fix: v0.6.2 — structural tracker refactor, batch writes, multi-instance prep

- Drop flat list as primary storage; derive uploaded/rejected IDs from by_person
  (single source of truth). Legacy flat lists in existing files still read for
  backward compat. Removes dual-representation sync hazard.
- Add begin_batch/flush_batch: per-person upload loop now does 1 os.replace
  instead of N (one per mark_uploaded call). Benefit on slow storage.
- reset_all_people(): RESET_PERSON=* is now O(1) disk writes instead of O(P^2).
- blur_score_from_image inlines cv2.Laplacian directly, removing assess_quality
  call overhead and decoupling from the full quality pipeline.

.env.example

@@ -8,40 +8,39 @@ FRIGATE_URL=http://192.168.1.10:5000
 # Set AUTO_MODE=true to force auto mode even in an interactive terminal.
 # AUTO_MODE=true
 # VERBOSE=true                # Enable DEBUG-level console output (log file is always DEBUG)
-# TRAINING_MODE: face = upload to Frigate face recognition API
-#                object = save crops to output dir for manual Frigate placement
-TRAINING_MODE=face
-# STRATEGY: auto = objective diversity (recommended), standard = 30 imgs, broad = 100 imgs
-STRATEGY=auto
+# STRATEGY: adaptive = embedding diversity (recommended), standard = 30 imgs, broad = 100 imgs
+STRATEGY=adaptive
 # LIMIT=50                    # Custom image count; overrides STRATEGY preset
-# OBJECT_CLASS=dog            # Object label for object mode (e.g. dog, cat, car)
 
 # ── People Filtering ──────────────────────────────────────────────────────────
 # ONLY_PEOPLE=John,Jane       # Comma-separated; process only these people
 # SKIP_PEOPLE=Unknown         # Comma-separated; skip these people
-# MIN_FACE_COUNT=5            # Skip people with fewer than N assets in Immich
+# MIN_FACE_COUNT=3            # Skip people with fewer than N assets in Immich (default: 3)
 # YEARS_FILTER=10             # Only include images from the last N years (default: 10)
+# MERGE_DUPLICATE_PEOPLE=false  # Merge duplicate Immich person records permanently (default: false — warn and skip)
 
 # ── Image Quality ─────────────────────────────────────────────────────────────
-# MIN_FACE_WIDTH=50           # Minimum face width in pixels (default: 50)
+# MIN_FACE_WIDTH=90           # Minimum face width in pixels (default: 90, guarantees ≥8,100px crop)
 # FACE_MARGIN=0.15            # Padding around face crop as fraction (default: 0.15)
 # ENABLE_FACE_ALIGNMENT=true  # Align face before cropping (default: true)
 # USE_FULL_RESOLUTION=true    # Use full-res images vs thumbnails (default: true)
 # MIN_CONFIDENCE=0.7          # Minimum face detection confidence (default: 0.7)
-# BLUR_THRESHOLD=100.0        # Laplacian blur threshold; lower = accept more blur (default: 100.0)
-# MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 80)
+# BLUR_THRESHOLD=120.0        # Laplacian blur threshold; lower = accept more blur (default: 120.0)
+# MAX_AUTO_IMAGES=20          # Hard cap on auto-diversity selection (default: 20)
+# QUALITY_REPLACEMENT=true    # At cap, replace a weaker tracked image with a better candidate (default: true)
+# FRIGATE_SCORE_CEILING=      # Below-cap novelty gate: unset = dynamic (default), 0 = disabled, e.g. 0.85 = fixed ceiling
+# ENABLE_FRIGATE_SCORES=true  # Call Frigate's recognize endpoint pre-upload to store diversity scores (default: true; adds ~200ms per upload)
 
 # ── Caching & Models ──────────────────────────────────────────────────────────
 # FORCE_CPU=true              # Disable GPU, fall back to CPU
 # ENABLE_CACHE=false          # Disable embedding cache (default: true)
-CACHE_DIR=/app/.if_cache
-HF_HOME=/models/huggingface
+DATA_DIR=/app/data
 INSIGHTFACE_HOME=/models/.insightface
 
 # ── Tracker overrides (one-shot — remove after use) ───────────────────────────
 # DRY_RUN=true                # Preview selection without downloading/uploading
 # RETRY_REJECTED=true         # Re-attempt previously rejected images
-# RESET_PERSON=John           # Clear uploaded+rejected history for one person
+# RESET_PERSON=John           # Clear uploaded+rejected history for one person (use * for all)
 
 # ── Scheduling ────────────────────────────────────────────────────────────────
 # CRON_SCHEDULE controls container lifetime:

.github/workflows/docker-publish.yml

@@ -2,7 +2,7 @@ name: Publish Docker Image
 
 on:
   push:
-    branches: ["main", "dev"]
+    branches: ["dev"]
     paths-ignore:
       - "**.md"
       - "docs/**"
@@ -12,9 +12,16 @@ on:
       - ".github/workflows/lint.yml"
       - ".github/dependabot.yml"
       - "uv.lock"
-      - "uv-cpu.lock"
-      - "uv-rocm.lock"
-      - "uv-intel.lock"
+  workflow_call:
+    inputs:
+      tag:
+        type: string
+        required: false
+        description: "Release tag, e.g. v0.4.1 — triggers :latest + versioned image tags"
+      version:
+        type: string
+        required: false
+        description: "Version string without v prefix, e.g. 0.4.1"
 
 concurrency:
   group: docker-${{ github.ref }}
@@ -26,15 +33,13 @@ env:
 
 jobs:
   build:
-    name: Build (${{ matrix.platform }})
-    runs-on: ${{ matrix.runner }}
+    name: Build (linux/amd64)
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         include:
           - platform: linux/amd64
             runner: ubuntu-latest
-          - platform: linux/arm64
-            runner: ubuntu-latest
     permissions:
       contents: read
       packages: write
@@ -49,29 +54,37 @@ jobs:
           df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v6
-
-      - name: Set up QEMU
-        if: matrix.platform == 'linux/arm64'
-        uses: docker/setup-qemu-action@v4
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
           platforms: ${{ matrix.platform }}
+          build-args: VERSION=${{ steps.version.outputs.value }}
           cache-from: type=gha,scope=${{ matrix.platform }}
           cache-to: type=gha,mode=max,scope=${{ matrix.platform }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -84,9 +97,9 @@ jobs:
           touch "/tmp/digests/${digest#sha256:}"
 
       - name: Upload digest
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: digest-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          name: digest-amd64
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
@@ -101,17 +114,17 @@ jobs:
 
     steps:
       - name: Download digests
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           path: /tmp/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -120,22 +133,26 @@ jobs:
       - name: Determine image tags
         id: tags
         run: |
-          if [ "${{ github.ref_name }}" = "dev" ]; then
-            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev" >> "$GITHUB_OUTPUT"
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            echo "tag_args=-t ${IMAGE}:latest -t ${IMAGE}:${INPUT_TAG}" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:latest" >> "$GITHUB_OUTPUT"
           else
-            echo "tags=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest" >> "$GITHUB_OUTPUT"
+            echo "tag_args=-t ${IMAGE}:dev" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
         run: |
           docker buildx imagetools create \
-            -t ${{ steps.tags.outputs.tags }} \
+            ${{ steps.tags.outputs.tag_args }} \
             $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
 
       - name: Inspect image
         run: |
-          docker buildx imagetools inspect ${{ steps.tags.outputs.tags }}
+          docker buildx imagetools inspect ${{ steps.tags.outputs.inspect_tag }}
 
       - name: Ensure package is public
         run: |
@@ -161,46 +178,67 @@ jobs:
           df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Determine CPU image tag
-        id: cpu-tag
+      - name: Determine CPU image tags
+        id: cpu-tags
         run: |
-          if [ "${{ github.ref_name }}" = "dev" ]; then
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev-cpu" >> "$GITHUB_OUTPUT"
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:cpu" "${IMAGE}:${INPUT_TAG}-cpu"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:cpu" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:cpu" >> "$GITHUB_OUTPUT"
+            echo "tags=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-cpu" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and push CPU image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
-          build-args: VARIANT=cpu
+          build-args: |
+            VARIANT=cpu
+            VERSION=${{ steps.version.outputs.value }}
           cache-from: type=gha,scope=cpu
           cache-to: type=gha,mode=max,scope=cpu
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push: true
-          tags: ${{ steps.cpu-tag.outputs.tag }}
+          tags: ${{ steps.cpu-tags.outputs.tags }}
 
       - name: Inspect CPU image
         run: |
-          docker buildx imagetools inspect ${{ steps.cpu-tag.outputs.tag }}
+          docker buildx imagetools inspect ${{ steps.cpu-tags.outputs.inspect_tag }}
 
       - name: Ensure package is public
         run: |
@@ -226,43 +264,64 @@ jobs:
           df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Determine ROCm image tag
-        id: rocm-tag
+      - name: Determine ROCm image tags
+        id: rocm-tags
         run: |
-          if [ "${{ github.ref_name }}" = "dev" ]; then
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev-rocm" >> "$GITHUB_OUTPUT"
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:rocm" "${IMAGE}:${INPUT_TAG}-rocm"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:rocm" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:rocm" >> "$GITHUB_OUTPUT"
+            echo "tags=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-rocm" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and push ROCm image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64
-          build-args: VARIANT=rocm
+          build-args: |
+            VARIANT=rocm
+            VERSION=${{ steps.version.outputs.value }}
           cache-from: type=gha,scope=linux/amd64-rocm
           cache-to: type=gha,mode=max,scope=linux/amd64-rocm
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push: true
-          tags: ${{ steps.rocm-tag.outputs.tag }}
+          tags: ${{ steps.rocm-tags.outputs.tags }}
 
       - name: Inspect ROCm image
         run: |
-          docker buildx imagetools inspect ${{ steps.rocm-tag.outputs.tag }}
+          docker buildx imagetools inspect ${{ steps.rocm-tags.outputs.inspect_tag }}
 
       - name: Ensure package is public
         run: |
@@ -288,43 +347,64 @@ jobs:
           df -h
 
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          ref: ${{ inputs.tag || github.ref }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Determine Intel image tag
-        id: intel-tag
+      - name: Determine Intel image tags
+        id: intel-tags
         run: |
-          if [ "${{ github.ref_name }}" = "dev" ]; then
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:dev-intel" >> "$GITHUB_OUTPUT"
+          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
+          INPUT_TAG="${{ inputs.tag }}"
+          if [ -n "$INPUT_TAG" ]; then
+            {
+              echo "tags<<EOF"
+              printf '%s\n' "${IMAGE}:intel" "${IMAGE}:${INPUT_TAG}-intel"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:intel" >> "$GITHUB_OUTPUT"
           else
-            echo "tag=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:intel" >> "$GITHUB_OUTPUT"
+            echo "tags=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
+            echo "inspect_tag=${IMAGE}:dev-intel" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Compute build version
+        id: version
+        run: |
+          if [ -n "${{ inputs.version }}" ]; then
+            echo "value=${{ inputs.version }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "value=dev" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build and push Intel image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64
-          build-args: VARIANT=intel
+          build-args: |
+            VARIANT=intel
+            VERSION=${{ steps.version.outputs.value }}
           cache-from: type=gha,scope=linux/amd64-intel
           cache-to: type=gha,mode=max,scope=linux/amd64-intel
           github-token: ${{ secrets.GITHUB_TOKEN }}
           push: true
-          tags: ${{ steps.intel-tag.outputs.tag }}
+          tags: ${{ steps.intel-tags.outputs.tags }}
 
       - name: Inspect Intel image
         run: |
-          docker buildx imagetools inspect ${{ steps.intel-tag.outputs.tag }}
+          docker buildx imagetools inspect ${{ steps.intel-tags.outputs.inspect_tag }}
 
       - name: Ensure package is public
         run: |

.github/workflows/lint.yml

@@ -23,10 +23,10 @@ jobs:
           echo "Disk space freed."
 
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Run Ruff
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@0ce1b0bf8b818ef400413f810f8a11cdbda0034b # v4.0.0
         with:
           args: "check"
 

.github/workflows/release.yml

@@ -32,12 +32,12 @@ jobs:
           echo "Disk space freed."
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
         run: uv python install 3.13
@@ -50,17 +50,8 @@ jobs:
             exit 1
           fi
 
-      - name: Ensure lockfiles are current
-        run: |
-          cp pyproject.toml _pyproject_orig.toml
-          for variant in cpu rocm intel; do
-            cp pyproject-${variant}.toml pyproject.toml
-            uv lock
-            cp uv.lock uv-${variant}.lock
-          done
-          cp _pyproject_orig.toml pyproject.toml
-          uv lock
-          rm _pyproject_orig.toml
+      - name: Ensure lockfile is current
+        run: uv lock
 
       - name: Resolve tag name
         id: tag
@@ -109,7 +100,7 @@ jobs:
           fi
 
       - name: Create GitHub Release
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           RELEASE_TAG: ${{ steps.tag.outputs.TAG }}
           RELEASE_NOTES: ${{ steps.changelog.outputs.NOTES }}
@@ -117,198 +108,34 @@ jobs:
           script: |
             const tag = process.env.RELEASE_TAG;
             const notes = (process.env.RELEASE_NOTES || '').trim();
-            await github.rest.repos.createRelease({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              tag_name: tag,
-              name: `Release ${tag}`,
-              body: notes || `Release ${tag}`,
-              draft: false,
-              prerelease: false,
-            });
+            try {
+              const existing = await github.rest.repos.getReleaseByTag({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag: tag,
+              });
+              console.log(`Release ${tag} already exists (id ${existing.data.id}), skipping creation.`);
+            } catch (err) {
+              if (err.status !== 404) throw err;
+              await github.rest.repos.createRelease({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                tag_name: tag,
+                name: `Release ${tag}`,
+                body: notes || `Release ${tag}`,
+                draft: false,
+                prerelease: false,
+              });
+            }
 
-  build-gpu:
-    name: Build GPU image
+  build-images:
+    name: Build and push Docker images
     needs: release
-    runs-on: ubuntu-latest
+    uses: ./.github/workflows/docker-publish.yml
+    with:
+      tag: ${{ needs.release.outputs.tag }}
+      version: ${{ needs.release.outputs.version }}
+    secrets: inherit
     permissions:
       packages: write
-    steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push GPU image (latest)
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          build-args: VERSION=${{ needs.release.outputs.version }}
-          cache-from: type=gha,scope=release-gpu
-          cache-to: type=gha,mode=max,scope=release-gpu
-          tags: |
-            ghcr.io/sudolulo/winnow:latest
-            ghcr.io/sudolulo/winnow:${{ needs.release.outputs.tag }}
-
-  build-cpu:
-    name: Build CPU image
-    needs: release
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push CPU image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          build-args: |
-            VARIANT=cpu
-            VERSION=${{ needs.release.outputs.version }}
-          cache-from: type=gha,scope=release-cpu
-          cache-to: type=gha,mode=max,scope=release-cpu
-          tags: |
-            ghcr.io/sudolulo/winnow:cpu
-            ghcr.io/sudolulo/winnow:${{ needs.release.outputs.tag }}-cpu
-
-  build-rocm:
-    name: Build ROCm image
-    needs: release
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push ROCm image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: true
-          build-args: |
-            VARIANT=rocm
-            VERSION=${{ needs.release.outputs.version }}
-          cache-from: type=gha,scope=release-rocm
-          cache-to: type=gha,mode=max,scope=release-rocm
-          tags: |
-            ghcr.io/sudolulo/winnow:rocm
-            ghcr.io/sudolulo/winnow:${{ needs.release.outputs.tag }}-rocm
-
-  build-intel:
-    name: Build Intel image
-    needs: release
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-    steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
-
-      - name: Log in to GHCR
-        uses: docker/login-action@v4
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build and push Intel image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64
-          push: true
-          build-args: |
-            VARIANT=intel
-            VERSION=${{ needs.release.outputs.version }}
-          cache-from: type=gha,scope=release-intel
-          cache-to: type=gha,mode=max,scope=release-intel
-          tags: |
-            ghcr.io/sudolulo/winnow:intel
-            ghcr.io/sudolulo/winnow:${{ needs.release.outputs.tag }}-intel
+      contents: read

.github/workflows/test.yml

@@ -13,16 +13,16 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
         run: uv python install 3.13
 
       - name: Install dependencies
-        run: uv sync --all-extras
+        run: uv sync --extra cpu
 
       - name: Run tests
         run: uv run pytest

.github/workflows/update-lockfile.yml

@@ -1,5 +1,5 @@
 # .github/workflows/update-lockfile.yml
-name: Update lockfiles
+name: Update lockfile
 
 on:
   push:
@@ -7,9 +7,6 @@ on:
       - '**'
     paths:
       - 'pyproject.toml'
-      - 'pyproject-cpu.toml'
-      - 'pyproject-rocm.toml'
-      - 'pyproject-intel.toml'
   workflow_dispatch:
 
 jobs:
@@ -18,49 +15,32 @@ jobs:
     permissions:
       contents: write
     steps:
-      - name: Free up disk space
-        run: |
-          sudo rm -rf /usr/share/dotnet
-          sudo rm -rf /opt/ghc
-          sudo rm -rf "/usr/local/share/boost"
-          sudo rm -rf "$AGENT_TOOLSDIRECTORY"
-          echo "Disk space freed."
-
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
       - name: Set up Python
         run: uv python install 3.13
 
-      - name: Regenerate all lockfiles
-        run: |
-          cp pyproject.toml _pyproject_orig.toml
-          for variant in cpu rocm intel; do
-            cp pyproject-${variant}.toml pyproject.toml
-            uv lock
-            cp uv.lock uv-${variant}.lock
-          done
-          cp _pyproject_orig.toml pyproject.toml
-          uv lock
-          rm _pyproject_orig.toml
+      - name: Regenerate lockfile
+        run: uv lock
 
       - name: Check for changes
         id: diff
         run: |
-          if git diff --quiet uv.lock uv-cpu.lock uv-rocm.lock uv-intel.lock; then
+          if git diff --quiet uv.lock; then
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Commit and push updated lockfiles
+      - name: Commit and push updated lockfile
         if: steps.diff.outputs.changed == 'true'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add uv.lock uv-cpu.lock uv-rocm.lock uv-intel.lock
-          git commit -m "chore: update lockfiles"
+          git add uv.lock
+          git commit -m "chore: update lockfile"
           git push

CHANGELOG.md

@@ -7,6 +7,240 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-06-16
+
+### Changed
+
+- **Flat `uploaded_asset_ids` / `rejected_asset_ids` lists dropped as primary storage**: asset IDs are now derived on read from `by_person` entries, which are the single source of truth. The legacy flat lists in existing tracker files are still read (union) so no assets become re-eligible after upgrading. New writes no longer maintain the flat lists. This removes the dual-representation sync hazard and paves the way for multi-instance support (per-instance `by_person` keying in a future release).
+
+- **Tracker writes batched per person**: `mark_uploaded` calls inside the per-person upload loop are now accumulated in memory (`begin_batch`) and flushed in a single `os.replace` write at the end of each person's loop (`flush_batch`), reducing N tracker writes per person to 1. Benefits users on slow storage (NAS, SD card, spinning disks).
+
+- **`RESET_PERSON=*` is now O(1) disk writes**: replaced the per-person `reset_person` loop with `reset_all_people()`, which makes one Frigate API call per person for file deletion and then clears both tracker files in two writes. Previously it was O(P²) iterations and 2P writes.
+
+- **`blur_score_from_image` inlines Laplacian computation**: replaced the `assess_quality()` call (which ran grayscale, exposure, and confidence checks whose results were discarded) with a direct `cv2.Laplacian` computation. The function is now self-contained and does not silently inherit future costs added to the full quality pipeline.
+
+## [0.6.1] - 2026-06-16
+
+### Fixed
+
+- **Corrupt or truncated full-res thumbnails now marked rejected**: `OSError` (truncated file) is caught alongside `PIL.UnidentifiedImageError` in the thumbnail path so persistently bad assets are tombstoned instead of retried forever. Full-res download failures (`USE_FULL_RESOLUTION=true`) remain transient — not marked rejected — so a Immich blip doesn't permanently blacklist valid assets.
+
+- **Quality replacement mode no longer flips mid-loop**: `person_has_fscores` was re-evaluated after each file deletion, which could switch the remaining replacements from Frigate-score mode to blur-score mode if the deleted file was the last scored one. The mode is now fixed for the duration of the upload loop.
+
+- **`reset_person` no longer removes shared asset IDs**: the flat `uploaded_asset_ids` list is now rebuilt from all remaining `by_person` entries rather than subtracting the reset person's IDs. Previously, resetting Alice could remove an asset ID that also appeared under Bob, making it re-eligible for upload.
+
+- **`_save` cache updated only after successful write**: the in-memory tracker cache is now updated after `os.replace` succeeds rather than before. A disk-full or permission error no longer leaves the cache permanently ahead of the on-disk file.
+
+- **Stale Frigate file cleanup batched**: the per-file `remove_frigate_file` loop is replaced with a single `remove_frigate_files_batch` call, reducing N tracker writes to 1 when stale mappings are cleaned up.
+
+- **`_migrate_entry` no longer mutates the cache through nested dict aliases**: all five nested dicts (`asset_ids`, `scores`, `frigate_scores`, `frigate_files`, `crop_dims`) are now individually copied so `.pop()` calls in write paths cannot reach the in-memory cache.
+
+- **`find_by_crop_dimension` and `_pick_mapped_file` now agree on duplicate asset→file handling**: both use first-seen-wins when the same `asset_id` maps to multiple Frigate filenames, preventing inconsistent replacement decisions.
+
+- **Non-atomic JSON write**: tracker files are written to a `.tmp` sibling then renamed with `os.replace` so a crash mid-write never leaves a truncated file.
+
+- **`get_person_summary` uses `_migrate_entry`**: replaced three ad-hoc `isinstance` guards with a single `_migrate_entry` call, making old-format (list) entries consistent with every other read path.
+
+- **Quality replacement floor check**: a candidate with a `None` blur score (PIL error during scoring) no longer blocks a freed slot — the `<=` floor comparison is only applied when a score is actually available.
+
+- **`executor.py` syntax error**: the `if img is None:` block in the full-res download path was comment-only and would have raised `IndentationError` on import. Added `pass`.
+
+- **Duplicate `if stale:` guard**: two consecutive identical guards around stale-cleanup and its log print were merged into one.
+
+- **`_flat_key` uses constant equality** instead of substring match, removing a latent routing bug for any filename that happens to contain "uploaded".
+
+- **`remove_frigate_file` no longer creates ghost entries**: returns early when the person is absent rather than writing an empty stub.
+
+- **`skip_ids` extracted to helper**: the identical set comprehension in `_handle_duplicate_people` that appeared in three branches is now a single `_smaller_duplicate_ids()` inner function.
+
+- **`blur_score_from_image` returns `None` on error** instead of `0.0`, so callers can distinguish a failed measurement from a legitimately near-zero Laplacian variance score.
+
+## [0.6.0] - 2026-06-15
+
+### Changed
+
+- **Upload tracker reverted to JSON storage**: the SQLite-based tracker introduced in v0.5.0 produced 17 bug-fix releases in two days due to data-loss risks in the migration layer, schema primary key conflicts, tracker isolation races, and disk-full retry storms. The JSON backend (`frigate_uploaded_ids.json` / `frigate_rejected_ids.json` in `DATA_DIR`) is restored. It is simpler, has no migration layer, and carries no external dependency. If you ran any v0.5.x version, delete `frigate_tracker.db` from your `DATA_DIR` once you confirm the JSON files look correct. JSON files from before v0.5.0 are read automatically with no changes required.
+
+- **`CACHE_DIR` env var accepted as `DATA_DIR` alias**: the rename introduced in v0.5.1 is preserved — `CACHE_DIR` still works with a deprecation warning. The default data path remains `data` (Docker: `/app/data`).
+
+- **Config file now lives in `DATA_DIR`**: `.immich_config.json` resolves to `DATA_DIR/.immich_config.json` so it persists across container restarts. The legacy CWD location is still checked as a fallback for existing setups.
+
+- **Diversity selector receives capacity as its limit directly**: instead of selecting up to `MAX_AUTO_IMAGES` and then slicing to the remaining capacity, the selector now runs with the actual remaining slot count as its budget.
+
+### Fixed
+
+- **Immich v2.7.5 compatibility**: `auto_configure` no longer pre-filters people by `assetCount` from `/api/people`, which Immich v2.7.5 dropped. The `MIN_FACE_COUNT` check now runs after `fetch_all_assets` using the actual fetched count.
+
+- **`fetch_face_data` no longer falls back to a wrong person's bounding box**: when `person_id` is provided but not found in the Immich `/api/faces` response, the function now returns `None` instead of using `faces[0]`. Previously a group photo where the target person's face entry was missing would inject a different person's bounding box into the crop.
+
+- **Corrupt thumbnail permanently rejected**: when `resp.ok=True` but `PIL.UnidentifiedImageError` is raised (Pillow cannot identify the image format), the asset is now marked rejected so it isn't re-downloaded on every future run. Transient `OSError`/truncation errors are intentionally not caught here — those are retried normally.
+
+- **`mark_uploaded` tracker failure no longer aborts the upload loop**: a tracker write failure after a successful Frigate POST is logged and the loop continues; the asset will be re-uploaded on the next run rather than the current run dying mid-job.
+
+- **`progress.remove_task` now in `finally` block**: the progress bar task is cleaned up even when a job exits via an exception, preventing orphaned progress rows in the terminal.
+
+- **`SKIP_PEOPLE`/`ONLY_PEOPLE` now strip whitespace**: `"Alice, Bob".split(",")` produces `[" Bob"]`; the leading space now stripped so comma-separated values with spaces work as expected.
+
+- **`FRIGATE_URL` with trailing slash no longer produces double-slash paths**: all Frigate API calls now use `_get_frigate_url()` for URL normalization rather than reading `FRIGATE_URL` inline.
+
+- **Frigate version `v`-prefix now stripped**: `v0.16.0`-style version strings are correctly parsed.
+
+- **Invalid numeric env var values warn and use defaults**: a typo such as `YEARS_FILTER=10 ` (trailing space) or `MIN_FACE_WIDTH=auto` now logs a `WARNING` and falls back to the documented default instead of raising `ValueError` at startup. Affects `YEARS_FILTER`, `MIN_FACE_WIDTH`, `MIN_FACE_COUNT`, `MAX_AUTO_IMAGES`, `BLUR_THRESHOLD`, `MIN_CONFIDENCE`, and `FACE_MARGIN`.
+
+- **`IMMICH_URL` blank placeholder falls back to config file**: `IMMICH_URL=` (empty or blank) in `.env` is now treated as unset and falls through to `DATA_DIR/.immich_config.json`, matching pre-v0.5.0 behaviour.
+
+- **Reconciliation checks Frigate immediately before first sleep**: the poll loop now performs an immediate check after upload, then backs off with `(1, 2, 4, 8)` s delays only if needed.
+
+- **Dockerfile unknown `VARIANT` now fails loudly**: an unrecognised value now exits with an error instead of silently falling through to the cpu branch.
+
+- **Embedding cache writes are now atomic**: `.npy` files are written to a `.tmp` sibling and renamed into place with `os.replace`, preventing truncated cache entries on process kill.
+
+- **`EmbeddingCache` singleton re-creates when `DATA_DIR` changes**: prevents test runs from sharing cache state across different `DATA_DIR` values.
+
+### Added
+
+- **Diversity test suite** (PR #11): 33 tests covering k-medoids clustering, farthest-point sampling, adaptive threshold computation, near-duplicate deduplication, and time-spread selection. Total: 93 tests.
+
+## [0.4.11] - 2026-06-14
+
+### Removed
+
+- **Object mode pipeline fully removed**: YOLO object detection, SigLIP image classification, `TRAINING_MODE`, and `OBJECT_CLASS` env vars are gone. Frigate has no training API for objects; the ~2 GB model stack (torch, torchvision, transformers, ultralytics) was dead weight.
+- **Dead Immich embedding path removed**: `FaceData.embedding` field and the `immich_embedding` parameter to `get_embedding()` were never consumed by any caller. Both removed along with the NumPy import in `immich_api.py` that existed solely for that path.
+- **Dead `mode` config key removed**: `"mode": "face"` was written into job config dicts in `jobs.py` but never read after object mode removal.
+
+### Fixed
+
+- **InsightFace `FutureWarning` suppressed in crop-alignment path**: the `insightface_app.get()` call in `image_processing.py` now wraps the same `warnings.catch_warnings()` suppressor already present in `embeddings.py`, preventing scikit-image deprecation noise in logs.
+
+### Changed
+
+- **Variant pyproject files synced to current state**: `pyproject-rocm.toml`, `pyproject-cpu.toml`, `pyproject-intel.toml` were at v0.2.13 and still listed torch/transformers/ultralytics. Updated to v0.4.11 and cleaned to face-only deps. Note: corresponding lockfiles (uv-rocm.lock, uv-cpu.lock, uv-intel.lock) need regeneration in their respective platform environments.
+- **`MERGE_DUPLICATE_PEOPLE` documented**: README and wiki now explain the default warn-and-skip behaviour vs. setting `true` for a permanent Immich merge, with irreversibility callout.
+- **Wiki fully updated**: all five wiki pages rewritten to remove object mode references, correct model size (~300 MB InsightFace vs former ~1–2 GB HuggingFace+InsightFace), fix default values (`MAX_AUTO_IMAGES` 80→20, `MIN_FACE_COUNT` 0→3), add `MERGE_DUPLICATE_PEOPLE` coverage, and update GPU verification commands for current ONNX provider API.
+
+## [0.4.10] - 2026-06-14
+
+### Changed
+
+- **`MAX_AUTO_IMAGES` default lowered from `80` to `20`**: winnow is designed to fill the gap where manual Frigate training images don't exist — not to be the primary dataset. A conservative default ensures winnow-imported images remain secondary to hand-picked ones where both exist.
+
+## [0.4.9] - 2026-06-14
+
+### Changed
+
+- **`FRIGATE_SCORE_CEILING` is now dynamic by default**: previously defaulted to `0` (disabled). Now unset (default) enables a self-calibrating novelty gate — below-cap candidates are skipped if their pre-upload Frigate score exceeds the most-redundant tracked file's score. This catches conditions already covered by manually-added Frigate images that winnow cannot track. Set `FRIGATE_SCORE_CEILING=0` to disable entirely; set a positive value (e.g. `0.85`) for a fixed hard ceiling.
+- **Quality replacement branches consolidated**: the Frigate-score and blur-score replacement paths in the upload loop shared identical structure. Merged into a single code path parameterised by score source and comparison direction.
+- **`MIN_FACE_COUNT` default raised from `0` to `3`**: people with fewer than 3 tagged photos produce degenerate training sets; skipping them by default avoids noisy runs.
+- **`STRATEGY=adaptive`** is the new primary name for embedding-based diversity selection; `auto` remains a silent alias for backwards compatibility.
+- **`MERGE_DUPLICATE_PEOPLE` and `TRACE_CROP_SIZE`** added to the README env var table (were in the codebase but undocumented).
+- **CUDA version corrected** in the image tags table (was 13.3, actual base image is 12.8.1).
+
+## [0.4.8] - 2026-06-14
+
+### Changed
+
+- **Tracker write-through cache**: `upload_tracker` now keeps an in-memory copy of each JSON file keyed by its resolved path. All reads after the first hit the cache instead of disk; writes go to both disk and cache atomically. Cuts per-person disk I/O in the upload loop from ~90 reads to ~1, with no API or behaviour changes.
+
+## [0.4.7] - 2026-06-14
+
+### Changed
+
+- **`_dedup_embeddings` pre-allocated buffer**: replaced the grow-on-keep `np.vstack` pattern with a pre-allocated `(Q, D)` buffer filled row-by-row. Eliminates O(K²) copy work and the GC pressure from K intermediate heap allocations while keeping identical arithmetic for the similarity checks.
+- **`_kmedoids` cost computation vectorized**: the Python-level `sum(dist_matrix[i, medoids[labels[i]]] for i in range(n))` generator (called once per swap evaluation) is replaced with `dist_matrix[np.arange(n), np.array(medoids)[labels]].sum()` — a single numpy fancy-index + reduction, ~20–50× faster in the swap loop.
+- **`_reconcile_frigate_mappings` single-write batch**: previously called `record_frigate_file` once per uploaded file, each doing a full JSON load + save (O(L) disk round-trips per person). Now builds the full `{frigate_filename: asset_id}` mapping dict and writes it in one `record_frigate_files_batch` call (O(1) disk round-trip).
+
+## [0.4.6] - 2026-06-14
+
+### Fixed
+
+- **OOM when Immich returns many pages per person**: `fetch_all_assets` now stops fetching once 5000 assets have been collected — the diversity selection pool is already capped at 3000 items, so fetching up to 1,000,000 was wasteful and could exhaust memory on large libraries. 5000 provides ample headroom for the pool cap while bounding per-person memory to ~2 MB.
+- **Non-dict items in Immich asset pages silently skipped**: a malformed or partially-null Immich response page could include `null` or non-object items in the assets array. These are now filtered at fetch time rather than causing `AttributeError` downstream.
+
+## [0.4.5] - 2026-06-14
+
+### Fixed
+
+- **Near-duplicate dedup O(N²) allocation**: `np.vstack(kept_normed)` was rebuilt on every loop iteration even for candidates that would be dropped; the stack is now rebuilt only when a new item is kept, reducing memory pressure significantly for large pools.
+- **`quality_score` falsy-zero in dedup sort**: the sort key used `c.get("quality_score") or 0.0`, which treated a legitimate `quality_score=0.0` identically to a missing key. Changed to an explicit `None` check so zero is preserved as-is, and object-mode candidates (which have no `quality_score`) continue to sort stably to the back.
+- **Post-dedup pool not re-checked against limit**: after near-duplicate removal the pool could silently shrink below the requested limit with no warning. A second `len < limit` guard now fires after dedup and emits the same "Only N embeddings" warning that the pre-dedup guard does.
+- **`mark_rejected` could miss plain-text 400 bodies longer than 100 bytes**: `error_detail = resp.text[:100]` was being searched for the keyword `"face"` to gate `mark_rejected()`, so a response body with `"face"` after byte 100 would never mark the asset rejected and it would be retried on every future run. The `"face"` check now uses the full response body; truncation is kept only for the displayed snippet.
+- **`_safe_person_dir` raised ValueError for all person names when `output_dir` resolved to `/`**: `base + os.sep` produced `"//"` when base was `"/"`, and valid paths like `/alice` don't start with `"//"`. Fixed by using `base` directly as the prefix when `base == os.sep`.
+
+## [0.4.4] - 2026-06-14
+
+### Added
+
+- **`RESET_PERSON=*` bulk reset**: resets every tracked person at once (deletes their Frigate training files and clears tracker data). Any other value still resets that specific person by name. If a person is literally named `*` they are reset as part of the bulk operation, and a warning is printed to clarify this.
+- **Near-duplicate removal before diversity selection**: a greedy dedup pass now runs after embedding collection and before clustering. Candidates within 0.20 cosine distance of a higher-quality image are dropped, eliminating burst shots and same-event lookalike photos that produce redundant training images. The best-quality frame from each near-identical group is kept. Dropped count is logged per person.
+
+### Fixed
+
+- **HTTP 500 upload errors no longer show Frigate's misleading "Try restarting Frigate" message**: the response body is now logged at debug level only. HTTP 400 detail (e.g. "No face was detected") is still shown since it is actionable.
+- **`RuntimeWarning: Mean of empty slice`** when a person has only one image after quality filtering: `_compute_adaptive_threshold` now returns the floor value immediately when there are no pairwise distances to sample, and the k-medoids cluster count is floored at 1 to prevent `k=0`.
+- **Path traversal guard on output directory**: person names with `../` sequences or absolute paths (e.g. `/etc`) are now rejected before any filesystem operation, logging an error and skipping the job rather than writing outside the output tree.
+
+## [0.4.3] - 2026-06-14
+
+### Added
+
+- **InsightFace landmark-based face crop alignment**: face crops for Frigate training are now aligned using InsightFace's `norm_crop` (ArcFace 112×112 alignment with 5-point facial landmarks). Previously, Immich's API returned only bounding boxes with no landmarks, so `align_face()` was dead code and crops were plain bbox slices — resulting in misaligned or partial crops (e.g. foreheads). The fix runs InsightFace detection on an expanded region around the Immich bbox, finds the nearest face, and uses its keypoints for proper alignment. Controlled by `ENABLE_FACE_ALIGNMENT` (default `true`).
+- **Duplicate Immich person detection and handling**: when multiple Immich person records share the same name, winnow now detects this at startup and warns with a per-group summary. Without handling, two jobs would run for the same Frigate folder and overwrite each other's output. By default (`MERGE_DUPLICATE_PEOPLE=false`) only the first person per name is processed. Set `MERGE_DUPLICATE_PEOPLE=true` to permanently merge duplicate records inside Immich (keeps the person with the most assets).
+
+## [0.4.2] - 2026-06-13
+
+### Changed
+
+- **GPU image now uses CUDA 12.8.1** (was 13.3): CUDA 13.3 requires driver ≥ 575; driver 570 (the current stable release) was incorrectly rejected with "CUDA driver version is insufficient" at startup. The `:latest` image now works with any NVIDIA driver ≥ 570.
+
+### Added
+
+- **`scripts/benchmark.py`**: measures InsightFace and SigLIP inference latency and throughput across GPU and CPU modes. Run inside the container with `python /app/scripts/benchmark.py`. RTX 2070 SUPER results: InsightFace 12.8 ms / 78 img/s (8× CPU), SigLIP batch 32 at 5.4 ms/img / 187 img/s (33× CPU).
+
+## [0.4.1] - 2026-06-13
+
+### Fixed
+
+- **`RESET_PERSON` no longer creates duplicate Frigate files**: previously, resetting a person only wiped the local tracker — existing Frigate training files were left as unmanaged orphans, causing the next run to upload a full new batch on top of them. `reset_person` now deletes all winnow-managed files for that person from Frigate before clearing the tracker. Manually-added Frigate files are unaffected.
+- **No spurious warning when `FRIGATE_URL` is unset and `RESET_PERSON` is used**: the deletion step is now skipped silently at info level rather than logging a misleading "could not delete" warning.
+
+## [0.4.0] - 2026-06-13
+
+### Added
+
+- **Pre-upload Frigate recognition scores**: `recognize_face` is now called before each upload to measure how novel the candidate is relative to the existing training set. The score is stored in the tracker (`frigate_scores` field) and drives quality replacement in subsequent runs. Adds ~200 ms per upload.
+- **`ENABLE_FRIGATE_SCORES`** (default `true`): controls all pre-upload Frigate recognize calls. Set `false` to use blur-score replacement only and skip the Frigate round-trip entirely.
+- **`FRIGATE_SCORE_CEILING`** (default `0.0`): skip uploads whose pre-upload recognize score already exceeds this value — those face conditions are already well-covered by the training set. `0` disables (no ceiling); requires at least one prior run to have stored scores.
+- **`get_most_redundant_mapped_file()`**: new upload-tracker function that returns the mapped file with the highest Frigate pre-upload score. High score = the training set already covers that face condition well = the best deletion target for quality replacement.
+- **Cold-start notice**: first run (no existing Frigate model) now logs a clear message explaining why Frigate scores are unavailable and that they will populate on subsequent runs.
+- **4 new tests** for `get_most_redundant_mapped_file` covering score ordering, ties, excludes, and no-score cases.
+
+### Changed
+
+- **Quality replacement now uses Frigate scores**: when Frigate scores are available, at-cap replacement targets the _most redundant_ mapped file (highest pre-upload score) and replaces it only when the candidate is _more novel_ (lower score). Falls back to blur-score comparison when no Frigate scores have been stored yet.
+- **`recognize_face` returns `(face_name, score) | None`** instead of `float | None`: the caller now validates that the recognized person matches the expected person before using the score. Wrong-person scores no longer drive ceiling skips or replacement decisions.
+- **Bootstrap fix**: recognize was previously called below-cap only when `FRIGATE_SCORE_CEILING > 0`, so `frigate_scores` was never populated with default settings and the Frigate replacement path never activated. Recognize is now called for all below-cap uploads when `ENABLE_FRIGATE_SCORES=true`, seeding scores for future at-cap runs regardless of ceiling setting.
+- **Batch GET `/api/faces`**: Frigate file-count lookups are now batched to reduce round-trip overhead on runs with many people.
+- **Skip candidate download on low Frigate confidence**: candidates where the Immich detection confidence is below threshold are now filtered before the full-resolution download, saving bandwidth.
+
+### Removed
+
+- **Post-upload quality gate (`FRIGATE_SCORE_THRESHOLD`)**: enforcement of a Frigate score threshold after upload has been removed. Post-upload scores are taken after the image is already in the training set, so the model has already retrained on it — deleting it at that point is wasteful and disrupts the model for the next Frigate run. Pre-upload scoring (`FRIGATE_SCORE_CEILING`) provides a cleaner signal at the right moment.
+
+### Fixed
+
+- **Frigate replacement path never activated with default settings**: with `FRIGATE_SCORE_CEILING=0.0` (default), the bootstrap call to `recognize_face` was gated behind `CEILING > 0`, so `frigate_scores` stayed empty, `has_frigate_scores` was always False, and the Frigate replacement branch was permanently unreachable. Removing the ceiling guard from the below-cap recognize call breaks the circular dependency.
+- **Schema comment contradiction**: `upload_tracker.py` line-16 comment described `frigate_scores` as "post-upload" while the block comment on lines 22–24 said "pre-upload". Corrected to "pre-upload" throughout.
+- **README default values**: `MIN_FACE_WIDTH` was documented as `50` (actual default: `90`); `BLUR_THRESHOLD` was documented as `100.0` (actual default: `120.0`). Both corrected.
+- **README missing env vars**: `FRIGATE_SCORE_CEILING` and `ENABLE_FRIGATE_SCORES` were present in `config.py` and `.env.example` but absent from the README env var table. Both added.
+- **README quality-replacement description**: Step 8 and the `QUALITY_REPLACEMENT` row now document the dual-mode behaviour (Frigate-score path and blur-score fallback) instead of describing only the original blur-score path.
+
+## [0.3.3] - 2026-06-13
+
+### Fixed
+
+- **`MIN_FACE_WIDTH` default raised from 50 → 90px**: 50px crops produce 2,500–4,225 total pixels, well below Frigate's own camera capture range of 16k–50k px. 90px guarantees ≥8,100 total pixels even when face margins are fully clipped by image edges, keeping winnow training crops above the floor Frigate considers useful.
+
 ## [0.3.2] - 2026-06-13
 
