Release 0.19.3

Let Back close the presets menu instead of the application
The presets menu at the foot of the tool rail is a PopupWindow, and showing a popup takes focus off the develop view until it closes. The menu held nothing focusable, so Android's Back gesture, pressed to dismiss it, found no focus item, went unanswered, and the platform closed the application. Slint closes a popup on Escape by itself but not on Back. The menu now holds a key scope, as the film list does, that closes it on Back or Escape. The next Back leaves develop for the grid.
2026-09-30 22:46:17 -04:00 · 2026-09-30 22:11:51 -04:00 · 2026-09-30 21:57:44 -04:00 · 2026-09-30 21:45:54 -04:00 · 2026-09-30 21:30:09 -04:00 · 2026-09-29 21:31:58 -04:00
1539 changed files with 242027 additions and 39027 deletions
@@ -10,3 +10,22 @@
 # detects exactly that and fails with an instruction rather than embedding the
 # pointer and failing at inference time.
 *.onnx filter=lfs diff=lfs merge=lfs -text
+
+# Test photographs live in LFS too, and are fetched only by the tests that
+# need them.
+#
+# `fixtures/**` holds real camera files — a twelve-frame panorama set is
+# 325 MB — and CI's `git lfs pull` excludes the directory, so a checkout
+# carries pointers there until a merge test asks for the frames. Same
+# reasoning as the models, with the opposite default: the model is not
+# optional and the fixtures are.
+fixtures/** filter=lfs diff=lfs merge=lfs -text
+
+# The manual's pictures live in LFS for the same reason the models do: a
+# screenshot or a GIF changes wholesale when the interface it shows changes,
+# and every re-recording would otherwise stay in every clone for good. The
+# desktop and benchmark legs exclude the directory, since nothing they build
+# or test reads it; the Android and Windows legs fetch it, because the APK
+# and the installer carry the manual (docs/manual/index.html) with its
+# pictures, and their packagers refuse a pointer.
+docs/manual/media/** filter=lfs diff=lfs merge=lfs -text
@@ -1,6 +1,6 @@
 name: Benchmarks

-# The suite docs/requirements.md §8 has been promising since it was written:
+# The suite docs/dev/requirements.md §8 has been promising since it was written:
 # "an automated benchmark suite against a synthetic 50k catalog, run per-commit
 # … A regression beyond stated tolerance fails the build."
 #
@@ -29,7 +29,7 @@ name: Benchmarks
 #         every commit to establish, every time, that this runner has no GPU. It
 #         runs on demand (Actions → Run workflow) so that a runner that *does*
 #         have one can be pointed at it, and the numbers it produces belong in
-#         docs/frame-budget.md by hand, as they already are.
+#         docs/dev/frame-budget.md by hand, as they already are.

 on:
  push:
@@ -148,7 +148,7 @@ jobs:
            | while read -r key; do git config --local --unset-all "$key"; done || true
          git config --local lfs.url \
            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
-          git lfs pull
+          git lfs pull --exclude="fixtures/**,docs/manual/media/**"

      - name: Cache cargo
        uses: actions/cache@v4
@@ -183,7 +183,7 @@ jobs:
      - name: Frame budget (FR-DSP-3)
        run: cargo test --release -p dr-gpu --test frame_budget -- --nocapture

-      # The instrument behind docs/frame-budget.md. It exits non-zero with no
+      # The instrument behind docs/dev/frame-budget.md. It exits non-zero with no
      # adapter, which is right for a tool a person runs deliberately and wrong
      # for a job that usually has none — hence continue-on-error. Its table is
      # in the log for whoever asked for this run; the committed numbers are
@@ -7,6 +7,10 @@ name: Build and test
 on:
  push:
    branches: [main, master, develop]
+    # A release tag builds again and publishes what it built (the `release`
+    # job at the end). The master push of the same commit has usually filled
+    # the caches, so the second run is the warm one.
+    tags: ['v*']
  pull_request:
    branches: [main, master, develop]

@@ -96,7 +100,9 @@ jobs:
            | while read -r key; do git config --local --unset-all "$key"; done || true
          git config --local lfs.url \
            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
-          git lfs pull
+          # The manual's pictures too: the APK carries the manual, and
+          # assemble-apk.sh refuses a pointer where a picture should be.
+          git lfs pull --exclude="fixtures/**"
          ls -lR models/

      - name: Cache cargo
@@ -151,9 +157,32 @@ jobs:
      - name: Test
        run: cargo test --workspace

+      # The runner has one 99 GB disk shared with its images, and this job
+      # ended at 92 GB (2.1 GB free) on v0.18.0's run; v0.18.1's release
+      # build then died with "No space left on device". The test executables
+      # and examples in target/debug are the largest things in it, are never
+      # reused (a changed source relinks them) and are not what the cache is
+      # for — the dependency rlibs are — so they go before the release build
+      # rather than competing with it.
+      - name: Free the test binaries before the release build
+        run: |
+          find target/debug/deps -maxdepth 1 -type f -executable -delete
+          rm -rf target/debug/examples target/debug/incremental
+          df -h /workspace 2>/dev/null || df -h .
+
      - name: Build
        run: cargo build --workspace --release

+      # Only on a release tag: the binary is 150 MB and nothing but the
+      # release job wants it.
+      - name: Upload the desktop binary
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: actions/upload-artifact@v3
+        with:
+          name: darkroom-desktop-x86_64-linux
+          path: target/release/darkroom-desktop
+          if-no-files-found: error
+
      - name: Disk after
        if: always()
        run: df -h /workspace 2>/dev/null || df -h .
@@ -213,7 +242,9 @@ jobs:
            | while read -r key; do git config --local --unset-all "$key"; done || true
          git config --local lfs.url \
            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
-          git lfs pull
+          # The manual's pictures too: the APK carries the manual, and
+          # assemble-apk.sh refuses a pointer where a picture should be.
+          git lfs pull --exclude="fixtures/**"
          ls -lR models/

      - name: Cache cargo
@@ -322,7 +353,7 @@ jobs:
        env:
          CARGO_TARGET_DIR: target-android
          # Absent secrets mean a debug signature, which is what a fork or a
-          # branch build should get. Set all three (see docs/android-signing.md)
+          # branch build should get. Set all three (see docs/dev/android-signing.md)
          # and the same job produces a release-signed APK instead.
          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
          KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
@@ -365,6 +396,124 @@ jobs:
          path: target-android/apk/darkroom.apk
          if-no-files-found: error

+  windows-image:
+    uses: ./.gitea/workflows/windows-image.yml
+
+  # TRACES: FR-PLAT-WIN-3
+  # The Windows executable and its installer, cross-built from Linux
+  # (docs/dev/windows.md §7). No Windows machine anywhere in this job: what it
+  # can prove is that the binary links, is a Windows executable with no
+  # MinGW runtime imports, starts under Wine, and that the installer installs
+  # and uninstalls under Wine. What it cannot prove — a Vulkan device, a
+  # render, the secret store — is a release step on a real machine (§6).
+  windows:
+    runs-on: linux/amd64
+    name: Windows (x86_64, cross)
+    needs: windows-image
+    container:
+      image: gitea.tourolle.paris/dtourolle/darkroom-windows:latest
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+      CARGO_TARGET_DIR: target-windows
+      # Wine keeps its prefix under $HOME, which the image points at a
+      # directory that does not exist in a fresh container.
+      HOME: /tmp/home
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Same step as the desktop leg: the models are LFS objects and the
+      # packager refuses pointers.
+      - name: Fetch the models
+        env:
+          LFS_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+        run: |
+          set -e
+          git lfs install --local
+          git config --local --get-regexp '^http\..*extraheader$' \
+            | cut -d' ' -f1 | sort -u \
+            | while read -r key; do git config --local --unset-all "$key"; done || true
+          git config --local lfs.url \
+            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
+          # The manual's pictures too: the installer carries the manual, and
+          # package.sh refuses a pointer where a picture should be.
+          git lfs pull --exclude="fixtures/**"
+          ls -l models/face models/scene
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            /opt/cargo/registry
+            target-windows
+          key: windows-${{ hashFiles('**/Cargo.lock') }}
+
+      # The cfg(windows) branches are linted here and nowhere else: the
+      # desktop leg's clippy never compiles them.
+      - name: Clippy for the target
+        run: cargo clippy --release --target x86_64-pc-windows-gnu -p darkroom-desktop -- -D warnings
+
+      - name: Build
+        run: cargo build --release --target x86_64-pc-windows-gnu -p darkroom-desktop
+
+      - name: Smoke-test the executable
+        run: |
+          set -e
+          mkdir -p "$HOME"
+          EXE=target-windows/x86_64-pc-windows-gnu/release/darkroom-desktop.exe
+          file "$EXE"
+          file "$EXE" | grep -q 'PE32+' || { echo "FAIL: not a PE32+ executable"; exit 1; }
+          file "$EXE" | grep -q '(GUI)' || { echo "FAIL: not a GUI-subsystem executable"; exit 1; }
+          if x86_64-w64-mingw32-objdump -p "$EXE" | grep -iE 'libwinpthread|libgcc|libstdc'; then
+            echo "FAIL: the executable imports a MinGW runtime DLL"
+            exit 1
+          fi
+          x86_64-w64-mingw32-objdump -p "$EXE" | grep 'DLL Name' | sort -u
+          wineboot --init >/dev/null 2>&1 || true
+          OUT=$(wine "$EXE" --version 2>/dev/null)
+          echo "wine: $OUT"
+          echo "$OUT" | grep -q '^darkroom-desktop ' || { echo "FAIL: --version did not answer under Wine"; exit 1; }
+
+      - name: Package the installer
+        run: bash docker/windows/package.sh
+
+      - name: Smoke-test the installer
+        run: |
+          set -e
+          SETUP=$(ls target-windows/installer/DarkRoom-*-x86_64-setup.exe)
+          file "$SETUP" | grep -q 'PE32+' || { echo "FAIL: the installer is not 64-bit"; exit 1; }
+          wine "$SETUP" /S 2>/dev/null
+          INST=$(echo "$HOME"/.wine/drive_c/users/*/AppData/Local/Programs/DarkRoom)
+          ls "$INST"
+          # As many files as package.sh stages: everything but the READMEs in
+          # the directories it copies. A literal here went stale the first
+          # time a model was added.
+          WANT=$(find models/face models/scene models/inpaint -maxdepth 1 -type f ! -name README.md | wc -l)
+          GOT=$(ls "$INST/models" | wc -l)
+          [ "$GOT" = "$WANT" ] || { echo "FAIL: expected $WANT model files, installed $GOT"; exit 1; }
+          # The manual, and every picture it shows, counted the same way.
+          [ -f "$INST/manual/index.html" ] || { echo "FAIL: no manual installed"; exit 1; }
+          WANT=$(ls docs/manual/media | wc -l)
+          GOT=$(ls "$INST/manual/media" | wc -l)
+          [ "$GOT" = "$WANT" ] || { echo "FAIL: expected $WANT manual pictures, installed $GOT"; exit 1; }
+          wine reg query 'HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DarkRoom' 2>/dev/null \
+            | grep -q DisplayVersion || { echo "FAIL: no uninstall registry key"; exit 1; }
+          wine "$INST/darkroom.exe" --version 2>/dev/null | grep -q '^darkroom-desktop ' \
+            || { echo "FAIL: the installed executable does not run"; exit 1; }
+          wine "$INST/uninstall.exe" /S 2>/dev/null
+          sleep 3
+          [ ! -e "$INST" ] || { echo "FAIL: uninstall left $INST behind"; ls -R "$INST"; exit 1; }
+          echo "OK: installed and uninstalled under Wine"
+
+      - name: Upload the installer
+        uses: actions/upload-artifact@v3
+        with:
+          name: darkroom-windows-x86_64-setup
+          path: target-windows/installer/DarkRoom-*-x86_64-setup.exe
+          if-no-files-found: error
+
  layering:
    runs-on: linux/amd64
    name: Layer separation
@@ -408,3 +557,47 @@ jobs:
            fi
          done
          exit $FAILED
+
+  # A v* tag becomes a Gitea Release carrying the three builds and their
+  # SHA256SUMS, titled and described by the tag's message. Until this job
+  # existed every release was made by hand, and most tags never got one.
+  #
+  # It needs all three platform jobs, so a tag whose tests fail publishes
+  # nothing; re-run the failed job and this one follows. The work is
+  # tools/publish-release.sh, which is also how a release is finished by hand.
+  release:
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: [desktop, android, windows]
+    runs-on: linux/amd64
+    name: Publish the release
+    container:
+      image: catthehacker/ubuntu:act-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Fetch the builds
+        uses: actions/download-artifact@v3
+        with:
+          path: dist
+
+      # Named for the download page, with the version in each name the way
+      # the hand-made releases had them. The installer already carries its
+      # version from package.sh.
+      - name: Publish
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -e
+          V="${TAG#v}"
+          ls -lR dist
+          mkdir -p out
+          cp dist/darkroom-arm64-v8a-apk/darkroom.apk "out/darkroom-${V}-arm64-v8a.apk"
+          cp dist/darkroom-desktop-x86_64-linux/darkroom-desktop "out/darkroom-desktop-${V}-x86_64-linux"
+          chmod +x "out/darkroom-desktop-${V}-x86_64-linux"
+          cp dist/darkroom-windows-x86_64-setup/DarkRoom-${V}-x86_64-setup.exe out/
+          bash tools/publish-release.sh "$TAG" out/*
@@ -7,7 +7,7 @@ name: Traceability
 # fail its own threshold. Two rules follow, and the extractor's own tests
 # enforce both:
 #
-#   1. Denominators are parsed from docs/requirements.md at run time.
+#   1. Denominators are parsed from docs/dev/requirements.md at run time.
 #   2. Coverage is |traced ∩ defined| / |defined|, never a raw traced count.
 #
 # This job is static analysis of source comments plus markdown parsing, so it
@@ -67,6 +67,12 @@ jobs:
      # threshold: zero requirements parsed, zero files scanned, a ratio above
      # 100%, or any orphan tag all fail the build. A misconfigured run must not
      # report a plausible-looking 0%.
+      # Every picture the manual shows is made by a scene in
+      # tools/manual/scenes.py, and every picture a scene makes is shown.
+      # Two files read; no app, no display.
+      - name: Manual pictures have scenes
+        run: tools/manual/record.sh --check
+
      - name: Traceability gate
        run: cargo run -q -p traceability -- check

@@ -74,11 +80,11 @@ jobs:
        run: |
          set -e
          cargo run -q -p traceability -- report
-          if ! git diff --quiet docs/traceability.md; then
+          if ! git diff --quiet docs/dev/traceability.md; then
            echo ""
-            echo "docs/traceability.md is out of date."
+            echo "docs/dev/traceability.md is out of date."
            echo "Run: cargo run -p traceability -- report"
-            git diff --stat docs/traceability.md
+            git diff --stat docs/dev/traceability.md
            exit 1
          fi

@@ -91,10 +97,19 @@ jobs:
      # they will conclude the application is broken rather than the page.
      #
      # This also fails on a malformed tag, so a typo costs a gesture its
-      # desktop half loudly rather than silently.
+      # desktop half loudly rather than silently — and on a key a Slint
+      # handler binds that no tag names, or a key a tag names that no handler
+      # binds (tools/traceability/src/keymap.rs).
      - name: Regenerate the gesture vocabulary and check it is committed
        run: cargo run -q -p traceability -- gestures-check

+      # The manual's page, which the packages carry and the help sheet links
+      # into. Blocking for the gesture book's reason: it is shown to the user,
+      # and a page that disagrees with the README is a manual describing an
+      # application that no longer exists.
+      - name: Regenerate the manual page and check it is committed
+        run: cargo run -q -p traceability -- manual-check
+
      # Advisory, not blocking: not every file implements a requirement, and a
      # tag on every function is noise that rots faster than it helps. Tag the
      # unit that decides.
@@ -127,4 +142,4 @@ jobs:

      - name: Summary
        if: always()
-        run: head -30 docs/traceability.md || true
+        run: head -30 docs/dev/traceability.md || true
@@ -0,0 +1,170 @@
+name: '🐳 Windows image'
+
+# Builds and pushes gitea.tourolle.paris/dtourolle/darkroom-windows, the job
+# container for the Windows leg of build-and-test.yml.
+#
+# The same shape as android-image.yml, for the same reason that one exists:
+# an image that lives only on a developer's laptop is a job that dies at
+# `docker pull`. Built from docker/windows, tagged by that directory's tree
+# id, skipped when the registry already has it.
+#
+# Called by build-and-test.yml on every push, and runnable by hand via
+# workflow_dispatch. It is cheap when nothing changed — see the guard below.
+on:
+  workflow_call:
+    inputs:
+      force:
+        description: 'Rebuild even if the registry already has this image ("true"/"false")'
+        type: string
+        default: 'false'
+  workflow_dispatch:
+    inputs:
+      force:
+        description: 'Rebuild even if the registry already has this image ("true"/"false")'
+        type: string
+        default: 'false'
+
+# Gitea's act_runner mangles boolean workflow inputs passed through an
+# expression — they arrive as false regardless of what was sent. Every input
+# here is a string compared with == 'true', as in KPN's docker.yaml.
+
+env:
+  IMAGE: gitea.tourolle.paris/dtourolle/darkroom-windows
+
+jobs:
+  build:
+    runs-on: linux/amd64
+    name: Build and push
+    # Deliberately NOT in a container: this job needs the host Docker daemon to
+    # build an image, and the host's cached ~/.docker/config.json to push it.
+    # That is also why there is no `docker login` step — the runner host was
+    # authenticated to the registry during setup.
+
+    steps:
+      # The host has no Node, so the JS-based actions/checkout cannot run here.
+      # A minimal shallow fetch with plain git gets the same tree.
+      - name: Checkout
+        run: |
+          set -e
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git -c http.extraheader="AUTHORIZATION: basic $(printf '%s' '${{ github.actor }}:${{ github.token }}' | base64 -w0)" \
+            fetch --depth 1 origin "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
+
+      # The image is tagged by the content of docker/windows, not by the commit
+      # that happened to touch it. `git rev-parse HEAD:<dir>` is the tree object
+      # id — it changes when and only when a file in that directory changes, so
+      # an unrelated push reuses the existing image and a Dockerfile edit can
+      # never silently keep serving a stale `latest`.
+      #
+      # Using the commit sha instead would rebuild 2.5 GB on every push; using a
+      # paths-filter action would need a container that has Node, and the only
+      # one this repo would reach for is the very image being built.
+      - name: Resolve image tag
+        id: tag
+        run: |
+          set -e
+          TREE=$(git rev-parse HEAD:docker/windows)
+          echo "tree=$TREE" >> "$GITHUB_OUTPUT"
+          echo "docker/windows tree: $TREE"
+
+      # Skip the build when the registry already holds this exact content. This
+      # is what keeps the job a few seconds long on a normal push, and what
+      # makes it self-healing: if the tag is missing for any reason, including
+      # the image having never been pushed at all, it gets built here.
+      #
+      # The probe is curl against the registry API, NOT `docker manifest
+      # inspect`. The latter exits 1 on this registry even for tags that are
+      # demonstrably present — jellytau-builder:latest answers HTTP 200 to the
+      # API while `docker manifest inspect` reports "manifest unknown" for it.
+      # Trusting that would have rebuilt 7 GB on every single push.
+      #
+      # A HEAD request also gives the digest for free, which is how the repoint
+      # decision below is made without pulling any layers.
+      - name: Query registry
+        id: check
+        env:
+          # The runner's own credentials, so this does not depend on how the
+          # host's ~/.docker/config.json happens to be set up.
+          REG_USER: ${{ github.actor }}
+          REG_PASS: ${{ github.token }}
+          TREE: ${{ steps.tag.outputs.tree }}
+        run: |
+          set -eu
+          ACCEPT='application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json'
+          API="https://gitea.tourolle.paris/v2/dtourolle/darkroom-windows/manifests"
+
+          # Prints "<http-status> <digest-or-empty>" for a tag.
+          probe() {
+            curl -sI -u "$REG_USER:$REG_PASS" -H "Accept: $ACCEPT" "$API/$1" \
+              | tr -d '\r' \
+              | awk 'BEGIN{s="000";d=""} /^HTTP/{s=$2} tolower($1)=="docker-content-digest:"{d=$2} END{print s, d}'
+          }
+
+          read -r TREE_STATUS TREE_DIGEST <<EOF
+          $(probe "$TREE")
+          EOF
+          read -r LATEST_STATUS LATEST_DIGEST <<EOF
+          $(probe latest)
+          EOF
+
+          echo "tag $TREE -> HTTP $TREE_STATUS ${TREE_DIGEST:-(no digest)}"
+          echo "tag latest -> HTTP $LATEST_STATUS ${LATEST_DIGEST:-(no digest)}"
+
+          # Build unless the registry definitively confirms this content is
+          # already there. An auth failure or an unreachable registry lands
+          # here too, and rebuilding needlessly is the safe direction to fail —
+          # skipping a build that was needed is what breaks the Windows job.
+          if [ "${{ inputs.force }}" = "true" ]; then
+            echo "forced rebuild requested"
+            echo "build=true" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          elif [ "$TREE_STATUS" != "200" ]; then
+            echo "registry does not have this content — building"
+            echo "build=true" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          elif [ -n "$TREE_DIGEST" ] && [ "$TREE_DIGEST" = "$LATEST_DIGEST" ]; then
+            echo "registry is already correct — nothing to do"
+            echo "build=false" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "content is present but latest points elsewhere — repointing"
+            echo "build=false" >> "$GITHUB_OUTPUT"
+            echo "repoint=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Context is docker/windows, matching the README's build command. The
+      # Dockerfile COPYs nothing from the repo, so it needs no wider context —
+      # and a narrow context keeps the daemon from tarring up the whole tree,
+      # target/ included.
+      - name: Build
+        if: ${{ steps.check.outputs.build == 'true' }}
+        run: |
+          set -e
+          docker build \
+            -t "$IMAGE:${{ steps.tag.outputs.tree }}" \
+            -t "$IMAGE:latest" \
+            docker/windows
+
+      # Both tags are pushed: the tree tag is what the guard above looks for on
+      # the next run, and `latest` is what build-and-test.yml pulls.
+      - name: Push
+        if: ${{ steps.check.outputs.build == 'true' }}
+        run: |
+          set -e
+          docker push "$IMAGE:${{ steps.tag.outputs.tree }}"
+          docker push "$IMAGE:latest"
+
+      # A cache hit on the tree tag says nothing about where `latest` points — a
+      # reverted Dockerfile or a build from another branch can leave it on
+      # different content. This runs only when the digests above actually
+      # disagree, so the common case costs nothing; the layers are already in
+      # the registry, so the push that follows uploads a manifest, not 2.5 GB.
+      - name: Repoint latest
+        if: ${{ steps.check.outputs.repoint == 'true' }}
+        run: |
+          set -e
+          docker pull "$IMAGE:${{ steps.tag.outputs.tree }}"
+          docker tag "$IMAGE:${{ steps.tag.outputs.tree }}" "$IMAGE:latest"
+          docker push "$IMAGE:latest"
@@ -26,7 +26,7 @@ fi
 # The artefacts are generated from the tree, so regenerating them because one
 # was itself edited would be circular.
 case "$(tr -d '[:space:]' <<< "${staged}")" in
-    docs/traceability.md | docs/gestures.md | ui/dr-ui/src/gesture_book.rs)
+    docs/dev/traceability.md | docs/gestures.md | ui/dr-ui/src/gesture_book.rs | docs/manual/index.html)
        exit 0
        ;;
 esac
@@ -41,9 +41,9 @@ if ! cargo run -q -p traceability -- report >/dev/null 2>&1; then
    exit 0
 fi

-if ! git diff --quiet -- docs/traceability.md; then
-    git add docs/traceability.md
-    echo "pre-commit: regenerated docs/traceability.md and staged it"
+if ! git diff --quiet -- docs/dev/traceability.md; then
+    git add docs/dev/traceability.md
+    echo "pre-commit: regenerated docs/dev/traceability.md and staged it"
 fi

 # The gesture vocabulary, same discipline.
@@ -65,3 +65,17 @@ for f in docs/gestures.md ui/dr-ui/src/gesture_book.rs; do
        echo "pre-commit: regenerated ${f} and staged it"
    fi
 done
+
+# The manual's page, when its source is part of the commit. Rendered from
+# nothing but the README, so there is no reason to pay for it otherwise.
+if grep -qx 'docs/manual/README.md' <<< "${staged}"; then
+    if ! out="$(cargo run -q -p traceability -- manual 2>&1)"; then
+        echo "pre-commit: the manual would not render" >&2
+        echo "${out}" >&2
+        exit 1
+    fi
+    if ! git diff --quiet -- docs/manual/index.html; then
+        git add docs/manual/index.html
+        echo "pre-commit: regenerated docs/manual/index.html and staged it"
+    fi
+fi
@@ -23,3 +23,4 @@ tools/film-profiles/upstream/
 # checkout, so it is larger than the repository it sits in.
 /.flatpak-builder/
 /build/
+__pycache__/
@@ -0,0 +1,165 @@
+# Working in this repository
+
+Notes for anyone — person or agent — changing this code. They record what
+went wrong once and what the fix looked like, so the same shape is not
+written again. Requirements live in `docs/dev/requirements.md`; this file is
+about habits, not features.
+
+## Catalog reads: work is proportional to what changed, never to library size
+
+`docs/dev/catalog.md §1` states the rule. These are the ways it was broken on
+the Identity screen, found when every confirm click cost half a second on a
+24k-image library (2026-09-19), and what each fix looked like.
+
+**A redraw must know what changed.** A click handler that calls "refresh
+everything" pays for everything. `identity_ui::refresh` takes a `Changed`:
+a confirm re-reads the rail and the grid and *not* the coverage line,
+because moving a face between people cannot alter how many images are
+indexed. Before adding a read to a shared refresh, ask which events can
+change its answer, and gate it on those.
+
+**Count with `COUNT(*)`, never with `.len()` on a list you then drop.**
+`repairs::counts` used to build every repair's work list — a `Target` with
+its path per row, sorted into visiting order — to report its length. Six
+repairs, 350 ms, nothing kept. If the caller wants a number, the query
+returns a number.
+
+**One query, not one per row.** `ThumbStore::contains` in a filter over
+5,000 rows is 5,000 prepared statements; `ThumbStore::held(size)` reads the
+index once into a set. The same applies to any `query_row` inside a loop
+over a result set — including `deep_count` per sidebar row, which is fine
+at sidebar scale and would not be at grid scale. Aggregate in one
+statement and look up in memory.
+
+**SQL text in a loop is a prepare in a loop.** rusqlite's `execute` and
+`query_row` compile their statement on every call. A loop that calls them
+per row pays a prepare per row even when each query is a primary-key seek:
+the merge of a synced catalog prepared four statements for each of 13,000
+incoming faces (450 ms of a pass that changed nothing), `persist` four per
+photograph a scan listed (1.5 s for a first scan), the shard sync one per
+image each way. Hoist the statement, use `prepare_cached`, or — better, when
+the loop asks the same table about every row — read that table once into a
+map. And do not rewrite a row with what it already holds: an upsert of
+identical values still dirties the page.
+
+**A `LIKE` is case-insensitive, and no index here serves that.**
+`source_ref LIKE 'stem.%'` read every name of the root per sidecar a pull
+took in. When the check that decides is exact, spell the prefix as a range
+(`>= 'stem.' AND < 'stem/'`, `/` being the byte after `.`), which the
+`(root_id, source_ref)` key answers with a seek.
+
+**`Catalog::open` is not free, and every worker thread calls it.** The
+backfill runs on every open, and the develop view opens a catalog to fetch
+each original and again for each neighbour it prefetches. Keep each
+backfill step's no-op case to a read of the small side — the unpaired
+JPEGs, not every RAW; the distinct keywords, not every assignment — and
+measure an open with `catalog_bench` after adding one.
+
+**Filter and aggregate in SQL, and aggregate the small side first.**
+`faces::people` read 19,000 rows, grouped, sorted them by name, and the
+screen threw 17,000 away (empty unnamed groups). `people_in_use` filters in
+the `WHERE`, and joins `people` to a pre-aggregated `face_person` (2,000
+groups) rather than grouping after a `LEFT JOIN` over every person. The
+sort then sees only the rows that will be drawn.
+
+**Wide rows make "just check one column" a table scan.** A `faces` row is
+~8 KB (a 1 KB embedding and a ~5 KB crop, then the columns added later).
+Any predicate that reads `quality`, `crop` or an eye column for every face
+reads every row. V17 learned this for the eye filter; V19 applies it to the
+repair counts with partial indexes (`faces_owed_*`) that hold only the rows
+still owing, keyed on what the predicate joins on and carrying `model_id`
+because the predicate reads it. Two things to know about them:
+
+- **Drive the count from the small side.** SQLite uses a partial index
+  when the query starts from `faces` (`repairs::count`, `Needs::Face`) and
+  ignores it inside a correlated `EXISTS (... WHERE f.image_id = i.id ...)`.
+  That is why `Needs::Face` carries the per-face fragment and spells it two
+  ways.
+- **Spell the predicate as the index's `WHERE` is spelled.** `NEEDS_EYES`
+  is `(f.eye_right IS NULL OR f.landmarks_dense IS NULL)` because
+  `faces_owed_eyes` is `WHERE eye_right IS NULL OR landmarks_dense IS NULL`.
+  Change one, change both, and `counts_are_the_sizes_of_the_lists` will
+  tell you if they drift.
+
+Check a query's plan with `EXPLAIN QUERY PLAN` against a copy of a real
+catalog before trusting an index exists for it: "SEARCH ... USING COVERING
+INDEX" is the answer you want, "SEARCH f USING INDEX faces_image" on a wide
+table means every probe opens a row.
+
+## Catalog writes: one transaction per user action
+
+`faces::confirm` opens a transaction. Calling it in a loop over a group is
+a commit per face; `faces::confirm_all` is two statements and one commit,
+`faces::reassign` one transaction for a whole split. When a UI action
+touches N rows, give the catalog a function that takes the N, not a loop
+that calls the one-row function N times — `unchecked_transaction` cannot
+nest, so this has to be designed in at the catalog layer, not wrapped
+from above.
+
+## Screens: keep what is already decoded
+
+`identity::load_faces` takes the crops the grid is currently showing and
+hands them back into the new cells. Before that, a click re-read 4 MB of
+crop blobs and decoded 700 JPEGs to produce the pixels already on screen.
+When a redraw replaces a model, the expensive parts of the old model — a
+decoded image, a cut portrait — are the first thing to reuse; only the row
+that changed needs new work. Drain the old cells rather than cloning them.
+
+## Remote calls: one round trip per file, not one per ancestor
+
+`NextcloudBackend::move_to` guaranteed its destination's parent with a
+`MKCOL` per ancestor from the account root, on every file of a batch —
+three `405`s before each `MOVE`. The backend now remembers the collections
+it has confirmed (`known_dirs`) for its lifetime, which is one job. When a
+per-file operation has a per-batch precondition, satisfy it once.
+
+## Providers: read the runtime's source for the version on disk, not the binding
+
+Two things the MIGraphX rung (2026-09-20) got wrong before it was measured
+right, both because `ort`'s builder was trusted to mean what its method
+names say.
+
+**A binding's option builder may fill a struct the runtime no longer
+reads.** `ep::MIGraphX::with_save_model` sets fields of the legacy
+`OrtMIGraphXProviderOptions`; ONNX Runtime 1.29 reads that struct for the
+precision flags and ignores the rest, so every session compiled for 40 s
+and the cache directory went nowhere. The option that works
+(`migraphx_model_cache_dir`) exists only in the generic key/value
+registration, which `session::migraphx` calls on the API table directly.
+Before wiring a provider option, fetch the provider's source at the
+runtime's exact version and find where the option is *read*.
+
+**A provider's cache key may leave out what you are varying.** MIGraphX
+keys a compiled program on graph, GPU and its own version — not precision.
+The first fp16 measurement built in 0.3 s and matched f32 to the tenth of a
+millisecond, because it had loaded the f32 program. A "from cache" build
+that is suspiciously fast on the first run of a new configuration is a key
+collision, not a fast provider; give each precision its own directory (the
+engine does) and check the cache directory gained a file.
+
+## Measuring
+
+`cargo run --release -p dr-ui --example identity_bench -- CATALOG THUMBS`
+times what one click on the Identity screen reads and what the batch
+operations write. Run it against a **copy** of a real catalog (it writes),
+never the library's own file; `sqlite3 catalog.sqlite ".backup copy.sqlite"`
+takes a consistent one while the app runs. Compare the `cpu` column when
+other builds are running on the machine — the wall clock doubles under
+load, the CPU figure does not. Keep the binary from before the change and
+run both back to back rather than trusting numbers taken an hour apart.
+
+`cargo run --release -p dr-catalog --example catalog_bench -- CATALOG
+[FACES_DIR]` does the same for opening the catalog (the backfill step by
+step), the upload snapshot, a merge, and the face shard export and import;
+`persist_bench`, an ignored test in `dr-ui`'s scan module, replays a scan's
+`persist` and a sidecar pull (`DR_BENCH_CATALOG=copy.sqlite cargo test
+--release -p dr-ui --lib persist_bench -- --ignored --nocapture
+--test-threads=1`). Both take copies; hand `catalog_bench` a copy of the
+face store directory too.
+
+Reference figures from the 2026-09-19 fixes, largest person (754 faces),
+24k images, 19k faces, before → after. What one click read: `load_people`
+22 ms → 12 ms, `load_faces` 316 ms → 2.4 ms, `audit` 190 ms → not run
+(66 ms when it is, on open and at the end of a sweep). What one click
+wrote: `confirm_all` 16 ms → 2 ms, `split_off` 23 ms → 4.5 ms. A click on
+the face grid went from ~530 ms of catalog work to ~15 ms.
@@ -1,6 +1,6 @@
 # Contributing to DarkRoom

-There is a lot of documentation here — 14 documents and 177 numbered
+There is a lot of documentation here — twenty-odd documents and 192 numbered
 requirements — and almost all of it is written for someone who has already
 decided to work on this. This file is the other thing: how to get a first
 change landed without reading any of it.
@@ -62,7 +62,7 @@ sudo apt-get install pkg-config libfontconfig1-dev libxkbcommon-dev
 cargo run -p darkroom-desktop
 ```

-The first build resolves 826 crates and takes a while — on a laptop, long
+The first build resolves some 850 crates and takes a while — on a laptop, long
 enough to look like a hang. It is not one.

 Android is a containerised toolchain and is not needed for most work; see
@@ -90,18 +90,18 @@ break it by accident:
 cargo run --release -p dr-bench -- check
 ```

-That is the benchmark suite (`docs/requirements.md` §8), which builds a
+That is the benchmark suite (`docs/dev/requirements.md` §8), which builds a
 synthetic 50,000-image catalog and fails the build if a performance target is
 missed or a measurement has drifted past its tolerance. It runs on every push in
-its own workflow. [`docs/benchmarks.md`](docs/benchmarks.md) says what it
+its own workflow. [`docs/dev/benchmarks.md`](docs/dev/benchmarks.md) says what it
 measures, what it deliberately does not, and how to read a failure. If you have
 touched the catalog, the decoder, the thumbnail store or the exporter, run it
 before you send.

