Record where a linear DNG too large for one texture goes

ARCH §5.3 still described only a tile cache nobody built; it now says
what 0.19.0 tiles and what it does not: a linear DNG past PROXY_EDGE
opens on a reduced copy, a finer render samples a full-resolution
window, and the export is cut into halo-grown tiles. display-and-
extension.md's FR-DSP-2 row said absent, outstanding.md said the halo
had nothing to read it and that such a file fell to the embedded
preview.

rawler now builds from third_party, which ARCH's stack table and §3.2,
the root Cargo.toml's comment ("two upstream crates ... for Android")
and third_party/README.md's bump procedure did not know; the README
also names each vendored crate's licence. panorama.md and the manual
say a composite this wide develops and exports.

docs/dev/architecture.md

@@ -34,7 +34,7 @@ document elaborates:
 | UI | Slint | D1, D8 |
 | GPU | wgpu → Vulkan (Linux + Android) | D1 |
 | Shaders | Hand-written WGSL | D6 |
-| RAW decode | rawler; LibRaw fallback behind a trait | D2 |
+| RAW decode | rawler (0.7.2, carried patched in `third_party/`); LibRaw fallback behind a trait | D2 |
 | Catalog | SQLite (WAL) — a rebuildable index | D5, §6.12 |
 | Colour | lcms2 + GPU-side matrix/LUT transforms | D5 |
 | Network | reqwest + quick-xml | D7 |
@@ -140,6 +140,11 @@ is *not* demosaiced. Demosaic is a GPU pipeline stage (§5.2).
 > (§3.1's `read_range`), not the decoder. `dr_decode::Rawler` is the one implementation, and only
 > the places that start a job name `dr_decode::default()`; everything below them takes a
 > `&dyn Decoder`.
+>
+> rawler itself is built from `third_party/rawler-0.7.2` since 0.19.0: the crate as published,
+> with its allocation guard raised so that a linear DNG wider than about 16 700 pixels (a
+> stitched panorama) decodes rather than being refused
+> ([third_party/README.md](../../third_party/README.md)).
 
 ### 3.3 Operation and descriptors
 
@@ -433,6 +438,20 @@ Tile results cache keyed by `(VersionId, tile, zoom, graph_hash_prefix)`, where
 operations up to the first `Affects` change. Adjusting exposure reuses cached demosaic and camera
 profile output for every tile.
 
+> **As built (0.19.0).** The interactive path does not tile: one fused dispatch over the viewport
+> is inside the frame budget ([frame-budget.md](frame-budget.md)), and there is no scheduler or tile
+> cache. What tiles is a source too large for one texture. A linear DNG whose long edge passes
+> `PROXY_EDGE` (8192) — a stitched panorama — is held at full resolution on the CPU and opened on
+> a box-reduced copy, from which the canvas at fit, the thumbnail, the histograms and the masks
+> work. A render finer than the copy — the canvas zoomed in, a tile of the export — samples a
+> window cut from the full resolution (`DemosaicedImage::linear_rgb16_window`), which the fused
+> shader addresses through two source-window uniforms so that crops, warps and grain seeds stay
+> where they are in the frame. The canvas keeps one window while the view stays inside it. The
+> export is cut by `dr_pipeline::tiles::plan` into 4096-pixel tiles on a 16-pixel grid, each
+> grown by the detail chain's reach (`ComposedDetail::reach`, the sum of its passes' radii), and
+> reassembled; `core/dr-gpu/tests/source_window.rs` holds it to the untiled render within one code
+> value. A CFA file too large for one texture is still refused.
+
 ### 5.4 Mask rasterisation
 
 **All masks rasterise on the GPU, including drawn brush strokes** (§6.11). Strokes arrive as