Step to a library photograph without flashing frames in between

A step along the roll showed up to four pictures: the grid thumbnail,
the previous photograph again (the thumbnail was dropped when the bytes
landed, while the canvas still held the last texture through the decode
and first render), the new one at its defaults when a cached original
beat the sidecar, and then its edit.

The thumbnail now stays up until render_now draws the new photograph's
first frame, and that first frame waits up to 400 ms for the stored edit
before drawing at the defaults. A later arrival still redraws.

Cargo.lock

@@ -1265,7 +1265,7 @@ checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
 [[package]]
 name = "darkroom-android"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "android_logger",
  "dr-plat",
@@ -1278,7 +1278,7 @@ dependencies = [
 
 [[package]]
 name = "darkroom-desktop"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "anyhow",
  "dr-plat",
@@ -1454,7 +1454,7 @@ checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
 name = "dr-bench"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "anyhow",
  "dr-catalog",
@@ -1471,7 +1471,7 @@ dependencies = [
 
 [[package]]
 name = "dr-catalog"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-face",
  "dr-plat",
@@ -1486,7 +1486,7 @@ dependencies = [
 
 [[package]]
 name = "dr-decode"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-types",
  "env_logger",
@@ -1500,7 +1500,7 @@ dependencies = [
 
 [[package]]
 name = "dr-export"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-decode",
  "dr-gpu",
@@ -1519,7 +1519,7 @@ dependencies = [
 
 [[package]]
 name = "dr-face"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-inference-engine",
  "env_logger",
@@ -1532,7 +1532,7 @@ dependencies = [
 
 [[package]]
 name = "dr-film"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "log",
  "serde",
@@ -1541,7 +1541,7 @@ dependencies = [
 
 [[package]]
 name = "dr-gpu"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "bytemuck",
  "dr-decode",
@@ -1559,7 +1559,7 @@ dependencies = [
 
 [[package]]
 name = "dr-inference-engine"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "env_logger",
  "libloading",
@@ -1574,7 +1574,7 @@ dependencies = [
 
 [[package]]
 name = "dr-ingest"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-plat",
  "dr-types",
@@ -1586,7 +1586,7 @@ dependencies = [
 
 [[package]]
 name = "dr-lens"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "lensfun",
  "log",
@@ -1594,7 +1594,7 @@ dependencies = [
 
 [[package]]
 name = "dr-pano"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-decode",
  "dr-inference-engine",
@@ -1608,7 +1608,7 @@ dependencies = [
 
 [[package]]
 name = "dr-pipeline"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-types",
  "log",
@@ -1617,7 +1617,7 @@ dependencies = [
 
 [[package]]
 name = "dr-plat"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "android-native-keyring-store",
  "dr-types",
@@ -1633,7 +1633,7 @@ dependencies = [
 
 [[package]]
 name = "dr-preset-xmp"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-pipeline",
  "log",
@@ -1643,7 +1643,7 @@ dependencies = [
 
 [[package]]
 name = "dr-segment"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-inference-engine",
  "env_logger",
@@ -1656,7 +1656,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "async-trait",
  "dr-plat",
@@ -1670,7 +1670,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync-folder"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "async-trait",
  "dr-sync",
@@ -1682,7 +1682,7 @@ dependencies = [
 
 [[package]]
 name = "dr-sync-nextcloud"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "async-trait",
  "dr-decode",
@@ -1704,7 +1704,7 @@ dependencies = [
 
 [[package]]
 name = "dr-thumbs"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-types",
  "jpeg-encoder",
@@ -1716,7 +1716,7 @@ dependencies = [
 
 [[package]]
 name = "dr-types"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "serde",
  "serde_json",
@@ -1725,7 +1725,7 @@ dependencies = [
 
 [[package]]
 name = "dr-ui"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1773,7 +1773,7 @@ dependencies = [
 
 [[package]]
 name = "dr-xmp"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "dr-types",
  "log",
@@ -5513,8 +5513,6 @@ dependencies = [
 [[package]]
 name = "rawler"
 version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f4cc35c23969a4a834e0b117c7da41ace812eb9053b5effc3fc5c77d114677"
 dependencies = [
  "backtrace",
  "bitstream-io",
@@ -7109,7 +7107,7 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "traceability"
-version = "0.18.2"
+version = "0.19.4"
 dependencies = [
  "anyhow",
  "proc-macro2",

Cargo.toml

@@ -32,7 +32,7 @@ members = [
 exclude = ["third_party"]
 
 [workspace.package]
-version = "0.18.2"
+version = "0.19.4"
 edition = "2021"
 rust-version = "1.92"
 license = "GPL-3.0-or-later"
@@ -276,11 +276,13 @@ opt-level = 0
 lto = "thin"
 codegen-units = 1
 
-# Two upstream crates carry a local patch so that the Android build can draw
-# with wgpu on a rotated display (technical-debt.md TD-1). Both are exact
-# copies of the version the lockfile already resolves, plus that patch;
-# third_party/README.md says what was changed and how to carry it forward
-# when Slint or wgpu moves.
+# Three upstream crates carry a local patch: wgpu-hal and Slint's Skia
+# renderer so that the Android build can draw with wgpu on a rotated display
+# (technical-debt.md TD-1), and rawler so that a linear DNG wider than 16 700
+# pixels decodes. Each is an exact copy of the version the lockfile already
+# resolves, plus its patch; third_party/README.md says what was changed and
+# how to carry it forward when Slint, wgpu or rawler moves.
 [patch.crates-io]
 wgpu-hal = { path = "third_party/wgpu-hal-29.0.4" }
 i-slint-renderer-skia = { path = "third_party/i-slint-renderer-skia-1.17.1" }
+rawler = { path = "third_party/rawler-0.7.2" }

README.md

@@ -25,26 +25,34 @@ dated folder and a backup beside it — is found, proved the same, and folded
 onto one copy with the spares in the trash. Face detection and identity,
 with the index syncing between devices.
 
-**Developing.** Eighteen declared operations fused into one compute
-dispatch, plus the neighbourhood work that cannot be: clarity, texture,
-capture sharpening, noise reduction, lens correction, spectral film
-simulation. Crop, straighten and correct converging verticals, spot repair,
-and local adjustments over masks the model draws — click a subject or a
-category, then paint, subtract a gradient or keep only where two selections
-agree, grow or shrink the edge. A mask's sliders add to the photograph's, the
-film's among them, so a sky can be burned in on the print as a darkroom
-printer would. Hot and dead photosites are mended before the demosaic, with
-nothing to set. Focus peaking and a raw histogram for judging
-what is recoverable. Presets, with a collection shipped in the application —
+**Developing.** Nineteen declared operations, those that read one pixel
+fused into a generated shader rather than run a pass each, plus the
+neighbourhood work that cannot be: clarity, texture, dehaze, capture
+sharpening, noise reduction, lens correction. Every edit works on the scene
+as the camera recorded it — linear, highlights beyond white included — and
+one `Tone Mapping` step, last, after sharpening and noise reduction, fits it
+to the screen, with a contrast and a white point of its own; a spectral film
+stock takes its place when one is chosen. Crop, straighten and correct
+converging verticals, spot repair, and local adjustments over masks the
+model draws — click a subject or a category, then paint, subtract a gradient
+or keep only where two selections agree, grow or shrink the edge. A mask's
+sliders add to the photograph's, the film's among them, so a sky can be
+burned in on the print as a darkroom printer would. Hot and dead photosites
+are mended before the demosaic, with nothing to set. Focus peaking and a raw
+histogram for judging what is recoverable. Presets, a click away in a menu
+at the foot of the tool rail, with a collection shipped in the application —
 everyday corrections, and a look for each measured colour, cinema and
 black-and-white stock — and Lightroom presets imported as looks that leave a
-photograph's own corrections alone. XMP sidecars other editors read.
+photograph's own corrections alone. XMP sidecars other editors read. A
+linear DNG larger than one GPU texture — a stitched panorama twenty thousand
+pixels wide — opens, develops and exports at full size.
 
 [![Segmenting an urban scene and choosing the sky as a mask](docs/manual/media/local-segment.png)](docs/manual/README.md#local-adjustments)
 
-**Panoramas.** Select the frames, align, choose a projection, fill the
-ragged border rather than crop it, and the composite lands beside its
-sources as a DNG, with a sidecar recording what it was merged from.
+**Panoramas.** Select the frames, align, untick any frame to leave it out
+and the rest re-align at once, choose a projection, fill the ragged border
+rather than crop it, and the composite lands beside its sources as a DNG,
+with a sidecar recording what it was merged from.
 
 [![Twelve hand-held frames aligned on a cylinder](docs/manual/media/panorama-aligned.png)](docs/manual/README.md#merging-a-panorama)
 
@@ -75,40 +83,137 @@ texture directly — no readback between the GPU and the screen.
 | Windows | `DarkRoom-<version>-x86_64-setup.exe`, cross-built by CI ([windows.md](docs/dev/windows.md)) | Verified under Wine only; unsigned |
 | Flatpak | [`packaging/flatpak/`](packaging/flatpak/) | Manifest in tree; folders are chosen through the portal, but no Flatpak has been built to prove it |
 
-Or build it. Git LFS is required for the model weights, and the toolchain
-pins itself to 1.92.0:
+## Building from source
+
+**Before anything.** Git LFS holds the model weights and the manual's
+pictures; a clone without it has ~130-byte pointers in their place, and every
+packager below refuses to ship one. The Rust toolchain pins itself to 1.92.0
+through `rust-toolchain.toml`, so rustup is all you install. Slint needs a few
+system headers, and the app needs a Vulkan driver at runtime:
 
 ```bash
+git clone https://gitea.tourolle.paris/dtourolle/DarkRoom.git && cd DarkRoom
 git lfs install && git lfs pull
+
+# Debian / Ubuntu
+sudo apt-get install pkg-config libfontconfig1-dev libxkbcommon-dev libvulkan1
+# Arch
+sudo pacman -S --needed pkgconf fontconfig libxkbcommon vulkan-icd-loader
+```
+
+**To try it** from the checkout, without installing anything:
+
+```bash
 cargo run --release -p darkroom-desktop
 ```
 
-Android, through the containerised toolchain ([docker/android](docker/android/README.md)):
+This is for development. The binary under `target/` finds no face, scene or
+panorama-fill models, and a release build does not find the manual either:
+it looks for all of them in the system data directories an install creates
+(`$XDG_DATA_DIRS/darkroom`, by default `/usr/local/share/darkroom` and
+`/usr/share/darkroom`), never in the checkout. Those features show as
+unavailable until it is installed.
+
+### Linux: build and install
+
+**On Arch**, build a package from the checkout and install it with pacman,
+so it can be upgraded and removed like any other:
 
 ```bash
-./docker/android/build.sh cargo ndk -t arm64-v8a build --release
+cd packaging && makepkg -si
 ```
 
-[CONTRIBUTING.md](CONTRIBUTING.md) has the system packages, the four
+**Elsewhere**, build the release binary and install it under `/usr/local`
+by hand. These are the same files, in the same places, as the Arch package
+([`packaging/PKGBUILD`](packaging/PKGBUILD)'s `package()` is the reference):
+
+```bash
+cargo build --release --locked -p darkroom-desktop
+# -> target/release/darkroom-desktop
+
+P=/usr/local
+sudo install -Dm755 target/release/darkroom-desktop $P/bin/darkroom-desktop
+
+# The models: faces and eye state, scene categories, panorama border fill
+sudo install -d $P/share/darkroom/models
+sudo install -m644 models/face/*.onnx models/scene/* models/inpaint/*.onnx \
+    $P/share/darkroom/models/
+
+# The offline manual the Help menu opens
+sudo install -Dm644 docs/manual/index.html $P/share/darkroom/manual/index.html
+sudo install -Dm644 -t $P/share/darkroom/manual/media docs/manual/media/*
+
+# Launcher entry, icon and software-centre description
+sudo install -Dm644 packaging/paris.tourolle.darkroom.desktop \
+    $P/share/applications/paris.tourolle.darkroom.desktop
+sudo install -Dm644 ui/dr-ui/ui/app-icon.png \
+    $P/share/icons/hicolor/256x256/apps/paris.tourolle.darkroom.png
+sudo install -Dm644 packaging/paris.tourolle.darkroom.metainfo.xml \
+    $P/share/metainfo/paris.tourolle.darkroom.metainfo.xml
+```
+
+Then run `darkroom-desktop`, or open it from the application menu. To
+uninstall, remove those files and `/usr/local/share/darkroom`. Your catalog,
+settings and thumbnails live in `darkroom/` under your own XDG data, config
+and cache directories (`~/.local/share`, `~/.config`, `~/.cache`) and are
+not touched by either.
+
+Optional at runtime: `gnome-keyring` or `kwallet` to remember Nextcloud
+credentials, and an ONNX Runtime in `/usr/lib` (CPU, or ROCm on an AMD GPU) to
+run the models on every core rather than on the built-in engine.
+
+### Windows: build the installer
+
+The `.exe` is cross-built from Linux in a container (podman or docker), with
+no Windows machine involved. Two steps — the executable, then the NSIS
+installer that carries it with its models and manual:
+
+```bash
+./docker/windows/build.sh cargo build --release --target x86_64-pc-windows-gnu -p darkroom-desktop
+./docker/windows/build.sh docker/windows/package.sh
+```
+
+Both land in the container's cache on the host, `~/.cache/darkroom-windows/target/`:
+the bare executable under `x86_64-pc-windows-gnu/release/darkroom-desktop.exe`,
+the installer under `installer/DarkRoom-<version>-x86_64-setup.exe`.
+Copy that to the Windows machine and run it — it installs per user, needs no
+administrator rights, and adds an uninstaller. Run on its own, the bare
+`.exe` looks for `models\` and `manual\` beside itself, so use the installer.
+[docker/windows](docker/windows/README.md) has the details.
+
+### Android: build the APK
+
+Also containerised ([docker/android](docker/android/README.md)). This
+builds, packages and debug-signs the APK, and with `--install` puts it on a
+device connected over adb:
+
+```bash
+./docker/android/package.sh --install
+```
+
+A debug-signed APK cannot replace one installed from a release; uninstall
+that first.
+
+[CONTRIBUTING.md](CONTRIBUTING.md) has the four
 commands CI runs against what you send, and the shortest useful
 contribution — a develop operation is one YAML file, and it arrives with its
 controls, its place in the chain and its tests.
 
 ## Where it stands
 
-**0.18.2**, twenty-eight tagged releases in. 192 numbered requirements in
-scope, 84% of them claimed by code and [traced to it](docs/dev/traceability.md);
+**0.19.4**, thirty-three tagged releases in. 193 numbered requirements in
+scope, 85% of them claimed by code and [traced to it](docs/dev/traceability.md);
 the rest are written down rather than merely absent.
 
 **Not built:** plugins (post-v1, [D12](docs/dev/requirements.md)), compare and
-survey culling, AI denoise, tiled rendering, HDR merge and
-focus stacking, importing a Lightroom or darktable catalog, translations
-beyond the launch screen, most of the Android platform integration beyond
-running, and a Flatpak actually built and run in its sandbox. The
-performance targets are half verified: the per-commit benchmark suite §8
-requires exists for everything that does not need a frame — the catalog,
-the scan, the thumbnails — and not yet for the render path, so a regression
-there fails nothing.
+survey culling, AI denoise, tiled rendering beyond the export of an oversized
+DNG, HDR merge and focus stacking, importing a Lightroom or darktable catalog,
+translations beyond the launch screen, most of the Android platform
+integration beyond running, and a Flatpak actually built and run in its
+sandbox. The performance targets are half verified: the per-commit benchmark
+suite §8 requires exists for everything that does not need a frame — the
+catalog, the scan, the thumbnails — and not yet for the render path, so a
+regression there fails nothing.
 [outstanding.md](docs/dev/outstanding.md) is the list, with the reasoning for
 each.
 

apps/darkroom-android/android/AndroidManifest.xml

@@ -4,9 +4,10 @@
 
   Deliberately minimal: this packages the viewer for on-device testing (spike
   S2 needs Adreno and Mali hardware, which no emulator represents). Nothing
-  here is a distribution manifest yet. Only network access is declared: file
-  access needs no manifest permission because the library grid reads through
-  SAF, which grants per-tree at runtime (ARCH §6.9).
+  here is a distribution manifest yet. The library grid needs no storage
+  permission, because it reads through SAF, which grants per-tree at runtime
+  (ARCH §6.9); the one storage permission declared is for importing from a
+  camera card, which is read by path.
 
   Minimal is not the same as empty, and the entries below that are not the
   activity are the difference. A manifest is the only place a component can be
@@ -21,13 +22,29 @@
          WebDAV listing, thumbnail and image fetches. Without it Android refuses
          socket creation outright, and the failure is invisible — no panic to
          catch, no log line, just a worker thread that stops. Storage is the
-         separate case that genuinely needs no permission here, because SAF
-         grants per-tree at runtime (ARCH §6.9). -->
+         separate case: the library and album folders need no permission
+         here, because SAF grants per-tree at runtime (ARCH §6.9). -->
     <uses-permission android:name="android.permission.INTERNET" />
     <!-- Read before deciding whether a sync may run: FR-NC-6 gates background
          work on unmetered-and-charging, which means knowing the network type. -->
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
+    <!-- FR-CAT-10: importing from a camera card. The importer reads the card
+         as files, and "all files access" is what makes an SD card or a USB
+         card reader readable by path on API 30 and up (see Cards.java). It is
+         granted on a system settings page, not a dialog; the import page
+         sends the user there when it is missing. READ_EXTERNAL_STORAGE is the
+         same thing for API 28 and 29, and means nothing above them; on 29 it
+         reads by path only with requestLegacyExternalStorage, which is why
+         <application> carries that flag.
+
+         Google Play limits MANAGE_EXTERNAL_STORAGE to a short list of app
+         kinds. DarkRoom is not distributed through Play. -->
+    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" />
+    <uses-permission
+        android:name="android.permission.READ_EXTERNAL_STORAGE"
+        android:maxSdkVersion="29" />
+
     <!-- Vulkan 1.1 is what wgpu needs; the API 28 floor is where support is
          dependable (NFR-COMPAT-1). Marked required so an unsupported device
          fails at install rather than at first frame. -->
@@ -53,6 +70,7 @@
         android:icon="@mipmap/ic_launcher"
         android:hasCode="true"
         android:allowBackup="false"
+        android:requestLegacyExternalStorage="true"
         android:supportsRtl="true">
 
         <!-- NativeActivity rather than a Kotlin Activity: android-activity's

apps/darkroom-android/android/java/paris/tourolle/darkroom/Cards.java

@@ -0,0 +1,150 @@
+package paris.tourolle.darkroom;
+
+import android.Manifest;
+import android.content.Context;
+import android.content.Intent;
+import android.content.pm.PackageManager;
+import android.net.Uri;
+import android.os.Build;
+import android.os.Environment;
+import android.os.storage.StorageManager;
+import android.os.storage.StorageVolume;
+import android.provider.Settings;
+import android.util.Log;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Finding a camera card, and the permission that makes it readable (FR-CAT-10).
+ *
+ * <p>An import reads the card as files: the survey walks it, the probe reads
+ * each header and the copy streams each original, all through the same
+ * {@code std::fs} code the desktop uses. Android hands out such paths —
+ * {@code /storage/9C33-6BBD/DCIM} — to an app holding "all files access"
+ * ({@code MANAGE_EXTERNAL_STORAGE}, API 30), which covers the root of an SD
+ * card and of a USB card reader. Below API 30 the same paths are readable
+ * with {@code READ_EXTERNAL_STORAGE}.
+ *
+ * <p>Not the folder picker {@link FolderPicker} uses for albums. A tree
+ * granted through SAF is {@code content://} URIs, not paths, and since API 30
+ * the picker refuses the root of a card outright; reading a card through it
+ * would mean a second storage implementation under the importer, where this
+ * needs none.
+ *
+ * <p>Google Play restricts this permission to file managers and the like.
+ * DarkRoom is not distributed through Play, so the restriction does not
+ * apply; it would need revisiting if that changed.
+ */
+public final class Cards {
+    private static final String TAG = "DarkRoom";
+
+    private Cards() {
+    }
+
+    /** Whether this app may read a card's files by path. */
+    public static boolean hasAccess(Context context) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            return Environment.isExternalStorageManager();
+        }
+        return context.checkSelfPermission(Manifest.permission.READ_EXTERNAL_STORAGE)
+                == PackageManager.PERMISSION_GRANTED;
+    }
+
+    /**
+     * Open the system page where the user grants it.
+     *
+     * <p>A settings page rather than a permission dialog because there is no
+     * dialog for this one on API 30 and up: the user flips "Allow access to
+     * manage all files" for this app. Below 30 the context is the application
+     * context, which cannot raise a runtime permission request (that needs an
+     * Activity's result), so the app's own settings page is the route there
+     * too. Either way the app learns of the grant by asking
+     * {@link #hasAccess} again.
+     */
+    public static void requestAccess(Context context) {
+        Uri self = Uri.parse("package:" + context.getPackageName());
+        Intent intent;
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            intent = new Intent(Settings.ACTION_MANAGE_APP_ALL_FILES_ACCESS_PERMISSION, self);
+        } else {
+            intent = new Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS, self);
+        }
+        // The context is not an Activity; see FolderPicker.start.
+        intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+        try {
+            context.startActivity(intent);
+        } catch (RuntimeException e) {
+            // Some builds ship without the per-app page; the list of every
+            // app holding the permission is the fallback that always exists.
+            Log.w(TAG, "no per-app all-files page; opening the list", e);
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+                Intent list = new Intent(Settings.ACTION_MANAGE_ALL_FILES_ACCESS_PERMISSION);
+                list.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
+                context.startActivity(list);
+            }
+        }
+    }
+
+    /**
+     * Every mounted volume other than the device's own storage.
+     *
+     * <p>One string per volume, {@code path \t description \t removable},
+     * where removable is {@code 1} or {@code 0}: the reason {@link Intents}
+     * gives for keeping the JNI surface to strings. The primary volume is left
+     * out — it is the device's internal storage, never a card — and so is
+     * anything not mounted, which is a card being ejected or one the system
+     * could not read.
+     */
+    public static String[] volumes(Context context) {
+        List<String> out = new ArrayList<String>();
+        StorageManager manager = (StorageManager) context.getSystemService(Context.STORAGE_SERVICE);
+        if (manager == null) {
+            return new String[0];
+        }
+        for (StorageVolume volume : manager.getStorageVolumes()) {
+            if (volume.isPrimary()) {
+                continue;
+            }
+            String state = volume.getState();
+            if (!Environment.MEDIA_MOUNTED.equals(state)
+                    && !Environment.MEDIA_MOUNTED_READ_ONLY.equals(state)) {
+                continue;
+            }
+            String path = path(volume);
+            if (path == null) {
+                Log.w(TAG, "a mounted volume with no path: " + volume);
+                continue;
+            }
+            String description = volume.getDescription(context);
+            if (description == null) {
+                description = new File(path).getName();
+            }
+            out.add(path + "\t" + description.replace('\t', ' ') + "\t"
+                    + (volume.isRemovable() ? "1" : "0"));
+        }
+        return out.toArray(new String[0]);
+    }
+
+    /**
+     * Where the volume is mounted.
+     *
+     * <p>{@code getDirectory} is API 30. Below it the same answer is the
+     * hidden {@code getPath}, which every release from 24 to 29 has, reached by
+     * reflection because android.jar does not declare it.
+     */
+    private static String path(StorageVolume volume) {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+            File dir = volume.getDirectory();
+            return dir == null ? null : dir.getPath();
+        }
+        try {
+            Object path = StorageVolume.class.getMethod("getPath").invoke(volume);
+            return path == null ? null : path.toString();
+        } catch (ReflectiveOperationException e) {
+            Log.w(TAG, "StorageVolume.getPath", e);
+            return null;
+        }
+    }
+}

core/dr-catalog/examples/catalog_bench.rs

@@ -27,7 +27,7 @@
 use std::path::PathBuf;
 use std::time::{Duration, Instant};
 
-use dr_catalog::{keywords, rating, schema, Catalog};
+use dr_catalog::{keywords, name_dates, rating, schema, Catalog};
 
 fn main() {
     let mut args: Vec<String> = std::env::args().skip(1).collect();
@@ -108,6 +108,9 @@ fn main() {
     time("  keywords::adopt_orphan_terms", 20, || {
         keywords::adopt_orphan_terms(conn).unwrap();
     });
+    time("  name_dates::fill", 20, || {
+        name_dates::fill(conn, None).unwrap();
+    });
 
     interactive(conn);
 

core/dr-catalog/src/albums.rs

@@ -306,6 +306,48 @@ pub fn record_exports(
     Ok(())
 }
 
+/// Every file name an album records, for an export choosing a name to know
+/// what it would land on.
+///
+/// A server album cannot be asked while the export is queued offline, and
+/// the names this app put there are the ones a second export of the same
+/// photographs will collide with. One read of the album's rows, not one per
+/// candidate name.
+pub fn file_names(
+    conn: &Connection,
+    id: AlbumId,
+) -> Result<std::collections::HashSet<String>, CatalogError> {
+    ensure_tables(conn)?;
+    let mut stmt = conn.prepare("SELECT file_name FROM album_exports WHERE album_id = ?1")?;
+    let rows = stmt
+        .query_map([id.0 as i64], |r| r.get(0))?
+        .collect::<Result<_, _>>()?;
+    Ok(rows)
+}
+
+/// A file the upload had to give another name: the server held one by the
+/// name the export recorded, put there by something this catalog never
+/// saw. The album row follows the file to the name it was given.
+///
+/// By the album's server folder, because that is all an outbox entry knows.
+/// `folder` is spelled as [`Place::Server`] spells it, without slashes at
+/// either end.
+pub fn rename_export(
+    conn: &Connection,
+    folder: &str,
+    from: &str,
+    to: &str,
+) -> Result<(), CatalogError> {
+    ensure_tables(conn)?;
+    conn.execute(
+        "UPDATE OR REPLACE album_exports SET file_name = ?3
+          WHERE file_name = ?2
+            AND album_id IN (SELECT id FROM albums WHERE server_path = ?1 AND deleted = 0)",
+        rusqlite::params![folder.trim_matches('/'), from, to],
+    )?;
+    Ok(())
+}
+
 /// The photographs behind an album's files, most recently exported first —
 /// what the grid shows when the album is opened.
 pub fn sources(conn: &Connection, id: AlbumId) -> Result<Vec<ImageId>, CatalogError> {
@@ -463,6 +505,28 @@ mod tests {
         assert_eq!(sources(conn, album).unwrap(), vec![b]);
     }
 
+    #[test]
+    fn a_renamed_upload_moves_the_row_of_the_server_album_only() {
+        let cat = catalog();
+        let conn = cat.connection();
+        let web = create(conn, "Web", &Place::Server("Albums/Web".into())).unwrap();
+        let other = create(conn, "Other", &Place::Server("Albums/Other".into())).unwrap();
+        let a = image(conn, "a.cr3");
+        record_exports(conn, web, &[(a, "a.jpg".into())]).unwrap();
+        record_exports(conn, other, &[(a, "a.jpg".into())]).unwrap();
+
+        rename_export(conn, "/Albums/Web", "a.jpg", "a-1.jpg").unwrap();
+
+        assert_eq!(
+            file_names(conn, web).unwrap(),
+            ["a-1.jpg".to_string()].into()
+        );
+        assert_eq!(
+            file_names(conn, other).unwrap(),
+            ["a.jpg".to_string()].into()
+        );
+    }
+
     #[test]
     fn moving_to_the_server_forgets_the_local_folder() {
         let cat = catalog();

core/dr-catalog/src/lib.rs

@@ -50,6 +50,7 @@ pub mod faces;
 pub mod jobs;
 pub mod keywords;
 pub mod merge;
+pub mod name_dates;
 pub mod query;
 pub mod rating;
 pub mod recovery;

core/dr-catalog/src/name_dates.rs

@@ -0,0 +1,387 @@
+//! TRACES: FR-CAT-5
+//! A capture time read from the file's name, for an image whose header has
+//! none.
+//!
+//! # Why
+//!
+//! A photograph with no EXIF date sorts after everything else, so it is lost
+//! at the end of the grid and absent from the timeline. The files that end up
+//! there are rarely without a date — they are without *EXIF*: WhatsApp strips
+//! every tag and names the file `WhatsApp Image 2023-06-15 at 07.00.42.jpeg`,
+//! a Windows Phone wrote `WP_20140922_14_16_27_Pro.jpg`, a phone camera
+//! `IMG_20190812_153012.jpg`, and darktable's import renames to
+//! `20230629_0001.jpeg`. On the reference library 250 of 274 undated images
+//! carried their date in the name or in the folder above it.
+//!
+//! # What is accepted
+//!
+//! A date is `YYYYMMDD` as a whole run of digits, or `YYYY`, `MM` and `DD`
+//! joined by `-`, `_` or `.`. A time may follow it — `HHMMSS` as one run (or
+//! nine digits, milliseconds appended), or three two-digit runs joined by
+//! `-`, `_`, `.` or `:` — after `_`, `-`, `.`, `T`, a space or ` at `.
+//! Anything else after the date leaves it at midnight: `_0059` in
+//! `20230628_0059` is a sequence number, not 00:59, and reading it as a time
+//! would invent one.
+//!
+//! The name is tried first and then each folder above it, innermost first —
+//! `2016/2016-11-11/IMG_7910.jpg` is dated by its folder. A bare year folder
+//! is not a date: putting a photograph at 1 January is a wrong answer, and an
+//! undated one at least says it does not know.
+//!
+//! The reading is wall-clock time with no zone, stored as EXIF's is
+//! (`dr_decode::parse_exif_datetime`), and EXIF always wins: this only fills
+//! rows whose `captured_at` is still empty.
+
+use rusqlite::Connection;
+
+use crate::CatalogError;
+
+/// The capture time a path's name states, as wall-clock Unix seconds.
+pub fn date_from_path(source_ref: &str) -> Option<i64> {
+    let mut parts = source_ref.rsplit(['/', '\\']);
+    let name = parts.next()?;
+    let stem = name.rsplit_once('.').map_or(name, |(stem, _)| stem);
+    date_in(stem).or_else(|| parts.find_map(date_in))
+}
+
+/// Date every examined, undated image whose name states one.
+///
+/// `only` limits the pass to the images just examined — what the sweep hands
+/// in — and `None` visits every undated image, which is the backfill's case.
+/// Both read the undated side alone (`images_captured` answers
+/// `captured_at IS NULL` with a seek), never the library.
+///
+/// Returns how many images were dated.
+pub fn fill(conn: &Connection, only: Option<&[i64]>) -> Result<usize, CatalogError> {
+    let rows: Vec<(i64, String)> = match only {
+        None => {
+            let mut stmt = conn.prepare(
+                "SELECT id, source_ref FROM images
+                  WHERE captured_at IS NULL AND metadata_state >= 2",
+            )?;
+            let rows = stmt
+                .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))?
+                .collect::<Result<_, _>>()?;
+            rows
+        }
+        Some(ids) => {
+            let mut stmt = conn.prepare_cached(
+                "SELECT source_ref FROM images
+                  WHERE id = ?1 AND captured_at IS NULL AND metadata_state >= 2",
+            )?;
+            let mut rows = Vec::new();
+            for &id in ids {
+                let mut q = stmt.query([id])?;
+                if let Some(r) = q.next()? {
+                    rows.push((id, r.get(0)?));
+                }
+            }
+            rows
+        }
+    };
+
+    let dated: Vec<(i64, i64)> = rows
+        .iter()
+        .filter_map(|(id, path)| date_from_path(path).map(|at| (*id, at)))
+        .collect();
+    if dated.is_empty() {
+        return Ok(0);
+    }
+
+    // A savepoint rather than a transaction, so a caller already inside one
+    // can still call this: the backfill's 250 rows are one commit, not 250.
+    conn.execute_batch("SAVEPOINT name_dates")?;
+    let written = (|| {
+        let mut stmt = conn.prepare_cached(
+            "UPDATE images SET captured_at = ?2 WHERE id = ?1 AND captured_at IS NULL",
+        )?;
+        let mut n = 0;
+        for (id, at) in &dated {
+            n += stmt.execute(rusqlite::params![id, at])?;
+        }
+        Ok::<_, CatalogError>(n)
+    })();
+    match written {
+        Ok(n) => {
+            conn.execute_batch("RELEASE name_dates")?;
+            Ok(n)
+        }
+        Err(e) => {
+            let _ = conn.execute_batch("ROLLBACK TO name_dates; RELEASE name_dates");
+            Err(e)
+        }
+    }
+}
+
+/// The first date, with its time if one follows, in one name component.
+fn date_in(s: &str) -> Option<i64> {
+    let b = s.as_bytes();
+    let mut i = 0;
+    while i < b.len() {
+        // Only at the start of a run of digits: a date inside a longer number
+        // is a coincidence, not a date.
+        if b[i].is_ascii_digit() && (i == 0 || !b[i - 1].is_ascii_digit()) {
+            if let Some(at) = date_at(b, i) {
+                return Some(at);
+            }
+        }
+        i += 1;
+    }
+    None
+}
+
+/// A date starting at `i`, and the time after it if there is one.
+fn date_at(b: &[u8], i: usize) -> Option<i64> {
+    let run = digits(b, i);
+    let ((y, mo, d), after) = match run.len() {
+        // YYYYMMDD, or YYYYMMDDHHMMSS written as one number.
+        8 | 14 => ((num(&run[..4]), num(&run[4..6]), num(&run[6..8])), i + 8),
+        4 => {
+            let sep = |at: usize| matches!(b.get(at), Some(b'-' | b'_' | b'.'));
+            let mo_at = i + 4 + 1;
+            let d_at = mo_at + 2 + 1;
+            if !(sep(i + 4) && digits(b, mo_at).len() == 2 && sep(mo_at + 2))
+                || digits(b, d_at).len() != 2
+            {
+                return None;
+            }
+            (
+                (num(run), num(&b[mo_at..mo_at + 2]), num(&b[d_at..d_at + 2])),
+                d_at + 2,
+            )
+        }
+        _ => return None,
+    };
+    let day = civil_days(y, mo, d)?;
+
+    let time = if run.len() == 14 {
+        hms(num(&run[8..10]), num(&run[10..12]), num(&run[12..14]))
+    } else {
+        time_at(b, after)
+    };
+    Some(day * 86_400 + time.unwrap_or(0))
+}
+
+/// The time following a date that ends at `i`, as seconds into the day.
+fn time_at(b: &[u8], i: usize) -> Option<i64> {
+    let rest = &b[i..];
+    let start = if rest.starts_with(b" at ") {
+        i + 4
+    } else if matches!(rest.first(), Some(b'_' | b'-' | b'.' | b'T' | b' ')) {
+        i + 1
+    } else {
+        return None;
+    };
+
+    let run = digits(b, start);
+    match run.len() {
+        // HHMMSS, or with milliseconds appended (Pixel's PXL_…_123456789).
+        6 | 9 => hms(num(&run[..2]), num(&run[2..4]), num(&run[4..6])),
+        2 => {
+            let sep = |at: usize| matches!(b.get(at), Some(b'-' | b'_' | b'.' | b':'));
+            let (m_at, s_at) = (start + 3, start + 6);
+            if !(sep(start + 2) && digits(b, m_at).len() == 2 && sep(m_at + 2))
+                || digits(b, s_at).len() != 2
+            {
+                return None;
+            }
+            hms(num(run), num(&b[m_at..m_at + 2]), num(&b[s_at..s_at + 2]))
+        }
+        _ => None,
+    }
+}
+
+/// The run of ASCII digits starting at `i`.
+fn digits(b: &[u8], i: usize) -> &[u8] {
+    let rest = b.get(i..).unwrap_or(&[]);
+    let n = rest.iter().take_while(|c| c.is_ascii_digit()).count();
+    &rest[..n]
+}
+
+fn num(d: &[u8]) -> i64 {
+    d.iter().fold(0, |n, c| n * 10 + i64::from(c - b'0'))
+}
+
+fn hms(h: i64, m: i64, s: i64) -> Option<i64> {
+    ((0..24).contains(&h) && (0..60).contains(&m) && (0..61).contains(&s))
+        .then_some(h * 3_600 + m * 60 + s)
+}
+
+/// Days since 1970-01-01 for a valid civil date, `None` for anything else.
+///
+/// The year range is EXIF's (`parse_exif_datetime`): wide enough for scanned
+/// film, narrow enough that a counter such as `12345678` is not a date.
+fn civil_days(y: i64, mo: i64, d: i64) -> Option<i64> {
+    let leap = y % 4 == 0 && (y % 100 != 0 || y % 400 == 0);
+    let month_len = match mo {
+        1 | 3 | 5 | 7 | 8 | 10 | 12 => 31,
+        4 | 6 | 9 | 11 => 30,
+        2 if leap => 29,
+        2 => 28,
+        _ => return None,
+    };
+    if !(1900..=2200).contains(&y) || !(1..=month_len).contains(&d) {
+        return None;
+    }
+    let y_adj = if mo <= 2 { y - 1 } else { y };
+    let era = y_adj.div_euclid(400);
+    let yoe = y_adj - era * 400;
+    let mp = (mo + 9) % 12;
+    let doy = (153 * mp + 2) / 5 + d - 1;
+    let doe = yoe * 365 + yoe / 4 - yoe / 100 + doy;
+    Some(era * 146_097 + doe - 719_468)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Wall-clock seconds for a date and time, the expected side of each case.
+    fn at(y: i64, mo: i64, d: i64, h: i64, mi: i64, s: i64) -> Option<i64> {
+        Some(civil_days(y, mo, d).unwrap() * 86_400 + h * 3_600 + mi * 60 + s)
+    }
+
+    #[test]
+    fn the_names_in_the_reference_library_are_read() {
+        // Every shape here is a file that sat undated at the end of the grid.
+        for (path, want) in [
+            (
+                "PhotosRaw/alps trip/alps whatsapp/WhatsApp Image 2023-06-15 at 07.00.42.jpeg",
+                at(2023, 6, 15, 7, 0, 42),
+            ),
+            (
+                "PhotosRaw/alps trip/alps whatsapp/WhatsApp Image 2023-06-17 at 12.45.52 (1).jpeg",
+                at(2023, 6, 17, 12, 45, 52),
+            ),
+            (
+                "PhotosRaw/WP_20140922_14_16_27_Pro.jpg",
+                at(2014, 9, 22, 14, 16, 27),
+            ),
+            // A sequence number after the date is not a time.
+            (
+                "PhotosRaw/Darktable/20230629_no_name/20230629_0001.jpeg",
+                at(2023, 6, 29, 0, 0, 0),
+            ),
+            ("PhotosRaw/20230628_0059.jpg", at(2023, 6, 28, 0, 0, 0)),
+            (
+                "PhotosRaw/backdrops/IMG_20130625_0021.jpg",
+                at(2013, 6, 25, 0, 0, 0),
+            ),
+            (
+                "PhotosRaw/alps trip/20230628_0641 - 20230628_0661.jpg",
+                at(2023, 6, 28, 0, 0, 0),
+            ),
+        ] {
+            assert_eq!(date_from_path(path), want, "{path}");
+        }
+    }
+
+    #[test]
+    fn common_camera_and_app_names_are_read() {
+        for (path, want) in [
+            ("IMG_20190812_153012.jpg", at(2019, 8, 12, 15, 30, 12)),
+            ("PXL_20210101_123456789.jpg", at(2021, 1, 1, 12, 34, 56)),
+            (
+                "Screenshot_2021-03-04-12-30-45.png",
+                at(2021, 3, 4, 12, 30, 45),
+            ),
+            (
+                "Screenshot from 2021-03-04 12-30-45.png",
+                at(2021, 3, 4, 12, 30, 45),
+            ),
+            ("IMG-20210304-WA0001.jpg", at(2021, 3, 4, 0, 0, 0)),
+            ("20210304143012.jpg", at(2021, 3, 4, 14, 30, 12)),
+            ("2019.12.25 party.jpg", at(2019, 12, 25, 0, 0, 0)),
+            ("signal-2022-01-02-101112.jpg", at(2022, 1, 2, 10, 11, 12)),
+            ("2022-01-02T10:11:12.jpg", at(2022, 1, 2, 10, 11, 12)),
+        ] {
+            assert_eq!(date_from_path(path), want, "{path}");
+        }
+    }
+
+    #[test]
+    fn a_folder_dates_a_name_that_does_not() {
+        assert_eq!(
+            date_from_path("PhotosRaw/2016/2016-11-11/IMG_7910.jpg"),
+            at(2016, 11, 11, 0, 0, 0)
+        );
+        // The innermost folder that states a date wins.
+        assert_eq!(
+            date_from_path("2016-01-01 trip/2016-01-03/_MG_1.jpg"),
+            at(2016, 1, 3, 0, 0, 0)
+        );
+        // The name beats its folder.
+        assert_eq!(
+            date_from_path("2016-11-11/IMG_20161112_080000.jpg"),
+            at(2016, 11, 12, 8, 0, 0)
+        );
+    }
+
+    #[test]
+    fn numbers_that_are_not_dates_are_left_alone() {
+        for path in [
+            "PhotosRaw/_MG_9002.jpg",
+            "PhotosRaw/scanning/fau_2.jpg",
+            // A year folder is not a day.
+            "PhotosRaw/2016/_MG_1.jpg",
+            "IMG_1999.jpg",
+            "DSC_12345678.jpg",  // month 56
+            "20230230_0001.jpg", // 30 February
+            "120230615.jpg",     // the date is inside a longer number
+            "1612345678901.jpg", // a millisecond epoch, not a civil date
+            "2023-6-15.jpg",     // a one-digit month is too loose to trust
+        ] {
+            assert_eq!(date_from_path(path), None, "{path}");
+        }
+    }
+
+    #[test]
+    fn a_time_that_cannot_be_is_dropped_and_the_date_kept() {
+        assert_eq!(
+            date_from_path("20230615_256199.jpg"),
+            at(2023, 6, 15, 0, 0, 0)
+        );
+    }
+
+    #[test]
+    fn fill_dates_only_examined_undated_rows_and_never_overrides_exif() {
+        let c = Connection::open_in_memory().unwrap();
+        crate::schema::migrate(&c).unwrap();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'remote', 'lib')",
+            [],
+        )
+        .unwrap();
+        // (id, name, captured_at, metadata_state)
+        for (id, name, captured, state) in [
+            (1i64, "IMG_20190812_153012.jpg", None, 2i64),
+            // EXIF already answered; the name disagrees and loses.
+            (2, "IMG_20190812_153012b.jpg", Some(42i64), 2),
+            // Not yet examined: EXIF may still come, so the name waits.
+            (3, "IMG_20190813_000000.jpg", None, 1),
+            (4, "_MG_9002.jpg", None, 2),
+        ] {
+            c.execute(
+                "INSERT INTO images(id, root_id, source_ref, captured_at, metadata_state, added_at)
+                 VALUES (?1, 1, ?2, ?3, ?4, 0)",
+                rusqlite::params![id, name, captured, state],
+            )
+            .unwrap();
+        }
+        let captured = |id: i64| -> Option<i64> {
+            c.query_row("SELECT captured_at FROM images WHERE id = ?1", [id], |r| {
+                r.get(0)
+            })
+            .unwrap()
+        };
+
+        assert_eq!(fill(&c, Some(&[2, 3, 4])).unwrap(), 0);
+        assert_eq!(fill(&c, None).unwrap(), 1);
+        assert_eq!(captured(1), at(2019, 8, 12, 15, 30, 12));
+        assert_eq!(captured(2), Some(42));
+        assert_eq!(captured(3), None);
+        assert_eq!(captured(4), None);
+        // Nothing left to do is a no-op, not a rewrite.
+        assert_eq!(fill(&c, None).unwrap(), 0);
+    }
+}

core/dr-catalog/src/schema.rs

@@ -356,6 +356,15 @@ pub fn backfill(conn: &Connection) -> Result<Vec<(&'static str, usize)>, Catalog
         out.push(("keyword_terms", n));
     }
 
+    // TRACES: FR-CAT-5
+    // A date from the file's name for every examined image EXIF left undated.
+    // The sweep does this as it examines each image; this is for the images
+    // examined by a build that did not, and reads the undated side alone.
+    let n = crate::name_dates::fill(conn, None)?;
+    if n > 0 {
+        out.push(("dates_from_names", n));
+    }
+
     Ok(out)
 }
 

core/dr-decode/profiles/base_curves.yaml

@@ -1,160 +0,0 @@
-# DarkRoom camera base curves (FR-DEV-3e).
-#
-# ---------------------------------------------------------------------------
-# Adding a body is editing this file. It is not a code change.
-# ---------------------------------------------------------------------------
-#
-# The copy you are reading is compiled into the binary as a floor. At startup
-# `dr_decode::base_curve::load` also looks for `base_curves.yaml` in:
-#
-#   1. $DARKROOM_PROFILES/                       (set it while you are tuning)
-#   2. $XDG_DATA_HOME/darkroom/profiles/
-#      or $HOME/.local/share/darkroom/profiles/
-#
-# and uses the first one it finds *whose `version:` is higher than this one's*.
-# So: bump `version`, drop the file in that directory, restart. A body added
-# this afternoon renders correctly this afternoon, with no release and no
-# rebuild — which is what the requirement asks for, and what makes these
-# contributable under the GPL.
-#
-# The version check runs both ways on purpose. A file older than the built-in
-# copy is ignored with a log line, so upgrading DarkRoom cannot silently lose
-# curves to a pack somebody downloaded a year ago.
-#
-# ---------------------------------------------------------------------------
-# What the numbers mean
-# ---------------------------------------------------------------------------
-#
-# Five `[x, y]` control points on a monotone spline (Fritsch-Carlson, the same
-# one the tone curve widget draws). Both axes are **linear**:
-#
-#   x  scene-referred camera RGB after white balance, 1.0 = sensor saturation
-#   y  display-referred linear; the sRGB transfer function is applied later,
-#      at the end of the shader, so do not pre-apply a gamma here
-#
-# The identity is y = x, and it is what an unrecognised body gets if `default:`
-# is removed. It is also the wrong answer for almost every photograph: linear
-# scene data has middle grey at about 13% and a camera JPEG puts it near 18%,
-# so an uncurved render is roughly half a stop dark through the midtones and
-# has no highlight rolloff at all.
-#
-# A curve that works has three parts, and it is worth naming them because they
-# are what you are actually tuning:
-#
-#   the toe       the first span, slope near or below 1. Deep shadows stay
-#                 deep. Lift it and blacks go milky; crush it and shadow
-#                 detail the sensor recorded disappears.
-#   the midtones  the middle spans, slope well above 1. This is the contrast
-#                 and the brightness people read as "the camera's look".
-#   the shoulder  the last span, slope well below 1. Highlights compress
-#                 toward white instead of arriving there and clipping. It is
-#                 the difference between a rolled-off sky and a white hole.
-#
-# Two invariants are enforced in code and tested, so a mistake here fails the
-# build rather than the photograph: x must strictly increase, y must not
-# decrease, and everything must lie inside the unit square.
-#
-# ---------------------------------------------------------------------------
-# Honesty about these values
-# ---------------------------------------------------------------------------
-#
-# These are hand-tuned shapes, not measurements. They encode what every camera
-# JPEG rendering has in common — the toe/midtone/shoulder structure above —
-# plus each maker's well-known house differences: Canon's gentler shoulder and
-# warmer-reading midtones, Nikon's slightly higher midtone contrast, Sony's
-# flatter and more conservative default, Fujifilm's markedly contrastier
-# Provia-derived rendering.
-#
-# FR-DEV-3e's acceptance criterion is subjective comparison against each body's
-# own JPEG, and meeting it properly needs a frame from that body in front of
-# you. Where that has not been done, the entry is still much closer to right
-# than the identity — which is the bar these have to clear, and do.
-
-version: 1
-
-# The rendering for a body with no entry of its own.
-#
-# **Deliberately not the identity.** The failure this requirement exists to fix
-# is the flat render, and a conservative curve is far closer to right for every
-# body than no curve is for any of them. It is gentler than the per-body
-# entries below — a shallower midtone and an earlier, softer shoulder — because
-# it has to be safe on a sensor nobody has looked at, and the cost of being too
-# tame is a photograph that wants a little contrast rather than one that has
-# lost its highlights.
-default:
-  points:
-    - [0.00, 0.000]
-    - [0.04, 0.043]
-    - [0.13, 0.175]
-    - [0.45, 0.690]
-    - [1.00, 1.000]
-
-bodies:
-  # Canon. A soft toe and a long, gradual shoulder — the reason Canon files
-  # are described as forgiving in highlights and a little low in contrast
-  # straight out of camera.
-  - make: Canon
-    model: EOS 6D
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.045]
-      - [0.13, 0.190]
-      - [0.45, 0.720]
-      - [1.00, 1.000]
-
-  - make: Canon
-    model: EOS R6
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.044]
-      - [0.13, 0.195]
-      - [0.45, 0.730]
-      - [1.00, 1.000]
-
-  # Nikon. A slightly deeper toe and more midtone slope than Canon, which is
-  # the "punchier out of camera" difference people describe between the two.
-  - make: Nikon
-    model: Z 6
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.038]
-      - [0.13, 0.200]
-      - [0.46, 0.750]
-      - [1.00, 1.000]
-
-  - make: Nikon
-    model: D750
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.039]
-      - [0.13, 0.198]
-      - [0.46, 0.745]
-      - [1.00, 1.000]
-
-  # Sony. The flattest default of the four, and intentionally so — Sony's own
-  # rendering leaves more headroom than it uses, which is why Sony files are
-  # the ones people describe as needing the most work.
-  - make: Sony
-    model: ILCE-7M3
-    points:
-      - [0.00, 0.000]
-      - [0.04, 0.048]
-      - [0.13, 0.185]
-      - [0.44, 0.700]
-      - [1.00, 1.000]
-
-  # Fujifilm. Provia, the default film simulation: a firm toe, the steepest
-  # midtones here, and a hard shoulder. It is the most distinctive rendering of
-  # the four and the one where a flat render looks most obviously wrong.
-  #
-  # This entry does *not* read the in-RAF film simulation tag — that is
-  # FR-DEV-3f, and until it lands every Fujifilm file gets the Provia shape
-  # whatever the camera was set to.
-  - make: Fujifilm
-    model: X-T3
-    points:
-      - [0.00, 0.000]
-      - [0.045, 0.040]
-      - [0.14, 0.215]
-      - [0.47, 0.775]
-      - [1.00, 1.000]

