpenVINO)
+- **Python** 3.13+
+
+---
+
+## Getting Help
+
+- **[GitHub Discussions](https://github.com/sudolulo/winnow/discussions)** — questions, setup help, and general discussion
+- **[Wiki](https://github.com/sudolulo/winnow/wiki)** — setup guide, troubleshooting, and FAQ
+- **[Issues](https://github.com/sudolulo/winnow/issues)** — bugs and feature requests only
 
 ---
 

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release is supported with security fixes.
+
+## Reporting a Vulnerability
+
+Please do **not** open a public GitHub issue for security vulnerabilities.
+
+Email **holden@arch.fyi** with:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce or a proof of concept
+- Any suggested fix, if you have one
+
+You will receive an acknowledgement within 48 hours. If the vulnerability is confirmed, a fix will be released as soon as possible and you will be credited in the changelog unless you prefer otherwise.

compose.yml

@@ -9,20 +9,20 @@ services:
       - FRIGATE_URL=${FRIGATE_URL}
 
       # ── Mode & Strategy ───────────────────────────────────────────────────
-      - AUTO_MODE=true
-      # TRAINING_MODE: face = upload to Frigate face recognition API
-      #                object = save crops to output dir for manual Frigate placement
-      - TRAINING_MODE=face
+      # Auto mode is active by default when no TTY is present (Docker/cron).
+      # Set AUTO_MODE=true to force auto mode in an interactive terminal.
+      # To run interactively: docker exec -it winnow winnow
+      # - VERBOSE=true                # Enable DEBUG-level console output
       # STRATEGY: auto = objective diversity (recommended), standard = 30 imgs, broad = 100 imgs
       - STRATEGY=auto
       # - LIMIT=50                    # Custom image count; overrides STRATEGY preset
-      # - OBJECT_CLASS=dog            # Object label for object mode (e.g. dog, cat, car)
 
       # ── People Filtering ──────────────────────────────────────────────────
       # - ONLY_PEOPLE=John,Jane       # Comma-separated; process only these people
       # - SKIP_PEOPLE=Unknown         # Comma-separated; skip these people
       # - MIN_FACE_COUNT=5            # Skip people with fewer than N assets in Immich
       # - YEARS_FILTER=10             # Only include images from the last N years (default: 10)
+      # - MERGE_DUPLICATE_PEOPLE=true # Auto-merge Immich people with the same name (keeps most assets)
 
       # ── Image Quality ─────────────────────────────────────────────────────
       # - MIN_FACE_WIDTH=50           # Minimum face width in pixels (default: 50)
@@ -31,13 +31,13 @@ services:
       # - USE_FULL_RESOLUTION=true    # Use full-res images vs thumbnails (default: true)
       # - MIN_CONFIDENCE=0.7          # Minimum face detection confidence (default: 0.7)
       # - BLUR_THRESHOLD=100.0        # Laplacian blur threshold; lower = accept more blur (default: 100.0)
-      # - MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 80)
+      # - MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 5)
 
       # ── Caching & Models ──────────────────────────────────────────────────
-      - FORCE_CPU=false
-      - ENABLE_CACHE=true
-      - CACHE_DIR=/app/.if_cache
-      - HF_HOME=/models/huggingface
+      # - FORCE_CPU=true              # Disable GPU, fall back to CPU
+      # - OPENVINO_DEVICE=GPU         # Intel variant only: use Arc/iGPU instead of CPU (default: CPU)
+      # - ENABLE_CACHE=false          # Disable embedding cache (default: true)
+      - DATA_DIR=/app/data
       - INSIGHTFACE_HOME=/models/.insightface
 
       # ── Tracker overrides (one-shot, remove after use) ────────────────────
@@ -46,19 +46,23 @@ services:
       # - RESET_PERSON=John           # Clear uploaded+rejected history for one person
 
       # ── Scheduling ────────────────────────────────────────────────────────
-      # Cron expression (unset = run once and exit)
-      # Every Sunday at 3 AM:
-      - CRON_SCHEDULE=0 3 * * 0
-      # - CRON_SCHEDULE=0 3 1 * *
-      # - CRON_SCHEDULE=*/30 * * * *
+      # CRON_SCHEDULE controls container lifetime:
+      #   unset          — run once on startup, then exit
+      #   empty string   — stay alive, run nothing; trigger manually with:
+      #                    docker exec -it winnow winnow
+      #   cron expression — run on startup, then on schedule
+      # - CRON_SCHEDULE=                # Manual mode (keep alive, no auto-run)
+      # - CRON_SCHEDULE=0 3 * * 0      # Every Sunday at 3 AM
+      # - CRON_SCHEDULE=0 3 1 * *      # First of every month
     volumes:
       # Replace with absolute paths on your host, e.g. /opt/winnow/models
       - /path/to/winnow/models:/models
-      - /path/to/winnow/cache:/app/.if_cache
+      - /path/to/winnow/data:/app/data
       - /path/to/winnow/output:/app/frigate_train
-    stdin_open: true
-    tty: true
     restart: unless-stopped
+
+    # ── GPU device passthrough ─────────────────────────────────────────────────
+    # NVIDIA (default — requires nvidia-container-toolkit):
     deploy:
       resources:
         reservations:
@@ -66,3 +70,18 @@ services:
             - driver: nvidia
               count: all
               capabilities: [gpu]
+    #
+    # AMD ROCm — replace the deploy block above with:
+    #   devices:
+    #     - /dev/kfd
+    #     - /dev/dri
+    #   group_add:
+    #     - video
+    #     - render
+    #
+    # Intel Arc / iGPU — replace the deploy block above with:
+    #   devices:
+    #     - /dev/dri
+    #   group_add:
+    #     - render
+    #   Also set: OPENVINO_DEVICE=GPU in the environment section above.

docs/faq.md

@@ -1,63 +0,0 @@
-# FAQ
-
-## Does winnow modify my Immich library?
-
-No. winnow only reads from Immich (assets, people, face bounding boxes). It never writes back to Immich or deletes anything.
-
----
-
-## How many images should I upload to Frigate?
-
-The `auto` strategy decides this for you — it keeps selecting until adding more images would be redundant. In practice this is usually 20–60 per person. You can cap it with `MAX_AUTO_IMAGES` (default 80).
-
-Quality and diversity matter far more than volume. 30 well-spread images outperform 200 from the same week.
-
----
-
-## What's the difference between face mode and object mode?
-
-- **Face mode**: Extracts and aligns face crops, uploads them directly to Frigate's face training API. This is for teaching Frigate to recognize specific people.
-- **Object mode**: Runs YOLO detection on full images and saves crops of a target class (dog, cat, car, etc.) to disk. Frigate has no API for object training data, so you place them manually.
-
----
-
-## Can I run it without Frigate?
-
-Yes — in object mode, `FRIGATE_URL` is not used and crops are saved to the output volume. In face mode you need Frigate to receive the uploads, but you can use `DRY_RUN=true` to preview selection without uploading.
-
----
-
-## How does auto-diversity mode work?
-
-winnow computes a vector embedding for each candidate image (what the face/object actually looks like — angle, lighting, expression). It then clusters those embeddings and picks representatives that are maximally spread across the embedding space. It stops when the next-most-different image is already close to something already selected. See the README for the full pipeline.
-
----
-
-## Does it support multiple people in one run?
-
-Yes. By default it processes every named person in your Immich library. Use `ONLY_PEOPLE` to whitelist specific names or `SKIP_PEOPLE` to exclude them.
-
----
-
-## What GPU is needed?
-
-Any NVIDIA GPU with CUDA 12.x support. The models (InsightFace Buffalo_L + SigLIP) fit comfortably in 4 GB VRAM. CPU mode works but is significantly slower.
-
-ARM builds (linux/arm64) use CPU-only — CUDA is not available on ARM.
-
----
-
-## Does it work on Unraid / Proxmox / bare Docker?
-
-Yes — the `compose.yml` uses standard Docker volume mounts. Replace the example paths with whatever absolute paths suit your setup.
-
----
-
-## How do I update winnow?
-
-```bash
-docker compose pull
-docker compose up -d
-```
-
-The `latest` tag on GHCR tracks the `main` branch. Pinning to a version tag (e.g. `ghcr.io/sudolulo/winnow:v0.2.0`) is recommended for stability.

docs/setup.md

@@ -1,95 +0,0 @@
-# Setup Guide
-
-## Prerequisites
-
-- [Immich](https://immich.app) v1.106+ with face recognition enabled and people tagged
-- [Frigate](https://frigate.video) v0.16+ (face mode only)
-- Docker with the NVIDIA container toolkit (optional but strongly recommended)
-
----
-
-## 1. Get your Immich API key
-
-1. Open Immich → **Account Settings** → **API Keys**
-2. Click **New API Key**, give it a name (e.g. `winnow`), copy the key
-
----
-
-## 2. Get your Frigate URL
-
-This is the base URL of your Frigate instance, e.g. `http://192.168.1.10:5000`. Only needed for face mode — omit it entirely if you're using object mode.
-
----
-
-## 3. Deploy with Docker Compose
-
-Copy [`compose.yml`](../compose.yml) and [`.env.example`](../.env.example) to a directory on your host:
-
-```bash
-mkdir winnow && cd winnow
-curl -O https://raw.githubusercontent.com/sudolulo/winnow/main/compose.yml
-curl -O https://raw.githubusercontent.com/sudolulo/winnow/main/.env.example
-cp .env.example .env
-```
-
-Edit `.env` with your values:
-
-```bash
-IMMICH_URL=http://192.168.1.10:2283
-API_KEY=your-immich-api-key
-FRIGATE_URL=http://192.168.1.10:5000
-```
-
-Edit the volume paths in `compose.yml` to point to directories on your host where models, cache, and output crops should be stored:
-
-```yaml
-volumes:
-  - /your/path/to/models:/models
-  - /your/path/to/cache:/app/.if_cache
-  - /your/path/to/output:/app/frigate_train
-```
-
-These directories will be created automatically by Docker if they don't exist.
-
-Start it:
-
-```bash
-docker compose up -d
-```
-
-Logs:
-
-```bash
-docker compose logs -f winnow
-```
-
----
-
-## 4. First run
-
-On the first run, winnow downloads the embedding models (~1–2 GB) from HuggingFace and InsightFace. This happens once — subsequent runs use the cached models from your mounted volume and start immediately.
-
----
-
-## 5. Scheduling
-
-Set `CRON_SCHEDULE` in your `.env` to keep winnow running on a schedule:
-
-```
-CRON_SCHEDULE=0 3 * * 0   # Every Sunday at 3 AM
-```
-
-Without `CRON_SCHEDULE`, the container runs once and exits.
-
----
-
-## GPU passthrough
-
-To enable GPU acceleration, include the `deploy` block in `compose.yml` (already present in the example) and ensure the NVIDIA container toolkit is installed on your host:
-
-```bash
-# Verify GPU is accessible to Docker
-docker run --rm --gpus all nvidia/cuda:12.9.2-base-ubuntu22.04 nvidia-smi
-```
-
-CPU mode works without any GPU setup — set `FORCE_CPU=true` to disable GPU explicitly.

docs/troubleshooting.md

@@ -1,77 +0,0 @@
-# Troubleshooting
-
-## Container exits immediately
-
-Check logs:
-```bash
-docker compose logs winnow
-```
-
-Common causes:
-- **Missing required env var** — `IMMICH_URL` or `API_KEY` not set
-- **Cannot reach Immich** — check the URL and that Immich is running; use `http://` not `https://` unless you have TLS set up
-
----
-
-## "No people found" / nothing processed
-
-- Make sure Immich has completed face recognition and you have named people in your library
-- `YEARS_FILTER` defaults to 10 years — increase it if your tagged photos are older
-- `MIN_FACE_COUNT` skips people with few photos — lower or remove it
-
----
-
-## Frigate upload fails
-
-- Confirm `FRIGATE_URL` is reachable from inside the container: `docker exec winnow curl $FRIGATE_URL/api/stats`
-- Check Frigate v0.16+ — older versions don't have the face training API
-- Set `DRY_RUN=true` to verify selection without uploading
-
----
-
-## Models fail to download
-
-winnow downloads InsightFace and HuggingFace (SigLIP) models on first run.
-
-- Ensure the container has internet access
-- Confirm the model volume is mounted and writable
-- If behind a proxy, set `HTTP_PROXY` / `HTTPS_PROXY` env vars
-
----
-
-## Running on CPU (no GPU)
-
-Set `FORCE_CPU=true`. Everything works but embedding computation is slower — expect several minutes per person instead of seconds.
-
-If you have a GPU but it's not being used:
-- Confirm the NVIDIA container toolkit is installed: `docker run --rm --gpus all nvidia/cuda:12.9.2-base-ubuntu22.04 nvidia-smi`
-- Confirm the `deploy.resources.reservations.devices` block is present in `compose.yml`
-
----
-
-## Same images uploaded every run
-
-The upload tracker is stored in `CACHE_DIR` (`/app/.if_cache` by default). If this volume isn't persisted between runs, the tracker resets and images are re-uploaded.
-
-Make sure `/app/.if_cache` is mounted to a persistent host path.
-
----
-
-## Re-uploading a specific person
-
-To clear the upload history for one person and start fresh:
-
-```env
-RESET_PERSON=John
-```
-
-Remove this after one run — it clears the history and then processes normally.
-
----
-
-## Image quality issues
-
-- **Too blurry**: Lower `BLUR_THRESHOLD` (default 100) — e.g. `50` accepts more blur
-- **Face too small**: Lower `MIN_FACE_WIDTH` (default 50px)
-- **Low confidence detections included**: Raise `MIN_CONFIDENCE` (default 0.7)
-- **Rejected images being re-tried**: Set `RETRY_REJECTED=true` for one run

entrypoint.sh

@@ -2,11 +2,19 @@
 set -e
 export PYTHONUNBUFFERED=1
 
-# 1. Run the job immediately on startup
+# CRON_SCHEDULE controls container lifetime:
+#   unset          — run once and exit
+#   empty string   — stay alive, run nothing (use: docker exec -it winnow winnow)
+#   cron expression — run immediately, then on schedule
+
+if [ "${CRON_SCHEDULE+isset}" = "isset" ] && [ -z "$CRON_SCHEDULE" ]; then
+    echo "▶ CRON_SCHEDULE is empty — manual mode. Use 'docker exec -it winnow winnow' to run."
+    exec sleep infinity
+fi
+
 echo "▶ Running on startup..."
-/app/.venv/bin/python -m winnow.cli
+/app/.venv/bin/winnow
 
-# 2. If a schedule exists, start the scheduler
 if [ -n "${CRON_SCHEDULE:-}" ]; then
     echo "▶ CRON_SCHEDULE set to: $CRON_SCHEDULE"
     echo "▶ Switching to scheduled mode..."
@@ -14,4 +22,3 @@ if [ -n "${CRON_SCHEDULE:-}" ]; then
 else
     echo "▶ No schedule set, exiting."
 fi
-

pyproject.toml

@@ -1,64 +1,70 @@
 [project]
 name = "winnow"
-version = "0.2.1"
-description = "Immich to Frigate training sets"
-license = "MIT"
-requires-python = ">=3.12"
+version = "0.6.6"
+description = "Selects diverse, high-quality photos from Immich as training data for Frigate face recognition."
+license = "AGPL-3.0-or-later"
+requires-python = ">=3.13"
 authors = [{ name = "Holden Salomon", email = "holden@arch.fyi" }]
 keywords = ["immich", "frigate", "face-recognition", "training-data", "arcface", "insightface"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3.12",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
+    "Programming Language :: Python :: 3.13",
     "Topic :: Scientific/Engineering :: Image Recognition",
 ]
 dependencies = [
-    "croniter>=5.0.2",
+    "croniter>=6.2.3",
     "insightface>=0.7.3",
-    "nvidia-cudnn-cu12>=9.0.0",
-    "numpy>=2.2.6",
-    "onnxruntime-gpu>=1.23.2",
-    "opencv-python-headless>=4.12.0.88",
-    "pillow>=12.1.0",
+    "numpy>=2.5.1",
+    "opencv-python-headless>=5.0.0.93",
+    "pillow>=12.3.0",
     "python-dotenv>=1.2.1",
     "requests>=2.32.5",
     "rich>=14.2.0",
-    "torch>=2.6.0",
-    "transformers>=4.57.6",
-    "ultralytics>=8.3.252",
 ]
 
+[project.optional-dependencies]
+gpu   = [
+    "onnxruntime-gpu>=1.27.0; sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "nvidia-cudnn-cu12>=9.24.0.43; sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "nvidia-cuda-runtime-cu12>=12.0; sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "nvidia-cufft-cu12>=11.0; sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "nvidia-curand-cu12>=10.0; sys_platform == 'linux' and platform_machine == 'x86_64'",
+]
+rocm  = ["onnxruntime-rocm>=1.16.0; sys_platform == 'linux' and platform_machine == 'x86_64'"]
+intel = ["onnxruntime-openvino>=1.20.0; sys_platform == 'linux' and platform_machine == 'x86_64'"]
+cpu   = ["onnxruntime>=1.27.0"]
+
 [project.scripts]
 winnow = "winnow.cli:main"
 
 [project.urls]
 Repository = "https://github.com/sudolulo/winnow"
+Changelog = "https://github.com/sudolulo/winnow/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/sudolulo/winnow/wiki"
 
 [tool.uv]
-override-dependencies = ["onnxruntime-gpu>=1.23.2"]
-
-[tool.uv.sources]
-torch = [
-    { index = "pytorch-cu126", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'aarch64'" },
-    { index = "pytorch-cpu", marker = "sys_platform != 'linux'" },
+index-strategy = "unsafe-best-match"
+conflicts = [
+    [
+        { extra = "gpu" },
+        { extra = "rocm" },
+        { extra = "intel" },
+        { extra = "cpu" },
+    ],
+]
+required-environments = [
+    "sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "sys_platform == 'linux' and platform_machine == 'aarch64'",
 ]
 
-[[tool.uv.index]]
-name = "pytorch-cu126"
-url = "https://download.pytorch.org/whl/cu126"
-explicit = true
-
-[[tool.uv.index]]
-name = "pytorch-cpu"
-url = "https://download.pytorch.org/whl/cpu"
-explicit = true
 
 [dependency-groups]
 dev = [
-    "pytest>=8.0",
-    "ruff>=0.9.2",
+    "pytest>=9.1.1",
+    "ruff>=0.15.20",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -66,7 +72,7 @@ packages = ["winnow"]
 
 [tool.ruff]
 line-length = 120
-target-version = "py312"
+target-version = "py313"
 
 [tool.ruff.lint]
 select = ["E", "F", "I"]
@@ -82,14 +88,14 @@ insightface = "insightface"
 numpy = "numpy"
 nvidia-cudnn-cu12 = "nvidia.cudnn"
 onnxruntime-gpu = "onnxruntime"
+onnxruntime-rocm = "onnxruntime"
+onnxruntime-openvino = "onnxruntime"
+onnxruntime = "onnxruntime"
 requests = "requests"
 rich = "rich"
-torch = "torch"
-transformers = "transformers"
-ultralytics = "ultralytics"
 
 [tool.deptry.per_rule_ignores]
-DEP002 = ["onnxruntime-gpu", "nvidia-cudnn-cu12"]
+DEP002 = ["onnxruntime-gpu", "nvidia-cudnn-cu12", "onnxruntime-rocm", "onnxruntime-openvino", "onnxruntime"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
@@ -97,4 +103,3 @@ testpaths = ["tests"]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
-

scheduler.py

@@ -1,7 +1,6 @@
 #!/usr/bin/env python3
 import logging
 import os
-import subprocess
 import sys
 import time
 from pathlib import Path
@@ -9,50 +8,57 @@ from pathlib import Path
 try:
     from croniter import croniter
 except ImportError:
-    print("❌ croniter not installed. Run: uv add croniter")
+    print("croniter not installed. Run: uv add croniter")
     sys.exit(1)
 
-SCHEDULE = os.environ["CRON_SCHEDULE"]
-MODELS_DIR = os.environ.get("HF_HOME", "/models/huggingface")
-INSIGHTFACE_BASE = os.environ.get("INSIGHTFACE_HOME", "/models")
-
-RUN_ENV = {**os.environ, "PYTHONUNBUFFERED": "1"}
+# Imported at module level so models loaded during the first run stay
+# resident in memory across all subsequent scheduled runs.
+from winnow.cli import main
 
 logger = logging.getLogger(__name__)
 
 
-def check_models():
-    """Log model status before each run."""
-    print("📦 Checking models...", flush=True)
-    buffalo = Path(INSIGHTFACE_BASE) / ".insightface" / "models" / "buffalo_l"
-    if buffalo.exists():
-        print("  ✅ InsightFace Buffalo_L: present", flush=True)
-    else:
-        print("  ⬇️  InsightFace Buffalo_L: not found — will download", flush=True)
-
-    hf_hub = Path(MODELS_DIR) / "hub"
-    if hf_hub.exists() and any(hf_hub.iterdir()):
-        print("  ✅ HuggingFace models: present", flush=True)
-    else:
-        print("  ⬇️  HuggingFace models: not found — will download", flush=True)
-    print("🚀 Starting winnow...", flush=True)
+def _check_models() -> None:
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", "/models/.insightface")
+    buffalo = Path(insightface_home) / "models" / "buffalo_l"
+    if not buffalo.exists():
+        print("  InsightFace Buffalo_L not found — will download on first run", flush=True)
 
 
-NOW = time.time()
-cron = croniter(SCHEDULE, NOW)
+def _run_scheduler() -> None:
+    schedule = os.environ.get("CRON_SCHEDULE")
+    if not schedule:
+        print("Error: CRON_SCHEDULE environment variable is required.", flush=True)
+        sys.exit(1)
+
+    try:
+        Path("/tmp/winnow.pid").write_text(str(os.getpid()))
+    except OSError as e:
+        print(f"Warning: could not write PID file: {e}", flush=True)
+
+    now = time.time()
+    cron = croniter(schedule, now)
     next_run = cron.get_next(float)
+    print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
 
     while True:
         now = time.time()
         if now >= next_run:
-        print(f"\n▶ [{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow...", flush=True)
-        check_models()
-        result = subprocess.run(["uv", "run", "winnow"], env=RUN_ENV)
-        if result.returncode != 0:
-            logger.error(f"winnow exited with code {result.returncode}")
-            print(f"❌ winnow failed with exit code {result.returncode}", flush=True)
-        else:
-            print("✅ winnow completed successfully", flush=True)
+            print(f"\n[{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow run...", flush=True)
+            _check_models()
+            try:
+                main()
+                print("winnow run complete", flush=True)
+            except (KeyboardInterrupt, SystemExit):
+                raise
+            except Exception as e:
+                logger.error("winnow run failed: %s", e, exc_info=True)
+                print(f"winnow run failed: {e}", flush=True)
+            cron = croniter(schedule, time.time())
             next_run = cron.get_next(float)
-    time.sleep(60)
+            print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+        time.sleep(min(60, max(1, next_run - time.time())))
 
+
+if __name__ == "__main__":
+    _run_scheduler()

scripts/benchmark.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""
+winnow inference benchmark: GPU vs CPU throughput.
+
+Measures InsightFace (ArcFace) latency and throughput.
+Run with FORCE_CPU=true for CPU-only baseline.
+
+Usage inside container:
+    # GPU mode:
+    docker exec winnow python /app/scripts/benchmark.py
+
+    # CPU mode:
+    docker exec -e FORCE_CPU=true winnow python /app/scripts/benchmark.py
+"""
+
+import sys
+import time
+
+import numpy as np
+from PIL import Image, ImageDraw
+
+
+def _mode_label() -> str:
+    from winnow.config import _getenv_bool
+    return "CPU (FORCE_CPU=true)" if _getenv_bool("FORCE_CPU", False) else "GPU (auto)"
+
+
+def make_face_image(size: int = 640) -> Image.Image:
+    """Synthetic face-like image: skin-tone rectangle with landmark blobs."""
+    img = Image.new("RGB", (size, size), (200, 170, 140))
+    draw = ImageDraw.Draw(img)
+    # Head oval
+    cx, cy = size // 2, size // 2
+    hw, hh = int(size * 0.3), int(size * 0.38)
+    draw.ellipse([cx - hw, cy - hh, cx + hw, cy + hh], fill=(220, 185, 155))
+    # Eyes
+    for ex in [cx - int(size * 0.1), cx + int(size * 0.1)]:
+        ey = cy - int(size * 0.05)
+        r = max(4, size // 40)
+        draw.ellipse([ex - r, ey - r, ex + r, ey + r], fill=(40, 30, 20))
+    # Nose
+    draw.ellipse([cx - 5, cy + 5, cx + 5, cy + 15], fill=(180, 140, 110))
+    # Mouth
+    draw.arc([cx - 20, cy + 25, cx + 20, cy + 45], start=0, end=180, fill=(160, 80, 80), width=3)
+    return img
+
+
+def _stats(times_s: list[float]) -> dict:
+    arr = np.array(times_s) * 1000  # ms
+    return {
+        "median_ms": float(np.median(arr)),
+        "mean_ms": float(np.mean(arr)),
+        "min_ms": float(np.min(arr)),
+        "p95_ms": float(np.percentile(arr, 95)),
+        "ips": 1000.0 / float(np.median(arr)),
+    }
+
+
+def bench_insightface(n_warmup: int = 5, n_runs: int = 30) -> None:
+    import cv2
+
+    import winnow.embeddings as emb_mod
+    from winnow.embeddings import get_insightface_app
+
+    # Reset singleton so we get a fresh load
+    emb_mod._insightface_app = None
+    emb_mod._insightface_loaded = False
+
+    print("  Loading model...")
+    t_load = time.perf_counter()
+    app = get_insightface_app()
+    load_s = time.perf_counter() - t_load
+
+    if app is None:
+        print("  SKIP: InsightFace failed to load")
+        return
+
+    img_pil = make_face_image(640)
+    img_bgr = cv2.cvtColor(np.asarray(img_pil), cv2.COLOR_RGB2BGR)
+
+    # Warmup
+    for _ in range(n_warmup):
+        app.get(img_bgr)
+
+    # Timed — single image 640×640
+    times: list[float] = []
+    for _ in range(n_runs):
+        t0 = time.perf_counter()
+        app.get(img_bgr)
+        times.append(time.perf_counter() - t0)
+
+    s = _stats(times)
+    print(f"  Model load time : {load_s:.2f} s")
+    print("  Input size      : 640×640")
+    print(f"  Runs            : {n_runs} (after {n_warmup} warmup)")
+    print(f"  Median latency  : {s['median_ms']:.1f} ms")
+    print(f"  Mean / p95      : {s['mean_ms']:.1f} ms / {s['p95_ms']:.1f} ms")
+    print(f"  Min latency     : {s['min_ms']:.1f} ms")
+    print(f"  Throughput      : {s['ips']:.1f} images/s")
+
+    # Also test at 320×320
+    img_sm = make_face_image(320)
+    img_sm_bgr = cv2.cvtColor(np.asarray(img_sm), cv2.COLOR_RGB2BGR)
+    for _ in range(n_warmup):
+        app.get(img_sm_bgr)
+    times_sm: list[float] = []
+    for _ in range(n_runs):
+        t0 = time.perf_counter()
+        app.get(img_sm_bgr)
+        times_sm.append(time.perf_counter() - t0)
+    s2 = _stats(times_sm)
+    print(f"  320×320 median  : {s2['median_ms']:.1f} ms  ({s2['ips']:.1f} img/s)")
+
+
+def main() -> None:
+    print("=" * 56)
+    print("  winnow inference benchmark")
+    print(f"  Mode: {_mode_label()}")
+    print("=" * 56)
+    print()
+
+    print("── InsightFace Buffalo_L  (face detection + ArcFace) ──")
+    bench_insightface()
+    print()
+
+
+if __name__ == "__main__":
+    # Add winnow to path when run directly inside container
+    sys.path.insert(0, "/app")
+    main()

tests/test_config.py

@@ -17,15 +17,16 @@ def test_config_loads_defaults(monkeypatch):
     assert cfg.API_KEY == "test-key"
     assert cfg.OUTPUT_DIR == "./frigate_train"
     assert cfg.YEARS_FILTER == 10
-    assert cfg.MIN_FACE_WIDTH == 50
-    assert cfg.MIN_FACE_COUNT == 0
-    assert cfg.BLUR_THRESHOLD == 100.0
+    assert cfg.MIN_FACE_WIDTH == 90
+    assert cfg.MIN_FACE_COUNT == 3
+    assert cfg.BLUR_THRESHOLD == 120.0
     assert cfg.MIN_CONFIDENCE == 0.7
-    assert cfg.MAX_AUTO_IMAGES == 80
+    assert cfg.MAX_AUTO_IMAGES == 5
+    assert cfg.QUALITY_REPLACEMENT is True
     assert cfg.FACE_MARGIN == 0.15
     assert cfg.USE_FULL_RESOLUTION is True
     assert cfg.ENABLE_FACE_ALIGNMENT is True
-    assert cfg.ENABLE_CACHE is False
+    assert cfg.ENABLE_CACHE is True
 
     _Config.reset()
 
