Merge branch 'worktree-agent-afd449f5e7a01e341' into integration

# Conflicts:
#	core/dr-gpu/src/adjust.rs
#	core/dr-pipeline/ops/README.md
#	core/dr-pipeline/src/lib.rs
#	docs/traceability.md

core/dr-gpu/src/adjust.rs

@@ -34,6 +34,16 @@ use crate::{DemosaicedImage, GpuContext, GpuError};
 /// reads them.
 const RESERVED_FIELDS: usize = dr_pipeline::RESERVED_UNIFORM_FIELDS;
 
+/// TRACES: FR-DEV-3e
+/// The two crates must agree on how many points a base curve has.
+///
+/// `dr-decode` reads them from the profile database and `dr-pipeline` declares
+/// the uniform slots; this file is the only place the two meet, and it packs
+/// them by index. A disagreement would not fail to compile — it would upload a
+/// curve with a point missing or a stale float in it, which renders as a
+/// plausible-looking wrong tone response. Cheaper to catch here, at build time.
+const _: () = assert!(dr_decode::base_curve::POINTS == dr_pipeline::BASE_CURVE_POINTS);
+
 /// Runs composed operation chains against demosaiced images.
 pub struct AdjustPass {
     ctx: GpuContext,
@@ -677,6 +687,22 @@ impl AdjustPass {
         // runs. See `DemosaicedImage::is_non_linear`.
         let non_linear = if source.is_non_linear() { 1.0 } else { 0.0 };
         uniforms[12..16].copy_from_slice(&[wb[0], wb[1], wb[2], non_linear]);
+        // TRACES: FR-DEV-3e
+        // The camera profile's base curve, packed the way the generated block
+        // declares it: four x, four y, then the fifth point and the flag. The
+        // flag is what lets one compiled shader serve a profiled body and an
+        // unprofiled one, so the pipeline cache is not split in two by which
+        // camera took the frame.
+        //
+        // Written here rather than at the call site so that *both* callers —
+        // the plain render and the masked one — carry the profile. Filling it
+        // at one of them was how the two halves of this merge each had it.
+        let curve = source.base_curve();
+        let on = if curve.is_identity() { 0.0 } else { 1.0 };
+        let b = dr_pipeline::BASE_CURVE_UNIFORM_OFFSET;
+        uniforms[b..b + 4].copy_from_slice(&curve.xs[0..4]);
+        uniforms[b + 4..b + 8].copy_from_slice(&curve.ys[0..4]);
+        uniforms[b + 8..b + 12].copy_from_slice(&[curve.xs[4], curve.ys[4], on, 0.0]);
         uniforms
     }
 
@@ -862,7 +888,7 @@ pub(crate) fn numbered(src: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use dr_decode::{CfaPattern, CropRect, RawImage};
+    use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
     use dr_pipeline::ops::{colour_mixer, exposure, saturation};
     use dr_pipeline::EditGraph;
 
@@ -896,6 +922,7 @@ mod tests {
             // Identity, so the test reasons about the operations alone
             // rather than about a camera's colour response.
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -1069,6 +1096,7 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -1491,6 +1519,7 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -1590,6 +1619,7 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,

core/dr-gpu/src/demosaic.rs

@@ -10,7 +10,7 @@
 //! pass over this texture; it does not re-demosaic, which is what keeps the
 //! interaction budget (NFR-P9) reachable on a 24 MP file.
 
-use dr_decode::{CfaPattern, RawImage};
+use dr_decode::{BaseCurve, CfaPattern, RawImage};
 use wgpu::util::DeviceExt;
 
 use crate::{GpuContext, GpuError};
@@ -83,6 +83,16 @@ pub struct DemosaicedImage {
     color_matrix: [f32; 9],
     /// As-shot white balance, the neutral starting point for the WB control.
     as_shot_wb: [f32; 3],
+    /// TRACES: FR-DEV-3e
+    /// The camera profile's rendering curve, carried through for the adjust
+    /// pass exactly as `color_matrix` is.
+    ///
+    /// It rides on the image rather than on the edit graph because it is not
+    /// an edit: it belongs to the body that took the frame, the way the
+    /// masked-photosite crop and the EXIF orientation do, and a sidecar shared
+    /// between two bodies must never carry one body's rendering onto the
+    /// other's file (FR-NC-9).
+    base_curve: BaseCurve,
     /// Whether the texture holds gamma-encoded rather than linear values.
     non_linear: bool,
 }
@@ -108,6 +118,15 @@ impl DemosaicedImage {
         self.color_matrix
     }
 