core/dr-decode/src/base_curve.rs

@@ -1,752 +0,0 @@
-//! TRACES: FR-DEV-3e
-//! Base curves — the per-body rendering that turns a correct exposure into a
-//! photograph.
-//!
-//! # What this is for
-//!
-//! A camera matrix gets the *colours* right and leaves the picture flat. Sensor
-//! data is scene-referred and very nearly linear; a print, a screen and a
-//! camera's own JPEG are none of those things. Rendering linear data straight
-//! out is the dcraw default, and FR-DEV-3e names it precisely: "the flat,
-//! poor-skin-tone rendering characteristic of dcraw defaults, which is the
-//! documented reason people abandon darktable in the first hour."
-//!
-//! The fix is a tone curve applied as part of *reading* the file rather than as
-//! an edit — a toe, a steep midtone, and a shoulder that rolls highlights off
-//! instead of clipping them. Every raw converter has one. Adobe calls it the
-//! camera profile's tone curve, darktable calls it the base curve, and the name
-//! here follows darktable's because the placement does too: it runs in camera
-//! RGB, after white balance and the user's adjustments, immediately before the
-//! conversion out to a working space.
-//!
-//! # Why it is not an edit
-//!
-//! It never reaches the sidecar and there is no slider for it, for the same
-//! reason the EXIF orientation is not an edit (FR-DEV-3h): it is a property of
-//! the body that took the frame, not of what anyone decided about the frame.
-//! Sidecars are shared between devices and bodies (FR-NC-9), and one camera's
-//! rendering must not follow an edit onto another camera's file.
-//!
-//! # Why it is data
-//!
-//! FR-DEV-3e requires the profile database to be "versioned independently of
-//! the app binary so bodies and curves can be added without a release — and,
-//! under D8's GPLv3, contributed by users". So the curves live in
-//! `profiles/base_curves.yaml`, a file that is compiled in as a floor and
-//! *overridden* by a copy on disk carrying a higher `version:`. Adding a body
-//! is adding ten numbers to a YAML file; shipping that body to users is
-//! publishing the file. Neither is a code change and neither needs a release.
-//!
-//! See [`load`] for the search path and [`Curves::body`] for the matching.
-
-use std::path::{Path, PathBuf};
-use std::sync::OnceLock;
-
-/// How many control points a base curve has.
-///
-/// Five, which is not a coincidence: it is what the tone curve widget uses
-/// (`dr_pipeline::ops::curve::POINTS`), so the shader evaluates a profile's
-/// curve and a photographer's curve through exactly the same spline. A profile
-/// author and a photographer dragging a point mean the same thing by it, and
-/// the generated shader carries one implementation rather than two that could
-/// disagree.
-pub const POINTS: usize = 5;
-
-/// TRACES: FR-DEV-3e
-/// A base curve: five points on a monotone spline through the unit square.
-///
-/// `xs` is scene-linear camera RGB, normalised so that 1.0 is the sensor's
-/// saturation point. `ys` is display-referred linear — *not* gamma-encoded,
-/// because the sRGB transfer function is applied at the very end of the
-/// generated shader and applying it twice would wash the image out.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub struct BaseCurve {
-    pub xs: [f32; POINTS],
-    pub ys: [f32; POINTS],
-}
-
-impl BaseCurve {
-    /// The curve that does nothing — the identity diagonal.
-    ///
-    /// What an unrecognised body gets if the database carries no default, and
-    /// what a JPEG gets always: an already-rendered image must not be rendered
-    /// a second time.
-    pub const IDENTITY: Self = Self {
-        xs: [0.0, 0.25, 0.5, 0.75, 1.0],
-        ys: [0.0, 0.25, 0.5, 0.75, 1.0],
-    };
-
-    /// Whether this curve would leave the image alone.
-    ///
-    /// The shader is told to skip the stage entirely when it would, so an
-    /// unprofiled body costs a branch that is uniform across the dispatch
-    /// rather than a spline evaluation per channel per pixel.
-    pub fn is_identity(&self) -> bool {
-        self.xs
-            .iter()
-            .zip(self.ys.iter())
-            .all(|(x, y)| (x - y).abs() < 1e-6)
-    }
-
-    /// Build from raw pairs, rejecting anything that is not a curve.
-    ///
-    /// A profile file is data a user may have edited, so this is the boundary
-    /// where "ten numbers" becomes "a curve": the x coordinates must increase,
-    /// the y coordinates must not decrease, and both must lie in the unit
-    /// square. A non-monotone x sends the spline's span search backwards and
-    /// divides by a negative width; a decreasing y inverts tones locally,
-    /// which reads as a dark halo through smooth gradients rather than as a
-    /// bad profile.
-    ///
-    /// Endpoints are not forced to (0,0) and (1,1). A curve that lifts black
-    /// slightly, or that places the shoulder below white, is a legitimate
-    /// rendering choice and several bodies make it.
-    pub fn from_points(points: &[[f32; 2]]) -> Option<Self> {
-        if points.len() != POINTS {
-            return None;
-        }
-        let mut xs = [0.0f32; POINTS];
-        let mut ys = [0.0f32; POINTS];
-        for (i, p) in points.iter().enumerate() {
-            if !p[0].is_finite() || !p[1].is_finite() {
-                return None;
-            }
-            if !(0.0..=1.0).contains(&p[0]) || !(0.0..=1.0).contains(&p[1]) {
-                return None;
-            }
-            xs[i] = p[0];
-            ys[i] = p[1];
-        }
-        for i in 1..POINTS {
-            // Strictly increasing in x — the spline divides by the span width.
-            if xs[i] <= xs[i - 1] {
-                return None;
-            }
-            // Non-decreasing in y. Flat is allowed: a curve that holds a
-            // highlight range at white is clipping deliberately.
-            if ys[i] < ys[i - 1] {
-                return None;
-            }
-        }
-        Some(Self { xs, ys })
-    }
-}
-
-/// One body's entry in the database.
-#[derive(Debug, Clone, PartialEq)]
-pub struct BodyCurve {
-    /// The manufacturer, as the file writes it — "Canon", "NIKON CORPORATION".
-    pub make: String,
-    /// The model, as the file writes it — "EOS 6D", "ILCE-7M3".
-    pub model: String,
-    pub curve: BaseCurve,
-}
-
-/// TRACES: FR-DEV-3e
-/// The base curve database.
-///
-/// Versioned as a whole rather than per body, because that is the unit a user
-/// downloads and the unit that has to beat the built-in copy. See [`load`].
-#[derive(Debug, Clone, PartialEq)]
-pub struct Curves {
-    version: u32,
-    default: Option<BaseCurve>,
-    bodies: Vec<BodyCurve>,
-}
-
-impl Curves {
-    /// TRACES: FR-DEV-3e
-    /// The curve to render a frame from this body with.
-    ///
-    /// Falls back, in order, to the database's `default:` and then to the
-    /// identity. **The default is deliberately not the identity**: an
-    /// unrecognised body rendered flat is the failure this requirement exists
-    /// to prevent, and a gentle, conservative curve is much closer to right for
-    /// every body than no curve is for any of them. A body with its own entry
-    /// gets that instead.
-    ///
-    /// # What "this body" has to survive
-    ///
-    /// The same camera names itself three ways depending on which program last
-    /// touched the file. A native NEF says make "NIKON CORPORATION", model
-    /// "NIKON Z 6"; rawler's own database cleans that to "Nikon" and "Z 6"; an
-    /// Adobe-converted DNG keeps the uncleaned pair. A database that had to
-    /// spell every variant would go stale the first time a maker changed its
-    /// mind about its own name, so the matching does the folding instead:
-    ///
-    /// - Case, punctuation and runs of whitespace are flattened, so
-    ///   "ILCE-7M3", "ILCE 7M3" and "ilce-7m3" are one body.
-    /// - The make is compared on its **first word only**. Every maker's
-    ///   trailing corporate boilerplate — "CORPORATION", "IMAGING CORP" — is
-    ///   noise, and no two camera manufacturers share a first word.
-    /// - The model is tried both as written and with a leading copy of the
-    ///   make removed, which is what lets one "Canon"/"EOS 6D" entry cover
-    ///   "Canon EOS 6D" as well.
-    pub fn body(&self, make: &str, model: &str) -> BaseCurve {
-        let (make, model) = (make_key(make), normalise(model));
-        // The model with a leading copy of the maker's name removed.
-        let bare = model.strip_prefix(&format!("{make} ")).unwrap_or(&model);
-
-        self.bodies
-            .iter()
-            .find(|b| {
-                let entry_model = normalise(&b.model);
-                make_key(&b.make) == make && (entry_model == model || entry_model == bare)
-            })
-            .map(|b| b.curve)
-            .or(self.default)
-            .unwrap_or(BaseCurve::IDENTITY)
-    }
-
-    /// The database version. Higher wins; see [`load`].
-    pub fn version(&self) -> u32 {
-        self.version
-    }
-
-    /// How many bodies have their own curve, excluding the default.
-    pub fn len(&self) -> usize {
-        self.bodies.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.bodies.is_empty()
-    }
-
-    /// Parse a database from YAML.
-    ///
-    /// Entries that are not curves are dropped with a warning rather than
-    /// failing the parse. A user-contributed file with one bad body should
-    /// cost that body's rendering, not every body's — and the alternative is an
-    /// application that will not open a photograph because somebody typed a
-    /// comma.
-    pub fn parse(yaml: &str) -> Result<Self, String> {
-        let file: File = serde_norway::from_str(yaml).map_err(|e| e.to_string())?;
-
-        let default = file.default.and_then(|d| {
-            BaseCurve::from_points(&d.points).or_else(|| {
-                log::warn!("base curves: the default entry is not a monotone curve; ignoring it");
-                None
-            })
-        });
-
-        let bodies = file
-            .bodies
-            .into_iter()
-            .filter_map(|b| match BaseCurve::from_points(&b.points) {
-                Some(curve) => Some(BodyCurve {
-                    make: b.make,
-                    model: b.model,
-                    curve,
-                }),
-                None => {
-                    log::warn!(
-                        "base curves: {} {} is not a monotone curve; ignoring it",
-                        b.make,
-                        b.model
-                    );
-                    None
-                }
-            })
-            .collect();
-
-        Ok(Self {
-            version: file.version,
-            default,
-            bodies,
-        })
-    }
-}
-
-/// The copy that ships inside the binary.
-///
-/// A floor, not the answer: [`load`] prefers a newer file on disk. Compiled in
-/// so that a fresh install with no profile directory — and every Android build,
-/// where there is no such directory to speak of — still renders properly.
-const BUILT_IN: &str = include_str!("../profiles/base_curves.yaml");
-
-/// TRACES: FR-DEV-3e
-/// The base curve database, loaded once.
-///
-/// # The search path, and why it is a version comparison
-///
-/// 1. `$DARKROOM_PROFILES`, a directory, when set. The escape hatch: a profile
-///    author iterating on a curve points this at their working copy and does
-///    not have to install anything.
-/// 2. `$XDG_DATA_HOME/darkroom/profiles/`, else `$HOME/.local/share/darkroom/profiles/`.
-///    The same base directory the catalog uses, chosen there for the same
-///    reason — it is data, not cache, and must survive a storage sweep.
-/// 3. The copy compiled into the binary.
-///
-/// The first file that parses *and carries a higher `version:` than the
-/// built-in copy* wins. The version check is the whole mechanism the
-/// requirement asks for, and it runs in both directions:
-///
-/// - A downloaded pack at version 7 supersedes a binary shipping version 3, so
-///   a body added after the release renders correctly with no release.
-/// - A stale pack at version 2 does **not** supersede a binary shipping version
-///   3, so upgrading the application cannot silently lose curves to a file
-///   somebody downloaded a year ago and forgot.
-///
-/// Failures are warnings, never errors. A malformed profile file must cost the
-/// user their curves, not their photographs.
-pub fn load() -> &'static Curves {
-    static LOADED: OnceLock<Curves> = OnceLock::new();
-    LOADED.get_or_init(|| {
-        let built_in = Curves::parse(BUILT_IN).unwrap_or_else(|e| {
-            // Unreachable in a build that ran its tests — `the_shipped_database_parses`
-            // asserts exactly this — but a panic here would mean an
-            // application that cannot open a photograph because of a typo in a
-            // data file, which is never the right trade.
-            log::error!("base curves: the built-in database does not parse: {e}");
-            Curves {
-                version: 0,
-                default: None,
-                bodies: Vec::new(),
-            }
-        });
-
-        choose(built_in, &search_path())
-    })
-}
-
-/// The version comparison, separated from where the directories come from.
-///
-/// Split out so it can be tested against real files in a real directory
-/// without the process-wide `OnceLock` and the environment `load` reads. The
-/// rule this implements is the whole of what FR-DEV-3e asks for, so it is
-/// worth being able to state it as a test rather than as a comment.
-fn choose(built_in: Curves, dirs: &[PathBuf]) -> Curves {
-    for dir in dirs {
-        let path = dir.join("base_curves.yaml");
-        let Ok(text) = std::fs::read_to_string(&path) else {
-            continue;
-        };
-        match Curves::parse(&text) {
-            Ok(external) if external.version > built_in.version => {
-                log::info!(
-                    "base curves: using {} (version {}, {} bodies) over the built-in version {}",
-                    path.display(),
-                    external.version,
-                    external.len(),
-                    built_in.version
-                );
-                return external;
-            }
-            Ok(external) => log::info!(
-                "base curves: ignoring {} at version {}; the built-in database is version {}",
-                path.display(),
-                external.version,
-                built_in.version
-            ),
-            Err(e) => log::warn!("base curves: {} does not parse: {e}", path.display()),
-        }
-    }
-    built_in
-}
-
-/// TRACES: FR-DEV-3e
-/// The curve for a body, from the loaded database.
-///
-/// The one call site the decoder needs; everything above is reachable for
-/// tests and for a future profile editor.
-pub fn for_body(make: &str, model: &str) -> BaseCurve {
-    load().body(make, model)
-}
-
-/// Directories that may hold a `base_curves.yaml`, most specific first.
-fn search_path() -> Vec<PathBuf> {
-    let mut dirs = Vec::new();
-    if let Some(explicit) = std::env::var_os("DARKROOM_PROFILES") {
-        dirs.push(PathBuf::from(explicit));
-    }
-    // The same resolution `dr_ui::library::catalog_path` uses, and for the
-    // same reason: this is data a user may have installed, not a cache. It is
-    // duplicated rather than shared because `dr-decode` sits far below the UI
-    // and must not acquire a dependency on it to find a directory.
-    let base = std::env::var_os("XDG_DATA_HOME")
-        .map(PathBuf::from)
-        .or_else(|| std::env::var_os("HOME").map(|h| Path::new(&h).join(".local/share")));
-    if let Some(base) = base {
-        dirs.push(base.join("darkroom").join("profiles"));
-    }
-    dirs
-}
-
-/// A manufacturer's first word, folded.
-///
-/// "NIKON CORPORATION", "Nikon" and "nikon" all become `NIKON`. The corporate
-/// suffixes are not information — they appear or not depending on whether the
-/// file went through a DNG converter — and no two camera manufacturers share a
-/// first word, so nothing is lost by dropping them.
-fn make_key(s: &str) -> String {
-    normalise(s)
-        .split(' ')
-        .next()
-        .unwrap_or_default()
-        .to_string()
-}
-
-/// Fold a make or model into something two files can agree on.
-///
-/// Upper-cased, with every run of non-alphanumeric characters collapsed to one
-/// space and the ends trimmed, so that "ILCE-7M3", "ILCE 7M3" and "ilce-7m3"
-/// become one.
-fn normalise(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    let mut pending_space = false;
-    for c in s.chars() {
-        if c.is_ascii_alphanumeric() {
-            if pending_space && !out.is_empty() {
-                out.push(' ');
-            }
-            pending_space = false;
-            out.push(c.to_ascii_uppercase());
-        } else {
-            pending_space = true;
-        }
-    }
-    out
-}
-
-// ---- The on-disk shape, kept apart from the in-memory one ----------------
-//
-// Deliberately separate types. The file is data a user edits and is allowed to
-// be wrong; `Curves` is a parsed database whose every entry is known to be a
-// monotone curve. Deriving `Deserialize` on `BaseCurve` directly would delete
-// that boundary and let an unchecked five-point array reach the shader.
-//
-// Unknown fields are **accepted**, which is not laziness. The database is
-// versioned independently of the binary and moves in both directions: a pack
-// published after this release may carry keys this build has never heard of —
-// a hue twist, a look table (FR-DEV-3f) — and it must still deliver its curves
-// to an older DarkRoom rather than failing to parse and leaving every body
-// flat. `deny_unknown_fields` would trade that for a diagnostic nobody needs.
-
-#[derive(serde::Deserialize)]
-struct File {
-    version: u32,
-    #[serde(default)]
-    default: Option<Entry>,
-    #[serde(default)]
-    bodies: Vec<BodyEntry>,
-}
-
-#[derive(serde::Deserialize)]
-struct Entry {
-    points: Vec<[f32; 2]>,
-}
-
-#[derive(serde::Deserialize)]
-struct BodyEntry {
-    make: String,
-    model: String,
-    points: Vec<[f32; 2]>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn the_shipped_database_parses_and_carries_a_default() {
-        // The one test that must never be allowed to fail quietly: `load`
-        // degrades to an empty database rather than panicking, so without this
-        // a typo in the YAML would ship as "every photograph renders flat"
-        // rather than as a build failure.
-        let curves = Curves::parse(BUILT_IN).expect("the shipped database parses");
-        assert!(curves.version() >= 1);
-        assert!(!curves.is_empty(), "the database ships bodies");
-        assert!(
-            !curves.body("Nobody", "Nothing").is_identity(),
-            "an unknown body must still get the default rendering"
-        );
-    }
-
-    #[test]
-    fn every_shipped_curve_lifts_the_midtones_and_rolls_the_highlights() {
-        // What makes a base curve a base curve rather than a decoration. If a
-        // shipped curve failed either half it would be a worse rendering than
-        // the flat one it replaced, which is the one outcome forbidden.
-        let curves = Curves::parse(BUILT_IN).expect("parses");
-        let all = curves
-            .bodies
-            .iter()
-            .map(|b| (format!("{} {}", b.make, b.model), b.curve))
-            .chain(curves.default.map(|c| ("default".to_string(), c)));
-
-        for (name, curve) in all {
-            // The midtone point sits above the diagonal: a linear midtone is
-            // roughly a stop and a half darker than any camera renders it.
-            let mid = 2;
-            assert!(
-                curve.ys[mid] > curve.xs[mid],
-                "{name} does not lift its midtones ({} -> {})",
-                curve.xs[mid],
-                curve.ys[mid]
-            );
-            // And the last span is shallower than the one before it, which is
-            // what a shoulder *is*. Without one the curve clips highlights
-            // harder than the linear rendering did.
-            let slope =
-                |i: usize| (curve.ys[i + 1] - curve.ys[i]) / (curve.xs[i + 1] - curve.xs[i]);
-            assert!(
-                slope(POINTS - 2) < slope(POINTS - 3),
-                "{name} has no highlight shoulder"
-            );
-        }
-    }
-
-    #[test]
-    fn a_curve_that_is_not_monotone_is_refused() {
-        // The profile file is user-editable, so this is a real boundary and
-        // not a formality. A decreasing y inverts tones locally and shows up
-        // as a dark halo in a gradient, which reads as a rendering fault
-        // rather than as a bad profile.
-        assert_eq!(
-            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.4], [0.5, 0.3], [0.75, 0.8], [1.0, 1.0]]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_curve_whose_x_does_not_advance_is_refused() {
-        // The spline divides by the span width; a repeated x is a division by
-        // zero in the shader, which is a NaN pixel rather than an error.
-        assert_eq!(
-            BaseCurve::from_points(&[
-                [0.0, 0.0],
-                [0.25, 0.3],
-                [0.25, 0.5],
-                [0.75, 0.8],
-                [1.0, 1.0]
-            ]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_curve_of_the_wrong_length_is_refused() {
-        assert_eq!(BaseCurve::from_points(&[[0.0, 0.0], [1.0, 1.0]]), None);
-    }
-
-    #[test]
-    fn values_outside_the_unit_square_are_refused() {
-        // The shader clamps its output at the very end anyway, but a control
-        // point above 1.0 would put the shoulder outside the range the curve
-        // is defined over and silently flatten everything below it.
-        assert_eq!(
-            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.3], [0.5, 1.4], [0.75, 1.5], [1.0, 1.6]]),
-            None
-        );
-    }
-
-    #[test]
-    fn a_body_with_its_own_entry_beats_the_default() {
-        let curves = Curves::parse(
-            "version: 2
-default:
-  points: [[0.0, 0.0], [0.25, 0.3], [0.5, 0.6], [0.75, 0.85], [1.0, 1.0]]
-bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("Canon", "EOS 5D").ys[1], 0.30);
-    }
-
-    #[test]
-    fn the_make_may_be_repeated_in_the_model() {
-        // Canon writes "Canon" as the make and "Canon EOS 6D" as the model;
-        // rawler's cleaned strings drop the repetition and both reach here.
-        // One entry has to cover both or half the files on a card miss.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Canon", "Canon EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert_eq!(curves.body("CANON", "eos 6d").ys[1], 0.35);
-    }
-
-    #[test]
-    fn a_corporate_suffix_does_not_hide_a_body() {
-        // The same Z 6 arrives as "Nikon"/"Z 6" from rawler's camera database
-        // and as "NIKON CORPORATION"/"NIKON Z 6" from a DNG converted out of
-        // the same file. Both must find the entry, or converting a file to
-        // DNG would silently change how it renders.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Nikon
-    model: Z 6
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("Nikon", "Z 6").ys[1], 0.35);
-        assert_eq!(curves.body("NIKON CORPORATION", "NIKON Z 6").ys[1], 0.35);
-    }
-
-    #[test]
-    fn punctuation_and_spacing_do_not_decide_whether_a_body_is_known() {
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Sony
-    model: ILCE-7M3
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.body("SONY", "ILCE 7M3").ys[1], 0.35);
-        assert_eq!(curves.body("sony", "ilce-7m3").ys[1], 0.35);
-    }
-
-    #[test]
-    fn one_bad_entry_does_not_cost_the_rest() {
-        // A user-contributed file with one typo should cost that body's
-        // rendering, not every body's.
-        let curves = Curves::parse(
-            "version: 1
-bodies:
-  - make: Broken
-    model: Body
-    points: [[0.0, 0.0], [0.25, 0.9], [0.5, 0.1], [0.75, 0.9], [1.0, 1.0]]
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("parses");
-
-        assert_eq!(curves.len(), 1);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-        assert!(curves.body("Broken", "Body").is_identity());
-    }
-
-    #[test]
-    fn a_pack_from_the_future_still_delivers_its_curves() {
-        // The database is versioned independently of the binary, so a pack
-        // published after this build may carry keys this build has never heard
-        // of. It must still hand over the curves it does understand — failing
-        // the parse would leave every body flat, which is the exact failure
-        // FR-DEV-3e exists to prevent, delivered by the mechanism meant to
-        // prevent it.
-        let curves = Curves::parse(
-            "version: 9
-look_table: ambitious
-bodies:
-  - make: Canon
-    model: EOS 6D
-    hue_twist: [1, 2, 3]
-    points: [[0.0, 0.0], [0.25, 0.35], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-",
-        )
-        .expect("an unfamiliar key must not fail the parse");
-
-        assert_eq!(curves.version(), 9);
-        assert_eq!(curves.body("Canon", "EOS 6D").ys[1], 0.35);
-    }
-
-    #[test]
-    fn an_unknown_body_with_no_default_gets_the_identity() {
-        // Graceful fallback, stated as a property: never worse than a flat
-        // render, and never a curve tuned for somebody else's sensor when the
-        // database declines to offer one.
-        let curves = Curves::parse("version: 1\nbodies: []\n").expect("parses");
-        assert!(curves.body("Nobody", "Nothing").is_identity());
-    }
-
-    /// A directory holding one `base_curves.yaml`, unique to the caller.
-    fn a_pack_dir(name: &str, yaml: &str) -> PathBuf {
-        let dir = std::env::temp_dir().join(format!("darkroom-base-curves-{name}"));
-        let _ = std::fs::remove_dir_all(&dir);
-        std::fs::create_dir_all(&dir).expect("a writable temp directory");
-        std::fs::write(dir.join("base_curves.yaml"), yaml).expect("write");
-        dir
-    }
-
-    const A_CANON_ENTRY: &str = "bodies:
-  - make: Canon
-    model: EOS 6D
-    points: [[0.0, 0.0], [0.25, 0.42], [0.5, 0.7], [0.75, 0.9], [1.0, 1.0]]
-";
-
-    #[test]
-    fn a_newer_pack_on_disk_supersedes_the_built_in_database() {
-        // **This is the requirement.** FR-DEV-3e asks for a profile database
-        // versioned independently of the app binary "so bodies and curves can
-        // be added without a release". A file with a higher version, dropped
-        // in the profile directory, is what that means in practice.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let newer = format!("version: {}\n{A_CANON_ENTRY}", built_in.version() + 1);
-        let dir = a_pack_dir("newer", &newer);
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version() + 1);
-        assert_eq!(chosen.body("Canon", "EOS 6D").ys[1], 0.42);
-    }
-
-    #[test]
-    fn a_stale_pack_does_not_survive_an_upgrade() {
-        // The other direction, and the one that protects the user. Somebody
-        // downloads a pack, a release later ships better curves for the same
-        // bodies, and the forgotten file must not quietly hold the application
-        // back at last year's rendering.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let stale = format!("version: {}\n{A_CANON_ENTRY}", built_in.version());
-        let dir = a_pack_dir("stale", &stale);
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version());
-        assert_ne!(
-            chosen.body("Canon", "EOS 6D").ys[1],
-            0.42,
-            "an equal version must not displace the built-in database"
-        );
-    }
-
-    #[test]
-    fn a_broken_pack_costs_the_curves_and_not_the_photographs() {
-        // A malformed profile file must degrade to the built-in database, not
-        // to an error. The user came here to look at a photograph.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let dir = a_pack_dir("broken", "version: [this is not a number\n");
-
-        let chosen = choose(built_in.clone(), &[dir]);
-        assert_eq!(chosen.version(), built_in.version());
-        assert_eq!(chosen.len(), built_in.len());
-    }
-
-    #[test]
-    fn a_directory_with_no_pack_in_it_is_simply_skipped() {
-        // The ordinary case on every machine: the search path exists, the file
-        // does not. It must not be a warning, an error, or a slow path.
-        let built_in = Curves::parse(BUILT_IN).expect("parses");
-        let missing = std::env::temp_dir().join("darkroom-base-curves-nothing-here");
-        let _ = std::fs::remove_dir_all(&missing);
-
-        assert_eq!(choose(built_in.clone(), &[missing]), built_in);
-    }
-
-    #[test]
-    fn the_identity_is_recognised_as_doing_nothing() {
-        assert!(BaseCurve::IDENTITY.is_identity());
-        assert!(!Curves::parse(BUILT_IN)
-            .expect("parses")
-            .body("Canon", "EOS 6D")
-            .is_identity());
-    }
-}

core/dr-decode/src/lib.rs

@@ -16,14 +16,12 @@
 //! second decoder can be put behind them without changing any of them
 //! (FR-RAW-2). [`Rawler`] is the one that ships; [`default`] hands it out.
 
-pub mod base_curve;
 mod decoder;
 mod error;
 mod locate;
 mod preview;
 pub mod profile;
 
-pub use base_curve::BaseCurve;
 pub use decoder::{default, Decoder, Rawler};
 pub use error::DecodeError;
 pub use locate::{
@@ -125,19 +123,6 @@ pub struct RawImage {
     /// for the light the frame was shot under; see [`profile::CameraProfile`].
     pub color_matrix: Option<[f32; 9]>,
     /// TRACES: FR-DEV-3e
-    /// The per-body rendering curve, the other half of the camera profile.
-    ///
-    /// The matrix above decides what the colours *are*; this decides what the
-    /// picture looks like. Carried on the decoded image rather than looked up
-    /// downstream because this is the only point in the system that knows
-    /// which body took the frame, and because it is not an edit: it belongs to
-    /// the file in the same way the masked-photosite crop does, and must never
-    /// reach a sidecar (FR-NC-9).
-    ///
-    /// [`BaseCurve::IDENTITY`] for an unknown body with no default in the
-    /// database, which renders exactly as this decoder did before profiles
-    /// existed.
-    pub base_curve: BaseCurve,
     /// The usable region of `data`, excluding masked and border photosites.
     pub crop: CropRect,
     /// TRACES: FR-MRG-3
@@ -592,15 +577,6 @@ fn decode_unguarded(bytes: &[u8]) -> Result<RawImage, DecodeError> {
         profile.as_ref().map(|p| p.xyz_to_cam()).as_ref(),
     );
 
-    // The rendering half of the profile (FR-DEV-3e). rawler's cleaned strings
-    // are preferred where it has them — they are what the shipped database is
-    // written against — and the matching folds the variants either way, so a
-    // DNG naming the same body differently still finds its curve.
-    let base_curve = base_curve::for_body(
-        image.camera.clean_make.as_str(),
-        image.camera.clean_model.as_str(),
-    );
-
     // TRACES: FR-MRG-3
     // A linear DNG — three samples per pixel, no colour filter array — is a
     // composite this application wrote (or any other demosaiced DNG). It
@@ -683,7 +659,6 @@ fn decode_unguarded(bytes: &[u8]) -> Result<RawImage, DecodeError> {
             .unwrap_or(u16::MAX),
         wb_coeffs,
         color_matrix,
-        base_curve,
         samples_per_pixel,
         profile,
         make: image.camera.clean_make.clone(),

core/dr-decode/src/profile.rs

@@ -6,8 +6,10 @@
 //! colour needs two things the file cannot supply on its own: a **matrix**
 //! saying how this sensor's three responses relate to the CIE observer, and a
 //! **rendering** saying what to do with the resulting scene-referred values so
-//! that a photograph looks like a photograph. This module supplies the first
-//! and looks up the second ([`crate::base_curve`]).
+//! that a photograph looks like a photograph. This module supplies the first.
+//! The second is not the body's: since D19 it is the pipeline's view
+//! transform (FR-DEV-3j), one for every camera, and the per-body base curves
+//! that used to be looked up here are retired.
 //!
 //! # What is extracted, and from where
 //!
@@ -65,8 +67,8 @@
 //! FR-DEV-3e defers full `.dcp` support — `HueSatDeltas` and
 //! `ProfileLookTable` — and requires that they arrive as *additions* rather
 //! than as a pipeline reordering. They would: both are lookups applied to a
-//! colour after this matrix and before, or alongside, the base curve, so they
-//! extend [`CameraProfile`] with more calibration data and extend the shader's
+//! colour at this matrix, before any edit reaches it, so they extend
+//! [`CameraProfile`] with more calibration data and extend the shader's
 //! camera-profile stage with more work. Nothing above would move.
 
 use crate::{cam_to_srgb_from, invert3};

core/dr-film/README.md

@@ -1,9 +1,8 @@
 # Film stocks
 
 One file per stock in [`profiles/`](profiles/). Adding a stock is adding a
-file — no code change, no shader, no new operation — for the same reason
-`dr-decode`'s base curves work that way: under the GPLv3 a stock should be
-contributable without a release.
+file — no code change, no shader, no new operation — because under the GPLv3
+a stock should be contributable without a release.
 
 ## What a profile is
 
@@ -51,6 +50,13 @@ matters — see [`src/bake.rs`](src/bake.rs) for the argument:
    log exposure through the negative, the enlarger's exposure is added there,
    and the paper's own curve row and cube take it to linear sRGB.
 
+The stock is the last thing that happens to the picture. It runs in the view
+transform's place (D19): handed linear sRGB, scene-referred, after every other
+adjustment and after sharpening and noise reduction, and handing back the
+rendering the output transform encodes. So every other slider decides the
+exposure the negative receives, and the default tone mapping is not applied
+on top.
+
 Per pixel that is a matrix multiply, a handful of curve taps and one texture
 fetch — two for a print. Splitting 2 from 3, rather than baking one LUT over exposure, is measured
 rather than assumed: the curve carries all the sharp shape and the dye mixing

core/dr-film/src/profile.rs

@@ -2,9 +2,9 @@
 //!
 //! # Why it is data
 //!
-//! The same argument `dr_decode::base_curve` makes for camera bodies, and for
-//! the same requirement: under the GPLv3 a stock should be contributable
-//! without a release. A profile is three tables and a handful of facts, all of
+//! Under the GPLv3 a stock should be contributable without a release (the
+//! argument the retired per-body base curves made for camera bodies, before
+//! D19). A profile is three tables and a handful of facts, all of
 //! them published in the manufacturer's datasheet, so adding a stock is adding
 //! a file — not a code change, not a shader, and not a new operation.
 //!

core/dr-gpu/examples/sweep.rs

@@ -182,8 +182,7 @@ fn render_to(
     // and the example never has to know which it was handed.
     let shader = graph.compose_for(ColourSpace::Srgb);
     let scale = graph.render_scale(image.size(), (w, h));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     let key = graph.invalidation().through(Affects::Colour);
     adjust
         .render_detailed(image, &shader, w, h, None, &detail, key)

core/dr-gpu/src/adjust.rs

@@ -34,16 +34,6 @@ use crate::{DemosaicedImage, GpuContext, GpuError};
 /// reads them.
 const RESERVED_FIELDS: usize = dr_pipeline::RESERVED_UNIFORM_FIELDS;
 
-/// TRACES: FR-DEV-3e
-/// The two crates must agree on how many points a base curve has.
-///
-/// `dr-decode` reads them from the profile database and `dr-pipeline` declares
-/// the uniform slots; this file is the only place the two meet, and it packs
-/// them by index. A disagreement would not fail to compile — it would upload a
-/// curve with a point missing or a stale float in it, which renders as a
-/// plausible-looking wrong tone response. Cheaper to catch here, at build time.
-const _: () = assert!(dr_decode::base_curve::POINTS == dr_pipeline::BASE_CURVE_POINTS);
-
 /// Runs composed operation chains against demosaiced images.
 pub struct AdjustPass {
     ctx: GpuContext,
@@ -132,6 +122,8 @@ pub struct AdjustPass {
     colour_dispatches: usize,
     /// Detail dispatches encoded.
     detail_dispatches: usize,
+    /// View passes encoded — one per render with a detail stage (D19).
+    view_dispatches: usize,
 }
 
 struct Target {
@@ -663,6 +655,7 @@ impl AdjustPass {
             sample: SampleCache::new(ctx),
             colour_dispatches: 0,
             detail_dispatches: 0,
+            view_dispatches: 0,
         }
     }
 
@@ -1058,13 +1051,14 @@ impl AdjustPass {
     /// Render one frame with a neighbourhood stage.
     ///
     /// `shader` and `detail` must be the two halves of **one** composition —
-    /// `EditGraph::compose_for` and `EditGraph::compose_detail_for` on the same
-    /// graph, at the same output space. The fused pass stops at linear working
-    /// values when a detail stage exists and the last detail pass performs the
-    /// output transform, so a mismatched pair either encodes twice or not at
-    /// all.
+    /// `EditGraph::compose_for` and `EditGraph::compose_detail` on the same
+    /// graph. The fused pass stops at linear working values when a detail
+    /// stage exists, and its view pass ([`ComposedShader::view`]) performs the
+    /// view transform and the output transform after the last detail pass
+    /// (D19), so a mismatched pair either encodes twice or not at all.
     ///
-    /// An empty `detail` falls through to [`Self::render_masked`], which is
+    /// An encoded shader with an empty `detail` falls through to
+    /// [`Self::render_masked`], which is
     /// the honest thing to do rather than an optimisation: an edit with no
     /// active sharpening *is* an ordinary edit, and it should cost exactly
     /// what one costs.
@@ -1104,17 +1098,25 @@ impl AdjustPass {
         detail: &ComposedDetail,
         colour_key: u64,
     ) -> Result<&wgpu::Texture, GpuError> {
-        if detail.is_empty() {
+        // An edit with no detail stage encodes in the fused pass, and is an
+        // ordinary render. Decided from the shader rather than from the chain:
+        // an active kernel too fine for this render emits no pass, and its
+        // fused pass has still stopped at linear values for the view pass.
+        if shader.output_mode == OutputMode::Encoded && detail.is_empty() {
             return self.render_masked(source, shader, width, height, masks);
         }
-        if shader.output_mode != OutputMode::LinearWorking {
-            return Err(GpuError::ShaderCompilation(
-                "this detail chain expects a fused pass composed to hand on \
-                 linear working values, but the shader given encodes its own \
-                 output; compose both halves from the same graph"
-                    .into(),
-            ));
-        }
+        let view = match (shader.output_mode, shader.view.as_deref()) {
+            (OutputMode::LinearWorking, Some(view)) => view,
+            _ => {
+                return Err(GpuError::ShaderCompilation(
+                    "this detail chain expects a fused pass composed to hand on \
+                     linear working values, with its view pass, but the shader \
+                     given encodes its own output; compose both halves from the \
+                     same graph"
+                        .into(),
+                ));
+            }
+        };
 
         let (width, height) = (width.max(1), height.max(1));
         self.ensure_target(width, height);
@@ -1127,6 +1129,7 @@ impl AdjustPass {
         // both want `&mut self`, and the second holds its borrow across the
         // encode below.
         self.pipeline(shader)?;
+        self.pipeline(view)?;
         let colour_view = self
             .detail
             .colour_target(detail.len(), width, height)
@@ -1217,20 +1220,12 @@ impl AdjustPass {
             self.colour_dispatches += 1;
         }
 
-        // One encoder for the colour pass and every detail pass, submitted
-        // once — the shape `MaskPass::render` established. Submission order is
-        // the whole of the synchronisation: each pass reads what the previous
-        // one wrote, through the same queue.
-        let target_view = self.targets[self.current]
-            .as_ref()
-            .expect("ensured above")
-            .view
-            .clone();
-        let ran = match self
-            .detail
-            .encode(&mut enc, detail, &target_view, width, height)
-        {
-            Ok(ran) => ran,
+        // One encoder for the colour pass, every detail pass and the view pass,
+        // submitted once — the shape `MaskPass::render` established.
+        // Submission order is the whole of the synchronisation: each pass
+        // reads what the previous one wrote, through the same queue.
+        let (ran, result) = match self.detail.encode(&mut enc, detail, width, height) {
+            Ok(done) => done,
             Err(e) => {
                 // Nothing is submitted, so a cache this frame was to write
                 // holds nothing, and must not be read as though it did.
@@ -1240,6 +1235,86 @@ impl AdjustPass {
                 return Err(e);
             }
         };
+
+        // TRACES: FR-DEV-3j
+        // The view pass: the view transform and the output transform, after
+        // every kernel (D19). Its own uniform block, filled from the source
+        // like the fused pass's — it reads the non-linear flag and the film
+        // settings there — with the sample cache off, because the colour it
+        // reads is the detail stage's result, bound where the cache would be.
+        let view_uniforms = Self::fused_uniforms(source, view);
+        let view_params = self
+            .ctx
+            .device
+            .create_buffer_init(&wgpu::util::BufferInitDescriptor {
+                label: Some("adjust-view-params"),
+                contents: bytemuck::cast_slice(&view_uniforms),
+                usage: wgpu::BufferUsages::UNIFORM,
+            });
+        let (_, no_sample_out) = self.sample.views(SampleUse::Direct);
+        let target_view = self.targets[self.current]
+            .as_ref()
+            .expect("ensured above")
+            .view
+            .clone();
+        let view_bind_group = self
+            .ctx
+            .device
+            .create_bind_group(&wgpu::BindGroupDescriptor {
+                label: Some("adjust-view-bg"),
+                layout: &self.bind_group_layout,
+                entries: &[
+                    wgpu::BindGroupEntry {
+                        binding: 0,
+                        resource: wgpu::BindingResource::TextureView(source.view()),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 1,
+                        resource: view_params.as_entire_binding(),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 2,
+                        resource: wgpu::BindingResource::TextureView(&target_view),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 3,
+                        resource: wgpu::BindingResource::TextureView(
+                            masks.map_or(&self.empty_masks, |m| m.view()),
+                        ),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 4,
+                        resource: wgpu::BindingResource::TextureView(&film_curves),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 5,
+                        resource: wgpu::BindingResource::TextureView(&film_lut),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 6,
+                        resource: wgpu::BindingResource::TextureView(&result),
+                    },
+                    wgpu::BindGroupEntry {
+                        binding: 7,
+                        resource: wgpu::BindingResource::TextureView(&no_sample_out),
+                    },
+                ],
+            });
+        {
+            let pipeline = self
+                .cache
+                .get(&view.structure_hash)
+                .expect("compiled above");
+            let mut pass = enc.begin_compute_pass(&wgpu::ComputePassDescriptor {
+                label: Some("adjust-view-pass"),
+                timestamp_writes: None,
+            });
+            pass.set_pipeline(pipeline);
+            pass.set_bind_group(0, &view_bind_group, &[]);
+            pass.dispatch_workgroups(width.div_ceil(8), height.div_ceil(8), 1);
+        }
+        self.view_dispatches += 1;
+
         self.ctx.queue.submit(Some(enc.finish()));
         self.detail_dispatches += ran;
         self.colour_key = Some((key, width, height));
@@ -1275,22 +1350,13 @@ impl AdjustPass {
         // runs. See `DemosaicedImage::is_non_linear`.
         let non_linear = if source.is_non_linear() { 1.0 } else { 0.0 };
         uniforms[12..16].copy_from_slice(&[wb[0], wb[1], wb[2], non_linear]);
-        // TRACES: FR-DEV-3e
-        // The camera profile's base curve, packed the way the generated block
-        // declares it: four x, four y, then the fifth point and the flag. The
-        // flag is what lets one compiled shader serve a profiled body and an
-        // unprofiled one, so the pipeline cache is not split in two by which
-        // camera took the frame.
-        //
-        // Written here rather than at the call site so that *both* callers —
-        // the plain render and the masked one — carry the profile. Filling it
-        // at one of them was how the two halves of this merge each had it.
-        let curve = source.base_curve();
-        let on = if curve.is_identity() { 0.0 } else { 1.0 };
-        let b = dr_pipeline::BASE_CURVE_UNIFORM_OFFSET;
-        uniforms[b..b + 4].copy_from_slice(&curve.xs[0..4]);
-        uniforms[b + 4..b + 8].copy_from_slice(&curve.ys[0..4]);
-        uniforms[b + 8..b + 12].copy_from_slice(&[curve.xs[4], curve.ys[4], on, 0.0]);
+        // TRACES: FR-DSP-2 | NFR-RES-2
+        // Which part of the photograph the texture holds. The whole of it for
+        // every source that fits in one texture, which writes back exactly
+        // what the composer put there.
+        let w = dr_pipeline::SOURCE_WINDOW_UNIFORM_OFFSET;
+        uniforms[w..w + dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS]
+            .copy_from_slice(&source.window_uniforms());
         uniforms
     }
 
@@ -1404,6 +1470,13 @@ impl AdjustPass {
         self.detail_dispatches
     }
 
+    /// TRACES: FR-DEV-3j
+    /// View passes encoded since this pass was created: one for every render
+    /// that had a detail stage, since the view transform follows it.
+    pub fn view_dispatches(&self) -> usize {
+        self.view_dispatches
+    }
+
     /// How many linear intermediates have been allocated. For tests: see
     /// [`crate::MaskPass::allocations`] for the regression this catches.
     pub fn detail_allocations(&self) -> usize {
@@ -1447,9 +1520,9 @@ impl AdjustPass {
     /// one: the storage format is in the layout. The profile uniforms are
     /// filled neutral here rather than from the source, which is the whole
     /// point of the mode (`OutputMode::CameraLinear`): unit white balance,
-    /// identity matrix, base curve off. The non-linear flag is kept, so a
-    /// JPEG source is still linearised — camera space for a JPEG is the
-    /// decoded values made linear, which is the best that exists.
+    /// identity matrix, and no view transform composed. The non-linear flag
+    /// is kept, so a JPEG source is still linearised — camera space for a
+    /// JPEG is the decoded values made linear, which is the best that exists.
     ///
     /// The texture stays on the device for a merge's warp to sample; see
     /// [`Self::camera_texture`] and [`Self::read_camera_linear`].
@@ -1478,8 +1551,6 @@ impl AdjustPass {
         uniforms[4..8].copy_from_slice(&[0.0, 1.0, 0.0, 0.0]);
         uniforms[8..12].copy_from_slice(&[0.0, 0.0, 1.0, 0.0]);
         uniforms[12..16].copy_from_slice(&[1.0, 1.0, 1.0, non_linear]);
-        let b = dr_pipeline::BASE_CURVE_UNIFORM_OFFSET;
-        uniforms[b + 10] = 0.0;
 
         let params_buf = self
             .ctx
@@ -1707,7 +1778,7 @@ pub(crate) fn numbered(src: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
+    use dr_decode::{CfaPattern, CropRect, RawImage};
     use dr_pipeline::ops::{colour_mixer, exposure, saturation};
     use dr_pipeline::EditGraph;
     // For `Operation::detail`, which is how `the_whole_chain_at_once_compiles`
@@ -1745,7 +1816,6 @@ mod tests {
             // Identity, so the test reasons about the operations alone
             // rather than about a camera's colour response.
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -1949,7 +2019,6 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -2381,7 +2450,7 @@ mod tests {
         // find those operations in neither stage and fail for a reason that is
         // not a defect. Shadows the smaller size deliberately.
         let (w, h) = g.output_size(512, 512);
-        let detail = g.compose_detail_for((512, 512), (w, h), dr_types::ColourSpace::Srgb);
+        let detail = g.compose_detail((512, 512), (w, h));
         assert!(
             !detail.is_empty(),
             "the detail half composed nothing, so nothing of it was compiled"
@@ -2401,7 +2470,20 @@ mod tests {
         let mut fused_blocks = 0;
         for desc in g.descriptors() {
             let id = desc.id.0;
-            let point = shader.source.contains(&format!("---- {id} ----"));
+            // A stock is loaded here, and a stock is a rendering: the view
+            // transform it replaces is correctly in neither half (FR-DEV-3j).
+            if id == dr_pipeline::ops::view_transform::ID.0 {
+                assert!(!shader.source.contains("---- view_transform ----"));
+                continue;
+            }
+            // A view operation is in the view pass when a detail stage
+            // follows, which it does here (D19).
+            let block = format!("---- {id} ----");
+            let point = shader.source.contains(&block)
+                || shader
+                    .view
+                    .as_ref()
+                    .is_some_and(|v| v.source.contains(&block));
             let neighbourhood = detail
                 .passes
                 .iter()
@@ -2435,8 +2517,15 @@ mod tests {
         // because the two catch different faults: the XOR catches an operation
         // in the wrong stage, this catches a block in the shader that nothing
         // in the chain asked for.
+        //
+        // The view pass repeats the prologue — framing and the warps — for
+        // the positions it publishes, so only its operation blocks count.
+        let view_blocks = shader
+            .view
+            .as_ref()
+            .map_or(0, |v| v.source.matches("---- ").count() - (warp_blocks + 1));
         assert_eq!(
-            shader.source.matches("---- ").count(),
+            shader.source.matches("---- ").count() + view_blocks,
             fused_blocks + warp_blocks + 1,
             "the fused shader carries a block nothing in the chain asked for"
         );
@@ -2538,7 +2627,6 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -2642,7 +2730,6 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -3227,11 +3314,16 @@ mod tests {
     }
 
     #[test]
-    fn a_jpeg_and_sensor_data_agree_on_the_same_scene_value() {
-        // The two producers must be interchangeable. A mid-grey that is
-        // linearly 0.216 (sRGB 128) arriving as sensor data and as a JPEG
-        // must render the same, or an edit would mean different things
-        // depending on which decoder opened the file.
+    fn a_jpeg_and_sensor_data_differ_by_exactly_the_view_transform() {
+        // TRACES: FR-DEV-3j
+        // The two producers must be interchangeable up to the rendering. A
+        // mid-grey that is linearly 0.216 (sRGB 128) arriving as sensor data
+        // is scene-referred and goes through the view transform; arriving as
+        // a JPEG it is already a rendering and must come out as it went in.
+        // Before D19 the fixture's identity base curve made both unrendered
+        // and this asserted they matched; what it guards is unchanged — the
+        // linearisation of each agrees — but the rendering between them is
+        // now always there for sensor data.
         let Some(ctx) = ctx() else { return };
         let mut pass = AdjustPass::new(&ctx);
         let shader = EditGraph::default_chain().compose();
@@ -3250,11 +3342,18 @@ mod tests {
             read_centre(&ctx, t)
         };
 
-        let delta = (i32::from(from_sensor[0]) - i32::from(from_jpeg[0])).abs();
+        let scene = 3537.0 / 16383.0;
+        let viewed = dr_pipeline::view::Sigmoid::default_curve().channel(scene);
+        let expected = (dr_types::Transfer::Srgb.encode(viewed) * 255.0).round() as i32;
+        let delta = (i32::from(from_sensor[0]) - expected).abs();
         assert!(
             delta <= 3,
-            "the same scene value rendered {from_sensor:?} from sensor data \
-             and {from_jpeg:?} from a JPEG"
+            "sensor data rendered {from_sensor:?}, expected about {expected}"
+        );
+        let delta = (i32::from(from_jpeg[0]) - 128).abs();
+        assert!(
+            delta <= 3,
+            "a JPEG was rendered again: {from_jpeg:?} from sRGB 128"
         );
     }
 }

core/dr-gpu/src/demosaic.rs

@@ -10,7 +10,7 @@
 //! pass over this texture; it does not re-demosaic, which is what keeps the
 //! interaction budget (NFR-P9) reachable on a 24 MP file.
 
-use dr_decode::{BaseCurve, CfaPattern, RawImage};
+use dr_decode::{CfaPattern, RawImage};
 use wgpu::util::DeviceExt;
 
 use crate::{GpuContext, GpuError};
@@ -109,23 +109,25 @@ pub struct DemosaicedImage {
     color_matrix: [f32; 9],
     /// As-shot white balance, the neutral starting point for the WB control.
     as_shot_wb: [f32; 3],
-    /// TRACES: FR-DEV-3e
-    /// The camera profile's rendering curve, carried through for the adjust
-    /// pass exactly as `color_matrix` is.
-    ///
-    /// It rides on the image rather than on the edit graph because it is not
-    /// an edit: it belongs to the body that took the frame, the way the
-    /// masked-photosite crop and the EXIF orientation do, and a sidecar shared
-    /// between two bodies must never carry one body's rendering onto the
-    /// other's file (FR-NC-9).
-    base_curve: BaseCurve,
     /// Whether the texture holds gamma-encoded rather than linear values.
     non_linear: bool,
     /// Which upload this is, unique for the life of the process. See
     /// [`Self::id`].
     id: u64,
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// The whole frame's size in pixels — what [`Self::size`] reports.
+    /// The texture's own size when it holds the whole frame at full
+    /// resolution, which is every photograph that fits in one.
+    frame: (u32, u32),
+    /// Which part of the frame the texture holds, as origin and extent in
+    /// normalised frame coordinates. `[0, 0, 1, 1]` for the whole frame,
+    /// reduced or not. See [`Self::window_uniforms`].
+    window: [f32; 4],
 }
 
+/// The window of a texture that holds the whole frame.
+const WHOLE_FRAME: [f32; 4] = [0.0, 0.0, 1.0, 1.0];
+
 /// The next [`DemosaicedImage::id`].
 fn next_image_id() -> u64 {
     static NEXT: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -143,10 +145,50 @@ impl DemosaicedImage {
         &self.view
     }
 
+    /// The size of the photograph this stands for, in its own pixels.
+    ///
+    /// **Not necessarily the texture's.** For a photograph larger than one
+    /// texture this is a reduced copy of it or a window cut from it, and
+    /// everything that sizes a render, a crop or a kernel has to go on
+    /// measuring the photograph. What indexes the texture's texels asks
+    /// [`Self::texture_size`] instead.
     pub fn size(&self) -> (u32, u32) {
+        self.frame
+    }
+
+    /// The texture's own size in texels.
+    pub fn texture_size(&self) -> (u32, u32) {
         (self.width, self.height)
     }
 
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// The source window uniforms the fused shader reads, in the order
+    /// `dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS` declares them.
+    ///
+    /// The second `vec4` is zero for a texture that holds the whole frame at
+    /// full resolution, so the shader measures the texture itself exactly as
+    /// it did before windows existed.
+    pub fn window_uniforms(&self) -> [f32; dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS] {
+        let [x, y, w, h] = self.window;
+        let (fw, fh) = if self.is_whole() {
+            (0.0, 0.0)
+        } else {
+            (self.frame.0 as f32, self.frame.1 as f32)
+        };
+        [x, y, w, h, fw, fh, 0.0, 0.0]
+    }
+
+    /// Whether the texture is the whole frame at full resolution.
+    pub fn is_whole(&self) -> bool {
+        self.window == WHOLE_FRAME && self.frame == (self.width, self.height)
+    }
+
+    /// The window this texture holds, as origin and extent in normalised
+    /// frame coordinates.
+    pub fn window(&self) -> [f32; 4] {
+        self.window
+    }
+
     /// Which texture this is, as a number that is never reused.
     ///
     /// For a cache that has to know it is still looking at the same pixels
@@ -165,15 +207,6 @@ impl DemosaicedImage {
         self.color_matrix
     }
 
-    /// TRACES: FR-DEV-3e
-    /// The camera profile's base curve, as five `(x, y)` points.
-    ///
-    /// [`BaseCurve::IDENTITY`] where the body is unprofiled or the source was
-    /// never raw, in which case the adjust pass skips the stage entirely.
-    pub fn base_curve(&self) -> BaseCurve {
-        self.base_curve
-    }
-
     /// As-shot white balance multipliers, green-normalised.
     ///
     /// The white balance control is expressed *relative* to these, so its
@@ -287,13 +320,15 @@ impl DemosaicedImage {
             color_matrix: IDENTITY_3X3,
             as_shot_wb: [1.0, 1.0, 1.0],
             // **The identity, and this is the whole reason the field is here
-            // rather than resolved further down.** A JPEG has already had its
-            // camera's base curve baked in by the camera; applying one again
-            // would render the rendering, crushing the shadows and flattening
-            // the highlights of an image that was already finished.
-            base_curve: BaseCurve::IDENTITY,
+            // rather than resolved further down.** A JPEG has already been
+            // rendered by the camera; the view transform skips a source
+            // flagged non-linear, since rendering the rendering would crush
+            // the shadows and flatten the highlights of an image that was
+            // already finished.
             non_linear: true,
             id: next_image_id(),
+            frame: (width, height),
+            window: WHOLE_FRAME,
         })
     }
 }
@@ -304,11 +339,46 @@ impl DemosaicedImage {
     /// what a merge writes. No demosaic; the samples are normalised by the
     /// file's black and white levels exactly as the demosaic kernel would
     /// normalise a photosite, and everything else — the matrix, the
-    /// balance, the body's base curve — is carried through as for a CFA
+    /// balance, the view transform — is carried through as for a CFA
     /// file, because the composite is developed as one photograph from the
     /// body that took its sources.
     pub fn from_linear_rgb16(ctx: &GpuContext, raw: &RawImage) -> Result<Self, GpuError> {
         let (width, height) = (raw.crop.width.max(1), raw.crop.height.max(1));
+        Self::linear_rgb16_window(ctx, raw, [0, 0, width, height], 1)
+    }
+
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// Part of a linear DNG, or a reduced copy of it, for a photograph too
+    /// large to hold in one texture.
+    ///
+    /// `region` is `[x, y, width, height]` in pixels of the frame (the
+    /// file's crop), clamped to it. `reduce` averages `reduce × reduce`
+    /// blocks into one texel — a box filter, which is what a reduced copy
+    /// that is only ever displayed smaller than itself needs, and which keeps
+    /// the samples in scene-linear light where an average means something.
+    ///
+    /// The texture then knows where it sits ([`Self::window`]) and how large
+    /// the photograph is ([`Self::size`]), and the fused shader maps each
+    /// output pixel's position in the *photograph* into it. So a crop, a
+    /// rotation or a mask drawn on the reduced copy lands on the same pixels
+    /// of a full-resolution window, and an export in tiles is the same
+    /// picture as one that fitted.
+    ///
+    /// Refused only if the result itself does not fit the device.
+    pub fn linear_rgb16_window(
+        ctx: &GpuContext,
+        raw: &RawImage,
+        region: [u32; 4],
+        reduce: u32,
+    ) -> Result<Self, GpuError> {
+        let frame = (raw.crop.width.max(1), raw.crop.height.max(1));
+        let k = reduce.max(1);
+        let x0 = region[0].min(frame.0 - 1);
+        let y0 = region[1].min(frame.1 - 1);
+        let rw = region[2].clamp(1, frame.0 - x0);
+        let rh = region[3].clamp(1, frame.1 - y0);
+        let (width, height) = (rw.div_ceil(k), rh.div_ceil(k));
+
         let limits = ctx.device.limits();
         if width > limits.max_texture_dimension_2d || height > limits.max_texture_dimension_2d {
             return Err(GpuError::TooLarge(format!(
@@ -328,19 +398,49 @@ impl DemosaicedImage {
         }
         let black = black_per_cell(raw);
         let inv = inv_range_per_cell(raw);
-        // Per channel rather than per CFA cell: R, G, B are the first three.
-        let mut half: Vec<u16> = Vec::with_capacity((width * height * 4) as usize);
-        for y in 0..height as usize {
-            let row = (raw.crop.y as usize + y) * stride + raw.crop.x as usize * 3;
-            for x in 0..width as usize {
-                let p = &raw.data[row + x * 3..row + x * 3 + 3];
-                for c in 0..3 {
-                    let v = (f32::from(p[c]) - black[c]) * inv[c];
-                    half.push(f32_to_f16_bits_unclamped(v));
+
+        // One output row per task: a 200-megapixel reduction is a second of
+        // one core, and the rows are independent.
+        let row_texels = width as usize * 4;
+        let mut half = vec![0u16; row_texels * height as usize];
+        let fill_row = |ty: usize, out: &mut [u16]| {
+            let sy0 = y0 as usize + ty * k as usize;
+            let sy1 = (sy0 + k as usize).min((y0 + rh) as usize);
+            for tx in 0..width as usize {
+                let sx0 = x0 as usize + tx * k as usize;
+                let sx1 = (sx0 + k as usize).min((x0 + rw) as usize);
+                let mut acc = [0f32; 3];
+                for sy in sy0..sy1 {
+                    let row = (raw.crop.y as usize + sy) * stride + raw.crop.x as usize * 3;
+                    for sx in sx0..sx1 {
+                        let p = &raw.data[row + sx * 3..row + sx * 3 + 3];
+                        for c in 0..3 {
+                            acc[c] += f32::from(p[c]);
+                        }
+                    }
                 }
-                half.push(f32_to_f16_bits(1.0));
+                let n = ((sy1 - sy0) * (sx1 - sx0)).max(1) as f32;
+                let texel = &mut out[tx * 4..tx * 4 + 4];
+                for c in 0..3 {
+                    let v = (acc[c] / n - black[c]) * inv[c];
+                    texel[c] = f32_to_f16_bits_unclamped(v);
+                }
+                texel[3] = f32_to_f16_bits(1.0);
             }
-        }
+        };
+        let threads = std::thread::available_parallelism().map_or(1, |n| n.get());
+        let rows_per = (height as usize).div_ceil(threads).max(1);
+        std::thread::scope(|scope| {
+            for (chunk, rows) in half.chunks_mut(rows_per * row_texels).enumerate() {
+                let fill_row = &fill_row;
+                scope.spawn(move || {
+                    for (i, out) in rows.chunks_mut(row_texels).enumerate() {
+                        fill_row(chunk * rows_per + i, out);
+                    }
+                });
+            }
+        });
+
         let texture = ctx.device.create_texture_with_data(
             &ctx.queue,
             &wgpu::TextureDescriptor {
@@ -361,6 +461,17 @@ impl DemosaicedImage {
             bytemuck::cast_slice(&half),
         );
         let view = texture.create_view(&Default::default());
+        // The extent is the texels' own, `width × k`, not the region's: the
+        // last block of a reduction may run past the frame's edge, and
+        // stretching it to fit would put every texel slightly off the
+        // pixels it averaged. The shader's bounds test is on the frame, so
+        // nothing past the edge is ever read.
+        let window = [
+            x0 as f32 / frame.0 as f32,
+            y0 as f32 / frame.1 as f32,
+            (width * k) as f32 / frame.0 as f32,
+            (height * k) as f32 / frame.1 as f32,
+        ];
         Ok(Self {
             texture,
             view,
@@ -368,9 +479,10 @@ impl DemosaicedImage {
             height,
             color_matrix: raw.color_matrix.unwrap_or(IDENTITY_3X3),
             as_shot_wb: [raw.wb_coeffs[0], raw.wb_coeffs[1], raw.wb_coeffs[2]],
-            base_curve: raw.base_curve,
             non_linear: false,
             id: next_image_id(),
+            frame,
+            window,
         })
     }
 }
@@ -784,12 +896,13 @@ impl Demosaicer {
             // Whatever the profile database had for this body (FR-DEV-3e),
             // resolved at decode because that is the only place the make and
             // model are known.
-            base_curve: raw.base_curve,
             // Sensor data is linear by construction — the demosaic shader
             // normalises against black and white levels and applies no
             // transfer function.
             non_linear: false,
             id: next_image_id(),
+            frame: (width, height),
+            window: WHOLE_FRAME,
         })
     }
 }
@@ -1284,7 +1397,6 @@ mod tests {
             white_level: white,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -1400,7 +1512,6 @@ mod tests {
             white_level: white,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -1697,7 +1808,6 @@ mod tests {
             white_level: 16383,
             wb_coeffs: [1.0, 1.0, 1.0, 1.0],
             color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),
@@ -1782,7 +1892,6 @@ mod tests {
                 1.0,
             ],
             color_matrix: None,
-            base_curve: BaseCurve::IDENTITY,
             samples_per_pixel: 1,
             profile: None,
             make: String::new(),

core/dr-gpu/src/detail.rs

@@ -43,12 +43,12 @@
 //! dispatch is skipped, and dragging a sharpening slider costs the detail
 //! passes alone (FR-DEV-3d).
 //!
-//! The remaining passes alternate between slots 1 and 2, and the last one
-//! writes the display texture directly rather than an intermediate — so a
-//! chain of *N* passes costs *N* dispatches and not *N* + 1, and there is no
-//! resolve pass to pay for. That leaves the allocation at `1 + min(N-1, 2)`
-//! textures: one for a single-pass operation, two for a separable blur, three
-//! however long the chain gets after that.
+//! The passes alternate between slots 1 and 2, the last one included: since
+//! D19 it hands its result to the adjust pass's **view pass**, which performs
+//! the view transform and the output transform after every kernel, so no
+//! detail pass writes the display texture. A chain of *N* passes costs *N*
+//! dispatches plus that one, and the allocation is `1 + min(N, 2)` textures.
+//! An empty chain costs the view pass alone, reading slot 0.
 //!
 //! # The reduced chain, and why a second one was needed
 //!
@@ -186,10 +186,9 @@ impl Intermediates {
 /// intermediate against a fresh colour result and never be told.
 pub(crate) struct DetailRunner {
     ctx: GpuContext,
-    /// Layout for a pass writing another linear intermediate.
+    /// Layout for every pass: each writes a linear intermediate, the last
+    /// one included, and the adjust pass's view pass reads the last (D19).
     to_linear: Layout,
-    /// Layout for the last pass, which writes the display texture.
-    to_output: Layout,
     /// Compiled pipelines by pass structure hash.
     cache: HashMap<u64, wgpu::ComputePipeline>,
     pool: Intermediates,
@@ -255,7 +254,6 @@ impl DetailRunner {
         Self {
             ctx: ctx.clone(),
             to_linear: Layout::new(ctx, INTERMEDIATE_FORMAT, "detail-linear"),
-            to_output: Layout::new(ctx, crate::AdjustPass::FORMAT, "detail-output"),
             cache: HashMap::new(),
             pool: Intermediates::new(),
             reduced: Intermediates::new(),
@@ -274,27 +272,30 @@ impl DetailRunner {
         width: u32,
         height: u32,
     ) -> &wgpu::TextureView {
-        // One for the colour pass's result, then one per hand-off between
-        // detail passes, capped at two because a ping-pong needs no more: the
-        // last pass writes the display texture rather than an intermediate.
-        let needed = 1 + passes.saturating_sub(1).min(2);
+        // One for the colour pass's result, then one per pass, capped at two
+        // because a ping-pong needs no more. The last pass writes an
+        // intermediate like the others since D19 — the view pass reads it —
+        // so a one-pass chain needs two slots where it used to need one.
+        let needed = 1 + passes.min(2);
         self.pool.ensure(&self.ctx, needed, width, height);
         &self.pool.slots[0].view
     }
 