@@ -39,6 +40,7 @@ def test_config_env_overrides(monkeypatch):
     monkeypatch.setenv("BLUR_THRESHOLD", "50.0")
     monkeypatch.setenv("MIN_CONFIDENCE", "0.9")
     monkeypatch.setenv("MAX_AUTO_IMAGES", "40")
+    monkeypatch.setenv("QUALITY_REPLACEMENT", "false")
     monkeypatch.setenv("FACE_MARGIN", "0.2")
     monkeypatch.setenv("USE_FULL_RESOLUTION", "false")
     monkeypatch.setenv("ENABLE_FACE_ALIGNMENT", "false")
@@ -54,6 +56,7 @@ def test_config_env_overrides(monkeypatch):
     assert cfg.BLUR_THRESHOLD == 50.0
     assert cfg.MIN_CONFIDENCE == 0.9
     assert cfg.MAX_AUTO_IMAGES == 40
+    assert cfg.QUALITY_REPLACEMENT is False
     assert cfg.FACE_MARGIN == 0.2
     assert cfg.USE_FULL_RESOLUTION is False
     assert cfg.ENABLE_FACE_ALIGNMENT is False

tests/test_diversity.py

@@ -0,0 +1,336 @@
+"""Tests for core diversity selection algorithms (pure functions, no network)."""
+
+import numpy as np
+import pytest
+from PIL import Image
+
+
+def _unit_embeddings(n: int, d: int = 512, seed: int = 42) -> list:
+    """Return n normalised random embeddings — well-separated in high-dim space."""
+    rng = np.random.default_rng(seed)
+    embs = rng.standard_normal((n, d)).astype(np.float32)
+    embs /= np.linalg.norm(embs, axis=1, keepdims=True)
+    return list(embs)
+
+
+def _asset_with_face(
+    asset_id="a1", person_id="p1",
+    x1=10, y1=10, x2=60, y2=60,
+    img_w=100, img_h=100, score=0.9,
+):
+    return {
+        "id": asset_id,
+        "people": [{
+            "id": person_id,
+            "faces": [{
+                "boundingBoxX1": x1, "boundingBoxY1": y1,
+                "boundingBoxX2": x2, "boundingBoxY2": y2,
+                "imageWidth": img_w, "imageHeight": img_h,
+                "score": score,
+            }],
+        }],
+    }
+
+
+# ── _get_face_bbox ─────────────────────────────────────────────────────────────
+
+def test_get_face_bbox_returns_coords():
+    from winnow.diversity import _get_face_bbox
+    asset = _asset_with_face(x1=5, y1=10, x2=55, y2=70)
+    assert _get_face_bbox(asset) == (5, 10, 55, 70)
+
+
+def test_get_face_bbox_filters_by_person_id():
+    from winnow.diversity import _get_face_bbox
+    asset = _asset_with_face(person_id="p1")
+    assert _get_face_bbox(asset, person_id="p999") is None
+
+
+def test_get_face_bbox_returns_none_empty_faces():
+    from winnow.diversity import _get_face_bbox
+    asset = {"id": "a1", "people": [{"id": "p1", "faces": []}]}
+    assert _get_face_bbox(asset) is None
+
+
+def test_get_face_bbox_returns_none_no_people():
+    from winnow.diversity import _get_face_bbox
+    assert _get_face_bbox({"id": "a1"}) is None
+
+
+# ── _get_face_confidence ───────────────────────────────────────────────────────
+
+def test_get_face_confidence_returns_score():
+    from winnow.diversity import _get_face_confidence
+    asset = _asset_with_face(score=0.92)
+    assert _get_face_confidence(asset) == pytest.approx(0.92)
+
+
+def test_get_face_confidence_filters_by_person_id():
+    from winnow.diversity import _get_face_confidence
+    asset = _asset_with_face(person_id="p1", score=0.9)
+    assert _get_face_confidence(asset, person_id="p999") is None
+
+
+def test_get_face_confidence_returns_none_empty_faces():
+    from winnow.diversity import _get_face_confidence
+    asset = {"id": "a1", "people": [{"id": "p1", "faces": []}]}
+    assert _get_face_confidence(asset) is None
+
+
+# ── _crop_face_from_thumbnail ──────────────────────────────────────────────────
+
+def test_crop_face_returns_image():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200), color=(128, 64, 32))
+    asset = _asset_with_face(x1=50, y1=50, x2=150, y2=150, img_w=200, img_h=200)
+    crop = _crop_face_from_thumbnail(img, asset)
+    assert crop is not None
+    assert crop.width > 0 and crop.height > 0
+
+
+def test_crop_face_scales_bbox_to_thumbnail():
+    """When thumbnail is half the metadata dimensions, bbox is scaled accordingly."""
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200))
+    # Metadata says 400×400; bbox covers the centre quarter
+    asset = _asset_with_face(x1=100, y1=100, x2=300, y2=300, img_w=400, img_h=400)
+    crop = _crop_face_from_thumbnail(img, asset)
+    assert crop is not None
+    assert crop.width <= 200 and crop.height <= 200
+
+
+def test_crop_face_returns_none_no_metadata():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (100, 100))
+    assert _crop_face_from_thumbnail(img, {"id": "a1"}) is None
+
+
+def test_crop_face_returns_none_for_sub_30px_bbox():
+    """A 1×1 bbox produces a crop too small to embed — should be rejected."""
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (100, 100))
+    asset = _asset_with_face(x1=50, y1=50, x2=51, y2=51, img_w=100, img_h=100)
+    assert _crop_face_from_thumbnail(img, asset) is None
+
+
+def test_crop_face_respects_person_id_filter():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200))
+    asset = _asset_with_face(person_id="p1", x1=50, y1=50, x2=150, y2=150)
+    assert _crop_face_from_thumbnail(img, asset, person_id="p999") is None
+
+
+# ── _dedup_embeddings ──────────────────────────────────────────────────────────
+
+def test_dedup_keeps_all_diverse_embeddings():
+    from winnow.diversity import _dedup_embeddings
+    embs = _unit_embeddings(20)
+    candidates = [{"id": str(i)} for i in range(20)]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None] * 20)
+    # Random 512-dim unit vectors are far apart — all should survive
+    assert len(out_cands) == 20
+
+
+def test_dedup_removes_near_duplicate():
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    # Cosine distance ≈ 0.01 — well within the 0.20 dedup threshold
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    embs = [base, near_dup]
+    candidates = [{"id": "base", "quality_score": 0.9}, {"id": "dup", "quality_score": 0.5}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert len(out_cands) == 1
+    assert out_cands[0]["id"] == "base"
+
+
+def test_dedup_keeps_higher_quality_from_duplicate_pair():
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    # Reversed quality: near_dup is sharper
+    embs = [base, near_dup]
+    candidates = [{"id": "base", "quality_score": 0.3}, {"id": "dup", "quality_score": 0.95}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert len(out_cands) == 1
+    assert out_cands[0]["id"] == "dup"
+
+
+def test_dedup_single_embedding_passes_through():
+    from winnow.diversity import _dedup_embeddings
+    embs = _unit_embeddings(1)
+    out_embs, out_cands, _ = _dedup_embeddings(embs, [{"id": "only"}], [None])
+    assert len(out_cands) == 1
+
+
+def test_dedup_treats_zero_quality_score_as_zero_not_missing():
+    """quality_score=0.0 is a valid score — should not be treated as absent."""
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    embs = [base, near_dup]
+    # base has explicit 0.0; near_dup has 0.5 — near_dup should win
+    candidates = [{"id": "base", "quality_score": 0.0}, {"id": "dup", "quality_score": 0.5}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert out_cands[0]["id"] == "dup"
+
+
+# ── _kmedoids ──────────────────────────────────────────────────────────────────
+
+def _dist_matrix(embs):
+    m = np.vstack(embs)
+    m /= np.linalg.norm(m, axis=1, keepdims=True)
+    return 1 - m @ m.T
+
+
+def test_kmedoids_returns_k_distinct_medoids():
+    from winnow.diversity import _kmedoids
+    dist = _dist_matrix(_unit_embeddings(30))
+    medoids, _ = _kmedoids(dist, k=5)
+    assert len(medoids) == 5
+    assert len(set(medoids)) == 5
+
+
+def test_kmedoids_labels_cover_all_points():
+    from winnow.diversity import _kmedoids
+    dist = _dist_matrix(_unit_embeddings(20))
+    medoids, labels = _kmedoids(dist, k=4)
+    assert len(labels) == 20
+    assert set(labels).issubset(set(range(4)))
+
+
+def test_kmedoids_medoids_are_valid_indices():
+    from winnow.diversity import _kmedoids
+    n = 15
+    dist = _dist_matrix(_unit_embeddings(n))
+    medoids, _ = _kmedoids(dist, k=3)
+    assert all(0 <= m < n for m in medoids)
+
+
+def test_kmedoids_k_equals_n_selects_all():
+    from winnow.diversity import _kmedoids
+    n = 5
+    dist = _dist_matrix(_unit_embeddings(n))
+    medoids, _ = _kmedoids(dist, k=n)
+    assert len(medoids) == n
+
+
+# ── _compute_adaptive_threshold ────────────────────────────────────────────────
+
+def test_adaptive_threshold_positive():
+    from winnow.diversity import _compute_adaptive_threshold
+    embs = np.array(_unit_embeddings(50))
+    assert _compute_adaptive_threshold(embs) > 0
+
+
+def test_adaptive_threshold_floor_for_identical_embeddings():
+    """All-identical embeddings → median pairwise distance = 0 → floor at 0.05."""
+    from winnow.diversity import _compute_adaptive_threshold
+    base = np.zeros((10, 512), dtype=np.float32)
+    base[:, 0] = 1.0
+    assert _compute_adaptive_threshold(base) == pytest.approx(0.05)
+
+
+def test_adaptive_threshold_single_point_returns_floor():
+    from winnow.diversity import _compute_adaptive_threshold
+    single = np.ones((1, 512), dtype=np.float32)
+    single /= np.linalg.norm(single)
+    assert _compute_adaptive_threshold(single) == pytest.approx(0.05)
+
+
+def test_adaptive_threshold_scales_with_spread():
+    """A more spread-out embedding set should produce a higher threshold."""
+    from winnow.diversity import _compute_adaptive_threshold
+    tight = np.array(_unit_embeddings(30, seed=0)) * 0.001 + np.array([1.0] + [0.0] * 511)
+    tight /= np.linalg.norm(tight, axis=1, keepdims=True)
+    diverse = np.array(_unit_embeddings(30, seed=1))
+    assert _compute_adaptive_threshold(diverse) > _compute_adaptive_threshold(tight)
+
+
+# ── _select_time_spread ────────────────────────────────────────────────────────
+
+def test_time_spread_returns_exact_n():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(100)]
+    assert len(_select_time_spread(assets, limit=10)) == 10
+
+
+def test_time_spread_returns_all_when_under_limit():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(5)]
+    assert len(_select_time_spread(assets, limit=20)) == 5
+
+
+def test_time_spread_auto_defaults_to_30():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(200)]
+    assert len(_select_time_spread(assets, limit="auto")) == 30
+
+
+def test_time_spread_includes_first_and_last():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(100)]
+    result = _select_time_spread(assets, limit=5)
+    ids = [int(a["id"]) for a in result]
+    assert ids[0] == 0
+    assert ids[-1] == 99
+
+
+# ── _cluster_aware_selection ───────────────────────────────────────────────────
+
+def test_cluster_selection_returns_exact_limit(monkeypatch):
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(50)
+    candidates = [{"id": str(i)} for i in range(50)]
+    result = _cluster_aware_selection(embs, candidates, limit=10)
+    assert len(result) == 10
+
+
+def test_cluster_selection_output_is_subset_of_input(monkeypatch):
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(30)
+    candidates = [{"id": str(i)} for i in range(30)]
+    result = _cluster_aware_selection(embs, candidates, limit=10)
+    result_ids = {a["id"] for a in result}
+    assert result_ids.issubset({a["id"] for a in candidates})
+
+
+def test_cluster_selection_auto_stops_early_on_tight_cluster(monkeypatch):
+    """When all embeddings are nearly identical auto mode should stop early."""
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    rng = np.random.default_rng(0)
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    embs = []
+    for _ in range(50):
+        v = base + rng.standard_normal(512).astype(np.float32) * 0.001
+        v /= np.linalg.norm(v)
+        embs.append(v)
+    candidates = [{"id": str(i)} for i in range(50)]
+    result = _cluster_aware_selection(list(embs), candidates, limit="auto")
+    assert len(result) < 20
+
+
+def test_cluster_selection_hard_example_weighting_accepted(monkeypatch):
+    """Confidence scores are accepted without error."""
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(20)
+    candidates = [{"id": str(i)} for i in range(20)]
+    conf = [0.7 if i % 2 == 0 else 0.95 for i in range(20)]
+    result = _cluster_aware_selection(embs, candidates, limit=5, confidence_scores=conf)
+    assert len(result) == 5

tests/test_quality.py

@@ -0,0 +1,161 @@
+"""Tests for image quality filtering functions."""
+
+import numpy as np
+from PIL import Image
+
+
+def _rgb_image(r, g, b, size=(100, 100)) -> Image.Image:
+    arr = np.full((*size, 3), [r, g, b], dtype=np.uint8)
+    return Image.fromarray(arr, "RGB")
+
+
+def _noisy_color_image(size=(100, 100)) -> Image.Image:
+    """Noisy image with a strong red channel so grayscale check passes."""
+    rng = np.random.default_rng(0)
+    arr = rng.integers(0, 256, (*size, 3), dtype=np.uint8)
+    arr[:, :, 0] = np.clip(arr[:, :, 0].astype(int) + 80, 0, 255).astype(np.uint8)
+    arr[:, :, 2] = np.clip(arr[:, :, 2].astype(int) - 80, 0, 255).astype(np.uint8)
+    return Image.fromarray(arr, "RGB")
+
+
+# ── check_blur ────────────────────────────────────────────────────────────────
+
+def test_blur_rejects_flat_image():
+    from winnow.quality import check_blur
+    flat = np.full((100, 100, 3), 128, dtype=np.uint8)
+    passed, reason = check_blur(flat, threshold=100.0)
+    assert not passed
+    assert "Blurry" in reason
+
+
+def test_blur_passes_noisy_color_image():
+    from winnow.quality import check_blur
+    img = _noisy_color_image()
+    passed, _ = check_blur(np.asarray(img), threshold=100.0)
+    assert passed
+
+
+# ── check_grayscale ───────────────────────────────────────────────────────────
+
+def test_grayscale_rejects_ir_image():
+    from winnow.quality import check_grayscale
+    gray = np.full((100, 100, 3), 128, dtype=np.uint8)
+    passed, reason = check_grayscale(gray)
+    assert not passed
+    assert "Grayscale" in reason
+
+
+def test_grayscale_passes_color_image():
+    from winnow.quality import check_grayscale
+    color = np.zeros((100, 100, 3), dtype=np.uint8)
+    color[:, :, 0] = 200  # strong red channel
+    passed, _ = check_grayscale(color)
+    assert passed
+
+
+def test_grayscale_rejects_single_channel():
+    from winnow.quality import check_grayscale
+    single = np.full((100, 100, 1), 128, dtype=np.uint8)
+    passed, reason = check_grayscale(single)
+    assert not passed
+
+
+# ── check_exposure ────────────────────────────────────────────────────────────
+
+def test_exposure_rejects_black_image():
+    from winnow.quality import check_exposure
+    black = np.zeros((100, 100, 3), dtype=np.uint8)
+    passed, reason = check_exposure(black)
+    assert not passed
+    assert "Underexposed" in reason
+
+
+def test_exposure_rejects_white_image():
+    from winnow.quality import check_exposure
+    white = np.full((100, 100, 3), 255, dtype=np.uint8)
+    passed, reason = check_exposure(white)
+    assert not passed
+    assert "Overexposed" in reason
+
+
+def test_exposure_passes_normal_image():
+    from winnow.quality import check_exposure
+    mid = np.full((100, 100, 3), 128, dtype=np.uint8)
+    passed, _ = check_exposure(mid)
+    assert passed
+
+
+# ── check_face_size ───────────────────────────────────────────────────────────
+
+def test_face_size_rejects_small_face():
+    from winnow.quality import check_face_size
+    passed, reason = check_face_size(30, 30, min_px=50)
+    assert not passed
+    assert "small" in reason
+
+
+def test_face_size_passes_adequate_face():
+    from winnow.quality import check_face_size
+    passed, _ = check_face_size(100, 100, min_px=50)
+    assert passed
+
+
+def test_face_size_rejects_if_either_dimension_small():
+    from winnow.quality import check_face_size
+    passed, _ = check_face_size(100, 30, min_px=50)
+    assert not passed
+
+
+# ── check_confidence ──────────────────────────────────────────────────────────
+
+def test_confidence_rejects_low_score():
+    from winnow.quality import check_confidence
+    passed, reason = check_confidence(0.5, min_conf=0.7)
+    assert not passed
+    assert "confidence" in reason.lower()
+
+
+def test_confidence_passes_high_score():
+    from winnow.quality import check_confidence
+    passed, _ = check_confidence(0.95, min_conf=0.7)
+    assert passed
+
+
+def test_confidence_passes_none_score():
+    from winnow.quality import check_confidence
+    passed, _ = check_confidence(None, min_conf=0.7)
+    assert passed
+
+
+# ── assess_quality (integration) ─────────────────────────────────────────────
+
+def test_assess_quality_passes_good_image():
+    from winnow.quality import assess_quality
+    img = _noisy_color_image()
+    result = assess_quality(img, face_bbox=(10, 10, 110, 110), confidence=0.9)
+    assert result.passed
+    assert result.blur_score is not None
+    assert result.blur_score > 0
+
+
+def test_assess_quality_blur_score_is_low_for_flat_image():
+    from winnow.quality import assess_quality
+    flat = _rgb_image(128, 128, 128)
+    result = assess_quality(flat)
+    assert result.blur_score is not None
+    assert result.blur_score < 1.0
+
+
+def test_assess_quality_collects_multiple_failures():
+    from winnow.quality import assess_quality
+    black = _rgb_image(0, 0, 0)
+    result = assess_quality(black, face_bbox=(0, 0, 10, 10), confidence=0.3)
+    assert not result.passed
+    assert len(result.reasons) >= 2
+
+
+def test_assess_quality_skips_face_size_without_bbox():
+    from winnow.quality import assess_quality
+    img = _noisy_color_image()
+    result = assess_quality(img, face_bbox=None, confidence=0.9)
+    assert result.passed

tests/test_upload_tracker.py

@@ -7,7 +7,7 @@ import pytest
 @pytest.fixture(autouse=True)
 def isolated_cache(monkeypatch, tmp_path):
     """Point tracker at a temp directory so tests don't touch real cache files."""
-    monkeypatch.setenv("CACHE_DIR", str(tmp_path))
+    monkeypatch.setenv("DATA_DIR", str(tmp_path))
     from winnow.config import _Config
     _Config.reset()
     yield tmp_path
@@ -69,3 +69,194 @@ def test_duplicate_marks_are_idempotent():
     mark_uploaded("dup", person_name="Alice")
     mark_uploaded("dup", person_name="Alice")
     assert filter_already_uploaded(["dup", "new"]) == ["new"]
+
+
+# ── frigate_files mapping ─────────────────────────────────────────────────────
+
+def test_record_and_remove_frigate_file():
+    from winnow.upload_tracker import get_person_summary, record_frigate_file, remove_frigate_file
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a1")
+    assert "Alice-1000.webp" in get_person_summary()["Alice"]["frigate_files"]
+    remove_frigate_file("Alice", "Alice-1000.webp")
+    assert "Alice-1000.webp" not in get_person_summary()["Alice"]["frigate_files"]
+
+
+def test_remove_nonexistent_frigate_file_is_safe():
+    from winnow.upload_tracker import remove_frigate_file
+    # Should not raise even if the file was never recorded
+    remove_frigate_file("Alice", "Alice-ghost.webp")
+
+
+def test_remove_frigate_file_does_not_unmark_asset():
+    """Deleting a Frigate file should not re-expose the source asset for upload."""
+    from winnow.upload_tracker import (
+        filter_already_uploaded,
+        mark_uploaded,
+        record_frigate_file,
+        remove_frigate_file,
+    )
+    mark_uploaded("asset-a1", person_name="Alice")
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a1")
+    remove_frigate_file("Alice", "Alice-1000.webp")
+    # Asset must still be excluded — it was deliberately replaced, not lost
+    assert filter_already_uploaded(["asset-a1"]) == []
+
+
+def test_get_tracked_frigate_file_count_zero_when_empty():
+    from winnow.upload_tracker import get_tracked_frigate_file_count
+    assert get_tracked_frigate_file_count("Alice") == 0
+
+
+def test_get_tracked_frigate_file_count_counts_only_mapped():
+    """Only files explicitly recorded via record_frigate_file count toward the cap."""
+    from winnow.upload_tracker import get_tracked_frigate_file_count, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-a", person_name="Alice")
+    mark_uploaded("asset-b", person_name="Alice")
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a")
+    # asset-b is uploaded but not yet mapped — does not count
+    assert get_tracked_frigate_file_count("Alice") == 1
+    record_frigate_file("Alice", "Alice-1001.webp", "asset-b")
+    assert get_tracked_frigate_file_count("Alice") == 2
+
+
+def test_get_lowest_quality_mapped_file_none_when_empty():
+    from winnow.upload_tracker import get_lowest_quality_mapped_file
+    assert get_lowest_quality_mapped_file("Alice") is None
+
+
+def test_get_lowest_quality_mapped_file_returns_lowest():
+    from winnow.upload_tracker import (
+        get_lowest_quality_mapped_file,
+        mark_uploaded,
+        record_frigate_file,
+    )
+    mark_uploaded("asset-hi", person_name="Alice", score=0.95)
+    mark_uploaded("asset-lo", person_name="Alice", score=0.71)
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-hi")
+    record_frigate_file("Alice", "Alice-1001.webp", "asset-lo")
+    result = get_lowest_quality_mapped_file("Alice")
+    assert result is not None
+    frigate_filename, asset_id, score = result
+    assert frigate_filename == "Alice-1001.webp"
+    assert asset_id == "asset-lo"
+    assert score == pytest.approx(0.71, abs=0.001)
+
+
+def test_get_lowest_quality_mapped_file_skips_unscored():
+    """Files mapped without a score should not be returned as candidates."""
+    from winnow.upload_tracker import (
+        get_lowest_quality_mapped_file,
+        mark_uploaded,
+        record_frigate_file,
+    )
+    mark_uploaded("asset-scored", person_name="Alice", score=0.85)
+    mark_uploaded("asset-noscr", person_name="Alice")
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-scored")
+    record_frigate_file("Alice", "Alice-1001.webp", "asset-noscr")
+    result = get_lowest_quality_mapped_file("Alice")
+    assert result is not None
+    assert result[1] == "asset-scored"  # only scored file is a candidate
+
+
+# ── get_tracked_frigate_filenames ─────────────────────────────────────────────
+
+def test_get_tracked_frigate_filenames_empty():
+    from winnow.upload_tracker import get_tracked_frigate_filenames
+    assert get_tracked_frigate_filenames("Alice") == set()
+
+
+def test_get_tracked_frigate_filenames_returns_mapped():
+    from winnow.upload_tracker import get_tracked_frigate_filenames, record_frigate_file
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a")
+    record_frigate_file("Alice", "Alice-1001.webp", "asset-b")
+    assert get_tracked_frigate_filenames("Alice") == {"Alice-1000.webp", "Alice-1001.webp"}
+
+
+def test_get_tracked_frigate_filenames_excludes_removed():
+    from winnow.upload_tracker import (
+        get_tracked_frigate_filenames,
+        record_frigate_file,
+        remove_frigate_file,
+    )
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a")
+    record_frigate_file("Alice", "Alice-1001.webp", "asset-b")
+    remove_frigate_file("Alice", "Alice-1000.webp")
+    assert get_tracked_frigate_filenames("Alice") == {"Alice-1001.webp"}
+
+
+def test_get_tracked_frigate_filenames_isolated_by_person():
+    from winnow.upload_tracker import get_tracked_frigate_filenames, record_frigate_file
+    record_frigate_file("Alice", "Alice-1000.webp", "asset-a")
+    record_frigate_file("Bob", "Bob-2000.webp", "asset-b")
+    assert get_tracked_frigate_filenames("Alice") == {"Alice-1000.webp"}
+    assert get_tracked_frigate_filenames("Bob") == {"Bob-2000.webp"}
+
+
+# ── get_lowest_quality_mapped_file with exclude ───────────────────────────────
+
+def test_get_lowest_quality_exclude_skips_specified_file():
+    from winnow.upload_tracker import (
+        get_lowest_quality_mapped_file,
+        mark_uploaded,
+        record_frigate_file,
+    )
+    mark_uploaded("asset-lo", person_name="Alice", score=0.10)
+    mark_uploaded("asset-hi", person_name="Alice", score=0.90)
+    record_frigate_file("Alice", "Alice-lo.webp", "asset-lo")
+    record_frigate_file("Alice", "Alice-hi.webp", "asset-hi")
+    result = get_lowest_quality_mapped_file("Alice", exclude={"Alice-lo.webp"})
+    assert result is not None
+    assert result[1] == "asset-hi"  # lo was excluded; hi is returned
+
+
+def test_get_lowest_quality_exclude_all_returns_none():
+    from winnow.upload_tracker import (
+        get_lowest_quality_mapped_file,
+        mark_uploaded,
+        record_frigate_file,
+    )
+    mark_uploaded("asset-a", person_name="Alice", score=0.50)
+    record_frigate_file("Alice", "Alice-a.webp", "asset-a")
+    assert get_lowest_quality_mapped_file("Alice", exclude={"Alice-a.webp"}) is None
+
+
+# ── get_most_redundant_mapped_file ────────────────────────────────────────────
+
+def test_get_most_redundant_none_when_no_frigate_scores():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-a", person_name="Alice", score=0.80)
+    record_frigate_file("Alice", "Alice-a.webp", "asset-a")
+    # blur score only, no frigate_score → no candidates
+    assert get_most_redundant_mapped_file("Alice") is None
+
+
+def test_get_most_redundant_returns_highest_frigate_score():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-novel", person_name="Alice", score=0.50, frigate_score=0.31)
+    mark_uploaded("asset-redundant", person_name="Alice", score=0.90, frigate_score=0.88)
+    record_frigate_file("Alice", "Alice-novel.webp", "asset-novel")
+    record_frigate_file("Alice", "Alice-redundant.webp", "asset-redundant")
+    result = get_most_redundant_mapped_file("Alice")
+    assert result is not None
+    frigate_filename, asset_id, score = result
+    assert frigate_filename == "Alice-redundant.webp"
+    assert asset_id == "asset-redundant"
+    assert score == pytest.approx(0.88, abs=0.001)
+
+
+def test_get_most_redundant_exclude_skips_file():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-hi", person_name="Alice", score=0.9, frigate_score=0.85)
+    mark_uploaded("asset-lo", person_name="Alice", score=0.5, frigate_score=0.40)
+    record_frigate_file("Alice", "Alice-hi.webp", "asset-hi")
+    record_frigate_file("Alice", "Alice-lo.webp", "asset-lo")
+    result = get_most_redundant_mapped_file("Alice", exclude={"Alice-hi.webp"})
+    assert result is not None
+    assert result[1] == "asset-lo"  # hi excluded; lo is next highest
+
+
+def test_get_most_redundant_exclude_all_returns_none():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-a", person_name="Alice", score=0.5, frigate_score=0.70)
+    record_frigate_file("Alice", "Alice-a.webp", "asset-a")
+    assert get_most_redundant_mapped_file("Alice", exclude={"Alice-a.webp"}) is None

winnow/__init__.py

@@ -1,8 +1,12 @@
 """Immich to Frigate training set curator.
 
 AI-powered tool to extract high-quality, diverse training images from your
-Immich library for Frigate's Face Recognition (ArcFace) and Object/State
-Classification models.
+Immich library for Frigate's face recognition (ArcFace/Buffalo_L).
 """
 
-__version__ = "0.1.0"
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("winnow")
+except PackageNotFoundError:
+    __version__ = "unknown"

winnow/cache.py

@@ -7,38 +7,62 @@ recomputing on reruns. Uses numpy binary format for fast I/O.
 import hashlib
 import logging
 import os
+from pathlib import Path
 
 import numpy as np
 
 logger = logging.getLogger(__name__)
 
-# Model versions — bump these when the upstream model changes
 MODEL_VERSIONS = {
-    "insightface": "buffalo_l_v1",
-    "siglip": "siglip-base-patch16-224_v1",
     "immich": "immich_buffalo_l_v1",
 }
 
 
+def _insightface_model_fingerprint() -> str:
+    """Derive a version string from buffalo_l .onnx file sizes and mtimes.
+
+    Changes automatically when model files are replaced or updated, preventing
+    stale embeddings from a previous model being served from cache.
+    Falls back to a static string before the model is downloaded (first run).
+    """
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", os.path.expanduser("~/.insightface"))
+    model_dir = Path(insightface_home) / "models" / "buffalo_l"
+    if not model_dir.exists():
+        return "buffalo_l_v1"
+    onnx_files = sorted(model_dir.glob("*.onnx"))
+    if not onnx_files:
+        return "buffalo_l_v1"
+    fingerprint = "|".join(
+        f"{f.name}:{f.stat().st_size}:{int(f.stat().st_mtime)}"
+        for f in onnx_files
+    )
+    return hashlib.sha256(fingerprint.encode()).hexdigest()[:12]
+
+
 class EmbeddingCache:
     """Simple disk-based embedding cache.
 