 ## Requirements and traceability

-[`requirements.md`](docs/requirements.md) is the register of record.
-[`traceability.md`](docs/traceability.md) is generated from `TRACES:` tags in
+[`requirements.md`](docs/dev/requirements.md) is the register of record.
+[`traceability.md`](docs/dev/traceability.md) is generated from `TRACES:` tags in
 the source and must never be hand-edited:

 ```rust
@@ -124,15 +124,33 @@ Note that it tracks line numbers, so a change that only moves code still moves
 the matrix. Never regenerate it with a stale prebuilt binary.

 **One convention that the tooling cannot enforce.** A tag proves that a tag
-exists, not that the code under it does the thing — `docs/code-health.md`
+exists, not that the code under it does the thing — `docs/dev/code-health.md`
 CH-4 has the details, and two requirements currently read as covered on the
 strength of plumbing a future feature would use. So: **close a requirement
 with a test that would fail if the behaviour were removed.** Coverage that
 moves slowly and means something beats coverage that moves quickly.

-## Two invariants the build defends
+**Keys and gestures are held the same way.** A key handler in Slint compares
+one canonical chord, `Keys.chord(event) == "Ctrl+Z"`, under a `// KEYMAP:`
+comment naming its section of the gesture book, and every key it binds must be
+named by a `GESTURE:` block beside it. `cargo run -p traceability -- gestures`
+regenerates [`docs/gestures.md`](docs/gestures.md) and the in-app help sheet
+from those blocks; `-- gestures-check` fails when a handler binds a key no tag
+names, or a tag names a key no handler binds. A `manual:` field in a block
+links the gesture to a section of the manual, and a heading that is not there
+fails the scan.

-Worth knowing before you trip one, because both failures name a requirement
+**The manual is checked too.** `docs/manual/index.html` is rendered from
+`docs/manual/README.md` by `-- manual` and `-- manual-check` fails when they
+differ; `tools/manual/record.sh --check` fails when the manual shows a picture
+no scene in `tools/manual/scenes.py` makes. If you change what a pictured
+screen looks like, [`tools/manual`](tools/manual/README.md) says how to record
+it again. The pre-commit hook regenerates the matrix, the gesture book and the
+page; CI runs all three checks.
+
+## Three invariants the build defends
+
+Worth knowing before you trip one, because each failure names a requirement
 rather than a line:

 - **No operation may be named in `ui/`** (FR-DEV-3a). Special-casing one
@@ -144,6 +162,16 @@ rather than a line:
  `order:`, a filename disagreeing with its `id:`, a default outside its own
  range, an expression naming something that is not a parameter. Each error
  names the key you got wrong and exits rather than panicking.
+- **No verdict is written without a user action** (FR-CULL-13). A rating,
+  flag, colour label or trash membership is the photographer's to set, never a
+  signal's. `tools/traceability/src/verdicts.rs` finds every write of one in
+  the shipped code — the catalog setters, SQL that assigns those columns, the
+  sidecar's judgement amendment — and holds each to a reviewed list with its
+  reason: inside a Slint `on_*` callback, writing for callers that are checked
+  in turn, or carrying a verdict made elsewhere, such as a sidecar pull or the
+  sync merge. A new write fails `cargo test` (the `traceability` crate's tests,
+  part of the workspace run) until it is listed, and so does a listed one that
+  has gone; `cargo run -p traceability -- verdicts` prints the list.

 ## Commit messages

@@ -163,12 +191,12 @@ One commit per change. If you fixed two things, that is two commits.
 | Document | Read it when |
 |---|---|
 | [`core/dr-pipeline/ops/README.md`](core/dr-pipeline/ops/README.md) | Adding or changing a develop operation — start here regardless |
-| [`docs/architecture.md`](docs/architecture.md) | Anything touching the render path, catalog or sync |
-| [`docs/code-health.md`](docs/code-health.md) | Deciding what to work on; grades each seam by what it costs |
-| [`docs/benchmarks.md`](docs/benchmarks.md) | A change that could plausibly cost time or memory |
-| [`docs/technical-debt.md`](docs/technical-debt.md) | Something looks wrong — check it was not chosen |
-| [`docs/distribution.md`](docs/distribution.md) | Packaging a build, or adding a permission to one |
-| [`docs/requirements.md`](docs/requirements.md) | Reference, not reading |
+| [`docs/dev/architecture.md`](docs/dev/architecture.md) | Anything touching the render path, catalog or sync |
+| [`docs/dev/code-health.md`](docs/dev/code-health.md) | Deciding what to work on; grades each seam by what it costs |
+| [`docs/dev/benchmarks.md`](docs/dev/benchmarks.md) | A change that could plausibly cost time or memory |
+| [`docs/dev/technical-debt.md`](docs/dev/technical-debt.md) | Something looks wrong — check it was not chosen |
+| [`docs/dev/distribution.md`](docs/dev/distribution.md) | Packaging a build, or adding a permission to one |
+| [`docs/dev/requirements.md`](docs/dev/requirements.md) | Reference, not reading |

 `technical-debt.md` is the one to check before "fixing" anything surprising.
 It records compromises that were deliberate, each with the reasoning and a
@@ -347,6 +347,28 @@ dependencies = [
 "libloading",
 ]

+[[package]]
+name = "ashpd"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f3f79755c74fd155000314eb349864caa787c6592eace6c6882dad873d9c39"
+dependencies = [
+ "async-fs",
+ "async-net",
+ "enumflags2",
+ "futures-channel",
+ "futures-util",
+ "rand 0.9.5",
+ "raw-window-handle",
+ "serde",
+ "serde_repr",
+ "url",
+ "wayland-backend",
+ "wayland-client",
+ "wayland-protocols",
+ "zbus",
+]
+
 [[package]]
 name = "async-broadcast"
 version = "0.7.2"
@@ -385,6 +407,17 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "async-fs"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
+dependencies = [
+ "async-lock",
+ "blocking",
+ "futures-lite",
+]
+
 [[package]]
 name = "async-io"
 version = "2.6.0"
@@ -414,6 +447,17 @@ dependencies = [
 "pin-project-lite",
 ]

+[[package]]
+name = "async-net"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b948000fad4873c1c9339d60f2623323a0cfd3816e5181033c6a5cb68b2accf7"
+dependencies = [
+ "async-io",
+ "blocking",
+ "futures-lite",
+]
+
 [[package]]
 name = "async-process"
 version = "2.5.0"
@@ -1221,7 +1265,7 @@ checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"

 [[package]]
 name = "darkroom-android"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "android_logger",
 "dr-plat",
@@ -1234,13 +1278,14 @@ dependencies = [

 [[package]]
 name = "darkroom-desktop"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "anyhow",
 "dr-plat",
 "dr-ui",
 "env_logger",
 "log",
+ "winresource",
 ]

 [[package]]
@@ -1355,6 +1400,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
 "bitflags 2.13.1",
+ "block2 0.6.2",
+ "libc",
 "objc2 0.6.4",
 ]

@@ -1407,7 +1454,7 @@ checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"

 [[package]]
 name = "dr-bench"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "anyhow",
 "dr-catalog",
@@ -1424,7 +1471,7 @@ dependencies = [

 [[package]]
 name = "dr-catalog"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-face",
 "dr-plat",
@@ -1439,7 +1486,7 @@ dependencies = [

 [[package]]
 name = "dr-decode"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-types",
 "env_logger",
@@ -1453,7 +1500,7 @@ dependencies = [

 [[package]]
 name = "dr-export"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-decode",
 "dr-gpu",
@@ -1464,6 +1511,7 @@ dependencies = [
 "log",
 "png",
 "pollster",
+ "rawler",
 "thiserror 2.0.20",
 "tiff",
 "zune-jpeg 0.4.21",
@@ -1471,20 +1519,20 @@ dependencies = [

 [[package]]
 name = "dr-face"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
+ "dr-inference-engine",
 "env_logger",
 "log",
 "ndarray",
 "ort",
- "ort-tract",
 "thiserror 2.0.20",
 "zune-jpeg 0.4.21",
 ]

 [[package]]
 name = "dr-film"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "log",
 "serde",
@@ -1493,11 +1541,12 @@ dependencies = [

 [[package]]
 name = "dr-gpu"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "bytemuck",
 "dr-decode",
 "dr-film",
+ "dr-pano",
 "dr-pipeline",
 "dr-segment",
 "dr-types",
@@ -1508,9 +1557,24 @@ dependencies = [
 "wgpu",
 ]

+[[package]]
+name = "dr-inference-engine"
+version = "0.19.3"
+dependencies = [
+ "env_logger",
+ "libloading",
+ "log",
+ "ort",
+ "ort-sys",
+ "ort-tract",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "dr-ingest"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-plat",
 "dr-types",
@@ -1522,15 +1586,29 @@ dependencies = [

 [[package]]
 name = "dr-lens"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "lensfun",
 "log",
 ]

+[[package]]
+name = "dr-pano"
+version = "0.19.3"
+dependencies = [
+ "dr-decode",
+ "dr-inference-engine",
+ "dr-types",
+ "env_logger",
+ "log",
+ "ndarray",
+ "ort",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "dr-pipeline"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-types",
 "log",
@@ -1539,7 +1617,7 @@ dependencies = [

 [[package]]
 name = "dr-plat"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "android-native-keyring-store",
 "dr-types",
@@ -1555,7 +1633,7 @@ dependencies = [

 [[package]]
 name = "dr-preset-xmp"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-pipeline",
 "log",
@@ -1565,20 +1643,20 @@ dependencies = [

 [[package]]
 name = "dr-segment"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
+ "dr-inference-engine",
 "env_logger",
 "log",
 "ndarray",
 "ort",
- "ort-tract",
 "thiserror 2.0.20",
 "zune-jpeg 0.4.21",
 ]

 [[package]]
 name = "dr-sync"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "async-trait",
 "dr-plat",
@@ -1592,7 +1670,7 @@ dependencies = [

 [[package]]
 name = "dr-sync-folder"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "async-trait",
 "dr-sync",
@@ -1604,7 +1682,7 @@ dependencies = [

 [[package]]
 name = "dr-sync-nextcloud"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "async-trait",
 "dr-decode",
@@ -1626,7 +1704,7 @@ dependencies = [

 [[package]]
 name = "dr-thumbs"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-types",
 "jpeg-encoder",
@@ -1638,7 +1716,7 @@ dependencies = [

 [[package]]
 name = "dr-types"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "serde",
 "serde_json",
@@ -1647,7 +1725,7 @@ dependencies = [

 [[package]]
 name = "dr-ui"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -1657,8 +1735,10 @@ dependencies = [
 "dr-face",
 "dr-film",
 "dr-gpu",
+ "dr-inference-engine",
 "dr-ingest",
 "dr-lens",
+ "dr-pano",
 "dr-pipeline",
 "dr-plat",
 "dr-preset-xmp",
@@ -1668,25 +1748,32 @@ dependencies = [
 "dr-sync-nextcloud",
 "dr-thumbs",
 "dr-types",
+ "dr-xmp",
 "env_logger",
+ "i-slint-backend-testing",
 "jni 0.22.4",
 "log",
 "ndk-context",
+ "png",
 "pollster",
+ "raw-window-handle",
 "reqwest",
+ "rfd",
 "rusqlite",
 "serde_json",
 "serde_norway",
+ "sha2",
 "slint",
 "slint-build",
 "thiserror 2.0.20",
 "tokio",
+ "url",
 "wgpu",
 ]

 [[package]]
 name = "dr-xmp"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "dr-types",
 "log",
@@ -2744,6 +2831,18 @@ dependencies = [
 "i-slint-renderer-skia",
 ]

+[[package]]
+name = "i-slint-backend-testing"
+version = "1.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521e901e3d47ab829c0ef500c63155776208707cd93259e6a7803ed627fa2786"
+dependencies = [
+ "cfg_aliases",
+ "i-slint-common",
+ "i-slint-core",
+ "vtable",
+]
+
 [[package]]
 name = "i-slint-backend-winit"
 version = "1.17.1"
@@ -2924,8 +3023,6 @@ dependencies = [
 [[package]]
 name = "i-slint-renderer-skia"
 version = "1.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b6eed7f3f0a9a3d3ca6e8b9d4ca233371d989351fdb2a7ab88ec368b99e7b57"
 dependencies = [
 "ash",
 "bytemuck",
@@ -5416,8 +5513,6 @@ dependencies = [
 [[package]]
 name = "rawler"
 version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f4cc35c23969a4a834e0b117c7da41ace812eb9053b5effc3fc5c77d114677"
 dependencies = [
 "backtrace",
 "bitstream-io",
@@ -5619,6 +5714,30 @@ dependencies = [
 "zune-jpeg 0.5.15",
 ]

+[[package]]
+name = "rfd"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a15ad77d9e70a92437d8f74c35d99b4e4691128df018833e99f90bcd36152672"
+dependencies = [
+ "ashpd",
+ "block2 0.6.2",
+ "dispatch2",
+ "js-sys",
+ "log",
+ "objc2 0.6.4",
+ "objc2-app-kit 0.3.2",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "pollster",
+ "raw-window-handle",
+ "urlencoding",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "windows-sys 0.60.2",
+]
+
 [[package]]
 name = "rgb"
 version = "0.8.53"
@@ -6237,6 +6356,7 @@ dependencies = [
 "num-traits",
 "once_cell",
 "pin-weak",
+ "raw-window-handle",
 "slint-macros",
 "unicode-segmentation",
 "vtable",
@@ -6987,11 +7107,14 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"

 [[package]]
 name = "traceability"
-version = "0.11.0"
+version = "0.19.3"
 dependencies = [
 "anyhow",
+ "proc-macro2",
+ "pulldown-cmark",
 "serde",
 "serde_json",
+ "syn 2.0.119",
 ]

 [[package]]
@@ -7397,8 +7520,15 @@ dependencies = [
 "idna",
 "percent-encoding",
 "serde",
+ "serde_derive",
 ]

+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
 [[package]]
 name = "usvg"
 version = "0.47.0"
@@ -7887,8 +8017,6 @@ dependencies = [
 [[package]]
 name = "wgpu-hal"
 version = "29.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97ace1c17727311c22a46e4e3faf56ea6de81af99dcc839bdfb54857b94d448d"
 dependencies = [
 "android_system_properties",
 "arrayvec",
@@ -8121,6 +8249,15 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

+[[package]]
+name = "windows-sys"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
+dependencies = [
+ "windows-targets 0.53.5",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -8169,13 +8306,30 @@ dependencies = [
 "windows_aarch64_gnullvm 0.52.6",
 "windows_aarch64_msvc 0.52.6",
 "windows_i686_gnu 0.52.6",
- "windows_i686_gnullvm",
+ "windows_i686_gnullvm 0.52.6",
 "windows_i686_msvc 0.52.6",
 "windows_x86_64_gnu 0.52.6",
 "windows_x86_64_gnullvm 0.52.6",
 "windows_x86_64_msvc 0.52.6",
 ]

+[[package]]
+name = "windows-targets"
+version = "0.53.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4945f9f551b88e0d65f3db0bc25c33b8acea4d9e41163edf90dcd0b19f9069f3"
+dependencies = [
+ "windows-link",
+ "windows_aarch64_gnullvm 0.53.1",
+ "windows_aarch64_msvc 0.53.1",
+ "windows_i686_gnu 0.53.1",
+ "windows_i686_gnullvm 0.53.1",
+ "windows_i686_msvc 0.53.1",
+ "windows_x86_64_gnu 0.53.1",
+ "windows_x86_64_gnullvm 0.53.1",
+ "windows_x86_64_msvc 0.53.1",
+]
+
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
@@ -8203,6 +8357,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.42.2"
@@ -8221,6 +8381,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.42.2"
@@ -8239,12 +8405,24 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"

+[[package]]
+name = "windows_i686_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "960e6da069d81e09becb0ca57a65220ddff016ff2d6af6a223cf372a506593a3"
+
 [[package]]
 name = "windows_i686_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.42.2"
@@ -8263,6 +8441,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

+[[package]]
+name = "windows_i686_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.42.2"
@@ -8281,6 +8465,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.42.2"
@@ -8299,6 +8489,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.42.2"
@@ -8317,6 +8513,12 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
+
 [[package]]
 name = "winit"
 version = "0.30.13"
@@ -8387,6 +8589,16 @@ dependencies = [
 "memchr",
 ]

+[[package]]
+name = "winresource"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+dependencies = [
+ "toml 1.1.4+spec-1.1.0",
+ "version_check",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -8772,6 +8984,7 @@ dependencies = [
 "endi",
 "enumflags2",
 "serde",
+ "url",
 "winnow 1.0.4",
 "zvariant_derive",
 "zvariant_utils",
@@ -8,9 +8,11 @@ members = [
    "core/dr-export",
    "core/dr-face",
    "core/dr-film",
+    "core/dr-inference-engine",
    "core/dr-ingest",
    "core/dr-gpu",
    "core/dr-lens",
+    "core/dr-pano",
    "core/dr-pipeline",
    "core/dr-preset-xmp",
    "core/dr-segment",
@@ -25,9 +27,12 @@ members = [
    "tools/bench",
    "tools/traceability",
 ]
+# Patched copies of upstream crates, not our code: see third_party/README.md.
+# Excluded so `--workspace` does not test, lint or format them as ours.
+exclude = ["third_party"]

 [workspace.package]
-version = "0.11.0"
+version = "0.19.3"
 edition = "2021"
 rust-version = "1.92"
 license = "GPL-3.0-or-later"
@@ -45,9 +50,14 @@ dr-export = { path = "core/dr-export" }
 # `features = ["inference"]`.
 dr-face = { path = "core/dr-face", default-features = false }
 dr-film = { path = "core/dr-film" }
+# `tract` on by default so a test binary can open a session with nothing
+# installed; the apps add `native` to look for a runtime file (docs/dev/inference.md §3).
+dr-inference-engine = { path = "core/dr-inference-engine" }
 dr-ingest = { path = "core/dr-ingest" }
 dr-gpu = { path = "core/dr-gpu" }
 dr-lens = { path = "core/dr-lens" }
+# Optional runtime, like `dr-segment`: the geometry never needs a model.
+dr-pano = { path = "core/dr-pano", default-features = false }
 dr-pipeline = { path = "core/dr-pipeline" }
 dr-preset-xmp = { path = "core/dr-preset-xmp" }
 # `default-features = false` belongs *here*, not on each dependant: a member
@@ -120,6 +130,16 @@ url = "2.5"
 async-trait = "0.1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# The manual's HTML rendering (tools/traceability). Already in the tree as
+# Slint's Markdown parser, so this adds a dependency edge and no crate; only
+# the HTML writer is needed, not the command-line front end.
+pulldown-cmark = { version = "0.13", default-features = false, features = ["html"] }
+# The verdict-writer check (tools/traceability, FR-CULL-13) reads Rust as Rust:
+# a text scan cannot tell a call from a comment, a test module from shipped
+# code, or which callback closure a call sits in. Both already in the tree as
+# every proc macro's parser; `span-locations` gives a problem its line.
+syn = { version = "2", default-features = false, features = ["full", "parsing", "visit", "printing"] }
+proc-macro2 = { version = "1", default-features = false, features = ["span-locations"] }
 base64 = "0.23"

 # Display-server clients, for FR-DSP-8's per-display profile acquisition.
@@ -255,3 +275,14 @@ opt-level = 0
 [profile.release]
 lto = "thin"
 codegen-units = 1
+
+# Three upstream crates carry a local patch: wgpu-hal and Slint's Skia
+# renderer so that the Android build can draw with wgpu on a rotated display
+# (technical-debt.md TD-1), and rawler so that a linear DNG wider than 16 700
+# pixels decodes. Each is an exact copy of the version the lockfile already
+# resolves, plus its patch; third_party/README.md says what was changed and
+# how to carry it forward when Slint, wgpu or rawler moves.
+[patch.crates-io]
+wgpu-hal = { path = "third_party/wgpu-hal-29.0.4" }
+i-slint-renderer-skia = { path = "third_party/i-slint-renderer-skia-1.17.1" }
+rawler = { path = "third_party/rawler-0.7.2" }
@@ -0,0 +1,232 @@
+GNU GENERAL PUBLIC LICENSE
+Version 3, 29 June 2007
+
+Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+Preamble
+
+The GNU General Public License is a free, copyleft license for software and other kinds of works.
+
+The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
+
+For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
+
+Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
+
+Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+TERMS AND CONDITIONS
+
+0. Definitions.
+
+“This License” refers to version 3 of the GNU General Public License.
+
+“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
+
+“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
+
+To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
+
+A “covered work” means either the unmodified Program or a work based on the Program.
+
+To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
+
+To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
+
+A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
+
+The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
+
+The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same work.
+
+2. Basic Permissions.
+All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
+
+     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
+
+     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
+
+     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
+
+     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
+
+     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
+
+     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
+
+     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
+
+     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
+
+     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
+
+A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
+
+“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
+
+7. Additional Terms.
+“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
+
+     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
+
+     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
+
+     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
+
+     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
+
+     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
+
+     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
+
+8. Termination.
+You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
+
+An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
+
+11. Patents.
+A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
+
+A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
+
+In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
+
+A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
+
+13. Use with the GNU Affero General Public License.
+Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
+
+14. Revised Versions of this License.
+The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
+
+15. Disclaimer of Warranty.
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
+
+     <one line to give the program's name and a brief idea of what it does.>
+     Copyright (C) <year>  <name of author>
+
+     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+
+     <program>  Copyright (C) <year>  <name of author>
+     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+
+You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.
@@ -1,84 +1,254 @@
 # DarkRoom

-A cross-platform, non-destructive RAW photo editor for Linux and Android.
+A non-destructive RAW photo editor and library for Linux and Android, with a
+GPU develop pipeline, a catalog that syncs between devices, and no account,
+no telemetry and no cloud of its own.

-**Status:** 0.9.0, and no longer a spike. A library opens, culls, develops and
-exports on both platforms, across eight tagged releases. What is *not*
-built is written down rather than merely absent — see
-[docs/outstanding.md](docs/outstanding.md) for the requirements that have no
-implementation and why, and [docs/technical-debt.md](docs/technical-debt.md)
-for the compromises that were chosen.
+[![The library: seventy frames, the timeline beside them, the filter bar above](docs/manual/media/library.png)](docs/manual/README.md)
+
+**[The manual](docs/manual/README.md)** shows every feature, pictured from
+the application itself. This page says what it is, how to get it, and what
+is still missing.
+
+## What it does
+
+**A library.** Point it at a folder — on this machine, on a network mount,
+or one a Nextcloud client keeps in virtual-files mode, where a placeholder
+is treated as the photograph rather than as a one-byte file — or at a
+Nextcloud account directly; a photograph that is only on the server opens on
+its thumbnail with the download's progress over it. The grid is virtualised,
+ordered by capture time with a timeline beside it, and filtered by rating,
+flag, colour label, person and whether the file is here. Ratings, colour
+labels, keywords, collections and a trash that survives a crash
+mid-operation. Card ingest. Bursts fold. The same RAW catalogued twice — a
+dated folder and a backup beside it — is found, proved the same, and folded
+onto one copy with the spares in the trash. Face detection and identity,
+with the index syncing between devices.
+
+**Developing.** Nineteen declared operations, those that read one pixel
+fused into a generated shader rather than run a pass each, plus the
+neighbourhood work that cannot be: clarity, texture, dehaze, capture
+sharpening, noise reduction, lens correction. Every edit works on the scene
+as the camera recorded it — linear, highlights beyond white included — and
+one `Tone Mapping` step, last, after sharpening and noise reduction, fits it
+to the screen, with a contrast and a white point of its own; a spectral film
+stock takes its place when one is chosen. Crop, straighten and correct
+converging verticals, spot repair, and local adjustments over masks the
+model draws — click a subject or a category, then paint, subtract a gradient
+or keep only where two selections agree, grow or shrink the edge. A mask's
+sliders add to the photograph's, the film's among them, so a sky can be
+burned in on the print as a darkroom printer would. Hot and dead photosites
+are mended before the demosaic, with nothing to set. Focus peaking and a raw
+histogram for judging what is recoverable. Presets, a click away in a menu
+at the foot of the tool rail, with a collection shipped in the application —
+everyday corrections, and a look for each measured colour, cinema and
+black-and-white stock — and Lightroom presets imported as looks that leave a
+photograph's own corrections alone. XMP sidecars other editors read. A
+linear DNG larger than one GPU texture — a stitched panorama twenty thousand
+pixels wide — opens, develops and exports at full size.
+
+[![Segmenting an urban scene and choosing the sky as a mask](docs/manual/media/local-segment.png)](docs/manual/README.md#local-adjustments)
+
+**Panoramas.** Select the frames, align, untick any frame to leave it out
+and the rest re-align at once, choose a projection, fill the ragged border
+rather than crop it, and the composite lands beside its sources as a DNG,
+with a sidecar recording what it was merged from.
+
+[![Twelve hand-held frames aligned on a cylinder](docs/manual/media/panorama-aligned.png)](docs/manual/README.md#merging-a-panorama)
+
+**From the keyboard, and with its manual.** Rating, flagging and labelling
+have keys in the grid and in develop, as do zoom, undo and stepping through a
+shoot in develop, and none of them is keyboard-only. The help sheet (`F1`, or
+`?` in develop) lists every key and gesture, generated from the code that
+binds it, and links them to the sections of the manual that show them — the
+manual ships with the application and opens offline.
+
+**Export.** JPEG, PNG, AVIF, JPEG XL, 8- and 16-bit TIFF, with resize, output
+sharpening, a naming template and a colour space — into albums: named export
+folders on this machine or on the server, never inside the library, which
+remember the photograph behind each file and sync between devices as
+collections do.
+
+**On both platforms.** The same core runs on a desktop and a 12-inch
+tablet; the interface is one layout, tuned for a wide viewport with touch
+targets throughout. On both, the develop view draws the compute pass's
+texture directly — no readback between the GPU and the screen.
+
+## Getting it
+
+| Platform | How | State |
+|---|---|---|
+| Arch Linux | [`packaging/PKGBUILD`](packaging/PKGBUILD) — `makepkg -si` | Built from every release |
+| Android | The APK from each CI run, or `./docker/android/package.sh --install` | Runs on a tablet; F-Droid not yet submitted |
+| Windows | `DarkRoom-<version>-x86_64-setup.exe`, cross-built by CI ([windows.md](docs/dev/windows.md)) | Verified under Wine only; unsigned |
+| Flatpak | [`packaging/flatpak/`](packaging/flatpak/) | Manifest in tree; folders are chosen through the portal, but no Flatpak has been built to prove it |
+
+## Building from source
+
+**Before anything.** Git LFS holds the model weights and the manual's
+pictures; a clone without it has ~130-byte pointers in their place, and every
+packager below refuses to ship one. The Rust toolchain pins itself to 1.92.0
+through `rust-toolchain.toml`, so rustup is all you install. Slint needs a few
+system headers, and the app needs a Vulkan driver at runtime:
+
+```bash
+git clone https://gitea.tourolle.paris/dtourolle/DarkRoom.git && cd DarkRoom
+git lfs install && git lfs pull
+
+# Debian / Ubuntu
+sudo apt-get install pkg-config libfontconfig1-dev libxkbcommon-dev libvulkan1
+# Arch
+sudo pacman -S --needed pkgconf fontconfig libxkbcommon vulkan-icd-loader
+```
+
+**To try it** from the checkout, without installing anything:
+
+```bash
+cargo run --release -p darkroom-desktop
+```
+
+This is for development. The binary under `target/` finds no face, scene or
+panorama-fill models, and a release build does not find the manual either:
+it looks for all of them in the system data directories an install creates
+(`$XDG_DATA_DIRS/darkroom`, by default `/usr/local/share/darkroom` and
+`/usr/share/darkroom`), never in the checkout. Those features show as
+unavailable until it is installed.
+
+### Linux: build and install
+
+**On Arch**, build a package from the checkout and install it with pacman,
+so it can be upgraded and removed like any other:
+
+```bash
+cd packaging && makepkg -si
+```
+
+**Elsewhere**, build the release binary and install it under `/usr/local`
+by hand. These are the same files, in the same places, as the Arch package
+([`packaging/PKGBUILD`](packaging/PKGBUILD)'s `package()` is the reference):
+
+```bash
+cargo build --release --locked -p darkroom-desktop
+# -> target/release/darkroom-desktop
+
+P=/usr/local
+sudo install -Dm755 target/release/darkroom-desktop $P/bin/darkroom-desktop
+
+# The models: faces and eye state, scene categories, panorama border fill
+sudo install -d $P/share/darkroom/models
+sudo install -m644 models/face/*.onnx models/scene/* models/inpaint/*.onnx \
+    $P/share/darkroom/models/
+
+# The offline manual the Help menu opens
+sudo install -Dm644 docs/manual/index.html $P/share/darkroom/manual/index.html
+sudo install -Dm644 -t $P/share/darkroom/manual/media docs/manual/media/*
+
+# Launcher entry, icon and software-centre description
+sudo install -Dm644 packaging/paris.tourolle.darkroom.desktop \
+    $P/share/applications/paris.tourolle.darkroom.desktop
+sudo install -Dm644 ui/dr-ui/ui/app-icon.png \
+    $P/share/icons/hicolor/256x256/apps/paris.tourolle.darkroom.png
+sudo install -Dm644 packaging/paris.tourolle.darkroom.metainfo.xml \
+    $P/share/metainfo/paris.tourolle.darkroom.metainfo.xml
+```
+
+Then run `darkroom-desktop`, or open it from the application menu. To
+uninstall, remove those files and `/usr/local/share/darkroom`. Your catalog,
+settings and thumbnails live in `darkroom/` under your own XDG data, config
+and cache directories (`~/.local/share`, `~/.config`, `~/.cache`) and are
+not touched by either.
+
+Optional at runtime: `gnome-keyring` or `kwallet` to remember Nextcloud
+credentials, and an ONNX Runtime in `/usr/lib` (CPU, or ROCm on an AMD GPU) to
+run the models on every core rather than on the built-in engine.
+
+### Windows: build the installer
+
+The `.exe` is cross-built from Linux in a container (podman or docker), with
+no Windows machine involved. Two steps — the executable, then the NSIS
+installer that carries it with its models and manual:
+
+```bash
+./docker/windows/build.sh cargo build --release --target x86_64-pc-windows-gnu -p darkroom-desktop
+./docker/windows/build.sh docker/windows/package.sh
+```
+
+Both land in the container's cache on the host, `~/.cache/darkroom-windows/target/`:
+the bare executable under `x86_64-pc-windows-gnu/release/darkroom-desktop.exe`,
+the installer under `installer/DarkRoom-<version>-x86_64-setup.exe`.
+Copy that to the Windows machine and run it — it installs per user, needs no
+administrator rights, and adds an uninstaller. Run on its own, the bare
+`.exe` looks for `models\` and `manual\` beside itself, so use the installer.
+[docker/windows](docker/windows/README.md) has the details.
+
+### Android: build the APK
+
+Also containerised ([docker/android](docker/android/README.md)). This
+builds, packages and debug-signs the APK, and with `--install` puts it on a
+device connected over adb:
+
+```bash
+./docker/android/package.sh --install
+```
+
+A debug-signed APK cannot replace one installed from a release; uninstall
+that first.
+
+[CONTRIBUTING.md](CONTRIBUTING.md) has the four
+commands CI runs against what you send, and the shortest useful
+contribution — a develop operation is one YAML file, and it arrives with its
+controls, its place in the chain and its tests.
+
+## Where it stands
+
+**0.19.3**, thirty-two tagged releases in. 193 numbered requirements in
+scope, 85% of them claimed by code and [traced to it](docs/dev/traceability.md);
+the rest are written down rather than merely absent.
+
+**Not built:** plugins (post-v1, [D12](docs/dev/requirements.md)), compare and
+survey culling, AI denoise, tiled rendering beyond the export of an oversized
+DNG, HDR merge and focus stacking, importing a Lightroom or darktable catalog,
+translations beyond the launch screen, most of the Android platform
+integration beyond running, and a Flatpak actually built and run in its
+sandbox. The performance targets are half verified: the per-commit benchmark
+suite §8 requires exists for everything that does not need a frame — the
+catalog, the scan, the thumbnails — and not yet for the render path, so a
+regression there fails nothing.
+[outstanding.md](docs/dev/outstanding.md) is the list, with the reasoning for
+each.

 ## Documentation

-| Document | Contents |
+[docs/README.md](docs/README.md) is the index. The short version, for someone using it:
+
+| | |
+|---|---|
+| [manual](docs/manual/README.md) | Every feature, pictured |
+| [gestures.md](docs/gestures.md) | How it is driven — generated from the code, so it cannot describe a gesture that does not exist |
+
+For someone changing it:
+
+| | |
 |---|---|
 | [CONTRIBUTING.md](CONTRIBUTING.md) | How to land a first change without reading the rest |
-| [requirements.md](docs/requirements.md) | What the software must do — 179 numbered requirements |
-| [architecture.md](docs/architecture.md) | How it is built — crates, GPU pipeline, data model, sync |
-| [technical-debt.md](docs/technical-debt.md) | Compromises taken deliberately, each with the condition that retires it |
-| [outstanding.md](docs/outstanding.md) | What is not built, and whether that is a decision or a gap |
-| [code-health.md](docs/code-health.md) | What a contribution costs, per seam, measured |
-| [traceability.md](docs/traceability.md) | Generated: which requirement is claimed by which file |
-| [faces.md](docs/faces.md) | Face detection and identity — the models, the licence problem, and what S14 measured |
+| [requirements.md](docs/dev/requirements.md) | What the software must do — the numbered register, and the decisions |
+| [architecture.md](docs/dev/architecture.md) | How it is built — crates, the GPU pipeline, the data model, sync |
+| [technical-debt.md](docs/dev/technical-debt.md) | Compromises taken deliberately, each with the condition that retires it |
+| [outstanding.md](docs/dev/outstanding.md) | What is not built, and whether that is a decision or a gap |
+| [code-health.md](docs/dev/code-health.md) | What a contribution costs, per seam, measured |
+| [traceability.md](docs/dev/traceability.md) | Generated: which requirement is claimed by which file |

-## Building
-
-Desktop:
-
-```bash
-cargo run -p darkroom-desktop
-```
-
-Android (containerised toolchain, see [docker/android](docker/android/README.md)):
-
-```bash
-./docker/android/build.sh cargo ndk -t arm64-v8a build --release
-```
-
-Git LFS is required for the model weights, and the toolchain pins itself.
-[CONTRIBUTING.md](CONTRIBUTING.md) has the details and the four commands CI
-will run against what you send.
-
-## Current state
-
-**Working.** A catalog over a local folder, a Nextcloud account, or a folder a
-sync client keeps in virtual-files mode — where a placeholder is treated as the
-photograph rather than as a one-byte file. A virtualised library grid with a
-capture-time timeline, ratings, labels, keywords, collections and a trash that
-survives a crash mid-operation. Card ingest. Face detection and identity, with
-the index syncing between devices. A develop pipeline of fifteen declared
-operations fused into a single compute dispatch, plus the neighbourhood
-operations that cannot be — clarity, texture, capture sharpening, noise
-reduction, lens correction, spectral film simulation. Crop, straighten, spot
-removal, gradient and subject-segmentation masks, named presets, and a
-generated panel that no operation in `ui/` is allowed to name. Export to JPEG,
-PNG and 8- or 16-bit TIFF with resize and output sharpening.
-
-**The zero-copy display path works on desktop.** The compute pass writes a
-texture that Slint composites directly, which is what
-[ARCH §6.1](docs/architecture.md) requires; the readback it forbids costs 96%
-of frame time at 4K, and
-
-```bash
-cargo run -p dr-gpu --example bench --features readback
-```
-
-still reproduces that measurement. **The one exception is the Android develop
-view**, which reads the frame back through the CPU because zero-copy there
-needs wgpu's Vulkan swapchain, and that tears a portrait window on a tablet
-whose panel is mounted landscape. It is debt, not a revision of the rule: the
-reasoning, the on-device measurements that forced it, and the three separate
-things any one of which would remove it are in
-[technical-debt.md TD-1](docs/technical-debt.md).
-
-**Not built.** Plugins, compare and survey culling, focus peaking, burst
-grouping, AI denoise, tiled and progressive rendering, and most of the Android
-platform integration beyond running. The performance targets in §4.1 are
-unverified rather than unmet — the per-commit benchmark suite §8 requires does
-not exist, so nothing fails a build on a regression.
-[docs/outstanding.md](docs/outstanding.md) is the list, with the reasoning.
+Designs, one per subsystem:
+[segmentation](docs/dev/segmentation.md) and [mask editing](docs/dev/mask-editing.md) ·
+[spot removal](docs/dev/spot-removal.md) · [panorama](docs/dev/panorama.md) ·
+[faces](docs/dev/faces.md) · [inference](docs/dev/inference.md) ·
+[storage and sync](docs/dev/storage.md) · [catalog](docs/dev/catalog.md) ·
+[display and extension](docs/dev/display-and-extension.md) ·
+[navigation](docs/dev/ui-navigation.md) · [distribution](docs/dev/distribution.md) ·
+[windows](docs/dev/windows.md) · [benchmarks](docs/dev/benchmarks.md).

 ## Licence

-GPL-3.0-or-later.
+GPL-3.0-or-later. The photographs in the manual and the test fixtures are
+the author's and are there to show and test this project, nothing else.
+The model weights carry their own licences — [models/LICENCE.md](models/LICENCE.md).
@@ -4,9 +4,10 @@

  Deliberately minimal: this packages the viewer for on-device testing (spike
  S2 needs Adreno and Mali hardware, which no emulator represents). Nothing
-  here is a distribution manifest yet. Only network access is declared: file
-  access needs no manifest permission because the library grid reads through
-  SAF, which grants per-tree at runtime (ARCH §6.9).
+  here is a distribution manifest yet. The library grid needs no storage
+  permission, because it reads through SAF, which grants per-tree at runtime
+  (ARCH §6.9); the one storage permission declared is for importing from a
+  camera card, which is read by path.

  Minimal is not the same as empty, and the entries below that are not the
  activity are the difference. A manifest is the only place a component can be
@@ -21,13 +22,29 @@
         WebDAV listing, thumbnail and image fetches. Without it Android refuses
         socket creation outright, and the failure is invisible — no panic to
         catch, no log line, just a worker thread that stops. Storage is the
-         separate case that genuinely needs no permission here, because SAF
-         grants per-tree at runtime (ARCH §6.9). -->
+         separate case: the library and album folders need no permission
+         here, because SAF grants per-tree at runtime (ARCH §6.9). -->
    <uses-permission android:name="android.permission.INTERNET" />
    <!-- Read before deciding whether a sync may run: FR-NC-6 gates background
         work on unmetered-and-charging, which means knowing the network type. -->
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />

+    <!-- FR-CAT-10: importing from a camera card. The importer reads the card
+         as files, and "all files access" is what makes an SD card or a USB
+         card reader readable by path on API 30 and up (see Cards.java). It is
+         granted on a system settings page, not a dialog; the import page
+         sends the user there when it is missing. READ_EXTERNAL_STORAGE is the
+         same thing for API 28 and 29, and means nothing above them; on 29 it
+         reads by path only with requestLegacyExternalStorage, which is why
+         <application> carries that flag.
+
+         Google Play limits MANAGE_EXTERNAL_STORAGE to a short list of app
+         kinds. DarkRoom is not distributed through Play. -->
+    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="29" />
+
    <!-- Vulkan 1.1 is what wgpu needs; the API 28 floor is where support is
         dependable (NFR-COMPAT-1). Marked required so an unsupported device
         fails at install rather than at first frame. -->
@@ -53,6 +70,7 @@
        android:icon="@mipmap/ic_launcher"
        android:hasCode="true"
        android:allowBackup="false"
+        android:requestLegacyExternalStorage="true"
        android:supportsRtl="true">

        <!-- NativeActivity rather than a Kotlin Activity: android-activity's
@@ -141,6 +159,35 @@
            </intent-filter>
        </activity>

+        <!-- The manual (dr_ui::manual): a WebView over the copy the APK
+             carries in assets/manual. See ManualActivity.java for why it is
+             not the browser.
+
+             Not exported: nothing outside this app has a reason to start it,
+             and dr_ui starts it by class name, which needs no intent filter.
+             Its own task entry is not wanted either — it is a page over the
+             app, and Back returns to the photograph it was opened from.
+             configChanges so a rotation reflows the page rather than
+             reloading it at the top. -->
+        <activity
+            android:name="paris.tourolle.darkroom.ManualActivity"
+            android:exported="false"
+            android:label="DarkRoom manual"
+            android:theme="@style/ManualTheme"
+            android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|uiMode" />
+
+        <!-- FR-EXP-10: the system's folder picker, for an album's folder on
+             this device. NativeActivity's onActivityResult is not ours, so
+             this activity exists only to ask and hand the answer back (see
+             FolderPicker.java). Translucent and without a title so nothing
+             of it shows but the system chooser; not exported, and started by
+             class name from dr_ui::saf. -->
+        <activity
+            android:name="paris.tourolle.darkroom.FolderPicker"
+            android:exported="false"
+            android:theme="@android:style/Theme.Translucent.NoTitleBar"
+            android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|uiMode" />
+
        <!-- FR-PLAT-AND-6, outbound. Android has refused file:// URIs
             between apps since API 24 — handing one out raises
             FileUriExposedException in *this* process — so an exported JPEG
@@ -0,0 +1,150 @@
+package paris.tourolle.darkroom;
+
+import android.Manifest;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Environment;
+import android.os.storage.StorageManager;
+import android.os.storage.StorageVolume;
+import android.provider.Settings;
+import android.util.Log;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Finding a camera card, and the permission that makes it readable (FR-CAT-10).
+ *
+ * <p>An import reads the card as files: the survey walks it, the probe reads
+ * each header and the copy streams each original, all through the same
+ * {@code std::fs} code the desktop uses. Android hands out such paths —
+ * {@code /storage/9C33-6BBD/DCIM} — to an app holding "all files access"
+ * ({@code MANAGE_EXTERNAL_STORAGE}, API 30), which covers the root of an SD
+ * card and of a USB card reader. Below API 30 the same paths are readable
+ * with {@code READ_EXTERNAL_STORAGE}.
+ *
+ * <p>Not the folder picker {@link FolderPicker} uses for albums. A tree
+ * granted through SAF is {@code content://} URIs, not paths, and since API 30
+ * the picker refuses the root of a card outright; reading a card through it
+ * would mean a second storage implementation under the importer, where this
+ * needs none.
+ *
+ * <p>Google Play restricts this permission to file managers and the like.
+ * DarkRoom is not distributed through Play, so the restriction does not
+ * apply; it would need revisiting if that changed.
+ */
+public final class Cards {
+    private static final String TAG = "DarkRoom";
+
+    private Cards() {
+    }
+
+    /** Whether this app may read a card's files by path. */
+    public static boolean hasAccess(Context context) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            return Environment.isExternalStorageManager();
+        }
+        return context.checkSelfPermission(Manifest.permission.READ_EXTERNAL_STORAGE)
+                == PackageManager.PERMISSION_GRANTED;
+    }
+
+    /**
+     * Open the system page where the user grants it.
+     *
+     * <p>A settings page rather than a permission dialog because there is no
+     * dialog for this one on API 30 and up: the user flips "Allow access to
+     * manage all files" for this app. Below 30 the context is the application
+     * context, which cannot raise a runtime permission request (that needs an
+     * Activity's result), so the app's own settings page is the route there
+     * too. Either way the app learns of the grant by asking
+     * {@link #hasAccess} again.
+     */
+    public static void requestAccess(Context context) {
+        Uri self = Uri.parse("package:" + context.getPackageName());
+        Intent intent;
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            intent = new Intent(Settings.ACTION_MANAGE_APP_ALL_FILES_ACCESS_PERMISSION, self);
+        } else {
+            intent = new Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS, self);
+        }
+        // The context is not an Activity; see FolderPicker.start.
+        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        try {
+            context.startActivity(intent);
+        } catch (RuntimeException e) {
+            // Some builds ship without the per-app page; the list of every
+            // app holding the permission is the fallback that always exists.
+            Log.w(TAG, "no per-app all-files page; opening the list", e);
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                Intent list = new Intent(Settings.ACTION_MANAGE_ALL_FILES_ACCESS_PERMISSION);
+                list.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                context.startActivity(list);
+            }
+        }
+    }
+
+    /**
+     * Every mounted volume other than the device's own storage.
+     *
+     * <p>One string per volume, {@code path \t description \t removable},
+     * where removable is {@code 1} or {@code 0}: the reason {@link Intents}
+     * gives for keeping the JNI surface to strings. The primary volume is left
+     * out — it is the device's internal storage, never a card — and so is
+     * anything not mounted, which is a card being ejected or one the system
+     * could not read.
+     */
+    public static String[] volumes(Context context) {
+        List<String> out = new ArrayList<String>();
+        StorageManager manager = (StorageManager) context.getSystemService(Context.STORAGE_SERVICE);
+        if (manager == null) {
+            return new String[0];
+        }
+        for (StorageVolume volume : manager.getStorageVolumes()) {
+            if (volume.isPrimary()) {
+                continue;
+            }
+            String state = volume.getState();
+            if (!Environment.MEDIA_MOUNTED.equals(state)
+                    && !Environment.MEDIA_MOUNTED_READ_ONLY.equals(state)) {
+                continue;
+            }
+            String path = path(volume);
+            if (path == null) {
+                Log.w(TAG, "a mounted volume with no path: " + volume);
+                continue;
+            }
+            String description = volume.getDescription(context);
+            if (description == null) {
+                description = new File(path).getName();
+            }
+            out.add(path + "\t" + description.replace('\t', ' ') + "\t"
+                    + (volume.isRemovable() ? "1" : "0"));
+        }
+        return out.toArray(new String[0]);
+    }
+
+    /**
+     * Where the volume is mounted.
+     *
+     * <p>{@code getDirectory} is API 30. Below it the same answer is the
+     * hidden {@code getPath}, which every release from 24 to 29 has, reached by
+     * reflection because android.jar does not declare it.
+     */
+    private static String path(StorageVolume volume) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            File dir = volume.getDirectory();
+            return dir == null ? null : dir.getPath();
+        }
+        try {
+            Object path = StorageVolume.class.getMethod("getPath").invoke(volume);
+            return path == null ? null : path.toString();
+        } catch (ReflectiveOperationException e) {
+            Log.w(TAG, "StorageVolume.getPath", e);
+            return null;
+        }
+    }
+}
@@ -0,0 +1,117 @@
+package paris.tourolle.darkroom;
+
+import android.app.Activity;
+import android.content.ActivityNotFoundException;
+import android.content.Context;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+import android.util.Log;
+
+/**
+ * The system's folder picker, for an album's folder on this device (FR-EXP-10).
+ *
+ * <h2>Why an activity of its own</h2>
+ *
+ * <p>{@code ACTION_OPEN_DOCUMENT_TREE} answers through
+ * {@code onActivityResult}, and the main activity is {@code NativeActivity},
+ * whose result callback is not ours to override. So this one exists only to
+ * ask: it starts the picker, takes the answer, and finishes — no layout, a
+ * translucent theme, nothing on screen but the system's own chooser, which has
+ * its own "New folder".
+ *
+ * <p>The answer is left in a static for Rust to poll ({@link #poll}), rather
+ * than called back into native code: a callback would need a registered
+ * native method and a thread to deliver on, and a poll from the Slint timer
+ * that is already running is one static call.
+ *
+ * <h2>The grant</h2>
+ *
+ * <p>A tree URI is usable only while its permission is held, and a plain
+ * result grants it until the process dies. {@code takePersistableUriPermission}
+ * keeps it across restarts — an album's folder is chosen once and exported to
+ * for months.
+ */
+public final class FolderPicker extends Activity {
+    private static final String TAG = "DarkRoom";
+    private static final int REQUEST = 0x5AF;
+
+    /** The last answer: a tree URI, "" for a cancel, null while none has come. */
+    private static volatile String answer = null;
+
+    /**
+     * Start asking. Clears any answer left from before.
+     *
+     * <p>Takes a {@code Context} rather than an {@code Activity}, because what
+     * native code holds (ndk_context's handle) is the application context,
+     * and starting an activity from one that is not an activity needs
+     * {@code FLAG_ACTIVITY_NEW_TASK} — without it the call throws. The picker
+     * shares the app's task affinity, so it still opens over the app and Back
+     * still returns to it.
+     */
+    public static void start(Context from) {
+        answer = null;
+        Intent intent = new Intent(from, FolderPicker.class);
+        if (!(from instanceof Activity)) {
+            intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        }
+        from.startActivity(intent);
+    }
+
+    /**
+     * The answer, once: a tree URI, "" if the user backed out, or null while
+     * the picker is still open. Reading it clears it, so a second poll after a
+     * cancel does not see the cancel again.
+     */
+    public static String poll() {
+        String a = answer;
+        if (a != null) {
+            answer = null;
+        }
+        return a;
+    }
+
+    @Override
+    protected void onCreate(Bundle state) {
+        super.onCreate(state);
+        // Recreated after a rotation with the picker already up: asking again
+        // would stack a second chooser over the first.
+        if (state != null) {
+            return;
+        }
+        Intent pick = new Intent(Intent.ACTION_OPEN_DOCUMENT_TREE);
+        pick.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION
+                | Intent.FLAG_GRANT_WRITE_URI_PERMISSION
+                | Intent.FLAG_GRANT_PERSISTABLE_URI_PERMISSION);
+        try {
+            startActivityForResult(pick, REQUEST);
+        } catch (ActivityNotFoundException e) {
+            Log.w(TAG, "no folder picker on this device", e);
+            answer = "";
+            finish();
+        }
+    }
+
+    @Override
+    protected void onActivityResult(int request, int result, Intent data) {
+        if (request != REQUEST) {
+            return;
+        }
+        Uri tree = (result == RESULT_OK && data != null) ? data.getData() : null;
+        if (tree == null) {
+            answer = "";
+        } else {
+            try {
+                getContentResolver().takePersistableUriPermission(tree,
+                        Intent.FLAG_GRANT_READ_URI_PERMISSION
+                                | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
+            } catch (SecurityException e) {
+                // Still usable this session; said in the log so a folder that
+                // stops working after a restart has an explanation.
+                Log.w(TAG, "the folder grant could not be kept: " + tree, e);
+            }
+            answer = tree.toString();
+        }
+        finish();
+    }
+}
@@ -0,0 +1,105 @@
+package paris.tourolle.darkroom;
+
+import android.app.Activity;
+import android.content.ActivityNotFoundException;
+import android.content.Intent;
+import android.net.Uri;
+import android.os.Bundle;
+import android.webkit.WebResourceRequest;
+import android.webkit.WebSettings;
+import android.webkit.WebView;
+import android.webkit.WebViewClient;
+
+/**
+ * The manual that ships in the APK, shown in a WebView.
+ *
+ * <h2>Why an activity of our own rather than the browser</h2>
+ *
+ * <p>The desktop hands the manual to the system browser. Android leaves no
+ * way to do the same: the page is an asset inside the APK, which is not a
+ * file; an unpacked copy in app-private storage is a file no browser may
+ * read; a {@code file:} URI handed to another app is refused since API 24;
+ * and a {@code content:} URI serves the page but leaves the browser to fetch
+ * every picture by a relative URL against the provider, which browsers do not
+ * reliably do. A WebView reads {@code file:///android_asset/} straight from
+ * the APK, pictures and section anchor included, and nothing is unpacked.
+ *
+ * <h2>What it is not</h2>
+ *
+ * <p>A browser. JavaScript stays off (the page has none), and a link that
+ * leaves the manual — the design documents are on the forge — goes to the
+ * user's browser rather than opening inside this view, so the only thing ever
+ * shown here is the page the APK carries.
+ *
+ * <p>Started by {@code dr_ui::manual} with {@code Intent.setClassName}, so the
+ * name here and there must agree; a test in lib.rs checks the manifest
+ * declares it.
+ */
+public final class ManualActivity extends Activity {
+    /** The section to open at, a heading's anchor. Absent opens the top. */
+    public static final String EXTRA_ANCHOR = "anchor";
+
+    private static final String PAGE = "file:///android_asset/manual/index.html";
+
+    private WebView web;
+
+    @Override
+    protected void onCreate(Bundle saved) {
+        super.onCreate(saved);
+        setTitle("DarkRoom manual");
+
+        web = new WebView(this);
+        WebSettings settings = web.getSettings();
+        settings.setJavaScriptEnabled(false);
+        // Pinch to zoom into a screenshot, which is 1600 pixels wide and drawn
+        // at the width of a phone.
+        settings.setBuiltInZoomControls(true);
+        settings.setDisplayZoomControls(false);
+        web.setWebViewClient(new WebViewClient() {
+            @Override
+            public boolean shouldOverrideUrlLoading(WebView view, WebResourceRequest request) {
+                Uri uri = request.getUrl();
+                if ("file".equals(uri.getScheme())) {
+                    return false;
+                }
+                try {
+                    startActivity(new Intent(Intent.ACTION_VIEW, uri));
+                } catch (ActivityNotFoundException e) {
+                    // No browser on the device: the link does nothing, which
+                    // is all it could do.
+                }
+                return true;
+            }
+        });
+        setContentView(web);
+
+        if (saved != null) {
+            web.restoreState(saved);
+        } else {
+            String anchor = getIntent().getStringExtra(EXTRA_ANCHOR);
+            web.loadUrl(anchor == null || anchor.isEmpty() ? PAGE : PAGE + "#" + anchor);
+        }
+    }
+
+    @Override
+    protected void onSaveInstanceState(Bundle out) {
+        super.onSaveInstanceState(out);
+        web.saveState(out);
+    }
+
+    /** Back walks back through the sections visited, then leaves. */
+    @Override
+    public void onBackPressed() {
+        if (web.canGoBack()) {
+            web.goBack();
+        } else {
+            super.onBackPressed();
+        }
+    }
+
+    @Override
+    protected void onDestroy() {
+        web.destroy();
+        super.onDestroy();
+    }
+}
@@ -0,0 +1,114 @@
+package paris.tourolle.darkroom;
+
+import android.content.ContentResolver;
+import android.content.Context;
+import android.database.Cursor;
+import android.net.Uri;
+import android.provider.DocumentsContract;
+import android.util.Log;
+
+import java.io.IOException;
+import java.io.OutputStream;
+
+/**
+ * Writing an export into a folder the user granted through
+ * {@link FolderPicker} — the Storage Access Framework, which is the only way
+ * this app reaches a folder on the device (FR-PLAT-AND-1).
+ *
+ * <p>A tree URI is not a path: a child is found by listing the folder and
+ * matching its display name, and created through the provider, which may
+ * rename it on a collision. So the name that was actually written is handed
+ * back, and the album records that one.
+ *
+ * <p>Two static calls, strings and a byte array in, a string out, for the
+ * reason {@link Intents} gives: every call here would be a signature typed as
+ * a string on the Rust side, and the fewer of those the better.
+ */
+public final class Saf {
+    private static final String TAG = "DarkRoom";
+
+    private Saf() {
+    }
+
+    /** Whether {@code name} already exists in the folder. False on any error. */
+    public static boolean exists(Context context, String tree, String name) {
+        try {
+            return find(context.getContentResolver(), Uri.parse(tree), name) != null;
+        } catch (RuntimeException e) {
+            Log.w(TAG, "checking " + name + " in " + tree, e);
+            return false;
+        }
+    }
+
+    /**
+     * Write {@code bytes} as {@code name} in the folder, replacing a file of
+     * that name when {@code replace} is set.
+     *
+     * @return the name the file has in the folder — the provider may have
+     *         added " (1)" — or null on failure, with the reason in the log.
+     */
+    public static String write(Context context, String tree, String name, String mime,
+            byte[] bytes, boolean replace) {
+        ContentResolver resolver = context.getContentResolver();
+        Uri treeUri = Uri.parse(tree);
+        try {
+            Uri target = replace ? find(resolver, treeUri, name) : null;
+            if (target == null) {
+                Uri folder = DocumentsContract.buildDocumentUriUsingTree(treeUri,
+                        DocumentsContract.getTreeDocumentId(treeUri));
+                target = DocumentsContract.createDocument(resolver, folder, mime, name);
+            }
+            if (target == null) {
+                Log.w(TAG, "the folder refused to create " + name + " in " + tree);
+                return null;
+            }
+            // "wt": truncate. A replacement shorter than what it replaces
+            // must not keep the old file's tail.
+            try (OutputStream out = resolver.openOutputStream(target, "wt")) {
+                if (out == null) {
+                    Log.w(TAG, "no stream for " + target);
+                    return null;
+                }
+                out.write(bytes);
+            }
+            String written = displayName(resolver, target);
+            return written != null ? written : name;
+        } catch (IOException | RuntimeException e) {
+            Log.w(TAG, "writing " + name + " to " + tree, e);
+            return null;
+        }
+    }
+
+    /** The document for {@code name} directly in the tree's folder, or null. */
+    private static Uri find(ContentResolver resolver, Uri tree, String name) {
+        String folderId = DocumentsContract.getTreeDocumentId(tree);
+        Uri children = DocumentsContract.buildChildDocumentsUriUsingTree(tree, folderId);
+        String[] columns = {
+                DocumentsContract.Document.COLUMN_DOCUMENT_ID,
+                DocumentsContract.Document.COLUMN_DISPLAY_NAME,
+        };
+        try (Cursor c = resolver.query(children, columns, null, null, null)) {
+            if (c == null) {
+                return null;
+            }
+            while (c.moveToNext()) {
+                if (name.equals(c.getString(1))) {
+                    return DocumentsContract.buildDocumentUriUsingTree(tree, c.getString(0));
+                }
+            }
+        }
+        return null;
+    }
+
+    private static String displayName(ContentResolver resolver, Uri document) {
+        String[] columns = {DocumentsContract.Document.COLUMN_DISPLAY_NAME};
+        try (Cursor c = resolver.query(document, columns, null, null, null)) {
+            if (c != null && c.moveToFirst()) {
+                return c.getString(0);
+            }
+        } catch (RuntimeException e) {
+            Log.w(TAG, "reading the name of " + document, e);
+        }
+        return null;
+    }
+}
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Day or night as the system is; see values/themes.xml. -->
+<resources>
+    <style name="ManualTheme" parent="@android:style/Theme.DeviceDefault.DayNight" />
+</resources>
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  The manual's theme (ManualActivity). Light below API 29, which has no
+  day-night theme in the platform; values-v29 follows the system from there.
+  The WebView takes prefers-color-scheme from whether this theme is light, and
+  the manual's stylesheet takes its colours from that.
+-->
+<resources>
+    <style name="ManualTheme" parent="@android:style/Theme.DeviceDefault.Light" />
+</resources>
@@ -240,7 +240,7 @@ fn android_main(app: slint::android::AndroidApp) {
 ///
 /// **Face weights are absent from the repository by design.** The InsightFace
 /// grant is research-only and incompatible with this project's licence
-/// (docs/faces.md §2), so a desktop user fetches them, runs
+/// (docs/dev/faces.md §2), so a desktop user fetches them, runs
 /// `tools/fix-face-model-shapes.sh` over them, and drops the result in. A build
 /// that carries none is the ordinary case and face indexing simply stays off.
 ///
@@ -269,11 +269,13 @@ fn android_main(app: slint::android::AndroidApp) {
 /// thousand of them is an ANR by definition — the system puts "DarkRoom isn't
 /// responding" over a window that has never painted, and offers to kill it.
 ///
-/// This copies **41 MB** on the first launch after an install: 24.9 MB of scene
+/// This copied **41 MB** on the first launch after an install: 24.9 MB of scene
 /// model, 13.6 MB of embedder, 2.5 MB of detector, each read whole out of the
-/// APK and written to `/data`. v0.10.0 added the scene model, which is 60% of
+/// APK and written to `/data`. v0.10.0 added the scene model, which was 60% of
 /// that total; v0.10.0 is the release the ANR appeared in, and the 8,010 minor
 /// faults in its report are what 41 MB of freshly touched pages looks like.
+/// The two further detectors the settings page offers since have made it
+/// 61 MB, which is the same argument with a larger number.
 ///
 /// So it runs on a worker (NFR-ARCH-1: nothing blocking on the UI executor) and
 /// this function returns as soon as the thread is running. Nothing on the
@@ -298,7 +300,9 @@ fn install_bundled_models(app: slint::android::AndroidApp) {
    // on the worker because `AAssetManager` is thread-safe by contract and
    // reading the pointer takes only the app's read lock, which `poll_events`
    // also only ever holds shared.
-    std::thread::spawn(move || unpack_bundled_models(&app));
+    dr_ui::executors::spawn(dr_ui::executors::Executor::Io, "models", move || {
+        unpack_bundled_models(&app)
+    });
 }

 /// The copy itself, on the worker [`install_bundled_models`] starts.
@@ -317,15 +321,45 @@ fn unpack_bundled_models(app: &slint::android::AndroidApp) {
    // decodes to 150 anonymous channels — `library::scene_model` wants the
    // vocabulary and the category descriptor beside it, and requires all three
    // before it reports the tab available.
-    const BUNDLED: [(&std::ffi::CStr, &str); 5] = [
+    //
+    // Three detectors, because which one runs is a setting
+    // (`FaceDetector`, docs/dev/faces.md §12.3) and a tablet has no other way to
+    // obtain the one it was not shipped with. Twenty megabytes of APK for
+    // the choice; the embedder is the same for all three.
+    //
+    // Then the three eye-state models (docs/dev/faces.md §17): landmarks, open
+    // or closed, sunglasses. The app indexes without them; with them the
+    // eyes-open filter has something to read, and a tablet has no other way
+    // to get them either.
+    //
+    // The int8 forms beside the three detectors are what the Hexagon runs
+    // (docs/dev/inference.md §5); the engine loads the sibling when the probe
+    // chose that rung and ignores it otherwise.
+    const BUNDLED: [(&std::ffi::CStr, &str); 14] = [
        (c"models/scrfd_500m_640.onnx", "scrfd_500m_640.onnx"),
+        (
+            c"models/scrfd_500m_640.int8.onnx",
+            "scrfd_500m_640.int8.onnx",
+        ),
+        (c"models/scrfd_2.5g_640.onnx", "scrfd_2.5g_640.onnx"),
+        (
+            c"models/scrfd_2.5g_640.int8.onnx",
+            "scrfd_2.5g_640.int8.onnx",
+        ),
+        (c"models/scrfd_10g_640.onnx", "scrfd_10g_640.onnx"),
+        (c"models/scrfd_10g_640.int8.onnx", "scrfd_10g_640.int8.onnx"),
        (c"models/arcface_mbf_b1.onnx", "arcface_mbf_b1.onnx"),
+        (c"models/2d106det_b1.onnx", "2d106det_b1.onnx"),
+        (c"models/ocec_s_b1.onnx", "ocec_s_b1.onnx"),
+        (c"models/sgc_l_48_b1.onnx", "sgc_l_48_b1.onnx"),
        (c"models/yolo26s-sem-ade20k.onnx", "yolo26s-sem-ade20k.onnx"),
        (
            c"models/yolo26s-sem-ade20k.classes.json",
            "yolo26s-sem-ade20k.classes.json",
        ),
        (c"models/categories.txt", "categories.txt"),
+        // The panorama border filler (FR-MRG-4); MIT, 28 MB.
+        (c"models/migan-512.onnx", "migan-512.onnx"),
    ];

    let dir = dr_ui::shared_face_models_dir();
@@ -334,8 +368,8 @@ fn unpack_bundled_models(app: &slint::android::AndroidApp) {

    for (asset_path, name) in BUNDLED {
        let dest = dir.join(name);
-        // Already unpacked. Not re-read on every launch: this is 41 MB of
-        // copying across the five entries, and the file does not change without
+        // Already unpacked. Not re-read on every launch: this is 73 MB of
+        // copying across the ten entries, and the file does not change without
        // the APK changing, at which point the install wiped it anyway. It
        // matters more now than it did — a launch that skips every entry here
        // costs nothing at all, which is what makes the second launch after an
@@ -383,6 +417,27 @@ fn unpack_bundled_models(app: &slint::android::AndroidApp) {
        "bundled models ready: {copied} bytes copied in {} ms",
        started.elapsed().as_millis()
    );
+
+    // Now, and not at launch: the probe fingerprints the model files, and
+    // on a first launch they were not on disk until this line. The runtime
+    // is in the APK's native library directory beside `libdarkroom.so`,
+    // which is also where Qualcomm's DSP loader has to be pointed for the
+    // Hexagon skel (docs/dev/inference.md §3, §8).
+    dr_ui::inference::init(native_library_dir().into_iter().collect());
+}
+
+/// The directory the system unpacked this APK's native libraries into.
+///
+/// Read from where the loader put *this* library rather than asked of the
+/// activity: `android-activity` does not expose `nativeLibraryDir`, and the
+/// answer is in `/proc/self/maps` for free.
+#[cfg(target_os = "android")]
+fn native_library_dir() -> Option<std::path::PathBuf> {
+    let maps = std::fs::read_to_string("/proc/self/maps").ok()?;
+    maps.lines()
+        .filter_map(|l| l.split_whitespace().nth(5))
+        .find(|p| p.ends_with("/libdarkroom.so"))
+        .and_then(|p| std::path::Path::new(p).parent().map(Into::into))
 }

 /// TRACES: FR-PLAT-AND-6
@@ -528,6 +583,37 @@ mod tests {
        );
    }

+    /// `dr_ui::manual` starts the manual by class name. A name the manifest
+    /// does not declare is an `ActivityNotFoundException` on the device and a
+    /// Manual button that does nothing, so the three spellings — dr_ui's, the
+    /// manifest's and the Java file's — are checked to be one.
+    #[test]
+    fn the_manual_activity_dr_ui_starts_is_declared() {
+        let manifest = manifest();
+        let wanted = dr_ui::manual::ANDROID_ACTIVITY;
+        let element = manifest
+            .split("<activity")
+            .skip(1)
+            .find(|a| attribute(a, "android:name").as_deref() == Some(wanted))
+            .unwrap_or_else(|| panic!("the manifest declares no activity {wanted}"));
+        assert_eq!(
+            attribute(element, "android:exported").as_deref(),
+            Some("false"),
+            "the manual activity has no reason to be startable by another app"
+        );
+        let java = include_str!("../android/java/paris/tourolle/darkroom/ManualActivity.java");
+        let (package, class) = wanted.rsplit_once('.').expect("unqualified class name");
+        assert!(java.contains(&format!("package {package};")));
+        assert!(java.contains(&format!("class {class} ")));
+        assert!(
+            java.contains(&format!(
+                "EXTRA_ANCHOR = \"{}\"",
+                dr_ui::manual::ANDROID_EXTRA_ANCHOR
+            )),
+            "ManualActivity reads the section from a different extra than dr_ui writes"
+        );
+    }
+
    #[test]
    fn the_provider_hands_out_one_file_at_a_time_and_nothing_by_itself() {
        let manifest = manifest();
@@ -15,5 +15,16 @@ anyhow.workspace = true
 env_logger.workspace = true
 log.workspace = true

+# The Windows resource block — icon and version — compiled in by build.rs.
+# Unconditional rather than under `[target.'cfg(windows)']`, because a cfg on
+# a build-dependency is evaluated against the *host* — the machine running
+# the build script — and this is built for Windows from Linux. The script
+# itself returns before touching the crate on every other target.
+[build-dependencies]
+winresource = "0.1"
+
 [features]
 default = []
+# The manual's recording hook (dr-ui's `automation`); tools/manual/record.sh
+# builds with it, nothing else does.
+automation = ["dr-ui/automation"]
@@ -0,0 +1,58 @@
+//! TRACES: FR-PLAT-WIN-2
+//! The Windows resource block: icon and version, compiled into the executable.
+//!
+//! Windows takes an application's icon and its "Details" tab from a resource
+//! inside the `.exe`, not from a `.desktop` file, so without this the installed
+//! program shows the generic executable icon in Explorer, the Start Menu and
+//! the taskbar, and reports no version. Nothing here runs for any other
+//! target: the whole body is behind the target-OS check, and the crate that
+//! does the work is a build-dependency only.
+//!
+//! The icon is the same PNG every other platform uses, wrapped into an `.ico`
+//! in `OUT_DIR` rather than committed: an ICO entry may *be* a PNG (Vista and
+//! later read them directly), so the wrapper is a 22-byte header and the
+//! file's bytes, and a generated binary stays out of the tree.
+
+use std::io::Write as _;
+use std::path::PathBuf;
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
+    }
+
+    let png = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../ui/dr-ui/ui/app-icon.png");
+    println!("cargo:rerun-if-changed={}", png.display());
+    let bytes = std::fs::read(&png).expect("read app-icon.png");
+    let ico = PathBuf::from(std::env::var("OUT_DIR").unwrap()).join("darkroom.ico");
+    write_png_ico(&ico, &bytes, 256).expect("write darkroom.ico");
+
+    let mut res = winresource::WindowsResource::new();
+    res.set_icon(ico.to_str().unwrap());
+    res.set("ProductName", "DarkRoom");
+    res.set("FileDescription", "DarkRoom");
+    res.set("LegalCopyright", "GPL-3.0-or-later");
+    // Cross-compiling: `winresource` looks for a `windres` for the target and
+    // the Windows image names it explicitly, for the same reason the Android
+    // image names its linkers.
+    if let Ok(windres) = std::env::var("WINDRES") {
+        res.set_windres_path(&windres);
+    }
+    res.compile().expect("compile the Windows resource block");
+}
+
+/// One PNG image as an `.ico`. `edge` is the PNG's width and height; 256 is
+/// written as 0 per the format.
+fn write_png_ico(path: &std::path::Path, png: &[u8], edge: u32) -> std::io::Result<()> {
+    let mut f = std::fs::File::create(path)?;
+    let dim = if edge >= 256 { 0u8 } else { edge as u8 };
+    // ICONDIR: reserved, type 1 (icon), one image.
+    f.write_all(&[0, 0, 1, 0, 1, 0])?;
+    // ICONDIRENTRY: width, height, palette 0, reserved, planes 1, bpp 32,
+    // byte length, offset (6 + 16).
+    f.write_all(&[dim, dim, 0, 0, 1, 0, 32, 0])?;
+    f.write_all(&(png.len() as u32).to_le_bytes())?;
+    f.write_all(&22u32.to_le_bytes())?;
+    f.write_all(png)
+}
@@ -1,12 +1,32 @@
 //! DarkRoom desktop entry point.
 //!
 //!   darkroom-desktop <file-or-directory>...
+//!   darkroom-desktop --version
+
+// TRACES: FR-PLAT-WIN-2
+// A GUI-subsystem executable, or Windows opens a console window behind the
+// application for the life of the process. Release only: the console is where
+// the log goes when there is no file, and a debug build is run from one.
+// `--version` still prints under this — stdout is simply not attached when
+// launched from Explorer, which is not where anyone asks for a version.
+#![cfg_attr(all(windows, not(debug_assertions)), windows_subsystem = "windows")]

 use std::path::PathBuf;

 use dr_plat::diagnostics::Installed;

 fn main() -> anyhow::Result<()> {
+    // TRACES: FR-PLAT-WIN-3
+    // Before the logger, the crash hook and everything else: this exists so a
+    // build made on a machine that cannot run the application — the Linux CI
+    // producing the Windows binary, checked under Wine — has an exit that
+    // proves the executable starts without opening a window or touching the
+    // user's directories (docs/dev/windows.md §6).
+    if std::env::args().nth(1).as_deref() == Some("--version") {
+        println!("darkroom-desktop {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
+    }
+
    // Built rather than `init`ed, so the same logger can be handed to the
    // diagnostics tee: `env_logger` keeps writing to stderr exactly as before,
    // and every record it accepts is also appended to the on-disk log
@@ -41,6 +61,11 @@ fn main() -> anyhow::Result<()> {
        eprintln!("usage: darkroom-desktop <file-or-directory>...");
    }

+    // Before the window: the probe runs on its own thread and the first
+    // frame does not wait for it, but the models a background job asks for
+    // should already know where the runtime is (docs/dev/inference.md §4).
+    dr_ui::inference::init(runtime_dirs());
+
    dr_ui::run(paths)?;

    // Skip Rust's normal static/thread-local teardown on the way out: a
@@ -50,3 +75,39 @@ fn main() -> anyhow::Result<()> {
    // destruction" when the window is closed.
    std::process::exit(0);
 }
+
+/// Where a desktop package may have put `libonnxruntime`, most specific
+/// first. None of these existing is the tract build, which is a complete
+/// application and not an error (docs/dev/inference.md §3).
+///
+/// `DARKROOM_ORT_DIR` is for a developer pointing at a runtime that is not
+/// installed — the wheel's `capi` directory, say. Then beside the executable
+/// and in the package's private library directory, for a package that
+/// bundles its own; then the user's own `runtime/` beside the models, where
+/// `tools/fetch-desktop-runtime.sh` puts one; then the Flatpak prefix; then
+/// the system library directory, for a distribution that ships ONNX Runtime
+/// as a package of its own. The user's copy outranks the system's because
+/// the system's is the one most likely to be built without the GPU
+/// providers, or against the wrong cuDNN — and a system copy whose providers
+/// do not load is not a problem, only a slower app: the probe builds a real
+/// session before believing a provider.
+fn runtime_dirs() -> Vec<PathBuf> {
+    let mut dirs = Vec::new();
+    if let Some(dir) = std::env::var_os("DARKROOM_ORT_DIR") {
+        dirs.push(PathBuf::from(dir));
+    }
+    if let Ok(exe) = std::env::current_exe() {
+        if let Some(bin) = exe.parent() {
+            dirs.push(bin.to_path_buf());
+            dirs.push(bin.join("../lib/darkroom"));
+        }
+    }
+    dirs.push(dr_ui::inference::user_runtime_dir());
+    #[cfg(target_os = "linux")]
+    dirs.extend([
+        PathBuf::from("/app/lib/darkroom"),
+        PathBuf::from("/usr/lib/darkroom"),
+        PathBuf::from("/usr/lib"),
+    ]);
+    dirs
+}
@@ -0,0 +1,297 @@
+//! What the catalog's routine reads cost on a real library, off the GUI.
+//!
+//!   cargo run --release -p dr-catalog --example catalog_bench -- CATALOG.sqlite [FACES_DIR] [--remote PEER.sqlite]
+//!
+//! Times `Catalog::open` — which every worker thread pays, including the
+//! develop view's fetch of each original and each neighbour it prefetches —
+//! and the backfill that runs inside it, step by step. Run it against a
+//! *copy* of a real catalog: opening migrates and backfills, which write.
+//!
+//! Then what the library screen reads on every keystroke and scroll: the
+//! filter chips' counts, the keyword panel, and the grid's total. Two of
+//! those live in `dr-ui` (`library::local_original_count` and the grid
+//! count), whose `library` module is private; their SQL is spelled here as
+//! it is spelled there, and has to be kept in step by hand.
+//!
+//! `--remote` also times a merge with another device's catalog — the
+//! server snapshot — which is the pass where the two disagree: faces one
+//! side found and the other did not, boxes that moved. The merge with a copy
+//! of itself matches every face by its box and never reaches that work. The
+//! first of its runs writes what the peer brought; the rest are the steady
+//! state, so compare two builds from two fresh copies of one catalog.
+//!
+//! The figures are for reading side by side before and after a change; they
+//! are not a gate. Compare the `cpu` column when the machine is busy. The
+//! answers are printed too, so two builds can be checked for agreeing.
+
+use std::path::PathBuf;
+use std::time::{Duration, Instant};
+
+use dr_catalog::{keywords, name_dates, rating, schema, Catalog};
+
+fn main() {
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let peer = args.iter().position(|a| a == "--remote").map(|at| {
+        let path = args.get(at + 1).map(PathBuf::from).unwrap_or_else(|| {
+            eprintln!("--remote needs a catalog");
+            std::process::exit(2);
+        });
+        args.drain(at..at + 2);
+        path
+    });
+    let Some(path) = args.first().map(PathBuf::from) else {
+        eprintln!("usage: catalog_bench CATALOG.sqlite");
+        std::process::exit(2);
+    };
+
+    // Once untimed, so a migration or a first backfill is not in the figures.
+    drop(Catalog::open(&path).expect("catalog"));
+
+    time("Catalog::open", 20, || {
+        drop(Catalog::open(&path).unwrap());
+    });
+
+    // One develop landing, in the two shapes the app has had. Five opens is
+    // what `fetch_original` and a `holds_original` per prefetched neighbour
+    // cost when each asked on a connection of its own; two is the fetch plus
+    // one connection the prefetch worker keeps for its batch's row checks.
+    // Five images from the library, against an empty cache: the question is
+    // asked the same way whatever the answer.
+    let images: Vec<dr_types::ImageId> = {
+        let c = Catalog::open(&path).unwrap();
+        let mut stmt = c
+            .connection()
+            .prepare("SELECT id FROM images ORDER BY id LIMIT 5 OFFSET 1000")
+            .unwrap();
+        let ids = stmt
+            .query_map([], |r| r.get::<_, i64>(0))
+            .unwrap()
+            .map(|id| dr_types::ImageId(id.unwrap() as u64))
+            .collect();
+        ids
+    };
+    let cache_dir = path.with_extension("bench-cache");
+    let budget = dr_catalog::Budget::default();
+    time("landing: 5 opens (fetch + 4 row checks)", 20, || {
+        let store = dr_catalog::Cache::open(&cache_dir, budget).unwrap();
+        let c = Catalog::open(&path).unwrap();
+        let _ = store.load(c.connection(), images[0], 0).unwrap();
+        for &image in &images[1..] {
+            let store = dr_catalog::Cache::open(&cache_dir, budget).unwrap();
+            let c = Catalog::open(&path).unwrap();
+            let _ = store.holds_original(c.connection(), image);
+        }
+    });
+    time("landing: 2 opens (fetch + held row checks)", 20, || {
+        let store = dr_catalog::Cache::open(&cache_dir, budget).unwrap();
+        let c = Catalog::open(&path).unwrap();
+        let _ = store.load(c.connection(), images[0], 0).unwrap();
+        let held = Catalog::open(&path).unwrap();
+        for &image in &images[1..] {
+            let store = dr_catalog::Cache::open(&cache_dir, budget).unwrap();
+            let _ = store.holds_original(held.connection(), image);
+        }
+    });
+    let _ = std::fs::remove_dir_all(&cache_dir);
+
+    let catalog = Catalog::open(&path).unwrap();
+    let conn = catalog.connection();
+    time("schema::backfill (all steps)", 20, || {
+        schema::backfill(conn).unwrap();
+    });
+    time("  rating::ensure_default_versions", 20, || {
+        rating::ensure_default_versions(conn).unwrap();
+    });
+    time("  rating::align_default_version_uuids", 20, || {
+        rating::align_default_version_uuids(conn).unwrap();
+    });
+    time("  keywords::adopt_orphan_terms", 20, || {
+        keywords::adopt_orphan_terms(conn).unwrap();
+    });
+    time("  name_dates::fill", 20, || {
+        name_dates::fill(conn, None).unwrap();
+    });
+
+    interactive(conn);
+
+    // A sync pass: the upload snapshot, then a merge of the catalog with a
+    // copy of itself — every row a match, which is the steady state.
+    let scratch = path.with_extension("bench-snapshot");
+    time("snapshot_for_upload", 3, || {
+        let _ = std::fs::remove_file(&scratch);
+        catalog.snapshot_for_upload(&scratch).unwrap();
+    });
+    println!(
+        "  snapshot size {:.1} MB",
+        std::fs::metadata(&scratch).map(|m| m.len()).unwrap_or(0) as f64 / 1e6
+    );
+    let remote = path.with_extension("bench-remote");
+    let _ = std::fs::remove_file(&remote);
+    conn.execute("VACUUM INTO ?1", [remote.to_string_lossy().as_ref()])
+        .unwrap();
+    time("merge_remote_catalog (self)", 5, || {
+        catalog.merge_remote_catalog(&remote).unwrap();
+    });
+    let _ = std::fs::remove_file(&scratch);
+    let _ = std::fs::remove_file(&remote);
+
+    if let Some(peer) = &peer {
+        // A copy, so nothing the merge does to its input reaches the file
+        // the caller named.
+        std::fs::copy(peer, &remote).unwrap();
+        let mut first = None;
+        time("merge_remote_catalog (--remote)", 5, || {
+            let report = catalog.merge_remote_catalog(&remote).unwrap();
+            first.get_or_insert(report);
+        });
+        println!("  first pass: {first:?}");
+        let _ = std::fs::remove_file(&remote);
+    }
+
+    // The face half of a sync pass, against a copy of the face store: both
+    // directions in the steady state, where nothing is new either way.
+    if let Some(faces) = args.get(1).map(PathBuf::from) {
+        let model = "scrfd_10g+w600k_mbf";
+        let mut store = dr_catalog::FaceShardStore::open(&faces).unwrap();
+        println!(
+            "  first export sent {}, first import adopted {}",
+            dr_catalog::face_shard::export_to_shards(conn, &mut store, model).unwrap(),
+            dr_catalog::face_shard::import_from_shards(conn, &store, model).unwrap()
+        );
+        time("face_shard::export_to_shards (steady)", 5, || {
+            dr_catalog::face_shard::export_to_shards(conn, &mut store, model).unwrap();
+        });
+        time("face_shard::import_from_shards (steady)", 5, || {
+            dr_catalog::face_shard::import_from_shards(conn, &store, model).unwrap();
+        });
+    }
+}
+
+/// What one click in the library reads: a rating or label keystroke
+/// refreshes the chips, a selection change redraws the keyword panel, and
+/// every scroll reload counts the grid.
+fn interactive(conn: &rusqlite::Connection) {
+    println!(
+        "  rating_histogram {:?}, label_histogram {:?}, local originals {}, grid {} / rated {}",
+        rating::rating_histogram(conn).unwrap(),
+        rating::label_histogram(conn).unwrap(),
+        local_original_count(conn),
+        grid_count(conn, ""),
+        grid_count(conn, RATED_AT_LEAST_ONE),
+    );
+    let words = keywords::list(conn).unwrap();
+    println!(
+        "  keywords::list {} terms, digest {:016x}",
+        words.len(),
+        digest(&format!("{words:?}"))
+    );
+    // A selection the size of a grid window, from the start of the library.
+    let selection: Vec<dr_types::ImageId> = conn
+        .prepare("SELECT id FROM images ORDER BY id LIMIT 120")
+        .unwrap()
+        .query_map([], |r| Ok(dr_types::ImageId(r.get::<_, i64>(0)? as u64)))
+        .unwrap()
+        .collect::<Result<_, _>>()
+        .unwrap();
+    println!(
+        "  keywords::for_images digest {:016x}",
+        digest(&format!(
+            "{:?}",
+            keywords::for_images(conn, &selection).unwrap()
+        ))
+    );
+
+    time("rating::rating_histogram", 50, || {
+        rating::rating_histogram(conn).unwrap();
+    });
+    time("library::local_original_count", 50, || {
+        local_original_count(conn);
+    });
+    time("rating::label_histogram", 50, || {
+        rating::label_histogram(conn).unwrap();
+    });
+    time("keywords::list", 50, || {
+        keywords::list(conn).unwrap();
+    });
+    time("keywords::for_images (120)", 50, || {
+        keywords::for_images(conn, &selection).unwrap();
+    });
+    time("grid count", 50, || {
+        grid_count(conn, "");
+    });
+    time("grid count, rated >= 1", 50, || {
+        grid_count(conn, RATED_AT_LEAST_ONE);
+    });
+}
+
+/// `dr_ui::library::local_original_count`, spelled as it is there.
+fn local_original_count(conn: &rusqlite::Connection) -> i64 {
+    conn.query_row(
+        "SELECT count(*) FROM images i
+          WHERE i.shadowed_by IS NULL AND i.trashed_at IS NULL
+            AND i.id IN (SELECT ic.image_id FROM image_cache ic
+                          WHERE ic.tier_actual >= 2)",
+        [],
+        |r| r.get(0),
+    )
+    .unwrap()
+}
+
+/// `RatingFilter::sql` for one star and up.
+const RATED_AT_LEAST_ONE: &str = " AND coalesce((SELECT dv.rating FROM versions dv
+                             WHERE dv.image_id = i.id AND dv.is_default = 1
+                             LIMIT 1), 0) >= 1";
+
+/// `dr_ui::library::total_images_filtered`, spelled as it is there.
+fn grid_count(conn: &rusqlite::Connection, rated: &str) -> i64 {
+    let visible = "i.shadowed_by IS NULL AND i.trashed_at IS NULL";
+    let hidden = dr_catalog::bursts::collapsed_away_frames("i");
+    conn.query_row(
+        &format!(
+            "SELECT (SELECT count(*) FROM images i WHERE {visible}{rated})
+                  - (SELECT count(*) FROM {hidden} AND {visible}{rated})"
+        ),
+        [],
+        |r| r.get(0),
+    )
+    .unwrap()
+}
+
+/// FNV-1a, to print a long answer as something two runs can compare.
+fn digest(s: &str) -> u64 {
+    s.bytes().fold(0xcbf29ce484222325, |h, b| {
+        (h ^ u64::from(b)).wrapping_mul(0x100000001b3)
+    })
+}
+
+/// Run `f` a few times and print the best wall-clock, the median, and the
+/// best CPU time — the figure to compare across runs on a busy machine.
+fn time(label: &str, runs: usize, mut f: impl FnMut()) {
+    let mut wall: Vec<Duration> = Vec::with_capacity(runs);
+    let mut cpu: Vec<Duration> = Vec::with_capacity(runs);
+    for _ in 0..runs {
+        let c = cpu_now();
+        let t = Instant::now();
+        f();
+        wall.push(t.elapsed());
+        cpu.push(cpu_now().saturating_sub(c));
+    }
+    wall.sort();
+    cpu.sort();
+    println!(
+        "{label:42} best {:8.2} ms   median {:8.2} ms   cpu {:8.2} ms",
+        wall[0].as_secs_f64() * 1e3,
+        wall[runs / 2].as_secs_f64() * 1e3,
+        cpu[0].as_secs_f64() * 1e3
+    );
+}
+
+/// This thread's time on a CPU so far, from `/proc/self/schedstat`; zero where
+/// the file is missing, which only makes the CPU column useless.
+fn cpu_now() -> Duration {
+    std::fs::read_to_string("/proc/self/schedstat")
+        .ok()
+        .and_then(|s| s.split_whitespace().next()?.parse::<u64>().ok())
+        .map(Duration::from_nanos)
+        .unwrap_or_default()
+}
@@ -0,0 +1,141 @@
+//! Run the people and face deduplication (#78) on a copy of a real catalog.
+//!
+//!   cargo run --release -p dr-catalog --example dedup_people -- COPY.sqlite [--peer PEER_COPY.sqlite]
+//!
+//! It writes: run it against a *copy* (`sqlite3 catalog.sqlite ".backup
+//! copy.sqlite"`), never the library's own file. Prints the live people and
+//! faces before and after, what the first run merged and kept apart, and
+//! how long the first and a second run took -- the second is the cost the
+//! job adds to every sync once a catalog is clean.
+//!
+//! `--peer` then plays a sync round trip with another device's catalog (a
+//! copy of the server snapshot, which it also writes): the peer merges this
+//! one as the previous release would, with no job after it, then this one
+//! merges the peer back through `sync::merge_remote`, twice. The named
+//! people each side lists are printed after each step; they should agree.
+
+use std::path::PathBuf;
+use std::time::Instant;
+
+use dr_catalog::{dedup_people, merge, schema, sync};
+use rusqlite::Connection;
+
+fn open(path: &std::path::Path) -> Connection {
+    let conn = Connection::open(path).expect("open the catalog copy");
+    schema::configure(&conn).expect("configure");
+    schema::migrate(&conn).expect("migrate");
+    conn
+}
+
+/// The named people a device lists, as `name (uuid prefix)`, sorted.
+fn named(conn: &Connection) -> Vec<String> {
+    let mut v: Vec<String> = conn
+        .prepare(
+            "SELECT name, substr(uuid, 1, 8) FROM people
+              WHERE merged_into IS NULL AND trim(name) <> ''",
+        )
+        .unwrap()
+        .query_map([], |r| {
+            Ok(format!(
+                "{} ({})",
+                r.get::<_, String>(0)?,
+                r.get::<_, String>(1)?
+            ))
+        })
+        .unwrap()
+        .collect::<Result<_, _>>()
+        .unwrap();
+    v.sort();
+    v
+}
+
+fn main() {
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let peer = args.iter().position(|a| a == "--peer").map(|at| {
+        let p = PathBuf::from(&args[at + 1]);
+        args.drain(at..at + 2);
+        p
+    });
+    let Some(path) = args.first().map(PathBuf::from) else {
+        eprintln!("usage: dedup_people COPY.sqlite [--peer PEER_COPY.sqlite]");
+        std::process::exit(2);
+    };
+    let conn = open(&path);
+
+    let counts = |label: &str| {
+        let q = |sql: &str| -> i64 { conn.query_row(sql, [], |r| r.get(0)).unwrap() };
+        println!(
+            "{label}: {} people listed ({} named), {} redirects, {} faces, {} confirmed",
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NULL"),
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NULL AND trim(name) <> ''"),
+            q("SELECT COUNT(*) FROM people WHERE merged_into IS NOT NULL"),
+            q("SELECT COUNT(*) FROM faces"),
+            q("SELECT COUNT(*) FROM face_person WHERE confirmed = 1"),
+        );
+    };
+
+    counts("before");
+    for pass in ["first", "second", "third"] {
+        let started = Instant::now();
+        let report = dedup_people::run(&conn).expect("dedup");
+        let took = started.elapsed();
+        println!("{pass} run: {took:?}, changed: {}", report.changed());
+        if pass == "first" {
+            println!("  merged: {:?}", report.merged);
+            for k in &report.kept_apart {
+                println!(
+                    "  kept apart: {:?} ({}) from {}: {:?}",
+                    k.name, k.uuid, k.survivor, k.why
+                );
+            }
+            println!(
+                "  redirects followed {}, cycles broken {}, faces fused {}, faces confirmed apart {}",
+                report.redirects_followed,
+                report.cycles_broken,
+                report.faces_fused,
+                report.faces_confirmed_apart
+            );
+        }
+    }
+    counts("after");
+
+    let Some(peer_path) = peer else { return };
+    let peer = open(&peer_path);
+    let show = |step: &str| {
+        let (ours, theirs) = (named(&conn), named(&peer));
+        println!(
+            "{step}: this device lists {} named, the peer {}; {}",
+            ours.len(),
+            theirs.len(),
+            if ours == theirs {
+                "the same".to_string()
+            } else {
+                format!("differ:\n  here {ours:?}\n  peer {theirs:?}")
+            }
+        );
+    };
+    show("before the round trip");
+    for round in 1..=2 {
+        peer.execute(
+            "ATTACH DATABASE ?1 AS remote_cat",