-    /// Encode every pass of `chain`, the last one writing `output`.
+    /// Encode every pass of `chain`, and return how many ran and the view
+    /// the last one wrote — slot 0, the colour pass's own result, for an
+    /// empty chain.
     ///
     /// The caller must already have run the fused colour pass into
     /// [`Self::colour_target`] — or established that a previous frame's is
-    /// still valid, which is the whole point of keeping slot 0.
+    /// still valid, which is the whole point of keeping slot 0 — and reads the
+    /// returned view in the view pass that finishes the render (D19).
     pub(crate) fn encode(
         &mut self,
         encoder: &mut wgpu::CommandEncoder,
         chain: &ComposedDetail,
-        output: &wgpu::TextureView,
         width: u32,
         height: u32,
-    ) -> Result<usize, GpuError> {
+    ) -> Result<(usize, wgpu::TextureView), GpuError> {
         for pass in &chain.passes {
             self.compile(pass)?;
         }
@@ -340,17 +341,15 @@ impl DetailRunner {
         for pass in chain.passes.iter() {
             let scaled = pass.output_scale > 1;
 
-            // The last pass carries the output transform into the display
-            // texture, which is the render size by definition. A scaled pass
-            // there would bind a shader dispatching over a quarter-size grid
-            // to a full-size target and write a quarter of the picture — a
-            // wrong image rather than a validation failure, so it is caught
-            // here and named.
-            if scaled && pass.writes_output {
+            // The last pass hands the view pass its input, which is read at
+            // the render size by definition. A scaled pass there would leave
+            // the result in the reduced chain and the view pass would read the
+            // full-size slot before it — a wrong image rather than a
+            // validation failure, so it is caught here and named.
+            if scaled && std::ptr::eq(pass, chain.passes.last().expect("iterating")) {
                 return Err(GpuError::ShaderCompilation(format!(
                     "detail pass {} declares output_scale {} and is last in \
-                     the chain; the output transform is written at the render \
-                     size",
+                     the chain; the view pass reads the render size",
                     pass.label, pass.output_scale
                 )));
             }
@@ -365,17 +364,14 @@ impl DetailRunner {
             };
 
             // Read what the previous pass in *this pass's own chain* wrote;
-            // write the next slot of it, or the display texture if this is the
-            // last pass. Alternating slots is what stops a pass reading the
+            // write the next slot of it. Alternating slots is what stops a pass reading the
             // texture it is writing — on a compute pass that is not an error
             // the driver reports, merely a picture that depends on scheduling.
             let source = match (scaled, carried) {
                 (true, Some(slot)) => &self.reduced.slots[slot].view,
                 _ => &self.pool.slots[full].view,
             };
-            let destination = if pass.writes_output {
-                output
-            } else if scaled {
+            let destination = if scaled {
                 &self.reduced.slots[reduced_writes % 2].view
             } else {
                 &self.pool.slots[1 + (full_writes % 2)].view
@@ -387,11 +383,7 @@ impl DetailRunner {
                 Some(slot) => &self.reduced.slots[slot].view,
                 None => &self.no_reduced,
             };
-            let layout = if pass.writes_output {
-                &self.to_output
-            } else {
-                &self.to_linear
-            };
+            let layout = &self.to_linear;
 
             let params = self
                 .ctx
@@ -464,9 +456,7 @@ impl DetailRunner {
             compute.dispatch_workgroups(dispatch_w.div_ceil(8), dispatch_h.div_ceil(8), 1);
             drop(compute);
 
-            if pass.writes_output {
-                // Nothing downstream to hand anything to.
-            } else if scaled {
+            if scaled {
                 carried = Some(reduced_writes % 2);
                 reduced_writes += 1;
             } else {
@@ -480,7 +470,7 @@ impl DetailRunner {
             }
         }
 
-        Ok(chain.passes.len())
+        Ok((chain.passes.len(), self.pool.slots[full].view.clone()))
     }
 
     /// Compile one pass, or leave the cached pipeline in place.
@@ -508,11 +498,7 @@ impl DetailRunner {
                 source: wgpu::ShaderSource::Wgsl(pass.source.as_str().into()),
             });
 
-        let layout = if pass.writes_output {
-            &self.to_output
-        } else {
-            &self.to_linear
-        };
+        let layout = &self.to_linear;
 
         let pipeline = self
             .ctx

core/dr-gpu/src/mask.rs

@@ -928,7 +928,7 @@ impl MaskPass {
         // the only readers and they are skipped in that case.
         let source_step = match source {
             Some(image) => {
-                let (sw, sh) = image.size();
+                let (sw, sh) = image.texture_size();
                 [
                     sw as f32 / width.max(1) as f32,
                     sh as f32 / height.max(1) as f32,

core/dr-gpu/src/merge.rs

@@ -30,18 +30,27 @@
 //! are the caller's to provide and cache — `source` is asked for frame `k`
 //! as it is needed, and a caller short of memory may demosaic on demand.
 //!
+//! # The blend
+//!
+//! With a seam map (`dr_pano::seam`), a frame's weight at a pixel is its
+//! share of the map about that pixel — whole on its own side of a seam,
+//! nothing on the other, and a ramp across a window `seam_blend` pixels
+//! wide that follows the seam. Without one, or where the map has nothing
+//! to say, the weight is the distance to the frame's edge over `feather`,
+//! which hides exposure steps and does not hide parallax: the average draws
+//! anything the frames disagree on twice.
+//!
 //! # What is not here yet
 //!
-//! A feathered blend, not seams and a Laplacian pyramid: the weight is the
-//! distance to the frame's edge, which hides exposure steps and small
-//! misalignments and does not hide parallax. Gain is a scalar per frame
-//! the caller supplies. Both are panorama.md §10's step 5, after the path
-//! writes a file end to end.
+//! A Laplacian pyramid, which would let the seam's blend be narrow for
+//! detail and wide for exposure at once. Gain is a scalar per frame the
+//! caller supplies.
 
 use std::sync::Arc;
 
 use dr_pano::bundle::Cameras;
 use dr_pano::projection::{Bounds, Projection};
+use dr_pano::seam::SeamMap;
 use wgpu::util::DeviceExt;
 
 use crate::readback::await_mapping;
@@ -58,7 +67,7 @@ pub struct MergeFrame {
 }
 
 /// The output the merge produces.
-#[derive(Debug, Clone, Copy, PartialEq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct MergeOutput {
     pub projection: Projection,
     /// The projection's scale in output pixels: the cylinder's radius, the
@@ -69,10 +78,19 @@ pub struct MergeOutput {
     pub bounds: Bounds,
     /// Pixels over which a frame's weight ramps up from its edge.
     pub feather: f32,
+    /// Which frame each part of the output is taken from, laid out at the
+    /// proxies' scale; `None` for the feathered average everywhere.
+    pub seams: Option<Arc<SeamMap>>,
+    /// The width, in output pixels, of the blend across a seam.
+    pub seam_blend: f32,
     /// Chunk size: the unit of GPU work and of memory.
     pub chunk: (u32, u32),
     /// Multiplies a normalised sample (1.0 = white) to the sensor's scale.
     pub sample_scale: f32,
+    /// The white balance the composite will be developed with — the
+    /// inverse of its `AsShotNeutral` — so that a blown sample can be
+    /// written as the camera value that balance calls grey.
+    pub balance: [f32; 3],
 }
 
 impl MergeOutput {
@@ -109,7 +127,14 @@ struct WarpParams {
     tile_origin: [f32; 2],
     tile_size: [u32; 2],
     feather: f32,
-    _pad: f32,
+    clip_onset: f32,
+    balance: [f32; 4],
+    seam_origin: [f32; 2],
+    seam_size: [u32; 2],
+    seam_px: f32,
+    seam_radius: f32,
+    frame_index: u32,
+    seam_on: u32,
 }
 
 #[repr(C)]
@@ -177,6 +202,16 @@ impl MergePass {
                         count: None,
                     },
                     storage(2, false),
+                    wgpu::BindGroupLayoutEntry {
+                        binding: 3,
+                        visibility: wgpu::ShaderStages::COMPUTE,
+                        ty: wgpu::BindingType::Texture {
+                            sample_type: wgpu::TextureSampleType::Uint,
+                            view_dimension: wgpu::TextureViewDimension::D2,
+                            multisampled: false,
+                        },
+                        count: None,
+                    },
                 ],
             });
         let resolve_layout =
@@ -274,6 +309,32 @@ impl MergePass {
         let mut band_cov = vec![false; (out_w * ch) as usize];
         let mut chunk_px: Vec<u32> = Vec::new();
 
+        // The seam map, once for the whole output, and where it sits in
+        // this output's coordinates. A one-texel stand-in when there is
+        // none, because the binding is not optional.
+        let (seam_tex, seam_origin, seam_px, seam_radius, seam_size) = match &output.seams {
+            Some(m) => {
+                let ((ou, ov), px) = m.at_scale(output.scale);
+                let radius = m.blend_radius(output.scale, f64::from(output.seam_blend));
+                (
+                    self.label_texture(m.width as u32, m.height as u32, &m.labels),
+                    [ou as f32, ov as f32],
+                    px as f32,
+                    radius as f32,
+                    [m.width as u32, m.height as u32],
+                )
+            }
+            None => (
+                self.label_texture(1, 1, &[dr_pano::seam::NONE]),
+                [0.0; 2],
+                1.0,
+                1.0,
+                [1, 1],
+            ),
+        };
+        let seam_view = seam_tex.create_view(&Default::default());
+        let seam_on = u32::from(output.seams.is_some());
+
         let mut y = 0u32;
         while y < out_h {
             let rows = ch.min(out_h - y);
@@ -334,9 +395,21 @@ impl MergePass {
                         tile_origin: [rect.0 as f32, rect.1 as f32],
                         tile_size: [rect.2, rect.3],
                         feather: output.feather,
-                        _pad: 0.0,
+                        clip_onset: dr_pipeline::CLIP_ONSET,
+                        balance: [
+                            output.balance[0].max(1e-3),
+                            output.balance[1].max(1e-3),
+                            output.balance[2].max(1e-3),
+                            0.0,
+                        ],
+                        seam_origin,
+                        seam_size,
+                        seam_px,
+                        seam_radius,
+                        frame_index: k as u32,
+                        seam_on,
                     };
-                    self.accumulate(&params, tile);
+                    self.accumulate(&params, tile, &seam_view);
                 }
 
                 self.resolve_chunk((cols, rows), output.sample_scale, &mut chunk_px)?;
@@ -374,7 +447,42 @@ impl MergePass {
         self.ctx.queue.submit(Some(enc.finish()));
     }
 
-    fn accumulate(&mut self, params: &WarpParams, tile: &wgpu::Texture) {
+    /// The seam map's labels as an `r8uint` texture.
+    fn label_texture(&self, width: u32, height: u32, labels: &[u8]) -> wgpu::Texture {
+        let size = wgpu::Extent3d {
+            width,
+            height,
+            depth_or_array_layers: 1,
+        };
+        let tex = self.ctx.device.create_texture(&wgpu::TextureDescriptor {
+            label: Some("merge-seams"),
+            size,
+            mip_level_count: 1,
+            sample_count: 1,
+            dimension: wgpu::TextureDimension::D2,
+            format: wgpu::TextureFormat::R8Uint,
+            usage: wgpu::TextureUsages::TEXTURE_BINDING | wgpu::TextureUsages::COPY_DST,
+            view_formats: &[],
+        });
+        self.ctx.queue.write_texture(
+            wgpu::TexelCopyTextureInfo {
+                texture: &tex,
+                mip_level: 0,
+                origin: wgpu::Origin3d::ZERO,
+                aspect: wgpu::TextureAspect::All,
+            },
+            labels,
+            wgpu::TexelCopyBufferLayout {
+                offset: 0,
+                bytes_per_row: Some(width),
+                rows_per_image: Some(height),
+            },
+            size,
+        );
+        tex
+    }
+
+    fn accumulate(&mut self, params: &WarpParams, tile: &wgpu::Texture, seams: &wgpu::TextureView) {
         let chunk = (params.chunk_size[0], params.chunk_size[1]);
         let uniforms = self
             .ctx
@@ -406,6 +514,10 @@ impl MergePass {
                         binding: 2,
                         resource: acc.as_entire_binding(),
                     },
+                    wgpu::BindGroupEntry {
+                        binding: 3,
+                        resource: wgpu::BindingResource::TextureView(seams),
+                    },
                 ],
             });
         let mut enc = self.ctx.device.create_command_encoder(&Default::default());

core/dr-gpu/src/raw_histogram.rs

@@ -28,8 +28,8 @@
 //! than leaving the specification and the code silently disagreeing.
 //!
 //! That texture is the right one on the merits. It is camera-native: no white
-//! balance has been applied, no camera matrix, no base curve, no tone curve,
-//! no output transform. It is normalised by the sensor's own black and white
+//! balance has been applied, no camera matrix, no tone curve, no view
+//! transform, no output transform. It is normalised by the sensor's own black and white
 //! levels, so 1.0 is saturation by construction and the distribution below it
 //! *is* the headroom question, with no calibration to carry and no origin to
 //! choose.

core/dr-gpu/src/segment.rs

@@ -208,7 +208,7 @@ impl SegmentPass {
         source: &DemosaicedImage,
         opts: SegmentOptions,
     ) -> Result<Segmentation, GpuError> {
-        let (src_w, src_h) = source.size();
+        let (src_w, src_h) = source.texture_size();
         let (width, height) = proxy_size(src_w, src_h, opts.max_edge);
         let n = (width * height) as u64;
 

core/dr-gpu/src/shaders/merge.wgsl

@@ -5,8 +5,9 @@
 // pixel it asks which direction that pixel looks along, turns the
 // direction into the frame's camera, projects it to a source pixel, and
 // if that pixel is inside the tile that was rendered for this chunk,
-// samples it and adds it — weighted by its distance from the frame's edge
-// — into the accumulator. `resolve` runs once per chunk after every frame
+// samples it and adds it — weighted by the frame's share of the seam map
+// there, or by its distance from the frame's edge where there is no map —
+// into the accumulator. `resolve` runs once per chunk after every frame
 // has been added: divides the sums by the weights and packs the result as
 // sixteen-bit samples at the sensor's scale (FR-MRG-3).
 //
@@ -46,13 +47,87 @@ struct Params {
     tile_size: vec2<u32>,
     // Pixels over which the weight ramps from the edge to full.
     feather: f32,
-    _pad: f32,
+    // Where a sample starts to count as blown (`CLIP_ONSET`), and the
+    // white balance the composite will be developed with.
+    clip_onset: f32,
+    balance: vec4<f32>,
+    // The seam map (`dr_pano::seam`): where its texel (0, 0)'s corner sits
+    // in this output's centred coordinates, its size, output pixels per
+    // texel, the blend's radius in texels, which frame this dispatch is,
+    // and whether there is a map at all.
+    seam_origin: vec2<f32>,
+    seam_size: vec2<u32>,
+    seam_px: f32,
+    seam_radius: f32,
+    frame_index: u32,
+    seam_on: u32,
 };
 
 @group(0) @binding(0) var<uniform> p: Params;
 @group(0) @binding(1) var tile: texture_2d<f32>;
 // rgb·w summed, then w: four floats per chunk pixel.
 @group(0) @binding(2) var<storage, read_write> acc: array<vec4<f32>>;
+// One frame index per texel, 255 for none.
+@group(0) @binding(3) var seams: texture_2d<u32>;
+
+const NO_FRAME: u32 = 255u;
+
+fn label(i: i32, j: i32) -> u32 {
+    if (i < 0 || j < 0 || i >= i32(p.seam_size.x) || j >= i32(p.seam_size.y)) {
+        return NO_FRAME;
+    }
+    return textureLoad(seams, vec2<i32>(i, j), 0).r;
+}
+
+// This frame's share of the seam map about output point (u, v): the
+// tent-weighted fraction of the texels within the radius that it owns, and
+// the weight of the texels owned by anyone (zero where the map has nothing
+// to say). `SeamMap::share` verbatim.
+fn seam_share(u: f32, v: f32) -> vec2<f32> {
+    let x = (u - p.seam_origin.x) / p.seam_px - 0.5;
+    let y = (v - p.seam_origin.y) / p.seam_px - 0.5;
+    let r = max(p.seam_radius, 1.0);
+    let x0 = i32(ceil(x - r));
+    let x1 = i32(floor(x + r));
+    let y0 = i32(ceil(y - r));
+    let y1 = i32(floor(y + r));
+    // Most pixels are nowhere near a seam: if the window's corners, edge
+    // midpoints and centre agree, so does the window. A seam crossing it
+    // has to cross its border, between two of those.
+    let xm = i32(round(x));
+    let ym = i32(round(y));
+    let c = label(xm, ym);
+    if (label(x0, y0) == c && label(x1, y0) == c && label(x0, y1) == c && label(x1, y1) == c
+        && label(xm, y0) == c && label(xm, y1) == c && label(x0, ym) == c && label(x1, ym) == c) {
+        if (c == NO_FRAME) {
+            return vec2<f32>(0.0, 0.0);
+        }
+        return vec2<f32>(select(0.0, 1.0, c == p.frame_index), 1.0);
+    }
+    var mine = 0.0;
+    var owned = 0.0;
+    for (var j = y0; j <= y1; j = j + 1) {
+        let wy = 1.0 - abs(y - f32(j)) / r;
+        if (wy <= 0.0) {
+            continue;
+        }
+        for (var i = x0; i <= x1; i = i + 1) {
+            let wx = 1.0 - abs(x - f32(i)) / r;
+            let l = label(i, j);
+            if (wx <= 0.0 || l == NO_FRAME) {
+                continue;
+            }
+            owned = owned + wx * wy;
+            if (l == p.frame_index) {
+                mine = mine + wx * wy;
+            }
+        }
+    }
+    if (owned <= 0.0) {
+        return vec2<f32>(0.0, 0.0);
+    }
+    return vec2<f32>(mine / owned, 1.0);
+}
 
 fn to_direction(u: f32, v: f32) -> vec3<f32> {
     let s = p.proj_scale;
@@ -95,7 +170,17 @@ fn warp(@builtin(global_invocation_id) gid: vec3<u32>) {
     if (edge <= 0.0) {
         return;
     }
-    let w = clamp(edge / max(p.feather, 1.0), 0.0, 1.0);
+    var w = clamp(edge / max(p.feather, 1.0), 0.0, 1.0);
+    // With seams, the share of the map scales it. The small floor keeps
+    // the feather underneath as the answer wherever no frame that reaches
+    // this pixel owns it — the map is coarser than the output, so at the
+    // frames' outer edges it can name a frame that falls just short.
+    if (p.seam_on != 0u) {
+        let s = seam_share(u, v);
+        if (s.y > 0.0) {
+            w = w * (s.x + 1e-4);
+        }
+    }
     // Into the tile.
     let tx = sx - p.tile_origin.x;
     let ty = sy - p.tile_origin.y;
@@ -125,7 +210,19 @@ fn warp(@builtin(global_invocation_id) gid: vec3<u32>) {
         return;
     }
     // Colour is the alpha-weighted mean of the texels that exist.
-    let rgb = s.rgb / s.a * p.gain;
+    let cam = s.rgb / s.a;
+    // **A blown sample is written as grey, before the gain.** A clipped
+    // photosite arrives as (1, 1, 1), which is not a colour: balanced, it
+    // is magenta, and the develop's highlight desaturation only rescues it
+    // while it is still at the white level. A gain below one moved it off
+    // that level, and a feather mixed it into a neighbour's real sky, so
+    // the composite's blown clouds came out pink. Written instead as the
+    // camera value the balance maps to grey — the develop pipeline's own
+    // neutral, the brightest balanced channel — it survives both.
+    let clipped = smoothstep(p.clip_onset, 1.0, max(cam.r, max(cam.g, cam.b)));
+    let balanced = cam * p.balance.rgb;
+    let grey = vec3<f32>(max(balanced.r, max(balanced.g, balanced.b))) / p.balance.rgb;
+    let rgb = mix(cam, grey, clipped) * p.gain;
     let wa = w * s.a;
     let i = gid.y * p.chunk_size.x + gid.x;
     acc[i] = acc[i] + vec4<f32>(rgb * wa, wa);

core/dr-gpu/src/shaders/raw_histogram.wgsl

@@ -3,7 +3,7 @@
 //
 // The shader beside this one, `histogram.wgsl`, counts the frame the display
 // is about to show: an 8-bit code value, after white balance, the camera
-// matrix, the base curve, the tone curve and the output transform. This one
+// matrix, the tone curve, the view transform and the output transform. This one
 // counts the texture the demosaic wrote, before any of that. The two differ in
 // exactly one place — the axis — and everything else here is deliberately the
 // same construction, because the two reductions have the same shape and any

core/dr-gpu/tests/base_curve.rs

@@ -1,181 +0,0 @@
-//! TRACES: FR-DEV-3e
-//! The camera profile's base curve, end to end on a device.
-//!
-//! The unit tests either side of this one check halves. `dr-decode` asserts
-//! that the shipped database parses and that every curve in it lifts its
-//! midtones; `dr-pipeline` asserts that the generated WGSL evaluates a curve
-//! in the right place. Neither would notice if the two agreed with each other
-//! and both were wrong — a curve packed into the wrong uniform slots, or a
-//! flag read from the wrong component, satisfies both and renders nothing.
-//!
-//! So this renders real pixels twice, once with a profiled body's curve and
-//! once with the identity, and asserts the difference is the one a base curve
-//! is for: midtones lifted, black still black, white still white.
-
-use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
-use dr_gpu::{AdjustPass, Demosaicer, GpuContext};
-use dr_pipeline::EditGraph;
-
-const SIZE: u32 = 16;
-
-fn ctx() -> Option<GpuContext> {
-    pollster::block_on(GpuContext::new_headless()).ok()
-}
-
-/// A flat RGGB frame at `level` out of 65535, carrying `curve`.
-///
-/// Every photosite the same value, so the demosaic result is a uniform grey
-/// and the only thing that can move a pixel is the curve. The colour matrix is
-/// the identity and the balance is neutral for the same reason: this test is
-/// about one stage, and a real body's matrix would make every assertion below
-/// a statement about that body instead.
-fn flat_raw(level: u16, curve: BaseCurve) -> RawImage {
-    RawImage {
-        width: SIZE,
-        height: SIZE,
-        data: vec![level; (SIZE * SIZE) as usize],
-        cfa_pattern: CfaPattern::Rggb,
-        black_level: [0; 4],
-        white_level: u16::MAX,
-        wb_coeffs: [1.0, 1.0, 1.0, 1.0],
-        color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-        base_curve: curve,
-        samples_per_pixel: 1,
-        profile: None,
-        make: String::new(),
-        model: String::new(),
-        crop: CropRect {
-            x: 0,
-            y: 0,
-            width: SIZE,
-            height: SIZE,
-        },
-    }
-}
-
-/// Render a neutral edit over a flat frame and return the centre pixel's red.
-///
-/// The centre rather than a corner: a demosaic has to invent its edges, and
-/// the interpolated border of a 16×16 frame is not where anyone should be
-/// reading a tone off.
-fn rendered_level(ctx: &GpuContext, level: u16, curve: BaseCurve) -> u8 {
-    let raw = flat_raw(level, curve);
-    let source = Demosaicer::new(ctx)
-        .expect("demosaicer")
-        .run(&raw)
-        .expect("demosaic");
-    let shader = EditGraph::default_chain().compose();
-    let mut adjust = AdjustPass::new(ctx);
-    adjust.render(&source, &shader, SIZE, SIZE).expect("render");
-    let (pixels, _, _) = adjust.export_pixels().expect("readback");
-    let centre = ((SIZE / 2) * SIZE + SIZE / 2) * 4;
-    pixels[centre as usize]
-}
-
-/// The Canon EOS 6D's curve, from the shipped profile database.
-///
-/// Looked up by name rather than written out, so this also asserts the thing
-/// no other test can: that a curve travels from the YAML, through the body
-/// match, onto the decoded image and into the uniform block that the shader
-/// actually reads.
-fn six_d() -> BaseCurve {
-    let curve = dr_decode::base_curve::for_body("Canon", "EOS 6D");
-    assert!(
-        !curve.is_identity(),
-        "the shipped database must have a curve for the EOS 6D"
-    );
-    curve
-}
-
-#[test]
-fn a_profiled_body_renders_brighter_midtones_than_a_flat_one() {
-    // **The whole requirement, in one assertion.** A linear midtone renders
-    // roughly half a stop dark, which is the flat, lifeless look FR-DEV-3e
-    // exists to get away from. If the curve did not reach the shader — wrong
-    // slot, wrong flag, wrong stage — this is the only test that would fail.
-    let Some(ctx) = ctx() else {
-        eprintln!("skipping: no GPU adapter");
-        return;
-    };
-
-    // 13% of full scale: roughly where a camera places middle grey, leaving
-    // about two and a half stops of highlight headroom above it.
-    let level = (0.13 * 65535.0) as u16;
-    let flat = rendered_level(&ctx, level, BaseCurve::IDENTITY);
-    let profiled = rendered_level(&ctx, level, six_d());
-
-    assert!(
-        profiled > flat + 8,
-        "the profile lifted middle grey from {flat} only to {profiled}"
-    );
-}
-
-#[test]
-fn the_curve_leaves_black_black_and_white_white() {
-    // A base curve renders the range between the endpoints; it must not move
-    // the endpoints themselves. A curve that lifted black would put a grey
-    // veil over every night photograph, and one that pulled white down would
-    // make a correctly exposed frame look underexposed.
-    let Some(ctx) = ctx() else {
-        eprintln!("skipping: no GPU adapter");
-        return;
-    };
-
-    let curve = six_d();
-    assert_eq!(rendered_level(&ctx, 0, curve), 0, "black moved");
-    assert_eq!(rendered_level(&ctx, u16::MAX, curve), 255, "white moved");
-}
-
-#[test]
-fn an_unprofiled_body_renders_exactly_as_it_did_before_profiles_existed() {
-    // The graceful fallback, asserted as a number rather than as a promise.
-    // With no curve the pipeline must still be a pass-through: black level
-    // out, white level in, sRGB encoding on the way to the screen and nothing
-    // else. "Never worse than today" is the one property this change was not
-    // allowed to trade away, and the way it would break is silently — a flag
-    // read from the wrong component would apply a curve nobody asked for.
-    let Some(ctx) = ctx() else {
-        eprintln!("skipping: no GPU adapter");
-        return;
-    };
-
-    for level in [0u16, 4_000, 8_520, 32_768, 60_000, u16::MAX] {
-        let scene = f32::from(level) / f32::from(u16::MAX);
-        let expected = (dr_types::Transfer::Srgb.encode(scene) * 255.0).round() as i32;
-        let got = i32::from(rendered_level(&ctx, level, BaseCurve::IDENTITY));
-        // Two 8-bit steps: the texture holding the demosaiced frame is
-        // `Rgba16Float`, so a value round-trips through eleven mantissa bits
-        // before it is encoded. That is well under one step at any level, and
-        // the tolerance is for the rounding either side of it rather than for
-        // the transform being approximate.
-        assert!(
-            (got - expected).abs() <= 2,
-            "raw {level} rendered as {got}, expected about {expected}"
-        );
-    }
-}
-
-#[test]
-fn the_curve_is_monotone_through_the_whole_range() {
-    // The property the spline's tangent limiting exists to guarantee, checked
-    // where it actually matters: on the device, through the real uniform
-    // packing. A curve that dipped anywhere would put a dark band across a
-    // smooth gradient — a sky, most visibly — and it would read as a
-    // rendering fault rather than as a bad profile.
-    let Some(ctx) = ctx() else {
-        eprintln!("skipping: no GPU adapter");
-        return;
-    };
-
-    let curve = six_d();
-    let mut previous = 0u8;
-    for step in 0..=16u32 {
-        let level = (step * 65535 / 16) as u16;
-        let value = rendered_level(&ctx, level, curve);
-        assert!(
-            value >= previous,
-            "the curve fell from {previous} to {value} at raw level {level}"
-        );
-        previous = value;
-    }
-}

core/dr-gpu/tests/capture_sharpen.rs

@@ -87,8 +87,7 @@ fn sharpened(amount: f32, radius: f32, threshold: f32) -> EditGraph {
 fn render(pass: &mut AdjustPass, graph: &EditGraph, source: &DemosaicedImage, out: u32) -> Vec<u8> {
     let shader = graph.compose_for(ColourSpace::Srgb);
     let scale = graph.render_scale(source.size(), (out, out));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     let key = graph.invalidation().through(Affects::Colour);
     pass.render_detailed(source, &shader, out, out, None, &detail, key)
         .expect("render");
@@ -413,7 +412,7 @@ fn dragging_the_amount_recompiles_nothing_and_reallocates_nothing() {
     let pipelines = pass.cached_detail_pipelines();
     let allocations = pass.detail_allocations();
     assert_eq!(pipelines, 2, "one per axis of the separable mask");
-    assert_eq!(allocations, 2, "the colour result, and one hand-off");
+    assert_eq!(allocations, 3, "the colour result, and the ping-pong pair");
     assert_eq!(pass.detail_dispatches(), 2);
     assert_eq!(pass.colour_dispatches(), 1);
 
@@ -453,13 +452,12 @@ fn dragging_the_amount_recompiles_nothing_and_reallocates_nothing() {
 
 #[test]
 fn a_render_too_coarse_for_the_radius_still_reaches_the_screen() {
-    // The failure mode that the pass-through exists to prevent, proved on a
-    // device rather than argued about. With the radius finer than a render
-    // pixel the operation declines to sharpen — but it is still active, so the
-    // fused pass has already been composed to hand on unclipped linear values,
-    // and something must still perform the output transform. An empty chain
-    // here would not be a soft preview: it would be a hard error out of
-    // `render_detailed`, on the most ordinary develop view there is.
+    // Proved on a device rather than argued about. With the radius finer than
+    // a render pixel the operation declines to sharpen — but it is still
+    // active, so the fused pass has already been composed to hand on
+    // unclipped linear values, and something must still perform the output
+    // transform. Since D19 that is the view pass, whatever the chain holds:
+    // the chain is empty and the frame is still whole.
     let Some(ctx) = ctx() else { return };
     const SOURCE: u32 = 128;
     const RENDER: u32 = 32; // a quarter scale, as a fit view of a large frame
@@ -471,7 +469,16 @@ fn a_render_too_coarse_for_the_radius_still_reaches_the_screen() {
 
     let mut pass = AdjustPass::new(&ctx);
     let sharp = render(&mut pass, &graph, &source, RENDER);
-    assert_eq!(pass.detail_dispatches(), 1, "one pass, and it only encodes");
+    assert_eq!(
+        pass.detail_dispatches(),
+        0,
+        "nothing to sharpen at this scale"
+    );
+    assert_eq!(
+        pass.view_dispatches(),
+        1,
+        "and the view pass finishes the frame"
+    );
 
     // And what reaches the screen is the unsharpened picture, not a black
     // frame, a linear one, or a guess.

core/dr-gpu/tests/detail_instances.rs

@@ -38,15 +38,17 @@ fn grey(ctx: &GpuContext) -> DemosaicedImage {
     DemosaicedImage::from_rgba8(ctx, &data, SIZE, SIZE).expect("upload")
 }
 
-/// A pass that sums the instance list into the red channel and writes the
-/// output. Deliberately trivial: the value on screen is then a direct readout
-/// of what arrived in the buffer.
+/// A pass that sums the instance list into the red channel and writes a
+/// linear intermediate, which the view pass then encodes (D19). Deliberately
+/// trivial: the value on screen is then a direct readout of what arrived in the
+/// buffer, through the sRGB encode — the source is an 8-bit upload, so the
+/// view transform is skipped for it and the encode is the only thing between.
 fn summing_pass(storage: Vec<[f32; 4]>, structure: u64) -> ComposedDetailPass {
     let source = "
 @group(0) @binding(0) var source: texture_2d<f32>;
 struct Params { detail_base: vec4<f32> }
 @group(0) @binding(1) var<uniform> u: Params;
-@group(0) @binding(2) var output: texture_storage_2d<rgba8unorm, write>;
+@group(0) @binding(2) var output: texture_storage_2d<rgba16float, write>;
 @group(0) @binding(3) var<storage, read> instances: array<vec4<f32>>;
 
 @compute @workgroup_size(8, 8, 1)
@@ -61,7 +63,7 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {
     for (var i = 0u; i < n; i = i + 1u) {
         total = total + instances[i].x * f32(i + 1u);
     }
-    textureStore(output, vec2<i32>(gid.xy), vec4<f32>(total, f32(n) / 255.0, 0.0, 1.0));
+    textureStore(output, vec2<i32>(gid.xy), vec4<f32>(total, f32(n) * 0.1, 0.0, 1.0));
 }
 "
     .to_string();
@@ -73,13 +75,17 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {
         uniforms: vec![SIZE as f32, SIZE as f32, 1.0, 0.0],
         storage,
         radius: 0,
-        writes_output: true,
         // Any distinct number: the hash is a cache key, and these tests are
         // what decide whether two chains share a pipeline.
         structure_hash: structure,
     }
 }
 
+/// A linear value as the view pass leaves it in the 8-bit output.
+fn encoded(linear: f32) -> u8 {
+    (dr_types::Transfer::Srgb.encode(linear) * 255.0).round() as u8
+}
+
 fn render(pass: &mut AdjustPass, source: &DemosaicedImage, chain: &ComposedDetail) -> Vec<u8> {
     // The fused half has to be composed knowing a detail stage follows it, or
     // it encodes its own output and the chain would quantise twice — a mismatch
@@ -118,12 +124,15 @@ fn a_pass_reads_the_list_it_was_given() {
     let pixels = render(&mut pass, &source, &chain);
     let (red, green) = (pixels[0], pixels[1]);
 
-    // 0.05·1 + 0.1·2 = 0.25, written straight to an rgba8 target.
+    // 0.05·1 + 0.1·2 = 0.25.
     assert!(
-        red.abs_diff((0.25 * 255.0) as u8) <= 1,
+        red.abs_diff(encoded(0.25)) <= 1,
         "the shader summed {red}, not the list it was handed"
     );
-    assert_eq!(green, 2, "arrayLength saw both entries");
+    assert!(
+        green.abs_diff(encoded(0.2)) <= 1,
+        "arrayLength saw both entries"
+    );
 }
 
 /// A convolution declares no list and must still run: it is bound to the
@@ -142,7 +151,10 @@ fn a_pass_with_no_list_still_runs() {
 
     let pixels = render(&mut pass, &source, &chain);
     assert_eq!(pixels[0], 0, "the placeholder is zeroed");
-    assert_eq!(pixels[1], 1, "and is exactly one element long");
+    assert!(
+        pixels[1].abs_diff(encoded(0.1)) <= 1,
+        "and is exactly one element long"
+    );
 }
 
 /// The property that makes placing the tenth spot as cheap as moving a slider:

core/dr-gpu/tests/detail_stage.rs

@@ -101,8 +101,7 @@ fn render(
     let _ = ctx;
     let shader = graph.compose_for(ColourSpace::Srgb);
     let scale = graph.render_scale(source.size(), (out, out));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     let key = graph.invalidation().through(Affects::Colour);
     pass.render_detailed(source, &shader, out, out, None, &detail, key)
         .expect("render");
@@ -301,7 +300,7 @@ fn dragging_a_slider_recompiles_nothing_and_reallocates_nothing() {
     let pipelines = pass.cached_detail_pipelines();
     let allocations = pass.detail_allocations();
     assert_eq!(pipelines, 2, "one per pass of the separable blur");
-    assert_eq!(allocations, 2, "the colour result, and one hand-off");
+    assert_eq!(allocations, 3, "the colour result, and the ping-pong pair");
 
     for radius in [0.06, 0.07, 0.08, 0.09] {
         graph.set_param(PROBE, RADIUS, radius);
@@ -403,8 +402,7 @@ fn an_empty_chain_falls_through_to_the_ordinary_render() {
 
     let shader = graph.compose_for(ColourSpace::Srgb);
     let scale = graph.render_scale((SIZE, SIZE), (SIZE, SIZE));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     assert!(detail.is_empty());
 
     pass.render_detailed(&source, &shader, SIZE, SIZE, None, &detail, 0)

core/dr-gpu/tests/film_sim.rs

@@ -15,7 +15,7 @@
 //! model is checked against the reference, and the shader is checked against
 //! the CPU model.
 
-use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
+use dr_decode::{CfaPattern, CropRect, RawImage};
 use dr_film::bake::{bake, Recipe, Settings};
 use dr_gpu::{AdjustPass, Demosaicer, GpuContext, LabelField, MaskPass};
 use dr_pipeline::mask::{MaskLayer, MaskSource};
@@ -48,7 +48,6 @@ fn flat_raw(level: u16) -> RawImage {
         // Off deliberately: a film replaces the camera's rendering, and
         // leaving a curve here would test the suppression rather than the
         // film. `dr-pipeline` asserts the suppression on the generated source.
-        base_curve: BaseCurve::IDENTITY,
         samples_per_pixel: 1,
         profile: None,
         make: String::new(),

core/dr-gpu/tests/hot_pixels.rs

@@ -6,7 +6,7 @@
 //! anything: the repair happens on the mosaic, and what a photographer would
 //! see of a defect it missed is the coloured cross the demosaic makes of it.
 
-use dr_decode::{BaseCurve, CfaPattern, CropRect, RawImage};
+use dr_decode::{CfaPattern, CropRect, RawImage};
 use dr_gpu::{AdjustPass, Demosaicer, GpuContext};
 use dr_pipeline::EditGraph;
 
@@ -32,7 +32,6 @@ fn frame(pattern: CfaPattern, level: u16, set: &[(u32, u32, u16)]) -> RawImage {
         white_level: WHITE,
         wb_coeffs: [1.0, 1.0, 1.0, 1.0],
         color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
-        base_curve: BaseCurve::IDENTITY,
         samples_per_pixel: 1,
         profile: None,
         make: String::new(),

core/dr-gpu/tests/local_contrast.rs

@@ -109,8 +109,7 @@ fn row_rgb(pixels: &[u8], size: u32, y: u32) -> Vec<[u8; 3]> {
 fn render(pass: &mut AdjustPass, graph: &EditGraph, source: &DemosaicedImage, out: u32) -> Vec<u8> {
     let shader = graph.compose_for(ColourSpace::Srgb);
     let scale = graph.render_scale(source.size(), (out, out));
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     let key = graph.invalidation().through(Affects::Colour);
     pass.render_detailed(source, &shader, out, out, None, &detail, key)
         .expect("render");
@@ -683,28 +682,21 @@ fn texture_contributes_nothing_where_its_scale_does_not_exist() {
     // `render_masked`, and was rejected for handing a linear-working shader
     // to the plain path — so texture alone on a thumbnail did not render.
     //
-    // The seam was closed where that note said it would have to be, at the
-    // composition boundary: `compose_detail` now emits a bodyless
-    // `detail/resolve` pass in exactly this case, which reads only the pixel
-    // it writes and performs the output transform the fused pass declined to
-    // do. So the chain is no longer empty — it carries precisely the one pass
-    // that finishes the render and no kernel at all, which is the honest
-    // description of "a two-pixel surface structure is not present in a
-    // 128-pixel rendering".
+    // The seam was closed at the composition boundary, and closed again,
+    // more simply, by D19: no detail pass encodes any more, the fused pass's
+    // view pass performs the output transform whatever the chain holds, and
+    // so the empty chain is a whole render. That is the honest description of
+    // "a two-pixel surface structure is not present in a 128-pixel
+    // rendering".
     let scale = graph.render_scale(source.size(), (128, 128));
-    let composed =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
-    assert_eq!(
-        composed.len(),
-        1,
-        "the chain must carry the resolve pass and nothing else"
-    );
-    assert_eq!(composed.passes[0].label, "detail/resolve");
-    assert_eq!(
-        composed.radius(),
-        0,
+    let composed = graph.compose_detail(scale.full_size(), scale.render_size());
+    assert!(
+        composed.is_empty(),
         "texture claimed a kernel it cannot draw"
     );
+    let mut pass = AdjustPass::new(&ctx);
+    render(&mut pass, &graph, &source, 128);
+    assert_eq!(pass.view_dispatches(), 1, "the view pass still finishes it");
 
     // With clarity on as well the edit is renderable again, and the dispatch
     // count says what the assertion above says: two passes, not four. Texture

core/dr-gpu/tests/noise_reduction.rs

@@ -73,8 +73,7 @@ fn render_at(
     scale: RenderScale,
 ) -> Vec<u8> {
     let shader = graph.compose_for(ColourSpace::Srgb);
-    let detail =
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb);
+    let detail = graph.compose_detail(scale.full_size(), scale.render_size());
     let key = graph.invalidation().through(Affects::Colour);
     pass.render_detailed(source, &shader, out.0, out.1, None, &detail, key)
         .expect("render");

core/dr-gpu/tests/scene_referred.rs

@@ -0,0 +1,196 @@
+//! TRACES: FR-DEV-2 | FR-DEV-3j
+//! Scene-referred until the view transform (D19, ARCH §6.14), on a device.
+//!
+//! The rule is about every operation between the camera matrix and the view
+//! transform, so this runs each of them over a ramp that reaches sixteen
+//! times sensor saturation and asserts the two things a clip or an early
+//! encode would break: the output still increases with the input, and values
+//! above 1.0 still differ from one another.
+//!
+//! A clip above 1.0 cannot be seen through an 8-bit display encode on its
+//! own, so each operation is wrapped: a gain of sixteen ahead of it puts the
+//! ramp into the range the rule is about, a gain of one sixty-fourth after it
+//! brings the result back under 1.0 — with two stops to spare, for the
+//! operations that brighten — and an identity in the view transform's
+//! place stops the sigmoid compressing what is being measured. A fragment
+//! that clamps, or encodes and decodes through a clamped range, flattens the
+//! top of the ramp, and the last few steps come out equal.
+//!
+//! The view stage and the detail stage are excluded. The view transform and
+//! film simulation clip into a display range because that is their job, and
+//! a neighbourhood operation is a pass of its own that a flat frame cannot
+//! exercise.
+
+use std::sync::Arc;
+
+use dr_decode::{CfaPattern, CropRect, RawImage};
+use dr_gpu::{AdjustPass, Demosaicer, GpuContext};
+use dr_pipeline::descriptor::{Attribute, LocalizedKey, OpDescriptor, OpId, ParamId, ParamKind};
+use dr_pipeline::operation::{Operation, Stage, Uniform};
+
+const SIZE: u32 = 16;
+
+fn ctx() -> Option<GpuContext> {
+    pollster::block_on(GpuContext::new_headless()).ok()
+}
+
+/// A gain, as a scene-stage operation, or an identity in the view stage.
+struct Probe {
+    id: &'static str,
+    gain: f32,
+    stage: Stage,
+}
+
+impl Operation for Probe {
+    fn descriptor(&self) -> Arc<OpDescriptor> {
+        Arc::new(OpDescriptor {
+            id: OpId(self.id),
+            label: LocalizedKey(self.id),
+            params: Vec::new(),
+            attributes: vec![Attribute::Tone],
+        })
+    }
+    fn set_param(&mut self, _: ParamId, _: f32) {}
+    fn param(&self, _: ParamId) -> f32 {
+        0.0
+    }
+    fn is_active(&self) -> bool {
+        true
+    }
+    fn stage(&self) -> Stage {
+        self.stage
+    }
+    /// The identity view claims the view transform's place: while it is
+    /// active the composer emits it rather than the sigmoid.
+    fn renders(&self) -> bool {
+        self.stage == Stage::View
+    }
+    fn wgsl_body(&self) -> String {
+        "c = c * gain;".into()
+    }
+    fn uniforms(&self) -> Vec<Uniform> {
+        vec![Uniform {
+            name: "gain",
+            value: self.gain,
+        }]
+    }
+}
+
+fn probe(id: &'static str, gain: f32, stage: Stage) -> Box<dyn Operation> {
+    Box::new(Probe { id, gain, stage })
+}
+
+/// A flat frame at `level` of sensor saturation, identity matrix, neutral
+/// balance.
+fn flat(ctx: &GpuContext, level: f32) -> dr_gpu::DemosaicedImage {
+    let raw = RawImage {
+        width: SIZE,
+        height: SIZE,
+        data: vec![(level * f32::from(u16::MAX)).round() as u16; (SIZE * SIZE) as usize],
+        cfa_pattern: CfaPattern::Rggb,
+        black_level: [0; 4],
+        white_level: u16::MAX,
+        wb_coeffs: [1.0, 1.0, 1.0, 1.0],
+        color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+        samples_per_pixel: 1,
+        profile: None,
+        make: String::new(),
+        model: String::new(),
+        crop: CropRect {
+            x: 0,
+            y: 0,
+            width: SIZE,
+            height: SIZE,
+        },
+    };
+    Demosaicer::new(ctx)
+        .expect("demosaicer")
+        .run(&raw)
+        .expect("demosaic")
+}
+
+/// Every parameter moved off its default, a third of the way toward its
+/// maximum — or toward its minimum where the default is the maximum.
+///
+/// The tone curve is the exception, because its neutral is a relationship:
+/// its parameters are point coordinates, and moving every x and y the same
+/// fraction leaves the points on the diagonal. It gets a lifted midpoint on
+/// the master and on the red curve instead — the two helpers that clamped.
+fn non_neutral(op: &mut dyn Operation) {
+    use dr_pipeline::ops::curve::{coordinate, Axis, Channel};
+    if op.descriptor().id == dr_pipeline::ops::curve::ID {
+        op.set_param(coordinate(Channel::Master, 2, Axis::Y), 0.65);
+        op.set_param(coordinate(Channel::Red, 2, Axis::Y), 0.6);
+        return;
+    }
+    for p in &op.descriptor().params {
+        if let ParamKind::Scalar { min, max, .. } = p.kind {
+            let toward = if p.default < max { max } else { min };
+            op.set_param(p.id, p.default + (toward - p.default) / 3.0);
+        }
+    }
+}
+
+/// The ramp, as scene values after the sixteenfold gain: 0.4 to 16.
+///
+/// Kept below 1.0 at the sensor, and away from its last 1.5%, because the
+/// prologue's highlight desaturation fades a photosite toward neutral there —
+/// a sensor fact, not an operation's, and flat grey is neutral already.
+const LEVELS: [f32; 8] = [0.025, 0.05, 0.1, 0.2, 0.4, 0.6, 0.8, 0.95];
+
+#[test]
+fn scene_referred_until_the_view() {
+    // TRACES: FR-DEV-2 | FR-DEV-3j
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+    let sources: Vec<_> = LEVELS.iter().map(|&l| flat(&ctx, l)).collect();
+    let mut adjust = AdjustPass::new(&ctx);
+
+    let mut checked = 0;
+    for mut op in dr_pipeline::ops::chain() {
+        if op.detail().is_some() || op.stage() == Stage::View {
+            continue;
+        }
+        let id = op.descriptor().id.0;
+        non_neutral(op.as_mut());
+        assert!(op.is_active(), "{id}: the edit above left it neutral");
+        let ops = vec![
+            probe("probe_up", 16.0, Stage::Scene),
+            op,
+            probe("probe_down", 1.0 / 64.0, Stage::Scene),
+            probe("probe_view", 1.0, Stage::View),
+        ];
+        let shader = dr_pipeline::compose(&ops);
+        assert!(
+            !shader.source.contains("view_sigmoid"),
+            "the identity must take the view transform's place"
+        );
+
+        let mut out = Vec::new();
+        for source in &sources {
+            adjust.render(source, &shader, SIZE, SIZE).expect("render");
+            let (pixels, _, _) = adjust.export_pixels().expect("readback");
+            let centre = (((SIZE / 2) * SIZE + SIZE / 2) * 4) as usize;
+            out.push([pixels[centre], pixels[centre + 1], pixels[centre + 2]]);
+        }
+
+        for channel in 0..3 {
+            let ramp: Vec<u8> = out.iter().map(|p| p[channel]).collect();
+            assert!(
+                ramp.windows(2).all(|w| w[1] >= w[0]),
+                "{id} is not monotone in channel {channel}: {ramp:?}"
+            );
+            // The top three levels are scene 9.6, 12.8 and 15.2: all far
+            // above 1.0, and a clip anywhere below them makes them equal.
+            let top = &ramp[LEVELS.len() - 3..];
+            assert!(
+                top[0] < top[1] && top[1] < top[2],
+                "{id} flattens values above 1.0 in channel {channel}: {ramp:?}"
+            );
+        }
+        checked += 1;
+    }
+    assert!(checked >= 10, "only {checked} operations were checked");
+}