 ### Added

CONTRIBUTING.md

@@ -36,6 +36,10 @@ CI runs both on every push and PR to `main` and `dev`. PRs must pass before merg
 - Keep the `CHANGELOG.md` entry in the `[Unreleased]` section updated.
 - Commit messages should be plain English describing what changed and why.
 
+## Development Tooling
+
+Development uses Claude Code (Anthropic) for implementation assistance. All code is reviewed and the final call on design, behavior, and what ships is made by the maintainer. Contributions from humans are equally welcome.
+
 ## License
 
 By submitting a contribution you agree that your work will be released under the project's [AGPLv3+ license](LICENSE).

Dockerfile

@@ -1,16 +1,17 @@
 # ── Base images ───────────────────────────────────────────────────────────────
-#   amd64 + gpu:   NVIDIA CUDA 13.3 + cuDNN (GPU acceleration via NVIDIA Container Toolkit)
-#   amd64 + rocm:  Ubuntu 22.04 (AMD GPU via ROCm — pass /dev/kfd and /dev/dri)
+#   amd64 + gpu:   NVIDIA CUDA 12.8 + cuDNN on Ubuntu 24.04 (highest Ubuntu NVIDIA publishes)
+#   amd64 + rocm:  Ubuntu 26.04 (AMD GPU via ROCm — pass /dev/kfd and /dev/dri)
 #   amd64 + intel: Ubuntu 22.04 (Intel Arc / iGPU via OpenVINO — pass /dev/dri)
-#   amd64 + cpu:   Ubuntu 22.04 (CPU-only, ~2 GB smaller image)
+#                  Note: intel stays on 22.04 — Intel's GPU repo only publishes for jammy
+#   amd64 + cpu:   Ubuntu 26.04 (CPU-only, ~2 GB smaller image)
 #   arm64:         Ubuntu 24.04 (CPU-only; no CUDA/ROCm wheels on ARM)
 
 ARG VARIANT=gpu
 
-FROM --platform=$BUILDPLATFORM nvidia/cuda:13.3.0-cudnn-runtime-ubuntu22.04 AS base-amd64-gpu
-FROM ubuntu:22.04 AS base-amd64-rocm
+FROM --platform=$BUILDPLATFORM nvidia/cuda:12.8.1-cudnn-runtime-ubuntu24.04 AS base-amd64-gpu
+FROM ubuntu:26.04 AS base-amd64-rocm
 FROM ubuntu:22.04 AS base-amd64-intel
-FROM ubuntu:22.04 AS base-amd64-cpu
+FROM ubuntu:26.04 AS base-amd64-cpu
 FROM ubuntu:24.04 AS base-arm64-gpu
 FROM ubuntu:24.04 AS base-arm64-rocm
 FROM ubuntu:24.04 AS base-arm64-intel
@@ -24,8 +25,9 @@ FROM base-${TARGETARCH}-${VARIANT} AS build
 ARG VARIANT=gpu
 ENV DEBIAN_FRONTEND=noninteractive
 
-# Both Ubuntu 22.04 and 24.04 get Python 3.13 from the deadsnakes PPA.
-# GNUPGHOME is isolated so gpg never contacts an agent socket under QEMU.
+# All base images get Python 3.13 from the deadsnakes PPA (26.04 ships 3.14 natively;
+# 3.13 is used to keep dependencies tested and aligned). GNUPGHOME is isolated
+# so gpg never contacts an agent socket under QEMU.
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates curl gnupg software-properties-common \
     && GNUPGHOME=$(mktemp -d) add-apt-repository ppa:deadsnakes/ppa -y \
@@ -36,23 +38,24 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/* \
     && ln -sf /usr/bin/python3.13 /usr/bin/python3
 
-RUN curl -LsSf https://astral.sh/uv/install.sh | sh \
-    && cp /root/.local/bin/uv /usr/local/bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.11.21 /uv /usr/local/bin/uv
 
 WORKDIR /app
 
-# Swap in the variant-specific pyproject and lockfile before syncing.
-COPY pyproject.toml uv.lock pyproject-cpu.toml uv-cpu.lock \
-     pyproject-rocm.toml uv-rocm.lock pyproject-intel.toml uv-intel.lock ./
+COPY pyproject.toml uv.lock ./
 RUN if [ "$VARIANT" = "cpu" ]; then \
-        cp pyproject-cpu.toml pyproject.toml && cp uv-cpu.lock uv.lock; \
+        uv sync --frozen --no-dev --extra cpu; \
     elif [ "$VARIANT" = "rocm" ]; then \
-        cp pyproject-rocm.toml pyproject.toml && cp uv-rocm.lock uv.lock; \
+        uv sync --frozen --no-dev --extra rocm; \
     elif [ "$VARIANT" = "intel" ]; then \
-        cp pyproject-intel.toml pyproject.toml && cp uv-intel.lock uv.lock; \
+        uv sync --frozen --no-dev --extra intel; \
+    elif [ "$VARIANT" = "gpu" ]; then \
+        uv sync --frozen --no-dev --extra gpu; \
+    else \
+        echo "Unknown VARIANT: '$VARIANT'. Must be one of: cpu, rocm, intel, gpu" >&2; \
+        exit 1; \
     fi && \
-    uv sync --frozen --no-dev \
-    && uv cache clean
+    uv cache clean
 
 COPY winnow/ winnow/
 COPY entrypoint.sh scheduler.py ./
@@ -67,7 +70,7 @@ FROM base-${TARGETARCH}-${VARIANT} AS runtime
 ARG VARIANT=gpu
 ARG VERSION=dev
 LABEL org.opencontainers.image.title="winnow" \
-      org.opencontainers.image.description="Selects diverse, high-quality photos from Immich as training data for Frigate face recognition and object classification." \
+      org.opencontainers.image.description="Selects diverse, high-quality photos from Immich as training data for Frigate face recognition." \
       org.opencontainers.image.source="https://github.com/sudolulo/winnow" \
       org.opencontainers.image.licenses="AGPL-3.0-or-later" \
       org.opencontainers.image.version="${VERSION}"
@@ -116,7 +119,7 @@ https://repositories.intel.com/graphics/ubuntu jammy flex" \
     fi
 
 RUN groupadd -g 568 apps && useradd -u 568 -g apps -m -s /bin/bash appuser \
-    && mkdir -p /models/.insightface /models/huggingface \
+    && mkdir -p /models/.insightface \
     && chown -R appuser:apps /app /models
 
 WORKDIR /app
@@ -124,7 +127,8 @@ USER appuser
 # PYTHONPATH=/app makes the winnow package importable from the entry point script.
 # uv sync builds the wheel before winnow/ is COPY'd, so site-packages has only
 # the dist-info. Explicitly adding /app lets Python find winnow/__init__.py there.
-ENV HF_HOME=/models/huggingface INSIGHTFACE_HOME=/models/.insightface PYTHONPATH=/app
+ENV INSIGHTFACE_HOME=/models/.insightface PYTHONPATH=/app
 
-HEALTHCHECK CMD test -f /app/entrypoint.sh || exit 1
+HEALTHCHECK --interval=60s --timeout=5s --start-period=120s --retries=3 \
+    CMD sh -c 'if [ -f /tmp/winnow.pid ]; then kill -0 "$(cat /tmp/winnow.pid)"; fi'
 ENTRYPOINT ["tini", "--", "/app/entrypoint.sh"]

README.md

@@ -2,11 +2,18 @@
 
 [![Docker](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/docker-publish.yml) [![Test](https://github.com/sudolulo/winnow/actions/workflows/test.yml/badge.svg)](https://github.com/sudolulo/winnow/actions/workflows/test.yml) [![GitHub release](https://img.shields.io/github/v/release/sudolulo/winnow)](https://github.com/sudolulo/winnow/releases/latest) [![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE) [![Immich](https://img.shields.io/badge/Immich-v1.106%2B-blueviolet)](https://immich.app) [![Frigate](https://img.shields.io/badge/Frigate-Ready-brightgreen)](https://frigate.video)
 
+> **Note:** winnow's approach to training Frigate face recognition is not an officially documented workflow — results may vary.
+
+> **Early Development — Use With Caution**
+> winnow is in an unfinished state and maturing. Features that modify your Frigate training data — quality replacement, stale mapping cleanup — can remove images from your dataset and are not yet battle-tested at scale. Review the logs after each run and keep backups of your Frigate face training directory until you are confident in the results.
+
 **Docs:** [Setup](https://github.com/sudolulo/winnow/wiki/Setup) · [Troubleshooting](https://github.com/sudolulo/winnow/wiki/Troubleshooting) · [FAQ](https://github.com/sudolulo/winnow/wiki/FAQ)
 
-`winnow` pulls photos from your [Immich](https://immich.app) library, selects the most diverse and highest-quality subset using AI embeddings, and delivers them as training data for [Frigate](https://frigate.video)'s face recognition and object classification models.
+`winnow` pulls photos from your [Immich](https://immich.app) library, selects the most diverse and highest-quality subset using AI embeddings, and delivers them as training data for [Frigate](https://frigate.video)'s face recognition.
 
-Frigate's face recognition is only as good as its training data — and the key quality metric is **diversity**, not volume. A hundred photos from the same week teach the model one lighting condition. What you need is a spread: different years, different angles, different lighting, different contexts. Your photo library already has that data. winnow finds and delivers the right subset automatically.
+The best Frigate training data is images you curate manually — photos taken specifically for recognition, in controlled conditions, uploaded directly through Frigate's UI. Winnow is meant to supplement people in your library, not replace manual training. In some cases one has people they would like to recognize that do not occur in detections often enough to train a diverse dataset. This is meant to fill that gap.
+
+> **winnow only touches files it uploaded.** Faces added to Frigate manually through its UI are never deleted, replaced, or modified — not by quality replacement, not by `RESET_PERSON`, not by stale cleanup. Your manually curated images are always the primary dataset; winnow only adds to it.
 
