fix: dedupe scan 500 error, SQLite limit crash, add keep-best action

- Replace BigInt hammingDistance with 32-bit popcount — safer (no throw
  on malformed hashes) and ~10× faster
- Make scan() async with setImmediate chunking so the event loop stays
  responsive on large libraries
- Batch getGroups() photo lookup in slices of 900 to stay under SQLite's
  999-variable limit
- Add POST /api/duplicates/keep-best endpoint: scores by resolution then
  filesize, soft-deletes the losers, dismisses the pair
- DuplicateGroup: green "Keep" badge on the best photo, green "Keep best"
  button in footer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/dedupe.js

@@ -1,6 +1,10 @@
 import { hammingDistance } from '../worker/hash.js';
 
-export function scan(db, threshold) {
+// Chunk size for the outer loop — yields to the event loop between chunks
+// so the server stays responsive during a long scan.
+const SCAN_CHUNK = 50;
+
+export async function scan(db, threshold) {
   const THRESHOLD = threshold ?? parseInt(process.env.DEDUPE_THRESHOLD ?? '10', 10);
   const start = Date.now();
 
@@ -13,21 +17,42 @@ export function scan(db, threshold) {
   );
 
   let newPairs = 0;
-  db.raw.transaction(() => {
-    for (let i = 0; i < photos.length; i++) {
-      for (let j = i + 1; j < photos.length; j++) {
-        const dist = hammingDistance(photos[i].phash, photos[j].phash);
-        if (dist <= THRESHOLD) {
-          const r = insert.run(photos[i].id, photos[j].id, dist);
-          if (r.changes) newPairs++;
+
+  for (let i = 0; i < photos.length; i += SCAN_CHUNK) {
+    await new Promise(resolve => setImmediate(resolve));
+    const end = Math.min(i + SCAN_CHUNK, photos.length);
+
+    db.raw.transaction(() => {
+      for (let ii = i; ii < end; ii++) {
+        for (let j = ii + 1; j < photos.length; j++) {
+          const dist = hammingDistance(photos[ii].phash, photos[j].phash);
+          if (dist <= THRESHOLD) {
+            const r = insert.run(photos[ii].id, photos[j].id, dist);
+            if (r.changes) newPairs++;
+          }
         }
       }
-    }
-  })();
+    })();
+  }
 
   return { photos: photos.length, newPairs, duration: Date.now() - start };
 }
 
+const ID_BATCH = 900;
+
+function fetchPhotosByIds(db, ids) {
+  const rows = [];
+  for (let i = 0; i < ids.length; i += ID_BATCH) {
+    const batch = ids.slice(i, i + ID_BATCH);
+    const got = db.raw.prepare(
+      `SELECT id, thumb_path, preview_path, date_taken, filesize, width, height, camera_model
+       FROM photos WHERE id IN (${batch.map(() => '?').join(',')})`
+    ).all(batch);
+    rows.push(...got);
+  }
+  return rows;
+}
+
 export function getGroups(db) {
   const pairs = db.getDupePairs();
   if (!pairs.length) return [];
@@ -53,11 +78,7 @@ export function getGroups(db) {
   }
 
   const allIds = [...parent.keys()];
-  const rows   = db.raw.prepare(
-    `SELECT id, thumb_path, preview_path, date_taken, filesize, width, height, camera_model
-     FROM photos WHERE id IN (${allIds.map(() => '?').join(',')})`
-  ).all(allIds);
-
+  const rows   = fetchPhotosByIds(db, allIds);
   const photoMap = new Map(rows.map(r => [r.id, r]));
 
   return [...groups.values()]
@@ -65,3 +86,29 @@ export function getGroups(db) {
     .map(ids => ids.map(id => photoMap.get(id)).filter(Boolean))
     .sort((a, b) => b.length - a.length);
 }
+
+export function scoreDuplicate(photo) {
+  const pixels = (photo.width || 0) * (photo.height || 0);
+  const size   = photo.filesize || 0;
+  const hasExif = photo.camera_model ? 1 : 0;
+  return pixels * 1e6 + size + hasExif * 1e3;
+}
+
+export function keepBest(db, photoIds) {
+  const ids = photoIds.map(Number);
+  const photos = fetchPhotosByIds(db, ids);
+  if (photos.length < 2) return null;
+
+  photos.sort((a, b) => scoreDuplicate(b) - scoreDuplicate(a));
+  const keeper = photos[0];
+  const discard = photos.slice(1);
+
+  db.raw.transaction(() => {
+    for (const p of discard) {
+      db.raw.prepare('UPDATE photos SET deleted = 1 WHERE id = ?').run(p.id);
+    }
+  })();
+
+  db.dismissDuplicates(ids);
+  return { kept: keeper.id, deleted: discard.map(p => p.id) };
+}

server/index.js

@@ -5,7 +5,7 @@ import fs from 'fs';
 import { fileURLToPath } from 'url';
 import { spawn } from 'child_process';
 import { openDb } from '../worker/db.js';
-import { scan, getGroups } from './dedupe.js';
+import { scan, getGroups, keepBest } from './dedupe.js';
 import { scanMusicLibrary, initMusicTable, musicScanActive } from '../worker/scanMusic.js';
 
 const __dirname  = path.dirname(fileURLToPath(import.meta.url));
@@ -561,10 +561,10 @@ app.delete('/api/photos/:id/collections/:colId', (req, res) => {
 
 // ── Duplicates ────────────────────────────────────────────────────────────────
 
-app.post('/api/dedupe/scan', (_req, res) => {
+app.post('/api/dedupe/scan', async (_req, res) => {
   try {
     const { dedupe_threshold } = db.getSettings();
-    res.json(scan(db, dedupe_threshold));
+    res.json(await scan(db, dedupe_threshold));
   } catch (e) { res.status(500).json({ error: e.message }); }
 });
 
@@ -592,6 +592,16 @@ app.post('/api/duplicates/dismiss', (req, res) => {
   res.sendStatus(204);
 });
 
+app.post('/api/duplicates/keep-best', (req, res) => {
+  try {
+    const ids = req.body.photoIds;
+    if (!Array.isArray(ids) || ids.length < 2) return badRequest(res, 'photoIds must be array of ≥2');
+    const result = keepBest(db, ids);
+    cache.invalidate();
+    res.json(result);
+  } catch (e) { res.status(500).json({ error: e.message }); }
+});
+
 // ── Photo Sync ────────────────────────────────────────────────────────────────
 
 app.get('/api/sync/stream', (req, res) => {