Say where hot and dead photosites are repaired

c50d96e added a repair pass ahead of the demosaic and no document said
so: FR-RAW-3's text names levels, the CFA and the colour matrices, and
architecture.md §5.2's stage diagram went from the upload straight to
black and white levels.

FR-RAW-3 now carries a status note: what counts as hot or dead, what
the photosite becomes, that Bayer and X-Trans share the pass, that
export and every other demosaicing path get it with no setting, the
test that holds it, and that the DNG defect map dr-decode can read is
still not used. §5.2 gains the stage and a paragraph on why it sits
before the demosaic, and its pointer to the raw histogram's tap names
the demosaic box rather than a row count the new stage would have made
wrong.

docs/dev/architecture.md

@@ -347,6 +347,8 @@ RawImage (sensor data, CPU)
    │  upload
    ▼
 ┌─────────────────────┐
+│ hot/dead photosites │  repaired on the mosaic (FR-RAW-3)
+├─────────────────────┤
 │ black/white levels  │  integer normalise
 ├─────────────────────┤
 │ demosaic            │  Bayer or Markesteijn (X-Trans, FR-RAW-5)
@@ -379,8 +381,17 @@ RawImage (sensor data, CPU)
 
 Working precision is f16 in a linear wide-gamut space, quantising once at the output transform.
 
+**A hot or dead photosite is repaired before the demosaic, not after.** Past it, one photosite of
+nonsense is a coloured cross three pixels wide that no later stage can tell from detail. The pass
+(`shaders/hot_pixels.wgsl`, run by `Demosaicer::run` into a second buffer) replaces a photosite that
+stands apart from every same-colour photosite in its 5×5 window *and* from each of its eight
+immediate neighbours with the nearest value that neighbourhood vouches for. The second test is what
+keeps a star: real light arrives through a lens and lights a patch, so its neighbours are lit too. A
+6×6 sensor-anchored colour tile serves Bayer and X-Trans alike, every path that demosaics gets it,
+and there is no setting.
+
 There is a second reduction that does not hang off the bottom of this chain. The raw histogram
-(FR-CULL-3) taps the demosaiced scene-linear texture directly — the box four rows from the top —
+(FR-CULL-3) taps the demosaiced scene-linear texture directly — the demosaic box's output —
 because what it measures is the file rather than the render. See §5.5.
 
 ### 5.3 Tiling and scheduling

docs/dev/requirements.md

@@ -269,6 +269,17 @@ identification, and camera-native colour matrices. Demosaic quality shall be sel
 least a fast method for preview and a high-quality method for export (FR-EXP-9 requires export to
 use the latter).
 
+*Status (2026-09-27), defective photosites.* Hot and dead photosites are repaired on the mosaic,
+before the demosaic, where each is still one wrong value rather than a coloured cross three pixels
+wide (`core/dr-gpu/src/shaders/hot_pixels.wgsl`). A photosite is repaired only where it stands apart
+from every same-colour photosite in its 5×5 window and from each of its eight immediate neighbours,
+which leaves stars and glints alone, and it takes the value of its brightest (or, when dead,
+darkest) same-colour neighbour, so nothing is invented. A 6×6 sensor-anchored colour tile serves
+Bayer and X-Trans alike; export and every other path that demosaics get the repair, and there is no
+setting. `core/dr-gpu/tests/hot_pixels.rs` renders a frame with and without a defect and compares
+the finished pixels. The DNG defect map `dr_decode::defects` reads is not used: few files carry
+one, and a CR2 none.
+
 **FR-RAW-4 — Robustness.** A malformed or hostile RAW file shall not crash the application or
 compromise the process. Decode failures are reported per-file and do not abort a batch.