 ---
 
@@ -20,7 +27,7 @@ Immich library
       │
       ▼
 2. Filter by recency (YEARS_FILTER) and skip already-uploaded
-   and rejected assets (persistent tracker in CACHE_DIR)
+   and rejected assets (persistent tracker in DATA_DIR)
       │
       ▼
 3. Quality filter — download preview thumbnails and reject:
@@ -32,46 +39,42 @@ Immich library
       │
       ▼
 4. Compute embeddings from the same preview thumbnails
-   • Faces   → InsightFace (ArcFace / Buffalo_L)  → 512-dim vector
-   • Objects → SigLIP (Vision Transformer)         → 768-dim vector
+   • InsightFace (ArcFace / Buffalo_L) → 512-dim vector
       │
       ▼
-5. Diversity selection
+5. Near-duplicate removal — greedy cosine-distance pass drops burst shots
+   and near-identical photos before clustering runs; the highest-quality
+   image from each near-duplicate group is kept
+      │
+      ▼
+6. Diversity selection
    • K-Medoids clustering → one representative per natural group
    • Farthest Point Sampling → fill remaining slots with maximally spread picks
-   • Hard example weighting — unusual angles and low-confidence detections
-     are biased toward selection, since those are where models tend to fail
-   • Auto mode: stops when similarity to the existing set exceeds a threshold
-     (20 % of median pairwise distance for faces, 10 % for objects)
+   • Hard example weighting — low-confidence detections get a distance boost
+     so unusual angles and harder looks are preferred over easy frontals
+   • Adaptive mode: stops when the next candidate is too similar to those already
+     selected (distance threshold = 20 % of median pairwise distance)
       │
       ▼
-6. Download full-resolution originals from Immich
+7. Download full-resolution originals from Immich
       │
       ▼
-7. Crop and process
-   • Face mode: EXIF-corrected, landmark-aligned 112×112 crop (ArcFace format)
-   • Object mode: YOLOv9c detection → one crop per matched instance
+8. Crop and process — EXIF-corrected, landmark-aligned 112×112 crop (ArcFace format)
       │
       ▼
-8. Deliver
-   • Face mode: upload crops to Frigate's face registration API
-     ↳ below MAX_AUTO_IMAGES — upload freely
-     ↳ at cap + QUALITY_REPLACEMENT=true — swap the lowest-scoring tracked
-       image if the new candidate scores higher; manually added files are
-       never touched
-     ↳ at cap + QUALITY_REPLACEMENT=false — skip this person
-   • Object mode: save crops to disk → place into your Frigate data directory
+9. Deliver — upload crops to Frigate's face registration API
+   ↳ below MAX_AUTO_IMAGES — upload, unless the novelty gate
+     (FRIGATE_SCORE_CEILING) determines the candidate is already
+     covered by the current training set
+   ↳ at cap + QUALITY_REPLACEMENT=true — with Frigate scoring active,
+     swap the most redundant tracked image (highest pre-upload recognize
+     score) if the candidate is more novel (lower score); falling back to
+     blur-score comparison when no Frigate scores are available; manually
+     added files are never touched
+   ↳ at cap + QUALITY_REPLACEMENT=false — skip this person
 ```
 
-Uploaded and rejected asset IDs are persisted across runs. The same image is never processed twice; Frigate rejections are permanently skipped unless `RETRY_REJECTED=true`.
-
----
-
-## Modes
-
-**Face mode** (default) — extracts face crops using Immich's bounding box metadata, applies EXIF orientation correction, and aligns them to ArcFace's standard 112×112 format using 5-point facial landmarks. Crops are uploaded directly to Frigate's face registration API.
-
-**Object mode** — runs each full-resolution image through YOLOv9c to detect instances of a target class (dog, cat, car, etc.), crops each detection, and saves it to the output directory. Frigate has no API for uploading object training data; place the crops into your Frigate data directory manually.
+Uploaded and rejected asset IDs are persisted across runs in two JSON files (`frigate_uploaded_ids.json` and `frigate_rejected_ids.json` in `DATA_DIR`). The same image is never processed twice; rejected assets are permanently skipped unless `RETRY_REJECTED=true`.
 
 ---
 
@@ -81,7 +84,7 @@ Uploaded and rejected asset IDs are persisted across runs. The same image is nev
 
 | Tag | Arch | Acceleration |
 | :-- | :-- | :-- |
-| `:latest` | amd64 + arm64 | NVIDIA CUDA 13.3 (amd64) · requires [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html) |
+| `:latest` | amd64 | NVIDIA CUDA 12.8 · requires [NVIDIA Container Toolkit](https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/install-guide.html) |
 | `:rocm` | amd64 | AMD ROCm · pass `/dev/kfd` + `/dev/dri` |
 | `:intel` | amd64 | Intel Arc / iGPU via OpenVINO · pass `/dev/dri`, set `OPENVINO_DEVICE=GPU` |
 | `:cpu` | amd64 + arm64 | CPU only · ~2 GB smaller · no GPU required |
@@ -99,8 +102,8 @@ services:
       - FRIGATE_URL=http://192.168.1.10:5000
       - CRON_SCHEDULE=0 3 * * 0
     volumes:
-      - /path/to/models:/models
-      - /path/to/cache:/app/.if_cache
+      - /path/to/models:/models    # INSIGHTFACE_HOME — persists Buffalo_L model (~300 MB)
+      - /path/to/data:/app/data
       - /path/to/output:/app/frigate_train
     deploy:
       resources:
@@ -145,7 +148,7 @@ See [compose.yml](compose.yml) for the full annotated example with all options.
 | *(empty string)* | Stay alive, run nothing — trigger manually with `docker exec -it winnow winnow` |
 | Cron expression | Run on startup, then repeat on schedule |
 
-In scheduled mode the process (and loaded models) stays resident between runs. The first run after a fresh install downloads the embedding models (~1–2 GB); subsequent runs use the cached models from the mounted volume.
+In scheduled mode the process (and loaded models) stays resident between runs. The first run after a fresh install downloads InsightFace Buffalo_L (~300 MB); subsequent runs use the cached model from the mounted volume.
 
 ---
 
@@ -163,11 +166,9 @@ In scheduled mode the process (and loaded models) stays resident between runs. T
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `TRAINING_MODE` | `face` | `face` — upload crops to Frigate; `object` — save crops to disk |
-| `STRATEGY` | `auto` | `auto` (embedding-based adaptive), `standard` (30 images), `broad` (100 images) |
+| `STRATEGY` | `adaptive` | `adaptive` — embedding-based diversity selection, stops when candidates become redundant; `standard` — fixed 30 images; `broad` — fixed 100 images |
 | `LIMIT` | *(unset)* | Exact image count — overrides `STRATEGY` |
-| `OBJECT_CLASS` | `dog` | Target class for object mode (any YOLO class: `dog`, `cat`, `car`, etc.) |
-| `AUTO_MODE` | *(auto)* | Force non-interactive mode in a terminal; auto-detected otherwise |
+| `AUTO_MODE` | *(auto)* | Skip interactive prompts and process all people unattended — auto-detected when no TTY is present (Docker, cron); set `true` to force in a terminal |
 | `VERBOSE` | `false` | Enable DEBUG-level console output (log file is always DEBUG) |
 
 ### People Filtering
@@ -176,21 +177,33 @@ In scheduled mode the process (and loaded models) stays resident between runs. T
 | :--- | :--- | :--- |
 | `ONLY_PEOPLE` | *(unset)* | Comma-separated whitelist — process only these people |
 | `SKIP_PEOPLE` | *(unset)* | Comma-separated list — skip these people |
-| `MIN_FACE_COUNT` | `0` | Skip people with fewer than N tagged assets in Immich |
+| `MIN_FACE_COUNT` | `3` | Skip people with fewer than N tagged assets in Immich |
+| `MERGE_DUPLICATE_PEOPLE` | `false` | When Immich has duplicate entries for the same person (same face split across multiple names), merge their asset pools before processing. Without this, each duplicate group emits a warning and is skipped |
 | `YEARS_FILTER` | `10` | Ignore images older than N years |
 
+> **Duplicate people detection** — winnow warns at startup if the same name appears on multiple Immich person records (a common side-effect of Immich's face clustering creating separate pools for the same individual). By default (`false`) it logs the duplicates, keeps only the person with the most assets, and skips the rest — no data is changed. Set `MERGE_DUPLICATE_PEOPLE=true` to permanently merge each duplicate group inside Immich (the person with the most assets absorbs the others). **This modifies Immich and cannot be undone.** Only enable it once you've verified the duplicates are actually the same person.
+
 ### Image Quality
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `MIN_FACE_WIDTH` | `50` | Minimum face crop width in pixels |
+| `MAX_AUTO_IMAGES` | `20` | Maximum training images per person in Frigate |
+| `QUALITY_REPLACEMENT` | `true` | When at cap, swap a weaker tracked image for a better candidate. With Frigate scoring active, targets the most redundant image (highest pre-upload recognize score); otherwise uses blur score. Never touches manually added Frigate files. Set `false` to skip people at cap |
+
+#### Advanced Tuning *(calibrated — do not adjust)*
+
+These defaults are tuned for Frigate's ArcFace requirements. winnow will warn on launch if any are set. Image quality issues caused by non-default values will not be investigated.
+
+| Variable | Default | Description |
+| :--- | :--- | :--- |
+| `ENABLE_FRIGATE_SCORES` | `true` | Call Frigate's recognize endpoint pre-upload to store diversity scores used for quality replacement. Adds ~200 ms per upload. Disabling also disables the below-cap novelty gate |
+| `FRIGATE_SCORE_CEILING` | *(unset)* | Below-cap novelty gate. Unset: dynamic — skips candidates whose Frigate score exceeds the most-redundant tracked file's score, auto-calibrates each run. `0`: disable entirely. Positive value (e.g. `0.85`): fixed hard ceiling |
+| `MIN_FACE_WIDTH` | `90` | Minimum face crop width in pixels |
 | `FACE_MARGIN` | `0.15` | Padding around bounding box crop (fraction of face size) |
 | `ENABLE_FACE_ALIGNMENT` | `true` | Align to ArcFace 112×112 format using facial landmarks |
 | `USE_FULL_RESOLUTION` | `true` | Download full-resolution originals rather than preview thumbnails |
 | `MIN_CONFIDENCE` | `0.7` | Minimum Immich face detection confidence |
-| `BLUR_THRESHOLD` | `100.0` | Laplacian variance threshold — lower accepts more blur |
-| `MAX_AUTO_IMAGES` | `80` | Maximum training images per person in Frigate |
-| `QUALITY_REPLACEMENT` | `true` | When at cap, swap the lowest-scoring tracked image for a better candidate. Never touches manually added Frigate files. Set `false` to skip people already at cap |
+| `BLUR_THRESHOLD` | `120.0` | Laplacian variance threshold — lower accepts more blur |
 
 ### GPU & Models
 
@@ -199,23 +212,23 @@ In scheduled mode the process (and loaded models) stays resident between runs. T
 | `FORCE_CPU` | `false` | Disable GPU — fall back to CPU for all inference |
 | `OPENVINO_DEVICE` | `CPU` | Intel variant only: set `GPU` to use Arc or iGPU; default runs on CPU |
 | `ENABLE_CACHE` | `true` | Cache computed embeddings to disk (speeds up re-runs on the same library) |
-| `CACHE_DIR` | `.if_cache` | Path for embedding cache and upload tracker files |
-| `HF_HOME` | *(system)* | HuggingFace model cache path (SigLIP) |
+| `DATA_DIR` | `data` | Path for embedding cache and upload tracker JSON files |
 | `INSIGHTFACE_HOME` | *(system)* | InsightFace model cache path (Buffalo_L) |
 
 ### Output
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
-| `OUTPUT_DIR` | `./frigate_train` | Directory for object-mode crops and the `winnow.log` file. In Docker, set this via the volume mount instead. |
+| `OUTPUT_DIR` | `./frigate_train` | Directory where face crops are staged before upload and where `winnow.log` is written. In Docker, set this via the volume mount instead. |
 
 ### Tracker Overrides *(one-shot — remove after use)*
 
 | Variable | Default | Description |
 | :--- | :--- | :--- |
 | `DRY_RUN` | `false` | Preview selection without downloading or uploading |
-| `RETRY_REJECTED` | `false` | Re-attempt assets previously rejected by Frigate |
-| `RESET_PERSON` | *(unset)* | Clear upload and rejection history for one person by name |
+| `RETRY_REJECTED` | `false` | Re-attempt all previously rejected assets (low-confidence skips, Frigate rejections, and other permanent exclusions) |
+| `RESET_PERSON` | *(unset)* | Set to a person's name to clear their upload history and delete their winnow-managed Frigate training files so the next run starts fresh. Set to `*` to reset all tracked people at once. Manually added Frigate files are never touched |
+| `TRACE_CROP_SIZE` | *(unset)* | Debug: print all tracked crops whose width or height matches this pixel value, then exit |
 
 ### Scheduling
 
@@ -236,14 +249,14 @@ uv run winnow
 
 Requires Python 3.13+ and [uv](https://astral.sh/uv). An NVIDIA, AMD, or Intel GPU is recommended — CPU mode works but embedding computation is slower.
 
-When run with a terminal attached, winnow starts an interactive session: select which people to process and choose a strategy (auto, standard, broad, or a custom count) per person. Without a TTY — Docker, cron, or `AUTO_MODE=true` — it processes all people automatically using the configured defaults.
+When run with a terminal attached, winnow starts an interactive session: select which people to process and choose a strategy (adaptive, standard, broad, or a custom count) per person. Without a TTY — Docker, cron, or `AUTO_MODE=true` — it processes all people unattended using the configured defaults.
 
 ---
 
 ## Requirements
 
 - **Immich** v1.106+
-- **Frigate** v0.16+ (face mode only — object mode has no Frigate dependency)
+- **Frigate** v0.16+
 - **GPU** recommended: NVIDIA (CUDA), AMD (ROCm), or Intel (Arc / iGPU via OpenVINO)
 - **Python** 3.13+
 

compose.yml

@@ -13,19 +13,16 @@ services:
       # Set AUTO_MODE=true to force auto mode in an interactive terminal.
       # To run interactively: docker exec -it winnow winnow
       # - VERBOSE=true                # Enable DEBUG-level console output
-      # TRAINING_MODE: face = upload to Frigate face recognition API
-      #                object = save crops to output dir for manual Frigate placement
-      - TRAINING_MODE=face
       # STRATEGY: auto = objective diversity (recommended), standard = 30 imgs, broad = 100 imgs
       - STRATEGY=auto
       # - LIMIT=50                    # Custom image count; overrides STRATEGY preset
-      # - OBJECT_CLASS=dog            # Object label for object mode (e.g. dog, cat, car)
 
       # ── People Filtering ──────────────────────────────────────────────────
       # - ONLY_PEOPLE=John,Jane       # Comma-separated; process only these people
       # - SKIP_PEOPLE=Unknown         # Comma-separated; skip these people
       # - MIN_FACE_COUNT=5            # Skip people with fewer than N assets in Immich
       # - YEARS_FILTER=10             # Only include images from the last N years (default: 10)
+      # - MERGE_DUPLICATE_PEOPLE=true # Auto-merge Immich people with the same name (keeps most assets)
 
       # ── Image Quality ─────────────────────────────────────────────────────
       # - MIN_FACE_WIDTH=50           # Minimum face width in pixels (default: 50)
@@ -34,14 +31,13 @@ services:
       # - USE_FULL_RESOLUTION=true    # Use full-res images vs thumbnails (default: true)
       # - MIN_CONFIDENCE=0.7          # Minimum face detection confidence (default: 0.7)
       # - BLUR_THRESHOLD=100.0        # Laplacian blur threshold; lower = accept more blur (default: 100.0)
-      # - MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 80)
+      # - MAX_AUTO_IMAGES=80          # Hard cap on auto-diversity selection (default: 20)
 
       # ── Caching & Models ──────────────────────────────────────────────────
       # - FORCE_CPU=true              # Disable GPU, fall back to CPU
       # - OPENVINO_DEVICE=GPU         # Intel variant only: use Arc/iGPU instead of CPU (default: CPU)
       # - ENABLE_CACHE=false          # Disable embedding cache (default: true)
-      - CACHE_DIR=/app/.if_cache
-      - HF_HOME=/models/huggingface
+      - DATA_DIR=/app/data
       - INSIGHTFACE_HOME=/models/.insightface
 
       # ── Tracker overrides (one-shot, remove after use) ────────────────────
@@ -61,7 +57,7 @@ services:
     volumes:
       # Replace with absolute paths on your host, e.g. /opt/winnow/models
       - /path/to/winnow/models:/models
-      - /path/to/winnow/cache:/app/.if_cache
+      - /path/to/winnow/data:/app/data
       - /path/to/winnow/output:/app/frigate_train
     restart: unless-stopped
 

pyproject-cpu.toml

@@ -1,93 +0,0 @@
-[project]
-name = "winnow"
-version = "0.2.13"
-description = "Immich to Frigate training sets"
-license = "AGPL-3.0-or-later"
-requires-python = ">=3.13"
-authors = [{ name = "Holden Salomon", email = "holden@arch.fyi" }]
-keywords = ["immich", "frigate", "face-recognition", "training-data", "arcface", "insightface"]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
-    "Programming Language :: Python :: 3.13",
-    "Topic :: Scientific/Engineering :: Image Recognition",
-]
-dependencies = [
-    "croniter>=5.0.2",
-    "insightface>=0.7.3",
-    "numpy>=2.2.6",
-    "onnxruntime>=1.23.2",
-    "opencv-python-headless>=4.12.0.88",
-    "pillow>=12.1.0",
-    "python-dotenv>=1.2.1",
-    "requests>=2.32.5",
-    "rich>=14.2.0",
-    "torch>=2.12.0",
-    "torchvision>=0.27.0",
-    "transformers>=5.12.0",
-    "ultralytics>=8.4.66",
-]
-
-[project.scripts]
-winnow = "winnow.cli:main"
-
-[project.urls]
-Repository = "https://github.com/sudolulo/winnow"
-
-[tool.uv]
-required-environments = [
-    "sys_platform == 'linux' and platform_machine == 'x86_64'",
-]
-
-[tool.uv.sources]
-torch = [
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-torchvision = [
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-
-[[tool.uv.index]]
-name = "pytorch-cpu"
-url = "https://download.pytorch.org/whl/cpu"
-explicit = true
-
-[dependency-groups]
-dev = [
-    "pytest>=8.0",
-    "ruff>=0.15.17",
-]
-
-[tool.hatch.build.targets.wheel]
-packages = ["winnow"]
-
-[tool.ruff]
-line-length = 120
-target-version = "py313"
-
-[tool.ruff.lint]
-select = ["E", "F", "I"]
-
-[tool.deptry]
-pep621_dev_dependency_groups = ["dev"]
-
-[tool.deptry.package_module_name_map]
-pillow = "PIL"
-opencv-python-headless = "cv2"
-python-dotenv = "dotenv"
-insightface = "insightface"
-numpy = "numpy"
-onnxruntime = "onnxruntime"
-requests = "requests"
-rich = "rich"
-torch = "torch"
-transformers = "transformers"
-ultralytics = "ultralytics"
-
-[tool.pytest.ini_options]
-testpaths = ["tests"]
-
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"

pyproject-intel.toml

@@ -1,103 +0,0 @@
-[project]
-name = "winnow"
-version = "0.2.13"
-description = "Immich to Frigate training sets"
-license = "AGPL-3.0-or-later"
-requires-python = ">=3.13"
-authors = [{ name = "Holden Salomon", email = "holden@arch.fyi" }]
-keywords = ["immich", "frigate", "face-recognition", "training-data", "arcface", "insightface"]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
-    "Programming Language :: Python :: 3.13",
-    "Topic :: Scientific/Engineering :: Image Recognition",
-]
-dependencies = [
-    "croniter>=5.0.2",
-    "insightface>=0.7.3",
-    "numpy>=2.2.6",
-    "onnxruntime-openvino>=1.20.0",
-    "opencv-python-headless>=4.12.0.88",
-    "pillow>=12.1.0",
-    "python-dotenv>=1.2.1",
-    "requests>=2.32.5",
-    "rich>=14.2.0",
-    "torch>=2.12.0",
-    "torchvision>=0.27.0",
-    "transformers>=5.12.0",
-    "ultralytics>=8.4.66",
-]
-
-[project.scripts]
-winnow = "winnow.cli:main"
-
-[project.urls]
-Repository = "https://github.com/sudolulo/winnow"
-
-[tool.uv]
-conflicts = [
-    [
-        { package = "onnxruntime" },
-        { package = "onnxruntime-gpu" },
-        { package = "onnxruntime-openvino" },
-    ],
-]
-required-environments = [
-    "sys_platform == 'linux' and platform_machine == 'x86_64'",
-]
-
-[tool.uv.sources]
-torch = [
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-torchvision = [
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-
-[[tool.uv.index]]
-name = "pytorch-cpu"
-url = "https://download.pytorch.org/whl/cpu"
-explicit = true
-
-[dependency-groups]
-dev = [
-    "pytest>=8.0",
-    "ruff>=0.15.17",
-]
-
-[tool.hatch.build.targets.wheel]
-packages = ["winnow"]
-
-[tool.ruff]
-line-length = 120
-target-version = "py313"
-
-[tool.ruff.lint]
-select = ["E", "F", "I"]
-
-[tool.deptry]
-pep621_dev_dependency_groups = ["dev"]
-
-[tool.deptry.package_module_name_map]
-pillow = "PIL"
-opencv-python-headless = "cv2"
-python-dotenv = "dotenv"
-insightface = "insightface"
-numpy = "numpy"
-onnxruntime-openvino = "onnxruntime"
-requests = "requests"
-rich = "rich"
-torch = "torch"
-transformers = "transformers"
-ultralytics = "ultralytics"
-
-[tool.deptry.per_rule_ignores]
-DEP002 = ["onnxruntime-openvino"]
-
-[tool.pytest.ini_options]
-testpaths = ["tests"]
-
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"

pyproject-rocm.toml

@@ -1,103 +0,0 @@
-[project]
-name = "winnow"
-version = "0.2.13"
-description = "Immich to Frigate training sets"
-license = "AGPL-3.0-or-later"
-requires-python = ">=3.13"
-authors = [{ name = "Holden Salomon", email = "holden@arch.fyi" }]
-keywords = ["immich", "frigate", "face-recognition", "training-data", "arcface", "insightface"]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
-    "Programming Language :: Python :: 3.13",
-    "Topic :: Scientific/Engineering :: Image Recognition",
-]
-dependencies = [
-    "croniter>=5.0.2",
-    "insightface>=0.7.3",
-    "numpy>=2.2.6",
-    "onnxruntime-rocm>=1.16.0",
-    "opencv-python-headless>=4.12.0.88",
-    "pillow>=12.1.0",
-    "python-dotenv>=1.2.1",
-    "requests>=2.32.5",
-    "rich>=14.2.0",
-    "torch>=2.5.0",
-    "torchvision>=0.20.0",
-    "transformers>=5.12.0",
-    "ultralytics>=8.4.66",
-]
-
-[project.scripts]
-winnow = "winnow.cli:main"
-
-[project.urls]
-Repository = "https://github.com/sudolulo/winnow"
-
-[tool.uv]
-index-strategy = "unsafe-best-match"
-conflicts = [
-    [
-        { package = "onnxruntime" },
-        { package = "onnxruntime-gpu" },
-        { package = "onnxruntime-rocm" },
-    ],
-]
-required-environments = [
-    "sys_platform == 'linux' and platform_machine == 'x86_64'",
-]
-
-[tool.uv.sources]
-torch = [
-    { index = "pytorch-rocm63", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-torchvision = [
-    { index = "pytorch-rocm63", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-]
-
-[[tool.uv.index]]
-name = "pytorch-rocm63"
-url = "https://download.pytorch.org/whl/rocm6.3"
-
-[dependency-groups]
-dev = [
-    "pytest>=8.0",
-    "ruff>=0.15.17",
-]
-
-[tool.hatch.build.targets.wheel]
-packages = ["winnow"]
-
-[tool.ruff]
-line-length = 120
-target-version = "py313"
-
-[tool.ruff.lint]
-select = ["E", "F", "I"]
-
-[tool.deptry]
-pep621_dev_dependency_groups = ["dev"]
-
-[tool.deptry.package_module_name_map]
-pillow = "PIL"
-opencv-python-headless = "cv2"
-python-dotenv = "dotenv"
-insightface = "insightface"
-numpy = "numpy"
-onnxruntime-rocm = "onnxruntime"
-requests = "requests"
-rich = "rich"
-torch = "torch"
-transformers = "transformers"
-ultralytics = "ultralytics"
-
-[tool.deptry.per_rule_ignores]
-DEP002 = ["onnxruntime-rocm"]
-
-[tool.pytest.ini_options]
-testpaths = ["tests"]
-
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "winnow"
-version = "0.3.2"
-description = "Selects diverse, high-quality photos from Immich as training data for Frigate face recognition and object classification."
+version = "0.6.2"
+description = "Selects diverse, high-quality photos from Immich as training data for Frigate face recognition."
 license = "AGPL-3.0-or-later"
 requires-python = ">=3.13"
 authors = [{ name = "Holden Salomon", email = "holden@arch.fyi" }]
@@ -17,22 +17,23 @@ classifiers = [
 dependencies = [
     "croniter>=5.0.2",
     "insightface>=0.7.3",
-    "nvidia-cudnn-cu12>=9.0.0",
     "numpy>=2.2.6",
-    "onnxruntime-gpu>=1.23.2; sys_platform == 'linux' and platform_machine == 'x86_64'",
-    "onnxruntime>=1.23.2; sys_platform == 'linux' and platform_machine != 'x86_64'",
-    "onnxruntime>=1.23.2; sys_platform != 'linux'",
     "opencv-python-headless>=4.12.0.88",
     "pillow>=12.1.0",
     "python-dotenv>=1.2.1",
     "requests>=2.32.5",
     "rich>=14.2.0",
-    "torch>=2.12.0",
-    "torchvision>=0.27.0",
-    "transformers>=5.12.0",
-    "ultralytics>=8.4.66",
 ]
 
+[project.optional-dependencies]
+gpu   = [
+    "onnxruntime-gpu>=1.23.2; sys_platform == 'linux' and platform_machine == 'x86_64'",
+    "nvidia-cudnn-cu12>=9.0.0; sys_platform == 'linux' and platform_machine == 'x86_64'",
+]
+rocm  = ["onnxruntime-rocm>=1.16.0; sys_platform == 'linux' and platform_machine == 'x86_64'"]
+intel = ["onnxruntime-openvino>=1.20.0; sys_platform == 'linux' and platform_machine == 'x86_64'"]
+cpu   = ["onnxruntime>=1.23.2"]
+
 [project.scripts]
 winnow = "winnow.cli:main"
 
@@ -42,10 +43,13 @@ Changelog = "https://github.com/sudolulo/winnow/blob/main/CHANGELOG.md"
 Documentation = "https://github.com/sudolulo/winnow/wiki"
 
 [tool.uv]
+index-strategy = "unsafe-best-match"
 conflicts = [
     [
-        { package = "onnxruntime" },
-        { package = "onnxruntime-gpu" },
+        { extra = "gpu" },
+        { extra = "rocm" },
+        { extra = "intel" },
+        { extra = "cpu" },
     ],
 ]
 required-environments = [
@@ -53,27 +57,6 @@ required-environments = [
     "sys_platform == 'linux' and platform_machine == 'aarch64'",
 ]
 
-[tool.uv.sources]
-torch = [
-    { index = "pytorch-cu126", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'aarch64'" },
-    { index = "pytorch-cpu", marker = "sys_platform != 'linux'" },
-]
-torchvision = [
-    { index = "pytorch-cu126", marker = "sys_platform == 'linux' and platform_machine == 'x86_64'" },
-    { index = "pytorch-cpu", marker = "sys_platform == 'linux' and platform_machine == 'aarch64'" },
-    { index = "pytorch-cpu", marker = "sys_platform != 'linux'" },
-]
-
-[[tool.uv.index]]
-name = "pytorch-cu126"
-url = "https://download.pytorch.org/whl/cu126"
-explicit = true
-
-[[tool.uv.index]]
-name = "pytorch-cpu"
-url = "https://download.pytorch.org/whl/cpu"
-explicit = true
 
 [dependency-groups]
 dev = [
@@ -102,14 +85,14 @@ insightface = "insightface"
 numpy = "numpy"
 nvidia-cudnn-cu12 = "nvidia.cudnn"
 onnxruntime-gpu = "onnxruntime"
+onnxruntime-rocm = "onnxruntime"
+onnxruntime-openvino = "onnxruntime"
+onnxruntime = "onnxruntime"
 requests = "requests"
 rich = "rich"
-torch = "torch"
-transformers = "transformers"
-ultralytics = "ultralytics"
 
 [tool.deptry.per_rule_ignores]
-DEP002 = ["onnxruntime-gpu", "nvidia-cudnn-cu12"]
+DEP002 = ["onnxruntime-gpu", "nvidia-cudnn-cu12", "onnxruntime-rocm", "onnxruntime-openvino", "onnxruntime"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
@@ -117,4 +100,3 @@ testpaths = ["tests"]
 [build-system]
 requires = ["hatchling"]
 build-backend = "hatchling.build"
-

scheduler.py

@@ -15,38 +15,49 @@ except ImportError:
 # resident in memory across all subsequent scheduled runs.
 from winnow.cli import main
 
-SCHEDULE = os.environ["CRON_SCHEDULE"]
-MODELS_DIR = os.environ.get("HF_HOME", "/models/huggingface")
-INSIGHTFACE_HOME = os.environ.get("INSIGHTFACE_HOME", "/models/.insightface")
-
 logger = logging.getLogger(__name__)
 
 
-def check_models() -> None:
-    buffalo = Path(INSIGHTFACE_HOME) / "models" / "buffalo_l"
-    hf_hub = Path(MODELS_DIR) / "hub"
+def _check_models() -> None:
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", "/models/.insightface")
+    buffalo = Path(insightface_home) / "models" / "buffalo_l"
     if not buffalo.exists():
         print("  InsightFace Buffalo_L not found — will download on first run", flush=True)
-    if not (hf_hub.exists() and any(hf_hub.iterdir())):
-        print("  HuggingFace models not found — will download on first run", flush=True)
 
 
-NOW = time.time()
-cron = croniter(SCHEDULE, NOW)
-next_run = cron.get_next(float)
+def _run_scheduler() -> None:
+    schedule = os.environ.get("CRON_SCHEDULE")
+    if not schedule:
+        print("Error: CRON_SCHEDULE environment variable is required.", flush=True)
+        sys.exit(1)
+
+    try:
+        Path("/tmp/winnow.pid").write_text(str(os.getpid()))
+    except OSError as e:
+        print(f"Warning: could not write PID file: {e}", flush=True)
 
-while True:
     now = time.time()
-    if now >= next_run:
-        print(f"\n[{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow run...", flush=True)
-        check_models()
-        try:
-            main()
-            print("winnow run complete", flush=True)
-        except KeyboardInterrupt:
-            raise
-        except Exception as e:
-            logger.error(f"winnow run failed: {e}", exc_info=True)
-            print(f"winnow run failed: {e}", flush=True)
-        next_run = cron.get_next(float)
-    time.sleep(max(1, next_run - time.time()))
+    cron = croniter(schedule, now)
+    next_run = cron.get_next(float)
+    print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+
+    while True:
+        now = time.time()
+        if now >= next_run:
+            print(f"\n[{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow run...", flush=True)
+            _check_models()
+            try:
+                main()
+                print("winnow run complete", flush=True)
+            except KeyboardInterrupt:
+                raise
+            except Exception as e:
+                logger.error("winnow run failed: %s", e, exc_info=True)
+                print(f"winnow run failed: {e}", flush=True)
+            next_run = cron.get_next(float)
+            print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+        time.sleep(min(60, max(1, next_run - time.time())))
+
+
+if __name__ == "__main__":
+    _run_scheduler()

scripts/benchmark.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""
+winnow inference benchmark: GPU vs CPU throughput.
+
+Measures InsightFace (ArcFace) latency and throughput.
+Run with FORCE_CPU=true for CPU-only baseline.
+
+Usage inside container:
+    # GPU mode:
+    docker exec winnow python /app/scripts/benchmark.py
+
+    # CPU mode:
+    docker exec -e FORCE_CPU=true winnow python /app/scripts/benchmark.py
+"""
+
+import sys
+import time
+
+import numpy as np
+from PIL import Image, ImageDraw
+
+
+def _mode_label() -> str:
+    from winnow.config import _getenv_bool
+    return "CPU (FORCE_CPU=true)" if _getenv_bool("FORCE_CPU", False) else "GPU (auto)"
+
+
+def make_face_image(size: int = 640) -> Image.Image:
+    """Synthetic face-like image: skin-tone rectangle with landmark blobs."""
+    img = Image.new("RGB", (size, size), (200, 170, 140))
+    draw = ImageDraw.Draw(img)
+    # Head oval
+    cx, cy = size // 2, size // 2
+    hw, hh = int(size * 0.3), int(size * 0.38)
+    draw.ellipse([cx - hw, cy - hh, cx + hw, cy + hh], fill=(220, 185, 155))
+    # Eyes
+    for ex in [cx - int(size * 0.1), cx + int(size * 0.1)]:
+        ey = cy - int(size * 0.05)
+        r = max(4, size // 40)
+        draw.ellipse([ex - r, ey - r, ex + r, ey + r], fill=(40, 30, 20))
+    # Nose
+    draw.ellipse([cx - 5, cy + 5, cx + 5, cy + 15], fill=(180, 140, 110))
+    # Mouth
+    draw.arc([cx - 20, cy + 25, cx + 20, cy + 45], start=0, end=180, fill=(160, 80, 80), width=3)
+    return img
+
+
+def _stats(times_s: list[float]) -> dict:
+    arr = np.array(times_s) * 1000  # ms
+    return {
+        "median_ms": float(np.median(arr)),
+        "mean_ms": float(np.mean(arr)),
+        "min_ms": float(np.min(arr)),
+        "p95_ms": float(np.percentile(arr, 95)),
+        "ips": 1000.0 / float(np.median(arr)),
+    }
+
+
+def bench_insightface(n_warmup: int = 5, n_runs: int = 30) -> None:
+    import cv2
+
+    import winnow.embeddings as emb_mod
+    from winnow.embeddings import get_insightface_app
+
+    # Reset singleton so we get a fresh load
+    emb_mod._insightface_app = None
+    emb_mod._insightface_loaded = False
+
+    print("  Loading model...")
+    t_load = time.perf_counter()
+    app = get_insightface_app()
+    load_s = time.perf_counter() - t_load
+
+    if app is None:
+        print("  SKIP: InsightFace failed to load")
+        return
+
+    img_pil = make_face_image(640)
+    img_bgr = cv2.cvtColor(np.asarray(img_pil), cv2.COLOR_RGB2BGR)
+
+    # Warmup
+    for _ in range(n_warmup):
+        app.get(img_bgr)
+
+    # Timed — single image 640×640
+    times: list[float] = []
+    for _ in range(n_runs):
+        t0 = time.perf_counter()
+        app.get(img_bgr)
+        times.append(time.perf_counter() - t0)
+
+    s = _stats(times)
+    print(f"  Model load time : {load_s:.2f} s")
+    print("  Input size      : 640×640")
+    print(f"  Runs            : {n_runs} (after {n_warmup} warmup)")
+    print(f"  Median latency  : {s['median_ms']:.1f} ms")
+    print(f"  Mean / p95      : {s['mean_ms']:.1f} ms / {s['p95_ms']:.1f} ms")
+    print(f"  Min latency     : {s['min_ms']:.1f} ms")
+    print(f"  Throughput      : {s['ips']:.1f} images/s")
+
+    # Also test at 320×320
+    img_sm = make_face_image(320)
+    img_sm_bgr = cv2.cvtColor(np.asarray(img_sm), cv2.COLOR_RGB2BGR)
+    for _ in range(n_warmup):
+        app.get(img_sm_bgr)
+    times_sm: list[float] = []
+    for _ in range(n_runs):
+        t0 = time.perf_counter()
+        app.get(img_sm_bgr)
+        times_sm.append(time.perf_counter() - t0)
+    s2 = _stats(times_sm)
+    print(f"  320×320 median  : {s2['median_ms']:.1f} ms  ({s2['ips']:.1f} img/s)")
+
+
+def main() -> None:
+    print("=" * 56)
+    print("  winnow inference benchmark")
+    print(f"  Mode: {_mode_label()}")
+    print("=" * 56)
+    print()
+
+    print("── InsightFace Buffalo_L  (face detection + ArcFace) ──")
+    bench_insightface()
+    print()
+
+
+if __name__ == "__main__":
+    # Add winnow to path when run directly inside container
+    sys.path.insert(0, "/app")
+    main()

tests/test_config.py

@@ -17,11 +17,11 @@ def test_config_loads_defaults(monkeypatch):
     assert cfg.API_KEY == "test-key"
     assert cfg.OUTPUT_DIR == "./frigate_train"
     assert cfg.YEARS_FILTER == 10
-    assert cfg.MIN_FACE_WIDTH == 50
-    assert cfg.MIN_FACE_COUNT == 0
-    assert cfg.BLUR_THRESHOLD == 100.0
+    assert cfg.MIN_FACE_WIDTH == 90
+    assert cfg.MIN_FACE_COUNT == 3
+    assert cfg.BLUR_THRESHOLD == 120.0
     assert cfg.MIN_CONFIDENCE == 0.7
-    assert cfg.MAX_AUTO_IMAGES == 80
+    assert cfg.MAX_AUTO_IMAGES == 20
     assert cfg.QUALITY_REPLACEMENT is True
     assert cfg.FACE_MARGIN == 0.15
     assert cfg.USE_FULL_RESOLUTION is True

tests/test_diversity.py

@@ -0,0 +1,336 @@
+"""Tests for core diversity selection algorithms (pure functions, no network)."""
+
+import numpy as np
+import pytest
+from PIL import Image
+
+
+def _unit_embeddings(n: int, d: int = 512, seed: int = 42) -> list:
+    """Return n normalised random embeddings — well-separated in high-dim space."""
+    rng = np.random.default_rng(seed)
+    embs = rng.standard_normal((n, d)).astype(np.float32)
+    embs /= np.linalg.norm(embs, axis=1, keepdims=True)
+    return list(embs)
+
+
+def _asset_with_face(
+    asset_id="a1", person_id="p1",
+    x1=10, y1=10, x2=60, y2=60,
+    img_w=100, img_h=100, score=0.9,
+):
+    return {
+        "id": asset_id,
+        "people": [{
+            "id": person_id,
+            "faces": [{
+                "boundingBoxX1": x1, "boundingBoxY1": y1,
+                "boundingBoxX2": x2, "boundingBoxY2": y2,
+                "imageWidth": img_w, "imageHeight": img_h,
+                "score": score,
+            }],
+        }],
+    }
+
+
+# ── _get_face_bbox ─────────────────────────────────────────────────────────────
+
+def test_get_face_bbox_returns_coords():
+    from winnow.diversity import _get_face_bbox
+    asset = _asset_with_face(x1=5, y1=10, x2=55, y2=70)
+    assert _get_face_bbox(asset) == (5, 10, 55, 70)
+
+
+def test_get_face_bbox_filters_by_person_id():
+    from winnow.diversity import _get_face_bbox
+    asset = _asset_with_face(person_id="p1")
+    assert _get_face_bbox(asset, person_id="p999") is None
+
+
+def test_get_face_bbox_returns_none_empty_faces():
+    from winnow.diversity import _get_face_bbox
+    asset = {"id": "a1", "people": [{"id": "p1", "faces": []}]}
+    assert _get_face_bbox(asset) is None
+
+
+def test_get_face_bbox_returns_none_no_people():
+    from winnow.diversity import _get_face_bbox
+    assert _get_face_bbox({"id": "a1"}) is None
+
+
+# ── _get_face_confidence ───────────────────────────────────────────────────────
+
+def test_get_face_confidence_returns_score():
+    from winnow.diversity import _get_face_confidence
+    asset = _asset_with_face(score=0.92)
+    assert _get_face_confidence(asset) == pytest.approx(0.92)
+
+
+def test_get_face_confidence_filters_by_person_id():
+    from winnow.diversity import _get_face_confidence
+    asset = _asset_with_face(person_id="p1", score=0.9)
+    assert _get_face_confidence(asset, person_id="p999") is None
