v1.8.1 "Iridescence"

Facet 1.8.1 "Iridescence"

The follow-ups Opalescence left open — most of them found by reviewing its own changes rather than reported from use. The one worth upgrading for: rotating a password now actually revokes the tokens issued under it. Apple Silicon also stops under-selecting, since 1.8.0 taught the richer models to run on Metal but left auto resolving to legacy on every Mac, so the machines most able to use them were the ones that didn't.

Security

• Rotating a password revokes the tokens issued under it. Nothing was invalidated server-side before: after a logout, after "Lock Edition", and even after viewer.edition_password was changed, an existing JWT still performed edition writes for its full 48 hours — the interface offered a revocation that never happened. Tokens now carry a digest of the stored viewer and edition passwords (taken from the hash, never the plaintext): rotating the viewer password ends the session outright, and rotating the edition password drops edition rights while leaving the session intact. Logout remains a client-side token drop — revoking one individual token needs server-side state this design doesn't have — and the code and client now say so plainly instead of implying otherwise.
• One mutex guards scoring_config.json. Two lock families protected the same file — the config writers held one, the password upgrade and the share-secret initialisation another — so interleaved writes could lose one side's update wholesale.

Changed

• The auto VRAM profile is sized from unified memory on Apple Silicon instead of always resolving to legacy. There is no CUDA device-properties query for unified memory, so the absence of a VRAM figure was read as the absence of an accelerator, and a 128 GB Mac got the weakest tier. Thresholds are deliberately conservative — each covers the profile's model weights twice over and leaves 8 GB to macOS and whatever else is running, then rounds up to a memory configuration Apple actually ships:

  Total unified memory	Profile
  ≥ 48 GB	24gb
  ≥ 32 GB	16gb
  ≥ 16 GB	8gb
  below	legacy

  A Mac that swaps is worse than one on a smaller profile. An explicitly configured profile stays authoritative, and no invented VRAM number is fed into the CUDA path.

• PUT /api/config/scoring_contexts/{name} requires both promote and excluded, and answers 404 rather than 400 for a context that doesn't exist. A partial body was applied as a full replacement, so sending only promote silently cleared the exclusions; it's now refused with 422 and the config is left untouched. The shipped client always sent both fields.

Fixed

• The library lock says when it can't do its job across hosts. flock is local to a host on SMB/CIFS, so two machines sharing an SMB-mounted database directory would each believe they hold it. The acquire now detects such a mount and warns once — it doesn't refuse, since the setup works as long as jobs run from one machine at a time — and stays silent on NFS, which gives real cross-host semantics between Linux clients.
• --upgrade-db no longer runs its schema migration unlocked. Step 0 issued ALTER TABLE on photos while holding nothing, so landing inside a recompute's long write transaction failed it and aborted the upgrade before it began.
• Armed retrains are cancelled at shutdown rather than left to fire. The accumulated counter is persisted, so the next rating re-arms one; firing at shutdown would start a multi-minute train that can't finish.

Upgrade notes

• Every existing session is signed out once on upgrade. Tokens issued before this release carry neither password claim and are stale by definition — no fallback accepts them. Expect a second one-off sign-out on the first restart after a plaintext viewer.password is auto-hashed, since the stored value (and therefore the digest) changes.
• Rotating the viewer password also ends active client-proofing sessions, which are minted through the same helper.
• Apple Silicon users on auto will move to a heavier model tier if the machine has 16 GB or more — first scan after upgrading will load larger models than 1.8.0 did. Set vram_profile explicitly to pin the old behaviour. Whether the selected tier fits in practice is derived from the documented per-model estimates, not measured on Apple hardware — reports welcome.
• The Windows library-lock path added in 1.8.0 still has not been exercised on Windows.

Full changelog: https://github.com/ncoevoet/facet/blob/master/CHANGELOG.md