     Embeddings are stored as .npy files in a flat directory,
-    keyed by a hash of (asset_id, model_version).
+    keyed by a hash of (asset_id, model_version). The InsightFace version
+    is derived from buffalo_l model file metadata so the cache auto-invalidates
+    when model files are replaced or updated.
     """
 
     def __init__(self, cache_dir: str = ".if_cache") -> None:
         self.cache_dir = cache_dir
         self._ensured = False
+        self._model_versions = {
+            **MODEL_VERSIONS,
+            "insightface": _insightface_model_fingerprint(),
+        }
 
     def _ensure_dir(self) -> None:
         if not self._ensured:
             os.makedirs(self.cache_dir, exist_ok=True)
             self._ensured = True
 
-    @staticmethod
-    def _key(asset_id: str, model: str) -> str:
-        version = MODEL_VERSIONS.get(model, model)
+    def _key(self, asset_id: str, model: str) -> str:
+        version = self._model_versions.get(model, model)
         raw = f"{asset_id}:{version}"
         return hashlib.sha256(raw.encode()).hexdigest()[:16]
 
@@ -58,10 +82,19 @@ class EmbeddingCache:
     def put(self, asset_id: str, embedding: np.ndarray, model: str = "insightface") -> None:
         """Store an embedding in the cache."""
         self._ensure_dir()
+        final = self._path(asset_id, model)
+        # Insert .tmp before .npy so np.save doesn't auto-append another .npy extension
+        # (np.save appends .npy to paths that don't already end in .npy).
+        tmp = final.removesuffix(".npy") + ".tmp.npy"
         try:
-            np.save(self._path(asset_id, model), embedding)
+            np.save(tmp, embedding)
+            os.replace(tmp, final)
         except Exception as e:
-            logger.debug(f"Cache write failed for {asset_id}: {e}")
+            logger.warning("Cache write failed for %s: %s", asset_id, e)
+            try:
+                os.remove(tmp)
+            except OSError:
+                pass
 
     def clear(self) -> None:
         """Delete all cached embeddings."""
@@ -70,25 +103,28 @@ class EmbeddingCache:
         count = 0
         for f in os.listdir(self.cache_dir):
             if f.endswith(".npy"):
+                try:
                     os.remove(os.path.join(self.cache_dir, f))
                     count += 1
-        logger.info(f"Cleared {count} cached embeddings.")
+                except OSError:
+                    pass
+        logger.info("Cleared %s cached embeddings.", count)
 
 
 # Singleton instance
 _cache: EmbeddingCache | None = None
+_cache_dir: str | None = None
 
 
 def get_cache(cache_dir: str = ".if_cache") -> EmbeddingCache:
     """Get or create the singleton cache instance.
 
-    Note: The ``cache_dir`` parameter is only used when creating the
-    singleton for the first time. Subsequent calls return the existing
-    instance regardless of ``cache_dir``. If you need a cache with a
-    different directory, instantiate ``EmbeddingCache`` directly.
+    Re-creates the instance when ``cache_dir`` changes so that test
+    isolation (which resets Config.DATA_DIR via _Config.reset()) always
+    writes to the correct directory rather than a stale one.
     """
-    global _cache
-    if _cache is None:
+    global _cache, _cache_dir
+    if _cache is None or _cache_dir != cache_dir:
         _cache = EmbeddingCache(cache_dir)
+        _cache_dir = cache_dir
     return _cache
-

winnow/cli.py

@@ -2,31 +2,207 @@
 
 import logging
 import os
+import sys
 
 from rich import print as rprint
 from rich.prompt import Confirm
 
-from .config import Config, ConfigManager
+from . import __version__
+from .config import Config, _getenv_bool
 from .executor import execute_jobs, upload_to_frigate
-from .immich_api import get_people
+from .immich_api import get_immich_version, get_people, merge_people
 from .jobs import _show_preview, auto_configure, interactive_configure
-from .logging import console, setup_logging
-from .upload_tracker import get_person_summary, reset_person
+from .log_config import console, setup_logging
+from .upload_tracker import find_by_crop_dimension, get_person_summary, reset_all_people, reset_person
 
 logger = logging.getLogger(__name__)
 
 
+def _handle_trace_crop(size_str: str) -> None:
+    """Print tracker records whose crop dimension matches the given pixel size and exit."""
+    try:
+        size = int(size_str)
+    except ValueError:
+        rprint(f"[bold red]TRACE_CROP_SIZE must be an integer, got: {size_str!r}[/bold red]")
+        sys.exit(1)
+
+    immich_url = os.environ.get("IMMICH_URL", "").rstrip("/")
+    matches = find_by_crop_dimension(size)
+    if not matches:
+        rprint(f"[yellow]No crops with dimension {size}px found in tracker.[/yellow]")
+        rprint("[dim]Note: crop dimensions are only recorded for uploads made after this feature was added.[/dim]")
+        sys.exit(0)
+
+    rprint(f"\n[bold]Crops matching dimension {size}px:[/bold] ({len(matches)} found)\n")
+    for m in matches:
+        rprint(f"  [bold cyan]{m['person']}[/bold cyan]")
+        rprint(f"    Dimensions:   {m['width']}×{m['height']}px")
+        rprint(f"    Asset ID:     {m['asset_id']}")
+        if immich_url:
+            rprint(f"    Immich URL:   {immich_url}/photos/{m['asset_id']}")
+        blur = m.get("blur_score")
+        rprint(f"    Blur score:   {blur:.1f}" if blur is not None else "    Blur score:   unknown")
+        fscore = m.get("frigate_score")
+        rprint(f"    Frigate score: {fscore:.2f}" if fscore is not None else "    Frigate score: unknown")
+        if m.get("frigate_filename"):
+            rprint(f"    Frigate file: {m['frigate_filename']}")
+        else:
+            rprint("    Frigate file: [dim]unmapped (reconciliation race)[/dim]")
+        rprint()
+    sys.exit(0)
+
+
+def _handle_duplicate_people(people: list[dict]) -> list[dict]:
+    """Warn about or merge Immich people that share the same name.
+
+    Duplicates arise when Immich creates separate person records for the same
+    individual (e.g. unmerged face clusters). Without handling, winnow would
+    run multiple jobs for the same Frigate folder and overwrite its own output,
+    leaving far fewer training images than expected.
+
+    With MERGE_DUPLICATE_PEOPLE=false (default): prints a warning, skips the
+    smaller duplicates so only the person with the most assets is processed,
+    and returns a deduplicated people list.
+    With MERGE_DUPLICATE_PEOPLE=true: merges each duplicate group inside
+    Immich via its API (permanently combines the face records), then
+    re-fetches the people list so the rest of the run sees the merged state.
+    """
+    from collections import defaultdict
+
+    by_name: dict[str, list[dict]] = defaultdict(list)
+    for p in people:
+        name = (p.get("name") or "").strip()
+        if name and p.get("id"):
+            by_name[name].append(p)
+
+    duplicates = {name: ps for name, ps in by_name.items() if len(ps) > 1}
+    if not duplicates:
+        return people
+
+    def _smaller_duplicate_ids(groups: dict) -> set[str]:
+        """IDs of all but the largest person in each duplicate group."""
+        return {
+            pid
+            for ps in groups.values()
+            for p in sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)[1:]
+            if (pid := p.get("id"))
+        }
+
+    skip_ids = _smaller_duplicate_ids(duplicates)
+
+    def _excl(lst: list[dict]) -> list[dict]:
+        return [p for p in lst if p.get("id") not in skip_ids]
+
+    if not Config.MERGE_DUPLICATE_PEOPLE:
+        rprint("\n[bold yellow]⚠  Duplicate person names detected in Immich:[/bold yellow]")
+        for name, ps in sorted(duplicates.items()):
+            ordered = sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)
+            entries = ", ".join(
+                f"[dim]{(p.get('id') or '?')[:8]}…[/dim] ({p.get('assetCount', 0)} assets)"
+                for p in ordered
+            )
+            rprint(f"  [yellow]{name}[/yellow] → {len(ps)} people: {entries}")
+            skipped = ordered[1:]
+            rprint(
+                f"  [dim]  Processing largest only "
+                f"({ordered[0].get('assetCount', 0)} assets). "
+                f"Skipping {len(skipped)} smaller duplicate(s) to avoid overwriting output.[/dim]"
+            )
+        rprint(
+            "  [dim]Set MERGE_DUPLICATE_PEOPLE=true to permanently merge duplicates "
+            "inside Immich (keeps the person with the most assets).[/dim]\n"
+        )
+        # Return deduplicated list — keep only the largest per name so that
+        # downstream job creation never runs two jobs for the same Frigate folder.
+        return _excl(people)
+
+    # Auto-merge: survivor = largest asset count, rest merge into it inside Immich
+    merged_any = False
+    for name, ps in sorted(duplicates.items()):
+        ordered = sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)
+        survivor = ordered[0]
+        survivor_id = survivor.get("id")
+        merge_ids = [pid for p in ordered[1:] if (pid := p.get("id")) is not None]
+        rprint(
+            f"  [cyan]Merging {name!r} inside Immich:[/cyan] keeping "
+            f"[dim]{survivor_id[:8]}…[/dim] ({survivor.get('assetCount', 0)} assets), "
+            f"absorbing {len(merge_ids)} smaller duplicate(s)..."
+        )
+        if merge_people(survivor_id, merge_ids):
+            rprint(f"  [green]✓ Merged {name!r}[/green]")
+            merged_any = True
+        else:
+            rprint(f"  [red]✗ Failed to merge {name!r}[/red]")
+
+    if merged_any:
+        rprint("  [dim]Re-fetching people after merge...[/dim]")
+        fresh = get_people()
+        if not fresh:
+            # Retry once: get_people() returns [] for both transient failures and
+            # auth errors (401); a second empty result strongly suggests a real failure.
+            fresh = get_people()
+        if not fresh:
+            logger.warning(
+                "Re-fetch after merge returned no people (tried twice)"
+                " — possible transient error or expired API key;"
+                " proceeding with pre-merge list. Check IMMICH_API_KEY if this recurs."
+            )
+            return _excl(people)
+        # Filter out the smaller duplicate from any group whose merge failed — those
+        # IDs still exist in Immich and would produce two jobs for the same folder.
+        # IDs from groups that merged successfully are already gone from Immich, so
+        # this filter is a no-op for them.
+        return _excl(fresh)
+
+    # All merges failed — fall back to local deduplication (keep largest per name) so
+    # downstream job creation never runs two jobs for the same Frigate folder.
+    rprint(
+        "  [yellow]All merges failed — applying local deduplication"
+        " to avoid overwriting output.[/yellow]"
+    )
+    return _excl(people)
+
+
+_UNSUPPORTED_VARS = [
+    "ENABLE_FRIGATE_SCORES",
+    "FRIGATE_SCORE_CEILING",
+    "MIN_FACE_WIDTH",
+    "FACE_MARGIN",
+    "ENABLE_FACE_ALIGNMENT",
+    "USE_FULL_RESOLUTION",
+    "MIN_CONFIDENCE",
+    "BLUR_THRESHOLD",
+]
+
+
 def main() -> None:
     """Entry point for winnow CLI."""
     try:
-        setup_logging(verbose=False)
+        verbose = _getenv_bool("VERBOSE", False)
+        setup_logging(verbose=verbose)
 
-        console.print(r"""
-    [bold blue]winnow[/bold blue]
+        trace_size = os.environ.get("TRACE_CROP_SIZE", "").strip()
+        if trace_size:
+            _handle_trace_crop(trace_size)
+
+        console.print(f"""
+    [bold blue]winnow[/bold blue] [dim]v{__version__}[/dim]
     [dim]Immich -> Frigate Training Data Curator[/dim]
         """)
 
-        ConfigManager.get().interactive_setup()
+        _FALSY = {"", "false", "0", "no", "off"}
+        set_unsupported = [v for v in _UNSUPPORTED_VARS if os.environ.get(v, "").strip().lower() not in _FALSY]
+        if set_unsupported:
+            console.print(
+                f"[bold yellow]⚠  Advanced tuning vars set: "
+                f"{', '.join(set_unsupported)}[/bold yellow]"
+            )
+            console.print(
+                "[dim]  These defaults are calibrated for Frigate's ArcFace requirements. "
+                "Image quality issues caused by non-default values will not be investigated.[/dim]\n"
+            )
+
+        Config.interactive_setup()
 
         try:
             Config.validate()
@@ -37,9 +213,24 @@ def main() -> None:
         rprint(f"Server: [dim]{Config.IMMICH_URL}[/dim]")
         rprint(f"Output: [dim]{Config.OUTPUT_DIR}[/dim]")
 
-        # Handle RESET_PERSON before anything else
+        # Handle RESET_PERSON before anything else.
+        # RESET_PERSON=* resets every tracked person; any other value resets
+        # that specific person by name.
         reset_person_name = os.environ.get("RESET_PERSON", "").strip()
         if reset_person_name:
+            if reset_person_name == "*":
+                names = list(get_person_summary().keys())
+                if "*" in names:
+                    rprint(
+                        "[yellow]Note: a person literally named '*' exists in the tracker "
+                        "and will be reset along with everyone else.[/yellow]"
+                    )
+                if names:
+                    reset_all_people()
+                    rprint(f"[bold yellow]Reset tracking data for all {len(names)} people.[/bold yellow]")
+                else:
+                    rprint("[dim]No tracking data to reset.[/dim]")
+            else:
                 reset_person(reset_person_name)
                 rprint(f"[bold yellow]Reset tracking data for: {reset_person_name}[/bold yellow]")
 
@@ -48,24 +239,42 @@ def main() -> None:
         if summary:
             rprint("\n[dim]Tracker summary:[/dim]")
             for person_name, counts in summary.items():
-                rprint(f"  [dim]{person_name}: {counts['uploaded']} uploaded, {counts['rejected']} rejected[/dim]")
+                frigate_part = (
+                    f", {counts['frigate_count']} in Frigate"
+                    if counts.get("frigate_count") is not None
+                    else ""
+                )
+                rprint(
+                    f"  [dim]{person_name}: {counts['uploaded']} uploaded,"
+                    f" {counts['rejected']} rejected{frigate_part}[/dim]"
+                )
+
+        _immich_version = get_immich_version()
+        if _immich_version is not None and _immich_version < (1, 106, 0):
+            rprint(
+                f"  [yellow]⚠  Immich {'.'.join(str(x) for x in _immich_version)} detected — "
+                "winnow requires v1.106+. Some features may not work.[/yellow]"
+            )
 
         people = get_people()
         if not people:
             rprint("[bold red]Could not fetch people from Immich. Check URL/Key.[/bold red]")
             return
 
-        # Check for non-interactive mode
-        auto_mode = os.environ.get("AUTO_MODE", "false").lower() == "true"
-        dry_run = os.environ.get("DRY_RUN", "false").lower() in ("true", "1", "yes")
+        people = _handle_duplicate_people(people)
+
+        # Auto mode when no TTY (Docker, cron, pipes) — the primary use case.
+        # A TTY means local interactive use; AUTO_MODE=true overrides that for scripting.
+        auto_mode = not sys.stdin.isatty() or _getenv_bool("AUTO_MODE", False)
+        dry_run = _getenv_bool("DRY_RUN", False)
 
         if dry_run:
             rprint("[bold yellow]DRY RUN — no images will be downloaded or uploaded[/bold yellow]")
 
         if auto_mode:
-            rprint("[bold cyan]Running in AUTO mode (non-interactive)[/bold cyan]")
             jobs = auto_configure(people)
         else:
+            rprint("[bold cyan]Interactive mode — set AUTO_MODE=true to skip prompts[/bold cyan]")
             jobs = interactive_configure(people)
 
         if jobs:

winnow/config.py

@@ -9,96 +9,208 @@ from typing import ClassVar
 from dotenv import load_dotenv
 from rich.prompt import Prompt
 
-load_dotenv()
+_LEGACY_CONFIG_FILE = Path(".immich_config.json")  # pre-v0.6: lived in process CWD, not on a volume
 
-CONFIG_FILE = Path(".immich_config.json")
+
+def _getenv_num(name: str, default, cast):
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    raw = raw.strip()
+    if not raw:
+        return default
+    try:
+        return cast(raw)
+    except ValueError:
+        logging.warning("%s=%r is not a valid %s — using default %s", name, raw, cast.__name__, default)
+        return default
+
+
+def _getenv_int(name: str, default: int) -> int:
+    return _getenv_num(name, default, int)
+
+
+def _getenv_float(name: str, default: float) -> float:
+    return _getenv_num(name, default, float)
+
+
+def _getenv_optional_float(name: str) -> float | None:
+    """Return float value of env var, or None if unset/empty. Warns and returns None on invalid."""
+    return _getenv_num(name, None, float)
+
+
+def _getenv_optional_int(name: str) -> int | None:
+    """Return int value of env var, or None if unset/empty. Warns and returns None on invalid."""
+    return _getenv_num(name, None, int)
+
+
+def _getenv_bool(name: str, default: bool) -> bool:
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    raw = raw.strip()
+    if not raw:
+        return default
+    return raw.lower() in ("true", "1", "yes")
 
 
 class _Config:
-    """Singleton configuration with uppercase attribute access for backward compatibility."""
+    """Singleton configuration with lazy loading via __getattr__.
+
+    Class-level attributes are annotations only (no defaults), so attribute
+    access on an un-loaded instance falls through to __getattr__, which
+    triggers _load() exactly once.
+    """
 
     _instance: ClassVar["_Config | None"] = None
 
-    # Configuration values
-    IMMICH_URL: str | None = None
-    API_KEY: str | None = None
-    OUTPUT_DIR: str = "./frigate_train"
-    YEARS_FILTER: int = 10
+    # Annotations only — no class-level defaults so __getattr__ fires on first access
+    IMMICH_URL: str | None
+    API_KEY: str | None
+    OUTPUT_DIR: str
+    YEARS_FILTER: int
 
     # Quality filtering
-    MIN_FACE_WIDTH: int = 50
-    BLUR_THRESHOLD: float = 100.0
-    MIN_CONFIDENCE: float = 0.7
-    MAX_AUTO_IMAGES: int = 80
+    MIN_FACE_WIDTH: int
+    BLUR_THRESHOLD: float
+    MIN_CONFIDENCE: float
+    MAX_AUTO_IMAGES: int
+    QUALITY_REPLACEMENT: bool
+    FRIGATE_SCORE_CEILING: float | None
+    ENABLE_FRIGATE_SCORES: bool
 
     # People filtering
-    MIN_FACE_COUNT: int = 0
+    MIN_FACE_COUNT: int
+    MERGE_DUPLICATE_PEOPLE: bool
 
     # Output quality
-    FACE_MARGIN: float = 0.15
-    USE_FULL_RESOLUTION: bool = True
-    ENABLE_FACE_ALIGNMENT: bool = True
+    FACE_MARGIN: float
+    USE_FULL_RESOLUTION: bool
+    ENABLE_FACE_ALIGNMENT: bool
 
-    # Caching (opt-in to avoid unexpected files)
-    ENABLE_CACHE: bool = False
-    CACHE_DIR: str = ".if_cache"
+    ENABLE_CACHE: bool
+    DATA_DIR: str
 
     def __new__(cls) -> "_Config":
         if cls._instance is None:
             cls._instance = super().__new__(cls)
-            cls._instance._load()
+            # Do NOT call _load() here — keep __new__ I/O-free so that import
+            # time does not trigger env/file reads.
         return cls._instance
 
+    def __getattr__(self, name: str):
+        """Called only when the attribute is not found on the instance.
+
+        On first access to any config attribute, load all values from env/file
+        and return the requested one.  Re-registers self as _instance so that
+        a subsequent reset() correctly finds and clears this object's attrs.
+        """
+        if name.startswith("_"):
+            raise AttributeError(name)
+        self._load()
+        # Re-register self as the singleton so reset() can clear our __dict__.
+        # This handles the case where __getattr__ is called on the module-level
+        # Config object after a reset() set _instance to None.
+        _Config._instance = self
+        # _load() sets the attribute as an instance attr; retrieve it directly
+        # to avoid infinite recursion through __getattr__.
+        try:
+            return self.__dict__[name]
+        except KeyError:
+            raise AttributeError(f"_Config has no attribute {name!r}")
+
     def _load(self) -> None:
         """Load configuration from environment and config file."""
+        load_dotenv()
         # Load from environment (highest priority)
         self.IMMICH_URL = os.getenv("IMMICH_URL")
         self.API_KEY = os.getenv("API_KEY")
         self.OUTPUT_DIR = os.getenv("OUTPUT_DIR", "./frigate_train")
-        self.YEARS_FILTER = int(os.getenv("YEARS_FILTER", "10"))
-        self.MIN_FACE_WIDTH = int(os.getenv("MIN_FACE_WIDTH", "50"))
-        self.MIN_FACE_COUNT = int(os.getenv("MIN_FACE_COUNT", "0"))
-        self.BLUR_THRESHOLD = float(os.getenv("BLUR_THRESHOLD", "100.0"))
-        self.MIN_CONFIDENCE = float(os.getenv("MIN_CONFIDENCE", "0.7"))
-        self.MAX_AUTO_IMAGES = int(os.getenv("MAX_AUTO_IMAGES", "80"))
-        self.FACE_MARGIN = float(os.getenv("FACE_MARGIN", "0.15"))
-        self.USE_FULL_RESOLUTION = os.getenv("USE_FULL_RESOLUTION", "true").lower() in ("true", "1", "yes")
-        self.ENABLE_FACE_ALIGNMENT = os.getenv("ENABLE_FACE_ALIGNMENT", "true").lower() in ("true", "1", "yes")
-        self.ENABLE_CACHE = os.getenv("ENABLE_CACHE", "false").lower() in ("true", "1", "yes")
-        self.CACHE_DIR = os.getenv("CACHE_DIR", ".if_cache")
+        self.YEARS_FILTER = _getenv_int("YEARS_FILTER", 10)
+        if self.YEARS_FILTER < 0:
+            logging.warning("YEARS_FILTER=%s is negative — using default 10", self.YEARS_FILTER)
+            self.YEARS_FILTER = 10
+        self.MIN_FACE_WIDTH = _getenv_int("MIN_FACE_WIDTH", 90)
+        self.MIN_FACE_COUNT = _getenv_int("MIN_FACE_COUNT", 3)
+        self.MERGE_DUPLICATE_PEOPLE = _getenv_bool("MERGE_DUPLICATE_PEOPLE", False)
+        self.BLUR_THRESHOLD = _getenv_float("BLUR_THRESHOLD", 120.0)
+        self.MIN_CONFIDENCE = _getenv_float("MIN_CONFIDENCE", 0.7)
+        self.MAX_AUTO_IMAGES = _getenv_int("MAX_AUTO_IMAGES", 5)
+        self.QUALITY_REPLACEMENT = _getenv_bool("QUALITY_REPLACEMENT", True)
+        self.FRIGATE_SCORE_CEILING = _getenv_optional_float("FRIGATE_SCORE_CEILING")
+        self.ENABLE_FRIGATE_SCORES = _getenv_bool("ENABLE_FRIGATE_SCORES", True)
+        self.FACE_MARGIN = _getenv_float("FACE_MARGIN", 0.15)
+        self.USE_FULL_RESOLUTION = _getenv_bool("USE_FULL_RESOLUTION", True)
+        self.ENABLE_FACE_ALIGNMENT = _getenv_bool("ENABLE_FACE_ALIGNMENT", True)
+        self.ENABLE_CACHE = _getenv_bool("ENABLE_CACHE", True)
+        _data_dir = os.getenv("DATA_DIR")
+        _cache_dir_legacy = os.getenv("CACHE_DIR")
+        if _data_dir:
+            self.DATA_DIR = _data_dir
+        elif _cache_dir_legacy:
+            logging.warning(
+                "CACHE_DIR is deprecated — rename it to DATA_DIR in your .env or compose.yml"
+            )
+            self.DATA_DIR = _cache_dir_legacy
+        else:
+            self.DATA_DIR = "data"
 
-        # Fall back to config file for missing values
-        if CONFIG_FILE.exists():
+        # Fall back to config file when the env var is absent or blank — a blank
+        # IMMICH_URL= placeholder in .env should not override the config file.
+        # Prefer DATA_DIR/.immich_config.json (volume-safe in Docker) and fall back
+        # to the legacy CWD path so existing installations continue to work.
+        _data_cfg = Path(self.DATA_DIR) / ".immich_config.json"
+        _data_cfg_exists = _data_cfg.exists()
+        if _data_cfg_exists and _LEGACY_CONFIG_FILE.exists():
+            logging.warning(
+                "Two config files found: %s and %s — using %s. Remove the legacy file to silence this.",
+                _data_cfg,
+                _LEGACY_CONFIG_FILE,
+                _data_cfg,
+            )
+        config_file = _data_cfg if _data_cfg_exists else _LEGACY_CONFIG_FILE
+        # _data_cfg_exists already confirmed the primary path — avoid re-stat.
+        # The short-circuit means the legacy path is stat'd at most once here.
+        if _data_cfg_exists or config_file.exists():
             try:
-                data = json.loads(CONFIG_FILE.read_text())
-                self.IMMICH_URL = self.IMMICH_URL or data.get("IMMICH_URL")
-                self.API_KEY = self.API_KEY or data.get("API_KEY")
+                data = json.loads(config_file.read_text())
+                if not self.IMMICH_URL:
+                    self.IMMICH_URL = data.get("IMMICH_URL")
                 if not os.getenv("OUTPUT_DIR"):
                     self.OUTPUT_DIR = data.get("OUTPUT_DIR", self.OUTPUT_DIR)
             except (json.JSONDecodeError, OSError) as e:
-                logging.warning(f"Failed to load config file: {e}")
+                logging.warning("Failed to load config file: %s", e)
 
     @classmethod
     def reset(cls) -> None:
         """Reset the singleton — mainly useful for testing or delayed env setup."""
+        if cls._instance is not None:
+            cls._instance.__dict__.clear()
         cls._instance = None
 
     def save(self) -> None:
-        """Persist configuration to file."""
+        """Persist non-sensitive configuration to file.
+
+        API_KEY is intentionally excluded — store it in .env or as an
+        environment variable instead of a plain-text config file.
+        Writes to DATA_DIR/.immich_config.json so the file survives container
+        restarts when DATA_DIR is a mounted volume.
+        """
+        config_file = Path(self.DATA_DIR) / ".immich_config.json"
         try:
-            CONFIG_FILE.write_text(
+            Path(self.DATA_DIR).mkdir(parents=True, exist_ok=True)
+            config_file.write_text(
                 json.dumps(
                     {
                         "IMMICH_URL": self.IMMICH_URL,
-                        "API_KEY": self.API_KEY,
                         "OUTPUT_DIR": self.OUTPUT_DIR,
                     },
                     indent=2,
                 )
             )
-            logging.info(f"Configuration saved to {CONFIG_FILE}")
+            logging.info("Configuration saved to %s", config_file)
         except OSError as e:
-            logging.error(f"Failed to save config: {e}")
+            logging.error("Failed to save config: %s", e)
 
     def interactive_setup(self) -> None:
         """Prompt user for missing configuration."""
@@ -113,8 +225,8 @@ class _Config:
 
         if not self.API_KEY:
             console.print("[yellow]Immich API Key not found.[/yellow]")
+            console.print("[dim]Tip: set API_KEY in your .env file to avoid re-entering it.[/dim]")
             self.API_KEY = Prompt.ask("Enter Immich API Key", password=True)
-            self.save()
 
     def validate(self) -> None:
         """Raise ValueError if required config is missing."""
@@ -122,47 +234,10 @@ class _Config:
             raise ValueError("Missing Immich URL or API Key.")
 
 
-# Singleton instance — use a lazy property pattern to avoid import-time side effects
-# when env vars aren't yet set. Call Config.instance() or just access attributes on
-# the module-level `Config` (which delegates to the singleton).
-class _ConfigAccessor:
-    """Lazy accessor that defers singleton creation until first attribute access.
-
-    This avoids reading .env and config files at import time, so environment
-    variables set after importing the module are properly picked up.
-    """
-
-    def __getattr__(self, name: str):
-        return getattr(_Config(), name)
-
-    def __setattr__(self, name: str, value):
-        if name.startswith("_"):
-            super().__setattr__(name, value)
-        else:
-            setattr(_Config(), name, value)
-
-    def reset(self) -> None:
-        """Reset the underlying singleton."""
-        _Config.reset()
-
-    def interactive_setup(self) -> None:
-        """Delegate to the singleton."""
-        _Config().interactive_setup()
-
-    def validate(self) -> None:
-        """Delegate to the singleton."""
-        _Config().validate()
-
-    def save(self) -> None:
-        """Delegate to the singleton."""
-        _Config().save()
-
-
-Config = _ConfigAccessor()
-ConfigManager = type("ConfigManager", (), {"get": staticmethod(lambda: _Config())})
+# Module-level singleton — lazy: no I/O until first attribute access.
+Config = _Config()
 
 
 def get_headers() -> dict[str, str]:
     """Return HTTP headers for Immich API requests."""
     return {"x-api-key": Config.API_KEY or "", "Accept": "application/json"}
-

winnow/diversity.py

@@ -5,11 +5,12 @@ Selection pipeline:
 1. Concurrent thumbnail download
 2. Quality filtering (blur, IR, exposure, confidence, face size)
 3. Face crop extraction (embed person's face, not full image)
-4. Embedding computation (InsightFace or SigLIP)
+4. Embedding computation (InsightFace)
 5. Cluster-aware selection (K-Medoids + FPS with hard example weighting)
 """
 
 import logging
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from io import BytesIO
 
 import numpy as np
@@ -22,14 +23,24 @@ from .quality import assess_quality
 
 logger = logging.getLogger(__name__)
 
+# Candidate pool: cap at _POOL_CAP assets, but take at least _POOL_SCALE × the
+# requested limit so small limits don't artificially narrow the search space.
+_POOL_CAP = 3000
+_POOL_SCALE = 20
+
+# Embedding batch size: bounds decoded thumbnails in memory.
+# At ~3-8 MB each, 32 images ≈ 100–250 MB peak — safe in a 4 GB container.
+_EMBEDDING_BATCH_SIZE = 32
+
 
 def select_diverse_assets(
     assets: list,
     limit: int | str,
     entity_name: str,
     selection_mode: str = "smart",
-    entity_type: str = "face",
+    person_id: str | None = None,
     progress_callback=None,
+    fetch_fn=None,
 ) -> list:
     """
     Select diverse assets using cluster-aware FPS or time spread.
@@ -37,31 +48,31 @@ def select_diverse_assets(
     Args:
         assets: List of asset dicts from Immich API
         limit: Number to select, or "auto" for dynamic selection
-        entity_name: Name of the person/object for logging
+        entity_name: Name of the person for logging
         selection_mode: 'smart' (embedding-based) or 'time' (time spread)
-        entity_type: 'face' or 'object' - determines embedding model
         progress_callback: Optional callback(current, total) for progress
+        fetch_fn: Optional callable(asset_id) -> Image | None; defaults to
+                  _fetch_thumbnail. Injected for testability.
 