+            [path.to_string_lossy().as_ref()],
+        )
+        .unwrap();
+        let theirs = merge::merge_all(&peer).expect("the peer's merge");
+        peer.execute("DETACH DATABASE remote_cat", []).unwrap();
+        println!(
+            "round {round}: the peer took {} people updated, {} inserted",
+            theirs.people_updated, theirs.people_inserted
+        );
+        show(&format!("round {round}, after the peer's merge"));
+        let started = Instant::now();
+        let ours = sync::merge_remote(&conn, &peer_path).expect("our merge");
+        println!(
+            "round {round}: merge_remote with the job took {:?}; {} people updated, {} inserted",
+            started.elapsed(),
+            ours.people_updated,
+            ours.people_inserted
+        );
+        show(&format!("round {round}, after ours"));
+    }
+}
@@ -34,6 +34,10 @@ struct Known {
    crop_px: f32,
 }

+/// What the catalog holds per face, decoded: photograph, vector, size,
+/// quality.
+type Decoded = (u64, Vec<f32>, f32, Option<f32>);
+
 fn main() {
    let args: Vec<String> = std::env::args().skip(1).collect();
    let Some(path) = args.first() else {
@@ -59,10 +63,10 @@ fn main() {

    let model = dr_face::ModelId::new(MODEL_ID.to_string());
    let stored = faces::embeddings(conn, MODEL_ID).expect("embeddings");
-    let mut embedding_of = HashMap::new();
-    for (id, image, blob, crop_px) in stored {
-        if let Some(e) = dr_face::Embedding::from_f16_bytes(model.clone(), &blob) {
-            embedding_of.insert(id, (image.0, e.v.to_vec(), crop_px));
+    let mut embedding_of: HashMap<faces::FaceId, Decoded> = HashMap::new();
+    for f in stored {
+        if let Some(e) = dr_face::Embedding::from_f16_bytes(model.clone(), &f.embedding) {
+            embedding_of.insert(f.face, (f.image.0, e.v.to_vec(), f.crop_px, f.quality));
        }
    }
    println!("faces with embeddings: {}", embedding_of.len());
@@ -82,7 +86,7 @@ fn main() {
            if !f.confirmed {
                continue;
            }
-            if let Some((image, embedding, crop_px)) = embedding_of.get(&f.id) {
+            if let Some((image, embedding, crop_px, _)) = embedding_of.get(&f.id) {
                mine.push(Known {
                    image: *image,
                    person: p.id,
@@ -288,19 +292,22 @@ fn band(label: &str, v: &[f32]) {
 /// The whole library through the real clusterer, for the numbers it would
 /// actually write.
 fn full_library(
-    embedding_of: &HashMap<faces::FaceId, (u64, Vec<f32>, f32)>,
+    embedding_of: &HashMap<faces::FaceId, Decoded>,
    confirmed: &HashMap<faces::FaceId, u64>,
    cal: &dr_face::Calibration,
 ) {
    let mut candidates: Vec<dr_face::Candidate> = embedding_of
        .iter()
-        .map(|(id, (image, embedding, crop_px))| dr_face::Candidate {
-            face: id.0,
-            image: *image,
-            embedding: embedding.clone(),
-            crop_px: *crop_px,
-            confirmed_person: confirmed.get(id).copied(),
-        })
+        .map(
+            |(id, (image, embedding, crop_px, quality))| dr_face::Candidate {
+                face: id.0,
+                image: *image,
+                embedding: embedding.clone(),
+                crop_px: *crop_px,
+                quality: *quality,
+                confirmed_person: confirmed.get(id).copied(),
+            },
+        )
        .collect();
    candidates.sort_by_key(|c| c.face);

@@ -308,7 +315,7 @@ fn full_library(

    // The three phases, separately, because "a regroup takes n seconds" does
    // not tell anyone which half to optimise — and the answer differs between
-    // a desktop and a tablet (docs/faces.md §9).
+    // a desktop and a tablet (docs/dev/faces.md §9).
    {
        let dim = candidates.first().map(|c| c.embedding.len()).unwrap_or(0);
        let flat: Vec<f32> = candidates
@@ -317,11 +324,13 @@ fn full_library(
            .collect();
        let crop_px: Vec<f32> = candidates.iter().map(|c| c.crop_px).collect();
        let images: Vec<u64> = candidates.iter().map(|c| c.image).collect();
+        let gallery: Vec<bool> = candidates.iter().map(|c| c.in_gallery()).collect();
        let view = dr_face::neighbours::Faces {
            embeddings: &flat,
            dim,
            crop_px: &crop_px,
            images: &images,
+            gallery: &gallery,
        };

        let t = std::time::Instant::now();
@@ -335,8 +344,7 @@ fn full_library(
        let agglomerate = t.elapsed().as_secs_f64() - scan;

        let t = std::time::Instant::now();
-        let _ =
-            dr_face::identity_shares(candidates.len(), &clusters, &evidence, dr_face::TOP_MATCHES);
+        let _ = dr_face::identity_shares(&gallery, &clusters, &evidence, dr_face::TOP_MATCHES);
        println!(
            "  scan {scan:.2}s ({} evidence pairs) · agglomerate {agglomerate:.2}s · score {:.2}s",
            evidence.len(),
@@ -0,0 +1,516 @@
+//! TRACES: FR-EXP-10 | FR-EXP-6 | FR-CAT-7
+//! Albums: named export folders, and which photographs went into each.
+//!
+//! An album is where finished pictures go — a folder of JPEGs somebody else
+//! looks at — as opposed to a collection, which is a set of originals the
+//! photographer works on. The folder holds only the exported files. What the
+//! catalog adds is the link back: each export is recorded against the image
+//! it was rendered from, so opening an album in the library shows the RAWs
+//! behind its JPEGs, and re-exporting after an edit is one selection away.
+//!
+//! # Where the folder is, and why that is two tables
+//!
+//! An album's folder is either on the library's server or on this device.
+//!
+//! A **server folder** is one path on the account, the same from every device
+//! signed in to it, so it lives on the album row and syncs with it.
+//!
+//! A **local folder** — a filesystem path on a desktop, a Storage Access
+//! Framework tree on Android — means nothing on any other device. It lives in
+//! `album_folders`, which the merge never reads and the upload snapshot drops
+//! ([`crate::sync::snapshot_for_upload`]). An album made on the desktop with a
+//! local folder therefore reaches the tablet as an album with no folder there
+//! yet, which is true, and which the tablet can fix by choosing one.
+//!
+//! # Created on first use, not by a migration
+//!
+//! A new schema version makes every older build refuse this catalog's
+//! snapshot at sync (`crate::sync::remote_is_mergeable`), so the tablet would
+//! stop merging collections, keywords and people until it was updated — for
+//! a feature it does not have. The tables are created by [`ensure_tables`]
+//! instead, the way `dedup_probes` is; an older build that meets them ignores
+//! them, and its merge keeps working.
+//!
+//! # Sync
+//!
+//! Albums merge by uuid and revision with tombstones, and their exports as a
+//! set union keyed on the image's server file id — the rules
+//! [`crate::merge`] applies to collections, for the same reasons.
+
+use rusqlite::{Connection, OptionalExtension};
+
+use dr_types::ImageId;
+
+use crate::error::CatalogError;
+
+/// Identifies an album within one catalog. Local, like every integer id here;
+/// the uuid is what crosses devices.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub struct AlbumId(pub u64);
+
+/// Where an album's files go.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Place {
+    /// A folder on the library's server, relative to the account root, with no
+    /// leading slash. The same on every device.
+    Server(String),
+    /// A folder on this device: a filesystem path, or on Android a SAF tree
+    /// URI. Never synced.
+    Local(String),
+}
+
+/// One album, as the sidebar and the export sheet show it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Album {
+    pub id: AlbumId,
+    pub uuid: String,
+    pub name: String,
+    /// Where exports go from this device, or `None` for an album whose folder
+    /// is local to another device and has not been chosen here.
+    pub place: Option<Place>,
+    /// Distinct photographs exported into it — what the grid shows when the
+    /// album is opened.
+    pub sources: usize,
+}
+
+/// Create the album tables if this catalog does not have them yet.
+///
+/// Cheap when they exist: `IF NOT EXISTS` is answered from the schema, and
+/// every function below calls this first so no caller has to remember to.
+pub fn ensure_tables(conn: &Connection) -> Result<(), CatalogError> {
+    conn.execute_batch(
+        "CREATE TABLE IF NOT EXISTS albums (
+             id          INTEGER PRIMARY KEY,
+             -- The merge identity; the integer id is local.
+             uuid        TEXT    NOT NULL UNIQUE,
+             name        TEXT    NOT NULL,
+             -- A folder on the server, relative to the account root. NULL for
+             -- an album whose folder is local to some device.
+             server_path TEXT,
+             created     INTEGER NOT NULL,
+             revision    INTEGER NOT NULL DEFAULT 1,
+             modified    INTEGER NOT NULL,
+             deleted     INTEGER NOT NULL DEFAULT 0
+         );
+         -- One row per file written into an album. Keyed on the file, not the
+         -- image: a photograph exported twice — two crops, or once before an
+         -- edit and once after — is two files in the folder and two rows here.
+         CREATE TABLE IF NOT EXISTS album_exports (
+             album_id    INTEGER NOT NULL REFERENCES albums(id) ON DELETE CASCADE,
+             file_name   TEXT    NOT NULL,
+             image_id    INTEGER NOT NULL REFERENCES images(id) ON DELETE CASCADE,
+             exported_at INTEGER NOT NULL,
+             PRIMARY KEY (album_id, file_name)
+         );
+         CREATE INDEX IF NOT EXISTS album_exports_image ON album_exports(image_id);
+         -- This device's folder for an album. Never merged, never uploaded.
+         CREATE TABLE IF NOT EXISTS album_folders (
+             album_id INTEGER PRIMARY KEY REFERENCES albums(id) ON DELETE CASCADE,
+             folder   TEXT    NOT NULL
+         );",
+    )?;
+    Ok(())
+}
+
+/// Make an album.
+///
+/// The name is trimmed and must not be empty; two albums may share one, as
+/// two collections may, because the uuid is the identity and refusing a
+/// duplicate name here would refuse it on one device and not another.
+pub fn create(conn: &Connection, name: &str, place: &Place) -> Result<AlbumId, CatalogError> {
+    ensure_tables(conn)?;
+    let name = name.trim();
+    if name.is_empty() {
+        return Err(CatalogError::EmptyName);
+    }
+    let now = now_secs();
+    let tx = conn.unchecked_transaction()?;
+    tx.execute(
+        "INSERT INTO albums(uuid, name, server_path, created, revision, modified)
+         VALUES (?1, ?2, ?3, ?4, 1, ?4)",
+        rusqlite::params![
+            crate::collections::new_uuid(),
+            name,
+            server_path(place),
+            now
+        ],
+    )?;
+    let id = AlbumId(tx.last_insert_rowid() as u64);
+    if let Place::Local(folder) = place {
+        tx.execute(
+            "INSERT INTO album_folders(album_id, folder) VALUES (?1, ?2)",
+            rusqlite::params![id.0 as i64, folder],
+        )?;
+    }
+    tx.commit()?;
+    Ok(id)
+}
+
+/// Rename an album. The folder keeps its name: the album is what the
+/// photographer calls it, the folder is what is already out there.
+pub fn rename(conn: &Connection, id: AlbumId, name: &str) -> Result<(), CatalogError> {
+    ensure_tables(conn)?;
+    let name = name.trim();
+    if name.is_empty() {
+        return Err(CatalogError::EmptyName);
+    }
+    let n = conn.execute(
+        "UPDATE albums SET name = ?2, revision = revision + 1, modified = ?3
+          WHERE id = ?1 AND deleted = 0",
+        rusqlite::params![id.0 as i64, name, now_secs()],
+    )?;
+    if n == 0 {
+        return Err(CatalogError::NoSuchAlbum(id.0));
+    }
+    Ok(())
+}
+
+/// Point an album at a different folder, from this device.
+///
+/// A server folder replaces the synced path, and bumps the revision so the
+/// move reaches every device. A local folder is recorded for this device
+/// only; it also clears a server path, because an album goes to one place and
+/// the photographer has just said which.
+pub fn set_place(conn: &Connection, id: AlbumId, place: &Place) -> Result<(), CatalogError> {
+    ensure_tables(conn)?;
+    let tx = conn.unchecked_transaction()?;
+    let n = tx.execute(
+        "UPDATE albums SET server_path = ?2, revision = revision + 1, modified = ?3
+          WHERE id = ?1 AND deleted = 0",
+        rusqlite::params![id.0 as i64, server_path(place), now_secs()],
+    )?;
+    if n == 0 {
+        return Err(CatalogError::NoSuchAlbum(id.0));
+    }
+    match place {
+        Place::Local(folder) => tx.execute(
+            "INSERT INTO album_folders(album_id, folder) VALUES (?1, ?2)
+             ON CONFLICT(album_id) DO UPDATE SET folder = excluded.folder",
+            rusqlite::params![id.0 as i64, folder],
+        )?,
+        Place::Server(_) => tx.execute(
+            "DELETE FROM album_folders WHERE album_id = ?1",
+            [id.0 as i64],
+        )?,
+    };
+    tx.commit()?;
+    Ok(())
+}
+
+/// Delete an album, leaving a tombstone. The files in its folder are not
+/// touched: they are finished work somebody may already have been sent a
+/// link to, and the album was only ever this catalog's note of them.
+pub fn delete(conn: &Connection, id: AlbumId) -> Result<(), CatalogError> {
+    ensure_tables(conn)?;
+    let tx = conn.unchecked_transaction()?;
+    let n = tx.execute(
+        "UPDATE albums SET deleted = 1, revision = revision + 1, modified = ?2
+          WHERE id = ?1 AND deleted = 0",
+        rusqlite::params![id.0 as i64, now_secs()],
+    )?;
+    if n == 0 {
+        return Err(CatalogError::NoSuchAlbum(id.0));
+    }
+    tx.execute(
+        "DELETE FROM album_exports WHERE album_id = ?1",
+        [id.0 as i64],
+    )?;
+    tx.execute(
+        "DELETE FROM album_folders WHERE album_id = ?1",
+        [id.0 as i64],
+    )?;
+    tx.commit()?;
+    Ok(())
+}
+
+/// Every live album, by name, with how many photographs each holds.
+///
+/// One statement: the counts are aggregated from `album_exports` first and
+/// joined to the (few) albums, not counted per row.
+pub fn list(conn: &Connection) -> Result<Vec<Album>, CatalogError> {
+    ensure_tables(conn)?;
+    let mut stmt = conn.prepare(
+        "SELECT a.id, a.uuid, a.name, a.server_path, f.folder, coalesce(e.n, 0)
+           FROM albums a
+           LEFT JOIN album_folders f ON f.album_id = a.id
+           LEFT JOIN (SELECT album_id, count(DISTINCT image_id) AS n
+                        FROM album_exports GROUP BY album_id) e
+                  ON e.album_id = a.id
+          WHERE a.deleted = 0
+          ORDER BY a.name COLLATE NOCASE, a.id",
+    )?;
+    let rows = stmt
+        .query_map([], album_from_row)?
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(rows)
+}
+
+/// One album, or `None` if it is gone.
+pub fn get(conn: &Connection, id: AlbumId) -> Result<Option<Album>, CatalogError> {
+    ensure_tables(conn)?;
+    Ok(conn
+        .query_row(
+            "SELECT a.id, a.uuid, a.name, a.server_path, f.folder,
+                    (SELECT count(DISTINCT image_id) FROM album_exports WHERE album_id = a.id)
+               FROM albums a
+               LEFT JOIN album_folders f ON f.album_id = a.id
+              WHERE a.id = ?1 AND a.deleted = 0",
+            [id.0 as i64],
+            album_from_row,
+        )
+        .optional()?)
+}
+
+/// The album with this uuid, if this catalog holds it live.
+pub fn id_for_uuid(conn: &Connection, uuid: &str) -> Result<Option<AlbumId>, CatalogError> {
+    ensure_tables(conn)?;
+    Ok(conn
+        .query_row(
+            "SELECT id FROM albums WHERE uuid = ?1 AND deleted = 0",
+            [uuid],
+            |r| r.get::<_, i64>(0),
+        )
+        .optional()?
+        .map(|id| AlbumId(id as u64)))
+}
+
+/// Record the files one export wrote into an album, and which image each
+/// came from. One transaction for the batch, however many files it placed.
+///
+/// A file name already recorded is re-pointed at the image that wrote it
+/// last: an export that overwrote `IMG_0001.jpg` replaced the picture in the
+/// folder, and the link must say what is there now.
+pub fn record_exports(
+    conn: &Connection,
+    id: AlbumId,
+    files: &[(ImageId, String)],
+) -> Result<(), CatalogError> {
+    ensure_tables(conn)?;
+    if files.is_empty() {
+        return Ok(());
+    }
+    let tx = conn.unchecked_transaction()?;
+    let now = now_secs();
+    {
+        let mut insert = tx.prepare(
+            "INSERT INTO album_exports(album_id, file_name, image_id, exported_at)
+             VALUES (?1, ?2, ?3, ?4)
+             ON CONFLICT(album_id, file_name) DO UPDATE SET
+                 image_id = excluded.image_id, exported_at = excluded.exported_at",
+        )?;
+        for (image, name) in files {
+            insert.execute(rusqlite::params![id.0 as i64, name, image.0 as i64, now])?;
+        }
+    }
+    tx.commit()?;
+    Ok(())
+}
+
+/// The photographs behind an album's files, most recently exported first —
+/// what the grid shows when the album is opened.
+pub fn sources(conn: &Connection, id: AlbumId) -> Result<Vec<ImageId>, CatalogError> {
+    ensure_tables(conn)?;
+    let mut stmt = conn.prepare(
+        "SELECT image_id FROM album_exports
+          WHERE album_id = ?1
+          GROUP BY image_id
+          ORDER BY max(exported_at) DESC, image_id",
+    )?;
+    let rows = stmt
+        .query_map([id.0 as i64], |r| r.get::<_, i64>(0))?
+        .map(|r| r.map(|i| ImageId(i as u64)))
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(rows)
+}
+
+/// The names of the files an image left in an album — the "which JPEG is
+/// this" half of the link.
+pub fn files_of(
+    conn: &Connection,
+    id: AlbumId,
+    image: ImageId,
+) -> Result<Vec<String>, CatalogError> {
+    ensure_tables(conn)?;
+    let mut stmt = conn.prepare(
+        "SELECT file_name FROM album_exports
+          WHERE album_id = ?1 AND image_id = ?2
+          ORDER BY exported_at DESC, file_name",
+    )?;
+    let rows = stmt
+        .query_map(rusqlite::params![id.0 as i64, image.0 as i64], |r| r.get(0))?
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(rows)
+}
+
+fn album_from_row(r: &rusqlite::Row<'_>) -> rusqlite::Result<Album> {
+    let server: Option<String> = r.get(3)?;
+    let local: Option<String> = r.get(4)?;
+    Ok(Album {
+        id: AlbumId(r.get::<_, i64>(0)? as u64),
+        uuid: r.get(1)?,
+        name: r.get(2)?,
+        // A server path wins: `set_place` clears the local folder when it
+        // sets one, so both being present means a merge brought a server
+        // path in over a local choice — and the newer revision decided that.
+        place: server.map(Place::Server).or(local.map(Place::Local)),
+        sources: r.get::<_, i64>(5)? as usize,
+    })
+}
+
+fn server_path(place: &Place) -> Option<&str> {
+    match place {
+        Place::Server(p) => Some(p.trim_matches('/')),
+        Place::Local(_) => None,
+    }
+}
+
+fn now_secs() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A catalog, and the connection to it. The `Catalog` has to outlive the
+    /// connection it hands out, so tests hold both.
+    fn catalog() -> crate::Catalog {
+        let cat = crate::Catalog::in_memory().unwrap();
+        cat.connection()
+            .execute(
+                "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+                [],
+            )
+            .unwrap();
+        cat
+    }
+
+    fn image(conn: &Connection, path: &str) -> ImageId {
+        conn.execute(
+            "INSERT INTO images(root_id, source_ref, added_at) VALUES (1, ?1, 0)",
+            [path],
+        )
+        .unwrap();
+        ImageId(conn.last_insert_rowid() as u64)
+    }
+
+    #[test]
+    fn an_album_lists_with_its_place_and_no_photographs() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let web = create(conn, " Web ", &Place::Server("Shared/Web/".into())).unwrap();
+        let print = create(conn, "Print", &Place::Local("/mnt/print".into())).unwrap();
+
+        let all = list(conn).unwrap();
+        assert_eq!(all.len(), 2);
+        assert_eq!(all[0].id, print, "sorted by name");
+        assert_eq!(all[0].place, Some(Place::Local("/mnt/print".into())));
+        assert_eq!(all[1].id, web);
+        assert_eq!(all[1].name, "Web", "trimmed");
+        assert_eq!(all[1].place, Some(Place::Server("Shared/Web".into())));
+        assert_eq!(all[1].sources, 0);
+    }
+
+    #[test]
+    fn an_empty_name_is_refused() {
+        let cat = catalog();
+        let conn = cat.connection();
+        assert!(matches!(
+            create(conn, "  ", &Place::Local("/x".into())),
+            Err(CatalogError::EmptyName)
+        ));
+    }
+
+    #[test]
+    fn exports_link_files_back_to_their_images() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let album = create(conn, "Web", &Place::Local("/out".into())).unwrap();
+        let a = image(conn, "a.cr3");
+        let b = image(conn, "b.cr3");
+
+        record_exports(
+            conn,
+            album,
+            &[
+                (a, "a.jpg".into()),
+                (a, "a (1).jpg".into()),
+                (b, "b.jpg".into()),
+            ],
+        )
+        .unwrap();
+
+        let got = get(conn, album).unwrap().unwrap();
+        assert_eq!(got.sources, 2, "two photographs, three files");
+        let mut s = sources(conn, album).unwrap();
+        s.sort();
+        assert_eq!(s, vec![a, b]);
+        assert_eq!(files_of(conn, album, a).unwrap().len(), 2);
+    }
+
+    #[test]
+    fn an_overwritten_file_points_at_what_wrote_it_last() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let album = create(conn, "Web", &Place::Local("/out".into())).unwrap();
+        let a = image(conn, "a.cr3");
+        let b = image(conn, "b.cr3");
+        record_exports(conn, album, &[(a, "x.jpg".into())]).unwrap();
+        record_exports(conn, album, &[(b, "x.jpg".into())]).unwrap();
+        assert_eq!(sources(conn, album).unwrap(), vec![b]);
+    }
+
+    #[test]
+    fn moving_to_the_server_forgets_the_local_folder() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let album = create(conn, "Web", &Place::Local("/out".into())).unwrap();
+        set_place(conn, album, &Place::Server("Web".into())).unwrap();
+        assert_eq!(
+            get(conn, album).unwrap().unwrap().place,
+            Some(Place::Server("Web".into()))
+        );
+        set_place(conn, album, &Place::Local("/again".into())).unwrap();
+        assert_eq!(
+            get(conn, album).unwrap().unwrap().place,
+            Some(Place::Local("/again".into()))
+        );
+    }
+
+    #[test]
+    fn a_deleted_album_is_gone_and_its_uuid_no_longer_resolves() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let album = create(conn, "Web", &Place::Local("/out".into())).unwrap();
+        let uuid = get(conn, album).unwrap().unwrap().uuid;
+        let a = image(conn, "a.cr3");
+        record_exports(conn, album, &[(a, "a.jpg".into())]).unwrap();
+
+        delete(conn, album).unwrap();
+        assert!(list(conn).unwrap().is_empty());
+        assert_eq!(id_for_uuid(conn, &uuid).unwrap(), None);
+        assert!(matches!(
+            rename(conn, album, "Again"),
+            Err(CatalogError::NoSuchAlbum(_))
+        ));
+    }
+
+    #[test]
+    fn a_rename_bumps_the_revision_the_merge_compares() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let album = create(conn, "Web", &Place::Local("/out".into())).unwrap();
+        rename(conn, album, "Website").unwrap();
+        let rev: i64 = conn
+            .query_row(
+                "SELECT revision FROM albums WHERE id = ?1",
+                [album.0 as i64],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(rev, 2);
+    }
+}
@@ -0,0 +1,417 @@
+//! TRACES: NFR-P9
+//! Which catalog files this process has already backfilled, and as of what.
+//!
+//! # Why this exists
+//!
+//! [`crate::schema::backfill`] used to run inside every [`crate::Catalog::open`],
+//! and every worker thread opens its own connection. Landing on a photograph
+//! in develop opened the catalog five times — the fetch of the original and a
+//! cache check per prefetched neighbour — and each open paid the whole
+//! backfill: an anti-join of every image against its versions, a pass over
+//! every default version's uuid, the unpaired JPEGs and the keyword
+//! vocabulary. On the reference library that was ~12 ms an open and ~60 ms of
+//! CPU a landing, spent confirming that nothing had changed since the open
+//! before.
+//!
+//! # What makes skipping it safe
+//!
+//! Everything the backfill repairs is a row some write *added*: an image
+//! inserted by a scan or an import has no default version and may be the RAW
+//! beside an unpaired JPEG; a version merged or restored from an older build
+//! may carry a minted uuid; a keyword assignment merged from a remote may name
+//! a word with no term. So the question "is any work owed?" is answered by
+//! whether those tables have gained rows since the last backfill, and that is
+//! a read of each table's last row — the last page of its b-tree — rather than
+//! a scan.
+//!
+//! # Why the last row, and not only its id
+//!
+//! None of these tables is `AUTOINCREMENT`, so SQLite hands out the largest
+//! rowid plus one, and an id freed by deleting the newest row is handed out
+//! again. That is an ordinary sequence, not a contrived one: emptying the
+//! trash of the newest photograph and then scanning a new one, or a local
+//! folder's walk removing a renamed file's row and inserting the new name in
+//! the same pass. `max(id)` does not move, and neither does `count(*)`. And
+//! the row that took the id is exactly one that needs the backfill, because
+//! neither scan creates default versions — `persist` and the walk insert the
+//! image and leave the version, the pairing and the keyword terms to the next
+//! open. Skipped, it would go without them until the app restarted: a rating
+//! or a keyword with nowhere to land, a JPEG beside its RAW shown twice.
+//!
+//! So the stamp carries the last row's content as well as its id: the newest
+//! image's path, when it was added, and **whether it has a version**; the
+//! newest version's image; the newest assignment's word and version. Whether
+//! the newest image has a version is the part that cannot be fooled: once the
+//! backfill has run, every image has one, and a row that has just taken a
+//! freed id has none, so the two stamps differ whatever the path and the time
+//! say. The others make the newest version or assignment a different row
+//! whenever a different one took its id; one that is the same content at the
+//! same id is the same row as far as the backfill is concerned.
+//!
+//! The [`Stamp`] is those, the schema version, and the file's identity.
+//! An open whose stamp matches the one recorded at the last backfill of the
+//! same path skips it; anything else runs it. That covers the cases that must
+//! run it:
+//!
+//! - **The first open in a process.** Nothing is recorded yet.
+//! - **A migration.** `user_version` is in the stamp, and [`crate::Catalog::open`]
+//!   also runs the backfill unconditionally whenever `migrate` moved the
+//!   schema, because that is what the backfill was written for.
+//! - **A pulled catalog.** The merge inserts assignments, which moves the
+//!   stamp; and [`crate::sync::merge_remote`] [`forget`]s the path as well, so
+//!   the next open backfills even when every incoming row collided.
+//! - **A file replaced underneath the path** — a restore from backup, a
+//!   rebuild, a catalog copied in. On unix the device and inode are in the
+//!   stamp, and a replacement is a new inode; [`crate::recovery::set_aside`],
+//!   the first step of both a restore and a rebuild, forgets the path too.
+//! - **Another process writing.** The stamp is read from the file, not from
+//!   anything this process did, so a scan in a second instance moves it just
+//!   the same.
+//!
+//! # Why the stamp is taken before the backfill
+//!
+//! The backfill adds versions and terms itself, so a stamp read afterwards
+//! would describe its own writes. Read afterwards it could also describe an
+//! image another connection inserted between the backfill's read and the
+//! stamp's — and record that image as covered when it was not. Read before,
+//! the worst case is the reverse: the backfill's own inserts move the stamp,
+//! and the next open runs one more backfill that finds nothing. That costs one
+//! redundant pass after a backfill that did real work, and never misses a row.
+//!
+//! # What it does not see
+//!
+//! An `UPDATE` that creates work without adding a row. None of this build's
+//! writers does: a scan's move of a file is a new `source_ref` and so a new
+//! image, and uuids are only rewritten by the backfill itself. Should one
+//! appear, the cost is that its repair waits for the next insert or the next
+//! start of the app — which is exactly where the backfill ran before it ran on
+//! every open.
+//!
+//! Kept in memory rather than in the catalog on purpose: a row in the file
+//! would travel in the sync snapshot and would need a table an older build
+//! does not have, and a flag that another device's catalog carried in would
+//! say nothing about this one.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Mutex, OnceLock};
+
+use rusqlite::Connection;
+
+use crate::error::CatalogError;
+
+/// What a catalog looked like, as far as the backfill cares.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct Stamp {
+    /// Device and inode, so a file swapped in under the same name is a new
+    /// catalog. `None` where the platform has no such thing.
+    file: Option<(u64, u64)>,
+    user_version: i64,
+    /// The newest image: id, path, when added, and whether it has a version.
+    last_image: Option<String>,
+    /// The newest version: id and the image it belongs to.
+    last_version: Option<String>,
+    /// The newest keyword assignment: rowid, version and word.
+    last_keyword: Option<String>,
+}
+
+/// The stamp recorded at the last backfill, per catalog file.
+fn done() -> &'static Mutex<HashMap<PathBuf, Stamp>> {
+    static DONE: OnceLock<Mutex<HashMap<PathBuf, Stamp>>> = OnceLock::new();
+    DONE.get_or_init(Default::default)
+}
+
+/// One name per file, whichever spelling of its path the caller used.
+fn key(path: &Path) -> PathBuf {
+    std::fs::canonicalize(path).unwrap_or_else(|_| path.to_path_buf())
+}
+
+/// Read the stamp of the catalog behind `conn`, which was opened from `path`.
+///
+/// One statement: the last row of each of three tables, each found by
+/// descending its rowid b-tree to the last page, plus one probe of
+/// `versions_image` for the newest image — and a `stat` of the file.
+pub(crate) fn stamp(conn: &Connection, path: &Path) -> Result<Stamp, CatalogError> {
+    let (user_version, last_image, last_version, last_keyword) = conn.query_row(
+        "SELECT (SELECT user_version FROM pragma_user_version),
+                (SELECT printf('%d|%d|%d|%s', i.id, i.added_at,
+                               EXISTS (SELECT 1 FROM versions v WHERE v.image_id = i.id),
+                               i.source_ref)
+                   FROM images i ORDER BY i.id DESC LIMIT 1),
+                (SELECT printf('%d|%d', id, image_id)
+                   FROM versions ORDER BY id DESC LIMIT 1),
+                (SELECT printf('%d|%d|%s', rowid, version_id, keyword)
+                   FROM keywords ORDER BY rowid DESC LIMIT 1)",
+        [],
+        |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?)),
+    )?;
+    Ok(Stamp {
+        file: file_identity(path),
+        user_version,
+        last_image,
+        last_version,
+        last_keyword,
+    })
+}
+
+#[cfg(unix)]
+fn file_identity(path: &Path) -> Option<(u64, u64)> {
+    use std::os::unix::fs::MetadataExt;
+    std::fs::metadata(path).ok().map(|m| (m.dev(), m.ino()))
+}
+
+#[cfg(not(unix))]
+fn file_identity(_path: &Path) -> Option<(u64, u64)> {
+    None
+}
+
+/// Whether the catalog at `path` was last backfilled at exactly `stamp`.
+pub(crate) fn is_current(path: &Path, stamp: &Stamp) -> bool {
+    done()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .get(&key(path))
+        == Some(stamp)
+}
+
+/// Record that the catalog at `path` has been backfilled as of `stamp`.
+pub(crate) fn record(path: &Path, stamp: Stamp) {
+    done()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .insert(key(path), stamp);
+}
+
+/// Make the next open of `path` backfill, whatever its stamp says.
+///
+/// For the writers that know they have changed the catalog wholesale — a
+/// merge of a pulled catalog, a restore from backup — so their correctness
+/// does not rest on the stamp happening to move.
+pub(crate) fn forget(path: &Path) {
+    done()
+        .lock()
+        .unwrap_or_else(|e| e.into_inner())
+        .remove(&key(path));
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::rating::derived_version_uuid;
+    use crate::Catalog;
+    use std::path::PathBuf;
+
+    /// A catalog file of its own, holding one image the server has named,
+    /// backfilled and settled.
+    ///
+    /// Opened three times on the way: to create it; after the image went in,
+    /// which gives the image its default version; and once more, because that
+    /// version moved the stamp and the next open runs the one redundant pass
+    /// the module header describes. After that the stamp stands still.
+    fn catalog(tag: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "dr-backfilled-{tag}-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("catalog.sqlite");
+        {
+            let cat = Catalog::open(&path).unwrap();
+            let c = cat.connection();
+            c.execute_batch(
+                "INSERT INTO roots(id, kind, label) VALUES (1, 'remote', 'Photos');
+                 INSERT INTO images(id, root_id, source_ref, added_at)
+                      VALUES (1, 1, 'Photos/a.CR3', 0);
+                 INSERT INTO remote(image_id, file_id) VALUES (1, 77);",
+            )
+            .unwrap();
+        }
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+        path
+    }
+
+    /// The default version's uuid for `image`, read through an ordinary open.
+    fn uuid(path: &std::path::Path, image: i64) -> Option<String> {
+        let cat = Catalog::open(path).unwrap();
+        cat.connection()
+            .query_row(
+                "SELECT uuid FROM versions WHERE image_id = ?1 AND is_default = 1",
+                [image],
+                |r| r.get(0),
+            )
+            .ok()
+    }
+
+    /// Put the one row back into the state the backfill repairs, with an
+    /// `UPDATE` — which moves none of the stamp's maxima, so only the stamp's
+    /// other parts or an explicit `forget` can bring the backfill back.
+    fn unalign(path: &std::path::Path) {
+        rusqlite::Connection::open(path)
+            .unwrap()
+            .execute("UPDATE versions SET uuid = 'minted' WHERE image_id = 1", [])
+            .unwrap();
+    }
+
+    #[test]
+    fn an_unchanged_catalog_is_not_backfilled_again() {
+        let path = catalog("unchanged");
+        unalign(&path);
+        assert_eq!(
+            uuid(&path, 1).as_deref(),
+            Some("minted"),
+            "nothing was added since the last backfill, so the open skipped it"
+        );
+    }
+
+    #[test]
+    fn an_image_a_scan_added_is_backfilled_on_the_next_open() {
+        let path = catalog("scanned");
+        rusqlite::Connection::open(&path)
+            .unwrap()
+            .execute(
+                "INSERT INTO images(id, root_id, source_ref, added_at)
+                 VALUES (2, 1, 'Photos/b.CR3', 0)",
+                [],
+            )
+            .unwrap();
+        assert!(uuid(&path, 2).is_some(), "the new image got its version");
+    }
+
+    /// The id of a deleted newest row is handed out again, so `max(id)` is
+    /// the same before and after — the sequence emptying the trash and then
+    /// scanning makes. The image that took the id still needs its version.
+    ///
+    /// A virtual copy on the older image holds the newest version id, so
+    /// the deletion does not move `max(versions.id)` either: nothing the old
+    /// stamp read changes, which is the case that went unrepaired.
+    #[test]
+    fn an_image_that_reuses_a_deleted_id_is_backfilled_on_the_next_open() {
+        let path = catalog("reused");
+        rusqlite::Connection::open(&path)
+            .unwrap()
+            .execute(
+                "INSERT INTO images(id, root_id, source_ref, added_at)
+                 VALUES (2, 1, 'Photos/b.CR3', 0)",
+                [],
+            )
+            .unwrap();
+        assert!(uuid(&path, 2).is_some());
+        rusqlite::Connection::open(&path)
+            .unwrap()
+            .execute(
+                "INSERT INTO versions(image_id, uuid, name, is_default)
+                 VALUES (1, 'copy', 'Crop', 0)",
+                [],
+            )
+            .unwrap();
+        // Settle: one open backfills after the new version, one more runs
+        // the redundant pass and records the stamp that stands.
+        assert!(uuid(&path, 2).is_some());
+        assert!(uuid(&path, 2).is_some());
+
+        let c = rusqlite::Connection::open(&path).unwrap();
+        let before: (i64, i64) = c
+            .query_row(
+                "SELECT (SELECT max(id) FROM images), (SELECT max(id) FROM versions)",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        c.execute("DELETE FROM images WHERE id = 2", []).unwrap();
+        c.execute(
+            "INSERT INTO images(root_id, source_ref, added_at)
+             VALUES (1, 'Photos/c.CR3', 0)",
+            [],
+        )
+        .unwrap();
+        let after: (i64, i64) = c
+            .query_row(
+                "SELECT (SELECT max(id) FROM images), (SELECT max(id) FROM versions)",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        assert_eq!(before, after, "SQLite handed the freed id out again");
+        drop(c);
+        assert!(uuid(&path, 2).is_some(), "the new image got its version");
+    }
+
+    /// The same, with the same file coming back at the same id in the same
+    /// second: path and time match, and only the missing version tells.
+    #[test]
+    fn the_same_file_back_at_the_same_id_is_backfilled_on_the_next_open() {
+        let path = catalog("returned");
+        let c = rusqlite::Connection::open(&path).unwrap();
+        // As above: a newer version on another image keeps the deletion
+        // from moving `max(versions.id)`.
+        c.execute_batch(
+            "INSERT INTO images(id, root_id, source_ref, added_at)
+                  VALUES (0, 1, 'Photos/0.CR3', 0);
+             INSERT INTO versions(image_id, uuid, name, is_default)
+                  VALUES (0, 'copy', 'Crop', 0);",
+        )
+        .unwrap();
+        drop(c);
+        assert!(uuid(&path, 1).is_some());
+        assert!(uuid(&path, 1).is_some());
+        let c = rusqlite::Connection::open(&path).unwrap();
+        c.execute_batch(
+            "DELETE FROM images WHERE id = 1;
+             INSERT INTO images(id, root_id, source_ref, added_at)
+                  VALUES (1, 1, 'Photos/a.CR3', 0);
+             INSERT INTO remote(image_id, file_id) VALUES (1, 77);",
+        )
+        .unwrap();
+        drop(c);
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+    }
+
+    #[test]
+    fn the_first_open_after_a_migration_backfills() {
+        let path = catalog("migrated");
+        unalign(&path);
+        rusqlite::Connection::open(&path)
+            .unwrap()
+            .pragma_update(None, "user_version", crate::schema::SCHEMA_VERSION - 1)
+            .unwrap();
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+    }
+
+    #[test]
+    fn the_first_open_after_a_pulled_catalog_backfills() {
+        let path = catalog("pulled");
+        // The remote is this catalog as it stands, so every row the merge
+        // offers collides and nothing in the stamp moves: only the merge
+        // saying so can make the next open backfill.
+        let remote = path.with_file_name("remote.sqlite");
+        rusqlite::Connection::open(&path)
+            .unwrap()
+            .execute("VACUUM INTO ?1", [remote.to_string_lossy().as_ref()])
+            .unwrap();
+        unalign(&path);
+        assert_eq!(uuid(&path, 1).as_deref(), Some("minted"));
+
+        Catalog::open(&path)
+            .unwrap()
+            .merge_remote_catalog(&remote)
+            .unwrap();
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_catalog_replaced_under_the_same_name_backfills() {
+        let path = catalog("replaced");
+        unalign(&path);
+        assert_eq!(uuid(&path, 1).as_deref(), Some("minted"));
+        // Every connection is closed, so the WAL is folded in and the main
+        // file is the whole catalog. A copy renamed over it is the same rows
+        // in a new file — which is what a restore or a copied-in catalog is.
+        let copy = path.with_file_name("copy.sqlite");
+        std::fs::copy(&path, &copy).unwrap();
+        std::fs::rename(&copy, &path).unwrap();
+        assert_eq!(uuid(&path, 1), Some(derived_version_uuid(77)));
+    }
+}
@@ -82,7 +82,7 @@
 //! Grouping has no natural `subject_id`: it is a property of a *run* of frames,
 //! so a per-image job would rebuild the world once per photograph. It is
 //! therefore a debounced library-level pass, for exactly the reasons
-//! docs/catalog.md §10.2 gives for face clustering, and [`regroup`] is the whole
+//! docs/dev/catalog.md §10.2 gives for face clustering, and [`regroup`] is the whole
 //! of it — one ordered walk, no per-pair comparison beyond adjacent frames.
 //!
 //! # Grouping is not hiding
@@ -722,6 +722,31 @@ pub fn not_collapsed_away(image: &str) -> String {
    )
 }

+/// SQL for the rows [`not_collapsed_away`] drops, as a `FROM ... WHERE`
+/// joining each such frame to its image under the alias `image`.
+///
+/// For counting. A count that applies [`not_collapsed_away`] to every row
+/// pays two primary-key probes per image to find the handful a collapsed
+/// burst hides; counting everything and subtracting what this lists walks
+/// only `burst_members`, which is empty on a library without bursts. The
+/// caller appends its own conditions on `image` with `AND`, the same ones
+/// it counted the whole with, so the subtraction takes away only rows the
+/// whole included. `image_id` is `burst_members`' key, so no image is
+/// listed twice.
+///
+/// The two must describe the same rows: change one, change both, and
+/// `the_collapsed_frames_are_what_the_predicate_drops` will say if they drift.
+///
+/// Never interpolate anything user-supplied as `image`.
+pub fn collapsed_away_frames(image: &str) -> String {
+    format!(
+        "burst_members bm CROSS JOIN images {image} ON {image}.id = bm.image_id
+          WHERE bm.representative = 0
+            AND NOT EXISTS (SELECT 1 FROM burst_expanded be
+                             WHERE be.burst_id = bm.burst_id)"
+    )
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -1235,6 +1260,46 @@ mod tests {
        assert_eq!(visible(cat.connection()), vec![1, 2, 3, 4]);
    }

+    #[test]
+    fn the_collapsed_frames_are_what_the_predicate_drops() {
+        // `collapsed_away_frames` is `not_collapsed_away` turned inside out
+        // for counting; the two must name the same rows, open or closed.
+        let cat = seeded(&[
+            (1, 1000, Some(0xFF00)),
+            (2, 1001, Some(0xFF00)),
+            (3, 1002, Some(0xFF00)),
+            (4, 9000, Some(0xAA00)),
+            (5, 9001, Some(0xAA00)),
+            (6, 20000, Some(0xFF00)),
+        ]);
+        regroup(cat.connection(), Rules::default()).unwrap();
+        let ids = |sql: String| -> Vec<i64> {
+            let c = cat.connection();
+            let mut stmt = c.prepare(&sql).unwrap();
+            let rows = stmt.query_map([], |r| r.get::<_, i64>(0)).unwrap();
+            rows.collect::<Result<Vec<_>, _>>().unwrap()
+        };
+        let dropped = || {
+            ids(format!(
+                "SELECT id FROM images i WHERE NOT {} ORDER BY id",
+                not_collapsed_away("i")
+            ))
+        };
+        let listed = || {
+            ids(format!(
+                "SELECT i.id FROM {} ORDER BY i.id",
+                collapsed_away_frames("i")
+            ))
+        };
+
+        assert_eq!(listed(), dropped());
+        set_expanded(cat.connection(), ImageId(1), false).unwrap();
+        assert_eq!(dropped(), vec![2, 3]);
+        assert_eq!(listed(), dropped());
+        set_expanded(cat.connection(), ImageId(4), false).unwrap();
+        assert_eq!(listed(), dropped());
+    }
+
    #[test]
    fn a_library_with_no_bursts_hides_nothing() {
        // The predicate is in every grid query, so its cost and its effect on a
@@ -65,6 +65,16 @@ pub enum CatalogError {
    #[error("no such collection: {0}")]
    NoSuchCollection(u64),

+    /// An album the caller named is gone — deleted here, or by a merge while
+    /// its id sat in a UI model.
+    #[error("no such album: {0}")]
+    NoSuchAlbum(u64),
+
+    /// A name that is empty once trimmed. Refused rather than stored, because
+    /// a row with no name is one the sidebar cannot draw and nobody can pick.
+    #[error("a name is required")]
+    EmptyName,
+
    /// A keyword the caller named is gone — deleted, or fused into another by a
    /// merge while its id sat in a UI model.
    ///
@@ -96,6 +106,13 @@ pub enum CatalogError {

    #[error("io: {0}")]
    Io(String),
+
+    /// TRACES: FR-CAT-11a
+    /// A duplicate group planned earlier no longer holds: a copy was trashed,
+    /// rescanned or changed since the review was drawn. The group is left
+    /// untouched rather than consolidated on a stale plan.
+    #[error("no longer a duplicate: {0}")]
+    StaleDuplicate(String),
 }

 impl From<rusqlite::Error> for CatalogError {
@@ -2,7 +2,7 @@
 //! Face data as sealed shards, so a second device does not re-index the library.
 //!
 //! Indexing a 23,500-image library is on the order of two hours of CPU
-//! (docs/faces.md §12.2). It is also **byte-identical on every device**: the
+//! (docs/dev/faces.md §12.2). It is also **byte-identical on every device**: the
 //! same model over the same proxy produces the same embedding. Paying for it
 //! once per account rather than once per device is the whole point of this
 //! module, and it is the same bargain the thumbnail store already makes.
@@ -30,6 +30,7 @@
 //! identity every client agrees on (FR-NC-5), and it survives a server-side
 //! move, so a shard written before a reorganisation still applies after it.

+use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};

 use rusqlite::{Connection, OptionalExtension};
@@ -48,9 +49,10 @@ pub const SHARD_MAX_BYTES: u64 = dr_thumbs::SHARD_MAX_BYTES;
 /// Bytes one stored face occupies, near enough to bound a shard by.
 ///
 /// Counted rather than measured: the embedding is fixed at 512 × f16, the
-/// landmarks at 5 × 2 × f32, and the rest is a handful of numbers. Measuring
+/// landmarks at 5 × 2 × f32 and the dense ones at 106 × 2 × u16, and the
+/// rest is a handful of numbers. Measuring
 /// the file after each insert would mean a `VACUUM` to get an honest answer.
-const BYTES_PER_FACE: u64 = 1024 + 40 + 64;
+const BYTES_PER_FACE: u64 = 1024 + 40 + 424 + 64;

 /// Bytes a stored crop occupies, near enough to bound a shard by.
 ///
@@ -76,6 +78,14 @@ pub struct SharedFace {
    pub confidence: f32,
    pub embedding: Vec<u8>,
    pub crop_px: f32,
+    /// See `faces::DetectedFace::quality`. `None` from a shard written before
+    /// the number was kept.
+    pub quality: Option<f32>,
+    /// See `faces::DetectedFace::eyes`. `None` from a peer without the eye
+    /// models, or a shard written before they existed.
+    pub eyes: Option<dr_face::EyeReading>,
+    /// See `faces::DetectedFace::landmarks_dense`; empty where none.
+    pub landmarks_dense: Vec<u8>,
    /// The face cut out and encoded, or empty where none was kept.
    ///
    /// Travels with the face rather than in the catalog snapshot, which is the
@@ -146,6 +156,129 @@ impl FaceShardStore {
            .flatten()
    }

+    /// [`indexed_at`](Self::indexed_at) for every entry at once.
+    ///
+    /// What a pass over the whole library asks instead of one lookup per image:
+    /// the export compares every marker in the catalog with this, and a lookup
+    /// each was 19,000 statements prepared and run on every sync pass that had
+    /// nothing to send.
+    fn all_indexed_at(&self) -> Result<HashMap<(u64, String), Option<i64>>, CatalogError> {
+        let mut q = self
+            .index
+            .prepare("SELECT file_id, model_id, indexed_at FROM entries")?;
+        let rows = q.query_map([], |r| {
+            Ok((
+                (r.get::<_, i64>(0)? as u64, r.get::<_, String>(1)?),
+                r.get::<_, Option<i64>>(2)?,
+            ))
+        })?;
+        Ok(rows.collect::<Result<_, _>>()?)
+    }
+
+    /// [`held_model`](Self::held_model) for every file at once: one statement,
+    /// ordered exactly as that one is, keeping the first row per file.
+    fn all_held_models(&self, model_id: &str) -> Result<HashMap<u64, String>, CatalogError> {
+        let mut q = self.index.prepare(&format!(
+            "SELECT file_id, model_id FROM entries
+              WHERE {} = ?1
+              ORDER BY file_id, indexed_at DESC NULLS LAST, model_id",
+            crate::faces::embedder_sql("model_id")
+        ))?;
+        let rows = q.query_map([crate::faces::embedder_of(model_id)], |r| {
+            Ok((r.get::<_, i64>(0)? as u64, r.get::<_, String>(1)?))
+        })?;
+        let mut out = HashMap::new();
+        for row in rows {
+            let (file, model) = row?;
+            out.entry(file).or_insert(model);
+        }
+        Ok(out)
+    }
+
+    /// The pipeline this store holds an image under, among those sharing
+    /// `model_id`'s embedder — the most recently indexed where a peer has
+    /// sent more than one.
+    ///
+    /// What the import asks: not "has anyone run *this* detector over it" but
+    /// "does anyone hold comparable faces for it". See `faces::embedder_of`.
+    pub fn held_model(&self, file_id: u64, model_id: &str) -> Option<String> {
+        self.index
+            .query_row(
+                &format!(
+                    "SELECT model_id FROM entries
+                      WHERE file_id = ?1 AND {} = ?2
+                      ORDER BY indexed_at DESC NULLS LAST, model_id",
+                    crate::faces::embedder_sql("model_id")
+                ),
+                rusqlite::params![file_id as i64, crate::faces::embedder_of(model_id)],
+                |r| r.get::<_, String>(0),
+            )
+            .optional()
+            .ok()
+            .flatten()
+    }
+
+    /// The other pipelines this file is held under that share `model_id`'s
+    /// embedder — the generations a put of `model_id` may supersede.
+    fn siblings(&self, file_id: u64, model_id: &str) -> Vec<String> {
+        let mut stmt = match self.index.prepare(&format!(
+            "SELECT model_id FROM entries
+              WHERE file_id = ?1 AND model_id != ?2 AND {} = ?3",
+            crate::faces::embedder_sql("model_id")
+        )) {
+            Ok(s) => s,
+            Err(_) => return Vec::new(),
+        };
+        stmt.query_map(
+            rusqlite::params![
+                file_id as i64,
+                model_id,
+                crate::faces::embedder_of(model_id)
+            ],
+            |r| r.get::<_, String>(0),
+        )
+        .map(|rows| rows.filter_map(|r| r.ok()).collect())
+        .unwrap_or_default()
+    }
+
+    /// Whether a pass this file is already held under outranks `model_id`,
+    /// so a put of `model_id` would add a generation nobody would adopt.
+    pub fn outranked(&self, file_id: u64, model_id: &str) -> bool {
+        use dr_types::FaceDetector;
+        let Some(incoming) = FaceDetector::for_model_id(model_id) else {
+            return false;
+        };
+        self.siblings(file_id, model_id)
+            .iter()
+            .filter_map(|m| FaceDetector::for_model_id(m))
+            .any(|held| held.outranks(incoming))
+    }
+
+    /// Forget the index entries for generations of this file that `model_id`
+    /// outranks. The bytes stay where they are — a sealed shard is
+    /// immutable — but the store stops offering them, and a later export or
+    /// merge writes nothing for them again.
+    fn supersede(&self, file_id: u64, model_id: &str) -> Result<(), CatalogError> {
+        use dr_types::FaceDetector;
+        let Some(incoming) = FaceDetector::for_model_id(model_id) else {
+            return Ok(());
+        };
+        for held in self.siblings(file_id, model_id) {
+            let weaker = FaceDetector::for_model_id(&held).is_some_and(|h| incoming.outranks(h));
+            if weaker {
+                self.index.execute(
+                    "DELETE FROM entries WHERE file_id = ?1 AND model_id = ?2",
+                    rusqlite::params![file_id as i64, held],
+                )?;
+                self.index.execute(
+                    "DELETE FROM faces_meta WHERE file_id = ?1 AND model_id = ?2",
+                    rusqlite::params![file_id as i64, held],
+                )?;
+            }
+        }
+        Ok(())
+    }
+
    pub fn contains(&self, file_id: u64, model_id: &str) -> bool {
        self.index
            .query_row(
@@ -201,6 +334,15 @@ impl FaceShardStore {
        faces: &[SharedFace],
        indexed_at: Option<i64>,
    ) -> Result<u32, CatalogError> {
+        // One generation per image per embedder. A store carried every pass
+        // — 24,123 entries for 19,089 images on the reference library, a
+        // third of its 293 MB — and only the strongest was ever adopted.
+        // A weaker pass arriving after a stronger one is not written; a
+        // stronger one arriving retires the weaker from the index.
+        if self.outranked(file_id, model_id) {
+            return Ok(0);
+        }
+        self.supersede(file_id, model_id)?;
        let incoming = faces
            .iter()
            .map(|f| BYTES_PER_FACE + if f.crop.is_empty() { 0 } else { BYTES_PER_CROP })
@@ -224,8 +366,12 @@ impl FaceShardStore {
            tx.execute(
                "INSERT INTO faces
                     (file_id, model_id, x, y, w, h, landmarks, confidence,
-                      embedding, crop_px, crop)
-                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11)",
+                      embedding, crop_px, crop, quality,
+                      eye_right, eye_right_px, eye_right_sharp,
+                      eye_left, eye_left_px, eye_left_sharp, sunglasses,
+                      landmarks_dense)
+                 VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12,
+                         ?13, ?14, ?15, ?16, ?17, ?18, ?19, ?20)",
                rusqlite::params![
                    f.file_id as i64,
                    f.model_id,
@@ -238,6 +384,15 @@ impl FaceShardStore {
                    f.embedding,
                    f.crop_px as f64,
                    (!f.crop.is_empty()).then_some(f.crop.as_slice()),
+                    f.quality.map(f64::from),
+                    f.eyes.map(|e| f64::from(e.right.open)),
+                    f.eyes.map(|e| f64::from(e.right.px)),
+                    f.eyes.map(|e| f64::from(e.right.sharpness)),
+                    f.eyes.map(|e| f64::from(e.left.open)),
+                    f.eyes.map(|e| f64::from(e.left.px)),
+                    f.eyes.map(|e| f64::from(e.left.sharpness)),
+                    f.eyes.map(|e| f64::from(e.sunglasses)),
+                    (!f.landmarks_dense.is_empty()).then_some(f.landmarks_dense.as_slice()),
                ],
            )?;
        }
@@ -429,32 +584,67 @@ impl FaceShardStore {
            rusqlite::OpenFlags::SQLITE_OPEN_READ_ONLY | rusqlite::OpenFlags::SQLITE_OPEN_NO_MUTEX,
        )?;

-        let mut q =
-            src.prepare("SELECT file_id, model_id, faces_found, source_edge FROM indexed")?;
-        let images: Vec<(i64, String, i64, i64)> = q
-            .query_map([], |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?)))?
+        // The peer's marker travels with the image: it is what lets
+        // `import_from_shards` record the adoption under the time the peer
+        // indexed it, and so what keeps `export_to_shards` from reading the
+        // adoption as a re-index and sending the peer's faces back out under
+        // this device's name. A shard from before the column has none.
+        let mut q = src.prepare(&format!(
+            "SELECT file_id, model_id, faces_found, source_edge, {} FROM indexed",
+            match has_column(&src, "indexed", "indexed_at") {
+                Ok(true) => "indexed_at",
+                _ => "NULL",
+            }
+        ))?;
+        let images: Vec<(i64, String, i64, i64, Option<i64>)> = q
+            .query_map([], |r| {
+                Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?))
+            })?
            .collect::<Result<_, _>>()?;

        let mut adopted = 0;
-        for (file_id, model_id, _found, edge) in images {
-            if self.contains(file_id as u64, &model_id) {
+        for (file_id, model_id, _found, edge, indexed_at) in images {
+            if self.contains(file_id as u64, &model_id) || self.outranked(file_id as u64, &model_id)
+            {
                continue;
            }
            let mut fq = src.prepare(&format!(
                "SELECT f.file_id, f.model_id, f.x, f.y, f.w, f.h, f.landmarks,
-                        f.confidence, f.embedding, f.crop_px, {}
+                        f.confidence, f.embedding, f.crop_px, {}, {}, {}, {}
                   FROM faces f WHERE f.file_id = ?1 AND f.model_id = ?2",
-                crop_column(&src)
+                column_or_null(&src, "crop"),
+                column_or_null(&src, "quality"),
+                crate::schema::EYE_COLUMNS
+                    .iter()
+                    .map(|c| column_or_null(&src, c))
+                    .collect::<Vec<_>>()
+                    .join(", "),
+                column_or_null(&src, "landmarks_dense"),
            ))?;
            let faces: Vec<SharedFace> = fq
                .query_map(rusqlite::params![file_id, &model_id], read_shared_face)?
                .collect::<Result<_, _>>()?;
-            self.put_image(file_id as u64, &model_id, edge as u32, &faces)?;
+            self.put_image_at(file_id as u64, &model_id, edge as u32, &faces, indexed_at)?;
            adopted += 1;
        }
        Ok(adopted)
    }

+    /// Record when the catalog indexed a held image, for an entry that
+    /// arrived without a marker — a peer's shard from before the column.
+    pub fn set_indexed_at(
+        &self,
+        file_id: u64,
+        model_id: &str,
+        at: i64,
+    ) -> Result<(), CatalogError> {
+        self.index.execute(
+            "UPDATE entries SET indexed_at = ?3 WHERE file_id = ?1 AND model_id = ?2",
+            rusqlite::params![file_id as i64, model_id, at],
+        )?;
+        Ok(())
+    }
+
    /// Read back everything held for one image.
    pub fn get_image(
        &self,
@@ -484,7 +674,9 @@ impl FaceShardStore {
        let Some(edge) = edge else { return Ok(None) };

        let mut q = conn.prepare(
-            "SELECT file_id, model_id, x, y, w, h, landmarks, confidence, embedding, crop_px, crop
+            "SELECT file_id, model_id, x, y, w, h, landmarks, confidence, embedding, crop_px,
+                    crop, quality, eye_right, eye_right_px, eye_right_sharp,
+                    eye_left, eye_left_px, eye_left_sharp, sunglasses, landmarks_dense
               FROM faces WHERE file_id = ?1 AND model_id = ?2",
        )?;
        let faces: Vec<SharedFace> = q
@@ -541,6 +733,15 @@ fn upgrade_shard(conn: &Connection) -> Result<(), CatalogError> {
    for (table, column, decl) in [
        ("faces", "crop", "BLOB"),
        ("indexed", "indexed_at", "INTEGER"),
+        ("faces", "quality", "REAL"),
+        ("faces", "eye_right", "REAL"),
+        ("faces", "eye_right_px", "REAL"),
+        ("faces", "eye_right_sharp", "REAL"),
+        ("faces", "eye_left", "REAL"),
+        ("faces", "eye_left_px", "REAL"),
+        ("faces", "eye_left_sharp", "REAL"),
+        ("faces", "sunglasses", "REAL"),
+        ("faces", "landmarks_dense", "BLOB"),
    ] {
        if !has_column(conn, table, column)? {
            conn.execute_batch(&format!("ALTER TABLE {table} ADD COLUMN {column} {decl}"))?;
@@ -555,16 +756,19 @@ fn has_column(conn: &Connection, table: &str, column: &str) -> Result<bool, Cata
    Ok(stmt.exists(rusqlite::params![table, column])?)
 }

-/// `f.crop`, or a `NULL` standing in for it.
+/// `f.<column>`, or a `NULL` standing in for it.
 ///
 /// A shard downloaded from a peer is opened **read-only** and cannot be
-/// upgraded, so one written before crops existed has to be read as it is rather
-/// than repaired. Selecting a literal keeps the column count the same, which is
-/// what lets [`read_shared_face`] stay a single function.
-fn crop_column(conn: &Connection) -> &'static str {
-    match has_column(conn, "faces", "crop") {
-        Ok(true) => "f.crop",
-        _ => "NULL",
+/// upgraded, so one written before a column existed has to be read as it is
+/// rather than repaired. Selecting a literal keeps the column count the same,
+/// which is what lets [`read_shared_face`] stay a single function.
+///
+/// `column` is one of this module's own names, never anything read from
+/// outside, which is what makes formatting it into SQL acceptable.
+fn column_or_null(conn: &Connection, column: &str) -> String {
+    match has_column(conn, "faces", column) {
+        Ok(true) => format!("f.{column}"),
+        _ => "NULL".to_string(),
    }
 }

@@ -598,16 +802,21 @@ pub fn export_to_shards_reporting(
    model_id: &str,
    progress: &mut dyn FnMut(usize, usize),
 ) -> Result<usize, CatalogError> {
-    let mut q = conn.prepare(
-        "SELECT r.file_id, fi.image_id, fi.source_edge, fi.indexed_at
+    // Every pipeline sharing this one's embedder, each image under the id
+    // that actually indexed it. A device that switched detectors still holds
+    // most of its library under the previous id, and those faces are exactly
+    // as comparable — and as wanted by a peer — as the new ones.
+    let mut q = conn.prepare(&format!(
+        "SELECT r.file_id, fi.image_id, fi.source_edge, fi.indexed_at, fi.model_id
           FROM face_index fi
           JOIN remote r ON r.image_id = fi.image_id
-          WHERE fi.model_id = ?1
+          WHERE {} = ?1
          ORDER BY fi.image_id",
-    )?;
-    let rows: Vec<(i64, i64, i64, i64)> = q
-        .query_map([model_id], |r| {
-            Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?))
+        crate::faces::embedder_sql("fi.model_id")
+    ))?;
+    let rows: Vec<(i64, i64, i64, i64, String)> = q
+        .query_map([crate::faces::embedder_of(model_id)], |r| {
+            Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?, r.get(4)?))
        })?
        .collect::<Result<_, _>>()?;

@@ -615,9 +824,22 @@ pub fn export_to_shards_reporting(
    /// enough that the reporting is lost in the write it accompanies.
    const REPORT_EVERY: usize = 25;

+    // What the store holds, read once. A put below rewrites only its own
+    // file's entries -- its generation, and siblings it supersedes -- so a
+    // file already written in this pass is asked of the store again and every
+    // other answer is the one a lookup would have given.
+    //
+    // An index that cannot be read answers as each lookup did: nothing held.
+    let held = store.all_indexed_at().unwrap_or_else(|e| {
+        log::debug!("reading the shard index: {e}");
+        HashMap::new()
+    });
+    let mut written: HashSet<u64> = HashSet::new();
+
    let total = rows.len();
    let mut exported = 0;
-    for (seen, (file_id, image_id, edge, indexed_at)) in rows.into_iter().enumerate() {
+    for (seen, (file_id, image_id, edge, indexed_at, model_id)) in rows.into_iter().enumerate() {
+        let model_id = model_id.as_str();
        if seen.is_multiple_of(REPORT_EVERY) {
            progress(seen, total);
        }
@@ -630,14 +852,20 @@ pub fn export_to_shards_reporting(
        //
        // The comparison is against when the *catalog* indexed it, so a
        // re-index is visible and an unchanged image still costs nothing.
-        if store
-            .indexed_at(file_id as u64, model_id)
-            .is_some_and(|was| was >= indexed_at)
-        {
+        let was = if written.contains(&(file_id as u64)) {
+            store.indexed_at(file_id as u64, model_id)
+        } else {
+            held.get(&(file_id as u64, model_id.to_string()))
+                .copied()
+                .flatten()
+        };
+        if was.is_some_and(|was| was >= indexed_at) {
            continue;
        }
        let mut fq = conn.prepare(
-            "SELECT x, y, w, h, landmarks, detector_confidence, embedding, crop_px, crop
+            "SELECT x, y, w, h, landmarks, detector_confidence, embedding, crop_px, crop,
+                    quality, eye_right, eye_right_px, eye_right_sharp,
+                    eye_left, eye_left_px, eye_left_sharp, sunglasses, landmarks_dense
               FROM faces WHERE image_id = ?1 AND model_id = ?2",
        )?;
        let faces: Vec<SharedFace> = fq
@@ -654,6 +882,9 @@ pub fn export_to_shards_reporting(
                    embedding: r.get(6)?,
                    crop_px: r.get::<_, f64>(7)? as f32,
                    crop: r.get::<_, Option<Vec<u8>>>(8)?.unwrap_or_default(),
+                    quality: r.get::<_, Option<f64>>(9)?.map(|q| q as f32),
+                    eyes: crate::faces::read_eyes(r, 10)?,
+                    landmarks_dense: r.get::<_, Option<Vec<u8>>>(17)?.unwrap_or_default(),
                })
            })?
            .collect::<Result<_, _>>()?;
@@ -665,6 +896,7 @@ pub fn export_to_shards_reporting(
            &faces,
            Some(indexed_at),
        )?;
+        written.insert(file_id as u64);
        exported += 1;
    }
    progress(total, total);
@@ -677,10 +909,20 @@ pub fn export_to_shards_reporting(
 /// adopted rather than re-detected, which is the difference between a new
 /// device being useful in a minute and in two hours.
 ///
-/// Skips any image this device has already indexed itself. Local work is not
-/// second-guessed by a peer's — the two should agree, since the same model over
-/// the same proxy is deterministic, but where they do not, the copy this device
-/// computed is the one it can vouch for.
+/// Skips any image this device has already indexed itself under this
+/// pipeline or any sharing its embedder — unless the peer ran a detector that
+/// outranks the one that indexed it here. Local work is not second-guessed
+/// by a peer's equal: the two should agree, since the same model over the
+/// same proxy is deterministic, and where they do not, the copy this device
+/// computed is the one it can vouch for. A peer's *stronger* pass is another
+/// matter: it is the re-detection this device's own sweep would queue
+/// (`FaceDetector::supersedes`), already done, and taking it is what spares
+/// a tablet the fetch. Names survive the replacement by box overlap and
+/// embedding, as they do a local re-detection (`faces::record_detections`).
+///
+/// A peer's faces are taken under whichever compatible detector found them:
+/// a tablet set to the fast detector adopts the desktop's thorough pass
+/// rather than re-detecting it worse.
 ///
 /// Returns how many images were adopted.
 pub fn import_from_shards(
@@ -688,28 +930,92 @@ pub fn import_from_shards(
    store: &FaceShardStore,
    model_id: &str,
 ) -> Result<usize, CatalogError> {
+    use dr_types::FaceDetector;
+
    // Only images this device actually has. A shard covers the whole account,
    // and a device holding a subset of the library should take only its own
    // part rather than accumulating faces for photographs it cannot show.
-    let mut q = conn.prepare(
-        "SELECT r.file_id, r.image_id
+    //
+    // With the pipeline that indexed each one here, or NULL: the marker is
+    // what decides whether a peer's copy is a gap filled or an upgrade.
+    let mut q = conn.prepare(&format!(
+        "SELECT r.file_id, r.image_id,
+                (SELECT fi.model_id FROM face_index fi
+                  WHERE fi.image_id = r.image_id AND {} = ?1)
           FROM remote r
           JOIN images i ON i.id = r.image_id
-          WHERE i.trashed_at IS NULL
-            AND NOT EXISTS (
-                SELECT 1 FROM face_index fi
-                 WHERE fi.image_id = r.image_id AND fi.model_id = ?1
-            )",
-    )?;
-    let candidates: Vec<(i64, i64)> = q
-        .query_map([model_id], |r| Ok((r.get(0)?, r.get(1)?)))?
+          WHERE i.trashed_at IS NULL",
+        crate::faces::embedder_sql("fi.model_id")
+    ))?;
+    let candidates: Vec<(i64, i64, Option<String>)> = q
+        .query_map([crate::faces::embedder_of(model_id)], |r| {
+            Ok((r.get(0)?, r.get(1)?, r.get(2)?))
+        })?
        .collect::<Result<_, _>>()?;

+    /// Images per write transaction. Large enough that fourteen thousand
+    /// adoptions are a hundred and forty commits rather than fourteen
+    /// thousand; small enough that a read on the UI thread, queued behind
+    /// the lock, waits a fraction of a second and not the whole import.
+    const CHUNK: usize = 100;
+
+    // Every file's held pipeline, read once rather than asked per candidate --
+    // 23,000 prepared lookups on every pass, nearly all of them for images
+    // this device already holds. Nothing below changes which pipeline the
+    // store holds a file under (`set_indexed_at` touches only a file already
+    // decided), and each candidate is a different file, so these are the
+    // answers the lookups gave.
+    // An index that cannot be read answers as each lookup did: nothing held.
+    let held_models = store.all_held_models(model_id).unwrap_or_else(|e| {
+        log::debug!("reading the shard index: {e}");
+        HashMap::new()
+    });
+
    let mut adopted = 0;
-    for (file_id, image_id) in candidates {
-        let Some((faces, edge)) = store.get_image(file_id as u64, model_id)? else {
+    let mut tx = conn.unchecked_transaction()?;
+    let mut in_chunk = 0;
+    for (file_id, image_id, local) in candidates {
+        if in_chunk == CHUNK {
+            tx.commit()?;
+            tx = conn.unchecked_transaction()?;
+            in_chunk = 0;
+        }
+        let Some(held) = held_models.get(&(file_id as u64)).cloned() else {
            continue;
        };
+        if let Some(local) = local {
+            // An unknown detector on either side cannot be ranked, and an
+            // unranked peer is treated as an equal: kept out.
+            let upgrade = match (
+                FaceDetector::for_model_id(&held),
+                FaceDetector::for_model_id(&local),
+            ) {
+                (Some(theirs), Some(ours)) => theirs.outranks(ours),
+                _ => false,
+            };
+            if !upgrade {
+                continue;
+            }
+        }
+        let Some((faces, edge)) = store.get_image(file_id as u64, &held)? else {
+            continue;
+        };
+        // A face the peer embedded before its quality was kept (schema V14)
+        // is adopted with the reading missing, exactly as one without an eye
+        // reading is. The measuring passes find their work by the NULL
+        // column, not by the run marker (`dr_ui::repairs`, `faces_needing`),
+        // so adopting costs the reading nothing and this device's own pass
+        // fills it.
+        //
+        // This used to refuse such faces, on the reasoning that the marker
+        // would stop them ever being measured — true before the quality
+        // repair existed, and wrong after. What it cost: V14 had dropped the
+        // markers of every image holding such faces, so the peer never
+        // re-exported them, and the only copies in the shards were the
+        // unmeasured ones. A tablet holding shards with 4,310 of the
+        // desktop's images and 3,170 of its confirmations declined every one
+        // of them, showed a fraction of each person, and queued the whole
+        // library for a re-detection of its own instead.
        let local: Vec<crate::faces::DetectedFace> = faces
            .into_iter()
            .map(|f| crate::faces::DetectedFace {
@@ -721,6 +1027,9 @@ pub fn import_from_shards(
                confidence: f.confidence,
                embedding: f.embedding,
                crop_px: f.crop_px,
+                quality: f.quality,
+                eyes: f.eyes,
+                landmarks_dense: f.landmarks_dense,
                model_id: f.model_id,
                // A peer that indexed before crops existed sends none, and the
                // reader falls back to the proxy exactly as it does for a face
@@ -729,15 +1038,42 @@ pub fn import_from_shards(
            })
            .collect();

-        crate::faces::record_detections(
-            conn,
+        crate::faces::record_detections_within(
+            &tx,
            dr_types::ImageId(image_id as u64),
-            model_id,
+            &held,
            edge,
            &local,
        )?;
+        // The peer's marker, not this moment. `record_detections` stamps the
+        // run as now, and `export_to_shards` reads a marker newer than the
+        // shard's as a re-index — so every adopted image went straight back
+        // out as this device's own work: 14,100 adopted, 15,457 "newly
+        // indexed" on the next pass, and twenty-two shards of a peer's faces
+        // uploaded again under a second name. Where the peer's shard carried
+        // no marker, the store takes the catalog's, so the two agree either
+        // way and the export sees nothing to send.
+        match store.indexed_at(file_id as u64, &held) {
+            Some(theirs) => {
+                tx.execute(
+                    "UPDATE face_index SET indexed_at = ?3
+                      WHERE image_id = ?1 AND model_id = ?2",
+                    rusqlite::params![image_id, held, theirs],
+                )?;
+            }
+            None => {
+                let ours: i64 = tx.query_row(
+                    "SELECT indexed_at FROM face_index WHERE image_id = ?1 AND model_id = ?2",
+                    rusqlite::params![image_id, held],
+                    |r| r.get(0),
+                )?;
+                store.set_indexed_at(file_id as u64, &held, ours)?;
+            }
+        }
        adopted += 1;
+        in_chunk += 1;
    }
+    tx.commit()?;
    Ok(adopted)
 }

@@ -766,6 +1102,9 @@ fn read_shared_face(r: &rusqlite::Row<'_>) -> rusqlite::Result<SharedFace> {
        embedding: r.get(8)?,
        crop_px: r.get::<_, f64>(9)? as f32,
        crop: r.get::<_, Option<Vec<u8>>>(10)?.unwrap_or_default(),
+        quality: r.get::<_, Option<f64>>(11)?.map(|q| q as f32),
+        eyes: crate::faces::read_eyes(r, 12)?,
+        landmarks_dense: r.get::<_, Option<Vec<u8>>>(19)?.unwrap_or_default(),
    })
 }

@@ -849,7 +1188,24 @@ CREATE TABLE IF NOT EXISTS faces (
    crop_px    REAL NOT NULL,
    -- The face, cut out. NULL where the face was found before crops were kept,
    -- or adopted from a peer that did not have one.
-    crop       BLOB
+    crop       BLOB,
+    -- Length of the raw embedding (`faces::DetectedFace::quality`). NULL from
+    -- a build that did not keep it, and a face the receiving device will not
+    -- adopt -- see `import_from_shards`.
+    quality    REAL,
+    -- The eye reading (`faces::DetectedFace::eyes`), all seven or none. NULL
+    -- from a peer without the eye models; adopted anyway, and read by the
+    -- receiving device's own measuring pass if it has them.
+    eye_right       REAL,
+    eye_right_px    REAL,
+    eye_right_sharp REAL,
+    eye_left        REAL,
+    eye_left_px     REAL,
+    eye_left_sharp  REAL,
+    sunglasses      REAL,
+    -- The dense landmarks behind the reading (`faces::DetectedFace::
+    -- landmarks_dense`), 424 bytes packed; NULL where none.
+    landmarks_dense BLOB
 );
 CREATE INDEX IF NOT EXISTS faces_file ON faces(file_id, model_id);

@@ -908,6 +1264,9 @@ mod tests {
            confidence: 0.87,
            embedding: vec![seed; 1024],
            crop_px: 180.0,
+            quality: Some(17.5),
+            eyes: None,
+            landmarks_dense: Vec::new(),
            crop: vec![seed; 64],
        }
    }
@@ -925,6 +1284,7 @@ mod tests {
        assert_eq!(edge, 1024);
        assert_eq!(faces[0].embedding.len(), 1024);
        assert!((faces[0].crop_px - 180.0).abs() < 1e-3);
+        assert_eq!(faces[0].quality, Some(17.5));
    }

    /// The case the run marker exists for, carried across the wire: an image
@@ -949,6 +1309,32 @@ mod tests {
        assert!(!s.contains(1, "lvface"));
    }

+    /// One generation per image per embedder: a stronger detector's pass
+    /// retires a weaker one from the index, and a weaker pass arriving after
+    /// a stronger is not written at all.
+    #[test]
+    fn a_stronger_pass_retires_a_weaker_one_and_a_weaker_is_not_added() {
+        let dir = tempdir();
+        let mut s = FaceShardStore::open(&dir).unwrap();
+        s.put_image(1, "w600k_mbf", 1024, &[face(1, 1)]).unwrap();
+        s.put_image(1, "scrfd_10g+w600k_mbf", 1024, &[face(1, 2)])
+            .unwrap();
+        assert!(s.contains(1, "scrfd_10g+w600k_mbf"));
+        assert!(!s.contains(1, "w600k_mbf"), "the fast pass was not retired");
+        assert_eq!(s.len(), 1, "faces_meta still counts the retired pass");
+
+        s.put_image(1, "scrfd_2.5g+w600k_mbf", 1024, &[face(1, 3)])
+            .unwrap();
+        assert!(
+            !s.contains(1, "scrfd_2.5g+w600k_mbf"),
+            "a weaker pass was added"
+        );
+        assert_eq!(
+            s.held_model(1, "w600k_mbf").as_deref(),
+            Some("scrfd_10g+w600k_mbf")
+        );
+    }
+
    #[test]
    fn re_storing_an_image_replaces_rather_than_doubling_it() {
        let dir = tempdir();
@@ -1115,6 +1501,9 @@ mod catalog_round_trip {
            confidence: 0.9,
            embedding: vec![seed; 1024],
            crop_px: 180.0,
+            quality: Some(20.0),
+            eyes: None,
+            landmarks_dense: Vec::new(),
            model_id: "w600k_mbf".into(),
            crop: vec![seed; 64],
        }
@@ -1162,9 +1551,103 @@ mod catalog_round_trip {
        let got = faces::for_image(&b, dr_types::ImageId(90)).unwrap();
        assert_eq!(got.len(), 1);
        assert!((got[0].crop_px - 180.0).abs() < 1e-3);
+        assert_eq!(got[0].quality, Some(20.0));
        assert!((got[0].landmarks[2].0 - 0.15).abs() < 1e-5);
        let emb = faces::embeddings(&b, "w600k_mbf").unwrap();
-        assert!(emb.iter().any(|(_, _, blob, _)| blob[0] == 1));
+        assert!(emb.iter().any(|e| e.embedding[0] == 1));
+
+        // And what B adopted is not B's work: its next export sends nothing.
+        // Adopting used to stamp the run as now, so every adopted image went
+        // back out under B's name as a re-index.
+        assert_eq!(export_to_shards(&b, &mut store_b, "w600k_mbf").unwrap(), 0);
+    }
+
+    /// The desktop switched to a stronger detector part-way through the
+    /// library, so its faces sit under two pipeline ids. A tablet on the
+    /// original detector must receive *all* of them — each under the id that
+    /// found it — and not re-detect the thorough half worse.
+    #[test]
+    fn every_generation_sharing_an_embedder_travels_and_is_adopted() {
+        let a = device(&[(1, 5001), (2, 5002)]);
+        let b = device(&[(90, 5001), (91, 5002)]);
+
+        faces::record_detections(&a, dr_types::ImageId(1), "w600k_mbf", 1024, &[detected(1)])
+            .unwrap();
+        let mut thorough = detected(2);
+        thorough.model_id = "scrfd_10g+w600k_mbf".into();
+        faces::record_detections(
+            &a,
+            dr_types::ImageId(2),
+            "scrfd_10g+w600k_mbf",
+            1024,
+            &[thorough],
+        )
+        .unwrap();
+
+        let mut store_a = FaceShardStore::open(&tempdir("a")).unwrap();
+        assert_eq!(
+            export_to_shards(&a, &mut store_a, "scrfd_10g+w600k_mbf").unwrap(),
+            2,
+            "the export left the earlier detector's images behind"
+        );
+
+        let mut store_b = FaceShardStore::open(&tempdir("b")).unwrap();
+        store_b.merge_shard(&store_a.shard_path(0)).unwrap();
+        assert_eq!(import_from_shards(&b, &store_b, "w600k_mbf").unwrap(), 2);
+
+        assert_eq!(faces::coverage(&b, "w600k_mbf").unwrap().outstanding(), 0);
+        let old = faces::for_image(&b, dr_types::ImageId(90)).unwrap();
+        let new = faces::for_image(&b, dr_types::ImageId(91)).unwrap();
+        assert_eq!(old[0].model_id, "w600k_mbf");
+        assert_eq!(
+            new[0].model_id, "scrfd_10g+w600k_mbf",
+            "adopted under the wrong id"
+        );
+    }
+
+    /// A face a peer embedded without measuring it is adopted all the same,
+    /// and left on this device's quality pass by its missing reading. Refusing
+    /// it was what stranded every confirmation the desktop had made on faces
+    /// from before V14: the tablet held the shards and would not use them.
+    #[test]
+    fn a_peers_unmeasured_faces_are_adopted_and_left_for_the_quality_pass() {
+        let b = device(&[(90, 5001), (91, 5002)]);
+        let mut store = FaceShardStore::open(&tempdir("unmeasured")).unwrap();
+        let shared = |file_id: u64, quality: Option<f32>| SharedFace {
+            file_id,
+            model_id: "w600k_mbf".into(),
+            x: 0.1,
+            y: 0.2,
+            w: 0.15,
+            h: 0.2,
+            landmarks: vec![1; 40],
+            confidence: 0.87,
+            embedding: vec![1; 1024],
+            crop_px: 180.0,
+            quality,
+            eyes: None,
+            landmarks_dense: Vec::new(),
+            crop: Vec::new(),
+        };
+        store
+            .put_image(5001, "w600k_mbf", 2560, &[shared(5001, None)])
+            .unwrap();
+        store
+            .put_image(5002, "w600k_mbf", 2560, &[shared(5002, Some(19.0))])
+            .unwrap();
+
+        assert_eq!(import_from_shards(&b, &store, "w600k_mbf").unwrap(), 2);
+        let cov = faces::coverage(&b, "w600k_mbf").unwrap();
+        assert_eq!(cov.indexed, 2);
+        assert_eq!(cov.outstanding(), 0, "the unmeasured image was refused");
+        let got = faces::for_image(&b, dr_types::ImageId(90)).unwrap();
+        assert_eq!(got.len(), 1);
+        assert_eq!(got[0].quality, None, "a reading was invented");
+        // Still owed to the measuring pass, which lists by the column.
+        assert_eq!(
+            faces::count_needing(&b, "w600k_mbf", "f.quality IS NULL").unwrap(),
+            1
+        );
    }

    #[test]
@@ -1187,7 +1670,60 @@ mod catalog_round_trip {
            "a peer's copy replaced work this device had already done"
        );
        let emb = faces::embeddings(&b, "w600k_mbf").unwrap();
-        assert_eq!(emb[0].2[0], 9, "B's own embedding was overwritten");
+        assert_eq!(emb[0].embedding[0], 9, "B's own embedding was overwritten");
+    }
+
+    /// A peer's stronger detector is the re-detection this device would
+    /// otherwise queue for itself. Taking it saves the fetch; the name the
+    /// user confirmed here rides across on the box, as it would locally.
+    #[test]
+    fn a_peers_stronger_pass_replaces_a_weaker_local_one_and_keeps_the_name() {
+        let a = device(&[(1, 5001)]);
+        let b = device(&[(50, 5001)]);
+
+        let ids =
+            faces::record_detections(&b, dr_types::ImageId(50), "w600k_mbf", 1024, &[detected(9)])
+                .unwrap();
+        let anna = faces::create_person(&b, "Anna").unwrap();
+        faces::confirm(&b, ids[0], anna).unwrap();
+
+        let mut thorough = detected(7);
+        thorough.model_id = "scrfd_10g+w600k_mbf".into();
+        let mut second = detected(8);
+        second.model_id = "scrfd_10g+w600k_mbf".into();
+        second.x = 0.6;
+        faces::record_detections(
+            &a,
+            dr_types::ImageId(1),
+            "scrfd_10g+w600k_mbf",
+            1024,
+            &[thorough, second],
+        )
+        .unwrap();
+
+        let mut store = FaceShardStore::open(&tempdir("upgrade")).unwrap();
+        export_to_shards(&a, &mut store, "scrfd_10g+w600k_mbf").unwrap();
+        assert_eq!(import_from_shards(&b, &store, "w600k_mbf").unwrap(), 1);
+
+        let got = faces::for_image(&b, dr_types::ImageId(50)).unwrap();
+        assert_eq!(got.len(), 2, "the stronger pass was not adopted");
+        let named = got
+            .iter()
+            .find(|f| f.person == Some(anna))
+            .expect("the name was lost");
+        assert!(named.confirmed);
+        assert_eq!(named.model_id, "scrfd_10g+w600k_mbf");
+
+        // And never downwards: A on the fast detector keeps B's thorough faces.
+        let mut store_b = FaceShardStore::open(&tempdir("downgrade")).unwrap();
+        faces::record_detections(&b, dr_types::ImageId(50), "w600k_mbf", 1024, &[detected(9)])
+            .unwrap();
+        export_to_shards(&b, &mut store_b, "w600k_mbf").unwrap();
+        assert_eq!(
+            import_from_shards(&a, &store_b, "scrfd_10g+w600k_mbf").unwrap(),
+            0
+        );
+        assert_eq!(faces::for_image(&a, dr_types::ImageId(1)).unwrap().len(), 2);
    }

    /// A device holding a subset of the library takes only its own part.
@@ -1281,6 +1817,9 @@ mod catalog_round_trip {
            confidence: 0.87,
            embedding: vec![seed; 1024],
            crop_px: 180.0,
+            quality: None,
+            eyes: None,
+            landmarks_dense: Vec::new(),
            crop: vec![seed; 64],
        }
    }
@@ -1430,6 +1969,10 @@ mod catalog_round_trip {
        let (faces, _) = store.get_image(77, "w600k_mbf").unwrap().unwrap();
        assert_eq!(faces.len(), 1);
        assert!(faces[0].crop.is_empty(), "a crop was invented from nowhere");
+        assert_eq!(
+            faces[0].quality, None,
+            "a quality was invented from nowhere"
+        );
        let _ = std::fs::remove_dir_all(&dir);
    }

@@ -29,7 +29,11 @@ pub enum JobKind {
    ScanFolder = 0,
    /// Promote an image from stat-only to full EXIF.
    ExtractMetadata = 1,
-    /// Build or rebuild a thumbnail.
+    /// Build or rebuild a thumbnail. **Retired** — see [`JobKind::RETIRED`].
+    ///
+    /// Kept so the number stays taken: a catalog written by 0.16.0 or earlier
+    /// holds rows of kind 2, and reusing it would hand them to whatever took
+    /// its place.
    Thumbnail = 2,
    /// A sidecar on disk is newer than what the catalog read.
    ReadSidecar = 3,
@@ -69,6 +73,18 @@ impl JobKind {
        JobKind::DetectFaces,
    ];

+    /// Kinds that are no longer queued by anything, whose rows are deleted on
+    /// sight by [`drop_retired`].
+    ///
+    /// `Thumbnail` is here because thumbnails are owed by the store, not by
+    /// the queue. The grid's worker and the thumbnail sweep both find their
+    /// work by asking `ThumbStore` what it lacks, and the store is shared
+    /// between devices, so it is the only thing that can say another device
+    /// already made one. Up to 0.16.0 every scan enqueued a job per
+    /// photograph anyway and no handler ever claimed one: the reference
+    /// catalog held 23,582 of them (#73; catalog.md §6.1).
+    pub const RETIRED: [JobKind; 1] = [JobKind::Thumbnail];
+
    fn from_i64(v: i64) -> Option<Self> {
        Some(match v {
            0 => JobKind::ScanFolder,
@@ -185,7 +201,8 @@ pub fn enqueue(
    priority: Priority,
    payload: Option<&str>,
 ) -> Result<(), CatalogError> {
-    conn.execute(
+    // Cached: a scan enqueues one per photograph it lists.
+    conn.prepare_cached(
        "INSERT INTO jobs(kind, subject_id, priority, state, payload)
         VALUES (?1, ?2, ?3, 0, ?4)
         ON CONFLICT(kind, subject_id) DO UPDATE SET
@@ -195,8 +212,13 @@ pub fn enqueue(
             state      = CASE WHEN jobs.state = 2 THEN 0 ELSE jobs.state END,
             attempts   = CASE WHEN jobs.state = 2 THEN 0 ELSE jobs.attempts END,
             not_before = CASE WHEN jobs.state = 2 THEN 0 ELSE jobs.not_before END",
-        rusqlite::params![kind as i64, subject_id, priority as i64, payload],
-    )?;
+    )?
+    .execute(rusqlite::params![
+        kind as i64,
+        subject_id,
+        priority as i64,
+        payload
+    ])?;
    Ok(())
 }

@@ -393,7 +415,7 @@ pub fn recover_orphaned(conn: &Connection) -> Result<usize, CatalogError> {
 ///
 /// Coalescing keeps the table one row per unit of work, but nothing shrinks it
 /// when the work stops existing: a library that has been culled carries a
-/// thumbnail job for every photograph deleted since the last time anything
+/// job for every photograph deleted since the last time anything
 /// looked. Each one would be claimed, run, and failed five times.
 ///
 /// Only kinds whose subject really is an image ([`JobKind::subject_is_image`])
@@ -425,6 +447,32 @@ pub fn reap_orphan_subjects(conn: &Connection) -> Result<usize, CatalogError> {
    Ok(n)
 }

+/// Delete every row of a [`JobKind::RETIRED`] kind.
+///
+/// Not a migration, deliberately. A schema bump makes an older build refuse
+/// the synced catalog snapshot, and a device still on 0.16.0 would lose the
+/// catalog to save a megabyte. So this runs where the queue is readied —
+/// [`crate::runner::recover`], at every open — and has to be cheap when there
+/// is nothing to do: `kind` leads the `UNIQUE(kind, subject_id)` index, so an
+/// empty answer is one index probe, not a table scan.
+///
+/// Every open rather than once, because once is not enough: an older build
+/// opening the same catalog enqueues them again on its next scan.
+///
+/// Rows in any state go. Nothing claims these kinds, so none can be running,
+/// and a failed one would be a report about work nobody was going to do.
+pub fn drop_retired(conn: &Connection) -> Result<usize, CatalogError> {
+    let kinds: Vec<i64> = JobKind::RETIRED.iter().map(|k| *k as i64).collect();
+    let placeholders = std::iter::repeat_n("?", kinds.len())
+        .collect::<Vec<_>>()
+        .join(",");
+    let n = conn.execute(
+        &format!("DELETE FROM jobs WHERE kind IN ({placeholders})"),
+        rusqlite::params_from_iter(kinds.iter()),
+    )?;
+    Ok(n)
+}
+
 /// How much is left, by state.
 ///
 /// One query rather than a listing, because the caller is a progress line: a
@@ -244,7 +244,8 @@ pub fn delete(conn: &Connection, id: KeywordId) -> Result<usize, CatalogError> {
 /// every assignment, and a query per keyword would be one statement per word
 /// in the library.
 pub fn list(conn: &Connection) -> Result<Vec<Keyword>, CatalogError> {
-    let mut stmt = conn.prepare(
+    ensure_term_index(conn);
+    let mut stmt = conn.prepare_cached(
        // DISTINCT image, not row: a word on two versions of one frame is one
        // photograph, and reporting two is the kind of small lie that makes a
        // user stop trusting the counts.
@@ -269,6 +270,27 @@ pub fn list(conn: &Connection) -> Result<Vec<Keyword>, CatalogError> {
    Ok(rows)
 }

+/// The index [`list`]'s per-word count is served from: `keywords_term`
+/// with the version beside the word, so the count reads no `keywords` row.
+///
+/// `keywords_term` alone gave the row id, and each of the 10,800 assignments
+/// on the reference library cost a probe of the table for its version --
+/// 4 ms of the keyword panel's redraw, on every selection change.
+///
+/// Created on first use rather than by a migration, for the reason
+/// `duplicates::ensure_probe_table` gives: a new schema version makes every
+/// older build refuse this catalog's snapshot at sync, and an older build
+/// that meets an extra index ignores it. Once it exists, the statement is a
+/// lookup in the schema (microseconds). A failure to create it is logged and
+/// the list read without it: the index is a speed-up, never an answer.
+fn ensure_term_index(conn: &Connection) {
+    if let Err(e) = conn.execute_batch(
+        "CREATE INDEX IF NOT EXISTS keywords_term_version ON keywords(keyword, version_id);",
+    ) {
+        log::warn!("keywords: could not create keywords_term_version: {e}");
+    }
+}
+
 /// Assign a keyword to images, creating the keyword if it is new.
 ///
 /// The bulk form is the *only* form, because keywording a selection is the
@@ -491,7 +513,12 @@ pub fn adopt_orphan_terms(conn: &Connection) -> Result<usize, CatalogError> {
            // quietly readmitted to the vocabulary; it stays visible as an
            // orphan in [`for_images`] instead, which is a state someone can
            // see and act on rather than one that silently undoes a deletion.
-            "SELECT DISTINCT k.keyword FROM keywords k
+            //
+            // The distinct words first, then the check: the vocabulary has no
+            // index a tombstone-inclusive lookup can use, so checking once per
+            // assignment scanned it 10,000 times on every open. Once per word
+            // is a few dozen scans of a few dozen rows.
+            "SELECT k.keyword FROM (SELECT DISTINCT keyword FROM keywords) k
              WHERE NOT EXISTS (SELECT 1 FROM keyword_terms t
                                 WHERE t.name = k.keyword)",
        )?;
@@ -36,16 +36,21 @@ use std::path::Path;
 use dr_types::{Availability, ImageId};
 use rusqlite::Connection;

+pub mod albums;
+mod backfilled;
 pub mod bursts;
 pub mod cache;
 pub mod collections;
 pub mod dedup;
+pub mod dedup_people;
+pub mod duplicates;
 pub mod error;
 pub mod face_shard;
 pub mod faces;
 pub mod jobs;
 pub mod keywords;
 pub mod merge;
+pub mod name_dates;
 pub mod query;
 pub mod rating;
 pub mod recovery;
@@ -56,12 +61,13 @@ pub mod sync;
 pub mod trash;
 pub mod walk;

+pub use albums::{Album, AlbumId, Place};
 pub use cache::{Budget, Cache, DEFAULT_BUDGET_BYTES};
 pub use collections::{Collection, CollectionKind, TreeRow};
 pub use dedup::{seen_by_content, seen_by_metadata, set_content_hash};
 pub use error::CatalogError;
 pub use face_shard::{FaceShardStore, SharedFace};
-pub use faces::{Calibration, DetectedFace, Face, FaceId, Person, PersonId};
+pub use faces::{Calibration, DetectedFace, Face, FaceId, FaceUpdate, Person, PersonId};
 pub use jobs::{Job, JobKind, Priority};
 pub use keywords::{Coverage, Keyword, KeywordId, SelectionKeyword};
 pub use merge::MergeReport;
@@ -246,8 +252,18 @@ impl Catalog {
        // A migration adds a column; it cannot know what the value should be
        // for rows that already existed. Backfilling on open is what stops
        // those rows being silently partial.
-        for (what, n) in schema::backfill(&conn)? {
-            log::info!("backfilled {what} for {n} row(s) (schema was v{from})");
+        //
+        // Once per catalog state rather than once per open (NFR-P9): every
+        // worker thread opens its own connection, and a develop landing made
+        // five, each paying the whole backfill to confirm nothing had changed.