core/dr-gpu/tests/source_window.rs

@@ -0,0 +1,208 @@
+//! TRACES: FR-DSP-2 | NFR-RES-2
+//! A photograph larger than one texture, developed from windows of it.
+//!
+//! The claim under test is that the window is invisible: a frame rendered a
+//! tile at a time, each tile from only the part of the source it reads, is the
+//! frame rendered whole. `dr-pipeline` can check the plan — the tiles cover
+//! the frame once, each is grown by the reach — but not that the shader's
+//! mapping into a window lands on the texel the whole texture would have
+//! given, which only a device answers.
+//!
+//! The frames here are small and the "device limit" is a number passed in,
+//! so the tiling is exercised on any adapter, including one whose real limit
+//! a test image could never approach.
+
+use dr_decode::{CfaPattern, CropRect, RawImage};
+use dr_gpu::{AdjustPass, DemosaicedImage, GpuContext};
+use dr_pipeline::descriptor::{OpId, ParamId};
+use dr_pipeline::framing::ANGLE;
+use dr_pipeline::{tiles, Affects, EditGraph};
+use dr_types::ColourSpace;
+
+fn ctx() -> Option<GpuContext> {
+    match pollster::block_on(GpuContext::new_headless()) {
+        Ok(c) => Some(c),
+        Err(e) => {
+            eprintln!("skipping: no GPU adapter ({e})");
+            None
+        }
+    }
+}
+
+/// A linear RGB frame with detail at every scale: a slow gradient for the
+/// tone controls and a hash for the kernels, so a tile that read one pixel
+/// off would show.
+fn linear_frame(w: u32, h: u32, noise: bool) -> RawImage {
+    let mut data = Vec::with_capacity((w * h * 3) as usize);
+    for y in 0..h {
+        for x in 0..w {
+            let base = 4000.0 + 30000.0 * (x as f32 / w as f32) + 12000.0 * (y as f32 / h as f32);
+            let hash = if noise {
+                ((x.wrapping_mul(73_856_093) ^ y.wrapping_mul(19_349_663)) % 8000) as f32
+            } else {
+                0.0
+            };
+            for c in 0..3 {
+                data.push((base * (0.7 + 0.15 * c as f32) + hash) as u16);
+            }
+        }
+    }
+    RawImage {
+        width: w,
+        height: h,
+        data,
+        cfa_pattern: CfaPattern::Unknown,
+        black_level: [512; 4],
+        white_level: 65535,
+        wb_coeffs: [2.0, 1.0, 1.5, 1.0],
+        color_matrix: Some([1.6, -0.5, -0.1, -0.2, 1.4, -0.2, 0.0, -0.4, 1.4]),
+        samples_per_pixel: 3,
+        profile: None,
+        make: String::new(),
+        model: String::new(),
+        crop: CropRect {
+            x: 0,
+            y: 0,
+            width: w,
+            height: h,
+        },
+    }
+}
+
+/// Render `graph` over `source` at `size` and read it back.
+fn render(
+    pass: &mut AdjustPass,
+    graph: &EditGraph,
+    source: &DemosaicedImage,
+    size: (u32, u32),
+) -> Vec<u8> {
+    let shader = graph.compose_for(ColourSpace::Srgb);
+    let detail = graph.compose_detail(source.size(), size);
+    let key = graph.invalidation().through(Affects::Colour);
+    pass.render_detailed(source, &shader, size.0, size.1, None, &detail, key)
+        .expect("render");
+    pass.export_pixels().expect("readback").0
+}
+
+/// The frame at full resolution, a tile at a time, each from its own window.
+fn render_tiled(
+    ctx: &GpuContext,
+    pass: &mut AdjustPass,
+    graph: &mut EditGraph,
+    raw: &RawImage,
+    max_edge: u32,
+) -> (Vec<u8>, usize) {
+    let frame = (raw.crop.width, raw.crop.height);
+    let out = graph.output_size(frame.0, frame.1);
+    let reach = graph.compose_detail(frame, out).reach();
+    let plan = tiles::plan(out, max_edge, reach).expect("a plan");
+    let mut pixels = vec![0u8; (out.0 * out.1 * 4) as usize];
+    for t in &plan {
+        graph.framing_mut().set_view(t.view(out));
+        let r = graph.source_region(frame, 0);
+        let x0 = (r.x * frame.0 as f32).floor() as u32;
+        let y0 = (r.y * frame.1 as f32).floor() as u32;
+        let x1 = ((r.x + r.width) * frame.0 as f32).ceil() as u32;
+        let y1 = ((r.y + r.height) * frame.1 as f32).ceil() as u32;
+        let window = DemosaicedImage::linear_rgb16_window(ctx, raw, [x0, y0, x1 - x0, y1 - y0], 1)
+            .expect("window");
+        assert_eq!(window.size(), frame, "a window measures the frame");
+        let tile = render(pass, graph, &window, (t.grown[2], t.grown[3]));
+        let (ox, oy) = t.keep_offset();
+        for row in 0..t.keep[3] {
+            let src = (((oy + row) * t.grown[2] + ox) * 4) as usize;
+            let dst = (((t.keep[1] + row) * out.0 + t.keep[0]) * 4) as usize;
+            let n = (t.keep[2] * 4) as usize;
+            pixels[dst..dst + n].copy_from_slice(&tile[src..src + n]);
+        }
+    }
+    graph
+        .framing_mut()
+        .set_view(dr_pipeline::CropRect::default());
+    (pixels, plan.len())
+}
+
+fn largest_difference(a: &[u8], b: &[u8]) -> u8 {
+    a.iter()
+        .zip(b)
+        .map(|(x, y)| x.abs_diff(*y))
+        .max()
+        .unwrap_or(0)
+}
+
+#[test]
+fn tiles_of_windows_are_the_whole_frame() {
+    // Point operations only, unrotated: every output pixel is an exact load
+    // of one source texel, so the tiled frame has to be the whole one to
+    // the bit.
+    let Some(ctx) = ctx() else { return };
+    let raw = linear_frame(200, 120, true);
+    let mut graph = EditGraph::default_chain();
+    graph.set_param(OpId("exposure"), ParamId("exposure"), 0.7);
+    let mut pass = AdjustPass::new(&ctx);
+
+    let whole = DemosaicedImage::from_linear_rgb16(&ctx, &raw).unwrap();
+    assert!(whole.is_whole());
+    let reference = render(&mut pass, &graph, &whole, (200, 120));
+    let (tiled, n) = render_tiled(&ctx, &mut pass, &mut graph, &raw, 64);
+    assert!(n > 4, "the frame should have been cut, got {n} tile(s)");
+    assert_eq!(largest_difference(&reference, &tiled), 0);
+}
+
+#[test]
+fn a_straightened_frame_with_clarity_tiles_without_seams() {
+    // The hard case: a free angle samples between texels, and clarity reads
+    // a wide neighbourhood on a reduced grid. The halo and the grid
+    // alignment are what keep the tiles' edges out of the picture; a code
+    // value of rounding is all that may differ.
+    let Some(ctx) = ctx() else { return };
+    let raw = linear_frame(320, 208, true);
+    let mut graph = EditGraph::default_chain();
+    graph.set_param(OpId("clarity"), ParamId("amount"), 60.0);
+    graph.framing_mut().set_param(ANGLE, 3.0);
+    let mut pass = AdjustPass::new(&ctx);
+
+    let whole = DemosaicedImage::from_linear_rgb16(&ctx, &raw).unwrap();
+    let out = graph.output_size(320, 208);
+    let reference = render(&mut pass, &graph, &whole, out);
+    let (tiled, n) = render_tiled(&ctx, &mut pass, &mut graph, &raw, 160);
+    assert!(n > 1, "the frame should have been cut, got {n} tile(s)");
+    let worst = largest_difference(&reference, &tiled);
+    assert!(
+        worst <= 1,
+        "tiles differ from the whole frame by {worst} code values"
+    );
+}
+
+#[test]
+fn a_reduced_copy_stands_for_the_whole_frame() {
+    // The canvas at fit renders from a copy reduced to fit the device. It
+    // must measure the photograph, not itself, or a crop drawn on it lands
+    // somewhere else in the export; and rendered small it must look like the
+    // full frame rendered small.
+    let Some(ctx) = ctx() else { return };
+    let raw = linear_frame(400, 240, false);
+    let mut graph = EditGraph::default_chain();
+    graph.set_crop(dr_pipeline::CropRect {
+        x: 0.25,
+        y: 0.1,
+        width: 0.5,
+        height: 0.6,
+    });
+    let mut pass = AdjustPass::new(&ctx);
+
+    let whole = DemosaicedImage::from_linear_rgb16(&ctx, &raw).unwrap();
+    let reduced = DemosaicedImage::linear_rgb16_window(&ctx, &raw, [0, 0, 400, 240], 3).unwrap();
+    assert_eq!(reduced.size(), (400, 240));
+    assert_eq!(reduced.texture_size(), (134, 80));
+    assert!(!reduced.is_whole());
+
+    let size = (50, 36);
+    let a = render(&mut pass, &graph, &whole, size);
+    let b = render(&mut pass, &graph, &reduced, size);
+    let worst = largest_difference(&a, &b);
+    assert!(
+        worst <= 3,
+        "the reduced copy renders {worst} code values away"
+    );
+}

core/dr-gpu/tests/spot_removal.rs

@@ -72,7 +72,7 @@ fn render(pass: &mut AdjustPass, graph: &EditGraph, source: &DemosaicedImage, ou
     let shader = graph.compose_for(ColourSpace::Srgb);
     let (w, h) = graph.output_size(source.size().0, source.size().1);
     let (w, h) = (w.min(out), h.min(out));
-    let detail = graph.compose_detail_for(source.size(), (w, h), ColourSpace::Srgb);
+    let detail = graph.compose_detail(source.size(), (w, h));
     let key = graph.invalidation().through(Affects::Colour);
     pass.render_detailed(source, &shader, w, h, None, &detail, key)
         .expect("render");

core/dr-gpu/tests/view_transform.rs

@@ -0,0 +1,178 @@
+//! TRACES: FR-DEV-3j | FR-DEV-2
+//! The view transform, end to end on a device.
+//!
+//! `dr-pipeline` checks the curve on the CPU and that the composer emits it in
+//! the right place. Neither would notice a shader that disagreed with the CPU
+//! reference, or a clamp somewhere upstream that made two highlights the same
+//! number before the curve ever saw them — which is exactly what the retired
+//! base curve did, and why D19 exists. So this renders real pixels.
+
+use dr_decode::{CfaPattern, CropRect, RawImage};
+use dr_gpu::{AdjustPass, Demosaicer, GpuContext};
+use dr_pipeline::view::Sigmoid;
+use dr_pipeline::EditGraph;
+
+const SIZE: u32 = 16;
+
+fn ctx() -> Option<GpuContext> {
+    pollster::block_on(GpuContext::new_headless()).ok()
+}
+
+/// A flat RGGB frame at `level` out of 65535, with an identity matrix and a
+/// neutral balance, so the only things that move a pixel are the edit and the
+/// view transform.
+fn flat_raw(level: u16) -> RawImage {
+    RawImage {
+        width: SIZE,
+        height: SIZE,
+        data: vec![level; (SIZE * SIZE) as usize],
+        cfa_pattern: CfaPattern::Rggb,
+        black_level: [0; 4],
+        white_level: u16::MAX,
+        wb_coeffs: [1.0, 1.0, 1.0, 1.0],
+        color_matrix: Some([1.0, 0.0, 0.0, 0.0, 1.0, 0.0, 0.0, 0.0, 1.0]),
+        samples_per_pixel: 1,
+        profile: None,
+        make: String::new(),
+        model: String::new(),
+        crop: CropRect {
+            x: 0,
+            y: 0,
+            width: SIZE,
+            height: SIZE,
+        },
+    }
+}
+
+/// Render `graph` over a flat frame and return the centre pixel's red.
+///
+/// The centre rather than a corner: a demosaic has to invent its edges.
+fn rendered(ctx: &GpuContext, level: u16, graph: &EditGraph) -> u8 {
+    let source = Demosaicer::new(ctx)
+        .expect("demosaicer")
+        .run(&flat_raw(level))
+        .expect("demosaic");
+    let shader = graph.compose();
+    let mut adjust = AdjustPass::new(ctx);
+    adjust.render(&source, &shader, SIZE, SIZE).expect("render");
+    let (pixels, _, _) = adjust.export_pixels().expect("readback");
+    let centre = ((SIZE / 2) * SIZE + SIZE / 2) * 4;
+    pixels[centre as usize]
+}
+
+#[test]
+fn the_shader_agrees_with_the_cpu_reference() {
+    // TRACES: FR-DEV-3j
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+    let curve = Sigmoid::default_curve();
+    let graph = EditGraph::default_chain();
+    for level in [0u16, 500, 4_000, 8_520, 32_768, 60_000, u16::MAX] {
+        let scene = f32::from(level) / f32::from(u16::MAX);
+        let display = curve.channel(scene).min(1.0);
+        let expected = (dr_types::Transfer::Srgb.encode(display) * 255.0).round() as i32;
+        let got = i32::from(rendered(&ctx, level, &graph));
+        // Two 8-bit steps, for the `Rgba16Float` intermediate and the
+        // rounding either side of the encode.
+        assert!(
+            (got - expected).abs() <= 2,
+            "raw {level} rendered as {got}, expected about {expected}"
+        );
+    }
+}
+
+#[test]
+fn highlights_above_one_stay_distinct() {
+    // TRACES: FR-DEV-2 | FR-DEV-3j
+    // The failure D19 names first. Two stops of exposure put these two
+    // frames at 1.0 and 1.5 of sensor saturation. The base curve was flat
+    // past 1.0, so both rendered as the same white; the view transform's
+    // shoulder still separates them.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+    let mut graph = EditGraph::default_chain();
+    graph.set_param(
+        dr_pipeline::ops::exposure::ID,
+        dr_pipeline::ops::exposure::EXPOSURE,
+        2.0,
+    );
+    let lower = rendered(&ctx, u16::MAX / 4, &graph);
+    let upper = rendered(&ctx, (u16::MAX / 8) * 3, &graph);
+    assert!(
+        upper > lower,
+        "scene 1.0 rendered {lower} and scene 1.5 rendered {upper}"
+    );
+    assert!(upper < 255, "scene 1.5 is below the default white point");
+}
+
+#[test]
+fn the_rendering_is_monotone_through_the_whole_range() {
+    // TRACES: FR-DEV-3j
+    // A dip anywhere puts a dark band across a smooth gradient — a sky, most
+    // visibly.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+    let graph = EditGraph::default_chain();
+    let mut last = 0u8;
+    for step in 0..=32u32 {
+        let level = (step * u32::from(u16::MAX) / 32) as u16;
+        let got = rendered(&ctx, level, &graph);
+        assert!(got >= last, "raw {level} rendered {got}, below {last}");
+        last = got;
+    }
+}
+
+/// Render `graph` over a flat frame through `render_detailed`, the path every
+/// frontend takes, and return the centre pixel's red.
+fn rendered_detailed(ctx: &GpuContext, level: u16, graph: &EditGraph) -> (u8, AdjustPass) {
+    let source = Demosaicer::new(ctx)
+        .expect("demosaicer")
+        .run(&flat_raw(level))
+        .expect("demosaic");
+    let shader = graph.compose_for(dr_types::ColourSpace::Srgb);
+    let detail = graph.compose_detail(source.size(), (SIZE, SIZE));
+    let key = graph.invalidation().through(dr_pipeline::Affects::Colour);
+    let mut adjust = AdjustPass::new(ctx);
+    adjust
+        .render_detailed(&source, &shader, SIZE, SIZE, None, &detail, key)
+        .expect("render");
+    let (pixels, _, _) = adjust.export_pixels().expect("readback");
+    let centre = ((SIZE / 2) * SIZE + SIZE / 2) * 4;
+    (pixels[centre as usize], adjust)
+}
+
+#[test]
+fn a_detail_stage_renders_through_the_view_pass_unchanged() {
+    // TRACES: FR-DEV-3j | FR-DEV-2
+    // With a detail stage the view transform is a dispatch of its own after
+    // it (D19). Sharpening a flat field changes nothing, so the same frame
+    // with and without it must render the same: the view pass read the detail
+    // stage's result, applied the view transform once, and encoded once.
+    let Some(ctx) = ctx() else {
+        eprintln!("skipping: no GPU adapter");
+        return;
+    };
+    let plain = rendered(&ctx, 8_520, &EditGraph::default_chain());
+
+    let mut sharpened = EditGraph::default_chain();
+    let id = dr_pipeline::ops::capture_sharpen::ID;
+    sharpened.set_param(id, dr_pipeline::ops::capture_sharpen::AMOUNT, 100.0);
+    sharpened.set_param(id, dr_pipeline::ops::capture_sharpen::RADIUS, 1.0);
+    let (detailed, pass) = rendered_detailed(&ctx, 8_520, &sharpened);
+
+    assert!(
+        pass.detail_dispatches() > 0,
+        "the premise: a detail stage ran"
+    );
+    assert_eq!(pass.view_dispatches(), 1);
+    assert!(
+        detailed.abs_diff(plain) <= 1,
+        "with a detail stage {detailed}, without {plain}"
+    );
+}

core/dr-pano/src/align.rs

@@ -12,6 +12,11 @@
 //!    best-connected frame; rotations chained along it.
 //! 5. Bundle adjustment over every link's inliers (`bundle`).
 //!
+//! Steps 1 and 2 are [`match_pairs`] and most of the time; 3 to 5 are
+//! [`solve`], which takes a subset of the frames. Leaving a frame out is
+//! then a solve over the pairs already measured — the same links, not a
+//! fresh RANSAC whose seeds would move with the frames' positions.
+//!
 //! What it refuses to do is guess. A frame the tree does not reach is
 //! reported by index with the reason (FR-MRG-5) and left out of the
 //! cameras; the caller decides whether a set with a hole is worth
@@ -125,13 +130,45 @@ impl Alignment {
     }
 }
 
-/// Align a set of frames from their features.
+/// Every pair of a set measured: steps 1 and 2, the expensive part, kept
+/// so that a solve over a subset reuses it.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Pairs {
+    /// Each frame's long edge, for the focal length's clamp.
+    long_edges: Vec<f64>,
+    /// Pairs with enough matches to try a geometry, whether or not it held.
+    matched: Vec<(usize, usize)>,
+    links: Vec<Link>,
+    /// Every link's inliers, in pixels, centred.
+    observations: Vec<Observation>,
+}
+
+impl Pairs {
+    /// How many frames were measured.
+    pub fn len(&self) -> usize {
+        self.long_edges.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.long_edges.is_empty()
+    }
+}
+
+/// Align a set of frames from their features: [`match_pairs`], then
+/// [`solve`] over all of them.
 ///
 /// Every `Features` must be in its own frame's pixel coordinates with the
 /// image size filled in; points are centred on the image centre here. The
 /// frames must all come from the same lens at the same focal length, which
 /// is the panorama assumption and not checked — the caller has the EXIF.
 pub fn align(frames: &[Features], opts: &AlignOptions) -> Result<Alignment, PanoError> {
+    let pairs = match_pairs(frames, opts)?;
+    solve(&pairs, &vec![true; frames.len()], opts)
+}
+
+/// Steps 1 and 2: every pair matched, and a robust homography for each
+/// pair with enough matches.
+pub fn match_pairs(frames: &[Features], opts: &AlignOptions) -> Result<Pairs, PanoError> {
     let n = frames.len();
     if n < 2 {
         return Err(PanoError::Input(
@@ -156,7 +193,7 @@ pub fn align(frames: &[Features], opts: &AlignOptions) -> Result<Alignment, Pano
     // 1 + 2: every pair.
     let mut links = Vec::new();
     let mut observations: Vec<Observation> = Vec::new();
-    let mut matched_any = vec![false; n];
+    let mut matched = Vec::new();
     let t_match = std::time::Instant::now();
     for i in 0..n {
         for j in i + 1..n {
@@ -165,8 +202,7 @@ pub fn align(frames: &[Features], opts: &AlignOptions) -> Result<Alignment, Pano
             if matches.len() < 4 {
                 continue;
             }
-            matched_any[i] = true;
-            matched_any[j] = true;
+            matched.push((i, j));
             let pairs: Vec<((f64, f64), (f64, f64))> = matches
                 .iter()
                 .map(|m| {
@@ -214,6 +250,69 @@ pub fn align(frames: &[Features], opts: &AlignOptions) -> Result<Alignment, Pano
     }
 
     log::debug!("matching and pairwise geometry in {:?}", t_match.elapsed());
+    Ok(Pairs {
+        long_edges: frames
+            .iter()
+            .map(|f| f.width.max(f.height) as f64)
+            .collect(),
+        matched,
+        links,
+        observations,
+    })
+}
+
+/// Steps 3 to 5 over the frames `keep` marks, from pairs already measured.
+///
+/// The result is indexed by the kept frames in order: its frame `k` is the
+/// `k`-th frame `keep` marks. Only pairs whose frames are both kept take
+/// part, so a frame whose only overlap was with one left out is reported
+/// as unaligned, as it would be had it never been measured with it.
+pub fn solve(pairs: &Pairs, keep: &[bool], opts: &AlignOptions) -> Result<Alignment, PanoError> {
+    if keep.len() != pairs.len() {
+        return Err(PanoError::Input(format!(
+            "{} flags for {} frames",
+            keep.len(),
+            pairs.len()
+        )));
+    }
+    // Input index to the solve's.
+    let mut slot = vec![None; keep.len()];
+    let mut n = 0usize;
+    for (k, &kept) in keep.iter().enumerate() {
+        if kept {
+            slot[k] = Some(n);
+            n += 1;
+        }
+    }
+    if n < 2 {
+        return Err(PanoError::Input(
+            "a panorama needs at least two frames".into(),
+        ));
+    }
+    let both = |i: usize, j: usize| Some((slot[i]?, slot[j]?));
+    let mut matched_any = vec![false; n];
+    for &(i, j) in &pairs.matched {
+        if let Some((i, j)) = both(i, j) {
+            matched_any[i] = true;
+            matched_any[j] = true;
+        }
+    }
+    let links: Vec<Link> = pairs
+        .links
+        .iter()
+        .filter_map(|l| {
+            let (i, j) = both(l.i, l.j)?;
+            Some(Link { i, j, ..l.clone() })
+        })
+        .collect();
+    let observations: Vec<Observation> = pairs
+        .observations
+        .iter()
+        .filter_map(|o| {
+            let (i, j) = both(o.i, o.j)?;
+            Some(Observation { i, j, ..*o })
+        })
+        .collect();
 
     // 3: the focal length.
     let mut estimates: Vec<f64> = links
@@ -221,9 +320,12 @@ pub fn align(frames: &[Features], opts: &AlignOptions) -> Result<Alignment, Pano
         .filter_map(|l| homography::focal_from_homography(&l.h))
         .filter(|f| f.is_finite() && *f > 0.0)
         .collect();
-    let longest = frames
+    let longest = pairs
+        .long_edges
         .iter()
-        .map(|f| f.width.max(f.height) as f64)
+        .zip(keep)
+        .filter(|(_, &kept)| kept)
+        .map(|(&e, _)| e)
         .fold(0.0, f64::max);
     let focal = if !estimates.is_empty() {
         estimates.sort_by(f64::total_cmp);
@@ -448,6 +550,40 @@ mod tests {
         assert!(out.rotations[..3].iter().all(Option::is_some));
     }
 
+    #[test]
+    fn a_frame_left_out_is_solved_without_measuring_again() {
+        let (frames, truth) = synthetic_sweep(6, 0.3, 1400.0, 1024, 768);
+        let opts = AlignOptions::default();
+        let pairs = match_pairs(&frames, &opts).expect("measured");
+        // The first frame left out: five cameras, indexed as the kept
+        // frames, and the links among them only.
+        let keep = [false, true, true, true, true, true];
+        let out = solve(&pairs, &keep, &opts).expect("solved");
+        assert!(out.is_complete(), "unaligned: {:?}", out.unaligned);
+        assert_eq!(out.rotations.len(), 5);
+        assert_eq!(out.links.len(), 4 + 3, "links: {}", out.links.len());
+        let root = out
+            .rotations
+            .iter()
+            .position(|r| *r == Some(Mat3::IDENTITY))
+            .unwrap();
+        for k in 0..5 {
+            let rel_truth = truth.rotations[root + 1].transpose() * truth.rotations[k + 1];
+            let err = angle_between(rel_truth, out.rotations[k].unwrap());
+            assert!(err < 2e-3, "frame {k} off by {err} rad");
+        }
+        // A frame in the middle left out splits the sweep only if nothing
+        // spans the gap; at 0.3 rad steps its neighbours still overlap.
+        let keep = [true, true, false, true, true, true];
+        let out = solve(&pairs, &keep, &opts).expect("solved");
+        assert!(out.is_complete(), "unaligned: {:?}", out.unaligned);
+        // And the whole set solved from the pairs is `align`'s answer.
+        assert_eq!(
+            solve(&pairs, &[true; 6], &opts).expect("solved"),
+            align(&frames, &opts).expect("aligned")
+        );
+    }
+
     #[test]
     fn one_frame_is_refused() {
         let (frames, _) = synthetic_sweep(1, 0.3, 1400.0, 640, 480);

core/dr-pano/src/lib.rs

@@ -22,6 +22,7 @@
 //! - [`align`] — the whole thing, from features to cameras, honest about
 //!   what it could not place.
 //! - [`projection`] — perspective, cylindrical, spherical.
+//! - [`seam`] — which frame each output pixel is taken from.
 //! - [`linalg`] — the small dense algebra all of it uses.
 //!
 //! # What it depends on
@@ -43,15 +44,17 @@ pub mod matching;
 #[cfg(feature = "xfeat")]
 pub mod migan;
 pub mod projection;
+pub mod seam;
 #[cfg(feature = "xfeat")]
 pub mod xfeat;
 
-pub use align::{align, AlignOptions, Alignment, Link, Unaligned};
+pub use align::{align, match_pairs, solve, AlignOptions, Alignment, Link, Pairs, Unaligned};
 pub use bundle::Cameras;
 pub use features::{Features, Keypoint};
 pub use fill::{fill_border, Inpainter, Observer, Params as FillParams};
 pub use image::Gray;
 pub use projection::Projection;
+pub use seam::{SeamMap, SeamOptions};
 
 #[derive(Debug, thiserror::Error)]
 pub enum PanoError {

core/dr-pano/src/seam.rs

@@ -0,0 +1,691 @@
+//! TRACES: FR-MRG-10
+//! Where each frame gives way to the next.
+//!
+//! The first merges averaged every overlap: each frame weighted by its
+//! distance from its own edge, so that across two hundred pixels one frame
+//! faded into the other. That hides an exposure step and does not hide
+//! anything that differs between the frames — parallax on a near slope, a
+//! walker, a branch in the wind — which the average draws twice, half as
+//! bright, a soft double edge at 1:1.
+//!
+//! A seam answers it the way every stitcher does: in an overlap, each output
+//! pixel is taken from *one* frame, and the line where the choice changes is
+//! put where the frames agree and the picture is smooth — through sky,
+//! along a shadow, round the walker rather than through him — and away from
+//! either frame's edge, where vignetting and the lens correction's fringe
+//! live. The blend is then narrow and only across that line.
+//!
+//! # How
+//!
+//! At proxy resolution, on the output surface, which fits (panorama.md §5:
+//! "it is a mask, not an image"):
+//!
+//! 1. Frames are laid down one at a time, each next to one already placed.
+//!    The composite so far is a label per texel and the value its owner saw.
+//! 2. Where a new frame overlaps the composite, a cost per texel: the
+//!    difference between the two (after the gains), how much detail either
+//!    has there, and how near either frame's edge it is — smoothed over a
+//!    few texels, because "agree" means locally, not at one pixel.
+//! 3. The cut is a path across the overlap, perpendicular to the line from
+//!    the composite's frames to the new one, found by dynamic programming
+//!    one row at a time: the per-column seam panorama.md §4 chose over a
+//!    graph cut because it is the GPU-friendly shape. Texels on the new
+//!    frame's side of the path become its own.
+//!
+//! What the merge reads is [`SeamMap::share`]: the fraction of a small
+//! window about a point that is labelled with a frame, tent-weighted, which
+//! is a narrow blend that follows the seam. `merge.wgsl` computes the same
+//! thing on the GPU from the same labels.
+
+use crate::bundle::Cameras;
+use crate::image::Gray;
+use crate::projection::{self, Projection};
+
+/// No frame owns this texel.
+pub const NONE: u8 = 255;
+
+/// The most frames a map can label: one less than [`NONE`].
+pub const MAX_FRAMES: usize = NONE as usize;
+
+/// Which frame each texel of the output takes its pixels from.
+#[derive(Debug, Clone, PartialEq)]
+pub struct SeamMap {
+    pub width: usize,
+    pub height: usize,
+    /// The projection scale the map was laid out at: the proxies' focal
+    /// length. Output coordinates at any other scale are this times the
+    /// ratio of the scales.
+    pub scale: f64,
+    /// Centred output coordinates, at `scale`, of texel (0, 0)'s top-left
+    /// corner.
+    pub origin: (f64, f64),
+    /// Output units per texel, at `scale`.
+    pub px: f64,
+    /// Row-major, one per texel: the frame's index, or [`NONE`].
+    pub labels: Vec<u8>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct SeamOptions {
+    /// The widest the map is laid out, in texels. Wider than the proxies'
+    /// own resolution buys nothing.
+    pub max_width: usize,
+    /// How much detail costs against disagreement: a seam through texture
+    /// shows even where the frames agree, because the blend across it
+    /// softens it.
+    pub detail: f32,
+    /// How much a frame's edge costs, and how far in from it the cost
+    /// reaches, in proxy pixels. Frame edges are where vignetting is
+    /// darkest and the lens correction ran out of sensor.
+    pub edge: f32,
+    pub edge_margin: f32,
+    /// The radius, in texels, a texel's cost looks about it for the worst
+    /// of its neighbours: at least the radius the merge blends across.
+    pub smoothing: usize,
+}
+
+impl Default for SeamOptions {
+    fn default() -> Self {
+        SeamOptions {
+            max_width: 2048,
+            detail: 0.5,
+            edge: 0.5,
+            edge_margin: 24.0,
+            smoothing: 4,
+        }
+    }
+}
+
+/// The most texels a blend reaches either side of a seam. The merge's
+/// shader loads the square of twice this per pixel per frame near a seam.
+pub const MAX_BLEND_RADIUS: f64 = 4.0;
+
+/// Cost of a texel outside the overlap: high enough that the path keeps to
+/// the overlap wherever there is one, finite so that a row with a gap in it
+/// still has an answer.
+const OUTSIDE: f32 = 1.0e3;
+
+impl SeamMap {
+    /// The map's origin and texel size in the coordinates of an output
+    /// laid out at `scale` (the full-resolution focal length, or a fraction
+    /// of it).
+    pub fn at_scale(&self, scale: f64) -> ((f64, f64), f64) {
+        let r = scale / self.scale;
+        ((self.origin.0 * r, self.origin.1 * r), self.px * r)
+    }
+
+    /// The radius, in texels, of a blend `blend_px` output pixels wide in an
+    /// output laid out at `scale`: what [`Self::share`] and the shader are
+    /// given, so that the preview and the merge blend alike.
+    pub fn blend_radius(&self, scale: f64, blend_px: f64) -> f64 {
+        let (_, px) = self.at_scale(scale);
+        (blend_px / 2.0 / px).clamp(1.0, MAX_BLEND_RADIUS)
+    }
+
+    /// The share frame `k` has of output point `(u, v)` given at `scale`:
+    /// the tent-weighted fraction of the texels within `radius` (in texels)
+    /// that it owns. `None` where no texel in reach is owned at all — the
+    /// map has nothing to say there, and the caller falls back to its
+    /// feather.
+    ///
+    /// This is the function `merge.wgsl`'s `seam_share` repeats; the two
+    /// must agree.
+    pub fn share(&self, k: usize, u: f64, v: f64, scale: f64, radius: f64) -> Option<f32> {
+        let ((ou, ov), px) = self.at_scale(scale);
+        let x = (u - ou) / px - 0.5;
+        let y = (v - ov) / px - 0.5;
+        let r = radius.max(1.0);
+        let (x0, x1) = ((x - r).ceil() as i64, (x + r).floor() as i64);
+        let (y0, y1) = ((y - r).ceil() as i64, (y + r).floor() as i64);
+        let (mut mine, mut all) = (0.0f64, 0.0f64);
+        for j in y0.max(0)..=y1.min(self.height as i64 - 1) {
+            let wy = 1.0 - (y - j as f64).abs() / r;
+            if wy <= 0.0 {
+                continue;
+            }
+            for i in x0.max(0)..=x1.min(self.width as i64 - 1) {
+                let wx = 1.0 - (x - i as f64).abs() / r;
+                if wx <= 0.0 {
+                    continue;
+                }
+                let l = self.labels[j as usize * self.width + i as usize];
+                if l == NONE {
+                    continue;
+                }
+                all += wx * wy;
+                if usize::from(l) == k {
+                    mine += wx * wy;
+                }
+            }
+        }
+        (all > 0.0).then(|| (mine / all) as f32)
+    }
+}
+
+/// One frame warped onto the map: its gain-corrected value and its distance
+/// from its own edge (in proxy pixels) per texel, NaN where it does not
+/// reach.
+struct Warped {
+    value: Vec<f32>,
+    edge: Vec<f32>,
+}
+
+/// Lay seams across the overlaps of `proxies`, aligned by `cameras` (at the
+/// proxies' scale), with `gains` the linear multipliers the merge will
+/// apply. `None` if the frames project nowhere or there are more than
+/// [`MAX_FRAMES`].
+pub fn find(
+    proxies: &[&Gray],
+    cameras: &Cameras,
+    gains: &[f32],
+    projection: Projection,
+    opts: &SeamOptions,
+) -> Option<SeamMap> {
+    let n = proxies.len();
+    if n == 0 || n > MAX_FRAMES || cameras.rotations.len() != n || gains.len() != n {
+        return None;
+    }
+    let (fw, fh) = (proxies[0].width as f64, proxies[0].height as f64);
+    let scale = cameras.focal;
+    let bounds = projection::bounds(projection, scale, cameras, (fw, fh))?;
+    let width = opts.max_width.min(bounds.width().ceil() as usize).max(1);
+    let px = bounds.width() / width as f64;
+    let height = ((bounds.height() / px).ceil() as usize).max(1);
+    let mut map = SeamMap {
+        width,
+        height,
+        scale,
+        origin: (bounds.min_u, bounds.min_v),
+        px,
+        labels: vec![NONE; width * height],
+    };
+
+    // Where each frame's centre lands, in texels: what orders the frames
+    // and orients each cut.
+    let centres: Vec<(f64, f64)> = (0..n)
+        .map(|k| {
+            let d = cameras.bearing(k, (0.0, 0.0));
+            projection
+                .from_direction(scale, d)
+                .map(|(u, v)| ((u - bounds.min_u) / px, (v - bounds.min_v) / px))
+                .unwrap_or((width as f64 / 2.0, height as f64 / 2.0))
+        })
+        .collect();
+
+    // The composite so far: what its owner saw, and how far from the
+    // owner's edge.
+    let mut value = vec![f32::NAN; width * height];
+    let mut edge = vec![f32::NAN; width * height];
+
+    for k in order(&centres, (width as f64 / 2.0, height as f64 / 2.0)) {
+        let w = warp(&map, proxies[k], cameras, k, gains[k], projection);
+        let overlap: Vec<usize> = (0..width * height)
+            .filter(|&i| map.labels[i] != NONE && !w.value[i].is_nan())
+            .collect();
+        // Texels nobody owns yet are the new frame's without a cut.
+        let mut take: Vec<bool> = map
+            .labels
+            .iter()
+            .zip(&w.value)
+            .map(|(&l, v)| l == NONE && !v.is_nan())
+            .collect();
+        if !overlap.is_empty() {
+            cut(
+                &map, &value, &edge, &w, &overlap, &centres, k, opts, &mut take,
+            );
+        }
+        for i in 0..width * height {
+            if take[i] {
+                map.labels[i] = k as u8;
+                value[i] = w.value[i];
+                edge[i] = w.edge[i];
+            }
+        }
+    }
+    Some(map)
+}
+
+/// The order frames are laid down in: the one nearest the middle first,
+/// then always the unplaced frame nearest any placed one, so that each new
+/// frame meets the composite along an overlap rather than across a gap.
+fn order(centres: &[(f64, f64)], middle: (f64, f64)) -> Vec<usize> {
+    let d2 = |a: (f64, f64), b: (f64, f64)| (a.0 - b.0).powi(2) + (a.1 - b.1).powi(2);
+    let n = centres.len();
+    let mut placed = vec![false; n];
+    let mut out = Vec::with_capacity(n);
+    let first = (0..n)
+        .min_by(|&a, &b| d2(centres[a], middle).total_cmp(&d2(centres[b], middle)))
+        .expect("at least one frame");
+    placed[first] = true;
+    out.push(first);
+    while out.len() < n {
+        let next = (0..n)
+            .filter(|&k| !placed[k])
+            .min_by(|&a, &b| {
+                let near = |k: usize| {
+                    out.iter()
+                        .map(|&p| d2(centres[k], centres[p]))
+                        .fold(f64::MAX, f64::min)
+                };
+                near(a).total_cmp(&near(b))
+            })
+            .expect("an unplaced frame");
+        placed[next] = true;
+        out.push(next);
+    }
+    out
+}
+
+/// Frame `k` sampled at every texel's centre, bilinearly. The proxy is
+/// gamma-encoded grey, so the gain (linear) becomes `gain^(1/2.2)` on it.
+fn warp(
+    map: &SeamMap,
+    g: &Gray,
+    cameras: &Cameras,
+    k: usize,
+    gain: f32,
+    projection: Projection,
+) -> Warped {
+    let (fw, fh) = (g.width as f64, g.height as f64);
+    let gain = gain.max(1e-6).powf(1.0 / 2.2);
+    let mut value = vec![f32::NAN; map.width * map.height];
+    let mut edge = vec![f32::NAN; map.width * map.height];
+    for ty in 0..map.height {
+        let v = map.origin.1 + (ty as f64 + 0.5) * map.px;
+        for tx in 0..map.width {
+            let u = map.origin.0 + (tx as f64 + 0.5) * map.px;
+            let d = projection.to_direction(map.scale, u, v);
+            let Some((x, y)) = cameras.project(k, d) else {
+                continue;
+            };
+            let (x, y) = (x + fw / 2.0 - 0.5, y + fh / 2.0 - 0.5);
+            let e = x.min(fw - 1.0 - x).min(y).min(fh - 1.0 - y);
+            if e < 0.0 {
+                continue;
+            }
+            let (x0, y0) = (x.floor() as usize, y.floor() as usize);
+            let (x1, y1) = ((x0 + 1).min(g.width - 1), (y0 + 1).min(g.height - 1));
+            let (ax, ay) = ((x - x0 as f64) as f32, (y - y0 as f64) as f32);
+            let at = |xx: usize, yy: usize| g.data[yy * g.width + xx];
+            let top = at(x0, y0) * (1.0 - ax) + at(x1, y0) * ax;
+            let bot = at(x0, y1) * (1.0 - ax) + at(x1, y1) * ax;
+            let i = ty * map.width + tx;
+            value[i] = (top * (1.0 - ay) + bot * ay) * gain;
+            edge[i] = e as f32;
+        }
+    }
+    Warped { value, edge }
+}
+
+/// Central-difference gradient magnitude of `plane` at texel `i`, from the
+/// neighbours that exist.
+fn detail(plane: &[f32], width: usize, height: usize, i: usize) -> f32 {
+    let (x, y) = (i % width, i / width);
+    let c = plane[i];
+    let mut g = 0.0f32;
+    let mut diff = |j: usize| {
+        let n = plane[j];
+        if !n.is_nan() {
+            g = g.max((n - c).abs());
+        }
+    };
+    if x > 0 {
+        diff(i - 1);
+    }
+    if x + 1 < width {
+        diff(i + 1);
+    }
+    if y > 0 {
+        diff(i - width);
+    }
+    if y + 1 < height {
+        diff(i + width);
+    }
+    g
+}
+
+/// Cut the overlap between the composite and frame `k`, marking in `take`
+/// the overlap texels that go to `k`.
+#[allow(clippy::too_many_arguments)]
+fn cut(
+    map: &SeamMap,
+    value: &[f32],
+    edge: &[f32],
+    new: &Warped,
+    overlap: &[usize],
+    centres: &[(f64, f64)],
+    k: usize,
+    opts: &SeamOptions,
+    take: &mut [bool],
+) {
+    let (w, h) = (map.width, map.height);
+
+    // The raw cost per overlap texel.
+    let mut raw = vec![f32::NAN; w * h];
+    let margin = opts.edge_margin.max(1.0);
+    for &i in overlap {
+        let differ = (value[i] - new.value[i]).abs();
+        let detail = detail(value, w, h, i).max(detail(&new.value, w, h, i));
+        let near = (1.0 - edge[i].min(new.edge[i]) / margin).max(0.0);
+        raw[i] = differ + opts.detail * detail + opts.edge * near * near + 1e-3;
+    }
+    // The worst over a small window: a texel is only cheap if its whole
+    // neighbourhood agrees, so the path keeps at least the blend's radius
+    // clear of a difference rather than threading the one lucky texel
+    // beside it — the blend straddles the path by that much and would
+    // otherwise reach the difference anyway.
+    let r = opts.smoothing as isize;
+    let mut cost = vec![OUTSIDE; w * h];
+    for &i in overlap {
+        let (x, y) = ((i % w) as isize, (i / w) as isize);
+        let mut worst = 0.0f32;
+        for dy in -r..=r {
+            for dx in -r..=r {
+                let (xx, yy) = (x + dx, y + dy);
+                if xx < 0 || yy < 0 || xx >= w as isize || yy >= h as isize {
+                    continue;
+                }
+                let c = raw[yy as usize * w + xx as usize];
+                if !c.is_nan() {
+                    worst = worst.max(c);
+                }
+            }
+        }
+        cost[i] = worst;
+    }
+
+    // The axis the cut crosses: from the composite's frames, weighted by how
+    // much of the overlap each owns, to the new frame.
+    let mut from = (0.0f64, 0.0f64);
+    for &i in overlap {
+        let c = centres[usize::from(map.labels[i])];
+        from = (from.0 + c.0, from.1 + c.1);
+    }
+    let m = overlap.len() as f64;
+    from = (from.0 / m, from.1 / m);
+    let to = centres[k];
+    let (mut ax, mut ay) = (to.0 - from.0, to.1 - from.1);
+    let len = (ax * ax + ay * ay).sqrt();
+    if len < 1e-6 {
+        (ax, ay) = (1.0, 0.0);
+    } else {
+        (ax, ay) = (ax / len, ay / len);
+    }
+    // Along the cut: perpendicular to the axis.
+    let (bx, by) = (-ay, ax);
+
+    // The overlap's extent in (s along the cut, t across it).
+    let st = |i: usize| {
+        let (x, y) = ((i % w) as f64 + 0.5, (i / w) as f64 + 0.5);
+        (x * bx + y * by, x * ax + y * ay)
+    };
+    let (mut s0, mut s1, mut t0, mut t1) = (f64::MAX, f64::MIN, f64::MAX, f64::MIN);
+    for &i in overlap {
+        let (s, t) = st(i);
+        s0 = s0.min(s);
+        s1 = s1.max(s);
+        t0 = t0.min(t);
+        t1 = t1.max(t);
+    }
+    let rows = (s1 - s0).round() as usize + 1;
+    let cols = (t1 - t0).round() as usize + 1;
+
+    // The grid in (s, t), each cell sampled from the texel it falls in, so
+    // that a rotated overlap has no holes.
+    let mut grid = vec![OUTSIDE; rows * cols];
+    let mut any = vec![false; rows];
+    for si in 0..rows {
+        for ti in 0..cols {
+            let (s, t) = (s0 + si as f64, t0 + ti as f64);
+            let x = s * bx + t * ax;
+            let y = s * by + t * ay;
+            if x < 0.0 || y < 0.0 {
+                continue;
+            }
+            let (x, y) = (x as usize, y as usize);
+            if x >= w || y >= h {
+                continue;
+            }
+            let c = cost[y * w + x];
+            if c < OUTSIDE {
+                grid[si * cols + ti] = c;
+                any[si] = true;
+            }
+        }
+    }
+
+    // Dynamic programming down the rows: the path moves at most one column
+    // per row, and starts afresh after a row with no overlap in it.
+    let mut acc = grid.clone();
+    let mut from_col = vec![0u32; rows * cols];
+    for si in 1..rows {
+        if !any[si] {
+            continue;
+        }
+        let prev = &acc[(si - 1) * cols..si * cols].to_vec();
+        if !any[si - 1] {
+            continue;
+        }
+        for ti in 0..cols {
+            let mut best = (prev[ti], ti);
+            if ti > 0 && prev[ti - 1] < best.0 {
+                best = (prev[ti - 1], ti - 1);
+            }
+            if ti + 1 < cols && prev[ti + 1] < best.0 {
+                best = (prev[ti + 1], ti + 1);
+            }
+            acc[si * cols + ti] += best.0;
+            from_col[si * cols + ti] = best.1 as u32;
+        }
+    }
+    // Back up from the end of each run of rows with overlap.
+    let mut seam = vec![usize::MAX; rows];
+    let mut si = rows;
+    while si > 0 {
+        si -= 1;
+        if !any[si] {
+            continue;
+        }
+        let row = &acc[si * cols..(si + 1) * cols];
+        let mut t = (0..cols)
+            .min_by(|&a, &b| row[a].total_cmp(&row[b]))
+            .unwrap_or(0);
+        loop {
+            seam[si] = t;
+            if si == 0 || !any[si - 1] {
+                break;
+            }
+            t = from_col[si * cols + t] as usize;
+            si -= 1;
+        }
+    }
+
+    // The new frame takes the side of the path its centre is on.
+    for &i in overlap {
+        let (s, t) = st(i);
+        let si = ((s - s0).round() as usize).min(rows - 1);
+        let ti = (t - t0).round();
+        if seam[si] != usize::MAX && ti >= seam[si] as f64 {
+            take[i] = true;
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::linalg::{Mat3, Vec3};
+
+    /// A scene as a function of direction, and frames of it rendered by the
+    /// same cameras the seam reads.
+    fn render(
+        cameras: &Cameras,
+        k: usize,
+        size: (usize, usize),
+        scene: impl Fn(Vec3) -> f32,
+    ) -> Gray {
+        let (w, h) = size;
+        let mut data = vec![0.0; w * h];
+        for y in 0..h {
+            for x in 0..w {
+                let p = (
+                    x as f64 + 0.5 - w as f64 / 2.0,
+                    y as f64 + 0.5 - h as f64 / 2.0,
+                );
+                data[y * w + x] = scene(cameras.bearing(k, p));
+            }
+        }
+        Gray {
+            width: w,
+            height: h,
+            data,
+        }
+    }
+
+    fn yaw(a: f64) -> Mat3 {
+        let (s, c) = a.sin_cos();
+        Mat3([[c, 0.0, s], [0.0, 1.0, 0.0], [-s, 0.0, c]])
+    }
+
+    /// Smooth, with a little texture: what a sky over a slope looks like to
+    /// the cost.
+    fn landscape(d: Vec3) -> f32 {
+        let (x, y) = (d.x() / d.z(), d.y() / d.z());
+        let texture = if y > 0.1 { 0.1 * (y * 40.0).sin() } else { 0.0 };
+        (0.5 + 0.2 * (x * 3.0).sin() + texture).clamp(0.0, 1.0) as f32
+    }
+
+    fn pair() -> Cameras {
+        Cameras {
+            rotations: vec![Mat3::IDENTITY, yaw(0.35)],
+            focal: 300.0,
+        }
+    }
+
+    #[test]
+    fn one_frame_owns_everything_it_reaches() {
+        let cameras = Cameras {
+            rotations: vec![Mat3::IDENTITY],
+            focal: 300.0,
+        };
+        let g = render(&cameras, 0, (320, 240), landscape);
+        let map = find(
+            &[&g],
+            &cameras,
+            &[1.0],
+            Projection::Perspective,
+            &Default::default(),
+        )
+        .unwrap();
+        let owned = map.labels.iter().filter(|&&l| l == 0).count();
+        assert!(owned as f64 > 0.95 * (map.width * map.height) as f64);
+    }
+
+    #[test]
+    fn each_frame_keeps_its_own_side() {
+        let cameras = pair();
+        let frames: Vec<Gray> = (0..2)
+            .map(|k| render(&cameras, k, (320, 240), landscape))
+            .collect();
+        let refs: Vec<&Gray> = frames.iter().collect();
+        let map = find(
+            &refs,
+            &cameras,
+            &[1.0, 1.0],
+            Projection::Cylindrical,
+            &Default::default(),
+        )
+        .unwrap();
+        let mid = map.height / 2 * map.width;
+        assert_eq!(map.labels[mid + 2], 0, "the left edge is frame 0's alone");
+        assert_eq!(
+            map.labels[mid + map.width - 3],
+            1,
+            "the right edge is frame 1's"
+        );
+        // One change of owner along every row that both frames cross.
+        for y in 0..map.height {
+            let row = &map.labels[y * map.width..(y + 1) * map.width];
+            let owned: Vec<u8> = row.iter().copied().filter(|&l| l != NONE).collect();
+            let changes = owned.windows(2).filter(|p| p[0] != p[1]).count();
+            assert!(changes <= 1, "row {y} changes owner {changes} times");
+        }
+    }
+
+    #[test]
+    fn the_seam_goes_round_what_only_one_frame_saw() {
+        // Frame 1 saw something frame 0 did not — a figure that walked into
+        // the overlap — in the middle of where the two meet.
+        let cameras = pair();
+        let figure = Vec3::new(0.175f64.sin(), 0.0, 0.175f64.cos());
+        let walker = |d: Vec3| {
+            let near = (d.x() - figure.x()).abs() < 0.04 && (d.y() - figure.y()).abs() < 0.15;
+            if near {
+                0.95
+            } else {
+                landscape(d)
+            }
+        };
+        let frames = [
+            render(&cameras, 0, (320, 240), landscape),
+            render(&cameras, 1, (320, 240), walker),
+        ];
+        let refs: Vec<&Gray> = frames.iter().collect();
+        let map = find(
+            &refs,
+            &cameras,
+            &[1.0, 1.0],
+            Projection::Cylindrical,
+            &Default::default(),
+        )
+        .unwrap();
+        // Every texel of the figure is taken from the same frame, with a
+        // blend radius of room to spare, so it is either all there or not at
+        // all — never half.
+        let (u, v) = Projection::Cylindrical
+            .from_direction(map.scale, figure)
+            .unwrap();
+        let mut owners = std::collections::HashSet::new();
+        // The figure's extent on the surface, plus the blend's radius.
+        let radius = 3.0;
+        let reach = |half: f64| half * map.scale + radius * map.px;
+        let (ru, rv) = (reach(0.04), reach(0.15));
+        let mut dv = -rv;
+        while dv <= rv {
+            let mut du = -ru;
+            while du <= ru {
+                let s = map.share(1, u + du, v + dv, map.scale, radius);
+                owners.insert((s.unwrap() * 100.0).round() as i32);
+                du += map.px;
+            }
+            dv += map.px;
+        }
+        assert_eq!(owners.len(), 1, "the figure is split: shares {owners:?}");
+    }
+
+    #[test]
+    fn share_is_a_blend_across_the_seam_and_whole_away_from_it() {
+        let map = SeamMap {
+            width: 8,
+            height: 1,
+            scale: 1.0,
+            origin: (0.0, 0.0),
+            px: 1.0,
+            labels: vec![0, 0, 0, 0, 1, 1, 1, 1],
+        };
+        assert_eq!(map.share(0, 1.5, 0.5, 1.0, 2.0), Some(1.0));
+        assert_eq!(map.share(1, 6.5, 0.5, 1.0, 2.0), Some(1.0));
+        let at_seam = map.share(0, 4.0, 0.5, 1.0, 2.0).unwrap();
+        assert!((at_seam - 0.5).abs() < 1e-6, "{at_seam}");
+        // And at twice the scale, the same point is twice as far out.
+        assert_eq!(
+            map.share(0, 8.0, 1.0, 2.0, 2.0),
+            map.share(0, 4.0, 0.5, 1.0, 2.0)
+        );
+        let empty = SeamMap {
+            labels: vec![NONE; 8],
+            ..map
+        };
+        assert_eq!(empty.share(0, 4.0, 0.5, 1.0, 2.0), None);
+    }
+}

core/dr-pipeline/build.rs

@@ -405,6 +405,7 @@ fn emit_node(out: &mut String, node: &Declaration) {
         active,
         tests,
         presentation,
+        camera_stage,
         ..
     } = node;
 
@@ -569,6 +570,15 @@ fn emit_node(out: &mut String, node: &Declaration) {
         "        fn is_active(&self) -> bool {{\n            {active_expr}\n        }}\n"
     );
 
+    // Only a camera-stage node says anything: the trait's default is the
+    // scene, which is every other node (D19).
+    if *camera_stage {
+        out.push_str(
+            "        fn stage(&self) -> crate::operation::Stage {\n            \
+             crate::operation::Stage::Camera\n        }\n\n",
+        );
+    }
+
     let _ = writeln!(
         out,
         "        fn wgsl_body(&self) -> String {{\n            {}.into()\n        }}\n",

core/dr-pipeline/ops/README.md

@@ -228,9 +228,11 @@ interpolated points — master, red, green, blue — each reaching the shader on
 when it has been moved), `colour_mixer` (thirty-six faceted parameters from
 twelve computed hue bands), `film_sim` (a stock's measured tables, which are
 not parameters, and the one node that declares `Operation::renders` — see
-below), `capture_sharpen` (a separable convolution) and `noise_reduction` (a
-kernel, and one that decides how many dispatches to emit at each resolution) —
-the last two for the reason the next section gives. `vignetting` is
+below), `view_transform` (composed at its defaults, which a declaration cannot
+say — see [What is not a node](#what-is-not-a-node-and-why)), and the five
+kernels — `capture_sharpen` (a separable convolution), `noise_reduction` (one
+that decides how many dispatches to emit at each resolution), `clarity`,
+`texture` and `dehaze` — for the reason the next section gives. `vignetting` is
 hand-written too but is not in the develop chain — it carries lens-profile
 coefficients that are not parameters.
 
@@ -240,18 +242,16 @@ coefficients that are not parameters.
 `Operation::renders`, and it is worth knowing why before writing a second one.
 
 Every other node *adjusts* a picture. That one *makes* it: a film stock's
-characteristic curve does the camera profile's base curve's job, from
-measurements rather than from a curve somebody drew. Running both renders the
-scene twice — the camera's rendering, and then a film's rendering of *that* —
-which looks like neither and reads as a colour-management bug with no
-colour-management bug to find.
+characteristic curve does the view transform's job, from measurements rather
+than from a curve somebody chose. Running both renders the scene twice — the
+default rendering, and then a film's rendering of *that* — which looks like
+neither and reads as a colour-management bug with no colour-management bug to
+find.
 
-So a node declaring `renders` takes camera RGB and hands back linear sRGB, and
-in exchange the composer emits neither the base curve nor the conversion out of
-camera space. Both halves move to the node, together: the base curve is defined
-in camera RGB and the matrix is what leaves it, so a node replacing one has
-necessarily replaced the other. `compose_full` keeps them as a single string
-for exactly that reason — it is what makes getting half of it right impossible. `distortion` and
+So `film_sim` is in `Stage::View` beside `view_transform`, and while a stock
+is loaded the composer emits it in the view transform's place, last, after the
+detail stage, and not the sigmoid (D19). It is handed working-space colour and
+hands back display-referred linear sRGB for the output transform. `distortion` and
 `aberration` are `Warp`s rather than operations: they rewrite coordinates
 before sampling rather than transforming a colour after it.
 
@@ -264,7 +264,8 @@ clarity, texture, dehaze and spot removal are all defined by what the
 of `c` at any price.
 
 They go in the **detail stage**, which runs after the fused pass, in linear
-light, at render resolution, before the output transform — see
+light, at render resolution, before the view transform and the output
+transform — see
 [`../src/detail.rs`](../src/detail.rs) for why each of those is a decision
 rather than a convenience. A node of this kind:
 
@@ -294,41 +295,38 @@ in raw pixels is a different photograph on screen and in the exported file.
 
 ## What is not a node, and why
 
-Three things act on every pixel and are deliberately not in this directory:
-the as-shot white balance, the camera matrix, and the **base curve**
-(FR-DEV-3e). They are emitted by [`../src/operation.rs`](../src/operation.rs)
-into the composed shader's fixed preamble, around the block of nodes.
+Two things act on every pixel and are deliberately not in this directory: the
+as-shot white balance and the camera matrix. They are emitted by
+[`../src/operation.rs`](../src/operation.rs) into the composed shader around the
+block of nodes. They are properties of the *file*, at the same standing as the
+masked-photosite crop (FR-RAW-3) and the stored orientation (FR-DEV-3h): nobody
+chose the sensor's green sensitivity, and reading the file correctly means
+undoing it.
 
