diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..1690e17
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,45 @@
+name: Bug report
+description: Something does not work as described in the documentation
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting! Remove camera addresses and passwords from anything you paste.
+  - type: input
+    id: version
+    attributes:
+      label: VisionState version
+      description: Settings → Apps → VisionState (or VisionState (beta))
+      placeholder: "0.8.0"
+    validations:
+      required: true
+  - type: dropdown
+    id: kind
+    attributes:
+      label: Sensor kind
+      options:
+        - State sensor
+        - Object sensor
+        - Reading sensor
+        - Not about one sensor
+    validations:
+      required: true
+  - type: input
+    id: system
+    attributes:
+      label: Home Assistant version and hardware
+      placeholder: "2026.10.0, Raspberry Pi 4 / Intel NUC / Proxmox VM"
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened, and what did you expect?
+      description: Steps to see it again help a lot. A screenshot is welcome.
+    validations:
+      required: true
+  - type: textarea
+    id: log
+    attributes:
+      label: Log
+      description: The app's Log tab, around the time it happened.
+      render: text
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..3f91377
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Questions, ideas and shared meter readings
+    url: https://github.com/oleost/VisionState/discussions
+    about: Ask, suggest a feature, or share an export of readings (Quality tab → Export readings) to help improve reading.
+  - name: Security vulnerability
+    url: https://github.com/oleost/VisionState/security/advisories/new
+    about: Report it privately, not as an issue.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa68409..9c8ae1d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,12 +25,12 @@ jobs:
           cache: pip
           cache-dependency-path: visionstate/backend/requirements*.txt
       - run: pip install -r requirements-dev.txt
-      - name: Cache AI model
+      - name: Cache AI models (all of them, for tests/test_models.py)
         uses: actions/cache@v6
         with:
           path: visionstate/backend/models
-          key: models-${{ hashFiles('visionstate/backend/visionstate/backbones.json', 'visionstate/backend/visionstate/detectors.json', 'visionstate/backend/visionstate/readers.json') }}
-      - run: python -m visionstate.backbones models
+          key: models-all-${{ hashFiles('visionstate/backend/visionstate/backbones.json', 'visionstate/backend/visionstate/detectors.json', 'visionstate/backend/visionstate/readers.json') }}
+      - run: python -m visionstate.backbones models --all
       - run: ruff check visionstate tests
       - run: ruff format --check visionstate tests
       - name: Types (pyright)
diff --git a/CLAUDE.md b/CLAUDE.md
index 66ca9fe..2b599ce 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -3,13 +3,41 @@
 VisionState — a Home Assistant app that turns camera images into sensors, all locally:
 **states** the user teaches it (garage door open/closed; embedding model + small per-sensor
 classifier), **objects** found by a pretrained detector (people, cars, animals) and **readings**
-(a number on a display, OCR). This file is the contributor guide for people and AI assistants.
+(a number on a display or the wheels of a meter). This file is the contributor guide for people
+and AI assistants.
 
-- **Source of truth for scope and design decisions:** [`docs/SCOPE.md`](docs/SCOPE.md).
-  Update it when a decision changes.
-- **Language:** everything in the repository (code, comments, UI text, docs, commit
-  messages, this file) is written in English.
-- Public repository `github.com/oleost/VisionState`, Apache-2.0. Pull requests go to `beta`.
+- **Language:** everything in the repository (code, comments, UI text, docs, commit messages) is
+  written in English.
+- Public repository `github.com/oleost/VisionState`, Apache-2.0, owned by its maintainer (oleost).
+  The maintainer (and Claude working for them) commits straight to `beta`; everyone else opens a
+  pull request against `beta`. Branches and releases: [`docs/RELEASING.md`](docs/RELEASING.md).
+
+## Where things are written down
+
+Every fact has **one** home; other files link to it instead of repeating it.
+
+| What | Home |
+|---|---|
+| What the app does for a user, how to use it, the defaults a user sees | [`visionstate/DOCS.md`](visionstate/DOCS.md) (the app's *Documentation* tab) |
+| The pitch, install, screenshots | [`README.md`](README.md) (and the short store text `visionstate/README.md`) |
+| Design decisions and why, non-goals, roadmap, open ideas | [`docs/SCOPE.md`](docs/SCOPE.md) |
+| Where the code is, how a check flows, data on disk, recipes for common changes | [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) |
+| Values of defaults, limits and tunables | `settings.py` and the model registries — docs name the setting, not its value (DOCS.md may state what the user sees) |
+| Branches, channels, CI, release steps | [`docs/RELEASING.md`](docs/RELEASING.md) |
+| How to work: principles, checks, testing, pitfalls | this file |
+| The wheel reader model: data, licences, results, how to train it | [`tools/wheelreader/README.md`](tools/wheelreader/README.md) |
+| The plan for better counter readings, and its status | [`docs/WHEEL_READER_PLAN.md`](docs/WHEEL_READER_PLAN.md) |
+| Face recognition: models, licences, privacy, the plan and the decisions made building it | [`docs/FACE_RECOGNITION_PLAN.md`](docs/FACE_RECOGNITION_PLAN.md) |
+| What changed in a version | `visionstate/CHANGELOG.md` (written at release, never edited afterwards) |
+| Test image sources | `visionstate/backend/tests/assets/README.md` |
+
+- Update the home of a fact **in the same change** as the code; a change that makes a doc wrong is
+  not finished.
+- No "as of version X" or "currently vN" status lines outside the CHANGELOG and the roadmap: they go
+  stale. Say what is, and let git say when.
+- `tests/test_docs.py` (backend, runs in CI) checks every Markdown link, every repository path and
+  every `module.name` / `settings.X["key"]` in backticks against the code — a rename that leaves a
+  doc behind fails the tests.
 
 ## Principles (do not break these)
 
@@ -19,205 +47,130 @@ classifier), **objects** found by a pretrained detector (people, cars, animals)
 - **Camera credentials never leak:** `redact.py` masks them in logs, errors and exports.
 - **No hard-coded defaults** outside `settings.py` / the registries; the UI reads them from
   `GET /api/v1/config`.
-- Home Assistant state values stay lower-case keys (`open`, `car_parked`).
+- Home Assistant state values stay lower-case keys (`open`, `car_parked`); unique IDs and topics
+  never change once released.
 - Marketing text (README, release notes) promotes VisionState on its own merits — no comparisons
   with other products.
 
-## Layout and conventions
-
-- `visionstate/` is the Home Assistant app (build context of the Dockerfile).
-  - `backend/visionstate/settings.py` holds every backend default/tunable; import from there.
-  - **Map of the code: [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md)** — what runs where, how a
-    check flows, which files a common change touches. Keep it current when the structure changes.
-  - `backend/visionstate/engine/` is the runtime: `Runtime` (`runtime.py`) is put together from one
-    mixin per part (`models`, `checks`, `objects`, `reading`, `teaching`, `training`, `publishing`,
-    `history`, `reminders`) on `RuntimeBase` (`base.py`, the shared state); a part inherits the parts it uses.
-    `state.py` holds `SensorConfig`/`LiveState`, `logic.py` the pure decisions. New engine code goes
-    into the part it belongs to; a long-running loop must survive any exception (log it once, try
-    again) — only `CancelledError` may end it.
-  - `backend/visionstate/backbones.json` (state sensors), `detectors.json` (object sensors) and
-    `readers.json` (reading sensors; also the wheel readers for mechanical counters, trained with
-    `tools/wheelreader` — see its README) are the model registries. Entries are never changed or
-    removed once released (a new model gets a new id); `python -m visionstate.backbones <dir>`
-    downloads every bundled model of all three.
-  - Sensor kinds (`settings.SENSOR_KINDS`): `single_state`, `objects` and `reading`; the UI's tabs per kind
-    are in `ui.ts` (`TABS_BY_KIND`). New features must say which kind(s) they apply to.
-  - The History page and every sensor's History tab are one view (`lib/components/history/`,
-    a row component per kind); its filter is in the page URL (`lib/history.ts`). On the server
-    `api/history.py` turns every filter into SQL in one place (`history_query`); a new filter
-    goes there, a new event into `settings.HISTORY_EVENTS` + `EVENT_ROWS` + `ui.ts HISTORY_EVENTS`.
-  - Object sensors can be taught (`teach.py`, `api/teach.py`, `settings.TEACH`): taught boxes are
-    `sample` rows with `object_label`; own labels live in `objects["custom"]`. The detector is never
-    retrained; DINOv2 (always loaded) compares boxes with the taught ones.
-  - `frontend/src/lib/tokens.css` holds all colours/type/spacing; `ui.ts` holds UI constants;
-    `api.ts` is the only place that builds API URLs; `router.svelte.ts` defines app paths.
-  - The UI reads sensor defaults, limits and palette from `GET /api/v1/config`.
-- Backend checks: `cd visionstate/backend && .venv/Scripts/python -m pytest -q && .venv/Scripts/ruff check visionstate tests && .venv/Scripts/ruff format visionstate tests`
-  (tests need the model: `python -m visionstate.backbones models`), and the types:
-  `.venv/Scripts/pyright --pythonpath .venv/Scripts/python.exe` (0 errors; CI runs it). CI measures
-  coverage and fails below 88 %; add `--cov=visionstate --cov-report=term-missing:skip-covered` to see
-  what is not tested.
-- Frontend checks: `cd visionstate/frontend && npm run check && npm run build`.
-- **UI testing routine** (every UI change, before a beta release) — many users run Home Assistant
-  on phones/tablets:
-  - Automated: `cd visionstate/frontend && npm run build && VS_PYTHON=../backend/.venv/Scripts/python npm run e2e`
-    (Playwright, `e2e/`; also runs in CI; once: `npx playwright install chromium webkit`). It starts the backend + `scripts/fake_camera.py`,
-    seeds one sensor of each kind (a trained state sensor, an object sensor on a real photo and
-    reading sensors on a drawn display and a drawn mechanical counter), and runs every page on **desktop** (1440×900, mouse),
-    **mobile** (Pixel 7, real touch via CDP) and **iphone** (iPhone 14, WebKit like the Home Assistant
-    app on iOS; gestures with the mouse): no console errors, no sideways scrolling, no text
-    running out of buttons or cards, plus the wizard (all three kinds), region editor gestures,
-    labelling, review, boxes, teaching an object sensor and readings. Add a test
-    for every new page or gesture.
-  - Look at the full-page screenshots in `test-results/pages/{desktop,mobile,iphone}/` after UI changes,
-    for every page in all three projects.
-  - Then try the change by hand in a real browser (Claude: the Chrome tools) — passing tests are not
-    enough: start `scripts/fake_camera.py 8198` and the backend (`VISIONSTATE_PORT`, `_DATA`, `_MEDIA`,
-    `_FRONTEND=frontend/dist`, `_BUNDLED_MODELS` as in `playwright.config.ts`; a copy of the last e2e
-    run's `data` and `media` folders gives seeded sensors), use the changed screens at desktop width
-    and at ~390 px, and check the console. Reload after a rebuild (a hash-only navigation keeps the old page).
-    A Chrome window does not get narrower than 500 px (and a maximised one not at all): for a real
-    phone width, open any same-origin URL (e.g. `/api/v1/status`) and replace the page with
-    `<iframe src="/#/…" style="width:390px;height:844px">` — media queries then see 390 px.
-  - Handy while working (add `VS_PYTHON=…` as above): only the phone `npx playwright test
-    --project=mobile`; one test `npx playwright test -g "reading sensor"`; watch it in a browser
-    `--headed` or step through it with `--ui`; after a failure `npx playwright show-trace
-    test-results/<test>/trace.zip` shows every step with DOM snapshots.
-  - Never rely on Ctrl/Shift/hover-only interactions; hide keyboard hints with `.kbd-only`.
-
-## Testing and verifying locally
-
-- **Run the app against a fake camera** (no Home Assistant needed):
-  `python scripts/fake_camera.py 8765`, then start the backend (see README → Run it locally) and
-  use `http://127.0.0.1:8765/…` as an *HTTP snapshot URL*. The camera serves `/snapshot.jpg`
-  (synthetic garage door; `/set?state=open|closed|partial`, `/set?night=1`), `/photo/<name>.jpg`
-  (real CC0 photos from `backend/tests/assets`, for object sensors) and
-  `/display.jpg?text=12:05&style=lcd|led` (a drawn seven-segment display, for reading sensors)
-  and `/counter.jpg?value=89939.5&digits=7&decimals=3` (a drawn mechanical counter with rolling
-  digit wheels; `.5` = the last wheel half way to the next digit).
-- **Check the Home Assistant side** with any local MQTT broker (e.g. Mosquitto on 1883) and
-  `VISIONSTATE_MQTT_HOST=127.0.0.1`: the discovery configs appear under `homeassistant/…` and
-  values under `visionstate/<slug>/…`. The CI smoke test does the same against the built image.
-- **Test pitfalls found the hard way** (keep tests stable):
-  - The UI polls frames and status, so the network never goes idle — wait for elements or for
-    `img.complete`, never for `networkidle`.
-  - History rows and retrains happen *after* a value or state is published.
-    Never read them right after; poll with `wait_for` / `expect.poll`. A sensor reports `ok` with
-    its first model — wait for `model.n_samples` when a test needs the model trained on all labels.
-  - Touch in Playwright goes through CDP (`e2e/helpers.ts`): a fast release starts a fling that
-    swallows the next tap, so drags rest briefly before lifting. Full-page screenshots drop touch
-    emulation — assert touch-only CSS in the test, not from a screenshot.
-  - A change that makes text longer while something reloads can shift the page on phones and make
-    a tap land elsewhere; keep the last result on screen while re-testing.
-  - A Svelte `$effect` tracks every state read until the first `await` of any function it calls.
-    If that function later sets what it read, the effect restarts it on every answer — the live
-    frames polled the camera dozens of times a second from 0.1.0 until 0.6.5. Call such functions
-    with `untrack`, name the real dependencies with `void x`, and give a polling loop a counter so
-    a restart ends the old loop (a request still on its way would otherwise start a second one).
-    The e2e test "no page asks the server more often than it polls" counts requests per page.
-  - The Chrome tab Claude drives counts as hidden (`document.visibilityState`); views that only
-    poll while visible look fine there. Use `setVisibility` (e2e) or override it by hand.
-- **Models:** registries pin a Hugging Face revision and SHA-256. Every model file is checked
-  against real inputs in tests (`test_objects.py`, `test_reading.py`) — one public ONNX conversion
-  turned out to be broken and only a test with real photos showed it. Test images must be CC0 /
-  public domain (list sources in `tests/assets/README.md`) or drawn by our own code
-  (`tests/displays.py`).
-- **Local experiment data** lives in `/VisionStateLocal/` (ignored by git, outside the Docker build
-  context): images with other licences may be used there for trying things out, never in the
-  repository, the tests or a shipped model. Its `README.md` lists each source and licence.
-- **Windows development:** create the venv inside the project (`visionstate/backend/.venv`; long
-  paths break pip elsewhere), and set `PYTHONUTF8=1` for scripts that read or write source files.
-  The app itself handles the Windows event loop (`__main__.py`).
-- **Docs screenshots** (`docs/promo/`): Playwright at 1440 px wide with device scale 1.2 (1728 px
-  images), against the fake camera and CC0 photos, with a local MQTT broker so the header shows
-  *MQTT connected*. Keep images in one row the same height, and show the user before publishing.
-
-## Branches, channels and releases
-
-- **Branches and channels — never commit to `main` directly.**
-  - `beta` is the working branch: every change lands here first (directly or via PR to `beta`).
-    Its `visionstate/config.yaml` is the beta channel ("VisionState (beta)", versions `X.Y.ZbN`,
-    own media folder). Home Assistant users get it via `https://github.com/oleost/VisionState#beta`.
-  - `main` is the stable channel and only changes by promoting a tested beta (PR from a
-    `promote/X.Y.Z` branch). `main` is branch-protected.
-  - `scripts/channel.py` is the only way to change name/version/channel fields in config.yaml.
-  - Home Assistant pulls prebuilt images (`image:` in config.yaml), so a version must never reach a
-    branch before its images exist. CI refuses tags that do not match config.yaml and branches that
-    carry the wrong channel.
-- **A beta tag is the CI run.** Run the local checks first (backend, frontend, e2e, hands-on in
-  a browser), then push the tag: its CI tests, builds both images on native runners, and — for
-  beta tags — creates the pre-release and fast-forwards `beta`. If it fails, nothing was
-  published: delete the tag (`git push origin :refs/tags/vX.Y.ZbN`, `git tag -d …`), fix, and tag
-  the same version again. For a stable release, or when unsure, run CI first on a temporary
-  branch with a draft PR against `beta` and close it afterwards.
-- Documentation-only changes (README, DOCS.md, CLAUDE.md, images) may go to `main` through a PR
-  without a beta; merge `main` back into `beta` afterwards.
-- **Beta release** (on `beta`, about 10 minutes, unattended after the tag):
-  0. **The maintainer says "go" first.** Before committing the change and releasing, start a local
-     instance for the maintainer to try (fake camera + backend with seeded sensors, see the UI
-     testing routine), give the URL of the changed screens, sum up what was done and show the
-     release notes (the new `CHANGELOG.md` entry). Commit, version and tag only after an explicit "go".
-  1. `python scripts/channel.py beta X.Y.ZbN`, add a `## X.Y.ZbN` entry to `visionstate/CHANGELOG.md`
-     (it becomes the release notes), commit. Do **not** push `beta`.
-  2. `git tag vX.Y.ZbN && git push origin vX.Y.ZbN` (**tag only**). CI then publishes
-     `ghcr.io/oleost/visionstate-{amd64,aarch64}:X.Y.ZbN`, creates the GitHub pre-release and moves
-     `beta` to the tagged commit; `gh run watch` follows it.
-  3. `git fetch origin && git status` — local `beta` should equal `origin/beta`. If the release
-     changed a file under `.github/workflows/`, CI may not push the branch: run `git push origin beta`
-     yourself once the images exist (the registry answers 200 for
-     `https://ghcr.io/v2/oleost/visionstate-<arch>/manifests/X.Y.ZbN` with an anonymous pull token).
-     A tagline for the release title is optional: `gh release edit vX.Y.ZbN --title "X.Y.ZbN — …"`.
-- **Before promoting a beta to stable** (there is no separate release candidate: the beta being
-  promoted is checked as it is) — go through all of it, and tell the user what
-  was checked and what was found:
-  1. **CI on the beta being promoted is green**, including the checks that only block stable
-     releases: the upgrade test from the last stable release and back (`scripts/upgrade_test.sh`,
-     both architectures), the old CPU check (amd64 `kvm64`, aarch64 `cortex-a53`), the memory peak
-     with all three models (see the notice in the smoke test; limit in `MEMORY_LIMIT`), the app
-     options check (`scripts/check_options.py`), `pip-audit` / `npm audit` (a warning on betas,
-     an error on stable), and e2e on desktop, Android and iPhone (WebKit).
-  2. **On the test Home Assistant** (a Home Assistant OS VM with the beta app installed):
-     - update the beta app to the beta being promoted; the standing test sensors (one of each kind) keep
-       working, their entities in Home Assistant keep their IDs, the log has no warnings or errors;
-     - restart Home Assistant, reboot the host and restart the MQTT broker: the app and its
-       entities come back by themselves;
-     - make a backup of the app and restore it: the sensors are back;
-     - **soak for 1 hour** with the sensors checking: memory of the app (Supervisor app stats)
-       and its data on disk level off instead of growing, the log stays quiet;
-     - open the app in Home Assistant at desktop width and on a phone (Ingress);
-     - prepare the **update from the last stable release in a real Home Assistant**: the stable
-       app (repository without `#beta`) is installed there too. It shares MQTT topics and unique
-       IDs with the beta app, so never run both: stop the beta app, start the stable one and give
-       it one sensor of each kind (import exports of the standing test sensors).
-  3. **What changed since the last stable release**: new or upgraded dependencies have a licence
-     that fits Apache-2.0 (`git diff vX.Y.Z -- visionstate/backend/requirements.txt
-     visionstate/frontend/package.json`); `homeassistant:` in config.yaml still names the oldest
-     Home Assistant that works; DOCS.md, README.md and SCOPE.md describe what is being released.
-- **Promote to stable** (only when the user says the beta is tested, after the checks above):
-  1. `git switch -c promote/X.Y.Z beta`; `python scripts/channel.py stable X.Y.Z`; in the changelog,
-     merge the `X.Y.ZbN` entries into one `## X.Y.Z` entry; commit.
-  2. `git merge origin/main`; if `visionstate/config.yaml` conflicts, re-run
-     `python scripts/channel.py stable X.Y.Z` to resolve it; commit.
-  3. `git tag vX.Y.Z && git push origin vX.Y.Z` (tag only); wait for the images.
-  4. Push the branch, open a PR to `main`, wait for CI, merge it. Right away, update the stable app
-     on the test Home Assistant (reload the store): its sensors keep working, their entities keep
-     their IDs, the log has no warnings or errors. Only then `gh release create vX.Y.Z --latest`;
-     stop the stable app and start the beta app again.
-  5. Merge `main` back into `beta`, keeping beta's config: `git switch beta && git merge main`,
-     then `python scripts/channel.py beta <last beta version>` and commit (a beta version whose
-     images exist); the next beta release sets the next version.
-- Python version is **3.14** (Dockerfile image, CI `setup-python`, ruff `target-version`, local
-  `.venv` created with `py -3.14`). Upgrade all of them together; Dependabot ignores Python image
-  upgrades for that reason.
-- **Old CPUs and virtual machines must keep working** (x86-64-v1, e.g. Proxmox `kvm64`; ARMv8.0,
-  e.g. Raspberry Pi 3/4 and Home Assistant Yellow with CM4 — Green is ARMv8.2). NumPy is pinned
-  below 2.4 because newer wheels need x86-64-v2 (Dependabot ignores them). CI runs
-  `scripts/cpu_probe.py` in each image under an emulated old CPU (amd64 `kvm64`, aarch64
-  `cortex-a53`); when it fails after a dependency update, that update needs a newer CPU — keep the
-  old version.
-- **Docs checklist** — when behaviour, defaults, versions or the workflow change, update in the same
-  change: `visionstate/DOCS.md` (user guide in HA), `README.md` (front page), `docs/SCOPE.md`
-  (design as built, roadmap), `visionstate/CHANGELOG.md`, and this file.
-- Dependency updates: Dependabot opens one grouped PR per ecosystem monthly. CI runs the tests, a
-  smoke test that starts the built image (both architectures) against a real MQTT broker, and the
-  upgrade test from the last stable release.
+## Conventions
+
+- `visionstate/` is the Home Assistant app (build context of the Dockerfile); the map of the code
+  is [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) — keep it current when the structure changes.
+- Sensor kinds (`settings.SENSOR_KINDS`): `single_state`, `objects`, `reading`. A new feature says
+  which kind(s) it applies to.
+- New engine code goes into the part (mixin) it belongs to. A long-running loop must survive any
+  exception (log it once, try again) — only `CancelledError` may end it.
+- Model registries (`backbones.json`, `detectors.json`, `readers.json`, `faces.json`): entries are never changed
+  or removed once released (their texts, measured footprint and similarity limits may be); a new model gets a new id, pinned by Hugging Face revision and SHA-256,
+  and is checked against real inputs in the tests (one public ONNX conversion turned out to be
+  broken and only a test with real photos showed it).
+- Frontend: colours/type/spacing only in `tokens.css`, UI constants in `ui.ts`, API URLs only in
+  `api.ts`, app paths in `router.svelte.ts`. There is **no formatter** for the frontend (single
+  quotes, ~120-character lines, kept by hand) — never run Prettier on it. Backend: ruff format.
+- Never rely on Ctrl/Shift/hover-only interactions; hide keyboard hints with `.kbd-only`.
+- Test images must be CC0 / public domain (sources in `tests/assets/README.md`) or drawn by our own
+  code (`tests/displays.py`). Local experiment data lives in `/VisionStateLocal/` (ignored by git,
+  outside the Docker build context): images with other licences may be used there for trying things
+  out, never in the repository, the tests or a shipped model; its `README.md` lists each source.
+
+## Checks
+
+- Backend: `cd visionstate/backend && .venv/Scripts/python -m pytest -q && .venv/Scripts/ruff check visionstate tests && .venv/Scripts/ruff format visionstate tests`
+  and the types `.venv/Scripts/pyright --pythonpath .venv/Scripts/python.exe` (0 errors; on Linux and
+  macOS the venv's programs are in `.venv/bin/`). Tests need
+  the bundled models once: `python -m visionstate.backbones models` (`--all` adds the downloadable
+  ones, so `tests/test_models.py` checks every model). CI fails below 88 % coverage;
+  `--cov=visionstate --cov-report=term-missing:skip-covered` shows what is not tested.
+- Frontend: `cd visionstate/frontend && npm run check && npm run build`.
+- UI: see the routine below — every UI change, and before every beta release.
+
+## Run it locally
+
+```bash
+cd visionstate/backend
+py -3.14 -m venv .venv                     # inside the project: long paths break pip elsewhere on Windows
+.venv/Scripts/pip install -r requirements-dev.txt
+.venv/Scripts/python -m visionstate.backbones models
+VISIONSTATE_DATA=./dev/data VISIONSTATE_MEDIA=./dev/media VISIONSTATE_BUNDLED_MODELS=./models \
+  HA_URL=http://homeassistant.local:8123 HA_TOKEN=<long-lived token> \
+  VISIONSTATE_MQTT_HOST=<broker> .venv/Scripts/python -m visionstate
+```
+
+The UI is then on port 8099 (no login: only on your own machine). `npm run dev` in
+`visionstate/frontend` serves the UI with hot reload and proxies `/api` to it. On Windows set
+`PYTHONUTF8=1` for scripts that read or write source files; the app handles the Windows event loop
+itself (`__main__.py`).
+
+- **Fake camera** (no Home Assistant needed): `python scripts/fake_camera.py 8765`, and use
+  `http://127.0.0.1:8765/…` as an *HTTP snapshot URL*: `/snapshot.jpg` (a drawn garage door;
+  `/set?state=open|closed|partial`, `/set?night=1`), `/photo/<name>.jpg` (the CC0 photos from
+  `backend/tests/assets`, for object sensors), `/display.jpg?text=12:05&style=lcd|led` (a drawn
+  seven-segment display) and `/counter.jpg?value=89939.5&digits=7&decimals=3` (a drawn mechanical
+  counter; `.5` = the last wheel half way to the next digit).
+- **The Home Assistant side:** any local MQTT broker (e.g. Mosquitto on 1883) and
+  `VISIONSTATE_MQTT_HOST=127.0.0.1`: discovery configs appear under `homeassistant/…`, values under
+  `visionstate/<slug>/…`.
+- **On a real Home Assistant, without a release:** build the working copy as a *local app*. Copy the
+  `visionstate/` folder (without `node_modules`, `dist`, `.venv`, `models`) into the `local_apps`
+  folder of Home Assistant (older versions: `addons`; reach it with the Samba or Terminal & SSH app),
+  and in that copy's `config.yaml` delete `image:` and give it its own `name`, `slug`, `panel_title`
+  and `VISIONSTATE_MEDIA` folder. Home Assistant then builds the Dockerfile itself, the same image
+  as a release (*Local apps* in the app store; after a change: *Rebuild*). It shares MQTT topics and
+  unique IDs with an installed VisionState, so never run both at once; it has its own data (move
+  sensors with export/import). This is how changes are tried on Home Assistant during development;
+  a beta is released when the maintainer asks for one.
+
+## UI testing routine
+
+Many users run Home Assistant on phones and tablets.
+
+- **Automated:** `cd visionstate/frontend && npm run build && VS_PYTHON=../backend/.venv/Scripts/python npm run e2e`
+  (Playwright, `e2e/`; once: `npx playwright install chromium webkit`). It starts the backend and
+  `scripts/fake_camera.py`, seeds one sensor of each kind (a trained state sensor, an object sensor
+  on a real photo, reading sensors on a drawn display and a drawn mechanical counter), and runs every
+  page on **desktop** (1440×900, mouse), **mobile** (Pixel 7, real touch via CDP) and **iphone**
+  (iPhone 14, WebKit like the Home Assistant app on iOS): no console errors, no sideways scrolling,
+  no text running out of buttons or cards, plus the wizard, region editor gestures, labelling,
+  review, boxes, teaching and readings. Add a test for every new page or gesture.
+- Look at the full-page screenshots in `test-results/pages/{desktop,mobile,iphone}/` for every page.
+- **Then by hand in a real browser** (Claude: the Chrome tools) — passing tests are not enough:
+  start `scripts/fake_camera.py 8198` and the backend (`VISIONSTATE_PORT`, `_DATA`, `_MEDIA`,
+  `_FRONTEND=frontend/dist`, `_BUNDLED_MODELS` as in `playwright.config.ts`; a copy of the last e2e
+  run's `data` and `media` folders gives seeded sensors), use the changed screens at desktop width
+  and at ~390 px, and check the console. Reload after a rebuild (a hash-only navigation keeps the
+  old page). A Chrome window does not get narrower than 500 px: for a real phone width, open any
+  same-origin URL (e.g. `/api/v1/status`) and replace the page with
+  `<iframe src="/#/…" style="width:390px;height:844px">`.
+- Handy: only the phone `npx playwright test --project=mobile`; one test `-g "reading sensor"`;
+  watch it `--headed` or step through it `--ui`; after a failure `npx playwright show-trace
+  test-results/<test>/trace.zip`.
+- **Demo sensors:** `python scripts/seed_demo.py --url <app> --images <camera>` seeds one sensor of
+  each kind (Driveway with Emma and "Our car", Garage door, Water meter) on any instance: locally
+  with `--images http://127.0.0.1:8765/photo` (the fake camera), or on an installed app with
+  `--app <slug>` (photos from GitHub). Running it twice changes nothing.
+- **Docs screenshots** (`docs/promo/`): seed the demo sensors on a local backend with a local MQTT
+  broker (so the header shows *MQTT connected*), then `node e2e/promo.mjs <app URL>` in
+  `visionstate/frontend` (1440 px wide, device scale 1.2, one row of the README the same height).
+  The Home Assistant screenshots (`ha-*.png`) are taken by hand on a real Home Assistant. Show the
+  maintainer before publishing.
+
+## Test pitfalls found the hard way
+
+- The UI polls frames and status, so the network never goes idle — wait for elements or for
+  `img.complete`, never for `networkidle`.
+- History rows and retrains happen *after* a value or state is published. Never read them right
+  after; poll with `wait_for` / `expect.poll`. A sensor reports `ok` with its first model — wait for
+  `model.n_samples` when a test needs the model trained on all labels.
+- Touch in Playwright goes through CDP (`e2e/helpers.ts`): a fast release starts a fling that
+  swallows the next tap, so drags rest briefly before lifting. Full-page screenshots drop touch
+  emulation — assert touch-only CSS in the test, not from a screenshot.
+- A change that makes text longer while something reloads can shift the page on phones and make a
+  tap land elsewhere; keep the last result on screen while re-testing.
+- A Svelte `$effect` tracks every state read until the first `await` of any function it calls. If
+  that function later sets what it read, the effect restarts it on every answer — the live frames
+  polled the camera dozens of times a second from 0.1.0 until 0.6.5. Call such functions with
+  `untrack`, name the real dependencies with `void x`, and give a polling loop a counter so a
+  restart ends the old loop. The e2e test "no page asks the server more often than it polls"
+  counts requests per page.
+- The Chrome tab Claude drives counts as hidden (`document.visibilityState`); views that only poll
+  while visible look fine there. Use `setVisibility` (e2e) or override it by hand.
diff --git a/README.md b/README.md
index 717745c..90a7bea 100644
--- a/README.md
+++ b/README.md
@@ -6,10 +6,8 @@
 </p>
 
 <p align="center">
-  <b>Teach a local AI what your camera sees — and turn it into a Home Assistant sensor.</b><br>
-  Garage door open, closed or halfway? Gate shut? Click a few examples and you have a sensor.<br>
-  Person at the door, car in the driveway, cat on the lawn? Pick the objects — no training needed.<br>
-  kWh on the meter, minutes left on the washer? Read the number.
+  <b>Turn your cameras into Home Assistant sensors — with a local AI you teach in minutes.</b><br>
+  Is the garage door open? Who just came home, and is that our car? What does the water meter say?
 </p>
 
 <p align="center">
@@ -28,125 +26,56 @@
 </p>
 
 <p align="center">
-  <img src="docs/promo/dashboard.png" alt="VisionState dashboard with a garage door, a driveway and a power meter sensor" width="900">
+  <img src="docs/promo/dashboard.png" alt="VisionState with a driveway, a garage door and a water meter sensor" width="900">
 </p>
 
-## Why VisionState?
+## Three kinds of sensor
 
-Your cameras already see whether *the garage door is half open*, *the gate is shut* or *the
-lights in the shed are still on*. VisionState turns what they see into **states** you can use in
-Home Assistant — and because every home is different, you teach it yourself, in minutes,
-without writing code or leaving Home Assistant:
+| | What you get | How |
+|---|---|---|
+| 🚪 **States** | *Garage door open, closed or halfway*, gate shut, lights on in the shed | Click a few examples of each state; it learns in about a second |
+| 🧍 **Objects & people** | *Emma is home*, *our car is in the driveway*, a cat on the lawn, an unknown person at the door | Pick from 80 objects — no training. Name people by their face once; every camera knows them |
+| 🔢 **Readings** | The water, gas or power meter, the minutes left on the washer | Draw a box around the number. Counters only go up and land in the Energy dashboard |
 
-- 📸 **Train by clicking** — look at the live image and press the matching state (or keys `1`–`9`).
-  The model retrains in about a second after every click.
-- 🐕 **Find objects without training** — people, cars, bicycles, cats, dogs and 75 more, with a
-  count and an on/off sensor for each. Pick them, done. Wrong about your garden statue? Tap the
-  box: *not a person*. Want *our car* apart from any car? Give it its own label.
-- 🔢 **Read numbers** — power meters, the rolling digits of water and gas meters (read wheel by
-  wheel, also while a wheel is half way between two digits), prices, the minutes left on the
-  washing machine. Counters only go up and land straight in the Energy dashboard; implausible readings are rejected, and a
-  Quality tab shows how reliably your meter is read.
-- 🎯 **Watch only what matters** — draw a box (or any shape) around the door or the driveway;
-  the AI ignores everything else.
-- 📦 **Bulk upload** — drop images, ZIP archives or a **video**; frames are extracted, duplicates
-  skipped, and the current model suggests a label for each one.
-- ⚡ **Smart triggers** — check when a motion sensor, door contact or the garage opener changes
-  (or only when it becomes one state), or when the image itself changes. No more polling every
-  few seconds.
-- 💡 **Cameras in the dark** — a light or switch is turned on for each check, and while you frame
-  the image, then off again — for a meter in a cabinet.
-- 🩺 **Finds its own mistakes** — flags training images whose label looks wrong, so one slip
-  doesn't drag the sensor down.
-- 🔁 **Gets better as you use it** — a review queue collects the frames the AI was unsure about;
-  one click turns them into training data. Forgot about it? A reminder shows up in Home Assistant
-  (or on your phone) after a week — never a ping for every frame.
-- 🕓 **Everything in one history** — every state change, object that came and went and reading,
-  with its frame; filter by sensor, by what was seen, by event and by time, and bookmark the view.
-- 🧠 **Runs locally on any CPU** — Intel, AMD and Raspberry Pi 4/5. No cloud, no GPU, no subscription.
-- 🏠 **Native Home Assistant** — sidebar app with Ingress; sensors appear through MQTT discovery,
-  named like any other integration's. Keep a sensor out of Home Assistant while you tune it.
-- 🎥 **Any camera** — every `camera.*` entity in Home Assistant (ESP32-CAM, IP cameras, NVRs…),
-  or a direct RTSP / HTTP snapshot URL.
-
-## A look inside
+<p align="center">
+  <img src="docs/promo/objects.png" alt="An object sensor recognising Emma by her face and telling our car from any car" width="900">
+</p>
 
 <table>
   <tr>
-    <td width="50%" valign="top"><img src="docs/promo/objects.png" alt="An object sensor finding dogs and a person" width="100%"></td>
-    <td width="50%" valign="top"><img src="docs/promo/reading.png" alt="A reading sensor reading a power meter" width="100%"></td>
+    <td width="50%" valign="top"><img src="docs/promo/reading.png" alt="A reading sensor reading the wheels of a real water meter" width="100%"></td>
+    <td width="50%" valign="top"><img src="docs/promo/people.png" alt="The People page with the faces taught for Emma" width="100%"></td>
   </tr>
   <tr>
-    <td valign="top"><b>Objects</b> — people, cars, animals and more, found without any training. Each one becomes an on/off sensor and a count in Home Assistant.</td>
-    <td valign="top"><b>Reading</b> — the number on a display or on the rolling wheels of a water or gas meter, checked before it is published: a counter never goes down.</td>
-  </tr>
-  <tr>
-    <td colspan="2" valign="top"><img src="docs/promo/wizard.png" alt="The new sensor wizard testing an object sensor on a fresh frame" width="100%"></td>
-  </tr>
-  <tr>
-    <td colspan="2" valign="top"><b>New sensor</b> — pick a camera, draw the region and choose what to detect: your own states, objects or a number. The wizard tests it on a fresh frame right away.</td>
+    <td valign="top"><b>Real meters</b> — the rolling wheels of a water meter, read right even while a wheel is half way between two digits.</td>
+    <td valign="top"><b>People</b> — a few photos from your phone are enough to start; faces never leave your Home Assistant.</td>
   </tr>
 </table>
 
-## In Home Assistant
+## Highlights
 
-Every sensor is a normal Home Assistant device, set up automatically through MQTT discovery —
-ready for dashboards, automations and the history graph.
+- 🧠 **100 % local on any CPU** — Intel, AMD, Raspberry Pi 4/5. No cloud, no GPU, no subscription, no telemetry.
+- 🏠 **Native Home Assistant** — a sidebar app; every sensor is a normal device through MQTT discovery.
+- 🎥 **Any camera** — every `camera.*` entity, or an RTSP / HTTP snapshot URL.
+- 🎯 **Watch only what matters** — draw a region around the door or the driveway; the rest is ignored.
+- ⚡ **Checks when something happens** — on motion, a door contact or a change in the image, and can switch on a light for a camera in the dark.
+- 🔁 **Gets better as you use it** — unsure frames go to a review queue, wrong boxes are fixed with a tap, and suspicious labels are flagged.
+
+## In Home Assistant
 
 <table>
   <tr>
     <td width="50%" valign="top"><img src="docs/promo/ha-states.png" alt="A garage door state sensor as a Home Assistant device" width="100%"></td>
-    <td width="50%" valign="top"><img src="docs/promo/ha-objects.png" alt="An object sensor as a Home Assistant device" width="100%"></td>
+    <td width="50%" valign="top"><img src="docs/promo/ha-objects.png" alt="The driveway object sensor as a Home Assistant device, with Emma and our car" width="100%"></td>
   </tr>
   <tr>
-    <td valign="top"><b>State sensor</b> — the state (<code>closed</code>, <code>open</code>, …) with its confidence, the last frame, a button to check now and a switch to pause it.</td>
-    <td valign="top"><b>Object sensor</b> — an on/off sensor and a count for every object you picked, plus the last frame with the boxes drawn in.</td>
+    <td valign="top"><b>State sensor</b> — the state with its confidence, the last frame, a button to check now and a switch to pause it.</td>
+    <td valign="top"><b>Object sensor</b> — an on/off sensor and a count for every object, person and own label.</td>
   </tr>
 </table>
 
-## Install
-
-**Requirements:** Home Assistant OS or Supervised (2025.10 or newer), the **Mosquitto broker**
-app and the **MQTT** integration, and at least one camera.
-
-1. Click **Add repository** above — or go to **Settings → Apps** (called *Add-ons* in older
-   versions) **→ App store → ⋮ → Repositories** and add `https://github.com/oleost/VisionState`.
-2. Install **VisionState** (it downloads a ready-made image for your machine).
-3. Start it and open **VisionState** from the sidebar.
-
-### Beta channel
-
-New features are released as **beta** first and move to the stable app once they are tested. To
-help test them, add `https://github.com/oleost/VisionState#beta` as a repository and install
-**VisionState (beta)**.
-
-- The beta is a separate app with its own data; move sensors over with **Export** (stable) and
-  **Import** (beta). Entity ids stay the same, so automations keep working.
-- Run only one of the two apps at a time — both publish the same sensors.
-
-## Get your first sensor in five minutes
-
-1. **New sensor** → name it, pick a camera.
-2. Draw a box around the thing to watch (drag its corners to shape it to the object).
-3. Name the states, e.g. *Open*, *Closed*, *Partial*.
-4. On the **Label** tab, press the matching state a few times for each situation — about
-   **20 per state**, including some at night.
-5. Under **Settings → When to check**, add your motion sensor or garage opener as a trigger.
-
-That's it — `sensor.garage_door` is now in Home Assistant:
-
-| Entity | What it is |
-|---|---|
-| `sensor.<name>` | The state (`open`, `closed`, …) — or `unknown` when the AI isn't sure |
-| `sensor.<name>_confidence` | How sure the AI is, in % |
-| `image.<name>_last_frame` | The region that was classified |
-| `button.<name>_classify_now` | Check right now (handy in automations) |
-| `switch.<name>_enabled` | Pause / resume |
-| `sensor.visionstate_review_queue` | Frames waiting for review (all sensors) |
-
 ```yaml
-# Example: notify when the garage door has been open for 10 minutes
-alias: Garage door left open
+# Example: tell me when the garage door has been open for 10 minutes
 triggers:
   - trigger: state
     entity_id: sensor.garage_door
@@ -158,104 +87,61 @@ actions:
       message: The garage door has been open for 10 minutes.
 ```
 
-The full user guide is in [`visionstate/DOCS.md`](visionstate/DOCS.md) (also on the app's
-*Documentation* tab).
-
-## How it works
-
-```
-camera ─► crop to your region ─► DINOv2 (ONNX, 8-bit) ─► feature vector ─► tiny per-sensor classifier
-                                                                                     │
-Home Assistant ◄── MQTT discovery ◄── debounce + "unknown" below threshold ◄─────────┘
-```
-
-A pre-trained vision model ([DINOv2](https://github.com/facebookresearch/dinov2)) turns the
-region into a feature vector. On top of that, each sensor gets its own small classifier trained
-on *your* labelled images — which is why a handful of examples is enough and training takes
-about a second. Results are debounced so someone walking past doesn't flip the state.
+## Install
 
-Object sensors use a pretrained detector instead ([D-FINE](https://github.com/Peterande/D-FINE),
-Apache-2.0, trained on the COCO objects). It finds every object in the region; each object you
-picked is reported with a count and cleared a while after it was last seen. Boxes you corrected
-teach it your camera: later boxes that clearly look like one you taught get your answer.
+**Requirements:** Home Assistant OS or Supervised (2025.10 or newer), the **Mosquitto broker** app
+with the **MQTT** integration, and a camera.
 
-Reading sensors read the digits in the region with a small text recognizer
-([PaddleOCR](https://github.com/PaddlePaddle/PaddleOCR), Apache-2.0) that may only output digits,
-then check the value (a counter never goes down) before publishing it. Mechanical counters are
-read by a small model made for VisionState that tells how far each wheel has turned; the wheels
-are read together, the way they turn ([`tools/wheelreader`](tools/wheelreader), trained on
-public-domain meter photos and drawn wheels).
+1. Click **Add repository** above — or add `https://github.com/oleost/VisionState` under
+   **Settings → Apps → App store → ⋮ → Repositories**.
+2. Install **VisionState**, start it and open it from the sidebar.
+3. **New sensor** → pick a camera, draw a region, choose what to watch. The wizard tests it on a
+   fresh frame right away.
 
-Everything stays on your machine: images live in `/media/visionstate`, models and settings in
-the app's data folder (included in Home Assistant backups).
+New features come to a separate **beta** app first: add `https://github.com/oleost/VisionState#beta`
+instead. Run only one of the two at a time (they publish the same sensors); move sensors with
+**Export** and **Import**.
 
-## Privacy & security
+The user guide — every entity, triggers, faces, readings, review — is on the app's
+*Documentation* tab ([`visionstate/DOCS.md`](visionstate/DOCS.md)).
 
-- 100 % local — no cloud services, no telemetry.
-- Only reachable through Home Assistant Ingress (requires a Home Assistant login).
-- Camera passwords are hidden in logs and removed from exported sensor bundles.
-
-## Development
+## How it works
 
 ```
-visionstate/            Home Assistant app (config.yaml, Dockerfile, docs)
-  backend/              Python 3.14 · FastAPI · ONNX Runtime · scikit-learn
-  frontend/             Svelte 5 · Vite · TypeScript
-scripts/channel.py      Switches the app config between the stable and beta channel
-scripts/fake_camera.py  A fake camera (garage door, real photos, drawn displays and counters) for local testing
-docs/SCOPE.md           Design as built, decisions and roadmap
-CLAUDE.md               Contributor guide: conventions, how to test and verify, release steps
+camera ─► your region ─► pretrained model (ONNX, CPU) ─► small per-sensor model ─► debounce ─► MQTT ─► Home Assistant
 ```
 
-New features land on the `beta` branch first and reach `main` (stable) only after testing;
-please open pull requests against `beta`. [`CLAUDE.md`](CLAUDE.md) explains the conventions, how to
-test changes locally (fake camera, MQTT, UI tests on desktop and phone) and the pitfalls we ran
-into — it is written for people and AI coding assistants alike.
+- **States:** [DINOv2](https://github.com/facebookresearch/dinov2) turns the region into a feature
+  vector; a tiny classifier per sensor, trained on *your* examples, picks the state.
+- **Objects:** [D-FINE](https://github.com/Peterande/D-FINE) finds the COCO objects; boxes you
+  corrected or gave an own label teach it your camera.
+- **Faces:** [YuNet](https://github.com/opencv/opencv_zoo) finds a face on each person, and only a
+  clear one is compared ([SFace](https://github.com/opencv/opencv_zoo), or
+  [AuraFace](https://huggingface.co/fal/AuraFace-v1) on a fast PC) with the faces you named.
+- **Readings:** [PaddleOCR](https://github.com/PaddlePaddle/PaddleOCR) reads digits; mechanical
+  counters use a small wheel reader made for VisionState ([`tools/wheelreader`](tools/wheelreader)).
+  Every value is checked before it is published.
 
-<details>
-<summary>Run it locally</summary>
-
-Backend:
-
-```bash
-cd visionstate/backend
-python3.14 -m venv .venv && . .venv/bin/activate  # Windows: py -3.14 -m venv .venv; .venv\Scripts\activate
-pip install -r requirements-dev.txt
-python -m visionstate.backbones models            # download the bundled model once
-pytest
-VISIONSTATE_DATA=./dev/data VISIONSTATE_MEDIA=./dev/media VISIONSTATE_BUNDLED_MODELS=./models \
-  HA_URL=http://homeassistant.local:8123 HA_TOKEN=<long-lived token> \
-  VISIONSTATE_MQTT_HOST=<broker> python -m visionstate
-```
-
-> ⚠️ Outside Home Assistant the app has **no login**: anyone who can reach port 8099 can use it.
-> Only run it like this on your own machine or behind a reverse proxy with authentication.
-
-Frontend (proxies `/api` to the backend on port 8099):
-
-```bash
-cd visionstate/frontend
-npm install
-npm run dev
-```
-
-UI tests (Playwright) start the backend and a fake camera by themselves and run every page on a
-desktop browser and on an emulated phone with touch:
+## Privacy & security
 
-```bash
-cd visionstate/frontend
-npx playwright install chromium   # once
-npm run build
-VS_PYTHON=../backend/.venv/bin/python npm run e2e
-```
+- Nothing leaves your machine; there is no telemetry.
+- Only reachable through Home Assistant Ingress (a Home Assistant login).
+- Camera passwords are hidden in logs and removed from exports.
+- Face recognition is off until you turn it on for a camera; faces are kept in the app's own
+  storage and exported only if you tick it.
 
-</details>
+## Contributing
 
-Issues and ideas are welcome in [GitHub Issues](https://github.com/oleost/VisionState/issues).
+Pull requests go to the `beta` branch. [`CLAUDE.md`](CLAUDE.md) is the contributor guide (run it
+locally against a fake camera, checks, UI tests on desktop and phones) and
+[`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) maps the code. Issues and ideas:
+[GitHub Issues](https://github.com/oleost/VisionState/issues). Security: [`SECURITY.md`](SECURITY.md).
 
 ## Licence
 
-[Apache-2.0](LICENSE). The bundled models are Apache-2.0 as well: DINOv2 (Meta), D-FINE,
-PaddleOCR PP-OCRv6 and the VisionState wheel reader.
+[Apache-2.0](LICENSE). Bundled models: DINOv2 (Meta), D-FINE, PaddleOCR PP-OCRv6 and the
+VisionState wheel reader, all Apache-2.0. Face models, downloaded only when a camera recognises
+faces: YuNet (MIT), SFace or AuraFace (Apache-2.0). The screenshots use CC0 and public-domain
+images.
 
 If VisionState is useful to you, you can [buy me a coffee](https://buymeacoffee.com/o1ep) ☕
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..53ccfab
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security
+
+Please report a vulnerability privately: **Security → Report a vulnerability** on this repository
+(GitHub's private vulnerability reporting), not as a public issue. You get an answer within a few
+days, and a fix goes out as a beta first, then in the next stable release.
+
+Supported: the latest stable release and the current beta.
+
+What VisionState relies on, so you know what counts as a vulnerability: it is only reachable
+through Home Assistant Ingress (other requests are refused); camera credentials are never written to
+logs, errors or exports; nothing is sent anywhere but to your own Home Assistant and MQTT broker.
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index bced7d7..7cb8281 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -4,6 +4,28 @@ A map of the code: what runs where, how one check flows through it, and which fi
 for common changes. What VisionState does and why is in [`SCOPE.md`](SCOPE.md); how to work on
 it is in [`CLAUDE.md`](../CLAUDE.md).
 
+## Repository
+
+```
+repository.yaml, README.md, CLAUDE.md, SECURITY.md
+visionstate/            the Home Assistant app: config.yaml, Dockerfile, DOCS.md, CHANGELOG.md, icon/logo
+  backend/              Python package `visionstate` + tests (the Dockerfile builds from visionstate/)
+  frontend/             Svelte app, Playwright tests in e2e/ (and promo.mjs: the README screenshots)
+scripts/                channel.py (stable/beta config), fake_camera.py (test camera), seed_demo.py
+                        (the demo sensors), CI helpers:
+                        check_options.py, cpu_probe.py, upgrade_test.sh, discovery_ids.py
+tools/wheelreader/      training code of the wheel reader model (not part of the app image)
+docs/                   SCOPE.md, ARCHITECTURE.md, RELEASING.md, WHEEL_READER_PLAN.md,
+                        FACE_RECOGNITION_PLAN.md, promo/ (README images)
+.github/                CI workflow, Dependabot, issue forms
+```
+
+**Stack:** Python 3.14, FastAPI, uvicorn, SQLAlchemy (SQLite), asyncio; ONNX Runtime (CPU only),
+NumPy, Pillow, PyAV (bundled FFmpeg), scikit-learn; aiomqtt, websockets, httpx. Frontend: Svelte 5 +
+Vite + TypeScript, plain CSS with design tokens, a hash router (Ingress-safe), bundled fonts. Docker
+image `python:3.14-slim`, built by GitHub Actions and published on GHCR. Quality: pytest (with a fake
+camera, Home Assistant and MQTT), ruff, pyright, svelte-check, Playwright, an image smoke test.
+
 ## The process
 
