findupe 0.4.0__tar.gz

findupe-0.4.0/.github/workflows/release.yml

@@ -0,0 +1,97 @@
+name: release
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    # skip the tool's own bump commit — avoids re-running on the push it makes
+    if: ${{ !startsWith(github.event.head_commit.message, 'bump:') }}
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.cz.outputs.version }}
+      previous_version: ${{ steps.cz.outputs.previous_version }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0 # commitizen needs full history since the last tag
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # NOT persist-credentials: false here (unlike `build` below) —
+          # commitizen-action's push: true default relies on the credential
+          # actions/checkout leaves in .git/config to push the bump commit + tag.
+
+      - id: cz
+        uses: commitizen-tools/commitizen-action@338bbd841b75aaee6bf5340e1fa12f6ab58ff9ff # 0.27.1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          changelog_increment_filename: _release_notes.md
+
+      - name: Create GitHub Release
+        # commitizen-action always sets `version` (= `cz version --project`,
+        # the static pyproject version) even on a no-bump run, since a
+        # no-increment `cz bump` exits via the action's default no_raise=21.
+        # Comparing against `previous_version` is the real bump signal.
+        if: ${{ steps.cz.outputs.version != steps.cz.outputs.previous_version }}
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        with:
+          tag_name: v${{ steps.cz.outputs.version }}
+          body_path: _release_notes.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Build and publish are separate jobs, and publish gets NO checkout — per
+  # the publish action's own README: separating build from publish means
+  # anything maliciously injected into the build environment can't ride
+  # along into the job that holds PyPI's OIDC trust.
+  build:
+    needs: release
+    if: ${{ needs.release.outputs.version != needs.release.outputs.previous_version }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # only checks out code + builds; no git writes, unlike `release`
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          # commitizen-action already pushed the bump commit + tag to main
+          # inside the `release` job (push: true is its default) — a plain
+          # checkout here would still resolve to the pre-bump commit that
+          # triggered this run, not the bumped pyproject.toml `uv build`
+          # needs to read. Check out the tag the release job just created.
+          ref: v${{ needs.release.outputs.version }}
+          # this job only reads + builds, never pushes — no reason for uv
+          # build or its dependencies to have a retained git credential.
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+
+      - run: uv build
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: [release, build]
+    if: ${{ needs.release.outputs.version != needs.release.outputs.previous_version }}
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/findupe
+    permissions:
+      id-token: write # mandatory for PyPI Trusted Publishing (OIDC); scoped to this job only
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        # Pinned to the commit tagged v1.14.0 (not the release/v1 branch
+        # pointer, which moves) — this job carries Trusted Publishing
+        # authority, so it gets stricter pinning than the rest of this file.
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

findupe-0.4.0/.gitignore

@@ -0,0 +1,11 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+dist/
+*.egg-info/
+.DS_Store
+
+# generated scan output — never committed
+report*.html
+findupe-selection-*.json

findupe-0.4.0/.python-version

@@ -0,0 +1 @@
+3.11

findupe-0.4.0/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+All notable changes to this project are documented here. Versions follow
+[Semantic Versioning](https://semver.org/). New entries are generated
+automatically by [Commitizen](https://commitizen-tools.github.io/commitizen/)
+from [Conventional Commits](https://www.conventionalcommits.org/) on every
+qualifying push to `main` — the heading style below matches what it emits.
+
+## v0.4.0 (2026-07-16)
+
+### BREAKING CHANGE
+
+- the CLI command changes from `dupefinder` to `findupe`,
+and the on-disk data directory moves from `~/.dupefinder/` to
+`~/.findupe/` (auto-migrated in place on first run). Any scripts,
+aliases, or cron jobs invoking `dupefinder` directly, or reading
+`~/.dupefinder/` paths directly instead of through the CLI, need updating.
+
+### Feat
+
+- PyPI-publish CI (OIDC), and APFS clone detection
+- rename project dupefinder -> findupe, honest space labels, PyPI-ready metadata
+
+### Fix
+
+- address PR review findings (Codex + CodeRabbit)
+
+## v0.3.0 (2026-07-13)
+
+### Feat
+
+- persistent scan history, stats totals, and an HTML dashboard
+
+## v0.2.1 (2026-07-12)
+
+### Fix
+
+- fail fast on bad scan roots, surface hash/decode errors loudly
+
+## v0.2.0 (2026-07-11)
+
+### Feat
+
+- split HTML report into images/other categories
+
+## v0.1.0 (2026-07-09)
+
+### Feat
+
+- exact-duplicate detection for any file type via size → 64KB-edge → full BLAKE2b funnel
+- same-photo-across-formats detection (HEIC/JPEG/RAW, re-encodes, resized exports) via orientation-normalized pHash + dHash; keeping `X.CR3` + `X.jpg` side by side is never flagged
+- self-contained offline HTML review report: side-by-side thumbnails, per-keeper pre-checked candidates, live reclaim counter, one-click selection export
+- review-first `apply` to the real macOS Trash (all volumes), typed confirmation, full re-verification at apply time, last-copy-per-partition protection
+- `undo` restores from an atomically-written manifest, immune to Finder's collision renames
+- companions (Live Photo `.MOV`, `.XMP`/`.AAE` sidecars) ride along with their primary on trash and undo
+- safety guards: Photos/Lightroom denylist, iCloud/Dropbox stub handling (`--materialize`), hardlink/symlink/zero-byte exclusion, burst/low-entropy flagging, cloud-sync badges
+- persistent SQLite hash cache; re-scans only hash new/changed files
+- validated end-to-end against a real 6,177-photo library; two rounds of real-data tuning plus a 20-agent adversarial code review (12 defects found and fixed) drove false positives to zero

