Release 0.14.0

Nine agent branches, merged one at a time on ui-wiring and gated at each
step: develop.rs, library.rs, collections_ui.rs and library_ui.rs become
module directories; every screen's wire() and lib.rs::run() become lists
of named functions, with the develop screen's callbacks in develop_ui.rs;
the six view booleans become View and Page enums; the collections sidebar
and the library grid get their own Slint globals, taking 155 members off
AppWindow. No behaviour change: a multiset audit of code lines over every
moved region lost nothing, the workspace gate is clean, and the manual
recorded from this build and from master's from the same library snapshot
matches picture for picture, apart from a panorama stall that master
shows too when a merge starts during the engine's TensorRT compile queue.

.gitattributes

@@ -1,6 +1,6 @@
 # Model weights live in LFS.
 #
-# `core/dr-segment/models/*.onnx` is ~11 MB of binary that changes wholesale
+# `models/**/*.onnx` is tens of MB of binary that changes wholesale
 # when it changes at all. In ordinary git objects every future revision of it
 # would be stored in full, in every clone, forever — and the one thing nobody
 # can do with it is a useful diff.
@@ -10,3 +10,19 @@
 # detects exactly that and fails with an instruction rather than embedding the
 # pointer and failing at inference time.
 *.onnx filter=lfs diff=lfs merge=lfs -text
+
+# Test photographs live in LFS too, and are fetched only by the tests that
+# need them.
+#
+# `fixtures/**` holds real camera files — a twelve-frame panorama set is
+# 325 MB — and CI's `git lfs pull` excludes the directory, so a checkout
+# carries pointers there until a merge test asks for the frames. Same
+# reasoning as the models, with the opposite default: the model is not
+# optional and the fixtures are.
+fixtures/** filter=lfs diff=lfs merge=lfs -text
+
+# The manual's pictures live in LFS for the same reason the models do: a
+# screenshot or a GIF changes wholesale when the interface it shows changes,
+# and every re-recording would otherwise stay in every clone for good. CI's
+# pulls exclude the directory; nothing built or tested reads it.
+docs/manual/media/** filter=lfs diff=lfs merge=lfs -text

.gitea/workflows/benchmark.yml

@@ -0,0 +1,193 @@
+name: Benchmarks
+
+# The suite docs/dev/requirements.md §8 has been promising since it was written:
+# "an automated benchmark suite against a synthetic 50k catalog, run per-commit
+# … A regression beyond stated tolerance fails the build."
+#
+# Its own workflow rather than a step inside build-and-test.yml, and the reason
+# is what a failure here means. A red `Build and test` says the code is wrong; a
+# red `Benchmarks` says the code is slower than it was, which is a different
+# conversation, is read by different people, and must not be reachable by
+# retrying a flaky compile.
+#
+# # Why this is split in two
+#
+# §8 names "the reference desktop", not CI, and it is right to. So:
+#
+#   cpu — runs on every push. It needs no adapter and no display, and the
+#         budgets it asserts (a 50k catalog opening inside two seconds) have
+#         two orders of magnitude of headroom, so a modest runner can be held
+#         to them honestly. Machine-sensitive budgets — throughput targets
+#         written for a 24-thread desktop — are reported here rather than
+#         asserted; `dr-bench` decides that per metric and says so in its
+#         report. Asserting them on a two-core container would produce exactly
+#         what core/dr-gpu/tests/frame_budget.rs refused to produce: a red gate
+#         everybody learns to ignore.
+#
+#   gpu — the frame budget, which already exists and already skips itself where
+#         there is no adapter. Not on push: it would build wgpu and naga on
+#         every commit to establish, every time, that this runner has no GPU. It
+#         runs on demand (Actions → Run workflow) so that a runner that *does*
+#         have one can be pointed at it, and the numbers it produces belong in
+#         docs/dev/frame-budget.md by hand, as they already are.
+
+on:
+  push:
+    branches: [main, master, develop]
+  pull_request:
+    branches: [main, master, develop]
+  workflow_dispatch:
+
+jobs:
+  cpu:
+    runs-on: linux/amd64
+    name: CPU and I/O (per commit)
+    # Node for actions/checkout and actions/cache, which the bare runner image
+    # cannot execute. Rust is installed below.
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    env:
+      # Same reasoning as the desktop job in build-and-test.yml: incremental
+      # state exists to make the *second* build in a working tree fast, which is
+      # not a thing a fresh checkout has, and it fills the runner's disk.
+      CARGO_INCREMENTAL: 0
+      # The fixture, out of the workspace so actions/cache never picks it up.
+      # A 14 MB synthetic catalog is two seconds to regenerate and would
+      # otherwise be uploaded and downloaded on every push to save them.
+      DR_BENCH_DIR: /tmp/darkroom-bench
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # No `git lfs pull` here, deliberately. `dr-bench` depends on the catalog,
+      # the decoder, the thumbnail store and the encoder, and on nothing that
+      # reaches `dr-segment` — so the model this repository keeps in LFS is not
+      # part of this job's dependency graph and fetching it would be a minute
+      # spent on a file nothing opens.
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: bench-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      # Pinned to the workspace rust-version, as every other job here is: a
+      # floating toolchain turns an unrelated push into a mystery failure, and
+      # for a benchmark it would turn one into a mystery *regression*.
+      #
+      # rust-analyzer is named for the reason build-and-test.yml gives: rustup
+      # reconciles rust-toolchain.toml on the first cargo call whatever this
+      # step asks for, so naming it keeps the download inside the step that says
+      # it is installing things.
+      - name: Install Rust 1.92.0
+        run: |
+          set -e
+          curl -fsSL https://sh.rustup.rs | sh -s -- \
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0 \
+            --component rust-analyzer
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      # `-p dr-bench`, not `--workspace`. The whole point of that crate having
+      # no GPU and no UI dependency is that this job resolves the catalog, the
+      # decoder and the encoders and stops there — a few minutes rather than the
+      # release build of Slint and wgpu the desktop job pays for.
+      #
+      # Release, and it is not optional: the workspace builds its own crates at
+      # opt-level = 0 in dev, and every figure this produces is dominated by
+      # this workspace's own code. A debug run would measure rustc.
+      - name: Build the suite
+        run: cargo build --release -p dr-bench
+
+      # Exit 1 is a violated budget or a regression past tolerance; exit 2 is
+      # the harness failing to run at all. Both fail the job, and the report
+      # above the failure says which.
+      - name: Measure, and gate
+        run: cargo run --release -p dr-bench -- check
+
+      - name: Disk after
+        if: always()
+        run: df -h /workspace 2>/dev/null || df -h .
+
+  gpu:
+    # On demand only — see the header. A runner with a Vulkan device can be
+    # pointed at this; one without will skip the measurement and say so, which
+    # is the same posture the rest of this repository's device tests take.
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: linux/amd64
+    name: Frame budget (on demand)
+    container:
+      image: catthehacker/ubuntu:act-latest
+
+    env:
+      CARGO_INCREMENTAL: 0
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # `dr-gpu` depends on `dr-segment` for the watershed's pixel passes. Its
+      # default features are off, so no weights are compiled in — but the fetch
+      # is cheap insurance and its failure is not fatal. The header of the same
+      # step in build-and-test.yml explains why the extraheader is stripped
+      # rather than reused: two Authorization headers is a 400 from Gitea, one
+      # step after the batch call that had just succeeded.
+      - name: Fetch the segmentation model
+        continue-on-error: true
+        env:
+          LFS_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+        run: |
+          set -e
+          git lfs install --local
+          git config --local --get-regexp '^http\..*extraheader$' \
+            | cut -d' ' -f1 | sort -u \
+            | while read -r key; do git config --local --unset-all "$key"; done || true
+          git config --local lfs.url \
+            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
+          git lfs pull --exclude="fixtures/**,docs/manual/media/**"
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: bench-gpu-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
+
+      - name: Build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y -qq pkg-config libfontconfig1-dev libxkbcommon-dev
+
+      - name: Install Rust 1.92.0
+        run: |
+          set -e
+          curl -fsSL https://sh.rustup.rs | sh -s -- \
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0 \
+            --component rust-analyzer
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      # The guard, in release. Its own module documentation is explicit that a
+      # release run checks strictly more than a dev one: the CPU half of a frame
+      # is shader-string assembly, which is several times slower unoptimised, so
+      # it is folded into the assertion only when debug_assertions is off.
+      #
+      # With no adapter this prints "skipping: no GPU adapter" and passes. A
+      # test that cannot run is not evidence either way, and turning that into a
+      # failure would make the job useless on the runner it usually lands on.
+      - name: Frame budget (FR-DSP-3)
+        run: cargo test --release -p dr-gpu --test frame_budget -- --nocapture
+
+      # The instrument behind docs/dev/frame-budget.md. It exits non-zero with no
+      # adapter, which is right for a tool a person runs deliberately and wrong
+      # for a job that usually has none — hence continue-on-error. Its table is
+      # in the log for whoever asked for this run; the committed numbers are
+      # still updated by hand, as that file says.
+      - name: Frame budget table
+        continue-on-error: true
+        run: cargo run --release -p dr-gpu --example frame_budget

.gitea/workflows/build-and-test.yml

@@ -27,10 +27,78 @@ jobs:
     container:
       image: catthehacker/ubuntu:act-latest
 
+    # This job filled the runner's disk and died mid-link with "No space left
+    # on device" — LLVM reporting an IO failure on its output stream, which
+    # reads like a compiler crash and is not one.
+    #
+    # `target/debug` was 24 GB against `target/release`'s 2.6 GB: 15 GB of it
+    # debug info in `debug/deps`, 3.6 GB incremental state. Neither earns its
+    # space here. Nothing attaches a debugger to a CI run, and incremental
+    # compilation exists to make the *second* build in a working tree fast,
+    # which is not a thing a fresh checkout has. Turning both off is the
+    # standard CI setting rather than a trick.
+    #
+    # Measured on this workspace: the same `cargo test --workspace --no-run`
+    # tree goes from 24 GB to 3.3 GB, `debug/deps` from 15 GB to 2.8 GB.
+    #
+    # Backtraces still name functions without debug info; they lose file and
+    # line numbers. If a test failure ever needs those, drop DEBUG to 1
+    # (line-tables-only) rather than back to 2.
+    #
+    # This is a mitigation, not a fix. If the runner is full of anything other
+    # than this job's own output, it will still be full afterwards.
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # The model, which is in LFS and is not optional.
+      #
+      # `models/**/*.onnx` is tracked in LFS (.gitattributes), so a
+      # plain checkout writes a ~130-byte pointer where 11 MB should be, and
+      # `dr-segment`'s build script panics by design rather than embedding a
+      # pointer and failing at inference. That failure reads like a broken build
+      # instead of a missing fetch, which is how it went unnoticed.
+      #
+      # Not `lfs: true` on the checkout above, and no `Authorization` header
+      # here either. Both install a blanket header for every request to this
+      # host, and the object download is the one request that already carries
+      # one: `git lfs pull` asks `/info/lfs/objects/batch` first, and Gitea
+      # answers with a short-lived `Bearer` JWT scoped to that object. git-lfs
+      # then sends the JWT *and* the configured header, and two `Authorization`
+      # headers is a 400 from Gitea — reported as
+      #   LFS: Client error: .../info/lfs/objects/<oid>
+      # one step after the batch call that had just succeeded, which reads like
+      # a rejected credential rather than a duplicated one. A lone token header
+      # is understood fine; it is only the collision that fails.
+      #
+      # So: strip the headers and hand the token to git-lfs as an ordinary
+      # credential instead. It authenticates the batch call and leaves the
+      # per-object JWT untouched. Gitea authenticates on the password, so the
+      # username is a placeholder. Nothing later in this job talks to the
+      # remote, so dropping checkout's header costs us nothing.
+      #
+      # `continue-on-error` deliberately: if this cannot authenticate, the build
+      # below still runs and fails with the build script's own message, which
+      # names the real problem. A checkout that dies here says nothing.
+      - name: Fetch the segmentation model
+        continue-on-error: true
+        env:
+          LFS_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+        run: |
+          set -e
+          git lfs install --local
+          git config --local --get-regexp '^http\..*extraheader$' \
+            | cut -d' ' -f1 | sort -u \
+            | while read -r key; do git config --local --unset-all "$key"; done || true
+          git config --local lfs.url \
+            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
+          git lfs pull --exclude="fixtures/**,docs/manual/media/**"
+          ls -lR models/
+
       - name: Cache cargo
         uses: actions/cache@v4
         with:
@@ -49,14 +117,28 @@ jobs:
       # The act image ships Node but no Rust. Pinned to the workspace
       # rust-version so CI, the Android image, and local builds agree — a
       # floating toolchain turns an unrelated push into a mystery failure.
+      #
+      # The component list mirrors rust-toolchain.toml's, rust-analyzer
+      # included, even though nothing in this job runs it. rustup reconciles
+      # that file against the installed toolchain on the first cargo call in
+      # the work tree and fetches whatever is missing — so leaving it out does
+      # not save the download, it only moves it into the middle of a build
+      # step where it is nobody's line item. Naming it here keeps every fetch
+      # inside the step whose name says it is installing things.
       - name: Install Rust 1.92.0
         run: |
           set -e
           curl -fsSL https://sh.rustup.rs | sh -s -- \
             -y --no-modify-path --profile minimal \
-            --default-toolchain 1.92.0 --component rustfmt,clippy
+            --default-toolchain 1.92.0 --component rustfmt,clippy,rust-analyzer
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
+      # Free space before and after the expensive steps, so a repeat of the
+      # disk exhaustion above is one line to diagnose instead of a puzzling
+      # LLVM error.
+      - name: Disk before
+        run: df -h /workspace 2>/dev/null || df -h .
+
       - name: Format
         run: cargo fmt --all -- --check
 
@@ -72,6 +154,10 @@ jobs:
       - name: Build
         run: cargo build --workspace --release
 
+      - name: Disk after
+        if: always()
+        run: df -h /workspace 2>/dev/null || df -h .
+
   android:
     runs-on: linux/amd64
     name: Android (aarch64)
@@ -86,6 +172,50 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # The model, which is in LFS and is not optional.
+      #
+      # `models/**/*.onnx` is tracked in LFS (.gitattributes), so a
+      # plain checkout writes a ~130-byte pointer where 11 MB should be, and
+      # `dr-segment`'s build script panics by design rather than embedding a
+      # pointer and failing at inference. That failure reads like a broken build
+      # instead of a missing fetch, which is how it went unnoticed.
+      #
+      # Not `lfs: true` on the checkout above, and no `Authorization` header
+      # here either. Both install a blanket header for every request to this
+      # host, and the object download is the one request that already carries
+      # one: `git lfs pull` asks `/info/lfs/objects/batch` first, and Gitea
+      # answers with a short-lived `Bearer` JWT scoped to that object. git-lfs
+      # then sends the JWT *and* the configured header, and two `Authorization`
+      # headers is a 400 from Gitea — reported as
+      #   LFS: Client error: .../info/lfs/objects/<oid>
+      # one step after the batch call that had just succeeded, which reads like
+      # a rejected credential rather than a duplicated one. A lone token header
+      # is understood fine; it is only the collision that fails.
+      #
+      # So: strip the headers and hand the token to git-lfs as an ordinary
+      # credential instead. It authenticates the batch call and leaves the
+      # per-object JWT untouched. Gitea authenticates on the password, so the
+      # username is a placeholder. Nothing later in this job talks to the
+      # remote, so dropping checkout's header costs us nothing.
+      #
+      # `continue-on-error` deliberately: if this cannot authenticate, the build
+      # below still runs and fails with the build script's own message, which
+      # names the real problem. A checkout that dies here says nothing.
+      - name: Fetch the segmentation model
+        continue-on-error: true
+        env:
+          LFS_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+        run: |
+          set -e
+          git lfs install --local
+          git config --local --get-regexp '^http\..*extraheader$' \
+            | cut -d' ' -f1 | sort -u \
+            | while read -r key; do git config --local --unset-all "$key"; done || true
+          git config --local lfs.url \
+            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
+          git lfs pull --exclude="fixtures/**,docs/manual/media/**"
+          ls -lR models/
+
       - name: Cache cargo
         uses: actions/cache@v4
         with:
@@ -94,8 +224,15 @@ jobs:
             target-android
           key: android-${{ hashFiles('**/Cargo.lock') }}
 
-      # Only the core crates cross-compile today; the UI and app crates join
-      # once the Android shell exists (milestone v0.1, FR-PLAT-AND-*).
+      # A fast gate on the crates most likely to break the cross-compile, run
+      # before the expensive part. It is `cargo check`, so it type-checks
+      # without linking and returns in a fraction of the time the step below
+      # takes.
+      #
+      # Not a statement that only these crates cross-compile — `darkroom-android`
+      # and the whole UI stack beneath it build for aarch64 too, which is what
+      # the API-level step below does. This one exists to fail fast and name a
+      # smaller suspect when it does.
       - name: Cross-compile core
         env:
           CARGO_TARGET_DIR: target-android
@@ -117,7 +254,19 @@ jobs:
           CARGO_TARGET_DIR: target-android
         run: |
           set -e
-          cargo ndk -t arm64-v8a build -p dr-gpu --release
+          # `darkroom-android`, not a core crate: this step reads the API level
+          # out of a *linked* object, and only that crate produces one. It is
+          # the workspace's single `crate-type = ["cdylib"]`; a library crate
+          # builds an rlib, which is an archive of object files that no linker
+          # has yet touched and that `file` therefore has nothing to say about.
+          # Asking for `-p dr-gpu` here could only ever reach the "no aarch64
+          # .so was produced" branch below, whatever the linker did.
+          #
+          # It is also the honest artefact to check: the .so this names is the
+          # one that ships in the APK, so the API level verified here is the
+          # API level a device will refuse to install against.
+          cargo ndk -t arm64-v8a -o target-android/jniLibs \
+            build -p darkroom-android --release
           MIN_API=$(sed -n 's/^ARG MIN_API=\([0-9]*\).*/\1/p' docker/android/Dockerfile)
           # Empty on both sides would compare equal and pass, so neither side
           # is allowed to be the result of a failed parse.
@@ -131,12 +280,201 @@ jobs:
             exit 1
           fi
           echo "checking $SO"
-          file "$SO"
-          API=$(file "$SO" | sed -n 's/.*for Android \([0-9]*\).*/\1/p')
-          if [ -z "$API" ] || [ "$API" != "$MIN_API" ]; then
-            echo "FAIL: linked for Android '${API:-unknown}', expected $MIN_API"
+          # `file` is kept for the log — it names the NDK that built this — but
+          # the check no longer depends on it.
+          file "$SO" || true
+          # The API level is the first word of the `.note.android.ident` ELF
+          # note, little-endian. Read the note rather than asking `file` for it:
+          # `file` only prints "for Android 28" when its magic database is new
+          # enough to decode that note, and this image's is not. The parse then
+          # produced nothing, `${API:-unknown}` reported "unknown", and every
+          # push failed here for weeks on a .so that was linked perfectly
+          # correctly. A note read straight out of the ELF cannot go stale that
+          # way.
+          readelf -n "$SO" | sed -n '/android.ident/,+3p'
+          HEX=$(readelf -n "$SO" 2>/dev/null \
+                | awk '/description data:/ { print $6 $5 $4 $3; exit }')
+          if [ -z "$HEX" ]; then
+            echo "FAIL: no .note.android.ident in $SO — nothing states an API level"
             exit 1
           fi
+          API=$(( 0x$HEX ))
+          if [ "$API" != "$MIN_API" ]; then
+            echo "FAIL: linked for Android $API, expected $MIN_API"
+            exit 1
+          fi
+          echo "OK: linked for Android $API"
+
+      # The APK itself, so a run leaves something installable behind rather
+      # than only the knowledge that it would have linked. The assembly is
+      # `docker/android/assemble-apk.sh`, shared with `package.sh` so the file
+      # a device gets from `package.sh --install` and the file published here
+      # are built by the same code — see that script's header.
+      #
+      # `KEYSTORE` deliberately points at a throwaway directory instead of its
+      # default under `target-android`: that directory is what `actions/cache`
+      # restores and saves, and a signing key has no business in a build cache
+      # or in anything this job uploads. A fresh debug key per run is the right
+      # trade for an artefact whose purpose is getting the app onto a test
+      # device; nothing upgrades in place over it, which is the one thing a
+      # stable key would buy.
+      - name: Package the APK
+        env:
+          CARGO_TARGET_DIR: target-android
+          # Absent secrets mean a debug signature, which is what a fork or a
+          # branch build should get. Set all three (see docs/dev/android-signing.md)
+          # and the same job produces a release-signed APK instead.
+          ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          KEYSTORE_PASS: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_PASS: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+        run: |
+          set -e
+          KEYDIR="$(mktemp -d)"
+          chmod 700 "$KEYDIR"
+          trap 'rm -rf "$KEYDIR"' EXIT
+
+          if [ -n "$ANDROID_KEYSTORE_BASE64" ]; then
+            # The keystore reaches the runner base64-encoded because a secret
+            # is a string. It is written under a 0700 mktemp directory, never
+            # into the workspace: `target-android` is what actions/cache saves,
+            # and the upload step globs the workspace.
+            printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "$KEYDIR/release.keystore"
+            export KEYSTORE="$KEYDIR/release.keystore"
+          else
+            # Not an error. Unset the rest so assemble-apk.sh takes its debug
+            # path cleanly rather than seeing a half-configured release one.
+            export KEYSTORE="$KEYDIR/debug.keystore"
+            unset KEYSTORE_PASS KEY_PASS KEY_ALIAS
+          fi
+
+          REPO="$PWD" TARGET_DIR="$PWD/target-android" \
+            bash docker/android/assemble-apk.sh
+
+      # v3, not v4. v4 is untested against this Gitea and its runner; v3 is
+      # what JellyTau uploads its APK with on this same runner, so it is the
+      # version known to work here rather than the version that ought to.
+      #
+      # `if-no-files-found: error` because the failure this guards against is
+      # a green run with an empty artefact list, which reads as success until
+      # somebody goes looking for the file.
+      - name: Upload the APK
+        uses: actions/upload-artifact@v3
+        with:
+          name: darkroom-arm64-v8a-apk
+          path: target-android/apk/darkroom.apk
+          if-no-files-found: error
+
+  windows-image:
+    uses: ./.gitea/workflows/windows-image.yml
+
+  # TRACES: FR-PLAT-WIN-3
+  # The Windows executable and its installer, cross-built from Linux
+  # (docs/dev/windows.md §7). No Windows machine anywhere in this job: what it
+  # can prove is that the binary links, is a Windows executable with no
+  # MinGW runtime imports, starts under Wine, and that the installer installs
+  # and uninstalls under Wine. What it cannot prove — a Vulkan device, a
+  # render, the secret store — is a release step on a real machine (§6).
+  windows:
+    runs-on: linux/amd64
+    name: Windows (x86_64, cross)
+    needs: windows-image
+    container:
+      image: gitea.tourolle.paris/dtourolle/darkroom-windows:latest
+    env:
+      CARGO_INCREMENTAL: 0
+      CARGO_PROFILE_DEV_DEBUG: 0
+      CARGO_TARGET_DIR: target-windows
+      # Wine keeps its prefix under $HOME, which the image points at a
+      # directory that does not exist in a fresh container.
+      HOME: /tmp/home
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Same step as the desktop leg: the models are LFS objects and the
+      # packager refuses pointers.
+      - name: Fetch the models
+        env:
+          LFS_TOKEN: ${{ secrets.GITEA_TOKEN || github.token }}
+        run: |
+          set -e
+          git lfs install --local
+          git config --local --get-regexp '^http\..*extraheader$' \
+            | cut -d' ' -f1 | sort -u \
+            | while read -r key; do git config --local --unset-all "$key"; done || true
+          git config --local lfs.url \
+            "https://x-access-token:${LFS_TOKEN}@gitea.tourolle.paris/dtourolle/DarkRoom.git/info/lfs"
+          git lfs pull --exclude="fixtures/**,docs/manual/media/**"
+          ls -l models/face models/scene
+
+      - name: Cache cargo
+        uses: actions/cache@v4
+        with:
+          path: |
+            /opt/cargo/registry
+            target-windows
+          key: windows-${{ hashFiles('**/Cargo.lock') }}
+
+      # The cfg(windows) branches are linted here and nowhere else: the
+      # desktop leg's clippy never compiles them.
+      - name: Clippy for the target
+        run: cargo clippy --release --target x86_64-pc-windows-gnu -p darkroom-desktop -- -D warnings
+
+      - name: Build
+        run: cargo build --release --target x86_64-pc-windows-gnu -p darkroom-desktop
+
+      - name: Smoke-test the executable
+        run: |
+          set -e
+          mkdir -p "$HOME"
+          EXE=target-windows/x86_64-pc-windows-gnu/release/darkroom-desktop.exe
+          file "$EXE"
+          file "$EXE" | grep -q 'PE32+' || { echo "FAIL: not a PE32+ executable"; exit 1; }
+          file "$EXE" | grep -q '(GUI)' || { echo "FAIL: not a GUI-subsystem executable"; exit 1; }
+          if x86_64-w64-mingw32-objdump -p "$EXE" | grep -iE 'libwinpthread|libgcc|libstdc'; then
+            echo "FAIL: the executable imports a MinGW runtime DLL"
+            exit 1
+          fi
+          x86_64-w64-mingw32-objdump -p "$EXE" | grep 'DLL Name' | sort -u
+          wineboot --init >/dev/null 2>&1 || true
+          OUT=$(wine "$EXE" --version 2>/dev/null)
+          echo "wine: $OUT"
+          echo "$OUT" | grep -q '^darkroom-desktop ' || { echo "FAIL: --version did not answer under Wine"; exit 1; }
+
+      - name: Package the installer
+        run: bash docker/windows/package.sh
+
+      - name: Smoke-test the installer
+        run: |
+          set -e
+          SETUP=$(ls target-windows/installer/DarkRoom-*-x86_64-setup.exe)
+          file "$SETUP" | grep -q 'PE32+' || { echo "FAIL: the installer is not 64-bit"; exit 1; }
+          wine "$SETUP" /S 2>/dev/null
+          INST=$(echo "$HOME"/.wine/drive_c/users/*/AppData/Local/Programs/DarkRoom)
+          ls "$INST"
+          # As many files as package.sh stages: everything but the READMEs in
+          # the directories it copies. A literal here went stale the first
+          # time a model was added.
+          WANT=$(find models/face models/scene models/inpaint -maxdepth 1 -type f ! -name README.md | wc -l)
+          GOT=$(ls "$INST/models" | wc -l)
+          [ "$GOT" = "$WANT" ] || { echo "FAIL: expected $WANT model files, installed $GOT"; exit 1; }
+          wine reg query 'HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DarkRoom' 2>/dev/null \
+            | grep -q DisplayVersion || { echo "FAIL: no uninstall registry key"; exit 1; }
+          wine "$INST/darkroom.exe" --version 2>/dev/null | grep -q '^darkroom-desktop ' \
+            || { echo "FAIL: the installed executable does not run"; exit 1; }
+          wine "$INST/uninstall.exe" /S 2>/dev/null
+          sleep 3
+          [ ! -e "$INST" ] || { echo "FAIL: uninstall left $INST behind"; ls -R "$INST"; exit 1; }
+          echo "OK: installed and uninstalled under Wine"
+
+      - name: Upload the installer
+        uses: actions/upload-artifact@v3
+        with:
+          name: darkroom-windows-x86_64-setup
+          path: target-windows/installer/DarkRoom-*-x86_64-setup.exe
+          if-no-files-found: error
 
   layering:
     runs-on: linux/amd64
@@ -151,11 +489,17 @@ jobs:
 
       # `cargo tree` resolves the dependency graph, so it needs the registry
       # index but no system libraries — this job builds nothing.
+      #
+      # rust-analyzer is named for the reason given in the desktop job: rustup
+      # installs rust-toolchain.toml's components on the first cargo call
+      # whether or not this step asks for them, and an unasked-for download is
+      # the one nobody can find in the log.
       - name: Install Rust 1.92.0
         run: |
           set -e
           curl -fsSL https://sh.rustup.rs | sh -s -- \
-            -y --no-modify-path --profile minimal --default-toolchain 1.92.0
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0 \
+            --component rust-analyzer
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       # ARCH §6.5a: no core/ crate may depend on the UI toolkit. One stray

.gitea/workflows/traceability-check.yml

@@ -7,7 +7,7 @@ name: Traceability
 # fail its own threshold. Two rules follow, and the extractor's own tests
 # enforce both:
 #
-#   1. Denominators are parsed from docs/requirements.md at run time.
+#   1. Denominators are parsed from docs/dev/requirements.md at run time.
 #   2. Coverage is |traced ∩ defined| / |defined|, never a raw traced count.
 #
 # This job is static analysis of source comments plus markdown parsing, so it
@@ -44,12 +44,17 @@ jobs:
           key: traces-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
 
       # Source-comment and markdown parsing only, so the minimal profile is
-      # enough — no system libraries and no components beyond cargo itself.
+      # enough — no system libraries and nothing this job itself needs beyond
+      # cargo. rust-analyzer is here anyway because rust-toolchain.toml lists
+      # it: rustup installs that file's components on the first cargo call in
+      # the work tree regardless, and a download named in the install step
+      # beats the same download appearing unannounced inside the gate.
       - name: Install Rust 1.92.0
         run: |
           set -e
           curl -fsSL https://sh.rustup.rs | sh -s -- \
-            -y --no-modify-path --profile minimal --default-toolchain 1.92.0
+            -y --no-modify-path --profile minimal --default-toolchain 1.92.0 \
+            --component rust-analyzer
           echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
 
       # The gate's own arithmetic is the thing being trusted, so its tests run
@@ -69,14 +74,27 @@ jobs:
         run: |
           set -e
           cargo run -q -p traceability -- report
-          if ! git diff --quiet docs/traceability.md; then
+          if ! git diff --quiet docs/dev/traceability.md; then
             echo ""
-            echo "docs/traceability.md is out of date."
+            echo "docs/dev/traceability.md is out of date."
             echo "Run: cargo run -p traceability -- report"
-            git diff --stat docs/traceability.md
+            git diff --stat docs/dev/traceability.md
             exit 1
           fi
 
+      # The gesture vocabulary, from the same scanner and under the same rule.
+      #
+      # Blocking, and for a sharper reason than the matrix: these two artefacts
+      # are not only read, one of them is *shown to the user*. A stale
+      # `gesture_book.rs` is a help sheet in the application telling somebody to
+      # perform a gesture that was removed — worse than no help sheet, because
+      # they will conclude the application is broken rather than the page.
+      #
+      # This also fails on a malformed tag, so a typo costs a gesture its
+      # desktop half loudly rather than silently.
+      - name: Regenerate the gesture vocabulary and check it is committed
+        run: cargo run -q -p traceability -- gestures-check
+
       # Advisory, not blocking: not every file implements a requirement, and a
       # tag on every function is noise that rots faster than it helps. Tag the
       # unit that decides.
@@ -109,4 +127,4 @@ jobs:
 
       - name: Summary
         if: always()
-        run: head -30 docs/traceability.md || true
+        run: head -30 docs/dev/traceability.md || true

.gitea/workflows/windows-image.yml

@@ -0,0 +1,170 @@
+name: '🐳 Windows image'
+
+# Builds and pushes gitea.tourolle.paris/dtourolle/darkroom-windows, the job
+# container for the Windows leg of build-and-test.yml.
+#
+# The same shape as android-image.yml, for the same reason that one exists:
+# an image that lives only on a developer's laptop is a job that dies at
+# `docker pull`. Built from docker/windows, tagged by that directory's tree
+# id, skipped when the registry already has it.
+#
+# Called by build-and-test.yml on every push, and runnable by hand via
+# workflow_dispatch. It is cheap when nothing changed — see the guard below.
+on:
+  workflow_call:
+    inputs:
+      force:
+        description: 'Rebuild even if the registry already has this image ("true"/"false")'
+        type: string
+        default: 'false'
+  workflow_dispatch:
+    inputs:
+      force:
+        description: 'Rebuild even if the registry already has this image ("true"/"false")'
+        type: string
+        default: 'false'
+
+# Gitea's act_runner mangles boolean workflow inputs passed through an
+# expression — they arrive as false regardless of what was sent. Every input
+# here is a string compared with == 'true', as in KPN's docker.yaml.
+
+env:
+  IMAGE: gitea.tourolle.paris/dtourolle/darkroom-windows
+
+jobs:
+  build:
+    runs-on: linux/amd64
+    name: Build and push
+    # Deliberately NOT in a container: this job needs the host Docker daemon to
+    # build an image, and the host's cached ~/.docker/config.json to push it.
+    # That is also why there is no `docker login` step — the runner host was
+    # authenticated to the registry during setup.
+
+    steps:
+      # The host has no Node, so the JS-based actions/checkout cannot run here.
+      # A minimal shallow fetch with plain git gets the same tree.
+      - name: Checkout
+        run: |
+          set -e
+          git init -q .
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git -c http.extraheader="AUTHORIZATION: basic $(printf '%s' '${{ github.actor }}:${{ github.token }}' | base64 -w0)" \
+            fetch --depth 1 origin "${{ github.sha }}"
+          git checkout -q FETCH_HEAD
+
+      # The image is tagged by the content of docker/windows, not by the commit
+      # that happened to touch it. `git rev-parse HEAD:<dir>` is the tree object
+      # id — it changes when and only when a file in that directory changes, so
+      # an unrelated push reuses the existing image and a Dockerfile edit can
+      # never silently keep serving a stale `latest`.
+      #
+      # Using the commit sha instead would rebuild 2.5 GB on every push; using a
+      # paths-filter action would need a container that has Node, and the only
+      # one this repo would reach for is the very image being built.
+      - name: Resolve image tag
+        id: tag
+        run: |
+          set -e
+          TREE=$(git rev-parse HEAD:docker/windows)
+          echo "tree=$TREE" >> "$GITHUB_OUTPUT"
+          echo "docker/windows tree: $TREE"
+
+      # Skip the build when the registry already holds this exact content. This
+      # is what keeps the job a few seconds long on a normal push, and what
+      # makes it self-healing: if the tag is missing for any reason, including
+      # the image having never been pushed at all, it gets built here.
+      #
+      # The probe is curl against the registry API, NOT `docker manifest
+      # inspect`. The latter exits 1 on this registry even for tags that are
+      # demonstrably present — jellytau-builder:latest answers HTTP 200 to the
+      # API while `docker manifest inspect` reports "manifest unknown" for it.
+      # Trusting that would have rebuilt 7 GB on every single push.
+      #
+      # A HEAD request also gives the digest for free, which is how the repoint
+      # decision below is made without pulling any layers.
+      - name: Query registry
+        id: check
+        env:
+          # The runner's own credentials, so this does not depend on how the
+          # host's ~/.docker/config.json happens to be set up.
+          REG_USER: ${{ github.actor }}
+          REG_PASS: ${{ github.token }}
+          TREE: ${{ steps.tag.outputs.tree }}
+        run: |
+          set -eu
+          ACCEPT='application/vnd.oci.image.index.v1+json,application/vnd.docker.distribution.manifest.v2+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json'
+          API="https://gitea.tourolle.paris/v2/dtourolle/darkroom-windows/manifests"
+
+          # Prints "<http-status> <digest-or-empty>" for a tag.
+          probe() {
+            curl -sI -u "$REG_USER:$REG_PASS" -H "Accept: $ACCEPT" "$API/$1" \
+              | tr -d '\r' \
+              | awk 'BEGIN{s="000";d=""} /^HTTP/{s=$2} tolower($1)=="docker-content-digest:"{d=$2} END{print s, d}'
+          }
+
+          read -r TREE_STATUS TREE_DIGEST <<EOF
+          $(probe "$TREE")
+          EOF
+          read -r LATEST_STATUS LATEST_DIGEST <<EOF
+          $(probe latest)
+          EOF
+
+          echo "tag $TREE -> HTTP $TREE_STATUS ${TREE_DIGEST:-(no digest)}"
+          echo "tag latest -> HTTP $LATEST_STATUS ${LATEST_DIGEST:-(no digest)}"
+
+          # Build unless the registry definitively confirms this content is
+          # already there. An auth failure or an unreachable registry lands
+          # here too, and rebuilding needlessly is the safe direction to fail —
+          # skipping a build that was needed is what breaks the Windows job.
+          if [ "${{ inputs.force }}" = "true" ]; then
+            echo "forced rebuild requested"
+            echo "build=true" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          elif [ "$TREE_STATUS" != "200" ]; then
+            echo "registry does not have this content — building"
+            echo "build=true" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          elif [ -n "$TREE_DIGEST" ] && [ "$TREE_DIGEST" = "$LATEST_DIGEST" ]; then
+            echo "registry is already correct — nothing to do"
+            echo "build=false" >> "$GITHUB_OUTPUT"
+            echo "repoint=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "content is present but latest points elsewhere — repointing"
+            echo "build=false" >> "$GITHUB_OUTPUT"
+            echo "repoint=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      # Context is docker/windows, matching the README's build command. The
+      # Dockerfile COPYs nothing from the repo, so it needs no wider context —
+      # and a narrow context keeps the daemon from tarring up the whole tree,
+      # target/ included.
+      - name: Build
+        if: ${{ steps.check.outputs.build == 'true' }}
+        run: |
+          set -e
+          docker build \
+            -t "$IMAGE:${{ steps.tag.outputs.tree }}" \
+            -t "$IMAGE:latest" \
+            docker/windows
+
+      # Both tags are pushed: the tree tag is what the guard above looks for on
+      # the next run, and `latest` is what build-and-test.yml pulls.
+      - name: Push
+        if: ${{ steps.check.outputs.build == 'true' }}
+        run: |
+          set -e
+          docker push "$IMAGE:${{ steps.tag.outputs.tree }}"
+          docker push "$IMAGE:latest"
+
+      # A cache hit on the tree tag says nothing about where `latest` points — a
+      # reverted Dockerfile or a build from another branch can leave it on
+      # different content. This runs only when the digests above actually
+      # disagree, so the common case costs nothing; the layers are already in
+      # the registry, so the push that follows uploads a manifest, not 2.5 GB.
+      - name: Repoint latest
+        if: ${{ steps.check.outputs.repoint == 'true' }}
+        run: |
+          set -e
+          docker pull "$IMAGE:${{ steps.tag.outputs.tree }}"
+          docker tag "$IMAGE:${{ steps.tag.outputs.tree }}" "$IMAGE:latest"
+          docker push "$IMAGE:latest"

.githooks/post-checkout

@@ -0,0 +1,3 @@
+#!/bin/sh
+command -v git-lfs >/dev/null 2>&1 || { printf >&2 "\n%s\n\n" "This repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'post-checkout' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks')."; exit 2; }
+git lfs post-checkout "$@"

.githooks/post-commit

@@ -0,0 +1,3 @@
+#!/bin/sh
+command -v git-lfs >/dev/null 2>&1 || { printf >&2 "\n%s\n\n" "This repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'post-commit' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks')."; exit 2; }
+git lfs post-commit "$@"

.githooks/post-merge

@@ -0,0 +1,3 @@
+#!/bin/sh
+command -v git-lfs >/dev/null 2>&1 || { printf >&2 "\n%s\n\n" "This repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'post-merge' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks')."; exit 2; }
+git lfs post-merge "$@"

.githooks/pre-commit

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Keep the generated artefacts in step with the tags in the tree.
+#
+# Two of them now, from the same scanner: the requirements matrix and the
+# gesture vocabulary. Both are generated *from* the tree and cite line numbers
+# in it, so both go stale on any commit that moves a line — a `cargo fmt` sweep
+# above all, but equally a commit that merely adds a paragraph above a tag.
+#
+# The gate regenerates the matrix in CI and fails if the result differs from
+# what is committed. That is the right check — a matrix that disagrees with the
+# tree is worse than none, because it is read as current — but it fails *after*
+# a push, on a commit that is otherwise fine, and it has now done so on six
+# commits in a row because adding a `TRACES:` tag and regenerating the matrix
+# are two actions and only the first is on anyone's mind.
+#
+# So it happens here instead, where the tags are being changed.
+#
+# Only when something that can carry a tag is staged: a commit touching
+# workflows, packaging or the matrix itself pays nothing.
+set -euo pipefail
+
+staged="$(git diff --cached --name-only --diff-filter=ACMR)"
+if ! grep -qE '\.(rs|slint|yaml|md)$' <<< "${staged}"; then
+    exit 0
+fi
+# The artefacts are generated from the tree, so regenerating them because one
+# was itself edited would be circular.
+case "$(tr -d '[:space:]' <<< "${staged}")" in
+    docs/dev/traceability.md | docs/gestures.md | ui/dr-ui/src/gesture_book.rs)
+        exit 0
+        ;;
+esac
+
+repo="$(git rev-parse --show-toplevel)"
+cd "${repo}"
+
+# Quiet unless it has something to say. A hook that prints on every commit is
+# a hook people start passing --no-verify to.
+if ! cargo run -q -p traceability -- report >/dev/null 2>&1; then
+    echo "pre-commit: could not run the traceability report; leaving the matrix alone" >&2
+    exit 0
+fi
+
+if ! git diff --quiet -- docs/dev/traceability.md; then
+    git add docs/dev/traceability.md
+    echo "pre-commit: regenerated docs/dev/traceability.md and staged it"
+fi
+
+# The gesture vocabulary, same discipline.
+#
+# **Failure here is reported and not swallowed**, unlike the matrix above. A
+# matrix that will not build leaves the previous one in place, which is merely
+# stale; a malformed `GESTURE:` block means a gesture the user is about to be
+# told about in the wrong words, or not at all. The gate would catch it in CI
+# either way — this is only about catching it a push earlier.
+if ! out="$(cargo run -q -p traceability -- gestures 2>&1)"; then
+    echo "pre-commit: the gesture scan failed — the tags below need fixing" >&2
+    echo "${out}" >&2
+    exit 1
+fi
+
+for f in docs/gestures.md ui/dr-ui/src/gesture_book.rs; do
+    if ! git diff --quiet -- "${f}"; then
+        git add "${f}"
+        echo "pre-commit: regenerated ${f} and staged it"
+    fi
+done

.githooks/pre-push

@@ -0,0 +1,3 @@
+#!/bin/sh
+command -v git-lfs >/dev/null 2>&1 || { printf >&2 "\n%s\n\n" "This repository is configured for Git LFS but 'git-lfs' was not found on your path. If you no longer wish to use Git LFS, remove this hook by deleting the 'pre-push' file in the hooks directory (set by 'core.hookspath'; usually '.git/hooks')."; exit 2; }
+git lfs pre-push "$@"

.gitignore

@@ -2,3 +2,25 @@
 /target-android
 Cargo.lock.bak
 *.log
+
+# makepkg build products. `packaging/PKGBUILD` and the .desktop entry are
+# sources and belong in the tree; everything makepkg derives from them does
+# not — `pkg/` and `src/` are staging directories it recreates on every run,
+# and the package itself is 33 MB of compiled output.
+/packaging/pkg/
+/packaging/src/
+/packaging/*.pkg.tar.*
+/packaging/*.log
+
+# Cached upstream film profiles, re-fetchable with
+# tools/film-profiles/convert.py --fetch. Not source: the converted
+# profiles in core/dr-film/profiles are.
+tools/film-profiles/upstream/
+
+# flatpak-builder's cache and its output tree. `packaging/flatpak/` holds the
+# manifest, which is source; everything a build derives from it is not — and
+# `.flatpak-builder/` in particular caches an unpacked copy of the whole
+# checkout, so it is larger than the repository it sits in.
+/.flatpak-builder/
+/build/
+__pycache__/

CLAUDE.md

@@ -0,0 +1,132 @@
+# Working in this repository
+
+Notes for anyone — person or agent — changing this code. They record what
+went wrong once and what the fix looked like, so the same shape is not
+written again. Requirements live in `docs/dev/requirements.md`; this file is
+about habits, not features.
+
+## Catalog reads: work is proportional to what changed, never to library size
+
+`docs/dev/catalog.md §1` states the rule. These are the ways it was broken on
+the Identity screen, found when every confirm click cost half a second on a
+24k-image library (2026-09-19), and what each fix looked like.
+
+**A redraw must know what changed.** A click handler that calls "refresh
+everything" pays for everything. `identity_ui::refresh` takes a `Changed`:
+a confirm re-reads the rail and the grid and *not* the coverage line,
+because moving a face between people cannot alter how many images are
+indexed. Before adding a read to a shared refresh, ask which events can
+change its answer, and gate it on those.
+
+**Count with `COUNT(*)`, never with `.len()` on a list you then drop.**
+`repairs::counts` used to build every repair's work list — a `Target` with
+its path per row, sorted into visiting order — to report its length. Six
+repairs, 350 ms, nothing kept. If the caller wants a number, the query
+returns a number.
+
+**One query, not one per row.** `ThumbStore::contains` in a filter over
+5,000 rows is 5,000 prepared statements; `ThumbStore::held(size)` reads the
+index once into a set. The same applies to any `query_row` inside a loop
+over a result set — including `deep_count` per sidebar row, which is fine
+at sidebar scale and would not be at grid scale. Aggregate in one
+statement and look up in memory.
+
+**Filter and aggregate in SQL, and aggregate the small side first.**
+`faces::people` read 19,000 rows, grouped, sorted them by name, and the
+screen threw 17,000 away (empty unnamed groups). `people_in_use` filters in
+the `WHERE`, and joins `people` to a pre-aggregated `face_person` (2,000
+groups) rather than grouping after a `LEFT JOIN` over every person. The
+sort then sees only the rows that will be drawn.
+
+**Wide rows make "just check one column" a table scan.** A `faces` row is
+~8 KB (a 1 KB embedding and a ~5 KB crop, then the columns added later).
+Any predicate that reads `quality`, `crop` or an eye column for every face
+reads every row. V17 learned this for the eye filter; V19 applies it to the
+repair counts with partial indexes (`faces_owed_*`) that hold only the rows
+still owing, keyed on what the predicate joins on and carrying `model_id`
+because the predicate reads it. Two things to know about them:
+
+- **Drive the count from the small side.** SQLite uses a partial index
+  when the query starts from `faces` (`repairs::count`, `Needs::Face`) and
+  ignores it inside a correlated `EXISTS (... WHERE f.image_id = i.id ...)`.
+  That is why `Needs::Face` carries the per-face fragment and spells it two
+  ways.
+- **Spell the predicate as the index's `WHERE` is spelled.** `NEEDS_EYES`
+  is `(f.eye_right IS NULL OR f.landmarks_dense IS NULL)` because
+  `faces_owed_eyes` is `WHERE eye_right IS NULL OR landmarks_dense IS NULL`.
+  Change one, change both, and `counts_are_the_sizes_of_the_lists` will
+  tell you if they drift.
+
+Check a query's plan with `EXPLAIN QUERY PLAN` against a copy of a real
+catalog before trusting an index exists for it: "SEARCH ... USING COVERING
+INDEX" is the answer you want, "SEARCH f USING INDEX faces_image" on a wide
+table means every probe opens a row.
+
+## Catalog writes: one transaction per user action
+
+`faces::confirm` opens a transaction. Calling it in a loop over a group is
+a commit per face; `faces::confirm_all` is two statements and one commit,
+`faces::reassign` one transaction for a whole split. When a UI action
+touches N rows, give the catalog a function that takes the N, not a loop
+that calls the one-row function N times — `unchecked_transaction` cannot
+nest, so this has to be designed in at the catalog layer, not wrapped
+from above.
+
+## Screens: keep what is already decoded
+
+`identity::load_faces` takes the crops the grid is currently showing and
+hands them back into the new cells. Before that, a click re-read 4 MB of
+crop blobs and decoded 700 JPEGs to produce the pixels already on screen.
+When a redraw replaces a model, the expensive parts of the old model — a
+decoded image, a cut portrait — are the first thing to reuse; only the row
+that changed needs new work. Drain the old cells rather than cloning them.
+
+## Remote calls: one round trip per file, not one per ancestor
+
+`NextcloudBackend::move_to` guaranteed its destination's parent with a
+`MKCOL` per ancestor from the account root, on every file of a batch —
+three `405`s before each `MOVE`. The backend now remembers the collections
+it has confirmed (`known_dirs`) for its lifetime, which is one job. When a
+per-file operation has a per-batch precondition, satisfy it once.
+
+## Providers: read the runtime's source for the version on disk, not the binding
+
+Two things the MIGraphX rung (2026-09-20) got wrong before it was measured
+right, both because `ort`'s builder was trusted to mean what its method
+names say.
+
+**A binding's option builder may fill a struct the runtime no longer
+reads.** `ep::MIGraphX::with_save_model` sets fields of the legacy
+`OrtMIGraphXProviderOptions`; ONNX Runtime 1.29 reads that struct for the
+precision flags and ignores the rest, so every session compiled for 40 s
+and the cache directory went nowhere. The option that works
+(`migraphx_model_cache_dir`) exists only in the generic key/value
+registration, which `session::migraphx` calls on the API table directly.
+Before wiring a provider option, fetch the provider's source at the
+runtime's exact version and find where the option is *read*.
+
+**A provider's cache key may leave out what you are varying.** MIGraphX
+keys a compiled program on graph, GPU and its own version — not precision.
+The first fp16 measurement built in 0.3 s and matched f32 to the tenth of a
+millisecond, because it had loaded the f32 program. A "from cache" build
+that is suspiciously fast on the first run of a new configuration is a key
+collision, not a fast provider; give each precision its own directory (the
+engine does) and check the cache directory gained a file.
+
+## Measuring
+
+`cargo run --release -p dr-ui --example identity_bench -- CATALOG THUMBS`
+times what one click on the Identity screen reads and what the batch
+operations write. Run it against a **copy** of a real catalog (it writes),
+never the library's own file; `sqlite3 catalog.sqlite ".backup copy.sqlite"`
+takes a consistent one while the app runs. Compare the `cpu` column when
+other builds are running on the machine — the wall clock doubles under
+load, the CPU figure does not. Keep the binary from before the change and
+run both back to back rather than trusting numbers taken an hour apart.
+
+Reference figures from the 2026-09-19 fixes, largest person (754 faces),
+24k images, 19k faces, before → after. What one click read: `load_people`
+22 ms → 12 ms, `load_faces` 316 ms → 2.4 ms, `audit` 190 ms → not run
+(66 ms when it is, on open and at the end of a sweep). What one click
+wrote: `confirm_all` 16 ms → 2 ms, `split_off` 23 ms → 4.5 ms. A click on
+the face grid went from ~530 ms of catalog work to ~15 ms.

CONTRIBUTING.md

@@ -0,0 +1,180 @@
+# Contributing to DarkRoom
+
+There is a lot of documentation here — 14 documents and 177 numbered
+requirements — and almost all of it is written for someone who has already
+decided to work on this. This file is the other thing: how to get a first
+change landed without reading any of it.
+
+## The shortest useful contribution
+
+**A develop operation is one file.** Not one file plus a registration, plus a
+shader edit, plus a control in the UI — one file:
+
+```
+core/dr-pipeline/ops/split_toning.yaml
+```
+
+`build.rs` finds it with `read_dir`, compiles it into Rust implementing
+`Operation`, and from there it is indistinguishable from a hand-written node.
+It arrives with controls built from its declared parameter kinds, a place in
+the chain from `order:`, a place in the panel from `attributes:`, sidecar
+persistence, and its own tests — which are declared in the same file and run
+under `cargo test`.
+
+Read [`core/dr-pipeline/ops/README.md`](core/dr-pipeline/ops/README.md) and
+copy [`exposure.yaml`](core/dr-pipeline/ops/exposure.yaml). Split toning,
+colour zones, selective colour and channel-mixer variants are all pure point
+operations, which means all of them are declarations rather than code.
+
+If you want to understand one thing about the architecture before starting,
+make it this: **the core describes its capabilities and the interface composes
+them.** No code in `ui/` names an operation, and a test enforces that
+(`ui/dr-ui/tests/ui_names_no_operation.rs`). It is why your node needs no UI
+change.
+
+## Getting it to build
+
+**Git LFS is required.** Model weights are stored in LFS, and a clone made
+without it leaves a ~130-byte text pointer where an 11 MB model should be:
+
+```bash
+git lfs install && git lfs pull
+```
+
+Forget this and `dr-segment`'s build script stops with an instruction rather
+than embedding the pointer and failing at inference time — but it is easier to
+run the two commands now.
+
+**The toolchain pins itself.** `rust-toolchain.toml` selects 1.92.0 and rustup
+fetches it on first use. Do not override it; `cargo fmt` and `clippy` are both
+version-sensitive and CI runs exactly this version.
+
+**System packages.** Slint and winit need these at build time. On Debian or
+Ubuntu:
+
+```bash
+sudo apt-get install pkg-config libfontconfig1-dev libxkbcommon-dev
+```
+
+**Then:**
+
+```bash
+cargo run -p darkroom-desktop
+```
+
+The first build resolves 826 crates and takes a while — on a laptop, long
+enough to look like a hang. It is not one.
+
+Android is a containerised toolchain and is not needed for most work; see
+[`docker/android/README.md`](docker/android/README.md) if you get there.
+
+## What CI will check
+
+All four of these run on every push, so run them before you send anything:
+
+```bash
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets -- -D warnings
+cargo test --workspace
+cargo build --workspace --release
+```
+
+GPU tests skip themselves where there is no adapter rather than failing — a
+test that cannot run is not evidence either way — so a green run on a machine
+without a GPU is expected, and does not mean the GPU paths were exercised.
+
+There is a fifth check, and it is not in that list because you are unlikely to
+break it by accident:
+
+```bash
+cargo run --release -p dr-bench -- check
+```
+
+That is the benchmark suite (`docs/dev/requirements.md` §8), which builds a
+synthetic 50,000-image catalog and fails the build if a performance target is
+missed or a measurement has drifted past its tolerance. It runs on every push in
+its own workflow. [`docs/dev/benchmarks.md`](docs/dev/benchmarks.md) says what it
+measures, what it deliberately does not, and how to read a failure. If you have
+touched the catalog, the decoder, the thumbnail store or the exporter, run it
+before you send.
+
+## Requirements and traceability
+
+[`requirements.md`](docs/dev/requirements.md) is the register of record.
+[`traceability.md`](docs/dev/traceability.md) is generated from `TRACES:` tags in
+the source and must never be hand-edited:
+
+```rust
+// TRACES: FR-DEV-3a | FR-DEV-3c
+```
+
+Tags are read from `.rs`, `.slint`, `.wgsl` and `.yaml` — the last so a
+declared operation can record the requirement it satisfies, since the Rust it
+generates lands in `OUT_DIR` and is not scanned.
+
+A pre-commit hook regenerates the matrix and stages it whenever you touch
+something that can carry a tag, so you should not have to think about it. If
+you do need to run it by hand:
+
+```bash
+cargo run -p traceability -- report
+```
+
+Note that it tracks line numbers, so a change that only moves code still moves
+the matrix. Never regenerate it with a stale prebuilt binary.
+
+**One convention that the tooling cannot enforce.** A tag proves that a tag
+exists, not that the code under it does the thing — `docs/dev/code-health.md`
+CH-4 has the details, and two requirements currently read as covered on the
+strength of plumbing a future feature would use. So: **close a requirement
+with a test that would fail if the behaviour were removed.** Coverage that
+moves slowly and means something beats coverage that moves quickly.
+
+## Two invariants the build defends
+
+Worth knowing before you trip one, because both failures name a requirement
+rather than a line:
+
+- **No operation may be named in `ui/`** (FR-DEV-3a). Special-casing one
+  operation in the panel to fix a layout problem is how a generated interface
+  stops being generated. If a node needs presentation the panel cannot give it,
+  the answer is a `presentation:` hint in the declaration and a `WidgetKind`,
+  not a branch in `develop.rs`.
+- **The operation schema rejects ambiguity at build time**: a duplicate
+  `order:`, a filename disagreeing with its `id:`, a default outside its own
+  range, an expression naming something that is not a parameter. Each error
+  names the key you got wrong and exits rather than panicking.
+
+## Commit messages
+
+Imperative subject describing the change from the reader's side — "Offer the
+merge when two people turn out to share a name", not "fix: merge dialog". No
+conventional-commits prefixes.
+
+The body is where the reasoning goes, and it is expected to be substantial when
+the change is. This codebase records *why* far more than most, in commits and
+in comments alike, and that is the single habit most worth adopting: the
+constraint you worked around is invisible to whoever reads the diff next.
+
+One commit per change. If you fixed two things, that is two commits.
+
+## Where to read next, in order
+
+| Document | Read it when |
+|---|---|
+| [`core/dr-pipeline/ops/README.md`](core/dr-pipeline/ops/README.md) | Adding or changing a develop operation — start here regardless |
+| [`docs/dev/architecture.md`](docs/dev/architecture.md) | Anything touching the render path, catalog or sync |
+| [`docs/dev/code-health.md`](docs/dev/code-health.md) | Deciding what to work on; grades each seam by what it costs |
+| [`docs/dev/benchmarks.md`](docs/dev/benchmarks.md) | A change that could plausibly cost time or memory |
+| [`docs/dev/technical-debt.md`](docs/dev/technical-debt.md) | Something looks wrong — check it was not chosen |
+| [`docs/dev/distribution.md`](docs/dev/distribution.md) | Packaging a build, or adding a permission to one |
+| [`docs/dev/requirements.md`](docs/dev/requirements.md) | Reference, not reading |
+
+`technical-debt.md` is the one to check before "fixing" anything surprising.
+It records compromises that were deliberate, each with the reasoning and a
+falsifiable condition for when it stops being one — the point being that you
+can tell a constraint from an accident without asking.
+
+## Licence
+
+GPL-3.0-or-later. By contributing you agree your work is licensed the same way.

Cargo.lock

@@ -1221,23 +1221,27 @@ checksum = "f27ae1dd37df86211c42e150270f82743308803d90a6f6e6651cd730d5e1732f"
 
 [[package]]
 name = "darkroom-android"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "android_logger",
- "dr-sync-nextcloud",
+ "dr-plat",
+ "dr-sync",
  "dr-ui",
+ "jni 0.21.1",
  "log",
  "slint",
 ]
 
 [[package]]
 name = "darkroom-desktop"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "anyhow",
+ "dr-plat",
  "dr-ui",
  "env_logger",
  "log",
+ "winresource",
 ]
 
 [[package]]
@@ -1403,10 +1407,29 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
 
 [[package]]
-name = "dr-catalog"
-version = "0.3.0"
+name = "dr-bench"
+version = "0.14.0"
 dependencies = [
+ "anyhow",
+ "dr-catalog",
+ "dr-decode",
+ "dr-export",
+ "dr-thumbs",
+ "dr-types",
+ "env_logger",
+ "log",
+ "rusqlite",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "dr-catalog"
+version = "0.14.0"
+dependencies = [
+ "dr-face",
  "dr-plat",
+ "dr-thumbs",
  "dr-types",
  "env_logger",
  "log",
@@ -1417,7 +1440,7 @@ dependencies = [
 
 [[package]]
 name = "dr-decode"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "dr-types",
  "env_logger",
@@ -1431,7 +1454,7 @@ dependencies = [
 
 [[package]]
 name = "dr-export"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "dr-decode",
  "dr-gpu",
@@ -1442,17 +1465,42 @@ dependencies = [
  "log",
  "png",
  "pollster",
+ "rawler",
  "thiserror 2.0.20",
  "tiff",
  "zune-jpeg 0.4.21",
 ]
 
+[[package]]
+name = "dr-face"
+version = "0.14.0"
+dependencies = [
+ "dr-inference-engine",
+ "env_logger",
+ "log",
+ "ndarray",
+ "ort",
+ "thiserror 2.0.20",
+ "zune-jpeg 0.4.21",
+]
+
+[[package]]
+name = "dr-film"
+version = "0.14.0"
+dependencies = [
+ "log",
+ "serde",
+ "serde_norway",
+]
+
 [[package]]
 name = "dr-gpu"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "bytemuck",
  "dr-decode",
+ "dr-film",
+ "dr-pano",
  "dr-pipeline",
  "dr-segment",
  "dr-types",
@@ -1463,9 +1511,24 @@ dependencies = [
  "wgpu",
 ]
 
+[[package]]
+name = "dr-inference-engine"
+version = "0.14.0"
+dependencies = [
+ "env_logger",
+ "libloading",
+ "log",
+ "ort",
+ "ort-sys",
+ "ort-tract",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "dr-ingest"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "dr-plat",
  "dr-types",
@@ -1477,15 +1540,29 @@ dependencies = [
 
 [[package]]
 name = "dr-lens"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "lensfun",
  "log",
 ]
 
+[[package]]
+name = "dr-pano"
+version = "0.14.0"
+dependencies = [
+ "dr-decode",
+ "dr-inference-engine",
+ "dr-types",
+ "env_logger",
+ "log",
+ "ndarray",
+ "ort",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "dr-pipeline"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "dr-types",
  "log",
@@ -1494,7 +1571,7 @@ dependencies = [
 
 [[package]]
 name = "dr-plat"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "android-native-keyring-store",
  "dr-types",
@@ -1503,26 +1580,54 @@ dependencies = [
  "keyring-core",
  "log",
  "thiserror 2.0.20",
+ "wayland-client",
+ "wayland-protocols",
+ "x11rb",
+]
+
+[[package]]
+name = "dr-preset-xmp"
+version = "0.14.0"
+dependencies = [
+ "dr-pipeline",
+ "log",
+ "quick-xml",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
 name = "dr-segment"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
+ "dr-inference-engine",
  "env_logger",
  "log",
  "ndarray",
  "ort",
- "ort-tract",
  "thiserror 2.0.20",
  "zune-jpeg 0.4.21",
 ]
 
 [[package]]
 name = "dr-sync"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "async-trait",
+ "dr-plat",
+ "dr-types",
+ "log",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.20",
+ "tokio",
+]
+
+[[package]]
+name = "dr-sync-folder"
+version = "0.14.0"
+dependencies = [
+ "async-trait",
+ "dr-sync",
  "dr-types",
  "log",
  "thiserror 2.0.20",
@@ -1531,12 +1636,13 @@ dependencies = [
 
 [[package]]
 name = "dr-sync-nextcloud"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "async-trait",
  "dr-decode",
  "dr-plat",
  "dr-sync",
+ "dr-sync-folder",
  "dr-types",
  "env_logger",
  "log",
@@ -1552,7 +1658,7 @@ dependencies = [
 
 [[package]]
 name = "dr-thumbs"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "dr-types",
  "jpeg-encoder",
@@ -1564,7 +1670,7 @@ dependencies = [
 
 [[package]]
 name = "dr-types"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "serde",
  "serde_json",
@@ -1573,24 +1679,35 @@ dependencies = [
 
 [[package]]
 name = "dr-ui"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "anyhow",
+ "async-trait",
  "dr-catalog",
  "dr-decode",
  "dr-export",
+ "dr-face",
+ "dr-film",
  "dr-gpu",
+ "dr-inference-engine",
  "dr-ingest",
+ "dr-lens",
+ "dr-pano",
  "dr-pipeline",
  "dr-plat",
+ "dr-preset-xmp",
  "dr-segment",
  "dr-sync",
+ "dr-sync-folder",
  "dr-sync-nextcloud",
  "dr-thumbs",
  "dr-types",
+ "dr-xmp",
+ "env_logger",
  "jni 0.22.4",
  "log",
  "ndk-context",
+ "png",
  "pollster",
  "reqwest",
  "rusqlite",
@@ -1603,6 +1720,16 @@ dependencies = [
  "wgpu",
 ]
 
+[[package]]
+name = "dr-xmp"
+version = "0.14.0"
+dependencies = [
+ "dr-types",
+ "log",
+ "quick-xml",
+ "thiserror 2.0.20",
+]
+
 [[package]]
 name = "drm"
 version = "0.14.1"
@@ -6896,7 +7023,7 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "traceability"
-version = "0.3.0"
+version = "0.14.0"
 dependencies = [
  "anyhow",
  "serde",
@@ -8296,6 +8423,16 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "winresource"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+dependencies = [
+ "toml 1.1.4+spec-1.1.0",
+ "version_check",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"

Cargo.toml

@@ -6,22 +6,30 @@ members = [
     "core/dr-thumbs",
     "core/dr-decode",
     "core/dr-export",
+    "core/dr-face",
+    "core/dr-film",
+    "core/dr-inference-engine",
     "core/dr-ingest",
     "core/dr-gpu",
     "core/dr-lens",
+    "core/dr-pano",
     "core/dr-pipeline",
+    "core/dr-preset-xmp",
     "core/dr-segment",
     "core/dr-sync",
+    "core/dr-sync-folder",
     "core/dr-sync-nextcloud",
+    "core/dr-xmp",
     "platform/dr-plat",
     "ui/dr-ui",
     "apps/darkroom-desktop",
     "apps/darkroom-android",
+    "tools/bench",
     "tools/traceability",
 ]
 
 [workspace.package]
-version = "0.3.0"
+version = "0.14.0"
 edition = "2021"
 rust-version = "1.92"
 license = "GPL-3.0-or-later"
@@ -34,10 +42,21 @@ dr-catalog = { path = "core/dr-catalog" }
 dr-thumbs = { path = "core/dr-thumbs" }
 dr-decode = { path = "core/dr-decode" }
 dr-export = { path = "core/dr-export" }
+# Stated explicitly for the same reason as `dr-segment` below: no dependant
+# should drag in an ONNX runtime by accident. Members opt in with
+# `features = ["inference"]`.
+dr-face = { path = "core/dr-face", default-features = false }
+dr-film = { path = "core/dr-film" }
+# `tract` on by default so a test binary can open a session with nothing
+# installed; the apps add `native` to look for a runtime file (docs/dev/inference.md §3).
+dr-inference-engine = { path = "core/dr-inference-engine" }
 dr-ingest = { path = "core/dr-ingest" }
 dr-gpu = { path = "core/dr-gpu" }
 dr-lens = { path = "core/dr-lens" }
+# Optional runtime, like `dr-segment`: the geometry never needs a model.
+dr-pano = { path = "core/dr-pano", default-features = false }
 dr-pipeline = { path = "core/dr-pipeline" }
+dr-preset-xmp = { path = "core/dr-preset-xmp" }
 # `default-features = false` belongs *here*, not on each dependant: a member
 # inheriting a workspace dependency cannot turn its default features off, so
 # writing it below would silently do nothing and every crate touching
@@ -46,7 +65,9 @@ dr-pipeline = { path = "core/dr-pipeline" }
 dr-segment = { path = "core/dr-segment", default-features = false }
 dr-plat = { path = "platform/dr-plat" }
 dr-sync = { path = "core/dr-sync" }
+dr-sync-folder = { path = "core/dr-sync-folder" }
 dr-sync-nextcloud = { path = "core/dr-sync-nextcloud" }
+dr-xmp = { path = "core/dr-xmp" }
 dr-ui = { path = "ui/dr-ui" }
 
 # GPU + UI
@@ -108,6 +129,25 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 base64 = "0.23"
 
+# Display-server clients, for FR-DSP-8's per-display profile acquisition.
+#
+# Neither is a new cost: winit already builds both, so the versions are the
+# ones Slint's backend has resolved to and pinning anything else here would
+# compile a second copy. Both are pure Rust — x11rb speaks the X11 wire
+# protocol itself rather than binding libxcb, and wayland-client binds
+# libwayland only under a feature that is off — which keeps the Android
+# cross-compile a plain Rust dependency graph, the same criterion as the TLS
+# and SQLite choices above. They are declared under a target predicate that
+# excludes Android, where neither display server exists.
+#
+# `staging` on wayland-protocols is what carries `wp_color_manager_v1`: the
+# colour-management extension is still staging upstream, which is the
+# protocol-level statement of the thing FR-DSP-8 anticipates when it says
+# Wayland's colour management "is not universally available".
+x11rb = { version = "0.13", features = ["randr"] }
+wayland-client = "0.31"
+wayland-protocols = { version = "0.32", features = ["client", "staging"] }
+
 # Platform secure storage: Secret Service on Linux, Keystore on Android
 # (FR-NC-2). Credentials never touch the catalog or a plain file.
 # keyring 4 restructured its features: `v1` is the default set and brings
@@ -200,13 +240,25 @@ ort-tract = "0.4"
 ndarray = "0.17"
 
 [profile.dev]
-# Dependencies optimised even in dev builds — wgpu and image decoding are
-# unusably slow otherwise, and they rarely need debugging.
+# Dev builds are tuned for how fast they *compile*, not for how fast they run.
+# Optimisation is a release concern; `[profile.release]` below is where it
+# belongs.
+#
+# This deliberately reverses an earlier choice. Dependencies used to be built
+# at `opt-level = 2` here, because wgpu and image decoding are slow without it.
+# That is still true, and it is the price: a debug run of the app, and the
+# decode- and GPU-heavy tests, are slower than they were. What it buys is that
+# nothing has to be optimised before it can be compiled — which is the cost
+# paid on every edit, by every worktree, rather than only when something is
+# actually run.
+#
+# If a particular crate turns out to be the one that makes a test unbearable,
+# raise it alone rather than restoring the blanket rule:
+#
+#   [profile.dev.package.zune-jpeg]
+#   opt-level = 2
 opt-level = 0
 
-[profile.dev.package."*"]
-opt-level = 2
-
 [profile.release]
 lto = "thin"
 codegen-units = 1

LICENSE

@@ -0,0 +1,232 @@
+GNU GENERAL PUBLIC LICENSE
+Version 3, 29 June 2007
+
+Copyright © 2007 Free Software Foundation, Inc. <https://fsf.org/>
+
+Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
+
+Preamble
+
+The GNU General Public License is a free, copyleft license for software and other kinds of works.
+
+The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.
+
+When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.
+
+To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.
+
+For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights.
+
+Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software, and (2) offer you this License giving you legal permission to copy, distribute and/or modify it.
+
+For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software. For both users' and authors' sake, the GPL requires that modified versions be marked as changed, so that their problems will not be attributed erroneously to authors of previous versions.
+
+Some devices are designed to deny users access to install or run modified versions of the software inside them, although the manufacturer can do so. This is fundamentally incompatible with the aim of protecting users' freedom to change the software. The systematic pattern of such abuse occurs in the area of products for individuals to use, which is precisely where it is most unacceptable. Therefore, we have designed this version of the GPL to prohibit the practice for those products. If such problems arise substantially in other domains, we stand ready to extend this provision to those domains in future versions of the GPL, as needed to protect the freedom of users.
+
+Finally, every program is threatened constantly by software patents. States should not allow patents to restrict development and use of software on general-purpose computers, but in those that do, we wish to avoid the special danger that patents applied to a free program could make it effectively proprietary. To prevent this, the GPL assures that patents cannot be used to render the program non-free.
+
+The precise terms and conditions for copying, distribution and modification follow.
+
+TERMS AND CONDITIONS
+
+0. Definitions.
+
+“This License” refers to version 3 of the GNU General Public License.
+
+“Copyright” also means copyright-like laws that apply to other kinds of works, such as semiconductor masks.
+
+“The Program” refers to any copyrightable work licensed under this License. Each licensee is addressed as “you”. “Licensees” and “recipients” may be individuals or organizations.
+
+To “modify” a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission, other than the making of an exact copy. The resulting work is called a “modified version” of the earlier work or a work “based on” the earlier work.
+
+A “covered work” means either the unmodified Program or a work based on the Program.
+
+To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.
+
+To “convey” a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
+
+An interactive user interface displays “Appropriate Legal Notices” to the extent that it includes a convenient and prominently visible feature that (1) displays an appropriate copyright notice, and (2) tells the user that there is no warranty for the work (except to the extent that warranties are provided), that licensees may convey the work under this License, and how to view a copy of this License. If the interface presents a list of user commands or options, such as a menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+The “source code” for a work means the preferred form of the work for making modifications to it. “Object code” means any non-source form of a work.
+
+A “Standard Interface” means an interface that either is an official standard defined by a recognized standards body, or, in the case of interfaces specified for a particular programming language, one that is widely used among developers working in that language.
+
+The “System Libraries” of an executable work include anything, other than the work as a whole, that (a) is included in the normal form of packaging a Major Component, but which is not part of that Major Component, and (b) serves only to enable use of the work with that Major Component, or to implement a Standard Interface for which an implementation is available to the public in source code form. A “Major Component”, in this context, means a major essential component (kernel, window system, and so on) of the specific operating system (if any) on which the executable work runs, or a compiler used to produce the work, or an object code interpreter used to run it.
+
+The “Corresponding Source” for a work in object code form means all the source code needed to generate, install, and (for an executable work) run the object code and to modify the work, including scripts to control those activities. However, it does not include the work's System Libraries, or general-purpose tools or generally available free programs which are used unmodified in performing those activities but which are not part of the work. For example, Corresponding Source includes interface definition files associated with source files for the work, and the source code for shared libraries and dynamically linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same work.
+
+2. Basic Permissions.
+All rights granted under this License are granted for the term of copyright on the Program, and are irrevocable provided the stated conditions are met. This License explicitly affirms your unlimited permission to run the unmodified Program. The output from running a covered work is covered by this License only if the output, given its content, constitutes a covered work. This License acknowledges your rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the conditions stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+No covered work shall be deemed part of an effective technological measure under any applicable law fulfilling obligations under article 11 of the WIPO copyright treaty adopted on 20 December 1996, or similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid circumvention of technological measures to the extent such circumvention is effected by exercising rights under this License with respect to the covered work, and you disclaim any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+You may convey verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice; keep intact all notices stating that this License and any non-permissive terms added in accord with section 7 apply to the code; keep intact all notices of the absence of any warranty; and give all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+You may convey a work based on the Program, or the modifications to produce it from the Program, in the form of source code under the terms of section 4, provided that you also meet all of these conditions:
+
+     a) The work must carry prominent notices stating that you modified it, and giving a relevant date.
+
+     b) The work must carry prominent notices stating that it is released under this License and any conditions added under section 7. This requirement modifies the requirement in section 4 to “keep intact all notices”.
+
+     c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.
+
+     d) If the work has interactive user interfaces, each must display Appropriate Legal Notices; however, if the Program has interactive interfaces that do not display Appropriate Legal Notices, your work need not make them do so.
+
+A compilation of a covered work with other separate and independent works, which are not by their nature extensions of the covered work, and which are not combined with it such as to form a larger program, in or on a volume of a storage or distribution medium, is called an “aggregate” if the compilation and its resulting copyright are not used to limit the access or legal rights of the compilation's users beyond what the individual works permit. Inclusion of a covered work in an aggregate does not cause this License to apply to the other parts of the aggregate.
+
+6. Conveying Non-Source Forms.
+You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways:
+
+     a) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by the Corresponding Source fixed on a durable physical medium customarily used for software interchange.
+
+     b) Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
+
+     c) Convey individual copies of the object code with a copy of the written offer to provide the Corresponding Source. This alternative is allowed only occasionally and noncommercially, and only if you received the object code with such an offer, in accord with subsection 6b.
+
+     d) Convey the object code by offering access from a designated place (gratis or for a charge), and offer equivalent access to the Corresponding Source in the same way through the same place at no further charge. You need not require recipients to copy the Corresponding Source along with the object code. If the place to copy the object code is a network server, the Corresponding Source may be on a different server (operated by you or a third party) that supports equivalent copying facilities, provided you maintain clear directions next to the object code saying where to find the Corresponding Source. Regardless of what server hosts the Corresponding Source, you remain obligated to ensure that it is available for as long as needed to satisfy these requirements.
+
+     e) Convey the object code using peer-to-peer transmission, provided you inform other peers where the object code and Corresponding Source of the work are being offered to the general public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded from the Corresponding Source as a System Library, need not be included in conveying the object code work.
+
+A “User Product” is either (1) a “consumer product”, which means any tangible personal property which is normally used for personal, family, or household purposes, or (2) anything designed or sold for incorporation into a dwelling. In determining whether a product is a consumer product, doubtful cases shall be resolved in favor of coverage. For a particular product received by a particular user, “normally used” refers to a typical or common use of that class of product, regardless of the status of the particular user or of the way in which the particular user actually uses, or expects or is expected to use, the product. A product is a consumer product regardless of whether the product has substantial commercial, industrial or non-consumer uses, unless such uses represent the only significant mode of use of the product.
+
+“Installation Information” for a User Product means any methods, procedures, authorization keys, or other information required to install and execute modified versions of a covered work in that User Product from a modified version of its Corresponding Source. The information must suffice to ensure that the continued functioning of the modified object code is in no case prevented or interfered with solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or specifically for use in, a User Product, and the conveying occurs as part of a transaction in which the right of possession and use of the User Product is transferred to the recipient in perpetuity or for a fixed term (regardless of how the transaction is characterized), the Corresponding Source conveyed under this section must be accompanied by the Installation Information. But this requirement does not apply if neither you nor any third party retains the ability to install modified object code on the User Product (for example, the work has been installed in ROM).
+
+The requirement to provide Installation Information does not include a requirement to continue to provide support service, warranty, or updates for a work that has been modified or installed by the recipient, or for the User Product in which it has been modified or installed. Access to a network may be denied when the modification itself materially and adversely affects the operation of the network or violates the rules and protocols for communication across the network.
+
+Corresponding Source conveyed, and Installation Information provided, in accord with this section must be in a format that is publicly documented (and with an implementation available to the public in source code form), and must require no special password or key for unpacking, reading or copying.
+
+7. Additional Terms.
+“Additional permissions” are terms that supplement the terms of this License by making exceptions from one or more of its conditions. Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:
+
+     a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; or
+
+     b) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; or
+
+     c) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; or
+
+     d) Limiting the use for publicity purposes of names of licensors or authors of the material; or
+
+     e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or
+
+     f) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.
+
+All other non-permissive additional terms are considered “further restrictions” within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term. If a license document contains a further restriction but permits relicensing or conveying under this License, you may add to a covered work material governed by the terms of that license document, provided that the further restriction does not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you must place, in the relevant source files, a statement of the additional terms that apply to those files, or a notice indicating where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the form of a separately written license, or stated as exceptions; the above requirements apply either way.
+
+8. Termination.
+You may not propagate or modify a covered work except as expressly provided under this License. Any attempt otherwise to propagate or modify it is void, and will automatically terminate your rights under this License (including any patent licenses granted under the third paragraph of section 11).
+
+However, if you cease all violation of this License, then your license from a particular copyright holder is reinstated (a) provisionally, unless and until the copyright holder explicitly and finally terminates your license, and (b) permanently, if the copyright holder fails to notify you of the violation by some reasonable means prior to 60 days after the cessation.
+
+Moreover, your license from a particular copyright holder is reinstated permanently if the copyright holder notifies you of the violation by some reasonable means, this is the first time you have received notice of violation of this License (for any work) from that copyright holder, and you cure the violation prior to 30 days after your receipt of the notice.
+
+Termination of your rights under this section does not terminate the licenses of parties who have received copies or rights from you under this License. If your rights have been terminated and not permanently reinstated, you do not qualify to receive new licenses for the same material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+You are not required to accept this License in order to receive or run a copy of the Program. Ancillary propagation of a covered work occurring solely as a consequence of using peer-to-peer transmission to receive a copy likewise does not require acceptance. However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+Each time you convey a covered work, the recipient automatically receives a license from the original licensors, to run, modify and propagate that work, subject to this License. You are not responsible for enforcing compliance by third parties with this License.
+
+An “entity transaction” is a transaction transferring control of an organization, or substantially all assets of one, or subdividing an organization, or merging organizations. If propagation of a covered work results from an entity transaction, each party to that transaction who receives a copy of the work also receives whatever licenses to the work the party's predecessor in interest had or could give under the previous paragraph, plus a right to possession of the Corresponding Source of the work from the predecessor in interest, if the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.
+
+11. Patents.
+A “contributor” is a copyright holder who authorizes use under this License of the Program or a work on which the Program is based. The work thus licensed is called the contributor's “contributor version”.
+
+A contributor's “essential patent claims” are all patent claims owned or controlled by the contributor, whether already acquired or hereafter acquired, that would be infringed by some manner, permitted by this License, of making, using, or selling its contributor version, but do not include claims that would be infringed only as a consequence of further modification of the contributor version. For purposes of this definition, “control” includes the right to grant patent sublicenses in a manner consistent with the requirements of this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.
+
+In the following three paragraphs, a “patent license” is any express agreement or commitment, however denominated, not to enforce a patent (such as an express permission to practice a patent or covenant not to sue for patent infringement). To “grant” such a patent license to a party means to make such an agreement or commitment not to enforce a patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license, and the Corresponding Source of the work is not available for anyone to copy, free of charge and under the terms of this License, through a publicly available network server or other readily accessible means, then you must either (1) cause the Corresponding Source to be so available, or (2) arrange to deprive yourself of the benefit of the patent license for this particular work, or (3) arrange, in a manner consistent with the requirements of this License, to extend the patent license to downstream recipients. “Knowingly relying” means you have actual knowledge that, but for the patent license, your conveying the covered work in a country, or your recipient's use of the covered work in a country, would infringe one or more identifiable patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or arrangement, you convey, or propagate by procuring conveyance of, a covered work, and grant a patent license to some of the parties receiving the covered work authorizing them to use, propagate, modify or convey a specific copy of the covered work, then the patent license you grant is automatically extended to all recipients of the covered work and works based on it.
+
+A patent license is “discriminatory” if it does not include within the scope of its coverage, prohibits the exercise of, or is conditioned on the non-exercise of one or more of the rights that are specifically granted under this License. You may not convey a covered work if you are a party to an arrangement with a third party that is in the business of distributing software, under which you make payment to the third party based on the extent of your activity of conveying the work, and under which the third party grants, to any of the parties who would receive the covered work from you, a discriminatory patent license (a) in connection with copies of the covered work conveyed by you (or copies made from those copies), or (b) primarily for and in connection with specific products or compilations that contain the covered work, unless you entered into that arrangement, or that patent license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting any implied license or other defenses to infringement that may otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+If conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot convey a covered work so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not convey it at all. For example, if you agree to terms that obligate you to collect a royalty for further conveying from those to whom you convey the Program, the only way you could satisfy both those terms and this License would be to refrain entirely from conveying the Program.
+
+13. Use with the GNU Affero General Public License.
+Notwithstanding any other provision of this License, you have permission to link or combine any covered work with a work licensed under version 3 of the GNU Affero General Public License into a single combined work, and to convey the resulting work. The terms of this License will continue to apply to the part which is the covered work, but the special requirements of the GNU Affero General Public License, section 13, concerning interaction through a network will apply to the combination as such.
+
+14. Revised Versions of this License.
+The Free Software Foundation may publish revised and/or new versions of the GNU General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Program specifies that a certain numbered version of the GNU General Public License “or any later version” applies to it, you have the option of following the terms and conditions either of that numbered version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of the GNU General Public License, you may choose any version ever published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions of the GNU General Public License can be used, that proxy's public statement of acceptance of a version permanently authorizes you to choose that version for the Program.
+
+Later license versions may give you additional or different permissions. However, no additional obligations are imposed on any author or copyright holder as a result of your choosing to follow a later version.
+
+15. Disclaimer of Warranty.
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM “AS IS” WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+16. Limitation of Liability.
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+If the disclaimer of warranty and limitation of liability provided above cannot be given local legal effect according to their terms, reviewing courts shall apply local law that most closely approximates an absolute waiver of all civil liability in connection with the Program, unless a warranty or assumption of liability accompanies a copy of the Program in return for a fee.
+
+END OF TERMS AND CONDITIONS
+
+How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms.
+
+To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively state the exclusion of warranty; and each file should have at least the “copyright” line and a pointer to where the full notice is found.
+
+     <one line to give the program's name and a brief idea of what it does.>
+     Copyright (C) <year>  <name of author>
+
+     This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+
+     This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+     You should have received a copy of the GNU General Public License along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program does terminal interaction, make it output a short notice like this when it starts in an interactive mode:
+
+     <program>  Copyright (C) <year>  <name of author>
+     This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+     This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, your program's commands might be different; for a GUI interface, you would use an “about box”.
+
+You should also get your employer (if you work as a programmer) or school, if any, to sign a “copyright disclaimer” for the program, if necessary. For more information on this, and how to apply and follow the GNU GPL, see <https://www.gnu.org/licenses/>.
+
+The GNU General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Lesser General Public License instead of this License. But first, please read <https://www.gnu.org/philosophy/why-not-lgpl.html>.

README.md

@@ -1,48 +1,134 @@
 # DarkRoom
 
-A cross-platform, non-destructive RAW photo editor for Linux and Android.
+A non-destructive RAW photo editor and library for Linux and Android, with a
+GPU develop pipeline, a catalog that syncs between devices, and no account,
+no telemetry and no cloud of its own.
 
