Scan reliability: neural confident-gate, look-alike big-cluster guard, gate language

Three trust/robustness fixes found while dogfooding on a large library:

- Burst scan never pre-marks a deletion on dHash alone. dHash can't tell "same
  framing, subject moved" from a true duplicate, so it was confidently marking a
  different-moment frame for deletion. A cluster now stays confident only if
  Apple's neural feature print agrees it's near-identical (max pairwise distance
  ≤ 0.10); anything looser — or any frame that can't be read — falls to "you
  decide, keep all". Missing a duplicate is harmless; deleting a keeper isn't.

- Look-alikes no longer freezes. A stage-1 dHash cluster bigger than 80 is
  collision noise (solid colours, screenshots) whose stage-2 confirmation means
  thousands of neural prints + O(n²) — an effective hang. Skip them (count
  surfaced via progSkippedClusters), and compute the surviving clusters' feature
  prints concurrently.

- The permission-gate screen carries the globe language menu too; a
  non-default-language user could otherwise not switch language before granting
  access. Extracted as a shared languageMenu, reused by the main toolbar.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: chodaict

app/Sources/SnapsiftApp/ContentView.swift

@@ -51,6 +51,18 @@ struct ContentView: View {
         }
         .frame(maxWidth: .infinity, maxHeight: .infinity)
         .background(Color.reefGround)
+        // The permission screen has no main toolbar, so carry the language menu
+        // here too — otherwise a non-default-language user is stuck on the gate.
+        .toolbar { ToolbarItem { languageMenu } }
+    }
+
+    /// Globe language switcher, shared by the gate and the main toolbar.
+    private var languageMenu: some View {
+        Menu {
+            Picker("", selection: $langRaw) {
+                ForEach(Language.allCases) { l in Text(l.endonym).tag(l.rawValue) }
+            }.pickerStyle(.inline)
+        } label: { Image(systemName: "globe") }
     }
 
     // MARK: main split
@@ -537,13 +549,7 @@ struct ContentView: View {
             .help(t.helpTitle())
             .keyboardShortcut("?", modifiers: .command)
         }
-        ToolbarItem {
-            Menu {
-                Picker("", selection: $langRaw) {
-                    ForEach(Language.allCases) { l in Text(l.endonym).tag(l.rawValue) }
-                }.pickerStyle(.inline)
-            } label: { Image(systemName: "globe") }
-        }
+        ToolbarItem { languageMenu }
     }
 
     private func runDelete() async {

app/Sources/SnapsiftApp/L10n.swift

@@ -340,6 +340,14 @@ struct L10n: Sendable {
         case .zhTW: return "確認候選群組 \(i)/\(total)…"
         }
     }
+    /// Shown when oversized dHash-collision clusters were skipped (noise guard).
+    func progSkippedClusters(_ n: Int) -> String {
+        switch language {
+        case .en: return "Skipped \(n) oversized noise clusters"
+        case .ja: return "過大なノイズ群 \(n) 件をスキップ"
+        case .zhTW: return "略過 \(n) 個過大的噪音群"
+        }
+    }
     func progFaces(_ i: Int, _ total: Int) -> String {
         switch language {
         case .en: return "Analysing faces \(i)/\(total)…"

app/Sources/SnapsiftApp/LibraryModel.swift

@@ -57,6 +57,13 @@ final class LibraryModel: ObservableObject {
     /// bursts: median spread 3, p75 6 — so ≤6 captures ~86% of genuine
     /// held-shutter bursts while pose/subject changes (≈12) fall to "you decide".
     var contentConfidentSpread = 6
+    /// Before a frame is *ever* pre-marked for deletion, the cluster must also be
+    /// neurally near-identical, not just dHash-close (dHash can't tell "same
+    /// framing, subject moved" from a true duplicate). A pre-marked deletion needs
+    /// max pairwise feature distance ≤ this; a moved-subject pair (≈0.2+) falls to
+    /// "you decide". Tight on purpose — wrongly deleting a keeper breaks trust,
+    /// while missing a duplicate is harmless.
+    var contentConfidentFeature: Float = 0.10
     @Published var refiningFaces = false
     /// True once a face-refinement pass has re-picked keepers.
     @Published var facesApplied = false
@@ -181,13 +188,27 @@ final class LibraryModel: ObservableObject {
             clustered, asset: { lookup[$0] }, manager: imageManager,
             maxDistance: contentMaxDistance, t: t
         ) { [weak self] msg in Task { @MainActor in self?.progress = msg } }
-        groups = verified.map { vc in
-            let confident = vc.spread <= contentConfidentSpread
+        // Neural gate: a cluster only stays "confident" (→ pre-marks a deletion)
+        // if Apple's feature print agrees it's near-identical. dHash is cheap
+        // recall; this is the precise arbiter that keeps the scan from ever
+        // suggesting you delete a frame that's actually a different moment.
+        var built: [ReviewGroup] = []
+        var n = 0
+        for vc in verified {
+            n += 1
+            if n % 50 == 0 { progress = t.progConfirming(n, verified.count) }
+            var confident = vc.spread <= contentConfidentSpread
+            if confident {
+                let fs = await LookAlikeScanner.featureSpread(
+                    vc.photos.map(\.uuid), asset: { lookup[$0] }, manager: imageManager)
+                confident = (fs != nil && fs! <= contentConfidentFeature)
+            }
             var g = ReviewGroup(photos: vc.photos, keeperID: keeper(vc.photos).uuid)
             g.confidentDupe = confident
             g.keepAll = !confident            // uncertain groups: keep all, pre-mark nothing
-            return g
+            built.append(g)
         }
+        groups = built
     }
 