findupe-0.4.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jyshnkr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

findupe-0.4.0/PKG-INFO

@@ -0,0 +1,168 @@
+Metadata-Version: 2.4
+Name: findupe
+Version: 0.4.0
+Summary: Safe duplicate finder & reviewer for macOS — exact + perceptual image matching, review-first deletion to Trash
+Project-URL: Homepage, https://github.com/jyshnkr/findupe
+Project-URL: Repository, https://github.com/jyshnkr/findupe
+Project-URL: Changelog, https://github.com/jyshnkr/findupe/blob/main/CHANGELOG.md
+Author-email: JayaShankar Mangina <jyshnkr.ai@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,deduplication,duplicates,images,macos,perceptual-hash,photos
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: End Users/Desktop
+Classifier: Operating System :: MacOS :: MacOS X
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Multimedia :: Graphics
+Classifier: Topic :: Utilities
+Requires-Python: >=3.11
+Requires-Dist: imagehash>=4.3.2
+Requires-Dist: pillow-heif>=1.4
+Requires-Dist: pillow>=12.0
+Requires-Dist: pybktree>=1.1
+Requires-Dist: rawpy>=0.27
+Description-Content-Type: text/markdown
+
+# findupe
+
+Safe duplicate finder & reviewer for macOS. Finds **exact duplicates** (any file type,
+zero false positives) and **same-photo-different-format duplicates** (HEIC / JPEG / RAW,
+re-encodes, resized exports), then lets *you* review everything visually in an HTML
+report before anything moves — to the real macOS **Trash**, never deleted outright.
+
+Built for photographers: keeping `X.CR3` + `X.jpg` side by side is intentional and is
+**never** flagged. Only surplus copies *within* a format (`X copy.jpg`, `X_2.jpg`,
+a re-imported CR3) become deletion candidates.
+
+## Workflow
+
+`scan` writes two reports — one for images (exact + perceptual matching), one
+for everything else (PDFs, text, archives, ... — exact-hash matches only,
+since perceptual matching never applies to non-images). Review and apply each
+independently.
+
+```
+1. uv run findupe scan ~/Pictures/inbox "/Volumes/Extreme SSD/photos"
+2. open report-images.html   # photo/image duplicates — thumbnails, adjust checkboxes
+   open report-other.html    # everything else — plain checkbox + path + size rows
+3.                           # click "Export selection" on each ->
+                              #   findupe-selection-<id>-images.json
+                              #   findupe-selection-<id>-other.json
+4. uv run findupe apply findupe-selection-<id>-images.json --dry-run   # preview
+   uv run findupe apply findupe-selection-<id>-other.json  --dry-run   # preview
+5. uv run findupe apply findupe-selection-<id>-images.json            # typed confirmation
+   uv run findupe apply findupe-selection-<id>-other.json             # typed confirmation
+6. uv run findupe undo                                             # list restore points
+   uv run findupe undo <manifest>                                  # put everything back
+```
+
+## How it decides two files are "the same"
+
+| Tier | Test | Shown as |
+|---|---|---|
+| Exact | size → 64KB-edges hash → full **BLAKE2b** | Exact duplicates (pre-checked per keeper rule) |
+| Strong visual | **pHash ≤ 2 AND dHash ≤ 2** after EXIF-orientation normalization | Same image, multiple versions |
+| Possible | pHash 3–8 | Review-only — no checkboxes, the tool will not touch these |
+
+Thresholds were calibrated on real files: a HEIC→JPEG export measures distance **0**
+(even resized); different photos measure ≥ 28. Burst frames are the treacherous case —
+static-scene frames shot in the same second can hash **identically** — so three extra
+guards demote them to review-only, verified against a real 6,177-photo library:
+
+- capture metadata (time + exposure) must match for any strong match to form;
+- **SubSecTimeOriginal** must match too — it differs between burst frames shot within
+  the same second (`'75'` vs `'97'` on consecutive EOS R6 II frames);
+- **RAW↔RAW pairs are never perceptually strong.** Every real-world RAW duplicate is a
+  byte-identical copy (nobody re-encodes a CR3), so RAW deletion candidates come only
+  from the exact tier — burst frames whose previews collide land in review-only.
+
+RAW files are fingerprinted via their embedded JPEG preview (rawpy; exiftool fallback).
+And "surplus" is computed only within *directly-matched* same-format clusters — a file
+that merely shares a family through a chain of cross-format links renders as an
+informational "sibling", never as a deletion candidate.