+        // [`backfilled`] says what "changed" means and why it is enough. A
+        // migration always backfills, stamp or no stamp.
+        let stamp = backfilled::stamp(&conn, path)?;
+        if from < schema::SCHEMA_VERSION || !backfilled::is_current(path, &stamp) {
+            for (what, n) in schema::backfill(&conn)? {
+                log::info!("backfilled {what} for {n} row(s) (schema was v{from})");
+            }
+            backfilled::record(path, stamp);
        }
        Ok(Catalog { conn })
    }
@@ -0,0 +1,387 @@
+//! TRACES: FR-CAT-5
+//! A capture time read from the file's name, for an image whose header has
+//! none.
+//!
+//! # Why
+//!
+//! A photograph with no EXIF date sorts after everything else, so it is lost
+//! at the end of the grid and absent from the timeline. The files that end up
+//! there are rarely without a date — they are without *EXIF*: WhatsApp strips
+//! every tag and names the file `WhatsApp Image 2023-06-15 at 07.00.42.jpeg`,
+//! a Windows Phone wrote `WP_20140922_14_16_27_Pro.jpg`, a phone camera
+//! `IMG_20190812_153012.jpg`, and darktable's import renames to
+//! `20230629_0001.jpeg`. On the reference library 250 of 274 undated images
+//! carried their date in the name or in the folder above it.
+//!
+//! # What is accepted
+//!
+//! A date is `YYYYMMDD` as a whole run of digits, or `YYYY`, `MM` and `DD`
+//! joined by `-`, `_` or `.`. A time may follow it — `HHMMSS` as one run (or
+//! nine digits, milliseconds appended), or three two-digit runs joined by
+//! `-`, `_`, `.` or `:` — after `_`, `-`, `.`, `T`, a space or ` at `.
+//! Anything else after the date leaves it at midnight: `_0059` in
+//! `20230628_0059` is a sequence number, not 00:59, and reading it as a time
+//! would invent one.
+//!
+//! The name is tried first and then each folder above it, innermost first —
+//! `2016/2016-11-11/IMG_7910.jpg` is dated by its folder. A bare year folder
+//! is not a date: putting a photograph at 1 January is a wrong answer, and an
+//! undated one at least says it does not know.
+//!
+//! The reading is wall-clock time with no zone, stored as EXIF's is
+//! (`dr_decode::parse_exif_datetime`), and EXIF always wins: this only fills
+//! rows whose `captured_at` is still empty.
+
+use rusqlite::Connection;
+
+use crate::CatalogError;
+
+/// The capture time a path's name states, as wall-clock Unix seconds.
+pub fn date_from_path(source_ref: &str) -> Option<i64> {
+    let mut parts = source_ref.rsplit(['/', '\\']);
+    let name = parts.next()?;
+    let stem = name.rsplit_once('.').map_or(name, |(stem, _)| stem);
+    date_in(stem).or_else(|| parts.find_map(date_in))
+}
+
+/// Date every examined, undated image whose name states one.
+///
+/// `only` limits the pass to the images just examined — what the sweep hands
+/// in — and `None` visits every undated image, which is the backfill's case.
+/// Both read the undated side alone (`images_captured` answers
+/// `captured_at IS NULL` with a seek), never the library.
+///
+/// Returns how many images were dated.
+pub fn fill(conn: &Connection, only: Option<&[i64]>) -> Result<usize, CatalogError> {
+    let rows: Vec<(i64, String)> = match only {
+        None => {
+            let mut stmt = conn.prepare(
+                "SELECT id, source_ref FROM images
+                  WHERE captured_at IS NULL AND metadata_state >= 2",
+            )?;
+            let rows = stmt
+                .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))?
+                .collect::<Result<_, _>>()?;
+            rows
+        }
+        Some(ids) => {
+            let mut stmt = conn.prepare_cached(
+                "SELECT source_ref FROM images
+                  WHERE id = ?1 AND captured_at IS NULL AND metadata_state >= 2",
+            )?;
+            let mut rows = Vec::new();
+            for &id in ids {
+                let mut q = stmt.query([id])?;
+                if let Some(r) = q.next()? {
+                    rows.push((id, r.get(0)?));
+                }
+            }
+            rows
+        }
+    };
+
+    let dated: Vec<(i64, i64)> = rows
+        .iter()
+        .filter_map(|(id, path)| date_from_path(path).map(|at| (*id, at)))
+        .collect();
+    if dated.is_empty() {
+        return Ok(0);
+    }
+
+    // A savepoint rather than a transaction, so a caller already inside one
+    // can still call this: the backfill's 250 rows are one commit, not 250.
+    conn.execute_batch("SAVEPOINT name_dates")?;
+    let written = (|| {
+        let mut stmt = conn.prepare_cached(
+            "UPDATE images SET captured_at = ?2 WHERE id = ?1 AND captured_at IS NULL",
+        )?;
+        let mut n = 0;
+        for (id, at) in &dated {
+            n += stmt.execute(rusqlite::params![id, at])?;
+        }
+        Ok::<_, CatalogError>(n)
+    })();
+    match written {
+        Ok(n) => {
+            conn.execute_batch("RELEASE name_dates")?;
+            Ok(n)
+        }
+        Err(e) => {
+            let _ = conn.execute_batch("ROLLBACK TO name_dates; RELEASE name_dates");
+            Err(e)
+        }
+    }
+}
+
+/// The first date, with its time if one follows, in one name component.
+fn date_in(s: &str) -> Option<i64> {
+    let b = s.as_bytes();
+    let mut i = 0;
+    while i < b.len() {
+        // Only at the start of a run of digits: a date inside a longer number
+        // is a coincidence, not a date.
+        if b[i].is_ascii_digit() && (i == 0 || !b[i - 1].is_ascii_digit()) {
+            if let Some(at) = date_at(b, i) {
+                return Some(at);
+            }
+        }
+        i += 1;
+    }
+    None
+}
+
+/// A date starting at `i`, and the time after it if there is one.
+fn date_at(b: &[u8], i: usize) -> Option<i64> {
+    let run = digits(b, i);
+    let ((y, mo, d), after) = match run.len() {
+        // YYYYMMDD, or YYYYMMDDHHMMSS written as one number.
+        8 | 14 => ((num(&run[..4]), num(&run[4..6]), num(&run[6..8])), i + 8),
+        4 => {
+            let sep = |at: usize| matches!(b.get(at), Some(b'-' | b'_' | b'.'));
+            let mo_at = i + 4 + 1;
+            let d_at = mo_at + 2 + 1;
+            if !(sep(i + 4) && digits(b, mo_at).len() == 2 && sep(mo_at + 2))
+                || digits(b, d_at).len() != 2
+            {
+                return None;
+            }
+            (
+                (num(run), num(&b[mo_at..mo_at + 2]), num(&b[d_at..d_at + 2])),
+                d_at + 2,
+            )
+        }
+        _ => return None,
+    };
+    let day = civil_days(y, mo, d)?;
+
+    let time = if run.len() == 14 {
+        hms(num(&run[8..10]), num(&run[10..12]), num(&run[12..14]))
+    } else {
+        time_at(b, after)
+    };
+    Some(day * 86_400 + time.unwrap_or(0))
+}
+
+/// The time following a date that ends at `i`, as seconds into the day.
+fn time_at(b: &[u8], i: usize) -> Option<i64> {
+    let rest = &b[i..];
+    let start = if rest.starts_with(b" at ") {
+        i + 4
+    } else if matches!(rest.first(), Some(b'_' | b'-' | b'.' | b'T' | b' ')) {
+        i + 1
+    } else {
+        return None;
+    };
+
+    let run = digits(b, start);
+    match run.len() {
+        // HHMMSS, or with milliseconds appended (Pixel's PXL_…_123456789).
+        6 | 9 => hms(num(&run[..2]), num(&run[2..4]), num(&run[4..6])),
+        2 => {
+            let sep = |at: usize| matches!(b.get(at), Some(b'-' | b'_' | b'.' | b':'));
+            let (m_at, s_at) = (start + 3, start + 6);
+            if !(sep(start + 2) && digits(b, m_at).len() == 2 && sep(m_at + 2))
+                || digits(b, s_at).len() != 2
+            {
+                return None;
+            }
+            hms(num(run), num(&b[m_at..m_at + 2]), num(&b[s_at..s_at + 2]))
+        }
+        _ => None,
+    }
+}
+
+/// The run of ASCII digits starting at `i`.
+fn digits(b: &[u8], i: usize) -> &[u8] {
+    let rest = b.get(i..).unwrap_or(&[]);
+    let n = rest.iter().take_while(|c| c.is_ascii_digit()).count();
+    &rest[..n]
+}
+
+fn num(d: &[u8]) -> i64 {
+    d.iter().fold(0, |n, c| n * 10 + i64::from(c - b'0'))
+}
+
+fn hms(h: i64, m: i64, s: i64) -> Option<i64> {
+    ((0..24).contains(&h) && (0..60).contains(&m) && (0..61).contains(&s))
+        .then_some(h * 3_600 + m * 60 + s)
+}
+
+/// Days since 1970-01-01 for a valid civil date, `None` for anything else.
+///
+/// The year range is EXIF's (`parse_exif_datetime`): wide enough for scanned
+/// film, narrow enough that a counter such as `12345678` is not a date.
+fn civil_days(y: i64, mo: i64, d: i64) -> Option<i64> {
+    let leap = y % 4 == 0 && (y % 100 != 0 || y % 400 == 0);
+    let month_len = match mo {
+        1 | 3 | 5 | 7 | 8 | 10 | 12 => 31,
+        4 | 6 | 9 | 11 => 30,
+        2 if leap => 29,
+        2 => 28,
+        _ => return None,
+    };
+    if !(1900..=2200).contains(&y) || !(1..=month_len).contains(&d) {
+        return None;
+    }
+    let y_adj = if mo <= 2 { y - 1 } else { y };
+    let era = y_adj.div_euclid(400);
+    let yoe = y_adj - era * 400;
+    let mp = (mo + 9) % 12;
+    let doy = (153 * mp + 2) / 5 + d - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    Some(era * 146_097 + doe - 719_468)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Wall-clock seconds for a date and time, the expected side of each case.
+    fn at(y: i64, mo: i64, d: i64, h: i64, mi: i64, s: i64) -> Option<i64> {
+        Some(civil_days(y, mo, d).unwrap() * 86_400 + h * 3_600 + mi * 60 + s)
+    }
+
+    #[test]
+    fn the_names_in_the_reference_library_are_read() {
+        // Every shape here is a file that sat undated at the end of the grid.
+        for (path, want) in [
+            (
+                "PhotosRaw/alps trip/alps whatsapp/WhatsApp Image 2023-06-15 at 07.00.42.jpeg",
+                at(2023, 6, 15, 7, 0, 42),
+            ),
+            (
+                "PhotosRaw/alps trip/alps whatsapp/WhatsApp Image 2023-06-17 at 12.45.52 (1).jpeg",
+                at(2023, 6, 17, 12, 45, 52),
+            ),
+            (
+                "PhotosRaw/WP_20140922_14_16_27_Pro.jpg",
+                at(2014, 9, 22, 14, 16, 27),
+            ),
+            // A sequence number after the date is not a time.
+            (
+                "PhotosRaw/Darktable/20230629_no_name/20230629_0001.jpeg",
+                at(2023, 6, 29, 0, 0, 0),
+            ),
+            ("PhotosRaw/20230628_0059.jpg", at(2023, 6, 28, 0, 0, 0)),
+            (
+                "PhotosRaw/backdrops/IMG_20130625_0021.jpg",
+                at(2013, 6, 25, 0, 0, 0),
+            ),
+            (
+                "PhotosRaw/alps trip/20230628_0641 - 20230628_0661.jpg",
+                at(2023, 6, 28, 0, 0, 0),
+            ),
+        ] {
+            assert_eq!(date_from_path(path), want, "{path}");
+        }
+    }
+
+    #[test]
+    fn common_camera_and_app_names_are_read() {
+        for (path, want) in [
+            ("IMG_20190812_153012.jpg", at(2019, 8, 12, 15, 30, 12)),
+            ("PXL_20210101_123456789.jpg", at(2021, 1, 1, 12, 34, 56)),
+            (
+                "Screenshot_2021-03-04-12-30-45.png",
+                at(2021, 3, 4, 12, 30, 45),
+            ),
+            (
+                "Screenshot from 2021-03-04 12-30-45.png",
+                at(2021, 3, 4, 12, 30, 45),
+            ),
+            ("IMG-20210304-WA0001.jpg", at(2021, 3, 4, 0, 0, 0)),
+            ("20210304143012.jpg", at(2021, 3, 4, 14, 30, 12)),
+            ("2019.12.25 party.jpg", at(2019, 12, 25, 0, 0, 0)),
+            ("signal-2022-01-02-101112.jpg", at(2022, 1, 2, 10, 11, 12)),
+            ("2022-01-02T10:11:12.jpg", at(2022, 1, 2, 10, 11, 12)),
+        ] {
+            assert_eq!(date_from_path(path), want, "{path}");
+        }
+    }
+
+    #[test]
+    fn a_folder_dates_a_name_that_does_not() {
+        assert_eq!(
+            date_from_path("PhotosRaw/2016/2016-11-11/IMG_7910.jpg"),
+            at(2016, 11, 11, 0, 0, 0)
+        );
+        // The innermost folder that states a date wins.
+        assert_eq!(
+            date_from_path("2016-01-01 trip/2016-01-03/_MG_1.jpg"),
+            at(2016, 1, 3, 0, 0, 0)
+        );
+        // The name beats its folder.
+        assert_eq!(
+            date_from_path("2016-11-11/IMG_20161112_080000.jpg"),
+            at(2016, 11, 12, 8, 0, 0)
+        );
+    }
+
+    #[test]
+    fn numbers_that_are_not_dates_are_left_alone() {
+        for path in [
+            "PhotosRaw/_MG_9002.jpg",
+            "PhotosRaw/scanning/fau_2.jpg",
+            // A year folder is not a day.
+            "PhotosRaw/2016/_MG_1.jpg",
+            "IMG_1999.jpg",
+            "DSC_12345678.jpg",  // month 56
+            "20230230_0001.jpg", // 30 February
+            "120230615.jpg",     // the date is inside a longer number
+            "1612345678901.jpg", // a millisecond epoch, not a civil date
+            "2023-6-15.jpg",     // a one-digit month is too loose to trust
+        ] {
+            assert_eq!(date_from_path(path), None, "{path}");
+        }
+    }
+
+    #[test]
+    fn a_time_that_cannot_be_is_dropped_and_the_date_kept() {
+        assert_eq!(
+            date_from_path("20230615_256199.jpg"),
+            at(2023, 6, 15, 0, 0, 0)
+        );
+    }
+
+    #[test]
+    fn fill_dates_only_examined_undated_rows_and_never_overrides_exif() {
+        let c = Connection::open_in_memory().unwrap();
+        crate::schema::migrate(&c).unwrap();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'remote', 'lib')",
+            [],
+        )
+        .unwrap();
+        // (id, name, captured_at, metadata_state)
+        for (id, name, captured, state) in [
+            (1i64, "IMG_20190812_153012.jpg", None, 2i64),
+            // EXIF already answered; the name disagrees and loses.
+            (2, "IMG_20190812_153012b.jpg", Some(42i64), 2),
+            // Not yet examined: EXIF may still come, so the name waits.
+            (3, "IMG_20190813_000000.jpg", None, 1),
+            (4, "_MG_9002.jpg", None, 2),
+        ] {
+            c.execute(
+                "INSERT INTO images(id, root_id, source_ref, captured_at, metadata_state, added_at)
+                 VALUES (?1, 1, ?2, ?3, ?4, 0)",
+                rusqlite::params![id, name, captured, state],
+            )
+            .unwrap();
+        }
+        let captured = |id: i64| -> Option<i64> {
+            c.query_row("SELECT captured_at FROM images WHERE id = ?1", [id], |r| {
+                r.get(0)
+            })
+            .unwrap()
+        };
+
+        assert_eq!(fill(&c, Some(&[2, 3, 4])).unwrap(), 0);
+        assert_eq!(fill(&c, None).unwrap(), 1);
+        assert_eq!(captured(1), at(2019, 8, 12, 15, 30, 12));
+        assert_eq!(captured(2), Some(42));
+        assert_eq!(captured(3), None);
+        assert_eq!(captured(4), None);
+        // Nothing left to do is a no-op, not a rewrite.
+        assert_eq!(fill(&c, None).unwrap(), 0);
+    }
+}
@@ -301,13 +301,7 @@ fn like_prefix(path: &str) -> String {
 }

 fn label_code(l: ColourLabel) -> i64 {
-    match l {
-        ColourLabel::Red => 1,
-        ColourLabel::Yellow => 2,
-        ColourLabel::Green => 3,
-        ColourLabel::Blue => 4,
-        ColourLabel::Purple => 5,
-    }
+    crate::rating::label_code(l)
 }

 fn flag_code(f: FlagState) -> i64 {
@@ -30,7 +30,7 @@

 use rusqlite::{Connection, OptionalExtension};

-use dr_types::{FlagState, ImageId};
+use dr_types::{ColourLabel, FlagState, ImageId};

 use crate::error::CatalogError;

@@ -49,6 +49,12 @@ pub struct Judgement {
    /// 0..=5. Zero means *unrated*, which is a state in its own right.
    pub rating: u8,
    pub flag: FlagState,
+    /// TRACES: FR-CAT-5
+    /// The colour label, or `None`. Not part of [`Judgement::is_judged`]:
+    /// a label sorts photographs into piles of the photographer's own
+    /// meaning — "to print", "send to Anna" — and says nothing about whether
+    /// a frame has been culled, which is the question "unjudged" asks.
+    pub label: Option<ColourLabel>,
 }

 impl Judgement {
@@ -267,6 +273,35 @@ pub fn align_default_version_uuids(conn: &Connection) -> Result<usize, CatalogEr
    Ok(moved)
 }

+/// TRACES: FR-CAT-13
+/// How `versions.label` encodes a colour label, and back.
+///
+/// One place for both directions, so a label written by the XMP pull and a
+/// label queried by the selector cannot drift apart: the query used to hold
+/// its own copy of the forward mapping and nothing held the reverse.
+pub fn label_code(l: ColourLabel) -> i64 {
+    match l {
+        ColourLabel::Red => 1,
+        ColourLabel::Yellow => 2,
+        ColourLabel::Green => 3,
+        ColourLabel::Blue => 4,
+        ColourLabel::Purple => 5,
+    }
+}
+
+/// The colour a `versions.label` value names, or `None` for NULL and for a
+/// code this build does not know.
+pub fn label_from_code(code: Option<i64>) -> Option<ColourLabel> {
+    Some(match code? {
+        1 => ColourLabel::Red,
+        2 => ColourLabel::Yellow,
+        3 => ColourLabel::Green,
+        4 => ColourLabel::Blue,
+        5 => ColourLabel::Purple,
+        _ => return None,
+    })
+}
+
 /// The default version's row id for an image, creating one if it has none.
 ///
 /// Every write path goes through this rather than assuming a version exists.
@@ -358,6 +393,97 @@ pub fn set_flag_many(
    apply_many(conn, images, |conn, id| set_flag(conn, id, flag))
 }

+/// TRACES: FR-CAT-5
+/// Set or clear the colour label for one image.
+pub fn set_label(
+    conn: &Connection,
+    image: ImageId,
+    label: Option<ColourLabel>,
+) -> Result<(), CatalogError> {
+    let version = default_version_id(conn, image)?;
+    conn.execute(
+        "UPDATE versions SET label = ?2 WHERE id = ?1",
+        rusqlite::params![version, label.map(label_code)],
+    )?;
+    Ok(())
+}
+
+/// TRACES: FR-CAT-5
+/// Set or clear a label on many images in one transaction — one keystroke
+/// over a selection is one commit, as for [`set_rating_many`].
+pub fn set_label_many(
+    conn: &Connection,
+    images: &[ImageId],
+    label: Option<ColourLabel>,
+) -> Result<usize, CatalogError> {
+    apply_many(conn, images, |conn, id| set_label(conn, id, label))
+}
+
+/// TRACES: FR-CAT-5
+/// What a label key does to a set of images: Lightroom's toggle.
+///
+/// Pressing the key for the label every one of them already carries takes it
+/// off; otherwise every one of them gets it. Decided over the whole set
+/// rather than per image, so a selection that was half red comes out all red
+/// rather than inverted — the photographer pressed "red", and a key that
+/// turned half of them red and the other half plain would be two answers to
+/// one question.
+pub fn toggled_label(
+    current: impl IntoIterator<Item = Option<ColourLabel>>,
+    pressed: ColourLabel,
+) -> Option<ColourLabel> {
+    let mut any = false;
+    for label in current {
+        any = true;
+        if label != Some(pressed) {
+            return Some(pressed);
+        }
+    }
+    if any {
+        None
+    } else {
+        Some(pressed)
+    }
+}
+
+/// TRACES: FR-CAT-5 | FR-CAT-6
+/// How the library divides by colour label, for the filter chips' counts.
+///
+/// Index 0 is unlabelled and index `n` the label whose code is `n`. The
+/// same shape as [`rating_histogram`], and for the same reason the
+/// unlabelled slot is what is left of [`judged_rows`]: an image without a
+/// version row is unlabelled, not missing.
+///
+/// Only labelled rows are grouped. The join this replaced (2026-09-26)
+/// probed `versions_judgement` per image and then read each version's row
+/// for `label`, which the index does not carry -- 10 ms on the reference
+/// library, on every label keystroke, to find that none of 23,500 images
+/// had one. This walks the default versions in the index's order, which
+/// is close to the table's, and groups the few that are labelled.
+pub fn label_histogram(conn: &Connection) -> Result<[usize; 6], CatalogError> {
+    let mut out = [0usize; 6];
+    let mut stmt = conn.prepare_cached(
+        "SELECT label, count(*) FROM versions
+          WHERE is_default = 1 AND label IS NOT NULL
+          GROUP BY label",
+    )?;
+    let rows = stmt.query_map([], |r| Ok((r.get::<_, i64>(0)?, r.get::<_, i64>(1)?)))?;
+    let mut counted = 0usize;
+    for (code, count) in rows.flatten() {
+        // A code this build does not know counts as unlabelled, which is how
+        // `label_from_code` reads it everywhere else.
+        let slot = if label_from_code(Some(code)).is_some() {
+            code as usize
+        } else {
+            0
+        };
+        out[slot] += count as usize;
+        counted += count as usize;
+    }
+    out[0] += judged_rows(conn)?.saturating_sub(counted);
+    Ok(out)
+}
+
 /// Shared bulk wrapper, so the two axes cannot drift in their commit
 /// behaviour — a partially-committed rating and a fully-committed flag from
 /// the same keystroke would be hard to explain and harder to notice.
@@ -382,21 +508,22 @@ fn apply_many(
 /// An image with no version reads as unrated and unflagged rather than as an
 /// error: that is exactly what it is.
 pub fn judgement(conn: &Connection, image: ImageId) -> Result<Judgement, CatalogError> {
-    let row: Option<(i64, i64)> = conn
+    let row: Option<(i64, i64, Option<i64>)> = conn
        .query_row(
-            "SELECT rating, flag FROM versions
+            "SELECT rating, flag, label FROM versions
              WHERE image_id = ?1
              ORDER BY is_default DESC, id ASC
              LIMIT 1",
            [image.0 as i64],
-            |r| Ok((r.get(0)?, r.get(1)?)),
+            |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?)),
        )
        .optional()?;

    Ok(match row {
-        Some((rating, flag)) => Judgement {
+        Some((rating, flag, label)) => Judgement {
            rating: rating.clamp(0, MAX_RATING as i64) as u8,
            flag: flag_from_code(flag),
+            label: label_from_code(label),
        },
        None => Judgement::default(),
    })
@@ -423,7 +550,7 @@ pub fn judgements(
        .collect::<Vec<_>>()
        .join(",");
    let sql = format!(
-        "SELECT image_id, rating, flag FROM versions
+        "SELECT image_id, rating, flag, label FROM versions
          WHERE image_id IN ({placeholders}) AND is_default = 1"
    );

@@ -438,15 +565,17 @@ pub fn judgements(
            r.get::<_, i64>(0)?,
            r.get::<_, i64>(1)?,
            r.get::<_, i64>(2)?,
+            r.get::<_, Option<i64>>(3)?,
        ))
    })?;

-    for (image, rating, flag) in rows.flatten() {
+    for (image, rating, flag, label) in rows.flatten() {
        out.insert(
            ImageId(image as u64),
            Judgement {
                rating: rating.clamp(0, MAX_RATING as i64) as u8,
                flag: flag_from_code(flag),
+                label: label_from_code(label),
            },
        );
    }
@@ -462,25 +591,61 @@ pub fn judgements(
 pub fn rating_histogram(conn: &Connection) -> Result<[usize; 6], CatalogError> {
    let mut out = [0usize; 6];

-    // LEFT JOIN, so an image whose version row is missing still counts as
-    // unrated rather than vanishing from the totals. The histogram has to sum
-    // to the library size or it is not believable.
-    let mut stmt = conn.prepare(
-        "SELECT coalesce(v.rating, 0) AS r, count(*)
-           FROM images i
-           LEFT JOIN versions v ON v.image_id = i.id AND v.is_default = 1
-          GROUP BY r",
+    // Only the rated rows are grouped; the unrated slot is what is left of
+    // [`judged_rows`]. So an image whose version row is missing still counts
+    // as unrated rather than vanishing from the totals -- the histogram has
+    // to sum to the library size or it is not believable.
+    //
+    // It was one `images LEFT JOIN versions ... GROUP BY` until 2026-09-26:
+    // a probe of `versions_judgement` per image and a sort of every row, to
+    // put 22,000 of 23,500 in slot zero. 9 ms on every star keystroke on the
+    // reference library; this is a pass over the index that sorts only the
+    // rated few, and [`judged_rows`] is three index-only counts.
+    let mut stmt = conn.prepare_cached(
+        "SELECT rating, count(*) FROM versions
+          WHERE is_default = 1 AND rating != 0
+          GROUP BY rating",
    )?;
    let rows = stmt.query_map([], |r| Ok((r.get::<_, i64>(0)?, r.get::<_, i64>(1)?)))?;

+    let mut counted = 0usize;
    for (rating, count) in rows.flatten() {
        if let Some(slot) = out.get_mut(rating.clamp(0, MAX_RATING as i64) as usize) {
            *slot += count as usize;
+            counted += count as usize;
        }
    }
+    out[0] += judged_rows(conn)?.saturating_sub(counted);
    Ok(out)
 }

+/// How many rows `images LEFT JOIN versions ON ... AND is_default = 1` has:
+/// one per image with no default version, and one per default version for
+/// the rest. The total both histograms divide up, and the unjudged slot is
+/// what is left of it once the judged rows are counted.
+///
+/// Spelled as three counts rather than as that join because the join probes
+/// `versions_judgement` once per image, where each count here is one pass
+/// over an index without reading a row: the library size, the default
+/// versions, and the images holding one. An image with two default versions
+/// -- nothing prevents it -- is two rows of the join and one image of the
+/// third count, so it adds one here exactly as it did there. A version
+/// always belongs to an image; `foreign_keys` is on and deletes cascade.
+///
+/// `count(DISTINCT image_id)` alone in its statement: that is what lets
+/// SQLite read the distinct values off the index's order instead of
+/// building a temporary b-tree of them.
+fn judged_rows(conn: &Connection) -> Result<usize, CatalogError> {
+    let n: i64 = conn
+        .prepare_cached(
+            "SELECT (SELECT count(*) FROM images)
+                  + (SELECT count(*) FROM versions WHERE is_default = 1)
+                  - (SELECT count(DISTINCT image_id) FROM versions WHERE is_default = 1)",
+        )?
+        .query_row([], |r| r.get(0))?;
+    Ok(n.max(0) as usize)
+}
+
 /// How many images carry each flag: `(picks, rejects)`.
 pub fn flag_counts(conn: &Connection) -> Result<(usize, usize), CatalogError> {
    let picks: i64 = conn.query_row(
@@ -657,6 +822,72 @@ mod tests {
        assert_eq!(distinct, 200);
    }

+    #[test]
+    fn a_label_round_trips_and_clears() {
+        // TRACES: FR-CAT-5
+        let cat = with_images(1);
+        let id = ids(&cat)[0];
+        set_label(cat.connection(), id, Some(ColourLabel::Green)).unwrap();
+        assert_eq!(
+            judgement(cat.connection(), id).unwrap().label,
+            Some(ColourLabel::Green)
+        );
+        set_label(cat.connection(), id, None).unwrap();
+        assert_eq!(judgement(cat.connection(), id).unwrap().label, None);
+    }
+
+    #[test]
+    fn a_label_is_not_a_judgement() {
+        // "Unjudged" is the cull's resume point; a label is a pile of the
+        // photographer's own, and labelling a frame must not hide it there.
+        let cat = with_images(1);
+        let id = ids(&cat)[0];
+        set_label(cat.connection(), id, Some(ColourLabel::Red)).unwrap();
+        assert!(!judgement(cat.connection(), id).unwrap().is_judged());
+    }
+
+    #[test]
+    fn labelling_a_selection_is_one_commit_and_reaches_every_image() {
+        // TRACES: FR-CAT-5
+        let cat = with_images(4);
+        let all = ids(&cat);
+        assert_eq!(
+            set_label_many(cat.connection(), &all, Some(ColourLabel::Blue)).unwrap(),
+            4
+        );
+        let found = judgements(cat.connection(), &all).unwrap();
+        assert!(all
+            .iter()
+            .all(|id| found[id].label == Some(ColourLabel::Blue)));
+        assert_eq!(
+            label_histogram(cat.connection()).unwrap(),
+            [0, 0, 0, 0, 4, 0]
+        );
+    }
+
+    #[test]
+    fn a_label_key_toggles_only_when_every_image_already_has_it() {
+        // TRACES: FR-CAT-5
+        use ColourLabel::*;
+        assert_eq!(toggled_label([Some(Red), Some(Red)], Red), None);
+        assert_eq!(toggled_label([Some(Red), None], Red), Some(Red));
+        assert_eq!(toggled_label([Some(Blue)], Red), Some(Red));
+        assert_eq!(toggled_label([], Red), Some(Red));
+    }
+
+    #[test]
+    fn the_label_histogram_sums_to_the_library() {
+        // TRACES: FR-CAT-6
+        // Images without a version row count as unlabelled rather than
+        // vanishing, as the rating histogram's do.
+        let cat = with_images(3);
+        let first = ids(&cat)[0];
+        set_label(cat.connection(), first, Some(ColourLabel::Purple)).unwrap();
+        let h = label_histogram(cat.connection()).unwrap();
+        assert_eq!(h, [2, 0, 0, 0, 0, 1]);
+        assert_eq!(h.iter().sum::<usize>(), 3);
+    }
+
    #[test]
    fn a_rating_round_trips() {
        let cat = with_images(1);
@@ -801,6 +1032,100 @@ mod tests {
        assert_eq!(h.iter().sum::<usize>(), 4);
    }

+    /// The rows of the join the histograms used to be spelled as, grouped the
+    /// way `rating_histogram` groups them. What the counts must still agree
+    /// with, in the states nothing in the schema prevents.
+    fn by_join(cat: &Catalog, column: &str) -> Vec<(i64, i64)> {
+        cat.connection()
+            .prepare(&format!(
+                "SELECT coalesce(v.{column}, 0) AS c, count(*)
+                   FROM images i
+                   LEFT JOIN versions v ON v.image_id = i.id AND v.is_default = 1
+                  GROUP BY c ORDER BY c"
+            ))
+            .unwrap()
+            .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))
+            .unwrap()
+            .map(Result::unwrap)
+            .collect()
+    }
+
+    /// A library in every awkward state at once: an image with no version,
+    /// one with only a virtual copy, one with two default versions, and
+    /// values out of range on both axes.
+    fn awkward() -> Catalog {
+        let cat = with_images(8);
+        ensure_default_versions(cat.connection()).unwrap();
+        let all = ids(&cat);
+        let c = cat.connection();
+        set_rating(c, all[0], 5).unwrap();
+        set_rating(c, all[1], 2).unwrap();
+        set_label(c, all[1], Some(ColourLabel::Blue)).unwrap();
+        c.execute(
+            "DELETE FROM versions WHERE image_id = ?1",
+            [all[2].0 as i64],
+        )
+        .unwrap();
+        c.execute(
+            "UPDATE versions SET is_default = 0 WHERE image_id = ?1",
+            [all[3].0 as i64],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO versions(image_id, uuid, name, is_default, rating, label)
+             VALUES (?1, 'second-default', 'Copy', 1, 4, 3)",
+            [all[4].0 as i64],
+        )
+        .unwrap();
+        c.execute(
+            "UPDATE versions SET rating = -1, label = 9 WHERE image_id = ?1",
+            [all[5].0 as i64],
+        )
+        .unwrap();
+        c.execute(
+            "UPDATE versions SET rating = 7, label = 0 WHERE image_id = ?1",
+            [all[6].0 as i64],
+        )
+        .unwrap();
+        cat
+    }
+
+    /// Fold the join's rows into slots the way the old code did.
+    fn folded(rows: &[(i64, i64)], slot: impl Fn(i64) -> usize) -> [usize; 6] {
+        let mut out = [0usize; 6];
+        for &(code, n) in rows {
+            out[slot(code)] += n as usize;
+        }
+        out
+    }
+
+    #[test]
+    fn the_rating_histogram_agrees_with_the_join_it_replaced() {
+        let cat = awkward();
+        let expected = folded(&by_join(&cat, "rating"), |r| {
+            r.clamp(0, MAX_RATING as i64) as usize
+        });
+        assert_eq!(rating_histogram(cat.connection()).unwrap(), expected);
+        // Nine rows for eight images: the doubled default counts twice, as
+        // it always has.
+        assert_eq!(expected.iter().sum::<usize>(), 9);
+    }
+
+    #[test]
+    fn the_label_histogram_agrees_with_the_join_it_replaced() {
+        let cat = awkward();
+        let expected = folded(&by_join(&cat, "label"), |code| {
+            if label_from_code(Some(code)).is_some() {
+                code as usize
+            } else {
+                0
+            }
+        });
+        assert_eq!(label_histogram(cat.connection()).unwrap(), expected);
+        assert_eq!(expected[3], 1, "the second default's label is counted");
+        assert_eq!(expected.iter().sum::<usize>(), 9);
+    }
+
    #[test]
    fn flag_counts_separate_picks_from_rejects() {
        let cat = with_images(5);
@@ -16,7 +16,7 @@
 //! # The one thing a rebuild does not recover
 //!
 //! **Collections.** A manual collection is a set of images the user assembled
-//! by hand and nothing in the filesystem records it (`docs/catalog.md` §8.1) —
+//! by hand and nothing in the filesystem records it (`docs/dev/catalog.md` §8.1) —
 //! which is the whole reason the catalog file itself syncs. So the two offers
 //! are not interchangeable, and the interface must not present them as if they
 //! were: a restore keeps the user's collections, a rebuild does not.
@@ -198,6 +198,54 @@ pub fn backup_before_migration(conn: &Connection, catalog: &Path) -> Result<(),
    Ok(())
 }

+/// How long a catalog may go without a backup before the next opportunity
+/// takes one.
+///
+/// A day. The catalog is an index, so what a backup protects is the day's
+/// worth of collection and people edits the sidecars do not hold — and a
+/// second copy of a 130 MB file per launch would be a cost with nothing to
+/// show for it when the user launches four times in an afternoon.
+pub const BACKUP_EVERY: i64 = 24 * 60 * 60;
+
+/// Whether [`BACKUP_EVERY`] has passed since the newest backup, or there is
+/// none.
+///
+/// Read from the filenames, like [`backups`], so a restored or copied backup
+/// directory answers the same way it did on the machine it came from.
+pub fn backup_due(catalog: &Path) -> bool {
+    match backups(catalog).first() {
+        Some(newest) => now() - newest.taken_at >= BACKUP_EVERY,
+        None => true,
+    }
+}
+
+/// TRACES: NFR-R2
+/// Take the scheduled backup, if one is due. Returns the file written, or
+/// `None` when the newest is recent enough.
+///
+/// The scheduled half of NFR-R2 — the migration half is
+/// [`backup_before_migration`]. "On a schedule" for an application that runs
+/// when the user opens it means "at the next chance after a day has passed",
+/// and the chance the caller picks is the end of a library sweep: the
+/// catalog is quiet, the work is already off the UI thread, and it is the
+/// moment a day's edits have just been consolidated.
+///
+/// A brand-new catalog with no images is not backed up: there is nothing in
+/// it yet that a rescan would not rebuild, and the first backup would only be
+/// a copy of an empty schema.
+pub fn backup_if_due(conn: &Connection, catalog: &Path) -> Result<Option<PathBuf>, CatalogError> {
+    if !backup_due(catalog) {
+        return Ok(None);
+    }
+    let images: i64 = conn.query_row("SELECT count(*) FROM images", [], |r| r.get(0))?;
+    if images == 0 {
+        return Ok(None);
+    }
+    let path = backup(conn, catalog)?;
+    log::info!("scheduled backup of the catalog to {}", path.display());
+    Ok(Some(path))
+}
+
 /// The backups available for `catalog`, newest first.
 ///
 /// Never fails: an unreadable or absent backup directory means there are no
@@ -274,6 +322,10 @@ pub fn restore(catalog: &Path, backup: &Path) -> Result<(), CatalogError> {
 /// to move — a caller may be recovering from a file SQLite could not open
 /// because it was never created.
 pub fn set_aside(catalog: &Path) -> Result<Option<PathBuf>, CatalogError> {
+    // Whatever takes this name next — a rebuild or a restored backup — is not
+    // the file this process last backfilled. Forgotten while the path still
+    // resolves, so it is the same key the open recorded.
+    crate::backfilled::forget(catalog);
    let moved = if catalog.exists() {
        let dest = with_suffix(catalog, DAMAGED_SUFFIX);
        // An earlier damaged copy is replaced rather than accumulating: two of
@@ -386,6 +438,49 @@ mod tests {
        base
    }

+    #[test]
+    fn a_scheduled_backup_is_taken_once_a_day_and_not_more() {
+        let dir = tempdir("scheduled");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 3);
+        let cat = Catalog::open(&path).unwrap();
+
+        // Nothing yet: due.
+        assert!(backup_due(&path));
+        let first = backup_if_due(cat.connection(), &path).unwrap();
+        assert!(first.is_some(), "the first opportunity takes one");
+
+        // Taken just now: not due, and a second call does nothing.
+        assert!(!backup_due(&path));
+        assert_eq!(backup_if_due(cat.connection(), &path).unwrap(), None);
+        assert_eq!(backups(&path).len(), 1);
+
+        // Age the one backup past the interval by renaming it, since the
+        // timestamp is read from the name. Now it is due again.
+        let old = first.unwrap();
+        let aged = old
+            .parent()
+            .unwrap()
+            .join(format!("catalog-{}.sqlite", now() - BACKUP_EVERY - 1));
+        std::fs::rename(&old, &aged).unwrap();
+        assert!(backup_due(&path));
+        assert!(backup_if_due(cat.connection(), &path).unwrap().is_some());
+        assert_eq!(backups(&path).len(), 2);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn an_empty_catalog_is_not_worth_backing_up() {
+        let dir = tempdir("empty");
+        let path = dir.join("catalog.sqlite");
+        let cat = Catalog::open(&path).unwrap();
+        assert!(backup_due(&path), "due in principle");
+        assert_eq!(backup_if_due(cat.connection(), &path).unwrap(), None);
+        assert!(backups(&path).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
    /// A catalog on disk with enough rows to span several pages, closed.
    ///
    /// Closed matters: WAL means the rows are in `catalog.sqlite-wal` until
@@ -479,7 +574,7 @@ mod tests {
        // The first NFR-R6 branch, asserted on the thing that distinguishes it
        // from the second: a collection exists nowhere but the catalog, so it
        // is the evidence that the *contents* came back and not merely a
-        // readable file (docs/catalog.md §8.1).
+        // readable file (docs/dev/catalog.md §8.1).
        let dir = tempdir("restore");
        let path = dir.join("catalog.sqlite");
        fixture(&path, 500);
@@ -77,7 +77,7 @@ pub enum Outcome {

 /// Something that can actually do the work a job describes.
 ///
-/// The catalog knows what needs doing and nothing about how — a thumbnail
+/// The catalog knows what needs doing and nothing about how — face detection
 /// needs a decoder, a fetch needs a network stack, and neither belongs under
 /// `core/dr-catalog` (ARCH §4.1: calls go downward). So the queue lives here
 /// and the handlers are supplied from above.
@@ -187,17 +187,19 @@ pub struct Recovered {
    pub reclaimed: usize,
    /// Jobs deleted because the photograph they name no longer exists.
    pub reaped: usize,
+    /// Jobs deleted because their kind is retired ([`JobKind::RETIRED`]).
+    pub retired: usize,
 }

 impl Recovered {
    pub fn did_anything(&self) -> bool {
-        self.reclaimed > 0 || self.reaped > 0
+        self.reclaimed > 0 || self.reaped > 0 || self.retired > 0
    }
 }

 /// Ready the queue for a fresh run, before any worker touches it.
 ///
-/// Two distinct cleanups, and both are startup-only:
+/// Three distinct cleanups, and all are startup-only:
 ///
 /// - **Reclaim.** A `Running` row has no owner; the process that claimed it is
 ///   gone. On Android that is a routine morning, not a crash (FR-PLAT-AND-3).
@@ -205,19 +207,27 @@ impl Recovered {
 ///   process down with it three times running should not be retried forever,
 ///   and the attempt counter is the only evidence of that we have.
 /// - **Reap.** Jobs naming an image the catalog no longer has. A library that
-///   has been culled leaves thumbnail jobs for photographs that were deleted
+///   has been culled leaves jobs for photographs that were deleted
 ///   months ago, and every one of them would be claimed, run and failed.
+/// - **Retire.** Rows of a kind nothing enqueues or claims any more
+///   ([`jobs::drop_retired`]). Here rather than in a migration so that no
+///   schema bump locks an older device out of the synced catalog, and every
+///   time rather than once because an older build sharing the catalog will
+///   queue them again.
 ///
-/// Reclaim runs first so its count is the honest number of interrupted jobs,
+/// Retiring runs first, so the other two never touch rows about to go.
+/// Reclaim runs next so its count is the honest number of interrupted jobs,
 /// before reaping removes whichever of them pointed at nothing.
 ///
 /// **Call this exactly once per catalog, at startup.** It cannot distinguish a
 /// job a dead process was holding from one a live runner is holding right now,
 /// because there is no owner column — the queue is durable, not distributed.
 pub fn recover(conn: &Connection) -> Result<Recovered, CatalogError> {
+    let retired = jobs::drop_retired(conn)?;
    Ok(Recovered {
        reclaimed: jobs::recover_orphaned(conn)?,
        reaped: jobs::reap_orphan_subjects(conn)?,
+        retired,
    })
 }

@@ -729,7 +739,7 @@ mod tests {
        // which is the window a durable queue exists to survive: no `complete`,
        // no `fail`, just a row marked `Running` with nobody holding it.
        let c = db();
-        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::ContentHash, 1);

        // The dead process. It claimed the job and never came back.
        let claimed = jobs::claim_next(&c, 0).unwrap().expect("claimable");
@@ -738,7 +748,7 @@ mod tests {
        // A fresh runner, before it starts, finds the queue empty — the row is
        // `Running` and no claim will touch it.
        let seen = Arc::new(Mutex::new(Vec::new()));
-        let mut runner = Runner::new(&c).with(recording(vec![JobKind::Thumbnail], seen.clone()));
+        let mut runner = Runner::new(&c).with(recording(vec![JobKind::ContentHash], seen.clone()));
        assert_eq!(
            runner.drain_all(0).unwrap().ran(),
            0,
@@ -766,7 +776,7 @@ mod tests {
        // the only evidence we keep across a death. Without this a poison-pill
        // job would be reclaimed and re-run forever.
        let c = db();
-        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::ContentHash, 1);

        for _ in 0..MAX_ATTEMPTS {
            jobs::claim_next(&c, 0).unwrap().expect("claimable");
@@ -782,13 +792,49 @@ mod tests {
        assert_eq!(state, JobState::Failed as i64);
    }

+    #[test]
+    fn recovery_drops_retired_kinds_every_time_and_nothing_else() {
+        // What 0.16.0 left behind: a thumbnail job per photograph that nothing
+        // would ever claim, beside live work that must survive.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::Thumbnail, 2);
+        enqueue(
+            &c,
+            JobKind::DetectFaces,
+            Some(1),
+            Priority::Background,
+            None,
+        )
+        .unwrap();
+
+        let first = recover(&c).unwrap();
+        assert_eq!(first.retired, 2);
+        assert!(first.did_anything());
+
+        let kinds: Vec<i64> = c
+            .prepare("SELECT kind FROM jobs")
+            .unwrap()
+            .query_map([], |r| r.get(0))
+            .unwrap()
+            .map(Result::unwrap)
+            .collect();
+        assert_eq!(kinds, vec![JobKind::DetectFaces as i64]);
+
+        // An older build opening the same catalog queues them again on its
+        // next scan. The next open by this one clears them again.
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        assert_eq!(recover(&c).unwrap().retired, 1);
+        assert_eq!(recover(&c).unwrap(), Recovered::default());
+    }
+
    #[test]
    fn recovery_drops_jobs_whose_photograph_is_gone() {
        // A culled library leaves thumbnail jobs for images deleted months
        // ago. Every one would be claimed, run and failed.
        let c = db();
-        queued(&c, JobKind::Thumbnail, 1);
-        queued(&c, JobKind::Thumbnail, 2);
+        queued(&c, JobKind::ContentHash, 1);
+        queued(&c, JobKind::ContentHash, 2);
        c.execute("DELETE FROM images WHERE id = 2", []).unwrap();

        let recovered = recover(&c).unwrap();
@@ -804,7 +850,7 @@ mod tests {
    #[test]
    fn a_quiet_startup_recovers_nothing() {
        let c = db();
-        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::ContentHash, 1);
        assert_eq!(recover(&c).unwrap(), Recovered::default());
        assert!(!recover(&c).unwrap().did_anything());
    }
@@ -15,7 +15,7 @@ use rusqlite::Connection;
 use crate::error::CatalogError;

 /// Schema version this build writes and understands.
-pub const SCHEMA_VERSION: i64 = 13;
+pub const SCHEMA_VERSION: i64 = 20;

 /// Apply migrations up to [`SCHEMA_VERSION`].
 ///
@@ -119,9 +119,181 @@ pub fn migrate(conn: &Connection) -> Result<i64, CatalogError> {
        tx.commit()?;
    }

+    if from < 14 {
+        let tx = conn.unchecked_transaction()?;
+        // `ALTER TABLE ... ADD COLUMN` has no `IF NOT EXISTS`, and NFR-R5
+        // wants this re-enterable: a catalog whose `user_version` was rewound
+        // by a rollback already has the column, and would otherwise fail its
+        // next open on it.
+        let has_quality: bool = tx
+            .prepare("SELECT 1 FROM pragma_table_info('faces') WHERE name = 'quality'")?
+            .exists([])?;
+        if !has_quality {
+            tx.execute_batch("ALTER TABLE faces ADD COLUMN quality REAL;")?;
+        }
+        tx.execute_batch(V14)?;
+        tx.pragma_update(None, "user_version", 14)?;
+        tx.commit()?;
+    }
+
+    if from < 15 {
+        let tx = conn.unchecked_transaction()?;
+        tx.execute_batch(V15)?;
+        tx.pragma_update(None, "user_version", 15)?;
+        tx.commit()?;
+    }
+
+    if from < 16 {
+        let tx = conn.unchecked_transaction()?;
+        // Guarded like V14's column, and for the same reason: `ALTER TABLE
+        // ... ADD COLUMN` has no `IF NOT EXISTS`, and this step must be
+        // re-enterable (NFR-R5).
+        for column in EYE_COLUMNS {
+            let present: bool = tx
+                .prepare("SELECT 1 FROM pragma_table_info('faces') WHERE name = ?1")?
+                .exists([column])?;
+            if !present {
+                tx.execute_batch(&format!("ALTER TABLE faces ADD COLUMN {column} REAL;"))?;
+            }
+        }
+        tx.pragma_update(None, "user_version", 16)?;
+        tx.commit()?;
+    }
+
+    if from < 17 {
+        let tx = conn.unchecked_transaction()?;
+        tx.execute_batch(V17)?;
+        tx.pragma_update(None, "user_version", 17)?;
+        tx.commit()?;
+    }
+
+    if from < 18 {
+        let tx = conn.unchecked_transaction()?;
+        // Guarded like V14's and V16's columns: ALTER has no IF NOT EXISTS
+        // and the step must be re-enterable (NFR-R5).
+        let present: bool = tx
+            .prepare("SELECT 1 FROM pragma_table_info('faces') WHERE name = 'landmarks_dense'")?
+            .exists([])?;
+        if !present {
+            tx.execute_batch("ALTER TABLE faces ADD COLUMN landmarks_dense BLOB;")?;
+        }
+        tx.pragma_update(None, "user_version", 18)?;
+        tx.commit()?;
+    }
+
+    if from < 19 {
+        let tx = conn.unchecked_transaction()?;
+        tx.execute_batch(V19)?;
+        tx.pragma_update(None, "user_version", 19)?;
+        tx.commit()?;
+    }
+
+    if from < 20 {
+        let tx = conn.unchecked_transaction()?;
+        v20_markers_name_the_detector_that_found_the_faces(&tx)?;
+        tx.pragma_update(None, "user_version", 20)?;
+        tx.commit()?;
+    }
+
    Ok(from)
 }

+// V20 -- TRACES: FR-CAT-7
+//
+// Run markers that named the wrong detector, put right.
+//
+// `faces::record_updates` -- the write behind the quality, eye and crop
+// passes -- re-marked an image under the pipeline the pass ran as, while
+// the faces it had updated kept the id of the detector that found them.
+// A marker of `scrfd_10g+w600k_mbf` over faces spelled `w600k_mbf` reads,
+// to every consumer, as the thorough detector having examined the image:
+// the upgrade repair skips it, and `face_shard::export_to_shards` selects
+// its faces by the marker's id, finds none, and tells every other device
+// that the thorough detector found nothing there. The desktop's shard index
+// held 54 such entries over photographs with named faces, and the tablet's
+// eye pass over faces it had adopted from the desktop had made 430 more.
+//
+// The write is fixed to keep the marker under the faces' own id. This puts
+// the markers already written right, with a fresh time so the export sends
+// each image again under an entry newer than the empty one -- which is what
+// `held_model` orders by. Where the right marker is still there beside the
+// wrong one (the old write inserted rather than replaced), the wrong one
+// goes and the right one is refreshed for the same reason: its entry in
+// the shards is older than the empty one, and a device that has neither
+// would take the empty one. An image V14 left with faces and no marker at
+// all is not touched: that state is the quality pass's cue, and the fixed
+// write marks it correctly when the pass reaches it.
+//
+// Restated in Rust rather than SQL because the embedder half of a pipeline
+// id is `faces::embedder_sql`, which this must agree with.
+fn v20_markers_name_the_detector_that_found_the_faces(tx: &Connection) -> Result<(), CatalogError> {
+    let fi = crate::faces::embedder_sql("face_index.model_id");
+    let f = crate::faces::embedder_sql("f.model_id");
+    // A marker is wrong when the image holds faces of its embedder under
+    // another id. First the wrong ones that sit beside a right one -- the
+    // update below would collide with it -- then the rest are renamed.
+    let wrong = format!(
+        "EXISTS (SELECT 1 FROM faces f
+                  WHERE f.image_id = face_index.image_id
+                    AND {f} = {fi}
+                    AND f.model_id != face_index.model_id)"
+    );
+    let found_by = format!(
+        "(SELECT MIN(f.model_id) FROM faces f
+           WHERE f.image_id = face_index.image_id AND {f} = {fi})"
+    );
+    let now = crate::faces::now_secs();
+    tx.execute(
+        &format!(
+            "UPDATE face_index
+                SET indexed_at = ?1
+              WHERE model_id = {found_by}
+                AND EXISTS (SELECT 1 FROM face_index w
+                             WHERE w.image_id = face_index.image_id
+                               AND w.model_id != face_index.model_id
+                               AND {} = {fi})",
+            crate::faces::embedder_sql("w.model_id")
+        ),
+        [now],
+    )?;
+    tx.execute(
+        &format!(
+            "DELETE FROM face_index
+              WHERE {wrong}
+                AND EXISTS (SELECT 1 FROM face_index o
+                             WHERE o.image_id = face_index.image_id
+                               AND o.model_id = {found_by})"
+        ),
+        [],
+    )?;
+    tx.execute(
+        &format!(
+            "UPDATE face_index
+                SET model_id = {found_by},
+                    faces_found = (SELECT COUNT(*) FROM faces f
+                                    WHERE f.image_id = face_index.image_id AND {f} = {fi}),
+                    indexed_at = ?1
+              WHERE {wrong}"
+        ),
+        [now],
+    )?;
+    Ok(())
+}
+
+/// The seven columns V16 adds to `faces`, in the order the readers name them.
+///
+/// Named once because three places have to agree on them: this migration,
+/// [`for_attached`], and the face shard's own catch-up (`face_shard`).
+pub const EYE_COLUMNS: [&str; 7] = [
+    "eye_right",
+    "eye_right_px",
+    "eye_right_sharp",
+    "eye_left",
+    "eye_left_px",
+    "eye_left_sharp",
+    "sunglasses",
+];
+
 /// Recompute columns a migration added, for rows that predate it.
 ///
 /// A migration adds a column with a default; it cannot know what the value
@@ -129,8 +301,11 @@ pub fn migrate(conn: &Connection) -> Result<i64, CatalogError> {
 /// silently partial — present, queryable, and wrong — which is worse than
 /// missing, because nothing signals that they need attention.
 ///
-/// Cheap enough to run on every open: each pass is one indexed UPDATE, and
-/// re-running it is a no-op once the values are already right.
+/// Idempotent: re-running it is a no-op once the values are already right.
+/// [`crate::Catalog::open`] runs it once per catalog state rather than on
+/// every open — each pass scans a whole table, and together they were most of
+/// what an open cost — and `backfilled` in this crate says what counts as a
+/// new state.
 ///
 /// Returns how many rows each backfill touched, for logging.
 pub fn backfill(conn: &Connection) -> Result<Vec<(&'static str, usize)>, CatalogError> {
@@ -181,14 +356,50 @@ pub fn backfill(conn: &Connection) -> Result<Vec<(&'static str, usize)>, Catalog
        out.push(("keyword_terms", n));
    }

+    // TRACES: FR-CAT-5
+    // A date from the file's name for every examined image EXIF left undated.
+    // The sweep does this as it examines each image; this is for the images
+    // examined by a build that did not, and reads the undated side alone.
+    let n = crate::name_dates::fill(conn, None)?;
+    if n > 0 {
+        out.push(("dates_from_names", n));
+    }
+
    Ok(out)
 }

+/// How long a connection waits for a writer to finish before giving up.
+///
+/// TRACES: NFR-R1
+/// SQLite's default is **zero** — the loser of a race gets `SQLITE_BUSY` at
+/// once rather than a turn — and WAL does not change that for two writers. One
+/// writer and many readers is the case WAL makes free; this is the other one,
+/// and this application has it constantly: the face sweep commits a batch while
+/// reclustering reads, the derived sync imports shards while the sweep writes.
+///
+/// Without a timeout that contention was *lost work*, not a retry. A face
+/// sweep that had already paid for the detection and the embedding — the
+/// expensive part, seconds per image — threw the result away on
+/// `storing faces for 214: database is locked` and moved on, and both the
+/// desktop and the tablet logged runs of those on consecutive images.
+///
+/// Ten seconds, matching the figure the job runner's tests already use for the
+/// same reason. It is far longer than any transaction here (a sweep batch is
+/// sub-second; the slowest is a WAL checkpoint of a 130 MB catalog), so in
+/// practice it is a bound on pathology rather than a wait anyone sits through.
+/// The tension with NFR-P9 is real but one-sided: a query on the UI thread
+/// would rather wait for its turn than fail, because the failure is what the
+/// user sees as "cannot open catalog".
+const BUSY_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+
 /// Connection setup applied on every open, migration or not.
 ///
 /// WAL is required by NFR-R1: it survives power loss without corruption, and
 /// it lets a background job write while the grid reads.
 pub fn configure(conn: &Connection) -> Result<(), CatalogError> {
+    // Before the pragmas, so that a connection racing a migration waits for it
+    // rather than failing on the first statement it tries.
+    conn.busy_timeout(BUSY_TIMEOUT)?;
    conn.pragma_update(None, "journal_mode", "WAL")?;
    // NORMAL rather than FULL: with WAL this is durable across process death
    // (which is what FR-PLAT-AND-3 cares about) and only risks the last
@@ -251,7 +462,16 @@ pub fn for_attached(schema_name: &str) -> String {
    format!(
        "{}\n{}\n{}\n\
         ALTER TABLE {schema_name}.people ADD COLUMN ignored INTEGER NOT NULL DEFAULT 0;\n\
-         ALTER TABLE {schema_name}.faces ADD COLUMN crop BLOB;",
+         ALTER TABLE {schema_name}.faces ADD COLUMN crop BLOB;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN quality REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_right REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_right_px REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_right_sharp REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_left REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_left_px REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN eye_left_sharp REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN sunglasses REAL;\n\
+         ALTER TABLE {schema_name}.faces ADD COLUMN landmarks_dense BLOB;",
        rewrite_for_attached(V1, schema_name),
        rewrite_for_attached(V6, schema_name),
        rewrite_for_attached(V8, schema_name),
@@ -286,15 +506,51 @@ fn rewrite_for_attached(sql: &str, schema_name: &str) -> String {
 fn pair_raw_and_jpeg(conn: &Connection) -> Result<usize, CatalogError> {
    use std::collections::HashMap;

-    // (folder, lowercase stem) -> RAW id, built in one pass over the RAWs.
+    // The small side first: the JPEGs not yet paired. On a settled library
+    // these are the ones with no RAW beside them -- 1,900 of 24,000 on the
+    // reference library -- and this runs on every open, including the ones
+    // the develop view makes for each photograph it fetches. Reading every
+    // RAW to find the handful that share a folder with one of them was most
+    // of what opening the catalog cost.
+    let jpegs: Vec<(i64, Option<i64>, String)> = {
+        let mut stmt = conn.prepare(
+            "SELECT id, folder_id, source_ref FROM images
+              WHERE lower(format) IN ('jpg','jpeg') AND shadowed_by IS NULL",
+        )?;
+        let rows = stmt.query_map([], |r| {
+            Ok((
+                r.get::<_, i64>(0)?,
+                r.get::<_, Option<i64>>(1)?,
+                r.get::<_, String>(2)?,
+            ))
+        })?;
+        rows.filter_map(Result::ok).collect()
+    };
+    if jpegs.is_empty() {
+        return Ok(0);
+    }
+
+    // (folder, lowercase stem) -> RAW id, over the folders those JPEGs are in
+    // and no others: a pair is same-folder by definition. Ordered by id so
+    // that where two RAWs share a stem the later one wins, as it did when this
+    // read every RAW in table order.
+    let mut folders: Vec<i64> = jpegs.iter().filter_map(|(_, f, _)| *f).collect();
+    folders.sort_unstable();
+    folders.dedup();
+    let unfiled = jpegs.iter().any(|(_, f, _)| f.is_none());
+    let folders = serde_json::to_string(&folders).unwrap_or_else(|_| "[]".to_string());
+
    let mut raws: HashMap<(Option<i64>, String), i64> = HashMap::new();
    {
        let mut stmt = conn.prepare(
            "SELECT id, folder_id, source_ref FROM images
              WHERE lower(format) IN
-                    ('cr2','cr3','nef','arw','raf','rw2','orf','dng')",
+                    ('cr2','cr3','nef','arw','raf','rw2','orf','dng')
+                AND (folder_id IN (SELECT value FROM json_each(?1))
+                     OR (?2 AND folder_id IS NULL))
+              ORDER BY id",
        )?;
-        let rows = stmt.query_map([], |r| {
+        let rows = stmt.query_map(rusqlite::params![folders, unfiled], |r| {
            Ok((
                r.get::<_, i64>(0)?,
                r.get::<_, Option<i64>>(1)?,
@@ -310,25 +566,16 @@ fn pair_raw_and_jpeg(conn: &Connection) -> Result<usize, CatalogError> {
        return Ok(0);
    }

-    let pairs: Vec<(i64, i64)> = {
-        let mut stmt = conn.prepare(
-            "SELECT id, folder_id, source_ref FROM images
-              WHERE lower(format) IN ('jpg','jpeg') AND shadowed_by IS NULL",
-        )?;
-        let rows = stmt.query_map([], |r| {
-            Ok((
-                r.get::<_, i64>(0)?,
-                r.get::<_, Option<i64>>(1)?,
-                r.get::<_, String>(2)?,
-            ))
-        })?;
-        rows.filter_map(|row| {
-            let (id, folder, path) = row.ok()?;
-            let raw = raws.get(&(folder, stem_of(&path).to_ascii_lowercase()))?;
-            Some((id, *raw))
+    let pairs: Vec<(i64, i64)> = jpegs
+        .iter()
+        .filter_map(|(id, folder, path)| {
+            let raw = raws.get(&(*folder, stem_of(path).to_ascii_lowercase()))?;
+            Some((*id, *raw))
        })
-        .collect()
-    };
+        .collect();
+    if pairs.is_empty() {
+        return Ok(0);
+    }

    let tx = conn.unchecked_transaction()?;
    for (jpeg, raw) in &pairs {
@@ -569,6 +816,195 @@ CREATE TABLE IF NOT EXISTS sidecars (
 );
 "#;

+const V14: &str = r#"
+-- TRACES: FR-CULL-9 | FR-CULL-10
+-- How recognisable the model found each face, and a second look at the faces
+-- it was never asked about.
+--
+-- The embedder's raw output has a length, and the length is a quality
+-- reading: it grows with how much of a face the model could make out, and a
+-- blur, an occlusion or a hard profile comes out short (dr_face::embedding,
+-- `MIN_GALLERY_QUALITY`). Normalising threw it away. A short vector sits
+-- near the middle of the sphere and matches a little of everyone, which is
+-- how one bad crop bridges two people in a grouping pass -- so a face below
+-- the floor is compared against the others and never compared *against*.
+--
+-- Nullable, and NULL means "never measured": every face indexed before this
+-- version stored the unit vector, whose length is one whatever the crop was.
+-- A face with no reading is admitted to the gallery, because a rule that
+-- cannot be checked should admit rather than exclude -- but it is also a
+-- face this rule is not yet protecting anyone from, and the only way to
+-- measure it is to embed it again.
+--
+-- The `face-quality` repair is what does that (`dr_ui::repairs`, once the
+-- sweep's measuring pass): it lists every face with no reading, and each is
+-- embedded again from the native render with the landmarks it already has,
+-- the raw vector written over the old one (`record_updates`) and nothing
+-- else touched -- not the id, not the box, not who the user said it was.
+-- The faces keep drawing the People screen throughout.
+--
+-- The run markers of those images are forgotten too, exactly as V12 forgot
+-- the runs made against too small a proxy. The build this shipped in had no
+-- measuring pass yet, and a marker is the one thing that stops a face ever
+-- being looked at again; with the repair in place, detection leaves an
+-- image holding this embedder's faces to it rather than detecting from
+-- scratch, so the deletion costs nothing -- and an image that was examined
+-- and found empty keeps its marker, since there is nothing on it to measure.
+--
+-- The cost is a re-fetch of every image with a face on it, on the next pass
+-- the user starts. That is a whole-library transfer (FR-NC-6), and it starts
+-- when they say so, not here.
+--
+-- From this version the `embedding` blob is the **raw** model output rather
+-- than the unit vector V8 describes -- the length is the quality, and a store
+-- that kept only the direction had thrown it away. Readers re-normalise on
+-- load, so a unit blob from before and a raw blob from now compare alike;
+-- `quality` is that length kept beside the blob for the readers that never
+-- load the vector, and NULL rather than 1.0 for the old rows, because a unit
+-- vector reads as a length of one and one is not "unmeasured".
+--
+-- The column itself is added in `migrate`, guarded, because ALTER has no
+-- IF NOT EXISTS and this step has to be re-enterable (NFR-R5).
+DELETE FROM face_index
+ WHERE EXISTS (SELECT 1 FROM faces f
+                WHERE f.image_id = face_index.image_id
+                  AND f.model_id = face_index.model_id);
+"#;
+
+const V15: &str = r#"
+-- TRACES: FR-CAT-13
+-- Where a standard XMP sidecar and the catalog disagree.
+--
+-- An `.xmp` beside a photograph is read on the same pull as DarkRoom's own
+-- sidecar, and reconciled field by field (`dr_xmp::reconcile`): keywords
+-- union, and a rating, label or caption is taken only where the catalog holds
+-- none. That rule is the safe one and it is not always the right one -- a
+-- rating changed in Lightroom after it was changed here is a genuine
+-- disagreement, and a standard XMP carries no revision to settle it by. So
+-- the disagreement is written here instead of being resolved, and the
+-- requirement's "a metadata reload offered" is a row in this table with a
+-- button in front of it: the reload re-reads the file with the sidecar
+-- winning, and deletes the row.
+--
+-- Keyed on the sidecar's path like `sidecars` is, and for the same reason: a
+-- path is what the scan reports, what a fetch addresses, and what the ETag
+-- that noticed the change belongs to. `fields` is the disagreeing fields as
+-- `dr_xmp` names them, space-separated, for the line the settings page shows.
+--
+-- Rebuildable: the next pull that sees a changed ETag writes the row again.
+CREATE TABLE IF NOT EXISTS xmp_conflicts (
+    root_id INTEGER NOT NULL REFERENCES roots(id) ON DELETE CASCADE,
+    path    TEXT    NOT NULL,
+    fields  TEXT    NOT NULL,
+    seen_at INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY(root_id, path)
+);
+"#;
+
+// V19 -- TRACES: NFR-P9
+//
+// The indexes the repair counts are served from, and V17's lesson applied
+// to the rest of the face columns.
+//
+// "How many images still owe a quality reading" was answered per image: a
+// correlated EXISTS over `faces` that had to open each face's row to look
+// at one nullable column -- the row being eight kilobytes of embedding and
+// crop. Six such counts run every time the Identity screen opens and every
+// time a sweep ends, 160 ms of them on the reference library. Three
+// partial indexes hold only the faces still owing each pass, keyed by the
+// image and carrying the model id the predicate also reads, so the count
+// walks a few thousand index entries and touches no row at all -- and each
+// index shrinks to nothing as its pass completes. The planner takes them
+// when the count is driven from `faces` (`repairs::count`) and ignores
+// them inside the per-image EXISTS, which is why that function has two
+// spellings of the same predicate.
+//
+// `faces_image_model` replaces `faces_image`: the same key with the model
+// id beside it, so "does this image hold this embedder's faces" -- asked in
+// the audit, the proxy repair and the outstanding-detection count -- is an
+// index-only probe where it used to read the row for the model id. Every
+// lookup that used `faces_image` is served by its prefix.
+//
+// Not applied to attached catalogs, like V7 and V17: an index is a local
+// concern, and a merge never runs these queries across an attachment.
+
+const V19: &str = r#"
+CREATE INDEX IF NOT EXISTS faces_image_model ON faces(image_id, model_id);
+DROP INDEX IF EXISTS faces_image;
+CREATE INDEX IF NOT EXISTS faces_owed_quality ON faces(image_id, model_id)
+    WHERE quality IS NULL;
+CREATE INDEX IF NOT EXISTS faces_owed_crop ON faces(image_id, model_id)
+    WHERE crop IS NULL;
+CREATE INDEX IF NOT EXISTS faces_owed_eyes ON faces(image_id, model_id)
+    WHERE eye_right IS NULL OR landmarks_dense IS NULL;
+"#;
+
+// V18 -- TRACES: FR-CULL-8a | FR-CULL-12
+//
+// The 106 dense landmarks the eye pass reads its eye boxes from, kept beside
+// the reading as `dr_face::Landmarks::to_packed_bytes`: 106 x (x, y) as
+// 16-bit fixed point over the frame, 424 bytes a face, a seventh of a
+// pixel on a 6000-pixel frame. Derived data under FR-CULL-12 -- rebuilt by
+// re-reading, never in a sidecar -- and stored for the same reason the
+// embedding is: it cost a fetch of the original and a model run, and the
+// next per-face pass (head pose, expression) should not have to pay either
+// again. NULL where the face was never read.
+//
+// Added in `migrate`, guarded, like every ALTER here (NFR-R5).
+
+const V17: &str = r#"
+-- TRACES: FR-CULL-8a | FR-CULL-13 | NFR-P9
+-- The eyes-open filter's index, and a lesson about where a column lands.
+--
+-- The people filter is a correlated EXISTS over `faces` per image, and it
+-- was fast because `faces_image` *covers* it: the subquery never touched a
+-- row. Reading V16's seven eye columns in the same subquery did touch the
+-- row -- and `ALTER TABLE ADD COLUMN` puts a column at the end of the
+-- record, after the 1 KB embedding and the ~5 KB crop, so every check
+-- dragged six kilobytes off disk to reach seven floats. Measured on the
+-- reference library: 24 seconds for one count, thirteen of them system
+-- time. With this index the same count takes five milliseconds, because
+-- the subquery is served from the index again and never reads a row.
+--
+-- The columns are listed in EYE_COLUMNS' order behind `image_id`, which is
+-- the key the subquery searches on. Nothing else changed in V17; a catalog
+-- already at V16 needs only this.
+CREATE INDEX IF NOT EXISTS faces_eyes ON faces(
+    image_id, eye_right, eye_right_px, eye_right_sharp,
+    eye_left, eye_left_px, eye_left_sharp, sunglasses
+);
+"#;
+
+// V16 -- TRACES: FR-CULL-8a
+//
+// What each face's eyes are doing: for each eye P(open), the source pixels
+// across its box and the sharpness of the patch the classifier saw; and
+// P(sunglasses) for the head. Seven numbers rather than a verdict, because
+// the verdict is a rule with thresholds in it (dr_face::eyes::EyeReading::
+// state) and a rule belongs in code that can be changed, not in rows that
+// would have to be re-measured.
+//
+// The pixels and the sharpness are what stop a smear reading as a blink: an
+// eye too small or too soft to read is not asked, and a face with no
+// readable eye is "unclear", which no filter drops. Sunglasses are a column
+// of their own for the same kind of reason — the eye classifier answers
+// confidently over dark glass, and its answer means nothing there. A filter
+// for "eyes open" reads all seven.
+//
+// NULL means "never measured" -- a face indexed before this version, or on a
+// device without the eye models -- and a NULL is left alone by every filter
+// that reads these, so an old library does not empty its grid the moment the
+// chip is pressed. The sweep's measuring pass fills them in, from the native
+// render, with the landmarks already stored: the same pass V14 built for the
+// embedding's length, extended to ask the eye models too. No run marker is
+// forgotten here, for the reason V14's note gives -- the measuring pass
+// finds its own work by the NULL, and deleting markers would only put the
+// detector back over images it has finished with.
+//
+// The columns are added in `migrate`, guarded, because ALTER has no IF NOT
+// EXISTS and the step has to be re-enterable (NFR-R5). Their names are
+// `EYE_COLUMNS`.
+
 const V9: &str = r#"
 -- TRACES: FR-CULL-8
 -- A record that face detection has *run* on an image, distinct from what it
@@ -612,7 +1048,7 @@ CREATE INDEX face_index_model ON face_index(model_id);

 const V8: &str = r#"
 -- TRACES: FR-CULL-8 | FR-CULL-9 | FR-CULL-10 | FR-CULL-11 | FR-CULL-12 | NFR-SEC-5
-- People and faces (docs/faces.md, docs/catalog.md §10).
+-- People and faces (docs/dev/faces.md, docs/dev/catalog.md §10).
 --
 -- Everything here is **derived data** except one column. Faces, landmarks,
 -- embeddings, cluster assignments and suggestions are all reproducible by
@@ -648,8 +1084,8 @@ CREATE TABLE faces (
    x REAL NOT NULL, y REAL NOT NULL, w REAL NOT NULL, h REAL NOT NULL,
    landmarks  BLOB NOT NULL,          -- 5 x (x, y) f32, normalised likewise
    detector_confidence REAL NOT NULL,
-    embedding  BLOB NOT NULL,          -- 512 x f16, L2-normalised
-    -- Source pixels across the aligned 112x112 crop (docs/faces.md §7).
+    embedding  BLOB NOT NULL,          -- 512 x f16; unit length until V14, raw since
+    -- Source pixels across the aligned 112x112 crop (docs/dev/faces.md §7).
    --
    -- Not cosmetic: it is the honest quality signal for the UI, a feature in
    -- the §8 calibration -- FR-CULL-9 names face size as an axis along which an
@@ -1038,6 +1474,60 @@ CREATE INDEX jobs_ready ON jobs(state, priority DESC, not_before);

 #[cfg(test)]
 mod tests {
+
+    #[test]
+    fn a_writer_waits_for_its_turn_rather_than_losing_its_work() {
+        // The failure this exists for: a face sweep that had already paid for
+        // the detection and the embedding threw the result away on
+        // "database is locked" and moved on. WAL does not help here — it makes
+        // one writer and many readers free, and this is two writers.
+        let dir = std::env::temp_dir().join(format!(
+            "dr-busy-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let path = dir.join("catalog.sqlite");
+
+        let held = rusqlite::Connection::open(&path).unwrap();
+        configure(&held).unwrap();
+        migrate(&held).unwrap();
+
+        let other = rusqlite::Connection::open(&path).unwrap();
+        configure(&other).unwrap();
+
+        // Every connection carries the timeout, which is what makes the wait
+        // below a wait rather than an immediate error.
+        let timeout: i64 = other
+            .query_row("PRAGMA busy_timeout", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(timeout, BUSY_TIMEOUT.as_millis() as i64);
+
+        // A writer holds the database; the other one must still get its turn
+        // once the first commits, rather than failing at the moment it asks.
+        let writing = held.unchecked_transaction().unwrap();
+        held.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+
+        let handle = std::thread::spawn(move || {
+            other.execute(
+                "INSERT INTO roots(id, kind, label) VALUES (2, 'local', 'two')",
+                [],
+            )
+        });
+        std::thread::sleep(std::time::Duration::from_millis(150));
+        writing.commit().unwrap();
+
+        assert!(
+            handle.join().unwrap().is_ok(),
+            "the second writer waited and then wrote, rather than erroring"
+        );
+        let _ = std::fs::remove_dir_all(&dir);
+    }
    use super::*;

    fn mem() -> Connection {
@@ -1131,6 +1621,36 @@ mod tests {
        assert_eq!(backfilled(&c, "shadowed_by"), 0);
    }

+    #[test]
+    fn a_pair_is_found_among_other_folders_and_unfiled_images() {
+        // The RAWs are read only from the folders an unpaired JPEG is in,
+        // plus the unfiled ones when an unfiled JPEG is waiting: each JPEG
+        // must still find its own sibling, and only its own.
+        let c = with_root();
+        let raw_a = image(&c, Some(1), "a/IMG_7.CR2", "cr2");
+        image(&c, Some(2), "b/IMG_7.CR2", "cr2");
+        image(&c, Some(2), "b/IMG_8.CR2", "cr2");
+        let raw_unfiled = image(&c, None, "IMG_9.DNG", "dng");
+        let jpeg_a = image(&c, Some(1), "a/IMG_7.JPG", "jpg");
+        let jpeg_unfiled = image(&c, None, "IMG_9.jpg", "jpg");
+        image(&c, Some(1), "a/IMG_9.jpg", "jpg");
+
+        assert_eq!(backfilled(&c, "shadowed_by"), 2);
+        let of = |id: i64| -> Option<i64> {
+            c.query_row("SELECT shadowed_by FROM images WHERE id = ?1", [id], |r| {
+                r.get(0)
+            })
+            .unwrap()
+        };
+        assert_eq!(of(jpeg_a), Some(raw_a));
+        assert_eq!(of(jpeg_unfiled), Some(raw_unfiled));
+        assert_eq!(
+            backfilled(&c, "shadowed_by"),
+            0,
+            "settled on the second pass"
+        );
+    }
+
    #[test]
    fn a_raw_is_never_shadowed_by_a_jpeg() {
        // The relationship is one-way: the RAW is the photograph.
@@ -1325,6 +1845,35 @@ mod tests {
        assert_eq!(migrate(&c).unwrap(), SCHEMA_VERSION);
    }

+    /// V16 adds its columns guarded, so a catalog whose version was rewound
+    /// after the columns landed — the rollback NFR-R5 contemplates — migrates
+    /// again rather than failing on "duplicate column".
+    #[test]
+    fn the_eye_columns_survive_a_rewound_version() {
+        let c = mem();
+        migrate(&c).unwrap();
+        for column in EYE_COLUMNS {
+            let present: bool = c
+                .prepare("SELECT 1 FROM pragma_table_info('faces') WHERE name = ?1")
+                .unwrap()
+                .exists([column])
+                .unwrap();
+            assert!(present, "{column} missing after migration");
+        }
+        c.pragma_update(None, "user_version", 15).unwrap();
+        assert_eq!(migrate(&c).unwrap(), 15);
+        let indexed: bool = c
+            .prepare("SELECT 1 FROM sqlite_master WHERE type = 'index' AND name = 'faces_eyes'")
+            .unwrap()
+            .exists([])
+            .unwrap();
+        assert!(indexed, "V17's covering index is there");
+        let v: i64 = c
+            .query_row("PRAGMA user_version", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(v, SCHEMA_VERSION);
+    }
+
    #[test]
    fn refuses_a_catalog_from_a_newer_build() {
        let c = mem();
@@ -1405,6 +1954,148 @@ mod tests {
        assert_eq!(kept, vec![3, 4]);
    }

+    #[test]
+    fn v14_forgets_runs_that_found_faces_but_never_measured_them() {
+        let c = mem();
+        c.pragma_update(None, "user_version", 0).unwrap();
+        migrate(&c).unwrap();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'test')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at)
+             VALUES (1,1,'a',0),(2,1,'b',0),(3,1,'c',0)",
+            [],
+        )
+        .unwrap();
+        // Image 1 was examined and holds a face; 2 was examined and found
+        // empty; 3 holds a face found by a different model.
+        for (image, model) in [(1, "m"), (2, "m"), (3, "m")] {
+            c.execute(
+                "INSERT INTO face_index(image_id, model_id, indexed_at, faces_found, source_edge)
+                 VALUES (?1, ?2, 0, 0, 2560)",
+                rusqlite::params![image, model],
+            )
+            .unwrap();
+        }
+        for (image, model) in [(1, "m"), (3, "other")] {
+            c.execute(
+                "INSERT INTO faces
+                     (image_id, x, y, w, h, landmarks, detector_confidence, embedding,
+                      crop_px, model_id, detected_at)
+                 VALUES (?1, 0.1, 0.1, 0.2, 0.2, X'00', 0.9, X'00', 180.0, ?2, 0)",
+                rusqlite::params![image, model],
+            )
+            .unwrap();
+        }
+        c.pragma_update(None, "user_version", 13).unwrap();
+
+        migrate(&c).unwrap();
+
+        let kept: Vec<i64> = c
+            .prepare("SELECT image_id FROM face_index ORDER BY image_id")
+            .unwrap()
+            .query_map([], |r| r.get(0))
+            .unwrap()
+            .map(Result::unwrap)
+            .collect();
+        // 1 goes: it has a face with no quality. 2 stays: nothing on it to
+        // measure. 3 stays: its face belongs to a run this marker does not
+        // describe.
+        assert_eq!(kept, vec![2, 3]);
+        // And the faces themselves are untouched.
+        let faces: i64 = c
+            .query_row("SELECT count(*) FROM faces", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(faces, 2);
+    }
+
+    #[test]
+    fn v20_renames_markers_to_the_detector_that_found_the_faces() {
+        let c = mem();
+        c.pragma_update(None, "user_version", 0).unwrap();
+        migrate(&c).unwrap();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'test')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at)
+             VALUES (1,1,'a',0),(2,1,'b',0),(3,1,'c',0),(4,1,'d',0),(5,1,'e',0)",
+            [],
+        )
+        .unwrap();
+        // 1: the desktop's case -- old faces, re-marked as thorough.
+        // 2: the tablet's case -- adopted thorough faces, re-marked int8,
+        //    and the right marker still beside it (refreshed, so it is
+        //    exported again over the empty entry).
+        // 3: right already.  4: examined and empty.  5: V14's state, faces
+        //    and no marker.
+        for (image, model) in [
+            (1, "scrfd_10g+w600k_mbf"),
+            (2, "scrfd_10g_i8+w600k_mbf"),
+            (2, "scrfd_10g+w600k_mbf"),
+            (3, "scrfd_10g+w600k_mbf"),
+            (4, "scrfd_10g+w600k_mbf"),
+        ] {
+            c.execute(
+                "INSERT INTO face_index(image_id, model_id, indexed_at, faces_found, source_edge)
+                 VALUES (?1, ?2, 100, 0, 6000)",
+                rusqlite::params![image, model],
+            )
+            .unwrap();
+        }
+        for (image, model) in [
+            (1, "w600k_mbf"),
+            (1, "w600k_mbf"),
+            (2, "scrfd_10g+w600k_mbf"),
+            (3, "scrfd_10g+w600k_mbf"),
+            (5, "w600k_mbf"),
+        ] {
+            c.execute(
+                "INSERT INTO faces
+                     (image_id, x, y, w, h, landmarks, detector_confidence, embedding,
+                      crop_px, model_id, detected_at)
+                 VALUES (?1, 0.1, 0.1, 0.2, 0.2, X'00', 0.9, X'00', 180.0, ?2, 0)",
+                rusqlite::params![image, model],
+            )
+            .unwrap();
+        }
+        c.pragma_update(None, "user_version", 19).unwrap();
+
+        migrate(&c).unwrap();
+
+        let markers: Vec<(i64, String, i64, bool)> = c
+            .prepare(
+                "SELECT image_id, model_id, faces_found, indexed_at > 100
+                   FROM face_index ORDER BY image_id, model_id",
+            )
+            .unwrap()
+            .query_map([], |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?, r.get(3)?)))
+            .unwrap()
+            .map(Result::unwrap)
+            .collect();
+        assert_eq!(
+            markers,
+            vec![
+                (1, "w600k_mbf".to_string(), 2, true),
+                (2, "scrfd_10g+w600k_mbf".to_string(), 0, true),
+                (3, "scrfd_10g+w600k_mbf".to_string(), 0, false),
+                (4, "scrfd_10g+w600k_mbf".to_string(), 0, false),
+            ]
+        );
+        // Re-enterable: nothing left to rename.
+        c.pragma_update(None, "user_version", 19).unwrap();
+        migrate(&c).unwrap();
+        let n: i64 = c
+            .query_row("SELECT count(*) FROM face_index", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(n, 4);
+    }
+
    #[test]
    fn job_uniqueness_coalesces_rather_than_duplicating() {
        let c = mem();
@@ -46,26 +46,240 @@ pub fn checkpoint(conn: &Connection) -> Result<(), CatalogError> {
    Ok(())
 }

-/// Write a consistent snapshot of the catalog to `dest`, ready to upload.
+/// Write a consistent snapshot of the catalog to `dest`, ready to upload,
+/// without the face crops.
 ///
-/// Uses the backup API rather than a filesystem copy so the snapshot is
-/// coherent even with writers active. Callers should still prefer a quiet
-/// moment — this competes with background jobs for the write lock.
+/// Built rather than copied. The snapshot is the *whole catalog* bar the
+/// crops, uploaded on every sync and downloaded by every device. The crops are
+/// most of the file (96 MB of a 158 MB reference catalog), and copying them in
+/// only to delete them was most of the cost. A backup-API copy followed by
+/// `UPDATE faces SET crop = NULL` and `VACUUM` wrote the file roughly three
+/// times over to produce 50 MB (#71). So this creates the schema in an empty
+/// file and copies every table into it with `crop` left NULL. That is one
+/// pass, with nothing written that is not uploaded.
+///
+/// Consistency comes from doing the whole copy inside one transaction on the
+/// snapshot's connection, which holds a single read snapshot of the source for
+/// its duration. A writer committing meanwhile lands in the source's WAL and is
+/// simply not seen, the same serialisation the backup API gave.
+///
+/// Crops are not lost by this: they travel in the face shards
+/// ([`crate::face_shard::export_to_shards`]), which are written once and
+/// downloaded once. Nothing reads a crop out of a merged remote catalog. The
+/// merge reads a remote face's box and model to match it to a local one, and
+/// no more. So leaving them out costs a receiving device nothing it would
+/// otherwise have had. A device never adopts a downloaded catalog as its own,
+/// so a fresh one gets its crops from the shards too.
+///
+/// The result must stay what every earlier build already merges: same schema,
+/// same `user_version`, same page size and the same WAL flag in the header.
+/// The `the_snapshot_*` tests pin those.
 pub fn snapshot_for_upload(conn: &Connection, dest: &Path) -> Result<(), CatalogError> {
-    let out = copy_to(conn, dest)?;
-    strip_face_crops(&out)?;
+    // The source is read through a second connection, attached to the
+    // snapshot's, so it needs to be a file. Every catalog is one.
+    let source = conn
+        .path()
+        .filter(|p| !p.is_empty())
+        .map(PathBuf::from)
+        .ok_or_else(|| CatalogError::Io("the catalog to snapshot has no file".into()))?;
+
+    // Not needed for consistency, since the read transaction below sees the
+    // WAL, but it keeps the live WAL from growing across syncs, as before.
+    checkpoint(conn)?;
+
+    // A leftover from a pass that died mid-build would otherwise be built on.
+    for stale in [
+        dest.to_path_buf(),
+        sidecar_of(dest, "-wal"),
+        sidecar_of(dest, "-journal"),
+        sidecar_of(dest, "-shm"),
+    ] {
+        match std::fs::remove_file(&stale) {
+            Ok(()) => {}
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+            Err(e) => return Err(CatalogError::Io(format!("{}: {e}", stale.display()))),
+        }
+    }
+
+    let out = Connection::open(dest)?;
+    build_snapshot(conn, &source, &out)?;
+    // This device's local album folders are paths and SAF grants nobody
+    // else can use; the merge never reads them, and the snapshot is what
+    // a fresh device would otherwise adopt whole.
+    out.execute_batch("DROP TABLE IF EXISTS album_folders")?;
+    verify_snapshot(&out)?;
    Ok(())
 }

+/// `catalog.sqlite` + `-wal` → `catalog.sqlite-wal`.
+fn sidecar_of(path: &Path, suffix: &str) -> PathBuf {
+    let mut s = path.as_os_str().to_owned();
+    s.push(suffix);
+    PathBuf::from(s)
+}
+
+/// Schema name the source catalog is attached under while a snapshot is built.
+const SOURCE_SCHEMA: &str = "snap_src";
+
+/// The body of [`snapshot_for_upload`]: fill the empty database `out` from
+/// the catalog at `source`.
+fn build_snapshot(conn: &Connection, source: &Path, out: &Connection) -> Result<(), CatalogError> {
+    // Settings that only take on an empty file, copied from the source so the
+    // result is the file a backup would have been.
+    let page_size: i64 = conn.query_row("PRAGMA main.page_size", [], |r| r.get(0))?;
+    let auto_vacuum: i64 = conn.query_row("PRAGMA main.auto_vacuum", [], |r| r.get(0))?;
+    out.pragma_update(None, "page_size", page_size)?;
+    out.pragma_update(None, "auto_vacuum", auto_vacuum)?;
+    // A scratch file, rebuilt whole on every pass and checked before upload:
+    // durability during the build buys nothing. MEMORY rather than OFF keeps
+    // ROLLBACK defined on the failure path.
+    out.pragma_update(None, "journal_mode", "MEMORY")?;
+    out.pragma_update(None, "synchronous", "OFF")?;
+    // The rows were checked when they were written, and the copy has them
+    // all by the end. The bundled SQLite turns foreign keys on by default,
+    // and with them a multi-row INSERT into `images` scans `images` for
+    // children of every row it adds (`shadowed_by` refers to the same table
+    // and has no index): 1.2 s of a 1.7 s snapshot on 24k images.
+    out.pragma_update(None, "foreign_keys", false)?;
+
+    // Bound as a parameter, so a path containing a quote cannot break out.
+    out.execute(
+        &format!("ATTACH DATABASE ?1 AS {SOURCE_SCHEMA}"),
+        [source.to_string_lossy().as_ref()],
+    )?;
+    let result = copy_schema_and_rows(out);
+    if let Err(e) = out.execute(&format!("DETACH DATABASE {SOURCE_SCHEMA}"), []) {
+        log::warn!("failed to detach the catalog from its snapshot: {e}");
+    }
+    result?;
+
+    // Last, and outside any transaction, which is the only place it can be
+    // set: the header says WAL, as every snapshot uploaded so far has.
+    out.pragma_update(None, "journal_mode", "WAL")?;
+    Ok(())
+}
+
+fn copy_schema_and_rows(out: &Connection) -> Result<(), CatalogError> {
+    let tx = out.unchecked_transaction()?;
+
+    // The first read of the source opens its read snapshot. Everything from
+    // here, schema included, is as of that one moment.
+    let objects: Vec<(String, String, String)> = {
+        let mut stmt = tx.prepare(&format!(
+            "SELECT type, name, sql FROM {SOURCE_SCHEMA}.sqlite_master
+              WHERE sql IS NOT NULL AND name NOT LIKE 'sqlite\\_%' ESCAPE '\\'
+              ORDER BY rowid"
+        ))?;
+        let rows = stmt.query_map([], |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?)))?;
+        rows.collect::<Result<_, _>>()?
+    };
+    let user_version: i64 =
+        tx.query_row(&format!("PRAGMA {SOURCE_SCHEMA}.user_version"), [], |r| {
+            r.get(0)
+        })?;
+    let application_id: i64 =
+        tx.query_row(&format!("PRAGMA {SOURCE_SCHEMA}.application_id"), [], |r| {
+            r.get(0)
+        })?;
+
+    // Tables and their rows first, then indexes, triggers and views, so that
+    // an index is built once over the data rather than maintained per row,
+    // and no trigger fires on the copy. Foreign keys are off on this
+    // connection, so the order tables are filled in does not matter.
+    for (_, name, sql) in objects.iter().filter(|(k, _, _)| k == "table") {
+        // Verbatim: an unqualified CREATE lands in `main`, the snapshot.
+        tx.execute_batch(sql)?;
+        let columns: Vec<String> = {
+            let mut stmt = tx.prepare("SELECT name FROM pragma_table_info(?1, 'main')")?;
+            let rows = stmt.query_map([name], |r| r.get::<_, String>(0))?;
+            rows.collect::<Result<_, _>>()?
+        };
+        let select = columns
+            .iter()
+            .map(|c| {
+                if name == "faces" && c == "crop" {
+                    "NULL".to_string()
+                } else {
+                    quote_ident(c)
+                }
+            })
+            .collect::<Vec<_>>()
+            .join(", ");
+        let insert = columns
+            .iter()
+            .map(|c| quote_ident(c))
+            .collect::<Vec<_>>()
+            .join(", ");
+        let table = quote_ident(name);
+        tx.execute(
+            &format!(
+                "INSERT INTO main.{table} ({insert})
+                 SELECT {select} FROM {SOURCE_SCHEMA}.{table}"
+            ),
+            [],
+        )?;
+    }
+    // AUTOINCREMENT's counters live in a table the filter above skips; the
+    // CREATE of such a table makes an empty one here.
+    let has_sequence: bool = tx.query_row(
+        &format!(
+            "SELECT EXISTS(SELECT 1 FROM {SOURCE_SCHEMA}.sqlite_master
+                            WHERE name = 'sqlite_sequence')"
+        ),
+        [],
+        |r| r.get(0),
+    )?;
+    if has_sequence {
+        tx.execute_batch(&format!(
+            "DELETE FROM main.sqlite_sequence;
+             INSERT INTO main.sqlite_sequence SELECT * FROM {SOURCE_SCHEMA}.sqlite_sequence;"
+        ))?;
+    }
+    for (_, _, sql) in objects.iter().filter(|(k, _, _)| k != "table") {
+        tx.execute_batch(sql)?;
+    }
+
+    tx.pragma_update(None, "user_version", user_version)?;
+    tx.pragma_update(None, "application_id", application_id)?;
+    tx.commit()?;
+    Ok(())
+}
+
+/// `name` as an SQL identifier, whatever it contains.
+fn quote_ident(name: &str) -> String {
+    format!("\"{}\"", name.replace('"', "\"\""))
+}
+
+/// TRACES: NFR-R2
+/// Refuse to hand over a snapshot that will not pass `quick_check`.
+///
+/// The upload is the copy every other device merges from, and a damaged one
+/// costs far more than the check: each device downloads it, fails, and — for
+/// a week, once — declines to push over it. `quick_check` reads every page
+/// but skips index verification, which is the affordable version of "is this
+/// a database" on a 40 MB file that has just been written and is still in the
+/// page cache. A failure here is [`CatalogError::Corrupt`], the same thing a
+/// receiving device would have said, so the sync reports it the same way.
+fn verify_snapshot(snapshot: &Connection) -> Result<(), CatalogError> {
+    let verdict: String = snapshot.query_row("PRAGMA quick_check", [], |r| r.get(0))?;
+    if verdict == "ok" {
+        Ok(())
+    } else {
+        Err(CatalogError::Corrupt {
+            detail: format!("the snapshot for upload failed quick_check: {verdict}"),
+        })
+    }
+}
+
 /// Checkpoint, then copy the whole database to `dest`, and hand back the
 /// connection to the copy.
 ///
-/// Split out from [`snapshot_for_upload`] because [`crate::recovery`] wants
-/// exactly this and none of what follows it there: an NFR-R2 backup is the
-/// file the user may have to *live on*, so it keeps the face crops that an
-/// upload strips. Sharing the copy rather than reimplementing it is what keeps
-/// the WAL discipline in one place — a backup taken with `fs::copy` would be
-/// the torn snapshot this module's header exists to warn about.
+/// What [`crate::recovery`] takes its NFR-R2 backups with. A backup is the
+/// file the user may have to *live on*, so it keeps the face crops that
+/// [`snapshot_for_upload`] leaves out, and a byte-for-byte page copy is the
+/// right tool. Keeping it here beside the upload keeps the WAL discipline in
+/// one place: a backup taken with `fs::copy` would be the torn snapshot this
+/// module's header exists to warn about.
 pub(crate) fn copy_to(conn: &Connection, dest: &Path) -> Result<Connection, CatalogError> {
    checkpoint(conn)?;

@@ -81,39 +295,6 @@ pub(crate) fn copy_to(conn: &Connection, dest: &Path) -> Result<Connection, Cata
    Ok(out)
 }

-/// Drop the stored face crops from a snapshot before it is uploaded.
-///
-/// The snapshot is the *whole catalog*, uploaded on every sync and downloaded
-/// by every device. Face crops are a few KB each and a fully indexed library
-/// holds tens of thousands of them, so leaving them in would put tens of MB on
-/// every round trip — the exact cost `face_shard`'s 25 MB cap exists to bound,
-/// and the reason the bulk per-face data lives in shards in the first place.
-///
-/// Crops are not lost by this: they travel in the face shards
-/// ([`crate::face_shard::export_to_shards`]), which are written once and
-/// downloaded once. Nothing reads a crop out of a merged remote catalog —
-/// [`merge_all`] touches collections and keywords only — so removing them here
-/// costs a receiving device nothing it would otherwise have had.
-///
-/// `VACUUM` afterwards because SQLite does not return freed pages to the file
-/// on its own, and an upload sized by the file rather than by its contents
-/// would keep paying for bytes that are no longer there.
-fn strip_face_crops(snapshot: &Connection) -> Result<(), CatalogError> {
-    // A catalog older than the crop column is a legitimate input here — a
-    // snapshot taken mid-migration, or a test fixture built from an earlier
-    // schema — so an absent column is nothing to fail over.
-    let has_crop = snapshot
-        .prepare("SELECT crop FROM faces LIMIT 1")
-        .map(|_| true)
-        .unwrap_or(false);
-    if !has_crop {
-        return Ok(());
-    }
-    snapshot.execute("UPDATE faces SET crop = NULL WHERE crop IS NOT NULL", [])?;
-    snapshot.execute_batch("VACUUM")?;
-    Ok(())
-}
-
 /// Whether a downloaded remote catalog is worth merging.
 ///