 One Python process (`python -m visionstate`) serves the API and the built UI through Home
@@ -30,12 +52,13 @@ API as `request.app.state.runtime`.
 | `db.py` | SQLAlchemy tables and the schema migrations (`MIGRATIONS`, `SCHEMA_VERSION`) |
 | `storage.py` | Image files on disk: training samples, history frames, thumbnails |
 | `engine/` | The runtime — see below |
-| `api/` | The REST API (`/api/v1/…`), one file per topic: `sensors.py` (CRUD, quality, export), `history.py` (the history: one filter for the list, its count and facets; history frames), `samples.py` (training images), `teach.py` (taught boxes), `cameras.py` (camera and entity lists, the light, previews), `review.py` (review queue and answers), `imports.py` (import), `system.py` (UI config, status, AI models, storage, review rules, review reminder), `common.py` (input models and views shared by them) |
+| `api/` | The REST API (`/api/v1/…`), one file per topic: `sensors.py` (CRUD, quality, export), `history.py` (the history: one filter for the list, its count and facets; history frames), `samples.py` (training images), `teach.py` (taught boxes; what is taught from a history frame is written into its row: `remember_taught`), `faces.py` (teaching a face on a sensor; the people and their faces, shared by every sensor), `cameras.py` (camera and entity lists, the light, previews), `review.py` (review queue and answers), `imports.py` (import), `system.py` (UI config, status, AI models and deleting downloaded ones, storage, review rules, review reminder, teaching and face limits), `common.py` (input models and views shared by them) |
 | `sources.py` | Camera sources: Home Assistant camera, HTTP snapshot, RTSP; address checks and size limits; the Home Assistant REST client (states, services, notify services, the app's page) |
 | `mqtt.py` | MQTT topics, Home Assistant discovery messages, the bridge (connect, publish, commands) |
 | `ha_events.py` | Home Assistant WebSocket: state changes of trigger entities, entity registry |
 | `lights.py` | A sensor's light: switched on for checks and while someone looks, shared by both |
 | `backbones.py`, `detectors.py`, `readers.py` | The three AI models and their registries (`*.json`): embedding backbone (state sensors), object detector, number reader (and the wheel reader for mechanical counters, `readers.WheelReader`; trained with `tools/wheelreader`) |
+| `faces.py` | Faces in person boxes (registry `faces.json`, never bundled): finding them (YuNet), the quality gate, aligning, evening out the light (`even_light`), embedding, telling who it is |
 | `classifier.py` | The small per-sensor classifier ("head") on top of the backbone |
 | `teach.py` | Object sensors: comparing detected boxes with the boxes the user taught |
 | `imaging.py` | Decoding, regions (ROI), crops, change signatures, drawing boxes |
@@ -49,7 +72,7 @@ API as `request.app.state.runtime`.
 parts it uses — its class line says what it depends on:
 
 ```
-Runtime ── ChecksMixin ──┬─ ObjectChecksMixin ── TeachingMixin ── ModelsMixin ── TrainingMixin
+Runtime ── ChecksMixin ──┬─ ObjectChecksMixin ── FacesMixin, TeachingMixin ── ModelsMixin ── TrainingMixin
         │                │                    └─ PublishingMixin
         │                └─ ReadingChecksMixin ── ModelsMixin, PublishingMixin
         ├─ HistoryMixin ── PublishingMixin                (all of them on RuntimeBase)
@@ -61,11 +84,12 @@ Runtime ── ChecksMixin ──┬─ ObjectChecksMixin ── TeachingMixin 
 | `base.py` | `RuntimeBase`: the shared state (`__init__`), loading a sensor, its live state, waking it |
 | `runtime.py` | Lifecycle (start/stop), sensors coming and going, waking a sensor, triggers |
 | `state.py` | `SensorConfig` (a snapshot of a sensor row) and `LiveState` (everything a sensor knows between checks) |
-| `logic.py` | Pure decisions, no I/O: debouncing object tracks, review, triggers, when to check next |
+| `logic.py` | Pure decisions, no I/O: debouncing object tracks, review, triggers, when to check next, looking for a face while a person is there (`steer_face_burst`) |
 | `checks.py` | Each sensor's loop, change detection (probe), the light, `run_once` and the state sensors' check |
-| `objects.py`, `reading.py` | The check of an object sensor and of a reading sensor |
+| `objects.py`, `reading.py` | The check of an object sensor (with its questions in Review, and "last seen" read back from the history at start: `restore_last_seen`) and of a reading sensor |
 | `models.py` | Loading and switching the three AI models; `detect_objects`, `read_number` |
 | `teaching.py` | Taught boxes of object sensors (index, embeddings) |
+| `faces.py` | Faces on object sensors: the face model (downloaded and loaded in the background, let go when unused), the index of the people's taught faces (shared by every sensor), the face step of a check (`apply_faces`), each person's own entities (where they are seen, when they were last seen) |
 | `training.py` | Training the state sensors' heads; embeddings of samples |
 | `publishing.py` | Discovery and values to Home Assistant, the review queue entity, commands from it |
 | `history.py` | History clean-up by age and size, disk use |
@@ -82,7 +106,7 @@ sensor loop (checks._sensor_loop)          woken by: its interval, a trigger ent
   ├─ decode (imaging.decode)
   └─ by kind:
       state sensor   → checks._run_states  backbone embedding → head → probabilities
-      object sensor  → objects._run_objects detector → taught boxes (teaching) → tracks (logic)
+      object sensor  → objects._run_objects detector → taught boxes (teaching) → faces → tracks (logic)
       reading sensor → reading._run_reading reader → parse → plausibility → debounce
         │
         ├─ publish (publishing._send → mqtt.MqttBridge.publish)   state, attributes, image
@@ -96,9 +120,16 @@ error is kept in `LiveState.error` and shown in the UI.
 
 - **SQLite** (`<data>/visionstate.db`): `sensor` (+ `state`), `sample` (+ `sample_label`,
   `embedding` cache), `prediction` (the history and the review queue), `reading_stat`,
-  `model_info` (per sensor), `setting` (global settings as JSON).
-- **Files** (`<media>/`): `samples/<sensor>/`, `history/<sensor>/`, thumbnails; `<data>/heads/`
-  (trained heads), `<data>/models/` (downloaded models).
+  `model_info` (per sensor), `setting` (global settings as JSON), `person` (+ `face`,
+  `face_embedding` cache: the people taught by face, shared by every sensor).
+- **Faces** (`<data>/faces/`): crops of the people's taught faces — in the app's own storage, not
+  the media folder (see `storage.Storage.face_path`).
+- **Files** (`<media>/`): `samples/<sensor>/` (training images; for object sensors the crops of
+  taught boxes), `history/<sensor>/`, `thumbs/`; `<data>/heads/` (trained heads), `<data>/models/`
+  (downloaded models, left out of backups).
+- **Object sensors' taught boxes** are `sample` rows with `object_label`, `detected`, `box` and
+  `score`; own labels live in `sensor.objects["custom"]`. Readings and object events are
+  `prediction` rows (see `db.py`).
 - **Settings of a sensor** that have many fields (`triggers`, `objects`, `reading`, `review`) are
   stored as JSON and always read through `settings.merge_*`, so a field added later gets its
   default for existing sensors without a migration.
@@ -113,9 +144,10 @@ error is kept in `LiveState.error` and shown in the UI.
 | `lib/router.svelte.ts` | Hash routes (`paths`), a page's query (`route.query`, `setQuery`) |
 | `lib/history.ts` | The history filter: from and to the page URL, and as the API takes it |
 | `lib/ui.ts` | UI constants (tabs per sensor kind, wizard texts); `tokens.css` colours, type, spacing |
-| `pages/` | Dashboard, the new sensor wizard (`NewSensor.svelte`; its Detect step per kind in `pages/wizard/`), Review, History, Settings, and `SensorPage` with one file per tab in `pages/sensor/` (its History tab is `HistoryView`) |
+| `lib/objects.ts`, `lib/reading.ts`, `lib/roi.ts`, `lib/format.ts` | Helpers: names and colours of objects and own labels, reading values and units, region geometry, formatting |
+| `pages/` | Dashboard, the new sensor wizard (`NewSensor.svelte`; its Detect step per kind in `pages/wizard/`), Review, History, People, Settings, and `SensorPage` with one file per tab in `pages/sensor/` (its History tab is `HistoryView`) |
 | `lib/components/history/` | `HistoryView` (filters, list, paging, new rows) shared by the History page and the History tabs, and one row component per sensor kind |
-| `lib/components/` | Building blocks (region editor, frames with boxes, editors for triggers, reading, states…) |
+| `lib/components/` | Building blocks (region editor, frames with boxes, editors for triggers, reading, states, limits that inherit (`LimitsEditor`)…) |
 
 ## Recipes
 
@@ -139,8 +171,14 @@ a test that an old database is upgraded (see `tests/test_entity_ids.py`).
 **A new API endpoint**: in the `api/` file of its topic, input as a pydantic model, its function
 in `lib/api.ts`, its type in `lib/types.ts`.
 
-**A new AI model**: a new entry in the registry JSON (never change a released one), checked
-against real inputs in the tests.
+**A new history event**: its name in `settings.HISTORY_EVENTS`, which rows it matches in
+`EVENT_ROWS` (`api/history.py`; every filter becomes SQL in `history_query`, nowhere else), its
+label in `HISTORY_EVENTS` in `lib/ui.ts`.
+
+**A new AI model**: a new entry in the registry JSON (never change a released one's file or
+inputs), with its measured footprint (`ram_mb`, `time_ms`, `accuracy`; see `backbones.Footprint`).
+`tests/test_models.py` checks every entry against real inputs once it is downloaded
+(`python -m visionstate.backbones models --all`, as CI does).
 
 **A new page or tab**: the route in `router.svelte.ts` (tab: `TABS_BY_KIND` in `ui.ts`), the page
 in `pages/`, and an e2e test in `e2e/ui.spec.ts` on all three devices.
diff --git a/docs/FACE_RECOGNITION_PLAN.md b/docs/FACE_RECOGNITION_PLAN.md
new file mode 100644
index 0000000..4751bd3
--- /dev/null
+++ b/docs/FACE_RECOGNITION_PLAN.md
@@ -0,0 +1,524 @@
+# Face recognition: research and plan
+
+Recognising **who** a person is (`Ole`, `Kari`, *someone unknown*) when an object sensor sees a
+person. It applies to the `objects` sensor kind only. Phases 1–3 are built (§12 says what was
+decided and where the build differs from this plan); how it works now is in [`SCOPE.md`](SCOPE.md)
+§5, the code map in [`ARCHITECTURE.md`](ARCHITECTURE.md). Research done 2026-10-10; licence
+statements were read from the model pages that day and again on 2026-10-11 (§4).
+
+## 1. The idea in one paragraph
+
+An object sensor that counts `person` can switch on **Recognise faces**. For every counted person
+box, VisionState looks for a face in the upper part of the box, aligns it, turns it into a face
+embedding and compares it with the faces the user taught for each person. A match makes the box
+that person. People are **own labels** under `person` (as "Our car" is under `car` today), so each
+one gets the binary sensor and count that own labels already get, and the teaching, review
+("Is this Kari?"), Quality tab and export work the way they already do for own labels. Only the
+embedding differs: a face model instead of DINOv2 on the whole box.
+
+## 2. Why a part of object sensors, not a new sensor kind
+
+- **The person detector already runs.** Face recognition is a second step on boxes the object
+  sensor already found, so it costs nothing while nobody is there. A separate kind would detect
+  people a second time.
+- **The model for it already exists.** Own labels (`sensor.objects["custom"]`, `{key, name,
+  parent}`), taught boxes (`sample` rows with `object_label`), matching with a threshold, a margin
+  and an *ask* band, keeping an answer while a box stays (`keep_iou`), the review queue and export
+  are all built (SCOPE §5, *Teaching object sensors*). Face recognition is another way to compute
+  the similarity for one parent class.
+- **Why DINOv2 is not enough for people.** DINOv2 on a whole person box mostly measures clothing,
+  posture and background: the same person in another jacket looks like someone else, and two
+  people in similar clothes look the same. A face model is trained to ignore exactly that. This is
+  measured in phase 0 (§6), not assumed: DINOv2 on the box is the baseline every face model must beat.
+
+## 3. How one check would flow
+
+1. The object check finds and counts person boxes as today.
+2. **Face search** (when the sensor has Recognise faces on, also before anyone is taught, so the
+   Live tab can show whether faces are usable, §9.2):
+   for at most N counted person boxes (most certain first, like `TEACH["max_checked"]`), crop the
+   upper part of the box with a margin from the full frame (not the scaled 640×640 detector input),
+   scale it up to the face detector's input and run the face detector. Keep the best face per
+   person box, with its 5 landmarks (eyes, nose, mouth corners). A face outside its person box is
+   ignored. A box that keeps a confident name (step 7) is not searched every check, only every few
+   checks, to save CPU while someone stands in view.
+3. **Quality gate:** skip faces that are too small (eye distance in pixels, a setting), too blurry
+   (variance of the Laplacian), turned too far (landmark symmetry) or with a low detector score.
+   Starting point for the minimum: the literature puts reliable identification at roughly 70–100
+   pixels between the eyes and calls it unreliable below about 40; phase 0 sets the default.
+   A skipped face is *no face*, never *unknown*: a back of a head says nothing about who it is.
+4. **Align:** a similarity transform from the 5 landmarks onto the recogniser's template
+   (112×112 for the ArcFace family) — a small NumPy least-squares fit (Umeyama) and Pillow's
+   affine transform, so no OpenCV dependency is added.
+5. **Embed** with the face recogniser (L2-normalised), cached per sample like other embeddings.
+6. **Compare** with each taught person: cosine similarity to the mean of the person's best 3
+   taught faces (not the single best: one mislabelled face would then match anything like it;
+   Frigate uses a trimmed mean for the same reason). The same rule as taught boxes: a match needs
+   the threshold *and* a margin over the next person; between the ask threshold and the match
+   threshold the box is *ask* and goes to the review queue; below it the face is *unknown*.
+   **The thresholds belong to the face model**, stored with its registry entry, not in `TEACH`:
+   DINOv2's 0.88 means nothing for a face model (OpenCV's SFace demo uses a cosine of 0.363 for
+   "same person").
+7. **Over time:** a person box that stays (`keep_iou`) keeps its name while its face, when seen,
+   stays close enough; a name is published after M consistent checks or one very certain one.
+   When a person appears, the existing burst triggers give extra checks, so a passing person is
+   seen several times and the clearest face counts.
+8. **Publish:** each person's own label turns on/off with the existing debounce and
+   `clear_after_s`. *Unknown person* turns on only when several usable faces of the same person box
+   matched nobody and that box never got a name — one bad frame of a family member must not raise
+   it (§11).
+
+What the face models cost is measured in phase 0; a person crop is small, so the face detector
+runs on about 160–320 px, not on the whole frame.
+
+## 4. Models found (licences as stated on 2026-10-10)
+
+The repository rule applies: weights in a registry are pinned by Hugging Face revision and SHA-256
+and tested on real inputs. The hard question for faces is the **licence of the weights and of the
+data they were trained on**: almost all public face models are MIT/Apache *code* with weights
+trained on research-only data sets. VisionState is Apache-2.0, so anyone may use it commercially;
+weights it ships must allow that too.
+
+### Face detectors
+
+| Model | Licence | Training data | Notes |
+|---|---|---|---|
+| **YuNet** (OpenCV Zoo) | MIT (the model directory) | WIDER FACE, whose Hugging Face card says CC BY-NC-ND 4.0 | Tiny (under 1 MB), 5 landmarks, ONNX; the 2026may variant has a dynamic input (multiples of 32). Best technical fit; the data question must be settled. |
+| **BlazeFace full-range** (MediaPipe) | Apache-2.0 (per a re-host; check Google's model card) | Google's own, per its model card (to read) | TFLite only; needs an ONNX conversion that we check against real photos. Made for faces up to about 5 m. |
+| SCRFD, RetinaFace (InsightFace) | Code MIT, **models non-commercial research only** | WIDER FACE | Not usable. |
+| YOLO face models (Ultralytics based) | AGPL-3.0 | WIDER FACE | Not usable in an Apache-2.0 app. |
+
+### Face recognisers
+
+| Model | Licence | Training data | Size / accuracy | Notes |
+|---|---|---|---|---|
+| **SFace** (OpenCV Zoo, MobileFaceNet with SFace loss) | Apache-2.0 (the model directory) | Not stated in the zoo; the paper trained on CASIA-WebFace, VGGFace2 and MS-Celeb-1M | 112×112, fp32 and int8 ONNX; the zoo reports 0.994 on its own evaluation | Made to pair with YuNet's 5 landmarks. Smallest step to a working pipeline; data provenance unclear. |
+| **EdgeFace** XXS / XS / S / Base (Idiap) | BSD-3-Clause code; weights listed as BSD-3 by a third party | WebFace260M subsets (4M, 12M), terms not found | 1.2–18 M parameters; LFW 99.57–99.83 %, CPLFW 90.3–93.8 % | Won the compact track of the IJCB 2023 efficient face recognition competition; ONNX ports exist. Best accuracy per FLOP. |
+| **AuraFace v1** (fal) | Apache-2.0 | "A commercial dataset" (not named) | The recogniser `glintr100.onnx` is 261 MB; LFW 0.9965, CPLFW 0.909 | The only one that says its data allows commercial use. Too big as a default on a Raspberry Pi; an optional download. Its repository also carries InsightFace's SCRFD detector, which is *not* covered by that. |
+| ArcFace (ONNX Model Zoo), FaceNet ports | Apache/MIT on the files | MS1M / VGGFace2 / CASIA (research terms; MS-Celeb-1M was withdrawn) | — | Same data problem as SFace, and larger. |
+| InsightFace packs (buffalo_l, antelopev2, …) | **Non-commercial research only** | — | — | Not usable. |
+
+**Prior art, Frigate** (its source, `dev` branch, 2026-10-10): faces are only looked for inside a
+`person` box. Detector: YuNet through OpenCV (`cv2.FaceDetectorYN`, a 100 kB file), plus OpenCV's
+LBF landmark model (56 MB) to align onto the ArcFace 5-point template. Recognisers: *small* =
+FaceNet (TFLite, 94 MB, CPU), *large* = an ArcFace ONNX of 261 MB (the size of the glintr100
+network that AuraFace uses; which weights it is was not checked) for GPU/NPU. All four files are
+downloaded on first use from one GitHub release, tagged Apache-2.0, that names no source or
+training data. Matching: one mean embedding per person (outliers below cosine 0.3 dropped, then a
+trimmed mean), cosine to it, mapped to a confidence by a sigmoid; a name needs several consistent
+recognitions, larger faces weigh more, blurry ones less. Its docs advise 20–30 varied photos per
+person and warn that bulk-adding similar ones overfits.
+
+**Leaning:** prototype with **YuNet + SFace** (both from OpenCV Zoo, made to fit together, tiny)
+and **EdgeFace-XS** as the second recogniser, with AuraFace as the accuracy reference. Before
+anything ships, a decision on the training-data question (§10, question 1). Sizes in the OpenCV
+Zoo: SFace 38.7 MB fp32 and 9.9 MB int8; YuNet well under 1 MB.
+
+## 5. Privacy and the law
+
+Not legal advice; the points to design for, and to say plainly in DOCS.md.
+
+- **Biometric data.** A face template used to identify someone is special-category data under
+  GDPR Art. 9. A private person's camera is only outside GDPR under the household exemption, and
+  the CJEU (*Ryneš*, C-212/13, 2014) held that a home camera that also covers public space (a
+  street, a neighbour's door) is not purely household use. Norway follows GDPR through the EEA.
+- **EU AI Act.** Read in the Act and in the Commission's *Guidelines on prohibited AI practices*
+  (C(2025) 884, 2025; non-binding but the Commission's reading):
+  - **The user is outside the Act.** It does not apply to the obligations of deployers who are
+    natural persons in a purely personal, non-professional activity (Art. 2(10)). The guidelines
+    give almost exactly our case as the example: *"an individual using a facial recognition system
+    at home (e.g. to control access and to monitor for safety the entrance to the home) would fall
+    under the exclusion"* (para. 34).
+  - **The software itself stays in scope** for whoever provides it (para. 35: a system used for
+    personal purposes "remains a high-risk AI system as classified in Article 6"). Recognising
+    household members on a general camera, who do not step "actively and consciously in front of
+    a camera installed in a way fostering active participation" (para. 306), fits *remote
+    biometric identification* (Art. 3(41)), which is high-risk (Annex III, point 1(a)). One-to-one
+    *verification* and access control to premises are not "remote" (para. 305) — a doorbell that
+    recognises the person ringing is closer to that, but VisionState does not limit itself to it.
+  - **But the Act binds providers who place a system on the market or put it into service**, and
+    "making available on the market" means supply "in the course of a commercial activity, whether
+    in return for payment or free of charge" (Art. 3(10)). Recital 103 says making components
+    available through open repositories is not in itself monetisation; the Commission's guidance
+    for the Cyber Resilience Act, built on the same product-law terms, says sharing free and open
+    source code on a public repository is not placing it on the market. VisionState is free, has no
+    paid tier, no paid support and no telemetry. On that reading it is not placed on the market at
+    all, so the high-risk duties do not reach it; the open-source exemption of Art. 2(12) is then
+    not even needed (it excludes high-risk systems).
+  - **What would change it:** monetising VisionState (a paid version, paid support, a company
+    selling it or bundling it in a product). Then face recognition would need the high-risk route
+    or must be left out.
+  - Timing: the Annex III obligations apply from 2 December 2027 after the "Digital Omnibus"
+    (Regulation (EU) 2026/1744, per secondary sources). The Commission's draft guidelines on
+    high-risk classification (May 2026) are to be checked once final; on 2026-10-12, before face
+    recognition reached the stable channel, no final version was found — only the draft of 19 May
+    2026 — and nothing in the draft changes the verdict below.
+  - The Art. 5 prohibition on *untargeted* scraping of facial images from the internet or CCTV to
+    build or expand recognition databases applies to everyone: VisionState must never grow a
+    gallery of strangers by itself.
+  - Others ship the same feature today (Frigate, commercial home cameras); that shows practice, not
+    what applies from December 2027 — Frigate's maker also sells a subscription, VisionState sells
+    nothing.
+  - **Verdict for the plan (not legal advice):** low risk for a free, non-monetised project;
+    building phases 0–2 is fine (the maintainer's decision, 2026-10-10). Before face recognition
+    reaches the stable channel, re-read the final high-risk guidelines.
+- **Norway:** Datatilsynet's guidance for private cameras: your own house and garden only, not
+  public areas where people pass, and not a neighbour's property. The AI Act comes to Norway through
+  the EEA.
+- Elsewhere other rules apply (e.g. Illinois BIPA); the docs tell the user it is their
+  responsibility, as for any camera.
+
+Design rules that follow:
+
+1. **Off by default**, switched on per sensor with a short explanation of what is stored. The
+   people taught are the user's household and guests; the docs say they should know, children
+   included.
+2. **Only taught faces are a gallery, and only a human adds to it.** A recognised face is never
+   added to the person's faces by itself (that drifts: one wrong match teaches the next one).
+   Unknown faces are not stored as templates; they only live in history frames, under the normal
+   history limits (`history_days`, `history_max_gb`).
+3. **Faces are kept where only the app can read them.** Training images live in `/media`, which
+   Home Assistant's media browser shows to every user of the house; taught face crops go to the
+   app's own `/data` instead. That puts them in Home Assistant backups — say so in DOCS.md, and that
+   backups should be encrypted.
+4. **Embeddings are biometric data too.** Published attacks rebuild a recognisable face from an
+   ArcFace-style template, so the cached embeddings are deleted with the person and never exported
+   (an import computes them again).
+5. **Forgetting is complete:** deleting a person deletes their face samples, crops and cached
+   embeddings; switching the feature off offers to delete everything.
+6. **Export:** sensor bundles include taught faces only when the user ticks it; the readings export
+   is unaffected. No face ever leaves the machine otherwise (no telemetry, as always).
+7. **Not a security function.** No liveness check: a photo of a face is that face. DOCS.md says
+   not to unlock doors or disarm alarms on it alone.
+8. Infrared night images, masks, hats and sunglasses make recognition worse; the docs say so and
+   the Quality tab shows it (§9.5).
+
+## 6. Plan
+
+| Phase | What | Done when |
+|---|---|---|
+| **0. Spike** (local, `/VisionStateLocal/`) | Frames from real doorbell/driveway cameras of the household (with their consent), at the camera resolution Home Assistant actually delivers. Measure: how often a usable face is found in a person box per pass; detectors (YuNet, BlazeFace) on person crops; recognisers (SFace, EdgeFace-XS/S, AuraFace) against **DINOv2 on the box** as the baseline: true matches at a fixed false-match rate, the gap between same-person and other-person similarities, day vs IR. Time per face on a desktop CPU and a Raspberry Pi 4. Read the weights' and data's terms; ask the authors where unclear. | A detector and recogniser chosen with numbers, the minimum face size and thresholds proposed, and a written verdict on licences. Or a "not good enough at typical camera distances" verdict, which is a valid outcome. |
+| **1. Faces only** | A face registry (detectors and recognisers, pinned like the others), face search in person boxes, face boxes drawn in the Live tab, no identities. | Users can see whether their camera gives usable faces before teaching anything. |
+| **2. People** | Recognise faces on an object sensor; teach a face from the Live tab or history ("Who is this?" → a person, new or existing); matching, ask band, entities per person and *unknown person*; Forget person. | A person is recognised on a test with CC0 / public-domain photos (below) and on the spike data. |
+| **3. Quality and review** | Review questions ("Is this Kari?"), Quality tab per person (faces taught, similarity between people — look-alikes —, possibly mislabelled faces), history filter by person, import/export with the opt-in. | e2e tests on desktop, mobile and iPhone. |
+| **4. Later** | Teaching from uploaded photos of a person (face found in the photo); a Home Assistant *event* entity "person recognised" for automations; the face from several checks combined per visit. | — |
+
+**Test images.** Tests need several photos of the same real person that are CC0 or in the public
+domain. Works of the US federal government are public domain (e.g. NASA astronaut portraits: several
+photos per person); the sources go in `tests/assets/README.md` as usual. Personal photos of the
+household stay in `/VisionStateLocal/` and never enter the repository, a test or a model.
+
+## 7. Where it would go in the code
+
+Following the existing structure (names are proposals):
+
+- A face registry next to `detectors.json` and `readers.json` (a detector and a recogniser per
+  entry), and a face module next to `teach.py`: crop, detect, quality gate, align, embed.
+- Loading in `engine/models.py` (loaded on first use, released when no sensor uses it, as the
+  detector and reader are); the per-check step in `engine/objects.py` after counting, the taught
+  faces index next to the taught boxes in `engine/teaching.py`.
+- Settings: a face block in `settings.py` (minimum eye distance, blur limit, thresholds, max faces
+  per check), and `recognise_faces` in `settings.OBJECT_DEFAULTS`; all exposed through
+  `GET /api/v1/config`.
+- Data: taught faces are `sample` rows with `object_label` = the person's key, the face box and
+  landmarks, and a crop of the face **with a margin, not aligned** (in `/data`, §5): another
+  recogniser may need another template or size (FaceNet takes 160 px, the ArcFace family 112), so
+  changing the model must be able to align again from the stored crop. Their embeddings are cached
+  under their own `roi_key`. A schema migration only if the box and landmarks do not fit the
+  existing columns.
+- Entities: each person is an own label, so its binary sensor and count already exist; *unknown
+  person* and the later event entity are new, with new unique IDs that never change.
+
+## 8. The model is downloaded only when someone turns it on
+
+Nothing about faces is in the app image, and nothing is downloaded or loaded until a user turns on
+**Recognise faces** for a sensor and confirms it. This is the mechanism the optional models already
+use, extended by one step:
+
+- **Today:** a registry entry with `"bundled": false` is fetched by `backbones.download` (to
+  `/data/models`, kept out of Home Assistant backups, checked against its SHA-256, refused when it
+  does not match) when it is chosen under **Settings → AI model**, where the choice reads
+  "… · download 21 MB". The detector and the reader are loaded on first use (`ensure_detector`,
+  `ensure_reader`), and the status rows say "loaded when …" until then.
+- **For faces:** the face registry's entries are never bundled. Turning faces on for the first
+  sensor downloads the chosen face model (detector and recogniser) and loads it; turning off the
+  last sensor that uses it releases it from memory. The file stays in `/data/models`, so turning it
+  on again is instant and needs no network; **Settings → AI model** can delete it while no sensor
+  uses it (a new button; the other models have no such need, they are small or bundled).
+- **While it downloads** the sensor keeps working as an object sensor without faces. Today a
+  download shows only "Switching (may download)…"; the face model is larger, so the status reports
+  progress (bytes so far / size), and the sensor shows it (§9).
+- **When it fails** (no internet, a checksum that does not match): the sensor's face card shows the
+  error and **Try again**; the status row *Face model* shows it in red, as the other models do.
+  Without internet the user can put the file in `/data/models` by hand; the error names the file
+  and its source.
+- **Import:** a sensor imported with taught faces gets the faces but not the feature: face
+  recognition stays off until the user turns it on there (with the same confirmation and download).
+
+## 9. User interface
+
+Built from the pieces object sensors already have, so nothing is new to learn: the teach sheet
+(tap a box), *Is this …?* in the review queue, the Quality tab that appears once something was
+taught, the *What you taught* card on the Settings tab, own labels with their entities, and
+**Settings → AI model**. Everything works by tap (phones and tablets first, no hover or keyboard
+needed), and all texts below are proposals. Model names and sizes in them are examples until phase 0
+has chosen the model.
+
+### 9.1 Where it is switched on
+
+- **Not in the new-sensor wizard.** The wizard stays short; when `person` is among the chosen
+  objects, one line under it says *"Later you can teach it to recognise people by their face
+  (Settings tab)."* Turning on a biometric feature deserves its own decision, not a step in a flow.
+- **Sensor → Settings tab, card *Faces*** — only on object sensors that look for `person`
+  (otherwise the card says *"Add Person to the objects to recognise faces."*). While off:
+
+  > **Recognise people by their face**
+  > Name the people you know; each gets an on/off sensor in Home Assistant.
+  > [ Turn on… ]
+
+- **Turn on…** opens a sheet (the teach sheet's layout: a bottom sheet on phones, a dialog on
+  desktop) that says what happens before anything is downloaded:
+
+  > **Recognise faces on *Front door*?**
+  > - Faces are looked for only in people this sensor finds, and compared with faces **you** name.
+  > - Stored on this Home Assistant only, in the app's own storage (not the media folder): a small
+  >   picture of each face you teach. Faces of people you have not named are not kept, apart from
+  >   the normal history frames. The people you teach should know about it.
+  > - Needs the face model *YuNet + SFace* (Apache-2.0, 38 MB), downloaded once from Hugging Face.
+  > - Cameras that see a street or a neighbour's door may need their consent where you live.
+  >   *Read more* (DOCS.md).
+  > - It is not a lock: a photo of a face looks like that face.
+  >
+  > [ Download and turn on ]  [ Cancel ]
+
+  The model name, licence, size and source come from the registry through `GET /api/v1/config`,
+  never from the UI. When the model is already downloaded the button is just **Turn on**.
+- **After confirming** the card shows the download (*"Downloading the face model… 12 of 38 MB"*,
+  a thin progress bar) and then the card's normal state (§9.6). Leaving the page does not stop it.
+
+### 9.2 Seeing faces before teaching anyone
+
+The first question a user has is *does my camera see faces well enough?* — answer it before
+asking them to teach.
+
+- **Live tab:** inside each person box a small face box is drawn (rounded, in the person's colour)
+  when a face was found. A person box without a usable face gets a quiet tag in the *Right now*
+  list: *"Person · face too small"*, *"… · face turned away"*, *"… · face blurry"*, *"… · no face
+  seen"* — the quality gate's reasons, in words.
+- **Faces card** (Settings tab) and the top of the Quality tab: *"A usable face in 9 of the last
+  40 people seen."* When that share is low, a hint names the likely fix: a camera closer to where
+  faces are, a higher resolution (an RTSP source instead of the snapshot), more light.
+
+### 9.3 Teaching a person
+
+- **Tap a person box** (Live tab or a history frame) → the teach sheet. With faces on, its
+  close-up shows **the face**, not the whole body (on a phone the face is a few pixels in the
+  frame), and a section comes first:
+
+  > **Who is this?**
+  > [ Kari ] [ Ole ] [ + New person… ]
+  > Not someone you know? Close this.
+
+  The existing choices (*Not a person*, *Something else…*) stay below it.
+- **No usable face in the box:** the section says *"No clear face here — pick a moment where the
+  face is visible"* and offers no names: a person is only ever taught from a face. That keeps a back
+  or a jacket out of someone's faces.
+- **New person…** asks for a name (as **New label…** does) and explains: *"Gets an on/off sensor
+  and a count in Home Assistant."* People are own labels under `person`, marked as taught by face,
+  so the existing own labels made from whole boxes keep working beside them.
+- **After teaching** a toast says what it learned and what helps: *"Got it: this is Kari (1 face).
+  A few more, in other light and angles, make it reliable."* Up to the number the docs recommend,
+  each teach says how many faces the person has.
+- **More than one person in a frame:** each box is taught on its own, as today.
+
+### 9.4 When it is not sure: the review queue
+
+- **"Is this Kari?"** — the same review card as own labels, but with the **face close-up beside the
+  frame** (stacked on phones) and, beside it, one of Kari's taught faces to compare with. The card
+  of own labels says *"It looks 82 % like …"*; a face model's cosine (OpenCV's SFace demo already
+  calls 0.363 the same person) would read as nonsense there, so faces say *"probably"* / *"not
+  sure"* instead of a number. Answers: *Yes, Kari* · *No, it is …* (chips of the other people and
+  **New person…**) · *Skip*. A *yes* or *no* teaches that face.
+- **"Who is this?"** for faces that match nobody is **off by default** (the Faces card: *Ask me
+  about faces I do not know*): it keeps frames of strangers longer (review frames get twice the
+  history time), so it is the user's choice. Answers: the people chips, **New person…**,
+  **Don't know** (removes the item, teaches nothing).
+- Limits as today: one waiting question per person, a cooldown, none with review off.
+
+### 9.5 The Quality tab: People
+
+A section **People** above *What you taught* (the tab appears once a person is taught, as now):
+
+- One card per person: name, the number of faces and a strip of the taught face crops (tap one to
+  see the frame it came from; **×** forgets that face), *last seen 5 min ago*, and a simple meter —
+  *1–4 faces: "teach a few more"*, enough: none.
+- **Look-alikes:** when two people's faces come close (the closest pair of taught faces above a
+  setting), a notice on both cards: *"Kari and Eva look alike to the AI — teach both in more
+  light and angles."*
+- **Possibly mislabelled:** a taught face that is closer to another person than to its own gets a
+  badge (as mislabelled samples do on state sensors), with *Move to Eva* and *Forget*.
+- **Remove person** (tap again to confirm): their faces, their entities in Home Assistant, gone.
+
+### 9.6 The Faces card when on (sensor Settings tab)
+
+- **Recognise faces** (on/off). Off keeps what was taught for later, as **Use what you taught**
+  does; the entities of people stay but report off.
+- **Ask me about faces I do not know** (off by default, §9.4).
+- **Smallest face** — a slider like *Smallest object*, in pixels between the eyes, defaulting from
+  the face settings in `settings.py` (the value is never in the UI).
+- **Forget all faces** (tap again to confirm): every taught face and person, their entities, and
+  the cached face embeddings. **Forget all** of *What you taught* forgets faces too.
+- The model line: *"YuNet + SFace · 38 MB · change under Settings → AI model."*
+
+### 9.7 Settings → AI model and Status
+
+- A field **Faces (object sensors)** with the face models (*"… · download 38 MB"* while not
+  downloaded), the licence and source as for the detector, and *"Downloaded when a sensor turns on
+  face recognition."* Changing it re-embeds every taught face (as a new state backbone retrains),
+  so the confirmation says so; people are kept.
+- A status row **Face model**: *loaded when a sensor recognises faces* / its name / the download
+  progress / the error in red.
+- **Delete downloaded file** next to it while no sensor uses faces.
+
+### 9.8 Home Assistant, history and export
+
+- **Entities:** each person is an on/off sensor and a count (an own label); **Unknown person** is
+  one more on/off sensor per sensor, made when faces are turned on. The *In Home Assistant* card on
+  the Live tab lists them, as it does for classes.
+- **History:** people are in the *What* filter like own labels; a row of a person shows the face
+  close-up.
+- **Export:** for a sensor with taught faces, **Export** asks first: *Include the taught faces (N)*
+  — unticked by default. Without them the bundle carries the people (names) but no faces.
+
+### 9.9 Testing the UI
+
+As every UI change (CLAUDE.md, *UI testing routine*): e2e tests on desktop, mobile and iPhone for
+the turn-on sheet (with a face model served by the test, never a real download in CI), teaching a
+face from the Live tab, the review card, the People section and forgetting; and by hand at desktop
+width and ~390 px. The fake camera would need a frame with faces: public-domain photos (§6).
+
+## 10. Open questions for the maintainer
+
+1. **Licence bar.** Ship only weights whose training data allows any use (today: AuraFace, and
+   perhaps BlazeFace), or accept models like YuNet/SFace whose code licence is permissive but
+   whose training data is research-only? A middle way: never bundle such a model, download it on
+   demand after the user accepts its terms (as the optional models are downloaded today).
+2. **Default target:** must face recognition run on a Raspberry Pi 4, or is it fine as
+   "desktop/NUC recommended"?
+3. **Camera resolution:** Home Assistant's camera proxy often gives a reduced snapshot; does a
+   doorbell at 2–4 m give enough pixels per face? Phase 0 answers it; maybe an RTSP source per
+   sensor becomes the recommendation for faces.
+4. **Unknown person:** only an entity, or also a review item ("Who is this?") — which stores the
+   frame longer under review retention?
+5. **Where to switch it on:** only on the sensor's Settings tab after a confirmation (§9.1), or
+   also in the new-sensor wizard? The plan keeps it out of the wizard.
+
+## 11. Pitfalls to avoid
+
+Collected from the research, from how others built it, and from VisionState's own history.
+
+- **Every check is another chance of a false match.** A false-match rate per comparison is
+  multiplied by the checks per visit (bursts!) and by the number of people taught. So a name needs
+  agreement across checks (§3 step 7), the margin over the next person matters as much as the
+  threshold, and thresholds are measured at a false-match rate per *visit*, not per image.
+- **"Unknown" from a bad face.** Without the quality gate every family member seen from the side
+  becomes *unknown person* — a false alarm in an automation. A face that fails the gate is no face.
+- **Learning from its own answers.** Adding recognised faces to the gallery automatically drifts
+  towards wrong people (the wheel reader plan's rule: only human answers are labels). Frigate's
+  docs also warn that bulk-adding similar faces overfits.
+- **One threshold for all models.** Similarities of different models are not comparable; each
+  model's thresholds live with its registry entry and are measured on our data.
+- **Faces that are not people at the door:** a TV, a poster or a framed photo in view. The region
+  (ROI) and the person detector's size limits keep most out; the docs mention it.
+- **Children, and time.** Recognition is weaker for children, and their faces change quickly. The
+  Quality tab shows how old each person's taught faces are and suggests adding recent ones.
+- **Night and infrared.** Greyscale IR frames match colour faces worse. Measure it in phase 0; if
+  needed, keep separate day and night faces per person (the history already knows a greyscale
+  frame).
+- **Unequal accuracy across groups of people.** Public models are less accurate for some skin
+  tones and ages; the docs say so instead of promising one accuracy.
+- **A low-resolution snapshot.** The camera proxy may scale the frame down; then no face is ever
+  usable. The Live tab's face reasons (§9.2) make that visible instead of failing silently.
+- **Licence by repository label.** A repository tagged Apache-2.0 says nothing about the data
+  behind the weights (Frigate's model release names none). Read the model card and the data's
+  terms before a model enters the registry.
+- **Polling while a face model loads.** A large model loaded in the event loop would freeze the
+  UI; load it in a worker thread like the others, and never let a failed download stop the
+  sensor's loop (CLAUDE.md: long-running loops survive any exception).
+
+## 12. Decisions and the build
+
+The maintainer's answers to §10 (2026-10-11):
+
+1. **Licence bar:** both, the user chooses. **SFace** (default, small) and **AuraFace v1** (the
+   only one whose makers say its data allows commercial use; for a fast PC) are recognisers in
+   `faces.json`; **YuNet** finds the faces for both (the AuraFace repository's SCRFD detector is
+   not covered by its licence). None is bundled; the confirmation sheet and Settings → AI model
+   state each one's licence and training data. BlazeFace (a detector with Google's own data)
+   needs an ONNX conversion checked on real photos — not done.
+2. **Raspberry Pi 4 is the target** for the default: SFace with YuNet, at most
+   `FACES["max_faces"]` faces per check in one detector run.
+3. **Phase 0 was skipped**: no household frames yet. Thresholds were set from the NASA test photos
+   (`tests/assets`, both recognisers: same person 0.59–0.95, different people at most 0.30) and the
+   minimum face from the recognisers' input (the eyes are about 35 px apart in a 112 px aligned
+   face, so a default of 20 px). They are tried on real cameras on the dev app and adjusted there.
+   The first try (a phone as a 480 × 640 RTSP camera in a living room) changed three things: the
+   smallest face is the width of the face box (`min_face_px`), as the eyes come together when a
+   head turns and a turned face was called too small; faces a bit more turned may be named
+   (`FACES["max_turn"]`), while only a clearly seen face can make an *unknown person*; and the
+   sharpness limit was lowered, as at 112 px it also rejected sharp faces about 14 px between the
+   eyes, where the recogniser still told the person from a stranger. A second try (the phone
+   moved around, someone leaning into it) added *cut*: a face cut by the frame's edge got eyes
+   guessed outside the picture and looked like nobody (0.15), which could have made the user an
+   unknown person.
+4. **Unknown person** is an entity; "Who is this?" is a review item only with **Ask me about faces
+   I do not know** on (off by default).
+5. **Only on the sensor's Settings tab**, after the confirmation; the wizard only says it exists
+   (changed later: the wizard can turn it on too, after the same confirmation — see below).
+6. Built as phases 1–3 together.
+
+Where the build differs from §3–§9:
+
+- YuNet's ONNX file has a fixed 640 × 640 input: four head regions are tiled into one run.
+- A face found from two overlapping person boxes counts for the first one only.
+- The face close-up in the teach sheet and the review card is cut from the frame by the UI; a
+  taught face's crop is not linked back to the frame it came from (§9.5 "tap one to see the
+  frame" is not built), and a history row of a person shows the frame, not the face.
+- History has no extra filter for people: people are own labels, so the *What* filter already
+  lists them, and *Unknown person* with them.
+- Separate day and night faces per person (§11) are not built. Of phase 4, only teaching from
+  photos is: a person's photos, a short video or a ZIP on the **People** page (origin `upload`).
+- After the first tries the maintainer asked for: the faces' limits (smallest face and the four
+  similarities) set for all sensors under **Settings → Recognising faces** and per sensor, like the
+  teaching limits (§9.6 had only *Smallest face*, per sensor); turning faces on in the wizard too
+  (§5 had it on the Settings tab only); and the face model listed right after the object detector,
+  its file deleted like any other downloaded model under *Compare and manage the models* (§9.7's
+  own *Delete downloaded file* button is gone).
+- **The people are shared** by every sensor (the maintainer, after the first doorbell test): a
+  person taught on one camera is known on all that recognise faces, listed on a **People** page
+  (renamed and forgotten there, and on each sensor's Quality tab), and has their own entity saying
+  which sensor sees them now. Deleting a sensor keeps the faces taught on it. §9's per-sensor
+  people and *Forget all faces* on the Faces card are replaced by this.
+- **A backlit doorbell** (the maintainer's, 2026-10-12: 2560 × 1920 fisheye, half of it sky). The
+  person was found in nearly every frame, and the face was usable (67–73 px) from about two metres,
+  but against the bright sky it was nearly black: its SFace embedding was 0.30–0.51 from the faces
+  taught earlier and only 0.15–0.53 from one taken seconds before, so it was named late and asked
+  about rarely. Two changes, measured with the faces of one walk taught and those of a second walk
+  as queries (CC0 NASA faces as other people):
+  - the face's brightness is evened out before it is embedded (`faces.even_light`, a histogram
+    equalisation of its luminance): named right from 39 % to 64 %, all of them at least in the ask
+    band (86 % before), and other people less alike (the highest from 0.30 to 0.26; Williams
+    2006–2018 0.64 → 0.63, Williams–Wilmore 0.09 → 0.01);
+  - SFace's `ask_similarity` from 0.38 to 0.32, so an uncertain face of a taught person becomes a
+    question (and an answer a taught face) instead of *not sure who*.
+  Faces taught on the camera itself, in its own light, still help most: answering the questions is
+  how a camera learns someone.
+- **After walking up to that doorbell** (the same day): the face of someone walking up was usable
+  for about three seconds, often between two regular checks, so a sensor that recognises faces now
+  checks about every second while a person nobody is named for is there and coming closer
+  (`engine.logic.steer_face_burst`, `FACES["burst_*"]`); it asks about a person up to
+  `FACES["ask_burst"]` times per review cooldown, and an answer opens the next question at once.
+  What is taught from a history frame or an answer is written into that row and the same
+  moment's rows (*Taught: Ole*) and counts as last seen then; "last seen" is read back from the
+  history at start. Each person has two entities: *Ole seen by* (the sensor that sees them now)
+  and *Ole last seen* (a timestamp) — their own name alone was easily taken for Home Assistant's own person entity.
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
new file mode 100644
index 0000000..7b3c323
--- /dev/null
+++ b/docs/RELEASING.md
@@ -0,0 +1,120 @@
+# Releasing
+
+Branches, channels, versions and the release steps. How to work on the code is in
+[`CLAUDE.md`](../CLAUDE.md).
+
+## Channels and branches
+
+| | Stable | Beta |
+|---|---|---|
+| Branch | `main` (branch-protected; changes only by promoting a tested beta) | `beta` (every change lands here first, directly or by a PR to `beta`) |
+| Home Assistant repository | `https://github.com/oleost/VisionState` | `https://github.com/oleost/VisionState#beta` |
+| App name | VisionState | VisionState (beta) |
+| Version | `X.Y.Z` | `X.Y.ZbN` |
+| Images | `ghcr.io/oleost/visionstate-{amd64,aarch64}:X.Y.Z` (+`latest`) | `…:X.Y.ZbN` (+`beta`) |
+| Media folder | `/media/visionstate` | `/media/visionstate_beta` |
+| GitHub release | latest | pre-release |
+
+- **Changes go to `beta`.** The maintainer commits and pushes straight to `beta` (after the local
+  checks): config.yaml keeps its version, so Home Assistant users get nothing new until the next
+  tag, and a PR would only run CI twice. Contributors and Dependabot open a PR against `beta`. Edit
+  `visionstate/DOCS.md` together with the feature it describes: the app's Documentation tab may
+  show it from the repository before the feature is released.
+- **Never commit to `main` directly.** Documentation-only changes (Markdown, images, issue
+  templates) may go to `main` through a PR without a beta; merge `main` back into `beta` afterwards.
+- `scripts/channel.py` is the only way to change the name, version and channel fields in
+  `visionstate/config.yaml`.
+- Home Assistant pulls prebuilt images (`image:` in config.yaml), so a version must never reach a
+  branch before its images exist. CI refuses tags that do not match config.yaml and branches that
+  carry the wrong channel.
+- The slug (`visionstate`), the MQTT discovery prefix and node id (`homeassistant` / `visionstate`)
+  and every `unique_id` never change: entity IDs in Home Assistant hang on them.
+
+## What CI does
+
+On every push to `main`/`beta`, every PR and every tag (`.github/workflows/ci.yml`): backend
+(ruff, pyright, pytest with coverage ≥ 88 % — the docs check included —, the app options check
+`scripts/check_options.py`, `pip-audit`), frontend (`svelte-check`, build, `npm audit`), e2e on
+desktop, Android and iPhone (WebKit), then both images built on native runners and tested: a smoke
+test against a real MQTT broker (start, discovery, the memory peak with all three models under
+`MEMORY_LIMIT`, a clean `docker stop`), `scripts/cpu_probe.py` under an emulated old CPU (amd64
+`kvm64`, aarch64 `cortex-a53`) and `scripts/upgrade_test.sh` (from the last stable release and
+back). The audits only warn on betas and block stable releases. Only a version tag publishes the
+images; a beta tag then also creates the pre-release from the changelog entry and fast-forwards
+`beta`.
+
+If a tag's CI fails, nothing was published: delete the tag (`git push origin :refs/tags/vX.Y.ZbN`,
+`git tag -d …`), fix, and tag the same version again. When unsure, run CI first on a temporary
+branch with a draft PR against `beta` and close it afterwards.
+
+## Beta release
+
+On `beta`, about 10 minutes, unattended after the tag.
+
+0. **The maintainer says "go" first.** Run the local checks (backend, frontend, e2e, hands-on in a
+   browser; see `CLAUDE.md`), start a local instance for the maintainer to try (fake camera +
+   backend with seeded sensors), give the URL of the changed screens, sum up what was done and show
+   the release notes (the new `CHANGELOG.md` entry). Commit, version and tag only after an explicit
+   "go".
+1. `python scripts/channel.py beta X.Y.ZbN`, add a `## X.Y.ZbN` entry to `visionstate/CHANGELOG.md`
+   (it becomes the release notes), commit. Do **not** push `beta`.
+2. `git tag vX.Y.ZbN && git push origin vX.Y.ZbN` (**tag only**); `gh run watch` follows it.
+3. `git fetch origin && git status` — local `beta` should equal `origin/beta`. If the release
+   changed a file under `.github/workflows/`, CI may not push the branch: run `git push origin beta`
+   yourself once the images exist (the registry answers 200 for
+   `https://ghcr.io/v2/oleost/visionstate-<arch>/manifests/X.Y.ZbN` with an anonymous pull token).
+   A tagline for the release title is optional: `gh release edit vX.Y.ZbN --title "X.Y.ZbN — …"`.
+
+## Before promoting a beta to stable
+
+There is no separate release candidate: the beta being promoted is checked as it is. Go through
+all of it and tell the maintainer what was checked and what was found.
+
+1. **CI on that beta is green**, including what only blocks stable releases (the audits).
+2. **On the test Home Assistant** (a Home Assistant OS VM with the beta app installed):
+   - update the beta app to the beta being promoted; the standing test sensors (one of each kind)
+     keep working, their entities keep their IDs, the log has no warnings or errors;
+   - restart Home Assistant, reboot the host and restart the MQTT broker: the app and its entities
+     come back by themselves;
+   - make a backup of the app and restore it: the sensors are back;
+   - **soak for 1 hour** with the sensors checking: the app's memory (Supervisor app stats) and its
+     data on disk level off instead of growing, the log stays quiet;
+   - open the app in Home Assistant at desktop width and on a phone (Ingress);
+   - prepare the **update from the last stable release**: the stable app is installed there too. It
+     shares MQTT topics and unique IDs with the beta app, so never run both: stop the beta app,
+     start the stable one, and give it one sensor of each kind (exports of the standing test sensors,
+     or `scripts/seed_demo.py --app <slug>` once the stable release can teach faces from photos).
+3. **What changed since the last stable release**: new or upgraded dependencies have a licence that
+   fits Apache-2.0 (`git diff vX.Y.Z -- visionstate/backend/requirements.txt
+   visionstate/frontend/package.json`); `homeassistant:` in config.yaml still names the oldest Home
+   Assistant that works; the docs describe what is being released (the roadmap in `SCOPE.md` and
+   the status in `WHEEL_READER_PLAN.md` included), and the README screenshots show today's app
+   (`docs/promo/`, how to take them in `CLAUDE.md`).
+
+## Promote to stable
+
+Only when the maintainer says the beta is tested, after the checks above.
+
+1. `git switch -c promote/X.Y.Z beta`; `python scripts/channel.py stable X.Y.Z`; in the changelog,
+   merge the `X.Y.ZbN` entries into one `## X.Y.Z` entry; commit.
+2. `git merge origin/main`; if `visionstate/config.yaml` conflicts, re-run
+   `python scripts/channel.py stable X.Y.Z`; commit.
+3. `git tag vX.Y.Z && git push origin vX.Y.Z` (tag only); wait for the images.
+4. Push the branch, open a PR to `main`, wait for CI, merge it. Right away, update the stable app on
+   the test Home Assistant (reload the store): its sensors keep working, their entities keep their
+   IDs, the log has no warnings or errors. Only then `gh release create vX.Y.Z --latest`; stop the
+   stable app and start the beta app again.
+5. Merge `main` back into `beta`, keeping beta's config: `git switch beta && git merge main`, then
+   `python scripts/channel.py beta <last beta version>` and commit (a beta version whose images
+   exist); the next beta release sets the next version.
+
+## Dependencies and platforms
+
+- Dependabot opens one grouped PR per ecosystem monthly, against `beta`.
+- Python is **3.14** everywhere (Dockerfile image, CI `setup-python`, ruff `target-version`, the
+  local `.venv`). Upgrade all of them together; Dependabot ignores Python image upgrades for that
+  reason.
+- **Old CPUs and virtual machines must keep working** (x86-64-v1, e.g. Proxmox `kvm64`; ARMv8.0,
+  e.g. Raspberry Pi 3/4 and Home Assistant Yellow with CM4). NumPy is pinned below 2.4 because newer
+  wheels need x86-64-v2 (found through issue #29; Dependabot ignores them). When `cpu_probe.py`
+  fails after a dependency update, that update needs a newer CPU — keep the old version.
diff --git a/docs/SCOPE.md b/docs/SCOPE.md
index bec8c93..0ac105a 100644
--- a/docs/SCOPE.md
+++ b/docs/SCOPE.md
@@ -1,8 +1,9 @@
 # Scope & Design Decisions
 
-> Describes VisionState **as built** (stable 0.6.3, 2026-10-05) and the open
-> ideas. Update it whenever a decision changes.
-> Project: **VisionState** · Licence: Apache-2.0 · Repository: `github.com/oleost/VisionState`
+> The design as built, the decisions behind it, and the roadmap. Update it in the same change as
+> the decision. How to use the app: [`visionstate/DOCS.md`](../visionstate/DOCS.md); where the code
+> is: [`ARCHITECTURE.md`](ARCHITECTURE.md); channels and releases: [`RELEASING.md`](RELEASING.md).
+> Setting names below are keys in `settings.py`, which holds their values.
 
 ## 1. Vision
 
@@ -13,8 +14,8 @@ the matching state on a live image, or by bulk-uploading images/video. Everythin
 locally, on any CPU, with a polished UI inside Home Assistant.
 
 A second sensor kind, **object sensors**, finds common objects (people, cars, animals …) with a
-pretrained detector, and a third, **reading sensors**, reads a number from a display with a
-text recognizer. Neither needs training.
+pretrained detector, and a third, **reading sensors**, reads a number from a display or the wheels
+of a meter. Neither needs training.
 
 ## 2. Goals / Non-goals
 
@@ -31,7 +32,7 @@ text recognizer. Neither needs training.
 - Tracking objects across frames (identities, paths, line crossing), zones within one sensor,
   custom-trained detectors.
 - Multi-label sensors (the data model allows this later, see §10).
-- Reading pointer dials (needle gauges, the small red hands on some water meters) — see §16.
+- Reading pointer dials (needle gauges, the small red hands on some water meters) — see §14.
 - Cloud training or cloud inference; telemetry of any kind.
 - armv7 / i386 (deprecated by Home Assistant).
 
@@ -39,7 +40,7 @@ text recognizer. Neither needs training.
 
 | Term | Meaning |
 |---|---|
-| **Sensor** | One thing to recognise, e.g. "Garage door". Becomes one HA device with entities. Its **kind** is `single_state` (learned states) or `objects` (detector), fixed at creation. |
+| **Sensor** | One thing to recognise, e.g. "Garage door". Becomes one HA device with entities. Its **kind** is `single_state` (learned states), `objects` (detector) or `reading` (a number), fixed at creation. |
 | **State** | One possible value of a sensor. Has a display name ("Open") and a key (`open`, derived from the name, used in HA). |
 | **Source** | Where images come from: HA camera entity, HTTP snapshot URL, RTSP stream, or upload. |
 | **ROI** | Region of interest — a rectangle, or a polygon (up to `ROI_MAX_POINTS` corners), cropped from the frame before classification; outside a polygon is filled with a neutral colour. |
@@ -57,7 +58,7 @@ text recognizer. Neither needs training.
 - Home Assistant app with **Ingress** (sidebar panel, HA handles authentication); requests
   from anything other than the Ingress proxy are refused.
 - Architectures: `amd64`, `aarch64`. Prebuilt images on GHCR, pulled by Home Assistant.
-- Two release channels (see §18): stable (`main`) and beta (`beta` branch, `#beta` repo URL).
+- Two release channels, stable and beta ([`RELEASING.md`](RELEASING.md)).
 - Also runnable as a plain Docker container / Python process for development, configured via
   environment variables and a long-lived HA token (no login outside HA).
 - MQTT broker discovered automatically through the Supervisor services API
@@ -80,8 +81,21 @@ so retraining only runs the backbone on new or changed samples.
 
 | ID | Model | Use |
 |---|---|---|
-| `dinov2-small-q8` | DINOv2 ViT-S/14, 8-bit quantised (bundled) | Default everywhere, ~25 ms per frame on a desktop CPU |
+| `dinov2-small-q8` | DINOv2 ViT-S/14, 8-bit quantised (bundled) | Default everywhere |
 | `dinov2-small` | DINOv2 ViT-S/14, fp32 (downloaded on demand, SHA-256 checked) | Optional, slightly more accurate |
+| `dinov2-base` | DINOv2 ViT-B/14, fp32 (downloaded on demand, 347 MB) | Fast PCs; separates objects best |
+
+- Each registry entry carries a rough footprint for **Compare and manage the models** in Settings
+  (`backbones.Footprint`: extra memory, time per check on 4 threads of a desktop CPU, an accuracy
+  rank within its kind), measured when the model was added. Texts and footprint may be updated in a
+  released entry; its file and inputs never change.
+- DINOv2 base, evaluated (2026-10-11) with the crops of the 14 objects in the CC0 test photos, each
+  also changed in light, framing, blur, JPEG quality and night colours: the gap between the same
+  object changed (5th percentile) and other objects of its kind (90th percentile) was 0.12 for base
+  fp32, 0.08 for small fp32, 0.06 for small 8-bit — and 0.04 for base 8-bit, whose quantisation
+  squeezes everything together (other objects of a kind around 0.82), so base is offered in fp32
+  only; fp16 saved disk but used more memory on CPU. Base needs slightly stricter teaching limits
+  (`settings.TEACH_BY_BACKBONE`).
 
 - MobileNet was dropped: the available ONNX exports only expose classification logits.
 - Switching backbone retrains every sensor from its stored samples.
@@ -100,8 +114,14 @@ with the 80 COCO labels, their keys, groups and the popular ones):
 
 | ID | Model | Use |
 |---|---|---|
-| `dfine-s-coco` | D-FINE S, COCO, fp32 ONNX (bundled, 42 MB) | Default; ~0.1 s per check on a desktop CPU |
+| `dfine-s-coco` | D-FINE S, COCO, fp32 ONNX (bundled, 42 MB) | Default |
 | `dfine-n-coco` | D-FINE N, COCO, fp32 ONNX (downloaded on demand, 15 MB) | Faster, misses more |
+| `dfine-m-coco` | D-FINE M, COCO, fp32 ONNX (downloaded on demand, 79 MB) | Fast PCs; finds more small and hidden objects |
+| `dfine-l-coco` | D-FINE L, COCO, fp32 ONNX (downloaded on demand, 125 MB) | Fast PCs; the most accurate |
+
+D-FINE X (251 MB) was left out: twice the size of L for little more. At the default 60 % threshold
+M and L find the same objects in the test photos as S, with fewer weak false boxes, so the
+threshold is the same for every detector.
 
 1. Crop the ROI's bounding box plus a margin (`DETECTION["context_margin"]`) so edge objects are
    seen whole; stretch to 640×640 (no letterbox), scale to 0–1.
@@ -134,7 +154,9 @@ knew). Instead a second step compares boxes with boxes the user taught:
 - Unsure (`ask_similarity` 0.75 up to `match_similarity`, to an own label of the box's class): the
   box carries `ask`, counts neither for nor against that label (it keeps its published state), and
   goes to the review queue ("Is this Our car?", a history row `published_key = "ask"`, reason
-  `ask`) — one waiting question per label, at most one per review cooldown, none with review off.
+  `ask`) — one waiting question per label, at most one per review cooldown, none with review off;
+  about a face up to `FACES["ask_burst"]` (waiting, and per cooldown), `FACES["ask_gap_s"]` apart,
+  and an answer resets that person's cooldown.
   Yes/no teach the box from that history frame (as the label / as its class); answering again
   replaces that taught box. Below 0.75 it is simply not that label.
 - Switching off needs `DETECTION["clear_misses"]` (2) checks in a row without the object as well
@@ -150,18 +172,91 @@ knew). Instead a second step compares boxes with boxes the user taught:
 - Nothing changes for a sensor until something is taught; **Use what you taught** off skips it.
   The analysed frames of the last checks are kept (`frames_kept`) so a box can be taught a while
   after it was shown. Export/import carries taught boxes and own labels.
+- **Tunable** (`settings.TEACH_TUNABLE`): `match_similarity`, `keep_similarity`, `ask_similarity`,
+  `rescue_similarity` and `rescue_floor` can be set by the user, globally (DB setting `teach`,
+  `GET/PUT /api/v1/teach-limits`) and per sensor (`objects["teach"]`); unset values inherit.
+  `settings.merge_teach`: the backbone's defaults (`TEACH`, with `TEACH_BY_BACKBONE` on top) <
+  global < sensor. Asking and keeping must not start above a match (refused by the API). A user's
+  value stays when the backbone changes; the UI says to look at it again.
+
+**Recognising people by their face** (`faces.py`, `engine/faces.py`, `api/faces.py`; registry
+`faces.json`, tunables `settings.FACES`, per sensor `objects["faces"]` with `settings.FACE_DEFAULTS`;
+the user's limits `settings.FACE_TUNABLE`).
+Why it is a part of object sensors and not a kind, the research, the privacy rules and what is
+left are in [`FACE_RECOGNITION_PLAN.md`](FACE_RECOGNITION_PLAN.md). In short:
+
+- Off by default; on only for a sensor that looks for `person` (its Settings tab, or the wizard),
+  after a confirmation that names what is stored and downloaded. The face models are never
+  bundled: the first sensor that turns it on downloads them (`backbones.download` with progress)
+  and loads them in the background — the sensor runs without faces meanwhile; a failed download waits for **Try again**. The last sensor
+  turning it off lets the model go; its files can then be deleted (like any downloaded model not
+  in use: `DELETE /api/v1/models/{kind}/{id}`, *Compare and manage the models*).
+- The user's limits (`settings.FACE_TUNABLE`: the smallest face and the four similarities) work
+  like the teaching limits: defaults (`FACE_DEFAULTS`, the similarities from the face model) <
+  global (Settings, DB setting `faces`) < the sensor's own (`objects["faces"]`); an unset value
+  inherits.
+- Each check: person boxes (at most `FACES["max_faces"]`, new boxes first, then the ones searched
+  longest ago) are cropped from the full frame in their upper part and tiled
+  four to one YuNet run (640 × 640). One face counts for one person box. The quality gate (not
+  cut by the frame's edge — the detector then guesses the eyes —, the face's width `min_face_px` —
+  not the distance between the eyes, which shrinks as a head turns —, detector score, how far it
+  is turned, sharpness) makes a bad face *no face*, never *unknown*. A usable face is aligned on
+  its five points (Umeyama + Pillow, no OpenCV), its brightness evened out (`faces.even_light`: a
+  face in front of a bright sky is nearly black) and embedded; cached embeddings carry
+  `faces.EMBEDDING_VERSION`, so a change to that step recomputes them.
+- A person's score is the mean similarity to their `top_k` closest taught faces. Thresholds belong
+  to the recogniser's registry entry (cosine values of one model mean nothing for another): a
+  match needs `match_similarity` and `FACES["margin"]` over the next person, and is published at
+  once from `sure_similarity`, else when a second check of the same box agrees; between
+  `ask_similarity` and a match the box is `ask` (review: "Is this Kari?"); a box that stays keeps
+  its name while no usable face is seen or the face is above `keep_similarity`. A sure name is
+  carried for `recheck_every` checks without searching again. A box whose usable face matched
+  nobody `unknown_after` checks in a row and never had a name counts for `unknown_person`
+  (`settings.FACE_UNKNOWN_KEY`, its own entities). Only faces seen clearly count:
+  `FACES["unknown_size"]` times the smallest face, turned at most `FACES["unknown_max_turn"]`,
+  detector score at least `FACES["unknown_min_score"]`; a smaller, more turned or less certain face
+  can be named but is otherwise *not sure who*, as not looking like anyone may only be the angle.
+  Measured on the NASA test photos: the same person 0.64–0.95 (SFace) and 0.59–0.93 (AuraFace),
+  different people at most 0.30 and 0.22.
+- The people are shared by every sensor (a household, not a camera): `person` rows, each with
+  `face` rows (`db.Face`: {box, points, score} in the crop, and the sensor it was taught on, null
+  once that sensor is deleted — the face stays). The crop (the face with a margin, not aligned, so
+  another recogniser can align it its own way) lives in `<data>/faces/`, not in the media folder;
+  embeddings are cached per face model (`face_embedding`), deleted with the face, never exported.
+  A sensor that recognises faces gets every person as an own label (`engine.with_people`, not
+  stored on the sensor): its entities, and a name its faces can get. One index of all taught
+  faces serves every sensor. Only a human adds a face (teach sheet, review answer), on any sensor.
+- Each person also has two entities of their own on the app's device: `sensor.visionstate_<key>_seen_by`
+  (`mqtt.person_discovery_messages`): the slug of the sensor that sees them now — the one that saw
+  them last when several do — or `settings.PERSON_NOT_SEEN`; when and where they were last seen
+  are attributes, and when also a timestamp entity, `sensor.visionstate_<key>_last_seen` (a frame
+  confirmed afterwards moves it: `engine.objects.seen_earlier`, published at once). Kept in memory, and at start read back from the history
+  (`engine.objects.restore_last_seen`: the last "on", an "off" less `clear_after_s`, a box taught
+  from a frame), so "last seen" survives a restart while the history keeps it. A box taught from
+  a history frame or a review answer is written into that row (`api.teach.remember_taught`: its
+  label, `taught`), so the History shows what was taught from it.
+- `GET /people` and `/faces/{id}` (`api/faces.py`) list, rename, move and forget for all sensors;
+  teaching stays on a sensor (`/sensors/{id}/faces`), or comes from photos (`POST /people/photos`:
+  read like a state sensor's upload, `uploads.frames_from_file`; the best face of each picture
+  through the same gate, at most `FACES["max_photos"]`; origin `upload`, no sensor). Export carries the faces taught on that
+  sensor, with their people's keys and names, only with `?faces=true`; import adds them to the
+  person with that key or name (or a new one) and turns face recognition off.
 
 - Weights: D-FINE (Apache-2.0, COCO-trained; not the Objects365 variants, which carry other
   terms), ONNX conversions from Hugging Face pinned by revision and SHA-256. One conversion
   of D-FINE N was found broken during evaluation; tests with real CC0 photos
-  (`tests/assets`) now guard every model file. 8-bit variants were slower and worse on CPU.
+  (`tests/assets`, `tests/test_models.py`) now guard every model file. 8-bit variants were slower and worse on CPU.
 **Reading sensors** use a CTC text recognizer (registry `backend/visionstate/readers.json`):
 
 | ID | Model | Use |
 |---|---|---|
-| `ppocrv6-tiny` | PP-OCRv6 tiny rec, ONNX (bundled, 4.5 MB) | Default; ~2 ms per read on a desktop CPU |
+| `ppocrv6-tiny` | PP-OCRv6 tiny rec, ONNX (bundled, 4.5 MB) | Default |
 | `ppocrv6-small` | PP-OCRv6 small rec, ONNX (downloaded on demand, 21 MB) | Unusual fonts |
 
+PP-OCRv6 medium (77 MB) was evaluated and left out (2026-10-11): on 280 drawn LCD/LED displays
+(clean, blurred, low resolution, low contrast, noisy, tilted, heavy JPEG) and 49 drawn counters
+it read 297 of 329 right, tiny 304 and small 316; it took 9 for 3 or 8 on seven-segment digits.
+
 1. Crop the ROI's bounding box (no margin, no mask). Display *auto*: autocontrast greyscale;
    when the read is unsure (< `READING["segments_fallback_below"]`) also try the digits' own
    segments (two-stage Otsu on brightness for light-on-dark, on darkness for dark-on-light,
@@ -198,20 +293,13 @@ the digits) at a cost of `wheel_shift_penalty` per bin. The last wheel is rounde
 digit; the confidence is the mean probability per wheel. It always returns `digits` digits, so
 the digit count check does not apply. Counters made before it (no stored `counter_reader`) keep
 the text reader: schema v12 stores `"ocr"` for them, and so does importing an older export
-(`db.keep_text_reader`). How it is to get better (benchmark, the last value as an expectation,
-calibrated confidence, self-calibration of the region, wheels-v2, learning per sensor):
-[`WHEEL_READER_PLAN.md`](WHEEL_READER_PLAN.md). Training code and data sources: `tools/wheelreader`
-(synthetic wheels drawn with OFL fonts, the CC0 Word-Wheel Water Meter Dataset (Sci Data 2026),
-the CC0 exports shared in issues #32/#40).
-
-- Evaluated for the wheel reader (2026-10-09; whole reading exact, last digit rounded): a
-  user's ESP32 water meter with red wheels, held out from training: 17/17 (PP-OCRv6 small 15,
-  tiny 8 with 5 too high); two water meters never seen in training (bolausson, test only): 30–33
-  of 35 and 15–18 of 18 with no value too high (small 30 with 2 too high, 15 with 1); the
-  Dryad test set (2,400 photos): 97.7 % when the photo is the right way up. Trained without the
-  user's images it read them just as well. The remaining misses are ±1 on a half-turned last
-  wheel. The decode score separates right from wrong reads only moderately, so it is not used
-  for more than the confidence.
+(`db.keep_text_reader`). The model, its training data and its
+results: [`tools/wheelreader/README.md`](../tools/wheelreader/README.md); how it is to get better:
+[`WHEEL_READER_PLAN.md`](WHEEL_READER_PLAN.md).
+
+- Why a wheel reader (2026-10-09): on every meter tested it read more readings right than
+  PP-OCRv6 small and gave no value too high, which the text reader did (numbers in its README).
+  The remaining misses are ±1 on a half-turned last wheel.
 - Evaluated (spike on Commons photos): PP-OCR read LCD, LED, dot-matrix and flip-segment
   displays correctly (7/7 with a tight region); it fails on small blurry LCDs, and on rolling
   counter wheels when the whole counter is read as one line. DINOv2 per digit (4/23) and a CNN
@@ -270,6 +358,11 @@ the pixels are decoded.
   - Optional region change detection: a small greyscale copy of the ROI is compared every
     *N* seconds; the AI only runs when the difference exceeds a threshold.
   - Every trigger starts a *burst* (default every 2 s for 30 s) to catch the final state.
+  - A sensor that recognises faces starts one by itself when a check finds a person nobody is
+    named for (`engine.logic.steer_face_burst`, tunables `FACES["burst_*"]`): someone walking up
+    shows a usable face for a few seconds only. It runs while they come closer or show a face, ends
+    once everyone is named, when they are gone, without progress or after `burst_max_s`, and comes
+    again only after they have gone. The light is held through it like any burst.
   - The MQTT `classify` button checks once.
 - **Light** (`triggers.light_entity`, `light_delay_s`; picked with the camera in the UI): a light,
   switch or input_boolean, switched over the HA REST API (`homeassistant.turn_on/off`). `lights.py`
@@ -319,15 +412,10 @@ the pixels are decoded.
 
 ## 8. Home Assistant integration (MQTT Discovery)
 
-One HA **device** per sensor:
-
-| Entity | Type | Purpose |
-|---|---|---|
-| `sensor.<name>` | `sensor` (`device_class: enum`, options = state keys + `unknown`) | The result |
-| `…_confidence` | `sensor` (%) | Top probability |
-| `image.…_last_frame` | `image` | The ROI that was classified |
-| `button.…_classify_now` | `button` | Check now (automations) |
-| `switch.…_enabled` | `switch` | Pause / resume |
+One HA **device** per sensor (the entities a user sees are listed in DOCS.md). A state sensor:
+the result as `sensor` with `device_class: enum` (options = state keys + `unknown`), its
+confidence, an `image` of the region that was classified, a `button` to check now and a `switch`
+to pause it.
 
 **Object sensors** replace the first two with two entities per selected class:
 `binary_sensor.<name>_<class>` (`device_class: occupancy`, attributes: confidence,
@@ -381,8 +469,9 @@ outside Home Assistant it shows the expected IDs.
 Principle: **easy by default, details on demand.** Dark theme, responsive.
 
 1. **Dashboard** — cards per sensor: live thumbnail, state, confidence, 24 h timeline, health.
-2. **New sensor wizard** — camera → region → *detect*: states (names) or objects (popular
-   first, all 80 behind "Show all", with a test on a fresh frame) → optional triggers.
+2. **New sensor wizard** — camera → region → *detect*: states (names), objects (popular
+   first, all 80 behind "Show all") or a reading (display or counter), each tested on a fresh
+   frame → optional triggers.
 3. **Label** — live view, one button per state (keys 1–9), current prediction, day/night
    coverage, last trigger, undo.
 4. **Upload** — drag & drop images/ZIP/video; label in a grid or accept all suggestions.
@@ -401,9 +490,9 @@ Principle: **easy by default, details on demand.** Dark theme, responsive.
     object class or own label — the row's `state_key`; never a reading), event, time window and
     *waiting for review*, newest or oldest first. Each filter takes several values (any of them
     matches); filters combine with *and*. Events are a registry per kind
-    (`settings.HISTORY_EVENTS`: `change`, `flagged`; `appeared`, `cleared`, `filtered`, `asked`;
-    `value`, `rejected`, `verified`), sent to the UI in `/config`; `api/history.py` says which rows
-    each matches. One function (`history_query`) turns a filter into SQL for the list
+    (`settings.HISTORY_EVENTS`: `change`, `flagged`; `appeared`, `cleared`, `filtered`, `asked`,
+    `face_seen`; `value`, `rejected`, `verified`), sent to the UI in `/config`; `api/history.py`
+    says which rows each matches. One function (`history_query`) turns a filter into SQL for the list
     (`GET /history`, paged by a cursor on `(created_at, id)` so rows arriving at the top never
     repeat a row), its count and the facets (`GET /history/facets`: rows per sensor, key and event,
     each counted without its own filter so other choices stay offered). The filter lives in the
@@ -431,12 +520,12 @@ loads.
 
 ## 10. Data model & extensibility
 
-- SQLite; schema version in `PRAGMA user_version` with additive migrations (`db.MIGRATIONS`,
-  currently v10). An older version started on a newer database ignores the columns it does not
+- SQLite; schema version in `PRAGMA user_version` (`db.SCHEMA_VERSION`) with additive migrations
+  (`db.MIGRATIONS`). An older version started on a newer database ignores the columns it does not
   know (rollback works; checked by the upgrade test).
-- `sensor.kind`: `single_state`, `objects` (`sensor.objects` holds classes, `min_size`,
-  `clear_after_s`, `use_taught` and the own labels `custom`) or `reading` (`sensor.reading` holds mode, decimals, unit, device class,
-  display, `digits`, `max_step`, `spot_rate`); reserved for `multi_label`. Every reading is
+- `sensor.kind`: `single_state`, `objects` (`sensor.objects` holds the fields of
+  `settings.OBJECT_DEFAULTS`, the classes and the own labels `custom`) or `reading`
+  (`sensor.reading` holds the fields of `settings.READING_DEFAULTS`); reserved for `multi_label`. Every reading is
   counted per sensor and local day in `reading_stat` (reads, accepted, rejected per reason);
   every rejected reading is a `prediction` row with its frame and `review_reason` "rejected"
   (spot checks: "spot_check"), and `read_ok` / `correct_value` hold the user's verdict. Verified
@@ -460,6 +549,7 @@ loads.
 | Settings, DB, embeddings, trained heads | `/data` (per app) | Yes |
 | Downloaded backbone models | `/data/models` | Excluded (re-downloadable) |
 | Training images (and boxes taught to object sensors, as crops) | `/media/visionstate/samples/<sensor>/` (beta: `/media/visionstate_beta`) | With the media folder |
+| The people's taught faces (crops, shared by every sensor) | `/data/faces/` — not in the media folder, which every Home Assistant user can browse | Yes |
 | History frames | `/media/…/history/` | Limits: 7 days and 2 GB by default, whichever comes first (see below) |
 
 History frames are full camera frames (JPEG 90). They are removed by age (`history_days`;
@@ -501,41 +591,13 @@ automatically.
 - Not implemented: full export of all sensors + global settings, merge/replace import modes,
   exporting trained heads (retraining is faster than shipping them).
 
-## 13. Configuration (app options)
-
-`log_level`, `discovery_prefix`, and optional `mqtt_host`,
-`mqtt_port`, `mqtt_username`, `mqtt_password`. Everything else (AI model, review rules,
-sensor settings) lives in the UI.
+## 13. Configuration
 
-## 14. Tech stack
+App options are only for logging and a broker Home Assistant does not provide (list in DOCS.md).
+Everything else (AI models, review rules, sensor settings) lives in the UI and the database, so it
+is part of backups and needs no restart.
 
-| Layer | Choice |
-|---|---|
-| Runtime | Python 3.14 (image and CI), FastAPI, uvicorn, SQLAlchemy, asyncio |
-| Inference | ONNX Runtime, NumPy, Pillow, PyAV (bundled FFmpeg) |
-| Training | scikit-learn |
-| MQTT / HA | aiomqtt, websockets, httpx |
-| Frontend | Svelte 5 + Vite + TypeScript, plain CSS with design tokens (`tokens.css`), hash router (Ingress-safe), bundled fonts |