     Returns:
         List of selected assets
     """
-    # Fast path: fewer assets than limit
+    # Fast path: fewer assets than limit — sort for consistent ordering with other paths
     if limit != "auto" and len(assets) <= limit:
-        return assets
+        return sorted(assets, key=lambda x: x.get("fileCreatedAt", ""))
 
     # Sort by creation time
     assets = sorted(assets, key=lambda x: x.get("fileCreatedAt", ""))
 
-    if selection_mode != "smart" or not is_embedding_available(entity_type):
+    if selection_mode != "smart" or not is_embedding_available():
         if selection_mode == "smart":
-            model_name = "InsightFace" if entity_type == "face" else "SigLIP"
-            logger.warning(f"{model_name} unavailable. Falling back to time spread.")
+            logger.warning("InsightFace unavailable. Falling back to time spread.")
         return _select_time_spread(assets, limit)
 
     try:
-        return _select_by_embedding(assets, limit, entity_type, progress_callback)
+        return _select_by_embedding(assets, limit, person_id, progress_callback, fetch_fn=fetch_fn)
     except Exception as e:
-        logger.error(f"Smart Diversity failed: {e}. Falling back to time spread.")
+        logger.error("Smart Diversity failed: %s. Falling back to time spread.", e)
         return _select_time_spread(assets, limit)
 
 
@@ -80,9 +91,11 @@ def _fetch_thumbnail(asset_id: str, timeout: int = 10) -> Image.Image | None:
         return None
 
 
-def _get_face_bbox(asset: dict) -> tuple[float, float, float, float] | None:
-    """Extract face bounding box from asset metadata if available."""
+def _get_face_bbox(asset: dict, person_id: str | None = None) -> tuple[float, float, float, float] | None:
+    """Extract face bounding box from asset metadata for the given person."""
     for person in asset.get("people", []):
+        if person_id and person.get("id") != person_id:
+            continue
         faces = person.get("faces", [])
         if faces:
             f = faces[0]
@@ -95,12 +108,16 @@ def _get_face_bbox(asset: dict) -> tuple[float, float, float, float] | None:
     return None
 
 
-def _get_face_confidence(asset: dict) -> float | None:
-    """Extract face detection confidence from asset metadata if available."""
+def _get_face_confidence(asset: dict, person_id: str | None = None) -> float | None:
+    """Extract face detection confidence from asset metadata for the given person."""
     for person in asset.get("people", []):
+        if person_id and person.get("id") != person_id:
+            continue
         faces = person.get("faces", [])
         if faces:
-            return faces[0].get("score") or faces[0].get("confidence")
+            f = faces[0]
+            score = f.get("score")
+            return score if score is not None else f.get("confidence")
     return None
 
 
@@ -108,6 +125,7 @@ def _crop_face_from_thumbnail(
     img: Image.Image,
     asset: dict,
     margin: float = 0.25,
+    person_id: str | None = None,
 ) -> Image.Image | None:
     """Crop the face region from a thumbnail using Immich bbox metadata.
 
@@ -118,19 +136,22 @@ def _crop_face_from_thumbnail(
         img: Full preview thumbnail
         asset: Asset dict with people/faces metadata
         margin: Extra margin around the bbox (fraction, default 25%)
+        person_id: If provided, only crop from this person's face data.
 
     Returns:
         Cropped face PIL image, or None if no face metadata available
     """
-    bbox = _get_face_bbox(asset)
+    bbox = _get_face_bbox(asset, person_id=person_id)
     if bbox is None:
         return None
 
     x1, y1, x2, y2 = bbox
     img_w, img_h = img.size
 
-    # Get metadata dimensions to scale bbox
+    # Get metadata dimensions to scale bbox — must match the same person as _get_face_bbox
     for person in asset.get("people", []):
+        if person_id and person.get("id") != person_id:
+            continue
         faces = person.get("faces", [])
         if faces:
             meta_w = faces[0].get("imageWidth") or img_w
@@ -160,6 +181,28 @@ def _crop_face_from_thumbnail(
     return crop
 
 
+def _scale_bbox_to_thumbnail(
+    bbox: tuple[float, float, float, float],
+    img: Image.Image,
+    asset: dict,
+    person_id: str | None = None,
+) -> tuple[float, float, float, float]:
+    """Scale a face bbox from original detection-image space to thumbnail-pixel space."""
+    x1, y1, x2, y2 = bbox
+    img_w, img_h = img.size
+    for person in asset.get("people", []):
+        if person_id and person.get("id") != person_id:
+            continue
+        faces = person.get("faces", [])
+        if faces:
+            meta_w = faces[0].get("imageWidth") or 0
+            meta_h = faces[0].get("imageHeight") or 0
+            scale_x = img_w / meta_w if meta_w else 1.0
+            scale_y = img_h / meta_h if meta_h else 1.0
+            return (x1 * scale_x, y1 * scale_y, x2 * scale_x, y2 * scale_y)
+    return bbox
+
+
 # =============================================================================
 # Embedding Collection
 # =============================================================================
@@ -168,21 +211,21 @@ def _crop_face_from_thumbnail(
 def _select_by_embedding(
     assets: list,
     limit: int | str,
-    entity_type: str,
+    person_id: str | None = None,
     progress_callback=None,
+    fetch_fn=None,
 ) -> list:
     """Select assets using embedding-based cluster-aware FPS.
 
     Pipeline:
     1. Concurrent thumbnail download
     2. Quality filtering
-    3. Face crop extraction (face mode only)
+    3. Face crop extraction
     4. Embedding computation
     5. Cluster-aware selection with hard example weighting
     """
-    # Determine candidate pool (cap at 3000 for performance)
     effective_limit = 30 if limit == "auto" else limit
-    pool_size = min(3000, max(effective_limit * 20, len(assets)))
+    pool_size = min(_POOL_CAP, max(effective_limit * _POOL_SCALE, len(assets)))
 
     # Subsample if needed (evenly distributed in time)
     if len(assets) > pool_size:
@@ -191,40 +234,59 @@ def _select_by_embedding(
     else:
         candidates = assets
 
-    # --- Phase 1: Concurrent thumbnail download ---
-    from concurrent.futures import ThreadPoolExecutor, as_completed
+    # --- Phases 1-4: Batched download → quality filter → crop → embed ---
+    # Process in bounded batches so at most _BATCH decoded images live in RAM
+    # at once. With 472 candidates each thumbnail is ~3-8 MB decoded; loading
+    # all at once easily exhausts a 4 GB container limit on CPU.
+    # LIMITATION — thumbnail-resolution embeddings drive full-res crop selection:
+    # diversity selection runs InsightFace on Immich preview thumbnails (~720p)
+    # to avoid downloading full-res for every candidate, but the training crop
+    # comes from the full-resolution original. Embeddings from thumbnails are
+    # representative in practice, but heavy JPEG compression on a preview could
+    # produce a subtly different embedding than the full-res version. For most
+    # libraries this is negligible; it matters if Immich preview quality is low.
+    _fetch = fetch_fn or _fetch_thumbnail
+    embeddings, valid_candidates, confidence_scores = [], [], []
+    quality_filtered = 0
+    processed = 0
 
-    thumbnail_map: dict[str, Image.Image] = {}
-    with ThreadPoolExecutor(max_workers=8) as pool:
-        futures = {pool.submit(_fetch_thumbnail, a["id"]): a for a in candidates}
-        for i, future in enumerate(as_completed(futures)):
-            if progress_callback:
-                progress_callback(i, len(candidates))
+    for batch_start in range(0, len(candidates), _EMBEDDING_BATCH_SIZE):
+        batch = candidates[batch_start : batch_start + _EMBEDDING_BATCH_SIZE]
+
+        # Download this batch concurrently
+        batch_images: dict[str, Image.Image] = {}
+        with ThreadPoolExecutor(max_workers=min(8, len(batch))) as pool:
+            futures = {pool.submit(_fetch, a["id"]): a for a in batch}
+            for future in as_completed(futures):
                 asset = futures[future]
                 try:
                     img = future.result()
                     if img is not None:
-                    thumbnail_map[asset["id"]] = img
-            except Exception:
+                        batch_images[asset["id"]] = img
+                except Exception as e:
+                    logger.debug("Failed to fetch thumbnail for %s: %s", asset["id"], e)
                     continue
 
-    # --- Phase 2-4: Quality filter → Crop → Embed ---
-    embeddings, valid_candidates, confidence_scores = [], [], []
-    quality_filtered = 0
-
-    for asset in candidates:
-        img = thumbnail_map.get(asset["id"])
+        # Process each image; batch_images goes out of scope after this loop,
+        # bounding peak thumbnail memory to _BATCH images per iteration.
+        for asset in batch:
+            img = batch_images.get(asset["id"])
+            processed += 1
+            if progress_callback:
+                progress_callback(processed, len(candidates))
             if img is None:
                 continue
 
-        confidence = _get_face_confidence(asset)
+            confidence = _get_face_confidence(asset, person_id=person_id)
 
-        # Quality gate: filter before expensive embedding computation
-        if entity_type == "face":
-            face_bbox = _get_face_bbox(asset)
+            face_bbox = _get_face_bbox(asset, person_id=person_id)
+            thumbnail_bbox = (
+                _scale_bbox_to_thumbnail(face_bbox, img, asset, person_id)
+                if face_bbox is not None else None
+            )
             quality = assess_quality(
                 img,
-                face_bbox=face_bbox,
+                face_bbox=thumbnail_bbox,
                 confidence=confidence,
                 blur_threshold=Config.BLUR_THRESHOLD,
                 min_face_px=Config.MIN_FACE_WIDTH,
@@ -232,45 +294,113 @@ def _select_by_embedding(
             )
             if not quality.passed:
                 quality_filtered += 1
-                logger.debug(f"Quality filtered {asset['id']}: {quality.reason}")
+                logger.debug("Quality filtered %s: %s", asset["id"], quality.reason)
                 continue
 
-            # Crop the target person's face before embedding
-            face_crop = _crop_face_from_thumbnail(img, asset)
+            asset["quality_score"] = quality.blur_score
+            face_crop = _crop_face_from_thumbnail(img, asset, person_id=person_id)
             embed_img = face_crop if face_crop is not None else img
-        else:
-            embed_img = img
 
-        emb = get_embedding(embed_img, entity_type, asset_id=asset["id"])
+            emb = get_embedding(embed_img, asset_id=asset["id"])
             if emb is not None:
+                if np.linalg.norm(emb) < 1e-6:
+                    logger.debug("Zero-norm embedding for asset %s, skipping", asset["id"])
+                    continue
                 embeddings.append(emb)
                 valid_candidates.append(asset)
                 confidence_scores.append(confidence)
 
-    if progress_callback:
-        progress_callback(len(candidates), len(candidates))
-
     if quality_filtered > 0:
-        logger.info(f"Quality filtering removed {quality_filtered} images.")
+        logger.info("Quality filtering removed %s images.", quality_filtered)
 
     if not embeddings:
         logger.warning("No valid embeddings found. Falling back to time spread.")
         return _select_time_spread(assets, limit)
 
     if limit != "auto" and len(valid_candidates) < limit:
-        logger.warning(f"Only {len(valid_candidates)} valid embeddings. Returning all.")
+        logger.warning("Only %s valid embeddings. Returning all.", len(valid_candidates))
         return valid_candidates
 
-    # --- Phase 5: Cluster-aware selection ---
+    # --- Phase 5: Near-duplicate removal ---
+    # Burst shots and repeated near-identical photos produce embeddings that are
+    # close but not identical, so FPS doesn't filter them out on its own.
+    # Greedily drop any candidate within DEDUP_THRESHOLD cosine distance of a
+    # higher-quality image already in the kept set.
+    embeddings, valid_candidates, confidence_scores = _dedup_embeddings(
+        embeddings, valid_candidates, confidence_scores
+    )
+
+    # Re-check after dedup: pool may have shrunk below limit
+    if limit != "auto" and len(valid_candidates) < limit:
+        logger.warning("Only %s embeddings after near-duplicate removal. Returning all.", len(valid_candidates))
+        return valid_candidates
+
+    # --- Phase 6: Cluster-aware selection ---
     return _cluster_aware_selection(
         embeddings,
         valid_candidates,
         limit,
-        entity_type=entity_type,
         confidence_scores=confidence_scores,
     )
 
 
+# =============================================================================
+# Near-Duplicate Removal
+# =============================================================================
+
+_DEDUP_THRESHOLD = 0.20  # cosine distance — burst shots ~0.01-0.05, same-event similar shots ~0.10-0.20
+
+
+def _dedup_embeddings(
+    embeddings: list,
+    candidates: list,
+    confidence_scores: list,
+) -> tuple[list, list, list]:
+    """Greedy near-duplicate removal before clustering.
+
+    Sorts by quality score descending (best first), then for each candidate
+    drops it if any already-kept embedding is within _DEDUP_THRESHOLD cosine
+    distance. This eliminates burst-shot near-duplicates while preserving the
+    highest-quality representative from each near-identical group.
+    """
+    if len(embeddings) < 2:
+        return embeddings, candidates, confidence_scores
+
+    emb_matrix = np.vstack(embeddings)
+    norms = np.linalg.norm(emb_matrix, axis=1, keepdims=True)
+    emb_normed = emb_matrix / np.maximum(norms, 1e-8)
+
+    # Sort by quality descending so the best image in each near-duplicate group wins.
+    # Use explicit None check so a legitimate quality_score=0.0 isn't treated as missing.
+    quality_scores = [qs if (qs := c.get("quality_score")) is not None else 0.0 for c in candidates]
+    order = sorted(range(len(candidates)), key=lambda i: quality_scores[i], reverse=True)
+
+    kept_indices = []
+    # Pre-allocate a max-size buffer and fill row-by-row — eliminates the O(K²)
+    # copy overhead from vstack-on-keep while keeping identical arithmetic.
+    kept_buf = np.empty((len(order), emb_normed.shape[1]), dtype=emb_normed.dtype)
+    n_kept = 0
+
+    for i in order:
+        if n_kept > 0:
+            sims = emb_normed[i] @ kept_buf[:n_kept].T
+            if np.any(sims > 1 - _DEDUP_THRESHOLD):
+                continue
+        kept_buf[n_kept] = emb_normed[i]
+        n_kept += 1
+        kept_indices.append(i)
+
+    dropped = len(embeddings) - len(kept_indices)
+    if dropped:
+        logger.info("Near-duplicate removal dropped %s images (threshold %s).", dropped, _DEDUP_THRESHOLD)
+
+    return (
+        [embeddings[i] for i in kept_indices],
+        [candidates[i] for i in kept_indices],
+        [confidence_scores[i] for i in kept_indices],
+    )
+
+
 # =============================================================================
 # K-Medoids (Lightweight Implementation)
 # =============================================================================
@@ -302,12 +432,13 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
     # Iterative swap step
     medoids = list(medoids)
     labels = np.argmin(dist_matrix[:, medoids], axis=1)
-    cost = sum(dist_matrix[i, medoids[labels[i]]] for i in range(n))
+    cost = dist_matrix[np.arange(n), np.array(medoids)[labels]].sum()
 
     for _ in range(max_iter):
         improved = False
         # Try swapping each medoid with a random non-medoid
-        non_medoids = [i for i in range(n) if i not in medoids]
+        medoid_set = set(medoids)
+        non_medoids = [i for i in range(n) if i not in medoid_set]
         if not non_medoids:
             break
 
@@ -317,7 +448,7 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
                 new_medoids = medoids.copy()
                 new_medoids[m_idx] = cand
                 new_labels = np.argmin(dist_matrix[:, new_medoids], axis=1)
-                new_cost = sum(dist_matrix[i, new_medoids[new_labels[i]]] for i in range(n))
+                new_cost = dist_matrix[np.arange(n), np.array(new_medoids)[new_labels]].sum()
                 if new_cost < cost:
                     medoids = new_medoids
                     labels = new_labels
@@ -338,11 +469,11 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
 # =============================================================================
 
 
-def _compute_adaptive_threshold(emb_normed: np.ndarray, entity_type: str) -> float:
+def _compute_adaptive_threshold(emb_normed: np.ndarray) -> float:
     """Compute adaptive FPS stop threshold based on actual embedding distribution.
 
     Instead of a hardcoded threshold, samples pairwise distances and sets
-    the threshold as a fraction of the median pairwise distance.
+    the threshold as 20% of the median pairwise distance.
     """
     n = len(emb_normed)
     sample_size = min(200, n)
@@ -350,20 +481,14 @@ def _compute_adaptive_threshold(emb_normed: np.ndarray, entity_type: str) -> flo
     indices = rng.choice(n, sample_size, replace=False) if n > sample_size else np.arange(n)
     sample = emb_normed[indices]
 
-    # Compute pairwise cosine distances for the sample
     pairwise = 1 - sample @ sample.T
     upper_tri = pairwise[np.triu_indices(len(sample), k=1)]
+    if len(upper_tri) == 0:
+        return 0.05
     median_dist = float(np.median(upper_tri))
+    threshold = max(0.05, median_dist * 0.20)
 
-    # Faces: 20% of median (tighter — want fewer, more distinct images)
-    # Objects: 10% of median (wider — want more diversity)
-    fraction = 0.20 if entity_type == "face" else 0.10
-    threshold = max(0.05, median_dist * fraction)
-
-    logger.info(
-        f"Adaptive threshold: {threshold:.4f} "
-        f"(median_dist={median_dist:.4f}, fraction={fraction}, type={entity_type})"
-    )
+    logger.debug("Adaptive threshold: %.4f (median_dist=%.4f)", threshold, median_dist)
     return threshold
 
 
@@ -371,7 +496,6 @@ def _cluster_aware_selection(
     embeddings: list,
     candidates: list,
     limit: int | str,
-    entity_type: str = "face",
     confidence_scores: list | None = None,
 ) -> list:
     """Two-stage selection: K-Medoids clustering → FPS with hard example weighting.
@@ -389,29 +513,36 @@ def _cluster_aware_selection(
     norms = np.linalg.norm(emb_matrix, axis=1, keepdims=True)
     emb_normed = emb_matrix / np.maximum(norms, 1e-8)
 
-    # Build confidence weight array for hard example boosting
+    # Build confidence weight array for hard example boosting.
+    # Default to 1.0 for faces with no confidence score: treat as high-confidence
+    # (no boost) rather than hard-example territory. A missing score field should
+    # not cause these images to beat genuinely high-confidence detections in FPS.
     conf_array = np.ones(n)
-    if confidence_scores and entity_type == "face":
+    if confidence_scores:
         for i, c in enumerate(confidence_scores):
             if c is not None:
                 conf_array[i] = c
 
     # Compute adaptive threshold for auto mode
-    auto_threshold = _compute_adaptive_threshold(emb_normed, entity_type) if limit == "auto" else 0.0
+    auto_threshold = _compute_adaptive_threshold(emb_normed) if limit == "auto" else 0.0
     target = Config.MAX_AUTO_IMAGES if limit == "auto" else limit
 
+    # Short-circuit: nothing to select
+    if limit != "auto" and target <= 0:
+        return []
+
     # --- Stage 1: K-Medoids clustering ---
-    k = min(max(5, target // 4), n // 3, n)  # e.g., 5-20 clusters
-    logger.info(f"Clustering {n} embeddings into {k} groups (K-Medoids)...")
+    # Cap k at target so we never seed more cluster representatives than requested.
+    k = min(max(5, target // 4), max(1, n // 3), n, target)  # e.g., 1-20 clusters
+    logger.debug("Clustering %s embeddings into %s groups (K-Medoids)...", n, k)
 
     # Compute full cosine distance matrix
     dist_matrix = 1 - emb_normed @ emb_normed.T
 
     medoid_indices, cluster_labels = _kmedoids(dist_matrix, k)
     selected = list(medoid_indices)
-    selected_set = set(selected)
 
-    logger.info(f"Selected {len(selected)} cluster medoids as initial picks.")
+    logger.debug("Selected %s cluster medoids as initial picks.", len(selected))
 
     # --- Stage 2: FPS with hard example weighting ---
     min_dists = np.full(n, np.inf)
@@ -423,10 +554,11 @@ def _cluster_aware_selection(
     for idx in selected:
         min_dists[idx] = -np.inf
 
-    while len(selected) < target:
-        # Hard example weighting: boost distance for low-confidence candidates
-        # Confidence < 0.85 gets up to 1.5× distance boost
+    # Hard example weighting: boost distance for low-confidence candidates.
+    # conf_array is constant after this point, so compute once outside the loop.
     hard_weight = np.where(conf_array < 0.85, 1.0 + (0.85 - conf_array) * 2.0, 1.0)
+
+    while len(selected) < target:
         weighted_dists = min_dists * hard_weight
 
         best_idx = int(np.argmax(weighted_dists))
@@ -436,30 +568,33 @@ def _cluster_aware_selection(
             break  # All points selected
 
         if limit == "auto" and best_dist < auto_threshold:
-            logger.info(
-                f"Auto-stop: Next best image {best_dist:.3f} away " f"(adaptive threshold {auto_threshold:.4f})."
+            logger.debug(
+                f"Auto-stop: next best image {best_dist:.3f} away (adaptive threshold {auto_threshold:.4f})."
             )
             break
 
         selected.append(best_idx)
-        selected_set.add(best_idx)
 
         # Update min distances
         dists_to_new = dist_matrix[best_idx]
         min_dists = np.minimum(min_dists, dists_to_new)
         min_dists[best_idx] = -np.inf
 
-    # Log hard example stats
-    if entity_type == "face":
-        selected_conf = [conf_array[i] for i in selected if conf_array[i] < 1.0]
-        hard_count = sum(1 for c in selected_conf if c < 0.85)
-        logger.info(
-            f"Selection complete: {len(selected)} images " f"({hard_count} hard examples with confidence < 0.85)."
+    hard_count = sum(
+        1 for i in selected
+        if confidence_scores
+        and i < len(confidence_scores)
+        and confidence_scores[i] is not None
+        and confidence_scores[i] < 0.85
     )
-    else:
-        logger.info(f"Selection complete: {len(selected)} diverse images.")
+    logger.info("Selection complete: %s images (%s hard examples with confidence < 0.85).", len(selected), hard_count)
 
-    return [candidates[i] for i in selected]
+    # Slice to target: the while loop enforces this for non-auto mode, but
+    # guard here too in case the medoid seed already exceeded target (small target).
+    result = [candidates[i] for i in selected]
+    if limit != "auto":
+        result = result[:target]
+    return result
 
 
 # =============================================================================
@@ -472,10 +607,10 @@ def _select_time_spread(assets: list, limit: int | str) -> list:
     if limit == "auto":
         limit = 30
 
-    logger.info(f"Selecting {limit} images using time spread.")
+    logger.info("Selecting %s images using time spread.", limit)
 
     if len(assets) <= limit:
         return assets
 
     indices = np.linspace(0, len(assets) - 1, limit, dtype=int)
-    return [assets[i] for i in np.unique(indices)]
+    return [assets[i] for i in indices]

winnow/embeddings.py

@@ -1,58 +1,100 @@
 """
-Unified embedding interface for faces and objects.
+Embedding interface for face diversity selection.
 
 - Faces: InsightFace (ArcFace/Buffalo_L) — or reuse from Immich
-- Objects: SigLIP (Vision Transformer via transformers)
 - Caching: Disk-based cache avoids recomputation on reruns
 """
 
-import contextlib
 import importlib
 import logging
 import os
+import time
 import warnings
+from contextlib import contextmanager
+from pathlib import Path
 
 import cv2
 import numpy as np
 from PIL import Image
 
 from .cache import get_cache
+from .config import _getenv_bool
 
 logger = logging.getLogger(__name__)
 
-# Lazy-loaded singletons
+
+@contextmanager
+def _suppress_output():
+    """Suppress stdout/stderr at the file-descriptor level, silencing C extension noise."""
+    devnull_fd = None
+    saved_out = None
+    saved_err = None
+    try:
+        devnull_fd = os.open(os.devnull, os.O_WRONLY)
+        saved_out = os.dup(1)
+        saved_err = os.dup(2)
+        os.dup2(devnull_fd, 1)
+        os.dup2(devnull_fd, 2)
+        yield
+    finally:
+        # Each block is a separate sequential statement. A BaseException (e.g.
+        # KeyboardInterrupt) raised inside block N would propagate past blocks N+1
+        # and N+2, leaving saved_err or devnull_fd unclosed. In CPython, KI is
+        # delivered between bytecodes, not mid-syscall; os.dup2 is a single C call
+        # and completes atomically, so this race is not realistically triggerable.
+        if saved_out is not None:
+            try:
+                os.dup2(saved_out, 1)
+            except OSError as e:
+                logger.debug("_suppress_output: failed to restore stdout fd: %s", e)
+            finally:
+                try:
+                    os.close(saved_out)
+                except OSError:
+                    pass
+        if saved_err is not None:
+            try:
+                os.dup2(saved_err, 2)
+            except OSError as e:
+                logger.debug("_suppress_output: failed to restore stderr fd: %s", e)
+            finally:
+                try:
+                    os.close(saved_err)
+                except OSError:
+                    pass
+        if devnull_fd is not None:
+            try:
+                os.close(devnull_fd)
+            except OSError:
+                pass
+
+
+# Lazy-loaded singleton
 _insightface_app = None
 _insightface_loaded = False
-_siglip_model = None
-_siglip_processor = None
-_siglip_loaded = False
 
 
 def _is_force_cpu() -> bool:
     """Check if CPU mode is forced via environment variable."""
-    return os.getenv("FORCE_CPU", "").lower() in ("true", "1", "yes")
+    return _getenv_bool("FORCE_CPU", False)
 
 
 def _preload_cuda_libs() -> None:
     """Preload CUDA/cuDNN DLLs so onnxruntime-gpu registers CUDAExecutionProvider.
 
