docs: retarget Postgres to .179 and refresh next-steps

Update deploy docs off dead .181, refresh FIXES_2026-07-09, and point
.notes/task_list at Gitea issues as source of truth.

.notes/task_list.md

@@ -1,65 +1,29 @@
 # Task List
 
-## High Priority
+> **SoT for current work:** open [Gitea issues](https://git.levkin.ca/ilia/punimtag/issues) and [docs/FIXES_2026-07-09.md](../docs/FIXES_2026-07-09.md).  
+> This file is historical; do not treat unchecked DeepFace items as the active backlog.
 
-### DeepFace Migration
-- [ ] Update requirements.txt with DeepFace dependencies
-- [ ] Modify database schema for DeepFace support
-- [ ] Implement DeepFace face detection
-- [ ] Implement cosine similarity matching
-- [ ] Update GUI for detector selection
-- [ ] Create migration script
-- [ ] Test with demo photos
-- [ ] Update documentation
+## Active (2026-07)
 
-### Bug Fixes
-- [ ] Fix import paths after restructuring
-- [ ] Update all relative imports to absolute imports
-- [ ] Test all GUI panels after restructure
-- [ ] Verify database connections work
+See FIXES doc + Gitea:
 
-## Medium Priority
+- QA: #21 network/SharePoint scan, #26 thumbnails, #30/#31/#33 auto-match
+- Blocked on client: #44 JRCC watermark, #43 tag without account
+- Ops: production Next.js viewer on LXC 9101; DB host `.179`
 
-### Code Quality
-- [ ] Add type hints throughout codebase
-- [ ] Improve error handling consistency
-- [ ] Add logging framework
-- [ ] Increase test coverage
-- [ ] Document all public APIs
-
-### Features
-- [ ] Add batch face identification
-- [ ] Implement face clustering
-- [ ] Add photo timeline view
-- [ ] Implement advanced filters
-- [ ] Add keyboard shortcuts
-
-## Low Priority
+## Historical / backlog ideas
 
 ### Performance
-- [ ] Optimize database queries
-- [ ] Implement result caching
-- [ ] Add lazy loading for large datasets
-- [ ] Profile and optimize slow operations
+- [ ] Pre-generate thumbnails at Process time
+- [ ] Lazy-load face metadata on home page SSR
+- [ ] Run viewer with `next start` (not `next dev`)
 
-### Documentation
-- [ ] Create developer guide
-- [ ] Add API documentation
-- [ ] Create video tutorials
-- [ ] Write troubleshooting guide
+### Features
+- [ ] Guest “suggest name” (#43) after product rules
+- [ ] JRCC watermark swap (#44) when asset arrives
 
-## Completed
-- [x] Restructure project to organized layout
-- [x] Create architecture documentation
-- [x] Unified dashboard interface
-- [x] Auto-matching functionality
-- [x] Tag management system
-- [x] Search and statistics
-
-## Backlog
-- Web interface migration
-- Cloud storage integration
-- Mobile app
-- Video face detection
-- Multi-user support
+## Completed (selected)
 
+- [x] 2026-07-09 open-issue triage (#45/#46/#47 + related) — PRs #51/#52
+- [x] Shared Postgres retarget `.181` → `.179`
+- [x] Grid thumbnail + disk cache

DEPLOYMENT_CHECKLIST.md

@@ -7,8 +7,8 @@ After pulling from Git, configure the following server-specific settings:
 ### Root `.env`
 ```bash
 # Database connections
-DATABASE_URL=postgresql+psycopg2://user:password@10.0.10.181:5432/punimtag
-DATABASE_URL_AUTH=postgresql+psycopg2://user:password@10.0.10.181:5432/punimtag_auth
+DATABASE_URL=postgresql+psycopg2://user:password@10.0.10.179:5432/punimtag
+DATABASE_URL_AUTH=postgresql+psycopg2://user:password@10.0.10.179:5432/punimtag_auth
 
 # JWT Secrets
 SECRET_KEY=your-secret-key-here
@@ -26,8 +26,8 @@ VITE_API_URL=http://10.0.10.121:8000
 
 ### `viewer-frontend/.env`
 ```bash
-DATABASE_URL=postgresql://user:password@10.0.10.181:5432/punimtag
-DATABASE_URL_AUTH=postgresql://user:password@10.0.10.181:5432/punimtag_auth
+DATABASE_URL=postgresql://user:password@10.0.10.179:5432/punimtag
+DATABASE_URL_AUTH=postgresql://user:password@10.0.10.179:5432/punimtag_auth
 NEXTAUTH_URL=http://10.0.10.121:3001
 NEXTAUTH_SECRET=your-secret-key-here
 AUTH_URL=http://10.0.10.121:3001