-| Packaging | HA app repository, Docker (python:3.14-slim), GitHub Actions → GHCR |
-| Quality | pytest (unit + integration with a fake camera/HA/MQTT; coverage measured in CI, floor 88 %), ruff, svelte-check, Playwright UI tests (desktop + phone with touch, against the real backend and `scripts/fake_camera.py`), image smoke test in CI, Dependabot (monthly, to `beta`) |
-| Docs | `README.md`, `visionstate/DOCS.md` (shown in HA), `CHANGELOG.md`, this file |
-
-## 15. Repo layout
-
-```
-/                       repository.yaml, README.md, CLAUDE.md
-/visionstate            HA app: config.yaml, Dockerfile, DOCS.md, CHANGELOG.md, icon/logo
-/visionstate/backend    Python package + tests (inside the app dir: the Dockerfile builds from it);
-                        visionstate/engine/ is the runtime: Runtime (runtime.py) from one mixin
-                        per part (models, checks, objects, reading, teaching, training,
-                        publishing, history), state.py and logic.py (pure decisions)
-/visionstate/frontend   Svelte app
-/scripts                channel.py (stable/beta config switch), fake_camera.py (test camera)
-/docs                   SCOPE.md, promo/ (README screenshots and logos)
-/.github                CI workflow, Dependabot
-```
-
-## 16. Roadmap
+## 14. Roadmap
 
 | Milestone | Content | Version |
 |---|---|---|
@@ -553,48 +615,22 @@ sensor settings) lives in the UI.
 | **Mechanical counters** ✅ | Rolling digit wheels (water, gas): one cell per wheel, digit count check | 0.6.1 (beta 0.6.1b6) |
 | **Teaching object sensors** ✅ | Correct a box (not it / something else), own labels ("Our car"), missed boxes, Quality tab | 0.6.3 (beta 0.6.3b10) |
 | **Readings & light** ✅ | Reading Quality tab and review of rejected readings, extra reading entities (rate, problem, reader image), a light for each check, regular check off / trigger states, entity IDs without prefix | 0.6.3 (betas 0.6.3b1–b16) |
+| **Hardening** ✅ | Loops that survive unexpected errors (MQTT bridge, sensor loops), redacted log lines and tracebacks, source address checks, frame and image size limits, sturdier import, engine split into a package, coverage in CI | 0.6.4 |
 | **History** ✅ | History page with filters shared by every sensor's History tab, the images behind the Quality tab's mix-ups | 0.7.0 |
-| **Wheel reader** ✅ | Mechanical counters read wheel by wheel with a model made for VisionState; wheels mid-turn read right | 0.8.0 (betas 0.7.1b3–b4) |
-| **Better counter readings** | Benchmark, the last value as an expectation, calibrated confidence, extra decimal, export v2, self-calibrating regions, wheels-v2, learning per sensor — see [`WHEEL_READER_PLAN.md`](WHEEL_READER_PLAN.md) | export v2 in 0.8.0 (betas 0.7.1b5–b6); the rest planned |
+| **Wheel reader** ✅ | Mechanical counters read wheel by wheel with a model made for VisionState; wheels mid-turn read right; export v2 of readings | 0.8.0 (betas 0.7.1b3–b6) |
 | **Review reminder** ✅ | A notification in Home Assistant (optionally a push) when frames have waited for review a long time | 0.8.0 (beta 0.7.1b1) |
-| **Hardening** ✅ | Loops that survive unexpected errors (MQTT bridge, sensor loops), redacted log lines and tracebacks, source address checks, frame and image size limits, sturdier import, engine split into a package, coverage in CI | 0.6.4 |
+| **Larger models, tunable teaching** ✅ | D-FINE M and L, DINOv2 base, a model comparison in Settings, teaching limits globally and per sensor | 0.9.0 (beta 0.8.1b1) |
+| **Recognising faces** ✅ | Faces in person boxes (YuNet), people taught by face and shared by every camera (SFace, or AuraFace for a fast PC), a People page, an entity per person saying where they are, unknown person, review questions, export opt-in — phases 1–3 of [`FACE_RECOGNITION_PLAN.md`](FACE_RECOGNITION_PLAN.md), and teaching a face from photos | 0.9.0 (betas 0.8.1b3–b5) |
+| **Better counter readings** | Benchmark, the last value as an expectation, calibrated confidence, extra decimal, self-calibrating regions, wheels-v2, learning per sensor — status per phase in [`WHEEL_READER_PLAN.md`](WHEEL_READER_PLAN.md) | planned |
 
-**Open ideas** (not scheduled): full export/import of everything; merge/replace import;
+**Open ideas** (not scheduled): more on the History page (export of a filtered selection, a
+summary per hour or day, "seen in the frame" as a filter, saved filters, bulk actions); full
+export/import of everything; merge/replace import;
 less MQTT/camera traffic (throttle frame publishing, reuse the engine's latest frame in the UI);
 video de-duplication on the ROI instead of the full frame; light theme following Home
 Assistant; mechanical counters beyond [`WHEEL_READER_PLAN.md`](WHEEL_READER_PLAN.md): pointer
 dials and gauges; several readings per sensor (a sign with four prices, a
-counter plus its dials); issue templates; per-sensor model
+counter plus its dials); per-sensor model
 choice with unloading of idle models (DINOv2 stays loaded: object sensors that were taught use
 it); zones and line crossing for object sensors; classes outside COCO (an open-vocabulary
 detector) — until then, a state sensor covers many of them ("parcel on the doorstep").
-
-## 17. Identity
-
-| Item | Value |
-|---|---|
-| Name | VisionState (beta: "VisionState (beta)") |
-| App slug | `visionstate` |
-| Repository | `github.com/oleost/VisionState` (`#beta` for the beta channel) |
-| Images | `ghcr.io/oleost/visionstate-{amd64,aarch64}:X.Y.Z` (+`latest`) / `:X.Y.ZbN` (+`beta`) |
-| MQTT discovery prefix / node id | `homeassistant` / `visionstate` |
-| Licence | Apache-2.0 |
-
-## 18. Release channels
-
-- **beta** branch: all changes land here first; versions `X.Y.ZbN`, GitHub pre-releases, own
-  media folder. The maintainer runs it permanently.
-- **main** branch: stable; changes only by promoting a tested beta through a PR
-  (branch-protected, CI required).
-- CI builds, tests and smoke-tests the image on both architectures, each on its own hardware
-  (start, MQTT, discovery, clean `docker stop` with exit code 0) before publishing, refuses
-  tags that do not match `config.yaml`, and refuses the wrong channel on a branch.
-- The amd64 image is also run under an emulated x86-64-v1 CPU (`kvm64`, qemu-user) with
-  `scripts/cpu_probe.py`, which exercises every native library and the app. NumPy is pinned
-  below 2.4 for that reason (2.4+ needs x86-64-v2; found through issue #29). Checked 2026-10:
-  with NumPy 2.3.5 all other pins (SciPy 1.18, scikit-learn 1.9, ONNX Runtime 1.30, Pillow 12,
-  PyAV 18) work on `kvm64` and `qemu64`.
-- A beta tag is the whole release: after both images are published CI creates the pre-release
-  from the changelog entry and fast-forwards `beta`, so the branch never carries a version
-  without images. Stable releases are promoted by hand.
-- Step-by-step procedures are in `CLAUDE.md`.
diff --git a/docs/WHEEL_READER_PLAN.md b/docs/WHEEL_READER_PLAN.md
index 5edbb91..f7af4fb 100644
--- a/docs/WHEEL_READER_PLAN.md
+++ b/docs/WHEEL_READER_PLAN.md
@@ -1,8 +1,7 @@
 # Wheel reader: plan for better counter readings
 
-Status: **plan** (written 2026-10-09, after 0.7.1b4); B1 (the export) is built in 0.7.1b5. This document is
-the design for improving how VisionState reads **mechanical counters** (rolling digit wheels on
-water and gas meters). It applies to reading sensors with the *counter* display and the wheel reader
+The design for improving how VisionState reads **mechanical counters** (rolling digit wheels on
+water and gas meters); what is done and what is next is in the table in §9. It applies to reading sensors with the *counter* display and the wheel reader
 (`counter_reader: "wheels"`). The general design is in [`SCOPE.md`](SCOPE.md), and the model and its
 training are in [`tools/wheelreader`](../tools/wheelreader/README.md).
 
@@ -13,13 +12,7 @@ training are in [`tools/wheelreader`](../tools/wheelreader/README.md).
   over 100 bins (0.0–9.9). `readers.wheel_value` then finds the most likely value whose wheels fit
   together, from right to left, with one common shift of up to ±2 bins. The last wheel is rounded,
   and the confidence is the mean probability per wheel.
-- **Trained on** 600 k drawn cells, the CC0 Dryad Word-Wheel set (nearest-digit labels; about a
-  third of the crops are upside down, picked by a synthetic-only model) and the CC0 exports from
-  issues #32 and #40.
-- **Results:**
-  - #40 meter, held out: 17/17 (PP-OCRv6 small 15, tiny 8).
-  - Two meters never seen: 30–33/35 and 15–18/18, no value too high.
-  - Dryad test: 97.7 % with the right orientation.
+- **Training data and results:** [`tools/wheelreader/README.md`](../tools/wheelreader/README.md).
 - **Known weaknesses, with evidence:**
   - *±1 on the last digit* when the last wheel is about half way. The rounding moves with the
     per-frame shift (pedro32: 81 exact + 12 at +1).
@@ -46,7 +39,7 @@ training are in [`tools/wheelreader`](../tools/wheelreader/README.md).
 5. **No telemetry.** Data only arrives when a user exports it and shares it on purpose.
 6. **The registry rules stay.** A changed model, or changed calibration of a model, gets a new
    registry id. Existing sensors keep their behaviour until the user picks the new one, as in
-   0.7.1b4.
+   0.8.0 (counters made before the wheel reader kept the text reader).
 
 ## 3. Phase 0 — benchmark and metrics (the base for everything else)
 
@@ -147,9 +140,10 @@ In the decoder the expectation can be tested, explained, set per sensor and used
 
 ## 5. Phase B — better data in
 
-### B1. The export ("Export checked readings")
+### B1. The export ("Export readings") — done
 
-**Built in 0.7.1b5–b6**, with these changes to the table below (decided 2026-10-10):
+Built in 0.8.0; what it contains is in [`SCOPE.md`](SCOPE.md) §12. Decisions that differ from the
+first plan (2026-10-10):
 - the light is recorded per reading automatically (greyscale picture, and whether VisionState had
   the sensor's light on) instead of a flag in the dialog;
 - frames are **not** deduplicated in the app — a reading of the same frame is still a reading; the
@@ -157,28 +151,13 @@ In the decoder the expectation can be tested, explained, set per sensor and used
 - the unchecked accepted readings are **always** included (no option, no count limit): the images
   are what is scarce. Their value is the reader's guess, so the tools use them as labels only after
   a check (§B4);
-- no spot-check button (0.7.1b5 had one; removed in b6);
-- no count limits: one ZIP of at most 24 MB (GitHub's limit is 25 MB per file; about 1,000
-  readings), checked readings first, then the newest unchecked ones; what does not fit is counted
-  in `left_out`. Splitting into parts was built and dropped as more than we need now. Images are
-  not scaled down: the data stays as the app stored it.
-
-It already gives the region with a margin, the right value, the answer, the region each reading
-was made in and the CC0 licence. To add (format version `"format": 2` in `readings.json`, and
-README.txt to match):
-
-| Add | Why |
-|---|---|
-| reader id and model version **per reading** | today `reader` is the current choice for the whole export; after 0.7.1b4 OCR and wheel readings are mixed |
-| wheel reader details per reading: position and probability per wheel, the shift, V with its fraction | shows where the model hesitated without running it again; lets us check calibration on shared data |
-| an optional free-text **"What meter is this?"** in the export dialog | today it has to be written in the post, and it gets forgotten |
-| an optional **light** flag (day / night or IR / flash), not the time of day | IR and flash are their own problems; the time of day is more than we need |
-| each frame **once** | the old export had one image read 15 times |
-| optionally the latest **unchecked accepted** readings, marked `"answer": "unchecked"` | today almost only rejected readings get checked, so exports are mostly failures. A counter only goes up, so ordered unchecked readings still give useful weak labels |
-| a button to **spot-check** a few accepted readings before exporting | easier than changing `spot_rate` |
-
-Privacy stays as it is: only the region with a small margin, no camera, name or position, and the
-day only. The user looks at the images before sharing (README.txt).
+- no spot-check button; `spot_rate` is the way to get accepted readings checked;
+- one ZIP of at most 24 MB (GitHub's limit is 25 MB per file), checked readings first, then the
+  newest unchecked ones; what does not fit is counted in `left_out`. Splitting into parts was built
+  and dropped as more than we need now. Images are not scaled down.
+
+Privacy: only the region with a small margin, no camera, name or position, and the day only. The
+user looks at the images before sharing (README.txt in the ZIP).
 
 ### B2. Collecting
 
@@ -251,7 +230,9 @@ the correlation peak and skip frames where it is weak (light changes, IR switchi
 
 The manual 4-point correction stays planned for strongly angled cameras (see the earlier
 decision: measure the read rate at real angles first, for example with the user's ESP32 camera, or
-with `fake_camera` given a perspective parameter). C2 can later suggest the four points.
+with `fake_camera` given a perspective parameter). C2 can later suggest the four points. Open
+questions: reuse the 4-corner polygon region or a new corner tool (existing sensors must keep
+working), the corner order and orientation, and dragging corners on a phone.
 
 ## 7. Phase D — wheels-v2
 
@@ -294,21 +275,23 @@ with `fake_camera` given a perspective parameter). C2 can later suggest the four
 
 ## 9. Order, size and dependencies
 
-| Phase | Builds on | Size | Gives |
-|---|---|---|---|
-| 0 Benchmark | — | small | a fair measure for everything after |
-| A1 Expectation | 0 | medium | far fewer too-high and unclear readings |
-| A2 Calibration | 0 | small | a threshold that means what it says |
-| A3 Extra decimal | — | small | a smoother rate, earlier leak detection |
-| B1 Export v2 | — | small–medium | the data we need, labelled properly |
-| B2 Collecting | B1 | ongoing | more meter types |
-| C2 Calibration per sensor | 0 | medium | a stable last digit, forgiving regions |
-| C3 Camera drift | C2 | small–medium | sensors survive small camera moves |
-| C4 4-point perspective | real angle tests | medium | angled cameras |
-| D wheels-v2 | 0, B (data), C1 | large | a better base model |
-| E Learning per sensor | D (embedding), A2 | medium | the last step for an unusual meter |
-
-Suggested order: **0 → A1 + A2 + B1 (in parallel; B2 starts right after B1) → A3 → C2 → D → E**,
+| Phase | Builds on | Size | Gives | Status |
+|---|---|---|---|---|
+| 0 Benchmark | — | small | a fair measure for everything after | planned |
+| A1 Expectation | 0 | medium | far fewer too-high and unclear readings | planned |
+| A2 Calibration | 0 | small | a threshold that means what it says | planned |
+| A3 Extra decimal | — | small | a smoother rate, earlier leak detection | planned |
+| B1 Export v2 | — | small–medium | the data we need, labelled properly | **done, 0.8.0** |
+| B2 Collecting | B1 | ongoing | more meter types | next (issue forms point to Discussions) |
+| C2 Calibration per sensor | 0 | medium | a stable last digit, forgiving regions | planned |
+| C3 Camera drift | C2 | small–medium | sensors survive small camera moves | when a real case asks for it |
+| C4 4-point perspective | real angle tests | medium | angled cameras | waits for a test with a real angled meter |
+| D wheels-v2 | 0, B (data), C1 | large | a better base model | planned |
+| E Learning per sensor | D (embedding), A2 | medium | the last step for an unusual meter | planned |
+
+Update the status column in the same change that builds a phase.
+
+Suggested order: **0 → A1 + A2 (B2 alongside) → A3 → C2 → D → E**,
 with C3 and C4 when real cases ask for them. A and C2 need no new training and help every existing
 counter sensor right away.
 
diff --git a/docs/promo/dashboard.png b/docs/promo/dashboard.png
index 84fd758..6aad03f 100644
Binary files a/docs/promo/dashboard.png and b/docs/promo/dashboard.png differ
diff --git a/docs/promo/ha-objects.png b/docs/promo/ha-objects.png
index 953a72b..4aa4f70 100644
Binary files a/docs/promo/ha-objects.png and b/docs/promo/ha-objects.png differ
diff --git a/docs/promo/objects.png b/docs/promo/objects.png
index 25f7cc1..90757c7 100644
Binary files a/docs/promo/objects.png and b/docs/promo/objects.png differ
diff --git a/docs/promo/people.png b/docs/promo/people.png
new file mode 100644
index 0000000..dce282a
Binary files /dev/null and b/docs/promo/people.png differ
diff --git a/docs/promo/reading.png b/docs/promo/reading.png
index b47a15c..bca4359 100644
Binary files a/docs/promo/reading.png and b/docs/promo/reading.png differ
diff --git a/docs/promo/wizard.png b/docs/promo/wizard.png
deleted file mode 100644
index 91b86fc..0000000
Binary files a/docs/promo/wizard.png and /dev/null differ
diff --git a/scripts/seed_demo.py b/scripts/seed_demo.py
new file mode 100644
index 0000000..3831c55
--- /dev/null
+++ b/scripts/seed_demo.py
@@ -0,0 +1,273 @@
+"""Seed the demo sensors: one of each kind, the sensors on the README screenshots.
+
+    python scripts/seed_demo.py --url http://127.0.0.1:8099 --images http://127.0.0.1:8765/photo
+    python scripts/seed_demo.py --app c088851d_visionstate      # an installed app, through Ingress
+
+- Driveway (objects): a person and a car; Emma is recognised by her face (taught from two other
+  photos of her) and the car is taught as the own label "Our car".
+- Garage door (states): trained on 36 frames drawn from one photo (closed, open, partial).
+- Water meter (reading): the wheels of a real water meter, one of them half way between digits.
+
+The cameras are HTTP snapshot URLs: ``--images`` + ``/<name>.jpg``, by default the test photos on
+GitHub (reachable from any Home Assistant). With the fake camera use ``http://127.0.0.1:<port>/photo``.
+Sensors and people that already exist (same name) are left alone, so running it twice is harmless.
+``--app`` needs HA_URL and HA_TOKEN (a long-lived token of an administrator) in the environment.
+Run it with the backend's Python (it needs httpx, numpy, Pillow and, for --app, websockets).
+Images: visionstate/backend/tests/assets (sources and licences in its README.md).
+"""
+
+import argparse
+import asyncio
+import io
+import json
+import os
+import random
+import sys
+import time
+from pathlib import Path
+
+import httpx
+import numpy as np
+from PIL import Image, ImageDraw, ImageEnhance, ImageFilter
+
+ASSETS = Path(__file__).resolve().parent.parent / "visionstate" / "backend" / "tests" / "assets"
+GITHUB = "https://raw.githubusercontent.com/oleost/VisionState/beta/visionstate/backend/tests/assets"
+
+# The garage door in demo_garage.jpg (pixels) and the sensor's region around it.
+DOOR = {"tl": (130, 45), "tr": (620, 130), "br": (615, 585), "bl": (130, 685)}
+GARAGE_ROI = {"x": 0.1, "y": 0.06, "w": 0.43, "h": 0.94}
+
+
+def garage_frames(per_state: int = 12) -> dict[str, list[bytes]]:
+    """Frames of the garage door closed, open and half open, with some light and camera jitter."""
+    rnd = random.Random(7)
+    base = Image.open(ASSETS / "demo_garage.jpg").convert("RGB")
+    w, h = base.size
+
+    def lerp(a, b, t):
+        return (a[0] + (b[0] - a[0]) * t, a[1] + (b[1] - a[1]) * t)
+
+    def raised(frac: float) -> Image.Image:
+        """The door lifted by ``frac``: daylight shows below it."""
+        top_l, top_r = (
+            lerp(DOOR["tl"], DOOR["bl"], 1 - frac),
+            lerp(DOOR["tr"], DOOR["br"], 1 - frac),
+        )
+        mask = Image.new("L", (w, h), 0)
+        ImageDraw.Draw(mask).polygon([top_l, top_r, DOOR["br"], DOOR["bl"]], fill=255)
+        m = np.asarray(mask.filter(ImageFilter.GaussianBlur(2)), dtype=np.float32)[:, :, None] / 255
+        outside = np.clip(
+            235 - 70 * np.linspace(0, 1, h)[:, None] + np.random.default_rng(1).normal(0, 6, (h, w)),
+            0,
+            255,
+        )
+        out = np.asarray(base, dtype=np.float32) * (1 - m) + outside[:, :, None] * m
+        img = Image.fromarray(np.clip(out, 0, 255).astype("uint8"))
+        ImageDraw.Draw(img).line([top_l, top_r], fill=(70, 70, 70), width=6)
+        glow = Image.new("L", (w, h), 0)
+        ImageDraw.Draw(glow).polygon([DOOR["bl"], DOOR["br"], (w, h), (0, h)], fill=int(90 * frac))
+        return Image.composite(
+            Image.new("RGB", (w, h), (255, 255, 255)),
+            img,
+            glow.filter(ImageFilter.GaussianBlur(40)),
+        )
+
+    def jitter(img: Image.Image) -> bytes:
+        img = ImageEnhance.Brightness(img).enhance(rnd.uniform(0.75, 1.2))
+        img = ImageEnhance.Contrast(img).enhance(rnd.uniform(0.85, 1.15))
+        dx, dy = rnd.randint(-10, 10), rnd.randint(-8, 8)
+        img = img.transform(
+            img.size,
+            Image.Transform.AFFINE,
+            (1, 0, dx, 0, 1, dy),
+            fillcolor=(40, 40, 40),
+        )
+        noise = np.random.default_rng(rnd.randint(0, 1 << 30)).normal(0, rnd.uniform(2, 7), (h, w, 3))
+        img = Image.fromarray(np.clip(np.asarray(img, dtype=np.float32) + noise, 0, 255).astype("uint8"))
+        buf = io.BytesIO()
+        img.filter(ImageFilter.GaussianBlur(rnd.uniform(0, 1.2))).save(buf, format="JPEG", quality=88)
+        return buf.getvalue()
+
+    make = {
+        "closed": lambda: base,
+        "open": lambda: raised(rnd.uniform(0.85, 0.95)),
+        "partial": lambda: raised(rnd.uniform(0.35, 0.6)),
+    }
+    return {key: [jitter(fn()) for _ in range(per_state)] for key, fn in make.items()}
+
+
+class Api:
+    """The app's API, directly (``--url``) or through Home Assistant Ingress (``--app``)."""
+
+    def __init__(self, base: str, cookies: dict | None = None):
+        self.client = httpx.Client(base_url=base.rstrip("/") + "/api/v1", cookies=cookies, timeout=180)
+
+    def call(self, method: str, path: str, **kwargs):
+        r = self.client.request(method, path, **kwargs)
+        if r.status_code >= 400:
+            sys.exit(f"{method} {path}: {r.status_code} {r.text[:300]}")
+        return r.json() if r.content else None
+
+
+def ingress(app: str) -> Api:
+    from websockets.asyncio.client import connect
+
+    ha = os.environ["HA_URL"].rstrip("/")
+    token = os.environ["HA_TOKEN"]
+
+    async def supervisor(endpoint: str, method: str = "get") -> dict:
+        async with connect(ha.replace("http", "ws", 1) + "/api/websocket") as ws:
+            await ws.recv()
+            await ws.send(json.dumps({"type": "auth", "access_token": token}))
+            await ws.recv()
+            await ws.send(
+                json.dumps(
+                    {
+                        "id": 1,
+                        "type": "supervisor/api",
+                        "endpoint": endpoint,
+                        "method": method,
+                    }
+                )
+            )
+            while True:
+                msg = json.loads(await ws.recv())
+                if msg.get("id") == 1:
+                    if not msg.get("success"):
+                        sys.exit(f"Supervisor {endpoint}: {msg.get('error')}")
+                    return msg["result"]
+
+    session = asyncio.run(supervisor("/ingress/session", "post"))["session"]
+    entry = asyncio.run(supervisor(f"/addons/{app}/info"))["ingress_entry"]
+    return Api(ha + entry, {"ingress_session": session})
+
+
+def wait(what: str, check, timeout: float = 180):
+    end = time.time() + timeout
+    while time.time() < end:
+        value = check()
+        if value:
+            return value
+        time.sleep(2)
+    sys.exit(f"Timed out waiting for {what}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    target = parser.add_mutually_exclusive_group(required=True)
+    target.add_argument("--url", help="the app's address, e.g. http://127.0.0.1:8099")
+    target.add_argument("--app", help="slug of an installed app, reached through Ingress")
+    parser.add_argument(
+        "--images",
+        default=GITHUB,
+        help="where the cameras get the photos (default: GitHub)",
+    )
+    args = parser.parse_args()
+    api = Api(args.url) if args.url else ingress(args.app)
+    photo = lambda name: f"{args.images.rstrip('/')}/{name}.jpg"
+    existing = {s["name"]: s for s in api.call("GET", "/sensors")}
+
+    def create(spec: dict) -> dict | None:
+        if spec["name"] in existing:
+            print(f"{spec['name']}: already there")
+            return None
+        sensor = api.call("POST", "/sensors", json=spec)
+        print(f"{spec['name']}: created (id {sensor['id']})")
+        return sensor
+
+    garage = create(
+        {
+            "name": "Garage door",
+            "source_type": "http",
+            "source": photo("demo_garage"),
+            "roi": GARAGE_ROI,
+            "states": [{"name": "Closed"}, {"name": "Open"}, {"name": "Partial"}],
+            "interval_s": 30,
+        }
+    )
+    if garage:
+        for key, frames in garage_frames().items():
+            files = [("files", (f"{key}_{i:02d}.jpg", data, "image/jpeg")) for i, data in enumerate(frames)]
+            api.call(
+                "POST",
+                f"/sensors/{garage['id']}/uploads",
+                files=files,
+                data={"state_key": key},
+            )
+
+    meter = create(
+        {
+            "name": "Water meter",
+            "kind": "reading",
+            "source_type": "http",
+            "source": photo("counter_turning"),
+            "reading": {
+                "mode": "counter",
+                "display": "counter",
+                "digits": 7,
+                "decimals": 3,
+                "unit": "m³",
+                "device_class": "water",
+            },
+            "interval_s": 30,
+            "debounce": 1,
+        }
+    )
+
+    driveway = create(
+        {
+            "name": "Driveway",
+            "kind": "objects",
+            "source_type": "http",
+            "source": photo("demo_driveway"),
+            "objects": {
+                "classes": ["person", "car"],
+                "faces": {"enabled": True, "ask_unknown": False},
+            },
+            "interval_s": 10,
+        }
+    )
+    if not any(p["name"] == "Emma" for p in api.call("GET", "/people")["people"]):
+        # The face model loads (or downloads) once a sensor recognises faces.
+        files = [
+            ("files", (f"{n}.jpg", (ASSETS / f"{n}.jpg").read_bytes(), "image/jpeg"))
+            for n in ("demo_emma_car", "demo_emma_guitar")
+        ]
+        for _ in range(60):
+            r = api.client.post("/people/photos", files=files, data={"new_person": "Emma"})
+            if r.status_code != 409:
+                break
+            time.sleep(3)
+        if r.status_code >= 400:
+            sys.exit(f"Emma: {r.status_code} {r.text[:300]} (an app older than 0.8.1b4 cannot teach faces from photos)")
+        print(f"Emma: {r.json()['added']} faces taught")
+    if driveway:
+
+        def car():
+            view = api.call("GET", f"/sensors/{driveway['id']}")
+            cars = [d for d in view["objects"]["detections"] if d["key"] == "car"]
+            return (view["live"]["frame_id"], cars[0]) if cars else None
+
+        frame_id, box = wait("the car on the driveway", car)
+        api.call(
+            "POST",
+            f"/sensors/{driveway['id']}/taught",
+            json={
+                "frame_id": frame_id,
+                "box": box["box"],
+                "detected": "car",
+                "score": box["score"],
+                "new_label": "Our car",
+            },
+        )
+        print("Our car: taught")
+    if meter:
+        value = wait(
+            "the water meter",
+            lambda: api.call("GET", f"/sensors/{meter['id']}")["reading"]["value"],
+        )
+        print("Water meter reads", value)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/wheelreader/README.md b/tools/wheelreader/README.md
index 2c6414a..ed72861 100644
--- a/tools/wheelreader/README.md
+++ b/tools/wheelreader/README.md
@@ -26,9 +26,16 @@ Licence: Apache-2.0. Trained on data that may be used for anything:
 | [Word-Wheel Water Meter Dataset](https://doi.org/10.5061/dryad.7d7wm3860) (Sci Data 2026), recognition crops | CC0 | training (labels: the nearest digit per wheel) |
 | Checked readings exported from VisionState and shared in issues [#32](https://github.com/oleost/VisionState/issues/32) and [#40](https://github.com/oleost/VisionState/issues/40) | CC0 (the export's LICENSE.txt) | training; `wheels-v1` was evaluated with #40 0001–0017 held out, then trained on all of it |
 
-Results (whole reading exact, last digit rounded; see `docs/SCOPE.md`): the #40 water meter
-held out 17/17 (PP-OCRv6 small 15/17), two meters never seen 30–33/35 and 15–18/18 with no value
-too high, the Dryad test set 97.7 % when the photo is the right way up.
+Results of `wheels-v1` (2026-10-09; whole reading exact, last digit rounded):
+
+| Set | Wheel reader | PP-OCRv6 small | PP-OCRv6 tiny |
+|---|---|---|---|
+| #40 water meter with red wheels (ESP32 camera), 0001–0017 held out | 17/17 | 15/17 | 8/17 (5 too high) |
+| Two water meters never seen in training (test only, GPL images kept locally) | 30–33/35 and 15–18/18, none too high | 30/35 (2 too high), 15/18 (1 too high) | — |
+| Dryad test set (2,400 photos), right way up | 97.7 % | — | — |
+
+Trained without the #40 images it read them just as well. The remaining misses are ±1 on a
+half-turned last wheel. Known weaknesses and what comes next are in the plan below.
 
 ## Making it again
 
diff --git a/visionstate/CHANGELOG.md b/visionstate/CHANGELOG.md
index f2b0ef4..57d7d6f 100644
--- a/visionstate/CHANGELOG.md
+++ b/visionstate/CHANGELOG.md
@@ -1,5 +1,37 @@
 # Changelog
 
+## 0.9.0
+
+### New
+
+- **Recognise people by their face** on object sensors that look for Person. Off until you turn it
+  on per sensor; the faces never leave your Home Assistant.
+  - Name the people of your household by tapping them on the Live tab, in the history or in the
+    review queue, or add photos from your phone on the new **People** page.
+  - A person named on one camera is known on every camera, with their own sensor that says where
+    they are now. **Unknown person** turns on for a clear face that matches nobody.
+  - While someone walks up, the sensor looks for their face about every second, and when it is
+    not sure who it is, it asks you in Review: each answer teaches it how that camera sees them.
+  - Made for doorbells: faces in front of a bright sky are evened out before they are compared,
+    and the Live tab shows whether your camera sees faces well enough.
+  - Two face models: **SFace** (fine on a Raspberry Pi 4) and **AuraFace** (for a fast PC).
+- **Larger AI models for fast PCs** under **Settings → AI model**: **D-FINE M** and **L** find more
+  small and far-off objects, **DINOv2 base** tells similar states apart best. Compare every model's
+  memory, speed and accuracy there, and delete downloaded ones you no longer use.
+- **Teaching limits you can tune**, for all object sensors and per sensor.
+- **The wizard warns about a small picture**, which may be the camera's low-resolution stream.
+
+### Better
+
+- **The History shows what you taught from it** (*Taught: Our car*).
+- **"Last seen" survives an update or restart**: a sensor no longer says *Not seen yet* about
+  something it has seen before.
+
+### Fixed
+
+- Boxes on the Live tab now always match the picture shown.
+- Switching AI models gives the memory of the old model back without a restart.
+
 ## 0.8.0
 
 ### New
diff --git a/visionstate/DOCS.md b/visionstate/DOCS.md
index c8a9a82..1973456 100644
--- a/visionstate/DOCS.md
+++ b/visionstate/DOCS.md
@@ -1,6 +1,6 @@
 # VisionState
 
-![VisionState with a garage door, a driveway and a power meter sensor](https://raw.githubusercontent.com/oleost/VisionState/main/docs/promo/dashboard.png)
+![VisionState with a driveway, a garage door and a water meter sensor](https://raw.githubusercontent.com/oleost/VisionState/main/docs/promo/dashboard.png)
 
 Teach a local AI to recognise **states** in camera images — a garage door that is `open`,
 `closed` or `partial`, a gate, a parking spot, a light — and use the result as a normal
@@ -29,7 +29,9 @@ number** from a display, without any training. Everything runs on this machine;
       inside the box, which makes it far more accurate. For an object that sits at an angle,
       shape the box: drag a corner to move it, drag a **+** on an edge to add a corner, and
       double-click / double-tap (or press and hold) a corner to remove it. Everything outside
-      the shape is ignored. **Reset to rectangle** goes back to a plain box.
+      the shape is ignored. **Reset to rectangle** goes back to a plain box. A small picture
+      gets a warning: it may be the camera's low-resolution stream, and its main stream is often
+      hidden in Home Assistant.
    3. Choose what it detects: **States** (name them, for example *Open*, *Closed*, *Partial*),
       **Objects** (see *Object sensors* below) or **Reading** (see *Reading sensors* below).
       This can not be changed later.
@@ -74,7 +76,7 @@ away. Sensors not sent are marked on the dashboard.
 
 ## Object sensors
 
-An object sensor finds common objects — people, cars, bicycles, cats, dogs, birds and 70 more —
+An object sensor finds common objects — people, cars, bicycles, cats, dogs, birds and 74 more —
 with a pretrained detector. There is nothing to label: pick the objects in the wizard (popular
 ones first, all others under **Show all**) and the wizard tests it on a fresh frame right away.
 Where it gets your camera wrong, you can correct it later (see *Teaching an object sensor*).
@@ -112,7 +114,9 @@ Where it gets your camera wrong, you can correct it later (see *Teaching an obje
 ### Teaching an object sensor
 
 The detector works without training, but it can be corrected where it gets your camera wrong.
-Tap a box on the **Live** tab or on a history frame (or its entry under the frame):
+Tap a box on the **Live** tab or on a history frame (or its entry under the frame). A history
+entry you taught from says so (*Taught: Our car*), and what you taught counts as last seen at
+that frame's time:
 
 | Choice | What happens from then on |
 |---|---|
@@ -135,7 +139,9 @@ clearly (say a car in light you never taught it in), goes to the **review queue*
 car?* Meanwhile the label stays as it was — it is not switched off, nor on. **Yes** teaches the box
 as your label, **No** as an ordinary car, both in that light, so the next time it knows. A box that
 looks little like it is simply not yours, and it does not ask. At most one question per label is
-waiting, and no more often than the review cooldown (**Settings → Review queue**).
+waiting, and no more often than the review cooldown (**Settings → Review queue**). About a person's
+face it may ask a few times in a row (someone walking up shows several faces worth teaching), a
+few seconds apart, and answering one lets the next come right away.
 
 - Every check decides anew, box by box, by what a box looks like — not where it is, so an object
   that moves a little or is lit differently is still recognised. Boxes filtered away in a check
@@ -149,10 +155,119 @@ waiting, and no more often than the review cooldown (**Settings → Review queue
   away lately — check now and then that nothing real is filtered away.
 - **Settings → What you taught**: **Use what you taught** off lets the AI alone decide again (what
   you taught is kept); **Forget all** removes every taught box and own label.
+- **How close is close enough** can be tuned, in percent of likeness (100% = the very same
+  picture): when a box takes a taught answer, how long it keeps it while it stays in place, from
+  when it asks in the review queue, when a missed object is found again, and how unsure an AI box
+  may be to be looked at for one. **Settings → Teaching object sensors** sets them for all object
+  sensors; a sensor's **Settings → What you taught → Limits for this sensor** can set its own.
+  An empty field inherits and shows in grey what it uses: the default (which depends on the state
+  model, see below), or on a sensor the global value. Values you set yourself stay when you switch
+  the state model — look at them again after a switch. Recognised too eagerly? Raise the first
+  value; a known object not recognised in other light? Lower it a little, or teach it in that light.
 - A box drawn where the AI sees nothing at all (not even unsure) cannot be found by itself; you
   get a note when that is the case.
 - Export and import take what you taught along.
 
+### Recognising people by their face
+
+An object sensor that looks for **Person** can tell *who* it is: the people you name each get an
+on/off sensor and a count in Home Assistant, like own labels, and **Unknown person** turns on for
+someone it has not been taught. It is **off** until you turn it on. The people are **shared**:
+every camera that recognises faces knows everyone you named on any of them, and each person also
+gets two sensors of their own: *Kari seen by* (`sensor.visionstate_kari_seen_by`), the sensor that
+sees them now — the one that saw them last, when several do — or `not_seen`, and *Kari last seen*
+(`sensor.visionstate_kari_last_seen`), when they were last seen. Confirming afterwards that a frame
+was Kari (in Review or the History) counts too: the history of *Kari seen by* shows only what was
+recognised at the time, *Kari last seen* moves to that frame. After a restart or an update of the
+app, when everyone and everything was last seen comes back from the history (as far back as it
+keeps frames).
+
+**Before you turn it on.** Faces are biometric data. VisionState keeps them on your Home
+Assistant only — no face ever leaves it, as nothing else does — but the people you teach should
+know about it, children included. A camera that sees a street, a path others use or a
+neighbour's door may need their consent where you live (in Norway, Datatilsynet's rules for
+private cameras: your own house and garden only). It is **not a lock**: a photo of a face looks
+like that face, so never unlock a door or disarm an alarm on it alone. Recognition is weaker for
+children (their faces change quickly: add recent faces now and then), in infrared night images,
+with masks, hats or sunglasses, and — as for every public face model — not equally good for
+everyone.
+
+- **Turn it on** under the sensor's **Settings → Faces → Turn on…**, or when you make the sensor
+  (**Recognise people by their face** under the objects, once Person is picked). A sheet says
+  what is stored and which face model is downloaded (once, from Hugging Face), and nothing
+  happens until you confirm. While it downloads the sensor keeps working without faces; the card
+  shows the progress, and **Try again** if it failed. Without internet, put the file the message
+  names in the app's `models` folder by hand.
+- **Does my camera see faces well enough?** The **Live** tab draws a small rounded box around
+  each face it finds in a person, and says for each person what it saw: a name, *face too small*,
+  *face turned away*, *face cut off by the edge*, *face blurry* or *no face seen*, and how many of
+  the last people it looked at had a usable face. A face it cannot use counts as no face, never as
+  an unknown person. When faces are rarely usable, the card says the likely reason (for faces too
+  small, also the size of the camera's pictures).
+- **Limits** — **Settings → Recognising faces** sets them for all sensors; a sensor's **Faces →
+  Limits for this sensor** can set its own (an empty field follows the global value, shown in
+  grey). **Smallest face** (its width in pixels) sets how small a face may be; lower it only if
+  the names stay right, as small faces are easily mistaken. The similarities (in percent) say how
+  close a face must be to the faces you taught to be named, to be named at once without a second
+  check, to be asked about in the review queue, and to keep a name while the person stays. Their
+  defaults belong to the face model; values you set yourself stay when you switch it.
+- **Which camera works?** What counts is how many pixels a face gets, not the camera's megapixels
+  on the box. Use the camera's **main stream** over RTSP: many cameras and doorbells give Home
+  Assistant a small sub-stream or snapshot (640×480), where a face is only usable within a few
+  metres. Roughly, at the default *Smallest face*, for a sharp picture in good light:
+  - a camera of 640×480 with a normal lens (an ESP32 camera, a sub-stream): up to about 2–3 m;
+  - 1920×1080: about 5–8 m (less with a wider lens);
+  - a doorbell (very wide angle) on its main stream: about 1–1.5 m — enough for someone at the
+    door, but faces at the edge of the picture are stretched, and a doorbell sees people from below.
+  *Unknown person* needs a bigger face than a name (about two thirds of these distances).
+  A camera where people walk towards it at head height sees the most faces; one high up or from
+  the side mostly sees the tops and sides of heads.
+- **Teach a person**: tap a person on the **Live** tab or in a history frame. *Who is this?* comes
+  first, with a close-up of the face: tap a name, or **New person…**. Only a usable face can be
+  taught, so a back or a jacket never becomes someone. A few faces per person, in other light, from
+  other angles and on each camera, make it reliable; the message after teaching says how many a
+  person has. Someone who was only there for a moment (at a doorbell) can be named afterwards: a
+  face nobody is named for keeps a frame in the history (*Face seen, not named*; at most one a
+  minute, or a closer one).
+- **From photos**: on the **People** page, **Add a person** (a name, then **Add photos**) or
+  **Add photos** on a person takes photos from the phone — its camera or gallery — or a short video
+  turning the head a little (a frame every half second), or a ZIP of photos. The best face of each
+  goes through the same check; the message says how many were added and why a photo was skipped.
+  A quick start: faces taught on each camera still recognise people best, as a camera sees them
+  from another angle and in other light. Photos can be added once a sensor recognises faces.
+- **When someone comes**: a person walking up to the camera shows a usable face for only a few
+  seconds. When a check finds a person nobody is named for, the sensor checks about every second
+  for a while (*Person seen* on the **Live** tab): while they come closer or show their face,
+  until they are named or gone, and for half a minute at most. Someone who stays (on the steps,
+  in the garden) gets one such burst, not one every few minutes.
+- **How it decides**: each face is compared with the faces you taught for each person. A clear
+  match names the person; a less certain one needs a second check that agrees. A person who stays
+  where they were keeps the name while their face is turned away. Close to someone, but not
+  clearly, it asks in the review queue: *Is this Kari?* — **Yes**, another person, a new person or
+  *No, someone I do not know*. A face seen clearly (close enough, and nearly straight at the
+  camera) that matched nobody in two checks in a row turns **Unknown person** on. A face further
+  away or more turned can still be named, but if it looks like nobody it is only *not sure who*:
+  a face seen from the side often does not look like the faces you taught. **Ask me about faces I
+  do not know** (off by default) also asks *Who is this?* about faces nobody is named for. Without
+  it such a face is still kept in the history (*Face seen, not named*) to name later; a question
+  waiting for an answer keeps its frame twice as long as the history.
+- It never learns by itself: only faces you name are taught.
+- **People** (in the menu, once there are people or a sensor recognises faces) shows every person
+  with their faces and the camera each was taught on (× forgets one), where they were last seen,
+  people the AI finds alike (*teach both in more light and from more angles*) and faces that look
+  more like someone else than the person they were taught as (**move** gives them that name).
+  **Rename** changes the name (the entity IDs stay), **Remove person** removes their faces and
+  their entities on every camera, **Forget everyone** all of it. A sensor's **Quality** tab shows
+  the same people.
+- **Off** (the switch on the Faces card) removes the people's entities from that sensor; the people
+  stay. Deleting a sensor keeps the faces taught on it. Turned off on every sensor, the face model
+  is let go from memory; **Settings → AI model → Compare and manage the models** can then delete
+  its file.
+- **Where faces are kept**: in the app's own storage, not in the media folder (which Home
+  Assistant's media browser shows to every user) — so they are in Home Assistant backups: keep
+  those encrypted. The numbers the AI computes from a face are kept with them and deleted with the
+  person; an export never contains them.
+
 ## Reading sensors
 
 A reading sensor reads a **number** from a display or counter — the kWh on a power meter, a fuel
@@ -198,10 +313,9 @@ First choose **what it looks like**:
   last wheel turning: the value stays, but it is not counted as rejected and does not go to the
   review queue (the Live tab says *Last wheel turning*). If the last wheel never stands still,
   you can also leave it out of the region and count one digit and one decimal less.
-  On a real water meter with red wheels (an ESP32 camera with its flash) the wheel reader read
-  all 17 checked images right; the text reader read 15 with PP-OCRv6 small and 8 with the
-  included tiny reader. New counters use the wheel reader; counters set up before it came keep the
-  text reader until you choose *Wheel reader* on their Settings tab (their Live tab suggests it).
+  The wheel reader reads mechanical counters better than the text reader on every meter it was
+  tried on. New counters use it; counters set up before it came keep the text reader until you
+  choose *Wheel reader* on their Settings tab (their Live tab suggests it).
 - **Safety net**: a reading is rejected — and the last value kept — when the reader is less sure
   than the minimum (default 70 %), finds no number, a counter reads lower than before, a
   mechanical counter is read with the wrong number of digits, or the value changes more than the
@@ -248,10 +362,9 @@ First choose **what it looks like**:
   has been tried on three kinds of real water meter and a public set of 2,400 meter photos;
   other meters may need a tighter region. Small pointer dials (the red hands on some water
   meters) are not read.
-- Reading sensors are **new** and have hardly been tried on real cameras yet. Feedback helps a
-  lot: what the display or meter is, whether it read correctly, and a screenshot of *What the reader
-  sees* — in [GitHub Discussions](https://github.com/oleost/VisionState/discussions) or as an
-  issue.
+- Feedback on reading helps a lot, above all from meters and displays it has not seen yet: what
+  the display or meter is, whether it read correctly, and a screenshot of *What the reader sees* —
+  or an export (above) — in [GitHub Discussions](https://github.com/oleost/VisionState/discussions).
 - The default check interval is 30 s; a trigger (for example a motion sensor or image change
   detection) makes it read right away.
 
@@ -345,7 +458,8 @@ automations.
 ## History
 
 **History** at the top lists what every sensor recorded: state changes, objects that appeared,
-cleared or were filtered away, new values and rejected readings, and frames sent to review. Each
+cleared or were filtered away, faces nobody is named for, new values and rejected readings, and
+frames sent to review. Each
 sensor's **History** tab is the same list for that sensor alone; **Open in all history** there
 takes its filter to the History page.
 
@@ -377,6 +491,10 @@ How long history is kept is set under **Settings → Storage** (below).
 - **Export** (on a sensor) downloads a ZIP with the sensor's settings (region, states, objects or
   reading settings, triggers, review overrides) and all its images with labels — for an object
   sensor, the boxes it was taught and its own labels. Camera passwords are removed from the file.
+  For a sensor where faces were taught it asks first whether to **include the faces** taught on it
+  (unticked by default), with their people's names. An import adds them to the people of the same
+  name (or makes them), but face recognition stays off until you turn it on there: the import
+  says so and opens the sensor's Settings tab.
 - **Import** (dashboard or Settings) adds it as a new sensor (named "… (2)" when the name is
   taken) — also on another installation — and
   trains it automatically. If the camera URL needed a password, enter it again on the sensor's
@@ -391,15 +509,28 @@ two apps at a time (both publish the same entities).
 
 ## AI models
 
-Three models, chosen under **Settings → AI model** for all sensors of a kind:
+The models, chosen under **Settings → AI model** for all sensors of a kind (smallest first):
 
 - **State sensors:** DINOv2 small, 8-bit — included, runs on any CPU including a Raspberry
-  Pi 4. A slightly more accurate full-precision version is downloaded on first use (89 MB).
-  Switching retrains every state sensor from its stored images. It is always loaded: object
-  sensors that were taught use it too, to compare boxes with the ones you taught.
+  Pi 4. A slightly more accurate full-precision version is downloaded on first use (89 MB), and
+  for a fast PC **DINOv2 base** (347 MB, about 400 MB of memory, about three times as slow), which
+  tells similar states and taught objects apart best. Switching retrains every state sensor from
+  its stored images. It is always loaded: object sensors that were taught use it too, to compare
+  boxes with the ones you taught (with DINOv2 base a box must be a little closer to count).
 - **Object sensors:** D-FINE S — included, about 0.1 s per check on a modern PC and a few
   seconds on a Raspberry Pi 4. D-FINE N is faster and lighter but misses more (downloaded on
-  first use, 15 MB). The detector is only loaded while at least one object sensor exists.
+  first use, 15 MB). For a fast PC, **D-FINE M** (79 MB) and **D-FINE L** (125 MB) find more
+  small, far-off and partly hidden objects, at about three and four times the time of S. The
+  detector is only loaded while at least one object sensor exists.
+- **Faces** (object sensors that recognise faces): never included — downloaded when a sensor
+  first turns face recognition on. Faces are found with **YuNet** (OpenCV Zoo, MIT) and told
+  apart by **SFace** (Apache-2.0, 39 MB with YuNet, about 10 ms per face; fine on a Raspberry Pi 4)
+  or, for a fast PC, **AuraFace v1** (Apache-2.0, 261 MB, about 600 MB of memory, about six
+  times as slow per face), which tells faces apart better in poor light and at an angle. YuNet
+  was trained on a research data set and SFace's paper names research data sets too (their
+  terms are not commercial); AuraFace's makers say its data allows commercial use. Switching
+  compares every taught face again with the new model; the people are kept. Only loaded while a
+  sensor recognises faces.
 - **Reading sensors:** PP-OCRv6 tiny (PaddleOCR) — included, a few milliseconds per reading.
   PP-OCRv6 small is larger and reads unusual fonts more reliably (downloaded on first use,
   21 MB). Mechanical counters are read by the included **VisionState wheel reader** (2 MB, a few
@@ -407,7 +538,12 @@ Three models, chosen under **Settings → AI model** for all sensors of a kind:
   is set to the text reader. There is one wheel reader so far, so there is nothing to choose.
   Only loaded while at least one reading sensor exists.
 
-A choice you made stays when a later version recommends another model.
+**Compare and manage the models** (under the choices) lists every model, from the smallest to
+the largest, with its rough memory use, time per check, how accurate it is compared with the
+others and whether it is included, downloaded or still to download. A downloaded model that is
+not in use can be deleted there to free the disk (it is downloaded again when chosen); a face
+model only while no sensor recognises faces with it. A choice you made stays when a later
+version recommends another model.
 
 ## App options
 
diff --git a/visionstate/README.md b/visionstate/README.md
index f3647b4..fc36a31 100644
--- a/visionstate/README.md
+++ b/visionstate/README.md
@@ -1,8 +1,9 @@
 # VisionState
 
-Teach a local AI what your camera sees — garage door open, closed or halfway, gate shut,
-car in the driveway — and use it as a Home Assistant sensor. Label a few examples by clicking,
-and the sensor learns in seconds. Runs 100 % locally on any CPU.
+Teach a local AI what your camera sees — garage door open, closed or halfway, gate shut — and
+use it as a Home Assistant sensor. Find people, cars and animals without any training, tell the
+people of your household by their face, or read the number on a power, water or gas meter. Runs
+100 % locally on any CPU.
 
 ![VisionState dashboard](https://raw.githubusercontent.com/oleost/VisionState/main/docs/promo/dashboard.png)
 
diff --git a/visionstate/backend/tests/assets/README.md b/visionstate/backend/tests/assets/README.md
index b3551bc..665c6ff 100644
--- a/visionstate/backend/tests/assets/README.md
+++ b/visionstate/backend/tests/assets/README.md
@@ -10,6 +10,17 @@ down to 640 px.
 | `beach.jpg` | one person and several dogs | [Dog owner walking his dogs on the beach..JPG](https://commons.wikimedia.org/wiki/File:Dog_owner_walking_his_dogs_on_the_beach..JPG) |
 | `cat.jpg` | one cat | [House cat sitting next to apartment entrance door looking off to side.jpg](https://commons.wikimedia.org/wiki/File:House_cat_sitting_next_to_apartment_entrance_door_looking_off_to_side.jpg) |
 
+The face tests use NASA portraits, works of the US federal government and so in the public domain,
+from Wikimedia Commons, scaled down:
+
+| File | Who | Source |
+|---|---|---|
+| `face_williams_2006.jpg` | Suni Williams | [Sunita Williams.jpg](https://commons.wikimedia.org/wiki/File:Sunita_Williams.jpg) |
+| `face_williams_2018.jpg` | Suni Williams, twelve years later | [Sunita Williams in 2018.jpg](https://commons.wikimedia.org/wiki/File:Sunita_Williams_in_2018.jpg) |
+| `face_wilmore.jpg` | Butch Wilmore | [Barry Wilmore.jpg](https://commons.wikimedia.org/wiki/File:Barry_Wilmore.jpg) |
+| `face_crew.jpg` | Williams (left) and Wilmore, 2024 | [Boeing CFT Crew Portrait-Sunita Williams and Barry Wilmore (KSC-20240404-PH-NAS01 0001).jpg](https://commons.wikimedia.org/wiki/File:Boeing_CFT_Crew_Portrait-Sunita_Williams_and_Barry_Wilmore_(KSC-20240404-PH-NAS01_0001).jpg) |
+| `face_group.jpg` | A crew of nine with both of them | [The official Expedition 71 crew portrait with CFT crew.jpg](https://commons.wikimedia.org/wiki/File:The_official_Expedition_71_crew_portrait_with_CFT_crew.jpg) |
+
 `counter_red.jpg` is the counter of a real water meter (seven wheels, the last three red, read
 as `0632289`): one image from the checked readings a user exported from VisionState and shared
 in [issue #40](https://github.com/oleost/VisionState/issues/40) under CC0 (the export's
@@ -19,3 +30,14 @@ the region the same way.
 
 `lcd.png` is drawn by `tests/displays.py` (our own, no licence questions) and used by the CI smoke
 test for the number reader; the reading tests draw their displays on the fly.
+
+The demo sensors (`scripts/seed_demo.py`, the README screenshots) use:
+
+| File | What | Source |
+|---|---|---|
+| `demo_driveway.jpg` | Emma on her car, cut to 16:9 with a camera's date and name drawn on | [Woman Car](https://stocksnap.io/photo/woman-car-WKVLDV0K0G) by Candace McDaniel, StockSnap (CC0) |
+| `demo_emma_car.jpg` | Emma in the same car: a face to teach | [Woman Car](https://stocksnap.io/photo/woman-car-XHLANQWHBS), same author (CC0) |
+| `demo_emma_guitar.jpg` | Emma on the car with a guitar: a face to teach | [Woman Car](https://stocksnap.io/photo/woman-car-TV3QFON1JP), same author (CC0) |
+| `demo_garage.jpg` | A garage door from inside, cut; the script draws it open and half open | [Utility building interior view of wood panel overhead garage doors](https://commons.wikimedia.org/wiki/File:UTILITY_BUILDING_INTERIOR_VIEW_OF_WOOD_PANEL_OVERHEAD_GARAGE_DOORS,_LOOKING_NORTHWEST._-_Tucson_Plant_Materials_Center,_General_Utility_Building,_3241_North_Romero_Road,_HABS_ARIZ,10-TUCSO,32C-7.tif), HABS (public domain) |
+
+"Emma" is a made-up name. The water meter is `counter_turning.jpg` above.
diff --git a/visionstate/backend/tests/assets/demo_driveway.jpg b/visionstate/backend/tests/assets/demo_driveway.jpg
new file mode 100644
index 0000000..db97bef
Binary files /dev/null and b/visionstate/backend/tests/assets/demo_driveway.jpg differ
diff --git a/visionstate/backend/tests/assets/demo_emma_car.jpg b/visionstate/backend/tests/assets/demo_emma_car.jpg
new file mode 100644
index 0000000..9a1e200
Binary files /dev/null and b/visionstate/backend/tests/assets/demo_emma_car.jpg differ
diff --git a/visionstate/backend/tests/assets/demo_emma_guitar.jpg b/visionstate/backend/tests/assets/demo_emma_guitar.jpg
new file mode 100644
index 0000000..51ea2df
Binary files /dev/null and b/visionstate/backend/tests/assets/demo_emma_guitar.jpg differ
diff --git a/visionstate/backend/tests/assets/demo_garage.jpg b/visionstate/backend/tests/assets/demo_garage.jpg
new file mode 100644
index 0000000..51abfaf
Binary files /dev/null and b/visionstate/backend/tests/assets/demo_garage.jpg differ
diff --git a/visionstate/backend/tests/assets/face_crew.jpg b/visionstate/backend/tests/assets/face_crew.jpg
new file mode 100644
index 0000000..8e7fcac
Binary files /dev/null and b/visionstate/backend/tests/assets/face_crew.jpg differ
diff --git a/visionstate/backend/tests/assets/face_group.jpg b/visionstate/backend/tests/assets/face_group.jpg
new file mode 100644
index 0000000..bc6e79d
Binary files /dev/null and b/visionstate/backend/tests/assets/face_group.jpg differ
diff --git a/visionstate/backend/tests/assets/face_williams_2006.jpg b/visionstate/backend/tests/assets/face_williams_2006.jpg
new file mode 100644
index 0000000..3b52930
Binary files /dev/null and b/visionstate/backend/tests/assets/face_williams_2006.jpg differ
diff --git a/visionstate/backend/tests/assets/face_williams_2018.jpg b/visionstate/backend/tests/assets/face_williams_2018.jpg
new file mode 100644
index 0000000..bb6b3cf
Binary files /dev/null and b/visionstate/backend/tests/assets/face_williams_2018.jpg differ
diff --git a/visionstate/backend/tests/assets/face_wilmore.jpg b/visionstate/backend/tests/assets/face_wilmore.jpg
new file mode 100644
index 0000000..6de857e
Binary files /dev/null and b/visionstate/backend/tests/assets/face_wilmore.jpg differ
diff --git a/visionstate/backend/tests/conftest.py b/visionstate/backend/tests/conftest.py
index 5ffb0d5..9da5af7 100644
--- a/visionstate/backend/tests/conftest.py
+++ b/visionstate/backend/tests/conftest.py
@@ -3,7 +3,7 @@
 
 import pytest
 
-from visionstate import backbones, detectors, readers
+from visionstate import backbones, detectors, faces, readers
 
 MODEL_DIR = Path(os.environ.get("VISIONSTATE_TEST_MODELS", Path(__file__).parent.parent / "models"))
 ASSETS = Path(__file__).parent / "assets"  # real photos (CC0), see assets/README.md
@@ -47,3 +47,11 @@ def init(self, path):
     yield
     for db in opened:
         db.engine.dispose()
+
+
+_sface = faces.RECOGNISERS[faces.DEFAULT_RECOGNISER]
+# Face models are never bundled: on disk after `python -m visionstate.backbones models --all` (as in CI).
+requires_faces = pytest.mark.skipif(
+    not all((MODEL_DIR / spec.filename).exists() for spec in (_default, _detector, faces.DETECTOR, _sface)),
+    reason=f"Face models not downloaded; run `python -m visionstate.backbones {MODEL_DIR} --all`",
+)
diff --git a/visionstate/backend/tests/test_docs.py b/visionstate/backend/tests/test_docs.py
new file mode 100644
index 0000000..3570d0c
--- /dev/null
+++ b/visionstate/backend/tests/test_docs.py
@@ -0,0 +1,159 @@
+"""The docs stay true to the code: every link, repository path and code name they mention exists.
+
+Runs on the repository checkout (CI); skipped where the docs are not around (the app image).
+A failure here means a rename or a removal left a doc behind: fix the doc in the same change.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+from visionstate import settings
+
+REPO = Path(__file__).resolve().parents[3]
+BACKEND = REPO / "visionstate" / "backend" / "visionstate"
+FRONTEND = REPO / "visionstate" / "frontend"
+
+pytestmark = pytest.mark.skipif(not (REPO / "CLAUDE.md").exists(), reason="no repository checkout")
+
+# The CHANGELOG is history: it describes each version as it was.
+DOCS = [
+    *REPO.glob("*.md"),
+    *(REPO / "docs").glob("*.md"),
+    REPO / "visionstate" / "DOCS.md",
+    REPO / "visionstate" / "README.md",
+    REPO / "tools" / "wheelreader" / "README.md",
+    REPO / "visionstate" / "backend" / "tests" / "assets" / "README.md",
+]
+# Where a path in a doc may start from.
+BASES = [
+    REPO,
+    REPO / "visionstate",
+    REPO / "visionstate" / "backend",
+    BACKEND,
+    FRONTEND,
+    FRONTEND / "src",
+    FRONTEND / "src" / "lib",
+]
+SOURCE_SUFFIXES = {".py", ".ts", ".svelte", ".md", ".yml", ".yaml", ".sh", ".css", ".toml"}
+TOP_DIRS = {"visionstate", "docs", "scripts", "tools", ".github", "backend", "frontend", "e2e", "tests", "lib",
+            "pages", "engine", "api"}  # fmt: skip
+# Paths that are made at run time, not kept in the repository.
+NOT_IN_REPO = (".venv", "dist", "node_modules", "test-results", "dev/", "VisionStateLocal", "models")
+FILE_WORDS = {"json", "py", "md", "ts", "yml", "yaml", "txt", "zip", "jpg", "png", "onnx", "db", "svelte", "css",
+              "sh", "pt", "spec"}  # fmt: skip
+SKIP_TREES = ("node_modules", ".venv", "dist", "test-results", "__pycache__", ".git")
+
+
+def _files() -> list[Path]:
+    return [p for p in REPO.rglob("*") if p.is_file() and not any(part in SKIP_TREES for part in p.parts)]
+
+
+FILES = _files()
+NAMES = {p.name for p in FILES}
+# Modules by name; several share one (faces.py, engine/faces.py, api/faces.py): any of them counts.
+MODULES: dict[str, list[Path]] = {}
+for _path in BACKEND.rglob("*.py"):
+    if "__pycache__" not in _path.parts and _path.stem != "__init__":
+        MODULES.setdefault(_path.stem, []).append(_path)
+BACKEND_TEXT = "\n".join(p.read_text(encoding="utf-8") for paths in MODULES.values() for p in paths)
+# Tables whose columns a doc may name (`prediction.read_ok`); "sensor" is also a Home Assistant domain.
+TABLES = set(re.findall(r'__tablename__ = "(\w+)"', (BACKEND / "db.py").read_text(encoding="utf-8"))) - {"sensor"}
+# A plan names code that is still to be written; only its links and paths are checked.
+PLANS = {REPO / "docs" / "WHEEL_READER_PLAN.md"}
+
+
+def _prose(doc: Path) -> str:
+    """The doc without fenced code blocks (commands and examples, not references)."""
+    return re.sub(r"^```.*?^```", "", doc.read_text(encoding="utf-8"), flags=re.M | re.S)
+
+
+def _defines(text: str, name: str) -> bool:
+    n = re.escape(name)
+    return re.search(rf"(def|class)\s+{n}\b|^\s*{n}\s*[:=]|self\.{n}\s*[:=]|^\s*{n}\s*$", text, re.M) is not None
+
+
+def _settings_dicts() -> dict[str, dict]:
+    return {k: v for k, v in vars(settings).items() if k.isupper() and isinstance(v, dict)}
+
+
+def _problem(token: str, doc: Path) -> str | None:
+    """Why `token` (inline code in `doc`) does not match the repository, or None."""
+    if any(c in token for c in " <>{}*…?#:,|$=") or token.startswith(("/", "http", "-")):
+        return None
+    # settings.X["key"] / X["key"]
+    m = re.fullmatch(r'(?:settings\.)?([A-Z][A-Z0-9_]+)\["(\w+)"\]', token)
+    if m:
+        d = getattr(settings, m[1], None)
+        if not isinstance(d, dict):
+            return f"settings.{m[1]} is not a dict of settings" if token.startswith("settings.") else None
+        return None if m[2] in d else f'settings.{m[1]} has no "{m[2]}"'
+    # module.name, Class.name, table.column
+    m = re.fullmatch(r"([A-Za-z_]\w*)\.([A-Za-z_]\w*)(\(\))?", token)
+    if m and m[2] not in FILE_WORDS:
+        if doc in PLANS:
+            return None
+        first, name = m[1], m[2]
+        if first in MODULES:
+            text = "\n".join(p.read_text(encoding="utf-8") for p in MODULES[first])
+            if _defines(text, name) or name.endswith("_"):
+                return None
+            return f"{first}.py does not define {name}"
+        if first[0].isupper() and re.search(rf"class {first}\b", BACKEND_TEXT):
+            return None if _defines(BACKEND_TEXT, name) else f"nothing defines {first}.{name}"
+        if first in TABLES:
+            return None if _defines((BACKEND / "db.py").read_text(encoding="utf-8"), name) else f"no column {token}"
+        return None
+    # paths
+    if not re.fullmatch(r"[\w.@-]+(/[\w.@-]+)*/?", token) or any(n in token for n in NOT_IN_REPO):
+        return None
+    path = token.rstrip("/")
+    has_dir = "/" in path
+    if has_dir and path.split("/")[0] not in TOP_DIRS and not path.startswith(".."):
+        return None
+    if not has_dir and Path(path).suffix not in SOURCE_SUFFIXES:
+        return None
+    if not has_dir:
+        return None if path in NAMES else f"no file named {path}"
+    for base in [doc.parent, *BASES]:
+        if (base / path).exists():
+            return None
+    return f"no such path {token}"
+
+
+def test_links_in_the_docs_lead_somewhere():
+    missing = []
+    for doc in DOCS:
+        for target in re.findall(r"\]\(([^)\s]+)\)", _prose(doc)):
+            if target.startswith(("http://", "https://", "mailto:", "#")):
+                continue
+            if not (doc.parent / target.split("#")[0]).exists():
+                missing.append(f"{doc.relative_to(REPO)}: {target}")
+    assert not missing, "links to nothing:\n" + "\n".join(missing)
+
+
+def test_code_named_in_the_docs_exists():
+    problems = []
+    for doc in DOCS:
+        for token in re.findall(r"`([^`\n]+)`", _prose(doc)):
+            why = _problem(token.strip(), doc)
+            if why:
+                problems.append(f"{doc.relative_to(REPO)}: `{token}` — {why}")
+    assert not problems, "the docs name things the code does not have:\n" + "\n".join(problems)
+
+
+def test_values_named_in_the_docs_match_settings():
+    """`some_setting` (0.88) in a doc must be the value in settings.py."""
+    values: dict[str, set] = {}
+    for d in _settings_dicts().values():
+        for k, v in d.items():
+            if isinstance(v, (int, float)) and not isinstance(v, bool):
+                values.setdefault(k, set()).add(float(v))
+    wrong = []
+    for doc in DOCS:
+        pattern = r'`(?:[A-Z_]+\[")?(\w+)(?:"\])?` \((\d+(?:\.\d+)?)[ ),;]'
+        for key, number in re.findall(pattern, _prose(doc)):
+            if len(values.get(key, ())) == 1 and float(number) not in values[key]:
+                wrong.append(f"{doc.relative_to(REPO)}: `{key}` ({number}) — settings.py says {values[key].pop():g}")
+    assert not wrong, "values in the docs differ from settings.py:\n" + "\n".join(wrong)
diff --git a/visionstate/backend/tests/test_faces.py b/visionstate/backend/tests/test_faces.py
new file mode 100644
index 0000000..5c75c1b
--- /dev/null
+++ b/visionstate/backend/tests/test_faces.py
@@ -0,0 +1,678 @@
+"""Recognising people by their face: the face pipeline on real photos, matching, and the sensor flow.
+
+The photos are NASA portraits (public domain, tests/assets/README.md): Suni Williams in 2006 and
+2018, Butch Wilmore, the two of them together, and a crew of nine with both of them in it.
+"""
+
+import io
+import json
+import zipfile
+from concurrent.futures import ThreadPoolExecutor
+
+import numpy as np
+import pytest
+from fastapi.testclient import TestClient
+from PIL import Image, ImageFilter
+from sqlalchemy import delete, func, select
+
+from visionstate import detectors, faces
+from visionstate.db import FaceEmbedding
+from visionstate.main import create_app
+from visionstate.settings import FACE_UNKNOWN_KEY, FACES, merge_objects
+
+from .conftest import ASSETS, MODEL_DIR, requires_faces
+from .test_integration import wait_for
+from .test_objects import PhotoCamera, create, settings  # noqa: F401 - fixture
+
+# --- geometry and matching (no models) ---------------------------------------------------------
+
+
+FRAME = (640, 480)  # the frame the drawn faces are in
+
+
+def face_at(points, score=0.9) -> faces.Face:
+    xs, ys = [p[0] for p in points], [p[1] for p in points]
+    return faces.Face((min(xs) - 10, min(ys) - 20, max(xs) + 10, max(ys) + 10), tuple(points), score)
+
+
+def test_align_puts_the_five_points_on_the_template():
+    # The template turned by 20°, scaled by 2.5 and moved: aligning must undo exactly that.
+    angle = np.radians(20)
+    rot = np.array([[np.cos(angle), -np.sin(angle)], [np.sin(angle), np.cos(angle)]])
+    points = (faces.TEMPLATE_112 @ rot.T) * 2.5 + np.array([200, 150])
+    m = faces.similarity_transform(points, faces.TEMPLATE_112)
+    mapped = points @ m[:, :2].T + m[:, 2]
+    assert np.allclose(mapped, faces.TEMPLATE_112, atol=1e-6)
+    # Drawn dots at the points land on the template's points in the aligned face.
+    image = Image.new("RGB", (500, 500))
+    for x, y in points:
+        image.paste((255, 255, 255), (round(x) - 5, round(y) - 5, round(x) + 6, round(y) + 6))
+    aligned = np.asarray(faces.align(image, face_at([tuple(p) for p in points])).convert("L"))
+    for x, y in faces.TEMPLATE_112:
+        assert aligned[round(y), round(x)] > 128
+
+
+def test_even_light_spreads_a_dark_face_over_the_full_range():
+    # A face in front of a bright sky: dark and flat. Evened out it uses the full range, its
+    # colours kept (a red face stays red), at the same size.
+    dark = Image.effect_noise((112, 112), 20).point(lambda v: 20 + v // 8).convert("RGB")
+    dark = Image.merge("RGB", (dark.getchannel(0).point(lambda v: v + 10), dark.getchannel(1), dark.getchannel(2)))
+    even = faces.even_light(dark)
+    low, high = even.convert("L").getextrema()
+    assert even.size == dark.size and low < 40 and high > 215
+    r, g, b = (np.asarray(even.getchannel(c), dtype=np.float32).mean() for c in range(3))
+    assert r > g and r > b
+
+
+def test_turn_eye_distance_and_quality_gate():
+    straight = face_at([(40, 50), (80, 50), (60, 70), (45, 90), (75, 90)])  # 60 px wide
+    half = face_at([(40, 50), (80, 50), (75, 70), (45, 90), (75, 90)])  # turned, but can be named
+    sideways = face_at([(40, 50), (80, 50), (85, 70), (45, 90), (75, 90)])
+    assert straight.eye_distance == 40 and straight.width == 60
+    assert faces.turn(straight) == 0 and faces.turn(sideways) > FACES["max_turn"]
+    sharp = Image.effect_noise((112, 112), 60).convert("RGB")
+    assert faces.problem(straight, sharp, 30, FRAME) is None
+    assert faces.problem(straight, sharp, 61, FRAME) == "small"  # the face's width, not its eyes
+    assert faces.problem(half, sharp, 30, FRAME) is None
+    assert faces.problem(sideways, sharp, 30, FRAME) == "turned"
+    # A profile: eyes close together for the width of the face is turned, however big it is.
+    profile = faces.Face((10, 10, 70, 80), ((40, 40), (44, 40), (30, 55), (38, 65), (42, 65)), 0.9)
+    assert faces.problem(profile, sharp, 30, FRAME) == "turned"
+    assert faces.problem(profile, sharp, 61, FRAME) == "small"
+    assert faces.problem(face_at(straight.points, score=0.5), sharp, 30, FRAME) == "unsure"
+    assert faces.problem(straight, Image.new("RGB", (112, 112), (90, 90, 90)), 30, FRAME) == "blurry"
+    # Matching nobody makes a stranger only of a face seen clearly: big enough and nearly straight.
+    assert faces.clearly_seen(straight, 30) and not faces.clearly_seen(straight, 45)
+    assert not faces.clearly_seen(half, 30)
+    assert not faces.clearly_seen(face_at(straight.points, score=0.8), 30)
+    # Cut by the edge of the frame (a person leaning into the camera): the eyes are guessed.
+    assert faces.problem(straight, sharp, 30, (200, 85)) == "cut"
+    top = faces.Face((143, 0, 258, 74), ((174, -4), (225, 0), (198, 17), (175, 35), (214, 38)), 0.79)
+    assert faces.cut_off(top, (480, 640)) and not faces.cut_off(straight, FRAME)
+
+
+def test_head_region_is_the_top_of_a_standing_person_and_all_of_a_close_up():
+    standing = faces.head_region((0.4, 0.1, 0.5, 0.9), 1000, 1000)  # 100 × 800 px
+    assert standing[1] < 100 and standing[3] < 100 + 1.3 * 100 + 20
+    close_up = faces.head_region((0.2, 0.2, 0.6, 0.6), 1000, 1000)  # 400 × 400 px: taken whole
+    assert close_up[3] >= 600
+
+
+def unit(*values):
+    v = np.array(values, dtype=np.float32)
+    return v / np.linalg.norm(v)
+
+
+def index(entries) -> faces.FaceIndex:
+    return faces.FaceIndex(
+        "test", list(range(1, len(entries) + 1)), [e[0] for e in entries], np.stack([e[1] for e in entries])
+    )
+
+
+LIMITS = faces.RECOGNISERS[faces.DEFAULT_RECOGNISER].thresholds
+
+
+def test_a_person_is_the_mean_of_their_closest_faces():
+    kari, eva = unit(1, 0, 0), unit(0, 1, 0)
+    # One of Kari's faces was taught as Eva by mistake: Eva's score is her mean, not that face.
+    idx = index([("kari", kari), ("kari", kari), ("kari", kari), ("eva", eva), ("eva", eva), ("eva", kari)])
+    who = faces.identify(idx, kari)
+    assert who.label == "kari" and who.similarity == 1.0 and who.margin == pytest.approx(1 - 1 / 3, abs=1e-3)
+    assert faces.decide(who, LIMITS) == "match"
+    assert faces.decide(faces.identify(idx, unit(0, 0, 1)), LIMITS) == "unknown"
+    assert faces.decide(faces.Identity(None, 0, 0, None), LIMITS) == "unknown"
+    between = faces.Identity("kari", (LIMITS["ask_similarity"] + LIMITS["match_similarity"]) / 2, 0.3, 1)
+    assert faces.decide(between, LIMITS) == "ask"
+    # Close to two people at once: not a match.
+    assert faces.decide(faces.Identity("kari", 0.9, 0.01, 1), LIMITS) == "ask"
+    # A person who stays keeps their name down to keep_similarity.
+    staying = faces.Identity("kari", LIMITS["keep_similarity"] + 0.01, 0.3, 1)
+    assert faces.decide(staying, LIMITS, kept="kari") == "match"
+    assert faces.decide(staying, LIMITS) != "match"
+
+
+def test_only_a_clearly_seen_face_that_matches_nobody_is_a_stranger():
+    from visionstate.engine.faces import FacesMixin
+
+    idx = index([("kari", unit(1, 0, 0))])
+    box = [0.1, 0.1, 0.5, 0.9]
+
+    def check(clear: bool, before: list[dict]) -> dict:
+        det = {"key": "person", "box": box, "face": {"problem": None}}
+        face_settings = {"ask_unknown": False}
+        FacesMixin._name_face(None, det, before, idx, unit(0, 0, 1), LIMITS, face_settings, clear)  # type: ignore[arg-type]
+        return det
+
+    # Turned or small: matching nobody may be the angle, so it never counts towards a stranger.
+    det = check(False, [])
+    assert det["face"]["state"] == "unclear" and "label" not in det
+    det = check(False, [det])
+    assert "label" not in det
+    # Seen clearly twice: a stranger, who stays one while turned away.
+    det = check(True, [check(True, [])])
+    assert det["label"] == FACE_UNKNOWN_KEY
+    assert check(False, [det])["label"] == FACE_UNKNOWN_KEY
+
+
+def test_every_face_model_is_pinned_and_described():
+    for spec in (faces.DETECTOR, *faces.RECOGNISERS.values()):
+        assert "/resolve/" in spec.url and len(spec.sha256) == 64 and spec.size > 0
+        assert spec.description and spec.license and spec.data and spec.source
+        assert not spec.bundled  # downloaded only when a sensor turns faces on
+    for spec in faces.RECOGNISERS.values():
+        t = spec.thresholds
+        assert t["ask_similarity"] < t["keep_similarity"] < t["match_similarity"] < t["sure_similarity"]
+        assert spec.footprint.ram_mb > 0 and spec.footprint.time_ms > 0
+    ranks = [s.footprint.accuracy for s in sorted(faces.RECOGNISERS.values(), key=lambda s: s.footprint.time_ms)]
+    assert ranks == sorted(ranks)
+
+
+# --- the models on real photos ---------------------------------------------------------------------
+
+
+def on_disk(spec):
+    return pytest.param(
+        spec,
+        id=spec.id,
+        marks=pytest.mark.skipif(
+            not all((MODEL_DIR / s.filename).exists() for s in (spec, faces.DETECTOR)),
+            reason=f"{spec.id} not downloaded (backbones models --all)",
+        ),
+    )
+
+
+def photo_faces(recogniser, name):
+    """(x of the person box, embedding, face) of every usable face in a photo."""
+    image = Image.open(ASSETS / f"{name}.jpg").convert("RGB")
+    spec = detectors.DETECTORS[detectors.DEFAULT_DETECTOR]
+    people = [d for d in detectors.Detector(spec, MODEL_DIR / spec.filename).detect(image, 0.6) if d.key == "person"]
+    finder = faces.FaceDetector(faces.DETECTOR, MODEL_DIR / faces.DETECTOR.filename)
+    regions = [faces.head_region(p.box, image.width, image.height) for p in people]
+    result = []
+    for person, region, face in zip(people, regions, finder.detect([image.crop(r) for r in regions]), strict=True):
+        assert face is not None, f"no face in a person box of {name}"
+        moved = face.moved(region[0], region[1], 1.0)
+        aligned = faces.align(image, moved)
+        assert faces.problem(moved, aligned, 30, image.size) is None
+        result.append((person.box[0], recogniser.embed([aligned])[0], moved))
+    return result
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in faces.RECOGNISERS.values()])
+def test_loading_a_face_model_keeps_the_log_quiet(spec, capfd):
+    """SFace's file lists its weights as graph inputs: ONNX Runtime wrote 174 warnings per load."""
+    faces.Recogniser(spec, MODEL_DIR / spec.filename)
+    assert "onnxruntime" not in capfd.readouterr().err.replace("\x00", "")
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in faces.RECOGNISERS.values()])
+def test_every_face_model_tells_people_apart_in_real_photos(spec):
+    recogniser = faces.Recogniser(spec, MODEL_DIR / spec.filename)
+    limits = spec.thresholds
+    [(_, williams_2006, _)] = photo_faces(recogniser, "face_williams_2006")
+    [(_, williams_2018, _)] = photo_faces(recogniser, "face_williams_2018")
+    [(_, wilmore, _)] = photo_faces(recogniser, "face_wilmore")
+    assert williams_2006 @ williams_2018 >= limits["match_similarity"]  # twelve years apart
+    assert williams_2006 @ wilmore < limits["ask_similarity"]
+    idx = index([("williams", williams_2006), ("williams", williams_2018), ("wilmore", wilmore)])
+    # Both of them together (2024): each found, the right way round.
+    crew = sorted(photo_faces(recogniser, "face_crew"), key=lambda c: c[0])
+    assert [faces.identify(idx, v).label for _, v, _ in crew] == ["williams", "wilmore"]
+    assert all(faces.decide(faces.identify(idx, v), limits) == "match" for _, v, _ in crew)
+    # A crew of nine: the two of them, and nobody else is taken for them.
+    named = [faces.decide(faces.identify(idx, v), limits) for _, v, _ in photo_faces(recogniser, "face_group")]
+    assert named.count("ask") == 0 and named.count("match") >= 2
+
+
+@requires_faces
+def test_a_blurred_or_small_face_is_no_face():
+    image = Image.open(ASSETS / "face_williams_2018.jpg").convert("RGB")
+    finder = faces.FaceDetector(faces.DETECTOR, MODEL_DIR / faces.DETECTOR.filename)
+    [face] = finder.detect([image])
+    assert face is not None and faces.problem(face, faces.align(image, face), 30, image.size) is None
+    blurred = image.filter(ImageFilter.GaussianBlur(6))
+    [soft] = finder.detect([blurred])
+    assert soft is None or faces.problem(soft, faces.align(blurred, soft), 30, blurred.size) in ("blurry", "unsure")
+    tiny = image.resize((image.width // 8, image.height // 8))
+    [small] = finder.detect([tiny])
+    assert small is None or faces.problem(small, faces.align(tiny, small), 30, tiny.size) == "small"
+
+
+# --- the sensor --------------------------------------------------------------------------------------
+
+
+def view(client, sid):
+    return client.get(f"/api/v1/sensors/{sid}").json()
+
+
+def live(client, sid):
+    return {c["key"]: c for c in view(client, sid)["objects"]["live"]}
+
+
+def person_with_face(client, sid):
+    """The frame of the last check and its person box with a usable face (or None)."""
+    v = view(client, sid)
+    for d in v["objects"]["detections"]:
+        if d["key"] == "person" and (d.get("face") or {}).get("box") and not d["face"].get("problem"):
+            return v["live"]["frame_id"], d
+    return None
+
+
+def faces_patch(enabled, **extra):
+    return {"objects": {"classes": ["person"], "clear_after_s": 0, "faces": {"enabled": enabled, **extra}}}
+
+
+@requires_faces
+def test_people_are_taught_recognised_forgotten_exported(settings):  # noqa: F811
+    camera = PhotoCamera("face_williams_2006")
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        rt.grabber = camera
+        sid = create(client, objects={"classes": ["person"], "clear_after_s": 0}, interval_s=1).json()["id"]
+        # Off by default: no model, no face search, no "unknown person".
+        assert view(client, sid)["objects"]["faces"]["enabled"] is False
+        assert wait_for(lambda: live(client, sid)["person"]["on"], timeout=60)
+        assert rt.face_model is None and FACE_UNKNOWN_KEY not in live(client, sid)
+        body = {"frame_id": view(client, sid)["live"]["frame_id"], "box": [0, 0, 1, 1], "new_person": "Suni"}
+        assert client.post(f"/api/v1/sensors/{sid}/faces", json=body).status_code == 400
+
+        # Turned on: the model loads, faces are looked for, and "unknown person" is an entity.
+        assert client.patch(f"/api/v1/sensors/{sid}", json=faces_patch(True)).status_code == 200
+        assert wait_for(lambda: client.get("/api/v1/status").json()["faces"]["loaded"], timeout=60)
+        assert "binary_sensor.beach_unknown_person" in view(client, sid)["entity_ids"]
+        assert wait_for(lambda: person_with_face(client, sid), timeout=30)
+        stats = view(client, sid)["objects"]["face_stats"]
+        assert stats["looked"] >= 1 and stats["usable"] >= 1
+        with Image.open(ASSETS / "face_williams_2006.jpg") as photo:
+            assert stats["frame"] == list(photo.size)
+        # A face nobody is named for keeps its frame in the history (once, not every check).
+        seen = {"sensor": sid, "event": "face_seen", "limit": 10}
+        assert wait_for(lambda: client.get("/api/v1/history", params=seen).json()["total"] == 1, timeout=30)
+        row = client.get("/api/v1/history", params=seen).json()["items"][0]