-**Status:** early. v0.1 is a remote library viewer — see
-[docs/milestone-v0.1.md](docs/milestone-v0.1.md).
+[![The library: seventy frames, the timeline beside them, the filter bar above](docs/manual/media/library.png)](docs/manual/README.md)
 
-## Documentation
+**[The manual](docs/manual/README.md)** shows every feature, pictured from
+the application itself. This page says what it is, how to get it, and what
+is still missing.
 
-| Document | Contents |
-|---|---|
-| [requirements.md](docs/requirements.md) | What the software must do — 122 numbered requirements |
-| [architecture.md](docs/architecture.md) | How it is built — crates, GPU pipeline, data model, sync |
-| [milestone-v0.1.md](docs/milestone-v0.1.md) | The first buildable milestone |
+## What it does
 
-## Building
+**A library.** Point it at a folder — on this machine, on a network mount,
+or one a Nextcloud client keeps in virtual-files mode, where a placeholder
+is treated as the photograph rather than as a one-byte file — or at a
+Nextcloud account directly. The grid is virtualised, ordered by capture
+time with a timeline beside it, and filtered by rating, flag, person and
+whether the file is here. Ratings, keywords, collections and a
+trash that survives a crash mid-operation. Card ingest. Bursts fold. Face
+detection and identity, with the index syncing between devices.
 
-Desktop:
+**Developing.** Eighteen declared operations fused into one compute
+dispatch, plus the neighbourhood work that cannot be: clarity, texture,
+capture sharpening, noise reduction, lens correction, spectral film
+simulation. Crop and straighten, spot repair, and local adjustments over
+masks the model draws — click a subject or a category, then paint, subtract
+a gradient, grow or shrink the edge. Focus peaking and a raw histogram for
+judging what is recoverable. Named presets; XMP sidecars other editors read.
+
+[![Segmenting an urban scene and choosing the sky as a mask](docs/manual/media/local-segment.png)](docs/manual/README.md#local-adjustments)
+
+**Panoramas.** Select the frames, align, choose a projection, fill the
+ragged border rather than crop it, and the composite lands beside its
+sources as a DNG, with a sidecar recording what it was merged from.
+
+[![Twelve hand-held frames aligned on a cylinder](docs/manual/media/panorama-aligned.png)](docs/manual/README.md#merging-a-panorama)
+
+**Export.** JPEG, PNG, AVIF, JPEG XL, 8- and 16-bit TIFF, with resize, output
+sharpening, a naming template and a colour space — to a folder here or back
+into the library.
+
+**On both platforms.** The same core runs on a desktop and a 12-inch
+tablet; the interface is one layout, tuned for a wide viewport with touch
+targets throughout. On desktop the develop view draws the compute pass's
+texture directly — no readback between the GPU and the screen.
+
+## Getting it
+
+| Platform | How | State |
+|---|---|---|
+| Arch Linux | [`packaging/PKGBUILD`](packaging/PKGBUILD) — `makepkg -si` | Built from every release |
+| Android | The APK from each CI run, or `./docker/android/package.sh --install` | Runs on a tablet; F-Droid not yet submitted |
+| Windows | `DarkRoom-<version>-x86_64-setup.exe`, cross-built by CI ([windows.md](docs/dev/windows.md)) | Verified under Wine only; unsigned |
+| Flatpak | [`packaging/flatpak/`](packaging/flatpak/) | Manifest in tree; choosing a library does not yet work in the sandbox |
+
+Or build it. Git LFS is required for the model weights, and the toolchain
+pins itself to 1.92.0:
 
 ```bash
-cargo run -p darkroom-desktop
+git lfs install && git lfs pull
+cargo run --release -p darkroom-desktop
 ```
 
-Android (containerised toolchain, see [docker/android](docker/android/README.md)):
+Android, through the containerised toolchain ([docker/android](docker/android/README.md)):
 
 ```bash
 ./docker/android/build.sh cargo ndk -t arm64-v8a build --release
 ```
 
-## Current state
+[CONTRIBUTING.md](CONTRIBUTING.md) has the system packages, the four
+commands CI runs against what you send, and the shortest useful
+contribution — a develop operation is one YAML file, and it arrives with its
+controls, its place in the chain and its tests.
 
-Working: workspace, GPU context and compute pass, adaptive Slint shell, Android
-cross-compilation of the core crates.
+## Where it stands
 
-**Not yet working:** the zero-copy display path. The build currently uploads
-frames through the CPU, which is exactly what
-[ARCH §6.1](docs/architecture.md) forbids — measured at 96% of frame time at
-4K. Replacing it is spike S1, the project's highest priority.
+**0.14.0**, twenty-one tagged releases in. 188 numbered requirements in
+scope, 82% of them claimed by code and [traced to it](docs/dev/traceability.md);
+the rest are written down rather than merely absent.
 
-```
-cargo run -p dr-gpu --example bench --features readback
-```
+**Not built:** plugins (post-v1, [D12](docs/dev/requirements.md)), compare and
+survey culling, AI denoise, tiled and progressive rendering, HDR merge and
+focus stacking, most of the Android platform integration beyond running,
+and the Flatpak's library chooser. The performance targets are half
+verified: the per-commit benchmark suite §8 requires exists for everything
+that does not need a frame — the catalog, the scan, the thumbnails — and
+not yet for the render path, so a regression there fails nothing.
+[outstanding.md](docs/dev/outstanding.md) is the list, with the reasoning for
+each.
 
-reproduces that measurement.
+**The one deliberate compromise worth knowing about before reading
+anything else:** the Android develop view reads its frame back through the
+CPU, because zero-copy there needs wgpu's Vulkan swapchain and that tears a
+portrait window on a tablet whose panel is mounted landscape. It is debt,
+not a revision of the rule — [technical-debt.md TD-1](docs/dev/technical-debt.md)
+has the measurements and the three things any one of which would remove it.
+
+## Documentation
+
+[docs/README.md](docs/README.md) is the index. The short version, for someone using it:
+
+| | |
+|---|---|
+| [manual](docs/manual/README.md) | Every feature, pictured |
+| [gestures.md](docs/gestures.md) | How it is driven — generated from the code, so it cannot describe a gesture that does not exist |
+
+For someone changing it:
+
+| | |
+|---|---|
+| [CONTRIBUTING.md](CONTRIBUTING.md) | How to land a first change without reading the rest |
+| [requirements.md](docs/dev/requirements.md) | What the software must do — the numbered register, and the decisions |
+| [architecture.md](docs/dev/architecture.md) | How it is built — crates, the GPU pipeline, the data model, sync |
+| [technical-debt.md](docs/dev/technical-debt.md) | Compromises taken deliberately, each with the condition that retires it |
+| [outstanding.md](docs/dev/outstanding.md) | What is not built, and whether that is a decision or a gap |
+| [code-health.md](docs/dev/code-health.md) | What a contribution costs, per seam, measured |
+| [traceability.md](docs/dev/traceability.md) | Generated: which requirement is claimed by which file |
+
+Designs, one per subsystem:
+[segmentation](docs/dev/segmentation.md) and [mask editing](docs/dev/mask-editing.md) ·
+[spot removal](docs/dev/spot-removal.md) · [panorama](docs/dev/panorama.md) ·
+[faces](docs/dev/faces.md) · [inference](docs/dev/inference.md) ·
+[storage and sync](docs/dev/storage.md) · [catalog](docs/dev/catalog.md) ·
+[display and extension](docs/dev/display-and-extension.md) ·
+[navigation](docs/dev/ui-navigation.md) · [distribution](docs/dev/distribution.md) ·
+[windows](docs/dev/windows.md) · [benchmarks](docs/dev/benchmarks.md).
 
 ## Licence
 
-GPL-3.0-or-later.
+GPL-3.0-or-later. The photographs in the manual and the test fixtures are
+the author's and are there to show and test this project, nothing else.
+The model weights carry their own licences — [models/LICENCE.md](models/LICENCE.md).

apps/darkroom-android/Cargo.toml

@@ -16,9 +16,14 @@ crate-type = ["cdylib"]
 # No backend feature to select: dr-ui picks its Slint backend from the target,
 # so building for aarch64-linux-android gets android-activity automatically.
 dr-ui.workspace = true
-# For `session::set_data_dir`: only the platform entry point knows where Android
+# For `account::set_data_dir`: only the platform entry point knows where Android
 # lets this app keep files, and it must be set before any store is opened.
-dr-sync-nextcloud.workspace = true
+dr-sync.workspace = true
+# For the panic hook, for `state::set_state_dir` and for
+# `diagnostics::install`. Android has no XDG directories, so the entry point is
+# the only place that knows where a crash record or a log file may be written,
+# and both have to be in place before anything can fail.
+dr-plat.workspace = true
 # Directly, not just through dr-ui: `android_main` takes an `AndroidApp` and
 # calls `slint::android::init`, both of which come from this crate. The backend
 # feature comes from dr-ui's target-specific dependency.
@@ -26,6 +31,21 @@ slint.workspace = true
 log.workspace = true
 android_logger = "0.15"
 
+# The launch Intent and the share sheet are Java-only surfaces — see `intents`
+# — and JNI is the only way to reach them.
+#
+# Target-gated because the crate still has to compile on the host: it is a
+# workspace member, `cargo test --workspace` builds it, and the manifest tests
+# in `lib.rs` are the one part of it that runs there.
+#
+# 0.21 rather than the 0.22 that android-activity 0.6 uses. Both are already in
+# the lock — Slint's Android backend depends on two major versions of
+# android-activity and pulls both — so this adds nothing to the build either
+# way, and every object here comes from a raw pointer rather than from a type
+# android-activity handed over, so the two never have to agree.
+[target.'cfg(target_os = "android")'.dependencies]
+jni = "0.21"
+
 [features]
 # Mirrors darkroom-desktop: the CPU readback path is gone since S1 landed
 # zero-copy. It mattered more here than on desktop — the same wrong path with

apps/darkroom-android/android/AndroidManifest.xml

@@ -7,6 +7,12 @@
   here is a distribution manifest yet. Only network access is declared: file
   access needs no manifest permission because the library grid reads through
   SAF, which grants per-tree at runtime (ARCH §6.9).
+
+  Minimal is not the same as empty, and the entries below that are not the
+  activity are the difference. A manifest is the only place a component can be
+  declared: an intent filter is how the system learns this app is worth
+  offering for a photograph, and a provider is how it learns the class exists
+  at all. Neither can be moved into code (FR-PLAT-AND-6).
 -->
 <manifest xmlns:android="http://schemas.android.com/apk/res/android"
     package="paris.tourolle.darkroom">
@@ -51,10 +57,30 @@
 
         <!-- NativeActivity rather than a Kotlin Activity: android-activity's
              glue loads libdarkroom.so and calls android_main. `android.app.lib_name`
-             is how it learns which library to load, and must match [lib].name. -->
+             is how it learns which library to load, and must match [lib].name.
+
+             `singleTask` because a second instance of this activity is not
+             survivable. The intent filters below mean another app can now
+             launch it while it is already running, and under the default
+             launch mode that starts a *second* NativeActivity — in the
+             caller's task, in this same process, calling android_main again.
+             Two Slint backends and two wgpu devices in one process is not a
+             degraded experience, it is a failed second launch on top of a
+             working first one.
+
+             What it costs, stated plainly: a share that arrives while DarkRoom
+             is already running brings it forward without opening the image.
+             The Intent goes to `onNewIntent`, and android-activity's event
+             stream has no variant for it (MainEvent in 0.6 stops at Destroy),
+             so nothing native ever sees it. Reading it would mean a Java
+             Activity subclass forwarding it across JNI — the same shape of
+             change FR-PLAT-AND-5 declined for onTrimMemory, and for the same
+             reason. Launched from cold, which is the ordinary case for "open
+             this photograph", the Intent is on getIntent() and is read. -->
         <activity
             android:name="android.app.NativeActivity"
             android:exported="true"
+            android:launchMode="singleTask"
             android:configChanges="orientation|keyboardHidden|screenSize|screenLayout|density|uiMode"
             android:windowSoftInputMode="adjustResize">
 
@@ -66,6 +92,80 @@
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
+
+            <!-- FR-PLAT-AND-6, inbound. The traceability tool reads .rs,
+                 .slint, .wgsl and .yaml, so this is a reference and not a
+                 tag; the tag that counts is on the test in lib.rs that
+                 asserts these declarations are still here.
+
+                 Opening a photograph from a gallery, a file manager or a
+                 download. `android_main` reads the launch Intent through
+                 `Intents.receive` and the named images become the browsing
+                 list, exactly as paths on the desktop command line do.
+
+                 `image/*` and not a wider match, even though it misses raws:
+                 a provider that does not recognise `.CR3` reports it as
+                 `application/octet-stream`, and claiming that type would put
+                 DarkRoom in the chooser for every unidentified binary on the
+                 device — an APK, a database, a partial download. Being absent
+                 from one gallery's menu is a smaller failure than being
+                 present in all of them. DNG, which providers do know as
+                 `image/x-adobe-dng`, matches here already.
+
+                 BROWSABLE is what lets a browser's finished download and a
+                 link hand the file over; without it those routes silently do
+                 not list the app. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
+
+            <!-- The share sheet, one photograph or a selection of them.
+                 SEND_MULTIPLE is declared because the sheet offers this app
+                 for a multi-selection only if it says it accepts one, and a
+                 culling tool that can be sent a single frame and not a burst
+                 is the wrong way round.
+
+                 ACTION_EDIT is deliberately not here. It is a promise to write
+                 the result back to the URI it was handed, and nothing in this
+                 app does: an edit lands in a sidecar beside the original
+                 (FR-CAT-8). Registering for it would put DarkRoom in the "edit
+                 with" menu and lose the user's work every time. -->
+            <intent-filter>
+                <action android:name="android.intent.action.SEND" />
+                <action android:name="android.intent.action.SEND_MULTIPLE" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <data android:mimeType="image/*" />
+            </intent-filter>
         </activity>
+
+        <!-- FR-PLAT-AND-6, outbound. Android has refused file:// URIs
+             between apps since API 24 — handing one out raises
+             FileUriExposedException in *this* process — so an exported JPEG
+             reaches the share sheet as a content:// URI or not at all.
+
+             Not AndroidX's FileProvider: that is a Maven artefact, and this
+             build has no Gradle and no dependency resolver (docker/android/
+             README.md). ExportProvider does the same hundred lines against one
+             fixed root.
+
+             `exported="false"` with `grantUriPermissions="true"` is the whole
+             security model, and the two halves are not redundant. Exported
+             false means no app may address the provider on its own account;
+             the grant flag means a URI this app puts in an Intent carries a
+             read permission for that one file, for the lifetime of the
+             receiving task. Without the grant flag the share sheet opens and
+             every target fails with SecurityException; with `exported="true"`
+             instead, every app on the device could read the app's private
+             directory. The authority must equal ExportProvider.AUTHORITY — a
+             mismatch is a SecurityException in somebody else's app, so a test
+             in lib.rs compares the two strings. -->
+        <provider
+            android:name="paris.tourolle.darkroom.ExportProvider"
+            android:authorities="paris.tourolle.darkroom.exports"
+            android:exported="false"
+            android:grantUriPermissions="true" />
     </application>
 </manifest>

apps/darkroom-android/android/java/paris/tourolle/darkroom/ExportProvider.java

@@ -0,0 +1,260 @@
+package paris.tourolle.darkroom;
+
+import android.content.ContentProvider;
+import android.content.ContentValues;
+import android.content.Context;
+import android.database.Cursor;
+import android.database.MatrixCursor;
+import android.net.Uri;
+import android.os.ParcelFileDescriptor;
+import android.provider.OpenableColumns;
+import android.util.Log;
+import android.webkit.MimeTypeMap;
+
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.util.List;
+import java.util.Locale;
+
+/**
+ * Hands an exported file to another app, and hands out nothing else.
+ *
+ * <p>FR-PLAT-AND-6's outbound half. Android has refused {@code file://} URIs
+ * between apps since API 24 — passing one raises {@code FileUriExposedException}
+ * in the *sending* process — so the only way to give a photo to the share sheet
+ * is a {@code content://} URI backed by a provider, plus a per-Intent read
+ * grant that expires with the task that received it.
+ *
+ * <h2>Why this is not AndroidX's FileProvider</h2>
+ *
+ * <p>Because AndroidX is a Maven artefact and this build has no Gradle and no
+ * dependency resolver (see docker/android/README.md). Pulling in the one class
+ * would mean adopting the whole mechanism that fetches it. What
+ * {@code FileProvider} does is a hundred lines — map a request path onto a
+ * directory, refuse anything outside it, answer the two columns the share sheet
+ * reads — and those lines are below. The configuration it takes as an XML
+ * {@code <meta-data>} resource is a constant here instead, because there is
+ * exactly one directory worth serving and a second place to state it is a
+ * second place for it to be wrong.
+ *
+ * <h2>The one directory</h2>
+ *
+ * <p>{@code getFilesDir()}, which is the same directory the Rust side calls
+ * {@code internal_data_path} and passes to {@code dr_sync::account::set_data_dir}
+ * — {@code ANativeActivity.internalDataPath} and {@code Context.getFilesDir()}
+ * are the same path. Everything the app writes for itself, the export outbox
+ * included, is under it. Nothing else is reachable: a request is resolved
+ * against the real filesystem with {@link File#getCanonicalFile()} and then
+ * checked to be *inside* that root, so {@code ../} and a symlink planted in the
+ * outbox are refused by the same test. Serving a path the caller composed,
+ * unchecked, would turn a share button into a reader for every file this app
+ * can see, which on Android includes credentials and the whole catalog.
+ *
+ * <p>{@code android:exported="false"} in the manifest is the outer half of the
+ * same rule: no app can address this provider at all except through a URI this
+ * app handed it with a read grant attached.
+ */
+public final class ExportProvider extends ContentProvider {
+    private static final String TAG = "DarkRoom";
+
+    /**
+     * Must equal {@code android:authorities} in AndroidManifest.xml.
+     *
+     * <p>A mismatch is not a build error and not a runtime error here: it is a
+     * {@code SecurityException} in whichever app opened the share sheet, naming
+     * an authority that does not exist. A test in {@code lib.rs} asserts the
+     * two strings are the same for that reason.
+     */
+    public static final String AUTHORITY = "paris.tourolle.darkroom.exports";
+
+    /** Nothing to set up; the root is resolved per request against the context. */
+    @Override
+    public boolean onCreate() {
+        return true;
+    }
+
+    /**
+     * The {@code content://} URI for a file, or null if it is not one this
+     * provider may serve.
+     *
+     * <p>Returning null rather than an unusable URI keeps the refusal at the
+     * point where the path is known. A URI for a file outside the root would be
+     * rejected later by {@link #openFile}, in the *receiving* app's stack trace,
+     * where nothing says which of our files was asked for.
+     */
+    public static Uri uriFor(Context context, File file) {
+        try {
+            File root = root(context);
+            File target = file.getCanonicalFile();
+            String relative = within(root, target);
+            if (relative == null) {
+                Log.w(TAG, "not shareable, outside " + root + ": " + target);
+                return null;
+            }
+            // Built segment by segment rather than with a composed path
+            // string: appendPath percent-encodes, and getPathSegments below
+            // decodes symmetrically. A file called "Rue d'Alésia.jpg" survives
+            // the round trip only because both halves agree.
+            Uri.Builder builder = new Uri.Builder().scheme("content").authority(AUTHORITY);
+            for (String segment : relative.split("/")) {
+                if (!segment.isEmpty()) {
+                    builder.appendPath(segment);
+                }
+            }
+            return builder.build();
+        } catch (IOException e) {
+            Log.w(TAG, "cannot resolve " + file + " for sharing: " + e);
+            return null;
+        }
+    }
+
+    /**
+     * The two columns a share target actually reads.
+     *
+     * <p>Without {@code _display_name} the receiving app shows the URI's last
+     * segment, and without {@code _size} a mail client cannot tell whether the
+     * attachment fits before it starts reading. Both are optional in the sense
+     * that the transfer still works; both are the difference between "DSC_4471
+     * final.jpg, 8.2 MB" and an unnamed blob.
+     */
+    @Override
+    public Cursor query(Uri uri, String[] projection, String selection,
+                        String[] selectionArgs, String sortOrder) {
+        File file = resolve(uri);
+        if (file == null) {
+            return null;
+        }
+        String[] columns = projection != null
+                ? projection
+                : new String[] {OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE};
+        MatrixCursor cursor = new MatrixCursor(columns, 1);
+        MatrixCursor.RowBuilder row = cursor.newRow();
+        for (String column : columns) {
+            if (OpenableColumns.DISPLAY_NAME.equals(column)) {
+                row.add(file.getName());
+            } else if (OpenableColumns.SIZE.equals(column)) {
+                row.add(file.length());
+            } else {
+                // A column we do not have. Null rather than omitted: a cursor
+                // whose row is shorter than its projection throws in the
+                // caller, which is a crash in someone else's app.
+                row.add(null);
+            }
+        }
+        return cursor;
+    }
+
+    /**
+     * From the extension, because that is all there is.
+     *
+     * <p>The type decides which apps the chooser offers, so guessing wrong
+     * narrows the sheet rather than breaking the transfer. Exports are JPEG,
+     * PNG or TIFF and {@code MimeTypeMap} knows all three.
+     */
+    @Override
+    public String getType(Uri uri) {
+        File file = resolve(uri);
+        if (file == null) {
+            return null;
+        }
+        String name = file.getName();
+        int dot = name.lastIndexOf('.');
+        if (dot >= 0 && dot < name.length() - 1) {
+            String extension = name.substring(dot + 1).toLowerCase(Locale.ROOT);
+            String type = MimeTypeMap.getSingleton().getMimeTypeFromExtension(extension);
+            if (type != null) {
+                return type;
+            }
+        }
+        return "application/octet-stream";
+    }
+
+    /**
+     * Read-only, always.
+     *
+     * <p>A write mode is refused rather than quietly downgraded: a caller that
+     * asked for "rw" intends to save something back, and letting it open the
+     * file read-only would fail at its first write with an error about a
+     * descriptor rather than about permission. Nothing this app shares is meant
+     * to be edited in place by the app it was shared with.
+     */
+    @Override
+    public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {
+        if (!"r".equals(mode)) {
+            throw new SecurityException("this provider is read-only, asked for '" + mode + "'");
+        }
+        File file = resolve(uri);
+        if (file == null) {
+            throw new FileNotFoundException("no such export: " + uri);
+        }
+        return ParcelFileDescriptor.open(file, ParcelFileDescriptor.MODE_READ_ONLY);
+    }
+
+    @Override
+    public Uri insert(Uri uri, ContentValues values) {
+        throw new UnsupportedOperationException("exports are written by the app, not through it");
+    }
+
+    @Override
+    public int update(Uri uri, ContentValues values, String selection, String[] selectionArgs) {
+        throw new UnsupportedOperationException("exports are written by the app, not through it");
+    }
+
+    @Override
+    public int delete(Uri uri, String selection, String[] selectionArgs) {
+        throw new UnsupportedOperationException("exports are deleted by the app, not through it");
+    }
+
+    /** The served root, resolved through the filesystem so the check below is real. */
+    private static File root(Context context) throws IOException {
+        return context.getFilesDir().getCanonicalFile();
+    }
+
+    /** The file a request names, or null if it names anything else. */
+    private File resolve(Uri uri) {
+        Context context = getContext();
+        if (context == null) {
+            return null;
+        }
+        List<String> segments = uri.getPathSegments();
+        if (segments.isEmpty()) {
+            return null;
+        }
+        try {
+            File root = root(context);
+            File candidate = root;
+            for (String segment : segments) {
+                candidate = new File(candidate, segment);
+            }
+            candidate = candidate.getCanonicalFile();
+            if (within(root, candidate) == null || !candidate.isFile()) {
+                Log.w(TAG, "refused " + uri);
+                return null;
+            }
+            return candidate;
+        } catch (IOException e) {
+            Log.w(TAG, "refused " + uri + ": " + e);
+            return null;
+        }
+    }
+
+    /**
+     * {@code target}'s path relative to {@code root}, or null if it is not
+     * under it.
+     *
+     * <p>Both sides are canonical by the time they get here, which is what
+     * makes one string comparison enough for {@code ../} and for a symlink
+     * alike. The trailing separator matters: without it a sibling directory
+     * whose name merely starts with the root's — {@code /data/.../files.old} —
+     * passes.
+     */
+    private static String within(File root, File target) {
+        String rootPath = root.getPath() + File.separator;
+        String targetPath = target.getPath();
+        if (!targetPath.startsWith(rootPath)) {
+            return null;
+        }
+        return targetPath.substring(rootPath.length());
+    }
+}

apps/darkroom-android/android/java/paris/tourolle/darkroom/Intents.java

@@ -0,0 +1,320 @@
+package paris.tourolle.darkroom;
+
+import android.app.Activity;
+import android.content.ActivityNotFoundException;
+import android.content.ContentResolver;
+import android.content.Context;
+import android.content.Intent;
+import android.database.Cursor;
+import android.net.Uri;
+import android.provider.OpenableColumns;
+import android.util.Log;
+
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * The two directions of FR-PLAT-AND-6: what the app was opened *with*, and
+ * handing a finished export to somebody else.
+ *
+ * <h2>Why this is Java and not JNI in lib.rs</h2>
+ *
+ * <p>Every call below is reachable over JNI, and doing it that way would be
+ * roughly forty {@code call_method} invocations with their signatures written
+ * out as strings — each one a name Java checks at run time and nothing checks
+ * at build time. The Rust side would then hold the exact logic that is here,
+ * expressed less clearly, and a typo in {@code "()Landroid/content/Intent;"}
+ * would surface on a device as a {@code NoSuchMethodError} rather than at the
+ * compiler. So the platform work stays on the platform's side and the JNI
+ * surface is two calls, both taking and returning strings.
+ *
+ * <p>The class is only reachable because the APK now compiles Java at all; see
+ * docker/android/assemble-apk.sh.
+ */
+public final class Intents {
+    private static final String TAG = "DarkRoom";
+
+    /**
+     * Where incoming images are copied, under {@code getCacheDir()}.
+     *
+     * <p>The cache and not the data directory, deliberately: these are copies
+     * of somebody else's file, the app has no claim on them once the session
+     * ends, and the cache is the one place Android may reclaim under storage
+     * pressure without the user being asked. Putting them in the data
+     * directory would grow the app's footprint by a RAW file per share, for
+     * ever, with nothing that ever deletes them.
+     */
+    private static final String INBOX = "incoming";
+
+    private Intents() {
+    }
+
+    /**
+     * The images this launch was asked to open, as paths the decoder can read.
+     *
+     * <p>Empty for an ordinary launch from the launcher, which is the common
+     * case and not a failure.
+     *
+     * <h3>Why the bytes are copied</h3>
+     *
+     * <p>A share arrives as a {@code content://} URI, which is a handle into
+     * another app's provider and not a path — there is no filename behind it to
+     * open, and the grant that makes it readable belongs to this task and dies
+     * with it. DarkRoom's decoders take paths (ARCH §6.9 is the note that
+     * Android has no paths to give), so the choice is to copy or to teach the
+     * whole read path about URIs, and the second is FR-PLAT-AND-1's SAF
+     * connector, which is not built.
+     *
+     * <p>So it is a copy, and the cost is honest: a 60 MB raw file is written
+     * once, to the cache, before the viewer opens. It is bounded by the share
+     * being a deliberate act — a person picked these files — rather than by
+     * anything this code does.
+     *
+     * <p>The inbox is emptied first. Without that, every share ever received
+     * accumulates until the platform decides the cache is too large, and the
+     * files are indistinguishable from each other by then.
+     */
+    public static String[] receive(Activity activity) {
+        List<Uri> uris = incoming(activity.getIntent());
+        if (uris.isEmpty()) {
+            return new String[0];
+        }
+
+        File inbox = new File(activity.getCacheDir(), INBOX);
+        empty(inbox);
+        if (!inbox.mkdirs() && !inbox.isDirectory()) {
+            Log.e(TAG, "cannot create " + inbox + "; the launch intent is dropped");
+            return new String[0];
+        }
+
+        List<String> paths = new ArrayList<String>();
+        for (Uri uri : uris) {
+            String path = localise(activity, uri, inbox, paths.size());
+            if (path != null) {
+                paths.add(path);
+            }
+        }
+        Log.i(TAG, "launch intent carried " + paths.size() + " of " + uris.size() + " image(s)");
+        return paths.toArray(new String[0]);
+    }
+
+    /**
+     * Offer a file this app produced to whatever else is installed.
+     *
+     * <p>Returns false when there is nothing to offer it to, or when the file
+     * is not one {@link ExportProvider} may serve — both of which the caller
+     * has to be able to say out loud, because from the user's side a share
+     * button that does nothing is indistinguishable from one that failed.
+     *
+     * <p>{@code FLAG_GRANT_READ_URI_PERMISSION} is the whole security model:
+     * the provider is not exported, so the receiving app can reach this one
+     * file, for as long as its task lives, and nothing else ever.
+     */
+    public static boolean share(Activity activity, String path, String mimeType) {
+        Uri uri = ExportProvider.uriFor(activity, new File(path));
+        if (uri == null) {
+            return false;
+        }
+
+        Intent send = new Intent(Intent.ACTION_SEND);
+        send.setType(mimeType != null && !mimeType.isEmpty() ? mimeType : "image/*");
+        send.putExtra(Intent.EXTRA_STREAM, uri);
+        send.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
+
+        // Always a chooser, never a direct start. Android's "remembered
+        // default" for ACTION_SEND is a per-user setting this app has no
+        // business consuming: the app a photograph should go to differs every
+        // time, and the one time it does not, the sheet is one extra tap.
+        Intent chooser = Intent.createChooser(send, null);
+        try {
+            activity.startActivity(chooser);
+            return true;
+        } catch (ActivityNotFoundException e) {
+            Log.w(TAG, "nothing installed accepts " + mimeType + ": " + e);
+            return false;
+        }
+    }
+
+    /**
+     * The URIs an Intent carries, by the action that carried them.
+     *
+     * <p>Only the actions the manifest registers for. An action we did not
+     * declare cannot arrive, so handling one here would be code that reads as
+     * support for something the launcher will never offer.
+     */
+    @SuppressWarnings("deprecation")
+    private static List<Uri> incoming(Intent intent) {
+        List<Uri> uris = new ArrayList<Uri>();
+        if (intent == null) {
+            return uris;
+        }
+        String action = intent.getAction();
+        if (Intent.ACTION_VIEW.equals(action)) {
+            add(uris, intent.getData());
+        } else if (Intent.ACTION_SEND.equals(action)) {
+            // The typed getParcelableExtra(String, Class) overload is API 33,
+            // and minSdk is 28. The deprecated form is the only one that exists
+            // on every device this APK installs on.
+            add(uris, (Uri) intent.getParcelableExtra(Intent.EXTRA_STREAM));
+        } else if (Intent.ACTION_SEND_MULTIPLE.equals(action)) {
+            ArrayList<Uri> many = intent.getParcelableArrayListExtra(Intent.EXTRA_STREAM);
+            if (many != null) {
+                for (Uri uri : many) {
+                    add(uris, uri);
+                }
+            }
+        }
+        return uris;
+    }
+
+    private static void add(List<Uri> uris, Uri uri) {
+        if (uri != null) {
+            uris.add(uri);
+        }
+    }
+
+    /** A URI as a readable path, copying it into the inbox if it is not one already. */
+    private static String localise(Context context, Uri uri, File inbox, int index) {
+        // A file:// URI is already a path, and copying it would double a raw
+        // file on disk to no end. Rare — the platform has refused file:// URIs
+        // between apps since API 24 — but it is what a shell `am start -d
+        // file:///sdcard/…` produces, which is how this path gets tested
+        // without a second app installed.
+        if (ContentResolver.SCHEME_FILE.equals(uri.getScheme())) {
+            String path = uri.getPath();
+            if (path != null && new File(path).canRead()) {
+                return path;
+            }
+            Log.w(TAG, "cannot read " + uri);
+            return null;
+        }
+
+        File dest = new File(inbox, unique(inbox, displayName(context, uri), index));
+        InputStream in = null;
+        OutputStream out = null;
+        try {
+            in = context.getContentResolver().openInputStream(uri);
+            if (in == null) {
+                Log.w(TAG, "no stream behind " + uri);
+                return null;
+            }
+            out = new FileOutputStream(dest);
+            byte[] buffer = new byte[64 * 1024];
+            int read;
+            while ((read = in.read(buffer)) > 0) {
+                out.write(buffer, 0, read);
+            }
+            out.flush();
+            return dest.getAbsolutePath();
+        } catch (IOException e) {
+            Log.w(TAG, "cannot copy " + uri + ": " + e);
+            // The partial copy is removed rather than left: it has the name and
+            // the extension of a photograph and none of the bytes, and the
+            // decoder would report it as a corrupt file rather than a failed
+            // transfer.
+            dest.delete();
+            return null;
+        } catch (SecurityException e) {
+            // The grant on a shared URI dies with the task that received it.
+            // A process resumed from a saved state can find itself holding a
+            // URI it may no longer read (FR-PLAT-AND-3), and that is a lost
+            // permission rather than a broken file.
+            Log.w(TAG, "no longer permitted to read " + uri + ": " + e);
+            dest.delete();
+            return null;
+        } finally {
+            close(in);
+            close(out);
+        }
+    }
+
+    /**
+     * What the sending app calls the file, reduced to something safe to write.
+     *
+     * <p>The name is chosen by another application and lands in a path this one
+     * composes, so it is filtered rather than trusted: a name containing a
+     * separator would place the copy outside the inbox, and one beginning with
+     * a dot would hide it from everything that lists the directory. What
+     * survives is the part a photographer recognises — {@code DSC_4471.NEF} —
+     * which is the only reason to use the sender's name at all.
+     */
+    private static String displayName(Context context, Uri uri) {
+        String name = null;
+        Cursor cursor = null;
+        try {
+            cursor = context.getContentResolver().query(
+                    uri, new String[] {OpenableColumns.DISPLAY_NAME}, null, null, null);
+            if (cursor != null && cursor.moveToFirst() && !cursor.isNull(0)) {
+                name = cursor.getString(0);
+            }
+        } catch (Exception e) {
+            // Providers are other people's code and any of them may throw.
+            // A name is a convenience; failing the whole open over it is not.
+            Log.d(TAG, "no display name for " + uri + ": " + e);
+        } finally {
+            if (cursor != null) {
+                cursor.close();
+            }
+        }
+        if (name == null) {
+            name = uri.getLastPathSegment();
+        }
+        if (name == null) {
+            return "shared";
+        }
+        StringBuilder safe = new StringBuilder(name.length());
+        for (int i = 0; i < name.length(); i++) {
+            char c = name.charAt(i);
+            boolean ok = (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
+                    || (c >= '0' && c <= '9') || c == '.' || c == '-' || c == '_';
+            safe.append(ok ? c : '_');
+        }
+        while (safe.length() > 0 && safe.charAt(0) == '.') {
+            safe.deleteCharAt(0);
+        }
+        return safe.length() > 0 ? safe.toString() : "shared";
+    }
+
+    /**
+     * A name nothing in the inbox has yet.
+     *
+     * <p>A multi-image share of a burst arrives as several files a camera named
+     * the same thing in different folders, and the second one silently
+     * overwriting the first would show the user one photograph where they
+     * picked four.
+     */
+    private static String unique(File inbox, String name, int index) {
+        if (!new File(inbox, name).exists()) {
+            return name;
+        }
+        return index + "-" + name;
+    }
+
+    private static void close(java.io.Closeable stream) {
+        if (stream != null) {
+            try {
+                stream.close();
+            } catch (IOException e) {
+                Log.d(TAG, "close failed: " + e);
+            }
+        }
+    }
+
+    /** Delete the inbox's contents, one level deep, which is all it ever has. */
+    private static void empty(File inbox) {
+        File[] stale = inbox.listFiles();
+        if (stale == null) {
+            return;
+        }
+        for (File file : stale) {
+            if (!file.delete()) {
+                Log.d(TAG, "could not remove stale " + file);
+            }
+        }
+    }
+}

apps/darkroom-android/src/intents.rs

@@ -0,0 +1,192 @@
+//! What the app was launched with, and handing a finished export back out.
+//!
+//! FR-PLAT-AND-6's Rust side, which is deliberately the thin side. Both
+//! directions are implemented in `android/java/paris/tourolle/darkroom/` and
+//! everything here is the two calls that reach them; `Intents.java` carries the
+//! reasoning for the split. The short version is that a JNI method signature is
+//! a string Java resolves at run time and nothing checks at build time, so
+//! forty of them is forty ways for a rename to become a `NoSuchMethodError` on
+//! somebody's tablet. Two is two.
+//!
+//! # Nothing here fails loudly
+//!
+//! A class the loader cannot see, a pending Java exception, a shared URI whose
+//! grant died with the task that received it: each ends as a log line and an
+//! empty result. This runs on the way to [`dr_ui::run`], before a window
+//! exists, and the alternative to opening with an empty browsing list is not
+//! opening at all.
+
+use std::path::{Path, PathBuf};
+
+use jni::errors::Result as JniResult;
+use jni::objects::{JClass, JObject, JObjectArray, JString, JValue};
+use jni::{JNIEnv, JavaVM};
+
+/// The class both directions live in, named the way `loadClass` wants it —
+/// dots, not slashes. `find_class` takes the other form, and this code calls
+/// neither by accident; see [`load_class`].
+const INTENTS: &str = "paris.tourolle.darkroom.Intents";
+
+/// The images this launch was asked to open, already local and readable.
+///
+/// Empty for an ordinary launch from the launcher, which is the common case
+/// and not a failure. What comes back is passed to `dr_ui::run` exactly as
+/// command-line paths are on the desktop, so a shared photograph becomes the
+/// browsing list and `startup_action` shows it rather than the launch screen.
+pub fn launch_images(app: &slint::android::AndroidApp) -> Vec<PathBuf> {
+    with_activity(app, "reading the launch intent", |env, activity| {
+        let class = load_class(env, activity, INTENTS)?;
+        let returned = env
+            .call_static_method(
+                &class,
+                "receive",
+                "(Landroid/app/Activity;)[Ljava/lang/String;",
+                &[JValue::Object(activity)],
+            )?
+            .l()?;
+
+        let array = JObjectArray::from(returned);
+        let count = env.get_array_length(&array)?;
+        let mut paths = Vec::with_capacity(count as usize);
+        for i in 0..count {
+            let element = env.get_object_array_element(&array, i)?;
+            let text: String = env.get_string(&JString::from(element))?.into();
+            paths.push(PathBuf::from(text));
+        }
+        Ok(paths)
+    })
+    .unwrap_or_default()
+}
+
+/// Offer a file this app produced to whatever else is installed.
+///
+/// `false` means the sheet did not open — the file is not under the directory
+/// [`ExportProvider`] serves, or nothing installed accepts the type. Both are
+/// answers a caller has to be able to give the user, because a share control
+/// that silently does nothing is indistinguishable from one that failed.
+///
+/// **This half has no caller yet, and that is the honest state of it.** The
+/// provider, the URI grant and the chooser are all here and are what
+/// FR-PLAT-AND-6 asks for; what is missing is a share control in the interface,
+/// which lives in `ui/dr-ui` and needs one thing this signature shows: an
+/// `AndroidApp` to call through. Wiring it means keeping a clone of the app —
+/// it is `Clone` and cheap — somewhere `ui/` can reach, which is a change to
+/// how the platform entry point talks to the interface rather than a change
+/// here. Until that exists this function is reachable and untested, and it is
+/// deliberately not tagged as covering the requirement.
+///
+/// `mime` decides which applications the chooser offers; the empty string
+/// falls back to `image/*` on the Java side.
+pub fn share(app: &slint::android::AndroidApp, file: &Path, mime: &str) -> bool {
+    with_activity(app, "opening the share sheet", |env, activity| {
+        let class = load_class(env, activity, INTENTS)?;
+        let path = env.new_string(file.to_string_lossy().as_ref())?;
+        let mime = env.new_string(mime)?;
+        env.call_static_method(
+            &class,
+            "share",
+            "(Landroid/app/Activity;Ljava/lang/String;Ljava/lang/String;)Z",
+            &[
+                JValue::Object(activity),
+                JValue::Object(&path),
+                JValue::Object(&mime),
+            ],
+        )?
+        .z()
+    })
+    .unwrap_or(false)
+}
+
+/// Attach to the JVM, borrow the activity, and run `body` against both.
+///
+/// Shared by the two entry points because the three steps before the
+/// interesting one are identical and each has its own way of failing. `body`
+/// returning `Err` is reported here, once, in the one place that can also clear
+/// a pending Java exception — see [`report`].
+fn with_activity<T>(
+    app: &slint::android::AndroidApp,
+    doing: &str,
+    body: impl FnOnce(&mut JNIEnv, &JObject) -> JniResult<T>,
+) -> Option<T> {
+    let vm = match unsafe { JavaVM::from_raw(app.vm_as_ptr().cast()) } {
+        Ok(vm) => vm,
+        Err(e) => {
+            log::error!("no JVM handle, so {doing} is skipped: {e}");
+            return None;
+        }
+    };
+    // Cheap when the thread is already attached, which it is: the glue
+    // attached it before it called `android_main`. The guard exists for the
+    // case where it is not, and costs a lookup where it is.
+    let mut env = match vm.attach_current_thread() {
+        Ok(env) => env,
+        Err(e) => {
+            log::error!("cannot attach to the JVM, so {doing} is skipped: {e}");
+            return None;
+        }
+    };
+
+    // SAFETY: `activity_as_ptr` documents this as an unowned JNI *global*
+    // reference to the Activity, valid for as long as the `AndroidApp` it came
+    // from. `JObject` in jni 0.21 is a plain wrapper with no `Drop`, so
+    // borrowing it here cannot delete a reference this code does not own — the
+    // one way to get this wrong is `AutoLocal` or a `GlobalRef`, both of which
+    // would free it out from under android-activity.
+    let activity = unsafe { JObject::from_raw(app.activity_as_ptr().cast()) };
+
+    match body(&mut env, &activity) {
+        Ok(value) => Some(value),
+        Err(e) => {
+            report(&mut env, doing, &e);
+            None
+        }
+    }
+}
+
+/// Look an app class up through the *activity's* class loader.
+///
+/// `find_class` is the obvious call and the wrong one. JNI resolves a class
+/// against the loader belonging to the Java frame beneath the call, and on this
+/// thread there is no such frame: `android_main` runs on a thread the native
+/// glue created and attached itself, so the loader in scope is the system one.
+/// It knows every class in the platform and nothing at all from this APK, and
+/// says so as a `ClassNotFoundException` naming a class that is plainly in the
+/// dex — which reads as a broken build rather than as the wrong loader.
+///
+/// The activity is a Java object, so its loader is the app's.
+fn load_class<'local>(
+    env: &mut JNIEnv<'local>,
+    activity: &JObject,
+    name: &str,
+) -> JniResult<JClass<'local>> {
+    let loader = env
+        .call_method(activity, "getClassLoader", "()Ljava/lang/ClassLoader;", &[])?
+        .l()?;
+    let name = env.new_string(name)?;
+    let class = env
+        .call_method(
+            &loader,
+            "loadClass",
+            "(Ljava/lang/String;)Ljava/lang/Class;",
+            &[JValue::Object(&name)],
+        )?
+        .l()?;
+    Ok(JClass::from(class))
+}
+
+/// Log a JNI failure, and clear the exception behind it if there is one.
+///
+/// The clearing is not tidiness. A Java exception raised through JNI stays
+/// *pending* on the thread, and the next JNI call made while one is pending
+/// aborts the process — so a swallowed exception here would come back as a
+/// crash somewhere unrelated, most likely inside Slint. `exception_describe`
+/// first, because the trace it prints to logcat is the only place the Java
+/// class and line survive; `jni::errors::Error::JavaException` on its own says
+/// neither.
+fn report(env: &mut JNIEnv, doing: &str, e: &jni::errors::Error) {
+    log::error!("{doing} failed: {e}");
+    if let Ok(true) = env.exception_check() {
+        let _ = env.exception_describe();
+        let _ = env.exception_clear();
+    }
+}

apps/darkroom-android/src/lib.rs

@@ -6,8 +6,21 @@
 //! * There are no command-line paths. Android's SAF hands out document URIs,
 //!   not filesystem paths (ARCH §6.9), so the viewer opens with an empty
 //!   browsing list and the library grid is the only way in.
-//! * Logging goes to logcat. `env_logger` writes to stderr, which Android
-//!   discards.
+//! * Logging goes to logcat *and* to a file. `env_logger` writes to stderr,
+//!   which Android discards; logcat replaces it, and a rotating file beside it
+//!   replaces the thing logcat cannot be — a record that outlives the session
+//!   and can be sent to somebody (NFR-OPS-1, [`dr_plat::diagnostics`]).
+//!
+//! The first of those has one exception, and it is the launch `Intent`: a
+//! gallery, a file manager or the share sheet can name images to open, and
+//! those arrive as URIs on an `Intent` rather than as words on a command line.
+//! [`intents`] turns them into paths, and from there they are the same list
+//! the desktop builds from `argv` (FR-PLAT-AND-6).
+
+// The whole module is JNI against classes that exist only in the APK, so it
+// is gated with everything else that cannot compile off-device.
+#[cfg(target_os = "android")]
+mod intents;
 
 // `slint::android` exists only when compiling for Android, so the whole entry
 // point is gated on the target rather than on a feature. Without this the
@@ -18,22 +31,109 @@
 /// Android application entry point, called by android-activity's glue.
 #[no_mangle]
 fn android_main(app: slint::android::AndroidApp) {
-    android_logger::init_once(
+    // **The first statement in the process, and it has to be.** Everything
+    // between here and `install` returning runs with no logger installed at
+    // all: asking the activity for its external directory, `create_dir_all`
+    // and an `open` on a FUSE-backed volume the system may still be mounting.
+    // A failure or a stall in any of it is invisible on every surface there
+    // is — no file yet, and nothing in logcat either — which is precisely the
+    // kind of launch logcat exists to debug.
+    //
+    // `AndroidLogger` rather than `init_once`, so logcat can be *teed* rather
+    // than replaced: `init_once` installs itself as the global logger and
+    // there is only one of those. Everything that reached logcat before the
+    // file existed still reaches it, at the same level and under the same tag;
+    // the file is strictly additional.
+    let console = android_logger::AndroidLogger::new(
         android_logger::Config::default()
             .with_max_level(log::LevelFilter::Info)
             .with_tag("DarkRoom"),
     );
 
+    // Handed to the logger directly, and **not** written as `log::info!`,
+    // which here would compile and emit nothing: the facade's maximum level is
+    // `Off` until `diagnostics::install` sets it, and the macro tests that
+    // before it reaches any logger at all. This call skips the facade and
+    // reaches `__android_log_write` with nothing in between.
+    //
+    // That independence is the second reason for it. When the log is silent,
+    // this line is what says which half is at fault: present here and absent
+    // below means the `log` wiring, absent in both means liblog is not
+    // delivering this process's records — a question about the device, which
+    // no amount of reading this file can answer.
+    log::Log::log(
+        &console,
+        &log::Record::builder()
+            .level(log::Level::Info)
+            .target(module_path!())
+            .module_path(Some(module_path!()))
+            .args(format_args!(
+                "DarkRoom v{} starting; logcat only until the log file opens",
+                env!("CARGO_PKG_VERSION")
+            ))
+            .build(),
+    );
+
+    // Before the file logger, because it needs somewhere to write.
+    //
+    // **The external directory, not the internal one, and the difference is
+    // the entire point of the file.** Both are app-private and both survive
+    // backgrounding — the volatile one is the *cache* directory, which is not
+    // in play here. What separates them is retrieval:
+    // `/data/data/<pkg>/files` needs `run-as` against a debuggable build or
+    // root to read, and `/sdcard/Android/data/<pkg>/files` is a plain
+    // `adb pull` from any build, needing no permission since API 19. A log
+    // nobody can get off the device does not do the job NFR-OPS-1 describes.
+    //
+    // The consequence is that anyone holding the tablet can read it, which is
+    // why `dr_plat::diagnostics` redacts at the sink and why configuration —
+    // the account list, and the credential reference beside it — stays on
+    // `internal_data_path` below rather than moving here (NFR-SEC-2).
+    let external = app.external_data_path();
+    if let Some(dir) = external.clone().or_else(|| app.internal_data_path()) {
+        dr_plat::set_state_dir(dir);
+    }
+
+    let logging = dr_plat::diagnostics::install(Box::new(console), log::LevelFilter::Info);
+
     // Panics go to stderr, and Android discards stderr. Without this hook a
     // worker thread that panics is invisible: the process survives, the
     // channel it was writing to closes, and the UI reports only that
     // something "failed unexpectedly" with no way to find out what.
-    std::panic::set_hook(Box::new(|info| {
-        log::error!("panic: {info}");
-    }));
+    //
+    // This used to be one `log::error!` of the raw panic, which had two
+    // problems: logcat is a ring buffer that is gone by the time a user
+    // reports anything, and the raw message can carry a document URI naming
+    // their library or a credential a library interpolated into an error
+    // (NFR-SEC-2). `dr_plat::crash` writes a redacted record to disk and logs
+    // the redacted form. Nothing uploads it.
+    //
+    // Before `set_state_dir` on purpose: the hook resolves the directory when
+    // it fires, so installing it first covers the startup below rather than
+    // leaving it uncovered.
+    dr_plat::crash::install(env!("CARGO_PKG_VERSION"));
 
     log::info!("DarkRoom v{}", env!("CARGO_PKG_VERSION"));
 
+    // Said in logcat as well as in the file, because the first thing anybody
+    // asked for a log needs is where it is — and on a device that is a path
+    // nobody can guess and a command nobody remembers.
+    match &logging {
+        dr_plat::Installed::ToFile(path) => {
+            log::info!("logging to {}", path.display());
+            if external.is_none() {
+                log::warn!(
+                    "no external storage; the log is app-private and needs \
+                     `adb shell run-as paris.tourolle.darkroom cat files/darkroom.log` \
+                     on a debuggable build"
+                );
+            }
+        }
+        dr_plat::Installed::ConsoleOnly(why) => {
+            log::warn!("no log file this session, only logcat: {why}");
+        }
+    }
+
     // Before anything opens a store: Android has no $HOME and no XDG
     // directories, so the default guess resolves to a path the app cannot
     // write. Nothing failed loudly — the session list went to a doomed path, so
@@ -43,21 +143,460 @@ fn android_main(app: slint::android::AndroidApp) {
     match app.internal_data_path() {
         Some(dir) => {
             log::info!("data dir: {}", dir.display());
-            dr_sync_nextcloud::session::set_data_dir(dir);
+            // Crash records go beside the account data rather than under it:
+            // both are app-private and neither is a cache, which is the whole
+            // distinction that matters here (see `dr_plat::crash::state_dir`).
+            dr_plat::crash::set_state_dir(dir.join("state"));
+            dr_sync::account::set_data_dir(dir);
         }
         None => log::error!("no internal data path; settings will not persist"),
     }
 
-    if let Err(e) = slint::android::init(app) {
+    // After the data dir, because it writes beside the catalog. **Not** before
+    // the first frame any more — it starts a worker and returns; see the
+    // function for what it used to cost the launch.
+    install_bundled_models(app.clone());
+
+    // Before `init_with_event_listener`, which takes `app` by value and is the
+    // last moment anything can ask the activity a question. Not an ordering
+    // preference — after that line there is no `app` left to read the Intent
+    // through.
+    let opened_with = intents::launch_images(&app);
+
+    // TRACES: FR-PLAT-AND-5
+    // The listener is the whole reason this is not the one-line
+    // `slint::android::init(app)`. Slint owns the event loop on Android, so
+    // the platform's lifecycle and memory events reach the application only if
+    // it asks for them here — and it must ask *before* the loop starts, which
+    // is why this sits between the data directory and `dr_ui::run`.
+    //
+    // The listener runs inside `poll_events`, on the same thread the event
+    // loop and every interface cache live on, which is what lets
+    // `dr_ui::memory` be a thread-local registry of plain `Fn()` rather than a
+    // cross-thread channel (see its module documentation).
+    //
+    // # Why two events and not eight
+    //
+    // FR-PLAT-AND-5 names `onTrimMemory`, whose `TRIM_MEMORY_*` levels grade
+    // how badly the system wants the memory back. Those levels do not exist
+    // here: `ComponentCallbacks2` is a Java interface implemented by an
+    // `Activity` or `Application`, and this app has neither — it is a bare
+    // `NativeActivity`, whose native callback table offers only the ungraded
+    // `onLowMemory`. android-activity surfaces exactly that as `LowMemory`.
+    // Reading the grades would mean shipping a Java subclass to forward them,
+    // which is a distribution-manifest change and not this one.
+    //
+    // `Stop` recovers the one grade that matters most anyway, and for free.
+    // It is the moment the activity stops being visible — `TRIM_MEMORY_UI_HIDDEN`
+    // in all but name — and it is the cheapest possible time to give memory
+    // back, because nothing that is freed has to be drawn again before anyone
+    // sees it. `Pause` deliberately does not qualify: a permission dialog or
+    // the share sheet pauses an activity that is still on screen behind it,
+    // and throwing away its render pipeline would make every such interruption
+    // cost a full re-render.
+    use slint::android::android_activity::{MainEvent, PollEvent};
+    if let Err(e) = slint::android::init_with_event_listener(app, |event| match event {
+        PollEvent::Main(MainEvent::LowMemory) => {
+            dr_ui::memory::relieve(dr_ui::memory::Level::Critical);
+        }
+        PollEvent::Main(MainEvent::Stop) => {
+            dr_ui::memory::relieve(dr_ui::memory::Level::UiHidden);
+        }
+        _ => {}
+    }) {
         log::error!("Slint Android backend failed to initialise: {e}");
         return;
     }
 
-    // Empty rather than the desktop's argv: see the module note above.
+    // The launch Intent's images, where there were any, standing in for the
+    // desktop's argv — `launch::startup_action` treats a non-empty list as
+    // "the user asked for these specifically", which is exactly what a share
+    // or a tap in a gallery is. Empty for an ordinary launch, and the library
+    // opens as before.
     //
     // Returning from `android_main` ends the process, so a failure here is
     // logged rather than propagated — there is no shell to show `Err` to.
-    if let Err(e) = dr_ui::run(Vec::new()) {
+    if let Err(e) = dr_ui::run(opened_with) {
         log::error!("DarkRoom exited with error: {e:#}");
     }
 }
+
+/// Unpack the models the APK carries, if it carries any.
+///
+/// # Why Android needs this and no other platform does
+///
+/// A desktop build reads its models from a path — the account's directory, the
+/// shared one, or `$XDG_DATA_DIRS` where a package put them. **Android has no
+/// such path.** `internal_data_path` is app-private, `run-as` needs a
+/// debuggable build, and an asset inside a package is not a path anything can
+/// open (ARCH §6.9), so a phone had no way to reach a model at all.
+///
+/// So the APK carries them in `assets/models/` and this copies them out, once,
+/// into the same shared directory a desktop install uses. After that every
+/// lookup in `dr_ui::library` finds them exactly where it finds a desktop
+/// user's.
+///
+/// # The two sets are not the same kind of thing
+///
+/// **Face weights are absent from the repository by design.** The InsightFace
+/// grant is research-only and incompatible with this project's licence
+/// (docs/dev/faces.md §2), so a desktop user fetches them, runs
+/// `tools/fix-face-model-shapes.sh` over them, and drops the result in. A build
+/// that carries none is the ordinary case and face indexing simply stays off.
+///
+/// **The scene model is committed** (AGPL, compatible — `models/LICENCE.md`),
+/// so a build carrying none means a checkout without `git lfs pull` rather than
+/// a deliberate omission. It is still not an error here: the scene tab reports
+/// itself unavailable the same way face indexing does, because a photo editor
+/// that refuses to start over a missing grading feature is worse than one that
+/// starts without it.
+///
+/// # Why it is not `include_bytes!` like the instance model
+///
+/// Size. The instance model is 11 MB and compiled in; the scene model is 24 MB
+/// on top of that, and a 35 MB constant in the binary is paid by every install
+/// whether or not the tab is opened. Assets are also *stored* rather than
+/// deflated in the APK (see `assemble-apk.sh`), so unpacking is a copy rather
+/// than an inflate.
+///
+/// # Why it returns before it has done anything
+///
+/// **`android_main` runs with the input channel unserviced.** Nothing drains
+/// it until Slint reaches `poll_events`, and Slint does not reach `poll_events`
+/// until `dr_ui::run` calls `window.run()`, which is the last line of it. So
+/// every millisecond spent between the top of `android_main` and that line is a
+/// millisecond in which Android's input dispatcher gets no answer, and five
+/// thousand of them is an ANR by definition — the system puts "DarkRoom isn't
+/// responding" over a window that has never painted, and offers to kill it.
+///
+/// This copied **41 MB** on the first launch after an install: 24.9 MB of scene
+/// model, 13.6 MB of embedder, 2.5 MB of detector, each read whole out of the
+/// APK and written to `/data`. v0.10.0 added the scene model, which was 60% of
+/// that total; v0.10.0 is the release the ANR appeared in, and the 8,010 minor
+/// faults in its report are what 41 MB of freshly touched pages looks like.
+/// The two further detectors the settings page offers since have made it
+/// 61 MB, which is the same argument with a larger number.
+///
+/// So it runs on a worker (NFR-ARCH-1: nothing blocking on the UI executor) and
+/// this function returns as soon as the thread is running. Nothing on the
+/// launch path waits for it, and no other startup step needs its result.
+///
+/// # The window in which a model looks absent, and why that is honest enough
+///
+/// Until the copy finishes, `library::face_models` and `library::scene_model`
+/// answer `is_file()` about files that are not written yet, so both report
+/// their feature unavailable — the same answer they give a build carrying no
+/// weights at all, which is the ordinary case this whole path was written
+/// around. It is briefly pessimistic rather than wrong, it lasts about as long
+/// as it takes to read one screenful of the grid, and the temporary name
+/// [`unpack_bundled_models`] writes under is what stops it being worse than
+/// pessimistic: a lookup never sees a half-written file, only an absent one.
+#[cfg(target_os = "android")]
+fn install_bundled_models(app: slint::android::AndroidApp) {
+    // Detached rather than joined: there is no later moment on the launch path
+    // that wants the answer, and a handle nobody joins is a handle nobody can
+    // forget to. `AndroidApp` is documented `Send` and `Sync` and is an `Arc`
+    // internally, so the clone costs a refcount; `asset_manager` is asked for
+    // on the worker because `AAssetManager` is thread-safe by contract and
+    // reading the pointer takes only the app's read lock, which `poll_events`
+    // also only ever holds shared.
+    std::thread::spawn(move || unpack_bundled_models(&app));
+}
+
+/// The copy itself, on the worker [`install_bundled_models`] starts.
+#[cfg(target_os = "android")]
+fn unpack_bundled_models(app: &slint::android::AndroidApp) {
+    use std::io::Read;
+
+    let started = std::time::Instant::now();
+
+    // The face names are the **shape-fixed** exports, matching what
+    // `library::face_models` looks for: tract cannot parse either InsightFace
+    // graph with its dynamic input dimension, so what ships here has already
+    // been through `tools/fix-face-model-shapes.sh`.
+    //
+    // The scene entries are three files rather than one because the graph alone
+    // decodes to 150 anonymous channels — `library::scene_model` wants the
+    // vocabulary and the category descriptor beside it, and requires all three
+    // before it reports the tab available.
+    //
+    // Three detectors, because which one runs is a setting
+    // (`FaceDetector`, docs/dev/faces.md §12.3) and a tablet has no other way to
+    // obtain the one it was not shipped with. Twenty megabytes of APK for
+    // the choice; the embedder is the same for all three.
+    //
+    // Then the three eye-state models (docs/dev/faces.md §17): landmarks, open
+    // or closed, sunglasses. The app indexes without them; with them the
+    // eyes-open filter has something to read, and a tablet has no other way
+    // to get them either.
+    //
+    // The int8 forms beside the three detectors are what the Hexagon runs
+    // (docs/dev/inference.md §5); the engine loads the sibling when the probe
+    // chose that rung and ignores it otherwise.
+    const BUNDLED: [(&std::ffi::CStr, &str); 14] = [
+        (c"models/scrfd_500m_640.onnx", "scrfd_500m_640.onnx"),
+        (
+            c"models/scrfd_500m_640.int8.onnx",
+            "scrfd_500m_640.int8.onnx",
+        ),
+        (c"models/scrfd_2.5g_640.onnx", "scrfd_2.5g_640.onnx"),
+        (
+            c"models/scrfd_2.5g_640.int8.onnx",
+            "scrfd_2.5g_640.int8.onnx",
+        ),
+        (c"models/scrfd_10g_640.onnx", "scrfd_10g_640.onnx"),
+        (c"models/scrfd_10g_640.int8.onnx", "scrfd_10g_640.int8.onnx"),
+        (c"models/arcface_mbf_b1.onnx", "arcface_mbf_b1.onnx"),
+        (c"models/2d106det_b1.onnx", "2d106det_b1.onnx"),
+        (c"models/ocec_s_b1.onnx", "ocec_s_b1.onnx"),
+        (c"models/sgc_l_48_b1.onnx", "sgc_l_48_b1.onnx"),
+        (c"models/yolo26s-sem-ade20k.onnx", "yolo26s-sem-ade20k.onnx"),
+        (
+            c"models/yolo26s-sem-ade20k.classes.json",
+            "yolo26s-sem-ade20k.classes.json",
+        ),
+        (c"models/categories.txt", "categories.txt"),
+        // The panorama border filler (FR-MRG-4); MIT, 28 MB.
+        (c"models/migan-512.onnx", "migan-512.onnx"),
+    ];
+
+    let dir = dr_ui::shared_face_models_dir();
+    let assets = app.asset_manager();
+    let mut copied = 0u64;
+
+    for (asset_path, name) in BUNDLED {
+        let dest = dir.join(name);
+        // Already unpacked. Not re-read on every launch: this is 73 MB of
+        // copying across the ten entries, and the file does not change without
+        // the APK changing, at which point the install wiped it anyway. It
+        // matters more now than it did — a launch that skips every entry here
+        // costs nothing at all, which is what makes the second launch after an
+        // install cheap even though the first one is not.
+        if dest.is_file() {
+            continue;
+        }
+        let Some(mut asset) = assets.open(asset_path) else {
+            log::info!("no bundled {name} in this APK; the feature needing it stays off");
+            continue;
+        };
+        let mut bytes = Vec::new();
+        if let Err(e) = asset.read_to_end(&mut bytes) {
+            log::error!("bundled {name} could not be read: {e}");
+            continue;
+        }
+        if let Err(e) = std::fs::create_dir_all(&dir) {
+            log::error!("cannot create {}: {e}", dir.display());
+            return;
+        }
+        // Written under a temporary name and renamed, because
+        // `library::face_models` and `library::scene_model` both decide a
+        // feature is available on `is_file()` alone. A truncated write — the process backgrounded and
+        // killed mid-copy — would otherwise leave a file that passes that test
+        // and fails inside tract, reported to the user as a broken model rather
+        // than a missing one.
+        let part = dir.join(format!("{name}.part"));
+        match std::fs::write(&part, &bytes).and_then(|()| std::fs::rename(&part, &dest)) {
+            Ok(()) => {
+                copied += bytes.len() as u64;
+                log::info!("installed bundled {name} ({} bytes)", bytes.len());
+            }
+            Err(e) => {
+                log::error!("cannot install {name}: {e}");
+                let _ = std::fs::remove_file(&part);
+            }
+        }
+    }
+
+    // The figure this whole function is about. Said even when it is zero, so a
+    // launch that ANRs anyway can be told apart from one that spent its six
+    // seconds here — on a second launch there is nothing left to copy and the
+    // line reads `0 bytes`.
+    log::info!(
+        "bundled models ready: {copied} bytes copied in {} ms",
+        started.elapsed().as_millis()
+    );
+
+    // Now, and not at launch: the probe fingerprints the model files, and
+    // on a first launch they were not on disk until this line. The runtime
+    // is in the APK's native library directory beside `libdarkroom.so`,
+    // which is also where Qualcomm's DSP loader has to be pointed for the
+    // Hexagon skel (docs/dev/inference.md §3, §8).
+    dr_ui::inference::init(native_library_dir().into_iter().collect());
+}
+
+/// The directory the system unpacked this APK's native libraries into.
+///
+/// Read from where the loader put *this* library rather than asked of the
+/// activity: `android-activity` does not expose `nativeLibraryDir`, and the
+/// answer is in `/proc/self/maps` for free.
+#[cfg(target_os = "android")]
+fn native_library_dir() -> Option<std::path::PathBuf> {
+    let maps = std::fs::read_to_string("/proc/self/maps").ok()?;
+    maps.lines()
+        .filter_map(|l| l.split_whitespace().nth(5))
+        .find(|p| p.ends_with("/libdarkroom.so"))
+        .and_then(|p| std::path::Path::new(p).parent().map(Into::into))
+}
+
+/// TRACES: FR-PLAT-AND-6
+/// The declarations that make this app a receiver, held to on the host.
+///
+/// Everything FR-PLAT-AND-6 does on a device is unreachable from `cargo test`:
+/// there is no `Intent` off-device and no `ContentProvider` to instantiate. But
+/// the requirement is not only behaviour — half of it is *declaration*, and a
+/// declaration can be wrong in ways that compile perfectly and fail silently.
+/// An intent filter that is deleted takes the app out of every gallery's "open
+/// with" menu with nothing to notice; an authority that stops matching the
+/// class it names raises a `SecurityException` in whichever other app opened
+/// the share sheet, which is the last place anybody would look for it.
+///
+/// The manifest is read by aapt2 and the Java by javac, so a Rust build sees
+/// neither. `include_str!` is what puts them where a test can reach them, and
+/// this is the only place in the workspace that does.
+#[cfg(test)]
+mod tests {
+    /// The manifest with its comments removed and its whitespace flattened, so
+    /// a match is about the declaration and not about how it is indented.
+    fn manifest() -> String {
+        let xml = include_str!("../android/AndroidManifest.xml");
+        let mut out = String::with_capacity(xml.len());
+        let mut rest = xml;
+        // Comments first, and not by regex over the whole file: several of them
+        // quote the very attribute names the assertions below look for, so a
+        // test that read them would pass on the strength of the prose
+        // explaining an entry that had been deleted.
+        while let Some(start) = rest.find("<!--") {
+            out.push_str(&rest[..start]);
+            match rest[start..].find("-->") {
+                Some(end) => rest = &rest[start + end + 3..],
+                None => {
+                    rest = "";
+                    break;
+                }
+            }
+        }
+        out.push_str(rest);
+        out.split_whitespace().collect::<Vec<_>>().join(" ")
+    }
+
+    /// The body of each `<intent-filter>`, so an action and a MIME type are
+    /// checked to be in the *same* filter. Two filters, one naming the action
+    /// and one naming the type, register for neither.
+    fn intent_filters(manifest: &str) -> Vec<&str> {
+        manifest
+            .split("<intent-filter>")
+            .skip(1)
+            .filter_map(|filter| filter.split("</intent-filter>").next())
+            .collect()
+    }
+
+    /// The single `<provider>` element, attributes and all.
+    fn provider(manifest: &str) -> String {
+        let start = manifest
+            .find("<provider")
+            .expect("no <provider> in the manifest");
+        let rest = &manifest[start..];
+        let end = rest.find("/>").expect("unterminated <provider> element");
+        rest[..end + 2].to_string()
+    }
+
+    fn attribute(element: &str, name: &str) -> Option<String> {
+        let key = format!("{name}=\"");
+        let start = element.find(&key)? + key.len();
+        let value = element[start..].split('"').next()?;
+        Some(value.to_string())
+    }
+
+    #[test]
+    fn a_gallery_can_open_a_photograph_in_this_app() {
+        let manifest = manifest();
+        let registered = intent_filters(&manifest).iter().any(|filter| {
+            filter.contains("android.intent.action.VIEW")
+                && filter.contains("android.intent.category.DEFAULT")
+                && filter.contains(r#"android:mimeType="image/*""#)
+        });
+        assert!(
+            registered,
+            "no VIEW filter for image/*: nothing will offer DarkRoom for a photograph"
+        );
+    }
+
+    #[test]
+    fn the_share_sheet_can_send_one_image_or_several() {
+        let manifest = manifest();
+        let registered = intent_filters(&manifest).iter().any(|filter| {
+            // The closing quote matters: SEND is a prefix of SEND_MULTIPLE, so
+            // a bare substring test passes on a filter that declares only the
+            // second and would not be offered for a single photograph.
+            filter.contains(r#"android.intent.action.SEND""#)
+                && filter.contains(r#"android.intent.action.SEND_MULTIPLE""#)
+                && filter.contains("android.intent.category.DEFAULT")
+                && filter.contains(r#"android:mimeType="image/*""#)
+        });
+        assert!(
+            registered,
+            "no SEND/SEND_MULTIPLE filter for image/*, so the share sheet will not list DarkRoom"
+        );
+    }
+
+    #[test]
+    fn one_activity_ever_so_a_second_launch_cannot_start_a_second_one() {
+        // Not style. Another app can now launch this activity while it is
+        // already running, and the default launch mode answers that by
+        // creating a second NativeActivity in this process — a second
+        // android_main, a second Slint backend, a second wgpu device.
+        assert!(
+            manifest().contains(r#"android:launchMode="singleTask""#),
+            "the activity must be singleTask; see the manifest comment"
+        );
+    }
+
+    #[test]
+    fn the_provider_authority_is_the_one_the_class_answers_to() {
+        let manifest = manifest();
+        let element = provider(&manifest);
+
+        let declared =
+            attribute(&element, "android:authorities").expect("the provider declares no authority");
+        let java = include_str!("../android/java/paris/tourolle/darkroom/ExportProvider.java");
+        let constant = java
+            .split("AUTHORITY = \"")
+            .nth(1)
+            .and_then(|rest| rest.split('"').next())
+            .expect("ExportProvider declares no AUTHORITY constant");
+
+        assert_eq!(
+            declared, constant,
+            "the manifest and ExportProvider disagree about the authority; \
+             a share would fail as a SecurityException inside the receiving app"
+        );
+
+        let class = attribute(&element, "android:name").expect("the provider declares no class");
+        let (package, _) = class
+            .rsplit_once('.')
+            .expect("the provider class is unqualified");
+        assert!(
+            java.contains(&format!("package {package};")),
+            "the manifest names {class}, which is not the class in ExportProvider.java"
+        );
+    }
+
+    #[test]
+    fn the_provider_hands_out_one_file_at_a_time_and_nothing_by_itself() {
+        let manifest = manifest();
+        let element = provider(&manifest);
+        // The two halves are not redundant. Without the grant, every share
+        // target fails; exported, every app on the device could read this
+        // app's private directory.
+        assert_eq!(
+            attribute(&element, "android:exported").as_deref(),
+            Some("false"),
+            "an exported provider would serve the app's private directory to anything installed"
+        );
+        assert_eq!(
+            attribute(&element, "android:grantUriPermissions").as_deref(),
+            Some("true"),
+            "without URI grants the share sheet opens and every target fails to read the file"
+        );
+    }
+}

apps/darkroom-desktop/Cargo.toml

@@ -6,10 +6,22 @@ rust-version.workspace = true
 license.workspace = true
 
 [dependencies]
-dr-ui.workspace = true
+dr-ui = { workspace = true, features = ["scene-model"] }
+# For the panic hook and the log sink, directly rather than through dr-ui:
+# both have to be installed before `dr_ui::run`, because a panic during startup
+# is exactly the one they exist to catch and record (NFR-OPS-1, NFR-OPS-2).
+dr-plat.workspace = true
 anyhow.workspace = true
 env_logger.workspace = true
 log.workspace = true
 
+# The Windows resource block — icon and version — compiled in by build.rs.
+# Unconditional rather than under `[target.'cfg(windows)']`, because a cfg on
+# a build-dependency is evaluated against the *host* — the machine running
+# the build script — and this is built for Windows from Linux. The script
+# itself returns before touching the crate on every other target.
+[build-dependencies]
+winresource = "0.1"
+
 [features]
 default = []

apps/darkroom-desktop/build.rs

@@ -0,0 +1,58 @@
+//! TRACES: FR-PLAT-WIN-2
+//! The Windows resource block: icon and version, compiled into the executable.
+//!
+//! Windows takes an application's icon and its "Details" tab from a resource
+//! inside the `.exe`, not from a `.desktop` file, so without this the installed
+//! program shows the generic executable icon in Explorer, the Start Menu and
+//! the taskbar, and reports no version. Nothing here runs for any other
+//! target: the whole body is behind the target-OS check, and the crate that
+//! does the work is a build-dependency only.
+//!
+//! The icon is the same PNG every other platform uses, wrapped into an `.ico`
+//! in `OUT_DIR` rather than committed: an ICO entry may *be* a PNG (Vista and
+//! later read them directly), so the wrapper is a 22-byte header and the
+//! file's bytes, and a generated binary stays out of the tree.
+
+use std::io::Write as _;
+use std::path::PathBuf;
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
+    }
+
+    let png = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("../../ui/dr-ui/ui/app-icon.png");
+    println!("cargo:rerun-if-changed={}", png.display());
+    let bytes = std::fs::read(&png).expect("read app-icon.png");
+    let ico = PathBuf::from(std::env::var("OUT_DIR").unwrap()).join("darkroom.ico");
+    write_png_ico(&ico, &bytes, 256).expect("write darkroom.ico");
+
+    let mut res = winresource::WindowsResource::new();
+    res.set_icon(ico.to_str().unwrap());
+    res.set("ProductName", "DarkRoom");
+    res.set("FileDescription", "DarkRoom");
+    res.set("LegalCopyright", "GPL-3.0-or-later");
+    // Cross-compiling: `winresource` looks for a `windres` for the target and
+    // the Windows image names it explicitly, for the same reason the Android
+    // image names its linkers.
+    if let Ok(windres) = std::env::var("WINDRES") {
+        res.set_windres_path(&windres);
+    }
+    res.compile().expect("compile the Windows resource block");
+}
+
+/// One PNG image as an `.ico`. `edge` is the PNG's width and height; 256 is
+/// written as 0 per the format.
+fn write_png_ico(path: &std::path::Path, png: &[u8], edge: u32) -> std::io::Result<()> {
+    let mut f = std::fs::File::create(path)?;
+    let dim = if edge >= 256 { 0u8 } else { edge as u8 };
+    // ICONDIR: reserved, type 1 (icon), one image.
+    f.write_all(&[0, 0, 1, 0, 1, 0])?;
+    // ICONDIRENTRY: width, height, palette 0, reserved, planes 1, bpp 32,
+    // byte length, offset (6 + 16).
+    f.write_all(&[dim, dim, 0, 0, 1, 0, 32, 0])?;
+    f.write_all(&(png.len() as u32).to_le_bytes())?;
+    f.write_all(&22u32.to_le_bytes())?;
+    f.write_all(png)
+}

apps/darkroom-desktop/src/main.rs

@@ -1,21 +1,113 @@
 //! DarkRoom desktop entry point.
 //!
 //!   darkroom-desktop <file-or-directory>...
+//!   darkroom-desktop --version
+
+// TRACES: FR-PLAT-WIN-2
+// A GUI-subsystem executable, or Windows opens a console window behind the
+// application for the life of the process. Release only: the console is where
+// the log goes when there is no file, and a debug build is run from one.
+// `--version` still prints under this — stdout is simply not attached when
+// launched from Explorer, which is not where anyone asks for a version.
+#![cfg_attr(all(windows, not(debug_assertions)), windows_subsystem = "windows")]
 
 use std::path::PathBuf;
 
+use dr_plat::diagnostics::Installed;
+
 fn main() -> anyhow::Result<()> {
-    env_logger::Builder::from_env(env_logger::Env::default().default_filter_or(
+    // TRACES: FR-PLAT-WIN-3
+    // Before the logger, the crash hook and everything else: this exists so a
+    // build made on a machine that cannot run the application — the Linux CI
+    // producing the Windows binary, checked under Wine — has an exit that
+    // proves the executable starts without opening a window or touching the
+    // user's directories (docs/dev/windows.md §6).
+    if std::env::args().nth(1).as_deref() == Some("--version") {
+        println!("darkroom-desktop {}", env!("CARGO_PKG_VERSION"));
+        return Ok(());
+    }
+
+    // Built rather than `init`ed, so the same logger can be handed to the
+    // diagnostics tee: `env_logger` keeps writing to stderr exactly as before,
+    // and every record it accepts is also appended to the on-disk log
+    // (NFR-OPS-1). `filter()` is asked afterwards because the environment may
+    // have overridden the default below, and the file must not be quieter than
+    // the terminal.
+    let console = env_logger::Builder::from_env(env_logger::Env::default().default_filter_or(
         "info,wgpu_core=warn,wgpu_hal=warn,zbus=warn,tracing=warn,calloop=warn,rawler=warn",
     ))
-    .init();
+    .build();
+    let level = console.filter();
+    let logging = dr_plat::diagnostics::install(Box::new(console), level);
+
+    // Immediately after the logger and before anything that could fail. Until
+    // now a panic on desktop went to stderr and died with the terminal, which
+    // means every panic a user has ever hit was unreportable: the process
+    // survives (the panicking worker does not), a control goes dead, and there
+    // is nothing on disk to say why. The record is local and stays local —
+    // there is no upload path, by design; see `dr_plat::crash`.
+    dr_plat::crash::install(env!("CARGO_PKG_VERSION"));
 
     log::info!("DarkRoom v{}", env!("CARGO_PKG_VERSION"));
+    // First thing in the file, so a user asked for "the log" can find it
+    // without being told a path over the phone.
+    match &logging {
+        Installed::ToFile(path) => log::info!("logging to {}", path.display()),
+        Installed::ConsoleOnly(why) => log::warn!("no log file this session: {why}"),
+    }
 
     let paths: Vec<PathBuf> = std::env::args().skip(1).map(PathBuf::from).collect();
     if paths.is_empty() {
         eprintln!("usage: darkroom-desktop <file-or-directory>...");
     }
 
-    dr_ui::run(paths)
+    // Before the window: the probe runs on its own thread and the first
+    // frame does not wait for it, but the models a background job asks for
+    // should already know where the runtime is (docs/dev/inference.md §4).
+    dr_ui::inference::init(runtime_dirs());
+
+    dr_ui::run(paths)?;
+
+    // Skip Rust's normal static/thread-local teardown on the way out: a
+    // background zbus/keyring connection opened by dr_ui::launch_ui can
+    // still be alive here, and unwinding through it races its async-io
+    // reactor thread, panicking with "thread local ... during or after
+    // destruction" when the window is closed.
+    std::process::exit(0);
+}
+
+/// Where a desktop package may have put `libonnxruntime`, most specific
+/// first. None of these existing is the tract build, which is a complete
+/// application and not an error (docs/dev/inference.md §3).
+///
+/// `DARKROOM_ORT_DIR` is for a developer pointing at a runtime that is not
+/// installed — the wheel's `capi` directory, say. Then beside the executable
+/// and in the package's private library directory, for a package that
+/// bundles its own; then the user's own `runtime/` beside the models, where
+/// `tools/fetch-desktop-runtime.sh` puts one; then the Flatpak prefix; then
+/// the system library directory, for a distribution that ships ONNX Runtime
+/// as a package of its own. The user's copy outranks the system's because
+/// the system's is the one most likely to be built without the GPU
+/// providers, or against the wrong cuDNN — and a system copy whose providers
+/// do not load is not a problem, only a slower app: the probe builds a real
+/// session before believing a provider.
+fn runtime_dirs() -> Vec<PathBuf> {
+    let mut dirs = Vec::new();
+    if let Some(dir) = std::env::var_os("DARKROOM_ORT_DIR") {
+        dirs.push(PathBuf::from(dir));
+    }
+    if let Ok(exe) = std::env::current_exe() {
+        if let Some(bin) = exe.parent() {
+            dirs.push(bin.to_path_buf());
+            dirs.push(bin.join("../lib/darkroom"));
+        }
+    }
+    dirs.push(dr_ui::inference::user_runtime_dir());
+    #[cfg(target_os = "linux")]
+    dirs.extend([
+        PathBuf::from("/app/lib/darkroom"),
+        PathBuf::from("/usr/lib/darkroom"),
+        PathBuf::from("/usr/lib"),
+    ]);
+    dirs
 }

core/dr-catalog/Cargo.toml

@@ -7,6 +7,15 @@ license.workspace = true
 
 [dependencies]
 dr-types.workspace = true
+# The face subsystem's arithmetic — `Calibration` in particular, so the sigmoid
+# that turns a cosine into a probability has exactly one definition. Default
+# features are off, so this brings in no ONNX runtime and no weights: only the
+# model-free half compiles here.
+dr-face.workspace = true
+# For `SHARD_MAX_BYTES` alone. The face shards are capped at the same 25 MB the
+# thumbnail shards are, and sharing the constant is what keeps them from
+# drifting apart — the cap is a statement about sync cost, not about thumbnails.
+dr-thumbs.workspace = true
 # The `Storage` trait, and nothing else from it. A scan has to read a real
 # directory, and this is how `core/` reaches the platform without a
 # `#[cfg(target_os)]` of its own (ARCH §4.1: calls go downward).