-The test is not "does it transform a colour" — all three do. It is **whose
-decision is it**. A node is something a photographer chose: it has parameters,
-it moves off a neutral, it lands in the sidecar, it can be undone. These three
-are properties of the *file*, at the same standing as the masked-photosite crop
-(FR-RAW-3) and the stored orientation (FR-DEV-3h). Nobody chose the sensor's
-green sensitivity or the body's rendering; they are what reading the file
-correctly means.
+The **view transform** (FR-DEV-3j) *is* a node — `view_transform.yaml`, a
+`rust:` one — and that is a change of mind worth knowing about. It replaced the
+per-body base curve, which was kept out of this directory because it belonged
+to the camera: as a node it would have carried one body's rendering onto
+another body's file through a shared sidecar. D19 retired the per-body curves,
+and with them the argument. One view transform serves every body, so its
+settings are a decision about the picture like any other. What is still
+special about it is `Stage::View`: the composer emits it at the end of the
+chain *whatever its state*, because a photograph with no view transform is a
+scan and not a picture. Its neutral is its defaults, like every other node's,
+so an untouched photograph writes nothing for it.
 
-Making the base curve a node would have said the opposite in four places at
-once. It would have appeared in the develop panel as a control, so an
-unprofiled body would show a slider that does nothing. Its values would have
-gone into the sidecar, and sidecars are shared between devices and bodies
-(FR-NC-9) — one camera's rendering would follow an edit onto another camera's
-file. Its neutral would have had to be "the identity", so a profiled body would
-open reporting itself modified. And there is no seam through which a node could
-learn which camera took the frame: the profile arrives on the decoded image,
-travels through `DemosaicedImage` beside the matrix it belongs with, and is
-written into the uniform block by the same three lines in `dr-gpu` — which is
-exactly the path the matrix already took, because it is exactly the same kind
-of thing.
+## Stages
 
-What it *does* share with the tone curve node is the spline. The composer asks
-`ToneCurve` for its `curve_span`/`curve_eval` helpers rather than emitting a
-second copy, so a profile author placing a control point and a photographer
-dragging one mean the same thing by it.
-
-The order still reads correctly from this directory: the base curve runs after
-every node in the chain and before the conversion out of camera space. That is
-the same reasoning `exposure` records under `placement:` — corrections to
-capture are only meaningful on linear values, so the rendering goes last.
+`stage: camera` puts a node in camera RGB, ahead of the camera matrix; the
+default, `stage: scene`, hands it working-space colour — linear sRGB
+primaries, scene-referred and unbounded. White balance is the only camera
+node, because its multipliers scale the sensor's own channels. Everything else
+belongs in the scene, where a hue or a luminance weight means the same thing
+whichever body took the frame (D19). The composer emits the camera nodes, then
+the matrix, then the scene nodes, each group in `order:`, and the view
+transform last. `stage: view` is not offered to a declaration: a node that
+maps into a display range is exactly what ARCH §6.14 forbids of everything
+before the end, and the one that is allowed to is hand-written.
 
 ## Errors
 

core/dr-pipeline/ops/contrast.yaml

@@ -64,7 +64,8 @@ wgsl: |
       // to grey and its noise stays the size it was.
       //
       // The grey is (1, 1, 1) scaled, because this runs after white balance
-      // in the camera's space, where that is what neutral is.
+      // and the camera matrix, which carries a balanced neutral to equal
+      // channels.
       c = mix(c, vec3<f32>(0.18), -amount);
   } else {
       let luma = luminance(c);

core/dr-pipeline/ops/film_sim.yaml

@@ -1,5 +1,5 @@
 id: film_sim
-order: 25
+order: 190
 # What this node is *about* is not written here, and cannot be: a `rust:` node
 # publishes its own descriptor, so `attributes:` in this file would be read,
 # validated and then ignored. See `Attribute::Effect` on `FilmSim`'s descriptor
@@ -11,15 +11,17 @@ why_rust: |
   characteristic curves and a density lookup — which are not parameters and
   which no `uniforms:` expression could produce. Its neutral is "no stock
   loaded" rather than a set of values, and it is the one node that declares
-  `Operation::renders`, so the composer omits the camera profile's base curve
-  and the conversion out of camera space on its behalf.
+  `Operation::renders`, so while a stock is loaded the composer emits it in
+  the view transform's place instead of the default sigmoid.
 
 placement: |
-  After white balance and exposure, and before everything else.
+  Last, in the view transform's place (D19, FR-DEV-3j), after every other
+  operation and after the detail stage.
 
-  Those two are what the camera did — interpreting the sensor, and correcting
-  the amount of light that reached it — and they are only meaningful on
-  scene-linear values, which is what a film has to be handed. Everything below
-  is a decision about the picture, and a decision about the picture belongs
-  after the film has rendered it, exactly as it does when you scan a frame and
-  then work on the scan.
+  Before D19 it sat at order 25, after white balance and exposure, and every
+  decision below it acted on the film's output, as though the frame had been
+  scanned and then worked on. That put a display-referred rendering in the
+  middle of the chain, which is what D19 removes: every operation is now handed
+  the scene, and the film is the last thing that happens to the picture — an
+  edit is a decision about the exposure the negative receives. `Stage::View`
+  is what puts it there; this number only places it in the panel's order.

core/dr-pipeline/ops/view_transform.yaml

@@ -0,0 +1,18 @@
+id: view_transform
+order: 200
+# A `rust:` node publishes its own descriptor; its attributes are on the type
+# in `../src/ops/view_transform.rs`.
+rust: ViewTransform
+
+why_rust: |
+  It is composed at its defaults — a photograph with no view transform is a
+  scan, not a picture — which is `Stage::View`, and a declaration has no way to
+  say it. Its three uniforms are also the solution of two equations rather than
+  expressions over its parameters (`dr_pipeline::view::Sigmoid::new`).
+
+placement: |
+  Last, after every scene operation and, when there is one, after the detail
+  stage (D19, FR-DEV-3j). It is the one stage allowed to map scene-linear colour
+  to a display range, so anything after it would be working on a rendering.
+  The order here only places it in the panel; the composer puts every
+  `Stage::View` node at the end whatever its number says.

core/dr-pipeline/ops/white_balance.yaml

@@ -20,6 +20,13 @@ placement: |
   First. It is a correction to how the scene was captured, and every tonal
   operation after it should act on a correctly balanced image.
 
+# In camera RGB, ahead of the camera matrix, and the only node there (D19).
+# Its multipliers scale the sensor's own channels — that is what the as-shot
+# ones are, and what the picker solves for — and a matrix that mixes the
+# channels, which is every body's, would turn the same numbers into a
+# different correction once it had run.
+stage: camera
+
 params:
   temperature:
     label: param.temperature

core/dr-pipeline/src/bundled.rs

@@ -49,7 +49,9 @@ pub struct Section {
     /// A stable identifier, for a frontend that remembers which sections a
     /// photographer folded away. Never shown.
     pub id: &'static str,
-    /// What the section is called on screen.
+    /// What the section is called on screen, as a category path: `/`
+    /// separates the levels, so `Film/Colour` is a folder inside `Film`. The
+    /// same spelling a photographer's own preset names use for theirs.
     pub title: &'static str,
     /// The presets in it, every one reaching only what it names.
     pub presets: PresetLibrary,
@@ -65,17 +67,17 @@ const SECTIONS: &[(&str, &str, &str)] = &[
     ("skies", "Skies", include_str!("../presets/skies.drpl")),
     (
         "colour_film",
-        "Colour film",
+        "Film/Colour",
         include_str!("../presets/colour_film.drpl"),
     ),
     (
         "cinema_film",
-        "Cinema film",
+        "Film/Cinema",
         include_str!("../presets/cinema_film.drpl"),
     ),
     (
         "bw_film",
-        "Black and white film",
+        "Film/Black and white",
         include_str!("../presets/bw_film.drpl"),
     ),
 ];

core/dr-pipeline/src/declared/decl.rs

@@ -271,6 +271,32 @@ pub struct Declaration {
     /// Boxed so the rare node that declares one does not widen every
     /// declaration by the size of a presentation it does not have.
     pub presentation: Option<Box<PresentationDef>>,
+    /// Whether the node runs in camera RGB, ahead of the camera matrix —
+    /// `stage: camera`. See [`read_stage`].
+    pub camera_stage: bool,
+}
+
+/// TRACES: FR-DEV-3e | FR-DEV-2
+/// Where in the chain a declared node's colour comes from: `stage: camera` or
+/// `stage: scene`, the default.
+///
+/// Camera RGB is where white balance's multipliers are defined, and it is the
+/// only thing that belongs there (D19): every other operation is handed
+/// working-space colour, so that a hue or a luminance weight means the same
+/// thing whichever body took the frame. `view` is not offered. The view
+/// transform is hand-written, and a declared node that clipped into a display
+/// range would be exactly what ARCH §6.14 forbids of every node before it.
+fn read_stage(root: &Mapping) -> Result<bool, String> {
+    match root.get("stage") {
+        None => Ok(false),
+        Some(v) => match as_str(v, "stage")? {
+            "camera" => Ok(true),
+            "scene" => Ok(false),
+            other => Err(format!(
+                "unknown stage {other:?}; expected \"camera\" or \"scene\""
+            )),
+        },
+    }
 }
 
 impl Declaration {
@@ -512,6 +538,7 @@ pub fn read_node(text: &str, ctx: &str, shared: &BTreeSet<&str>) -> Result<Node,
             "define",
             "label",
             "attributes",
+            "stage",
         ] {
             if root.contains_key(key) {
                 return Err(format!(
@@ -564,6 +591,7 @@ pub fn read_node(text: &str, ctx: &str, shared: &BTreeSet<&str>) -> Result<Node,
         .collect();
     let tests = read_tests(root, &params, &uniform_names, &helper_names)?;
     let presentation = read_presentation(root, &param_names)?;
+    let camera_stage = read_stage(root)?;
 
     Ok(Node::Declared(Box::new(Declaration {
         id,
@@ -580,6 +608,7 @@ pub fn read_node(text: &str, ctx: &str, shared: &BTreeSet<&str>) -> Result<Node,
         active,
         tests,
         presentation,
+        camera_stage,
     })))
 }
 

core/dr-pipeline/src/declared/mod.rs

@@ -107,6 +107,8 @@ pub struct DeclaredOp {
     helpers: Vec<Helper>,
     presentation: Option<Presentation>,
     order: i64,
+    /// See `decl::read_stage`.
+    camera_stage: bool,
 }
 
 /// One uniform: the name the fragment reads it by, and how to compute it.
@@ -208,6 +210,7 @@ impl DeclaredOp {
             wgsl: declaration.wgsl_body(),
             helpers,
             presentation: declaration.presentation.as_deref().map(presentation),
+            camera_stage: declaration.camera_stage,
             order: declaration.order,
         })
     }
@@ -292,6 +295,14 @@ impl Operation for DeclaredOp {
     fn presentation(&self) -> Option<Presentation> {
         self.presentation.clone()
     }
+
+    fn stage(&self) -> crate::operation::Stage {
+        if self.camera_stage {
+            crate::operation::Stage::Camera
+        } else {
+            crate::operation::Stage::Scene
+        }
+    }
 }
 
 /// A declared parameter as the descriptor the panel reads.

core/dr-pipeline/src/descriptor.rs

@@ -659,10 +659,10 @@ impl Attribute {
     ///
     /// `Effect` after `Colour` is a look laid over a settled picture — and is
     /// the one arguable slot. A spectral film simulation declares
-    /// [`crate::Operation::renders`] and replaces the base curve, which is an
-    /// argument for treating it as foundational rather than final; an array of
-    /// six cannot say "last, except when it is first". The tension is recorded
-    /// here rather than settled.
+    /// [`crate::Operation::renders`] and takes the view transform's place at
+    /// the very end of the chain (D19), which is an argument for treating it as
+    /// the rendering rather than one effect among others; an array of six
+    /// cannot say that. The tension is recorded here rather than settled.
     ///
     /// Both ends were wrong for as long as this list only fed a row of chips
     /// nobody reads in order. It stopped being harmless when the same list

core/dr-pipeline/src/detail.rs

@@ -24,9 +24,10 @@
 //!        v
 //!   +------------------------------------------+
 //!   | the fused point-operation pass           |  one dispatch
-//!   |   white balance, exposure, tone, colour  |
-//!   |   the mask layers                        |
+//!   |   white balance (camera RGB)             |
 //!   |   camera RGB -> linear sRGB              |
+//!   |   exposure, tone, colour                 |
+//!   |   the mask layers                        |
 //!   +------------------------------------------+
 //!        |  rgba16float, linear, **unclipped**, at render resolution
 //!        v
@@ -34,7 +35,13 @@
 //!   | the detail stage - this module           |  one dispatch per pass
 //!   |   sharpen, NR, clarity, texture, spots   |
 //!   +------------------------------------------+
-//!        |  the last pass applies the output transform
+//!        |  rgba16float, still scene-linear and unclipped
+//!        v
+//!   +------------------------------------------+
+//!   | the view pass                            |  one dispatch
+//!   |   view transform, or the film stock      |
+//!   |   output transform, mask reveal          |
+//!   +------------------------------------------+
 //!        v
 //!   rgba8unorm display or export texture
 //! ```
@@ -52,14 +59,13 @@
 //! texture, clarity, spot removal and sharpen/NR sit below the tone curve and
 //! the colour mixer.
 //!
-//! **In linear light, after the camera matrix.** The fused pass works in
-//! *camera* space, because white balance and exposure are physically
-//! meaningful there and nowhere else. A detail pass is the opposite case: it
-//! wants a luminance, and camera RGB has no luminance — the three channels are
+//! **In linear light, after the camera matrix.** A detail pass wants a
+//! luminance, and camera RGB has no luminance — the three channels are
 //! whatever the CFA's dyes passed, and weighting them 0.2126/0.7152/0.0722
-//! would be numerology. So the split is taken *after* the `cam_to_srgb`
-//! multiply, where the working space is linear sRGB and a luminance is a
-//! luminance.
+//! would be numerology. Since D19 only white balance runs in camera RGB; the
+//! `cam_to_srgb` multiply follows it, so every point operation, and every
+//! detail pass after them, works in linear sRGB primaries, where a luminance
+//! is a luminance.
 //!
 //! **Before the output transform, and before the clip.** FR-DEV-2 allows
 //! exactly one quantisation, at the display or export stage. A detail pass
@@ -70,9 +76,11 @@
 //! therefore `rgba16float` and holds linear values that have **not** been
 //! clamped to `0..=1`: a recovered highlight is still above one at this point,
 //! and clipping it before the sharpener sees it would put a hard edge exactly
-//! where the sharpener is most visible. The last detail pass performs the
-//! primaries conversion, the clip and the encode, so the single quantisation
-//! stays single.
+//! where the sharpener is most visible. Every detail pass writes such an
+//! intermediate, the last one included, and the view pass after them — the
+//! view transform, then the output transform's primaries, clip and encode —
+//! is the one place the scene is fitted to a display (D19, ARCH §6.14), so
+//! the single quantisation stays single.
 //!
 //! **After framing, at render resolution.** The alternative — running detail
 //! on the demosaiced source before the framing prologue — is superficially
@@ -122,8 +130,6 @@
 
 use std::fmt::Write as _;
 
-use dr_types::ColourSpace;
-
 use crate::operation::{Helper, Operation, Uniform};
 
 /// Floats the generated detail uniform block always carries, before an
@@ -199,6 +205,10 @@ pub const DETAIL_BASE_UNIFORM_FIELDS: usize = 4;
 pub struct RenderScale {
     render: (u32, u32),
     full: (u32, u32),
+    /// The whole framed photograph at source resolution: `full` before the
+    /// zoom and the tile were folded in. What a frame fraction is a fraction
+    /// of — see [`Self::frame_fraction`].
+    frame: (u32, u32),
 }
 
 impl RenderScale {
@@ -210,9 +220,27 @@ impl RenderScale {
     /// [`crate::EditGraph::render_scale`] works both out from the framing, and
     /// is what a caller should normally use.
     pub fn new(render: (u32, u32), full: (u32, u32)) -> Self {
+        let full = (full.0.max(1), full.1.max(1));
         Self {
             render: (render.0.max(1), render.1.max(1)),
-            full: (full.0.max(1), full.1.max(1)),
+            full,
+            frame: full,
+        }
+    }
+
+    /// TRACES: FR-DSP-1 | FR-DSP-2
+    /// The same scale, for a render that shows only part of a larger frame.
+    ///
+    /// `frame` is the whole framed photograph at source resolution — the crop
+    /// folded in, the zoom and any tile not. A zoomed view and an export tile
+    /// both look at part of the frame, and a clarity radius is a fraction of
+    /// the *frame*, not of the part: measured against the part, zooming in
+    /// shrinks the halo to a fraction of what the file will get, and two
+    /// neighbouring tiles of an export would each draw their own.
+    pub fn within(self, frame: (u32, u32)) -> Self {
+        Self {
+            frame: (frame.0.max(1), frame.1.max(1)),
+            ..self
         }
     }
 
@@ -261,8 +289,19 @@ impl RenderScale {
     /// For the compositional family — clarity, texture, dehaze — and the same
     /// unit `dr-gpu`'s mask rasteriser already converts feathers in. An edit
     /// stored this way is resolution-independent by construction.
+    ///
+    /// Measured against the whole frame ([`Self::within`]), scaled by the
+    /// render's own short edge over the viewed region's. When the render shows
+    /// the whole frame the two sizes cancel and this is `fraction` of the
+    /// render's short edge exactly.
     pub fn frame_fraction(&self, fraction: f32) -> f32 {
-        fraction * self.render.0.min(self.render.1) as f32
+        let render = self.render.0.min(self.render.1) as f32;
+        let viewed = self.full.0.min(self.full.1) as f32;
+        let frame = self.frame.0.min(self.frame.1) as f32;
+        if self.frame == self.full {
+            return fraction * render;
+        }
+        fraction * render * (frame / viewed)
     }
 
     /// Whether a radius stated in source pixels survives this render.
@@ -491,15 +530,6 @@ pub struct ComposedDetailPass {
     pub radius: u32,
     /// See [`DetailPass::output_scale`].
     pub output_scale: u32,
-    /// Whether this pass writes the display/export texture rather than another
-    /// linear intermediate.
-    ///
-    /// True for exactly the last pass in the chain, which carries the output
-    /// transform — the primaries conversion, the clip and the encode that the
-    /// fused pass performs when there is no detail stage at all. Folding them
-    /// into the last pass rather than adding a resolve dispatch keeps the cost
-    /// of the stage at one dispatch per pass, not one plus one.
-    pub writes_output: bool,
     /// Identifies this pass's *structure*, for the pipeline cache. Covers the
     /// generated source, not the uniform values — so moving a slider uploads a
     /// buffer and reuses the compiled pipeline, exactly as the fused pass does.
@@ -537,6 +567,26 @@ impl ComposedDetail {
             .max()
             .unwrap_or(0)
     }
+
+    /// TRACES: FR-DSP-2
+    /// How far the whole chain reads from the pixel it finally writes, in
+    /// render pixels: the halo a tile has to be grown by so that its interior
+    /// renders exactly as the untiled frame does.
+    ///
+    /// The **sum** of the passes' reaches, not the widest of them. The passes
+    /// run one after another, so a pixel of the last one depends on pixels of
+    /// the one before it `r` away, each of which depends on pixels a further
+    /// `r'` away. A separable blur's two halves each reach `r` along one axis
+    /// and the sum over-counts them by a factor of two; that is the price of a
+    /// bound that is always safe, and it is paid only by export tiles.
+    ///
+    /// One pixel per pass on top, for the reduced grids' bilinear taps.
+    pub fn reach(&self) -> u32 {
+        self.passes
+            .iter()
+            .map(|p| p.radius.saturating_mul(p.output_scale).saturating_add(1))
+            .fold(0u32, u32::saturating_add)
+    }
 }
 
 /// TRACES: FR-DEV-3 | FR-DSP-1
@@ -547,10 +597,11 @@ impl ComposedDetail {
 /// an edit with no sharpening produces an empty chain and `dr-gpu` runs the
 /// single dispatch it always did.
 ///
-/// `output` is the space the **last** pass encodes into, and it is a parameter
-/// for the same reason it is a parameter to [`crate::compose_with_framing`]: a
-/// screen render and a Display P3 export are the same edit and different
-/// shaders, and neither is more authoritative than the other.
+/// No pass encodes. Every pass writes a linear intermediate, the last one
+/// included, and the fused pass's view pass ([`crate::ComposedShader::view`])
+/// reads the last and performs the view transform and the output transform
+/// (D19). So the output space is not a parameter here: a screen render and a
+/// Display P3 export share one detail stage.
 ///
 /// # The generated uniform block
 ///
@@ -562,12 +613,8 @@ impl ComposedDetail {
 /// is there because a two-pass operation emitting one body for both directions
 /// is a reasonable thing to want, and would otherwise need a uniform of its
 /// own purely to say which half it is in.
-pub fn compose_detail(
-    ops: &[Box<dyn Operation>],
-    scale: RenderScale,
-    output: ColourSpace,
-) -> ComposedDetail {
-    compose_detail_with(ops, &[], scale, output)
+pub fn compose_detail(ops: &[Box<dyn Operation>], scale: RenderScale) -> ComposedDetail {
+    compose_detail_with(ops, &[], scale)
 }
 
 /// TRACES: FR-DEV-8
@@ -592,7 +639,6 @@ pub fn compose_detail_with(
     ops: &[Box<dyn Operation>],
     spots: &[DetailPass],
     scale: RenderScale,
-    output: ColourSpace,
 ) -> ComposedDetail {
     // Every pass of every active detail operation, flattened, carrying the
     // operation it came from for the uniform prefix and the helper set.
@@ -624,45 +670,13 @@ pub fn compose_detail_with(
         }
     }
 
-    // An active detail operation that emitted nothing at this scale.
-    //
-    // Legal, and the honest answer for an acutance operation on a heavy proxy
-    // — a one-source-pixel radius is a third of a render pixel there and no
-    // kernel represents a third of a pixel (see [`RenderScale`]). But it opens
-    // a hole between the two halves of the composition: [`compose_full`]
-    // decides to hand on linear working values from the *operations*, which it
-    // must, having no scale to consult, so the fused pass has already stopped
-    // short of the output transform. Returning an empty chain here would leave
-    // that transform undone and bind an `rgba16float` shader to an
-    // `rgba8unorm` target, which surfaces as a wgpu validation failure a long
-    // way from the cause.
-    //
-    // So the chain is never empty when the fused pass is expecting one: a
-    // single pass with no body, which reads the intermediate and performs the
-    // output transform the fused pass skipped. One dispatch, in the uncommon
-    // case where a photographer has a kernel switched on at a scale that
-    // cannot draw it — against the alternative of the preview failing outright
-    // or `compose_full` growing a resolution argument it has no other use for.
-    if planned.is_empty() && ops.iter().any(|o| o.is_active() && o.detail().is_some()) {
-        return ComposedDetail {
-            passes: vec![compose_one(
-                RESOLVE_ID,
-                &[],
-                &DetailPass {
-                    output_scale: 1,
-                    label: "resolve",
-                    radius: 0,
-                    wgsl: String::new(),
-                    uniforms: Vec::new(),
-                    storage: Vec::new(),
-                },
-                0,
-                scale,
-                output,
-                true,
-            )],
-        };
-    }
+    // An active detail operation may emit nothing at this scale — an
+    // acutance operation on a heavy proxy, whose one-source-pixel radius is a
+    // third of a render pixel (see [`RenderScale`]). The chain is then empty
+    // while the fused pass has stopped at linear working values, and that is
+    // fine: the fused pass's view pass reads the fused result directly and
+    // performs the output transform. Before D19 the last detail pass encoded,
+    // and this case needed a body-less resolve pass to do it.
 
     // TRACES: NFR-P5
     // A pass whose body is empty changes nothing but where the pixels are: it
@@ -674,12 +688,10 @@ pub fn compose_detail_with(
     // 2560 x 1600 frame on the reference laptop with its clocks held down.
     //
     // Dropped here, where the chain is still a list, and only where dropping
-    // it is exact:
+    // it is exact. The last pass is no exception since D19: it writes an
+    // `rgba16float` intermediate like the others, and the view pass reads
+    // whichever one the chain last wrote.
     //
-    // - **Not the last pass.** The last pass performs the output transform on
-    //   what it read from an `rgba16float` intermediate. Moving that transform
-    //   onto the pass before would apply it to that pass's `f32` result
-    //   instead, which is a different rounding of the same picture.
     // - **Not after a reduced pass.** A full-resolution pass ends the reduced
     //   chain (see `DetailRunner::encode`), so one that follows a scaled pass
     //   is what stops the next operation reading the last one's base. None of
@@ -688,45 +700,29 @@ pub fn compose_detail_with(
     // Everywhere else the pass before and the pass after exchange the same
     // `rgba16float` texels either way, `aux` included.
     let mut kept: Vec<(&str, &[Helper], DetailPass, usize)> = Vec::with_capacity(planned.len());
-    let total = planned.len();
-    for (position, entry) in planned.into_iter().enumerate() {
+    for entry in planned {
         let after_full = kept.last().is_none_or(|(_, _, p, _)| p.output_scale <= 1);
-        let droppable = position + 1 < total && after_full && entry.2.is_identity();
+        let droppable = after_full && entry.2.is_identity();
         if !droppable {
             kept.push(entry);
         }
     }
     let planned = kept;
 
-    let last = planned.len().saturating_sub(1);
     let passes = planned
         .into_iter()
-        .enumerate()
-        .map(|(position, (id, helpers, pass, index))| {
-            compose_one(id, helpers, &pass, index, scale, output, position == last)
-        })
+        .map(|(id, helpers, pass, index)| compose_one(id, helpers, &pass, index, scale))
         .collect();
 
     ComposedDetail { passes }
 }
 
-/// The operation id the resolve pass is labelled with.
-///
-/// Not an operation: no `ops/*.yaml` declares it and nothing in the chain
-/// answers to it. It exists so the generated label reads `detail/resolve`
-/// rather than borrowing the id of whichever operation happened to fall
-/// through, which would send a reader looking for a bug in that operation.
-const RESOLVE_ID: &str = "detail";
-
-#[allow(clippy::too_many_arguments)]
 fn compose_one(
     id: &str,
     helpers: &[Helper],
     pass: &DetailPass,
     index: usize,
     scale: RenderScale,
-    output: ColourSpace,
-    writes_output: bool,
 ) -> ComposedDetailPass {
     let prefix = format!("{}_{index}", crate::operation::sanitise(id));
 
@@ -772,41 +768,13 @@ fn compose_one(
         let _ = writeln!(helper_src, "{}\n", h.source.trim_end());
     }
 
-    // The storage format and the tail are the *only* difference between an
-    // intermediate pass and the final one. Everything above — the taps, the
-    // uniforms, the body — is identical, which is what lets an operation write
-    // one kernel without knowing whether it happens to be last in the chain.
-    let (store_format, tail) = if writes_output {
-        (
-            "rgba8unorm",
-            format!(
-                "{}    // Clip to the output gamut and encode. The one quantisation\n\
-                 \x20   // the pipeline performs (FR-DEV-2), and it is here rather than\n\
-                 \x20   // in the fused pass because this is now the last thing to run.\n\
-                 \x20   c = clamp(c, vec3<f32>(0.0), vec3<f32>(1.0));\n\
-                 \x20   textureStore(output, coord, vec4<f32>(encode_output(c), 1.0));",
-                crate::operation::primaries_conversion(output)
-            ),
-        )
-    } else {
-        (
-            "rgba16float",
-            "    // Another linear intermediate: no clip and no encode, because\n\
-             \x20   // the pass after this one still has to read real values.\n\
-             \x20   //\n\
-             \x20   // `aux` rides in alpha. A pass that never touches it hands on\n\
-             \x20   // whatever it was given, so the lane costs an operation that\n\
-             \x20   // does not want it exactly one copy of a value it already read.\n\
-             \x20   textureStore(output, coord, vec4<f32>(c, aux));"
-                .to_string(),
-        )
-    };
-
-    let encode_fn = if writes_output {
-        crate::operation::encode_output_fn(output)
-    } else {
-        String::new()
-    };
+    // Every pass writes another linear intermediate: no clip and no encode,
+    // because the view pass after the last one still has to read real values
+    // (D19). `aux` rides in alpha. A pass that never touches it hands on
+    // whatever it was given, so the lane costs an operation that does not want
+    // it exactly one copy of a value it already read.
+    let store_format = "rgba16float";
+    let tail = "    textureStore(output, coord, vec4<f32>(c, aux));";
 
     let label = format!("{id}/{}", pass.label);
     let indented = body
@@ -823,7 +791,7 @@ fn compose_one(
 // way back to a coordinate.
 //
 // In:  linear sRGB, scene-referred, **unclipped**, at render resolution.
-// Out: {}
+// Out: the same, for the next pass or for the view pass after the last.
 
 struct Params {{
 {uniform_fields}}}
@@ -907,7 +875,7 @@ fn reduced_at(coord: vec2<i32>) -> f32 {{
     return mix(mix(s00, s10, f.x), mix(s01, s11, f.x), f.y);
 }}
 
-{helper_src}{encode_fn}
+{helper_src}
 @compute @workgroup_size(8, 8, 1)
 fn main(@builtin(global_invocation_id) gid: vec3<u32>) {{
     let dims = textureDimensions(output);
@@ -936,12 +904,7 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {{
 
 {tail}
 }}
-",
-        if writes_output {
-            "display-encoded, in the output space."
-        } else {
-            "linear sRGB, for the next pass."
-        },
+"
     );
 
     let structure_hash = crate::operation::hash_source(&source);
@@ -956,7 +919,6 @@ fn main(@builtin(global_invocation_id) gid: vec3<u32>) {{
         // dispatch size and a declaration is data, which since FR-PLG-2 can
         // come from a file this build did not write.
         output_scale: pass.output_scale.max(1),
-        writes_output,
         structure_hash,
     }
 }
@@ -1013,6 +975,21 @@ mod tests {
         assert!((export.frame_fraction(0.01) - 40.0).abs() < 0.5);
     }
 
+    #[test]
+    fn a_frame_fraction_does_not_shrink_with_the_zoom_or_the_tile() {
+        // TRACES: FR-DSP-1 | FR-DSP-2
+        // A 6000×4000 frame. At fit in a 1500×1000 panel, 1% of it is 10
+        // render pixels; zoomed to 1:1 on a 1500×1000 corner of it, the same
+        // 1% is 40 — the 40 the file gets — and an export tile of that corner
+        // must say 40 too, or each tile draws its own halo and the seams show.
+        let fit = RenderScale::new((1500, 1000), (6000, 4000));
+        assert!((fit.frame_fraction(0.01) - 10.0).abs() < 1e-3);
+        let zoomed = RenderScale::new((1500, 1000), (1500, 1000)).within((6000, 4000));
+        assert!((zoomed.frame_fraction(0.01) - 40.0).abs() < 1e-3);
+        let tile = RenderScale::full((1024, 1024)).within((6000, 4000));
+        assert!((tile.frame_fraction(0.01) - 40.0).abs() < 1e-3);
+    }
+
     #[test]
     fn zooming_to_one_to_one_makes_the_preview_exact() {
         // The reason there is no separate full-resolution preview path: the
@@ -1095,27 +1072,19 @@ mod tests {
         // dispatch. An unedited photograph must not pay for a sharpener it is
         // not using.
         let ops = with_blur(0.0);
-        let composed = compose_detail(
-            &ops,
-            RenderScale::full((512, 512)),
-            dr_types::ColourSpace::Srgb,
-        );
+        let composed = compose_detail(&ops, RenderScale::full((512, 512)));
         assert!(composed.is_empty());
         assert_eq!(fused(&ops).output_mode, OutputMode::Encoded);
     }
 
     #[test]
-    fn a_separable_blur_becomes_two_passes_and_only_the_last_encodes() {
-        // The multi-pass case, which is the one the ping-pong exists for. The
-        // first pass writes a linear intermediate and the second writes the
-        // display texture — so the output transform happens exactly once, at
-        // the end, wherever the end happens to be.
+    fn a_separable_blur_becomes_two_passes_and_neither_encodes() {
+        // The multi-pass case, which is the one the ping-pong exists for. Both
+        // passes write linear intermediates, and the fused pass's view pass
+        // reads the second and performs the view transform and the output
+        // transform — so those happen exactly once, after every kernel (D19).
         let ops = with_blur(0.05);
-        let composed = compose_detail(
-            &ops,
-            RenderScale::full((512, 512)),
-            dr_types::ColourSpace::Srgb,
-        );
+        let composed = compose_detail(&ops, RenderScale::full((512, 512)));
         assert_eq!(composed.len(), 2);
 
         let first = &composed.passes[0];
@@ -1123,13 +1092,16 @@ mod tests {
         assert_eq!(first.label, "detail_probe/horizontal");
         assert_eq!(last.label, "detail_probe/vertical");
 
-        assert!(!first.writes_output);
-        assert!(first.source.contains("texture_storage_2d<rgba16float"));
-        assert!(!first.source.contains("fn encode_output"));
-
-        assert!(last.writes_output);
-        assert!(last.source.contains("texture_storage_2d<rgba8unorm"));
-        assert!(last.source.contains("fn encode_output"));
+        for pass in [first, last] {
+            assert!(pass.source.contains("texture_storage_2d<rgba16float"));
+            assert!(!pass.source.contains("fn encode_output"));
+            assert!(!pass.source.contains("view_sigmoid"));
+        }
+        let view = fused(&ops)
+            .view
+            .expect("a view pass follows the detail stage");
+        assert!(view.source.contains("fn encode_output"));
+        assert!(view.source.contains("c = view_sigmoid("));
 
         // Two passes of one operation are two shaders, so they must not share
         // a pipeline-cache entry — the classic way a second pass silently runs
@@ -1143,11 +1115,7 @@ mod tests {
         // and the composer rewrites it to a prefixed struct field, so two
         // operations may both call a uniform `radius` and neither has to know.
         let ops = with_blur(0.05);
-        let composed = compose_detail(
-            &ops,
-            RenderScale::full((512, 512)),
-            dr_types::ColourSpace::Srgb,
-        );
+        let composed = compose_detail(&ops, RenderScale::full((512, 512)));
         let src = &composed.passes[0].source;
         assert!(src.contains("detail_probe_0_radius: f32,"));
         assert!(src.contains("let r = i32(u.detail_probe_0_radius);"));
@@ -1164,13 +1132,7 @@ mod tests {
         // outright by the WGSL uniform address space rules, and the failure
         // arrives as a shader compilation error against generated source.
         let ops = with_blur(0.05);
-        for pass in compose_detail(
-            &ops,
-            RenderScale::full((512, 512)),
-            dr_types::ColourSpace::Srgb,
-        )
-        .passes
-        {
+        for pass in compose_detail(&ops, RenderScale::full((512, 512))).passes {
             assert_eq!(pass.uniforms.len() % 4, 0, "{}", pass.label);
             assert!(pass.uniforms.iter().all(|v| v.is_finite()));
             // The base block is first and fixed, so a pass never addresses a
@@ -1189,7 +1151,7 @@ mod tests {
         // the truth rather than zero.
         let ops = with_blur(0.05);
         let scale = RenderScale::full((400, 400));
-        let composed = compose_detail(&ops, scale, dr_types::ColourSpace::Srgb);
+        let composed = compose_detail(&ops, scale);
         let expected = BoxBlur::with_radius(0.05).kernel(scale);
         assert_eq!(expected, 20, "5% of a 400px edge");
         assert_eq!(composed.radius(), expected);
@@ -1208,7 +1170,7 @@ mod tests {
             .iter()
             .map(|&(w, h)| {
                 let scale = RenderScale::full((w, h));
-                let composed = compose_detail(&ops, scale, dr_types::ColourSpace::Srgb);
+                let composed = compose_detail(&ops, scale);
                 composed.radius() as f32 / w.min(h) as f32
             })
             .collect();
@@ -1226,14 +1188,14 @@ mod tests {
         // cannot see each other. `compose_full` decides to hand on linear
         // working values from the *operations* — it has no resolution to
         // consult — while this composer converts a radius and can legitimately
-        // decide there is nothing to draw at this size. An empty chain would
-        // then leave the output transform undone: the fused pass writes
-        // `rgba16float` and the frontend binds an `rgba8unorm` target to it.
+        // decide there is nothing to draw at this size.
         //
         // A photographer meets this by turning on capture sharpening or
         // luminance noise reduction while the develop view is fitted to a
-        // large file, which is the normal way to work, so it is not an edge
-        // case that can be left to fail.
+        // large file, which is the normal way to work. Before D19 an empty
+        // chain left the output transform undone and needed a resolve pass;
+        // now the view pass does the output transform whatever the chain
+        // holds.
         let ops = with_blur(0.001);
         let scale = RenderScale::full((400, 400));
         assert!(ops.last().expect("the blur").is_active());
@@ -1243,74 +1205,59 @@ mod tests {
             "the premise: a radius too small to draw emits no pass"
         );
 
-        let composed = compose_detail(&ops, scale, dr_types::ColourSpace::Srgb);
-        assert_eq!(composed.len(), 1, "the chain must not be empty here");
-        assert_eq!(composed.radius(), 0, "it reads only the pixel it writes");
-
-        let resolve = &composed.passes[0];
-        assert_eq!(resolve.label, "detail/resolve");
-        assert!(resolve.writes_output);
-        assert!(resolve.source.contains("texture_storage_2d<rgba8unorm"));
-        assert!(resolve.source.contains("fn encode_output"));
-        // Exactly the fixed base block and no more: a pass with no body has
-        // nothing of its own to upload, and the block still has to be a
-        // multiple of sixteen bytes.
-        assert_eq!(resolve.uniforms.len(), DETAIL_BASE_UNIFORM_FIELDS);
-        assert_eq!(resolve.uniforms.len() % 4, 0);
-
-        // And it really is a copy: the fused pass composed alongside it is the
-        // one that stopped short, so the two agree about who encodes.
-        assert_eq!(fused(&ops).output_mode, OutputMode::LinearWorking);
+        // Empty, and that is fine since D19: nothing in the chain encodes, so
+        // there is no output transform for an empty chain to leave undone.
+        // The fused pass stopped at linear values and its view pass reads
+        // them directly.
+        let composed = compose_detail(&ops, scale);
+        assert!(composed.is_empty());
+        let fused = fused(&ops);
+        assert_eq!(fused.output_mode, OutputMode::LinearWorking);
+        let view = fused
+            .view
+            .expect("the view pass performs the output transform");
+        assert_eq!(view.output_mode, OutputMode::Encoded);
+        assert!(view.source.contains("fn encode_output"));
     }
 
     #[test]
     fn a_pass_that_changes_nothing_is_dropped_where_that_is_exact() {
         // TRACES: NFR-P5
-        // Capture sharpening at a scale too coarse to draw its radius emits a
-        // pass with an empty body. Between two other passes it costs a
-        // render-sized read and write and changes no texel, so it goes; as the
-        // last pass it performs the output transform on the intermediate, and
-        // moving that onto the pass before would round differently, so it
-        // stays.
-        use crate::ops::{capture_sharpen, CaptureSharpen, NoiseReduction};
-        let sharpen = || -> Box<dyn Operation> {
-            let mut op = CaptureSharpen::new();
-            op.set_param(capture_sharpen::AMOUNT, 60.0);
-            Box::new(op)
-        };
+        // A pass with an empty body costs a render-sized read and write and
+        // changes no texel, so it goes — wherever it falls since D19, the last
+        // position included, because the last pass writes an intermediate like
+        // every other and the view pass reads whichever the chain last wrote.
+        // Built by hand, and run as a repair so it goes first: no operation
+        // emits one any more (capture sharpening at a scale too coarse to draw
+        // its radius used to, and now emits nothing).
+        use crate::ops::NoiseReduction;
         let chroma = || -> Box<dyn Operation> { Box::new(NoiseReduction::with_amounts(0.0, 60.0)) };
-        // A 24 MP frame fitted to a panel: a one-source-pixel radius is a
-        // quarter of a render pixel.
         let scale = RenderScale::new((1500, 1000), (6000, 4000));
-        let unresolved = sharpen().detail().expect("a detail stage").passes(scale);
-        assert!(
-            unresolved.len() == 1 && unresolved[0].is_identity(),
-            "the premise: sharpening at this scale is one pass that does nothing"
-        );
-        let labels = |ops: &[Box<dyn Operation>]| -> Vec<String> {
-            compose_detail(ops, scale, dr_types::ColourSpace::Srgb)
+        let nothing = DetailPass {
+            output_scale: 1,
+            label: "nothing",
+            radius: 0,
+            wgsl: "// `c` already holds this pixel.".to_string(),
+            uniforms: Vec::new(),
+            storage: Vec::new(),
+        };
+        assert!(nothing.is_identity(), "the premise");
+        let labels: Vec<String> =
+            compose_detail_with(&[chroma()], std::slice::from_ref(&nothing), scale)
                 .passes
                 .iter()
                 .map(|p| p.label.clone())
-                .collect()
-        };
-
-        // First, ahead of the chroma passes: dropped.
-        let first = labels(&[sharpen(), chroma()]);
+                .collect();
         assert_eq!(
-            first,
+            labels,
             [
                 "noise_reduction/chroma-horizontal",
                 "noise_reduction/chroma-vertical"
             ]
         );
-        // Last, after them: kept, and it is the pass that encodes.
-        let last = labels(&[chroma(), sharpen()]);
-        assert_eq!(last.len(), 3);
-        assert_eq!(last[2], "capture_sharpen/unresolved");
-        // Alone: kept, because the fused pass stopped short and something has
-        // to finish the frame.
-        assert_eq!(labels(&[sharpen()]), ["capture_sharpen/unresolved"]);
+        // Alone: dropped too, and the chain is empty — the view pass
+        // finishes the frame.
+        assert!(compose_detail_with(&[], &[nothing], scale).is_empty());
     }
 
     #[test]
@@ -1325,11 +1272,7 @@ mod tests {
         // A pass that says nothing about `aux` hands on what it was given,
         // which is why the box blur below needs no knowledge of it.
         let ops = with_blur(0.05);
-        let composed = compose_detail(
-            &ops,
-            RenderScale::full((512, 512)),
-            dr_types::ColourSpace::Srgb,
-        );
+        let composed = compose_detail(&ops, RenderScale::full((512, 512)));
 
         for pass in &composed.passes {
             assert!(
@@ -1344,11 +1287,12 @@ mod tests {
                 .contains("textureStore(output, coord, vec4<f32>(c, aux));"),
             "an intermediate must carry the lane to the pass after it"
         );
-        // The last pass writes the display texture, whose alpha is opacity and
-        // not scratch space. Readable there, not written — which is the right
-        // way round, because the combining pass is the one that reads it.
-        assert!(composed.passes[1].writes_output);
-        assert!(!composed.passes[1].source.contains("vec4<f32>(c, aux)"));
+        // The last pass carries it too: since D19 it writes an intermediate
+        // for the view pass rather than the display texture, whose alpha is
+        // opacity. The view pass reads only the colour.
+        assert!(composed.passes[1]
+            .source
+            .contains("textureStore(output, coord, vec4<f32>(c, aux));"));
     }
 
     #[test]
@@ -1357,11 +1301,7 @@ mod tests {
         // overwhelmingly common edit: no sharpening means no chain, which
         // means `dr-gpu` runs the single fused dispatch it always did.
         let ops = crate::ops::chain();
-        let composed = compose_detail(
-            &ops,
-            RenderScale::full((64, 64)),
-            dr_types::ColourSpace::Srgb,
-        );
+        let composed = compose_detail(&ops, RenderScale::full((64, 64)));
         assert!(composed.is_empty());
         assert_eq!(composed.radius(), 0);
     }

core/dr-pipeline/src/framing.rs

@@ -260,8 +260,9 @@ impl CropRect {
     ///
     /// `anchor` is the point of the rect that stays put, in the rect's own
     /// `0..1` coordinates: `(1.0, 1.0)` while the top-left handle is dragged,
-    /// so the far corner is the one that does not move, and `(0.5, 0.5)` when
-    /// a ratio is chosen and the composition should stay where it is.
+    /// so the far corner is the one that does not move, `(0.0, 0.5)` while
+    /// the right-hand edge is dragged, and `(0.5, 0.5)` when a ratio is
+    /// chosen and the composition should stay where it is.
     ///
     /// **The rect grows onto the ratio rather than shrinking onto it.** The
     /// axis that is short is extended; the long one is never trimmed. Fitting
@@ -269,6 +270,7 @@ impl CropRect {
     /// along one axis alone would be immediately clamped back by the other,
     /// and the handle would simply refuse to move. The result is then scaled
     /// down, both axes together, only as far as the frame's edge demands.
+    /// The exception is an edge: see the note in the body.
     pub fn with_aspect(self, frame_w: u32, frame_h: u32, ratio: f32, anchor: (f32, f32)) -> Self {
         let rect = self.normalised();
         let ratio = finite(ratio, 0.0);
@@ -286,8 +288,19 @@ impl CropRect {
         let px = rect.x + ax * rect.width;
         let py = rect.y + ay * rect.height;
 
-        let mut w = rect.width.max(rect.height * r);
-        let mut h = w / r;
+        // An anchor in the middle of one side is an *edge* being dragged, and
+        // then the axis across that edge leads: it is the only one the user
+        // moved. Growing the short axis instead would take the other side
+        // for the leader whenever the edge went inward, and the edge would be
+        // pushed straight back out — a handle that only ever grows the crop.
+        let (mut w, mut h) = if ax == 0.5 && ay != 0.5 {
+            (rect.height * r, rect.height)
+        } else if ay == 0.5 && ax != 0.5 {
+            (rect.width, rect.width / r)
+        } else {
+            let w = rect.width.max(rect.height * r);
+            (w, w / r)
+        };
 
         // Scaled to fit, never clamped to fit: clamping one axis against the
         // frame would break the very ratio this exists to hold.
@@ -1298,7 +1311,8 @@ impl Framing {
         // count active stages, and a neutral graph must generate none.
         if !self.is_active() {
             return "    // Source position, normalised and centred: the whole frame, unrotated.
-    let src_dims = textureDimensions(source);
+    let tex_dims = textureDimensions(source);
+    let src_dims = select(tex_dims, vec2<u32>(u.source_full.xy), u.source_full.x > 0.5);
     let aspect = vec2<f32>(f32(src_dims.x) / f32(src_dims.y), 1.0);
     let uv = (vec2<f32>(gid.xy) + vec2<f32>(0.5)) / vec2<f32>(dims);
     var p = (uv - vec2<f32>(0.5)) * aspect;
@@ -1314,7 +1328,8 @@ impl Framing {
     // warp chain expects: the centre is (0, 0) and the radius is 1 at the
     // corner. Working here rather than in pixels is what makes the map
     // independent of the resolution being rendered at.
-    let src_dims = textureDimensions(source);
+    let tex_dims = textureDimensions(source);
+    let src_dims = select(tex_dims, vec2<u32>(u.source_full.xy), u.source_full.x > 0.5);
     let aspect = vec2<f32>(f32(src_dims.x) / f32(src_dims.y), 1.0);
     var uv = (vec2<f32>(gid.xy) + vec2<f32>(0.5)) / vec2<f32>(dims);
 ",
@@ -2253,6 +2268,42 @@ mod tests {
         assert!((c.y - start.y).abs() < 1e-5, "{c:?}");
     }
 
+    #[test]
+    fn a_locked_edge_leads_and_the_far_side_stays_put() {
+        // An edge dragged inward under a lock must narrow the crop. With the
+        // short axis leading, the untouched height would win and push the
+        // edge straight back out.
+        let start = CropRect {
+            x: 0.2,
+            y: 0.2,
+            width: 0.4,
+            height: 0.6,
+        };
+        // Right edge held, dragged in: the left side and the vertical
+        // centre stay, the width is what was asked for.
+        let c = start.with_aspect(4000, 4000, 1.0, (0.0, 0.5));
+        assert!((c.x - start.x).abs() < 1e-5, "{c:?}");
+        assert!((c.width - start.width).abs() < 1e-5, "{c:?}");
+        assert!((c.height - start.width).abs() < 1e-5, "{c:?}");
+        assert!(
+            (c.y + c.height / 2.0 - (start.y + start.height / 2.0)).abs() < 1e-5,
+            "{c:?}"
+        );
+
+        // Top edge held: the bottom and the horizontal centre stay, the
+        // height is what was asked for.
+        let c = start.with_aspect(4000, 4000, 1.0, (0.5, 1.0));
+        assert!(
+            (c.y + c.height - (start.y + start.height)).abs() < 1e-5,
+            "{c:?}"
+        );
+        assert!((c.width - c.height).abs() < 1e-5, "{c:?}");
+        assert!(
+            (c.x + c.width / 2.0 - (start.x + start.width / 2.0)).abs() < 1e-5,
+            "{c:?}"
+        );
+    }
+
     #[test]
     fn a_locked_rect_grows_onto_the_ratio_rather_than_shrinking_onto_it() {
         // Shrinking to fit makes a one-axis drag do nothing at all: the other

core/dr-pipeline/src/graph.rs

@@ -83,6 +83,13 @@ impl ParamCapability {
     }
 }
 
+/// TRACES: FR-DSP-2
+/// How far past the framing's own footprint [`EditGraph::source_region`]
+/// reaches when a lens warp is active, as a fraction of the frame on each
+/// side. Distortion profiles move a corner by a few per cent of the frame; a
+/// window short of what the warp reads would render the missing strip black.
+pub const WARP_MARGIN: f32 = 0.04;
+
 /// An ordered pipeline of operations, plus how the result is framed.
 pub struct EditGraph {
     ops: Vec<Box<dyn Operation>>,
@@ -292,6 +299,57 @@ impl EditGraph {
         self.framing.output_size(width, height)
     }
 
+    /// TRACES: FR-DSP-2 | NFR-RES-2
+    /// The part of the source the visible region reads, as a rectangle in
+    /// normalised source coordinates, clamped to the frame.
+    ///
+    /// For a photograph larger than one texture: a render of part of it —
+    /// the canvas zoomed in, one tile of an export — binds only this window
+    /// of the source (see `dr_pipeline::SOURCE_WINDOW_UNIFORM_FIELDS`).
+    ///
+    /// The framing is walked on the CPU with [`Framing::source_at`], along
+    /// the border and across the interior, so a straightened or keystoned
+    /// view gets the box around the quadrilateral it actually reads. The lens
+    /// warps have no CPU mirror, so when one is active the box is widened
+    /// by [`WARP_MARGIN`] of the frame on each side: a distortion profile
+    /// moves a corner by a few per cent of the frame at most. `halo`, in
+    /// source pixels, is added on top — the detail stage's reach, which reads
+    /// beyond the pixels it writes.
+    pub fn source_region(&self, source: (u32, u32), halo: u32) -> crate::framing::CropRect {
+        const STEPS: usize = 16;
+        let (sw, sh) = (source.0.max(1), source.1.max(1));
+        let (mut x0, mut y0, mut x1, mut y1) = (f32::MAX, f32::MAX, f32::MIN, f32::MIN);
+        for j in 0..=STEPS {
+            for i in 0..=STEPS {
+                let out = (i as f32 / STEPS as f32, j as f32 / STEPS as f32);
+                let (x, y) = self.framing.source_at(out, sw, sh);
+                x0 = x0.min(x);
+                y0 = y0.min(y);
+                x1 = x1.max(x);
+                y1 = y1.max(y);
+            }
+        }
+        let warp = if crate::lens::compose_warps(&self.warps).is_active() {
+            WARP_MARGIN
+        } else {
+            0.0
+        };
+        // Two pixels beyond the halo: the bilinear tap's second texel, and
+        // the rounding of the box to whole pixels by the caller.
+        let px = (halo as f32 + 2.0) / sw as f32;
+        let py = (halo as f32 + 2.0) / sh as f32;
+        let x0 = (x0 - warp - px).clamp(0.0, 1.0);
+        let y0 = (y0 - warp - py).clamp(0.0, 1.0);
+        let x1 = (x1 + warp + px).clamp(0.0, 1.0);
+        let y1 = (y1 + warp + py).clamp(0.0, 1.0);
+        crate::framing::CropRect {
+            x: x0,
+            y: y0,
+            width: (x1 - x0).max(0.0),
+            height: (y1 - y0).max(0.0),
+        }
+    }
+
     /// Descriptors for every operation, in order.
     ///
     /// Operations only — framing is not one, and is reached through
@@ -952,46 +1010,35 @@ impl EditGraph {
             ((fw as f32 * view.width).round() as u32).max(1),
             ((fh as f32 * view.height).round() as u32).max(1),
         );
-        crate::detail::RenderScale::new(render, full)
+        crate::detail::RenderScale::new(render, full).within((fw, fh))
     }
 
     /// TRACES: FR-DEV-3 | FR-DSP-1
-    /// Generate the detail stage for this edit at one resolution, to sRGB.
+    /// Generate the detail stage for this edit at one resolution.
     ///
     /// Empty for every edit with no active neighbourhood operation, which is
     /// almost all of them — and in that case [`Self::compose`] emits the
     /// single encoded dispatch it always has.
-    pub fn compose_detail(
-        &self,
-        source: (u32, u32),
-        render: (u32, u32),
-    ) -> crate::detail::ComposedDetail {
-        self.compose_detail_for(source, render, dr_types::ColourSpace::Srgb)
-    }
-
-    /// TRACES: FR-EXP-2
-    /// The detail stage, encoded into a chosen output space.
     ///
-    /// The space belongs here as well as on [`Self::compose_for`] because when
-    /// a detail stage exists it is the *last* pass that performs the output
-    /// transform — the fused pass stops at linear working values. Composing
-    /// the two halves for different spaces would encode the edit twice, or
-    /// not at all.
+    /// No output space: since D19 no detail pass encodes. The fused pass's
+    /// view pass reads what the last one wrote and performs the view transform
+    /// and the output transform, so it is [`Self::compose_for`] alone that
+    /// names the space.
+    ///
     /// `source` is the demosaiced image's size and `render` the size being
     /// drawn. The scale is worked out here rather than handed in, because the
     /// repairs need the *source* size as well — a spot is stored in normalised
     /// source coordinates and has to be put through the framing to find out
     /// where it lands on this render, and a [`crate::detail::RenderScale`]
     /// describes the region on screen rather than the photograph.
-    pub fn compose_detail_for(
+    pub fn compose_detail(
         &self,
         source: (u32, u32),
         render: (u32, u32),
-        output: dr_types::ColourSpace,
     ) -> crate::detail::ComposedDetail {
         let scale = self.render_scale(source, render);
         let spots = self.spots.passes(&self.framing, source, scale);
-        crate::detail::compose_detail_with(&self.ops, &spots, scale, output)
+        crate::detail::compose_detail_with(&self.ops, &spots, scale)
     }
 