+        assert row["published_key"] == "face" and row["has_frame"] and not row["is_change"]
+
+        def teach(name):
+            frame_id, person = person_with_face(client, sid)
+            body = {"frame_id": frame_id, "box": person["box"], "score": person["score"], "new_person": name}
+            resp = client.post(f"/api/v1/sensors/{sid}/faces", json=body)
+            assert resp.status_code == 201, resp.text
+            return resp.json()
+
+        suni = teach("Suni")
+        assert suni["label"] == "suni" and suni["faces"] == 1
+        assert "binary_sensor.beach_suni" in view(client, sid)["entity_ids"]
+        assert wait_for(lambda: live(client, sid).get("suni", {}).get("on"), timeout=30)
+        # A box without a face cannot be taught: a back or a jacket never becomes someone.
+        frame_id = view(client, sid)["live"]["frame_id"]
+        check = client.post(f"/api/v1/sensors/{sid}/faces/check", json={"frame_id": frame_id, "box": [0, 0.8, 0.3, 1]})
+        assert check.status_code == 200 and check.json()["problem"] == "none" and check.json()["message"]
+        nobody = {"frame_id": frame_id, "box": [0, 0.8, 0.3, 1], "person": "suni"}
+        assert client.post(f"/api/v1/sensors/{sid}/faces", json=nobody).status_code == 400
+
+        camera.name = "face_wilmore"
+        assert wait_for(lambda: not live(client, sid)["suni"]["on"] and person_with_face(client, sid), timeout=30)
+        teach("Butch")
+
+        # Both together, and in a crew of nine: each is named, the others are unknown people.
+        camera.name = "face_crew"
+        assert wait_for(lambda: live(client, sid)["suni"]["on"] and live(client, sid)["butch"]["on"], timeout=30)
+        camera.name = "face_group"
+        assert wait_for(lambda: live(client, sid)[FACE_UNKNOWN_KEY]["on"], timeout=60)
+        assert live(client, sid)[FACE_UNKNOWN_KEY]["count"] <= 7
+        assert wait_for(lambda: live(client, sid)["suni"]["on"] and live(client, sid)["butch"]["on"], timeout=30)
+
+        people = client.get("/api/v1/people").json()
+        assert [p["name"] for p in people["people"]] == ["Suni", "Butch"] and people["sensors"] == [sid]
+        face_id = people["people"][0]["faces"][0]["id"]
+        first = people["people"][0]["faces"][0]
+        assert first["suspect"] is None and first["sensor_id"] == sid and people["look_alikes"] == []
+        # Embeddings are cached per model and version (an older version is recomputed).
+        with rt.db.session() as s:
+            keys = set(s.scalars(select(FaceEmbedding.model)))
+        assert keys == {f"{faces.DEFAULT_RECOGNISER}/{faces.EMBEDDING_VERSION}"}
+        # A check and a request building the index at once store each face's embedding once.
+        for _ in range(5):
+            with rt.db.session() as s:
+                s.execute(delete(FaceEmbedding))
+            with ThreadPoolExecutor(8) as pool:
+                built = list(pool.map(lambda _: rt._build_face_index(rt.face_model, 0), range(8)))
+            assert all(len(index.ids) == 2 for index in built)
+        with rt.db.session() as s:
+            assert s.scalar(select(func.count()).select_from(FaceEmbedding)) == 2
+        # Each person's own entity says where they are seen: on this sensor now.
+        assert people["people"][0]["seen"]["now"] == "beach" and people["people"][0]["seen"]["sensor_id"] == sid
+        image = client.get(f"/api/v1/faces/{face_id}/image")
+        assert image.status_code == 200 and image.headers["content-type"] == "image/jpeg"
+        # Faces are kept in the app's own storage, never in the media folder.
+        assert list((settings.data_dir / "faces").glob("*.jpg"))
+        assert not list((settings.media_dir / "samples").rglob("*.jpg"))
+        # Not among the boxes taught by their look.
+        assert client.get(f"/api/v1/sensors/{sid}/taught").json()["examples"] == []
+        assert view(client, sid)["objects"]["taught"] == 0 and view(client, sid)["objects"]["taught_faces"] == 2
+
+        # Shared: another sensor that recognises faces knows them without being taught.
+        other = create(client, name="Door", objects={"classes": ["person"], "clear_after_s": 0}, interval_s=1)
+        door = other.json()["id"]
+        assert client.patch(f"/api/v1/sensors/{door}", json=faces_patch(True)).status_code == 200
+        assert "binary_sensor.door_suni" in view(client, door)["entity_ids"]
+        assert wait_for(lambda: live(client, door).get("suni", {}).get("on"), timeout=30)
+        # Deleting a sensor keeps the faces taught on it.
+        assert client.delete(f"/api/v1/sensors/{door}").status_code == 204
+
+        # Export: the faces taught on this camera only when asked for, with their people's names.
+        plain = zipfile.ZipFile(io.BytesIO(client.get(f"/api/v1/sensors/{sid}/export").content))
+        manifest = json.loads(plain.read("manifest.json"))
+        assert manifest["samples"] == [] and manifest["faces"] == []
+        with_faces = client.get(f"/api/v1/sensors/{sid}/export", params={"faces": True}).content
+        stored = json.loads(zipfile.ZipFile(io.BytesIO(with_faces)).read("manifest.json"))["faces"]
+        assert sorted(f["person"] for f in stored) == ["butch", "suni"]
+        imported = client.post("/api/v1/import", files={"file": ("b.zip", with_faces, "application/zip")})
+        assert imported.status_code == 201, imported.text
+        copy = imported.json()["id"]
+        assert view(client, copy)["objects"]["faces"]["enabled"] is False  # turned on there, by the user
+        assert imported.json()["faces_off"] is True  # so the UI says to turn it on
+        # The same people (no copies of them), each with the face again, from the new sensor.
+        people = client.get("/api/v1/people").json()["people"]
+        assert [(p["key"], len(p["faces"])) for p in people] == [("suni", 2), ("butch", 2)]
+
+        # Renamed: the key (and entity IDs) stay. A face under the wrong name is moved; forgetting
+        # a person removes their faces and entities everywhere.
+        assert client.patch("/api/v1/people/suni", json={"name": "Sunita"}).json() == {"key": "suni", "name": "Sunita"}
+        assert client.patch("/api/v1/people/suni", json={"name": "butch"}).status_code == 400  # taken
+        assert client.patch(f"/api/v1/faces/{face_id}", json={"person": "butch"}).status_code == 200
+        assert client.delete(f"/api/v1/faces/{face_id}").status_code == 204
+        assert client.delete("/api/v1/people/suni").status_code == 204
+        assert "binary_sensor.beach_suni" not in view(client, sid)["entity_ids"]
+        assert client.delete("/api/v1/people").status_code == 204
+        assert client.get("/api/v1/people").json()["people"] == []
+        assert not list((settings.data_dir / "faces").glob("*.jpg"))
+
+        # Turned off everywhere: the face model is let go; the files can then be deleted.
+        assert client.delete(f"/api/v1/models/face_models/{faces.DEFAULT_RECOGNISER}").status_code == 409
+        assert client.patch(f"/api/v1/sensors/{sid}", json=faces_patch(False)).status_code == 200
+        assert wait_for(lambda: rt.face_model is None, timeout=10)
+        assert FACE_UNKNOWN_KEY not in live(client, sid)
+
+
+@requires_faces
+def test_a_face_question_is_answered_in_the_review_queue(settings):  # noqa: F811
+    camera = PhotoCamera("face_williams_2006")
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        rt.grabber = camera
+        patch = faces_patch(True, ask_unknown=True)["objects"]
+        sid = create(client, objects=patch, interval_s=1).json()["id"]
+        assert wait_for(lambda: person_with_face(client, sid), timeout=90)
+        frame_id, person = person_with_face(client, sid)
+        body = {"frame_id": frame_id, "box": person["box"], "new_person": "Suni"}
+        assert client.post(f"/api/v1/sensors/{sid}/faces", json=body).status_code == 201
+        # Butch is nobody yet: "Who is this?" (asked about faces nobody was taught for).
+        camera.name = "face_wilmore"
+
+        def question():
+            items = client.get("/api/v1/review").json()["items"]
+            return next((i for i in items if (i["probs"].get("ask") or {}).get("face")), None)
+
+        assert wait_for(question, timeout=60)
+        item = question()
+        assert item["probs"]["ask"]["label"] == FACE_UNKNOWN_KEY and item["probs"]["ask"]["face"]
+        assert {"key": "suni", "name": "Suni", "parent": "person", "face": True} in item["sensor"]["labels"]
+        bad = client.post(f"/api/v1/review/{item['id']}", json={"action": "new"})
+        assert bad.status_code == 400
+        resp = client.post(f"/api/v1/review/{item['id']}", json={"action": "new", "value": "Butch"})
+        assert resp.status_code == 200, resp.text
+        people = client.get("/api/v1/people").json()["people"]
+        assert {p["name"]: len(p["faces"]) for p in people} == {"Suni": 1, "Butch": 1}
+        assert wait_for(lambda: live(client, sid).get("butch", {}).get("on"), timeout=30)
+        assert merge_objects(None)["faces"]["ask_unknown"] is False  # off by default
+        # The question's frame in the history now shows who it was: taught from it.
+        rows = client.get("/api/v1/history", params={"sensor": sid, "limit": 100}).json()["items"]
+        row = next(r for r in rows if r["id"] == item["id"])
+        assert [d["label"] for d in row["detections"] if d.get("taught")] == ["butch"]
+    # After an update or restart, when each person was last seen comes back from the history.
+    with TestClient(create_app(settings)) as client:
+        # (Butch was waited for until seen; Suni may have been taught and gone before a check saw her.)
+        assert live(client, sid)["butch"]["last_seen"]
+        seen = {p["key"]: p["seen"]["at"] for p in client.get("/api/v1/people").json()["people"]}
+        assert seen["butch"]
+
+
+def test_a_face_model_that_cannot_be_downloaded_leaves_the_sensor_working(settings, monkeypatch, tmp_path):  # noqa: F811
+    from visionstate import backbones
+
+    def offline(*_args, **_kwargs):
+        raise OSError("no internet")
+
+    settings.bundled_models_dir = tmp_path / "empty"
+    monkeypatch.setattr(backbones, "download", offline)
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        assert client.post("/api/v1/faces/retry").status_code == 200
+        assert wait_for(lambda: rt.face_status()["error"], timeout=10)
+        error = rt.face_status()["error"]
+        assert faces.DETECTOR.filename in error and "by hand" in error
+        assert rt.face_model is None and not rt.face_status()["loading"]
+        # No retry by itself: only when asked.
+        assert rt.wanted_faces() is None and rt.face_status()["error"] == error
+        assert client.post("/api/v1/faces/retry").status_code == 200
+        assert wait_for(lambda: rt.face_status()["error"], timeout=10)
+        settings_view = client.get("/api/v1/settings").json()
+        assert [m["id"] for m in settings_view["face_models"]] == list(faces.RECOGNISERS)
+        assert all(not m["installed"] and m["data"] for m in settings_view["face_models"])
+        assert (
+            client.put(
+                "/api/v1/settings", json={"backbone": settings_view["backbone"], "face_model": "nope"}
+            ).status_code
+            == 400
+        )
+        resp = client.put("/api/v1/settings", json={"backbone": settings_view["backbone"], "face_model": "auraface-v1"})
+        assert resp.status_code == 200 and resp.json()["face_model"] == "auraface-v1"
+
+
+def test_face_limits_global_and_per_sensor(settings):  # noqa: F811
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        view = client.get("/api/v1/face-limits").json()
+        defaults = faces.tunable_defaults(view["model"])
+        assert view["defaults"] == defaults == view["effective"] and not any(view["values"].values())
+        assert defaults["match_similarity"] == faces.recogniser_spec(view["model"]).match_similarity
+        assert set(client.get("/api/v1/config").json()["face_limits"]) == set(defaults)
+
+        # Global: one set, the rest follow the face model; nonsense is refused.
+        view = client.put("/api/v1/face-limits", json={"min_face_px": 40}).json()
+        assert view["effective"]["min_face_px"] == 40 and rt.global_faces == {"min_face_px": 40}
+        assert client.put("/api/v1/face-limits", json={"ask_similarity": 0.9}).status_code == 400  # above match
+        assert client.put("/api/v1/face-limits", json={"min_face_px": 5}).status_code == 422
+
+        # A sensor follows the global value until it has its own.
+        sid = create(client, objects={"classes": ["person"]}).json()["id"]
+        assert rt.face_limits(rt.load_sensor(sid))["min_face_px"] == 40
+        on = {"objects": {"faces": {"enabled": False, "ask_unknown": False, "min_face_px": 24}}}
+        assert client.patch(f"/api/v1/sensors/{sid}", json=on).status_code == 200
+        assert rt.face_limits(rt.load_sensor(sid))["min_face_px"] == 24
+        assert client.get(f"/api/v1/sensors/{sid}").json()["objects"]["faces"]["min_face_px"] == 24
+        bad = {"objects": {"faces": {"match_similarity": 0.9, "sure_similarity": 0.8}}}
+        assert client.patch(f"/api/v1/sensors/{sid}", json=bad).status_code == 400  # match above sure
+        back = {"objects": {"faces": {"enabled": False, "ask_unknown": False}}}
+        client.patch(f"/api/v1/sensors/{sid}", json=back)
+        assert rt.face_limits(rt.load_sensor(sid))["min_face_px"] == 40
+
+
+def test_a_downloaded_model_not_in_use_can_be_deleted(settings):  # noqa: F811
+    with TestClient(create_app(settings)) as client:
+        info = client.get("/api/v1/settings").json()
+        in_use = next(b for b in info["backbones"] if b["id"] == info["backbone"])
+        assert in_use["in_use"] and not in_use["downloaded"]  # included in the app, and in use
+        assert client.delete(f"/api/v1/models/backbones/{info['backbone']}").status_code == 409
+        other = next(d for d in info["detectors"] if d["id"] != info["detector"])
+        assert not other["in_use"]
+        assert client.delete(f"/api/v1/models/detectors/{other['id']}").status_code == 404  # not downloaded
+        assert client.delete("/api/v1/models/detectors/nope").status_code == 404
+
+        # Downloaded and not in use: deleted.
+        spec = detectors.DETECTORS[other["id"]]
+        settings.models_dir.mkdir(parents=True, exist_ok=True)
+        (settings.models_dir / spec.filename).write_bytes(b"model")
+        assert next(d for d in client.get("/api/v1/settings").json()["detectors"] if d["id"] == spec.id)["downloaded"]
+        resp = client.delete(f"/api/v1/models/detectors/{spec.id}")
+        assert resp.status_code == 200 and not (settings.models_dir / spec.filename).exists()
+
+        # A face model goes with the face detector once it is the last one.
+        recogniser = faces.RECOGNISERS["auraface-v1"]
+        for name in (recogniser.filename, faces.DETECTOR.filename):
+            (settings.models_dir / name).write_bytes(b"model")
+        assert client.delete("/api/v1/models/face_models/auraface-v1").status_code == 200
+        assert not (settings.models_dir / recogniser.filename).exists()
+        assert not (settings.models_dir / faces.DETECTOR.filename).exists()
+
+
+def test_each_person_has_an_entity_saying_where_they_are():
+    from visionstate.mqtt import person_discovery_messages, person_topics
+
+    [(topic, config), (stamp_topic, stamp)] = person_discovery_messages("homeassistant", [("ole", "Ole")])
+    # And one saying when they were last seen, as a timestamp ("3 minutes ago" in Home Assistant).
+    assert stamp_topic == "homeassistant/sensor/visionstate/person_ole_last_seen/config"
+    assert stamp["default_entity_id"] == "sensor.visionstate_ole_last_seen" and stamp["name"] == "Ole last seen"
+    assert stamp["device_class"] == "timestamp" and stamp["unique_id"] == "visionstate_person_ole_last_seen"
+    assert stamp["state_topic"] == person_topics("ole")["last_seen"] == "visionstate/people/ole/last_seen"
+    assert topic == "homeassistant/sensor/visionstate/person_ole/config"
+    assert config["default_entity_id"] == "sensor.visionstate_ole_seen_by" and config["name"] == "Ole seen by"
+    assert config["unique_id"] == "visionstate_person_ole" and config["device"]["identifiers"] == ["visionstate"]
+    assert config["state_topic"] == person_topics("ole")["state"] == "visionstate/people/ole/state"
+
+
+@requires_faces
+def test_people_are_taught_from_photos(settings):  # noqa: F811
+    from visionstate.uploads import zip_bytes
+
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        photo = (ASSETS / "face_williams_2006.jpg").read_bytes()
+        files = [("files", ("suni.jpg", photo, "image/jpeg"))]
+        # Only once a sensor recognises faces (its confirmation fetches the face model).
+        assert client.post("/api/v1/people/photos", data={"new_person": "Suni"}, files=files).status_code == 400
+        create(client, objects=faces_patch(True)["objects"])
+        assert wait_for(lambda: rt.face_model is not None, timeout=60)
+        blank = io.BytesIO()
+        Image.new("RGB", (640, 480), (90, 90, 90)).save(blank, "JPEG")
+        files = [("files", ("suni.jpg", photo, "image/jpeg")), ("files", ("wall.jpg", blank.getvalue(), "image/jpeg"))]
+        made = client.post("/api/v1/people/photos", data={"new_person": "Suni"}, files=files)
+        assert made.status_code == 201, made.text
+        body = made.json()
+        assert body["label"] == "suni" and body["added"] == 1 and body["faces"] == 1
+        assert body["skipped"] == [{"file": "wall.jpg", "message": "No face found in this photo."}]
+        # More of an existing person, from a ZIP (as from a state sensor's upload).
+        archive = zip_bytes({"a.jpg": (ASSETS / "face_williams_2018.jpg").read_bytes()})
+        more = client.post(
+            "/api/v1/people/photos", data={"person": "suni"}, files=[("files", ("p.zip", archive, "application/zip"))]
+        )
+        assert more.status_code == 201 and more.json()["faces"] == 2
+        [suni] = client.get("/api/v1/people").json()["people"]
+        assert {f["origin"] for f in suni["faces"]} == {"upload"} and all(f["sensor_id"] is None for f in suni["faces"])
+        # No usable face: nobody is made.
+        empty = [("files", ("wall.jpg", blank.getvalue(), "image/jpeg"))]
+        nobody = client.post("/api/v1/people/photos", data={"new_person": "Nobody"}, files=empty).json()
+        assert nobody["added"] == 0 and len(client.get("/api/v1/people").json()["people"]) == 1
+        assert client.post("/api/v1/people/photos", files=empty).status_code == 400  # who is it?
+
+
+def test_questions_about_a_face_come_in_a_burst_and_an_answer_opens_the_next(settings):  # noqa: F811
+    """Someone walking up to a doorbell shows several faces worth teaching: up to
+    FACES["ask_burst"] questions about one person per review cooldown, FACES["ask_gap_s"] apart,
+    and an answer lets the next one come right away. An own label is asked about one at a time."""
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        sid = create(client, objects={"classes": ["person", "car"]}, enabled=False).json()["id"]
+        cfg = rt.load_sensor(sid)
+        image = Image.new("RGB", (64, 48))
+        kari = {"key": "person", "score": 0.9, "box": [0.1, 0.1, 0.5, 0.9], "face": {"box": [0.2, 0.1, 0.3, 0.2]}}
+        kari["ask"] = {"id": None, "label": "kari", "similarity": 0.4, "face": True}
+        car = {"key": "car", "score": 0.9, "box": [0.5, 0.5, 0.9, 0.9], "ask": {"label": "our_car", "similarity": 0.8}}
+
+        def waiting(label):
+            items = client.get("/api/v1/review").json()["items"]
+            return [i for i in items if i["probs"]["ask"]["label"] == label]
+
+        start = 1_000_000.0
+        for n in range(8):  # a check every 2 s: a question at most every FACES["ask_gap_s"]
+            client.portal.call(rt._ask_unsure, cfg, image, [kari, car], start + 2 * n)
+        assert len(waiting("kari")) == 4  # 16 s of checks every 2 s: at 0, 4, 8 and 12 s
+        assert len(waiting("our_car")) == 1
+        for n in range(8, 20):
+            client.portal.call(rt._ask_unsure, cfg, image, [kari, car], start + 2 * n)
+        assert len(waiting("kari")) == FACES["ask_burst"]  # then it waits for the cooldown
+        # An answer opens the next question at once (no 5 minutes to wait in front of the camera).
+        first = waiting("kari")[0]["id"]
+        assert client.post(f"/api/v1/review/{first}", json={"action": "skip"}).status_code == 200
+        client.portal.call(rt._ask_unsure, cfg, image, [kari, car], start + 41)
+        assert len(waiting("kari")) == FACES["ask_burst"] and waiting("kari")[0]["id"] != first
+        assert len(waiting("our_car")) == 1
+
+
+def test_a_person_taught_from_a_frame_was_last_seen_then(settings):  # noqa: F811
+    """Answering "yes, Kari" about a frame from 17:28 means Kari was there at 17:28: their entity
+    says so at once (last_seen), while its value stays where they are now."""
+    from datetime import UTC, datetime
+
+    from visionstate.mqtt import person_topics
+
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        sent: dict[str, object] = {}
+
+        async def publish(topic, payload, retain=False):
+            sent[topic] = payload
+
+        rt.mqtt.publish = publish
+        at = datetime(2026, 10, 12, 15, 28, tzinfo=UTC).timestamp()
+        rt.seen_earlier(1, "kari", at, person=True)
+        client.portal.call(rt.person_last_seen_changed, "kari")
+        topics = person_topics("kari")
+        assert sent[topics["state"]] == "not_seen"
+        assert sent[topics["attributes"]]["last_seen"] == "2026-10-12T15:28:00+00:00"
+        assert sent[topics["last_seen"]] == "2026-10-12T15:28:00+00:00"  # the timestamp entity
+        # An older frame does not move it back.
+        rt.seen_earlier(1, "kari", at - 3600, person=True)
+        client.portal.call(rt.person_last_seen_changed, "kari")
+        assert sent[topics["attributes"]]["last_seen"] == "2026-10-12T15:28:00+00:00"
+
+
+def test_what_is_taught_from_a_frame_shows_on_the_same_moments_entries(settings):  # noqa: F811
+    """A face seen and the question about it are two history entries of one moment: answering
+    the question marks both (where the box is the same), not an entry of another moment."""
+    from datetime import timedelta
+
+    from visionstate.api.teach import remember_taught
+    from visionstate.db import Prediction, utcnow
+    from visionstate.settings import HISTORY
+
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        sid = create(client, objects={"classes": ["person"]}, enabled=False).json()["id"]
+        box = [0.4, 0.2, 0.6, 0.9]
+        person = {"key": "person", "score": 0.9, "box": box}
+        now = utcnow()
+        later = now + timedelta(seconds=HISTORY["same_moment_s"] * 4)
+        rows = [("ask", now), ("face", now + timedelta(seconds=1)), ("face", later)]
+        with rt.db.session() as s:
+            made = [
+                Prediction(
+                    sensor_id=sid,
+                    state_key="person",
+                    published_key=k,
+                    confidence=0.9,
+                    probs={},
+                    created_at=at,
+                    detections=[dict(person)],
+                    is_change=False,
+                    reviewed=True,
+                )
+                for k, at in rows
+            ]
+            s.add_all(made)
+            s.flush()
+            ids = [m.id for m in made]
+        remember_taught(rt, sid, ids[0], box, "kari", "person", person=True)
+        with rt.db.session() as s:
+            taught = [[d.get("label") for d in s.get(Prediction, i).detections if d.get("taught")] for i in ids]
+        assert taught == [["kari"], ["kari"], []]
diff --git a/visionstate/backend/tests/test_models.py b/visionstate/backend/tests/test_models.py
new file mode 100644
index 0000000..65958b7
--- /dev/null
+++ b/visionstate/backend/tests/test_models.py
@@ -0,0 +1,108 @@
+"""Every model in the registries, on real inputs: a broken file or conversion must fail here.
+
+Models that are downloaded on first use are only on disk after
+``python -m visionstate.backbones models --all`` (CI does that); otherwise their tests are skipped.
+"""
+
+import re
+
+import pytest
+from PIL import Image, ImageEnhance
+
+from visionstate import backbones, detectors, readers, teach
+from visionstate.settings import merge_teach
+
+from .conftest import ASSETS, MODEL_DIR
+from .displays import render
+
+
+def on_disk(spec) -> object:
+    return pytest.param(
+        spec,
+        id=spec.id,
+        marks=pytest.mark.skipif(
+            not (MODEL_DIR / spec.filename).exists(), reason=f"{spec.id} not downloaded (backbones models --all)"
+        ),
+    )
+
+
+ALL_SPECS = [
+    *backbones.BACKBONES.values(),
+    *detectors.DETECTORS.values(),
+    *readers.READERS.values(),
+    *readers.WHEEL_READERS.values(),
+]
+
+
+@pytest.mark.parametrize("spec", ALL_SPECS, ids=lambda s: s.id)
+def test_every_model_is_pinned_and_described(spec):
+    assert "/resolve/" in spec.url and re.fullmatch(r"[0-9a-f]{64}", spec.sha256)
+    assert spec.size > 0 and spec.description
+    # The model comparison in Settings shows these for every model.
+    assert spec.footprint.ram_mb > 0 and spec.footprint.time_ms > 0 and 1 <= spec.footprint.accuracy <= 5
+
+
+@pytest.mark.parametrize("registry", [backbones.BACKBONES, detectors.DETECTORS, readers.READERS])
+def test_slower_models_are_more_accurate(registry):
+    """Within a kind, a model that costs more time must rank at least as accurate (else why offer it)."""
+    by_time = sorted(registry.values(), key=lambda s: s.footprint.time_ms)
+    ranks = [s.footprint.accuracy for s in by_time]
+    assert ranks == sorted(ranks)
+
+
+def counts(found) -> dict[str, int]:
+    result: dict[str, int] = {}
+    for det in found:
+        result[det.key] = result.get(det.key, 0) + 1
+    return result
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in detectors.DETECTORS.values()])
+def test_every_detector_finds_objects_in_real_photos(spec):
+    """At the default threshold, on the CC0 photos (tests/assets/README.md)."""
+    detector = detectors.Detector(spec, MODEL_DIR / spec.filename)
+    driveway = counts(detector.detect(Image.open(ASSETS / "driveway.jpg"), 0.6))
+    beach = counts(detector.detect(Image.open(ASSETS / "beach.jpg"), 0.6))
+    cat = counts(detector.detect(Image.open(ASSETS / "cat.jpg"), 0.6))
+    assert driveway.get("car", 0) >= 3 and driveway.get("person") == 1
+    assert beach.get("dog", 0) >= 4 and beach.get("person") == 1
+    assert cat == {"cat": 1}
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in backbones.BACKBONES.values()])
+def test_every_backbone_tells_taught_objects_apart(spec):
+    """With its default teaching limits: the same dog in other light is recognised, another dog
+    and a car are not even asked about."""
+    embedder = backbones.Embedder(spec, MODEL_DIR / spec.filename)
+    limits = merge_teach(spec.id, None, None)
+    beach = Image.open(ASSETS / "beach.jpg").convert("RGB")
+    driveway = Image.open(ASSETS / "driveway.jpg").convert("RGB")
+    detector_spec = detectors.DETECTORS[detectors.DEFAULT_DETECTOR]
+    found = detectors.Detector(detector_spec, MODEL_DIR / detector_spec.filename).detect(beach, 0.6)
+    dogs = sorted((d.box for d in found if d.key == "dog"), key=lambda b: b[0])
+    car = next(d.box for d in detectors.Detector(detector_spec, MODEL_DIR / detector_spec.filename).detect(driveway, 0.6)
+               if d.key == "car")  # fmt: skip
+
+    def vector(image, box):
+        return teach.embed(embedder, [teach.crop(image, box)])[0]
+
+    dog = vector(beach, dogs[0])
+    darker = vector(ImageEnhance.Brightness(beach).enhance(0.8), dogs[0])
+    assert float(dog @ darker) >= limits["match_similarity"]
+    assert float(dog @ vector(driveway, car)) < limits["ask_similarity"]
+    assert max(float(dog @ vector(beach, other)) for other in dogs[1:]) < limits["match_similarity"]
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in readers.READERS.values()])
+@pytest.mark.parametrize(("text", "style"), [("74590", "lcd"), ("0123456.7", "lcd"), ("2:38", "led"), ("98765", "led")])
+def test_every_reader_reads_drawn_displays(spec, text, style):
+    reader = readers.Reader(spec, MODEL_DIR / spec.filename)
+    result, _ = reader.read_display(render(text, style), "auto")
+    assert result.text == text and result.score > 0.8
+
+
+@pytest.mark.parametrize("spec", [on_disk(s) for s in readers.WHEEL_READERS.values()])
+def test_every_wheel_reader_reads_a_real_meter(spec):
+    wheels = readers.WheelReader(spec, MODEL_DIR / spec.filename)
+    result, _ = wheels.read_counter(Image.open(ASSETS / "counter_red.jpg").convert("RGB"), 7)
+    assert result.text == "0632289"
diff --git a/visionstate/backend/tests/test_objects.py b/visionstate/backend/tests/test_objects.py
index 6a6e1f9..6540863 100644
--- a/visionstate/backend/tests/test_objects.py
+++ b/visionstate/backend/tests/test_objects.py
@@ -353,3 +353,27 @@ def test_detector_choice_is_stored_and_switchable(settings):
             "detector": "nope",
         }
         assert client.put("/api/v1/settings", json=body).status_code == 400
+
+
+def test_the_frame_on_screen_changes_together_with_its_boxes(settings):
+    """While a check looks for objects (and faces), the sensor still shows the last frame with its
+    boxes: a new frame is announced only together with what was found in it."""
+    import asyncio
+
+    with TestClient(create_app(settings)) as client:
+        rt = client.app.state.runtime
+        rt.grabber = PhotoCamera("beach")
+        # Paused: only the check run here looks at the camera.
+        sid = create(client, objects={"classes": ["dog"]}, interval_s=3600, enabled=False).json()["id"]
+        live = rt.live_state(sid)
+        live.frame_id, live.detections = "before", [{"key": "dog", "score": 0.9, "box": [0, 0, 0.1, 0.1]}]
+        seen_during: list = []
+
+        async def detect(*_args, **_kwargs):
+            seen_during.append((live.frame_id, len(live.detections)))
+            return []
+
+        rt.detect_objects = detect
+        asyncio.run_coroutine_threadsafe(rt.run_once(rt.load_sensor(sid)), rt._loop).result(timeout=30)
+        assert seen_during == [("before", 1)]  # the old frame with its own boxes, meanwhile
+        assert live.frame_id not in (None, "before") and live.detections == []
diff --git a/visionstate/backend/tests/test_teach.py b/visionstate/backend/tests/test_teach.py
index 379f676..c5552a8 100644
--- a/visionstate/backend/tests/test_teach.py
+++ b/visionstate/backend/tests/test_teach.py
@@ -443,3 +443,83 @@ def after_a_check():
         after_a_check()
         assert client.post(f"/api/v1/review/{item['id']}", json={"action": "skip"}).status_code == 200
         assert taught() == ["rex"]
+
+
+# --- tunable limits: backbone defaults < global < sensor -----------------------------------------
+
+
+def test_teach_limits_inherit_backbone_global_and_sensor():
+    from visionstate.settings import TEACH_BY_BACKBONE, TEACH_TUNABLE, merge_teach, teach_defaults
+
+    small = teach_defaults("dinov2-small-q8")
+    assert small == {key: TEACH[key] for key in TEACH_TUNABLE}
+    base = teach_defaults("dinov2-base")
+    assert base["match_similarity"] == TEACH_BY_BACKBONE["dinov2-base"]["match_similarity"] > small["match_similarity"]
+    merged = merge_teach(
+        "dinov2-base", {"ask_similarity": 0.7, "junk": 1}, {"ask_similarity": 0.72, "rescue_floor": None}
+    )
+    assert merged["ask_similarity"] == 0.72  # the sensor's own value wins
+    assert merged["match_similarity"] == base["match_similarity"]  # nobody set it: the backbone's default
+    assert merged["rescue_floor"] == TEACH["rescue_floor"]  # None = inherit
+    assert "junk" not in merged and merged["max_labels"] == TEACH["max_labels"]  # the rest of TEACH comes along
+
+
+def test_apply_uses_the_limits_it_is_given():
+    parents = {"our_car": "car"}
+    idx = index([("our_car", "car", OUR_CAR)], parents)
+    vector = np.stack([toward(OUR_CAR, unit(0, 0, 0, 1), 0.85)])
+    found = [det("car")]
+    strict = teach.apply(found, [0], vector, [], np.zeros((0, 4)), idx, ["car"], parents)[0]
+    assert "label" not in strict  # 0.85 is below the default 0.88
+    loose = {**TEACH, "match_similarity": 0.84}
+    assert (
+        teach.apply(found, [0], vector, [], np.zeros((0, 4)), idx, ["car"], parents, None, loose)[0]["label"]
+        == "our_car"
+    )
+    no_asking = {**TEACH, "ask_similarity": 0.86}
+    assert "ask" not in teach.apply(found, [0], vector, [], np.zeros((0, 4)), idx, ["car"], parents, None, no_asking)[0]
+
+
+def test_teach_limits_api_global_sensor_and_export(settings):  # noqa: F811
+    from visionstate.settings import teach_defaults
+
+    with TestClient(create_app(settings)) as client:
+        view = client.get("/api/v1/teach-limits").json()
+        defaults = teach_defaults(view["backbone"])
+        assert view["defaults"] == defaults == view["effective"]
+        assert set(view["values"]) == set(defaults) and not any(view["values"].values())
+        config = client.get("/api/v1/config").json()["teach"]
+        assert config["tunable"] == list(defaults) and config["limits"]["match_similarity"][1] < 1
+
+        # Global: set one, the rest stay at the default; nonsense is refused.
+        view = client.put("/api/v1/teach-limits", json={"match_similarity": 0.92}).json()
+        assert view["values"]["match_similarity"] == 0.92 and view["effective"]["match_similarity"] == 0.92
+        assert view["effective"]["ask_similarity"] == defaults["ask_similarity"]
+        assert client.put("/api/v1/teach-limits", json={"ask_similarity": 0.95}).status_code == 400  # above match
+        assert client.put("/api/v1/teach-limits", json={"match_similarity": 1.5}).status_code == 422
+        rt = client.app.state.runtime
+        assert rt.global_teach == {"match_similarity": 0.92}
+
+        # A sensor: inherits, can have its own values, and loses them again.
+        sid = create(client, objects={"classes": ["dog"]}).json()["id"]
+        assert sensor(client, sid)["objects"]["teach"] == {}
+        assert rt.teach_limits(rt.load_sensor(sid))["match_similarity"] == 0.92
+        resp = client.patch(f"/api/v1/sensors/{sid}", json={"objects": {"teach": {"match_similarity": 0.8}}})
+        assert resp.status_code == 200, resp.text
+        assert sensor(client, sid)["objects"]["teach"] == {"match_similarity": 0.8}
+        assert sensor(client, sid)["objects"]["classes"] == ["dog"]  # the rest of objects stays
+        assert rt.teach_limits(rt.load_sensor(sid))["match_similarity"] == 0.8
+        bad = {"objects": {"teach": {"match_similarity": 0.8, "keep_similarity": 0.85}}}
+        assert client.patch(f"/api/v1/sensors/{sid}", json=bad).status_code == 400  # keep above match
+        assert sensor(client, sid)["objects"]["teach"] == {"match_similarity": 0.8}  # unchanged
+
+        # Export and import carry the sensor's own values.
+        exported = client.get(f"/api/v1/sensors/{sid}/export")
+        imported = client.post("/api/v1/import", files={"file": ("b.zip", exported.content, "application/zip")})
+        assert imported.status_code == 201, imported.text
+        assert sensor(client, imported.json()["id"])["objects"]["teach"] == {"match_similarity": 0.8}
+
+        client.patch(f"/api/v1/sensors/{sid}", json={"objects": {"teach": {}}})
+        assert sensor(client, sid)["objects"]["teach"] == {}
+        client.put("/api/v1/teach-limits", json={})
+        assert rt.teach_limits(rt.load_sensor(sid))["match_similarity"] == defaults["match_similarity"]
diff --git a/visionstate/backend/tests/test_triggers.py b/visionstate/backend/tests/test_triggers.py
index 1ed4d90..312c7f2 100644
--- a/visionstate/backend/tests/test_triggers.py
+++ b/visionstate/backend/tests/test_triggers.py
@@ -16,9 +16,10 @@
 from visionstate.api.common import Triggers
 from visionstate.db import SCHEMA_VERSION, Database
 from visionstate.engine import LiveState, SensorConfig, entity_triggers, next_check_at
+from visionstate.engine.logic import steer_face_burst
 from visionstate.ha_events import HaEventListener, parse_trigger_event, trigger_subscription
 from visionstate.main import create_app
-from visionstate.settings import TRIGGER_DEFAULTS, Settings, merge_triggers
+from visionstate.settings import FACES, TRIGGER_DEFAULTS, Settings, merge_triggers
 
 from .conftest import requires_model, requires_reader
 from .displays import render
@@ -545,3 +546,51 @@ def view():
             assert wait_for(lambda before=before: view()["reading"]["last"]["at"] != before, timeout=30)
             assert view()["reading"]["last"]["reason"] is None, view()["reading"]["last"]
         assert client.get(f"/api/v1/sensors/{sid}/reading-quality").json()["periods"][0]["rejected"] == 0
+
+
+def person(height: float, face: dict | None = None) -> dict:
+    """A person box of that height (share of the frame) and what the face search found in it."""
+    return {"key": "person", "score": 0.9, "box": [0.4, 0.9 - height, 0.5, 0.9], **({"face": face} if face else {})}
+
+
+def test_a_face_burst_follows_a_person_walking_up_to_the_door():
+    """Someone walking up shows a usable face for a few seconds only: a person nobody is named for
+    starts checks every FACES["burst_interval_s"], kept up while they come closer or show a face,
+    over once they are named; not again until they have gone."""
+    live, t = LiveState(last_run=100), 100.0
+    fb = live.face_burst
+    assert steer_face_burst(fb, [], t) is None  # nobody there
+    assert steer_face_burst(fb, [person(0.1, {"problem": "none"})], t) == "start"  # far away, no face yet
+    assert next_check_at(config(), live, t + 0.1) == (100 + FACES["burst_interval_s"], "full")
+    for n in range(1, 10):  # coming closer: no face for longer than burst_idle_checks, but growing
+        assert steer_face_burst(fb, [person(0.1 * 1.15**n, {"problem": "small"})], t + n) is None
+    usable = {"problem": None, "box": [0.45, 0.2, 0.5, 0.25], "face_px": 60, "state": "ask"}
+    for n in range(10, 20):  # standing at the door with a face it is not sure of
+        assert steer_face_burst(fb, [person(0.5, usable)], t + n) is None
+    named = {**usable, "state": "match", "label": "kari"}
+    assert steer_face_burst(fb, [person(0.5, named)], t + 20) == "stop"  # named: done
+    assert next_check_at(config(), live, t + 20.5) == (160, "full")  # the regular interval again
+    # Still there: no second burst. Gone (burst_absent_checks), then back: a burst of its own.
+    assert steer_face_burst(fb, [person(0.5, {"problem": "turned"})], t + 30) is None
+    for n in range(FACES["burst_absent_checks"]):
+        assert steer_face_burst(fb, [], t + 40 + n) is None
+    assert steer_face_burst(fb, [person(0.2)], t + 50) == "start"
+
+
+def test_a_face_burst_ends_without_progress_and_after_its_time():
+    # Standing still with their back to the camera: over after burst_idle_checks checks.
+    fb = LiveState().face_burst
+    assert steer_face_burst(fb, [person(0.4, {"problem": "none"})], 0) == "start"
+    stops = [
+        steer_face_burst(fb, [person(0.4, {"problem": "none"})], n) for n in range(1, FACES["burst_idle_checks"] + 1)
+    ]
+    assert stops[-1] == "stop" and stops[:-1] == [None] * (FACES["burst_idle_checks"] - 1)
+    # A face it is never sure of keeps it going, but not beyond burst_max_s.
+    fb = LiveState().face_burst
+    unsure = {"problem": None, "box": [0.45, 0.2, 0.5, 0.25], "face_px": 60, "state": "unknown"}
+    assert steer_face_burst(fb, [person(0.4, unsure)], 0) == "start"
+    assert steer_face_burst(fb, [person(0.4, unsure)], FACES["burst_max_s"] - 1) is None
+    assert steer_face_burst(fb, [person(0.4, unsure)], FACES["burst_max_s"]) == "stop"
+    # A person filtered away (taught "not a person": a statue) never starts one.
+    statue = {**person(0.4), "filtered": True}
+    assert steer_face_burst(LiveState().face_burst, [statue], 0) is None
diff --git a/visionstate/backend/visionstate/api/common.py b/visionstate/backend/visionstate/api/common.py
index 5dfbd13..98efc59 100644
--- a/visionstate/backend/visionstate/api/common.py
+++ b/visionstate/backend/visionstate/api/common.py
@@ -12,11 +12,15 @@
 from sqlalchemy.orm import Session
 
 from .. import detectors, imaging, teach
-from ..db import ModelInfo, Sample, SampleLabel, Sensor
-from ..engine import LiveState, ObjectTrack, Runtime, SensorConfig
+from ..db import Face, ModelInfo, Sample, SampleLabel, Sensor
+from ..engine import LiveState, ObjectTrack, Runtime, SensorConfig, with_people
 from ..mqtt import main_entities
 from ..settings import (
     COUNTER_READERS,
+    FACE_DEFAULTS,
+    FACE_LIMITS,
+    FACE_UNKNOWN_KEY,
+    FACES,
     KIND_OBJECTS,
     KIND_READING,
     LIGHT_DOMAINS,
@@ -32,12 +36,14 @@
     REVIEW_DEFAULTS,
     REVIEW_LIMITS,
     ROI_MAX_POINTS,
+    TEACH_TUNABLE_LIMITS,
     TRIGGER_DEFAULTS,
     TRIGGER_LIMITS,
     TRIGGER_MAX_ENTITIES,
     TRIGGER_STATE_MAX_LENGTH,
     UNKNOWN_STATE,
     active_custom,
+    faces_on,
     merge_objects,
     merge_reading,
     merge_review,
@@ -180,6 +186,67 @@ def _valid_only_states(self) -> Triggers:
 
 _olo = {k: v[0] for k, v in OBJECT_LIMITS.items()}
 _ohi = {k: v[1] for k, v in OBJECT_LIMITS.items()}
+_tlo = {k: v[0] for k, v in TEACH_TUNABLE_LIMITS.items()}
+_thi = {k: v[1] for k, v in TEACH_TUNABLE_LIMITS.items()}
+
+
+class TeachLimits(BaseModel):
+    """The tunable teaching limits (settings.TEACH_TUNABLE). None = inherit: globally the
+    backbone's default, on a sensor the global value."""
+
+    match_similarity: float | None = Field(None, ge=_tlo["match_similarity"], le=_thi["match_similarity"])
+    keep_similarity: float | None = Field(None, ge=_tlo["keep_similarity"], le=_thi["keep_similarity"])
+    ask_similarity: float | None = Field(None, ge=_tlo["ask_similarity"], le=_thi["ask_similarity"])
+    rescue_similarity: float | None = Field(None, ge=_tlo["rescue_similarity"], le=_thi["rescue_similarity"])
+    rescue_floor: float | None = Field(None, ge=_tlo["rescue_floor"], le=_thi["rescue_floor"])
+
+    def stored(self) -> dict:
+        return {k: v for k, v in self.model_dump().items() if v is not None}
+
+
+def check_teach(limits: dict) -> None:
+    """Effective teaching limits must make sense together: asking and keeping start below a match."""
+    if limits["ask_similarity"] > limits["match_similarity"]:
+        raise HTTPException(400, "“Asks you in the review queue” must not be above “Recognised as a box you taught”")
+    if limits["keep_similarity"] > limits["match_similarity"]:
+        raise HTTPException(400, "“Keeps that answer” must not be above “Recognised as a box you taught”")
+
+
+_flo = {k: v[0] for k, v in FACE_LIMITS.items()}
+_fhi = {k: v[1] for k, v in FACE_LIMITS.items()}
+
+
+class FaceLimits(BaseModel):
+    """The tunable face limits (settings.FACE_TUNABLE). None = inherit: globally the default (the
+    face model's similarities), on a sensor the global value."""
+
+    min_face_px: float | None = Field(None, ge=_flo["min_face_px"], le=_fhi["min_face_px"])
+    match_similarity: float | None = Field(None, ge=_flo["match_similarity"], le=_fhi["match_similarity"])
+    sure_similarity: float | None = Field(None, ge=_flo["sure_similarity"], le=_fhi["sure_similarity"])
+    ask_similarity: float | None = Field(None, ge=_flo["ask_similarity"], le=_fhi["ask_similarity"])
+    keep_similarity: float | None = Field(None, ge=_flo["keep_similarity"], le=_fhi["keep_similarity"])
+
+    def stored(self) -> dict:
+        return {k: v for k, v in self.model_dump().items() if v is not None}
+
+
+def check_faces(limits: dict) -> None:
+    """Effective face limits must make sense together: asking and keeping below a match, a match
+    not above being sure at once."""
+    if limits["ask_similarity"] > limits["match_similarity"]:
+        raise HTTPException(400, "“Asks you in the review queue” must not be above “Recognised”")
+    if limits["keep_similarity"] > limits["match_similarity"]:
+        raise HTTPException(400, "“Keeps the name” must not be above “Recognised”")
+    if limits["match_similarity"] > limits["sure_similarity"]:
+        raise HTTPException(400, "“Recognised” must not be above “Sure at once”")
+
+
+class FacesIn(FaceLimits):
+    """Recognising people by their face on an object sensor: on or off, asking about strangers,
+    and its own face limits (unset ones follow the global ones). Defaults: settings.FACE_*."""
+
+    enabled: bool = FACE_DEFAULTS["enabled"]
+    ask_unknown: bool = FACE_DEFAULTS["ask_unknown"]
 
 
 class ObjectsIn(BaseModel):
@@ -191,7 +258,17 @@ class ObjectsIn(BaseModel):
         default=OBJECT_DEFAULTS["clear_after_s"], ge=_olo["clear_after_s"], le=_ohi["clear_after_s"]
     )
     use_taught: bool = OBJECT_DEFAULTS["use_taught"]
-    # Own labels ("custom") are made by teaching a box (api/teach.py), never set here.
+    teach: TeachLimits | None = None  # this sensor's own teaching limits; unset ones follow the global ones
+    faces: FacesIn | None = None  # recognising people by their face; unset keeps what the sensor has
+    # Own labels ("custom") are made by teaching a box (api/teach.py) or a face (api/faces.py), never set here.
+
+    def stored(self, exclude_unset: bool = False) -> dict:
+        data = self.model_dump(exclude_unset=exclude_unset, exclude={"teach", "faces"})
+        if self.teach is not None or not exclude_unset:
+            data["teach"] = self.teach.stored() if self.teach else {}
+        if self.faces is not None:
+            data["faces"] = self.faces.model_dump(exclude_none=True)
+        return data
 
     @field_validator("classes")
     @classmethod
@@ -340,14 +417,16 @@ def entity_ids(rt: Runtime, sensor: Sensor) -> list[str]:
 
 
 def objects_view(session: Session, sensor: Sensor, live: LiveState | None) -> dict | None:
-    """An object sensor's part of its view: each class and own label, live, and what was taught."""
+    """An object sensor's part of its view: each class and own label (with the people while it
+    recognises faces), live, and what was taught."""
     if sensor.kind != KIND_OBJECTS:
         return None
-    settings = merge_objects(sensor.objects)
+    settings = with_people(merge_objects(sensor.objects), session)
     parents = {label["key"]: label["parent"] for label in active_custom(settings)}
     tracks = live.tracks if live else {}
     per_class = []
-    for key in [*settings["classes"], *parents]:
+    unknown = [FACE_UNKNOWN_KEY] if faces_on(settings) else []  # recognising faces: "unknown person"
+    for key in [*settings["classes"], *parents, *unknown]:
         track = tracks.get(key) or ObjectTrack()
         per_class.append(
             {
@@ -365,12 +444,23 @@ def objects_view(session: Session, sensor: Sensor, live: LiveState | None) -> di
         )
     ).all()
     usable = [(label, detected) for label, detected in taught if label is not None and teach.usable(label, parents)]
+    taught_faces = session.scalar(select(func.count()).select_from(Face).where(Face.sensor_id == sensor.id)) or 0
+    stats = list(live.face_stats) if live else []
     return {
         **settings,
         "live": per_class,
         "detections": live.detections if live else [],
         "taught": len(taught),  # boxes taught (Quality tab, first-time question)
+        "taught_faces": taught_faces,  # faces taught on this camera (export)
         "taught_keys": sorted(teach.compared_keys(usable, parents)),  # classes compared with them
+        # Faces: of the last person boxes looked at, how many had a usable face, and why not.
+        "face_stats": {
+            "looked": len(stats),
+            "usable": stats.count("ok"),
+            "problems": {p: stats.count(p) for p in sorted(set(stats) - {"ok"})},
+            "frame": list(live.face_frame) if live and live.face_frame else None,  # width, height
+            "min_face_px": live.face_min_px if live else None,  # the smallest face it was looked at with
+        },
     }
 
 
@@ -405,6 +495,11 @@ def sensor_view(rt: Runtime, session: Session, sensor: Sensor) -> dict:
     else:
         status = "ok"
     ids = entity_ids(rt, sensor)
+    now = time.time()
+    paces = [merge_triggers(sensor.triggers)["burst_interval_s"]] if live and live.burst_until > now else []
+    if live and live.face_burst.until > now:
+        paces.append(FACES["burst_interval_s"])
+    pace = min(paces) if paces else None
     return {
         "id": sensor.id,
         "slug": sensor.slug,
@@ -437,7 +532,9 @@ def sensor_view(rt: Runtime, session: Session, sensor: Sensor) -> dict:
             "confidence": live.confidence if live else 0.0,
             "probs": live.probs if live else {},
             "last_run": live.last_run if live else None,
-            "in_burst": bool(live and live.burst_until > time.time()),
+            # A burst of checks (a trigger's, or looking for a face while a person is there) and its pace.
+            "in_burst": pace is not None,
+            "burst_interval_s": pace,
             "change_score": live.change_score if live else None,
             "last_trigger": live.last_trigger if live else None,
             "light_error": live.light_error if live else "",
diff --git a/visionstate/backend/visionstate/api/faces.py b/visionstate/backend/visionstate/api/faces.py
new file mode 100644
index 0000000..93d8979
--- /dev/null
+++ b/visionstate/backend/visionstate/api/faces.py
@@ -0,0 +1,494 @@
+"""Recognising people by their face (docs/FACE_RECOGNITION_PLAN.md). The people and their faces
+are shared by every object sensor that recognises faces: a face is taught on any of them (a
+person box in a frame of that sensor), and the people are listed, renamed and forgotten for all
+of them at once. Turning it on and off is a setting of each sensor (``objects.faces``); the face
+model is chosen in /settings."""
+
+from __future__ import annotations
+
+import asyncio
+import itertools
+import tempfile
+from datetime import datetime
+from pathlib import Path
+
+import numpy as np
+from fastapi import APIRouter, File, Form, HTTPException, Request, Response, UploadFile
+from fastapi.responses import FileResponse
+from PIL import Image
+from pydantic import BaseModel, Field, field_validator
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from .. import detectors, faces, imaging, uploads
+from ..db import Face, Person, Sensor
+from ..engine import Runtime, SensorConfig
+from ..settings import FACES, KIND_OBJECTS, TEACH, UPLOAD_LIMITS, merge_objects
+from .common import API_PREFIX, iso, runtime, slugify
+from .samples import copy_limited
+from .teach import RESERVED_KEYS, frame_image, remember_taught
+
+router = APIRouter(prefix=f"{API_PREFIX}/sensors", tags=["faces"])
+people_router = APIRouter(prefix=API_PREFIX, tags=["faces"])
+
+# Why a face cannot be taught, in words (faces.problem).
+PROBLEMS = {
+    "none": "No face found here. Pick a moment where the face is visible.",
+    "cut": "The edge of the picture cuts the face here. Pick a moment where the whole face is in view.",
+    "small": "The face is too small here. Pick a moment where the person is closer to the camera.",
+    "turned": "The face is turned away too far here. Pick a moment where they look towards the camera.",
+    "blurry": "The face is blurry here. Pick a sharper moment.",
+    "unsure": "This does not clearly look like a face. Pick another moment.",
+}
+
+
+# The same, about a photo from a phone (People page).
+PHOTO_PROBLEMS = {
+    "none": "No face found in this photo.",
+    "cut": "The edge of this photo cuts the face.",
+    "small": "The face is too small in this photo: take it closer.",
+    "turned": "The face is turned away in this photo: look at the camera.",
+    "blurry": "This photo is blurry.",
+    "unsure": "This does not clearly look like a face.",
+}
+
+
+class FaceBoxIn(BaseModel):
+    """A person box on the frame a check analysed (``frame_id``) or on a history frame."""
+
+    frame_id: str | None = Field(default=None, max_length=64)
+    history_id: int | None = None
+    box: list[float] = Field(min_length=4, max_length=4)  # x1, y1, x2, y2 normalised to the frame
+
+    @field_validator("box")
+    @classmethod
+    def _valid_box(cls, value: list[float]) -> list[float]:
+        x1, y1, x2, y2 = (min(max(float(v), 0.0), 1.0) for v in value)
+        if x2 - x1 < TEACH["min_box"] or y2 - y1 < TEACH["min_box"]:
+            raise ValueError("The box is too small")
+        return [x1, y1, x2, y2]
+
+
+class FaceTeachIn(FaceBoxIn):
+    """Who the face in a person box is: one of the people, or a new person."""
+
+    score: float | None = Field(default=None, ge=0, le=1)
+    person: str | None = Field(default=None, max_length=64)
+    new_person: str | None = Field(default=None, min_length=1, max_length=64)
+
+
+class FaceMoveIn(BaseModel):
+    person: str = Field(max_length=64)
+
+
+class PersonIn(BaseModel):
+    name: str = Field(min_length=1, max_length=64)
+
+
+# --- The people -----------------------------------------------------------------------------------
+
+
+def person_by_key(s: Session, key: str) -> Person:
+    person = s.scalar(select(Person).where(Person.key == key))
+    if person is None:
+        raise HTTPException(404, f"No person called {key!r}")
+    return person
+
+
+def _check_name(s: Session, name: str, keep: int | None = None) -> str:
+    name = name.strip()
+    if not name:
+        raise HTTPException(400, "Give the person a name")
+    for other in s.scalars(select(Person)):
+        if other.id != keep and other.name.lower() == name.lower():
+            raise HTTPException(400, f"There is already a person called {name}")
+    return name
+
+
+def taken_keys(s: Session) -> set[str]:
+    """Keys a new person or own label may not have: objects VisionState knows, every own label of
+    every sensor and every person (all can be entities of one sensor)."""
+    taken = set(detectors.LABELS.by_key) | RESERVED_KEYS
+    taken |= set(s.scalars(select(Person.key)))
+    for objects in s.scalars(select(Sensor.objects).where(Sensor.kind == KIND_OBJECTS)):
+        taken |= {label["key"] for label in merge_objects(objects)["custom"]}
+    return taken
+
+
+def new_person(s: Session, name: str) -> Person:
+    """A new person; their key never clashes with an object, an own label or another person."""
+    if (s.scalar(select(func.count()).select_from(Person)) or 0) >= FACES["max_people"]:
+        raise HTTPException(400, f"VisionState can know at most {FACES['max_people']} people")
+    name = _check_name(s, name)
+    taken = taken_keys(s)
+    base = slugify(name, "person")
+    key, n = base, 2
+    while key in taken:
+        key, n = f"{base}_{n}", n + 1
+    person = Person(key=key, name=name)
+    s.add(person)
+    s.flush()
+    return person
+
+
+# --- Teaching a face on a sensor ------------------------------------------------------------------
+
+
+async def _face_model(rt: Runtime) -> faces.FaceModel:
+    model = rt.wanted_faces()
+    if model is None:
+        status = rt.face_status()
+        raise HTTPException(409, status["error"] or "The face model is still loading. Try again in a moment.")
+    return model
+
+
+async def _find(
+    rt: Runtime, sensor_id: int, body: FaceBoxIn, cfg: SensorConfig
+) -> tuple[Image.Image, str, faces.Face | None, str | None]:
+    """The frame, its origin, the face in the person box (frame pixels) and why it cannot be used."""
+    model = await _face_model(rt)
+    image, origin = await frame_image(rt, sensor_id, body.frame_id, body.history_id)
+    [(face, aligned)] = await rt.find_faces(model, image, [body.box])
+    if face is None or aligned is None:
+        return image, origin, None, "none"
+    min_px = rt.face_limits(cfg)["min_face_px"]
+    return image, origin, face, faces.problem(face, aligned, min_px, (image.width, image.height))
+
+
+def _config(rt: Runtime, sensor_id: int) -> SensorConfig:
+    cfg = rt.load_sensor(sensor_id)
+    if cfg is None or not cfg.is_objects:
+        raise HTTPException(404, "Sensor not found")
+    if not cfg.faces_on:
+        raise HTTPException(400, "Turn on face recognition for this sensor first (its Settings tab)")
+    return cfg
+
+
+@router.post("/{sensor_id}/faces/check")
+async def check_face(sensor_id: int, body: FaceBoxIn, request: Request) -> dict:
+    """Whether there is a face in a person box that can be taught: {face (normalised box), problem, message}."""
+    rt = runtime(request)
+    cfg = await asyncio.to_thread(_config, rt, sensor_id)
+    image, _origin, face, problem = await _find(rt, sensor_id, body, cfg)
+    box = None
+    if face is not None:
+        w, h = image.width, image.height
+        box = [
+            round(face.box[0] / w, 4),
+            round(face.box[1] / h, 4),
+            round(face.box[2] / w, 4),
+            round(face.box[3] / h, 4),
+        ]
+    return {"face": box, "problem": problem, "message": PROBLEMS.get(problem or "", "")}
+
+
+@router.post("/{sensor_id}/faces", status_code=201)
+async def teach_face(sensor_id: int, body: FaceTeachIn, request: Request) -> dict:
+    """Teach the face in a person box as one of the people, or as a new person; every sensor
+    that recognises faces knows it from then on.
+
+    Only a face that passes the quality gate is taught: a back or a jacket never becomes someone."""
+    rt = runtime(request)
+    cfg = await asyncio.to_thread(_config, rt, sensor_id)
+    if not body.person and not body.new_person:
+        raise HTTPException(400, "Say who it is: a person or a new person")
+    with rt.db.session() as s:
+        if body.person:
+            person = person_by_key(s, body.person)
+            count = s.scalar(select(func.count()).select_from(Face).where(Face.person_id == person.id)) or 0
+            if count >= FACES["max_faces_per_person"]:
+                raise HTTPException(400, f"A person can have at most {FACES['max_faces_per_person']} faces")
+        else:
+            # Checked now, made only once the face is good.
+            if (s.scalar(select(func.count()).select_from(Person)) or 0) >= FACES["max_people"]:
+                raise HTTPException(400, f"VisionState can know at most {FACES['max_people']} people")
+            _check_name(s, body.new_person or "")
+    image, origin, face, problem = await _find(rt, sensor_id, body, cfg)
+    if problem or face is None:
+        raise HTTPException(400, PROBLEMS.get(problem or "none", PROBLEMS["none"]))
+    crop, local = faces.face_crop(image, face)
+    filename = await asyncio.to_thread(rt.storage.save_face, crop)
+    with rt.db.session() as s:
+        person = person_by_key(s, body.person) if body.person else new_person(s, body.new_person or "")
+        face_id = add_face_row(s, person.id, sensor_id, filename, crop, faces.face_to_dict(local), origin)
+        key, name = person.key, person.name
+        n = s.scalar(select(func.count()).select_from(Face).where(Face.person_id == person.id)) or 0
+    if body.new_person:
+        await rt.people_changed()  # the person's entities on every sensor that recognises faces
+    else:
+        rt.faces_changed()
+    if body.history_id is not None:
+        await asyncio.to_thread(remember_taught, rt, sensor_id, body.history_id, body.box, key, "person", True)
+        await rt.person_last_seen_changed(key)  # Home Assistant gets that last_seen too
+    return {"id": face_id, "label": key, "name": name, "faces": n}
+
+
+def add_face_row(
+    s: Session, person_id: int, sensor_id: int | None, filename: str, crop: Image.Image, face: dict, origin: str
+) -> int:
+    row = Face(
+        person_id=person_id,
+        sensor_id=sensor_id,
+        filename=filename,
+        origin=origin,
+        is_night=imaging.is_night(crop),
+        face=face,
+    )
+    s.add(row)
+    s.flush()
+    return row.id
+
+
+# --- Shared: the people and their faces -----------------------------------------------------------
+
+
+@people_router.get("/people")
+async def people(request: Request) -> dict:
+    """Every person with their faces (and the camera each was taught on), where each was last
+    seen; look-alikes and faces that may have the wrong name (only while the face model is
+    loaded: they need its embeddings)."""
+    rt = runtime(request)
+
+    def read() -> tuple[list[tuple[str, str]], list[tuple], dict[int, str]]:
+        with rt.db.session() as s:
+            persons = [(p.key, p.name) for p in s.scalars(select(Person).order_by(Person.created_at))]
+            rows = s.execute(
+                select(Face.id, Person.key, Face.origin, Face.is_night, Face.created_at, Face.sensor_id)
+                .join(Person, Face.person_id == Person.id)
+                .order_by(Face.created_at.desc())
+            ).all()
+            names: dict[int, str] = {i: n for i, n in s.execute(select(Sensor.id, Sensor.name)).all()}
+        return persons, [tuple(r) for r in rows], names
+
+    persons, rows, sensor_names = await asyncio.to_thread(read)
+    suspects: dict[int, str] = {}
+    look_alikes: list[dict] = []
+    if rt.face_model is not None:
+        index = await rt.face_index_for(rt.face_model)
+        suspects, look_alikes = _quality(index, rt.face_limits(None))
+    oldest: dict[str, datetime] = {}
+    for _id, key, _origin, _night, created, _sensor in rows:
+        if key not in oldest or created < oldest[key]:
+            oldest[key] = created
+    return {
+        "model": rt.face_status(),
+        "sensors": await asyncio.to_thread(rt.face_sensor_ids),
+        "people": [
+            {
+                "key": key,
+                "name": name,
+                "seen": {**(seen := rt.person_seen(key)), "sensor_name": sensor_names.get(seen["sensor_id"] or 0)},
+                "oldest": iso(oldest.get(key)),
+                "faces": [
+                    {
+                        "id": fid,
+                        "origin": origin,
+                        "is_night": night,
+                        "created_at": iso(created),
+                        "sensor_id": sensor_id,
+                        "sensor_name": sensor_names.get(sensor_id) if sensor_id is not None else None,
+                        "suspect": suspects.get(fid),
+                    }
+                    for fid, person, origin, night, created, sensor_id in rows
+                    if person == key
+                ],
+            }
+            for key, name in persons
+        ],
+        "look_alikes": look_alikes,
+    }
+
+
+def _quality(index: faces.FaceIndex, limits: dict[str, float]) -> tuple[dict[int, str], list[dict]]:
+    """Faces closer to another person than to their own (id -> that person), and pairs of people
+    whose closest faces come near the match threshold (FACES["look_alike"])."""
+    suspects: dict[int, str] = {}
+    pairs: dict[tuple[str, str], float] = {}
+    if not index.ids:
+        return suspects, []
+    sims = index.vectors @ index.vectors.T
+    labels = np.array(index.labels)
+    for i, face_id in enumerate(index.ids):
+        own = labels == labels[i]
+        own[i] = False
+        per: dict[str, float] = {}
+        for label in set(index.labels):
+            mask = (labels == label) if label != labels[i] else own
+            values = np.sort(sims[i][mask])[::-1][: FACES["top_k"]]
+            if len(values):
+                per[label] = float(values.mean())
+        mine = per.get(str(labels[i]))
+        others = {k: v for k, v in per.items() if k != labels[i]}
+        if mine is not None and others:
+            closest, value = max(others.items(), key=lambda kv: kv[1])
+            if value > mine:
+                suspects[face_id] = closest
+        for label in others:
+            a, b = sorted((str(labels[i]), label))
+            pairs[(a, b)] = max(pairs.get((a, b), -1.0), float(sims[i][labels == label].max()))
+    limit = limits["match_similarity"] * FACES["look_alike"]
+    look_alikes = [{"a": a, "b": b, "similarity": round(v, 3)} for (a, b), v in pairs.items() if v >= limit]
+    return suspects, look_alikes
+
+
+@people_router.post("/people/photos", status_code=201)
+async def add_photos(
+    request: Request,
+    files: list[UploadFile] = File(...),
+    person: str | None = Form(default=None, max_length=64),
+    new_name: str | None = Form(default=None, alias="new_person", max_length=64),
+) -> dict:
+    """Teach faces from photos or short videos (taken with a phone or picked from its gallery;
+    read like a state sensor's upload: images, ZIP archives, videos) as one of the people, or as a
+    new person (made only when there is a usable face). The best face of each picture goes
+    through the same quality gate as on a camera; at most FACES["max_photos"] faces are added."""
+    rt = runtime(request)
+    if not person and not (new_name or "").strip():
+        raise HTTPException(400, "Say who it is: a person or a new person")
+    if not await asyncio.to_thread(rt.face_sensor_ids):  # the face model is only fetched after a sensor's confirmation
+        raise HTTPException(400, "Turn on face recognition on a sensor first (its Settings → Faces)")
+    with rt.db.session() as s:
+        if person:
+            person_by_key(s, person)
+        else:
+            if (s.scalar(select(func.count()).select_from(Person)) or 0) >= FACES["max_people"]:
+                raise HTTPException(400, f"VisionState can know at most {FACES['max_people']} people")
+            _check_name(s, new_name or "")
+    model = await _face_model(rt)
+    min_px = rt.face_limits(None)["min_face_px"]
+    found: list[tuple[Image.Image, faces.Face]] = []
+    skipped: list[dict] = []
+    for upload_file in files:
+        if len(found) >= FACES["max_photos"]:
+            break
+        name = upload_file.filename or "photo"
+        try:
+            pictures = await asyncio.to_thread(_pictures, upload_file, name, FACES["max_photos"] * 3)
+        except (uploads.UploadError, OSError) as err:
+            skipped.append({"file": name, "message": str(err) or "Not an image this app can read."})
+            continue
+        problems: list[str] = []
+        for image in pictures:
+            face, aligned = await rt.face_in_photo(model, image)
+            problem = "none" if face is None or aligned is None else faces.problem(face, aligned, min_px, image.size)
+            if problem or face is None:
+                problems.append(problem or "none")
+                continue
+            found.append((image, face))
+            if len(found) >= FACES["max_photos"]:
+                break
+        if problems and len(problems) == len(pictures):  # nothing usable in this file
+            skipped.append({"file": name, "message": PHOTO_PROBLEMS.get(problems[0], PHOTO_PROBLEMS["none"])})
+    if not found:
+        return {"label": person, "name": None, "added": 0, "skipped": skipped, "faces": None}
+    with rt.db.session() as s:
+        who = person_by_key(s, person) if person else new_person(s, new_name or "")
+        count = s.scalar(select(func.count()).select_from(Face).where(Face.person_id == who.id)) or 0
+        added = 0
+        for image, face in found:
+            if count >= FACES["max_faces_per_person"]:
+                skipped.append({"file": "", "message": f"A person has at most {FACES['max_faces_per_person']} faces."})
+                break
+            crop, local = faces.face_crop(image, face)
+            filename = rt.storage.save_face(crop)
+            add_face_row(s, who.id, None, filename, crop, faces.face_to_dict(local), "upload")
+            count, added = count + 1, added + 1
+        result = {"label": who.key, "name": who.name, "added": added, "skipped": skipped, "faces": count}
+    if not person:
+        await rt.people_changed()
+    else:
+        await asyncio.to_thread(rt.faces_changed)
+    return result
+
+
+def _pictures(upload_file: UploadFile, name: str, limit: int) -> list[Image.Image]:
+    """The pictures in an uploaded file (an image, the images of a ZIP, frames of a video), at
+    most ``limit``; the file goes through a temporary file within the upload limit."""
+    with tempfile.NamedTemporaryFile(delete=False, suffix=Path(name).suffix) as tmp:
+        path = Path(tmp.name)
+        within = copy_limited(upload_file.file, tmp, UPLOAD_LIMITS["max_file_mb"] * 1_000_000)
+    try:
+        if not within:
+            raise uploads.UploadError(f"Larger than {UPLOAD_LIMITS['max_file_mb']} MB.")
+        frames = uploads.frames_from_file(path, name, FACES["photo_video_interval_s"])
+        return [image for image, _origin in itertools.islice(frames, limit)]
+    finally:
+        path.unlink(missing_ok=True)
+
+
+@people_router.patch("/people/{key}")
+async def rename_person(key: str, body: PersonIn, request: Request) -> dict:
+    """A person's name (their entities' names follow; their key and entity IDs stay)."""
+    rt = runtime(request)
+    with rt.db.session() as s:
+        person = person_by_key(s, key)
+        person.name = _check_name(s, body.name, keep=person.id)
+        result = {"key": person.key, "name": person.name}
+    await rt.people_changed()
+    return result
+
+
+@people_router.delete("/people/{key}", status_code=204)
+async def forget_person(key: str, request: Request) -> Response:
+    """Forget a person: their faces, embeddings and entities on every sensor."""
+    rt = runtime(request)
+    await asyncio.to_thread(_forget_people, rt, key)
+    await rt.people_changed()
+    return Response(status_code=204)
+
+
+@people_router.delete("/people", status_code=204)
+async def forget_everyone(request: Request) -> Response:
+    """Forget every person and every face."""
+    rt = runtime(request)
+    await asyncio.to_thread(_forget_people, rt, None)
+    await rt.people_changed()
+    return Response(status_code=204)
+
+
+def _forget_people(rt: Runtime, key: str | None) -> None:
+    with rt.db.session() as s:
+        persons = [person_by_key(s, key)] if key is not None else list(s.scalars(select(Person)))
+        for person in persons:
+            for face in s.scalars(select(Face).where(Face.person_id == person.id)):
+                rt.storage.delete_face(face.filename)
+            s.delete(person)  # their faces and embeddings go with them (foreign keys)
+
+
+@people_router.get("/faces/{face_id}/image")
+def face_image(face_id: int, request: Request) -> FileResponse:
+    rt = runtime(request)
+    with rt.db.session() as s:
+        face = s.get(Face, face_id)
+        if face is None:
+            raise HTTPException(404, "Face not found")
+        path = rt.storage.face_path(face.filename)
+    if not path.exists():
+        raise HTTPException(404, "Image file missing")
+    return FileResponse(path, media_type="image/jpeg", headers={"Cache-Control": "private, max-age=3600"})
+
+
+@people_router.patch("/faces/{face_id}")
+def move_face(face_id: int, body: FaceMoveIn, request: Request) -> dict:
+    """Give a taught face another person's name (it was taught under the wrong one)."""
+    rt = runtime(request)
+    with rt.db.session() as s:
+        face = s.get(Face, face_id)
+        if face is None:
+            raise HTTPException(404, "Face not found")
+        face.person_id = person_by_key(s, body.person).id
+    rt.faces_changed()
+    return {"id": face_id, "label": body.person}
+
+
+@people_router.delete("/faces/{face_id}", status_code=204)
+def forget_face(face_id: int, request: Request) -> Response:
+    rt = runtime(request)
+    with rt.db.session() as s:
+        face = s.get(Face, face_id)
+        if face is None:
+            raise HTTPException(404, "Face not found")
+        rt.storage.delete_face(face.filename)
+        s.delete(face)  # its cached embeddings go with it (foreign key)
+    rt.faces_changed()
+    return Response(status_code=204)
diff --git a/visionstate/backend/visionstate/api/history.py b/visionstate/backend/visionstate/api/history.py
index 7864bc9..fecf717 100644
--- a/visionstate/backend/visionstate/api/history.py
+++ b/visionstate/backend/visionstate/api/history.py
@@ -30,6 +30,7 @@
     "cleared": Prediction.published_key == "off",
     "filtered": Prediction.published_key == "filtered",
     "asked": Prediction.published_key == "ask",
+    "face_seen": Prediction.published_key == "face",
     "value": Prediction.published_key.is_not(None),
     "rejected": Prediction.published_key.is_(None),
     "verified": Prediction.read_ok.is_not(None),
diff --git a/visionstate/backend/visionstate/api/imports.py b/visionstate/backend/visionstate/api/imports.py
index 8a3cd92..b81e20c 100644
--- a/visionstate/backend/visionstate/api/imports.py
+++ b/visionstate/backend/visionstate/api/imports.py
@@ -9,9 +9,10 @@
 from pathlib import Path
 
 from fastapi import APIRouter, File, HTTPException, Request, UploadFile
+from sqlalchemy import select
 
-from .. import bundle, detectors, imaging
-from ..db import keep_text_reader
+from .. import bundle, detectors, faces, imaging
+from ..db import Person, keep_text_reader
 from ..engine import Runtime
 from ..redact import redact
 from ..settings import (
@@ -23,9 +24,11 @@
 from .common import (
     API_PREFIX,
     runtime,
+    slugify,
     unique_name,
     unique_slug,
 )
+from .faces import add_face_row, new_person, taken_keys
 from .samples import copy_limited
 
 log = logging.getLogger(__name__)
@@ -43,20 +46,23 @@ async def import_bundle(request: Request, file: UploadFile = File(...)) -> dict:
         path.unlink(missing_ok=True)
         raise HTTPException(413, f"Bundle is larger than {UPLOAD_LIMITS['max_file_mb']} MB")
     try:
-        sensor_id, skipped = await asyncio.to_thread(_import_sync, rt, path)
+        sensor_id, skipped, faces_off = await asyncio.to_thread(_import_sync, rt, path)
     except (ValueError, KeyError, TypeError, OSError, zipfile.BadZipFile) as err:
         raise HTTPException(400, f"Import failed: {redact(str(err))}") from err
     finally:
         path.unlink(missing_ok=True)
     await rt.sensor_created(sensor_id)
+    await rt.people_changed()  # people that came with their faces
     cfg = await asyncio.to_thread(rt.load_sensor, sensor_id)
     if cfg and cfg.kind == KIND_STATES:
         rt.schedule_retrain(sensor_id, delay=0)
-    return {"id": sensor_id, "skipped": skipped}
+    # faces_off: it recognised faces where it was exported; the UI says to turn that on again here.
+    return {"id": sensor_id, "skipped": skipped, "faces_off": faces_off}
 
 
-def _import_sync(rt: Runtime, path: Path) -> tuple[int, int]:
-    """Creates the sensor of a bundle; returns its ID and how many of its images were unreadable."""
+def _import_sync(rt: Runtime, path: Path) -> tuple[int, int, bool]:
+    """Creates the sensor of a bundle; returns its ID, how many of its images were unreadable and
+    whether face recognition, on where it was exported, was turned off."""
     from pydantic import ValidationError
 
     from .sensors import SensorIn
@@ -93,6 +99,12 @@ def _import_sync(rt: Runtime, path: Path) -> tuple[int, int]:
         raise ValueError(f"invalid sensor in bundle: {err.errors()[0].get('msg')}") from err
     except HTTPException as err:
         raise ValueError(f"invalid sensor in bundle: {err.detail}") from err
+    faces_off = False
+    if spec.objects is not None and spec.objects.faces is not None:
+        # Taught faces come along, face recognition does not: it is turned on there, with its
+        # own confirmation (and download).
+        faces_off = bool(spec.objects.faces.enabled)
+        spec.objects.faces.enabled = False
     samples = manifest.get("samples", []) if spec.kind in (KIND_STATES, KIND_OBJECTS) else []
     if not isinstance(samples, list) or len(samples) > UPLOAD_LIMITS["max_zip_members"]:
         raise ValueError("too many samples in bundle")
@@ -121,7 +133,31 @@ def _import_sync(rt: Runtime, path: Path) -> tuple[int, int]:
         except (ValueError, KeyError, TypeError, AttributeError, OSError) as err:
             skipped += 1
             log.warning("Import: skipping a sample: %s", err)
-    return sensor_id, skipped
+    stored = manifest.get("faces", []) if spec.kind == KIND_OBJECTS else []
+    for item in stored if isinstance(stored, list) else []:
+        try:
+            _import_face(rt, path, sensor_id, item)
+        except (ValueError, KeyError, TypeError, AttributeError, OSError, HTTPException) as err:
+            skipped += 1
+            log.warning("Import: skipping a face: %s", getattr(err, "detail", err))
+    return sensor_id, skipped, faces_off
+
+
+def _import_face(rt: Runtime, path: Path, sensor_id: int, item: dict) -> None:
+    """A taught face from a bundle, for its person: the one with that key (or name), else a new one."""
+    face = faces.face_to_dict(faces.face_from_dict(item["face"]))
+    image = imaging.decode(bundle.read_sample_bytes(path, str(item["file"]), "faces"))
+    key, name = str(item["person"]), str(item.get("name") or item["person"]).strip()[:64]
+    with rt.db.session() as s:
+        person = s.scalar(select(Person).where(Person.key == key))
+        if person is None:
+            person = next((p for p in s.scalars(select(Person)) if p.name.lower() == name.lower()), None)
+        if person is None:
+            person = new_person(s, name)
+            if key not in taken_keys(s) and slugify(key, "") == key:
+                person.key = key  # the same entity IDs as where it was exported
+        filename = rt.storage.save_face(image)
+        add_face_row(s, person.id, sensor_id, filename, image, face, "import")
 
 
 def _import_sample(rt: Runtime, path: Path, sensor_id: int, kind: str, item: dict, own: set, state_ids: dict) -> None:
diff --git a/visionstate/backend/visionstate/api/review.py b/visionstate/backend/visionstate/api/review.py
index e22f538..a21feb5 100644
--- a/visionstate/backend/visionstate/api/review.py
+++ b/visionstate/backend/visionstate/api/review.py
@@ -11,15 +11,16 @@
 from sqlalchemy import CursorResult, delete, func, select, update
 
 from .. import imaging, readers
-from ..db import Prediction, Sample, SampleLabel, Sensor
-from ..engine import Runtime
-from ..settings import KIND_OBJECTS, KIND_READING, merge_objects, merge_reading
+from ..db import Face, Prediction, Sample, SampleLabel, Sensor
+from ..engine import Runtime, with_people
+from ..settings import FACE_UNKNOWN_KEY, KIND_OBJECTS, KIND_READING, merge_objects, merge_reading
 from .common import (
     API_PREFIX,
     get_sensor,
     runtime,
     state_id_for,
 )
+from .faces import FaceTeachIn, teach_face
 from .history import prediction_view
 from .teach import TeachIn, teach_box
 
@@ -29,10 +30,12 @@
 
 class ReviewIn(BaseModel):
     # State sensors: confirm | label (state_key) | skip. Reading sensors: read_ok | misread
-    # (optionally the value that was right) | skip. Object sensors ("Is this Our car?"): yes | no | skip.
+    # (optionally the value that was right) | skip. Object sensors ("Is this Our car?"): yes | no | skip;
+    # about a face ("Is this Kari?", "Who is this?") also person (state_key: who it is) and new
+    # (value: the new person's name).
     action: str
     state_key: str | None = None
-    value: str | None = Field(None, max_length=32)
+    value: str | None = Field(None, max_length=64)
 
 
 @router.get("/review")
@@ -65,8 +68,10 @@ def review_queue(request: Request, limit: int = 50) -> dict:
                         "roi": sensor.roi,
                         "states": [{"key": st.key, "name": st.name, "color": st.color} for st in sensor.states],
                         "reading": merge_reading(sensor.reading) if sensor.kind == KIND_READING else None,
-                        # object sensors: the own labels a question can be about
-                        "labels": merge_objects(sensor.objects)["custom"] if sensor.kind == KIND_OBJECTS else [],
+                        # object sensors: the own labels (and people) a question can be about
+                        "labels": with_people(merge_objects(sensor.objects), s)["custom"]
+                        if sensor.kind == KIND_OBJECTS
+                        else [],
                     },
                 }
             )
@@ -106,7 +111,7 @@ async def review_answer(prediction_id: int, body: ReviewIn, request: Request) ->
         sensor = get_sensor(s, row.sensor_id)
         kind = sensor.kind
     if kind == KIND_OBJECTS:
-        return await _answer_object(rt, request, prediction_id, body.action)
+        return await _answer_object(rt, request, prediction_id, body)
     with rt.db.session() as s:
         row = s.get(Prediction, prediction_id)
         if row is None:
@@ -166,11 +171,19 @@ async def review_answer(prediction_id: int, body: ReviewIn, request: Request) ->
     return {"ok": True}
 
 
-async def _answer_object(rt: Runtime, request: Request, prediction_id: int, action: str) -> dict:
+async def _answer_object(rt: Runtime, request: Request, prediction_id: int, body: ReviewIn) -> dict:
     """ "Is this Our car?" — yes teaches the box as the own label, no as its plain class (both in
     the light of that frame, so later boxes like it are told apart); skip only takes it out of the
-    queue. Answering again replaces the box the first answer taught."""
-    if action not in ("yes", "no", "skip"):
+    queue. Answering again replaces the box the first answer taught.
+
+    About a face: yes teaches the face as that person, person as the person named in
+    ``state_key``, new as a new person called ``value``; no and skip teach nothing (a face is
+    never taught as "not someone")."""
+    action = body.action
+    with rt.db.session() as s:
+        row = s.get(Prediction, prediction_id)
+        is_face = bool(row is not None and ((row.probs or {}).get("ask") or {}).get("face"))
+    if action not in (("yes", "no", "skip", "person", "new") if is_face else ("yes", "no", "skip")):
         raise HTTPException(400, "Answer yes, no or skip")
     with rt.db.session() as s:
         row = s.get(Prediction, prediction_id)
@@ -182,19 +195,50 @@ async def _answer_object(rt: Runtime, request: Request, prediction_id: int, acti
         sensor_id, score, taught = row.sensor_id, row.confidence, row.sample_id
         row.reviewed = True
         row.sample_id = None
-        if taught is not None and (sample := s.get(Sample, taught)) is not None:
+        if taught is not None and is_face and (face := s.get(Face, taught)) is not None:
+            rt.storage.delete_face(face.filename)  # the face the first answer taught
+            s.delete(face)
+        elif taught is not None and not is_face and (sample := s.get(Sample, taught)) is not None:
             rt.storage.delete_sample(sensor_id, sample.id, sample.filename)
