Keep blown highlights grey in a panorama

A clipped photosite reaches the merge as (1, 1, 1), which the as-shot
balance turns magenta. The preview balanced it with no highlight rule at
all, so every blown cloud was pink on the alignment page. The DNG had the
quieter form of the same fault: a frame's gain below one moved a blown
sample off the white level, and a feather mixed it into a neighbour's
real sky, so the develop's own desaturation no longer recognised it.

The merge shader and the preview now write a blown sample, before the
gain, as the camera value the composite's balance calls grey — the
develop pipeline's neutral, fading in from CLIP_ONSET.

core/dr-gpu/src/merge.rs

@@ -73,6 +73,10 @@ pub struct MergeOutput {
     pub chunk: (u32, u32),
     /// Multiplies a normalised sample (1.0 = white) to the sensor's scale.
     pub sample_scale: f32,
+    /// The white balance the composite will be developed with — the
+    /// inverse of its `AsShotNeutral` — so that a blown sample can be
+    /// written as the camera value that balance calls grey.
+    pub balance: [f32; 3],
 }
 
 impl MergeOutput {
@@ -109,7 +113,8 @@ struct WarpParams {
     tile_origin: [f32; 2],
     tile_size: [u32; 2],
     feather: f32,
-    _pad: f32,
+    clip_onset: f32,
+    balance: [f32; 4],
 }
 
 #[repr(C)]
@@ -334,7 +339,13 @@ impl MergePass {
                         tile_origin: [rect.0 as f32, rect.1 as f32],
                         tile_size: [rect.2, rect.3],
                         feather: output.feather,
-                        _pad: 0.0,
+                        clip_onset: dr_pipeline::CLIP_ONSET,
+                        balance: [
+                            output.balance[0].max(1e-3),
+                            output.balance[1].max(1e-3),
+                            output.balance[2].max(1e-3),
+                            0.0,
+                        ],
                     };
                     self.accumulate(&params, tile);
                 }

core/dr-gpu/src/shaders/merge.wgsl

@@ -46,7 +46,10 @@ struct Params {
     tile_size: vec2<u32>,
     // Pixels over which the weight ramps from the edge to full.
     feather: f32,
-    _pad: f32,
+    // Where a sample starts to count as blown (`CLIP_ONSET`), and the
+    // white balance the composite will be developed with.
+    clip_onset: f32,
+    balance: vec4<f32>,
 };
 
 @group(0) @binding(0) var<uniform> p: Params;
@@ -125,7 +128,19 @@ fn warp(@builtin(global_invocation_id) gid: vec3<u32>) {
         return;
     }
     // Colour is the alpha-weighted mean of the texels that exist.
-    let rgb = s.rgb / s.a * p.gain;
+    let cam = s.rgb / s.a;
+    // **A blown sample is written as grey, before the gain.** A clipped
+    // photosite arrives as (1, 1, 1), which is not a colour: balanced, it
+    // is magenta, and the develop's highlight desaturation only rescues it
+    // while it is still at the white level. A gain below one moved it off
+    // that level, and a feather mixed it into a neighbour's real sky, so
+    // the composite's blown clouds came out pink. Written instead as the
+    // camera value the balance maps to grey — the develop pipeline's own
+    // neutral, the brightest balanced channel — it survives both.
+    let clipped = smoothstep(p.clip_onset, 1.0, max(cam.r, max(cam.g, cam.b)));
+    let balanced = cam * p.balance.rgb;
+    let grey = vec3<f32>(max(balanced.r, max(balanced.g, balanced.b))) / p.balance.rgb;
+    let rgb = mix(cam, grey, clipped) * p.gain;
     let wa = w * s.a;
     let i = gid.y * p.chunk_size.x + gid.x;
     acc[i] = acc[i] + vec4<f32>(rgb * wa, wa);