 /// Cheap guard before attaching: a remote written by a newer build may contain
@@ -149,6 +330,13 @@ pub fn merge_remote(conn: &Connection, remote: &Path) -> Result<MergeReport, Cat

    let result = merge::merge_all(conn);

+    // The merge brings in rows the backfill exists for — assignments whose
+    // word this device has no term for, from a remote older than v6 — so the
+    // next open must run it, whether or not the stamp happened to move.
+    if let Some(path) = conn.path().filter(|p| !p.is_empty()) {
+        crate::backfilled::forget(Path::new(path));
+    }
+
    // Detach even if the merge failed, or the next attempt errors with
    // "database remote_cat is already in use".
    let detach = conn.execute(&format!("DETACH DATABASE {REMOTE_SCHEMA}"), []);
@@ -156,6 +344,18 @@ pub fn merge_remote(conn: &Connection, remote: &Path) -> Result<MergeReport, Cat
        log::warn!("failed to detach remote catalog: {e}");
    }

+    // After every merge, because a merge is where two devices' people meet:
+    // the same name typed on each, or a redirect one of them made. Its own
+    // transaction, and a failure is logged rather than returned -- what the
+    // merge took is committed and valid whether or not the duplicates were
+    // folded, and the next pass tries again. Runs on the sync worker, never
+    // the UI thread, and costs ~10 ms when there is nothing to do.
+    if result.is_ok() {
+        if let Err(e) = crate::dedup_people::run(conn) {
+            log::warn!("dedup after the catalog merge: {e}");
+        }
+    }
+
    result
 }

@@ -266,6 +466,92 @@ mod tests {
        assert_eq!(n, 2);
    }

+    /// One image, known to the server by `file_id`, in a catalog.
+    fn with_image(c: &Connection, file_id: i64) -> dr_types::ImageId {
+        c.execute(
+            "INSERT OR IGNORE INTO roots(id, kind, label) VALUES (1, 'remote', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(root_id, source_ref, added_at) VALUES (1, ?1, 0)",
+            [format!("IMG_{file_id}.CR3")],
+        )
+        .unwrap();
+        let id = c.last_insert_rowid();
+        c.execute(
+            "INSERT INTO remote(image_id, file_id) VALUES (?1, ?2)",
+            [id, file_id],
+        )
+        .unwrap();
+        dr_types::ImageId(id as u64)
+    }
+
+    #[test]
+    fn an_album_and_its_exports_reach_another_device_but_its_folder_does_not() {
+        use crate::albums::{self, Place};
+        let dir = tempdir();
+        let remote_path = dir.join("remote.sqlite");
+        let snap = dir.join("snap.sqlite");
+        {
+            // The desktop: two albums, one on the server and one on its own
+            // disk, each with an export of the same photograph.
+            let r = seeded(&dir.join("desktop.sqlite"));
+            let img = with_image(&r, 4242);
+            let web = albums::create(&r, "Web", &Place::Server("Shared/Web".into())).unwrap();
+            let print = albums::create(&r, "Print", &Place::Local("/mnt/print".into())).unwrap();
+            albums::record_exports(&r, web, &[(img, "IMG_4242.jpg".into())]).unwrap();
+            albums::record_exports(&r, print, &[(img, "IMG_4242.tif".into())]).unwrap();
+            snapshot_for_upload(&r, &snap).unwrap();
+            std::fs::rename(&snap, &remote_path).unwrap();
+        }
+
+        // The tablet knows the same file under its own image id.
+        let local = seeded(&dir.join("tablet.sqlite"));
+        with_image(&local, 1);
+        let img = with_image(&local, 4242);
+
+        let report = merge_remote(&local, &remote_path).unwrap();
+        assert_eq!(report.albums_taken, 2);
+        assert_eq!(report.album_exports_added, 2);
+        assert!(report.local_changed());
+
+        let all = albums::list(&local).unwrap();
+        let print = all.iter().find(|a| a.name == "Print").unwrap();
+        let web = all.iter().find(|a| a.name == "Web").unwrap();
+        assert_eq!(print.place, None, "the desktop's disk is not the tablet's");
+        assert_eq!(web.place, Some(Place::Server("Shared/Web".into())));
+        assert_eq!(albums::sources(&local, web.id).unwrap(), vec![img]);
+
+        // Nothing changed on either side, so a second pass takes nothing.
+        let again = merge_remote(&local, &remote_path).unwrap();
+        assert_eq!(again.albums_taken, 0);
+        assert_eq!(again.album_exports_added, 0);
+    }
+
+    #[test]
+    fn a_device_that_never_made_an_album_still_uploads_this_ones() {
+        use crate::albums::{self, Place};
+        let dir = tempdir();
+        let remote_path = dir.join("remote.sqlite");
+        {
+            // A snapshot from a build that predates albums altogether.
+            let r = seeded(&remote_path);
+            checkpoint(&r).unwrap();
+        }
+        let local = seeded(&dir.join("local.sqlite"));
+        albums::create(&local, "Web", &Place::Server("Web".into())).unwrap();
+
+        let report = merge_remote(&local, &remote_path).unwrap();
+        assert_eq!(report.albums_taken, 0);
+        // Its albums table is absent, so nothing was compared — and the local
+        // album has still to reach the server.
+        assert!(
+            albums::list(&local).unwrap().len() == 1,
+            "the local album survives a merge with a catalog that has none"
+        );
+    }
+
    #[test]
    fn the_remote_can_be_merged_twice_without_attach_conflict() {
        // Detach must happen even on the failure path, or the second attempt
@@ -358,4 +644,188 @@ mod tests {
            .unwrap();
        assert_eq!(kept, 1, "stripping the snapshot damaged the live catalog");
    }
+    /// Device-side setup for the snapshot tests: an image both devices know by
+    /// its cross-device file id, and one face on it carrying `crop`.
+    fn with_a_face(c: &Connection, face_id: i64, x: f64, crop: &[u8]) {
+        c.execute(
+            "INSERT OR IGNORE INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at) VALUES (1, 1, 'a.CR3', 0)",
+            [],
+        )
+        .unwrap();
+        c.execute("INSERT INTO remote(image_id, file_id) VALUES (1, 5000)", [])
+            .unwrap();
+        c.execute(
+            "INSERT INTO faces
+                 (id, image_id, x, y, w, h, landmarks, detector_confidence, embedding,
+                  crop_px, model_id, detected_at, crop)
+             VALUES (?1, 1, ?2, 0.2, 0.2, 0.2, X'00', 0.9, X'00', 150.0, 'w600k_mbf', 0, ?3)",
+            rusqlite::params![face_id, x, crop],
+        )
+        .unwrap();
+    }
+
+    fn crop_of(c: &Connection, face_id: i64) -> Option<Vec<u8>> {
+        c.query_row("SELECT crop FROM faces WHERE id = ?1", [face_id], |r| {
+            r.get(0)
+        })
+        .unwrap()
+    }
+
+    /// The snapshot is built table by table rather than copied, so what has to
+    /// hold is that it is still the same database bar the crops: every table,
+    /// index and row, and the header fields an older build checks before it
+    /// will merge (`user_version`) or open it the way it always has (the WAL
+    /// flag and page size a backup-API copy carried).
+    #[test]
+    fn the_snapshot_is_the_catalog_bar_the_crops() {
+        let dir = tempdir();
+        let live = dir.join("catalog.sqlite");
+        let snap = dir.join("snap.sqlite");
+        let c = seeded(&live);
+        with_a_face(&c, 7, 0.3, &[7u8; 4096]);
+        c.execute(
+            "INSERT INTO collections(uuid, name, kind, created, revision, modified)
+             VALUES ('u1', 'Iceland', 0, 0, 1, 1)",
+            [],
+        )
+        .unwrap();
+        // Created on first use rather than by a migration: the copy must not
+        // depend on the migrations knowing every table.
+        crate::duplicates::ensure_probe_table(&c).unwrap();
+
+        snapshot_for_upload(&c, &snap).unwrap();
+        let out = Connection::open(&snap).unwrap();
+
+        let objects = |conn: &Connection| -> Vec<(String, String)> {
+            let mut stmt = conn
+                .prepare("SELECT type, name FROM sqlite_master ORDER BY type, name")
+                .unwrap();
+            let rows = stmt
+                .query_map([], |r| Ok((r.get(0).unwrap(), r.get(1).unwrap())))
+                .unwrap();
+            rows.map(Result::unwrap).collect()
+        };
+        assert_eq!(objects(&out), objects(&c), "the snapshot's schema differs");
+
+        for (kind, table) in objects(&c) {
+            if kind != "table" {
+                continue;
+            }
+            let count = |conn: &Connection| -> i64 {
+                conn.query_row(&format!("SELECT COUNT(*) FROM \"{table}\""), [], |r| {
+                    r.get(0)
+                })
+                .unwrap()
+            };
+            assert_eq!(count(&out), count(&c), "rows differ in {table}");
+        }
+
+        for pragma in [
+            "user_version",
+            "application_id",
+            "page_size",
+            "journal_mode",
+        ] {
+            let read = |conn: &Connection| -> String {
+                conn.query_row(&format!("PRAGMA {pragma}"), [], |r| {
+                    r.get::<_, rusqlite::types::Value>(0)
+                })
+                .map(|v| format!("{v:?}"))
+                .unwrap()
+            };
+            assert_eq!(read(&out), read(&c), "{pragma} differs");
+        }
+        drop(out);
+        // Bytes 18 and 19 of the header are 2 for a WAL database, which is
+        // what every snapshot uploaded before this one said.
+        let header = std::fs::read(&snap).unwrap();
+        assert_eq!(&header[18..20], &[2, 2], "the snapshot is not WAL-flagged");
+
+        // The face is there; its pixels are not.
+        let out = Connection::open(&snap).unwrap();
+        assert_eq!(crop_of(&out, 7), None);
+    }
+
+    /// A pass that died mid-build leaves a file behind; the next one must
+    /// build afresh rather than on top of it.
+    #[test]
+    fn a_leftover_snapshot_is_replaced_not_built_on() {
+        let dir = tempdir();
+        let live = dir.join("catalog.sqlite");
+        let snap = dir.join("snap.sqlite");
+        let c = seeded(&live);
+
+        std::fs::write(&snap, b"not a database").unwrap();
+        snapshot_for_upload(&c, &snap).unwrap();
+        // And twice over a good one, which is the steady state.
+        snapshot_for_upload(&c, &snap).unwrap();
+
+        let out = Connection::open(&snap).unwrap();
+        let v: i64 = out
+            .query_row("PRAGMA user_version", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(v, schema::SCHEMA_VERSION);
+    }
+
+    /// The merge side of a crop-less snapshot: the other device's names still
+    /// cross over — the match is by box, not by pixels — and this device's
+    /// own crop is left exactly as it was, never replaced by the snapshot's
+    /// NULL.
+    #[test]
+    fn merging_a_crop_less_snapshot_keeps_local_crops_and_takes_the_names() {
+        let dir = tempdir();
+        let snap = dir.join("snap.sqlite");
+
+        let desktop = seeded(&dir.join("desktop.sqlite"));
+        with_a_face(&desktop, 42, 0.31, &[1u8; 3000]);
+        desktop
+            .execute(
+                "INSERT INTO people(id, uuid, name, ignored, created, revision, modified)
+                 VALUES (3, 'u-anna', 'Anna', 0, 0, 1, 1)",
+                [],
+            )
+            .unwrap();
+        desktop
+            .execute(
+                "INSERT INTO face_person(face_id, person_id, probability, confirmed)
+                 VALUES (42, 3, 0.9, 1)",
+                [],
+            )
+            .unwrap();
+        snapshot_for_upload(&desktop, &snap).unwrap();
+
+        // The tablet found the same face itself, under its own row id, and has
+        // its own crop of it — from its own detection or from the shards.
+        let tablet = seeded(&dir.join("tablet.sqlite"));
+        let mine = vec![9u8; 2500];
+        with_a_face(&tablet, 7, 0.30, &mine);
+
+        let report = merge_remote(&tablet, &snap).unwrap();
+        assert_eq!(report.people_inserted, 1);
+        assert_eq!(report.faces_assigned, 1);
+        let named: (String, bool) = tablet
+            .query_row(
+                "SELECT p.name, fp.confirmed
+                   FROM face_person fp JOIN people p ON p.id = fp.person_id
+                  WHERE fp.face_id = 7",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        assert_eq!(named, ("Anna".to_string(), true));
+        assert_eq!(
+            crop_of(&tablet, 7),
+            Some(mine),
+            "the merge touched a local crop"
+        );
+
+        // Idempotent over a crop-less remote too.
+        let again = merge_remote(&tablet, &snap).unwrap();
+        assert!(!again.local_changed());
+    }
 }
@@ -129,28 +129,40 @@ pub fn record_trashed(
        return Ok(0);
    }
    let tx = conn.unchecked_transaction()?;
-    let mut n = 0;
-
-    {
-        let mut stmt = tx.prepare(
-            "UPDATE images
-                SET trashed_from = CASE
-                        WHEN trashed_at IS NULL THEN source_ref
-                        ELSE trashed_from
-                    END,
-                    source_ref   = ?2,
-                    trashed_at   = coalesce(trashed_at, ?3)
-              WHERE id = ?1",
-        )?;
-        for (image, path) in moved {
-            n += stmt.execute(rusqlite::params![image.0 as i64, path, now])?;
-        }
-    }
-
+    let n = record_trashed_within(&tx, moved, now)?;
    tx.commit()?;
    Ok(n)
 }

+/// [`record_trashed`] inside a transaction the caller owns.
+///
+/// For a caller whose trash is one half of a larger write that must land
+/// whole or not at all — consolidating duplicates (`crate::duplicates`)
+/// merges a copy's judgements onto the survivor and trashes the copy in one
+/// commit. `unchecked_transaction` cannot nest, so this is offered here
+/// rather than wrapped from above.
+pub fn record_trashed_within(
+    tx: &Connection,
+    moved: &[(ImageId, String)],
+    now: i64,
+) -> Result<usize, CatalogError> {
+    let mut n = 0;
+    let mut stmt = tx.prepare(
+        "UPDATE images
+            SET trashed_from = CASE
+                    WHEN trashed_at IS NULL THEN source_ref
+                    ELSE trashed_from
+                END,
+                source_ref   = ?2,
+                trashed_at   = coalesce(trashed_at, ?3)
+          WHERE id = ?1",
+    )?;
+    for (image, path) in moved {
+        n += stmt.execute(rusqlite::params![image.0 as i64, path, now])?;
+    }
+    Ok(n)
+}
+
 /// Record that images have been moved back out of the trash.
 ///
 /// Call after the move succeeds, for the same reason as [`record_trashed`].
@@ -48,7 +48,6 @@ use dr_types::{Availability, FormatFilter, RootId, SourceRef};
 use rusqlite::{Connection, OptionalExtension};

 use crate::error::CatalogError;
-use crate::jobs::{self, JobKind, Priority};
 use crate::query::availability_code;
 use crate::scan::{
    classify_dir, classify_entry, DirAction, DirState, EntryAction, KnownFile, ScanOutcome,
@@ -336,7 +335,7 @@ pub fn scan_root(
                                    }
                                }
                                EntryAction::Insert => {
-                                    let id = insert_image(
+                                    insert_image(
                                        &tx,
                                        root,
                                        folder_id,
@@ -345,11 +344,10 @@ pub fn scan_root(
                                        entry.meta.mtime,
                                        now,
                                    )?;
-                                    queue_reading_it(&tx, id)?;
                                    report.inserted += 1;
                                }
                                EntryAction::Changed => {
-                                    let id = update_image(
+                                    update_image(
                                        &tx,
                                        root,
                                        folder_id,
@@ -357,7 +355,6 @@ pub fn scan_root(
                                        entry.meta.size,
                                        entry.meta.mtime,
                                    )?;
-                                    queue_reading_it(&tx, id)?;
                                    report.updated += 1;
                                }
                                EntryAction::Ignored => unreachable!("returned above"),
@@ -640,7 +637,7 @@ fn insert_image(
    size: u64,
    mtime: i64,
    now: i64,
-) -> Result<i64, CatalogError> {
+) -> Result<(), CatalogError> {
    // `metadata_state = 1`: the scan knows the name, the size and the mtime,
    // and has read no EXIF. Claiming otherwise would make a date filter
    // silently wrong on a freshly scanned library.
@@ -664,7 +661,7 @@ fn insert_image(
            now,
        ],
    )?;
-    image_id(conn, root, src)
+    Ok(())
 }

 fn update_image(
@@ -674,7 +671,7 @@ fn update_image(
    src: &SourceRef,
    size: u64,
    mtime: i64,
-) -> Result<i64, CatalogError> {
+) -> Result<(), CatalogError> {
    // The content hash is dropped, not recomputed: it described bytes that no
    // longer exist, and leaving it would let reconnect-by-hash match this image
    // to a file it is no longer a copy of. `metadata_state` goes back to 1 for
@@ -692,37 +689,7 @@ fn update_image(
            src.key(),
        ],
    )?;
-    image_id(conn, root, src)
-}
-
-fn image_id(conn: &Connection, root: RootId, src: &SourceRef) -> Result<i64, CatalogError> {
-    Ok(conn.query_row(
-        "SELECT id FROM images WHERE root_id = ?1 AND source_ref = ?2",
-        rusqlite::params![root.0 as i64, src.key()],
-        |r| r.get(0),
-    )?)
-}
-
-/// Queue the work that turns a stat-only row into a usable grid cell.
-///
-/// Enqueued inside the scan's transaction, so a folder's rows and the jobs that
-/// finish them land together — a crash between the two would otherwise leave
-/// images no worker was ever told about.
-fn queue_reading_it(conn: &Connection, image_id: i64) -> Result<(), CatalogError> {
-    jobs::enqueue(
-        conn,
-        JobKind::ExtractMetadata,
-        Some(image_id),
-        Priority::Background,
-        None,
-    )?;
-    jobs::enqueue(
-        conn,
-        JobKind::Thumbnail,
-        Some(image_id),
-        Priority::Background,
-        None,
-    )
+    Ok(())
 }

 /// TRACES: FR-CAT-9
@@ -831,6 +798,17 @@ mod tests {
            let tmp = target.with_extension("tmp");
            fs::write(&tmp, bytes).expect("write");
            fs::rename(&tmp, &target).expect("rename");
+            // A scan tells a changed file by its mtime, at whole-second
+            // resolution; a resave landing in the same second as the scan
+            // before it looks unchanged, and the test fails when the machine
+            // is fast enough. Two seconds ahead, on the file and its folder,
+            // is what a real resave some time later would look like.
+            let later = std::time::SystemTime::now() + std::time::Duration::from_secs(2);
+            for p in [target.as_path(), target.parent().expect("parent")] {
+                fs::File::open(p)
+                    .and_then(|f| f.set_modified(later))
+                    .expect("set mtime");
+            }
            self
        }

@@ -1096,7 +1074,7 @@ mod tests {
    }

    #[test]
-    fn a_resaved_file_is_queued_for_rereading_and_loses_its_stale_hash() {
+    fn a_resaved_file_owes_a_reread_and_loses_its_stale_hash() {
        let lib = Library::new("resaved");
        lib.file("IMG.CR3", b"raw");
        lib.scan();
@@ -1121,9 +1099,8 @@ mod tests {
            "a hash of bytes that no longer exist would match this image to the \
             wrong file on reconnect"
        );
-        assert_eq!(lib.count("SELECT metadata_state FROM images"), 1);
        assert_eq!(
-            lib.count("SELECT count(*) FROM jobs WHERE kind = 1"),
+            lib.count("SELECT metadata_state FROM images"),
            1,
            "EXIF must be re-read"
        );
@@ -1137,7 +1114,11 @@ mod tests {
        let lib = Library::new("no-requeue");
        lib.file("a.CR3", b"raw");
        lib.scan();
-        lib.conn().execute("DELETE FROM jobs", []).unwrap();
+        // As if the metadata sweep had read it: what is owed is recorded in
+        // `metadata_state`, and the thumbnail store answers for itself.
+        lib.conn()
+            .execute("UPDATE images SET metadata_state = 2", [])
+            .unwrap();

        lib.file("b.CR3", b"raw");
        let r = lib.scan();
@@ -1145,9 +1126,9 @@ mod tests {
        assert_eq!(r.inserted, 1);
        assert_eq!(r.unchanged, 1);
        assert_eq!(
-            lib.count("SELECT count(*) FROM jobs"),
-            2,
-            "EXIF and a thumbnail for the new image, and nothing for the old one"
+            lib.count("SELECT count(*) FROM images WHERE metadata_state < 2"),
+            1,
+            "EXIF owed for the new image, and nothing for the old one"
        );
    }

@@ -1171,17 +1152,15 @@ mod tests {
    }

    #[test]
-    fn a_new_image_is_queued_for_a_thumbnail_and_for_exif() {
+    fn a_new_image_owes_its_exif_and_queues_nothing() {
+        // The sweeps find their work from `metadata_state` and the thumbnail
+        // store. A queued job would be a second record of the same debt, and
+        // no handler claims one (#73).
        let lib = Library::new("queued");
        lib.file("IMG.CR3", b"raw");
        lib.scan();

-        assert_eq!(
-            lib.count("SELECT count(*) FROM jobs WHERE kind = 2"),
-            1,
-            "no thumbnail job means an empty grid cell forever"
-        );
-        assert_eq!(lib.count("SELECT count(*) FROM jobs WHERE kind = 1"), 1);
+        assert_eq!(lib.count("SELECT count(*) FROM jobs"), 0);
        assert_eq!(
            lib.count("SELECT metadata_state FROM images"),
            1,
@@ -0,0 +1,341 @@
+// TRACES: FR-PLAT-AND-3
+//! No job kind is enqueued without something that claims it.
+//!
+//! The queue coalesces, so a producer with no consumer does not fail — it
+//! just leaves a row per subject for ever. That is how the reference catalog
+//! came to hold 23,582 `Thumbnail` jobs, one per photograph, re-coalesced on
+//! every scan, with no handler for the kind anywhere in the tree (#73). Nothing
+//! at runtime notices: the rows are cheap one at a time and invisible in the
+//! interface. So the pairing is checked here, over the source, instead.
+//!
+//! ## What counts
+//!
+//! In shipping code under `core/`, `ui/`, `apps/` and `platform/` — every
+//! `src/` tree, with `#[cfg(test)]` items dropped:
+//!
+//! - **Enqueued**: the `JobKind::X` named in the arguments of a call to
+//!   `enqueue(`. An enqueue whose kind is not spelled there — passed in a
+//!   variable — is refused outright, because this scan could not say what it
+//!   queues.
+//! - **Claimed**: the `JobKind::X` in the body of a `fn kinds(` (what a
+//!   `JobHandler` declares, and all a `Runner` claims), or named in a call to
+//!   `claim_next_matching(`. A call to `claim_next(` claims every kind.
+//!   `JobKind::ALL` in either place means every kind.
+//!
+//! Tests and examples are left out on purpose: a unit test of the queue's
+//! mechanics enqueues and claims whatever it likes, and proves nothing about
+//! the app.
+
+use std::collections::BTreeSet;
+use std::fs;
+use std::path::{Path, PathBuf};
+
+/// Every `.rs` file under each `src/` of each crate in `group`.
+fn crate_sources(group: &Path, out: &mut Vec<PathBuf>) {
+    let Ok(crates) = fs::read_dir(group) else {
+        return;
+    };
+    for krate in crates {
+        let src = krate.expect("read dir entry").path().join("src");
+        if src.is_dir() {
+            rust_files(&src, out);
+        }
+    }
+}
+
+fn rust_files(dir: &Path, out: &mut Vec<PathBuf>) {
+    for entry in fs::read_dir(dir).unwrap_or_else(|e| panic!("cannot read {}: {e}", dir.display()))
+    {
+        let path = entry.expect("read dir entry").path();
+        if path.is_dir() {
+            rust_files(&path, out);
+        } else if path.extension().and_then(|e| e.to_str()) == Some("rs") {
+            out.push(path);
+        }
+    }
+}
+
+/// Blank out string literals and line comments, so neither a brace nor a
+/// `JobKind::` inside prose is read as code.
+fn strip_literals_and_comments(line: &str) -> String {
+    let mut out = String::with_capacity(line.len());
+    let mut chars = line.chars().peekable();
+    let mut in_string = false;
+    while let Some(c) = chars.next() {
+        if in_string {
+            match c {
+                '\\' => {
+                    chars.next();
+                }
+                '"' => in_string = false,
+                _ => {}
+            }
+            continue;
+        }
+        match c {
+            '"' => in_string = true,
+            '/' if chars.peek() == Some(&'/') => break,
+            _ => out.push(c),
+        }
+    }
+    out
+}
+
+/// The shipping code of a file, comments and strings blanked, with every
+/// `#[cfg(test)]` item dropped. The attribute must be the whole line, so a
+/// doc comment mentioning it is not mistaken for one.
+fn shipping_code(text: &str) -> String {
+    let lines: Vec<String> = text.lines().map(strip_literals_and_comments).collect();
+    let mut out = String::new();
+    let mut i = 0;
+    while i < lines.len() {
+        if lines[i].trim() != "#[cfg(test)]" {
+            out.push_str(&lines[i]);
+            out.push('\n');
+            i += 1;
+            continue;
+        }
+        let (mut j, mut depth, mut opened) = (i + 1, 0i32, false);
+        while j < lines.len() {
+            depth += lines[j].matches('{').count() as i32;
+            depth -= lines[j].matches('}').count() as i32;
+            opened |= lines[j].contains('{');
+            if (opened && depth <= 0) || (!opened && lines[j].contains(';')) {
+                break;
+            }
+            j += 1;
+        }
+        i = j + 1;
+    }
+    out
+}
+
+/// The text from `start` (just past an opening delimiter) to its matching
+/// close.
+fn balanced(code: &str, start: usize, open: char, close: char) -> &str {
+    let mut depth = 1;
+    for (i, c) in code[start..].char_indices() {
+        if c == open {
+            depth += 1;
+        } else if c == close {
+            depth -= 1;
+            if depth == 0 {
+                return &code[start..start + i];
+            }
+        }
+    }
+    &code[start..]
+}
+
+/// Each call of `name(` in `code` that is a call rather than the function's
+/// own definition or a longer name ending in it, as its argument text.
+fn calls<'a>(code: &'a str, name: &str) -> Vec<&'a str> {
+    let needle = format!("{name}(");
+    let mut found = Vec::new();
+    for (at, _) in code.match_indices(&needle) {
+        let before = &code[..at];
+        let prev = before.chars().next_back();
+        if prev.is_some_and(|c| c.is_alphanumeric() || c == '_') {
+            continue;
+        }
+        if before.trim_end().ends_with("fn") {
+            continue;
+        }
+        found.push(balanced(code, at + needle.len(), '(', ')'));
+    }
+    found
+}
+
+/// Bodies of every `fn kinds(` that has one — a trait declaration ending in
+/// `;` has none.
+fn kinds_bodies(code: &str) -> Vec<&str> {
+    let mut found = Vec::new();
+    for (at, _) in code.match_indices("fn kinds(") {
+        let rest = &code[at..];
+        let (Some(brace), semi) = (rest.find('{'), rest.find(';')) else {
+            continue;
+        };
+        if semi.is_some_and(|s| s < brace) {
+            continue;
+        }
+        found.push(balanced(code, at + brace + 1, '{', '}'));
+    }
+    found
+}
+
+/// The `X` of each `JobKind::X` in `text`.
+fn kinds_named(text: &str) -> Vec<String> {
+    text.match_indices("JobKind::")
+        .map(|(at, m)| {
+            text[at + m.len()..]
+                .chars()
+                .take_while(|c| c.is_alphanumeric() || *c == '_')
+                .collect()
+        })
+        .collect()
+}
+
+#[derive(Default, Debug)]
+struct Ledger {
+    /// Kind → where it is enqueued.
+    enqueued: Vec<(String, String)>,
+    /// Enqueue calls whose kind could not be read.
+    unreadable: Vec<String>,
+    claimed: BTreeSet<String>,
+    claims_everything: bool,
+}
+
+fn read(files: &[(String, String)]) -> Ledger {
+    let mut ledger = Ledger::default();
+    for (name, text) in files {
+        let code = shipping_code(text);
+
+        for args in calls(&code, "enqueue") {
+            let kinds = kinds_named(args);
+            if kinds.is_empty() {
+                ledger
+                    .unreadable
+                    .push(format!("{name}: enqueue({})", args.trim()));
+            }
+            for k in kinds {
+                ledger.enqueued.push((k, name.clone()));
+            }
+        }
+
+        let claimed = kinds_bodies(&code)
+            .into_iter()
+            .chain(calls(&code, "claim_next_matching"));
+        for text in claimed {
+            for k in kinds_named(text) {
+                if k == "ALL" {
+                    ledger.claims_everything = true;
+                } else {
+                    ledger.claimed.insert(k);
+                }
+            }
+        }
+        if !calls(&code, "claim_next").is_empty() {
+            ledger.claims_everything = true;
+        }
+    }
+    ledger
+}
+
+#[test]
+fn every_kind_enqueued_is_claimed_by_something() {
+    let repo = Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(Path::parent)
+        .expect("core/dr-catalog has a grandparent");
+
+    let mut paths = Vec::new();
+    for group in ["core", "ui", "apps", "platform"] {
+        crate_sources(&repo.join(group), &mut paths);
+    }
+    let files: Vec<(String, String)> = paths
+        .iter()
+        .map(|p| {
+            let text = fs::read_to_string(p)
+                .unwrap_or_else(|e| panic!("cannot read {}: {e}", p.display()));
+            let name = p.strip_prefix(repo).unwrap_or(p).display().to_string();
+            (name, text)
+        })
+        .collect();
+
+    // A scan over nothing passes for the wrong reason. The queue's own file
+    // and the scan that used to feed it must both have been read, and the
+    // queue's definitions found in them.
+    for must in [
+        "core/dr-catalog/src/jobs.rs",
+        "core/dr-catalog/src/runner.rs",
+        "ui/dr-ui/src/library/scan.rs",
+    ] {
+        assert!(
+            files.iter().any(|(n, _)| n == must),
+            "{must} was not scanned — the source walk is wrong, not the code"
+        );
+    }
+    let jobs = &files
+        .iter()
+        .find(|(n, _)| n == "core/dr-catalog/src/jobs.rs")
+        .unwrap()
+        .1;
+    assert!(shipping_code(jobs).contains("pub fn enqueue("));
+
+    let ledger = read(&files);
+
+    assert!(
+        ledger.unreadable.is_empty(),
+        "\n\nThese enqueue calls do not name their JobKind, so this test cannot \
+         check that anything claims it. Spell the kind at the call:\n  {}\n",
+        ledger.unreadable.join("\n  ")
+    );
+
+    if ledger.claims_everything {
+        return;
+    }
+    let orphans: Vec<String> = ledger
+        .enqueued
+        .iter()
+        .filter(|(k, _)| !ledger.claimed.contains(k))
+        .map(|(k, at)| format!("JobKind::{k}, enqueued in {at}"))
+        .collect();
+    assert!(
+        orphans.is_empty(),
+        "\n\nEnqueued, and claimed by nothing (claimed: {:?}):\n  {}\n\n\
+         A kind nobody claims is a row per subject that stays for ever — the \
+         queue coalesces, so it never fails, it only grows (#73). Register a \
+         JobHandler for the kind, or stop enqueueing it and add it to \
+         JobKind::RETIRED so the rows already queued are dropped.\n",
+        ledger.claimed,
+        orphans.join("\n  ")
+    );
+}
+
+/// The reader itself, on code whose answer is known — so a parsing bug shows
+/// up as this failing, rather than the real check quietly finding nothing.
+#[test]
+fn the_reader_sees_producers_and_consumers() {
+    let producer = r#"
+        use dr_catalog::jobs;
+        fn persist(tx: &Connection, id: i64) {
+            // jobs::enqueue(tx, JobKind::ContentHash, ...) in a comment is not a call
+            let _ = dr_catalog::jobs::enqueue(
+                tx,
+                JobKind::Thumbnail,
+                Some(id),
+                Priority::Background,
+                None,
+            );
+            jobs::enqueue(tx, kind, Some(id), Priority::Background, None)?;
+        }
+        pub fn enqueue(conn: &Connection, kind: JobKind) {}
+        #[cfg(test)]
+        mod tests {
+            fn t() { enqueue(&c, JobKind::FetchOriginal, None, P, None); }
+        }
+    "#;
+    let consumer = r#"
+        impl JobHandler for Faces {
+            fn kinds(&self) -> &[JobKind] {
+                &[JobKind::DetectFaces]
+            }
+            fn run(&mut self) {}
+        }
+        trait JobHandler { fn kinds(&self) -> &[JobKind]; }
+        fn pull(c: &Connection) { claim_next_matching(c, 0, &[JobKind::FetchPreview]); }
+    "#;
+    let ledger = read(&[
+        ("producer.rs".into(), producer.into()),
+        ("consumer.rs".into(), consumer.into()),
+    ]);
+
+    let enqueued: Vec<&str> = ledger.enqueued.iter().map(|(k, _)| k.as_str()).collect();
+    assert_eq!(enqueued, vec!["Thumbnail"]);
+    assert_eq!(ledger.unreadable.len(), 1, "{:?}", ledger.unreadable);
+    assert_eq!(
+        ledger.claimed,
+        BTreeSet::from(["DetectFaces".to_string(), "FetchPreview".to_string()])
+    );
+    assert!(!ledger.claims_everything);
+}
@@ -0,0 +1,221 @@
+//! TRACES: S15 | FR-MRG-3
+//! Spike S15.1 — does rawler read back a linear DNG this application writes?
+//!
+//!   cargo run -p dr-decode --example linear_dng [-- <out.dng>]
+//!
+//! Decides FR-MRG-3's container. A panorama composite is three linear samples
+//! per pixel with a camera matrix attached, which is exactly what a
+//! `LinearRaw` DNG is; if rawler parses one, the composite re-enters the
+//! library as `Format::Dng` and the only new decode work is a `cpp == 3`
+//! branch. If it does not, the container is a float TIFF with a decode path
+//! of its own.
+//!
+//! The file is hand-rolled rather than written with the `tiff` crate, whose
+//! encoder fixes `PhotometricInterpretation` to RGB and cannot say
+//! `LinearRaw`. Eighty lines of IFD is the cheaper thing to own than a fork.
+
+use rawler::rawsource::RawSource;
+
+const W: u32 = 64;
+const H: u32 = 48;
+
+fn main() {
+    let bytes = write_linear_dng(W, H);
+    if let Some(path) = std::env::args().nth(1) {
+        std::fs::write(&path, &bytes).expect("write");
+        println!("wrote {path} ({} bytes)", bytes.len());
+    }
+
+    let source = RawSource::new_from_slice(&bytes);
+    let decoder = match rawler::get_decoder(&source) {
+        Ok(d) => d,
+        Err(e) => {
+            println!("FAIL  get_decoder: {e}");
+            std::process::exit(1);
+        }
+    };
+    println!("ok    decoder found");
+
+    let image = match decoder.raw_image(&source, &Default::default(), false) {
+        Ok(i) => i,
+        Err(e) => {
+            println!("FAIL  raw_image: {e}");
+            std::process::exit(1);
+        }
+    };
+    println!(
+        "ok    raw_image: {}×{}, cpp {}, bps {}, {} samples, make {:?} model {:?}",
+        image.width,
+        image.height,
+        image.cpp,
+        image.bps,
+        match &image.data {
+            rawler::RawImageData::Integer(v) => v.len(),
+            rawler::RawImageData::Float(v) => v.len(),
+        },
+        image.make,
+        image.model
+    );
+    println!(
+        "      white {:?}  black {:?}  wb {:?}",
+        image.whitelevel.0,
+        image
+            .blacklevel
+            .levels
+            .iter()
+            .map(|r| r.n as f32 / r.d.max(1) as f32)
+            .collect::<Vec<_>>(),
+        image.wb_coeffs
+    );
+
+    // The pixel at (1, 0) was written as (1000, 2000, 3000): if the samples
+    // come back interleaved in that order, cpp == 3 means what it says.
+    if let rawler::RawImageData::Integer(v) = &image.data {
+        let i = image.cpp;
+        println!("      pixel (1,0) = {:?}", &v[i..i + image.cpp.min(3)]);
+    }
+
+    // What dr-decode itself makes of it: the colour matrix rawler parsed into
+    // the camera definition, and the profile the decoder would build from it.
+    println!("      rawler color_matrix: {:?}", image.camera.color_matrix);
+    let dng = dr_decode::profile::read_dng_matrices(decoder.as_ref());
+    let profile = dr_decode::CameraProfile::extract(&image, &dng);
+    println!(
+        "      CameraProfile: {}",
+        profile
+            .as_ref()
+            .map(|p| format!("xyz_to_cam {:?}", p.xyz_to_cam()))
+            .unwrap_or_else(|| "none".into())
+    );
+
+    match dr_decode::decode(&bytes) {
+        Ok(r) => println!(
+            "note  dr_decode::decode accepted it as CFA: {}×{}, {} samples — the cpp==3 branch is the work",
+            r.width,
+            r.height,
+            r.data.len()
+        ),
+        Err(e) => println!("note  dr_decode::decode refused it: {e} — the cpp==3 branch is the work"),
+    }
+}
+
+/// A minimal `LinearRaw` DNG: one IFD, uncompressed 16-bit RGB, the tags a
+/// decoder needs to treat it as a DNG and the matrix a develop chain needs
+/// to treat it as a camera. Little-endian, one strip.
+fn write_linear_dng(w: u32, h: u32) -> Vec<u8> {
+    // Pixels first, so their offset is known: a ramp with one marker pixel.
+    let mut pixels: Vec<u16> = Vec::with_capacity((w * h * 3) as usize);
+    for y in 0..h {
+        for x in 0..w {
+            if (x, y) == (1, 0) {
+                pixels.extend([1000, 2000, 3000]);
+            } else {
+                let v = ((x + y) * 512).min(65535) as u16;
+                pixels.extend([v, v / 2, v / 3]);
+            }
+        }
+    }
+    let pixel_bytes: Vec<u8> = pixels.iter().flat_map(|v| v.to_le_bytes()).collect();
+
+    // Layout: header (8) | pixels | extra data | IFD.
+    let pixels_off = 8u32;
+    let extra_off = pixels_off + pixel_bytes.len() as u32;
+
+    // Values that do not fit in four bytes go in `extra`, and the entry
+    // points at them.
+    let mut extra: Vec<u8> = Vec::new();
+    let mut entries: Vec<(u16, u16, u32, [u8; 4])> = Vec::new();
+
+    fn short(tag: u16, v: u16) -> (u16, u16, u32, [u8; 4]) {
+        let mut b = [0u8; 4];
+        b[..2].copy_from_slice(&v.to_le_bytes());
+        (tag, 3, 1, b)
+    }
+    fn long(tag: u16, v: u32) -> (u16, u16, u32, [u8; 4]) {
+        (tag, 4, 1, v.to_le_bytes())
+    }
+    fn ascii(extra: &mut Vec<u8>, extra_off: u32, tag: u16, s: &str) -> (u16, u16, u32, [u8; 4]) {
+        let mut bytes = s.as_bytes().to_vec();
+        bytes.push(0);
+        let off = extra_off + extra.len() as u32;
+        extra.extend(&bytes);
+        (tag, 2, bytes.len() as u32, off.to_le_bytes())
+    }
+
+    entries.push(long(254, 0)); // NewSubfileType: main image
+    entries.push(long(256, w));
+    entries.push(long(257, h));
+    // BitsPerSample ×3 — three shorts, six bytes, so out of line.
+    {
+        let off = extra_off + extra.len() as u32;
+        for _ in 0..3 {
+            extra.extend(16u16.to_le_bytes());
+        }
+        entries.push((258, 3, 3, off.to_le_bytes()));
+    }
+    entries.push(short(259, 1)); // Compression: none
+    entries.push(short(262, 34892)); // PhotometricInterpretation: LinearRaw
+    entries.push(ascii(&mut extra, extra_off, 271, "DarkRoom"));
+    entries.push(ascii(&mut extra, extra_off, 272, "Panorama"));
+    entries.push(long(273, pixels_off)); // StripOffsets
+    entries.push(short(274, 1)); // Orientation
+    entries.push(short(277, 3)); // SamplesPerPixel
+    entries.push(long(278, h)); // RowsPerStrip
+    entries.push(long(279, pixel_bytes.len() as u32)); // StripByteCounts
+    entries.push(short(284, 1)); // PlanarConfiguration: chunky
+    entries.push((50706, 1, 4, [1, 4, 0, 0])); // DNGVersion
+    entries.push((50707, 1, 4, [1, 4, 0, 0])); // DNGBackwardVersion
+    entries.push(ascii(&mut extra, extra_off, 50708, "DarkRoom Panorama")); // UniqueCameraModel
+    entries.push(long(50717, 65535)); // WhiteLevel
+
+    // ColorMatrix1: XYZ → camera, 9 SRATIONALs. A plausible sRGB-ish matrix
+    // (the inverse of the sRGB D65 primaries), scaled to integers.
+    {
+        let m: [(i32, i32); 9] = [
+            (32406, 10000),
+            (-15372, 10000),
+            (-4986, 10000),
+            (-9689, 10000),
+            (18758, 10000),
+            (415, 10000),
+            (557, 10000),
+            (-2040, 10000),
+            (10570, 10000),
+        ];
+        let off = extra_off + extra.len() as u32;
+        for (n, d) in m {
+            extra.extend(n.to_le_bytes());
+            extra.extend(d.to_le_bytes());
+        }
+        entries.push((50721, 10, 9, off.to_le_bytes()));
+    }
+    // AsShotNeutral: 3 RATIONALs, neutral.
+    {
+        let off = extra_off + extra.len() as u32;
+        for _ in 0..3 {
+            extra.extend(1u32.to_le_bytes());
+            extra.extend(1u32.to_le_bytes());
+        }
+        entries.push((50728, 5, 3, off.to_le_bytes()));
+    }
+    entries.push(short(50778, 21)); // CalibrationIlluminant1: D65
+
+    entries.sort_by_key(|e| e.0);
+
+    let ifd_off = extra_off + extra.len() as u32;
+    let mut out = Vec::new();
+    out.extend(b"II");
+    out.extend(42u16.to_le_bytes());
+    out.extend(ifd_off.to_le_bytes());
+    out.extend(&pixel_bytes);
+    out.extend(&extra);
+    out.extend((entries.len() as u16).to_le_bytes());
+    for (tag, ty, count, value) in &entries {
+        out.extend(tag.to_le_bytes());
+        out.extend(ty.to_le_bytes());
+        out.extend(count.to_le_bytes());
+        out.extend(value);
+    }
+    out.extend(0u32.to_le_bytes()); // no next IFD
+    out
+}
@@ -1,160 +0,0 @@
-# DarkRoom camera base curves (FR-DEV-3e).
-#
-# ---------------------------------------------------------------------------
-# Adding a body is editing this file. It is not a code change.
-# ---------------------------------------------------------------------------
-#
-# The copy you are reading is compiled into the binary as a floor. At startup
-# `dr_decode::base_curve::load` also looks for `base_curves.yaml` in:
-#
-#   1. $DARKROOM_PROFILES/                       (set it while you are tuning)
-#   2. $XDG_DATA_HOME/darkroom/profiles/
-#      or $HOME/.local/share/darkroom/profiles/
-#
-# and uses the first one it finds *whose `version:` is higher than this one's*.
-# So: bump `version`, drop the file in that directory, restart. A body added
-# this afternoon renders correctly this afternoon, with no release and no
-# rebuild — which is what the requirement asks for, and what makes these
-# contributable under the GPL.
-#
-# The version check runs both ways on purpose. A file older than the built-in
-# copy is ignored with a log line, so upgrading DarkRoom cannot silently lose
-# curves to a pack somebody downloaded a year ago.
-#
-# ---------------------------------------------------------------------------
-# What the numbers mean
-# ---------------------------------------------------------------------------
-#
-# Five `[x, y]` control points on a monotone spline (Fritsch-Carlson, the same
-# one the tone curve widget draws). Both axes are **linear**:
-#
-#   x  scene-referred camera RGB after white balance, 1.0 = sensor saturation
-#   y  display-referred linear; the sRGB transfer function is applied later,
-#      at the end of the shader, so do not pre-apply a gamma here
-#
-# The identity is y = x, and it is what an unrecognised body gets if `default:`
-# is removed. It is also the wrong answer for almost every photograph: linear
-# scene data has middle grey at about 13% and a camera JPEG puts it near 18%,
-# so an uncurved render is roughly half a stop dark through the midtones and
-# has no highlight rolloff at all.
-#
-# A curve that works has three parts, and it is worth naming them because they
-# are what you are actually tuning:
-#
-#   the toe       the first span, slope near or below 1. Deep shadows stay
-#                 deep. Lift it and blacks go milky; crush it and shadow
-#                 detail the sensor recorded disappears.
-#   the midtones  the middle spans, slope well above 1. This is the contrast
-#                 and the brightness people read as "the camera's look".
-#   the shoulder  the last span, slope well below 1. Highlights compress
-#                 toward white instead of arriving there and clipping. It is
-#                 the difference between a rolled-off sky and a white hole.
-#
-# Two invariants are enforced in code and tested, so a mistake here fails the
-# build rather than the photograph: x must strictly increase, y must not
-# decrease, and everything must lie inside the unit square.
-#
-# ---------------------------------------------------------------------------
-# Honesty about these values
-# ---------------------------------------------------------------------------
-#
-# These are hand-tuned shapes, not measurements. They encode what every camera
-# JPEG rendering has in common — the toe/midtone/shoulder structure above —
-# plus each maker's well-known house differences: Canon's gentler shoulder and
-# warmer-reading midtones, Nikon's slightly higher midtone contrast, Sony's
-# flatter and more conservative default, Fujifilm's markedly contrastier
-# Provia-derived rendering.
-#
-# FR-DEV-3e's acceptance criterion is subjective comparison against each body's
-# own JPEG, and meeting it properly needs a frame from that body in front of
-# you. Where that has not been done, the entry is still much closer to right
-# than the identity — which is the bar these have to clear, and do.
-
-version: 1
-
-# The rendering for a body with no entry of its own.
-#
-# **Deliberately not the identity.** The failure this requirement exists to fix
-# is the flat render, and a conservative curve is far closer to right for every
-# body than no curve is for any of them. It is gentler than the per-body
-# entries below — a shallower midtone and an earlier, softer shoulder — because
-# it has to be safe on a sensor nobody has looked at, and the cost of being too
-# tame is a photograph that wants a little contrast rather than one that has
-# lost its highlights.
-default:
-  points:
-    - [0.00, 0.000]
-    - [0.04, 0.043]
-    - [0.13, 0.175]
-    - [0.45, 0.690]
-    - [1.00, 1.000]
-
-bodies:
-  # Canon. A soft toe and a long, gradual shoulder — the reason Canon files
-  # are described as forgiving in highlights and a little low in contrast
-  # straight out of camera.
-  - make: Canon
-    model: EOS 6D
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.045]
-      - [0.13, 0.190]
-      - [0.45, 0.720]
-      - [1.00, 1.000]
-
-  - make: Canon
-    model: EOS R6
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.044]
-      - [0.13, 0.195]
-      - [0.45, 0.730]
-      - [1.00, 1.000]
-
-  # Nikon. A slightly deeper toe and more midtone slope than Canon, which is
-  # the "punchier out of camera" difference people describe between the two.
-  - make: Nikon
-    model: Z 6
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.038]
-      - [0.13, 0.200]
-      - [0.46, 0.750]
-      - [1.00, 1.000]
-
-  - make: Nikon
-    model: D750
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.039]
-      - [0.13, 0.198]
-      - [0.46, 0.745]
-      - [1.00, 1.000]
-
-  # Sony. The flattest default of the four, and intentionally so — Sony's own
-  # rendering leaves more headroom than it uses, which is why Sony files are
-  # the ones people describe as needing the most work.
-  - make: Sony
-    model: ILCE-7M3
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.048]
-      - [0.13, 0.185]
-      - [0.44, 0.700]
-      - [1.00, 1.000]
-
-  # Fujifilm. Provia, the default film simulation: a firm toe, the steepest
-  # midtones here, and a hard shoulder. It is the most distinctive rendering of
-  # the four and the one where a flat render looks most obviously wrong.
-  #
-  # This entry does *not* read the in-RAF film simulation tag — that is
-  # FR-DEV-3f, and until it lands every Fujifilm file gets the Provia shape
-  # whatever the camera was set to.
-  - make: Fujifilm
-    model: X-T3
-    points:
-      - [0.00, 0.000]
-      - [0.045, 0.040]
-      - [0.14, 0.215]
-      - [0.47, 0.775]
-      - [1.00, 1.000]
@@ -1,752 +0,0 @@
-//! TRACES: FR-DEV-3e
-//! Base curves — the per-body rendering that turns a correct exposure into a
-//! photograph.
-//!
-//! # What this is for
-//!
-//! A camera matrix gets the *colours* right and leaves the picture flat. Sensor
-//! data is scene-referred and very nearly linear; a print, a screen and a
-//! camera's own JPEG are none of those things. Rendering linear data straight
-//! out is the dcraw default, and FR-DEV-3e names it precisely: "the flat,
-//! poor-skin-tone rendering characteristic of dcraw defaults, which is the
-//! documented reason people abandon darktable in the first hour."
-//!
-//! The fix is a tone curve applied as part of *reading* the file rather than as
-//! an edit — a toe, a steep midtone, and a shoulder that rolls highlights off
-//! instead of clipping them. Every raw converter has one. Adobe calls it the
-//! camera profile's tone curve, darktable calls it the base curve, and the name
-//! here follows darktable's because the placement does too: it runs in camera
-//! RGB, after white balance and the user's adjustments, immediately before the
-//! conversion out to a working space.
-//!
-//! # Why it is not an edit
-//!
-//! It never reaches the sidecar and there is no slider for it, for the same
-//! reason the EXIF orientation is not an edit (FR-DEV-3h): it is a property of
-//! the body that took the frame, not of what anyone decided about the frame.
-//! Sidecars are shared between devices and bodies (FR-NC-9), and one camera's
-//! rendering must not follow an edit onto another camera's file.
-//!
-//! # Why it is data
-//!
-//! FR-DEV-3e requires the profile database to be "versioned independently of
-//! the app binary so bodies and curves can be added without a release — and,
-//! under D8's GPLv3, contributed by users". So the curves live in
-//! `profiles/base_curves.yaml`, a file that is compiled in as a floor and
-//! *overridden* by a copy on disk carrying a higher `version:`. Adding a body
-//! is adding ten numbers to a YAML file; shipping that body to users is
-//! publishing the file. Neither is a code change and neither needs a release.
-//!
-//! See [`load`] for the search path and [`Curves::body`] for the matching.
-
-use std::path::{Path, PathBuf};
-use std::sync::OnceLock;
-
-/// How many control points a base curve has.
-///
-/// Five, which is not a coincidence: it is what the tone curve widget uses
-/// (`dr_pipeline::ops::curve::POINTS`), so the shader evaluates a profile's
-/// curve and a photographer's curve through exactly the same spline. A profile
-/// author and a photographer dragging a point mean the same thing by it, and
-/// the generated shader carries one implementation rather than two that could
-/// disagree.
-pub const POINTS: usize = 5;
-
-/// TRACES: FR-DEV-3e
-/// A base curve: five points on a monotone spline through the unit square.
-///
-/// `xs` is scene-linear camera RGB, normalised so that 1.0 is the sensor's
-/// saturation point. `ys` is display-referred linear — *not* gamma-encoded,
-/// because the sRGB transfer function is applied at the very end of the
-/// generated shader and applying it twice would wash the image out.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct BaseCurve {
-    pub xs: [f32; POINTS],
-    pub ys: [f32; POINTS],
-}
-
-impl BaseCurve {
-    /// The curve that does nothing — the identity diagonal.
-    ///
-    /// What an unrecognised body gets if the database carries no default, and
-    /// what a JPEG gets always: an already-rendered image must not be rendered
-    /// a second time.
-    pub const IDENTITY: Self = Self {
-        xs: [0.0, 0.25, 0.5, 0.75, 1.0],
-        ys: [0.0, 0.25, 0.5, 0.75, 1.0],
-    };
-
-    /// Whether this curve would leave the image alone.
-    ///
-    /// The shader is told to skip the stage entirely when it would, so an
-    /// unprofiled body costs a branch that is uniform across the dispatch
-    /// rather than a spline evaluation per channel per pixel.
-    pub fn is_identity(&self) -> bool {
-        self.xs
-            .iter()
-            .zip(self.ys.iter())
-            .all(|(x, y)| (x - y).abs() < 1e-6)
-    }
-
-    /// Build from raw pairs, rejecting anything that is not a curve.
-    ///
-    /// A profile file is data a user may have edited, so this is the boundary
-    /// where "ten numbers" becomes "a curve": the x coordinates must increase,
-    /// the y coordinates must not decrease, and both must lie in the unit
-    /// square. A non-monotone x sends the spline's span search backwards and
-    /// divides by a negative width; a decreasing y inverts tones locally,
-    /// which reads as a dark halo through smooth gradients rather than as a
-    /// bad profile.
-    ///
-    /// Endpoints are not forced to (0,0) and (1,1). A curve that lifts black
-    /// slightly, or that places the shoulder below white, is a legitimate
-    /// rendering choice and several bodies make it.
-    pub fn from_points(points: &[[f32; 2]]) -> Option<Self> {
-        if points.len() != POINTS {
-            return None;
-        }
-        let mut xs = [0.0f32; POINTS];
-        let mut ys = [0.0f32; POINTS];
-        for (i, p) in points.iter().enumerate() {
-            if !p[0].is_finite() || !p[1].is_finite() {
-                return None;
-            }
-            if !(0.0..=1.0).contains(&p[0]) || !(0.0..=1.0).contains(&p[1]) {
-                return None;
-            }
-            xs[i] = p[0];
-            ys[i] = p[1];
-        }
-        for i in 1..POINTS {
-            // Strictly increasing in x — the spline divides by the span width.
-            if xs[i] <= xs[i - 1] {
-                return None;
-            }
-            // Non-decreasing in y. Flat is allowed: a curve that holds a
-            // highlight range at white is clipping deliberately.
-            if ys[i] < ys[i - 1] {
-                return None;
-            }
-        }
-        Some(Self { xs, ys })
-    }
-}
-
-/// One body's entry in the database.
-#[derive(Debug, Clone, PartialEq)]
-pub struct BodyCurve {
-    /// The manufacturer, as the file writes it — "Canon", "NIKON CORPORATION".
-    pub make: String,
-    /// The model, as the file writes it — "EOS 6D", "ILCE-7M3".
-    pub model: String,
-    pub curve: BaseCurve,
-}
-
-/// TRACES: FR-DEV-3e
-/// The base curve database.
-///
-/// Versioned as a whole rather than per body, because that is the unit a user
-/// downloads and the unit that has to beat the built-in copy. See [`load`].
-#[derive(Debug, Clone, PartialEq)]
-pub struct Curves {
-    version: u32,
-    default: Option<BaseCurve>,
-    bodies: Vec<BodyCurve>,
-}
-
-impl Curves {
-    /// TRACES: FR-DEV-3e
-    /// The curve to render a frame from this body with.
-    ///
-    /// Falls back, in order, to the database's `default:` and then to the
-    /// identity. **The default is deliberately not the identity**: an
-    /// unrecognised body rendered flat is the failure this requirement exists
-    /// to prevent, and a gentle, conservative curve is much closer to right for
-    /// every body than no curve is for any of them. A body with its own entry
-    /// gets that instead.
-    ///
-    /// # What "this body" has to survive
-    ///
-    /// The same camera names itself three ways depending on which program last
-    /// touched the file. A native NEF says make "NIKON CORPORATION", model
-    /// "NIKON Z 6"; rawler's own database cleans that to "Nikon" and "Z 6"; an
-    /// Adobe-converted DNG keeps the uncleaned pair. A database that had to
-    /// spell every variant would go stale the first time a maker changed its
-    /// mind about its own name, so the matching does the folding instead:
-    ///
-    /// - Case, punctuation and runs of whitespace are flattened, so
-    ///   "ILCE-7M3", "ILCE 7M3" and "ilce-7m3" are one body.
-    /// - The make is compared on its **first word only**. Every maker's
-    ///   trailing corporate boilerplate — "CORPORATION", "IMAGING CORP" — is
-    ///   noise, and no two camera manufacturers share a first word.
-    /// - The model is tried both as written and with a leading copy of the
-    ///   make removed, which is what lets one "Canon"/"EOS 6D" entry cover
-    ///   "Canon EOS 6D" as well.
-    pub fn body(&self, make: &str, model: &str) -> BaseCurve {
-        let (make, model) = (make_key(make), normalise(model));
-        // The model with a leading copy of the maker's name removed.
-        let bare = model.strip_prefix(&format!("{make} ")).unwrap_or(&model);
-
-        self.bodies
-            .iter()
-            .find(|b| {
-                let entry_model = normalise(&b.model);
-                make_key(&b.make) == make && (entry_model == model || entry_model == bare)
-            })
-            .map(|b| b.curve)
-            .or(self.default)
-            .unwrap_or(BaseCurve::IDENTITY)
-    }
-
-    /// The database version. Higher wins; see [`load`].
-    pub fn version(&self) -> u32 {
-        self.version
-    }
-
-    /// How many bodies have their own curve, excluding the default.
-    pub fn len(&self) -> usize {
-        self.bodies.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.bodies.is_empty()
-    }
-
-    /// Parse a database from YAML.
-    ///
-    /// Entries that are not curves are dropped with a warning rather than
-    /// failing the parse. A user-contributed file with one bad body should
-    /// cost that body's rendering, not every body's — and the alternative is an
-    /// application that will not open a photograph because somebody typed a
-    /// comma.
-    pub fn parse(yaml: &str) -> Result<Self, String> {
-        let file: File = serde_norway::from_str(yaml).map_err(|e| e.to_string())?;
-
-        let default = file.default.and_then(|d| {
-            BaseCurve::from_points(&d.points).or_else(|| {
-                log::warn!("base curves: the default entry is not a monotone curve; ignoring it");
-                None
-            })
-        });
-
-        let bodies = file
-            .bodies
-            .into_iter()
-            .filter_map(|b| match BaseCurve::from_points(&b.points) {
-                Some(curve) => Some(BodyCurve {
-                    make: b.make,
-                    model: b.model,
-                    curve,
-                }),
-                None => {
-                    log::warn!(
-                        "base curves: {} {} is not a monotone curve; ignoring it",
-                        b.make,
-                        b.model
-                    );
-                    None
-                }
-            })
-            .collect();
-
-        Ok(Self {
-            version: file.version,
-            default,
-            bodies,
-        })
-    }
-}
-
-/// The copy that ships inside the binary.
-///
-/// A floor, not the answer: [`load`] prefers a newer file on disk. Compiled in
-/// so that a fresh install with no profile directory — and every Android build,
-/// where there is no such directory to speak of — still renders properly.
-const BUILT_IN: &str = include_str!("../profiles/base_curves.yaml");
-
-/// TRACES: FR-DEV-3e
-/// The base curve database, loaded once.
-///
-/// # The search path, and why it is a version comparison
-///
-/// 1. `$DARKROOM_PROFILES`, a directory, when set. The escape hatch: a profile
-///    author iterating on a curve points this at their working copy and does
-///    not have to install anything.
-/// 2. `$XDG_DATA_HOME/darkroom/profiles/`, else `$HOME/.local/share/darkroom/profiles/`.
-///    The same base directory the catalog uses, chosen there for the same
-///    reason — it is data, not cache, and must survive a storage sweep.
-/// 3. The copy compiled into the binary.
-///
-/// The first file that parses *and carries a higher `version:` than the
-/// built-in copy* wins. The version check is the whole mechanism the
-/// requirement asks for, and it runs in both directions:
-///
-/// - A downloaded pack at version 7 supersedes a binary shipping version 3, so
-///   a body added after the release renders correctly with no release.
-/// - A stale pack at version 2 does **not** supersede a binary shipping version
-///   3, so upgrading the application cannot silently lose curves to a file
-///   somebody downloaded a year ago and forgot.
-///
-/// Failures are warnings, never errors. A malformed profile file must cost the
-/// user their curves, not their photographs.
-pub fn load() -> &'static Curves {
-    static LOADED: OnceLock<Curves> = OnceLock::new();
-    LOADED.get_or_init(|| {
-        let built_in = Curves::parse(BUILT_IN).unwrap_or_else(|e| {
-            // Unreachable in a build that ran its tests — `the_shipped_database_parses`
-            // asserts exactly this — but a panic here would mean an
-            // application that cannot open a photograph because of a typo in a
-            // data file, which is never the right trade.
-            log::error!("base curves: the built-in database does not parse: {e}");
-            Curves {
-                version: 0,
-                default: None,
-                bodies: Vec::new(),
-            }
-        });
-
-        choose(built_in, &search_path())
-    })
-}
-
-/// The version comparison, separated from where the directories come from.
-///
-/// Split out so it can be tested against real files in a real directory
-/// without the process-wide `OnceLock` and the environment `load` reads. The
-/// rule this implements is the whole of what FR-DEV-3e asks for, so it is
-/// worth being able to state it as a test rather than as a comment.
-fn choose(built_in: Curves, dirs: &[PathBuf]) -> Curves {
-    for dir in dirs {
-        let path = dir.join("base_curves.yaml");
-        let Ok(text) = std::fs::read_to_string(&path) else {
-            continue;
-        };
-        match Curves::parse(&text) {
-            Ok(external) if external.version > built_in.version => {
-                log::info!(
-                    "base curves: using {} (version {}, {} bodies) over the built-in version {}",
-                    path.display(),
-                    external.version,
-                    external.len(),
-                    built_in.version
-                );
-                return external;
-            }
-            Ok(external) => log::info!(
-                "base curves: ignoring {} at version {}; the built-in database is version {}",
-                path.display(),
-                external.version,
-                built_in.version
-            ),
-            Err(e) => log::warn!("base curves: {} does not parse: {e}", path.display()),
-        }
-    }
-    built_in
-}
-
-/// TRACES: FR-DEV-3e
-/// The curve for a body, from the loaded database.
-///
-/// The one call site the decoder needs; everything above is reachable for
-/// tests and for a future profile editor.
-pub fn for_body(make: &str, model: &str) -> BaseCurve {
-    load().body(make, model)
-}
-
-/// Directories that may hold a `base_curves.yaml`, most specific first.
-fn search_path() -> Vec<PathBuf> {
-    let mut dirs = Vec::new();
-    if let Some(explicit) = std::env::var_os("DARKROOM_PROFILES") {
-        dirs.push(PathBuf::from(explicit));
-    }
-    // The same resolution `dr_ui::library::catalog_path` uses, and for the
-    // same reason: this is data a user may have installed, not a cache. It is
-    // duplicated rather than shared because `dr-decode` sits far below the UI
-    // and must not acquire a dependency on it to find a directory.
-    let base = std::env::var_os("XDG_DATA_HOME")
-        .map(PathBuf::from)
-        .or_else(|| std::env::var_os("HOME").map(|h| Path::new(&h).join(".local/share")));
-    if let Some(base) = base {
-        dirs.push(base.join("darkroom").join("profiles"));
-    }
-    dirs
-}
-
-/// A manufacturer's first word, folded.
-///
-/// "NIKON CORPORATION", "Nikon" and "nikon" all become `NIKON`. The corporate
-/// suffixes are not information — they appear or not depending on whether the
-/// file went through a DNG converter — and no two camera manufacturers share a
-/// first word, so nothing is lost by dropping them.
-fn make_key(s: &str) -> String {
-    normalise(s)
-        .split(' ')
-        .next()
-        .unwrap_or_default()
-        .to_string()
-}
-
-/// Fold a make or model into something two files can agree on.
-///
-/// Upper-cased, with every run of non-alphanumeric characters collapsed to one
-/// space and the ends trimmed, so that "ILCE-7M3", "ILCE 7M3" and "ilce-7m3"
-/// become one.
-fn normalise(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    let mut pending_space = false;
-    for c in s.chars() {
-        if c.is_ascii_alphanumeric() {
-            if pending_space && !out.is_empty() {
-                out.push(' ');
-            }
-            pending_space = false;
-            out.push(c.to_ascii_uppercase());
-        } else {
-            pending_space = true;
-        }
-    }
-    out
-}
-
-// ---- The on-disk shape, kept apart from the in-memory one ----------------
-//
-// Deliberately separate types. The file is data a user edits and is allowed to
-// be wrong; `Curves` is a parsed database whose every entry is known to be a
-// monotone curve. Deriving `Deserialize` on `BaseCurve` directly would delete
-// that boundary and let an unchecked five-point array reach the shader.
-//
-// Unknown fields are **accepted**, which is not laziness. The database is
-// versioned independently of the binary and moves in both directions: a pack
-// published after this release may carry keys this build has never heard of —
-// a hue twist, a look table (FR-DEV-3f) — and it must still deliver its curves
-// to an older DarkRoom rather than failing to parse and leaving every body
-// flat. `deny_unknown_fields` would trade that for a diagnostic nobody needs.
-
-#[derive(serde::Deserialize)]
-struct File {
-    version: u32,
-    #[serde(default)]
-    default: Option<Entry>,
-    #[serde(default)]
-    bodies: Vec<BodyEntry>,
-}
-
-#[derive(serde::Deserialize)]
-struct Entry {
-    points: Vec<[f32; 2]>,
-}
-
-#[derive(serde::Deserialize)]
-struct BodyEntry {
-    make: String,
-    model: String,
-    points: Vec<[f32; 2]>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_shipped_database_parses_and_carries_a_default() {
-        // The one test that must never be allowed to fail quietly: `load`
-        // degrades to an empty database rather than panicking, so without this
-        // a typo in the YAML would ship as "every photograph renders flat"
-        // rather than as a build failure.
-        let curves = Curves::parse(BUILT_IN).expect("the shipped database parses");
-        assert!(curves.version() >= 1);
-        assert!(!curves.is_empty(), "the database ships bodies");
-        assert!(
-            !curves.body("Nobody", "Nothing").is_identity(),
-            "an unknown body must still get the default rendering"
-        );
-    }
-
-    #[test]
-    fn every_shipped_curve_lifts_the_midtones_and_rolls_the_highlights() {
-        // What makes a base curve a base curve rather than a decoration. If a
-        // shipped curve failed either half it would be a worse rendering than
-        // the flat one it replaced, which is the one outcome forbidden.
-        let curves = Curves::parse(BUILT_IN).expect("parses");
-        let all = curves
-            .bodies
-            .iter()
-            .map(|b| (format!("{} {}", b.make, b.model), b.curve))
-            .chain(curves.default.map(|c| ("default".to_string(), c)));
-
-        for (name, curve) in all {
-            // The midtone point sits above the diagonal: a linear midtone is
-            // roughly a stop and a half darker than any camera renders it.
-            let mid = 2;
-            assert!(
-                curve.ys[mid] > curve.xs[mid],
-                "{name} does not lift its midtones ({} -> {})",
-                curve.xs[mid],
-                curve.ys[mid]
-            );
-            // And the last span is shallower than the one before it, which is
-            // what a shoulder *is*. Without one the curve clips highlights
-            // harder than the linear rendering did.
-            let slope =
-                |i: usize| (curve.ys[i + 1] - curve.ys[i]) / (curve.xs[i + 1] - curve.xs[i]);
-            assert!(
-                slope(POINTS - 2) < slope(POINTS - 3),
-                "{name} has no highlight shoulder"
-            );
-        }
-    }
-
-    #[test]
-    fn a_curve_that_is_not_monotone_is_refused() {
-        // The profile file is user-editable, so this is a real boundary and
-        // not a formality. A decreasing y inverts tones locally and shows up
-        // as a dark halo in a gradient, which reads as a rendering fault
-        // rather than as a bad profile.
-        assert_eq!(
-            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.4], [0.5, 0.3], [0.75, 0.8], [1.0, 1.0]]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_curve_whose_x_does_not_advance_is_refused() {
-        // The spline divides by the span width; a repeated x is a division by
-        // zero in the shader, which is a NaN pixel rather than an error.
-        assert_eq!(
-            BaseCurve::from_points(&[
-                [0.0, 0.0],
-                [0.25, 0.3],
-                [0.25, 0.5],
-                [0.75, 0.8],
-                [1.0, 1.0]
-            ]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_curve_of_the_wrong_length_is_refused() {
-        assert_eq!(BaseCurve::from_points(&[[0.0, 0.0], [1.0, 1.0]]), None);
-    }
-
-    #[test]
-    fn values_outside_the_unit_square_are_refused() {
-        // The shader clamps its output at the very end anyway, but a control
-        // point above 1.0 would put the shoulder outside the range the curve
-        // is defined over and silently flatten everything below it.
-        assert_eq!(
-            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.3], [0.5, 1.4], [0.75, 1.5], [1.0, 1.6]]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_body_with_its_own_entry_beats_the_default() {
-        let curves = Curves::parse(
-            "version: 2
-default:
-  points: [[0.0, 0.0], [0.25, 0.3], [0.5, 0.6], [0.75, 0.85], [1.0, 1.0]]
-bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("Canon", "EOS 5D").ys[1], 0.30);
-    }
-
-    #[test]
-    fn the_make_may_be_repeated_in_the_model() {
-        // Canon writes "Canon" as the make and "Canon EOS 6D" as the model;
-        // rawler's cleaned strings drop the repetition and both reach here.
-        // One entry has to cover both or half the files on a card miss.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Canon", "Canon EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("CANON", "eos 6d").ys[1], 0.35);
-    }
-
-    #[test]
-    fn a_corporate_suffix_does_not_hide_a_body() {
-        // The same Z 6 arrives as "Nikon"/"Z 6" from rawler's camera database
-        // and as "NIKON CORPORATION"/"NIKON Z 6" from a DNG converted out of
-        // the same file. Both must find the entry, or converting a file to
-        // DNG would silently change how it renders.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Nikon
-    model: Z 6
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Nikon", "Z 6").ys[1], 0.35);
-        assert_eq!(curves.body("NIKON CORPORATION", "NIKON Z 6").ys[1], 0.35);
-    }
-
-    #[test]
-    fn punctuation_and_spacing_do_not_decide_whether_a_body_is_known() {
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Sony
-    model: ILCE-7M3
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("SONY", "ILCE 7M3").ys[1], 0.35);
-        assert_eq!(curves.body("sony", "ilce-7m3").ys[1], 0.35);
-    }
-
-    #[test]
-    fn one_bad_entry_does_not_cost_the_rest() {
-        // A user-contributed file with one typo should cost that body's
-        // rendering, not every body's.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Broken
-    model: Body
-    points: [[0.0, 0.0], [0.25, 0.9], [0.5, 0.1], [0.75, 0.9], [1.0, 1.0]]
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.len(), 1);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert!(curves.body("Broken", "Body").is_identity());
-    }
-
-    #[test]
-    fn a_pack_from_the_future_still_delivers_its_curves() {
-        // The database is versioned independently of the binary, so a pack
-        // published after this build may carry keys this build has never heard
-        // of. It must still hand over the curves it does understand — failing
-        // the parse would leave every body flat, which is the exact failure
-        // FR-DEV-3e exists to prevent, delivered by the mechanism meant to
-        // prevent it.
-        let curves = Curves::parse(
-            "version: 9
-look_table: ambitious
-bodies:
-  - make: Canon
-    model: EOS 6D
-    hue_twist: [1, 2, 3]
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("an unfamiliar key must not fail the parse");
-
-        assert_eq!(curves.version(), 9);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-    }
-
-    #[test]
-    fn an_unknown_body_with_no_default_gets_the_identity() {
-        // Graceful fallback, stated as a property: never worse than a flat
-        // render, and never a curve tuned for somebody else's sensor when the
-        // database declines to offer one.
-        let curves = Curves::parse("version: 1\nbodies: []\n").expect("parses");
-        assert!(curves.body("Nobody", "Nothing").is_identity());
-    }
-
-    /// A directory holding one `base_curves.yaml`, unique to the caller.
-    fn a_pack_dir(name: &str, yaml: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("darkroom-base-curves-{name}"));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).expect("a writable temp directory");
-        std::fs::write(dir.join("base_curves.yaml"), yaml).expect("write");
-        dir
-    }
-
-    const A_CANON_ENTRY: &str = "bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.42], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-";
-
-    #[test]
-    fn a_newer_pack_on_disk_supersedes_the_built_in_database() {
-        // **This is the requirement.** FR-DEV-3e asks for a profile database
-        // versioned independently of the app binary "so bodies and curves can
-        // be added without a release". A file with a higher version, dropped
-        // in the profile directory, is what that means in practice.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let newer = format!("version: {}\n{A_CANON_ENTRY}", built_in.version() + 1);
-        let dir = a_pack_dir("newer", &newer);
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version() + 1);
-        assert_eq!(chosen.body("Canon", "EOS 6D").ys[1], 0.42);
-    }
-
-    #[test]
-    fn a_stale_pack_does_not_survive_an_upgrade() {
-        // The other direction, and the one that protects the user. Somebody
-        // downloads a pack, a release later ships better curves for the same
-        // bodies, and the forgotten file must not quietly hold the application
-        // back at last year's rendering.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let stale = format!("version: {}\n{A_CANON_ENTRY}", built_in.version());
-        let dir = a_pack_dir("stale", &stale);
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version());
-        assert_ne!(
-            chosen.body("Canon", "EOS 6D").ys[1],
-            0.42,
-            "an equal version must not displace the built-in database"
-        );
-    }
-
-    #[test]
-    fn a_broken_pack_costs_the_curves_and_not_the_photographs() {
-        // A malformed profile file must degrade to the built-in database, not
-        // to an error. The user came here to look at a photograph.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let dir = a_pack_dir("broken", "version: [this is not a number\n");
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version());
-        assert_eq!(chosen.len(), built_in.len());
-    }
-
-    #[test]
-    fn a_directory_with_no_pack_in_it_is_simply_skipped() {
-        // The ordinary case on every machine: the search path exists, the file
-        // does not. It must not be a warning, an error, or a slow path.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let missing = std::env::temp_dir().join("darkroom-base-curves-nothing-here");
-        let _ = std::fs::remove_dir_all(&missing);
-
-        assert_eq!(choose(built_in.clone(), &[missing]), built_in);
-    }
-
-    #[test]
-    fn the_identity_is_recognised_as_doing_nothing() {
-        assert!(BaseCurve::IDENTITY.is_identity());
-        assert!(!Curves::parse(BUILT_IN)
-            .expect("parses")
-            .body("Canon", "EOS 6D")
-            .is_identity());
-    }
-}
@@ -0,0 +1,121 @@
+//! TRACES: FR-RAW-2
+//! The seam a second decoder plugs into.
+//!
+//! D2 keeps LibRaw as the fallback for bodies rawler does not cover. Adding
+//! it later should be a new `impl Decoder`, not an edit to every caller that
+//! reads a header, cuts a thumbnail or opens a photograph for export — which
+//! is what the free functions alone would have made it. So the callers take a
+//! `&dyn Decoder`, and only the places that start a job name [`default`].
+//!
+//! Bytes in, always. Nothing here takes a path or a `SourceRef`: resolving a
+//! file to bytes is `Storage`'s job at the caller, so the same decoder serves a
+//! local file, an Android document and a range fetched from Nextcloud. The
+//! decoder's part in that is to say how much of a file it needs
+//! ([`Decoder::header_bytes`]) and where its preview sits
+//! ([`Decoder::locate_preview`]); the storage layer fetches exactly that.
+//!
+//! What stays a free function is what is not a decoder's to vary: recognising
+//! a JPEG ([`crate::probe`]), decoding one ([`crate::decode_jpeg`]) and
+//! checking one is whole ([`crate::is_complete_jpeg`]). A second RAW decoder
+//! would not read a JPEG differently.
+
+use dr_types::Orientation;
+
+use crate::{DecodeError, Metadata, Preview, PreviewLocation, PreviewSize, RawImage};
+
+/// TRACES: FR-RAW-2
+/// A RAW decoder, over bytes.
+///
+/// Object-safe so a caller can hold `&dyn Decoder` without becoming generic,
+/// `Send + Sync` because the callers that need one most — the thumbnail
+/// lanes, the export worker — run off the UI thread, and `Debug` so a job
+/// description that carries one can still be printed.
+pub trait Decoder: Send + Sync + std::fmt::Debug {
+    /// How much of the start of a file [`Self::metadata`] and
+    /// [`Self::locate_preview`] need. A caller reading over a network fetches
+    /// this range and no more.
+    fn header_bytes(&self) -> u64;
+
+    /// Capture metadata, from a header or a whole file, without touching
+    /// sensor data.
+    fn metadata(&self, bytes: &[u8]) -> Result<Metadata, DecodeError>;
+
+    /// How the stored pixels are turned, from a header. `None` where the file
+    /// does not say, which callers take as upright.
+    fn orientation(&self, header: &[u8]) -> Option<Orientation>;
+
+    /// Where the embedded preview best suited to a thumbnail sits in the file,
+    /// from its header, so a remote caller can fetch that range alone.
+    fn locate_preview(&self, header: &[u8], file_len: u64) -> Option<PreviewLocation>;
+
+    /// The embedded preview at the size asked for, falling through the ladder
+    /// to the next size where the file lacks it.
+    fn preview(&self, bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError>;
+
+    /// Sensor data, for develop and export. The expensive path.
+    fn decode(&self, bytes: &[u8]) -> Result<RawImage, DecodeError>;
+}
+
+/// TRACES: FR-RAW-2
+/// The decoder the application ships: rawler for sensor data and the
+/// previews it knows, DarkRoom's own container walk for headers and ranges.
+///
+/// Its methods are the crate's free functions, unchanged. They stay public
+/// for the tools and examples that read one file and have no caller to keep
+/// decoder-agnostic.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct Rawler;
+
+impl Decoder for Rawler {
+    fn header_bytes(&self) -> u64 {
+        crate::HEADER_BYTES
+    }
+
+    fn metadata(&self, bytes: &[u8]) -> Result<Metadata, DecodeError> {
+        crate::metadata(bytes)
+    }
+
+    fn orientation(&self, header: &[u8]) -> Option<Orientation> {
+        crate::orientation(header)
+    }
+
+    fn locate_preview(&self, header: &[u8], file_len: u64) -> Option<PreviewLocation> {
+        crate::locate_preview(header, file_len)
+    }
+
+    fn preview(&self, bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError> {
+        crate::extract_preview(bytes, size)
+    }
+
+    fn decode(&self, bytes: &[u8]) -> Result<RawImage, DecodeError> {
+        crate::decode(bytes)
+    }
+}
+
+/// TRACES: FR-RAW-2
+/// The decoder a job uses unless it was handed another.
+///
+/// Named by the places that start work — a thread, a UI handler — and by
+/// nothing below them. Returning `&'static dyn Decoder` rather than `Rawler`
+/// is the point: a caller that only has this cannot reach past the trait.
+pub fn default() -> &'static dyn Decoder {
+    static RAWLER: Rawler = Rawler;
+    &RAWLER
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The default is the shipped decoder, reached through the trait: same
+    /// header budget, and the same answer to bytes neither can read.
+    #[test]
+    fn the_default_is_rawler_behind_the_trait() {
+        let d = default();
+        assert_eq!(d.header_bytes(), crate::HEADER_BYTES);
+        let junk = [0u8; 64];
+        assert_eq!(d.metadata(&junk).is_err(), crate::metadata(&junk).is_err());
+        assert!(d.decode(&junk).is_err());
+        assert_eq!(d.orientation(&junk), crate::orientation(&junk));
+    }
+}
@@ -25,6 +25,42 @@ pub enum DecodeError {
    CorruptPreview(String),
 }

+/// Run a decoder call, and return a panic inside it as an error.
+///
+/// TRACES: FR-RAW-4 | NFR-SEC-1 | NFR-R3
+/// rawler `panic!`s on some malformed input rather than returning `Err` — a
+/// DNG whose IFD claims a >50000 px image, for one, which is in the reference
+/// library. A panic on a worker thread ends the thread: the face sweep that
+/// met that file stopped 13 seconds in, three sweeps running, with "17301
+/// image(s) to index" as the last word and nothing to say why. FR-RAW-4's
+/// rule — a malformed file must not abort a batch — is this crate's to keep
+/// whatever the library beneath it does, so every entry point that calls into
+/// rawler runs through here, and a file that panics the decoder is one failed
+/// file like any other.
+///
+/// The crash hook still records the panic, because it runs before unwinding
+/// reaches this frame; that is right — it is a real defect in a dependency
+/// and the record is how it gets reported upstream — and a repeat is the same
+/// file being met again rather than a new fault.
+pub(crate) fn guarded<T>(
+    what: &'static str,
+    f: impl FnOnce() -> Result<T, DecodeError>,
+) -> Result<T, DecodeError> {
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)) {
+        Ok(result) => result,
+        Err(payload) => {
+            let msg = payload
+                .downcast_ref::<&str>()
+                .map(|s| s.to_string())
+                .or_else(|| payload.downcast_ref::<String>().cloned())
+                .unwrap_or_else(|| "no message".to_string());
+            Err(DecodeError::Decode(format!(
+                "{what}: the decoder panicked on this file: {msg}"
+            )))
+        }
+    }
+}
+
 impl DecodeError {
    /// Whether a fallback path might still produce an image.
    ///
@@ -49,4 +85,28 @@ mod tests {
        // A genuinely unsupported file has nowhere to fall through to.
        assert!(!DecodeError::Unsupported("unknown".into()).has_fallback());
    }
+
+    #[test]
+    fn a_panic_in_the_decoder_is_an_error_and_the_thread_survives() {
+        // The property the face sweep relies on: one file that panics rawler
+        // is one failed file, not the end of the pass. The message travels,
+        // because "decode failed" alone sends the reader to the crash log.
+        let err = guarded("decode", || -> Result<(), DecodeError> {
+            panic!("rawler: surely there's no such thing as a {}MP image!", 600)
+        })
+        .unwrap_err();
+        let text = err.to_string();
+        assert!(text.contains("panicked"), "{text}");
+        assert!(text.contains("600MP"), "{text}");
+        assert!(!err.has_fallback(), "a panic is not a missing preview");
+    }
+
+    #[test]
+    fn a_result_passes_through_untouched() {
+        assert_eq!(guarded("decode", || Ok::<_, DecodeError>(7)).unwrap(), 7);
+        assert!(matches!(
+            guarded("decode", || Err::<(), _>(DecodeError::NoPreview)),
+            Err(DecodeError::NoPreview)
+        ));
+    }
 }
@@ -11,14 +11,18 @@
 //!
 //! Fusing them would force a full decode where a header read suffices, which
 //! is exactly why Lightroom stalls ~2 s per image during culling.
+//!
+//! Callers reach these through the [`Decoder`] trait rather than by name, so a
+//! second decoder can be put behind them without changing any of them
+//! (FR-RAW-2). [`Rawler`] is the one that ships; [`default`] hands it out.

-pub mod base_curve;
+mod decoder;
 mod error;
 mod locate;
 mod preview;
 pub mod profile;

-pub use base_curve::BaseCurve;
+pub use decoder::{default, Decoder, Rawler};
 pub use error::DecodeError;
 pub use locate::{
    defects, is_complete_jpeg, jpeg_metadata, locate_preview, tiff_metadata, BadLine, BadPixel,
@@ -119,21 +123,24 @@ pub struct RawImage {
    /// for the light the frame was shot under; see [`profile::CameraProfile`].
    pub color_matrix: Option<[f32; 9]>,
    /// TRACES: FR-DEV-3e
-    /// The per-body rendering curve, the other half of the camera profile.
-    ///
-    /// The matrix above decides what the colours *are*; this decides what the
-    /// picture looks like. Carried on the decoded image rather than looked up
-    /// downstream because this is the only point in the system that knows
-    /// which body took the frame, and because it is not an edit: it belongs to
-    /// the file in the same way the masked-photosite crop does, and must never
-    /// reach a sidecar (FR-NC-9).
-    ///
-    /// [`BaseCurve::IDENTITY`] for an unknown body with no default in the
-    /// database, which renders exactly as this decoder did before profiles
-    /// existed.
-    pub base_curve: BaseCurve,
    /// The usable region of `data`, excluding masked and border photosites.
    pub crop: CropRect,
+    /// TRACES: FR-MRG-3
+    /// Samples per photosite in `data`: 1 for a colour-filter-array capture,
+    /// 3 for a *linear* DNG — demosaiced RGB, still camera-space, which is
+    /// what a merge writes. With 3, `cfa_pattern` means nothing, `data` is
+    /// `width × height × 3` interleaved, and the GPU uploads it as it is
+    /// rather than demosaicing.
+    pub samples_per_pixel: u8,
+    /// TRACES: FR-MRG-3
+    /// The body's colour profile as the file carried it, for a composite to
+    /// carry on: calibrations and the as-shot neutral. `None` for a body the
+    /// decoder has no matrix for.
+    pub profile: Option<profile::CameraProfile>,
+    /// The body, as rawler cleans the names: what `Make`/`Model` say and what
+    /// the base-curve database matches on.
+    pub make: String,
+    pub model: String,
 }

 /// TRACES: FR-RAW-3
@@ -285,6 +292,30 @@ pub fn probe(header: &[u8]) -> Option<Format> {
 /// TRACES: FR-CAT-5 | M-12
 /// Read capture metadata without decoding sensor data.
 pub fn metadata(bytes: &[u8]) -> Result<Metadata, DecodeError> {
+    error::guarded("metadata", || metadata_unguarded(bytes))
+}
+
+/// TRACES: FR-CAT-5
+/// Where a TIFF-shaped file keeps its first IFD, when the head handed to
+/// [`metadata`] does not reach it — the linear DNG a merge writes puts its
+/// IFDs after the pixels, and rawler, given the head alone, finds no
+/// decoder in it. The caller fetches from this offset to the end and
+/// reads the two ranges with [`metadata_split`].
+pub fn trailing_ifd(head: &[u8]) -> Option<u64> {
+    locate::trailing_ifd(head)
+}
+
+/// TRACES: FR-CAT-5
+/// [`metadata`] for a file read in two ranges: `head` from offset 0 and
+/// `tail` from `tail_at`. The EXIF sub-IFD such a file wrote before its
+/// pixels is in the head; the first IFD and its values are in the tail.
+pub fn metadata_split(head: &[u8], tail: &[u8], tail_at: u64) -> Result<Metadata, DecodeError> {
+    error::guarded("metadata", || {
+        locate::tiff_metadata_split(head, tail, tail_at)
+    })
+}
+
+fn metadata_unguarded(bytes: &[u8]) -> Result<Metadata, DecodeError> {
    use rawler::rawsource::RawSource;

    // rawler has no decoder for a plain JPEG, so without this every JPEG in a
@@ -510,6 +541,10 @@ pub(crate) fn parse_exif_offset(s: &str) -> Option<i32> {
 /// Only develop and export should call it; culling and the grid must not
 /// (FR-CULL-1).
 pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
+    error::guarded("decode", || decode_unguarded(bytes))
+}
+
+fn decode_unguarded(bytes: &[u8]) -> Result<RawImage, DecodeError> {
    use rawler::rawsource::RawSource;

    let source = RawSource::new_from_slice(bytes);
@@ -542,14 +577,20 @@ pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
        profile.as_ref().map(|p| p.xyz_to_cam()).as_ref(),
    );

-    // The rendering half of the profile (FR-DEV-3e). rawler's cleaned strings
-    // are preferred where it has them — they are what the shipped database is
-    // written against — and the matching folds the variants either way, so a
-    // DNG naming the same body differently still finds its curve.
-    let base_curve = base_curve::for_body(
-        image.camera.clean_make.as_str(),
-        image.camera.clean_model.as_str(),
-    );
+    // TRACES: FR-MRG-3
+    // A linear DNG — three samples per pixel, no colour filter array — is a
+    // composite this application wrote (or any other demosaiced DNG). It
+    // carries the same scale, matrices and neutral as a CFA file and goes
+    // through the same profile; only the demosaic is skipped.
+    let samples_per_pixel = match image.cpp {
+        1 => 1u8,
+        3 => 3,
+        other => {
+            return Err(DecodeError::Unsupported(format!(
+                "{other} samples per pixel; only CFA (1) and linear RGB (3) are handled"
+            )))
+        }
+    };

    let data = match image.data {
        rawler::RawImageData::Integer(v) => v,
@@ -618,7 +659,10 @@ pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
            .unwrap_or(u16::MAX),
        wb_coeffs,
        color_matrix,
-        base_curve,
+        samples_per_pixel,
+        profile,
+        make: image.camera.clean_make.clone(),
+        model: image.camera.clean_model.clone(),
    })
 }

@@ -183,22 +183,65 @@ struct Entry {
    value: u32,
 }

+/// The bytes a [`TiffReader`] reads: the head of a file, and optionally a
+/// second range from further in, at a known offset.
+///
+/// A camera writes its IFDs at the front, so the first 256 KB of a file
+/// is the whole structure. A file written strip by strip — the linear
+/// DNG a merge produces — has its first IFD at the *end*, after the
+/// pixels, and a reader that only has the head sees a pointer into
+/// nothing. Rather than fetch 800 MB to read a date, the caller fetches
+/// the head, asks [`crate::trailing_ifd`] where the IFD is, fetches that
+/// tail, and reads through both. Offsets are the file's own throughout;
+/// a read that falls in neither range is simply absent.
+#[derive(Clone, Copy)]
+struct Src<'a> {
+    head: &'a [u8],
+    tail: &'a [u8],
+    /// Where `tail` starts in the file.
+    tail_at: usize,
+}
+
+impl<'a> Src<'a> {
+    fn whole(data: &'a [u8]) -> Self {
+        Src {
+            head: data,
+            tail: &[],
+            tail_at: 0,
+        }
+    }
+
+    fn get(&self, start: usize, len: usize) -> Option<&'a [u8]> {
+        let end = start.checked_add(len)?;
+        if let Some(b) = self.head.get(start..end) {
+            return Some(b);
+        }
+        let s = start.checked_sub(self.tail_at)?;
+        self.tail.get(s..s.checked_add(len)?)
+    }
+}
+
 /// A minimal TIFF structure reader.
 ///
 /// Deliberately not a general TIFF parser: it reads the IFD chain and entry
 /// values and nothing else, because that is all locating a preview needs.
 struct TiffReader<'a> {
-    data: &'a [u8],
+    data: Src<'a>,
    little_endian: bool,
    first_ifd: u32,
 }

 impl<'a> TiffReader<'a> {
    fn new(data: &'a [u8]) -> Option<Self> {
-        if data.len() < 8 {
+        Self::over(Src::whole(data))
+    }
+
+    fn over(data: Src<'a>) -> Option<Self> {
+        let head = data.head;
+        if head.len() < 8 {
            return None;
        }
-        let little_endian = match &data[0..2] {
+        let little_endian = match &head[0..2] {
            b"II" => true,
            b"MM" => false,
            _ => return None,
@@ -362,9 +405,7 @@ impl<'a> TiffReader<'a> {
            };
            raw[..len.min(4)].to_vec()
        } else {
-            self.data
-                .get(e.value as usize..e.value as usize + len)?
-                .to_vec()
+            self.data.get(e.value as usize, len)?.to_vec()
        };

        let s = String::from_utf8_lossy(&bytes);
@@ -396,8 +437,7 @@ impl<'a> TiffReader<'a> {
            // same way to recover the original byte order.
            return None;
        }
-        let start = e.value as usize;
-        self.data.get(start..start.checked_add(len)?)
+        self.data.get(e.value as usize, len)
    }

    fn offsets(&self, e: &Entry) -> Vec<u32> {
@@ -420,8 +460,8 @@ impl<'a> TiffReader<'a> {
    }
 }

-fn read_u16(data: &[u8], at: usize, le: bool) -> Option<u16> {
-    let b = data.get(at..at + 2)?;
+fn read_u16(data: Src<'_>, at: usize, le: bool) -> Option<u16> {
+    let b = data.get(at, 2)?;
    Some(if le {
        u16::from_le_bytes([b[0], b[1]])
    } else {
@@ -429,8 +469,8 @@ fn read_u16(data: &[u8], at: usize, le: bool) -> Option<u16> {
    })
 }

-fn read_u32(data: &[u8], at: usize, le: bool) -> Option<u32> {
-    let b = data.get(at..at + 4)?;
+fn read_u32(data: Src<'_>, at: usize, le: bool) -> Option<u32> {
+    let b = data.get(at, 4)?;
    Some(if le {
        u32::from_le_bytes([b[0], b[1], b[2], b[3]])
    } else {
@@ -460,7 +500,36 @@ pub fn jpeg_metadata(bytes: &[u8]) -> Result<crate::Metadata, crate::DecodeError
 /// no `DateTimeOriginal` for some DNGs whose tag sits plainly at byte 826 —
 /// and without this fallback those images are silently undated.
 pub fn tiff_metadata(tiff_data: &[u8]) -> Result<crate::Metadata, crate::DecodeError> {
-    let reader = TiffReader::new(tiff_data)
+    tiff_metadata_over(Src::whole(tiff_data))
+}
+
+/// Where a TIFF-shaped file's first IFD is, when the head does not reach
+/// it: the offset to fetch from, so [`tiff_metadata_split`] can read it.
+/// `None` for a file that is not TIFF, or whose IFD the head already holds.
+pub fn trailing_ifd(head: &[u8]) -> Option<u64> {
+    let r = TiffReader::new(head)?;
+    let at = r.first_ifd as u64;
+    (at >= head.len() as u64).then_some(at)
+}
+
+/// [`tiff_metadata`] over a head and a tail fetched separately: the head
