Let one mask be built from more than one selection, and paint into it

A mask the model draws arrives approximately right — stopping inside a
shoulder, leaking into the hair — and FR-DEV-3's edge controls move the
*whole* boundary, so no value of feather or dilation fixes two errors that
go opposite ways. What fixes them is a second selection joined to the first,
and a layer that held exactly one source had nowhere to put one. The brush
the core has had all along was reachable from no control in the application.

A layer is now an ordered list of parts. Each names a source and how it
joins the mask before it — added to it, or taken out of it — and carries its
own edge treatment, because a model's soft coverage and a stroke painted
where it stopped short do not want the same feather. Invert and opacity stay
on the layer, where the composed shader already reads them.

The sidecar grows `[part]` blocks and nothing else. A layer of one part
writes exactly the bytes it always did; a mask block with no part blocks
after it reads back as one part; and a stroke, a join or a source this build
cannot read costs that part rather than the layer. So every sidecar in every
library still parses to the edit it always was.

On the device the parts fold into the layer's one slice, so eight layers
still cost eight channels: union is a `max` blend and subtraction is the
erase blend the brush already used. A part is drawn into a scratch texture
before it is joined, and that is not incidental — an erase stroke means a
hole in *that part*, not a hole in the mask, and drawn straight onto the
accumulator it would punch through the subject underneath. A layer of one
part skips all of it and takes the path it always took.

In the interface: a part list under the selected layer with a chip saying
which way each joins, Add and Subtract beside it, a Select/Paint/Erase strip
with the brush's size, hardness and flow, and a drag on the photograph that
paints. Pressing Paint on a mask that cannot hold a stroke joins a part that
can, rather than explaining that a subject is not a brush. A whole stroke is
one step in the history.

The edge controls now shape the part that is selected rather than the layer,
which is the one behaviour change to an existing control: with a correction
selected, the feather slider softens the correction and leaves the model's
mask alone.

core/dr-gpu/tests/local_adjustments.rs

@@ -12,7 +12,7 @@
 
 use dr_gpu::{AdjustPass, DemosaicedImage, GpuContext, LabelField, MaskPass};
 use dr_pipeline::descriptor::ParamId;
-use dr_pipeline::mask::{MaskLayer, MaskSource, MaskStack};
+use dr_pipeline::mask::{Join, MaskLayer, MaskPart, MaskSource, MaskStack};
 use dr_pipeline::operation::compose_full;
 use dr_pipeline::spot::SpotSet;
 use dr_pipeline::{ops, EditGraph, Framing};
@@ -286,11 +286,11 @@ type Gesture = (bool, f32, f32, Vec<(f32, f32)>);
 fn painted(gestures: &[Gesture]) -> MaskLayer {
     let mut layer = brighten(MaskSource::brush());
     for (erase, radius, flow, path) in gestures {
-        layer.begin_stroke(*erase, *radius, 0.9, *flow);
+        layer.begin_stroke(0, *erase, *radius, 0.9, *flow);
         for &(x, y) in path {
-            layer.extend_stroke(x, y);
+            layer.extend_stroke(0, x, y);
         }
-        layer.end_stroke();
+        layer.end_stroke(0);
     }
     layer
 }
@@ -505,9 +505,9 @@ fn hardness_decides_how_quickly_the_edge_falls_away() {
 
     let edge = |hardness: f32| {
         let mut layer = brighten(MaskSource::brush());
-        layer.begin_stroke(false, 0.4, hardness, 1.0);
-        layer.extend_stroke(0.5, 0.5);
-        layer.end_stroke();
+        layer.begin_stroke(0, false, 0.4, hardness, 1.0);
+        layer.extend_stroke(0, 0.5, 0.5);
+        layer.end_stroke(0);
 
