Keep the face, not just a way to find it again

A face was drawn by decoding the 1024px proxy it was found on and cutting the
box out again, every time the People screen opened. That made the screen a
derivative of the thumbnail cache: evict a proxy — which the cache may do at any
moment — and the cell goes blank, with no way back short of re-fetching the
original over the network and re-detecting it. It also cost a full JPEG decode
per image, per visit, to show a 96px cell.

So the crop is cut once, when the pixels are already in hand at detection time,
and kept. A 160px JPEG is a few KB against the ~250 KB proxy it replaces reading.

Where it lives is the interesting part. The catalog snapshot is uploaded *whole*
on every sync and downloaded by every device, so a crop column there would put
tens of MB on every round trip — the exact cost `face_shard`'s 25 MB cap exists
to bound, and the reason bulk per-face data lives in shards already. Crops
therefore travel in the face shards, beside the embeddings, and
`snapshot_for_upload` strips them from the copy it writes. Nothing reads a crop
out of a merged remote catalog — the merge touches collections and keywords only
— so a receiving device loses nothing. A shard carrying crops holds around 3,500
faces rather than 22,000, which is the price of a second device showing People
immediately instead of re-fetching every proxy.

The column is nullable and the reader falls back to the proxy, so a face indexed
before this still works and the next indexing pass fills it in.

V10 also adds `people.ignored`, for a person the user has looked at and does not
want to identify. Most clusters in a real library are strangers — passers-by,
other people's guests, a face on a poster — and there is no way to tell "not yet
looked at" from "looked at, don't care" without recording the second. It is a
column rather than a deletion because a deleted cluster comes straight back on
the next Regroup: the faces are still there and still similar, and nothing short
of remembering the judgement survives re-clustering. Same argument
`face_person_rejected` makes one level down.

And `prune_empty_unnamed`, for what clustering leaves behind. Regroup creates a
person per unanchored group and never removed the previous run's now-empty ones,
so pressing it twice added a rail entry per group it no longer believed in.
Named people are never touched however empty — a name is user data — nor is a
merge tombstone, which must outlive its faces to keep redirecting.

298 tests pass, including that the snapshot carries no crops while the live
catalog keeps them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-catalog/src/sync.rs

@@ -61,6 +61,42 @@ pub fn snapshot_for_upload(conn: &Connection, dest: &Path) -> Result<(), Catalog
     // have. The effect is the same: one step, no interleaved writers, no
     // progress callback. A 50k-image catalog is tens of megabytes.
     backup.run_to_completion(i32::MAX, std::time::Duration::ZERO, None)?;
+    drop(backup);
+
+    strip_face_crops(&out)?;
+    Ok(())
+}
+
+/// Drop the stored face crops from a snapshot before it is uploaded.
+///
+/// The snapshot is the *whole catalog*, uploaded on every sync and downloaded
+/// by every device. Face crops are a few KB each and a fully indexed library
+/// holds tens of thousands of them, so leaving them in would put tens of MB on
+/// every round trip — the exact cost `face_shard`'s 25 MB cap exists to bound,
+/// and the reason the bulk per-face data lives in shards in the first place.
+///
+/// Crops are not lost by this: they travel in the face shards
+/// ([`crate::face_shard::export_to_shards`]), which are written once and
+/// downloaded once. Nothing reads a crop out of a merged remote catalog —
+/// [`merge_all`] touches collections and keywords only — so removing them here
+/// costs a receiving device nothing it would otherwise have had.
+///
+/// `VACUUM` afterwards because SQLite does not return freed pages to the file
+/// on its own, and an upload sized by the file rather than by its contents
+/// would keep paying for bytes that are no longer there.
+fn strip_face_crops(snapshot: &Connection) -> Result<(), CatalogError> {
+    // A catalog older than the crop column is a legitimate input here — a
+    // snapshot taken mid-migration, or a test fixture built from an earlier
+    // schema — so an absent column is nothing to fail over.
+    let has_crop = snapshot
+        .prepare("SELECT crop FROM faces LIMIT 1")
+        .map(|_| true)
+        .unwrap_or(false);
+    if !has_crop {
+        return Ok(());
+    }
+    snapshot.execute("UPDATE faces SET crop = NULL WHERE crop IS NOT NULL", [])?;
+    snapshot.execute_batch("VACUUM")?;
     Ok(())
 }
 
@@ -250,4 +286,62 @@ mod tests {
         std::fs::create_dir_all(&base).unwrap();
         base
     }
+
+    /// The whole reason crops live in the shards: a snapshot is uploaded whole,
+    /// on every sync, to every device.
+    #[test]
+    fn the_snapshot_carries_no_face_crops() {
+        let dir = tempdir();
+        let live = dir.join("catalog.sqlite");
+        let snap = dir.join("snap.sqlite");
+
+        let c = seeded(&live);
+        c.execute(
+            "INSERT OR IGNORE INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at) VALUES (1, 1, 'a.CR3', 0)",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO faces
+                 (image_id, x, y, w, h, landmarks, detector_confidence, embedding,
+                  crop_px, model_id, detected_at, crop)
+             VALUES (1, 0.1, 0.1, 0.2, 0.2, X'00', 0.9, X'00', 180.0, 'm', 0, ?1)",
+            [vec![7u8; 4096]],
+        )
+        .unwrap();
+
+        snapshot_for_upload(&c, &snap).unwrap();
+
+        let out = Connection::open(&snap).unwrap();
+        let crops: i64 = out
+            .query_row(
+                "SELECT COUNT(*) FROM faces WHERE crop IS NOT NULL",
+                [],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(crops, 0, "the snapshot still carries face crops");
+
+        // The face itself must still be there — only the pixels are dropped.
+        let faces: i64 = out
+            .query_row("SELECT COUNT(*) FROM faces", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(faces, 1);
+
+        // And the local catalog keeps its crop: this strips the copy, never
+        // the original.
+        let kept: i64 = c
+            .query_row(
+                "SELECT COUNT(*) FROM faces WHERE crop IS NOT NULL",
+                [],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(kept, 1, "stripping the snapshot damaged the live catalog");
+    }
 }