+
+## Safety model
+
+- **`scan` has no delete authority.** Deletion happens only through `apply`, which takes
+  the selection file you exported from the report after human review.
+- **Everything is re-verified at apply time** — every keeper and every candidate is
+  re-checked (existence, size, full BLAKE2b). A file that changed since the scan is
+  skipped; a keeper that changed rejects its whole partition; a selection that lists a
+  keeper for deletion is rejected outright.
+- **The last copy always survives**: at most `n-1` files of a (family, format) partition
+  can be trashed, enforced independently of the report UI.
+- **Real Trash, all volumes**: batched Finder AppleScript, so "Put Back" works — external
+  drives use their own `.Trashes` (pre-flight checked; a volume without a working Trash is
+  refused, never silently permanent-deleted).
+- **Undo manifest written before anything moves** (atomic write), and `undo` re-locates
+  files in the Trash by size + hash — immune to Finder's collision renames.
+- **Never touched at all**: hardlinks (deleting one reclaims nothing — informational),
+  Photos/Lightroom library internals (hard denylist), symlinks, iCloud dataless stubs
+  (skipped and listed; `--materialize` downloads them on purpose), zero-byte files.
+- **Companions ride along**: Live Photo `.MOV`s and `XMP`/`AAE` sidecars are trashed with
+  their primary and restored with it on undo.
+- **Flagged families are never pre-checked**: >3 visually-matched same-format files
+  ("possible-burst") or near-uniform images ("low-entropy") require deliberate clicks.
+- Files in iCloud/Dropbox-synced folders carry a ☁ badge — deleting them propagates to
+  your other devices.
+- **APFS clones are detected where possible** (`⧉ clone — 0 B freed` badge, via physical
+  extent comparison — `F_LOG2PHYS_EXT`) and excluded from the reclaimable total, since
+  trashing one frees nothing while its keeper survives. Detection isn't foolproof (some
+  volumes/setups can't be probed, and only clone-of-keeper is checked, not
+  clone-of-another-candidate) — an undetected clone still reclaims no space when
+  trashed, same as before this existed (the report footer explains this too).
+
+## Install
+
+Requires macOS.
+
+```sh
+pipx install findupe
+# or
+uv tool install findupe
+```
+
+Then `findupe --help`. Running on a non-macOS platform refuses immediately with a
+clear error — the Trash integration (Finder/AppleScript) and clone-detection notes
+are macOS/APFS-specific.
+
+## Dev setup
+
+Requires macOS + [uv](https://docs.astral.sh/uv/). Python 3.11+ and all dependencies
+(Pillow, pillow-heif, imagehash, rawpy, pybktree) are resolved automatically.
+
+```sh
+uv sync
+uv run pytest          # 145 tests
+uv run findupe --help
+```
+
+First `apply` may trigger a one-time macOS permission prompt ("Terminal wants to control
+Finder") — that's the Trash integration. If you deny it, apply aborts safely.
+
+All state lives under `~/.findupe/`: the hash cache (`index.db`, re-scans only hash
+new/changed files), scan history (`scans/`), and undo manifests (`undo/`).
+`findupe cache clear` resets the hash cache only. If you have an existing
+`~/.dupefinder/` from before the `findupe` rename, it's moved into place
+automatically, once, the first time you run any command that doesn't override
+`--db`/`--undo-dir`/`--scans-dir`.
+
+## Commit conventions & releases
+
+Commits to `main` follow [Conventional Commits](https://www.conventionalcommits.org/):
+`feat:` for user-facing additions, `fix:` for bug fixes, `chore:`/`docs:`/`test:`
+for everything with no release impact. A qualifying push is picked up automatically by
+[Commitizen](https://commitizen-tools.github.io/commitizen/) — it computes the next
+[semantic version](https://semver.org/) (`feat` → minor, `fix`/`perf`/`refactor` → patch,
+`feat!`/`BREAKING CHANGE` → major), updates `CHANGELOG.md`, tags the release, and a GitHub
+Action turns that tag into a [GitHub Release](https://github.com/jyshnkr/findupe/releases)
+with no manual step. See `.github/workflows/release.yml`.
+
+## Deliberately out of scope (v1)
+
+Scanning inside Photos/Lightroom libraries · OCR screenshot discrimination · config
+file · GUI · scheduling. (APFS clone detection shipped — see Safety model above.) See
+`docs/superpowers/specs/2026-07-09-dupefinder-design.md` for the full original design +
+rationale (written before the project was renamed from `dupefinder` to `findupe`, and
+before clone detection existed).