core/dr-catalog/examples/face_confidence.rs

@@ -0,0 +1,420 @@
+//! What the suggestion confidence would say about a real library.
+//!
+//!   cargo run --release -p dr-catalog --example face_confidence -- CATALOG.sqlite [--full]
+//!
+//! Read-only: it writes nothing to the catalog, so it can be pointed at a copy
+//! of a live library and re-run at will.
+//!
+//! # What it measures
+//!
+//! The user's own confirmations are the only ground truth a library has, so
+//! the evaluation is leave-one-out over them: hide one confirmed face, ask the
+//! scorer which of the confirmed identities it belongs to, and compare with
+//! what the user said. Faces from the same photograph are excluded exactly as
+//! the clusterer excludes them, so nothing is scored against a co-occurrence
+//! that would never have been allowed to merge.
+//!
+//! Two numbers are compared on that task: the share (`dr_face::assign`) and the
+//! mean-within-group figure it replaced. Accuracy says which one picks the
+//! right person; the reliability table says whether the percentage the user is
+//! shown means what it claims — which is the question FR-CULL-9 exists for.
+
+use std::collections::HashMap;
+
+use dr_catalog::faces::{self, PersonId};
+use dr_catalog::Catalog;
+
+const MODEL_ID: &str = "w600k_mbf";
+const TOP: usize = 10;
+
+struct Known {
+    image: u64,
+    person: PersonId,
+    embedding: Vec<f32>,
+    crop_px: f32,
+}
+
+/// What the catalog holds per face, decoded: photograph, vector, size,
+/// quality.
+type Decoded = (u64, Vec<f32>, f32, Option<f32>);
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let Some(path) = args.first() else {
+        eprintln!("usage: face_confidence CATALOG.sqlite [--full]");
+        std::process::exit(2);
+    };
+
+    let catalog = Catalog::open(std::path::Path::new(path)).expect("open catalog");
+    let conn = catalog.connection();
+
+    let cal = match faces::calibration(conn, MODEL_ID) {
+        Ok(Some((c, _))) => c,
+        _ => dr_face::Calibration::default(),
+    };
+    println!(
+        "calibration: a={:.2} b={:.2} w_size={:.3} valid={} (P=0.5 at cosine {:.3})",
+        cal.a,
+        cal.b,
+        cal.w_size,
+        cal.valid,
+        cal.boundary_at(0.5, 150.0, 0.0)
+    );
+
+    let model = dr_face::ModelId::new(MODEL_ID.to_string());
+    let stored = faces::embeddings(conn, MODEL_ID).expect("embeddings");
+    let mut embedding_of: HashMap<faces::FaceId, Decoded> = HashMap::new();
+    for f in stored {
+        if let Some(e) = dr_face::Embedding::from_f16_bytes(model.clone(), &f.embedding) {
+            embedding_of.insert(f.face, (f.image.0, e.v.to_vec(), f.crop_px, f.quality));
+        }
+    }
+    println!("faces with embeddings: {}", embedding_of.len());
+
+    // The ground truth: every confirmed face, under the person the user put it
+    // on. Identities with a single confirmation are dropped — leaving one out
+    // leaves that identity with no evidence at all, so they measure nothing.
+    let people = faces::people(conn).expect("people");
+    let mut known: Vec<Known> = Vec::new();
+    let mut identities = 0usize;
+    for p in &people {
+        if p.confirmed_faces < 2 {
+            continue;
+        }
+        let mut mine = Vec::new();
+        for f in faces::for_person(conn, p.id, false).expect("faces") {
+            if !f.confirmed {
+                continue;
+            }
+            if let Some((image, embedding, crop_px, _)) = embedding_of.get(&f.id) {
+                mine.push(Known {
+                    image: *image,
+                    person: p.id,
+                    embedding: embedding.clone(),
+                    crop_px: *crop_px,
+                });
+            }
+        }
+        if mine.len() >= 2 {
+            identities += 1;
+            known.extend(mine);
+        }
+    }
+    println!(
+        "ground truth: {} confirmed faces across {identities} identities\n",
+        known.len()
+    );
+    if known.len() < 2 {
+        println!("not enough confirmations to evaluate.");
+        return;
+    }
+
+    let mut share_right = 0usize;
+    let mut mean_right = 0usize;
+    // (share of the winner, was the winner correct)
+    let mut reliability: Vec<(f32, bool)> = Vec::with_capacity(known.len());
+    // What each scorer would have *displayed* for the correct answer.
+    let mut shown_share = Vec::with_capacity(known.len());
+    let mut shown_mean = Vec::with_capacity(known.len());
+
+    for (i, me) in known.iter().enumerate() {
+        let mut per_person: HashMap<PersonId, Vec<f32>> = HashMap::new();
+        // The mean baseline is the old code's, which had no floor: it averaged
+        // over every member of the group.
+        let mut all_person: HashMap<PersonId, Vec<f32>> = HashMap::new();
+        for (j, them) in known.iter().enumerate() {
+            if i == j || me.image == them.image {
+                continue;
+            }
+            let cos: f32 = me
+                .embedding
+                .iter()
+                .zip(&them.embedding)
+                .map(|(a, b)| a * b)
+                .sum();
+            // The floor the real scorer sees: `cluster_scored` scans at
+            // `RIVAL_FLOOR` and `identity_shares` never learns about a pair
+            // below it. Summing the near-orthogonal ones here instead of
+            // dropping them is not a stricter test, it is a different
+            // function — fifty identities contributing their *upper tail* of
+            // noise outweigh one contributing a real match.
+            let probability = cal.probability(cos, me.crop_px.min(them.crop_px), 0.0);
+            if probability >= dr_face::RIVAL_FLOOR {
+                per_person.entry(them.person).or_default().push(probability);
+            }
+            all_person.entry(them.person).or_default().push(probability);
+        }
+
+        // The share: sum of the best TOP matches per identity, normalised.
+        // Evidence, and the coherence that goes with it: the sum of the best
+        // TOP matches, and their mean. dr_face::assign shows the product of
+        // that mean and the identity's share of the total.
+        let mut evidence: Vec<(PersonId, f32, f32)> = per_person
+            .iter()
+            .map(|(&p, probabilities)| {
+                let mut v = probabilities.clone();
+                v.sort_by(|a, b| b.total_cmp(a));
+                let counted = v.len().min(TOP);
+                let sum = v.iter().take(TOP).sum::<f32>();
+                (p, sum, sum / counted as f32)
+            })
+            .collect();
+        let total: f32 = evidence.iter().map(|(_, s, _)| *s).sum();
+        evidence.sort_by(|a, b| b.1.total_cmp(&a.1));
+
+        // The number it replaced: the mean over every member of the identity.
+        let mut means: Vec<(PersonId, f32)> = all_person
+            .iter()
+            .map(|(&p, probabilities)| {
+                (
+                    p,
+                    probabilities.iter().sum::<f32>() / probabilities.len() as f32,
+                )
+            })
+            .collect();
+        means.sort_by(|a, b| b.1.total_cmp(&a.1));
+
+        if let (Some(&(winner, score, coherence)), true) = (evidence.first(), total > 0.0) {
+            let correct = winner == me.person;
+            share_right += correct as usize;
+            // What the screen would say about the identity it picked.
+            reliability.push((coherence * score / total, correct));
+            let ours = evidence
+                .iter()
+                .find(|(p, _, _)| *p == me.person)
+                .map(|(_, s, c)| c * s / total)
+                .unwrap_or(0.0);
+            shown_share.push(ours);
+        }
+        if let Some(&(winner, _)) = means.first() {
+            mean_right += (winner == me.person) as usize;
+            shown_mean.push(
+                means
+                    .iter()
+                    .find(|(p, _)| *p == me.person)
+                    .map(|(_, s)| *s)
+                    .unwrap_or(0.0),
+            );
+        }
+    }
+
+    let n = known.len() as f64;
+    println!("which identity does this face belong to? (leave-one-out, top-1)");
+    println!(
+        "  share of evidence   {:>6.2}%  ({share_right}/{})",
+        100.0 * share_right as f64 / n,
+        known.len()
+    );
+    println!(
+        "  mean within group   {:>6.2}%  ({mean_right}/{})\n",
+        100.0 * mean_right as f64 / n,
+        known.len()
+    );
+
+    println!("what the screen would show for the answer the user gave:");
+    band("  share ", &shown_share);
+    band("  mean  ", &shown_mean);
+
+    println!("\nreliability of the share — is a stated {{n}}% right {{n}}% of the time?");
+    println!(
+        "  {:>12}  {:>7}  {:>9}  {:>8}",
+        "stated", "faces", "correct", "gap"
+    );
+    for (lo, hi) in [
+        (0.0, 0.5),
+        (0.5, 0.6),
+        (0.6, 0.7),
+        (0.7, 0.8),
+        (0.8, 0.9),
+        (0.9, 0.95),
+        (0.95, 1.001),
+    ] {
+        let bucket: Vec<bool> = reliability
+            .iter()
+            .filter(|(s, _)| *s >= lo && *s < hi)
+            .map(|(_, c)| *c)
+            .collect();
+        if bucket.is_empty() {
+            continue;
+        }
+        let observed = bucket.iter().filter(|c| **c).count() as f64 / bucket.len() as f64;
+        let stated = reliability
+            .iter()
+            .filter(|(s, _)| *s >= lo && *s < hi)
+            .map(|(s, _)| *s as f64)
+            .sum::<f64>()
+            / bucket.len() as f64;
+        println!(
+            "  {:>5.0}–{:>3.0}%  {:>9}  {:>8.1}%  {:>+7.1}",
+            lo * 100.0,
+            hi.min(1.0) * 100.0,
+            bucket.len(),
+            100.0 * observed,
+            100.0 * (observed - stated)
+        );
+    }
+
+    if args.iter().any(|a| a == "--full") {
+        // The confirmations go in as anchors, exactly as `recluster` sends
+        // them: they are what makes a group a named identity, and therefore
+        // what makes it a rival.
+        let mut confirmed = HashMap::new();
+        for p in &people {
+            for f in faces::for_person(conn, p.id, false).expect("faces") {
+                if f.confirmed {
+                    confirmed.insert(f.id, p.id.0);
+                }
+            }
+        }
+        full_library(&embedding_of, &confirmed, &cal);
+    }
+}
+
+/// Where a set of confidences actually falls.
+fn band(label: &str, v: &[f32]) {
+    if v.is_empty() {
+        return;
+    }
+    let mut s = v.to_vec();
+    s.sort_by(|a, b| a.total_cmp(b));
+    let pct = |q: f64| s[((s.len() - 1) as f64 * q) as usize];
+    let mean = s.iter().sum::<f32>() / s.len() as f32;
+    println!(
+        "{label} median {:>5.1}%   mean {:>5.1}%   p10 {:>5.1}%   p90 {:>5.1}%   under 50%: {:>5.1}%",
+        100.0 * pct(0.5),
+        100.0 * mean,
+        100.0 * pct(0.10),
+        100.0 * pct(0.90),
+        100.0 * s.iter().filter(|x| **x < 0.5).count() as f32 / s.len() as f32
+    );
+}
+
+/// The whole library through the real clusterer, for the numbers it would
+/// actually write.
+fn full_library(
+    embedding_of: &HashMap<faces::FaceId, Decoded>,
+    confirmed: &HashMap<faces::FaceId, u64>,
+    cal: &dr_face::Calibration,
+) {
+    let mut candidates: Vec<dr_face::Candidate> = embedding_of
+        .iter()
+        .map(
+            |(id, (image, embedding, crop_px, quality))| dr_face::Candidate {
+                face: id.0,
+                image: *image,
+                embedding: embedding.clone(),
+                crop_px: *crop_px,
+                quality: *quality,
+                confirmed_person: confirmed.get(id).copied(),
+            },
+        )
+        .collect();
+    candidates.sort_by_key(|c| c.face);
+
+    println!("\nthe whole library, at the default merge probability:");
+
+    // The three phases, separately, because "a regroup takes n seconds" does
+    // not tell anyone which half to optimise — and the answer differs between
+    // a desktop and a tablet (docs/dev/faces.md §9).
+    {
+        let dim = candidates.first().map(|c| c.embedding.len()).unwrap_or(0);
+        let flat: Vec<f32> = candidates
+            .iter()
+            .flat_map(|c| c.embedding.clone())
+            .collect();
+        let crop_px: Vec<f32> = candidates.iter().map(|c| c.crop_px).collect();
+        let images: Vec<u64> = candidates.iter().map(|c| c.image).collect();
+        let gallery: Vec<bool> = candidates.iter().map(|c| c.in_gallery()).collect();
+        let view = dr_face::neighbours::Faces {
+            embeddings: &flat,
+            dim,
+            crop_px: &crop_px,
+            images: &images,
+            gallery: &gallery,
+        };
+
+        let t = std::time::Instant::now();
+        let evidence = dr_face::neighbours::above_threshold(&view, cal, dr_face::RIVAL_FLOOR);
+        let scan = t.elapsed().as_secs_f64();
+
+        // `cluster` runs its own scan at the merge threshold, so the
+        // agglomeration is what is left after taking one scan off the total.
+        let t = std::time::Instant::now();
+        let clusters = dr_face::cluster(&candidates, cal, dr_face::DEFAULT_MERGE_PROBABILITY);
+        let agglomerate = t.elapsed().as_secs_f64() - scan;
+
+        let t = std::time::Instant::now();
+        let _ = dr_face::identity_shares(&gallery, &clusters, &evidence, dr_face::TOP_MATCHES);
+        println!(
+            "  scan {scan:.2}s ({} evidence pairs) · agglomerate {agglomerate:.2}s · score {:.2}s",
+            evidence.len(),
+            t.elapsed().as_secs_f64()
+        );
+    }
+
+    let start = std::time::Instant::now();
+    let grouping = dr_face::cluster_scored(&candidates, cal, dr_face::DEFAULT_MERGE_PROBABILITY);
+    let real: Vec<_> = grouping
+        .clusters
+        .iter()
+        .filter(|c| c.members.len() >= 2)
+        .collect();
+    let grouped: usize = real.iter().map(|c| c.members.len()).sum();
+    println!(
+        "  {} face(s) → {} group(s) of two or more, holding {grouped} faces ({:.0}%), in {:.1}s",
+        candidates.len(),
+        real.len(),
+        100.0 * grouped as f64 / candidates.len() as f64,
+        start.elapsed().as_secs_f64()
+    );
+
+    let named: Vec<_> = real.iter().filter(|c| c.person.is_some()).collect();
+    println!(
+        "  {} of those group(s) carry a confirmation, holding {} faces",
+        named.len(),
+        named.iter().map(|c| c.members.len()).sum::<usize>()
+    );
+
+    let shown: Vec<f32> = real
+        .iter()
+        .flat_map(|c| c.members.iter().map(|&m| grouping.confidence[m]))
+        .collect();
+    band("  new, all groups   ", &shown);
+    let onto_people: Vec<f32> = named
+        .iter()
+        .flat_map(|c| c.members.iter().map(|&m| grouping.confidence[m]))
+        .collect();
+    band("  new, onto a person", &onto_people);
+
+    // The number the old code would have written for the same grouping.
+    let means: Vec<f32> = real
+        .iter()
+        .flat_map(|c| {
+            c.members.iter().map(|&m| {
+                let me = &candidates[m];
+                let mut sum = 0.0;
+                let mut n = 0.0;
+                for &other in &c.members {
+                    if other == m {
+                        continue;
+                    }
+                    let them = &candidates[other];
+                    let cos: f32 = me
+                        .embedding
+                        .iter()
+                        .zip(&them.embedding)
+                        .map(|(a, b)| a * b)
+                        .sum();
+                    sum += cal.probability(cos, me.crop_px.min(them.crop_px), 0.0);
+                    n += 1.0;
+                }
+                if n == 0.0 {
+                    1.0
+                } else {
+                    sum / n
+                }
+            })
+        })
+        .collect();
+    band("  old, all groups   ", &means);
+}

core/dr-catalog/examples/sync_probe.rs

@@ -0,0 +1,111 @@
+//! What a second device ends up with after adopting this library.
+//!
+//! Stands up an empty catalog, gives it the images the real one has, adopts the
+//! face shards into it exactly as a sync would, merges the real catalog in as a
+//! remote — and then counts. The point is to answer "why does the tablet show
+//! fewer faces for this person" without needing the tablet.
+//!
+//!   cargo run -p dr-catalog --example sync_probe -- CATALOG.sqlite FACES_DIR
+
+use std::path::PathBuf;
+
+use dr_catalog::face_shard::{self, FaceShardStore};
+use dr_catalog::Catalog;
+
+const MODEL: &str = "w600k_mbf";
+
+fn main() {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    if args.len() < 2 {
+        eprintln!("usage: sync_probe CATALOG.sqlite FACES_DIR");
+        std::process::exit(2);
+    }
+    let source = PathBuf::from(&args[0]);
+    let faces_dir = PathBuf::from(&args[1]);
+
+    let dir = std::env::temp_dir().join(format!("dr-sync-probe-{}", std::process::id()));
+    let _ = std::fs::remove_dir_all(&dir);
+    std::fs::create_dir_all(&dir).unwrap();
+    let dest = dir.join("catalog.sqlite");
+
+    let far = Catalog::open(&dest).expect("fresh catalog");
+    let conn = far.connection();
+
+    // The images a scan would have found. Nothing else: no faces, no people.
+    conn.execute(
+        "ATTACH DATABASE ?1 AS src",
+        [source.to_string_lossy().as_ref()],
+    )
+    .unwrap();
+    // Foreign keys off for the copy: `images` carries self-references
+    // (`shadowed_by`) that are only consistent once every row is in, and this
+    // is a bulk clone rather than an edit.
+    conn.execute_batch(
+        "PRAGMA foreign_keys = OFF;
+         INSERT INTO roots SELECT * FROM src.roots;
+         INSERT INTO images SELECT * FROM src.images;
+         INSERT INTO remote SELECT * FROM src.remote;
+         PRAGMA foreign_keys = ON;",
+    )
+    .unwrap();
+    let images: i64 = conn
+        .query_row("SELECT COUNT(*) FROM images", [], |r| r.get(0))
+        .unwrap();
+    conn.execute_batch("DETACH DATABASE src").unwrap();
+    println!("second device starts with {images} image(s), no faces");
+
+    // Adopt every shard, which is what a completed face sync leaves behind.
+    let store = FaceShardStore::open(&faces_dir).expect("shard store");
+    let adopted = face_shard::import_from_shards(conn, &store, MODEL).expect("import");
+    let faces: i64 = conn
+        .query_row("SELECT COUNT(*) FROM faces", [], |r| r.get(0))
+        .unwrap();
+    println!("adopted {adopted} image(s) from the shards -> {faces} face(s)");
+
+    // Then the catalog merge, which is where people and their judgements come.
+    let report = dr_catalog::sync::merge_remote(conn, &source).expect("merge");
+    println!(
+        "merge: {} people in, {} updated, {} kept local, {} face(s) assigned, \
+         {} kept local, {} rejection(s)",
+        report.people_inserted,
+        report.people_updated,
+        report.people_kept_local,
+        report.faces_assigned,
+        report.faces_kept_local,
+        report.faces_rejected,
+    );
+
+    // Per person, against what the source holds.
+    conn.execute(
+        "ATTACH DATABASE ?1 AS src",
+        [source.to_string_lossy().as_ref()],
+    )
+    .unwrap();
+    let mut q = conn
+        .prepare(
+            "SELECT p.name,
+                    (SELECT COUNT(*) FROM src.face_person sfp
+                      JOIN src.people sp ON sp.id = sfp.person_id
+                     WHERE sp.uuid = p.uuid) AS there,
+                    (SELECT COUNT(*) FROM face_person fp WHERE fp.person_id = p.id) AS here
+               FROM people p
+              WHERE p.name != ''
+              ORDER BY there DESC LIMIT 12",
+        )
+        .unwrap();
+    println!("\n{:<24} {:>8} {:>8}", "person", "source", "here");
+    let rows = q
+        .query_map([], |r| {
+            Ok((
+                r.get::<_, String>(0)?,
+                r.get::<_, i64>(1)?,
+                r.get::<_, i64>(2)?,
+            ))
+        })
+        .unwrap();
+    for row in rows.flatten() {
+        println!("{:<24} {:>8} {:>8}", row.0, row.1, row.2);
+    }
+
+    println!("\nprobe catalog left at {}", dest.display());
+}

core/dr-catalog/src/cache.rs

@@ -222,6 +222,56 @@ impl Cache {
         Ok(())
     }
 
+    /// TRACES: FR-NC-6c | FR-NC-6a
+    /// Record an original this cache does **not** own the bytes of.
+    ///
+    /// The virtual-filesystem case. On a library kept by a sync client the
+    /// original is materialised *in the library folder itself*, so copying it
+    /// under `originals/` would hold two copies of every pinned photograph —
+    /// and the copy would be the one the budget could evict while the real
+    /// disk cost stayed.
+    ///
+    /// So the bytes are left where they are and only the bookkeeping is kept.
+    /// `path` is deliberately `NULL`, which is what makes this safe:
+    /// [`release`](Self::release) deletes the file a row names, and a row that
+    /// names none deletes nothing. **That matters more than it sounds.**
+    /// Deleting a materialised file inside a synced folder does not free a
+    /// cache — it deletes the photograph, and the client propagates that to
+    /// the server and to every other device. Handing the disk back is the
+    /// backend's job (`RemoteBackend::dematerialise`), not this one's.
+    ///
+    /// `bytes` is what the original occupies where it lies, for the budget and
+    /// for reporting; pass 0 where it is not known.
+    pub fn record_in_place(
+        &self,
+        conn: &Connection,
+        image: ImageId,
+        bytes: u64,
+        pinned: bool,
+        now: i64,
+    ) -> Result<(), CatalogError> {
+        conn.execute(
+            "INSERT INTO image_cache
+                 (image_id, tier_actual, tier_desired, bytes, last_used, pinned, path)
+             VALUES (?1, ?2, ?2, ?3, ?4, ?5, NULL)
+             ON CONFLICT(image_id) DO UPDATE SET
+                 tier_actual = ?2,
+                 tier_desired = max(tier_desired, ?2),
+                 bytes       = ?3,
+                 last_used   = ?4,
+                 pinned      = max(pinned, ?5),
+                 path        = NULL",
+            rusqlite::params![
+                image.0 as i64,
+                Tier::Original.stored(),
+                bytes as i64,
+                now,
+                i64::from(pinned),
+            ],
+        )?;
+        Ok(())
+    }
+
     /// Read a cached original back, if it is here.
     ///
     /// Touches `last_used`, which is what makes the eviction order reflect

core/dr-catalog/src/collections.rs

@@ -376,6 +376,64 @@ pub fn set_order(
     touch(conn, id)
 }
 
+/// Whether this collection has a manual order worth reading.
+///
+/// The grid asks before choosing an `ORDER BY`, and the answer is narrower
+/// than "is it manual". Two things have to be true.
+///
+/// It must be **manual**: a saved filter's contents are whatever its selector
+/// matches now, in whatever order the query returns them, and there are no
+/// member rows to carry a position.
+///
+/// And it must have **no children**. A parent's contents are the union of its
+/// own members and its descendants' ([`descendants`]), and positions are only
+/// ever assigned within one collection — so two children's positions are
+/// unrelated integers, and interleaving them by value would order the grid by
+/// a coincidence. Capture time is the honest answer for a set.
+///
+/// Kept here rather than assembled at the call site, so the rule has one name
+/// and one test, and the grid does not have to know that "no children" is part
+/// of it.
+pub fn orders_manually(conn: &Connection, id: CollectionId) -> Result<bool, CatalogError> {
+    if kind_of(conn, id)? != CollectionKind::Manual {
+        return Ok(false);
+    }
+
+    let has_child: Option<i64> = conn
+        .query_row(
+            "SELECT 1 FROM collections
+              WHERE parent_id = ?1 AND deleted = 0 LIMIT 1",
+            [id.0 as i64],
+            |r| r.get(0),
+        )
+        .optional()?;
+
+    Ok(has_child.is_none())
+}
+
+/// Every image in a manual collection, in manual order.
+///
+/// The whole membership, not the filtered view the grid happens to be showing.
+/// [`set_order`] renumbers exactly the images it is handed, so a caller that
+/// reordered a filtered list would renumber those and leave every hidden image
+/// on a stale position — two images sharing a position, and a grid that
+/// rearranges itself when the filter comes off.
+///
+/// `image_id` breaks ties. Positions are dense in practice, but a merge can
+/// deliver two devices' rows at the same position, and an order that is not
+/// total is one the grid draws differently each time it reads it.
+pub fn members_in_order(conn: &Connection, id: CollectionId) -> Result<Vec<ImageId>, CatalogError> {
+    let mut stmt = conn.prepare(
+        "SELECT image_id FROM collection_members
+          WHERE collection_id = ?1
+          ORDER BY position, image_id",
+    )?;
+    let rows = stmt
+        .query_map([id.0 as i64], |r| Ok(ImageId(r.get::<_, i64>(0)? as u64)))?
+        .collect::<Result<Vec<_>, _>>()?;
+    Ok(rows)
+}
+
 /// Save a smart collection's selector.
 ///
 /// Refuses a selector that references this collection, directly or through
@@ -477,6 +535,160 @@ pub fn collections_for_image(
     Ok(rows)
 }
 
+/// One collection a set of images is filed in, and how much of that set is in
+/// it.
+///
+/// `holding` is what makes a removal honest: with forty photographs selected
+/// and three of them in "Iceland", the row has to say "3 of 40" or the user
+/// reads it as "this selection is in Iceland" and takes all forty out of a
+/// collection thirty-seven of them were never in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Membership {
+    pub id: CollectionId,
+    pub name: String,
+    /// How many of the images asked about are members. Never zero — a
+    /// collection holding none of them is not returned at all.
+    pub holding: usize,
+}
+
+/// Every collection the given images are filed in, with how many of them each
+/// holds.
+///
+/// The read behind "which collections is this selection in, and take it out of
+/// one" — the counterpart to [`collections_for_image`], which answers the same
+/// question for a single photograph and does not need the counts.
+///
+/// Smart collections never appear: they have no `collection_members` rows, so
+/// there is nothing to remove and offering it would be a button that does
+/// nothing. Sorted by name, matching the sidebar.
+///
+/// # Why this is chunked
+///
+/// The image list is a *selection*, which a select-all makes as large as the
+/// library. SQLite caps the number of bound parameters in one statement, so a
+/// single `IN (...)` over every selected id fails outright on exactly the
+/// gesture most likely to produce it. The counts are summed across chunks
+/// rather than re-queried, so the result is the same as the unchunked query
+/// would have given.
+pub fn membership_of(
+    conn: &Connection,
+    images: &[ImageId],
+) -> Result<Vec<Membership>, CatalogError> {
+    if images.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // Well under SQLite's default parameter cap, and large enough that an
+    // ordinary selection is one round trip.
+    const CHUNK: usize = 400;
+
+    let mut totals: std::collections::HashMap<CollectionId, (String, usize)> =
+        std::collections::HashMap::new();
+
+    for chunk in images.chunks(CHUNK) {
+        let placeholders = std::iter::repeat_n("?", chunk.len())
+            .collect::<Vec<_>>()
+            .join(",");
+        // The placeholder list is built from the id *count*, never from user
+        // text — the same construction `deep_count` uses.
+        let sql = format!(
+            "SELECT c.id, c.name, count(*)
+               FROM collection_members m
+               JOIN collections c ON c.id = m.collection_id
+              WHERE m.image_id IN ({placeholders}) AND c.deleted = 0
+              GROUP BY c.id, c.name"
+        );
+        let params: Vec<rusqlite::types::Value> = chunk
+            .iter()
+            .map(|i| rusqlite::types::Value::Integer(i.0 as i64))
+            .collect();
+
+        let mut stmt = conn.prepare(&sql)?;
+        let rows = stmt.query_map(rusqlite::params_from_iter(params.iter()), |r| {
+            Ok((
+                CollectionId(r.get::<_, i64>(0)? as u64),
+                r.get::<_, String>(1)?,
+                r.get::<_, i64>(2)? as usize,
+            ))
+        })?;
+
+        for row in rows {
+            let (id, name, n) = row?;
+            let entry = totals.entry(id).or_insert((name, 0));
+            entry.1 += n;
+        }
+    }
+
+    let mut out: Vec<Membership> = totals
+        .into_iter()
+        .map(|(id, (name, holding))| Membership { id, name, holding })
+        .collect();
+    // By name, then by id, so two collections sharing a name have a stable
+    // order rather than the hash map's.
+    out.sort_by(|a, b| {
+        a.name
+            .to_lowercase()
+            .cmp(&b.name.to_lowercase())
+            .then(a.id.0.cmp(&b.id.0))
+    });
+    Ok(out)
+}
+
+/// What kind of collection `id` is, or `None` if there is no such collection.
+///
+/// Cheaper than reading the whole [`Collection`] where the caller only needs to
+/// know whether member rows exist — the grid asks this to decide whether manual
+/// position is a thing it can order by, and a smart collection has no
+/// `collection_members` rows to carry one.
+pub fn kind(conn: &Connection, id: CollectionId) -> Result<Option<CollectionKind>, CatalogError> {
+    let found = conn
+        .query_row(
+            "SELECT kind FROM collections WHERE id = ?1 AND deleted = 0",
+            [id.0 as i64],
+            |r| r.get::<_, i64>(0),
+        )
+        .optional()?;
+    Ok(found.map(CollectionKind::from_i64))
+}
+
+/// TRACES: FR-UI-8
+/// The device-independent name of a collection, from its local id.
+///
+/// The pair to [`id_for_uuid`], and the reason both exist: `collections.id` is
+/// an autoincrement local to one catalog, so anything that travels between
+/// devices — a place, a merge — has to say which collection it means in the
+/// only vocabulary they share.
+///
+/// `None` for a collection that is not there, or has been tombstoned. A caller
+/// writing down a scope treats that as "the whole library", which is the
+/// harmless direction: the alternative is recording a name nothing can resolve.
+pub fn uuid_of(conn: &Connection, id: CollectionId) -> Result<Option<String>, CatalogError> {
+    Ok(conn
+        .query_row(
+            "SELECT uuid FROM collections WHERE id = ?1 AND deleted = 0",
+            [id.0 as i64],
+            |r| r.get::<_, String>(0),
+        )
+        .optional()?)
+}
+
+/// TRACES: FR-UI-8
+/// The local id of a collection, from the name every device knows it by.
+///
+/// `None` where this device has never heard of it, or has deleted it — a place
+/// recorded on the tablet inside a collection this machine has not yet merged.
+/// The caller falls back to the whole library rather than to an empty grid.
+pub fn id_for_uuid(conn: &Connection, uuid: &str) -> Result<Option<CollectionId>, CatalogError> {
+    Ok(conn
+        .query_row(
+            "SELECT id FROM collections WHERE uuid = ?1 AND deleted = 0",
+            [uuid],
+            |r| r.get::<_, i64>(0),
+        )
+        .optional()?
+        .map(|id| CollectionId(id as u64)))
+}
+
 /// A collection and everything beneath it, including itself.
 ///
 /// Used for cycle checks and for scoping the grid to a parent: selecting a
@@ -772,6 +984,106 @@ mod tests {
         ImageId(i)
     }
 
+    #[test]
+    fn a_manual_leaf_orders_manually() {
+        let cat = seeded();
+        let c = cat.connection();
+        let id = create(c, "Trip", None, CollectionKind::Manual).unwrap();
+        assert!(orders_manually(c, id).unwrap());
+    }
+
+    #[test]
+    fn a_saved_filter_has_no_manual_order() {
+        let cat = seeded();
+        let c = cat.connection();
+        let id = create(c, "Picks", None, CollectionKind::Smart).unwrap();
+        assert!(
+            !orders_manually(c, id).unwrap(),
+            "a smart collection has no member rows to carry a position"
+        );
+    }
+
+    #[test]
+    fn a_parent_has_no_manual_order_of_its_own() {
+        let cat = seeded();
+        let c = cat.connection();
+        let parent = create(c, "2026", None, CollectionKind::Manual).unwrap();
+        let child = create(c, "Iceland", Some(parent), CollectionKind::Manual).unwrap();
+
+        assert!(
+            !orders_manually(c, parent).unwrap(),
+            "a set shows its descendants' images, whose positions are unrelated"
+        );
+        assert!(
+            orders_manually(c, child).unwrap(),
+            "the child is still a leaf and still orders manually"
+        );
+    }
+
+    #[test]
+    fn deleting_the_last_child_gives_the_parent_its_order_back() {
+        let cat = seeded();
+        let c = cat.connection();
+        let parent = create(c, "2026", None, CollectionKind::Manual).unwrap();
+        let child = create(c, "Iceland", Some(parent), CollectionKind::Manual).unwrap();
+        assert!(!orders_manually(c, parent).unwrap());
+
+        delete(c, child).unwrap();
+        assert!(
+            orders_manually(c, parent).unwrap(),
+            "a tombstoned child must not keep counting as a child"
+        );
+    }
+
+    #[test]
+    fn members_come_back_in_the_order_they_were_put_in() {
+        let cat = seeded();
+        let c = cat.connection();
+        let id = create(c, "Trip", None, CollectionKind::Manual).unwrap();
+        add_images(c, id, &[img(3), img(1), img(2)]).unwrap();
+
+        assert_eq!(
+            members_in_order(c, id).unwrap(),
+            vec![img(3), img(1), img(2)],
+            "adding assigns position in the order given, and reading returns it"
+        );
+    }
+
+    #[test]
+    fn members_come_back_in_the_order_set_order_wrote() {
+        let cat = seeded();
+        let c = cat.connection();
+        let id = create(c, "Trip", None, CollectionKind::Manual).unwrap();
+        add_images(c, id, &[img(1), img(2), img(3)]).unwrap();
+
+        set_order(c, id, &[img(3), img(2), img(1)]).unwrap();
+        assert_eq!(
+            members_in_order(c, id).unwrap(),
+            vec![img(3), img(2), img(1)]
+        );
+    }
+
+    #[test]
+    fn members_in_order_is_total_even_where_positions_collide() {
+        let cat = seeded();
+        let c = cat.connection();
+        let id = create(c, "Trip", None, CollectionKind::Manual).unwrap();
+        add_images(c, id, &[img(1), img(2), img(3)]).unwrap();
+
+        // What a merge can deliver: two devices' rows landing on one position.
+        c.execute(
+            "UPDATE collection_members SET position = 0 WHERE collection_id = ?1",
+            [id.0 as i64],
+        )
+        .unwrap();
+
+        assert_eq!(
+            members_in_order(c, id).unwrap(),
+            vec![img(1), img(2), img(3)],
+            "image_id breaks the tie, so two reads cannot disagree"
+        );
+    }
+
     #[test]
     fn a_created_collection_appears_in_the_tree() {
         let cat = seeded();
@@ -1225,4 +1537,85 @@ mod tests {
         let d = descendants(c, a).unwrap();
         assert!(d.len() <= 2);
     }
+
+    #[test]
+    fn membership_says_how_many_of_the_selection_each_collection_holds() {
+        // The count is the whole point: "3 of 40" is what stops a user taking
+        // forty photographs out of a collection thirty-seven were never in.
+        let cat = seeded();
+        let c = cat.connection();
+        let iceland = create(c, "Iceland", None, CollectionKind::Manual).unwrap();
+        let best = create(c, "Best", None, CollectionKind::Manual).unwrap();
+        add_images(c, iceland, &[img(1), img(2), img(3)]).unwrap();
+        add_images(c, best, &[img(1)]).unwrap();
+
+        let m = membership_of(c, &[img(1), img(2), img(3), img(4)]).unwrap();
+        assert_eq!(m.len(), 2);
+        // Sorted by name, so "Best" comes before "Iceland".
+        assert_eq!(m[0].id, best);
+        assert_eq!(m[0].holding, 1);
+        assert_eq!(m[1].id, iceland);
+        assert_eq!(m[1].holding, 3);
+    }
+
+    #[test]
+    fn membership_omits_collections_holding_none_of_them() {
+        // A row offering to remove images that are not there would be a button
+        // that does nothing, which is worse than an absent one.
+        let cat = seeded();
+        let c = cat.connection();
+        let a = create(c, "A", None, CollectionKind::Manual).unwrap();
+        create(c, "Empty", None, CollectionKind::Manual).unwrap();
+        add_images(c, a, &[img(1)]).unwrap();
+
+        let m = membership_of(c, &[img(1)]).unwrap();
+        assert_eq!(m.len(), 1);
+        assert_eq!(m[0].id, a);
+    }
+
+    #[test]
+    fn membership_of_nothing_is_nothing() {
+        let cat = seeded();
+        assert!(membership_of(cat.connection(), &[]).unwrap().is_empty());
+    }
+
+    #[test]
+    fn membership_skips_a_deleted_collection() {
+        // The tombstone survives the delete, and its member rows are dropped —
+        // but a merge can leave rows behind, and the sheet must not offer a
+        // collection the sidebar does not draw.
+        let cat = seeded();
+        let c = cat.connection();
+        let a = create(c, "A", None, CollectionKind::Manual).unwrap();
+        add_images(c, a, &[img(1)]).unwrap();
+        delete(c, a).unwrap();
+
+        assert!(membership_of(c, &[img(1)]).unwrap().is_empty());
+    }
+
+    #[test]
+    fn membership_sums_across_chunks() {
+        // The chunking exists for a select-all, which is exactly the gesture
+        // that would otherwise exceed SQLite's parameter cap. A count that was
+        // per-chunk rather than summed would under-report on the one selection
+        // large enough to need it.
+        let cat = seeded();
+        let c = cat.connection();
+        let a = create(c, "A", None, CollectionKind::Manual).unwrap();
+        // Past the fixture's six, so the member rows have images to point at.
+        for i in 7..=900i64 {
+            c.execute(
+                "INSERT INTO images(id, root_id, source_ref, added_at)
+                 VALUES (?1, 1, ?2, 0)",
+                rusqlite::params![i, format!("img{i}.CR3")],
+            )
+            .unwrap();
+        }
+        let ids: Vec<ImageId> = (1..=900).map(img).collect();
+        add_images(c, a, &ids).unwrap();
+
+        let m = membership_of(c, &ids).unwrap();
+        assert_eq!(m.len(), 1);
+        assert_eq!(m[0].holding, 900, "counted across every chunk");
+    }
 }

core/dr-catalog/src/error.rs

@@ -1,14 +1,37 @@
-//! TRACES: NFR-ARCH-4 | NFR-R5
+//! TRACES: NFR-ARCH-4 | NFR-R5 | NFR-R6
 //! Catalog errors.
 //!
 //! Typed and attached to the affected subject rather than panicking — a
 //! corrupt row or a failed job marks one image and lets the batch continue.
+//!
+//! # Why `From<rusqlite::Error>` is written by hand
+//!
+//! One class of SQLite failure is not about the statement that hit it: when
+//! the file itself is damaged, *every* query fails, and which one the user
+//! happened to trigger first says nothing. Before this, corruption reached the
+//! interface as whatever `Sqlite(...)` the first failing query produced —
+//! "database disk image is malformed" attached to a thumbnail refresh — and
+//! there was nowhere to hang a recovery offer.
+//!
+//! So the conversion classifies rather than wraps: `SQLITE_CORRUPT` and
+//! `SQLITE_NOTADB` become [`CatalogError::Corrupt`] wherever they arise, which
+//! means a background job that trips over the damage reports the same thing
+//! the startup check does (see [`crate::recovery`]).
 
 /// Something went wrong talking to the catalog.
 #[derive(Debug, thiserror::Error)]
 pub enum CatalogError {
     #[error("sqlite: {0}")]
-    Sqlite(#[from] rusqlite::Error),
+    Sqlite(#[source] rusqlite::Error),
+
+    /// The catalog file is damaged.
+    ///
+    /// Its own variant because it is the one error with a *user-facing
+    /// remedy*: restore the NFR-R2 backup, or discard the index and rebuild it
+    /// from sources plus sidecars (NFR-R6, invariant §5.2.4). Every other
+    /// variant here is either a caller's mistake or a fact about one row.
+    #[error("the catalog file is damaged: {detail}")]
+    Corrupt { detail: String },
 
     /// The catalog was written by a newer build.
     ///
@@ -74,3 +97,38 @@ pub enum CatalogError {
     #[error("io: {0}")]
     Io(String),
 }
+
+impl From<rusqlite::Error> for CatalogError {
+    fn from(e: rusqlite::Error) -> Self {
+        if is_corruption(&e) {
+            // `to_string` rather than keeping the error: the detail is going
+            // into a dialog and into a log line, and the recovery path has no
+            // use for the rusqlite type once it knows the file is damaged.
+            CatalogError::Corrupt {
+                detail: e.to_string(),
+            }
+        } else {
+            CatalogError::Sqlite(e)
+        }
+    }
+}
+
+/// Whether a SQLite failure means the *file* is damaged rather than the
+/// statement wrong.
+///
+/// `SQLITE_NOTADB` is included because it is what a truncated or overwritten
+/// catalog produces — SQLite cannot read the header, so it declines to call it
+/// a database at all. To a user those are the same accident, and the same two
+/// offers answer both.
+///
+/// Deliberately *not* included: `SQLITE_CANTOPEN` (a missing file, which
+/// `Connection::open` fixes by creating one), `SQLITE_BUSY`, and
+/// `SQLITE_IOERR` — a failing disk or a dropped network mount is a different
+/// problem, and telling the user to rebuild their index would be a wrong
+/// answer delivered confidently.
+fn is_corruption(e: &rusqlite::Error) -> bool {
+    matches!(
+        e.sqlite_error_code(),
+        Some(rusqlite::ErrorCode::DatabaseCorrupt) | Some(rusqlite::ErrorCode::NotADatabase)
+    )
+}

core/dr-catalog/src/jobs.rs

@@ -10,8 +10,14 @@
 //!   table absorb the redundancy.
 //! - **Priority shared with the GPU scheduler** (ARCH §5.3), so one notion of
 //!   urgency governs the whole app and visible work always preempts bulk work.
+//!
+//! Nothing in this file runs a job. [`crate::runner`] is the other half — the
+//! one that claims from this table, does the work through a handler, and
+//! reports back. Worth knowing because for a long time it did not exist: every
+//! producer called [`enqueue`] and nothing ever called [`claim_next`], so the
+//! table only ever grew.
 
-use rusqlite::Connection;
+use rusqlite::{Connection, OptionalExtension};
 
 use crate::error::CatalogError;
 
@@ -35,9 +41,34 @@ pub enum JobKind {
     FetchPreview = 6,
     /// Fetch a full original: pinned by rule, or explicitly asked for.
     FetchOriginal = 7,
+    /// Detect and embed the faces in one image (FR-CULL-8).
+    ///
+    /// One job does both, rather than splitting them: the proxy is already
+    /// decoded and in memory, and the natural unit of resumable work is one
+    /// photograph. Splitting would double the queue's row count for nothing.
+    ///
+    /// Runs against the proxy tier, never a full decode — a library that has
+    /// been browsed has already paid for its proxies, so face indexing adds no
+    /// RAW decodes that were not already happening.
+    DetectFaces = 8,
 }
 
 impl JobKind {
+    /// Every kind, so code that has to enumerate them cannot quietly miss one
+    /// that was added later. A `match` would catch that; a hand-written array
+    /// at each call site would not.
+    pub const ALL: [JobKind; 9] = [
+        JobKind::ScanFolder,
+        JobKind::ExtractMetadata,
+        JobKind::Thumbnail,
+        JobKind::ReadSidecar,
+        JobKind::WriteSidecar,
+        JobKind::ContentHash,
+        JobKind::FetchPreview,
+        JobKind::FetchOriginal,
+        JobKind::DetectFaces,
+    ];
+
     fn from_i64(v: i64) -> Option<Self> {
         Some(match v {
             0 => JobKind::ScanFolder,
@@ -48,6 +79,7 @@ impl JobKind {
             5 => JobKind::ContentHash,
             6 => JobKind::FetchPreview,
             7 => JobKind::FetchOriginal,
+            8 => JobKind::DetectFaces,
             _ => return None,
         })
     }
@@ -57,6 +89,16 @@ impl JobKind {
     pub fn is_network(self) -> bool {
         matches!(self, JobKind::FetchPreview | JobKind::FetchOriginal)
     }
+
+    /// Whether `subject_id` names a row in `images`.
+    ///
+    /// Every kind but one is per-photograph. `ScanFolder`'s subject is a
+    /// *folder*, and the two id spaces are unrelated — so anything that joins
+    /// `subject_id` against `images` has to exclude it, or it will read one
+    /// table's ids as another's and act on the answer.
+    pub fn subject_is_image(self) -> bool {
+        !matches!(self, JobKind::ScanFolder)
+    }
 }
 
 /// Scheduling class, matching the GPU tile scheduler (ARCH §5.3).
@@ -75,6 +117,22 @@ pub enum Priority {
     Interactive = 2,
 }
 
+impl Priority {
+    /// Read back from the stored column.
+    ///
+    /// An unrecognised value reads as `Background` rather than failing: a
+    /// priority is a hint about ordering, and refusing to run a job because
+    /// its urgency is spelled oddly would be a worse answer than running it
+    /// last.
+    fn from_i64(v: i64) -> Self {
+        match v {
+            2 => Priority::Interactive,
+            1 => Priority::Prefetch,
+            _ => Priority::Background,
+        }
+    }
+}
+
 /// Lifecycle state.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 #[repr(i64)]
@@ -145,52 +203,115 @@ pub fn enqueue(
 /// Claim the next runnable job, highest priority first.
 ///
 /// `now` is passed rather than read from the clock so backoff is testable.
-/// Claiming marks the row `Running` in the same transaction as the read, so
-/// two workers cannot take the same job.
 pub fn claim_next(conn: &Connection, now: i64) -> Result<Option<Job>, CatalogError> {
-    let tx = conn.unchecked_transaction()?;
+    claim(conn, now, None)
+}
 
-    let job = tx
-        .query_row(
-            "SELECT id, kind, subject_id, priority, attempts, payload
-               FROM jobs
-              WHERE state = 0 AND not_before <= ?1
-              ORDER BY priority DESC, id ASC
-              LIMIT 1",
-            [now],
-            |r| {
-                Ok((
-                    r.get::<_, i64>(0)?,
-                    r.get::<_, i64>(1)?,
-                    r.get::<_, Option<i64>>(2)?,
-                    r.get::<_, i64>(3)?,
-                    r.get::<_, i64>(4)?,
-                    r.get::<_, Option<String>>(5)?,
-                ))
-            },
-        )
-        .ok();
+/// Claim the next runnable job of one of `kinds`.
+///
+/// What lets a runner take only the work it can actually do. A device with no
+/// connector must leave `FetchOriginal` rows alone rather than claim them and
+/// fail them five times each with backoff; a runner gated onto an unmetered
+/// network (FR-NC-6) passes the local kinds only and leaves the transfers
+/// where they are. Neither is expressible by filtering *after* a claim,
+/// because the claim has already marked the row `Running`.
+///
+/// An empty list claims nothing, which is the honest reading of "there is
+/// nothing this worker can do".
+pub fn claim_next_matching(
+    conn: &Connection,
+    now: i64,
+    kinds: &[JobKind],
+) -> Result<Option<Job>, CatalogError> {
+    if kinds.is_empty() {
+        return Ok(None);
+    }
+    claim(conn, now, Some(kinds))
+}
 
-    let Some((id, kind, subject_id, priority, attempts, payload)) = job else {
+/// The claim, as one statement.
+///
+/// # Why this is not a transaction around a read and a write
+///
+/// It used to be, and under two connections that is not safe in the way it
+/// looks. A deferred transaction takes a read lock for the `SELECT` and only
+/// tries to upgrade at the `UPDATE`; with WAL, a second worker that read the
+/// same snapshot gets `SQLITE_BUSY_SNAPSHOT` on its write — an error a busy
+/// handler cannot retry away, because the fix is to roll back and start over.
+/// So the queue was correct only in the sense that the loser failed loudly.
+///
+/// `UPDATE ... WHERE id = (SELECT ...) RETURNING` is one statement, so it is
+/// one implicit transaction that takes the write lock immediately. Two workers
+/// serialise, the loser waits out its busy timeout rather than erroring, and
+/// neither can see a row the other is already holding.
+fn claim(
+    conn: &Connection,
+    now: i64,
+    kinds: Option<&[JobKind]>,
+) -> Result<Option<Job>, CatalogError> {
+    // `now` first, then the kinds, matching the order the placeholders appear
+    // in the text below.
+    let mut args: Vec<i64> = vec![now];
+    let filter = match kinds {
+        None => String::new(),
+        Some(kinds) => {
+            // Built from the kind *count*, never from anything a user typed —
+            // the same discipline `collections::descendants` uses, since
+            // `carray` is not compiled in.
+            let placeholders = std::iter::repeat_n("?", kinds.len())
+                .collect::<Vec<_>>()
+                .join(",");
+            args.extend(kinds.iter().map(|k| *k as i64));
+            format!(" AND kind IN ({placeholders})")
+        }
+    };
+
+    let sql = format!(
+        "UPDATE jobs
+            SET state = 1, attempts = attempts + 1
+          WHERE id = (SELECT id
+                        FROM jobs
+                       WHERE state = 0 AND not_before <= ?{filter}
+                       ORDER BY priority DESC, id ASC
+                       LIMIT 1)
+      RETURNING id, kind, subject_id, priority, attempts, payload"
+    );
+
+    let claimed = conn
+        .query_row(&sql, rusqlite::params_from_iter(args.iter()), |r| {
+            Ok((
+                r.get::<_, i64>(0)?,
+                r.get::<_, i64>(1)?,
+                r.get::<_, Option<i64>>(2)?,
+                r.get::<_, i64>(3)?,
+                r.get::<_, i64>(4)?,
+                r.get::<_, Option<String>>(5)?,
+            ))
+        })
+        .optional()?;
+
+    let Some((id, kind, subject_id, priority, attempts, payload)) = claimed else {
         return Ok(None);
     };
 
-    tx.execute(
-        "UPDATE jobs SET state = 1, attempts = attempts + 1 WHERE id = ?1",
-        [id],
-    )?;
-    tx.commit()?;
+    let Some(kind) = JobKind::from_i64(kind) else {
+        // A row written by a build that knows a kind this one does not — a
+        // downgrade, or a catalog synced from a newer device. Running it as
+        // some other kind would be worse than not running it, so it is parked
+        // where the next claim will not see it again.
+        //
+        // Answering `None` understates what is queued for one pass. The
+        // alternative is a loop that keeps claiming the same unreadable row.
+        abandon(conn, id, &format!("unknown job kind {kind}"))?;
+        return Ok(None);
+    };
 
     Ok(Some(Job {
         id,
-        kind: JobKind::from_i64(kind).unwrap_or(JobKind::ExtractMetadata),
+        kind,
         subject_id,
-        priority: match priority {
-            2 => Priority::Interactive,
-            1 => Priority::Prefetch,
-            _ => Priority::Background,
-        },
-        attempts: attempts + 1,
+        priority: Priority::from_i64(priority),
+        attempts,
         payload,
     }))
 }
@@ -204,16 +325,53 @@ pub fn complete(conn: &Connection, id: i64) -> Result<(), CatalogError> {
 /// Job failed. Reschedules with backoff, or gives up past [`MAX_ATTEMPTS`].
 pub fn fail(conn: &Connection, job: &Job, now: i64, err: &str) -> Result<(), CatalogError> {
     if job.attempts >= MAX_ATTEMPTS {
-        conn.execute(
-            "UPDATE jobs SET state = 2, last_error = ?2 WHERE id = ?1",
-            rusqlite::params![job.id, err],
-        )?;
+        abandon(conn, job.id, err)
     } else {
         conn.execute(
             "UPDATE jobs SET state = 0, not_before = ?2, last_error = ?3 WHERE id = ?1",
             rusqlite::params![job.id, now + backoff_seconds(job.attempts), err],
         )?;
+        Ok(())
     }
+}
+
+/// Give up on a job now, with no further retries.
+///
+/// For failures a retry cannot fix — the subject is gone, the payload is
+/// unreadable, the format is one this build does not know. Walking the whole
+/// retry ladder to reach a conclusion the first attempt already reached costs
+/// five wakeups and five backoffs per photograph, which on a phone is the
+/// difference the user notices.
+///
+/// The row is kept rather than deleted, because "this file failed and here is
+/// why" is something the user is entitled to see (NFR-ARCH-4).
+pub fn abandon(conn: &Connection, id: i64, err: &str) -> Result<(), CatalogError> {
+    conn.execute(
+        "UPDATE jobs SET state = 2, last_error = ?2 WHERE id = ?1",
+        rusqlite::params![id, err],
+    )?;
+    Ok(())
+}
+
+/// Put a claimed job back exactly as it was found.
+///
+/// For a worker that is being stopped rather than a job that is going wrong:
+/// the platform revoked the slot, the user left the screen. The attempt the
+/// claim consumed is given back, because nothing was learned about the file —
+/// without that, five backgroundings in a row would mark good work as failed.
+///
+/// Guarded on the claim still being *this* claim. There is no owner column, so
+/// `attempts` stands in for one: it is bumped by every claim, so the row only
+/// still reads `state = 1` with the caller's own attempt number while nobody
+/// else has taken it since. A worker that comes back after the recovery pass
+/// handed its job to someone else therefore changes nothing, rather than
+/// releasing a job another worker is in the middle of.
+pub fn release(conn: &Connection, job: &Job) -> Result<(), CatalogError> {
+    conn.execute(
+        "UPDATE jobs SET state = 0, attempts = max(0, attempts - 1)
+          WHERE id = ?1 AND state = 1 AND attempts = ?2",
+        rusqlite::params![job.id, job.attempts],
+    )?;
     Ok(())
 }
 
@@ -221,11 +379,97 @@ pub fn fail(conn: &Connection, job: &Job, now: i64, err: &str) -> Result<(), Cat
 ///
 /// A row left `Running` has no owner — the process that claimed it is gone.
 /// Called at startup, before any worker begins (FR-PLAT-AND-3).
+///
+/// The attempt the dead claim consumed is deliberately *not* refunded. A job
+/// that takes the process down with it is indistinguishable from one that
+/// fails, and the attempt counter is the only evidence that survives a death —
+/// without it a poison-pill job is reclaimed and re-run forever.
 pub fn recover_orphaned(conn: &Connection) -> Result<usize, CatalogError> {
     let n = conn.execute("UPDATE jobs SET state = 0 WHERE state = 1", [])?;
     Ok(n)
 }
 
+/// Delete jobs whose photograph is gone.
+///
+/// Coalescing keeps the table one row per unit of work, but nothing shrinks it
+/// when the work stops existing: a library that has been culled carries a
+/// thumbnail job for every photograph deleted since the last time anything
+/// looked. Each one would be claimed, run, and failed five times.
+///
+/// Only kinds whose subject really is an image ([`JobKind::subject_is_image`])
+/// are considered — `ScanFolder`'s subject is a folder id, and joining it
+/// against `images` would delete jobs by coincidence of numbering.
+///
+/// There is no foreign key to do this instead. `jobs.subject_id` deliberately
+/// references nothing: it means different tables for different kinds, and a
+/// constraint that is right for eight of nine kinds is not a constraint.
+pub fn reap_orphan_subjects(conn: &Connection) -> Result<usize, CatalogError> {
+    let kinds: Vec<i64> = JobKind::ALL
+        .iter()
+        .filter(|k| k.subject_is_image())
+        .map(|k| *k as i64)
+        .collect();
+    let placeholders = std::iter::repeat_n("?", kinds.len())
+        .collect::<Vec<_>>()
+        .join(",");
+
+    let n = conn.execute(
+        &format!(
+            "DELETE FROM jobs
+              WHERE subject_id IS NOT NULL
+                AND kind IN ({placeholders})
+                AND NOT EXISTS (SELECT 1 FROM images WHERE images.id = jobs.subject_id)"
+        ),
+        rusqlite::params_from_iter(kinds.iter()),
+    )?;
+    Ok(n)
+}
+
+/// How much is left, by state.
+///
+/// One query rather than a listing, because the caller is a progress line: a
+/// foreground service's notification has to say how much remains without
+/// reading a hundred thousand rows to find out (FR-PLAT-AND-4).
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct Counts {
+    /// Claimable now or after a backoff.
+    pub pending: usize,
+    /// Claimed by someone. After a clean start that is a live worker; before
+    /// [`recover_orphaned`] it is a dead one.
+    pub running: usize,
+    /// Given up on, and kept so the user can see what failed and why.
+    pub failed: usize,
+}
+
+impl Counts {
+    /// Work that is still going to happen.
+    pub fn outstanding(&self) -> usize {
+        self.pending + self.running
+    }
+}
+
+/// Count the queue by state.
+pub fn counts(conn: &Connection) -> Result<Counts, CatalogError> {
+    // `sum` over no rows is NULL, not 0 — an empty queue would otherwise fail
+    // to convert rather than counting nothing.
+    let (pending, running, failed) = conn.query_row(
+        "SELECT sum(state = 0), sum(state = 1), sum(state = 2) FROM jobs",
+        [],
+        |r| {
+            Ok((
+                r.get::<_, Option<i64>>(0)?,
+                r.get::<_, Option<i64>>(1)?,
+                r.get::<_, Option<i64>>(2)?,
+            ))
+        },
+    )?;
+    Ok(Counts {
+        pending: pending.unwrap_or(0) as usize,
+        running: running.unwrap_or(0) as usize,
+        failed: failed.unwrap_or(0) as usize,
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -380,6 +624,241 @@ mod tests {
         assert_eq!(backoff_seconds(100), 300);
     }
 
+    /// An image row, so a job has a subject that exists.
+    fn image(c: &Connection, id: i64) {
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', '/lib')
+             ON CONFLICT DO NOTHING",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at) VALUES (?1, 1, ?2, 0)",
+            rusqlite::params![id, format!("/lib/{id}.CR3")],
+        )
+        .unwrap();
+    }
+
+    #[test]
+    fn a_runner_claims_only_the_kinds_it_names() {
+        // The property a filtered claim exists for: work this worker cannot do
+        // is left untouched — not claimed, not attempted, not failed.
+        let c = db();
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        enqueue(
+            &c,
+            JobKind::FetchOriginal,
+            Some(1),
+            Priority::Interactive,
+            None,
+        )
+        .unwrap();
+
+        // `FetchOriginal` is the higher priority and would be claimed first by
+        // an unfiltered claim. It is not this worker's to take.
+        let job = claim_next_matching(&c, 0, &[JobKind::Thumbnail])
+            .unwrap()
+            .expect("the thumbnail is claimable");
+        assert_eq!(job.kind, JobKind::Thumbnail);
+        assert!(claim_next_matching(&c, 0, &[JobKind::Thumbnail])
+            .unwrap()
+            .is_none());
+
+        let (state, attempts): (i64, i64) = c
+            .query_row(
+                "SELECT state, attempts FROM jobs WHERE kind = ?1",
+                [JobKind::FetchOriginal as i64],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        assert_eq!(state, JobState::Pending as i64);
+        assert_eq!(attempts, 0);
+    }
+
+    #[test]
+    fn a_worker_that_can_do_nothing_claims_nothing() {
+        let c = db();
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        assert!(claim_next_matching(&c, 0, &[]).unwrap().is_none());
+    }
+
+    #[test]
+    fn releasing_a_claim_gives_the_attempt_back() {
+        // A stopped worker has learned nothing about the file, so the claim it
+        // is handing back must cost nothing.
+        let c = db();
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+
+        let job = claim_next(&c, 0).unwrap().unwrap();
+        assert_eq!(job.attempts, 1);
+        release(&c, &job).unwrap();
+
+        let again = claim_next(&c, 0).unwrap().expect("claimable again at once");
+        assert_eq!(again.attempts, 1, "the release refunded the first attempt");
+    }
+
+    #[test]
+    fn releasing_a_job_someone_else_has_reclaimed_does_nothing() {
+        // `attempts` standing in for an owner column. A worker that comes back
+        // after the recovery pass handed its job to someone else must not
+        // release a claim that is no longer its to release — which would drop
+        // the live worker's job back into the queue to be run twice.
+        let c = db();
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+
+        let stale = claim_next(&c, 0).unwrap().unwrap();
+        recover_orphaned(&c).unwrap();
+        let live = claim_next(&c, 0).unwrap().unwrap();
+        assert_eq!(live.attempts, 2);
+
+        release(&c, &stale).unwrap();
+
+        let (state, attempts): (i64, i64) = c
+            .query_row("SELECT state, attempts FROM jobs", [], |r| {
+                Ok((r.get(0)?, r.get(1)?))
+            })
+            .unwrap();
+        assert_eq!(
+            state,
+            JobState::Running as i64,
+            "the live claim still holds"
+        );
+        assert_eq!(attempts, 2, "and its attempt was not refunded for it");
+    }
+
+    #[test]
+    fn abandoning_skips_the_whole_retry_ladder() {
+        let c = db();
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        let job = claim_next(&c, 0).unwrap().unwrap();
+
+        abandon(&c, job.id, "not an image this build can read").unwrap();
+
+        assert!(claim_next(&c, 1_000_000).unwrap().is_none());
+        let (state, attempts, err): (i64, i64, String) = c
+            .query_row("SELECT state, attempts, last_error FROM jobs", [], |r| {
+                Ok((r.get(0)?, r.get(1)?, r.get(2)?))
+            })
+            .unwrap();
+        assert_eq!(state, JobState::Failed as i64);
+        assert_eq!(attempts, 1, "one attempt, not MAX_ATTEMPTS");
+        // Kept, not deleted: the user is entitled to see what failed and why.
+        assert!(err.contains("this build can read"));
+    }
+
+    #[test]
+    fn jobs_for_a_deleted_photograph_are_reaped() {
+        // Coalescing keeps the table one row per unit of work; nothing shrank
+        // it when the work stopped existing.
+        let c = db();
+        image(&c, 1);
+        image(&c, 2);
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        enqueue(&c, JobKind::Thumbnail, Some(2), Priority::Background, None).unwrap();
+        enqueue(
+            &c,
+            JobKind::ExtractMetadata,
+            Some(2),
+            Priority::Background,
+            None,
+        )
+        .unwrap();
+
+        c.execute("DELETE FROM images WHERE id = 2", []).unwrap();
+        assert_eq!(reap_orphan_subjects(&c).unwrap(), 2);
+
+        let left: i64 = c
+            .query_row("SELECT subject_id FROM jobs", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(left, 1);
+    }
+
+    #[test]
+    fn a_folder_scan_is_not_reaped_by_image_ids() {
+        // `ScanFolder`'s subject is a folder. Joining it against `images`
+        // would delete it whenever the numbering happened not to collide —
+        // which, on a fresh library, is almost always.
+        let c = db();
+        enqueue(
+            &c,
+            JobKind::ScanFolder,
+            Some(1),
+            Priority::Background,
+            Some("/lib/2024"),
+        )
+        .unwrap();
+
+        assert_eq!(reap_orphan_subjects(&c).unwrap(), 0);
+        assert!(claim_next(&c, 0).unwrap().is_some());
+    }
+
+    #[test]
+    fn a_job_kind_from_a_newer_build_is_parked_rather_than_guessed_at() {
+        // A catalog synced from a device running a later build. Running an
+        // unknown kind as some arbitrary known one is worse than not running
+        // it, and the old code silently read every unknown kind as
+        // `ExtractMetadata`.
+        let c = db();
+        c.execute(
+            "INSERT INTO jobs(kind, subject_id, priority, state) VALUES (99, 1, 0, 0)",
+            [],
+        )
+        .unwrap();
+
+        assert!(claim_next(&c, 0).unwrap().is_none());
+
+        let (state, err): (i64, String) = c
+            .query_row("SELECT state, last_error FROM jobs", [], |r| {
+                Ok((r.get(0)?, r.get(1)?))
+            })
+            .unwrap();
+        assert_eq!(state, JobState::Failed as i64);
+        assert!(err.contains("99"), "{err}");
+    }
+
+    #[test]
+    fn counts_say_what_is_left() {
+        // What a foreground service's notification is built from: a number,
+        // without reading a hundred thousand rows to find it.
+        let c = db();
+        assert_eq!(counts(&c).unwrap(), Counts::default());
+
+        for id in 1..=3 {
+            enqueue(&c, JobKind::Thumbnail, Some(id), Priority::Background, None).unwrap();
+        }
+        let job = claim_next(&c, 0).unwrap().unwrap();
+        abandon(&c, job.id, "nope").unwrap();
+        claim_next(&c, 0).unwrap().unwrap();
+
+        let n = counts(&c).unwrap();
+        assert_eq!(n.pending, 1);
+        assert_eq!(n.running, 1);
+        assert_eq!(n.failed, 1);
+        assert_eq!(n.outstanding(), 2, "failed work is not outstanding work");
+    }
+
+    #[test]
+    fn every_kind_is_in_all() {
+        // `ALL` is what the reap builds its kind filter from, so a kind added
+        // to the enum and forgotten here would quietly stop being reaped.
+        for (i, kind) in JobKind::ALL.iter().enumerate() {
+            assert_eq!(
+                JobKind::from_i64(i as i64),
+                Some(*kind),
+                "ALL is out of step with the discriminants at {i}"
+            );
+        }
+        assert!(JobKind::from_i64(JobKind::ALL.len() as i64).is_none());
+    }
+
+    #[test]
+    fn only_a_folder_scan_has_a_non_image_subject() {
+        assert!(!JobKind::ScanFolder.subject_is_image());
+        for kind in JobKind::ALL.iter().filter(|k| **k != JobKind::ScanFolder) {
+            assert!(kind.subject_is_image(), "{kind:?}");
+        }
+    }
+
     #[test]
     fn network_jobs_are_identifiable_for_metered_gating() {
         // FR-NC-6: transfers respect unmetered-network and charging

core/dr-catalog/src/keywords.rs

@@ -1,4 +1,4 @@
-//! TRACES: FR-CAT-5 | FR-CAT-6 | FR-CAT-13 | NFR-R5
+//! TRACES: FR-CAT-5 | FR-CAT-6 | NFR-R5
 //! Keywords: the vocabulary, the assignments, and the edits the UI performs.
 //!
 //! The read half of this shipped with the catalog and the write half did not.

core/dr-catalog/src/lib.rs

@@ -15,9 +15,13 @@
 //! - [`query`] — selectors compiled to indexed SQL, windowed for the grid
 //! - [`collections`] — the collection tree and membership the UI edits
 //! - [`keywords`] — the keyword vocabulary and what it is assigned to
+//! - [`faces`] — detected faces, the people they belong to, and who said so
+//! - [`bursts`] — frames that are one moment, grouped so they judge as one
 //! - [`jobs`] — the durable background work queue
+//! - [`runner`] — the thing that drains it, driven by whoever owns the thread
 //! - [`trash`] — soft delete to a folder, then permanent delete
 //! - [`merge`] / [`sync`] — cross-device merging of collections and keywords
+//! - [`recovery`] — backups, and the two offers made when this file is damaged
 //!
 //! # The one thing everything is designed around
 //!
@@ -32,15 +36,20 @@ use std::path::Path;
 use dr_types::{Availability, ImageId};
 use rusqlite::Connection;
 
+pub mod bursts;
 pub mod cache;
 pub mod collections;
 pub mod dedup;
 pub mod error;
+pub mod face_shard;
+pub mod faces;
 pub mod jobs;
 pub mod keywords;
 pub mod merge;
 pub mod query;
 pub mod rating;
+pub mod recovery;
+pub mod runner;
 pub mod scan;
 pub mod schema;
 pub mod sync;
@@ -51,14 +60,21 @@ pub use cache::{Budget, Cache, DEFAULT_BUDGET_BYTES};
 pub use collections::{Collection, CollectionKind, TreeRow};
 pub use dedup::{seen_by_content, seen_by_metadata, set_content_hash};
 pub use error::CatalogError;
+pub use face_shard::{FaceShardStore, SharedFace};
+pub use faces::{Calibration, DetectedFace, Face, FaceId, FaceUpdate, Person, PersonId};
 pub use jobs::{Job, JobKind, Priority};
 pub use keywords::{Coverage, Keyword, KeywordId, SelectionKeyword};
 pub use merge::MergeReport;
 pub use query::{Query, Sort};
 pub use rating::{Judgement, MAX_RATING};
+pub use recovery::Backup;
+// Not `runner::Budget`: `cache::Budget` already owns that name here and
+// means something else entirely (bytes on disk, not jobs in a slot).
+// Callers spell the work budget `runner::Budget`, where it is unambiguous.
+pub use runner::{DrainReport, JobHandler, Outcome, Runner};
 pub use scan::{DirAction, DirState, EntryAction, ScanOutcome};
 pub use trash::{TrashedImage, TRASH_DIR};
-pub use walk::{ensure_root, scan_root, RootKind, ScanProgress, ScanReport};
+pub use walk::{ensure_root, mark_root_offline, scan_root, RootKind, ScanProgress, ScanReport};
 
 /// One row of the library grid.
 ///
@@ -114,13 +130,90 @@ impl Granularity {
     }
 
     /// A sensible bucket size for a span of seconds, so the UI need not guess.
+    ///
+    /// # Chosen by how many bars it produces, not by fixed cut-offs
+    ///
+    /// This used to be four thresholds on the span, which reads sensibly and
+    /// behaves badly under zoom. Each zoom step halves the span, so the bar
+    /// count halves with it until a threshold is crossed — a fifteen-year
+    /// library went 15 bars, 8, then 46, 23, 11, and finally *6*. Zooming in
+    /// made the picture coarser, which is the opposite of what zooming is for.
+    ///
+    /// So the choice is made on the axis's terms: of the four bucket sizes,
+    /// take the one whose bar count comes nearest [`Self::TARGET_BARS`]. The
+    /// count then stays in the same neighbourhood at every zoom level, and
+    /// each step in genuinely shows finer structure rather than the same
+    /// structure drawn wider.
+    ///
+    /// Nearest in *ratio*, not in difference: the counts available for a given
+    /// span are orders of magnitude apart — a span is either about 4 years or
+    /// about 48 months — and on a linear measure the larger count always looks
+    /// further away, which would bias every choice towards too few bars.
     pub fn for_span(seconds: i64) -> Self {
+        Self::for_bucket(seconds.max(1) / Self::TARGET_BARS)
+    }
+
+    /// The calendar unit nearest a bucket of `seconds`, for *labelling* one.
+    ///
+    /// Split out from [`Self::for_span`] because the axis no longer buckets by
+    /// calendar unit at all — it divides the visible span into a fixed number
+    /// of equal bins (see `LibrarySettings::timeline_bars`). What is still
+    /// wanted is the unit a bin is closest to, so a bin of about a day is
+    /// labelled as a date and one of about a year as a year. Asked directly
+    /// rather than derived from the span, because the bin count is now the
+    /// user's rather than this module's target.
+    pub fn for_bucket(seconds: i64) -> Self {
+        let seconds = seconds.max(1) as f64;
+        // Finest first, so that when two options are equally far from the
+        // target the finer one wins: `min_by` keeps the first minimum it saw,
+        // and more detail is the better failure.
+        [
+            Granularity::Hour,
+            Granularity::Day,
+            Granularity::Month,
+            Granularity::Year,
+        ]
+        .into_iter()
+        .min_by(|a, b| {
+            let cost = |g: Granularity| {
+                // How far off, measured multiplicatively: twice as long and
+                // half as long are equally wrong.
+                //
+                // Deliberately not clamped. A bucket shorter than the unit
+                // scores *worse* the coarser the unit, which is what makes an
+                // hour of photographs pick hourly bars instead of every option
+                // tying at "one bucket" and the coarsest winning.
+                (seconds / g.approx_seconds() as f64).ln().abs()
+            };
+            cost(*a)
+                .partial_cmp(&cost(*b))
+                // Ties cannot arise from real spans, but a NaN would; falling
+                // back to the coarser option keeps the axis drawable.
+                .unwrap_or(std::cmp::Ordering::Equal)
+        })
+        .unwrap_or(Granularity::Day)
+    }
+
+    /// How many bars the timeline wants across its axis.
+    ///
+    /// Not a hard count — the bucket sizes are calendar units, so the actual
+    /// number lands where the calendar puts it. It is the figure the choice
+    /// aims at: enough bars that a busy fortnight is visibly busier than a
+    /// quiet one, few enough that each is wide enough to hit with a finger.
+    const TARGET_BARS: i64 = 40;
+
+    /// Nominal length of one bucket, for choosing between them.
+    ///
+    /// Approximate on purpose: months and years vary and it does not matter
+    /// here, because this only ranks four options that are a factor of ~12 or
+    /// ~30 apart. The exact boundaries come from `strftime` on the real dates.
+    fn approx_seconds(self) -> i64 {
         const DAY: i64 = 86_400;
-        match seconds {
-            s if s > 5 * 365 * DAY => Granularity::Year,
-            s if s > 90 * DAY => Granularity::Month,
-            s if s > 2 * DAY => Granularity::Day,
-            _ => Granularity::Hour,
+        match self {
+            Granularity::Year => 365 * DAY,
+            Granularity::Month => 30 * DAY,
+            Granularity::Day => DAY,
+            Granularity::Hour => 3600,
         }
     }
 }
@@ -132,9 +225,23 @@ pub struct Catalog {
 
 impl Catalog {
     /// Open or create a catalog, migrating it forward if needed.
+    ///
+    /// Does **not** verify the file — see [`Self::open_verified`], and
+    /// [`recovery`] for why the check is bound to startup rather than to every
+    /// open. Damage this trips over on the way past is still reported as
+    /// [`CatalogError::Corrupt`] rather than as a stray SQLite error.
     pub fn open(path: &Path) -> Result<Self, CatalogError> {
         let conn = Connection::open(path)?;
         schema::configure(&conn)?;
+        // NFR-R2, and the reason it is *here*: a migration is the one routine
+        // operation that rewrites table structure, so it is the likeliest way
+        // this file becomes unreadable — and afterwards there is no
+        // pre-migration state left to copy. A failure to take the copy is
+        // logged rather than raised: a full disk must not be the thing that
+        // makes a library unopenable.
+        if let Err(e) = recovery::backup_before_migration(&conn, path) {
+            log::warn!("could not back up before migrating: {e}");
+        }
         let from = schema::migrate(&conn)?;
         // A migration adds a column; it cannot know what the value should be
         // for rows that already existed. Backfilling on open is what stops
@@ -145,6 +252,26 @@ impl Catalog {
         Ok(Catalog { conn })
     }
 
+    /// TRACES: NFR-R6
+    /// Open a catalog, checking the file first.
+    ///
+    /// What startup calls. On [`CatalogError::Corrupt`] the caller has a user
+    /// in front of it and must make the two offers [`recovery`] describes,
+    /// rather than reporting a SQLite message on a banner and carrying on into
+    /// a scan that would write into the damage.
+    ///
+    /// Checked *before* opening rather than after, because opening runs
+    /// migrations: a damaged catalog that happens to have an intact header
+    /// would otherwise be migrated — rewriting structure on top of structure
+    /// that is already wrong — before anybody asked whether it was sound.
+    pub fn open_verified(path: &Path) -> Result<Self, CatalogError> {
+        // A catalog that is not there yet is not damaged; `open` creates it.
+        if path.is_file() {
+            recovery::check_file(path)?;
+        }
+        Self::open(path)
+    }
+
     /// An in-memory catalog, for tests and for a throwaway import preview.
     pub fn in_memory() -> Result<Self, CatalogError> {
         let conn = Connection::open_in_memory()?;
@@ -422,10 +549,34 @@ mod tests {
     #[test]
     fn timeline_granularity_follows_the_span() {
         const DAY: i64 = 86_400;
-        assert_eq!(Granularity::for_span(10 * 365 * DAY), Granularity::Year);
-        assert_eq!(Granularity::for_span(120 * DAY), Granularity::Month);
+        // Chosen by how many bars it makes, not by fixed cut-offs — see
+        // `for_span`. Ten years of yearly bars is ten bars, which says almost
+        // nothing about a library; monthly is 122, which is a shape.
+        assert_eq!(Granularity::for_span(10 * 365 * DAY), Granularity::Month);
+        assert_eq!(Granularity::for_span(120 * DAY), Granularity::Day);
         assert_eq!(Granularity::for_span(10 * DAY), Granularity::Day);
         assert_eq!(Granularity::for_span(3600), Granularity::Hour);
+
+        // The property the target exists for: zooming in never coarsens the
+        // axis. Under the old thresholds a fifteen-year library went 15 bars,
+        // then 8, then 46, 23, 11 — finer spans drawn with wider bars.
+        let mut span = 15 * 365 * DAY;
+        let mut previous = Granularity::for_span(span).approx_seconds();
+        for _ in 0..10 {
+            span /= 2;
+            let bucket = Granularity::for_span(span).approx_seconds();
+            assert!(
+                bucket <= previous,
+                "halving the span to {span}s coarsened the bucket \
+                 from {previous}s to {bucket}s"
+            );
+            previous = bucket;
+        }
+
+        // And a span shorter than any bucket still picks the finest, rather
+        // than every option tying at one bar and the coarsest winning.
+        assert_eq!(Granularity::for_span(60), Granularity::Hour);
+        assert_eq!(Granularity::for_span(1), Granularity::Hour);
     }
 
     #[test]

core/dr-catalog/src/query.rs

@@ -301,13 +301,7 @@ fn like_prefix(path: &str) -> String {
 }
 
 fn label_code(l: ColourLabel) -> i64 {
-    match l {
-        ColourLabel::Red => 1,
-        ColourLabel::Yellow => 2,
-        ColourLabel::Green => 3,
-        ColourLabel::Blue => 4,
-        ColourLabel::Purple => 5,
-    }
+    crate::rating::label_code(l)
 }
 
 fn flag_code(f: FlagState) -> i64 {

core/dr-catalog/src/rating.rs

@@ -30,7 +30,7 @@
 
 use rusqlite::{Connection, OptionalExtension};
 
-use dr_types::{FlagState, ImageId};
+use dr_types::{ColourLabel, FlagState, ImageId};
 
 use crate::error::CatalogError;
 
@@ -63,6 +63,59 @@ impl Judgement {
     }
 }
 
+/// TRACES: FR-NC-8 | FR-NC-9
+/// The default version's uuid for a photograph the server knows by `file_id`.
+///
+/// # Why this is derived and not generated
+///
+/// A version's uuid is the identity a cross-device merge keys on. It used to
+/// be minted at random per row, and the comment above this function used to
+/// say that made it unique — which it did, and that was precisely the bug.
+/// Two devices indexing the same library minted *different* uuids for the same
+/// photograph, so the sidecar they shared ended up with two `default = 1`
+/// blocks, `Version::merge` never saw a matching pair to reconcile, and a
+/// rating made on one device was invisible on the other. `crate::merge` has
+/// documented the consequence for keywords for as long as it has existed: a
+/// uuid-keyed join across two catalogs unions nothing at all.
+///
+/// `oc:fileid` is the identity that *is* shared. The server assigns it, every
+/// client pointed at that library sees the same integer, and it survives a
+/// server-side rename and move — the same three properties that made
+/// `crate::merge::ASSIGN_BY_FILE_ID` prefer it to a content hash.
+///
+/// # The layout
+///
+/// A UUIDv8 (RFC 9562: an application-defined layout) carrying the file id
+/// verbatim across the four variable fields, with a fixed tag in the node
+/// field saying what minted it. Verbatim rather than hashed so the mapping is
+/// injective by construction: two file ids cannot collide, which a truncated
+/// hash could, and a uuid read out of a sidecar can be traced back to the file
+/// it belongs to by eye.
+///
+/// Every device computes this identically from the same integer, which is the
+/// whole point — there is no negotiation and no first-writer-wins.
+pub fn derived_version_uuid(file_id: i64) -> String {
+    let id = file_id as u64;
+    format!(
+        // 32 + 16 + 12 + 4 = 64 bits of file id, then the tag.
+        "{:08x}-{:04x}-8{:03x}-{:04x}-{:012x}",
+        (id >> 32) as u32,
+        (id >> 16) as u16,
+        (id >> 4) as u16 & 0x0FFF,
+        // The two high bits are the RFC's variant field and must be `0b10`;
+        // the remaining fourteen carry the file id's last four bits.
+        0x8000u16 | ((id as u16 & 0x000F) << 10),
+        DERIVED_VERSION_TAG,
+    )
+}
+
+/// The node field of a [`derived_version_uuid`], identifying what minted it.
+///
+/// Fixed and arbitrary. Its only job is to keep a derived uuid from colliding
+/// with a randomly minted one and to make it recognisable in a sidecar read by
+/// eye — `…-d0c5ec0de001` is visibly not a v4.
+const DERIVED_VERSION_TAG: u64 = 0xd0c5_ec0d_e001;
+
 /// Give every image without one a default version.
 ///
 /// Idempotent, and cheap on the common path: the `NOT EXISTS` sub-select is
@@ -72,8 +125,9 @@ impl Judgement {
 /// Returns how many were created, so a scan can log the backfill rather than
 /// silently doing thousands of inserts.
 ///
-/// The UUID is per row and generated here — it is the merge identity across
-/// devices (FR-NC-8), so two images must never share one.
+/// The uuid comes from [`derived_version_uuid`] where the server has named the
+/// file, so every device computes the same one; only a library with no server
+/// behind it falls back to a generated id.
 pub fn ensure_default_versions(conn: &Connection) -> Result<usize, CatalogError> {
     // One transaction for the batch. A backfill over a 24k-image library is
     // 24k inserts, and per-statement commits would make it minutes rather
@@ -93,13 +147,17 @@ pub fn ensure_default_versions(conn: &Connection) -> Result<usize, CatalogError>
 /// transaction within a transaction". The same split, for the same reason, as
 /// `collections::add_within`.
 pub fn ensure_default_versions_within(conn: &Connection) -> Result<usize, CatalogError> {
-    let ids: Vec<i64> = {
+    // The remote id travels with the image so the uuid can be derived from it.
+    // A `LEFT JOIN`, because a library on a folder or a card has no `remote`
+    // row at all and still needs its versions.
+    let ids: Vec<(i64, Option<i64>)> = {
         let mut stmt = conn.prepare(
-            "SELECT i.id FROM images i
+            "SELECT i.id, r.file_id FROM images i
+             LEFT JOIN remote r ON r.image_id = i.id
               WHERE NOT EXISTS (SELECT 1 FROM versions v WHERE v.image_id = i.id)",
         )?;
         let found = stmt
-            .query_map([], |r| r.get(0))?
+            .query_map([], |r| Ok((r.get(0)?, r.get(1)?)))?
             .collect::<Result<Vec<_>, _>>()?;
         found
     };
@@ -112,14 +170,103 @@ pub fn ensure_default_versions_within(conn: &Connection) -> Result<usize, Catalo
             "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
              VALUES (?1, ?2, ?3, 1, 0, 0)",
         )?;
-        for id in &ids {
-            insert.execute(rusqlite::params![id, new_uuid(), DEFAULT_VERSION_NAME])?;
+        for (id, file_id) in &ids {
+            insert.execute(rusqlite::params![
+                id,
+                version_uuid(*file_id),
+                DEFAULT_VERSION_NAME
+            ])?;
         }
     }
 
     Ok(ids.len())
 }
 
+/// The uuid to mint for a new default version.
+///
+/// Derived from the server's file id where there is one, so two devices agree
+/// (FR-NC-8); generated where there is not.
+///
+/// # What the fallback costs
+///
+/// A library with no server behind it — a folder, a card — has no identity two
+/// devices could both compute, so the split this derivation prevents is still
+/// reachable there if that folder is synced by something else. That case is
+/// repaired rather than prevented: `Sidecar::fuse_default_versions` folds the
+/// rival defaults together the next time either device reads the file.
+fn version_uuid(file_id: Option<i64>) -> String {
+    match file_id {
+        Some(id) => derived_version_uuid(id),
+        None => new_uuid(),
+    }
+}
+
+/// TRACES: FR-NC-8 | FR-NC-9
+/// Move default versions minted before [`derived_version_uuid`] onto it.
+///
+/// Every catalog written by an earlier build holds a randomly minted uuid per
+/// image, and its peers hold different ones for the same photographs. Deriving
+/// the uuid only for *new* rows would leave every image already indexed —
+/// which is all of them, on a library anybody has used — writing to the same
+/// rival identity it always did.
+///
+/// Safe to run repeatedly: it selects only rows whose uuid is not already the
+/// derived one, so a realigned catalog matches nothing and writes nothing.
+///
+/// # Why this cannot collide
+///
+/// `versions.uuid` is `UNIQUE`, and `remote.file_id` has a unique index of its
+/// own, so two images cannot derive the same uuid. The one row that could
+/// stand in the way is a *virtual copy* (FR-CAT-12) that already holds the
+/// target — impossible to mint but not impossible to receive from a merge — so
+/// the update is skipped where the target is taken rather than failing the
+/// backfill and, with it, the catalog open.
+///
+/// # The sidecar side is not this function's business
+///
+/// Moving the catalog's uuid alone would leave the file's default under the
+/// old one and the next write would add a rival rather than amend it. What
+/// stops that is `library::amend` fusing onto the write's uuid before it looks
+/// anything up, which renames the file's default to match. This end and that
+/// one have to land together, and they do.
+///
+/// Returns how many rows moved.
+pub fn align_default_version_uuids(conn: &Connection) -> Result<usize, CatalogError> {
+    // Filtered in SQL rather than in the loop: every derived uuid ends in the
+    // tag, so a catalog that has already been realigned selects no rows at all
+    // and this costs one indexed pass instead of twenty-four thousand reads.
+    let already = format!("%-{DERIVED_VERSION_TAG:012x}");
+    let stale: Vec<(i64, i64)> = {
+        let mut stmt = conn.prepare(
+            "SELECT v.id, r.file_id
+               FROM versions v
+               JOIN remote r ON r.image_id = v.image_id
+              WHERE v.is_default = 1 AND v.uuid NOT LIKE ?1",
+        )?;
+        let found = stmt
+            .query_map([&already], |r| Ok((r.get(0)?, r.get(1)?)))?
+            .collect::<Result<Vec<_>, _>>()?;
+        found
+    };
+    if stale.is_empty() {
+        return Ok(0);
+    }
+
+    let tx = conn.unchecked_transaction()?;
+    let mut moved = 0usize;
+    {
+        // `OR IGNORE` covers the taken-target case described above: the row
+        // keeps the uuid it has, which is the state this build has always
+        // coped with, rather than aborting the transaction.
+        let mut update = tx.prepare("UPDATE OR IGNORE versions SET uuid = ?2 WHERE id = ?1")?;
+        for (row, file_id) in &stale {
+            moved += update.execute(rusqlite::params![row, derived_version_uuid(*file_id)])?;
+        }
+    }
+    tx.commit()?;
+    Ok(moved)
+}
+
 /// The default version's row id for an image, creating one if it has none.
 ///
 /// Every write path goes through this rather than assuming a version exists.
@@ -128,6 +275,35 @@ pub fn ensure_default_versions_within(conn: &Connection) -> Result<usize, Catalo
 /// version pass was interrupted between the image insert and the commit.
 /// Failing a rating because of either would be the wrong answer — the user
 /// pressed a key and expects a star.
+/// TRACES: FR-CAT-13
+/// How `versions.label` encodes a colour label, and back.
+///
+/// One place for both directions, so a label written by the XMP pull and a
+/// label queried by the selector cannot drift apart: the query used to hold
+/// its own copy of the forward mapping and nothing held the reverse.
+pub fn label_code(l: ColourLabel) -> i64 {
+    match l {
+        ColourLabel::Red => 1,
+        ColourLabel::Yellow => 2,
+        ColourLabel::Green => 3,
+        ColourLabel::Blue => 4,
+        ColourLabel::Purple => 5,
+    }
+}
+
+/// The colour a `versions.label` value names, or `None` for NULL and for a
+/// code this build does not know.
+pub fn label_from_code(code: Option<i64>) -> Option<ColourLabel> {
+    Some(match code? {
+        1 => ColourLabel::Red,
+        2 => ColourLabel::Yellow,
+        3 => ColourLabel::Green,
+        4 => ColourLabel::Blue,
+        5 => ColourLabel::Purple,
+        _ => return None,
+    })
+}
+
 pub fn default_version_id(conn: &Connection, image: ImageId) -> Result<i64, CatalogError> {
     let existing: Option<i64> = conn
         .query_row(
@@ -144,10 +320,21 @@ pub fn default_version_id(conn: &Connection, image: ImageId) -> Result<i64, Cata
         return Ok(id);
     }
 