+    /// TRACES: FR-DEV-3e
+    /// The camera profile's base curve, as five `(x, y)` points.
+    ///
+    /// [`BaseCurve::IDENTITY`] where the body is unprofiled or the source was
+    /// never raw, in which case the adjust pass skips the stage entirely.
+    pub fn base_curve(&self) -> BaseCurve {
+        self.base_curve
+    }
+
     /// As-shot white balance multipliers, green-normalised.
     ///
     /// The white balance control is expressed *relative* to these, so its
@@ -220,6 +239,12 @@ impl DemosaicedImage {
             height,
             color_matrix: IDENTITY_3X3,
             as_shot_wb: [1.0, 1.0, 1.0],
+            // **The identity, and this is the whole reason the field is here
+            // rather than resolved further down.** A JPEG has already had its
+            // camera's base curve baked in by the camera; applying one again
+            // would render the rendering, crushing the shadows and flattening
+            // the highlights of an image that was already finished.
+            base_curve: BaseCurve::IDENTITY,
             non_linear: true,
         })
     }
@@ -495,6 +520,10 @@ impl Demosaicer {
             // no colour transform rather than not at all.
             color_matrix: raw.color_matrix.unwrap_or(IDENTITY_3X3),
             as_shot_wb: [raw.wb_coeffs[0], raw.wb_coeffs[1], raw.wb_coeffs[2]],
+            // Whatever the profile database had for this body (FR-DEV-3e),
+            // resolved at decode because that is the only place the make and
+            // model are known.
+            base_curve: raw.base_curve,
             // Sensor data is linear by construction — the demosaic shader
             // normalises against black and white levels and applies no
             // transfer function.
@@ -808,6 +837,7 @@ mod tests {
             white_level: white,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -919,6 +949,7 @@ mod tests {
             white_level: white,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -1164,6 +1195,7 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,
@@ -1244,6 +1276,7 @@ mod tests {
                 1.0,
             ],
             color_matrix: None,
+            base_curve: BaseCurve::IDENTITY,
             crop: CropRect {
                 x: 0,
                 y: 0,