findupe-0.4.0/README.md

@@ -0,0 +1,142 @@
+# findupe
+
+Safe duplicate finder & reviewer for macOS. Finds **exact duplicates** (any file type,
+zero false positives) and **same-photo-different-format duplicates** (HEIC / JPEG / RAW,
+re-encodes, resized exports), then lets *you* review everything visually in an HTML
+report before anything moves — to the real macOS **Trash**, never deleted outright.
+
+Built for photographers: keeping `X.CR3` + `X.jpg` side by side is intentional and is
+**never** flagged. Only surplus copies *within* a format (`X copy.jpg`, `X_2.jpg`,
+a re-imported CR3) become deletion candidates.
+
+## Workflow
+
+`scan` writes two reports — one for images (exact + perceptual matching), one
+for everything else (PDFs, text, archives, ... — exact-hash matches only,
+since perceptual matching never applies to non-images). Review and apply each
+independently.
+
+```
+1. uv run findupe scan ~/Pictures/inbox "/Volumes/Extreme SSD/photos"
+2. open report-images.html   # photo/image duplicates — thumbnails, adjust checkboxes
+   open report-other.html    # everything else — plain checkbox + path + size rows
+3.                           # click "Export selection" on each ->
+                              #   findupe-selection-<id>-images.json
+                              #   findupe-selection-<id>-other.json
+4. uv run findupe apply findupe-selection-<id>-images.json --dry-run   # preview
+   uv run findupe apply findupe-selection-<id>-other.json  --dry-run   # preview
+5. uv run findupe apply findupe-selection-<id>-images.json            # typed confirmation
+   uv run findupe apply findupe-selection-<id>-other.json             # typed confirmation
+6. uv run findupe undo                                             # list restore points
+   uv run findupe undo <manifest>                                  # put everything back
+```
+
+## How it decides two files are "the same"
+
+| Tier | Test | Shown as |
+|---|---|---|
+| Exact | size → 64KB-edges hash → full **BLAKE2b** | Exact duplicates (pre-checked per keeper rule) |
+| Strong visual | **pHash ≤ 2 AND dHash ≤ 2** after EXIF-orientation normalization | Same image, multiple versions |
+| Possible | pHash 3–8 | Review-only — no checkboxes, the tool will not touch these |
+
+Thresholds were calibrated on real files: a HEIC→JPEG export measures distance **0**
+(even resized); different photos measure ≥ 28. Burst frames are the treacherous case —
+static-scene frames shot in the same second can hash **identically** — so three extra
+guards demote them to review-only, verified against a real 6,177-photo library:
+
+- capture metadata (time + exposure) must match for any strong match to form;
+- **SubSecTimeOriginal** must match too — it differs between burst frames shot within
+  the same second (`'75'` vs `'97'` on consecutive EOS R6 II frames);
+- **RAW↔RAW pairs are never perceptually strong.** Every real-world RAW duplicate is a
+  byte-identical copy (nobody re-encodes a CR3), so RAW deletion candidates come only
+  from the exact tier — burst frames whose previews collide land in review-only.
+
+RAW files are fingerprinted via their embedded JPEG preview (rawpy; exiftool fallback).
+And "surplus" is computed only within *directly-matched* same-format clusters — a file
+that merely shares a family through a chain of cross-format links renders as an
+informational "sibling", never as a deletion candidate.
+
+## Safety model
+
+- **`scan` has no delete authority.** Deletion happens only through `apply`, which takes
+  the selection file you exported from the report after human review.
+- **Everything is re-verified at apply time** — every keeper and every candidate is
+  re-checked (existence, size, full BLAKE2b). A file that changed since the scan is
+  skipped; a keeper that changed rejects its whole partition; a selection that lists a
+  keeper for deletion is rejected outright.
+- **The last copy always survives**: at most `n-1` files of a (family, format) partition
