Merge: group the frames of one moment, and let a burst fold away

FR-CULL-5. Frames join a burst when they are adjacent in time and look
like the frame before them -- both, because time alone groups a whole
ceremony and similarity alone groups a studio setup across two days.
Adjacent pairs only, chained; there is no all-pairs step and there must
never be one.

No selection of any kind. The representative is the earliest frame, a
fact about the clock rather than a judgement about the photograph, and a
newly found burst arrives open, so the pass never takes a row off the
screen.

Verified: fmt, clippy --workspace --all-targets -D warnings, 346
dr-catalog tests, 511 dr-ui tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/catalog.md

@@ -810,6 +810,60 @@ confidence is unavailable. It does not fall back to an untuned default dressed u
 
 ---
 
+## 10a. Bursts and near-duplicates
+
+Specified by FR-CULL-5, implemented in `dr_catalog::bursts` (a v11 migration) with the pass that
+feeds it in `dr_ui::bursts`.
+
+A burst is a run of frames that are **adjacent in time and look like the frame before them**. Both
+halves are load-bearing. Time alone groups a whole wedding ceremony, because a photographer working
+steadily never leaves the gap that would end the run. Similarity alone groups a studio setup shot
+across two days, which is a project rather than a moment. The bounds are two seconds and eight bits
+of a 64-bit difference hash, and the reasoning for each figure is in the module.
+
+**Two seconds, for a burst that fires ten frames in one.** `images.captured_at` is whole seconds:
+EXIF's `DateTimeOriginal` has no sub-second field, and `SubSecTimeOriginal` is optional and widely
+omitted. Ten frames of a burst therefore arrive sharing a timestamp, and any threshold finer than a
+second is a threshold on information the catalog does not have. Where the pace really is faster than
+two seconds, the similarity bound is what separates the frames.
+
+**The signal is a perceptual hash of the thumbnail, not of the original.** `images.perceptual_hash`
+is filled from the 256px thumbnails §7 already stores — vastly more resolution than a 9×8 reduction
+uses — so a library that has been browsed has already paid for its signatures and no RAW is decoded
+for this. The consequence is stated rather than hidden: an image with no thumbnail gets no
+signature, and a frame with no signature never joins a burst. It is picked up by the next pass.
+
+**It is a pass, not a job kind**, for exactly the reason §10.2 gives for face clustering: a burst is
+a property of a *run* of frames and has no natural `subject_id`, so a per-image job would rebuild
+the world once per photograph. It runs when the thumbnail sweep finishes, which is the first moment
+the signatures can all be computed.
+
+**A newly found burst arrives open.** The pass marks frames; it never takes them off the screen.
+Collapsing on discovery would be tidier and would also mean a background pass removing photographs
+from under someone part way through a cull. Folding a burst up is the user's act, it is remembered
+(`burst_expanded`), and a burst that is already known keeps whatever state it is in — so the pass
+that follows the next import does not spring open a morning's work.
+
+**Nothing here ranks a frame.** The representative of a collapsed burst is its *earliest* frame,
+which is a fact about the clock rather than a judgement about the photograph. FR-CULL-5 names the
+failure this avoids — rejecting the only frame of an important moment because someone blinked — and
+the only judgement in the subsystem is the user's own choice of representative, which lives in its
+own table (`burst_pick`) so that rebuilding the grouping cannot erase it. Same argument as
+`people.ignored` in §10.
+
+**What the collapse costs the grid.** Which rows a collapsed burst hides has to be decided by the
+query rather than by the cells, because the grid is a window (`LIMIT n OFFSET k`) and the frames it
+hides are mostly not loaded. So the predicate joins `VISIBLE` in every query that lists or counts
+cells, under the same discipline: present in four places of five, the header's count, the
+scrollbar, the shift-click range and the scrub's ordinal stop describing the same list.
+
+**What this does not settle.** Bursts are local: the tables ride along in the uploaded catalog
+snapshot and nothing on the far side reads them, so a second device rebuilds its own grouping from
+its own signatures. Making `burst_pick` cross-device is a merge question of the same shape as §8.4's
+and is not answered here.
+
+---
+
 ## 11. Requirements touched
 
 | ID | How this document addresses it |
@@ -828,6 +882,7 @@ confidence is unavailable. It does not fall back to an untuned default dressed u
 | NFR-P1 | §3.1 one stat per directory, not per file |
 | NFR-P3 | §7.1 on-demand generation |
 | NFR-ARCH-2 | §6.3 priority classes shared with the GPU scheduler |
+| FR-CULL-5 | §10a burst grouping: capture-time proximity and image similarity, collapse without selection |
 | NFR-ARCH-3 | §4.3 query cancellation, §6 job cancellation |
 | NFR-RES-4 | §7.3 LRU cap, eviction order |
 | FR-CULL-8 | §10.1 `faces` schema, §6.1 `DetectFaces` job kind on the proxy tier |