Let one mask be built from more than one selection, and paint into it

A mask the model draws arrives approximately right — stopping inside a
shoulder, leaking into the hair — and FR-DEV-3's edge controls move the
*whole* boundary, so no value of feather or dilation fixes two errors that
go opposite ways. What fixes them is a second selection joined to the first,
and a layer that held exactly one source had nowhere to put one. The brush
the core has had all along was reachable from no control in the application.

A layer is now an ordered list of parts. Each names a source and how it
joins the mask before it — added to it, or taken out of it — and carries its
own edge treatment, because a model's soft coverage and a stroke painted
where it stopped short do not want the same feather. Invert and opacity stay
on the layer, where the composed shader already reads them.

The sidecar grows `[part]` blocks and nothing else. A layer of one part
writes exactly the bytes it always did; a mask block with no part blocks
after it reads back as one part; and a stroke, a join or a source this build
cannot read costs that part rather than the layer. So every sidecar in every
library still parses to the edit it always was.

On the device the parts fold into the layer's one slice, so eight layers
still cost eight channels: union is a `max` blend and subtraction is the
erase blend the brush already used. A part is drawn into a scratch texture
before it is joined, and that is not incidental — an erase stroke means a
hole in *that part*, not a hole in the mask, and drawn straight onto the
accumulator it would punch through the subject underneath. A layer of one
part skips all of it and takes the path it always took.

In the interface: a part list under the selected layer with a chip saying
which way each joins, Add and Subtract beside it, a Select/Paint/Erase strip
with the brush's size, hardness and flow, and a drag on the photograph that
paints. Pressing Paint on a mask that cannot hold a stroke joins a part that
can, rather than explaining that a subject is not a brush. A whole stroke is
one step in the history.

The edge controls now shape the part that is selected rather than the layer,
which is the one behaviour change to an existing control: with a correction
selected, the feather slider softens the correction and leaves the model's
mask alone.

docs/requirements.md

@@ -495,6 +495,28 @@ blend without a halo — the boundary is the picture's own, at whatever detail t
 also the only route to selecting by skin tone, and the prerequisite for composing a selection from
 several criteria at once.
 
+**FR-DEV-19 — Mask editing.** A mask layer's coverage shall be editable by hand after it is
+created: painted into, erased from, and built from more than one selection. Every edit is stored as
+geometry and parameters in the edit graph; no rasterised mask is written to a file and none exists
+in CPU memory (ARCH §5.4).
+
+A model finds a subject in a second and, before this, the photographer could not then change it by a
+single pixel. The coverage arrives approximately right — stopping inside a shoulder, leaking into
+the hair — and FR-DEV-3's edge controls move the *whole* boundary, so no value of either fixes two
+errors that go opposite ways. Every competing developer has had a brush over its selections for a
+decade; a mask that cannot be corrected is the reason an edit leaves this application for a pixel
+editor.
+
+**FR-DEV-19a — Mask composition.** A layer's mask is an ordered list of parts, each naming a source
+and how it joins the mask before it — added to it, or taken out of it. A layer of one part is
+exactly the layer that existed before this, and reads and writes the same sidecar. The parts of a
+layer merge under FR-NC-9 as the layer does, and each carries its own edge treatment.
+
+**FR-DEV-19b — Hand correction.** A part may be painted, with add and erase strokes, at a radius,
+hardness and flow the photographer sets. Strokes are stored as normalised source coordinates and
+rasterised on the device, so a correction stays on what it was painted on through a crop, a zoom and
+an export at any size. A whole stroke is one step in the history.
+
 ### 3.4 Display and interaction
 
 **FR-DSP-1 — Proxy-resolution rendering.** The develop view renders at the resolution actually