+  can be trashed, enforced independently of the report UI.
+- **Real Trash, all volumes**: batched Finder AppleScript, so "Put Back" works — external
+  drives use their own `.Trashes` (pre-flight checked; a volume without a working Trash is
+  refused, never silently permanent-deleted).
+- **Undo manifest written before anything moves** (atomic write), and `undo` re-locates
+  files in the Trash by size + hash — immune to Finder's collision renames.
+- **Never touched at all**: hardlinks (deleting one reclaims nothing — informational),
+  Photos/Lightroom library internals (hard denylist), symlinks, iCloud dataless stubs
+  (skipped and listed; `--materialize` downloads them on purpose), zero-byte files.
+- **Companions ride along**: Live Photo `.MOV`s and `XMP`/`AAE` sidecars are trashed with
+  their primary and restored with it on undo.
+- **Flagged families are never pre-checked**: >3 visually-matched same-format files
+  ("possible-burst") or near-uniform images ("low-entropy") require deliberate clicks.
+- Files in iCloud/Dropbox-synced folders carry a ☁ badge — deleting them propagates to
+  your other devices.
+- **APFS clones are detected where possible** (`⧉ clone — 0 B freed` badge, via physical
+  extent comparison — `F_LOG2PHYS_EXT`) and excluded from the reclaimable total, since
+  trashing one frees nothing while its keeper survives. Detection isn't foolproof (some
+  volumes/setups can't be probed, and only clone-of-keeper is checked, not
+  clone-of-another-candidate) — an undetected clone still reclaims no space when
+  trashed, same as before this existed (the report footer explains this too).
+
+## Install
+
+Requires macOS.
+
+```sh
+pipx install findupe
+# or
+uv tool install findupe
+```
+
+Then `findupe --help`. Running on a non-macOS platform refuses immediately with a
+clear error — the Trash integration (Finder/AppleScript) and clone-detection notes
+are macOS/APFS-specific.
+
+## Dev setup
+
+Requires macOS + [uv](https://docs.astral.sh/uv/). Python 3.11+ and all dependencies
+(Pillow, pillow-heif, imagehash, rawpy, pybktree) are resolved automatically.
+
+```sh
+uv sync
+uv run pytest          # 145 tests
+uv run findupe --help
+```
+
+First `apply` may trigger a one-time macOS permission prompt ("Terminal wants to control
+Finder") — that's the Trash integration. If you deny it, apply aborts safely.
+
+All state lives under `~/.findupe/`: the hash cache (`index.db`, re-scans only hash
+new/changed files), scan history (`scans/`), and undo manifests (`undo/`).
+`findupe cache clear` resets the hash cache only. If you have an existing
+`~/.dupefinder/` from before the `findupe` rename, it's moved into place
+automatically, once, the first time you run any command that doesn't override
+`--db`/`--undo-dir`/`--scans-dir`.
+
+## Commit conventions & releases
+
+Commits to `main` follow [Conventional Commits](https://www.conventionalcommits.org/):
+`feat:` for user-facing additions, `fix:` for bug fixes, `chore:`/`docs:`/`test:`
+for everything with no release impact. A qualifying push is picked up automatically by
+[Commitizen](https://commitizen-tools.github.io/commitizen/) — it computes the next
+[semantic version](https://semver.org/) (`feat` → minor, `fix`/`perf`/`refactor` → patch,
+`feat!`/`BREAKING CHANGE` → major), updates `CHANGELOG.md`, tags the release, and a GitHub
+Action turns that tag into a [GitHub Release](https://github.com/jyshnkr/findupe/releases)
+with no manual step. See `.github/workflows/release.yml`.
+
+## Deliberately out of scope (v1)
+
+Scanning inside Photos/Lightroom libraries · OCR screenshot discrimination · config
+file · GUI · scheduling. (APFS clone detection shipped — see Safety model above.) See
+`docs/superpowers/specs/2026-07-09-dupefinder-design.md` for the full original design +
+rationale (written before the project was renamed from `dupefinder` to `findupe`, and
+before clone detection existed).