             s.delete(sample)
     if taught is not None:
-        rt.taught_changed(sensor_id)
-    if action != "skip":
+        if is_face:
+            rt.faces_changed()
+        else:
+            rt.taught_changed(sensor_id)
+    if is_face:
+        await _answer_face(rt, request, prediction_id, sensor_id, question, score, body)
+        rt.live_state(sensor_id).asked.pop(question["label"], None)  # answered: the next may come now
+    elif action != "skip":
         label = question["label"] if action == "yes" else question["detected"]
-        body = TeachIn(
+        taught_box = TeachIn(
             history_id=prediction_id, box=question["box"], label=label, detected=question["detected"], score=score
         )
-        result = await teach_box(sensor_id, body, request)
+        result = await teach_box(sensor_id, taught_box, request)
         with rt.db.session() as s:
             if (answered := s.get(Prediction, prediction_id)) is not None:
                 answered.sample_id = result["id"]
     await rt.publish_review_count()
     return {"ok": True}
+
+
+async def _answer_face(
+    rt: Runtime, request: Request, prediction_id: int, sensor_id: int, question: dict, score: float, body: ReviewIn
+) -> None:
+    """Teach the face of a question when the answer says who it is (see _answer_object)."""
+    person, new_person = None, None
+    if body.action == "yes" and question["label"] != FACE_UNKNOWN_KEY:
+        person = question["label"]
+    elif body.action == "person":
+        person = body.state_key
+    elif body.action == "new":
+        new_person = (body.value or "").strip() or None
+        if new_person is None:
+            raise HTTPException(400, "Give the new person a name")
+    if person is None and new_person is None:
+        return
+    face = FaceTeachIn(history_id=prediction_id, box=question["box"], score=score, person=person, new_person=new_person)
+    result = await teach_face(sensor_id, face, request)
+    with rt.db.session() as s:
+        if (answered := s.get(Prediction, prediction_id)) is not None:
+            answered.sample_id = result["id"]
diff --git a/visionstate/backend/visionstate/api/sensors.py b/visionstate/backend/visionstate/api/sensors.py
index 55694b8..6bed45b 100644
--- a/visionstate/backend/visionstate/api/sensors.py
+++ b/visionstate/backend/visionstate/api/sensors.py
@@ -14,7 +14,7 @@
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
-from .. import bundle, readers
+from .. import bundle, faces, readers
 from ..db import ModelInfo, Prediction, ReadingStat, Sample, Sensor, State
 from ..redact import redact
 from ..settings import (
@@ -30,6 +30,8 @@
     SENSOR_LIMITS,
     SENSOR_PUBLISH_DEFAULT,
     STATE_PALETTE,
+    merge_objects,
+    merge_teach,
 )
 from ..sources import SOURCE_TYPES, SourceError
 from .common import (
@@ -40,6 +42,8 @@
     Roi,
     StateIn,
     Triggers,
+    check_faces,
+    check_teach,
     get_sensor,
     runtime,
     sample_counts,
@@ -115,7 +119,7 @@ def new_sensor(self, slug: str) -> Sensor:
             publish=self.publish,
             triggers=self.triggers.model_dump() if self.triggers else None,
             review=self.review.stored() if self.review else None,
-            objects=self.objects.model_dump() if self.objects else None,
+            objects=self.objects.stored() if self.objects else None,
             reading=self.reading.model_dump() if self.reading else None,
         )
         _apply_states(sensor, self.states)
@@ -223,7 +227,10 @@ async def update_sensor(sensor_id: int, body: SensorPatch, request: Request) ->
             _apply_states(sensor, body.states)
         if body.objects is not None:
             # Merged, so own labels (made by teaching) and fields an older UI does not send stay.
-            sensor.objects = {**(sensor.objects or {}), **body.objects.model_dump(exclude_unset=True)}
+            sensor.objects = {**(sensor.objects or {}), **body.objects.stored(exclude_unset=True)}
+            merged = merge_objects(sensor.objects)
+            check_teach(merge_teach(rt.backbone_id, rt.global_teach, merged["teach"]))
+            check_faces(faces.merge_limits(rt.face_choice, rt.global_faces, merged["faces"]))
         if body.reading is not None:
             sensor.reading = body.reading.model_dump()
         s.flush()
@@ -513,13 +520,14 @@ async def reading_export(
 
 
 @router.get("/{sensor_id}/export")
-async def export(sensor_id: int, request: Request, background: BackgroundTasks) -> FileResponse:
+async def export(sensor_id: int, request: Request, background: BackgroundTasks, faces: bool = False) -> FileResponse:
+    """A sensor as a bundle to import elsewhere; ``faces``: with the faces taught on it."""
     rt = runtime(request)
     fd, name = tempfile.mkstemp(suffix=".zip")
     os.close(fd)
     tmp = Path(name)
     try:
-        filename = await asyncio.to_thread(bundle.export_sensor, rt.db, rt.storage, sensor_id, tmp)
+        filename = await asyncio.to_thread(bundle.export_sensor, rt.db, rt.storage, sensor_id, tmp, faces)
     except KeyError as err:
         tmp.unlink(missing_ok=True)
         raise HTTPException(404, "Sensor not found") from err
diff --git a/visionstate/backend/visionstate/api/system.py b/visionstate/backend/visionstate/api/system.py
index d4ed18e..c297e69 100644
--- a/visionstate/backend/visionstate/api/system.py
+++ b/visionstate/backend/visionstate/api/system.py
@@ -1,5 +1,5 @@
-"""App-wide endpoints: the UI config, status, the AI models, history storage limits, review rules
-and the review reminder.
+"""App-wide endpoints: the UI config, status, the AI models, history storage limits, review rules,
+the review reminder and the teaching limits.
 
 Cameras and previews are in cameras.py, the review queue in review.py, import in imports.py."""
 
@@ -13,11 +13,16 @@
 from pydantic import BaseModel, Field
 from sqlalchemy import func, select
 
-from .. import backbones, detectors, readers
-from ..db import Prediction, Sensor
+from .. import backbones, detectors, faces, readers
+from ..db import Person, Prediction, Sensor
 from ..redact import redact
 from ..settings import (
     COUNTER_READERS,
+    FACE_DEFAULTS,
+    FACE_LIMITS,
+    FACE_TUNABLE,
+    FACE_UNKNOWN_KEY,
+    FACES,
     HISTORY,
     HISTORY_EVENTS,
     LIGHT_DOMAINS,
@@ -49,6 +54,8 @@
     STORAGE_DEFAULTS,
     STORAGE_LIMITS,
     TEACH,
+    TEACH_TUNABLE,
+    TEACH_TUNABLE_LIMITS,
     TRIGGER_DEFAULTS,
     TRIGGER_LIMITS,
     TRIGGER_MAX_ENTITIES,
@@ -56,11 +63,17 @@
     VERSION,
     VIDEO,
     merge_review,
+    merge_teach,
+    teach_defaults,
 )
 from ..sources import SOURCE_TYPES, SourceError
 from .common import (
     API_PREFIX,
+    FaceLimits,
     ReviewRules,
+    TeachLimits,
+    check_faces,
+    check_teach,
     iso,
     runtime,
 )
@@ -100,7 +113,16 @@ def ui_config() -> dict:
         "object_max_classes": OBJECT_MAX_CLASSES,
         "object_labels": [{"key": x.key, "name": x.name, "group": x.group} for x in detectors.LABELS.labels],
         "object_popular": list(detectors.LABELS.popular),
-        "teach": {"none_label": NONE_LABEL, "max_labels": TEACH["max_labels"]},
+        "teach": {
+            "none_label": NONE_LABEL,
+            "max_labels": TEACH["max_labels"],
+            "tunable": list(TEACH_TUNABLE),
+            "limits": TEACH_TUNABLE_LIMITS,
+        },
+        "face_defaults": {k: FACE_DEFAULTS[k] for k in ("enabled", "ask_unknown")},  # the limits: face-limits
+        "face_limits": FACE_LIMITS,
+        "face_unknown_key": FACE_UNKNOWN_KEY,
+        "faces": {k: FACES[k] for k in ("max_people", "max_faces_per_person", "suggest_faces", "stats_window")},
         "reading_sensor_defaults": READING_SENSOR_DEFAULTS,
         "reading_defaults": READING_DEFAULTS,
         "reading_limits": READING_LIMITS,
@@ -127,9 +149,11 @@ def counts():
             return (
                 s.scalar(select(func.count()).select_from(Sensor)) or 0,
                 s.scalar(select(func.count()).select_from(Prediction).where(Prediction.reviewed.is_(False))) or 0,
+                s.scalar(select(func.count()).select_from(Person)) or 0,
             )
 
-    sensors, review = await asyncio.to_thread(counts)
+    sensors, review, people = await asyncio.to_thread(counts)
+    face_sensors = await asyncio.to_thread(rt.face_sensor_ids)
     mqtt = rt.mqtt
     return {
         "version": VERSION,
@@ -147,6 +171,8 @@ def counts():
         "wheel_reader": rt.wheel_reader.spec.id if rt.wheel_reader else None,
         "wheel_reader_name": rt.wheel_reader.spec.name if rt.wheel_reader else None,
         "wheel_reader_error": rt.wheel_reader_error,
+        # The face model, the people and how many sensors recognise them (the People page).
+        "faces": {**rt.face_status(), "people": people, "sensors": len(face_sensors)},
         "mqtt": {
             "connected": mqtt.connected,
             "host": mqtt.config.host if mqtt.config else None,
@@ -167,63 +193,79 @@ class SettingsIn(BaseModel):
     backbone: str
     detector: str | None = None  # object sensors; None keeps the current one
     reader: str | None = None  # reading sensors; None keeps the current one
+    face_model: str | None = None  # face recognition on object sensors; None keeps the current one
+
+
+# The models a user chooses, per kind (the keys of their lists in GET /settings).
+MODELS = {
+    "backbones": backbones.BACKBONES,
+    "detectors": detectors.DETECTORS,
+    "readers": readers.READERS,
+    "face_models": faces.RECOGNISERS,
+}
+
+
+def _in_use(rt, kind: str, model_id: str, face_sensors: bool) -> str:
+    """Why a model cannot be deleted now ("" if it can)."""
+    if kind == "backbones" and model_id == rt.backbone_id:
+        return "It is the state model in use. Choose another one first."
+    if kind == "detectors" and model_id == rt.db.get_text("detector", detectors.DEFAULT_DETECTOR):
+        return "It is the object model in use. Choose another one first."
+    if kind == "readers" and model_id == rt.db.get_text("reader", readers.DEFAULT_READER):
+        return "It is the display reader in use. Choose another one first."
+    if kind == "face_models" and model_id == rt.face_choice and face_sensors:
+        return "A sensor recognises faces with it. Turn that off there first, or choose another face model."
+    return ""
 
 
 @router.get("/settings")
 def get_settings(request: Request) -> dict:
-    """The chosen AI models and every model that can be chosen."""
+    """The chosen AI models and every model that can be chosen, with whether each was downloaded
+    and can be deleted again (``in_use`` says why not)."""
     rt = runtime(request)
+    face_sensors = bool(rt.face_sensor_ids())
+
+    def model(spec, kind: str = "") -> dict:
+        return {
+            "id": spec.id,
+            "name": spec.name,
+            "description": spec.description,
+            "installed": rt.model_path(spec) is not None,
+            "downloaded": rt.downloaded(spec),
+            "in_use": _in_use(rt, kind, spec.id, face_sensors),
+            "size": spec.size,
+            "license": spec.license,
+            "source": spec.source,
+            **spec.footprint.as_dict(),
+        }
+
     return {
         "backbone": rt.embedder.spec.id if rt.embedder else backbones.DEFAULT_BACKBONE,
-        "backbones": [
-            {
-                "id": spec.id,
-                "name": spec.name,
-                "description": spec.description,
-                "installed": rt.model_path(spec) is not None,
-                "size": spec.size,
-            }
-            for spec in backbones.BACKBONES.values()
-        ],
+        "backbones": [model(spec, "backbones") for spec in backbones.BACKBONES.values()],
         "detector": rt.db.get_text("detector", detectors.DEFAULT_DETECTOR),
-        "detectors": [
-            {
-                "id": spec.id,
-                "name": spec.name,
-                "description": spec.description,
-                "installed": rt.model_path(spec) is not None,
-                "size": spec.size,
-                "license": spec.license,
-                "source": spec.source,
-            }
-            for spec in detectors.DETECTORS.values()
-        ],
+        "detectors": [model(spec, "detectors") for spec in detectors.DETECTORS.values()],
         "reader": rt.db.get_text("reader", readers.DEFAULT_READER),
-        "readers": [
-            {
-                "id": spec.id,
-                "name": spec.name,
-                "description": spec.description,
-                "installed": rt.model_path(spec) is not None,
-                "size": spec.size,
-                "license": spec.license,
-                "source": spec.source,
-            }
-            for spec in readers.READERS.values()
-        ],
+        "readers": [model(spec, "readers") for spec in readers.READERS.values()],
         # Mechanical counters set to the wheel reader; one model for now, so nothing to choose.
         "wheel_reader": readers.DEFAULT_WHEEL_READER,
-        "wheel_readers": [
+        "wheel_readers": [model(spec) for spec in readers.WHEEL_READERS.values()],
+        # Faces: the recogniser to choose (one face detector goes with every one); downloaded when
+        # a sensor turns face recognition on. "size" and "installed" count the detector too.
+        "face_model": rt.face_choice,
+        "face_models": [
             {
-                "id": spec.id,
-                "name": spec.name,
-                "description": spec.description,
-                "installed": rt.model_path(spec) is not None,
-                "size": spec.size,
-                "license": spec.license,
-                "source": spec.source,
+                **model(spec, "face_models"),
+                "size": spec.size + (0 if rt.model_path(faces.DETECTOR) else faces.DETECTOR.size),
+                "installed": rt.face_files_present(spec.id),
+                "data": spec.data,
+                "detector": {
+                    "name": faces.DETECTOR.name,
+                    "license": faces.DETECTOR.license,
+                    "data": faces.DETECTOR.data,
+                    "source": faces.DETECTOR.source,
+                },
             }
-            for spec in readers.WHEEL_READERS.values()
+            for spec in faces.RECOGNISERS.values()
         ],
         "options": {
             "discovery_prefix": rt.settings.discovery_prefix,
@@ -242,6 +284,8 @@ async def put_settings(body: SettingsIn, request: Request) -> dict:
         raise HTTPException(400, "Unknown detector")
     if body.reader is not None and body.reader not in readers.READERS:
         raise HTTPException(400, "Unknown reader")
+    if body.face_model is not None and body.face_model not in faces.RECOGNISERS:
+        raise HTTPException(400, "Unknown face model")
     current = get_settings(request)
     # Only reload what changed: a new backbone retrains every state sensor.
     if body.backbone != current["backbone"]:
@@ -259,9 +303,41 @@ async def put_settings(body: SettingsIn, request: Request) -> dict:
             await rt.set_reader(body.reader)
         except Exception as err:  # noqa: BLE001
             raise HTTPException(500, f"Could not load reader: {redact(str(err))}") from err
+    if body.face_model is not None and body.face_model != current["face_model"]:
+        await rt.set_face_model(body.face_model)  # loads in the background when a sensor uses faces
     return get_settings(request)
 
 
+@router.post("/faces/retry")
+async def faces_retry(request: Request) -> dict:
+    """Try to download and load the face model again after it failed."""
+    rt = runtime(request)
+    rt.retry_faces()
+    return rt.face_status()
+
+
+@router.delete("/models/{kind}/{model_id}")
+async def delete_model(kind: str, model_id: str, request: Request) -> dict:
+    """Delete a downloaded AI model that is not in use (it is downloaded again when chosen)."""
+    rt = runtime(request)
+    spec = MODELS.get(kind, {}).get(model_id)
+    if spec is None:
+        raise HTTPException(404, "Unknown model")
+    face_sensors = bool(await asyncio.to_thread(rt.face_sensor_ids))
+    reason = await asyncio.to_thread(_in_use, rt, kind, model_id, face_sensors)
+    if reason:
+        raise HTTPException(409, reason)
+    if not rt.downloaded(spec):
+        raise HTTPException(404, "This model is included in the app or not downloaded")
+    if kind == "face_models":
+        if rt.face_model is not None:
+            await rt.faces_settled()  # let the unused face model go before its file
+        await asyncio.to_thread(rt.delete_face_files, model_id)
+    else:
+        await asyncio.to_thread((rt.settings.models_dir / spec.filename).unlink, missing_ok=True)
+    return await asyncio.to_thread(get_settings, request)
+
+
 # --- storage ----------------------------------------------------------------------
 
 
@@ -303,6 +379,61 @@ async def put_review_rules(body: ReviewRules, request: Request) -> dict:
     return merge_review(rt.global_review, None)
 
 
+# --- teaching limits ----------------------------------------------------------
+
+
+def _teach_view(rt) -> dict:
+    """The global teaching limits: the backbone's defaults, what the user set (None: the default)
+    and the result, which each object sensor inherits unless it has its own value."""
+    backbone = rt.backbone_id
+    return {
+        "backbone": backbone,
+        "defaults": teach_defaults(backbone),
+        "values": {key: rt.global_teach.get(key) for key in TEACH_TUNABLE},
+        "effective": {key: merge_teach(backbone, rt.global_teach, None)[key] for key in TEACH_TUNABLE},
+    }
+
+
+@router.get("/teach-limits")
+def get_teach_limits(request: Request) -> dict:
+    return _teach_view(runtime(request))
+
+
+@router.put("/teach-limits")
+async def put_teach_limits(body: TeachLimits, request: Request) -> dict:
+    rt = runtime(request)
+    check_teach(merge_teach(rt.backbone_id, body.stored(), None))
+    await asyncio.to_thread(rt.set_global_teach, body.stored())
+    return _teach_view(rt)
+
+
+# --- face limits --------------------------------------------------------------
+
+
+def _faces_view(rt) -> dict:
+    """The global face limits: the face model's defaults, what the user set (None: the default)
+    and the result, which each object sensor inherits unless it has its own value."""
+    return {
+        "model": rt.face_choice,
+        "defaults": faces.tunable_defaults(rt.face_choice),
+        "values": {key: rt.global_faces.get(key) for key in FACE_TUNABLE},
+        "effective": faces.merge_limits(rt.face_choice, rt.global_faces, None),
+    }
+
+
+@router.get("/face-limits")
+def get_face_limits(request: Request) -> dict:
+    return _faces_view(runtime(request))
+
+
+@router.put("/face-limits")
+async def put_face_limits(body: FaceLimits, request: Request) -> dict:
+    rt = runtime(request)
+    check_faces(faces.merge_limits(rt.face_choice, body.stored(), None))
+    await asyncio.to_thread(rt.set_global_faces, body.stored())
+    return _faces_view(rt)
+
+
 # --- review reminder ----------------------------------------------------------
 
 _mlo = {k: v[0] for k, v in REMINDER_LIMITS.items()}
diff --git a/visionstate/backend/visionstate/api/teach.py b/visionstate/backend/visionstate/api/teach.py
index d9b5586..57c41b8 100644
--- a/visionstate/backend/visionstate/api/teach.py
+++ b/visionstate/backend/visionstate/api/teach.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+from datetime import UTC, timedelta
 
 from fastapi import APIRouter, HTTPException, Request, Response
 from PIL import Image
@@ -10,14 +11,15 @@
 from sqlalchemy import ColumnElement, func, select
 from sqlalchemy.orm import Session
 
-from .. import detectors, imaging
-from ..db import Prediction, Sample
+from .. import detectors, imaging, teach
+from ..db import Person, Prediction, Sample
 from ..engine import Runtime
-from ..settings import KIND_OBJECTS, NONE_LABEL, TEACH, active_custom, merge_objects
+from ..settings import FACE_UNKNOWN_KEY, HISTORY, KIND_OBJECTS, NONE_LABEL, TEACH, active_custom, merge_objects
 from .common import API_PREFIX, get_sensor, iso, runtime, slugify
 from .sensors import prediction_view
 
 router = APIRouter(prefix=f"{API_PREFIX}/sensors", tags=["teach"])
+RESERVED_KEYS = {NONE_LABEL, FACE_UNKNOWN_KEY}  # never the key of an own label
 
 
 class TeachIn(BaseModel):
@@ -41,8 +43,9 @@ def _valid_box(cls, value: list[float]) -> list[float]:
         return [x1, y1, x2, y2]
 
 
-def _own_label(objects: dict, name: str, parent: str) -> dict:
-    """A new own label: its key never clashes with an object VisionState knows or another own label."""
+def own_label(objects: dict, name: str, parent: str, people: set[str]) -> dict:
+    """A new own label: its key never clashes with an object VisionState knows, another own label
+    or a person (``people``: their keys; they are entities of the sensor too)."""
     if parent not in objects["classes"]:
         raise HTTPException(400, "An own label belongs to one of the sensor's objects")
     if len(objects["custom"]) >= TEACH["max_labels"]:
@@ -50,7 +53,7 @@ def _own_label(objects: dict, name: str, parent: str) -> dict:
     name = name.strip()
     if any(label["name"].lower() == name.lower() for label in objects["custom"]):
         raise HTTPException(400, f"There is already a label called {name}")
-    taken = set(detectors.LABELS.by_key) | {label["key"] for label in objects["custom"]} | {NONE_LABEL}
+    taken = set(detectors.LABELS.by_key) | {label["key"] for label in objects["custom"]} | RESERVED_KEYS | people
     base = slugify(name, "label")
     key, n = base, 2
     while key in taken:
@@ -96,19 +99,21 @@ def taught(sensor_id: int, request: Request) -> dict:
         }
 
 
-async def _frame_image(rt: Runtime, sensor_id: int, body: TeachIn) -> tuple[Image.Image, str]:
-    """The frame the box was drawn on, and where it came from ("live" or "history")."""
-    if body.history_id is not None:
+async def frame_image(
+    rt: Runtime, sensor_id: int, frame_id: str | None, history_id: int | None
+) -> tuple[Image.Image, str]:
+    """The frame a box was drawn on, and where it came from ("live" or "history")."""
+    if history_id is not None:
         with rt.db.session() as s:
-            row = s.get(Prediction, body.history_id)
+            row = s.get(Prediction, history_id)
             if row is None or row.sensor_id != sensor_id or not row.frame:
                 raise HTTPException(404, "History frame not found")
             path = rt.storage.history_path(sensor_id, row.frame)
         if not path.exists():
             raise HTTPException(404, "History frame file missing")
         return await asyncio.to_thread(imaging.load, path), "history"
-    if body.frame_id:
-        data = rt.live_state(sensor_id).analysed_frame(body.frame_id)
+    if frame_id:
+        data = rt.live_state(sensor_id).analysed_frame(frame_id)
         if data is None:
             raise HTTPException(409, "That frame is no longer kept. Tap the box again on the newest frame.")
         return await asyncio.to_thread(imaging.decode, data), "live"
@@ -137,7 +142,9 @@ async def teach_box(sensor_id: int, body: TeachIn, request: Request) -> dict:
             raise HTTPException(400, f"Unknown object {body.detected!r}")
         new = None
         if body.new_label:
-            new = _own_label(objects, body.new_label, body.parent or body.detected or "")
+            new = own_label(
+                objects, body.new_label, body.parent or body.detected or "", set(s.scalars(select(Person.key)))
+            )
             label = new["key"]
         else:
             active = {c["key"] for c in active_custom(objects)}
@@ -150,7 +157,7 @@ async def teach_box(sensor_id: int, body: TeachIn, request: Request) -> dict:
     x1, _, x2, y2 = body.box
     if not imaging.in_region((x1 + x2) / 2, y2, roi):
         raise HTTPException(400, "That box is outside the sensor's region, so it never counts")
-    image, origin = await _frame_image(rt, sensor_id, body)
+    image, origin = await frame_image(rt, sensor_id, body.frame_id, body.history_id)
     if new is not None:
         with rt.db.session() as s:
             row = get_sensor(s, sensor_id)
@@ -169,10 +176,68 @@ async def teach_box(sensor_id: int, body: TeachIn, request: Request) -> dict:
     if new is not None:
         await rt.sensor_updated(sensor_id, retrain=False)  # the new label's entities
     rt.taught_changed(sensor_id)
+    if body.history_id is not None:
+        await asyncio.to_thread(remember_taught, rt, sensor_id, body.history_id, body.box, label, body.detected)
     return {"id": example_id, "label": label, "seen": seen}
 
 
-def _delete_examples(rt: Runtime, s: Session, sensor_id: int, where: list[ColumnElement[bool]]) -> int:
+def remember_taught(
+    rt: Runtime,
+    sensor_id: int,
+    history_id: int,
+    box: list[float],
+    label: str,
+    detected: str | None,
+    person: bool = False,
+) -> None:
+    """A box taught from a history frame (or a review answer): the row shows it with its new label
+    from then on, and an own label or person counts as seen at that frame's time (so the sensor no
+    longer says "not seen yet" about what was just taught from it)."""
+    with rt.db.session() as s:
+        row = s.get(Prediction, history_id)
+        if row is None or row.sensor_id != sensor_id:
+            return
+        key = _mark_taught(row, box, label, detected, add=True) or label
+        # The same moment's other rows (a face seen, and the question about it) show it too.
+        moment = timedelta(seconds=HISTORY["same_moment_s"])
+        for other in s.scalars(
+            select(Prediction).where(
+                Prediction.sensor_id == sensor_id,
+                Prediction.id != row.id,
+                Prediction.created_at.between(row.created_at - moment, row.created_at + moment),
+            )
+        ):
+            _mark_taught(other, box, label, detected, add=False)
+        created = row.created_at
+        at = (created if created.tzinfo else created.replace(tzinfo=UTC)).timestamp()  # stored naive, in UTC
+    if label not in (NONE_LABEL, key):
+        rt.seen_earlier(sensor_id, label, at, person)
+
+
+def _mark_taught(row: Prediction, box: list[float], label: str, detected: str | None, add: bool) -> str | None:
+    """Write a taught box into a history row: the box of the row that is this one (or, ``add``,
+    a new one) gets the label; returns the class it was found as, or None (no such box)."""
+    found = [dict(d) for d in row.detections or []]
+    best = max(found, key=lambda d: teach.box_iou(d["box"], box), default=None)
+    if best is None or teach.box_iou(best["box"], box) < TEACH["keep_iou"]:
+        if not add:
+            return None
+        best = {"key": detected or label, "score": 0.0, "box": list(box)}
+        found.append(best)
+    best.pop("ask", None)
+    best.pop("filtered", None)
+    if label in (NONE_LABEL, best["key"]):
+        best.pop("label", None)  # not it, or just the class it was found as
+        if label == NONE_LABEL:
+            best["filtered"] = True
+    else:
+        best["label"] = label
+    best["taught"] = True
+    row.detections = found
+    return best["key"]
+
+
+def delete_examples(rt: Runtime, s: Session, sensor_id: int, where: list[ColumnElement[bool]]) -> int:
     """Delete the taught boxes of a sensor that match ``where`` (all with an empty list); returns how many."""
     rows = s.scalars(
         select(Sample).where(Sample.sensor_id == sensor_id, Sample.object_label.is_not(None), *where)
@@ -188,13 +253,13 @@ def forget_box(sensor_id: int, example_id: int, request: Request) -> Response:
     rt = runtime(request)
     with rt.db.session() as s:
         get_sensor(s, sensor_id, KIND_OBJECTS)
-        if not _delete_examples(rt, s, sensor_id, [Sample.id == example_id]):
+        if not delete_examples(rt, s, sensor_id, [Sample.id == example_id]):
             raise HTTPException(404, "Taught box not found")
     rt.taught_changed(sensor_id)
     return Response(status_code=204)
 
 
-async def _remove_labels(rt: Runtime, sensor_id: int, keys: set[str] | None) -> None:
+async def remove_labels(rt: Runtime, sensor_id: int, keys: set[str] | None) -> None:
     """Remove own labels (``None``: all of them, and every taught box) with their entities."""
     with rt.db.session() as s:
         sensor = get_sensor(s, sensor_id, KIND_OBJECTS)
@@ -202,7 +267,7 @@ async def _remove_labels(rt: Runtime, sensor_id: int, keys: set[str] | None) ->
         gone = [c["key"] for c in objects["custom"] if keys is None or c["key"] in keys]
         if keys is not None and not gone:
             raise HTTPException(404, "Label not found")
-        _delete_examples(rt, s, sensor_id, [] if keys is None else [Sample.object_label.in_(gone)])
+        delete_examples(rt, s, sensor_id, [] if keys is None else [Sample.object_label.in_(gone)])
         sensor.objects = {**(sensor.objects or {}), "custom": [c for c in objects["custom"] if c["key"] not in gone]}
         slug = sensor.slug
     for key in gone:
@@ -214,31 +279,32 @@ async def _remove_labels(rt: Runtime, sensor_id: int, keys: set[str] | None) ->
 @router.delete("/{sensor_id}/taught", status_code=204)
 async def forget_all(sensor_id: int, request: Request) -> Response:
     """Forget everything an object sensor was taught: every box and every own label."""
-    await _remove_labels(runtime(request), sensor_id, None)
+    await remove_labels(runtime(request), sensor_id, None)
     return Response(status_code=204)
 
 
 @router.delete("/{sensor_id}/labels/{key}", status_code=204)
 async def remove_label(sensor_id: int, key: str, request: Request) -> Response:
     """Remove an own label, the boxes taught with it and its entities in Home Assistant."""
-    await _remove_labels(runtime(request), sensor_id, {key})
+    await remove_labels(runtime(request), sensor_id, {key})
     return Response(status_code=204)
 
 
 def import_custom(stored: object) -> list[dict]:
-    """Own labels from an exported sensor, checked like new ones."""
+    """Own labels from an exported sensor, checked like new ones (people come with their faces,
+    api/imports.py)."""
     labels: list[dict] = []
     for item in stored if isinstance(stored, list) else []:
         try:
             key, name, parent = str(item["key"]), str(item["name"]).strip(), str(item["parent"])
         except KeyError, TypeError:
             continue
-        taken = set(detectors.LABELS.by_key) | {label["key"] for label in labels} | {NONE_LABEL}
-        if slugify(key, "") != key or key in taken or not name or parent not in detectors.LABELS.by_key:
+        taken = set(detectors.LABELS.by_key) | {label["key"] for label in labels} | RESERVED_KEYS
+        if item.get("face") or slugify(key, "") != key or key in taken or not name:
+            continue
+        if parent not in detectors.LABELS.by_key or len(labels) >= TEACH["max_labels"]:
             continue
         labels.append({"key": key, "name": name[:64], "parent": parent})
-        if len(labels) >= TEACH["max_labels"]:
-            break
     return labels
 
 
diff --git a/visionstate/backend/visionstate/backbones.json b/visionstate/backend/visionstate/backbones.json
index 8196384..506b26b 100644
--- a/visionstate/backend/visionstate/backbones.json
+++ b/visionstate/backend/visionstate/backbones.json
@@ -11,11 +11,14 @@
       "mean": [0.485, 0.456, 0.406],
       "std": [0.229, 0.224, 0.225],
       "pooling": "cls_mean",
-      "bundled": true
+      "bundled": true,
+      "ram_mb": 60,
+      "time_ms": 70,
+      "accuracy": 3
     },
     "dinov2-small": {
       "name": "DINOv2 small · fp32 (accurate)",
-      "description": "Full precision. Slightly more accurate, about 3x slower. Downloaded on first use (89 MB).",
+      "description": "Full precision. Slightly more accurate and slower, most of all on small CPUs such as a Raspberry Pi. Downloaded on first use (89 MB).",
       "url": "https://huggingface.co/onnx-community/dinov2-small/resolve/8b1f705a3a7f6f062f6bdd21986c1583d3ef105d/onnx/model.onnx",
       "sha256": "f22797eabf810a75e41de68d378541ebea372122b25c4ce3ef25ff618250c20a",
       "size": 88532934,
@@ -23,7 +26,27 @@
       "mean": [0.485, 0.456, 0.406],
       "std": [0.229, 0.224, 0.225],
       "pooling": "cls_mean",
-      "bundled": false
+      "bundled": false,
+      "ram_mb": 120,
+      "time_ms": 85,
+      "accuracy": 4
+    },
+    "dinov2-base": {
+      "name": "DINOv2 base · fp32 (most accurate)",
+      "description": "A larger model: tells similar states and objects apart best, but about three times as slow as DINOv2 small and needs about 400 MB of memory. For a fast PC. Downloaded on first use (347 MB).",
+      "url": "https://huggingface.co/onnx-community/dinov2-base/resolve/31ef06cac16d5d301c5930d147002a058c85a5e4/onnx/model.onnx",
+      "sha256": "320d1012a6fc65b101fc85ca30ee7a47b2e4f6a2e8bd78fb9d7036def0e30cb0",
+      "size": 346627111,
+      "input_size": 224,
+      "mean": [0.485, 0.456, 0.406],
+      "std": [0.229, 0.224, 0.225],
+      "pooling": "cls_mean",
+      "license": "Apache-2.0",
+      "source": "https://huggingface.co/facebook/dinov2-base",
+      "bundled": false,
+      "ram_mb": 390,
+      "time_ms": 245,
+      "accuracy": 5
     }
   }
 }
diff --git a/visionstate/backend/visionstate/backbones.py b/visionstate/backend/visionstate/backbones.py
index 5d8469d..887b845 100644
--- a/visionstate/backend/visionstate/backbones.py
+++ b/visionstate/backend/visionstate/backbones.py
@@ -3,18 +3,21 @@
 Available backbones are declared in ``backbones.json``; adding a model is a new entry there.
 Entries are never changed or removed once released, so a stored choice keeps working.
 Run ``python -m visionstate.backbones <dest>`` to download all bundled models (backbones,
-detectors, readers) for the Dockerfile and CI. ``download``/``locate`` work for every kind of spec.
+detectors, readers) for the Dockerfile and CI; ``--all`` adds the ones downloaded on first use. ``download``/``locate`` work for every kind of spec.
 """
 
 from __future__ import annotations
 
+import ctypes
+import gc
 import hashlib
 import json
 import logging
 import sys
 import threading
 import urllib.request
-from dataclasses import dataclass
+from collections.abc import Callable
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Protocol
 
@@ -41,6 +44,27 @@ def sha256(self) -> str: ...
     def filename(self) -> str: ...
 
 
+@dataclass(frozen=True)
+class Footprint:
+    """What a model costs and gives, roughly, for the model comparison in Settings.
+
+    Measured with ONNX Runtime on 4 threads of a desktop CPU (the extra memory once loaded and
+    run, the time of one check); ``accuracy`` ranks the models of one kind from 1 to 5. Texts and
+    these numbers may be updated in a released entry; its file and inputs never change.
+    """
+
+    ram_mb: int = 0
+    time_ms: int = 0
+    accuracy: int = 0
+
+    @classmethod
+    def of(cls, entry: dict) -> Footprint:
+        return cls(int(entry.get("ram_mb", 0)), int(entry.get("time_ms", 0)), int(entry.get("accuracy", 0)))
+
+    def as_dict(self) -> dict:
+        return {"ram_mb": self.ram_mb, "time_ms": self.time_ms, "accuracy": self.accuracy}
+
+
 @dataclass(frozen=True)
 class BackboneSpec:
     id: str
@@ -54,6 +78,9 @@ class BackboneSpec:
     std: tuple[float, float, float]
     pooling: str
     bundled: bool
+    license: str = ""
+    source: str = ""
+    footprint: Footprint = field(default_factory=lambda: Footprint())
 
     @property
     def filename(self) -> str:
@@ -76,6 +103,9 @@ def load_registry() -> tuple[str, dict[str, BackboneSpec]]:
             std=tuple(v["std"]),
             pooling=v.get("pooling", "cls_mean"),
             bundled=bool(v.get("bundled", False)),
+            license=v.get("license", ""),
+            source=v.get("source", ""),
+            footprint=Footprint.of(v),
         )
         for key, v in raw["backbones"].items()
     }
@@ -93,16 +123,22 @@ def sha256_file(path: Path) -> str:
     return digest.hexdigest()
 
 
-def download(spec: ModelFile, dest_dir: Path) -> Path:
+def download(spec: ModelFile, dest_dir: Path, progress: Callable[[int], None] | None = None) -> Path:
+    """Fetch a model into ``dest_dir`` (unless it is there already) and check its SHA-256;
+    ``progress`` is told the bytes fetched so far."""
     dest_dir.mkdir(parents=True, exist_ok=True)
     target = dest_dir / spec.filename
     if target.exists() and sha256_file(target) == spec.sha256:
         return target
     tmp = target.with_suffix(".part")
     log.info("Downloading model %s from %s", spec.id, spec.url)
+    done = 0
     with urllib.request.urlopen(spec.url, timeout=60) as resp, tmp.open("wb") as out:  # noqa: S310
         while chunk := resp.read(1 << 20):
             out.write(chunk)
+            done += len(chunk)
+            if progress is not None:
+                progress(done)
     actual = sha256_file(tmp)
     if actual != spec.sha256:
         tmp.unlink(missing_ok=True)
@@ -123,15 +159,30 @@ def cpu_session(model_path: Path):
     """An ONNX Runtime session on the CPU — the only target, deliberately (docs/SCOPE.md).
 
     Only the CPU provider is passed, so nothing else ONNX Runtime ships with (such as its
-    Azure provider) is ever used.
+    Azure provider) is ever used. Only errors are logged: SFace's file lists its weights as graph
+    inputs too, and ONNX Runtime warned about every one of them (174 lines) each time it loaded.
     """
     import onnxruntime as ort
 
     options = ort.SessionOptions()
+    options.log_severity_level = 3
     options.graph_optimization_level = ort.GraphOptimizationLevel.ORT_ENABLE_ALL
     return ort.InferenceSession(str(model_path), sess_options=options, providers=["CPUExecutionProvider"])
 
 
+def release_memory() -> None:
+    """Give the memory of models that are no longer used back to the system.
+
+    A dropped ONNX Runtime session is freed, but glibc keeps the freed memory for later use, so
+    switching models left the app hundreds of MB larger every time (until a restart).
+    ``malloc_trim`` returns it; on other C libraries (Windows, macOS) there is nothing to do."""
+    gc.collect()
+    try:
+        ctypes.CDLL("libc.so.6").malloc_trim(0)
+    except OSError, AttributeError:
+        pass
+
+
 class Embedder:
     """Turns images into L2-normalised feature vectors with one ONNX backbone."""
 
@@ -169,12 +220,15 @@ def _pool(self, hidden: np.ndarray) -> np.ndarray:
 
 
 if __name__ == "__main__":
-    from . import detectors, readers
+    from . import detectors, faces, readers
 
     logging.basicConfig(level=logging.INFO)
-    destination = Path(sys.argv[1] if len(sys.argv) > 1 else "models")
-    # Every bundled model: backbones (states), detectors (objects), readers and wheel readers (readings).
+    args = [a for a in sys.argv[1:] if a != "--all"]
+    destination = Path(args[0] if args else "models")
+    # Every bundled model: backbones (states), detectors (objects), readers and wheel readers
+    # (readings); with --all also the ones downloaded on first use (the face models are never
+    # bundled), for the tests of every model.
     specs = [*BACKBONES.values(), *detectors.DETECTORS.values(), *readers.READERS.values()]
-    for spec in [*specs, *readers.WHEEL_READERS.values()]:
-        if spec.bundled:
+    for spec in [*specs, *readers.WHEEL_READERS.values(), faces.DETECTOR, *faces.RECOGNISERS.values()]:
+        if spec.bundled or "--all" in sys.argv:
             print(download(spec, destination))
diff --git a/visionstate/backend/visionstate/bundle.py b/visionstate/backend/visionstate/bundle.py
index 031093d..bc12625 100644
--- a/visionstate/backend/visionstate/bundle.py
+++ b/visionstate/backend/visionstate/bundle.py
@@ -9,7 +9,7 @@
 
 from sqlalchemy import select
 
-from .db import Database, Prediction, Sample, Sensor
+from .db import Database, Face, Person, Prediction, Sample, Sensor
 from .redact import has_credentials, redact
 from .settings import EXPORT_STRIP_CREDENTIALS, UPLOAD_LIMITS, VERSION
 from .storage import Storage
@@ -18,8 +18,11 @@
 MANIFEST = "manifest.json"
 
 
-def export_sensor(db: Database, storage: Storage, sensor_id: int, target: Path) -> str:
-    """Writes a bundle for one sensor to ``target``; returns the suggested download filename."""
+def export_sensor(db: Database, storage: Storage, sensor_id: int, target: Path, include_faces: bool = False) -> str:
+    """Writes a bundle for one sensor to ``target``; returns the suggested download filename.
+
+    The faces taught on this sensor go along only with ``include_faces`` (the user ticks it), with
+    the names of their people; their embeddings never do (an import computes them again)."""
     with db.session() as s:
         sensor = s.get(Sensor, sensor_id)
         if sensor is None:
@@ -49,9 +52,28 @@ def export_sensor(db: Database, storage: Storage, sensor_id: int, target: Path)
                 "states": [{"key": st.key, "name": st.name, "color": st.color} for st in sensor.states],
             },
             "samples": [],
+            "faces": [],
         }
         samples = s.scalars(select(Sample).where(Sample.sensor_id == sensor_id)).all()
+        query = select(Face, Person).join(Person, Face.person_id == Person.id).where(Face.sensor_id == sensor_id)
+        taught_faces = [(face, person) for face, person in s.execute(query).all()] if include_faces else []
         with zipfile.ZipFile(target, "w", zipfile.ZIP_DEFLATED) as archive:
+            for face, person in taught_faces:
+                path = storage.face_path(face.filename)
+                if not path.exists():
+                    continue
+                archive.write(path, f"faces/{face.filename}")
+                manifest["faces"].append(
+                    {
+                        "file": face.filename,
+                        "person": person.key,
+                        "name": person.name,
+                        "origin": face.origin,
+                        "is_night": face.is_night,
+                        "face": face.face,
+                        "created_at": face.created_at.isoformat(),
+                    }
+                )
             for sample in samples:
                 path = storage.sample_path(sensor_id, sample.filename)
                 if not path.exists():
@@ -242,9 +264,9 @@ def read_manifest(path: Path) -> dict:
     return manifest
 
 
-def read_sample_bytes(path: Path, filename: str) -> bytes:
+def read_sample_bytes(path: Path, filename: str, folder: str = "samples") -> bytes:
     with zipfile.ZipFile(path) as archive:
-        info = archive.getinfo(f"samples/{filename}")
+        info = archive.getinfo(f"{folder}/{filename}")
         if info.file_size > UPLOAD_LIMITS["max_zip_member_mb"] * 1_000_000:
             raise ValueError(f"{filename} is too large")
         return archive.read(info)
diff --git a/visionstate/backend/visionstate/db.py b/visionstate/backend/visionstate/db.py
index 1ed2b94..71799d9 100644
--- a/visionstate/backend/visionstate/db.py
+++ b/visionstate/backend/visionstate/db.py
@@ -27,7 +27,7 @@
 from sqlalchemy.engine import Connection
 from sqlalchemy.orm import DeclarativeBase, Mapped, Session, mapped_column, relationship, sessionmaker
 
-SCHEMA_VERSION = 12
+SCHEMA_VERSION = 13
 
 # Schema upgrades for existing databases, keyed on the version they upgrade to.
 # Each step is a list of (table, column, SQL type) columns to add.
@@ -49,6 +49,7 @@
         ("sample", "score", "FLOAT"),
     ],
     11: [("prediction", "sample_id", "INTEGER")],
+    # 13: the people and their faces (new tables: person, face, face_embedding).
 }
 
 
@@ -243,6 +244,47 @@ class ModelInfo(Base):
     train_seconds: Mapped[float] = mapped_column(Float, default=0.0)
 
 
+class Person(Base):
+    """Someone taught by their face, known to every object sensor that recognises faces. ``key``
+    is the entity key on those sensors (``binary_sensor.<sensor>_<key>``) and of their own
+    sensor (``sensor.visionstate_<key>``): never changed once made."""
+
+    __tablename__ = "person"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    key: Mapped[str] = mapped_column(String(64), unique=True)
+    name: Mapped[str] = mapped_column(String(128))
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utcnow)
+
+
+class Face(Base):
+    """A taught face: the face with a margin, not aligned, in <data>/faces
+    (storage.Storage.face_path), the face in that crop's pixels {box, points, score} (see
+    faces.face_to_dict), and the camera it was taught on (null once that sensor is deleted: the
+    face stays with the person)."""
+
+    __tablename__ = "face"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    person_id: Mapped[int] = mapped_column(ForeignKey("person.id", ondelete="CASCADE"), index=True)
+    sensor_id: Mapped[int | None] = mapped_column(ForeignKey("sensor.id", ondelete="SET NULL"), nullable=True)
+    filename: Mapped[str] = mapped_column(String(256))
+    origin: Mapped[str] = mapped_column(String(32))  # live | history | review | import
+    is_night: Mapped[bool] = mapped_column(Boolean, default=False)
+    face: Mapped[dict] = mapped_column(JSON)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=utcnow)
+
+
+class FaceEmbedding(Base):
+    """A taught face's embedding by one face model (made again when the model changes)."""
+
+    __tablename__ = "face_embedding"
+
+    face_id: Mapped[int] = mapped_column(ForeignKey("face.id", ondelete="CASCADE"), primary_key=True)
+    model: Mapped[str] = mapped_column(String(64), primary_key=True)
+    vector: Mapped[bytes] = mapped_column(LargeBinary)
+
+
 class Setting(Base):
     __tablename__ = "setting"
 
diff --git a/visionstate/backend/visionstate/detectors.json b/visionstate/backend/visionstate/detectors.json
index ba8ad12..86f7577 100644
--- a/visionstate/backend/visionstate/detectors.json
+++ b/visionstate/backend/visionstate/detectors.json
@@ -507,7 +507,10 @@
       "label_set": "coco",
       "license": "Apache-2.0",
       "source": "https://huggingface.co/ustc-community/dfine-small-coco",
-      "bundled": true
+      "bundled": true,
+      "ram_mb": 230,
+      "time_ms": 100,
+      "accuracy": 3
     },
     "dfine-n-coco": {
       "name": "D-FINE N (fast)",
@@ -519,7 +522,40 @@
       "label_set": "coco",
       "license": "Apache-2.0",
       "source": "https://huggingface.co/ustc-community/dfine-nano-coco",
-      "bundled": false
+      "bundled": false,
+      "ram_mb": 100,
+      "time_ms": 40,
+      "accuracy": 2
+    },
+    "dfine-m-coco": {
+      "name": "D-FINE M (accurate)",
+      "description": "Finds more small, far-off and partly hidden objects than D-FINE S, but is about three times as slow. For a fast PC. Downloaded on first use (79 MB).",
+      "url": "https://huggingface.co/onnx-community/dfine_m_coco-ONNX/resolve/489756db2825cb068a588fe930af239a656d1fe1/onnx/model.onnx",
+      "sha256": "70aaa837978a06ba44ad17398c7079ae5a1a7b1a9032b5d7053981e1ada02d6b",
+      "size": 78624257,
+      "input_size": 640,
+      "label_set": "coco",
+      "license": "Apache-2.0",
+      "source": "https://huggingface.co/ustc-community/dfine-medium-coco",
+      "bundled": false,
+      "ram_mb": 300,
+      "time_ms": 290,
+      "accuracy": 4
+    },
+    "dfine-l-coco": {
+      "name": "D-FINE L (most accurate)",
+      "description": "The most accurate, about four times as slow as D-FINE S. For a fast PC. Downloaded on first use (125 MB).",
+      "url": "https://huggingface.co/onnx-community/dfine_l_coco-ONNX/resolve/e09b218185400510b68d067bbd0c9379d905ffcd/onnx/model.onnx",
+      "sha256": "d678f3baebfb909d3a20f21d1d807544d0172ed47fa1ab88e7fcdec7e365b236",
+      "size": 125348332,
+      "input_size": 640,
+      "label_set": "coco",
+      "license": "Apache-2.0",
+      "source": "https://huggingface.co/ustc-community/dfine-large-coco",
+      "bundled": false,
+      "ram_mb": 350,
+      "time_ms": 420,
+      "accuracy": 5
     }
   }
 }
diff --git a/visionstate/backend/visionstate/detectors.py b/visionstate/backend/visionstate/detectors.py
index 15ccadb..695529b 100644
--- a/visionstate/backend/visionstate/detectors.py
+++ b/visionstate/backend/visionstate/detectors.py
@@ -9,13 +9,13 @@
 
 import json
 import threading
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 
 import numpy as np
 from PIL import Image
 
-from .backbones import cpu_session
+from .backbones import Footprint, cpu_session
 from .settings import DETECTION
 
 REGISTRY_FILE = Path(__file__).with_name("detectors.json")
@@ -44,6 +44,7 @@ class DetectorSpec:
     license: str
     source: str
     bundled: bool
+    footprint: Footprint = field(default_factory=lambda: Footprint())
 
     @property
     def filename(self) -> str:
@@ -85,6 +86,7 @@ def load_registry() -> tuple[str, dict[str, DetectorSpec], dict[str, LabelSet]]:
             license=v.get("license", ""),
             source=v.get("source", ""),
             bundled=bool(v.get("bundled", False)),
+            footprint=Footprint.of(v),
         )
         for key, v in raw["detectors"].items()
     }
diff --git a/visionstate/backend/visionstate/engine/__init__.py b/visionstate/backend/visionstate/engine/__init__.py
index c984708..024e46f 100644
--- a/visionstate/backend/visionstate/engine/__init__.py
+++ b/visionstate/backend/visionstate/engine/__init__.py
@@ -7,7 +7,7 @@
 
 from .logic import entity_triggers, filter_detections, next_check_at, review_reason, update_tracks
 from .runtime import Runtime
-from .state import Debouncer, LiveState, ObjectTrack, SensorConfig
+from .state import Debouncer, LiveState, ObjectTrack, SensorConfig, with_people
 
 __all__ = [
     "Debouncer",
@@ -15,6 +15,7 @@
     "ObjectTrack",
     "Runtime",
     "SensorConfig",
+    "with_people",
     "entity_triggers",
     "filter_detections",
     "next_check_at",
diff --git a/visionstate/backend/visionstate/engine/base.py b/visionstate/backend/visionstate/engine/base.py
index f584902..60fc325 100644
--- a/visionstate/backend/visionstate/engine/base.py
+++ b/visionstate/backend/visionstate/engine/base.py
@@ -14,12 +14,12 @@
 
 from sqlalchemy import select
 
-from .. import backbones, classifier, detectors, readers, teach
+from .. import backbones, classifier, detectors, faces, readers, teach
 from ..db import Database, Sensor
 from ..ha_events import HaEventListener
 from ..lights import Lights
 from ..mqtt import MqttBridge
-from ..settings import RUNTIME, Settings, merge_review
+from ..settings import RUNTIME, Settings, merge_review, merge_teach
 from ..sources import FrameGrabber, HomeAssistant
 from ..storage import Storage
 from .state import LiveState, SensorConfig
@@ -44,6 +44,8 @@ def __init__(self, settings: Settings, db: Database):
         self.ha_entity_ids: dict[str, str] = {}
         self._registry_wanted = asyncio.Event()  # discovery was published: read the registry again
         self.global_review: dict = {}  # global review rules (DB setting "review")
+        self.global_teach: dict = {}  # the user's teaching limits for all sensors (DB setting "teach")
+        self.global_faces: dict = {}  # the user's face limits for all sensors (DB setting "faces")
         self.storage_rules: dict = {}  # history limits (DB setting "storage"); see storage_limits()
         self.history_trimmed = False  # frames were removed to stay under the size limit (until limits change)
         self.reminder_rules: dict = {}  # the review reminder (DB setting "reminder"); see reminder_settings()
@@ -61,6 +63,20 @@ def __init__(self, settings: Settings, db: Database):
         self.wheel_reader: readers.WheelReader | None = None  # loaded on first use by a counter
         self.wheel_reader_error = ""
         self._wheel_reader_lock = asyncio.Lock()
+        # Faces (object sensors): the face model, loaded in the background when a sensor turns face
+        # recognition on (engine/faces.py); the chosen recogniser (DB setting "face_model").
+        self.face_model: faces.FaceModel | None = None
+        self.face_choice = faces.DEFAULT_RECOGNISER
+        self.face_error = ""
+        self.face_progress: dict | None = None  # {"done", "total"} bytes while it downloads
+        self._face_lock = asyncio.Lock()
+        self._face_task: asyncio.Task | None = None
+        self.face_index: faces.FaceIndex | None = None  # the people's taught faces; built on use
+        self._face_generation = 0
+        # Where each person is seen (their own entity, sensor.visionstate_<key>): what was last
+        # published, and when and on which sensor they were last seen.
+        self._person_where: dict[str, str] = {}
+        self._person_last: dict[str, tuple[float, int]] = {}
         self.heads: dict[int, classifier.Head] = {}
         self.taught: dict[int, teach.TaughtIndex] = {}  # object sensors; built on use, dropped on change
         self._taught_generation: dict[int, int] = {}  # counts changes to each sensor's taught boxes
@@ -124,3 +140,17 @@ def wake(self, sensor_id: int, force: bool = False, paused_too: bool = False) ->
 
     def review_rules(self, cfg: SensorConfig) -> dict:
         return merge_review(self.global_review, cfg.review)
+
+    @property
+    def backbone_id(self) -> str:
+        """The backbone in use (or chosen, while it loads)."""
+        return self.embedder.spec.id if self.embedder else self.db.get_text("backbone", backbones.DEFAULT_BACKBONE)
+
+    def teach_limits(self, cfg: SensorConfig) -> dict:
+        """An object sensor's teaching limits: the backbone's defaults < global < the sensor's own."""
+        return merge_teach(self.backbone_id, self.global_teach, cfg.objects.get("teach"))
+
+    def face_limits(self, cfg: SensorConfig | None) -> dict[str, float]:
+        """An object sensor's face limits: the face model's defaults < global < the sensor's own
+        (``None``: the global ones)."""
+        return faces.merge_limits(self.face_choice, self.global_faces, cfg.objects.get("faces") if cfg else None)
diff --git a/visionstate/backend/visionstate/engine/checks.py b/visionstate/backend/visionstate/engine/checks.py
index 9e56ea9..b904c85 100644
--- a/visionstate/backend/visionstate/engine/checks.py
+++ b/visionstate/backend/visionstate/engine/checks.py
@@ -134,7 +134,7 @@ def _light_after(self, cfg: SensorConfig) -> None:
         live = self.live_state(cfg.id)
         if not entity or live.light_off_task or not self.lights.held(entity, f"check:{cfg.id}"):
             return
-        wait = max(0.0, live.burst_until - time.time())
+        wait = max(0.0, max(live.burst_until, live.face_burst.until) - time.time())
 
         async def off() -> None:
             await asyncio.sleep(wait)
@@ -248,12 +248,14 @@ async def run_once(
             if live.signature is not None:
                 live.change_score = imaging.change_score(live.signature, signature)
             live.signature = signature
-        live.frame_id = frame_id
         await self._send(cfg, t["availability"], "online", retain=True)
         if cfg.is_objects:
             live.analysed.append((frame_id, data))
-            await self._run_objects(cfg, image)
+            # The frame on screen changes together with its boxes, once they are found (the UI
+            # draws the boxes of live.detections on live.frame_id).
+            await self._run_objects(cfg, image, frame_id)
             return
+        live.frame_id = frame_id
         if cfg.is_reading:
             await self._run_reading(cfg, image, lit)
             return
diff --git a/visionstate/backend/visionstate/engine/faces.py b/visionstate/backend/visionstate/engine/faces.py
new file mode 100644
index 0000000..42e4b7a
--- /dev/null
+++ b/visionstate/backend/visionstate/engine/faces.py
@@ -0,0 +1,502 @@
+"""Recognising people by their face on object sensors (see faces.py and docs/FACE_RECOGNITION_PLAN.md).
+
+The face model is downloaded and loaded in the background when a sensor needs it — a sensor keeps
+working as an object sensor without faces meanwhile — and let go when no sensor uses it.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import threading
+from collections.abc import Sequence
+from datetime import UTC, datetime
+
+import numpy as np
+from PIL import Image
+from sqlalchemy import delete, select
+from sqlalchemy.dialects.sqlite import insert
+
+from .. import backbones, faces, imaging
+from ..db import Face, FaceEmbedding, Person, Sensor
+from ..mqtt import person_topics
+from ..redact import redact
+from ..settings import FACE_UNKNOWN_KEY, FACES, KIND_OBJECTS, PERSON_NOT_SEEN, TEACH, faces_on, merge_objects
+from .base import RuntimeBase
+from .models import ModelsMixin
+from .publishing import PublishingMixin
+from .state import SensorConfig
+
+log = logging.getLogger(__name__)
+
+# The index of taught faces is built one at a time: a check and a request (the People page) could
+# otherwise embed the same face at once and both store it.
+_INDEX_LOCK = threading.Lock()
+
+
+def _iou(a: Sequence[float], b: Sequence[float]) -> float:
+    x1, y1 = max(a[0], b[0]), max(a[1], b[1])
+    x2, y2 = min(a[2], b[2]), min(a[3], b[3])
+    inter = max(0.0, x2 - x1) * max(0.0, y2 - y1)
+    union = (a[2] - a[0]) * (a[3] - a[1]) + (b[2] - b[0]) * (b[3] - b[1]) - inter
+    return inter / union if union > 0 else 0.0
+
+
+def same_box(previous: list[dict], box: Sequence[float]) -> dict | None:
+    """The last check's person box that is this one (it overlaps by TEACH["keep_iou"])."""
+    best = max(
+        (d for d in previous if d.get("key") == "person" or d.get("was") == "person"),
+        key=lambda d: _iou(d["box"], box),
+        default=None,
+    )
+    return best if best is not None and _iou(best["box"], box) >= TEACH["keep_iou"] else None
+
+
+class FacesMixin(ModelsMixin, PublishingMixin, RuntimeBase):
+    # --- The model ------------------------------------------------------------------------------
+
+    def face_status(self) -> dict:
+        """The face model for the UI: chosen, loaded, downloading (bytes), or why it failed."""
+        spec = faces.recogniser_spec(self.face_choice)
+        return {
+            "model": spec.id,
+            "loaded": self.face_model is not None and self.face_model.id == spec.id,
+            "loading": self._face_task is not None and not self._face_task.done(),
+            "progress": self.face_progress,
+            "error": self.face_error,
+            "downloaded": self.face_files_present(spec.id),
+        }
+
+    def face_files_present(self, model_id: str) -> bool:
+        spec = faces.recogniser_spec(model_id)
+        return self.model_path(faces.DETECTOR) is not None and self.model_path(spec) is not None
+
+    def wanted_faces(self) -> faces.FaceModel | None:
+        """The face model when it is loaded; otherwise its loading is started in the background
+        (unless it failed: then only ``retry_faces`` tries again) and None is returned."""
+        model = self.face_model
+        if model is not None and model.id == self.face_choice:
+            return model
+        if self._on_loop(self.wanted_faces):
+            return None  # called from a worker thread: started on the event loop
+        if not self.face_error and (self._face_task is None or self._face_task.done()):
+            self._face_task = self._spawn(self._load_faces())
+        return None
+
+    def retry_faces(self) -> None:
+        self.face_error = ""
+        self.wanted_faces()
+
+    def _set_progress(self, done: int, total: int) -> None:
+        self.face_progress = {"done": done, "total": total}
+
+    async def _load_faces(self) -> None:
+        async with self._face_lock:
+            detector_spec, spec = faces.DETECTOR, faces.recogniser_spec(self.face_choice)
+            try:
+                missing = [s for s in (detector_spec, spec) if self.model_path(s) is None]
+                total, before = sum(s.size for s in missing), 0
+                paths = []
+                for model_spec in (detector_spec, spec):
+                    path = self.model_path(model_spec)
+                    if path is None:
+                        start = before
+                        self._set_progress(start, total)
+                        try:
+                            path = await asyncio.to_thread(
+                                backbones.download,
+                                model_spec,
+                                self.settings.models_dir,
+                                lambda n, start=start: self._set_progress(start + n, total),
+                            )
+                        except Exception as err:
+                            raise RuntimeError(
+                                f"Could not download {model_spec.filename} from {model_spec.url} ({err}). "
+                                f"Without internet, put that file in {self.settings.models_dir} by hand."
+                            ) from err
+                        before += model_spec.size
+                    paths.append(path)
+                model = await asyncio.to_thread(
+                    lambda: faces.FaceModel(
+                        faces.FaceDetector(detector_spec, paths[0]), faces.Recogniser(spec, paths[1])
+                    )
+                )
+            except Exception as err:  # noqa: BLE001 - shown in the UI; the sensors go on without faces
+                self.face_error = redact(str(err)) or type(err).__name__
+                log.exception("Could not load the face model %s", spec.id)
+                return
+            finally:
+                self.face_progress = None
+            replaced, self.face_model, self.face_error = self.face_model, model, ""
+            log.info("Face model %s loaded", spec.id)
+        if replaced is not None:
+            await asyncio.to_thread(backbones.release_memory)
+        sensor_ids = await asyncio.to_thread(self.face_sensor_ids)
+        if not sensor_ids:
+            # Turned off while it loaded (a check in flight asked for it): let it go again.
+            await self.faces_settled()
+            return
+        for sensor_id in sensor_ids:
+            self.wake(sensor_id, force=True)
+
+    def face_sensor_ids(self) -> list[int]:
+        with self.db.session() as s:
+            rows = s.scalars(select(Sensor).where(Sensor.kind == KIND_OBJECTS)).all()
+            return [row.id for row in rows if faces_on(merge_objects(row.objects))]
+
+    async def faces_settled(self) -> None:
+        """A sensor turned faces on or off: load the model when one uses it, let it go when none does."""
+        if await asyncio.to_thread(self.face_sensor_ids):
+            self.wanted_faces()
+            return
+        if self.face_model is not None:
+            self.face_model = None
+            self.face_index = None
+            await asyncio.to_thread(backbones.release_memory)
+            log.info("Face model let go: no sensor recognises faces")
+
+    async def set_face_model(self, model_id: str) -> None:
+        """Choose the recogniser. Taught faces are embedded again with it (their crops are kept)."""
+        await asyncio.to_thread(self.db.set_setting, "face_model", model_id)
+        self.face_choice = model_id
+        self.face_error = ""
+        self.face_index = None
+        if self.face_model is not None or await asyncio.to_thread(self.face_sensor_ids):
+            self.wanted_faces()
+
+    def delete_face_files(self, model_id: str) -> None:
+        """Delete a downloaded face model (only while no sensor uses it); the face detector goes
+        with the last one."""
+        models = self.settings.models_dir
+        (models / faces.RECOGNISERS[model_id].filename).unlink(missing_ok=True)
+        if not any((models / spec.filename).exists() for spec in faces.RECOGNISERS.values()):
+            (models / faces.DETECTOR.filename).unlink(missing_ok=True)
+
+    # --- What was taught (the people, shared by every sensor) -------------------------------------
+
+    async def face_index_for(self, model: faces.FaceModel) -> faces.FaceIndex:
+        index = self.face_index
+        if index is None or index.model != model.id or index.generation != self._face_generation:
+            index = await asyncio.to_thread(self._build_face_index, model, self._face_generation)
+            self.face_index = index
+        return index
+
+    def _build_face_index(self, model: faces.FaceModel, generation: int) -> faces.FaceIndex:
+        with _INDEX_LOCK:
+            return self._build_face_index_locked(model, generation)
+
+    def _build_face_index_locked(self, model: faces.FaceModel, generation: int) -> faces.FaceIndex:
+        cache_key = f"{model.id}/{faces.EMBEDDING_VERSION}"  # cached embeddings of another version are not used
+        with self.db.session() as s:
+            s.execute(delete(FaceEmbedding).where(FaceEmbedding.model == model.id))  # before versions
+            examples = [
+                (face_id, key, filename, dict(face))
+                for face_id, key, filename, face in s.execute(
+                    select(Face.id, Person.key, Face.filename, Face.face)
+                    .join(Person, Face.person_id == Person.id)
+                    .order_by(Face.id)
+                ).all()
+            ]
+            cached = {
+                r.face_id: np.frombuffer(r.vector, dtype=np.float32)
+                for r in s.scalars(
+                    select(FaceEmbedding).where(
+                        FaceEmbedding.face_id.in_([e[0] for e in examples]), FaceEmbedding.model == cache_key
+                    )
+                )
+            }
+        ids, labels, vectors = [], [], []
+        for face_id, key, filename, face in examples:
+            vector = cached.get(face_id)
+            if vector is None:
+                path = self.storage.face_path(filename)
+                if not path.exists():
+                    continue
+                crop = imaging.load(path)
+                aligned = faces.align(crop, faces.face_from_dict(face), model.recogniser.spec.input_size)
+                vector = model.recogniser.embed([aligned])[0]
+                row = {"face_id": face_id, "model": cache_key, "vector": vector.tobytes()}
+                with self.db.session() as s:  # stored once, whoever comes first
+                    s.execute(insert(FaceEmbedding).values(**row).on_conflict_do_nothing())
+            ids.append(face_id)
+            labels.append(key)
+            vectors.append(vector)
+        stacked = np.stack(vectors) if vectors else np.zeros((0, 0), dtype=np.float32)
+        return faces.FaceIndex(model.id, ids, labels, stacked, generation)
+
+    def faces_changed(self) -> None:
+        """Taught faces were added, moved or removed: every sensor that recognises faces compares
+        with the new set from its next check on."""
+        self._face_generation += 1
+        self.face_index = None
+        for sensor_id in self.face_sensor_ids():
+            self.wake(sensor_id, force=True)
+
+    async def people_changed(self) -> None:
+        """A person was added, renamed or forgotten: the entities of every sensor that recognises
+        faces, and each person's own entity, follow."""
+        await asyncio.to_thread(self.faces_changed)
+        for sensor_id in await asyncio.to_thread(self.face_sensor_ids):
+            cfg = await asyncio.to_thread(self.load_sensor, sensor_id)
+            if cfg is not None:
+                await self.publish_discovery(cfg)
+        await self.publish_people()
+
+    # --- Where each person is (sensor.visionstate_<key>) ----------------------------------------
+
+    def _people(self) -> list[tuple[str, str]]:
+        with self.db.session() as s:
+            return [(p.key, p.name) for p in s.scalars(select(Person).order_by(Person.created_at))]
+
+    def person_seen(self, key: str) -> dict:
+        """Where a person is seen now (a sensor's slug, or PERSON_NOT_SEEN), and when and on which
+        sensor they were last seen."""
+        at, sensor_id = self._person_last.get(key, (0.0, 0))
+        return {"now": self._person_where.get(key, PERSON_NOT_SEEN), "at": at or None, "sensor_id": sensor_id or None}
+
+    async def publish_people(self) -> None:
+        """Each person's own entity (again): discovery for the people there are, removed for the
+        ones forgotten, and where each is."""
+        people = await asyncio.to_thread(self._people)
+        keys = {key for key, _ in people}
+        for key in set(self._person_where) - keys:
+            await self.mqtt.remove_person(key)
+            self._person_where.pop(key, None)
+            self._person_last.pop(key, None)
+        await self.mqtt.publish_people_discovery(people)
+        for key, _ in people:
+            await self._publish_person(key, self._person_where.get(key, PERSON_NOT_SEEN), force=True)
+
+    async def person_last_seen_changed(self, key: str) -> None:
+        """A person was taught from a frame (they were there then): their entity's last_seen now."""
+        await self._publish_person(key, self._person_where.get(key, PERSON_NOT_SEEN), force=True)
+
+    async def update_people(self, cfg: SensorConfig) -> None:
+        """After a check of a sensor that recognises faces: where each person is now. A person
+        seen on several sensors is where they were seen last."""
+        live = self.live_state(cfg.id)
+        keys = [c["key"] for c in cfg.custom_labels if c.get("face")]
+        for key in keys:
+            track = live.tracks.get(key)
+            if track is not None and track.on and track.last_seen:
+                last = self._person_last.get(key)
+                if last is None or track.last_seen >= last[0]:
+                    self._person_last[key] = (track.last_seen, cfg.id)
+        for key in keys:
+            where = PERSON_NOT_SEEN
+            _at, sensor_id = self._person_last.get(key, (0.0, 0))
+            track = self.live_state(sensor_id).tracks.get(key) if sensor_id else None
+            if track is not None and track.on:
+                where = cfg.slug if sensor_id == cfg.id else await self._sensor_slug(sensor_id) or PERSON_NOT_SEEN
+            await self._publish_person(key, where)
+
+    async def _sensor_slug(self, sensor_id: int) -> str:
+        cfg = await asyncio.to_thread(self.load_sensor, sensor_id)
+        return cfg.slug if cfg else ""
+
+    async def _publish_person(self, key: str, where: str, force: bool = False) -> None:
+        if not force and self._person_where.get(key) == where:
+            return
+        self._person_where[key] = where
+        t = person_topics(key)
+        at, sensor_id = self._person_last.get(key, (0.0, 0))
+        last = await asyncio.to_thread(self.load_sensor, sensor_id) if sensor_id else None
+        attributes = {
+            "last_seen": datetime.fromtimestamp(at, UTC).isoformat() if at else None,
+            "last_sensor": last.slug if last else None,
+            "last_sensor_name": last.name if last else None,
+        }
+        await self.mqtt.publish(t["state"], where, retain=True)
+        await self.mqtt.publish(t["attributes"], attributes, retain=True)
+        if attributes["last_seen"]:  # never seen: the timestamp sensor stays unknown
+            await self.mqtt.publish(t["last_seen"], attributes["last_seen"], retain=True)
+
+    # --- One check ------------------------------------------------------------------------------
+
+    async def face_in_photo(
+        self, model: faces.FaceModel, image: Image.Image
+    ) -> tuple[faces.Face | None, Image.Image | None]:
+        """The best face in a whole photo (a selfie from a phone), with it aligned."""
+        async with self._sem:
+            [face] = await asyncio.to_thread(model.detector.detect, [image])
+        if face is None:
+            return None, None
+        return face, await asyncio.to_thread(faces.align, image, face, model.recogniser.spec.input_size)
+
+    async def find_faces(
+        self, model: faces.FaceModel, image: Image.Image, boxes: list[Sequence[float]]
+    ) -> list[tuple[faces.Face | None, Image.Image | None]]:
+        """The best face in each person box (normalised), in frame pixels, with it aligned."""
+        regions, offsets = [], []
+        for box in boxes:
+            x1, y1, x2, y2 = faces.head_region(box, image.width, image.height)
+            regions.append(image.crop((x1, y1, max(x2, x1 + 1), max(y2, y1 + 1))))
+            offsets.append((x1, y1))
+        async with self._sem:
+            found = await asyncio.to_thread(model.detector.detect, regions)
+        result: list[tuple[faces.Face | None, Image.Image | None]] = []
+        for face, (dx, dy) in zip(found, offsets, strict=True):
+            if face is None:
+                result.append((None, None))
+                continue
+            moved = face.moved(dx, dy, 1.0)
+            aligned = await asyncio.to_thread(faces.align, image, moved, model.recogniser.spec.input_size)
+            result.append((moved, aligned))
+        return result
+
+    async def apply_faces(
+        self, cfg: SensorConfig, image: Image.Image, found: list[dict], previous: list[dict]
+    ) -> list[dict]:
+        """Look for faces in the person boxes of a check and tell who they are.
+
+        Each searched person box gets ``face`` ({box (normalised), problem, label, similarity,
+        state, sure, unknown, age}); a recognised person becomes the box's own ``label`` (it
+        counts for that person), a maybe ``ask``, and a clearly seen face that matched nobody for
+        FACES["unknown_after"] checks ``label`` = FACE_UNKNOWN_KEY. A box that stays where it was
+        keeps its name while no usable face is seen (and while the face stays close enough).
+        """
+        model = self.wanted_faces()
+        if model is None:
+            return found
+        live = self.live_state(cfg.id)
+        index = await self.face_index_for(model)
+        limits = self.face_limits(cfg)
+        settings = cfg.objects["faces"]
+        result = [dict(d) for d in found]
+        searched: list[int] = []
+        waiting: list[tuple[int, dict]] = []  # person boxes to search, with what they were last check
+        for i, d in enumerate(result):
+            if d["key"] != "person" or d.get("filtered"):
+                continue
+            face_before = (same_box(previous, d["box"]) or {}).get("face") or {}
+            if face_before.get("sure") and face_before.get("age", 0) + 1 < FACES["recheck_every"]:
+                # A sure name: carried over for a few checks without looking again (saves CPU).
+                result[i]["face"] = {**face_before, "age": face_before.get("age", 0) + 1}
+                result[i]["label"] = face_before["label"]
+                continue
+            waiting.append((i, face_before))
+        # At most FACES["max_faces"] per check: new boxes first, then the ones searched longest ago,
+        # so in a crowd every person is looked at in turn.
+        waiting.sort(key=lambda w: (bool(w[1]), -w[1].get("age", 0), -result[w[0]]["score"]))
+        for i, face_before in waiting:
+            if len(searched) < FACES["max_faces"]:
+                searched.append(i)
+            elif face_before:  # not looked at this check: it stays what it was
+                result[i]["face"] = {**face_before, "age": face_before.get("age", 0) + 1}
+                if face_before.get("label") and face_before.get("state") == "match":
+                    result[i]["label"] = face_before["label"]
+                elif face_before.get("unknown", 0) >= FACES["unknown_after"] and not face_before.get("named"):
+                    result[i]["label"] = FACE_UNKNOWN_KEY
+        if not searched:
+            return result
+        seen = await self.find_faces(model, image, [result[i]["box"] for i in searched])
+        live.face_frame = (image.width, image.height)
+        live.face_min_px = limits["min_face_px"]
+        taken: list[tuple[float, float, float, float]] = []  # one face counts for one person box
+        usable: list[tuple[int, faces.Face, Image.Image]] = []
+        for i, (face, aligned) in zip(searched, seen, strict=True):
+            problem = "none"
+            if face is not None and aligned is not None:
+                if any(_iou(face.box, other) > 0.5 for other in taken):
+                    face, problem = None, "none"
+                else:
+                    taken.append(face.box)
+                    min_px = limits["min_face_px"]
+                    problem = faces.problem(face, aligned, min_px, (image.width, image.height)) or ""
+            entry: dict = {"problem": problem or None}
+            if face is not None:
+                w, h = image.width, image.height
+                x1, y1, x2, y2 = face.box
+                entry["box"] = [round(x1 / w, 4), round(y1 / h, 4), round(x2 / w, 4), round(y2 / h, 4)]
+                entry["face_px"] = round(face.width)
+            result[i]["face"] = entry
+            live.face_stats.append(problem or "ok")
+            if not problem and face is not None and aligned is not None:
+                usable.append((i, face, aligned))
+        vectors = np.zeros((0, 0), dtype=np.float32)
+        if usable and index.ids:
+            async with self._sem:
+                vectors = await asyncio.to_thread(model.recogniser.embed, [a for _, _, a in usable])
+        for n, (i, face, _aligned) in enumerate(usable):
+            clear = faces.clearly_seen(face, limits["min_face_px"])
+            self._name_face(result[i], previous, index, vectors[n] if index.ids else None, limits, settings, clear)
+        for i in searched:
+            if result[i]["face"].get("problem"):
+                self._keep_name(result[i], previous)  # no usable face now: keep what the box was
+        return result
+
+    def _name_face(
+        self,
+        det: dict,
+        previous: list[dict],
+        index: faces.FaceIndex,
+        vector: np.ndarray | None,
+        limits: dict[str, float],
+        settings: dict,
+        clear: bool = True,
+    ) -> None:
+        """Who the usable face of a person box is (see apply_faces). ``clear``: seen well enough
+        (faces.clearly_seen) that matching nobody counts towards Unknown person."""
+        face = det["face"]
+        before = same_box(previous, det["box"])
+        face_before = (before or {}).get("face") or {}
+        named_before = face_before.get("label") if face_before.get("state") == "match" else None
+        if vector is None:  # nobody taught yet: a usable face, nothing to compare with
+            identity = faces.Identity(None, 0.0, 0.0, None)
+        else:
+            identity = faces.identify(index, vector)
+        decision = faces.decide(identity, limits, named_before)
+        named = bool(face_before.get("named")) or named_before is not None
+        face.update({"similarity": identity.similarity, "candidate": identity.label, "age": 0, "named": named})
+        if decision == "match" and identity.label is not None:
+            agreed = named_before == identity.label or face_before.get("candidate") == identity.label
+            if identity.similarity >= limits["sure_similarity"] or agreed:
+                sure = identity.similarity >= limits["sure_similarity"]
+                face.update({"label": identity.label, "state": "match", "sure": sure, "named": True})
+                det["label"] = identity.label
+                det["match"] = {"id": identity.example_id, "label": identity.label, "similarity": identity.similarity}
+            else:
+                face["state"] = "pending"  # a second check must agree first
+            return
+        if decision == "ask" and identity.label is not None:
+            face["state"] = "ask"
+            det["ask"] = {
+                "id": identity.example_id,
+                "label": identity.label,
+                "similarity": identity.similarity,
+                "face": True,
+            }
+            return
+        if not clear:  # small or turned: not looking like anyone may only be the angle
+            face.update({"state": "unclear", "unknown": face_before.get("unknown", 0)})
+            if face["unknown"] >= FACES["unknown_after"] and not named and not det.get("label"):
+                det["label"] = FACE_UNKNOWN_KEY  # a stranger seen clearly before stays one
+            return
+        face["state"] = "unknown"
+        if not index.ids:
+            return  # nobody was taught: there is no "unknown" yet
+        face["unknown"] = face_before.get("unknown", 0) + 1
+        if not named and face["unknown"] >= FACES["unknown_after"] and not det.get("label"):
+            det["label"] = FACE_UNKNOWN_KEY
+        if settings["ask_unknown"]:
+            det["ask"] = {"id": None, "label": FACE_UNKNOWN_KEY, "similarity": identity.similarity, "face": True}
+
+    @staticmethod
+    def _keep_name(det: dict, previous: list[dict]) -> None:
+        """A person box without a usable face this check keeps the name it had in the last one."""
+        face_before = (same_box(previous, det["box"]) or {}).get("face") or {}
+        if face_before.get("state") == "match" and face_before.get("label"):
+            det["face"].update(
+                {
+                    "label": face_before["label"],
+                    "state": "match",
+                    "kept": True,
+                    "named": True,
+                    "similarity": face_before.get("similarity"),
+                }
+            )
+            det["label"] = face_before["label"]
+        elif face_before.get("unknown"):
+            det["face"].update({"unknown": face_before["unknown"], "named": bool(face_before.get("named"))})
+            if face_before["unknown"] >= FACES["unknown_after"] and not face_before.get("named"):
+                det["label"] = det.get("label") or FACE_UNKNOWN_KEY
diff --git a/visionstate/backend/visionstate/engine/logic.py b/visionstate/backend/visionstate/engine/logic.py
index 504593f..943de7b 100644
--- a/visionstate/backend/visionstate/engine/logic.py
+++ b/visionstate/backend/visionstate/engine/logic.py
@@ -6,8 +6,8 @@
 import math
 
 from .. import detectors, imaging, readers, teach
-from ..settings import DETECTION
-from .state import LiveState, ObjectTrack, SensorConfig
+from ..settings import DETECTION, FACES
+from .state import FaceBurst, LiveState, ObjectTrack, SensorConfig
 
 
 def review_reason(
@@ -152,9 +152,9 @@ def next_check_at(cfg: SensorConfig, live: LiveState, now: float) -> tuple[float
     """When the sensor loop should wake up next, and whether that is a full check or a cheap probe."""
     if live.last_run is None:
         return now, "full"
-    in_burst = now < live.burst_until
-    if in_burst:
-        full_at = live.last_run + cfg.triggers["burst_interval_s"]
