FR-MRG-4: the border is cropped or filled, the fill experimental; panorama.md §13 records what was built and measured

docs/requirements.md

@@ -1729,15 +1729,28 @@ profile, exposure, everything in §3.3 — as one photograph, from the sensor's
 
 **FR-MRG-4 — Projection and framing.** Cylindrical, spherical or perspective, chosen from the
 field of view and overridable; the horizon levelled from the estimated rotations, overridable by a
-drag; auto-crop to the largest inscribed rectangle, overridable. No boundary fill: painting pixels
-that were never captured is the pixel editing §1.3 excludes.
+drag; the border either cropped to the largest inscribed rectangle or filled, the photographer's
+choice, the crop the default.
 
 *The auto-crop is non-destructive* (built 2026-09-19): it is the composite's default crop, not a
 cut — the whole merge including its border is in the file, and resetting the crop shows it.
-*Boundary fill is an open question, raised the same day:* a fill of the border from the picture's
-own edge through FR-DEV-8's heal would be non-generative and honest about what it is; a generative
-inpainter is a model licence, hundreds of megabytes of weights and an inference path the
-application does not have. Neither is decided; the clause stands as written until one is.
+
+*The fill is generative and opt-in* (revised the same day, having first said "no boundary
+fill"): MI-GAN (Sargsyan et al., ICCV 2023; MIT code and weights, `models/LICENCE.md`) paints
+the uncovered border from the picture's own edge, under the inference engine (S16, [inference.md](inference.md)). It is a
+proposal under FR-MRG-1 — shown on the page, chosen against the crop, confirmed before the merge
+— never the default, and a merge that used it says so in its sidecar (`border filled`) so the
+invented pixels are declared, not passed off as captured. §1.3 still holds: the fill touches only
+pixels no frame reached, never the photograph; a filled merge keeps the inscribed crop as its
+default so the honest picture is one reset away. The filler is loaded from the model directory
+when present and the choice is greyed out, with the reason, when it is not.
+
+*Experimental, as shipped 2026-09-19.* The fill is right in thin borders and wrong in deep
+corners, where the model invents cloud and water where there is sky and grass
+(panorama.md §13); it ships opt-in with **every knob on the page** — working scale, edge
+erosion, coarse pass, band width, mirror depth, seam feather — each redrawing the preview, and
+the knobs used are written into the sidecar's `merge` line beside `border filled`. The knobs
+leave the page when the defaults are right; the sidecar record stays.
 
 **FR-MRG-5 — Honesty of failure.** *(general to any merge)* A frame that cannot be aligned is
 named, with why — too few matches, no overlap with any other frame, a residual above the stated