     /// Build a Core Photo from a PHAsset, enriched with Apple quality + size.

app/Sources/SnapsiftApp/LookAlikeScanner.swift

@@ -23,6 +23,12 @@ enum LookAlikeScanner {
                      featureDistance: Float = 0.15,   // ≈0.0 for a true re-saved
                                                       // copy; 0.15 excludes merely
                                                       // similar shots (cats ≈0.3)
+                     maxCluster: Int = 80,            // a stage-1 dHash cluster
+                                                      // bigger than this is noise
+                                                      // (solid colours, screenshots
+                                                      // all colliding). Confirming
+                                                      // it means thousands of neural
+                                                      // prints + O(n²) — the freeze.
                      progress: @escaping (String) -> Void) async -> [[String]] {
 
         // Stage 1 — dHash all thumbnails (tiny 9×8 requests, fast).
@@ -43,20 +49,33 @@ enum LookAlikeScanner {
         for a in assets { byID[a.localIdentifier] = a }
 
         var confirmed: [[String]] = []
+        var skipped = 0
         var c = 0
         for cand in candidates {
             c += 1
             if c % 25 == 0 { progress(t.progConfirming(c, candidates.count)) }
-            var prints: [(String, VNFeaturePrintObservation)] = []
-            for id in cand {
-                if let a = byID[id], let fp = await featurePrint(a, manager) {
-                    prints.append((id, fp))
+
+            // Oversized dHash clusters are collision noise; confirming them is the
+            // O(n²) + thousands-of-fetches freeze. Skip rather than hang.
+            if cand.count > maxCluster { skipped += 1; continue }
+
+            // Compute the members' neural prints concurrently — one cluster at a
+            // time keeps total in-flight work bounded by the cluster size.
+            let prints: [(String, VNFeaturePrintObservation)] =
+                await withTaskGroup(of: (String, VNFeaturePrintObservation)?.self) { group in
+                    for id in cand {
+                        guard let a = byID[id] else { continue }
+                        group.addTask { (await featurePrint(a, manager)).map { (id, $0) } }
+                    }
+                    var acc: [(String, VNFeaturePrintObservation)] = []
+                    for await r in group { if let r { acc.append(r) } }
+                    return acc
                 }
-            }
             for group in unionByDistance(prints, maxDistance: featureDistance) where group.count >= 2 {
                 confirmed.append(group)
             }
         }
+        if skipped > 0 { progress(t.progSkippedClusters(skipped)) }
         return confirmed
     }
 
@@ -110,6 +129,41 @@ enum LookAlikeScanner {
         return out
     }
 
+    /// Largest pairwise neural feature-print distance among a cluster's frames —
+    /// the precise "how different are these really?" that dHash can't give. Used
+    /// to confirm a dHash-confident burst is genuinely near-identical *before* the
+    /// scan dares pre-mark a frame for deletion. Returns nil if any frame can't be
+    /// read; the caller treats nil as "uncertain — don't pre-mark", same as a
+    /// distance over threshold. "Same framing, subject moved" lands ≈0.2+; a true
+    /// held-shutter duplicate ≈0.0.
+    static func featureSpread(_ uuids: [String],
+                              asset: @escaping (String) -> PHAsset?,
+                              manager: PHCachingImageManager) async -> Float? {
+        let prints: [VNFeaturePrintObservation?] =
+            await withTaskGroup(of: VNFeaturePrintObservation?.self) { group in
+                for id in uuids {
+                    group.addTask {
+                        guard let a = asset(id) else { return nil }
+                        return await featurePrint(a, manager)
+                    }
+                }
+                var acc: [VNFeaturePrintObservation?] = []
+                for await r in group { acc.append(r) }
+                return acc
+            }
+        let fps = prints.compactMap { $0 }
+        guard fps.count == uuids.count else { return nil }   // any unreadable → uncertain
+        var maxD: Float = 0
+        for i in 0..<fps.count {
+            for j in (i + 1)..<fps.count {
+                var d: Float = 0
+                do { try fps[i].computeDistance(&d, to: fps[j]) } catch { continue }
+                maxD = max(maxD, d)
+            }
+        }
+        return maxD
+    }
+
     // MARK: - feature-print union
 
     private static func unionByDistance(_ prints: [(String, VNFeaturePrintObservation)],