Keep the dense landmarks behind each eye reading, packed

The 106 points the eye boxes were cut from, stored beside the reading as
16-bit fixed point over the frame: 424 bytes a face, a seventh of a pixel
on a 6000-pixel frame, where f16 at the same size would have been six.
Derived data like the embedding, kept for the same reason — it cost a
fetch and a model run, and the next per-face pass should run from the
catalog. Shards carry it; a peer's shard from before it is still read.

docs/catalog.md

@@ -761,6 +761,10 @@ CREATE TABLE faces (
     eye_left_px     REAL,
     eye_left_sharp  REAL,
     sunglasses      REAL,
+    -- The 106 dense landmarks the eyes were read from, packed as 16-bit
+    -- fixed point over the frame: 424 bytes (schema V18). Kept so the next
+    -- per-face pass runs from the catalog rather than from the original.
+    landmarks_dense BLOB,
     -- Which model produced this. An embedding is only comparable to others
     -- from the same model; mixing them silently yields nonsense similarities.
     model_id   TEXT NOT NULL,

docs/faces.md

@@ -1435,6 +1435,16 @@ Two things no sample so far can say. None holds more than one real blink, so the
 sunglasses misses is a narrowed or shut eye rather than a wrong one, but that is a reading of a
 contact sheet, not a number. And the floors were set on a few dozen faces. Both are M11.
 
+### 17.4a What is kept per face
+
+The box, the five landmarks, `crop_px`, the embedding and the crop were already there. The eye
+pass adds the seven numbers of §17.3 and the **106 dense landmarks** it read the eye boxes from,
+packed as 16-bit fixed point over the frame — 424 bytes a face, a seventh of a pixel on a
+6000-pixel frame (`dr_face::Landmarks::to_packed_bytes`, schema V18). Kept for the reason the
+embedding is kept: it cost a fetch of the original and a model run, and the next per-face pass —
+head pose, expression, whatever FR-CULL-8a grows — should run from the catalog. `f16` would have
+been the same size and worse: three figures near 1.0 is six pixels at that scale.
+
 ### 17.5 The measuring pass, and shards
 
 A face indexed before the models existed, or on a device without them, has no reading. The sweep's
@@ -1444,8 +1454,9 @@ box and landmarks already stored (`dr_ui::faces::measure_native`). No detector r
 moves. A device *without* the models does not list them, or it would fetch every original in the
 library to do nothing to it; `dr_catalog::faces::unmeasured_sql` is the one predicate both the
 count and the work list use, so the pass converges. The People screen's coverage line counts
-these faces as work to measure and keeps the Index button while any remain, or an already-indexed
-library could never have its readings filled in.
+these faces as work to read and keeps the button while any remain — reading **Read eye state**
+once detection is complete and only readings are left, which is the state an already-indexed
+library is in the day the models arrive.
 
 Shards carry the seven columns beside `quality`. A peer's faces without a reading are **adopted**,
 unlike a peer's faces without a quality (§14): the measuring pass finds this work by the NULL and

docs/gestures.md

@@ -25,7 +25,7 @@ Sampling a neutral is the first move of the tonal pass — every colour judgemen
 
 Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as magnifying the picture rather than sliding it about. Double-tap is the way to an exact 1:1; this is the way to everything in between.
 
-<sub>`ui/dr-ui/ui/app.slint:1986`</sub>
+<sub>`ui/dr-ui/ui/app.slint:1988`</sub>
 
 ### Move a magnified photograph about
 
@@ -34,7 +34,7 @@ Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as m
 
 Only once there is something outside the viewport to reach, which is why the cursor becomes a hand exactly then. The view is clamped to the frame: panning past the edge would show undefined area beside the photograph, and that reads as a rendering fault rather than as the end of the picture.
 
-<sub>`ui/dr-ui/ui/app.slint:2077`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2079`</sub>
 
 ### Paint a mask by hand
 
@@ -43,7 +43,7 @@ Only once there is something outside the viewport to reach, which is why the cur
 
 A model's mask stops inside a shoulder and leaks into the hair, and no single edge control fixes two errors that go opposite ways. The whole stroke is one step in the history, so taking a mark back costs one press however long it took to make.
 