     Starting with onnxruntime-gpu 1.19+, CUDA/cuDNN libraries are no longer
-    bundled inside the ORT package. They must be loaded from the nvidia-*
-    pip packages (nvidia-cuda-runtime-cu12, nvidia-cudnn-cu12) before any
-    InferenceSession is created.
-
-    Calling preload_dlls() with directory="" searches NVIDIA site-packages
-    directories automatically.
+    bundled inside the ORT package — they come from the nvidia-* pip packages.
+    preload_dlls() locates them automatically via site-packages discovery.
     """
     try:
         import onnxruntime
         if hasattr(onnxruntime, "preload_dlls"):
-            onnxruntime.preload_dlls(cuda=True, cudnn=True, directory="")
-            logger.info("Preloaded CUDA/cuDNN DLLs for onnxruntime-gpu")
+            onnxruntime.preload_dlls(cuda=True, cudnn=True)
+            logger.debug("Preloaded CUDA/cuDNN DLLs for onnxruntime-gpu")
         else:
             logger.debug("onnxruntime.preload_dlls() not available (ORT < 1.21)")
     except Exception as e:
-        logger.warning(f"Failed to preload CUDA/cuDNN DLLs: {e}")
+        logger.warning("Failed to preload CUDA/cuDNN DLLs: %s", e)
 
 
 # =============================================================================
@@ -65,55 +107,98 @@ def get_insightface_app():
     global _insightface_app, _insightface_loaded
     if _insightface_loaded:
         return _insightface_app
-    _insightface_loaded = True
-
-    # Preload CUDA/cuDNN DLLs BEFORE any ORT InferenceSession is created
-    _preload_cuda_libs()
 
+    ctx_id = -1
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", os.path.expanduser("~/.insightface"))
     try:
         import onnxruntime as ort
         from insightface.app import FaceAnalysis
 
+        # Preload CUDA/cuDNN DLLs before any ORT InferenceSession is created.
+        # Silently no-ops on ROCm/Intel builds where preload_dlls() is absent.
+        _preload_cuda_libs()
+
+        # Disk cache check — lets the user know whether a download is coming
+        buffalo_path = Path(insightface_home) / "models" / "buffalo_l"
+        if buffalo_path.exists() and any(buffalo_path.iterdir()):
+            logger.info("InsightFace Buffalo_L: found in model cache")
+        else:
+            logger.info("InsightFace Buffalo_L: not cached — downloading now (~300 MB)")
+
         # Get providers, excluding TensorRT to avoid noisy errors
         providers = [p for p in ort.get_available_providers() if p != "TensorrtExecutionProvider"]
-        logger.info(f"Available ONNX providers: {providers}")
+        logger.debug("ONNX providers available: %s", providers)
 
-        # Determine device: 0 for GPU, -1 for CPU
         gpu_providers = {
             "CUDAExecutionProvider",
             "ROCmExecutionProvider",
             "MPSExecutionProvider",
             "CoreMLExecutionProvider",
+            "OpenVINOExecutionProvider",
         }
-        ctx_id = -1 if _is_force_cpu() else (0 if gpu_providers & set(providers) else -1)
+        has_gpu_provider = bool(gpu_providers & set(providers))
+        ctx_id = -1 if _is_force_cpu() else (0 if has_gpu_provider else -1)
 
-        device_str = "GPU" if ctx_id >= 0 else "CPU"
-        logger.info(f"Loading InsightFace Buffalo_L on {device_str} (ctx_id={ctx_id})...")
+        # For OpenVINO EP, inject device_type from env var (default CPU; set GPU for Intel Arc/iGPU)
+        has_openvino = "OpenVINOExecutionProvider" in providers
+        if has_openvino:
+            openvino_device = os.getenv("OPENVINO_DEVICE", "CPU")
+            providers = [
+                ("OpenVINOExecutionProvider", {"device_type": openvino_device})
+                if p == "OpenVINOExecutionProvider" else p
+                for p in providers
+            ]
+            logger.debug("OpenVINO EP: device_type=%s", openvino_device)
 
-        # Suppress C-level output during model loading
-        with open(os.devnull, "w") as devnull, contextlib.redirect_stdout(devnull), contextlib.redirect_stderr(devnull):
-            insightface_home = os.environ.get("INSIGHTFACE_HOME", os.path.expanduser("~/.insightface"))
+        if not has_gpu_provider and not _is_force_cpu():
+            logger.warning(
+                "No GPU execution provider found — running InsightFace on CPU. "
+                "Ensure the container has GPU access and the correct variant image is used "
+                "(gpu for NVIDIA, rocm for AMD, intel for Intel Arc/iGPU)."
+            )
+
+        if ctx_id < 0:
+            device_str = "CPU"
+        elif has_openvino:
+            device_str = f"OpenVINO ({os.getenv('OPENVINO_DEVICE', 'CPU')})"
+        else:
+            device_str = "GPU"
+        logger.info("InsightFace Buffalo_L: loading into memory on %s...", device_str)
+
+        t0 = time.time()
+        with _suppress_output():
             _insightface_app = FaceAnalysis(name="buffalo_l", root=insightface_home, providers=providers)
             _insightface_app.prepare(ctx_id=ctx_id, det_size=(640, 640))
 
+        logger.info("InsightFace Buffalo_L: ready on %s (%.1fs)", device_str, time.time() - t0)
+        _insightface_loaded = True
         return _insightface_app
 
     except ImportError:
         logger.error("InsightFace not installed!")
+        _insightface_loaded = True
         return None
     except Exception as e:
-        logger.error(f"Failed to load InsightFace: {e}")
-        # Retry on CPU if GPU failed
+        logger.error("Failed to load InsightFace: %s", e)
         if ctx_id == 0:
-            logger.warning("Retrying InsightFace on CPU...")
+            logger.warning("InsightFace GPU load failed — retrying on CPU...")
             try:
                 from insightface.app import FaceAnalysis
 
-                _insightface_app = FaceAnalysis(name="buffalo_l", root=insightface_home)
+                t0 = time.time()
+                with _suppress_output():
+                    _insightface_app = FaceAnalysis(
+                        name="buffalo_l",
+                        root=insightface_home,
+                        providers=["CPUExecutionProvider"],
+                    )
                     _insightface_app.prepare(ctx_id=-1, det_size=(640, 640))
+                logger.info("InsightFace Buffalo_L: ready on CPU (fallback, %.1fs)", time.time() - t0)
+                _insightface_loaded = True
                 return _insightface_app
             except Exception as ex:
-                logger.error(f"CPU fallback failed: {ex}")
+                logger.error("InsightFace CPU fallback failed: %s", ex)
+        _insightface_loaded = True
         return None
 
 
@@ -124,8 +209,9 @@ def get_face_embedding(img_pil: Image.Image) -> np.ndarray | None:
         return None
 
     try:
-        # InsightFace expects BGR cv2 image
-        img_bgr = cv2.cvtColor(np.asarray(img_pil), cv2.COLOR_RGB2BGR)
+        # InsightFace expects BGR cv2 image; normalise mode first so RGBA/grayscale don't
+        # raise a channel-count error inside cvtColor.
+        img_bgr = cv2.cvtColor(np.asarray(img_pil.convert("RGB")), cv2.COLOR_RGB2BGR)
 
         # Suppress scikit-image FutureWarning from InsightFace's face_align.py
         with warnings.catch_warnings():
@@ -135,162 +221,47 @@ def get_face_embedding(img_pil: Image.Image) -> np.ndarray | None:
         if not faces:
             return None
 
-        # Return embedding of largest face
-        largest = max(faces, key=lambda f: (f.bbox[2] - f.bbox[0]) * (f.bbox[3] - f.bbox[1]))
-        return largest.embedding
+        # Return embedding of the face nearest the crop centre; a large margin can pull
+        # a bigger neighbouring face into frame, and max-by-area would pick the wrong person.
+        cx, cy = img_pil.width / 2, img_pil.height / 2
+        nearest = min(
+            faces,
+            key=lambda f: ((f.bbox[0] + f.bbox[2]) / 2 - cx) ** 2 + ((f.bbox[1] + f.bbox[3]) / 2 - cy) ** 2,
+        )
+        return nearest.embedding
     except Exception as e:
-        logger.error(f"Error getting face embedding: {e}")
+        logger.error("Error getting face embedding: %s", e)
         return None
 
 
 # =============================================================================
-# SigLIP (Objects)
-# =============================================================================
-
-
-def get_siglip_model():
-    """Singleton for SigLIP model and processor with GPU auto-detection."""
-    global _siglip_model, _siglip_processor, _siglip_loaded
-    if _siglip_loaded:
-        return _siglip_model, _siglip_processor
-    _siglip_loaded = True
-
-    try:
-        import warnings
-
-        import torch
-        from transformers import AutoImageProcessor, SiglipVisionModel
-
-        model_name = "google/siglip-base-patch16-224"
-        logger.info(f"Loading SigLIP model ({model_name})...")
-
-        with warnings.catch_warnings():
-            warnings.filterwarnings("ignore", category=FutureWarning)
-            warnings.filterwarnings("ignore", message=".*use_fast.*")
-            _siglip_processor = AutoImageProcessor.from_pretrained(model_name, use_fast=True)
-            _siglip_model = SiglipVisionModel.from_pretrained(model_name)
-
-        _siglip_model.eval()
-
-        # Move to GPU if available
-        if not _is_force_cpu():
-            if torch.cuda.is_available():
-                _siglip_model = _siglip_model.cuda()
-                logger.info("SigLIP running on CUDA GPU")
-            elif hasattr(torch.backends, "mps") and torch.backends.mps.is_available():
-                _siglip_model = _siglip_model.to("mps")
-                logger.info("SigLIP running on Apple MPS")
-            else:
-                logger.info("SigLIP running on CPU")
-        else:
-            logger.info("FORCE_CPU set. SigLIP running on CPU")
-
-        return _siglip_model, _siglip_processor
-
-    except ImportError as e:
-        logger.error(f"transformers/torch not installed: {e}")
-        return None, None
-    except Exception as e:
-        logger.error(f"Failed to load SigLIP: {e}")
-        return None, None
-
-
-def get_object_embedding(img_pil: Image.Image) -> np.ndarray | None:
-    """Get 768-dim SigLIP embedding for an image."""
-    model, processor = get_siglip_model()
-    if model is None:
-        return None
-
-    try:
-        import torch
-
-        inputs = processor(images=img_pil, return_tensors="pt")
-        device = next(model.parameters()).device
-        inputs = {k: v.to(device) for k, v in inputs.items()}
-
-        with torch.no_grad():
-            outputs = model(**inputs)
-            return outputs.pooler_output.squeeze().cpu().numpy()
-    except Exception as e:
-        logger.error(f"Error getting object embedding: {e}")
-        return None
-
-
-def get_object_embeddings_batch(images: list[Image.Image]) -> list[np.ndarray | None]:
-    """Get SigLIP embeddings for a batch of images (GPU-efficient)."""
-    model, processor = get_siglip_model()
-    if model is None:
-        return [None] * len(images)
-
-    try:
-        import torch
-
-        inputs = processor(images=images, return_tensors="pt", padding=True)
-        device = next(model.parameters()).device
-        inputs = {k: v.to(device) for k, v in inputs.items()}
-
-        with torch.no_grad():
-            outputs = model(**inputs)
-            embeddings = outputs.pooler_output.cpu().numpy()
-            return [embeddings[i] for i in range(len(embeddings))]
-    except Exception as e:
-        logger.error(f"Error in batch embedding: {e}")
-        # Fall back to individual computation
-        return [get_object_embedding(img) for img in images]
-
-
-# =============================================================================
-# Unified Interface with Caching
+# Embedding Interface with Caching
 # =============================================================================
 
 
 def get_embedding(
     img_pil: Image.Image,
-    entity_type: str = "face",
     asset_id: str | None = None,
-    immich_embedding: np.ndarray | None = None,
 ) -> np.ndarray | None:
-    """Get embedding for an image based on entity type.
+    """Get embedding for a face image.
 
-    Priority:
-    1. Pre-fetched Immich embedding (if provided)
-    2. Disk cache (if enabled and asset_id provided)
-    3. Local model computation (InsightFace or SigLIP)
-
-    Args:
-        img_pil: The image to embed
-        entity_type: 'face' or 'object'
-        asset_id: Optional asset ID for cache lookup
-        immich_embedding: Optional pre-fetched embedding from Immich API
+    Checks disk cache first (if enabled and asset_id provided),
+    then falls back to local InsightFace computation.
     """
     from .config import Config
 
     use_cache = Config.ENABLE_CACHE and asset_id is not None
-    cache = get_cache(Config.CACHE_DIR) if use_cache else None
-    model_key = "immich" if entity_type == "face" else "siglip"
+    cache = get_cache(Config.DATA_DIR) if use_cache else None
 
-    # 1. Use Immich embedding if provided
-    if immich_embedding is not None:
     if cache:
-            cache.put(asset_id, immich_embedding, model_key)
-        return immich_embedding
-
-    # 2. Check disk cache
-    if cache:
-        cached = cache.get(asset_id, model_key)
+        cached = cache.get(asset_id, "insightface")
         if cached is not None:
             return cached
 
-    # 3. Compute locally
-    if entity_type == "face":
     emb = get_face_embedding(img_pil)
-        model_key = "insightface"
-    else:
-        emb = get_object_embedding(img_pil)
 
-    # Cache the result
     if emb is not None and cache:
-        cache.put(asset_id, emb, model_key)
+        cache.put(asset_id, emb, "insightface")
 
     return emb
 
@@ -298,42 +269,23 @@ def get_embedding(
 def _is_module_available(module_name: str) -> bool:
     """Check if a Python module is importable without importing it fully."""
     try:
-        importlib.util.find_spec(module_name)
-        return True
+        return importlib.util.find_spec(module_name) is not None
     except (ModuleNotFoundError, ValueError):
         return False
 
 
-def is_embedding_available(entity_type: str = "face", *, load: bool = False) -> bool:
-    """Check if embedding model is available for the given entity type.
+def is_embedding_available(*, load: bool = False) -> bool:
+    """Check if InsightFace is available.
 
     By default this performs a lightweight import-check only (no model loading).
-    Pass ``load=True`` to actually load the model (expensive, hundreds of MB).
-
-    Args:
-        entity_type: 'face' or 'object'
-        load: If True, fully load the model to verify. If False (default),
-              only check that the required packages are importable.
+    Pass ``load=True`` to actually load the model (expensive, ~300 MB).
     """
     if load:
-        if entity_type == "face":
         return get_insightface_app() is not None
-        model, _ = get_siglip_model()
-        return model is not None
-
-    # Lightweight check: just verify the packages are importable
-    if entity_type == "face":
     return _is_module_available("insightface") and _is_module_available("onnxruntime")
-    return _is_module_available("transformers") and _is_module_available("torch")
 
 
-def load_embedding_model(entity_type: str = "face") -> bool:
-    """Explicitly load the embedding model for the given entity type.
-
-    Returns True if the model loaded successfully.
-    """
-    if entity_type == "face":
+def load_embedding_model() -> bool:
+    """Explicitly load InsightFace. Returns True if the model loaded successfully."""
     return get_insightface_app() is not None
-    model, _ = get_siglip_model()
-    return model is not None
 

winnow/executor.py

@@ -1,64 +1,72 @@
 """Execution phase: image processing and Frigate upload."""
 
 import logging
+import operator
 import os
 import shutil
 from io import BytesIO
 from urllib.parse import quote
 
+import PIL
 import requests
 from PIL import Image
 from rich import print as rprint
 from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn, TextColumn
 
 from .config import Config, get_headers
-from .image_processing import process_face_mode, process_full_mode, process_object_mode
-from .immich_api import fetch_face_data, fetch_full_image
-from .logging import console
-from .upload_tracker import mark_rejected, mark_uploaded
+from .frigate_api import (
+    _get_frigate_url,
+    delete_frigate_person_files,
+    get_all_frigate_person_files,
+    get_frigate_person_files,
+    get_frigate_version,
+    recognize_face,
+)
+from .image_processing import process_face_mode
+from .immich_api import fetch_full_image
+from .log_config import console
+from .quality import blur_score_from_image
+from .reconcile import enrich_asset_with_face_data, reconcile_frigate_mappings
+from .upload_tracker import (
+    REJECT_TRACKER_FILE,
+    UPLOAD_TRACKER_FILE,
+    begin_batch,
+    flush_batch,
+    get_lowest_quality_mapped_file,
+    get_most_redundant_mapped_file,
+    get_tracked_frigate_file_count,
+    get_tracked_frigate_filenames,
+    has_frigate_scores,
+    mark_rejected,
+    mark_uploaded,
+    remove_frigate_file,
+    remove_frigate_files_batch,
+)
 
 logger = logging.getLogger(__name__)
 
 
-def _enrich_asset_with_face_data(asset: dict, person: dict) -> dict:
-    """Enrich an asset dict with face bounding box data from the Immich faces API.
+def _safe_person_dir(output_dir: str, person_name: str) -> str:
+    """Return the output subdirectory for a person, raising ValueError on path traversal.
 
-    The search/metadata endpoint does not include face bounding box data,
-    so we fetch it from GET /api/faces?id={asset_id} and inject it into
-    the asset's "people" field so process_face_mode can find it.
-
-    Returns the enriched asset dict (modifies in place and returns it).
+    os.path.join silently discards output_dir when person_name is absolute,
+    and '../..' sequences resolve outside the tree. Both are rejected by the
+    realpath+startswith guard, which is the load-bearing security check.
+    The islink check below provides an earlier, cleaner error message for the
+    symlink sub-case; it is redundant with (not a replacement for) the
+    realpath+startswith traversal check.
     """
-    person_id = person["id"]
-    face_data = fetch_face_data(asset["id"], person_id=person_id)
-
-    if face_data is None:
-        logger.debug(f"No face data returned for {person.get('name')} in asset {asset.get('id')}")
-        # Clean any None entries from the people list (can come from Immich API)
-        if "people" in asset:
-            asset["people"] = [p for p in asset["people"] if p is not None]
-        return asset
-
-    # Skip zero-area bounding boxes (face detection failed or no face found)
-    if face_data.bbox == (0, 0, 0, 0):
-        logger.debug(f"Zero-area bounding box for {person.get('name')} in asset {asset.get('id')}")
-        # Clean any None entries from the people list (can come from Immich API)
-        if "people" in asset:
-            asset["people"] = [p for p in asset["people"] if p is not None]
-        return asset
-
-    face_info = {
-        "boundingBoxX1": face_data.bbox[0],
-        "boundingBoxY1": face_data.bbox[1],
-        "boundingBoxX2": face_data.bbox[2],
-        "boundingBoxY2": face_data.bbox[3],
-        "imageWidth": face_data.image_width,
-        "imageHeight": face_data.image_height,
-    }
-
-    # Inject into asset so process_face_mode can find it via asset["people"]
-    asset["people"] = [{"id": person_id, "faces": [face_info]}]
-    return asset
+    raw = os.path.join(output_dir, person_name)
+    if os.path.islink(raw):
+        raise ValueError(f"Person name {person_name!r} resolves to a symlink — skipping")
+    candidate = os.path.realpath(raw)
+    base = os.path.realpath(output_dir)
+    # Use the base path as its own prefix when it's the filesystem root ("/"),
+    # otherwise append os.sep — avoids the false "//" double-slash when base == "/".
+    base_prefix = base if base == os.sep else base + os.sep
+    if not candidate.startswith(base_prefix) and candidate != base:
+        raise ValueError(f"Person name {person_name!r} escapes output directory — skipping")
+    return candidate
 
 
 def execute_jobs(jobs: list[dict]) -> None:
@@ -74,6 +82,18 @@ def execute_jobs(jobs: list[dict]) -> None:
 
     use_full_res = Config.USE_FULL_RESOLUTION
 
+    # Load InsightFace app for landmark-based crop alignment.
+    # The model is already resident from the diversity/embedding phase, so this
+    # is just a singleton lookup — no load cost.
+    insightface_app = None
+    if Config.ENABLE_FACE_ALIGNMENT:
+        try:
+            from .embeddings import get_insightface_app
+
+            insightface_app = get_insightface_app()
+        except Exception as e:
+            logger.debug("InsightFace unavailable for crop alignment: %s", e)
+
     with Progress(
         SpinnerColumn(),
         TextColumn("[progress.description]{task.description}"),
@@ -85,107 +105,151 @@ def execute_jobs(jobs: list[dict]) -> None:
         overall_task = progress.add_task("[green]Overall Progress", total=grand_total)
 
         for job in jobs:
-            person, assets, config = job["person"], job["assets"], job["config"]
-            name, mode = person["name"], config.get("mode", "face")
+            person, assets = job["person"], job["assets"]
+            name = person["name"]
 
             job_task = progress.add_task(f"Processing {name}...", total=len(assets))
-            person_dir = os.path.join(Config.OUTPUT_DIR, name)
+            try:
+                try:
+                    person_dir = _safe_person_dir(Config.OUTPUT_DIR, name)
+                except ValueError as e:
+                    logger.error(str(e))
+                    continue
                 # Face crops are transient (uploaded then discarded); wipe before each run.
-            # Object crops are the deliverable; preserve them across runs.
-            if mode == "face" and os.path.isdir(person_dir):
+                # A symlink could appear here via a TOCTOU race after _safe_person_dir
+                # returned — writing through it would land crops outside output_dir.
+                if os.path.islink(person_dir):
+                    logger.error("person_dir %s became a symlink after path check — skipping job", person_dir)
+                    continue
+                try:
+                    if os.path.isdir(person_dir):
                         shutil.rmtree(person_dir)
                     os.makedirs(person_dir, exist_ok=True)
+                except OSError as e:
+                    logger.error("Failed to prepare output dir for %s: %s", name, e)
+                    continue
 
-            # Track filename → asset_id mapping for upload dedup
+                # Track filename → asset_id, filename → confidence score, filename → crop dims
                 asset_map: dict[str, str] = {}
+                score_map: dict[str, float | None] = {}
+                dims_map: dict[str, tuple[int, int]] = {}
 
                 count = 0
                 for asset in assets:
                     try:
-                    # For face mode, enrich the asset with face bounding box data
-                    # from the Immich faces API (not included in search/metadata results)
-                    if mode == "face":
-                        asset = _enrich_asset_with_face_data(asset, person)
+                        # Enrich the asset with face bounding box data from the Immich
+                        # faces API (not included in search/metadata results).
+                        asset = enrich_asset_with_face_data(asset, person)
+                        # Skip download if detection confidence already disqualifies
+                        # the asset — avoids fetching a large image we'll discard.
+                        conf = asset.get("face_confidence")
+                        if conf is not None and conf < Config.MIN_CONFIDENCE:
+                            progress.console.print(
+                                f"[yellow]Skipped {asset['id']}"
+                                f" (detection confidence {conf:.2f} < {Config.MIN_CONFIDENCE})[/yellow]"
+                            )
+                            mark_rejected(asset["id"], person_name=name)
+                            progress.advance(job_task)
+                            progress.advance(overall_task)
+                            continue
 
                         # Use full-resolution for final output when configured
                         if use_full_res:
                             img = fetch_full_image(asset["id"])
+                            if img is None:
+                                # Full-res download failed — could be a transient network
+                                # error, so don't mark rejected; it will be retried next run.
+                                pass
                         else:
                             resp = requests.get(
                                 f"{Config.IMMICH_URL}/api/assets/{asset['id']}/thumbnail?size=preview&format=JPEG",
                                 headers=get_headers(),
                                 timeout=30,
                             )
-                        img = Image.open(BytesIO(resp.content)) if resp.ok else None
+                            if resp.ok:
+                                try:
+                                    img = Image.open(BytesIO(resp.content))
+                                except (PIL.UnidentifiedImageError, OSError):
+                                    # Pillow cannot identify the format or the content is
+                                    # truncated. The download already succeeded (resp.ok),
+                                    # so this is a data problem, not a transient network
+                                    # error — mark rejected so it isn't retried forever.
+                                    logger.warning("Invalid image data for asset %s — marking rejected", asset["id"])
+                                    mark_rejected(asset["id"], person_name=name)
+                                    img = None
+                            else:
+                                img = None
 
                         if img is None:
                             progress.console.print(f"[red]Failed download {asset['id']}[/red]")
                         else:
-                        saved = (
-                            process_face_mode(img, asset, person, person_dir, count)
-                            if mode == "face"
-                            else process_object_mode(img, config, person_dir, count)
-                            if mode == "object"
-                            else process_full_mode(img, person_dir, count)
+                            saved = process_face_mode(
+                                img, asset, person, person_dir, count, insightface_app=insightface_app
                             )
-                        if saved:
-                            # Record which asset produced which output file
+                            if isinstance(saved, tuple):
                                 filename = f"{count}.jpg"
                                 asset_map[filename] = asset["id"]
-                            # Also record object-mode variant filenames
-                            if mode == "object":
-                                for f in sorted(os.listdir(person_dir)):
-                                    if f.startswith(f"{count}_") and f not in asset_map:
-                                        asset_map[f] = asset["id"]
+                                score_map[filename] = asset.get("quality_score")
+                                dims_map[filename] = saved
+                                # Time-spread path: compute blur score from the downloaded
+                                # image. Capped at 1440px via blur_score_from_image() so the
+                                # scale matches the preview thumbnails the embedding path uses
+                                # — Laplacian variance grows with resolution, making full-res
+                                # and thumbnail scores incomparable if left uncapped.
+                                if score_map[filename] is None:
+                                    score_map[filename] = blur_score_from_image(img)
 
                                 count += 1
                             else:
+                                reason = saved if isinstance(saved, str) else "no usable face data"
                                 progress.console.print(
-                                f"[yellow]Skipped {asset['id']} (no usable face data)[/yellow]"
+                                    f"[yellow]Skipped {asset['id']} ({reason})[/yellow]"
                                 )
                     except Exception as e:
-                    logger.error(f"Failed to process asset {asset['id']}: {e}")
+                        logger.error("Failed to process asset %s: %s", asset.get("id", "<unknown>"), e)
 
                     progress.advance(job_task)
                     progress.advance(overall_task)
 
-            # Store asset_map on the job so upload_to_frigate can use it
+                # Store maps on the job so upload_to_frigate can use them
                 job["asset_map"] = asset_map
-
-            progress.remove_task(job_task)
+                job["score_map"] = score_map
+                job["dims_map"] = dims_map
 
                 # Log how many images were actually saved vs selected
                 if count < len(assets):
-                logger.info(f"{name}: saved {count}/{len(assets)} selected images")
+                    logger.info("%s: saved %s/%s selected images", name, count, len(assets))
+            finally:
+                progress.remove_task(job_task)
 
 
 def upload_to_frigate(jobs: list[dict]) -> None:
     """Upload processed face crops to Frigate via API with detailed logging.
 
-    Only runs for face-mode jobs. Object-mode crops are saved to the output
-    directory as the deliverable and must be copied to Frigate manually.
-
     After each successful upload, records the Immich asset ID in the
     upload tracker so it is skipped on future runs.
     """
-    face_jobs = [j for j in jobs if j["config"].get("mode", "face") == "face"]
-
-    if not face_jobs:
-        rprint("[dim]No face-mode jobs to upload.[/dim]")
+    if not jobs:
+        rprint("[dim]No jobs to upload.[/dim]")
         return
 
-    # Notify user about object-mode jobs that were skipped
-    object_jobs = [j for j in jobs if j["config"].get("mode") == "object"]
-    for job in object_jobs:
-        name = job["person"]["name"]
-        person_dir = os.path.join(Config.OUTPUT_DIR, name)
-        rprint(f"  [dim]📁 {name} (object): crops saved to {person_dir} — copy to Frigate manually[/dim]")
-
-    frigate_url = os.environ.get("FRIGATE_URL", "")
+    frigate_url = _get_frigate_url()
     if not frigate_url:
         rprint("[yellow]⚠️  FRIGATE_URL not set, skipping upload.[/yellow]")
         return
 
+    _frigate_version = get_frigate_version()
+    if _frigate_version is not None:
+        try:
+            parts = [int(x) for x in _frigate_version.lstrip("v").split("-")[0].split(".") if x.isdigit()]
+            if len(parts) >= 2 and (parts[0], parts[1]) < (0, 16):
+                rprint(
+                    f"  [yellow]⚠  Frigate {_frigate_version} detected — "
+                    "face training API requires v0.16+. Uploads may fail.[/yellow]"
+                )
+        except Exception:
+            pass
+
     rprint("\n[bold cyan]📤 Uploading to Frigate[/bold cyan]")
     rprint(f"  Target: [dim]{frigate_url}[/dim]")
 
@@ -193,7 +257,7 @@ def upload_to_frigate(jobs: list[dict]) -> None:
     # from the asset_map stored on each job during execute_jobs()
     filename_to_asset_id: dict[str, dict[str, str]] = {}
     total_files = 0
-    for job in face_jobs:
+    for job in jobs:
         name = job["person"]["name"]
         asset_map = job.get("asset_map", {})
         filename_to_asset_id[name] = asset_map
@@ -203,11 +267,15 @@ def upload_to_frigate(jobs: list[dict]) -> None:
         rprint("  [yellow]No images found to upload.[/yellow]")
         return
 
-    rprint(f"  People: [bold]{len(face_jobs)}[/bold], Total images: [bold]{total_files}[/bold]")
+    rprint(f"  People: [bold]{len(jobs)}[/bold], Total images: [bold]{total_files}[/bold]")
 
     uploaded, failed = 0, 0
     max_retries = 2
 
+    # Fetch all Frigate training files once — avoids one GET /api/faces per person.
+    # Falls back to per-person calls inside the loop if this fetch fails.
+    all_frigate_files = get_all_frigate_person_files()
+
     with Progress(
         SpinnerColumn(),
         TextColumn("[progress.description]{task.description}"),
@@ -217,19 +285,25 @@ def upload_to_frigate(jobs: list[dict]) -> None:
     ) as progress:
         upload_task = progress.add_task("[green]Uploading to Frigate", total=total_files)
 
-        for job in face_jobs:
+        for job in jobs:
             name = job["person"]["name"]
             # URL-encode the name for the API (handles spaces, special chars)
             encoded_name = quote(name, safe="")
             if " " in name:
                 progress.console.print(f"  ℹ️  URL-encoded name for Frigate API: '{name}' → '{encoded_name}'")
 
-            person_dir = os.path.join(Config.OUTPUT_DIR, name)
+            try:
+                person_dir = _safe_person_dir(Config.OUTPUT_DIR, name)
+            except ValueError as e:
+                logger.error(str(e))
+                continue
             if not os.path.isdir(person_dir):
                 progress.console.print(f"  [dim]⏭️  {name}: no output directory, skipping[/dim]")
                 continue
 
             asset_map = filename_to_asset_id.get(name, {})
+            score_map = job.get("score_map", {})
+            dims_map = job.get("dims_map", {})
             person_files = sorted(asset_map.keys())
 
             if not person_files:
@@ -240,8 +314,194 @@ def upload_to_frigate(jobs: list[dict]) -> None:
             person_uploaded = 0
             person_failed = 0
 
