Say where hot and dead photosites are repaired

c50d96e added a repair pass ahead of the demosaic and no document said
so: FR-RAW-3's text names levels, the CFA and the colour matrices, and
architecture.md §5.2's stage diagram went from the upload straight to
black and white levels.

FR-RAW-3 now carries a status note: what counts as hot or dead, what
the photosite becomes, that Bayer and X-Trans share the pass, that
export and every other demosaicing path get it with no setting, the
test that holds it, and that the DNG defect map dr-decode can read is
still not used. §5.2 gains the stage and a paragraph on why it sits
before the demosaic, and its pointer to the raw histogram's tap names
the demosaic box rather than a row count the new stage would have made
wrong.

docs/dev/requirements.md

@@ -269,6 +269,17 @@ identification, and camera-native colour matrices. Demosaic quality shall be sel
 least a fast method for preview and a high-quality method for export (FR-EXP-9 requires export to
 use the latter).
 
+*Status (2026-09-27), defective photosites.* Hot and dead photosites are repaired on the mosaic,
+before the demosaic, where each is still one wrong value rather than a coloured cross three pixels
+wide (`core/dr-gpu/src/shaders/hot_pixels.wgsl`). A photosite is repaired only where it stands apart
+from every same-colour photosite in its 5×5 window and from each of its eight immediate neighbours,
+which leaves stars and glints alone, and it takes the value of its brightest (or, when dead,
+darkest) same-colour neighbour, so nothing is invented. A 6×6 sensor-anchored colour tile serves
+Bayer and X-Trans alike; export and every other path that demosaics get the repair, and there is no
+setting. `core/dr-gpu/tests/hot_pixels.rs` renders a frame with and without a defect and compares
+the finished pixels. The DNG defect map `dr_decode::defects` reads is not used: few files carry
+one, and a CR2 none.
+
 **FR-RAW-4 — Robustness.** A malformed or hostile RAW file shall not crash the application or
 compromise the process. Decode failures are reported per-file and do not abort a batch.