+
+
+def test_get_face_confidence_returns_none_empty_faces():
+    from winnow.diversity import _get_face_confidence
+    asset = {"id": "a1", "people": [{"id": "p1", "faces": []}]}
+    assert _get_face_confidence(asset) is None
+
+
+# ── _crop_face_from_thumbnail ──────────────────────────────────────────────────
+
+def test_crop_face_returns_image():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200), color=(128, 64, 32))
+    asset = _asset_with_face(x1=50, y1=50, x2=150, y2=150, img_w=200, img_h=200)
+    crop = _crop_face_from_thumbnail(img, asset)
+    assert crop is not None
+    assert crop.width > 0 and crop.height > 0
+
+
+def test_crop_face_scales_bbox_to_thumbnail():
+    """When thumbnail is half the metadata dimensions, bbox is scaled accordingly."""
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200))
+    # Metadata says 400×400; bbox covers the centre quarter
+    asset = _asset_with_face(x1=100, y1=100, x2=300, y2=300, img_w=400, img_h=400)
+    crop = _crop_face_from_thumbnail(img, asset)
+    assert crop is not None
+    assert crop.width <= 200 and crop.height <= 200
+
+
+def test_crop_face_returns_none_no_metadata():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (100, 100))
+    assert _crop_face_from_thumbnail(img, {"id": "a1"}) is None
+
+
+def test_crop_face_returns_none_for_sub_30px_bbox():
+    """A 1×1 bbox produces a crop too small to embed — should be rejected."""
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (100, 100))
+    asset = _asset_with_face(x1=50, y1=50, x2=51, y2=51, img_w=100, img_h=100)
+    assert _crop_face_from_thumbnail(img, asset) is None
+
+
+def test_crop_face_respects_person_id_filter():
+    from winnow.diversity import _crop_face_from_thumbnail
+    img = Image.new("RGB", (200, 200))
+    asset = _asset_with_face(person_id="p1", x1=50, y1=50, x2=150, y2=150)
+    assert _crop_face_from_thumbnail(img, asset, person_id="p999") is None
+
+
+# ── _dedup_embeddings ──────────────────────────────────────────────────────────
+
+def test_dedup_keeps_all_diverse_embeddings():
+    from winnow.diversity import _dedup_embeddings
+    embs = _unit_embeddings(20)
+    candidates = [{"id": str(i)} for i in range(20)]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None] * 20)
+    # Random 512-dim unit vectors are far apart — all should survive
+    assert len(out_cands) == 20
+
+
+def test_dedup_removes_near_duplicate():
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    # Cosine distance ≈ 0.01 — well within the 0.20 dedup threshold
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    embs = [base, near_dup]
+    candidates = [{"id": "base", "quality_score": 0.9}, {"id": "dup", "quality_score": 0.5}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert len(out_cands) == 1
+    assert out_cands[0]["id"] == "base"
+
+
+def test_dedup_keeps_higher_quality_from_duplicate_pair():
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    # Reversed quality: near_dup is sharper
+    embs = [base, near_dup]
+    candidates = [{"id": "base", "quality_score": 0.3}, {"id": "dup", "quality_score": 0.95}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert len(out_cands) == 1
+    assert out_cands[0]["id"] == "dup"
+
+
+def test_dedup_single_embedding_passes_through():
+    from winnow.diversity import _dedup_embeddings
+    embs = _unit_embeddings(1)
+    out_embs, out_cands, _ = _dedup_embeddings(embs, [{"id": "only"}], [None])
+    assert len(out_cands) == 1
+
+
+def test_dedup_treats_zero_quality_score_as_zero_not_missing():
+    """quality_score=0.0 is a valid score — should not be treated as absent."""
+    from winnow.diversity import _dedup_embeddings
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    near_dup = base.copy()
+    near_dup[1] = 0.014
+    near_dup /= np.linalg.norm(near_dup)
+
+    embs = [base, near_dup]
+    # base has explicit 0.0; near_dup has 0.5 — near_dup should win
+    candidates = [{"id": "base", "quality_score": 0.0}, {"id": "dup", "quality_score": 0.5}]
+    _, out_cands, _ = _dedup_embeddings(embs, candidates, [None, None])
+    assert out_cands[0]["id"] == "dup"
+
+
+# ── _kmedoids ──────────────────────────────────────────────────────────────────
+
+def _dist_matrix(embs):
+    m = np.vstack(embs)
+    m /= np.linalg.norm(m, axis=1, keepdims=True)
+    return 1 - m @ m.T
+
+
+def test_kmedoids_returns_k_distinct_medoids():
+    from winnow.diversity import _kmedoids
+    dist = _dist_matrix(_unit_embeddings(30))
+    medoids, _ = _kmedoids(dist, k=5)
+    assert len(medoids) == 5
+    assert len(set(medoids)) == 5
+
+
+def test_kmedoids_labels_cover_all_points():
+    from winnow.diversity import _kmedoids
+    dist = _dist_matrix(_unit_embeddings(20))
+    medoids, labels = _kmedoids(dist, k=4)
+    assert len(labels) == 20
+    assert set(labels).issubset(set(range(4)))
+
+
+def test_kmedoids_medoids_are_valid_indices():
+    from winnow.diversity import _kmedoids
+    n = 15
+    dist = _dist_matrix(_unit_embeddings(n))
+    medoids, _ = _kmedoids(dist, k=3)
+    assert all(0 <= m < n for m in medoids)
+
+
+def test_kmedoids_k_equals_n_selects_all():
+    from winnow.diversity import _kmedoids
+    n = 5
+    dist = _dist_matrix(_unit_embeddings(n))
+    medoids, _ = _kmedoids(dist, k=n)
+    assert len(medoids) == n
+
+
+# ── _compute_adaptive_threshold ────────────────────────────────────────────────
+
+def test_adaptive_threshold_positive():
+    from winnow.diversity import _compute_adaptive_threshold
+    embs = np.array(_unit_embeddings(50))
+    assert _compute_adaptive_threshold(embs) > 0
+
+
+def test_adaptive_threshold_floor_for_identical_embeddings():
+    """All-identical embeddings → median pairwise distance = 0 → floor at 0.05."""
+    from winnow.diversity import _compute_adaptive_threshold
+    base = np.zeros((10, 512), dtype=np.float32)
+    base[:, 0] = 1.0
+    assert _compute_adaptive_threshold(base) == pytest.approx(0.05)
+
+
+def test_adaptive_threshold_single_point_returns_floor():
+    from winnow.diversity import _compute_adaptive_threshold
+    single = np.ones((1, 512), dtype=np.float32)
+    single /= np.linalg.norm(single)
+    assert _compute_adaptive_threshold(single) == pytest.approx(0.05)
+
+
+def test_adaptive_threshold_scales_with_spread():
+    """A more spread-out embedding set should produce a higher threshold."""
+    from winnow.diversity import _compute_adaptive_threshold
+    tight = np.array(_unit_embeddings(30, seed=0)) * 0.001 + np.array([1.0] + [0.0] * 511)
+    tight /= np.linalg.norm(tight, axis=1, keepdims=True)
+    diverse = np.array(_unit_embeddings(30, seed=1))
+    assert _compute_adaptive_threshold(diverse) > _compute_adaptive_threshold(tight)
+
+
+# ── _select_time_spread ────────────────────────────────────────────────────────
+
+def test_time_spread_returns_exact_n():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(100)]
+    assert len(_select_time_spread(assets, limit=10)) == 10
+
+
+def test_time_spread_returns_all_when_under_limit():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(5)]
+    assert len(_select_time_spread(assets, limit=20)) == 5
+
+
+def test_time_spread_auto_defaults_to_30():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(200)]
+    assert len(_select_time_spread(assets, limit="auto")) == 30
+
+
+def test_time_spread_includes_first_and_last():
+    from winnow.diversity import _select_time_spread
+    assets = [{"id": str(i)} for i in range(100)]
+    result = _select_time_spread(assets, limit=5)
+    ids = [int(a["id"]) for a in result]
+    assert ids[0] == 0
+    assert ids[-1] == 99
+
+
+# ── _cluster_aware_selection ───────────────────────────────────────────────────
+
+def test_cluster_selection_returns_exact_limit(monkeypatch):
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(50)
+    candidates = [{"id": str(i)} for i in range(50)]
+    result = _cluster_aware_selection(embs, candidates, limit=10)
+    assert len(result) == 10
+
+
+def test_cluster_selection_output_is_subset_of_input(monkeypatch):
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(30)
+    candidates = [{"id": str(i)} for i in range(30)]
+    result = _cluster_aware_selection(embs, candidates, limit=10)
+    result_ids = {a["id"] for a in result}
+    assert result_ids.issubset({a["id"] for a in candidates})
+
+
+def test_cluster_selection_auto_stops_early_on_tight_cluster(monkeypatch):
+    """When all embeddings are nearly identical auto mode should stop early."""
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    rng = np.random.default_rng(0)
+    base = np.zeros(512, dtype=np.float32)
+    base[0] = 1.0
+    embs = []
+    for _ in range(50):
+        v = base + rng.standard_normal(512).astype(np.float32) * 0.001
+        v /= np.linalg.norm(v)
+        embs.append(v)
+    candidates = [{"id": str(i)} for i in range(50)]
+    result = _cluster_aware_selection(list(embs), candidates, limit="auto")
+    assert len(result) < 20
+
+
+def test_cluster_selection_hard_example_weighting_accepted(monkeypatch):
+    """Confidence scores are accepted without error."""
+    from winnow.diversity import _cluster_aware_selection
+    monkeypatch.setattr("winnow.diversity.Config.MAX_AUTO_IMAGES", 20)
+    embs = _unit_embeddings(20)
+    candidates = [{"id": str(i)} for i in range(20)]
+    conf = [0.7 if i % 2 == 0 else 0.95 for i in range(20)]
+    result = _cluster_aware_selection(embs, candidates, limit=5, confidence_scores=conf)
+    assert len(result) == 5

tests/test_upload_tracker.py

@@ -7,7 +7,7 @@ import pytest
 @pytest.fixture(autouse=True)
 def isolated_cache(monkeypatch, tmp_path):
     """Point tracker at a temp directory so tests don't touch real cache files."""
-    monkeypatch.setenv("CACHE_DIR", str(tmp_path))
+    monkeypatch.setenv("DATA_DIR", str(tmp_path))
     from winnow.config import _Config
     _Config.reset()
     yield tmp_path
@@ -218,3 +218,45 @@ def test_get_lowest_quality_exclude_all_returns_none():
     mark_uploaded("asset-a", person_name="Alice", score=0.50)
     record_frigate_file("Alice", "Alice-a.webp", "asset-a")
     assert get_lowest_quality_mapped_file("Alice", exclude={"Alice-a.webp"}) is None
+
+
+# ── get_most_redundant_mapped_file ────────────────────────────────────────────
+
+def test_get_most_redundant_none_when_no_frigate_scores():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-a", person_name="Alice", score=0.80)
+    record_frigate_file("Alice", "Alice-a.webp", "asset-a")
+    # blur score only, no frigate_score → no candidates
+    assert get_most_redundant_mapped_file("Alice") is None
+
+
+def test_get_most_redundant_returns_highest_frigate_score():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-novel", person_name="Alice", score=0.50, frigate_score=0.31)
+    mark_uploaded("asset-redundant", person_name="Alice", score=0.90, frigate_score=0.88)
+    record_frigate_file("Alice", "Alice-novel.webp", "asset-novel")
+    record_frigate_file("Alice", "Alice-redundant.webp", "asset-redundant")
+    result = get_most_redundant_mapped_file("Alice")
+    assert result is not None
+    frigate_filename, asset_id, score = result
+    assert frigate_filename == "Alice-redundant.webp"
+    assert asset_id == "asset-redundant"
+    assert score == pytest.approx(0.88, abs=0.001)
+
+
+def test_get_most_redundant_exclude_skips_file():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-hi", person_name="Alice", score=0.9, frigate_score=0.85)
+    mark_uploaded("asset-lo", person_name="Alice", score=0.5, frigate_score=0.40)
+    record_frigate_file("Alice", "Alice-hi.webp", "asset-hi")
+    record_frigate_file("Alice", "Alice-lo.webp", "asset-lo")
+    result = get_most_redundant_mapped_file("Alice", exclude={"Alice-hi.webp"})
+    assert result is not None
+    assert result[1] == "asset-lo"  # hi excluded; lo is next highest
+
+
+def test_get_most_redundant_exclude_all_returns_none():
+    from winnow.upload_tracker import get_most_redundant_mapped_file, mark_uploaded, record_frigate_file
+    mark_uploaded("asset-a", person_name="Alice", score=0.5, frigate_score=0.70)
+    record_frigate_file("Alice", "Alice-a.webp", "asset-a")
+    assert get_most_redundant_mapped_file("Alice", exclude={"Alice-a.webp"}) is None

winnow/__init__.py

@@ -1,8 +1,7 @@
 """Immich to Frigate training set curator.
 
 AI-powered tool to extract high-quality, diverse training images from your
-Immich library for Frigate's Face Recognition (ArcFace) and Object/State
-Classification models.
+Immich library for Frigate's face recognition (ArcFace/Buffalo_L).
 """
 
 from importlib.metadata import PackageNotFoundError, version

winnow/cache.py

@@ -7,38 +7,62 @@ recomputing on reruns. Uses numpy binary format for fast I/O.
 import hashlib
 import logging
 import os
+from pathlib import Path
 
 import numpy as np
 
 logger = logging.getLogger(__name__)
 
-# Model versions — bump these when the upstream model changes
 MODEL_VERSIONS = {
-    "insightface": "buffalo_l_v1",
-    "siglip": "siglip-base-patch16-224_v1",
     "immich": "immich_buffalo_l_v1",
 }
 
 
+def _insightface_model_fingerprint() -> str:
+    """Derive a version string from buffalo_l .onnx file sizes and mtimes.
+
+    Changes automatically when model files are replaced or updated, preventing
+    stale embeddings from a previous model being served from cache.
+    Falls back to a static string before the model is downloaded (first run).
+    """
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", os.path.expanduser("~/.insightface"))
+    model_dir = Path(insightface_home) / "models" / "buffalo_l"
+    if not model_dir.exists():
+        return "buffalo_l_v1"
+    onnx_files = sorted(model_dir.glob("*.onnx"))
+    if not onnx_files:
+        return "buffalo_l_v1"
+    fingerprint = "|".join(
+        f"{f.name}:{f.stat().st_size}:{int(f.stat().st_mtime)}"
+        for f in onnx_files
+    )
+    return hashlib.sha256(fingerprint.encode()).hexdigest()[:12]
+
+
 class EmbeddingCache:
     """Simple disk-based embedding cache.
 
     Embeddings are stored as .npy files in a flat directory,
-    keyed by a hash of (asset_id, model_version).
+    keyed by a hash of (asset_id, model_version). The InsightFace version
+    is derived from buffalo_l model file metadata so the cache auto-invalidates
+    when model files are replaced or updated.
     """
 
     def __init__(self, cache_dir: str = ".if_cache") -> None:
         self.cache_dir = cache_dir
         self._ensured = False
+        self._model_versions = {
+            **MODEL_VERSIONS,
+            "insightface": _insightface_model_fingerprint(),
+        }
 
     def _ensure_dir(self) -> None:
         if not self._ensured:
             os.makedirs(self.cache_dir, exist_ok=True)
             self._ensured = True
 
-    @staticmethod
-    def _key(asset_id: str, model: str) -> str:
-        version = MODEL_VERSIONS.get(model, model)
+    def _key(self, asset_id: str, model: str) -> str:
+        version = self._model_versions.get(model, model)
         raw = f"{asset_id}:{version}"
         return hashlib.sha256(raw.encode()).hexdigest()[:16]
 
@@ -58,10 +82,19 @@ class EmbeddingCache:
     def put(self, asset_id: str, embedding: np.ndarray, model: str = "insightface") -> None:
         """Store an embedding in the cache."""
         self._ensure_dir()
+        final = self._path(asset_id, model)
+        # Insert .tmp before .npy so np.save doesn't auto-append another .npy extension
+        # (np.save appends .npy to paths that don't already end in .npy).
+        tmp = final.removesuffix(".npy") + ".tmp.npy"
         try:
-            np.save(self._path(asset_id, model), embedding)
+            np.save(tmp, embedding)
+            os.replace(tmp, final)
         except Exception as e:
-            logger.debug(f"Cache write failed for {asset_id}: {e}")
+            logger.debug("Cache write failed for %s: %s", asset_id, e)
+            try:
+                os.remove(tmp)
+            except OSError:
+                pass
 
     def clear(self) -> None:
         """Delete all cached embeddings."""
@@ -72,23 +105,23 @@ class EmbeddingCache:
             if f.endswith(".npy"):
                 os.remove(os.path.join(self.cache_dir, f))
                 count += 1
-        logger.info(f"Cleared {count} cached embeddings.")
+        logger.info("Cleared %s cached embeddings.", count)
 
 
 # Singleton instance
 _cache: EmbeddingCache | None = None
+_cache_dir: str | None = None
 
 
 def get_cache(cache_dir: str = ".if_cache") -> EmbeddingCache:
     """Get or create the singleton cache instance.
 
-    Note: The ``cache_dir`` parameter is only used when creating the
-    singleton for the first time. Subsequent calls return the existing
-    instance regardless of ``cache_dir``. If you need a cache with a
-    different directory, instantiate ``EmbeddingCache`` directly.
+    Re-creates the instance when ``cache_dir`` changes so that test
+    isolation (which resets Config.DATA_DIR via _Config.reset()) always
+    writes to the correct directory rather than a stale one.
     """
-    global _cache
-    if _cache is None:
+    global _cache, _cache_dir
+    if _cache is None or _cache_dir != cache_dir:
         _cache = EmbeddingCache(cache_dir)
+        _cache_dir = cache_dir
     return _cache
-

winnow/cli.py

@@ -7,12 +7,12 @@ import sys
 from rich import print as rprint
 from rich.prompt import Confirm
 
-from .config import Config, ConfigManager
+from .config import Config, _getenv_bool
 from .executor import execute_jobs, upload_to_frigate
-from .immich_api import get_people
+from .immich_api import get_immich_version, get_people, merge_people
 from .jobs import _show_preview, auto_configure, interactive_configure
 from .log_config import console, setup_logging
-from .upload_tracker import find_by_crop_dimension, get_person_summary, reset_person
+from .upload_tracker import find_by_crop_dimension, get_person_summary, reset_all_people, reset_person
 
 logger = logging.getLogger(__name__)
 
@@ -41,6 +41,8 @@ def _handle_trace_crop(size_str: str) -> None:
             rprint(f"    Immich URL:   {immich_url}/photos/{m['asset_id']}")
         blur = m.get("blur_score")
         rprint(f"    Blur score:   {blur:.1f}" if blur is not None else "    Blur score:   unknown")
+        fscore = m.get("frigate_score")
+        rprint(f"    Frigate score: {fscore:.2f}" if fscore is not None else "    Frigate score: unknown")
         if m.get("frigate_filename"):
             rprint(f"    Frigate file: {m['frigate_filename']}")
         else:
@@ -49,10 +51,116 @@ def _handle_trace_crop(size_str: str) -> None:
     sys.exit(0)
 
 
+def _handle_duplicate_people(people: list[dict]) -> list[dict]:
+    """Warn about or merge Immich people that share the same name.
+
+    Duplicates arise when Immich creates separate person records for the same
+    individual (e.g. unmerged face clusters). Without handling, winnow would
+    run multiple jobs for the same Frigate folder and overwrite its own output,
+    leaving far fewer training images than expected.
+
+    With MERGE_DUPLICATE_PEOPLE=false (default): prints a warning, skips the
+    smaller duplicates so only the person with the most assets is processed,
+    and returns a deduplicated people list.
+    With MERGE_DUPLICATE_PEOPLE=true: merges each duplicate group inside
+    Immich via its API (permanently combines the face records), then
+    re-fetches the people list so the rest of the run sees the merged state.
+    """
+    from collections import defaultdict
+
+    by_name: dict[str, list[dict]] = defaultdict(list)
+    for p in people:
+        name = (p.get("name") or "").strip()
+        if name:
+            by_name[name].append(p)
+
+    duplicates = {name: ps for name, ps in by_name.items() if len(ps) > 1}
+    if not duplicates:
+        return people
+
+    def _smaller_duplicate_ids(groups: dict) -> set[str]:
+        """IDs of all but the largest person in each duplicate group."""
+        return {
+            p["id"]
+            for ps in groups.values()
+            for p in sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)[1:]
+        }
+
+    if not Config.MERGE_DUPLICATE_PEOPLE:
+        rprint("\n[bold yellow]⚠  Duplicate person names detected in Immich:[/bold yellow]")
+        for name, ps in sorted(duplicates.items()):
+            ordered = sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)
+            entries = ", ".join(
+                f"[dim]{p['id'][:8]}…[/dim] ({p.get('assetCount', 0)} assets)"
+                for p in ordered
+            )
+            rprint(f"  [yellow]{name}[/yellow] → {len(ps)} people: {entries}")
+            skipped = ordered[1:]
+            rprint(
+                f"  [dim]  Processing largest only "
+                f"({ordered[0].get('assetCount', 0)} assets). "
+                f"Skipping {len(skipped)} smaller duplicate(s) to avoid overwriting output.[/dim]"
+            )
+        rprint(
+            "  [dim]Set MERGE_DUPLICATE_PEOPLE=true to permanently merge duplicates "
+            "inside Immich (keeps the person with the most assets).[/dim]\n"
+        )
+        # Return deduplicated list — keep only the largest per name so that
+        # downstream job creation never runs two jobs for the same Frigate folder.
+        return [p for p in people if p["id"] not in _smaller_duplicate_ids(duplicates)]
+
+    # Auto-merge: survivor = largest asset count, rest merge into it inside Immich
+    merged_any = False
+    for name, ps in sorted(duplicates.items()):
+        ordered = sorted(ps, key=lambda x: x.get("assetCount", 0), reverse=True)
+        survivor = ordered[0]
+        merge_ids = [p["id"] for p in ordered[1:]]
+        rprint(
+            f"  [cyan]Merging {name!r} inside Immich:[/cyan] keeping "
+            f"[dim]{survivor['id'][:8]}…[/dim] ({survivor.get('assetCount', 0)} assets), "
+            f"absorbing {len(merge_ids)} smaller duplicate(s)..."
+        )
+        if merge_people(survivor["id"], merge_ids):
+            rprint(f"  [green]✓ Merged {name!r}[/green]")
+            merged_any = True
+        else:
+            rprint(f"  [red]✗ Failed to merge {name!r}[/red]")
+
+    if merged_any:
+        rprint("  [dim]Re-fetching people after merge...[/dim]")
+        fresh = get_people()
+        # Filter out the smaller duplicate from any group whose merge failed — those
+        # IDs still exist in Immich and would produce two jobs for the same folder.
+        # IDs from groups that merged successfully are already gone from Immich, so
+        # this filter is a no-op for them.
+        skip_ids = _smaller_duplicate_ids(duplicates)
+        return [p for p in fresh if p.get("id") not in skip_ids]
+
+    # All merges failed — fall back to local deduplication (keep largest per name) so
+    # downstream job creation never runs two jobs for the same Frigate folder.
+    rprint(
+        "  [yellow]All merges failed — applying local deduplication"
+        " to avoid overwriting output.[/yellow]"
+    )
+    return [p for p in people if p["id"] not in _smaller_duplicate_ids(duplicates)]
+
+
+_UNSUPPORTED_VARS = [
+    "ENABLE_FRIGATE_SCORES",
+    "FRIGATE_SCORE_CEILING",
+    "MIN_FACE_WIDTH",
+    "FACE_MARGIN",
+    "ENABLE_FACE_ALIGNMENT",
+    "USE_FULL_RESOLUTION",
+    "MIN_CONFIDENCE",
+    "BLUR_THRESHOLD",
+]
+
+
 def main() -> None:
     """Entry point for winnow CLI."""
     try:
-        verbose = os.environ.get("VERBOSE", "").lower() in ("true", "1", "yes")
+        verbose = _getenv_bool("VERBOSE", False)
         setup_logging(verbose=verbose)
 
         trace_size = os.environ.get("TRACE_CROP_SIZE", "").strip()
@@ -64,7 +172,18 @@ def main() -> None:
     [dim]Immich -> Frigate Training Data Curator[/dim]
         """)
 
-        ConfigManager.get().interactive_setup()
+        set_unsupported = [v for v in _UNSUPPORTED_VARS if os.environ.get(v)]
+        if set_unsupported:
+            console.print(
+                f"[bold yellow]⚠  Advanced tuning vars set: "
+                f"{', '.join(set_unsupported)}[/bold yellow]"
+            )
+            console.print(
+                "[dim]  These defaults are calibrated for Frigate's ArcFace requirements. "
+                "Image quality issues caused by non-default values will not be investigated.[/dim]\n"
+            )
+
+        Config.interactive_setup()
 
         try:
             Config.validate()
@@ -75,11 +194,26 @@ def main() -> None:
         rprint(f"Server: [dim]{Config.IMMICH_URL}[/dim]")
         rprint(f"Output: [dim]{Config.OUTPUT_DIR}[/dim]")
 
-        # Handle RESET_PERSON before anything else
+        # Handle RESET_PERSON before anything else.
+        # RESET_PERSON=* resets every tracked person; any other value resets
+        # that specific person by name.
         reset_person_name = os.environ.get("RESET_PERSON", "").strip()
         if reset_person_name:
-            reset_person(reset_person_name)
-            rprint(f"[bold yellow]Reset tracking data for: {reset_person_name}[/bold yellow]")
+            if reset_person_name == "*":
+                names = list(get_person_summary().keys())
+                if "*" in names:
+                    rprint(
+                        "[yellow]Note: a person literally named '*' exists in the tracker "
+                        "and will be reset along with everyone else.[/yellow]"
+                    )
+                if names:
+                    reset_all_people()
+                    rprint(f"[bold yellow]Reset tracking data for all {len(names)} people.[/bold yellow]")
+                else:
+                    rprint("[dim]No tracking data to reset.[/dim]")
+            else:
+                reset_person(reset_person_name)
+                rprint(f"[bold yellow]Reset tracking data for: {reset_person_name}[/bold yellow]")
 
         # Show per-person tracker summary if data exists
         summary = get_person_summary()
@@ -96,15 +230,24 @@ def main() -> None:
                     f" {counts['rejected']} rejected{frigate_part}[/dim]"
                 )
 
+        _immich_version = get_immich_version()
+        if _immich_version is not None and _immich_version < (1, 106, 0):
+            rprint(
+                f"  [yellow]⚠  Immich {'.'.join(str(x) for x in _immich_version)} detected — "
+                "winnow requires v1.106+. Some features may not work.[/yellow]"
+            )
+
         people = get_people()
         if not people:
             rprint("[bold red]Could not fetch people from Immich. Check URL/Key.[/bold red]")
             return
 
+        people = _handle_duplicate_people(people)
+
         # Auto mode when no TTY (Docker, cron, pipes) — the primary use case.
         # A TTY means local interactive use; AUTO_MODE=true overrides that for scripting.
-        auto_mode = not sys.stdin.isatty() or os.environ.get("AUTO_MODE", "").lower() in ("true", "1", "yes")
-        dry_run = os.environ.get("DRY_RUN", "false").lower() in ("true", "1", "yes")
+        auto_mode = not sys.stdin.isatty() or _getenv_bool("AUTO_MODE", False)
+        dry_run = _getenv_bool("DRY_RUN", False)
 
         if dry_run:
             rprint("[bold yellow]DRY RUN — no images will be downloaded or uploaded[/bold yellow]")

winnow/config.py

@@ -9,78 +9,180 @@ from typing import ClassVar
 from dotenv import load_dotenv
 from rich.prompt import Prompt
 
-load_dotenv()
+_LEGACY_CONFIG_FILE = Path(".immich_config.json")  # pre-v0.6: lived in process CWD, not on a volume
 
-CONFIG_FILE = Path(".immich_config.json")
+
+def _getenv_num(name: str, default, cast):
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    raw = raw.strip()
+    if not raw:
+        return default
+    try:
+        return cast(raw)
+    except ValueError:
+        logging.warning("%s=%r is not a valid %s — using default %s", name, raw, cast.__name__, default)
+        return default
+
+
+def _getenv_int(name: str, default: int) -> int:
+    return _getenv_num(name, default, int)
+
+
+def _getenv_float(name: str, default: float) -> float:
+    return _getenv_num(name, default, float)
+
+
+def _getenv_optional_float(name: str) -> float | None:
+    """Return float value of env var, or None if unset/empty. Warns and returns None on invalid."""
+    return _getenv_num(name, None, float)
+
+
+def _getenv_optional_int(name: str) -> int | None:
+    """Return int value of env var, or None if unset/empty. Warns and returns None on invalid."""
+    return _getenv_num(name, None, int)
+
+
+def _getenv_bool(name: str, default: bool) -> bool:
+    raw = os.getenv(name)
+    if raw is None:
+        return default
+    raw = raw.strip()
+    if not raw:
+        return default
+    return raw.lower() in ("true", "1", "yes")
 
 
 class _Config:
-    """Singleton configuration with uppercase attribute access for backward compatibility."""
+    """Singleton configuration with lazy loading via __getattr__.
+
+    Class-level attributes are annotations only (no defaults), so attribute
+    access on an un-loaded instance falls through to __getattr__, which
+    triggers _load() exactly once.
+    """
 
     _instance: ClassVar["_Config | None"] = None
 
-    # Configuration values
-    IMMICH_URL: str | None = None
-    API_KEY: str | None = None
-    OUTPUT_DIR: str = "./frigate_train"
-    YEARS_FILTER: int = 10
+    # Annotations only — no class-level defaults so __getattr__ fires on first access
+    IMMICH_URL: str | None
+    API_KEY: str | None
+    OUTPUT_DIR: str
+    YEARS_FILTER: int
 
     # Quality filtering
-    MIN_FACE_WIDTH: int = 50
-    BLUR_THRESHOLD: float = 100.0
-    MIN_CONFIDENCE: float = 0.7
-    MAX_AUTO_IMAGES: int = 80
-    QUALITY_REPLACEMENT: bool = True
+    MIN_FACE_WIDTH: int
+    BLUR_THRESHOLD: float
+    MIN_CONFIDENCE: float
+    MAX_AUTO_IMAGES: int
+    QUALITY_REPLACEMENT: bool
+    FRIGATE_SCORE_CEILING: float | None
+    ENABLE_FRIGATE_SCORES: bool
 
     # People filtering
-    MIN_FACE_COUNT: int = 0
+    MIN_FACE_COUNT: int
+    MERGE_DUPLICATE_PEOPLE: bool
 
     # Output quality
-    FACE_MARGIN: float = 0.15
-    USE_FULL_RESOLUTION: bool = True
-    ENABLE_FACE_ALIGNMENT: bool = True
+    FACE_MARGIN: float
+    USE_FULL_RESOLUTION: bool
+    ENABLE_FACE_ALIGNMENT: bool
 
-    ENABLE_CACHE: bool = True
-    CACHE_DIR: str = ".if_cache"
+    ENABLE_CACHE: bool
+    DATA_DIR: str
 
     def __new__(cls) -> "_Config":
         if cls._instance is None:
             cls._instance = super().__new__(cls)
-            cls._instance._load()
+            # Do NOT call _load() here — keep __new__ I/O-free so that import
+            # time does not trigger env/file reads.
         return cls._instance
 
+    def __getattr__(self, name: str):
+        """Called only when the attribute is not found on the instance.
+
+        On first access to any config attribute, load all values from env/file
+        and return the requested one.  Re-registers self as _instance so that
+        a subsequent reset() correctly finds and clears this object's attrs.
+        """
+        if name.startswith("_"):
+            raise AttributeError(name)
+        self._load()
+        # Re-register self as the singleton so reset() can clear our __dict__.
+        # This handles the case where __getattr__ is called on the module-level
+        # Config object after a reset() set _instance to None.
+        _Config._instance = self
+        # _load() sets the attribute as an instance attr; retrieve it directly
+        # to avoid infinite recursion through __getattr__.
+        try:
+            return self.__dict__[name]
+        except KeyError:
+            raise AttributeError(f"_Config has no attribute {name!r}")
+
     def _load(self) -> None:
         """Load configuration from environment and config file."""
+        load_dotenv()
         # Load from environment (highest priority)
         self.IMMICH_URL = os.getenv("IMMICH_URL")
         self.API_KEY = os.getenv("API_KEY")
         self.OUTPUT_DIR = os.getenv("OUTPUT_DIR", "./frigate_train")
-        self.YEARS_FILTER = int(os.getenv("YEARS_FILTER", "10"))
-        self.MIN_FACE_WIDTH = int(os.getenv("MIN_FACE_WIDTH", "50"))
-        self.MIN_FACE_COUNT = int(os.getenv("MIN_FACE_COUNT", "0"))
-        self.BLUR_THRESHOLD = float(os.getenv("BLUR_THRESHOLD", "100.0"))
-        self.MIN_CONFIDENCE = float(os.getenv("MIN_CONFIDENCE", "0.7"))
-        self.MAX_AUTO_IMAGES = int(os.getenv("MAX_AUTO_IMAGES", "80"))
-        self.QUALITY_REPLACEMENT = os.getenv("QUALITY_REPLACEMENT", "true").lower() in ("true", "1", "yes")
-        self.FACE_MARGIN = float(os.getenv("FACE_MARGIN", "0.15"))
-        self.USE_FULL_RESOLUTION = os.getenv("USE_FULL_RESOLUTION", "true").lower() in ("true", "1", "yes")
-        self.ENABLE_FACE_ALIGNMENT = os.getenv("ENABLE_FACE_ALIGNMENT", "true").lower() in ("true", "1", "yes")
-        self.ENABLE_CACHE = os.getenv("ENABLE_CACHE", "true").lower() in ("true", "1", "yes")
-        self.CACHE_DIR = os.getenv("CACHE_DIR", ".if_cache")
+        self.YEARS_FILTER = _getenv_int("YEARS_FILTER", 10)
+        self.MIN_FACE_WIDTH = _getenv_int("MIN_FACE_WIDTH", 90)
+        self.MIN_FACE_COUNT = _getenv_int("MIN_FACE_COUNT", 3)
+        self.MERGE_DUPLICATE_PEOPLE = _getenv_bool("MERGE_DUPLICATE_PEOPLE", False)
+        self.BLUR_THRESHOLD = _getenv_float("BLUR_THRESHOLD", 120.0)
+        self.MIN_CONFIDENCE = _getenv_float("MIN_CONFIDENCE", 0.7)
+        self.MAX_AUTO_IMAGES = _getenv_int("MAX_AUTO_IMAGES", 20)
+        self.QUALITY_REPLACEMENT = _getenv_bool("QUALITY_REPLACEMENT", True)
+        self.FRIGATE_SCORE_CEILING = _getenv_optional_float("FRIGATE_SCORE_CEILING")
+        self.ENABLE_FRIGATE_SCORES = _getenv_bool("ENABLE_FRIGATE_SCORES", True)
+        self.FACE_MARGIN = _getenv_float("FACE_MARGIN", 0.15)
+        self.USE_FULL_RESOLUTION = _getenv_bool("USE_FULL_RESOLUTION", True)
+        self.ENABLE_FACE_ALIGNMENT = _getenv_bool("ENABLE_FACE_ALIGNMENT", True)
+        self.ENABLE_CACHE = _getenv_bool("ENABLE_CACHE", True)
+        _data_dir = os.getenv("DATA_DIR")
+        _cache_dir_legacy = os.getenv("CACHE_DIR")
+        if _data_dir:
+            self.DATA_DIR = _data_dir
+        elif _cache_dir_legacy:
+            logging.warning(
+                "CACHE_DIR is deprecated — rename it to DATA_DIR in your .env or compose.yml"
+            )
+            self.DATA_DIR = _cache_dir_legacy
+        else:
+            self.DATA_DIR = "data"
 
-        # Fall back to config file for non-sensitive values (API_KEY not stored here)
-        if CONFIG_FILE.exists():
+        # Fall back to config file when the env var is absent or blank — a blank
+        # IMMICH_URL= placeholder in .env should not override the config file.
+        # Prefer DATA_DIR/.immich_config.json (volume-safe in Docker) and fall back
+        # to the legacy CWD path so existing installations continue to work.
+        _data_cfg = Path(self.DATA_DIR) / ".immich_config.json"
+        _data_cfg_exists = _data_cfg.exists()
+        if _data_cfg_exists and _LEGACY_CONFIG_FILE.exists():
+            logging.warning(
+                "Two config files found: %s and %s — using %s. Remove the legacy file to silence this.",
+                _data_cfg,
+                _LEGACY_CONFIG_FILE,
+                _data_cfg,
+            )
+        config_file = _data_cfg if _data_cfg_exists else _LEGACY_CONFIG_FILE
+        # _data_cfg_exists already confirmed the primary path — avoid re-stat.
+        # The short-circuit means the legacy path is stat'd at most once here.
+        if _data_cfg_exists or config_file.exists():
             try:
-                data = json.loads(CONFIG_FILE.read_text())
-                self.IMMICH_URL = self.IMMICH_URL or data.get("IMMICH_URL")
-                if not os.getenv("OUTPUT_DIR"):
+                data = json.loads(config_file.read_text())
+                if not self.IMMICH_URL:
+                    self.IMMICH_URL = data.get("IMMICH_URL")
+                if os.getenv("OUTPUT_DIR") is None:
                     self.OUTPUT_DIR = data.get("OUTPUT_DIR", self.OUTPUT_DIR)
             except (json.JSONDecodeError, OSError) as e:
-                logging.warning(f"Failed to load config file: {e}")
+                logging.warning("Failed to load config file: %s", e)
 
     @classmethod
     def reset(cls) -> None:
         """Reset the singleton — mainly useful for testing or delayed env setup."""
+        if cls._instance is not None:
+            cls._instance.__dict__.clear()
         cls._instance = None
 
     def save(self) -> None:
@@ -88,9 +190,13 @@ class _Config:
 
         API_KEY is intentionally excluded — store it in .env or as an
         environment variable instead of a plain-text config file.
+        Writes to DATA_DIR/.immich_config.json so the file survives container
+        restarts when DATA_DIR is a mounted volume.
         """
