Tighten libvips encoder options and ping robustness

API-review findings (cf. ruby-vips 2.3 / libvips 8.15 docs):

* `strip: true` → `keep: :none`. Soft-deprecated in libvips 8.15 in
  favour of the bitmask `keep:` form. Same effect today, future-proof
  later; output bytes are unchanged.

* `subsample_mode: :on` added explicitly to both writes. libvips'
  default `:auto` disables 4:2:0 chroma subsampling for Q >= 90, which
  would silently inflate output ~20-30% if a user bumps the
  collection-metadata `quality` past that threshold. For a photo
  gallery 4:2:0 is the right call across the quality range; pin it.
  At the current defaults (full Q85, thumb Q80) the auto mode would
  have produced the same output, so today the change is a no-op on
  the byte stream.

* `fail_on: :error` added to the `Vips::Image.new_from_file` ping in
  `ImageFile#initialize`. For a build tool, a truncated or corrupt
  source JPEG should abort the build with a clear error rather than
  silently rendering a half-grey output. Default is `:none` (warnings
  ignored), which is the wrong default for our use case.

Three mozjpeg-style options (`trellis_quant`, `overshoot_deringing`,
`optimize_scans`) were considered and skipped: libvips on Ubuntu
24.04 is built against stock libjpeg-turbo, not mozjpeg, so passing
them emits warnings and has no effect. Worth revisiting if the CI
matrix ever picks up a mozjpeg-libvips build.

cache_spec spy counts and the `geometry_string` cache fingerprint
are unaffected. The bench delta on the small workload is within noise
of the pre-tweak libvips numbers.

https://claude.ai/code/session_01AZQRrnPUpfUMCXLu3oTSDN

Author: claude

CHANGELOG.md

@@ -9,10 +9,18 @@
 * **Behaviour change:** EXIF Orientation is now honoured. Sources that
   previously rendered sideways (Orientation 5–8) will now render
   upright. Output JPEGs no longer carry the orientation tag.
-* **Behaviour change:** thumbnails (`*_thumb.jpg`, `*_index.jpg`) are
-  now progressive JPEGs encoded at Q80 with optimised Huffman tables
-  and EXIF metadata stripped. Previously they used RMagick's default
-  encoder settings (baseline JPEG, ~Q75, EXIF retained).
+* **Behaviour change:** every rendered JPEG (full-size + thumbs) now
+  ships as a progressive JPEG with optimised Huffman tables, explicit
+  4:2:0 chroma subsampling, and all metadata stripped (`keep: :none`).
+  Thumbnails are encoded at Q80 and full-size renders honour the
+  collection-metadata `quality` value (default 85). Previously
+  thumbnails used RMagick's default encoder (baseline JPEG, ~Q75, EXIF
+  retained). The explicit `subsample_mode: :on` guards against a
+  silent ~25% file-size jump if a user bumps `quality` to ≥ 90 (where
+  libvips' `:auto` mode would otherwise switch to 4:4:4).
+* **Robustness:** image header reads now use `fail_on: :error`, so a
+  truncated or corrupt source JPEG aborts the build with a clear
+  error rather than silently rendering a half-grey output.
 * **Behaviour narrowing:** `max_size` values with ImageMagick trailing
   flags other than `>` (i.e. `!`, `^`, `@`, `#`) are silently treated
   as the plain `WxH` form. cheesy-gallery's own config never used

lib/cheesy-gallery/image_file.rb

@@ -20,7 +20,7 @@ def initialize(site, collection, file, max_size:, quality:)
       Jekyll.logger.debug 'Identifying:', path
       # autorot so width/height reflect post-orientation pixels — matches
       # what Vips::Image.thumbnail will produce at render time.
-      source = Vips::Image.new_from_file(path, access: :sequential).autorot
+      source = Vips::Image.new_from_file(path, access: :sequential, fail_on: :error).autorot
       fit_inside(source.width, source.height)
     end
 
@@ -42,8 +42,9 @@ def process_and_write(source_path, dest_path)
       dest_path,
       Q: @quality,
       interlace: true,
-      strip: true,
+      keep: :none,
       optimize_coding: true,
+      subsample_mode: :on,
     )
   end
 

lib/cheesy-gallery/image_thumb.rb

@@ -26,8 +26,9 @@ def process_and_write(source_path, dest_path)
       dest_path,
       Q: 80,
       interlace: true,
-      strip: true,
+      keep: :none,
       optimize_coding: true,
+      subsample_mode: :on,
     )
   end
 end