+            # Snapshot live Frigate files for post-upload reconciliation diff only.
+            # effective_count is sourced from the tracker (mapped files) so that
+            # manually-added Frigate files don't consume winnow's managed quota.
+            # Replacement targets also come exclusively from the tracker, so manually
+            # added files are never selected for deletion — only winnow-uploaded ones.
+            # LIMITATION — manual files are invisible to diversity decisions: winnow
+            # can observe their effect on the Frigate score (indirectly, via recognize)
+            # but cannot measure their embedding distribution directly. If a user has
+            # 20 manually-added frontals and winnow has room for 20 more, winnow may
+            # add more frontals because it can't see that frontals are already covered.
+            # TODO(frigate-api): if Frigate exposes per-file embeddings, compute
+            # diversity against the full training set (tracked + manual) rather than
+            # relying solely on the Frigate score as a proxy signal.
+            _snapshot = (
+                all_frigate_files.get(name, []) if all_frigate_files is not None
+                else get_frigate_person_files(name)
+            )
+            if _snapshot is None:
+                # Frigate GET is down. The tracker only knows files winnow mapped
+                # previously — it is blind to manually-added Frigate files. Using
+                # the tracker as the baseline would make those unmapped files look
+                # like new uploads in reconcile, triggering the >target guard and
+                # silently dropping all mappings. Skip reconciliation entirely when
+                # we can't get a reliable live snapshot.
+                logger.warning(
+                    "%s: Frigate API unreachable at upload start"
+                    " — file mapping will be skipped for this batch", name
+                )
+                known_frigate_files_at_start: set[str] = set()
+                _skip_reconcile = True
+            else:
+                known_frigate_files_at_start: set[str] = set(_snapshot)
+                _skip_reconcile = False
+                # Remove tracker mappings for files that no longer exist in Frigate
+                # (manually deleted, or cleaned up outside winnow). This corrects the
+                # effective_count so those slots are available for new uploads.
+                stale = get_tracked_frigate_filenames(name) - known_frigate_files_at_start
+                if stale:
+                    remove_frigate_files_batch(name, list(stale))
+                    progress.console.print(
+                        f"  [dim]{name}: cleared {len(stale)} stale mapping(s)"
+                        " (file(s) no longer in Frigate)[/dim]"
+                    )
+            effective_count = get_tracked_frigate_file_count(name)
+            quality_replacement = job.get("config", {}).get("quality_replacement", False)
+            if Config.ENABLE_FRIGATE_SCORES and effective_count == 0:
+                progress.console.print(
+                    f"  [dim]{name}: first run — Frigate diversity scoring will apply from the next run[/dim]"
+                )
+            # Snapshot whether Frigate has a model before the upload loop starts.
+            # effective_count is incremented inside the loop on each successful upload,
+            # so using the live value would incorrectly trigger recognize_face calls
+            # mid-batch on the first run (after the first upload sets it to 1).
+            has_frigate_model = effective_count > 0
+            actually_uploaded: list[tuple[str, str | None]] = []
+            failed_deletes: set[str] = set()
+            min_quality_score_for_slot: float | None = None
+            person_has_fscores: bool = has_frigate_scores(name)
+
+            begin_batch(UPLOAD_TRACKER_FILE)
+            begin_batch(REJECT_TRACKER_FILE)
+            try:
                 for fname in person_files:
                     fpath = os.path.join(person_dir, fname)
+
+                    # If a previous replacement delete succeeded but that upload failed,
+                    # require the next candidate to beat the deleted file's score so the
+                    # freed slot isn't filled with something worse than what we removed.
+                    if min_quality_score_for_slot is not None:
+                        file_score = score_map.get(fname)
+                        if file_score is not None and file_score < min_quality_score_for_slot:
+                            progress.console.print(
+                                f"    [dim]⏭  {fname}: score {file_score:.3f} < freed slot floor"
+                                f" {min_quality_score_for_slot:.3f}, skipping[/dim]"
+                            )
+                            progress.advance(upload_task)
+                            continue
+
+                    at_cap = effective_count >= Config.MAX_AUTO_IMAGES
+
+                    # Pre-upload Frigate score — clean measurement (image not yet in training set).
+                    # Called for all below-cap uploads (seeds frigate_scores for future at-cap
+                    # replacement) and for at-cap uploads when scores already exist.
+                    # Skipped when has_frigate_model is False (effective_count was 0 before the loop).
+                    # recognize_face returns (face_name, score); we only use the score when the
+                    # best match is for the correct person. Mismatches (or "unknown") are treated
+                    # as None so a wrong-person score never drives a ceiling skip or replacement.
+                    # Frigate rebuilds its model asynchronously after any delete (clear + background
+                    # thread), so the first recognize call after a deletion returns None — our code
+                    # handles this conservatively by skipping that candidate until the next run.
+                    # LIMITATION — async rebuild during multi-replacement runs: each deletion in a
+                    # single run triggers a background model rebuild in Frigate. Subsequent recognize
+                    # calls in the same run may get None (rebuild in progress), causing later
+                    # candidates to fall back to blur-score replacement or be skipped entirely.
+                    # The more replacements that happen in one run, the worse the scoring gets.
+                    # TODO(frigate-api): if Frigate exposes a model generation counter or a
+                    # rebuild-complete signal, poll it between recognize calls during replacement
+                    # sequences rather than accepting stale/None scores.
+                    pre_fscore: float | None = None
+                    if Config.ENABLE_FRIGATE_SCORES and has_frigate_model:
+                        if not at_cap or person_has_fscores:
+                            _result = recognize_face(fpath)
+                            if _result is not None and (_result[0] or "").casefold() == name.casefold():
+                                pre_fscore = _result[1]
+
+                    # Below-cap novelty gate: skip candidates already covered by the Frigate model,
+                    # including conditions learned from manually-added images winnow can't track.
+                    # pre_fscore is None when effective_count == 0 (no Frigate model yet),
+                    # so this block never fires on the first run without an extra guard.
+                    if not at_cap and pre_fscore is not None:
+                        _ceiling = Config.FRIGATE_SCORE_CEILING
+                        if _ceiling is None:
+                            # Dynamic default: bar = most-redundant tracked file's Frigate score.
+                            # Falls back to uploading freely when no tracked scores exist yet.
+                            _bar = get_most_redundant_mapped_file(name)
+                            _skip = _bar is not None and pre_fscore > _bar[2]
+                            _bar_str = f"most redundant tracked {_bar[2]:.2f}" if _bar else ""
+                        elif _ceiling == 0.0:
+                            _skip = False  # explicitly disabled
+                            _bar_str = ""
+                        else:
+                            _skip = pre_fscore > _ceiling
+                            _bar_str = f"ceiling {_ceiling:.2f}"
+                        if _skip:
+                            progress.console.print(
+                                f"    [dim]⏭  {fname}: Frigate score {pre_fscore:.2f}"
+                                f" > {_bar_str}, already covered[/dim]"
+                            )
+                            progress.advance(upload_task)
+                            continue
+
+                    if at_cap:
+                        if not quality_replacement:
+                            progress.console.print(f"    [dim]⏭  {fname}: at cap, quality replacement disabled[/dim]")
+                            progress.advance(upload_task)
+                            continue
+
+                        using_fscore = person_has_fscores and Config.ENABLE_FRIGATE_SCORES
+                        if using_fscore:
+                            candidate_score = pre_fscore
+                            get_target = get_most_redundant_mapped_file
+                            score_label, better_note = "frigate", " (more novel)"
+                            no_score_msg = "Frigate recognize unavailable, skipping replacement"
+                            is_better_than = operator.lt
+                        else:
+                            candidate_score = score_map.get(fname)
+                            get_target = get_lowest_quality_mapped_file
+                            score_label, better_note = "blur", ""
+                            no_score_msg = "no quality score, skipping replacement"
+                            is_better_than = operator.gt
+
+                        if candidate_score is None:
+                            progress.console.print(f"    [dim]⏭  {fname}: {no_score_msg}[/dim]")
+                            progress.advance(upload_task)
+                            continue
+
+                        target = get_target(name, exclude=failed_deletes)
+                        not_better = target is None or not is_better_than(candidate_score, target[2])
+                        if not_better:
+                            target_str = f"{target[2]:.3f}" if target is not None else "N/A"
+                            cmp_op = "<" if using_fscore else ">"
+                            progress.console.print(
+                                f"    [dim]⏭  {fname}: {score_label} {candidate_score:.3f}"
+                                f" not {cmp_op} {target_str}, skipping[/dim]"
+                            )
+                            progress.advance(upload_task)
+                            continue
+
+                        target_frigate_file, _target_asset_id, target_score = target
+                        cmp_op = "<" if using_fscore else ">"
+                        progress.console.print(
+                            f"    🔄 {fname}: {score_label} {candidate_score:.3f} {cmp_op} {target_score:.3f},"
+                            f" replacing {target_frigate_file}{better_note}"
+                        )
+                        if delete_frigate_person_files(name, [target_frigate_file]):
+                            remove_frigate_file(name, target_frigate_file)
+                            person_has_fscores = has_frigate_scores(name)
+                            effective_count -= 1
+                            min_quality_score_for_slot = None if using_fscore else target_score
+                        else:
+                            logger.warning(
+                                "Failed to delete %s for %s, skipping replacement",
+                                target_frigate_file, name,
+                            )
+                            failed_deletes.add(target_frigate_file)
+                            progress.advance(upload_task)
+                            continue
+
                     for attempt in range(1, max_retries + 1):
                         try:
                             with open(fpath, "rb") as f:
@@ -253,11 +513,40 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                             if resp.status_code == 200:
                                 uploaded += 1
                                 person_uploaded += 1
-
-                            # Mark this asset as uploaded so it's skipped on future runs
+                                effective_count += 1
+                                min_quality_score_for_slot = None  # for/else rollback mirrors this pair
                                 asset_id = asset_map.get(fname)
                                 if asset_id:
-                                mark_uploaded(asset_id, person_name=name)
+                                    try:
+                                        mark_uploaded(
+                                            asset_id,
+                                            person_name=name,
+                                            score=score_map.get(fname),
+                                            crop_dims=dims_map.get(fname),
+                                            frigate_score=pre_fscore,
+                                        )
+                                    except Exception as tracker_exc:
+                                        # Upload to Frigate succeeded — don't retry on tracker
+                                        # failure or we'd upload a duplicate to Frigate.
+                                        logger.error(
+                                            "Tracker write failed for %s — upload succeeded"
+                                            " but asset may be re-selected next run: %s",
+                                            fname, tracker_exc,
+                                        )
+                                    else:
+                                        if pre_fscore is not None:
+                                            person_has_fscores = True
+                                    # Always record for reconcile so the Frigate filename→asset_id
+                                    # mapping is created even when the tracker write fails.
+                                    # Trade-off: if mark_uploaded failed, asset_id is absent from
+                                    # asset_ids and scores. Consequences: (1) re-selected next run
+                                    # → Frigate duplicate; (2) excluded from quality-replacement
+                                    # candidates (_pick_mapped_file requires a scores entry);
+                                    # (3) counted toward MAX_AUTO_IMAGES cap (via frigate_files).
+                                    # The alternative — not appending — leaves the file permanently
+                                    # unmapped (reconcile never creates the frigate_files entry),
+                                    # making (2) and (3) permanent. Frigate duplicate is lesser.
+                                    actually_uploaded.append((fname, asset_id))
 
                                 break
                             else:
@@ -272,13 +561,21 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                                 progress.console.print(
                                     f"    [red]✗ {fname}: HTTP {resp.status_code} (after {max_retries} attempts)[/red]"
                                 )
+                                full_body = resp.text
                                 try:
-                                error_detail = resp.json().get("message", resp.text[:100])
-                                progress.console.print(f"      [dim]{error_detail}[/dim]")
+                                    error_detail = resp.json().get("message", full_body[:100])
                                 except Exception:
-                                error_detail = resp.text[:100]
+                                    error_detail = full_body[:100]
+                                if resp.status_code in (400, 500):
                                     progress.console.print(f"      [dim]{error_detail}[/dim]")
-                            if resp.status_code == 400 and "face" in error_detail.lower():
+                                else:
+                                    logger.debug("%s HTTP %s: %s", fname, resp.status_code, error_detail)
+                                _is_permanent = (
+                                    (resp.status_code == 400 and "face" in full_body.lower())
+                                    or resp.status_code == 422
+                                    or (resp.status_code == 500 and "could not process" in full_body.lower())
+                                )
+                                if _is_permanent:
                                     asset_id = asset_map.get(fname)
                                     if asset_id:
                                         mark_rejected(asset_id, person_name=name)
@@ -311,9 +608,47 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                             progress.console.print(
                                 f"    [red]✗ {fname}: {type(e).__name__} - {e} (after {max_retries} attempts)[/red]"
                             )
+                    else:
+                        # All retries exhausted without a successful upload.
+                        # Restore the slot freed by the preceding delete so the next
+                        # candidate still sees at_cap=True and must beat the replacement gate.
+                        # Also clear the quality floor — the deleted file's score no longer
+                        # represents any live Frigate file, and leaving it blocks the next
+                        # candidate from filling the restored slot.
+                        if at_cap:
+                            effective_count += 1
+                            min_quality_score_for_slot = None
 
                     progress.advance(upload_task)
 
+                if min_quality_score_for_slot is not None:
+                    logger.warning(
+                        f"{name}: freed replacement slot (floor {min_quality_score_for_slot:.3f})"
+                        " was not filled this run — will be available next run"
+                    )
+
+            finally:
+                try:
+                    flush_batch(UPLOAD_TRACKER_FILE)
+                except Exception as _flush_exc:
+                    logger.warning(
+                        "flush_batch failed during cleanup"
+                        " — batch will be recovered on next begin_batch: %s",
+                        _flush_exc,
+                    )
+                try:
+                    flush_batch(REJECT_TRACKER_FILE)
+                except Exception as _flush_exc:
+                    logger.warning(
+                        "flush_batch failed during cleanup"
+                        " — batch will be recovered on next begin_batch: %s",
+                        _flush_exc,
+                    )
+
+            # Batch-map Frigate filenames to asset IDs now that all uploads are done.
+            if actually_uploaded and not _skip_reconcile:
+                reconcile_frigate_mappings(name, known_frigate_files_at_start, actually_uploaded)
+
             # Per-person summary
             if person_failed == 0:
                 progress.console.print(

winnow/frigate_api.py

@@ -0,0 +1,173 @@
+"""Frigate API helpers for querying face training state."""
+
+import logging
+import os
+
+import requests
+
+logger = logging.getLogger(__name__)
+
+
+def _get_frigate_url() -> str:
+    """Return normalized FRIGATE_URL with whitespace and trailing slash stripped, or '' if unset."""
+    return os.environ.get("FRIGATE_URL", "").strip().rstrip("/")
+
+
+def get_frigate_version() -> str | None:
+    """Fetch Frigate's version string from GET /api/version.
+
+    Returns the version string (e.g. "0.16.0-beta4") or None if FRIGATE_URL
+    is unset, the endpoint is unreachable, or the response is not parseable.
+    """
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return None
+    try:
+        resp = requests.get(f"{frigate_url}/api/version", timeout=5)
+        if resp.ok:
+            return resp.text.strip().strip('"')
+        return None
+    except Exception:
+        return None
+
+
+def _get_faces_data() -> dict | None:
+    """Fetch raw GET /api/faces response. Returns None if unavailable."""
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return None
+    try:
+        resp = requests.get(f"{frigate_url}/api/faces", timeout=10)
+        resp.raise_for_status()
+        return resp.json()
+    except Exception as e:
+        logger.warning("Could not query Frigate faces API: %s", e)
+        return None
+
+
+def get_all_frigate_person_files() -> dict[str, list[str]] | None:
+    """Return {person_name: [filename, ...]} for every person in Frigate.
+
+    Single call used to build per-person snapshots before the upload loop,
+    avoiding one GET /api/faces per person.  Returns None if unavailable.
+    """
+    data = _get_faces_data()
+    if data is None:
+        return None
+    # Response: {person_name: [file, ...], "train": [...], ...}
+    # "train" is a flat pending list, not a person — skip it.
+    # TODO(frigate-api): "train" is the only known special key as of Frigate v0.16.
+    # Log unexpected non-list values so future Frigate schema additions are visible.
+    result = {}
+    for name, files in data.items():
+        if name == "train":
+            continue
+        if isinstance(files, list):
+            result[name] = files
+        else:
+            logger.debug("Frigate API: skipping unexpected key %r (got %s, not list)", name, type(files).__name__)
+    return result
+
+
+def get_frigate_face_counts() -> dict[str, int] | None:
+    """Return {person_name: training_image_count} from Frigate's train directory.
+
+    Returns None if FRIGATE_URL is not set or the API is unreachable, so callers
+    can distinguish "API unavailable" from "person has 0 images."
+    """
+    all_files = get_all_frigate_person_files()
+    if all_files is None:
+        return None
+    return {name: len(files) for name, files in all_files.items()}
+
+
+def get_frigate_person_files(person_name: str) -> list[str] | None:
+    """Return the list of training filenames for a person in Frigate.
+
+    Returns None if the API is unreachable. Returns an empty list if the
+    person exists but has no training images yet.
+    """
+    data = _get_faces_data()
+    if data is None:
+        return None
+    files = data.get(person_name)
+    if files is not None and not isinstance(files, list):
+        logger.debug("Frigate API: unexpected type for %r — got %s, not list", person_name, type(files).__name__)
+        return []
+    return files if files is not None else []
+
+
+def recognize_face(file_path: str) -> tuple[str | None, float] | None:
+    """Submit an image to Frigate's recognize endpoint.
+
+    Returns (face_name, score) where face_name is the best-matching person
+    (may be "unknown" if below Frigate's confidence threshold) and score is
+    the sigmoid-mapped cosine similarity (0-1) against that person's mean
+    embedding.
+
+    Returns None if FRIGATE_URL is unset, the API is unreachable, no face is
+    detected, or face recognition is not enabled in Frigate.
+
+    LIMITATION — mean embedding comparison: the score reflects similarity to
+    the arithmetic mean of all training embeddings, not to individual ones.
+    A bimodal training set (e.g. frontals + profiles) has a mean that sits
+    between both clusters, making candidates from either cluster look more
+    novel than they are. Winnow could add redundant frontals while the score
+    suggests novelty, because the mean is pulled toward profiles.
+    TODO(frigate-api): if Frigate exposes per-file embeddings via the API,
+    replace mean-comparison with nearest-neighbour distance across individual
+    training embeddings for accurate coverage detection.
+    """
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return None
+    try:
+        with open(file_path, "rb") as f:
+            resp = requests.post(
+                f"{frigate_url}/api/faces/recognize",
+                files={"file": (os.path.basename(file_path), f, "image/jpeg")},
+                timeout=15,
+            )
+        if not resp.ok:
+            return None
+        data = resp.json()
+        if data.get("success") and "score" in data:
+            return (data.get("face_name"), round(float(data["score"]), 4))
+        return None
+    except Exception as e:
+        logger.debug("Frigate recognize failed for %s: %s", file_path, e)
+        return None
+
+
+def delete_frigate_person_files(person_name: str, filenames: list[str]) -> bool:
+    """Delete specific training files for a person from Frigate.
+
+    Uses POST /api/faces/{name}/delete with body {"ids": [filename, ...]}.
+    Returns True on success, False if unreachable or the request fails.
+    """
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return False
+    if not filenames:
+        return True
+    from urllib.parse import quote
+    encoded_name = quote(person_name, safe="")
+    try:
+        resp = requests.post(
+            f"{frigate_url}/api/faces/{encoded_name}/delete",
+            json={"ids": filenames},
+            timeout=10,
+        )
+        if resp.ok:
+            logger.debug("Deleted %s Frigate file(s) for %s", len(filenames), person_name)
+            return True
+        if resp.status_code == 404:
+            # File already absent — stale tracker entry. Return True so the caller
+            # removes it from the tracker and frees the slot cleanly.
+            logger.warning("Frigate file(s) not found for %s (stale tracker entry?): %s", person_name, filenames)
+            return True
+        logger.warning("Frigate delete returned %s for %s", resp.status_code, person_name)
+        return False
+    except Exception as e:
+        logger.warning("Failed to delete Frigate files for %s: %s", person_name, e)
+        return False

winnow/image_processing.py

@@ -1,7 +1,8 @@
-"""Image processing functions for cropping faces and objects."""
+"""Image processing functions for cropping faces."""
 
 import logging
 import os
+import warnings
 
 import numpy as np
 from PIL import Image
@@ -10,25 +11,20 @@ from .config import Config
 
 logger = logging.getLogger(__name__)
 
-# Lazy singleton
-_yolo_model = None
-
 
 def _save_jpeg(img: Image.Image, path: str) -> None:
     if img.mode != "RGB":
         img = img.convert("RGB")
-    img.save(path, format="JPEG")
-
-
-def get_yolo_model():
-    """Singleton for YOLO model."""
-    global _yolo_model
-    if _yolo_model is None:
-        from ultralytics import YOLO
-
-        logger.info("Loading YOLOv9c model...")
-        _yolo_model = YOLO("yolov9c.pt")
-    return _yolo_model
+    tmp = path + ".tmp"
+    try:
+        img.save(tmp, format="JPEG")
+        os.replace(tmp, path)
+    except Exception:
+        try:
+            os.remove(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def align_face(img: Image.Image, landmarks: list[list[float]] | np.ndarray) -> Image.Image | None:
@@ -50,15 +46,17 @@ def align_face(img: Image.Image, landmarks: list[list[float]] | np.ndarray) -> I
         img_np = np.asarray(img)
         lm = np.array(landmarks, dtype=np.float32)
         if lm.shape != (5, 2):
-            logger.debug(f"Invalid landmark shape: {lm.shape}, expected (5, 2)")
+            logger.debug("Invalid landmark shape: %s, expected (5, 2)", lm.shape)
             return None
+        with warnings.catch_warnings():
+            warnings.filterwarnings("ignore", message=".*estimate.*is deprecated", category=FutureWarning)
             aligned = norm_crop(img_np, lm)
         return Image.fromarray(aligned)
     except ImportError:
         logger.debug("InsightFace not available for face alignment")
         return None
     except Exception as e:
-        logger.debug(f"Face alignment failed: {e}")
+        logger.debug("Face alignment failed: %s", e)
         return None
 
 
@@ -69,12 +67,16 @@ def process_face_mode(
     output_dir: str,
     count: int,
     min_width: int | None = None,
-) -> bool:
+    insightface_app=None,
+) -> tuple[int, int] | str:
     """Crop face based on Immich metadata and save to output directory.
 
-    If face alignment is enabled and landmarks are available, produces
-    an aligned 112x112 crop. Otherwise falls back to bounding box crop
-    with configurable margin.
+    Returns (width, height) of the saved crop, or a skip-reason string if the
+    face was filtered out.
+    When insightface_app is provided and ENABLE_FACE_ALIGNMENT is True,
+    re-detects the face in the Immich bbox region using InsightFace to get
+    precise landmarks for a proper 112x112 aligned crop. Falls back to
+    bounding box crop with configurable margin if alignment is unavailable.
     """
     min_width = min_width or Config.MIN_FACE_WIDTH
 
@@ -89,15 +91,18 @@ def process_face_mode(
             break
 
     if not face_info:
-        logger.debug(f"No face info for {person.get('name')} in asset {asset.get('id')}")
-        return False
+        logger.debug("No face info for %s in asset %s", person.get("name"), asset.get("id"))
+        return "no face metadata"
 
     img_w, img_h = img.size
-    meta_w = face_info.get("imageWidth") or img_w
-    meta_h = face_info.get("imageHeight") or img_h
+    meta_w = face_info.get("imageWidth") or 0
+    meta_h = face_info.get("imageHeight") or 0
 
-    # Scale bounding box to actual image dimensions
-    scale_x, scale_y = img_w / meta_w, img_h / meta_h
+    # Scale bounding box from detection-image space to actual image dimensions.
+    # Fall back to 1.0 if Immich omits the field — bbox is assumed to already
+    # be in image space (correct for thumbnails, wrong for full-res).
+    scale_x = img_w / meta_w if meta_w else 1.0
+    scale_y = img_h / meta_h if meta_h else 1.0
     x1 = face_info["boundingBoxX1"] * scale_x
     y1 = face_info["boundingBoxY1"] * scale_y
     x2 = face_info["boundingBoxX2"] * scale_x
@@ -105,21 +110,56 @@ def process_face_mode(
 
     face_w, face_h = x2 - x1, y2 - y1
     if face_w < min_width or face_h < min_width:
-        logger.debug(f"Face too small ({face_w:.1f}x{face_h:.1f})")
-        return False
+        logger.debug("Face too small (%.1fx%.1f)", face_w, face_h)
+        return f"face too small ({face_w:.0f}x{face_h:.0f}px, min {min_width}px)"
 
-    # Try face alignment if enabled and landmarks available
+    # Re-detect face with InsightFace for landmark-based alignment.
+    # Immich's /api/faces endpoint does not include landmarks, so the
+    # align_face fallback below never fires without this step.
+    if insightface_app is not None and Config.ENABLE_FACE_ALIGNMENT:
+        try:
+            # Expand the Immich bbox by 50% to give InsightFace enough context
+            # for detection and alignment, then search for the face nearest the
+            # centre of that region (handles group photos at the boundary).
+            pad_x, pad_y = face_w * 0.5, face_h * 0.5
+            search_box = (
+                max(0, x1 - pad_x),
+                max(0, y1 - pad_y),
+                min(img_w, x2 + pad_x),
+                min(img_h, y2 + pad_y),
+            )
+            search_crop = img.crop(search_box)
+            with warnings.catch_warnings():
+                warnings.filterwarnings("ignore", message=".*estimate.*is deprecated", category=FutureWarning)
+                detected = insightface_app.get(np.asarray(search_crop))
+            if detected:
+                cx, cy = search_crop.width / 2, search_crop.height / 2
+                best = min(
+                    detected,
+                    key=lambda f: abs((f.bbox[0] + f.bbox[2]) / 2 - cx)
+                    + abs((f.bbox[1] + f.bbox[3]) / 2 - cy),
+                )
+                kps = getattr(best, "kps", None)
+                if kps is not None and np.asarray(kps).shape == (5, 2):
+                    aligned = align_face(search_crop, kps)
+                    if aligned is not None:
+                        _save_jpeg(aligned, os.path.join(output_dir, f"{count}.jpg"))
+                        return aligned.size
+        except Exception as e:
+            logger.debug("InsightFace re-detection failed for %s: %s", asset.get("id"), e)
+
+    # Landmark alignment from Immich metadata (Immich does not currently
+    # expose landmarks, so this path is a future-proofing fallback)
     if Config.ENABLE_FACE_ALIGNMENT:
         landmarks = face_info.get("landmarks") or face_info.get("landmark")
         if landmarks:
-            # Scale landmarks
             scaled_landmarks = [[lm[0] * scale_x, lm[1] * scale_y] for lm in landmarks]
             aligned = align_face(img, scaled_landmarks)
             if aligned is not None:
                 _save_jpeg(aligned, os.path.join(output_dir, f"{count}.jpg"))
-                return True
+                return aligned.size
 
-    # Fall back to bounding box crop with configurable margin
+    # Final fallback: bounding box crop with configurable margin
     margin = Config.FACE_MARGIN
     margin_x, margin_y = face_w * margin, face_h * margin
     crop_box = (
@@ -131,45 +171,7 @@ def process_face_mode(
 
     face_crop = img.crop(crop_box)
     _save_jpeg(face_crop, os.path.join(output_dir, f"{count}.jpg"))
-    return True
+    return face_crop.size
 
 
-def process_object_mode(
-    img: Image.Image,
-    config: dict,
-    output_dir: str,
-    count: int,
-) -> bool:
-    """Detect and crop objects using YOLO."""
-    try:
-        model = get_yolo_model()
-        target_class = config.get("object_class", "dog")
-        device = "cpu" if os.getenv("FORCE_CPU", "").lower() in ("true", "1", "yes") else None
-
-        results = model(img, verbose=False, device=device)
-
-        found = False
-        class_idx = 0  # Sequential counter per target class (Issue #10)
-        for box in (box for r in results for box in r.boxes):
-            cls_id = int(box.cls[0])
-            conf = float(box.conf[0])
-            if 0 <= cls_id < len(model.names) and model.names[cls_id] == target_class and conf > 0.5:
-                x1, y1, x2, y2 = box.xyxy[0].tolist()
-                _save_jpeg(
-                    img.crop((x1, y1, x2, y2)),
-                    os.path.join(output_dir, f"{count}_{class_idx}.jpg"),
-                )
-                class_idx += 1
-                found = True
-
-        return found
-    except Exception as e:
-        logger.error(f"YOLO processing failed: {e}")
-        return False
-
-
-def process_full_mode(img: Image.Image, output_dir: str, count: int) -> bool:
-    """Save full image."""
-    _save_jpeg(img, os.path.join(output_dir, f"{count}.jpg"))
-    return True
 

winnow/immich_api.py

@@ -5,7 +5,6 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from io import BytesIO
 
-import numpy as np
 import requests
 from PIL import Image, ImageOps
 
@@ -14,19 +13,42 @@ from .config import Config, get_headers
 logger = logging.getLogger(__name__)
 
 MAX_PAGES = 1000  # Safety limit for pagination
+_MAX_ASSETS_PER_PERSON = 5000  # Stop fetching after this many — diversity pool is capped at 3000 anyway
 
 
 @dataclass
 class FaceData:
     """Pre-computed face data from Immich."""
 