core/dr-gpu/tests/base_curve.rs

@@ -0,0 +1,179 @@
+//! TRACES: FR-DEV-3e
+//! The camera profile's base curve, end to end on a device.
+//!
+//! The unit tests either side of this one check halves. `dr-decode` asserts
+//! that the shipped database parses and that every curve in it lifts its
+//! midtones; `dr-pipeline` asserts that the generated WGSL evaluates a curve
+//! in the right place. Neither would notice if the two agreed with each other
+//! and both were wrong — a curve packed into the wrong uniform slots, or a
+//! flag read from the wrong component, satisfies both and renders nothing.
+//!
+//! So this renders real pixels twice, once with a profiled body's curve and
+//! once with the identity, and asserts the difference is the one a base curve
+//! is for: midtones lifted, black still black, white still white.
+
+use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
+use dr_gpu::{AdjustPass, Demosaicer, GpuContext};
+use dr_pipeline::EditGraph;
+
+const SIZE: u32 = 16;
+
+fn ctx() -> Option<GpuContext> {
+    pollster::block_on(GpuContext::new_headless()).ok()
+}
+
+/// A flat RGGB frame at `level` out of 65535, carrying `curve`.
+///
+/// Every photosite the same value, so the demosaic result is a uniform grey
+/// and the only thing that can move a pixel is the curve. The colour matrix is
+/// the identity and the balance is neutral for the same reason: this test is
+/// about one stage, and a real body's matrix would make every assertion below
+/// a statement about that body instead.
+fn flat_raw(level: u16, curve: BaseCurve) -> RawImage {
+    RawImage {
+        width: SIZE,
+        height: SIZE,
+        data: vec![level; (SIZE * SIZE) as usize],
+        cfa_pattern: CfaPattern::Rggb,
+        black_level: [0; 4],
+        white_level: u16::MAX,
+        wb_coeffs: [1.0, 1.0, 1.0, 1.0],
+        color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+        base_curve: curve,
+        crop: CropRect {
+            x: 0,
+            y: 0,
+            width: SIZE,
+            height: SIZE,
+        },
+    }
+}
+
+/// Render a neutral edit over a flat frame and return the centre pixel's red.
+///
+/// The centre rather than a corner: a demosaic has to invent its edges, and
+/// the interpolated border of a 16×16 frame is not where anyone should be
+/// reading a tone off.
+fn rendered_level(ctx: &GpuContext, level: u16, curve: BaseCurve) -> u8 {
+    let raw = flat_raw(level, curve);
+    let source = Demosaicer::new(ctx)
+        .expect("demosaicer")
+        .run(&raw)
+        .expect("demosaic");
+    let shader = EditGraph::default_chain().compose();
+    let mut adjust = AdjustPass::new(ctx);
+    adjust
+        .render(&source, &shader, SIZE, SIZE)
+        .expect("render");
+    let (pixels, _, _) = adjust.export_pixels().expect("readback");
+    let centre = ((SIZE / 2) * SIZE + SIZE / 2) * 4;
+    pixels[centre as usize]
+}
+
+/// The Canon EOS 6D's curve, from the shipped profile database.
+///
+/// Looked up by name rather than written out, so this also asserts the thing
+/// no other test can: that a curve travels from the YAML, through the body
+/// match, onto the decoded image and into the uniform block that the shader
+/// actually reads.
+fn six_d() -> BaseCurve {
+    let curve = dr_decode::base_curve::for_body("Canon", "EOS 6D");
+    assert!(
+        !curve.is_identity(),
+        "the shipped database must have a curve for the EOS 6D"
+    );
+    curve
+}
+
+#[test]
+fn a_profiled_body_renders_brighter_midtones_than_a_flat_one() {
+    // **The whole requirement, in one assertion.** A linear midtone renders
+    // roughly half a stop dark, which is the flat, lifeless look FR-DEV-3e
+    // exists to get away from. If the curve did not reach the shader — wrong
+    // slot, wrong flag, wrong stage — this is the only test that would fail.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+
+    // 13% of full scale: roughly where a camera places middle grey, leaving
+    // about two and a half stops of highlight headroom above it.
+    let level = (0.13 * 65535.0) as u16;
+    let flat = rendered_level(&ctx, level, BaseCurve::IDENTITY);
+    let profiled = rendered_level(&ctx, level, six_d());
+
+    assert!(
+        profiled > flat + 8,
+        "the profile lifted middle grey from {flat} only to {profiled}"
+    );
+}
+
+#[test]
+fn the_curve_leaves_black_black_and_white_white() {
+    // A base curve renders the range between the endpoints; it must not move
+    // the endpoints themselves. A curve that lifted black would put a grey
+    // veil over every night photograph, and one that pulled white down would
+    // make a correctly exposed frame look underexposed.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+
+    let curve = six_d();
+    assert_eq!(rendered_level(&ctx, 0, curve), 0, "black moved");
+    assert_eq!(rendered_level(&ctx, u16::MAX, curve), 255, "white moved");
+}
+
+#[test]
+fn an_unprofiled_body_renders_exactly_as_it_did_before_profiles_existed() {
+    // The graceful fallback, asserted as a number rather than as a promise.
+    // With no curve the pipeline must still be a pass-through: black level
+    // out, white level in, sRGB encoding on the way to the screen and nothing
+    // else. "Never worse than today" is the one property this change was not
+    // allowed to trade away, and the way it would break is silently — a flag
+    // read from the wrong component would apply a curve nobody asked for.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+
+    for level in [0u16, 4_000, 8_520, 32_768, 60_000, u16::MAX] {
+        let scene = f32::from(level) / f32::from(u16::MAX);
+        let expected = (dr_types::Transfer::Srgb.encode(scene) * 255.0).round() as i32;
+        let got = i32::from(rendered_level(&ctx, level, BaseCurve::IDENTITY));
+        // Two 8-bit steps: the texture holding the demosaiced frame is
+        // `Rgba16Float`, so a value round-trips through eleven mantissa bits
+        // before it is encoded. That is well under one step at any level, and
+        // the tolerance is for the rounding either side of it rather than for
+        // the transform being approximate.
+        assert!(
+            (got - expected).abs() <= 2,
+            "raw {level} rendered as {got}, expected about {expected}"
+        );
+    }
+}
+
+#[test]
+fn the_curve_is_monotone_through_the_whole_range() {
+    // The property the spline's tangent limiting exists to guarantee, checked
+    // where it actually matters: on the device, through the real uniform
+    // packing. A curve that dipped anywhere would put a dark band across a
+    // smooth gradient — a sky, most visibly — and it would read as a
+    // rendering fault rather than as a bad profile.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+
+    let curve = six_d();
+    let mut previous = 0u8;
+    for step in 0..=16u32 {
+        let level = (step * 65535 / 16) as u16;
+        let value = rendered_level(&ctx, level, curve);
+        assert!(
+            value >= previous,
+            "the curve fell from {previous} to {value} at raw level {level}"
+        );
+        previous = value;
+    }
+}