- Strip all face code from update.rb; add shared log helper writing to
  /opt/albumen/log/albumen.log with [update] prefix.  update.rb now owns
  only album.json; face_daemon.rb owns faces.json.
- New scripts/face_daemon.rb: polls MEDIA_ROOT for unprocessed images,
  calls faces.py in batches, writes per-directory faces.json sidecars
  atomically.  Graceful SIGTERM/SIGINT shutdown between directories.
- New config/face_daemon.service: systemd unit running as albumen user,
  Restart=on-failure, logs via SyslogIdentifier=albumen-faces.
- app.rb: add FACES_ENABLED constant; load_faces() helper reads faces.json;
  album_files() merges face data into each entry as :faces field.
- Update README.md and DESIGN.md to document the new daemon architecture,
  faces.json schema, and service management commands.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- process_dir() takes idx/total args and prints [N/total] prefix on every
  Scanning/Skipping line so long runs are easy to monitor via tail -f
- faces_pending?() checks album.json for any image with faces: null when
  faces.enabled is true; if found, the sentinel skip is bypassed so those
  images get processed even though the directory mtime hasn't changed
- This handles the case where face detection is newly enabled on a library
  that was previously indexed without it — no --force needed on subsequent
  runs after the initial catch-up

Resume after abort: sentinel is only touched after atomic_write_json, so
an aborted directory reruns cleanly. Already-completed directories skip
normally; partially-detected batches rerun from scratch (safe/idempotent).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- faces.py: use model="cnn" (more accurate, better at angles/small faces/poor
  lighting) instead of HOG; model comment explains the trade-off clearly
- faces.py: accept multiple image paths; process with ThreadPoolExecutor
  (dlib releases GIL during C++ inference → genuine thread parallelism);
  output JSON dict {path: [faces]} for batch calls
- update.rb: batch_detect_faces() collects all unprocessed images per
  directory and calls faces.py once per directory rather than once per image,
  avoiding repeated model load overhead
- update.rb: FACES_WORKERS read from config.yml faces.workers (default 4;
  set to 20 in this install's config.yml on a 64-core Xeon)
- update.rb: process_dir() now takes idx/total and prints [N/total] prefix
  on every Scanning/Skipping line for progress monitoring

To monitor a long run:
  nohup ruby /opt/albumen/scripts/update.rb > /tmp/faces_update.log 2>&1 &
  tail -f /tmp/faces_update.log

Resume/restart is fully safe: sentinel files are only written after
atomic_write_json, so an aborted directory reruns cleanly from scratch.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- scripts/faces.py: Python helper using face_recognition (dlib/HOG) to
  detect faces and return 128-D encodings as JSON; called by update.rb
- scripts/update.rb: enrich_faces() stores face boxes and encodings in
  album.json per image (null = not yet processed, [] = processed/none found);
  skips files already processed; gated on faces.enabled in config.yml
- Reads CONFIG_PATH (same env var as app.rb) to check faces.enabled flag
- Feature is off by default; enabled in this install via config.yml
- README.md, DESIGN.md: document installation, opt-in config, data model,
  and planned clustering/people-management pipeline

People management UI and clustering script are the next milestone.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- update.rb: skip exiftool on images marked exif_absent (set after first
  failed attempt); prevents repeated slow scans of old photos with no EXIF
- update.rb: explicit directory argument now implies force — passing a path
  always rescans that subtree regardless of sentinel mtime
- app.rb: /admin/update no longer hardcodes --force; sentinel-based skipping
  is used by default, making UI updates finish in seconds instead of minutes
- admin/album.erb: add "Force rescan all" checkbox to Run Update button;
  checked state passes force=1 to the server and restores --force behavior
- README.md, DESIGN.md: document sentinel skipping, exif_absent flag, and
  explicit-directory force behavior

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

update.rb records transcoded_to in album.json (even on re-runs where
the MP4 already exists) so the marker survives across scans.

app.rb filters files with transcoded_to from non-admin views.
album.erb renders them greyed-out with an amber "⚠ original" badge in
admin mode. admin/album.erb marks the edit-table row and shows the
target filename under the original.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

On each run, any .avi, .mkv, or .mov file without a same-named .mp4
sibling is transcoded with ffmpeg (H.264/AAC, CRF 23, faststart).
The original is kept on disk and hidden in album.json so only the
playable MP4 appears in the UI; admins can un-hide the original if
needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Album cards show recursive photo count (bubbles up through sub-albums).
- Lightbox info panel shows camera, aperture, shutter speed, and ISO;
  update.rb now extracts and stores these EXIF fields.
- Video thumbnail cards show a duration badge (e.g. "1:23").
- Slideshow launcher redesigned: button on its own line, with Shuffle /
  Full screen / Interval options on a second line, all inside a rounded
  border to make the grouping clear.
- Fixed album-actions alignment so Interval sits level with the checkboxes.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

When a media file is deleted from disk, also delete its cached
thumbnail from cache/thumbs/ so stale .th.jpg files don't accumulate.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

EXIF DateTimeOriginal has no timezone — it's the camera's wall clock.
Storing it via .iso8601 attached +00:00 (server TZ), causing browsers
to shift the time to their local zone when parsing. Switch to
strftime('%Y-%m-%dT%H:%M:%S') so no offset is written. JS strips any
existing +00:00 suffix from already-stored values so old data is also
displayed correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>