+    // Derived from the server's file id where there is one, so the version
+    // this mints is the same one the photographer's other device will mint
+    // (FR-NC-8). A miss here is a library with no server behind it.
+    let file_id: Option<i64> = conn
+        .query_row(
+            "SELECT file_id FROM remote WHERE image_id = ?1",
+            [image.0 as i64],
+            |r| r.get(0),
+        )
+        .optional()?;
+
     conn.execute(
         "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
          VALUES (?1, ?2, ?3, 1, 0, 0)",
-        rusqlite::params![image.0 as i64, new_uuid(), DEFAULT_VERSION_NAME],
+        rusqlite::params![image.0 as i64, version_uuid(file_id), DEFAULT_VERSION_NAME],
     )?;
     Ok(conn.last_insert_rowid())
 }
@@ -356,15 +543,22 @@ fn flag_from_code(v: i64) -> FlagState {
     }
 }
 
-/// A version UUID.
+/// A generated version UUID, for a photograph no server has named.
 ///
 /// Hand-rolled rather than pulling in the `uuid` crate for one function — the
-/// same reasoning as the date maths in `library_ui`. This needs to be unique
-/// across devices, not cryptographically unguessable: it keys a merge, and an
-/// attacker who can write to the sidecar has already won.
+/// same reasoning as the date maths in `library_ui`. It needs to be unique,
+/// not cryptographically unguessable: it keys a merge, and an attacker who can
+/// write to the sidecar has already won.
 ///
 /// Seeded from the system clock and a per-process counter, so two versions
 /// created inside the same nanosecond tick still differ.
+///
+/// **Unique is not the same as agreed**, which is the distinction that cost a
+/// photographer a day of culling. Two devices calling this for the same
+/// photograph get two different answers, and a merge keyed on the result then
+/// has no pair to reconcile. Anything with a `file_id` behind it must use
+/// [`derived_version_uuid`]; this is the fallback for libraries that have no
+/// server to supply one.
 fn new_uuid() -> String {
     use std::sync::atomic::{AtomicU64, Ordering};
     static COUNTER: AtomicU64 = AtomicU64::new(0);
@@ -731,3 +925,224 @@ mod tests {
         assert_eq!(cat.count(&unrated, 0).unwrap(), 4);
     }
 }
+
+/// TRACES: FR-NC-8 | FR-NC-9
+/// The identity two devices have to agree on without talking to each other.
+#[cfg(test)]
+mod derived_identity {
+    use super::*;
+    use crate::Catalog;
+
+    /// A catalog whose images the server has named, as a remote scan leaves it.
+    fn with_remote_images(file_ids: &[i64]) -> Catalog {
+        let cat = Catalog::in_memory().unwrap();
+        let c = cat.connection();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'remote', 'lib')",
+            [],
+        )
+        .unwrap();
+        for (i, file_id) in file_ids.iter().enumerate() {
+            c.execute(
+                "INSERT INTO images(root_id, source_ref, added_at) VALUES (1, ?1, 0)",
+                [format!("img{i:03}.CR3")],
+            )
+            .unwrap();
+            let image = c.last_insert_rowid();
+            c.execute(
+                "INSERT INTO remote(image_id, file_id) VALUES (?1, ?2)",
+                rusqlite::params![image, file_id],
+            )
+            .unwrap();
+        }
+        cat
+    }
+
+    fn default_uuids(cat: &Catalog) -> Vec<String> {
+        let mut stmt = cat
+            .connection()
+            .prepare("SELECT uuid FROM versions WHERE is_default = 1 ORDER BY image_id")
+            .unwrap();
+        stmt.query_map([], |r| r.get(0))
+            .unwrap()
+            .map(Result::unwrap)
+            .collect()
+    }
+
+    /// The whole point: the same photograph, indexed independently on two
+    /// devices, gets one identity. This used to be two.
+    #[test]
+    fn two_devices_derive_the_same_uuid_for_one_photograph() {
+        let laptop = with_remote_images(&[4_812]);
+        let tablet = with_remote_images(&[4_812]);
+        ensure_default_versions(laptop.connection()).unwrap();
+        ensure_default_versions(tablet.connection()).unwrap();
+
+        assert_eq!(default_uuids(&laptop), default_uuids(&tablet));
+    }
+
+    /// And different photographs must still be told apart — the property the
+    /// random uuid did have, which this must not give up to gain agreement.
+    #[test]
+    fn different_photographs_keep_different_uuids() {
+        let cat = with_remote_images(&[1, 2, 3, 0x7FFF_FFFF_FFFF_FFFF]);
+        ensure_default_versions(cat.connection()).unwrap();
+
+        let mut uuids = default_uuids(&cat);
+        let before = uuids.len();
+        uuids.sort();
+        uuids.dedup();
+        assert_eq!(uuids.len(), before, "two photographs share an identity");
+    }
+
+    /// The file id has to survive the layout intact, or two ids that differ
+    /// only in the bits it drops would collide.
+    #[test]
+    fn the_whole_file_id_is_carried() {
+        // A pair differing only in the low four bits, and a pair differing
+        // only in the high thirty-two — the two places a sloppy layout loses
+        // information.
+        assert_ne!(derived_version_uuid(0x10), derived_version_uuid(0x1F));
+        assert_ne!(
+            derived_version_uuid(0x0000_0001_0000_0000),
+            derived_version_uuid(0x0000_0002_0000_0000)
+        );
+        assert_ne!(derived_version_uuid(0), derived_version_uuid(-1));
+    }
+
+    /// Well-formed, and recognisably not a generated one.
+    #[test]
+    fn a_derived_uuid_is_a_well_formed_v8() {
+        let uuid = derived_version_uuid(4_812);
+        let fields: Vec<&str> = uuid.split('-').collect();
+        assert_eq!(fields.len(), 5);
+        assert_eq!(
+            fields.iter().map(|f| f.len()).collect::<Vec<_>>(),
+            vec![8, 4, 4, 4, 12]
+        );
+        assert!(fields[2].starts_with('8'), "version nibble: {uuid}");
+        // The RFC's variant field is the two high bits of the fourth group,
+        // and must read `0b10` — so the first hex digit is 8, 9, a or b.
+        assert!(
+            matches!(fields[3].as_bytes()[0], b'8' | b'9' | b'a' | b'b'),
+            "variant: {uuid}"
+        );
+        assert!(uuid.ends_with("d0c5ec0de001"), "tag: {uuid}");
+    }
+
+    /// A library with no server behind it has no shared identity to derive,
+    /// and must still get a version rather than failing.
+    #[test]
+    fn a_library_with_no_server_still_gets_its_versions() {
+        let cat = Catalog::in_memory().unwrap();
+        let c = cat.connection();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(root_id, source_ref, added_at) VALUES (1, 'a.CR3', 0)",
+            [],
+        )
+        .unwrap();
+
+        assert_eq!(ensure_default_versions(c).unwrap(), 1);
+        assert_eq!(default_uuids(&cat).len(), 1);
+    }
+
+    /// The repair. A catalog written by an earlier build holds randomly minted
+    /// uuids, and leaving them there would mean every image already indexed —
+    /// which is all of them — kept writing to its own rival identity.
+    #[test]
+    fn a_catalog_from_an_earlier_build_is_realigned() {
+        let cat = with_remote_images(&[4_812, 4_813]);
+        let c = cat.connection();
+        // As the old code left it.
+        for (i, image) in [1i64, 2].iter().enumerate() {
+            c.execute(
+                "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
+                 VALUES (?1, ?2, 'Default', 1, ?3, 0)",
+                rusqlite::params![image, format!("random-{i}"), (i + 1) as i64],
+            )
+            .unwrap();
+        }
+
+        assert_eq!(align_default_version_uuids(c).unwrap(), 2);
+        assert_eq!(
+            default_uuids(&cat),
+            vec![derived_version_uuid(4_812), derived_version_uuid(4_813)]
+        );
+
+        // The judgement travels with the row — a realignment that dropped the
+        // ratings would be a worse bug than the one it fixes.
+        let ratings: Vec<i64> = {
+            let mut stmt = c
+                .prepare("SELECT rating FROM versions ORDER BY image_id")
+                .unwrap();
+            let v = stmt
+                .query_map([], |r| r.get(0))
+                .unwrap()
+                .map(Result::unwrap)
+                .collect();
+            v
+        };
+        assert_eq!(ratings, vec![1, 2]);
+    }
+
+    /// Runs on every catalog open, so a second pass must select nothing and
+    /// write nothing.
+    #[test]
+    fn realigning_twice_changes_nothing_the_second_time() {
+        let cat = with_remote_images(&[4_812]);
+        ensure_default_versions(cat.connection()).unwrap();
+
+        assert_eq!(
+            align_default_version_uuids(cat.connection()).unwrap(),
+            0,
+            "a freshly derived catalog must match nothing"
+        );
+        let before = default_uuids(&cat);
+        align_default_version_uuids(cat.connection()).unwrap();
+        assert_eq!(default_uuids(&cat), before);
+    }
+
+    /// A virtual copy (FR-CAT-12) that already holds the target uuid must not
+    /// take the backfill — and with it the catalog open — down with it.
+    #[test]
+    fn a_taken_target_leaves_the_row_where_it_is() {
+        let cat = with_remote_images(&[4_812]);
+        let c = cat.connection();
+        c.execute(
+            "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
+             VALUES (1, 'random', 'Default', 1, 0, 0)",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
+             VALUES (1, ?1, 'For print', 0, 0, 0)",
+            [derived_version_uuid(4_812)],
+        )
+        .unwrap();
+
+        assert_eq!(align_default_version_uuids(c).unwrap(), 0);
+        assert_eq!(default_uuids(&cat), vec!["random".to_string()]);
+    }
+
+    /// The backfill is what actually runs this, so it has to be wired in.
+    #[test]
+    fn opening_a_catalog_realigns_it() {
+        let cat = with_remote_images(&[4_812]);
+        cat.connection()
+            .execute(
+                "INSERT INTO versions(image_id, uuid, name, is_default, rating, flag)
+                 VALUES (1, 'random', 'Default', 1, 3, 0)",
+                [],
+            )
+            .unwrap();
+
+        crate::schema::backfill(cat.connection()).unwrap();
+        assert_eq!(default_uuids(&cat), vec![derived_version_uuid(4_812)]);
+    }
+}

core/dr-catalog/src/recovery.rs

@@ -0,0 +1,753 @@
+//! TRACES: NFR-R2 | NFR-R6
+//! What to do once the index is already damaged.
+//!
+//! # Why this can be a small module
+//!
+//! Because of a property the rest of the catalog was built to keep: the
+//! catalog is an *index*, not a source of truth (ARCH §6.12, invariant
+//! §5.2.4). Sidecars beside the images hold the authoritative ratings,
+//! keywords and edit graphs, for every catalogued image and whether or not a
+//! remote account exists (FR-CAT-8). So the worst outcome available here is a
+//! rescan — expensive, but not a loss.
+//!
+//! That is the second offer. The first is cheaper and loses nothing at all: a
+//! backup, restored.
+//!
+//! # The one thing a rebuild does not recover
+//!
+//! **Collections.** A manual collection is a set of images the user assembled
+//! by hand and nothing in the filesystem records it (`docs/dev/catalog.md` §8.1) —
+//! which is the whole reason the catalog file itself syncs. So the two offers
+//! are not interchangeable, and the interface must not present them as if they
+//! were: a restore keeps the user's collections, a rebuild does not.
+//!
+//! # When the check runs, and when it does not
+//!
+//! [`integrity_check`] reads every page of the database. That is affordable
+//! once, at startup, where a failure has a user in front of it who can answer
+//! a question — and it is *not* affordable on every [`Catalog::open`], which
+//! this application does per background task, dozens of times a session. So
+//! the check is bound to [`Catalog::open_verified`] rather than to `open`,
+//! and the cheap half of the story — classifying `SQLITE_CORRUPT` and
+//! `SQLITE_NOTADB` as [`CatalogError::Corrupt`] — happens for free on every
+//! query through [`crate::error`]'s conversion. A background job that trips
+//! over the damage first therefore reports the same thing the startup check
+//! would have.
+//!
+//! [`Catalog::open`]: crate::Catalog::open
+//! [`Catalog::open_verified`]: crate::Catalog::open_verified
+
+use std::path::{Path, PathBuf};
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use rusqlite::Connection;
+
+use crate::error::CatalogError;
+use crate::schema;
+
+/// Directory backups live in, relative to the catalog file.
+///
+/// Beside the catalog rather than in the cache directory, and that is the
+/// point of the choice: this is the copy the user falls back on, and a cache
+/// is a place the operating system is entitled to empty without asking
+/// (see `library::data_root` for the same reasoning about sidecars).
+const BACKUP_DIR: &str = "backups";
+
+/// How many backups are kept.
+///
+/// Small on purpose. A backup is a full copy of a catalog that is tens of
+/// megabytes at 50k images, and the value of the third-oldest one is close to
+/// zero: corruption is noticed at the next launch, not months later. What the
+/// depth buys is protection against backing *up* the damage — if a corrupt
+/// catalog is copied before anyone notices, the generation behind it is still
+/// clean.
+pub const KEEP_BACKUPS: usize = 3;
+
+/// Suffix given to a catalog that has been set aside as damaged.
+///
+/// Kept rather than deleted. It costs disk this application would rather not
+/// spend, and it is still the right call: `.sqlite` files have been recovered
+/// by hand before, the user has not consented to a deletion, and NFR-R4's
+/// instinct — never destroy what the user did not ask you to destroy — does
+/// not stop applying at the catalog's edge.
+const DAMAGED_SUFFIX: &str = "damaged";
+
+/// One kept backup.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Backup {
+    pub path: PathBuf,
+    /// UTC seconds at which it was taken, read from the filename rather than
+    /// from the filesystem: a copy, a restore or a sync can rewrite an mtime,
+    /// and then the newest backup is not the one that looks newest.
+    pub taken_at: i64,
+    pub bytes: u64,
+}
+
+/// Where backups for `catalog` are kept.
+pub fn backup_dir(catalog: &Path) -> PathBuf {
+    catalog
+        .parent()
+        .unwrap_or_else(|| Path::new("."))
+        .join(BACKUP_DIR)
+}
+
+/// Check the database this connection is attached to.
+///
+/// `quick_check` rather than `integrity_check`: the difference is that
+/// `quick_check` skips verifying that every index agrees with its table, which
+/// is the expensive half and the half this application least needs — every
+/// index here is derivable, and `REINDEX` fixes one without anybody being
+/// asked a question. What is left still reads every page, and catches the
+/// damage that matters: torn b-trees, a bad freelist, a truncated file.
+///
+/// Returns [`CatalogError::Corrupt`] carrying what SQLite said, so the message
+/// the user sees is the diagnosis rather than a paraphrase of it.
+pub fn integrity_check(conn: &Connection) -> Result<(), CatalogError> {
+    // The argument caps how many problems are reported. One is enough: the
+    // answer is the same whether the file has one damaged page or nine
+    // hundred, and an unbounded check on a badly damaged file can run for a
+    // very long time producing a list nobody will read.
+    let mut stmt = conn.prepare("PRAGMA quick_check(1)")?;
+    let rows: Vec<String> = stmt
+        .query_map([], |r| r.get(0))?
+        .collect::<Result<Vec<_>, _>>()?;
+
+    // A healthy database answers with the single row "ok".
+    if rows.len() == 1 && rows[0] == "ok" {
+        return Ok(());
+    }
+    Err(CatalogError::Corrupt {
+        detail: rows.join("; "),
+    })
+}
+
+/// Check a catalog file that is not currently open.
+///
+/// Used before a restore: a backup is only worth swapping in if it is sound,
+/// and swapping in a second damaged file — leaving the user with no catalog
+/// and no offer left — is the failure this exists to prevent.
+pub fn check_file(path: &Path) -> Result<(), CatalogError> {
+    if !path.is_file() {
+        return Err(CatalogError::Io(format!("{} is missing", path.display())));
+    }
+    // Read-write rather than read-only, which reads oddly for a check. A
+    // backup carries the WAL journal mode in its header because it was copied
+    // page-for-page from a WAL database, and SQLite cannot open one read-only
+    // without a shared-memory file it is then not allowed to create. Nothing
+    // here writes; the connection is opened, read, and dropped.
+    let conn = Connection::open(path)?;
+    integrity_check(&conn)
+}
+
+/// Take a backup of the open catalog.
+///
+/// Returns the file written. Older generations beyond [`KEEP_BACKUPS`] are
+/// pruned, newest kept.
+///
+/// Goes through `crate::sync::copy_to` — SQLite's own backup API after a
+/// TRUNCATE checkpoint — rather than copying the file. A WAL database is not
+/// one file, and `fs::copy` of the main file alone would silently back up a
+/// state that is older than the catalog and possibly torn, which is the one
+/// failure mode a backup cannot afford.
+pub fn backup(conn: &Connection, catalog: &Path) -> Result<PathBuf, CatalogError> {
+    let dir = backup_dir(catalog);
+    std::fs::create_dir_all(&dir)
+        .map_err(|e| CatalogError::Io(format!("creating {}: {e}", dir.display())))?;
+
+    let dest = dir.join(format!("catalog-{}.sqlite", now()));
+    // A second backup within the same second would otherwise land on the first
+    // one's name. Rare, and only reachable from tests and a retry, but the
+    // result would be a half-overwritten backup rather than two.
+    if dest.exists() {
+        std::fs::remove_file(&dest)
+            .map_err(|e| CatalogError::Io(format!("replacing {}: {e}", dest.display())))?;
+    }
+
+    // Dropped immediately: the copy is complete when `copy_to` returns, and
+    // holding the connection open would leave a `-wal` beside a file whose
+    // whole purpose is to be a single self-contained artefact.
+    drop(crate::sync::copy_to(conn, &dest)?);
+
+    prune(catalog);
+    Ok(dest)
+}
+
+/// Back up before a migration, if there is anything to back up.
+///
+/// Called from [`Catalog::open`](crate::Catalog::open) between `configure` and
+/// `migrate`. NFR-R2 asks for this and the reasoning is narrower than "backups
+/// are prudent": a migration is the one routine operation that rewrites table
+/// structure, so it is the likeliest way a catalog becomes unreadable, and it
+/// is the one moment where the pre-change state is still on disk to be copied.
+/// Afterwards there is nothing left to take a copy *of*.
+///
+/// A no-op in the two cases where it would cost without buying anything: a
+/// catalog already at [`schema::SCHEMA_VERSION`], and a brand-new file at
+/// version 0 with no tables in it yet.
+pub fn backup_before_migration(conn: &Connection, catalog: &Path) -> Result<(), CatalogError> {
+    let from: i64 = conn.query_row("PRAGMA user_version", [], |r| r.get(0))?;
+    if from == 0 || from >= schema::SCHEMA_VERSION {
+        return Ok(());
+    }
+    let path = backup(conn, catalog)?;
+    log::info!(
+        "backed up catalog at v{from} to {} before migrating to v{}",
+        path.display(),
+        schema::SCHEMA_VERSION
+    );
+    Ok(())
+}
+
+/// How long a catalog may go without a backup before the next opportunity
+/// takes one.
+///
+/// A day. The catalog is an index, so what a backup protects is the day's
+/// worth of collection and people edits the sidecars do not hold — and a
+/// second copy of a 130 MB file per launch would be a cost with nothing to
+/// show for it when the user launches four times in an afternoon.
+pub const BACKUP_EVERY: i64 = 24 * 60 * 60;
+
+/// Whether [`BACKUP_EVERY`] has passed since the newest backup, or there is
+/// none.
+///
+/// Read from the filenames, like [`backups`], so a restored or copied backup
+/// directory answers the same way it did on the machine it came from.
+pub fn backup_due(catalog: &Path) -> bool {
+    match backups(catalog).first() {
+        Some(newest) => now() - newest.taken_at >= BACKUP_EVERY,
+        None => true,
+    }
+}
+
+/// TRACES: NFR-R2
+/// Take the scheduled backup, if one is due. Returns the file written, or
+/// `None` when the newest is recent enough.
+///
+/// The scheduled half of NFR-R2 — the migration half is
+/// [`backup_before_migration`]. "On a schedule" for an application that runs
+/// when the user opens it means "at the next chance after a day has passed",
+/// and the chance the caller picks is the end of a library sweep: the
+/// catalog is quiet, the work is already off the UI thread, and it is the
+/// moment a day's edits have just been consolidated.
+///
+/// A brand-new catalog with no images is not backed up: there is nothing in
+/// it yet that a rescan would not rebuild, and the first backup would only be
+/// a copy of an empty schema.
+pub fn backup_if_due(conn: &Connection, catalog: &Path) -> Result<Option<PathBuf>, CatalogError> {
+    if !backup_due(catalog) {
+        return Ok(None);
+    }
+    let images: i64 = conn.query_row("SELECT count(*) FROM images", [], |r| r.get(0))?;
+    if images == 0 {
+        return Ok(None);
+    }
+    let path = backup(conn, catalog)?;
+    log::info!("scheduled backup of the catalog to {}", path.display());
+    Ok(Some(path))
+}
+
+/// The backups available for `catalog`, newest first.
+///
+/// Never fails: an unreadable or absent backup directory means there are no
+/// backups, which is a fact about the offer to make rather than an error to
+/// report on top of the corruption the user is already looking at.
+pub fn backups(catalog: &Path) -> Vec<Backup> {
+    let dir = backup_dir(catalog);
+    let Ok(entries) = std::fs::read_dir(&dir) else {
+        return Vec::new();
+    };
+
+    let mut out: Vec<Backup> = entries
+        .flatten()
+        .filter_map(|e| {
+            let path = e.path();
+            let taken_at = timestamp_of(&path)?;
+            let bytes = e.metadata().ok()?.len();
+            Some(Backup {
+                path,
+                taken_at,
+                bytes,
+            })
+        })
+        .collect();
+    out.sort_by_key(|b| std::cmp::Reverse(b.taken_at));
+    out
+}
+
+/// Put a backup back in place of the damaged catalog.
+///
+/// **Every connection to `catalog` must be closed first.** This replaces the
+/// file underneath anything still holding it open, which on a live connection
+/// is how a *second* corrupt catalog gets made.
+///
+/// The order is deliberate:
+///
+/// 1. The backup is checked. A restore that installs a second damaged file
+///    leaves the user with nothing to try next.
+/// 2. The damaged catalog is renamed aside, and its `-wal` and `-shm` are
+///    **deleted**. This is the step that is easy to leave out and fatal to
+///    leave out: a journal belonging to the old file, sitting beside the new
+///    one under the same name, is replayed into it on the next open. That is
+///    not a restore, it is a fresh corruption with the evidence gone.
+/// 3. The backup is *copied* into place, not moved, so a failure here can be
+///    retried against the same backup.
+pub fn restore(catalog: &Path, backup: &Path) -> Result<(), CatalogError> {
+    check_file(backup)?;
+    set_aside(catalog)?;
+    std::fs::copy(backup, catalog).map_err(|e| {
+        CatalogError::Io(format!(
+            "restoring {} from {}: {e}",
+            catalog.display(),
+            backup.display()
+        ))
+    })?;
+    log::info!(
+        "restored {} from backup {}",
+        catalog.display(),
+        backup.display()
+    );
+    Ok(())
+}
+
+/// Move a damaged catalog out of the way so the next open builds a fresh one.
+///
+/// This is the rebuild path (NFR-R6's second offer) and also the first half of
+/// a [`restore`]. Nothing else is needed to rebuild: the next
+/// [`Catalog::open`](crate::Catalog::open) creates an empty catalog at the
+/// current schema, and the ordinary scan repopulates it from sources and
+/// sidecars — which is precisely invariant §5.2.4 being spent rather than
+/// merely asserted.
+///
+/// Returns where the damaged file was put, or `None` if there was no catalog
+/// to move — a caller may be recovering from a file SQLite could not open
+/// because it was never created.
+pub fn set_aside(catalog: &Path) -> Result<Option<PathBuf>, CatalogError> {
+    let moved = if catalog.exists() {
+        let dest = with_suffix(catalog, DAMAGED_SUFFIX);
+        // An earlier damaged copy is replaced rather than accumulating: two of
+        // these is two full-size catalogs on the user's disk, and the older
+        // one has already been superseded by a recovery the user completed.
+        let _ = std::fs::remove_file(&dest);
+        // The rename first, so that a failure here leaves the journals with
+        // the file they belong to rather than orphaned beside a catalog that
+        // is still in use.
+        std::fs::rename(catalog, &dest).map_err(|e| {
+            CatalogError::Io(format!(
+                "setting aside {} as {}: {e}",
+                catalog.display(),
+                dest.display()
+            ))
+        })?;
+        log::warn!(
+            "catalog {} was damaged; kept as {}",
+            catalog.display(),
+            dest.display()
+        );
+        Some(dest)
+    } else {
+        None
+    };
+
+    // Then the journals, whether or not there was a catalog to move: a `-wal`
+    // orphaned beside a missing database is replayed into whatever takes that
+    // name next, which would not be a restore but a fresh corruption with the
+    // evidence gone.
+    for sidecar in journals(catalog) {
+        if let Err(e) = std::fs::remove_file(&sidecar) {
+            if e.kind() != std::io::ErrorKind::NotFound {
+                return Err(CatalogError::Io(format!(
+                    "removing stale journal {}: {e}",
+                    sidecar.display()
+                )));
+            }
+        }
+    }
+
+    Ok(moved)
+}
+
+/// Delete backups beyond [`KEEP_BACKUPS`].
+///
+/// Best-effort and silent about individual failures: failing to delete an old
+/// backup is not a reason to fail the new one, which is already written.
+fn prune(catalog: &Path) {
+    for old in backups(catalog).into_iter().skip(KEEP_BACKUPS) {
+        if let Err(e) = std::fs::remove_file(&old.path) {
+            log::warn!("could not prune backup {}: {e}", old.path.display());
+        }
+    }
+}
+
+/// The WAL and shared-memory files SQLite keeps beside a database.
+fn journals(catalog: &Path) -> [PathBuf; 2] {
+    [with_suffix(catalog, "wal"), with_suffix(catalog, "shm")]
+}
+
+/// `catalog.sqlite` plus `-suffix`, the way SQLite names its own sidecars.
+///
+/// Appended to the whole filename rather than replacing the extension, so
+/// `catalog.sqlite-wal` is what SQLite would look for and `catalog.sqlite-
+/// damaged` sorts next to the catalog it came from.
+fn with_suffix(catalog: &Path, suffix: &str) -> PathBuf {
+    let mut s = catalog.as_os_str().to_os_string();
+    s.push("-");
+    s.push(suffix);
+    PathBuf::from(s)
+}
+
+/// Read the timestamp out of a backup's filename, or `None` if this is not one.
+///
+/// Doubles as the filter that keeps [`backups`] from offering the user
+/// something that is not a catalog — a stray file in the directory, or a `-wal`
+/// left by a crash mid-backup.
+fn timestamp_of(path: &Path) -> Option<i64> {
+    let name = path.file_name()?.to_str()?;
+    name.strip_prefix("catalog-")?
+        .strip_suffix(".sqlite")?
+        .parse()
+        .ok()
+}
+
+/// Seconds since the epoch, or 0 if the clock is before it.
+fn now() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::Catalog;
+    use std::io::{Seek, SeekFrom, Write};
+
+    /// A scratch directory that cleans up with the test.
+    fn tempdir(tag: &str) -> PathBuf {
+        let base = std::env::temp_dir().join(format!(
+            "dr-recovery-{tag}-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&base);
+        std::fs::create_dir_all(&base).unwrap();
+        base
+    }
+
+    #[test]
+    fn a_scheduled_backup_is_taken_once_a_day_and_not_more() {
+        let dir = tempdir("scheduled");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 3);
+        let cat = Catalog::open(&path).unwrap();
+
+        // Nothing yet: due.
+        assert!(backup_due(&path));
+        let first = backup_if_due(cat.connection(), &path).unwrap();
+        assert!(first.is_some(), "the first opportunity takes one");
+
+        // Taken just now: not due, and a second call does nothing.
+        assert!(!backup_due(&path));
+        assert_eq!(backup_if_due(cat.connection(), &path).unwrap(), None);
+        assert_eq!(backups(&path).len(), 1);
+
+        // Age the one backup past the interval by renaming it, since the
+        // timestamp is read from the name. Now it is due again.
+        let old = first.unwrap();
+        let aged = old
+            .parent()
+            .unwrap()
+            .join(format!("catalog-{}.sqlite", now() - BACKUP_EVERY - 1));
+        std::fs::rename(&old, &aged).unwrap();
+        assert!(backup_due(&path));
+        assert!(backup_if_due(cat.connection(), &path).unwrap().is_some());
+        assert_eq!(backups(&path).len(), 2);
+
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn an_empty_catalog_is_not_worth_backing_up() {
+        let dir = tempdir("empty");
+        let path = dir.join("catalog.sqlite");
+        let cat = Catalog::open(&path).unwrap();
+        assert!(backup_due(&path), "due in principle");
+        assert_eq!(backup_if_due(cat.connection(), &path).unwrap(), None);
+        assert!(backups(&path).is_empty());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A catalog on disk with enough rows to span several pages, closed.
+    ///
+    /// Closed matters: WAL means the rows are in `catalog.sqlite-wal` until
+    /// something checkpoints, and a test that corrupted the main file while
+    /// the data was still in the journal would be corrupting empty space.
+    fn fixture(path: &Path, images: i64) {
+        let cat = Catalog::open(path).unwrap();
+        let c = cat.connection();
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO collections(uuid, name, kind, created, revision, modified)
+             VALUES ('u1', 'Iceland', 0, 0, 1, 1)",
+            [],
+        )
+        .unwrap();
+        for i in 1..=images {
+            c.execute(
+                "INSERT INTO images(id, root_id, source_ref, added_at)
+                 VALUES (?1, 1, ?2, 0)",
+                rusqlite::params![i, format!("DCIM/IMG_{i:05}.CR3")],
+            )
+            .unwrap();
+        }
+        crate::sync::checkpoint(c).unwrap();
+        drop(cat);
+    }
+
+    /// Scribble over everything past the first two pages.
+    ///
+    /// Past them rather than over them so that page 1 — the header and the
+    /// schema — survives: this produces a file SQLite is willing to open and
+    /// then finds damaged, which is the case `quick_check` exists for. Wiping
+    /// the header instead produces `SQLITE_NOTADB` at the first pragma, which
+    /// is a different branch and has its own test.
+    fn corrupt(path: &Path) {
+        let mut f = std::fs::OpenOptions::new().write(true).open(path).unwrap();
+        let len = f.metadata().unwrap().len();
+        assert!(
+            len > 8192,
+            "fixture is only {len} bytes; corrupting past page 2 would be a no-op"
+        );
+        let junk = vec![0x5a_u8; (len - 8192) as usize];
+        f.seek(SeekFrom::Start(8192)).unwrap();
+        f.write_all(&junk).unwrap();
+        f.sync_all().unwrap();
+    }
+
+    #[test]
+    fn a_healthy_catalog_passes() {
+        let cat = Catalog::in_memory().unwrap();
+        integrity_check(cat.connection()).unwrap();
+    }
+
+    #[test]
+    fn a_corrupt_catalog_is_reported_as_corrupt_not_as_sqlite() {
+        // The whole point of the variant: this used to arrive as whatever
+        // rusqlite error the first failing query produced, with nowhere to
+        // hang a recovery offer.
+        let dir = tempdir("detect");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 500);
+        corrupt(&path);
+
+        assert!(matches!(
+            Catalog::open_verified(&path),
+            Err(CatalogError::Corrupt { .. })
+        ));
+    }
+
+    #[test]
+    fn a_file_that_is_not_a_database_is_also_corrupt() {
+        // A truncated or overwritten catalog never reaches `quick_check`: the
+        // first pragma fails with SQLITE_NOTADB. Same accident to the user,
+        // same two offers, so it must classify the same way.
+        let dir = tempdir("notadb");
+        let path = dir.join("catalog.sqlite");
+        std::fs::write(&path, b"this is not a catalog, it is a text file\n").unwrap();
+
+        assert!(matches!(
+            Catalog::open(&path),
+            Err(CatalogError::Corrupt { .. })
+        ));
+    }
+
+    #[test]
+    fn restoring_a_backup_recovers_the_collections_a_rebuild_would_lose() {
+        // The first NFR-R6 branch, asserted on the thing that distinguishes it
+        // from the second: a collection exists nowhere but the catalog, so it
+        // is the evidence that the *contents* came back and not merely a
+        // readable file (docs/dev/catalog.md §8.1).
+        let dir = tempdir("restore");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 500);
+
+        {
+            let cat = Catalog::open(&path).unwrap();
+            backup(cat.connection(), &path).unwrap();
+        }
+        corrupt(&path);
+        assert!(matches!(
+            Catalog::open_verified(&path),
+            Err(CatalogError::Corrupt { .. })
+        ));
+
+        let newest = backups(&path).into_iter().next().expect("a backup exists");
+        restore(&path, &newest.path).unwrap();
+
+        let cat = Catalog::open_verified(&path).unwrap();
+        let name: String = cat
+            .connection()
+            .query_row("SELECT name FROM collections", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(name, "Iceland");
+        let images: i64 = cat
+            .connection()
+            .query_row("SELECT count(*) FROM images", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(images, 500);
+    }
+
+    #[test]
+    fn a_damaged_backup_is_refused_rather_than_installed() {
+        let dir = tempdir("badbackup");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 500);
+        {
+            let cat = Catalog::open(&path).unwrap();
+            backup(cat.connection(), &path).unwrap();
+        }
+        let newest = backups(&path).into_iter().next().unwrap();
+        corrupt(&newest.path);
+        corrupt(&path);
+
+        assert!(matches!(
+            restore(&path, &newest.path),
+            Err(CatalogError::Corrupt { .. })
+        ));
+        // And the damaged catalog is still where it was, so the second offer
+        // is still available.
+        assert!(path.exists());
+    }
+
+    #[test]
+    fn setting_aside_leaves_a_fresh_catalog_to_rebuild_into() {
+        // The second NFR-R6 branch. What makes it a rebuild rather than a data
+        // loss is invariant §5.2.4, which lives outside this crate — what is
+        // testable here is that the damaged file is out of the way, kept, and
+        // that the next open succeeds on an empty catalog at the current
+        // schema, which is what a scan then fills.
+        let dir = tempdir("rebuild");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 500);
+        corrupt(&path);
+
+        let kept = set_aside(&path).unwrap().expect("the catalog was there");
+        assert!(kept.exists(), "the damaged catalog was deleted, not kept");
+        assert!(!path.exists());
+
+        let cat = Catalog::open_verified(&path).unwrap();
+        let images: i64 = cat
+            .connection()
+            .query_row("SELECT count(*) FROM images", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(images, 0);
+        let v: i64 = cat
+            .connection()
+            .query_row("PRAGMA user_version", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(v, schema::SCHEMA_VERSION);
+    }
+
+    #[test]
+    fn a_stale_journal_does_not_follow_the_catalog_into_recovery() {
+        // The step that is easy to omit: a `-wal` belonging to the damaged
+        // file is replayed into whatever takes its name next.
+        let dir = tempdir("journal");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 500);
+        std::fs::write(with_suffix(&path, "wal"), b"stale").unwrap();
+
+        set_aside(&path).unwrap();
+        assert!(!with_suffix(&path, "wal").exists());
+    }
+
+    #[test]
+    fn a_migration_is_backed_up_before_it_runs() {
+        // NFR-R2's second clause, against a real v1 catalog rather than a
+        // faked version number: the point is not that *a* file appears but
+        // that it holds the state from before the migration, which is the only
+        // state that is any use if the migration is what breaks it.
+        let dir = tempdir("premigrate");
+        let path = dir.join("catalog.sqlite");
+        {
+            let c = Connection::open(&path).unwrap();
+            schema::configure(&c).unwrap();
+            // `v1_for_attached` names the schema it targets, and "main" is a
+            // schema like any other — so this is the real v1, without needing
+            // `V1` itself to become visible outside its module.
+            c.execute_batch(&schema::v1_for_attached("main")).unwrap();
+            c.pragma_update(None, "user_version", 1).unwrap();
+            c.execute(
+                "INSERT INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+                [],
+            )
+            .unwrap();
+            crate::sync::checkpoint(&c).unwrap();
+        }
+        assert!(backups(&path).is_empty());
+
+        Catalog::open(&path).unwrap();
+
+        let taken = backups(&path);
+        assert_eq!(taken.len(), 1, "no backup was taken before the migration");
+        check_file(&taken[0].path).unwrap();
+        let kept = Connection::open(&taken[0].path).unwrap();
+        let v: i64 = kept
+            .query_row("PRAGMA user_version", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(v, 1, "the backup was taken after the migration, not before");
+    }
+
+    #[test]
+    fn opening_an_up_to_date_catalog_takes_no_backup() {
+        // Or every background task that opens the catalog would copy it.
+        let dir = tempdir("nobackup");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 10);
+        Catalog::open(&path).unwrap();
+        assert!(backups(&path).is_empty());
+    }
+
+    #[test]
+    fn only_the_newest_generations_are_kept() {
+        let dir = tempdir("prune");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 10);
+        let cat = Catalog::open(&path).unwrap();
+
+        // Written by hand rather than by calling `backup` in a loop: the
+        // filename carries whole seconds, so real calls would collide.
+        std::fs::create_dir_all(backup_dir(&path)).unwrap();
+        for t in 1..=KEEP_BACKUPS as i64 + 2 {
+            drop(
+                crate::sync::copy_to(
+                    cat.connection(),
+                    &backup_dir(&path).join(format!("catalog-{t}.sqlite")),
+                )
+                .unwrap(),
+            );
+        }
+        prune(&path);
+
+        let kept = backups(&path);
+        assert_eq!(kept.len(), KEEP_BACKUPS);
+        // Newest first, and the newest is the highest timestamp.
+        assert_eq!(kept[0].taken_at, KEEP_BACKUPS as i64 + 2);
+    }
+
+    #[test]
+    fn a_stray_file_in_the_backup_directory_is_not_offered_as_one() {
+        let dir = tempdir("stray");
+        let path = dir.join("catalog.sqlite");
+        fixture(&path, 10);
+        std::fs::create_dir_all(backup_dir(&path)).unwrap();
+        std::fs::write(backup_dir(&path).join("notes.txt"), b"hello").unwrap();
+        std::fs::write(backup_dir(&path).join("catalog-7.sqlite-wal"), b"x").unwrap();
+
+        assert!(backups(&path).is_empty());
+    }
+}

core/dr-catalog/src/runner.rs

@@ -0,0 +1,935 @@
+//! TRACES: FR-PLAT-AND-4 | FR-PLAT-AND-3
+//! The thing that drains the queue.
+//!
+//! [`crate::jobs`] has been a complete, durable, coalescing work queue since
+//! the catalog was written, and nothing has ever taken a job out of it. Every
+//! producer — the local walk, the remote scan — called `enqueue` and no one
+//! called `claim_next`, so the table grew one row per photograph and stayed
+//! that size forever. This module is the missing half.
+//!
+//! # Why the runner is driven rather than self-owning
+//!
+//! The obvious shape is a thread that loops until the queue is empty, and it
+//! is the wrong one. On Android the process does not decide when background
+//! work may run: `WorkManager` does, subject to Doze, battery saver and the
+//! metered-network constraints in FR-NC-6, and it revokes permission mid-job
+//! by calling `onStopped()` (FR-PLAT-AND-4). A foreground service for a
+//! user-initiated export gets a longer leash but still not an unbounded one.
+//!
+//! So the runner owns no thread, no clock and no policy. It exposes
+//! [`Runner::run_one`] — claim one job, run it, record what happened — and
+//! [`Runner::drain`], which repeats that against a [`Budget`] and a
+//! cancellation flag the host owns. A `Worker.doWork()` that must return
+//! within ten minutes calls `drain` with a deadline; a desktop idle loop calls
+//! it with none. Neither has to reach inside.
+//!
+//! Everything the host supplies is passed in for the same reason `jobs` takes
+//! `now` rather than reading the clock: a scheduler is exactly the thing that
+//! has to be testable without waiting.
+//!
+//! # Why interruption is not failure
+//!
+//! Four things can happen to a claimed job, and only two of them are the job's
+//! fault:
+//!
+//! - [`Outcome::Done`] — the row is deleted.
+//! - [`Outcome::Retry`] — the work failed and might succeed later. Backoff,
+//!   and eventually [`crate::jobs::MAX_ATTEMPTS`] gives up on it.
+//! - [`Outcome::Abandon`] — the work cannot succeed, ever. Failing five times
+//!   over five minutes to learn that is five minutes of a phone's battery.
+//! - [`Outcome::Interrupted`] — the *host* stopped, not the job. The claim is
+//!   released and the attempt it consumed is given back, because a user who
+//!   pulled the app off the screen has not told us anything about the file.
+//!
+//! Process death is the fifth case and the one that cannot report itself: the
+//! row simply stays `Running` with no owner. [`Runner::recover`] is what
+//! reclaims it, and it is why an interrupted job is resumable rather than lost
+//! (FR-PLAT-AND-3). It must run **before** any worker starts against a
+//! catalog, or it will steal a job another runner is holding — there is no
+//! owner column to tell them apart.
+
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use rusqlite::Connection;
+
+use crate::error::CatalogError;
+use crate::jobs::{self, Job, JobKind};
+
+/// What running a job turned out to be.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Outcome {
+    /// The work is done. The row goes away.
+    Done,
+    /// It failed, and trying again later is reasonable. Backoff applies, and
+    /// [`crate::jobs::MAX_ATTEMPTS`] eventually stops it.
+    Retry(String),
+    /// It failed in a way no retry can fix — the subject is gone, the payload
+    /// is unreadable, the format is one this build does not know. Marked
+    /// failed at once rather than burning the whole retry ladder to reach the
+    /// same answer.
+    Abandon(String),
+    /// The host is stopping, and the job never really ran.
+    ///
+    /// Distinct from `Retry` because it costs no attempt: `onStopped()` five
+    /// times in a row would otherwise mark a perfectly good job as failed.
+    Interrupted,
+}
+
+/// Something that can actually do the work a job describes.
+///
+/// The catalog knows what needs doing and nothing about how — a thumbnail
+/// needs a decoder, a fetch needs a network stack, and neither belongs under
+/// `core/dr-catalog` (ARCH §4.1: calls go downward). So the queue lives here
+/// and the handlers are supplied from above.
+pub trait JobHandler {
+    /// The kinds this handler will accept.
+    ///
+    /// Load-bearing, not documentation: the runner claims **only** kinds some
+    /// handler declares. A queue holding `FetchOriginal` rows on a device with
+    /// no connector must leave them alone rather than claim them and fail
+    /// them, and a runner that claimed everything would do exactly that — five
+    /// times each, with backoff, on battery.
+    fn kinds(&self) -> &[JobKind];
+
+    /// Do the work.
+    ///
+    /// The connection is offered because most handlers write their result back
+    /// into the catalog; one that does not is free to ignore it. It is the
+    /// runner's own connection, so a handler must not hold a transaction open
+    /// across a network call — the runner needs it back to record the outcome.
+    fn run(&mut self, conn: &Connection, job: &Job) -> Outcome;
+}
+
+/// How much work a host is willing to let one drain do.
+///
+/// Both limits are checked *before* a job is claimed, never during one: a
+/// handler is opaque and may be halfway through writing a sidecar. Overrunning
+/// a deadline by one job is survivable; being killed mid-write is the thing
+/// [`Runner::recover`] exists to clean up after.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct Budget {
+    /// Stop after this many jobs. `None` means "until the queue is empty".
+    pub max_jobs: Option<usize>,
+    /// Stop once the clock reaches this second. Same clock the drain is given.
+    pub deadline: Option<i64>,
+}
+
+impl Budget {
+    /// Run until nothing is left. What a desktop idle pass wants.
+    pub const UNLIMITED: Self = Self {
+        max_jobs: None,
+        deadline: None,
+    };
+
+    /// At most `n` jobs. A slice small enough to stay responsive.
+    pub fn jobs(n: usize) -> Self {
+        Self {
+            max_jobs: Some(n),
+            ..Self::UNLIMITED
+        }
+    }
+
+    /// Until the clock reaches `deadline`. What a `WorkManager` slot wants.
+    pub fn until(deadline: i64) -> Self {
+        Self {
+            deadline: Some(deadline),
+            ..Self::UNLIMITED
+        }
+    }
+}
+
+/// Why a drain stopped.
+///
+/// Worth distinguishing because the host's next move differs: `Drained` means
+/// there is nothing to reschedule for, and the other three all mean "there is
+/// more, ask again".
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub enum Stopped {
+    /// Nothing claimable is left.
+    #[default]
+    Drained,
+    /// The job count ran out.
+    Budget,
+    /// The clock ran out.
+    Deadline,
+    /// The host asked it to stop, or a handler reported itself interrupted.
+    Cancelled,
+}
+
+impl Stopped {
+    /// Whether the queue may still hold claimable work.
+    pub fn more_to_do(self) -> bool {
+        self != Stopped::Drained
+    }
+}
+
+/// What one drain did.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct DrainReport {
+    pub completed: usize,
+    pub retried: usize,
+    pub abandoned: usize,
+    pub interrupted: usize,
+    pub stopped: Stopped,
+}
+
+impl DrainReport {
+    /// Jobs claimed, whatever became of them. This is what a budget counts.
+    pub fn ran(&self) -> usize {
+        self.completed + self.retried + self.abandoned + self.interrupted
+    }
+}
+
+/// What a recovery pass found waiting from the last run.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+pub struct Recovered {
+    /// Jobs a dead process was holding. These are the resumed ones.
+    pub reclaimed: usize,
+    /// Jobs deleted because the photograph they name no longer exists.
+    pub reaped: usize,
+}
+
+impl Recovered {
+    pub fn did_anything(&self) -> bool {
+        self.reclaimed > 0 || self.reaped > 0
+    }
+}
+
+/// Ready the queue for a fresh run, before any worker touches it.
+///
+/// Two distinct cleanups, and both are startup-only:
+///
+/// - **Reclaim.** A `Running` row has no owner; the process that claimed it is
+///   gone. On Android that is a routine morning, not a crash (FR-PLAT-AND-3).
+///   The attempt it consumed is *kept*, deliberately: a job that takes the
+///   process down with it three times running should not be retried forever,
+///   and the attempt counter is the only evidence of that we have.
+/// - **Reap.** Jobs naming an image the catalog no longer has. A library that
+///   has been culled leaves thumbnail jobs for photographs that were deleted
+///   months ago, and every one of them would be claimed, run and failed.
+///
+/// Reclaim runs first so its count is the honest number of interrupted jobs,
+/// before reaping removes whichever of them pointed at nothing.
+///
+/// **Call this exactly once per catalog, at startup.** It cannot distinguish a
+/// job a dead process was holding from one a live runner is holding right now,
+/// because there is no owner column — the queue is durable, not distributed.
+pub fn recover(conn: &Connection) -> Result<Recovered, CatalogError> {
+    Ok(Recovered {
+        reclaimed: jobs::recover_orphaned(conn)?,
+        reaped: jobs::reap_orphan_subjects(conn)?,
+    })
+}
+
+/// Claims work, runs it, and records what happened.
+///
+/// Borrows its connection rather than owning one so a host can drive it from
+/// the same handle it already has open. Nothing here spawns a thread; several
+/// runners on several threads, each with its own connection to the same
+/// catalog, are safe because the claim is a single atomic statement (see
+/// [`crate::jobs::claim_next`]).
+pub struct Runner<'a> {
+    conn: &'a Connection,
+    handlers: Vec<Box<dyn JobHandler + 'a>>,
+    /// The union of every handler's kinds, cached because it is passed to
+    /// every claim. This is what stops the runner claiming work it cannot do.
+    claimable: Vec<JobKind>,
+}
+
+impl<'a> Runner<'a> {
+    /// A runner with no handlers. It can recover, and it can claim nothing.
+    pub fn new(conn: &'a Connection) -> Self {
+        Self {
+            conn,
+            handlers: Vec::new(),
+            claimable: Vec::new(),
+        }
+    }
+
+    /// Add a handler.
+    pub fn with(self, handler: impl JobHandler + 'a) -> Self {
+        self.with_boxed(Box::new(handler))
+    }
+
+    /// Add a handler chosen at runtime — a network one only where there is a
+    /// connector, a decoding one only where there is a decoder.
+    pub fn with_boxed(mut self, handler: Box<dyn JobHandler + 'a>) -> Self {
+        for kind in handler.kinds() {
+            if !self.claimable.contains(kind) {
+                self.claimable.push(*kind);
+            }
+        }
+        self.handlers.push(handler);
+        self
+    }
+
+    /// The kinds this runner will claim. Useful to a host deciding whether
+    /// starting it is worth waking the radio for.
+    pub fn claimable(&self) -> &[JobKind] {
+        &self.claimable
+    }
+
+    /// See [`recover`]. Offered here too so a host has one thing to hold.
+    pub fn recover(&self) -> Result<Recovered, CatalogError> {
+        recover(self.conn)
+    }
+
+    /// Claim one job, run it, and record the outcome.
+    ///
+    /// `Ok(None)` means nothing this runner can do is claimable *now* — the
+    /// queue may still hold work of other kinds, or work still backing off.
+    pub fn run_one(&mut self, now: i64) -> Result<Option<Ran>, CatalogError> {
+        // Copied out before `self.handlers` is borrowed mutably below. Both
+        // are fields of `self`, but the copy is what lets the two borrows
+        // coexist without the connection being reborrowed through `self`.
+        let conn = self.conn;
+
+        let Some(job) = jobs::claim_next_matching(conn, now, &self.claimable)? else {
+            return Ok(None);
+        };
+
+        let outcome = match self
+            .handlers
+            .iter_mut()
+            .find(|h| h.kinds().contains(&job.kind))
+        {
+            Some(handler) => handler.run(conn, &job),
+            // Unreachable by construction: `claimable` is exactly the union of
+            // the handlers' kinds. Parked rather than released, because
+            // releasing it would put it straight back where the next turn of
+            // the drain loop would claim it again, forever.
+            None => Outcome::Abandon(format!("no handler for {:?}", job.kind)),
+        };
+
+        match &outcome {
+            Outcome::Done => jobs::complete(conn, job.id)?,
+            Outcome::Retry(why) => jobs::fail(conn, &job, now, why)?,
+            Outcome::Abandon(why) => jobs::abandon(conn, job.id, why)?,
+            Outcome::Interrupted => jobs::release(conn, &job)?,
+        }
+
+        Ok(Some(Ran { job, outcome }))
+    }
+
+    /// Run jobs until the budget, the flag or the queue says stop.
+    ///
+    /// `clock` is called once per iteration rather than sampled once, because
+    /// the two things it feeds both move during a long drain: the deadline
+    /// check, and the `now` a failing job's backoff is measured from.
+    ///
+    /// Cancellation is checked between jobs only. A handler that wants to bail
+    /// out of work already started says so with [`Outcome::Interrupted`],
+    /// which also ends the drain — otherwise a handler that always interrupts
+    /// would release its job and be handed it straight back.
+    pub fn drain(
+        &mut self,
+        clock: &dyn Fn() -> i64,
+        budget: Budget,
+        cancel: &AtomicBool,
+    ) -> Result<DrainReport, CatalogError> {
+        let mut report = DrainReport::default();
+
+        loop {
+            // Relaxed: the flag is a one-way latch set by another thread and
+            // the only thing ordered against it is our own next claim. Missing
+            // one turn of the loop costs a job, not correctness.
+            if cancel.load(Ordering::Relaxed) {
+                report.stopped = Stopped::Cancelled;
+                break;
+            }
+            if budget.max_jobs.is_some_and(|max| report.ran() >= max) {
+                report.stopped = Stopped::Budget;
+                break;
+            }
+
+            let now = clock();
+            if budget.deadline.is_some_and(|end| now >= end) {
+                report.stopped = Stopped::Deadline;
+                break;
+            }
+
+            let Some(ran) = self.run_one(now)? else {
+                report.stopped = Stopped::Drained;
+                break;
+            };
+
+            match ran.outcome {
+                Outcome::Done => report.completed += 1,
+                Outcome::Retry(_) => report.retried += 1,
+                Outcome::Abandon(_) => report.abandoned += 1,
+                Outcome::Interrupted => {
+                    report.interrupted += 1;
+                    report.stopped = Stopped::Cancelled;
+                    break;
+                }
+            }
+        }
+
+        Ok(report)
+    }
+
+    /// Drain with no budget and no cancellation, at a fixed instant.
+    ///
+    /// Terminates because a job that fails is pushed past `now` by its backoff
+    /// and stops being claimable at this instant.
+    pub fn drain_all(&mut self, now: i64) -> Result<DrainReport, CatalogError> {
+        static NEVER: AtomicBool = AtomicBool::new(false);
+        self.drain(&|| now, Budget::UNLIMITED, &NEVER)
+    }
+}
+
+/// One job and what became of it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Ran {
+    pub job: Job,
+    pub outcome: Outcome,
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::{Path, PathBuf};
+    use std::sync::{Arc, Mutex};
+
+    use super::*;
+    use crate::jobs::{enqueue, JobState, Priority, MAX_ATTEMPTS};
+    use crate::schema;
+
+    /// A handler built from a closure, so each test states its own behaviour.
+    struct Fake<F> {
+        kinds: Vec<JobKind>,
+        act: F,
+    }
+
+    impl<F: FnMut(&Job) -> Outcome> JobHandler for Fake<F> {
+        fn kinds(&self) -> &[JobKind] {
+            &self.kinds
+        }
+        fn run(&mut self, _conn: &Connection, job: &Job) -> Outcome {
+            (self.act)(job)
+        }
+    }
+
+    fn handler<F: FnMut(&Job) -> Outcome>(kinds: &[JobKind], act: F) -> Fake<F> {
+        Fake {
+            kinds: kinds.to_vec(),
+            act,
+        }
+    }
+
+    /// A handler that records which subjects it saw and always succeeds.
+    ///
+    /// Takes its kinds by value and borrows nothing, so the returned handler is
+    /// `Send + 'static` and can be moved into a worker thread — which the
+    /// contention test needs.
+    fn recording(kinds: Vec<JobKind>, seen: Arc<Mutex<Vec<i64>>>) -> impl JobHandler + Send {
+        Fake {
+            kinds,
+            act: move |job: &Job| {
+                seen.lock().unwrap().push(job.subject_id.unwrap_or(-1));
+                Outcome::Done
+            },
+        }
+    }
+
+    fn db() -> Connection {
+        let c = Connection::open_in_memory().unwrap();
+        schema::configure(&c).unwrap();
+        schema::migrate(&c).unwrap();
+        c
+    }
+
+    /// An image row, so a job has a subject that exists.
+    fn image(c: &Connection, id: i64) {
+        c.execute(
+            "INSERT INTO roots(id, kind, label) VALUES (1, 'local', '/lib')
+             ON CONFLICT DO NOTHING",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at) VALUES (?1, 1, ?2, 0)",
+            rusqlite::params![id, format!("/lib/{id}.CR3")],
+        )
+        .unwrap();
+    }
+
+    fn queued(c: &Connection, kind: JobKind, subject: i64) {
+        image(c, subject);
+        enqueue(c, kind, Some(subject), Priority::Background, None).unwrap();
+    }
+
+    fn rows(c: &Connection) -> i64 {
+        c.query_row("SELECT count(*) FROM jobs", [], |r| r.get(0))
+            .unwrap()
+    }
+
+    /// A catalog on disk, so more than one connection can open it.
+    fn temp_catalog(name: &str) -> PathBuf {
+        let dir = std::env::temp_dir().join(format!(
+            "dr-runner-{name}-{}-{:?}",
+            std::process::id(),
+            std::thread::current().id()
+        ));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        dir.join("catalog.db")
+    }
+
+    fn open(path: &Path) -> Connection {
+        let c = Connection::open(path).unwrap();
+        schema::configure(&c).unwrap();
+        schema::migrate(&c).unwrap();
+        // Several connections write to this file at once in the contention
+        // tests. Without a busy handler the loser of a race gets an error
+        // instead of a turn.
+        c.busy_timeout(std::time::Duration::from_secs(10)).unwrap();
+        c
+    }
+
+    #[test]
+    fn a_completed_job_leaves_the_queue() {
+        // The whole finding in one assertion: before this module, the row
+        // stayed forever because nothing ever claimed it.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let report = Runner::new(&c)
+            .with(recording(vec![JobKind::Thumbnail], seen.clone()))
+            .drain_all(0)
+            .unwrap();
+
+        assert_eq!(report.completed, 1);
+        assert_eq!(report.stopped, Stopped::Drained);
+        assert_eq!(*seen.lock().unwrap(), vec![1]);
+        assert_eq!(rows(&c), 0, "a completed job leaves no row behind");
+    }
+
+    #[test]
+    fn a_failed_job_backs_off_and_is_claimed_again_later() {
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+
+        // A `Cell` rather than a captured `bool`, so the closure's mutability
+        // is its own business and the test reads the same either way.
+        let failed_once = std::cell::Cell::new(false);
+        let mut runner = Runner::new(&c).with(handler(&[JobKind::Thumbnail], |_| {
+            if failed_once.replace(true) {
+                Outcome::Done
+            } else {
+                Outcome::Retry("decoder said no".into())
+            }
+        }));
+
+        let first = runner.drain_all(100).unwrap();
+        assert_eq!(first.retried, 1);
+        assert_eq!(rows(&c), 1, "a retryable failure keeps its row");
+
+        // Still inside the backoff window: nothing claimable, so the drain
+        // reports itself drained rather than spinning on the same job.
+        assert_eq!(runner.drain_all(100).unwrap().ran(), 0);
+
+        let later = runner.drain_all(100 + jobs::backoff_seconds(1)).unwrap();
+        assert_eq!(later.completed, 1);
+        assert_eq!(rows(&c), 0);
+    }
+
+    #[test]
+    fn a_job_that_keeps_failing_is_given_up_on() {
+        // FR-RAW-4: one corrupt file must not stall the queue behind endless
+        // retries. Driven through the runner rather than by hand, because the
+        // runner is what a corrupt file will actually meet.
+        let c = db();
+        queued(&c, JobKind::ExtractMetadata, 1);
+
+        let mut runner = Runner::new(&c).with(handler(&[JobKind::ExtractMetadata], |_| {
+            Outcome::Retry("corrupt file".into())
+        }));
+
+        let mut now = 0;
+        for _ in 0..MAX_ATTEMPTS {
+            assert_eq!(runner.drain_all(now).unwrap().retried, 1);
+            now += jobs::backoff_seconds(MAX_ATTEMPTS);
+        }
+
+        assert_eq!(runner.drain_all(now + 100_000).unwrap().ran(), 0);
+        let state: i64 = c
+            .query_row("SELECT state FROM jobs", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(state, JobState::Failed as i64);
+    }
+
+    #[test]
+    fn an_abandoned_job_is_not_retried_at_all() {
+        // The difference that matters on battery: five failures spread over
+        // five minutes to learn what the first one already said.
+        let c = db();
+        queued(&c, JobKind::FetchOriginal, 1);
+
+        let mut runner = Runner::new(&c).with(handler(&[JobKind::FetchOriginal], |_| {
+            Outcome::Abandon("no connector on this device".into())
+        }));
+
+        assert_eq!(runner.drain_all(0).unwrap().abandoned, 1);
+        // One attempt, not MAX_ATTEMPTS, and never claimable again.
+        assert_eq!(runner.drain_all(1_000_000).unwrap().ran(), 0);
+        let (state, attempts): (i64, i64) = c
+            .query_row("SELECT state, attempts FROM jobs", [], |r| {
+                Ok((r.get(0)?, r.get(1)?))
+            })
+            .unwrap();
+        assert_eq!(state, JobState::Failed as i64);
+        assert_eq!(attempts, 1);
+    }
+
+    #[test]
+    fn an_interrupted_job_costs_no_attempt_and_ends_the_drain() {
+        // `onStopped()` says nothing about the file. Charging it an attempt
+        // would let five backgroundings mark good work as failed.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::Thumbnail, 2);
+
+        let report = Runner::new(&c)
+            .with(handler(&[JobKind::Thumbnail], |_| Outcome::Interrupted))
+            .drain_all(0)
+            .unwrap();
+
+        assert_eq!(report.interrupted, 1);
+        assert_eq!(
+            report.stopped,
+            Stopped::Cancelled,
+            "an interrupted job must end the drain, or releasing it hands it \
+             straight back and the loop never ends"
+        );
+        let (state, attempts): (i64, i64) = c
+            .query_row(
+                "SELECT state, attempts FROM jobs WHERE subject_id = 1",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        assert_eq!(state, JobState::Pending as i64);
+        assert_eq!(attempts, 0, "the claim's speculative attempt is given back");
+    }
+
+    #[test]
+    fn only_kinds_a_handler_covers_are_claimed() {
+        // A device with no connector must leave `FetchOriginal` where it is.
+        // Claiming it to fail it would cost five attempts and five backoffs
+        // per photograph, on battery, to reach a conclusion known in advance.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::FetchOriginal, 2);
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let report = Runner::new(&c)
+            .with(recording(vec![JobKind::Thumbnail], seen.clone()))
+            .drain_all(0)
+            .unwrap();
+
+        assert_eq!(report.completed, 1);
+        assert_eq!(*seen.lock().unwrap(), vec![1]);
+
+        let (state, attempts): (i64, i64) = c
+            .query_row(
+                "SELECT state, attempts FROM jobs WHERE subject_id = 2",
+                [],
+                |r| Ok((r.get(0)?, r.get(1)?)),
+            )
+            .unwrap();
+        assert_eq!(state, JobState::Pending as i64);
+        assert_eq!(attempts, 0, "an unhandled job is untouched, not failed");
+    }
+
+    #[test]
+    fn a_runner_with_no_handlers_claims_nothing() {
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+
+        assert_eq!(Runner::new(&c).drain_all(0).unwrap().ran(), 0);
+        assert_eq!(rows(&c), 1);
+    }
+
+    #[test]
+    fn a_drain_stops_at_its_job_budget() {
+        let c = db();
+        for id in 1..=5 {
+            queued(&c, JobKind::Thumbnail, id);
+        }
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let mut runner = Runner::new(&c).with(recording(vec![JobKind::Thumbnail], seen.clone()));
+        let report = runner
+            .drain(&|| 0, Budget::jobs(2), &AtomicBool::new(false))
+            .unwrap();
+
+        assert_eq!(report.completed, 2);
+        assert_eq!(report.stopped, Stopped::Budget);
+        assert!(report.stopped.more_to_do());
+        assert_eq!(rows(&c), 3, "the rest is still queued for the next slot");
+        assert_eq!(seen.lock().unwrap().len(), 2);
+    }
+
+    #[test]
+    fn a_drain_stops_at_its_deadline() {
+        // What a `WorkManager` slot does: a fixed window, and whatever did not
+        // fit stays queued for the next one.
+        let c = db();
+        for id in 1..=5 {
+            queued(&c, JobKind::Thumbnail, id);
+        }
+
+        // A clock that advances a second per reading, so the deadline arrives
+        // without the test sleeping.
+        let tick = std::cell::Cell::new(0i64);
+        let clock = || {
+            let t = tick.get();
+            tick.set(t + 1);
+            t
+        };
+
+        let report = Runner::new(&c)
+            .with(handler(&[JobKind::Thumbnail], |_| Outcome::Done))
+            .drain(&clock, Budget::until(3), &AtomicBool::new(false))
+            .unwrap();
+
+        assert_eq!(report.stopped, Stopped::Deadline);
+        assert_eq!(report.completed, 3, "one job per second up to the deadline");
+        assert_eq!(rows(&c), 2);
+    }
+
+    #[test]
+    fn a_cancelled_drain_stops_between_jobs() {
+        let c = db();
+        for id in 1..=5 {
+            queued(&c, JobKind::Thumbnail, id);
+        }
+
+        let cancel = AtomicBool::new(false);
+        // Cancelled from inside the handler, standing in for the host thread
+        // setting the flag while a job is in flight: the job in hand finishes,
+        // and nothing further is claimed.
+        let report = Runner::new(&c)
+            .with(handler(&[JobKind::Thumbnail], |_| {
+                cancel.store(true, Ordering::Relaxed);
+                Outcome::Done
+            }))
+            .drain(&|| 0, Budget::UNLIMITED, &cancel)
+            .unwrap();
+
+        assert_eq!(report.completed, 1);
+        assert_eq!(report.stopped, Stopped::Cancelled);
+        assert_eq!(rows(&c), 4, "the work is kept, not lost");
+    }
+
+    #[test]
+    fn a_job_interrupted_by_process_death_is_reclaimed_and_run_once() {
+        // FR-PLAT-AND-3. The kill happens between the claim and the outcome,
+        // which is the window a durable queue exists to survive: no `complete`,
+        // no `fail`, just a row marked `Running` with nobody holding it.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+
+        // The dead process. It claimed the job and never came back.
+        let claimed = jobs::claim_next(&c, 0).unwrap().expect("claimable");
+        assert_eq!(claimed.subject_id, Some(1));
+
+        // A fresh runner, before it starts, finds the queue empty — the row is
+        // `Running` and no claim will touch it.
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let mut runner = Runner::new(&c).with(recording(vec![JobKind::Thumbnail], seen.clone()));
+        assert_eq!(
+            runner.drain_all(0).unwrap().ran(),
+            0,
+            "an orphan is invisible until it is recovered — which is exactly \
+             why recovery has to happen at startup"
+        );
+
+        let recovered = runner.recover().unwrap();
+        assert_eq!(recovered.reclaimed, 1);
+
+        let report = runner.drain_all(0).unwrap();
+        assert_eq!(report.completed, 1);
+        assert_eq!(
+            *seen.lock().unwrap(),
+            vec![1],
+            "resumed, not repeated and not lost"
+        );
+        assert_eq!(rows(&c), 0);
+    }
+
+    #[test]
+    fn a_crash_still_costs_an_attempt() {
+        // Deliberate: a job that takes the process down with it every time is
+        // indistinguishable from one that fails, and the attempt counter is
+        // the only evidence we keep across a death. Without this a poison-pill
+        // job would be reclaimed and re-run forever.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+
+        for _ in 0..MAX_ATTEMPTS {
+            jobs::claim_next(&c, 0).unwrap().expect("claimable");
+            recover(&c).unwrap();
+        }
+
+        let job = jobs::claim_next(&c, 0).unwrap().unwrap();
+        assert!(job.attempts > MAX_ATTEMPTS);
+        jobs::fail(&c, &job, 0, "died again").unwrap();
+        let state: i64 = c
+            .query_row("SELECT state FROM jobs", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(state, JobState::Failed as i64);
+    }
+
+    #[test]
+    fn recovery_drops_jobs_whose_photograph_is_gone() {
+        // A culled library leaves thumbnail jobs for images deleted months
+        // ago. Every one would be claimed, run and failed.
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+        queued(&c, JobKind::Thumbnail, 2);
+        c.execute("DELETE FROM images WHERE id = 2", []).unwrap();
+
+        let recovered = recover(&c).unwrap();
+        assert_eq!(recovered.reaped, 1);
+        assert!(recovered.did_anything());
+
+        let left: i64 = c
+            .query_row("SELECT subject_id FROM jobs", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(left, 1, "only the job whose subject survives is kept");
+    }
+
+    #[test]
+    fn a_quiet_startup_recovers_nothing() {
+        let c = db();
+        queued(&c, JobKind::Thumbnail, 1);
+        assert_eq!(recover(&c).unwrap(), Recovered::default());
+        assert!(!recover(&c).unwrap().did_anything());
+    }
+
+    #[test]
+    fn two_runners_on_one_catalog_never_take_the_same_job() {
+        // Sequential rather than threaded, so the property is asserted without
+        // depending on the scheduler: whatever the second connection claims,
+        // it is not what the first one is holding.
+        let path = temp_catalog("contention-pair");
+        let a = open(&path);
+        let b = open(&path);
+
+        for id in 1..=2 {
+            queued(&a, JobKind::Thumbnail, id);
+        }
+
+        let first = jobs::claim_next(&a, 0).unwrap().expect("one for A");
+        let second = jobs::claim_next(&b, 0).unwrap().expect("one for B");
+
+        assert_ne!(first.id, second.id);
+        assert!(
+            jobs::claim_next(&a, 0).unwrap().is_none(),
+            "a claimed job is invisible to every connection, not just its own"
+        );
+    }
+
+    #[test]
+    fn concurrent_runners_share_the_queue_without_repeating_work() {
+        // The claim is one atomic statement precisely so this holds: four
+        // threads, four connections, and every job run exactly once.
+        const THREADS: usize = 4;
+        const JOBS: i64 = 24;
+
+        let path = temp_catalog("contention-threads");
+        let seeder = open(&path);
+        for id in 1..=JOBS {
+            queued(&seeder, JobKind::Thumbnail, id);
+        }
+        drop(seeder);
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        let mut threads = Vec::new();
+        for _ in 0..THREADS {
+            let path = path.clone();
+            let seen = seen.clone();
+            threads.push(std::thread::spawn(move || {
+                let conn = open(&path);
+                // Bound to a local rather than left as the block's tail: the
+                // `Runner` borrows `conn`, and a tail expression's temporaries
+                // are dropped *after* the block's locals, so the borrow would
+                // outlive what it borrows.
+                let completed = Runner::new(&conn)
+                    .with(recording(vec![JobKind::Thumbnail], seen))
+                    .drain_all(0)
+                    .unwrap()
+                    .completed;
+                completed
+            }));
+        }
+
+        let completed: usize = threads.into_iter().map(|t| t.join().unwrap()).sum();
+        assert_eq!(completed, JOBS as usize);
+
+        let mut ran = seen.lock().unwrap().clone();
+        ran.sort_unstable();
+        assert_eq!(
+            ran,
+            (1..=JOBS).collect::<Vec<_>>(),
+            "every job exactly once — no duplicate claim, nothing dropped"
+        );
+
+        let leftover = open(&path);
+        assert_eq!(rows(&leftover), 0);
+    }
+
+    #[test]
+    fn priority_survives_the_runner() {
+        // NFR-ARCH-2: visible work strictly preempts bulk work, and it has to
+        // still be true when the queue is drained through a handler rather
+        // than by hand.
+        let c = db();
+        image(&c, 1);
+        image(&c, 2);
+        enqueue(&c, JobKind::Thumbnail, Some(1), Priority::Background, None).unwrap();
+        enqueue(&c, JobKind::Thumbnail, Some(2), Priority::Interactive, None).unwrap();
+
+        let seen = Arc::new(Mutex::new(Vec::new()));
+        Runner::new(&c)
+            .with(recording(vec![JobKind::Thumbnail], seen.clone()))
+            .drain_all(0)
+            .unwrap();
+
+        assert_eq!(*seen.lock().unwrap(), vec![2, 1]);
+    }
+
+    #[test]
+    fn a_handler_sees_the_payload_and_the_attempt_count() {
+        // Both are how a handler decides what to do: the payload is the only
+        // thing that survives from the enqueue site, and the attempt count is
+        // how it can tell a first try from a last one.
+        let c = db();
+        image(&c, 1);
+        enqueue(
+            &c,
+            JobKind::ScanFolder,
+            Some(1),
+            Priority::Background,
+            Some("/lib/2024"),
+        )
+        .unwrap();
+
+        let payload = Arc::new(Mutex::new(None));
+        let recorded = payload.clone();
+        Runner::new(&c)
+            .with(handler(&[JobKind::ScanFolder], move |job| {
+                *recorded.lock().unwrap() = Some((job.payload.clone(), job.attempts));
+                Outcome::Done
+            }))
+            .drain_all(0)
+            .unwrap();
+
+        assert_eq!(
+            *payload.lock().unwrap(),
+            Some((Some("/lib/2024".to_string()), 1))
+        );
+    }
+}

core/dr-catalog/src/sync.rs

@@ -52,6 +52,43 @@ pub fn checkpoint(conn: &Connection) -> Result<(), CatalogError> {
 /// coherent even with writers active. Callers should still prefer a quiet
 /// moment — this competes with background jobs for the write lock.
 pub fn snapshot_for_upload(conn: &Connection, dest: &Path) -> Result<(), CatalogError> {
+    let out = copy_to(conn, dest)?;
+    strip_face_crops(&out)?;
+    verify_snapshot(&out)?;
+    Ok(())
+}
+
+/// TRACES: NFR-R2
+/// Refuse to hand over a snapshot that will not pass `quick_check`.
+///
+/// The upload is the copy every other device merges from, and a damaged one
+/// costs far more than the check: each device downloads it, fails, and — for
+/// a week, once — declines to push over it. `quick_check` reads every page
+/// but skips index verification, which is the affordable version of "is this
+/// a database" on a 40 MB file that has just been written and is still in the
+/// page cache. A failure here is [`CatalogError::Corrupt`], the same thing a
+/// receiving device would have said, so the sync reports it the same way.
+fn verify_snapshot(snapshot: &Connection) -> Result<(), CatalogError> {
+    let verdict: String = snapshot.query_row("PRAGMA quick_check", [], |r| r.get(0))?;
+    if verdict == "ok" {
+        Ok(())
+    } else {
+        Err(CatalogError::Corrupt {
+            detail: format!("the snapshot for upload failed quick_check: {verdict}"),
+        })
+    }
+}
+
+/// Checkpoint, then copy the whole database to `dest`, and hand back the
+/// connection to the copy.
+///
+/// Split out from [`snapshot_for_upload`] because [`crate::recovery`] wants
+/// exactly this and none of what follows it there: an NFR-R2 backup is the
+/// file the user may have to *live on*, so it keeps the face crops that an
+/// upload strips. Sharing the copy rather than reimplementing it is what keeps
+/// the WAL discipline in one place — a backup taken with `fs::copy` would be
+/// the torn snapshot this module's header exists to warn about.
+pub(crate) fn copy_to(conn: &Connection, dest: &Path) -> Result<Connection, CatalogError> {
     checkpoint(conn)?;
 
     let mut out = Connection::open(dest)?;
@@ -61,6 +98,41 @@ pub fn snapshot_for_upload(conn: &Connection, dest: &Path) -> Result<(), Catalog
     // have. The effect is the same: one step, no interleaved writers, no
     // progress callback. A 50k-image catalog is tens of megabytes.
     backup.run_to_completion(i32::MAX, std::time::Duration::ZERO, None)?;
+    drop(backup);
+
+    Ok(out)
+}
+
+/// Drop the stored face crops from a snapshot before it is uploaded.
+///
+/// The snapshot is the *whole catalog*, uploaded on every sync and downloaded
+/// by every device. Face crops are a few KB each and a fully indexed library
+/// holds tens of thousands of them, so leaving them in would put tens of MB on
+/// every round trip — the exact cost `face_shard`'s 25 MB cap exists to bound,
+/// and the reason the bulk per-face data lives in shards in the first place.
+///
+/// Crops are not lost by this: they travel in the face shards
+/// ([`crate::face_shard::export_to_shards`]), which are written once and
+/// downloaded once. Nothing reads a crop out of a merged remote catalog —
+/// [`merge_all`] touches collections and keywords only — so removing them here
+/// costs a receiving device nothing it would otherwise have had.
+///
+/// `VACUUM` afterwards because SQLite does not return freed pages to the file
+/// on its own, and an upload sized by the file rather than by its contents
+/// would keep paying for bytes that are no longer there.
+fn strip_face_crops(snapshot: &Connection) -> Result<(), CatalogError> {
+    // A catalog older than the crop column is a legitimate input here — a
+    // snapshot taken mid-migration, or a test fixture built from an earlier
+    // schema — so an absent column is nothing to fail over.
+    let has_crop = snapshot
+        .prepare("SELECT crop FROM faces LIMIT 1")
+        .map(|_| true)
+        .unwrap_or(false);
+    if !has_crop {
+        return Ok(());
+    }
+    snapshot.execute("UPDATE faces SET crop = NULL WHERE crop IS NOT NULL", [])?;
+    snapshot.execute_batch("VACUUM")?;
     Ok(())
 }
 
@@ -250,4 +322,62 @@ mod tests {
         std::fs::create_dir_all(&base).unwrap();
         base
     }
+
+    /// The whole reason crops live in the shards: a snapshot is uploaded whole,
+    /// on every sync, to every device.
+    #[test]
+    fn the_snapshot_carries_no_face_crops() {
+        let dir = tempdir();
+        let live = dir.join("catalog.sqlite");
+        let snap = dir.join("snap.sqlite");
+
+        let c = seeded(&live);
+        c.execute(
+            "INSERT OR IGNORE INTO roots(id, kind, label) VALUES (1, 'local', 'lib')",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO images(id, root_id, source_ref, added_at) VALUES (1, 1, 'a.CR3', 0)",
+            [],
+        )
+        .unwrap();
+        c.execute(
+            "INSERT INTO faces
+                 (image_id, x, y, w, h, landmarks, detector_confidence, embedding,
+                  crop_px, model_id, detected_at, crop)
+             VALUES (1, 0.1, 0.1, 0.2, 0.2, X'00', 0.9, X'00', 180.0, 'm', 0, ?1)",
+            [vec![7u8; 4096]],
+        )
+        .unwrap();
+
+        snapshot_for_upload(&c, &snap).unwrap();
+
+        let out = Connection::open(&snap).unwrap();
+        let crops: i64 = out
+            .query_row(
+                "SELECT COUNT(*) FROM faces WHERE crop IS NOT NULL",
+                [],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(crops, 0, "the snapshot still carries face crops");
+
+        // The face itself must still be there — only the pixels are dropped.
+        let faces: i64 = out
+            .query_row("SELECT COUNT(*) FROM faces", [], |r| r.get(0))
+            .unwrap();
+        assert_eq!(faces, 1);
+
+        // And the local catalog keeps its crop: this strips the copy, never
+        // the original.
+        let kept: i64 = c
+            .query_row(
+                "SELECT COUNT(*) FROM faces WHERE crop IS NOT NULL",
+                [],
+                |r| r.get(0),
+            )
+            .unwrap();
+        assert_eq!(kept, 1, "stripping the snapshot damaged the live catalog");
+    }
 }

core/dr-catalog/src/walk.rs

@@ -432,7 +432,7 @@ fn bump_generation(conn: &Connection, root: RootId, now: i64) -> Result<i64, Cat
     Ok(next)
 }
 
-/// TRACES: FR-CAT-9
+/// TRACES: FR-CAT-9 | FR-PLAT-AND-2
 /// Mark every image under a root as unreachable.
 ///
 /// The other half of FR-CAT-9's distinction: a source *proven absent* may leave
@@ -445,14 +445,38 @@ fn bump_generation(conn: &Connection, root: RootId, now: i64) -> Result<i64, Cat
 /// the root now claims something about the files that is no longer known to be
 /// true, and only reading the directories again can settle it. Pruning would
 /// skip them all and leave a plugged-in library showing as offline forever.
-fn mark_root_offline(conn: &Connection, root: RootId) -> Result<(), CatalogError> {
+///
+/// # Why the ETag goes with the mtime
+///
+/// The three columns are the same fact told by three kinds of storage: a local
+/// directory proves it is unchanged with its mtime and entry count, and a
+/// remote one proves it with a propagating ETag (ARCH §6.6). Clearing two of
+/// them and leaving the third would disarm the re-listing on exactly the
+/// libraries this is most likely to be called for — a remote scan prunes on
+/// the ETag alone, so a root that came back would be walked, found unchanged
+/// at every level, pruned whole, and left with every row still marked offline
+/// and nothing that would ever clear the mark.
+///
+/// # Public, because losing a root is not only the local walk's business
+///
+/// This began as the private end of [`scan_root`]'s root-failure branches,
+/// which is the only route a library reached through [`Storage`] can take.
+/// The application does not currently take that route at all: it opens
+/// libraries through `dr-sync`'s connectors, so the discovery happens in a
+/// crate that cannot see this one's internals, and the correct response is
+/// identical (FR-PLAT-AND-2). Exported rather than reimplemented beside the
+/// caller that found out — a second copy would be a second thing to remember
+/// when the ETag rule below changes.
+///
+/// [`Storage`]: dr_plat::Storage
+pub fn mark_root_offline(conn: &Connection, root: RootId) -> Result<(), CatalogError> {
     let root_id = root.0 as i64;
     conn.execute(
         "UPDATE images SET availability = ?1 WHERE root_id = ?2 AND availability != ?1",
         rusqlite::params![availability_code(Availability::Offline), root_id],
     )?;
     conn.execute(
-        "UPDATE folders SET mtime = NULL, entry_count = NULL WHERE root_id = ?1",
+        "UPDATE folders SET mtime = NULL, entry_count = NULL, etag = NULL WHERE root_id = ?1",
         [root_id],
     )?;
     Ok(())
@@ -995,6 +1019,40 @@ mod tests {
         );
     }
 