+/// from offset 0, the tail from `tail_at`. For the file whose IFDs follow
+/// its pixels.
+pub fn tiff_metadata_split(
+    head: &[u8],
+    tail: &[u8],
+    tail_at: u64,
+) -> Result<crate::Metadata, crate::DecodeError> {
+    tiff_metadata_over(Src {
+        head,
+        tail,
+        tail_at: usize::try_from(tail_at)
+            .map_err(|_| crate::DecodeError::Metadata("tail offset out of range".into()))?,
+    })
+}
+
+fn tiff_metadata_over(src: Src<'_>) -> Result<crate::Metadata, crate::DecodeError> {
+    let reader = TiffReader::over(src)
        .ok_or_else(|| crate::DecodeError::Metadata("malformed EXIF header".into()))?;

    let mut md = crate::Metadata::default();
@@ -158,6 +158,10 @@ pub enum PreviewSize {
 /// Returns [`DecodeError::NoPreview`] where there is none at all: a
 /// fall-through signal, not a failure (see [`DecodeError::has_fallback`]).
 pub fn extract_preview(bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError> {
+    crate::error::guarded("preview", || extract_preview_unguarded(bytes, size))
+}
+
+fn extract_preview_unguarded(bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError> {
    use rawler::rawsource::RawSource;

    // A plain JPEG *is* its own preview — rawler has no decoder for one, and
@@ -6,8 +6,10 @@
 //! colour needs two things the file cannot supply on its own: a **matrix**
 //! saying how this sensor's three responses relate to the CIE observer, and a
 //! **rendering** saying what to do with the resulting scene-referred values so
-//! that a photograph looks like a photograph. This module supplies the first
-//! and looks up the second ([`crate::base_curve`]).
+//! that a photograph looks like a photograph. This module supplies the first.
+//! The second is not the body's: since D19 it is the pipeline's view
+//! transform (FR-DEV-3j), one for every camera, and the per-body base curves
+//! that used to be looked up here are retired.
 //!
 //! # What is extracted, and from where
 //!
@@ -65,8 +67,8 @@
 //! FR-DEV-3e defers full `.dcp` support — `HueSatDeltas` and
 //! `ProfileLookTable` — and requires that they arrive as *additions* rather
 //! than as a pipeline reordering. They would: both are lookups applied to a
-//! colour after this matrix and before, or alongside, the base curve, so they
-//! extend [`CameraProfile`] with more calibration data and extend the shader's
+//! colour at this matrix, before any edit reaches it, so they extend
+//! [`CameraProfile`] with more calibration data and extend the shader's
 //! camera-profile stage with more work. Nothing above would move.

 use crate::{cam_to_srgb_from, invert3};
@@ -392,6 +394,21 @@ impl CameraProfile {
    }

    /// The calibrations this profile was built from, coolest first.
+    /// TRACES: FR-MRG-3
+    /// The calibrations as a DNG carries them: `(CalibrationIlluminant,
+    /// ColorMatrix)` with the EXIF light-source code, for a composite to
+    /// write the profile of the body that took its sources.
+    ///
+    /// The code is recovered from the temperature, which is lossy only for
+    /// illuminants this profile never kept: `extract` drops calibrations
+    /// whose illuminant has no temperature, so every one here maps back.
+    pub fn dng_calibrations(&self) -> Vec<(u16, [[f32; 3]; 3])> {
+        self.calibrations
+            .iter()
+            .map(|c| (illuminant_code(c.temperature), c.xyz_to_cam))
+            .collect()
+    }
+
    pub fn calibrations(&self) -> &[Calibration] {
        &self.calibrations
    }
@@ -528,6 +545,39 @@ fn illuminant_temperature(illuminant: Illuminant) -> Option<f32> {
    })
 }

+/// The EXIF `LightSource` code for a calibration temperature — the inverse
+/// of [`illuminant_temperature`], on the temperatures it produces.
+fn illuminant_code(temperature: f32) -> u16 {
+    // Nearest of the table, so a temperature that came through a float
+    // round-trip still lands on its illuminant. Where two illuminants share
+    // a temperature (D55 and Daylight, D65 and Cloudy, D75 and Shade) the
+    // CIE standard one is written: it is what every profile database means.
+    const TABLE: &[(f32, u16)] = &[
+        (2856.0, 17), // A
+        (3200.0, 24), // ISO studio tungsten
+        (3500.0, 15), // white fluorescent
+        (4150.0, 14), // cool white fluorescent
+        (4230.0, 2),  // fluorescent
+        (4874.0, 18), // B
+        (5000.0, 13), // daylight white fluorescent
+        (5003.0, 23), // D50
+        (5503.0, 20), // D55
+        (6430.0, 12), // daylight fluorescent
+        (6504.0, 21), // D65
+        (6774.0, 19), // C
+        (7504.0, 22), // D75
+    ];
+    TABLE
+        .iter()
+        .min_by(|a, b| {
+            (a.0 - temperature)
+                .abs()
+                .total_cmp(&(b.0 - temperature).abs())
+        })
+        .map(|(_, code)| *code)
+        .unwrap_or(255)
+}
+
 /// Compose a forward matrix into camera RGB → linear sRGB.
 ///
 /// `forward` takes white-balanced camera RGB to XYZ under D50, which is the
@@ -38,4 +38,7 @@ dr-gpu.workspace = true
 dr-pipeline.workspace = true
 env_logger.workspace = true
 pollster.workspace = true
+# The DNG writer's test reads its output back through the decoder the
+# library uses, which is the whole claim the writer makes (S15.1).
+rawler.workspace = true
 zune-jpeg.workspace = true
@@ -0,0 +1,351 @@
+//! TRACES: FR-MRG-3
+//! A linear DNG: the container a merge writes its composite into.
+//!
+//! Decided by S15.1 (2026-09-19): rawler reads back a `LinearRaw` DNG the
+//! application writes, so a composite re-enters the library as
+//! `Format::Dng` through the decoder every camera DNG uses. What is written
+//! is a RAW in every sense a warp can preserve — camera-linear `u16`
+//! samples at the first source's own scale, its matrices, illuminants,
+//! as-shot neutral and body name — so the panorama is developed afterwards
+//! as one photograph, from the sensor's numbers.
+//!
+//! # Streamed, not buffered
+//!
+//! The composite is larger than any single photograph the pipeline renders
+//! and larger than the tablet's memory (FR-MRG-11), so the writer never
+//! holds it. Strips are pulled from the caller one at a time through a
+//! closure, in order, and written as they arrive; the caller renders a band
+//! of chunks, hands over its rows, and moves on.
+//!
+//! # Why the `tiff` crate after all
+//!
+//! S15.1's spike hand-rolled its IFD because the crate's encoder fixes
+//! `PhotometricInterpretation` to RGB when the image is opened. It does — but
+//! a directory is a map and a later `write_tag` on the same tag replaces the
+//! earlier, so `LinearRaw` goes in over the top and everything else the
+//! crate does (strips, offsets, sub-IFDs, the EXIF block `encode.rs` already
+//! knows how to write) is kept.
+
+use std::io::{Seek, Write};
+
+use tiff::encoder::{colortype, DirectoryEncoder, SRational, TiffEncoder, TiffKind, TiffValue};
+use tiff::tags::Tag;
+
+use crate::encode::{sub_directories, tag_metadata, Ascii, Rationals};
+use crate::{ExportError, SourceMetadata};
+
+/// What the DNG says about the camera that "took" the composite: the first
+/// source's profile, carried across so the composite develops through it.
+#[derive(Debug, Clone, PartialEq)]
+pub struct DngProfile {
+    /// `UniqueCameraModel`, the name the profile database matches on.
+    pub unique_model: String,
+    /// `(CalibrationIlluminant, ColorMatrix)`: the EXIF light-source code and
+    /// the XYZ → camera matrix measured under it. One or two.
+    pub calibrations: Vec<(u16, [[f32; 3]; 3])>,
+    /// `AsShotNeutral`, camera RGB of the scene's white.
+    pub as_shot_neutral: [f32; 3],
+    /// `WhiteLevel`: the sample value that is clipping. The first source's
+    /// white minus its black, since the samples are black-subtracted.
+    pub white_level: u32,
+}
+
+/// Write a linear DNG, pulling `rows_per_strip`-row strips from `strips`.
+///
+/// Each call to `strips` receives the strip index and a buffer to fill with
+/// `width × rows × 3` interleaved RGB `u16` samples (the last strip may be
+/// shorter). `source` supplies the `Make`, `Model`, dates and EXIF block
+/// exactly as an export does (FR-EXP-8 sanitising already applied by the
+/// caller).
+///
+/// `PhotometricInterpretation = LinearRaw`, `DNGVersion 1.4`, uncompressed,
+/// `Orientation = 1` — the composite is written upright (panorama.md §8).
+///
+/// `crop` is asked once every strip is in, and its answer — the largest
+/// rectangle the frames covered, found while the strips went by
+/// (`Inscribed`) — becomes `DefaultCropOrigin`/`DefaultCropSize`
+/// (FR-MRG-4): the file opens on the picture, and the border is still in it.
+// Eight arguments, and each is a different thing: the sink, three
+// dimensions, the profile, the header, the strip source and the crop. A
+// struct for them would be a struct with one caller.
+#[allow(clippy::too_many_arguments)]
+pub fn write_linear_dng<W, F, C>(
+    out: W,
+    width: u32,
+    height: u32,
+    rows_per_strip: u32,
+    profile: &DngProfile,
+    source: Option<&SourceMetadata>,
+    mut strips: F,
+    crop: C,
+) -> Result<(), ExportError>
+where
+    W: Write + Seek,
+    F: FnMut(usize, &mut Vec<u16>) -> Result<(), ExportError>,
+    C: FnOnce() -> Option<crate::Rect>,
+{
+    let enc = |e: tiff::TiffError| ExportError::Encode(e.to_string());
+    let mut encoder = TiffEncoder::new(out).map_err(enc)?;
+    let sub = sub_directories(&mut encoder, source, width, height)?;
+    let mut image = encoder
+        .new_image::<colortype::RGB16>(width, height)
+        .map_err(enc)?;
+    image.rows_per_strip(rows_per_strip.max(1)).map_err(enc)?;
+    tag_metadata(image.encoder(), source, &sub)?;
+    tag_dng(image.encoder(), profile).map_err(enc)?;
+
+    let rows = rows_per_strip.max(1);
+    let strip_count = height.div_ceil(rows) as usize;
+    let mut buf: Vec<u16> = Vec::with_capacity((width * rows * 3) as usize);
+    for k in 0..strip_count {
+        buf.clear();
+        strips(k, &mut buf)?;
+        let expected_rows = rows.min(height - k as u32 * rows);
+        let expected = (width * expected_rows * 3) as usize;
+        if buf.len() != expected {
+            return Err(ExportError::Encode(format!(
+                "strip {k} has {} samples, expected {expected}",
+                buf.len()
+            )));
+        }
+        image.write_strip(&buf).map_err(enc)?;
+    }
+    if let Some(r) = crop().filter(|r| r.width > 0 && r.height > 0) {
+        let r = crate::Rect {
+            x: r.x.min(width - 1),
+            y: r.y.min(height - 1),
+            width: r.width.min(width - r.x.min(width - 1)),
+            height: r.height.min(height - r.y.min(height - 1)),
+        };
+        image
+            .encoder()
+            .write_tag(Tag::Unknown(tag::DEFAULT_CROP_ORIGIN), &[r.x, r.y][..])
+            .map_err(enc)?;
+        image
+            .encoder()
+            .write_tag(
+                Tag::Unknown(tag::DEFAULT_CROP_SIZE),
+                &[r.width, r.height][..],
+            )
+            .map_err(enc)?;
+    }
+    image.finish().map_err(enc)
+}
+
+/// The tags that make a TIFF a DNG, and a linear one.
+fn tag_dng<W, K>(dir: &mut DirectoryEncoder<'_, W, K>, profile: &DngProfile) -> tiff::TiffResult<()>
+where
+    W: Write + Seek,
+    K: TiffKind,
+{
+    // Over the top of what `new_image` wrote: this is the whole trick.
+    dir.write_tag(Tag::PhotometricInterpretation, LINEAR_RAW)?;
+    dir.write_tag(Tag::Orientation, 1u16)?;
+    dir.write_tag(Tag::Unknown(tag::DNG_VERSION), &[1u8, 4, 0, 0][..])?;
+    dir.write_tag(Tag::Unknown(tag::DNG_BACKWARD_VERSION), &[1u8, 4, 0, 0][..])?;
+    dir.write_tag(
+        Tag::Unknown(tag::UNIQUE_CAMERA_MODEL),
+        Ascii(&profile.unique_model),
+    )?;
+    dir.write_tag(
+        Tag::Unknown(tag::WHITE_LEVEL),
+        &[profile.white_level; 3][..],
+    )?;
+    dir.write_tag(Tag::Unknown(tag::BLACK_LEVEL), &[0u32; 3][..])?;
+
+    for (slot, (illuminant, matrix)) in profile.calibrations.iter().take(2).enumerate() {
+        let (ill_tag, mat_tag) = if slot == 0 {
+            (tag::CALIBRATION_ILLUMINANT_1, tag::COLOR_MATRIX_1)
+        } else {
+            (tag::CALIBRATION_ILLUMINANT_2, tag::COLOR_MATRIX_2)
+        };
+        dir.write_tag(Tag::Unknown(ill_tag), *illuminant)?;
+        let flat: Vec<SRational> = matrix
+            .iter()
+            .flatten()
+            .map(|&v| SRational {
+                n: (v * 10_000.0).round() as i32,
+                d: 10_000,
+            })
+            .collect();
+        dir.write_tag(Tag::Unknown(mat_tag), SRationals(&flat))?;
+    }
+
+    let neutral: Vec<(u32, u32)> = profile
+        .as_shot_neutral
+        .iter()
+        .map(|&v| ((v.max(0.0) * 1_000_000.0).round() as u32, 1_000_000))
+        .collect();
+    dir.write_tag(Tag::Unknown(tag::AS_SHOT_NEUTRAL), Rationals(&neutral))?;
+    Ok(())
+}
+
+/// `PhotometricInterpretation` for demosaiced, un-rendered sensor data.
+const LINEAR_RAW: u16 = 34892;
+
+/// DNG tag numbers the `tiff` crate has no names for.
+mod tag {
+    pub const DNG_VERSION: u16 = 50706;
+    pub const DNG_BACKWARD_VERSION: u16 = 50707;
+    pub const UNIQUE_CAMERA_MODEL: u16 = 50708;
+    pub const BLACK_LEVEL: u16 = 50714;
+    pub const WHITE_LEVEL: u16 = 50717;
+    pub const DEFAULT_CROP_ORIGIN: u16 = 50719;
+    pub const DEFAULT_CROP_SIZE: u16 = 50720;
+    pub const COLOR_MATRIX_1: u16 = 50721;
+    pub const COLOR_MATRIX_2: u16 = 50722;
+    pub const AS_SHOT_NEUTRAL: u16 = 50728;
+    pub const CALIBRATION_ILLUMINANT_1: u16 = 50778;
+    pub const CALIBRATION_ILLUMINANT_2: u16 = 50779;
+}
+
+/// A run of `SRATIONAL`s, as `encode::Rationals` is for `RATIONAL`.
+struct SRationals<'a>(&'a [SRational]);
+
+impl TiffValue for SRationals<'_> {
+    const BYTE_LEN: u8 = 8;
+    const FIELD_TYPE: tiff::tags::Type = tiff::tags::Type::SRATIONAL;
+
+    fn count(&self) -> usize {
+        self.0.len()
+    }
+
+    fn data(&self) -> std::borrow::Cow<'_, [u8]> {
+        let mut out = Vec::with_capacity(self.0.len() * 8);
+        for r in self.0 {
+            out.extend_from_slice(&r.n.to_ne_bytes());
+            out.extend_from_slice(&r.d.to_ne_bytes());
+        }
+        std::borrow::Cow::Owned(out)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn profile() -> DngProfile {
+        DngProfile {
+            unique_model: "Canon EOS 6D".into(),
+            calibrations: vec![
+                (17, [[0.8, -0.2, 0.1], [-0.3, 1.1, 0.2], [0.0, -0.1, 0.9]]),
+                (21, [[0.7, -0.1, 0.0], [-0.2, 1.0, 0.1], [0.0, -0.2, 0.8]]),
+            ],
+            as_shot_neutral: [0.5, 1.0, 0.6],
+            white_level: 13_023,
+        }
+    }
+
+    fn write(width: u32, height: u32, rows: u32) -> Vec<u8> {
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        let source = SourceMetadata {
+            make: Some("Canon".into()),
+            model: Some("Canon EOS 6D".into()),
+            captured_at: Some(1_754_398_664),
+            captured_offset: Some(120),
+            ..Default::default()
+        };
+        write_linear_dng(
+            &mut bytes,
+            width,
+            height,
+            rows,
+            &profile(),
+            Some(&source),
+            |k, buf| {
+                let first = k as u32 * rows;
+                let n = rows.min(height - first);
+                for y in first..first + n {
+                    for x in 0..width {
+                        buf.extend([(x + y * width) as u16, 1000, 2000]);
+                    }
+                }
+                Ok(())
+            },
+            || {
+                Some(crate::Rect {
+                    x: 2,
+                    y: 1,
+                    width: 15,
+                    height: 10,
+                })
+            },
+        )
+        .expect("written");
+        bytes.into_inner()
+    }
+
+    #[test]
+    fn rawler_reads_it_back_as_linear_raw() {
+        let bytes = write(20, 13, 4);
+        let source = rawler::rawsource::RawSource::new_from_slice(&bytes);
+        let decoder = rawler::get_decoder(&source).expect("a DNG");
+        let image = decoder
+            .raw_image(&source, &Default::default(), false)
+            .expect("decodes");
+        assert_eq!((image.width, image.height, image.cpp), (20, 13, 3));
+        assert_eq!(image.whitelevel.0[0], 13_023);
+        // Pixel (3, 2) is (3 + 2·20, 1000, 2000) — samples in order, strips
+        // joined without a seam.
+        let rawler::RawImageData::Integer(data) = &image.data else {
+            panic!("integer samples")
+        };
+        let i = (2 * 20 + 3) * 3;
+        assert_eq!(&data[i..i + 3], &[43, 1000, 2000]);
+        // Last row, from the short final strip.
+        let i = (12 * 20 + 19) * 3;
+        assert_eq!(data[i], (19 + 12 * 20) as u16);
+        // The profile came through as the camera's.
+        assert!(!image.camera.color_matrix.is_empty());
+        assert_eq!(image.model, "Canon EOS 6D");
+        // The default crop is what the decoder reports as the picture.
+        let crop = image.crop_area.expect("a crop");
+        assert_eq!((crop.p.x, crop.p.y, crop.d.w, crop.d.h), (2, 1, 15, 10));
+    }
+
+    #[test]
+    fn the_catalog_reads_the_date_from_a_head_and_a_tail() {
+        // TRACES: FR-CAT-5
+        // The IFDs follow the pixels, so a scan that has the first bytes of
+        // the file has a pointer into nothing; rawler finds no decoder in
+        // that, and the composite would sit undated at the end of the grid.
+        // The scan's second range — from the first IFD to the end — with
+        // the head is enough to date it, and to name the camera.
+        let bytes = write(640, 400, 64);
+        let head = &bytes[..4096];
+        assert!(
+            dr_decode::metadata(head).is_err(),
+            "the head alone must not read"
+        );
+        let at = dr_decode::trailing_ifd(head).expect("the IFD is beyond the head");
+        assert!(at as usize > head.len());
+        let tail = &bytes[at as usize..];
+        assert!(tail.len() < 4096, "the tail is the IFD, not the pixels");
+        let md = dr_decode::metadata_split(head, tail, at).expect("read from two ranges");
+        assert_eq!(md.captured_at, Some(1_754_398_664));
+        assert_eq!(md.captured_offset, Some(120));
+        assert_eq!(md.model.as_deref(), Some("Canon EOS 6D"));
+        // A head that holds everything is not a trailing-IFD file.
+        assert_eq!(dr_decode::trailing_ifd(&bytes), None);
+    }
+
+    #[test]
+    fn a_strip_of_the_wrong_length_is_refused() {
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        let err = write_linear_dng(
+            &mut bytes,
+            8,
+            8,
+            8,
+            &profile(),
+            None,
+            |_, buf| {
+                buf.extend([0u16; 10]);
+                Ok(())
+            },
+            || None,
+        )
+        .unwrap_err();
+        assert!(matches!(err, ExportError::Encode(_)));
+    }
+}
@@ -213,7 +213,7 @@ impl tiff::encoder::TiffValue for Undefined<'_> {
 /// specification says, `dr-decode` reads them back with `from_utf8_lossy`, and
 /// a mangled accent is a far better outcome than a refusal. So the bytes go
 /// through verbatim with the terminating NUL the type requires.
-struct Ascii<'a>(&'a str);
+pub(crate) struct Ascii<'a>(pub(crate) &'a str);

 impl tiff::encoder::TiffValue for Ascii<'_> {
    const BYTE_LEN: u8 = 1;
@@ -241,7 +241,7 @@ impl tiff::encoder::TiffValue for Ascii<'_> {
 /// a value that forced little-endian would be read back byte-swapped on a
 /// big-endian machine. `exif.rs` builds its own header and so chooses its own
 /// order; here the container has already chosen.
-struct Rationals<'a>(&'a [(u32, u32)]);
+pub(crate) struct Rationals<'a>(pub(crate) &'a [(u32, u32)]);

 impl tiff::encoder::TiffValue for Rationals<'_> {
    const BYTE_LEN: u8 = 8;
@@ -317,7 +317,7 @@ where
 /// and then no pointer is written either, so the file has no trace of the
 /// directory rather than a pointer to an empty one.
 #[derive(Default)]
-struct SubDirectories {
+pub(crate) struct SubDirectories {
    exif: Option<u32>,
    gps: Option<u32>,
 }
@@ -335,7 +335,7 @@ struct SubDirectories {
 /// A TIFF gets no separate EXIF *block* — no APP1, no `eXIf` chunk. Its own
 /// directory is the EXIF structure, and adding a second copy inside it would
 /// give a reader two answers to every question.
-fn sub_directories<W>(
+pub(crate) fn sub_directories<W>(
    encoder: &mut tiff::encoder::TiffEncoder<W>,
    source: Option<&SourceMetadata>,
    width: u32,
@@ -465,7 +465,7 @@ where
 ///
 /// No `Orientation`, for the reason `exif.rs` gives at length: the pixels
 /// arriving here are already upright.
-fn tag_metadata<W, K>(
+pub(crate) fn tag_metadata<W, K>(
    dir: &mut tiff::encoder::DirectoryEncoder<'_, W, K>,
    source: Option<&SourceMetadata>,
    sub: &SubDirectories,
@@ -0,0 +1,156 @@
+//! TRACES: FR-MRG-4
+//! The largest rectangle inside a coverage mask, found a row at a time.
+//!
+//! A merged panorama has ragged edges: the frames' footprints under a
+//! cylinder or a sphere are not rectangles, and the composite carries a
+//! black border where none of them reached. FR-MRG-4 asks for an auto-crop
+//! to the largest inscribed rectangle. This finds it as the bands are
+//! produced, so the composite is never held to be measured (FR-MRG-11):
+//! each row extends a running histogram of consecutive covered rows above
+//! it, and the largest rectangle ending on that row is the largest
+//! rectangle under the histogram — a stack pass, linear in the width.
+//!
+//! The crop is written as the DNG's `DefaultCropOrigin`/`DefaultCropSize`,
+//! which every reader honours and which discards nothing: the pixels
+//! outside it are still in the file for a photographer who wants them.
+
+/// The rectangle so far, in pixels from the top left.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct Rect {
+    pub x: u32,
+    pub y: u32,
+    pub width: u32,
+    pub height: u32,
+}
+
+impl Rect {
+    pub fn area(&self) -> u64 {
+        u64::from(self.width) * u64::from(self.height)
+    }
+}
+
+/// Feed rows top to bottom; ask for the best at any point.
+#[derive(Debug, Clone)]
+pub struct Inscribed {
+    width: usize,
+    /// How many consecutive covered rows end at the last row fed, per column.
+    heights: Vec<u32>,
+    rows: u32,
+    best: Rect,
+}
+
+impl Inscribed {
+    pub fn new(width: u32) -> Self {
+        Inscribed {
+            width: width as usize,
+            heights: vec![0; width as usize],
+            rows: 0,
+            best: Rect::default(),
+        }
+    }
+
+    /// One more row of coverage, `width` long.
+    pub fn push_row(&mut self, covered: &[bool]) {
+        debug_assert_eq!(covered.len(), self.width);
+        for (h, &c) in self.heights.iter_mut().zip(covered) {
+            *h = if c { *h + 1 } else { 0 };
+        }
+        self.rows += 1;
+        // Largest rectangle under the histogram, with a sentinel column of
+        // height 0 at the end so every bar is popped.
+        let mut stack: Vec<usize> = Vec::new();
+        for i in 0..=self.width {
+            let h = if i < self.width { self.heights[i] } else { 0 };
+            while let Some(&top) = stack.last() {
+                if self.heights[top] <= h {
+                    break;
+                }
+                stack.pop();
+                let height = self.heights[top];
+                let left = stack.last().map_or(0, |&l| l + 1);
+                let width = (i - left) as u32;
+                let area = u64::from(width) * u64::from(height);
+                if area > self.best.area() {
+                    self.best = Rect {
+                        x: left as u32,
+                        y: self.rows - height,
+                        width,
+                        height,
+                    };
+                }
+            }
+            stack.push(i);
+        }
+    }
+
+    /// Several rows at once, as a band hands them over.
+    pub fn push_rows(&mut self, covered: &[bool], rows: u32) {
+        for r in 0..rows as usize {
+            self.push_row(&covered[r * self.width..(r + 1) * self.width]);
+        }
+    }
+
+    pub fn best(&self) -> Rect {
+        self.best
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn from_art(art: &[&str]) -> Rect {
+        let mut ins = Inscribed::new(art[0].len() as u32);
+        for row in art {
+            let covered: Vec<bool> = row.chars().map(|c| c == '#').collect();
+            ins.push_row(&covered);
+        }
+        ins.best()
+    }
+
+    #[test]
+    fn a_full_mask_is_its_own_rectangle() {
+        let r = from_art(&["####", "####", "####"]);
+        assert_eq!(
+            r,
+            Rect {
+                x: 0,
+                y: 0,
+                width: 4,
+                height: 3
+            }
+        );
+    }
+
+    #[test]
+    fn ragged_edges_are_cut_off() {
+        // A cylinder's footprint: narrower at top and bottom.
+        let r = from_art(&[
+            "..####..", ".######.", "########", "########", ".######.", "..####..",
+        ]);
+        // 6 wide × 4 tall = 24 beats 8 × 2 = 16 and 4 × 6 = 24 ties; the
+        // first found wins a tie, which is the wider one here.
+        assert_eq!(r.area(), 24);
+        assert!(r.width == 6 && r.height == 4 || r.width == 4 && r.height == 6);
+    }
+
+    #[test]
+    fn a_hole_is_avoided() {
+        let r = from_art(&["#####", "##.##", "#####", "#####"]);
+        // Left of the hole: 2 × 4 = 8; right: 2 × 4 = 8; below: 5 × 2 = 10.
+        assert_eq!(
+            r,
+            Rect {
+                x: 0,
+                y: 2,
+                width: 5,
+                height: 2
+            }
+        );
+    }
+
+    #[test]
+    fn nothing_covered_is_nothing() {
+        assert_eq!(from_art(&["....", "...."]).area(), 0);
+    }
+}
@@ -24,16 +24,20 @@

 use dr_types::{ColourSpace, ExportFormat, ExportSettings};

+mod dng;
 mod encode;
 mod error;
 mod exif;
 pub mod icc;
+mod inscribed;
 mod metadata;
 mod name;
 mod sharpen;
 mod size;

+pub use dng::{write_linear_dng, DngProfile};
 pub use error::ExportError;
+pub use inscribed::{Inscribed, Rect};
 pub use metadata::SourceMetadata;
 pub use name::{resolve_name, NameContext};
 pub use size::target_size;
@@ -9,10 +9,11 @@ license.workspace = true
 thiserror.workspace = true
 log.workspace = true

-# Inference. `ort` is the API; **tract is the engine** — see the workspace
-# manifest, and docs/faces.md §3, for why the C++ ONNX Runtime is not linked.
+# Inference. `ort` is the API; **what runs it is `dr-inference-engine`'s
+# business** — tract, or an ONNX Runtime the app found on disk, on whichever
+# provider the device has (docs/dev/inference.md). This crate never names either.
 ort = { workspace = true, optional = true }
-ort-tract = { workspace = true, optional = true }
+dr-inference-engine = { workspace = true, optional = true }
 ndarray = { workspace = true, optional = true }

 [dev-dependencies]
@@ -20,7 +21,7 @@ zune-jpeg.workspace = true
 env_logger.workspace = true
 # The M1 probe drives `ort` directly so it can print the raw load error.
 ort = { workspace = true }
-ort-tract = { workspace = true }
+dr-inference-engine = { workspace = true }

 [[example]]
 name = "probe"
@@ -30,9 +31,13 @@ required-features = ["inference"]
 name = "faces"
 required-features = ["inference"]

+[[example]]
+name = "eyes"
+required-features = ["inference"]
+
 [features]
 # Nothing on by default, and in particular **no `embedded-model`**: the weights
-# are not a build input and never become one (docs/faces.md §2.2). A feature
+# are not a build input and never become one (docs/dev/faces.md §2.2). A feature
 # flag that *could* embed them is a flag someone eventually sets in a packaging
 # script, and the InsightFace grant does not survive that.
 default = []
@@ -44,4 +49,4 @@ default = []
 # must be testable against synthetic embeddings on a machine with no weights on
 # it — a test suite that needs a research-licensed download is a test suite
 # that does not run in CI.
-inference = ["dep:ort", "dep:ort-tract", "dep:ndarray"]
+inference = ["dep:ort", "dep:dr-inference-engine", "dep:ndarray"]
@@ -0,0 +1,145 @@
+//! Detect the faces in a JPEG and read each one's eyes (docs/dev/faces.md §17).
+//!
+//! The thing worth looking at is whether the eye boxes land on eyes and
+//! whether soft ones are refused — so with `--dump DIR` the crops the
+//! classifiers were shown are written out as PPMs, one per eye and one per
+//! head framing, named by image and face, and every line carries the
+//! numbers the readability floors are set from.
+//!
+//!   cargo run -p dr-face --features inference --example eyes -- \
+//!       DET.onnx 2D106DET.onnx OCEC.onnx SGC.onnx [--dump DIR] photo.jpg [photo.jpg ...]
+//!
+//! All four models must have had their dynamic dims pinned first; see
+//! `tools/fix-face-model-shapes.sh`.
+
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use dr_face::{align, DetectOptions, Detector, EyeModels, Pixels};
+
+fn main() {
+    env_logger::init();
+
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let dump = args.iter().position(|a| a == "--dump").map(|i| {
+        args.remove(i);
+        PathBuf::from(args.remove(i))
+    });
+    if args.len() < 5 {
+        eprintln!(
+            "usage: eyes DET.onnx 2D106DET.onnx OCEC.onnx SGC.onnx [--dump DIR] IMAGE.jpg [IMAGE.jpg ...]"
+        );
+        std::process::exit(2);
+    }
+    if let Some(d) = &dump {
+        std::fs::create_dir_all(d).expect("dump dir");
+    }
+
+    let t = Instant::now();
+    let mut detector = Detector::from_path(&args[0]).expect("load detector");
+    let mut models = EyeModels::from_paths(&args[1], &args[2], &args[3]).expect("load eye models");
+    println!("loaded the models in {:?}", t.elapsed());
+
+    let opts = DetectOptions::default();
+    for path in &args[4..] {
+        let (rgb, w, h) = match load_jpeg(path) {
+            Ok(v) => v,
+            Err(e) => {
+                println!("{path}: {e}");
+                continue;
+            }
+        };
+        let dets = detector.detect(&rgb, w, h, &opts).expect("detect");
+        println!("\n{path}  ({w}×{h})  {} face(s)", dets.len());
+
+        let stem = Path::new(path)
+            .file_stem()
+            .map(|s| s.to_string_lossy().into_owned())
+            .unwrap_or_default();
+
+        for (i, d) in dets.iter().enumerate() {
+            let px = Pixels::RgbF32(&rgb);
+            let t = Instant::now();
+            let reading = models
+                .read(px, w, h, d.bbox, &d.landmarks)
+                .expect("read eyes");
+            let ms = t.elapsed().as_secs_f64() * 1e3;
+            let Some((r, lm)) = reading else {
+                println!("  [{i}] nothing to cut, skipped");
+                continue;
+            };
+            println!(
+                "  [{i}] conf {:.2}  box {:.0}×{:.0}  right {:.3} ({:.0}px, sharp {:.3})  left {:.3} ({:.0}px, sharp {:.3})  sunglasses {:.3}  → {:?}  ({ms:.1} ms)",
+                d.confidence,
+                d.width(),
+                d.height(),
+                r.right.open,
+                r.right.px,
+                r.right.sharpness,
+                r.left.open,
+                r.left.px,
+                r.left.sharpness,
+                r.sunglasses,
+                r.state(),
+            );
+            if let Some(dir) = &dump {
+                // The same crops `EyeModels::read` cut, cut again for the
+                // sheet from the landmarks it handed back: the reading itself
+                // carries numbers, not pixels.
+                for (name, contour) in [("right", lm.right_eye()), ("left", lm.left_eye())] {
+                    if let Some(patch) =
+                        align::eye_box(&contour).and_then(|b| align::eye_patch(px, w, h, b))
+                    {
+                        write_ppm(
+                            &dir.join(format!("{stem}-{i}-{name}.ppm")),
+                            patch.pixels(),
+                            align::EYE_PATCH_WIDTH,
+                            align::EYE_PATCH_HEIGHT,
+                        );
+                    }
+                }
+                if let Some(head) = align::head_views(px, w, h, &d.landmarks) {
+                    for (n, view) in head.views().enumerate() {
+                        write_ppm(
+                            &dir.join(format!("{stem}-{i}-head{n}.ppm")),
+                            view,
+                            align::SUNGLASSES_EDGE,
+                            align::SUNGLASSES_EDGE,
+                        );
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn write_ppm(path: &Path, rgb: &[f32], w: usize, h: usize) {
+    let mut out = format!("P6\n{w} {h}\n255\n").into_bytes();
+    out.extend(
+        rgb.iter()
+            .map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8),
+    );
+    std::fs::write(path, out).expect("write ppm");
+}
+
+/// Decode to the tightly packed `f32` RGB `0.0..=1.0` the crate expects.
+fn load_jpeg(path: &str) -> Result<(Vec<f32>, usize, usize), String> {
+    let bytes = std::fs::read(path).map_err(|e| e.to_string())?;
+    let mut dec = zune_jpeg::JpegDecoder::new(&bytes);
+    let px = dec.decode().map_err(|e| e.to_string())?;
+    let info = dec.info().ok_or("no jpeg header")?;
+    let (w, h) = (info.width as usize, info.height as usize);
+
+    let rgb: Vec<f32> = match px.len() / (w * h) {
+        3 => px.iter().map(|&v| v as f32 / 255.0).collect(),
+        1 => px
+            .iter()
+            .flat_map(|&v| {
+                let g = v as f32 / 255.0;
+                [g, g, g]
+            })
+            .collect(),
+        n => return Err(format!("{n} components per pixel, expected 1 or 3")),
+    };
+    Ok((rgb, w, h))
+}
@@ -7,7 +7,7 @@
 //!       DET.onnx EMB.onnx photo.jpg [photo.jpg ...]
 //!
 //! The models must have had their input dims frozen first; see
-//! `tools/fix-face-model-shapes.sh` and docs/faces.md §12 M1.
+//! `tools/fix-face-model-shapes.sh` and docs/dev/faces.md §12 M1.

 use std::time::Instant;

@@ -63,15 +63,16 @@ fn main() {
            let embed_ms = t.elapsed().as_secs_f64() * 1e3;

            println!(
-                "  [{i}] conf {:.3}  box {:.0},{:.0} {:.0}×{:.0}  crop_px {:.0}  embed {embed_ms:.0} ms",
+                "  [{i}] conf {:.3}  box {:.0},{:.0} {:.0}×{:.0}  crop_px {:.0}  quality {:.1}  embed {embed_ms:.0} ms",
                d.confidence,
                d.bbox.0,
                d.bbox.1,
                d.width(),
                d.height(),
                aligned.source_px(),
+                emb.quality,
            );
-            all.push((path.clone(), i, emb));
+            all.push((path.clone(), i, emb.embedding));
        }
    }

@@ -1,4 +1,4 @@
-//! M1 (docs/faces.md §12) — will tract load these graphs at all?
+//! M1 (docs/dev/faces.md §12) — will tract load these graphs at all?
 //!
 //! The one measurement everything else in the face subsystem is conditional
 //! on. `det_500m.onnx` has a dynamic H/W input, which is exactly what tract
@@ -9,7 +9,7 @@
 //!
 //! # What it is for
 //!
-//! docs/faces.md §9 has the desktop numbers and the question they leave open:
+//! docs/dev/faces.md §9 has the desktop numbers and the question they leave open:
 //! a GPU GEMM is worth roughly 1.5× of a regroup on a twenty-core desktop,
 //! because the scan is under a third of the pass there. On a tablet the CPU is
 //! several times slower and the GPU is not, so the same optimisation is worth
@@ -46,11 +46,13 @@ fn main() {
    );
    for n in sizes {
        let (embeddings, crop_px, images) = population(n);
+        let gallery = vec![true; n];
        let faces = Faces {
            embeddings: &embeddings,
            dim: EMBEDDING_DIM,
            crop_px: &crop_px,
            images: &images,
+            gallery: &gallery,
        };

        let start = std::time::Instant::now();
@@ -1,4 +1,4 @@
-//! Five-point face alignment (docs/faces.md §5).
+//! Five-point face alignment (docs/dev/faces.md §5).
 //!
 //! ArcFace embeddings are trained on faces warped to a canonical 112×112
 //! arrangement. Feeding the model a plain bounding-box crop *works* — it
@@ -117,51 +117,56 @@ impl Aligned112 {
    /// `face_index --quality` prints the joint distribution so the two are
    /// chosen together rather than each in ignorance of the other.
    pub fn sharpness(&self) -> f32 {
-        let e = ALIGNED_EDGE;
-        let luma: Vec<f32> = self
-            .pixels
-            .chunks_exact(3)
-            .map(|p| 0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2])
-            .collect();
-
-        let (mut lap_sum, mut lap_sq) = (0.0_f64, 0.0_f64);
-        let (mut lum_sum, mut lum_sq) = (0.0_f64, 0.0_f64);
-        let mut n = 0.0_f64;
-
-        for y in 1..e - 1 {
-            for x in 1..e - 1 {
-                let i = y * e + x;
-                // Four-neighbour Laplacian. The 8-neighbour form is more
-                // sensitive to diagonal detail and also to noise, which on a
-                // high-ISO frame is exactly the thing that must not read as
-                // sharpness.
-                let lap = 4.0 * luma[i] - luma[i - 1] - luma[i + 1] - luma[i - e] - luma[i + e];
-                let lap = lap as f64;
-                lap_sum += lap;
-                lap_sq += lap * lap;
-
-                let l = luma[i] as f64;
-                lum_sum += l;
-                lum_sq += l * l;
-                n += 1.0;
-            }
-        }
-
-        if n == 0.0 {
-            return 0.0;
-        }
-        let lap_var = (lap_sq / n - (lap_sum / n).powi(2)).max(0.0);
-        let lum_var = (lum_sq / n - (lum_sum / n).powi(2)).max(0.0);
-
-        // A crop with no luma variation has no edges to find either, so the
-        // ratio is 0/0. Zero is the right answer: nothing there is a face.
-        if lum_var <= 1e-9 {
-            return 0.0;
-        }
-        (lap_var / lum_var) as f32
+        laplacian_ratio(&self.pixels, ALIGNED_EDGE, ALIGNED_EDGE)
    }
 }

+/// Variance of the four-neighbour Laplacian over the variance of the luma,
+/// for a `w × h` RGB crop — the measure [`Aligned112::sharpness`] describes,
+/// shared with [`EyePatch::sharpness`].
+fn laplacian_ratio(pixels: &[f32], w: usize, h: usize) -> f32 {
+    let luma: Vec<f32> = pixels
+        .chunks_exact(3)
+        .map(|p| 0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2])
+        .collect();
+
+    let (mut lap_sum, mut lap_sq) = (0.0_f64, 0.0_f64);
+    let (mut lum_sum, mut lum_sq) = (0.0_f64, 0.0_f64);
+    let mut n = 0.0_f64;
+
+    for y in 1..h.saturating_sub(1) {
+        for x in 1..w.saturating_sub(1) {
+            let i = y * w + x;
+            // Four-neighbour Laplacian. The 8-neighbour form is more
+            // sensitive to diagonal detail and also to noise, which on a
+            // high-ISO frame is exactly the thing that must not read as
+            // sharpness.
+            let lap = 4.0 * luma[i] - luma[i - 1] - luma[i + 1] - luma[i - w] - luma[i + w];
+            let lap = lap as f64;
+            lap_sum += lap;
+            lap_sq += lap * lap;
+
+            let l = luma[i] as f64;
+            lum_sum += l;
+            lum_sq += l * l;
+            n += 1.0;
+        }
+    }
+
+    if n == 0.0 {
+        return 0.0;
+    }
+    let lap_var = (lap_sq / n - (lap_sum / n).powi(2)).max(0.0);
+    let lum_var = (lum_sq / n - (lum_sum / n).powi(2)).max(0.0);
+
+    // A crop with no luma variation has no edges to find either, so the
+    // ratio is 0/0. Zero is the right answer: nothing there is a face.
+    if lum_var <= 1e-9 {
+        return 0.0;
+    }
+    (lap_var / lum_var) as f32
+}
+
 /// A similarity transform: rotation, uniform scale, translation.
 ///
 /// Stored as the four independent parameters rather than a 2×3 matrix so that
@@ -203,7 +208,7 @@ impl Similarity {
 ///
 /// # Why least squares and not RANSAC
 ///
-/// The reference C++ implementation (docs/faces.md §1.1) fits this with
+/// The reference C++ implementation (docs/dev/faces.md §1.1) fits this with
 /// OpenCV's `estimateAffinePartial2D` under RANSAC. RANSAC over five points is
 /// a strange fit: the minimal sample for a similarity is two, so it can discard
 /// landmarks it judges outliers and solve from a subset — and on a profile face
@@ -351,27 +356,314 @@ pub fn warp_pixels(
    let m = fit_similarity(landmarks, &ARCFACE_TEMPLATE)?;

    let e = ALIGNED_EDGE;
-    let mut pixels = vec![0.0_f32; e * e * 3];
-    for v in 0..e {
-        for u in 0..e {
-            // Pixel centres, so the transform is not off by half a pixel —
-            // which is small enough to survive review and large enough to
-            // matter on a 40-pixel face.
-            let (x, y) = m.invert(u as f32 + 0.5, v as f32 + 0.5);
-            let (x, y) = (x - 0.5, y - 0.5);
-            let out = (v * e + u) * 3;
-            sample_bilinear(px, width, height, x, y, &mut pixels[out..out + 3]);
-        }
-    }
-
+    let window = TemplateWindow {
+        x: 0.0,
+        y: 0.0,
+        w: e as f32,
+        h: e as f32,
+    };
    Some(Aligned112 {
-        pixels,
+        pixels: sample_window(px, width, height, &m, &window, e, e),
        // The warp maps `scale` source pixels to one destination pixel, so the
        // crop spans 112/scale of the source.
        source_px: ALIGNED_EDGE as f32 / m.scale(),
    })
 }

+/// A rectangle in **template** coordinates — the 112-unit frame
+/// [`ARCFACE_TEMPLATE`] is written in — that a crop is sampled from.
+///
+/// Every crop this module makes is one of these resampled through the same
+/// fitted similarity: the aligned face is the window `(0, 0, 112, 112)`, an
+/// eye is a small window around its template point, a head is a window larger
+/// than the face. Stating them all in one frame is what lets a second crop be
+/// added as a constant rather than a second warp, and what keeps them
+/// consistent with each other — the eye window sits where the eye landmark
+/// lands *after* alignment, so a tilted face gets an upright eye.
+#[derive(Debug, Clone, Copy, PartialEq)]
+struct TemplateWindow {
+    x: f32,
+    y: f32,
+    w: f32,
+    h: f32,
+}
+
+/// Resample `window` of the template frame into an `out_w × out_h` RGB buffer.
+///
+/// Bilinear, from the source, in one step — the property [`warp`] insists on,
+/// and every crop through here inherits it. The output pixel `(u, v)` is placed
+/// at its centre in the window, taken back through `m` to source coordinates,
+/// and sampled there; the window's aspect is **not** preserved when it differs
+/// from the output's, which is deliberate for the eye classifier (it was
+/// trained on detector boxes resized the same way) and moot for the others.
+fn sample_window(
+    px: Pixels<'_>,
+    width: usize,
+    height: usize,
+    m: &Similarity,
+    window: &TemplateWindow,
+    out_w: usize,
+    out_h: usize,
+) -> Vec<f32> {
+    let mut pixels = vec![0.0_f32; out_w * out_h * 3];
+    let sx = window.w / out_w as f32;
+    let sy = window.h / out_h as f32;
+    for v in 0..out_h {
+        for u in 0..out_w {
+            // Pixel centres, so the transform is not off by half a pixel —
+            // which is small enough to survive review and large enough to
+            // matter on a 40-pixel face.
+            let tx = window.x + (u as f32 + 0.5) * sx;
+            let ty = window.y + (v as f32 + 0.5) * sy;
+            let (x, y) = m.invert(tx, ty);
+            let (x, y) = (x - 0.5, y - 0.5);
+            let out = (v * out_w + u) * 3;
+            sample_bilinear(px, width, height, x, y, &mut pixels[out..out + 3]);
+        }
+    }
+    pixels
+}
+
+// ── eyes ──────────────────────────────────────────────────────────────────
+
+/// Width of an eye crop as the classifier reads it, in pixels. Fixed by the
+/// OCEC input (`docs/dev/faces.md` §17): 40 wide, 24 high.
+pub const EYE_PATCH_WIDTH: usize = 40;
+/// Height of an eye crop as the classifier reads it, in pixels.
+pub const EYE_PATCH_HEIGHT: usize = 24;
+
+/// How much an eye's box is grown beyond its lid contour, as a fraction of
+/// its width and height on each side.
+///
+/// The classifier was trained on a whole-body detector's *eye* boxes — tight
+/// round the palpebral fissure — and measured on 25 open-eyed faces from the
+/// reference library, a tight box is what it wants: 22 of 25 read open at
+/// 0 and 0.1, 18 at 0.4, 14 at 0.6 (docs/dev/faces.md §17.2). A tenth, so a
+/// contour landing a pixel short of the lashes still holds them.
+pub const EYE_BOX_MARGIN: f32 = 0.1;
+
+/// Height a shut eye's box is given, as a fraction of its width.
+///
+/// A closed eye's contour has no height. The box is given the height an
+/// open eye of the same width would have, so the classifier sees the same
+/// framing either way — which is what it was trained on.
+pub const EYE_BOX_MIN_ASPECT: f32 = 0.4;
+
+/// The box round an eye's lid contour, in the contour's own coordinates:
+/// `(x, y, w, h)`.
+///
+/// Model-free: the contour is whatever the landmark model gave for the ten
+/// (or so) points on the lids, in source pixels. `None` for an empty
+/// contour or one with no width, which is what a hidden eye's collapsed
+/// contour can come to.
+pub fn eye_box(contour: &[(f32, f32)]) -> Option<(f32, f32, f32, f32)> {
+    let (mut x0, mut y0, mut x1, mut y1) = (f32::MAX, f32::MAX, f32::MIN, f32::MIN);
+    for &(x, y) in contour {
+        x0 = x0.min(x);
+        y0 = y0.min(y);
+        x1 = x1.max(x);
+        y1 = y1.max(y);
+    }
+    let w = x1 - x0;
+    if contour.is_empty() || w <= 0.0 || w.is_nan() {
+        return None;
+    }
+    let h = (y1 - y0).max(w * EYE_BOX_MIN_ASPECT);
+    let cy = (y0 + y1) / 2.0;
+    let (mx, my) = (w * EYE_BOX_MARGIN, h * EYE_BOX_MARGIN);
+    Some((x0 - mx, cy - h / 2.0 - my, w + 2.0 * mx, h + 2.0 * my))
+}
+
+/// One eye, resampled to the classifier's input.
+///
+/// Constructible only by [`eye_patch`], for the reason [`Aligned112`] is
+/// only constructible by [`warp`]: the classifier accepting a plain buffer
+/// would accept any 40×24 of anything, and its answer would still be a
+/// plausible probability.
+#[derive(Debug, Clone, PartialEq)]
+pub struct EyePatch {
+    /// `24 × 40 × 3`, row-major RGB in `0.0..=1.0`.
+    pixels: Vec<f32>,
+    /// Source pixels across the box the patch was cut from.
+    source_px: f32,
+}
+
+impl EyePatch {
+    pub fn pixels(&self) -> &[f32] {
+        &self.pixels
+    }
+
+    /// Source pixels across the eye box — how much eye there was to read.
+    ///
+    /// The classifier was trained down to eyes a dozen pixels wide, and
+    /// below that a crop is an interpolation of nothing; `crate::eyes` draws
+    /// the line. Zero when the box had no width, which is a hidden eye.
+    pub fn source_px(&self) -> f32 {
+        self.source_px
+    }
+
+    /// How sharp the eye the classifier is about to see actually is —
+    /// [`Aligned112::sharpness`]'s measure, over the patch.
+    ///
+    /// The reason it exists is the reason the face's does: a soft eye is
+    /// not a closed one, but a classifier shown a smear says "closed" with
+    /// the same confidence it says anything, and the only defence is to
+    /// not ask. A face sharp enough to embed can still hold an eye too soft
+    /// to read — it is a fortieth of the face — so the measure is taken
+    /// here and not inherited from the crop.
+    pub fn sharpness(&self) -> f32 {
+        laplacian_ratio(&self.pixels, EYE_PATCH_WIDTH, EYE_PATCH_HEIGHT)
+    }
+}
+
+/// Cut an eye out of the source at the classifier's size, from an
+/// axis-aligned box in source pixels — [`eye_box`]'s, as a rule.
+///
+/// Upright and from the frame, not through the face's alignment: the
+/// classifier's training crops were detector boxes, and a landmark model's
+/// contour already says where the eye is on a tilted head. Bilinear in one
+/// step from the native buffer, so a large face gives real pixels; the
+/// box's aspect is not preserved, which is what the training resize did.
+pub fn eye_patch(
+    px: Pixels<'_>,
+    width: usize,
+    height: usize,
+    bbox: (f32, f32, f32, f32),
+) -> Option<EyePatch> {
+    let pixels = crop_box(px, width, height, bbox, EYE_PATCH_WIDTH, EYE_PATCH_HEIGHT)?;
+    Some(EyePatch {
+        pixels,
+        source_px: bbox.2,
+    })
+}
+
+// ── sunglasses ────────────────────────────────────────────────────────────
+
+/// Edge of the crop the sunglasses classifier reads. Fixed by the SGC input:
+/// 48×48.
+pub const SUNGLASSES_EDGE: usize = 48;
+
+/// The windows read for the sunglasses classifier, in template units:
+/// `(x, y, w, h)`.
+///
+/// **Two framings, and the classifier's answer is the higher of the two.**
+/// It was trained on a whole-body detector's *head* boxes, and a head box
+/// is not reproducible from five landmarks: how much hair and hat it took in
+/// depended on the person. So it is shown the face twice — once as the
+/// aligned crop itself, once shifted up and widened to take in hair and
+/// hat at the cost of the chin, which is roughly where a head box falls —
+/// and a pair of sunglasses counts if it looks like one in either.
+///
+/// Measured over 12 faces in sunglasses and 28 with plainly visible eyes
+/// from the reference library (`examples/eyes.rs --head`), at the 0.5
+/// threshold:
+///
+/// | window | sunglasses found | clear eyes kept |
+/// |---|---|---|
+/// | the aligned face, `(0, 0, 112, 112)` | 9 | 28 |
+/// | a head, `(-5, -14, 122, 122)` | 6 | 27 |
+/// | a larger head, `(-30, -55, 172, 190)` | 6 | 25 |
+/// | **the higher of the first two** | **11** | 27 |
+///
+/// The face-tight crop alone was the best single framing, which was not the
+/// expectation; the head framing found the sunglasses under a cap that the
+/// face crop missed. The one clear-eyed face the pair loses wears a cap and
+/// clear glasses, at 0.68. Erring towards "sunglasses" is the safe direction
+/// for what this feeds: a face called sunglasses is left alone by the
+/// eyes-open filter, where a pair of sunglasses missed hands the eye
+/// classifier a lens to guess at (docs/dev/faces.md §17).
+pub const SUNGLASSES_WINDOWS: [(f32, f32, f32, f32); 2] =
+    [(0.0, 0.0, 112.0, 112.0), (-5.0, -14.0, 122.0, 122.0)];
+
+/// The framings of one face the sunglasses classifier is shown.
+///
+/// A newtype for the reason [`EyePatch`] is one.
+#[derive(Debug, Clone, PartialEq)]
+pub struct HeadViews {
+    /// Each `48 × 48 × 3`, row-major RGB in `0.0..=1.0`.
+    views: Vec<Vec<f32>>,
+}
+
+impl HeadViews {
+    pub fn views(&self) -> impl Iterator<Item = &[f32]> {
+        self.views.iter().map(Vec::as_slice)
+    }
+}
+
+/// Cut the [`SUNGLASSES_WINDOWS`] out of the source, aligned, at the
+/// classifier's size.
+pub fn head_views(
+    px: Pixels<'_>,
+    width: usize,
+    height: usize,
+    landmarks: &[(f32, f32); 5],
+) -> Option<HeadViews> {
+    head_views_in(px, width, height, landmarks, &SUNGLASSES_WINDOWS)
+}
+
+/// [`head_views`] over windows other than [`SUNGLASSES_WINDOWS`].
+///
+/// For measuring them, which is how the constant was chosen
+/// (`examples/eyes.rs --head`); production callers use the constant.
+pub fn head_views_in(
+    px: Pixels<'_>,
+    width: usize,
+    height: usize,
+    landmarks: &[(f32, f32); 5],
+    windows: &[(f32, f32, f32, f32)],
+) -> Option<HeadViews> {
+    if !px.fits(width, height) || windows.is_empty() {
+        return None;
+    }
+    let m = fit_similarity(landmarks, &ARCFACE_TEMPLATE)?;
+    let views = windows
+        .iter()
+        .map(|&(x, y, w, h)| {
+            let window = TemplateWindow { x, y, w, h };
+            sample_window(
+                px,
+                width,
+                height,
+                &m,
+                &window,
+                SUNGLASSES_EDGE,
+                SUNGLASSES_EDGE,
+            )
+        })
+        .collect();
+    Some(HeadViews { views })
+}
+
+/// An axis-aligned crop of the source, resampled to `out_w × out_h` RGB.
+///
+/// `(x, y, w, h)` in source pixels; the aspect is not preserved when it
+/// differs from the output's. Bilinear in one step, like every crop here;
+/// pixels outside the source read black. What a landmark model trained on
+/// detector boxes wants — upright, from the frame — as against the aligned
+/// windows above.
+pub fn crop_box(
+    px: Pixels<'_>,
+    width: usize,
+    height: usize,
+    (x, y, w, h): (f32, f32, f32, f32),
+    out_w: usize,
+    out_h: usize,
+) -> Option<Vec<f32>> {
+    if !px.fits(width, height) || w <= 0.0 || h <= 0.0 {
+        return None;
+    }
+    let identity = Similarity {
+        a: 1.0,
+        b: 0.0,
+        tx: 0.0,
+        ty: 0.0,
+    };
+    let window = TemplateWindow { x, y, w, h };
+    Some(sample_window(
+        px, width, height, &identity, &window, out_w, out_h,
+    ))
+}
+
 fn sample_bilinear(px: Pixels<'_>, w: usize, h: usize, x: f32, y: f32, out: &mut [f32]) {
    let x0 = x.floor();
    let y0 = y.floor();
@@ -489,6 +781,125 @@ mod tests {
        }
    }

+    /// A source whose red channel is its x coordinate and green its y, so a
+    /// crop's mean colour says where in the source it was taken from.
+    fn coordinate_image(w: usize, h: usize) -> Vec<f32> {
+        let mut rgb = vec![0.0_f32; w * h * 3];
+        for y in 0..h {
+            for x in 0..w {
+                rgb[(y * w + x) * 3] = x as f32 / w as f32;
+                rgb[(y * w + x) * 3 + 1] = y as f32 / h as f32;
+            }
+        }
+        rgb
+    }
+
+    fn mean_channel(px: &[f32], c: usize) -> f32 {
+        let n = px.len() / 3;
+        px.chunks_exact(3).map(|p| p[c]).sum::<f32>() / n as f32
+    }
+
+    /// The box is the contour's bounds, grown by the margin, and a shut
+    /// eye's flat contour is given an open eye's height.
+    #[test]
+    fn an_eye_box_holds_its_contour_with_a_margin() {
+        let open = [(100.0, 50.0), (110.0, 46.0), (120.0, 50.0), (110.0, 54.0)];
+        let (x, y, w, h) = eye_box(&open).unwrap();
+        assert!((w - 20.0 * (1.0 + 2.0 * EYE_BOX_MARGIN)).abs() < 1e-4);
+        assert!((h - 8.0 * (1.0 + 2.0 * EYE_BOX_MARGIN)).abs() < 1e-4);
+        assert!((x + w / 2.0 - 110.0).abs() < 1e-4);
+        assert!((y + h / 2.0 - 50.0).abs() < 1e-4);
+
+        let shut = [(100.0, 50.0), (110.0, 50.0), (120.0, 50.0)];
+        let (_, _, w2, h2) = eye_box(&shut).unwrap();
+        assert!((w2 - w).abs() < 1e-4, "same width");
+        assert!((h2 - 20.0 * EYE_BOX_MIN_ASPECT * (1.0 + 2.0 * EYE_BOX_MARGIN)).abs() < 1e-4);
+
+        assert!(eye_box(&[]).is_none());
+        assert!(eye_box(&[(5.0, 5.0), (5.0, 9.0)]).is_none(), "no width");
+    }
+
+    /// The patch is cut from the box it was given, upright, and knows how
+    /// many source pixels it spans.
+    #[test]
+    fn an_eye_patch_is_the_box_resampled() {
+        let (w, h) = (200, 200);
+        let rgb = coordinate_image(w, h);
+        let bbox = (60.0, 90.0, 30.0, 12.0);
+        let eye = eye_patch(Pixels::RgbF32(&rgb), w, h, bbox).unwrap();
+        assert_eq!(eye.pixels().len(), EYE_PATCH_WIDTH * EYE_PATCH_HEIGHT * 3);
+        assert_eq!(eye.source_px(), 30.0);
+        let cx = mean_channel(eye.pixels(), 0) * w as f32;
+        let cy = mean_channel(eye.pixels(), 1) * h as f32;
+        assert!((cx - 75.0).abs() < 0.6, "{cx}");
+        assert!((cy - 96.0).abs() < 0.6, "{cy}");
+        // No width, or a buffer that is not the size it claims: nothing.
+        assert!(eye_patch(Pixels::RgbF32(&rgb), w, h, (60.0, 90.0, 0.0, 12.0)).is_none());
+        assert!(eye_patch(Pixels::RgbF32(&rgb), 190, 200, bbox).is_none());
+    }
+
+    /// A soft eye scores lower than the same eye sharp, on the patch itself.
+    #[test]
+    fn an_eye_patchs_sharpness_falls_with_blur() {
+        let edge = 120;
+        let sharp = image(
+            edge,
+            |x, y| if (x / 5 + y / 5) % 2 == 0 { 0.9 } else { 0.1 },
+        );
+        let soft = blur(&blur(&sharp, edge), edge);
+        let bbox = (20.0, 40.0, 40.0, 24.0);
+        let a = eye_patch(Pixels::RgbF32(&sharp), edge, edge, bbox)
+            .unwrap()
+            .sharpness();
+        let b = eye_patch(Pixels::RgbF32(&soft), edge, edge, bbox)
+            .unwrap()
+            .sharpness();
+        assert!(a > b * 2.0, "sharp {a} should clearly beat blurred {b}");
+    }
+
+    /// The second sunglasses framing takes in more than the face — it starts
+    /// above the template's top edge and ends below its bottom — and the
+    /// first is the aligned face itself.
+    #[test]
+    fn the_head_views_are_the_face_and_a_wider_framing_of_it() {
+        let (w, h) = (300, 300);
+        let rgb = coordinate_image(w, h);
+        let lm = shifted_scaled(1.0, 100.0, 100.0, 0.0);
+        let head = head_views(Pixels::RgbF32(&rgb), w, h, &lm).unwrap();
+        let views: Vec<&[f32]> = head.views().collect();
+        let face = warp(&rgb, w, h, &lm).unwrap();
+        assert_eq!(views.len(), SUNGLASSES_WINDOWS.len());
+        for v in &views {
+            assert_eq!(v.len(), SUNGLASSES_EDGE * SUNGLASSES_EDGE * 3);
+        }
+
+        // The face view samples the same region as the aligned crop.
+        assert!((mean_channel(views[0], 0) - mean_channel(face.pixels(), 0)).abs() < 0.01);
+        assert!((mean_channel(views[0], 1) - mean_channel(face.pixels(), 1)).abs() < 0.01);
+
+        let (x, y, ww, hh) = SUNGLASSES_WINDOWS[1];
+        assert!(
+            x < 0.0 && y < 0.0,
+            "the window starts outside the face crop"
+        );
+        assert!(x + ww > ALIGNED_EDGE as f32, "and is wider than it");
+        assert!(y + hh < ALIGNED_EDGE as f32, "but stops short of the chin");
+        // Centred horizontally on the face, so the two share a mean x.
+        assert!((mean_channel(views[1], 0) - mean_channel(face.pixels(), 0)).abs() < 0.01);
+        // Its first row lies above the face's first row.
+        assert!(views[1][1] < face.pixels()[1]);
+    }
+
+    #[test]
+    fn degenerate_landmarks_yield_no_head_crop() {
+        let rgb = vec![0.5_f32; 64 * 64 * 3];
+        let degenerate = [(50.0, 50.0); 5];
+        assert!(head_views(Pixels::RgbF32(&rgb), 64, 64, &degenerate).is_none());
+        // And a buffer that is not the size it claims.
+        let lm = shifted_scaled(1.0, 0.0, 0.0, 0.0);
+        assert!(head_views(Pixels::RgbF32(&rgb), 60, 60, &lm).is_none());
+    }
+
    #[test]
    fn out_of_bounds_samples_read_black_rather_than_wrapping() {
        let rgb = vec![1.0_f32; 32 * 32 * 3];
@@ -136,11 +136,24 @@ pub const RIVAL_FLOOR: f32 = 0.5;
 ///
 /// A face in no group, or one with no evidence for anybody, scores 0.
 ///
+/// `gallery` is one flag per face — which faces may be evidence at all
+/// ([`crate::embedding::MIN_GALLERY_QUALITY`]). Its length is the face count.
+/// A pair is evidence *about* either face but only *from* a gallery one: a
+/// probe learns from the references it matched, and a reference learns nothing
+/// from a probe that happened to match it, however well. Without that, the one
+/// short vector in a group would be the strongest match every face in it had.
+///
 /// `pairs` must be the *evidence* list — scanned at [`RIVAL_FLOOR`], not at the
 /// merge threshold. Passing the merge list still works but silently removes
 /// every rival weaker than a merge, which is most of them, and every uniqueness
 /// collapses to 1.
-pub fn identity_shares(faces: usize, clusters: &[Cluster], pairs: &[Pair], top: usize) -> Vec<f32> {
+pub fn identity_shares(
+    gallery: &[bool],
+    clusters: &[Cluster],
+    pairs: &[Pair],
+    top: usize,
+) -> Vec<f32> {
+    let faces = gallery.len();
    // An identity is a *person*, not a group. One person routinely holds
    // several anchored groups — the same reason they hold several unnamed ones
    // — and keying this by group had Catherine competing with Catherine, which
@@ -174,15 +187,16 @@ pub fn identity_shares(faces: usize, clusters: &[Cluster], pairs: &[Pair], top:
        }
        // A pair is evidence in both directions: j's identity hears about i,
        // and i's identity hears about j. The pair list holds each unordered
-        // pair once, so both have to be recorded here.
+        // pair once, so both have to be recorded here — each only where the
+        // face doing the telling is in the gallery.
        let (gi, gj) = (group_of[p.i], group_of[p.j]);
-        if gj != usize::MAX {
+        if gj != usize::MAX && gallery[p.j] {
            evidence[p.i]
                .entry(key_of[gj])
                .or_default()
                .push(p.probability);
        }
-        if gi != usize::MAX {
+        if gi != usize::MAX && gallery[p.i] {
            evidence[p.j]
                .entry(key_of[gi])
                .or_default()
@@ -255,6 +269,11 @@ mod tests {
        Pair { i, j, probability }
    }

+    /// `n` faces, every one of them fit to be compared against.
+    fn all(n: usize) -> Vec<bool> {
+        vec![true; n]
+    }
+
    /// The failure the module exists to fix: face 0 matches its own group's
    /// three members strongly, and the group has forty more it is unrelated to.
    /// The old within-group mean reported ~0.07 for this.
@@ -264,7 +283,7 @@ mod tests {
        let clusters = vec![cluster(&members)];
        let pairs = vec![pair(0, 1, 0.99), pair(0, 2, 0.97), pair(0, 3, 0.95)];

-        let shares = identity_shares(44, &clusters, &pairs, TOP_MATCHES);
+        let shares = identity_shares(&all(44), &clusters, &pairs, TOP_MATCHES);
        assert!(
            (shares[0] - 0.97).abs() < 1e-6,
            "the mean of its three real matches, undiluted: {}",
@@ -284,7 +303,7 @@ mod tests {
            pair(0, 4, 0.90),
        ];

-        let shares = identity_shares(5, &clusters, &pairs, TOP_MATCHES);
+        let shares = identity_shares(&all(5), &clusters, &pairs, TOP_MATCHES);
        // Coherent at 0.90, and only half of the evidence is its own.
        assert!(
            (shares[0] - 0.45).abs() < 1e-6,
@@ -298,9 +317,9 @@ mod tests {
    #[test]
    fn a_rival_too_weak_to_merge_still_lowers_the_confidence() {
        let clusters = vec![named(&[0, 1], 1), named(&[2, 3], 2)];
-        let sure = identity_shares(4, &clusters, &[pair(0, 1, 0.95)], TOP_MATCHES);
+        let sure = identity_shares(&all(4), &clusters, &[pair(0, 1, 0.95)], TOP_MATCHES);
        let contested = identity_shares(
-            4,
+            &all(4),
            &clusters,
            &[pair(0, 1, 0.95), pair(0, 2, 0.60)],
            TOP_MATCHES,
@@ -321,7 +340,7 @@ mod tests {
    fn an_unnamed_group_is_not_treated_as_competition() {
        let clusters = vec![cluster(&[0, 1]), cluster(&[2, 3])];
        let shares = identity_shares(
-            4,
+            &all(4),
            &clusters,
            &[pair(0, 1, 0.95), pair(0, 2, 0.90)],
            TOP_MATCHES,
@@ -343,7 +362,7 @@ mod tests {
        let mut pairs: Vec<Pair> = (1..11).map(|j| pair(0, j, 0.90)).collect();
        pairs.extend((11..62).map(|j| pair(0, j, 0.55)));

-        let shares = identity_shares(62, &clusters, &pairs, TOP_MATCHES);
+        let shares = identity_shares(&all(62), &clusters, &pairs, TOP_MATCHES);
        // Ten at 0.90 against ten at 0.55 — not fifty-one at 0.55.
        assert!(
            (shares[0] - 0.90 * (9.0 / 14.5)).abs() < 1e-5,
@@ -352,11 +371,29 @@ mod tests {
        );
    }

+    /// A probe learns from the references it matched; a reference learns
+    /// nothing from a probe. The pair is the same pair — what differs is who
+    /// is doing the telling.
+    #[test]
+    fn a_face_outside_the_gallery_is_nobody_s_evidence() {
+        let clusters = vec![named(&[0, 1, 2], 1)];
+        let gallery = vec![true, true, false];
+        let pairs = vec![pair(0, 1, 0.80), pair(0, 2, 0.99), pair(1, 2, 0.99)];
+
+        let shares = identity_shares(&gallery, &clusters, &pairs, TOP_MATCHES);
+        // Faces 0 and 1 hear only from each other: the 0.99 the probe offered
+        // them is not counted.
+        assert!((shares[0] - 0.80).abs() < 1e-6, "{}", shares[0]);
+        assert!((shares[1] - 0.80).abs() < 1e-6, "{}", shares[1]);
+        // The probe hears from both references.
+        assert!((shares[2] - 0.99).abs() < 1e-6, "{}", shares[2]);
+    }
+
    /// A face nothing has any evidence about claims nothing.
    #[test]
    fn a_face_with_no_evidence_reports_no_confidence() {
        let clusters = vec![cluster(&[0, 1])];
-        let shares = identity_shares(2, &clusters, &[], TOP_MATCHES);
+        let shares = identity_shares(&all(2), &clusters, &[], TOP_MATCHES);
        assert_eq!(shares, vec![0.0, 0.0]);
    }
 }
@@ -1,4 +1,4 @@
-//! Cosine to probability (docs/faces.md §8, FR-CULL-9).
+//! Cosine to probability (docs/dev/faces.md §8, FR-CULL-9).
 //!
 //! FR-CULL-9 is a hard requirement rather than an implementation detail: no
 //! code path may threshold a bare cosine, every threshold in the subsystem is
@@ -28,7 +28,7 @@
 //! calibration to the belief it was supposed to test — and that is the whole
 //! of the alternative.
 //!
-//! docs/faces.md §8.1 names one more that would cost no labelling at all: two
+//! docs/dev/faces.md §8.1 names one more that would cost no labelling at all: two
 //! faces in adjacent frames of one burst are near-certainly the same person,
 //! and FR-CULL-5's grouping is sitting there. Nothing draws on it. This crate
 //! cannot see a catalog, let alone the bursts in one — it is handed cosines by
@@ -83,7 +83,7 @@ pub struct Calibration {
 }

 impl Default for Calibration {
-    /// The reference implementation's fitted MBF curve (docs/faces.md §1):
+    /// The reference implementation's fitted MBF curve (docs/dev/faces.md §1):
    /// steepness 16.2, P=0.5 at cosine 0.267.
    ///
    /// **`valid` is false**, and that is the point. It is a documented
@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! The two small classifiers behind a face's eye state (docs/dev/faces.md §17).
+//!
+//! **OCEC** — *open closed eyes classification*, Hyodo 2025 — reads one
+//! 40×24 eye and answers P(open). **SGC** — *sunglasses classification*,
+//! Hyodo 2026 — reads a 48×48 head and answers P(sunglasses); it is shown
+//! two framings of each face and the higher answer stands, for the reason
+//! [`crate::align::SUNGLASSES_WINDOWS`] gives. Both are
+//! depthwise-separable CNNs of a few hundred kilobytes, both MIT with their
+//! weights, and both were exported with BatchNorm already folded, which is
+//! about the friendliest graph tract can be handed.
+//!
+//! Neither takes a plain buffer. [`EyeClassifier::classify`] takes an
+//! [`EyePatch`] and [`SunglassesClassifier::classify`] a [`HeadViews`], each
+//! constructible only by the crop in [`crate::align`] that puts the right
+//! pixels in it — the same defence [`crate::embed::Embedder`] makes with
+//! [`crate::align::Aligned112`], for the same reason: a classifier handed the
+//! wrong region returns a confident probability of nothing. Where the eye
+//! box comes from is [`crate::landmarks`]; [`EyeModels::read`] is the whole
+//! chain.
+//!
+//! # The graphs must have a fixed batch
+//!
+//! Both ship with a dynamic batch dimension, which tract will not analyse.
+//! `tools/fix-face-model-shapes.sh` pins it to 1, exactly as it does for the
+//! embedder; the shipped files are the pinned ones.
+//!
+//! # Pre-processing
+//!
+//! Read off the reference demos rather than assumed: RGB, `x / 255`, NCHW,
+//! the crop resized to the input with bilinear interpolation and **without**
+//! preserving its aspect. [`crate::align`]'s crops arrive already at the
+//! input size in `0..=1`, so there is nothing left to do but lay them out.
+
+use ndarray::Array4;
+
+use crate::align::{
+    eye_box, eye_patch, head_views, EyePatch, HeadViews, EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH,
+    SUNGLASSES_EDGE,
+};
+use crate::eyes::{Eye, EyeReading};
+use crate::landmarks::{Landmarker, Landmarks};
+use crate::{FaceError, Pixels};
+use dr_inference_engine::{Form, Model, Role};
+
+/// A loaded OCEC graph.
+pub struct EyeClassifier {
+    session: Model,
+}
+
+/// A loaded SGC graph.
+pub struct SunglassesClassifier {
+    session: Model,
+}
+
+/// Open a single-input, single-output classifier and check it is the shape
+/// the crop feeding it will be.
+///
+/// The check is against the *input*, because that is where these two graphs
+/// differ from each other and from everything else in this crate: an SGC file
+/// given to the eye classifier would otherwise be resized into by an eye
+/// patch, and answer. `expected` names the model in the error.
+fn open_classifier(
+    bytes: &[u8],
+    expected: &'static str,
+    (h, w): (usize, usize),
+) -> Result<Model, FaceError> {
+    let model = dr_inference_engine::open(Role::EyeClassifier, Form::F32, bytes)?;
+    let acquired = model.acquire()?;
+    let session = acquired.lock();
+
+    let input = session.inputs().first().ok_or(FaceError::WrongModel {
+        expected,
+        detail: "model has no inputs".into(),
+    })?;
+    let shape: Option<Vec<i64>> = input.dtype().tensor_shape().map(|s| s.to_vec());
+    let want = [1, 3, h as i64, w as i64];
+    if shape.as_deref() != Some(&want[..]) {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: format!(
+                "input '{}' is {:?}, expected {:?} (batch pinned to 1)",
+                input.name(),
+                shape,
+                want
+            ),
+        });
+    }
+    if session.outputs().len() != 1 {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: format!("{} outputs, expected one", session.outputs().len()),
+        });
+    }
+    drop(session);
+    drop(acquired);
+    Ok(model)
+}
+
+/// Lay a `h × w` RGB crop out as the `[1, 3, h, w]` tensor both graphs take.
+fn to_nchw(pixels: &[f32], h: usize, w: usize) -> Array4<f32> {
+    let mut input = Array4::<f32>::zeros((1, 3, h, w));
+    for y in 0..h {
+        for x in 0..w {
+            for c in 0..3 {
+                input[[0, c, y, x]] = pixels[(y * w + x) * 3 + c];
+            }
+        }
+    }
+    input
+}
+
+/// Run a one-number classifier and read its sigmoid back, clamped.
+fn run_scalar(model: &Model, input: Array4<f32>, expected: &'static str) -> Result<f32, FaceError> {
+    let acquired = model.acquire()?;
+    let mut session = acquired.lock();
+    let outputs = session
+        .run(ort::inputs![
+            ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+        ])
+        .map_err(FaceError::Inference)?;
+    let (_, data) = outputs[0]
+        .try_extract_tensor::<f32>()
+        .map_err(FaceError::Inference)?;
+    let Some(&p) = data.first() else {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: "empty output".into(),
+        });
+    };
+    // The graph ends in a sigmoid, so this is a clamp against rounding and
+    // nothing more — the reference demo does the same.
+    Ok(p.clamp(0.0, 1.0))
+}
+
+impl EyeClassifier {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Ok(Self {
+            session: open_classifier(bytes, "OCEC", (EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH))?,
+        })
+    }
+
+    /// P(open) for one eye.
+    pub fn classify(&mut self, eye: &EyePatch) -> Result<f32, FaceError> {
+        let input = to_nchw(eye.pixels(), EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH);
+        run_scalar(&self.session, input, "OCEC")
+    }
+}
+
+impl SunglassesClassifier {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Ok(Self {
+            session: open_classifier(bytes, "SGC", (SUNGLASSES_EDGE, SUNGLASSES_EDGE))?,
+        })
+    }
+
+    /// P(sunglasses) for one head: the highest answer over its framings.
+    pub fn classify(&mut self, head: &HeadViews) -> Result<f32, FaceError> {
+        let mut best = 0.0_f32;
+        for view in head.views() {
+            let input = to_nchw(view, SUNGLASSES_EDGE, SUNGLASSES_EDGE);
+            best = best.max(run_scalar(&self.session, input, "SGC")?);
+        }
+        Ok(best)
+    }
+}
+
+/// The three models behind a reading, which is how every caller holds them.
+///
+/// One struct rather than three optional parameters, because a partial
+/// reading is not a reading: an eye state with no sunglasses number behind
+/// it is exactly the beach-photograph failure [`crate::eyes`] describes, and
+/// an eye box without the landmarks is the loose one this module replaced.
+/// The models load together or not at all.
+pub struct EyeModels {
+    pub landmarks: Landmarker,
+    pub eyes: EyeClassifier,
+    pub sunglasses: SunglassesClassifier,
+}
+
+impl EyeModels {
+    pub fn from_paths(
+        landmarks: impl AsRef<std::path::Path>,
+        eyes: impl AsRef<std::path::Path>,
+        sunglasses: impl AsRef<std::path::Path>,
+    ) -> Result<Self, FaceError> {
+        Ok(Self {
+            landmarks: Landmarker::from_path(landmarks)?,
+            eyes: EyeClassifier::from_path(eyes)?,
+            sunglasses: SunglassesClassifier::from_path(sunglasses)?,
+        })
+    }
+
+    /// Read one face's eyes, and hand back the dense landmarks it read them
+    /// from.
+    ///
+    /// `bbox` is the detector's `(x0, y0, x1, y1)` and `landmarks5` its five
+    /// points, both in source pixels; the buffer is the one the aligned
+    /// crop was taken from, so an eye is read from the same pixels the
+    /// embedder saw the face in. `None` where nothing could be cut — a
+    /// degenerate box or landmarks — which the caller stores as "not read".
+    ///
+    /// The landmarks come back because they cost a model run the caller will
+    /// not want to pay twice: stored beside the reading, a later pass over
+    /// faces — head pose, expression — has them without the original.
+    pub fn read(
+        &mut self,
+        px: Pixels<'_>,
+        width: usize,
+        height: usize,
+        bbox: (f32, f32, f32, f32),
+        landmarks5: &[(f32, f32); 5],
+    ) -> Result<Option<(EyeReading, Landmarks)>, FaceError> {
+        let Some(lm) = self.landmarks.landmarks(px, width, height, bbox)? else {
+            return Ok(None);
+        };
+        let Some(head) = head_views(px, width, height, landmarks5) else {
+            return Ok(None);
+        };
+        let mut eye = |contour: &[(f32, f32)]| -> Result<Eye, FaceError> {
+            // A hidden eye's contour can collapse to no width. Its numbers
+            // are then zero — no pixels, no sharpness — which is what the
+            // rule in `crate::eyes` reads as "not readable".
+            let Some(b) = eye_box(contour) else {
+                return Ok(Eye {
+                    open: 0.0,
+                    px: 0.0,
+                    sharpness: 0.0,
+                });
+            };
+            let Some(patch) = eye_patch(px, width, height, b) else {
+                return Ok(Eye {
+                    open: 0.0,
+                    px: 0.0,
+                    sharpness: 0.0,
+                });
+            };
+            Ok(Eye {
+                open: self.eyes.classify(&patch)?,
+                px: patch.source_px(),
+                sharpness: patch.sharpness(),
+            })
+        };
+        let right = eye(&lm.right_eye())?;
+        let left = eye(&lm.left_eye())?;
+        let reading = EyeReading {
+            right,
+            left,
+            sunglasses: self.sunglasses.classify(&head)?,
+        };
+        Ok(Some((reading, lm)))
+    }
+}
@@ -1,4 +1,4 @@
-//! Grouping faces into people (docs/faces.md §9, FR-CULL-10).
+//! Grouping faces into people (docs/dev/faces.md §9, FR-CULL-10).
 //!
 //! Model-free: this is arithmetic over embeddings, and it is where the
 //! subsystem's accuracy actually lives, so it is testable with no weights on
@@ -19,6 +19,23 @@
 //! and clustering never moves it. Two groups holding confirmations of
 //! *different* people cannot merge, whatever their similarity says.
 //!
+//! # The gallery, and the faces that are only ever compared against it
+//!
+//! A third defence, and the cheapest of all: **a short embedding is never a
+//! reference.** The length of the raw vector is the model's own reading of
+//! how recognisable the crop was ([`crate::embedding::MIN_GALLERY_QUALITY`]),
+//! and a short one sits near the centre of the sphere, matching a little of
+//! everybody. One of those in a group is a bridge to the next group over.
+//!
+//! So the population is split. Faces at or above the floor are the
+//! **gallery**, and they cluster exactly as described below. Faces under it
+//! are **probes**: each is measured against the finished groups and joins the
+//! one it fits, by the same average-link rule and under the same constraints
+//! — but it is measured against the gallery members only, never against
+//! another probe, and once placed it is never part of what the next face is
+//! measured against. A blurred photograph of a known person is still named;
+//! it just cannot vouch for anyone else.
+//!
 //! # Average link, not single link
 //!
 //! Single-link chains: one bad edge welds two identities together, and it is
@@ -117,6 +134,11 @@ pub struct Candidate {
    pub embedding: Vec<f32>,
    /// Source pixels across the aligned crop, for the calibration's size term.
    pub crop_px: f32,
+    /// Length of the raw embedding, where it was recorded
+    /// ([`crate::embedding::MIN_GALLERY_QUALITY`]). `None` for a face indexed
+    /// before it was kept, which is admitted to the gallery — see
+    /// [`Candidate::in_gallery`].
+    pub quality: Option<f32>,
    /// The person this face is *confirmed* to be, if any.
    ///
    /// Suggestions are deliberately not passed here. They are this function's
@@ -125,6 +147,13 @@ pub struct Candidate {
    pub confirmed_person: Option<u64>,
 }

+impl Candidate {
+    /// Whether this face may be compared *against*, as well as compared.
+    pub fn in_gallery(&self) -> bool {
+        crate::embedding::in_gallery(self.quality)
+    }
+}
+
 /// One group of faces the clusterer believes are one person.
 #[derive(Debug, Clone, PartialEq)]
 pub struct Cluster {
@@ -202,7 +231,7 @@ pub fn cluster_scored(faces: &[Candidate], cal: &Calibration, min_probability: f

    let clusters = build(faces, cal, min_probability, &merges);
    let confidence = crate::assign::identity_shares(
-        faces.len(),
+        &columns.gallery,
        &clusters,
        &evidence,
        crate::assign::TOP_MATCHES,
@@ -225,6 +254,7 @@ struct Columns {
    dim: usize,
    crop_px: Vec<f32>,
    images: Vec<u64>,
+    gallery: Vec<bool>,
 }

 impl Columns {
@@ -245,6 +275,7 @@ impl Columns {
            dim,
            crop_px: faces.iter().map(|f| f.crop_px).collect(),
            images: faces.iter().map(|f| f.image).collect(),
+            gallery: faces.iter().map(Candidate::in_gallery).collect(),
        }
    }

@@ -254,22 +285,171 @@ impl Columns {
            dim: self.dim,
            crop_px: &self.crop_px,
            images: &self.images,
+            gallery: &self.gallery,
        }
    }
 }

+/// Agglomerate the gallery over its pairs, then place the probes.
+///
+/// `pairs` is what [`neighbours::above_threshold`] returned: every pair has a
+/// gallery side, but a pair with a probe on the other side is not a merge —
+/// it is the evidence [`place_probes`] works from. Only the gallery-to-gallery
+/// pairs reach the engine, so a probe enters it as a singleton with no edges
+/// and comes out exactly as it went in.
 fn build(
    faces: &[Candidate],
    cal: &Calibration,
    min_probability: f32,
    pairs: &[neighbours::Pair],
 ) -> Vec<Cluster> {
+    let gallery: Vec<bool> = faces.iter().map(Candidate::in_gallery).collect();
+    let (merges, probe_pairs): (Vec<_>, Vec<_>) = pairs
+        .iter()
+        .copied()
+        .partition(|p| gallery[p.i] && gallery[p.j]);
+
    let mut engine = Engine::new(faces, cal, min_probability);
-    let parts = components(faces.len(), pairs);
+    let parts = components(faces.len(), &merges);
    for (component, edges) in parts.members.iter().zip(&parts.edges) {
        engine.agglomerate(component, edges);
    }
-    engine.finish()
+    let dot = engine.dot;
+    let clusters = engine.finish();
+    if probe_pairs.is_empty() {
+        return clusters;
+    }
+    place_probes(
+        faces,
+        cal,
+        min_probability,
+        dot,
+        &gallery,
+        clusters,
+        &probe_pairs,
+    )
+}
+
+/// Put each probe into the finished group it fits, or leave it alone.
+///
+/// The same decision the engine makes for a singleton — average link over the
+/// group, at or above `min_probability`, subject to [`Engine::can_link`]'s two
+/// constraints — with one difference that is the whole point: the average is
+/// over the group's **gallery** members. A probe already placed is not part of
+/// what the next one is measured against, so a run of short vectors cannot
+/// pull each other in one after another.
+///
+/// Probes are placed in index order and each placement is final, which is
+/// what keeps this deterministic. The group a probe joins gains its
+/// photograph, so a second face from the same frame cannot follow it — the
+/// co-occurrence rule, applied exactly as the engine applies it.
+fn place_probes(
+    faces: &[Candidate],
+    cal: &Calibration,
+    min_probability: f32,
+    dot: neighbours::DotFn,
+    gallery: &[bool],
+    mut clusters: Vec<Cluster>,
+    probe_pairs: &[neighbours::Pair],
+) -> Vec<Cluster> {
+    // Where each face sits, and what each group's photographs and gallery
+    // members are. The probe's own singleton is here too, and is dropped once
+    // it has moved.
+    let mut group_of = vec![usize::MAX; faces.len()];
+    for (g, c) in clusters.iter().enumerate() {
+        for &m in &c.members {
+            group_of[m] = g;
+        }
+    }
+    let mut images: Vec<HashSet<u64>> = clusters
+        .iter()
+        .map(|c| c.members.iter().map(|&m| faces[m].image).collect())
+        .collect();
+    let references: Vec<Vec<usize>> = clusters
+        .iter()
+        .map(|c| c.members.iter().copied().filter(|&m| gallery[m]).collect())
+        .collect();
+
+    // Which groups each probe has any above-threshold pair into. Only those
+    // can average above the threshold — the argument the module note makes
+    // for the engine holds here unchanged.
+    let mut candidates: Vec<Vec<usize>> = vec![Vec::new(); faces.len()];
+    for p in probe_pairs {
+        let (probe, reference) = if gallery[p.i] { (p.j, p.i) } else { (p.i, p.j) };
+        candidates[probe].push(group_of[reference]);
+    }
+
+    let mut moved: Vec<usize> = Vec::new();
+    for probe in 0..faces.len() {
+        if gallery[probe] || candidates[probe].is_empty() {
+            continue;
+        }
+        let mut groups = std::mem::take(&mut candidates[probe]);
+        groups.sort_unstable();
+        groups.dedup();
+
+        let face = &faces[probe];
+        let mut best: Option<(f32, usize)> = None;
+        for g in groups {
+            let target = &clusters[g];
+            if let (Some(mine), Some(theirs)) = (face.confirmed_person, target.person) {
+                if mine != theirs {
+                    continue;
+                }
+            }
+            if images[g].contains(&face.image) {
+                continue;
+            }
+            let (mut sum, mut count) = (0.0_f64, 0.0_f64);
+            for &r in &references[g] {
+                let cos = dot(&face.embedding, &faces[r].embedding);
+                let min_crop = face.crop_px.min(faces[r].crop_px);
+                sum += cal.probability(cos, min_crop, 0.0) as f64;
+                count += 1.0;
+            }
+            if count == 0.0 {
+                continue;
+            }
+            let p = (sum / count) as f32;
+            // Strictly better wins; on a tie the lowest group index, which is
+            // the engine's own tiebreak.
+            if p >= min_probability && best.is_none_or(|(bp, _)| p > bp) {
+                best = Some((p, g));
+            }
+        }
+
+        let Some((_, g)) = best else { continue };
+        let own = group_of[probe];
+        clusters[g].members.push(probe);
+        clusters[g].members.sort_unstable();
+        clusters[g].person = clusters[g].person.or(face.confirmed_person);
+        images[g].insert(face.image);
+        group_of[probe] = g;
+        moved.push(own);
+    }
+
+    if moved.is_empty() {
+        return clusters;
+    }
+    // The singletons the probes left behind, then the order `Engine::finish`
+    // promises: largest first, lowest member first among equals.
+    let mut vacated = vec![false; clusters.len()];
+    for g in moved {
+        vacated[g] = true;
+    }
+    let mut out: Vec<Cluster> = clusters
+        .into_iter()
+        .zip(vacated)
+        .filter(|(_, gone)| !gone)
+        .map(|(c, _)| c)
+        .collect();
+    out.sort_by(|x, y| {
+        y.members
+            .len()
+            .cmp(&x.members.len())
+            .then(x.members[0].cmp(&y.members[0]))
+    });
+    out
 }

 /// Split one person's faces into the groups a raised threshold separates them
@@ -726,10 +906,19 @@ mod tests {
            image,
            embedding: at_cosine(identity, cosine),
            crop_px: 150.0,
+            quality: None,
            confirmed_person: None,
        }
    }

+    /// A face too short to be a reference: compared, never compared against.
+    fn probe(face: u64, image: u64, identity: usize, cosine: f32) -> Candidate {
+        Candidate {
+            quality: Some(crate::embedding::MIN_GALLERY_QUALITY - 5.0),
+            ..candidate(face, image, identity, cosine)
+        }
+    }
+
    /// A calibration steep enough that the test's cosines are unambiguous:
    /// 0.6 is near-certain, 0.1 is near-impossible.
    fn cal() -> Calibration {
@@ -1099,6 +1288,7 @@ mod tests {
                    image,
                    embedding: at_cosine(p, cosine),
                    crop_px: 60.0 + ((out.len() % 11) as f32) * 25.0,
+                    quality: None,
                    confirmed_person: None,
                });
                image += 1;
@@ -1182,6 +1372,7 @@ mod tests {
            image: 5_000,
            embedding: at_cosine(200, 1.0),
            crop_px: 150.0,
+            quality: None,
            confirmed_person: None,
        });
        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
@@ -1191,4 +1382,117 @@ mod tests {
            "the outlier was absorbed"
        );
    }
+
+    // ── the gallery ───────────────────────────────────────────────────────
+
+    /// A short vector is still somebody: it joins the group it matches.
+    #[test]
+    fn a_probe_joins_the_group_it_matches() {
+        let faces = vec![
+            candidate(1, 10, 0, 1.0),
+            candidate(2, 11, 0, 0.95),
+            probe(3, 12, 0, 0.92),
+        ];
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        assert_eq!(out.len(), 1);
+        assert_eq!(out[0].members, vec![0, 1, 2]);
+    }
+
+    /// Two short vectors that resemble each other are noise agreeing with
+    /// noise, and there is nothing in the gallery for either to be measured
+    /// against.
+    #[test]
+    fn two_probes_are_never_grouped_with_each_other() {
+        let faces = vec![probe(1, 10, 0, 1.0), probe(2, 11, 0, 0.98)];
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        assert_eq!(out.len(), 2, "two probes were grouped: {out:?}");
+    }
+
+    /// The point of measuring against the gallery only: a probe that has been
+    /// placed is not a stepping stone for the next one.
+    #[test]
+    fn a_placed_probe_is_not_what_the_next_probe_is_measured_against() {
+        let mut first = probe(2, 11, 0, 0.6);
+        // 0.6 along identity 0 and 0.8 along its perpendicular: near enough to
+        // the reference to join it, and much nearer to the face below.
+        first.embedding = at_cosine(0, 0.6);
+        let mut second = probe(3, 12, 0, 0.0);
+        second.embedding = at_cosine(0, 0.0);
+        let faces = vec![candidate(1, 10, 0, 1.0), first, second];
+
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        let group = out.iter().find(|c| c.members.contains(&0)).unwrap();
+        assert_eq!(
+            group.members,
+            vec![0, 1],
+            "the first probe should have joined"
+        );
+        assert!(
+            out.iter().any(|c| c.members == vec![2]),
+            "the second probe reached the group through the first: {out:?}"
+        );
+    }
+
+    /// A confirmation on a probe is still the user's word: the group it joins
+    /// becomes that person, and a group already someone else's is closed to it.
+    #[test]
+    fn a_probe_carries_its_confirmation_and_respects_others() {
+        let mut anchored = probe(3, 12, 0, 0.92);
+        anchored.confirmed_person = Some(7);
+        let faces = vec![
+            candidate(1, 10, 0, 1.0),
+            candidate(2, 11, 0, 0.95),
+            anchored,
+        ];
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        assert_eq!(out.len(), 1);
+        assert_eq!(out[0].person, Some(7));
+
+        let mut theirs = candidate(1, 10, 0, 1.0);
+        theirs.confirmed_person = Some(8);
+        let faces = vec![theirs, candidate(2, 11, 0, 0.95), {
+            let mut a = probe(3, 12, 0, 0.92);
+            a.confirmed_person = Some(7);
+            a
+        }];
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        assert!(
+            out.iter()
+                .any(|c| c.members == vec![2] && c.person == Some(7)),
+            "a probe confirmed as one person joined another's group: {out:?}"
+        );
+    }
+
+    /// The co-occurrence rule follows a probe in: once it has joined, its
+    /// photograph is the group's.
+    #[test]
+    fn a_probe_cannot_join_a_group_holding_a_face_from_its_own_photograph() {
+        let faces = vec![
+            candidate(1, 10, 0, 1.0),
+            candidate(2, 11, 0, 0.95),
+            probe(3, 10, 0, 0.92),
+        ];
+        let out = cluster(&faces, &cal(), DEFAULT_MERGE_PROBABILITY);
+        assert!(out.iter().any(|c| c.members == vec![2]), "{out:?}");
+    }
+
+    /// A probe's placement is scored like anyone else's, from the references
+    /// it matched — and the references' own scores do not hear from it.
+    #[test]
+    fn a_probe_is_scored_but_is_not_evidence() {
+        let gallery_only = vec![candidate(1, 10, 0, 1.0), candidate(2, 11, 0, 0.95)];
+        let without = cluster_scored(&gallery_only, &cal(), DEFAULT_MERGE_PROBABILITY);
+
+        let mut with_probe = gallery_only.clone();
+        with_probe.push(probe(3, 12, 0, 0.99));
+        let with = cluster_scored(&with_probe, &cal(), DEFAULT_MERGE_PROBABILITY);
+
+        assert_eq!(with.clusters[0].members, vec![0, 1, 2]);
+        assert!(with.confidence[2] > 0.9, "{}", with.confidence[2]);
+        assert_eq!(
+            &with.confidence[..2],
+            &without.confidence[..],
+            "a probe changed what the references were sure of"
+        );
+    }
 }
@@ -1,4 +1,4 @@
-//! SCRFD face detection (docs/faces.md §4).
+//! SCRFD face detection (docs/dev/faces.md §4).
 //!
 //! One forward pass produces a box, a confidence and **five landmarks** per
 //! face — the landmarks being the reason for this detector rather than a
@@ -14,7 +14,8 @@

 use ndarray::Array4;

-use crate::{install_backend, FaceError};
+use crate::FaceError;
+use dr_inference_engine::{Form, Model, Role};

 /// The graph's input edge, in pixels. See the module note: not configurable.
 pub const INPUT_EDGE: usize = 640;
@@ -135,7 +136,10 @@ impl Detection {

 /// A loaded SCRFD graph.
 pub struct Detector {
-    session: ort::session::Session,
+    session: Model,
+    /// f32 or int8 — the int8 form finds a different set of faces and is a
+    /// different detector in `model_id` (docs/dev/inference.md §7).
+    form: Form,
    /// Feature-map count: 3 for strides {8,16,32}, 4 for {8,16,32,64}.
    ///
    /// Discovered from the output count rather than assumed, because both
@@ -145,18 +149,29 @@ pub struct Detector {
 }

 impl Detector {
-    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
-        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
-        Self::from_bytes(&bytes)
+    /// Which form this detector was loaded from.
+    pub fn form(&self) -> Form {
+        self.form
    }

-    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
-        install_backend();
+    /// Load the canonical f32 file at `path`, or the form the device's
+    /// backend wants instead — the `.int8.onnx` beside it on a Hexagon —
+    /// which [`Detector::form`] then reports.
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let (path, form) = dr_inference_engine::resolve_model(Role::Detector, path.as_ref());
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes_in(&bytes, form)
+    }

-        let session = ort::session::Session::builder()
-            .map_err(FaceError::Inference)?
-            .commit_from_memory(bytes)
-            .map_err(FaceError::Inference)?;
+    /// An f32 graph from memory.
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Self::from_bytes_in(bytes, Form::F32)
+    }
+
+    fn from_bytes_in(bytes: &[u8], form: Form) -> Result<Self, FaceError> {
+        let model = dr_inference_engine::open(Role::Detector, form, bytes)?;
+        let acquired = model.acquire()?;
+        let session = acquired.lock();

        let n_out = session.outputs().len();
        if n_out % 3 != 0 || !(9..=12).contains(&n_out) {
@@ -191,7 +206,13 @@ impl Detector {
            }
        }

-        Ok(Self { session, fmc })
+        drop(session);
+        drop(acquired);
+        Ok(Self {
+            session: model,
+            form,
+            fmc,
+        })
    }

    /// Stride levels this graph emits.
@@ -223,8 +244,9 @@ impl Detector {
        let lb = Letterbox::fit(width as f32, height as f32);
        let input = lb.sample(rgb, width, height);

-        let outputs = self
-            .session
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
            .run(ort::inputs![
                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
            ])
@@ -324,7 +346,7 @@ fn iou(a: &(f32, f32, f32, f32), b: &(f32, f32, f32, f32)) -> f32 {
 /// How the image is fitted into the graph's fixed square input.
 ///
 /// The forward and inverse mappings live in one struct on purpose:
-/// docs/faces.md §4.1 notes that what matters is not *where* the padding goes
+/// docs/dev/faces.md §4.1 notes that what matters is not *where* the padding goes
 /// but that the two agree. A mismatch offsets every box and landmark by the
 /// padding, producing detections that look plausible and embeddings that
 /// quietly cluster badly three stages later.
@@ -350,7 +372,7 @@ impl Letterbox {
    ///
    /// `(x·255 − 127.5) / 128` — note `/128`, not `/127.5`. The reference
    /// implementation this is ported from uses `/128` for both models, and
-    /// every measured number in docs/faces.md §1 came from it.
+    /// every measured number in docs/dev/faces.md §1 came from it.
    ///
    /// Padding is grey, matching the reference's `114`: the value the network
    /// reads least as an edge, where black would draw a hard border across the
@@ -1,4 +1,4 @@
-//! ArcFace / MobileFaceNet inference (docs/faces.md §6).
+//! ArcFace / MobileFaceNet inference (docs/dev/faces.md §6).
 //!
 //! Takes an aligned crop and returns 512 L2-normalised floats. The alignment is
 //! not optional and cannot be skipped by accident: [`Embedder::embed`] takes an
@@ -14,11 +14,47 @@ use ndarray::Array4;