+        config_file = Path(self.DATA_DIR) / ".immich_config.json"
         try:
-            CONFIG_FILE.write_text(
+            Path(self.DATA_DIR).mkdir(parents=True, exist_ok=True)
+            config_file.write_text(
                 json.dumps(
                     {
                         "IMMICH_URL": self.IMMICH_URL,
@@ -99,9 +205,9 @@ class _Config:
                     indent=2,
                 )
             )
-            logging.info(f"Configuration saved to {CONFIG_FILE}")
+            logging.info("Configuration saved to %s", config_file)
         except OSError as e:
-            logging.error(f"Failed to save config: {e}")
+            logging.error("Failed to save config: %s", e)
 
     def interactive_setup(self) -> None:
         """Prompt user for missing configuration."""
@@ -125,52 +231,10 @@ class _Config:
             raise ValueError("Missing Immich URL or API Key.")
 
 
-# Singleton instance — use a lazy property pattern to avoid import-time side effects
-# when env vars aren't yet set. Call Config.instance() or just access attributes on
-# the module-level `Config` (which delegates to the singleton).
-class _ConfigAccessor:
-    """Lazy accessor that defers singleton creation until first attribute access.
-
-    This avoids reading .env and config files at import time, so environment
-    variables set after importing the module are properly picked up.
-    """
-
-    def __getattr__(self, name: str):
-        return getattr(_Config(), name)
-
-    def __setattr__(self, name: str, value):
-        if name.startswith("_"):
-            super().__setattr__(name, value)
-        else:
-            setattr(_Config(), name, value)
-
-    def reset(self) -> None:
-        """Reset the underlying singleton."""
-        _Config.reset()
-
-    def interactive_setup(self) -> None:
-        """Delegate to the singleton."""
-        _Config().interactive_setup()
-
-    def validate(self) -> None:
-        """Delegate to the singleton."""
-        _Config().validate()
-
-    def save(self) -> None:
-        """Delegate to the singleton."""
-        _Config().save()
-
-
-Config = _ConfigAccessor()
-
-
-class ConfigManager:
-    @staticmethod
-    def get() -> _Config:
-        return _Config()
+# Module-level singleton — lazy: no I/O until first attribute access.
+Config = _Config()
 
 
 def get_headers() -> dict[str, str]:
     """Return HTTP headers for Immich API requests."""
     return {"x-api-key": Config.API_KEY or "", "Accept": "application/json"}
-

winnow/diversity.py

@@ -5,11 +5,12 @@ Selection pipeline:
 1. Concurrent thumbnail download
 2. Quality filtering (blur, IR, exposure, confidence, face size)
 3. Face crop extraction (embed person's face, not full image)
-4. Embedding computation (InsightFace or SigLIP)
+4. Embedding computation (InsightFace)
 5. Cluster-aware selection (K-Medoids + FPS with hard example weighting)
 """
 
 import logging
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from io import BytesIO
 
 import numpy as np
@@ -22,15 +23,24 @@ from .quality import assess_quality
 
 logger = logging.getLogger(__name__)
 
+# Candidate pool: cap at _POOL_CAP assets, but take at least _POOL_SCALE × the
+# requested limit so small limits don't artificially narrow the search space.
+_POOL_CAP = 3000
+_POOL_SCALE = 20
+
+# Embedding batch size: bounds decoded thumbnails in memory.
+# At ~3-8 MB each, 32 images ≈ 100–250 MB peak — safe in a 4 GB container.
+_EMBEDDING_BATCH_SIZE = 32
+
 
 def select_diverse_assets(
     assets: list,
     limit: int | str,
     entity_name: str,
     selection_mode: str = "smart",
-    entity_type: str = "face",
     person_id: str | None = None,
     progress_callback=None,
+    fetch_fn=None,
 ) -> list:
     """
     Select diverse assets using cluster-aware FPS or time spread.
@@ -38,10 +48,11 @@ def select_diverse_assets(
     Args:
         assets: List of asset dicts from Immich API
         limit: Number to select, or "auto" for dynamic selection
-        entity_name: Name of the person/object for logging
+        entity_name: Name of the person for logging
         selection_mode: 'smart' (embedding-based) or 'time' (time spread)
-        entity_type: 'face' or 'object' - determines embedding model
         progress_callback: Optional callback(current, total) for progress
+        fetch_fn: Optional callable(asset_id) -> Image | None; defaults to
+                  _fetch_thumbnail. Injected for testability.
 
     Returns:
         List of selected assets
@@ -53,16 +64,15 @@ def select_diverse_assets(
     # Sort by creation time
     assets = sorted(assets, key=lambda x: x.get("fileCreatedAt", ""))
 
-    if selection_mode != "smart" or not is_embedding_available(entity_type):
+    if selection_mode != "smart" or not is_embedding_available():
         if selection_mode == "smart":
-            model_name = "InsightFace" if entity_type == "face" else "SigLIP"
-            logger.warning(f"{model_name} unavailable. Falling back to time spread.")
+            logger.warning("InsightFace unavailable. Falling back to time spread.")
         return _select_time_spread(assets, limit)
 
     try:
-        return _select_by_embedding(assets, limit, entity_type, person_id, progress_callback)
+        return _select_by_embedding(assets, limit, person_id, progress_callback, fetch_fn=fetch_fn)
     except Exception as e:
-        logger.error(f"Smart Diversity failed: {e}. Falling back to time spread.")
+        logger.error("Smart Diversity failed: %s. Falling back to time spread.", e)
         return _select_time_spread(assets, limit)
 
 
@@ -179,22 +189,21 @@ def _crop_face_from_thumbnail(
 def _select_by_embedding(
     assets: list,
     limit: int | str,
-    entity_type: str,
     person_id: str | None = None,
     progress_callback=None,
+    fetch_fn=None,
 ) -> list:
     """Select assets using embedding-based cluster-aware FPS.
 
     Pipeline:
     1. Concurrent thumbnail download
     2. Quality filtering
-    3. Face crop extraction (face mode only)
+    3. Face crop extraction
     4. Embedding computation
     5. Cluster-aware selection with hard example weighting
     """
-    # Determine candidate pool (cap at 3000 for performance)
     effective_limit = 30 if limit == "auto" else limit
-    pool_size = min(3000, max(effective_limit * 20, len(assets)))
+    pool_size = min(_POOL_CAP, max(effective_limit * _POOL_SCALE, len(assets)))
 
     # Subsample if needed (evenly distributed in time)
     if len(assets) > pool_size:
@@ -207,20 +216,25 @@ def _select_by_embedding(
     # Process in bounded batches so at most _BATCH decoded images live in RAM
     # at once. With 472 candidates each thumbnail is ~3-8 MB decoded; loading
     # all at once easily exhausts a 4 GB container limit on CPU.
-    from concurrent.futures import ThreadPoolExecutor, as_completed
-
-    _BATCH = 32
+    # LIMITATION — thumbnail-resolution embeddings drive full-res crop selection:
+    # diversity selection runs InsightFace on Immich preview thumbnails (~720p)
+    # to avoid downloading full-res for every candidate, but the training crop
+    # comes from the full-resolution original. Embeddings from thumbnails are
+    # representative in practice, but heavy JPEG compression on a preview could
+    # produce a subtly different embedding than the full-res version. For most
+    # libraries this is negligible; it matters if Immich preview quality is low.
+    _fetch = fetch_fn or _fetch_thumbnail
     embeddings, valid_candidates, confidence_scores = [], [], []
     quality_filtered = 0
     processed = 0
 
-    for batch_start in range(0, len(candidates), _BATCH):
-        batch = candidates[batch_start : batch_start + _BATCH]
+    for batch_start in range(0, len(candidates), _EMBEDDING_BATCH_SIZE):
+        batch = candidates[batch_start : batch_start + _EMBEDDING_BATCH_SIZE]
 
         # Download this batch concurrently
         batch_images: dict[str, Image.Image] = {}
         with ThreadPoolExecutor(max_workers=min(8, len(batch))) as pool:
-            futures = {pool.submit(_fetch_thumbnail, a["id"]): a for a in batch}
+            futures = {pool.submit(_fetch, a["id"]): a for a in batch}
             for future in as_completed(futures):
                 asset = futures[future]
                 try:
@@ -228,7 +242,7 @@ def _select_by_embedding(
                     if img is not None:
                         batch_images[asset["id"]] = img
                 except Exception as e:
-                    logger.debug(f"Failed to fetch thumbnail for {asset['id']}: {e}")
+                    logger.debug("Failed to fetch thumbnail for %s: %s", asset["id"], e)
                     continue
 
         # Process each image; batch_images goes out of scope after this loop,
@@ -243,54 +257,121 @@ def _select_by_embedding(
 
             confidence = _get_face_confidence(asset, person_id=person_id)
 
-            if entity_type == "face":
-                face_bbox = _get_face_bbox(asset, person_id=person_id)
-                quality = assess_quality(
-                    img,
-                    face_bbox=face_bbox,
-                    confidence=confidence,
-                    blur_threshold=Config.BLUR_THRESHOLD,
-                    min_face_px=Config.MIN_FACE_WIDTH,
-                    min_confidence=Config.MIN_CONFIDENCE,
-                )
-                if not quality.passed:
-                    quality_filtered += 1
-                    logger.debug(f"Quality filtered {asset['id']}: {quality.reason}")
-                    continue
+            face_bbox = _get_face_bbox(asset, person_id=person_id)
+            quality = assess_quality(
+                img,
+                face_bbox=face_bbox,
+                confidence=confidence,
+                blur_threshold=Config.BLUR_THRESHOLD,
+                min_face_px=Config.MIN_FACE_WIDTH,
+                min_confidence=Config.MIN_CONFIDENCE,
+            )
+            if not quality.passed:
+                quality_filtered += 1
+                logger.debug("Quality filtered %s: %s", asset["id"], quality.reason)
+                continue
 
-                asset["quality_score"] = quality.blur_score
-                face_crop = _crop_face_from_thumbnail(img, asset, person_id=person_id)
-                embed_img = face_crop if face_crop is not None else img
-            else:
-                embed_img = img
+            asset["quality_score"] = quality.blur_score
+            face_crop = _crop_face_from_thumbnail(img, asset, person_id=person_id)
+            embed_img = face_crop if face_crop is not None else img
 
-            emb = get_embedding(embed_img, entity_type, asset_id=asset["id"])
+            emb = get_embedding(embed_img, asset_id=asset["id"])
             if emb is not None:
                 embeddings.append(emb)
                 valid_candidates.append(asset)
                 confidence_scores.append(confidence)
 
     if quality_filtered > 0:
-        logger.info(f"Quality filtering removed {quality_filtered} images.")
+        logger.info("Quality filtering removed %s images.", quality_filtered)
 
     if not embeddings:
         logger.warning("No valid embeddings found. Falling back to time spread.")
         return _select_time_spread(assets, limit)
 
     if limit != "auto" and len(valid_candidates) < limit:
-        logger.warning(f"Only {len(valid_candidates)} valid embeddings. Returning all.")
+        logger.warning("Only %s valid embeddings. Returning all.", len(valid_candidates))
         return valid_candidates
 
-    # --- Phase 5: Cluster-aware selection ---
+    # --- Phase 5: Near-duplicate removal ---
+    # Burst shots and repeated near-identical photos produce embeddings that are
+    # close but not identical, so FPS doesn't filter them out on its own.
+    # Greedily drop any candidate within DEDUP_THRESHOLD cosine distance of a
+    # higher-quality image already in the kept set.
+    embeddings, valid_candidates, confidence_scores = _dedup_embeddings(
+        embeddings, valid_candidates, confidence_scores
+    )
+
+    # Re-check after dedup: pool may have shrunk below limit
+    if limit != "auto" and len(valid_candidates) < limit:
+        logger.warning("Only %s embeddings after near-duplicate removal. Returning all.", len(valid_candidates))
+        return valid_candidates
+
+    # --- Phase 6: Cluster-aware selection ---
     return _cluster_aware_selection(
         embeddings,
         valid_candidates,
         limit,
-        entity_type=entity_type,
         confidence_scores=confidence_scores,
     )
 
 
+# =============================================================================
+# Near-Duplicate Removal
+# =============================================================================
+
+_DEDUP_THRESHOLD = 0.20  # cosine distance — burst shots ~0.01-0.05, same-event similar shots ~0.10-0.20
+
+
+def _dedup_embeddings(
+    embeddings: list,
+    candidates: list,
+    confidence_scores: list,
+) -> tuple[list, list, list]:
+    """Greedy near-duplicate removal before clustering.
+
+    Sorts by quality score descending (best first), then for each candidate
+    drops it if any already-kept embedding is within _DEDUP_THRESHOLD cosine
+    distance. This eliminates burst-shot near-duplicates while preserving the
+    highest-quality representative from each near-identical group.
+    """
+    if len(embeddings) < 2:
+        return embeddings, candidates, confidence_scores
+
+    emb_matrix = np.vstack(embeddings)
+    norms = np.linalg.norm(emb_matrix, axis=1, keepdims=True)
+    emb_normed = emb_matrix / np.maximum(norms, 1e-8)
+
+    # Sort by quality descending so the best image in each near-duplicate group wins.
+    # Use explicit None check so a legitimate quality_score=0.0 isn't treated as missing.
+    quality_scores = [qs if (qs := c.get("quality_score")) is not None else 0.0 for c in candidates]
+    order = sorted(range(len(candidates)), key=lambda i: quality_scores[i], reverse=True)
+
+    kept_indices = []
+    # Pre-allocate a max-size buffer and fill row-by-row — eliminates the O(K²)
+    # copy overhead from vstack-on-keep while keeping identical arithmetic.
+    kept_buf = np.empty((len(order), emb_normed.shape[1]), dtype=emb_normed.dtype)
+    n_kept = 0
+
+    for i in order:
+        if n_kept > 0:
+            sims = emb_normed[i] @ kept_buf[:n_kept].T
+            if np.any(sims > 1 - _DEDUP_THRESHOLD):
+                continue
+        kept_buf[n_kept] = emb_normed[i]
+        n_kept += 1
+        kept_indices.append(i)
+
+    dropped = len(embeddings) - len(kept_indices)
+    if dropped:
+        logger.info("Near-duplicate removal dropped %s images (threshold %s).", dropped, _DEDUP_THRESHOLD)
+
+    return (
+        [embeddings[i] for i in kept_indices],
+        [candidates[i] for i in kept_indices],
+        [confidence_scores[i] for i in kept_indices],
+    )
+
+
 # =============================================================================
 # K-Medoids (Lightweight Implementation)
 # =============================================================================
@@ -322,7 +403,7 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
     # Iterative swap step
     medoids = list(medoids)
     labels = np.argmin(dist_matrix[:, medoids], axis=1)
-    cost = sum(dist_matrix[i, medoids[labels[i]]] for i in range(n))
+    cost = dist_matrix[np.arange(n), np.array(medoids)[labels]].sum()
 
     for _ in range(max_iter):
         improved = False
@@ -337,7 +418,7 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
                 new_medoids = medoids.copy()
                 new_medoids[m_idx] = cand
                 new_labels = np.argmin(dist_matrix[:, new_medoids], axis=1)
-                new_cost = sum(dist_matrix[i, new_medoids[new_labels[i]]] for i in range(n))
+                new_cost = dist_matrix[np.arange(n), np.array(new_medoids)[new_labels]].sum()
                 if new_cost < cost:
                     medoids = new_medoids
                     labels = new_labels
@@ -358,11 +439,11 @@ def _kmedoids(dist_matrix: np.ndarray, k: int, max_iter: int = 50) -> tuple[list
 # =============================================================================
 
 
-def _compute_adaptive_threshold(emb_normed: np.ndarray, entity_type: str) -> float:
+def _compute_adaptive_threshold(emb_normed: np.ndarray) -> float:
     """Compute adaptive FPS stop threshold based on actual embedding distribution.
 
     Instead of a hardcoded threshold, samples pairwise distances and sets
-    the threshold as a fraction of the median pairwise distance.
+    the threshold as 20% of the median pairwise distance.
     """
     n = len(emb_normed)
     sample_size = min(200, n)
@@ -370,20 +451,14 @@ def _compute_adaptive_threshold(emb_normed: np.ndarray, entity_type: str) -> flo
     indices = rng.choice(n, sample_size, replace=False) if n > sample_size else np.arange(n)
     sample = emb_normed[indices]
 
-    # Compute pairwise cosine distances for the sample
     pairwise = 1 - sample @ sample.T
     upper_tri = pairwise[np.triu_indices(len(sample), k=1)]
+    if len(upper_tri) == 0:
+        return 0.05
     median_dist = float(np.median(upper_tri))
+    threshold = max(0.05, median_dist * 0.20)
 
-    # Faces: 20% of median (tighter — want fewer, more distinct images)
-    # Objects: 10% of median (wider — want more diversity)
-    fraction = 0.20 if entity_type == "face" else 0.10
-    threshold = max(0.05, median_dist * fraction)
-
-    logger.debug(
-        f"Adaptive threshold: {threshold:.4f} "
-        f"(median_dist={median_dist:.4f}, fraction={fraction}, type={entity_type})"
-    )
+    logger.debug("Adaptive threshold: %.4f (median_dist=%.4f)", threshold, median_dist)
     return threshold
 
 
@@ -391,7 +466,6 @@ def _cluster_aware_selection(
     embeddings: list,
     candidates: list,
     limit: int | str,
-    entity_type: str = "face",
     confidence_scores: list | None = None,
 ) -> list:
     """Two-stage selection: K-Medoids clustering → FPS with hard example weighting.
@@ -411,18 +485,23 @@ def _cluster_aware_selection(
 
     # Build confidence weight array for hard example boosting
     conf_array = np.ones(n)
-    if confidence_scores and entity_type == "face":
+    if confidence_scores:
         for i, c in enumerate(confidence_scores):
             if c is not None:
                 conf_array[i] = c
 
     # Compute adaptive threshold for auto mode
-    auto_threshold = _compute_adaptive_threshold(emb_normed, entity_type) if limit == "auto" else 0.0
+    auto_threshold = _compute_adaptive_threshold(emb_normed) if limit == "auto" else 0.0
     target = Config.MAX_AUTO_IMAGES if limit == "auto" else limit
 
+    # Short-circuit: nothing to select
+    if limit != "auto" and target <= 0:
+        return []
+
     # --- Stage 1: K-Medoids clustering ---
-    k = min(max(5, target // 4), n // 3, n)  # e.g., 5-20 clusters
-    logger.debug(f"Clustering {n} embeddings into {k} groups (K-Medoids)...")
+    # Cap k at target so we never seed more cluster representatives than requested.
+    k = min(max(5, target // 4), max(1, n // 3), n, target)  # e.g., 1-20 clusters
+    logger.debug("Clustering %s embeddings into %s groups (K-Medoids)...", n, k)
 
     # Compute full cosine distance matrix
     dist_matrix = 1 - emb_normed @ emb_normed.T
@@ -431,7 +510,7 @@ def _cluster_aware_selection(
     selected = list(medoid_indices)
     selected_set = set(selected)
 
-    logger.debug(f"Selected {len(selected)} cluster medoids as initial picks.")
+    logger.debug("Selected %s cluster medoids as initial picks.", len(selected))
 
     # --- Stage 2: FPS with hard example weighting ---
     min_dists = np.full(n, np.inf)
@@ -469,17 +548,16 @@ def _cluster_aware_selection(
         min_dists = np.minimum(min_dists, dists_to_new)
         min_dists[best_idx] = -np.inf
 
-    # Log hard example stats
-    if entity_type == "face":
-        selected_conf = [conf_array[i] for i in selected if conf_array[i] < 1.0]
-        hard_count = sum(1 for c in selected_conf if c < 0.85)
-        logger.info(
-            f"Selection complete: {len(selected)} images " f"({hard_count} hard examples with confidence < 0.85)."
-        )
-    else:
-        logger.info(f"Selection complete: {len(selected)} diverse images.")
+    selected_conf = [conf_array[i] for i in selected if conf_array[i] < 1.0]
+    hard_count = sum(1 for c in selected_conf if c < 0.85)
+    logger.info("Selection complete: %s images (%s hard examples with confidence < 0.85).", len(selected), hard_count)
 
-    return [candidates[i] for i in selected]
+    # Slice to target: the while loop enforces this for non-auto mode, but
+    # guard here too in case the medoid seed already exceeded target (small target).
+    result = [candidates[i] for i in selected]
+    if limit != "auto":
+        result = result[:target]
+    return result
 
 
 # =============================================================================
@@ -492,7 +570,7 @@ def _select_time_spread(assets: list, limit: int | str) -> list:
     if limit == "auto":
         limit = 30
 
-    logger.info(f"Selecting {limit} images using time spread.")
+    logger.info("Selecting %s images using time spread.", limit)
 
     if len(assets) <= limit:
         return assets

winnow/embeddings.py

@@ -1,8 +1,7 @@
 """
-Unified embedding interface for faces and objects.
+Embedding interface for face diversity selection.
 
 - Faces: InsightFace (ArcFace/Buffalo_L) — or reuse from Immich
-- Objects: SigLIP (Vision Transformer via transformers)
 - Caching: Disk-based cache avoids recomputation on reruns
 """
 
@@ -19,6 +18,7 @@ import numpy as np
 from PIL import Image
 
 from .cache import get_cache
+from .config import _getenv_bool
 
 logger = logging.getLogger(__name__)
 
@@ -36,23 +36,22 @@ def _suppress_output():
         try:
             os.dup2(saved_out, 1)
         finally:
-            os.dup2(saved_err, 2)
-        os.close(devnull_fd)
-        os.close(saved_out)
-        os.close(saved_err)
+            try:
+                os.dup2(saved_err, 2)
+            finally:
+                os.close(devnull_fd)
+                os.close(saved_out)
+                os.close(saved_err)
 
 
-# Lazy-loaded singletons
+# Lazy-loaded singleton
 _insightface_app = None
 _insightface_loaded = False
-_siglip_model = None
-_siglip_processor = None
-_siglip_loaded = False
 
 
 def _is_force_cpu() -> bool:
     """Check if CPU mode is forced via environment variable."""
-    return os.getenv("FORCE_CPU", "").lower() in ("true", "1", "yes")
+    return _getenv_bool("FORCE_CPU", False)
 
 
 def _preload_cuda_libs() -> None:
@@ -70,7 +69,7 @@ def _preload_cuda_libs() -> None:
         else:
             logger.debug("onnxruntime.preload_dlls() not available (ORT < 1.21)")
     except Exception as e:
-        logger.warning(f"Failed to preload CUDA/cuDNN DLLs: {e}")
+        logger.warning("Failed to preload CUDA/cuDNN DLLs: %s", e)
 
 
 # =============================================================================
@@ -104,7 +103,7 @@ def get_insightface_app():
 
         # Get providers, excluding TensorRT to avoid noisy errors
         providers = [p for p in ort.get_available_providers() if p != "TensorrtExecutionProvider"]
-        logger.debug(f"ONNX providers available: {providers}")
+        logger.debug("ONNX providers available: %s", providers)
 
         gpu_providers = {
             "CUDAExecutionProvider",
@@ -125,7 +124,7 @@ def get_insightface_app():
                 if p == "OpenVINOExecutionProvider" else p
                 for p in providers
             ]
-            logger.debug(f"OpenVINO EP: device_type={openvino_device}")
+            logger.debug("OpenVINO EP: device_type=%s", openvino_device)
 
         if not has_gpu_provider and not _is_force_cpu():
             logger.warning(
@@ -140,21 +139,21 @@ def get_insightface_app():
             device_str = f"OpenVINO ({os.getenv('OPENVINO_DEVICE', 'CPU')})"
         else:
             device_str = "GPU"
-        logger.info(f"InsightFace Buffalo_L: loading into memory on {device_str}...")
+        logger.info("InsightFace Buffalo_L: loading into memory on %s...", device_str)
 
         t0 = time.time()
         with _suppress_output():
             _insightface_app = FaceAnalysis(name="buffalo_l", root=insightface_home, providers=providers)
             _insightface_app.prepare(ctx_id=ctx_id, det_size=(640, 640))
 
-        logger.info(f"InsightFace Buffalo_L: ready on {device_str} ({time.time() - t0:.1f}s)")
+        logger.info("InsightFace Buffalo_L: ready on %s (%.1fs)", device_str, time.time() - t0)
         return _insightface_app
 
     except ImportError:
         logger.error("InsightFace not installed!")
         return None
     except Exception as e:
-        logger.error(f"Failed to load InsightFace: {e}")
+        logger.error("Failed to load InsightFace: %s", e)
         if ctx_id == 0:
             logger.warning("InsightFace GPU load failed — retrying on CPU...")
             try:
@@ -168,10 +167,10 @@ def get_insightface_app():
                         providers=["CPUExecutionProvider"],
                     )
                     _insightface_app.prepare(ctx_id=-1, det_size=(640, 640))
-                logger.info(f"InsightFace Buffalo_L: ready on CPU (fallback, {time.time() - t0:.1f}s)")
+                logger.info("InsightFace Buffalo_L: ready on CPU (fallback, %.1fs)", time.time() - t0)
                 return _insightface_app
             except Exception as ex:
-                logger.error(f"InsightFace CPU fallback failed: {ex}")
+                logger.error("InsightFace CPU fallback failed: %s", ex)
         return None
 
 
@@ -197,174 +196,38 @@ def get_face_embedding(img_pil: Image.Image) -> np.ndarray | None:
         largest = max(faces, key=lambda f: (f.bbox[2] - f.bbox[0]) * (f.bbox[3] - f.bbox[1]))
         return largest.embedding
     except Exception as e:
-        logger.error(f"Error getting face embedding: {e}")
+        logger.error("Error getting face embedding: %s", e)
         return None
 
 
 # =============================================================================
-# SigLIP (Objects)
-# =============================================================================
-
-
-def get_siglip_model():
-    """Singleton for SigLIP model and processor with GPU auto-detection."""
-    global _siglip_model, _siglip_processor, _siglip_loaded
-    if _siglip_loaded:
-        return _siglip_model, _siglip_processor
-    _siglip_loaded = True
-
-    try:
-        import warnings
-
-        import torch
-        from transformers import AutoImageProcessor, SiglipVisionModel
-
-        model_name = "google/siglip-base-patch16-224"
-
-        # Disk cache check — path derived from model_name using HuggingFace's slug convention
-        hf_home = os.environ.get("HF_HOME", os.path.join(os.path.expanduser("~"), ".cache", "huggingface"))
-        cache_slug = "models--" + model_name.replace("/", "--")
-        model_cache = Path(hf_home) / "hub" / cache_slug
-        if model_cache.exists() and any(model_cache.iterdir()):
-            logger.info(f"SigLIP {model_name}: found in model cache")
-        else:
-            logger.info(f"SigLIP {model_name}: not cached — downloading now (~380 MB)")
-
-        logger.info(f"SigLIP {model_name}: loading into memory...")
-        t0 = time.time()
-
-        with warnings.catch_warnings():
-            warnings.filterwarnings("ignore", category=FutureWarning)
-            warnings.filterwarnings("ignore", message=".*use_fast.*")
-            _siglip_processor = AutoImageProcessor.from_pretrained(model_name, use_fast=True)
-            _siglip_model = SiglipVisionModel.from_pretrained(model_name)
-
-        _siglip_model.eval()
-
-        # Move to GPU if available (ROCm builds expose torch.cuda.is_available() == True)
-        if not _is_force_cpu():
-            if torch.cuda.is_available():
-                _siglip_model = _siglip_model.cuda()
-                device_name = "CUDA GPU"
-            elif hasattr(torch, "xpu") and torch.xpu.is_available():
-                _siglip_model = _siglip_model.to("xpu")
-                device_name = "Intel XPU"
-            elif hasattr(torch.backends, "mps") and torch.backends.mps.is_available():
-                _siglip_model = _siglip_model.to("mps")
-                device_name = "Apple MPS"
-            else:
-                device_name = "CPU"
-        else:
-            device_name = "CPU (FORCE_CPU)"
-
-        logger.info(f"SigLIP {model_name}: ready on {device_name} ({time.time() - t0:.1f}s)")
-        return _siglip_model, _siglip_processor
-
-    except ImportError as e:
-        logger.error(f"transformers/torch not installed: {e}")
-        return None, None
-    except Exception as e:
-        logger.error(f"Failed to load SigLIP: {e}")
-        return None, None
-
-
-def get_object_embedding(img_pil: Image.Image) -> np.ndarray | None:
-    """Get 768-dim SigLIP embedding for an image."""
-    model, processor = get_siglip_model()
-    if model is None:
-        return None
-
-    try:
-        import torch
-
-        inputs = processor(images=img_pil, return_tensors="pt")
-        device = next(model.parameters()).device
-        inputs = {k: v.to(device) for k, v in inputs.items()}
-
-        with torch.no_grad():
-            outputs = model(**inputs)
-            return outputs.pooler_output.squeeze().cpu().numpy()
-    except Exception as e:
-        logger.error(f"Error getting object embedding: {e}")
-        return None
-
-
-def get_object_embeddings_batch(images: list[Image.Image]) -> list[np.ndarray | None]:
-    """Get SigLIP embeddings for a batch of images (GPU-efficient)."""
-    model, processor = get_siglip_model()
-    if model is None:
-        return [None] * len(images)
-
-    try:
-        import torch
-
-        inputs = processor(images=images, return_tensors="pt", padding=True)
-        device = next(model.parameters()).device
-        inputs = {k: v.to(device) for k, v in inputs.items()}
-
-        with torch.no_grad():
-            outputs = model(**inputs)
-            embeddings = outputs.pooler_output.cpu().numpy()
-            return [embeddings[i] for i in range(len(embeddings))]
-    except Exception as e:
-        logger.error(f"Error in batch embedding: {e}")
-        # Fall back to individual computation
-        return [get_object_embedding(img) for img in images]
-
-
-# =============================================================================
-# Unified Interface with Caching
+# Embedding Interface with Caching
 # =============================================================================
 
 
 def get_embedding(
     img_pil: Image.Image,
-    entity_type: str = "face",
     asset_id: str | None = None,
-    immich_embedding: np.ndarray | None = None,
 ) -> np.ndarray | None:
-    """Get embedding for an image based on entity type.
+    """Get embedding for a face image.
 
-    Priority:
-    1. Pre-fetched Immich embedding (if provided)
-    2. Disk cache (if enabled and asset_id provided)
-    3. Local model computation (InsightFace or SigLIP)
-
-    Args:
-        img_pil: The image to embed
-        entity_type: 'face' or 'object'
-        asset_id: Optional asset ID for cache lookup
-        immich_embedding: Optional pre-fetched embedding from Immich API
+    Checks disk cache first (if enabled and asset_id provided),
+    then falls back to local InsightFace computation.
     """
     from .config import Config
 
     use_cache = Config.ENABLE_CACHE and asset_id is not None
-    cache = get_cache(Config.CACHE_DIR) if use_cache else None
-    # Use a single consistent cache key per model so lookups and stores always match.
-    # "immich" was previously used as the face key on the lookup path but "insightface"
-    # on the store path — meaning the cache was never hit for locally-computed embeddings.
-    cache_key = "insightface" if entity_type == "face" else "siglip"
+    cache = get_cache(Config.DATA_DIR) if use_cache else None
 
-    # 1. Use Immich embedding if provided
-    if immich_embedding is not None:
-        if cache:
-            cache.put(asset_id, immich_embedding, cache_key)
-        return immich_embedding
-
-    # 2. Check disk cache
     if cache:
-        cached = cache.get(asset_id, cache_key)
+        cached = cache.get(asset_id, "insightface")
         if cached is not None:
             return cached
 
-    # 3. Compute locally
-    if entity_type == "face":
-        emb = get_face_embedding(img_pil)
-    else:
-        emb = get_object_embedding(img_pil)
+    emb = get_face_embedding(img_pil)
 
     if emb is not None and cache:
-        cache.put(asset_id, emb, cache_key)
+        cache.put(asset_id, emb, "insightface")
 
     return emb
 
@@ -372,42 +235,23 @@ def get_embedding(
 def _is_module_available(module_name: str) -> bool:
     """Check if a Python module is importable without importing it fully."""
     try:
-        importlib.util.find_spec(module_name)
-        return True
+        return importlib.util.find_spec(module_name) is not None
     except (ModuleNotFoundError, ValueError):
         return False
 
 
-def is_embedding_available(entity_type: str = "face", *, load: bool = False) -> bool:
-    """Check if embedding model is available for the given entity type.
+def is_embedding_available(*, load: bool = False) -> bool:
+    """Check if InsightFace is available.
 
     By default this performs a lightweight import-check only (no model loading).
-    Pass ``load=True`` to actually load the model (expensive, hundreds of MB).
-
-    Args:
-        entity_type: 'face' or 'object'
-        load: If True, fully load the model to verify. If False (default),
-              only check that the required packages are importable.
+    Pass ``load=True`` to actually load the model (expensive, ~300 MB).
     """
     if load:
-        if entity_type == "face":
-            return get_insightface_app() is not None
-        model, _ = get_siglip_model()
-        return model is not None
-
-    # Lightweight check: just verify the packages are importable
-    if entity_type == "face":
-        return _is_module_available("insightface") and _is_module_available("onnxruntime")
-    return _is_module_available("transformers") and _is_module_available("torch")
-
-
-def load_embedding_model(entity_type: str = "face") -> bool:
-    """Explicitly load the embedding model for the given entity type.
-
-    Returns True if the model loaded successfully.
-    """
-    if entity_type == "face":
         return get_insightface_app() is not None
-    model, _ = get_siglip_model()
-    return model is not None
+    return _is_module_available("insightface") and _is_module_available("onnxruntime")
+
+
+def load_embedding_model() -> bool:
+    """Explicitly load InsightFace. Returns True if the model loaded successfully."""
+    return get_insightface_app() is not None
 

winnow/executor.py

@@ -3,136 +3,67 @@
 import logging
 import os
 import shutil
-import time
 from io import BytesIO
 from urllib.parse import quote
 
+import PIL
 import requests
 from PIL import Image
 from rich import print as rprint
 from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn, TextColumn
 
 from .config import Config, get_headers
-from .frigate_api import delete_frigate_person_files, get_frigate_person_files
-from .image_processing import process_face_mode, process_full_mode, process_object_mode
-from .immich_api import fetch_face_data, fetch_full_image
+from .frigate_api import (
+    _get_frigate_url,
+    delete_frigate_person_files,
+    get_all_frigate_person_files,
+    get_frigate_person_files,
+    get_frigate_version,
+    recognize_face,
+)
+from .image_processing import process_face_mode
+from .immich_api import fetch_full_image
 from .log_config import console
-from .quality import assess_quality
+from .quality import blur_score_from_image
+from .reconcile import enrich_asset_with_face_data, reconcile_frigate_mappings
 from .upload_tracker import (
     get_lowest_quality_mapped_file,
+    get_most_redundant_mapped_file,
     get_tracked_frigate_file_count,
     get_tracked_frigate_filenames,
+    has_frigate_scores,
     mark_rejected,
     mark_uploaded,
-    record_frigate_file,
+    begin_batch,
+    flush_batch,
     remove_frigate_file,
+    remove_frigate_files_batch,
 )
 
 logger = logging.getLogger(__name__)
 
 
-def _reconcile_frigate_mappings(
-    person_name: str,
-    known_files_before: set[str],
-    uploaded: list[tuple[str, str | None]],
-) -> None:
-    """Map Frigate filenames to asset IDs after a batch of uploads.
+def _safe_person_dir(output_dir: str, person_name: str) -> str:
+    """Return the output subdirectory for a person, raising ValueError on path traversal.
 
-    Polls until all expected new files appear in the Frigate API, then maps
-    them to asset IDs by filename timestamp order (Frigate processes the