+    /// TRACES: FR-PLAT-AND-2 | FR-CAT-9
+    #[test]
+    fn marking_a_root_offline_forgets_the_remote_validator_too() {
+        // The half of the marking that only a remote library can notice, and
+        // the reason it has to be here rather than beside the connector: a
+        // remote scan prunes on the propagating ETag alone (ARCH §6.6). Clear
+        // the local mtime and leave the ETag standing and a library that came
+        // back would be walked, found unchanged at every level, pruned whole,
+        // and left with every row still marked offline — with nothing that
+        // would ever clear the mark, because clearing it is something only a
+        // listing can do.
+        //
+        // Written directly because this module never writes an ETag; it is
+        // `ui/dr-ui/src/library.rs`'s scan that does, against the same table.
+        let lib = Library::new("etag-forgotten");
+        lib.file("2026/IMG.CR3", b"raw");
+        lib.scan();
+        lib.conn()
+            .execute(
+                "UPDATE folders SET etag = 'e1' WHERE root_id = ?1",
+                [lib.root.0 as i64],
+            )
+            .expect("etag");
+        assert!(lib.count("SELECT COUNT(*) FROM folders WHERE etag IS NOT NULL") > 0);
+
+        mark_root_offline(lib.conn(), lib.root).expect("mark");
+
+        assert_eq!(
+            lib.count("SELECT COUNT(*) FROM folders WHERE etag IS NOT NULL"),
+            0,
+            "an unreachable library must be re-listed, not pruned as unchanged"
+        );
+    }
+
     #[test]
     fn a_root_that_comes_back_is_available_again() {
         // The other half: a drive plugged back in must return the library to

core/dr-decode/examples/linear_dng.rs

@@ -0,0 +1,221 @@
+//! TRACES: S15 | FR-MRG-3
+//! Spike S15.1 — does rawler read back a linear DNG this application writes?
+//!
+//!   cargo run -p dr-decode --example linear_dng [-- <out.dng>]
+//!
+//! Decides FR-MRG-3's container. A panorama composite is three linear samples
+//! per pixel with a camera matrix attached, which is exactly what a
+//! `LinearRaw` DNG is; if rawler parses one, the composite re-enters the
+//! library as `Format::Dng` and the only new decode work is a `cpp == 3`
+//! branch. If it does not, the container is a float TIFF with a decode path
+//! of its own.
+//!
+//! The file is hand-rolled rather than written with the `tiff` crate, whose
+//! encoder fixes `PhotometricInterpretation` to RGB and cannot say
+//! `LinearRaw`. Eighty lines of IFD is the cheaper thing to own than a fork.
+
+use rawler::rawsource::RawSource;
+
+const W: u32 = 64;
+const H: u32 = 48;
+
+fn main() {
+    let bytes = write_linear_dng(W, H);
+    if let Some(path) = std::env::args().nth(1) {
+        std::fs::write(&path, &bytes).expect("write");
+        println!("wrote {path} ({} bytes)", bytes.len());
+    }
+
+    let source = RawSource::new_from_slice(&bytes);
+    let decoder = match rawler::get_decoder(&source) {
+        Ok(d) => d,
+        Err(e) => {
+            println!("FAIL  get_decoder: {e}");
+            std::process::exit(1);
+        }
+    };
+    println!("ok    decoder found");
+
+    let image = match decoder.raw_image(&source, &Default::default(), false) {
+        Ok(i) => i,
+        Err(e) => {
+            println!("FAIL  raw_image: {e}");
+            std::process::exit(1);
+        }
+    };
+    println!(
+        "ok    raw_image: {}×{}, cpp {}, bps {}, {} samples, make {:?} model {:?}",
+        image.width,
+        image.height,
+        image.cpp,
+        image.bps,
+        match &image.data {
+            rawler::RawImageData::Integer(v) => v.len(),
+            rawler::RawImageData::Float(v) => v.len(),
+        },
+        image.make,
+        image.model
+    );
+    println!(
+        "      white {:?}  black {:?}  wb {:?}",
+        image.whitelevel.0,
+        image
+            .blacklevel
+            .levels
+            .iter()
+            .map(|r| r.n as f32 / r.d.max(1) as f32)
+            .collect::<Vec<_>>(),
+        image.wb_coeffs
+    );
+
+    // The pixel at (1, 0) was written as (1000, 2000, 3000): if the samples
+    // come back interleaved in that order, cpp == 3 means what it says.
+    if let rawler::RawImageData::Integer(v) = &image.data {
+        let i = image.cpp;
+        println!("      pixel (1,0) = {:?}", &v[i..i + image.cpp.min(3)]);
+    }
+
+    // What dr-decode itself makes of it: the colour matrix rawler parsed into
+    // the camera definition, and the profile the decoder would build from it.
+    println!("      rawler color_matrix: {:?}", image.camera.color_matrix);
+    let dng = dr_decode::profile::read_dng_matrices(decoder.as_ref());
+    let profile = dr_decode::CameraProfile::extract(&image, &dng);
+    println!(
+        "      CameraProfile: {}",
+        profile
+            .as_ref()
+            .map(|p| format!("xyz_to_cam {:?}", p.xyz_to_cam()))
+            .unwrap_or_else(|| "none".into())
+    );
+
+    match dr_decode::decode(&bytes) {
+        Ok(r) => println!(
+            "note  dr_decode::decode accepted it as CFA: {}×{}, {} samples — the cpp==3 branch is the work",
+            r.width,
+            r.height,
+            r.data.len()
+        ),
+        Err(e) => println!("note  dr_decode::decode refused it: {e} — the cpp==3 branch is the work"),
+    }
+}
+
+/// A minimal `LinearRaw` DNG: one IFD, uncompressed 16-bit RGB, the tags a
+/// decoder needs to treat it as a DNG and the matrix a develop chain needs
+/// to treat it as a camera. Little-endian, one strip.
+fn write_linear_dng(w: u32, h: u32) -> Vec<u8> {
+    // Pixels first, so their offset is known: a ramp with one marker pixel.
+    let mut pixels: Vec<u16> = Vec::with_capacity((w * h * 3) as usize);
+    for y in 0..h {
+        for x in 0..w {
+            if (x, y) == (1, 0) {
+                pixels.extend([1000, 2000, 3000]);
+            } else {
+                let v = ((x + y) * 512).min(65535) as u16;
+                pixels.extend([v, v / 2, v / 3]);
+            }
+        }
+    }
+    let pixel_bytes: Vec<u8> = pixels.iter().flat_map(|v| v.to_le_bytes()).collect();
+
+    // Layout: header (8) | pixels | extra data | IFD.
+    let pixels_off = 8u32;
+    let extra_off = pixels_off + pixel_bytes.len() as u32;
+
+    // Values that do not fit in four bytes go in `extra`, and the entry
+    // points at them.
+    let mut extra: Vec<u8> = Vec::new();
+    let mut entries: Vec<(u16, u16, u32, [u8; 4])> = Vec::new();
+
+    fn short(tag: u16, v: u16) -> (u16, u16, u32, [u8; 4]) {
+        let mut b = [0u8; 4];
+        b[..2].copy_from_slice(&v.to_le_bytes());
+        (tag, 3, 1, b)
+    }
+    fn long(tag: u16, v: u32) -> (u16, u16, u32, [u8; 4]) {
+        (tag, 4, 1, v.to_le_bytes())
+    }
+    fn ascii(extra: &mut Vec<u8>, extra_off: u32, tag: u16, s: &str) -> (u16, u16, u32, [u8; 4]) {
+        let mut bytes = s.as_bytes().to_vec();
+        bytes.push(0);
+        let off = extra_off + extra.len() as u32;
+        extra.extend(&bytes);
+        (tag, 2, bytes.len() as u32, off.to_le_bytes())
+    }
+
+    entries.push(long(254, 0)); // NewSubfileType: main image
+    entries.push(long(256, w));
+    entries.push(long(257, h));
+    // BitsPerSample ×3 — three shorts, six bytes, so out of line.
+    {
+        let off = extra_off + extra.len() as u32;
+        for _ in 0..3 {
+            extra.extend(16u16.to_le_bytes());
+        }
+        entries.push((258, 3, 3, off.to_le_bytes()));
+    }
+    entries.push(short(259, 1)); // Compression: none
+    entries.push(short(262, 34892)); // PhotometricInterpretation: LinearRaw
+    entries.push(ascii(&mut extra, extra_off, 271, "DarkRoom"));
+    entries.push(ascii(&mut extra, extra_off, 272, "Panorama"));
+    entries.push(long(273, pixels_off)); // StripOffsets
+    entries.push(short(274, 1)); // Orientation
+    entries.push(short(277, 3)); // SamplesPerPixel
+    entries.push(long(278, h)); // RowsPerStrip
+    entries.push(long(279, pixel_bytes.len() as u32)); // StripByteCounts
+    entries.push(short(284, 1)); // PlanarConfiguration: chunky
+    entries.push((50706, 1, 4, [1, 4, 0, 0])); // DNGVersion
+    entries.push((50707, 1, 4, [1, 4, 0, 0])); // DNGBackwardVersion
+    entries.push(ascii(&mut extra, extra_off, 50708, "DarkRoom Panorama")); // UniqueCameraModel
+    entries.push(long(50717, 65535)); // WhiteLevel
+
+    // ColorMatrix1: XYZ → camera, 9 SRATIONALs. A plausible sRGB-ish matrix
+    // (the inverse of the sRGB D65 primaries), scaled to integers.
+    {
+        let m: [(i32, i32); 9] = [
+            (32406, 10000),
+            (-15372, 10000),
+            (-4986, 10000),
+            (-9689, 10000),
+            (18758, 10000),
+            (415, 10000),
+            (557, 10000),
+            (-2040, 10000),
+            (10570, 10000),
+        ];
+        let off = extra_off + extra.len() as u32;
+        for (n, d) in m {
+            extra.extend(n.to_le_bytes());
+            extra.extend(d.to_le_bytes());
+        }
+        entries.push((50721, 10, 9, off.to_le_bytes()));
+    }
+    // AsShotNeutral: 3 RATIONALs, neutral.
+    {
+        let off = extra_off + extra.len() as u32;
+        for _ in 0..3 {
+            extra.extend(1u32.to_le_bytes());
+            extra.extend(1u32.to_le_bytes());
+        }
+        entries.push((50728, 5, 3, off.to_le_bytes()));
+    }
+    entries.push(short(50778, 21)); // CalibrationIlluminant1: D65
+
+    entries.sort_by_key(|e| e.0);
+
+    let ifd_off = extra_off + extra.len() as u32;
+    let mut out = Vec::new();
+    out.extend(b"II");
+    out.extend(42u16.to_le_bytes());
+    out.extend(ifd_off.to_le_bytes());
+    out.extend(&pixel_bytes);
+    out.extend(&extra);
+    out.extend((entries.len() as u16).to_le_bytes());
+    for (tag, ty, count, value) in &entries {
+        out.extend(tag.to_le_bytes());
+        out.extend(ty.to_le_bytes());
+        out.extend(count.to_le_bytes());
+        out.extend(value);
+    }
+    out.extend(0u32.to_le_bytes()); // no next IFD
+    out
+}

core/dr-decode/src/base_curve.rs

@@ -487,7 +487,8 @@ mod tests {
             // And the last span is shallower than the one before it, which is
             // what a shoulder *is*. Without one the curve clips highlights
             // harder than the linear rendering did.
-            let slope = |i: usize| (curve.ys[i + 1] - curve.ys[i]) / (curve.xs[i + 1] - curve.xs[i]);
+            let slope =
+                |i: usize| (curve.ys[i + 1] - curve.ys[i]) / (curve.xs[i + 1] - curve.xs[i]);
             assert!(
                 slope(POINTS - 2) < slope(POINTS - 3),
                 "{name} has no highlight shoulder"
@@ -502,13 +503,7 @@ mod tests {
         // as a dark halo in a gradient, which reads as a rendering fault
         // rather than as a bad profile.
         assert_eq!(
-            BaseCurve::from_points(&[
-                [0.0, 0.0],
-                [0.25, 0.4],
-                [0.5, 0.3],
-                [0.75, 0.8],
-                [1.0, 1.0]
-            ]),
+            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.4], [0.5, 0.3], [0.75, 0.8], [1.0, 1.0]]),
             None
         );
     }
@@ -540,13 +535,7 @@ mod tests {
         // point above 1.0 would put the shoulder outside the range the curve
         // is defined over and silently flatten everything below it.
         assert_eq!(
-            BaseCurve::from_points(&[
-                [0.0, 0.0],
-                [0.25, 0.3],
-                [0.5, 1.4],
-                [0.75, 1.5],
-                [1.0, 1.6]
-            ]),
+            BaseCurve::from_points(&[[0.0, 0.0], [0.25, 0.3], [0.5, 1.4], [0.75, 1.5], [1.0, 1.6]]),
             None
         );
     }

core/dr-decode/src/error.rs

@@ -25,6 +25,42 @@ pub enum DecodeError {
     CorruptPreview(String),
 }
 
+/// Run a decoder call, and return a panic inside it as an error.
+///
+/// TRACES: FR-RAW-4 | NFR-SEC-1 | NFR-R3
+/// rawler `panic!`s on some malformed input rather than returning `Err` — a
+/// DNG whose IFD claims a >50000 px image, for one, which is in the reference
+/// library. A panic on a worker thread ends the thread: the face sweep that
+/// met that file stopped 13 seconds in, three sweeps running, with "17301
+/// image(s) to index" as the last word and nothing to say why. FR-RAW-4's
+/// rule — a malformed file must not abort a batch — is this crate's to keep
+/// whatever the library beneath it does, so every entry point that calls into
+/// rawler runs through here, and a file that panics the decoder is one failed
+/// file like any other.
+///
+/// The crash hook still records the panic, because it runs before unwinding
+/// reaches this frame; that is right — it is a real defect in a dependency
+/// and the record is how it gets reported upstream — and a repeat is the same
+/// file being met again rather than a new fault.
+pub(crate) fn guarded<T>(
+    what: &'static str,
+    f: impl FnOnce() -> Result<T, DecodeError>,
+) -> Result<T, DecodeError> {
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(f)) {
+        Ok(result) => result,
+        Err(payload) => {
+            let msg = payload
+                .downcast_ref::<&str>()
+                .map(|s| s.to_string())
+                .or_else(|| payload.downcast_ref::<String>().cloned())
+                .unwrap_or_else(|| "no message".to_string());
+            Err(DecodeError::Decode(format!(
+                "{what}: the decoder panicked on this file: {msg}"
+            )))
+        }
+    }
+}
+
 impl DecodeError {
     /// Whether a fallback path might still produce an image.
     ///
@@ -49,4 +85,28 @@ mod tests {
         // A genuinely unsupported file has nowhere to fall through to.
         assert!(!DecodeError::Unsupported("unknown".into()).has_fallback());
     }
+
+    #[test]
+    fn a_panic_in_the_decoder_is_an_error_and_the_thread_survives() {
+        // The property the face sweep relies on: one file that panics rawler
+        // is one failed file, not the end of the pass. The message travels,
+        // because "decode failed" alone sends the reader to the crash log.
+        let err = guarded("decode", || -> Result<(), DecodeError> {
+            panic!("rawler: surely there's no such thing as a {}MP image!", 600)
+        })
+        .unwrap_err();
+        let text = err.to_string();
+        assert!(text.contains("panicked"), "{text}");
+        assert!(text.contains("600MP"), "{text}");
+        assert!(!err.has_fallback(), "a panic is not a missing preview");
+    }
+
+    #[test]
+    fn a_result_passes_through_untouched() {
+        assert_eq!(guarded("decode", || Ok::<_, DecodeError>(7)).unwrap(), 7);
+        assert!(matches!(
+            guarded("decode", || Err::<(), _>(DecodeError::NoPreview)),
+            Err(DecodeError::NoPreview)
+        ));
+    }
 }

core/dr-decode/src/lib.rs

@@ -134,6 +134,22 @@ pub struct RawImage {
     pub base_curve: BaseCurve,
     /// The usable region of `data`, excluding masked and border photosites.
     pub crop: CropRect,
+    /// TRACES: FR-MRG-3
+    /// Samples per photosite in `data`: 1 for a colour-filter-array capture,
+    /// 3 for a *linear* DNG — demosaiced RGB, still camera-space, which is
+    /// what a merge writes. With 3, `cfa_pattern` means nothing, `data` is
+    /// `width × height × 3` interleaved, and the GPU uploads it as it is
+    /// rather than demosaicing.
+    pub samples_per_pixel: u8,
+    /// TRACES: FR-MRG-3
+    /// The body's colour profile as the file carried it, for a composite to
+    /// carry on: calibrations and the as-shot neutral. `None` for a body the
+    /// decoder has no matrix for.
+    pub profile: Option<profile::CameraProfile>,
+    /// The body, as rawler cleans the names: what `Make`/`Model` say and what
+    /// the base-curve database matches on.
+    pub make: String,
+    pub model: String,
 }
 
 /// TRACES: FR-RAW-3
@@ -285,6 +301,30 @@ pub fn probe(header: &[u8]) -> Option<Format> {
 /// TRACES: FR-CAT-5 | M-12
 /// Read capture metadata without decoding sensor data.
 pub fn metadata(bytes: &[u8]) -> Result<Metadata, DecodeError> {
+    error::guarded("metadata", || metadata_unguarded(bytes))
+}
+
+/// TRACES: FR-CAT-5
+/// Where a TIFF-shaped file keeps its first IFD, when the head handed to
+/// [`metadata`] does not reach it — the linear DNG a merge writes puts its
+/// IFDs after the pixels, and rawler, given the head alone, finds no
+/// decoder in it. The caller fetches from this offset to the end and
+/// reads the two ranges with [`metadata_split`].
+pub fn trailing_ifd(head: &[u8]) -> Option<u64> {
+    locate::trailing_ifd(head)
+}
+
+/// TRACES: FR-CAT-5
+/// [`metadata`] for a file read in two ranges: `head` from offset 0 and
+/// `tail` from `tail_at`. The EXIF sub-IFD such a file wrote before its
+/// pixels is in the head; the first IFD and its values are in the tail.
+pub fn metadata_split(head: &[u8], tail: &[u8], tail_at: u64) -> Result<Metadata, DecodeError> {
+    error::guarded("metadata", || {
+        locate::tiff_metadata_split(head, tail, tail_at)
+    })
+}
+
+fn metadata_unguarded(bytes: &[u8]) -> Result<Metadata, DecodeError> {
     use rawler::rawsource::RawSource;
 
     // rawler has no decoder for a plain JPEG, so without this every JPEG in a
@@ -375,7 +415,10 @@ fn rawler_location(gps: &rawler::exif::ExifGPS) -> Option<Location> {
         (r.d != 0).then(|| r.n as f64 / r.d as f64)
     }
 
-    fn degrees(dms: &[rawler::formats::tiff::Rational; 3], reference: Option<&String>) -> Option<f64> {
+    fn degrees(
+        dms: &[rawler::formats::tiff::Rational; 3],
+        reference: Option<&String>,
+    ) -> Option<f64> {
         let d = ratio(&dms[0])? + ratio(&dms[1])? / 60.0 + ratio(&dms[2])? / 3600.0;
         // South and west are stored as positive magnitudes with a letter.
         let negative = matches!(
@@ -507,6 +550,10 @@ pub(crate) fn parse_exif_offset(s: &str) -> Option<i32> {
 /// Only develop and export should call it; culling and the grid must not
 /// (FR-CULL-1).
 pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
+    error::guarded("decode", || decode_unguarded(bytes))
+}
+
+fn decode_unguarded(bytes: &[u8]) -> Result<RawImage, DecodeError> {
     use rawler::rawsource::RawSource;
 
     let source = RawSource::new_from_slice(bytes);
@@ -534,7 +581,10 @@ pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
     // both callers ask the same object for it.
     let profile = profile::CameraProfile::extract(&image, &dng);
     let color_matrix = profile.as_ref().and_then(|p| p.cam_to_srgb());
-    let wb_coeffs = sane_wb(image.wb_coeffs, profile.as_ref().map(|p| p.xyz_to_cam()).as_ref());
+    let wb_coeffs = sane_wb(
+        image.wb_coeffs,
+        profile.as_ref().map(|p| p.xyz_to_cam()).as_ref(),
+    );
 
     // The rendering half of the profile (FR-DEV-3e). rawler's cleaned strings
     // are preferred where it has them — they are what the shipped database is
@@ -545,6 +595,21 @@ pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
         image.camera.clean_model.as_str(),
     );
 
+    // TRACES: FR-MRG-3
+    // A linear DNG — three samples per pixel, no colour filter array — is a
+    // composite this application wrote (or any other demosaiced DNG). It
+    // carries the same scale, matrices and neutral as a CFA file and goes
+    // through the same profile; only the demosaic is skipped.
+    let samples_per_pixel = match image.cpp {
+        1 => 1u8,
+        3 => 3,
+        other => {
+            return Err(DecodeError::Unsupported(format!(
+                "{other} samples per pixel; only CFA (1) and linear RGB (3) are handled"
+            )))
+        }
+    };
+
     let data = match image.data {
         rawler::RawImageData::Integer(v) => v,
         rawler::RawImageData::Float(v) => {
@@ -613,6 +678,10 @@ pub fn decode(bytes: &[u8]) -> Result<RawImage, DecodeError> {
         wb_coeffs,
         color_matrix,
         base_curve,
+        samples_per_pixel,
+        profile,
+        make: image.camera.clean_make.clone(),
+        model: image.camera.clean_model.clone(),
     })
 }
 

core/dr-decode/src/locate.rs

@@ -183,22 +183,65 @@ struct Entry {
     value: u32,
 }
 
+/// The bytes a [`TiffReader`] reads: the head of a file, and optionally a
+/// second range from further in, at a known offset.
+///
+/// A camera writes its IFDs at the front, so the first 256 KB of a file
+/// is the whole structure. A file written strip by strip — the linear
+/// DNG a merge produces — has its first IFD at the *end*, after the
+/// pixels, and a reader that only has the head sees a pointer into
+/// nothing. Rather than fetch 800 MB to read a date, the caller fetches
+/// the head, asks [`crate::trailing_ifd`] where the IFD is, fetches that
+/// tail, and reads through both. Offsets are the file's own throughout;
+/// a read that falls in neither range is simply absent.
+#[derive(Clone, Copy)]
+struct Src<'a> {
+    head: &'a [u8],
+    tail: &'a [u8],
+    /// Where `tail` starts in the file.
+    tail_at: usize,
+}
+
+impl<'a> Src<'a> {
+    fn whole(data: &'a [u8]) -> Self {
+        Src {
+            head: data,
+            tail: &[],
+            tail_at: 0,
+        }
+    }
+
+    fn get(&self, start: usize, len: usize) -> Option<&'a [u8]> {
+        let end = start.checked_add(len)?;
+        if let Some(b) = self.head.get(start..end) {
+            return Some(b);
+        }
+        let s = start.checked_sub(self.tail_at)?;
+        self.tail.get(s..s.checked_add(len)?)
+    }
+}
+
 /// A minimal TIFF structure reader.
 ///
 /// Deliberately not a general TIFF parser: it reads the IFD chain and entry
 /// values and nothing else, because that is all locating a preview needs.
 struct TiffReader<'a> {
-    data: &'a [u8],
+    data: Src<'a>,
     little_endian: bool,
     first_ifd: u32,
 }
 
 impl<'a> TiffReader<'a> {
     fn new(data: &'a [u8]) -> Option<Self> {
-        if data.len() < 8 {
+        Self::over(Src::whole(data))
+    }
+
+    fn over(data: Src<'a>) -> Option<Self> {
+        let head = data.head;
+        if head.len() < 8 {
             return None;
         }
-        let little_endian = match &data[0..2] {
+        let little_endian = match &head[0..2] {
             b"II" => true,
             b"MM" => false,
             _ => return None,
@@ -362,9 +405,7 @@ impl<'a> TiffReader<'a> {
             };
             raw[..len.min(4)].to_vec()
         } else {
-            self.data
-                .get(e.value as usize..e.value as usize + len)?
-                .to_vec()
+            self.data.get(e.value as usize, len)?.to_vec()
         };
 
         let s = String::from_utf8_lossy(&bytes);
@@ -396,8 +437,7 @@ impl<'a> TiffReader<'a> {
             // same way to recover the original byte order.
             return None;
         }
-        let start = e.value as usize;
-        self.data.get(start..start.checked_add(len)?)
+        self.data.get(e.value as usize, len)
     }
 
     fn offsets(&self, e: &Entry) -> Vec<u32> {
@@ -420,8 +460,8 @@ impl<'a> TiffReader<'a> {
     }
 }
 
-fn read_u16(data: &[u8], at: usize, le: bool) -> Option<u16> {
-    let b = data.get(at..at + 2)?;
+fn read_u16(data: Src<'_>, at: usize, le: bool) -> Option<u16> {
+    let b = data.get(at, 2)?;
     Some(if le {
         u16::from_le_bytes([b[0], b[1]])
     } else {
@@ -429,8 +469,8 @@ fn read_u16(data: &[u8], at: usize, le: bool) -> Option<u16> {
     })
 }
 
-fn read_u32(data: &[u8], at: usize, le: bool) -> Option<u32> {
-    let b = data.get(at..at + 4)?;
+fn read_u32(data: Src<'_>, at: usize, le: bool) -> Option<u32> {
+    let b = data.get(at, 4)?;
     Some(if le {
         u32::from_le_bytes([b[0], b[1], b[2], b[3]])
     } else {
@@ -460,7 +500,36 @@ pub fn jpeg_metadata(bytes: &[u8]) -> Result<crate::Metadata, crate::DecodeError
 /// no `DateTimeOriginal` for some DNGs whose tag sits plainly at byte 826 —
 /// and without this fallback those images are silently undated.
 pub fn tiff_metadata(tiff_data: &[u8]) -> Result<crate::Metadata, crate::DecodeError> {
-    let reader = TiffReader::new(tiff_data)
+    tiff_metadata_over(Src::whole(tiff_data))
+}
+
+/// Where a TIFF-shaped file's first IFD is, when the head does not reach
+/// it: the offset to fetch from, so [`tiff_metadata_split`] can read it.
+/// `None` for a file that is not TIFF, or whose IFD the head already holds.
+pub fn trailing_ifd(head: &[u8]) -> Option<u64> {
+    let r = TiffReader::new(head)?;
+    let at = r.first_ifd as u64;
+    (at >= head.len() as u64).then_some(at)
+}
+
+/// [`tiff_metadata`] over a head and a tail fetched separately: the head
+/// from offset 0, the tail from `tail_at`. For the file whose IFDs follow
+/// its pixels.
+pub fn tiff_metadata_split(
+    head: &[u8],
+    tail: &[u8],
+    tail_at: u64,
+) -> Result<crate::Metadata, crate::DecodeError> {
+    tiff_metadata_over(Src {
+        head,
+        tail,
+        tail_at: usize::try_from(tail_at)
+            .map_err(|_| crate::DecodeError::Metadata("tail offset out of range".into()))?,
+    })
+}
+
+fn tiff_metadata_over(src: Src<'_>) -> Result<crate::Metadata, crate::DecodeError> {
+    let reader = TiffReader::over(src)
         .ok_or_else(|| crate::DecodeError::Metadata("malformed EXIF header".into()))?;
 
     let mut md = crate::Metadata::default();
@@ -678,7 +747,8 @@ fn read_gps_entries(r: &TiffReader, entries: &[Entry]) -> Option<dr_types::Locat
     // still writes the entry.
     let degrees = |tag: u16, ref_tag: u16| -> Option<f64> {
         let e = find(tag)?;
-        let d = r.rational(e, 0)? + r.rational(e, 1).unwrap_or(0.0) / 60.0
+        let d = r.rational(e, 0)?
+            + r.rational(e, 1).unwrap_or(0.0) / 60.0
             + r.rational(e, 2).unwrap_or(0.0) / 3600.0;
         // The magnitude is unsigned; the hemisphere is a letter beside it.
         let south_or_west = find(ref_tag)
@@ -1200,7 +1270,8 @@ mod tests {
         let heap = GPS_IFD + 2 + 12 + 4;
         let mut extra = Vec::new();
         extra.extend_from_slice(&1u16.to_le_bytes());
-        for (tag, kind, count, value) in [(gps_tag::LATITUDE, 5u16, 3u32, heap)] {
+        {
+            let (tag, kind, count, value) = (gps_tag::LATITUDE, 5u16, 3u32, heap);
             extra.extend_from_slice(&tag.to_le_bytes());
             extra.extend_from_slice(&kind.to_le_bytes());
             extra.extend_from_slice(&count.to_le_bytes());
@@ -1412,7 +1483,9 @@ pub fn defects(tiff_data: &[u8]) -> Defects {
 /// skip one this build does not implement rather than abandoning the list —
 /// and lists mixing a warp with a defect map are ordinary.
 fn read_opcode_list(bytes: &[u8], out: &mut Defects) {
-    let Some(count) = be_u32(bytes, 0) else { return };
+    let Some(count) = be_u32(bytes, 0) else {
+        return;
+    };
     // A sensor has a handful of opcodes, not thousands. A huge count is a
     // corrupt or hostile file.
     if count > 256 {

core/dr-decode/src/preview.rs

@@ -39,27 +39,14 @@ impl Preview {
     /// not: a quarter turn is a permutation, so it costs the same either way,
     /// and doing it on the smaller buffer moves a fraction of the bytes.
     ///
-    /// Allocates a second buffer rather than rotating in place. An in-place
-    /// quarter turn on a non-square image is a cycle-following permutation
-    /// that is both slower per pixel and far harder to get right, for a saving
-    /// that a thumbnail-sized buffer does not need.
+    /// The turn itself is [`dr_types::Orientation::into_shown`], which every
+    /// other consumer of an orientation in this codebase also goes through.
+    /// That is deliberate: a hand-written permutation per caller is how two of
+    /// them come to disagree, and a disagreement here shows as a thumbnail
+    /// facing the other way from the develop view.
     pub fn apply_orientation(&mut self, orientation: dr_types::Orientation) {
-        if orientation.is_normal() || self.width == 0 || self.height == 0 {
-            return;
-        }
-        let (dw, dh) = orientation.oriented_size(self.width, self.height);
-
-        let mut out = vec![0u8; (dw as usize) * (dh as usize) * 4];
-        for y in 0..dh {
-            for x in 0..dw {
-                let (sx, sy) = orientation.source_pixel(x, y, dw, dh);
-                let s = ((sy * self.width + sx) * 4) as usize;
-                let d = ((y * dw + x) * 4) as usize;
-                out[d..d + 4].copy_from_slice(&self.rgba[s..s + 4]);
-            }
-        }
-
-        self.rgba = out;
+        let (rgba, dw, dh) = orientation.into_shown(&self.rgba, self.width, self.height, 4);
+        self.rgba = rgba;
         self.width = dw;
         self.height = dh;
     }
@@ -171,6 +158,10 @@ pub enum PreviewSize {
 /// Returns [`DecodeError::NoPreview`] where there is none at all: a
 /// fall-through signal, not a failure (see [`DecodeError::has_fallback`]).
 pub fn extract_preview(bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError> {
+    crate::error::guarded("preview", || extract_preview_unguarded(bytes, size))
+}
+
+fn extract_preview_unguarded(bytes: &[u8], size: PreviewSize) -> Result<Preview, DecodeError> {
     use rawler::rawsource::RawSource;
 
     // A plain JPEG *is* its own preview — rawler has no decoder for one, and

core/dr-decode/src/profile.rs

@@ -392,6 +392,21 @@ impl CameraProfile {
     }
 
     /// The calibrations this profile was built from, coolest first.
+    /// TRACES: FR-MRG-3
+    /// The calibrations as a DNG carries them: `(CalibrationIlluminant,
+    /// ColorMatrix)` with the EXIF light-source code, for a composite to
+    /// write the profile of the body that took its sources.
+    ///
+    /// The code is recovered from the temperature, which is lossy only for
+    /// illuminants this profile never kept: `extract` drops calibrations
+    /// whose illuminant has no temperature, so every one here maps back.
+    pub fn dng_calibrations(&self) -> Vec<(u16, [[f32; 3]; 3])> {
+        self.calibrations
+            .iter()
+            .map(|c| (illuminant_code(c.temperature), c.xyz_to_cam))
+            .collect()
+    }
+
     pub fn calibrations(&self) -> &[Calibration] {
         &self.calibrations
     }
@@ -528,6 +543,39 @@ fn illuminant_temperature(illuminant: Illuminant) -> Option<f32> {
     })
 }
 
+/// The EXIF `LightSource` code for a calibration temperature — the inverse
+/// of [`illuminant_temperature`], on the temperatures it produces.
+fn illuminant_code(temperature: f32) -> u16 {
+    // Nearest of the table, so a temperature that came through a float
+    // round-trip still lands on its illuminant. Where two illuminants share
+    // a temperature (D55 and Daylight, D65 and Cloudy, D75 and Shade) the
+    // CIE standard one is written: it is what every profile database means.
+    const TABLE: &[(f32, u16)] = &[
+        (2856.0, 17), // A
+        (3200.0, 24), // ISO studio tungsten
+        (3500.0, 15), // white fluorescent
+        (4150.0, 14), // cool white fluorescent
+        (4230.0, 2),  // fluorescent
+        (4874.0, 18), // B
+        (5000.0, 13), // daylight white fluorescent
+        (5003.0, 23), // D50
+        (5503.0, 20), // D55
+        (6430.0, 12), // daylight fluorescent
+        (6504.0, 21), // D65
+        (6774.0, 19), // C
+        (7504.0, 22), // D75
+    ];
+    TABLE
+        .iter()
+        .min_by(|a, b| {
+            (a.0 - temperature)
+                .abs()
+                .total_cmp(&(b.0 - temperature).abs())
+        })
+        .map(|(_, code)| *code)
+        .unwrap_or(255)
+}
+
 /// Compose a forward matrix into camera RGB → linear sRGB.
 ///
 /// `forward` takes white-balanced camera RGB to XYZ under D50, which is the
@@ -1048,7 +1096,11 @@ mod tests {
         // would render black, which is much harder to diagnose than
         // uncalibrated.
         assert!(!usable(&[[0.0; 3]; 3]));
-        assert!(!usable(&[[f32::NAN, 0.0, 0.0], [0.0, 1.0, 0.0], [0.0, 0.0, 1.0]]));
+        assert!(!usable(&[
+            [f32::NAN, 0.0, 0.0],
+            [0.0, 1.0, 0.0],
+            [0.0, 0.0, 1.0]
+        ]));
         assert!(usable(&SIX_D_D65));
     }
 

core/dr-export/Cargo.toml

@@ -38,4 +38,7 @@ dr-gpu.workspace = true
 dr-pipeline.workspace = true
 env_logger.workspace = true
 pollster.workspace = true
+# The DNG writer's test reads its output back through the decoder the
+# library uses, which is the whole claim the writer makes (S15.1).
+rawler.workspace = true
 zune-jpeg.workspace = true

core/dr-export/src/dng.rs

@@ -0,0 +1,351 @@
+//! TRACES: FR-MRG-3
+//! A linear DNG: the container a merge writes its composite into.
+//!
+//! Decided by S15.1 (2026-09-19): rawler reads back a `LinearRaw` DNG the
+//! application writes, so a composite re-enters the library as
+//! `Format::Dng` through the decoder every camera DNG uses. What is written
+//! is a RAW in every sense a warp can preserve — camera-linear `u16`
+//! samples at the first source's own scale, its matrices, illuminants,
+//! as-shot neutral and body name — so the panorama is developed afterwards
+//! as one photograph, from the sensor's numbers.
+//!
+//! # Streamed, not buffered
+//!
+//! The composite is larger than any single photograph the pipeline renders
+//! and larger than the tablet's memory (FR-MRG-11), so the writer never
+//! holds it. Strips are pulled from the caller one at a time through a
+//! closure, in order, and written as they arrive; the caller renders a band
+//! of chunks, hands over its rows, and moves on.
+//!
+//! # Why the `tiff` crate after all
+//!
+//! S15.1's spike hand-rolled its IFD because the crate's encoder fixes
+//! `PhotometricInterpretation` to RGB when the image is opened. It does — but
+//! a directory is a map and a later `write_tag` on the same tag replaces the
+//! earlier, so `LinearRaw` goes in over the top and everything else the
+//! crate does (strips, offsets, sub-IFDs, the EXIF block `encode.rs` already
+//! knows how to write) is kept.
+
+use std::io::{Seek, Write};
+
+use tiff::encoder::{colortype, DirectoryEncoder, SRational, TiffEncoder, TiffKind, TiffValue};
+use tiff::tags::Tag;
+
+use crate::encode::{sub_directories, tag_metadata, Ascii, Rationals};
+use crate::{ExportError, SourceMetadata};
+
+/// What the DNG says about the camera that "took" the composite: the first
+/// source's profile, carried across so the composite develops through it.
+#[derive(Debug, Clone, PartialEq)]
+pub struct DngProfile {
+    /// `UniqueCameraModel`, the name the profile database matches on.
+    pub unique_model: String,
+    /// `(CalibrationIlluminant, ColorMatrix)`: the EXIF light-source code and
+    /// the XYZ → camera matrix measured under it. One or two.
+    pub calibrations: Vec<(u16, [[f32; 3]; 3])>,
+    /// `AsShotNeutral`, camera RGB of the scene's white.
+    pub as_shot_neutral: [f32; 3],
+    /// `WhiteLevel`: the sample value that is clipping. The first source's
+    /// white minus its black, since the samples are black-subtracted.
+    pub white_level: u32,
+}
+
+/// Write a linear DNG, pulling `rows_per_strip`-row strips from `strips`.
+///
+/// Each call to `strips` receives the strip index and a buffer to fill with
+/// `width × rows × 3` interleaved RGB `u16` samples (the last strip may be
+/// shorter). `source` supplies the `Make`, `Model`, dates and EXIF block
+/// exactly as an export does (FR-EXP-8 sanitising already applied by the
+/// caller).
+///
+/// `PhotometricInterpretation = LinearRaw`, `DNGVersion 1.4`, uncompressed,
+/// `Orientation = 1` — the composite is written upright (panorama.md §8).
+///
+/// `crop` is asked once every strip is in, and its answer — the largest
+/// rectangle the frames covered, found while the strips went by
+/// (`Inscribed`) — becomes `DefaultCropOrigin`/`DefaultCropSize`
+/// (FR-MRG-4): the file opens on the picture, and the border is still in it.
+// Eight arguments, and each is a different thing: the sink, three
+// dimensions, the profile, the header, the strip source and the crop. A
+// struct for them would be a struct with one caller.
+#[allow(clippy::too_many_arguments)]
+pub fn write_linear_dng<W, F, C>(
+    out: W,
+    width: u32,
+    height: u32,
+    rows_per_strip: u32,
+    profile: &DngProfile,
+    source: Option<&SourceMetadata>,
+    mut strips: F,
+    crop: C,
+) -> Result<(), ExportError>
+where
+    W: Write + Seek,
+    F: FnMut(usize, &mut Vec<u16>) -> Result<(), ExportError>,
+    C: FnOnce() -> Option<crate::Rect>,
+{
+    let enc = |e: tiff::TiffError| ExportError::Encode(e.to_string());
+    let mut encoder = TiffEncoder::new(out).map_err(enc)?;
+    let sub = sub_directories(&mut encoder, source, width, height)?;
+    let mut image = encoder
+        .new_image::<colortype::RGB16>(width, height)
+        .map_err(enc)?;
+    image.rows_per_strip(rows_per_strip.max(1)).map_err(enc)?;
+    tag_metadata(image.encoder(), source, &sub)?;
+    tag_dng(image.encoder(), profile).map_err(enc)?;
+
+    let rows = rows_per_strip.max(1);
+    let strip_count = height.div_ceil(rows) as usize;
+    let mut buf: Vec<u16> = Vec::with_capacity((width * rows * 3) as usize);
+    for k in 0..strip_count {
+        buf.clear();
+        strips(k, &mut buf)?;
+        let expected_rows = rows.min(height - k as u32 * rows);
+        let expected = (width * expected_rows * 3) as usize;
+        if buf.len() != expected {
+            return Err(ExportError::Encode(format!(
+                "strip {k} has {} samples, expected {expected}",
+                buf.len()
+            )));
+        }
+        image.write_strip(&buf).map_err(enc)?;
+    }
+    if let Some(r) = crop().filter(|r| r.width > 0 && r.height > 0) {
+        let r = crate::Rect {
+            x: r.x.min(width - 1),
+            y: r.y.min(height - 1),
+            width: r.width.min(width - r.x.min(width - 1)),
+            height: r.height.min(height - r.y.min(height - 1)),
+        };
+        image
+            .encoder()
+            .write_tag(Tag::Unknown(tag::DEFAULT_CROP_ORIGIN), &[r.x, r.y][..])
+            .map_err(enc)?;
+        image
+            .encoder()
+            .write_tag(
+                Tag::Unknown(tag::DEFAULT_CROP_SIZE),
+                &[r.width, r.height][..],
+            )
+            .map_err(enc)?;
+    }
+    image.finish().map_err(enc)
+}
+
+/// The tags that make a TIFF a DNG, and a linear one.
+fn tag_dng<W, K>(dir: &mut DirectoryEncoder<'_, W, K>, profile: &DngProfile) -> tiff::TiffResult<()>
+where
+    W: Write + Seek,
+    K: TiffKind,
+{
+    // Over the top of what `new_image` wrote: this is the whole trick.
+    dir.write_tag(Tag::PhotometricInterpretation, LINEAR_RAW)?;
+    dir.write_tag(Tag::Orientation, 1u16)?;
+    dir.write_tag(Tag::Unknown(tag::DNG_VERSION), &[1u8, 4, 0, 0][..])?;
+    dir.write_tag(Tag::Unknown(tag::DNG_BACKWARD_VERSION), &[1u8, 4, 0, 0][..])?;
+    dir.write_tag(
+        Tag::Unknown(tag::UNIQUE_CAMERA_MODEL),
+        Ascii(&profile.unique_model),
+    )?;
+    dir.write_tag(
+        Tag::Unknown(tag::WHITE_LEVEL),
+        &[profile.white_level; 3][..],
+    )?;
+    dir.write_tag(Tag::Unknown(tag::BLACK_LEVEL), &[0u32; 3][..])?;
+
+    for (slot, (illuminant, matrix)) in profile.calibrations.iter().take(2).enumerate() {
+        let (ill_tag, mat_tag) = if slot == 0 {
+            (tag::CALIBRATION_ILLUMINANT_1, tag::COLOR_MATRIX_1)
+        } else {
+            (tag::CALIBRATION_ILLUMINANT_2, tag::COLOR_MATRIX_2)
+        };
+        dir.write_tag(Tag::Unknown(ill_tag), *illuminant)?;
+        let flat: Vec<SRational> = matrix
+            .iter()
+            .flatten()
+            .map(|&v| SRational {
+                n: (v * 10_000.0).round() as i32,
+                d: 10_000,
+            })
+            .collect();
+        dir.write_tag(Tag::Unknown(mat_tag), SRationals(&flat))?;
+    }
+
+    let neutral: Vec<(u32, u32)> = profile
+        .as_shot_neutral
+        .iter()
+        .map(|&v| ((v.max(0.0) * 1_000_000.0).round() as u32, 1_000_000))
+        .collect();
+    dir.write_tag(Tag::Unknown(tag::AS_SHOT_NEUTRAL), Rationals(&neutral))?;
+    Ok(())
+}
+
+/// `PhotometricInterpretation` for demosaiced, un-rendered sensor data.
+const LINEAR_RAW: u16 = 34892;
+
+/// DNG tag numbers the `tiff` crate has no names for.
+mod tag {
+    pub const DNG_VERSION: u16 = 50706;
+    pub const DNG_BACKWARD_VERSION: u16 = 50707;
+    pub const UNIQUE_CAMERA_MODEL: u16 = 50708;
+    pub const BLACK_LEVEL: u16 = 50714;
+    pub const WHITE_LEVEL: u16 = 50717;
+    pub const DEFAULT_CROP_ORIGIN: u16 = 50719;
+    pub const DEFAULT_CROP_SIZE: u16 = 50720;
+    pub const COLOR_MATRIX_1: u16 = 50721;
+    pub const COLOR_MATRIX_2: u16 = 50722;
+    pub const AS_SHOT_NEUTRAL: u16 = 50728;
+    pub const CALIBRATION_ILLUMINANT_1: u16 = 50778;
+    pub const CALIBRATION_ILLUMINANT_2: u16 = 50779;
+}
+
+/// A run of `SRATIONAL`s, as `encode::Rationals` is for `RATIONAL`.
+struct SRationals<'a>(&'a [SRational]);
+
+impl TiffValue for SRationals<'_> {
+    const BYTE_LEN: u8 = 8;
+    const FIELD_TYPE: tiff::tags::Type = tiff::tags::Type::SRATIONAL;
+
+    fn count(&self) -> usize {
+        self.0.len()
+    }
+
+    fn data(&self) -> std::borrow::Cow<'_, [u8]> {
+        let mut out = Vec::with_capacity(self.0.len() * 8);
+        for r in self.0 {
+            out.extend_from_slice(&r.n.to_ne_bytes());
+            out.extend_from_slice(&r.d.to_ne_bytes());
+        }
+        std::borrow::Cow::Owned(out)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn profile() -> DngProfile {
+        DngProfile {
+            unique_model: "Canon EOS 6D".into(),
+            calibrations: vec![
+                (17, [[0.8, -0.2, 0.1], [-0.3, 1.1, 0.2], [0.0, -0.1, 0.9]]),
+                (21, [[0.7, -0.1, 0.0], [-0.2, 1.0, 0.1], [0.0, -0.2, 0.8]]),
+            ],
+            as_shot_neutral: [0.5, 1.0, 0.6],
+            white_level: 13_023,
+        }
+    }
+
+    fn write(width: u32, height: u32, rows: u32) -> Vec<u8> {
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        let source = SourceMetadata {
+            make: Some("Canon".into()),
+            model: Some("Canon EOS 6D".into()),
+            captured_at: Some(1_754_398_664),
+            captured_offset: Some(120),
+            ..Default::default()
+        };
+        write_linear_dng(
+            &mut bytes,
+            width,
+            height,
+            rows,
+            &profile(),
+            Some(&source),
+            |k, buf| {
+                let first = k as u32 * rows;
+                let n = rows.min(height - first);
+                for y in first..first + n {
+                    for x in 0..width {
+                        buf.extend([(x + y * width) as u16, 1000, 2000]);
+                    }
+                }
+                Ok(())
+            },
+            || {
+                Some(crate::Rect {
+                    x: 2,
+                    y: 1,
+                    width: 15,
+                    height: 10,
+                })
+            },
+        )
+        .expect("written");
+        bytes.into_inner()
+    }
+
+    #[test]
+    fn rawler_reads_it_back_as_linear_raw() {
+        let bytes = write(20, 13, 4);
+        let source = rawler::rawsource::RawSource::new_from_slice(&bytes);
+        let decoder = rawler::get_decoder(&source).expect("a DNG");
+        let image = decoder
+            .raw_image(&source, &Default::default(), false)
+            .expect("decodes");
+        assert_eq!((image.width, image.height, image.cpp), (20, 13, 3));
+        assert_eq!(image.whitelevel.0[0], 13_023);
+        // Pixel (3, 2) is (3 + 2·20, 1000, 2000) — samples in order, strips
+        // joined without a seam.
+        let rawler::RawImageData::Integer(data) = &image.data else {
+            panic!("integer samples")
+        };
+        let i = (2 * 20 + 3) * 3;
+        assert_eq!(&data[i..i + 3], &[43, 1000, 2000]);
+        // Last row, from the short final strip.
+        let i = (12 * 20 + 19) * 3;
+        assert_eq!(data[i], (19 + 12 * 20) as u16);
+        // The profile came through as the camera's.
+        assert!(!image.camera.color_matrix.is_empty());
+        assert_eq!(image.model, "Canon EOS 6D");
+        // The default crop is what the decoder reports as the picture.
+        let crop = image.crop_area.expect("a crop");
+        assert_eq!((crop.p.x, crop.p.y, crop.d.w, crop.d.h), (2, 1, 15, 10));
+    }
+
+    #[test]
+    fn the_catalog_reads_the_date_from_a_head_and_a_tail() {
+        // TRACES: FR-CAT-5
+        // The IFDs follow the pixels, so a scan that has the first bytes of
+        // the file has a pointer into nothing; rawler finds no decoder in
+        // that, and the composite would sit undated at the end of the grid.
+        // The scan's second range — from the first IFD to the end — with
+        // the head is enough to date it, and to name the camera.
+        let bytes = write(640, 400, 64);
+        let head = &bytes[..4096];
+        assert!(
+            dr_decode::metadata(head).is_err(),
+            "the head alone must not read"
+        );
+        let at = dr_decode::trailing_ifd(head).expect("the IFD is beyond the head");
+        assert!(at as usize > head.len());
+        let tail = &bytes[at as usize..];
+        assert!(tail.len() < 4096, "the tail is the IFD, not the pixels");
+        let md = dr_decode::metadata_split(head, tail, at).expect("read from two ranges");
+        assert_eq!(md.captured_at, Some(1_754_398_664));
+        assert_eq!(md.captured_offset, Some(120));
+        assert_eq!(md.model.as_deref(), Some("Canon EOS 6D"));
+        // A head that holds everything is not a trailing-IFD file.
+        assert_eq!(dr_decode::trailing_ifd(&bytes), None);
+    }
+
+    #[test]
+    fn a_strip_of_the_wrong_length_is_refused() {
+        let mut bytes = std::io::Cursor::new(Vec::new());
+        let err = write_linear_dng(
+            &mut bytes,
+            8,
+            8,
+            8,
+            &profile(),
+            None,
+            |_, buf| {
+                buf.extend([0u16; 10]);
+                Ok(())
+            },
+            || None,
+        )
+        .unwrap_err();
+        assert!(matches!(err, ExportError::Encode(_)));
+    }
+}

core/dr-export/src/encode.rs

@@ -77,9 +77,7 @@ pub fn encode(
         .map(|m| m.sanitised(settings.strip_location));
     // JPEG and PNG take a finished block; TIFF writes the tags into its own
     // directory and needs the fields.
-    let block = carried
-        .as_ref()
-        .and_then(|m| exif::block(m, width, height));
+    let block = carried.as_ref().and_then(|m| exif::block(m, width, height));
 
     match settings.format {
         ExportFormat::Jpeg => jpeg(
@@ -215,7 +213,7 @@ impl tiff::encoder::TiffValue for Undefined<'_> {
 /// specification says, `dr-decode` reads them back with `from_utf8_lossy`, and
 /// a mangled accent is a far better outcome than a refusal. So the bytes go
 /// through verbatim with the terminating NUL the type requires.
-struct Ascii<'a>(&'a str);
+pub(crate) struct Ascii<'a>(pub(crate) &'a str);
 
 impl tiff::encoder::TiffValue for Ascii<'_> {
     const BYTE_LEN: u8 = 1;
@@ -243,7 +241,7 @@ impl tiff::encoder::TiffValue for Ascii<'_> {
 /// a value that forced little-endian would be read back byte-swapped on a
 /// big-endian machine. `exif.rs` builds its own header and so chooses its own
 /// order; here the container has already chosen.
-struct Rationals<'a>(&'a [(u32, u32)]);
+pub(crate) struct Rationals<'a>(pub(crate) &'a [(u32, u32)]);
 
 impl tiff::encoder::TiffValue for Rationals<'_> {
     const BYTE_LEN: u8 = 8;
@@ -303,8 +301,11 @@ where
     W: std::io::Write + std::io::Seek,
     K: tiff::encoder::TiffKind,
 {
-    dir.write_tag(tiff::tags::Tag::Unknown(TAG_ICC_PROFILE), Undefined(profile))
-        .map_err(|e| ExportError::Encode(e.to_string()))
+    dir.write_tag(
+        tiff::tags::Tag::Unknown(TAG_ICC_PROFILE),
+        Undefined(profile),
+    )
+    .map_err(|e| ExportError::Encode(e.to_string()))
 }
 
 /// TRACES: FR-EXP-8
@@ -316,7 +317,7 @@ where
 /// and then no pointer is written either, so the file has no trace of the
 /// directory rather than a pointer to an empty one.
 #[derive(Default)]
-struct SubDirectories {
+pub(crate) struct SubDirectories {
     exif: Option<u32>,
     gps: Option<u32>,
 }
@@ -334,7 +335,7 @@ struct SubDirectories {
 /// A TIFF gets no separate EXIF *block* — no APP1, no `eXIf` chunk. Its own
 /// directory is the EXIF structure, and adding a second copy inside it would
 /// give a reader two answers to every question.
-fn sub_directories<W>(
+pub(crate) fn sub_directories<W>(
     encoder: &mut tiff::encoder::TiffEncoder<W>,
     source: Option<&SourceMetadata>,
     width: u32,
@@ -376,7 +377,10 @@ where
                 )?;
             }
             if let Some(f) = md.aperture.filter(|f| *f > 0.0) {
-                dir.write_tag(Tag::Unknown(exif::tag::FNUMBER), Rationals(&[exif::tenths(f)]))?;
+                dir.write_tag(
+                    Tag::Unknown(exif::tag::FNUMBER),
+                    Rationals(&[exif::tenths(f)]),
+                )?;
             }
             if let Some(f) = md.focal_length.filter(|f| *f > 0.0) {
                 dir.write_tag(
@@ -461,7 +465,7 @@ where
 ///
 /// No `Orientation`, for the reason `exif.rs` gives at length: the pixels
 /// arriving here are already upright.
-fn tag_metadata<W, K>(
+pub(crate) fn tag_metadata<W, K>(
     dir: &mut tiff::encoder::DirectoryEncoder<'_, W, K>,
     source: Option<&SourceMetadata>,
     sub: &SubDirectories,
@@ -935,11 +939,16 @@ mod tests {
             assert_eq!(md.aperture, Some(2.8), "{format:?}");
             assert_eq!(md.focal_length, Some(85.0), "{format:?}");
 
-            let loc = md.location.unwrap_or_else(|| panic!("{format:?} lost the fix"));
+            let loc = md
+                .location
+                .unwrap_or_else(|| panic!("{format:?} lost the fix"));
             // Within a metre of where it started, which is finer than any
             // consumer receiver and far finer than the tag's own rounding.
             assert!((loc.latitude - LATITUDE).abs() < 1e-5, "{format:?} {loc:?}");
-            assert!((loc.longitude - LONGITUDE).abs() < 1e-5, "{format:?} {loc:?}");
+            assert!(
+                (loc.longitude - LONGITUDE).abs() < 1e-5,
+                "{format:?} {loc:?}"
+            );
             assert_eq!(loc.altitude, Some(35.0), "{format:?}");
         }
     }

core/dr-export/src/inscribed.rs

@@ -0,0 +1,156 @@
+//! TRACES: FR-MRG-4
+//! The largest rectangle inside a coverage mask, found a row at a time.
+//!
+//! A merged panorama has ragged edges: the frames' footprints under a
+//! cylinder or a sphere are not rectangles, and the composite carries a
+//! black border where none of them reached. FR-MRG-4 asks for an auto-crop
+//! to the largest inscribed rectangle. This finds it as the bands are
+//! produced, so the composite is never held to be measured (FR-MRG-11):
+//! each row extends a running histogram of consecutive covered rows above
+//! it, and the largest rectangle ending on that row is the largest
+//! rectangle under the histogram — a stack pass, linear in the width.
+//!
+//! The crop is written as the DNG's `DefaultCropOrigin`/`DefaultCropSize`,
+//! which every reader honours and which discards nothing: the pixels
+//! outside it are still in the file for a photographer who wants them.
+
+/// The rectangle so far, in pixels from the top left.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub struct Rect {
+    pub x: u32,
+    pub y: u32,
+    pub width: u32,
+    pub height: u32,
+}
+
+impl Rect {
+    pub fn area(&self) -> u64 {
+        u64::from(self.width) * u64::from(self.height)
+    }
+}
+
+/// Feed rows top to bottom; ask for the best at any point.
+#[derive(Debug, Clone)]
+pub struct Inscribed {
+    width: usize,
+    /// How many consecutive covered rows end at the last row fed, per column.
+    heights: Vec<u32>,
+    rows: u32,
+    best: Rect,
+}
+
+impl Inscribed {
+    pub fn new(width: u32) -> Self {
+        Inscribed {
+            width: width as usize,
+            heights: vec![0; width as usize],
+            rows: 0,
+            best: Rect::default(),
+        }
+    }
+
+    /// One more row of coverage, `width` long.
+    pub fn push_row(&mut self, covered: &[bool]) {
+        debug_assert_eq!(covered.len(), self.width);
+        for (h, &c) in self.heights.iter_mut().zip(covered) {
+            *h = if c { *h + 1 } else { 0 };
+        }
+        self.rows += 1;
+        // Largest rectangle under the histogram, with a sentinel column of
+        // height 0 at the end so every bar is popped.
+        let mut stack: Vec<usize> = Vec::new();
+        for i in 0..=self.width {
+            let h = if i < self.width { self.heights[i] } else { 0 };
+            while let Some(&top) = stack.last() {
+                if self.heights[top] <= h {
+                    break;
+                }
+                stack.pop();
+                let height = self.heights[top];
+                let left = stack.last().map_or(0, |&l| l + 1);
+                let width = (i - left) as u32;
+                let area = u64::from(width) * u64::from(height);
+                if area > self.best.area() {
+                    self.best = Rect {
+                        x: left as u32,
+                        y: self.rows - height,
+                        width,
+                        height,
+                    };
+                }
+            }
+            stack.push(i);
+        }
+    }
+
+    /// Several rows at once, as a band hands them over.
+    pub fn push_rows(&mut self, covered: &[bool], rows: u32) {
+        for r in 0..rows as usize {
+            self.push_row(&covered[r * self.width..(r + 1) * self.width]);
+        }
+    }
+
+    pub fn best(&self) -> Rect {
+        self.best
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn from_art(art: &[&str]) -> Rect {
+        let mut ins = Inscribed::new(art[0].len() as u32);
+        for row in art {
+            let covered: Vec<bool> = row.chars().map(|c| c == '#').collect();
+            ins.push_row(&covered);
+        }
+        ins.best()
+    }
+
+    #[test]
+    fn a_full_mask_is_its_own_rectangle() {
+        let r = from_art(&["####", "####", "####"]);
+        assert_eq!(
+            r,
+            Rect {
+                x: 0,
+                y: 0,
+                width: 4,
+                height: 3
+            }
+        );
+    }
+
+    #[test]
+    fn ragged_edges_are_cut_off() {
+        // A cylinder's footprint: narrower at top and bottom.
+        let r = from_art(&[
+            "..####..", ".######.", "########", "########", ".######.", "..####..",
+        ]);
+        // 6 wide × 4 tall = 24 beats 8 × 2 = 16 and 4 × 6 = 24 ties; the
+        // first found wins a tie, which is the wider one here.
+        assert_eq!(r.area(), 24);
+        assert!(r.width == 6 && r.height == 4 || r.width == 4 && r.height == 6);
+    }
+
+    #[test]
+    fn a_hole_is_avoided() {
+        let r = from_art(&["#####", "##.##", "#####", "#####"]);
+        // Left of the hole: 2 × 4 = 8; right: 2 × 4 = 8; below: 5 × 2 = 10.
+        assert_eq!(
+            r,
+            Rect {
+                x: 0,
+                y: 2,
+                width: 5,
+                height: 2
+            }
+        );
+    }
+
+    #[test]
+    fn nothing_covered_is_nothing() {
+        assert_eq!(from_art(&["....", "...."]).area(), 0);
+    }
+}

core/dr-export/src/lib.rs

@@ -1,4 +1,4 @@
-//! TRACES: FR-EXP-1 | FR-EXP-2 | FR-EXP-3 | FR-EXP-4 | FR-EXP-6 | FR-EXP-9
+//! TRACES: FR-EXP-1 | FR-EXP-2 | FR-EXP-3 | FR-EXP-4 | FR-EXP-6 | FR-EXP-9 | R3
 //! Turning a rendered frame into a file's worth of bytes.
 //!
 //! # What this crate is, and is not
@@ -24,16 +24,20 @@
 
 use dr_types::{ColourSpace, ExportFormat, ExportSettings};
 
+mod dng;
 mod encode;
 mod error;
 mod exif;
 pub mod icc;
+mod inscribed;
 mod metadata;
 mod name;
 mod sharpen;
 mod size;
 
+pub use dng::{write_linear_dng, DngProfile};
 pub use error::ExportError;
+pub use inscribed::{Inscribed, Rect};
 pub use metadata::SourceMetadata;
 pub use name::{resolve_name, NameContext};
 pub use size::target_size;
@@ -179,7 +183,15 @@ pub fn export(
         settings.allow_upscaling,
     );
 
-    let resized = size::resample(frame, width, height);
+    // TRACES: FR-EXP-3
+    // One mode promises exact dimensions rather than a bound on them, and it
+    // is the only place the fit/fill distinction survives: `target_size` has
+    // already reported what the file will be either way.
+    let resized = if settings.sizing.crops_to_fill() {
+        size::resample_filling(frame, width, height)
+    } else {
+        size::resample(frame, width, height)
+    };
 
     // Scaled by how much the image actually shrank: a full-size export needs
     // no compensation, and a thumbnail needs a great deal.
@@ -250,7 +262,13 @@ mod tests {
 
     #[test]
     fn png_export_produces_a_png() {
-        let out = export(&frame(32, 32), &settings(ExportFormat::Png), "a.png".into(), None).unwrap();
+        let out = export(
+            &frame(32, 32),
+            &settings(ExportFormat::Png),
+            "a.png".into(),
+            None,
+        )
+        .unwrap();
         assert_eq!(&out.bytes[..8], b"\x89PNG\r\n\x1a\n");
     }
 
@@ -270,8 +288,20 @@ mod tests {
     fn a_sixteen_bit_tiff_is_larger_than_an_eight_bit_one() {
         // Both are uncompressed RGB; the only difference is the sample width,
         // so this is what proves the 16-bit path is not quietly writing 8.
-        let eight = export(&frame(16, 16), &settings(ExportFormat::Tiff8), "a".into(), None).unwrap();
-        let sixteen = export(&frame(16, 16), &settings(ExportFormat::Tiff16), "a".into(), None).unwrap();
+        let eight = export(
+            &frame(16, 16),
+            &settings(ExportFormat::Tiff8),
+            "a".into(),
+            None,
+        )
+        .unwrap();
+        let sixteen = export(
+            &frame(16, 16),
+            &settings(ExportFormat::Tiff16),
+            "a".into(),
+            None,
+        )
+        .unwrap();
         assert!(sixteen.bytes.len() > eight.bytes.len());
     }
 

core/dr-export/src/size.rs

@@ -25,8 +25,11 @@ const A: f32 = 3.0;
 /// TRACES: FR-EXP-3
 /// Resolve the requested sizing against a source, honouring the upscale rule.
 ///
-/// Aspect is preserved in every mode, so only one dimension is ever the
-/// requested one.
+/// Aspect is preserved in every mode. In all but one that means only a single
+/// dimension is ever the requested one; [`SizingMode::FillBox`] is the
+/// exception, and it keeps the aspect by *discarding* the overhang rather than
+/// by settling for a smaller box — see [`resample_filling`], which does the
+/// discarding.
 ///
 /// **Upscaling is refused by clamping, never by failing.** FR-EXP-3 makes
 /// upscaling opt-in, and a batch of mixed frames must not abort because one
@@ -45,21 +48,56 @@ pub fn target_size(
         SizingMode::Original => (src_w, src_h),
         SizingMode::LongEdge(n) => scale_to(src_w, src_h, n, src_w >= src_h),
         SizingMode::ShortEdge(n) => scale_to(src_w, src_h, n, src_w < src_h),
+        // Fit is a ceiling on both axes, so the smaller factor wins and the
+        // result touches the box on one axis only.
+        SizingMode::FitBox(bw, bh) => {
+            scale_by(src_w, src_h, box_factor(src_w, src_h, bw, bh, f64::min))
+        }
+        // Fill is the box, exactly. The scale that covers it is the larger
+        // factor, and the overhang is taken off in `resample_filling` — this
+        // reports what the file will be, which is the whole reason the mode
+        // exists.
+        SizingMode::FillBox(bw, bh) => (bw.max(1), bh.max(1)),
         SizingMode::Percentage(p) => {
             let f = f64::from(p) / 100.0;
-            (
-                ((f64::from(src_w) * f).round() as u32).max(1),
-                ((f64::from(src_h) * f).round() as u32).max(1),
-            )
+            scale_by(src_w, src_h, f)
         }
     };
 
     if !allow_upscaling && (w > src_w || h > src_h) {
+        // A fill box has to keep its shape even when it cannot keep its size:
+        // the mode's promise is an exact aspect ratio at exact dimensions, and
+        // falling back to the source's own shape would quietly export a 3:2
+        // file where a 16:9 one was asked for. So the *box* is scaled down to
+        // what the source can cover, rather than abandoned.
+        if let SizingMode::FillBox(bw, bh) = sizing {
+            let cover = box_factor(src_w, src_h, bw, bh, f64::max);
+            if cover > 1.0 {
+                return scale_by(bw.max(1), bh.max(1), 1.0 / cover);
+            }
+        }
         return (src_w, src_h);
     }
     (w.max(1), h.max(1))
 }
 
+/// TRACES: FR-EXP-3
+/// The scale that puts `src` against a `bw × bh` box, `choose` deciding which
+/// axis governs: `f64::min` fits inside it, `f64::max` covers it.
+fn box_factor(src_w: u32, src_h: u32, bw: u32, bh: u32, choose: fn(f64, f64) -> f64) -> f64 {
+    let fw = f64::from(bw.max(1)) / f64::from(src_w.max(1));
+    let fh = f64::from(bh.max(1)) / f64::from(src_h.max(1));
+    choose(fw, fh)
+}
+
+/// Both axes by one factor, never rounding away to nothing.
+fn scale_by(w: u32, h: u32, factor: f64) -> (u32, u32) {
+    (
+        ((f64::from(w) * factor).round() as u32).max(1),
+        ((f64::from(h) * factor).round() as u32).max(1),
+    )
+}
+
 /// Scale so that the chosen edge lands on `n`.
 fn scale_to(src_w: u32, src_h: u32, n: u32, width_is_the_edge: bool) -> (u32, u32) {
     let n = n.max(1);
@@ -95,6 +133,46 @@ pub fn resample(frame: &Frame, dst_w: u32, dst_h: u32) -> Vec<u8> {
     pass(&horizontal, dst_w, frame.height, dst_w, dst_h, false)
 }
 
+/// TRACES: FR-EXP-3
+/// Resample onto exactly `(dst_w, dst_h)`, covering the box and cutting the
+/// overhang off the middle.
+///
+/// The other half of [`SizingMode::FillBox`]. [`resample`] alone would do the
+/// job by *stretching* the frame onto the box, which is the one outcome a
+/// photographer would never accept — a 3:2 photograph squeezed onto a 16:9
+/// panel is visibly wrong in a way no amount of resolution fixes.
+///
+/// So the frame is scaled until it covers the box, on whichever axis needs the
+/// most, and the surplus is taken symmetrically off the other. Centred rather
+/// than anchored: the crop tool is where a photographer decides *which* part
+/// of the frame survives, and this stage guessing differently would fight it.
+/// Locking the crop to the export's ratio leaves nothing here to cut.
+pub fn resample_filling(frame: &Frame, dst_w: u32, dst_h: u32) -> Vec<u8> {
+    let (dst_w, dst_h) = (dst_w.max(1), dst_h.max(1));
+
+    // Rounded *up*, and floored at the destination: a cover scale that rounds
+    // down leaves the box a pixel short on one axis, and the crop below would
+    // then read past the end of the buffer.
+    let cover = box_factor(frame.width, frame.height, dst_w, dst_h, f64::max);
+    let cw = (((f64::from(frame.width) * cover).ceil()) as u32).max(dst_w);
+    let ch = (((f64::from(frame.height) * cover).ceil()) as u32).max(dst_h);
+
+    let covered = resample(frame, cw, ch);
+    if cw == dst_w && ch == dst_h {
+        return covered;
+    }
+
+    let (x0, y0) = ((cw - dst_w) / 2, (ch - dst_h) / 2);
+    let mut out = vec![0u8; (dst_w as usize) * (dst_h as usize) * 4];
+    for y in 0..dst_h as usize {
+        let src = ((y + y0 as usize) * cw as usize + x0 as usize) * 4;
+        let dst = y * dst_w as usize * 4;
+        let run = dst_w as usize * 4;
+        out[dst..dst + run].copy_from_slice(&covered[src..src + run]);
+    }
+    out
+}
+
 /// One separable pass. `horizontal` picks the axis being resampled.
 fn pass(src: &[u8], src_w: u32, src_h: u32, dst_w: u32, dst_h: u32, horizontal: bool) -> Vec<u8> {
     let (src_len, dst_len) = if horizontal {
@@ -219,6 +297,124 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_fit_box_stays_inside_the_box_and_keeps_its_shape() {
+        // Fit is a ceiling on both axes, so a 3:2 frame in a 16:9 box comes
+        // back short of the box's width, never past its height.
+        assert_eq!(
+            target_size(6000, 4000, SizingMode::FitBox(3840, 2160), false),
+            (3240, 2160)
+        );
+        // Portrait into the same box: now the height governs nothing and the
+        // width does.
+        assert_eq!(
+            target_size(4000, 6000, SizingMode::FitBox(3840, 2160), false),
+            (1440, 2160)
+        );
+    }
+
+    #[test]
+    fn a_fill_box_is_the_box_exactly() {
+        // The whole point of the mode. A display that accepts one resolution
+        // and rejects everything else has to get that resolution whatever the
+        // photograph's own shape is.
+        for (w, h) in [(6000u32, 4000u32), (4000, 6000), (5000, 5000)] {
+            assert_eq!(
+                target_size(w, h, SizingMode::FillBox(3840, 2160), false),
+                (3840, 2160),
+                "{w}x{h} did not fill the box"
+            );
+        }
+    }
+
+    #[test]
+    fn a_fill_box_too_large_for_the_source_keeps_its_shape_not_the_sources() {
+        // Upscaling off, and the source cannot cover 4K. Falling back to the
+        // source's own size would export a 3:2 file where 16:9 was asked
+        // for — silently wrong in exactly the way the mode exists to prevent.
+        // The box shrinks instead.
+        let (w, h) = target_size(1600, 1200, SizingMode::FillBox(3840, 2160), false);
+        assert!(w <= 1600 && h <= 1200, "upscaled to {w}x{h}");
+        let want = 3840.0 / 2160.0;
+        assert!(
+            ((w as f64 / h as f64) / want - 1.0).abs() < 0.01,
+            "{w}x{h} is not the box's shape"
+        );
+    }
+
+    #[test]
+    fn a_fill_box_within_the_source_is_honoured_with_upscaling_off() {
+        // The ordinary case: a 24 MP frame has pixels to spare for a 4K panel,
+        // so nothing is being enlarged and the clamp must not fire.
+        assert_eq!(
+            target_size(6000, 4000, SizingMode::FillBox(3840, 2160), false),
+            (3840, 2160)
+        );
+    }
+
+    #[test]
+    fn a_filled_frame_comes_back_at_exactly_the_box() {
+        let f = frame(128, 64);
+        // Wider than the source's 2:1, so the crop comes off the width.
+        assert_eq!(resample_filling(&f, 40, 40).len(), 40 * 40 * 4);
+        assert_eq!(resample_filling(&f, 100, 25).len(), 100 * 25 * 4);
+        // Already the box: no work, and no drift.
+        assert_eq!(resample_filling(&f, 128, 64), f.rgba);
+    }
+
+    #[test]
+    fn a_fill_crops_rather_than_stretching() {
+        // The property that separates fill from handing the box straight to
+        // `resample`. The test frame ramps red left to right, so a 2:1 source
+        // squeezed into a square would compress that ramp into the full
+        // width — where a centre crop keeps its middle, and therefore starts
+        // and ends well inside the source's own range.
+        let f = frame(128, 128);
+        let square = resample(&f, 64, 64);
+        let filled = resample_filling(&f, 32, 64);
+
+        let left = |b: &[u8]| b[0];
+        let right = |b: &[u8], w: usize| b[(w - 1) * 4];
+
+        assert!(
+            left(&filled) > left(&square),
+            "a centre crop must start further into the ramp"
+        );
+        assert!(
+            right(&filled, 32) < right(&square, 64),
+            "a centre crop must end further from the ramp's end"
+        );
+    }
+
+    #[test]
+    fn a_fill_takes_the_overhang_evenly_off_both_sides() {
+        // Centred, not anchored: the crop tool is where a photographer decides
+        // which part of the frame survives, and this stage must not have an
+        // opinion of its own.
+        let f = frame(128, 128);
+        let filled = resample_filling(&f, 32, 64);
+        let px = |x: usize| filled[x * 4];
+        // The ramp is horizontal, so a centred crop is symmetric about the
+        // frame's own midpoint: the two ends should sit equally far from it.
+        let mid = i32::from(resample(&f, 128, 128)[64 * 4]);
+        let lo = i32::from(px(0));
+        let hi = i32::from(px(31));
+        assert!(
+            ((mid - lo) - (hi - mid)).abs() < 8,
+            "not centred: {lo} .. {mid} .. {hi}"
+        );
+    }
+
+    #[test]
+    fn a_flat_field_survives_a_fill_unchanged() {
+        // Same guard as the fit path: any deviation means the cover scale and
+        // the crop disagree about where the pixels are.
+        let flat = Frame::new(64, 48, vec![200; 64 * 48 * 4]).unwrap();
+        for byte in resample_filling(&flat, 30, 30) {
+            assert_eq!(byte, 200);
+        }
+    }
+
     #[test]
     fn upscaling_is_refused_by_clamping_rather_than_failing() {
         // FR-EXP-3: opt-in, and a batch must not abort over one small frame.

core/dr-face/Cargo.toml

@@ -0,0 +1,52 @@
+[package]
+name = "dr-face"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+[dependencies]
+thiserror.workspace = true
+log.workspace = true
+
+# Inference. `ort` is the API; **what runs it is `dr-inference-engine`'s
+# business** — tract, or an ONNX Runtime the app found on disk, on whichever
+# provider the device has (docs/dev/inference.md). This crate never names either.
+ort = { workspace = true, optional = true }
+dr-inference-engine = { workspace = true, optional = true }
+ndarray = { workspace = true, optional = true }
+
+[dev-dependencies]
+zune-jpeg.workspace = true
+env_logger.workspace = true
+# The M1 probe drives `ort` directly so it can print the raw load error.
+ort = { workspace = true }
+dr-inference-engine = { workspace = true }
+
+[[example]]
+name = "probe"
+required-features = ["inference"]
+
+[[example]]
+name = "faces"
+required-features = ["inference"]
+
+[[example]]
+name = "eyes"
+required-features = ["inference"]
+
+[features]
+# Nothing on by default, and in particular **no `embedded-model`**: the weights
+# are not a build input and never become one (docs/dev/faces.md §2.2). A feature
+# flag that *could* embed them is a flag someone eventually sets in a packaging
+# script, and the InsightFace grant does not survive that.
+default = []
+
+# The ONNX runtime, and the two stages that need it.
+#
+# Separable because the accuracy of this subsystem lives in `calibrate` and
+# `cluster`, which are arithmetic over embeddings with no model in them. They
+# must be testable against synthetic embeddings on a machine with no weights on
+# it — a test suite that needs a research-licensed download is a test suite
+# that does not run in CI.
+inference = ["dep:ort", "dep:dr-inference-engine", "dep:ndarray"]

core/dr-face/examples/eyes.rs

@@ -0,0 +1,145 @@
+//! Detect the faces in a JPEG and read each one's eyes (docs/dev/faces.md §17).
+//!
+//! The thing worth looking at is whether the eye boxes land on eyes and
+//! whether soft ones are refused — so with `--dump DIR` the crops the
+//! classifiers were shown are written out as PPMs, one per eye and one per
+//! head framing, named by image and face, and every line carries the
+//! numbers the readability floors are set from.
+//!
+//!   cargo run -p dr-face --features inference --example eyes -- \
+//!       DET.onnx 2D106DET.onnx OCEC.onnx SGC.onnx [--dump DIR] photo.jpg [photo.jpg ...]
+//!
+//! All four models must have had their dynamic dims pinned first; see
+//! `tools/fix-face-model-shapes.sh`.
+
+use std::path::{Path, PathBuf};
+use std::time::Instant;
+
+use dr_face::{align, DetectOptions, Detector, EyeModels, Pixels};
+
+fn main() {
+    env_logger::init();
+
+    let mut args: Vec<String> = std::env::args().skip(1).collect();
+    let dump = args.iter().position(|a| a == "--dump").map(|i| {
+        args.remove(i);
+        PathBuf::from(args.remove(i))
+    });
+    if args.len() < 5 {
+        eprintln!(
+            "usage: eyes DET.onnx 2D106DET.onnx OCEC.onnx SGC.onnx [--dump DIR] IMAGE.jpg [IMAGE.jpg ...]"
+        );
+        std::process::exit(2);
+    }
+    if let Some(d) = &dump {
+        std::fs::create_dir_all(d).expect("dump dir");
+    }
+
+    let t = Instant::now();
+    let mut detector = Detector::from_path(&args[0]).expect("load detector");
+    let mut models = EyeModels::from_paths(&args[1], &args[2], &args[3]).expect("load eye models");
+    println!("loaded the models in {:?}", t.elapsed());
+
+    let opts = DetectOptions::default();
+    for path in &args[4..] {
+        let (rgb, w, h) = match load_jpeg(path) {
+            Ok(v) => v,
+            Err(e) => {
+                println!("{path}: {e}");
+                continue;
+            }
+        };
+        let dets = detector.detect(&rgb, w, h, &opts).expect("detect");
+        println!("\n{path}  ({w}×{h})  {} face(s)", dets.len());
+
+        let stem = Path::new(path)
+            .file_stem()
+            .map(|s| s.to_string_lossy().into_owned())
+            .unwrap_or_default();
+
+        for (i, d) in dets.iter().enumerate() {
+            let px = Pixels::RgbF32(&rgb);
+            let t = Instant::now();
+            let reading = models
+                .read(px, w, h, d.bbox, &d.landmarks)
+                .expect("read eyes");
+            let ms = t.elapsed().as_secs_f64() * 1e3;
+            let Some((r, lm)) = reading else {
+                println!("  [{i}] nothing to cut, skipped");
+                continue;
+            };
+            println!(
+                "  [{i}] conf {:.2}  box {:.0}×{:.0}  right {:.3} ({:.0}px, sharp {:.3})  left {:.3} ({:.0}px, sharp {:.3})  sunglasses {:.3}  → {:?}  ({ms:.1} ms)",
+                d.confidence,
+                d.width(),
+                d.height(),
+                r.right.open,
+                r.right.px,
+                r.right.sharpness,
+                r.left.open,
+                r.left.px,
+                r.left.sharpness,
+                r.sunglasses,
+                r.state(),
+            );
+            if let Some(dir) = &dump {
+                // The same crops `EyeModels::read` cut, cut again for the
+                // sheet from the landmarks it handed back: the reading itself
+                // carries numbers, not pixels.
+                for (name, contour) in [("right", lm.right_eye()), ("left", lm.left_eye())] {
+                    if let Some(patch) =
+                        align::eye_box(&contour).and_then(|b| align::eye_patch(px, w, h, b))
+                    {
+                        write_ppm(
+                            &dir.join(format!("{stem}-{i}-{name}.ppm")),
+                            patch.pixels(),
+                            align::EYE_PATCH_WIDTH,
+                            align::EYE_PATCH_HEIGHT,
+                        );
+                    }
+                }
+                if let Some(head) = align::head_views(px, w, h, &d.landmarks) {
+                    for (n, view) in head.views().enumerate() {
+                        write_ppm(
+                            &dir.join(format!("{stem}-{i}-head{n}.ppm")),
+                            view,
+                            align::SUNGLASSES_EDGE,
+                            align::SUNGLASSES_EDGE,
+                        );
+                    }
+                }
+            }
+        }
+    }
+}
+
+fn write_ppm(path: &Path, rgb: &[f32], w: usize, h: usize) {
+    let mut out = format!("P6\n{w} {h}\n255\n").into_bytes();
+    out.extend(
+        rgb.iter()
+            .map(|v| (v.clamp(0.0, 1.0) * 255.0).round() as u8),
+    );
+    std::fs::write(path, out).expect("write ppm");
+}
+
+/// Decode to the tightly packed `f32` RGB `0.0..=1.0` the crate expects.
+fn load_jpeg(path: &str) -> Result<(Vec<f32>, usize, usize), String> {
+    let bytes = std::fs::read(path).map_err(|e| e.to_string())?;
+    let mut dec = zune_jpeg::JpegDecoder::new(&bytes);
+    let px = dec.decode().map_err(|e| e.to_string())?;
+    let info = dec.info().ok_or("no jpeg header")?;
+    let (w, h) = (info.width as usize, info.height as usize);
+
+    let rgb: Vec<f32> = match px.len() / (w * h) {
+        3 => px.iter().map(|&v| v as f32 / 255.0).collect(),
+        1 => px
+            .iter()
+            .flat_map(|&v| {
+                let g = v as f32 / 255.0;
+                [g, g, g]
+            })
+            .collect(),
+        n => return Err(format!("{n} components per pixel, expected 1 or 3")),
+    };
+    Ok((rgb, w, h))
+}

core/dr-face/examples/faces.rs

@@ -0,0 +1,128 @@
+//! Detect, align and embed the faces in a JPEG.
+//!
+//! The thing worth looking at is whether the landmarks land on a real
+//! photograph — the same reason `dr-segment` has `examples/detect.rs`.
+//!
+//!   cargo run -p dr-face --features inference --example faces -- \
+//!       DET.onnx EMB.onnx photo.jpg [photo.jpg ...]
+//!
+//! The models must have had their input dims frozen first; see
+//! `tools/fix-face-model-shapes.sh` and docs/dev/faces.md §12 M1.
+
+use std::time::Instant;
+
+use dr_face::{align, DetectOptions, Detector, Embedder, ModelId};
+
+fn main() {
+    env_logger::init();
+
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    if args.len() < 3 {
+        eprintln!("usage: faces DET.onnx EMB.onnx IMAGE.jpg [IMAGE.jpg ...]");
+        std::process::exit(2);
+    }
+
+    let t = Instant::now();
+    let mut detector = Detector::from_path(&args[0]).expect("load detector");
+    let mut embedder =
+        Embedder::from_path(&args[1], ModelId::new("w600k_mbf")).expect("load embedder");
+    println!(
+        "loaded both models in {:?}  (strides {:?})",
+        t.elapsed(),
+        detector.strides()
+    );
+
+    let opts = DetectOptions::default();
+    let mut all = Vec::new();
+
+    for path in &args[2..] {
+        let (rgb, w, h) = match load_jpeg(path) {
+            Ok(v) => v,
+            Err(e) => {
+                println!("{path}: {e}");
+                continue;
+            }
+        };
+
+        let t = Instant::now();
+        let dets = detector.detect(&rgb, w, h, &opts).expect("detect");
+        let detect_ms = t.elapsed().as_secs_f64() * 1e3;
+
+        println!(
+            "\n{path}  ({w}×{h})  {} face(s) in {detect_ms:.0} ms",
+            dets.len()
+        );
+
+        for (i, d) in dets.iter().enumerate() {
+            let Some(aligned) = align::warp(&rgb, w, h, &d.landmarks) else {
+                println!("  [{i}] degenerate landmarks, skipped");
+                continue;
+            };
+            let t = Instant::now();
+            let emb = embedder.embed(&aligned).expect("embed");
+            let embed_ms = t.elapsed().as_secs_f64() * 1e3;
+
+            println!(
+                "  [{i}] conf {:.3}  box {:.0},{:.0} {:.0}×{:.0}  crop_px {:.0}  quality {:.1}  embed {embed_ms:.0} ms",
+                d.confidence,
+                d.bbox.0,
+                d.bbox.1,
+                d.width(),
+                d.height(),
+                aligned.source_px(),
+                emb.quality,
+            );
+            all.push((path.clone(), i, emb.embedding));
+        }
+    }
+
+    // Every pair, so the numbers can be eyeballed against the expectation that
+    // faces from one identity's folder score high and everything else low.
+    if all.len() > 1 {
+        println!("\ncosine similarity");
+        for i in 0..all.len() {
+            for j in i + 1..all.len() {
+                let cos = all[i].2.cosine(&all[j].2).expect("same model");
+                println!(
+                    "  {:.4}   {}#{}  vs  {}#{}",
+                    cos,
+                    short(&all[i].0),
+                    all[i].1,
+                    short(&all[j].0),
+                    all[j].1
+                );
+            }
+        }
+    }
+}
+
+fn short(path: &str) -> String {
+    let p = std::path::Path::new(path);
+    let file = p.file_name().unwrap_or_default().to_string_lossy();
+    match p.parent().and_then(|d| d.file_name()) {
+        Some(dir) => format!("{}/{file}", dir.to_string_lossy()),
+        None => file.into_owned(),
+    }
+}
+
+/// Decode to the tightly packed `f32` RGB `0.0..=1.0` the crate expects.
+fn load_jpeg(path: &str) -> Result<(Vec<f32>, usize, usize), String> {
+    let bytes = std::fs::read(path).map_err(|e| e.to_string())?;
+    let mut dec = zune_jpeg::JpegDecoder::new(&bytes);
+    let px = dec.decode().map_err(|e| e.to_string())?;
+    let info = dec.info().ok_or("no jpeg header")?;
+    let (w, h) = (info.width as usize, info.height as usize);
+
+    let rgb: Vec<f32> = match px.len() / (w * h) {
+        3 => px.iter().map(|&v| v as f32 / 255.0).collect(),
+        1 => px
+            .iter()
+            .flat_map(|&v| {
+                let g = v as f32 / 255.0;
+                [g, g, g]
+            })
+            .collect(),
+        n => return Err(format!("{n} components per pixel, expected 1 or 3")),
+    };
+    Ok((rgb, w, h))
+}

core/dr-face/examples/probe.rs

@@ -0,0 +1,58 @@
+//! M1 (docs/dev/faces.md §12) — will tract load these graphs at all?
+//!
+//! The one measurement everything else in the face subsystem is conditional
+//! on. `det_500m.onnx` has a dynamic H/W input, which is exactly what tract
+//! failed on for YOLO26n-seg, so a plain "no" here is the expected outcome and
+//! the interesting part is the error it gives.
+//!
+//!   cargo run -p dr-face --features inference --example probe -- MODEL...
+
+fn main() {
+    env_logger::init();
+
+    let paths: Vec<String> = std::env::args().skip(1).collect();
+    if paths.is_empty() {
+        eprintln!("usage: probe MODEL.onnx [MODEL.onnx ...]");
+        std::process::exit(2);
+    }
+
+    let mut failures = 0;
+    for path in &paths {
+        println!("\n=== {path} ===");
+        let bytes = match std::fs::read(path) {
+            Ok(b) => b,
+            Err(e) => {
+                println!("  UNREADABLE: {e}");
+                failures += 1;
+                continue;
+            }
+        };
+        println!("  {} bytes", bytes.len());
+
+        dr_face::install_backend_for_probe();
+
+        let session =
+            ort::session::Session::builder().and_then(|mut b| b.commit_from_memory(&bytes));
+
+        match session {
+            Err(e) => {
+                println!("  LOAD FAILED: {e}");
+                failures += 1;
+            }
+            Ok(s) => {
+                println!("  LOADED");
+                for i in s.inputs() {
+                    println!("    in  {:<24} {:?}", i.name(), i.dtype().tensor_shape());
+                }
+                for o in s.outputs() {
+                    println!("    out {:<24} {:?}", o.name(), o.dtype().tensor_shape());
+                }
+            }
+        }
+    }
+
+    println!("\n{} of {} failed", failures, paths.len());
+    if failures > 0 {
+        std::process::exit(1);
+    }
+}