 use crate::align::{Aligned112, ALIGNED_EDGE};
 use crate::embedding::{normalise, Embedding, ModelId, EMBEDDING_DIM};
-use crate::{install_backend, FaceError};
+use crate::FaceError;
+use dr_inference_engine::{Form, Model, Role};
+
+/// What one pass of the embedder produces: the direction, and the length.
+///
+/// Two fields rather than a `quality` on [`Embedding`], because every other
+/// holder of an `Embedding` relies on it being unit length and compares by
+/// dot product; the length is a separate fact about the same face, and it is
+/// stored separately too.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Embedded {
+    pub embedding: Embedding,
+    /// L2 norm of the raw model output.
+    ///
+    /// The model's own opinion of how recognisable the crop was — see
+    /// [`crate::embedding::MIN_GALLERY_QUALITY`] for what it means and where
+    /// it is used.
+    pub quality: f32,
+}
+
+impl Embedded {
+    /// Storage form: the **raw** vector, `512 × f16`.
+    ///
+    /// Not the unit vector. The length is the quality, and a store that held
+    /// only the direction would have thrown it away at the one moment it could
+    /// be known — which is what this crate used to do. Readers re-normalise
+    /// ([`Embedding::from_f16_bytes`]), so every comparison is still a dot
+    /// product, and [`crate::embedding::read_f16_bytes`] gives the length back
+    /// to a reader that wants it.
+    ///
+    /// f16 costs nothing extra at this scale: its precision is relative, so a
+    /// component of a vector of length 20 is kept to the same three figures as
+    /// the same component scaled to length 1.
+    pub fn to_f16_bytes(&self) -> Vec<u8> {
+        self.embedding.to_f16_bytes_scaled(self.quality)
+    }
+}

 /// A loaded ArcFace graph.
 pub struct Embedder {
-    session: ort::session::Session,
+    session: Model,
    model: ModelId,
 }

@@ -29,12 +65,11 @@ impl Embedder {
    }

    pub fn from_bytes(bytes: &[u8], model: ModelId) -> Result<Self, FaceError> {
-        install_backend();
-
-        let session = ort::session::Session::builder()
-            .map_err(FaceError::Inference)?
-            .commit_from_memory(bytes)
-            .map_err(FaceError::Inference)?;
+        // Always the f32 form: an embedding must compare across devices
+        // (docs/dev/inference.md §7), and the engine pins this role to it.
+        let loaded = dr_inference_engine::open(Role::Embedder, Form::F32, bytes)?;
+        let acquired = loaded.acquire()?;
+        let session = acquired.lock();

        // One output, `[1, 512]`. Checked because an ArcFace variant with a
        // different embedding width would otherwise be read as a truncated
@@ -55,7 +90,12 @@ impl Embedder {
            });
        }

-        Ok(Self { session, model })
+        drop(session);
+        drop(acquired);
+        Ok(Self {
+            session: loaded,
+            model,
+        })
    }

    pub fn model(&self) -> &ModelId {
@@ -63,7 +103,7 @@ impl Embedder {
    }

    /// Embed one aligned face.
-    pub fn embed(&mut self, face: &Aligned112) -> Result<Embedding, FaceError> {
+    pub fn embed(&mut self, face: &Aligned112) -> Result<Embedded, FaceError> {
        // `(x·255 − 127.5) / 128` — see the `/128` note in `detect::Letterbox`.
        let px = face.pixels();
        let mut input = Array4::<f32>::zeros((1, 3, ALIGNED_EDGE, ALIGNED_EDGE));
@@ -76,8 +116,9 @@ impl Embedder {
            }
        }

-        let outputs = self
-            .session
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
            .run(ort::inputs![
                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
            ])
@@ -95,11 +136,14 @@ impl Embedder {

        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
        v.copy_from_slice(&data[..EMBEDDING_DIM]);
-        normalise(&mut v);
+        let quality = normalise(&mut v);

-        Ok(Embedding {
-            model: self.model.clone(),
-            v,
+        Ok(Embedded {
+            embedding: Embedding {
+                model: self.model.clone(),
+                v,
+            },
+            quality,
        })
    }
 }
@@ -1,4 +1,4 @@
-//! What an embedder produces, and how it is stored (docs/faces.md §6).
+//! What an embedder produces, and how it is stored (docs/dev/faces.md §6).
 //!
 //! Deliberately **model-free**: the vector, its identity, its comparison and
 //! its storage encoding are arithmetic, and `calibrate` and `cluster` are built
@@ -12,6 +12,43 @@
 /// Embedding dimensionality. Fixed by the model family, not a parameter.
 pub const EMBEDDING_DIM: usize = 512;

+/// The shortest raw embedding a face may be *compared against*.
+///
+/// # What the length of the vector says
+///
+/// ArcFace is trained on the direction of its output and nothing else, and
+/// the length it leaves behind turns out to be a free quality signal: the
+/// magnitude grows with how recognisable the crop was to the model, and a
+/// blurred, occluded, badly lit or hard-profile face comes out short. MagFace
+/// (Meng et al., CVPR 2021) made that the training objective; the plain
+/// ArcFace heads this crate runs already show it, weaker but usable, which is
+/// why it is worth keeping the number the normalisation discards.
+///
+/// # Why it gates the gallery and not the face
+///
+/// A short vector is a bad *reference*: it sits nearer the centre of the
+/// sphere than a real identity does and matches a little of everyone, which
+/// is exactly the face that welds two people together in a clustering pass.
+/// It is not a bad *probe* — the face is still real, still somebody, and
+/// comparing it against good references is the only way it will ever be named.
+/// So a face below this floor is compared against the gallery and never
+/// becomes part of it: see `cluster::Candidate::in_gallery`.
+///
+/// 14 is the operating point for `w600k_mbf`, whose norms on the reference
+/// library run from about 8 on a blur to the high 20s on a clean portrait. A
+/// face whose quality was never recorded — indexed before the number was kept
+/// — is not gated, because a rule that cannot be checked should admit, not
+/// exclude.
+pub const MIN_GALLERY_QUALITY: f32 = 14.0;
+
+/// Whether an embedding of this quality may serve as a reference.
+///
+/// `None` is "not measured", and is admitted: the rule is about a number that
+/// was read and found short, not about a number that is missing.
+pub fn in_gallery(quality: Option<f32>) -> bool {
+    quality.is_none_or(|q| q >= MIN_GALLERY_QUALITY)
+}
+
 /// Which model produced an embedding.
 ///
 /// Embeddings from different models are not comparable, and this is the one
@@ -58,10 +95,19 @@ impl Embedding {
    }

    /// Storage form: `512 × f16`, 1 KB per face (catalog.md §10.1).
+    ///
+    /// This writes the unit vector. What the catalog stores is the raw one —
+    /// `embed::Embedded::to_f16_bytes` — because the length is the quality
+    /// and a unit vector has none left to read.
    pub fn to_f16_bytes(&self) -> Vec<u8> {
+        self.to_f16_bytes_scaled(1.0)
+    }
+
+    /// The unit vector scaled by `length`, as `512 × f16`.
+    pub(crate) fn to_f16_bytes_scaled(&self, length: f32) -> Vec<u8> {
        let mut out = Vec::with_capacity(EMBEDDING_DIM * 2);
        for &x in self.v.iter() {
-            out.extend_from_slice(&f32_to_f16_bits(x).to_le_bytes());
+            out.extend_from_slice(&f32_to_f16_bits(x * length).to_le_bytes());
        }
        out
    }
@@ -71,25 +117,42 @@ impl Embedding {
    /// The f16 round-trip perturbs a unit vector by ~1e-3 in cosine — three
    /// orders below the separation between a match and a non-match — but the
    /// drift is free to remove and invisible if left, so it is removed here
-    /// rather than remembered at every call site.
+    /// rather than remembered at every call site. The same pass is what turns
+    /// a stored raw vector back into the unit one every comparison expects.
    pub fn from_f16_bytes(model: ModelId, bytes: &[u8]) -> Option<Self> {
-        if bytes.len() != EMBEDDING_DIM * 2 {
-            return None;
-        }
-        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
-        for (i, chunk) in bytes.chunks_exact(2).enumerate() {
-            v[i] = f16_bits_to_f32(u16::from_le_bytes([chunk[0], chunk[1]]));
-        }
-        normalise(&mut v);
-        Some(Self { model, v })
+        read_f16_bytes(model, bytes).map(|(e, _)| e)
    }
 }

+/// Read a stored vector back, with the length it was stored at.
+///
+/// The length is the quality where the blob is a raw one, and ~1 where it is
+/// a unit vector from before raw vectors were stored — which is why the
+/// catalog keeps the quality beside the blob rather than deriving it from
+/// this: a unit vector reads as a quality of 1, not as "unmeasured".
+pub fn read_f16_bytes(model: ModelId, bytes: &[u8]) -> Option<(Embedding, f32)> {
+    if bytes.len() != EMBEDDING_DIM * 2 {
+        return None;
+    }
+    let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+    for (i, chunk) in bytes.chunks_exact(2).enumerate() {
+        v[i] = f16_bits_to_f32(u16::from_le_bytes([chunk[0], chunk[1]]));
+    }
+    let length = normalise(&mut v);
+    Some((Embedding { model, v }, length))
+}
+
 fn dot(a: &[f32; EMBEDDING_DIM], b: &[f32; EMBEDDING_DIM]) -> f32 {
    a.iter().zip(b.iter()).map(|(x, y)| x * y).sum()
 }

-pub(crate) fn normalise(v: &mut [f32; EMBEDDING_DIM]) {
+/// Scale `v` to unit length, and return the length it had.
+///
+/// The length is the one thing about the raw output that survives being
+/// thrown away by everything downstream, and it is a quality signal
+/// ([`MIN_GALLERY_QUALITY`]) — so it comes back out rather than being lost
+/// here.
+pub(crate) fn normalise(v: &mut [f32; EMBEDDING_DIM]) -> f32 {
    // Clamped rather than checked: a zero-norm embedding is a broken model,
    // not a runtime condition worth an error path, and dividing by 1e-6 keeps
    // the NaN out of the catalog.
@@ -97,6 +160,7 @@ pub(crate) fn normalise(v: &mut [f32; EMBEDDING_DIM]) {
    for x in v.iter_mut() {
        *x /= norm;
    }
+    norm
 }

 // ── f16 ───────────────────────────────────────────────────────────────────
@@ -113,9 +177,10 @@ fn f32_to_f16_bits(x: f32) -> u16 {
    let mant = bits & 0x007f_ffff;

    if exp >= 0x1f {
-        // Overflow, inf, or NaN. Embeddings are unit-norm so this is the
-        // broken-model path; infinity is the honest answer, not a clamp that
-        // hides it.
+        // Overflow, inf, or NaN. No component of an embedding exceeds its
+        // length, and the lengths this model produces are in the tens, so
+        // this is the broken-model path; infinity is the honest answer, not a
+        // clamp that hides it.
        return sign
            | 0x7c00
            | if mant != 0 && exp == 0x1f + 112 {
@@ -125,9 +190,9 @@ fn f32_to_f16_bits(x: f32) -> u16 {
            };
    }
    if exp <= 0 {
-        // Subnormal or underflow. A component of a unit 512-vector is ~0.04,
-        // nowhere near here, so this branch exists for correctness rather than
-        // for traffic.
+        // Subnormal or underflow. A component of a unit 512-vector is ~0.04
+        // and a stored one is that times the length, nowhere near here, so
+        // this branch exists for correctness rather than for traffic.
        if exp < -10 {
            return sign;
        }
@@ -208,7 +273,7 @@ mod tests {
        );
    }

-    /// The claim docs/faces.md §6 makes about the storage format: the f16
+    /// The claim docs/dev/faces.md §6 makes about the storage format: the f16
    /// round-trip costs ~1e-3 of cosine, three orders below the separation
    /// between a match and a non-match.
    #[test]
@@ -221,6 +286,42 @@ mod tests {
        }
    }

+    #[test]
+    fn normalising_reports_the_length_it_removed() {
+        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+        v[0] = 3.0;
+        v[1] = 4.0;
+        let norm = normalise(&mut v);
+        assert!((norm - 5.0).abs() < 1e-6, "norm {norm}");
+        assert!((v[0] - 0.6).abs() < 1e-6 && (v[1] - 0.8).abs() < 1e-6);
+    }
+
+    /// The gate admits what it cannot measure: a face from before the number
+    /// was kept is not a face that was found wanting.
+    #[test]
+    fn an_unmeasured_quality_is_admitted_to_the_gallery() {
+        assert!(in_gallery(None));
+        assert!(in_gallery(Some(MIN_GALLERY_QUALITY)));
+        assert!(in_gallery(Some(27.5)));
+        assert!(!in_gallery(Some(MIN_GALLERY_QUALITY - 0.01)));
+        assert!(!in_gallery(Some(8.0)));
+    }
+
+    /// The storage form carries the length, and the length comes back out —
+    /// without touching the direction every comparison is made on.
+    #[test]
+    fn a_raw_vector_round_trips_with_its_length() {
+        let e = unit(3);
+        let raw = e.to_f16_bytes_scaled(21.5);
+        let (back, length) = read_f16_bytes(e.model.clone(), &raw).unwrap();
+        assert!((length - 21.5).abs() < 0.05, "length {length}");
+        assert!(e.cosine(&back).unwrap() > 0.9999);
+        // A unit vector from an older store reads as length 1, not as an
+        // error — see `read_f16_bytes` on why that is not "unmeasured".
+        let (_, one) = read_f16_bytes(e.model.clone(), &e.to_f16_bytes()).unwrap();
+        assert!((one - 1.0).abs() < 1e-2, "length {one}");
+    }
+
    #[test]
    fn f16_round_trip_rejects_a_wrong_length_blob() {
        assert!(Embedding::from_f16_bytes(ModelId::new("m"), &[0u8; 100]).is_none());
@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! What a face's eyes are doing, and how the numbers behind it are read.
+//!
+//! Model-free: the models in [`crate::classify`] produce the numbers, and
+//! everything that interprets them — the catalog's filter, the People
+//! screen's label — comes through here, so a threshold lives in exactly one
+//! place.
+//!
+//! # Seven numbers, one answer
+//!
+//! An eye classifier answers "open or closed" for whatever it is shown, and
+//! it is shown three things it cannot answer for. **Dark glass**: over
+//! sunglasses it answers anyway, confidently, for a state that cannot be
+//! seen — so the reading carries P(sunglasses) from a classifier that looks
+//! at the whole head, and that takes precedence. **A smear**: a soft eye is
+//! not a closed one, but shown a blur the classifier says "closed" with the
+//! same confidence it says anything, and on the reference library that was
+//! the commonest wrong answer of all — small faces, motion, a proxy where
+//! the native render should have been. So each eye carries how many source
+//! pixels it spanned and how sharp the patch was, and an eye under either
+//! floor is not asked. **A cheek**: a head turned far enough hides its far
+//! eye, and the landmark contour of a hidden eye collapses to a sliver; an
+//! eye much narrower than its partner is not asked either.
+//!
+//! The two eyes are kept apart rather than averaged. A wink is one eye
+//! closed, and averaging it lands at 0.5 — the one value that says the least.
+//! [`EyeState::Open`] requires every eye that *could be read* to be open;
+//! a face with no readable eye is [`EyeState::Unreadable`], which is not a
+//! blink and not open, and a filter for either leaves it alone.
+
+/// One eye's numbers.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Eye {
+    /// P(open), the classifier's sigmoid.
+    pub open: f32,
+    /// Source pixels across the eye box — [`crate::align::EyePatch::source_px`].
+    pub px: f32,
+    /// [`crate::align::EyePatch::sharpness`] of the patch the classifier saw.
+    pub sharpness: f32,
+}
+
+/// The numbers the models produced for one face.
+///
+/// Stored per face, nullable as a whole: a face indexed before the eye models
+/// existed, or on a device without them, has no reading rather than a
+/// reading of zeros.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct EyeReading {
+    /// The subject's **right** eye — image-left.
+    pub right: Eye,
+    /// The subject's **left** eye — image-right.
+    pub left: Eye,
+    /// P(the head wears sunglasses).
+    pub sunglasses: f32,
+}
+
+/// Above this an eye is open. The classifier's own decision point; its
+/// training put the two classes either side of a sigmoid and this is where
+/// the sigmoid crosses.
+pub const EYES_OPEN_THRESHOLD: f32 = 0.5;
+
+/// Above this the head wears sunglasses and the eye readings are moot.
+pub const SUNGLASSES_THRESHOLD: f32 = 0.5;
+
+/// Fewest source pixels across an eye box for the eye to be read.
+///
+/// The classifier was trained on eyes down to about a dozen pixels wide
+/// (its reference footage averaged 15–21); below that the 40-pixel patch is
+/// an interpolation of nothing, and the answer is noise that reads as
+/// "closed". docs/dev/faces.md §17.3 has the measurement behind the number.
+pub const MIN_EYE_PX: f32 = 12.0;
+
+/// Least [`Eye::sharpness`] for the eye to be read.
+///
+/// The same measure as the face's `min_sharpness`, over the eye patch, and
+/// chosen the same way: the value under which the open-eyed faces of the
+/// reference sample were being called closed. docs/dev/faces.md §17.3.
+pub const MIN_EYE_SHARPNESS: f32 = 0.02;
+
+/// An eye narrower than this fraction of its partner is the far eye of a
+/// turned head, out of view behind the nose, and is not read.
+///
+/// A landmark model's contour for a hidden eye collapses towards the nose.
+/// Measured on twenty native renders of the reference library
+/// (docs/dev/faces.md §17.4): profiles put the far eye at 0.02–0.43 of the near
+/// one, two three-quarter faces whose far eye read closed sat at 0.54, and
+/// every face looking at the camera — winks included, since a shut eye's
+/// box keeps its width — sat at 0.78 or more. 0.6 splits the gap.
+pub const HIDDEN_EYE_RATIO: f32 = 0.6;
+
+/// What the reading says, for a screen or a filter.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EyeState {
+    /// Every eye that could be read is open.
+    Open,
+    /// An eye that could be read is closed — a blink, or a wink.
+    Closed,
+    /// The eyes cannot be seen. Neither open nor closed, and a filter for
+    /// either leaves the face alone.
+    Sunglasses,
+    /// No eye was sharp enough, large enough and in view to read. Neither
+    /// open nor closed, like sunglasses, and left alone by every filter.
+    Unreadable,
+}
+
+impl Eye {
+    /// Whether this eye can be read at all: enough pixels, sharp enough,
+    /// and not the collapsed contour of a hidden eye — measured against
+    /// `other`, its partner.
+    pub fn readable(&self, other: &Eye) -> bool {
+        self.px >= MIN_EYE_PX
+            && self.sharpness >= MIN_EYE_SHARPNESS
+            && self.px >= other.px * HIDDEN_EYE_RATIO
+    }
+}
+
+impl EyeReading {
+    pub fn state(&self) -> EyeState {
+        if self.sunglasses >= SUNGLASSES_THRESHOLD {
+            return EyeState::Sunglasses;
+        }
+        let readable = [
+            self.right.readable(&self.left).then_some(self.right.open),
+            self.left.readable(&self.right).then_some(self.left.open),
+        ];
+        let mut any = false;
+        for open in readable.into_iter().flatten() {
+            any = true;
+            if open < EYES_OPEN_THRESHOLD {
+                return EyeState::Closed;
+            }
+        }
+        if any {
+            EyeState::Open
+        } else {
+            EyeState::Unreadable
+        }
+    }
+
+    /// Whether this is a face a "no one blinking" filter should drop.
+    ///
+    /// The filter's question, rather than [`EyeState`]'s four-way answer,
+    /// because the two differ on exactly the cases that matter: a face
+    /// behind sunglasses, or one whose eyes could not be read, is not open
+    /// — and it is not a blink either. Only [`EyeState::Closed`] is one.
+    pub fn is_blink(&self) -> bool {
+        self.state() == EyeState::Closed
+    }
+}
+
+impl EyeState {
+    /// The word the People screen puts on the face.
+    pub fn label(&self) -> &'static str {
+        match self {
+            EyeState::Open => "Eyes open",
+            EyeState::Closed => "Eyes closed",
+            EyeState::Sunglasses => "Sunglasses",
+            EyeState::Unreadable => "Eyes unclear",
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn eye(open: f32) -> Eye {
+        Eye {
+            open,
+            px: 40.0,
+            sharpness: 0.1,
+        }
+    }
+
+    fn reading(right: f32, left: f32, sunglasses: f32) -> EyeReading {
+        EyeReading {
+            right: eye(right),
+            left: eye(left),
+            sunglasses,
+        }
+    }
+
+    #[test]
+    fn both_eyes_open_is_open() {
+        assert_eq!(reading(0.9, 0.8, 0.1).state(), EyeState::Open);
+        assert!(!reading(0.9, 0.8, 0.1).is_blink());
+    }
+
+    /// A wink is not "eyes open": one eye closed lands the same place a
+    /// blink does, and a filter for "nobody blinking" should drop it.
+    #[test]
+    fn one_eye_closed_is_closed() {
+        assert_eq!(reading(0.9, 0.2, 0.1).state(), EyeState::Closed);
+        assert_eq!(reading(0.2, 0.9, 0.1).state(), EyeState::Closed);
+        assert!(reading(0.2, 0.9, 0.1).is_blink());
+    }
+
+    /// The whole reason the sunglasses number exists: whatever the eye
+    /// classifier says over dark glass, it is not a reading of the eyes.
+    #[test]
+    fn sunglasses_override_the_eye_readings_either_way() {
+        assert_eq!(reading(0.9, 0.9, 0.8).state(), EyeState::Sunglasses);
+        assert_eq!(reading(0.1, 0.1, 0.8).state(), EyeState::Sunglasses);
+        assert!(!reading(0.1, 0.1, 0.8).is_blink());
+    }
+
+    /// A soft or tiny eye is not asked; if neither can be, the face is
+    /// unreadable rather than closed.
+    #[test]
+    fn a_soft_or_tiny_eye_is_not_read() {
+        let mut r = reading(0.1, 0.9, 0.0);
+        r.right.sharpness = MIN_EYE_SHARPNESS / 2.0;
+        assert_eq!(r.state(), EyeState::Open, "the soft closed eye is ignored");
+
+        let mut r = reading(0.1, 0.9, 0.0);
+        r.right.px = MIN_EYE_PX - 1.0;
+        assert_eq!(r.state(), EyeState::Open, "the tiny closed eye is ignored");
+
+        let mut r = reading(0.1, 0.1, 0.0);
+        r.right.sharpness = 0.0;
+        r.left.px = 3.0;
+        assert_eq!(r.state(), EyeState::Unreadable);
+        assert!(!r.is_blink());
+        assert_eq!(r.state().label(), "Eyes unclear");
+    }
+
+    /// A profile: the far eye's contour collapses, and the sliver is not
+    /// read. The near eye still decides.
+    #[test]
+    fn a_turned_heads_collapsed_far_eye_is_not_read() {
+        let mut r = reading(0.05, 0.95, 0.0);
+        r.right.px = 40.0 * HIDDEN_EYE_RATIO - 1.0;
+        assert!(!r.right.readable(&r.left));
+        assert_eq!(r.state(), EyeState::Open);
+
+        let mut blink = reading(0.95, 0.05, 0.0);
+        blink.right.px = 40.0 * HIDDEN_EYE_RATIO - 1.0;
+        assert_eq!(blink.state(), EyeState::Closed);
+
+        // Both eyes narrow but alike is not a turned head: both count.
+        let mut small = reading(0.05, 0.95, 0.0);
+        small.right.px = 14.0;
+        small.left.px = 14.0;
+        assert_eq!(small.state(), EyeState::Closed);
+    }
+
+    #[test]
+    fn the_thresholds_are_inclusive_at_the_decision_point() {
+        assert_eq!(
+            reading(EYES_OPEN_THRESHOLD, EYES_OPEN_THRESHOLD, 0.0).state(),
+            EyeState::Open
+        );
+        assert_eq!(
+            reading(1.0, 1.0, SUNGLASSES_THRESHOLD).state(),
+            EyeState::Sunglasses
+        );
+        let mut r = reading(1.0, 1.0, 0.0);
+        r.right.px = MIN_EYE_PX;
+        r.left.px = MIN_EYE_PX;
+        r.right.sharpness = MIN_EYE_SHARPNESS;
+        assert!(r.right.readable(&r.left));
+    }
+}
@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! Dense facial landmarks — InsightFace's `2d106det` (docs/dev/faces.md §17.2).
+//!
+//! SCRFD's five points place a face; they do not place an eye. Its eye
+//! point is loose enough that a window centred on it left the eye in a
+//! corner on turned and smiling heads, and two model-free ways of
+//! re-centring it made things worse. So a second model draws the eye's lid
+//! contour, and the eye box is cut from that.
+//!
+//! **Why this one.** Three were measured on the same faces — MediaPipe Face
+//! Mesh V2, PIPNet and this — and tied on what the eye classifier made of
+//! their boxes (22 of 25 open eyes read open, against 19 from the SCRFD
+//! point). This is the cheapest of the three by a wide margin (5 MB, 106
+//! points, ~24 ms in tract), and it is under the grant the detector and
+//! embedder already carry rather than a new one to read.
+//!
+//! # Pre-processing
+//!
+//! Ported from InsightFace's `landmark.py`: a square crop centred on the
+//! detector box, 1.5× its longer edge, resized to 192; **RGB in 0..255**
+//! (the graph carries its own `bn_data` normalisation, so `input_mean` is
+//! 0 and `input_std` 1); 106 `(x, y)` in −1..1 mapped back through
+//! `(p + 1) · 96`. The graph's batch dimension is the literal `None` and
+//! is pinned to 1 by `tools/fix-face-model-shapes.sh`, like the embedder's.
+//!
+//! # The layout
+//!
+//! Checked by drawing the points on the reference faces rather than taken
+//! from a diagram: the subject's right eye (image-left) is points 33–42,
+//! the left 87–96, ten each round the lids.
+
+use ndarray::Array4;
+
+use crate::align::crop_box;
+use crate::{FaceError, Pixels};
+use dr_inference_engine::{Form, Model, Role};
+
+/// The graph's input edge, in pixels.
+pub const INPUT_EDGE: usize = 192;
+
+/// How many points the model returns.
+pub const POINTS: usize = 106;
+
+/// The crop's edge as a multiple of the detector box's longer edge.
+const CROP_SCALE: f32 = 1.5;
+
+/// The span of the frame, in long-edge units, the packed form covers: a
+/// quarter of the frame outside each edge.
+pub const PACKED_RANGE: (f32, f32) = (-0.25, 1.25);
+
+/// Bytes the packed form of one face's landmarks takes.
+pub const PACKED_BYTES: usize = POINTS * 4;
+
+/// Point indices of the subject's right eye's lid contour (image-left).
+pub const RIGHT_EYE: [usize; 10] = [33, 34, 35, 36, 37, 38, 39, 40, 41, 42];
+/// Point indices of the subject's left eye's lid contour (image-right).
+pub const LEFT_EYE: [usize; 10] = [87, 88, 89, 90, 91, 92, 93, 94, 95, 96];
+
+/// The 106 points of one face, in **source pixels**.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Landmarks {
+    pub points: [(f32, f32); POINTS],
+}
+
+impl Landmarks {
+    /// Storage form: `106 × (x, y)` as little-endian **`u16` fixed point**
+    /// over the frame, 424 bytes.
+    ///
+    /// Each coordinate is normalised by `long_edge` like the five points the
+    /// catalog already keeps, then mapped over [`PACKED_RANGE`] — a quarter
+    /// of the frame either side of it, because a landmark on a face at the
+    /// edge does land outside the image — onto 0..65535. That is 0.14 source
+    /// pixels on a 6000-pixel frame. `f16` would be the same size and worse:
+    /// its three significant figures near 1.0 are six pixels at that scale,
+    /// and the eye contour this is kept for is drawn to the pixel.
+    pub fn to_packed_bytes(&self, long_edge: f32) -> Vec<u8> {
+        let (lo, hi) = PACKED_RANGE;
+        let pack = |v: f32| -> [u8; 2] {
+            let t = ((v / long_edge - lo) / (hi - lo)).clamp(0.0, 1.0);
+            ((t * 65535.0).round() as u16).to_le_bytes()
+        };
+        let mut out = Vec::with_capacity(POINTS * 4);
+        for &(x, y) in &self.points {
+            out.extend_from_slice(&pack(x));
+            out.extend_from_slice(&pack(y));
+        }
+        out
+    }
+
+    /// [`Self::to_packed_bytes`] read back, into source pixels of a frame
+    /// with this `long_edge`. `None` for a blob of the wrong length.
+    pub fn from_packed_bytes(bytes: &[u8], long_edge: f32) -> Option<Self> {
+        if bytes.len() != POINTS * 4 {
+            return None;
+        }
+        let (lo, hi) = PACKED_RANGE;
+        let unpack = |b: &[u8]| -> f32 {
+            let t = u16::from_le_bytes([b[0], b[1]]) as f32 / 65535.0;
+            (t * (hi - lo) + lo) * long_edge
+        };
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            let at = i * 4;
+            *p = (unpack(&bytes[at..at + 2]), unpack(&bytes[at + 2..at + 4]));
+        }
+        Some(Self { points })
+    }
+
+    /// The lid contour of the subject's right eye.
+    pub fn right_eye(&self) -> [(f32, f32); 10] {
+        RIGHT_EYE.map(|i| self.points[i])
+    }
+
+    /// The lid contour of the subject's left eye.
+    pub fn left_eye(&self) -> [(f32, f32); 10] {
+        LEFT_EYE.map(|i| self.points[i])
+    }
+}
+
+/// A loaded `2d106det` graph.
+pub struct Landmarker {
+    session: Model,
+}
+
+impl Landmarker {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        let model = dr_inference_engine::open(Role::Landmarks, Form::F32, bytes)?;
+        let acquired = model.acquire()?;
+        let session = acquired.lock();
+
+        let input = session.inputs().first().ok_or(FaceError::WrongModel {
+            expected: "2d106det",
+            detail: "model has no inputs".into(),
+        })?;
+        let shape: Option<Vec<i64>> = input.dtype().tensor_shape().map(|s| s.to_vec());
+        let want = [1, 3, INPUT_EDGE as i64, INPUT_EDGE as i64];
+        if shape.as_deref() != Some(&want[..]) {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!(
+                    "input '{}' is {:?}, expected {:?} (batch pinned to 1)",
+                    input.name(),
+                    shape,
+                    want
+                ),
+            });
+        }
+        let out = session.outputs().first().ok_or(FaceError::WrongModel {
+            expected: "2d106det",
+            detail: "model has no outputs".into(),
+        })?;
+        let last: Option<i64> = out.dtype().tensor_shape().and_then(|d| d.last().copied());
+        if last != Some((POINTS * 2) as i64) {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!(
+                    "output '{}' is {:?}-wide, expected {}",
+                    out.name(),
+                    last,
+                    POINTS * 2
+                ),
+            });
+        }
+        drop(session);
+        drop(acquired);
+        Ok(Self { session: model })
+    }
+
+    /// The landmarks of the face in `bbox` — `(x0, y0, x1, y1)` in source
+    /// pixels, the detector's box — read from the source.
+    ///
+    /// `None` for a box with no area or a buffer that is not the size it
+    /// claims, as every crop here.
+    pub fn landmarks(
+        &mut self,
+        px: Pixels<'_>,
+        width: usize,
+        height: usize,
+        bbox: (f32, f32, f32, f32),
+    ) -> Result<Option<Landmarks>, FaceError> {
+        let (w, h) = (bbox.2 - bbox.0, bbox.3 - bbox.1);
+        let side = w.max(h) * CROP_SCALE;
+        let (cx, cy) = ((bbox.0 + bbox.2) / 2.0, (bbox.1 + bbox.3) / 2.0);
+        let (x0, y0) = (cx - side / 2.0, cy - side / 2.0);
+        let Some(crop) = crop_box(
+            px,
+            width,
+            height,
+            (x0, y0, side, side),
+            INPUT_EDGE,
+            INPUT_EDGE,
+        ) else {
+            return Ok(None);
+        };
+
+        let e = INPUT_EDGE;
+        let mut input = Array4::<f32>::zeros((1, 3, e, e));
+        for y in 0..e {
+            for x in 0..e {
+                for c in 0..3 {
+                    input[[0, c, y, x]] = crop[(y * e + x) * 3 + c] * 255.0;
+                }
+            }
+        }
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
+            .run(ort::inputs![
+                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+            ])
+            .map_err(FaceError::Inference)?;
+        let (_, data) = outputs[0]
+            .try_extract_tensor::<f32>()
+            .map_err(FaceError::Inference)?;
+        if data.len() < POINTS * 2 {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!("got {} values, expected {}", data.len(), POINTS * 2),
+            });
+        }
+
+        // −1..1 in the crop → crop pixels → source pixels.
+        let scale = side / e as f32;
+        let half = e as f32 / 2.0;
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            let (u, v) = ((data[2 * i] + 1.0) * half, (data[2 * i + 1] + 1.0) * half);
+            *p = (x0 + u * scale, y0 + v * scale);
+        }
+        Ok(Some(Landmarks { points }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Packed and unpacked, every point comes back within a fifth of a
+    /// source pixel on a 6000-pixel frame — including one outside the
+    /// image, which a face at the edge does produce.
+    #[test]
+    fn dense_landmarks_round_trip_through_their_packed_bytes() {
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            *p = (i as f32 * 37.3 - 200.0, 5900.0 - i as f32 * 11.1);
+        }
+        let lm = Landmarks { points };
+        let bytes = lm.to_packed_bytes(6000.0);
+        assert_eq!(bytes.len(), PACKED_BYTES);
+        assert_eq!(PACKED_BYTES, 424);
+        let back = Landmarks::from_packed_bytes(&bytes, 6000.0).unwrap();
+        for (a, b) in lm.points.iter().zip(back.points.iter()) {
+            assert!((a.0 - b.0).abs() < 0.2, "{} vs {}", a.0, b.0);
+            assert!((a.1 - b.1).abs() < 0.2, "{} vs {}", a.1, b.1);
+        }
+        assert!(Landmarks::from_packed_bytes(&bytes[..100], 6000.0).is_none());
+    }
+}
@@ -1,8 +1,10 @@
-//! Faces and identity (S14, docs/faces.md).
+//! Faces and identity (S14, docs/dev/faces.md).
 //!
-//! Two models, run over the proxy tier, producing per face a box, five
+//! Two models, run over the native render, producing per face a box, five
 //! landmarks, a confidence and a 512-d embedding (FR-CULL-8) — and then the
-//! arithmetic that turns embeddings into people (FR-CULL-9, FR-CULL-10).
+//! arithmetic that turns embeddings into people (FR-CULL-9, FR-CULL-10). Two
+//! more, optional, read each face's eyes and whether sunglasses hide them
+//! (FR-CULL-8a, [`classify`] and [`eyes`]).
 //!
 //! Like `dr-segment`, this crate is **device-free**: no GPU adapter, no
 //! Slint, nothing that needs a display. Unlike `dr-segment`, it carries **no
@@ -19,8 +21,9 @@
 //! for a packaging script to switch on. The application obtains a model at
 //! runtime; this crate takes bytes and never fetches anything.
 //!
-//! docs/faces.md §2 is the full reading, including what would have to change
-//! for that to stop being true.
+//! docs/dev/faces.md §2 is the full reading, including what would have to change
+//! for that to stop being true. The eye-state models are the exception: MIT,
+//! weights and all, and shipped in `models/face/` (docs/dev/faces.md §17).
 //!
 //! # Why the runtime is split behind a feature
 //!
@@ -34,19 +37,25 @@
 pub mod align;
 pub mod assign;
 pub mod calibrate;
+#[cfg(feature = "inference")]
+pub mod classify;
 pub mod cluster;
 #[cfg(feature = "inference")]
 pub mod detect;
 #[cfg(feature = "inference")]
 pub mod embed;
 pub mod embedding;
+pub mod eyes;
+#[cfg(feature = "inference")]
+pub mod landmarks;
 pub mod naming;
 pub mod neighbours;
+pub mod references;

 /// Smallest long edge a face crop may be sampled from.
 ///
 /// **A floor on the crop source, not on the detector input.** The distinction
-/// is the whole of FR-CULL-8 and `docs/faces.md` §7: detection letterboxes
+/// is the whole of FR-CULL-8 and `docs/dev/faces.md` §7: detection letterboxes
 /// every buffer into 640×640, so its input resolution decides nothing, while
 /// [`warp`] samples the 112×112 the embedder sees and so converts source
 /// resolution directly into embedding quality. FR-CULL-8 requires that crop to
@@ -65,18 +74,29 @@ pub mod neighbours;
 pub const MIN_CROP_EDGE: u32 = 1025;

 pub use align::{
-    warp, warp_pixels, Aligned112, Pixels, Similarity, ALIGNED_EDGE, ARCFACE_TEMPLATE,
+    crop_box, eye_box, eye_patch, head_views, warp, warp_pixels, Aligned112, EyePatch, HeadViews,
+    Pixels, Similarity, ALIGNED_EDGE, ARCFACE_TEMPLATE,
 };
 pub use assign::{identity_shares, RIVAL_FLOOR, TOP_MATCHES};
 pub use calibrate::{Calibration, Pairs, ReliabilityBand};
+#[cfg(feature = "inference")]
+pub use classify::{EyeClassifier, EyeModels, SunglassesClassifier};
 pub use cluster::{
    cluster, cluster_scored, split, Candidate, Cluster, Grouping, DEFAULT_MERGE_PROBABILITY,
 };
 #[cfg(feature = "inference")]
 pub use detect::{DetectOptions, Detection, Detector};
 #[cfg(feature = "inference")]
-pub use embed::Embedder;
-pub use embedding::{Embedding, ModelId, EMBEDDING_DIM};
+pub use embed::{Embedded, Embedder};
+pub use embedding::{
+    in_gallery, read_f16_bytes, Embedding, ModelId, EMBEDDING_DIM, MIN_GALLERY_QUALITY,
+};
+pub use eyes::{
+    Eye, EyeReading, EyeState, EYES_OPEN_THRESHOLD, HIDDEN_EYE_RATIO, MIN_EYE_PX,
+    MIN_EYE_SHARPNESS, SUNGLASSES_THRESHOLD,
+};
+#[cfg(feature = "inference")]
+pub use landmarks::{Landmarker, Landmarks};
 pub use naming::{name_for_instance, name_instances, NamedFace};

 /// What can go wrong between an image and a face.
@@ -105,25 +125,21 @@ pub enum FaceError {
    ImageShape { expected: usize, got: usize },
 }

-/// Install tract as `ort`'s backend.
-///
-/// Idempotent, and it must happen before any other `ort` call: with
-/// `alternative-backend` there is no linked runtime to fall back on, so an
-/// un-set API is a panic rather than a slow path. Same helper as
-/// `dr-segment::semantic`, for the same reason.
 #[cfg(feature = "inference")]
-pub(crate) fn install_backend() {
-    use std::sync::Once;
-    static ONCE: Once = Once::new();
-    ONCE.call_once(|| {
-        let _ = ort::set_api(ort_tract::api());
-    });
+impl From<dr_inference_engine::Error> for FaceError {
+    fn from(e: dr_inference_engine::Error) -> Self {
+        match e {
+            dr_inference_engine::Error::Inference(e) => FaceError::Inference(e),
+            dr_inference_engine::Error::Io(e) => FaceError::ModelRead(e),
+        }
+    }
 }

-/// [`install_backend`] for the M1 probe example, which drives `ort` directly
-/// rather than through [`detect::Detector`] so it can report the raw error.
+/// Make sure `ort` has a backend, for the M1 probe example, which drives
+/// `ort` directly rather than through [`detect::Detector`] so it can report
+/// the raw error. Every other path goes through `dr-inference-engine`.
 #[cfg(feature = "inference")]
 #[doc(hidden)]
 pub fn install_backend_for_probe() {
-    install_backend();
+    dr_inference_engine::ensure_runtime();
 }
@@ -115,8 +115,19 @@ pub struct Faces<'a> {
    /// Source pixels across the aligned crop, for the calibration's size term.
    pub crop_px: &'a [f32],
    /// Which photograph each face came from. Two faces in one frame are not
-    /// the same person, so those pairs are never returned (docs/faces.md §9).
+    /// the same person, so those pairs are never returned (docs/dev/faces.md §9).
    pub images: &'a [u64],
+    /// Which faces may be compared *against* — the gallery
+    /// ([`crate::embedding::MIN_GALLERY_QUALITY`]).
+    ///
+    /// A pair needs at least one gallery side: a probe measured against a
+    /// reference is a comparison, two short vectors measured against each
+    /// other is noise agreeing with noise, and those pairs are never returned.
+    /// Filtered here rather than by the caller for the same reason
+    /// co-occurrence is: what this module leaves out of the list stays out of
+    /// the graph, the components and the merge order, so nothing downstream
+    /// has to remember the rule.
+    pub gallery: &'a [bool],
 }

 impl Faces<'_> {
@@ -272,8 +283,9 @@ fn scan_rows(scan: &Scan, from: usize, to: usize, out: &mut Vec<Pair>) {
            let a = faces.row(i);
            let crop_a = faces.crop_px[i];
            let image_a = faces.images[i];
+            let gallery_a = faces.gallery[i];
            for j in start..tile_end {
-                if image_a == faces.images[j] {
+                if image_a == faces.images[j] || !(gallery_a || faces.gallery[j]) {
                    continue;
                }
                let cos = dot(a, faces.row(j));
@@ -552,6 +564,7 @@ mod tests {
        embeddings: Vec<f32>,
        crop_px: Vec<f32>,
        images: Vec<u64>,
+        gallery: Vec<bool>,
    }

    impl Set {
@@ -561,6 +574,7 @@ mod tests {
                dim: DIM,
                crop_px: &self.crop_px,
                images: &self.images,
+                gallery: &self.gallery,
            }
        }

@@ -588,10 +602,12 @@ mod tests {
            }
        }
        let crop_px = vec![150.0; embeddings.len()];
+        let gallery = vec![true; embeddings.len()];
        Set {
            embeddings: embeddings.concat(),
            crop_px,
            images,
+            gallery,
        }
    }

@@ -601,7 +617,7 @@ mod tests {
        let mut out = Vec::new();
        for i in 0..n {
            for j in i + 1..n {
-                if faces.images[i] == faces.images[j] {
+                if faces.images[i] == faces.images[j] || !(faces.gallery[i] || faces.gallery[j]) {
                    continue;
                }
                let cos: f32 = faces
@@ -750,6 +766,35 @@ mod tests {
        assert!(above_threshold(&s.faces(), &cal(), 0.9).is_empty());
    }

+    /// A probe against a reference is a comparison; two probes against each
+    /// other is not. The rule lives here so that nothing downstream sees the
+    /// pair at all.
+    #[test]
+    fn two_faces_outside_the_gallery_are_never_paired() {
+        let mut s = population(1, 3, 1.0);
+        s.gallery = vec![false, false, true];
+        let pairs = above_threshold(&s.faces(), &cal(), 0.9);
+        assert!(
+            !pairs.iter().any(|p| p.i == 0 && p.j == 1),
+            "two probes were paired with each other"
+        );
+        // Each probe is still measured against the one reference.
+        assert!(pairs.iter().any(|p| p.i == 0 && p.j == 2));
+        assert!(pairs.iter().any(|p| p.i == 1 && p.j == 2));
+    }
+
+    #[test]
+    fn the_gallery_rule_matches_the_reference_at_scale() {
+        let mut s = population(60, 8, 0.97);
+        for (i, g) in s.gallery.iter_mut().enumerate() {
+            *g = i % 3 != 0;
+        }
+        let f = s.faces();
+        let got = above_threshold(&f, &cal(), 0.9);
+        let want = reference(&f, &cal(), 0.9);
+        assert!(same_pairs(&got, &want), "{} vs {}", got.len(), want.len());
+    }
+
    #[test]
    fn pairs_come_back_in_index_order() {
        let s = population(300, 8, 0.97);
@@ -0,0 +1,232 @@
+//! TRACES: FR-CULL-10 | NFR-P9
+//! Which of a person's faces stand for them in a grouping pass.
+//!
+//! # Why not all of them
+//!
+//! Every face the user has ruled on enters [`crate::cluster`] as an anchor,
+//! and the pass compares every face against every other
+//! ([`crate::neighbours`] is exhaustive by design). So a person with 750
+//! confirmed faces costs 750 comparisons against each of the library's other
+//! faces, and the cost of naming a library well grows with how well it is
+//! named: a fully confirmed library of 25,000 faces spends almost the whole
+//! scan re-comparing faces whose identity is already settled against each
+//! other.
+//!
+//! Most of those comparisons say nothing new. A person's confirmed faces are
+//! heavily redundant — thirty frames from one afternoon are one point of
+//! view, not thirty — and a new face that matches one of them matches the
+//! others too. What a new face needs to be measured against is the person's
+//! *range*: the angles, ages and lights they have been photographed in, each
+//! represented once.
+//!
+//! # The choice: the most diverse of the good ones
+//!
+//! Two rules, in order.
+//!
+//! **Good enough to vouch.** Only faces whose raw embedding was at least
+//! [`MIN_REFERENCE_QUALITY`] long are eligible — a stricter floor than the
+//! gallery's ([`crate::embedding::MIN_GALLERY_QUALITY`]), because a reference
+//! is asked to speak *for* a person rather than merely be admitted to the
+//! comparison. A face whose length was never recorded is admitted, as it is
+//! everywhere else: a rule that cannot be checked admits rather than excludes.
+//!
+//! **As far apart as possible.** From the eligible pool, up to
+//! [`MAX_REFERENCES`] faces are chosen to maximise the volume they span —
+//! the determinant of their Gram matrix — greedily: start from the longest
+//! vector, and at each step add the face with the largest component
+//! orthogonal to everything chosen so far. That is Gram–Schmidt with a
+//! pivot, and the product of the squared residuals it picks *is* the
+//! determinant, so the greedy step is the exact greedy on the objective.
+//! The effect is that a near-duplicate of a chosen face has almost no
+//! residual and is passed over, while the one profile shot among two
+//! hundred frontal frames is taken early.
+//!
+//! What is not chosen still belongs to the person. Those faces keep their
+//! confirmations and are not touched by the pass; they are simply not
+//! compared, which is the whole saving.
+
+/// The most faces that stand for one person.
+///
+/// A hundred is far more points of view than a person has. What it bounds
+/// is the cost: with every person at the cap, a scan against the named part
+/// of a library is `people × 100` comparisons per face rather than
+/// `confirmations`, and the two part company as soon as a library is used.
+pub const MAX_REFERENCES: usize = 100;
+
+/// The shortest raw embedding that may stand for a person.
+///
+/// One above the gallery floor: a reference vouches for someone, and the
+/// margin keeps the faces that only just cleared the gallery — the ones
+/// nearest the middle of the sphere — out of the set that speaks for a
+/// person.
+pub const MIN_REFERENCE_QUALITY: f32 = 15.0;
+
+/// Whether a face of this quality may stand for a person.
+///
+/// `None` is "never measured" and is admitted, as in
+/// [`crate::embedding::in_gallery`].
+pub fn eligible(quality: Option<f32>) -> bool {
+    quality.is_none_or(|q| q >= MIN_REFERENCE_QUALITY)
+}
+
+/// Choose which of one person's faces stand for them.
+///
+/// `embeddings` and `quality` are one entry per face, the embeddings unit
+/// length and all of one dimension. Returns the indices chosen, in the order
+/// chosen — the first is the longest eligible vector, and each after it is
+/// the one furthest from the span of those before. Every eligible face is
+/// returned when there are `max` or fewer of them, so a person under the
+/// cap loses nothing.
+///
+/// Deterministic: equal residuals break on the longer vector, then the lower
+/// index, so two devices holding the same faces choose the same references
+/// and group the same way (`cluster::clustering_is_deterministic`).
+pub fn select(embeddings: &[&[f32]], quality: &[Option<f32>], max: usize) -> Vec<usize> {
+    debug_assert_eq!(embeddings.len(), quality.len());
+    let mut pool: Vec<usize> = (0..embeddings.len())
+        .filter(|&i| eligible(quality[i]))
+        .collect();
+    if pool.len() <= max {
+        return pool;
+    }
+    // Longest first, so the seed is the pool's front and a tie on residual
+    // resolves to the earlier position. A missing reading ranks below any
+    // measured one for this purpose only: it is admitted, but a face that
+    // was measured and found long is the better seed.
+    pool.sort_by(|&a, &b| {
+        let qa = quality[a].unwrap_or(0.0);
+        let qb = quality[b].unwrap_or(0.0);
+        qb.total_cmp(&qa).then(a.cmp(&b))
+    });
+
+    // Residuals: what remains of each pool vector outside the span of the
+    // chosen ones. Copied, since they are rewritten in place.
+    let mut residual: Vec<Vec<f32>> = pool.iter().map(|&i| embeddings[i].to_vec()).collect();
+    let mut taken = vec![false; pool.len()];
+    let mut chosen = Vec::with_capacity(max);
+
+    while chosen.len() < max {
+        // The face with the most left outside the span. The seed is the
+        // pool's front by construction: every unit vector has the same
+        // residual before anything is chosen, up to rounding, and rounding
+        // is not a reason to prefer one. After that `> best` and not `>=`,
+        // so a genuine tie keeps the earlier (longer) candidate.
+        let mut pick = None;
+        let mut best = 0.0_f32;
+        if chosen.is_empty() {
+            pick = Some(0);
+            best = residual[0].iter().map(|x| x * x).sum();
+        } else {
+            for (k, r) in residual.iter().enumerate() {
+                if taken[k] {
+                    continue;
+                }
+                let n2: f32 = r.iter().map(|x| x * x).sum();
+                if n2 > best {
+                    best = n2;
+                    pick = Some(k);
+                }
+            }
+        }
+        // Nothing left outside the span: every remaining face is a
+        // combination of the chosen ones and adds no volume.
+        let Some(k) = pick.filter(|_| best > 1e-6) else {
+            break;
+        };
+        taken[k] = true;
+        chosen.push(pool[k]);
+
+        // Project the chosen direction out of every remaining residual.
+        let inv = best.sqrt().recip();
+        let q: Vec<f32> = residual[k].iter().map(|x| x * inv).collect();
+        for (j, r) in residual.iter_mut().enumerate() {
+            if taken[j] {
+                continue;
+            }
+            let d: f32 = r.iter().zip(&q).map(|(a, b)| a * b).sum();
+            for (x, y) in r.iter_mut().zip(&q) {
+                *x -= d * y;
+            }
+        }
+    }
+    chosen
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unit(v: &[f32]) -> Vec<f32> {
+        let n = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+        v.iter().map(|x| x / n).collect()
+    }
+
+    #[test]
+    fn a_person_under_the_cap_keeps_every_eligible_face() {
+        let e = [unit(&[1.0, 0.0]), unit(&[0.0, 1.0]), unit(&[1.0, 1.0])];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0), None, Some(16.0)];
+        assert_eq!(select(&refs, &q, 100), vec![0, 1, 2]);
+    }
+
+    #[test]
+    fn a_short_vector_never_stands_for_a_person() {
+        let e = [unit(&[1.0, 0.0]), unit(&[0.0, 1.0])];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0), Some(MIN_REFERENCE_QUALITY - 0.01)];
+        assert_eq!(select(&refs, &q, 100), vec![0]);
+    }
+
+    /// Two hundred frames from one afternoon and one profile shot: the
+    /// profile is the second choice, not the two-hundred-and-first.
+    #[test]
+    fn the_odd_one_out_is_chosen_before_any_duplicate() {
+        let mut e: Vec<Vec<f32>> = Vec::new();
+        let mut q = Vec::new();
+        for i in 0..200 {
+            // Near-duplicates of one direction, with a little noise.
+            let t = (i as f32) * 1e-3;
+            e.push(unit(&[1.0, t, t * 0.5]));
+            q.push(Some(20.0 + (i % 7) as f32));
+        }
+        e.push(unit(&[0.0, 0.0, 1.0]));
+        q.push(Some(16.0));
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let chosen = select(&refs, &q, 3);
+        assert_eq!(chosen.len(), 3);
+        assert_eq!(
+            chosen[1], 200,
+            "the profile shot was not second: {chosen:?}"
+        );
+        // Seeded on the longest vector.
+        assert_eq!(q[chosen[0]], Some(26.0));
+    }
+
+    /// Faces inside the span of the chosen ones add no volume and are not
+    /// taken to fill the cap.
+    #[test]
+    fn the_cap_is_not_filled_from_inside_the_span() {
+        let e = [
+            unit(&[1.0, 0.0]),
+            unit(&[0.0, 1.0]),
+            unit(&[1.0, 1.0]),
+            unit(&[2.0, -1.0]),
+        ];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0); 4];
+        assert_eq!(select(&refs, &q, 3).len(), 2);
+    }
+
+    #[test]
+    fn the_choice_is_deterministic() {
+        let e: Vec<Vec<f32>> = (0..50)
+            .map(|i| {
+                let a = (i as f32) * 0.37;
+                unit(&[a.cos(), a.sin(), (a * 3.0).sin(), 0.2])
+            })
+            .collect();
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = vec![Some(18.0); 50];
+        assert_eq!(select(&refs, &q, 5), select(&refs, &q, 5));
+    }
+}
@@ -1,9 +1,8 @@
 # Film stocks

 One file per stock in [`profiles/`](profiles/). Adding a stock is adding a
-file — no code change, no shader, no new operation — for the same reason
-`dr-decode`'s base curves work that way: under the GPLv3 a stock should be
-contributable without a release.
+file — no code change, no shader, no new operation — because under the GPLv3
+a stock should be contributable without a release.

 ## What a profile is

@@ -41,18 +40,41 @@ matters — see [`src/bake.rs`](src/bake.rs) for the argument:
 1. **A 3×3 matrix**, linear sRGB to the three layers' exposure. Exact, not an
   approximation: the reconstructed scene spectrum is linear in the sRGB
   triple, so the integral collapses into nine numbers.
-2. **Three 1D curves**, log exposure to density, sampled at 256 points.
-3. **One 32³ lookup**, density to linear sRGB — dye absorption, the print
-   through the negative, the paper, the viewing illuminant and the chromatic
-   adaptation, all of which take exactly three numbers in.
+2. **Three 1D curves**, log exposure to density, sampled at 256 points — one
+   row per development time the datasheet measures. Push picks between the
+   rows, and interpolating them is exact, because density is linear in push
+   between two measured processes.
+3. **One 32³ lookup**, density to linear sRGB — dye absorption, the viewing
+   illuminant and the chromatic adaptation, all of which take exactly three
+   numbers in. A printed negative is two: the film's cube ends at the paper's
+   log exposure through the negative, the enlarger's exposure is added there,
+   and the paper's own curve row and cube take it to linear sRGB.

-Per pixel that is a matrix multiply, three curve taps and one texture fetch.
-Splitting 2 from 3, rather than baking one LUT over exposure, is measured
+The stock is the last thing that happens to the picture. It runs in the view
+transform's place (D19): handed linear sRGB, scene-referred, after every other
+adjustment and after sharpening and noise reduction, and handing back the
+rendering the output transform encodes. So every other slider decides the
+exposure the negative receives, and the default tone mapping is not applied
+on top.
+
+Per pixel that is a matrix multiply, a handful of curve taps and one texture
+fetch — two for a print. Splitting 2 from 3, rather than baking one LUT over exposure, is measured
 rather than assumed: the curve carries all the sharp shape and the dye mixing
 is smooth, so folding the curve into the 3D lookup would need it three times
 larger for the same error. At 32³ the worst interpolation error is about 0.003
 in linear sRGB, below one 8-bit code value, and there is a test that says so.

+**No slider is baked.** Camera exposure is a gain before the matrix, push
+chooses between curve rows, print exposure is the addition between the two
+cubes, and format sets the grain; each reaches the shader as a uniform that is
+linear in what it does. That is what lets a mask layer hold its own film
+settings, and a pixel under several layers take the weighted average of them.
+Only the enlarger's filtration is solved at bake time, against the
+photograph's exposure — an enlarger has one filtration for the whole print —
+so the film's Exposure, set on the whole photograph, is the one slider that
+rebakes. The stock and its
+paper are the photograph's; a layer has no picker.
+
 ## Adding a stock

 If spektrafilm has it, add its name to `STOCKS` in
@@ -21,14 +21,16 @@
 //!    curves and dyes, the viewing illuminant, the adaptation — all of it takes
 //!    three numbers in and gives three numbers out. So it bakes into one small
 //!    3D lookup, and the per-pixel cost is a matrix multiply, three curve taps
-//!    and one texture fetch.
+//!    and one texture fetch. A print is two: the film's lookup ends at the
+//!    paper's log exposure, where the enlarger's exposure is an addition, and
+//!    the paper's curve and lookup take it from there — see [`Paper`].
 //!
 //! Splitting 2 from 3 rather than baking a single LUT over exposure is
 //! deliberate and measured: the curve carries all of the sharp shape and the
 //! dye mixing is smooth, so putting the curve in the 3D LUT would force it
 //! three times larger for the same error.

-use crate::profile::Profile;
+use crate::profile::{Profile, CURVE_SAMPLES};
 use crate::spectrum::{illuminant, Spectrum, Viewing};
 use crate::tables::{SPECTRUM, SRGB_BASIS};

@@ -47,7 +49,19 @@ pub const MID_GREY: f32 = 0.184;
 /// that on: the error is already under what the output can represent.
 pub const LUT_SIZE: usize = 32;

-/// What to develop, and how.
+/// TRACES: FR-DEV-3f
+/// The most development times a stock may measure: one curve row, and one
+/// push station, each. Every stock shipped measures five; the ceiling is what
+/// the shader's fixed uniform block can hold.
+pub const MAX_CURVE_ROWS: usize = 8;
+
+/// What to develop: the materials, and where the enlarger is balanced.
+///
+/// **Not how far, and not how bright.** Push, print exposure and camera
+/// exposure are [`Settings`], evaluated per pixel against these tables, so
+/// that a mask layer can hold its own and a pixel under it can take the
+/// weighted average of everyone's (FR-DEV-3f). What is left here is what a
+/// photograph has one of.
 pub struct Recipe<'a> {
    /// The stock the picture was taken on.
    pub film: &'a Profile,
@@ -55,17 +69,15 @@ pub struct Recipe<'a> {
    /// what a reversal stock wants and what makes a negative come out orange
    /// and inverted — that being what a negative actually looks like.
    pub print: Option<&'a Profile>,
-    /// Camera exposure, in stops.
-    pub exposure_ev: f32,
-    /// Enlarger exposure, in stops. Ignored without a `print`.
-    pub print_exposure_ev: f32,
-    /// TRACES: FR-DEV-3f
-    /// Development, in stops of push. Positive develops longer.
+    /// The camera exposure the enlarger is balanced at, in stops. Ignored
+    /// without a `print`.
    ///
-    /// Ignored by a stock measured at one process, of which there are many —
-    /// see [`crate::profile::Profile::curves_at_push`], which returns the one
-    /// measured curve rather than inventing a pushed one.
-    pub push_stops: f32,
+    /// The *photograph's* exposure, never a region's. An enlarger has one
+    /// filtration for the whole print: a negative exposed a stop brighter in
+    /// one corner prints a stop darker there, and that difference is the
+    /// picture — balancing it away per pixel would erase every local exposure
+    /// change a layer made.
+    pub exposure_ev: f32,
 }

 impl<'a> Recipe<'a> {
@@ -76,12 +88,27 @@ impl<'a> Recipe<'a> {
            film,
            print,
            exposure_ev: 0.0,
-            print_exposure_ev: 0.0,
-            push_stops: 0.0,
        }
    }
 }

+/// TRACES: FR-DEV-3f
+/// What a pixel is developed with, against a [`Baked`] stock.
+///
+/// The shader's uniforms, as the CPU sees them: every field is linear in what
+/// the tables are indexed by, which is what lets the composer blend several
+/// layers' settings into one before the fragment runs.
+#[derive(Debug, Clone, Copy, Default, PartialEq)]
+pub struct Settings {
+    /// Camera exposure, in stops: a gain on the scene.
+    pub exposure_ev: f32,
+    /// Development, in stops of push. Positive develops longer. Nothing for a
+    /// stock measured at one process, of which there are many.
+    pub push_stops: f32,
+    /// Enlarger exposure, in stops. Nothing without a print.
+    pub print_exposure_ev: f32,
+}
+
 /// A recipe reduced to three tables.
 ///
 /// Plain `f32` with a documented layout, and no notion of a texture: what to
@@ -89,16 +116,31 @@ impl<'a> Recipe<'a> {
 /// the whole model be tested on the CPU.
 #[derive(Debug, Clone)]
 pub struct Baked {
-    /// Linear sRGB to the three layers' log₁₀ exposure, before the log — row
-    /// `l`, column `c` is layer `l`'s response to sRGB channel `c`.
+    /// Linear sRGB to the three layers' exposure, before the log — row `l`,
+    /// column `c` is layer `l`'s response to sRGB channel `c`. At unit gain:
+    /// [`Settings::exposure_ev`] is applied per pixel.
    pub exposure_matrix: [[f32; 3]; 3],
-    /// The characteristic curves, `CURVE_SAMPLES` samples per layer, uniform
-    /// over `[curve_log_min, curve_log_max]`.
+    /// The characteristic curves: `curve_rows` rows of `CURVE_SAMPLES`
+    /// samples, row after row, each uniform over
+    /// `[curve_log_min, curve_log_max]`.
+    ///
+    /// Row `r` is the stock as measured at its `r`th development time, which
+    /// is push [`Self::push_stations`]`[r]`. The rows are the measurements
+    /// themselves rather than a resampling: between two, density is linear in
+    /// push (development is interpolated in log time, and push is log time),
+    /// so interpolating the rows by push reproduces
+    /// [`Profile::curves_at_push`] exactly. A stock measured at one process
+    /// has one row.
    pub curves: Vec<[f32; 3]>,
+    pub curve_rows: usize,
+    /// The push each row was developed to, ascending, one per row.
+    pub push_stations: Vec<f32>,
    pub curve_log_min: f32,
    pub curve_log_max: f32,
-    /// Density to linear sRGB, `LUT_SIZE³` entries uniform over
-    /// `[0, density_max]` on each axis.
+    /// Film density to what comes next, `LUT_SIZE³` entries uniform over
+    /// `[0, density_max]` on each axis: linear sRGB when the film is viewed
+    /// directly, and the paper's log₁₀ exposure through it, per layer, when it
+    /// is printed.
    ///
    /// **The red axis varies fastest**, then green, then blue — that is,
    /// `lut[(b * size + g) * size + r]`. Stated because it is not the order
@@ -108,60 +150,142 @@ pub struct Baked {
    /// picture with red and blue transposed, which looks like a plausible
    /// photograph of the wrong colour.
    pub lut: Vec<[f32; 3]>,
+    /// The paper, when there is one. See [`Paper`].
+    pub paper: Option<Paper>,
+    /// The deepest density any row develops to, so one lookup covers every
+    /// push.
    pub density_max: f32,
    pub lut_size: usize,
 }

+/// TRACES: FR-DEV-3f
+/// The print half of a baked stock: enlarger to paper to viewing.
+///
+/// Split from the film's lookup at the paper's log exposure, for the reason
+/// the film is split from its own curve. The enlarger's exposure is a shift
+/// *in that log exposure*, the same stops on all three layers, so a print
+/// exposure is an addition between the two lookups — exact at any value and
+/// free per pixel. Baking it into one lookup instead needs a slice per
+/// setting, and interpolating between slices misses by several code values,
+/// because the paper's curve is the sharpest thing in the print.
+#[derive(Debug, Clone)]
+pub struct Paper {
+    /// The enlarger's filtration, per layer, in log₁₀ exposure: what makes a
+    /// mid-grey scene print neutral at the photograph's exposure. See
+    /// [`Recipe::exposure_ev`].
+    pub balance: [f32; 3],
+    /// The paper's characteristic curves, `CURVE_SAMPLES` samples uniform
+    /// over `[log_min, log_max]`.
+    pub curves: Vec<[f32; 3]>,
+    pub log_min: f32,
+    pub log_max: f32,
+    /// Paper density to linear sRGB, laid out as [`Baked::lut`] is, uniform
+    /// over `[0, density_max]`.
+    pub lut: Vec<[f32; 3]>,
+    pub density_max: f32,
+}
+
+/// Where `push` falls among the rows: the lower row and the fraction toward
+/// the next. Clamped at both ends, as `curves_at_push` clamps to the first and
+/// last measured process.
+fn push_row(stations: &[f32], push: f32) -> (usize, f32) {
+    if stations.len() < 2 {
+        return (0, 0.0);
+    }
+    let last = stations.len() - 1;
+    let hi = stations
+        .iter()
+        .position(|p| *p >= push)
+        .unwrap_or(last)
+        .max(1);
+    let lo = hi - 1;
+    let f = (push - stations[lo]) / (stations[hi] - stations[lo]).max(1e-6);
+    (lo, f.clamp(0.0, 1.0))
+}
+
 impl Baked {
-    /// Look a colour up the way the shader will, for tests and for previews.
+    /// Look a colour up the way the shader will, at the stock's own settings.
    pub fn apply(&self, rgb: [f32; 3]) -> [f32; 3] {
+        self.apply_at(rgb, &Settings::default())
+    }
+
+    /// Look a colour up the way the shader will, for tests and for previews.
+    pub fn apply_at(&self, rgb: [f32; 3], settings: &Settings) -> [f32; 3] {
+        let gain = 2f32.powf(settings.exposure_ev);
        let mut log_exposure = [0.0f32; 3];
        for (l, slot) in log_exposure.iter_mut().enumerate() {
            let m = self.exposure_matrix[l];
-            let e = m[0] * rgb[0] + m[1] * rgb[1] + m[2] * rgb[2];
+            let e = gain * (m[0] * rgb[0] + m[1] * rgb[1] + m[2] * rgb[2]);
            *slot = (e.max(0.0) + 1e-10).log10();
        }
-        self.sample_lut(self.sample_curves(log_exposure))
+        let density = self.sample_curves(log_exposure, settings.push_stops);
+        let through = sample_cube(&self.lut, self.lut_size, density, self.density_max);
+        let Some(paper) = &self.paper else {
+            return through;
+        };
+        let shift = settings.print_exposure_ev * 2f32.log10();
+        let paper_log = [0, 1, 2].map(|l| through[l] + paper.balance[l] + shift);
+        let paper_density = sample_curve(&paper.curves, paper.log_min, paper.log_max, paper_log);
+        sample_cube(&paper.lut, self.lut_size, paper_density, paper.density_max)
    }

-    fn sample_curves(&self, log_exposure: [f32; 3]) -> [f32; 3] {
-        let last = self.curves.len() - 1;
-        let span = self.curve_log_max - self.curve_log_min;
-        let mut out = [0.0f32; 3];
-        for (c, slot) in out.iter_mut().enumerate() {
-            let t = ((log_exposure[c] - self.curve_log_min) / span).clamp(0.0, 1.0) * last as f32;
-            let i = (t.floor() as usize).min(last - 1);
-            let f = t - i as f32;
-            *slot = self.curves[i][c] * (1.0 - f) + self.curves[i + 1][c] * f;
+    fn sample_curves(&self, log_exposure: [f32; 3], push_stops: f32) -> [f32; 3] {
+        let (row, g) = push_row(&self.push_stations, push_stops);
+        let lo = self.sample_curve_row(log_exposure, row);
+        if self.curve_rows < 2 {
+            return lo;
        }
-        out
+        let hi = self.sample_curve_row(log_exposure, row + 1);
+        [0, 1, 2].map(|c| lo[c] * (1.0 - g) + hi[c] * g)
    }

-    fn sample_lut(&self, density: [f32; 3]) -> [f32; 3] {
-        let n = self.lut_size;
-        let mut base = [0usize; 3];
-        let mut frac = [0f32; 3];
-        for c in 0..3 {
-            let t = (density[c] / self.density_max).clamp(0.0, 1.0) * (n - 1) as f32;
-            base[c] = (t.floor() as usize).min(n - 2);
-            frac[c] = t - base[c] as f32;
-        }
-        let mut out = [0.0f32; 3];
-        for dx in 0..2 {
-            for dy in 0..2 {
-                for dz in 0..2 {
-                    let w = if dx == 0 { 1.0 - frac[0] } else { frac[0] }
-                        * if dy == 0 { 1.0 - frac[1] } else { frac[1] }
-                        * if dz == 0 { 1.0 - frac[2] } else { frac[2] };
-                    let e = self.lut[((base[2] + dz) * n + base[1] + dy) * n + base[0] + dx];
-                    for c in 0..3 {
-                        out[c] += w * e[c];
-                    }
+    fn sample_curve_row(&self, log_exposure: [f32; 3], row: usize) -> [f32; 3] {
+        let samples = self.curves.len() / self.curve_rows;
+        let curve = &self.curves[row * samples..(row + 1) * samples];
+        sample_curve(curve, self.curve_log_min, self.curve_log_max, log_exposure)
+    }
+}
+
+/// Three curves sampled uniformly over `[log_min, log_max]`, read at a log
+/// exposure per layer. Clamped at both ends, as the shader's is.
+fn sample_curve(curve: &[[f32; 3]], log_min: f32, log_max: f32, at: [f32; 3]) -> [f32; 3] {
+    let last = curve.len() - 1;
+    let span = log_max - log_min;
+    let mut out = [0.0f32; 3];
+    for (c, slot) in out.iter_mut().enumerate() {
+        let t = ((at[c] - log_min) / span).clamp(0.0, 1.0) * last as f32;
+        let i = (t.floor() as usize).min(last - 1);
+        let f = t - i as f32;
+        *slot = curve[i][c] * (1.0 - f) + curve[i + 1][c] * f;
+    }
+    out
+}
+
+/// A cube of `n³` triples over `[0, max]` per axis, red fastest, read
+/// trilinearly.
+fn sample_cube(lut: &[[f32; 3]], n: usize, density: [f32; 3], max: f32) -> [f32; 3] {
+    let mut base = [0usize; 3];
+    let mut frac = [0f32; 3];
+    for c in 0..3 {
+        let t = (density[c] / max).clamp(0.0, 1.0) * (n - 1) as f32;
+        base[c] = (t.floor() as usize).min(n - 2);
+        frac[c] = t - base[c] as f32;
+    }
+    let mut out = [0.0f32; 3];
+    for dx in 0..2 {
+        for dy in 0..2 {
+            for dz in 0..2 {
+                let w = if dx == 0 { 1.0 - frac[0] } else { frac[0] }
+                    * if dy == 0 { 1.0 - frac[1] } else { frac[1] }
+                    * if dz == 0 { 1.0 - frac[2] } else { frac[2] };
+                let e = lut[((base[2] + dz) * n + base[1] + dy) * n + base[0] + dx];
+                for c in 0..3 {
+                    out[c] += w * e[c];
                }
            }
        }
-        out
    }
+    out
 }

 /// Linear sRGB to the three layers' exposure, mid-grey normalised.
@@ -204,12 +328,7 @@ pub fn exposure_matrix(film: &Profile) -> [[f32; 3]; 3] {
 /// goes: the mask is a fixed density, so balancing mid-grey to neutral cancels
 /// it — which is why a printed negative looks like a photograph while a scanned
 /// one looks orange.
-fn print_balance(
-    film: &Profile,
-    paper: &Profile,
-    exposure_ev: f32,
-    print_exposure_ev: f32,
-) -> [f32; 3] {
+pub fn print_balance(film: &Profile, paper: &Profile, exposure_ev: f32) -> [f32; 3] {
    let matrix = exposure_matrix(film);
    let scene = MID_GREY * 2f32.powf(exposure_ev);
    let mut log_exposure = [0.0f32; 3];
@@ -227,7 +346,7 @@ fn print_balance(

    let mut offsets = [0.0f32; 3];
    for (l, slot) in offsets.iter_mut().enumerate() {
-        *slot = target - (mid_raw[l] + 1e-10).log10() + print_exposure_ev * 2f32.log10();
+        *slot = target - (mid_raw[l] + 1e-10).log10();
    }
    offsets
 }
@@ -257,77 +376,117 @@ fn paper_exposure(film: &Profile, paper: &Profile, density: [f32; 3]) -> [f32; 3
 /// Bake a recipe into the tables a shader runs.
 pub fn bake(recipe: &Recipe) -> Baked {
    let film = recipe.film;
-    let mut matrix = exposure_matrix(film);
-    // Camera exposure rides in the matrix rather than in the shader: it is a
-    // scalar on a linear quantity, and folding it in here costs nothing and
-    // keeps the per-pixel work identical whether or not it has been moved.
-    let gain = 2f32.powf(recipe.exposure_ev);
-    for row in &mut matrix {
-        for v in row.iter_mut() {
-            *v *= gain;
-        }
-    }
+    // At unit gain. Camera exposure is a scalar on a linear quantity, so the
+    // shader applies it for the price of one multiply — and has to, since a
+    // layer may hold its own.
+    let matrix = exposure_matrix(film);

    // TRACES: FR-DEV-3f
-    // Developed to the requested push before anything else reads the curves:
-    // the density ceiling, the print balance and the grain all depend on how
-    // far this film was taken, and a push that only reached one of them would
-    // be a contrast change wearing a push's name.
-    let curves = film.curves_at_push(recipe.push_stops);
-    let density_max = curves
-        .iter()
-        .flat_map(|row| row.iter())
-        .fold(0.0f32, |a, &b| a.max(b))
-        .max(1e-3);
-
-    let viewing = match recipe.print {
-        Some(paper) => Viewing::new(&paper.viewing_illuminant),
-        None => Viewing::new(&film.viewing_illuminant),
+    // Every measured process, not the one the slider is at: the shader
+    // interpolates between rows per pixel, so a layer can push a region.
+    // Resampled to one length because the rows share a texture.
+    let measured = film.development_curves.len() >= 2
+        && film.development_times.len() == film.development_curves.len();
+    let (curves, push_stations): (Vec<[f32; 3]>, Vec<f32>) = if measured {
+        let rows = film.development_curves.len().min(MAX_CURVE_ROWS);
+        (
+            film.development_curves[..rows]
+                .iter()
+                .flat_map(|c| resample(c))
+                .collect(),
+            film.development_times[..rows]
+                .iter()
+                .map(|t| 2.0 * (t / film.development_normal).log2())
+                .collect(),
+        )
+    } else {
+        (resample(&film.density_curves), vec![0.0])
    };
-    let balance = recipe
-        .print
-        .map(|paper| print_balance(film, paper, recipe.exposure_ev, recipe.print_exposure_ev));
+    let curve_rows = push_stations.len();
+    // The ceiling of the deepest row, so one lookup covers every push.
+    let density_max = ceiling(&curves);

    let n = LUT_SIZE;
-    let mut lut = Vec::with_capacity(n * n * n);
    // Blue outermost and red innermost, so the red axis varies fastest. See
    // `Baked::lut`: this is the layout a 3D texture upload wants, and getting
    // it backwards transposes red and blue in the finished picture.
-    for b in 0..n {
-        for g in 0..n {
-            for r in 0..n {
-                let density = [
-                    density_max * r as f32 / (n - 1) as f32,
-                    density_max * g as f32 / (n - 1) as f32,
-                    density_max * b as f32 / (n - 1) as f32,
-                ];
-                lut.push(match recipe.print.zip(balance) {
-                    Some((paper, offsets)) => {
-                        let raw = paper_exposure(film, paper, density);
-                        let mut log_exposure = [0.0f32; 3];
-                        for (l, slot) in log_exposure.iter_mut().enumerate() {
-                            *slot = (raw[l] + 1e-10).log10() + offsets[l];
-                        }
-                        let paper_density = paper.density_at(log_exposure);
-                        viewing.to_srgb(&paper.transmittance(paper_density))
-                    }
-                    None => viewing.to_srgb(&film.transmittance(density)),
-                });
+    let cube = |max: f32, f: &dyn Fn([f32; 3]) -> [f32; 3]| {
+        let mut out = Vec::with_capacity(n * n * n);
+        for b in 0..n {
+            for g in 0..n {
+                for r in 0..n {
+                    let step = max / (n - 1) as f32;
+                    out.push(f([r as f32 * step, g as f32 * step, b as f32 * step]));
+                }
            }
        }
-    }
+        out
+    };
+
+    let (lut, paper) = match recipe.print {
+        None => {
+            let viewing = Viewing::new(&film.viewing_illuminant);
+            (
+                cube(density_max, &|d| viewing.to_srgb(&film.transmittance(d))),
+                None,
+            )
+        }
+        Some(paper) => {
+            let viewing = Viewing::new(&paper.viewing_illuminant);
+            let curves = resample(&paper.density_curves);
+            let paper_max = ceiling(&curves);
+            let lut = cube(density_max, &|d| {
+                paper_exposure(film, paper, d).map(|raw| (raw + 1e-10).log10())
+            });
+            let paper = Paper {
+                balance: print_balance(film, paper, recipe.exposure_ev),
+                log_min: paper.log_exposure_min,
+                log_max: paper.log_exposure_max,
+                lut: cube(paper_max, &|d| viewing.to_srgb(&paper.transmittance(d))),
+                density_max: paper_max,
+                curves,
+            };
+            (lut, Some(paper))
+        }
+    };

    Baked {
        exposure_matrix: matrix,
        curves,
+        curve_rows,
+        push_stations,
        curve_log_min: film.log_exposure_min,
        curve_log_max: film.log_exposure_max,
        lut,
+        paper,
        density_max,
        lut_size: n,
    }
 }

+/// A curve at `CURVE_SAMPLES`, uniform over the same domain it came in on.
+fn resample(curve: &[[f32; 3]]) -> Vec<[f32; 3]> {
+    if curve.len() == CURVE_SAMPLES {
+        return curve.to_vec();
+    }
+    (0..CURVE_SAMPLES)
+        .map(|i| {
+            let at = i as f32 / (CURVE_SAMPLES - 1) as f32;
+            sample_curve(curve, 0.0, 1.0, [at; 3])
+        })
+        .collect()
+}
+
+/// The deepest density in a set of curves, floored so a lookup over it has
+/// a width.
+fn ceiling(curves: &[[f32; 3]]) -> f32 {
+    curves
+        .iter()
+        .flat_map(|row| row.iter())
+        .fold(0.0f32, |a, &b| a.max(b))
+        .max(1e-3)
+}
+
 fn mean(s: &Spectrum) -> f32 {
    s.iter().sum::<f32>() / SPECTRUM as f32
 }
@@ -467,6 +626,10 @@ mod tests {

    #[test]
    fn exposure_moves_the_print_the_way_it_moves_a_photograph() {
+        // The photograph's exposure: the enlarger balanced at it, and the
+        // scene brighter by it. Mid-grey stays where the balance puts it —
+        // that is what the balance is for — so what a stop more does to a
+        // print is lift everything either side of it along the paper's curve.
        let film = portra();
        let paper = endura();
        let brighter = bake(&Recipe {
@@ -474,7 +637,155 @@ mod tests {
            ..Recipe::new(&film, Some(&paper))
        });
        let base = bake(&Recipe::new(&film, Some(&paper)));
-        assert!(brighter.apply([MID_GREY; 3])[1] > base.apply([MID_GREY; 3])[1]);
+        let one_stop = Settings {
+            exposure_ev: 1.0,
+            ..Settings::default()
+        };
+        for v in [0.02f32, 0.6] {
+            assert!(
+                brighter.apply_at([v; 3], &one_stop)[1] > base.apply([v; 3])[1],
+                "{v} did not print brighter a stop up"
+            );
+        }
+        let (a, b) = (
+            brighter.apply_at([MID_GREY; 3], &one_stop)[1],
+            base.apply([MID_GREY; 3])[1],
+        );
+        assert!(
+            (a - b).abs() < 1.0 / 255.0,
+            "the balance let mid-grey move: {a} vs {b}"
+        );
+    }
+
+    #[test]
+    fn a_region_exposed_brighter_prints_brighter_than_the_enlarger_expects() {
+        // TRACES: FR-DEV-3f
+        // A layer's exposure is the scene's, not the enlarger's: the balance
+        // stays where the photograph put it, so the region prints lighter by
+        // more than the whole photograph would, which is what dodging at the
+        // camera is.
+        let film = portra();
+        let paper = endura();
+        let base = bake(&Recipe::new(&film, Some(&paper)));
+        let rebalanced = bake(&Recipe {
+            exposure_ev: 1.0,
+            ..Recipe::new(&film, Some(&paper))
+        });
+        let one_stop = Settings {
+            exposure_ev: 1.0,
+            ..Settings::default()
+        };
+        let local = base.apply_at([MID_GREY; 3], &one_stop)[1];
+        let global = rebalanced.apply_at([MID_GREY; 3], &one_stop)[1];
+        assert!(local > base.apply([MID_GREY; 3])[1], "not brighter at all");
+        assert!(
+            local > global,
+            "a region was rebalanced as though it were the whole print: {local} vs {global}"
+        );
+    }
+
+    #[test]
+    fn more_light_through_the_enlarger_darkens_the_print() {
+        // TRACES: FR-DEV-3f
+        // Paper is negative-working. Opening the enlarger a stop is burning
+        // in, and a slider that brightened would be the wrong way round for
+        // anyone who has printed.
+        let film = portra();
+        let paper = endura();
+        let baked = bake(&Recipe::new(&film, Some(&paper)));
+        let at = |stops: f32| {
+            baked.apply_at(
+                [MID_GREY; 3],
+                &Settings {
+                    print_exposure_ev: stops,
+                    ..Settings::default()
+                },
+            )[1]
+        };
+        assert!(at(1.0) < at(0.0) && at(0.0) < at(-1.0));
+    }
+
+    #[test]
+    fn a_push_on_a_row_is_the_measured_curve() {
+        // TRACES: FR-DEV-3f
+        // The rows are the measured processes, so at a row the table must be
+        // that curve exactly, and between rows — density being linear in push
+        // there — it must be `curves_at_push` to rounding.
+        let film = profile(include_str!("../profiles/kodak_doublex.yaml"));
+        let baked = bake(&Recipe::new(&film, None));
+        assert_eq!(
+            baked.curve_rows, 5,
+            "Double-X measures five development times"
+        );
+
+        let span = film.log_exposure_max - film.log_exposure_min;
+        let mut worst = 0.0f32;
+        let stations = baked.push_stations.clone();
+        let mut pushes: Vec<(f32, bool)> = stations.iter().map(|p| (*p, true)).collect();
+        for k in 0..=16 {
+            pushes.push((-1.0 + 4.0 * k as f32 / 16.0, false));
+        }
+        for (push, on_row) in pushes {
+            let exact = film.curves_at_push(push);
+            for i in (0..exact.len()).step_by(7) {
+                let log = film.log_exposure_min + span * i as f32 / (exact.len() - 1) as f32;
+                let got = baked.sample_curves([log; 3], push);
+                for c in 0..3 {
+                    let err = (got[c] - exact[i][c]).abs();
+                    if on_row {
+                        assert!(err < 1e-4, "push {push} is a row but misses it by {err}");
+                    }
+                    worst = worst.max(err);
+                }
+            }
+        }
+        assert!(worst < 1e-3, "between rows the density is off by {worst}");
+    }
+
+    #[test]
+    fn a_print_exposure_is_exact_at_any_setting() {
+        // TRACES: FR-DEV-3f
+        // The enlarger's exposure is added between the two lookups rather than
+        // baked into either, so no setting is nearer the tables than another.
+        // Compared against the chain evaluated spectrally, end to end, at
+        // settings chosen off every half and whole stop.
+        let film = portra();
+        let paper = endura();
+        let baked = bake(&Recipe::new(&film, Some(&paper)));
+        let offsets = print_balance(&film, &paper, 0.0);
+        let viewing = Viewing::new(&paper.viewing_illuminant);
+
+        let mut worst = 0.0f32;
+        for stops in [-2.3f32, -0.6, 0.0, 0.35, 1.7] {
+            for i in 0..14 {
+                let v = 0.004 * 2f32.powf(i as f32 * 0.6);
+                let rgb = [v, v * 0.8, v * 1.1];
+                let mut log_exposure = [0.0f32; 3];
+                for (l, slot) in log_exposure.iter_mut().enumerate() {
+                    let m = baked.exposure_matrix[l];
+                    *slot =
+                        ((m[0] * rgb[0] + m[1] * rgb[1] + m[2] * rgb[2]).max(0.0) + 1e-10).log10();
+                }
+                let raw = paper_exposure(&film, &paper, film.density_at(log_exposure));
+                let paper_log =
+                    [0, 1, 2].map(|l| (raw[l] + 1e-10).log10() + offsets[l] + stops * 2f32.log10());
+                let exact = viewing.to_srgb(&paper.transmittance(paper.density_at(paper_log)));
+                let approx = baked.apply_at(
+                    rgb,
+                    &Settings {
+                        print_exposure_ev: stops,
+                        ..Settings::default()
+                    },
+                );
+                for c in 0..3 {
+                    worst = worst.max((exact[c] - approx[c]).abs());
+                }
+            }
+        }
+        assert!(
+            worst < 1.0 / 255.0,
+            "the print misses the spectral chain by {worst}"
+        );
    }

    #[test]
@@ -550,5 +861,25 @@ mod tests {
        let baked = bake(&Recipe::new(&film, None));
        assert_eq!(baked.lut.len(), LUT_SIZE * LUT_SIZE * LUT_SIZE);
        assert_eq!(baked.curves.len(), CURVE_SAMPLES);
+        assert_eq!(baked.curve_rows, 1);
+        assert!(baked.paper.is_none());
+
+        // A print has a second lookup and a curve of its own; a development
+        // series a row per push. Neither is inferred from the other.
+        let negative = portra();
+        let paper = endura();
+        let printed = bake(&Recipe::new(&negative, Some(&paper)));
+        let print = printed
+            .paper
+            .as_ref()
+            .expect("a printed negative has a paper");
+        assert_eq!(print.lut.len(), LUT_SIZE.pow(3));
+        assert_eq!(print.curves.len(), CURVE_SAMPLES);
+
+        let pushable = profile(include_str!("../profiles/kodak_doublex.yaml"));
+        let rows = bake(&Recipe::new(&pushable, None));
+        assert_eq!(rows.curve_rows, pushable.development_times.len());
+        assert_eq!(rows.push_stations.len(), rows.curve_rows);
+        assert_eq!(rows.curves.len(), rows.curve_rows * CURVE_SAMPLES);
    }
 }
@@ -2,9 +2,9 @@
 //!
 //! # Why it is data
 //!
-//! The same argument `dr_decode::base_curve` makes for camera bodies, and for
-//! the same requirement: under the GPLv3 a stock should be contributable
-//! without a release. A profile is three tables and a handful of facts, all of
+//! Under the GPLv3 a stock should be contributable without a release (the
+//! argument the retired per-body base curves made for camera bodies, before
+//! D19). A profile is three tables and a handful of facts, all of
 //! them published in the manufacturer's datasheet, so adding a stock is adding
 //! a file — not a code change, not a shader, and not a new operation.
 //!
@@ -7,6 +7,11 @@ license.workspace = true

 [dependencies]
 dr-types.workspace = true
+# The merge's geometry (FR-MRG-10): rotations, the focal length and the
+# projections, solved on proxies by dr-pano and consumed here per chunk. The
+# geometry alone — no keypoint model, no runtime — which is what the
+# workspace entry turns off.
+dr-pano.workspace = true
 dr-decode.workspace = true
 dr-pipeline.workspace = true
 # The watershed's pixel passes are here because they are shaders; everything
@@ -1,6 +1,6 @@
 //! What a frame actually costs — the measurement FR-DSP-2 is waiting on.
 //!
-//! `docs/display-and-extension.md` §2 argues that tiled computation predates
+//! `docs/dev/display-and-extension.md` §2 argues that tiled computation predates
 //! the fused-shader design and may not need to exist: the composer folds every
 //! active operation into **one dispatch over a viewport-sized target**, so the
 //! problem tiles were invented to solve may already be solved. That argument
@@ -28,7 +28,7 @@
 //! the per-frame CPU half is dominated by shader-source assembly, which is
 //! string formatting and is several times slower unoptimised.
 //!
-//! The committed numbers live in `docs/frame-budget.md`. Rerun this and diff
+//! The committed numbers live in `docs/dev/frame-budget.md`. Rerun this and diff
 //! that file; a regression should be a diff rather than somebody's memory.
 //!
 //! # Why the 99th percentile and not the mean
@@ -680,15 +680,18 @@ fn film_tables() -> FilmTables {
    FilmTables {
        exposure_matrix: baked.exposure_matrix,
        curves: baked.curves.clone(),
+        push_stations: baked.push_stations.clone(),
        curve_log_min: baked.curve_log_min,
        curve_log_max: baked.curve_log_max,
        lut: baked.lut.clone(),
        density_max: baked.density_max,
        lut_size: baked.lut_size,
+        // Viewed directly: `STOCK` is baked without a paper above.
+        paper: None,
        // Grain off. It is a per-pixel hash and would be measured; it is also
        // not part of every edit, and the chain being measured here is "every
        // operation active", not "every option of every operation".
-        grain_particles: [0.0; 3],
+        grain_particles: [[0.0; 3]; dr_pipeline::ops::film_sim::FORMAT_COUNT],
        grain_density_max: [baked.density_max; 3],
        grain_uniformity: 0.97,
    }
@@ -1,6 +1,6 @@
 //! Segment an image and write the granularity ladder as false-coloured PPMs.
 //!
-//! The whole point of S15 step 2 (docs/segmentation.md §11): look at the
+//! The whole point of S15 step 2 (docs/dev/segmentation.md §11): look at the
 //! ladder and decide whether clicking through it would land on the things a
 //! person means. No amount of design settles that — the pictures do.
 //!
@@ -182,8 +182,7 @@ fn render_to(
    // and the example never has to know which it was handed.
    let shader = graph.compose_for(ColourSpace::Srgb);
    let scale = graph.render_scale(image.size(), (w, h));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
    let key = graph.invalidation().through(Affects::Colour);
    adjust
        .render_detailed(image, &shader, w, h, None, &detail, key)
@@ -10,7 +10,7 @@
 //! pass over this texture; it does not re-demosaic, which is what keeps the
 //! interaction budget (NFR-P9) reachable on a 24 MP file.

-use dr_decode::{BaseCurve, CfaPattern, RawImage};
+use dr_decode::{CfaPattern, RawImage};
 use wgpu::util::DeviceExt;

 use crate::{GpuContext, GpuError};
@@ -57,6 +57,32 @@ struct XTransParams {
    tile: [u32; 4],
 }

+/// Uniform block for the hot-pixel repair. Layout must match
+/// `hot_pixels.wgsl`.
+///
+/// One block for both colour filter arrays: the repair asks only "which
+/// photosites share this one's colour", and a 6×6 tile answers that for a
+/// Bayer cell as well as for X-Trans.
+#[repr(C)]
+#[derive(Copy, Clone, Debug, bytemuck::Pod, bytemuck::Zeroable)]
+struct HotPixelParams {
+    crop_x: u32,
+    crop_y: u32,
+    width: u32,
+    height: u32,
+    stride: u32,
+    words: u32,
+    row_invocations: u32,
+    samples: u32,
+    black: [f32; 4],
+    inv_range: [f32; 4],
+    tile: [u32; 4],
+}
+
+/// The repair's workgroup width. Must match `@workgroup_size` in
+/// `hot_pixels.wgsl`.
+const HOT_PIXEL_GROUP: u32 = 64;
+
 /// A demosaiced image living on the GPU.
 ///
 /// RGBA16Float, scene-referred, camera colour space. This is the input every
@@ -83,18 +109,29 @@ pub struct DemosaicedImage {
    color_matrix: [f32; 9],
    /// As-shot white balance, the neutral starting point for the WB control.
    as_shot_wb: [f32; 3],
-    /// TRACES: FR-DEV-3e
-    /// The camera profile's rendering curve, carried through for the adjust
-    /// pass exactly as `color_matrix` is.
-    ///
-    /// It rides on the image rather than on the edit graph because it is not
-    /// an edit: it belongs to the body that took the frame, the way the
-    /// masked-photosite crop and the EXIF orientation do, and a sidecar shared
-    /// between two bodies must never carry one body's rendering onto the
-    /// other's file (FR-NC-9).
-    base_curve: BaseCurve,
    /// Whether the texture holds gamma-encoded rather than linear values.
    non_linear: bool,
+    /// Which upload this is, unique for the life of the process. See
+    /// [`Self::id`].
+    id: u64,
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// The whole frame's size in pixels — what [`Self::size`] reports.
+    /// The texture's own size when it holds the whole frame at full
+    /// resolution, which is every photograph that fits in one.
+    frame: (u32, u32),
+    /// Which part of the frame the texture holds, as origin and extent in
+    /// normalised frame coordinates. `[0, 0, 1, 1]` for the whole frame,
+    /// reduced or not. See [`Self::window_uniforms`].
+    window: [f32; 4],
+}
+
+/// The window of a texture that holds the whole frame.
+const WHOLE_FRAME: [f32; 4] = [0.0, 0.0, 1.0, 1.0];
+
+/// The next [`DemosaicedImage::id`].
+fn next_image_id() -> u64 {
+    static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
+    NEXT.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
 }

 impl DemosaicedImage {
@@ -108,25 +145,68 @@ impl DemosaicedImage {
        &self.view
    }

+    /// The size of the photograph this stands for, in its own pixels.
+    ///
+    /// **Not necessarily the texture's.** For a photograph larger than one
+    /// texture this is a reduced copy of it or a window cut from it, and
+    /// everything that sizes a render, a crop or a kernel has to go on
+    /// measuring the photograph. What indexes the texture's texels asks
+    /// [`Self::texture_size`] instead.
    pub fn size(&self) -> (u32, u32) {
+        self.frame
+    }
+
+    /// The texture's own size in texels.
+    pub fn texture_size(&self) -> (u32, u32) {
        (self.width, self.height)
    }

+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// The source window uniforms the fused shader reads, in the order
+    /// `dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS` declares them.
+    ///
+    /// The second `vec4` is zero for a texture that holds the whole frame at
+    /// full resolution, so the shader measures the texture itself exactly as
+    /// it did before windows existed.
+    pub fn window_uniforms(&self) -> [f32; dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS] {
+        let [x, y, w, h] = self.window;
+        let (fw, fh) = if self.is_whole() {
+            (0.0, 0.0)
+        } else {
+            (self.frame.0 as f32, self.frame.1 as f32)
+        };
+        [x, y, w, h, fw, fh, 0.0, 0.0]
+    }
+
+    /// Whether the texture is the whole frame at full resolution.
+    pub fn is_whole(&self) -> bool {
+        self.window == WHOLE_FRAME && self.frame == (self.width, self.height)
+    }
+
+    /// The window this texture holds, as origin and extent in normalised
+    /// frame coordinates.
+    pub fn window(&self) -> [f32; 4] {
+        self.window
+    }
+
+    /// Which texture this is, as a number that is never reused.
+    ///
+    /// For a cache that has to know it is still looking at the same pixels
+    /// (`AdjustPass`'s sample cache) without holding the texture alive to find
+    /// out: keeping a handle would keep half a gigabyte of a closed photograph
+    /// on the device, and comparing addresses would mistake a new upload for an
+    /// old one the moment the allocator reused the slot. A texture here is
+    /// never written after it is built, so the same id is the same pixels.
+    pub(crate) fn id(&self) -> u64 {
+        self.id
+    }
+
    /// Camera RGB → linear sRGB, row-major. Identity where the body is
    /// uncalibrated, so the image renders uncalibrated rather than black.
    pub fn color_matrix(&self) -> [f32; 9] {
        self.color_matrix
    }

-    /// TRACES: FR-DEV-3e
-    /// The camera profile's base curve, as five `(x, y)` points.
-    ///
-    /// [`BaseCurve::IDENTITY`] where the body is unprofiled or the source was
-    /// never raw, in which case the adjust pass skips the stage entirely.
-    pub fn base_curve(&self) -> BaseCurve {
-        self.base_curve
-    }
-
    /// As-shot white balance multipliers, green-normalised.
    ///
    /// The white balance control is expressed *relative* to these, so its
@@ -240,16 +320,226 @@ impl DemosaicedImage {
            color_matrix: IDENTITY_3X3,
            as_shot_wb: [1.0, 1.0, 1.0],
            // **The identity, and this is the whole reason the field is here
-            // rather than resolved further down.** A JPEG has already had its
-            // camera's base curve baked in by the camera; applying one again
-            // would render the rendering, crushing the shadows and flattening
-            // the highlights of an image that was already finished.
-            base_curve: BaseCurve::IDENTITY,
+            // rather than resolved further down.** A JPEG has already been
+            // rendered by the camera; the view transform skips a source
+            // flagged non-linear, since rendering the rendering would crush
+            // the shadows and flatten the highlights of an image that was
