Undefer AI subject masking, which shipped, and give it a clause

§7 still listed "AI subject masking — deferred per D11" while
MaskSource::Subject and MaskSource::Category, backed by dr-segment's
instance and semantic models, had been the primary way a local
adjustment is made for weeks. The code was tagged FR-DEV-3, which
names gradients and brushes and says nothing about a model.

FR-DEV-3i now states what exists: a subject or a category found by a
local model, stored as identity with the run's signature so that it
merges per field and reads as stale rather than wrong, then treated as
any other layer by the edge, stroke, composition and reveal clauses.
The one place it departs from FR-DEV-19 — coverage written run-length
coded beside the layer, so a stored subject renders without a model —
is recorded in the clause instead of left for the next audit to find.
The segmentation crate and the UI's selection module are tagged to it.

docs/requirements.md

@@ -450,6 +450,29 @@ missing tag into a visibly wrong image, and most files have no tag.
 in develop with no user action, and its sidecar is byte-identical to that of the same frame shot in
 landscape.
 
+**FR-DEV-3i — Model-found masks.** A mask layer's part may be a thing a model found in the
+photograph, selected by pointing at it: one **subject** — this dog, not that one — from an
+instance model, or one **category** — all the sky, all the foliage — from a semantic model. The
+selection is stored as *identity* (which run, which instance or which category name, with the
+run's signature) so that two devices selecting the same subject hold the same value and merge per
+field under FR-NC-9, and a layer whose run no longer matches reads as **stale** rather than
+silently masking something else. The mask arrives approximately right and soft, and it is then an
+ordinary layer: FR-DEV-3's edge treatment shapes it, FR-DEV-19b's strokes correct it, FR-DEV-19a
+composes it with a gradient or a range, and FR-DEV-19c shows it. Inference is local
+(NFR-SEC-4); the models and their grants are named in `models/LICENCE.md` and D14.
+
+*Added 2026-09-19, because it was built and §7 still said it was deferred.* The deferral treated
+subject masking as an AI feature to be copied from Adobe or darktable; what was built is the
+shape §7's own note asked for — a mask that behaves like a hand-drawn one — and it has been the
+primary way a local adjustment is made since the watershed hierarchy failed on real photographs
+(`docs/segmentation.md` §15).
+
+One departure from FR-DEV-19 is recorded rather than hidden. A model-found part's coverage is
+also written to the sidecar, run-length coded beside the layer, because a stored subject that is
+"reproducible by running the model again" renders as nothing on a device or in a batch export
+that never runs a model. It is a materialisation of the identity, not the edit: it takes no part
+in equality or merge, and the identity remains what the part means.
+
 **FR-DEV-4 — Ordered, GPU-resident execution.** The pipeline executes as a sequence of GPU
 compute stages. Intermediate results remain in GPU memory between stages. **Processed pixels
 shall reach the display without a CPU round-trip.** *(This is a hard architectural constraint —
@@ -2195,7 +2218,7 @@ note where deferring now constrains the design later.
 | Print layout | — |
 | Soft proofing | Parameterise the output colour stage by an arbitrary profile so this becomes a UI addition, not a pipeline change. FR-EXP-3's print-dimension mode already half-commits to print workflows. |
 | ~~Face recognition~~ | **Undeferred 2026-08-09**, in the narrower form specified in §3.9.1 (FR-CULL-8 … FR-CULL-12): people *grouping and search*, no automated selection. Reclassified as culling rather than AI — it is the same mechanical-grouping category as FR-CULL-5, not the taste operation AI masking is. Gated on spike S14 and decision D13. |
-| AI subject masking | Deferred per D11. Note darktable shipped this in 5.6 (June 2026), so the gap is now visible. **Conditions for deferring safely:** AI denoise ships in v1 (FR-DEV-3g ✓), manual masking is excellent including GPU-rasterised drawn masks (ARCH §6.11 ✓), and the product has a clear differentiator (culling, §3.9 ✓). When it does land, copy darktable's shape — prompt-point segmentation producing an *editable* mask that behaves like a hand-drawn one — not Adobe's opaque version. |
+| ~~AI subject masking~~ | **Undeferred 2026-09-19** — it had been built. FR-DEV-3i states what exists: subject and category masks from local models, stored as identity, editable like a drawn mask. The shape this row asked for when it was written — point at a thing, get an editable mask — is the shape that shipped. |
 | AI upscaling | Deferred. Lower priority than denoise, which has no manual fallback. |
 | Video | — |
 | Plugin API | **Post-v1**, decided 2026-09-19. Specified in full in §3.10 as the design of record; every clause there is marked `(post-v1)` and sits outside the coverage denominator. D16 (plugin licensing) defers with it. FR-DEV-3c's compile-time declarations are not plugins and remain in v1. |