+    pace = burst_pace(cfg, live, now)
+    if pace is not None:
+        full_at = live.last_run + pace
     elif cfg.triggers["regular"]:
         # Counted from the last check, whatever caused it: frequent triggers postpone it.
         full_at = live.last_run + cfg.interval_s
@@ -169,6 +169,51 @@ def next_check_at(cfg: SensorConfig, live: LiveState, now: float) -> tuple[float
     return full_at, "full"
 
 
+def burst_pace(cfg: SensorConfig, live: LiveState, now: float) -> float | None:
+    """Seconds between checks while a burst runs (a trigger's, or looking for a face), or None."""
+    paces = [cfg.triggers["burst_interval_s"]] if now < live.burst_until else []
+    if now < live.face_burst.until:
+        paces.append(FACES["burst_interval_s"])
+    return min(paces) if paces else None
+
+
+def steer_face_burst(burst: FaceBurst, found: list[dict], now: float) -> str | None:
+    """After a check of a sensor that recognises faces: start or end looking for a face more
+    often while a person is there (FACES["burst_*"]). Returns "start" or "stop" when that changes."""
+    people = [d for d in found if d["key"] == "person" and not d.get("filtered")]
+    if not people:
+        burst.absent += 1
+        if burst.absent >= FACES["burst_absent_checks"]:
+            burst.spent = False  # gone: the next visit gets a burst of its own
+            return _end_face_burst(burst, spent=False)
+        return None
+    burst.absent = 0
+    unnamed = [d for d in people if (d.get("face") or {}).get("state") != "match"]
+    height = max(d["box"][3] - d["box"][1] for d in people)
+    width = max(float((d.get("face") or {}).get("face_px") or 0) for d in people)
+    if burst.until == 0.0:
+        if burst.spent or not unnamed:
+            return None
+        burst.until, burst.idle, burst.best_height, burst.best_face = now + FACES["burst_max_s"], 0, height, width
+        return "start"
+    if not unnamed or now >= burst.until:
+        return _end_face_burst(burst, spent=True)  # everyone named, or the time is up
+    usable = any((d.get("face") or {}).get("box") and not (d.get("face") or {}).get("problem") for d in unnamed)
+    closer = height > burst.best_height * FACES["burst_progress"] or width > burst.best_face * FACES["burst_progress"]
+    burst.idle = 0 if usable or closer else burst.idle + 1
+    burst.best_height, burst.best_face = max(burst.best_height, height), max(burst.best_face, width)
+    if burst.idle >= FACES["burst_idle_checks"]:
+        return _end_face_burst(burst, spent=True)  # standing turned away, or no face to be had
+    return None
+
+
+def _end_face_burst(burst: FaceBurst, spent: bool) -> str | None:
+    running = burst.until > 0.0
+    burst.until, burst.idle = 0.0, 0
+    burst.spent = burst.spent or spent
+    return "stop" if running else None
+
+
 def reading_verdict(
     text: readers.Text, value: float | None, last: float | None, threshold: float, settings: dict
 ) -> tuple[str | None, bool]:
diff --git a/visionstate/backend/visionstate/engine/models.py b/visionstate/backend/visionstate/engine/models.py
index d036fe3..31e27b6 100644
--- a/visionstate/backend/visionstate/engine/models.py
+++ b/visionstate/backend/visionstate/engine/models.py
@@ -23,6 +23,10 @@ class ModelsMixin(TrainingMixin, RuntimeBase):
     def model_path(self, spec: backbones.ModelFile) -> Path | None:
         return backbones.locate(spec, [self.settings.bundled_models_dir, self.settings.models_dir])
 
+    def downloaded(self, spec: backbones.ModelFile) -> bool:
+        """Whether a model was downloaded (and can be deleted again), not included in the app."""
+        return (self.settings.models_dir / spec.filename).exists()
+
     async def load_embedder(self, backbone_id: str) -> None:
         spec = backbones.BACKBONES.get(backbone_id) or backbones.BACKBONES[backbones.DEFAULT_BACKBONE]
         path = self.model_path(spec)
@@ -34,6 +38,7 @@ async def load_embedder(self, backbone_id: str) -> None:
 
     async def set_backbone(self, backbone_id: str) -> None:
         await self.load_embedder(backbone_id)
+        await asyncio.to_thread(backbones.release_memory)
         self.db.set_setting("backbone", backbone_id)
         for sensor_id in await asyncio.to_thread(self._sensor_ids, KIND_STATES):
             self.schedule_retrain(sensor_id, delay=0)
@@ -70,6 +75,7 @@ async def set_detector(self, detector_id: str) -> None:
         if self.detector is not None or object_sensors:
             async with self._detector_lock:
                 await self.load_detector(detector_id)
+            await asyncio.to_thread(backbones.release_memory)
         await asyncio.to_thread(self.db.set_setting, "detector", detector_id)
         for sensor_id in object_sensors:
             self.wake(sensor_id, force=True)
@@ -102,6 +108,7 @@ async def set_reader(self, reader_id: str) -> None:
         if self.reader is not None or reading_sensors:
             async with self._reader_lock:
                 await self.load_reader(reader_id)
+            await asyncio.to_thread(backbones.release_memory)
         await asyncio.to_thread(self.db.set_setting, "reader", reader_id)
         for sensor_id in reading_sensors:
             self.wake(sensor_id, force=True)
diff --git a/visionstate/backend/visionstate/engine/objects.py b/visionstate/backend/visionstate/engine/objects.py
index 37d0915..1c343ac 100644
--- a/visionstate/backend/visionstate/engine/objects.py
+++ b/visionstate/backend/visionstate/engine/objects.py
@@ -8,36 +8,39 @@
 from datetime import UTC, datetime
 
 from PIL import Image
-from sqlalchemy import select
+from sqlalchemy import func, select
 
 from .. import detectors, imaging, teach
-from ..db import Prediction
+from ..db import Person, Prediction, Sensor
 from ..mqtt import object_topics, topics
 from ..redact import redact
-from ..settings import DETECTION, TEACH
+from ..settings import DETECTION, FACE_UNKNOWN_KEY, FACES, KIND_OBJECTS, TEACH
 from .base import RuntimeBase
-from .logic import update_tracks
+from .faces import FacesMixin
+from .logic import steer_face_burst, update_tracks
 from .publishing import PublishingMixin
-from .state import SensorConfig
+from .state import ObjectTrack, SensorConfig
 from .teaching import TeachingMixin
 
 log = logging.getLogger(__name__)
 OBJECT_BOX_COLOR = "#7ee2b8"  # boxes drawn on the Home Assistant image of an object sensor
 
 
-class ObjectChecksMixin(TeachingMixin, PublishingMixin, RuntimeBase):
-    async def _run_objects(self, cfg: SensorConfig, image: Image.Image) -> None:
-        """One check of an object sensor: detect, compare with what was taught, update and publish."""
+class ObjectChecksMixin(FacesMixin, TeachingMixin, PublishingMixin, RuntimeBase):
+    async def _run_objects(self, cfg: SensorConfig, image: Image.Image, frame_id: str | None) -> None:
+        """One check of an object sensor: detect, compare with what was taught, update and publish.
+        ``frame_id`` (the frame analysed) is announced together with what was found in it."""
         live = self.live_state(cfg.id)
         classes = cfg.objects["classes"]
         index = await self.taught_index(cfg)
         rescue = bool(index and index.rescue)
         # Once a box the detector missed was taught, its unsure boxes are looked at too.
-        floor = min(cfg.threshold, TEACH["rescue_floor"]) if rescue else cfg.threshold
+        floor = min(cfg.threshold, self.teach_limits(cfg)["rescue_floor"]) if rescue else cfg.threshold
         try:
             found = await self.detect_objects(image, cfg.roi, cfg.objects, floor, all_classes=rescue)
         except Exception as err:  # noqa: BLE001 - detector missing or failed to load
             live.error = f"Object detector unavailable: {redact(str(err))}"
+            live.frame_id, live.detections = frame_id, []
             return
         candidates: list[dict] = []
         if rescue:
@@ -45,9 +48,11 @@ async def _run_objects(self, cfg: SensorConfig, image: Image.Image) -> None:
             found = [d for d in found if d["score"] >= cfg.threshold and d["key"] in classes]
         if index is not None:
             found = await self.apply_taught(cfg, image, index, found, candidates, live.detections)
+        if cfg.faces_on:
+            found = await self.apply_faces(cfg, image, found, live.detections)
         counted = [d for d in found if not d.get("filtered")]
         now = time.time()
-        live.detections = found
+        live.frame_id, live.detections = frame_id, found  # together: the boxes belong to that frame
         best = max(counted, key=lambda d: d["score"], default=None)
         live.top, live.confidence = (best.get("label") or best["key"], best["score"]) if best else (None, 0.0)
         keys = cfg.object_keys
@@ -56,6 +61,10 @@ async def _run_objects(self, cfg: SensorConfig, image: Image.Image) -> None:
         # Something that was there is missing: look again soon instead of at the next interval.
         missing = any(t.on and 0 < t.misses < DETECTION["clear_misses"] for t in live.tracks.values())
         live.recheck_at = now + DETECTION["recheck_s"] if missing else 0.0
+        if cfg.faces_on:
+            await self.update_people(cfg)  # each person's own entity: where they are seen
+            if steer_face_burst(live.face_burst, found, now) == "start":
+                live.last_trigger = {"source": "person", "detail": "looking for a face", "at": now}
 
         for key in keys:
             track = live.tracks[key]
@@ -73,6 +82,7 @@ async def _run_objects(self, cfg: SensorConfig, image: Image.Image) -> None:
             await self._send(cfg, ot["attributes"], attributes, retain=True)
         names = {key: label.name for key, label in detectors.LABELS.by_key.items()}
         names.update({c["key"]: c["name"] for c in cfg.custom_labels})
+        names[FACE_UNKNOWN_KEY] = "Unknown person"
         drawn = [{**d, "key": d.get("label") or d["key"]} for d in counted]
         annotated = await asyncio.to_thread(
             lambda: imaging.crop_box(
@@ -86,12 +96,82 @@ async def _run_objects(self, cfg: SensorConfig, image: Image.Image) -> None:
             published = "on" if track.on else "off"
             await asyncio.to_thread(self._record_detection, cfg.id, image, key, published, track.score, found)
         await self._record_filtered(cfg, image, found, now)
+        if cfg.faces_on:
+            await self._record_face(cfg, image, found, now)
         await self._ask_unsure(cfg, image, found, now)
 
+    async def _record_face(self, cfg: SensorConfig, image: Image.Image, found: list[dict], now: float) -> None:
+        """Keep a frame in the history when a usable face nobody is named for is seen, so the user
+        can name them there later: at most one per FACES["record_cooldown_s"], unless the face came
+        FACES["record_closer"] times closer since (the best look at someone at a doorbell)."""
+        live = self.live_state(cfg.id)
+        unnamed = [
+            d
+            for d in found
+            if (face := d.get("face"))
+            and face.get("problem") is None
+            and face.get("box")
+            and face.get("state") != "match"
+        ]
+        if not unnamed:
+            return
+        best = max(unnamed, key=lambda d: d["face"].get("face_px", 0))
+        width = float(best["face"].get("face_px", 0))
+        at, logged_width = live.face_logged
+        if now - at < FACES["record_cooldown_s"] and width < logged_width * FACES["record_closer"]:
+            return
+        live.face_logged = (now, width)
+        key = best.get("label") or best["key"]
+        await asyncio.to_thread(self._record_detection, cfg.id, image, key, "face", best["score"], found)
+
+    def restore_last_seen(self) -> None:
+        """At start: when each object, own label and person was last seen, from the history (the
+        live state starts empty, so every sensor said "not seen yet" after an update or restart).
+        An "off" row is written clear_after_s after the object was last there; a box taught from a
+        history frame counts at that frame's time. Only what the history still keeps is known."""
+        with self.db.session() as s:
+            objects = select(Sensor.id).where(Sensor.kind == KIND_OBJECTS)
+            events = s.execute(
+                select(
+                    Prediction.sensor_id,
+                    Prediction.state_key,
+                    Prediction.published_key,
+                    func.max(Prediction.created_at),
+                )
+                .where(Prediction.sensor_id.in_(objects), Prediction.published_key.in_(("on", "off")))
+                .group_by(Prediction.sensor_id, Prediction.state_key, Prediction.published_key)
+            ).all()
+            taught_rows = s.execute(
+                select(Prediction.sensor_id, Prediction.created_at, Prediction.detections).where(
+                    Prediction.sensor_id.in_(objects), Prediction.published_key.in_(("face", "ask"))
+                )
+            ).all()
+            people = set(s.scalars(select(Person.key)))
+        clear_after: dict[int, float] = {}
+        for sensor_id, key, event, created in events:
+            if sensor_id not in clear_after:
+                cfg = self.load_sensor(sensor_id)
+                clear_after[sensor_id] = float(cfg.objects["clear_after_s"]) if cfg and cfg.objects else 0.0
+            at = _timestamp(created) - (clear_after[sensor_id] if event == "off" else 0.0)
+            self.seen_earlier(sensor_id, key, at, key in people)
+        for sensor_id, created, detections in taught_rows:
+            for d in detections or []:
+                if d.get("taught") and d.get("label"):
+                    self.seen_earlier(sensor_id, d["label"], _timestamp(created), d["label"] in people)
+
+    def seen_earlier(self, sensor_id: int, key: str, at: float, person: bool = False) -> None:
+        """``key`` (an own label, or a ``person``) was taught from a frame taken at ``at``: it counts
+        as last seen then, unless a check saw it later. Nothing is switched on: that frame is the past."""
+        track = self.live_state(sensor_id).tracks.setdefault(key, ObjectTrack())
+        track.last_seen = max(track.last_seen, at)
+        last = self._person_last.get(key)
+        if person and (last is None or at > last[0]):
+            self._person_last[key] = (at, sensor_id)  # the People page's "last seen"
+
     async def _ask_unsure(self, cfg: SensorConfig, image: Image.Image, found: list[dict], now: float) -> None:
         """Put a box that may be an own label, but not clearly, in the review queue ("Is this Our
-        car?"); the answer is taught. One question per label at a time, at most one per review
-        cooldown, and none while the review rules are off."""
+        car?"); the answer is taught. One question per label per review cooldown (about a face: up
+        to FACES["ask_burst"], FACES["ask_gap_s"] apart), and none while the review rules are off."""
         live = self.live_state(cfg.id)
         rules = self.review_rules(cfg)
         unsure = [d for d in found if d.get("ask") and not d.get("filtered")]
@@ -99,30 +179,38 @@ async def _ask_unsure(self, cfg: SensorConfig, image: Image.Image, found: list[d
             return
         asked = False
         for label in sorted({d["ask"]["label"] for d in unsure}):
-            if now - live.asked.get(label, 0.0) < rules["cooldown_s"]:
-                continue
             box = max((d for d in unsure if d["ask"]["label"] == label), key=lambda d: d["ask"]["similarity"])
-            live.asked[label] = now
-            asked = await asyncio.to_thread(self._record_question, cfg.id, image, box, found) or asked
+            burst = FACES["ask_burst"] if box["ask"].get("face") else 1
+            times = [t for t in live.asked.get(label, []) if now - t < rules["cooldown_s"]]
+            if len(times) >= burst or (times and now - times[-1] < FACES["ask_gap_s"]):
+                live.asked[label] = times
+                continue
+            recorded = await asyncio.to_thread(self._record_question, cfg.id, image, box, found, burst)
+            live.asked[label] = [*times, now] if recorded else times
+            asked = asked or recorded
         if asked:
             await self.publish_review_count()
 
-    def _record_question(self, sensor_id: int, image: Image.Image, box: dict, found: list[dict]) -> bool:
-        """A history row waiting for review: may ``box`` be its own label? False: one is waiting already."""
+    def _record_question(self, sensor_id: int, image: Image.Image, box: dict, found: list[dict], most: int = 1) -> bool:
+        """A history row waiting for review: may ``box`` be its own label? False: ``most`` about
+        that label are waiting already."""
         label = box["ask"]["label"]
         with self.db.session() as s:
             waiting = s.scalar(
-                select(Prediction.id).where(
+                select(func.count(Prediction.id)).where(
                     Prediction.sensor_id == sensor_id,
                     Prediction.published_key == "ask",
                     Prediction.state_key == label,
                     Prediction.reviewed.is_(False),
                 )
             )
-        if waiting is not None:
+        if (waiting or 0) >= most:
             return False
         frame = self.storage.save_history(sensor_id, image)
         question = {"label": label, "similarity": box["ask"]["similarity"], "box": box["box"], "detected": box["key"]}
+        if box["ask"].get("face") and (box.get("face") or {}).get("box"):
+            question["face"] = box["face"]["box"]  # "Is this Kari?" / "Who is this?" about a face
+            question["example"] = box["ask"].get("id")  # the closest taught face, to compare with
         with self.db.session() as s:
             s.add(
                 Prediction(
@@ -155,7 +243,8 @@ async def _record_filtered(self, cfg: SensorConfig, image: Image.Image, found: l
     def _record_detection(
         self, sensor_id: int, image: Image.Image, key: str, published: str, score: float, found: list[dict]
     ) -> None:
-        """A history row of an object sensor: a class or own label went "on" or "off", or was "filtered"."""
+        """A history row of an object sensor: a class or own label went "on" or "off", was
+        "filtered", or a face nobody is named for was seen ("face")."""
         frame = self.storage.save_history(sensor_id, image)
         with self.db.session() as s:
             s.add(
@@ -166,8 +255,13 @@ def _record_detection(
                     confidence=score,
                     probs={},
                     frame=frame,
-                    is_change=True,
+                    is_change=published != "face",  # a face seen is not a change of what is there
                     reviewed=True,  # nothing to review: the detector is not trained here
                     detections=found,
                 )
             )
+
+
+def _timestamp(value: datetime) -> float:
+    """A stored time as a Unix timestamp (SQLite keeps it without its zone: UTC)."""
+    return (value if value.tzinfo else value.replace(tzinfo=UTC)).timestamp()
diff --git a/visionstate/backend/visionstate/engine/runtime.py b/visionstate/backend/visionstate/engine/runtime.py
index 5dd3bbc..f82091a 100644
--- a/visionstate/backend/visionstate/engine/runtime.py
+++ b/visionstate/backend/visionstate/engine/runtime.py
@@ -8,7 +8,7 @@
 
 from sqlalchemy import select
 
-from .. import backbones, detectors, readers
+from .. import backbones, detectors, faces, readers
 from ..db import Database, Sensor
 from ..ha_events import HaEventListener, fetch_entity_ids
 from ..mqtt import MqttBridge, SensorDescriptor
@@ -31,7 +31,7 @@ class Runtime(ChecksMixin, HistoryMixin, RemindersMixin):
 
     def __init__(self, settings: Settings, db: Database):
         super().__init__(settings, db)
-        self.mqtt = MqttBridge(settings, self._on_command, self._on_mqtt_connect)
+        self.mqtt = MqttBridge(settings, self._on_command, self._on_connect)
         self.ha_events = HaEventListener(settings, self._on_ha_state)
 
     async def start(self) -> None:
@@ -39,6 +39,8 @@ async def start(self) -> None:
         MQTT, the Home Assistant event stream and the housekeeping loops."""
         self._loop = asyncio.get_running_loop()
         self.global_review = await asyncio.to_thread(self.db.get_dict, "review")
+        self.global_teach = await asyncio.to_thread(self.db.get_dict, "teach")
+        self.global_faces = await asyncio.to_thread(self.db.get_dict, "faces")
         self.storage_rules = await asyncio.to_thread(self.db.get_dict, "storage")
         self.reminder_rules = await asyncio.to_thread(self.db.get_dict, "reminder")
         self.reminder_sent_at = await asyncio.to_thread(self.db.get_setting, "reminder_sent_at")
@@ -46,6 +48,9 @@ async def start(self) -> None:
         await asyncio.to_thread(self._pin_setting, "backbone", backbones.DEFAULT_BACKBONE)
         await asyncio.to_thread(self._pin_setting, "detector", detectors.DEFAULT_DETECTOR)
         await asyncio.to_thread(self._pin_setting, "reader", readers.DEFAULT_READER)
+        self.face_choice = await asyncio.to_thread(self.db.get_text, "face_model", faces.DEFAULT_RECOGNISER)
+        if self.face_choice not in faces.RECOGNISERS:
+            self.face_choice = faces.DEFAULT_RECOGNISER
         backbone_id = self.db.get_text("backbone", backbones.DEFAULT_BACKBONE)
         try:
             await self.load_embedder(backbone_id)
@@ -56,8 +61,10 @@ async def start(self) -> None:
             if self.heads_load(sensor_id):
                 log.info("Sensor %s: model from another version, retraining from stored images", sensor_id)
                 self.schedule_retrain(sensor_id, delay=0)
+        await asyncio.to_thread(self.restore_last_seen)  # "last seen" survives an update or restart
         for sensor_id in await asyncio.to_thread(self._sensor_ids):
             self._start_loop(sensor_id)
+        await self.faces_settled()  # sensors that recognise faces: load the face model in the background
         await self.refresh_trigger_entities()
         self.ha_events.start()
         self.mqtt.start()
@@ -67,6 +74,11 @@ async def start(self) -> None:
         if self.ha_events.enabled:
             self._spawn(self._entity_registry_loop())
 
+    async def _on_connect(self) -> None:
+        """MQTT (re)connected: every sensor's entities, then each person's own entity."""
+        await self._on_mqtt_connect()
+        await self.publish_people()
+
     async def stop(self) -> None:
         for handle in self._retrain_handles.values():
             handle.cancel()
@@ -109,6 +121,8 @@ async def sensor_created(self, sensor_id: int) -> None:
             await self.publish_discovery(cfg)
         self._start_loop(sensor_id)
         await self.refresh_trigger_entities()
+        if cfg and cfg.is_objects:
+            await self.faces_settled()  # made with face recognition on (the wizard)
 
     async def sensor_updated(self, sensor_id: int, retrain: bool) -> None:
         cfg = await asyncio.to_thread(self.load_sensor, sensor_id)
@@ -120,6 +134,8 @@ async def sensor_updated(self, sensor_id: int, retrain: bool) -> None:
         self.taught.pop(sensor_id, None)  # own labels or classes may have changed
         self.live_state(sensor_id).signature = None  # the region may have moved
         await self.refresh_trigger_entities()
+        if cfg.is_objects:
+            await self.faces_settled()
         self.wake(sensor_id)
 
     async def sensor_deleted(self, sensor_id: int, descriptor: SensorDescriptor) -> None:
@@ -131,6 +147,7 @@ async def sensor_deleted(self, sensor_id: int, descriptor: SensorDescriptor) ->
         self.live.pop(sensor_id, None)
         self.heads.pop(sensor_id, None)
         self.taught.pop(sensor_id, None)
+        self._person_last = {k: v for k, v in self._person_last.items() if v[1] != sensor_id}
         self._published_classes.pop(sensor_id, None)
         (self.settings.heads_dir / f"{sensor_id}.joblib").unlink(missing_ok=True)
         await self.mqtt.remove_discovery(descriptor)
@@ -139,13 +156,26 @@ async def sensor_deleted(self, sensor_id: int, descriptor: SensorDescriptor) ->
         await self.refresh_trigger_entities()
         if descriptor.kind == KIND_OBJECTS and not await asyncio.to_thread(self._sensor_ids, KIND_OBJECTS):
             self.detector = None  # the last object sensor is gone: free the memory
+        if descriptor.kind == KIND_OBJECTS:
+            await self.faces_settled()
         if descriptor.kind == KIND_READING and not await asyncio.to_thread(self._sensor_ids, KIND_READING):
             self.reader = None
+        await asyncio.to_thread(backbones.release_memory)
 
     def set_global_review(self, rules: dict) -> None:
         self.global_review = dict(rules)
         self.db.set_setting("review", self.global_review)
 
+    def set_global_teach(self, limits: dict) -> None:
+        """The user's teaching limits for all sensors; only the ones set (not None) are kept."""
+        self.global_teach = {k: v for k, v in limits.items() if v is not None}
+        self.db.set_setting("teach", self.global_teach)
+
+    def set_global_faces(self, limits: dict) -> None:
+        """The user's face limits for all sensors; only the ones set (not None) are kept."""
+        self.global_faces = {k: v for k, v in limits.items() if v is not None}
+        self.db.set_setting("faces", self.global_faces)
+
     def _trigger_index(self) -> dict[str, set[int]]:
         index: dict[str, set[int]] = {}
         with self.db.session() as s:
diff --git a/visionstate/backend/visionstate/engine/state.py b/visionstate/backend/visionstate/engine/state.py
index c030ad3..94dc0ed 100644
--- a/visionstate/backend/visionstate/engine/state.py
+++ b/visionstate/backend/visionstate/engine/state.py
@@ -8,17 +8,22 @@
 from dataclasses import dataclass, field
 
 import numpy as np
+from sqlalchemy import select
+from sqlalchemy.orm import Session, object_session
 
 from .. import detectors
-from ..db import Sensor
+from ..db import Person, Sensor
 from ..mqtt import SensorDescriptor
 from ..settings import (
+    FACE_UNKNOWN_KEY,
+    FACES,
     KIND_OBJECTS,
     KIND_READING,
     KIND_STATES,
     RUNTIME,
     TEACH,
     active_custom,
+    faces_on,
     merge_objects,
     merge_reading,
     merge_triggers,
@@ -70,10 +75,17 @@ def parents(self) -> dict[str, str]:
         """Own label -> the class it is a kind of."""
         return {label["key"]: label["parent"] for label in self.custom_labels}
 
+    @property
+    def faces_on(self) -> bool:
+        """An object sensor that recognises people by their face."""
+        return self.is_objects and faces_on(self.objects)
+
     @property
     def object_keys(self) -> list[str]:
-        """What an object sensor reports: its classes, then its own labels."""
-        return [*self.objects["classes"], *(label["key"] for label in self.custom_labels)]
+        """What an object sensor reports: its classes, then its own labels (and, recognising
+        faces, the unknown person)."""
+        unknown = [FACE_UNKNOWN_KEY] if self.faces_on else []
+        return [*self.objects["classes"], *(label["key"] for label in self.custom_labels), *unknown]
 
     @property
     def descriptor(self) -> SensorDescriptor:
@@ -81,6 +93,7 @@ def descriptor(self) -> SensorDescriptor:
         objects = (
             [(k, names[k].name, names[k].icon) for k in self.objects["classes"] if k in names]
             + [(c["key"], c["name"], names[c["parent"]].icon) for c in self.custom_labels if c["parent"] in names]
+            + ([(FACE_UNKNOWN_KEY, "Unknown person", "mdi:account-question")] if self.faces_on else [])
             if self.is_objects
             else []
         )
@@ -105,13 +118,26 @@ def from_row(cls, row: Sensor) -> SensorConfig:
             triggers=merge_triggers(row.triggers),
             review=dict(row.review or {}),
             kind=row.kind or KIND_STATES,
-            objects=merge_objects(row.objects),
+            objects=with_people(merge_objects(row.objects), object_session(row)),
             reading=merge_reading(row.reading),
             entity_prefix=bool(row.entity_prefix),
             publish=bool(row.publish),
         )
 
 
+def with_people(objects: dict, session: Session | None) -> dict:
+    """An object sensor's settings with the people (shared by every sensor, db.Person) among its
+    own labels while it recognises faces: {key, name, parent "person", face True}. Each one is an
+    entity of the sensor and a name its faces can get."""
+    if session is None or not faces_on(objects):
+        return objects
+    people = [
+        {"key": p.key, "name": p.name, "parent": "person", "face": True}
+        for p in session.scalars(select(Person).order_by(Person.created_at))
+    ]
+    return {**objects, "custom": [*(c for c in objects["custom"] if not c.get("face")), *people]}
+
+
 class Debouncer:
     """Only changes the published value after ``required`` consecutive equal results."""
 
@@ -144,6 +170,18 @@ class ObjectTrack:
     score: float = 0.0  # best confidence in the last check
 
 
+@dataclass
+class FaceBurst:
+    """Checks every FACES["burst_interval_s"] while a person nobody is named for is there (logic.steer_face_burst)."""
+
+    until: float = 0.0  # running until then (at most); 0: not running
+    idle: int = 0  # checks in a row without a usable face or the person coming closer
+    absent: int = 0  # checks in a row without a person
+    best_height: float = 0.0  # the tallest person box (share of the frame) of this burst
+    best_face: float = 0.0  # the widest face (pixels) of this burst
+    spent: bool = False  # this visit had its burst: none again until the person has gone
+
+
 @dataclass
 class LiveState:
     frames: deque = field(default_factory=lambda: deque(maxlen=RUNTIME["frame_cache_size"]))
@@ -160,6 +198,7 @@ class LiveState:
     force: bool = False
     force_paused: bool = False  # the forced check was asked for by the user: also when paused
     burst_until: float = 0.0
+    face_burst: FaceBurst = field(default_factory=FaceBurst)
     last_probe: float = 0.0
     signature: np.ndarray | None = None  # region thumbnail of the last classified frame
     change_score: float | None = None  # last measured difference, shown in the UI for tuning
@@ -176,7 +215,15 @@ class LiveState:
     filtered_keys: set[str] = field(default_factory=set)
     filtered_logged: dict[str, float] = field(default_factory=dict)
     recheck_at: float = 0.0  # an object that was there went missing: check again then (0: no)
-    asked: dict[str, float] = field(default_factory=dict)  # own label -> when the review last asked
+    asked: dict[str, list[float]] = field(
+        default_factory=dict
+    )  # own label/person -> when the review asked (this cooldown)
+    # Faces: what the face search gave for the last person boxes it looked at ("ok" or the
+    # problem: "none", "cut", "small", "turned", "blurry", "unsure"), for "a usable face in 9 of 40".
+    face_stats: deque = field(default_factory=lambda: deque(maxlen=FACES["stats_window"]))
+    face_frame: tuple[int, int] | None = None  # the size of the last frame looked at for faces
+    face_min_px: float | None = None  # the smallest face (its width) it was looked at with
+    face_logged: tuple[float, float] = (0.0, 0.0)  # when a face nobody is named for was last kept, and its width
     # Reading sensors: the last read {"text", "score", "value", "reason", "at"} and the image
     # the reader saw (JPEG), shown in the UI so a bad region or display setting is easy to spot.
     reading: dict | None = None
diff --git a/visionstate/backend/visionstate/engine/teaching.py b/visionstate/backend/visionstate/engine/teaching.py
index 64e6f04..b1c21dc 100644
--- a/visionstate/backend/visionstate/engine/teaching.py
+++ b/visionstate/backend/visionstate/engine/teaching.py
@@ -107,7 +107,16 @@ async def apply_taught(
             vectors = await asyncio.to_thread(teach.embed, embedder, crops)
         n = len(checked)
         return teach.apply(
-            found, checked, vectors[:n], rescue, vectors[n:], index, cfg.objects["classes"], cfg.parents, previous
+            found,
+            checked,
+            vectors[:n],
+            rescue,
+            vectors[n:],
+            index,
+            cfg.objects["classes"],
+            cfg.parents,
+            previous,
+            self.teach_limits(cfg),
         )
 
     def taught_changed(self, sensor_id: int) -> None:
diff --git a/visionstate/backend/visionstate/faces.json b/visionstate/backend/visionstate/faces.json
new file mode 100644
index 0000000..638ded2
--- /dev/null
+++ b/visionstate/backend/visionstate/faces.json
@@ -0,0 +1,62 @@
+{
+  "detector": "yunet-2023mar",
+  "detectors": {
+    "yunet-2023mar": {
+      "name": "YuNet (OpenCV Zoo)",
+      "description": "Finds faces and five points on them (eyes, nose, mouth corners) in the upper part of a person box.",
+      "url": "https://huggingface.co/opencv/face_detection_yunet/resolve/3cc26e7f1014a5ee5d74a42acee58bafc9d0a310/face_detection_yunet_2023mar.onnx",
+      "sha256": "8f2383e4dd3cfbb4553ea8718107fc0423210dc964f9f4280604804ed2552fa4",
+      "size": 232589,
+      "input_size": 640,
+      "license": "MIT",
+      "data": "Trained on WIDER FACE, a research data set (non-commercial terms).",
+      "source": "https://huggingface.co/opencv/face_detection_yunet",
+      "bundled": false
+    }
+  },
+  "default": "sface-2021dec",
+  "recognisers": {
+    "sface-2021dec": {
+      "name": "SFace (fast)",
+      "description": "Small and fast; made to work with YuNet. Recommended, also on a Raspberry Pi.",
+      "url": "https://huggingface.co/opencv/face_recognition_sface/resolve/3d7082438a6e4551e840c9b2bb60b71e8da4b524/face_recognition_sface_2021dec.onnx",
+      "sha256": "0ba9fbfa01b5270c96627c4ef784da859931e02f04419c829e83484087c34e79",
+      "size": 38696353,
+      "input_size": 112,
+      "mean": 0.0,
+      "std": 1.0,
+      "match_similarity": 0.5,
+      "sure_similarity": 0.6,
+      "ask_similarity": 0.32,
+      "keep_similarity": 0.4,
+      "license": "Apache-2.0",
+      "data": "The model's paper trained it on CASIA-WebFace, VGGFace2 and MS-Celeb-1M, research data sets (non-commercial terms).",
+      "source": "https://huggingface.co/opencv/face_recognition_sface",
+      "bundled": false,
+      "ram_mb": 60,
+      "time_ms": 20,
+      "accuracy": 3
+    },
+    "auraface-v1": {
+      "name": "AuraFace v1 (accurate)",
+      "description": "A large model: tells faces apart better in poor light and at an angle, but needs about 600 MB of memory and is slow on small CPUs. For a fast PC.",
+      "url": "https://huggingface.co/fal/AuraFace-v1/resolve/af6d057c9b0ec4071d4c49c80e3539258798b609/glintr100.onnx",
+      "sha256": "a7933ea5330113b01c9b60351d8f4c33003f145d8470ac5f0e52ee2effe25c60",
+      "size": 260694151,
+      "input_size": 112,
+      "mean": 127.5,
+      "std": 127.5,
+      "match_similarity": 0.4,
+      "sure_similarity": 0.5,
+      "ask_similarity": 0.28,
+      "keep_similarity": 0.3,
+      "license": "Apache-2.0",
+      "data": "Trained on a commercial data set that its makers say allows commercial use.",
+      "source": "https://huggingface.co/fal/AuraFace-v1",
+      "bundled": false,
+      "ram_mb": 600,
+      "time_ms": 60,
+      "accuracy": 5
+    }
+  }
+}
diff --git a/visionstate/backend/visionstate/faces.py b/visionstate/backend/visionstate/faces.py
new file mode 100644
index 0000000..8976d26
--- /dev/null
+++ b/visionstate/backend/visionstate/faces.py
@@ -0,0 +1,542 @@
+"""Faces in person boxes: find them, check that they are usable, align and embed them, and tell
+who they are (object sensors with face recognition on; docs/FACE_RECOGNITION_PLAN.md).
+
+The face models are declared in ``faces.json``: one face detector (YuNet: a face box and five
+points — the eyes, the nose tip and the mouth corners) and the recognisers the user can choose
+from (a face embedding from a face aligned on those five points). None of them is bundled: they
+are downloaded when a sensor first turns face recognition on. Entries are never changed or
+removed once released (their texts, footprint and similarity limits may be).
+
+A face is only looked for in the upper part of a person box the object detector found, cut from
+the full frame. A face that fails the quality gate (too small, blurry, turned away, unsure) is
+*no face*, never someone unknown. A usable face is compared with the faces the user taught for
+each person; see ``identify``.
+"""
+
+from __future__ import annotations
+
+import json
+import math
+import threading
+from collections.abc import Sequence
+from dataclasses import dataclass, field
+from pathlib import Path
+
+import numpy as np
+from PIL import Image, ImageOps
+
+from .backbones import Footprint, cpu_session
+from .settings import FACE_DEFAULTS, FACE_TUNABLE, FACES
+
+REGISTRY_FILE = Path(__file__).with_name("faces.json")
+
+# How a face becomes an embedding besides the model (see ``Recogniser.embed``); part of the key of
+# cached embeddings, so a change here recomputes them. 2: the brightness of the face is evened out.
+EMBEDDING_VERSION = 2
+
+# Where the five points of a face go in a 112 × 112 aligned face (the ArcFace template, which
+# SFace uses too): right eye, left eye (as seen in the picture: left, right), nose tip, mouth corners.
+TEMPLATE_112 = np.array(
+    [[38.2946, 51.6963], [73.5318, 51.5014], [56.0252, 71.7366], [41.5493, 92.3655], [70.7299, 92.2041]],
+    dtype=np.float64,
+)
+
+
+@dataclass(frozen=True)
+class FaceDetectorSpec:
+    id: str
+    name: str
+    description: str
+    url: str
+    sha256: str
+    size: int
+    input_size: int
+    license: str
+    data: str
+    source: str
+    bundled: bool = False
+
+    @property
+    def filename(self) -> str:
+        return f"{self.id}.onnx"
+
+
+@dataclass(frozen=True)
+class RecogniserSpec:
+    id: str
+    name: str
+    description: str
+    url: str
+    sha256: str
+    size: int
+    input_size: int
+    mean: float  # the aligned face (RGB, 0-255) is fed as (pixel - mean) / std
+    std: float
+    # Cosine similarities of this model (they mean nothing for another one): a match needs
+    # ``match_similarity`` (and a margin over the next person), a name is published at once from
+    # ``sure_similarity`` (else after a second check agrees), between ``ask_similarity`` and a
+    # match the sensor is unsure and may ask, and a person who stays keeps their name down to
+    # ``keep_similarity``.
+    match_similarity: float
+    sure_similarity: float
+    ask_similarity: float
+    keep_similarity: float
+    license: str
+    data: str  # what it was trained on, as its makers say
+    source: str
+    bundled: bool = False
+    footprint: Footprint = field(default_factory=lambda: Footprint())
+
+    @property
+    def filename(self) -> str:
+        return f"{self.id}.onnx"
+
+    @property
+    def thresholds(self) -> dict[str, float]:
+        return {
+            "match_similarity": self.match_similarity,
+            "sure_similarity": self.sure_similarity,
+            "ask_similarity": self.ask_similarity,
+            "keep_similarity": self.keep_similarity,
+        }
+
+
+def load_registry() -> tuple[FaceDetectorSpec, str, dict[str, RecogniserSpec]]:
+    """The face detector, the default recogniser's id and every recogniser in ``faces.json``."""
+    raw = json.loads(REGISTRY_FILE.read_text(encoding="utf-8"))
+    d = raw["detectors"][raw["detector"]]
+    detector = FaceDetectorSpec(
+        id=raw["detector"],
+        name=d["name"],
+        description=d.get("description", ""),
+        url=d["url"],
+        sha256=d["sha256"],
+        size=int(d.get("size", 0)),
+        input_size=int(d["input_size"]),
+        license=d.get("license", ""),
+        data=d.get("data", ""),
+        source=d.get("source", ""),
+        bundled=bool(d.get("bundled", False)),
+    )
+    recognisers = {
+        key: RecogniserSpec(
+            id=key,
+            name=v["name"],
+            description=v.get("description", ""),
+            url=v["url"],
+            sha256=v["sha256"],
+            size=int(v.get("size", 0)),
+            input_size=int(v["input_size"]),
+            mean=float(v["mean"]),
+            std=float(v["std"]),
+            match_similarity=float(v["match_similarity"]),
+            sure_similarity=float(v["sure_similarity"]),
+            ask_similarity=float(v["ask_similarity"]),
+            keep_similarity=float(v["keep_similarity"]),
+            license=v.get("license", ""),
+            data=v.get("data", ""),
+            source=v.get("source", ""),
+            bundled=bool(v.get("bundled", False)),
+            footprint=Footprint.of(v),
+        )
+        for key, v in raw["recognisers"].items()
+    }
+    return detector, raw["default"], recognisers
+
+
+DETECTOR, DEFAULT_RECOGNISER, RECOGNISERS = load_registry()
+
+
+def tunable_defaults(model_id: str) -> dict[str, float]:
+    """The tunable face limits (settings.FACE_TUNABLE) as they are by default with a face model."""
+    return {"min_face_px": FACE_DEFAULTS["min_face_px"], **recogniser_spec(model_id).thresholds}
+
+
+def merge_limits(model_id: str, global_limits: dict | None, sensor: dict | None) -> dict[str, float]:
+    """Effective face limits: the model's defaults < the global values < the sensor's own."""
+    merged = tunable_defaults(model_id)
+    for overrides in (global_limits, sensor):
+        merged.update({k: float(v) for k, v in (overrides or {}).items() if k in FACE_TUNABLE and v is not None})
+    return merged
+
+
+def recogniser_spec(model_id: str) -> RecogniserSpec:
+    return RECOGNISERS.get(model_id) or RECOGNISERS[DEFAULT_RECOGNISER]
+
+
+# --- Finding faces -----------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class Face:
+    """A face found in a picture, in that picture's pixels."""
+
+    box: tuple[float, float, float, float]  # x1, y1, x2, y2
+    points: tuple[tuple[float, float], ...]  # the five points (see TEMPLATE_112)
+    score: float
+
+    @property
+    def width(self) -> float:
+        return self.box[2] - self.box[0]
+
+    @property
+    def eye_distance(self) -> float:
+        (ax, ay), (bx, by) = self.points[0], self.points[1]
+        return math.hypot(bx - ax, by - ay)
+
+    def moved(self, dx: float, dy: float, scale: float) -> Face:
+        """The same face in another picture, whose pixels are ``x * scale + dx`` (and y alike)."""
+        x1, y1, x2, y2 = self.box
+        return Face(
+            (x1 * scale + dx, y1 * scale + dy, x2 * scale + dx, y2 * scale + dy),
+            tuple((x * scale + dx, y * scale + dy) for x, y in self.points),
+            self.score,
+        )
+
+
+def head_region(box: Sequence[float], width: int, height: int) -> tuple[int, int, int, int]:
+    """Where a face is looked for in a person box (normalised): its upper part, in frame pixels.
+
+    A standing person's box is about three times as tall as wide; the head is in the top of it.
+    A box of only head and shoulders (a doorbell) is about as tall as wide and is taken whole.
+    """
+    x1, y1, x2, y2 = (box[0] * width, box[1] * height, box[2] * width, box[3] * height)
+    bw, bh = x2 - x1, y2 - y1
+    margin = bw * FACES["region_margin"]
+    top = y1 - margin
+    bottom = y1 + min(bh, bw * FACES["region_height"]) + margin
+    return (
+        max(0, int(x1 - margin)),
+        max(0, int(top)),
+        min(width, int(math.ceil(x2 + margin))),
+        min(height, int(math.ceil(bottom))),
+    )
+
+
+def _nms(boxes: np.ndarray, scores: np.ndarray, iou: float) -> list[int]:
+    order = list(np.argsort(-scores))
+    keep: list[int] = []
+    while order:
+        best, order = order[0], order[1:]
+        keep.append(int(best))
+        if not order:
+            break
+        rest = boxes[order]
+        x1 = np.maximum(boxes[best, 0], rest[:, 0])
+        y1 = np.maximum(boxes[best, 1], rest[:, 1])
+        x2 = np.minimum(boxes[best, 2], rest[:, 2])
+        y2 = np.minimum(boxes[best, 3], rest[:, 3])
+        inter = np.clip(x2 - x1, 0, None) * np.clip(y2 - y1, 0, None)
+        area = lambda b: (b[..., 2] - b[..., 0]) * (b[..., 3] - b[..., 1])  # noqa: E731
+        overlap = inter / np.maximum(area(boxes[best]) + area(rest) - inter, 1e-9)
+        order = [o for o, v in zip(order, overlap, strict=True) if v <= iou]
+    return keep
+
+
+def decode_yunet(outputs: Sequence[np.ndarray], size: int, min_score: float) -> list[Face]:
+    """Faces from YuNet's outputs (cls, obj, bbox, kps for strides 8, 16, 32), in input pixels.
+
+    The same decoding as OpenCV's ``FaceDetectorYN``: the score is sqrt(cls × obj), boxes and
+    points are offsets from each cell of the stride's grid.
+    """
+    strides = (8, 16, 32)
+    boxes, scores, points = [], [], []
+    for i, stride in enumerate(strides):
+        cls, obj = outputs[i][0, :, 0], outputs[i + 3][0, :, 0]
+        bbox, kps = outputs[i + 6][0], outputs[i + 9][0]
+        score = np.sqrt(np.clip(cls, 0, 1) * np.clip(obj, 0, 1))
+        idx = np.nonzero(score >= min_score)[0]
+        if not len(idx):
+            continue
+        cols = size // stride
+        r, c = (idx // cols).astype(np.float32), (idx % cols).astype(np.float32)
+        cx, cy = (c + bbox[idx, 0]) * stride, (r + bbox[idx, 1]) * stride
+        w, h = np.exp(bbox[idx, 2]) * stride, np.exp(bbox[idx, 3]) * stride
+        boxes.append(np.stack([cx - w / 2, cy - h / 2, cx + w / 2, cy + h / 2], axis=1))
+        scores.append(score[idx])
+        pts = kps[idx].reshape(-1, 5, 2)
+        points.append(np.stack([(pts[:, :, 0] + c[:, None]) * stride, (pts[:, :, 1] + r[:, None]) * stride], axis=2))
+    if not boxes:
+        return []
+    all_boxes, all_scores, all_points = np.concatenate(boxes), np.concatenate(scores), np.concatenate(points)
+    keep = _nms(all_boxes, all_scores, FACES["nms_iou"])
+    return [
+        Face(
+            tuple(float(v) for v in all_boxes[k]),  # type: ignore[arg-type]
+            tuple((float(x), float(y)) for x, y in all_points[k]),
+            float(all_scores[k]),
+        )
+        for k in keep
+    ]
+
+
+class FaceDetector:
+    """YuNet with a fixed square input: up to four head regions are looked at in one run, each
+    scaled into a quarter of the input (YuNet finds faces of about 10 to 300 pixels)."""
+
+    def __init__(self, spec: FaceDetectorSpec, model_path: Path):
+        self.spec = spec
+        self.session = cpu_session(model_path)
+        self.input_name = self.session.get_inputs()[0].name
+        self._lock = threading.Lock()
+
+    @property
+    def cell(self) -> int:
+        return self.spec.input_size // 2
+
+    def detect(self, regions: list[Image.Image]) -> list[Face | None]:
+        """The best face in each region (None: none found), in that region's pixels."""
+        result: list[Face | None] = []
+        for start in range(0, len(regions), 4):
+            result.extend(self._detect_four(regions[start : start + 4]))
+        return result
+
+    def _detect_four(self, regions: list[Image.Image]) -> list[Face | None]:
+        size, cell = self.spec.input_size, self.cell
+        canvas = np.zeros((size, size, 3), dtype=np.float32)
+        placed = []
+        for i, region in enumerate(regions):
+            scale = cell / max(region.width, region.height)
+            w, h = max(1, round(region.width * scale)), max(1, round(region.height * scale))
+            ox, oy = (i % 2) * cell, (i // 2) * cell
+            canvas[oy : oy + h, ox : ox + w] = np.asarray(
+                region.convert("RGB").resize((w, h), Image.Resampling.BILINEAR), dtype=np.float32
+            )
+            placed.append((ox, oy, w, h, scale))
+        batch = canvas[:, :, ::-1].transpose(2, 0, 1)[None].copy()  # YuNet takes BGR, 0-255
+        with self._lock:
+            outputs = [np.asarray(o) for o in self.session.run(None, {self.input_name: batch})]
+        found = decode_yunet(outputs, size, FACES["detect_score"])
+        best: list[Face | None] = []
+        for ox, oy, w, h, scale in placed:
+            inside = [
+                f
+                for f in found
+                if ox <= (f.box[0] + f.box[2]) / 2 < ox + w and oy <= (f.box[1] + f.box[3]) / 2 < oy + h
+            ]
+            face = max(inside, key=lambda f: f.score, default=None)
+            best.append(face.moved(-ox / scale, -oy / scale, 1 / scale) if face else None)
+        return best
+
+
+# --- Quality, alignment ------------------------------------------------------------------------
+
+
+def similarity_transform(src: np.ndarray, dst: np.ndarray) -> np.ndarray:
+    """The 2 × 3 rotation, scale and shift that best maps points ``src`` onto ``dst`` (Umeyama)."""
+    n = len(src)
+    mu_s, mu_d = src.mean(axis=0), dst.mean(axis=0)
+    s_c, d_c = src - mu_s, dst - mu_d
+    cov = d_c.T @ s_c / n
+    u, sv, vt = np.linalg.svd(cov)
+    d = np.eye(2)
+    if np.linalg.det(u) * np.linalg.det(vt) < 0:
+        d[1, 1] = -1
+    rotation = u @ d @ vt
+    scale = float(np.trace(np.diag(sv) @ d) / ((s_c**2).sum() / n))
+    shift = mu_d - scale * rotation @ mu_s
+    return np.hstack([scale * rotation, shift[:, None]])
+
+
+def align(image: Image.Image, face: Face, size: int = 112) -> Image.Image:
+    """The face turned and scaled so that its five points sit on the template (``size`` square)."""
+    src = np.array(face.points, dtype=np.float64)
+    m = similarity_transform(src, TEMPLATE_112 * (size / 112))
+    a, t = m[:, :2], m[:, 2]
+    inv = np.linalg.inv(a)
+    back = -inv @ t
+    data = (inv[0, 0], inv[0, 1], back[0], inv[1, 0], inv[1, 1], back[1])
+    return image.convert("RGB").transform((size, size), Image.Transform.AFFINE, data, Image.Resampling.BILINEAR)
+
+
+def sharpness(aligned: Image.Image) -> float:
+    """Variance of the Laplacian of an aligned face (grey): low = blurry."""
+    g = np.asarray(aligned.convert("L"), dtype=np.float32)
+    lap = 4 * g[1:-1, 1:-1] - g[:-2, 1:-1] - g[2:, 1:-1] - g[1:-1, :-2] - g[1:-1, 2:]
+    return float(lap.var())
+
+
+def turn(face: Face) -> float:
+    """How far the face is turned sideways: the nose's offset from between the eyes, along the
+    line of the eyes, in eye distances (0 = straight at the camera, about 0.35 = 30 degrees, 0.6 = 45)."""
+    (ax, ay), (bx, by), (nx, ny) = face.points[0], face.points[1], face.points[2]
+    dist = math.hypot(bx - ax, by - ay)
+    if dist <= 0:
+        return 1.0
+    ux, uy = (bx - ax) / dist, (by - ay) / dist
+    mx, my = (ax + bx) / 2, (ay + by) / 2
+    return abs((nx - mx) * ux + (ny - my) * uy) / dist
+
+
+def cut_off(face: Face, frame: tuple[int, int]) -> bool:
+    """Whether the frame's edge cuts the face: its box reaches the edge or a point is outside.
+    The face detector then guesses where the eyes are, and the face looks like nobody."""
+    w, h = frame
+    x1, y1, x2, y2 = face.box
+    inside = all(0 <= x < w and 0 <= y < h for x, y in face.points)
+    return not inside or x1 <= 0 or y1 <= 0 or x2 >= w - 1 or y2 >= h - 1
+
+
+def problem(face: Face, aligned: Image.Image, min_face_px: float, frame: tuple[int, int]) -> str | None:
+    """Why a face cannot be used ("cut", "small", "turned", "blurry", "unsure"), or None.
+
+    ``face`` in the pixels of the frame of size ``frame``; ``min_face_px`` is the sensor's
+    smallest face (its width)."""
+    if cut_off(face, frame):
+        return "cut"
+    if face.width < min_face_px:
+        return "small"
+    if face.score < FACES["min_score"]:
+        return "unsure"
+    if turn(face) > FACES["max_turn"] or face.eye_distance < face.width * FACES["turned_eye_share"]:
+        return "turned"
+    if sharpness(aligned) < FACES["min_sharpness"]:
+        return "blurry"
+    return None
+
+
+def clearly_seen(face: Face, min_face_px: float) -> bool:
+    """Whether a usable face is seen well enough that matching nobody makes it a stranger: big
+    enough, nearly straight at the camera (a turned face may just not look like its photos) and
+    surely a face."""
+    return (
+        face.width >= min_face_px * FACES["unknown_size"]
+        and turn(face) <= FACES["unknown_max_turn"]
+        and face.score >= FACES["unknown_min_score"]
+    )
+
+
+# --- Telling who it is ------------------------------------------------------------------------
+
+
+def even_light(face: Image.Image) -> Image.Image:
+    """The face with its brightness spread over the full range (its colours kept).
+
+    A doorbell looks out at a bright sky, so a face in front of it is often nearly black: its
+    embedding then hardly looked like the same person a few seconds later. Evening out the light
+    raised the faces named right in a backlit test from 39 % to 64 % and made other people look
+    less alike, not more (docs/FACE_RECOGNITION_PLAN.md §12)."""
+    y, cb, cr = face.convert("YCbCr").split()
+    return Image.merge("YCbCr", (ImageOps.equalize(y), cb, cr)).convert("RGB")
+
+
+class Recogniser:
+    """Turns aligned faces into L2-normalised embeddings with one ONNX recogniser."""
+
+    def __init__(self, spec: RecogniserSpec, model_path: Path):
+        self.spec = spec
+        self.session = cpu_session(model_path)
+        self.input_name = self.session.get_inputs()[0].name
+        self._lock = threading.Lock()
+
+    def embed(self, faces: list[Image.Image]) -> np.ndarray:
+        """One embedding per aligned face; one at a time (some models take a batch of one only)."""
+        vectors = []
+        for face in faces:
+            arr = np.asarray(even_light(face), dtype=np.float32)
+            arr = ((arr - self.spec.mean) / self.spec.std).transpose(2, 0, 1)[None]
+            with self._lock:
+                out = np.asarray(self.session.run(None, {self.input_name: arr})[0])[0]
+            vectors.append(out / max(float(np.linalg.norm(out)), 1e-8))
+        return np.stack(vectors).astype(np.float32) if vectors else np.zeros((0, 0), dtype=np.float32)
+
+
+@dataclass
+class FaceModel:
+    """The face detector and the chosen recogniser, loaded together."""
+
+    detector: FaceDetector
+    recogniser: Recogniser
+
+    @property
+    def id(self) -> str:
+        return self.recogniser.spec.id
+
+
+@dataclass
+class FaceIndex:
+    """The people's taught faces (shared by every sensor), ready to compare with."""
+
+    model: str
+    ids: list[int]
+    labels: list[str]  # the person (their key) of each face
+    vectors: np.ndarray
+    generation: int = 0
+
+
+@dataclass(frozen=True)
+class Identity:
+    """Who a face is: ``label`` is the closest person (None: nobody is taught), ``similarity`` its
+    score, ``margin`` over the next person (1 when there is only one)."""
+
+    label: str | None
+    similarity: float
+    margin: float
+    example_id: int | None
+
+
+def scores(index: FaceIndex, vector: np.ndarray) -> list[tuple[str, float, int]]:
+    """(person, score, closest face's id) for each taught person, best first.
+
+    A person's score is the mean similarity to their ``FACES["top_k"]`` closest faces, not the
+    single closest: one face taught under the wrong name does not then match everything like it.
+    """
+    if not index.ids:
+        return []
+    sims = index.vectors @ vector
+    per: dict[str, list[tuple[float, int]]] = {}
+    for sim, label, example in zip(sims, index.labels, index.ids, strict=True):
+        per.setdefault(label, []).append((float(sim), example))
+    ranked = []
+    for label, values in per.items():
+        values.sort(key=lambda v: -v[0])
+        top = values[: FACES["top_k"]]
+        ranked.append((label, sum(v for v, _ in top) / len(top), top[0][1]))
+    ranked.sort(key=lambda r: -r[1])
+    return ranked
+
+
+def identify(index: FaceIndex, vector: np.ndarray) -> Identity:
+    ranked = scores(index, vector)
+    if not ranked:
+        return Identity(None, 0.0, 0.0, None)
+    label, score, example = ranked[0]
+    margin = score - ranked[1][1] if len(ranked) > 1 else 1.0
+    return Identity(label, round(score, 3), round(margin, 3), example)
+
+
+def decide(identity: Identity, limits: dict[str, float], kept: str | None = None) -> str:
+    """What a usable face is: "match" (it is ``identity.label``), "ask" (maybe, not sure) or
+    "unknown" (nobody taught). ``kept``: the name this person box had in the last check; it keeps
+    it while the face stays close enough (``keep_similarity``)."""
+    if identity.label is None:
+        return "unknown"
+    if kept is not None and identity.label == kept and identity.similarity >= limits["keep_similarity"]:
+        return "match"
+    if identity.similarity >= limits["match_similarity"] and identity.margin >= FACES["margin"]:
+        return "match"
+    if identity.similarity >= limits["ask_similarity"]:
+        return "ask"
+    return "unknown"
+
+
+def face_crop(image: Image.Image, face: Face) -> tuple[Image.Image, Face]:
+    """What is stored of a taught face: the face with a margin (not aligned, so another model can
+    align it its own way later), and the face in that crop's pixels."""
+    x1, y1, x2, y2 = face.box
+    m = max(x2 - x1, y2 - y1) * FACES["crop_margin"]
+    left, top = max(0, int(x1 - m)), max(0, int(y1 - m))
+    right, bottom = min(image.width, int(math.ceil(x2 + m))), min(image.height, int(math.ceil(y2 + m)))
+    return image.crop((left, top, right, bottom)).convert("RGB"), face.moved(-left, -top, 1.0)
+
+
+def face_from_dict(data: dict) -> Face:
+    return Face(tuple(data["box"]), tuple(tuple(p) for p in data["points"]), float(data.get("score", 1.0)))  # type: ignore[arg-type]
+
+
+def face_to_dict(face: Face) -> dict:
+    return {
+        "box": [round(v, 1) for v in face.box],
+        "points": [[round(x, 1), round(y, 1)] for x, y in face.points],
+        "score": round(face.score, 3),
+    }
diff --git a/visionstate/backend/visionstate/main.py b/visionstate/backend/visionstate/main.py
index e14fefd..ac53aa3 100644
--- a/visionstate/backend/visionstate/main.py
+++ b/visionstate/backend/visionstate/main.py
@@ -9,7 +9,7 @@
 from fastapi.responses import FileResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 
-from .api import cameras, history, imports, review, samples, sensors, system, teach
+from .api import cameras, faces, history, imports, review, samples, sensors, system, teach
 from .db import Database
 from .engine import Runtime
 from .settings import INGRESS_PROXY_IP, VERSION, Settings, load_settings
@@ -52,6 +52,8 @@ async def ingress_only(request: Request, call_next):
     app.include_router(sensors.router)
     app.include_router(samples.router)
     app.include_router(teach.router)
+    app.include_router(faces.router)
+    app.include_router(faces.people_router)
 
     frontend = settings.frontend_dir.resolve()
     index = frontend / "index.html"
diff --git a/visionstate/backend/visionstate/mqtt.py b/visionstate/backend/visionstate/mqtt.py
index a7f1c3e..67dd875 100644
--- a/visionstate/backend/visionstate/mqtt.py
+++ b/visionstate/backend/visionstate/mqtt.py
@@ -365,15 +365,69 @@ def main_entities(sensor: SensorDescriptor) -> list[tuple[str, str]]:
 }
 
 
-def hub_discovery_messages(prefix: str) -> list[tuple[str, dict]]:
-    """App-wide entities (not tied to one sensor), grouped under a "VisionState" device."""
-    device = {
+def _hub_device() -> dict:
+    return {
         "identifiers": [APP_SLUG],
         "name": "VisionState",
         "manufacturer": "VisionState",
         "model": "VisionState app",
         "sw_version": VERSION,
     }
+
+
+def person_topics(key: str) -> dict[str, str]:
+    """Topics of a person's own entities: on which sensor they are seen, and when they were last
+    seen (never renamed once released)."""
+    base = f"{APP_SLUG}/people/{key}"
+    return {"state": f"{base}/state", "attributes": f"{base}/attributes", "last_seen": f"{base}/last_seen"}
+
+
+def person_discovery_messages(prefix: str, people: list[tuple[str, str]]) -> list[tuple[str, dict]]:
+    """Each person's own entities on the "VisionState" device: "<name> seen by"
+    (sensor.visionstate_<key>_seen_by), the slug of the sensor that sees them or not_seen, and
+    "<name> last seen" (sensor.visionstate_<key>_last_seen), a timestamp, so Home Assistant shows
+    "3 minutes ago" also when the user confirmed a frame afterwards. (The names say what the value
+    is; a person's own name alone was easily taken for Home Assistant's person.<name>. Beta
+    installs keep the entity ID they had.)"""
+    messages = []
+    for key, name in people:
+        t = person_topics(key)
+        messages.append(
+            (
+                f"{prefix}/sensor/{APP_SLUG}/person_{key}/config",
+                {
+                    "unique_id": f"{APP_SLUG}_person_{key}",
+                    "default_entity_id": f"sensor.{APP_SLUG}_{key}_seen_by",
+                    "name": f"{name} seen by",
+                    "state_topic": t["state"],
+                    "json_attributes_topic": t["attributes"],
+                    "icon": "mdi:account-eye",
+                    "availability": [{"topic": BRIDGE_AVAILABILITY}],
+                    "device": _hub_device(),
+                },
+            )
+        )
+        messages.append(
+            (
+                f"{prefix}/sensor/{APP_SLUG}/person_{key}_last_seen/config",
+                {
+                    "unique_id": f"{APP_SLUG}_person_{key}_last_seen",
+                    "default_entity_id": f"sensor.{APP_SLUG}_{key}_last_seen",
+                    "name": f"{name} last seen",
+                    "state_topic": t["last_seen"],
+                    "device_class": "timestamp",
+                    "icon": "mdi:account-clock",
+                    "availability": [{"topic": BRIDGE_AVAILABILITY}],
+                    "device": _hub_device(),
+                },
+            )
+        )
+    return messages
+
+
+def hub_discovery_messages(prefix: str) -> list[tuple[str, dict]]:
+    """App-wide entities (not tied to one sensor), grouped under a "VisionState" device."""
+    device = _hub_device()
     return [
         (
             f"{prefix}/sensor/{APP_SLUG}/review_queue/config",
@@ -531,6 +585,17 @@ async def publish_hub_discovery(self) -> None:
         for topic, payload in hub_discovery_messages(self.settings.discovery_prefix):
             await self.publish(topic, payload, retain=True)
 
+    async def publish_people_discovery(self, people: list[tuple[str, str]]) -> None:
+        for topic, payload in person_discovery_messages(self.settings.discovery_prefix, people):
+            await self.publish(topic, payload, retain=True)
+
+    async def remove_person(self, key: str) -> None:
+        """Forget a person's own entity and its retained values."""
+        for entity in (f"person_{key}", f"person_{key}_last_seen"):
+            await self.publish(f"{self.settings.discovery_prefix}/sensor/{APP_SLUG}/{entity}/config", "", retain=True)
+        for topic in person_topics(key).values():
+            await self.publish(topic, "", retain=True)
+
     async def remove_discovery(self, sensor: SensorDescriptor) -> None:
         for topic, _ in discovery_messages(self.settings.discovery_prefix, sensor):
             await self.publish(topic, "", retain=True)
diff --git a/visionstate/backend/visionstate/readers.json b/visionstate/backend/visionstate/readers.json
index e951cd0..ee3363d 100644
--- a/visionstate/backend/visionstate/readers.json
+++ b/visionstate/backend/visionstate/readers.json
@@ -12,7 +12,10 @@
       "chars": {"0": 33, "1": 34, "2": 35, "3": 36, "4": 37, "5": 38, "6": 39, "7": 40, "8": 41, "9": 42, ".": 14, ",": 12, ":": 16, "-": 13},
       "license": "Apache-2.0",
       "source": "https://huggingface.co/PaddlePaddle/PP-OCRv6_tiny_rec_onnx",
-      "bundled": true
+      "bundled": true,
+      "ram_mb": 20,
+      "time_ms": 3,
+      "accuracy": 3
     },
     "ppocrv6-small": {
       "name": "PP-OCRv6 small",
@@ -25,7 +28,10 @@
       "chars": {"0": 33, "1": 34, "2": 35, "3": 36, "4": 37, "5": 38, "6": 39, "7": 40, "8": 41, "9": 42, ".": 14, ",": 12, ":": 16, "-": 13},
       "license": "Apache-2.0",
       "source": "https://huggingface.co/PaddlePaddle/PP-OCRv6_small_rec_onnx",
-      "bundled": false
+      "bundled": false,
+      "ram_mb": 40,
+      "time_ms": 8,
+      "accuracy": 4
     }
   },
   "wheel_readers": {
@@ -42,7 +48,10 @@
         "bins": 100,
         "license": "Apache-2.0",
         "source": "https://huggingface.co/oleost/visionstate-wheel-reader",
-        "bundled": true
+        "bundled": true,
+        "ram_mb": 12,
+        "time_ms": 5,
+        "accuracy": 3
       }
     }
   }
diff --git a/visionstate/backend/visionstate/readers.py b/visionstate/backend/visionstate/readers.py
index e9cfab0..14df99d 100644
--- a/visionstate/backend/visionstate/readers.py
+++ b/visionstate/backend/visionstate/readers.py
@@ -19,13 +19,13 @@
 import re
 import threading
 from collections import deque
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from pathlib import Path
 
 import numpy as np
 from PIL import Image, ImageFilter, ImageOps
 
-from .backbones import cpu_session
+from .backbones import Footprint, cpu_session
 from .settings import READING
 
 REGISTRY_FILE = Path(__file__).with_name("readers.json")
@@ -46,6 +46,7 @@ class ReaderSpec:
     license: str
     source: str
     bundled: bool
+    footprint: Footprint = field(default_factory=lambda: Footprint())
 
     @property
     def filename(self) -> str:
@@ -69,6 +70,7 @@ def load_registry() -> tuple[str, dict[str, ReaderSpec]]:
             license=v.get("license", ""),
             source=v.get("source", ""),
             bundled=bool(v.get("bundled", False)),
+            footprint=Footprint.of(v),
         )
         for key, v in raw["readers"].items()
     }
@@ -270,6 +272,7 @@ class WheelReaderSpec:
     license: str
     source: str
     bundled: bool
+    footprint: Footprint = field(default_factory=lambda: Footprint())
 
     @property
     def filename(self) -> str:
@@ -293,6 +296,7 @@ def load_wheel_registry() -> tuple[str, dict[str, WheelReaderSpec]]:
             license=v.get("license", ""),
             source=v.get("source", ""),
             bundled=bool(v.get("bundled", False)),
+            footprint=Footprint.of(v),
         )
         for key, v in raw["readers"].items()
     }
diff --git a/visionstate/backend/visionstate/settings.py b/visionstate/backend/visionstate/settings.py
index 9e3c1bd..0e28f4a 100644
--- a/visionstate/backend/visionstate/settings.py
+++ b/visionstate/backend/visionstate/settings.py
@@ -54,6 +54,8 @@
     # The user's own labels, each a kind of one of the classes: [{"key", "name", "parent"}], e.g.
     # "Our car" under "car". Each gets the same two entities as a class. Made by teaching a box.
     "custom": [],
+    "teach": {},  # this sensor's own values of the tunable teaching limits (TEACH_TUNABLE); missing = global
+    "faces": {},  # recognising people by their face: see FACE_DEFAULTS (missing = default)
 }
 OBJECT_LIMITS = {
     "min_size": (0.0, 0.5),
@@ -198,6 +200,121 @@
 }
 NONE_LABEL = "none"  # taught label of a box that is not what the detector said
 
+# The limits of TEACH a user can change: globally (Settings → Teaching object sensors, DB setting
+# "teach") and per sensor (objects["teach"]); empty = inherit. Effective: merge_teach.
+TEACH_TUNABLE = ("match_similarity", "keep_similarity", "ask_similarity", "rescue_similarity", "rescue_floor")
+TEACH_TUNABLE_LIMITS = {
+    "match_similarity": (0.5, 0.99),
+    "keep_similarity": (0.5, 0.99),
+    "ask_similarity": (0.5, 0.99),
+    "rescue_similarity": (0.5, 0.99),
+    "rescue_floor": (0.05, 0.6),
+}
+# Defaults of a backbone whose similarities spread differently from DINOv2 small's (TEACH was
+# measured on that). DINOv2 base, on the CC0 test photos (14 objects; the same object with other
+# light, framing, blur, JPEG or night colours vs other objects of its kind): at 0.88 one pair of
+# different dogs counted as the same (0.891); at 0.90 none did, and 93 % of the changed copies
+# of an object were still recognised, as with DINOv2 small 8-bit at 0.88.
+TEACH_BY_BACKBONE: dict[str, dict[str, float]] = {
+    "dinov2-base": {"match_similarity": 0.9, "rescue_similarity": 0.92},
+}
+
+# Recognising people by their face (object sensors that look for "person"; off by default, see
+# docs/FACE_RECOGNITION_PLAN.md). The faces of each person box are looked for in its upper part,
+# checked (a face that fails is "no face", never someone unknown), aligned and compared with the
+# faces the user taught. Similarity thresholds belong to the face model (faces.json).
+FACE_DEFAULTS = {
+    "enabled": False,
+    # Smallest usable face: the width of the face in the camera's frame, in pixels (not the
+    # distance between the eyes, which shrinks as a head turns). On a 480x640 living room camera
+    # and the test photos scaled down, SFace still told the person (0.53-0.60) from a stranger
+    # (<=0.31) at a face 28-31 px wide (about 13 px between the eyes); at 21 px it fell to 0.45.
+    "min_face_px": 30.0,
+    "ask_unknown": False,  # put faces nobody was taught for in the review queue ("Who is this?")
+}
+# What the user can tune, for all sensors (Settings) and per sensor (its Faces card): a sensor's
+# unset value follows the global one, which follows the default (min_face_px above; the
+# similarities: the face model's, faces.json).
+FACE_TUNABLE = ("min_face_px", "match_similarity", "sure_similarity", "ask_similarity", "keep_similarity")
+FACE_LIMITS = {
+    "min_face_px": (16.0, 240.0),
+    "match_similarity": (0.2, 0.95),
+    "sure_similarity": (0.2, 0.95),
+    "ask_similarity": (0.1, 0.95),
+    "keep_similarity": (0.1, 0.95),
+}
+FACES = {
+    "stats_window": 40,  # "a usable face in 9 of the last 40 person boxes looked at"
+    "max_faces": 4,  # person boxes searched for a face per check (most certain first): one detector run
+    # A person box that keeps a sure name is searched again only every this many checks.
+    "recheck_every": 3,
+    # The upper part of a person box where the face is looked for: its height, in box widths
+    # (a standing person is about 3 widths tall), and a margin on every side, in box widths.
+    "region_height": 1.3,
+    "region_margin": 0.1,
+    "detect_score": 0.6,  # a face the face detector finds at all
+    "nms_iou": 0.3,
+    # Quality gate. The face detector's score, how far the face is turned sideways (see faces.turn:
+    # 0 straight, ~0.35 about 30 degrees, ~0.6 about 45) and the sharpness of the aligned face
+    # (variance of the Laplacian at 112 px: sharp faces 32+ down to 13 px between the eyes, the
+    # same faces blurred by 2 px at most 19). A profile has its eyes close together for its width:
+    # 0.41-0.50 of it looking at the camera, a profile 0.08; below turned_eye_share it is turned.
+    "min_score": 0.75,
+    "max_turn": 0.55,
+    "min_sharpness": 25.0,
+    "turned_eye_share": 0.3,
+    # A face that matched nobody counts towards Unknown person only when it is clearly seen: this
+    # many times the smallest face, turned at most this far, and found with at least this detector
+    # score. A smaller or more turned face can be named (a person's own face still looks like them
+    # a bit turned, 0.66-0.78 at 0.26-0.35), but not matching anyone may only mean the angle: "not
+    # sure who", never a stranger. On a phone camera real faces scored 0.86-0.94 and things taken
+    # for a face (a wall, a second face on a profile with the eyes in the wrong place) 0.60-0.79.
+    "unknown_size": 1.5,
+    "unknown_max_turn": 0.35,
+    "unknown_min_score": 0.85,
+    "top_k": 3,  # a person's score: the mean similarity to their this many closest taught faces
+    "margin": 0.05,  # a match must beat the next person by this much
+    # Unknown person: a person box whose usable face matched nobody in this many checks in a row
+    # (the same box: it overlaps the last check's by keep_iou in TEACH) and that never had a name.
+    "unknown_after": 2,
+    "crop_margin": 0.5,  # what is stored of a taught face: the face box plus this share of its size around it
+    "max_faces_per_person": 50,
+    "max_people": 10,  # people VisionState knows (shared; two entities on each sensor that recognises faces, and one of their own)
+    "suggest_faces": 5,  # a person with fewer taught faces gets "teach a few more"
+    "look_alike": 0.9,  # two people whose closest faces are this share of the match threshold apart look alike
+    # A usable face nobody is named for keeps its frame in the history, to name them there later
+    # (someone at a doorbell is gone before the Live tab can be tapped): at most one per this many
+    # seconds per sensor, unless the face came this many times closer (wider) since the last one.
+    "record_cooldown_s": 60,
+    "record_closer": 1.5,
+    # "Is this Kari?": a person moves, so each question shows another face to teach. Up to this many
+    # questions about one person per review cooldown (and waiting at once), at least this many
+    # seconds apart; an answer opens the next one right away. Own labels ask one at a time.
+    "ask_burst": 5,
+    "ask_gap_s": 3.0,
+    # Looking for a face while a person is there: someone walking up to a doorbell shows a usable
+    # face for a few seconds only, often between two regular checks. A check that finds a person
+    # nobody is named for checks again every burst_interval_s (or the sensor's burst pace if
+    # faster), until everyone in view is named, nobody was seen in burst_absent_checks checks in a
+    # row, burst_idle_checks checks in a row brought neither a usable face nor a person coming
+    # closer (a box or face burst_progress times larger than before), or after burst_max_s. Then not
+    # again until the person has gone: someone sitting on the steps gets one burst, not one an hour.
+    "burst_interval_s": 1.0,
+    "burst_max_s": 30.0,
+    "burst_idle_checks": 6,
+    "burst_absent_checks": 2,
+    "burst_progress": 1.1,
+    # Photos and short videos from a phone (People page; the same upload as a state sensor's, so
+    # images, ZIP archives and videos): at most this many faces are added from one upload, and a
+    # video gives a frame every this many seconds (turning the head gives several angles).
+    "max_photos": 10,
+    "photo_video_interval_s": 0.5,
+}
+FACE_UNKNOWN_KEY = "unknown_person"  # the key (and entity) of a face nobody was taught for
+# A person's own entity (sensor.visionstate_<key>) says on which sensor they are seen: its slug,
+# the one that saw them last when several do, or this when none sees them now.
+PERSON_NOT_SEEN = "not_seen"
+
 # --- Triggers: when a sensor checks its camera ---------------------------------
 #
 # 1. The regular interval (SENSOR_DEFAULTS["interval_s"]) is the safety net.
@@ -364,6 +481,9 @@
 
 HISTORY = {
     "page_size": 50,
+    # Rows of one sensor this close in time are the same moment (a face seen and the question about
+    # it): what is taught from one of them shows on the others too, where the box is the same.
+    "same_moment_s": 3.0,
     "max_page_size": 200,
     "max_filter_values": 50,  # values of one filter (sensors, keys, events) in one request
     "window_presets_h": (1, 24, 24 * 7, 24 * 30),  # time windows offered besides "any time"
@@ -373,7 +493,8 @@
 # kinds). api/history.py says which rows each one matches, the UI how it is named.
 HISTORY_EVENTS: dict[str, tuple[str, ...]] = {
     KIND_STATES: ("change", "flagged"),  # a published change; a frame put in the review queue
-    KIND_OBJECTS: ("appeared", "cleared", "filtered", "asked"),  # "asked": "Is this Our car?"
+    # "asked": "Is this Our car?"; "face_seen": a face nobody is named for (FACES["record_cooldown_s"]).
+    KIND_OBJECTS: ("appeared", "cleared", "filtered", "asked", "face_seen"),
     KIND_READING: ("value", "rejected", "verified"),  # verified: the user said whether it read right
 }
 
@@ -422,14 +543,43 @@ def merge_reminder(stored: dict | None) -> dict:
     return {**REMINDER_DEFAULTS, **{k: v for k, v in (stored or {}).items() if k in REMINDER_DEFAULTS}}
 
 
+def teach_defaults(backbone: str) -> dict:
+    """The tunable teaching limits as they are by default for ``backbone``."""
+    return {key: TEACH_BY_BACKBONE.get(backbone, {}).get(key, TEACH[key]) for key in TEACH_TUNABLE}
+
+
+def merge_teach(backbone: str, global_limits: dict | None, sensor_overrides: dict | None) -> dict:
+    """Effective teaching limits (all of TEACH): defaults of the backbone < global < sensor overrides."""
+    merged = {**TEACH, **teach_defaults(backbone)}
+    for overrides in (global_limits, sensor_overrides):
+        merged.update({k: v for k, v in (overrides or {}).items() if v is not None and k in TEACH_TUNABLE})
+    return merged
+
+
 def merge_objects(stored: dict | None) -> dict:
     """Object settings of a sensor: stored values on top of OBJECT_DEFAULTS."""
     merged = {**OBJECT_DEFAULTS, **(stored or {})}
     merged["classes"] = list(merged.get("classes") or [])
     merged["custom"] = [dict(label) for label in merged.get("custom") or []]
+    merged["teach"] = {k: v for k, v in (merged.get("teach") or {}).items() if k in TEACH_TUNABLE and v is not None}
+    merged["faces"] = merge_faces(merged.get("faces"))
+    return merged
+
+
+def merge_faces(stored: dict | None) -> dict:
+    """Face settings of an object sensor: whether it is on and asks (stored on top of
+    FACE_DEFAULTS), and its own values of FACE_TUNABLE (only the ones it set; see faces.merge_limits)."""
+    stored = stored or {}
+    merged = {k: stored.get(k, FACE_DEFAULTS[k]) for k in ("enabled", "ask_unknown")}
+    merged.update({k: float(stored[k]) for k in FACE_TUNABLE if stored.get(k) is not None})
     return merged
 
 
+def faces_on(objects: dict) -> bool:
+    """Whether an object sensor recognises faces: switched on, and it looks for people."""
+    return bool(objects["faces"]["enabled"]) and "person" in objects["classes"]
+
+
 def active_custom(objects: dict) -> list[dict]:
     """The sensor's own labels that are in use: those whose class is still selected."""
     return [label for label in objects["custom"] if label["parent"] in objects["classes"]]
@@ -482,6 +632,12 @@ class Settings:
     def models_dir(self) -> Path:
         return self.data_dir / "models"
 
+    @property
+    def faces_dir(self) -> Path:
+        """Faces taught to object sensors: in the app's own storage, never in the media folder
+        (Home Assistant's media browser shows that to every user)."""
+        return self.data_dir / "faces"
+
     @property
     def heads_dir(self) -> Path:
         return self.data_dir / "heads"
@@ -511,6 +667,7 @@ def ensure_dirs(self) -> None:
             self.data_dir,
             self.models_dir,
             self.heads_dir,
+            self.faces_dir,
             self.samples_dir,
             self.history_dir,
             self.thumbs_dir,
diff --git a/visionstate/backend/visionstate/storage.py b/visionstate/backend/visionstate/storage.py
index 8f5ec07..d79ccad 100644
--- a/visionstate/backend/visionstate/storage.py
+++ b/visionstate/backend/visionstate/storage.py
@@ -18,6 +18,10 @@ def __init__(self, settings: Settings):
     def sample_path(self, sensor_id: int, filename: str) -> Path:
         return self.settings.samples_dir / str(sensor_id) / filename
 
+    def face_path(self, filename: str) -> Path:
+        """A taught face (db.Face): shared by every sensor, so not in a sensor's folder."""
+        return self.settings.faces_dir / filename
+
     def history_path(self, sensor_id: int, filename: str) -> Path:
         return self.settings.history_dir / str(sensor_id) / filename
 
@@ -37,6 +41,14 @@ def save_sample(self, sensor_id: int, image: Image.Image) -> str:
         self._write(self.sample_path(sensor_id, filename), image)
         return filename
 
+    def save_face(self, image: Image.Image) -> str:
+        filename = self.new_filename()
+        self._write(self.face_path(filename), image)
+        return filename
+
+    def delete_face(self, filename: str) -> None:
+        self.face_path(filename).unlink(missing_ok=True)
+
     def save_history(self, sensor_id: int, image: Image.Image) -> str:
         filename = self.new_filename()
         self._write(self.history_path(sensor_id, filename), image)
@@ -67,11 +79,18 @@ def history_bytes(self) -> int:
         return self._folder_bytes(self.settings.history_dir) + self._folder_bytes(self.settings.thumbs_dir / "history")
 
     def samples_bytes(self) -> int:
-        """Training images and their thumbnails on disk."""
-        return self._folder_bytes(self.settings.samples_dir) + self._folder_bytes(self.settings.thumbs_dir / "sample")
+        """Training images (and taught faces) and their thumbnails on disk."""
+        return (
+            self._folder_bytes(self.settings.samples_dir)
+            + self._folder_bytes(self.settings.faces_dir)
+            + self._folder_bytes(self.settings.thumbs_dir / "sample")
+        )
 
     def delete_sensor(self, sensor_id: int) -> None:
         import shutil
 
-        for directory in (self.settings.samples_dir / str(sensor_id), self.settings.history_dir / str(sensor_id)):
+        for directory in (
+            self.settings.samples_dir / str(sensor_id),
+            self.settings.history_dir / str(sensor_id),
+        ):
             shutil.rmtree(directory, ignore_errors=True)
diff --git a/visionstate/backend/visionstate/teach.py b/visionstate/backend/visionstate/teach.py
index ae55eea..386866b 100644
--- a/visionstate/backend/visionstate/teach.py
+++ b/visionstate/backend/visionstate/teach.py
@@ -143,7 +143,7 @@ def nearest(index: TaughtIndex, vector: np.ndarray, min_similarity: float) -> Ma
     return Match(label, similarity, example_id)
 
 
-def _iou(a: Sequence[float], b: Sequence[float]) -> float:
+def box_iou(a: Sequence[float], b: Sequence[float]) -> float:
     """Intersection over union of two boxes (x1, y1, x2, y2)."""
     x1, y1 = max(a[0], b[0]), max(a[1], b[1])
     x2, y2 = min(a[2], b[2]), min(a[3], b[3])
@@ -159,7 +159,7 @@ def plan(found: list[dict], candidates: list[dict], index: TaughtIndex) -> tuple
     rescue = []
     if index.rescue:
         for cand in sorted(candidates, key=lambda d: -d["score"]):
-            if any(_iou(cand["box"], d["box"]) >= TEACH["rescue_overlap_iou"] for d in found):
+            if any(box_iou(cand["box"], d["box"]) >= TEACH["rescue_overlap_iou"] for d in found):
                 continue  # the same object as a counted box (e.g. a car also seen as a truck)
             rescue.append(cand)
             if len(rescue) >= TEACH["max_rescue"]:
@@ -177,6 +177,7 @@ def apply(
