Bring master's display and parity work under the new checks

Master moved sixteen commits while these fixes were being written — per-display
colour, the frame-budget measurement that decides FR-DSP-2, and a declared
node running without being compiled. Merged here rather than on master so the
conflicts are resolved where they can be tested.

Two files overlapped and neither was interesting. `lib.rs` gained `mod remote`
from this branch and `mod display_ui` from master, which git resolved on its
own. `docs/traceability.md` is generated, so it was regenerated from the merged
tree rather than hand-resolved — hand-editing a generated matrix produces one
that agrees with neither side. Coverage reads 59.9% (106/177), up from 55.4%,
entirely from master's tagging.

The check worth having run is `the_interface_names_no_operation` against
master's new `display_ui.rs` and its 195 changed lines of `develop.rs`: a new
UI module written without knowledge of this gate passes it. That is the
evidence the gate is not merely satisfiable by the code that shipped with it.

fmt clean, clippy clean at -D warnings, 2087 tests pass.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ui/dr-ui/src/lib.rs

@@ -23,6 +23,7 @@ mod activity;
 mod collections_ui;
 mod derived_sync;
 mod develop;
+mod display_ui;
 mod export;
 pub mod faces;
 mod gradient;
@@ -1378,8 +1379,20 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
     let rows: Rc<slint::VecModel<ParamRow>> = Rc::new(slint::VecModel::default());
     window.set_adjust_rows(rows.clone().into());
     // Viewport size, tracked so a re-render after a slider move matches it.
+    //
+    // In *physical* pixels, which is what the render target wants and what
+    // FR-DSP-8 means by handling fractional scaling without resampling. The
+    // one caller that thinks in logical pixels is Slint's resize callback,
+    // and it converts on the way in.
     let viewport = Rc::new(RefCell::new((1024u32, 768u32)));
 
+    // TRACES: FR-DSP-8
+    // What the displays are, and which one the canvas is on. Probed once here
+    // so that the About page can describe the session's colour path before any
+    // photograph is opened — the acquisition path is a property of the desktop
+    // and not of the image.
+    let display = display_ui::DisplayWatch::probe();
+
     // Re-render the current session into the canvas.
     //
     // Called on every slider change, so it must do no more than run the
@@ -1394,10 +1407,26 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
         let session = session.clone();
         let viewport = viewport.clone();
         let drawn_history = drawn_history.clone();
+        let display = display.clone();
         Rc::new(move |window: &AppWindow, draft: bool| {
             let mut slot = session.borrow_mut();
             let Some(s) = slot.as_mut() else { return };
 
+            // TRACES: FR-DSP-8 | FR-DSP-6
+            // **Every canvas render is encoded for the display showing it.**
+            //
+            // Set here rather than pushed from the display watch, and rather
+            // than set once when a photograph is opened, because this is the
+            // one path every frame takes. A session opened while the window
+            // sits on the second monitor is then correct on its *first* frame
+            // — where a push would leave it sRGB until the next poll, which is
+            // a visible flash of the wrong colour on every image opened.
+            //
+            // Free when nothing has changed: the field is compared before it
+            // is written, and an unchanged output space composes to the same
+            // structure hash and the same cached pipeline.
+            s.set_display_space(display.space());
+
             // TRACES: FR-DEV-5
             // Whether undo has anywhere to go, pushed from here because every
             // edit ends in a redraw and nothing else is on all of their paths:
@@ -2571,13 +2600,22 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
 
     // Track the canvas size so the adjust pass renders at viewport
     // resolution rather than sensor resolution (FR-DSP-1).
+    //
+    // TRACES: FR-DSP-8
+    // Slint reports the canvas in *logical* pixels, which is the box the
+    // compositor will draw into and not the number of device pixels it will
+    // fill. `display_ui::physical` converts, so that a fractionally scaled
+    // desktop is presented 1:1 rather than resampled — see that function for
+    // why a soft canvas is the failure being avoided here.
     {
         let weak = window.as_weak();
         let viewport = viewport.clone();
         let redraw = redraw.clone();
+        let display = display.clone();
         window.on_canvas_resized(move |w_px, h_px| {
             let Some(w) = weak.upgrade() else { return };
-            let size = (w_px.max(1) as u32, h_px.max(1) as u32);
+            let logical = (w_px.max(1) as u32, h_px.max(1) as u32);
+            let size = display.canvas_resized(&w, logical);
             if *viewport.borrow() == size {
                 return;
             }
@@ -2586,6 +2624,10 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
         });
     }
 
+    // TRACES: FR-DSP-8 | FR-DSP-6
+    // And which display that canvas is on, from now until the window closes.
+    display_ui::attach(&window, &display, &viewport, redraw.clone());
+
     // FR-UI-1: layout class from window width. Computed here rather than in
     // Slint because a property that both derives from and feeds the layout is
     // a binding loop.