     /// TRACES: FR-DEV-3d
@@ -1122,13 +1169,21 @@ mod tests {
     fn a_fresh_graph_is_neutral() {
         // Opening an unedited image must produce the image, not an
         // interpretation of it.
+        //
+        // One block, and it is the view transform: a view operation is
+        // composed at its defaults, because a photograph with no view
+        // transform is a scan rather than a picture (FR-DEV-3j). It is still
+        // neutral in the sense that matters here — nothing moved, nothing is
+        // written — and every adjustment is absent.
         let g = EditGraph::default_chain();
         assert!(g.is_neutral());
+        let source = g.compose().source;
         assert_eq!(
-            g.compose().source.matches("---- ").count(),
-            0,
-            "a neutral graph must generate no operation blocks"
+            source.matches("---- ").count(),
+            1,
+            "a neutral graph must generate no adjustment blocks"
         );
+        assert!(source.contains("---- view_transform ----"));
     }
 
     #[test]
@@ -1207,13 +1262,15 @@ mod tests {
     #[test]
     fn only_active_operations_reach_the_shader() {
         // The composition property, end to end: two adjustments out of seven
-        // available must generate a shader doing exactly two things.
+        // available must generate a shader doing exactly two things — and
+        // the view transform, which every render has (FR-DEV-3j).
         let mut g = EditGraph::default_chain();
         g.set_param(exposure::ID, exposure::EXPOSURE, 1.0);
         g.set_param(white_balance::ID, white_balance::TINT, 25.0);
 
         let shader = g.compose();
-        assert_eq!(shader.source.matches("---- ").count(), 2);
+        assert_eq!(shader.source.matches("---- ").count(), 3);
+        assert!(shader.source.contains("---- view_transform ----"));
         assert!(shader.source.contains("---- exposure ----"));
         assert!(shader.source.contains("---- white_balance ----"));
         assert!(!shader.source.contains("---- saturation ----"));

core/dr-pipeline/src/lib.rs

@@ -50,6 +50,8 @@ pub mod preset;
 pub mod sidecar;
 pub mod spot;
 pub mod state;
+pub mod tiles;
+pub mod view;
 
 pub use coverage::Coverage;
 pub use declared::{Declaration, DeclaredOp};
@@ -66,8 +68,8 @@ pub use history::{Edit, Entry as HistoryEntry, History, Step};
 pub use lens::{compose_warps, ComposedWarp, LensProfile, Tca, Warp};
 pub use operation::{
     compose, compose_with_framing, Affects, ComposedShader, Helper, Invalidation, Operation,
-    OutputMode, Uniform, BASE_CURVE_POINTS, BASE_CURVE_UNIFORM_OFFSET, CLIP_ONSET,
-    RESERVED_UNIFORM_FIELDS, SAMPLE_CACHE_UNIFORM_OFFSET,
+    OutputMode, Stage, Uniform, CLIP_ONSET, RESERVED_UNIFORM_FIELDS, SAMPLE_CACHE_UNIFORM_OFFSET,
+    SOURCE_WINDOW_UNIFORM_FIELDS, SOURCE_WINDOW_UNIFORM_OFFSET, WHOLE_SOURCE_WINDOW,
 };
 pub use preset::{LibraryParseError, NameError, Preset, PresetLibrary, Reach, Scope};
 pub use sidecar::{Sidecar, Version};
@@ -169,7 +171,21 @@ mod tests {
         let mut fused_blocks = 0;
         for desc in g.descriptors() {
             let id = desc.id.0;
-            let point = shader.source.contains(&format!("---- {id} ----"));
+            // The film is loaded here, and a stock is a rendering: the view
+            // transform it replaces is correctly in neither stage (FR-DEV-3f,
+            // FR-DEV-3j).
+            if id == crate::ops::view_transform::ID.0 {
+                assert!(!shader.source.contains("---- view_transform ----"));
+                continue;
+            }
+            // A view operation is in the view pass when a detail stage
+            // follows, which it does here (D19).
+            let block = format!("---- {id} ----");
+            let point = shader.source.contains(&block)
+                || shader
+                    .view
+                    .as_ref()
+                    .is_some_and(|v| v.source.contains(&block));
             let neighbourhood = detail
                 .passes
                 .iter()
@@ -182,8 +198,12 @@ mod tests {
             );
             fused_blocks += usize::from(point);
         }
+        let view_blocks = shader
+            .view
+            .as_ref()
+            .map_or(0, |v| v.source.matches("---- ").count());
         assert_eq!(
-            shader.source.matches("---- ").count(),
+            shader.source.matches("---- ").count() + view_blocks,
             fused_blocks,
             "the fused shader carries a block nothing in the chain asked for"
         );

core/dr-pipeline/src/mask.rs

@@ -2068,8 +2068,8 @@ pub(crate) struct LayerShader {
     ///
     /// Kept apart from the rest because it belongs at the other end of the
     /// shader. Everything else runs on scene-referred colour in the working
-    /// space, where a flat tint would then be pushed through the base curve
-    /// and the camera matrix and arrive as some other colour, and a
+    /// space, where a flat tint would then be pushed through the view
+    /// transform and arrive as some other colour, and a
     /// white-on-black alpha would arrive as neither. This runs after the
     /// output transform, so what is written is what is seen.
     pub reveal: String,

core/dr-pipeline/src/neutral.rs

@@ -82,8 +82,8 @@ const FLOOR: f32 = 1e-4;
 /// Move the graph so that `sample` renders neutral.
 ///
 /// `sample` is the linear triple the operation's own gains multiply — camera
-/// RGB with the camera's as-shot balance on, *before* the body's base curve
-/// and matrix, and with the sampling operation at its defaults. Not the
+/// RGB with the camera's as-shot balance on, *before* the camera matrix and
+/// the view transform, and with the sampling operation at its defaults. Not the
 /// pixel on the screen: the matrix mixes the channels on the way there, so
 /// a colour read after it does not answer to these gains, and a solve over
 /// one lands somewhere no sample asked for. Returns whether the graph was

core/dr-pipeline/src/ops/capture_sharpen.rs

@@ -347,8 +347,15 @@ impl Operation for CaptureSharpen {
 
 impl DetailStage for CaptureSharpen {
     fn passes(&self, scale: RenderScale) -> Vec<DetailPass> {
+        // A radius finer than one pixel of this render: the detail it would
+        // act on is not in this texture — it was lost to the downscale before
+        // this stage ran (FR-DSP-1). Guessing at it would put sharpening on
+        // screen that the exported file will not contain, so there is no
+        // pass, and the interface is free to say `zoom to 1:1`. An empty
+        // chain is a whole render since D19: the fused pass's view pass
+        // performs the output transform whatever the chain holds.
         if !self.resolves(scale) {
-            return vec![nothing_to_sharpen()];
+            return Vec::new();
         }
 
         let extent = self.kernel(scale);
@@ -396,41 +403,6 @@ impl DetailStage for CaptureSharpen {
     }
 }
 
-/// The pass emitted when the radius is finer than a render pixel.
-///
-/// One dispatch that changes nothing, rather than an empty chain, and the
-/// difference is not stylistic. [`crate::operation::compose_full`] decides
-/// from the *operations* — before any resolution is known — that an active
-/// detail operation means the fused pass hands on unclipped linear values
-/// instead of encoding its own output. If this returned no passes at all,
-/// that decision would still stand and nothing downstream would ever perform
-/// the output transform: `dr-gpu` would be handed a linear-working shader
-/// with an empty chain and refuse it.
-///
-/// So the honest "nothing survives at this scale" still has to carry the
-/// encode, and one pass that does only that is exactly the resolve step the
-/// stage would otherwise need. It costs a single copy of a proxy-sized
-/// texture, which is a rounding error against the dispatches around it.
-fn nothing_to_sharpen() -> DetailPass {
-    DetailPass {
-        output_scale: 1,
-        label: "unresolved",
-        // Reads only the pixel it writes, so a tile needs no halo at all.
-        radius: 0,
-        // A convolution, not a list: nothing to bind at binding 3.
-        storage: Vec::new(),
-        uniforms: Vec::new(),
-        wgsl: "// The chosen radius is finer than one pixel of this render, so the detail
-// it would act on is not in this texture — it was lost to the downscale
-// before this stage ran (FR-DSP-1). Guessing at it would put sharpening on
-// screen that the exported file will not contain, so this pass passes the
-// colour through unchanged and the interface is free to say `zoom to 1:1`.
-//
-// `c` already holds this pixel; leaving it alone is the whole body."
-            .to_string(),
-    }
-}
-
 /// One axis of the separable unsharp mask.
 ///
 /// Emitted verbatim for both passes — see [`DetailStage::passes`] for why the
@@ -528,7 +500,6 @@ c = select(c, scaled, centre > 1e-5);"#;
 mod tests {
     use super::*;
     use crate::EditGraph;
-    use dr_types::ColourSpace;
 
     /// The develop chain with the sharpener turned up.
     ///
@@ -549,7 +520,7 @@ mod tests {
         // The scale is what these tests vary, so it is rebuilt into the two
         // sizes it stands for rather than handed over: a render of the full
         // frame at `render_size`, from a source of `full_size`.
-        graph.compose_detail_for(scale.full_size(), scale.render_size(), ColourSpace::Srgb)
+        graph.compose_detail(scale.full_size(), scale.render_size())
     }
 
     #[test]
@@ -591,13 +562,11 @@ mod tests {
         assert_eq!(first.label, "capture_sharpen/horizontal");
         assert_eq!(last.label, "capture_sharpen/vertical");
 
-        assert!(!first.writes_output);
-        assert!(first.source.contains("texture_storage_2d<rgba16float"));
-        assert!(!first.source.contains("fn encode_output"));
-
-        assert!(last.writes_output);
-        assert!(last.source.contains("texture_storage_2d<rgba8unorm"));
-        assert!(last.source.contains("fn encode_output"));
+        // Neither encodes: the view pass after the detail stage does (D19).
+        for pass in [first, last] {
+            assert!(pass.source.contains("texture_storage_2d<rgba16float"));
+            assert!(!pass.source.contains("fn encode_output"));
+        }
 
         // Two shaders, so two pipeline-cache entries. Sharing one would run
         // the horizontal pass's uniforms through the vertical pass's slots.
@@ -723,20 +692,11 @@ mod tests {
         let proxy = RenderScale::new((1000, 1000), (4000, 4000));
         assert!(!proxy.resolves(1.0));
 
+        // Empty: since D19 nothing in the detail stage encodes, so a chain
+        // with nothing to draw is a whole render — the fused pass's view pass
+        // finishes it.
         let composed = chain_at(&graph, proxy);
-        // Not empty, though. See `nothing_to_sharpen`: the fused pass has
-        // already been composed to hand on linear values, so *something* must
-        // still perform the output transform.
-        assert_eq!(composed.len(), 1);
-        assert_eq!(composed.radius(), 0, "it reads no neighbours");
-        let pass = &composed.passes[0];
-        assert_eq!(pass.label, "capture_sharpen/unresolved");
-        assert!(pass.writes_output);
-        assert!(pass.source.contains("fn encode_output"));
-        assert!(
-            !pass.source.contains("for (var i ="),
-            "the pass-through must not walk a kernel it has decided not to run"
-        );
+        assert!(composed.is_empty());
 
         // Zooming to 1:1 is what brings it back — the view rect shrinks while
         // the render target keeps its size — so there is no separate

core/dr-pipeline/src/ops/curve.rs

@@ -488,6 +488,36 @@ fn curve_eval(
 }",
 };
 
+/// TRACES: FR-DEV-2
+/// The curve continued past its last point, for scene values above the
+/// widget's axis.
+const CURVE_EXTEND: Helper = Helper {
+    name: "curve_extend",
+    source: "\
+// A five-point curve at `x`, continued past its last point along the slope of
+// its last span.
+//
+// The widget draws a 0..1 axis, and scene-referred values do not stop at 1
+// (D19): exposure and highlight recovery put them above it, and the view
+// transform after every operation is what brings them down. Flat past the last
+// point — which is what `curve_eval` gives, and what this curve did until
+// D19 — made every one of them the same number, a hard clip in the middle of
+// the chain. Continued along the last span instead, an identity curve stays
+// the identity to any height, and a curve that lifts the highlights keeps
+// lifting them. The slope is the last span's secant, which is also the
+// tangent `curve_eval` gives the last point, so the join is smooth; monotone
+// points make it non-negative.
+fn curve_extend(
+    x0: f32, y0: f32, x1: f32, y1: f32, x2: f32, y2: f32,
+    x3: f32, y3: f32, x4: f32, y4: f32, x: f32,
+) -> f32 {
+    if (x <= x4) {
+        return curve_eval(x0, y0, x1, y1, x2, y2, x3, y3, x4, y4, x);
+    }
+    return y4 + (x - x4) * max((y4 - y3) / (x4 - x3), 0.0);
+}",
+};
+
 /// One colour component through its own curve.
 const CHANNEL_CURVE: Helper = Helper {
     name: "channel_curve",
@@ -504,20 +534,21 @@ const CHANNEL_CURVE: Helper = Helper {
 // it changes the proportions between the components, which is what makes it
 // chromatic where the master is tonal.
 //
-// The clamp is the curve's promise rather than an oversight: its last point
-// *is* white, so a component arriving above the axis takes the value the curve
-// gives at 1. The master does the same to a luminance above 1, through the
-// gain it applies; a channel curve that instead let highlights past unchanged
-// would tint them differently from every tone below them, which reads as a
-// coloured fringe along a blown edge.
+// Above the axis the curve continues along its last span (`curve_extend`),
+// exactly as the master's does, so a highlight is tinted the way every tone
+// just below it is — a component that stopped at the curve's top instead
+// would put a coloured fringe along a blown edge, and flattened every
+// scene-referred highlight into one value besides (D19). Below zero there is
+// no light to curve; the floor is the one clamp left, and it is at zero, not
+// at one.
 fn channel_curve(
     v: f32,
     x0: f32, y0: f32, x1: f32, y1: f32, x2: f32, y2: f32,
     x3: f32, y3: f32, x4: f32, y4: f32,
 ) -> f32 {
-    let encoded = pow(clamp(v, 0.0, 1.0), 1.0 / 2.2);
-    let curved = curve_eval(x0, y0, x1, y1, x2, y2, x3, y3, x4, y4, encoded);
-    return pow(clamp(curved, 0.0, 1.0), 2.2);
+    let encoded = pow(max(v, 0.0), 1.0 / 2.2);
+    let curved = curve_extend(x0, y0, x1, y1, x2, y2, x3, y3, x4, y4, encoded);
+    return pow(max(curved, 0.0), 2.2);
 }",
 };
 
@@ -535,10 +566,11 @@ static MASTER_HELPERS: &[Helper] = &[
     helpers::APPLY_TONE_GAIN,
     CURVE_SPAN,
     CURVE_EVAL,
+    CURVE_EXTEND,
 ];
 
 /// The per-channel curves alone.
-static CHANNEL_HELPERS: &[Helper] = &[CURVE_SPAN, CURVE_EVAL, CHANNEL_CURVE];
+static CHANNEL_HELPERS: &[Helper] = &[CURVE_SPAN, CURVE_EVAL, CURVE_EXTEND, CHANNEL_CURVE];
 
 /// Both.
 static ALL_HELPERS: &[Helper] = &[
@@ -546,6 +578,7 @@ static ALL_HELPERS: &[Helper] = &[
     helpers::APPLY_TONE_GAIN,
     CURVE_SPAN,
     CURVE_EVAL,
+    CURVE_EXTEND,
     CHANNEL_CURVE,
 ];
 
@@ -553,16 +586,17 @@ static ALL_HELPERS: &[Helper] = &[
 const MASTER_BODY: &str = "\
 let luma = luminance(c);
 if (luma > 0.0001) {
-    // The curve is authored on a display-referred 0..1 axis, which is where
-    // the eye reads tone and where the widget's grid lives. Scene-referred
-    // luminance is unbounded, so it is encoded to that axis, curved, and
-    // decoded back — otherwise a point placed at the middle of the grid
-    // would not correspond to the middle of the visible range.
-    let encoded = pow(clamp(luma, 0.0, 1.0), 1.0 / 2.2);
+    // The curve is authored on a 0..1 axis, which is where the widget's grid
+    // lives, with a 2.2 gamma so that a point placed at the middle of the
+    // grid means the middle of the visible range. Scene-referred luminance
+    // does not stop at 1: above the axis the curve continues along its last
+    // span (`curve_extend`) rather than clipping, because the view transform
+    // after every operation is what brings a highlight down (D19).
+    let encoded = pow(luma, 1.0 / 2.2);
 
-    let curved = curve_eval(x0, y0, x1, y1, x2, y2, x3, y3, x4, y4, encoded);
+    let curved = curve_extend(x0, y0, x1, y1, x2, y2, x3, y3, x4, y4, encoded);
 
-    let decoded = pow(clamp(curved, 0.0, 1.0), 2.2);
+    let decoded = pow(max(curved, 0.0), 2.2);
     // Applied as a ratio so hue is preserved, exactly as contrast does.
     c = apply_tone_gain(c, decoded / luma);
 }";
@@ -1288,7 +1322,10 @@ mod tests {
         c.set_param(P2_Y, 0.7);
 
         let body = c.wgsl_body();
-        assert!(body.contains("curve_eval("), "the master curve is missing");
+        assert!(
+            body.contains("curve_extend("),
+            "the master curve is missing"
+        );
         assert!(
             !body.contains("channel_curve("),
             "an untouched channel reached the shader:\n{body}"

core/dr-pipeline/src/ops/dehaze.rs

@@ -541,14 +541,13 @@ c = (c - lifted) / t;";
 mod tests {
     use super::*;
     use crate::detail::compose_detail;
-    use dr_types::ColourSpace;
 
     fn ops(amount: f32) -> Vec<Box<dyn Operation>> {
         vec![Box::new(Dehaze::with_amount(amount))]
     }
 
     fn composed(amount: f32, scale: RenderScale) -> crate::ComposedDetail {
-        compose_detail(&ops(amount), scale, ColourSpace::Srgb)
+        compose_detail(&ops(amount), scale)
     }
 
     #[test]
@@ -658,11 +657,6 @@ mod tests {
         let split = Split::of(Dehaze::with_amount(60.0).patch(RenderScale::full((2000, 1500))));
         assert!(composed.passes.iter().all(|p| p.radius == split.extent()));
 
-        // Only the last writes the display texture, so the output transform
-        // happens exactly once (FR-DEV-2).
-        assert!(!composed.passes[0].writes_output);
-        assert!(composed.passes[1].writes_output);
-
         // Nothing here uses the reduced chain — see the module documentation
         // for why a second operation cannot pick its own `output_scale` while
         // the runner holds one reduced buffer.

core/dr-pipeline/src/ops/film_sim.rs

@@ -1,22 +1,25 @@
 //! TRACES: FR-DEV-3f
 //! Film simulation — the stock renders the picture.
 //!
-//! # Why this one replaces the base curve
+//! # Why this one is the view transform
 //!
-//! [`crate::ops`]' other nodes adjust a picture. This one *makes* it. The base
-//! curve exists because sensor data is scene-referred and nothing anybody looks
-//! at is (FR-DEV-3e); a film stock's characteristic curve does the same job,
-//! from measurements, with a toe and a shoulder that were coated onto acetate
-//! rather than drawn. Running both renders the image twice — the camera's
-//! JPEG-ish rendering, and then a film's rendering of that — which is not what
+//! [`crate::ops`]' other nodes adjust a picture. This one *makes* it. The view
+//! transform exists because sensor data is scene-referred and nothing anybody
+//! looks at is (FR-DEV-3j); a film stock's characteristic curve does the same
+//! job, from measurements, with a toe and a shoulder that were coated onto
+//! acetate rather than drawn. Running both renders the image twice — the
+//! default rendering, and then a film's rendering of that — which is not what
 //! either is for and looks like neither.
 //!
-//! So this node declares [`Operation::renders`], and the composer answers by
-//! emitting neither the base curve nor the camera matrix. Both jobs move here:
-//! the fragment takes camera RGB, converts it to linear sRGB itself with the
-//! matrix already in the uniform block, and returns linear sRGB. That is a
-//! contract worth stating plainly, because a node that got half of it wrong
-//! would produce a picture that renders perfectly and is wrong everywhere.
+//! So this node is in [`Stage::View`] and declares [`Operation::renders`]: when
+//! a stock is loaded the composer puts it at the end of the chain in place of
+//! the default sigmoid (D19). It is handed working-space colour — linear sRGB
+//! primaries, scene-referred, after every other operation and after the detail
+//! stage — and returns display-referred linear sRGB for the output transform.
+//! Before D19 it ran at order 25, after exposure and before everything else,
+//! and the operations below it acted on its output. They now act on the scene
+//! it is shown: an edit is a decision about the exposure the negative
+//! receives, and the film is the last thing that happens to the picture.
 //!
 //! # Why the tables are not parameters
 //!
@@ -34,7 +37,7 @@
 use std::sync::{Arc, LazyLock};
 
 use crate::descriptor::{Attribute, LocalizedKey, OpDescriptor, OpId, ParamDescriptor, ParamId};
-use crate::operation::{Operation, Uniform};
+use crate::operation::{Operation, Stage, Uniform};
 
 pub const ID: OpId = OpId("film_sim");
 pub const EXPOSURE: ParamId = ParamId("exposure");
@@ -304,11 +307,17 @@ impl Operation for FilmSim {
         self.tables.is_some()
     }
 
-    /// This node renders; the camera's own rendering must not also run.
+    /// This node renders; the default view transform must not also run.
     fn renders(&self) -> bool {
         true
     }
 
+    /// TRACES: FR-DEV-3f | FR-DEV-3j
+    /// The view transform's place, at the end of the chain (D19).
+    fn stage(&self) -> Stage {
+        Stage::View
+    }
+
     fn set_film_tables(&mut self, tables: Option<&FilmTables>) {
         self.set_tables(tables.cloned());
     }
@@ -396,14 +405,10 @@ impl Operation for FilmSim {
         // sampler binding, and adding one to interpolate two lookups would
         // cost a binding in every shader whether or not a film is loaded.
         "\
-// Camera RGB to linear sRGB. The film's exposure matrix is defined against
-// sRGB primaries, and this node has taken over the conversion the composer
-// would otherwise have emitted at the end — see `Operation::renders`.
-let scene = vec3<f32>(
-    dot(u.cam_to_srgb_0.rgb, c),
-    dot(u.cam_to_srgb_1.rgb, c),
-    dot(u.cam_to_srgb_2.rgb, c),
-);
+// Working-space colour, which is linear sRGB primaries — what the film's
+// exposure matrix is defined against. The composer converted out of camera
+// RGB before any scene-stage operation ran (D19).
+let scene = c;
 
 // What each emulsion layer was exposed to. A matrix, exactly: the scene
 // spectrum reconstructed from an sRGB triple is linear in that triple, so the
@@ -701,10 +706,10 @@ mod tests {
 
     #[test]
     fn it_declares_itself_a_rendering_transform() {
-        // The whole reason the composer skips the base curve and the camera
-        // matrix. If this ever returned false the picture would be rendered
-        // twice and converted twice, which looks like a colour management bug
-        // a long way from here.
+        // The whole reason the composer emits the stock in the view
+        // transform's place rather than beside it. If this ever returned
+        // false the picture would be rendered twice, which looks like a
+        // colour management bug a long way from here.
         assert!(FilmSim::new().renders());
     }
 
@@ -727,13 +732,15 @@ mod tests {
     }
 
     #[test]
-    fn the_fragment_converts_out_of_camera_space_itself() {
-        // It has to: it has taken over the conversion the composer would
-        // otherwise emit at the end.
+    fn the_fragment_is_handed_working_space_colour() {
+        // TRACES: FR-DEV-3f
+        // D19: the composer leaves camera space before any scene-stage
+        // operation, so a film converting again would apply the camera
+        // matrix twice.
         let mut op = FilmSim::new();
         op.set_tables(Some(tables()));
         let wgsl = op.wgsl_body();
-        assert!(wgsl.contains("cam_to_srgb_0"), "{wgsl}");
+        assert!(!wgsl.contains("cam_to_srgb"), "{wgsl}");
     }
 
     #[test]

core/dr-pipeline/src/ops/local_contrast.rs

@@ -878,7 +878,6 @@ c = c * exp2(stops);"
 mod tests {
     use super::*;
     use crate::detail::compose_detail;
-    use dr_types::ColourSpace;
 
     /// The two controls, as the graph would hold them.
     fn ops(clarity: f32, texture: f32) -> Vec<Box<dyn Operation>> {
@@ -889,7 +888,7 @@ mod tests {
     }
 
     fn composed(clarity: f32, texture: f32, scale: RenderScale) -> crate::ComposedDetail {
-        compose_detail(&ops(clarity, texture), scale, ColourSpace::Srgb)
+        compose_detail(&ops(clarity, texture), scale)
     }
 
     #[test]

core/dr-pipeline/src/ops/mod.rs

@@ -74,6 +74,7 @@ pub mod distortion;
 pub mod film_sim;
 pub mod local_contrast;
 pub mod noise_reduction;
+pub mod view_transform;
 pub mod vignetting;
 
 pub use aberration::Aberration;
@@ -87,6 +88,7 @@ pub use film_sim::{FilmSim, FilmTables, PaperTables};
 // documentation for why that is two nodes and not one.
 pub use local_contrast::{Clarity, Texture};
 pub use noise_reduction::NoiseReduction;
+pub use view_transform::ViewTransform;
 pub use vignetting::Vignetting;
 
 // The declared nodes, plus `helpers` and `chain`. Generated into OUT_DIR by

core/dr-pipeline/src/ops/noise_reduction.rs

@@ -615,7 +615,6 @@ c = vec3<f32>(y0) + chroma_sum / weight_sum;";
 #[cfg(test)]
 mod tests {
     use super::*;
-    use dr_types::ColourSpace;
 
     /// A 24 MP frame, and the panel a develop view might show it in.
     const FULL: (u32, u32) = (6000, 4000);
@@ -629,7 +628,7 @@ mod tests {
     }
 
     fn compose(op: NoiseReduction, scale: RenderScale) -> crate::detail::ComposedDetail {
-        crate::detail::compose_detail(&chain_with(op), scale, ColourSpace::Srgb)
+        crate::detail::compose_detail(&chain_with(op), scale)
     }
 
     #[test]
@@ -674,11 +673,6 @@ mod tests {
         // The luminance pass runs first, so the chroma guide is the denoised
         // luminance rather than the raw one.
         assert_eq!(both.passes[0].label, "noise_reduction/luminance");
-        // And only the last pass in the whole chain performs the output
-        // transform, whichever pass that happens to be.
-        assert!(!both.passes[0].writes_output);
-        assert!(!both.passes[1].writes_output);
-        assert!(both.passes[2].writes_output);
     }
 
     #[test]

core/dr-pipeline/src/ops/view_transform.rs

@@ -0,0 +1,211 @@
+//! TRACES: FR-DEV-3j
+//! The view transform as an operation: the photographer's two numbers for
+//! the curve [`crate::view`] defines.
+//!
+//! # Why it is a node now, when the base curve could not be
+//!
+//! The base curve was kept out of the chain for reasons that were all about
+//! the *body*: it was looked up by camera model, so as a node it would have
+//! carried one camera's rendering onto another camera's file through a shared
+//! sidecar, shown a dead slider on an unprofiled body, and opened a profiled
+//! one reporting itself modified. D19 removed the premise. There is one view
+//! transform for every body, so its settings are a decision about the picture
+//! like any other, and they belong in the sidecar, the history and a mask
+//! layer.
+//!
+//! # Why it is composed at its defaults
+//!
+//! A neutral operation is normally left out of the shader, and "active" means
+//! "moved from its defaults". Both stay true here — an untouched photograph
+//! writes no view transform parameters, and `every_node_starts_neutral` still
+//! holds — but the composer emits this node whatever its state, because a
+//! photograph with no view transform is a scan, not a picture. See
+//! [`crate::operation::Stage::View`].
+
+use std::sync::{Arc, LazyLock};
+
+use crate::descriptor::{
+    Attribute, LocalizedKey, OpDescriptor, OpId, ParamDescriptor, ParamId, Scale, Unit,
+};
+use crate::operation::{Helper, Operation, Stage, Uniform};
+use crate::view::{Sigmoid, CONTRAST_RANGE, DEFAULT_CONTRAST, DEFAULT_WHITE, WHITE_RANGE};
+
+pub const ID: OpId = OpId("view_transform");
+pub const CONTRAST: ParamId = ParamId("contrast");
+pub const WHITE: ParamId = ParamId("white");
+
+static HELPERS: [Helper; 1] = [Helper {
+    name: "view_sigmoid",
+    source: crate::view::VIEW_SIGMOID_WGSL,
+}];
+
+static DESCRIPTOR: LazyLock<Arc<OpDescriptor>> = LazyLock::new(|| {
+    Arc::new(OpDescriptor {
+        // Tone: it is the tone response of the whole picture, and the panel's
+        // Light group is where a photographer looks for the white point.
+        attributes: vec![Attribute::Tone],
+        id: ID,
+        label: LocalizedKey("op.view_transform"),
+        params: vec![
+            ParamDescriptor::scalar(
+                "contrast",
+                "param.view_transform.contrast",
+                CONTRAST_RANGE.0,
+                CONTRAST_RANGE.1,
+                DEFAULT_CONTRAST,
+                Unit::None,
+                Scale::Linear,
+                2,
+            ),
+            ParamDescriptor::scalar(
+                "white",
+                "param.view_transform.white",
+                WHITE_RANGE.0,
+                WHITE_RANGE.1,
+                DEFAULT_WHITE,
+                Unit::Stops,
+                Scale::Linear,
+                1,
+            ),
+        ],
+    })
+});
+
+#[derive(Debug, Clone)]
+pub struct ViewTransform {
+    contrast: f32,
+    white: f32,
+}
+
+impl Default for ViewTransform {
+    fn default() -> Self {
+        Self {
+            contrast: DEFAULT_CONTRAST,
+            white: DEFAULT_WHITE,
+        }
+    }
+}
+
+impl ViewTransform {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// The curve these settings solve to.
+    pub fn sigmoid(&self) -> Sigmoid {
+        Sigmoid::new(self.contrast, self.white)
+    }
+}
+
+impl Operation for ViewTransform {
+    fn descriptor(&self) -> Arc<OpDescriptor> {
+        DESCRIPTOR.clone()
+    }
+
+    fn set_param(&mut self, id: ParamId, value: f32) {
+        match id {
+            CONTRAST => self.contrast = value,
+            WHITE => self.white = value,
+            _ => log::warn!("view_transform: unknown parameter {id}"),
+        }
+    }
+
+    fn param(&self, id: ParamId) -> f32 {
+        match id {
+            CONTRAST => self.contrast,
+            WHITE => self.white,
+            _ => 0.0,
+        }
+    }
+
+    fn is_active(&self) -> bool {
+        self.contrast != DEFAULT_CONTRAST || self.white != DEFAULT_WHITE
+    }
+
+    fn stage(&self) -> Stage {
+        Stage::View
+    }
+
+    fn wgsl_body(&self) -> String {
+        "\
+// Skipped for an already-rendered source: a JPEG is a display rendering
+// already, and rendering it again would compress it twice.
+if (!non_linear) {
+    c = view_sigmoid(c, slope, inv_k, peak);
+}"
+        .into()
+    }
+
+    fn uniforms(&self) -> Vec<Uniform> {
+        let s = self.sigmoid();
+        vec![
+            Uniform {
+                name: "slope",
+                value: s.n,
+            },
+            Uniform {
+                name: "inv_k",
+                value: s.inv_k,
+            },
+            Uniform {
+                name: "peak",
+                value: s.w,
+            },
+        ]
+    }
+
+    fn helpers(&self) -> &[Helper] {
+        &HELPERS
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn it_starts_neutral_and_says_so() {
+        // TRACES: FR-DEV-3j
+        // Neutral in the sense every other node is: nothing moved, so nothing
+        // is written. It is still composed — see the module documentation.
+        let op = ViewTransform::new();
+        assert!(!op.is_active());
+        assert_eq!(op.sigmoid(), Sigmoid::default_curve());
+    }
+
+    #[test]
+    fn moving_either_slider_makes_it_active() {
+        let mut op = ViewTransform::new();
+        op.set_param(WHITE, 6.0);
+        assert!(op.is_active());
+        let mut op = ViewTransform::new();
+        op.set_param(CONTRAST, 2.0);
+        assert!(op.is_active());
+    }
+
+    #[test]
+    fn the_uniforms_are_the_solved_curve() {
+        let mut op = ViewTransform::new();
+        op.set_param(CONTRAST, 2.0);
+        op.set_param(WHITE, 6.0);
+        let s = Sigmoid::new(2.0, 6.0);
+        let u = op.uniforms();
+        assert_eq!(
+            u.iter().map(|u| u.value).collect::<Vec<_>>(),
+            vec![s.n, s.inv_k, s.w]
+        );
+    }
+
+    #[test]
+    fn the_descriptor_defaults_are_the_curve_defaults() {
+        // The sidecar treats a value equal to the descriptor's default as
+        // unedited; the two disagreeing would make every photograph open
+        // reporting a view transform edit it never had.
+        let d = ViewTransform::new().descriptor();
+        assert_eq!(
+            d.param(CONTRAST).expect("contrast").default,
+            DEFAULT_CONTRAST
+        );
+        assert_eq!(d.param(WHITE).expect("white").default, DEFAULT_WHITE);
+    }
+}

core/dr-pipeline/src/tiles.rs

@@ -0,0 +1,155 @@
+//! TRACES: FR-DSP-2 | NFR-RES-2
+//! Cutting a render too large for one texture into tiles.
+//!
+//! The interactive path is not tiled, and on the evidence should not be
+//! (`docs/dev/frame-budget.md`, TD-4): one fused dispatch over a viewport is
+//! inside the frame budget, and a halo per tile nearly doubles the taps of a
+//! wide kernel. What does not fit is a *file*. A 22927×8966 panorama has no
+//! render target on a device whose textures stop at 16384, so its export, and
+//! nothing else, is drawn a tile at a time.
+//!
+//! A tile is two rectangles in pixels of the framed output: the one rendered,
+//! grown by the detail stage's reach ([`crate::ComposedDetail::reach`]) so
+//! every kernel near its edge reads the pixels it would read untiled, and the
+//! one kept, which is the tile proper. The kept rectangles cover the frame
+//! exactly once.
+//!
+//! The rendered rectangle's origin is aligned to [`TILE_ALIGN`]. The detail
+//! stage computes clarity's base on a reduced grid, and a tile starting half
+//! way through a reduced texel would reduce different pixels together than
+//! the untiled frame does, which shows as a faint seam.
+
+/// A multiple of every reduced grid the detail stage uses, so a tile's
+/// grids line up with the untiled frame's.
+pub const TILE_ALIGN: u32 = 16;
+
+/// One tile of a render: what to draw, and which part of it to keep.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct Tile {
+    /// `[x, y, width, height]` in output pixels: the tile grown by the halo,
+    /// clamped to the frame. This is what is rendered.
+    pub grown: [u32; 4],
+    /// `[x, y, width, height]` in output pixels: the tile proper, which lies
+    /// inside `grown`. This is what is kept.
+    pub keep: [u32; 4],
+}
+
+impl Tile {
+    /// The rendered rectangle as a view on the frame, the rectangle
+    /// [`crate::Framing::set_view`] takes.
+    pub fn view(&self, frame: (u32, u32)) -> crate::framing::CropRect {
+        let (fw, fh) = (frame.0.max(1) as f32, frame.1.max(1) as f32);
+        crate::framing::CropRect {
+            x: self.grown[0] as f32 / fw,
+            y: self.grown[1] as f32 / fh,
+            width: self.grown[2] as f32 / fw,
+            height: self.grown[3] as f32 / fh,
+        }
+    }
+
+    /// Where the kept rectangle starts inside the rendered one.
+    pub fn keep_offset(&self) -> (u32, u32) {
+        (self.keep[0] - self.grown[0], self.keep[1] - self.grown[1])
+    }
+}
+
+/// Cut a `frame`-sized render into tiles no larger than `max_edge` once
+/// grown by `halo` on every side.
+///
+/// Row-major, top to bottom, so a caller writing the file as it goes gets
+/// its bands in order. A frame that fits whole is one tile with no halo.
+/// `None` when the halo leaves no room for a tile at all — a spot heal
+/// cloning from across a frame wider than the device can hold is the case,
+/// and it has to be refused rather than drawn with a seam.
+pub fn plan(frame: (u32, u32), max_edge: u32, halo: u32) -> Option<Vec<Tile>> {
+    let (fw, fh) = (frame.0.max(1), frame.1.max(1));
+    if fw <= max_edge && fh <= max_edge {
+        return Some(vec![Tile {
+            grown: [0, 0, fw, fh],
+            keep: [0, 0, fw, fh],
+        }]);
+    }
+    // The halo, rounded up so a grown origin lands on the grid; the tile
+    // proper a multiple of it for the same reason.
+    let halo = halo.div_ceil(TILE_ALIGN) * TILE_ALIGN;
+    let room = max_edge.checked_sub(2 * halo)?;
+    let step = room / TILE_ALIGN * TILE_ALIGN;
+    if step == 0 {
+        return None;
+    }
+    let mut out = Vec::new();
+    let mut y = 0;
+    while y < fh {
+        let kh = step.min(fh - y);
+        let mut x = 0;
+        while x < fw {
+            let kw = step.min(fw - x);
+            let gx = x.saturating_sub(halo);
+            let gy = y.saturating_sub(halo);
+            let gx1 = (x + kw + halo).min(fw);
+            let gy1 = (y + kh + halo).min(fh);
+            out.push(Tile {
+                grown: [gx, gy, gx1 - gx, gy1 - gy],
+                keep: [x, y, kw, kh],
+            });
+            x += kw;
+        }
+        y += kh;
+    }
+    Some(out)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_frame_that_fits_is_one_tile_with_no_halo() {
+        let tiles = plan((6000, 4000), 8192, 200).unwrap();
+        assert_eq!(tiles.len(), 1);
+        assert_eq!(tiles[0].grown, [0, 0, 6000, 4000]);
+        assert_eq!(tiles[0].keep, tiles[0].grown);
+    }
+
+    #[test]
+    fn the_kept_rectangles_cover_the_frame_exactly_once() {
+        // The panorama that started this, against a 16384 device with a
+        // clarity-sized halo.
+        let frame = (22927, 8966);
+        let tiles = plan(frame, 16384, 230).unwrap();
+        let mut covered = vec![0u8; (frame.0 * frame.1) as usize];
+        for t in &tiles {
+            let [x, y, w, h] = t.keep;
+            for yy in y..y + h {
+                for xx in x..x + w {
+                    covered[(yy * frame.0 + xx) as usize] += 1;
+                }
+            }
+        }
+        assert!(covered.iter().all(|&c| c == 1));
+    }
+
+    #[test]
+    fn every_tile_fits_the_device_and_holds_its_halo() {
+        let frame = (22927, 8966);
+        let (max, halo) = (8192, 300);
+        for t in plan(frame, max, halo).unwrap() {
+            let [gx, gy, gw, gh] = t.grown;
+            let [kx, ky, kw, kh] = t.keep;
+            assert!(gw <= max && gh <= max, "{t:?} does not fit");
+            assert_eq!(gx % TILE_ALIGN, 0, "{t:?} starts off the grid");
+            assert_eq!(gy % TILE_ALIGN, 0, "{t:?} starts off the grid");
+            // The halo is there on every side, or the frame ends first — in
+            // which case the untiled render stops at the same edge.
+            assert!(gx == 0 || kx - gx >= halo);
+            assert!(gy == 0 || ky - gy >= halo);
+            assert!(gx + gw == frame.0 || gx + gw - (kx + kw) >= halo);
+            assert!(gy + gh == frame.1 || gy + gh - (ky + kh) >= halo);
+        }
+    }
+
+    #[test]
+    fn a_halo_wider_than_the_device_is_refused() {
+        assert_eq!(plan((40000, 100), 16384, 9000), None);
+    }
+}

core/dr-pipeline/src/view.rs

@@ -0,0 +1,276 @@
+//! TRACES: FR-DEV-3j | FR-DEV-2
+//! The view transform — the one stage that maps scene-linear colour to a
+//! display range (D19, ARCH §6.14).
+//!
+//! # What it is
+//!
+//! A log-logistic sigmoid, per channel:
+//!
+//! ```text
+//! f(x) = w · r / (1 + r),   r = (x / k)^n
+//! ```
+//!
+//! `n` is the contrast — the slope in log-log terms, before the shoulder
+//! bends it. `k` and `w` are solved from two conditions rather than set:
+//! scene middle grey lands on display middle grey, and the scene white the
+//! photographer chose lands on display white. So the curve has a toe, a
+//! midtone slope and a shoulder that approaches `w` — a hair above 1.0 —
+//! without ever reaching it. Everything the shoulder has not reached by the
+//! white point is clipped by the output transform, which is the last moment
+//! and the only place a clip belongs.
+//!
+//! # Why per channel, and why the middle channel is put back
+//!
+//! Per channel is what makes a bright saturated colour desaturate as it
+//! approaches white — a blown sky rolls toward white rather than toward a
+//! saturated corner of the gamut, which is what film and every camera JPEG
+//! do. It also bends hue: the three channels sit at different places on the
+//! curve, so their ratios change, and an orange flame drifts toward yellow.
+//! So after the curve the middle channel is moved back to where it sat
+//! *between the other two* before it — the same fraction of the way from the
+//! smallest to the largest. The smallest and largest keep what the curve gave
+//! them, which keeps the desaturation; the hue, which is decided by that
+//! fraction, survives. It is the "preserve hue" step of darktable's sigmoid,
+//! at full strength.
+//!
+//! # Why these defaults
+//!
+//! [`SCENE_GREY`] is where the retired default base curve put middle grey
+//! (FR-DEV-3e): linear sensor data from a correctly exposed frame has it
+//! near 13% of saturation, and a camera JPEG shows it at 18%. The contrast
+//! and white defaults were chosen against that same retired curve: at 1.4 and
+//! 4 stops the midtones stay within a quarter of a stop of it between scene
+//! 0.03 and 1.0, while a highlight a stop past sensor saturation still rolls
+//! into white rather than stopping dead at it. The upper midtones come out a
+//! little darker than the curve had them, which is the price of that
+//! headroom and what the white slider is for.
+
+/// Scene-linear middle grey: where the retired default curve placed it.
+pub const SCENE_GREY: f32 = 0.13;
+
+/// Display-linear middle grey — what a camera JPEG shows a grey card as.
+pub const DISPLAY_GREY: f32 = 0.18;
+
+/// The default contrast, the sigmoid's log-log slope parameter `n`.
+pub const DEFAULT_CONTRAST: f32 = 1.4;
+
+/// The default white point, in stops above [`SCENE_GREY`].
+pub const DEFAULT_WHITE: f32 = 4.0;
+
+/// The contrast range a photographer is offered.
+pub const CONTRAST_RANGE: (f32, f32) = (1.0, 3.0);
+
+/// The white point range, in stops above middle grey.
+///
+/// The floor is not taste. The two conditions `k` and `w` are solved from
+/// have a solution only while `2^(white · n)` exceeds `1 / DISPLAY_GREY`,
+/// and at the lowest contrast that needs `white` above about 2.47 stops.
+pub const WHITE_RANGE: (f32, f32) = (2.5, 10.0);
+
+/// The curve's three numbers, solved from the photographer's two.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Sigmoid {
+    /// Contrast: the exponent.
+    pub n: f32,
+    /// `1 / k`, so the shader multiplies rather than divides.
+    pub inv_k: f32,
+    /// The asymptote the shoulder approaches, a little above 1.0.
+    pub w: f32,
+}
+
+impl Sigmoid {
+    /// Solve the curve for a contrast and a white point in stops.
+    ///
+    /// Out-of-range inputs are clamped to [`CONTRAST_RANGE`] and
+    /// [`WHITE_RANGE`] rather than trusted: they arrive from a sidecar, which
+    /// may have been written by a build with other limits, and outside them
+    /// the solution below divides by something that is no longer positive.
+    ///
+    /// With `r_g` the value of `r` at scene grey and `q = 2^(white · n)`, the
+    /// two conditions `f(grey) = display grey` and `f(grey · 2^white) = 1`
+    /// are `w·r_g/(1+r_g) = g` and `w·q·r_g/(1+q·r_g) = 1`. Dividing one by
+    /// the other eliminates `w` and leaves `r_g = (g·q − 1) / (q·(1 − g))`.
+    pub fn new(contrast: f32, white: f32) -> Self {
+        let n = contrast.clamp(CONTRAST_RANGE.0, CONTRAST_RANGE.1) as f64;
+        let white = white.clamp(WHITE_RANGE.0, WHITE_RANGE.1) as f64;
+        let g = f64::from(DISPLAY_GREY);
+        let q = (white * n).exp2();
+        let r_grey = (g * q - 1.0) / (q * (1.0 - g));
+        let w = g * (1.0 + r_grey) / r_grey;
+        // r = (x / k)^n, and r at scene grey is r_grey, so
+        // k = grey / r_grey^(1/n).
+        let k = f64::from(SCENE_GREY) / r_grey.powf(1.0 / n);
+        Self {
+            n: n as f32,
+            inv_k: (1.0 / k) as f32,
+            w: w as f32,
+        }
+    }
+
+    /// The default curve.
+    pub fn default_curve() -> Self {
+        Self::new(DEFAULT_CONTRAST, DEFAULT_WHITE)
+    }
+
+    /// One channel through the curve. The CPU reference the shader is
+    /// tested against.
+    pub fn channel(&self, x: f32) -> f32 {
+        let r = (x.max(0.0) * self.inv_k).powf(self.n);
+        self.w * r / (1.0 + r)
+    }
+
+    /// A colour through the curve, with the middle channel put back between
+    /// the other two. See the module documentation.
+    pub fn apply(&self, c: [f32; 3]) -> [f32; 3] {
+        let x = c.map(|v| v.max(0.0));
+        let y = x.map(|v| self.channel(v));
+        let lo = x[0].min(x[1]).min(x[2]);
+        let hi = x[0].max(x[1]).max(x[2]);
+        if hi - lo <= 1e-9 {
+            return y;
+        }
+        let (y_lo, y_hi) = (self.channel(lo), self.channel(hi));
+        x.map(|v| y_lo + (y_hi - y_lo) * (v - lo) / (hi - lo))
+    }
+}
+
+/// The WGSL twin of [`Sigmoid::apply`], as a helper function.
+pub const VIEW_SIGMOID_WGSL: &str = "\
+// The view transform (FR-DEV-3j): a log-logistic sigmoid per channel, then the
+// middle channel put back between the other two so that the hue survives the
+// shoulder. See `dr_pipeline::view` for the derivation and the defaults.
+fn view_sigmoid(c: vec3<f32>, n: f32, inv_k: f32, w: f32) -> vec3<f32> {
+    // Negative components are colours outside the working primaries. They are
+    // floored here, at the last stage, which is the one place a gamut clip
+    // belongs.
+    let x = max(c, vec3<f32>(0.0));
+    let lo = min(x.r, min(x.g, x.b));
+    let hi = max(x.r, max(x.g, x.b));
+    let r_lo = pow(lo * inv_k, n);
+    let r_hi = pow(hi * inv_k, n);
+    let y_lo = w * r_lo / (1.0 + r_lo);
+    let y_hi = w * r_hi / (1.0 + r_hi);
+    // Each channel's place between the smallest and the largest. A neutral
+    // has no spread, and every channel then takes the one value there is.
+    let spread = hi - lo;
+    let t = select((x - vec3<f32>(lo)) / max(spread, 1e-9), vec3<f32>(0.0), spread <= 1e-9);
+    return vec3<f32>(y_lo) + (y_hi - y_lo) * t;
+}
+";
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// The retired default base curve, for the acceptance comparison: five
+    /// points through the unit square, sampled here by straight lines between
+    /// them in log-log terms — close enough to the monotone spline that drew
+    /// it for a tolerance measured in quarters of a stop. Below its second
+    /// point it was a straight line from the origin.
+    fn retired_default(x: f32) -> f32 {
+        const P: [(f32, f32); 4] = [(0.04, 0.043), (0.13, 0.175), (0.45, 0.690), (1.0, 1.0)];
+        if x < 0.04 {
+            return x * (0.043 / 0.04);
+        }
+        let x = x.min(1.0);
+        let i = P.windows(2).position(|w| x <= w[1].0).unwrap_or(2);
+        let ((x0, y0), (x1, y1)) = (P[i], P[i + 1]);
+        let t = (x.ln() - x0.ln()) / (x1.ln() - x0.ln());
+        (y0.ln() + t * (y1.ln() - y0.ln())).exp()
+    }
+
+    #[test]
+    fn middle_grey_lands_on_display_grey() {
+        // TRACES: FR-DEV-3j
+        for (contrast, white) in [(1.0, 3.0), (1.4, 4.0), (2.5, 8.0), (3.0, 10.0)] {
+            let s = Sigmoid::new(contrast, white);
+            let got = s.channel(SCENE_GREY);
+            assert!(
+                (got - DISPLAY_GREY).abs() < 0.01,
+                "contrast {contrast}, white {white}: grey went to {got}"
+            );
+        }
+    }
+
+    #[test]
+    fn the_white_point_reaches_display_white() {
+        // TRACES: FR-DEV-3j
+        // The whole meaning of the slider: the scene value it names is where
+        // the picture reaches white, and not before.
+        for (contrast, white) in [(1.0, 3.0), (1.4, 4.0), (2.5, 8.0)] {
+            let s = Sigmoid::new(contrast, white);
+            let at = SCENE_GREY * white.exp2();
+            assert!((s.channel(at) - 1.0).abs() < 1e-4, "{}", s.channel(at));
+            assert!(s.channel(at * 0.9) < 1.0);
+            assert!(s.w > 1.0, "the shoulder must approach a value above white");
+        }
+    }
+
+    #[test]
+    fn the_curve_is_monotone_and_keeps_going_past_one() {
+        // TRACES: FR-DEV-3j | FR-DEV-2
+        // What the base curve got wrong: it was flat past 1.0, so every
+        // recovered highlight left it as the same number.
+        let s = Sigmoid::default_curve();
+        let mut last = -1.0;
+        for i in 0..=2000 {
+            let x = i as f32 * 0.004;
+            let y = s.channel(x);
+            assert!(y > last || (x == 0.0 && y == 0.0), "not increasing at {x}");
+            last = y;
+        }
+        assert!(s.channel(2.0) > s.channel(1.0));
+    }
+
+    #[test]
+    fn the_default_stays_close_to_the_retired_curve() {
+        // TRACES: FR-DEV-3j | FR-DEV-3e
+        // D19's promise to every existing photograph: the midtones do not
+        // move by more than a third of a stop.
+        let s = Sigmoid::default_curve();
+        let mut x = 0.03_f32;
+        while x <= 1.0 {
+            let ev = (s.channel(x) / retired_default(x)).log2();
+            assert!(ev.abs() < 0.3, "at scene {x} the default moved {ev:+.2} EV");
+            x *= 1.1;
+        }
+    }
+
+    #[test]
+    fn a_neutral_stays_neutral() {
+        // TRACES: FR-DEV-3j
+        let s = Sigmoid::default_curve();
+        for v in [0.0, 0.01, 0.13, 1.0, 7.0] {
+            let [r, g, b] = s.apply([v, v, v]);
+            assert_eq!(r, g);
+            assert_eq!(g, b);
+        }
+    }
+
+    #[test]
+    fn the_hue_survives_the_shoulder() {
+        // TRACES: FR-DEV-3j
+        // The middle channel's place between the other two is what decides
+        // the hue. Without the correction an orange at the shoulder drifts
+        // toward yellow as the red channel saturates first.
+        let s = Sigmoid::default_curve();
+        let orange = [2.0, 0.8, 0.1];
+        let out = s.apply(orange);
+        let before = (orange[1] - orange[2]) / (orange[0] - orange[2]);
+        let after = (out[1] - out[2]) / (out[0] - out[2]);
+        assert!((before - after).abs() < 1e-5, "{before} became {after}");
+        // And the extremes keep what the curve gave them — the desaturation
+        // toward white is the point of working per channel.
+        assert!((out[0] - s.channel(2.0)).abs() < 1e-6);
+        assert!((out[2] - s.channel(0.1)).abs() < 1e-6);
+    }
+
+    #[test]
+    fn out_of_range_settings_are_clamped_not_trusted() {
+        // A sidecar from another build may carry anything, and outside the
+        // range the solution divides by a value that is no longer positive.
+        let s = Sigmoid::new(0.0, 0.0);
+        assert!(s.n.is_finite() && s.inv_k.is_finite() && s.w.is_finite());
+        assert_eq!(s, Sigmoid::new(CONTRAST_RANGE.0, WHITE_RANGE.0));
+    }
+}

core/dr-pipeline/tests/declared_parity.rs

@@ -32,7 +32,8 @@
 //! # What is not covered, and why that is honest
 //!
 //! A `rust:` node — `tone_curve`, `colour_mixer`, `film_sim`,
-//! `capture_sharpen`, `noise_reduction`, `clarity`, `texture`, `dehaze` —
+//! `capture_sharpen`, `noise_reduction`, `clarity`, `texture`, `dehaze`,
+//! `view_transform` —
 //! names a hand-written type and has no declaration to interpret. It is not skipped
 //! silently: [`every_declared_node_is_checked`] asserts the two sets partition
 //! `ops/` between them, so a node that stops being declared cannot quietly
@@ -403,6 +404,7 @@ fn every_declared_node_is_checked() {
             "noise_reduction",
             "texture",
             "tone_curve",
+            "view_transform",
             "vignetting",
         ],
         "the set of hand-written nodes changed; if that is deliberate, update \

core/dr-preset-xmp/src/lib.rs

@@ -573,6 +573,32 @@ mod tests {
         assert_eq!(report.failed, 0);
     }
 
+    #[test]
+    fn a_subfolder_becomes_the_category_of_what_it_holds() {
+        // The folder picked is the root and names nothing; each folder under
+        // it is a level of category, as Lightroom's groups were.
+        let dir = tempdir("categories");
+        std::fs::write(dir.join("Golden Hour.xmp"), ELEMENT_FORM).unwrap();
+        let nested = dir.join("Film").join("Colour");
+        std::fs::create_dir_all(&nested).unwrap();
+        std::fs::write(nested.join("Golden Hour.xmp"), ELEMENT_FORM).unwrap();
+
+        let names: Vec<_> = read_path(&dir).presets.into_iter().map(|p| p.0).collect();
+        assert_eq!(names, ["Film/Colour/Golden Hour", "Golden Hour"]);
+    }
+
+    #[test]
+    fn a_slash_in_a_displayed_name_is_not_a_category() {
+        let dir = tempdir("slash");
+        std::fs::write(
+            dir.join("p.xmp"),
+            ATTRIBUTE_FORM.replace("Warm Portrait", "Warm / Cool"),
+        )
+        .unwrap();
+        let report = read_path(&dir);
+        assert_eq!(report.presets[0].0, "Warm \u{2215} Cool");
+    }
+
     #[test]
     fn a_preset_without_a_name_is_called_after_its_file() {
         // Lightroom writes the name it displays, which is not always the file
@@ -661,21 +687,37 @@ pub struct Report {
 /// A folder because that is the shape a photographer's presets are in — an
 /// exported Lightroom preset folder, nested one level per group — and asking
 /// them to import ninety files one at a time would be asking them not to
-/// bother. Nested folders are walked, which is what makes the group structure
-/// available to whatever wants it later.
+/// bother. Nested folders are walked, and each one below `path` becomes a
+/// category: a preset in `Portraits/` is named `Portraits/Warm skin`, which is
+/// how the preset menu files it (see `PresetLibrary`'s note on categories).
 ///
 /// The *name* comes from `crs:Name` where the file carries one and from the
 /// file stem where it does not. Lightroom writes the name it displays, which
 /// is not always the file name, and the displayed name is the one the
-/// photographer will look for.
+/// photographer will look for. A `/` inside that name would read as a
+/// category it never had, so it becomes `∕`, which looks the same and
+/// separates nothing.
 pub fn read_path(path: &std::path::Path) -> Report {
     let mut report = Report::default();
-    read_into(path, &mut report);
+    read_into(path, "", &mut report);
     report.presets.sort_by(|a, b| a.0.cmp(&b.0));
     report
 }
 
-fn read_into(path: &std::path::Path, report: &mut Report) {
+/// The category a folder below the import root files its presets under.
+fn category_of(parent: &str, folder: &std::path::Path) -> String {
+    let Some(name) = folder.file_name() else {
+        return parent.to_string();
+    };
+    let name = name.to_string_lossy().replace('/', "\u{2215}");
+    if parent.is_empty() {
+        name
+    } else {
+        format!("{parent}/{name}")
+    }
+}
+
+fn read_into(path: &std::path::Path, category: &str, report: &mut Report) {
     if path.is_dir() {
         let Ok(entries) = std::fs::read_dir(path) else {
             log::warn!("preset import: cannot read {}", path.display());
@@ -686,7 +728,12 @@ fn read_into(path: &std::path::Path, report: &mut Report) {
         let mut paths: Vec<std::path::PathBuf> = entries.flatten().map(|e| e.path()).collect();
         paths.sort();
         for path in paths {
-            read_into(&path, report);
+            let category = if path.is_dir() {
+                category_of(category, &path)
+            } else {
+                category.to_string()
+            };
+            read_into(&path, &category, report);
         }
         return;
     }
@@ -710,6 +757,12 @@ fn read_into(path: &std::path::Path, report: &mut Report) {
                     .unwrap_or_default()
             });
             report.unsupported.extend(import.skipped);
+            let name = name.replace('/', "\u{2215}");
+            let name = if category.is_empty() {
+                name
+            } else {
+                format!("{category}/{name}")
+            };
             report.presets.push((name, import.preset));
         }
         Err(e) => {

core/dr-thumbs/src/lib.rs

@@ -72,17 +72,54 @@ pub enum ThumbSize {
     /// Zoomed cells, the loupe, and the filmstrip. ~45 KB each, fetched only
     /// where something actually asks for that detail.
     Large = 1,
+    /// TRACES: FR-MRG-6
+    /// A panorama's cell two columns wide, at the height of one: long edge
+    /// sized for the width rather than for a square, since the grid class
+    /// of a 4:1 panorama is 256×64 — a smear across the cells. The wide
+    /// classes are made only for photographs that wide, so they cost a
+    /// library nothing else.
+    Wide2 = 2,
+    /// Three columns.
+    Wide3 = 3,
+    /// Four columns: the widest class.
+    Wide4 = 4,
 }
 
+/// The most columns a wide class spans.
+pub const WIDEST_SPAN: usize = 4;
+
 impl ThumbSize {
-    /// Long edge in pixels.
+    /// Long edge in pixels. A wide class is 512 per column it spans, which
+    /// keeps its short edge near the large class's for the aspect that
+    /// class is chosen for — sharp at the largest cells on a 2x display.
     pub fn edge(self) -> u32 {
         match self {
             ThumbSize::Grid => 256,
             ThumbSize::Large => 1024,
+            ThumbSize::Wide2 => 1024,
+            ThumbSize::Wide3 => 1536,
+            ThumbSize::Wide4 => 2048,
         }
     }
 
+    /// The wide class for a cell `span` columns wide: `None` for one
+    /// column, and the widest class for anything past it.
+    pub fn wide(span: usize) -> Option<Self> {
+        match span {
+            0 | 1 => None,
+            2 => Some(ThumbSize::Wide2),
+            3 => Some(ThumbSize::Wide3),
+            _ => Some(ThumbSize::Wide4),
+        }
+    }
+
+    /// The class for a cell `span` columns wide whose columns are drawn at
+    /// `pixels`: a wide class for any cell wider than one, whatever the
+    /// zoom, since its height is a column's and its width is not.
+    pub fn for_span(span: usize, pixels: u32) -> Self {
+        Self::wide(span).unwrap_or_else(|| Self::for_cell(pixels))
+    }
+
     /// The smallest class that can fill a cell of this size without visibly
     /// softening.
     ///
@@ -96,12 +133,22 @@ impl ThumbSize {
         }
     }
 
-    fn from_i64(v: i64) -> Self {
+    /// The class a stored discriminant names, or `None` for one this build
+    /// does not know.
+    pub fn from_stored(v: i64) -> Option<Self> {
         match v {
-            1 => ThumbSize::Large,
-            _ => ThumbSize::Grid,
+            0 => Some(ThumbSize::Grid),
+            1 => Some(ThumbSize::Large),
+            2 => Some(ThumbSize::Wide2),
+            3 => Some(ThumbSize::Wide3),
+            4 => Some(ThumbSize::Wide4),
+            _ => None,
         }
     }
+
+    fn from_i64(v: i64) -> Self {
+        Self::from_stored(v).unwrap_or(ThumbSize::Grid)
+    }
 }
 
 /// Long edge of a grid thumbnail.

docs/dev/architecture.md

@@ -34,7 +34,7 @@ document elaborates:
 | UI | Slint | D1, D8 |
 | GPU | wgpu → Vulkan (Linux + Android) | D1 |
 | Shaders | Hand-written WGSL | D6 |
-| RAW decode | rawler; LibRaw fallback behind a trait | D2 |
+| RAW decode | rawler (0.7.2, carried patched in `third_party/`); LibRaw fallback behind a trait | D2 |
 | Catalog | SQLite (WAL) — a rebuildable index | D5, §6.12 |
 | Colour | lcms2 + GPU-side matrix/LUT transforms | D5 |
 | Network | reqwest + quick-xml | D7 |
@@ -140,6 +140,11 @@ is *not* demosaiced. Demosaic is a GPU pipeline stage (§5.2).
 > (§3.1's `read_range`), not the decoder. `dr_decode::Rawler` is the one implementation, and only
 > the places that start a job name `dr_decode::default()`; everything below them takes a
 > `&dyn Decoder`.
+>
+> rawler itself is built from `third_party/rawler-0.7.2` since 0.19.0: the crate as published,
+> with its allocation guard raised so that a linear DNG wider than about 16 700 pixels (a
+> stitched panorama) decodes rather than being refused
+> ([third_party/README.md](../../third_party/README.md)).
 
