Put the repair tool on the photograph

A third chip beside Crop and Local, and the mode strip's own comment
predicted the shape: a mode that arms a gesture on the canvas and scopes
the column. Click a mark to cover it, drag the disc to move the repair,
drag the source circle to say where the patch comes from, Delete to remove
it. The source starts two and a half radii towards the middle of the
frame, which is FR-DEV-8's automatic placement in its cheap form — dust
sits on skies and skies are smooth, so it is usually right and always one
drag from fixed.

Two things are drawn deliberately. The circles are the size the repairs
actually are, because whether a disc covers a speck is the whole judgement
being made and a fixed-size dot would say nothing about it; the reach
around them is padded to a touch target so a spot on a dust mark can still
be picked up on a phone. And only the selected repair shows its source: a
dusty sky carries a dozen, and two dozen circles with nothing saying which
belongs to which is less information rather than more.

The panel edits what is stored while the canvas draws what is mapped, and
the two are pushed separately for that reason — a slider deriving its
value from the drawn radius would move differently at different zoom
levels. It is also the one panel built from SliderRow rather than a live
track: a repair has no OpId to coalesce a drag under, so a row that fires
once per gesture is what keeps undo one step per decision.

Verified as far as this environment allows: the strip renders and the
column re-scopes, photographed under XWayland. Synthetic clicks do not
reach this application, so the gestures are as-written rather than
as-felt, and docs/spot-removal.md says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/spot-removal.md

@@ -519,11 +519,21 @@ the residual a clone leaves by an order of magnitude. This is the measurement
 that decides `K`.
 
 **S6 — The tool.** `ViewMode::spots`, the chip, placement, handles, selection,
-the panel scope, deletion, history carrying the spot set, the reveal view, the
-stage-one source default.
+the panel scope, deletion, history carrying the spot set, the stage-one source
+default. **Done, except the reveal view** — §9's second half is the one piece
+of S6 not built, and it is separable: it is a view mode over the detail chain
+rather than part of the tool.
 *Acceptance:* a dust mark on a real frame is gone in one click, the edit survives
 a restart, and undo takes it back.
 
+*What was verified, and how.* Everything below the interface is under test —
+the model, the sidecar, the merge, the passes, both blend modes, and undo. The
+interface itself was compiled, laid out and photographed: the strip renders
+`Crop | Local | Repair` and the column re-scopes. It was **not** driven, because
+synthetic clicks do not reach this application (the compositor refuses them),
+so the gestures in §10 are as-written rather than as-felt. A first pass with a
+real pointer is the outstanding work on this stage.
+
 **S7 — The rest of FR-DEV-8.** The scored source search (§8 stage two), and
 copying a spot set across a selection.
 
@@ -549,7 +559,8 @@ means it.
 1. ~~**`K = 24`?**~~ Settled by S5's measurement: 24 samples, inverse square weights, zero error on the case the mode exists for.
 2. **Does the reveal view belong to spot mode only,** or is it a view mode of
    its own that a photographer can turn on while doing something else? It is
-   cheap to allow both; the risk is a mode nobody remembers turning on.
+   cheap to allow both; the risk is a mode nobody remembers turning on. Still
+   open, and now the only part of §9 unbuilt.
 3. **Should a spot be clamped inside the crop?** A spot outside the current crop
    costs nothing to render and is invisible, and re-cropping should bring it
    back rather than find it deleted. Leaning strongly towards no clamp.