core/dr-face/examples/scan_bench.rs

@@ -0,0 +1,112 @@
+//! How fast this machine can scan a library for face pairs.
+//!
+//!   cargo run --release -p dr-face --example scan_bench [-- FACES…]
+//!
+//! Synthetic embeddings, because the scan's cost is `n²/2` dot products and
+//! does not care what the vectors mean — which is what makes this runnable on
+//! a phone with no library on it, over `adb shell`, beside
+//! `tools/face-tests-on-device.sh`.
+//!
+//! # What it is for
+//!
+//! docs/dev/faces.md §9 has the desktop numbers and the question they leave open:
+//! a GPU GEMM is worth roughly 1.5× of a regroup on a twenty-core desktop,
+//! because the scan is under a third of the pass there. On a tablet the CPU is
+//! several times slower and the GPU is not, so the same optimisation is worth
+//! something different — and nobody had measured which.
+//!
+//! No weights, no catalog, no display: it needs nothing but the binary.
+
+use dr_face::neighbours::{above_threshold, Faces};
+use dr_face::{Calibration, EMBEDDING_DIM, RIVAL_FLOOR};
+
+/// Sizes to time, unless the command line names others.
+const DEFAULT_SIZES: [usize; 4] = [2_000, 4_000, 8_000, 18_000];
+
+fn main() {
+    let sizes: Vec<usize> = {
+        let given: Vec<usize> = std::env::args()
+            .skip(1)
+            .filter_map(|a| a.parse().ok())
+            .collect();
+        if given.is_empty() {
+            DEFAULT_SIZES.to_vec()
+        } else {
+            given
+        }
+    };
+
+    // The reference curve, so the cosine floor is the one a real library with
+    // no fit of its own would scan at.
+    let cal = Calibration::default();
+
+    println!(
+        "{:>8}  {:>9}  {:>10}  {:>9}",
+        "faces", "scan", "pairs", "GFLOP/s"
+    );
+    for n in sizes {
+        let (embeddings, crop_px, images) = population(n);
+        let gallery = vec![true; n];
+        let faces = Faces {
+            embeddings: &embeddings,
+            dim: EMBEDDING_DIM,
+            crop_px: &crop_px,
+            images: &images,
+            gallery: &gallery,
+        };
+
+        let start = std::time::Instant::now();
+        let pairs = above_threshold(&faces, &cal, RIVAL_FLOOR);
+        let secs = start.elapsed().as_secs_f64();
+
+        let flop = n as f64 * n as f64 / 2.0 * EMBEDDING_DIM as f64 * 2.0;
+        println!(
+            "{n:>8}  {secs:>8.2}s  {:>10}  {:>9.1}",
+            pairs.len(),
+            flop / secs / 1e9
+        );
+    }
+}
+
+/// `n` L2-normalised embeddings in a handful of loose clusters.
+///
+/// Clustered rather than uniform so the scan finds a plausible number of pairs
+/// to keep — a population where nothing survives the threshold would time the
+/// rejection path alone, which is not the path that matters. Hashed from an
+/// index rather than drawn from an RNG, so a number is reproducible from the
+/// command that produced it.
+fn population(n: usize) -> (Vec<f32>, Vec<f32>, Vec<u64>) {
+    let identities = (n / 12).max(1);
+    let mut embeddings = Vec::with_capacity(n * EMBEDDING_DIM);
+    for i in 0..n {
+        let mut v = unit(i % identities);
+        let noise = unit(i + 1_000_000);
+        for (x, e) in v.iter_mut().zip(&noise) {
+            *x = 0.75 * *x + 0.25 * e;
+        }
+        embeddings.extend(normalise(v));
+    }
+    // Every face in its own photograph: the co-occurrence rule skips pairs
+    // rather than scoring them, and skipped pairs are not what is being timed.
+    ((embeddings), vec![150.0; n], (0..n as u64).collect())
+}
+
+fn unit(seed: usize) -> Vec<f32> {
+    let mut s = (seed as u64).wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+    let mut v = Vec::with_capacity(EMBEDDING_DIM);
+    for _ in 0..EMBEDDING_DIM {
+        s ^= s << 13;
+        s ^= s >> 7;
+        s ^= s << 17;
+        v.push(((s >> 11) as f64 / (1u64 << 53) as f64) as f32 - 0.5);
+    }
+    normalise(v)
+}
+
+fn normalise(mut v: Vec<f32>) -> Vec<f32> {
+    let len = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+    for x in &mut v {
+        *x /= len;
+    }
+    v
+}

core/dr-face/src/assign.rs

@@ -0,0 +1,399 @@
+//! TRACES: FR-CULL-9 | FR-CULL-10
+//! How sure a *suggestion* is: an identity's share of the evidence for a face.
+//!
+//! [`crate::cluster`] decides which people exist; this decides what number to
+//! put beside "we think this is Anna". They are not the same question, and the
+//! answer to the second used to be a by-product of the first — the mean
+//! calibrated probability between a face and *every* other member of its group.
+//!
+//! # Why a mean over the group is the wrong number
+//!
+//! It measures the wrong thing twice over.
+//!
+//! **It punishes large, well-photographed people.** Anna has two hundred faces
+//! spanning fifteen years; a new photograph of her matches thirty of them
+//! strongly and is near-orthogonal to the rest, because a face at 8 and a face
+//! at 23 genuinely are. The mean lands around 0.2 and the interface reports a
+//! correct suggestion as a doubtful one. The better a person is covered, the
+//! worse their confidences get, which is exactly backwards.
+//!
+//! **It never asks who else it could be.** A face that matches Anna at 0.95 and
+//! matches nobody else at all, and a face that matches Anna at 0.95 *and her
+//! sister at 0.93*, are the same number under a within-group mean. The second
+//! is the one the user actually needs to look at, and it was indistinguishable
+//! from the first.
+//!
+//! # Coherence, times uniqueness
+//!
+//! Two questions, and the number is their product because they are genuinely
+//! independent: *is this the same person at all*, and *of the people we know,
+//! is it uniquely this one*.
+//!
+//! ```text
+//! evidence(P)  = Σ of the top n of { P(same | this face, f) : f ∈ P }
+//! coherence    = evidence(own) / (however many of the top n there were)
+//! uniqueness   = evidence(own) / (evidence(own) + Σ evidence(named rivals))
+//! confidence   = coherence × uniqueness
+//! ```
+//!
+//! **Coherence** is a mean, like the old number, but over the face's best
+//! [`TOP_MATCHES`] matches into the identity rather than over all of them. That single cap is what
+//! stops a well-photographed person scoring worse than a thin one: the two
+//! hundred faces a given photograph is legitimately orthogonal to no longer
+//! count against it.
+//!
+//! **Uniqueness** is the competition. A sole strong match leaves it at 1 and
+//! the confidence is the coherence; two identities matching equally well pull
+//! it to 0.5 each, and the screen has told the user the truth, which is that
+//! this face is a coin toss between two people.
+//!
+//! # Only the people the user has named compete
+//!
+//! Measured on a real 18,000-face library, normalising across *every* group
+//! made the number useless: the median suggestion read 21% and four in five
+//! read under half. The cause is not a bug in the arithmetic but a fact about
+//! clustering — one person is spread across many groups, since the pairs that
+//! would have joined them are the ones that fell short of the merge threshold.
+//! Normalising over groups therefore makes a face compete against *itself*,
+//! and the better covered the person, the more fragments there are to lose to.
+//!
+//! A fragment is not a rival. An identity the user has actually asserted is, so
+//! the denominator counts only the people they have ruled on — a group carries
+//! a [`Cluster::person`] when it holds a confirmation, a name, or an ignore —
+//! and counts them **per person, not per group**, since one person is left in
+//! several anchored groups for the same reason. Keying it by group had
+//! Catherine competing with Catherine and put the median suggestion onto a
+//! named person at 39%; keying it by person put it at 99.5%.
+//!
+//! Leave-one-out over that library's 2,702 confirmations across 54 named
+//! people, this is the regime where the number is worth having: 99.3% of faces
+//! are placed on the right person (the old mean managed 99.15%), the stated
+//! percentage is monotone in being right, and it errs low — 100% correct
+//! wherever it states 80% or more, 84% correct where it states under half.
+//! Understating is the safe direction for a screen whose whole purpose is
+//! deciding what to look at first, but it is *not* calibrated in the low bands
+//! and should not be read as though it were.
+//!
+//! Two faces of one unnamed group cannot be told from two fragments of one
+//! person by similarity alone; that is exactly why clustering stopped where it
+//! did. So the module does not pretend to: where nobody is named, uniqueness is
+//! 1 and the number falls back to plain coherence.
+//!
+//! # What it does not do
+//!
+//! It is not a merge threshold and must not become one. Clustering keeps
+//! deciding on the pairwise calibrated probability: uniqueness is *relative*,
+//! so a library with one named person in it would hand every stray face a
+//! uniqueness of 1. The absolute question ("is this the same person at all")
+//! and the comparative one ("of the people we know, which") are different, and
+//! the product is what keeps both in the answer.
+
+use std::collections::BTreeMap;
+
+use crate::cluster::Cluster;
+use crate::neighbours::Pair;
+
+/// Who the evidence is for.
+///
+/// Ordered rather than hashed so the sums below are reproducible; the ordering
+/// itself carries no meaning.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum Identity {
+    /// A person the user has confirmed a face onto. Every group anchored to
+    /// them is the same identity, however many of them the clusterer left.
+    Person(u64),
+    /// A group nobody has ruled on. It stands for itself and competes with
+    /// nothing.
+    Group(usize),
+}
+
+/// How many of an identity's best matches count as its evidence.
+///
+/// The cap is the whole reason the sum works: uncapped, evidence would grow
+/// with a person's face count and the largest group in the library would win
+/// every contest. Ten is enough that a person photographed from several angles
+/// contributes more than one lucky frame, and small enough that the hundred
+/// mediocre matches inside a well-covered identity cannot add up to a strong
+/// one. It is a starting point, not a measured optimum — M7's corpus is where
+/// it would be tuned.
+pub const TOP_MATCHES: usize = 10;
+
+/// The weakest match that counts as evidence for an identity.
+///
+/// Rivals are half the point of this module, so the evidence scan has to reach
+/// *below* the merge threshold — a named person who matches at 0.6 will never
+/// be merged into but is precisely the competition a suggestion should be
+/// discounted for. Even odds is the natural floor: below it a pair is more
+/// likely different people than the same, and it is not a small distinction —
+/// summing the near-orthogonal pairs instead of dropping them lets fifty
+/// identities' worth of noise, each contributing its *upper tail*, outweigh one
+/// real match. Measured on a real library, that alone moved the median stated
+/// confidence from 100% to 31%.
+pub const RIVAL_FLOOR: f32 = 0.5;
+
+/// How confident each face's placement is, indexed like the face slice the
+/// clusters came from.
+///
+/// A face in no group, or one with no evidence for anybody, scores 0.
+///
+/// `gallery` is one flag per face — which faces may be evidence at all
+/// ([`crate::embedding::MIN_GALLERY_QUALITY`]). Its length is the face count.
+/// A pair is evidence *about* either face but only *from* a gallery one: a
+/// probe learns from the references it matched, and a reference learns nothing
+/// from a probe that happened to match it, however well. Without that, the one
+/// short vector in a group would be the strongest match every face in it had.
+///
+/// `pairs` must be the *evidence* list — scanned at [`RIVAL_FLOOR`], not at the
+/// merge threshold. Passing the merge list still works but silently removes
+/// every rival weaker than a merge, which is most of them, and every uniqueness
+/// collapses to 1.
+pub fn identity_shares(
+    gallery: &[bool],
+    clusters: &[Cluster],
+    pairs: &[Pair],
+    top: usize,
+) -> Vec<f32> {
+    let faces = gallery.len();
+    // An identity is a *person*, not a group. One person routinely holds
+    // several anchored groups — the same reason they hold several unnamed ones
+    // — and keying this by group had Catherine competing with Catherine, which
+    // on the library it was measured against put the median suggestion onto a
+    // named person at 39%.
+    let key_of: Vec<Identity> = clusters
+        .iter()
+        .enumerate()
+        .map(|(g, c)| match c.person {
+            Some(p) => Identity::Person(p),
+            None => Identity::Group(g),
+        })
+        .collect();
+
+    let mut group_of = vec![usize::MAX; faces];
+    for (g, c) in clusters.iter().enumerate() {
+        for &m in &c.members {
+            if m < faces {
+                group_of[m] = g;
+            }
+        }
+    }
+
+    // Ordered, not hashed: the numbers are sums of floats over these buckets
+    // and this module inherits [`crate::cluster`]'s promise that the same input
+    // yields the same output, bit for bit.
+    let mut evidence: Vec<BTreeMap<Identity, Vec<f32>>> = vec![BTreeMap::new(); faces];
+    for p in pairs {
+        if p.i >= faces || p.j >= faces {
+            continue;
+        }
+        // A pair is evidence in both directions: j's identity hears about i,
+        // and i's identity hears about j. The pair list holds each unordered
+        // pair once, so both have to be recorded here — each only where the
+        // face doing the telling is in the gallery.
+        let (gi, gj) = (group_of[p.i], group_of[p.j]);
+        if gj != usize::MAX && gallery[p.j] {
+            evidence[p.i]
+                .entry(key_of[gj])
+                .or_default()
+                .push(p.probability);
+        }
+        if gi != usize::MAX && gallery[p.i] {
+            evidence[p.j]
+                .entry(key_of[gi])
+                .or_default()
+                .push(p.probability);
+        }
+    }
+
+    let mut out = vec![0.0; faces];
+    for (i, buckets) in evidence.iter_mut().enumerate() {
+        let mine = group_of[i];
+        if mine == usize::MAX {
+            continue;
+        }
+        let mine = key_of[mine];
+        let mut coherence = 0.0;
+        let mut ours = 0.0;
+        let mut rivals = 0.0;
+        for (&who, probabilities) in buckets.iter_mut() {
+            // Descending, and the ties broken by nothing: equal probabilities
+            // sum the same whichever order they land in.
+            probabilities.sort_by(|a, b| b.total_cmp(a));
+            let counted = probabilities.len().min(top);
+            let score: f32 = probabilities.iter().take(top).sum();
+            if who == mine {
+                ours = score;
+                coherence = score / counted as f32;
+            } else if matches!(who, Identity::Person(_)) {
+                // Only an identity the user has ruled on competes. A group
+                // nobody has ruled on and that matches this face is far more
+                // likely to be another fragment of the same person than a
+                // different one — see the module note, and the library it was
+                // measured on.
+                rivals += score;
+            }
+        }
+        let total = ours + rivals;
+        // No evidence at all: a face anchored into a group it has no measured
+        // similarity to. Nothing honest to report, so nothing is claimed.
+        out[i] = if total > 0.0 {
+            coherence * (ours / total)
+        } else {
+            0.0
+        };
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// An unnamed group: nobody has ruled on it, so it competes with nothing.
+    fn cluster(members: &[usize]) -> Cluster {
+        Cluster {
+            members: members.to_vec(),
+            person: None,
+        }
+    }
+
+    /// A group the user has confirmed a face onto — an identity, and therefore
+    /// a rival.
+    fn named(members: &[usize], person: u64) -> Cluster {
+        Cluster {
+            members: members.to_vec(),
+            person: Some(person),
+        }
+    }
+
+    fn pair(i: usize, j: usize, probability: f32) -> Pair {
+        Pair { i, j, probability }
+    }
+
+    /// `n` faces, every one of them fit to be compared against.
+    fn all(n: usize) -> Vec<bool> {
+        vec![true; n]
+    }
+
+    /// The failure the module exists to fix: face 0 matches its own group's
+    /// three members strongly, and the group has forty more it is unrelated to.
+    /// The old within-group mean reported ~0.07 for this.
+    #[test]
+    fn a_large_group_does_not_dilute_a_strong_match() {
+        let members: Vec<usize> = (0..44).collect();
+        let clusters = vec![cluster(&members)];
+        let pairs = vec![pair(0, 1, 0.99), pair(0, 2, 0.97), pair(0, 3, 0.95)];
+
+        let shares = identity_shares(&all(44), &clusters, &pairs, TOP_MATCHES);
+        assert!(
+            (shares[0] - 0.97).abs() < 1e-6,
+            "the mean of its three real matches, undiluted: {}",
+            shares[0]
+        );
+    }
+
+    /// Two named people matching equally well is a coin toss, and saying so is
+    /// the point — this is the sibling case FR-CULL-10 warns about.
+    #[test]
+    fn an_ambiguous_face_splits_its_confidence_between_the_rivals() {
+        let clusters = vec![named(&[0, 1, 2], 1), named(&[3, 4], 2)];
+        let pairs = vec![
+            pair(0, 1, 0.90),
+            pair(0, 2, 0.90),
+            pair(0, 3, 0.90),
+            pair(0, 4, 0.90),
+        ];
+
+        let shares = identity_shares(&all(5), &clusters, &pairs, TOP_MATCHES);
+        // Coherent at 0.90, and only half of the evidence is its own.
+        assert!(
+            (shares[0] - 0.45).abs() < 1e-6,
+            "even evidence both ways: {}",
+            shares[0]
+        );
+    }
+
+    /// A rival below the merge threshold still has to count, which is why the
+    /// evidence scan reaches down to [`RIVAL_FLOOR`].
+    #[test]
+    fn a_rival_too_weak_to_merge_still_lowers_the_confidence() {
+        let clusters = vec![named(&[0, 1], 1), named(&[2, 3], 2)];
+        let sure = identity_shares(&all(4), &clusters, &[pair(0, 1, 0.95)], TOP_MATCHES);
+        let contested = identity_shares(
+            &all(4),
+            &clusters,
+            &[pair(0, 1, 0.95), pair(0, 2, 0.60)],
+            TOP_MATCHES,
+        );
+
+        assert_eq!(sure[0], 0.95, "nobody else to be: its coherence stands");
+        assert!(
+            contested[0] < 0.59 && contested[0] > 0.57,
+            "0.95 coherent, but 0.95 against 0.60: {}",
+            contested[0]
+        );
+    }
+
+    /// A fragment of the same person is not a rival. Measured on a real
+    /// library, counting unnamed groups as competition put four suggestions in
+    /// five under half — see the module note.
+    #[test]
+    fn an_unnamed_group_is_not_treated_as_competition() {
+        let clusters = vec![cluster(&[0, 1]), cluster(&[2, 3])];
+        let shares = identity_shares(
+            &all(4),
+            &clusters,
+            &[pair(0, 1, 0.95), pair(0, 2, 0.90)],
+            TOP_MATCHES,
+        );
+        assert_eq!(
+            shares[0], 0.95,
+            "an unnamed group took evidence off a suggestion"
+        );
+    }
+
+    /// The cap, doing its job: an identity with fifty mediocre matches must not
+    /// beat one with ten strong ones on volume alone.
+    #[test]
+    fn evidence_is_capped_so_the_biggest_group_cannot_win_on_volume() {
+        let small: Vec<usize> = (0..11).collect();
+        let large: Vec<usize> = (11..62).collect();
+        let clusters = vec![named(&small, 1), named(&large, 2)];
+
+        let mut pairs: Vec<Pair> = (1..11).map(|j| pair(0, j, 0.90)).collect();
+        pairs.extend((11..62).map(|j| pair(0, j, 0.55)));
+
+        let shares = identity_shares(&all(62), &clusters, &pairs, TOP_MATCHES);
+        // Ten at 0.90 against ten at 0.55 — not fifty-one at 0.55.
+        assert!(
+            (shares[0] - 0.90 * (9.0 / 14.5)).abs() < 1e-5,
+            "capped at ten either side: {}",
+            shares[0]
+        );
+    }
+
+    /// A probe learns from the references it matched; a reference learns
+    /// nothing from a probe. The pair is the same pair — what differs is who
+    /// is doing the telling.
+    #[test]
+    fn a_face_outside_the_gallery_is_nobody_s_evidence() {
+        let clusters = vec![named(&[0, 1, 2], 1)];
+        let gallery = vec![true, true, false];
+        let pairs = vec![pair(0, 1, 0.80), pair(0, 2, 0.99), pair(1, 2, 0.99)];
+
+        let shares = identity_shares(&gallery, &clusters, &pairs, TOP_MATCHES);
+        // Faces 0 and 1 hear only from each other: the 0.99 the probe offered
+        // them is not counted.
+        assert!((shares[0] - 0.80).abs() < 1e-6, "{}", shares[0]);
+        assert!((shares[1] - 0.80).abs() < 1e-6, "{}", shares[1]);
+        // The probe hears from both references.
+        assert!((shares[2] - 0.99).abs() < 1e-6, "{}", shares[2]);
+    }
+
+    /// A face nothing has any evidence about claims nothing.
+    #[test]
+    fn a_face_with_no_evidence_reports_no_confidence() {
+        let clusters = vec![cluster(&[0, 1])];
+        let shares = identity_shares(&all(2), &clusters, &[], TOP_MATCHES);
+        assert_eq!(shares, vec![0.0, 0.0]);
+    }
+}

core/dr-face/src/calibrate.rs

@@ -0,0 +1,452 @@
+//! Cosine to probability (docs/dev/faces.md §8, FR-CULL-9).
+//!
+//! FR-CULL-9 is a hard requirement rather than an implementation detail: no
+//! code path may threshold a bare cosine, every threshold in the subsystem is
+//! stated as a probability, and the fit is per library and reports its own
+//! validity. The failure it guards against is invisible — a raw cosine means
+//! something different for every model, every population and every face size,
+//! and an uncalibrated similarity still *looks* like a plausible number all the
+//! way to the user interface.
+//!
+//! Model-free, so the part of this subsystem most likely to be subtly wrong is
+//! testable on synthetic embeddings with no weights on the machine.
+//!
+//! # Where the training pairs come from
+//!
+//! **Negatives are free and abundant.** Two faces detected in *the same
+//! photograph* are almost never the same person, which hands every multi-face
+//! image in the library a full set of negative pairs at no labelling cost — and
+//! they are *hard* negatives, from the same camera, lighting and processing,
+//! which is exactly the population where a threshold tuned on easy negatives
+//! fails. The exceptions (mirrors, photographs of photographs, collages) are
+//! rare enough to be noise at this scale.
+//!
+//! **Positives have to be earned.** A positive is a pair of faces the user has
+//! confirmed onto one person (FR-CULL-10), and there is no second source: the
+//! only labelling this subsystem has is the labelling somebody did by hand.
+//! Bootstrapping positives from a high cosine is circular — it fits the
+//! calibration to the belief it was supposed to test — and that is the whole
+//! of the alternative.
+//!
+//! docs/dev/faces.md §8.1 names one more that would cost no labelling at all: two
+//! faces in adjacent frames of one burst are near-certainly the same person,
+//! and FR-CULL-5's grouping is sitting there. Nothing draws on it. This crate
+//! cannot see a catalog, let alone the bursts in one — it is handed cosines by
+//! whoever assembled the pair — and no caller does that assembly on its behalf
+//! yet. Until one does, and until the purity of a burst pair is *measured*
+//! rather than assumed, the positives are the confirmations and nothing else.
+//!
+//! Which is why a fresh library has **no valid calibration** — no fit of its
+//! own — and says so. It is not left without a curve: it uses the reference
+//! implementation's fitted one ([`Calibration::default`]), which is a published
+//! operating point rather than an invention, and the interface reports which of
+//! the two it is speaking from.
+
+/// Bins over cosine ∈ [-1, 1].
+///
+/// 200 is the reference implementation's figure and the resolution is not
+/// critical; what matters is that there *is* a histogram. See [`Pairs`].
+const BINS: usize = 200;
+
+/// Minimum evidence before a fit is trusted.
+///
+/// Far stricter than the reference implementation's floor of two positives and
+/// one negative. That floor is reasonable there: its pairs come from a curated
+/// gallery of labelled reference portraits, where a positive pair is
+/// trustworthy by construction. Here every positive is a pair somebody
+/// confirmed while working through a young library's suggestions — a handful,
+/// arriving slowly — and the whole risk is fitting confidently to too few of
+/// them.
+pub const MIN_POSITIVE_PAIRS: u64 = 200;
+pub const MIN_NEGATIVE_PAIRS: u64 = 2_000;
+
+/// A fitted `P(same person | cosine, face size)`.
+///
+/// The single definition of what a similarity means in this subsystem. The
+/// catalog stores its parameters; nothing re-implements the sigmoid.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Calibration {
+    pub a: f32,
+    pub b: f32,
+    /// Weight on `log2(min crop_px)` — the face-size term FR-CULL-9 asks for.
+    pub w_size: f32,
+    /// Whether there was enough evidence to fit this library's own curve.
+    ///
+    /// False means the numbers came from the built-in reference curve, and the
+    /// UI says so — once, at the screen level. It does **not** mean confidences
+    /// are withheld: FR-CULL-9's distinction is between presenting an untuned
+    /// default *as though it were measured* and presenting it as what it is,
+    /// and only the first is forbidden.
+    pub valid: bool,
+    pub positive_pairs: u64,
+    pub negative_pairs: u64,
+}
+
+impl Default for Calibration {
+    /// The reference implementation's fitted MBF curve (docs/dev/faces.md §1):
+    /// steepness 16.2, P=0.5 at cosine 0.267.
+    ///
+    /// **`valid` is false**, and that is the point. It is a documented
+    /// operating point rather than an invented one, so a library with no fit of
+    /// its own can both cluster and quote a probability from it — what it may
+    /// not do is call that probability a measurement of *this* library.
+    fn default() -> Self {
+        Self {
+            a: 16.2,
+            b: -16.2 * 0.267,
+            w_size: 0.0,
+            valid: false,
+            positive_pairs: 0,
+            negative_pairs: 0,
+        }
+    }
+}
+
+impl Calibration {
+    /// P(same person), shifted by a base-rate prior.
+    ///
+    /// `log_prior_odds` is applied at evaluation rather than folded into the
+    /// fit, so one stored calibration serves every context: the odds that two
+    /// faces in a 40-image album match are not the odds in a 40,000-image
+    /// archive. Folding a prior in would need a refit per context and would
+    /// make the stored parameters mean different things depending on where they
+    /// came from.
+    pub fn probability(&self, cosine: f32, min_crop_px: f32, log_prior_odds: f32) -> f32 {
+        sigmoid(self.logit(cosine, min_crop_px) + log_prior_odds)
+    }
+
+    fn logit(&self, cosine: f32, min_crop_px: f32) -> f32 {
+        self.a * cosine + self.b + self.w_size * min_crop_px.max(1.0).log2()
+    }
+
+    /// The cosine at which [`Calibration::probability`] crosses `p`.
+    ///
+    /// What turns "merge above 0.9" into one comparison against a stored
+    /// similarity, rather than a sigmoid evaluated per candidate edge.
+    pub fn boundary_at(&self, p: f32, min_crop_px: f32, log_prior_odds: f32) -> f32 {
+        ((p / (1.0 - p)).ln() - self.b - self.w_size * min_crop_px.max(1.0).log2() - log_prior_odds)
+            / self.a
+    }
+}
+
+fn sigmoid(z: f32) -> f32 {
+    // Branch on the sign so neither tail overflows: exp(-z) for large positive
+    // z, exp(z) for large negative.
+    if z >= 0.0 {
+        1.0 / (1.0 + (-z).exp())
+    } else {
+        let e = z.exp();
+        e / (1.0 + e)
+    }
+}
+
+/// Accumulated pair evidence, as a histogram rather than a list.
+///
+/// # Why a histogram
+///
+/// A 25,000-face library has ~3×10⁸ pairs and no gradient descent is running
+/// over that. Bucketing them costs 200 counters per class and reduces the fit
+/// to two parameters against per-bin totals; the expensive part becomes the
+/// similarity matrix, which is one blocked GEMM. This is the trick that makes a
+/// per-library fit affordable at all, and it is not obvious from outside.
+#[derive(Debug, Clone)]
+pub struct Pairs {
+    positive: Vec<f64>,
+    negative: Vec<f64>,
+    n_pos: u64,
+    n_neg: u64,
+}
+
+impl Default for Pairs {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl Pairs {
+    pub fn new() -> Self {
+        Self {
+            positive: vec![0.0; BINS],
+            negative: vec![0.0; BINS],
+            n_pos: 0,
+            n_neg: 0,
+        }
+    }
+
+    /// Record a pair known to be the same person.
+    pub fn push_positive(&mut self, cosine: f32) {
+        self.positive[bin(cosine)] += 1.0;
+        self.n_pos += 1;
+    }
+
+    /// Record a pair known to be different people.
+    pub fn push_negative(&mut self, cosine: f32) {
+        self.negative[bin(cosine)] += 1.0;
+        self.n_neg += 1;
+    }
+
+    pub fn positives(&self) -> u64 {
+        self.n_pos
+    }
+    pub fn negatives(&self) -> u64 {
+        self.n_neg
+    }
+
+    /// Fit `P(same) = σ(a·cos + b)` by weighted logistic regression.
+    ///
+    /// Class weights are explicit because negatives outnumber positives by
+    /// orders of magnitude, and an unweighted fit produces a well-shaped curve
+    /// sitting at the wrong height — precisely the "plausible number all the
+    /// way to the user interface" failure FR-CULL-9 describes.
+    ///
+    /// Returns a calibration with `valid` set only if there was enough
+    /// evidence; the parameters are filled in either way so a caller with no
+    /// better option can still cluster at a documented operating point.
+    pub fn fit(&self) -> Calibration {
+        let base = Calibration {
+            positive_pairs: self.n_pos,
+            negative_pairs: self.n_neg,
+            ..Calibration::default()
+        };
+        if self.n_pos < MIN_POSITIVE_PAIRS || self.n_neg < MIN_NEGATIVE_PAIRS {
+            return base;
+        }
+
+        let total = self.n_pos as f64 + self.n_neg as f64;
+        let w_pos = total / (2.0 * self.n_pos as f64);
+        let w_neg = total / (2.0 * self.n_neg as f64);
+
+        // Start from the reference's fitted MBF curve rather than from zero:
+        // it is the right order of magnitude for every model in this family,
+        // so descent converges in far fewer steps and cannot wander into a
+        // sign-flipped solution on thin evidence.
+        let mut a = base.a as f64;
+        let mut b = base.b as f64;
+        const LR: f64 = 0.05;
+        const MAX_ITER: usize = 20_000;
+        const TOL: f64 = 1e-7;
+
+        for _ in 0..MAX_ITER {
+            let (mut da, mut db) = (0.0, 0.0);
+            for i in 0..BINS {
+                let x = bin_centre(i) as f64;
+                let s = 1.0 / (1.0 + (-(a * x + b)).exp());
+                if self.positive[i] > 0.0 {
+                    let e = (s - 1.0) * w_pos * self.positive[i];
+                    da += e * x;
+                    db += e;
+                }
+                if self.negative[i] > 0.0 {
+                    let e = s * w_neg * self.negative[i];
+                    da += e * x;
+                    db += e;
+                }
+            }
+            da /= total;
+            db /= total;
+            a -= LR * da;
+            b -= LR * db;
+            if da * da + db * db < TOL * TOL {
+                break;
+            }
+        }
+
+        Calibration {
+            a: a as f32,
+            b: b as f32,
+            w_size: 0.0,
+            valid: true,
+            positive_pairs: self.n_pos,
+            negative_pairs: self.n_neg,
+        }
+    }
+
+    /// How well the fit predicts the evidence, as a reliability diagram.
+    ///
+    /// FR-CULL-9's acceptance criterion is exactly this and not a single
+    /// accuracy figure: for each populated probability band, the observed match
+    /// rate against the predicted one. Returned rather than asserted so the
+    /// caller can show it, log it, or fail a test on it.
+    pub fn reliability(&self, cal: &Calibration, bands: usize) -> Vec<ReliabilityBand> {
+        let mut out = vec![
+            ReliabilityBand {
+                predicted: 0.0,
+                observed: 0.0,
+                count: 0
+            };
+            bands
+        ];
+        let mut sum_pred = vec![0.0_f64; bands];
+        for i in 0..BINS {
+            let n_pos = self.positive[i];
+            let n_neg = self.negative[i];
+            if n_pos + n_neg == 0.0 {
+                continue;
+            }
+            let p = cal.probability(bin_centre(i), 112.0, 0.0) as f64;
+            let band = ((p * bands as f64) as usize).min(bands - 1);
+            sum_pred[band] += p * (n_pos + n_neg);
+            out[band].observed += n_pos as f32;
+            out[band].count += (n_pos + n_neg) as u64;
+        }
+        for (band, o) in out.iter_mut().enumerate() {
+            if o.count > 0 {
+                o.predicted = (sum_pred[band] / o.count as f64) as f32;
+                o.observed /= o.count as f32;
+            }
+        }
+        out
+    }
+}
+
+/// One row of a reliability diagram.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct ReliabilityBand {
+    /// Mean probability the calibration predicted for pairs in this band.
+    pub predicted: f32,
+    /// Fraction of them that were actually the same person.
+    pub observed: f32,
+    pub count: u64,
+}
+
+fn bin(cosine: f32) -> usize {
+    let width = 2.0 / BINS as f32;
+    (((cosine + 1.0) / width) as usize).min(BINS - 1)
+}
+
+fn bin_centre(i: usize) -> f32 {
+    let width = 2.0 / BINS as f32;
+    -1.0 + (i as f32 + 0.5) * width
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Synthesise pairs from two well-separated cosine distributions, the way
+    /// a real embedding space behaves: positives near 0.6, negatives near 0.05
+    /// — the numbers our own end-to-end run actually produced.
+    fn realistic_pairs(n_pos: u64, n_neg: u64) -> Pairs {
+        let mut p = Pairs::new();
+        let mut s = 12345_u32;
+        let mut rand = move || {
+            s = s.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            (s >> 8) as f32 / (1u32 << 24) as f32
+        };
+        for _ in 0..n_pos {
+            // ~N(0.60, 0.12), by summing uniforms.
+            let g = (0..4).map(|_| rand()).sum::<f32>() / 4.0 - 0.5;
+            p.push_positive((0.60 + g * 0.48).clamp(-1.0, 1.0));
+        }
+        for _ in 0..n_neg {
+            let g = (0..4).map(|_| rand()).sum::<f32>() / 4.0 - 0.5;
+            p.push_negative((0.05 + g * 0.32).clamp(-1.0, 1.0));
+        }
+        p
+    }
+
+    #[test]
+    fn an_empty_library_has_no_valid_calibration() {
+        let cal = Pairs::new().fit();
+        assert!(!cal.valid, "a fit with no evidence must not claim validity");
+        assert_eq!(cal.positive_pairs, 0);
+    }
+
+    /// The exact case FR-CULL-9 legislates: enough negatives, too few
+    /// positives. The answer is "unavailable", not a plausible-looking curve.
+    #[test]
+    fn too_few_positives_is_invalid_however_many_negatives_there_are() {
+        let p = realistic_pairs(MIN_POSITIVE_PAIRS - 1, MIN_NEGATIVE_PAIRS * 10);
+        assert!(!p.fit().valid);
+    }
+
+    #[test]
+    fn too_few_negatives_is_invalid_too() {
+        let p = realistic_pairs(MIN_POSITIVE_PAIRS * 10, MIN_NEGATIVE_PAIRS - 1);
+        assert!(!p.fit().valid);
+    }
+
+    #[test]
+    fn a_well_separated_library_fits_a_usable_curve() {
+        let cal = realistic_pairs(2_000, 40_000).fit();
+        assert!(cal.valid);
+        assert!(cal.a > 0.0, "steepness must be positive: {}", cal.a);
+
+        // The decision boundary lands between the two populations.
+        let boundary = cal.boundary_at(0.5, 112.0, 0.0);
+        assert!(
+            boundary > 0.05 && boundary < 0.60,
+            "boundary {boundary} is not between the negative and positive modes"
+        );
+
+        // And the measured cosines from the real end-to-end run fall the
+        // right side of it.
+        assert!(cal.probability(0.596, 200.0, 0.0) > 0.9);
+        assert!(cal.probability(0.050, 200.0, 0.0) < 0.1);
+    }
+
+    #[test]
+    fn probability_and_boundary_are_inverses() {
+        let cal = realistic_pairs(2_000, 40_000).fit();
+        for &p in &[0.1_f32, 0.5, 0.9, 0.99] {
+            let cos = cal.boundary_at(p, 112.0, 0.0);
+            assert!((cal.probability(cos, 112.0, 0.0) - p).abs() < 1e-3);
+        }
+    }
+
+    /// A base rate shifts the answer without a refit — the property that lets
+    /// one stored calibration serve a small album and a large archive.
+    #[test]
+    fn a_prior_moves_the_boundary_in_the_right_direction() {
+        let cal = realistic_pairs(2_000, 40_000).fit();
+        let neutral = cal.probability(0.4, 112.0, 0.0);
+        let pessimistic = cal.probability(0.4, 112.0, -2.0);
+        let optimistic = cal.probability(0.4, 112.0, 2.0);
+        assert!(pessimistic < neutral && neutral < optimistic);
+    }
+
+    /// FR-CULL-9's acceptance criterion, run against the fit's own evidence:
+    /// in every populated band, the stated probability should track the
+    /// observed match rate.
+    #[test]
+    fn the_fit_is_reliable_on_the_evidence_it_was_fitted_to() {
+        let pairs = realistic_pairs(4_000, 40_000);
+        let cal = pairs.fit();
+        let bands = pairs.reliability(&cal, 10);
+
+        let mut checked = 0;
+        for b in &bands {
+            // Thinly populated bands are noise, not evidence.
+            if b.count < 200 {
+                continue;
+            }
+            checked += 1;
+            assert!(
+                (b.predicted - b.observed).abs() < 0.15,
+                "band predicted {:.3} but observed {:.3} over {} pairs",
+                b.predicted,
+                b.observed,
+                b.count
+            );
+        }
+        assert!(
+            checked >= 2,
+            "only {checked} bands had enough pairs to check"
+        );
+    }
+
+    #[test]
+    fn the_default_curve_is_the_references_and_is_not_marked_valid() {
+        let cal = Calibration::default();
+        assert!(!cal.valid);
+        assert!((cal.boundary_at(0.5, 112.0, 0.0) - 0.267).abs() < 1e-3);
+    }
+
+    #[test]
+    fn bins_cover_the_cosine_range_without_overflowing() {
+        assert_eq!(bin(-1.0), 0);
+        assert_eq!(bin(1.0), BINS - 1);
+        assert_eq!(bin(2.0), BINS - 1, "an out-of-range cosine must not panic");
+        assert!((bin_centre(bin(0.5)) - 0.5).abs() < 0.01);
+    }
+}

core/dr-face/src/classify.rs

@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! The two small classifiers behind a face's eye state (docs/dev/faces.md §17).
+//!
+//! **OCEC** — *open closed eyes classification*, Hyodo 2025 — reads one
+//! 40×24 eye and answers P(open). **SGC** — *sunglasses classification*,
+//! Hyodo 2026 — reads a 48×48 head and answers P(sunglasses); it is shown
+//! two framings of each face and the higher answer stands, for the reason
+//! [`crate::align::SUNGLASSES_WINDOWS`] gives. Both are
+//! depthwise-separable CNNs of a few hundred kilobytes, both MIT with their
+//! weights, and both were exported with BatchNorm already folded, which is
+//! about the friendliest graph tract can be handed.
+//!
+//! Neither takes a plain buffer. [`EyeClassifier::classify`] takes an
+//! [`EyePatch`] and [`SunglassesClassifier::classify`] a [`HeadViews`], each
+//! constructible only by the crop in [`crate::align`] that puts the right
+//! pixels in it — the same defence [`crate::embed::Embedder`] makes with
+//! [`crate::align::Aligned112`], for the same reason: a classifier handed the
+//! wrong region returns a confident probability of nothing. Where the eye
+//! box comes from is [`crate::landmarks`]; [`EyeModels::read`] is the whole
+//! chain.
+//!
+//! # The graphs must have a fixed batch
+//!
+//! Both ship with a dynamic batch dimension, which tract will not analyse.
+//! `tools/fix-face-model-shapes.sh` pins it to 1, exactly as it does for the
+//! embedder; the shipped files are the pinned ones.
+//!
+//! # Pre-processing
+//!
+//! Read off the reference demos rather than assumed: RGB, `x / 255`, NCHW,
+//! the crop resized to the input with bilinear interpolation and **without**
+//! preserving its aspect. [`crate::align`]'s crops arrive already at the
+//! input size in `0..=1`, so there is nothing left to do but lay them out.
+
+use ndarray::Array4;
+
+use crate::align::{
+    eye_box, eye_patch, head_views, EyePatch, HeadViews, EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH,
+    SUNGLASSES_EDGE,
+};
+use crate::eyes::{Eye, EyeReading};
+use crate::landmarks::{Landmarker, Landmarks};
+use crate::{FaceError, Pixels};
+use dr_inference_engine::{Form, Model, Role};
+
+/// A loaded OCEC graph.
+pub struct EyeClassifier {
+    session: Model,
+}
+
+/// A loaded SGC graph.
+pub struct SunglassesClassifier {
+    session: Model,
+}
+
+/// Open a single-input, single-output classifier and check it is the shape
+/// the crop feeding it will be.
+///
+/// The check is against the *input*, because that is where these two graphs
+/// differ from each other and from everything else in this crate: an SGC file
+/// given to the eye classifier would otherwise be resized into by an eye
+/// patch, and answer. `expected` names the model in the error.
+fn open_classifier(
+    bytes: &[u8],
+    expected: &'static str,
+    (h, w): (usize, usize),
+) -> Result<Model, FaceError> {
+    let model = dr_inference_engine::open(Role::EyeClassifier, Form::F32, bytes)?;
+    let acquired = model.acquire()?;
+    let session = acquired.lock();
+
+    let input = session.inputs().first().ok_or(FaceError::WrongModel {
+        expected,
+        detail: "model has no inputs".into(),
+    })?;
+    let shape: Option<Vec<i64>> = input.dtype().tensor_shape().map(|s| s.to_vec());
+    let want = [1, 3, h as i64, w as i64];
+    if shape.as_deref() != Some(&want[..]) {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: format!(
+                "input '{}' is {:?}, expected {:?} (batch pinned to 1)",
+                input.name(),
+                shape,
+                want
+            ),
+        });
+    }
+    if session.outputs().len() != 1 {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: format!("{} outputs, expected one", session.outputs().len()),
+        });
+    }
+    drop(session);
+    drop(acquired);
+    Ok(model)
+}
+
+/// Lay a `h × w` RGB crop out as the `[1, 3, h, w]` tensor both graphs take.
+fn to_nchw(pixels: &[f32], h: usize, w: usize) -> Array4<f32> {
+    let mut input = Array4::<f32>::zeros((1, 3, h, w));
+    for y in 0..h {
+        for x in 0..w {
+            for c in 0..3 {
+                input[[0, c, y, x]] = pixels[(y * w + x) * 3 + c];
+            }
+        }
+    }
+    input
+}
+
+/// Run a one-number classifier and read its sigmoid back, clamped.
+fn run_scalar(model: &Model, input: Array4<f32>, expected: &'static str) -> Result<f32, FaceError> {
+    let acquired = model.acquire()?;
+    let mut session = acquired.lock();
+    let outputs = session
+        .run(ort::inputs![
+            ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+        ])
+        .map_err(FaceError::Inference)?;
+    let (_, data) = outputs[0]
+        .try_extract_tensor::<f32>()
+        .map_err(FaceError::Inference)?;
+    let Some(&p) = data.first() else {
+        return Err(FaceError::WrongModel {
+            expected,
+            detail: "empty output".into(),
+        });
+    };
+    // The graph ends in a sigmoid, so this is a clamp against rounding and
+    // nothing more — the reference demo does the same.
+    Ok(p.clamp(0.0, 1.0))
+}
+
+impl EyeClassifier {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Ok(Self {
+            session: open_classifier(bytes, "OCEC", (EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH))?,
+        })
+    }
+
+    /// P(open) for one eye.
+    pub fn classify(&mut self, eye: &EyePatch) -> Result<f32, FaceError> {
+        let input = to_nchw(eye.pixels(), EYE_PATCH_HEIGHT, EYE_PATCH_WIDTH);
+        run_scalar(&self.session, input, "OCEC")
+    }
+}
+
+impl SunglassesClassifier {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Ok(Self {
+            session: open_classifier(bytes, "SGC", (SUNGLASSES_EDGE, SUNGLASSES_EDGE))?,
+        })
+    }
+
+    /// P(sunglasses) for one head: the highest answer over its framings.
+    pub fn classify(&mut self, head: &HeadViews) -> Result<f32, FaceError> {
+        let mut best = 0.0_f32;
+        for view in head.views() {
+            let input = to_nchw(view, SUNGLASSES_EDGE, SUNGLASSES_EDGE);
+            best = best.max(run_scalar(&self.session, input, "SGC")?);
+        }
+        Ok(best)
+    }
+}
+
+/// The three models behind a reading, which is how every caller holds them.
+///
+/// One struct rather than three optional parameters, because a partial
+/// reading is not a reading: an eye state with no sunglasses number behind
+/// it is exactly the beach-photograph failure [`crate::eyes`] describes, and
+/// an eye box without the landmarks is the loose one this module replaced.
+/// The models load together or not at all.
+pub struct EyeModels {
+    pub landmarks: Landmarker,
+    pub eyes: EyeClassifier,
+    pub sunglasses: SunglassesClassifier,
+}
+
+impl EyeModels {
+    pub fn from_paths(
+        landmarks: impl AsRef<std::path::Path>,
+        eyes: impl AsRef<std::path::Path>,
+        sunglasses: impl AsRef<std::path::Path>,
+    ) -> Result<Self, FaceError> {
+        Ok(Self {
+            landmarks: Landmarker::from_path(landmarks)?,
+            eyes: EyeClassifier::from_path(eyes)?,
+            sunglasses: SunglassesClassifier::from_path(sunglasses)?,
+        })
+    }
+
+    /// Read one face's eyes, and hand back the dense landmarks it read them
+    /// from.
+    ///
+    /// `bbox` is the detector's `(x0, y0, x1, y1)` and `landmarks5` its five
+    /// points, both in source pixels; the buffer is the one the aligned
+    /// crop was taken from, so an eye is read from the same pixels the
+    /// embedder saw the face in. `None` where nothing could be cut — a
+    /// degenerate box or landmarks — which the caller stores as "not read".
+    ///
+    /// The landmarks come back because they cost a model run the caller will
+    /// not want to pay twice: stored beside the reading, a later pass over
+    /// faces — head pose, expression — has them without the original.
+    pub fn read(
+        &mut self,
+        px: Pixels<'_>,
+        width: usize,
+        height: usize,
+        bbox: (f32, f32, f32, f32),
+        landmarks5: &[(f32, f32); 5],
+    ) -> Result<Option<(EyeReading, Landmarks)>, FaceError> {
+        let Some(lm) = self.landmarks.landmarks(px, width, height, bbox)? else {
+            return Ok(None);
+        };
+        let Some(head) = head_views(px, width, height, landmarks5) else {
+            return Ok(None);
+        };
+        let mut eye = |contour: &[(f32, f32)]| -> Result<Eye, FaceError> {
+            // A hidden eye's contour can collapse to no width. Its numbers
+            // are then zero — no pixels, no sharpness — which is what the
+            // rule in `crate::eyes` reads as "not readable".
+            let Some(b) = eye_box(contour) else {
+                return Ok(Eye {
+                    open: 0.0,
+                    px: 0.0,
+                    sharpness: 0.0,
+                });
+            };
+            let Some(patch) = eye_patch(px, width, height, b) else {
+                return Ok(Eye {
+                    open: 0.0,
+                    px: 0.0,
+                    sharpness: 0.0,
+                });
+            };
+            Ok(Eye {
+                open: self.eyes.classify(&patch)?,
+                px: patch.source_px(),
+                sharpness: patch.sharpness(),
+            })
+        };
+        let right = eye(&lm.right_eye())?;
+        let left = eye(&lm.left_eye())?;
+        let reading = EyeReading {
+            right,
+            left,
+            sunglasses: self.sunglasses.classify(&head)?,
+        };
+        Ok(Some((reading, lm)))
+    }
+}

core/dr-face/src/detect.rs

@@ -0,0 +1,463 @@
+//! SCRFD face detection (docs/dev/faces.md §4).
+//!
+//! One forward pass produces a box, a confidence and **five landmarks** per
+//! face — the landmarks being the reason for this detector rather than a
+//! general one, since [`crate::align`] cannot work without them.
+//!
+//! # The graph must have fixed input dimensions
+//!
+//! InsightFace ships `det_500m.onnx` with a dynamic H/W input, and **tract
+//! cannot parse it in that form** — it fails at node #0. The same file run
+//! through `tools/fix-face-model-shapes.sh` loads cleanly. Its outputs were
+//! already static at 640, so 640 is not a choice made here: it is the shape
+//! the export was always going to run at.
+
+use ndarray::Array4;
+
+use crate::FaceError;
+use dr_inference_engine::{Form, Model, Role};
+
+/// The graph's input edge, in pixels. See the module note: not configurable.
+pub const INPUT_EDGE: usize = 640;
+
+/// Strides, in the order SCRFD emits them.
+const ALL_STRIDES: [usize; 4] = [8, 16, 32, 64];
+
+/// Anchors per feature-map location.
+const ANCHORS: usize = 2;
+
+/// How detection is tuned.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct DetectOptions {
+    /// Minimum detector confidence.
+    ///
+    /// Deliberately *not* the low threshold `dr-segment` chose. There a false
+    /// positive costs one spurious row in a list the user is picking from;
+    /// here it costs a face in the People view to reject and — worse — a
+    /// garbage embedding that can bridge two real clusters into one. A false
+    /// negative is recoverable by re-indexing with a better model; a polluted
+    /// cluster graph, once the user has confirmed faces inside it, is not.
+    pub confidence: f32,
+    /// Box IoU above which two detections are judged to be the same face.
+    pub nms_iou: f32,
+    /// Cheap pre-filter: smallest box to keep, in source pixels on the shorter
+    /// edge.
+    ///
+    /// **Not the real size floor** — [`DetectOptions::min_source_px`] is, and
+    /// it is measured on the aligned crop rather than the box. This one exists
+    /// only to throw away the obviously hopeless before paying for a warp, so
+    /// it is deliberately set *below* what the real floor will accept: the
+    /// aligned crop spans roughly 1.3x the box's shorter edge, so 24 here
+    /// cannot reject a face that would have cleared 32 there.
+    pub min_face_px: f32,
+    /// Smallest face the embedder may be given, in **source pixels across the
+    /// aligned crop** — `crop_px` in the catalog.
+    ///
+    /// The honest statement of "a face must be at least 32x32", because this is
+    /// the number of real pixels behind the 112x112 the model actually sees.
+    /// The box's own size is not that: the ArcFace template reaches past the
+    /// box for forehead and chin, so a 64-pixel box and a 64-pixel crop are
+    /// different faces.
+    ///
+    /// Below this the crop was upsampled to reach the embedder, and upsampling
+    /// invents no detail — the embedding is of a soft, stretched face and is
+    /// correspondingly untrustworthy.
+    ///
+    /// Applied after alignment, so it lives with the sharpness floor rather
+    /// than with the detector. See [`DetectOptions::min_sharpness`].
+    pub min_source_px: f32,
+    /// Least acceptable [`crate::align::Aligned112::sharpness`].
+    ///
+    /// Applied after alignment rather than here, because it is a property of
+    /// the warped crop the embedder receives and not of the box. The pipeline
+    /// that enforces it is `dr_ui::faces::index_proxy`; it lives on this struct
+    /// so that every quality decision about a face is configured in one place
+    /// and a caller cannot enable one gate while forgetting the other.
+    ///
+    /// Zero disables it, which is what a measurement run wants.
+    ///
+    /// # It has to move with the size floor
+    ///
+    /// The two are coupled, because an upsampled face scores low here whatever
+    /// its original sharpness. Measured over the reference library, with the
+    /// size floor at 32 source pixels:
+    ///
+    /// | min sharpness | of what the size floor left, this removes |
+    /// |---|---|
+    /// | 0.002 | 3% |
+    /// | 0.005 | 8% |
+    /// | 0.010 | 16% |
+    /// | 0.020 | 27% |
+    ///
+    /// At a 64-pixel floor, 0.020 removed 7% — the same *kind* of face, the
+    /// large-but-soft one this gate exists for. Holding 0.020 while dropping
+    /// the size floor to 32 would have thrown away a quarter of the newly
+    /// admitted faces for being small rather than for being blurred, undoing
+    /// most of the point of lowering it. 0.005 removes 8% at 32, which is the
+    /// same job.
+    pub min_sharpness: f32,
+}
+
+impl Default for DetectOptions {
+    fn default() -> Self {
+        Self {
+            confidence: 0.5,
+            nms_iou: 0.4,
+            min_face_px: 24.0,
+            min_source_px: 32.0,
+            min_sharpness: 0.005,
+        }
+    }
+}
+
+/// One detected face, in **source image pixels**.
+///
+/// Pixels rather than the normalised form the catalog stores, because the
+/// caller still has to crop from this image. Normalisation happens at the
+/// storage boundary, where the long edge is known to be the right divisor.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Detection {
+    /// `(x0, y0, x1, y1)`.
+    pub bbox: (f32, f32, f32, f32),
+    /// Five points in the detector's own order — see [`crate::align`], which
+    /// consumes them without reordering.
+    pub landmarks: [(f32, f32); 5],
+    pub confidence: f32,
+}
+
+impl Detection {
+    pub fn width(&self) -> f32 {
+        self.bbox.2 - self.bbox.0
+    }
+    pub fn height(&self) -> f32 {
+        self.bbox.3 - self.bbox.1
+    }
+}
+
+/// A loaded SCRFD graph.
+pub struct Detector {
+    session: Model,
+    /// f32 or int8 — the int8 form finds a different set of faces and is a
+    /// different detector in `model_id` (docs/dev/inference.md §7).
+    form: Form,
+    /// Feature-map count: 3 for strides {8,16,32}, 4 for {8,16,32,64}.
+    ///
+    /// Discovered from the output count rather than assumed, because both
+    /// exports exist and hardcoding 3 silently ignores the largest faces a
+    /// four-stride model finds.
+    fmc: usize,
+}
+
+impl Detector {
+    /// Which form this detector was loaded from.
+    pub fn form(&self) -> Form {
+        self.form
+    }
+
+    /// Load the canonical f32 file at `path`, or the form the device's
+    /// backend wants instead — the `.int8.onnx` beside it on a Hexagon —
+    /// which [`Detector::form`] then reports.
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let (path, form) = dr_inference_engine::resolve_model(Role::Detector, path.as_ref());
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes_in(&bytes, form)
+    }
+
+    /// An f32 graph from memory.
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        Self::from_bytes_in(bytes, Form::F32)
+    }
+
+    fn from_bytes_in(bytes: &[u8], form: Form) -> Result<Self, FaceError> {
+        let model = dr_inference_engine::open(Role::Detector, form, bytes)?;
+        let acquired = model.acquire()?;
+        let session = acquired.lock();
+
+        let n_out = session.outputs().len();
+        if n_out % 3 != 0 || !(9..=12).contains(&n_out) {
+            return Err(FaceError::WrongModel {
+                expected: "InsightFace SCRFD",
+                detail: format!("expected 9 or 12 outputs, got {n_out}"),
+            });
+        }
+        let fmc = n_out / 3;
+
+        // The check that actually distinguishes the models. YuNet also has
+        // twelve outputs in three strides, so the count proves nothing — its
+        // groups are cls/obj/bbox/kps where SCRFD's are score/bbox/kps, and
+        // decoding one as the other yields a page of plausible numbers rather
+        // than an error. The last dimension is what separates them.
+        for (group, expected_last) in [1_i64, 4, 10].into_iter().enumerate() {
+            for s in 0..fmc {
+                let idx = group * fmc + s;
+                let out = &session.outputs()[idx];
+                let last: Option<i64> = out.dtype().tensor_shape().and_then(|d| d.last().copied());
+                if last != Some(expected_last) {
+                    return Err(FaceError::WrongModel {
+                        expected: "InsightFace SCRFD",
+                        detail: format!(
+                            "output '{}' last dim is {:?}, expected {expected_last} \
+                             (a YuNet export fails exactly here)",
+                            out.name(),
+                            last
+                        ),
+                    });
+                }
+            }
+        }
+
+        drop(session);
+        drop(acquired);
+        Ok(Self {
+            session: model,
+            form,
+            fmc,
+        })
+    }
+
+    /// Stride levels this graph emits.
+    pub fn strides(&self) -> &'static [usize] {
+        &ALL_STRIDES[..self.fmc]
+    }
+
+    /// Find the faces in an image.
+    ///
+    /// `rgb` is tightly packed `f32` RGB in `0.0..=1.0`, row-major — the same
+    /// convention `dr-segment` and [`crate::align`] use.
+    pub fn detect(
+        &mut self,
+        rgb: &[f32],
+        width: usize,
+        height: usize,
+        options: &DetectOptions,
+    ) -> Result<Vec<Detection>, FaceError> {
+        if width == 0 || height == 0 {
+            return Ok(Vec::new());
+        }
+        if rgb.len() != width * height * 3 {
+            return Err(FaceError::ImageShape {
+                expected: width * height * 3,
+                got: rgb.len(),
+            });
+        }
+
+        let lb = Letterbox::fit(width as f32, height as f32);
+        let input = lb.sample(rgb, width, height);
+
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
+            .run(ort::inputs![
+                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+            ])
+            .map_err(FaceError::Inference)?;
+
+        let mut raw: Vec<Detection> = Vec::new();
+
+        for (si, &stride) in ALL_STRIDES[..self.fmc].iter().enumerate() {
+            let (_, scores) = outputs[si]
+                .try_extract_tensor::<f32>()
+                .map_err(FaceError::Inference)?;
+            let (_, boxes) = outputs[self.fmc + si]
+                .try_extract_tensor::<f32>()
+                .map_err(FaceError::Inference)?;
+            let (_, kps) = outputs[self.fmc * 2 + si]
+                .try_extract_tensor::<f32>()
+                .map_err(FaceError::Inference)?;
+
+            let fw = INPUT_EDGE / stride;
+            let fh = INPUT_EDGE / stride;
+            let s = stride as f32;
+
+            for r in 0..fh {
+                for c in 0..fw {
+                    for a in 0..ANCHORS {
+                        let idx = (r * fw + c) * ANCHORS + a;
+                        let score = scores[idx];
+                        if score < options.confidence {
+                            continue;
+                        }
+
+                        // Anchor centre in input space, then distance-to-box
+                        // decoding: the four regressed values are distances
+                        // left/top/right/bottom in units of the stride.
+                        let (cx, cy) = ((c * stride) as f32, (r * stride) as f32);
+                        let b = &boxes[idx * 4..idx * 4 + 4];
+                        let (x0, y0) = lb.into_source(cx - b[0] * s, cy - b[1] * s);
+                        let (x1, y1) = lb.into_source(cx + b[2] * s, cy + b[3] * s);
+
+                        let k = &kps[idx * 10..idx * 10 + 10];
+                        let mut landmarks = [(0.0_f32, 0.0_f32); 5];
+                        for (p, lm) in landmarks.iter_mut().enumerate() {
+                            *lm = lb.into_source(cx + k[p * 2] * s, cy + k[p * 2 + 1] * s);
+                        }
+
+                        raw.push(Detection {
+                            bbox: (x0, y0, x1, y1),
+                            landmarks,
+                            confidence: score,
+                        });
+                    }
+                }
+            }
+        }
+
+        let mut kept = non_max_suppress(raw, options.nms_iou);
+
+        // Size floor last, on the *merged* boxes: a face that only clears the
+        // floor once NMS has picked the best of its overlapping detections
+        // should be kept.
+        kept.retain(|d| d.width().min(d.height()) >= options.min_face_px);
+
+        // No cap on the count. The reference implementation keeps the ten
+        // largest, which is right for a film frame where background extras are
+        // noise; it is wrong for a photo library, where a group shot with
+        // thirty faces is precisely the picture worth indexing.
+        Ok(kept)
+    }
+}
+
+/// Greedy NMS across all strides together.
+fn non_max_suppress(mut dets: Vec<Detection>, iou_threshold: f32) -> Vec<Detection> {
+    dets.sort_by(|a, b| b.confidence.total_cmp(&a.confidence));
+    let mut kept: Vec<Detection> = Vec::new();
+    for d in dets {
+        if kept.iter().all(|k| iou(&k.bbox, &d.bbox) <= iou_threshold) {
+            kept.push(d);
+        }
+    }
+    kept
+}
+
+fn iou(a: &(f32, f32, f32, f32), b: &(f32, f32, f32, f32)) -> f32 {
+    let ix = (a.2.min(b.2) - a.0.max(b.0)).max(0.0);
+    let iy = (a.3.min(b.3) - a.1.max(b.1)).max(0.0);
+    let inter = ix * iy;
+    let area_a = (a.2 - a.0).max(0.0) * (a.3 - a.1).max(0.0);
+    let area_b = (b.2 - b.0).max(0.0) * (b.3 - b.1).max(0.0);
+    let union = area_a + area_b - inter;
+    if union <= 0.0 {
+        0.0
+    } else {
+        inter / union
+    }
+}
+
+/// How the image is fitted into the graph's fixed square input.
+///
+/// The forward and inverse mappings live in one struct on purpose:
+/// docs/dev/faces.md §4.1 notes that what matters is not *where* the padding goes
+/// but that the two agree. A mismatch offsets every box and landmark by the
+/// padding, producing detections that look plausible and embeddings that
+/// quietly cluster badly three stages later.
+#[derive(Debug, Clone, Copy)]
+struct Letterbox {
+    /// Input pixels per source pixel.
+    scale: f32,
+    pad_x: f32,
+    pad_y: f32,
+}
+
+impl Letterbox {
+    fn fit(w: f32, h: f32) -> Self {
+        let scale = (INPUT_EDGE as f32 / w).min(INPUT_EDGE as f32 / h);
+        Self {
+            scale,
+            pad_x: (INPUT_EDGE as f32 - w * scale) * 0.5,
+            pad_y: (INPUT_EDGE as f32 - h * scale) * 0.5,
+        }
+    }
+
+    /// Resample into `[1, 3, 640, 640]`, normalised as the weights expect.
+    ///
+    /// `(x·255 − 127.5) / 128` — note `/128`, not `/127.5`. The reference
+    /// implementation this is ported from uses `/128` for both models, and
+    /// every measured number in docs/dev/faces.md §1 came from it.
+    ///
+    /// Padding is grey, matching the reference's `114`: the value the network
+    /// reads least as an edge, where black would draw a hard border across the
+    /// frame and invite a detection along it.
+    fn sample(&self, rgb: &[f32], width: usize, height: usize) -> Array4<f32> {
+        const PAD: f32 = 114.0;
+        let norm = |v: f32| (v * 255.0 - 127.5) / 128.0;
+
+        let mut input =
+            Array4::<f32>::from_elem((1, 3, INPUT_EDGE, INPUT_EDGE), (PAD - 127.5) / 128.0);
+
+        for iy in 0..INPUT_EDGE {
+            let sy = (iy as f32 + 0.5 - self.pad_y) / self.scale - 0.5;
+            if sy < -0.5 || sy > height as f32 - 0.5 {
+                continue;
+            }
+            for ix in 0..INPUT_EDGE {
+                let sx = (ix as f32 + 0.5 - self.pad_x) / self.scale - 0.5;
+                if sx < -0.5 || sx > width as f32 - 0.5 {
+                    continue;
+                }
+                let (x0f, y0f) = (sx.floor(), sy.floor());
+                let (fx, fy) = (sx - x0f, sy - y0f);
+                let x0 = (x0f as isize).clamp(0, width as isize - 1) as usize;
+                let y0 = (y0f as isize).clamp(0, height as isize - 1) as usize;
+                let x1 = (x0 + 1).min(width - 1);
+                let y1 = (y0 + 1).min(height - 1);
+
+                for c in 0..3 {
+                    let at = |x: usize, y: usize| rgb[(y * width + x) * 3 + c];
+                    let top = at(x0, y0) * (1.0 - fx) + at(x1, y0) * fx;
+                    let bot = at(x0, y1) * (1.0 - fx) + at(x1, y1) * fx;
+                    input[[0, c, iy, ix]] = norm(top * (1.0 - fy) + bot * fy);
+                }
+            }
+        }
+
+        input
+    }
+
+    /// Input-space point back to source pixels.
+    fn into_source(self, x: f32, y: f32) -> (f32, f32) {
+        ((x - self.pad_x) / self.scale, (y - self.pad_y) / self.scale)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn letterbox_round_trips_a_point() {
+        let lb = Letterbox::fit(1024.0, 683.0);
+        for &(x, y) in &[(0.0_f32, 0.0_f32), (512.0, 341.0), (1023.0, 682.0)] {
+            let (bx, by) = lb.into_source(x * lb.scale + lb.pad_x, y * lb.scale + lb.pad_y);
+            assert!((bx - x).abs() < 1e-2, "{bx} vs {x}");
+            assert!((by - y).abs() < 1e-2, "{by} vs {y}");
+        }
+    }
+
+    #[test]
+    fn letterbox_centres_the_short_axis() {
+        let lb = Letterbox::fit(640.0, 320.0);
+        assert!((lb.scale - 1.0).abs() < 1e-6);
+        assert!(lb.pad_x.abs() < 1e-6);
+        assert!((lb.pad_y - 160.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn nms_keeps_the_confident_box_and_drops_its_duplicate() {
+        let d = |x: f32, conf: f32| Detection {
+            bbox: (x, 0.0, x + 100.0, 100.0),
+            landmarks: [(0.0, 0.0); 5],
+            confidence: conf,
+        };
+        let kept = non_max_suppress(vec![d(0.0, 0.8), d(5.0, 0.9), d(500.0, 0.7)], 0.4);
+        assert_eq!(kept.len(), 2);
+        assert!((kept[0].confidence - 0.9).abs() < 1e-6);
+        assert!((kept[1].bbox.0 - 500.0).abs() < 1e-6);
+    }
+
+    #[test]
+    fn iou_of_a_box_with_itself_is_one_and_with_a_disjoint_box_is_zero() {
+        let a = (0.0, 0.0, 10.0, 10.0);
+        assert!((iou(&a, &a) - 1.0).abs() < 1e-6);
+        assert!(iou(&a, &(100.0, 100.0, 110.0, 110.0)) < 1e-6);
+    }
+}

core/dr-face/src/embed.rs

@@ -0,0 +1,149 @@
+//! ArcFace / MobileFaceNet inference (docs/dev/faces.md §6).
+//!
+//! Takes an aligned crop and returns 512 L2-normalised floats. The alignment is
+//! not optional and cannot be skipped by accident: [`Embedder::embed`] takes an
+//! [`Aligned112`], which only [`crate::align::warp`] can construct.
+//!
+//! # The graph must have a fixed batch
+//!
+//! `w600k_mbf.onnx` declares its batch dimension as the literal `dim_param`
+//! `"None"`, and tract fails to analyse the first Conv because of it. Pinned to
+//! 1 by `tools/fix-face-model-shapes.sh`, it loads and runs.
+
+use ndarray::Array4;
+
+use crate::align::{Aligned112, ALIGNED_EDGE};
+use crate::embedding::{normalise, Embedding, ModelId, EMBEDDING_DIM};
+use crate::FaceError;
+use dr_inference_engine::{Form, Model, Role};
+
+/// What one pass of the embedder produces: the direction, and the length.
+///
+/// Two fields rather than a `quality` on [`Embedding`], because every other
+/// holder of an `Embedding` relies on it being unit length and compares by
+/// dot product; the length is a separate fact about the same face, and it is
+/// stored separately too.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Embedded {
+    pub embedding: Embedding,
+    /// L2 norm of the raw model output.
+    ///
+    /// The model's own opinion of how recognisable the crop was — see
+    /// [`crate::embedding::MIN_GALLERY_QUALITY`] for what it means and where
+    /// it is used.
+    pub quality: f32,
+}
+
+impl Embedded {
+    /// Storage form: the **raw** vector, `512 × f16`.
+    ///
+    /// Not the unit vector. The length is the quality, and a store that held
+    /// only the direction would have thrown it away at the one moment it could
+    /// be known — which is what this crate used to do. Readers re-normalise
+    /// ([`Embedding::from_f16_bytes`]), so every comparison is still a dot
+    /// product, and [`crate::embedding::read_f16_bytes`] gives the length back
+    /// to a reader that wants it.
+    ///
+    /// f16 costs nothing extra at this scale: its precision is relative, so a
+    /// component of a vector of length 20 is kept to the same three figures as
+    /// the same component scaled to length 1.
+    pub fn to_f16_bytes(&self) -> Vec<u8> {
+        self.embedding.to_f16_bytes_scaled(self.quality)
+    }
+}
+
+/// A loaded ArcFace graph.
+pub struct Embedder {
+    session: Model,
+    model: ModelId,
+}
+
+impl Embedder {
+    pub fn from_path(path: impl AsRef<std::path::Path>, model: ModelId) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes, model)
+    }
+
+    pub fn from_bytes(bytes: &[u8], model: ModelId) -> Result<Self, FaceError> {
+        // Always the f32 form: an embedding must compare across devices
+        // (docs/dev/inference.md §7), and the engine pins this role to it.
+        let loaded = dr_inference_engine::open(Role::Embedder, Form::F32, bytes)?;
+        let acquired = loaded.acquire()?;
+        let session = acquired.lock();
+
+        // One output, `[1, 512]`. Checked because an ArcFace variant with a
+        // different embedding width would otherwise be read as a truncated
+        // one, and 512 is baked into the catalog's BLOB width.
+        let out = session.outputs().first().ok_or(FaceError::WrongModel {
+            expected: "ArcFace",
+            detail: "model has no outputs".into(),
+        })?;
+        let last = out.dtype().tensor_shape().and_then(|d| d.last().copied());
+        if last != Some(EMBEDDING_DIM as i64) {
+            return Err(FaceError::WrongModel {
+                expected: "ArcFace",
+                detail: format!(
+                    "output '{}' is {:?}-wide, expected {EMBEDDING_DIM}",
+                    out.name(),
+                    last
+                ),
+            });
+        }
+
+        drop(session);
+        drop(acquired);
+        Ok(Self {
+            session: loaded,
+            model,
+        })
+    }
+
+    pub fn model(&self) -> &ModelId {
+        &self.model
+    }
+
+    /// Embed one aligned face.
+    pub fn embed(&mut self, face: &Aligned112) -> Result<Embedded, FaceError> {
+        // `(x·255 − 127.5) / 128` — see the `/128` note in `detect::Letterbox`.
+        let px = face.pixels();
+        let mut input = Array4::<f32>::zeros((1, 3, ALIGNED_EDGE, ALIGNED_EDGE));
+        for y in 0..ALIGNED_EDGE {
+            for x in 0..ALIGNED_EDGE {
+                for c in 0..3 {
+                    let v = px[(y * ALIGNED_EDGE + x) * 3 + c];
+                    input[[0, c, y, x]] = (v * 255.0 - 127.5) / 128.0;
+                }
+            }
+        }
+
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
+            .run(ort::inputs![
+                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+            ])
+            .map_err(FaceError::Inference)?;
+
+        let (_, data) = outputs[0]
+            .try_extract_tensor::<f32>()
+            .map_err(FaceError::Inference)?;
+        if data.len() < EMBEDDING_DIM {
+            return Err(FaceError::WrongModel {
+                expected: "ArcFace",
+                detail: format!("got {} values, expected {EMBEDDING_DIM}", data.len()),
+            });
+        }
+
+        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+        v.copy_from_slice(&data[..EMBEDDING_DIM]);
+        let quality = normalise(&mut v);
+
+        Ok(Embedded {
+            embedding: Embedding {
+                model: self.model.clone(),
+                v,
+            },
+            quality,
+        })
+    }
+}

core/dr-face/src/embedding.rs

@@ -0,0 +1,341 @@
+//! What an embedder produces, and how it is stored (docs/dev/faces.md §6).
+//!
+//! Deliberately **model-free**: the vector, its identity, its comparison and
+//! its storage encoding are arithmetic, and `calibrate` and `cluster` are built
+//! on them. Keeping them out of the `inference` feature is what lets the part
+//! of this subsystem most likely to be subtly wrong be tested on a machine with
+//! no weights on it.
+//!
+//! [`crate::embed::Embedder`] is the thing that needs a model, and it lives
+//! behind the feature.
+
+/// Embedding dimensionality. Fixed by the model family, not a parameter.
+pub const EMBEDDING_DIM: usize = 512;
+
+/// The shortest raw embedding a face may be *compared against*.
+///
+/// # What the length of the vector says
+///
+/// ArcFace is trained on the direction of its output and nothing else, and
+/// the length it leaves behind turns out to be a free quality signal: the
+/// magnitude grows with how recognisable the crop was to the model, and a
+/// blurred, occluded, badly lit or hard-profile face comes out short. MagFace
+/// (Meng et al., CVPR 2021) made that the training objective; the plain
+/// ArcFace heads this crate runs already show it, weaker but usable, which is
+/// why it is worth keeping the number the normalisation discards.
+///
+/// # Why it gates the gallery and not the face
+///
+/// A short vector is a bad *reference*: it sits nearer the centre of the
+/// sphere than a real identity does and matches a little of everyone, which
+/// is exactly the face that welds two people together in a clustering pass.
+/// It is not a bad *probe* — the face is still real, still somebody, and
+/// comparing it against good references is the only way it will ever be named.
+/// So a face below this floor is compared against the gallery and never
+/// becomes part of it: see `cluster::Candidate::in_gallery`.
+///
+/// 14 is the operating point for `w600k_mbf`, whose norms on the reference
+/// library run from about 8 on a blur to the high 20s on a clean portrait. A
+/// face whose quality was never recorded — indexed before the number was kept
+/// — is not gated, because a rule that cannot be checked should admit, not
+/// exclude.
+pub const MIN_GALLERY_QUALITY: f32 = 14.0;
+
+/// Whether an embedding of this quality may serve as a reference.
+///
+/// `None` is "not measured", and is admitted: the rule is about a number that
+/// was read and found short, not about a number that is missing.
+pub fn in_gallery(quality: Option<f32>) -> bool {
+    quality.is_none_or(|q| q >= MIN_GALLERY_QUALITY)
+}
+
+/// Which model produced an embedding.
+///
+/// Embeddings from different models are not comparable, and this is the one
+/// mistake that produces plausible-looking garbage rather than an error — so
+/// the id travels *with* the vector rather than beside it, and
+/// [`Embedding::cosine`] refuses a cross-model comparison.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct ModelId(pub std::sync::Arc<str>);
+
+impl ModelId {
+    pub fn new(s: impl Into<std::sync::Arc<str>>) -> Self {
+        Self(s.into())
+    }
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl std::fmt::Display for ModelId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+/// A 512-d L2-normalised face embedding.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Embedding {
+    pub model: ModelId,
+    pub v: Box<[f32; EMBEDDING_DIM]>,
+}
+
+impl Embedding {
+    /// Cosine similarity, which for unit vectors is the plain dot product.
+    ///
+    /// `None` when the two came from different models. That is a real
+    /// possibility in a library indexed across a model upgrade, and the
+    /// alternative — returning a number — is the failure mode
+    /// `faces.model_id` exists to prevent.
+    pub fn cosine(&self, other: &Embedding) -> Option<f32> {
+        if self.model != other.model {
+            return None;
+        }
+        Some(dot(&self.v, &other.v))
+    }
+
+    /// Storage form: `512 × f16`, 1 KB per face (catalog.md §10.1).
+    ///
+    /// This writes the unit vector. What the catalog stores is the raw one —
+    /// `embed::Embedded::to_f16_bytes` — because the length is the quality
+    /// and a unit vector has none left to read.
+    pub fn to_f16_bytes(&self) -> Vec<u8> {
+        self.to_f16_bytes_scaled(1.0)
+    }
+
+    /// The unit vector scaled by `length`, as `512 × f16`.
+    pub(crate) fn to_f16_bytes_scaled(&self, length: f32) -> Vec<u8> {
+        let mut out = Vec::with_capacity(EMBEDDING_DIM * 2);
+        for &x in self.v.iter() {
+            out.extend_from_slice(&f32_to_f16_bits(x * length).to_le_bytes());
+        }
+        out
+    }
+
+    /// Read back from storage, re-normalising.
+    ///
+    /// The f16 round-trip perturbs a unit vector by ~1e-3 in cosine — three
+    /// orders below the separation between a match and a non-match — but the
+    /// drift is free to remove and invisible if left, so it is removed here
+    /// rather than remembered at every call site. The same pass is what turns
+    /// a stored raw vector back into the unit one every comparison expects.
+    pub fn from_f16_bytes(model: ModelId, bytes: &[u8]) -> Option<Self> {
+        read_f16_bytes(model, bytes).map(|(e, _)| e)
+    }
+}
+
+/// Read a stored vector back, with the length it was stored at.
+///
+/// The length is the quality where the blob is a raw one, and ~1 where it is
+/// a unit vector from before raw vectors were stored — which is why the
+/// catalog keeps the quality beside the blob rather than deriving it from
+/// this: a unit vector reads as a quality of 1, not as "unmeasured".
+pub fn read_f16_bytes(model: ModelId, bytes: &[u8]) -> Option<(Embedding, f32)> {
+    if bytes.len() != EMBEDDING_DIM * 2 {
+        return None;
+    }
+    let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+    for (i, chunk) in bytes.chunks_exact(2).enumerate() {
+        v[i] = f16_bits_to_f32(u16::from_le_bytes([chunk[0], chunk[1]]));
+    }
+    let length = normalise(&mut v);
+    Some((Embedding { model, v }, length))
+}
+
+fn dot(a: &[f32; EMBEDDING_DIM], b: &[f32; EMBEDDING_DIM]) -> f32 {
+    a.iter().zip(b.iter()).map(|(x, y)| x * y).sum()
+}
+
+/// Scale `v` to unit length, and return the length it had.
+///
+/// The length is the one thing about the raw output that survives being
+/// thrown away by everything downstream, and it is a quality signal
+/// ([`MIN_GALLERY_QUALITY`]) — so it comes back out rather than being lost
+/// here.
+pub(crate) fn normalise(v: &mut [f32; EMBEDDING_DIM]) -> f32 {
+    // Clamped rather than checked: a zero-norm embedding is a broken model,
+    // not a runtime condition worth an error path, and dividing by 1e-6 keeps
+    // the NaN out of the catalog.
+    let norm = v.iter().map(|x| x * x).sum::<f32>().sqrt().max(1e-6);
+    for x in v.iter_mut() {
+        *x /= norm;
+    }
+    norm
+}
+
+// ── f16 ───────────────────────────────────────────────────────────────────
+//
+// Hand-rolled rather than pulling in `half`: two functions over a format that
+// has not changed since 2008, used at exactly one boundary. The dependency
+// policy (D13, D1) makes the bar for a new crate high, and this is well under
+// it.
+
+fn f32_to_f16_bits(x: f32) -> u16 {
+    let bits = x.to_bits();
+    let sign = ((bits >> 16) & 0x8000) as u16;
+    let exp = ((bits >> 23) & 0xff) as i32 - 127 + 15;
+    let mant = bits & 0x007f_ffff;
+
+    if exp >= 0x1f {
+        // Overflow, inf, or NaN. No component of an embedding exceeds its
+        // length, and the lengths this model produces are in the tens, so
+        // this is the broken-model path; infinity is the honest answer, not a
+        // clamp that hides it.
+        return sign
+            | 0x7c00
+            | if mant != 0 && exp == 0x1f + 112 {
+                0x200
+            } else {
+                0
+            };
+    }
+    if exp <= 0 {
+        // Subnormal or underflow. A component of a unit 512-vector is ~0.04
+        // and a stored one is that times the length, nowhere near here, so
+        // this branch exists for correctness rather than for traffic.
+        if exp < -10 {
+            return sign;
+        }
+        let mant = mant | 0x0080_0000;
+        let shift = (14 - exp) as u32;
+        let half = (mant >> shift) as u16;
+        // Round to nearest, ties to even.
+        let rem = mant & ((1 << shift) - 1);
+        let tie = 1 << (shift - 1);
+        let round = u16::from(rem > tie || (rem == tie && (half & 1) == 1));
+        return sign | (half + round);
+    }
+
+    let half = ((exp as u16) << 10) | (mant >> 13) as u16;
+    let rem = mant & 0x1fff;
+    let round = u16::from(rem > 0x1000 || (rem == 0x1000 && (half & 1) == 1));
+    sign | (half + round)
+}
+
+fn f16_bits_to_f32(h: u16) -> f32 {
+    let sign = ((h & 0x8000) as u32) << 16;
+    let exp = ((h >> 10) & 0x1f) as u32;
+    let mant = (h & 0x03ff) as u32;
+
+    if exp == 0 {
+        if mant == 0 {
+            return f32::from_bits(sign);
+        }
+        // Subnormal: renormalise into f32's range.
+        let mut e = -1_i32;
+        let mut m = mant;
+        while m & 0x0400 == 0 {
+            m <<= 1;
+            e -= 1;
+        }
+        let m = m & 0x03ff;
+        return f32::from_bits(sign | (((127 - 15 + 1 + e) as u32) << 23) | (m << 13));
+    }
+    if exp == 0x1f {
+        return f32::from_bits(sign | 0x7f80_0000 | (mant << 13));
+    }
+    f32::from_bits(sign | ((exp + 127 - 15) << 23) | (mant << 13))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unit(seed: u32) -> Embedding {
+        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+        let mut s = seed.wrapping_mul(2_654_435_761).wrapping_add(1);
+        for x in v.iter_mut() {
+            s = s.wrapping_mul(1_664_525).wrapping_add(1_013_904_223);
+            *x = (s >> 8) as f32 / (1u32 << 23) as f32 - 0.5;
+        }
+        normalise(&mut v);
+        Embedding {
+            model: ModelId::new("test"),
+            v,
+        }
+    }
+
+    #[test]
+    fn a_normalised_embedding_has_cosine_one_with_itself() {
+        let e = unit(7);
+        assert!((e.cosine(&e).unwrap() - 1.0).abs() < 1e-5);
+    }
+
+    #[test]
+    fn embeddings_from_different_models_do_not_compare() {
+        let a = unit(1);
+        let mut b = unit(1);
+        b.model = ModelId::new("other");
+        assert_eq!(
+            a.cosine(&b),
+            None,
+            "a cross-model cosine must not be a number"
+        );
+    }
+
+    /// The claim docs/dev/faces.md §6 makes about the storage format: the f16
+    /// round-trip costs ~1e-3 of cosine, three orders below the separation
+    /// between a match and a non-match.
+    #[test]
+    fn f16_round_trip_preserves_the_embedding() {
+        for seed in 0..16 {
+            let e = unit(seed);
+            let back = Embedding::from_f16_bytes(e.model.clone(), &e.to_f16_bytes()).unwrap();
+            let cos = e.cosine(&back).unwrap();
+            assert!(cos > 0.9999, "seed {seed}: round-trip cosine {cos}");
+        }
+    }
+
+    #[test]
+    fn normalising_reports_the_length_it_removed() {
+        let mut v = Box::new([0.0_f32; EMBEDDING_DIM]);
+        v[0] = 3.0;
+        v[1] = 4.0;
+        let norm = normalise(&mut v);
+        assert!((norm - 5.0).abs() < 1e-6, "norm {norm}");
+        assert!((v[0] - 0.6).abs() < 1e-6 && (v[1] - 0.8).abs() < 1e-6);
+    }
+
+    /// The gate admits what it cannot measure: a face from before the number
+    /// was kept is not a face that was found wanting.
+    #[test]
+    fn an_unmeasured_quality_is_admitted_to_the_gallery() {
+        assert!(in_gallery(None));
+        assert!(in_gallery(Some(MIN_GALLERY_QUALITY)));
+        assert!(in_gallery(Some(27.5)));
+        assert!(!in_gallery(Some(MIN_GALLERY_QUALITY - 0.01)));
+        assert!(!in_gallery(Some(8.0)));
+    }
+
+    /// The storage form carries the length, and the length comes back out —
+    /// without touching the direction every comparison is made on.
+    #[test]
+    fn a_raw_vector_round_trips_with_its_length() {
+        let e = unit(3);
+        let raw = e.to_f16_bytes_scaled(21.5);
+        let (back, length) = read_f16_bytes(e.model.clone(), &raw).unwrap();
+        assert!((length - 21.5).abs() < 0.05, "length {length}");
+        assert!(e.cosine(&back).unwrap() > 0.9999);
+        // A unit vector from an older store reads as length 1, not as an
+        // error — see `read_f16_bytes` on why that is not "unmeasured".
+        let (_, one) = read_f16_bytes(e.model.clone(), &e.to_f16_bytes()).unwrap();
+        assert!((one - 1.0).abs() < 1e-2, "length {one}");
+    }
+
+    #[test]
+    fn f16_round_trip_rejects_a_wrong_length_blob() {
+        assert!(Embedding::from_f16_bytes(ModelId::new("m"), &[0u8; 100]).is_none());
+    }
+
+    #[test]
+    fn f16_handles_the_values_an_embedding_actually_contains() {
+        // Components of a unit 512-vector cluster around ±1/sqrt(512) ≈ 0.044.
+        for &x in &[0.0_f32, 1.0, -1.0, 0.044_194_17, -0.044_194_17, 1e-3, -7e-4] {
+            let back = f16_bits_to_f32(f32_to_f16_bits(x));
+            assert!(
+                (back - x).abs() <= 1e-3 * x.abs().max(1e-3),
+                "{x} round-tripped to {back}"
+            );
+        }
+    }
+}