 ### 3.3 Operation and descriptors
 
@@ -355,11 +360,12 @@ RawImage (sensor data, CPU)
 ├─────────────────────┤
 │ AI denoise          │  optional; raw-domain, joint with demosaic where possible
 ├─────────────────────┤
-│ camera profile      │  matrices + per-body base curve (FR-DEV-3e)
+│ white balance       │  camera RGB: as-shot, then the operation
 ├─────────────────────┤
-│ → working space     │  linear, wide-gamut, f16
+│ camera profile      │  the matrix (FR-DEV-3e) — no curve (D19)
+├─────────────────────┤
+│ → working space     │  linear, unbounded, f16
 ├─────────────────────┤
-│ white balance       │
 │ exposure/contrast   │
 │ highlights/shadows  │  ← masks apply per-op from here down
 │ tone curve          │
@@ -368,10 +374,11 @@ RawImage (sensor data, CPU)
 │ spot removal        │
 │ sharpen / NR        │
 │ lens corrections    │
-│ look (HaldCLUT)     │  FR-DEV-3f
 ├─────────────────────┤
 │ geometry            │  crop, straighten, rotate
 ├─────────────────────┤
+│ view transform      │  sigmoid, or the film stock (FR-DEV-3j)
+├─────────────────────┤
 │ output transform    │  → display or export profile
 └─────────────────────┘
    │
@@ -381,6 +388,14 @@ RawImage (sensor data, CPU)
 
 Working precision is f16 in a linear wide-gamut space, quantising once at the output transform.
 
+**Scene-referred until the view transform (D19, §6.14).** Everything between the matrix and the
+view transform is linear and unbounded. The view transform is the one stage allowed to compress
+the scene into a display range. With a detail stage it runs as a dispatch of its own after the
+detail passes, generated by the same composer as the fused pass so that it gets the mask layers,
+the film tables and the grain's source position. Without one it is the fused pass's tail. Both
+the view transform and the output transform (primaries, gamut clip, encode) come after
+everything that reads a neighbourhood.
+
 **A hot or dead photosite is repaired before the demosaic, not after.** Past it, one photosite of
 nonsense is a coloured cross three pixels wide that no later stage can tell from detail. The pass
 (`shaders/hot_pixels.wgsl`, run by `Demosaicer::run` into a second buffer) replaces a photosite that
@@ -423,6 +438,20 @@ Tile results cache keyed by `(VersionId, tile, zoom, graph_hash_prefix)`, where
 operations up to the first `Affects` change. Adjusting exposure reuses cached demosaic and camera
 profile output for every tile.
 
+> **As built (0.19.0).** The interactive path does not tile: one fused dispatch over the viewport
+> is inside the frame budget ([frame-budget.md](frame-budget.md)), and there is no scheduler or tile
+> cache. What tiles is a source too large for one texture. A linear DNG whose long edge passes
+> `PROXY_EDGE` (8192) — a stitched panorama — is held at full resolution on the CPU and opened on
+> a box-reduced copy, from which the canvas at fit, the thumbnail, the histograms and the masks
+> work. A render finer than the copy — the canvas zoomed in, a tile of the export — samples a
+> window cut from the full resolution (`DemosaicedImage::linear_rgb16_window`), which the fused
+> shader addresses through two source-window uniforms so that crops, warps and grain seeds stay
+> where they are in the frame. The canvas keeps one window while the view stays inside it. The
+> export is cut by `dr_pipeline::tiles::plan` into 4096-pixel tiles on a 16-pixel grid, each
+> grown by the detail chain's reach (`ComposedDetail::reach`, the sum of its passes' radii), and
+> reassembled; `core/dr-gpu/tests/source_window.rs` holds it to the untiled render within one code
+> value. A CFA file too large for one texture is still refused.
+
 ### 5.4 Mask rasterisation
 
 **All masks rasterise on the GPU, including drawn brush strokes** (§6.11). Strokes arrive as
@@ -442,7 +471,7 @@ exactly the stall §6.1 exists to prevent.
 **Two reductions, not one.** The display histogram (FR-DSP-7) counts the frame the output transform
 produced: its axis is the output code value, and a clipped bin means a highlight that is gone as the
 image currently stands. The raw histogram for culling (FR-CULL-3) counts the **demosaiced
-scene-linear texture** — before white balance, the camera matrix, the base curve and the tone chain
+scene-linear texture** — before white balance, the camera matrix, the tone chain and the view transform
 — on an axis of stops below sensor saturation, which is how it reports headroom the embedded JPEG's
 histogram cannot. A culling decision needs the second, an export decision needs the first, and
 neither answers for the other. Both are drawn by the same panel and chosen between.
@@ -1255,6 +1284,17 @@ differently, f16 rounding varies. Cache keys and graph hashes are computed over
 state, which is exactly deterministic. Cross-platform *rendering* equality is a bounded tolerance
 (R1), not a checksum.
 
+### 6.14 Scene-referred until the view transform
+
+Added 2026-09-27 (D19). Between the camera matrix and the view transform, values are scene-linear
+and unbounded, and no operation clamps above 1.0, applies a transfer function or maps to a display
+gamut. The view transform (FR-DEV-3j) is the one stage that does, and the output transform after
+it clips and encodes. This is the constraint the base curve broke and ARCH §5.2 had drawn all
+along: a display-referred curve in the middle of the chain throws away what every later stage,
+the neighbourhood ones above all, needs. A test (`scene_referred_until_the_view`, in `dr-gpu`)
+runs every point operation over a ramp to 16.0 so that a fragment that clips fails the build rather
+than the photograph.
+
 ---
 
 ## 13. Decisions
@@ -1278,6 +1318,7 @@ Full rationale in [requirements.md §8](requirements.md). Summary:
 | D13 | Face inference runtime and model licensing | **Runtime answered**, reopened for per-device backends (docs/inference.md); licensing open |
 | D14 | Segmentation source for local masking | Decided — arm C (docs/segmentation.md §14) |
 | D15 | Target devices — 12-inch tablet and desktop, no phone | Decided (requirements D15) |
+| D19 | Scene-referred pipeline, one view transform last | Decided (requirements D19) |
 
 ---
 

docs/dev/denoise.md

@@ -0,0 +1,358 @@
+# Learned denoise — joint demosaic and denoise on the mosaic
+
+Design for **FR-DEV-3g** ([requirements.md](requirements.md)), the learned stage
+[outstanding.md §3](outstanding.md) says is missing. Draft of 2026-09-27: nothing here is built,
+and every figure marked *estimate* is waiting for the measurement that replaces it.
+
+---
+
+## 1. What we are matching
+
+Lightroom's Denoise (April 2023, Eric Chan's "Denoise demystified") is the reference, and three
+facts about it set the shape of this design:
+
+- **It runs on the mosaic.** The network takes Bayer or X-Trans photosites before any demosaic
+  and emits full RGB: denoise and demosaic are one learned step. It descends from Adobe's 2019
+  learned demosaic (Raw Details). A photograph that is already demosaiced is not eligible.
+- **It is run once, not per frame.** The result is written as a new linear DNG beside the
+  original, and every later edit reads that file. The amount is chosen once, from a preview crop.
+- **It is trained on synthetic pairs.** Clean raws with sensor-modelled noise added, not
+  photographed pairs.
+
+The reason the mosaic is the right place is physical: before the demosaic, noise is independent
+per photosite with a known distribution (shot plus read). After it, the interpolation has
+correlated that noise into colour blotches many photosites across, which classical noise reduction
+cannot separate from texture. The same step removes demosaic artefacts
+— maze, zipper, false colour, X-Trans worms (FR-RAW-5).
+
+We match the first and third facts and not the second: our result is a cache, not a file in the
+library (§7).
+
+## 2. Where it sits
+
+[architecture.md §5.2](architecture.md) already reserves the slot. The learned stage **replaces
+the demosaic box** when it is on; nothing else in the chain moves.
+
+```
+RawImage ─► hot/dead photosites ─► black/white levels ─► ┬─ demosaic (classical) ─┬─► camera profile ─► …
+                                                         └─ learned demosaic+NR ──┘
+                                                              (cached, §7)
+```
+
+- **In:** the repaired, normalised mosaic, from the same buffer `Demosaicer::run` reads. The hot
+  pixel pass stays in front: an outlier of 50σ is outside anything the noise model generates, and
+  a network shown one invents a structure around it.
+- **Out:** linear camera RGB, f16, full resolution — exactly the texture the classical demosaic
+  produces, so the camera profile, the raw histogram and every operation below it are unchanged.
+- **Off by default, per photograph.** The classical path stays the default and the fallback; the
+  stage's absence degrades gracefully, as FR-DEV-3g requires.
+
+## 3. The model
+
+### 3.1 The 12×12 → 4×4 question
+
+The proposal: a network that reads a 12×12 window of photosites and predicts the RGB of the
+central 4×4, slid across the frame in steps of four.
+
+**The output half is right. The input half is too small by a factor of five or more.**
+
+*What is right about it.* Predicting a block aligned to the colour-filter period keeps the phase
+fixed: every prediction sees the same arrangement of red, green and blue around it, so the network
+never has to work out where it stands in the pattern. It also makes tiling trivial and exact.
+Both properties are kept below — as the head of the network and as the tiling contract (§3.4).
+
+*What is wrong with it.* A denoiser can only average away noise it can see around the pixel, and
+at high ISO it needs to see a long way:
+
+- The Canon 6D at ISO 6400 (clip ≈ 1,200 e⁻, read noise ≈ 2 e⁻ — *estimate*, §5 measures it) has a
+  mid-tone of ~150 e⁻, shot SNR ≈ 12, and a shadow three stops down of ~19 e⁻, SNR ≈ 4.
+- A shadow that looks clean wants SNR ≈ 40: a factor of 10, which is ~100 independent same-colour
+  samples in a flat area. Red and blue are a quarter of the photosites, so that is ~400
+  photosites: a **20×20 window just for a flat shadow**, 40×40 two stops further down.
+- A 12×12 window holds 36 red photosites. Averaged perfectly, that is a factor of 6 on red and
+  blue in a flat area, and less everywhere there is structure.
+- Chroma blotches are low-frequency noise — 16 to 64 photosites across. A window smaller than the
+  blotch cannot tell it from a colour change.
+
+Demosaic alone is content with 12×12: good classical demosaics read 5×5 to 9×9. So the proposal is
+a good demosaic network and a weak denoiser — which is a useful ablation (experiment E1, §6.3).
+
+*What it costs.* Adjacent 12×12 windows with a 4×4 output overlap nine-fold, so a network
+evaluated per window recomputes each photosite's features nine times. A convolutional network is
+the same computation with that work shared: it is "predict the central block from its
+neighbourhood" evaluated everywhere at once.
+
+### 3.2 The shape
+
+```
+mosaic (H×W) ──space-to-depth 2×2──► 4 ch @ H/2 × W/2  ┐
+noise map σ(x) ─space-to-depth 2×2──► 4 ch @ H/2 × W/2  ┴► U-Net ─► 12 ch @ H/2 × W/2 ─depth-to-space─► RGB @ H×W
+                                                                  (2×2 block × RGB per position)
+```
+
+- **Packing.** Bayer is packed 2×2 into four channels at half resolution, so every input position
+  is one whole quad and every output position is the 2×2 block of RGB it covers — the proposal's
+  head, at the Bayer period. (A 4×4 packing with a 48-channel head is the same thing at a coarser
+  stride and is a free parameter.)
+- **Phase unification.** Every body's pattern is cropped by a row or a column to RGGB before
+  packing, and the output is un-cropped. Flips are only used for augmentation in the CFA-preserving
+  form (Liu et al., "Bayer pattern unification and augmentation", 2019).
+- **Body.** A U-Net with four downsamplings and NAFNet blocks (Chen et al., 2022; MIT). The
+  receptive field at the raw scale is several hundred photosites, which covers §3.1's worst case
+  with room.
+- **Two sizes.** **M** (widths 32-64-128-256, ~6 M parameters, ~60 GMAC per raw megapixel —
+  *estimate*) is the desktop model and the one trained first. **S** (widths 16-32-64-128, fewer
+  bottleneck blocks, ~1 M parameters, ~12 GMAC/MP) is distilled from M for the tablet (§8).
+
+### 3.3 Conditioning on the noise
+
+The network is told how noisy each photosite is, rather than learning one model per ISO:
+
+- A per-photosite standard-deviation map, `σ(x) = √(K·x + σ_r²)` from the body's gain `K` and read
+  noise `σ_r` at that ISO, packed alongside the mosaic (FFDNet's arrangement, Zhang et al., 2018).
+- **This is what makes it camera-general.** A body it was never trained on only has to supply
+  `K` and `σ_r`. Three sources, in order of preference: a calibration table for the body (§5); the
+  DNG `NoiseProfile` tag, which Adobe's converter writes; a blind estimate from the photograph's
+  own flat regions (Foi et al., 2008), which always exists.
+- **It is also the Amount control.** Scaling the map up tells the network there is more noise than
+  there is and it smooths harder; scaling it down preserves more grain. Changing the amount re-runs
+  inference (§7.2), which is why it is set on a preview crop, as Lightroom does.
+
+The alternative — PMRID's k-sigma transform, which maps every ISO onto one noise level — is
+simpler and gives no Amount control. It is the fallback if conditioning underperforms.
+
+### 3.4 Tiling
+
+A 20 MP frame does not go through a network in one piece on either device. Inference tiles the
+mosaic into 512×512 input tiles with a 64-photosite halo on every side and keeps the central
+384×384 of each output: the proposal's "12 in, 4 out", scaled up. Halo and tile sizes must be
+multiples of 2 (the CFA phase) and of 16 (four downsamplings at half resolution), so the seams
+land at identical positions in every tile's own coordinates.
+
+This is inference-local tiling and does not depend on FR-DSP-2's render-path tiling, which stays
+under the challenge [outstanding.md §4](outstanding.md) records.
+
+## 4. Training data
+
+### 4.1 What the library holds
+
+From the reference catalog, 2026-09-27: 17,255 catalogued RAWs (9,345 DNG, 7,910 CR2), **all but
+seven from one body, the Canon EOS 6D** (RGGB Bayer, 5472×3648, AA filter), 166 shooting days from
+2015 to 2026.
+
+| ISO | Frames | Use |
+|---|---|---|
+| ≤ 200 | 5,065 | Clean sources for synthetic pairs |
+| 201–1600 | 7,807 | Low-noise end of the eval set |
+| 1601–6400 | 3,379 | Real-noise eval set; noise-model check (§5.3) |
+| > 6400 | 562 | The hard cases, by eye |
+
+There are **no X-Trans raws**, which matters for §9. The catalog does not hold shutter speed, so
+selection needs the files' EXIF. Whether the DNGs are mosaic (converted CR2) or linear must be
+checked before they are counted as sources: a linear DNG has no photosites to learn from.
+
+### 4.2 How a training pair is made
+
+1. **Clean source.** A base-ISO 6D frame, black-subtracted and normalised.
+2. **Full-colour truth by binning.** Each plane is resampled by half a photosite so the four
+   planes share a centre, then every 2×2 quad becomes one RGB pixel (R, mean of the two G, B):
+   a true full-colour image at 2736×1824 with no interpolation in it. This is the only way to have
+   ground truth for the demosaic half.
+3. **Re-mosaic.** That RGB image is sampled back into an RGGB mosaic. (It can equally be sampled
+   into X-Trans, §9.)
+4. **Darken and add noise.** Scale the signal by `1/g` for a target ISO `100·g`, then add noise
+   from the calibrated model at that ISO (§5): Poisson shot, Tukey-lambda read noise, row noise
+   and quantisation — the ELD model (Wei et al., CVPR 2020). The input is this mosaic; the target
+   is the clean RGB at the same scale.
+5. **Augment.** Random blur (Gaussian, σ 0–0.7 px) before re-mosaicking, because a binned image is
+   sharper per pixel than the AA-filtered sensor the model will see; exposure jitter; white-balance
+   gains within the body's range; CFA-preserving flips.
+
+**Why the target's own noise is tolerable.** A base-ISO frame is not noise-free, and binning only
+halves the green noise; red and blue keep theirs. But darkening by `g` scales signal and target
+noise together, while the added shot noise grows as `√g`. At ISO 3200 the input is ≈ 5.7× noisier
+than its target, at ISO 800 only ≈ 2.8×. L1 against a noisy target converges on the median, which
+is unbiased for symmetric noise. The low-ISO end is the one at risk of learning to keep grain: if
+it does, bin 4×4 instead (red and blue noise halved, 1368×912 per source) for those samples.
+
+**Why not the native mosaic as the target.** That trains denoise alone, with base-ISO noise baked
+into the answer ("noisier2noise") and no demosaic truth at all.
+
+### 4.3 How much
+
+The limit is scene diversity, not pixel count; every source yields an effectively unlimited
+number of pairs through random crops, ISO and noise draws.
+
+| Figure | Value | Reasoning |
+|---|---|---|
+| Sources, train | **3,000** | 5,065 base-ISO frames, less bursts (perceptual-hash dedup), heavy clipping, motion blur and linear DNGs. For scale: ELD reaches state of the art trained on ~230 scenes; SID has ~5,000 pairs of ~400 scenes |
+| Sources, validation | 200 | Split by shooting day, not by frame, so no scene is on both sides |
+| Pixels | ~15 Gpx of RGB truth | 3,000 × 5 MP after binning |
+| Crops per step | 8–16 × 256×256 photosites | Fits a 6 GB RTX 3050 at fp16 with M |
+| Stored | ~20 GB | 24 random 512×512 crops per source, uint16, zstd. Keeping whole CR2s would be ~75 GB |
+| Training | 200–400 k steps, one to two nights per run on the 3050 — *estimate*; expect three to five runs | |
+
+Stratify the selection: across all 166 days, and deliberately include faces and hair (the library
+has 19k detected faces, and skin is where over-smoothing shows first), foliage, fabric, text, and
+any base-ISO tripod night work.
+
+### 4.4 Reading raws the same way in training and in the app
+
+The training data must be decoded by **the same decoder the app uses**. rawpy (LibRaw) and
+`dr_decode::Rawler` can disagree on black level, white level, active area and therefore CFA phase,
+and a network trained on one pattern phase and run on another produces colour moiré everywhere.
+A `dr-decode` example that dumps the mosaic and its metadata as `.npy` is the only source the
+training repo reads — not rawpy, as `darkroom-infill`'s `develop-raws.py` does.
+
+## 5. The noise model and its calibration
+
+### 5.1 What is measured
+
+Per ISO: gain `K` (DN per electron), read-noise distribution (Gaussian σ and Tukey-λ shape),
+row-noise σ, black-level offset and any fixed pattern. Canon's third-stop ISOs on bodies of the
+6D's generation are digital gains of the full stops, so noise does not scale smoothly between
+them; **every third stop is calibrated**, not interpolated.
+
+### 5.2 The capture (one hour, once per body)
+
+- **Darks.** Lens cap on, viewfinder covered, manual. Five frames at 1/4000 s and five at 1/30 s
+  at every third stop from ISO 100 to 25600. They give read noise, row noise and the black-level
+  pattern; the two shutter speeds confirm dark current is negligible.
+- **Flats.** An evenly lit white wall, defocused, at every full stop: pairs at six exposure levels
+  from 1/64 of clip to 3/4 of it. The variance of each pair's difference against their mean is
+  the photon transfer curve, whose slope is `K`.
+
+### 5.3 The check
+
+Fit the same `(K, σ_r)` blindly from flat regions of the library's 3,379 ISO 1601–6400 frames
+(§3.3's third source). If it disagrees with the calibration by more than ~10%, one of them is
+wrong — and it tells us how far the blind estimate can be trusted for bodies with no calibration.
+
+## 6. Evaluation
+
+### 6.1 Real pairs (the test set)
+
+Synthetic validation says whether the model learned the synthetic problem; only photographed pairs
+say whether it learned the real one. On a tripod, with remote release and mirror lock-up, manual
+focus and white balance: **12 scenes** — low-light interior, a night street, fabric, foliage, fine
+text, a colour chart if one is to hand, and a still subject with skin and hair. At each, four
+ISO 100 frames at a long exposure (averaged: the reference), then ISO 1600, 3200, 6400, 12800 and
+25600 at the same aperture with the shutter shortened by the ISO ratio. A per-channel linear fit
+against the reference absorbs residual exposure mismatch (ELD's protocol).
+
+Plus 100 real library frames above ISO 3200 with no reference, judged by eye side by side.
+
+### 6.2 Baseline and metrics
+
+The baseline is today's path: the classical demosaic plus `ops/noise_reduction.rs` tuned by hand
+per ISO on the validation set. If a Lightroom or DxO trial is to hand, their output on the same
+twelve scenes is the ceiling, for our comparison only.
+
+Metrics, measured after a fixed tone curve (the camera profile and an sRGB curve) and not in linear
+light, where the highlights would dominate: PSNR and SSIM per ISO; chroma bias on flat patches,
+because denoisers desaturate; a slanted-edge MTF for detail; and maze or zipper artefacts on the
+resolution target at ISO 100.
+
+### 6.3 Experiments that answer design questions
+
+| | Question | Runs |
+|---|---|---|
+| E1 | How much context does denoise need? (§3.1) | Same data, receptive field 12, 36, 100, 300+ photosites; PSNR per ISO against it |
+| E2 | Noise-map conditioning or k-sigma? (§3.3) | M both ways |
+| E3 | Bin 2×2 or 4×4 for truth? (§4.2) | Compare at ISO 400–800, where it matters |
+| E4 | Is the blind noise estimate good enough? (§5.3) | Inference with calibrated vs blind maps on the real pairs |
+
+### 6.4 Acceptance
+
+- On the real pairs, ≥ 3 dB over the baseline at ISO 6400, and **no ISO at which it is worse**,
+  ISO 100 included — at base ISO it has to be at least as good a demosaic as the classical one.
+- Mean chroma error on flat patches under ΔE 1.
+- No maze, zipper or false colour on the resolution target that the classical demosaic does not
+  also show.
+- A 20 MP frame in ≤ 3 s on the laptop's GPU and ≤ 30 s on its CPU (§8).
+
+## 7. In the application
+
+### 7.1 A cache, not a new file
+
+Lightroom writes a DNG into the library. We do not: the library is synced, a 20 MP linear RGB file
+is ~120 MB, and a derived file inside a synced tree is exactly what
+[storage.md](storage.md) refuses. Instead:
+
+- The sidecar records the intent — denoise on, amount, model id — as the rest of the edit is
+  recorded, so it syncs and another device reproduces it.
+- The result is a local cache entry: f16 linear camera RGB, zstd, keyed on
+  `(file identity, decoder version, model id, amount, noise source)`. ~60–80 MB per frame
+  (*estimate*), LRU under a budget (default 5 GB, §10).
+- On open, the classical demosaic shows at once and the learned result swaps in when it is ready,
+  with progress over the canvas — the same pattern as a photograph that is only on the server.
+- Export needs the result and computes it if the cache has lost it.
+
+### 7.2 The Amount control
+
+A Denoise toggle and one Amount slider in develop. Moving the slider runs inference on the
+**visible viewport only** (~1 MP, a fraction of a second — *estimate*) so the photographer judges
+on the real result; releasing it queues the whole frame. There is no per-frame blend between the
+two paths: blending the classical output back in re-adds the noise the network removed.
+
+### 7.3 Runtime
+
+Through `dr-inference-engine`, as the other models run ([inference.md](inference.md)): TensorRT or
+CUDA fp16 on the laptop, MIGraphX on the desktop, ORT CPU everywhere, QNN on the tablet. Work is
+scheduled in the `Background` class so a slider never waits on it (architecture §5.3).
+
+## 8. Speed and the tablet
+
+M at ~60 GMAC/MP is ~1.2 TMAC for a 20 MP frame (*estimate*). On the RTX 3050 at fp16 that is
+about a second; on 20 CPU threads, tens of seconds.
+
+The tablet's Hexagon is fast — scrfd_10g's ~10 GFLOP in 3.2 ms, [inference.md §1.1](inference.md) —
+but **accepts int8 only**, and int8 is hostile to this task: a 14-bit signal quantised to 256
+levels loses the shadow steps the model exists to recover. Two ways round it, to be measured in
+this order:
+
+1. **Predict the residual, not the image.** S emits the correction to a cheap bilinear demosaic
+   computed in float outside the graph. The residual spans a few σ, which 256 levels resolve; the
+   addition happens in float. With a variance-stabilising transform (Anscombe) on the input.
+2. **16-bit activations** (QNN's A16W8), if the partition log shows the HTP running them.
+
+If neither holds S's quality within 0.5 dB of fp32 on the real pairs, **v1 is desktop-only** and the
+tablet shows the classical path. The sidecar still records the intent, so a desktop can render the
+learned result for a photograph edited on the tablet.
+
+## 9. X-Trans
+
+The requirements tie this stage to FR-RAW-5, and the library has no Fuji raws. What we can do
+without a Fuji body:
+
+- **Training does not need one.** §4.2 step 3 samples the binned RGB truth into any pattern.
+  X-Trans packs 6×6 into 36 channels at a sixth of the resolution, with a 108-channel head: the
+  same design at the X-Trans period. It is a separate model.
+- **Noise does.** A calibration capture (§5.2) or, failing that, the blind estimate — plus the
+  DNG `NoiseProfile` of converted Fuji files.
+- **The test set does.** raw.pixls.us has CC0 samples per body but no tripod ISO ladders. A few
+  hours with a borrowed X-Trans body and the §6.1 protocol is the honest version; without it,
+  X-Trans ships marked experimental.
+
+## 10. Plan and open decisions
+
+| Phase | Work | Output |
+|---|---|---|
+| P0 | Calibration capture; the `dr-decode` dump example; source selection and crop store | Noise tables, ~20 GB of crops, the 12-scene test set |
+| P1 | M on Bayer; eval harness; E1–E4 | A model that passes §6.4 on the laptop |
+| P2 | The stage in `dr-gpu`, cache, sidecar field, develop controls, export | A photograph denoised in the app |
+| P3 | S distilled; int8 and the residual head on the tablet | Tablet in or out of v1 (§8) |
+| P4 | X-Trans model | Experimental unless a body is borrowed |
+
+Training lives in a sibling repo, `darkroom-denoise`, next to `darkroom-infill` and reusing its
+hydration tools. The weights are trained from scratch on the author's own photographs with an
+MIT architecture, so this model adds no third-party licence to D13.
+
+**Decisions wanted before P1:**
+
+1. Bin 2×2 or 4×4 for the truth, or both (E3 answers it, but the crop store is built once).
+2. Cache budget and location.
+3. Whether the tablet is in v1's scope or explicitly deferred behind §8's measurement.
+4. Whether a Lightroom or DxO comparison is available for §6.2.
+5. A borrowed X-Trans body, or X-Trans experimental in v1.
+

docs/dev/display-and-extension.md

@@ -20,7 +20,7 @@ and the reason is that some of the work is done and untagged.
 | Requirement | Reality |
 |---|---|
 | FR-DSP-1 proxy rendering | **Done.** The develop view renders at viewport resolution, not source. |
-| FR-DSP-2 tiled computation | **Absent, and §2 now says it should stay that way.** Measured: the fused pass is inside the budget everywhere. See [frame-budget.md](frame-budget.md). |
+| FR-DSP-2 tiled computation | **Absent from the interactive path, and §2 now says it should stay that way.** Measured: the fused pass is inside the budget everywhere. See [frame-budget.md](frame-budget.md). *Since 0.19.0* the export of a linear DNG too large for one texture is drawn in halo-grown tiles, and the canvas renders such a file from a reduced copy and full-resolution windows (ARCH §5.3). |
 | FR-DSP-3 interactive latency | **Measured and asserted** for the fused path — `core/dr-gpu/tests/frame_budget.rs`. Missed by one operation, clarity, for the reason recorded as TD-4. |
 | FR-DSP-4 progressive refinement | **Built** (0.15.0), although §4's condition did not fire on the fused path: a half-resolution draft while a gesture moves, one sharp frame 120 ms after it stops, the histogram dimmed while it lags, and the draft faded out over 150 ms — `ui/dr-ui/src/refine.rs`. See [frame-budget.md](frame-budget.md). |
 | FR-DSP-5 zoom and pan | **Done and tagged**, against tests that fail if the behaviour is removed — `core/dr-gpu/tests/zoom_resolution.rs`. `Framing::view` shrinks the sampled region while the render target keeps its size, so zooming *raises* the resolution the pipeline works at. That is FR-DSP-5's requirement, arrived at without tiles. |

docs/dev/frame-budget.md

@@ -515,3 +515,26 @@ texture and dehaze; the scenes without dehaze moved within ±2%. The
 picture is the same bits: a minimum is exact in any order, the window is
 the one the split passes covered, and the rgba8 output hashed identically
 before and after in all 64 scene, view and size combinations measured.
+
+## The view pass after the detail stage — 2026-09-27
+
+**Status:** Not measured. Every figure above predates it.
+
+**A chain with a detail stage is now one dispatch longer** (`c07f81e`,
+D19). The fused pass used to end in the rendering — the base curve, then
+the output transform — before it stored, so every detail pass convolved
+display-referred values, and the last detail pass encoded. Now the fused
+pass stops before the view transform, every detail pass writes a
+scene-linear `rgba16float` intermediate, the last one included, and a view
+pass composed from the same inputs reads the result and runs the view
+transform (or the film stock), the output transform and the mask reveal.
+
+What that adds, per frame with a detail stage: one render-sized read and
+write, and a third intermediate for a one-pass chain. By the dehaze
+section's own figure that is about 4 ms at 2560 × 1600 on the laptop
+RTX 3050 under its power cap. What it removed: a capture sharpening too
+fine to draw at the current scale no longer emits a pass-through, and
+there is no resolve pass for an active kernel with nothing to draw. A
+chain with no detail operation is unchanged, one fused dispatch with the
+view transform at its tail. The rows above that name a detail operation
+should be re-run before they are quoted.

docs/dev/mask-editing.md

@@ -446,8 +446,8 @@ reading a flag.
 
 After the output transform, immediately before the clip and the encode — not
 among the layer blocks. Everything there runs on scene-referred colour in the
-working space, where a flat tint would be pushed through the base curve and
-the camera matrix and arrive as some other colour, and an alpha's white on
+working space, where a flat tint would be pushed through the view transform
+(the base curve and the camera matrix, before D19) and arrive as some other colour, and an alpha's white on
 black would arrive as neither.
 
 ### 6.3 Not on the graph

docs/dev/outstanding.md

@@ -46,6 +46,13 @@ before the demosaic, for Bayer and X-Trans alike and with no setting (FR-RAW-3;
 reader in `dr-decode` is still not wired in, and a CR2 carries no map for it to read); and the
 tablet's scrollers, which §4a now describes.
 
+**And for 0.19.0.** D19 rebuilt the develop pipeline around one rule — scene-linear from the camera
+matrix to a single view transform, last ([architecture.md §6.14](architecture.md)) — which neither
+closed nor opened an entry here: FR-DEV-3e's per-body base curves are retired by decision rather than
+left outstanding, and its DCP half stays deferred as before. §4's FR-DSP-2 and NFR-RES-2 entries
+record the one case that now tiles, a linear DNG larger than one texture, and §11 the merge's frame
+choice, which changes how FR-MRG-5 is met rather than whether.
+
 ---
 
 ## 1. Plugins — post-v1 since 2026-09-19
@@ -181,7 +188,7 @@ place.
 
 ## 4. The render path — FR-DSP-2, FR-DSP-4, NFR-RES-2, NFR-ARCH-1
 
-**FR-DSP-2 — Tiled computation. Unbuilt, and under challenge.** [architecture.md §6.2](architecture.md)
+**FR-DSP-2 — Tiled computation. Built for one case, and otherwise under challenge.** [architecture.md §6.2](architecture.md)
 calls for tiling "from day one" on the grounds that retrofitting it is a rewrite. It was not built,
 and the evidence has since moved. `core/dr-gpu/tests/frame_budget.rs` carries the argument in its
 own header: one fused dispatch over a viewport-sized target is comfortably inside the frame budget,
@@ -191,15 +198,22 @@ path stops being supported, and this test is what says so."
 tiled convolution at clarity's radius reads nearly twice the taps that an untiled one does, so the
 stage that looks most like it wants a tile cache is the stage that would be hurt most by one.
 
-What exists is the declaration and not the mechanism: `DetailPass::radius` is documented as the halo
-a tile would have to be grown by, with a test that pins it, and there is no scheduler to read it.
-That is deliberate plumbing, not an oversight.
+What existed until 0.19.0 was the declaration and not the mechanism: `DetailPass::radius`, the halo
+a tile would have to be grown by, with a test that pins it, and nothing to read it. The export of an
+oversized linear DNG (below) is now what reads it, through `ComposedDetail::reach`; there is still
+no scheduler and no tile cache.
 
 **So the open question here is not "when is tiling built" but "is FR-DSP-2 still a requirement" — and on 2026-09-19 the answer was: as written, until S6 runs.** FR-DSP-2 now carries a status note saying exactly that, and R5's note no longer claims it was rewritten.
 Two measurements say it costs more than it saves on the interactive path. Neither says anything
 about the export path or about a device under memory pressure, which is where the case for it
 actually lives — and that is spike S6, which has not run.
 
+**2026-09-27:** the export path does now tile, for the one case that forced it — a linear DNG
+wider than any texture, a 22 927 × 8966 Lightroom panorama in the case that prompted it. See the
+note under FR-DSP-2 in [requirements.md](requirements.md) and ARCH §5.3. The interactive path
+renders such a file from a reduced copy and one full-resolution window rather than tiles, and S6
+is still unrun.
+
 **FR-DSP-4 — Progressive refinement. Built in 0.15.0.** While a gesture moves the canvas renders
 a half-resolution draft, and the sharp frame lands once, 120 ms after the last movement: the
 decision is `ui/dr-ui/src/refine.rs`, a debounce whose every draft re-arms the settle timer, driven
@@ -212,8 +226,10 @@ interface could see, and a refinement that was not a jarring swap.
 
 **NFR-RES-2 — Images larger than GPU memory.** Half answered. NFR-R8's "decide explicitly" was
 decided on 2026-09-19: there is no CPU render pipeline, the degraded mode is the viewer on
-embedded previews with develop withheld, and NFR-RES-2 no longer promises a fallback render. What
-remains unbuilt is the memory half: there is no headroom budget, no allocation-failure staging,
+embedded previews with develop withheld, and NFR-RES-2 no longer promises a fallback render. Since
+0.19.0 that mode no longer catches a linear DNG larger than one texture, which develops from a
+reduced copy and exports in tiles; a CFA file that large still falls to it. What remains unbuilt is
+the memory half: there is no headroom budget, no allocation-failure staging,
 and no spill. Spike S6 — a tiled pipeline on a
 mid-range Android device with an image larger than available GPU memory — is the one that would
 settle both this and FR-DSP-2, and there is no evidence it has run.
@@ -567,7 +583,9 @@ whether something *should* be built — which is the opposite of the order §9 a
 and focus stacking there with their data model decided. Its clauses entered the register with no
 code behind them, which is why the coverage figure fell from 83.0% to 77.2% on that day — and the
 panorama was then built in the same week: alignment, projections, the chunked composite written as
-a DNG beside its sources, the auto-crop and the model's border fill.
+a DNG beside its sources, the auto-crop and the model's border fill. In 0.19.0 a frame that cannot
+be placed no longer ends the job: it is named on its row and the merge waits for it to be unticked,
+and any frame can be left out that way without reading the rest again (panorama.md §15).
 [panorama.md](panorama.md) §11 and §13 are where it stands.
 
 Three clauses carry no tag:

docs/dev/panorama.md

@@ -128,7 +128,11 @@ stays hot for it.
 ### 5.1 The tap — S15.3, answered by reading the composer
 
 The fused shader's order, fixed by `operation.rs`'s own tests: warp → as-shot
-white balance → operations → base curve → camera matrix → store. The store is
+white balance → operations → base curve → camera matrix → store. *(Amended
+2026-09-27, D19: warp → as-shot white balance → white balance → camera matrix
+→ operations → view transform → store. The tap is unaffected: it has no
+operations, its caller fills the matrix with the identity, and the composer
+emits no view transform in `OutputMode::CameraLinear`.)* The store is
 either the display encode or, in `OutputMode::LinearWorking`, an unclipped
 `rgba16float` of linear sRGB. That mode exists for the detail stage and is
 selected from the operations, never by a caller flag, so that a shader and
@@ -139,7 +143,9 @@ composer already makes that a matter of uniforms rather than structure: the
 white balance, the matrix and the curve's active flag are all in the reserved
 uniform block, and a fused pass with no operations, `as_shot_wb = 1`,
 `cam_to_srgb = I` and `base_curve_last.z = 0` stores exactly camera-linear
-RGB after the warp. So the tap is:
+RGB after the warp. *(Since D19 there is no curve flag: the base curve is
+gone, and the tap composes no view transform, so the white balance and the
+matrix are the only uniforms it fills neutral.)* So the tap is:
 
 - `EditGraph::compose_camera_linear()` — the `LinearWorking` tail with an
   empty operation list and identity framing, paired by name with
@@ -154,8 +160,8 @@ be re-developed deserves the sensor's precision. The cost is 2× on buffers
 FR-MRG-11 already bounds.
 
 **What the DNG carries as a consequence:** the first source's `Make`,
-`Model` and `UniqueCameraModel` — so `base_curve::for_body` finds the 6D's
-curve — its `ColorMatrix1`/`2` with illuminants, and its `AsShotNeutral`. The
+`Model` and `UniqueCameraModel` — so `base_curve::for_body` found the 6D's
+curve, until D19 retired the per-body curves — its `ColorMatrix1`/`2` with illuminants, and its `AsShotNeutral`. The
 composite then develops through the same profile as its sources, applied
 once. The spike's 64 × 48 file (§8) already carries the matrix and neutral;
 the body name is a string.
@@ -238,7 +244,9 @@ first source with a `-pano` suffix, beside it.
 Three samples per pixel rather than a CFA: the warp resamples, and there is no
 sensor grid to mosaic back onto. Nothing else about being a RAW is lost —
 no white balance, no curve, no matrix, no clip has been applied — and the
-photographer develops the panorama afterwards as one photograph.
+photographer develops the panorama afterwards as one photograph. One sample
+is rewritten: a blown one, which is written as the camera value the
+composite's balance calls grey rather than as the sensor's (1, 1, 1) — §15.
 
 The sources are portrait frames in the 6D set: `Orientation` is applied
 before alignment (learned features are not rotation-invariant) and the
@@ -279,11 +287,60 @@ carrying the first source's EXIF in a sub-IFD as `dr-export` already does.
 - The dialog shows the aligned proxies in the chosen projection, with the
   projection, horizon and crop controls of FR-MRG-4, and the per-frame
   residuals. A frame that failed to align is named there (FR-MRG-5), and the
-  merge cannot be confirmed with it in the set.
+  merge cannot be confirmed with it in the set. *(Since 2026-09-27 each row
+  has a box: an unticked frame is left out and the rest are solved again from
+  what the first pass measured — §15.)*
 - Confirm starts the FR-MRG-7 job. The composite appears in the grid when the
   file is written and catalogued, beside its sources, with the merge as the
   first entry in its history.
 
+**How it gets there (FR-MRG-6, 2026-09-28).** A rescan fired as the merge
+finished raced the upload it followed — the 800 MB copy into a folder library
+was still running when the folder was listed, and a Nextcloud upload takes
+minutes — so the listing lacked the composite, recorded the folder's
+validator, and the grid did not show it until the next sync pass. Now:
+
+- *Catalogued by the merge.* `MergeEvent::Done` carries a `Composite` — the
+  name it will have, the size of the picture it opens on (the crop, or the
+  whole when filled), the capture time written into the DNG (the mean of the
+  frames'; the sources' earliest where none has one), the body, and its
+  thumbnails. `library::catalogue_composite` writes the row in one
+  transaction, keyed on `(root_id, source_ref)` exactly as the scan will list
+  the file, at `metadata_state = 2`, and the grid reloads. The name is chosen
+  against the catalog's names in that folder (`names_in_folder`), since the
+  upload replaces whatever is at its name.
+- *The server's half after the upload.* Once a file the catalog already has
+  a row for is sent, the drain lists its folder once, records the file id the
+  server assigned (`record_uploaded`) and puts the merge's thumbnails in the
+  store under it; then the grid rescans. A scan that ran before the upload
+  leaves the row alone, and the one after it updates it in place.
+- *Thumbnails from the merge.* The bands are box-reduced as they are written,
+  after the fill, to a copy 4096 pixels long (`merge_thumbs::Reduced`). That
+  copy is written as a linear DNG in memory with the composite's own profile,
+  header and crop and opened through `open_session` — develop's first open:
+  the D19 pipeline, the default view transform and tone mapping, the as-shot
+  balance and the working-space-to-display conversion. The grid, large and
+  wide classes are rendered from that session, staged in the outbox as
+  `x.dng.thumbs` before the rename releases the payload, and drawn from
+  memory until the upload has a file id to store them under. A test develops
+  a synthetic composite both ways and holds the mean, 95th and 99.5th luma
+  percentiles within 3–4 levels; the naive balanced-and-gamma picture misses
+  by 13. Older composites, which have no staged thumbnails, are thumbnailed
+  the ordinary way.
+- *A wide cell.* `library_ui::layout` places the grid as a lattice of slots.
+  `natural_span` maps aspect to 2, 3 or 4 columns (from 1.9, 2.45 and 3.46 —
+  √(s(s+1)) is where two neighbouring classes leave the same share of their
+  cell empty), capped at the columns there are and the whole row on the
+  tablet, and the same number names the thumbnail class (`Wide2`–`Wide4`, 512
+  pixels of long edge per column). A wide cell that does not fit in the rest
+  of a row starts the next; nothing later moves into the gap, so ordinals —
+  the arrows, a shift-click's run, the timeline, burst folding — are
+  untouched, and up/down step by rows through the layout. The window's own
+  read carries `w` and `h`; where the wide ones sit in the whole list is one
+  query, run when the list changes, and a library with no panorama answers it
+  from the partial index `images_wide`, created on first use rather than by a
+  schema bump.
+
 ## 10. Order of work
 
 1. **S15**, all four, before anything else. (1) and (2) are a day each and
@@ -310,7 +367,7 @@ Built, on branch `merge/panorama`, in the order §10 gave:
 | The camera-space tap | `OutputMode::CameraLinear`, `AdjustPass::render_camera_linear` | Done, `rgba32float`, tiles by view rect |
 | Linear DNG writer, streamed | `dr_export::write_linear_dng` | Done; rawler reads it back |
 | A three-sample `RawImage` re-entering the pipeline | `dr-decode`, `DemosaicedImage::from_linear_rgb16` | Done |
-| Warp, accumulate, resolve, chunk by chunk | `dr_gpu::MergePass`, `merge.wgsl` | Done; feathered blend, scalar gain |
+| Warp, accumulate, resolve, chunk by chunk | `dr_gpu::MergePass`, `merge.wgsl` | Done; seams (§11.1) over a feather, scalar gain |
 | The job: load, proxies, align, gains, confirm, merge, provenance | `dr_ui::merge` | Done; `examples/merge.rs` drives it headless |
 | The page: table, preview, projection, Merge/Stop/Back; the grid's button | `merge.slint`, `merge_ui.rs` | Done; `DARKROOM_START_MERGE=a.CR2,b.CR2` lands on it |
 | Placement beside the sources through the outbox, rescan | `merge_ui.rs` | Done, untested against a server |
@@ -328,9 +385,11 @@ half.
    the file carries the black border. The largest inscribed rectangle over
    the coverage, then the DNG's `DefaultCropOrigin`/`DefaultCropSize`, so
    nothing is thrown away and the develop view opens on the picture.
-2. **Seams and the pyramid** (§10 step 5). The feather hides exposure and
-   small misalignment; parallax on the near slope will show as a soft
-   double edge at 1:1.
+2. **The pyramid** (§10 step 5). Seams landed 2026-09-30 (§11.1); the
+   blend across them is one width for every frequency, so an exposure step
+   the gains leave is narrowed to the seam's 64 px rather than hidden over
+   the old 200. A Laplacian pyramid would blend low frequencies wide and
+   detail narrow.
 3. **Vignetting in the tap.** The lens profile's distortion is applied
    before the fetch; its vignetting is an operation and is not. Frame edges
    are darker than their centres by the lens's falloff, and the feather
@@ -345,6 +404,35 @@ half.
    catalog's `content_hash` is null for most images most of the time. The
    hash can join it when the catalog has one.
 
+### 11.1 Seams — 2026-09-30
+
+The feather averaged every overlap over 200 px, so anything the frames
+disagreed on — parallax on the near slope, a walker, wind in a branch — came
+out twice at half strength: a soft double edge at 1:1, reported as a glitch.
+
+`dr_pano::seam` now chooses, per output texel at proxy resolution, which
+frame it is taken from. Frames are laid down nearest-first; where a new one
+overlaps the composite, each texel costs the gain-corrected difference
+between the two, plus the detail either has there, plus nearness to either
+frame's edge (vignetting, the lens correction's fringe), taken as the
+**worst** over a 4-texel window so the path stays a blend radius clear of a
+difference rather than grazing it. The cut is a dynamic-programming path
+across the overlap, perpendicular to the line from the composite's frames to
+the new one: §4's per-column seam, not a graph cut. The map is computed per
+projection, for the page's preview and again for the merge.
+
+`merge.wgsl` weights a frame by its tent-filtered share of the label map
+about each pixel (`SeamMap::share`, repeated verbatim), over a window
+`seam_blend_px` wide (64, capped at 4 texels either side). The edge feather
+remains underneath as a factor and, with a 1e-4 floor, as the answer where
+the map names no frame that reaches the pixel. `--feather-only` on
+`examples/merge.rs` merges the old way, for comparison.
+
+Known limits: one axis per new frame, so in a multi-row set a frame
+overlapping its left neighbour and the row above is cut along a compromise
+direction; the cost reads grey proxies, so a difference in hue alone is
+invisible to it.
+
 ## 12. Filling the border instead of cropping it — MI-GAN, read and measured 2026-09-19
 
 Raised after the first merges: the ragged border a cylinder leaves could be
@@ -559,3 +647,50 @@ gaps between cells — built and measured in `darkroom-infill`
 and the next thing to port into `dr_pano::fill` (it needs the
 discriminator as a second model, ~80 MB fp16). FR-MRG-4's *experimental*
 stays.
+
+## 15. Leaving a frame out, and white clouds — 2026-09-27
+
+**A frame is left out from its row, not by starting again.** Until now a
+frame that did not fit ended the job with its name, and the only way on was
+Back, a smaller selection, and every frame read, demosaiced and searched for
+keypoints again. Each row of the Frames table on the merge page now has a
+box, ticked by default. Unticking one leaves the frame out and the rest are
+solved again at once; ticking it brings it back.
+
+What makes that cheap is a split in `dr_pano::align`. `match_pairs` does
+the matching and the pairwise RANSAC once over every frame — about 5 s for
+the twelve-frame fixture — and `solve` takes a subset and uses only the
+links among the frames in it, about 0.1 s. Solving a subset by re-aligning
+it from scratch was tried and is wrong: the RANSAC seeds are keyed on frame
+position, so dropping a frame moved every seed after it, and on the fixture
+that was enough to lose a marginal link and strand a neighbour of the frame
+left out. A frame whose only overlap was with one left out is reported
+unaligned, exactly as it would be had it never been measured with it.
+
+**A frame that cannot be placed no longer ends the job either** (FR-MRG-5).
+Its row names it and says why, and `Merge` stays off until it is unticked —
+still never a silent drop. The headless example leaves such frames out the
+same way, and takes `--leave-out N` to untick frame `N` once the first
+alignment is in.
+
+**Blown highlights stay white.** A clipped photosite reaches the merge as
+camera (1, 1, 1), which the as-shot balance turns magenta. The alignment
+preview balanced it with no highlight rule, so every blown cloud was pink
+on the page. The DNG had a quieter form of the same fault: a frame's gain
+below one moved a blown sample off the white level, and the feather mixed
+it into a neighbour's real sky, after which the develop's own highlight
+desaturation no longer recognised it. The merge shader (`merge.wgsl`) and
+the preview (`grey_if_blown` in `dr_ui::merge`) now write a blown sample,
+before the gain, as the camera value the composite's balance maps to grey —
+the develop pipeline's neutral, fading in from `CLIP_ONSET` exactly as the
+develop's does.
+
+**A composite this wide is past two limits, both lifted the same day.**
+They were found on a 22 927 × 8966 panorama from Lightroom, and the fixture's
+own composite (22 993 × 5 980, §11) is past both. rawler's allocation guard,
+sized in samples but worded in pixels, refuses a three-sample DNG past about
+16 700 pixels wide; the copy in `third_party/` carries it raised
+([README](../../third_party/README.md)). And no texture holds such a frame:
+a linear DNG past 8192 pixels now opens on a box-reduced copy, a render finer
+than the copy samples a window of the full resolution, and the export is drawn
+in tiles (FR-DSP-2's note in requirements.md, ARCH §5.3).

docs/dev/requirements.md

@@ -306,6 +306,21 @@ from source + graph.
 per channel in a wide-gamut linear working space. Quantisation to the output bit depth happens
 once, at the final export or display stage.
 