-    embedding: np.ndarray | None
     bbox: tuple[float, float, float, float]  # (x1, y1, x2, y2)
     confidence: float | None
     image_width: int
     image_height: int
 
 
+def get_immich_version() -> tuple[int, int, int] | None:
+    """Fetch Immich server version from GET /api/server/version.
+
+    Returns (major, minor, patch) or None if unreachable or unparseable.
+    """
+    try:
+        resp = requests.get(
+            f"{Config.IMMICH_URL}/api/server/version",
+            headers=get_headers(),
+            timeout=5,
+        )
+        if resp.ok:
+            data = resp.json()
+            major, minor, patch = data.get("major"), data.get("minor"), data.get("patch")
+            if major is None or minor is None or patch is None:
+                logger.debug("Unexpected Immich version schema: %s", data)
+                return None
+            return (int(major), int(minor), int(patch))
+        return None
+    except Exception:
+        return None
+
+
 def get_people() -> list[dict]:
     """Fetch all people from Immich."""
     try:
@@ -35,23 +57,62 @@ def get_people() -> list[dict]:
             headers=get_headers(),
             timeout=10,
         )
+        if resp.status_code == 401:
+            logger.error("Immich API key is invalid or expired (401 Unauthorized). Update API_KEY.")
+            return []
         resp.raise_for_status()
-        return resp.json().get("people", [])
-    except (requests.RequestException, ValueError) as e:
-        logger.error(f"Failed to fetch people: {e}")
+        data = resp.json()
+        if not isinstance(data, dict):
+            logger.error("Unexpected response shape from Immich /people: %r", type(data))
+            return []
+        return data.get("people") or []
+    except (requests.RequestException, ValueError, AttributeError) as e:
+        logger.error("Failed to fetch people from Immich: %s", e)
         return []
 
 
-def fetch_all_assets(person: dict) -> list[dict]:
-    """Fetch all assets for a person with pagination."""
+def merge_people(survivor_id: str, merge_ids: list[str]) -> bool:
+    """Merge duplicate people into survivor via Immich's merge endpoint.
+
+    The survivor (identified by survivor_id) absorbs all faces and assets
+    from the people in merge_ids, which are then removed from Immich.
+    """
+    try:
+        resp = requests.put(
+            f"{Config.IMMICH_URL}/api/people/{survivor_id}/merge",
+            headers={**get_headers(), "Content-Type": "application/json"},
+            json={"ids": merge_ids},
+            timeout=30,
+        )
+        resp.raise_for_status()
+        return True
+    except requests.RequestException as e:
+        logger.error("Failed to merge people into %s: %s", survivor_id, e)
+        return False
+
+
+def fetch_all_assets(person: dict) -> tuple[list[dict], int]:
+    """Fetch all assets for a person with pagination.
+
+    Returns (assets, total_raw) where assets is the list of valid dict items
+    and total_raw is the raw item count across pages that had at least one valid
+    dict. All-garbage pages (every item non-dict) stop pagination and are not
+    counted. total_raw is a lower bound in two cases: a network error interrupts
+    pagination (a warning is logged), or an all-garbage page terminates it early
+    (a warning is logged and later pages are not fetched).
+    """
     name = person.get("name", "Unknown")
-    person_id = person["id"]
+    person_id = person.get("id")
+    if not person_id:
+        logger.error("Person dict missing 'id' field for %s — skipping asset fetch", name)
+        return [], 0
     url = f"{Config.IMMICH_URL}/api/search/metadata"
     page_size = 1000
 
-    logger.info(f"Fetching assets for {name}...")
+    logger.debug("Fetching assets for %s...", name)
 
-    assets = []
+    assets: list[dict] = []
+    total_raw = 0  # raw item count across pages that yielded at least one valid dict
     for page in range(1, MAX_PAGES + 1):
         try:
             resp = requests.post(
@@ -62,31 +123,64 @@ def fetch_all_assets(person: dict) -> list[dict]:
             )
 
             if not resp.ok:
-                logger.error(f"Error fetching assets for {name} (page {page}): {resp.status_code}")
+                logger.error("Error fetching assets for %s (page %s): %s", name, page, resp.status_code)
                 break
 
-            page_assets = resp.json().get("assets", [])
+            body = resp.json()
+            if not isinstance(body, dict):
+                logger.error("Unexpected response shape fetching assets for %s (page %s): %r", name, page, type(body))
+                break
+            page_assets = body.get("assets", [])
+            # Immich ≥2.x returns {"assets": {"items": [...]}};
+            # earlier versions returned {"assets": [...]} directly.
             if isinstance(page_assets, dict):
-                page_assets = page_assets.get("items", [])
+                page_assets = page_assets.get("items") or []
 
-            if not page_assets:
+            page_count = len(page_assets)  # raw count for termination check before filtering
+
+            # Single pass: partition valid assets from unexpected non-dict items
+            valid_assets, skipped_count = [], 0
+            for item in page_assets:
+                if isinstance(item, dict):
+                    valid_assets.append(item)
+                else:
+                    skipped_count += 1
+            if skipped_count:
+                logger.warning("%s: skipping %s non-dict item(s) in page %s", name, skipped_count, page)
+
+            if not valid_assets:
+                if page_count > 0:
+                    logger.warning(
+                        "%s: page %s returned %s item(s) but none were valid dicts — stopping pagination",
+                        name, page, page_count,
+                    )
                 break
 
-            assets.extend(page_assets)
-            logger.debug(f"Fetched page {page}, total: {len(assets)}")
+            # Count page_count (not just valid items) so that non-dict items from a
+            # transient schema issue on a mixed page don't cause MIN_FACE_COUNT to
+            # skip a real person. Pages where every item is a non-dict are excluded —
+            # they indicate a structural problem and break above without contributing.
+            total_raw += page_count
+            assets.extend(valid_assets)
+            logger.debug("Fetched page %s, total: %s", page, len(assets))
 
-            if len(page_assets) < page_size:
+            if page_count < page_size or len(assets) >= _MAX_ASSETS_PER_PERSON:
                 break
 
         except (requests.RequestException, ValueError) as e:
-            logger.error(f"Exception fetching assets for {name}: {e}")
+            logger.error("Exception fetching assets for %s (page %s): %s", name, page, e)
+            if page > 1:
+                logger.warning(
+                    "%s: pagination interrupted at page %s — total_raw=%s may undercount actual assets",
+                    name, page, total_raw,
+                )
             break
 
-    return assets
+    return assets, total_raw
 
 
 def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | None:
-    """Fetch pre-computed face data (embedding, bbox, confidence) from Immich.
+    """Fetch pre-computed face data (bbox, confidence) from Immich.
 
     Queries GET /api/faces?id={asset_id} to retrieve face detection results
     that Immich already computed using InsightFace Buffalo_L.
@@ -96,7 +190,7 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
         person_id: Optional person ID to match the specific face
 
     Returns:
-        FaceData with embedding, bbox, and confidence, or None if unavailable
+        FaceData with bbox and confidence, or None if unavailable
     """
     try:
         resp = requests.get(
@@ -107,29 +201,25 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
         )
 
         if not resp.ok:
-            logger.debug(f"Face data endpoint returned {resp.status_code} for {asset_id}")
+            logger.debug("Face data endpoint returned %s for %s", resp.status_code, asset_id)
             return None
 
         faces = resp.json()
-        if not faces:
+        if not isinstance(faces, list) or not faces:
             return None
 
-        # Match the target person if specified
+        # Match the target person if specified; never fall back to a different person's face.
         face = None
         if person_id:
             face = next(
-                (f for f in faces if (f.get("person") or {}).get("id") == person_id),
+                (f for f in faces if isinstance(f, dict) and (f.get("person") or {}).get("id") == person_id),
                 None,
             )
+        else:
+            face = faces[0] if isinstance(faces[0], dict) else None
         if face is None:
-            face = faces[0]  # Fall back to first/largest face
+            return None
 
-        # Extract embedding if available
-        embedding = None
-        if "embedding" in face:
-            embedding = np.array(face["embedding"], dtype=np.float32)
-
-        # Extract bounding box
         bbox = (
             face.get("boundingBoxX1", 0),
             face.get("boundingBoxY1", 0),
@@ -137,19 +227,19 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
             face.get("boundingBoxY2", 0),
         )
 
+        score = face.get("score")
         return FaceData(
-            embedding=embedding,
             bbox=bbox,
-            confidence=face.get("score") or face.get("confidence"),
+            confidence=score if score is not None else face.get("confidence"),
             image_width=face.get("imageWidth", 0),
             image_height=face.get("imageHeight", 0),
         )
 
     except requests.RequestException as e:
-        logger.debug(f"Failed to fetch face data for {asset_id}: {e}")
+        logger.debug("Failed to fetch face data for %s: %s", asset_id, e)
         return None
     except (AttributeError, KeyError, TypeError, ValueError) as e:
-        logger.debug(f"Failed to parse face data for {asset_id}: {e}")
+        logger.debug("Failed to parse face data for %s: %s", asset_id, e)
         return None
 
 
@@ -170,9 +260,9 @@ def fetch_full_image(asset_id: str, timeout: int = 60) -> Image.Image | None:
             try:
                 return ImageOps.exif_transpose(Image.open(BytesIO(resp.content)))
             except Exception:
-                logger.debug(f"PIL can't open original for {asset_id}, falling back to preview")
+                logger.debug("PIL can't open original for %s, falling back to preview", asset_id)
     except requests.RequestException:
-        logger.debug(f"Original request failed for {asset_id}, falling back to preview")
+        logger.debug("Original request failed for %s, falling back to preview", asset_id)
 
     # Fall back to preview thumbnail (always JPEG)
     try:
@@ -184,22 +274,26 @@ def fetch_full_image(asset_id: str, timeout: int = 60) -> Image.Image | None:
         if resp.ok:
             return ImageOps.exif_transpose(Image.open(BytesIO(resp.content)))
     except Exception as e:
-        logger.error(f"Failed to fetch image {asset_id}: {e}")
+        logger.error("Failed to fetch image %s: %s", asset_id, e)
 
     return None
 
 
 def filter_recent_assets(assets: list[dict], years: int | None = None) -> list[dict]:
-    """Filter assets to keep only those from the last N years."""
-    years = years or Config.YEARS_FILTER
+    """Filter assets to keep only those from the last N years. Pass years=0 to include all."""
+    if years is None:
+        years = Config.YEARS_FILTER
+    if not years:
+        return list(assets)
     cutoff = datetime.now(timezone.utc) - timedelta(days=365 * years)
 
-    logger.debug(f"Filtering assets older than {years} years ({cutoff})")
+    logger.debug("Filtering assets older than %s years (%s)", years, cutoff)
 
-    recent, skipped = [], 0
+    recent, skipped, bad_timestamp = [], 0, 0
     for asset in assets:
         created_at_str = asset.get("fileCreatedAt")
-        if not created_at_str:
+        if not isinstance(created_at_str, str) or not created_at_str:
+            bad_timestamp += 1
             continue
 
         try:
@@ -209,9 +303,15 @@ def filter_recent_assets(assets: list[dict], years: int | None = None) -> list[d
                 recent.append(asset)
             else:
                 skipped += 1
-        except ValueError:
+        except (ValueError, TypeError):
+            bad_timestamp += 1
             continue
 
-    logger.info(f"Retained {len(recent)} assets (filtered {skipped} old assets).")
+    if bad_timestamp:
+        logger.warning(
+            "filter_recent_assets: %s asset(s) had missing or unparseable fileCreatedAt"
+            " and were excluded from the pool.", bad_timestamp
+        )
+    logger.debug("Retained %s assets (filtered %s old assets).", len(recent), skipped)
     return recent
 

winnow/jobs.py

@@ -8,29 +8,28 @@ from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn
 from rich.prompt import Confirm, IntPrompt, Prompt
 from rich.table import Table
 
-from .config import Config
+from .config import Config, _getenv_bool, _getenv_int, _getenv_optional_int
 from .diversity import select_diverse_assets
 from .embeddings import is_embedding_available, load_embedding_model
+from .frigate_api import get_frigate_face_counts
 from .immich_api import fetch_all_assets, filter_recent_assets
-from .logging import console
-from .upload_tracker import filter_already_uploaded
+from .log_config import console
+from .upload_tracker import filter_already_uploaded, get_person_summary, update_frigate_count
 
 logger = logging.getLogger(__name__)
 
 # Strategy presets: (limit, mode_name)
 STRATEGY_PRESETS = {
-    "1": ("auto", "Auto Diversity"),
+    "1": ("auto", "Adaptive Diversity"),
     "2": (30, "Standard (30)"),
     "3": (100, "Broad (100)"),
 }
 
 
-def _get_strategy_choice(has_embedding: bool, entity_type: str) -> tuple[int | str, str]:
+def _get_strategy_choice(has_embedding: bool) -> tuple[int | str, str]:
     """Prompt user for training strategy and return (limit, selection_mode)."""
-    model_name = "InsightFace" if entity_type == "face" else "SigLIP"
-
     if has_embedding:
-        rprint("  [bold]1.[/bold] Auto (Objective Diversity) [green][Recommended][/green]")
+        rprint("  [bold]1.[/bold] Adaptive Diversity [green][Recommended][/green]")
         rprint("     [dim]• Dynamically selects images until redundancy starts[/dim]")
         rprint("  [bold]2.[/bold] Standard (30 images)")
         rprint("  [bold]3.[/bold] Broad (100 images)")
@@ -50,44 +49,58 @@ def _get_strategy_choice(has_embedding: bool, entity_type: str) -> tuple[int | s
         return 30, "smart"
 
     # Fallback when embedding model not available
-    rprint(f"  [yellow]Note: {model_name} not available. Using Time Spread.[/yellow]")
+    rprint("  [yellow]Note: InsightFace not available. Using Time Spread.[/yellow]")
     rprint("  [bold]1.[/bold] Standard (30 images) [green][Recommended][/green]")
     rprint("  [bold]2.[/bold] Broad (100 images)")
     rprint("  [bold]3.[/bold] Custom Count")
     rprint("  [bold]4.[/bold] Skip")
 
     choice = Prompt.ask("Choice", choices=["1", "2", "3", "4"], default="1")
-    limits = {"1": 30, "2": 100, "3": IntPrompt.ask("Enter number of images", default=30)}
-    return limits.get(choice, 0), "time" if choice != "4" else "skip"
+    if choice == "4":
+        return 0, "skip"
+    if choice == "3":
+        return IntPrompt.ask("Enter number of images", default=30), "time"
+    return {"1": 30, "2": 100}.get(choice, 30), "time"
 
 
 def _resolve_strategy(strategy: str, has_embedding: bool) -> tuple[int | str, str]:
     """Resolve env var strategy to (limit, selection_mode) without prompts."""
-    custom_limit = os.environ.get("LIMIT", "").strip()
-
+    if strategy == "skip":
+        return 0, "skip"
     if not has_embedding:
-        limit = int(custom_limit) if custom_limit else 30
+        limit = _getenv_int("LIMIT", 30)
+        if limit <= 0:
+            logger.warning("LIMIT=%s is invalid — ignoring and using default 30", limit)
+            limit = 30
         return limit, "time"
 
-    if custom_limit:
-        return int(custom_limit), "smart"
+    custom_limit = _getenv_optional_int("LIMIT")
+    if custom_limit is not None:
+        if custom_limit > 0:
+            return custom_limit, "smart"
+        logger.warning("LIMIT=%s is invalid — ignoring and using auto strategy", custom_limit)
 
     strategy_map = {
-        "auto": ("auto", "smart"),
+        "adaptive": ("auto", "smart"),
+        "auto": ("auto", "smart"),  # legacy alias for adaptive
         "standard": (30, "smart"),
         "broad": (100, "smart"),
     }
-    return strategy_map.get(strategy, ("auto", "smart"))
+    result = strategy_map.get(strategy)
+    if result is None:
+        logger.warning("Unrecognised STRATEGY=%r — falling back to auto", strategy)
+        return ("auto", "smart")
+    return result
 
 
-def _perform_selection(assets: list, limit: int | str, name: str, selection_mode: str, entity_type: str) -> list:
+def _perform_selection(
+    assets: list, limit: int | str, name: str, selection_mode: str, person_id: str | None = None
+) -> list:
     """Run diversity selection with progress display."""
     if selection_mode == "smart":
-        model_display = "InsightFace (face embeddings)" if entity_type == "face" else "SigLIP (visual embeddings)"
-        rprint(f"\n[cyan]Using {model_display} for diversity analysis...[/cyan]")
+        rprint("\n[cyan]Using InsightFace (face embeddings) for diversity analysis...[/cyan]")
 
-        # Pre-load model explicitly (separate from availability check)
-        load_embedding_model(entity_type)
+        load_embedding_model()
 
         with Progress(
             SpinnerColumn(),
@@ -102,7 +115,7 @@ def _perform_selection(assets: list, limit: int | str, name: str, selection_mode
                 limit,
                 name,
                 selection_mode=selection_mode,
-                entity_type=entity_type,
+                person_id=person_id,
                 progress_callback=lambda c, t: progress.update(task, completed=c, total=t),
             )
 
@@ -112,40 +125,51 @@ def _perform_selection(assets: list, limit: int | str, name: str, selection_mode
 
     rprint(f"\n[cyan]Using time-spread selection for {limit} images...[/cyan]")
     with console.status(f"[bold]Selecting {limit} images evenly distributed over time...[/bold]"):
-        selected = select_diverse_assets(assets, limit, name, selection_mode="time", entity_type=entity_type)
+        selected = select_diverse_assets(assets, limit, name, selection_mode="time", person_id=person_id)
     rprint(f"  [green]Selected {len(selected)} images using time spread.[/green]")
     return selected
 
 
+def _build_job(
+    person: dict,
+    assets: list,
+    limit: int | str,
+    selection_mode: str,
+    quality_replacement: bool = False,
+) -> dict | None:
+    """Select from pre-filtered assets and build a job dict. No terminal I/O."""
+    if not assets:
+        return None
+    name = person["name"]
+    selected = _perform_selection(assets, limit, name, selection_mode, person_id=person["id"])
+    if not selected:
+        return None
+    return {
+        "person": person,
+        "assets": selected,
+        "limit": len(selected),
+        "config": {"name": name, "quality_replacement": quality_replacement},
+    }
+
+
 def _configure_person(person: dict, people: list[dict]) -> dict | None:
     """Configure training for a single person. Returns job dict or None."""
     name = person["name"]
     console.print(f"\nSelected: [bold green]{name}[/bold green]")
 
-    # Select training mode
-    rprint("\n[bold cyan]Training Mode:[/bold cyan]")
-    rprint("  [bold]1.[/bold] Face (Frigate Face Recognition)")
-    rprint("  [bold]2.[/bold] Object (Frigate Object Classification)")
-
-    mode_choice = Prompt.ask("Choice", choices=["1", "2"], default="1")
-    entity_type = "face" if mode_choice == "1" else "object"
-
-    config = {"name": name, "mode": entity_type}
-    if entity_type == "object":
-        config["object_class"] = Prompt.ask("Enter Object Class (e.g. dog, cat, car)", default="dog")
-
-    # Fetch and filter assets
     years = IntPrompt.ask("Filter images older than (years)", default=Config.YEARS_FILTER)
 
-    console.print(f"Scanning for {name} ({entity_type})...")
+    console.print(f"Scanning for {name}...")
     with console.status("[bold green]Fetching assets...[/bold green]"):
-        all_assets = fetch_all_assets(person)
+        all_assets, total_raw = fetch_all_assets(person)
         recent_assets = filter_recent_assets(all_assets, years=years)
 
-    rprint(f"  Found [bold]{len(all_assets)}[/bold] total, [bold]{len(recent_assets)}[/bold] in range ({years} years).")
+    rprint(f"  Found [bold]{total_raw}[/bold] total, [bold]{len(recent_assets)}[/bold] in range ({years} years).")
+
+    # Ask before strategy so the post-dedup count can inform the choice
+    retry_env = _getenv_bool("RETRY_REJECTED", False)
+    retry_rejected = Confirm.ask("Include previously rejected images?", default=retry_env)
 
-    # Filter out assets already uploaded to Frigate
-    retry_rejected = os.environ.get("RETRY_REJECTED", "false").lower() in ("true", "1", "yes")
     before_dedup = len(recent_assets)
     new_asset_ids = set(filter_already_uploaded([a["id"] for a in recent_assets], retry_rejected=retry_rejected))
     recent_assets = [a for a in recent_assets if a["id"] in new_asset_ids]
@@ -157,19 +181,26 @@ def _configure_person(person: dict, people: list[dict]) -> dict | None:
         rprint("  [dim]Skipping (0 new images after dedup).[/dim]")
         return None
 
-    # Strategy selection
-    has_embedding = is_embedding_available(entity_type)
+    has_embedding = is_embedding_available()
     rprint(f"\n[bold cyan]Select Training Strategy for {name}:[/bold cyan]")
-
-    limit, selection_mode = _get_strategy_choice(has_embedding, entity_type)
+    limit, selection_mode = _get_strategy_choice(has_embedding)
     if selection_mode == "skip":
         return None
 
-    # Perform selection
-    selected_assets = _perform_selection(recent_assets, limit, name, selection_mode, entity_type)
+    job = _build_job(person, recent_assets, limit, selection_mode, quality_replacement=Config.QUALITY_REPLACEMENT)
+    if job is None:
+        rprint("  [dim]Skipping (0 images selected).[/dim]")
+        return None
 
-    rprint(f"  [green]Queued {len(selected_assets)} images for {name}.[/green]")
-    return {"person": person, "assets": selected_assets, "limit": len(selected_assets), "config": config}
+    rprint(f"  [green]Queued {job['limit']} images for {name}.[/green]")
+    return job
+
+
+def _valid_people(people: list[dict]) -> list[dict]:
+    return sorted(
+        [p for p in people if (p.get("name") or "").strip() and p.get("id")],
+        key=lambda x: x["name"],
+    )
 
 
 def interactive_configure(people: list[dict]) -> list[dict]:
@@ -178,7 +209,7 @@ def interactive_configure(people: list[dict]) -> list[dict]:
     Supports multi-person batch mode — after configuring one person,
     prompts to add another.
     """
-    valid_people = sorted([p for p in people if p.get("name")], key=lambda x: x["name"])
+    valid_people = _valid_people(people)
 
     if not valid_people:
         rprint("[red]No people found with names in Immich.[/red]")
@@ -189,9 +220,9 @@ def interactive_configure(people: list[dict]) -> list[dict]:
     while True:
         # Select person
         console.print("\n[bold cyan]Select Person to Train:[/bold cyan]")
+        queued_ids = {j["person"]["id"] for j in jobs}
         for idx, p in enumerate(valid_people, 1):
-            # Mark already-queued people
-            marker = " [dim](queued)[/dim]" if any(j["person"]["id"] == p["id"] for j in jobs) else ""
+            marker = " [dim](queued)[/dim]" if p.get("id") in queued_ids else ""
             console.print(f"  [bold]{idx}.[/bold] {p['name']}{marker}")
 
         p_choice = IntPrompt.ask("Enter Number", choices=[str(i) for i in range(1, len(valid_people) + 1)])
@@ -210,48 +241,90 @@ def interactive_configure(people: list[dict]) -> list[dict]:
 
 def auto_configure(people: list[dict]) -> list[dict]:
     """Non-interactive: configure jobs for all named people automatically."""
-    valid_people = sorted([p for p in people if p.get("name")], key=lambda x: x["name"])
+    valid_people = _valid_people(people)
 
     if not valid_people:
         rprint("[red]No people found with names in Immich.[/red]")
         return []
 
-    mode = os.environ.get("TRAINING_MODE", "face")
     strategy = os.environ.get("STRATEGY", "auto")
-    skip = os.environ.get("SKIP_PEOPLE", "").split(",") if os.environ.get("SKIP_PEOPLE") else []
-    only = os.environ.get("ONLY_PEOPLE", "").split(",") if os.environ.get("ONLY_PEOPLE") else []
+    skip = {s.strip().casefold() for s in os.environ.get("SKIP_PEOPLE", "").split(",") if s.strip()}
+    only = {s.strip().casefold() for s in os.environ.get("ONLY_PEOPLE", "").split(",") if s.strip()}
 
     if only:
-        valid_people = [p for p in valid_people if p["name"] in only]
+        valid_people = [p for p in valid_people if p["name"].casefold() in only]
     if skip:
-        valid_people = [p for p in valid_people if p["name"] not in skip]
+        valid_people = [p for p in valid_people if p["name"].casefold() not in skip]
 
-    # Filter by minimum face count (Issue #6: previously unimplemented)
     min_face_count = Config.MIN_FACE_COUNT
-    if min_face_count > 0:
-        valid_people = [p for p in valid_people if p.get("assetCount", 0) >= min_face_count]
-        if valid_people:
-            rprint(
-                f"  Filtered to {len(valid_people)} people with"
-                f" ≥{min_face_count} assets (MIN_FACE_COUNT={min_face_count})"
-            )
 
+    frigate_counts = get_frigate_face_counts()
+    # Persist each count to tracker so the last known value survives Frigate downtime
+    if frigate_counts is not None:
+        for pname, count in frigate_counts.items():
+            update_frigate_count(pname, count)
+    upload_summary = get_person_summary()
     jobs = []
     for person in valid_people:
         name = person["name"]
-        entity_type = mode
 
-        config = {"name": name, "mode": entity_type}
-        if entity_type == "object":
-            config["object_class"] = os.environ.get("OBJECT_CLASS", "dog")
-
-        all_assets = fetch_all_assets(person)
+        all_assets, total_raw = fetch_all_assets(person)
         recent_assets = filter_recent_assets(all_assets, years=Config.YEARS_FILTER)
 
-        rprint(f"  {name}: {len(all_assets)} total, {len(recent_assets)} recent")
+        rprint(f"  {name}: {total_raw} total, {len(recent_assets)} recent")
 
-        # Filter out assets already uploaded to Frigate
-        retry_rejected = os.environ.get("RETRY_REJECTED", "false").lower() in ("true", "1", "yes")
+        # MIN_FACE_COUNT guard: skip people with too few Immich assets.
+        # Uses total_raw so that non-dict items from a transient Immich schema
+        # issue on a mixed page don't shrink the count below the threshold.
+        # Done here (after fetch) rather than upfront because Immich v2.7.5+
+        # dropped assetCount from the /api/people response.
+        if min_face_count > 0 and total_raw < min_face_count:
+            rprint(f"  [dim]Skipping {name} ({total_raw} assets < MIN_FACE_COUNT={min_face_count}).[/dim]")
+            continue
+
+        # Enforce MAX_AUTO_IMAGES against the tracked file count only.
+        # Manually-added Frigate files are invisible to this cap so users can
+        # curate their own files without shrinking winnow's managed quota.
+        person_summary = upload_summary.get(name, {})
+        already_uploaded = len(person_summary.get("frigate_files", {}))
+        capacity = Config.MAX_AUTO_IMAGES - already_uploaded
+        if capacity <= 0:
+            if not Config.QUALITY_REPLACEMENT:
+                rprint(
+                    f"  [dim]Skipping {name} (at cap:"
+                    f" {already_uploaded}/{Config.MAX_AUTO_IMAGES}, quality replacement disabled).[/dim]"
+                )
+                continue
+            rprint(
+                f"  [cyan]{name}: at cap ({already_uploaded}/{Config.MAX_AUTO_IMAGES}),"
+                f" checking for quality improvements...[/cyan]"
+            )
+            quality_replacement_only = True
+        else:
+            quality_replacement_only = False
+
+        quality_replacement = quality_replacement_only or Config.QUALITY_REPLACEMENT
+
+        has_embedding = is_embedding_available()
+        limit, selection_mode = _resolve_strategy(strategy, has_embedding)
+
+        # Cap selection to remaining capacity (no cap when replacement-only — executor
+        # decides per-image whether to swap; any candidate could be an improvement).
+        if not quality_replacement_only:
+            if limit == "auto":
+                if already_uploaded > 0:
+                    # Switch from open-ended auto to a fixed budget at remaining capacity
+                    # so the diversity selector stops at the right count instead of
+                    # selecting more than MAX_AUTO_IMAGES and overflowing the cap.
+                    # First runs keep limit="auto" so FPS adaptive early-stop can fire.
+                    limit = capacity
+            else:
+                limit = min(limit, capacity)
+
+        if selection_mode == "skip":
+            continue
+
+        retry_rejected = _getenv_bool("RETRY_REJECTED", False)
         before_dedup = len(recent_assets)
         new_asset_ids = set(filter_already_uploaded([a["id"] for a in recent_assets], retry_rejected=retry_rejected))
         recent_assets = [a for a in recent_assets if a["id"] in new_asset_ids]
@@ -263,17 +336,13 @@ def auto_configure(people: list[dict]) -> list[dict]:
             rprint(f"  [dim]Skipping {name} (0 new images after dedup).[/dim]")
             continue
 
-        has_embedding = is_embedding_available(entity_type)
-        limit, selection_mode = _resolve_strategy(strategy, has_embedding)
-
-        if selection_mode == "skip":
+        job = _build_job(person, recent_assets, limit, selection_mode, quality_replacement=quality_replacement)
+        if job is None:
+            rprint(f"  [dim]Skipping {name} (0 images selected).[/dim]")
             continue
 
-        selected_assets = _perform_selection(recent_assets, limit, name, selection_mode, entity_type)
-
-        if selected_assets:
-            rprint(f"  [green]Queued {len(selected_assets)} images for {name}.[/green]")
-            jobs.append({"person": person, "assets": selected_assets, "limit": len(selected_assets), "config": config})
+        rprint(f"  [green]Queued {job['limit']} images for {name}.[/green]")
+        jobs.append(job)
 
     return jobs
 
@@ -282,20 +351,17 @@ def _show_preview(jobs: list[dict]) -> None:
     """Show a summary table of all queued jobs before execution."""
     table = Table(title="📋 Training Job Preview", show_header=True, header_style="bold cyan")
     table.add_column("Person", style="bold")
-    table.add_column("Mode", style="dim")
     table.add_column("Images", justify="right")
     table.add_column("Date Range", style="dim")
 
     for job in jobs:
         name = job["person"]["name"]
-        mode = job["config"].get("mode", "face")
         count = str(job["limit"])
 
-        # Date range
         dates = sorted(a.get("fileCreatedAt", "")[:10] for a in job["assets"] if a.get("fileCreatedAt"))
         date_range = f"{dates[0]} → {dates[-1]}" if len(dates) >= 2 else (dates[0] if dates else "—")
 
-        table.add_row(name, mode, count, date_range)
+        table.add_row(name, count, date_range)
 
     console.print()
     console.print(table)

winnow/log_config.py

@@ -13,12 +13,9 @@ console = Console()
 NOISY_LOGGERS = (
     "urllib3",
     "PIL",
-    "ultralytics",
     "insightface",
     "onnxruntime",
     "matplotlib",
-    "transformers",
-    "torch",
 )
 
 
@@ -26,10 +23,12 @@ def setup_logging(verbose: bool = False) -> logging.Logger:
     """Configure logging with Rich console and file output."""
     level = logging.DEBUG if verbose else logging.INFO
 
-    # Configure root logger
+    # Configure root logger; close existing handlers before replacing them
     root = logging.getLogger()
     root.setLevel(level)
-    root.handlers.clear()
+    for h in root.handlers[:]:
+        h.close()
+        root.removeHandler(h)
 
     # Rich console handler - uses shared console to avoid breaking progress bars
     root.addHandler(RichHandler(rich_tracebacks=True, markup=True, console=console))
@@ -37,7 +36,7 @@ def setup_logging(verbose: bool = False) -> logging.Logger:
     # File handler (always debug level) — log file respects OUTPUT_DIR if set
     log_dir = os.environ.get("OUTPUT_DIR", ".")
     os.makedirs(log_dir, exist_ok=True)
-    log_path = os.path.join(log_dir, "immich_export.log")
+    log_path = os.path.join(log_dir, "winnow.log")
     file_handler = logging.FileHandler(log_path)
     file_handler.setLevel(logging.DEBUG)
     file_handler.setFormatter(logging.Formatter("%(asctime)s - %(name)s - %(levelname)s - %(message)s"))
@@ -49,7 +48,6 @@ def setup_logging(verbose: bool = False) -> logging.Logger:
 
     # Suppress Python warnings from ML libraries
     warnings.filterwarnings("ignore", category=UserWarning, module="onnxruntime")
-    warnings.filterwarnings("ignore", category=FutureWarning, module="transformers")
 
     return root
 

winnow/quality.py

@@ -14,12 +14,18 @@ from PIL import Image
 logger = logging.getLogger(__name__)
 
 
+def _laplacian_var(img_np: np.ndarray) -> float:
+    gray = cv2.cvtColor(img_np, cv2.COLOR_RGB2GRAY) if img_np.ndim == 3 else img_np
+    return float(cv2.Laplacian(gray, cv2.CV_64F).var())
+
+
 @dataclass
 class QualityResult:
     """Result of quality assessment on a face/image crop."""
 