core/dr-face/src/eyes.rs

@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! What a face's eyes are doing, and how the numbers behind it are read.
+//!
+//! Model-free: the models in [`crate::classify`] produce the numbers, and
+//! everything that interprets them — the catalog's filter, the People
+//! screen's label — comes through here, so a threshold lives in exactly one
+//! place.
+//!
+//! # Seven numbers, one answer
+//!
+//! An eye classifier answers "open or closed" for whatever it is shown, and
+//! it is shown three things it cannot answer for. **Dark glass**: over
+//! sunglasses it answers anyway, confidently, for a state that cannot be
+//! seen — so the reading carries P(sunglasses) from a classifier that looks
+//! at the whole head, and that takes precedence. **A smear**: a soft eye is
+//! not a closed one, but shown a blur the classifier says "closed" with the
+//! same confidence it says anything, and on the reference library that was
+//! the commonest wrong answer of all — small faces, motion, a proxy where
+//! the native render should have been. So each eye carries how many source
+//! pixels it spanned and how sharp the patch was, and an eye under either
+//! floor is not asked. **A cheek**: a head turned far enough hides its far
+//! eye, and the landmark contour of a hidden eye collapses to a sliver; an
+//! eye much narrower than its partner is not asked either.
+//!
+//! The two eyes are kept apart rather than averaged. A wink is one eye
+//! closed, and averaging it lands at 0.5 — the one value that says the least.
+//! [`EyeState::Open`] requires every eye that *could be read* to be open;
+//! a face with no readable eye is [`EyeState::Unreadable`], which is not a
+//! blink and not open, and a filter for either leaves it alone.
+
+/// One eye's numbers.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Eye {
+    /// P(open), the classifier's sigmoid.
+    pub open: f32,
+    /// Source pixels across the eye box — [`crate::align::EyePatch::source_px`].
+    pub px: f32,
+    /// [`crate::align::EyePatch::sharpness`] of the patch the classifier saw.
+    pub sharpness: f32,
+}
+
+/// The numbers the models produced for one face.
+///
+/// Stored per face, nullable as a whole: a face indexed before the eye models
+/// existed, or on a device without them, has no reading rather than a
+/// reading of zeros.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct EyeReading {
+    /// The subject's **right** eye — image-left.
+    pub right: Eye,
+    /// The subject's **left** eye — image-right.
+    pub left: Eye,
+    /// P(the head wears sunglasses).
+    pub sunglasses: f32,
+}
+
+/// Above this an eye is open. The classifier's own decision point; its
+/// training put the two classes either side of a sigmoid and this is where
+/// the sigmoid crosses.
+pub const EYES_OPEN_THRESHOLD: f32 = 0.5;
+
+/// Above this the head wears sunglasses and the eye readings are moot.
+pub const SUNGLASSES_THRESHOLD: f32 = 0.5;
+
+/// Fewest source pixels across an eye box for the eye to be read.
+///
+/// The classifier was trained on eyes down to about a dozen pixels wide
+/// (its reference footage averaged 15–21); below that the 40-pixel patch is
+/// an interpolation of nothing, and the answer is noise that reads as
+/// "closed". docs/dev/faces.md §17.3 has the measurement behind the number.
+pub const MIN_EYE_PX: f32 = 12.0;
+
+/// Least [`Eye::sharpness`] for the eye to be read.
+///
+/// The same measure as the face's `min_sharpness`, over the eye patch, and
+/// chosen the same way: the value under which the open-eyed faces of the
+/// reference sample were being called closed. docs/dev/faces.md §17.3.
+pub const MIN_EYE_SHARPNESS: f32 = 0.02;
+
+/// An eye narrower than this fraction of its partner is the far eye of a
+/// turned head, out of view behind the nose, and is not read.
+///
+/// A landmark model's contour for a hidden eye collapses towards the nose.
+/// Measured on twenty native renders of the reference library
+/// (docs/dev/faces.md §17.4): profiles put the far eye at 0.02–0.43 of the near
+/// one, two three-quarter faces whose far eye read closed sat at 0.54, and
+/// every face looking at the camera — winks included, since a shut eye's
+/// box keeps its width — sat at 0.78 or more. 0.6 splits the gap.
+pub const HIDDEN_EYE_RATIO: f32 = 0.6;
+
+/// What the reading says, for a screen or a filter.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum EyeState {
+    /// Every eye that could be read is open.
+    Open,
+    /// An eye that could be read is closed — a blink, or a wink.
+    Closed,
+    /// The eyes cannot be seen. Neither open nor closed, and a filter for
+    /// either leaves the face alone.
+    Sunglasses,
+    /// No eye was sharp enough, large enough and in view to read. Neither
+    /// open nor closed, like sunglasses, and left alone by every filter.
+    Unreadable,
+}
+
+impl Eye {
+    /// Whether this eye can be read at all: enough pixels, sharp enough,
+    /// and not the collapsed contour of a hidden eye — measured against
+    /// `other`, its partner.
+    pub fn readable(&self, other: &Eye) -> bool {
+        self.px >= MIN_EYE_PX
+            && self.sharpness >= MIN_EYE_SHARPNESS
+            && self.px >= other.px * HIDDEN_EYE_RATIO
+    }
+}
+
+impl EyeReading {
+    pub fn state(&self) -> EyeState {
+        if self.sunglasses >= SUNGLASSES_THRESHOLD {
+            return EyeState::Sunglasses;
+        }
+        let readable = [
+            self.right.readable(&self.left).then_some(self.right.open),
+            self.left.readable(&self.right).then_some(self.left.open),
+        ];
+        let mut any = false;
+        for open in readable.into_iter().flatten() {
+            any = true;
+            if open < EYES_OPEN_THRESHOLD {
+                return EyeState::Closed;
+            }
+        }
+        if any {
+            EyeState::Open
+        } else {
+            EyeState::Unreadable
+        }
+    }
+
+    /// Whether this is a face a "no one blinking" filter should drop.
+    ///
+    /// The filter's question, rather than [`EyeState`]'s four-way answer,
+    /// because the two differ on exactly the cases that matter: a face
+    /// behind sunglasses, or one whose eyes could not be read, is not open
+    /// — and it is not a blink either. Only [`EyeState::Closed`] is one.
+    pub fn is_blink(&self) -> bool {
+        self.state() == EyeState::Closed
+    }
+}
+
+impl EyeState {
+    /// The word the People screen puts on the face.
+    pub fn label(&self) -> &'static str {
+        match self {
+            EyeState::Open => "Eyes open",
+            EyeState::Closed => "Eyes closed",
+            EyeState::Sunglasses => "Sunglasses",
+            EyeState::Unreadable => "Eyes unclear",
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn eye(open: f32) -> Eye {
+        Eye {
+            open,
+            px: 40.0,
+            sharpness: 0.1,
+        }
+    }
+
+    fn reading(right: f32, left: f32, sunglasses: f32) -> EyeReading {
+        EyeReading {
+            right: eye(right),
+            left: eye(left),
+            sunglasses,
+        }
+    }
+
+    #[test]
+    fn both_eyes_open_is_open() {
+        assert_eq!(reading(0.9, 0.8, 0.1).state(), EyeState::Open);
+        assert!(!reading(0.9, 0.8, 0.1).is_blink());
+    }
+
+    /// A wink is not "eyes open": one eye closed lands the same place a
+    /// blink does, and a filter for "nobody blinking" should drop it.
+    #[test]
+    fn one_eye_closed_is_closed() {
+        assert_eq!(reading(0.9, 0.2, 0.1).state(), EyeState::Closed);
+        assert_eq!(reading(0.2, 0.9, 0.1).state(), EyeState::Closed);
+        assert!(reading(0.2, 0.9, 0.1).is_blink());
+    }
+
+    /// The whole reason the sunglasses number exists: whatever the eye
+    /// classifier says over dark glass, it is not a reading of the eyes.
+    #[test]
+    fn sunglasses_override_the_eye_readings_either_way() {
+        assert_eq!(reading(0.9, 0.9, 0.8).state(), EyeState::Sunglasses);
+        assert_eq!(reading(0.1, 0.1, 0.8).state(), EyeState::Sunglasses);
+        assert!(!reading(0.1, 0.1, 0.8).is_blink());
+    }
+
+    /// A soft or tiny eye is not asked; if neither can be, the face is
+    /// unreadable rather than closed.
+    #[test]
+    fn a_soft_or_tiny_eye_is_not_read() {
+        let mut r = reading(0.1, 0.9, 0.0);
+        r.right.sharpness = MIN_EYE_SHARPNESS / 2.0;
+        assert_eq!(r.state(), EyeState::Open, "the soft closed eye is ignored");
+
+        let mut r = reading(0.1, 0.9, 0.0);
+        r.right.px = MIN_EYE_PX - 1.0;
+        assert_eq!(r.state(), EyeState::Open, "the tiny closed eye is ignored");
+
+        let mut r = reading(0.1, 0.1, 0.0);
+        r.right.sharpness = 0.0;
+        r.left.px = 3.0;
+        assert_eq!(r.state(), EyeState::Unreadable);
+        assert!(!r.is_blink());
+        assert_eq!(r.state().label(), "Eyes unclear");
+    }
+
+    /// A profile: the far eye's contour collapses, and the sliver is not
+    /// read. The near eye still decides.
+    #[test]
+    fn a_turned_heads_collapsed_far_eye_is_not_read() {
+        let mut r = reading(0.05, 0.95, 0.0);
+        r.right.px = 40.0 * HIDDEN_EYE_RATIO - 1.0;
+        assert!(!r.right.readable(&r.left));
+        assert_eq!(r.state(), EyeState::Open);
+
+        let mut blink = reading(0.95, 0.05, 0.0);
+        blink.right.px = 40.0 * HIDDEN_EYE_RATIO - 1.0;
+        assert_eq!(blink.state(), EyeState::Closed);
+
+        // Both eyes narrow but alike is not a turned head: both count.
+        let mut small = reading(0.05, 0.95, 0.0);
+        small.right.px = 14.0;
+        small.left.px = 14.0;
+        assert_eq!(small.state(), EyeState::Closed);
+    }
+
+    #[test]
+    fn the_thresholds_are_inclusive_at_the_decision_point() {
+        assert_eq!(
+            reading(EYES_OPEN_THRESHOLD, EYES_OPEN_THRESHOLD, 0.0).state(),
+            EyeState::Open
+        );
+        assert_eq!(
+            reading(1.0, 1.0, SUNGLASSES_THRESHOLD).state(),
+            EyeState::Sunglasses
+        );
+        let mut r = reading(1.0, 1.0, 0.0);
+        r.right.px = MIN_EYE_PX;
+        r.left.px = MIN_EYE_PX;
+        r.right.sharpness = MIN_EYE_SHARPNESS;
+        assert!(r.right.readable(&r.left));
+    }
+}

core/dr-face/src/landmarks.rs

@@ -0,0 +1,263 @@
+//! TRACES: FR-CULL-8a
+//! Dense facial landmarks — InsightFace's `2d106det` (docs/dev/faces.md §17.2).
+//!
+//! SCRFD's five points place a face; they do not place an eye. Its eye
+//! point is loose enough that a window centred on it left the eye in a
+//! corner on turned and smiling heads, and two model-free ways of
+//! re-centring it made things worse. So a second model draws the eye's lid
+//! contour, and the eye box is cut from that.
+//!
+//! **Why this one.** Three were measured on the same faces — MediaPipe Face
+//! Mesh V2, PIPNet and this — and tied on what the eye classifier made of
+//! their boxes (22 of 25 open eyes read open, against 19 from the SCRFD
+//! point). This is the cheapest of the three by a wide margin (5 MB, 106
+//! points, ~24 ms in tract), and it is under the grant the detector and
+//! embedder already carry rather than a new one to read.
+//!
+//! # Pre-processing
+//!
+//! Ported from InsightFace's `landmark.py`: a square crop centred on the
+//! detector box, 1.5× its longer edge, resized to 192; **RGB in 0..255**
+//! (the graph carries its own `bn_data` normalisation, so `input_mean` is
+//! 0 and `input_std` 1); 106 `(x, y)` in −1..1 mapped back through
+//! `(p + 1) · 96`. The graph's batch dimension is the literal `None` and
+//! is pinned to 1 by `tools/fix-face-model-shapes.sh`, like the embedder's.
+//!
+//! # The layout
+//!
+//! Checked by drawing the points on the reference faces rather than taken
+//! from a diagram: the subject's right eye (image-left) is points 33–42,
+//! the left 87–96, ten each round the lids.
+
+use ndarray::Array4;
+
+use crate::align::crop_box;
+use crate::{FaceError, Pixels};
+use dr_inference_engine::{Form, Model, Role};
+
+/// The graph's input edge, in pixels.
+pub const INPUT_EDGE: usize = 192;
+
+/// How many points the model returns.
+pub const POINTS: usize = 106;
+
+/// The crop's edge as a multiple of the detector box's longer edge.
+const CROP_SCALE: f32 = 1.5;
+
+/// The span of the frame, in long-edge units, the packed form covers: a
+/// quarter of the frame outside each edge.
+pub const PACKED_RANGE: (f32, f32) = (-0.25, 1.25);
+
+/// Bytes the packed form of one face's landmarks takes.
+pub const PACKED_BYTES: usize = POINTS * 4;
+
+/// Point indices of the subject's right eye's lid contour (image-left).
+pub const RIGHT_EYE: [usize; 10] = [33, 34, 35, 36, 37, 38, 39, 40, 41, 42];
+/// Point indices of the subject's left eye's lid contour (image-right).
+pub const LEFT_EYE: [usize; 10] = [87, 88, 89, 90, 91, 92, 93, 94, 95, 96];
+
+/// The 106 points of one face, in **source pixels**.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Landmarks {
+    pub points: [(f32, f32); POINTS],
+}
+
+impl Landmarks {
+    /// Storage form: `106 × (x, y)` as little-endian **`u16` fixed point**
+    /// over the frame, 424 bytes.
+    ///
+    /// Each coordinate is normalised by `long_edge` like the five points the
+    /// catalog already keeps, then mapped over [`PACKED_RANGE`] — a quarter
+    /// of the frame either side of it, because a landmark on a face at the
+    /// edge does land outside the image — onto 0..65535. That is 0.14 source
+    /// pixels on a 6000-pixel frame. `f16` would be the same size and worse:
+    /// its three significant figures near 1.0 are six pixels at that scale,
+    /// and the eye contour this is kept for is drawn to the pixel.
+    pub fn to_packed_bytes(&self, long_edge: f32) -> Vec<u8> {
+        let (lo, hi) = PACKED_RANGE;
+        let pack = |v: f32| -> [u8; 2] {
+            let t = ((v / long_edge - lo) / (hi - lo)).clamp(0.0, 1.0);
+            ((t * 65535.0).round() as u16).to_le_bytes()
+        };
+        let mut out = Vec::with_capacity(POINTS * 4);
+        for &(x, y) in &self.points {
+            out.extend_from_slice(&pack(x));
+            out.extend_from_slice(&pack(y));
+        }
+        out
+    }
+
+    /// [`Self::to_packed_bytes`] read back, into source pixels of a frame
+    /// with this `long_edge`. `None` for a blob of the wrong length.
+    pub fn from_packed_bytes(bytes: &[u8], long_edge: f32) -> Option<Self> {
+        if bytes.len() != POINTS * 4 {
+            return None;
+        }
+        let (lo, hi) = PACKED_RANGE;
+        let unpack = |b: &[u8]| -> f32 {
+            let t = u16::from_le_bytes([b[0], b[1]]) as f32 / 65535.0;
+            (t * (hi - lo) + lo) * long_edge
+        };
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            let at = i * 4;
+            *p = (unpack(&bytes[at..at + 2]), unpack(&bytes[at + 2..at + 4]));
+        }
+        Some(Self { points })
+    }
+
+    /// The lid contour of the subject's right eye.
+    pub fn right_eye(&self) -> [(f32, f32); 10] {
+        RIGHT_EYE.map(|i| self.points[i])
+    }
+
+    /// The lid contour of the subject's left eye.
+    pub fn left_eye(&self) -> [(f32, f32); 10] {
+        LEFT_EYE.map(|i| self.points[i])
+    }
+}
+
+/// A loaded `2d106det` graph.
+pub struct Landmarker {
+    session: Model,
+}
+
+impl Landmarker {
+    pub fn from_path(path: impl AsRef<std::path::Path>) -> Result<Self, FaceError> {
+        let bytes = std::fs::read(path).map_err(FaceError::ModelRead)?;
+        Self::from_bytes(&bytes)
+    }
+
+    pub fn from_bytes(bytes: &[u8]) -> Result<Self, FaceError> {
+        let model = dr_inference_engine::open(Role::Landmarks, Form::F32, bytes)?;
+        let acquired = model.acquire()?;
+        let session = acquired.lock();
+
+        let input = session.inputs().first().ok_or(FaceError::WrongModel {
+            expected: "2d106det",
+            detail: "model has no inputs".into(),
+        })?;
+        let shape: Option<Vec<i64>> = input.dtype().tensor_shape().map(|s| s.to_vec());
+        let want = [1, 3, INPUT_EDGE as i64, INPUT_EDGE as i64];
+        if shape.as_deref() != Some(&want[..]) {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!(
+                    "input '{}' is {:?}, expected {:?} (batch pinned to 1)",
+                    input.name(),
+                    shape,
+                    want
+                ),
+            });
+        }
+        let out = session.outputs().first().ok_or(FaceError::WrongModel {
+            expected: "2d106det",
+            detail: "model has no outputs".into(),
+        })?;
+        let last: Option<i64> = out.dtype().tensor_shape().and_then(|d| d.last().copied());
+        if last != Some((POINTS * 2) as i64) {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!(
+                    "output '{}' is {:?}-wide, expected {}",
+                    out.name(),
+                    last,
+                    POINTS * 2
+                ),
+            });
+        }
+        drop(session);
+        drop(acquired);
+        Ok(Self { session: model })
+    }
+
+    /// The landmarks of the face in `bbox` — `(x0, y0, x1, y1)` in source
+    /// pixels, the detector's box — read from the source.
+    ///
+    /// `None` for a box with no area or a buffer that is not the size it
+    /// claims, as every crop here.
+    pub fn landmarks(
+        &mut self,
+        px: Pixels<'_>,
+        width: usize,
+        height: usize,
+        bbox: (f32, f32, f32, f32),
+    ) -> Result<Option<Landmarks>, FaceError> {
+        let (w, h) = (bbox.2 - bbox.0, bbox.3 - bbox.1);
+        let side = w.max(h) * CROP_SCALE;
+        let (cx, cy) = ((bbox.0 + bbox.2) / 2.0, (bbox.1 + bbox.3) / 2.0);
+        let (x0, y0) = (cx - side / 2.0, cy - side / 2.0);
+        let Some(crop) = crop_box(
+            px,
+            width,
+            height,
+            (x0, y0, side, side),
+            INPUT_EDGE,
+            INPUT_EDGE,
+        ) else {
+            return Ok(None);
+        };
+
+        let e = INPUT_EDGE;
+        let mut input = Array4::<f32>::zeros((1, 3, e, e));
+        for y in 0..e {
+            for x in 0..e {
+                for c in 0..3 {
+                    input[[0, c, y, x]] = crop[(y * e + x) * 3 + c] * 255.0;
+                }
+            }
+        }
+        let acquired = self.session.acquire()?;
+        let mut session = acquired.lock();
+        let outputs = session
+            .run(ort::inputs![
+                ort::value::Tensor::from_array(input).map_err(FaceError::Inference)?
+            ])
+            .map_err(FaceError::Inference)?;
+        let (_, data) = outputs[0]
+            .try_extract_tensor::<f32>()
+            .map_err(FaceError::Inference)?;
+        if data.len() < POINTS * 2 {
+            return Err(FaceError::WrongModel {
+                expected: "2d106det",
+                detail: format!("got {} values, expected {}", data.len(), POINTS * 2),
+            });
+        }
+
+        // −1..1 in the crop → crop pixels → source pixels.
+        let scale = side / e as f32;
+        let half = e as f32 / 2.0;
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            let (u, v) = ((data[2 * i] + 1.0) * half, (data[2 * i + 1] + 1.0) * half);
+            *p = (x0 + u * scale, y0 + v * scale);
+        }
+        Ok(Some(Landmarks { points }))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Packed and unpacked, every point comes back within a fifth of a
+    /// source pixel on a 6000-pixel frame — including one outside the
+    /// image, which a face at the edge does produce.
+    #[test]
+    fn dense_landmarks_round_trip_through_their_packed_bytes() {
+        let mut points = [(0.0_f32, 0.0_f32); POINTS];
+        for (i, p) in points.iter_mut().enumerate() {
+            *p = (i as f32 * 37.3 - 200.0, 5900.0 - i as f32 * 11.1);
+        }
+        let lm = Landmarks { points };
+        let bytes = lm.to_packed_bytes(6000.0);
+        assert_eq!(bytes.len(), PACKED_BYTES);
+        assert_eq!(PACKED_BYTES, 424);
+        let back = Landmarks::from_packed_bytes(&bytes, 6000.0).unwrap();
+        for (a, b) in lm.points.iter().zip(back.points.iter()) {
+            assert!((a.0 - b.0).abs() < 0.2, "{} vs {}", a.0, b.0);
+            assert!((a.1 - b.1).abs() < 0.2, "{} vs {}", a.1, b.1);
+        }
+        assert!(Landmarks::from_packed_bytes(&bytes[..100], 6000.0).is_none());
+    }
+}

core/dr-face/src/lib.rs

@@ -0,0 +1,145 @@
+//! Faces and identity (S14, docs/dev/faces.md).
+//!
+//! Two models, run over the native render, producing per face a box, five
+//! landmarks, a confidence and a 512-d embedding (FR-CULL-8) — and then the
+//! arithmetic that turns embeddings into people (FR-CULL-9, FR-CULL-10). Two
+//! more, optional, read each face's eyes and whether sunglasses hide them
+//! (FR-CULL-8a, [`classify`] and [`eyes`]).
+//!
+//! Like `dr-segment`, this crate is **device-free**: no GPU adapter, no
+//! Slint, nothing that needs a display. Unlike `dr-segment`, it carries **no
+//! weights at all**, and the absence is deliberate — see [`the licence
+//! note`](#the-weights-are-not-in-this-repository) below.
+//!
+//! # The weights are not in this repository
+//!
+//! The models this crate is built for — SCRFD-500MF and ArcFace/MobileFaceNet
+//! — are InsightFace's, and their pretrained weights carry a **non-commercial
+//! research-only** grant. That is incompatible with GPL-3.0-or-later and with
+//! every channel DarkRoom ships through, so the weights cannot be committed
+//! here the way `dr-segment`'s can, and there is no `embedded-model` feature
+//! for a packaging script to switch on. The application obtains a model at
+//! runtime; this crate takes bytes and never fetches anything.
+//!
+//! docs/dev/faces.md §2 is the full reading, including what would have to change
+//! for that to stop being true. The eye-state models are the exception: MIT,
+//! weights and all, and shipped in `models/face/` (docs/dev/faces.md §17).
+//!
+//! # Why the runtime is split behind a feature
+//!
+//! [`calibrate`], [`cluster`] and [`assign`] are where this subsystem's accuracy
+//! actually lives, and all three are pure arithmetic over embeddings with no
+//! model in them.
+//! They build and test without `inference`, on synthetic embeddings, on a
+//! machine with no weights on it — which is what lets CI cover the part most
+//! likely to be subtly wrong.
+
+pub mod align;
+pub mod assign;
+pub mod calibrate;
+#[cfg(feature = "inference")]
+pub mod classify;
+pub mod cluster;
+#[cfg(feature = "inference")]
+pub mod detect;
+#[cfg(feature = "inference")]
+pub mod embed;
+pub mod embedding;
+pub mod eyes;
+#[cfg(feature = "inference")]
+pub mod landmarks;
+pub mod naming;
+pub mod neighbours;
+pub mod references;
+
+/// Smallest long edge a face crop may be sampled from.
+///
+/// **A floor on the crop source, not on the detector input.** The distinction
+/// is the whole of FR-CULL-8 and `docs/dev/faces.md` §7: detection letterboxes
+/// every buffer into 640×640, so its input resolution decides nothing, while
+/// [`warp`] samples the 112×112 the embedder sees and so converts source
+/// resolution directly into embedding quality. FR-CULL-8 requires that crop to
+/// come from the native render; this is the guard that catches a caller
+/// sampling from a proxy instead.
+///
+/// 1025 rather than 1024 because 1024 is exactly `dr_thumbs::ThumbSize::Large`,
+/// the stored proxy tier a caller is most likely to reach for by mistake, so
+/// the floor has to exclude it rather than admit it. Written as a minimum so
+/// the test is `edge < MIN_CROP_EDGE` with no boundary to get wrong.
+///
+/// It is a coarse guard and deliberately so: whether any *individual* crop was
+/// upsampled is answered exactly by `faces.crop_px` against [`ALIGNED_EDGE`],
+/// and that is the number §7b measures. This only stops a whole pass reading
+/// from the wrong tier.
+pub const MIN_CROP_EDGE: u32 = 1025;
+
+pub use align::{
+    crop_box, eye_box, eye_patch, head_views, warp, warp_pixels, Aligned112, EyePatch, HeadViews,
+    Pixels, Similarity, ALIGNED_EDGE, ARCFACE_TEMPLATE,
+};
+pub use assign::{identity_shares, RIVAL_FLOOR, TOP_MATCHES};
+pub use calibrate::{Calibration, Pairs, ReliabilityBand};
+#[cfg(feature = "inference")]
+pub use classify::{EyeClassifier, EyeModels, SunglassesClassifier};
+pub use cluster::{
+    cluster, cluster_scored, split, Candidate, Cluster, Grouping, DEFAULT_MERGE_PROBABILITY,
+};
+#[cfg(feature = "inference")]
+pub use detect::{DetectOptions, Detection, Detector};
+#[cfg(feature = "inference")]
+pub use embed::{Embedded, Embedder};
+pub use embedding::{
+    in_gallery, read_f16_bytes, Embedding, ModelId, EMBEDDING_DIM, MIN_GALLERY_QUALITY,
+};
+pub use eyes::{
+    Eye, EyeReading, EyeState, EYES_OPEN_THRESHOLD, HIDDEN_EYE_RATIO, MIN_EYE_PX,
+    MIN_EYE_SHARPNESS, SUNGLASSES_THRESHOLD,
+};
+#[cfg(feature = "inference")]
+pub use landmarks::{Landmarker, Landmarks};
+pub use naming::{name_for_instance, name_instances, NamedFace};
+
+/// What can go wrong between an image and a face.
+#[derive(Debug, thiserror::Error)]
+pub enum FaceError {
+    #[error("could not read model file: {0}")]
+    ModelRead(#[source] std::io::Error),
+
+    #[cfg(feature = "inference")]
+    #[error("inference failed: {0}")]
+    Inference(#[source] ort::Error),
+
+    /// The graph is not the one this decoder was written for.
+    ///
+    /// Worth a distinct variant rather than a generic failure: the models in
+    /// this space have interchangeable *shapes* and incompatible *layouts*
+    /// (a YuNet export also has twelve outputs), so the failure this catches
+    /// is not a crash but a page of plausible numbers.
+    #[error("model does not look like {expected}: {detail}")]
+    WrongModel {
+        expected: &'static str,
+        detail: String,
+    },
+
+    #[error("image buffer is {got} floats, expected {expected} (RGB, three per pixel)")]
+    ImageShape { expected: usize, got: usize },
+}
+
+#[cfg(feature = "inference")]
+impl From<dr_inference_engine::Error> for FaceError {
+    fn from(e: dr_inference_engine::Error) -> Self {
+        match e {
+            dr_inference_engine::Error::Inference(e) => FaceError::Inference(e),
+            dr_inference_engine::Error::Io(e) => FaceError::ModelRead(e),
+        }
+    }
+}
+
+/// Make sure `ort` has a backend, for the M1 probe example, which drives
+/// `ort` directly rather than through [`detect::Detector`] so it can report
+/// the raw error. Every other path goes through `dr-inference-engine`.
+#[cfg(feature = "inference")]
+#[doc(hidden)]
+pub fn install_backend_for_probe() {
+    dr_inference_engine::ensure_runtime();
+}

core/dr-face/src/naming.rs

@@ -0,0 +1,302 @@
+//! Naming a segmented person from the face inside it.
+//!
+//! `dr-segment` recognises *a person*; this crate recognises *which* person.
+//! Putting the two together costs one containment test and turns "person" in
+//! the mask list into "Anna" — which is the difference between a vocabulary of
+//! eighty COCO classes and a vocabulary that includes the user's family.
+//!
+//! Pure geometry: no model, no catalog, no Slint. The caller supplies boxes and
+//! names from wherever it keeps them.
+//!
+//! # Why containment and not overlap
+//!
+//! A face is a small part of the person it belongs to, and it is *inside* them.
+//! Intersection-over-union would be near zero for a correct match — the face is
+//! perhaps a twentieth of the person's area — so IoU is the wrong measure
+//! entirely here and would reject every true pairing.
+
+/// A face box with a name attached.
+#[derive(Debug, Clone, PartialEq)]
+pub struct NamedFace<'a> {
+    /// `(x0, y0, x1, y1)`, in the same space as the instance boxes.
+    pub bbox: (f32, f32, f32, f32),
+    pub name: &'a str,
+}
+
+/// How much of a face must lie inside an instance to belong to it.
+///
+/// Not 1.0: the detector's face box and the segmenter's person box come from
+/// different models and disagree at the edges, most visibly around hair and
+/// chin. A face 85% inside a person is that person's face.
+const MIN_CONTAINMENT: f32 = 0.7;
+
+/// The name to show for one segmented instance, if a face identifies it.
+///
+/// `None` leaves the instance labelled as the model found it. That is the right
+/// default in every uncertain case: a mask list saying "person" is merely
+/// unhelpful, where one saying "Anna" about her brother is wrong, and the user
+/// has no way to tell which they are looking at.
+///
+/// Where several named faces sit inside one instance — two people the segmenter
+/// merged into one blob — the largest face wins, on the grounds that it is the
+/// nearer subject and the one the box is mostly about. If two are within a
+/// whisker of each other the instance stays unnamed, because at that point the
+/// box genuinely covers two people and picking either is a coin toss.
+pub fn name_for_instance<'a>(
+    instance: (f32, f32, f32, f32),
+    faces: &[NamedFace<'a>],
+) -> Option<&'a str> {
+    let instance_area = area(instance);
+    if instance_area <= 0.0 {
+        return None;
+    }
+
+    let mut candidates: Vec<(f32, &'a str)> = faces
+        .iter()
+        .filter_map(|f| {
+            let fa = area(f.bbox);
+            if fa <= 0.0 {
+                return None;
+            }
+            let inside = intersection(instance, f.bbox);
+            if inside / fa < MIN_CONTAINMENT {
+                return None;
+            }
+            Some((fa, f.name))
+        })
+        .collect();
+
+    if candidates.is_empty() {
+        return None;
+    }
+    candidates.sort_by(|a, b| b.0.total_cmp(&a.0));
+
+    // Two comparably sized faces in one box: the segmenter has merged two
+    // people and there is no honest way to pick. Distinct names only — the
+    // same person detected twice (a mirror, a reflection) is not ambiguous.
+    if let [(first, a), (second, b), ..] = candidates.as_slice() {
+        if a != b && *second > *first * 0.8 {
+            return None;
+        }
+    }
+
+    Some(candidates[0].1)
+}
+
+/// Relabel a list of instances, in place, from the faces found in the image.
+///
+/// `is_person` decides which classes are eligible. Only person-like classes
+/// should be: a face inside a `tv` or a `laptop` is a photograph of someone on
+/// a screen, and renaming the television to "Anna" would be worse than leaving
+/// it alone.
+///
+/// Returns how many instances gained a name.
+pub fn name_instances<T>(
+    instances: &mut [T],
+    faces: &[NamedFace<'_>],
+    bbox_of: impl Fn(&T) -> (f32, f32, f32, f32),
+    is_person: impl Fn(&T) -> bool,
+    set_name: impl Fn(&mut T, &str),
+) -> usize {
+    let mut named = 0;
+    for inst in instances.iter_mut() {
+        if !is_person(inst) {
+            continue;
+        }
+        if let Some(name) = name_for_instance(bbox_of(inst), faces) {
+            let name = name.to_string();
+            set_name(inst, &name);
+            named += 1;
+        }
+    }
+    named
+}
+
+fn area(b: (f32, f32, f32, f32)) -> f32 {
+    ((b.2 - b.0).max(0.0)) * ((b.3 - b.1).max(0.0))
+}
+
+fn intersection(a: (f32, f32, f32, f32), b: (f32, f32, f32, f32)) -> f32 {
+    let w = (a.2.min(b.2) - a.0.max(b.0)).max(0.0);
+    let h = (a.3.min(b.3) - a.1.max(b.1)).max(0.0);
+    w * h
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A person filling most of a portrait, with their face near the top.
+    const PERSON: (f32, f32, f32, f32) = (100.0, 50.0, 400.0, 900.0);
+    const FACE: (f32, f32, f32, f32) = (200.0, 80.0, 300.0, 220.0);
+
+    fn named(bbox: (f32, f32, f32, f32), name: &str) -> NamedFace<'_> {
+        NamedFace { bbox, name }
+    }
+
+    #[test]
+    fn a_face_inside_a_person_names_them() {
+        let faces = [named(FACE, "Anna")];
+        assert_eq!(name_for_instance(PERSON, &faces), Some("Anna"));
+    }
+
+    #[test]
+    fn a_face_elsewhere_in_the_frame_names_nothing() {
+        let faces = [named((800.0, 80.0, 900.0, 220.0), "Anna")];
+        assert_eq!(name_for_instance(PERSON, &faces), None);
+    }
+
+    /// The measure has to be containment. A correct pairing has an IoU near
+    /// zero, so anything IoU-based would reject every true match.
+    #[test]
+    fn a_tiny_face_in_a_large_person_still_matches() {
+        let tall = (0.0, 0.0, 500.0, 2000.0);
+        let small = (240.0, 40.0, 280.0, 100.0);
+        assert_eq!(
+            name_for_instance(tall, &[named(small, "Anna")]),
+            Some("Anna")
+        );
+    }
+
+    #[test]
+    fn a_face_mostly_outside_the_person_is_not_theirs() {
+        // Overlapping the person's edge, but only just.
+        let straddling = (60.0, 80.0, 140.0, 220.0);
+        assert_eq!(
+            name_for_instance(PERSON, &[named(straddling, "Anna")]),
+            None
+        );
+    }
+
+    /// A tight portrait, where the segmenter's "person" is head and shoulders
+    /// and the face is most of it.
+    ///
+    /// This **is** named, and an earlier version of this module wrongly
+    /// refused to on the grounds that a face filling its instance meant the
+    /// two models disagreed. It does not: it means the photograph is a
+    /// close-up, which is the case where naming the region is most useful and
+    /// most certain. Left as a test because the reasoning is easy to get
+    /// backwards a second time.
+    #[test]
+    fn a_tight_portrait_is_named_rather_than_treated_as_suspicious() {
+        let head = (100.0, 50.0, 400.0, 400.0);
+        let face = (110.0, 60.0, 390.0, 390.0);
+        assert_eq!(
+            name_for_instance(head, &[named(face, "Anna")]),
+            Some("Anna")
+        );
+    }
+
+    /// A face box *larger* than the instance is a genuine disagreement, and
+    /// containment rejects it without needing a size rule: most of the face
+    /// lies outside the box it is supposed to belong to.
+    #[test]
+    fn a_face_larger_than_the_instance_does_not_name_it() {
+        let small_instance = (200.0, 200.0, 260.0, 260.0);
+        let huge_face = (100.0, 100.0, 500.0, 500.0);
+        assert_eq!(
+            name_for_instance(small_instance, &[named(huge_face, "Anna")]),
+            None
+        );
+    }
+
+    /// Two people merged into one blob: naming either would be a coin toss,
+    /// and a mask list saying "Anna" about her brother is worse than one
+    /// saying "person".
+    #[test]
+    fn two_comparable_faces_in_one_instance_leave_it_unnamed() {
+        let wide = (0.0, 0.0, 800.0, 900.0);
+        let faces = [
+            named((100.0, 80.0, 200.0, 220.0), "Anna"),
+            named((500.0, 85.0, 605.0, 230.0), "Bob"),
+        ];
+        assert_eq!(name_for_instance(wide, &faces), None);
+    }
+
+    /// But a clearly nearer subject wins: the box is mostly about them.
+    #[test]
+    fn a_much_larger_face_wins_over_someone_in_the_background() {
+        let wide = (0.0, 0.0, 800.0, 900.0);
+        let faces = [
+            named((100.0, 80.0, 300.0, 360.0), "Anna"),
+            named((600.0, 85.0, 640.0, 140.0), "distant"),
+        ];
+        assert_eq!(name_for_instance(wide, &faces), Some("Anna"));
+    }
+
+    /// The same person found twice — a mirror, a reflection — is not ambiguous
+    /// even though the two faces are comparable.
+    #[test]
+    fn the_same_name_twice_is_not_an_ambiguity() {
+        let wide = (0.0, 0.0, 800.0, 900.0);
+        let faces = [
+            named((100.0, 80.0, 200.0, 220.0), "Anna"),
+            named((500.0, 85.0, 605.0, 230.0), "Anna"),
+        ];
+        assert_eq!(name_for_instance(wide, &faces), Some("Anna"));
+    }
+
+    #[test]
+    fn degenerate_boxes_name_nothing_rather_than_panicking() {
+        assert_eq!(
+            name_for_instance((0.0, 0.0, 0.0, 0.0), &[named(FACE, "A")]),
+            None
+        );
+        assert_eq!(
+            name_for_instance(PERSON, &[named((5.0, 5.0, 5.0, 5.0), "A")]),
+            None
+        );
+        assert_eq!(name_for_instance(PERSON, &[]), None);
+    }
+
+    #[derive(Debug, PartialEq)]
+    struct Inst {
+        class: String,
+        bbox: (f32, f32, f32, f32),
+    }
+
+    #[test]
+    fn only_person_instances_are_renamed() {
+        let mut instances = vec![
+            Inst {
+                class: "person".into(),
+                bbox: PERSON,
+            },
+            // A face on a screen must not rename the television.
+            Inst {
+                class: "tv".into(),
+                bbox: PERSON,
+            },
+        ];
+        let faces = [named(FACE, "Anna")];
+
+        let n = name_instances(
+            &mut instances,
+            &faces,
+            |i| i.bbox,
+            |i| i.class == "person",
+            |i, name| i.class = name.to_string(),
+        );
+
+        assert_eq!(n, 1);
+        assert_eq!(instances[0].class, "Anna");
+        assert_eq!(instances[1].class, "tv");
+    }
+
+    #[test]
+    fn an_unrecognised_person_keeps_the_models_own_label() {
+        let mut instances = vec![Inst {
+            class: "person".into(),
+            bbox: PERSON,
+        }];
+        let n = name_instances(
+            &mut instances,
+            &[],
+            |i| i.bbox,
+            |i| i.class == "person",
+            |i, name| i.class = name.to_string(),
+        );
+        assert_eq!(n, 0);
+        assert_eq!(instances[0].class, "person");
+    }
+}

core/dr-face/src/neighbours.rs

@@ -0,0 +1,847 @@
+//! TRACES: FR-CULL-9 | FR-CULL-10
+//! Finding the face pairs that could possibly be the same person.
+//!
+//! [`crate::cluster`] used to begin by computing every pairwise cosine and
+//! holding the lot as an `n²` matrix of `f32`. At 1,800 faces that is 13 MB,
+//! which is why it survived; at 25,000 it is 2.5 GB, which is why it could not
+//! keep surviving.
+//!
+//! Almost all of that matrix is thrown away unread. Clustering only ever asks
+//! whether a pair is *above* the merge threshold, and in a real library the
+//! answer is no for well over 99% of pairs — the reference library's 1,813
+//! faces produced 7,875 qualifying pairs out of 1.6 million. So this module
+//! answers the only question that is actually asked — **which pairs clear the
+//! bar** — and returns that sparse list. Memory goes from `O(n²)` to `O(edges)`
+//! and the caller never has to hold a matrix at all.
+//!
+//! # Exact, not approximate
+//!
+//! The usual way to make this fast is an approximate nearest-neighbour index,
+//! which trades recall for speed: it *misses* some true neighbours, and a
+//! missed neighbour here is a face that silently never joins its person.
+//! Nothing surfaces that — the screen just quietly shows one person as two —
+//! so it is a poor trade for a feature whose whole job is to be trusted. This
+//! module is exact, and the clusters it produces are identical to those from a
+//! full scan.
+//!
+//! # An exact index was tried, measured, and removed
+//!
+//! Worth recording so it is not rediscovered as a good idea. The obvious exact
+//! index is IVF with a triangle-inequality bound: group the embeddings into
+//! cells, and skip a whole cell **pair** when the geometry proves no member of
+//! one can reach any member of the other. On the sphere,
+//!
+//! ```text
+//! angle(x, y) >= angle(c_P, c_Q) - radius(P) - radius(Q)
+//! ```
+//!
+//! so a cell pair is impossible when `cos` of that lower bound falls below the
+//! threshold. Exact, no recall loss, and it prunes beautifully on synthetic
+//! clusters.
+//!
+//! It prunes **nothing at all** on real face embeddings. Measured over the
+//! 1,813-face reference library, at √n = 43 cells:
+//!
+//! | quantity | measured |
+//! |---|---|
+//! | median pair angle | 88.5° (cosine 0.026) |
+//! | merge threshold | 66.2° (cosine 0.403) |
+//! | median cell radius | 80.4° |
+//! | median centroid separation | 85.0° |
+//! | cell pairs surviving the bound | **946 of 946 — 100%** |
+//!
+//! The arithmetic is not close. For the bound to exclude a typical cell pair it
+//! needs `radius(P) + radius(Q) < 85° - 66° = 19°`, so cells of radius under
+//! ~10°. But two photographs of the *same person* sit 36–60° apart, so even a
+//! perfect single-identity cell has a radius three times too large. No
+//! ball-based partition of this space can have cells tight enough for the
+//! inequality to bite — 512-d embeddings are near-orthogonal, and that is the
+//! curse of dimensionality doing exactly what it says.
+//!
+//! So the scan stayed exhaustive, and the effort went where it actually pays:
+//! not materialising the matrix, an unrolled dot product, and spreading the
+//! blocks across cores. That is `O(n²)` time and `O(edges)` memory, which for
+//! this problem is the honest answer.
+
+use crate::calibrate::Calibration;
+
+/// Rows of the similarity triangle handed to one thread at a time.
+///
+/// Small enough that the tail of the triangle divides evenly across cores —
+/// row `i` does `n - i` comparisons, so equal *row counts* are very unequal
+/// work — and large enough that the per-block overhead disappears.
+const BLOCK: usize = 64;
+
+/// Columns compared against one row block before moving on.
+///
+/// The other half of the tiling: 64 embeddings of 512 floats is 128 KB, which
+/// sits in L2 beside the row block instead of being re-read from memory for
+/// every row. See [`scan_rows`] for what it was worth.
+const COLUMN_TILE: usize = 64;
+
+/// Below this many faces, do the whole thing on the calling thread.
+///
+/// Spawning threads for a set this small costs more than the scan.
+const THREADS_ABOVE: usize = 2048;
+
+/// One face pair that clears the merge threshold.
+///
+/// `i < j` always, and the probability is carried because the caller would
+/// otherwise recompute the sigmoid it took a dot product to reach.
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub struct Pair {
+    pub i: usize,
+    pub j: usize,
+    pub probability: f32,
+}
+
+/// What the caller has to tell us about each face.
+///
+/// Deliberately not [`crate::cluster::Candidate`]: this module has no business
+/// knowing what a person or a photograph is, and taking the three arrays it
+/// actually reads keeps it testable on bare vectors.
+pub struct Faces<'a> {
+    /// Every embedding end to end, L2-normalised, [`Faces::dim`] floats each.
+    ///
+    /// **Flat, not a slice of vectors**, and the difference is measurable: a
+    /// `&[Vec<f32>]` is one heap allocation per face and the scan chases a
+    /// pointer per row, which defeats both the prefetcher and the tiling this
+    /// module does to stay in cache. One buffer is also the layout a GPU would
+    /// want, which is where this is eventually going.
+    pub embeddings: &'a [f32],
+    /// Floats per embedding — [`crate::EMBEDDING_DIM`] in practice, a parameter
+    /// so the tests can work in 64 dimensions.
+    pub dim: usize,
+    /// Source pixels across the aligned crop, for the calibration's size term.
+    pub crop_px: &'a [f32],
+    /// Which photograph each face came from. Two faces in one frame are not
+    /// the same person, so those pairs are never returned (docs/dev/faces.md §9).
+    pub images: &'a [u64],
+    /// Which faces may be compared *against* — the gallery
+    /// ([`crate::embedding::MIN_GALLERY_QUALITY`]).
+    ///
+    /// A pair needs at least one gallery side: a probe measured against a
+    /// reference is a comparison, two short vectors measured against each
+    /// other is noise agreeing with noise, and those pairs are never returned.
+    /// Filtered here rather than by the caller for the same reason
+    /// co-occurrence is: what this module leaves out of the list stays out of
+    /// the graph, the components and the merge order, so nothing downstream
+    /// has to remember the rule.
+    pub gallery: &'a [bool],
+}
+
+impl Faces<'_> {
+    /// How many faces there are.
+    pub fn len(&self) -> usize {
+        if self.dim == 0 {
+            0
+        } else {
+            self.embeddings.len() / self.dim
+        }
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    #[inline(always)]
+    fn row(&self, i: usize) -> &[f32] {
+        &self.embeddings[i * self.dim..(i + 1) * self.dim]
+    }
+}
+
+/// Every pair whose calibrated probability reaches `min_probability`.
+///
+/// Excludes pairs from the same photograph, which the clusterer would refuse
+/// anyway — dropping them here keeps them out of the graph the caller builds
+/// and out of the connected components it derives from it.
+///
+/// Ordered by `(i, j)`, which is what the caller's determinism rests on.
+pub fn above_threshold(faces: &Faces, cal: &Calibration, min_probability: f32) -> Vec<Pair> {
+    let n = faces.len();
+    if n < 2 {
+        return Vec::new();
+    }
+
+    // The loosest cosine that could clear the bar for *any* pair in the set.
+    // Cheaper than the sigmoid by far, and it rejects almost everything.
+    let scan = Scan {
+        faces,
+        cal,
+        min_probability,
+        tau: loosest_cosine(faces.crop_px, cal, min_probability),
+        dot: fastest_dot(),
+    };
+
+    let blocks: Vec<(usize, usize)> = (0..n)
+        .step_by(BLOCK)
+        .map(|start| (start, (start + BLOCK).min(n)))
+        .collect();
+
+    if n < THREADS_ABOVE {
+        let mut out = Vec::new();
+        for &(from, to) in &blocks {
+            scan_rows(&scan, from, to, &mut out);
+        }
+        return out;
+    }
+
+    // One worker per core bar one. This runs on a background thread behind a
+    // button the user pressed, and NFR-ARCH-2 puts it behind the UI: taking
+    // every core would stall the window it is reporting progress to.
+    let workers = std::thread::available_parallelism()
+        .map(|p| p.get().saturating_sub(1).max(1))
+        .unwrap_or(1)
+        .min(blocks.len());
+
+    let next = std::sync::atomic::AtomicUsize::new(0);
+    let mut parts: Vec<Vec<Vec<Pair>>> = std::thread::scope(|scope| {
+        let handles: Vec<_> = (0..workers)
+            .map(|_| {
+                let next = &next;
+                let blocks = &blocks;
+                scope.spawn(move || {
+                    // Results stay tagged with their block index, so the order
+                    // of the output does not depend on which thread got there
+                    // first. Determinism is a promise this module keeps.
+                    let mut mine: Vec<(usize, Vec<Pair>)> = Vec::new();
+                    loop {
+                        let b = next.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+                        let Some(&(from, to)) = blocks.get(b) else {
+                            break;
+                        };
+                        let mut out = Vec::new();
+                        scan_rows(&scan, from, to, &mut out);
+                        mine.push((b, out));
+                    }
+                    mine
+                })
+            })
+            .collect();
+
+        let mut slots: Vec<Vec<Vec<Pair>>> = vec![Vec::new(); blocks.len()];
+        for h in handles {
+            for (b, pairs) in h.join().unwrap_or_default() {
+                slots[b].push(pairs);
+            }
+        }
+        slots
+    });
+
+    let mut out = Vec::new();
+    for slot in &mut parts {
+        for pairs in slot.drain(..) {
+            out.extend(pairs);
+        }
+    }
+    out
+}
+
+/// Everything [`scan_rows`] needs that does not change between blocks.
+///
+/// A struct rather than eight arguments, and the grouping is real: these five
+/// are fixed for a whole scan and only the row range moves.
+#[derive(Clone, Copy)]
+struct Scan<'a> {
+    faces: &'a Faces<'a>,
+    cal: &'a Calibration,
+    min_probability: f32,
+    tau: f32,
+    dot: DotFn,
+}
+
+/// Compare rows `from..to` against everything after them.
+///
+/// The upper triangle, split by rows, and **tiled on the column side too**.
+/// Walking `j` from `i + 1` to `n` for one row at a time streams the whole
+/// embedding array past the core once per row — 336 GB of traffic for an
+/// 18,000-face library — where a column tile small enough to sit in L2 is read
+/// once per *tile* of rows. Measured on that library, the tiling alone took the
+/// scan from 4.64 s to 2.81 s before any change to the kernel.
+///
+/// Pairs come out ordered by `(i, j)`: the tiles are walked in ascending order
+/// but the row loop is inside them, so the block's own output is sorted before
+/// it is returned. Blocks are concatenated in row order, so the whole list is
+/// ordered — which is the promise the caller's determinism rests on.
+fn scan_rows(scan: &Scan, from: usize, to: usize, out: &mut Vec<Pair>) {
+    let Scan {
+        faces,
+        cal,
+        min_probability,
+        tau,
+        dot,
+    } = *scan;
+    let n = faces.len();
+    for tile in (from..n).step_by(COLUMN_TILE) {
+        let tile_end = (tile + COLUMN_TILE).min(n);
+        for i in from..to {
+            // The diagonal: nothing at or before `i` is this row's business.
+            let start = tile.max(i + 1);
+            if start >= tile_end {
+                continue;
+            }
+            let a = faces.row(i);
+            let crop_a = faces.crop_px[i];
+            let image_a = faces.images[i];
+            let gallery_a = faces.gallery[i];
+            for j in start..tile_end {
+                if image_a == faces.images[j] || !(gallery_a || faces.gallery[j]) {
+                    continue;
+                }
+                let cos = dot(a, faces.row(j));
+                // The cheap rejection, and it takes well over 99% of pairs.
+                if cos < tau {
+                    continue;
+                }
+                let probability = cal.probability(cos, crop_a.min(faces.crop_px[j]), 0.0);
+                if probability >= min_probability {
+                    out.push(Pair { i, j, probability });
+                }
+            }
+        }
+    }
+    out.sort_unstable_by_key(|p| (p.i, p.j));
+}
+
+/// The lowest cosine that could yield `min_probability` for any pair in the set.
+///
+/// The calibration is `sigmoid(a·cos + b + w_size·log2(crop))`, so for a fixed
+/// size term the cosine boundary is exact. The size term is *not* fixed — it
+/// varies per pair with the smaller of the two faces — so the safe bound uses
+/// whichever face size pushes the boundary lowest: the largest face when
+/// `w_size` is positive, the smallest when it is negative.
+///
+/// Returns [`f32::NEG_INFINITY`] — a filter that rejects nothing — where no
+/// boundary exists: a non-positive steepness, for which probability does not
+/// increase with cosine, or a threshold at the ends of the sigmoid. Those are
+/// degenerate calibrations rather than impossible ones, and the right response
+/// is to stop pruning, not to guess.
+fn loosest_cosine(crop_px: &[f32], cal: &Calibration, min_probability: f32) -> f32 {
+    if cal.a <= 0.0 || !(min_probability > 0.0 && min_probability < 1.0) {
+        return f32::NEG_INFINITY;
+    }
+
+    let (mut lo, mut hi) = (f32::INFINITY, 0.0_f32);
+    for &c in crop_px {
+        let c = c.max(1.0);
+        lo = lo.min(c);
+        hi = hi.max(c);
+    }
+    if !lo.is_finite() {
+        return f32::NEG_INFINITY;
+    }
+
+    let extreme = if cal.w_size >= 0.0 { hi } else { lo };
+    let tau = cal.boundary_at(min_probability, extreme, 0.0);
+    if tau.is_nan() {
+        return f32::NEG_INFINITY;
+    }
+    // Cosines never exceed 1, so a boundary above it legitimately rejects
+    // everything. Clamped rather than left free so the comparison stays cheap.
+    tau.min(1.0)
+}
+
+/// Cosine of two L2-normalised embeddings.
+///
+/// Eight accumulators rather than one. Floating-point addition is not
+/// associative, so the compiler may not re-associate a single running total and
+/// the loop serialises on the adder's latency; eight independent chains give it
+/// something to pipeline and vectorise. The order is fixed and identical on
+/// every run, which is what the caller's determinism needs — it is a different
+/// order from the naive sum, not a variable one.
+/// A dot product over two equal-length, L2-normalised rows.
+///
+/// Chosen once per scan rather than per pair — see [`fastest_dot`].
+pub(crate) type DotFn = fn(&[f32], &[f32]) -> f32;
+
+/// The widest dot product this machine can actually run.
+///
+/// # Why this is worth unsafe code
+///
+/// The scan is the arithmetic floor of the whole subsystem and it was running
+/// at **0.7 flops per cycle**. The workspace builds for baseline `x86-64`,
+/// which is SSE2 and no FMA, and the portable loop below was not being
+/// vectorised into even that. Measured over a real 18,143-face library, on
+/// twenty cores:
+///
+/// | kernel | scan | GFLOP/s |
+/// |---|---|---|
+/// | portable, untiled (what this replaced) | 4.64 s | 36 |
+/// | portable, tiled | 2.81 s | 60 |
+/// | **AVX2 + FMA, tiled** | **0.86 s** | **195 |
+///
+/// Identical pair lists — 1,531,969 — all three ways.
+///
+/// **Runtime detection on x86-64, unconditional on aarch64.** Advanced SIMD is
+/// in the aarch64 baseline, so every Android device that runs this has NEON and
+/// there is nothing to detect; on x86-64 AVX2 is not baseline and a binary that
+/// assumed it would not start on older hardware.
+///
+/// The three kernels sum in different orders, so a cosine may differ in its
+/// last bit between them. That only matters for a pair sitting exactly on the
+/// threshold, and the portable kernel already sums in eight accumulators rather
+/// than one, so the module was never bit-comparable with a naive sum.
+pub(crate) fn fastest_dot() -> DotFn {
+    #[cfg(target_arch = "x86_64")]
+    {
+        if std::arch::is_x86_feature_detected!("avx2") && std::arch::is_x86_feature_detected!("fma")
+        {
+            return dot_avx2;
+        }
+    }
+    #[cfg(target_arch = "aarch64")]
+    {
+        return dot_neon;
+    }
+    #[allow(unreachable_code)]
+    dot
+}
+
+/// Eight-wide fused multiply-add, on the half of desktops that have it.
+#[cfg(target_arch = "x86_64")]
+fn dot_avx2(a: &[f32], b: &[f32]) -> f32 {
+    // SAFETY: `fastest_dot` is the only thing that hands this out, and only
+    // after `is_x86_feature_detected!` has said both features are present.
+    unsafe { dot_avx2_inner(a, b) }
+}
+
+#[cfg(target_arch = "x86_64")]
+#[target_feature(enable = "avx2", enable = "fma")]
+unsafe fn dot_avx2_inner(a: &[f32], b: &[f32]) -> f32 {
+    use std::arch::x86_64::*;
+
+    let n = a.len().min(b.len());
+    let (mut acc0, mut acc1) = (_mm256_setzero_ps(), _mm256_setzero_ps());
+    let mut k = 0;
+    // Two accumulators, because one FMA cannot start until the previous one
+    // retires and the unit is pipelined several deep.
+    while k + 16 <= n {
+        // SAFETY: `k + 16 <= n`, and `n` is within both slices.
+        acc0 = _mm256_fmadd_ps(
+            _mm256_loadu_ps(a.as_ptr().add(k)),
+            _mm256_loadu_ps(b.as_ptr().add(k)),
+            acc0,
+        );
+        acc1 = _mm256_fmadd_ps(
+            _mm256_loadu_ps(a.as_ptr().add(k + 8)),
+            _mm256_loadu_ps(b.as_ptr().add(k + 8)),
+            acc1,
+        );
+        k += 16;
+    }
+
+    let mut lanes = [0.0_f32; 8];
+    _mm256_storeu_ps(lanes.as_mut_ptr(), _mm256_add_ps(acc0, acc1));
+    let mut total = ((lanes[0] + lanes[1]) + (lanes[2] + lanes[3]))
+        + ((lanes[4] + lanes[5]) + (lanes[6] + lanes[7]));
+    for k in k..n {
+        total += a[k] * b[k];
+    }
+    total
+}
+
+/// The same, four-wide, for the phone and the tablet.
+///
+/// No feature detection and no `target_feature`: Advanced SIMD is mandatory in
+/// the aarch64 baseline, so this compiles for every Android target the app
+/// builds for. The explicit `vfmaq` matters — LLVM will not fuse a multiply and
+/// an add on its own without fast-math, which is most of the win.
+#[cfg(target_arch = "aarch64")]
+fn dot_neon(a: &[f32], b: &[f32]) -> f32 {
+    use std::arch::aarch64::*;
+
+    let n = a.len().min(b.len());
+    // SAFETY: every load below is bounded by `k + 16 <= n`, and `n` is within
+    // both slices. NEON needs no feature detection on aarch64.
+    unsafe {
+        let mut acc = [vdupq_n_f32(0.0); 4];
+        let mut k = 0;
+        while k + 16 <= n {
+            for (l, slot) in acc.iter_mut().enumerate() {
+                *slot = vfmaq_f32(
+                    *slot,
+                    vld1q_f32(a.as_ptr().add(k + l * 4)),
+                    vld1q_f32(b.as_ptr().add(k + l * 4)),
+                );
+            }
+            k += 16;
+        }
+
+        let mut total = vaddvq_f32(vaddq_f32(
+            vaddq_f32(acc[0], acc[1]),
+            vaddq_f32(acc[2], acc[3]),
+        ));
+        for k in k..n {
+            total += a[k] * b[k];
+        }
+        total
+    }
+}
+
+/// The portable fallback, and the definition the others have to agree with.
+///
+/// Eight accumulators so the adds are independent; that is as much as can be
+/// asked of a loop that has to compile for anything.
+pub(crate) fn dot(a: &[f32], b: &[f32]) -> f32 {
+    const LANES: usize = 8;
+    let mut acc = [0.0_f32; LANES];
+    let n = a.len().min(b.len());
+    let chunks = n / LANES;
+
+    for c in 0..chunks {
+        let base = c * LANES;
+        for (l, slot) in acc.iter_mut().enumerate() {
+            *slot += a[base + l] * b[base + l];
+        }
+    }
+    let mut total =
+        ((acc[0] + acc[1]) + (acc[2] + acc[3])) + ((acc[4] + acc[5]) + (acc[6] + acc[7]));
+    for k in chunks * LANES..n {
+        total += a[k] * b[k];
+    }
+    total
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const DIM: usize = 64;
+
+    fn cal() -> Calibration {
+        Calibration {
+            a: 30.0,
+            b: -30.0 * 0.35,
+            w_size: 0.0,
+            valid: true,
+            positive_pairs: 1000,
+            negative_pairs: 10_000,
+        }
+    }
+
+    /// A unit vector in a reproducible pseudo-random direction.
+    ///
+    /// Hashed from the seed rather than drawn from an RNG, so a failure is
+    /// reproducible from the test alone.
+    fn vector(seed: u64) -> Vec<f32> {
+        let mut s = seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1;
+        let mut v = Vec::with_capacity(DIM);
+        for _ in 0..DIM {
+            s ^= s << 13;
+            s ^= s >> 7;
+            s ^= s << 17;
+            v.push(((s >> 11) as f64 / (1u64 << 53) as f64) as f32 - 0.5);
+        }
+        normalise(v)
+    }
+
+    fn normalise(mut v: Vec<f32>) -> Vec<f32> {
+        let n = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+        for x in &mut v {
+            *x /= n;
+        }
+        v
+    }
+
+    /// A vector a known cosine away from `base`.
+    fn near(base: &[f32], other: &[f32], cosine: f32) -> Vec<f32> {
+        let d = dot(base, other);
+        let mut perp: Vec<f32> = other.iter().zip(base).map(|(o, b)| o - d * b).collect();
+        let n = perp.iter().map(|x| x * x).sum::<f32>().sqrt();
+        for x in &mut perp {
+            *x /= n;
+        }
+        let s = (1.0 - cosine * cosine).max(0.0).sqrt();
+        normalise(
+            base.iter()
+                .zip(&perp)
+                .map(|(b, p)| cosine * b + s * p)
+                .collect(),
+        )
+    }
+
+    struct Set {
+        embeddings: Vec<f32>,
+        crop_px: Vec<f32>,
+        images: Vec<u64>,
+        gallery: Vec<bool>,
+    }
+
+    impl Set {
+        fn faces(&self) -> Faces<'_> {
+            Faces {
+                embeddings: &self.embeddings,
+                dim: DIM,
+                crop_px: &self.crop_px,
+                images: &self.images,
+                gallery: &self.gallery,
+            }
+        }
+
+        fn len(&self) -> usize {
+            self.embeddings.len() / DIM
+        }
+    }
+
+    /// `groups` identities, `per` faces each, every face in its own photograph.
+    fn population(groups: usize, per: usize, tightness: f32) -> Set {
+        let mut embeddings = Vec::new();
+        let mut images = Vec::new();
+        let mut image = 0u64;
+        for g in 0..groups {
+            let base = vector(g as u64 + 1);
+            let off = vector(g as u64 + 9_999);
+            for m in 0..per {
+                embeddings.push(if m == 0 {
+                    base.clone()
+                } else {
+                    near(&base, &off, tightness)
+                });
+                images.push(image);
+                image += 1;
+            }
+        }
+        let crop_px = vec![150.0; embeddings.len()];
+        let gallery = vec![true; embeddings.len()];
+        Set {
+            embeddings: embeddings.concat(),
+            crop_px,
+            images,
+            gallery,
+        }
+    }
+
+    /// The unpruned, unthreaded, unblocked definition of the answer.
+    fn reference(faces: &Faces, cal: &Calibration, min_probability: f32) -> Vec<Pair> {
+        let n = faces.len();
+        let mut out = Vec::new();
+        for i in 0..n {
+            for j in i + 1..n {
+                if faces.images[i] == faces.images[j] || !(faces.gallery[i] || faces.gallery[j]) {
+                    continue;
+                }
+                let cos: f32 = faces
+                    .row(i)
+                    .iter()
+                    .zip(faces.row(j))
+                    .map(|(x, y)| x * y)
+                    .sum();
+                let p = cal.probability(cos, faces.crop_px[i].min(faces.crop_px[j]), 0.0);
+                if p >= min_probability {
+                    out.push(Pair {
+                        i,
+                        j,
+                        probability: p,
+                    });
+                }
+            }
+        }
+        out
+    }
+
+    fn same_pairs(a: &[Pair], b: &[Pair]) -> bool {
+        a.len() == b.len() && a.iter().zip(b).all(|(x, y)| x.i == y.i && x.j == y.j)
+    }
+
+    /// The guard on the SIMD kernels, and the only check the aarch64 one gets
+    /// on a machine that is not aarch64: whatever [`fastest_dot`] picked has to
+    /// agree with the portable definition. A wrong lane index or a mishandled
+    /// tail would show up here as a wildly different number, not a rounding
+    /// difference.
+    #[test]
+    fn the_fastest_kernel_agrees_with_the_portable_one() {
+        let fast = fastest_dot();
+        for seed in 0..64u64 {
+            let a = vector(seed);
+            let b = vector(seed + 1_000);
+            let (want, got) = (dot(&a, &b), fast(&a, &b));
+            assert!(
+                (want - got).abs() < 1e-5,
+                "kernel disagreed on seed {seed}: {want} vs {got}"
+            );
+        }
+
+        // A length that is not a multiple of the widest step, so the tail is
+        // exercised rather than assumed away.
+        let a: Vec<f32> = (0..37).map(|k| k as f32 * 0.01).collect();
+        let b: Vec<f32> = (0..37).map(|k| 1.0 - k as f32 * 0.02).collect();
+        assert!((dot(&a, &b) - fast(&a, &b)).abs() < 1e-5, "tail mishandled");
+    }
+
+    #[test]
+    fn nothing_to_pair_is_no_pairs() {
+        let s = population(1, 1, 0.9);
+        assert!(above_threshold(&s.faces(), &cal(), 0.9).is_empty());
+    }
+
+    #[test]
+    fn the_blocked_scan_finds_exactly_what_the_reference_does() {
+        let s = population(60, 8, 0.97);
+        let f = s.faces();
+        let got = above_threshold(&f, &cal(), 0.9);
+        let want = reference(&f, &cal(), 0.9);
+        assert!(!want.is_empty(), "the reference found nothing to check");
+        assert!(same_pairs(&got, &want), "{} vs {}", got.len(), want.len());
+    }
+
+    /// Past `THREADS_ABOVE` the work is split across cores and stitched back
+    /// together, and the stitching is where an order bug would live.
+    #[test]
+    fn the_threaded_scan_finds_exactly_what_the_reference_does() {
+        let s = population(300, 8, 0.97);
+        assert!(
+            s.len() > THREADS_ABOVE,
+            "population is below the threading cutoff"
+        );
+        let f = s.faces();
+        let got = above_threshold(&f, &cal(), 0.9);
+        let want = reference(&f, &cal(), 0.9);
+        assert!(!want.is_empty());
+        assert!(same_pairs(&got, &want), "{} vs {}", got.len(), want.len());
+    }
+
+    /// The size term moves the cosine boundary per pair, so the pre-filter has
+    /// to be built from the most permissive size in the set or it will drop a
+    /// pair that would have qualified.
+    #[test]
+    fn a_size_weighted_calibration_still_matches_the_reference() {
+        let mut s = population(60, 8, 0.97);
+        for (i, c) in s.crop_px.iter_mut().enumerate() {
+            *c = 40.0 + (i % 17) as f32 * 30.0;
+        }
+        let sized = Calibration {
+            w_size: 0.5,
+            b: -30.0 * 0.35 - 0.5 * 7.0,
+            ..cal()
+        };
+        let f = s.faces();
+        assert!(same_pairs(
+            &above_threshold(&f, &sized, 0.9),
+            &reference(&f, &sized, 0.9)
+        ));
+    }
+
+    /// A negative size weight flips which extreme is permissive. Cheap to get
+    /// wrong and silent when it is, so it gets its own case.
+    #[test]
+    fn a_negative_size_weight_prunes_from_the_other_end() {
+        let mut s = population(60, 8, 0.97);
+        for (i, c) in s.crop_px.iter_mut().enumerate() {
+            *c = 40.0 + (i % 17) as f32 * 30.0;
+        }
+        let sized = Calibration {
+            w_size: -0.5,
+            b: -30.0 * 0.35 + 0.5 * 7.0,
+            ..cal()
+        };
+        let f = s.faces();
+        assert!(same_pairs(
+            &above_threshold(&f, &sized, 0.9),
+            &reference(&f, &sized, 0.9)
+        ));
+    }
+
+    /// A degenerate calibration has no cosine boundary to prune against, and
+    /// must stop pruning rather than prune on a bound that does not hold.
+    #[test]
+    fn a_flat_calibration_prunes_nothing_and_still_agrees() {
+        let flat = Calibration {
+            a: 0.0,
+            b: 4.0,
+            ..cal()
+        };
+        assert_eq!(loosest_cosine(&[150.0], &flat, 0.9), f32::NEG_INFINITY);
+        let s = population(20, 6, 0.97);
+        let f = s.faces();
+        assert!(same_pairs(
+            &above_threshold(&f, &flat, 0.9),
+            &reference(&f, &flat, 0.9)
+        ));
+    }
+
+    #[test]
+    fn two_faces_in_one_photograph_are_never_paired() {
+        let mut s = population(1, 2, 1.0);
+        s.images = vec![7, 7];
+        assert!(above_threshold(&s.faces(), &cal(), 0.9).is_empty());
+    }
+
+    /// A probe against a reference is a comparison; two probes against each
+    /// other is not. The rule lives here so that nothing downstream sees the
+    /// pair at all.
+    #[test]
+    fn two_faces_outside_the_gallery_are_never_paired() {
+        let mut s = population(1, 3, 1.0);
+        s.gallery = vec![false, false, true];
+        let pairs = above_threshold(&s.faces(), &cal(), 0.9);
+        assert!(
+            !pairs.iter().any(|p| p.i == 0 && p.j == 1),
+            "two probes were paired with each other"
+        );
+        // Each probe is still measured against the one reference.
+        assert!(pairs.iter().any(|p| p.i == 0 && p.j == 2));
+        assert!(pairs.iter().any(|p| p.i == 1 && p.j == 2));
+    }
+
+    #[test]
+    fn the_gallery_rule_matches_the_reference_at_scale() {
+        let mut s = population(60, 8, 0.97);
+        for (i, g) in s.gallery.iter_mut().enumerate() {
+            *g = i % 3 != 0;
+        }
+        let f = s.faces();
+        let got = above_threshold(&f, &cal(), 0.9);
+        let want = reference(&f, &cal(), 0.9);
+        assert!(same_pairs(&got, &want), "{} vs {}", got.len(), want.len());
+    }
+
+    #[test]
+    fn pairs_come_back_in_index_order() {
+        let s = population(300, 8, 0.97);
+        let pairs = above_threshold(&s.faces(), &cal(), 0.9);
+        assert!(pairs
+            .windows(2)
+            .all(|w| (w[0].i, w[0].j) < (w[1].i, w[1].j)));
+        assert!(pairs.iter().all(|p| p.i < p.j));
+    }
+
+    /// Threads must not make the answer depend on which one finished first.
+    #[test]
+    fn the_same_input_yields_the_same_pairs() {
+        let s = population(300, 8, 0.97);
+        assert_eq!(
+            above_threshold(&s.faces(), &cal(), 0.9),
+            above_threshold(&s.faces(), &cal(), 0.9)
+        );
+    }
+
+    /// The unrolled dot has to agree with the obvious one, tail included — the
+    /// lengths here are deliberately not multiples of the lane count.
+    #[test]
+    fn the_unrolled_dot_matches_the_naive_one() {
+        for len in [1usize, 7, 8, 9, 63, 64, 65, 512] {
+            let a: Vec<f32> = (0..len).map(|i| (i as f32 * 0.37).sin()).collect();
+            let b: Vec<f32> = (0..len).map(|i| (i as f32 * 0.11).cos()).collect();
+            let naive: f32 = a.iter().zip(&b).map(|(x, y)| x * y).sum();
+            assert!(
+                (dot(&a, &b) - naive).abs() < 1e-4,
+                "len {len}: {} vs {naive}",
+                dot(&a, &b)
+            );
+        }
+    }
+
+    /// The pre-filter is the whole speed story, so it is worth asserting it
+    /// actually rejects the bulk of the population rather than trusting it to.
+    #[test]
+    fn the_threshold_filter_rejects_almost_everything() {
+        let s = population(60, 8, 0.97);
+        let n = s.embeddings.len();
+        let total = n * (n - 1) / 2;
+        let kept = above_threshold(&s.faces(), &cal(), 0.9).len();
+        assert!(
+            kept * 20 < total,
+            "kept {kept} of {total} pairs, which is not sparse"
+        );
+    }
+}

core/dr-face/src/references.rs

@@ -0,0 +1,232 @@
+//! TRACES: FR-CULL-10 | NFR-P9
+//! Which of a person's faces stand for them in a grouping pass.
+//!
+//! # Why not all of them
+//!
+//! Every face the user has ruled on enters [`crate::cluster`] as an anchor,
+//! and the pass compares every face against every other
+//! ([`crate::neighbours`] is exhaustive by design). So a person with 750
+//! confirmed faces costs 750 comparisons against each of the library's other
+//! faces, and the cost of naming a library well grows with how well it is
+//! named: a fully confirmed library of 25,000 faces spends almost the whole
+//! scan re-comparing faces whose identity is already settled against each
+//! other.
+//!
+//! Most of those comparisons say nothing new. A person's confirmed faces are
+//! heavily redundant — thirty frames from one afternoon are one point of
+//! view, not thirty — and a new face that matches one of them matches the
+//! others too. What a new face needs to be measured against is the person's
+//! *range*: the angles, ages and lights they have been photographed in, each
+//! represented once.
+//!
+//! # The choice: the most diverse of the good ones
+//!
+//! Two rules, in order.
+//!
+//! **Good enough to vouch.** Only faces whose raw embedding was at least
+//! [`MIN_REFERENCE_QUALITY`] long are eligible — a stricter floor than the
+//! gallery's ([`crate::embedding::MIN_GALLERY_QUALITY`]), because a reference
+//! is asked to speak *for* a person rather than merely be admitted to the
+//! comparison. A face whose length was never recorded is admitted, as it is
+//! everywhere else: a rule that cannot be checked admits rather than excludes.
+//!
+//! **As far apart as possible.** From the eligible pool, up to
+//! [`MAX_REFERENCES`] faces are chosen to maximise the volume they span —
+//! the determinant of their Gram matrix — greedily: start from the longest
+//! vector, and at each step add the face with the largest component
+//! orthogonal to everything chosen so far. That is Gram–Schmidt with a
+//! pivot, and the product of the squared residuals it picks *is* the
+//! determinant, so the greedy step is the exact greedy on the objective.
+//! The effect is that a near-duplicate of a chosen face has almost no
+//! residual and is passed over, while the one profile shot among two
+//! hundred frontal frames is taken early.
+//!
+//! What is not chosen still belongs to the person. Those faces keep their
+//! confirmations and are not touched by the pass; they are simply not
+//! compared, which is the whole saving.
+
+/// The most faces that stand for one person.
+///
+/// A hundred is far more points of view than a person has. What it bounds
+/// is the cost: with every person at the cap, a scan against the named part
+/// of a library is `people × 100` comparisons per face rather than
+/// `confirmations`, and the two part company as soon as a library is used.
+pub const MAX_REFERENCES: usize = 100;
+
+/// The shortest raw embedding that may stand for a person.
+///
+/// One above the gallery floor: a reference vouches for someone, and the
+/// margin keeps the faces that only just cleared the gallery — the ones
+/// nearest the middle of the sphere — out of the set that speaks for a
+/// person.
+pub const MIN_REFERENCE_QUALITY: f32 = 15.0;
+
+/// Whether a face of this quality may stand for a person.
+///
+/// `None` is "never measured" and is admitted, as in
+/// [`crate::embedding::in_gallery`].
+pub fn eligible(quality: Option<f32>) -> bool {
+    quality.is_none_or(|q| q >= MIN_REFERENCE_QUALITY)
+}
+
+/// Choose which of one person's faces stand for them.
+///
+/// `embeddings` and `quality` are one entry per face, the embeddings unit
+/// length and all of one dimension. Returns the indices chosen, in the order
+/// chosen — the first is the longest eligible vector, and each after it is
+/// the one furthest from the span of those before. Every eligible face is
+/// returned when there are `max` or fewer of them, so a person under the
+/// cap loses nothing.
+///
+/// Deterministic: equal residuals break on the longer vector, then the lower
+/// index, so two devices holding the same faces choose the same references
+/// and group the same way (`cluster::clustering_is_deterministic`).
+pub fn select(embeddings: &[&[f32]], quality: &[Option<f32>], max: usize) -> Vec<usize> {
+    debug_assert_eq!(embeddings.len(), quality.len());
+    let mut pool: Vec<usize> = (0..embeddings.len())
+        .filter(|&i| eligible(quality[i]))
+        .collect();
+    if pool.len() <= max {
+        return pool;
+    }
+    // Longest first, so the seed is the pool's front and a tie on residual
+    // resolves to the earlier position. A missing reading ranks below any
+    // measured one for this purpose only: it is admitted, but a face that
+    // was measured and found long is the better seed.
+    pool.sort_by(|&a, &b| {
+        let qa = quality[a].unwrap_or(0.0);
+        let qb = quality[b].unwrap_or(0.0);
+        qb.total_cmp(&qa).then(a.cmp(&b))
+    });
+
+    // Residuals: what remains of each pool vector outside the span of the
+    // chosen ones. Copied, since they are rewritten in place.
+    let mut residual: Vec<Vec<f32>> = pool.iter().map(|&i| embeddings[i].to_vec()).collect();
+    let mut taken = vec![false; pool.len()];
+    let mut chosen = Vec::with_capacity(max);
+
+    while chosen.len() < max {
+        // The face with the most left outside the span. The seed is the
+        // pool's front by construction: every unit vector has the same
+        // residual before anything is chosen, up to rounding, and rounding
+        // is not a reason to prefer one. After that `> best` and not `>=`,
+        // so a genuine tie keeps the earlier (longer) candidate.
+        let mut pick = None;
+        let mut best = 0.0_f32;
+        if chosen.is_empty() {
+            pick = Some(0);
+            best = residual[0].iter().map(|x| x * x).sum();
+        } else {
+            for (k, r) in residual.iter().enumerate() {
+                if taken[k] {
+                    continue;
+                }
+                let n2: f32 = r.iter().map(|x| x * x).sum();
+                if n2 > best {
+                    best = n2;
+                    pick = Some(k);
+                }
+            }
+        }
+        // Nothing left outside the span: every remaining face is a
+        // combination of the chosen ones and adds no volume.
+        let Some(k) = pick.filter(|_| best > 1e-6) else {
+            break;
+        };
+        taken[k] = true;
+        chosen.push(pool[k]);
+
+        // Project the chosen direction out of every remaining residual.
+        let inv = best.sqrt().recip();
+        let q: Vec<f32> = residual[k].iter().map(|x| x * inv).collect();
+        for (j, r) in residual.iter_mut().enumerate() {
+            if taken[j] {
+                continue;
+            }
+            let d: f32 = r.iter().zip(&q).map(|(a, b)| a * b).sum();
+            for (x, y) in r.iter_mut().zip(&q) {
+                *x -= d * y;
+            }
+        }
+    }
+    chosen
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn unit(v: &[f32]) -> Vec<f32> {
+        let n = v.iter().map(|x| x * x).sum::<f32>().sqrt();
+        v.iter().map(|x| x / n).collect()
+    }
+
+    #[test]
+    fn a_person_under_the_cap_keeps_every_eligible_face() {
+        let e = [unit(&[1.0, 0.0]), unit(&[0.0, 1.0]), unit(&[1.0, 1.0])];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0), None, Some(16.0)];
+        assert_eq!(select(&refs, &q, 100), vec![0, 1, 2]);
+    }
+
+    #[test]
+    fn a_short_vector_never_stands_for_a_person() {
+        let e = [unit(&[1.0, 0.0]), unit(&[0.0, 1.0])];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0), Some(MIN_REFERENCE_QUALITY - 0.01)];
+        assert_eq!(select(&refs, &q, 100), vec![0]);
+    }
+
+    /// Two hundred frames from one afternoon and one profile shot: the
+    /// profile is the second choice, not the two-hundred-and-first.
+    #[test]
+    fn the_odd_one_out_is_chosen_before_any_duplicate() {
+        let mut e: Vec<Vec<f32>> = Vec::new();
+        let mut q = Vec::new();
+        for i in 0..200 {
+            // Near-duplicates of one direction, with a little noise.
+            let t = (i as f32) * 1e-3;
+            e.push(unit(&[1.0, t, t * 0.5]));
+            q.push(Some(20.0 + (i % 7) as f32));
+        }
+        e.push(unit(&[0.0, 0.0, 1.0]));
+        q.push(Some(16.0));
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let chosen = select(&refs, &q, 3);
+        assert_eq!(chosen.len(), 3);
+        assert_eq!(
+            chosen[1], 200,
+            "the profile shot was not second: {chosen:?}"
+        );
+        // Seeded on the longest vector.
+        assert_eq!(q[chosen[0]], Some(26.0));
+    }
+
+    /// Faces inside the span of the chosen ones add no volume and are not
+    /// taken to fill the cap.
+    #[test]
+    fn the_cap_is_not_filled_from_inside_the_span() {
+        let e = [
+            unit(&[1.0, 0.0]),
+            unit(&[0.0, 1.0]),
+            unit(&[1.0, 1.0]),
+            unit(&[2.0, -1.0]),
+        ];
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = [Some(20.0); 4];
+        assert_eq!(select(&refs, &q, 3).len(), 2);
+    }
+
+    #[test]
+    fn the_choice_is_deterministic() {
+        let e: Vec<Vec<f32>> = (0..50)
+            .map(|i| {
+                let a = (i as f32) * 0.37;
+                unit(&[a.cos(), a.sin(), (a * 3.0).sin(), 0.2])
+            })
+            .collect();
+        let refs: Vec<&[f32]> = e.iter().map(Vec::as_slice).collect();
+        let q = vec![Some(18.0); 50];
+        assert_eq!(select(&refs, &q, 5), select(&refs, &q, 5));
+    }
+}

core/dr-film/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "dr-film"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+
+# Isolated from dr-pipeline for the same reason dr-lens is: that crate has no
+# dependencies so its codegen stays testable without a device (ARCH §6.5a), and
+# a YAML parser plus the stock profiles do not belong in it. The pipeline
+# consumes the baked tables this crate produces and never links the profiles.
+#
+# No wgpu dependency either, deliberately. What comes out of here is plain
+# `f32` data with a documented layout; deciding it is a 3D texture is dr-gpu's
+# job, and keeping that decision out of here is what lets the whole spectral
+# model be tested on the CPU.
+[dependencies]
+log.workspace = true
+serde.workspace = true
+serde_norway.workspace = true

core/dr-film/README.md

@@ -0,0 +1,76 @@
+# Film stocks
+
+One file per stock in [`profiles/`](profiles/). Adding a stock is adding a
+file — no code change, no shader, no new operation — for the same reason
+`dr-decode`'s base curves work that way: under the GPLv3 a stock should be
+contributable without a release.
+
+## What a profile is
+
+Three measured tables, all of them published in the manufacturer's datasheet:
+
+| Field | What it decides |
+|---|---|
+| `log_sensitivity` | what each emulsion layer *sees*, per wavelength |
+| `density_curves` | contrast, latitude, and where the stock clips |
+| `dye_density` | what the developed stock *looks* like, per wavelength |
+| `base_density` | the support: film base, and a colour negative's orange mask |
+
+Plus `kind` (negative or positive), `support` (film or paper), and the two
+illuminants the data is referenced to. A print paper is a stock like any
+other; `support` exists so an interface can offer papers separately, not
+because the renderer treats them differently.
+
+## Why it is not a LUT
+
+Because the parameters stay physical. Opening up a stop moves the picture along
+the film's own characteristic curve — toe, shoulder and all — instead of
+scaling a number somebody baked at one exposure. A scanned negative comes out
+orange and inverted because that is what a negative *is*, and it becomes a
+photograph when a paper profile prints it, exactly as it would in a darkroom.
+
+The data cost runs the other way from a LUT collection too: a stock is about
+17 kB of measurements, where one HaldCLUT is roughly 800 kB of one person's
+grade.
+
+## How it runs
+
+The spectral chain reduces to three tables, and the reduction is exact where it
+matters — see [`src/bake.rs`](src/bake.rs) for the argument:
+
+1. **A 3×3 matrix**, linear sRGB to the three layers' exposure. Exact, not an
+   approximation: the reconstructed scene spectrum is linear in the sRGB
+   triple, so the integral collapses into nine numbers.
+2. **Three 1D curves**, log exposure to density, sampled at 256 points.
+3. **One 32³ lookup**, density to linear sRGB — dye absorption, the print
+   through the negative, the paper, the viewing illuminant and the chromatic
+   adaptation, all of which take exactly three numbers in.
+
+Per pixel that is a matrix multiply, three curve taps and one texture fetch.
+Splitting 2 from 3, rather than baking one LUT over exposure, is measured
+rather than assumed: the curve carries all the sharp shape and the dye mixing
+is smooth, so folding the curve into the 3D lookup would need it three times
+larger for the same error. At 32³ the worst interpolation error is about 0.003
+in linear sRGB, below one 8-bit code value, and there is a test that says so.
+
+## Adding a stock
+
+If spektrafilm has it, add its name to `STOCKS` in
+[`tools/film-profiles/convert.py`](../../tools/film-profiles/convert.py) and
+re-run it. Otherwise write the YAML by hand from the datasheet; the loader
+validates the table lengths and says which file and field is wrong.
+
+Either way, list it in `BUILT_IN` in [`src/lib.rs`](src/lib.rs) to compile it
+in — or drop it in the profile directory at runtime, which is the path meant
+for stocks that ship separately from the binary.
+
+## Provenance
+
+The shipped profiles are converted from
+[spektrafilm](https://github.com/andreavolpato/spektrafilm) by Andrea Volpato,
+licensed CC BY-SA 4.0. See [`profiles/LICENSE-PROFILES.txt`](profiles/LICENSE-PROFILES.txt)
+for the licence and [`profiles/CHANGELOG.txt`](profiles/CHANGELOG.txt) for what
+the conversion changed and what it deliberately did not.
+
+The sRGB reflectance basis is Mallett & Yuksel (2019); the observer is the CIE
+1931 2°.

