Tag three requirements the code already meets

R5 says in its own note that zoom_resolution.rs establishes it as a
pixel equality; that file was tagged FR-DSP-5 alone. FR-DEV-19's three
sub-clauses carry eighty-three tags between them while the parent had
none; MaskLayer, which is the thing they edit, now carries it. And
NFR-R3 — a crash in decode does not take down the application, the
image is marked failed — is exactly what the decoder's panic guard and
the face sweep's unreadable mark do, tagged FR-RAW-4 and NFR-SEC-1 and
not the clause that asked for them.

core/dr-decode/src/error.rs

@@ -27,7 +27,7 @@ pub enum DecodeError {
 
 /// Run a decoder call, and return a panic inside it as an error.
 ///
-/// TRACES: FR-RAW-4 | NFR-SEC-1
+/// TRACES: FR-RAW-4 | NFR-SEC-1 | NFR-R3
 /// rawler `panic!`s on some malformed input rather than returning `Err` — a
 /// DNG whose IFD claims a >50000 px image, for one, which is in the reference
 /// library. A panic on a worker thread ends the thread: the face sweep that

core/dr-gpu/tests/zoom_resolution.rs

@@ -1,4 +1,4 @@
-//! TRACES: FR-DSP-5
+//! TRACES: FR-DSP-5 | R5
 //! Zooming to 1:1 samples the source, pixel for pixel.
 //!
 //! FR-DSP-5: *"Fit, 1:1, and arbitrary zoom levels. At 1:1 and above, the

core/dr-pipeline/src/mask.rs

@@ -1304,7 +1304,12 @@ impl PartialEq for MaskPart {
     }
 }
 
+/// TRACES: FR-DEV-19
 /// One local adjustment: a rule about *where*, plus a chain saying *what*.
+///
+/// The *where* is editable after the fact — composed from parts (FR-DEV-19a),
+/// painted into and out of (FR-DEV-19b), shown (FR-DEV-19c) — and every edit
+/// to it is geometry and parameters in this struct, never a raster in a file.
 pub struct MaskLayer {
     /// Stable identity, for the sidecar and for merge (FR-NC-9).
     pub id: String,