+            // already finished.
            non_linear: true,
+            id: next_image_id(),
+            frame: (width, height),
+            window: WHOLE_FRAME,
        })
    }
 }

+impl DemosaicedImage {
+    /// TRACES: FR-MRG-3
+    /// A source that is already RGB in camera space: a linear DNG, which is
+    /// what a merge writes. No demosaic; the samples are normalised by the
+    /// file's black and white levels exactly as the demosaic kernel would
+    /// normalise a photosite, and everything else — the matrix, the
+    /// balance, the view transform — is carried through as for a CFA
+    /// file, because the composite is developed as one photograph from the
+    /// body that took its sources.
+    pub fn from_linear_rgb16(ctx: &GpuContext, raw: &RawImage) -> Result<Self, GpuError> {
+        let (width, height) = (raw.crop.width.max(1), raw.crop.height.max(1));
+        Self::linear_rgb16_window(ctx, raw, [0, 0, width, height], 1)
+    }
+
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// Part of a linear DNG, or a reduced copy of it, for a photograph too
+    /// large to hold in one texture.
+    ///
+    /// `region` is `[x, y, width, height]` in pixels of the frame (the
+    /// file's crop), clamped to it. `reduce` averages `reduce × reduce`
+    /// blocks into one texel — a box filter, which is what a reduced copy
+    /// that is only ever displayed smaller than itself needs, and which keeps
+    /// the samples in scene-linear light where an average means something.
+    ///
+    /// The texture then knows where it sits ([`Self::window`]) and how large
+    /// the photograph is ([`Self::size`]), and the fused shader maps each
+    /// output pixel's position in the *photograph* into it. So a crop, a
+    /// rotation or a mask drawn on the reduced copy lands on the same pixels
+    /// of a full-resolution window, and an export in tiles is the same
+    /// picture as one that fitted.
+    ///
+    /// Refused only if the result itself does not fit the device.
+    pub fn linear_rgb16_window(
+        ctx: &GpuContext,
+        raw: &RawImage,
+        region: [u32; 4],
+        reduce: u32,
+    ) -> Result<Self, GpuError> {
+        let frame = (raw.crop.width.max(1), raw.crop.height.max(1));
+        let k = reduce.max(1);
+        let x0 = region[0].min(frame.0 - 1);
+        let y0 = region[1].min(frame.1 - 1);
+        let rw = region[2].clamp(1, frame.0 - x0);
+        let rh = region[3].clamp(1, frame.1 - y0);
+        let (width, height) = (rw.div_ceil(k), rh.div_ceil(k));
+
+        let limits = ctx.device.limits();
+        if width > limits.max_texture_dimension_2d || height > limits.max_texture_dimension_2d {
+            return Err(GpuError::TooLarge(format!(
+                "{width}×{height} exceeds the device limit of {}",
+                limits.max_texture_dimension_2d
+            )));
+        }
+        let stride = raw.width as usize * 3;
+        let expected = raw.height as usize * stride;
+        if raw.data.len() < expected {
+            return Err(GpuError::TooLarge(format!(
+                "{} samples is short of the {expected} a {}×{} RGB image needs",
+                raw.data.len(),
+                raw.width,
+                raw.height
+            )));
+        }
+        let black = black_per_cell(raw);
+        let inv = inv_range_per_cell(raw);
+
+        // One output row per task: a 200-megapixel reduction is a second of
+        // one core, and the rows are independent.
+        let row_texels = width as usize * 4;
+        let mut half = vec![0u16; row_texels * height as usize];
+        let fill_row = |ty: usize, out: &mut [u16]| {
+            let sy0 = y0 as usize + ty * k as usize;
+            let sy1 = (sy0 + k as usize).min((y0 + rh) as usize);
+            for tx in 0..width as usize {
+                let sx0 = x0 as usize + tx * k as usize;
+                let sx1 = (sx0 + k as usize).min((x0 + rw) as usize);
+                let mut acc = [0f32; 3];
+                for sy in sy0..sy1 {
+                    let row = (raw.crop.y as usize + sy) * stride + raw.crop.x as usize * 3;
+                    for sx in sx0..sx1 {
+                        let p = &raw.data[row + sx * 3..row + sx * 3 + 3];
+                        for c in 0..3 {
+                            acc[c] += f32::from(p[c]);
+                        }
+                    }
+                }
+                let n = ((sy1 - sy0) * (sx1 - sx0)).max(1) as f32;
+                let texel = &mut out[tx * 4..tx * 4 + 4];
+                for c in 0..3 {
+                    let v = (acc[c] / n - black[c]) * inv[c];
+                    texel[c] = f32_to_f16_bits_unclamped(v);
+                }
+                texel[3] = f32_to_f16_bits(1.0);
+            }
+        };
+        let threads = std::thread::available_parallelism().map_or(1, |n| n.get());
+        let rows_per = (height as usize).div_ceil(threads).max(1);
+        std::thread::scope(|scope| {
+            for (chunk, rows) in half.chunks_mut(rows_per * row_texels).enumerate() {
+                let fill_row = &fill_row;
+                scope.spawn(move || {
+                    for (i, out) in rows.chunks_mut(row_texels).enumerate() {
+                        fill_row(chunk * rows_per + i, out);
+                    }
+                });
+            }
+        });
+
+        let texture = ctx.device.create_texture_with_data(
+            &ctx.queue,
+            &wgpu::TextureDescriptor {
+                label: Some("linear-rgb-source"),
+                size: wgpu::Extent3d {
+                    width,
+                    height,
+                    depth_or_array_layers: 1,
+                },
+                mip_level_count: 1,
+                sample_count: 1,
+                dimension: wgpu::TextureDimension::D2,
+                format: Self::FORMAT,
+                usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_SRC,
+                view_formats: &[],
+            },
+            wgpu::util::TextureDataOrder::LayerMajor,
+            bytemuck::cast_slice(&half),
+        );
+        let view = texture.create_view(&Default::default());
+        // The extent is the texels' own, `width × k`, not the region's: the
+        // last block of a reduction may run past the frame's edge, and
+        // stretching it to fit would put every texel slightly off the
+        // pixels it averaged. The shader's bounds test is on the frame, so
+        // nothing past the edge is ever read.
+        let window = [
+            x0 as f32 / frame.0 as f32,
+            y0 as f32 / frame.1 as f32,
+            (width * k) as f32 / frame.0 as f32,
+            (height * k) as f32 / frame.1 as f32,
+        ];
+        Ok(Self {
+            texture,
+            view,
+            width,
+            height,
+            color_matrix: raw.color_matrix.unwrap_or(IDENTITY_3X3),
+            as_shot_wb: [raw.wb_coeffs[0], raw.wb_coeffs[1], raw.wb_coeffs[2]],
+            non_linear: false,
+            id: next_image_id(),
+            frame,
+            window,
+        })
+    }
+}
+
+/// Convert an f32 to half-precision bits, the general case: sign,
+/// subnormals, round-to-nearest-even, saturation at the largest finite.
+///
+/// `f32_to_f16_bits` below is the 8-bit special case and says why it can
+/// be; this one exists because a linear DNG is not that case. A 14-bit
+/// sensor's least significant step, normalised, is 6.1e-5 — right at f16's
+/// smallest normal (6.1e-5) — so the deepest shadows of a composite land
+/// in the subnormal range, and rounding them to zero would crush the
+/// shadows of exactly the file that was written to keep them. Values below
+/// zero (black subtraction on a noisy photosite) and above one (a highlight
+/// past the white level) are legitimate and kept.
+fn f32_to_f16_bits_unclamped(v: f32) -> u16 {
+    let bits = v.to_bits();
+    let sign = ((bits >> 16) & 0x8000) as u16;
+    let exp = ((bits >> 23) & 0xFF) as i32;
+    let mant = bits & 0x7F_FFFF;
+    if exp == 0xFF {
+        // Infinity or NaN: a NaN sample is a decode fault; store the largest
+        // finite rather than propagate it through a blend.
+        return sign | 0x7BFF;
+    }
+    let e = exp - 127 + 15;
+    if e >= 0x1F {
+        return sign | 0x7BFF;
+    }
+    if e <= 0 {
+        // Subnormal in f16 (or underflow). Shift the full mantissa with its
+        // implicit bit right by the deficit, rounding to nearest even.
+        if e < -10 {
+            return sign;
+        }
+        let m = (mant | 0x80_0000) >> (1 - e);
+        let shift = 13;
+        let rounded = round_shift(m, shift);
+        return sign | rounded as u16;
+    }
+    let rounded = round_shift(mant, 13);
+    // Rounding can carry into the exponent; that is correct.
+    sign | (((e as u32) << 10) + rounded) as u16
+}
+
+/// `v >> shift`, rounded to nearest with ties to even.
+fn round_shift(v: u32, shift: u32) -> u32 {
+    let half = 1u32 << (shift - 1);
+    let mask = (1u32 << shift) - 1;
+    let low = v & mask;
+    let mut out = v >> shift;
+    if low > half || (low == half && (out & 1) == 1) {
+        out += 1;
+    }
+    out
+}
+
 /// Convert an f32 to IEEE 754 half-precision bits.
 ///
 /// Written out rather than pulled in as a dependency: the inputs here are
@@ -285,6 +575,8 @@ pub struct Demosaicer {
    pipeline: wgpu::ComputePipeline,
    xtrans_pipeline: wgpu::ComputePipeline,
    bind_group_layout: wgpu::BindGroupLayout,
+    hot_pixel_pipeline: wgpu::ComputePipeline,
+    hot_pixel_layout: wgpu::BindGroupLayout,
 }

 impl Demosaicer {
@@ -375,11 +667,15 @@ impl Demosaicer {
                    cache: None,
                });

+        let (hot_pixel_pipeline, hot_pixel_layout) = hot_pixel_pipeline(ctx);
+
        Ok(Self {
            ctx: ctx.clone(),
            pipeline,
            xtrans_pipeline,
            bind_group_layout,
+            hot_pixel_pipeline,
+            hot_pixel_layout,
        })
    }

@@ -389,6 +685,9 @@ impl Demosaicer {
    /// `RawImage`; which of the two CFA families it came off is this
    /// function's problem, not theirs.
    pub fn run(&self, raw: &RawImage) -> Result<DemosaicedImage, GpuError> {
+        if raw.samples_per_pixel == 3 {
+            return DemosaicedImage::from_linear_rgb16(&self.ctx, raw);
+        }
        let (width, height) = (raw.crop.width.max(1), raw.crop.height.max(1));

        let limits = self.ctx.device.limits();
@@ -403,8 +702,12 @@ impl Demosaicer {
        // the buffer outlive the `if` that chose them.
        let bayer_params;
        let xtrans_params;
+        // Kept for the hot-pixel repair: finding the X-Trans phase reads the
+        // whole frame on the CPU, and once per photograph is enough.
+        let mut xtrans_tile = None;
        let (pipeline, params_bytes) = if raw.cfa_pattern.is_xtrans() {
            xtrans_params = xtrans_params_for(raw, width, height);
+            xtrans_tile = Some(xtrans_params.tile);
            (&self.xtrans_pipeline, bytemuck::bytes_of(&xtrans_params))
        } else {
            let pattern = match raw.cfa_pattern {
@@ -443,6 +746,64 @@ impl Demosaicer {
                usage: wgpu::BufferUsages::STORAGE,
            });

+        // TRACES: FR-RAW-3
+        // The mosaic the demosaic actually reads: the readout with its hot and
+        // dead photosites repaired. A second buffer rather than in place,
+        // because every photosite's verdict reads its neighbours' originals.
+        let repaired = self.ctx.device.create_buffer(&wgpu::BufferDescriptor {
+            label: Some("raw-repaired"),
+            size: raw_buf.size(),
+            usage: wgpu::BufferUsages::STORAGE,
+            mapped_at_creation: false,
+        });
+        let words = packed.len() as u32;
+        let groups = words.div_ceil(HOT_PIXEL_GROUP).max(1);
+        // A 24 MP readout is 190,000 workgroups, past the 65,535 one
+        // dispatch dimension may hold, so the grid folds into rows.
+        let groups_x = groups.min(
+            self.ctx
+                .device
+                .limits()
+                .max_compute_workgroups_per_dimension,
+        );
+        let groups_y = groups.div_ceil(groups_x);
+        let hot_params = hot_pixel_params(
+            raw,
+            (width, height),
+            words,
+            groups_x * HOT_PIXEL_GROUP,
+            xtrans_tile,
+        );
+        let hot_params_buf =
+            self.ctx
+                .device
+                .create_buffer_init(&wgpu::util::BufferInitDescriptor {
+                    label: Some("hot-pixel-params"),
+                    contents: bytemuck::bytes_of(&hot_params),
+                    usage: wgpu::BufferUsages::UNIFORM,
+                });
+        let hot_bind_group = self
+            .ctx
+            .device
+            .create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("hot-pixel-bg"),
+                layout: &self.hot_pixel_layout,
+                entries: &[
+                    wgpu::BindGroupEntry {
+                        binding: 0,
+                        resource: raw_buf.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 1,
+                        resource: hot_params_buf.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 2,
+                        resource: repaired.as_entire_binding(),
+                    },
+                ],
+            });
+
        let params_buf = self
            .ctx
            .device
@@ -481,7 +842,7 @@ impl Demosaicer {
                entries: &[
                    wgpu::BindGroupEntry {
                        binding: 0,
-                        resource: raw_buf.as_entire_binding(),
+                        resource: repaired.as_entire_binding(),
                    },
                    wgpu::BindGroupEntry {
                        binding: 1,
@@ -500,6 +861,18 @@ impl Demosaicer {
            .create_command_encoder(&wgpu::CommandEncoderDescriptor {
                label: Some("demosaic-encoder"),
            });
+        // Two passes in one submission. wgpu orders a storage write in one
+        // pass before a read of the same buffer in the next, so the demosaic
+        // sees every repair.
+        {
+            let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor {
+                label: Some("hot-pixel-pass"),
+                timestamp_writes: None,
+            });
+            pass.set_pipeline(&self.hot_pixel_pipeline);
+            pass.set_bind_group(0, &hot_bind_group, &[]);
+            pass.dispatch_workgroups(groups_x, groups_y, 1);
+        }
        {
            let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor {
                label: Some("demosaic-pass"),
@@ -523,11 +896,13 @@ impl Demosaicer {
            // Whatever the profile database had for this body (FR-DEV-3e),
            // resolved at decode because that is the only place the make and
            // model are known.
-            base_curve: raw.base_curve,
            // Sensor data is linear by construction — the demosaic shader
            // normalises against black and white levels and applies no
            // transfer function.
            non_linear: false,
+            id: next_image_id(),
+            frame: (width, height),
+            window: WHOLE_FRAME,
        })
    }
 }
@@ -804,6 +1179,136 @@ fn detect_xtrans_phase(raw: &RawImage) -> (u32, u32) {

 /// TRACES: FR-RAW-5
 /// Everything the X-Trans shader needs about one image.
+/// TRACES: FR-RAW-3
+/// The hot-pixel repair's pipeline and its three bindings: the readout, the
+/// uniform block, and the repaired copy it writes.
+fn hot_pixel_pipeline(ctx: &GpuContext) -> (wgpu::ComputePipeline, wgpu::BindGroupLayout) {
+    let shader = ctx
+        .device
+        .create_shader_module(wgpu::ShaderModuleDescriptor {
+            label: Some("hot-pixels"),
+            source: wgpu::ShaderSource::Wgsl(include_str!("shaders/hot_pixels.wgsl").into()),
+        });
+    let storage = |binding, read_only| wgpu::BindGroupLayoutEntry {
+        binding,
+        visibility: wgpu::ShaderStages::COMPUTE,
+        ty: wgpu::BindingType::Buffer {
+            ty: wgpu::BufferBindingType::Storage { read_only },
+            has_dynamic_offset: false,
+            min_binding_size: None,
+        },
+        count: None,
+    };
+    let layout = ctx
+        .device
+        .create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+            label: Some("hot-pixel-bgl"),
+            entries: &[
+                storage(0, true),
+                wgpu::BindGroupLayoutEntry {
+                    binding: 1,
+                    visibility: wgpu::ShaderStages::COMPUTE,
+                    ty: wgpu::BindingType::Buffer {
+                        ty: wgpu::BufferBindingType::Uniform,
+                        has_dynamic_offset: false,
+                        min_binding_size: None,
+                    },
+                    count: None,
+                },
+                storage(2, false),
+            ],
+        });
+    let pipeline_layout = ctx
+        .device
+        .create_pipeline_layout(&wgpu::PipelineLayoutDescriptor {
+            label: Some("hot-pixel-layout"),
+            bind_group_layouts: &[Some(&layout)],
+            immediate_size: 0,
+        });
+    let pipeline = ctx
+        .device
+        .create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+            label: Some("hot-pixel-pipeline"),
+            layout: Some(&pipeline_layout),
+            module: &shader,
+            entry_point: Some("main"),
+            compilation_options: Default::default(),
+            cache: None,
+        });
+    (pipeline, layout)
+}
+
+/// The colour of each position of a Bayer cell, row-major, for the pattern
+/// the decoder reported: 0=R, 1=G, 2=B. `None` for anything that is not a
+/// 2×2 pattern.
+fn bayer_cell(pattern: CfaPattern) -> Option<[u32; 4]> {
+    match pattern {
+        CfaPattern::Rggb => Some([0, 1, 1, 2]),
+        CfaPattern::Bggr => Some([2, 1, 1, 0]),
+        CfaPattern::Grbg => Some([1, 0, 2, 1]),
+        CfaPattern::Gbrg => Some([1, 2, 0, 1]),
+        _ => None,
+    }
+}
+
+/// A Bayer cell as the 6×6 sensor-anchored tile the repair indexes.
+///
+/// The decoder's pattern is phased for the *crop* origin, and the tile is
+/// indexed by sensor coordinate, so each position is shifted by the crop.
+/// Six is even, so a column's parity modulo 6 is its parity outright and the
+/// cell repeats cleanly.
+fn pack_bayer_tile(cell: [u32; 4], crop_x: u32, crop_y: u32) -> [u32; 4] {
+    let mut out = [0u32; 4];
+    for row in 0..6u32 {
+        for col in 0..6u32 {
+            let i = (((row + crop_y) & 1) * 2 + ((col + crop_x) & 1)) as usize;
+            out[(row >> 1) as usize] |= cell[i] << ((row & 1) * 12 + col * 2);
+        }
+    }
+    out
+}
+
+/// The repair's uniforms for one readout.
+///
+/// `xtrans_tile` is the tile the X-Trans demosaic was given, when it was one;
+/// anything else must be a Bayer pattern, which `run` has already checked.
+fn hot_pixel_params(
+    raw: &RawImage,
+    (width, height): (u32, u32),
+    words: u32,
+    row_invocations: u32,
+    xtrans_tile: Option<[u32; 4]>,
+) -> HotPixelParams {
+    let (black, inv_range, tile) = match (xtrans_tile, bayer_cell(raw.cfa_pattern)) {
+        (Some(tile), _) => {
+            let (black, inv_range) = xtrans_levels(raw);
+            ([black; 4], [inv_range; 4], tile)
+        }
+        (None, Some(cell)) => (
+            black_per_cell(raw),
+            inv_range_per_cell(raw),
+            pack_bayer_tile(cell, raw.crop.x, raw.crop.y),
+        ),
+        // Not reached from `run`, which refuses any other pattern before
+        // this. A zero tile judges every photosite against all of its
+        // neighbours, which is right for a sensor with no colour filter.
+        (None, None) => (black_per_cell(raw), inv_range_per_cell(raw), [0; 4]),
+    };
+    HotPixelParams {
+        crop_x: raw.crop.x,
+        crop_y: raw.crop.y,
+        width,
+        height,
+        stride: raw.width,
+        words,
+        row_invocations,
+        samples: raw.data.len() as u32,
+        black,
+        inv_range,
+        tile,
+    }
+}
+
 fn xtrans_params_for(raw: &RawImage, width: u32, height: u32) -> XTransParams {
    let (black, inv_range) = xtrans_levels(raw);
    let wb = wb_gains(raw);
@@ -827,6 +1332,61 @@ mod tests {
    use super::*;
    use dr_decode::CropRect;

+    fn f16_to_f32(bits: u16) -> f32 {
+        let sign = if bits & 0x8000 != 0 { -1.0 } else { 1.0 };
+        let e = ((bits >> 10) & 0x1F) as i32;
+        let m = (bits & 0x3FF) as f32;
+        if e == 0 {
+            sign * m * 2f32.powi(-24)
+        } else {
+            sign * (1.0 + m / 1024.0) * 2f32.powi(e - 15)
+        }
+    }
+
+    /// The repair's tile is indexed by sensor coordinate, the decoder's
+    /// pattern by crop coordinate. A crop at an odd origin must shift one
+    /// into the other, or the repair compares red with green.
+    #[test]
+    fn the_bayer_tile_is_anchored_to_the_sensor_not_the_crop() {
+        let cell = bayer_cell(CfaPattern::Rggb).unwrap();
+        let colour = |tile: [u32; 4], x: u32, y: u32| {
+            (tile[((y % 6) >> 1) as usize] >> (((y % 6) & 1) * 12 + (x % 6) * 2)) & 3
+        };
+        for (cx, cy) in [(0, 0), (1, 0), (0, 1), (1, 1), (7, 4)] {
+            let tile = pack_bayer_tile(cell, cx, cy);
+            // Red is the crop's first photosite, wherever the crop starts.
+            assert_eq!(colour(tile, cx, cy), 0, "crop at ({cx}, {cy})");
+            assert_eq!(colour(tile, cx + 1, cy + 1), 2, "crop at ({cx}, {cy})");
+            assert_eq!(colour(tile, cx + 1, cy), 1, "crop at ({cx}, {cy})");
+        }
+    }
+
+    #[test]
+    fn unclamped_half_keeps_shadows_signs_and_highlights() {
+        // A 14-bit LSB, normalised: subnormal in f16, and must not be zero.
+        let lsb = 1.0 / 16383.0;
+        let back = f16_to_f32(f32_to_f16_bits_unclamped(lsb));
+        assert!((back - lsb).abs() / lsb < 0.01, "{back} vs {lsb}");
+        // A quarter of that, still representable.
+        let tiny = lsb / 4.0;
+        let back = f16_to_f32(f32_to_f16_bits_unclamped(tiny));
+        assert!((back - tiny).abs() / tiny < 0.05, "{back} vs {tiny}");
+        // Below zero and above one survive.
+        assert!((f16_to_f32(f32_to_f16_bits_unclamped(-0.01)) + 0.01).abs() < 1e-5);
+        assert!((f16_to_f32(f32_to_f16_bits_unclamped(1.75)) - 1.75).abs() < 1e-3);
+        // Exact values are exact.
+        assert_eq!(f32_to_f16_bits_unclamped(1.0), 0x3C00);
+        assert_eq!(f32_to_f16_bits_unclamped(0.5), 0x3800);
+        assert_eq!(f32_to_f16_bits_unclamped(0.0), 0);
+        // Within one ULP of the clamped one on its domain: that one
+        // truncates the mantissa, this one rounds it.
+        for i in 0..=255 {
+            let v = i as f32 / 255.0;
+            let (a, b) = (f32_to_f16_bits_unclamped(v), f32_to_f16_bits(v));
+            assert!(a.abs_diff(b) <= 1, "{v}: {a} vs {b}");
+        }
+    }
+
    fn raw_for(black: [u16; 4], white: u16) -> RawImage {
        RawImage {
            width: 4,
@@ -837,7 +1397,10 @@ mod tests {
            white_level: white,
            wb_coeffs: [1.0, 1.0, 1.0, 1.0],
            color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
+            samples_per_pixel: 1,
+            profile: None,
+            make: String::new(),
+            model: String::new(),
            crop: CropRect {
                x: 0,
                y: 0,
@@ -949,7 +1512,10 @@ mod tests {
            white_level: white,
            wb_coeffs: [1.0, 1.0, 1.0, 1.0],
            color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
+            samples_per_pixel: 1,
+            profile: None,
+            make: String::new(),
+            model: String::new(),
            crop: CropRect {
                x: 0,
                y: 0,
@@ -1170,6 +1736,53 @@ mod tests {
        }
    }

+    #[test]
+    fn a_grey_step_edge_stays_grey() {
+        // A flat patch cannot tell the Malvar kernels from any other set of
+        // weights that sum to zero. An edge can. A grey vertical step, so
+        // every photosite records the same profile, must come back with the
+        // three channels close together on both sides; any spread is false
+        // colour from interpolating across the edge.
+        //
+        // The bound is set by the paper's kernels, which peak at 0.19 here.
+        // With the ±2 terms of the green-site kernels transposed — the bug
+        // this test was written against — the peak is 0.375.
+        let Some(ctx) = ctx() else { return };
+        let d = Demosaicer::new(&ctx).expect("demosaicer");
+
+        let size = 32u32;
+        let white = 16383u16;
+        let mut raw = flat_cfa(CfaPattern::Rggb, size, [0, 0, 0], 0, white);
+        for y in 0..size {
+            for x in size / 2..size {
+                raw.data[(y * size + x) as usize] = white;
+            }
+        }
+
+        let img = d.run(&raw).expect("demosaic");
+        let px = read_rgba(&ctx, &img);
+        let (w, _) = img.size();
+
+        let mut worst = (0.0f32, 0u32, 0u32);
+        for y in 2..size - 2 {
+            for x in 2..size - 2 {
+                let p = px[(y * w + x) as usize];
+                let spread = (p[0] - p[1]).abs().max((p[2] - p[1]).abs());
+                if spread > worst.0 {
+                    worst = (spread, x, y);
+                }
+            }
+        }
+        assert!(
+            worst.0 < 0.25,
+            "false colour of {} at ({}, {}) on a grey edge — the green-site \
+             kernels are interpolating across the edge",
+            worst.0,
+            worst.1,
+            worst.2
+        );
+    }
+
    #[test]
    fn output_is_free_of_nan_and_negatives() {
        // f16 NaN propagates silently through every later stage; a negative
@@ -1195,7 +1808,10 @@ mod tests {
            white_level: 16383,
            wb_coeffs: [1.0, 1.0, 1.0, 1.0],
            color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
+            samples_per_pixel: 1,
+            profile: None,
+            make: String::new(),
+            model: String::new(),
            crop: CropRect {
                x: 0,
                y: 0,
@@ -1276,7 +1892,10 @@ mod tests {
                1.0,
            ],
            color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
+            samples_per_pixel: 1,
+            profile: None,
+            make: String::new(),
+            model: String::new(),
            crop: CropRect {
                x: 0,
                y: 0,
@@ -43,12 +43,12 @@
 //! dispatch is skipped, and dragging a sharpening slider costs the detail
 //! passes alone (FR-DEV-3d).
 //!
-//! The remaining passes alternate between slots 1 and 2, and the last one
-//! writes the display texture directly rather than an intermediate — so a
-//! chain of *N* passes costs *N* dispatches and not *N* + 1, and there is no
-//! resolve pass to pay for. That leaves the allocation at `1 + min(N-1, 2)`
-//! textures: one for a single-pass operation, two for a separable blur, three
-//! however long the chain gets after that.
+//! The passes alternate between slots 1 and 2, the last one included: since
+//! D19 it hands its result to the adjust pass's **view pass**, which performs
+//! the view transform and the output transform after every kernel, so no
+//! detail pass writes the display texture. A chain of *N* passes costs *N*
+//! dispatches plus that one, and the allocation is `1 + min(N, 2)` textures.
+//! An empty chain costs the view pass alone, reading slot 0.
 //!
 //! # The reduced chain, and why a second one was needed
 //!
@@ -186,10 +186,9 @@ impl Intermediates {
 /// intermediate against a fresh colour result and never be told.
 pub(crate) struct DetailRunner {
    ctx: GpuContext,
-    /// Layout for a pass writing another linear intermediate.
+    /// Layout for every pass: each writes a linear intermediate, the last
+    /// one included, and the adjust pass's view pass reads the last (D19).
    to_linear: Layout,
-    /// Layout for the last pass, which writes the display texture.
-    to_output: Layout,
    /// Compiled pipelines by pass structure hash.
    cache: HashMap<u64, wgpu::ComputePipeline>,
    pool: Intermediates,
@@ -255,7 +254,6 @@ impl DetailRunner {
        Self {
            ctx: ctx.clone(),
            to_linear: Layout::new(ctx, INTERMEDIATE_FORMAT, "detail-linear"),
-            to_output: Layout::new(ctx, crate::AdjustPass::FORMAT, "detail-output"),
            cache: HashMap::new(),
            pool: Intermediates::new(),
            reduced: Intermediates::new(),
@@ -274,27 +272,30 @@ impl DetailRunner {
        width: u32,
        height: u32,
    ) -> &wgpu::TextureView {
-        // One for the colour pass's result, then one per hand-off between
-        // detail passes, capped at two because a ping-pong needs no more: the
-        // last pass writes the display texture rather than an intermediate.
-        let needed = 1 + passes.saturating_sub(1).min(2);
+        // One for the colour pass's result, then one per pass, capped at two
+        // because a ping-pong needs no more. The last pass writes an
+        // intermediate like the others since D19 — the view pass reads it —
+        // so a one-pass chain needs two slots where it used to need one.
+        let needed = 1 + passes.min(2);
        self.pool.ensure(&self.ctx, needed, width, height);
        &self.pool.slots[0].view
    }

-    /// Encode every pass of `chain`, the last one writing `output`.
+    /// Encode every pass of `chain`, and return how many ran and the view
+    /// the last one wrote — slot 0, the colour pass's own result, for an
+    /// empty chain.
    ///
    /// The caller must already have run the fused colour pass into
    /// [`Self::colour_target`] — or established that a previous frame's is
-    /// still valid, which is the whole point of keeping slot 0.
+    /// still valid, which is the whole point of keeping slot 0 — and reads the
+    /// returned view in the view pass that finishes the render (D19).
    pub(crate) fn encode(
        &mut self,
        encoder: &mut wgpu::CommandEncoder,
        chain: &ComposedDetail,
-        output: &wgpu::TextureView,
        width: u32,
        height: u32,
-    ) -> Result<usize, GpuError> {
+    ) -> Result<(usize, wgpu::TextureView), GpuError> {
        for pass in &chain.passes {
            self.compile(pass)?;
        }
@@ -340,17 +341,15 @@ impl DetailRunner {
        for pass in chain.passes.iter() {
            let scaled = pass.output_scale > 1;

-            // The last pass carries the output transform into the display
-            // texture, which is the render size by definition. A scaled pass
-            // there would bind a shader dispatching over a quarter-size grid
-            // to a full-size target and write a quarter of the picture — a
-            // wrong image rather than a validation failure, so it is caught
-            // here and named.
-            if scaled && pass.writes_output {
+            // The last pass hands the view pass its input, which is read at
+            // the render size by definition. A scaled pass there would leave
+            // the result in the reduced chain and the view pass would read the
+            // full-size slot before it — a wrong image rather than a
+            // validation failure, so it is caught here and named.
+            if scaled && std::ptr::eq(pass, chain.passes.last().expect("iterating")) {
                return Err(GpuError::ShaderCompilation(format!(
                    "detail pass {} declares output_scale {} and is last in \
-                     the chain; the output transform is written at the render \
-                     size",
+                     the chain; the view pass reads the render size",
                    pass.label, pass.output_scale
                )));
            }
@@ -365,17 +364,14 @@ impl DetailRunner {
            };

            // Read what the previous pass in *this pass's own chain* wrote;
-            // write the next slot of it, or the display texture if this is the
-            // last pass. Alternating slots is what stops a pass reading the
+            // write the next slot of it. Alternating slots is what stops a pass reading the
            // texture it is writing — on a compute pass that is not an error
            // the driver reports, merely a picture that depends on scheduling.
            let source = match (scaled, carried) {
                (true, Some(slot)) => &self.reduced.slots[slot].view,
                _ => &self.pool.slots[full].view,
            };
-            let destination = if pass.writes_output {
-                output
-            } else if scaled {
+            let destination = if scaled {
                &self.reduced.slots[reduced_writes % 2].view
            } else {
                &self.pool.slots[1 + (full_writes % 2)].view
@@ -387,11 +383,7 @@ impl DetailRunner {
                Some(slot) => &self.reduced.slots[slot].view,
                None => &self.no_reduced,
            };
-            let layout = if pass.writes_output {
-                &self.to_output
-            } else {
-                &self.to_linear
-            };
+            let layout = &self.to_linear;

            let params = self
                .ctx
@@ -464,9 +456,7 @@ impl DetailRunner {
            compute.dispatch_workgroups(dispatch_w.div_ceil(8), dispatch_h.div_ceil(8), 1);
            drop(compute);

-            if pass.writes_output {
-                // Nothing downstream to hand anything to.
-            } else if scaled {
+            if scaled {
                carried = Some(reduced_writes % 2);
                reduced_writes += 1;
            } else {
@@ -480,7 +470,7 @@ impl DetailRunner {
            }
        }

-        Ok(chain.passes.len())
+        Ok((chain.passes.len(), self.pool.slots[full].view.clone()))
    }

    /// Compile one pass, or leave the cached pipeline in place.
@@ -508,11 +498,7 @@ impl DetailRunner {
                source: wgpu::ShaderSource::Wgsl(pass.source.as_str().into()),
            });

-        let layout = if pass.writes_output {
-            &self.to_output
-        } else {
-            &self.to_linear
-        };
+        let layout = &self.to_linear;

        let pipeline = self
            .ctx
@@ -470,7 +470,7 @@ impl FocusPeakPass {
            // TEXTURE_BINDING to be sampled by the compositor.
            // RENDER_ATTACHMENT is not used by anything here and is required
            // anyway: Slint rejects an imported texture without it. COPY_SRC
-            // is for `read_overlay` and its two callers.
+            // is for `read_overlay` and the tests that call it.
            usage: wgpu::TextureUsages::STORAGE_BINDING
                | wgpu::TextureUsages::TEXTURE_BINDING
                | wgpu::TextureUsages::RENDER_ATTACHMENT
@@ -490,18 +490,11 @@ impl FocusPeakPass {
    /// TRACES: AC-8
    /// Copy the overlay to the CPU, as RGBA8 rows with no padding.
    ///
-    /// **Two callers, and neither is the desktop display path.** The tests
-    /// below are one: an overlay is a claim about which pixels are sharp, and
-    /// there is no way to check that claim without looking at the pixels. The
-    /// other is the Android develop view, which reads the *frame* back for the
-    /// reasons `technical-debt.md` TD-1 records — wgpu's Android swapchain
-    /// tears a portrait window, so Slint is not drawing with wgpu there and no
-    /// texture can be handed over. An overlay that stayed on the device on a
-    /// platform where the picture underneath it does not would simply never be
-    /// seen.
-    ///
-    /// On desktop nothing calls this, and ARCH §6.1 holds on the path that
-    /// matters: the overlay reaches the compositor as a texture.
+    /// **The tests below are the only caller, and never the display path.** An
+    /// overlay is a claim about which pixels are sharp, and there is no way to
+    /// check that claim without looking at the pixels. On screen, on desktop
+    /// and Android alike, the overlay reaches the compositor as a texture and
+    /// ARCH §6.1 holds. (Android read it back here until TD-1 was paid off.)
    pub fn read_overlay(&self) -> Result<(Vec<u8>, u32, u32), GpuError> {
        let Some(layer) = self.layers[self.current].as_ref() else {
            return Err(GpuError::Readback("no overlay has been rendered".into()));
@@ -6,7 +6,7 @@
 //! module doc said for eight releases that it held no pipeline and no masks.
 //! It holds both now, plus demosaic, detail, segmentation masks, two
 //! histograms and focus peaking. The zero-copy claim is still the one that
-//! matters, and TD-1 records the one platform where it does not hold.
+//! matters, and since TD-1 was paid off it holds on Android too.
 //!
 //! Deliberately free of UI dependencies (ARCH §6.5a). The texture is handed
 //! out as a `wgpu::Texture`; who composites it is not this crate's concern.
@@ -28,6 +28,7 @@ mod error;
 mod focus;
 mod histogram;
 mod mask;
+mod merge;
 mod raw_histogram;
 mod readback;
 mod segment;
@@ -40,6 +41,7 @@ pub use demosaic::{DemosaicedImage, Demosaicer};
 pub use detail::INTERMEDIATE_FORMAT as DETAIL_INTERMEDIATE_FORMAT;
 pub use error::GpuError;
 pub use focus::{FocusPeakPass, FocusPeaking, PeakColour, PeakSensitivity};
+pub use merge::{Band, MergeFrame, MergeOutput, MergePass};
 // Renamed on the way out: `BINS` says enough inside `histogram`, and nothing
 // at all at a crate root shared with demosaic and segmentation.
 pub use histogram::{Histogram, HistogramPass, BINS as HISTOGRAM_BINS};
@@ -281,6 +283,7 @@ impl GpuContext {
        )))
    }

+    /// TRACES: NFR-COMPAT-1
    /// Ask one adapter for a device, with the limits the pipeline needs.
    async fn device_from(adapter: &wgpu::Adapter) -> Result<(wgpu::Device, wgpu::Queue), GpuError> {
        adapter
@@ -332,6 +335,20 @@ impl GpuContext {
    pub fn backend(&self) -> wgpu::Backend {
        self.adapter_info.backend
    }
+
+    /// TRACES: NFR-OPS-1
+    /// The driver, as the adapter reported it, for a diagnostics bundle.
+    /// Name and version in one string because wgpu splits them by backend
+    /// and neither half means much without the other.
+    pub fn driver(&self) -> String {
+        let info = &self.adapter_info;
+        match (info.driver.is_empty(), info.driver_info.is_empty()) {
+            (true, true) => "unknown driver".to_string(),
+            (false, true) => info.driver.clone(),
+            (true, false) => info.driver_info.clone(),
+            (false, false) => format!("{} {}", info.driver, info.driver_info),
+        }
+    }
 }

 #[repr(C)]
@@ -395,6 +395,7 @@ pub struct MaskPass {
    combine_layout: wgpu::BindGroupLayout,
    combine_union: wgpu::RenderPipeline,
    combine_subtract: wgpu::RenderPipeline,
+    combine_intersect: wgpu::RenderPipeline,
    /// Where a part is drawn before it is joined.
    ///
    /// One texture for the whole stack rather than one per layer, because
@@ -651,6 +652,16 @@ impl MaskPass {
            "mask-combine-subtract",
            blend_state(wgpu::BlendFactor::Zero, wgpu::BlendFactor::OneMinusSrc),
        );
+        // TRACES: FR-DEV-19a
+        // `dst * src`: what the mask had, kept only in proportion to how much
+        // of it this part also covers. The same three vertices and the same
+        // scratch, so a third set operation is a third blend state and
+        // nothing more — which is what `Join::apply` states on the CPU and
+        // `the_joins_match_their_definition` holds this to.
+        let combine_intersect = combine(
+            "mask-combine-intersect",
+            blend_state(wgpu::BlendFactor::Zero, wgpu::BlendFactor::Src),
+        );

        // The same, with the deposit thrown away: coverage is only ever taken
        // off what earlier strokes on this layer put down. There is no negative
@@ -681,6 +692,7 @@ impl MaskPass {
            combine_layout,
            combine_union,
            combine_subtract,
+            combine_intersect,
            scratch: None,
            array: None,
            allocations: 0,
@@ -708,10 +720,36 @@ impl MaskPass {
        source: Option<&DemosaicedImage>,
        width: u32,
        height: u32,
+    ) -> Result<&MaskArray, GpuError> {
+        self.render_revealing(stack, labels, subjects, source, width, height, None)
+    }
+
+    /// TRACES: FR-DEV-19c
+    /// [`Self::render`], also drawing the layer being looked at.
+    ///
+    /// A selection with no adjustment on it changes no pixel, so it is not
+    /// active and has no slice — which is right until somebody asks to *see*
+    /// it, and that is the state a photographer is in from choosing a subject
+    /// until deciding what to do to it.
+    ///
+    /// `reveal` has to be the same one the shader was composed with and the
+    /// same one the distance fields were built for: all three index this array
+    /// by position in [`MaskStack::rendered`], and two of them disagreeing
+    /// shows as an adjustment applied through another layer's mask.
+    #[allow(clippy::too_many_arguments)]
+    pub fn render_revealing(
+        &mut self,
+        stack: &MaskStack,
+        labels: Option<&LabelField>,
+        subjects: Option<&SubjectMasks>,
+        source: Option<&DemosaicedImage>,
+        width: u32,
+        height: u32,
+        reveal: Option<&dr_pipeline::mask::Reveal>,
    ) -> Result<&MaskArray, GpuError> {
        // At least one layer, because a zero-layer texture array is invalid
        // and the shader binds this slot unconditionally.
-        let active = stack.active_count().clamp(1, MAX_LAYERS) as u32;
+        let active = stack.rendered_count(reveal).clamp(1, MAX_LAYERS) as u32;
        self.ensure_array(width, height, active)?;

        let mut encoder = self
@@ -721,7 +759,7 @@ impl MaskPass {
                label: Some("mask-encoder"),
            });

-        for (slot, layer) in stack.active().enumerate().take(MAX_LAYERS) {
+        for (slot, layer) in stack.rendered(reveal).enumerate().take(MAX_LAYERS) {
            // **The path a mask with one part takes is the path every mask
            // took before parts existed**: drawn straight into the layer's
            // slice, cleared by the draw itself. Nothing about an unedited
@@ -732,12 +770,24 @@ impl MaskPass {
            // is done where it is read back rather than where it is drawn —
            // a brush deposits dabs and cannot know what the rest of the
            // frame is. See `fs_combine`.
-            let direct = layer.parts().len() == 1 && !layer.base().invert;
+            // TRACES: FR-DEV-19a
+            // The shown parts, not the parts: a hidden one is skipped here
+            // and nowhere else, and the first *shown* part is the one that
+            // opens the fold. Which can leave nothing — a revealed layer with
+            // every part hidden — and that clears the slice rather than
+            // leaving whatever the last rasterisation put there to be read
+            // back as this mask.
+            let shown: Vec<&dr_pipeline::mask::MaskPart> = layer.shown_parts().collect();
+            if shown.is_empty() {
+                self.clear_slice(&mut encoder, slot as u32);
+                continue;
+            }
+            let direct = shown.len() == 1 && !shown[0].invert;
            if !direct {
                self.ensure_scratch(width, height)?;
            }

-            for (index, part) in layer.parts().iter().enumerate() {
+            for (index, part) in shown.iter().copied().enumerate() {
                let base = index == 0;
                let field = match (&part.source, labels) {
                    (MaskSource::Regions { .. }, None) => {
@@ -878,7 +928,7 @@ impl MaskPass {
        // the only readers and they are skipped in that case.
        let source_step = match source {
            Some(image) => {
-                let (sw, sh) = image.size();
+                let (sw, sh) = image.texture_size();
                [
                    sw as f32 / width.max(1) as f32,
                    sh as f32 / height.max(1) as f32,
@@ -1338,11 +1388,38 @@ impl MaskPass {
        pass.set_pipeline(match join {
            Join::Union => &self.combine_union,
            Join::Subtract => &self.combine_subtract,
+            Join::Intersect => &self.combine_intersect,
        });
        pass.set_bind_group(0, &bind_group, &[]);
        pass.draw(0..3, 0..1);
    }

+    /// Leave a layer's slice covering nothing.
+    ///
+    /// A pass that clears and draws nothing, for the one case where a layer
+    /// reaches the array with no part to draw: every part hidden while the
+    /// layer is being revealed. The slice has to be written, because the
+    /// shader reads it whatever this function did.
+    fn clear_slice(&self, encoder: &mut wgpu::CommandEncoder, slot: u32) {
+        let target = self.slice_view(slot);
+        encoder.begin_render_pass(&wgpu::RenderPassDescriptor {
+            label: Some("mask-clear-pass"),
+            color_attachments: &[Some(wgpu::RenderPassColorAttachment {
+                view: &target,
+                depth_slice: None,
+                resolve_target: None,
+                ops: wgpu::Operations {
+                    load: wgpu::LoadOp::Clear(wgpu::Color::BLACK),
+                    store: wgpu::StoreOp::Store,
+                },
+            })],
+            depth_stencil_attachment: None,
+            timestamp_writes: None,
+            occlusion_query_set: None,
+            multiview_mask: None,
+        });
+    }
+
    /// The texture a part is drawn in before it is joined.
    ///
    /// Allocated on the first mask that has more than one part and kept at the
@@ -0,0 +1,659 @@
+//! TRACES: FR-MRG-10 | FR-MRG-11
+//! The merge: source frames warped into an output surface, chunk by chunk.
+//!
+//! The per-pixel half of a panorama (FR-MRG-10), on the GPU: the warp of a
+//! source tile into an output chunk, the weighted accumulation across
+//! frames, and the resolve to sixteen-bit samples. The geometry it is
+//! given — rotations, focal length, projection — is `dr-pano`'s, solved on
+//! proxies before any full-resolution pixel exists (panorama.md §5), and
+//! that is what makes this simple: every output pixel's source coordinates
+//! are a closed-form function, so a chunk can be produced from the source
+//! tiles that project into it and nothing else.
+//!
+//! # The loop
+//!
+//! ```text
+//! for each band of rows of the output:
+//!     for each chunk across the band:
+//!         zero the accumulator
+//!         for each frame whose footprint meets the chunk:
+//!             the source rectangle the chunk needs, from the geometry
+//!             render it camera-linear through the pipeline (the tile)
+//!             warp the tile into the chunk, accumulate       ← GPU
+//!         resolve the chunk to u16                            ← GPU
+//!         copy it into the band
+//!     hand the band to the writer (one DNG strip)
+//! ```
+//!
+//! No stage holds the composite (FR-MRG-11): the working set is one
+//! chunk's accumulator, one tile, one band of u16 rows. The frame textures
+//! are the caller's to provide and cache — `source` is asked for frame `k`
+//! as it is needed, and a caller short of memory may demosaic on demand.
+//!
+//! # The blend
+//!
+//! With a seam map (`dr_pano::seam`), a frame's weight at a pixel is its
+//! share of the map about that pixel — whole on its own side of a seam,
+//! nothing on the other, and a ramp across a window `seam_blend` pixels
+//! wide that follows the seam. Without one, or where the map has nothing
+//! to say, the weight is the distance to the frame's edge over `feather`,
+//! which hides exposure steps and does not hide parallax: the average draws
+//! anything the frames disagree on twice.
+//!
+//! # What is not here yet
+//!
+//! A Laplacian pyramid, which would let the seam's blend be narrow for
+//! detail and wide for exposure at once. Gain is a scalar per frame the
+//! caller supplies.
+
+use std::sync::Arc;
+
+use dr_pano::bundle::Cameras;
+use dr_pano::projection::{Bounds, Projection};
+use dr_pano::seam::SeamMap;
+use wgpu::util::DeviceExt;
+
+use crate::readback::await_mapping;
+use crate::{AdjustPass, DemosaicedImage, GpuContext, GpuError};
+
+/// One frame's part in the merge.
+pub struct MergeFrame {
+    /// The frame's edit, for its lens corrections — the only part of an
+    /// edit the camera-space tap uses (FR-MRG-2).
+    pub graph: Arc<dr_pipeline::EditGraph>,
+    /// Multiplies the frame's samples, to bring its exposure to the
+    /// reference frame's. 1.0 for no correction.
+    pub gain: f32,
+}
+
+/// The output the merge produces.
+#[derive(Debug, Clone, PartialEq)]
+pub struct MergeOutput {
+    pub projection: Projection,
+    /// The projection's scale in output pixels: the cylinder's radius, the
+    /// plane's distance. The source focal length at full resolution gives
+    /// output pixels the size of source pixels at the centre.
+    pub scale: f64,
+    /// The rectangle of the projection to produce, centred coordinates.
+    pub bounds: Bounds,
+    /// Pixels over which a frame's weight ramps up from its edge.
+    pub feather: f32,
+    /// Which frame each part of the output is taken from, laid out at the
+    /// proxies' scale; `None` for the feathered average everywhere.
+    pub seams: Option<Arc<SeamMap>>,
+    /// The width, in output pixels, of the blend across a seam.
+    pub seam_blend: f32,
+    /// Chunk size: the unit of GPU work and of memory.
+    pub chunk: (u32, u32),
+    /// Multiplies a normalised sample (1.0 = white) to the sensor's scale.
+    pub sample_scale: f32,
+    /// The white balance the composite will be developed with — the
+    /// inverse of its `AsShotNeutral` — so that a blown sample can be
+    /// written as the camera value that balance calls grey.
+    pub balance: [f32; 3],
+}
+
+impl MergeOutput {
+    pub fn width(&self) -> u32 {
+        self.bounds.width().ceil().max(1.0) as u32
+    }
+    pub fn height(&self) -> u32 {
+        self.bounds.height().ceil().max(1.0) as u32
+    }
+}
+
+/// A band of finished rows: `rows × width × 3` RGB `u16`, plus a coverage
+/// mask (`true` where any frame reached the pixel).
+pub struct Band<'a> {
+    pub first_row: u32,
+    pub rows: u32,
+    pub rgb: &'a [u16],
+    pub covered: &'a [bool],
+}
+
+#[repr(C)]
+#[derive(Clone, Copy, bytemuck::Pod, bytemuck::Zeroable)]
+struct WarpParams {
+    chunk_origin: [f32; 2],
+    chunk_size: [u32; 2],
+    projection: u32,
+    proj_scale: f32,
+    focal: f32,
+    gain: f32,
+    r0: [f32; 4],
+    r1: [f32; 4],
+    r2: [f32; 4],
+    frame_size: [f32; 2],
+    tile_origin: [f32; 2],
+    tile_size: [u32; 2],
+    feather: f32,
+    clip_onset: f32,
+    balance: [f32; 4],
+    seam_origin: [f32; 2],
+    seam_size: [u32; 2],
+    seam_px: f32,
+    seam_radius: f32,
+    frame_index: u32,
+    seam_on: u32,
+}
+
+#[repr(C)]
+#[derive(Clone, Copy, bytemuck::Pod, bytemuck::Zeroable)]
+struct ResolveParams {
+    chunk_size: [u32; 2],
+    scale: f32,
+    _pad: f32,
+}
+
+/// The two pipelines and the chunk buffers.
+pub struct MergePass {
+    ctx: GpuContext,
+    warp: wgpu::ComputePipeline,
+    warp_layout: wgpu::BindGroupLayout,
+    resolve: wgpu::ComputePipeline,
+    resolve_layout: wgpu::BindGroupLayout,
+    /// Accumulator and packed output for the current chunk size.
+    buffers: Option<(wgpu::Buffer, wgpu::Buffer, wgpu::Buffer, (u32, u32))>,
+}
+
+impl MergePass {
+    pub fn new(ctx: &GpuContext) -> Result<Self, GpuError> {
+        let module = ctx
+            .device
+            .create_shader_module(wgpu::ShaderModuleDescriptor {
+                label: Some("merge"),
+                source: wgpu::ShaderSource::Wgsl(include_str!("shaders/merge.wgsl").into()),
+            });
+        let uniform = |binding| wgpu::BindGroupLayoutEntry {
+            binding,
+            visibility: wgpu::ShaderStages::COMPUTE,
+            ty: wgpu::BindingType::Buffer {
+                ty: wgpu::BufferBindingType::Uniform,
+                has_dynamic_offset: false,
+                min_binding_size: None,
+            },
+            count: None,
+        };
+        let storage = |binding, read_only| wgpu::BindGroupLayoutEntry {
+            binding,
+            visibility: wgpu::ShaderStages::COMPUTE,
+            ty: wgpu::BindingType::Buffer {
+                ty: wgpu::BufferBindingType::Storage { read_only },
+                has_dynamic_offset: false,
+                min_binding_size: None,
+            },
+            count: None,
+        };
+        let warp_layout = ctx
+            .device
+            .create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+                label: Some("merge-warp-bgl"),
+                entries: &[
+                    uniform(0),
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 1,
+                        visibility: wgpu::ShaderStages::COMPUTE,
+                        ty: wgpu::BindingType::Texture {
+                            // Unfilterable: rgba32float, loaded by hand.
+                            sample_type: wgpu::TextureSampleType::Float { filterable: false },
+                            view_dimension: wgpu::TextureViewDimension::D2,
+                            multisampled: false,
+                        },
+                        count: None,
+                    },
+                    storage(2, false),
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 3,
+                        visibility: wgpu::ShaderStages::COMPUTE,
+                        ty: wgpu::BindingType::Texture {
+                            sample_type: wgpu::TextureSampleType::Uint,
+                            view_dimension: wgpu::TextureViewDimension::D2,
+                            multisampled: false,
+                        },
+                        count: None,
+                    },
+                ],
+            });
+        let resolve_layout =
+            ctx.device
+                .create_bind_group_layout(&wgpu::BindGroupLayoutDescriptor {
+                    label: Some("merge-resolve-bgl"),
+                    entries: &[uniform(0), storage(1, true), storage(2, false)],
+                });
+        let pipeline = |name: &str, layout: &wgpu::BindGroupLayout| {
+            let pl = ctx
+                .device
+                .create_pipeline_layout(&wgpu::PipelineLayoutDescriptor {
+                    label: Some(name),
+                    bind_group_layouts: &[Some(layout)],
+                    immediate_size: 0,
+                });
+            ctx.device
+                .create_compute_pipeline(&wgpu::ComputePipelineDescriptor {
+                    label: Some(name),
+                    layout: Some(&pl),
+                    module: &module,
+                    entry_point: Some(name),
+                    compilation_options: Default::default(),
+                    cache: None,
+                })
+        };
+        Ok(MergePass {
+            ctx: ctx.clone(),
+            warp: pipeline("warp", &warp_layout),
+            warp_layout,
+            resolve: pipeline("resolve", &resolve_layout),
+            resolve_layout,
+            buffers: None,
+        })
+    }
+
+    /// Allocate the chunk buffers for this size if the last ones differ.
+    fn ensure_buffers(&mut self, chunk: (u32, u32)) {
+        if self.buffers.as_ref().is_none_or(|b| b.3 != chunk) {
+            let n = u64::from(chunk.0) * u64::from(chunk.1);
+            let acc = self.ctx.device.create_buffer(&wgpu::BufferDescriptor {
+                label: Some("merge-acc"),
+                size: n * 16,
+                usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_DST,
+                mapped_at_creation: false,
+            });
+            let out = self.ctx.device.create_buffer(&wgpu::BufferDescriptor {
+                label: Some("merge-out"),
+                size: n * 8,
+                usage: wgpu::BufferUsages::STORAGE | wgpu::BufferUsages::COPY_SRC,
+                mapped_at_creation: false,
+            });
+            let read = self.ctx.device.create_buffer(&wgpu::BufferDescriptor {
+                label: Some("merge-read"),
+                size: n * 8,
+                usage: wgpu::BufferUsages::COPY_DST | wgpu::BufferUsages::MAP_READ,
+                mapped_at_creation: false,
+            });
+            self.buffers = Some((acc, out, read, chunk));
+        }
+    }
+
+    fn chunk_buffers(&self) -> (&wgpu::Buffer, &wgpu::Buffer, &wgpu::Buffer) {
+        let b = self.buffers.as_ref().expect("ensured by the caller");
+        (&b.0, &b.1, &b.2)
+    }
+
+    /// Produce the whole output, band by band, handing each finished band
+    /// to `sink`.
+    ///
+    /// `cameras` are in **full-resolution source pixels** (`frame_size`),
+    /// with frame `k` corresponding to `frames[k]` and `source(k)`. `source`
+    /// supplies the demosaiced frame on demand and may cache as it sees fit.
+    #[allow(clippy::too_many_arguments)]
+    pub fn merge<S, F>(
+        &mut self,
+        adjust: &mut AdjustPass,
+        frames: &[MergeFrame],
+        cameras: &Cameras,
+        frame_size: (u32, u32),
+        output: &MergeOutput,
+        mut source: S,
+        mut sink: F,
+        mut cancelled: impl FnMut() -> bool,
+    ) -> Result<(), GpuError>
+    where
+        S: FnMut(usize) -> Result<Arc<DemosaicedImage>, GpuError>,
+        F: FnMut(Band<'_>) -> Result<(), GpuError>,
+    {
+        let (out_w, out_h) = (output.width(), output.height());
+        let (cw, ch) = (output.chunk.0.max(8), output.chunk.1.max(8));
+        let (fw, fh) = (frame_size.0 as f64, frame_size.1 as f64);
+
+        let mut band_rgb = vec![0u16; (out_w * ch * 3) as usize];
+        let mut band_cov = vec![false; (out_w * ch) as usize];
+        let mut chunk_px: Vec<u32> = Vec::new();
+
+        // The seam map, once for the whole output, and where it sits in
+        // this output's coordinates. A one-texel stand-in when there is
+        // none, because the binding is not optional.
+        let (seam_tex, seam_origin, seam_px, seam_radius, seam_size) = match &output.seams {
+            Some(m) => {
+                let ((ou, ov), px) = m.at_scale(output.scale);
+                let radius = m.blend_radius(output.scale, f64::from(output.seam_blend));
+                (
+                    self.label_texture(m.width as u32, m.height as u32, &m.labels),
+                    [ou as f32, ov as f32],
+                    px as f32,
+                    radius as f32,
+                    [m.width as u32, m.height as u32],
+                )
+            }
+            None => (
+                self.label_texture(1, 1, &[dr_pano::seam::NONE]),
+                [0.0; 2],
+                1.0,
+                1.0,
+                [1, 1],
+            ),
+        };
+        let seam_view = seam_tex.create_view(&Default::default());
+        let seam_on = u32::from(output.seams.is_some());
+
+        let mut y = 0u32;
+        while y < out_h {
+            let rows = ch.min(out_h - y);
+            band_rgb.iter_mut().for_each(|v| *v = 0);
+            band_cov.iter_mut().for_each(|v| *v = false);
+
+            let mut x = 0u32;
+            while x < out_w {
+                if cancelled() {
+                    return Err(GpuError::Readback("merge cancelled".into()));
+                }
+                let cols = cw.min(out_w - x);
+                let origin = (
+                    output.bounds.min_u + f64::from(x),
+                    output.bounds.min_v + f64::from(y),
+                );
+                self.zero_accumulator((cols, rows));
+
+                for (k, frame) in frames.iter().enumerate() {
+                    let Some(rect) = source_rect(
+                        output.projection,
+                        output.scale,
+                        cameras,
+                        k,
+                        origin,
+                        (cols, rows),
+                        (fw, fh),
+                    ) else {
+                        continue;
+                    };
+                    let image = source(k)?;
+                    // The tile: that rectangle of the frame, camera-linear,
+                    // at 1:1.
+                    let view = dr_pipeline::CropRect {
+                        x: (rect.0 as f32) / fw as f32,
+                        y: (rect.1 as f32) / fh as f32,
+                        width: (rect.2 as f32) / fw as f32,
+                        height: (rect.3 as f32) / fh as f32,
+                    };
+                    let shader = frame.graph.compose_camera_linear(view);
+                    let tile = adjust.render_camera_linear(&image, &shader, rect.2, rect.3)?;
+                    let r = cameras.rotations[k].transpose();
+                    let params = WarpParams {
+                        chunk_origin: [origin.0 as f32, origin.1 as f32],
+                        chunk_size: [cols, rows],
+                        projection: match output.projection {
+                            Projection::Perspective => 0,
+                            Projection::Cylindrical => 1,
+                            Projection::Spherical => 2,
+                        },
+                        proj_scale: output.scale as f32,
+                        focal: cameras.focal as f32,
+                        gain: frame.gain,
+                        r0: [r.0[0][0] as f32, r.0[0][1] as f32, r.0[0][2] as f32, 0.0],
+                        r1: [r.0[1][0] as f32, r.0[1][1] as f32, r.0[1][2] as f32, 0.0],
+                        r2: [r.0[2][0] as f32, r.0[2][1] as f32, r.0[2][2] as f32, 0.0],
+                        frame_size: [fw as f32, fh as f32],
+                        tile_origin: [rect.0 as f32, rect.1 as f32],
+                        tile_size: [rect.2, rect.3],
+                        feather: output.feather,
+                        clip_onset: dr_pipeline::CLIP_ONSET,
+                        balance: [
+                            output.balance[0].max(1e-3),
+                            output.balance[1].max(1e-3),
+                            output.balance[2].max(1e-3),
+                            0.0,
+                        ],
+                        seam_origin,
+                        seam_size,
+                        seam_px,
+                        seam_radius,
+                        frame_index: k as u32,
+                        seam_on,
+                    };
+                    self.accumulate(&params, tile, &seam_view);
+                }
+
+                self.resolve_chunk((cols, rows), output.sample_scale, &mut chunk_px)?;
+                // Into the band.
+                for row in 0..rows as usize {
+                    for col in 0..cols as usize {
+                        let px = chunk_px[(row * cols as usize + col) * 2..][..2].to_vec();
+                        let i = row * out_w as usize + (x as usize + col);
+                        band_rgb[i * 3] = (px[0] & 0xFFFF) as u16;
+                        band_rgb[i * 3 + 1] = (px[0] >> 16) as u16;
+                        band_rgb[i * 3 + 2] = (px[1] & 0xFFFF) as u16;
+                        band_cov[i] = (px[1] >> 16) != 0;
+                    }
+                }
+                x += cols;
+            }
+
+            sink(Band {
+                first_row: y,
+                rows,
+                rgb: &band_rgb[..(out_w * rows * 3) as usize],
+                covered: &band_cov[..(out_w * rows) as usize],
+            })?;
+            y += rows;
+        }
+        Ok(())
+    }
+
+    fn zero_accumulator(&mut self, chunk: (u32, u32)) {
+        self.ensure_buffers(chunk);
+        let (acc, _, _) = self.chunk_buffers();
+        let n = u64::from(chunk.0) * u64::from(chunk.1) * 16;
+        let mut enc = self.ctx.device.create_command_encoder(&Default::default());
+        enc.clear_buffer(acc, 0, Some(n));
+        self.ctx.queue.submit(Some(enc.finish()));
+    }
+
+    /// The seam map's labels as an `r8uint` texture.
+    fn label_texture(&self, width: u32, height: u32, labels: &[u8]) -> wgpu::Texture {
+        let size = wgpu::Extent3d {
+            width,
+            height,
+            depth_or_array_layers: 1,
+        };
+        let tex = self.ctx.device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("merge-seams"),
+            size,
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: wgpu::TextureFormat::R8Uint,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+            view_formats: &[],
+        });
+        self.ctx.queue.write_texture(
+            wgpu::TexelCopyTextureInfo {
+                texture: &tex,
+                mip_level: 0,
+                origin: wgpu::Origin3d::ZERO,
+                aspect: wgpu::TextureAspect::All,
+            },
+            labels,
+            wgpu::TexelCopyBufferLayout {
+                offset: 0,
+                bytes_per_row: Some(width),
+                rows_per_image: Some(height),
+            },
+            size,
+        );
+        tex
+    }
+
+    fn accumulate(&mut self, params: &WarpParams, tile: &wgpu::Texture, seams: &wgpu::TextureView) {
+        let chunk = (params.chunk_size[0], params.chunk_size[1]);
+        let uniforms = self
+            .ctx
+            .device
+            .create_buffer_init(&wgpu::util::BufferInitDescriptor {
+                label: Some("merge-warp-params"),
+                contents: bytemuck::bytes_of(params),
+                usage: wgpu::BufferUsages::UNIFORM,
+            });
+        let view = tile.create_view(&Default::default());
+        self.ensure_buffers(chunk);
+        let (acc, _, _) = self.chunk_buffers();
+        let bind = self
+            .ctx
+            .device
+            .create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("merge-warp-bg"),
+                layout: &self.warp_layout,
+                entries: &[
+                    wgpu::BindGroupEntry {
+                        binding: 0,
+                        resource: uniforms.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 1,
+                        resource: wgpu::BindingResource::TextureView(&view),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 2,
+                        resource: acc.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 3,
+                        resource: wgpu::BindingResource::TextureView(seams),
+                    },
+                ],
+            });
+        let mut enc = self.ctx.device.create_command_encoder(&Default::default());
+        {
+            let mut pass = enc.begin_compute_pass(&Default::default());
+            pass.set_pipeline(&self.warp);
+            pass.set_bind_group(0, &bind, &[]);
+            pass.dispatch_workgroups(chunk.0.div_ceil(8), chunk.1.div_ceil(8), 1);
+        }
+        self.ctx.queue.submit(Some(enc.finish()));
+    }
+
+    fn resolve_chunk(
+        &mut self,
+        chunk: (u32, u32),
+        scale: f32,
+        out: &mut Vec<u32>,
+    ) -> Result<(), GpuError> {
+        let params = ResolveParams {
+            chunk_size: [chunk.0, chunk.1],
+            scale,
+            _pad: 0.0,
+        };
+        let uniforms = self
+            .ctx
+            .device
+            .create_buffer_init(&wgpu::util::BufferInitDescriptor {
+                label: Some("merge-resolve-params"),
+                contents: bytemuck::bytes_of(&params),
+                usage: wgpu::BufferUsages::UNIFORM,
+            });
+        let n = u64::from(chunk.0) * u64::from(chunk.1);
+        self.ensure_buffers(chunk);
+        let (acc, packed, read) = self.chunk_buffers();
+        let bind = self
+            .ctx
+            .device
+            .create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("merge-resolve-bg"),
+                layout: &self.resolve_layout,
+                entries: &[
+                    wgpu::BindGroupEntry {
+                        binding: 0,
+                        resource: uniforms.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 1,
+                        resource: acc.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 2,
+                        resource: packed.as_entire_binding(),
+                    },
+                ],
+            });
+        let mut enc = self.ctx.device.create_command_encoder(&Default::default());
+        {
+            let mut pass = enc.begin_compute_pass(&Default::default());
+            pass.set_pipeline(&self.resolve);
+            pass.set_bind_group(0, &bind, &[]);
+            pass.dispatch_workgroups(chunk.0.div_ceil(8), chunk.1.div_ceil(8), 1);
+        }
+        enc.copy_buffer_to_buffer(packed, 0, read, 0, n * 8);
+        self.ctx.queue.submit(Some(enc.finish()));
+
+        let slice = read.slice(..n * 8);
+        let (tx, rx) = std::sync::mpsc::channel();
+        slice.map_async(wgpu::MapMode::Read, move |r| {
+            let _ = tx.send(r);
+        });
+        await_mapping(&self.ctx, &rx)?;
+        {
+            let data = slice.get_mapped_range();
+            out.clear();
+            out.extend_from_slice(bytemuck::cast_slice::<u8, u32>(&data));
+        }
+        read.unmap();
+        Ok(())
+    }
+}
+
+/// The rectangle of frame `k` (x, y, w, h in source pixels) a chunk reads,
+/// or `None` if the chunk sees nothing of the frame.
+///
+/// Walks the chunk's border, projects each point into the frame, and takes
+/// the bounding box with a two-pixel margin for the bilinear fetch. The
+/// border rather than the corners because under a cylinder or sphere the
+/// extreme of a footprint is not at a corner.
+fn source_rect(
+    projection: Projection,
+    scale: f64,
+    cameras: &Cameras,
+    k: usize,
+    origin: (f64, f64),
+    size: (u32, u32),
+    frame: (f64, f64),
+) -> Option<(u32, u32, u32, u32)> {
+    let (w, h) = (f64::from(size.0), f64::from(size.1));
+    let steps = 16;
+    let mut min = (f64::MAX, f64::MAX);
+    let mut max = (f64::MIN, f64::MIN);
+    let mut any = false;
+    let mut visit = |u: f64, v: f64| {
+        let d = projection.to_direction(scale, u, v);
+        if let Some((x, y)) = cameras.project(k, d) {
+            let (x, y) = (x + frame.0 / 2.0, y + frame.1 / 2.0);
+            min = (min.0.min(x), min.1.min(y));
+            max = (max.0.max(x), max.1.max(y));
+            any = true;
+        }
+    };
+    for s in 0..=steps {
+        let t = f64::from(s) / f64::from(steps);
+        visit(origin.0 + w * t, origin.1);
+        visit(origin.0 + w * t, origin.1 + h);
+        visit(origin.0, origin.1 + h * t);
+        visit(origin.0 + w, origin.1 + h * t);
+    }
+    // The interior too, coarsely: a chunk can contain a frame entirely.
+    for i in 1..4 {
+        for j in 1..4 {
+            visit(
+                origin.0 + w * f64::from(i) / 4.0,
+                origin.1 + h * f64::from(j) / 4.0,
+            );
+        }
+    }
+    if !any {
+        return None;
+    }
+    let x0 = (min.0.floor() - 2.0).max(0.0);
+    let y0 = (min.1.floor() - 2.0).max(0.0);
+    let x1 = (max.0.ceil() + 2.0).min(frame.0);
+    let y1 = (max.1.ceil() + 2.0).min(frame.1);
+    if x1 <= x0 || y1 <= y0 {
+        return None;
+    }
+    Some((x0 as u32, y0 as u32, (x1 - x0) as u32, (y1 - y0) as u32))
+}
@@ -28,8 +28,8 @@
 //! than leaving the specification and the code silently disagreeing.
 //!
 //! That texture is the right one on the merits. It is camera-native: no white
-//! balance has been applied, no camera matrix, no base curve, no tone curve,
-//! no output transform. It is normalised by the sensor's own black and white
+//! balance has been applied, no camera matrix, no tone curve, no view
+//! transform, no output transform. It is normalised by the sensor's own black and white
 //! levels, so 1.0 is saturation by construction and the distribution below it
 //! *is* the headroom question, with no calibration to carry and no origin to
 //! choose.
@@ -1,4 +1,4 @@
-//! Watershed segmentation — arm A's GPU half (S15, docs/segmentation.md).
+//! Watershed segmentation — arm A's GPU half (S15, docs/dev/segmentation.md).
 //!
 //! Runs the five passes in `shaders/watershed.wgsl` over a demosaiced image
 //! and leaves a basin label per pixel on the GPU. The hierarchy built from
@@ -20,7 +20,7 @@
 //! one AC-8 forbids is per frame in the render loop, and sharing a switch
 //! would force a build wanting local masking to unlock the other.
 //!
-//! It is still a real cost and still unfinished. F3 in docs/segmentation.md
+//! It is still a real cost and still unfinished. F3 in docs/dev/segmentation.md
 //! §12 stands: the adjacency accumulation belongs GPU-side with atomics, and
 //! until it moves there every segmentation pays a full-resolution transfer.
 //! Read the feature name as a description of a known gap rather than as
@@ -36,7 +36,7 @@ pub struct SegmentOptions {
    /// Longest proxy edge. The segmentation runs here, not at sensor
    /// resolution: a 24 MP watershed costs 12× the memory to place boundaries
    /// a person cannot see, and the boundary refinement that matters at 1:1
-    /// is a separate stage (docs/segmentation.md §4).
+    /// is a separate stage (docs/dev/segmentation.md §4).
    pub max_edge: u32,
    /// Pre-smoothing radius in proxy pixels. The caller's to raise with ISO —
    /// this is the single knob that decides whether a noisy file segments
@@ -69,7 +69,7 @@ impl Default for SegmentOptions {
            w_chroma: 0.5,
            // **Zero: the pass is off.** It is implemented, dispatched
            // correctly and measurably changes nothing — see the ignored test
-            // below and §12 of docs/segmentation.md. Until that is understood,
+            // below and §12 of docs/dev/segmentation.md. Until that is understood,
            // running it would buy 64 dispatches per segmentation and no
            // improvement, so the default declines to pay.
            plateau_iterations: 0,
@@ -208,7 +208,7 @@ impl SegmentPass {
        source: &DemosaicedImage,
        opts: SegmentOptions,
    ) -> Result<Segmentation, GpuError> {
-        let (src_w, src_h) = source.size();
+        let (src_w, src_h) = source.texture_size();
        let (width, height) = proxy_size(src_w, src_h, opts.max_edge);
        let n = (width * height) as u64;

@@ -486,7 +486,7 @@ impl Segmentation {
    /// a region graph of a few thousand nodes that every later interaction
    /// reads from the CPU anyway.
    ///
-    /// What it is *not* is finished. F3 in docs/segmentation.md §12 stands:
+    /// What it is *not* is finished. F3 in docs/dev/segmentation.md §12 stands:
    /// the adjacency accumulation belongs on the GPU with atomics, and until
    /// it moves there a segmentation costs one full-resolution transfer of the
    /// label and gradient buffers. That is a real cost on a phone and the
@@ -724,7 +724,7 @@ mod tests {
        px
    }
    #[test]
-    #[ignore = "the plateau pass is a measured no-op; see docs/segmentation.md §12"]
+    #[ignore = "the plateau pass is a measured no-op; see docs/dev/segmentation.md §12"]
    fn lower_completion_drains_a_plateau_instead_of_shattering_it() {
        // F1, asserted rather than eyeballed, and asserted at the level where
        // it matters.
@@ -741,7 +741,7 @@ mod tests {
        // with no exit anywhere — cannot be drained by a distance that has
        // nowhere to descend to, and collapsing it fully would need connected
        // component labelling rather than a local rule. It is not worth it:
-        // see docs/segmentation.md §12.
+        // see docs/dev/segmentation.md §12.
        let Some(ctx) = ctx() else { return };
        let (w, h) = (96u32, 96u32);
        let src = DemosaicedImage::from_rgba8(&ctx, &ramp(w, h), w, h).expect("source");
@@ -160,12 +160,18 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {
        // Green is measured. Red and blue are interpolated from their own
        // axis, with a correction from the green Laplacian.
        //
-        // Malvar "G at R/B locations" kernels, transposed per axis:
-        //   chroma along the row:  (5c + 4(w1+e1) - (nw+ne+sw+se) - (n2+s2) + 0.5(w2+e2)) / 8
+        // Malvar "R at green in R row" kernel, and its transpose:
+        //   chroma along the row:  (5c + 4(w1+e1) - (nw+ne+sw+se) - (w2+e2) + 0.5(n2+s2)) / 8
+        //
+        // The -1 goes on the two greens *along* the chroma axis and the +0.5
+        // on the pair across it. Transposed, both kernels still sum to zero
+        // and reconstruct a flat patch exactly, but on an edge the correction
+        // at green sites is half strength and the false colour doubles: a
+        // blue/yellow zipper around every clipped highlight.
        let along_row =
-            (5.0 * c + 4.0 * (w1 + e1) - diag1 - vert2 + 0.5 * horiz2) * 0.125;
+            (5.0 * c + 4.0 * (w1 + e1) - diag1 - horiz2 + 0.5 * vert2) * 0.125;
        let along_col =
-            (5.0 * c + 4.0 * (n1 + s1) - diag1 - horiz2 + 0.5 * vert2) * 0.125;
+            (5.0 * c + 4.0 * (n1 + s1) - diag1 - vert2 + 0.5 * horiz2) * 0.125;

        let red_horizontal = red_is_horizontal(gid.x, gid.y);
        let r = select(along_col, along_row, red_horizontal);
@@ -0,0 +1,185 @@
+// Hot and dead photosite repair, on the raw mosaic, before demosaic.
+//
+// A hot photosite reads far above anything the light put there — a leaky
+// well, lit by its own dark current on a long or high-ISO exposure. Left in,
+// the demosaic spreads it into its neighbours' interpolated channels and it
+// becomes a coloured cross, three pixels wide, that no later stage can take
+// back out: by then it is five pixels of plausible colour rather than one
+// photosite of nonsense. So it is repaired here, where it is still one value.
+//
+// **What counts as hot.** A photosite far above *every* photosite of its own
+// colour in its 5x5 window, and also far above every one of its eight
+// immediate neighbours whatever their colour. The second half is what keeps a
+// star or a glint: real light arrives through a lens and an anti-aliasing
+// filter, so even the sharpest point lands on a patch of photosites, and the
+// ones beside it are lit too. A hot photosite's neighbours are as dark as the
+// rest of the frame. Dead photosites are the mirror image and are handled the
+// same way.
+//
+// **What it becomes.** The brightest (for a hot photosite) or darkest (for a
+// dead one) same-colour neighbour — the value nearest to what it read that
+// the neighbourhood can vouch for. An average would soften the one case this
+// gets wrong, a real highlight that happened to pass both tests; a clamp to
+// the neighbourhood's range cannot invent anything.
+//
+// Written for either colour filter array: the colour of a photosite comes from
+// a 6x6 tile anchored to the sensor, which holds the X-Trans pattern as it is
+// and a Bayer 2x2 cell repeated nine times.
+
+struct HotPixelParams {
+    // The cropped area, in sensor photosites. Only photosites inside it are
+    // judged, and only photosites inside it are asked as neighbours — the
+    // masked border sits at black and would make everything look hot.
+    crop_x: u32,
+    crop_y: u32,
+    width: u32,
+    height: u32,
+    // Row stride of the readout, in samples, and the number of u32 words.
+    stride: u32,
+    words: u32,
+    // How many invocations one row of the dispatch grid holds, so a frame
+    // wider than a dispatch dimension can be addressed as two.
+    row_invocations: u32,
+    // Samples in the readout. One less than twice `words` when the count is
+    // odd, and the padding half of the last word is never judged.
+    samples: u32,
+    // Per-position black levels and reciprocal ranges, indexed by the
+    // photosite's parity within the *crop*: (y&1)*2 + (x&1) counted from its
+    // origin, as the demosaic counts them.
+    black: vec4<f32>,
+    inv_range: vec4<f32>,
+    // The 6x6 colour tile, two bits per photosite, indexed by sensor
+    // coordinate modulo 6: word k holds row 2k in its low 12 bits and row
+    // 2k+1 in the next 12. The fourth word is padding.
+    tile: vec4<u32>,
+}
+
+@group(0) @binding(0) var<storage, read> raw: array<u32>;
+@group(0) @binding(1) var<uniform> params: HotPixelParams;
+@group(0) @binding(2) var<storage, read_write> repaired: array<u32>;
+
+// How far above its brightest neighbour a photosite must read to be hot, as a
+// ratio and a margin in normalised units. Twice the neighbourhood and two
+// percent of the range above it: far enough that shot noise in a lit area
+// never qualifies, near enough that a hot photosite in a night sky — reading
+// a third of the range over a sky at one percent — always does.
+const HOT_RATIO: f32 = 2.0;
+const HOT_MARGIN: f32 = 0.02;
+// A dead photosite reads under half its darkest neighbour, and only counts
+// where that neighbour is at least this bright: in the shadows, a photosite
+// at zero is noise that clipped at the black point, not a defect.
+const DEAD_RATIO: f32 = 0.5;
+const DEAD_FLOOR: f32 = 0.05;
+
+fn value_at(index: u32) -> u32 {
+    let word = raw[index >> 1u];
+    return select(word & 0xFFFFu, word >> 16u, (index & 1u) == 1u);
+}
+
+fn colour_at(sx: u32, sy: u32) -> u32 {
+    let row = sy % 6u;
+    let col = sx % 6u;
+    let word = params.tile[row >> 1u];
+    return (word >> ((row & 1u) * 12u + col * 2u)) & 3u;
+}
+
+// A raw value against its own black level and range. Compared rather than
+// stored, so it is left unclamped at the top: a hot photosite above white is
+// still more above white than its neighbours are.
+fn level(sx: u32, sy: u32, v: u32) -> f32 {
+    let cell = ((sy - params.crop_y) & 1u) * 2u + ((sx - params.crop_x) & 1u);
+    return max(f32(v) - params.black[cell], 0.0) * params.inv_range[cell];
+}
+
+// The value to store for the photosite at `index`.
+fn repair(index: u32) -> u32 {
+    let v = value_at(index);
+    let sx = index % params.stride;
+    let sy = index / params.stride;
+    if (sx < params.crop_x || sy < params.crop_y
+        || sx >= params.crop_x + params.width || sy >= params.crop_y + params.height) {
+        return v;
+    }
+
+    let centre = level(sx, sy, v);
+    let colour = colour_at(sx, sy);
+
+    var same_hi = -1.0;
+    var same_lo = 1.0e9;
+    var same_hi_raw = v;
+    var same_lo_raw = v;
+    var same_count = 0u;
+    var adjacent_hi = 0.0;
+    var adjacent_lo = 1.0e9;
+
+    for (var dy = -2; dy <= 2; dy++) {
+        for (var dx = -2; dx <= 2; dx++) {
+            if (dx == 0 && dy == 0) {
+                continue;
+            }
+            let nx = i32(sx) + dx;
+            let ny = i32(sy) + dy;
+            if (nx < i32(params.crop_x) || ny < i32(params.crop_y)
+                || nx >= i32(params.crop_x + params.width)
+                || ny >= i32(params.crop_y + params.height)) {
+                continue;
+            }
+            let nsx = u32(nx);
+            let nsy = u32(ny);
+            let nv = value_at(nsy * params.stride + nsx);
+            let n = level(nsx, nsy, nv);
+
+            if (abs(dx) <= 1 && abs(dy) <= 1) {
+                adjacent_hi = max(adjacent_hi, n);
+                adjacent_lo = min(adjacent_lo, n);
+            }
+            if (colour_at(nsx, nsy) == colour) {
+                same_count += 1u;
+                if (n > same_hi) {
+                    same_hi = n;
+                    same_hi_raw = nv;
+                }
+                if (n < same_lo) {
+                    same_lo = n;
+                    same_lo_raw = nv;
+                }
+            }
+        }
+    }
+
+    // A corner of the crop can leave a photosite with a single same-colour
+    // neighbour, and one witness is not a neighbourhood.
+    if (same_count < 2u) {
+        return v;
+    }
+
+    let hot_line_same = same_hi * HOT_RATIO + HOT_MARGIN;
+    let hot_line_adjacent = adjacent_hi * HOT_RATIO + HOT_MARGIN;
+    if (centre > hot_line_same && centre > hot_line_adjacent) {
+        return same_hi_raw;
+    }
+    if (same_lo >= DEAD_FLOOR && centre < same_lo * DEAD_RATIO
+        && centre < adjacent_lo * DEAD_RATIO) {
+        return same_lo_raw;
+    }
+    return v;
+}
+
+// One invocation per u32 word: two photosites, packed as the demosaic reads
+// them. A word may straddle two rows when the stride is odd, which `repair`
+// does not mind — it addresses by sample index.
+@compute @workgroup_size(64, 1, 1)
+fn main(@builtin(global_invocation_id) gid: vec3<u32>) {
+    let word = gid.y * params.row_invocations + gid.x;
+    if (word >= params.words) {
+        return;
+    }
+    let lo = repair(word * 2u);
+    // The padding half of an odd-length readout is copied, not judged: it is
+    // not a photosite, and the demosaic never addresses it.
+    var hi = raw[word] >> 16u;
+    if (word * 2u + 1u < params.samples) {
+        hi = repair(word * 2u + 1u);
+    }
+    repaired[word] = (lo & 0xFFFFu) | (hi << 16u);
+}
@@ -0,0 +1,263 @@
+// TRACES: FR-MRG-10 | FR-MRG-11
+// The merge: one source tile warped into one output chunk, accumulated.
+//
+// Two entry points. `warp` runs once per (chunk, frame): for every chunk
+// pixel it asks which direction that pixel looks along, turns the
+// direction into the frame's camera, projects it to a source pixel, and
+// if that pixel is inside the tile that was rendered for this chunk,
+// samples it and adds it — weighted by the frame's share of the seam map
+// there, or by its distance from the frame's edge where there is no map —
+// into the accumulator. `resolve` runs once per chunk after every frame
+// has been added: divides the sums by the weights and packs the result as
+// sixteen-bit samples at the sensor's scale (FR-MRG-3).
+//
+// The accumulator is a buffer and not a storage texture, because WebGPU
+// allows a read-write storage texture only in the 32-bit single-channel
+// formats, and this wants four channels. The tile is sampled by hand from
+// four `textureLoad`s rather than through a sampler, because `rgba32float`
+// is not filterable without an optional feature, and the tile is
+// `rgba32float` on purpose (panorama.md §5.1).
+//
+// The projection maths is `dr_pano::projection` verbatim; the two must
+// agree, and a golden test compares them.
+
+struct Params {
+    // Where the chunk's pixel (0, 0) sits in centred output coordinates,
+    // and the chunk's size.
+    chunk_origin: vec2<f32>,
+    chunk_size: vec2<u32>,
+    // 0 perspective, 1 cylindrical, 2 spherical; and the projection's
+    // scale (the cylinder's radius, the sphere's, the plane's distance) in
+    // output pixels.
+    projection: u32,
+    proj_scale: f32,
+    // The frame's focal length in source pixels, and the gain the frame's
+    // exposure is corrected by.
+    focal: f32,
+    gain: f32,
+    // World → this frame's camera: the transpose of its rotation, one row
+    // per vec4 (padded).
+    r0: vec4<f32>,
+    r1: vec4<f32>,
+    r2: vec4<f32>,
+    // The full frame's size in source pixels (for the edge weight), the
+    // tile's origin within the frame, and the tile's size.
+    frame_size: vec2<f32>,
+    tile_origin: vec2<f32>,
+    tile_size: vec2<u32>,
+    // Pixels over which the weight ramps from the edge to full.
+    feather: f32,
+    // Where a sample starts to count as blown (`CLIP_ONSET`), and the
+    // white balance the composite will be developed with.
+    clip_onset: f32,
+    balance: vec4<f32>,
+    // The seam map (`dr_pano::seam`): where its texel (0, 0)'s corner sits
+    // in this output's centred coordinates, its size, output pixels per
+    // texel, the blend's radius in texels, which frame this dispatch is,
+    // and whether there is a map at all.
+    seam_origin: vec2<f32>,
+    seam_size: vec2<u32>,
+    seam_px: f32,
+    seam_radius: f32,
+    frame_index: u32,
+    seam_on: u32,
+};
+
+@group(0) @binding(0) var<uniform> p: Params;
+@group(0) @binding(1) var tile: texture_2d<f32>;
+// rgb·w summed, then w: four floats per chunk pixel.
+@group(0) @binding(2) var<storage, read_write> acc: array<vec4<f32>>;
+// One frame index per texel, 255 for none.
+@group(0) @binding(3) var seams: texture_2d<u32>;
+
+const NO_FRAME: u32 = 255u;
+
+fn label(i: i32, j: i32) -> u32 {
+    if (i < 0 || j < 0 || i >= i32(p.seam_size.x) || j >= i32(p.seam_size.y)) {
+        return NO_FRAME;
+    }
+    return textureLoad(seams, vec2<i32>(i, j), 0).r;
+}
+
+// This frame's share of the seam map about output point (u, v): the
+// tent-weighted fraction of the texels within the radius that it owns, and
+// the weight of the texels owned by anyone (zero where the map has nothing
+// to say). `SeamMap::share` verbatim.
+fn seam_share(u: f32, v: f32) -> vec2<f32> {
+    let x = (u - p.seam_origin.x) / p.seam_px - 0.5;
+    let y = (v - p.seam_origin.y) / p.seam_px - 0.5;
+    let r = max(p.seam_radius, 1.0);
+    let x0 = i32(ceil(x - r));
+    let x1 = i32(floor(x + r));
+    let y0 = i32(ceil(y - r));
+    let y1 = i32(floor(y + r));
+    // Most pixels are nowhere near a seam: if the window's corners, edge
+    // midpoints and centre agree, so does the window. A seam crossing it
+    // has to cross its border, between two of those.
+    let xm = i32(round(x));
+    let ym = i32(round(y));
+    let c = label(xm, ym);
+    if (label(x0, y0) == c && label(x1, y0) == c && label(x0, y1) == c && label(x1, y1) == c
+        && label(xm, y0) == c && label(xm, y1) == c && label(x0, ym) == c && label(x1, ym) == c) {
+        if (c == NO_FRAME) {
+            return vec2<f32>(0.0, 0.0);
+        }
+        return vec2<f32>(select(0.0, 1.0, c == p.frame_index), 1.0);
+    }
+    var mine = 0.0;
+    var owned = 0.0;
+    for (var j = y0; j <= y1; j = j + 1) {
+        let wy = 1.0 - abs(y - f32(j)) / r;
+        if (wy <= 0.0) {
+            continue;
+        }
+        for (var i = x0; i <= x1; i = i + 1) {
+            let wx = 1.0 - abs(x - f32(i)) / r;
+            let l = label(i, j);
+            if (wx <= 0.0 || l == NO_FRAME) {
+                continue;
+            }
+            owned = owned + wx * wy;
+            if (l == p.frame_index) {
+                mine = mine + wx * wy;
+            }
+        }
+    }
+    if (owned <= 0.0) {
+        return vec2<f32>(0.0, 0.0);
+    }
+    return vec2<f32>(mine / owned, 1.0);
+}
+
+fn to_direction(u: f32, v: f32) -> vec3<f32> {
+    let s = p.proj_scale;
+    if (p.projection == 0u) {
+        return normalize(vec3<f32>(u, v, s));
+    }
+    if (p.projection == 1u) {
+        let theta = u / s;
+        return normalize(vec3<f32>(sin(theta), v / s, cos(theta)));
+    }
+    let theta = u / s;
+    let phi = v / s;
+    return vec3<f32>(sin(theta) * cos(phi), sin(phi), cos(theta) * cos(phi));
+}
+
+fn load(x: i32, y: i32) -> vec4<f32> {
+    return textureLoad(tile, vec2<i32>(x, y), 0);
+}
+
+@compute @workgroup_size(8, 8, 1)
+fn warp(@builtin(global_invocation_id) gid: vec3<u32>) {
+    if (gid.x >= p.chunk_size.x || gid.y >= p.chunk_size.y) {
+        return;
+    }
+    let u = p.chunk_origin.x + f32(gid.x) + 0.5;
+    let v = p.chunk_origin.y + f32(gid.y) + 0.5;
+    let d = to_direction(u, v);
+    let c = vec3<f32>(dot(p.r0.xyz, d), dot(p.r1.xyz, d), dot(p.r2.xyz, d));
+    if (c.z <= 1e-6) {
+        return;
+    }
+    // Source pixel, in the full frame, with the principal point at its
+    // centre. `- 0.5` puts pixel centres on integer coordinates for the
+    // bilinear fetch below.
+    let sx = p.focal * c.x / c.z + p.frame_size.x * 0.5 - 0.5;
+    let sy = p.focal * c.y / c.z + p.frame_size.y * 0.5 - 0.5;
+    // Weight: distance to the nearest frame edge, in pixels, over the
+    // feather. Zero outside the frame.
+    let edge = min(min(sx, p.frame_size.x - 1.0 - sx), min(sy, p.frame_size.y - 1.0 - sy));
+    if (edge <= 0.0) {
+        return;
+    }
+    var w = clamp(edge / max(p.feather, 1.0), 0.0, 1.0);
+    // With seams, the share of the map scales it. The small floor keeps
+    // the feather underneath as the answer wherever no frame that reaches
+    // this pixel owns it — the map is coarser than the output, so at the
+    // frames' outer edges it can name a frame that falls just short.
+    if (p.seam_on != 0u) {
+        let s = seam_share(u, v);
+        if (s.y > 0.0) {
+            w = w * (s.x + 1e-4);
+        }
+    }
+    // Into the tile.
+    let tx = sx - p.tile_origin.x;
+    let ty = sy - p.tile_origin.y;
+    let tw = f32(p.tile_size.x);
+    let th = f32(p.tile_size.y);
+    if (tx < 0.0 || ty < 0.0 || tx > tw - 1.0 || ty > th - 1.0) {
+        return;
+    }
+    let x0 = i32(floor(tx));
+    let y0 = i32(floor(ty));
+    let x1 = min(x0 + 1, i32(p.tile_size.x) - 1);
+    let y1 = min(y0 + 1, i32(p.tile_size.y) - 1);
+    let fx = tx - f32(x0);
+    let fy = ty - f32(y0);
+    // The four texels, with their alpha: the tap writes alpha 0 where the
+    // lens correction found no source pixel, and a sample that touches one
+    // of those is a partial pixel — down-weighted by exactly how much of
+    // it is missing, and dropped when all of it is.
+    let s00 = load(x0, y0);
+    let s10 = load(x1, y0);
+    let s01 = load(x0, y1);
+    let s11 = load(x1, y1);
+    let top = mix(s00, s10, fx);
+    let bot = mix(s01, s11, fx);
+    let s = mix(top, bot, fy);
+    if (s.a <= 0.001) {
+        return;
+    }
+    // Colour is the alpha-weighted mean of the texels that exist.
+    let cam = s.rgb / s.a;
+    // **A blown sample is written as grey, before the gain.** A clipped
+    // photosite arrives as (1, 1, 1), which is not a colour: balanced, it
+    // is magenta, and the develop's highlight desaturation only rescues it
+    // while it is still at the white level. A gain below one moved it off
+    // that level, and a feather mixed it into a neighbour's real sky, so
+    // the composite's blown clouds came out pink. Written instead as the
+    // camera value the balance maps to grey — the develop pipeline's own
+    // neutral, the brightest balanced channel — it survives both.
+    let clipped = smoothstep(p.clip_onset, 1.0, max(cam.r, max(cam.g, cam.b)));
+    let balanced = cam * p.balance.rgb;
+    let grey = vec3<f32>(max(balanced.r, max(balanced.g, balanced.b))) / p.balance.rgb;
+    let rgb = mix(cam, grey, clipped) * p.gain;
+    let wa = w * s.a;
+    let i = gid.y * p.chunk_size.x + gid.x;
+    acc[i] = acc[i] + vec4<f32>(rgb * wa, wa);
+}
+
+// Resolve: the accumulated chunk to sixteen-bit samples.
+struct ResolveParams {
+    chunk_size: vec2<u32>,
+    // Multiplies a normalised value (1.0 = the sensor's white) back to the
+    // sensor's scale: the source's white minus its black (FR-MRG-3).
+    scale: f32,
+    _pad: f32,
+};
+
+@group(0) @binding(0) var<uniform> rp: ResolveParams;
+@group(0) @binding(1) var<storage, read> racc: array<vec4<f32>>;
+// Two u32 per pixel: (r | g << 16), (b | coverage << 16). Coverage is
+// 65535 where any frame reached the pixel and 0 where none did, so the
+// CPU can tell an empty pixel from a black one.
+@group(0) @binding(2) var<storage, read_write> out: array<vec2<u32>>;
+
+@compute @workgroup_size(8, 8, 1)
+fn resolve(@builtin(global_invocation_id) gid: vec3<u32>) {
+    if (gid.x >= rp.chunk_size.x || gid.y >= rp.chunk_size.y) {
+        return;
+    }
+    let i = gid.y * rp.chunk_size.x + gid.x;
+    let a = racc[i];
+    if (a.w <= 0.0) {
+        out[i] = vec2<u32>(0u, 0u);
+        return;
+    }
+    let rgb = clamp(a.rgb / a.w * rp.scale, vec3<f32>(0.0), vec3<f32>(65535.0));
+    let r = u32(round(rgb.r));
+    let g = u32(round(rgb.g));
+    let b = u32(round(rgb.b));
+    out[i] = vec2<u32>(r | (g << 16u), b | (65535u << 16u));
+}
--- a/Show More
+++ b/Show More