-<sub>`ui/dr-ui/ui/app.slint:2164`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2166`</sub>
 
 ### Take back the last change
 
@@ -53,7 +53,7 @@ A model's mask stops inside a shoulder and leaks into the hair, and no single ed
 
 A whole drag is one step, so undo takes back a decision rather than a frame of a gesture. The list is there because arriving six steps back costs what arriving from one does.
 
-<sub>`ui/dr-ui/ui/app.slint:2385`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2387`</sub>
 
 ### Do it again after taking it back
 
@@ -61,7 +61,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 - **Pointer** — Click it, or press Redo in the History header
 - **Keyboard** — Ctrl+Shift+Z
 
-<sub>`ui/dr-ui/ui/app.slint:2398`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2400`</sub>
 
 ### Copy the settings from this photograph
 
@@ -71,7 +71,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 
 The panel is the copy that has to work: a tablet has no modifier key to hold and no menu bar to hang the action from. The shortcut is an accelerator for a control that is on screen either way.
 
-<sub>`ui/dr-ui/ui/app.slint:2431`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2433`</sub>
 
 ### Paste the settings onto this photograph
 
@@ -81,7 +81,7 @@ The panel is the copy that has to work: a tablet has no modifier key to hold and
 
 The button names what would be pasted — "3 adjustments", and whether the crop is coming with it — which the shortcut cannot say. Both paste the same scope.
 
-<sub>`ui/dr-ui/ui/app.slint:2443`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2445`</sub>
 
 ### Change which group of adjustments is on screen
 
@@ -91,7 +91,7 @@ The button names what would be pasted — "3 adjustments", and whether the crop
 
 The groups are whatever the operation set declares itself to be about, so there are as many as the pipeline has and no key can be assigned to one of them by name. Stepping is the binding that survives a node being added.
 
-<sub>`ui/dr-ui/ui/app.slint:2471`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2473`</sub>
 
 ### Look at the photograph at 1:1
 
@@ -101,7 +101,7 @@ The groups are whatever the operation set declares itself to be about, so there
 
 Noise reduction and capture sharpening are judgements about single pixels, and a fitted view averages several of the file's into each one on screen — so the frame looks softer than it is and the correction goes too far. The point and the magnification survive opening the next photograph, which is what makes checking the same eye across forty portraits forty keystrokes rather than forty pans.
 
-<sub>`ui/dr-ui/ui/app.slint:2506`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2508`</sub>
 
 ### Move to the next or previous photograph
 
@@ -111,7 +111,7 @@ Noise reduction and capture sharpening are judgements about single pixels, and a
 
 The edit on screen is saved on the way out, so stepping through a folder is as much a departure as going back to the grid and loses nothing.
 
-<sub>`ui/dr-ui/ui/app.slint:2558`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2560`</sub>
 
 ### See the photograph before you edited it
 
@@ -121,7 +121,7 @@ The edit on screen is saved on the way out, so stepping through a folder is as m
 
 Held rather than toggled, and no split screen: a split halves the working image on the tablet the column was sized for, and the comparison photographers describe making is a flick back and forth. It takes no history step, so checking whether a frame is overcooked costs nothing to undo afterwards.
 
-<sub>`ui/dr-ui/ui/app.slint:2682`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2684`</sub>
 
 ### Put one control back to its default
 
@@ -244,7 +244,7 @@ A face is either the system's guess or the user's judgement, and the two are nev
 
 This is the point of having identified anybody. Without it the screen is a filing cabinet with no drawer handles.
 
-<sub>`ui/dr-ui/ui/identity.slint:629`</sub>
+<sub>`ui/dr-ui/ui/identity.slint:635`</sub>
 
 ### Change how faces are grouped
 
@@ -253,7 +253,7 @@ This is the point of having identified anybody. Without it the screen is a filin
 
 The right match confidence is a property of your library, not of the model. "What would this do?" answers for this library without writing anything; names, confirmations and the groups you have set aside are kept whatever the dials say.
 
-<sub>`ui/dr-ui/ui/identity.slint:666`</sub>
+<sub>`ui/dr-ui/ui/identity.slint:672`</sub>
 
 ## Library grid