Provenance in the sidecar, a launch hook for the page, and where it stands

derived_from and merge are top-level sidecar fields (FR-MRG-6): one line
per source in order, and how the composite was made. A build that
predates them keeps the lines as unknown and writes them back. The job
writes the sidecar beside the composite and stages it with its own
record when the composite goes through the outbox.

DARKROOM_START_MERGE=a.CR2,b.CR2 lands on the merge page at startup with
the job running on local files, on the model of DARKROOM_START_IDENTITY,
for looking at the page where synthetic clicks do not reach it. The fetch
and the start are shared with the grid's button.

panorama.md §11 records what exists, the fixture's figures, and the six
things still open, auto-crop first.

docs/panorama.md

@@ -298,3 +298,49 @@ carrying the first source's EXIF in a sub-IFD as `dr-export` already does.
 5. Gain, seams, multi-band.
 6. The container, the catalog entry, provenance, the history entry.
 7. Tablet: NFR-MRG-1's figure, and FR-MRG-9's ceiling.
+
+## 11. Where it stands — 2026-09-19, end of the first day
+
+Built, on branch `merge/panorama`, in the order §10 gave:
+
+| Piece | Where | State |
+|---|---|---|
+| Geometry: keypoints, matching, homography, focal, bundle adjustment, projections | `core/dr-pano` | Done; 33 tests without a model; the fixture aligns in 4.5 s |
+| XFeat at two shapes under tract | `models/keypoints`, `dr_pano::xfeat` | Done; 300 ms/frame desktop, 400 ms tablet |
+| The camera-space tap | `OutputMode::CameraLinear`, `AdjustPass::render_camera_linear` | Done, `rgba32float`, tiles by view rect |
+| Linear DNG writer, streamed | `dr_export::write_linear_dng` | Done; rawler reads it back |
+| A three-sample `RawImage` re-entering the pipeline | `dr-decode`, `DemosaicedImage::from_linear_rgb16` | Done |
+| Warp, accumulate, resolve, chunk by chunk | `dr_gpu::MergePass`, `merge.wgsl` | Done; feathered blend, scalar gain |
+| The job: load, proxies, align, gains, confirm, merge, provenance | `dr_ui::merge` | Done; `examples/merge.rs` drives it headless |
+| The page: table, preview, projection, Merge/Stop/Back; the grid's button | `merge.slint`, `merge_ui.rs` | Done; `DARKROOM_START_MERGE=a.CR2,b.CR2` lands on it |
+| Placement beside the sources through the outbox, rescan | `merge_ui.rs` | Done, untested against a server |
+
+**Measured on the fixture (desktop, 12 × 20 MP, Intel adapter):** proxies
+and keypoints 4 s, alignment 4.5–12.6 s (load-sensitive: the matcher is
+every core), the merge **26 s for a 22 993 × 5 980 composite** in twelve
+bands of 2048 × 512 chunks, 45 s all told, an 825 MB DNG. NFR-MRG-1's 60 s
+holds on the desktop with room; the tablet's figure is still S15.4's open
+half.
+
+**Open, in the order they matter:**
+
+1. **Auto-crop (FR-MRG-4).** The merge returns a coverage mask per band and
+   the file carries the black border. The largest inscribed rectangle over
+   the coverage, then the DNG's `DefaultCropOrigin`/`DefaultCropSize`, so
+   nothing is thrown away and the develop view opens on the picture.
+2. **Seams and the pyramid** (§10 step 5). The feather hides exposure and
+   small misalignment; parallax on the near slope will show as a soft
+   double edge at 1:1.
+3. **Vignetting in the tap.** The lens profile's distortion is applied
+   before the fetch; its vignetting is an operation and is not. Frame edges
+   are darker than their centres by the lens's falloff, and the feather
+   averages them into the overlaps.
+4. **The tablet:** memory (twelve 40 MB sensor buffers on the CPU, one
+   demosaiced frame at a time on the GPU), the figure, and FR-MRG-9's
+   ceiling.
+5. **Horizon and drag-to-correct (FR-MRG-4, the proposed 4a).** The
+   alignment failed on nothing in the fixture; the interaction waits for a
+   set it fails on.
+6. **`derived_from` names sources by file name**, not content hash: the
+   catalog's `content_hash` is null for most images most of the time. The
+   hash can join it when the catalog has one.