-    upload queue in FIFO order, so earlier uploads get earlier timestamps).
-
-    KNOWN LIMITATION — race condition with external uploads:
-    If another client uploads a face file for this person concurrently, the
-    count of new files will exceed `len(uploaded)` and we bail out entirely
-    (the "> target" branch). That's safe — we never record a wrong mapping —
-    but those uploads become permanently unmapped (they won't be eligible for
-    quality replacement). The right fix is a Frigate API that returns the
-    filename in the upload response, removing the need for any post-upload
-    diffing. Until then, the external-upload guard keeps mappings correct at
-    the cost of occasionally missing them when another client is active.
+    os.path.join silently discards output_dir when person_name is absolute,
+    and '../..' sequences resolve outside the tree. Both are rejected by the
+    realpath+startswith guard, which is the load-bearing security check.
+    The islink check below provides an earlier, cleaner error message for the
+    symlink sub-case; it is redundant with (not a replacement for) the
+    realpath+startswith traversal check.
     """
-    target = len(uploaded)
-    current_files: set[str] = set()
-
-    for delay in (1, 2, 4, 8):
-        time.sleep(delay)
-        fresh = get_frigate_person_files(person_name)
-        if fresh is None:
-            logger.warning(
-                f"{person_name}: Frigate API unreachable during mapping reconciliation"
-                " — quality replacement won't target these files"
-            )
-            return
-        current_files = set(fresh)
-        if len(current_files - known_files_before) >= target:
-            break
-
-    new_files = current_files - known_files_before
-
-    if len(new_files) == target:
-        def _ts(fname: str) -> float:
-            try:
-                return float(fname.rsplit("_", 1)[-1].replace(".webp", ""))
-            except (ValueError, IndexError):
-                return 0.0
-
-        for (fname, asset_id), frigate_file in zip(uploaded, sorted(new_files, key=_ts)):
-            if asset_id:
-                record_frigate_file(person_name, frigate_file, asset_id)
-        logger.debug(f"{person_name}: batch-mapped {target} Frigate file(s)")
-    elif len(new_files) > target:
-        logger.info(
-            f"{person_name}: {len(new_files)} new Frigate files for {target} uploads"
-            " (external upload detected) — skipping file mapping"
-        )
-    else:
-        logger.warning(
-            f"{person_name}: only {len(new_files)} of {target} expected Frigate files"
-            " appeared after reconciliation — mapping skipped"
-        )
-
-
-def _enrich_asset_with_face_data(asset: dict, person: dict) -> dict:
-    """Enrich an asset dict with face bounding box data from the Immich faces API.
-
-    The search/metadata endpoint does not include face bounding box data,
-    so we fetch it from GET /api/faces?id={asset_id} and inject it into
-    the asset's "people" field so process_face_mode can find it.
-
-    Returns the enriched asset dict (modifies in place and returns it).
-    """
-    person_id = person["id"]
-    face_data = fetch_face_data(asset["id"], person_id=person_id)
-
-    if face_data is None:
-        logger.debug(f"No face data returned for {person.get('name')} in asset {asset.get('id')}")
-        # Clean any None entries from the people list (can come from Immich API)
-        if "people" in asset:
-            asset["people"] = [p for p in asset["people"] if p is not None]
-        return asset
-
-    # Skip zero-area bounding boxes (face detection failed or no face found)
-    if face_data.bbox == (0, 0, 0, 0):
-        logger.debug(f"Zero-area bounding box for {person.get('name')} in asset {asset.get('id')}")
-        # Clean any None entries from the people list (can come from Immich API)
-        if "people" in asset:
-            asset["people"] = [p for p in asset["people"] if p is not None]
-        return asset
-
-    face_info = {
-        "boundingBoxX1": face_data.bbox[0],
-        "boundingBoxY1": face_data.bbox[1],
-        "boundingBoxX2": face_data.bbox[2],
-        "boundingBoxY2": face_data.bbox[3],
-        "imageWidth": face_data.image_width,
-        "imageHeight": face_data.image_height,
-    }
-
-    # Inject into asset so process_face_mode can find it via asset["people"]
-    asset["people"] = [{"id": person_id, "faces": [face_info]}]
-    asset["face_confidence"] = face_data.confidence
-    return asset
+    raw = os.path.join(output_dir, person_name)
+    if os.path.islink(raw):
+        raise ValueError(f"Person name {person_name!r} resolves to a symlink — skipping")
+    candidate = os.path.realpath(raw)
+    base = os.path.realpath(output_dir)
+    # Use the base path as its own prefix when it's the filesystem root ("/"),
+    # otherwise append os.sep — avoids the false "//" double-slash when base == "/".
+    base_prefix = base if base == os.sep else base + os.sep
+    if not candidate.startswith(base_prefix) and candidate != base:
+        raise ValueError(f"Person name {person_name!r} escapes output directory — skipping")
+    return candidate
 
 
 def execute_jobs(jobs: list[dict]) -> None:
@@ -148,6 +79,18 @@ def execute_jobs(jobs: list[dict]) -> None:
 
     use_full_res = Config.USE_FULL_RESOLUTION
 
+    # Load InsightFace app for landmark-based crop alignment.
+    # The model is already resident from the diversity/embedding phase, so this
+    # is just a singleton lookup — no load cost.
+    insightface_app = None
+    if Config.ENABLE_FACE_ALIGNMENT:
+        try:
+            from .embeddings import get_insightface_app
+
+            insightface_app = get_insightface_app()
+        except Exception as e:
+            logger.debug("InsightFace unavailable for crop alignment: %s", e)
+
     with Progress(
         SpinnerColumn(),
         TextColumn("[progress.description]{task.description}"),
@@ -159,130 +102,151 @@ def execute_jobs(jobs: list[dict]) -> None:
         overall_task = progress.add_task("[green]Overall Progress", total=grand_total)
 
         for job in jobs:
-            person, assets, config = job["person"], job["assets"], job["config"]
-            name, mode = person["name"], config.get("mode", "face")
+            person, assets = job["person"], job["assets"]
+            name = person["name"]
 
             job_task = progress.add_task(f"Processing {name}...", total=len(assets))
-            person_dir = os.path.join(Config.OUTPUT_DIR, name)
-            # Face crops are transient (uploaded then discarded); wipe before each run.
-            # Object crops are the deliverable; preserve them across runs.
-            if mode == "face" and os.path.isdir(person_dir):
-                shutil.rmtree(person_dir)
-            os.makedirs(person_dir, exist_ok=True)
-
-            # Track filename → asset_id, filename → confidence score, filename → crop dims
-            asset_map: dict[str, str] = {}
-            score_map: dict[str, float | None] = {}
-            dims_map: dict[str, tuple[int, int]] = {}
-
-            count = 0
-            for asset in assets:
+            try:
                 try:
-                    # For face mode, enrich the asset with face bounding box data
-                    # from the Immich faces API (not included in search/metadata results)
-                    if mode == "face":
-                        asset = _enrich_asset_with_face_data(asset, person)
+                    person_dir = _safe_person_dir(Config.OUTPUT_DIR, name)
+                except ValueError as e:
+                    logger.error(str(e))
+                    continue
+                # Face crops are transient (uploaded then discarded); wipe before each run.
+                # A symlink could appear here via a TOCTOU race after _safe_person_dir
+                # returned — writing through it would land crops outside output_dir.
+                if os.path.islink(person_dir):
+                    logger.error("person_dir %s became a symlink after path check — skipping job", person_dir)
+                    continue
+                try:
+                    if os.path.isdir(person_dir):
+                        shutil.rmtree(person_dir)
+                    os.makedirs(person_dir, exist_ok=True)
+                except OSError as e:
+                    logger.error("Failed to prepare output dir for %s: %s", name, e)
+                    continue
 
-                    # Use full-resolution for final output when configured
-                    if use_full_res:
-                        img = fetch_full_image(asset["id"])
-                    else:
-                        resp = requests.get(
-                            f"{Config.IMMICH_URL}/api/assets/{asset['id']}/thumbnail?size=preview&format=JPEG",
-                            headers=get_headers(),
-                            timeout=30,
-                        )
-                        img = Image.open(BytesIO(resp.content)) if resp.ok else None
+                # Track filename → asset_id, filename → confidence score, filename → crop dims
+                asset_map: dict[str, str] = {}
+                score_map: dict[str, float | None] = {}
+                dims_map: dict[str, tuple[int, int]] = {}
 
-                    if img is None:
-                        progress.console.print(f"[red]Failed download {asset['id']}[/red]")
-                    else:
-                        saved = (
-                            process_face_mode(img, asset, person, person_dir, count)
-                            if mode == "face"
-                            else process_object_mode(img, config, person_dir, count)
-                            if mode == "object"
-                            else process_full_mode(img, person_dir, count)
-                        )
-                        if saved:
-                            # Record which asset produced which output file
-                            filename = f"{count}.jpg"
-                            asset_map[filename] = asset["id"]
-                            score_map[filename] = asset.get("quality_score")
-                            if mode == "face" and isinstance(saved, tuple):
-                                dims_map[filename] = saved
-                            # Time-spread path: compute blur score from the downloaded
-                            # image. Cap at 1440px so the scale matches the preview
-                            # thumbnails the embedding path uses for scoring — Laplacian
-                            # variance grows with resolution, making full-res and
-                            # thumbnail scores incomparable if left uncapped.
-                            if mode == "face" and score_map[filename] is None:
-                                try:
-                                    score_img = img.convert("RGB") if img.mode != "RGB" else img
-                                    if score_img.width > 1440 or score_img.height > 1440:
-                                        score_img = score_img.copy()
-                                        score_img.thumbnail((1440, 1440), Image.LANCZOS)
-                                    score_map[filename] = assess_quality(score_img).blur_score
-                                except Exception as exc:
-                                    logger.debug(f"Quality score fallback for {asset['id']}: {exc}")
-                                    score_map[filename] = 0.0  # unknown quality — treat as lowest
-                            # Also record object-mode variant filenames
-                            if mode == "object":
-                                for f in sorted(os.listdir(person_dir)):
-                                    if f.startswith(f"{count}_") and f not in asset_map:
-                                        asset_map[f] = asset["id"]
-                                        score_map[f] = asset.get("face_confidence")
-
-                            count += 1
-                        else:
+                count = 0
+                for asset in assets:
+                    try:
+                        # Enrich the asset with face bounding box data from the Immich
+                        # faces API (not included in search/metadata results).
+                        asset = enrich_asset_with_face_data(asset, person)
+                        # Skip download if detection confidence already disqualifies
+                        # the asset — avoids fetching a large image we'll discard.
+                        conf = asset.get("face_confidence")
+                        if conf is not None and conf < Config.MIN_CONFIDENCE:
                             progress.console.print(
-                                f"[yellow]Skipped {asset['id']} (no usable face data)[/yellow]"
+                                f"[yellow]Skipped {asset['id']}"
+                                f" (detection confidence {conf:.2f} < {Config.MIN_CONFIDENCE})[/yellow]"
                             )
-                except Exception as e:
-                    logger.error(f"Failed to process asset {asset['id']}: {e}")
+                            mark_rejected(asset["id"], person_name=name)
+                            progress.advance(job_task)
+                            progress.advance(overall_task)
+                            continue
 
-                progress.advance(job_task)
-                progress.advance(overall_task)
+                        # Use full-resolution for final output when configured
+                        if use_full_res:
+                            img = fetch_full_image(asset["id"])
+                            if img is None:
+                                # Full-res download failed — could be a transient network
+                                # error, so don't mark rejected; it will be retried next run.
+                                pass
+                        else:
+                            resp = requests.get(
+                                f"{Config.IMMICH_URL}/api/assets/{asset['id']}/thumbnail?size=preview&format=JPEG",
+                                headers=get_headers(),
+                                timeout=30,
+                            )
+                            if resp.ok:
+                                try:
+                                    img = Image.open(BytesIO(resp.content))
+                                except (PIL.UnidentifiedImageError, OSError):
+                                    # Pillow cannot identify the format or the content is
+                                    # truncated. The download already succeeded (resp.ok),
+                                    # so this is a data problem, not a transient network
+                                    # error — mark rejected so it isn't retried forever.
+                                    logger.warning("Invalid image data for asset %s — marking rejected", asset["id"])
+                                    mark_rejected(asset["id"], person_name=name)
+                                    img = None
+                            else:
+                                img = None
 
-            # Store maps on the job so upload_to_frigate can use them
-            job["asset_map"] = asset_map
-            job["score_map"] = score_map
-            job["dims_map"] = dims_map
+                        if img is None:
+                            progress.console.print(f"[red]Failed download {asset['id']}[/red]")
+                        else:
+                            saved = process_face_mode(
+                                img, asset, person, person_dir, count, insightface_app=insightface_app
+                            )
+                            if saved:
+                                filename = f"{count}.jpg"
+                                asset_map[filename] = asset["id"]
+                                score_map[filename] = asset.get("quality_score")
+                                if isinstance(saved, tuple):
+                                    dims_map[filename] = saved
+                                # Time-spread path: compute blur score from the downloaded
+                                # image. Capped at 1440px via blur_score_from_image() so the
+                                # scale matches the preview thumbnails the embedding path uses
+                                # — Laplacian variance grows with resolution, making full-res
+                                # and thumbnail scores incomparable if left uncapped.
+                                if score_map[filename] is None:
+                                    score_map[filename] = blur_score_from_image(img)
 
-            progress.remove_task(job_task)
+                                count += 1
+                            else:
+                                progress.console.print(
+                                    f"[yellow]Skipped {asset['id']} (no usable face data)[/yellow]"
+                                )
+                    except Exception as e:
+                        logger.error("Failed to process asset %s: %s", asset.get("id", "<unknown>"), e)
 
-            # Log how many images were actually saved vs selected
-            if count < len(assets):
-                logger.info(f"{name}: saved {count}/{len(assets)} selected images")
+                    progress.advance(job_task)
+                    progress.advance(overall_task)
+
+                # Store maps on the job so upload_to_frigate can use them
+                job["asset_map"] = asset_map
+                job["score_map"] = score_map
+                job["dims_map"] = dims_map
+
+                # Log how many images were actually saved vs selected
+                if count < len(assets):
+                    logger.info("%s: saved %s/%s selected images", name, count, len(assets))
+            finally:
+                progress.remove_task(job_task)
 
 
 def upload_to_frigate(jobs: list[dict]) -> None:
     """Upload processed face crops to Frigate via API with detailed logging.
 
-    Only runs for face-mode jobs. Object-mode crops are saved to the output
-    directory as the deliverable and must be copied to Frigate manually.
-
     After each successful upload, records the Immich asset ID in the
     upload tracker so it is skipped on future runs.
     """
-    face_jobs = [j for j in jobs if j["config"].get("mode", "face") == "face"]
-
-    if not face_jobs:
-        rprint("[dim]No face-mode jobs to upload.[/dim]")
+    if not jobs:
+        rprint("[dim]No jobs to upload.[/dim]")
         return
 
-    # Notify user about object-mode jobs that were skipped
-    object_jobs = [j for j in jobs if j["config"].get("mode") == "object"]
-    for job in object_jobs:
-        name = job["person"]["name"]
-        person_dir = os.path.join(Config.OUTPUT_DIR, name)
-        rprint(f"  [dim]📁 {name} (object): crops saved to {person_dir} — copy to Frigate manually[/dim]")
-
-    frigate_url = os.environ.get("FRIGATE_URL", "")
+    frigate_url = _get_frigate_url()
     if not frigate_url:
         rprint("[yellow]⚠️  FRIGATE_URL not set, skipping upload.[/yellow]")
         return
 
+    _frigate_version = get_frigate_version()
+    if _frigate_version is not None:
+        try:
+            parts = [int(x) for x in _frigate_version.lstrip("v").split("-")[0].split(".") if x.isdigit()]
+            if len(parts) >= 2 and (parts[0], parts[1]) < (0, 16):
+                rprint(
+                    f"  [yellow]⚠  Frigate {_frigate_version} detected — "
+                    "face training API requires v0.16+. Uploads may fail.[/yellow]"
+                )
+        except Exception:
+            pass
+
     rprint("\n[bold cyan]📤 Uploading to Frigate[/bold cyan]")
     rprint(f"  Target: [dim]{frigate_url}[/dim]")
 
@@ -290,7 +254,7 @@ def upload_to_frigate(jobs: list[dict]) -> None:
     # from the asset_map stored on each job during execute_jobs()
     filename_to_asset_id: dict[str, dict[str, str]] = {}
     total_files = 0
-    for job in face_jobs:
+    for job in jobs:
         name = job["person"]["name"]
         asset_map = job.get("asset_map", {})
         filename_to_asset_id[name] = asset_map
@@ -300,11 +264,15 @@ def upload_to_frigate(jobs: list[dict]) -> None:
         rprint("  [yellow]No images found to upload.[/yellow]")
         return
 
-    rprint(f"  People: [bold]{len(face_jobs)}[/bold], Total images: [bold]{total_files}[/bold]")
+    rprint(f"  People: [bold]{len(jobs)}[/bold], Total images: [bold]{total_files}[/bold]")
 
     uploaded, failed = 0, 0
     max_retries = 2
 
+    # Fetch all Frigate training files once — avoids one GET /api/faces per person.
+    # Falls back to per-person calls inside the loop if this fetch fails.
+    all_frigate_files = get_all_frigate_person_files()
+
     with Progress(
         SpinnerColumn(),
         TextColumn("[progress.description]{task.description}"),
@@ -314,14 +282,18 @@ def upload_to_frigate(jobs: list[dict]) -> None:
     ) as progress:
         upload_task = progress.add_task("[green]Uploading to Frigate", total=total_files)
 
-        for job in face_jobs:
+        for job in jobs:
             name = job["person"]["name"]
             # URL-encode the name for the API (handles spaces, special chars)
             encoded_name = quote(name, safe="")
             if " " in name:
                 progress.console.print(f"  ℹ️  URL-encoded name for Frigate API: '{name}' → '{encoded_name}'")
 
-            person_dir = os.path.join(Config.OUTPUT_DIR, name)
+            try:
+                person_dir = _safe_person_dir(Config.OUTPUT_DIR, name)
+            except ValueError as e:
+                logger.error(str(e))
+                continue
             if not os.path.isdir(person_dir):
                 progress.console.print(f"  [dim]⏭️  {name}: no output directory, skipping[/dim]")
                 continue
@@ -342,24 +314,59 @@ def upload_to_frigate(jobs: list[dict]) -> None:
             # Snapshot live Frigate files for post-upload reconciliation diff only.
             # effective_count is sourced from the tracker (mapped files) so that
             # manually-added Frigate files don't consume winnow's managed quota.
-            _snapshot = get_frigate_person_files(name)
+            # Replacement targets also come exclusively from the tracker, so manually
+            # added files are never selected for deletion — only winnow-uploaded ones.
+            # LIMITATION — manual files are invisible to diversity decisions: winnow
+            # can observe their effect on the Frigate score (indirectly, via recognize)
+            # but cannot measure their embedding distribution directly. If a user has
+            # 20 manually-added frontals and winnow has room for 20 more, winnow may
+            # add more frontals because it can't see that frontals are already covered.
+            # TODO(frigate-api): if Frigate exposes per-file embeddings, compute
+            # diversity against the full training set (tracked + manual) rather than
+            # relying solely on the Frigate score as a proxy signal.
+            _snapshot = (
+                all_frigate_files.get(name, []) if all_frigate_files is not None
+                else get_frigate_person_files(name)
+            )
             if _snapshot is None:
-                # Frigate GET is down; fall back to the tracker's mapped filenames
-                # as the pre-upload baseline. reconciliation will still work unless
-                # there are concurrent manual uploads (handled by >target guard).
+                # Frigate GET is down. The tracker only knows files winnow mapped
+                # previously — it is blind to manually-added Frigate files. Using
+                # the tracker as the baseline would make those unmapped files look
+                # like new uploads in reconcile, triggering the >target guard and
+                # silently dropping all mappings. Skip reconciliation entirely when
+                # we can't get a reliable live snapshot.
                 logger.warning(
-                    f"{name}: Frigate API unreachable at upload start"
-                    " — using tracker baseline for post-upload reconciliation"
+                    "%s: Frigate API unreachable at upload start"
+                    " — file mapping will be skipped for this batch", name
                 )
-                known_frigate_files_at_start: set[str] = get_tracked_frigate_filenames(name)
+                known_frigate_files_at_start: set[str] = set()
+                _skip_reconcile = True
             else:
                 known_frigate_files_at_start: set[str] = set(_snapshot)
+                _skip_reconcile = False
+                # Remove tracker mappings for files that no longer exist in Frigate
+                # (manually deleted, or cleaned up outside winnow). This corrects the
+                # effective_count so those slots are available for new uploads.
+                stale = get_tracked_frigate_filenames(name) - known_frigate_files_at_start
+                if stale:
+                    remove_frigate_files_batch(name, list(stale))
+                    progress.console.print(
+                        f"  [dim]{name}: cleared {len(stale)} stale mapping(s)"
+                        " (file(s) no longer in Frigate)[/dim]"
+                    )
             effective_count = get_tracked_frigate_file_count(name)
+            pre_run_count = effective_count
             quality_replacement = job.get("config", {}).get("quality_replacement", False)
+            if Config.ENABLE_FRIGATE_SCORES and pre_run_count == 0:
+                progress.console.print(
+                    f"  [dim]{name}: first run — Frigate diversity scoring will apply from the next run[/dim]"
+                )
             actually_uploaded: list[tuple[str, str | None]] = []
             failed_deletes: set[str] = set()
             min_quality_score_for_slot: float | None = None
+            person_has_fscores: bool = has_frigate_scores(name)
 
+            begin_batch(UPLOAD_TRACKER_FILE)
             for fname in person_files:
                 fpath = os.path.join(person_dir, fname)
 
@@ -368,48 +375,117 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                 # freed slot isn't filled with something worse than what we removed.
                 if min_quality_score_for_slot is not None:
                     file_score = score_map.get(fname)
-                    if file_score is None or file_score <= min_quality_score_for_slot:
-                        score_str = f"{file_score:.3f}" if file_score is not None else "N/A"
+                    if file_score is not None and file_score <= min_quality_score_for_slot:
                         progress.console.print(
-                            f"    [dim]⏭  {fname}: score {score_str} ≤ freed slot floor"
+                            f"    [dim]⏭  {fname}: score {file_score:.3f} ≤ freed slot floor"
                             f" {min_quality_score_for_slot:.3f}, skipping[/dim]"
                         )
                         progress.advance(upload_task)
                         continue
 
                 at_cap = effective_count >= Config.MAX_AUTO_IMAGES
+
+                # Pre-upload Frigate score — clean measurement (image not yet in training set).
+                # Called for all below-cap uploads (seeds frigate_scores for future at-cap
+                # replacement) and for at-cap uploads when scores already exist. Skipped on
+                # the first run (pre_run_count == 0) since Frigate has no model yet.
+                # recognize_face returns (face_name, score); we only use the score when the
+                # best match is for the correct person. Mismatches (or "unknown") are treated
+                # as None so a wrong-person score never drives a ceiling skip or replacement.
+                # Frigate rebuilds its model asynchronously after any delete (clear + background
+                # thread), so the first recognize call after a deletion returns None — our code
+                # handles this conservatively by skipping that candidate until the next run.
+                # LIMITATION — async rebuild during multi-replacement runs: each deletion in a
+                # single run triggers a background model rebuild in Frigate. Subsequent recognize
+                # calls in the same run may get None (rebuild in progress), causing later
+                # candidates to fall back to blur-score replacement or be skipped entirely.
+                # The more replacements that happen in one run, the worse the scoring gets.
+                # TODO(frigate-api): if Frigate exposes a model generation counter or a
+                # rebuild-complete signal, poll it between recognize calls during replacement
+                # sequences rather than accepting stale/None scores.
+                pre_fscore: float | None = None
+                if Config.ENABLE_FRIGATE_SCORES and pre_run_count > 0:
+                    if not at_cap or person_has_fscores:
+                        _result = recognize_face(fpath)
+                        if _result is not None and (_result[0] or "").casefold() == name.casefold():
+                            pre_fscore = _result[1]
+
+                # Below-cap novelty gate: skip candidates already covered by the Frigate model,
+                # including conditions learned from manually-added images winnow can't track.
+                # pre_fscore is None on the first run (pre_run_count == 0 skips recognize_face
+                # above), so this block never fires on the first run without an extra guard.
+                if not at_cap and pre_fscore is not None:
+                    _ceiling = Config.FRIGATE_SCORE_CEILING
+                    if _ceiling is None:
+                        # Dynamic default: bar = most-redundant tracked file's Frigate score.
+                        # Falls back to uploading freely when no tracked scores exist yet.
+                        _bar = get_most_redundant_mapped_file(name)
+                        _skip = _bar is not None and pre_fscore > _bar[2]
+                        _bar_str = f"most redundant tracked {_bar[2]:.2f}" if _bar else ""
+                    elif _ceiling == 0.0:
+                        _skip = False  # explicitly disabled
+                        _bar_str = ""
+                    else:
+                        _skip = pre_fscore > _ceiling
+                        _bar_str = f"ceiling {_ceiling:.2f}"
+                    if _skip:
+                        progress.console.print(
+                            f"    [dim]⏭  {fname}: Frigate score {pre_fscore:.2f}"
+                            f" > {_bar_str}, already covered[/dim]"
+                        )
+                        progress.advance(upload_task)
+                        continue
+
                 if at_cap:
                     if not quality_replacement:
                         progress.console.print(f"    [dim]⏭  {fname}: at cap, quality replacement disabled[/dim]")
                         progress.advance(upload_task)
                         continue
-                    new_score = score_map.get(fname)
-                    if new_score is None:
-                        progress.console.print(f"    [dim]⏭  {fname}: no confidence score, skipping replacement[/dim]")
+
+                    using_fscore = person_has_fscores and Config.ENABLE_FRIGATE_SCORES
+                    if using_fscore:
+                        candidate_score = pre_fscore
+                        get_target = get_most_redundant_mapped_file
+                        score_label, better_note = "frigate", " (more novel)"
+                        no_score_msg = "Frigate recognize unavailable, skipping replacement"
+                        is_better_than = lambda c, t: c < t
+                    else:
+                        candidate_score = score_map.get(fname)
+                        get_target = get_lowest_quality_mapped_file
+                        score_label, better_note = "blur", ""
+                        no_score_msg = "no quality score, skipping replacement"
+                        is_better_than = lambda c, t: c > t
+
+                    if candidate_score is None:
+                        progress.console.print(f"    [dim]⏭  {fname}: {no_score_msg}[/dim]")
                         progress.advance(upload_task)
                         continue
-                    worst = get_lowest_quality_mapped_file(name, exclude=failed_deletes)
-                    if worst is None or new_score <= worst[2]:
-                        worst_score_str = f"{worst[2]:.3f}" if worst is not None else "N/A"
+
+                    target = get_target(name, exclude=failed_deletes)
+                    not_better = target is None or not is_better_than(candidate_score, target[2])
+                    if not_better:
+                        target_str = f"{target[2]:.3f}" if target is not None else "N/A"
+                        cmp_op = "<" if using_fscore else ">"
                         progress.console.print(
-                            f"    [dim]⏭  {fname}: score {new_score:.3f} ≤ worst mapped"
-                            f" {worst_score_str}, skipping[/dim]"
+                            f"    [dim]⏭  {fname}: {score_label} {candidate_score:.3f}"
+                            f" not {cmp_op} {target_str}, skipping[/dim]"
                         )
                         progress.advance(upload_task)
                         continue
-                    # Delete the worst mapped file to make room for the better one
-                    worst_frigate_file, _worst_asset_id, worst_score = worst
+
+                    target_frigate_file, _target_asset_id, target_score = target
+                    cmp_op = "<" if using_fscore else ">"
                     progress.console.print(
-                        f"    🔄 {fname}: score {new_score:.3f} > {worst_score:.3f},"
-                        f" replacing {worst_frigate_file}"
+                        f"    🔄 {fname}: {score_label} {candidate_score:.3f} {cmp_op} {target_score:.3f},"
+                        f" replacing {target_frigate_file}{better_note}"
                     )
-                    if delete_frigate_person_files(name, [worst_frigate_file]):
-                        remove_frigate_file(name, worst_frigate_file)
+                    if delete_frigate_person_files(name, [target_frigate_file]):
+                        remove_frigate_file(name, target_frigate_file)
                         effective_count -= 1
-                        min_quality_score_for_slot = worst_score
+                        min_quality_score_for_slot = None if using_fscore else target_score
                     else:
-                        logger.warning(f"Failed to delete {worst_frigate_file} for {name}, skipping replacement")
-                        failed_deletes.add(worst_frigate_file)
+                        logger.warning("Failed to delete %s for %s, skipping replacement", target_frigate_file, name)
+                        failed_deletes.add(target_frigate_file)
                         progress.advance(upload_task)
                         continue
 
@@ -429,12 +505,24 @@ def upload_to_frigate(jobs: list[dict]) -> None:
 
                             asset_id = asset_map.get(fname)
                             if asset_id:
-                                mark_uploaded(
-                                    asset_id,
-                                    person_name=name,
-                                    score=score_map.get(fname),
-                                    crop_dims=dims_map.get(fname),
-                                )
+                                try:
+                                    mark_uploaded(
+                                        asset_id,
+                                        person_name=name,
+                                        score=score_map.get(fname),
+                                        crop_dims=dims_map.get(fname),
+                                        frigate_score=pre_fscore,
+                                    )
+                                except Exception as tracker_exc:
+                                    # Upload to Frigate succeeded — don't retry on tracker
+                                    # failure or we'd upload a duplicate to Frigate.
+                                    logger.error(
+                                        "Tracker write failed for %s — upload succeeded"
+                                        " but asset may be re-selected next run: %s",
+                                        fname, tracker_exc,
+                                    )
+                                if pre_fscore is not None:
+                                    person_has_fscores = True
                                 actually_uploaded.append((fname, asset_id))
 
                             break
@@ -450,13 +538,20 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                             progress.console.print(
                                 f"    [red]✗ {fname}: HTTP {resp.status_code} (after {max_retries} attempts)[/red]"
                             )
+                            full_body = resp.text
                             try:
-                                error_detail = resp.json().get("message", resp.text[:100])
-                                progress.console.print(f"      [dim]{error_detail}[/dim]")
+                                error_detail = resp.json().get("message", full_body[:100])
                             except Exception:
-                                error_detail = resp.text[:100]
+                                error_detail = full_body[:100]
+                            if resp.status_code == 400:
                                 progress.console.print(f"      [dim]{error_detail}[/dim]")
-                            if resp.status_code == 400 and "face" in error_detail.lower():
+                            else:
+                                logger.debug("%s HTTP %s: %s", fname, resp.status_code, error_detail)
+                            _is_permanent = (
+                                (resp.status_code == 400 and "face" in full_body.lower())
+                                or resp.status_code == 422
+                            )
+                            if _is_permanent:
                                 asset_id = asset_map.get(fname)
                                 if asset_id:
                                     mark_rejected(asset_id, person_name=name)
@@ -498,9 +593,11 @@ def upload_to_frigate(jobs: list[dict]) -> None:
                     " was not filled this run — will be available next run"
                 )
 
+            flush_batch(UPLOAD_TRACKER_FILE)
+
             # Batch-map Frigate filenames to asset IDs now that all uploads are done.
-            if actually_uploaded:
-                _reconcile_frigate_mappings(name, known_frigate_files_at_start, actually_uploaded)
+            if actually_uploaded and not _skip_reconcile:
+                reconcile_frigate_mappings(name, known_frigate_files_at_start, actually_uploaded)
 
             # Per-person summary
             if person_failed == 0:

winnow/frigate_api.py

@@ -8,9 +8,32 @@ import requests
 logger = logging.getLogger(__name__)
 
 
+def _get_frigate_url() -> str:
+    """Return normalized FRIGATE_URL with whitespace and trailing slash stripped, or '' if unset."""
+    return os.environ.get("FRIGATE_URL", "").strip().rstrip("/")
+
+
+def get_frigate_version() -> str | None:
+    """Fetch Frigate's version string from GET /api/version.
+
+    Returns the version string (e.g. "0.16.0-beta4") or None if FRIGATE_URL
+    is unset, the endpoint is unreachable, or the response is not parseable.
+    """
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return None
+    try:
+        resp = requests.get(f"{frigate_url}/api/version", timeout=5)
+        if resp.ok:
+            return resp.text.strip().strip('"')
+        return None
+    except Exception:
+        return None
+
+
 def _get_faces_data() -> dict | None:
     """Fetch raw GET /api/faces response. Returns None if unavailable."""
-    frigate_url = os.environ.get("FRIGATE_URL", "").rstrip("/")
+    frigate_url = _get_frigate_url()
     if not frigate_url:
         return None
     try:
@@ -18,26 +41,44 @@ def _get_faces_data() -> dict | None:
         resp.raise_for_status()
         return resp.json()
     except Exception as e:
-        logger.warning(f"Could not query Frigate faces API: {e}")
+        logger.warning("Could not query Frigate faces API: %s", e)
         return None
 
 
+def get_all_frigate_person_files() -> dict[str, list[str]] | None:
+    """Return {person_name: [filename, ...]} for every person in Frigate.
+
+    Single call used to build per-person snapshots before the upload loop,
+    avoiding one GET /api/faces per person.  Returns None if unavailable.
+    """
+    data = _get_faces_data()
+    if data is None:
+        return None
+    # Response: {person_name: [file, ...], "train": [...], ...}
+    # "train" is a flat pending list, not a person — skip it.
+    # TODO(frigate-api): "train" is the only known special key as of Frigate v0.16.
+    # Log unexpected non-list values so future Frigate schema additions are visible.
+    result = {}
+    for name, files in data.items():
+        if name == "train":
+            continue
+        if isinstance(files, list):
+            result[name] = files
+        else:
+            logger.debug("Frigate API: skipping unexpected key %r (got %s, not list)", name, type(files).__name__)
+    return result
+
+
 def get_frigate_face_counts() -> dict[str, int] | None:
     """Return {person_name: training_image_count} from Frigate's train directory.
 
     Returns None if FRIGATE_URL is not set or the API is unreachable, so callers
     can distinguish "API unavailable" from "person has 0 images."
     """
-    data = _get_faces_data()
-    if data is None:
+    all_files = get_all_frigate_person_files()
+    if all_files is None:
         return None
-    # Response: {person_name: [file, ...], "train": [...], ...}
-    # "train" is a flat pending list, not a person — skip it.
-    return {
-        name: len(files)
-        for name, files in data.items()
-        if name != "train" and isinstance(files, list)
-    }
+    return {name: len(files) for name, files in all_files.items()}
 
 
 def get_frigate_person_files(person_name: str) -> list[str] | None:
@@ -50,7 +91,52 @@ def get_frigate_person_files(person_name: str) -> list[str] | None:
     if data is None:
         return None
     files = data.get(person_name)
-    return files if isinstance(files, list) else []
+    if files is not None and not isinstance(files, list):
+        logger.debug("Frigate API: unexpected type for %r — got %s, not list", person_name, type(files).__name__)
+        return []
+    return files if files is not None else []
+
+
+def recognize_face(file_path: str) -> tuple[str | None, float] | None:
+    """Submit an image to Frigate's recognize endpoint.
+
+    Returns (face_name, score) where face_name is the best-matching person
+    (may be "unknown" if below Frigate's confidence threshold) and score is
+    the sigmoid-mapped cosine similarity (0-1) against that person's mean
+    embedding.
+
+    Returns None if FRIGATE_URL is unset, the API is unreachable, no face is
+    detected, or face recognition is not enabled in Frigate.
+
+    LIMITATION — mean embedding comparison: the score reflects similarity to
+    the arithmetic mean of all training embeddings, not to individual ones.
+    A bimodal training set (e.g. frontals + profiles) has a mean that sits
+    between both clusters, making candidates from either cluster look more
+    novel than they are. Winnow could add redundant frontals while the score
+    suggests novelty, because the mean is pulled toward profiles.
+    TODO(frigate-api): if Frigate exposes per-file embeddings via the API,
+    replace mean-comparison with nearest-neighbour distance across individual
+    training embeddings for accurate coverage detection.
+    """
+    frigate_url = _get_frigate_url()
+    if not frigate_url:
+        return None
+    try:
+        with open(file_path, "rb") as f:
+            resp = requests.post(
+                f"{frigate_url}/api/faces/recognize",
+                files={"file": (os.path.basename(file_path), f, "image/jpeg")},
+                timeout=15,
+            )
+        if not resp.ok:
+            return None
+        data = resp.json()
+        if data.get("success") and "score" in data:
+            return (data.get("face_name"), round(float(data["score"]), 4))
+        return None
+    except Exception as e:
+        logger.debug("Frigate recognize failed for %s: %s", file_path, e)
+        return None
 
 
 def delete_frigate_person_files(person_name: str, filenames: list[str]) -> bool:
@@ -59,27 +145,27 @@ def delete_frigate_person_files(person_name: str, filenames: list[str]) -> bool:
     Uses POST /api/faces/{name}/delete with body {"ids": [filename, ...]}.
     Returns True on success, False if unreachable or the request fails.
     """
-    frigate_url = os.environ.get("FRIGATE_URL", "").rstrip("/")
+    frigate_url = _get_frigate_url()
     if not frigate_url or not filenames:
         return False
     from urllib.parse import quote
-    encoded = quote(person_name, safe="")
+    encoded_name = quote(person_name, safe="")
     try:
         resp = requests.post(
-            f"{frigate_url}/api/faces/{encoded}/delete",
+            f"{frigate_url}/api/faces/{encoded_name}/delete",
             json={"ids": filenames},
             timeout=10,
         )
         if resp.ok:
-            logger.debug(f"Deleted {len(filenames)} Frigate file(s) for {person_name}")
+            logger.debug("Deleted %s Frigate file(s) for %s", len(filenames), person_name)
             return True
         if resp.status_code == 404:
             # File already absent — stale tracker entry. Return True so the caller
             # removes it from the tracker and frees the slot cleanly.
-            logger.warning(f"Frigate file(s) not found for {person_name} (stale tracker entry?): {filenames}")
+            logger.warning("Frigate file(s) not found for %s (stale tracker entry?): %s", person_name, filenames)
             return True
-        logger.warning(f"Frigate delete returned {resp.status_code} for {person_name}")
+        logger.warning("Frigate delete returned %s for %s", resp.status_code, person_name)
         return False
     except Exception as e:
-        logger.warning(f"Failed to delete Frigate files for {person_name}: {e}")
+        logger.warning("Failed to delete Frigate files for %s: %s", person_name, e)
         return False

winnow/image_processing.py

@@ -1,7 +1,8 @@
-"""Image processing functions for cropping faces and objects."""
+"""Image processing functions for cropping faces."""
 
 import logging
 import os
+import warnings
 
 import numpy as np
 from PIL import Image
@@ -10,25 +11,20 @@ from .config import Config
 
 logger = logging.getLogger(__name__)
 
-# Lazy singleton
-_yolo_model = None
-
 
 def _save_jpeg(img: Image.Image, path: str) -> None:
     if img.mode != "RGB":
         img = img.convert("RGB")
-    img.save(path, format="JPEG")
-
-
-def get_yolo_model():
-    """Singleton for YOLO model."""
-    global _yolo_model
-    if _yolo_model is None:
-        from ultralytics import YOLO
-
-        logger.info("Loading YOLOv9c model...")
-        _yolo_model = YOLO("yolov9c.pt")
-    return _yolo_model
+    tmp = path + ".tmp"
+    try:
+        img.save(tmp, format="JPEG")
+        os.replace(tmp, path)
+    except Exception:
+        try:
+            os.remove(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def align_face(img: Image.Image, landmarks: list[list[float]] | np.ndarray) -> Image.Image | None:
@@ -50,7 +46,7 @@ def align_face(img: Image.Image, landmarks: list[list[float]] | np.ndarray) -> I
         img_np = np.asarray(img)
         lm = np.array(landmarks, dtype=np.float32)
         if lm.shape != (5, 2):
-            logger.debug(f"Invalid landmark shape: {lm.shape}, expected (5, 2)")
+            logger.debug("Invalid landmark shape: %s, expected (5, 2)", lm.shape)
             return None
         aligned = norm_crop(img_np, lm)
         return Image.fromarray(aligned)
@@ -58,7 +54,7 @@ def align_face(img: Image.Image, landmarks: list[list[float]] | np.ndarray) -> I
         logger.debug("InsightFace not available for face alignment")
         return None
     except Exception as e:
-        logger.debug(f"Face alignment failed: {e}")
+        logger.debug("Face alignment failed: %s", e)
         return None
 
 
@@ -69,13 +65,15 @@ def process_face_mode(
     output_dir: str,
     count: int,
     min_width: int | None = None,
+    insightface_app=None,
 ) -> tuple[int, int] | None:
     """Crop face based on Immich metadata and save to output directory.
 
     Returns (width, height) of the saved crop, or None if no crop was saved.
-    If face alignment is enabled and landmarks are available, produces
-    an aligned 112x112 crop. Otherwise falls back to bounding box crop
-    with configurable margin.
+    When insightface_app is provided and ENABLE_FACE_ALIGNMENT is True,
+    re-detects the face in the Immich bbox region using InsightFace to get
+    precise landmarks for a proper 112x112 aligned crop. Falls back to
+    bounding box crop with configurable margin if alignment is unavailable.
     """
     min_width = min_width or Config.MIN_FACE_WIDTH
 
@@ -90,7 +88,7 @@ def process_face_mode(
             break
 
     if not face_info:
-        logger.debug(f"No face info for {person.get('name')} in asset {asset.get('id')}")
+        logger.debug("No face info for %s in asset %s", person.get("name"), asset.get("id"))
         return None
 
     img_w, img_h = img.size
@@ -106,21 +104,56 @@ def process_face_mode(
 
     face_w, face_h = x2 - x1, y2 - y1
     if face_w < min_width or face_h < min_width:
-        logger.debug(f"Face too small ({face_w:.1f}x{face_h:.1f})")
+        logger.debug("Face too small (%.1fx%.1f)", face_w, face_h)
         return None
 
-    # Try face alignment if enabled and landmarks available
+    # Re-detect face with InsightFace for landmark-based alignment.
+    # Immich's /api/faces endpoint does not include landmarks, so the
+    # align_face fallback below never fires without this step.
+    if insightface_app is not None and Config.ENABLE_FACE_ALIGNMENT:
+        try:
+            # Expand the Immich bbox by 50% to give InsightFace enough context
+            # for detection and alignment, then search for the face nearest the
+            # centre of that region (handles group photos at the boundary).
+            pad_x, pad_y = face_w * 0.5, face_h * 0.5
+            search_box = (
+                max(0, x1 - pad_x),
+                max(0, y1 - pad_y),
+                min(img_w, x2 + pad_x),
+                min(img_h, y2 + pad_y),
+            )
+            search_crop = img.crop(search_box)
+            with warnings.catch_warnings():
+                warnings.filterwarnings("ignore", message=".*estimate.*is deprecated", category=FutureWarning)
+                detected = insightface_app.get(np.asarray(search_crop))
+            if detected:
+                cx, cy = search_crop.width / 2, search_crop.height / 2
+                best = min(
+                    detected,
+                    key=lambda f: abs((f.bbox[0] + f.bbox[2]) / 2 - cx)
+                    + abs((f.bbox[1] + f.bbox[3]) / 2 - cy),
+                )
+                kps = getattr(best, "kps", None)
+                if kps is not None and np.asarray(kps).shape == (5, 2):
+                    aligned = align_face(search_crop, kps)
+                    if aligned is not None:
+                        _save_jpeg(aligned, os.path.join(output_dir, f"{count}.jpg"))
+                        return aligned.size
+        except Exception as e:
+            logger.debug("InsightFace re-detection failed for %s: %s", asset.get("id"), e)
+
+    # Landmark alignment from Immich metadata (Immich does not currently
+    # expose landmarks, so this path is a future-proofing fallback)
     if Config.ENABLE_FACE_ALIGNMENT:
         landmarks = face_info.get("landmarks") or face_info.get("landmark")
         if landmarks:
-            # Scale landmarks
             scaled_landmarks = [[lm[0] * scale_x, lm[1] * scale_y] for lm in landmarks]
             aligned = align_face(img, scaled_landmarks)
             if aligned is not None:
                 _save_jpeg(aligned, os.path.join(output_dir, f"{count}.jpg"))
                 return aligned.size
 
-    # Fall back to bounding box crop with configurable margin
+    # Final fallback: bounding box crop with configurable margin
     margin = Config.FACE_MARGIN
     margin_x, margin_y = face_w * margin, face_h * margin
     crop_box = (
@@ -135,49 +168,4 @@ def process_face_mode(
     return face_crop.size
 
 
-def process_object_mode(
-    img: Image.Image,
-    config: dict,
-    output_dir: str,
-    count: int,
-) -> bool:
-    """Detect and crop objects using YOLO."""
-    try:
-        model = get_yolo_model()
-        target_class = config.get("object_class", "dog")
-        import torch
-
-        if os.getenv("FORCE_CPU", "").lower() in ("true", "1", "yes"):
-            device = "cpu"
-        elif hasattr(torch, "xpu") and torch.xpu.is_available():
-            device = "xpu"
-        else:
-            device = None  # YOLO auto-selects (CUDA/ROCm/CPU)
-
-        results = model(img, verbose=False, device=device)
-
-        found = False
-        class_idx = 0  # Sequential counter per target class (Issue #10)
-        for box in (box for r in results for box in r.boxes):
-            cls_id = int(box.cls[0])
-            conf = float(box.conf[0])
-            if 0 <= cls_id < len(model.names) and model.names[cls_id] == target_class and conf > 0.5:
-                x1, y1, x2, y2 = box.xyxy[0].tolist()
-                _save_jpeg(
-                    img.crop((x1, y1, x2, y2)),
-                    os.path.join(output_dir, f"{count}_{class_idx}.jpg"),
-                )
-                class_idx += 1
-                found = True
-
-        return found
-    except Exception as e:
-        logger.error(f"YOLO processing failed: {e}")
-        return False
-
-
-def process_full_mode(img: Image.Image, output_dir: str, count: int) -> bool:
-    """Save full image."""
-    _save_jpeg(img, os.path.join(output_dir, f"{count}.jpg"))
-    return True
 

winnow/immich_api.py

@@ -5,7 +5,6 @@ from dataclasses import dataclass
 from datetime import datetime, timedelta, timezone
 from io import BytesIO
 
-import numpy as np
 import requests
 from PIL import Image, ImageOps
 
@@ -14,19 +13,38 @@ from .config import Config, get_headers
 logger = logging.getLogger(__name__)
 
 MAX_PAGES = 1000  # Safety limit for pagination
+_MAX_ASSETS_PER_PERSON = 5000  # Stop fetching after this many — diversity pool is capped at 3000 anyway
 
 
 @dataclass
 class FaceData:
     """Pre-computed face data from Immich."""
 
-    embedding: np.ndarray | None
     bbox: tuple[float, float, float, float]  # (x1, y1, x2, y2)
     confidence: float | None
     image_width: int
     image_height: int
 
 
+def get_immich_version() -> tuple[int, int, int] | None:
+    """Fetch Immich server version from GET /api/server/version.
+
+    Returns (major, minor, patch) or None if unreachable or unparseable.
+    """
+    try:
+        resp = requests.get(
+            f"{Config.IMMICH_URL}/api/server/version",
+            headers=get_headers(),
+            timeout=5,
+        )
+        if resp.ok:
+            data = resp.json()
+            return (int(data["major"]), int(data["minor"]), int(data["patch"]))
+        return None
+    except Exception:
+        return None
+
+
 def get_people() -> list[dict]:
     """Fetch all people from Immich."""
     try:
@@ -41,20 +59,52 @@ def get_people() -> list[dict]:
         resp.raise_for_status()
         return resp.json().get("people", [])
     except (requests.RequestException, ValueError) as e:
-        logger.error(f"Failed to fetch people from Immich: {e}")
+        logger.error("Failed to fetch people from Immich: %s", e)
         return []
 
 
-def fetch_all_assets(person: dict) -> list[dict]:
-    """Fetch all assets for a person with pagination."""
+def merge_people(survivor_id: str, merge_ids: list[str]) -> bool:
+    """Merge duplicate people into survivor via Immich's merge endpoint.
+
+    The survivor (identified by survivor_id) absorbs all faces and assets
+    from the people in merge_ids, which are then removed from Immich.
+    """
+    try:
+        resp = requests.put(
+            f"{Config.IMMICH_URL}/api/people/{survivor_id}/merge",
+            headers={**get_headers(), "Content-Type": "application/json"},
+            json={"ids": merge_ids},
+            timeout=30,
+        )
+        resp.raise_for_status()
+        return True
+    except requests.RequestException as e:
+        logger.error("Failed to merge people into %s: %s", survivor_id, e)
+        return False
+
+
+def fetch_all_assets(person: dict) -> tuple[list[dict], int]:
+    """Fetch all assets for a person with pagination.
+
+    Returns (assets, total_raw) where assets is the list of valid dict items
+    and total_raw is the raw item count across pages that had at least one valid
+    dict. All-garbage pages (every item non-dict) stop pagination and are not
+    counted. total_raw is a lower bound in two cases: a network error interrupts
+    pagination (a warning is logged), or an all-garbage page terminates it early
+    (a warning is logged and later pages are not fetched).
+    """
     name = person.get("name", "Unknown")
-    person_id = person["id"]
+    person_id = person.get("id")
+    if not person_id:
+        logger.error("Person dict missing 'id' field for %s — skipping asset fetch", name)
+        return [], 0
     url = f"{Config.IMMICH_URL}/api/search/metadata"
     page_size = 1000
 
-    logger.debug(f"Fetching assets for {name}...")
+    logger.debug("Fetching assets for %s...", name)
 
-    assets = []
+    assets: list[dict] = []
+    total_raw = 0  # raw item count across pages that yielded at least one valid dict
     for page in range(1, MAX_PAGES + 1):
         try:
             resp = requests.post(
@@ -65,31 +115,60 @@ def fetch_all_assets(person: dict) -> list[dict]:
             )
 
             if not resp.ok:
-                logger.error(f"Error fetching assets for {name} (page {page}): {resp.status_code}")
+                logger.error("Error fetching assets for %s (page %s): %s", name, page, resp.status_code)
                 break
 
             page_assets = resp.json().get("assets", [])
+            # Immich ≥2.x returns {"assets": {"items": [...]}};
+            # earlier versions returned {"assets": [...]} directly.
             if isinstance(page_assets, dict):
                 page_assets = page_assets.get("items", [])
 
-            if not page_assets:
+            page_count = len(page_assets)  # raw count for termination check before filtering
+
+            # Single pass: partition valid assets from unexpected non-dict items
+            valid_assets, skipped_count = [], 0
+            for item in page_assets:
+                if isinstance(item, dict):
+                    valid_assets.append(item)
+                else:
+                    skipped_count += 1
+            if skipped_count:
+                logger.warning("%s: skipping %s non-dict item(s) in page %s", name, skipped_count, page)
+
+            if not valid_assets:
+                if page_count > 0:
+                    logger.warning(
+                        "%s: page %s returned %s item(s) but none were valid dicts — stopping pagination",
+                        name, page, page_count,
+                    )
                 break
 
-            assets.extend(page_assets)
-            logger.debug(f"Fetched page {page}, total: {len(assets)}")
+            # Count page_count (not just valid items) so that non-dict items from a
+            # transient schema issue on a mixed page don't cause MIN_FACE_COUNT to
+            # skip a real person. Pages where every item is a non-dict are excluded —
+            # they indicate a structural problem and break above without contributing.
+            total_raw += page_count
+            assets.extend(valid_assets)
+            logger.debug("Fetched page %s, total: %s", page, len(assets))
 
-            if len(page_assets) < page_size:
+            if page_count < page_size or len(assets) >= _MAX_ASSETS_PER_PERSON:
                 break
 
         except (requests.RequestException, ValueError) as e:
-            logger.error(f"Exception fetching assets for {name}: {e}")
+            logger.error("Exception fetching assets for %s (page %s): %s", name, page, e)
+            if page > 1:
+                logger.warning(
+                    "%s: pagination interrupted at page %s — total_raw=%s may undercount actual assets",
+                    name, page, total_raw,
+                )
             break
 
-    return assets
+    return assets, total_raw
 
 
 def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | None:
-    """Fetch pre-computed face data (embedding, bbox, confidence) from Immich.
+    """Fetch pre-computed face data (bbox, confidence) from Immich.
 
     Queries GET /api/faces?id={asset_id} to retrieve face detection results
     that Immich already computed using InsightFace Buffalo_L.
@@ -99,7 +178,7 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
         person_id: Optional person ID to match the specific face
 
     Returns:
-        FaceData with embedding, bbox, and confidence, or None if unavailable
+        FaceData with bbox and confidence, or None if unavailable
     """
     try:
         resp = requests.get(
@@ -110,29 +189,25 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
         )
 
         if not resp.ok:
-            logger.debug(f"Face data endpoint returned {resp.status_code} for {asset_id}")
+            logger.debug("Face data endpoint returned %s for %s", resp.status_code, asset_id)
             return None
 
         faces = resp.json()
-        if not faces:
+        if not isinstance(faces, list) or not faces:
             return None
 
-        # Match the target person if specified
+        # Match the target person if specified; never fall back to a different person's face.
         face = None
         if person_id:
             face = next(
-                (f for f in faces if (f.get("person") or {}).get("id") == person_id),
+                (f for f in faces if isinstance(f, dict) and (f.get("person") or {}).get("id") == person_id),
                 None,
             )
+        else:
+            face = faces[0] if isinstance(faces[0], dict) else None
         if face is None:
-            face = faces[0]  # Fall back to first/largest face
+            return None
 
-        # Extract embedding if available
-        embedding = None
-        if "embedding" in face:
-            embedding = np.array(face["embedding"], dtype=np.float32)
-
-        # Extract bounding box
         bbox = (
             face.get("boundingBoxX1", 0),
             face.get("boundingBoxY1", 0),
@@ -142,7 +217,6 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
 
         score = face.get("score")
         return FaceData(
-            embedding=embedding,
             bbox=bbox,
             confidence=score if score is not None else face.get("confidence"),
             image_width=face.get("imageWidth", 0),
@@ -150,10 +224,10 @@ def fetch_face_data(asset_id: str, person_id: str | None = None) -> FaceData | N
         )
 
     except requests.RequestException as e:
-        logger.debug(f"Failed to fetch face data for {asset_id}: {e}")
+        logger.debug("Failed to fetch face data for %s: %s", asset_id, e)
         return None
     except (AttributeError, KeyError, TypeError, ValueError) as e:
-        logger.debug(f"Failed to parse face data for {asset_id}: {e}")
+        logger.debug("Failed to parse face data for %s: %s", asset_id, e)
         return None
 
 
@@ -174,9 +248,9 @@ def fetch_full_image(asset_id: str, timeout: int = 60) -> Image.Image | None:
             try:
                 return ImageOps.exif_transpose(Image.open(BytesIO(resp.content)))
             except Exception:
-                logger.debug(f"PIL can't open original for {asset_id}, falling back to preview")
+                logger.debug("PIL can't open original for %s, falling back to preview", asset_id)
     except requests.RequestException:
-        logger.debug(f"Original request failed for {asset_id}, falling back to preview")
+        logger.debug("Original request failed for %s, falling back to preview", asset_id)
 
     # Fall back to preview thumbnail (always JPEG)
     try:
@@ -188,22 +262,25 @@ def fetch_full_image(asset_id: str, timeout: int = 60) -> Image.Image | None:
         if resp.ok:
             return ImageOps.exif_transpose(Image.open(BytesIO(resp.content)))
     except Exception as e:
-        logger.error(f"Failed to fetch image {asset_id}: {e}")
+        logger.error("Failed to fetch image %s: %s", asset_id, e)
 
     return None
 
 
 def filter_recent_assets(assets: list[dict], years: int | None = None) -> list[dict]:
-    """Filter assets to keep only those from the last N years."""
-    years = years or Config.YEARS_FILTER
+    """Filter assets to keep only those from the last N years. Pass years=0 to include all."""
+    if years is None:
+        years = Config.YEARS_FILTER
+    if not years:
+        return list(assets)
     cutoff = datetime.now(timezone.utc) - timedelta(days=365 * years)
 
-    logger.debug(f"Filtering assets older than {years} years ({cutoff})")
+    logger.debug("Filtering assets older than %s years (%s)", years, cutoff)
 
     recent, skipped = [], 0
     for asset in assets:
         created_at_str = asset.get("fileCreatedAt")
-        if not created_at_str:
+        if not isinstance(created_at_str, str) or not created_at_str:
             continue
 
         try:
@@ -216,6 +293,6 @@ def filter_recent_assets(assets: list[dict], years: int | None = None) -> list[d
         except ValueError:
             continue
 
-    logger.debug(f"Retained {len(recent)} assets (filtered {skipped} old assets).")
+    logger.debug("Retained %s assets (filtered %s old assets).", len(recent), skipped)
     return recent
 

winnow/jobs.py

@@ -8,7 +8,7 @@ from rich.progress import BarColumn, Progress, SpinnerColumn, TaskProgressColumn
 from rich.prompt import Confirm, IntPrompt, Prompt
 from rich.table import Table
 
-from .config import Config
+from .config import Config, _getenv_bool, _getenv_int, _getenv_optional_int
 from .diversity import select_diverse_assets
 from .embeddings import is_embedding_available, load_embedding_model
 from .frigate_api import get_frigate_face_counts
@@ -20,18 +20,16 @@ logger = logging.getLogger(__name__)
 
 # Strategy presets: (limit, mode_name)
 STRATEGY_PRESETS = {
-    "1": ("auto", "Auto Diversity"),
+    "1": ("auto", "Adaptive Diversity"),
     "2": (30, "Standard (30)"),
     "3": (100, "Broad (100)"),
 }
 
 
-def _get_strategy_choice(has_embedding: bool, entity_type: str) -> tuple[int | str, str]:
+def _get_strategy_choice(has_embedding: bool) -> tuple[int | str, str]:
     """Prompt user for training strategy and return (limit, selection_mode)."""
-    model_name = "InsightFace" if entity_type == "face" else "SigLIP"
-
     if has_embedding:
-        rprint("  [bold]1.[/bold] Auto (Objective Diversity) [green][Recommended][/green]")
+        rprint("  [bold]1.[/bold] Adaptive Diversity [green][Recommended][/green]")
         rprint("     [dim]• Dynamically selects images until redundancy starts[/dim]")
         rprint("  [bold]2.[/bold] Standard (30 images)")
         rprint("  [bold]3.[/bold] Broad (100 images)")
@@ -51,7 +49,7 @@ def _get_strategy_choice(has_embedding: bool, entity_type: str) -> tuple[int | s
         return 30, "smart"
 
     # Fallback when embedding model not available
-    rprint(f"  [yellow]Note: {model_name} not available. Using Time Spread.[/yellow]")
+    rprint("  [yellow]Note: InsightFace not available. Using Time Spread.[/yellow]")
     rprint("  [bold]1.[/bold] Standard (30 images) [green][Recommended][/green]")
     rprint("  [bold]2.[/bold] Broad (100 images)")
     rprint("  [bold]3.[/bold] Custom Count")
@@ -67,17 +65,16 @@ def _get_strategy_choice(has_embedding: bool, entity_type: str) -> tuple[int | s
 
 def _resolve_strategy(strategy: str, has_embedding: bool) -> tuple[int | str, str]:
     """Resolve env var strategy to (limit, selection_mode) without prompts."""
-    custom_limit = os.environ.get("LIMIT", "").strip()
-
     if not has_embedding:
-        limit = int(custom_limit) if custom_limit else 30
-        return limit, "time"
+        return _getenv_int("LIMIT", 30), "time"
 
-    if custom_limit:
-        return int(custom_limit), "smart"
+    custom_limit = _getenv_optional_int("LIMIT")
+    if custom_limit is not None:
+        return custom_limit, "smart"
 
     strategy_map = {
-        "auto": ("auto", "smart"),
+        "adaptive": ("auto", "smart"),
+        "auto": ("auto", "smart"),  # legacy alias for adaptive
         "standard": (30, "smart"),
         "broad": (100, "smart"),
     }
@@ -85,15 +82,13 @@ def _resolve_strategy(strategy: str, has_embedding: bool) -> tuple[int | str, st
 
 
 def _perform_selection(
-    assets: list, limit: int | str, name: str, selection_mode: str, entity_type: str, person_id: str | None = None
+    assets: list, limit: int | str, name: str, selection_mode: str, person_id: str | None = None
 ) -> list:
     """Run diversity selection with progress display."""
     if selection_mode == "smart":
-        model_display = "InsightFace (face embeddings)" if entity_type == "face" else "SigLIP (visual embeddings)"
-        rprint(f"\n[cyan]Using {model_display} for diversity analysis...[/cyan]")
+        rprint("\n[cyan]Using InsightFace (face embeddings) for diversity analysis...[/cyan]")
 
-        # Pre-load model explicitly (separate from availability check)
-        load_embedding_model(entity_type)
+        load_embedding_model()
 
         with Progress(
             SpinnerColumn(),
@@ -108,7 +103,6 @@ def _perform_selection(
                 limit,
                 name,
                 selection_mode=selection_mode,
-                entity_type=entity_type,
                 person_id=person_id,
                 progress_callback=lambda c, t: progress.update(task, completed=c, total=t),
             )
@@ -119,45 +113,51 @@ def _perform_selection(
 
     rprint(f"\n[cyan]Using time-spread selection for {limit} images...[/cyan]")
     with console.status(f"[bold]Selecting {limit} images evenly distributed over time...[/bold]"):
-        selected = select_diverse_assets(
-            assets, limit, name, selection_mode="time", entity_type=entity_type, person_id=person_id
-        )
+        selected = select_diverse_assets(assets, limit, name, selection_mode="time", person_id=person_id)
     rprint(f"  [green]Selected {len(selected)} images using time spread.[/green]")
     return selected
 
 
+def _build_job(
+    person: dict,
+    assets: list,
+    limit: int | str,
+    selection_mode: str,
+    quality_replacement: bool = False,
+) -> dict | None:
+    """Select from pre-filtered assets and build a job dict. No terminal I/O."""
+    if not assets:
+        return None
+    name = person["name"]
+    selected = _perform_selection(assets, limit, name, selection_mode, person_id=person["id"])
+    if not selected:
+        return None
+    return {
+        "person": person,
+        "assets": selected,
+        "limit": len(selected),
+        "config": {"name": name, "quality_replacement": quality_replacement},
+    }
+
+
 def _configure_person(person: dict, people: list[dict]) -> dict | None:
     """Configure training for a single person. Returns job dict or None."""
     name = person["name"]
     console.print(f"\nSelected: [bold green]{name}[/bold green]")
 
-    # Select training mode
-    rprint("\n[bold cyan]Training Mode:[/bold cyan]")
-    rprint("  [bold]1.[/bold] Face (Frigate Face Recognition)")
-    rprint("  [bold]2.[/bold] Object (Frigate Object Classification)")
-
-    mode_choice = Prompt.ask("Choice", choices=["1", "2"], default="1")
-    entity_type = "face" if mode_choice == "1" else "object"
-
-    config = {"name": name, "mode": entity_type, "quality_replacement": Config.QUALITY_REPLACEMENT}
-    if entity_type == "object":
-        config["object_class"] = Prompt.ask("Enter Object Class (e.g. dog, cat, car)", default="dog")
-
-    # Fetch and filter assets
     years = IntPrompt.ask("Filter images older than (years)", default=Config.YEARS_FILTER)
 
-    console.print(f"Scanning for {name} ({entity_type})...")
+    console.print(f"Scanning for {name}...")
     with console.status("[bold green]Fetching assets...[/bold green]"):
-        all_assets = fetch_all_assets(person)
+        all_assets, total_raw = fetch_all_assets(person)
         recent_assets = filter_recent_assets(all_assets, years=years)
 
-    rprint(f"  Found [bold]{len(all_assets)}[/bold] total, [bold]{len(recent_assets)}[/bold] in range ({years} years).")
+    rprint(f"  Found [bold]{total_raw}[/bold] total, [bold]{len(recent_assets)}[/bold] in range ({years} years).")
 
-    # Filter out assets already uploaded to Frigate.
