Record that face detection has run, not just what it found

An image with no faces in it was indistinguishable from one that had
never been looked at, so every landscape, still life and document scan in
the library was re-detected on every pass, for ever. In a real library
that is most of it: on the 23,527-image test library, 64 of the first 110
images indexed contain no face at all.

Schema v9 adds face_index, a run marker per (image, model) carrying the
face count and the proxy edge it read. Keyed on the model, so a model
change puts every image back in the queue by itself.

That makes a coverage figure possible, which is the thing a user actually
wants to see. The audit also splits the outstanding set by whether a
proxy exists, because 23,417 awaiting a proxy and 110 ready to index are
different problems, and telling the user to run indexing again would not
fix the first.

The Identity screen gains Index faces, Stop, and the coverage line.
examples/face_index.rs is the same check and sweep without a window,
which is the right shape for an overnight pass.

Measured on the real library in release: 3.5 images/second, 110 images
and 125 faces in 30 seconds, and a second run correctly finds nothing
left to do.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-catalog/src/schema.rs

@@ -15,7 +15,7 @@ use rusqlite::Connection;
 use crate::error::CatalogError;
 
 /// Schema version this build writes and understands.
-pub const SCHEMA_VERSION: i64 = 8;
+pub const SCHEMA_VERSION: i64 = 9;
 
 /// Apply migrations up to [`SCHEMA_VERSION`].
 ///
@@ -84,6 +84,12 @@ pub fn migrate(conn: &Connection) -> Result<i64, CatalogError> {
         tx.pragma_update(None, "user_version", 8)?;
         tx.commit()?;
     }
+    if from < 9 {
+        let tx = conn.unchecked_transaction()?;
+        tx.execute_batch(V9)?;
+        tx.pragma_update(None, "user_version", 9)?;
+        tx.commit()?;
+    }
 
     Ok(from)
 }
@@ -333,6 +339,47 @@ fn stem_of(path: &str) -> &str {
 /// Both narrow the walk rather than reorder it, so the index still supplies the
 /// ordering and SQLite tests the extra predicate per row. That is the cheap
 /// direction: the expensive part was never the filtering, it was the sort.
+const V9: &str = r#"
+-- TRACES: FR-CULL-8
+-- A record that face detection has *run* on an image, distinct from what it
+-- found.
+--
+-- # Why the faces table cannot answer this
+--
+-- Without this, "has this image been indexed" is asked as "does it have any
+-- faces", and those are not the same question. **A photograph with no faces in
+-- it is indistinguishable from one that has never been looked at**, so every
+-- indexing pass re-examines every landscape, every still life and every
+-- document scan in the library, for ever. In a typical personal library that is
+-- most of it: the pass never converges, and the cost is paid again on every
+-- run rather than once.
+--
+-- It also makes a coverage figure possible, which is the thing a user actually
+-- wants to see — "4,812 of 5,000 images indexed" — where counting face rows
+-- can only ever report how many faces exist.
+--
+-- # Why it is keyed on the model
+--
+-- Embeddings from different models are not comparable, so a model change has
+-- to re-index. Keying the marker on `(image_id, model_id)` makes that
+-- automatic: new model, no marker, image comes back into the queue. The id
+-- names the whole pipeline -- detector and embedder together -- because
+-- changing either changes what is found.
+CREATE TABLE face_index (
+    image_id    INTEGER NOT NULL REFERENCES images(id) ON DELETE CASCADE,
+    model_id    TEXT    NOT NULL,
+    indexed_at  INTEGER NOT NULL,
+    -- Zero is a real and common answer, and recording it is the entire point.
+    faces_found INTEGER NOT NULL,
+    -- Long edge of the proxy this ran against. A face too small to detect at
+    -- 1024 may be findable at 2048, so a library whose proxies grow can
+    -- re-index the images that stand to gain instead of all of them.
+    source_edge INTEGER NOT NULL,
+    PRIMARY KEY (image_id, model_id)
+);
+CREATE INDEX face_index_model ON face_index(model_id);
+"#;
+
 const V8: &str = r#"
 -- TRACES: FR-CULL-8 | FR-CULL-9 | FR-CULL-10 | FR-CULL-11 | FR-CULL-12 | NFR-SEC-5
 -- People and faces (docs/faces.md, docs/catalog.md §10).