README.md

@@ -120,7 +120,7 @@ Both database connections are configured via the `.env` file.
 For development, you can use the shared development PostgreSQL server:
 
 **Dev PostgreSQL Server:**
-- **Host**: 10.0.10.181
+- **Host**: 10.0.10.179 (postgresQA / pve201 VM 109; legacy `.181` is dead)
 - **Port**: 5432
 - **User**: ladmin
 - **Password**: [Contact administrator for password]
@@ -133,10 +133,10 @@ For development, you can use the shared development PostgreSQL server:
 Configure your `.env` file for development:
 ```bash
 # Main database (dev)
-DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag
+DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag
 
 # Auth database (dev)
-DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag_auth
+DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag_auth
 ```
 
 **Install PostgreSQL (if not installed):**
@@ -201,10 +201,10 @@ DATABASE_URL_AUTH=postgresql+psycopg2://punimtag:punimtag_password@localhost:543
 **Development Server:**
 ```bash
 # Main database (dev PostgreSQL server)
-DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag
+DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag
 
 # Auth database (dev PostgreSQL server)
-DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag_auth
+DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag_auth
 ```
 
 **Automatic Initialization:**
@@ -822,7 +822,7 @@ The project includes scripts for deploying to the development server.
 - **Password**: [Contact administrator for password]
 
 **Development Database:**
-- **Host**: 10.0.10.181
+- **Host**: 10.0.10.179 (postgresQA / pve201 VM 109; legacy `.181` is dead)
 - **Port**: 5432
 - **User**: ladmin
 - **Password**: [Contact administrator for password]

docs/DEPLOYMENT.md

@@ -37,7 +37,7 @@ This guide covers deployment of PunimTag to development and production environme
 - **Password**: [Contact administrator for password]
 
 **Development Database:**
-- **Host**: 10.0.10.181
+- **Host**: 10.0.10.179 (postgresQA / pve201 VM 109; legacy `.181` is dead)
 - **Port**: 5432
 - **User**: ladmin
 - **Password**: [Contact administrator for password]
@@ -125,8 +125,8 @@ Set the following variables:
 
 ```bash
 # Development Database
-DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag
-DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag_auth
+DATABASE_URL=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag
+DATABASE_URL_AUTH=postgresql+psycopg2://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag_auth
 
 # JWT Secrets (change in production!)
 SECRET_KEY=dev-secret-key-change-in-production
@@ -157,8 +157,8 @@ VITE_API_URL=http://10.0.10.121:8000
 Create `viewer-frontend/.env`:
 
 ```bash
-DATABASE_URL=postgresql://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag
-DATABASE_URL_AUTH=postgresql://ladmin:[PASSWORD]@10.0.10.181:5432/punimtag_auth
+DATABASE_URL=postgresql://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag
+DATABASE_URL_AUTH=postgresql://ladmin:[PASSWORD]@10.0.10.179:5432/punimtag_auth
 NEXTAUTH_URL=http://10.0.10.121:3001
 NEXTAUTH_SECRET=dev-secret-key-change-in-production
 ```
@@ -501,7 +501,7 @@ curl http://localhost:8000/api/v1/health
 redis-cli ping
 
 # PostgreSQL
-psql -h 10.0.10.181 -U ladmin -d punimtag -c "SELECT 1;"
+psql -h 10.0.10.179 -U ladmin -d punimtag -c "SELECT 1;"
 ```
 
 ---

docs/DEPLOY_FROM_SCRATCH.md

@@ -87,7 +87,7 @@ If your PostgreSQL database is on a **separate server** from the application, yo
    ```bash
    listen_addresses = '*'  # Listen on all interfaces
    # OR for specific IP:
-   # listen_addresses = 'localhost,10.0.10.181'  # Replace with your DB server IP
+   # listen_addresses = 'localhost,10.0.10.179'  # Replace with your DB server IP
    ```
 
 3. **Restart PostgreSQL** to apply changes:
@@ -104,10 +104,10 @@ If your PostgreSQL database is on a **separate server** from the application, yo
 
 5. **Test the connection** from the application server:
    ```bash
-   psql -h 10.0.10.181 -U punim_dev_user -d postgres
+   psql -h 10.0.10.179 -U punim_dev_user -d postgres
    ```
    
-   Replace `10.0.10.181` with your database server IP and `punim_dev_user` with your database username.
+   Replace `10.0.10.179` with your database server IP and `punim_dev_user` with your database username.
 