         let pixels = render(&ctx, &stack_of(layer), None);
         // How many pixels along the centre row are neither fully painted nor
@@ -608,3 +608,184 @@ fn an_empty_stack_renders_exactly_as_the_unmasked_path() {
     let masked = render(&ctx, &MaskStack::new(), None);
     assert_eq!(plain, masked, "an empty mask stack must be a no-op");
 }
+
+// ---------------------------------------------------------------------------
+// Parts — a mask built from more than one selection
+// ---------------------------------------------------------------------------
+
+/// Everything, so a part joined to it has something to change.
+fn whole_frame() -> MaskSource {
+    MaskSource::Regions {
+        signature: 1,
+        level: 2,
+        ids: vec![0, 1],
+    }
+}
+
+/// Paint one gesture into a part of a layer, at a radius large enough that a
+/// 32-pixel frame can tell where it landed.
+fn paint(layer: &mut MaskLayer, part: usize, erase: bool, path: &[(f32, f32)]) {
+    assert!(
+        layer.begin_stroke(part, erase, 0.2, 1.0, 1.0),
+        "the layer had no room for a stroke"
+    );
+    for &(x, y) in path {
+        layer.extend_stroke(part, x, y);
+    }
+    layer.end_stroke(part);
+}
+
+#[test]
+fn a_union_part_adds_what_the_base_did_not_cover() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no adapter; skipping");
+        return;
+    };
+
+    let mut layer = brighten(MaskSource::Regions {
+        signature: 1,
+        level: 2,
+        ids: vec![0],
+    });
+    assert!(layer.push_part(MaskPart::painted("p2", Join::Union)));
+    paint(&mut layer, 1, false, &[(0.85, 0.5)]);
+
+    let mut stack = MaskStack::new();
+    stack.push(layer);
+    let pixels = render(&ctx, &stack, Some(&split_field(&ctx)));
+
+    assert!(
+        luma_at(&pixels, 4, 16) > 200,
+        "the base region is still masked"
+    );
+    assert!(
+        luma_at(&pixels, 27, 16) > 200,
+        "and the painted part joined the other half in"
+    );
+    assert_eq!(
+        luma_at(&pixels, 20, 2),
+        128,
+        "while what neither covers is untouched"
+    );
+}
+
+#[test]
+fn a_subtract_part_takes_a_bite_out_of_the_mask() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no adapter; skipping");
+        return;
+    };
+
+    let mut layer = brighten(whole_frame());
+    assert!(layer.push_part(MaskPart::painted("p2", Join::Subtract)));
+    paint(&mut layer, 1, false, &[(0.5, 0.5)]);
+
+    let mut stack = MaskStack::new();
+    stack.push(layer);
+    let pixels = render(&ctx, &stack, Some(&split_field(&ctx)));
+
+    assert_eq!(
+        luma_at(&pixels, 16, 16),
+        128,
+        "the middle was taken back out of the mask"
+    );
+    assert!(
+        luma_at(&pixels, 1, 1) > 200,
+        "and the corner the stroke never reached is still in it"
+    );
+}
+
+/// **The test the scratch texture exists for.** An erase stroke means a hole in
+/// the part it was painted into, not a hole in the mask: drawn straight onto
+/// the accumulator it would take away whatever the parts before it had put
+/// there, so tidying the edge of a correction would punch through the subject
+/// underneath — and the failure would read as the model's mask having holes.
+#[test]
+fn an_erase_stroke_holes_its_own_part_and_not_the_mask() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no adapter; skipping");
+        return;
+    };
+
+    let mut layer = brighten(whole_frame());
+    assert!(layer.push_part(MaskPart::painted("p2", Join::Union)));
+    paint(&mut layer, 1, false, &[(0.5, 0.5)]);
+    paint(&mut layer, 1, true, &[(0.5, 0.5)]);
+
+    let mut stack = MaskStack::new();
+    stack.push(layer);
+    let pixels = render(&ctx, &stack, Some(&split_field(&ctx)));
+
+    assert!(
+        luma_at(&pixels, 16, 16) > 200,
+        "the base still covers where the correction erased itself"
+    );
+}
+
+#[test]
+fn an_inverted_part_joins_everything_it_did_not_paint() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no adapter; skipping");
+        return;
+    };
+
+    // A base that covers nothing, so what shows is the part alone.
+    let mut layer = brighten(MaskSource::brush());
+    paint(&mut layer, 0, false, &[(0.1, 0.1)]);
+    assert!(layer.push_part(MaskPart::painted("p2", Join::Union)));
+    layer.parts_mut()[1].invert = true;
+    paint(&mut layer, 1, false, &[(0.5, 0.5)]);
+
+    let mut stack = MaskStack::new();
+    stack.push(layer);
+    let pixels = render(&ctx, &stack, Some(&split_field(&ctx)));
+
+    assert_eq!(
+        luma_at(&pixels, 16, 16),
+        128,
+        "where the inverted part was painted is outside the mask"
+    );
+    assert!(
+        luma_at(&pixels, 30, 30) > 200,
+        "and everywhere it was not is inside it"
+    );
+}
+
+/// Parts fold in order, so the same two selections joined the other way round
+/// are a different mask. A subtraction that lands before the part it was meant
+/// to cut into would take away nothing at all.
+#[test]
+fn the_order_parts_are_joined_in_is_the_mask() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no adapter; skipping");
+        return;
+    };
+
+    let render_pair = |cut_first: bool| {
+        let mut layer = brighten(MaskSource::brush());
+        if cut_first {
+            layer.push_part(MaskPart::painted("p2", Join::Subtract));
+            layer.push_part(MaskPart::painted("p3", Join::Union));
+            paint(&mut layer, 1, false, &[(0.5, 0.5)]);
+            paint(&mut layer, 2, false, &[(0.5, 0.5)]);
+        } else {
+            layer.push_part(MaskPart::painted("p2", Join::Union));
+            layer.push_part(MaskPart::painted("p3", Join::Subtract));
+            paint(&mut layer, 1, false, &[(0.5, 0.5)]);
+            paint(&mut layer, 2, false, &[(0.5, 0.5)]);
+        }
+        let mut stack = MaskStack::new();
+        stack.push(layer);
+        render(&ctx, &stack, Some(&split_field(&ctx)))
+    };
+
+    assert!(
+        luma_at(&render_pair(true), 16, 16) > 200,
+        "adding after a subtraction leaves the addition standing"
+    );
+    assert_eq!(
+        luma_at(&render_pair(false), 16, 16),
+        128,
+        "and subtracting after an addition takes it away again"
+    );
+}