+*Amended 2026-09-27 (D19):* quantisation is one of three things deferred to the end, not the only
+one. Until the view transform (FR-DEV-3j), values are **scene-linear and unbounded**: nothing
+clamps above 1.0, nothing applies a transfer function, and nothing maps to a display gamut. Every
+operation between the camera matrix and the view transform receives and returns that. The
+working space's primaries are linear Rec.709, carried unbounded, so a colour outside sRGB is a
+negative component rather than a clipped one. That is wide-gamut in range, not in the primaries
+the operations measure hue against; moving the primaries to Rec.2020 is deferred (D19).
+
+*Acceptance:* every point operation at non-neutral settings, handed a ramp to 16.0, returns values
+that are still monotone in the ramp and still above 1.0 where the ramp is, before the view
+transform (`scene_referred_until_the_view`, `core/dr-gpu/tests/scene_referred.rs`, rendered on a
+device: `dr-pipeline` has none). The view transform itself and film simulation are excluded,
+because clipping into a display range is their job, and so is the detail stage, which a flat frame
+cannot exercise.
+
 **FR-DEV-3 — Adjustment set (v1).**
 
 - White balance (temperature/tint, and picker)
@@ -408,21 +423,31 @@ demosaic and the working-space conversion.
 **v1 scope** (per D11 — good defaults rather than exhaustive colour science):
 
 1. Embedded DNG `ColorMatrix1/2` and `ForwardMatrix1/2` tags
-2. A hand-tuned base curve per launch camera body, shipped with the app
+2. ~~A hand-tuned base curve per launch camera body, shipped with the app~~ — **retired
+   2026-09-27 (D19).** The tone half of "the camera's look" is the view transform's (FR-DEV-3j),
+   one for every body and adjustable. The colour half stays here, in the matrix and later the DCP.
 3. HaldCLUT import (FR-DEV-3f)
 
+The camera profile ends at the matrix, and the matrix runs **first**: white balance is applied in
+camera RGB, where its multipliers are defined, and every other operation receives working-space
+colour. Before D19 the edits ran in camera RGB and the matrix came after them, so a hue in the
+colour mixer and the weights in `luminance()` meant something different on every body.
+
 **Deferred but not foreclosed:** full `.dcp` support with `HueSatDeltas`, `ProfileLookTable`, and
 dual-illuminant interpolation. The stage shall be structured so these are additions rather than a
 pipeline reordering.
 
 Rationale for the reduced scope: a bare 3×3 matrix produces the flat, poor-skin-tone rendering
 characteristic of dcraw defaults, which is the documented reason people abandon darktable in the
-first hour. A per-body base curve fixes most of that at a fraction of the cost of a full DCP
-implementation. The profile database ships **versioned independently of the app binary** so bodies
-and curves can be added without a release — and, under D8's GPLv3, contributed by users.
+first hour. ~~A per-body base curve fixes most of that at a fraction of the cost of a full DCP
+implementation.~~ The flat render is a missing *view transform*, not a missing per-body curve:
+darktable's own answer to the first-hour complaint was a scene-referred default, and Ansel's is
+the same. The per-body curves this clause shipped described themselves as hand-tuned shapes, not
+measurements, and their provenance was not known well enough to keep them as defaults (D19).
 
-*Acceptance:* for each launch body, the default render is subjectively comparable to the camera's
-own JPEG. ΔE2000 validation against ColorChecker references applies once DCP support lands.
+*Acceptance:* the default render is subjectively comparable to the camera's own JPEG — through
+FR-DEV-3j's default, for every body. ΔE2000 validation against ColorChecker references applies
+once DCP support lands.
 
 **FR-DEV-3f — Look emulation.** Support HaldCLUT import, which inherits the existing free film
 simulation ecosystem at near-zero implementation cost, plus reading the in-RAF film simulation tag
@@ -439,9 +464,13 @@ the picture along the film's own curve, shoulder and all, rather than scaling a
 exposure. And the **data cost inverts**: a stock is ~17 kB of published measurements where one
 HaldCLUT is ~800 kB of one person's grade.
 
-A film simulation is a *rendering*, not an adjustment, so it replaces the camera profile's base
-curve and the conversion out of camera space (`Operation::renders`) — applying both would render
-the scene twice.
+A film simulation is a *rendering*, not an adjustment, so it **is** the view transform when a
+stock is chosen (FR-DEV-3j): it runs last, after every adjustment and after the detail stage, in
+place of the default sigmoid, and never in addition to it. *Amended 2026-09-27 (D19):* it ran at
+order 25 before this, after exposure and before everything else, so the edits below it acted on
+the film's output. They now act on the scene the film is shown: an edit is a decision about the
+exposure the negative receives, and the film is the last thing that happens to the picture.
+Existing edits that combine a stock with tone or colour operations render differently.
 
 *Acceptance:* a neutral scene printed through a colour negative's own paper renders neutral to
 within 0.06 in linear sRGB; the baked lookup's interpolation error stays under one 8-bit code
@@ -518,6 +547,34 @@ also written to the sidecar, run-length coded beside the layer, because a stored
 that never runs a model. It is a materialisation of the identity, not the edit: it takes no part
 in equality or merge, and the identity remains what the part means.
 
+**FR-DEV-3j — View transform.** The last stage of the develop pipeline maps scene-linear
+colour to a display range, and it is the only stage that may. By default it is a log-logistic
+sigmoid applied per channel, with the middle channel's position between the other two restored
+afterwards so a hue survives the shoulder, and the result clipped only by the output transform. A
+stock chosen under FR-DEV-3f replaces it.
+
+It is an operation with two parameters, persisted in the sidecar, adjustable in the develop panel,
+and held per mask layer like any other:
+
+- **Contrast** — the sigmoid's slope. Default 1.4.
+- **White** — how far above middle grey, in stops, the scene reaches display white. Default 4.0,
+  so a highlight a stop past sensor saturation still rolls into white rather than clipping at it.
+
+Scene middle grey is 0.13, where the retired default curve placed it (FR-DEV-3e), and it maps to
+display 0.18. A photograph with the view transform at its defaults is **unedited**: the operation
+is always composed, and "active" keeps meaning "moved from the defaults", so an untouched image
+writes no parameters and every other operation's neutral is still the image.
+
+An already-rendered source — a JPEG — is not rendered again: the view transform is skipped for it,
+as the base curve was, so its two sliders do not move a JPEG. A film stock is not skipped, because
+choosing one is an edit.
+
+*Acceptance:* monotone in each channel; a neutral stays neutral; middle grey lands within 0.01 of
+0.18; between scene 0.03 and 1.0, the default is within 0.3 EV of the retired default curve; the
+scene value `0.13 · 2^white` reaches 1.0; and the shader agrees with the CPU reference.
+
+*Added 2026-09-27 (D19).*
+
 **FR-DEV-4 — Ordered, GPU-resident execution.** The pipeline executes as a sequence of GPU
 compute stages. Intermediate results remain in GPU memory between stages. **Processed pixels
 shall reach the display without a CPU round-trip.** *(This is a hard architectural constraint —
@@ -692,6 +749,15 @@ tiles are reused.
 > number from the device the clause is about rather than from the one it is not. If S6 finds the
 > fused pass inside budget there too, FR-DSP-2 becomes a scheduling concern for export and
 > thumbnailing as frame-budget.md proposes; if not, S6 names the stage to tile.
+>
+> **2026-09-27: the export half is built, for sources larger than one texture.** A linear DNG
+> past 8192 pixels (a stitched panorama, 22927×8966 in the case that prompted it) opens on a
+> reduced copy, and a render finer than the copy samples a window of the full resolution
+> through the fused shader's source-window uniforms. The export is drawn in 4096-pixel tiles
+> grown by the detail chain's reach (`dr_pipeline::tiles`, `ComposedDetail::reach`) and matches
+> the untiled render to within one code value (`core/dr-gpu/tests/source_window.rs`). The
+> interactive path is still one dispatch over the viewport: a zoomed canvas cuts one window
+> and keeps it while the view stays inside, which is not the tile cache this clause describes.
 
 **FR-DSP-3 — Interactive latency.** Moving a slider updates the visible region within one frame
 budget at proxy resolution. When a full-resolution result is needed it is computed
@@ -1846,7 +1912,7 @@ with no depth to recover — so it is where the shared machinery is built.
 
 **FR-MRG-2 — What is stitched.** Each source enters the merge in **camera space**: after black
 and white levels, demosaic and lens distortion correction, and before everything else — no white
-balance, no base curve, no camera matrix, no edit. The composite carries the first source's body,
+balance, no camera matrix, no edit, no view transform. The composite carries the first source's body,
 colour matrix and as-shot neutral, so that it is developed afterwards exactly as one of its
 sources would be: the camera profile, the white balance and every operation in §3.3 are applied
 once, to the composite, in its own develop.
@@ -1855,9 +1921,11 @@ This is the clause that decides what the output *is*. Stitching the rendered edi
 stitcher does; the result cannot be re-developed, and any difference between the frames' edits
 becomes a seam. Stitching camera-space pixels produces a photograph the camera could have taken,
 and nothing is applied twice. The cut sits *below* the profile, not above it, for a reason S15.3
-found in the pipeline: the base curve is part of the profile (FR-DEV-3e) and is applied to every
-frame of a known body, so a composite that baked it in and then developed as one would render the
-curve twice. Lens correction alone sits above the cut, because a distorted frame does not align.
+found in the pipeline: the profile's rendering was applied to every frame of a known body, so a
+composite that baked it in and then developed as one would render it twice. *(Amended 2026-09-27,
+D19: that rendering was the per-body base curve, retired; the view transform that replaces it is
+applied to every develop, so the reason stands.)* Lens correction alone sits above the cut, because
+a distorted frame does not align.
 White balance sits below it because the sensor saw the same light in every frame: un-balanced
 camera RGB agrees across the overlaps whether or not the camera's auto white balance drifted, and
 the balanced values would not.
@@ -1911,6 +1979,11 @@ The same rule as `spot-removal.md`'s and D17's: a tool that quietly alters or om
 photograph is the failure this application must not have, and here the omission would be an
 entire frame.
 
+*Amended 2026-09-27:* the job no longer stops. The frame is named on its row, with why, and the
+merge cannot be confirmed until the photographer unticks it; the rest are then solved again from
+the pairs already measured (panorama.md §15). The omission is the photographer's, made in view,
+which is what this clause asks — never a silent drop.
+
 **FR-MRG-6 — Provenance.** *(general to any merge)* The composite's sidecar carries
 `derived_from`: the content hashes of its sources in order, and the merge parameters. The history
 records the merge as the first entry, and export metadata declares the composite as one. Sources
@@ -2096,6 +2169,11 @@ tiling. GPU memory headroom is configurable. Where an allocation fails, work is
 memory or refused with a typed error (`GpuError::TooLarge`) — never rendered by a CPU pipeline,
 which does not exist (NFR-R8).
 
+> **2026-09-27:** a linear DNG larger than one texture is no longer refused. It is developed from
+> a reduced copy and full-resolution windows, and exported in tiles (FR-DSP-2's note). A CFA file
+> too large for one texture, or whose photosites overrun the device's storage-buffer limits on
+> upload, is still refused, and there is still no headroom budget.
+
 **NFR-RES-3 — Mobile power.** On Android the app shall not render continuously when idle. Battery
 and thermal behaviour are first-class concerns; background sync respects metered-connection and
 battery-saver settings.
@@ -2346,6 +2424,7 @@ Rationale, evidence, and the eliminated alternatives are recorded in
 | D11 | Product positioning | Culling-first differentiator; see below |
 | D12 | Scope versus pace | **DECIDED 2026-09-19** — settled by events; full scope stands, no v1 date |
 | D18 | Derived images | **DECIDED 2026-09-19** — a merge writes a new source file; no multi-source Version |
+| D19 | Scene-referred pipeline | **DECIDED 2026-09-27** — edits on unbounded scene-linear colour; one view transform, last; per-body base curves retired |
 
 ### D11 — product positioning
 
@@ -2358,7 +2437,7 @@ Settled by requirements calibration, 2026-08-08.
 | Culling | **The core differentiator** (§3.9) |
 | Focus checking | Peaking *and* zoom |
 | Ingest | Full workflow — template rename, checksum verify, dual-destination |
-| Colour defaults | Good, not obsessive — matrices plus per-body base curve |
+| Colour defaults | Good, not obsessive — matrices plus one scene-referred view transform for every body (D19; the per-body base curves are retired) |
 | Film simulation | Fujifilm explicitly targeted |
 | AI | Denoise in v1; masking deferred. Per-face eye state and head pose are in v1 **as culling evidence, not AI** (FR-CULL-8a, FR-CULL-13); gaze deferred (§7) |
 | Local adjustments | Full masking, GPU-rasterised |
@@ -2592,6 +2671,65 @@ file, not an edit to the old one; and the composite occupies disk — a five-fra
 where the output is still frame A, and inherits nothing from this decision but the provenance
 rule.
 
+### D19 — scene-referred pipeline · **DECIDED 2026-09-27**
+
+**Edits operate on scene-linear, unbounded colour in the working space, and one view transform,
+last, maps it to a display range.** Range, encoding and gamut are all deferred to that point, as
+quantisation already was (FR-DEV-2).
+
+*Why now.* The spec missed [Ansel](https://ansel.photos/), Aurélien Pierre's fork of darktable 4.0,
+and with it the argument he spent years making in darktable: a display-referred curve early in the
+pipeline throws away what every later stage needs. Reading the code against that argument found
+four places it applied:
+
+1. **The base curve clipped.** It was a five-point spline on the unit square, flat past its last
+   point, so every value above 1.0 — every recovered highlight — left it at the same number, per
+   channel.
+2. **The detail stage was handed non-linear data.** The fused pass stops at "linear working
+   values" when a sharpener or a blur follows, but it stopped *after* the base curve, so the
+   neighbourhood operations convolved curved, clipped values while their comments promised the
+   opposite.
+3. **The edits ran in camera RGB.** The matrix came after them, so `luminance()`'s Rec.709 weights
+   were applied to camera primaries and a hue in the colour mixer was a different hue on each
+   body. ARCH §5.2 had always drawn the matrix first; the code had drifted.
+4. **The tone curve clamped** to [0, 1] and applied a 2.2 gamma around its spline, mid-chain.
+
+*What changes.* The order becomes: demosaic → as-shot white balance and the white balance
+operation, in camera RGB → the camera matrix → every other point operation and every mask layer →
+the detail stage → the view transform (FR-DEV-3j), or the film stock (FR-DEV-3f) when one is chosen
+→ the output transform. With a detail stage the view transform is a dispatch of its own after it,
+composed by the same generator as the fused pass. Nothing before the view transform clamps above
+1.0 or display-encodes, and a test says so (FR-DEV-2).
+
+*What is retired.* The per-body base curves and their database (FR-DEV-3e). Their own file called
+them hand-tuned shapes rather than measurements, and not enough was known about where the shapes
+came from to keep them as defaults behind sliders. Body character is the matrix's, and the DCP's
+when it lands.
+
+*What it costs.*
+
+- **Every photograph renders differently.** The default view transform was fitted so middle grey
+  lands where the retired default curve put it and midtones stay within 0.3 EV of it, but the
+  upper midtones are darker and the highlights roll off over two more stops. Previews rendered
+  before the change keep the old look until they are rendered again.
+- **Film edits change meaning.** A tone or colour operation beside a stock used to act on the
+  film's output; it now acts on the scene the film receives.
+- **Tablet and desktop must be released together.** No schema changes and the sidecar gains only
+  ordinary parameters, but two peers on different builds render the same edit differently.
+- **One more dispatch with a detail stage**, for the view transform after it.
+
+*Rejected.* Keeping the per-body curves as the view transform's per-body defaults, for the
+provenance reason above. Leaving the film at order 25 and having it suppress the view transform:
+simpler, and it kept existing film edits' meaning, but it left a display-referred rendering in the
+middle of the chain, which is the thing this decision removes. A fixed view transform with no
+controls: it would have been smaller, but a scene-referred pipeline whose white point cannot be
+moved hands the photographer a shoulder they cannot place.
+
+*Deferred.* Working-space primaries of Rec.2020 rather than Rec.709. The range is already
+unbounded, but several fragments floor at zero, which clips a colour outside sRGB, and the colour
+mixer's bands and the colour grading wheel would need their hues re-measured. Gamut compression
+beyond the output transform's clip goes with it.
+
 ### D16 — plugin licensing · **OPEN, post-v1**
 
 > Deferred with §3.10 on 2026-09-19. Still to be answered before the format is published as

docs/gestures.md

@@ -39,7 +39,7 @@ The list is longer than it is tall, so a way to walk it that cannot be lost to t
 
 Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as magnifying the picture rather than sliding it about. Double-tap is the way to an exact 1:1; this is the way to everything in between. Past 1:1 the pixels are shown as they are, square and unsmoothed; below it, filtered.
 
-<sub>`ui/dr-ui/ui/app.slint:1961`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2029`</sub>
 
 ### Move a magnified photograph about
 
@@ -50,7 +50,7 @@ Anchored on the fingers' midpoint, and on the pointer, so the gesture reads as m
 
 Only once there is something outside the viewport to reach, which is why the cursor becomes a hand exactly then. The view is clamped to the frame: panning past the edge would show undefined area beside the photograph, and that reads as a rendering fault rather than as the end of the picture.
 
-<sub>`ui/dr-ui/ui/app.slint:2057`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2125`</sub>
 
 ### Paint a mask by hand
 
@@ -60,7 +60,7 @@ Only once there is something outside the viewport to reach, which is why the cur
 
 A model's mask stops inside a shoulder and leaks into the hair, and no single edge control fixes two errors that go opposite ways. The whole stroke is one step in the history, so taking a mark back costs one press however long it took to make.
 
-<sub>`ui/dr-ui/ui/app.slint:2148`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2216`</sub>
 
 ### Open this list
 
@@ -70,7 +70,7 @@ A model's mask stops inside a shoulder and leaks into the hair, and no single ed
 
 Most of the keys are develop's, and a reference that could only be opened from the grid had to be looked up before opening the photograph they were wanted for.
 
-<sub>`ui/dr-ui/ui/app.slint:2374`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2442`</sub>
 
 ### Take back the last change
 
@@ -81,7 +81,7 @@ Most of the keys are develop's, and a reference that could only be opened from t
 
 A whole drag is one step, so undo takes back a decision rather than a frame of a gesture. The list is there because arriving six steps back costs what arriving from one does.
 
-<sub>`ui/dr-ui/ui/app.slint:2404`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2472`</sub>
 
 ### Do it again after taking it back
 
@@ -90,7 +90,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 - **Keyboard** — `Ctrl+Shift+Z`, or `Ctrl+Y`
 - **See it** — [in the manual](manual/README.md#history-snapshots-presets)
 
-<sub>`ui/dr-ui/ui/app.slint:2418`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2486`</sub>
 
 ### Remove a repair
 
@@ -98,7 +98,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 - **Pointer** — Click it, then Delete Repair
 - **Keyboard** — `Delete` or `Backspace`, while repairing
 
-<sub>`ui/dr-ui/ui/app.slint:2438`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2506`</sub>
 
 ### Copy the settings from this photograph
 
@@ -109,7 +109,7 @@ A whole drag is one step, so undo takes back a decision rather than a frame of a
 
 The button is the copy that has to work: a tablet has no modifier key to hold and no menu bar to hang the action from. The shortcut is an accelerator for a control that is on screen either way.
 
-<sub>`ui/dr-ui/ui/app.slint:2457`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2525`</sub>
 
 ### Paste the settings onto this photograph
 
@@ -120,7 +120,7 @@ The button is the copy that has to work: a tablet has no modifier key to hold an
 
 The button names what would be pasted — "3 adjustments", and whether the crop is coming with it — which the shortcut cannot say. Both paste the same scope.
 
-<sub>`ui/dr-ui/ui/app.slint:2470`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2538`</sub>
 
 ### Choose which kinds of edit a copy carries
 
@@ -131,7 +131,7 @@ The button names what would be pasted — "3 adjustments", and whether the crop
 
 Lightroom's Copy Settings. Pasting a look across a shoot usually means leaving each frame's crop and rotation alone, and that is a choice to make at the moment of copying.
 
-<sub>`ui/dr-ui/ui/app.slint:2488`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2556`</sub>
 
 ### Export this photograph as the last one was
 
@@ -142,7 +142,7 @@ Lightroom's Copy Settings. Pasting a look across a shoot usually means leaving e
 
 Every export runs on the defaults in Settings, so "as the last one was" is what the button already does. The chord is Lightroom's and darktable's, kept so hands that learned it there need not learn it again.
 
-<sub>`ui/dr-ui/ui/app.slint:2513`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2581`</sub>
 
 ### Choose how to export, then export
 
@@ -153,7 +153,7 @@ Every export runs on the defaults in Settings, so "as the last one was" is what
 
 The export sheet is the export defaults alone with an Export button. What is chosen there is kept, so it is also what the next Ctrl+Shift+E uses.
 
-<sub>`ui/dr-ui/ui/app.slint:2526`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2594`</sub>
 
 ### Keep a crop that leaves a mask outside
 
@@ -161,7 +161,7 @@ The export sheet is the export defaults alone with an Export button. What is cho
 - **Pointer** — Press "Keep crop" on the notice, or "Undo crop" to take it back
 - **Keyboard** — `Enter` keeps it; `Ctrl+Z` takes the crop back, like any other step
 
-<sub>`ui/dr-ui/ui/app.slint:2591`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2659`</sub>
 
 ### Go back to the grid
 
@@ -171,7 +171,7 @@ The export sheet is the export defaults alone with an Export button. What is cho
 
 Lightroom's key for the grid. Escape gets there too, but a step at a time — out of a mode, then out of a zoom — where this goes straight back.
 
-<sub>`ui/dr-ui/ui/app.slint:2608`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2676`</sub>
 
 ### Nudge the control last moved
 
@@ -181,7 +181,7 @@ Lightroom's key for the grid. Escape gets there too, but a step at a time — ou
 
 Lightroom's keys for the selected slider. There is no focus ring on a slider here, so "selected" is the last one moved — the same control `R` puts back — which covers the framing sliders, perspective included, as well as the adjustments.
 
-<sub>`ui/dr-ui/ui/app.slint:2637`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2705`</sub>
 
 ### Change which group of adjustments is on screen
 
@@ -192,7 +192,7 @@ Lightroom's keys for the selected slider. There is no focus ring on a slider her
 
 The groups are whatever the operation set declares itself to be about, so there are as many as the pipeline has and no key can be assigned to one of them by name. Stepping is the binding that survives a node being added.
 
-<sub>`ui/dr-ui/ui/app.slint:2665`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2733`</sub>
 
 ### Look at the photograph at 1:1
 
@@ -203,7 +203,7 @@ The groups are whatever the operation set declares itself to be about, so there
 
 Noise reduction and capture sharpening are judgements about single pixels, and a fitted view averages several of the file's into each one on screen — so the frame looks softer than it is and the correction goes too far. The point and the magnification survive opening the next photograph, which is what makes checking the same eye across forty portraits forty keystrokes rather than forty pans. From 1:1 on the photograph is drawn as its own pixels, each a hard-edged square, rather than smoothed into a blur.
 
-<sub>`ui/dr-ui/ui/app.slint:2701`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2769`</sub>
 
 ### Rate this photograph
 
@@ -211,7 +211,7 @@ Noise reduction and capture sharpening are judgements about single pixels, and a
 - **Pointer** — Click a star in the top bar
 - **Keyboard** — `0`–`5`
 
-<sub>`ui/dr-ui/ui/app.slint:2758`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2826`</sub>
 
 ### Pick or reject this photograph
 
@@ -221,7 +221,7 @@ Noise reduction and capture sharpening are judgements about single pixels, and a
 
 The grid's keys, on the photograph that is open (FR-UI-5, 2026-09-19). Judging here does not move on to the next frame: that belongs to culling, and in develop the photograph in front of you is the one being worked on.
 
-<sub>`ui/dr-ui/ui/app.slint:2764`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2832`</sub>
 
 ### Give this photograph a colour label
 
@@ -232,7 +232,7 @@ The grid's keys, on the photograph that is open (FR-UI-5, 2026-09-19). Judging h
 
 The grid's keys, on the photograph that is open, so labelling while stepping through a folder is one hand's work. The bar names the label in words beside its mark.
 
-<sub>`ui/dr-ui/ui/app.slint:2794`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2862`</sub>
 
 ### Move to the next or previous photograph
 
@@ -243,7 +243,7 @@ The grid's keys, on the photograph that is open, so labelling while stepping thr
 
 The edit on screen is saved on the way out, so stepping through a folder is as much a departure as going back to the grid and loses nothing. A and D as well as the arrows, so the left hand steps along the roll while the right stays on the mouse.
 
-<sub>`ui/dr-ui/ui/app.slint:2819`</sub>
+<sub>`ui/dr-ui/ui/app.slint:2887`</sub>
 
 ### See the photograph before you edited it
 
@@ -254,7 +254,7 @@ The edit on screen is saved on the way out, so stepping through a folder is as m
 
 Held rather than toggled, and no split screen: a split halves the working image on the tablet the column was sized for, and the comparison photographers describe making is a flick back and forth. It takes no history step, so checking whether a frame is overcooked costs nothing to undo afterwards.
 
-<sub>`ui/dr-ui/ui/app.slint:2949`</sub>
+<sub>`ui/dr-ui/ui/app.slint:3012`</sub>
 
 ### Put one control back to its default
 
@@ -338,7 +338,7 @@ The question a correction raises is whether it did what it was for — whether t
 
 One key for "up one", innermost first: a question before the sheet under it, a sheet before the view, a view before the library. Nothing is left behind a dialogue that the key walked straight past.
 
-<sub>`ui/dr-ui/ui/app.slint:1021`</sub>
+<sub>`ui/dr-ui/ui/app.slint:1026`</sub>
 
 ### Do what a sheet offers
 
@@ -346,7 +346,7 @@ One key for "up one", innermost first: a question before the sheet under it, a s
 - **Pointer** — Press its button — Export, or Copy
 - **Keyboard** — `Enter`, on the export and copy sheets
 
-<sub>`ui/dr-ui/ui/app.slint:1031`</sub>
+<sub>`ui/dr-ui/ui/app.slint:1036`</sub>
 
 ### Scroll by the scrollbar
 
@@ -521,7 +521,7 @@ The right match confidence is a property of your library, not of the model. "Wha
 
 Touch has no ctrl, so without a mode there is no way to select a second photograph — the first tap would open it. The hold is the fast way in and the button is the one that can be found.
 
-<sub>`ui/dr-ui/ui/library.slint:1706`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1732`</sub>
 
 ### Add or remove one photograph
 
@@ -531,7 +531,7 @@ Touch has no ctrl, so without a mode there is no way to select a second photogra
 
 While selecting, a tap never opens. That is the whole point of the mode: one meaning per gesture at a time. Press Done to get tap-to-open back.
 
-<sub>`ui/dr-ui/ui/library.slint:1716`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1742`</sub>
 
 ### Leave selecting
 
@@ -540,7 +540,7 @@ While selecting, a tap never opens. That is the whole point of the mode: one mea
 - **Keyboard** — `Escape`, or `Back`; an open sheet closes first
 - **See it** — [in the manual](manual/README.md#selecting-several)
 
-<sub>`ui/dr-ui/ui/library.slint:1725`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1751`</sub>
 
 ### Pick a photograph up to drag it
 
@@ -550,7 +550,7 @@ While selecting, a tap never opens. That is the whole point of the mode: one mea
 
 A finger on a photograph might be starting a scroll, and for the first half-second the grid assumes it is. Holding says otherwise, and the ring is the grid saying it heard — from there the drag cannot be lost to a scroll. A mouse never waits: the cursor is precise enough that a sideways drag is unambiguous from the first pixel.
 
-<sub>`ui/dr-ui/ui/library.slint:1756`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1782`</sub>
 
 ### Select a range
 
@@ -561,7 +561,7 @@ A finger on a photograph might be starting a scroll, and for the first half-seco
 
 This replaced a double tap, which had no visible state and could take forty photographs by accident. The run is resolved by the catalog rather than by what is on screen, so the grid can scroll between the two taps — the ranges that hurt on a tablet are longer than a screenful, which is exactly where a finger sweep runs out.
 
-<sub>`ui/dr-ui/ui/library.slint:1822`</sub>
+<sub>`ui/dr-ui/ui/library.slint:1848`</sub>
 
 ### Take the blinks out of a burst
 
@@ -571,7 +571,7 @@ This replaced a double tap, which had no visible state and could take forty phot
 
 Face indexing reads each face's eyes. The chip drops frames where the chosen people are caught blinking, and leaves sunglasses and eyes it could not read alone.
 
-<sub>`ui/dr-ui/ui/library.slint:2540`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2573`</sub>
 
 ### Find photographs with two people in them
 
@@ -581,7 +581,7 @@ Face indexing reads each face's eyes. The chip drops frames where the chosen peo
 
 "Any of them" is a union and "all of them" is an intersection. The tray is where both terms and the choice between them live, because a filter belongs on the filter bar.
 
-<sub>`ui/dr-ui/ui/library.slint:2570`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2603`</sub>
 
 ### Show only photographs with one colour label
 
@@ -591,7 +591,7 @@ Face indexing reads each face's eyes. The chip drops frames where the chosen peo
 
 Each chip is the label's mark and its name, so the one you want is found by reading it; tap the lit chip again to show every label.
 
-<sub>`ui/dr-ui/ui/library.slint:2694`</sub>
+<sub>`ui/dr-ui/ui/library.slint:2727`</sub>
 
 ### Export the selection as the last export was
 
@@ -602,7 +602,7 @@ Each chip is the label's mark and its name, so the one you want is found by read
 
 Lightroom's and darktable's chords. Every export runs on the saved defaults, so the plain chord opens them beside an Export button and the shifted one skips straight to exporting.
 
-<sub>`ui/dr-ui/ui/library.slint:3164`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3197`</sub>
 
 ### Paste copied settings onto the selection
 
@@ -611,7 +611,7 @@ Lightroom's and darktable's chords. Every export runs on the saved defaults, so
 - **Keyboard** — `Ctrl+V`
 - **See it** — [in the manual](manual/README.md#copying-settings)
 
-<sub>`ui/dr-ui/ui/library.slint:3188`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3221`</sub>
 
 ### Keyword the selection
 
@@ -621,7 +621,7 @@ Lightroom's and darktable's chords. Every export runs on the saved defaults, so
 
 Lightroom's keywording chord. The sheet opens with its field ready for typing, so the keys that judge in the grid are out of the way until it closes.
 
-<sub>`ui/dr-ui/ui/library.slint:3217`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3250`</sub>
 
 ### Show only photographs with some number of stars
 
@@ -632,7 +632,7 @@ Lightroom's keywording chord. The sheet opens with its field ready for typing, s
 
 The chips say "this many or more". A range with a ceiling — the twos and threes still to be decided — is the keyboard's alone, and the bar says so in words while it holds.
 
-<sub>`ui/dr-ui/ui/library.slint:3251`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3284`</sub>
 
 ### Give photographs a colour label
 
@@ -643,7 +643,7 @@ The chips say "this many or more". A range with a ceiling — the twos and three
 
 Lightroom's keys, so hands that learned them there need not learn them again. Purple has no key there either, and is on the bar. Every mark carries its label's initial, so the label is read without telling the colours apart.
 
-<sub>`ui/dr-ui/ui/library.slint:3301`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3334`</sub>
 
 ### Pick or reject a photograph
 
@@ -653,7 +653,7 @@ Lightroom's keys, so hands that learned them there need not learn them again. Pu
 
 The keys every culling tool uses, so muscle memory built elsewhere works here.
 
-<sub>`ui/dr-ui/ui/library.slint:3325`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3358`</sub>
 
 ### Move photographs to the trash
 
@@ -663,7 +663,7 @@ The keys every culling tool uses, so muscle memory built elsewhere works here.
 
 The bin acts on one photograph, so a stray click cannot trash a selection; the key acts on the selection because that is what every file manager's Delete does. Both are undone from the trash view.
 
-<sub>`ui/dr-ui/ui/library.slint:3352`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3385`</sub>
 
 ### Open this list
 
@@ -671,7 +671,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 - **Pointer** — Press Help in the header, and Done to put it away
 - **Keyboard** — `F1`, and `Escape` to put it away
 
-<sub>`ui/dr-ui/ui/library.slint:3377`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3410`</sub>
 
 ### Rename the collection the grid is showing
 
@@ -679,7 +679,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 - **Pointer** — Double-click it in the sidebar
 - **Keyboard** — `F2`
 
-<sub>`ui/dr-ui/ui/library.slint:3385`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3418`</sub>
 
 ### Move through the grid
 
@@ -689,7 +689,7 @@ The bin acts on one photograph, so a stray click cannot trash a selection; the k
 
 The cursor selects what it lands on, so walking and judging are one hand's work.
 
-<sub>`ui/dr-ui/ui/library.slint:3405`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3438`</sub>
 
 ### Resize the thumbnails
 
@@ -700,7 +700,7 @@ The cursor selects what it lands on, so walking and judging are one hand's work.
 
 There is no wheel on a tablet, so without the pinch the cell size could only be changed by a control a finger cannot reach.
 
-<sub>`ui/dr-ui/ui/library.slint:3536`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3567`</sub>
 
 ### File photographs in a collection
 
@@ -710,7 +710,7 @@ There is no wheel on a tablet, so without the pinch the cell size could only be
 
 The selection is what the drag carries, which is why selecting several is worth the mode: forty photographs file in one gesture.
 
-<sub>`ui/dr-ui/ui/library.slint:3735`</sub>
+<sub>`ui/dr-ui/ui/library.slint:3766`</sub>
 
 ### Open a photograph
 
@@ -721,7 +721,7 @@ The selection is what the drag carries, which is why selecting several is worth
 
 A tap opens; a tap that *moved* does not. Travel is what separates a deliberate tap from a hand brushing past, and it is the only thing that does: the two are the same length. An earlier version required the finger to dwell 120 ms instead, and that rejected ordinary taps — a real tap is often quicker than a brush.
 
-<sub>`ui/dr-ui/ui/library.slint:4040`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4073`</sub>
 
 ### Rate a photograph without opening it
 
@@ -732,7 +732,7 @@ A tap opens; a tap that *moved* does not. Travel is what separates a deliberate
 
 A star has to take the press without it also reaching the cell, or every rating throws the user into develop.
 
-<sub>`ui/dr-ui/ui/library.slint:4163`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4196`</sub>
 
 ### Choose the frame a folded burst shows
 
@@ -742,7 +742,7 @@ A star has to take the press without it also reaching the cell, or every rating
 
 A folded burst draws its earliest frame, which is a fact about the clock and not a judgement about the photograph — nothing in this application ranks a frame (FR-CULL-5). But the point of a burst is that one of the twelve is better than the other eleven, and the photographer is the only one who knows which. So the choice is offered on the frames themselves, while they are open and side by side, which is the one moment the alternatives are on screen to be compared.
 
-<sub>`ui/dr-ui/ui/library.slint:4296`</sub>
+<sub>`ui/dr-ui/ui/library.slint:4329`</sub>
 
 ### Drop the selection but keep selecting
 
@@ -753,7 +753,7 @@ A folded burst draws its earliest frame, which is a fact about the clock and not
 
 Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the next selection can start straight away.
 
-<sub>`ui/dr-ui/ui/library.slint:4987`</sub>
+<sub>`ui/dr-ui/ui/library.slint:5022`</sub>
 
 ### Select everything the grid is showing
 
@@ -764,7 +764,7 @@ Distinct from Done, which leaves the mode entirely. Clearing keeps it, so the ne
 
 A scoped grid of two hundred frames is two hundred taps otherwise, and "all of them, except those three" is a far more common shape than the taps it took to say it.
 
-<sub>`ui/dr-ui/ui/library.slint:5006`</sub>
+<sub>`ui/dr-ui/ui/library.slint:5041`</sub>
 
 ### Take photographs out of a collection
 
@@ -774,7 +774,7 @@ A scoped grid of two hundred frames is two hundred taps otherwise, and "all of t
 
 The badge on a cell says a photograph is filed in three collections and never which. This is the sheet that names them, and the only way out of one the grid is not currently scoped to.
 
-<sub>`ui/dr-ui/ui/library.slint:5187`</sub>
+<sub>`ui/dr-ui/ui/library.slint:5222`</sub>
 
 ## Settings
 

docs/manual/README.md

@@ -75,6 +75,14 @@ past the window. On a tablet they scroll by flick alone, and a thin line at
 the right-hand edge shows where the view is while it moves, fading once it
 stops; it is only a picture, and a flick that starts on it scrolls the list.
 
+A panorama gets a wider cell: about twice as wide as it is tall and it spans
+two columns, then three, then four for the widest — whichever leaves the least
+of the cell empty — with a thumbnail made for that width. One that would not
+fit in what is left of a row starts the next, so the grid still reads in the
+order the photographs were taken; the arrows walk it in that order, and up and
+down go to whatever is above or below. On a tablet, or with too few columns to
+put it beside anything, a panorama takes the whole row.
+
 `Help` in the header, or `F1`, opens the controls and shortcuts: every key and
 gesture, screen by screen, with `See it` beside those this page shows, and
 `Manual` to open this page. In develop it is the `?` beside `Settings`.
@@ -176,6 +184,18 @@ Hold `Before` to see the photograph as it was.
 
 ![Raising exposure, pulling the highlights, lifting the shadows, then holding Before](media/develop-light.gif)
 
+`Tone Mapping`, last in the group, is how the scene is fitted onto the
+screen, and it runs after every other adjustment. `White Point` says how many
+stops above middle grey reach white — raise it to bring a bright sky back
+from white, lower it for a brighter, punchier picture — and `Contrast` sets
+the slope of the curve between. Every adjustment above it works on the scene
+as the camera recorded it, highlights beyond white included, so pulling the
+highlights recovers what the sensor caught rather than what the screen could
+show. A JPEG has been fitted to a screen already, by the camera, so on a
+JPEG these two do nothing.
+
+![Raising the white point to bring the clouds back from white, lowering it for a brighter picture, raising the contrast, then holding Before](media/develop-tonemap.gif)
+
 ### Looking closer
 
 Double-click for 1:1; drag to move about; double-click again to fit. The
@@ -269,7 +289,9 @@ opacity are in the panel. Heal blends; clone copies.
 
 The `Film` chooser at the head of Adjust applies a spectral simulation of a
 named stock; below it, the print exposure and push controls a film has and a
-sensor does not. The list opens over the column and scrolls on its own — by
+sensor does not. A stock takes the place of `Tone Mapping`: it is the last
+thing that happens to the picture, so every other adjustment decides the
+exposure the negative receives. The list opens over the column and scrolls on its own — by
 wheel, drag or flick, or with `Up`, `Down` and `Enter` — down to the
 black-and-white stocks at its end.
 
@@ -287,22 +309,32 @@ a gradient over the sky whose `Print Exposure` burns it in.
 ### History, snapshots, presets
 
 Every change is a step; `Undo` and the History panel walk them. `Snapshot`
-keeps the current state under a name. `Presets…` saves the settings to
-apply elsewhere, and imports Lightroom presets — `Folder…` for a folder of
-them, `.xmp file…` for one.
+keeps the current state under a name. `Presets`, at the foot of the tool
+rail on the left, opens a menu of presets beside the rail, over the photograph, filed in
+folders that start closed: your own under `Yours`, then the ones DarkRoom
+ships — `Essentials`, `Skies`, and `Film`, which holds `Colour`, `Cinema`
+and `Black and white`, one measured stock each. Choosing a folder opens it;
+choosing a preset applies it. The menu's last row, `Save or manage…`, opens
+the presets sheet, which lists the same folders and saves the settings to
+apply elsewhere, renames and deletes them, and imports Lightroom presets —
+`Folder…` for a folder of them, `.xmp file…` for one.
 
-The sheet lists your own presets first, then the ones DarkRoom ships —
-Essentials, Skies, and colour, cinema and black-and-white film, one measured stock
-each. A shipped preset is a look: it changes what it names and leaves the
+A `/` in a name files the preset: `Portraits/Warm skin` is `Warm skin` in a
+`Portraits` folder under `Yours`, and renaming it is how it moves. An
+imported Lightroom folder keeps its groups the same way.
+
+A shipped preset is a look: it changes what it names and leaves the
 photograph's own corrections alone, as an imported Lightroom preset does.
 Saving under a shipped preset's name makes your version the one that name
 applies, marked *changed*; `Revert` brings the shipped one back, and renaming
 yours makes it one of your own. A film preset carries its stock: choosing one
 sets the `Film` chooser and leaves the rest of the edit where it was.
 
+![The presets menu beside the tool rail, with Film and its colour stocks open](media/presets-menu.png)
+
 ![The presets sheet: a name for the current edit, the shipped Essentials, importing, and what an apply carries](media/presets.png)
 
-![Scrolling down the shipped presets to the black-and-white films, applying Ilford HP5 Plus, then holding Before](media/presets-film.gif)
+![Opening Film, then Black and white, in the presets menu and applying Ilford HP5 Plus, then holding Before](media/presets-film.gif)
 
 ### Copying settings
 
@@ -310,7 +342,7 @@ sets the `Film` chooser and leaves the rest of the edit where it was.
 or Ctrl+V, puts them on another, and says what it would paste — how many
 adjustments, and whether the crop comes too. In the grid, `Paste to N` on the
 selection bar pastes onto every photograph selected. Which kinds of edit a
-copy carries is chosen in `Presets…`, or with Ctrl+Shift+C: a look carried
+copy carries is chosen in the presets sheet, or with Ctrl+Shift+C: a look carried
 across a shoot usually leaves each frame's own crop alone.
 
 ## Merging a panorama
@@ -321,15 +353,35 @@ outlined where it landed — twelve hand-held portrait frames across an alpine
 valley, here. Change the projection (a 150° sweep on a flat perspective is
 what the middle of the film shows, and why cylindrical is suggested), ask for
 the border to be filled rather than cropped, then `Merge`. The composite is
-written beside its sources as a DNG and appears in the grid with the merge
-as the first step in its history.
+written beside its sources as a DNG and is in the grid the moment it is
+written — in a wide cell beside its frames, placed by when they were taken —
+with the merge as the first step in its history. Its thumbnail is made during
+the merge, from the finished picture, as develop will show it when you open
+it; on a server library it is in the grid while the file is still uploading.
+A second merge of the same frames is named `-pano-2`, never written over the
+first.
 
-![Twelve frames aligned, the projections tried, and the border filled](media/panorama.gif)
+Each frame has a box in the `Frames` list. Untick one to leave it out, and
+the rest are aligned again at once, without reading the frames again; tick
+it to bring it back. A frame that cannot be placed is named there with why,
+and `Merge` stays off until it is unticked. Blown sky stays white in the
+preview and in the composite.
+
+A panorama is usually far wider than a graphics card can draw in one piece.
+It opens in develop all the same, on a reduced copy that is drawn from the
+full resolution wherever you zoom in, and it exports at full size. The same
+goes for a panorama Lightroom stitched and saved as a DNG.
+
+![A 22 927 × 8966 panorama of a glacier at dusk: zoomed from the whole frame into the peaks, panned along the ridge and back out, then 1:1 on the peaks with a double-click](media/giant-pano.gif)
+
+![Twelve frames aligned, the first left out and brought back, the projections tried, and the border filled](media/panorama.gif)
 
 ![The alignment on a cylinder, each frame outlined where it landed](media/panorama-aligned.png)
 
 ![The same, with the ragged border filled by the model rather than cropped away](media/panorama-filled.png)
 
+![The composite in the grid straight after the merge, spanning four columns beside the twelve frames it was made from](media/panorama-in-grid.png)
+
 ## Export
 
 `Export` in the develop header, or `Export N` from a selection. Format,

docs/manual/index.html

@@ -194,6 +194,13 @@ the sidebar, the develop column and Settings have one too whenever they run
 past the window. On a tablet they scroll by flick alone, and a thin line at
 the right-hand edge shows where the view is while it moves, fading once it
 stops; it is only a picture, and a flick that starts on it scrolls the list.</p>
+<p>A panorama gets a wider cell: about twice as wide as it is tall and it spans
+two columns, then three, then four for the widest — whichever leaves the least
+of the cell empty — with a thumbnail made for that width. One that would not
+fit in what is left of a row starts the next, so the grid still reads in the
+order the photographs were taken; the arrows walk it in that order, and up and
+down go to whatever is above or below. On a tablet, or with too few columns to
+put it beside anything, a panorama takes the whole row.</p>
 <p><code>Help</code> in the header, or <code>F1</code>, opens the controls and shortcuts: every key and
 gesture, screen by screen, with <code>See it</code> beside those this page shows, and
 <code>Manual</code> to open this page. In develop it is the <code>?</code> beside <code>Settings</code>.</p>
@@ -264,6 +271,16 @@ the strip at its head narrows it to one group.</p>
 <p>Exposure, contrast, highlights, shadows, blacks, whites and a tone curve.
 Hold <code>Before</code> to see the photograph as it was.</p>
 <figure><img loading="lazy" src="media/develop-light.gif" alt="Raising exposure, pulling the highlights, lifting the shadows, then holding Before"><figcaption>Raising exposure, pulling the highlights, lifting the shadows, then holding Before</figcaption></figure>
+<p><code>Tone Mapping</code>, last in the group, is how the scene is fitted onto the
+screen, and it runs after every other adjustment. <code>White Point</code> says how many
+stops above middle grey reach white — raise it to bring a bright sky back
+from white, lower it for a brighter, punchier picture — and <code>Contrast</code> sets
+the slope of the curve between. Every adjustment above it works on the scene
+as the camera recorded it, highlights beyond white included, so pulling the
+highlights recovers what the sensor caught rather than what the screen could
+show. A JPEG has been fitted to a screen already, by the camera, so on a
+JPEG these two do nothing.</p>
+<figure><img loading="lazy" src="media/develop-tonemap.gif" alt="Raising the white point to bring the clouds back from white, lowering it for a brighter picture, raising the contrast, then holding Before"><figcaption>Raising the white point to bring the clouds back from white, lowering it for a brighter picture, raising the contrast, then holding Before</figcaption></figure>
 <h3 id="looking-closer">Looking closer</h3>
 <p>Double-click for 1:1; drag to move about; double-click again to fit. The
 wheel zooms to any amount in between. Past 1:1 the file's own pixels are
@@ -329,7 +346,9 @@ opacity are in the panel. Heal blends; clone copies.</p>
 <h3 id="film">Film</h3>
 <p>The <code>Film</code> chooser at the head of Adjust applies a spectral simulation of a
 named stock; below it, the print exposure and push controls a film has and a
-sensor does not. The list opens over the column and scrolls on its own — by
+sensor does not. A stock takes the place of <code>Tone Mapping</code>: it is the last
+thing that happens to the picture, so every other adjustment decides the
+exposure the negative receives. The list opens over the column and scrolls on its own — by
 wheel, drag or flick, or with <code>Up</code>, <code>Down</code> and <code>Enter</code> — down to the
 black-and-white stocks at its end.</p>
 <figure><img loading="lazy" src="media/film.gif" alt="Opening the film list, scrolling it, choosing Velvia, then holding Before"><figcaption>Opening the film list, scrolling it, choosing Velvia, then holding Before</figcaption></figure>
@@ -342,25 +361,33 @@ a gradient over the sky whose <code>Print Exposure</code> burns it in.</p>
 <figure><img loading="lazy" src="media/film-local.gif" alt="Kodak Ektar 100 on the whole frame, a gradient turned to cover the sky, its Print Exposure raised to burn the sky in, then holding Before"><figcaption>Kodak Ektar 100 on the whole frame, a gradient turned to cover the sky, its Print Exposure raised to burn the sky in, then holding Before</figcaption></figure>
 <h3 id="history-snapshots-presets">History, snapshots, presets</h3>
 <p>Every change is a step; <code>Undo</code> and the History panel walk them. <code>Snapshot</code>
-keeps the current state under a name. <code>Presets…</code> saves the settings to
-apply elsewhere, and imports Lightroom presets — <code>Folder…</code> for a folder of
-them, <code>.xmp file…</code> for one.</p>
-<p>The sheet lists your own presets first, then the ones DarkRoom ships —
-Essentials, Skies, and colour, cinema and black-and-white film, one measured stock
-each. A shipped preset is a look: it changes what it names and leaves the
+keeps the current state under a name. <code>Presets</code>, at the foot of the tool
+rail on the left, opens a menu of presets beside the rail, over the photograph, filed in
+folders that start closed: your own under <code>Yours</code>, then the ones DarkRoom
+ships — <code>Essentials</code>, <code>Skies</code>, and <code>Film</code>, which holds <code>Colour</code>, <code>Cinema</code>
+and <code>Black and white</code>, one measured stock each. Choosing a folder opens it;
+choosing a preset applies it. The menu's last row, <code>Save or manage…</code>, opens
+the presets sheet, which lists the same folders and saves the settings to
+apply elsewhere, renames and deletes them, and imports Lightroom presets —
+<code>Folder…</code> for a folder of them, <code>.xmp file…</code> for one.</p>
+<p>A <code>/</code> in a name files the preset: <code>Portraits/Warm skin</code> is <code>Warm skin</code> in a
+<code>Portraits</code> folder under <code>Yours</code>, and renaming it is how it moves. An
+imported Lightroom folder keeps its groups the same way.</p>
+<p>A shipped preset is a look: it changes what it names and leaves the
 photograph's own corrections alone, as an imported Lightroom preset does.
 Saving under a shipped preset's name makes your version the one that name
 applies, marked <em>changed</em>; <code>Revert</code> brings the shipped one back, and renaming
 yours makes it one of your own. A film preset carries its stock: choosing one
 sets the <code>Film</code> chooser and leaves the rest of the edit where it was.</p>
+<figure><img loading="lazy" src="media/presets-menu.png" alt="The presets menu beside the tool rail, with Film and its colour stocks open"><figcaption>The presets menu beside the tool rail, with Film and its colour stocks open</figcaption></figure>
 <figure><img loading="lazy" src="media/presets.png" alt="The presets sheet: a name for the current edit, the shipped Essentials, importing, and what an apply carries"><figcaption>The presets sheet: a name for the current edit, the shipped Essentials, importing, and what an apply carries</figcaption></figure>
-<figure><img loading="lazy" src="media/presets-film.gif" alt="Scrolling down the shipped presets to the black-and-white films, applying Ilford HP5 Plus, then holding Before"><figcaption>Scrolling down the shipped presets to the black-and-white films, applying Ilford HP5 Plus, then holding Before</figcaption></figure>
+<figure><img loading="lazy" src="media/presets-film.gif" alt="Opening Film, then Black and white, in the presets menu and applying Ilford HP5 Plus, then holding Before"><figcaption>Opening Film, then Black and white, in the presets menu and applying Ilford HP5 Plus, then holding Before</figcaption></figure>
 <h3 id="copying-settings">Copying settings</h3>
 <p><code>Copy</code> in the top bar, or Ctrl+C, takes this photograph's settings; <code>Paste</code>,
 or Ctrl+V, puts them on another, and says what it would paste — how many
 adjustments, and whether the crop comes too. In the grid, <code>Paste to N</code> on the
 selection bar pastes onto every photograph selected. Which kinds of edit a
-copy carries is chosen in <code>Presets…</code>, or with Ctrl+Shift+C: a look carried
+copy carries is chosen in the presets sheet, or with Ctrl+Shift+C: a look carried
 across a shoot usually leaves each frame's own crop alone.</p>
 <h2 id="merging-a-panorama">Merging a panorama</h2>
 <p>Select the frames, then <code>Merge to panorama</code> from the selection bar. The
@@ -369,11 +396,27 @@ outlined where it landed — twelve hand-held portrait frames across an alpine
 valley, here. Change the projection (a 150° sweep on a flat perspective is
 what the middle of the film shows, and why cylindrical is suggested), ask for
 the border to be filled rather than cropped, then <code>Merge</code>. The composite is
-written beside its sources as a DNG and appears in the grid with the merge
-as the first step in its history.</p>
-<figure><img loading="lazy" src="media/panorama.gif" alt="Twelve frames aligned, the projections tried, and the border filled"><figcaption>Twelve frames aligned, the projections tried, and the border filled</figcaption></figure>
+written beside its sources as a DNG and is in the grid the moment it is
+written — in a wide cell beside its frames, placed by when they were taken —
+with the merge as the first step in its history. Its thumbnail is made during
+the merge, from the finished picture, as develop will show it when you open
+it; on a server library it is in the grid while the file is still uploading.
+A second merge of the same frames is named <code>-pano-2</code>, never written over the
+first.</p>
+<p>Each frame has a box in the <code>Frames</code> list. Untick one to leave it out, and
+the rest are aligned again at once, without reading the frames again; tick
+it to bring it back. A frame that cannot be placed is named there with why,
+and <code>Merge</code> stays off until it is unticked. Blown sky stays white in the
+preview and in the composite.</p>
+<p>A panorama is usually far wider than a graphics card can draw in one piece.
+It opens in develop all the same, on a reduced copy that is drawn from the
+full resolution wherever you zoom in, and it exports at full size. The same
+goes for a panorama Lightroom stitched and saved as a DNG.</p>
+<figure><img loading="lazy" src="media/giant-pano.gif" alt="A 22 927 × 8966 panorama of a glacier at dusk: zoomed from the whole frame into the peaks, panned along the ridge and back out, then 1:1 on the peaks with a double-click"><figcaption>A 22 927 × 8966 panorama of a glacier at dusk: zoomed from the whole frame into the peaks, panned along the ridge and back out, then 1:1 on the peaks with a double-click</figcaption></figure>
+<figure><img loading="lazy" src="media/panorama.gif" alt="Twelve frames aligned, the first left out and brought back, the projections tried, and the border filled"><figcaption>Twelve frames aligned, the first left out and brought back, the projections tried, and the border filled</figcaption></figure>
 <figure><img loading="lazy" src="media/panorama-aligned.png" alt="The alignment on a cylinder, each frame outlined where it landed"><figcaption>The alignment on a cylinder, each frame outlined where it landed</figcaption></figure>
 <figure><img loading="lazy" src="media/panorama-filled.png" alt="The same, with the ragged border filled by the model rather than cropped away"><figcaption>The same, with the ragged border filled by the model rather than cropped away</figcaption></figure>
+<figure><img loading="lazy" src="media/panorama-in-grid.png" alt="The composite in the grid straight after the merge, spanning four columns beside the twelve frames it was made from"><figcaption>The composite in the grid straight after the merge, spanning four columns beside the twelve frames it was made from</figcaption></figure>
 <h2 id="export">Export</h2>
 <p><code>Export</code> in the develop header, or <code>Export N</code> from a selection. Format,
 size, colour space, sharpening and naming are in Settings, and apply to every