     classes: list[str],
     parents: dict[str, str],
     previous: list[dict] | None = None,
+    limits: dict | None = None,
 ) -> list[dict]:
     """The boxes of a check after comparing them with the taught ones.
 
@@ -186,16 +187,18 @@ def apply(
     ``previous`` (the boxes of the last check) lets an object that stayed where it was keep its
     answer at a lower similarity (``kept``, see TEACH["keep_similarity"]). A box that may be an
     own label, but not clearly, gets ``ask`` ({id, label, similarity}; see TEACH["ask_similarity"]).
+    ``limits``: the sensor's teaching limits (settings.merge_teach); TEACH when not given.
     """
+    limits = limits or TEACH
     result = [dict(d) for d in found]
     for i, vector in zip(checked, checked_vectors, strict=True):
-        match = nearest(index, vector, TEACH["match_similarity"])
+        match = nearest(index, vector, limits["match_similarity"])
         if match is None:
-            match = _kept(index, vector, result[i]["box"], previous or [])
+            match = _kept(index, vector, result[i]["box"], previous or [], limits["keep_similarity"])
             if match is not None:
                 result[i]["kept"] = True
         if match is None:
-            if ask := _unsure(index, vector, result[i]["key"], parents):
+            if ask := _unsure(index, vector, result[i]["key"], parents, limits["ask_similarity"]):
                 result[i]["ask"] = ask
             continue
         det = result[i]
@@ -211,13 +214,13 @@ def apply(
         if label:
             det["label"] = label
     for cand, vector in zip(rescue, rescue_vectors, strict=True):
-        match = nearest(index, vector, TEACH["rescue_similarity"])
+        match = nearest(index, vector, limits["rescue_similarity"])
         if match is None:
             continue
         key, label = resolve(match.label, parents)
         if key is None or key not in classes:
             continue
-        if any(_iou(cand["box"], d["box"]) >= TEACH["rescue_overlap_iou"] for d in result if not d.get("filtered")):
+        if any(box_iou(cand["box"], d["box"]) >= TEACH["rescue_overlap_iou"] for d in result if not d.get("filtered")):
             continue  # already counted (another unsure box of the same object was rescued)
         det = {**cand, "key": key, "rescued": True}
         det["match"] = {"id": match.example_id, "label": match.label, "similarity": round(match.similarity, 3)}
@@ -229,21 +232,25 @@ def apply(
     return result
 
 
-def _kept(index: TaughtIndex, vector: np.ndarray, box: Sequence[float], previous: list[dict]) -> Match | None:
+def _kept(
+    index: TaughtIndex, vector: np.ndarray, box: Sequence[float], previous: list[dict], keep_similarity: float
+) -> Match | None:
     """The answer a box got in the last check, when it is the same object at the same place and
     still close to that taught label (just below match_similarity, e.g. in other light)."""
     before = [
         d["match"]["label"]
         for d in previous
-        if d.get("match") and not d.get("rescued") and _iou(d["box"], box) >= TEACH["keep_iou"]
+        if d.get("match") and not d.get("rescued") and box_iou(d["box"], box) >= TEACH["keep_iou"]
     ]
-    match = nearest(index, vector, TEACH["keep_similarity"]) if before else None
+    match = nearest(index, vector, keep_similarity) if before else None
     return match if match is not None and match.label in before else None
 
 
-def _unsure(index: TaughtIndex, vector: np.ndarray, key: str, parents: dict[str, str]) -> dict | None:
+def _unsure(
+    index: TaughtIndex, vector: np.ndarray, key: str, parents: dict[str, str], ask_similarity: float
+) -> dict | None:
     """The own label (of the box's class) a box is close to but not clearly, to ask about."""
-    near = nearest(index, vector, TEACH["ask_similarity"])
+    near = nearest(index, vector, ask_similarity)
     if near is None:
         return None
     parent, label = resolve(near.label, parents)
@@ -264,4 +271,4 @@ def counts_for(detection: dict, key: str) -> bool:
 
 def seen_faintly(candidates: list[dict], box: Sequence[float]) -> bool:
     """Whether any of the detector's boxes (however unsure) overlaps a drawn box."""
-    return any(_iou(c["box"], box) >= TEACH["seen_iou"] for c in candidates)
+    return any(box_iou(c["box"], box) >= TEACH["seen_iou"] for c in candidates)
diff --git a/visionstate/config.yaml b/visionstate/config.yaml
index 3c754f1..91c3af2 100644
--- a/visionstate/config.yaml
+++ b/visionstate/config.yaml
@@ -1,5 +1,5 @@
 name: VisionState
-version: "0.8.0"
+version: "0.9.0"
 slug: visionstate
 description: Teach a local AI to recognise states (open, closed, …), find objects (people, cars, pets) or read numbers in your camera images
 url: https://github.com/oleost/VisionState
diff --git a/visionstate/frontend/e2e/env.ts b/visionstate/frontend/e2e/env.ts
index 9487f73..2907f75 100644
--- a/visionstate/frontend/e2e/env.ts
+++ b/visionstate/frontend/e2e/env.ts
@@ -9,6 +9,8 @@ export const SENSOR_NAME = 'Garage door';
 /** An object sensor looking at a real photo (a person with dogs, see backend/tests/assets). */
 export const OBJECT_SENSOR_NAME = 'Beach';
 export const PHOTO_URL = (name: string) => `${CAMERA_URL}/photo/${name}.jpg`;
+/** An object sensor that recognises faces, looking at two NASA astronauts (public domain); taught one of them. */
+export const FACE_SENSOR_NAME = 'Crew';
 /** A reading sensor looking at a drawn LCD counter. */
 export const READING_SENSOR_NAME = 'Power meter';
 export const DISPLAY_URL = (text: string, style: 'lcd' | 'led' = 'lcd') =>
diff --git a/visionstate/frontend/e2e/helpers.ts b/visionstate/frontend/e2e/helpers.ts
index e5afb78..eb51ab9 100644
--- a/visionstate/frontend/e2e/helpers.ts
+++ b/visionstate/frontend/e2e/helpers.ts
@@ -1,6 +1,6 @@
 // Shared helpers for the UI tests: error collection, layout checks and real touch/mouse gestures.
 import { expect, type APIRequestContext, type Locator, type Page, type TestInfo } from '@playwright/test';
-import { COUNTER_SENSOR_NAME, OBJECT_SENSOR_NAME, READING_SENSOR_NAME, SENSOR_NAME } from './env';
+import { COUNTER_SENSOR_NAME, FACE_SENSOR_NAME, OBJECT_SENSOR_NAME, READING_SENSOR_NAME, SENSOR_NAME } from './env';
 
 export type Point = { x: number; y: number };
 
@@ -113,6 +113,7 @@ export async function seededSensorId(request: APIRequestContext, name = SENSOR_N
 export const seededObjectSensorId = (request: APIRequestContext) => seededSensorId(request, OBJECT_SENSOR_NAME);
 export const seededReadingSensorId = (request: APIRequestContext) => seededSensorId(request, READING_SENSOR_NAME);
 export const seededCounterSensorId = (request: APIRequestContext) => seededSensorId(request, COUNTER_SENSOR_NAME);
+export const seededFaceSensorId = (request: APIRequestContext) => seededSensorId(request, FACE_SENSOR_NAME);
 
 /** API requests per path (without the query) made while `ms` pass on the page. */
 export async function apiRequestsDuring(page: Page, ms: number): Promise<Record<string, number>> {
diff --git a/visionstate/frontend/e2e/promo.mjs b/visionstate/frontend/e2e/promo.mjs
new file mode 100644
index 0000000..a8d3827
--- /dev/null
+++ b/visionstate/frontend/e2e/promo.mjs
@@ -0,0 +1,40 @@
+// The README screenshots (docs/promo/), from an app seeded with scripts/seed_demo.py.
+//   node e2e/promo.mjs [app URL, default http://127.0.0.1:8099] [output folder, default ../../docs/promo]
+// 1440 px wide at device scale 1.2; images in one row of the README get the same height.
+import { chromium } from '@playwright/test';
+import path from 'node:path';
+
+const base = (process.argv[2] ?? 'http://127.0.0.1:8099').replace(/\/$/, '');
+const out = process.argv[3] ?? path.resolve(import.meta.dirname, '..', '..', '..', 'docs', 'promo');
+
+const sensors = await (await fetch(`${base}/api/v1/sensors`)).json();
+const id = (name) => {
+  const sensor = sensors.find((s) => s.name === name);
+  if (!sensor) throw new Error(`No sensor called ${name}: run scripts/seed_demo.py first`);
+  return sensor.id;
+};
+// [page, file, height in CSS pixels]
+const shots = [
+  ['', 'dashboard', 640],
+  [`sensors/${id('Driveway')}`, 'objects', 890],
+  [`sensors/${id('Water meter')}`, 'reading', 790],
+  ['people', 'people', 790],
+];
+
+// A fresh check of every sensor, so none shows "unknown" from before it was trained.
+for (const s of sensors) await fetch(`${base}/api/v1/sensors/${s.id}/classify`, { method: 'POST' });
+await new Promise((resolve) => setTimeout(resolve, 5000));
+
+const browser = await chromium.launch();
+const page = await browser.newPage({ viewport: { width: 1440, height: 1100 }, deviceScaleFactor: 1.2 });
+const errors = [];
+page.on('console', (m) => m.type() === 'error' && errors.push(m.text()));
+for (const [hash, name, height] of shots) {
+  await page.goto(`${base}/#/${hash}`);
+  await page.waitForTimeout(4000); // the live frame and its boxes
+  await page.waitForFunction(() => [...document.images].every((img) => img.complete));
+  await page.screenshot({ path: path.join(out, `${name}.png`), clip: { x: 0, y: 0, width: 1440, height } });
+  console.log(`${name}.png`);
+}
+await browser.close();
+if (errors.length) console.log('Console errors:', errors);
diff --git a/visionstate/frontend/e2e/seed.setup.ts b/visionstate/frontend/e2e/seed.setup.ts
index b680990..f8108e9 100644
--- a/visionstate/frontend/e2e/seed.setup.ts
+++ b/visionstate/frontend/e2e/seed.setup.ts
@@ -6,6 +6,7 @@ import {
   COUNTER_SENSOR_NAME,
   COUNTER_URL,
   DISPLAY_URL,
+  FACE_SENSOR_NAME,
   OBJECT_SENSOR_NAME,
   PHOTO_URL,
   READING_SENSOR_NAME,
@@ -110,3 +111,39 @@ setup('seed a mechanical counter sensor', async ({ request }) => {
     .poll(async () => (await (await request.get(`api/v1/sensors/${sensor.id}`)).json()).reading.value, { timeout: 60_000 })
     .toBe('89.939');
 });
+
+setup('seed a sensor that recognises faces', async ({ request }) => {
+  const created = await request.post('api/v1/sensors', {
+    data: {
+      name: FACE_SENSOR_NAME,
+      kind: 'objects',
+      source_type: 'http',
+      source: PHOTO_URL('face_crew'),
+      objects: { classes: ['person'], faces: { enabled: true, ask_unknown: false } },
+      interval_s: 5,
+    },
+  });
+  expect(created.ok()).toBeTruthy();
+  const sensor = await created.json();
+  type Box = { key: string; score: number; box: number[]; face?: { box?: number[]; problem: string | null } };
+  // The face model loads in the background (it is in the bundled models folder, as in CI: no download).
+  let frameId = '';
+  let people: Box[] = [];
+  await expect
+    .poll(
+      async () => {
+        const view = await (await request.get(`api/v1/sensors/${sensor.id}`)).json();
+        frameId = view.live.frame_id;
+        people = (view.objects.detections as Box[]).filter((d) => d.key === 'person' && d.face?.box && !d.face.problem);
+        return people.length;
+      },
+      { timeout: 120_000 },
+    )
+    .toBe(2);
+  // Suni Williams stands on the left; the test teaches the other one by hand.
+  const left = people.sort((a, b) => a.box[0] - b.box[0])[0];
+  const taught = await request.post(`api/v1/sensors/${sensor.id}/faces`, {
+    data: { frame_id: frameId, box: left.box, score: left.score, new_person: 'Suni' },
+  });
+  expect(taught.ok(), await taught.text()).toBeTruthy();
+});
diff --git a/visionstate/frontend/e2e/ui.spec.ts b/visionstate/frontend/e2e/ui.spec.ts
index dcd222e..0a61357 100644
--- a/visionstate/frontend/e2e/ui.spec.ts
+++ b/visionstate/frontend/e2e/ui.spec.ts
@@ -1,5 +1,5 @@
 // UI tests, run once on desktop (mouse) and once on a phone (touch). See playwright.config.ts.
-import { expect, test, type APIRequestContext, type Page, type TestInfo } from '@playwright/test';
+import { expect, test, type APIRequestContext, type Locator, type Page, type TestInfo } from '@playwright/test';
 import path from 'node:path';
 import { CAMERA_URL, COUNTER_BOX, COUNTER_URL, DISPLAY_URL, PHOTO_URL, READING_SENSOR_NAME } from './env';
 import {
@@ -14,6 +14,7 @@ import {
   isTouch,
   press,
   seededCounterSensorId,
+  seededFaceSensorId,
   seededObjectSensorId,
   seededReadingSensorId,
   seededSensorId,
@@ -21,12 +22,19 @@ import {
   watchErrors,
 } from './helpers';
 
+/** Scrolls to the middle of the screen first, so a tap never lands under the sticky top bar. */
+async function pressCentered(locator: Locator, info: TestInfo) {
+  await locator.evaluate((el) => el.scrollIntoView({ block: 'center' }));
+  await press(locator, info);
+}
+
 /** Every page: [screenshot name, route, text that shows it is ready]. */
 async function allPages(request: APIRequestContext): Promise<[string, string, RegExp | string][]> {
   const id = await seededSensorId(request);
   const objectId = await seededObjectSensorId(request);
   const readingId = await seededReadingSensorId(request);
   const counterId = await seededCounterSensorId(request);
+  const faceId = await seededFaceSensorId(request);
   return [
     ['dashboard', '', 'Sensors'],
     ['new-sensor', 'sensors/new', 'Name it and pick a camera'],
@@ -44,6 +52,10 @@ async function allPages(request: APIRequestContext): Promise<[string, string, Re
     ['reading-settings', `sensors/${readingId}/settings`, 'Digits after the decimal point'],
     ['reading-quality', `sensors/${readingId}/quality`, 'Readings per day'],
     ['counter-live', `sensors/${counterId}/live`, 'One wheel per field'],
+    ['faces-live', `sensors/${faceId}/live`, 'Unknown person'],
+    ['faces-settings', `sensors/${faceId}/settings`, 'Ask me about faces I do not know'],
+    ['faces-quality', `sensors/${faceId}/quality`, 'Shared by every camera that recognises faces'],
+    ['people', 'people', 'The people you named by their face'],
     ['counter-settings', `sensors/${counterId}/settings`, 'Number of digits'],
     ['review', 'review', 'Frames the AI was unsure about'],
     ['history-all', 'history', 'What every sensor recorded'],
@@ -52,6 +64,7 @@ async function allPages(request: APIRequestContext): Promise<[string, string, Re
 }
 
 test('every page renders without errors and fits the screen', async ({ page, request }, info) => {
+  test.setTimeout(180_000); // every page, with a full-page screenshot each
   const pages = await allPages(request);
   // Native parts of controls are drawn dark (Safari shows light select menus with light text otherwise).
   await page.goto('#/');
@@ -88,6 +101,7 @@ const expectCalm = (counts: Record<string, number>) =>
   expect.soft(Object.entries(counts).filter(([, n]) => n > MAX_PER_PATH), JSON.stringify(counts)).toEqual([]);
 
 test('no page asks the server more often than it polls', async ({ page, request }) => {
+  test.setTimeout(180_000); // every page, 4 s each
   for (const [name, route, ready] of await allPages(request)) {
     await test.step(name, async () => {
       await page.goto(`#/${route}`);
@@ -204,6 +218,7 @@ test('new sensor wizard creates a sensor', async ({ page, request }, info) => {
 
   const image = page.locator('.roi img');
   await expect(image).toBeVisible();
+  await expect(page.getByTestId('low-stream')).toHaveCount(0); // 1280 × 720: no warning
   const box = (await image.boundingBox())!;
   await drag(page, info, { x: box.x + box.width * 0.2, y: box.y + box.height * 0.2 }, { x: box.x + box.width * 0.8, y: box.y + box.height * 0.9 });
   await expect(page.locator('.handle.corner')).toHaveCount(4);
@@ -240,6 +255,9 @@ test('new object sensor through the wizard', async ({ page, request }, info) =>
   await page.getByLabel('Source URL').fill(PHOTO_URL('driveway'));
   await press(page.getByRole('button', { name: 'Next' }), info);
   await expect(page.locator('.roi img')).toBeVisible();
+  // A small picture: maybe the camera's low-resolution stream.
+  await expect(page.getByTestId('low-stream')).toContainText('640×421');
+  await expectNoClipping(page, '.notice');
   await press(page.getByRole('button', { name: 'Next' }), info); // whole frame
 
   await press(page.getByRole('radio', { name: /Objects/ }), info);
@@ -252,6 +270,17 @@ test('new object sensor through the wizard', async ({ page, request }, info) =>
   await page.getByPlaceholder(/Search \d+ objects/).fill('bicy');
   await expect(page.getByRole('button', { name: 'Bicycle' })).toHaveCount(1);
   await expect(page.getByText('binary_sensor.driveway_test_car')).toBeVisible();
+  // With Person: recognising faces can be turned on here, after the same confirmation.
+  const faces = page.getByTestId('wizard-faces').getByRole('checkbox');
+  await expect(faces).not.toBeChecked();
+  await pressCentered(faces, info);
+  const sheet = page.getByRole('dialog', { name: 'Recognise faces' });
+  await expect(sheet.getByText(/It is not a lock/)).toBeVisible();
+  await press(sheet.getByRole('button', { name: 'Cancel' }), info);
+  await expect(faces).not.toBeChecked();
+  await pressCentered(faces, info);
+  await press(sheet.getByRole('button', { name: /^(Turn on|Download and turn on)$/ }), info);
+  await expect(faces).toBeChecked();
   await expectNoHorizontalOverflow(page);
   await page.screenshot({ path: path.join('test-results', 'pages', info.project.name, 'wizard-objects.png'), fullPage: true });
   await expectNoClipping(page, '.btn, .chip-btn, .kind, .card');
@@ -262,6 +291,8 @@ test('new object sensor through the wizard', async ({ page, request }, info) =>
   await expect(page.getByText('Right now')).toBeVisible();
   await expect(page.locator('.count.on').first()).toBeVisible({ timeout: 60_000 });
   const sensorId = Number(page.url().match(/sensors\/(\d+)\//)![1]);
+  const made = await (await request.get(`api/v1/sensors/${sensorId}`)).json();
+  expect(made.objects.faces).toEqual({ enabled: true, ask_unknown: false });
   errors.expectNone();
   await page.goto('about:blank');
   await request.delete(`api/v1/sensors/${sensorId}`);
@@ -658,12 +689,51 @@ test('teaching an object sensor: correct a box, draw a missed one, forget it all
     await expectNoClipping(page, '.btn, .chip, .card');
     await page.screenshot({ path: path.join('test-results', 'pages', info.project.name, 'objects-quality.png'), fullPage: true });
 
-    // Settings: turn it off or forget it all; then the Quality tab goes away again.
+    // Taught from a history frame: its entry says so from then on.
+    await page.goto(`#/sensors/${id}/history`);
+    const dogRow = page.getByRole('button', { name: /Dog detected/ }).first();
+    await expect(dogRow).toBeVisible({ timeout: 15_000 });
+    // The thumbnails load first, or the list moves under the tap on a phone; and the toast from
+    // teaching the missed box covers the bottom of a phone screen for a while.
+    await page.waitForFunction(() => [...document.images].every((img) => img.complete || img.loading === 'lazy'));
+    await expect(page.getByRole('button', { name: 'Dismiss' })).toHaveCount(0, { timeout: 20_000 });
+    await press(dogRow, info);
+    await expect(page.locator('.full .box').first()).toBeVisible();
+    await press(page.locator('.full button.found', { hasText: 'Dog' }).first(), info);
+    await press(sheet.getByRole('button', { name: 'Correct' }), info);
+    await expect(page.getByTestId('history-taught').first()).toContainText('Taught: Dog');
+    await expectNoHorizontalOverflow(page);
+
+    // Settings: its own teaching limits. Until set, a field shows the global value in grey.
     await page.goto(`#/sensors/${id}/settings`);
     await expect(page.getByText('Use what you taught')).toBeVisible();
     // The region's camera frame loads above: wait for it, or the page moves under the tap.
     await expect(page.locator('.roi img')).toBeVisible();
     await page.waitForFunction(() => [...document.images].every((img) => img.complete));
+    const global = await (await request.get('api/v1/teach-limits')).json();
+    const limits = page.getByTestId('sensor-teach-limits');
+    const match = limits.getByRole('spinbutton', { name: 'Recognised as a box you taught from' });
+    await expect(match).toHaveValue('');
+    await expect(match).toHaveAttribute('placeholder', String(Math.round(global.effective.match_similarity * 100)));
+    await expect(limits.getByRole('button', { name: /^Use the global value/ }).first()).toBeHidden();
+    await expectNoHorizontalOverflow(page);
+    await expectNoClipping(page, '.btn, .card');
+    await match.fill('80');
+    // The toast from teaching the missed box still covers the bottom of a phone screen: let it go.
+    await expect(page.getByRole('button', { name: 'Dismiss' })).toHaveCount(0, { timeout: 20_000 });
+    await pressCentered(page.getByRole('button', { name: 'Save changes' }), info);
+    await expect(page.getByText('Settings saved')).toBeVisible();
+    expect((await (await request.get(`api/v1/sensors/${id}`)).json()).objects.teach).toEqual({ match_similarity: 0.8 });
+    await page.reload();
+    await expect(match).toHaveValue('80');
+    await match.scrollIntoViewIfNeeded();
+    await page.screenshot({ path: path.join('test-results', 'pages', info.project.name, 'objects-teach-limits.png'), fullPage: true });
+    await pressCentered(limits.getByRole('button', { name: /^Use the global value/ }), info);
+    await expect(match).toHaveValue('');
+    await pressCentered(page.getByRole('button', { name: 'Save changes' }), info);
+    await expect.poll(async () => (await (await request.get(`api/v1/sensors/${id}`)).json()).objects.teach).toEqual({});
+
+    // Turn it off or forget it all; then the Quality tab goes away again.
     await press(page.getByRole('button', { name: 'Forget all' }), info);
     await press(page.getByRole('button', { name: 'Tap again to forget everything taught' }), info);
     await expect(page.getByText('Everything taught is forgotten')).toBeVisible();
@@ -1022,6 +1092,64 @@ test('the wheel reader shows in Settings and is offered to counters read as text
   }
 });
 
+test('the AI models can be compared, and the teaching and face limits set for all object sensors', async ({ page, request }, info) => {
+  const errors = watchErrors(page);
+  try {
+    await page.goto('#/settings');
+    await press(page.getByRole('button', { name: 'Compare and manage the models' }), info);
+    const compare = page.getByTestId('model-compare');
+    await expect(compare.getByText('D-FINE L (most accurate)')).toBeVisible();
+    await expect(compare.getByText('DINOv2 base · fp32 (most accurate)')).toBeVisible();
+    await expect(compare.getByText('AuraFace v1 (accurate)')).toBeVisible();
+    await expect(compare.getByText(/· in use$/)).toHaveCount(5); // one per kind
+    // From the smallest to the largest, in every kind.
+    const settings = await (await request.get('api/v1/settings')).json();
+    const smallest = [...settings.detectors].sort((a, b) => a.size - b.size)[0].name;
+    await expect(compare.locator('.kind').nth(1).locator('.name').first()).toContainText(smallest);
+    await expectNoHorizontalOverflow(page);
+    await expectNoClipping(page, '.btn, .card');
+
+    const view = await (await request.get('api/v1/teach-limits')).json();
+    const card = page.getByTestId('teach-limits');
+    const ask = card.getByRole('spinbutton', { name: 'Asks you in the review queue from' });
+    await expect(ask).toHaveValue('');
+    await expect(ask).toHaveAttribute('placeholder', String(Math.round(view.defaults.ask_similarity * 100)));
+    const save = card.getByRole('button', { name: 'Save teaching limits' });
+    await expect(save).toBeDisabled(); // nothing changed yet
+    await ask.fill('95'); // above "Recognised as…": not allowed
+    await expect(card.getByText('must not be above the first')).toBeVisible();
+    await ask.fill('70');
+    await expect(card.getByText('must not be above the first')).toBeHidden();
+    await pressCentered(save, info);
+    await expect(page.getByText('Teaching limits saved')).toBeVisible();
+    expect((await (await request.get('api/v1/teach-limits')).json()).values.ask_similarity).toBe(0.7);
+    await card.scrollIntoViewIfNeeded();
+    await page.screenshot({ path: path.join('test-results', 'pages', info.project.name, 'settings-models.png'), fullPage: true });
+    await pressCentered(card.getByRole('button', { name: /^Use the default of/ }), info);
+    await expect(ask).toHaveValue('');
+    await pressCentered(save, info);
+    await expect.poll(async () => (await (await request.get('api/v1/teach-limits')).json()).values.ask_similarity).toBeNull();
+
+    // Faces: the face model's defaults, a smallest face for every sensor, nonsense refused.
+    const faces = page.getByTestId('face-limits');
+    const smallestFace = faces.getByRole('spinbutton', { name: 'Smallest face' });
+    const faceView = await (await request.get('api/v1/face-limits')).json();
+    await expect(smallestFace).toHaveAttribute('placeholder', String(faceView.defaults.min_face_px));
+    await faces.getByRole('spinbutton', { name: 'Asks you in the review queue from' }).fill('95');
+    await expect(faces.getByText(/must not be above “Recognised as a person”/)).toBeVisible();
+    await faces.getByRole('spinbutton', { name: 'Asks you in the review queue from' }).fill('');
+    await smallestFace.fill('40');
+    await pressCentered(faces.getByRole('button', { name: 'Save face limits' }), info);
+    await expect(page.getByText('Face limits saved')).toBeVisible();
+    expect((await (await request.get('api/v1/face-limits')).json()).values.min_face_px).toBe(40);
+    await expectNoHorizontalOverflow(page);
+    errors.expectNone();
+  } finally {
+    await request.put('api/v1/teach-limits', { data: {} });
+    await request.put('api/v1/face-limits', { data: {} });
+  }
+});
+
 test('storage limits can be changed', async ({ page }, info) => {
   const errors = watchErrors(page);
   await page.goto('#/settings');
@@ -1177,3 +1305,90 @@ test('an answer in the review queue can be changed from the list', async ({ page
   await expectNoHorizontalOverflow(page);
   errors.expectNone();
 });
+
+test('faces: turned on with a confirmation, a person taught from the Live tab, shown under Quality', async ({ page, request }, info) => {
+  const errors = watchErrors(page);
+  const faceId = await seededFaceSensorId(request);
+  // Each device runs this against the same backend: start without the person it teaches.
+  for (const key of ['butch', 'kari']) {
+    const del = await request.delete(`api/v1/people/${key}`);
+    expect([204, 404]).toContain(del.status());
+  }
+
+  // Turning it on asks first, and says what is stored and downloaded.
+  const beach = await seededObjectSensorId(request);
+  await page.goto(`#/sensors/${beach}/settings`);
+  const card = page.getByTestId('faces-card');
+  await expect(card.getByText('Recognise people by their face')).toBeVisible();
+  await pressCentered(card.getByRole('button', { name: 'Turn on…' }), info);
+  const sheet = page.getByRole('dialog', { name: 'Recognise faces' });
+  await expect(sheet.getByText(/not the media folder/)).toBeVisible();
+  await expect(sheet.getByText(/It is not a lock/)).toBeVisible();
+  await expectNoHorizontalOverflow(page);
+  await press(sheet.getByRole('button', { name: /^(Turn on|Download and turn on)$/ }), info);
+  await expect(card.getByText('Ask me about faces I do not know')).toBeVisible();
+  // Its own limits follow the global ones until set.
+  const own = card.getByTestId('sensor-face-limits').getByRole('spinbutton', { name: 'Smallest face' });
+  await expect(own).toHaveValue('');
+  const global = await (await request.get('api/v1/face-limits')).json();
+  await expect(own).toHaveAttribute('placeholder', String(global.effective.min_face_px));
+  await expectNoClipping(page, '.btn, .card');
+  await pressCentered(card.getByRole('checkbox', { name: /Recognise faces/ }), info);
+  await expect(card.getByRole('button', { name: 'Turn on…' })).toBeVisible();
+  // Its toast sits at the bottom of a phone's screen, where the teach sheet's buttons come below.
+  await expect(page.getByText('Face recognition is off')).toHaveCount(0, { timeout: 15_000 });
+
+  // The Live tab: faces drawn in the person boxes, the known one named, the other unknown.
+  await page.goto(`#/sensors/${faceId}/live`);
+  await expect(page.locator('.roi .face').first()).toBeVisible({ timeout: 30_000 });
+  await expect(page.getByText('Person · Suni').first()).toBeVisible({ timeout: 30_000 });
+  // Tap the person nobody named (an unknown person after two checks): "Who is this?" with a new person.
+  await pressCentered(page.locator('button.found', { hasText: /Unknown person|^\s*Person/ }).first(), info);
+  const teach = page.getByRole('dialog', { name: 'Teach this box' });
+  await expect(teach.getByText('Who is this?')).toBeVisible();
+  await press(teach.getByRole('button', { name: 'New person…' }), info);
+  await teach.getByPlaceholder('Name').fill('Butch');
+  await press(teach.getByRole('button', { name: 'Add person' }), info);
+  await expect(page.getByText(/Got it: this is Butch \(1 face\)/)).toBeVisible();
+  await expect(page.getByText('Person · Butch').first()).toBeVisible({ timeout: 30_000 });
+
+  // Quality: one card per person, with their faces.
+  await page.goto(`#/sensors/${faceId}/quality`);
+  const people = page.getByTestId('people');
+  await expect(people).toBeVisible();
+  await expect(page.getByRole('heading', { name: /^Butch/ })).toBeVisible();
+  await expect(page.getByRole('img', { name: 'A face of Butch' })).toBeVisible();
+  await expectNoHorizontalOverflow(page);
+  await expectNoClipping(page, '.btn, .butch');
+
+  // People: shared by every camera, renamed there (the entity IDs stay).
+  await press(page.getByRole('link', { name: 'People' }), info);
+  await expect(page).toHaveURL(/#\/people$/);
+  const butch = page.locator('section.person', { has: page.getByRole('heading', { name: /^Butch/ }) });
+  await expect(butch.getByText(/Seen now on Crew|Last seen .* on Crew/)).toBeVisible({ timeout: 30_000 });
+  await expect(butch.getByText(/· Crew/).first()).toBeVisible(); // the camera each face was taught on
+  const rename = page.locator('form.rename'); // the heading becomes the name field
+  await expect(async () => {
+    await pressCentered(butch.getByRole('button', { name: 'Rename' }), info); // a tap after scrolling can be lost
+    await expect(rename).toBeVisible({ timeout: 2_000 });
+  }).toPass();
+  await rename.getByLabel('Name').fill('Butch W');
+  await press(rename.getByRole('button', { name: 'Save' }), info);
+  await expect(page.getByText('Butch is now Butch W')).toBeVisible();
+  await expect(page.getByRole('heading', { name: /^Butch W/ })).toBeVisible();
+  expect((await (await request.get('api/v1/people')).json()).people.map((p: { key: string }) => p.key)).toContain('butch');
+
+  // Photos from the phone: more of a person, and a new person (the photo picker is a file input).
+  const assets = path.join('..', 'backend', 'tests', 'assets');
+  await page.locator('#photos-butch').setInputFiles(path.join(assets, 'face_wilmore.jpg'));
+  await expect(page.getByText('1 face added to Butch W')).toBeVisible({ timeout: 30_000 });
+  await expect(butch.getByText(/· photo/)).toBeVisible();
+  const add = page.getByTestId('add-person');
+  await add.getByLabel('Name of the new person').fill('Kari');
+  await add.locator('input[type=file]').setInputFiles(path.join(assets, 'face_williams_2018.jpg'));
+  await expect(page.getByText('1 face added to Kari')).toBeVisible({ timeout: 30_000 });
+  await expect(page.getByRole('heading', { name: /^Kari/ })).toBeVisible();
+  await expectNoHorizontalOverflow(page);
+  await expectNoClipping(page, '.btn, .butch');
+  errors.expectNone();
+});
diff --git a/visionstate/frontend/src/App.svelte b/visionstate/frontend/src/App.svelte
index 7fe590e..b61e49f 100644
--- a/visionstate/frontend/src/App.svelte
+++ b/visionstate/frontend/src/App.svelte
@@ -8,6 +8,7 @@
   import Dashboard from './pages/Dashboard.svelte';
   import History from './pages/History.svelte';
   import NewSensor from './pages/NewSensor.svelte';
+  import People from './pages/People.svelte';
   import Review from './pages/Review.svelte';
   import SensorPage from './pages/SensorPage.svelte';
   import Settings from './pages/Settings.svelte';
@@ -39,6 +40,8 @@
     <Review />
   {:else if section === 'history'}
     <History />
+  {:else if section === 'people'}
+    <People />
   {:else if section === 'settings'}
     <Settings />
   {:else}
diff --git a/visionstate/frontend/src/lib/api.ts b/visionstate/frontend/src/lib/api.ts
index dfcab90..0199f82 100644
--- a/visionstate/frontend/src/lib/api.ts
+++ b/visionstate/frontend/src/lib/api.ts
@@ -1,6 +1,15 @@
 // Typed client for the backend. Every URL the UI uses is built here.
 import type {
   AppConfig,
+  ObjectSettings,
+  FaceLimitsInfo,
+  FaceOverrides,
+  FaceProblem,
+  FaceStatus,
+  ImportResult,
+  ModelKind,
+  People,
+  PhotoResult,
   Camera,
   Detection,
   HaEntity,
@@ -24,6 +33,8 @@ import type {
   Status,
   StorageInfo,
   Taught,
+  TeachLimitsInfo,
+  TeachOverrides,
   TeachInput,
 } from './types';
 
@@ -89,6 +100,13 @@ export interface HistoryPageOptions {
   newerThan?: string | null;
 }
 
+/** A person box on the frame a check analysed, or on a history frame. */
+export interface FaceBoxInput {
+  frame_id?: string;
+  history_id?: number;
+  box: [number, number, number, number];
+}
+
 export interface Frame {
   frameId: string | null;
   url: string; // object URL; caller revokes it
@@ -110,7 +128,7 @@ export const api = {
   config: () => request<AppConfig>('config'),
   status: () => request<Status>('status'),
   settings: () => request<SettingsInfo>('settings'),
-  saveSettings: (body: { backbone: string; detector?: string; reader?: string }) =>
+  saveSettings: (body: { backbone: string; detector?: string; reader?: string; face_model?: string }) =>
     request<SettingsInfo>('settings', send('PUT', body)),
   storage: () => request<StorageInfo>('storage'),
   saveStorage: (body: { history_days: number; history_max_gb: number }) =>
@@ -132,7 +150,11 @@ export const api = {
   sensors: () => request<Sensor[]>('sensors'),
   sensor: (id: number) => request<Sensor>(`sensors/${id}`),
   createSensor: (body: SensorInput) => request<Sensor>('sensors', send('POST', body)),
-  updateSensor: (id: number, body: Partial<SensorInput> & { clear_roi?: boolean }) =>
+  /** `objects` is merged into what the sensor has: only the fields sent change. */
+  updateSensor: (
+    id: number,
+    body: Partial<Omit<SensorInput, 'objects'>> & { objects?: Partial<ObjectSettings>; clear_roi?: boolean },
+  ) =>
     request<Sensor>(`sensors/${id}`, send('PATCH', body)),
   deleteSensor: (id: number) => request<void>(`sensors/${id}`, send('DELETE')),
   classify: (id: number) => request(`sensors/${id}/classify`, send('POST')),
@@ -200,8 +222,10 @@ export const api = {
   historyFacets: (filter: HistoryFilter) => request<HistoryFacets>(`history/facets?${listQs({ ...filter })}`),
   historyImageUrl: (predictionId: number, size: 'thumb' | 'full' = 'full') =>
     `${BASE}history/${predictionId}/image?size=${size}`,
-  exportUrl: (id: number) => `${BASE}sensors/${id}/export`,
+  exportUrl: (id: number, faces = false) => `${BASE}sensors/${id}/export${faces ? '?faces=true' : ''}`,
 
+  teachLimits: () => request<TeachLimitsInfo>('teach-limits'),
+  saveTeachLimits: (values: TeachOverrides) => request<TeachLimitsInfo>('teach-limits', send('PUT', values)),
   reviewRules: () => request<ReviewRules>('review-rules'),
   saveReviewRules: (rules: ReviewRules) => request<ReviewRules>('review-rules', send('PUT', rules)),
   reviewReminder: () => request<ReminderInfo>('review-reminder'),
@@ -218,6 +242,9 @@ export const api = {
   /** An object sensor's question: is this box the own label it asks about? The answer is taught. */
   answerQuestion: (predictionId: number, action: 'yes' | 'no' | 'skip') =>
     request(`review/${predictionId}`, send('POST', { action })),
+  /** A question about a face: yes, it is another person (`person`), a new person (`name`), or no/skip. */
+  answerFace: (predictionId: number, action: 'yes' | 'no' | 'skip' | 'person' | 'new', person?: string, name?: string) =>
+    request(`review/${predictionId}`, send('POST', { action, state_key: person ?? null, value: name ?? null })),
   /** A reading: did the reader read the right number? `value` = the right one, when it misread. */
   verifyReading: (predictionId: number, action: 'read_ok' | 'misread' | 'skip', value?: string) =>
     request(`review/${predictionId}`, send('POST', { action, value: value || null })),
@@ -236,9 +263,41 @@ export const api = {
   forgetAll: (id: number) => request<void>(`sensors/${id}/taught`, send('DELETE')),
   removeLabel: (id: number, key: string) => request<void>(`sensors/${id}/labels/${encodeURIComponent(key)}`, send('DELETE')),
 
+  /** Faces: taught on a sensor; the people (shared by every sensor), renamed, moved and forgotten. */
+  people: () => request<People>('people'),
+  checkFace: (id: number, body: FaceBoxInput) =>
+    request<{ face: [number, number, number, number] | null; problem: FaceProblem | null; message: string }>(
+      `sensors/${id}/faces/check`,
+      send('POST', body),
+    ),
+  teachFace: (id: number, body: FaceBoxInput & { score?: number | null; person?: string; new_person?: string }) =>
+    request<{ id: number; label: string; name: string; faces: number }>(`sensors/${id}/faces`, send('POST', body)),
+  faceImageUrl: (faceId: number) => `${BASE}faces/${faceId}/image`,
+  moveFace: (faceId: number, person: string) => request(`faces/${faceId}`, send('PATCH', { person })),
+  forgetFace: (faceId: number) => request<void>(`faces/${faceId}`, send('DELETE')),
+  renamePerson: (key: string, name: string) =>
+    request<{ key: string; name: string }>(`people/${encodeURIComponent(key)}`, send('PATCH', { name })),
+  /** A person (or, without a key, everyone) with their faces and entities on every sensor. */
+  forgetPerson: (key: string) => request<void>(`people/${encodeURIComponent(key)}`, send('DELETE')),
+  forgetPeople: () => request<void>('people', send('DELETE')),
+  /** Faces from photos or short videos (a phone's camera or gallery) for a person or a new one. */
+  addPhotos(who: { person: string } | { new_person: string }, files: File[]) {
+    const form = new FormData();
+    files.forEach((f) => form.append('files', f, f.name));
+    if ('person' in who) form.append('person', who.person);
+    else form.append('new_person', who.new_person);
+    return request<PhotoResult>('people/photos', { method: 'POST', body: form });
+  },
+  retryFaces: () => request<FaceStatus>('faces/retry', send('POST')),
+  faceLimits: () => request<FaceLimitsInfo>('face-limits'),
+  saveFaceLimits: (values: FaceOverrides) => request<FaceLimitsInfo>('face-limits', send('PUT', values)),
+  /** Delete a downloaded AI model that is not in use; `kind` is its list in GET /settings. */
+  deleteModel: (kind: ModelKind, id: string) =>
+    request<SettingsInfo>(`models/${kind}/${encodeURIComponent(id)}`, send('DELETE')),
+
   importBundle(file: File) {
     const form = new FormData();
     form.append('file', file, file.name);
-    return request<{ id: number; skipped: number }>('import', { method: 'POST', body: form });
+    return request<ImportResult>('import', { method: 'POST', body: form });
   },
 };
diff --git a/visionstate/frontend/src/lib/app.svelte.ts b/visionstate/frontend/src/lib/app.svelte.ts
index be0437d..96e93a0 100644
--- a/visionstate/frontend/src/lib/app.svelte.ts
+++ b/visionstate/frontend/src/lib/app.svelte.ts
@@ -1,6 +1,7 @@
 // Global app state: server config, status and toasts.
 import { api } from './api';
-import type { AppConfig, Sensor, StateDef, Status } from './types';
+import { plural } from './format';
+import type { AppConfig, ImportResult, Sensor, StateDef, Status } from './types';
 import { TOAST_MAX, TOAST_MS } from './ui';
 
 export const app = $state<{ config: AppConfig | null; status: Status | null; error: string }>({
@@ -44,6 +45,19 @@ export function dismiss(id: number): void {
   if (index >= 0) toasts.splice(index, 1);
 }
 
+/** What an import brought: unreadable images it skipped, and face recognition to turn on again (it
+ * is off after an import, so it gets its own confirmation here). */
+export function toastImported(result: ImportResult): void {
+  const skipped = result.skipped ? `; ${plural(result.skipped, 'unreadable image')} skipped` : '';
+  if (result.faces_off) {
+    toast(`Sensor imported${skipped}. It recognised faces where it came from: turn Recognise faces on below.`, {
+      tone: 'warn',
+    });
+  } else {
+    toast(`Sensor imported${skipped}`);
+  }
+}
+
 export function toastError(err: unknown): void {
   toast((err as Error).message || 'Something went wrong', { tone: 'danger' });
 }
diff --git a/visionstate/frontend/src/lib/components/DetectionBoxes.svelte b/visionstate/frontend/src/lib/components/DetectionBoxes.svelte
index d17987d..2a7ece9 100644
--- a/visionstate/frontend/src/lib/components/DetectionBoxes.svelte
+++ b/visionstate/frontend/src/lib/components/DetectionBoxes.svelte
@@ -3,7 +3,8 @@
   // positioned frame). Boxes are normalised to the whole frame. Labels never overlap: the most
   // certain object gets its label above the box, the next one inside the box if that is free,
   // and a label that fits nowhere is left out (the box stays). Boxes filtered away by what the
-  // sensor was taught are dashed and grey. With `onpick`, every box can be tapped.
+  // sensor was taught are dashed and grey. With `onpick`, every box can be tapped. A face found in a
+  // person box (a sensor that recognises faces) is drawn as a small rounded box inside it.
   import { pct } from '../format';
   import { boxName, objectColor } from '../objects';
   import type { Detection, OwnLabel } from '../types';
@@ -92,6 +93,19 @@
       </div>
     {/if}
   {/each}
+  {#each detections as d, i (i)}
+    {#if d.face?.box && !d.filtered}
+      <div
+        class="face"
+        class:unusable={!!d.face.problem}
+        style:left="{d.face.box[0] * 100}%"
+        style:top="{d.face.box[1] * 100}%"
+        style:width="{(d.face.box[2] - d.face.box[0]) * 100}%"
+        style:height="{(d.face.box[3] - d.face.box[1]) * 100}%"
+        style:--c={objectColor(classes, d.label ?? d.key)}
+      ></div>
+    {/if}
+  {/each}
 </div>
 
 <style>
@@ -137,6 +151,16 @@
     line-height: 15px;
     white-space: nowrap;
   }
+  .face {
+    position: absolute;
+    border: 2px solid var(--c);
+    border-radius: 40%;
+    box-shadow: 0 0 0 1px rgba(0, 0, 0, 0.35);
+  }
+  .face.unusable {
+    border-style: dotted;
+    opacity: 0.7;
+  }
   .tag.inside {
     bottom: auto;
     top: -2px;
diff --git a/visionstate/frontend/src/lib/components/ExportButton.svelte b/visionstate/frontend/src/lib/components/ExportButton.svelte
new file mode 100644
index 0000000..0466527
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/ExportButton.svelte
@@ -0,0 +1,54 @@
+<script lang="ts">
+  // Export a sensor as a bundle to import elsewhere. A sensor where faces were taught asks first
+  // whether to include them (unticked by default), with the names of their people.
+  import { api } from '../api';
+  import type { Sensor } from '../types';
+  import Icon from './Icon.svelte';
+
+  let { sensor }: { sensor: Sensor } = $props();
+
+  const faces = $derived(sensor.objects?.taught_faces ?? 0);
+  let open = $state(false);
+  let withFaces = $state(false);
+</script>
+
+{#if !faces}
+  <a class="btn sm" href={api.exportUrl(sensor.id)} download><Icon name="download" size={14} /> Export</a>
+{:else}
+  <span class="wrap">
+    <button class="btn sm" onclick={() => (open = !open)} aria-expanded={open}>
+      <Icon name="download" size={14} /> Export
+    </button>
+    {#if open}
+      <div class="pop card pad col" role="dialog" aria-label="Export">
+        <label class="check small">
+          <input type="checkbox" bind:checked={withFaces} />
+          Include the faces taught on this camera ({faces})
+        </label>
+        <span class="xsmall faint">With the names of their people; an import adds them to the people there.</span>
+        <a class="btn sm primary" href={api.exportUrl(sensor.id, withFaces)} download onclick={() => (open = false)}>
+          <Icon name="download" size={14} /> Download
+        </a>
+      </div>
+    {/if}
+  </span>
+{/if}
+
+<style>
+  .wrap {
+    position: relative;
+    display: inline-flex;
+  }
+  .pop {
+    position: absolute;
+    right: 0;
+    top: calc(100% + 6px);
+    z-index: 30;
+    width: min(280px, calc(100vw - 32px));
+    gap: var(--space-2);
+    box-shadow: 0 12px 40px rgba(0, 0, 0, 0.5);
+  }
+  .pop .btn {
+    align-self: flex-start;
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/FaceConsent.svelte b/visionstate/frontend/src/lib/components/FaceConsent.svelte
new file mode 100644
index 0000000..36a9947
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/FaceConsent.svelte
@@ -0,0 +1,125 @@
+<script lang="ts">
+  // Before face recognition is turned on for a sensor: what it does, what is stored and what is
+  // downloaded, said plainly. Nothing is downloaded until the user confirms. The model's name,
+  // licence, size and source come from the backend (GET /settings). A bottom sheet on phones.
+  import { onMount } from 'svelte';
+  import { size } from '../format';
+  import type { FaceModelInfo } from '../types';
+  import Icon from './Icon.svelte';
+
+  let {
+    name,
+    model,
+    onclose,
+    onconfirm,
+  }: {
+    /** The sensor's name ("" while it is being made). */
+    name: string;
+    model: FaceModelInfo | null;
+    onclose: () => void;
+    onconfirm: () => void;
+  } = $props();
+
+  let panel: HTMLDivElement;
+  onMount(() => panel?.querySelector<HTMLElement>('button.first')?.focus());
+
+  function keydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') onclose();
+  }
+</script>
+
+<svelte:window onkeydown={keydown} />
+
+<div class="backdrop" onclick={onclose} role="presentation"></div>
+<div class="sheet" role="dialog" aria-modal="true" aria-label="Recognise faces" bind:this={panel}>
+  <div class="row head">
+    <strong>Recognise faces{name ? ` on ${name}` : ''}?</strong>
+    <span class="spacer"></span>
+    <button class="btn ghost icon close" onclick={onclose} aria-label="Close"><Icon name="x" /></button>
+  </div>
+  <ul class="small">
+    <li>
+      Faces are looked for only in the people this sensor finds, and compared with faces <strong>you</strong> name —
+      the people are shared: those you named on other cameras are known here too.
+    </li>
+    <li>
+      Stored on this Home Assistant only, in the app's own storage (not the media folder, and in its backups): a small
+      picture of each face you teach. Faces of people you have not named are not kept, apart from the normal history
+      frames. The people you teach should know about it.
+    </li>
+    {#if model}
+      <li>
+        Needs the face model <em>{model.name}</em> with {model.detector.name} ({model.license} and {model.detector.license}{model.installed
+          ? ', already downloaded'
+          : `, ${size(model.size)} downloaded once from Hugging Face`}). {model.data} {model.detector.data}
+      </li>
+    {/if}
+    <li>Cameras that see a street or a neighbour's door may need their consent where you live.</li>
+    <li>It is not a lock: a photo of a face looks like that face. Do not unlock doors or disarm alarms on it alone.</li>
+  </ul>
+  <span class="xsmall faint">More in the app's Documentation tab.</span>
+  <div class="row actions">
+    <button class="btn primary first" onclick={onconfirm}>{model?.installed ? 'Turn on' : 'Download and turn on'}</button>
+    <button class="btn" onclick={onclose}>Cancel</button>
+  </div>
+</div>
+
+<style>
+  .backdrop {
+    position: fixed;
+    inset: 0;
+    z-index: 40;
+    background: rgba(5, 7, 9, 0.6);
+  }
+  .sheet {
+    position: fixed;
+    z-index: 41;
+    left: 50%;
+    top: 50%;
+    transform: translate(-50%, -50%);
+    width: min(480px, calc(100vw - 32px));
+    max-height: calc(100vh - 48px);
+    overflow-y: auto;
+    background: var(--c-surface);
+    border: 1px solid var(--c-border-strong);
+    border-radius: var(--radius-lg);
+    padding: var(--space-4);
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-3);
+    box-shadow: 0 12px 40px rgba(0, 0, 0, 0.5);
+  }
+  @media (max-width: 600px) {
+    .sheet {
+      left: 0;
+      right: 0;
+      top: auto;
+      bottom: 0;
+      transform: none;
+      width: auto;
+      max-height: 85vh;
+      border-radius: var(--radius-lg) var(--radius-lg) 0 0;
+      padding-bottom: calc(var(--space-4) + env(safe-area-inset-bottom));
+    }
+  }
+  .head {
+    align-items: flex-start;
+    gap: var(--space-3);
+  }
+  .close {
+    flex-shrink: 0;
+    margin: -6px -6px 0 0;
+  }
+  ul {
+    margin: 0;
+    padding-left: 1.2em;
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-2);
+    color: var(--c-text-2);
+  }
+  .actions {
+    gap: var(--space-2);
+    margin-top: var(--space-2);
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/FaceLimitsEditor.svelte b/visionstate/frontend/src/lib/components/FaceLimitsEditor.svelte
new file mode 100644
index 0000000..b4462fd
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/FaceLimitsEditor.svelte
@@ -0,0 +1,39 @@
+<script lang="ts">
+  // Edits the face limits: the smallest face and the similarities. An empty field inherits (shown
+  // in grey): on the Settings page the face model's default, on a sensor the global value.
+  import { app } from '../app.svelte';
+  import type { FaceLimits, FaceOverrides } from '../types';
+  import { FACE_FIELDS } from '../ui';
+  import LimitsEditor from './LimitsEditor.svelte';
+
+  let {
+    value = $bindable(),
+    inherited,
+    inheritedFrom,
+  }: { value: FaceOverrides; inherited: FaceLimits; inheritedFrom: string } = $props();
+
+  const limits = $derived(app.config?.face_limits);
+  const below = [
+    {
+      pairs: [
+        ['ask_similarity', 'match_similarity'],
+        ['keep_similarity', 'match_similarity'],
+      ],
+      message: 'Asking and keeping the name must not be above “Recognised as a person”.',
+    },
+    { pairs: [['match_similarity', 'sure_similarity']], message: '“Recognised as a person” must not be above “Sure at once”.' },
+  ] as const;
+</script>
+
+{#if limits}
+  <LimitsEditor
+    bind:value
+    {inherited}
+    {inheritedFrom}
+    fields={FACE_FIELDS}
+    {limits}
+    {below}
+    id="face"
+    note="Similarities mean something else for each face model."
+  />
+{/if}
diff --git a/visionstate/frontend/src/lib/components/FaceQuestion.svelte b/visionstate/frontend/src/lib/components/FaceQuestion.svelte
new file mode 100644
index 0000000..e21b79d
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/FaceQuestion.svelte
@@ -0,0 +1,231 @@
+<script lang="ts">
+  // A review question about a face: "Is this Kari?" (not sure enough to say so by itself) or "Who
+  // is this?" (a face nobody was taught for, when the sensor asks about those). The face close-up
+  // sits beside the frame (stacked on phones), with one of the person's taught faces to compare.
+  // A face model's similarity means nothing to people, so no percentage is shown.
+  import { api } from '../api';
+  import { app, toastError } from '../app.svelte';
+  import type { ObjectQuestion, ReviewItem } from '../types';
+  import DetectionBoxes from './DetectionBoxes.svelte';
+  import Icon from './Icon.svelte';
+  import RoiEditor from './RoiEditor.svelte';
+
+  let {
+    item,
+    question,
+    given,
+    onanswer,
+  }: {
+    item: ReviewItem;
+    question: ObjectQuestion;
+    /** The answer given before, when the item is opened again. */
+    given: string | null | undefined;
+    onanswer: (text: string, answer: string | null) => void;
+  } = $props();
+
+  const who = $derived(question.label === app.config?.face_unknown_key);
+  const people = $derived(item.sensor.labels.filter((l) => l.face));
+  const name = $derived(people.find((p) => p.key === question.label)?.name ?? question.label);
+  const others = $derived(people.filter((p) => p.key !== question.label));
+  let busy = $state(false);
+  let naming = $state(false);
+  let newName = $state('');
+
+  // The close-up: the face with some room around it, as a background crop of the frame.
+  const src = $derived(api.historyImageUrl(item.id));
+  let natural = $state<{ w: number; h: number } | null>(null);
+  $effect(() => {
+    const img = new Image();
+    img.onload = () => (natural = { w: img.naturalWidth, h: img.naturalHeight });
+    img.src = src;
+  });
+  const crop = $derived.by(() => {
+    if (!natural || !question.face) return null;
+    const [fx1, fy1, fx2, fy2] = question.face;
+    const mx = (fx2 - fx1) * 0.3;
+    const my = (fy2 - fy1) * 0.3;
+    const [x1, y1, x2, y2] = [Math.max(0, fx1 - mx), Math.max(0, fy1 - my), Math.min(1, fx2 + mx), Math.min(1, fy2 + my)];
+    const w = x2 - x1;
+    const h = y2 - y1;
+    return {
+      aspect: (w * natural.w) / (h * natural.h),
+      size: `${100 / w}% ${100 / h}%`,
+      position: `${w < 1 ? (x1 / (1 - w)) * 100 : 0}% ${h < 1 ? (y1 / (1 - h)) * 100 : 0}%`,
+    };
+  });
+
+  async function send(action: 'yes' | 'no' | 'skip' | 'person' | 'new', person?: string, text?: string) {
+    if (busy) return;
+    busy = true;
+    try {
+      await api.answerFace(item.id, action, person, action === 'new' ? newName.trim() : undefined);
+      const label = person ?? (action === 'new' ? 'new' : action === 'skip' ? null : action);
+      onanswer(text ?? 'Skipped', label);
+    } catch (err) {
+      toastError(err);
+    } finally {
+      busy = false;
+    }
+  }
+
+  function keydown(e: KeyboardEvent) {
+    if (naming || (e.target as HTMLElement).closest('input, select, textarea')) return;
+    if (e.key === 'Enter' && !who) send('yes', undefined, `✓ ${name}`);
+    else if (e.key.toLowerCase() === 's') send('skip');
+  }
+</script>
+
+<svelte:window onkeydown={keydown} />
+
+<div class="pair">
+  <div class="frame">
+    <RoiEditor {src} roi={item.sensor.roi}>
+      <DetectionBoxes
+        detections={[{ key: 'person', score: item.confidence, box: question.box, face: { box: question.face, problem: null } }]}
+        classes={['person']}
+        labels={false}
+      />
+    </RoiEditor>
+  </div>
+  <div class="faces">
+    {#if crop}
+      <figure>
+        <div
+          class="closeup"
+          style:aspect-ratio={crop.aspect}
+          style:background-image="url({src})"
+          style:background-size={crop.size}
+          style:background-position={crop.position}
+        ></div>
+        <figcaption class="xsmall faint">This face</figcaption>
+      </figure>
+    {/if}
+    {#if !who && question.example}
+      <figure>
+        <img src={api.faceImageUrl(question.example)} alt="A face taught as {name}" />
+        <figcaption class="xsmall faint">Taught as {name}</figcaption>
+      </figure>
+    {/if}
+  </div>
+</div>
+
+<div class="col center">
+  <p class="question">
+    {#if who}
+      Who is this?
+      <span class="small muted">A face this sensor does not know.</span>
+    {:else}
+      Is this <strong>{name}</strong>?
+      <span class="small muted">Probably, but not sure enough to say so by itself.</span>
+    {/if}
+  </p>
+  {#if naming}
+    <form
+      class="row wrap center-row"
+      onsubmit={(e) => {
+        e.preventDefault();
+        if (newName.trim()) send('new', undefined, `✓ ${newName.trim()} (new)`);
+      }}
+    >
+      <!-- svelte-ignore a11y_autofocus -->
+      <input class="input" bind:value={newName} maxlength="64" placeholder="Name" aria-label="Name of the new person" autofocus />
+      <button class="btn primary" type="submit" disabled={busy || !newName.trim()}>Add person</button>
+      <button class="btn" type="button" onclick={() => (naming = false)}>Back</button>
+    </form>
+  {:else}
+    <div class="row wrap center-row">
+      {#if !who}
+        <button class="btn primary lg" class:chosen={given === 'yes'} disabled={busy} onclick={() => send('yes', undefined, `✓ ${name}`)}>
+          <Icon name="check" /> Yes, {name}
+        </button>
+        <span class="small faint">No, it is</span>
+      {/if}
+      {#each who ? people : others as p (p.key)}
+        <button class="btn lg" class:chosen={given === p.key} disabled={busy} onclick={() => send('person', p.key, `✓ ${p.name}`)}>
+          {p.name}
+        </button>
+      {/each}
+      <button class="btn lg accent-outline" disabled={busy} onclick={() => (naming = true)}>
+        <Icon name="plus" size={14} /> New person…
+      </button>
+    </div>
+    <div class="row wrap center-row">
+      {#if !who}
+        <button class="btn ghost" class:chosen={given === 'no'} disabled={busy} onclick={() => send('no', undefined, `✓ Not ${name}`)}>
+          No, someone I do not know
+        </button>
+      {/if}
+      <button class="btn ghost" class:chosen={given === null} disabled={busy} onclick={() => send('skip')}>
+        {who ? 'Don’t know' : 'Skip'}
+      </button>
+    </div>
+  {/if}
+  <span class="xsmall faint">A name you give is taught: this face is added to that person.</span>
+  <span class="xsmall faint kbd-only">{who ? 'S = don’t know' : 'Enter = yes · S = skip'}</span>
+</div>
+
+<style>
+  .pair {
+    display: grid;
+    grid-template-columns: minmax(0, 1fr) 140px;
+    gap: var(--space-4);
+    align-items: start;
+  }
+  .faces {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-3);
+  }
+  figure {
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+  }
+  .closeup,
+  figure img {
+    width: 100%;
+    border-radius: var(--radius-sm);
+    background-repeat: no-repeat;
+    background-color: var(--c-sunken);
+  }
+  figure img {
+    aspect-ratio: 1;
+    object-fit: cover;
+  }
+  .frame {
+    border-radius: var(--radius-md);
+    overflow: hidden;
+  }
+  .center {
+    align-items: center;
+    text-align: center;
+    gap: var(--space-3);
+    margin-top: var(--space-4);
+  }
+  .center-row {
+    justify-content: center;
+    gap: var(--space-2);
+  }
+  .question {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    margin: 0;
+    font-size: var(--fs-lg);
+  }
+  .chosen {
+    outline: 2px solid var(--c-accent);
+  }
+  @media (max-width: 600px) {
+    .pair {
+      grid-template-columns: minmax(0, 1fr);
+    }
+    .faces {
+      flex-direction: row;
+    }
+    .faces figure {
+      width: 120px;
+    }
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/FaceStats.svelte b/visionstate/frontend/src/lib/components/FaceStats.svelte
new file mode 100644
index 0000000..13a5bd7
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/FaceStats.svelte
@@ -0,0 +1,51 @@
+<script lang="ts">
+  // Does the camera give usable faces? "A usable face in 9 of the last 40 people looked at", and
+  // when that share is low, what usually helps for the most common reason. Used on the Live tab,
+  // the Faces card and the Quality tab.
+  import { FACE_PROBLEMS } from '../objects';
+  import type { FaceProblem, SensorObjects } from '../types';
+
+  let { objects }: { objects: SensorObjects } = $props();
+
+  // Below this share, with enough people looked at, a hint names the likely fix.
+  const LOW_SHARE = 0.3;
+  const ENOUGH = 10;
+
+  const stats = $derived(objects.face_stats);
+  const main = $derived(
+    (Object.entries(stats.problems) as [FaceProblem, number][]).sort((a, b) => b[1] - a[1])[0]?.[0] ?? null,
+  );
+  const low = $derived(stats.looked >= ENOUGH && stats.usable / stats.looked < LOW_SHARE);
+  const frame = $derived(stats.frame ? `${stats.frame[0]}×${stats.frame[1]}` : '');
+</script>
+
+<span class="xsmall faint">
+  {#if !stats.looked}
+    No person looked at for a face yet.
+  {:else}
+    A usable face in {stats.usable} of the last {stats.looked} people looked at{main ? ` (mostly: ${FACE_PROBLEMS[main]})` : ''}.
+  {/if}
+</span>
+{#if low}
+  <span class="xsmall warn">
+    {#if main === 'small'}
+      Faces here are mostly too small: a face needs to be {stats.min_face_px ?? ''} pixels wide{frame
+        ? `, and this camera sends ${frame} pictures`
+        : ''}. Use the camera's main stream (its highest resolution) rather than a sub-stream or a small snapshot,
+      or a camera closer to where people pass.
+    {:else if main === 'cut'}
+      Faces here are often cut off by the edge of the picture. A camera that sees people whole helps.
+    {:else if main === 'turned' || main === 'none'}
+      Faces here are rarely usable: people seldom face this camera. A camera that people walk towards helps.
+    {:else}
+      Faces here are rarely usable. A sharper picture (the camera's main stream over RTSP instead of the snapshot)
+      or more light helps.
+    {/if}
+  </span>
+{/if}
+
+<style>
+  .warn {
+    color: var(--c-warn);
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/FacesCard.svelte b/visionstate/frontend/src/lib/components/FacesCard.svelte
new file mode 100644
index 0000000..4837af9
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/FacesCard.svelte
@@ -0,0 +1,175 @@
+<script lang="ts">
+  // Recognising people by their face, on an object sensor's Settings tab. Off by default: turning
+  // it on opens a sheet that says what is stored and what is downloaded, before anything is. Its
+  // changes are saved at once (not with "Save changes"), like teaching is.
+  import { api } from '../api';
+  import { app, toast, toastError } from '../app.svelte';
+  import { size } from '../format';
+  import { href, paths } from '../router.svelte';
+  import type { FaceKey, FaceLimitsInfo, FaceModelInfo, FaceOverrides, FaceSettings, Sensor } from '../types';
+  import { FACE_FIELDS } from '../ui';
+  import FaceConsent from './FaceConsent.svelte';
+  import FaceLimitsEditor from './FaceLimitsEditor.svelte';
+  import FaceStats from './FaceStats.svelte';
+  import Icon from './Icon.svelte';
+
+  let { sensor, onchange }: { sensor: Sensor; onchange: () => void } = $props();
+
+  const settings = $derived<FaceSettings>({ ...app.config!.face_defaults, ...(sensor.objects?.faces ?? {}) });
+  const looksForPeople = $derived(!!sensor.objects?.classes.includes('person'));
+  const status = $derived(app.status?.faces ?? null);
+  const people = $derived(app.status?.faces.people ?? 0);
+
+  let model = $state<FaceModelInfo | null>(null);
+  let asking = $state(false);
+  let busy = $state(false);
+  let globalFaces = $state<FaceLimitsInfo | null>(null);
+  // The sensor's own face limits (null: the global value), saved with their own button.
+  const own = (): FaceOverrides =>
+    Object.fromEntries(FACE_FIELDS.map((f) => [f.key, sensor.objects?.faces?.[f.key as FaceKey] ?? null]));
+  let limitValues = $state<FaceOverrides>(own());
+  const limitsChanged = $derived(JSON.stringify(limitValues) !== JSON.stringify(own()));
+  api
+    .settings()
+    .then((s) => (model = s.face_models.find((m) => m.id === s.face_model) ?? null))
+    .catch(toastError);
+  api
+    .faceLimits()
+    .then((f) => (globalFaces = f))
+    .catch(toastError);
+
+  async function save(faces: Partial<FaceSettings>, message?: string) {
+    busy = true;
+    try {
+      await api.updateSensor(sensor.id, { objects: { faces: { ...settings, ...faces } } });
+      if (message) toast(message);
+      onchange();
+    } catch (err) {
+      toastError(err);
+    } finally {
+      busy = false;
+    }
+  }
+
+  async function retry() {
+    try {
+      await api.retryFaces();
+    } catch (err) {
+      toastError(err);
+    }
+  }
+</script>
+
+<section class="card pad col faces" data-testid="faces-card">
+  <h3>Faces</h3>
+  {#if !looksForPeople}
+    <p class="small muted">Add Person to the objects to recognise people by their face.</p>
+  {:else if !settings.enabled}
+    <strong class="small">Recognise people by their face</strong>
+    <p class="small muted">
+      Name the people you know; each gets an on/off sensor in Home Assistant.
+      {#if people}It knows the {people} {people === 1 ? 'person' : 'people'} you named on other cameras right away.{/if}
+    </p>
+    <div class="row">
+      <button class="btn" onclick={() => (asking = true)}><Icon name="plus" size={14} /> Turn on…</button>
+    </div>
+  {:else}
+    <label class="check">
+      <input type="checkbox" checked disabled={busy} onchange={() => save({ enabled: false }, 'Face recognition is off')} />
+      <span class="col" style="gap:2px">
+        <strong class="small">Recognise faces</strong>
+        <span class="xsmall faint">
+          Off removes the people's entities from this sensor; the people stay (they are shared).
+        </span>
+      </span>
+    </label>
+    <label class="check">
+      <input
+        type="checkbox"
+        checked={settings.ask_unknown}
+        disabled={busy}
+        onchange={(e) => save({ ask_unknown: e.currentTarget.checked })}
+      />
+      <span class="col" style="gap:2px">
+        <strong class="small">Ask me about faces I do not know</strong>
+        <span class="xsmall faint">
+          Also asks “Who is this?” in the review queue about faces nobody is named for. A question waiting for an
+          answer keeps its frame twice as long as the history.
+        </span>
+      </span>
+    </label>
+    {#if globalFaces}
+      <div class="col limits" data-testid="sensor-face-limits">
+        <strong class="small">Limits for this sensor</strong>
+        <FaceLimitsEditor bind:value={limitValues} inherited={globalFaces.effective} inheritedFrom="the global value" />
+        <button
+          class="btn sm primary"
+          style="align-self:flex-start"
+          disabled={!limitsChanged || busy}
+          onclick={() => save(limitValues, 'Face limits saved')}
+        >
+          Save limits
+        </button>
+      </div>
+    {/if}
+
+    {#if status?.error}
+      <div class="notice warn col" style="gap:6px">
+        <span class="small">The face model could not be loaded: {status.error}</span>
+        <div class="row"><button class="btn sm" onclick={retry}><Icon name="refresh" size={14} /> Try again</button></div>
+      </div>
+    {:else if status?.progress}
+      <div class="col" style="gap:6px">
+        <span class="small muted">
+          Downloading the face model… {size(status.progress.done)} of {size(status.progress.total)}
+        </span>
+        <progress max={status.progress.total} value={status.progress.done}></progress>
+      </div>
+    {:else if status && !status.loaded}
+      <span class="small muted">Loading the face model…</span>
+    {:else if sensor.objects}
+      <FaceStats objects={sensor.objects} />
+    {/if}
+
+    <span class="xsmall faint">
+      {people} {people === 1 ? 'person' : 'people'}, shared by every camera that recognises faces:
+      <a href={href(paths.people())}>People</a>.
+    </span>
+    {#if model}
+      <span class="xsmall faint">
+        {model.name} · {size(model.size)} · change under <a href={href(paths.settings())}>Settings → AI model</a>.
+      </span>
+    {/if}
+  {/if}
+</section>
+
+{#if asking}
+  <FaceConsent
+    name={sensor.name}
+    {model}
+    onclose={() => (asking = false)}
+    onconfirm={async () => {
+      asking = false;
+      await save({ enabled: true }, 'Face recognition is on');
+    }}
+  />
+{/if}
+
+<style>
+  .faces {
+    gap: var(--space-3);
+  }
+  .check {
+    align-items: flex-start;
+  }
+  .check input {
+    margin-top: 3px;
+  }
+  .limits {
+    gap: var(--space-3);
+  }
+  progress {
+    width: 100%;
+    accent-color: var(--c-accent);
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/LimitsEditor.svelte b/visionstate/frontend/src/lib/components/LimitsEditor.svelte
new file mode 100644
index 0000000..114a03f
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/LimitsEditor.svelte
@@ -0,0 +1,120 @@
+<script lang="ts">
+  // Edits tunable limits that inherit (teaching of object sensors, faces). An empty field inherits
+  // (shown in grey): on the Settings page the default, on a sensor the global value. Similarities
+  // are shown in percent, pixel values as they are.
+  import Icon from './Icon.svelte';
+
+  type Field = { key: string; label: string; help: string; unit?: 'px' };
+
+  let {
+    value = $bindable(),
+    inherited,
+    inheritedFrom,
+    fields,
+    limits,
+    below = [],
+    id,
+    note = '',
+  }: {
+    value: Record<string, number | null | undefined>;
+    /** What an empty field uses. */
+    inherited: Record<string, number>;
+    /** Where that comes from, e.g. "the global value". */
+    inheritedFrom: string;
+    fields: readonly Field[];
+    /** Lowest and highest value per key. */
+    limits: Record<string, readonly [number, number]>;
+    /** Pairs [a, b]: a must not be above b; with the message shown when it is. */
+    below?: readonly { pairs: readonly (readonly [string, string])[]; message: string }[];
+    /** Prefix of the inputs' ids and test ids. */
+    id: string;
+    note?: string;
+  } = $props();
+
+  const pct = (f: Field) => f.unit !== 'px';
+  const shown = (f: Field, n: number) => (pct(f) ? Math.round(n * 100) : Math.round(n));
+  const effective = (key: string) => value[key] ?? inherited[key];
+  const conflicts = $derived(below.filter((b) => b.pairs.some(([a, c]) => effective(a) > effective(c))));
+
+  function set(f: Field, raw: string) {
+    value[f.key] = raw.trim() === '' ? null : pct(f) ? Number(raw) / 100 : Number(raw);
+  }
+</script>
+
+<div class="col limits">
+  {#each fields as f (f.key)}
+    {@const own = value[f.key] !== null && value[f.key] !== undefined}
+    <div class="line" data-testid={`${id}-${f.key}`}>
+      <label class="col name" for={`${id}-${f.key}`}>
+        <span>{f.label}</span>
+        <span class="xsmall faint">{f.help}</span>
+      </label>
+      <span class="row input-row">
+        <input
+          id={`${id}-${f.key}`}
+          class="input sm num"
+          class:own
+          type="number"
+          min={shown(f, limits[f.key][0])}
+          max={shown(f, limits[f.key][1])}
+          step="1"
+          value={own ? shown(f, value[f.key] as number) : ''}
+          placeholder={String(shown(f, inherited[f.key]))}
+          oninput={(e) => set(f, e.currentTarget.value)}
+          aria-label={f.label}
+        />
+        <span class="unit small muted">{pct(f) ? '%' : 'px'}</span>
+        <button
+          class="btn sm ghost reset"
+          class:hidden={!own}
+          disabled={!own}
+          onclick={() => (value[f.key] = null)}
+          aria-label={`Use ${inheritedFrom} (${shown(f, inherited[f.key])}${pct(f) ? '%' : ' px'})`}
+          title={`Use ${inheritedFrom}`}
+        >
+          <Icon name="x" size={14} />
+        </button>
+      </span>
+    </div>
+  {/each}
+  {#each conflicts as c (c.message)}
+    <div class="notice warn small">{c.message}</div>
+  {/each}
+  <p class="xsmall faint">Empty fields (in grey) use {inheritedFrom}.{note ? ` ${note}` : ''}</p>
+</div>
+
+<style>
+  .limits {
+    gap: var(--space-3);
+  }
+  .line {
+    display: flex;
+    align-items: center;
+    justify-content: space-between;
+    gap: var(--space-4);
+    color: var(--c-text-2);
+  }
+  .name {
+    gap: 2px;
+    min-width: 0;
+  }
+  .input-row {
+    gap: var(--space-2);
+    flex-shrink: 0;
+  }
+  .num {
+    width: 72px;
+  }
+  .num::placeholder {
+    color: var(--c-faint);
+  }
+  .num:not(.own) {
+    color: var(--c-faint);
+  }
+  .unit {
+    width: 18px;
+  }
+  .reset.hidden {
+    visibility: hidden;
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/ModelCompare.svelte b/visionstate/frontend/src/lib/components/ModelCompare.svelte
new file mode 100644
index 0000000..fa73f09
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/ModelCompare.svelte
@@ -0,0 +1,140 @@
+<script lang="ts">
+  // The AI models side by side, per kind and from the smallest to the largest: what they are for,
+  // rough memory and time, how accurate they are compared with each other, and whether they are
+  // on disk — a downloaded model not in use can be deleted here (it is downloaded again when
+  // chosen). Numbers come from the registries (GET /settings).
+  import { api } from '../api';
+  import { toast, toastError } from '../app.svelte';
+  import { bySize, mb } from '../format';
+  import type { BackboneInfo, ModelKind, SettingsInfo } from '../types';
+  import { MODEL_COMPARE_NOTE, MODEL_KINDS } from '../ui';
+  import ConfirmButton from './ConfirmButton.svelte';
+  import Icon from './Icon.svelte';
+
+  let { info, ondeleted }: { info: SettingsInfo; ondeleted: (info: SettingsInfo) => void } = $props();
+  let open = $state(false);
+
+  type Kind = (typeof MODEL_KINDS)[number]['key'];
+  const chosen = (kind: Kind) =>
+    ({
+      backbones: info.backbone,
+      detectors: info.detector,
+      face_models: info.face_model,
+      readers: info.reader,
+      wheel_readers: info.wheel_reader,
+    })[kind];
+  const deletable = (kind: Kind): kind is ModelKind => kind !== 'wheel_readers';
+
+  async function remove(kind: ModelKind, m: BackboneInfo) {
+    try {
+      ondeleted(await api.deleteModel(kind, m.id));
+      toast(`${m.name} deleted`);
+    } catch (err) {
+      toastError(err);
+    }
+  }
+  const time = (ms: number) => (ms < 1000 ? `${ms} ms` : `${(ms / 1000).toFixed(1)} s`);
+  const ram = (m: BackboneInfo) => (m.ram_mb >= 1000 ? `${(m.ram_mb / 1000).toFixed(1)} GB` : `${m.ram_mb} MB`);
+</script>
+
+<div class="col compare">
+  <button class="btn sm ghost toggle" onclick={() => (open = !open)} aria-expanded={open}>
+    <Icon name="chevron" size={14} />
+    Compare and manage the models
+  </button>
+  {#if open}
+    <div class="col kinds" data-testid="model-compare">
+      {#each MODEL_KINDS as kind (kind.key)}
+        <div class="col kind">
+          <strong class="small">{kind.title}</strong>
+          <span class="xsmall faint">{kind.text}</span>
+          {#each bySize(info[kind.key] as BackboneInfo[]) as m (m.id)}
+            <div class="model" class:current={m.id === chosen(kind.key)}>
+              <span class="name small">
+                {m.name}{#if m.id === chosen(kind.key)}<span class="xsmall muted"> · in use</span>{/if}
+              </span>
+              <span class="facts xsmall muted">
+                <span>~{ram(m)} RAM</span>
+                <span>~{time(m.time_ms)} per check</span>
+                <span>{!m.installed ? `download ${mb(m.size)}` : m.downloaded ? `downloaded, ${mb(m.size)}` : 'included'}</span>
+                <span class="accuracy" aria-label={`Accuracy ${m.accuracy} of 5`} title="Accuracy compared with the others">
+                  {#each [1, 2, 3, 4, 5] as n (n)}<span class="pip" class:on={n <= m.accuracy}></span>{/each}
+                </span>
+              </span>
+              {#if m.downloaded && deletable(kind.key)}
+                {#if m.in_use}
+                  <span class="xsmall faint">{m.in_use}</span>
+                {:else}
+                  {@const k = kind.key}
+                  <ConfirmButton class="btn sm ghost delete" onconfirm={() => remove(k, m)} confirmLabel="Tap again to delete">
+                    <Icon name="trash" size={14} /> Delete
+                  </ConfirmButton>
+                {/if}
+              {/if}
+            </div>
+          {/each}
+        </div>
+      {/each}
+      <p class="xsmall faint">{MODEL_COMPARE_NOTE}</p>
+    </div>
+  {/if}
+</div>
+
+<style>
+  .compare {
+    gap: var(--space-3);
+  }
+  .toggle {
+    align-self: flex-start;
+  }
+  .toggle :global(svg) {
+    transform: rotate(0deg);
+    transition: transform 0.15s;
+  }
+  .toggle[aria-expanded='true'] :global(svg) {
+    transform: rotate(90deg);
+  }
+  .kinds {
+    gap: var(--space-4);
+  }
+  .kind {
+    gap: var(--space-2);
+  }
+  .model {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    padding: var(--space-2) var(--space-3);
+    border-radius: var(--radius-md);
+    background: var(--c-surface-2);
+    border: 1px solid transparent;
+  }
+  .model.current {
+    border-color: var(--c-accent-line);
+  }
+  .name {
+    color: var(--c-text);
+  }
+  .model :global(.delete) {
+    align-self: flex-start;
+  }
+  .facts {
+    display: flex;
+    flex-wrap: wrap;
+    align-items: center;
+    gap: var(--space-1) var(--space-3);
+  }
+  .accuracy {
+    display: inline-flex;
+    gap: 3px;
+  }
+  .pip {
+    width: 8px;
+    height: 8px;
+    border-radius: var(--radius-pill);
+    background: var(--c-border-strong);
+  }
+  .pip.on {
+    background: var(--c-accent);
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/Nav.svelte b/visionstate/frontend/src/lib/components/Nav.svelte
index b3fd30c..7c4a8c8 100644
--- a/visionstate/frontend/src/lib/components/Nav.svelte
+++ b/visionstate/frontend/src/lib/components/Nav.svelte
@@ -4,11 +4,16 @@
   import { BETA_VERSION_PATTERN } from '../ui';
   import Logo from './Logo.svelte';
 
-  const section = $derived(['review', 'history', 'settings'].includes(route.parts[0]) ? route.parts[0] : 'sensors');
+  const section = $derived(
+    ['review', 'history', 'people', 'settings'].includes(route.parts[0]) ? route.parts[0] : 'sensors',
+  );
+  // People: only once there are people, or a sensor that recognises faces.
+  const faces = $derived(app.status?.faces);
   const items = $derived([
     { id: 'sensors', label: 'Sensors', path: paths.dashboard(), badge: 0 },
     { id: 'review', label: 'Review', path: paths.review(), badge: app.status?.review_count ?? 0 },
     { id: 'history', label: 'History', path: paths.history(), badge: 0 },
+    ...(faces?.people || faces?.sensors ? [{ id: 'people', label: 'People', path: paths.people(), badge: 0 }] : []),
     { id: 'settings', label: 'Settings', path: paths.settings(), badge: 0 },
   ]);
 </script>
diff --git a/visionstate/frontend/src/lib/components/PeopleCards.svelte b/visionstate/frontend/src/lib/components/PeopleCards.svelte
new file mode 100644
index 0000000..6b625b4
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/PeopleCards.svelte
@@ -0,0 +1,274 @@
+<script lang="ts">
+  // The people (shared by every sensor that recognises faces): one card per person with the faces
+  // taught and the camera of each, where they were last seen, whether they need more faces,
+  // look-alikes and faces that may carry the wrong name; renaming and forgetting. On the People
+  // page, and on the Quality tab of a sensor that recognises faces (`sensor`: how faces look on
+  // its camera, and links to it), reloaded with every poll of the sensor there.
+  import { untrack } from 'svelte';
+  import { api } from '../api';
+  import { app, refreshStatus, toast, toastError } from '../app.svelte';
+  import { ago, dateTime } from '../format';
+  import { photoMessage } from '../objects';
+  import { href, paths } from '../router.svelte';
+  import type { People, Person, Sensor } from '../types';
+  import { PHOTO_ACCEPT } from '../ui';
+  import ConfirmButton from './ConfirmButton.svelte';
+  import FaceStats from './FaceStats.svelte';
+  import Icon from './Icon.svelte';
+
+  let { sensor = null, onchange = () => {} }: { sensor?: Sensor | null; onchange?: () => void } = $props();
+
+  // Faces taught longer ago than this get a hint to add recent ones (children change quickly).
+  const OLD_DAYS = 180;
+
+  let people = $state<People | null>(null);
+  async function load() {
+    try {
+      people = await api.people();
+    } catch (err) {
+      toastError(err);
+    }
+  }
+  $effect(() => {
+    void sensor;
+    untrack(load);
+  });
+
+  const suggest = $derived(app.config?.faces.suggest_faces ?? 0);
+  const nameOf = (key: string) => people?.people.find((p) => p.key === key)?.name ?? key;
+  const lookAlikes = (p: Person) =>
+    (people?.look_alikes ?? []).filter((l) => l.a === p.key || l.b === p.key).map((l) => nameOf(l.a === p.key ? l.b : l.a));
+  const old = (p: Person) => !!p.oldest && Date.now() - Date.parse(p.oldest) > OLD_DAYS * 86_400_000;
+  const enabled = $derived(!sensor || !!people?.sensors.includes(sensor.id));
+
+  let renaming = $state<string | null>(null);
+  let newName = $state('');
+  function startRename(p: Person) {
+    renaming = p.key;
+    newName = p.name;
+  }
+  async function rename(e: SubmitEvent, p: Person) {
+    e.preventDefault();
+    const name = newName.trim();
+    renaming = null;
+    if (name && name !== p.name) await act(() => api.renamePerson(p.key, name), `${p.name} is now ${name}`);
+  }
+  let uploading = $state<string | null>(null);
+  async function addPhotos(e: Event, p: Person) {
+    const input = e.currentTarget as HTMLInputElement;
+    const files = [...(input.files ?? [])];
+    input.value = '';
+    if (!files.length) return;
+    uploading = p.key;
+    try {
+      const result = await api.addPhotos({ person: p.key }, files);
+      toast(photoMessage(result));
+      load();
+    } catch (err) {
+      toastError(err);
+    } finally {
+      uploading = null;
+    }
+  }
+
+  function seen(p: Person): string {
+    const where = p.seen.sensor_name ? ` on ${p.seen.sensor_name}` : '';
+    if (p.seen.now !== 'not_seen') return `Seen now${where}`;
+    return p.seen.at ? `Last seen ${ago(p.seen.at)}${where}` : 'Not seen yet';
+  }
+
+  async function act(action: () => Promise<unknown>, message: string) {
+    try {
+      await action();
+      toast(message);
+      onchange();
+      load();
+      refreshStatus();
+    } catch (err) {
+      toastError(err);
+    }
+  }
+</script>
+
+{#if people && (people.people.length || enabled)}
+  <section class="card pad col" style="gap:var(--space-2)" data-testid="people">
+    {#if sensor}<div class="card-title"><h3>People</h3></div>{/if}
+    {#if sensor && !enabled}
+      <div class="notice warn">
+        Face recognition is off for this sensor under <a href={href(paths.sensor(sensor.id, 'settings'))}>Settings</a>.
+      </div>
+    {:else if sensor?.objects}
+      <FaceStats objects={sensor.objects} />
+    {/if}
+    <p class="small muted">
+      {#if people.people.length}
+        Shared by every camera that recognises faces. Tap a person on a sensor's Live tab or in the history to teach
+        more faces — in other light, from other angles and on each camera.
+      {:else if sensor}
+        Nobody taught yet: tap a person on the <a href={href(paths.sensor(sensor.id, 'live'))}>Live</a> tab and say who it is.
+      {:else}
+        Nobody taught yet: tap a person on the Live tab of a sensor that recognises faces and say who it is.
+      {/if}
+    </p>
+  </section>
+
+  {#each people.people as p (p.key)}
+    <section class="card pad person">
+      <div class="card-title">
+        <div class="col" style="gap:2px">
+          {#if renaming === p.key}
+            <form class="row rename" onsubmit={(e) => rename(e, p)}>
+              <input class="input sm" bind:value={newName} maxlength="64" aria-label="Name" />
+              <button class="btn sm primary" type="submit">Save</button>