     passed: bool
     reasons: list[str] = field(default_factory=list)
+    blur_score: float | None = None
 
     @property
     def reason(self) -> str:
@@ -31,8 +37,7 @@ def check_blur(img_np: np.ndarray, threshold: float = 100.0) -> tuple[bool, str]
 
     Lower variance = blurrier image. ArcFace needs clear facial features.
     """
-    gray = cv2.cvtColor(img_np, cv2.COLOR_RGB2GRAY) if img_np.ndim == 3 else img_np
-    variance = cv2.Laplacian(gray, cv2.CV_64F).var()
+    variance = _laplacian_var(img_np)
     if variance < threshold:
         return False, f"Blurry (laplacian={variance:.1f}, threshold={threshold})"
     return True, ""
@@ -113,9 +118,14 @@ def assess_quality(
     img_np = np.asarray(img)
     reasons = []
 
-    # Run all checks, collect failures
+    # Compute laplacian variance once (used by check_blur and stored as blur_score)
+    blur_score = _laplacian_var(img_np)
+
     checks = [
-        check_blur(img_np, blur_threshold),
+        (
+            blur_score >= blur_threshold,
+            f"Blurry (laplacian={blur_score:.1f}, threshold={blur_threshold})" if blur_score < blur_threshold else "",
+        ),
         check_grayscale(img_np),
         check_exposure(img_np),
         check_confidence(confidence, min_confidence),
@@ -129,5 +139,27 @@ def assess_quality(
         if not passed:
             reasons.append(reason)
 
-    return QualityResult(passed=len(reasons) == 0, reasons=reasons)
+    return QualityResult(passed=len(reasons) == 0, reasons=reasons, blur_score=blur_score)
+
+
+def blur_score_from_image(img: Image.Image, max_dim: int = 1440) -> float | None:
+    """Compute Laplacian-variance blur score, capped at max_dim px to normalise scale.
+
+    Caps resolution so full-res and thumbnail scores are comparable — Laplacian
+    variance grows with pixel count, making uncapped full-res scores much larger
+    than thumbnail scores for the same perceived sharpness.
+
+    Returns None on error so callers can distinguish a failed measurement from a
+    legitimately low (near-zero) score.
+    """
+    try:
+        score_img = img.convert("RGB") if img.mode != "RGB" else img
+        if score_img.width > max_dim or score_img.height > max_dim:
+            if score_img is img:
+                score_img = score_img.copy()
+            score_img.thumbnail((max_dim, max_dim), Image.LANCZOS)
+        return _laplacian_var(np.array(score_img))
+    except Exception as exc:
+        logger.debug("blur_score_from_image failed: %s", exc)
+        return None
 

winnow/reconcile.py

@@ -0,0 +1,137 @@
+"""Frigate upload post-processing: reconciliation and asset enrichment."""
+
+import logging
+import time
+
+from .frigate_api import get_frigate_person_files
+from .immich_api import fetch_face_data
+from .upload_tracker import record_frigate_files_batch
+
+logger = logging.getLogger(__name__)
+
+# Exponential back-off delays (seconds) when polling Frigate after uploads.
+# Frigate processes the upload queue asynchronously, so files aren't
+# immediately visible in GET /api/faces — we wait progressively longer
+# rather than hammering the API.
+_RECONCILE_POLL_DELAYS = (1, 2, 4, 8)
+
+
+def reconcile_frigate_mappings(
+    person_name: str,
+    known_files_before: set[str],
+    uploaded: list[tuple[str, str | None]],
+) -> None:
+    """Map Frigate filenames to asset IDs after a batch of uploads.
+
+    Polls until all expected new files appear in the Frigate API, then maps
+    them to asset IDs by filename timestamp order (Frigate processes the
+    upload queue in FIFO order, so earlier uploads get earlier timestamps).
+
+    KNOWN LIMITATION — race condition with external uploads:
+    If another client uploads a face file for this person concurrently, the
+    count of new files will exceed `len(uploaded)` and we bail out entirely
+    (the "> target" branch). That's safe — we never record a wrong mapping —
+    but those uploads become permanently unmapped (they won't be eligible for
+    quality replacement). The right fix is a Frigate API that returns the
+    filename in the upload response, removing the need for any post-upload
+    diffing. Until then, the external-upload guard keeps mappings correct at
+    the cost of occasionally missing them when another client is active.
+    """
+    target = len(uploaded)
+    new_files: set[str] = set()
+
+    # Check before the first sleep so a fast Frigate response returns immediately.
+    for delay in (None, *_RECONCILE_POLL_DELAYS):
+        if delay is not None:
+            time.sleep(delay)
+        fresh = get_frigate_person_files(person_name)
+        if fresh is None:
+            logger.warning(
+                "%s: Frigate API unreachable during mapping reconciliation"
+                " — quality replacement won't target these files",
+                person_name,
+            )
+            return
+        new_files = set(fresh) - known_files_before
+        if len(new_files) >= target:
+            break
+
+    if len(new_files) == target:
+        def _ts(fname: str) -> float:
+            try:
+                return float(fname.rsplit("_", 1)[-1].rsplit(".", 1)[0])
+            except (ValueError, IndexError):
+                return float("inf")
+
+        logger.debug(
+            "%s: mapping %s file(s) by filename timestamp — assumes Frigate processes"
+            " uploads in FIFO order; mapping may be wrong if that ever changes",
+            person_name,
+            target,
+        )
+        mappings = {
+            frigate_file: asset_id
+            for (_, asset_id), frigate_file in zip(uploaded, sorted(new_files, key=lambda f: (_ts(f), f)))
+            if asset_id
+        }
+        record_frigate_files_batch(person_name, mappings)
+    elif len(new_files) > target:
+        logger.warning(
+            "%s: %s new Frigate files for %s uploads"
+            " (external upload detected) — skipping file mapping;"
+            " these files are permanently unmapped",
+            person_name,
+            len(new_files),
+            target,
+        )
+    else:
+        logger.warning(
+            "%s: only %s of %s expected Frigate files"
+            " appeared after reconciliation — mapping skipped;"
+            " these files are permanently unmapped",
+            person_name,
+            len(new_files),
+            target,
+        )
+
+
+def enrich_asset_with_face_data(asset: dict, person: dict) -> dict:
+    """Enrich an asset dict with face bounding box data from the Immich faces API.
+
+    The search/metadata endpoint does not include face bounding box data,
+    so we fetch it from GET /api/faces?id={asset_id} and inject it into
+    the asset's "people" field so process_face_mode can find it.
+
+    Returns the enriched asset dict (modifies in place and returns it).
+    """
+    person_id = person["id"]
+    face_data = fetch_face_data(asset["id"], person_id=person_id)
+
+    if face_data is None:
+        logger.debug("No face data returned for %s in asset %s", person.get("name"), asset.get("id"))
+        # Clean any None entries from the people list (can come from Immich API)
+        if "people" in asset:
+            asset["people"] = [p for p in asset["people"] if p is not None]
+        return asset
+
+    # Skip zero-area bounding boxes (face detection failed or no face found)
+    if face_data.bbox == (0, 0, 0, 0):
+        logger.debug("Zero-area bounding box for %s in asset %s", person.get("name"), asset.get("id"))
+        # Clean any None entries from the people list (can come from Immich API)
+        if "people" in asset:
+            asset["people"] = [p for p in asset["people"] if p is not None]
+        return asset
+
+    face_info = {
+        "boundingBoxX1": face_data.bbox[0],
+        "boundingBoxY1": face_data.bbox[1],
+        "boundingBoxX2": face_data.bbox[2],
+        "boundingBoxY2": face_data.bbox[3],
+        "imageWidth": face_data.image_width,
+        "imageHeight": face_data.image_height,
+    }
+
+    # Inject into asset so process_face_mode can find it via asset["people"]
+    asset["people"] = [{"id": person_id, "faces": [face_info]}]
+    asset["face_confidence"] = face_data.confidence
+    return asset

winnow/upload_tracker.py

@@ -1,6 +1,6 @@
 """Persistent tracker for Immich asset IDs already uploaded/rejected by Frigate.
 
-Two separate JSON files in CACHE_DIR:
+Two separate JSON files in DATA_DIR:
   frigate_uploaded_ids.json  — successfully uploaded assets
   frigate_rejected_ids.json  — assets Frigate rejected (e.g. no face detected)
 
@@ -8,114 +8,473 @@ Both are excluded from future candidate pools. To reset:
   - All:           delete both files
   - One person:    call reset_person("Name") or set RESET_PERSON=Name
   - Rejects only:  delete frigate_rejected_ids.json, or set RETRY_REJECTED=true
+
+by_person schema (frigate_uploaded_ids.json):
+  {
+    "asset_ids":      ["immich-id-1", ...],                    # all assets we attempted to upload
+    "scores":         {"immich-id-1": 450.3},                  # Laplacian blur variance at upload time
+    "frigate_scores": {"immich-id-1": 0.87},                   # Frigate recognition confidence (0-1) pre-upload
+    "frigate_files":  {"PersonName-123.webp": "immich-id-1"},  # Frigate filename → asset ID
+    "crop_dims":      {"immich-id-1": [640, 480]},             # crop pixel dimensions at upload time
+    "frigate_count":  42                                       # last known Frigate training image count
+  }
+
+frigate_scores stores pre-upload recognize scores (0-1 sigmoid-mapped cosine
+similarity). High score = the existing training set already covers this face
+condition well. Low score = a gap — novel/diverse for the training set.
+
+frigate_files only contains files winnow uploaded — files added manually through
+Frigate's UI are never mapped here and are never touched by quality replacement.
 """
 
 import json
 import logging
+import os
 from pathlib import Path
 
+from .frigate_api import _get_frigate_url, delete_frigate_person_files
+
 logger = logging.getLogger(__name__)
 
 UPLOAD_TRACKER_FILE = "frigate_uploaded_ids.json"
 REJECT_TRACKER_FILE = "frigate_rejected_ids.json"
 
+# Write-through in-memory cache keyed by the resolved file path.
+# Reduces per-call JSON reads from O(calls) to O(1) after the first load.
+# Keyed by full path so tests with isolated tmp dirs never share entries.
+_cache: dict[str, dict] = {}
+_deferred: set[str] = set()  # paths whose disk writes are batched until flush_batch()
+_dirty: set[str] = set()    # deferred paths that received at least one _save during the batch
+
 
 def _tracker_path(filename: str) -> Path:
     try:
         from .config import Config
-        return Path(Config.CACHE_DIR) / filename
+        return Path(Config.DATA_DIR) / filename
     except (ImportError, AttributeError):
         return Path(filename)
 
 
 def _load(filename: str) -> dict:
     path = _tracker_path(filename)
-    if not path.exists():
-        return {}
+    key = str(path)
+    if key in _cache:
+        return _cache[key]
+    data: dict = {}
+    if path.exists():
         try:
             with open(path) as f:
-            return json.load(f)
+                data = json.load(f)
         except (json.JSONDecodeError, OSError) as e:
             logger.warning(f"Could not load tracker {filename}: {e}")
-        return {}
+    _cache[key] = data
+    return data
+
+
+def _write_to_disk(path: Path, data: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_suffix(".tmp")
+    try:
+        with open(tmp, "w") as f:
+            json.dump(data, f, indent=2)
+        os.replace(tmp, path)
+    except Exception:
+        tmp.unlink(missing_ok=True)
+        raise
 
 
 def _save(filename: str, data: dict) -> None:
     path = _tracker_path(filename)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with open(path, "w") as f:
-        json.dump(data, f, indent=2)
+    key = str(path)
+    if key in _deferred:
+        _cache[key] = data  # accumulate in cache; disk write deferred until flush_batch()
+        _dirty.add(key)
+        return
+    _write_to_disk(path, data)
+    _cache[key] = data  # update cache only after successful write
+
+
+def begin_batch(filename: str) -> None:
+    """Defer tracker disk writes for filename. All _save calls accumulate in the
+    in-memory cache until flush_batch() is called. Use around per-person upload loops
+    to reduce N writes to 1.
+
+    If a previous batch for this file was interrupted before flush_batch() was called
+    (e.g. an exception escaped the upload loop), the leftover cache state is flushed
+    to disk here before starting fresh so that partial progress is not silently lost.
+    """
+    path = _tracker_path(filename)
+    key = str(path)
+    if key in _deferred and key in _dirty:
+        try:
+            _write_to_disk(path, _cache[key])
+        except Exception:
+            logger.warning(
+                "begin_batch: could not flush leftover deferred state for %s"
+                " — partial progress may be lost",
+                path,
+            )
+        _deferred.discard(key)
+        _dirty.discard(key)
+    _deferred.add(key)
+
+
+def flush_batch(filename: str) -> None:
+    """Write the accumulated cache state for filename to disk."""
+    path = _tracker_path(filename)
+    key = str(path)
+    if key in _dirty and key in _cache:
+        _write_to_disk(path, _cache[key])
+    _deferred.discard(key)
+    _dirty.discard(key)
 
 
 def _flat_key(filename: str) -> str:
-    return "uploaded_asset_ids" if "uploaded" in filename else "rejected_asset_ids"
+    return "uploaded_asset_ids" if filename == UPLOAD_TRACKER_FILE else "rejected_asset_ids"
 
 
-def _load_flat(filename: str) -> set[str]:
-    return set(_load(filename).get(_flat_key(filename), []))
+def _get_ids(entry: list | dict) -> list[str]:
+    """Extract asset_ids from either the old list format or the new dict format."""
+    if isinstance(entry, list):
+        return entry
+    return entry.get("asset_ids", [])
 
 
-def _mark(filename: str, asset_id: str, person_name: str | None) -> None:
+def _migrate_entry(entry: list | dict) -> dict:
+    """Ensure by_person entry is in the current dict format."""
+    if isinstance(entry, list):
+        return {"asset_ids": sorted(entry), "scores": {}, "frigate_scores": {}, "frigate_files": {}, "crop_dims": {}}
+    # Copy top-level and all nested dicts so callers' mutations never reach the cache.
+    result = dict(entry)
+    result["asset_ids"] = list(result.get("asset_ids", []))
+    result["scores"] = dict(result.get("scores", {}))
+    result["frigate_scores"] = dict(result.get("frigate_scores", {}))
+    result["frigate_files"] = dict(result.get("frigate_files", {}))
+    result["crop_dims"] = dict(result.get("crop_dims", {}))
+    return result
+
+
+def _mark(
+    filename: str,
+    asset_id: str,
+    person_name: str | None,
+    score: float | None = None,
+    crop_dims: tuple[int, int] | None = None,
+    frigate_score: float | None = None,
+) -> None:
+    if not person_name:
+        logger.warning("_mark called with empty person_name for asset %s — asset not recorded", asset_id)
+        return
     data = _load(filename)
-    flat_key = _flat_key(filename)
-    flat = set(data.get(flat_key, []))
-    flat.add(asset_id)
-    data[flat_key] = sorted(flat)
-    if person_name:
-        by_person = data.setdefault("by_person", {})
-        person_ids = set(by_person.get(person_name, []))
-        person_ids.add(asset_id)
-        by_person[person_name] = sorted(person_ids)
-    _save(filename, data)
+    by_person = dict(data.get("by_person", {}))
+    entry = _migrate_entry(by_person.get(person_name, {}))
+    ids = set(entry["asset_ids"])
+    ids.add(asset_id)
+    entry["asset_ids"] = sorted(ids)
+    if score is not None:
+        entry["scores"][asset_id] = round(score, 4)
+    if crop_dims is not None:
+        entry["crop_dims"][asset_id] = [crop_dims[0], crop_dims[1]]
+    if frigate_score is not None:
+        entry["frigate_scores"][asset_id] = round(frigate_score, 4)
+    by_person[person_name] = entry
+    new_data = dict(data)
+    new_data["by_person"] = by_person
+    _save(filename, new_data)
+    logger.debug("Marked %s in %s (%s)", asset_id, filename, person_name)
 
 
 # ── Public API ────────────────────────────────────────────────────────────────
 
 def load_uploaded_ids() -> set[str]:
-    return _load_flat(UPLOAD_TRACKER_FILE)
+    """Return all asset IDs recorded as uploaded. Derives from by_person (primary)
+    plus any legacy flat list still present in old tracker files."""
+    data = _load(UPLOAD_TRACKER_FILE)
+    ids = {aid for e in data.get("by_person", {}).values() for aid in _get_ids(e)}
+    ids.update(data.get("uploaded_asset_ids", []))  # backward compat with pre-0.6.1 files
+    return ids
 
 
 def load_rejected_ids() -> set[str]:
-    return _load_flat(REJECT_TRACKER_FILE)
+    """Return all asset IDs recorded as rejected. Derives from by_person (primary)
+    plus any legacy flat list still present in old tracker files."""
+    data = _load(REJECT_TRACKER_FILE)
+    ids = {aid for e in data.get("by_person", {}).values() for aid in _get_ids(e)}
+    ids.update(data.get("rejected_asset_ids", []))  # backward compat with pre-0.6.1 files
+    return ids
 
 
-def mark_uploaded(asset_id: str, person_name: str | None = None) -> None:
-    _mark(UPLOAD_TRACKER_FILE, asset_id, person_name)
-    logger.debug(f"Marked {asset_id} as uploaded ({person_name})")
+def mark_uploaded(
+    asset_id: str,
+    person_name: str | None = None,
+    score: float | None = None,
+    crop_dims: tuple[int, int] | None = None,
+    frigate_score: float | None = None,
+) -> None:
+    _mark(UPLOAD_TRACKER_FILE, asset_id, person_name, score=score, crop_dims=crop_dims, frigate_score=frigate_score)
 
 
 def mark_rejected(asset_id: str, person_name: str | None = None) -> None:
     _mark(REJECT_TRACKER_FILE, asset_id, person_name)
-    logger.debug(f"Marked {asset_id} as rejected ({person_name})")
+
+
+
+
+def record_frigate_file(person_name: str, frigate_filename: str, asset_id: str) -> None:
+    """Record a single Frigate filename → asset_id mapping."""
+    record_frigate_files_batch(person_name, {frigate_filename: asset_id})
+
+
+def record_frigate_files_batch(person_name: str, mappings: dict[str, str]) -> None:
+    """Record multiple Frigate filename → asset_id mappings in a single load/save."""
+    if not mappings:
+        return
+    src = _load(UPLOAD_TRACKER_FILE)
+    by_person = dict(src.get("by_person", {}))
+    entry = _migrate_entry(by_person.get(person_name, {}))
+    entry["frigate_files"].update(mappings)
+    by_person[person_name] = entry
+    data = dict(src)
+    data["by_person"] = by_person
+    _save(UPLOAD_TRACKER_FILE, data)
+    logger.debug(f"Batch-mapped {len(mappings)} Frigate file(s) for {person_name}")
+
+
+def remove_frigate_file(person_name: str, frigate_filename: str) -> None:
+    """Remove a Frigate filename from the mapping after it has been deleted.
+
+    Does NOT unmark the source asset_id — the deletion was deliberate and
+    we don't want to re-upload the inferior image on the next run.
+    """
+    remove_frigate_files_batch(person_name, [frigate_filename])
+
+
+def remove_frigate_files_batch(person_name: str, frigate_filenames: list[str]) -> None:
+    """Remove multiple Frigate filenames in a single load/save."""
+    src = _load(UPLOAD_TRACKER_FILE)
+    raw = src.get("by_person", {}).get(person_name)
+    if raw is None:
+        return
+    entry = _migrate_entry(raw)
+    for fn in frigate_filenames:
+        asset_id = entry["frigate_files"].pop(fn, None)
+        if asset_id is not None and asset_id not in entry["frigate_files"].values():
+            entry["frigate_scores"].pop(asset_id, None)
+    by_person = dict(src.get("by_person", {}))  # copy so assignment does not mutate the cache
+    by_person[person_name] = entry
+    data = dict(src)
+    data["by_person"] = by_person
+    _save(UPLOAD_TRACKER_FILE, data)
+    logger.debug(f"Removed {len(frigate_filenames)} Frigate file mapping(s) for {person_name}")
+
+
+def get_tracked_frigate_file_count(person_name: str) -> int:
+    """Return the number of Frigate training files winnow has mapped for this person.
+
+    Used as the cap baseline so that manually-added Frigate files do not
+    consume slots from winnow's managed quota.
+    """
+    data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
+    return len(entry["frigate_files"])
+
+
+def get_tracked_frigate_filenames(person_name: str) -> set[str]:
+    """Return the set of Frigate filenames currently mapped in the tracker for a person.
+
+    Used as a pre-upload baseline when the Frigate GET API is unreachable at
+    upload start, so reconciliation can still identify newly uploaded files.
+    """
+    data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
+    return set(entry["frigate_files"].keys())
+
+
+def has_frigate_scores(person_name: str) -> bool:
+    """Return True if any mapped file for this person has a stored Frigate recognition score."""
+    data = _load(UPLOAD_TRACKER_FILE)
+    raw = data.get("by_person", {}).get(person_name)
+    if not raw or isinstance(raw, list):
+        return False
+    frigate_files = raw.get("frigate_files", {})
+    frigate_scores = raw.get("frigate_scores", {})
+    return any(asset_id in frigate_scores for asset_id in frigate_files.values())
+
+
+def _pick_mapped_file(
+    person_name: str, score_key: str, *, highest: bool, exclude: set[str] | None = None
+) -> tuple[str, str, float] | None:
+    data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
+    scores = entry.get(score_key, {})
+    seen_assets: set[str] = set()
+    candidates = []
+    for ff, asset_id in entry.get("frigate_files", {}).items():
+        if (exclude is None or ff not in exclude) and asset_id in scores and asset_id not in seen_assets:
+            seen_assets.add(asset_id)
+            candidates.append((ff, asset_id, scores[asset_id]))
+    if not candidates:
+        return None
+    return max(candidates, key=lambda x: x[2]) if highest else min(candidates, key=lambda x: x[2])
+
+
+def get_lowest_quality_mapped_file(
+    person_name: str, exclude: set[str] | None = None
+) -> tuple[str, str, float] | None:
+    """Return (frigate_filename, asset_id, score) for the mapped file with the lowest
+    blur score, or None if no mapped files with known scores exist.
+
+    Used for quality replacement when no Frigate scores are available.
+    Pass `exclude` to skip files that failed to delete this run.
+    """
+    return _pick_mapped_file(person_name, "scores", highest=False, exclude=exclude)
+
+
+def get_most_redundant_mapped_file(
+    person_name: str, exclude: set[str] | None = None
+) -> tuple[str, str, float] | None:
+    """Return (frigate_filename, asset_id, score) for the mapped file with the highest
+    Frigate recognition score, or None if no mapped files with Frigate scores exist.
+
+    High Frigate score = the training set already covers this face condition well
+    = the most redundant file and therefore the best replacement target.
+    Pass `exclude` to skip files that failed to delete this run.
+    """
+    return _pick_mapped_file(person_name, "frigate_scores", highest=True, exclude=exclude)
+
+
+def find_by_crop_dimension(size: int) -> list[dict]:
+    """Return all tracked crops whose width or height matches `size` pixels.
+
+    Returns a list of dicts: {person, asset_id, width, height, blur_score, frigate_filename}.
+    frigate_filename is None when the Frigate mapping was lost to a reconciliation race.
+    """
+    data = _load(UPLOAD_TRACKER_FILE)
+    results = []
+    for person_name, raw_entry in data.get("by_person", {}).items():
+        entry = _migrate_entry(raw_entry)
+        scores = entry.get("scores", {})
+        frigate_files = entry.get("frigate_files", {})
+        asset_to_frigate: dict[str, str] = {}
+        for fn, aid in frigate_files.items():
+            asset_to_frigate.setdefault(aid, fn)  # first-seen wins; plain inversion silently drops duplicates
+        frigate_scores = entry.get("frigate_scores", {})
+        for asset_id, dims in entry.get("crop_dims", {}).items():
+            if not isinstance(dims, (list, tuple)) or len(dims) < 2:
+                continue
+            w, h = dims[0], dims[1]
+            if w == size or h == size:
+                results.append({
+                    "person": person_name,
+                    "asset_id": asset_id,
+                    "width": w,
+                    "height": h,
+                    "blur_score": scores.get(asset_id),
+                    "frigate_score": frigate_scores.get(asset_id),
+                    "frigate_filename": asset_to_frigate.get(asset_id),
+                })
+    return results
+
+
+def update_frigate_count(person_name: str, count: int) -> None:
+    """Record Frigate's authoritative training image count for a person."""
+    data = _load(UPLOAD_TRACKER_FILE)
+    by_person = dict(data.get("by_person", {}))
+    entry = _migrate_entry(by_person.get(person_name, {}))
+    entry["frigate_count"] = count
+    by_person[person_name] = entry
+    new_data = dict(data)
+    new_data["by_person"] = by_person
+    _save(UPLOAD_TRACKER_FILE, new_data)
+
+
+def reset_all_people() -> None:
+    """Reset all tracking data in two writes (O(P) Frigate API calls, O(1) disk writes).
+
+    Preferred over calling reset_person() in a loop when RESET_PERSON=* — that
+    approach is O(P²) because each call rebuilds the flat list from all remaining entries.
+    """
+    upload_data = _load(UPLOAD_TRACKER_FILE)
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        logger.info("FRIGATE_URL not set — skipping Frigate file deletion")
+    for person_name, raw_entry in upload_data.get("by_person", {}).items():
+        entry = _migrate_entry(raw_entry)
+        frigate_filenames = list(entry.get("frigate_files", {}).keys())
+        if not frigate_filenames:
+            continue
+        if frigate_url:
+            if delete_frigate_person_files(person_name, frigate_filenames):
+                logger.info(f"Deleted {len(frigate_filenames)} Frigate file(s) for {person_name}")
+            else:
+                logger.warning(f"Could not delete Frigate files for {person_name} — tracker reset proceeding anyway")
+    _save(UPLOAD_TRACKER_FILE, {})
+    _save(REJECT_TRACKER_FILE, {})
+    logger.info("Reset all tracking data")
 
 
 def reset_person(person_name: str) -> None:
-    """Remove all uploaded and rejected records for a given person."""
+    """Remove all uploaded and rejected records for a given person.
+
+    Also deletes winnow-managed Frigate training files so the next run starts
+    clean rather than uploading on top of orphaned files. Manually-added Frigate
+    files (not in frigate_files) are never touched. Proceeds with tracker reset
+    even if Frigate is unreachable.
+    """
+    upload_data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(upload_data.get("by_person", {}).get(person_name, {}))
+    frigate_filenames = list(entry.get("frigate_files", {}).keys())
+    if frigate_filenames:
+        if not _get_frigate_url():
+            logger.info(f"FRIGATE_URL not set — skipping Frigate file deletion for {person_name}")
+        elif delete_frigate_person_files(person_name, frigate_filenames):
+            logger.info(f"Deleted {len(frigate_filenames)} Frigate file(s) for {person_name}")
+        else:
+            logger.warning(f"Could not delete Frigate files for {person_name} — tracker reset proceeding anyway")
+
+    changed = False
     for filename in (UPLOAD_TRACKER_FILE, REJECT_TRACKER_FILE):
-        data = _load(filename)
-        flat_key = _flat_key(filename)
-        by_person = data.get("by_person", {})
-        person_ids = set(by_person.pop(person_name, []))
-        if person_ids:
-            flat = set(data.get(flat_key, [])) - person_ids
-            data[flat_key] = sorted(flat)
+        src = upload_data if filename == UPLOAD_TRACKER_FILE else _load(REJECT_TRACKER_FILE)
+        by_person = dict(src.get("by_person", {}))  # copy so pop() does not mutate the cache
+        tracker_entry = by_person.pop(person_name, None)
+        if tracker_entry is not None:
+            data = dict(src)
             data["by_person"] = by_person
+            flat_key = _flat_key(filename)
+            person_ids = set(_get_ids(tracker_entry))
+            if person_ids and flat_key in data and not isinstance(data[flat_key], list):
+                logger.warning(
+                    "reset_person: %s has unexpected type for %s (%s) — skipping flat-list cleanup;"
+                    " all persons' legacy IDs in this field are unaffected but unreadable",
+                    filename, flat_key, type(data[flat_key]).__name__,
+                )
+            elif person_ids and flat_key in data:
+                data[flat_key] = sorted(set(data[flat_key]) - person_ids)
             _save(filename, data)
+            changed = True
+    if changed:
         logger.info(f"Reset tracking data for {person_name}")
+    else:
+        logger.debug(f"reset_person: no tracking data found for {person_name}")
 
 
-def get_person_summary() -> dict[str, dict[str, int]]:
-    """Return {person_name: {uploaded: N, rejected: N}} for display."""
-    uploaded_by = _load(UPLOAD_TRACKER_FILE).get("by_person", {})
-    rejected_by = _load(REJECT_TRACKER_FILE).get("by_person", {})
-    names = set(uploaded_by) | set(rejected_by)
-    return {
-        name: {
-            "uploaded": len(uploaded_by.get(name, [])),
-            "rejected": len(rejected_by.get(name, [])),
-        }
-        for name in sorted(names)
+def get_person_summary() -> dict[str, dict]:
+    """Return {person_name: {uploaded, rejected, frigate_count, scores, frigate_files}} for display/capacity."""
+    uploaded_data = _load(UPLOAD_TRACKER_FILE).get("by_person", {})
+    rejected_data = _load(REJECT_TRACKER_FILE).get("by_person", {})
+    names = set(uploaded_data) | set(rejected_data)
+    result = {}
+    for name in sorted(names):
+        u_entry = _migrate_entry(uploaded_data.get(name, {}))
+        r_entry = _migrate_entry(rejected_data.get(name, {}))
+        result[name] = {
+            "uploaded": len(u_entry["asset_ids"]),
+            "rejected": len(r_entry["asset_ids"]),
+            "frigate_count": u_entry.get("frigate_count"),
+            "scores": u_entry["scores"],
+            "frigate_files": u_entry["frigate_files"],
         }
+    return result
 
 
 def filter_already_uploaded(