-    # In interactive mode, ask — use the env var only as the default so it can
-    # still be pre-set (e.g. RETRY_REJECTED=true) without forcing the answer.
-    retry_env = os.environ.get("RETRY_REJECTED", "false").lower() in ("true", "1", "yes")
+    # Ask before strategy so the post-dedup count can inform the choice
+    retry_env = _getenv_bool("RETRY_REJECTED", False)
     retry_rejected = Confirm.ask("Include previously rejected images?", default=retry_env)
+
     before_dedup = len(recent_assets)
     new_asset_ids = set(filter_already_uploaded([a["id"] for a in recent_assets], retry_rejected=retry_rejected))
     recent_assets = [a for a in recent_assets if a["id"] in new_asset_ids]
@@ -169,21 +169,19 @@ def _configure_person(person: dict, people: list[dict]) -> dict | None:
         rprint("  [dim]Skipping (0 new images after dedup).[/dim]")
         return None
 
-    # Strategy selection
-    has_embedding = is_embedding_available(entity_type)
+    has_embedding = is_embedding_available()
     rprint(f"\n[bold cyan]Select Training Strategy for {name}:[/bold cyan]")
-
-    limit, selection_mode = _get_strategy_choice(has_embedding, entity_type)
+    limit, selection_mode = _get_strategy_choice(has_embedding)
     if selection_mode == "skip":
         return None
 
-    # Perform selection
-    selected_assets = _perform_selection(
-        recent_assets, limit, name, selection_mode, entity_type, person_id=person["id"]
-    )
+    job = _build_job(person, recent_assets, limit, selection_mode, quality_replacement=Config.QUALITY_REPLACEMENT)
+    if job is None:
+        rprint("  [dim]Skipping (0 images selected).[/dim]")
+        return None
 
-    rprint(f"  [green]Queued {len(selected_assets)} images for {name}.[/green]")
-    return {"person": person, "assets": selected_assets, "limit": len(selected_assets), "config": config}
+    rprint(f"  [green]Queued {job['limit']} images for {name}.[/green]")
+    return job
 
 
 def interactive_configure(people: list[dict]) -> list[dict]:
@@ -230,25 +228,16 @@ def auto_configure(people: list[dict]) -> list[dict]:
         rprint("[red]No people found with names in Immich.[/red]")
         return []
 
-    mode = os.environ.get("TRAINING_MODE", "face")
     strategy = os.environ.get("STRATEGY", "auto")
-    skip = os.environ.get("SKIP_PEOPLE", "").split(",") if os.environ.get("SKIP_PEOPLE") else []
-    only = os.environ.get("ONLY_PEOPLE", "").split(",") if os.environ.get("ONLY_PEOPLE") else []
+    skip = [s.strip() for s in os.environ.get("SKIP_PEOPLE", "").split(",") if s.strip()]
+    only = [s.strip() for s in os.environ.get("ONLY_PEOPLE", "").split(",") if s.strip()]
 
     if only:
         valid_people = [p for p in valid_people if p["name"] in only]
     if skip:
         valid_people = [p for p in valid_people if p["name"] not in skip]
 
-    # Filter by minimum face count (Issue #6: previously unimplemented)
     min_face_count = Config.MIN_FACE_COUNT
-    if min_face_count > 0:
-        valid_people = [p for p in valid_people if p.get("assetCount", 0) >= min_face_count]
-        if valid_people:
-            rprint(
-                f"  Filtered to {len(valid_people)} people with"
-                f" ≥{min_face_count} assets (MIN_FACE_COUNT={min_face_count})"
-            )
 
     frigate_counts = get_frigate_face_counts()
     # Persist each count to tracker so the last known value survives Frigate downtime
@@ -259,28 +248,19 @@ def auto_configure(people: list[dict]) -> list[dict]:
     jobs = []
     for person in valid_people:
         name = person["name"]
-        entity_type = mode
 
-        config = {"name": name, "mode": entity_type}
-        if entity_type == "object":
-            config["object_class"] = os.environ.get("OBJECT_CLASS", "dog")
-
-        all_assets = fetch_all_assets(person)
+        all_assets, total_raw = fetch_all_assets(person)
         recent_assets = filter_recent_assets(all_assets, years=Config.YEARS_FILTER)
 
-        rprint(f"  {name}: {len(all_assets)} total, {len(recent_assets)} recent")
+        rprint(f"  {name}: {total_raw} total, {len(recent_assets)} recent")
 
-        # Filter out assets already uploaded to Frigate
-        retry_rejected = os.environ.get("RETRY_REJECTED", "false").lower() in ("true", "1", "yes")
-        before_dedup = len(recent_assets)
-        new_asset_ids = set(filter_already_uploaded([a["id"] for a in recent_assets], retry_rejected=retry_rejected))
-        recent_assets = [a for a in recent_assets if a["id"] in new_asset_ids]
-        skipped = before_dedup - len(recent_assets)
-        if skipped:
-            rprint(f"  [dim]Skipped {skipped} assets already uploaded to Frigate.[/dim]")
-
-        if not recent_assets:
-            rprint(f"  [dim]Skipping {name} (0 new images after dedup).[/dim]")
+        # MIN_FACE_COUNT guard: skip people with too few Immich assets.
+        # Uses total_raw so that non-dict items from a transient Immich schema
+        # issue on a mixed page don't shrink the count below the threshold.
+        # Done here (after fetch) rather than upfront because Immich v2.7.5+
+        # dropped assetCount from the /api/people response.
+        if min_face_count > 0 and total_raw < min_face_count:
+            rprint(f"  [dim]Skipping {name} ({total_raw} assets < MIN_FACE_COUNT={min_face_count}).[/dim]")
             continue
 
         # Enforce MAX_AUTO_IMAGES against the tracked file count only.
@@ -304,33 +284,45 @@ def auto_configure(people: list[dict]) -> list[dict]:
         else:
             quality_replacement_only = False
 
-        config["quality_replacement"] = quality_replacement_only or Config.QUALITY_REPLACEMENT
+        quality_replacement = quality_replacement_only or Config.QUALITY_REPLACEMENT
 
-        has_embedding = is_embedding_available(entity_type)
+        has_embedding = is_embedding_available()
         limit, selection_mode = _resolve_strategy(strategy, has_embedding)
 
         # Cap selection to remaining capacity (no cap when replacement-only — executor
         # decides per-image whether to swap; any candidate could be an improvement).
-        auto_cap = None
         if not quality_replacement_only:
             if limit == "auto":
+                # Switch from open-ended auto to a fixed budget at remaining capacity
+                # so the diversity selector itself stops at the right count instead of
+                # selecting MAX_AUTO_IMAGES and then discarding the excess by position.
                 if already_uploaded > 0:
-                    auto_cap = capacity
+                    limit = capacity
             else:
                 limit = min(limit, capacity)
 
         if selection_mode == "skip":
             continue
 
-        selected_assets = _perform_selection(
-            recent_assets, limit, name, selection_mode, entity_type, person_id=person["id"]
-        )
-        if auto_cap is not None:
-            selected_assets = selected_assets[:auto_cap]
+        retry_rejected = _getenv_bool("RETRY_REJECTED", False)
+        before_dedup = len(recent_assets)
+        new_asset_ids = set(filter_already_uploaded([a["id"] for a in recent_assets], retry_rejected=retry_rejected))
+        recent_assets = [a for a in recent_assets if a["id"] in new_asset_ids]
+        skipped = before_dedup - len(recent_assets)
+        if skipped:
+            rprint(f"  [dim]Skipped {skipped} assets already uploaded to Frigate.[/dim]")
 
-        if selected_assets:
-            rprint(f"  [green]Queued {len(selected_assets)} images for {name}.[/green]")
-            jobs.append({"person": person, "assets": selected_assets, "limit": len(selected_assets), "config": config})
+        if not recent_assets:
+            rprint(f"  [dim]Skipping {name} (0 new images after dedup).[/dim]")
+            continue
+
+        job = _build_job(person, recent_assets, limit, selection_mode, quality_replacement=quality_replacement)
+        if job is None:
+            rprint(f"  [dim]Skipping {name} (0 images selected).[/dim]")
+            continue
+
+        rprint(f"  [green]Queued {job['limit']} images for {name}.[/green]")
+        jobs.append(job)
 
     return jobs
 
@@ -339,20 +331,17 @@ def _show_preview(jobs: list[dict]) -> None:
     """Show a summary table of all queued jobs before execution."""
     table = Table(title="📋 Training Job Preview", show_header=True, header_style="bold cyan")
     table.add_column("Person", style="bold")
-    table.add_column("Mode", style="dim")
     table.add_column("Images", justify="right")
     table.add_column("Date Range", style="dim")
 
     for job in jobs:
         name = job["person"]["name"]
-        mode = job["config"].get("mode", "face")
         count = str(job["limit"])
 
-        # Date range
         dates = sorted(a.get("fileCreatedAt", "")[:10] for a in job["assets"] if a.get("fileCreatedAt"))
         date_range = f"{dates[0]} → {dates[-1]}" if len(dates) >= 2 else (dates[0] if dates else "—")
 
-        table.add_row(name, mode, count, date_range)
+        table.add_row(name, count, date_range)
 
     console.print()
     console.print(table)

winnow/log_config.py

@@ -13,12 +13,9 @@ console = Console()
 NOISY_LOGGERS = (
     "urllib3",
     "PIL",
-    "ultralytics",
     "insightface",
     "onnxruntime",
     "matplotlib",
-    "transformers",
-    "torch",
 )
 
 
@@ -51,7 +48,6 @@ def setup_logging(verbose: bool = False) -> logging.Logger:
 
     # Suppress Python warnings from ML libraries
     warnings.filterwarnings("ignore", category=UserWarning, module="onnxruntime")
-    warnings.filterwarnings("ignore", category=FutureWarning, module="transformers")
 
     return root
 

winnow/quality.py

@@ -138,3 +138,25 @@ def assess_quality(
 
     return QualityResult(passed=len(reasons) == 0, reasons=reasons, blur_score=blur_score)
 
+
+def blur_score_from_image(img: Image.Image, max_dim: int = 1440) -> float | None:
+    """Compute Laplacian-variance blur score, capped at max_dim px to normalise scale.
+
+    Caps resolution so full-res and thumbnail scores are comparable — Laplacian
+    variance grows with pixel count, making uncapped full-res scores much larger
+    than thumbnail scores for the same perceived sharpness.
+
+    Returns None on error so callers can distinguish a failed measurement from a
+    legitimately low (near-zero) score.
+    """
+    try:
+        score_img = img.convert("RGB") if img.mode != "RGB" else img
+        if score_img.width > max_dim or score_img.height > max_dim:
+            score_img = score_img.copy()
+            score_img.thumbnail((max_dim, max_dim), Image.LANCZOS)
+        gray = cv2.cvtColor(np.array(score_img), cv2.COLOR_RGB2GRAY)
+        return float(cv2.Laplacian(gray, cv2.CV_64F).var())
+    except Exception as exc:
+        logger.debug("blur_score_from_image failed: %s", exc)
+        return None
+

winnow/reconcile.py

@@ -0,0 +1,137 @@
+"""Frigate upload post-processing: reconciliation and asset enrichment."""
+
+import logging
+import time
+
+from .frigate_api import get_frigate_person_files
+from .immich_api import fetch_face_data
+from .upload_tracker import record_frigate_files_batch
+
+logger = logging.getLogger(__name__)
+
+# Exponential back-off delays (seconds) when polling Frigate after uploads.
+# Frigate processes the upload queue asynchronously, so files aren't
+# immediately visible in GET /api/faces — we wait progressively longer
+# rather than hammering the API.
+_RECONCILE_POLL_DELAYS = (1, 2, 4, 8)
+
+
+def reconcile_frigate_mappings(
+    person_name: str,
+    known_files_before: set[str],
+    uploaded: list[tuple[str, str | None]],
+) -> None:
+    """Map Frigate filenames to asset IDs after a batch of uploads.
+
+    Polls until all expected new files appear in the Frigate API, then maps
+    them to asset IDs by filename timestamp order (Frigate processes the
+    upload queue in FIFO order, so earlier uploads get earlier timestamps).
+
+    KNOWN LIMITATION — race condition with external uploads:
+    If another client uploads a face file for this person concurrently, the
+    count of new files will exceed `len(uploaded)` and we bail out entirely
+    (the "> target" branch). That's safe — we never record a wrong mapping —
+    but those uploads become permanently unmapped (they won't be eligible for
+    quality replacement). The right fix is a Frigate API that returns the
+    filename in the upload response, removing the need for any post-upload
+    diffing. Until then, the external-upload guard keeps mappings correct at
+    the cost of occasionally missing them when another client is active.
+    """
+    target = len(uploaded)
+    new_files: set[str] = set()
+
+    # Check before the first sleep so a fast Frigate response returns immediately.
+    for delay in (None, *_RECONCILE_POLL_DELAYS):
+        if delay is not None:
+            time.sleep(delay)
+        fresh = get_frigate_person_files(person_name)
+        if fresh is None:
+            logger.warning(
+                "%s: Frigate API unreachable during mapping reconciliation"
+                " — quality replacement won't target these files",
+                person_name,
+            )
+            return
+        new_files = set(fresh) - known_files_before
+        if len(new_files) >= target:
+            break
+
+    if len(new_files) == target:
+        def _ts(fname: str) -> float:
+            try:
+                return float(fname.rsplit("_", 1)[-1].rsplit(".", 1)[0])
+            except (ValueError, IndexError):
+                return 0.0
+
+        logger.debug(
+            "%s: mapping %s file(s) by filename timestamp — assumes Frigate processes"
+            " uploads in FIFO order; mapping may be wrong if that ever changes",
+            person_name,
+            target,
+        )
+        mappings = {
+            frigate_file: asset_id
+            for (_, asset_id), frigate_file in zip(uploaded, sorted(new_files, key=lambda f: (_ts(f), f)))
+            if asset_id
+        }
+        record_frigate_files_batch(person_name, mappings)
+    elif len(new_files) > target:
+        logger.warning(
+            "%s: %s new Frigate files for %s uploads"
+            " (external upload detected) — skipping file mapping;"
+            " these files are permanently unmapped",
+            person_name,
+            len(new_files),
+            target,
+        )
+    else:
+        logger.warning(
+            "%s: only %s of %s expected Frigate files"
+            " appeared after reconciliation — mapping skipped;"
+            " these files are permanently unmapped",
+            person_name,
+            len(new_files),
+            target,
+        )
+
+
+def enrich_asset_with_face_data(asset: dict, person: dict) -> dict:
+    """Enrich an asset dict with face bounding box data from the Immich faces API.
+
+    The search/metadata endpoint does not include face bounding box data,
+    so we fetch it from GET /api/faces?id={asset_id} and inject it into
+    the asset's "people" field so process_face_mode can find it.
+
+    Returns the enriched asset dict (modifies in place and returns it).
+    """
+    person_id = person["id"]
+    face_data = fetch_face_data(asset["id"], person_id=person_id)
+
+    if face_data is None:
+        logger.debug("No face data returned for %s in asset %s", person.get("name"), asset.get("id"))
+        # Clean any None entries from the people list (can come from Immich API)
+        if "people" in asset:
+            asset["people"] = [p for p in asset["people"] if p is not None]
+        return asset
+
+    # Skip zero-area bounding boxes (face detection failed or no face found)
+    if face_data.bbox == (0, 0, 0, 0):
+        logger.debug("Zero-area bounding box for %s in asset %s", person.get("name"), asset.get("id"))
+        # Clean any None entries from the people list (can come from Immich API)
+        if "people" in asset:
+            asset["people"] = [p for p in asset["people"] if p is not None]
+        return asset
+
+    face_info = {
+        "boundingBoxX1": face_data.bbox[0],
+        "boundingBoxY1": face_data.bbox[1],
+        "boundingBoxX2": face_data.bbox[2],
+        "boundingBoxY2": face_data.bbox[3],
+        "imageWidth": face_data.image_width,
+        "imageHeight": face_data.image_height,
+    }
+
+    # Inject into asset so process_face_mode can find it via asset["people"]
+    asset["people"] = [{"id": person_id, "faces": [face_info]}]
+    asset["face_confidence"] = face_data.confidence
+    return asset

winnow/upload_tracker.py

@@ -1,6 +1,6 @@
 """Persistent tracker for Immich asset IDs already uploaded/rejected by Frigate.
 
-Two separate JSON files in CACHE_DIR:
+Two separate JSON files in DATA_DIR:
   frigate_uploaded_ids.json  — successfully uploaded assets
   frigate_rejected_ids.json  — assets Frigate rejected (e.g. no face detected)
 
@@ -11,60 +11,105 @@ Both are excluded from future candidate pools. To reset:
 
 by_person schema (frigate_uploaded_ids.json):
   {
-    "asset_ids":     ["immich-id-1", ...],                    # all assets we attempted to upload
-    "scores":        {"immich-id-1": 450.3},                   # Laplacian blur variance at upload time
-    "frigate_files": {"PersonName-123.webp": "immich-id-1"},  # Frigate filename → asset ID
-    "crop_dims":     {"immich-id-1": [640, 480]},             # crop pixel dimensions at upload time
-    "frigate_count": 42                                       # last known Frigate training image count
+    "asset_ids":      ["immich-id-1", ...],                    # all assets we attempted to upload
+    "scores":         {"immich-id-1": 450.3},                  # Laplacian blur variance at upload time
+    "frigate_scores": {"immich-id-1": 0.87},                   # Frigate recognition confidence (0-1) pre-upload
+    "frigate_files":  {"PersonName-123.webp": "immich-id-1"},  # Frigate filename → asset ID
+    "crop_dims":      {"immich-id-1": [640, 480]},             # crop pixel dimensions at upload time
+    "frigate_count":  42                                       # last known Frigate training image count
   }
 
+frigate_scores stores pre-upload recognize scores (0-1 sigmoid-mapped cosine
+similarity). High score = the existing training set already covers this face
+condition well. Low score = a gap — novel/diverse for the training set.
+
 frigate_files only contains files winnow uploaded — files added manually through
 Frigate's UI are never mapped here and are never touched by quality replacement.
 """
 
 import json
 import logging
+import os
 from pathlib import Path
 
+from .frigate_api import delete_frigate_person_files
+
 logger = logging.getLogger(__name__)
 
 UPLOAD_TRACKER_FILE = "frigate_uploaded_ids.json"
 REJECT_TRACKER_FILE = "frigate_rejected_ids.json"
 
+# Write-through in-memory cache keyed by the resolved file path.
+# Reduces per-call JSON reads from O(calls) to O(1) after the first load.
+# Keyed by full path so tests with isolated tmp dirs never share entries.
+_cache: dict[str, dict] = {}
+_deferred: set[str] = set()  # paths whose disk writes are batched until flush_batch()
+
 
 def _tracker_path(filename: str) -> Path:
     try:
         from .config import Config
-        return Path(Config.CACHE_DIR) / filename
+        return Path(Config.DATA_DIR) / filename
     except (ImportError, AttributeError):
         return Path(filename)
 
 
 def _load(filename: str) -> dict:
     path = _tracker_path(filename)
-    if not path.exists():
-        return {}
+    key = str(path)
+    if key in _cache:
+        return _cache[key]
+    data: dict = {}
+    if path.exists():
+        try:
+            with open(path) as f:
+                data = json.load(f)
+        except (json.JSONDecodeError, OSError) as e:
+            logger.warning(f"Could not load tracker {filename}: {e}")
+    _cache[key] = data
+    return data
+
+
+def _write_to_disk(path: Path, data: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_suffix(".tmp")
     try:
-        with open(path) as f:
-            return json.load(f)
-    except (json.JSONDecodeError, OSError) as e:
-        logger.warning(f"Could not load tracker {filename}: {e}")
-        return {}
+        with open(tmp, "w") as f:
+            json.dump(data, f, indent=2)
+        os.replace(tmp, path)
+    except Exception:
+        tmp.unlink(missing_ok=True)
+        raise
 
 
 def _save(filename: str, data: dict) -> None:
     path = _tracker_path(filename)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with open(path, "w") as f:
-        json.dump(data, f, indent=2)
+    key = str(path)
+    if key in _deferred:
+        _cache[key] = data  # accumulate in cache; disk write deferred until flush_batch()
+        return
+    _write_to_disk(path, data)
+    _cache[key] = data  # update cache only after successful write
+
+
+def begin_batch(filename: str) -> None:
+    """Defer tracker disk writes for filename. All _save calls accumulate in the
+    in-memory cache until flush_batch() is called. Use around per-person upload loops
+    to reduce N writes to 1."""
+    _deferred.add(str(_tracker_path(filename)))
+
+
+def flush_batch(filename: str) -> None:
+    """Write the accumulated cache state for filename to disk."""
+    path = _tracker_path(filename)
+    key = str(path)
+    _deferred.discard(key)
+    if key in _cache:
+        _write_to_disk(path, _cache[key])
 
 
 def _flat_key(filename: str) -> str:
-    return "uploaded_asset_ids" if "uploaded" in filename else "rejected_asset_ids"
-
-
-def _load_flat(filename: str) -> set[str]:
-    return set(_load(filename).get(_flat_key(filename), []))
+    return "uploaded_asset_ids" if filename == UPLOAD_TRACKER_FILE else "rejected_asset_ids"
 
 
 def _get_ids(entry: list | dict) -> list[str]:
@@ -77,12 +122,15 @@ def _get_ids(entry: list | dict) -> list[str]:
 def _migrate_entry(entry: list | dict) -> dict:
     """Ensure by_person entry is in the current dict format."""
     if isinstance(entry, list):
-        return {"asset_ids": sorted(entry), "scores": {}, "frigate_files": {}, "crop_dims": {}}
-    entry.setdefault("asset_ids", [])
-    entry.setdefault("scores", {})
-    entry.setdefault("frigate_files", {})
-    entry.setdefault("crop_dims", {})
-    return entry
+        return {"asset_ids": sorted(entry), "scores": {}, "frigate_scores": {}, "frigate_files": {}, "crop_dims": {}}
+    # Copy top-level and all nested dicts so callers' mutations never reach the cache.
+    result = dict(entry)
+    result["asset_ids"] = list(result.get("asset_ids", []))
+    result["scores"] = dict(result.get("scores", {}))
+    result["frigate_scores"] = dict(result.get("frigate_scores", {}))
+    result["frigate_files"] = dict(result.get("frigate_files", {}))
+    result["crop_dims"] = dict(result.get("crop_dims", {}))
+    return result
 
 
 def _mark(
@@ -91,12 +139,9 @@ def _mark(
     person_name: str | None,
     score: float | None = None,
     crop_dims: tuple[int, int] | None = None,
+    frigate_score: float | None = None,
 ) -> None:
     data = _load(filename)
-    flat_key = _flat_key(filename)
-    flat = set(data.get(flat_key, []))
-    flat.add(asset_id)
-    data[flat_key] = sorted(flat)
     if person_name:
         by_person = data.setdefault("by_person", {})
         entry = _migrate_entry(by_person.get(person_name, {}))
@@ -107,6 +152,8 @@ def _mark(
             entry["scores"][asset_id] = round(score, 4)
         if crop_dims is not None:
             entry["crop_dims"][asset_id] = [crop_dims[0], crop_dims[1]]
+        if frigate_score is not None:
+            entry["frigate_scores"][asset_id] = round(frigate_score, 4)
         by_person[person_name] = entry
     _save(filename, data)
 
@@ -114,11 +161,21 @@ def _mark(
 # ── Public API ────────────────────────────────────────────────────────────────
 
 def load_uploaded_ids() -> set[str]:
-    return _load_flat(UPLOAD_TRACKER_FILE)
+    """Return all asset IDs recorded as uploaded. Derives from by_person (primary)
+    plus any legacy flat list still present in old tracker files."""
+    data = _load(UPLOAD_TRACKER_FILE)
+    ids = {aid for e in data.get("by_person", {}).values() for aid in _get_ids(e)}
+    ids.update(data.get("uploaded_asset_ids", []))  # backward compat with pre-0.6.1 files
+    return ids
 
 
 def load_rejected_ids() -> set[str]:
-    return _load_flat(REJECT_TRACKER_FILE)
+    """Return all asset IDs recorded as rejected. Derives from by_person (primary)
+    plus any legacy flat list still present in old tracker files."""
+    data = _load(REJECT_TRACKER_FILE)
+    ids = {aid for e in data.get("by_person", {}).values() for aid in _get_ids(e)}
+    ids.update(data.get("rejected_asset_ids", []))  # backward compat with pre-0.6.1 files
+    return ids
 
 
 def mark_uploaded(
@@ -126,8 +183,9 @@ def mark_uploaded(
     person_name: str | None = None,
     score: float | None = None,
     crop_dims: tuple[int, int] | None = None,
+    frigate_score: float | None = None,
 ) -> None:
-    _mark(UPLOAD_TRACKER_FILE, asset_id, person_name, score=score, crop_dims=crop_dims)
+    _mark(UPLOAD_TRACKER_FILE, asset_id, person_name, score=score, crop_dims=crop_dims, frigate_score=frigate_score)
     logger.debug(f"Marked {asset_id} as uploaded ({person_name})")
 
 
@@ -136,15 +194,24 @@ def mark_rejected(asset_id: str, person_name: str | None = None) -> None:
     logger.debug(f"Marked {asset_id} as rejected ({person_name})")
 
 
+
+
 def record_frigate_file(person_name: str, frigate_filename: str, asset_id: str) -> None:
-    """Record the mapping from a Frigate training filename to an Immich asset ID."""
+    """Record a single Frigate filename → asset_id mapping."""
+    record_frigate_files_batch(person_name, {frigate_filename: asset_id})
+
+
+def record_frigate_files_batch(person_name: str, mappings: dict[str, str]) -> None:
+    """Record multiple Frigate filename → asset_id mappings in a single load/save."""
+    if not mappings:
+        return
     data = _load(UPLOAD_TRACKER_FILE)
     by_person = data.setdefault("by_person", {})
     entry = _migrate_entry(by_person.get(person_name, {}))
-    entry["frigate_files"][frigate_filename] = asset_id
+    entry["frigate_files"].update(mappings)
     by_person[person_name] = entry
     _save(UPLOAD_TRACKER_FILE, data)
-    logger.debug(f"Mapped Frigate file {frigate_filename} → {asset_id} ({person_name})")
+    logger.debug(f"Batch-mapped {len(mappings)} Frigate file(s) for {person_name}")
 
 
 def remove_frigate_file(person_name: str, frigate_filename: str) -> None:
@@ -153,13 +220,24 @@ def remove_frigate_file(person_name: str, frigate_filename: str) -> None:
     Does NOT unmark the source asset_id — the deletion was deliberate and
     we don't want to re-upload the inferior image on the next run.
     """
+    remove_frigate_files_batch(person_name, [frigate_filename])
+
+
+def remove_frigate_files_batch(person_name: str, frigate_filenames: list[str]) -> None:
+    """Remove multiple Frigate filenames in a single load/save."""
     data = _load(UPLOAD_TRACKER_FILE)
     by_person = data.get("by_person", {})
-    entry = _migrate_entry(by_person.get(person_name, {}))
-    entry["frigate_files"].pop(frigate_filename, None)
+    raw = by_person.get(person_name)
+    if raw is None:
+        return
+    entry = _migrate_entry(raw)
+    for fn in frigate_filenames:
+        asset_id = entry["frigate_files"].pop(fn, None)
+        if asset_id:
+            entry["frigate_scores"].pop(asset_id, None)
     by_person[person_name] = entry
     _save(UPLOAD_TRACKER_FILE, data)
-    logger.debug(f"Removed Frigate file mapping {frigate_filename} ({person_name})")
+    logger.debug(f"Removed {len(frigate_filenames)} Frigate file mapping(s) for {person_name}")
 
 
 def get_tracked_frigate_file_count(person_name: str) -> int:
@@ -184,27 +262,55 @@ def get_tracked_frigate_filenames(person_name: str) -> set[str]:
     return set(entry["frigate_files"].keys())
 
 
+def has_frigate_scores(person_name: str) -> bool:
+    """Return True if any mapped file for this person has a stored Frigate recognition score."""
+    data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
+    frigate_files = entry.get("frigate_files", {})
+    frigate_scores = entry.get("frigate_scores", {})
+    return any(asset_id in frigate_scores for asset_id in frigate_files.values())
+
+
+def _pick_mapped_file(
+    person_name: str, score_key: str, *, highest: bool, exclude: set[str] | None = None
+) -> tuple[str, str, float] | None:
+    data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
+    scores = entry.get(score_key, {})
+    seen_assets: set[str] = set()
+    candidates = []
+    for ff, asset_id in entry.get("frigate_files", {}).items():
+        if (exclude is None or ff not in exclude) and asset_id in scores and asset_id not in seen_assets:
+            seen_assets.add(asset_id)
+            candidates.append((ff, asset_id, scores[asset_id]))
+    if not candidates:
+        return None
+    return max(candidates, key=lambda x: x[2]) if highest else min(candidates, key=lambda x: x[2])
+
+
 def get_lowest_quality_mapped_file(
     person_name: str, exclude: set[str] | None = None
 ) -> tuple[str, str, float] | None:
     """Return (frigate_filename, asset_id, score) for the mapped file with the lowest
-    quality score, or None if no mapped files with known scores exist.
+    blur score, or None if no mapped files with known scores exist.
 
-    Pass `exclude` to skip files that failed to delete this run without removing
-    them from the tracker — they remain candidates on the next run.
+    Used for quality replacement when no Frigate scores are available.
+    Pass `exclude` to skip files that failed to delete this run.
     """
-    data = _load(UPLOAD_TRACKER_FILE)
-    entry = _migrate_entry(data.get("by_person", {}).get(person_name, {}))
-    frigate_files = entry.get("frigate_files", {})
-    scores = entry.get("scores", {})
-    candidates = [
-        (frigate_filename, asset_id, scores[asset_id])
-        for frigate_filename, asset_id in frigate_files.items()
-        if asset_id in scores and (exclude is None or frigate_filename not in exclude)
-    ]
-    if not candidates:
-        return None
-    return min(candidates, key=lambda x: x[2])
+    return _pick_mapped_file(person_name, "scores", highest=False, exclude=exclude)
+
+
+def get_most_redundant_mapped_file(
+    person_name: str, exclude: set[str] | None = None
+) -> tuple[str, str, float] | None:
+    """Return (frigate_filename, asset_id, score) for the mapped file with the highest
+    Frigate recognition score, or None if no mapped files with Frigate scores exist.
+
+    High Frigate score = the training set already covers this face condition well
+    = the most redundant file and therefore the best replacement target.
+    Pass `exclude` to skip files that failed to delete this run.
+    """
+    return _pick_mapped_file(person_name, "frigate_scores", highest=True, exclude=exclude)
 
 
 def find_by_crop_dimension(size: int) -> list[dict]:
@@ -219,7 +325,10 @@ def find_by_crop_dimension(size: int) -> list[dict]:
         entry = _migrate_entry(raw_entry)
         scores = entry.get("scores", {})
         frigate_files = entry.get("frigate_files", {})
-        asset_to_frigate = {v: k for k, v in frigate_files.items()}
+        asset_to_frigate: dict[str, str] = {}
+        for fn, aid in frigate_files.items():
+            asset_to_frigate.setdefault(aid, fn)  # first-seen wins; plain inversion silently drops duplicates
+        frigate_scores = entry.get("frigate_scores", {})
         for asset_id, dims in entry.get("crop_dims", {}).items():
             w, h = dims[0], dims[1]
             if w == size or h == size:
@@ -229,6 +338,7 @@ def find_by_crop_dimension(size: int) -> list[dict]:
                     "width": w,
                     "height": h,
                     "blur_score": scores.get(asset_id),
+                    "frigate_score": frigate_scores.get(asset_id),
                     "frigate_filename": asset_to_frigate.get(asset_id),
                 })
     return results
@@ -244,20 +354,65 @@ def update_frigate_count(person_name: str, count: int) -> None:
     _save(UPLOAD_TRACKER_FILE, data)
 
 
+def reset_all_people() -> None:
+    """Reset all tracking data in two writes (O(P) Frigate API calls, O(1) disk writes).
+
+    Preferred over calling reset_person() in a loop when RESET_PERSON=* — that
+    approach is O(P²) because each call rebuilds the flat list from all remaining entries.
+    """
+    upload_data = _load(UPLOAD_TRACKER_FILE)
+    for person_name, raw_entry in upload_data.get("by_person", {}).items():
+        entry = _migrate_entry(raw_entry)
+        frigate_filenames = list(entry.get("frigate_files", {}).keys())
+        if not frigate_filenames:
+            continue
+        if not os.environ.get("FRIGATE_URL", "").strip():
+            logger.info(f"FRIGATE_URL not set — skipping Frigate file deletion for {person_name}")
+        elif delete_frigate_person_files(person_name, frigate_filenames):
+            logger.info(f"Deleted {len(frigate_filenames)} Frigate file(s) for {person_name}")
+        else:
+            logger.warning(f"Could not delete Frigate files for {person_name} — tracker reset proceeding anyway")
+    _save(UPLOAD_TRACKER_FILE, {})
+    _save(REJECT_TRACKER_FILE, {})
+    logger.info("Reset all tracking data")
+
+
 def reset_person(person_name: str) -> None:
-    """Remove all uploaded and rejected records for a given person."""
+    """Remove all uploaded and rejected records for a given person.
+
+    Also deletes winnow-managed Frigate training files so the next run starts
+    clean rather than uploading on top of orphaned files. Manually-added Frigate
+    files (not in frigate_files) are never touched. Proceeds with tracker reset
+    even if Frigate is unreachable.
+    """
+    upload_data = _load(UPLOAD_TRACKER_FILE)
+    entry = _migrate_entry(upload_data.get("by_person", {}).get(person_name, {}))
+    frigate_filenames = list(entry.get("frigate_files", {}).keys())
+    if frigate_filenames:
+        if not os.environ.get("FRIGATE_URL", "").strip():
+            logger.info(f"FRIGATE_URL not set — skipping Frigate file deletion for {person_name}")
+        elif delete_frigate_person_files(person_name, frigate_filenames):
+            logger.info(f"Deleted {len(frigate_filenames)} Frigate file(s) for {person_name}")
+        else:
+            logger.warning(f"Could not delete Frigate files for {person_name} — tracker reset proceeding anyway")
+
+    changed = False
     for filename in (UPLOAD_TRACKER_FILE, REJECT_TRACKER_FILE):
-        data = _load(filename)
-        flat_key = _flat_key(filename)
+        data = upload_data if filename == UPLOAD_TRACKER_FILE else _load(REJECT_TRACKER_FILE)
         by_person = data.get("by_person", {})
-        entry = by_person.pop(person_name, None)
-        if entry is not None:
-            person_ids = set(_get_ids(entry))
-            flat = set(data.get(flat_key, [])) - person_ids
-            data[flat_key] = sorted(flat)
+        tracker_entry = by_person.pop(person_name, None)
+        if tracker_entry is not None:
+            flat_key = _flat_key(filename)
+            person_ids = set(_get_ids(tracker_entry))
+            if person_ids and flat_key in data:
+                data[flat_key] = sorted(set(data[flat_key]) - person_ids)
             data["by_person"] = by_person
             _save(filename, data)
-    logger.info(f"Reset tracking data for {person_name}")
+            changed = True
+    if changed:
+        logger.info(f"Reset tracking data for {person_name}")
+    else:
+        logger.debug(f"reset_person: no tracking data found for {person_name}")
 
 
 def get_person_summary() -> dict[str, dict]:
@@ -267,14 +422,14 @@ def get_person_summary() -> dict[str, dict]:
     names = set(uploaded_data) | set(rejected_data)
     result = {}
     for name in sorted(names):
-        u_entry = uploaded_data.get(name, {})
-        r_entry = rejected_data.get(name, {})
+        u_entry = _migrate_entry(uploaded_data.get(name, {}))
+        r_entry = _migrate_entry(rejected_data.get(name, {}))
         result[name] = {
-            "uploaded": len(_get_ids(u_entry)),
-            "rejected": len(_get_ids(r_entry)),
-            "frigate_count": u_entry.get("frigate_count") if isinstance(u_entry, dict) else None,
-            "scores": u_entry.get("scores", {}) if isinstance(u_entry, dict) else {},
-            "frigate_files": u_entry.get("frigate_files", {}) if isinstance(u_entry, dict) else {},
+            "uploaded": len(u_entry["asset_ids"]),
+            "rejected": len(r_entry["asset_ids"]),
+            "frigate_count": u_entry.get("frigate_count"),
+            "scores": u_entry["scores"],
+            "frigate_files": u_entry["frigate_files"],
         }
     return result