After I enabled the App Sandbox, KiFinder scans completed with zero detected faces. The progress UI still finished, which made the failure look like a valid album with no matches.
The Core ML setup compiled its model into a hard-coded directory under /private/tmp. A sandboxed app could not write there, the session failed to initialize, and a try? converted that error into nil for every embedding. I fixed it by deriving the scratch directory from the system temporary directory, which places it inside the app container.
I checked the change with the real engine over saved photos. The broken build produced zero embeddings; the fixed build produced five and six for the same inputs. I also stopped re-scoring the full album after every keep or skip. Re-scoring now runs from an explicit “Find new matches” action and uses one batched matrix multiplication per album.
The missing error handling still needs improvement. A model that cannot initialize should stop the scan and explain the failure instead of returning an empty result that looks successful.