 **Note:** If PostgreSQL is on the same server as the application, you can skip this step and use `localhost` in your connection strings.
 

docs/FIXES_2026-07-09.md

@@ -1,8 +1,7 @@
 # PunimTag fixes — 2026-07-09
 
-Branch: `fix/open-issues-triage` · PR: https://git.levkin.ca/ilia/punimtag/pulls/51  
-Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca  
-(`punimtag.levkin.ca` is **not** live — no DNS.)
+Merged: PR #51 → `dev`, PR #52 → `master` (`eeb0033`).  
+Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 
 ## Infra (homelab)
 
@@ -11,19 +10,20 @@ Dev URLs: https://punimtagdev.levkin.ca · https://punimtagadmindev.levkin.ca
 | Outage | App `.env` pointed at dead Postgres `10.0.10.181` |
 | Fix | Retarget to live `postgresQA` **`10.0.10.179`** (pve201 VM 109) |
 | Hosts | LXC **9101** `punimTagFE-dev` @ `10.0.10.121` |
+| Monitoring | Kuma: PunimTag viewer/admin; Beszel: `punimtag-9101` |
 
-Ansible inventory/docs updated in the ansible repo (`main.yml`, `vault.example.yml`, `host-list.md`).
+Ansible: inventory/docs PRs for `.179` + monitoring (see ansible repo).
 
 ## Ticket fixes (code)
 
 | Issue | Status | Change |
 |-------|--------|--------|
-| **#45** Recursive scan checkbox | Closed | Keep directory handle; re-read files when checkbox toggles (`Scan.tsx`) |
-| **#46** Person search wrong people | Closed | Selected people use exact `person_ids`; free-text `"First Last"` uses AND (`Search.tsx`, `search_service.py`) |
-| **#47** Identify Next/Prev blank image | Closed | Clear loading when crop is already browser-cached (`Identify.tsx`) |
-| **#21** SharePoint/network scan hang | Open (needs QA) | Stop blocking API on full folder walk before enqueue; 2h job timeout (`photos.py`) |
-| **#26** Slow main-page images | Open (needs QA) | Grid requests `?thumbnail=true`; API resizes + **disk-caches** thumbs under `.cache/photo-thumbnails/` |
-| **#30/#31/#33** Auto-match false positives | Open (needs QA) | Re-enable small-face / tiny-reference filters (`face_service.py`) |
+| **#45** Recursive scan checkbox | Closed | Re-read local folder when recursive toggles (`Scan.tsx`) |
+| **#46** Person search wrong people | Closed | Selected people use exact `person_ids` (`Search.tsx`, `search_service.py`) |
+| **#47** Identify Next/Prev blank image | Closed | Clear loading when crop already cached (`Identify.tsx`) |
+| **#21** SharePoint/network scan hang | Open (needs QA) | Non-blocking import enqueue; 2h job timeout (`photos.py`) |
+| **#26** Slow main-page images | Open (needs QA) | Grid `?thumbnail=true` + disk cache under `.cache/photo-thumbnails/` |
+| **#30/#31/#33** Auto-match false positives | Open (needs QA) | Re-enable small-face filters (`face_service.py`) |
 
 ## Still blocked on client
 
@@ -31,21 +31,20 @@ Ansible inventory/docs updated in the ansible repo (`main.yml`, `vault.example.y
 |-------|------|
 | **#44** JRCC watermark | SVG/PNG + placement/opacity |
 | **#43** Tag without account | Product rules (approval, PII, ToS) |
-| **#21** path confirm | Exact SharePoint/network path Noam used + mount status on LXC |
+| **#21** path confirm | Exact SharePoint/network path Noam used |
 
 ## Performance notes (#26)
 
-**Why it felt slow (before deploy):** grid loaded **full-resolution** photos (and watermarked them for guests). Thumbnail resize existed only on the PR branch until deploy.
+Grid thumbs are ~**0.1%** of full image bytes (~13 KB vs ~11 MB). Warm cache ~15 ms server-side.
 
-**What we do now:**
-1. Grid always requests `?thumbnail=true`
-2. Server resizes to max **360px** JPEG (~quality 68)
-3. Writes result to `.cache/photo-thumbnails/` keyed by photo id + mtime (first hit slow, later hits fast)
-4. Long browser cache (`max-age=604800`)
-5. Fewer `priority` images above the fold (4 instead of 9)
+**Further options:** production `next start` (remove Next.js “N” badge); pre-generate thumbs at Process; lazy-load face metadata on home SSR.
 
-**Further options (not done):** pre-generate thumbs at Process time; CDN; reduce SSR face payload on `page.tsx`.
+## Ops follow-ups
+
+1. Run viewer as production (`next build` + `next start`), not `next dev`
+2. Keep `.env` on `.179` after every deploy (`DEPLOYMENT_CHECKLIST.md`)
+3. Client QA on open tickets above
 
 ## Cleanup
 
-Removed unused viewer assets: default Next SVGs, unused `jam-watermark.svg`, `test-image-detection.ts`.
+Removed unused viewer SVGs and `test-image-detection.ts`.