Specify face indexing at native resolution, and say what the proxy cost

FR-CULL-8 said detection runs against the thumbnail or proxy tier and
never a full decode, and faces.md §5 said the aligned crop is sampled
from that same proxy. Both are wrong in the same place: they treat
detection and cropping as one resolution problem when they are two, with
opposite answers.

Detection does not care. §4.1 fixes the graph's input at 640x640 and
letterboxes whatever arrives, so a face filling 2% of the frame reaches
the model at 12px whether the buffer handed over is 1024px or 6000px.
Every pixel above the detector's own input is discarded before inference.

The crop cares about nothing else. §5's warp produces the fixed 112x112
ArcFace sees, so source resolution converts directly into whether those
112 pixels were photographed or interpolated. Reading crop_px across the
18,671 faces the proxy-tier implementation stored: 47.3% were upsampled
to reach the embedder, 314 of them by more than 2x, the smallest from 34
source pixels. An upsampled crop does not fail loudly -- it yields a
confident embedding of detail that was never there, and the damage
appears three stages later as clusters that will not separate.

So FR-CULL-8 now specifies four stages with the resolutions named
separately: render native through FR-EXP-9's pipeline, downscale for the
detector, map boxes and landmarks back to native, crop and align from
the native render. The affordability the old rule bought is met instead
by when the pass runs -- background, preempted, resumable -- and the
requirement says plainly what it now costs on a remote library: the
original rather than FR-NC-3's byte range, 412 GB across the reference
library's 19,107 images, so a whole-library pass is a transfer under
FR-NC-6 rather than something that may start on its own.

MIN_CROP_EDGE replaces the MIN_DETECT_EDGE this branch briefly had. Same
number, guarding the quantity that turned out to matter.

faces.md §7b records both measurements, and marks the second as
unexplained rather than dressing it as a finding. Grouped by the buffer
detection ran against, faces per image was 0.078 at 1024 or below and
1.82 at 2048 or better, controlled for file type and size. That gap is
real and reproducible and I cannot account for it, because the letterbox
above says detector input should not matter. M4 is where it gets
settled. The crop measurement does not depend on it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-face/src/lib.rs

@@ -43,6 +43,27 @@ pub mod embedding;
 pub mod naming;
 pub mod neighbours;
 
+/// Smallest long edge a face crop may be sampled from.
+///
+/// **A floor on the crop source, not on the detector input.** The distinction
+/// is the whole of FR-CULL-8 and `docs/faces.md` §7: detection letterboxes
+/// every buffer into 640×640, so its input resolution decides nothing, while
+/// [`warp`] samples the 112×112 the embedder sees and so converts source
+/// resolution directly into embedding quality. FR-CULL-8 requires that crop to
+/// come from the native render; this is the guard that catches a caller
+/// sampling from a proxy instead.
+///
+/// 1025 rather than 1024 because 1024 is exactly `dr_thumbs::ThumbSize::Large`,
+/// the stored proxy tier a caller is most likely to reach for by mistake, so
+/// the floor has to exclude it rather than admit it. Written as a minimum so
+/// the test is `edge < MIN_CROP_EDGE` with no boundary to get wrong.
+///
+/// It is a coarse guard and deliberately so: whether any *individual* crop was
+/// upsampled is answered exactly by `faces.crop_px` against [`ALIGNED_EDGE`],
+/// and that is the number §7b measures. This only stops a whole pass reading
+/// from the wrong tier.
+pub const MIN_CROP_EDGE: u32 = 1025;
+
 pub use align::{warp, Aligned112, Similarity, ALIGNED_EDGE, ARCFACE_TEMPLATE};
 pub use assign::{identity_shares, RIVAL_FLOOR, TOP_MATCHES};
 pub use calibrate::{Calibration, Pairs, ReliabilityBand};