+              <button class="btn sm" type="button" onclick={() => (renaming = null)}>Cancel</button>
+            </form>
+          {:else}
+            <h3>{p.name} <span class="faint count">{p.faces.length}</span></h3>
+          {/if}
+          <span class="xsmall faint">
+            {seen(p)}
+            {#if p.faces.length < suggest} · teach a few more faces{/if}
+          </span>
+        </div>
+        <div class="row wrap actions">
+          <input
+            type="file"
+            accept={PHOTO_ACCEPT}
+            multiple
+            class="sr-only"
+            id={`photos-${p.key}`}
+            onchange={(e) => addPhotos(e, p)}
+            disabled={uploading !== null}
+          />
+          <label class="btn sm" for={`photos-${p.key}`} class:disabled={uploading !== null}>
+            <Icon name="camera" size={14} /> {uploading === p.key ? 'Adding…' : 'Add photos'}
+          </label>
+          {#if renaming !== p.key}
+            <button class="btn sm" onclick={() => startRename(p)}>Rename</button>
+          {/if}
+          <ConfirmButton
+            class="btn sm danger"
+            onconfirm={() => act(() => api.forgetPerson(p.key), `${p.name} removed, with their faces and entities`)}
+            confirmLabel="Tap again to remove"
+          >
+            <Icon name="trash" size={14} /> Remove person
+          </ConfirmButton>
+        </div>
+      </div>
+      {#each lookAlikes(p) as other (other)}
+        <div class="notice warn xsmall">
+          {p.name} and {other} look alike to the AI — teach both in more light and from more angles.
+        </div>
+      {/each}
+      {#if old(p)}
+        <div class="notice xsmall">Some faces were taught a long time ago. Add recent ones, above all for children.</div>
+      {/if}
+      <div class="faces">
+        {#each p.faces as f (f.id)}
+          <figure class:suspect={!!f.suspect}>
+            <img src={api.faceImageUrl(f.id)} alt="A face of {p.name}" loading="lazy" />
+            {#if f.is_night}<span class="badge">night</span>{/if}
+            <button
+              class="forget"
+              onclick={() => act(() => api.forgetFace(f.id), 'Face forgotten')}
+              aria-label="Forget this face"
+              title="Forget this face"
+            >
+              <Icon name="x" size={12} />
+            </button>
+            {#if f.suspect}
+              <button
+                class="btn sm move"
+                onclick={() => act(() => api.moveFace(f.id, f.suspect!), `Moved to ${nameOf(f.suspect!)}`)}
+              >
+                Looks like {nameOf(f.suspect)}: move
+              </button>
+            {/if}
+            <figcaption class="xsmall faint" title={dateTime(f.created_at)}>
+              {ago(f.created_at)}{f.sensor_name ? ` · ${f.sensor_name}` : f.origin === 'upload' ? ' · photo' : ''}
+            </figcaption>
+          </figure>
+        {/each}
+      </div>
+    </section>
+  {/each}
+{/if}
+
+<style>
+  .count {
+    font-weight: 400;
+    margin-left: 4px;
+  }
+  .actions {
+    gap: var(--space-2);
+    justify-content: flex-end;
+  }
+  label.disabled {
+    opacity: 0.5;
+    pointer-events: none;
+  }
+  .rename {
+    gap: var(--space-2);
+  }
+  .rename input {
+    max-width: 180px;
+  }
+  .person {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-3);
+  }
+  .faces {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(84px, 1fr));
+    gap: var(--space-3);
+  }
+  figure {
+    position: relative;
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+  }
+  figure img {
+    width: 100%;
+    aspect-ratio: 1;
+    object-fit: cover;
+    border-radius: var(--radius-sm);
+    background: var(--c-sunken);
+  }
+  figure.suspect img {
+    outline: 2px solid var(--c-warn);
+  }
+  .badge {
+    position: absolute;
+    left: 4px;
+    top: 4px;
+    padding: 0 6px;
+    border-radius: var(--radius-pill);
+    background: rgba(0, 0, 0, 0.6);
+    color: #fff;
+    font-size: var(--fs-xs);
+  }
+  .forget {
+    position: absolute;
+    right: 4px;
+    top: 4px;
+    width: 28px;
+    height: 28px;
+    border: 0;
+    border-radius: 50%;
+    background: rgba(0, 0, 0, 0.6);
+    color: #fff;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    cursor: pointer;
+  }
+  .move {
+    white-space: normal;
+    height: auto;
+    min-height: 28px;
+    text-align: left;
+  }
+</style>
diff --git a/visionstate/frontend/src/lib/components/TeachLimitsEditor.svelte b/visionstate/frontend/src/lib/components/TeachLimitsEditor.svelte
new file mode 100644
index 0000000..ae7e573
--- /dev/null
+++ b/visionstate/frontend/src/lib/components/TeachLimitsEditor.svelte
@@ -0,0 +1,44 @@
+<script lang="ts">
+  // Edits the teaching limits of object sensors. An empty field inherits (shown in grey): on the
+  // Settings page the state model's default, on a sensor the global value.
+  import { app } from '../app.svelte';
+  import type { TeachLimits, TeachOverrides } from '../types';
+  import { TEACH_FIELDS } from '../ui';
+  import LimitsEditor from './LimitsEditor.svelte';
+
+  let {
+    value = $bindable(),
+    inherited,
+    inheritedFrom,
+  }: {
+    value: TeachOverrides;
+    /** What an empty field uses. */
+    inherited: TeachLimits;
+    /** Where that comes from, e.g. "the global value". */
+    inheritedFrom: string;
+  } = $props();
+
+  const limits = $derived(app.config?.teach.limits);
+  const below = [
+    {
+      pairs: [
+        ['ask_similarity', 'match_similarity'],
+        ['keep_similarity', 'match_similarity'],
+      ],
+      message: 'The second and third values must not be above the first.',
+    },
+  ] as const;
+</script>
+
+{#if limits}
+  <LimitsEditor
+    bind:value
+    {inherited}
+    {inheritedFrom}
+    fields={TEACH_FIELDS}
+    {limits}
+    {below}
+    id="teach"
+    note="100% is the very same picture."
+  />
+{/if}
diff --git a/visionstate/frontend/src/lib/components/TeachSheet.svelte b/visionstate/frontend/src/lib/components/TeachSheet.svelte
index 866081a..1cda811 100644
--- a/visionstate/frontend/src/lib/components/TeachSheet.svelte
+++ b/visionstate/frontend/src/lib/components/TeachSheet.svelte
@@ -2,12 +2,13 @@
   // Teach an object sensor about one box: right, not what the AI said, something else (one of its
   // objects or own labels, or a new own label), or — for a box the user drew — what the AI missed.
   // The first time a sensor is taught, it asks once whether to start. A bottom sheet on phones,
-  // a small dialog on wider screens.
+  // a small dialog on wider screens. On a sensor that recognises faces, a person box first asks
+  // "Who is this?" with a close-up of the face; a person is only ever taught from a usable face.
   import { onMount, untrack } from 'svelte';
   import { api } from '../api';
   import { app, toast, toastError } from '../app.svelte';
   import { pct } from '../format';
-  import { activeLabels, boxName, boxReason, noneLabel, objectName } from '../objects';
+  import { activeLabels, boxReason, byFace, facesOn, noneLabel, objectName, peopleOf } from '../objects';
   import type { Detection, Sensor, TeachInput } from '../types';
   import Icon from './Icon.svelte';
 
@@ -32,7 +33,7 @@
     ondone: () => void;
   } = $props();
 
-  type View = 'main' | 'other' | 'new' | 'confirm';
+  type View = 'main' | 'other' | 'new' | 'confirm' | 'person';
   let view = $state<View>(untrack(() => detection) ? 'main' : 'other'); // the sheet is made for one box
   let pending = $state<{ label?: string; new_label?: string; summary: string } | null>(null);
   let newName = $state('');
@@ -41,20 +42,55 @@
 
   const own = $derived(sensor.objects?.custom ?? []);
   const classes = $derived(sensor.objects?.classes ?? []);
-  const current = $derived(detection ? (detection.label ?? detection.key) : null);
-  const name = $derived(detection ? boxName(detection, own) : '');
+  // A box named by its face (a person, or the unknown person) is taught here as what it is: a person.
+  const current = $derived(
+    detection ? (detection.label && !byFace(detection.label, own) ? detection.label : detection.key) : null,
+  );
+  const name = $derived(current ? objectName(current, own) : '');
   const objectWord = $derived(detection ? objectName(detection.key).toLowerCase() : '');
   const firstTime = $derived((sensor.objects?.taught ?? 0) === 0);
-  const roomForLabel = $derived(own.length < (app.config?.teach.max_labels ?? 0));
-  // Everything the box could be instead: the sensor's objects and own labels, except what it is now.
+  const roomForLabel = $derived(own.filter((l) => !l.face).length < (app.config?.teach.max_labels ?? 0));
+  // Everything the box could be instead: the sensor's objects and own labels (people are taught by
+  // their face, not here), except what it is now.
   const options = $derived([
     ...classes.filter((k) => k !== current).map((k) => ({ key: k, text: objectName(k), sub: '' })),
     ...activeLabels(sensor)
-      .filter((l) => l.key !== current)
+      .filter((l) => l.key !== current && !l.face)
       .map((l) => ({ key: l.key, text: l.name, sub: `a kind of ${objectName(l.parent).toLowerCase()}` })),
   ]);
 
-  // Close-up of the box with some of its surroundings (needs the image's size for the shape).
+  // Faces: is there a usable face in this person box? Asked once when the sheet opens.
+  const faceMode = $derived(!!detection && detection.key === 'person' && !detection.filtered && facesOn(sensor));
+  const people = $derived(peopleOf(sensor));
+  const roomForPerson = $derived(people.length < (app.config?.faces.max_people ?? 0));
+  let face = $state<{ box: [number, number, number, number] | null; message: string } | null>(null);
+  let personName = $state('');
+  onMount(() => {
+    if (!untrack(() => faceMode)) return;
+    api
+      .checkFace(sensor.id, { ...source, box })
+      .then((r) => (face = { box: r.problem ? null : r.face, message: r.message }))
+      .catch((err) => (face = { box: null, message: err instanceof Error ? err.message : String(err) }));
+  });
+
+  async function teachPerson(person: { key?: string; name?: string }) {
+    busy = true;
+    try {
+      const body = { ...source, box, score: detection?.score ?? null };
+      const r = await api.teachFace(sensor.id, person.key ? { ...body, person: person.key } : { ...body, new_person: person.name });
+      const suggest = app.config?.faces.suggest_faces ?? 0;
+      const more = r.faces < suggest ? ' A few more, in other light and from other angles, make it reliable.' : '';
+      toast(`Got it: this is ${r.name} (${r.faces} face${r.faces === 1 ? '' : 's'}).${more}`);
+      ondone();
+      onclose();
+    } catch (err) {
+      toastError(err);
+      busy = false;
+    }
+  }
+
+  // Close-up of the box with some of its surroundings (needs the image's size for the shape); of
+  // the face, when one was found.
   let natural = $state<{ w: number; h: number } | null>(null);
   $effect(() => {
     if (!src) return;
@@ -63,7 +99,7 @@
     img.src = src;
   });
   const area = $derived.by(() => {
-    const [x1, y1, x2, y2] = box;
+    const [x1, y1, x2, y2] = face?.box ?? box;
     const mx = (x2 - x1) * 0.2;
     const my = (y2 - y1) * 0.2;
     return [Math.max(0, x1 - mx), Math.max(0, y1 - my), Math.min(1, x2 + mx), Math.min(1, y2 + my)];
@@ -160,7 +196,50 @@
         <button class="btn" onclick={onclose}>Cancel</button>
       </div>
     </div>
+  {:else if view === 'person'}
+    <form
+      class="col body"
+      onsubmit={(e) => {
+        e.preventDefault();
+        if (personName.trim()) teachPerson({ name: personName.trim() });
+      }}
+    >
+      <label class="field">
+        Who is this?
+        <!-- svelte-ignore a11y_autofocus -->
+        <input class="input" bind:value={personName} maxlength="64" placeholder="Name" autofocus />
+      </label>
+      <span class="xsmall faint">Gets an on/off sensor and a count in Home Assistant.</span>
+      <div class="row actions">
+        <button class="btn primary" type="submit" disabled={busy || !personName.trim()}>Add person</button>
+        <button class="btn" type="button" onclick={() => (view = 'main')}>Back</button>
+      </div>
+    </form>
   {:else if view === 'main' && detection}
+    {#if faceMode}
+      <div class="col body who">
+        <strong>Who is this?</strong>
+        {#if !face}
+          <span class="small muted">Looking for the face…</span>
+        {:else if !face.box}
+          <span class="small muted">{face.message}</span>
+        {:else}
+          <div class="row wrap people">
+            {#each people as p, i (p.key)}
+              <button class="btn chip-btn" class:first={i === 0} disabled={busy} onclick={() => teachPerson({ key: p.key })}>
+                {p.name}
+              </button>
+            {/each}
+            {#if roomForPerson}
+              <button class="btn chip-btn accent-outline" class:first={!people.length} disabled={busy} onclick={() => (view = 'person')}>
+                <Icon name="plus" size={14} /> New person…
+              </button>
+            {/if}
+          </div>
+          <span class="xsmall faint">Not someone you know? Close this.</span>
+        {/if}
+      </div>
+    {/if}
     <div class="col body">
       {#if detection.filtered}
         <button class="btn first choice" disabled={busy} onclick={() => choose({ label: detection.key }, `Got it: boxes like this count as ${objectWord} again.`)}>
@@ -282,6 +361,16 @@
   .body {
     gap: var(--space-2);
   }
+  .who {
+    padding-bottom: var(--space-3);
+    border-bottom: 1px solid var(--c-border);
+  }
+  .people {
+    gap: var(--space-2);
+  }
+  .chip-btn {
+    height: var(--touch);
+  }
   .choice {
     height: var(--touch);
     justify-content: flex-start;
diff --git a/visionstate/frontend/src/lib/components/history/HistoryView.svelte b/visionstate/frontend/src/lib/components/history/HistoryView.svelte
index 7fa5922..358df44 100644
--- a/visionstate/frontend/src/lib/components/history/HistoryView.svelte
+++ b/visionstate/frontend/src/lib/components/history/HistoryView.svelte
@@ -41,12 +41,13 @@
   let active: HistoryFilter = {}; // the filter of the list shown ("the last hours" fixed when loaded)
   let generation = 0; // a newer load makes answers to older requests stale
 
-  async function load() {
+  /** The list again; `limit`: as many rows as are shown (after teaching from one, so it shows that). */
+  async function load(limit?: number) {
     const mine = ++generation;
     const filter = toFilter(shown);
     try {
       const [page, found] = await Promise.all([
-        api.history(filter, { order: shown.order, limit: settings?.page_size }),
+        api.history(filter, { order: shown.order, limit: limit ?? settings?.page_size }),
         api.historyFacets(filter),
       ]);
       if (mine !== generation) return;
@@ -66,9 +67,16 @@
   const key = $derived(JSON.stringify(shown));
   $effect(() => {
     void key;
-    untrack(load);
+    untrack(() => load());
   });
 
+  // Taught from a row: the row now shows what was taught (and the sensors their new labels).
+  function taughtFrom() {
+    onchange();
+    const shownRows = items?.length ?? 0;
+    void load(Math.min(Math.max(shownRows, settings?.page_size ?? 0), settings?.max_page_size ?? shownRows));
+  }
+
   async function more() {
     if (!next || loadingMore) return;
     const mine = generation;
@@ -199,7 +207,7 @@
   </span>
   <span class="spacer"></span>
   {#if fresh > 0}
-    <button type="button" class="btn sm accent-outline" onclick={load}>Show {fresh} new</button>
+    <button type="button" class="btn sm accent-outline" onclick={() => load()}>Show {fresh} new</button>
   {/if}
 </div>
 
@@ -220,7 +228,7 @@
       {@const sensor = byId.get(item.sensor_id)}
       {#if sensor}
         {@const Row = ROWS[sensor.kind]}
-        <Row {item} {sensor} showSensor={!locked} {onchange} />
+        <Row {item} {sensor} showSensor={!locked} onchange={taughtFrom} />
       {/if}
     {/each}
   </div>
diff --git a/visionstate/frontend/src/lib/components/history/ObjectRow.svelte b/visionstate/frontend/src/lib/components/history/ObjectRow.svelte
index 11d8f95..e931c41 100644
--- a/visionstate/frontend/src/lib/components/history/ObjectRow.svelte
+++ b/visionstate/frontend/src/lib/components/history/ObjectRow.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   // A history row of an object sensor: an object appeared, cleared, was filtered away by what the
-  // sensor was taught, or the sensor asked about it. It opens to the frame with its boxes, which can
-  // be corrected there.
+  // sensor was taught, the sensor asked about it, or it saw a face nobody is named for. It opens to
+  // the frame with its boxes, which can be corrected (or a person named) there.
   import { api } from '../../api';
   import { dateTime, pct } from '../../format';
   import { objectColor, objectCount, objectKeys, objectName } from '../../objects';
@@ -29,7 +29,18 @@
     return [...counts].map(([key, n]) => objectCount(n, key, own)).join(', ');
   });
 
-  const WHAT: Record<string, string> = { on: 'detected', off: 'cleared', filtered: 'filtered away', ask: '? (asked in Review)' };
+  // What was taught from this frame since it was recorded (a person named, a box corrected).
+  const taught = $derived([
+    ...new Set((p.detections ?? []).filter((d) => d.taught).map((d) => objectName(d.label ?? d.key, own))),
+  ]);
+
+  const WHAT: Record<string, string> = {
+    on: 'detected',
+    off: 'cleared',
+    filtered: 'filtered away',
+    ask: '? (asked in Review)',
+    face: '· face seen (tap the person to name them)',
+  };
 </script>
 
 <div class="card item">
@@ -40,12 +51,19 @@
       <span class="row wrap" style="gap:8px">
         <strong class="row" style="gap:8px" class:muted={filtered}>
           <span class="dot" class:ring={filtered} style:background={on ? objectColor(classes, p.state_key) : 'var(--c-unknown)'}></span>
-          {objectName(p.state_key, own)}{p.published_key === 'ask' ? '' : ' '}{WHAT[p.published_key ?? ''] ?? ''}
+          {objectName(p.state_key, own)}{p.published_key === 'ask' ? '' : ' '}{p.published_key === 'face' && taught.length
+            ? '· face seen'
+            : (WHAT[p.published_key ?? ''] ?? '')}
         </strong>
         {#if (on || filtered) && p.confidence}<span class="mono small muted">{pct(p.confidence)}</span>{/if}
       </span>
       <span class="xsmall faint">{dateTime(p.created_at)}</span>
       {#if inFrame}<span class="xsmall muted">In the frame: {inFrame}</span>{/if}
+      {#if taught.length}
+        <span class="xsmall taught row" style="gap:4px" data-testid="history-taught">
+          <Icon name="check" size={12} />Taught: {taught.join(', ')}
+        </span>
+      {/if}
     </span>
     <Icon name={open ? 'chevron-up' : 'chevron-down'} size={16} />
   </button>
@@ -74,6 +92,10 @@
   .sensor {
     overflow-wrap: anywhere;
   }
+  .taught {
+    color: var(--c-accent);
+    overflow-wrap: anywhere;
+  }
   img {
     width: 128px;
     aspect-ratio: 16 / 10;
diff --git a/visionstate/frontend/src/lib/format.ts b/visionstate/frontend/src/lib/format.ts
index 794cb7b..b798c22 100644
--- a/visionstate/frontend/src/lib/format.ts
+++ b/visionstate/frontend/src/lib/format.ts
@@ -20,6 +20,9 @@ export function dateTime(input: string): string {
 
 export const mb = (bytes: number) => `${Math.round(bytes / 1_000_000)} MB`;
 
+/** AI models from the smallest to the largest (their download size). */
+export const bySize = <T extends { size: number }>(models: readonly T[]): T[] => [...models].sort((a, b) => a.size - b.size);
+
 /** "12 kB", "820 MB", "1.4 GB" (binary units, like the backend's size limit). */
 export function size(bytes: number): string {
   if (bytes >= 1024 ** 3) return `${(bytes / 1024 ** 3).toFixed(1)} GB`;
diff --git a/visionstate/frontend/src/lib/objects.ts b/visionstate/frontend/src/lib/objects.ts
index 56ac17b..9899c14 100644
--- a/visionstate/frontend/src/lib/objects.ts
+++ b/visionstate/frontend/src/lib/objects.ts
@@ -1,12 +1,13 @@
 // Helpers for object sensors: display names and colours of object classes and own labels.
 import { app } from './app.svelte';
-import type { Detection, OwnLabel, Sensor } from './types';
+import type { Detection, FaceProblem, OwnLabel, PhotoResult, Sensor } from './types';
 
 /**
  * Display name of an object class ("traffic_light" → "Traffic light"), from the backend label
  * list, or of one of a sensor's own labels ("Our car") when `own` is given.
  */
 export function objectName(key: string, own: OwnLabel[] = []): string {
+  if (key === app.config?.face_unknown_key) return 'Unknown person';
   return (
     own.find((l) => l.key === key)?.name ??
     app.config?.object_labels.find((l) => l.key === key)?.name ??
@@ -14,11 +15,55 @@ export function objectName(key: string, own: OwnLabel[] = []): string {
   );
 }
 
-/** What a sensor reports, in order: its classes, then its own labels in use. */
+/** What a sensor reports, in order: its classes, then its own labels in use (and, recognising
+ * faces, the unknown person). */
 export function objectKeys(sensor: Pick<Sensor, 'objects'>): string[] {
   const objects = sensor.objects;
   if (!objects) return [];
-  return [...objects.classes, ...activeLabels(sensor).map((l) => l.key)];
+  const unknown = facesOn(sensor) && app.config ? [app.config.face_unknown_key] : [];
+  return [...objects.classes, ...activeLabels(sensor).map((l) => l.key), ...unknown];
+}
+
+/** Whether an object sensor recognises people by their face (switched on, and it looks for people). */
+export const facesOn = (sensor: Pick<Sensor, 'objects'>) =>
+  !!sensor.objects?.faces?.enabled && sensor.objects.classes.includes('person');
+
+/** The people (shared by every sensor) among an object sensor's labels while it recognises faces. */
+export const peopleOf = (sensor: Pick<Sensor, 'objects'>): OwnLabel[] =>
+  (sensor.objects?.custom ?? []).filter((l) => l.face);
+
+/** What adding photos did, for a toast: "2 faces added to Kari", and why a file was skipped. */
+export function photoMessage(result: PhotoResult): string {
+  const added = result.added
+    ? `${result.added} ${result.added === 1 ? 'face' : 'faces'} added to ${result.name}`
+    : 'No face added';
+  const skipped = result.skipped.map((s) => (s.file ? `${s.file}: ${s.message}` : s.message));
+  return [added, ...skipped].join(' · ');
+}
+
+/** Why the face of a person box cannot be used, in a few words. */
+export const FACE_PROBLEMS: Record<FaceProblem, string> = {
+  none: 'no face seen',
+  cut: 'face cut off by the edge',
+  small: 'face too small',
+  turned: 'face turned away',
+  blurry: 'face blurry',
+  unsure: 'face unclear',
+};
+
+/** What the face search says about a person box, in a few words ("" when nothing was looked at). */
+export function faceNote(d: Detection, own: OwnLabel[] = []): string {
+  const face = d.face;
+  if (!face) return '';
+  if (face.problem) {
+    const kept = face.kept && face.label ? `${objectName(face.label, own)} · ` : '';
+    return `${kept}${FACE_PROBLEMS[face.problem]}`;
+  }
+  if (face.state === 'match' && face.label) return `${objectName(face.label, own)}${face.kept ? ' (still here)' : ''}`;
+  if (face.state === 'pending') return 'checking who it is';
+  if (face.state === 'unclear') return 'not sure who';
+  if (face.state === 'ask' && face.candidate) return `maybe ${objectName(face.candidate, own)}`;
+  return own.some((l) => l.face) ? 'someone you have not named' : 'face seen';
 }
 
 /** Own labels whose object is still selected (the others are kept but not used). */
@@ -47,6 +92,7 @@ export function objectCount(n: number, key: string, own: OwnLabel[] = []): strin
   const label = own.find((l) => l.key === key);
   const name = label ? label.name : objectName(key).toLowerCase();
   if (n === 1 || label) return `${n} ${name}`;
+  if (name.endsWith('person')) return `${n} ${name.slice(0, -'person'.length)}people`; // "unknown people"
   let many = IRREGULAR_PLURALS[key];
   if (!many) {
     if (/(s|sh|ch|x)$/.test(name)) many = `${name}es`;
@@ -67,6 +113,10 @@ export function objectSummary(sensor: Sensor): string {
   return text.charAt(0).toUpperCase() + text.slice(1);
 }
 
+/** Whether a box's label comes from its face: a person taught by face, or the unknown person. */
+export const byFace = (label: string, own: OwnLabel[] = []) =>
+  label === app.config?.face_unknown_key || own.some((l) => l.key === label && l.face);
+
 /** The taught label of a box that is not what the detector said (from the backend config). */
 export const noneLabel = () => app.config?.teach.none_label ?? 'none';
 
@@ -75,6 +125,11 @@ export const boxName = (d: Detection, own: OwnLabel[] = []) => objectName(d.labe
 
 /** Why a box was changed by what the sensor was taught, in a few words ("" when it was not). */
 export function boxReason(d: Detection, own: OwnLabel[] = []): string {
+  if (d.label && byFace(d.label, own)) {
+    return d.label === app.config?.face_unknown_key
+      ? 'A face this sensor does not know'
+      : `Recognised by the face as ${objectName(d.label, own)}${d.face?.kept ? ' (still here, face not seen now)' : ''}`;
+  }
   if (d.filtered) {
     const taughtAs = d.match?.label;
     return taughtAs && taughtAs !== noneLabel()
diff --git a/visionstate/frontend/src/lib/router.svelte.ts b/visionstate/frontend/src/lib/router.svelte.ts
index 472b167..e15cd6c 100644
--- a/visionstate/frontend/src/lib/router.svelte.ts
+++ b/visionstate/frontend/src/lib/router.svelte.ts
@@ -23,6 +23,7 @@ export const paths = {
   sensor: (id: number, tab: SensorTab | '' = '') => (tab ? `sensors/${id}/${tab}` : `sensors/${id}`),
   sensorHome: (id: number, kind: SensorKind) => `sensors/${id}/${TABS_BY_KIND[kind][0]}`,
   review: () => 'review',
+  people: () => 'people',
   /** `query`: a history filter (lib/history.ts toQuery). */
   history: (query = '') => withQuery('history', query),
   settings: () => 'settings',
diff --git a/visionstate/frontend/src/lib/types.ts b/visionstate/frontend/src/lib/types.ts
index 7334574..b49a406 100644
--- a/visionstate/frontend/src/lib/types.ts
+++ b/visionstate/frontend/src/lib/types.ts
@@ -64,7 +64,7 @@ export interface ReminderInfo extends ReminderRules {
 export type ReviewOverrides = { [K in keyof ReviewRules]: ReviewRules[K] | null };
 
 export interface TriggerInfo {
-  source: 'entity' | 'change';
+  source: 'entity' | 'change' | 'person';
   detail: string;
   at: number;
 }
@@ -175,15 +175,127 @@ export interface Detection {
   /** Kept its taught answer: the same object at the same place, a little less alike. */
   kept?: boolean;
   /** May be this own label, but not clearly: asked about in the review queue. */
-  ask?: { id: number; label: string; similarity: number };
+  ask?: { id: number | null; label: string; similarity: number; face?: boolean };
+  /** Person boxes of a sensor that recognises faces: what the face search found (see FaceInfo). */
+  face?: FaceInfo;
+  /** On a history frame: taught from it since (its label is the answer; filtered: "not it"). */
+  taught?: boolean;
 }
 
-/** An object sensor's review question ("Is this Our car?"), in a history row's `probs.ask`. */
+/**
+ * The face search in one person box: `box` the face (normalised to the frame), `problem` why it
+ * cannot be used (null: usable) — 'none' no face, 'cut' by the frame's edge, 'small', 'turned',
+ * 'blurry', 'unsure'; `state` what a usable face is: 'match' (it is `label`), 'pending' (a second
+ * check must agree), 'ask' (maybe `candidate`), 'unknown', 'unclear' (matched nobody, but too small
+ * or turned to call a stranger).
+ */
+export interface FaceInfo {
+  box?: [number, number, number, number];
+  problem: FaceProblem | null;
+  face_px?: number; // the face's width in the frame, in pixels
+  state?: 'match' | 'pending' | 'ask' | 'unknown' | 'unclear';
+  label?: string;
+  candidate?: string | null;
+  similarity?: number;
+  kept?: boolean;
+}
+
+export type FaceProblem = 'none' | 'cut' | 'small' | 'turned' | 'blurry' | 'unsure';
+
+/** Recognising people by their face on an object sensor (defaults: config face_defaults), with its
+ * own face limits: an unset (or null) one follows the global value. */
+export interface FaceSettings extends FaceOverrides {
+  enabled: boolean;
+  /** Put faces nobody was taught for in the review queue ("Who is this?"). */
+  ask_unknown: boolean;
+}
+
+/** The tunable face limits: the smallest face (its width in pixels) and the similarities. */
+export type FaceKey = 'min_face_px' | 'match_similarity' | 'sure_similarity' | 'ask_similarity' | 'keep_similarity';
+export type FaceLimits = Record<FaceKey, number>;
+export type FaceOverrides = Partial<Record<FaceKey, number | null>>;
+
+/** GET /face-limits: the face model's defaults, what the user set and the result. */
+export interface FaceLimitsInfo {
+  model: string;
+  defaults: FaceLimits;
+  values: FaceOverrides;
+  effective: FaceLimits;
+}
+
+/** GET /people: the people (shared by every object sensor that recognises faces). */
+export interface People {
+  model: FaceStatus;
+  /** The sensors that recognise faces. */
+  sensors: number[];
+  people: Person[];
+  /** Pairs of people whose closest faces come near the match threshold. */
+  look_alikes: { a: string; b: string; similarity: number }[];
+}
+
+export interface Person {
+  key: string;
+  name: string;
+  /** Their own entity: the slug of the sensor that sees them now ('not_seen': none), and when and
+   * on which sensor they were last seen. */
+  seen: { now: string; at: number | null; sensor_id: number | null; sensor_name: string | null };
+  /** When the oldest taught face was taught. */
+  oldest: string | null;
+  /** `sensor_name`: the camera it was taught on (null once that sensor is deleted); `suspect`:
+   * the person a face is closer to than to its own (possibly the wrong name). */
+  faces: {
+    id: number;
+    origin: string;
+    is_night: boolean;
+    created_at: string;
+    sensor_id: number | null;
+    sensor_name: string | null;
+    suspect: string | null;
+  }[];
+}
+
+/** POST /people/photos: faces added from photos or videos, and the files that had none usable. */
+export interface PhotoResult {
+  label: string | null;
+  name: string | null;
+  added: number;
+  skipped: { file: string; message: string }[];
+  faces: number | null;
+}
+
+/** POST /import: the new sensor; `faces_off`: it recognised faces where it was exported (now off). */
+export interface ImportResult {
+  id: number;
+  skipped: number;
+  faces_off: boolean;
+}
+
+/** The face model: chosen, loaded, downloading (bytes) or why it failed. */
+export interface FaceStatus {
+  model: string;
+  loaded: boolean;
+  loading: boolean;
+  progress: { done: number; total: number } | null;
+  error: string;
+  downloaded: boolean;
+}
+
+export interface FaceModelInfo extends BackboneInfo {
+  /** What its makers say it was trained on. */
+  data: string;
+  detector: { name: string; license: string; data: string; source: string };
+}
+
+/** An object sensor's review question ("Is this Our car?"), in a history row's `probs.ask`. About a
+ * face ("Is this Kari?", "Who is this?" when label is the unknown key): `face` is the face's box. */
 export interface ObjectQuestion {
   label: string;
   similarity: number;
   box: [number, number, number, number];
   detected: string;
+  face?: [number, number, number, number];
+  /** About a face: the closest face taught as that person, to compare with. */
+  example?: number | null;
 }
 
 /** An own label of an object sensor: a kind of one of its objects, e.g. "Our car" (parent "car"). */
@@ -191,6 +303,8 @@ export interface OwnLabel {
   key: string;
   name: string;
   parent: string;
+  /** A person (shared by every sensor, GET /people): added by the backend while the sensor recognises faces. */
+  face?: boolean;
 }
 
 export interface ObjectSettings {
@@ -199,6 +313,22 @@ export interface ObjectSettings {
   clear_after_s: number;
   /** Compare boxes with what was taught; off = the detector alone. */
   use_taught: boolean;
+  /** This sensor's own teaching limits; a missing one follows the global value. */
+  teach?: TeachOverrides;
+  faces?: FaceSettings;
+}
+
+export type TeachKey = 'match_similarity' | 'keep_similarity' | 'ask_similarity' | 'rescue_similarity' | 'rescue_floor';
+export type TeachLimits = Record<TeachKey, number>;
+/** Teaching limits that may be unset (null): globally the state model's default, on a sensor the global value. */
+export type TeachOverrides = Partial<Record<TeachKey, number | null>>;
+
+/** GET /teach-limits: the global teaching limits. */
+export interface TeachLimitsInfo {
+  backbone: string;
+  defaults: TeachLimits;
+  values: TeachOverrides;
+  effective: TeachLimits;
 }
 
 export interface ObjectLive {
@@ -215,9 +345,19 @@ export interface SensorObjects extends ObjectSettings {
   custom: OwnLabel[];
   live: ObjectLive[];
   detections: Detection[];
-  /** Boxes taught so far, and the objects whose boxes are compared with them. */
+  /** Boxes taught so far, faces taught on this camera (the people are shared: GET /people), and the
+   * objects whose boxes are compared with the boxes. */
   taught: number;
+  taught_faces: number;
   taught_keys: string[];
+  /** Of the last person boxes looked at for a face, how many had a usable one, and why the others not. */
+  face_stats: {
+    looked: number;
+    usable: number;
+    problems: Partial<Record<FaceProblem, number>>;
+    frame: [number, number] | null; // width and height of the last frame looked at
+    min_face_px: number | null; // the smallest face it was looked at with
+  };
 }
 
 /** One taught box; label "none" = not what the detector said, detected null = a box it missed. */
@@ -265,6 +405,8 @@ export interface Live {
   probs: Record<string, number>;
   last_run: number | null;
   in_burst: boolean;
+  /** Seconds between checks of that burst (a trigger's, or looking for a face while a person is there). */
+  burst_interval_s?: number | null;
   change_score: number | null;
   last_trigger: TriggerInfo | null;
   /** Why the sensor's light could not be switched ('' = fine). */
@@ -370,7 +512,12 @@ export interface AppConfig {
   object_labels: ObjectLabel[];
   object_popular: string[];
   /** Teaching object sensors: the label of a box that is not what the detector said. */
-  teach: { none_label: string; max_labels: number };
+  teach: { none_label: string; max_labels: number; tunable: TeachKey[]; limits: Record<TeachKey, [number, number]> };
+  face_defaults: FaceSettings;
+  face_limits: Record<FaceKey, [number, number]>;
+  /** The key (and entity) of a face nobody was taught for. */
+  face_unknown_key: string;
+  faces: { max_people: number; max_faces_per_person: number; suggest_faces: number; stats_window: number };
   reading_sensor_defaults: { interval_s: number; threshold: number; debounce: number };
   reading_defaults: ReadingSettings;
   reading_limits: Record<'decimals' | 'digits' | 'max_step' | 'spot_rate' | 'rate_window_min', [number, number]>;
@@ -407,6 +554,8 @@ export interface Status {
   wheel_reader: string | null;
   wheel_reader_name: string | null;
   wheel_reader_error: string;
+  /** The face model, and how many people and sensors that recognise faces there are. */
+  faces: FaceStatus & { people: number; sensors: number };
   mqtt: { connected: boolean; host: string | null; error: string };
   home_assistant: boolean;
   ha_events: { enabled: boolean; connected: boolean; entities: number; error: string };
@@ -448,7 +597,8 @@ export interface Prediction {
   review_reason: 'low_confidence' | 'flip' | 'spot_check' | 'rejected' | 'ask' | null;
   reviewed: boolean;
   has_frame: boolean;
-  /** Object sensors: state_key = the class or own label, published_key = 'on' | 'off' | 'filtered' | 'ask'. */
+  /** Object sensors: state_key = the class or own label, published_key = 'on' | 'off' | 'filtered' | 'ask' |
+   * 'face' (a face nobody is named for). */
   detections: Detection[] | null;
   /** Reading sensors: did the reader read the right number (null = not verified)? */
   read_ok: boolean | null;
@@ -526,9 +676,23 @@ export interface BackboneInfo {
   name: string;
   description: string;
   installed: boolean;
+  /** Downloaded (not included in the app): it can be deleted while not in use. */
+  downloaded: boolean;
+  /** Why it cannot be deleted now ("" if it can). */
+  in_use: string;
   size: number;
+  license: string;
+  source: string;
+  /** Rough extra memory once loaded, and the time of one check (4 threads of a desktop CPU). */
+  ram_mb: number;
+  time_ms: number;
+  /** Rank within its kind, 1-5. */
+  accuracy: number;
 }
 
+/** The AI models a user chooses, by their list in GET /settings. */
+export type ModelKind = 'backbones' | 'detectors' | 'face_models' | 'readers';
+
 /** GET /storage: disk use and the history limits (whichever is reached first applies). */
 export interface StorageInfo {
   history_bytes: number;
@@ -542,10 +706,7 @@ export interface StorageInfo {
   history_max_gb: number;
 }
 
-export interface DetectorInfo extends BackboneInfo {
-  license: string;
-  source: string;
-}
+export type DetectorInfo = BackboneInfo;
 
 export interface SettingsInfo {
   backbone: string;
@@ -557,6 +718,9 @@ export interface SettingsInfo {
   /** The wheel reader for mechanical counters (one model for now, nothing to choose). */
   wheel_reader: string;
   wheel_readers: DetectorInfo[];
+  /** Recognising faces on object sensors: the recogniser chosen; downloaded when a sensor turns faces on. */
+  face_model: string;
+  face_models: FaceModelInfo[];
   options: Record<string, string | number>;
 }
 
diff --git a/visionstate/frontend/src/lib/ui.ts b/visionstate/frontend/src/lib/ui.ts
index 40e88f5..9c80b2e 100644
--- a/visionstate/frontend/src/lib/ui.ts
+++ b/visionstate/frontend/src/lib/ui.ts
@@ -58,6 +58,96 @@ export const REVIEW_FIELDS = [
   { key: 'spot_rate', label: 'Random spot checks of confident frames', unit: '%', scale: 100, step: 0.5 },
 ] as const;
 
+/** The teaching limits a user can change (settings.TEACH_TUNABLE), in the order shown. */
+export const TEACH_FIELDS = [
+  {
+    key: 'match_similarity',
+    label: 'Recognised as a box you taught from',
+    help: 'How close a box must be to one you taught to take its answer.',
+  },
+  {
+    key: 'keep_similarity',
+    label: 'Keeps that answer, while it stays in place, down to',
+    help: 'A parked car stays "Our car" when the light changes a little.',
+  },
+  {
+    key: 'ask_similarity',
+    label: 'Asks you in the review queue from',
+    help: 'Between this and the first value, a box that may be one of your own labels is asked about.',
+  },
+  {
+    key: 'rescue_similarity',
+    label: 'Finds a missed object again from',
+    help: 'Once you drew a box the AI missed, unsure boxes this close to it count.',
+  },
+  {
+    key: 'rescue_floor',
+    label: 'Looks again at AI boxes down to',
+    help: 'The weakest AI confidence looked at for missed objects.',
+  },
+] as const;
+
+/** The wizard warns of a low-resolution stream: a picture whose longest side is below this, or a
+ * camera entity or URL whose name says so (Reolink "fluent", "sub" streams, "low"). */
+export const SMALL_FRAME_PX = 1280;
+export const LOW_STREAM_NAME = /(^|[^a-z])(fluent|sub|low|lowres)([^a-z]|$)/i;
+
+/** Files a phone offers for faces: photos (its camera or gallery), short videos, ZIP archives. */
+export const PHOTO_ACCEPT = 'image/*,video/*,.zip';
+
+/** The faces' limits, on the Settings page and an object sensor's Faces card (in this order). */
+export const FACE_FIELDS = [
+  {
+    key: 'min_face_px',
+    label: 'Smallest face',
+    help: 'Its width in the picture. Smaller faces are not used: they are easily mistaken.',
+    unit: 'px',
+  },
+  {
+    key: 'match_similarity',
+    label: 'Recognised as a person from',
+    help: 'How close a face must be to the faces you taught; a second check must agree.',
+  },
+  {
+    key: 'sure_similarity',
+    label: 'Sure at once from',
+    help: 'Named in the first check, without waiting for a second one.',
+  },
+  {
+    key: 'ask_similarity',
+    label: 'Asks you in the review queue from',
+    help: 'Between this and the first similarity: "Is this Kari?"',
+  },
+  {
+    key: 'keep_similarity',
+    label: 'Keeps the name, while they stay, down to',
+    help: 'Someone who stays where they were keeps their name as their face turns.',
+  },
+] as const;
+
+/** The model comparison under Settings → AI model: one row per kind, in the order shown. */
+export const MODEL_KINDS = [
+  {
+    key: 'backbones',
+    title: 'State sensors',
+    text: 'Turns the region into numbers that a small model per sensor learns your states from. A larger model tells similar states (and taught objects) apart better.',
+  },
+  {
+    key: 'detectors',
+    title: 'Object sensors',
+    text: 'Finds people, vehicles and animals. Larger models find more small, far-off and partly hidden objects.',
+  },
+  {
+    key: 'face_models',
+    title: 'Faces (object sensors)',
+    text: 'Tells who a person is from their face; downloaded when a sensor recognises faces. Its size includes the face finder.',
+  },
+  { key: 'readers', title: 'Displays', text: 'Reads the digits of a display; small helps on unusual fonts.' },
+  { key: 'wheel_readers', title: 'Mechanical counters', text: 'Reads each wheel of a counter.' },
+] as const;
+export const MODEL_COMPARE_NOTE =
+  'Rough numbers: extra memory once loaded, and time per check on 4 cores of a desktop PC. A Raspberry Pi 4 takes about 20–40 times as long; a check only runs when it is due or something changed.';
+
 export const SAMPLE_ORIGINS: Record<string, string> = {
   snapshot: 'Snapshot',
   upload: 'Upload',
@@ -170,6 +260,7 @@ export const ENTITY_ID_PATTERN = /^[a-z0-9_]+\.[a-z0-9_]+$/;
 export const TRIGGER_SOURCES: Record<string, string> = {
   entity: 'Entity changed',
   change: 'Image changed',
+  person: 'Person seen',
 };
 
 /** Placeholder the backend puts where credentials were removed from an exported URL (redact.MASK). */
@@ -186,6 +277,7 @@ export const HISTORY_EVENTS: Record<string, string> = {
   cleared: 'Cleared',
   filtered: 'Filtered away',
   asked: 'Asked “is it yours?”',
+  face_seen: 'Face seen, not named',
   value: 'New value',
   rejected: 'Rejected reading',
   verified: 'Checked by hand',
diff --git a/visionstate/frontend/src/pages/Dashboard.svelte b/visionstate/frontend/src/pages/Dashboard.svelte
index 37ceafe..e29c2b6 100644
--- a/visionstate/frontend/src/pages/Dashboard.svelte
+++ b/visionstate/frontend/src/pages/Dashboard.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
   import { api } from '../lib/api';
-  import { app, shownConfidence, stateInfo, toast, toastError } from '../lib/app.svelte';
+  import { app, shownConfidence, stateInfo, toastError, toastImported } from '../lib/app.svelte';
   import AnalysedFrame from '../lib/components/AnalysedFrame.svelte';
   import Icon from '../lib/components/Icon.svelte';
   import LiveFrame from '../lib/components/LiveFrame.svelte';
@@ -36,9 +36,9 @@
     const file = (e.currentTarget as HTMLInputElement).files?.[0];
     if (!file) return;
     try {
-      const { id, skipped } = await api.importBundle(file);
-      toast(skipped ? `Sensor imported; ${skipped} unreadable image${skipped === 1 ? '' : 's'} skipped` : 'Sensor imported');
-      go(paths.sensor(id));
+      const result = await api.importBundle(file);
+      toastImported(result);
+      go(paths.sensor(result.id, result.faces_off ? 'settings' : ''));
     } catch (err) {
       toastError(err);
     } finally {
diff --git a/visionstate/frontend/src/pages/NewSensor.svelte b/visionstate/frontend/src/pages/NewSensor.svelte
index bfc2373..ad5b8eb 100644
--- a/visionstate/frontend/src/pages/NewSensor.svelte
+++ b/visionstate/frontend/src/pages/NewSensor.svelte
@@ -15,7 +15,7 @@
   import { isPolygon, toRectangle } from '../lib/roi';
   import { go, href, paths } from '../lib/router.svelte';
   import type { ReadingSettings, Roi, SensorKind, Triggers } from '../lib/types';
-  import { SENSOR_KIND_INFO } from '../lib/ui';
+  import { LOW_STREAM_NAME, SENSOR_KIND_INFO, SMALL_FRAME_PX } from '../lib/ui';
   import ObjectsStep from './wizard/ObjectsStep.svelte';
   import ReadingStep from './wizard/ReadingStep.svelte';
   import StatesStep from './wizard/StatesStep.svelte';
@@ -35,8 +35,12 @@
   let kind = $state<SensorKind>('single_state');
   let states = $state<{ name: string; color?: string }[]>([{ name: 'Open' }, { name: 'Closed' }]);
   let classes = $state<string[]>([...(app.config?.object_defaults.classes ?? [])]);
+  let faces = $state(false); // recognise people by their face (objects with Person)
   let reading = $state<ReadingSettings>({ ...app.config!.reading_defaults });
   let previewUrl = $state<string | null>(null);
+  let previewSize = $state<[number, number] | null>(null);
+  // A small picture, or a source named like a sub-stream: maybe the camera's low-resolution stream.
+  const lowStream = $derived(previewSize !== null && (Math.max(...previewSize) < SMALL_FRAME_PX || LOW_STREAM_NAME.test(source)));
   let previewError = $state('');
   let saving = $state(false);
   // Start from the backend defaults (GET /config), the same values a sensor gets when this step is skipped.
@@ -88,9 +92,13 @@
   function loadPreview() {
     previewError = '';
     previewUrl = null;
+    previewSize = null;
     const url = api.previewUrl(sourceType, source);
     const img = new Image();
-    img.onload = () => (previewUrl = url);
+    img.onload = () => {
+      previewUrl = url;
+      previewSize = [img.naturalWidth, img.naturalHeight];
+    };
     img.onerror = () => (previewError = 'Could not get a frame from this source. Check the camera or URL.');
     img.src = url;
   }
@@ -111,7 +119,15 @@
         source: source.trim(),
         roi,
         states: learned ? states.map((s) => ({ name: s.name.trim(), color: s.color })) : [],
-        ...(kind === 'objects' ? { objects: { ...app.config!.object_defaults, classes } } : {}),
+        ...(kind === 'objects'
+          ? {
+              objects: {
+                ...app.config!.object_defaults,
+                classes,
+                faces: { ...app.config!.face_defaults, enabled: faces && classes.includes('person') },
+              },
+            }
+          : {}),
         ...(kind === 'reading' ? { reading } : {}),
         interval_s,
         triggers,
@@ -182,6 +198,16 @@
         {#if previewError}
           <div class="notice danger"><Icon name="alert" />{previewError}</div>
         {:else}
+          {#if lowStream && previewSize}
+            <div class="notice warn small" data-testid="low-stream">
+              <Icon name="alert" />
+              <span>
+                This picture is {previewSize[0]}×{previewSize[1]}. If the camera has a higher resolution, this may be its
+                low-resolution stream: pick its main stream instead, which Home Assistant often hides (a disabled camera
+                entity of the same device).
+              </span>
+            </div>
+          {/if}
           <div class="frame">
             <RoiEditor src={previewUrl} bind:roi editable />
           </div>
@@ -215,7 +241,7 @@
         {#if kind === 'reading'}
           <ReadingStep bind:this={detectStep} {sourceType} {source} {entity} bind:roi bind:reading />
         {:else if kind === 'objects'}
-          <ObjectsStep bind:this={detectStep} {sourceType} {source} {name} bind:roi bind:classes />
+          <ObjectsStep bind:this={detectStep} {sourceType} {source} {name} bind:roi bind:classes bind:faces />
         {:else}
           <StatesStep {entity} {stateKeys} bind:states />
         {/if}
diff --git a/visionstate/frontend/src/pages/People.svelte b/visionstate/frontend/src/pages/People.svelte
new file mode 100644
index 0000000..2668a87
--- /dev/null
+++ b/visionstate/frontend/src/pages/People.svelte
@@ -0,0 +1,132 @@
+<script lang="ts">
+  // The people VisionState knows by their face, shared by every object sensor that recognises
+  // faces: their faces (from every camera), where they were seen, renaming and forgetting. Each
+  // person also has their own Home Assistant entity, sensor.visionstate_<key>_seen_by: the sensor that
+  // sees them now, or not_seen.
+  import { api } from '../lib/api';
+  import { app, refreshStatus, toast, toastError } from '../lib/app.svelte';
+  import ConfirmButton from '../lib/components/ConfirmButton.svelte';
+  import Icon from '../lib/components/Icon.svelte';
+  import PeopleCards from '../lib/components/PeopleCards.svelte';
+  import { photoMessage } from '../lib/objects';
+  import { PHOTO_ACCEPT } from '../lib/ui';
+
+  let version = $state(0); // a new one reloads the cards
+
+  const faces = $derived(app.status?.faces);
+  const room = $derived((faces?.people ?? 0) < (app.config?.faces.max_people ?? 0));
+
+  let newName = $state('');
+  let adding = $state(false);
+  async function addPerson(e: Event) {
+    const input = e.currentTarget as HTMLInputElement;
+    const files = [...(input.files ?? [])];
+    input.value = '';
+    const name = newName.trim();
+    if (!files.length || !name) return;
+    adding = true;
+    try {
+      const result = await api.addPhotos({ new_person: name }, files);
+      toast(photoMessage(result));
+      if (result.added) {
+        newName = '';
+        version += 1;
+        refreshStatus();
+      }
+    } catch (err) {
+      toastError(err);
+    } finally {
+      adding = false;
+    }
+  }
+
+  async function forgetEveryone() {
+    try {
+      await api.forgetPeople();
+      toast('Everyone is forgotten, with their faces and entities');
+      version += 1;
+      refreshStatus();
+    } catch (err) {
+      toastError(err);
+    }
+  }
+</script>
+
+<div class="page">
+  <h1>People</h1>
+  <p class="muted intro">
+    The people you named by their face. Every camera that recognises faces knows them: each gets an on/off sensor
+    there, and their own sensors in Home Assistant say which camera sees them now
+    (<span class="mono">sensor.visionstate_…_seen_by</span>) and when they were last seen
+    (<span class="mono">…_last_seen</span>).
+  </p>
+  {#if faces && !faces.sensors}
+    <div class="notice">
+      No sensor recognises faces yet: turn it on under an object sensor's Settings → Faces (one that looks for Person).
+    </div>
+  {/if}
+  {#if room && faces?.sensors}
+    <section class="card pad col add" data-testid="add-person">
+      <h3>Add a person</h3>
+      <p class="small muted">
+        A quick start: a few photos of their face, taken with the phone or picked from its gallery, or a short video
+        turning the head a little. Faces taught on each camera (tap a person on its Live tab) recognise them best.
+      </p>
+      <div class="row wrap add-row">
+        <input class="input" bind:value={newName} placeholder="Name" maxlength="64" aria-label="Name of the new person" />
+        <input
+          type="file"
+          accept={PHOTO_ACCEPT}
+          multiple
+          class="sr-only"
+          id="new-person-photos"
+          onchange={addPerson}
+          disabled={!newName.trim() || adding}
+        />
+        <label class="btn primary" for="new-person-photos" class:disabled={!newName.trim() || adding}>
+          <Icon name="camera" size={14} /> {adding ? 'Adding…' : 'Add photos'}
+        </label>
+      </div>
+    </section>
+  {/if}
+  {#key version}
+    <div class="col cards"><PeopleCards /></div>
+  {/key}
+  {#if faces?.people}
+    <div class="row wrap forget">
+      <ConfirmButton class="btn sm danger" onconfirm={forgetEveryone} confirmLabel="Tap again to forget everyone">
+        <Icon name="trash" size={14} /> Forget everyone
+      </ConfirmButton>
+      <span class="xsmall faint">Every person, their faces and their entities, on every camera.</span>
+    </div>
+  {/if}
+</div>
+
+<style>
+  .intro {
+    max-width: 720px;
+  }
+  .add {
+    gap: var(--space-2);
+    max-width: 900px;
+    margin-bottom: var(--space-4);
+  }
+  .add-row {
+    gap: var(--space-2);
+  }
+  .add-row .input {
+    max-width: 240px;
+  }
+  label.disabled {
+    opacity: 0.5;
+    pointer-events: none;
+  }
+  .cards {
+    gap: var(--space-4);
+    max-width: 900px;
+  }
+  .forget {
+    gap: var(--space-2);
+    margin-top: var(--space-6);
+  }
+</style>
diff --git a/visionstate/frontend/src/pages/Review.svelte b/visionstate/frontend/src/pages/Review.svelte
index 25db284..6fdafe2 100644
--- a/visionstate/frontend/src/pages/Review.svelte
+++ b/visionstate/frontend/src/pages/Review.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
   import { api } from '../lib/api';
-  import { refreshStatus, stateInfo, toast, toastError } from '../lib/app.svelte';
+  import { app, refreshStatus, stateInfo, toast, toastError } from '../lib/app.svelte';
   import ConfirmButton from '../lib/components/ConfirmButton.svelte';
   import DetectionBoxes from '../lib/components/DetectionBoxes.svelte';
+  import FaceQuestion from '../lib/components/FaceQuestion.svelte';
   import Icon from '../lib/components/Icon.svelte';
   import ReadingVerdict from '../lib/components/ReadingVerdict.svelte';
   import RoiEditor from '../lib/components/RoiEditor.svelte';
@@ -48,6 +49,7 @@
   /** Sidebar line: what was read, or the state the AI predicted. */
   const summary = (item: ReviewItem) => {
     const q = question(item);
+    if (q?.face && q.label === app.config?.face_unknown_key) return 'Who is this?';
     if (q) return `${labelName(item, q.label)}?`;
     return isReading(item) ? `“${readingDetail(item).text || '—'}”` : `${stateInfo(item.sensor, item.state_key).name} ${pct(item.confidence)}`;
   };
@@ -142,6 +144,7 @@
   function onkey(e: KeyboardEvent) {
     if (!current || isReading(current) || (e.target as HTMLElement).closest('input, select, textarea')) return;
     if (e.key === 'Escape') editing = null;
+    else if (question(current)?.face) return; // FaceQuestion has its own keys
     else if (question(current)) {
       if (e.key === 'Enter') answerQuestion('yes');
       else if (e.key.toLowerCase() === 'n') answerQuestion('no');
@@ -255,6 +258,19 @@
             <ReadingVerdict item={current} reading={current.sensor.reading} unit={unitOf(current)} large onanswer={readingAnswered} />
           {/key}
         </div>
+      {:else if current && question(current)?.face}
+        {@render header(current)}
+        {#key current.id}
+          <FaceQuestion
+            item={current}
+            question={question(current)!}
+            given={current.id in given ? given[current.id] : undefined}
+            onanswer={(text, answer) => {
+              if (current) given[current.id] = answer;
+              answered(text);
+            }}
+          />
+        {/key}
       {:else if current && question(current)}
         {@const q = question(current)!}
         {@const name = labelName(current, q.label)}
diff --git a/visionstate/frontend/src/pages/SensorPage.svelte b/visionstate/frontend/src/pages/SensorPage.svelte
index a686d12..27861f7 100644
--- a/visionstate/frontend/src/pages/SensorPage.svelte
+++ b/visionstate/frontend/src/pages/SensorPage.svelte
@@ -2,6 +2,7 @@
   import { onDestroy } from 'svelte';
   import { api } from '../lib/api';
   import { shownConfidence, stateInfo, toast, toastError } from '../lib/app.svelte';
+  import ExportButton from '../lib/components/ExportButton.svelte';
   import Icon from '../lib/components/Icon.svelte';
   import HistoryView from '../lib/components/history/HistoryView.svelte';
   import ObjectChips from '../lib/components/ObjectChips.svelte';
@@ -95,7 +96,7 @@
         </div>
         <span class="spacer"></span>
         <div class="row actions">
-          <a class="btn sm" href={api.exportUrl(sensor.id)} download><Icon name="download" size={14} /> Export</a>
+          <ExportButton {sensor} />
           <button class="btn sm" onclick={togglePause}>
             <Icon name={sensor.enabled ? 'pause' : 'play'} size={14} />
             {sensor.enabled ? 'Pause' : 'Resume'}
diff --git a/visionstate/frontend/src/pages/Settings.svelte b/visionstate/frontend/src/pages/Settings.svelte
index d98c40d..e6580ef 100644
--- a/visionstate/frontend/src/pages/Settings.svelte
+++ b/visionstate/frontend/src/pages/Settings.svelte
@@ -1,22 +1,91 @@
 <script lang="ts">
   import { api } from '../lib/api';
-  import { app, refreshStatus, toast, toastError } from '../lib/app.svelte';
+  import { app, refreshStatus, toast, toastError, toastImported } from '../lib/app.svelte';
+  import FaceLimitsEditor from '../lib/components/FaceLimitsEditor.svelte';
   import Icon from '../lib/components/Icon.svelte';
+  import ModelCompare from '../lib/components/ModelCompare.svelte';
   import ReminderCard from '../lib/components/ReminderCard.svelte';
   import ReviewRulesEditor from '../lib/components/ReviewRulesEditor.svelte';
   import StorageCard from '../lib/components/StorageCard.svelte';
-  import { mb } from '../lib/format';
+  import TeachLimitsEditor from '../lib/components/TeachLimitsEditor.svelte';
+  import { bySize, mb, size } from '../lib/format';
   import { go, paths } from '../lib/router.svelte';
-  import type { ReviewRules, SettingsInfo } from '../lib/types';
+  import type {
+    FaceLimitsInfo,
+    FaceOverrides,
+    FaceStatus,
+    ReviewRules,
+    SettingsInfo,
+    TeachLimitsInfo,
+    TeachOverrides,
+  } from '../lib/types';
 
   let info = $state<SettingsInfo | null>(null);
   let backbone = $state('');
   let detector = $state('');
   let reader = $state('');
+  let faceModel = $state('');
   let saving = $state(false);
   let importInput: HTMLInputElement;
   let reviewRules = $state<ReviewRules | null>(null);
   let savingReview = $state(false);
+  let teach = $state<TeachLimitsInfo | null>(null);
+  let teachValues = $state<TeachOverrides>({});
+  let savingTeach = $state(false);
+  const setOnly = (v: TeachOverrides) => JSON.stringify(Object.entries(v).filter(([, x]) => x !== null && x !== undefined).sort());
+  const teachChanged = $derived(teach !== null && setOnly(teachValues) !== setOnly(teach.values));
+  let faceLimits = $state<FaceLimitsInfo | null>(null);
+  let faceValues = $state<FaceOverrides>({});
+  let savingFaces = $state(false);
+  const facesChanged = $derived(faceLimits !== null && setOnly(faceValues) !== setOnly(faceLimits.values));
+
+  function loadFaceLimits() {
+    api
+      .faceLimits()
+      .then((f) => {
+        faceLimits = f;
+        faceValues = { ...f.values };
+      })
+      .catch(toastError);
+  }
+  loadFaceLimits();
+
+  async function saveFaceLimits() {
+    savingFaces = true;
+    try {
+      faceLimits = await api.saveFaceLimits(faceValues);
+      faceValues = { ...faceLimits.values };
+      toast('Face limits saved');
+    } catch (err) {
+      toastError(err);
+    } finally {
+      savingFaces = false;
+    }
+  }
+
+  function loadTeach() {
+    api
+      .teachLimits()
+      .then((t) => {
+        teach = t;
+        teachValues = { ...t.values };
+      })
+      .catch(toastError);
+  }
+  loadTeach();
+
+  async function saveTeach() {
+    savingTeach = true;
+    try {
+      teach = await api.saveTeachLimits(teachValues);
+      teachValues = { ...teach.values };
+      toast('Teaching limits saved');
+    } catch (err) {
+      toastError(err);
+    } finally {
+      savingTeach = false;
+    }
+  }
 
   api
     .reviewRules()
@@ -43,6 +112,7 @@
       backbone = s.backbone;
       detector = s.detector;
       reader = s.reader;
+      faceModel = s.face_model;
     })
     .catch(toastError);
 
@@ -50,16 +120,21 @@
   const selectedDetector = $derived(info?.detectors.find((d) => d.id === detector));
   const selectedReader = $derived(info?.readers.find((r) => r.id === reader));
   const wheelReader = $derived(info?.wheel_readers.find((r) => r.id === info?.wheel_reader));
+  const selectedFace = $derived(info?.face_models.find((m) => m.id === faceModel));
   const retrains = $derived(info !== null && backbone !== info.backbone);
-  const changed = $derived(info !== null && (retrains || detector !== info.detector || reader !== info.reader));
+  const changed = $derived(
+    info !== null && (retrains || detector !== info.detector || reader !== info.reader || faceModel !== info.face_model),
+  );
 
   async function save() {
     saving = true;
     try {
       const retrained = retrains;
-      info = await api.saveSettings({ backbone, detector, reader });
+      info = await api.saveSettings({ backbone, detector, reader, face_model: faceModel });
       toast(retrained ? 'AI model changed — state sensors are retraining' : 'AI models changed');
       refreshStatus();
+      if (retrained) loadTeach(); // the defaults depend on the state model
+      loadFaceLimits(); // and the face limits' on the face model
     } catch (err) {
       toastError(err);
     } finally {
@@ -71,9 +146,9 @@
     const file = (e.currentTarget as HTMLInputElement).files?.[0];
     if (!file) return;
     try {
-      const { id, skipped } = await api.importBundle(file);
-      toast(skipped ? `Sensor imported; ${skipped} unreadable image${skipped === 1 ? '' : 's'} skipped` : 'Sensor imported');
-      go(paths.sensor(id));
+      const result = await api.importBundle(file);
+      toastImported(result);
+      go(paths.sensor(result.id, result.faces_off ? 'settings' : ''));
     } catch (err) {
       toastError(err);
     } finally {
@@ -81,6 +156,14 @@
     }
   }
 
+  function faceStatus(f: FaceStatus): string {
+    if (f.error) return f.error;
+    if (f.progress) return `downloading… ${size(f.progress.done)} of ${size(f.progress.total)}`;
+    if (f.loaded) return info?.face_models.find((m) => m.id === f.model)?.name ?? f.model;
+    if (f.loading) return 'loading…';
+    return 'loaded when a sensor recognises faces';
+  }
+
   const statusRows = $derived(
     app.status
       ? [
@@ -122,6 +205,11 @@
             value: app.status.wheel_reader_error || app.status.wheel_reader_name || 'loaded when a mechanical counter is read',
             ok: !app.status.wheel_reader_error,
           },
+          {
+            label: 'Face model',
+            value: faceStatus(app.status.faces),
+            ok: !app.status.faces.error,
+          },
         ]
       : [],
   );
@@ -147,7 +235,7 @@
         <label class="field">
           State sensors (learned)
           <select class="input" bind:value={backbone}>
-            {#each info.backbones as b (b.id)}
+            {#each bySize(info.backbones) as b (b.id)}
               <option value={b.id}>{b.name}{b.installed ? '' : ` · download ${mb(b.size)}`}</option>
             {/each}
           </select>
@@ -156,7 +244,7 @@
         <label class="field">
           Object sensors
           <select class="input" bind:value={detector}>
-            {#each info.detectors as d (d.id)}
+            {#each bySize(info.detectors) as d (d.id)}
               <option value={d.id}>{d.name}{d.installed ? '' : ` · download ${mb(d.size)}`}</option>
             {/each}
           </select>
@@ -167,10 +255,26 @@
             >
           {/if}
         </label>
+        <label class="field">
+          Faces (object sensors)
+          <select class="input" bind:value={faceModel}>
+            {#each bySize(info.face_models) as m (m.id)}
+              <option value={m.id}>{m.name}{m.installed ? '' : ` · download ${mb(m.size)}`}</option>
+            {/each}
+          </select>
+          {#if selectedFace}
+            <span class="hint"
+              >{selectedFace.description} {selectedFace.license}, <a href={selectedFace.source} target="_blank" rel="noreferrer">source</a>;
+              {selectedFace.data} Faces are found with {selectedFace.detector.name} ({selectedFace.detector.license},
+              <a href={selectedFace.detector.source} target="_blank" rel="noreferrer">source</a>). Downloaded when a sensor turns
+              face recognition on; changing it compares every taught face again (the people are kept).</span
+            >
+          {/if}
+        </label>
         <label class="field">
           Reading sensors: displays
           <select class="input" bind:value={reader}>
-            {#each info.readers as r (r.id)}
+            {#each bySize(info.readers) as r (r.id)}
               <option value={r.id}>{r.name}{r.installed ? '' : ` · download ${mb(r.size)}`}</option>
             {/each}
           </select>
@@ -199,6 +303,7 @@
           </button>
           <span class="xsmall faint">A new state model retrains every state sensor from its stored images. Object and reading sensors need no training.</span>
         </div>
+        <ModelCompare {info} ondeleted={(next) => (info = next)} />
       {/if}
     </section>
 
@@ -213,6 +318,49 @@
       {/if}
     </section>
 
+    <section class="card pad col" data-testid="teach-limits">
+      <h3>Teaching object sensors</h3>
+      <p class="small muted">
+        How closely a box must resemble the boxes you taught an object sensor. Each sensor can override these on its Settings
+        tab.
+      </p>
+      {#if teach}
+        <TeachLimitsEditor
+          bind:value={teachValues}
+          inherited={teach.defaults}
+          inheritedFrom={`the default of ${info?.backbones.find((b) => b.id === teach?.backbone)?.name ?? 'the state model'}`}
+        />
+        <p class="xsmall faint">
+          The state model also compares the taught boxes, so the defaults follow it. Values you set yourself stay when you
+          switch the state model; check them afterwards.
+        </p>
+        <button class="btn primary" style="align-self:flex-start" disabled={!teachChanged || savingTeach} onclick={saveTeach}>
+          {savingTeach ? 'Saving…' : 'Save teaching limits'}
+        </button>
+      {/if}
+    </section>
+
+    <section class="card pad col" data-testid="face-limits">
+      <h3>Recognising faces</h3>
+      <p class="small muted">
+        For object sensors that recognise faces. Each sensor can override these on its Settings tab (Faces).
+      </p>
+      {#if faceLimits}
+        <FaceLimitsEditor
+          bind:value={faceValues}
+          inherited={faceLimits.defaults}
+          inheritedFrom={`the default of ${info?.face_models.find((m) => m.id === faceLimits?.model)?.name ?? 'the face model'}`}
+        />
+        <p class="xsmall faint">
+          The similarities' defaults follow the face model. Values you set yourself stay when you switch it; check them
+          afterwards.
+        </p>
+        <button class="btn primary" style="align-self:flex-start" disabled={!facesChanged || savingFaces} onclick={saveFaceLimits}>
+          {savingFaces ? 'Saving…' : 'Save face limits'}
+        </button>
+      {/if}
+    </section>
+
     <ReminderCard />
 
     <StorageCard />
diff --git a/visionstate/frontend/src/pages/sensor/LabelTab.svelte b/visionstate/frontend/src/pages/sensor/LabelTab.svelte
index 7870818..676cb46 100644
--- a/visionstate/frontend/src/pages/sensor/LabelTab.svelte
+++ b/visionstate/frontend/src/pages/sensor/LabelTab.svelte
@@ -133,7 +133,7 @@
         <p class="small muted">Label at least two different states to train the first model.</p>
       {/if}
       <div class="trigger">
-        {#if sensor.live.in_burst}<span class="chip info">Checking every {sensor.triggers.burst_interval_s} s</span>{/if}
+        {#if sensor.live.in_burst}<span class="chip info">Checking every {sensor.live.burst_interval_s ?? sensor.triggers.burst_interval_s} s</span>{/if}
         {#if sensor.live.last_trigger}
           <span class="xsmall muted">
             {TRIGGER_SOURCES[sensor.live.last_trigger.source] ?? 'Triggered'} {ago(sensor.live.last_trigger.at)}:
diff --git a/visionstate/frontend/src/pages/sensor/LiveTab.svelte b/visionstate/frontend/src/pages/sensor/LiveTab.svelte
index caf15da..983e9e0 100644
--- a/visionstate/frontend/src/pages/sensor/LiveTab.svelte
+++ b/visionstate/frontend/src/pages/sensor/LiveTab.svelte
@@ -5,7 +5,8 @@
   import AnalysedFrame from '../../lib/components/AnalysedFrame.svelte';
   import Icon from '../../lib/components/Icon.svelte';
   import { ago, pct, plural } from '../../lib/format';
-  import { objectColor, objectCount, objectKeys, objectName } from '../../lib/objects';
+  import FaceStats from '../../lib/components/FaceStats.svelte';
+  import { faceNote, facesOn, objectColor, objectCount, objectKeys, objectName } from '../../lib/objects';
   import { href, paths } from '../../lib/router.svelte';
   import type { Detection, Sensor } from '../../lib/types';
   import { TRIGGER_SOURCES } from '../../lib/ui';
@@ -21,6 +22,11 @@
     keys.map((key) => ({ key, n: objects.detections.filter((d) => counts(d, key)).length })).filter((x) => x.n > 0),
   );
   const filteredAway = $derived(objects.detections.filter((d) => d.filtered).length);
+  // Recognising faces: what the face search said about each person box of the last check.
+  const faces = $derived(facesOn(sensor));
+  const faceNotes = $derived(
+    faces ? objects.detections.filter((d) => d.face && !d.filtered).map((d) => faceNote(d, objects.custom)) : [],
+  );
   // Each class, followed by its own labels ("Rex" under "Dog").
   const rows = $derived(
     objects.live
@@ -87,6 +93,12 @@
           </li>
         {/each}
       </ul>
+      {#if faces}
+        <div class="faces">
+          {#each faceNotes as note, i (i)}<span class="xsmall muted">Person · {note}</span>{/each}
+          <FaceStats {objects} />
+        </div>
+      {/if}
       <p class="xsmall faint" style="margin-top:12px">
         An object is reported after {plural(sensor.debounce, 'check')} with it and cleared {objects.clear_after_s} s after it
         was last seen. Boxes below {pct(sensor.threshold)} are ignored.
@@ -95,7 +107,7 @@
         {/if}
       </p>
       <div class="trigger">
-        {#if sensor.live.in_burst}<span class="chip info">Checking every {sensor.triggers.burst_interval_s} s</span>{/if}
+        {#if sensor.live.in_burst}<span class="chip info">Checking every {sensor.live.burst_interval_s ?? sensor.triggers.burst_interval_s} s</span>{/if}
         {#if sensor.live.last_trigger}
           <span class="xsmall muted">
             {TRIGGER_SOURCES[sensor.live.last_trigger.source] ?? 'Triggered'} {ago(sensor.live.last_trigger.at)}:
@@ -174,6 +186,14 @@
     border: 1px solid var(--c-border-strong);
     color: var(--c-muted);
   }
+  .faces {
+    display: flex;
+    flex-direction: column;
+    gap: 4px;
+    margin-top: var(--space-3);
+    padding-top: var(--space-3);
+    border-top: 1px solid var(--c-border);
+  }
   .trigger {
     display: flex;
     flex-direction: column;
diff --git a/visionstate/frontend/src/pages/sensor/ObjectQualityTab.svelte b/visionstate/frontend/src/pages/sensor/ObjectQualityTab.svelte
index 17bfb2a..69660fb 100644
--- a/visionstate/frontend/src/pages/sensor/ObjectQualityTab.svelte
+++ b/visionstate/frontend/src/pages/sensor/ObjectQualityTab.svelte
@@ -6,6 +6,7 @@
   import { toast, toastError } from '../../lib/app.svelte';
   import ConfirmButton from '../../lib/components/ConfirmButton.svelte';
   import Icon from '../../lib/components/Icon.svelte';
+  import PeopleCards from '../../lib/components/PeopleCards.svelte';
   import TeachableFrame from '../../lib/components/TeachableFrame.svelte';
   import { ago, dateTime, pct } from '../../lib/format';
   import { noneLabel, objectName } from '../../lib/objects';
@@ -32,6 +33,8 @@
   });
 
   const own = $derived(sensor.objects?.custom ?? []);
+  // Boxes taught by their look (faces are under People): only then is "What you taught" shown.
+  const boxesTaught = $derived((sensor.objects?.taught ?? 0) > 0 || own.some((l) => !l.face));
   const compared = $derived((sensor.objects?.taught_keys ?? []).map((k) => objectName(k).toLowerCase()));
 
   interface Group {
@@ -46,7 +49,7 @@
   const groups = $derived.by(() => {
     if (!taught) return [] as Group[];
     const result = new Map<string, Group>();
-    for (const label of taught.labels) {
+    for (const label of taught.labels.filter((l) => !l.face)) {
       result.set(label.key, {
         id: label.key,
         title: label.name,
@@ -106,23 +109,26 @@
 
 <div class="layout">
   <div class="col" style="gap:var(--space-5)">
-    <section class="card pad">
-      <div class="card-title"><h3>What you taught</h3></div>
-      {#if taught && !taught.use_taught}
-        <div class="notice warn" style="margin-bottom:12px">
-          Turned off under <a href={href(paths.sensor(sensor.id, 'settings'))}>Settings</a>: the AI alone decides until you turn it on again.
-        </div>
-      {/if}
-      <p class="small muted">
-        {#if compared.length}
-          Each {compared.join(', ')} the AI finds is compared with these boxes. When it clearly looks like one of them it
-          gets that answer; otherwise the AI's own answer stands.
-        {:else}
-          Nothing to compare with yet.
+    <PeopleCards {sensor} {onchange} />
+    {#if boxesTaught}
+      <section class="card pad">
+        <div class="card-title"><h3>What you taught</h3></div>
+        {#if taught && !taught.use_taught}
+          <div class="notice warn" style="margin-bottom:12px">
+            Turned off under <a href={href(paths.sensor(sensor.id, 'settings'))}>Settings</a>: the AI alone decides until you turn it on again.
+          </div>
         {/if}
-        Tap a box on the <a href={href(paths.sensor(sensor.id, 'live'))}>Live</a> tab or in the history to teach more.
-      </p>
-    </section>
+        <p class="small muted">
+          {#if compared.length}
+            Each {compared.join(', ')} the AI finds is compared with these boxes. When it clearly looks like one of them it
+            gets that answer; otherwise the AI's own answer stands.
+          {:else}
+            Nothing to compare with yet.
+          {/if}
+          Tap a box on the <a href={href(paths.sensor(sensor.id, 'live'))}>Live</a> tab or in the history to teach more.
+        </p>
+      </section>
+    {/if}
 
     {#if taught === null}
       <p class="muted">Loading…</p>
diff --git a/visionstate/frontend/src/pages/sensor/ReadingLiveTab.svelte b/visionstate/frontend/src/pages/sensor/ReadingLiveTab.svelte
index 91fa0c5..03f1bf6 100644
--- a/visionstate/frontend/src/pages/sensor/ReadingLiveTab.svelte
+++ b/visionstate/frontend/src/pages/sensor/ReadingLiveTab.svelte
@@ -90,7 +90,7 @@
         <span class="chip ok">Last reading accepted</span>
       {/if}
       <div class="trigger">
-        {#if sensor.live.in_burst}<span class="chip info">Reading every {sensor.triggers.burst_interval_s} s</span>{/if}
+        {#if sensor.live.in_burst}<span class="chip info">Reading every {sensor.live.burst_interval_s ?? sensor.triggers.burst_interval_s} s</span>{/if}
         {#if sensor.live.last_trigger}
           <span class="xsmall muted">
             {TRIGGER_SOURCES[sensor.live.last_trigger.source] ?? 'Triggered'} {ago(sensor.live.last_trigger.at)}:
diff --git a/visionstate/frontend/src/pages/sensor/SettingsTab.svelte b/visionstate/frontend/src/pages/sensor/SettingsTab.svelte
index 936770d..86013a7 100644
--- a/visionstate/frontend/src/pages/sensor/SettingsTab.svelte
+++ b/visionstate/frontend/src/pages/sensor/SettingsTab.svelte
@@ -10,18 +10,20 @@
   import PublishSwitch from '../../lib/components/PublishSwitch.svelte';
   import ObjectPicker from '../../lib/components/ObjectPicker.svelte';
   import DigitCells from '../../lib/components/DigitCells.svelte';
+  import FacesCard from '../../lib/components/FacesCard.svelte';
   import ReadingEditor from '../../lib/components/ReadingEditor.svelte';
   import ReadingParams from '../../lib/components/ReadingParams.svelte';
   import ReviewRulesEditor from '../../lib/components/ReviewRulesEditor.svelte';
   import SensorParams from '../../lib/components/SensorParams.svelte';
   import SourcePicker from '../../lib/components/SourcePicker.svelte';
   import StatesEditor from '../../lib/components/StatesEditor.svelte';
+  import TeachLimitsEditor from '../../lib/components/TeachLimitsEditor.svelte';
   import TriggersEditor from '../../lib/components/TriggersEditor.svelte';
   import { isObjectSensor } from '../../lib/objects';
   import { isReadingSensor } from '../../lib/reading';
   import { isPolygon, toRectangle } from '../../lib/roi';
   import { go, href, paths } from '../../lib/router.svelte';
-  import type { ReviewRules, Roi, Sensor } from '../../lib/types';
+  import type { ReviewRules, Roi, Sensor, TeachLimitsInfo, TeachOverrides } from '../../lib/types';
   import { REDACTED_MARK } from '../../lib/ui';
 
   let { sensor, onchange }: { sensor: Sensor; onchange: () => void } = $props();
@@ -44,8 +46,12 @@
   let clearAfter = $state(initial.objects?.clear_after_s ?? 0);
   let minSize = $state(initial.objects?.min_size ?? 0);
   let useTaught = $state(initial.objects?.use_taught ?? true);
-  const taughtCount = $derived(sensor.objects?.taught ?? 0);
-  const taughtSomething = $derived(!!sensor.objects && (taughtCount > 0 || sensor.objects.custom.length > 0));
+  let teachLimits = $state<TeachOverrides>({ ...(initial.objects?.teach ?? {}) });
+  let globalTeach = $state<TeachLimitsInfo | null>(null);
+  if (objectSensor) api.teachLimits().then((t) => (globalTeach = t)).catch(toastError);
+  // Boxes taught by their look; faces are counted on the Faces card.
+  const taughtCount = $derived(sensor.objects?.taught ?? 0); // boxes (faces are under People)
+  const taughtSomething = $derived(!!sensor.objects && (taughtCount > 0 || sensor.objects.custom.some((l) => !l.face)));
   const readingSensor = isReadingSensor(initial);
   const { value: _v, last: _l, has_image: _h, ...initialReading } = initial.reading ?? ({} as NonNullable<typeof initial.reading>);
   let reading = $state({ ...app.config!.reading_defaults, ...initialReading });
@@ -62,7 +68,7 @@
         source,
         ...(roi ? { roi } : { clear_roi: true }),
         ...(objectSensor
-          ? { objects: { classes, clear_after_s: clearAfter, min_size: minSize, use_taught: useTaught } }
+          ? { objects: { classes, clear_after_s: clearAfter, min_size: minSize, use_taught: useTaught, teach: teachLimits } }
           : readingSensor
             ? { reading }
             : { states, review }),
@@ -164,6 +170,7 @@
         <p class="small muted">Each object gets an on/off sensor and a count in Home Assistant.</p>
         <ObjectPicker bind:selected={classes} />
       </section>
+      <FacesCard {sensor} {onchange} />
       {#if taughtSomething}
         <section class="card pad col">
           <h3>What you taught</h3>
@@ -185,8 +192,14 @@
             <ConfirmButton class="btn sm danger" onconfirm={forgetTaught} confirmLabel="Tap again to forget everything taught">
               <Icon name="trash" size={14} /> Forget all
             </ConfirmButton>
-            <span class="xsmall faint">Every taught box and own label, with its entities.</span>
+            <span class="xsmall faint">Every taught box, own label and person, with their entities.</span>
           </div>
+          {#if globalTeach}
+            <div class="col teach-limits" data-testid="sensor-teach-limits">
+              <strong class="small">Limits for this sensor</strong>
+              <TeachLimitsEditor bind:value={teachLimits} inherited={globalTeach.effective} inheritedFrom="the global value" />
+            </div>
+          {/if}
         </section>
       {/if}
     {:else}
@@ -244,6 +257,11 @@
   .taught {
     align-items: flex-start;
   }
+  .teach-limits {
+    gap: var(--space-3);
+    padding-top: var(--space-3);
+    border-top: 1px solid var(--c-border);
+  }
   .taught input {
     margin-top: 3px;
   }
diff --git a/visionstate/frontend/src/pages/wizard/ObjectsStep.svelte b/visionstate/frontend/src/pages/wizard/ObjectsStep.svelte
index 8a3d0e0..e615395 100644
--- a/visionstate/frontend/src/pages/wizard/ObjectsStep.svelte
+++ b/visionstate/frontend/src/pages/wizard/ObjectsStep.svelte
@@ -4,11 +4,12 @@
   import { onMount, untrack } from 'svelte';
   import { api } from '../../lib/api';
   import DetectionBoxes from '../../lib/components/DetectionBoxes.svelte';
+  import FaceConsent from '../../lib/components/FaceConsent.svelte';
   import ObjectPicker from '../../lib/components/ObjectPicker.svelte';
   import RoiEditor from '../../lib/components/RoiEditor.svelte';
   import { haSlug } from '../../lib/format';
   import { objectCount } from '../../lib/objects';
-  import type { Detection, Roi } from '../../lib/types';
+  import type { Detection, FaceModelInfo, Roi } from '../../lib/types';
   import HaPreview from './HaPreview.svelte';
   import TestCard from './TestCard.svelte';
 
@@ -18,7 +19,23 @@
     name,
     roi = $bindable(),
     classes = $bindable(),
-  }: { sourceType: string; source: string; name: string; roi: Roi | null; classes: string[] } = $props();
+    faces = $bindable(),
+  }: {
+    sourceType: string;
+    source: string;
+    name: string;
+    roi: Roi | null;
+    classes: string[];
+    /** Recognise people by their face (asked first, with what is stored and downloaded). */
+    faces: boolean;
+  } = $props();
+
+  let faceModel = $state<FaceModelInfo | null>(null);
+  let askingFaces = $state(false);
+  api
+    .settings()
+    .then((s) => (faceModel = s.face_models.find((m) => m.id === s.face_model) ?? null))
+    .catch(() => {});
 
   let image = $state<string | null>(null);
   let detections = $state<Detection[]>([]);
@@ -64,6 +81,25 @@
 <div class="col" style="gap:var(--space-3)">
   <h3>Which objects?</h3>
   <ObjectPicker bind:selected={classes} />
+  {#if classes.includes('person')}
+    <label class="check" data-testid="wizard-faces">
+      <input
+        type="checkbox"
+        checked={faces}
+        onclick={(e) => {
+          if (faces) return (faces = false);
+          e.preventDefault(); // on only after the confirmation
+          askingFaces = true;
+        }}
+      />
+      <span class="col" style="gap:2px">
+        <strong class="small">Recognise people by their face</strong>
+        <span class="xsmall faint">
+          You name the people after it is made (tap a person on its Live tab); each gets an on/off sensor.
+        </span>
+      </span>
+    </label>
+  {/if}
 </div>
 <TestCard {busy} onretest={test}>
   {#snippet status()}
@@ -93,7 +129,25 @@
   {/each}
 </HaPreview>
 
+{#if askingFaces}
+  <FaceConsent
+    name={name.trim()}
+    model={faceModel}
+    onclose={() => (askingFaces = false)}
+    onconfirm={() => {
+      askingFaces = false;
+      faces = true;
+    }}
+  />
+{/if}
+
 <style>
+  .check {
+    align-items: flex-start;
+  }
+  .check input {
+    margin-top: 3px;
+  }
   .danger-text {
     color: var(--c-danger);
   }