Specify eye state as a filter term, and record what was measured

FR-CULL-13, with §3.9.1's exclusion of blink detection re-read as the
exclusion of blink selection it always was: the stored fact and the chip
are built, a pass that picks the frame where everyone's eyes are open is
not. faces.md §17 has the models, the crop measurements, the four-state
rule and its floors, the native and proxy sheets read face by face, and
what remains to measure.

docs/requirements.md

@@ -1304,6 +1304,20 @@ per eye, sub-millisecond on CPU, opset 17 with batch-norm already folded. Its pu
 0.99 is on its own crops; ours are cut from a five-point landmark, so the number is measured on
 this library before it is believed.
 
+**Built 2026-09-19, in part** ([faces.md §17](faces.md)). Eye state ships: OCEC over a box cut
+from the lid contour of InsightFace's `2d106det`, plus a sunglasses classifier (SGC, MIT) whose
+answer takes precedence over the eyes it hides, and — the part the measurement forced — per eye
+the source pixels across the box and the sharpness of the patch, so an eye too small, too soft, or
+hidden by the turn of the head is recorded as *unreadable* rather than read as closed. The filter
+is the "Eyes open" chip on the library's people filter: with people chosen, it asks about their
+faces, and it drops a frame only on a closed eye that could be read. Head pose is **not** built;
+the hidden eye of a turned head is caught by its collapsed contour instead, and the selector-term
+form ("everyone's eyes open", composable in a saved collection) waits on FR-CULL-11's person term,
+which the grid filter also predates. The landmark model is under the InsightFace grant, accepted
+on the same terms as the detector and embedder (faces.md §2.2a, decision 2026-09-19: this project
+will not be commercial), so the weights test above is met by the two classifiers and not by the
+third model.
+
 *Acceptance:* on a labelled set of at least 500 faces from the reference library, eye state is
 within a stated tolerance of its published F1, reported separately for glasses, profile, and
 faces under 60 px; facing-the-camera agrees with a hand-labelled split at a stated rate. Both are
@@ -2240,7 +2254,7 @@ note where deferring now constrains the design later.
 | Gaze and eye-contact estimation | Every open gaze model read on 2026-09-19 is trained on Gaze360, MPIIGaze or ETH-XGaze, all research-only, and Gaze360's licence restricts *models trained on it* by name — the InsightFace situation again (D13). Head pose from the five landmarks is the proxy (FR-CULL-8a). Revisit when weights with a clean data chain exist; iris offset within the eye crop is the licence-free fallback if the proxy proves too weak. |
 | Print layout | — |
 | Soft proofing | Parameterise the output colour stage by an arbitrary profile so this becomes a UI addition, not a pipeline change. FR-EXP-3's print-dimension mode already half-commits to print workflows. |
-| ~~Face recognition~~ | **Undeferred 2026-08-09**, in the narrower form specified in §3.9.1 (FR-CULL-8 … FR-CULL-12): people *grouping and search*, no automated selection. Reclassified as culling rather than AI — it is the same mechanical-grouping category as FR-CULL-5, not the taste operation AI masking is. Gated on spike S14 and decision D13. |
+| ~~Face recognition~~ | **Undeferred 2026-08-09**, in the narrower form specified in §3.9.1 (FR-CULL-8 … FR-CULL-13): people *grouping and search*, no automated selection. Reclassified as culling rather than AI — it is the same mechanical-grouping category as FR-CULL-5, not the taste operation AI masking is. Gated on spike S14 and decision D13. |
 | ~~AI subject masking~~ | **Undeferred 2026-09-19** — it had been built. FR-DEV-3i states what exists: subject and category masks from local models, stored as identity, editable like a drawn mask. The shape this row asked for when it was written — point at a thing, get an editable mask — is the shape that shipped. |
 | AI upscaling | Deferred. Lower priority than denoise, which has no manual fallback. |
 | Video | — |