Merge branch 'zero-copy-display'

# Conflicts:
#	core/dr-gpu/src/adjust.rs
#	ui/dr-ui/src/develop.rs

ui/dr-ui/src/lib.rs

@@ -3,12 +3,17 @@
 //! A viewer with a develop panel: open a folder of RAW files, decode and
 //! demosaic on the GPU, and adjust.
 //!
-//! **Read before assuming A1 is proven.** Slint's public API for adopting an
-//! externally created wgpu texture is not wired up here; this build uploads
-//! through `SharedPixelBuffer`, which *is* a CPU round-trip — explicitly the
-//! thing ARCH §6.1 forbids in production. Spike S1 replaces it. Until then A1
-//! is unvalidated, and the develop path pays a readback per frame that the
-//! finished one will not.
+//! **The develop frame never leaves the GPU** (ARCH §6.1, AC-8). Spike S1
+//! wired Slint's texture import: [`shared_gpu`] opens one wgpu device and
+//! gives it to *both* the compute passes and Slint's renderer, and
+//! `DevelopSession::render` then hands the compositor the very texture the
+//! adjust pass wrote. What used to be a readback and an upload per frame is
+//! now a refcount.
+//!
+//! `SharedPixelBuffer` still appears in this file and in the library grid, and
+//! that is not a relapse: an embedded JPEG preview and a thumbnail are decoded
+//! on the CPU and have no texture to hand over. AC-8 is about pixels that were
+//! *computed on the GPU* travelling to the CPU and back to be looked at.
 //!
 //! **The develop panel is generated, not written.** [`develop`] asks the
 //! pipeline what parameters it has and builds a control per answer; no code
@@ -587,6 +592,64 @@ enum PointsUpdate {
     Unchanged,
 }
 
+/// TRACES: FR-DSP-1 | AC-8
+/// Open the one wgpu device the compute passes and the compositor share.
+///
+/// **This is the whole of the zero-copy display path, and it is four lines of
+/// configuration.** A `wgpu::Texture` belongs to the device that allocated it;
+/// handing one to a compositor drawing on a *different* device is meaningless,
+/// and the two would have to meet through system memory — which is the round
+/// trip ARCH §6.1 forbids. So there is exactly one device, made here, before
+/// anything else needs it.
+///
+/// **Called before the window exists, and it must be.** `BackendSelector`
+/// installs the Slint platform, and Slint installs a default one the first
+/// time a window is created; selecting afterwards is too late. That is why the
+/// GPU is opened at the top of [`run`] rather than beside the other
+/// controllers, where it used to sit.
+///
+/// `None` means develop is unavailable and the viewer falls back to embedded
+/// previews — the same degradation as a machine with no adapter at all.
+fn shared_gpu() -> Option<dr_gpu::GpuContext> {
+    let shared = match pollster::block_on(dr_gpu::GpuContext::new_shared()) {
+        Ok(shared) => shared,
+        Err(e) => {
+            log::warn!("no shareable GPU: {e}");
+            return None;
+        }
+    };
+    let dr_gpu::SharedGpu {
+        ctx,
+        instance,
+        adapter,
+    } = shared;
+
+    // `Manual` is the variant that means "render with these, do not open your
+    // own". The two clones are of wgpu handles, which are refcounts over the
+    // one device and the one queue — not copies of either.
+    let configuration = slint::wgpu_29::WGPUConfiguration::Manual {
+        instance,
+        adapter,
+        device: (*ctx.device).clone(),
+        queue: (*ctx.queue).clone(),
+    };
+
+    if let Err(e) = slint::BackendSelector::new()
+        .require_wgpu_29(configuration)
+        .select()
+    {
+        // Dropping the context rather than keeping it: Slint has fallen back
+        // to a renderer that did not adopt our device, so every texture this
+        // context produces is one the compositor cannot sample. A disabled
+        // develop panel is a visible, explicable failure; a texture handed
+        // across devices is undefined behaviour on a good day.
+        log::warn!("Slint would not adopt the GPU device, develop disabled: {e}");
+        return None;
+    }
+
+    Some(ctx)
+}
+
 /// TRACES: M-13 | M-14
 /// Build and run the viewer.
 pub fn run(paths: Vec<PathBuf>) -> Result<()> {
@@ -598,7 +661,21 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
     let entries = Rc::new(RefCell::new(collect(&paths)));
     log::info!("{} image(s) to browse", entries.borrow().len());
 
+    // Before the window, and it has to be: this selects the Slint backend, and
+    // creating a window selects one for us. See `shared_gpu`. The device is
+    // shared by demosaic, the adjust pass and the compositor; without one the
+    // app still browses through the preview path, just without develop.
+    let gpu = shared_gpu();
+
     let window = AppWindow::new()?;
+    match &gpu {
+        Some(ctx) => {
+            log::info!("adapter: {} ({:?})", ctx.adapter_name(), ctx.backend());
+            window.set_adapter(ctx.adapter_name().into());
+            window.set_backend(format!("{:?}", ctx.backend()).to_uppercase().into());
+        }
+        None => window.set_backend("NO GPU".into()),
+    }
 
     // Every background job reports here, and this draws the bar across the top
     // of the shell and fills the settings page's list. Built before the
@@ -924,22 +1001,6 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
         });
     }
 
-    // The device is shared by demosaic and the adjust pass. Without one the
-    // app still browses through the preview path, just without develop.
-    let gpu = match pollster::block_on(dr_gpu::GpuContext::new_headless()) {
-        Ok(ctx) => {
-            log::info!("adapter: {} ({:?})", ctx.adapter_name(), ctx.backend());
-            window.set_adapter(ctx.adapter_name().into());
-            window.set_backend(format!("{:?}", ctx.backend()).to_uppercase().into());
-            Some(ctx)
-        }
-        Err(e) => {
-            log::warn!("no GPU adapter: {e}");
-            window.set_backend("NO GPU".into());
-            None
-        }
-    };
-
     window.set_total(entries.borrow().len() as i32);
     let index = Rc::new(RefCell::new(0usize));
     // The current develop session, if the file yielded sensor data.
@@ -985,9 +1046,11 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
 
             // **Half resolution while the gesture is still moving.**
             //
-            // The adjust pass and the readback both scale with pixel count, so
-            // halving each edge is roughly a quarter of the work — the
-            // difference between keeping up with a drag and lagging behind it.
+            // The adjust pass scales with pixel count, so halving each edge is
+            // roughly a quarter of the work — the difference between keeping
+            // up with a drag and lagging behind it. Less dramatic since S1
+            // removed the readback that scaled the same way and cost far more,
+            // but a dispatch is still not free at 4K.
             // A draft frame is visible for one gesture and is replaced by a
             // full-resolution one the moment motion stops, so the cost is a
             // little softness exactly while the image is moving too fast to
@@ -1055,7 +1118,8 @@ pub fn run(paths: Vec<PathBuf>) -> Result<()> {
 
     // **Rendering is decoupled from input, and this is why.**
     //
-    // A render is a blocking GPU round-trip (see `AdjustPass::read_output`).
+    // A render used to be a blocking GPU round-trip — S1 removed the block,
+    // but not the reason for this, so read it as history that still applies.
     // Running one straight from a `moved` handler put that stall *inside* the
     // gesture: touch events arrive far faster than a render completes, so the
     // input queue backed up, positions arrived stale, and Android — seeing the