Render a blown highlight white instead of magenta

Every clipped sky came out bright pink. Measured, not guessed: developing
_MG_8596.CR2 and looking at the export, the subject renders correctly and only
the saturated region is wrong.

A fully clipped pixel reaches the shader as (1, 1, 1) — three photosites that
stopped counting, carrying no colour at all. The as-shot multipliers are not
neutral, so balancing sends it to (1.93, 1.00, 1.68) on this body, and the
camera matrix turns that into R 2.88, G 0.51, B 2.03. Red and blue clip at
one; green, whose matrix row is far less positive-heavy, does not. Red and
blue high with green low is magenta.

Nothing upstream was at fault, which is why the two previous attempts missed
it: the white balance is correct, the matrix is correct, and the sensor
normalisation is correct. The input simply was not a colour, and correct
arithmetic on a non-colour produces a confident wrong answer.

So saturation is detected before the balance is applied — the last 1.5% of
range, smoothstepped rather than switched, because a hard threshold draws a
visible rim around every highlight and a backlit edge on skin is where that
shows. Above it the pixel is pulled to the neutral of its own brightness, so
it keeps its luminance and loses only the cast.

Verified end to end on the file itself: the sky is white, the skin, the black
dresses and the stone are unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/dr-pipeline/src/operation.rs

@@ -347,7 +347,34 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {{
     //
     // A non-linear source has already had this applied in-camera; the uniform
     // is neutral there, so this is a multiply by one rather than a branch.
+    // How close this pixel was to saturation before any balance was applied.
+    // A photosite at its white level carries no colour information — every
+    // channel simply stopped counting — so the balance below must not be
+    // allowed to tint it.
+    let clipped = smoothstep(0.985, 1.0, max(c.r, max(c.g, c.b)));
+
     c = c * u.as_shot_wb.rgb;
+
+    // **Highlight desaturation, and without it every blown sky is magenta.**
+    //
+    // A fully clipped pixel arrives as (1, 1, 1). The as-shot multipliers are
+    // not neutral — on a Canon 6D they are (1.93, 1.00, 1.68) — so balancing
+    // sends it to exactly that, and the camera matrix then produces R 2.88,
+    // G 0.51, B 2.03. Red and blue clip at one and green does not, which is
+    // magenta. The balance is correct; the input was not a colour.
+    //
+    // So a saturated pixel is pulled back toward the neutral its raw values
+    // actually represent, fading in over the last 1.5% of range. Smoothly,
+    // because a hard switch puts a visible edge around every highlight where
+    // the two treatments meet — a rim light on skin is the worst case, and it
+    // is the one people notice.
+    //
+    // The neutral chosen is the balanced grey of the same brightness, so the
+    // highlight keeps its luminance and loses only the cast.
+    if (clipped > 0.0) {{
+        let neutral = vec3<f32>(max(c.r, max(c.g, c.b)));
+        c = mix(c, neutral, clipped);
+    }}
 {body}
     // Camera space -> linear sRGB. Applied after the adjustments so white
     // balance and exposure act on sensor-native values, which is where they