Let the model say what a thing is and the watershed say where it ends

Local masking needs to know where an image's regions are. The watershed
spike (S15 arm A) found the boundaries but had no idea what any of them
enclosed; its coarse levels were geometric accidents. This adds the other
half and the thing that joins them.

`core/dr-segment` is where region reasoning now lives — the hierarchy moves
out of `dr-gpu`, which keeps only the pixel passes that are genuinely
shaders. The new crate is device-free and, without its default features,
model-free too: 20 of its tests need neither an adapter nor 11 MB of
weights.

Arm B runs YOLO26n-seg through `ort`. D13 framed inference as a choice
between `ort`'s C++ runtime and the pure-Rust dependency policy; that was a
false choice. `ort`'s `alternative-backend` feature unlinks the C entirely
and `ort-tract` supplies the API from tract, which is pure Rust. Measured
before committing to it: zero unsupported operators, 420 ms for 640x640,
and correct masks on bus.jpg. No NDK problem to solve, so D13's largest
tolerated exception is not needed.

Arm C is `prior.rs`, and it ships because the two arms fail in opposite
directions. Instance membership re-weights the merge saddles, so region
pairs the model believes share an object merge early and pairs straddling
its edge merge late. No boundary moves — only the order in which they
dissolve — which is how the result stays pixel-accurate at every level
while its coarse levels become named things.

Two things the spec assumed that turned out to be false, both recorded in
models/LICENCE.md: there is no usable ADE20K-trained YOLO, so the shipped
vocabulary is COCO's 80 subjects and *stuff* like sky and foliage must come
from arm A; and tract cannot parse a dynamic-shape export, so the graph's
input is fixed and tiling is the only route to more semantic resolution.

Weights are AGPL-3.0, which GPLv3 §13 permits and which makes the combined
work effectively AGPL. Deliberate, not accidental. They live in Git LFS,
and a build script fails with an instruction rather than embedding a
pointer file when the clone lacks them.

Cargo.toml

@@ -9,6 +9,7 @@ members = [
     "core/dr-gpu",
     "core/dr-lens",
     "core/dr-pipeline",
+    "core/dr-segment",
     "core/dr-sync",
     "core/dr-sync-nextcloud",
     "platform/dr-plat",
@@ -35,6 +36,12 @@ dr-export = { path = "core/dr-export" }
 dr-gpu = { path = "core/dr-gpu" }
 dr-lens = { path = "core/dr-lens" }
 dr-pipeline = { path = "core/dr-pipeline" }
+# `default-features = false` belongs *here*, not on each dependant: a member
+# inheriting a workspace dependency cannot turn its default features off, so
+# writing it below would silently do nothing and every crate touching
+# `dr-segment` would drag in tract and 11 MB of weights. Members opt in with
+# `features = ["semantic", "embedded-model"]` instead.
+dr-segment = { path = "core/dr-segment", default-features = false }
 dr-plat = { path = "platform/dr-plat" }
 dr-sync = { path = "core/dr-sync" }
 dr-sync-nextcloud = { path = "core/dr-sync-nextcloud" }
@@ -157,6 +164,39 @@ bytemuck = { version = "1", features = ["derive"] }
 # swapping it out is not a pipeline change.
 lensfun = "0.7"
 
+# Neural inference for semantic segmentation (S15 arm B, D14).
+#
+# D13 framed this as a choice between `ort` (fast, best operator coverage, and
+# a C++ dependency to cross-compile under the NDK) and a pure-Rust runtime
+# (policy-compliant, unproven coverage). That framing turned out to be a false
+# choice: `ort` 2.0's `alternative-backend` feature *disables the linking
+# entirely* and lets a different engine supply the `OrtApi`, and `ort-tract` —
+# same authors, MIT/Apache — supplies it from `tract`, which is pure Rust.
+#
+# So we get `ort`'s API with no C at all. `download-binaries` and `tls-native`
+# are off with `default-features = false`, which is the point: nothing is
+# fetched at build time and nothing is linked, so the Android cross-compile
+# sees an ordinary Rust dependency graph. That is the same reasoning as rustls
+# over aws-lc-rs and bundled SQLite, applied to inference — D13's largest
+# tolerated exception turns out not to be needed.
+#
+# The trade is real and belongs on the record: tract is slower than the C++
+# runtime and covers fewer operators. Both were measured rather than assumed
+# before this landed — yolo26n-seg loads with **zero unsupported operators**
+# and runs 640x640 in ~470 ms on the reference desktop's CPU. That is fine for
+# a once-per-image precompute off the frame path (ARCH §6.1) and would not be
+# fine for anything per-frame, which is a constraint on what may be built on
+# top rather than on this choice.
+#
+# Pinned to an rc: `ort` 2.0 has been in rc for a long while and `ort-tract`
+# exists only against it. Worth revisiting at 2.0 final.
+ort = { version = "2.0.0-rc.13", default-features = false, features = ["alternative-backend", "ndarray", "std"] }
+ort-tract = "0.4"
+# Not a free choice: it is the version `ort` exposes its tensors through, so
+# two semver-incompatible ndarrays would not typecheck across the boundary —
+# the same coupling wgpu has with Slint above.
+ndarray = "0.17"
+
 [profile.dev]
 # Dependencies optimised even in dev builds — wgpu and image decoding are
 # unusably slow otherwise, and they rarely need debugging.