core/dr-film/profiles/CHANGELOG.txt

@@ -0,0 +1,74 @@
+Changes made to the spektrafilm profiles shipped in this directory
+=================================================================
+
+The profiles here are derived from spektrafilm by Andrea Volpato
+(https://github.com/andreavolpato/spektrafilm), licensed CC BY-SA 4.0. The
+full licence is in LICENSE-PROFILES.txt and is reproduced unchanged.
+
+CC BY-SA 4.0 section 3(a)(1)(B) requires that a modified copy say it was
+modified. It was. This file says how, and tools/film-profiles/convert.py
+performs the modification, so it can be re-run against upstream and the result
+compared rather than taken on trust.
+
+
+What was changed
+----------------
+
+1. Format. Upstream ships JSON; these are YAML, so that adding or correcting a
+   stock is editing a legible file rather than a minified one. No value is
+   altered by the reformat.
+
+2. Trimmed to the fields this renderer reads:
+
+     kept     info.*, data.wavelengths (implicitly, as the fixed grid),
+              data.log_sensitivity, data.channel_density (renamed
+              dye_density), data.base_density, data.log_exposure (kept as its
+              two endpoints, since it is uniformly sampled),
+              data.density_curves
+
+     dropped  data.density_curves_model      - a 3-CDF fit of the curves; the
+                                               sampled curves are shipped
+                                               instead, and reproduce it to
+                                               0.004 density
+              data.density_curves_layers     - per-sublayer curves, used for
+                                               grain, which is not implemented
+                                               yet. Worth restoring when it is:
+                                               real grain is per sublayer.
+              data.hanatos2025_adaptation_*  - parameters for a spectral
+                                               upsampling method this renderer
+                                               does not use; see below
+              data.midscale_neutral_density  - null in every profile shipped
+
+   Dropping fields loses nothing for the stocks shipped, but it does mean a
+   re-run of the converter is needed to pick up an upstream field later.
+
+3. Numbers are written at 6 significant figures (5 for the density curves).
+   The inputs are digitised datasheet curves, so this is well inside their
+   measurement error; it is what takes a profile from 207 kB to 17 kB.
+
+4. Nulls made explicit. Upstream uses null where a datasheet has no reading.
+   In log_sensitivity that means the layer is blind there, written here as the
+   sentinel -9; in the density tables it means no absorption, written as 0.
+
+
+What was NOT changed
+--------------------
+
+No measured value has been rescaled, shifted, smoothed or refitted. The
+renderer's own calibration conventions - mid-grey at 0.184, exposure
+normalised on the green layer - are taken from spektrafilm's reference
+implementation rather than invented, because the profile data is calibrated
+against them.
+
+
+Known deviation from upstream's rendering
+-----------------------------------------
+
+Upstream reconstructs a spectrum from an RGB triple with Hanatos (2025), which
+needs a 4 MB coefficient table. This renderer uses the Mallett & Yuksel (2019)
+sRGB basis instead, which is three curves and about 1 kB, at some cost in how
+faithfully very saturated and out-of-gamut colours are handled. The
+hanatos2025_adaptation_* parameters in the upstream profiles are therefore
+unused here. This is a deliberate trade of accuracy at the gamut edge against
+shipping four megabytes, and it is the first thing to revisit if saturated
+colours look wrong.

core/dr-film/profiles/LICENSE-PROFILES.txt

@@ -0,0 +1,520 @@
+================================================================================
+        License for spektrafilm profiles, LUTs, and direct derivatives
+                          by Andrea Volpato
+            License: CC BY-SA 4.0 | Preamble v1.1 (2026-05-28)
+================================================================================
+
+
+This license applies to the original spektrafilm profiles that can be found at
+https://github.com/andreavolpato/spektrafilm, in the subfolder
+src/spektrafilm/data/profiles, and to all direct derivatives of the profiles,
+such as copies in other projects, LUTs, or any other format that encodes the
+same content.
+
+LUTs and similar artifacts are interpreted as direct encodings of the
+information in the original profiles. I chose not to release them under GPLv3
+because GPL's software-shaped "derivative work" model fits LUTs poorly and would
+have made adoption more difficult. CC BY-SA 4.0 preserves the same share-alike
+spirit in a form that matches how creative-grading assets are actually handled.
+
+Please do not modify this file. Changes to profiles and LUTs should be tracked
+in a separate CHANGELOG.txt file shipped with them. A copy of this license is
+available at:
+https://github.com/andreavolpato/spektrafilm/blob/main/SPEKTRAFILM_LICENSE.txt
+
+---
+
+A note before the legal text.
+
+spektrafilm is a film-emulation project, designed in the open, given away
+freely, and made to stay that way. Use it on anything. Share it widely. Build
+on it. The works you make are yours, completely.
+
+What follows is the full text of the Creative Commons Attribution-ShareAlike
+4.0 International Public License (CC BY-SA 4.0). It is the legal floor. The
+spirit it exists to protect, in three lines:
+
+  - Free use forever, on any production, of any size.
+  - Full credit to the source, on every copy and every derivative.
+  - No parasitism.
+
+
+--------------------------------------------------------------------------------
+WHAT YOU CAN DO
+--------------------------------------------------------------------------------
+
+Use these profiles and LUTs freely to grade anything - personal, educational,
+or commercial; small project or feature film; any platform, any deliverable.
+The works you make are yours. No royalties. No copyleft on your finished film
+or photograph. No obligation flowing to your distributor, broadcaster, or
+audience.
+
+Share the files freely with friends, collaborators, vendors, and post houses.
+
+Modify, remix, regrade, recombine. Modified profiles or LUTs must stay
+CC BY-SA 4.0 and credit spektrafilm.
+
+
+--------------------------------------------------------------------------------
+ATTRIBUTION - ALWAYS, EVERYWHERE, FOREVER
+--------------------------------------------------------------------------------
+
+Every copy, redistribution, modification, or derivative of these files - in
+any format, in any context, across any chain of hands - must preserve:
+
+  - Andrea Volpato, named as the original author.
+  - https://github.com/andreavolpato/spektrafilm, as the canonical source.
+  - The CC BY-SA 4.0 license notice (this file, or a link to it).
+  - A note that the file has been modified, if it has, and by whom.
+
+This applies whether the LUT is shipped inside a .cube header, an ICC profile
+field, an app's About screen, a paid plugin, a derived .3dl, training-data
+documentation, or anywhere else. The form can vary; the information cannot
+disappear.
+
+Removing or hiding this information ends the license grant immediately
+(CC BY-SA 4.0, Section 6(a)).
+
+
+--------------------------------------------------------------------------------
+SUGGESTED ATTRIBUTION TEXT
+--------------------------------------------------------------------------------
+
+For unmodified files:
+
+    spektrafilm by Andrea Volpato
+    https://github.com/andreavolpato/spektrafilm
+    Licensed CC BY-SA 4.0
+
+For modified files:
+
+    Derived from spektrafilm by Andrea Volpato
+    https://github.com/andreavolpato/spektrafilm
+    Licensed CC BY-SA 4.0
+    Modified by [your name].
+
+
+--------------------------------------------------------------------------------
+WHAT I ASK, BEYOND THE LEGAL FLOOR
+--------------------------------------------------------------------------------
+
+These are not legal requirements. They are the spirit of the project, stated
+plainly, so nobody has to guess.
+
+  - Keep this file unchanged when sharing profiles/LUTs, and if changes were
+    made describe them in a file CHANGELOG.txt shipped together with this
+    license.
+
+  - Credit spektrafilm in the human layer too - project docs, about pages,
+    credits, breakdowns. Not required on a finished film or photograph, but
+    appreciated wherever it's natural.
+
+  - Don't use "spektrafilm" or my name in product branding without asking.
+    The license covers the files; the name is not part of that grant.
+    Factual reference is welcome and even encouraged, for example "graded with
+    spektrafilm", or "this app uses spektrafilm LUTs".
+
+  - Paid apps and tools that add real value are welcome. Charge for what you
+    built - UI, performance, support, a service. Please don't repackage the
+    LUTs themselves as a paid LUT pack: CC BY-SA technically allows it, but
+    that's not the spirit of the project, and any buyer can legally
+    redistribute for free anyway.
+
+  - Please don't train commercial AI models on the LUTs or their outputs.
+    CC BY-SA doesn't forbid this, but it is asked. Models that approximate
+    or replace the spektrafilm look defeat the purpose of giving these away
+    freely. Non-commercial research training is fine.
+
+
+--------------------------------------------------------------------------------
+CONTACT
+--------------------------------------------------------------------------------
+
+GitHub Issues or Discussions on the spektrafilm repository.
+
+For private inquiries about commercial licensing, name use, or custom work,
+write to andrea.volpato@outlook.com.
+
+
+--------------------------------------------------------------------------------
+A small thank you
+--------------------------------------------------------------------------------
+
+If spektrafilm finds its way into your work, that is already the reward. If
+you want to credit it generously, share what you made, or just say hi, please do
+not hesitate. Make beautiful images.
+
+                                                              Andrea Volpato
+
+
+================================================================================
+END OF SPEKTRAFILM PREAMBLE  -  BEGIN CC BY-SA 4.0 LICENSE TEXT (verbatim)
+================================================================================
+
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution-ShareAlike 4.0 International Public License ("Public
+License"). To the extent this Public License may be interpreted as a
+contract, You are granted the Licensed Rights in consideration of Your
+acceptance of these terms and conditions, and the Licensor grants You
+such rights in consideration of benefits the Licensor receives from
+making the Licensed Material available under these terms and
+conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. BY-SA Compatible License means a license listed at
+     creativecommons.org/compatiblelicenses, approved by Creative
+     Commons as essentially the equivalent of this Public License.
+
+  d. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  e. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  f. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  g. License Elements means the license attributes listed in the name
+     of a Creative Commons Public License. The License Elements of this
+     Public License are Attribution and ShareAlike.
+
+  h. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  i. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  j. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  k. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  l. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  m. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. Additional offer from the Licensor -- Adapted Material.
+               Every recipient of Adapted Material from You
+               automatically receives an offer from the Licensor to
+               exercise the Licensed Rights in the Adapted Material
+               under the conditions of the Adapter's License You apply.
+
+            c. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+  b. ShareAlike.
+
+     In addition to the conditions in Section 3(a), if You Share
+     Adapted Material You produce, the following conditions also apply.
+
+       1. The Adapter's License You apply must be a Creative Commons
+          license with the same License Elements, this version or
+          later, or a BY-SA Compatible License.
+
+       2. You must include the text of, or the URI or hyperlink to, the
+          Adapter's License You apply. You may satisfy this condition
+          in any reasonable manner based on the medium, means, and
+          context in which You Share Adapted Material.
+
+       3. You may not offer or impose any additional or different terms
+          or conditions on, or apply any Effective Technological
+          Measures to, Adapted Material that restrict exercise of the
+          rights granted under the Adapter's License You apply.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material,
+     including for purposes of Section 3(b); and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public licenses. Notwithstanding,
+Creative Commons may elect to apply one of its public licenses to material it
+publishes and in those instances will be considered the "Licensor." The text
+of the Creative Commons public licenses is dedicated to the public domain
+under the CC0 Public Domain Dedication. Except for the limited purpose of
+indicating that material is shared under a Creative Commons public license or
+as otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the use of
+the trademark "Creative Commons" or any other trademark or logo of Creative
+Commons without its prior written consent including, without limitation, in
+connection with any unauthorized modifications to any of its public licenses
+or any other arrangements, understandings, or agreements concerning use of
+licensed material. For the avoidance of doubt, this paragraph does not form
+part of the public licenses.
+
+Creative Commons may be contacted at creativecommons.org.

core/dr-film/profiles/fujifilm_c200.yaml

@@ -0,0 +1,453 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_c200
+name: 'Fujifilm C200'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+target_print: fujifilm_crystal_archive_typeii
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-4.49474, -3.7984, -0.780095]   # 380nm
+  - [-4.46591, -3.72613, -0.760927]   # 385nm
+  - [-4.43605, -3.65042, -0.740093]   # 390nm
+  - [-4.40511, -3.57101, -0.717364]   # 395nm
+  - [-4.37302, -3.48763, -0.692471]   # 400nm
+  - [-4.33971, -3.39998, -0.665089]   # 405nm
+  - [-4.30513, -3.30772, -0.636688]   # 410nm
+  - [-4.26919, -3.21047, -0.612675]   # 415nm
+  - [-4.23182, -3.10781, -0.596383]   # 420nm
+  - [-4.19291, -2.99929, -0.585538]   # 425nm
+  - [-4.15239, -2.88438, -0.579499]   # 430nm
+  - [-4.11014, -2.76251, -0.574724]   # 435nm
+  - [-4.06606, -2.63303, -0.57049]   # 440nm
+  - [-4.02002, -2.49519, -0.566659]   # 445nm
+  - [-3.97188, -2.34816, -0.557936]   # 450nm
+  - [-3.92151, -2.19099, -0.534054]   # 455nm
+  - [-3.86873, -2.0226, -0.494042]   # 460nm
+  - [-3.81338, -1.84173, -0.427312]   # 465nm
+  - [-3.75527, -1.65616, -0.379735]   # 470nm
+  - [-3.69417, -1.50853, -0.388078]   # 475nm
+  - [-3.62986, -1.3774, -0.454728]   # 480nm
+  - [-3.56207, -1.25803, -0.607564]   # 485nm
+  - [-3.49052, -1.14821, -0.848656]   # 490nm
+  - [-3.41488, -1.04849, -1.26772]   # 495nm
+  - [-3.33478, -0.975971, -1.66208]   # 500nm
+  - [-3.24984, -0.915464, -1.89074]   # 505nm
+  - [-3.15958, -0.861407, -2.21173]   # 510nm
+  - [-3.0635, -0.815729, -2.50355]   # 515nm
+  - [-2.96102, -0.766704, -2.76998]   # 520nm
+  - [-2.85147, -0.694583, -3.01422]   # 525nm
+  - [-2.73409, -0.610862, -3.23892]   # 530nm
+  - [-2.60802, -0.529292, -3.44633]   # 535nm
+  - [-2.47225, -0.455318, -3.63837]   # 540nm
+  - [-2.32562, -0.394037, -3.8167]   # 545nm
+  - [-2.16677, -0.343176, -3.98274]   # 550nm
+  - [-1.99411, -0.310025, -4.1377]   # 555nm
+  - [-1.80575, -0.302322, -4.28266]   # 560nm
+  - [-1.59945, -0.319278, -4.41857]   # 565nm
+  - [-1.37253, -0.385972, -4.54624]   # 570nm
+  - [-1.13632, -0.587991, -4.66639]   # 575nm
+  - [-0.945888, -0.921803, -4.77969]   # 580nm
+  - [-0.779331, -1.34203, -4.88668]   # 585nm
+  - [-0.665018, -1.78008, -4.9879]   # 590nm
+  - [-0.566605, -1.98531, -5.08379]   # 595nm
+  - [-0.492681, -2.04868, -5.17476]   # 600nm
+  - [-0.440289, -2.27014, -5.26118]   # 605nm
+  - [-0.411973, -2.47632, -5.34338]   # 610nm
+  - [-0.398393, -2.66876, -5.42167]   # 615nm
+  - [-0.387004, -2.84879, -5.49632]   # 620nm
+  - [-0.376404, -3.01756, -5.56758]   # 625nm
+  - [-0.366055, -3.17611, -5.63567]   # 630nm
+  - [-0.354218, -3.32533, -5.7008]   # 635nm
+  - [-0.343407, -3.46602, -5.76316]   # 640nm
+  - [-0.354363, -3.59889, -5.82292]   # 645nm
+  - [-0.428961, -3.72459, -5.88024]   # 650nm
+  - [-0.656074, -3.84366, -5.93526]   # 655nm
+  - [-0.946249, -3.95663, -5.98813]   # 660nm
+  - [-1.2394, -4.06396, -6.03897]   # 665nm
+  - [-1.50679, -4.16604, -6.08789]   # 670nm
+  - [-1.77081, -4.26327, -6.13499]   # 675nm
+  - [-2.01083, -4.35597, -6.18039]   # 680nm
+  - [-2.22998, -4.44446, -6.22416]   # 685nm
+  - [-2.43087, -4.52902, -6.2664]   # 690nm
+  - [-2.61568, -4.6099, -6.30718]   # 695nm
+  - [-2.78628, -4.68734, -6.34657]   # 700nm
+  - [-2.94424, -4.76155, -6.38466]   # 705nm
+  - [-3.09092, -4.83274, -6.42149]   # 710nm
+  - [-3.22748, -4.90107, -6.45714]   # 715nm
+  - [-3.35494, -4.96673, -6.49165]   # 720nm
+  - [-3.47418, -5.02986, -6.52509]   # 725nm
+  - [-3.58596, -5.09061, -6.5575]   # 730nm
+  - [-3.69097, -5.14911, -6.58893]   # 735nm
+  - [-3.7898, -5.20548, -6.61941]   # 740nm
+  - [-3.88299, -5.25984, -6.649]   # 745nm
+  - [-3.97099, -5.31229, -6.67774]   # 750nm
+  - [-4.05425, -5.36293, -6.70565]   # 755nm
+  - [-4.13311, -5.41186, -6.73278]   # 760nm
+  - [-4.20794, -5.45915, -6.75915]   # 765nm
+  - [-4.27902, -5.50489, -6.7848]   # 770nm
+  - [-4.34664, -5.54916, -6.80976]   # 775nm
+  - [-4.41103, -5.59203, -6.83405]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0.219934, 0.0690457, 0.197424]   # 385nm
+  - [0.180055, 0.0605677, 0.28454]   # 390nm
+  - [0.141725, 0.0508041, 0.368818]   # 395nm
+  - [0.10596, 0.0400928, 0.454706]   # 400nm
+  - [0.0734071, 0.0290889, 0.545617]   # 405nm
+  - [0.044698, 0.0185143, 0.641508]   # 410nm
+  - [0.0205128, 0.00884686, 0.739868]   # 415nm
+  - [0.00143889, 0.000152162, 0.83745]   # 420nm
+  - [-0.0121294, -0.0078213, 0.930727]   # 425nm
+  - [-0.0201355, -0.0153753, 1.01557]   # 430nm
+  - [-0.0229945, -0.0225837, 1.08729]   # 435nm
+  - [-0.0215373, -0.0290263, 1.14151]   # 440nm
+  - [-0.0168424, -0.0335359, 1.17517]   # 445nm
+  - [-0.0100824, -0.0341408, 1.18658]   # 450nm
+  - [-0.00236244, -0.0285442, 1.17471]   # 455nm
+  - [0.00540939, -0.0150457, 1.13895]   # 460nm
+  - [0.0125527, 0.00699094, 1.07976]   # 465nm
+  - [0.0185758, 0.0380109, 0.999158]   # 470nm
+  - [0.0231082, 0.079671, 0.900957]   # 475nm
+  - [0.0259004, 0.134705, 0.790535]   # 480nm
+  - [0.0268431, 0.205041, 0.674204]   # 485nm
+  - [0.0259478, 0.290603, 0.558042]   # 490nm
+  - [0.0232873, 0.389795, 0.446837]   # 495nm
+  - [0.0189498, 0.500236, 0.344137]   # 500nm
+  - [0.0130829, 0.618489, 0.252809]   # 505nm
+  - [0.00599797, 0.739757, 0.175046]   # 510nm
+  - [-0.00178396, 0.858726, 0.111939]   # 515nm
+  - [-0.00959523, 0.970773, 0.0632207]   # 520nm
+  - [-0.0167028, 1.07222, 0.0275014]   # 525nm
+  - [-0.0223299, 1.15986, 0.00276196]   # 530nm
+  - [-0.025608, 1.23008, -0.0131247]   # 535nm
+  - [-0.0255269, 1.27834, -0.0219903]   # 540nm
+  - [-0.0209923, 1.30026, -0.0253764]   # 545nm
+  - [-0.0109847, 1.29377, -0.0247663]   # 550nm
+  - [0.00535715, 1.25966, -0.0216485]   # 555nm
+  - [0.0287857, 1.20031, -0.0172561]   # 560nm
+  - [0.0599359, 1.11845, -0.0124018]   # 565nm
+  - [0.0991434, 1.01749, -0.00757597]   # 570nm
+  - [0.146168, 0.902569, -0.00309889]   # 575nm
+  - [0.200014, 0.780993, 0.000835038]   # 580nm
+  - [0.259016, 0.660985, 0.00418266]   # 585nm
+  - [0.321326, 0.549366, 0.0070436]   # 590nm
+  - [0.38551, 0.450047, 0.00954195]   # 595nm
+  - [0.450713, 0.364545, 0.011655]   # 600nm
+  - [0.516397, 0.293068, 0.0131587]   # 605nm
+  - [0.581981, 0.234893, 0.0137522]   # 610nm
+  - [0.646723, 0.188327, 0.0132301]   # 615nm
+  - [0.709967, 0.150922, 0.0116262]   # 620nm
+  - [0.771511, 0.120142, 0.00928497]   # 625nm
+  - [0.831605, 0.0942039, 0.00679313]   # 630nm
+  - [0.890487, 0.072248, 0.004726]   # 635nm
+  - [0.947953, 0.0538859, 0.003342]   # 640nm
+  - [1.00349, 0.03879, 0.00253006]   # 645nm
+  - [1.05676, 0.0266405, 0.00203029]   # 650nm
+  - [1.10771, 0.0172062, 0.00164137]   # 655nm
+  - [1.15629, 0.0103978, 0.00127914]   # 660nm
+  - [1.20202, 0.00621151, 0.000938116]   # 665nm
+  - [1.24377, 0.00458551, 0.00063837]   # 670nm
+  - [1.27996, 0.00527832, 0.000395263]   # 675nm
+  - [1.30926, 0.00784651, 0.000211127]   # 680nm
+  - [1.33124, 0.0117029, 7.69888e-05]   # 685nm
+  - [1.34632, 0.0162157, -1.40847e-06]   # 690nm
+  - [1.35498, 0.0208201, -7.37939e-07]   # 695nm
+  - [1.35683, 0.0250818, -3.79985e-07]   # 700nm
+  - [1.35067, 0.0286858, -1.92302e-07]   # 705nm
+  - [1.3351, 0.0314337, -9.56482e-08]   # 710nm
+  - [1.30924, 0.0332902, -4.67565e-08]   # 715nm
+  - [1.27315, 0.0343537, -2.24636e-08]   # 720nm
+  - [1.22786, 0.0347916, -1.0607e-08]   # 725nm
+  - [1.17506, 0.0347891, -4.9224e-09]   # 730nm
+  - [1.11643, 0.0345198, -2.24509e-09]   # 735nm
+  - [1.0534, 0.0341338, 8.61996e-05]   # 740nm
+  - [0.987186, 0.0337561, 0.000207593]   # 745nm
+  - [0, 0.0334908, 0.000267898]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0, 0, 0, 0, 0.933414, 0.897549, 0.876086, 0.866033, 0.870645, 0.882094, 0.892707, 0.900328, 0.902069, 0.895052, 0.884664, 0.872443, 0.857621, 0.842124, 0.825051, 0.807508, 0.788897, 0.770294, 0.751929, 0.735483, 0.71846, 0.702528, 0.691316, 0.681951, 0.673479, 0.664148, 0.654181, 0.643917, 0.632416, 0.620377, 0.60762, 0.59383, 0.580154, 0.561819, 0.527487, 0.490929, 0.446639, 0.40331, 0.3619, 0.324986, 0.284903, 0.262975, 0.249335, 0.242079, 0.239187, 0.23937, 0.239839, 0.244782, 0.250344, 0.257017, 0.264548, 0.271892, 0.279015, 0.281704, 0.281046, 0.275089, 0.268824, 0.261894, 0.254735, 0.246873, 0.239905, 0.23131, 0.222705, 0.214196, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00013078, -0.0007119, -0.00082588]
+  - [7.0327e-05, -0.00058386, -0.00074058]
+  - [0.00035341, -0.00036479, -0.00059121]
+  - [0.00066733, -0.00013673, -0.00039991]
+  - [0.00096611, 6.3991e-06, -0.00016937]
+  - [0.0012393, 3.0309e-05, 8.8551e-05]
+  - [0.0015194, 4.2329e-06, 0.00031585]
+  - [0.0018493, 4.5759e-05, 0.00042728]
+  - [0.0022351, 0.00020307, 0.00038164]
+  - [0.0026342, 0.00039831, 0.00022762]
+  - [0.0029943, 0.00050018, 6.6053e-05]
+  - [0.0033041, 0.00044924, -3.3788e-05]
+  - [0.0035839, 0.00028717, -5.1736e-05]
+  - [0.0038805, 0.00011785, -3.7112e-06]
+  - [0.0042462, 3.9574e-05, 8.4039e-05]
+  - [0.0047191, 9.0539e-05, 0.00019234]
+  - [0.0053195, 0.00024148, 0.0003051]
+  - [0.0060587, 0.00042993, 0.00039527]
+  - [0.0069464, 0.00060219, 0.00042321]
+  - [0.0079838, 0.00073226, 0.00035826]
+  - [0.0091474, 0.0008141, 0.00020985]
+  - [0.010382, 0.00084798, 3.9792e-05]
+  - [0.011617, 0.00084172, -6.2735e-05]
+  - [0.012809, 0.0008257, -3.3269e-05]
+  - [0.013983, 0.00085935, 0.00012393]
+  - [0.015241, 0.0010094, 0.00033413]
+  - [0.016724, 0.0013062, 0.00049864]
+  - [0.018543, 0.0017108, 0.00055964]
+  - [0.020721, 0.002128, 0.00053845]
+  - [0.02318, 0.0024666, 0.00051961]
+  - [0.025793, 0.0027096, 0.00059163]
+  - [0.028462, 0.0029405, 0.00078607]
+  - [0.031184, 0.0032967, 0.001057]
+  - [0.034051, 0.0038757, 0.0013133]
+  - [0.0372, 0.0046594, 0.0014795]
+  - [0.040732, 0.0055137, 0.0015425]
+  - [0.044657, 0.0062738, 0.001556]
+  - [0.048901, 0.0068592, 0.0016051]
+  - [0.053358, 0.0073409, 0.0017608]
+  - [0.057954, 0.0079116, 0.0020535]
+  - [0.062688, 0.0087773, 0.0024756]
+  - [0.067628, 0.010041, 0.0030004]
+  - [0.072875, 0.011652, 0.0035958]
+  - [0.07853, 0.013452, 0.0042261]
+  - [0.084658, 0.015279, 0.0048502]
+  - [0.091278, 0.017052, 0.0054333]
+  - [0.098343, 0.018802, 0.0059743]
+  - [0.10574, 0.020632, 0.0065296]
+  - [0.11331, 0.022658, 0.0072096]
+  - [0.12088, 0.024972, 0.0081306]
+  - [0.12839, 0.027619, 0.0093308]
+  - [0.13597, 0.030616, 0.010789]
+  - [0.14395, 0.034015, 0.01249]
+  - [0.15264, 0.037831, 0.014403]
+  - [0.16205, 0.041932, 0.016418]
+  - [0.1719, 0.046052, 0.018388]
+  - [0.18185, 0.049986, 0.020293]
+  - [0.19176, 0.053842, 0.022335]
+  - [0.20173, 0.058068, 0.024806]
+  - [0.21191, 0.063149, 0.027808]
+  - [0.22246, 0.069308, 0.031188]
+  - [0.23354, 0.076377, 0.034689]
+  - [0.24522, 0.08389, 0.038152]
+  - [0.25743, 0.091387, 0.041624]
+  - [0.26991, 0.098704, 0.045314]
+  - [0.28228, 0.10604, 0.049442]
+  - [0.2942, 0.11376, 0.054103]
+  - [0.30556, 0.12205, 0.059269]
+  - [0.31661, 0.13077, 0.0649]
+  - [0.32792, 0.13955, 0.071049]
+  - [0.34004, 0.14821, 0.077846]
+  - [0.3532, 0.15696, 0.085364]
+  - [0.36714, 0.16637, 0.093464]
+  - [0.3812, 0.17702, 0.1018]
+  - [0.39469, 0.18899, 0.11003]
+  - [0.40734, 0.20181, 0.11803]
+  - [0.41942, 0.21467, 0.12611]
+  - [0.43155, 0.22704, 0.13485]
+  - [0.44429, 0.23898, 0.14478]
+  - [0.4578, 0.25103, 0.15607]
+  - [0.47178, 0.26379, 0.16847]
+  - [0.48572, 0.27738, 0.18147]
+  - [0.4993, 0.29133, 0.19463]
+  - [0.51254, 0.30504, 0.20779]
+  - [0.52574, 0.31829, 0.22099]
+  - [0.53916, 0.33155, 0.23439]
+  - [0.55271, 0.34565, 0.24805]
+  - [0.56604, 0.36118, 0.26203]
+  - [0.57884, 0.37791, 0.27644]
+  - [0.59114, 0.39474, 0.29142]
+  - [0.60338, 0.41048, 0.30722]
+  - [0.61609, 0.42475, 0.32412]
+  - [0.62961, 0.43819, 0.34225]
+  - [0.64388, 0.45199, 0.3613]
+  - [0.65847, 0.46705, 0.3805]
+  - [0.67292, 0.4834, 0.39899]
+  - [0.68691, 0.50033, 0.41653]
+  - [0.70046, 0.51693, 0.43361]
+  - [0.71384, 0.53269, 0.45097]
+  - [0.7273, 0.54778, 0.46914]
+  - [0.74083, 0.56275, 0.48812]
+  - [0.75426, 0.57811, 0.50761]
+  - [0.76746, 0.59383, 0.52731]
+  - [0.78062, 0.60947, 0.54723]
+  - [0.79426, 0.62454, 0.56752]
+  - [0.80894, 0.63892, 0.58822]
+  - [0.82491, 0.65302, 0.60902]
+  - [0.84179, 0.66743, 0.6293]
+  - [0.85875, 0.68256, 0.64862]
+  - [0.8749, 0.69834, 0.66708]
+  - [0.88983, 0.71432, 0.68535]
+  - [0.90378, 0.73002, 0.7043]
+  - [0.91748, 0.7452, 0.72439]
+  - [0.93167, 0.75987, 0.7454]
+  - [0.94672, 0.77416, 0.76658]
+  - [0.9626, 0.78828, 0.78698]
+  - [0.97908, 0.80246, 0.80594]
+  - [0.99578, 0.81669, 0.82363]
+  - [1.0122, 0.8306, 0.84121]
+  - [1.028, 0.84395, 0.85998]
+  - [1.0435, 0.85725, 0.8803]
+  - [1.0593, 0.87158, 0.9012]
+  - [1.076, 0.88755, 0.92135]
+  - [1.093, 0.90439, 0.94018]
+  - [1.1096, 0.92068, 0.95823]
+  - [1.1251, 0.93532, 0.97646]
+  - [1.1399, 0.94838, 0.99539]
+  - [1.1546, 0.96103, 1.0147]
+  - [1.1701, 0.97479, 1.0335]
+  - [1.1867, 0.99043, 1.051]
+  - [1.2039, 1.0075, 1.0675]
+  - [1.2208, 1.0249, 1.0837]
+  - [1.2369, 1.0413, 1.1007]
+  - [1.2521, 1.0566, 1.1189]
+  - [1.2667, 1.0713, 1.1378]
+  - [1.2812, 1.0867, 1.1566]
+  - [1.2958, 1.1031, 1.1747]
+  - [1.3102, 1.1205, 1.1926]
+  - [1.3243, 1.1382, 1.2111]
+  - [1.3378, 1.1556, 1.2309]
+  - [1.351, 1.1724, 1.2515]
+  - [1.364, 1.1885, 1.2715]
+  - [1.377, 1.2041, 1.2899]
+  - [1.3903, 1.2196, 1.3064]
+  - [1.4036, 1.2352, 1.3219]
+  - [1.4164, 1.251, 1.338]
+  - [1.4286, 1.2669, 1.3557]
+  - [1.4404, 1.283, 1.3753]
+  - [1.452, 1.2995, 1.3959]
+  - [1.4636, 1.3164, 1.4164]
+  - [1.4751, 1.3338, 1.4361]
+  - [1.4862, 1.3513, 1.4549]
+  - [1.4968, 1.3685, 1.4735]
+  - [1.5069, 1.3854, 1.4925]
+  - [1.5167, 1.402, 1.512]
+  - [1.5262, 1.4187, 1.5318]
+  - [1.5353, 1.4356, 1.5511]
+  - [1.5437, 1.4524, 1.5696]
+  - [1.5517, 1.4688, 1.5878]
+  - [1.5593, 1.4849, 1.6062]
+  - [1.5672, 1.5007, 1.6256]
+  - [1.5754, 1.5166, 1.6461]
+  - [1.5837, 1.5329, 1.6675]
+  - [1.5916, 1.5498, 1.689]
+  - [1.5985, 1.5668, 1.71]
+  - [1.6042, 1.5833, 1.7303]
+  - [1.6092, 1.5986, 1.7502]
+  - [1.6143, 1.6127, 1.7702]
+  - [1.62, 1.6261, 1.7904]
+  - [1.626, 1.6393, 1.8106]
+  - [1.6316, 1.653, 1.8301]
+  - [1.6363, 1.6669, 1.8487]
+  - [1.6402, 1.6811, 1.8669]
+  - [1.6439, 1.6951, 1.8849]
+  - [1.6478, 1.7088, 1.9036]
+  - [1.6521, 1.722, 1.923]
+  - [1.6563, 1.7345, 1.943]
+  - [1.6598, 1.7462, 1.963]
+  - [1.6624, 1.7575, 1.9823]
+  - [1.6645, 1.7686, 2.0009]
+  - [1.6667, 1.78, 2.0188]
+  - [1.6694, 1.7917, 2.0365]
+  - [1.6726, 1.8036, 2.0545]
+  - [1.6757, 1.815, 2.073]
+  - [1.6781, 1.8255, 2.0917]
+  - [1.6795, 1.8351, 2.1099]
+  - [1.6803, 1.8442, 2.1272]
+  - [1.6813, 1.8532, 2.1436]
+  - [1.683, 1.8624, 2.1594]
+  - [1.6854, 1.8718, 2.1752]
+  - [1.6879, 1.8807, 2.1916]
+  - [1.6899, 1.8889, 2.2084]
+  - [1.691, 1.8963, 2.225]
+  - [1.6915, 1.9031, 2.241]
+  - [1.6919, 1.9101, 2.256]
+  - [1.6927, 1.9175, 2.2701]
+  - [1.694, 1.9252, 2.2838]
+  - [1.6955, 1.9325, 2.2977]
+  - [1.6967, 1.9388, 2.3119]
+  - [1.6973, 1.9439, 2.3262]
+  - [1.6975, 1.9482, 2.3401]
+  - [1.6975, 1.9523, 2.3536]
+  - [1.6976, 1.9569, 2.3665]
+  - [1.6979, 1.9621, 2.379]
+  - [1.6984, 1.9675, 2.391]
+  - [1.6991, 1.9727, 2.4023]
+  - [1.6998, 1.9776, 2.413]
+  - [1.7005, 1.9819, 2.4233]
+  - [1.701, 1.9859, 2.4337]
+  - [1.7013, 1.9895, 2.4442]
+  - [1.7016, 1.993, 2.4545]
+  - [1.7017, 1.9963, 2.4643]
+  - [1.7019, 1.9995, 2.4732]
+  - [1.7019, 2.0024, 2.4815]
+  - [1.702, 2.0049, 2.4893]
+  - [1.702, 2.007, 2.4971]
+  - [1.7021, 2.0089, 2.5051]
+  - [1.7023, 2.0108, 2.5134]
+  - [1.7026, 2.0127, 2.5215]
+  - [1.7029, 2.0148, 2.5292]
+  - [1.703, 2.0168, 2.5364]
+  - [1.703, 2.0187, 2.5431]
+  - [1.7029, 2.0204, 2.5494]
+  - [1.7028, 2.0219, 2.5554]
+  - [1.7027, 2.0232, 2.561]
+  - [1.7028, 2.0246, 2.5662]
+  - [1.7029, 2.026, 2.5711]
+  - [1.7031, 2.0273, 2.5758]
+  - [1.7032, 2.0286, 2.5805]
+  - [1.7033, 2.0296, 2.5852]
+  - [1.7034, 2.0305, 2.5898]
+  - [1.7033, 2.0313, 2.594]
+  - [1.7032, 2.032, 2.5976]
+  - [1.7032, 2.0327, 2.6008]
+  - [1.7032, 2.0334, 2.6038]
+  - [1.7033, 2.0339, 2.6069]
+  - [1.7034, 2.0344, 2.6102]
+  - [1.7036, 2.0347, 2.6134]
+  - [1.7038, 2.035, 2.6164]
+  - [1.7038, 2.0354, 2.6188]
+  - [1.7036, 2.0359, 2.6209]
+  - [1.7034, 2.0365, 2.6228]
+  - [1.7031, 2.0371, 2.6249]
+  - [1.7029, 2.0376, 2.6273]
+  - [1.7029, 2.0378, 2.6298]
+  - [1.7032, 2.0379, 2.6319]
+  - [1.7034, 2.0378, 2.6336]
+  - [1.7036, 2.0378, 2.6348]
+  - [1.7037, 2.038, 2.6358]
+  - [1.7036, 2.0383, 2.6369]
+  - [1.7034, 2.0387, 2.638]
+  - [1.7033, 2.039, 2.6391]
+  - [1.7032, 2.0393, 2.64]
+  - [1.7032, 2.0395, 2.6407]
+  - [1.7031, 2.0397, 2.6415]
+  - [1.7031, 2.0398, 2.6423]

core/dr-film/profiles/fujifilm_crystal_archive_typeii.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_crystal_archive_typeii
+name: 'Fujifilm Crystal Archive Type II'
+kind: negative          # negative | positive
+support: paper    # film | paper
+stage: printing        # filming | printing
+monochrome: false
+reference_illuminant: TH-KG3
+viewing_illuminant: D50
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-1.72849, -1.45889, -0.13565]   # 380nm
+  - [-1.72261, -1.4088, 0.0350273]   # 385nm
+  - [-1.71657, -1.35594, 0.175213]   # 390nm
+  - [-1.71034, -1.30008, 0.291354]   # 395nm
+  - [-1.70392, -1.24097, 0.385418]   # 400nm
+  - [-1.69731, -1.17833, 0.461728]   # 405nm
+  - [-1.69049, -1.11184, 0.487034]   # 410nm
+  - [-1.68345, -1.04117, 0.46685]   # 415nm
+  - [-1.67619, -0.965975, 0.466331]   # 420nm
+  - [-1.66869, -0.885921, 0.503006]   # 425nm
+  - [-1.66094, -0.800831, 0.582618]   # 430nm
+  - [-1.65292, -0.711205, 0.695305]   # 435nm
+  - [-1.64463, -0.622024, 0.798175]   # 440nm
+  - [-1.63605, -0.550974, 0.885224]   # 445nm
+  - [-1.62716, -0.471497, 0.958828]   # 450nm
+  - [-1.61795, -0.38529, 1.03405]   # 455nm
+  - [-1.6084, -0.293185, 1.12673]   # 460nm
+  - [-1.59849, -0.190272, 1.23891]   # 465nm
+  - [-1.5882, -0.107171, 1.38778]   # 470nm
+  - [-1.5775, -0.046512, 1.4762]   # 475nm
+  - [-1.56638, 0.00231205, 1.49213]   # 480nm
+  - [-1.5548, 0.0569909, 1.3993]   # 485nm
+  - [-1.54274, 0.157614, 1.20622]   # 490nm
+  - [-1.53016, 0.321573, 0.850708]   # 495nm
+  - [-1.51704, 0.48395, 0.432277]   # 500nm
+  - [-1.50334, 0.597413, 0.0438781]   # 505nm
+  - [-1.48902, 0.640533, -0.370317]   # 510nm
+  - [-1.47403, 0.61426, -0.680729]   # 515nm
+  - [-1.45832, 0.59313, -0.909975]   # 520nm
+  - [-1.44185, 0.611012, -1.20811]   # 525nm
+  - [-1.42456, 0.69349, -1.48636]   # 530nm
+  - [-1.40639, 0.851162, -1.74667]   # 535nm
+  - [-1.38725, 1.05477, -1.9907]   # 540nm
+  - [-1.36709, 1.18982, -2.21995]   # 545nm
+  - [-1.3458, 1.19734, -2.43571]   # 550nm
+  - [-1.32331, 0.9943, -2.63914]   # 555nm
+  - [-1.29949, 0.58033, -2.83127]   # 560nm
+  - [-1.27423, 0.102004, -3.01301]   # 565nm
+  - [-1.2474, -0.442731, -3.18519]   # 570nm
+  - [-1.21884, -0.962689, -3.34854]   # 575nm
+  - [-1.18839, -1.44551, -3.50372]   # 580nm
+  - [-1.15586, -1.89503, -3.65133]   # 585nm
+  - [-1.12103, -2.31458, -3.79191]   # 590nm
+  - [-1.08366, -2.70707, -3.92596]   # 595nm
+  - [-1.04348, -3.07502, -4.05391]   # 600nm
+  - [-1.00024, -3.42067, -4.17617]   # 605nm
+  - [-0.953788, -3.746, -4.29312]   # 610nm
+  - [-0.904925, -4.05273, -4.40509]   # 615nm
+  - [-0.856773, -4.34242, -4.5124]   # 620nm
+  - [-0.816642, -4.61645, -4.61533]   # 625nm
+  - [-0.786605, -4.87606, -4.71413]   # 630nm
+  - [-0.769419, -5.12236, -4.80907]   # 635nm
+  - [-0.758544, -5.35634, -4.90035]   # 640nm
+  - [-0.750889, -5.5789, -4.98819]   # 645nm
+  - [-0.740745, -5.79087, -5.07278]   # 650nm
+  - [-0.730874, -5.99298, -5.15429]   # 655nm
+  - [-0.714442, -6.18591, -5.23288]   # 660nm
+  - [-0.681737, -6.37026, -5.30872]   # 665nm
+  - [-0.620978, -6.54659, -5.38195]   # 670nm
+  - [-0.541223, -6.71542, -5.45269]   # 675nm
+  - [-0.452964, -6.87721, -5.52108]   # 680nm
+  - [-0.353734, -7.03241, -5.58722]   # 685nm
+  - [-0.25616, -7.18139, -5.65123]   # 690nm
+  - [-0.17291, -7.32453, -5.71321]   # 695nm
+  - [-0.0968648, -7.46217, -5.77325]   # 700nm
+  - [-0.0433942, -7.59461, -5.83144]   # 705nm
+  - [-0.0262128, -7.72215, -5.88787]   # 710nm
+  - [-0.03969, -7.84505, -5.94261]   # 715nm
+  - [-0.113391, -7.96356, -5.99575]   # 720nm
+  - [-0.315027, -8.07791, -6.04734]   # 725nm
+  - [-0.602976, -8.18832, -6.09747]   # 730nm
+  - [-0.877037, -8.29498, -6.14617]   # 735nm
+  - [-1.12917, -8.39809, -6.19353]   # 740nm
+  - [-1.36191, -8.49782, -6.23959]   # 745nm
+  - [-1.57741, -8.59433, -6.2844]   # 750nm
+  - [-1.77752, -8.68778, -6.32802]   # 755nm
+  - [-1.96383, -8.77831, -6.37049]   # 760nm
+  - [-2.13772, -8.86605, -6.41186]   # 765nm
+  - [-2.30038, -8.95114, -6.45217]   # 770nm
+  - [-2.45289, -9.03368, -6.49145]   # 775nm
+  - [-2.59615, -9.1138, -6.52976]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0.0535872, 0, 0.114736]   # 380nm
+  - [0.0516478, 0.0241619, 0.174544]   # 385nm
+  - [0.0485472, 0.0254428, 0.24179]   # 390nm
+  - [0.0493278, 0.0306765, 0.319245]   # 395nm
+  - [0.0476471, 0.0332242, 0.419029]   # 400nm
+  - [0.0476274, 0.0332242, 0.521266]   # 405nm
+  - [0.0476274, 0.0338556, 0.668001]   # 410nm
+  - [0.0476274, 0.0397069, 0.807391]   # 415nm
+  - [0.04723, 0.0452808, 0.91186]   # 420nm
+  - [0.0451642, 0.0504404, 1.00422]   # 425nm
+  - [0.0445558, 0.056064, 1.07683]   # 430nm
+  - [0.0438312, 0.0625845, 1.12534]   # 435nm
+  - [0.0426253, 0.0699821, 1.15527]   # 440nm
+  - [0.0404334, 0.079527, 1.16611]   # 445nm
+  - [0.0404056, 0.093543, 1.16214]   # 450nm
+  - [0.0404056, 0.107932, 1.14012]   # 455nm
+  - [0.0404056, 0.128165, 1.09253]   # 460nm
+  - [0.0404056, 0.152081, 1.02098]   # 465nm
+  - [0.0404056, 0.183751, 0.938491]   # 470nm
+  - [0.0404056, 0.216943, 0.813932]   # 475nm
+  - [0.0404056, 0.257291, 0.708028]   # 480nm
+  - [0.0404056, 0.306368, 0.582569]   # 485nm
+  - [0.0404056, 0.358964, 0.472806]   # 490nm
+  - [0.0411696, 0.426616, 0.368298]   # 495nm
+  - [0.0422358, 0.503746, 0.27099]   # 500nm
+  - [0.0451438, 0.590158, 0.204608]   # 505nm
+  - [0.0476214, 0.688945, 0.163098]   # 510nm
+  - [0.0491962, 0.779247, 0.130729]   # 515nm
+  - [0.0535149, 0.862578, 0.102252]   # 520nm
+  - [0.0547981, 0.955934, 0.0852359]   # 525nm
+  - [0.0622739, 1.04635, 0.0689451]   # 530nm
+  - [0.0732735, 1.11258, 0.05335]   # 535nm
+  - [0.0866949, 1.17013, 0.0465616]   # 540nm
+  - [0.104496, 1.19691, 0.0399187]   # 545nm
+  - [0.129517, 1.19737, 0.0338917]   # 550nm
+  - [0.15829, 1.16748, 0.030839]   # 555nm
+  - [0.196264, 1.09344, 0.0279583]   # 560nm
+  - [0.239355, 0.9867, 0.0257902]   # 565nm
+  - [0.281953, 0.848284, 0.0233344]   # 570nm
+  - [0.332883, 0.715483, 0.0233821]   # 575nm
+  - [0.397871, 0.567134, 0.0215211]   # 580nm
+  - [0.468423, 0.457659, 0.0193816]   # 585nm
+  - [0.549268, 0.346306, 0.0188885]   # 590nm
+  - [0.625449, 0.26265, 0.0151334]   # 595nm
+  - [0.704984, 0.19346, 0.0146367]   # 600nm
+  - [0.799658, 0.147851, 0.0146361]   # 605nm
+  - [0.886915, 0.117077, 0.0143639]   # 610nm
+  - [0.970277, 0.0857655, 0.0103382]   # 615nm
+  - [1.03751, 0.0674368, 0.00933611]   # 620nm
+  - [1.09096, 0.0536874, 0.00984592]   # 625nm
+  - [1.12505, 0.0423613, 0.0102343]   # 630nm
+  - [1.1432, 0.0319429, 0.0102343]   # 635nm
+  - [1.15079, 0.0256778, 0.00930957]   # 640nm
+  - [1.14756, 0.0199159, 0.00881458]   # 645nm
+  - [1.13655, 0.0161452, 0.00839374]   # 650nm
+  - [1.11889, 0.0146667, 0.00801033]   # 655nm
+  - [1.07863, 0.0141875, 0.00764148]   # 660nm
+  - [1.02102, 0.0138253, 0.00726431]   # 665nm
+  - [0.949384, 0.0129414, 0.00685595]   # 670nm
+  - [0.860726, 0.0118052, 0.00639354]   # 675nm
+  - [0.769831, 0.0106713, 0.00585421]   # 680nm
+  - [0.693466, 0.00953339, 0.00526879]   # 685nm
+  - [0.628063, 0.00838512, 0.00468337]   # 690nm
+  - [0.574846, 0.00722018, 0.00409795]   # 695nm
+  - [0.520894, 0.00603227, 0.00351253]   # 700nm
+  - [0.482782, 0.00483379, 0.0029271]   # 705nm
+  - [0.442446, 0.00363568, 0.00234168]   # 710nm
+  - [0.40718, 0.00242941, 0.00175626]   # 715nm
+  - [0.372016, 0.00120645, 0.00117084]   # 720nm
+  - [0, 0, 0]   # 725nm
+  - [0, 0, 0]   # 730nm
+  - [0, 0, 0]   # 735nm
+  - [0, 0, 0]   # 740nm
+  - [0, 0, 0]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.0854183, 0.0854181, 0.0854178, 0.0854172, 0.0854159, 0.0854133, 0.0854087, 0.0854008, 0.085388, 0.0853681, 0.085339, 0.0852984, 0.0852443, 0.0851754, 0.0850913, 0.0849923, 0.0848799, 0.084756, 0.0846228, 0.0844827, 0.0843378, 0.0841898, 0.0840402, 0.0838901, 0.0837405, 0.0835924, 0.0834466, 0.0833041, 0.0831656, 0.083032, 0.0829037, 0.0827808, 0.0826633, 0.0825507, 0.0824422, 0.0823372, 0.0822349, 0.0821348, 0.0820367, 0.0819406, 0.0818471, 0.081757, 0.0816715, 0.081592, 0.0815199, 0.0814565, 0.0814026, 0.0813584, 0.0813237, 0.0812977, 0.081279, 0.0812663, 0.0812581, 0.081253, 0.0812501, 0.0812484, 0.0812476, 0.0812472, 0.081247, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469, 0.0812469]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00082207, -0.00082089, -0.0008278]
+  - [-0.00070251, -0.00068042, -0.00074299]
+  - [-0.00050646, -0.00043818, -0.00059421]
+  - [-0.00029511, -0.00018684, -0.00040366]
+  - [-0.00012342, -3.2448e-05, -0.00017405]
+  - [-5.7059e-06, -1.3791e-05, 8.2719e-05]
+  - [9.1999e-05, -5.3052e-05, 0.00030861]
+  - [0.00021437, -1.8094e-05, 0.00041835]
+  - [0.00036418, 0.00014486, 0.00037072]
+  - [0.00048967, 0.00034766, 0.00021435]
+  - [0.00052986, 0.00044217, 4.9948e-05]
+  - [0.00046977, 0.0003613, -5.334e-05]
+  - [0.00032883, 0.00015162, -7.5506e-05]
+  - [0.00015441, -7.0724e-05, -3.2627e-05]
+  - [-2.3977e-06, -0.00019632, 4.8881e-05]
+  - [-0.00010783, -0.00018362, 0.00014965]
+  - [-0.00014853, -6.686e-05, 0.00025336]
+  - [-0.00012144, 8.2629e-05, 0.00033274]
+  - [-2.6361e-05, 0.00020353, 0.00034796]
+  - [0.00012767, 0.00026558, 0.00026816]
+  - [0.00030747, 0.00026076, 0.00010248]
+  - [0.00045058, 0.00018801, -8.7828e-05]
+  - [0.00048483, 5.4486e-05, -0.00021447]
+  - [0.00036793, -0.00010806, -0.0002141]
+  - [0.00012262, -0.00023675, -9.1985e-05]
+  - [-0.00016103, -0.00026207, 7.6502e-05]
+  - [-0.00036566, -0.00015576, 0.00019237]
+  - [-0.00040922, 3.4806e-05, 0.0001975]
+  - [-0.00029184, 0.00020223, 0.0001122]
+  - [-9.5598e-05, 0.0002456, 1.8958e-05]
+  - [6.4346e-05, 0.00014515, 3.3838e-06]
+  - [0.00010726, -1.3323e-05, 9.4186e-05]
+  - [3.073e-05, -9.0986e-05, 0.00024356]
+  - [-9.5183e-05, 4.539e-06, 0.00035985]
+  - [-0.00017677, 0.0002432, 0.00036739]
+  - [-0.00015513, 0.00047913, 0.00025196]
+  - [-3.7734e-05, 0.00054189, 6.3882e-05]
+  - [0.00011276, 0.00035217, -0.00011721]
+  - [0.00021999, -1.8483e-05, -0.00022712]
+  - [0.00023667, -0.00038648, -0.00024212]
+  - [0.00016448, -0.00056744, -0.00017543]
+  - [4.5715e-05, -0.00048499, -5.8608e-05]
+  - [-6.1191e-05, -0.00020712, 7.2192e-05]
+  - [-0.00010547, 0.00010637, 0.00017789]
+  - [-5.8446e-05, 0.00030226, 0.00021564]
+  - [7.9802e-05, 0.00031088, 0.00014983]
+  - [0.0002772, 0.00016015, -2.3921e-05]
+  - [0.00047128, -6.5728e-05, -0.00025896]
+  - [0.00058293, -0.00028098, -0.00046471]
+  - [0.00054165, -0.00042321, -0.00055092]
+  - [0.0003253, -0.00047619, -0.00049915]
+  - [7.3861e-06, -0.00044152, -0.00034298]
+  - [-0.00025809, -0.00030076, -0.00010896]
+  - [-0.00033976, -6.2071e-05, 0.00016363]
+  - [-0.00023734, 0.00017096, 0.00037558]
+  - [-7.8859e-05, 0.00021856, 0.00040885]
+  - [-4.5496e-06, -3.7942e-05, 0.00024981]
+  - [-5.8464e-05, -0.00051429, 4.6653e-05]
+  - [-0.00019127, -0.00093498, -1.538e-06]
+  - [-0.00034349, -0.001037, 0.0001544]
+  - [-0.00044273, -0.00073061, 0.0003845]
+  - [-0.00042628, -0.00014786, 0.00050558]
+  - [-0.00026692, 0.00044082, 0.00041417]
+  - [6.5451e-06, 0.00079889, 0.00014715]
+  - [0.00030202, 0.00086277, -0.00016471]
+  - [0.00048658, 0.00075004, -0.00040025]
+  - [0.0004445, 0.00063751, -0.0005207]
+  - [0.00014892, 0.00060848, -0.00055964]
+  - [-0.00029785, 0.00059124, -0.00055381]
+  - [-0.00069475, 0.00043711, -0.00048792]
+  - [-0.00084181, 7.3688e-05, -0.00030917]
+  - [-0.00065716, -0.00039517, -8.8031e-08]
+  - [-0.00023585, -0.00073202, 0.00035941]
+  - [0.00019663, -0.00072803, 0.00060765]
+  - [0.0004156, -0.00036241, 0.00059894]
+  - [0.00033322, 0.00016763, 0.00031642]
+  - [5.0392e-05, 0.00057689, -8.6933e-05]
+  - [-0.00020994, 0.00068893, -0.00035704]
+  - [-0.00024236, 0.00055285, -0.00027401]
+  - [2.4271e-05, 0.00039345, 0.00023857]
+  - [0.00051088, 0.00043678, 0.0011028]
+  - [0.0010787, 0.00074961, 0.0021741]
+  - [0.0016567, 0.0012202, 0.0033602]
+  - [0.0023139, 0.0016976, 0.0046902]
+  - [0.0032291, 0.0021826, 0.0063003]
+  - [0.0045891, 0.002919, 0.0083685]
+  - [0.0064976, 0.0043089, 0.011067]
+  - [0.0089716, 0.006716, 0.014575]
+  - [0.012067, 0.010247, 0.019105]
+  - [0.01599, 0.014723, 0.024907]
+  - [0.021128, 0.019911, 0.032266]
+  - [0.027967, 0.025845, 0.041485]
+  - [0.03695, 0.032967, 0.052808]
+  - [0.048361, 0.041996, 0.066279]
+  - [0.062311, 0.053595, 0.081691]
+  - [0.078811, 0.068073, 0.098725]
+  - [0.097885, 0.085337, 0.11724]
+  - [0.11966, 0.10507, 0.13741]
+  - [0.14433, 0.12704, 0.15951]
+  - [0.17206, 0.15127, 0.18372]
+  - [0.20283, 0.17805, 0.21003]
+  - [0.23646, 0.20762, 0.23829]
+  - [0.27278, 0.23997, 0.26842]
+  - [0.31188, 0.27478, 0.30059]
+  - [0.35419, 0.31171, 0.33524]
+  - [0.40038, 0.35077, 0.37288]
+  - [0.45105, 0.39251, 0.41394]
+  - [0.50649, 0.43786, 0.45877]
+  - [0.56669, 0.48776, 0.50778]
+  - [0.63151, 0.54281, 0.56172]
+  - [0.70116, 0.60317, 0.62176]
+  - [0.77634, 0.66872, 0.6891]
+  - [0.85811, 0.73927, 0.76438]
+  - [0.94732, 0.81458, 0.84722]
+  - [1.0441, 0.89415, 0.93616]
+  - [1.1475, 0.97724, 1.0289]
+  - [1.256, 1.0629, 1.1231]
+  - [1.3675, 1.1495, 1.2169]
+  - [1.4791, 1.2351, 1.3092]
+  - [1.5884, 1.3179, 1.3995]
+  - [1.6936, 1.3972, 1.486]
+  - [1.7936, 1.4734, 1.5661]
+  - [1.8874, 1.5464, 1.6374]
+  - [1.9732, 1.6148, 1.6991]
+  - [2.0497, 1.6771, 1.7515]
+  - [2.1163, 1.7325, 1.7958]
+  - [2.1736, 1.7817, 1.8327]
+  - [2.2226, 1.8263, 1.8629]
+  - [2.2648, 1.8682, 1.8866]
+  - [2.3009, 1.9079, 1.9046]
+  - [2.3314, 1.9453, 1.918]
+  - [2.3563, 1.9795, 1.928]
+  - [2.3764, 2.0099, 1.9358]
+  - [2.3922, 2.0365, 1.9419]
+  - [2.4046, 2.0599, 1.9466]
+  - [2.4145, 2.0809, 1.9501]
+  - [2.4223, 2.0997, 1.9524]
+  - [2.4283, 2.1163, 1.954]
+  - [2.4329, 2.1306, 1.9553]
+  - [2.4362, 2.1424, 1.9565]
+  - [2.4386, 2.152, 1.9577]
+  - [2.4403, 2.1595, 1.9585]
+  - [2.4415, 2.1653, 1.9588]
+  - [2.4426, 2.1698, 1.9584]
+  - [2.4434, 2.1733, 1.9577]
+  - [2.444, 2.1759, 1.9571]
+  - [2.4443, 2.1779, 1.9569]
+  - [2.4444, 2.1793, 1.9571]
+  - [2.4446, 2.1805, 1.9576]
+  - [2.4448, 2.1814, 1.958]
+  - [2.445, 2.1822, 1.9582]
+  - [2.4452, 2.1828, 1.9581]
+  - [2.4452, 2.1833, 1.9579]
+  - [2.4453, 2.1835, 1.9578]
+  - [2.4453, 2.1836, 1.9579]
+  - [2.4453, 2.1837, 1.9579]
+  - [2.4453, 2.1838, 1.9579]
+  - [2.4452, 2.184, 1.9576]
+  - [2.4449, 2.184, 1.9573]
+  - [2.4447, 2.1839, 1.9569]
+  - [2.4447, 2.1838, 1.9568]
+  - [2.445, 2.1838, 1.957]
+  - [2.4455, 2.1839, 1.9574]
+  - [2.446, 2.1843, 1.9578]
+  - [2.4461, 2.1847, 1.9581]
+  - [2.4458, 2.185, 1.9582]
+  - [2.4453, 2.1851, 1.9582]
+  - [2.4449, 2.1849, 1.9582]
+  - [2.445, 2.1844, 1.9583]
+  - [2.4455, 2.184, 1.9584]
+  - [2.4459, 2.1838, 1.9584]
+  - [2.4459, 2.1838, 1.9581]
+  - [2.4455, 2.1839, 1.9578]
+  - [2.4451, 2.1841, 1.9574]
+  - [2.4451, 2.1843, 1.9572]
+  - [2.4454, 2.1843, 1.9573]
+  - [2.4458, 2.1843, 1.9575]
+  - [2.446, 2.184, 1.9577]
+  - [2.4456, 2.1837, 1.9579]
+  - [2.4449, 2.1835, 1.9578]
+  - [2.4444, 2.1834, 1.9577]
+  - [2.4444, 2.1836, 1.9575]
+  - [2.445, 2.184, 1.9575]
+  - [2.4456, 2.1843, 1.9576]
+  - [2.4458, 2.1844, 1.9579]
+  - [2.4453, 2.1842, 1.9581]
+  - [2.4443, 2.184, 1.9581]
+  - [2.4436, 2.1838, 1.9579]
+  - [2.4437, 2.1839, 1.9576]
+  - [2.4444, 2.1842, 1.9574]
+  - [2.4455, 2.1844, 1.9574]
+  - [2.4461, 2.1844, 1.9576]
+  - [2.446, 2.1842, 1.9579]
+  - [2.4454, 2.1839, 1.9581]
+  - [2.4448, 2.1837, 1.958]
+  - [2.4446, 2.1839, 1.9578]
+  - [2.445, 2.1844, 1.9575]
+  - [2.4457, 2.1849, 1.9574]
+  - [2.4461, 2.185, 1.9575]
+  - [2.4461, 2.1846, 1.9577]
+  - [2.4456, 2.1838, 1.958]
+  - [2.445, 2.1831, 1.9581]
+  - [2.4446, 2.1827, 1.9582]
+  - [2.4444, 2.1829, 1.9583]
+  - [2.4444, 2.1833, 1.9584]
+  - [2.4447, 2.1838, 1.9583]
+  - [2.4451, 2.1842, 1.958]
+  - [2.4454, 2.1844, 1.9578]
+  - [2.4456, 2.1845, 1.9577]
+  - [2.4457, 2.1845, 1.9578]
+  - [2.4457, 2.1846, 1.9579]
+  - [2.4456, 2.1847, 1.958]
+  - [2.4455, 2.1849, 1.9579]
+  - [2.4454, 2.1849, 1.9576]
+  - [2.4452, 2.1847, 1.9572]
+  - [2.4451, 2.1844, 1.9569]
+  - [2.4451, 2.184, 1.9569]
+  - [2.4452, 2.1837, 1.9572]
+  - [2.4453, 2.1835, 1.9575]
+  - [2.4455, 2.1836, 1.9578]
+  - [2.4456, 2.1837, 1.958]
+  - [2.4455, 2.1838, 1.958]
+  - [2.4453, 2.1839, 1.9581]
+  - [2.4451, 2.1838, 1.9581]
+  - [2.4449, 2.1838, 1.9581]
+  - [2.4449, 2.1838, 1.9579]
+  - [2.445, 2.184, 1.9578]
+  - [2.4452, 2.1842, 1.9576]
+  - [2.4453, 2.1843, 1.9576]
+  - [2.4454, 2.1844, 1.9578]
+  - [2.4454, 2.1844, 1.958]
+  - [2.4453, 2.1843, 1.9581]
+  - [2.4452, 2.1842, 1.958]
+  - [2.4451, 2.1842, 1.9577]
+  - [2.445, 2.1842, 1.9574]
+  - [2.4451, 2.1842, 1.9573]
+  - [2.4453, 2.184, 1.9575]
+  - [2.4456, 2.1838, 1.9578]
+  - [2.4457, 2.1837, 1.958]
+  - [2.4457, 2.1836, 1.9579]
+  - [2.4455, 2.1837, 1.9577]
+  - [2.4452, 2.184, 1.9574]
+  - [2.4449, 2.1842, 1.9575]
+  - [2.4447, 2.1844, 1.9578]
+  - [2.4447, 2.1843, 1.9582]
+  - [2.4449, 2.1841, 1.9586]
+  - [2.4452, 2.1838, 1.9587]
+  - [2.4455, 2.1836, 1.9585]
+  - [2.4455, 2.1835, 1.9581]
+  - [2.4454, 2.1837, 1.9579]
+  - [2.4452, 2.1839, 1.9579]
+  - [2.445, 2.1841, 1.9578]
+  - [2.445, 2.1843, 1.9577]
+  - [2.4449, 2.1844, 1.9576]
+  - [2.4448, 2.1845, 1.9574]
+  - [2.4448, 2.1845, 1.9574]

core/dr-film/profiles/fujifilm_pro_400h.yaml

@@ -0,0 +1,453 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_pro_400h
+name: 'Fujifilm Pro 400H'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+target_print: fujifilm_crystal_archive_typeii
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-4.74895, -3.57065, -3.01142]   # 380nm
+  - [-4.72066, -3.51638, -2.51188]   # 385nm
+  - [-4.69133, -3.45942, -2.06558]   # 390nm
+  - [-4.6609, -3.39957, -1.53059]   # 395nm
+  - [-4.62929, -3.3366, -1.01396]   # 400nm
+  - [-4.59644, -3.27026, -0.666879]   # 405nm
+  - [-4.56228, -3.20031, -0.510879]   # 410nm
+  - [-4.52672, -3.12643, -0.459432]   # 415nm
+  - [-4.48969, -3.04832, -0.442987]   # 420nm
+  - [-4.45107, -2.96565, -0.442142]   # 425nm
+  - [-4.41078, -2.87806, -0.448563]   # 430nm
+  - [-4.3687, -2.78525, -0.4594]   # 435nm
+  - [-4.32471, -2.68702, -0.471909]   # 440nm
+  - [-4.27866, -2.58361, -0.482312]   # 445nm
+  - [-4.23043, -2.47694, -0.481095]   # 450nm
+  - [-4.17984, -2.37947, -0.464556]   # 455nm
+  - [-4.12673, -2.30961, -0.410612]   # 460nm
+  - [-4.07089, -2.23696, -0.326741]   # 465nm
+  - [-4.01211, -2.1604, -0.268736]   # 470nm
+  - [-3.95015, -2.03189, -0.360243]   # 475nm
+  - [-3.88475, -1.83324, -0.65128]   # 480nm
+  - [-3.81562, -1.60727, -1.02366]   # 485nm
+  - [-3.74241, -1.37249, -1.38035]   # 490nm
+  - [-3.66478, -1.15772, -1.63592]   # 495nm
+  - [-3.58228, -0.966348, -1.86046]   # 500nm
+  - [-3.49447, -0.853158, -2.06649]   # 505nm
+  - [-3.4008, -0.761958, -2.24571]   # 510nm
+  - [-3.30068, -0.668991, -2.41068]   # 515nm
+  - [-3.1934, -0.586303, -2.60081]   # 520nm
+  - [-3.07817, -0.510941, -2.78935]   # 525nm
+  - [-2.95408, -0.447353, -2.96779]   # 530nm
+  - [-2.82007, -0.400557, -3.13545]   # 535nm
+  - [-2.67488, -0.362668, -3.29283]   # 540nm
+  - [-2.51707, -0.332829, -3.44068]   # 545nm
+  - [-2.34492, -0.314016, -3.57975]   # 550nm
+  - [-2.15636, -0.310583, -3.71076]   # 555nm
+  - [-1.94896, -0.343411, -3.83436]   # 560nm
+  - [-1.76603, -0.438711, -3.95115]   # 565nm
+  - [-1.56821, -0.59746, -4.06167]   # 570nm
+  - [-1.31267, -0.87501, -4.1664]   # 575nm
+  - [-1.07494, -1.20135, -4.26578]   # 580nm
+  - [-0.851192, -1.58855, -4.36022]   # 585nm
+  - [-0.654707, -2.02843, -4.45006]   # 590nm
+  - [-0.479111, -2.449, -4.53564]   # 595nm
+  - [-0.354439, -2.84057, -4.61724]   # 600nm
+  - [-0.300304, -3.20604, -4.69515]   # 605nm
+  - [-0.286695, -3.54792, -4.76959]   # 610nm
+  - [-0.29805, -3.86844, -4.84081]   # 615nm
+  - [-0.301413, -4.16953, -4.909]   # 620nm
+  - [-0.291668, -4.45291, -4.97435]   # 625nm
+  - [-0.288952, -4.7201, -5.03704]   # 630nm
+  - [-0.313799, -4.97245, -5.09723]   # 635nm
+  - [-0.392054, -5.21115, -5.15506]   # 640nm
+  - [-0.589146, -5.43729, -5.21066]   # 645nm
+  - [-0.872896, -5.65184, -5.26417]   # 650nm
+  - [-1.20557, -5.85565, -5.3157]   # 655nm
+  - [-1.56468, -6.04953, -5.36535]   # 660nm
+  - [-1.90409, -6.23417, -5.41324]   # 665nm
+  - [-2.21264, -6.41023, -5.45944]   # 670nm
+  - [-2.49436, -6.57828, -5.50406]   # 675nm
+  - [-2.75261, -6.73886, -5.54716]   # 680nm
+  - [-2.9902, -6.89246, -5.58882]   # 685nm
+  - [-3.20951, -7.03953, -5.62913]   # 690nm
+  - [-3.41258, -7.18046, -5.66813]   # 695nm
+  - [-3.60114, -7.31565, -5.70589]   # 700nm
+  - [-3.77669, -7.44543, -5.74247]   # 705nm
+  - [-3.94055, -7.57011, -5.77793]   # 710nm
+  - [-4.09383, -7.69001, -5.81232]   # 715nm
+  - [-4.23753, -7.80537, -5.84568]   # 720nm
+  - [-4.37253, -7.91647, -5.87806]   # 725nm
+  - [-4.49958, -8.02352, -5.9095]   # 730nm
+  - [-4.61937, -8.12676, -5.94004]   # 735nm
+  - [-4.73251, -8.22637, -5.96972]   # 740nm
+  - [-4.83953, -8.32254, -5.99858]   # 745nm
+  - [-4.94092, -8.41546, -6.02665]   # 750nm
+  - [-5.03711, -8.50527, -6.05396]   # 755nm
+  - [-5.12848, -8.59215, -6.08054]   # 760nm
+  - [-5.21541, -8.67622, -6.10642]   # 765nm
+  - [-5.29819, -8.75762, -6.13163]   # 770nm
+  - [-5.37712, -8.83648, -6.15619]   # 775nm
+  - [-5.45247, -8.91291, -6.18013]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0.34676, 0.0696513, 0.131702]   # 385nm
+  - [0.319265, 0.0618921, 0.225988]   # 390nm
+  - [0.285859, 0.0537333, 0.312971]   # 395nm
+  - [0.245892, 0.0455686, 0.397832]   # 400nm
+  - [0.201381, 0.0377528, 0.486404]   # 405nm
+  - [0.156198, 0.0302909, 0.581067]   # 410nm
+  - [0.114163, 0.0227371, 0.680427]   # 415nm
+  - [0.0776462, 0.0143654, 0.781391]   # 420nm
+  - [0.0474829, 0.00448927, 0.880456]   # 425nm
+  - [0.0236701, -0.00722403, 0.97363]   # 430nm
+  - [0.00596488, -0.0204432, 1.05624]   # 435nm
+  - [-0.00596592, -0.0338814, 1.12347]   # 440nm
+  - [-0.0125814, -0.0452131, 1.17152]   # 445nm
+  - [-0.0144918, -0.051544, 1.19796]   # 450nm
+  - [-0.0125676, -0.0503589, 1.20113]   # 455nm
+  - [-0.00789912, -0.0401265, 1.17964]   # 460nm
+  - [-0.00159968, -0.0196582, 1.13293]   # 465nm
+  - [0.00535289, 0.0132097, 1.06189]   # 470nm
+  - [0.0122441, 0.0616617, 0.96931]   # 475nm
+  - [0.0186806, 0.128136, 0.859798]   # 480nm
+  - [0.0245206, 0.21287, 0.739344]   # 485nm
+  - [0.0297383, 0.314177, 0.614261]   # 490nm
+  - [0.0343113, 0.429397, 0.490143]   # 495nm
+  - [0.0382038, 0.554954, 0.371861]   # 500nm
+  - [0.0413269, 0.685933, 0.264014]   # 505nm
+  - [0.0434352, 0.81654, 0.170692]   # 510nm
+  - [0.0440126, 0.941437, 0.0947287]   # 515nm
+  - [0.0422939, 1.05641, 0.0371587]   # 520nm
+  - [0.0374526, 1.15812, -0.00273735]   # 525nm
+  - [0.0288374, 1.2434, -0.0270147]   # 530nm
+  - [0.0162005, 1.30839, -0.0384658]   # 535nm
+  - [-3.51948e-06, 1.34857, -0.0400844]   # 540nm
+  - [-0.0182628, 1.36054, -0.0348706]   # 545nm
+  - [-0.0357715, 1.34363, -0.0257769]   # 550nm
+  - [-0.0485783, 1.29962, -0.0154197]   # 555nm
+  - [-0.0522567, 1.23113, -0.00566218]   # 560nm
+  - [-0.0428337, 1.1409, 0.0024825]   # 565nm
+  - [-0.0175538, 1.03254, 0.00863996]   # 570nm
+  - [0.0245851, 0.911548, 0.0128401]   # 575nm
+  - [0.0825216, 0.78539, 0.0153817]   # 580nm
+  - [0.153172, 0.662055, 0.0167387]   # 585nm
+  - [0.231975, 0.54781, 0.0174185]   # 590nm
+  - [0.313945, 0.446096, 0.0177523]   # 595nm
+  - [0.395032, 0.358263, 0.0177606]   # 600nm
+  - [0.473009, 0.284591, 0.0172294]   # 605nm
+  - [0.5473, 0.224545, 0.0159148]   # 610nm
+  - [0.618185, 0.176674, 0.0137418]   # 615nm
+  - [0.686086, 0.138752, 0.0109325]   # 620nm
+  - [0.751414, 0.108374, 0.00799496]   # 625nm
+  - [0.814815, 0.0837329, 0.00550782]   # 630nm
+  - [0.877119, 0.0638285, 0.00378755]   # 635nm
+  - [0.938785, 0.0480442, 0.00275588]   # 640nm
+  - [0.999514, 0.0357303, 0.00213569]   # 645nm
+  - [1.05863, 0.0261626, 0.00168749]   # 650nm
+  - [1.11569, 0.0186805, 0.00129608]   # 655nm
+  - [1.17042, 0.0128209, 0.000939411]   # 660nm
+  - [1.22221, 0.00835647, 0.00063108]   # 665nm
+  - [1.26972, 0.0052109, 0.000384139]   # 670nm
+  - [1.31099, 0.00333637, 0.000199476]   # 675nm
+  - [1.34422, 0.00263613, 6.65128e-05]   # 680nm
+  - [1.36871, 0.00294955, -3.79186e-11]   # 685nm
+  - [1.38485, 0.00406796, -9.61671e-12]   # 690nm
+  - [1.39294, 0.00577614, -2.34088e-12]   # 695nm
+  - [1.39221, 0.00788678, -5.46902e-13]   # 700nm
+  - [1.38102, 0.0102338, -1.22636e-13]   # 705nm
+  - [1.35783, 0.0126326, -2.6394e-14]   # 710nm
+  - [1.32208, 0.014925, -5.4522e-15]   # 715nm
+  - [1.27458, 0.0170359, -1.08098e-15]   # 720nm
+  - [1.21726, 0.0189471, -2.05702e-16]   # 725nm
+  - [1.15236, 0.0206701, -3.75698e-17]   # 730nm
+  - [1.08185, 0.022228, 0.000136517]   # 735nm
+  - [1.00746, 0.0236499, 0.000234804]   # 740nm
+  - [0.930904, 0.0249707, 0.000254194]   # 745nm
+  - [0, 0.0262329, 0.000154766]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0, 0, 0, 0, 1.4474, 1.20509, 1.07983, 1.04147, 1.03163, 1.03439, 1.0368, 1.03634, 1.0304, 1.02041, 1.00575, 0.993828, 0.977195, 0.958985, 0.940514, 0.921349, 0.901653, 0.881819, 0.862021, 0.842933, 0.826213, 0.81326, 0.801029, 0.788723, 0.776385, 0.763877, 0.751139, 0.738038, 0.724336, 0.709406, 0.693362, 0.684193, 0.676051, 0.666831, 0.652116, 0.616376, 0.560767, 0.49031, 0.416583, 0.354486, 0.297783, 0.25329, 0.223723, 0.20895, 0.203568, 0.201114, 0.200084, 0.200073, 0.200496, 0.201116, 0.201074, 0.198929, 0.196057, 0.193024, 0.189976, 0.186897, 0.183803, 0.180708, 0.177659, 0.174625, 0.17126, 0.168754, 0.16604, 0.163724, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00063116, -0.00059043, -0.00068093]
+  - [-0.00053763, -0.00048781, -0.00061044]
+  - [-0.00038468, -0.00031126, -0.00048704]
+  - [-0.00021946, -0.00012775, -0.00032896]
+  - [-8.437e-05, -1.3915e-05, -0.00013838]
+  - [9.655e-06, 2.2463e-06, 7.4954e-05]
+  - [8.9022e-05, -2.2833e-05, 0.00026328]
+  - [0.00018848, 6.6842e-06, 0.00035633]
+  - [0.00031043, 0.00013001, 0.00032019]
+  - [0.00041512, 0.00028363, 0.0001951]
+  - [0.00045563, 0.00036048, 6.4328e-05]
+  - [0.00042065, 0.00031212, -1.4781e-05]
+  - [0.00032554, 0.00017257, -2.5369e-05]
+  - [0.00020746, 2.6488e-05, 1.9705e-05]
+  - [0.00010665, -4.601e-05, 9.9106e-05]
+  - [5.0155e-05, -1.3752e-05, 0.00019739]
+  - [4.9427e-05, 9.9527e-05, 0.00030175]
+  - [0.00010815, 0.00024311, 0.00039033]
+  - [0.00022807, 0.00037349, 0.00043093]
+  - [0.00040401, 0.0004698, 0.00039875]
+  - [0.00061205, 0.0005275, 0.00030224]
+  - [0.00080522, 0.00054723, 0.00019351]
+  - [0.00092835, 0.00053591, 0.00014783]
+  - [0.00094931, 0.00051896, 0.00022058]
+  - [0.00088741, 0.0005458, 0.00041049]
+  - [0.00081658, 0.00067221, 0.00065769]
+  - [0.0008349, 0.00092463, 0.00088194]
+  - [0.0010148, 0.0012733, 0.0010368]
+  - [0.0013641, 0.001642, 0.0011422]
+  - [0.0018236, 0.0019573, 0.0012725]
+  - [0.0023047, 0.002207, 0.001507]
+  - [0.0027443, 0.0024618, 0.0018783]
+  - [0.003144, 0.002839, 0.0023531]
+  - [0.003569, 0.0034246, 0.0028588]
+  - [0.0041098, 0.0042093, 0.0033344]
+  - [0.0048314, 0.0050855, 0.0037723]
+  - [0.0057427, 0.005917, 0.0042245]
+  - [0.0068013, 0.0066361, 0.0047736]
+  - [0.0079474, 0.0073043, 0.0054929]
+  - [0.0091441, 0.0080916, 0.0064221]
+  - [0.0104, 0.0091855, 0.0075673]
+  - [0.011767, 0.010688, 0.0089168]
+  - [0.013317, 0.012568, 0.010453]
+  - [0.015126, 0.014694, 0.012153]
+  - [0.017248, 0.016923, 0.013987]
+  - [0.01971, 0.019183, 0.015926]
+  - [0.022502, 0.021503, 0.017974]
+  - [0.025569, 0.023981, 0.020197]
+  - [0.028823, 0.026731, 0.022722]
+  - [0.032173, 0.02985, 0.025692]
+  - [0.035578, 0.033387, 0.02917]
+  - [0.039136, 0.037371, 0.033152]
+  - [0.043084, 0.041858, 0.03764]
+  - [0.047658, 0.04687, 0.042612]
+  - [0.052905, 0.05228, 0.047942]
+  - [0.05865, 0.057808, 0.053448]
+  - [0.064659, 0.063235, 0.059093]
+  - [0.070845, 0.06866, 0.065123]
+  - [0.077285, 0.074548, 0.071914]
+  - [0.084089, 0.081412, 0.07961]
+  - [0.091409, 0.089492, 0.08801]
+  - [0.099393, 0.098608, 0.096763]
+  - [0.10812, 0.10825, 0.10563]
+  - [0.11757, 0.11792, 0.11466]
+  - [0.12752, 0.12741, 0.12411]
+  - [0.13765, 0.13694, 0.13425]
+  - [0.14764, 0.14687, 0.14521]
+  - [0.15736, 0.15738, 0.15692]
+  - [0.16703, 0.16831, 0.16928]
+  - [0.17714, 0.17927, 0.18233]
+  - [0.18823, 0.19002, 0.19622]
+  - [0.20054, 0.2008, 0.211]
+  - [0.21383, 0.21218, 0.22641]
+  - [0.22746, 0.22474, 0.24197]
+  - [0.24073, 0.23853, 0.25718]
+  - [0.25334, 0.25301, 0.27188]
+  - [0.26551, 0.26736, 0.28645]
+  - [0.27785, 0.28102, 0.30159]
+  - [0.29092, 0.29406, 0.3179]
+  - [0.30487, 0.30704, 0.33551]
+  - [0.31939, 0.32051, 0.35401]
+  - [0.33393, 0.33457, 0.37274]
+  - [0.34812, 0.34876, 0.39116]
+  - [0.36197, 0.36249, 0.40908]
+  - [0.37578, 0.37559, 0.42655]
+  - [0.38977, 0.3885, 0.44375]
+  - [0.40387, 0.40197, 0.46074]
+  - [0.41767, 0.41652, 0.47757]
+  - [0.43084, 0.43191, 0.49435]
+  - [0.44343, 0.44716, 0.5112]
+  - [0.45586, 0.46124, 0.52836]
+  - [0.46866, 0.47387, 0.54604]
+  - [0.48217, 0.48565, 0.56433]
+  - [0.4963, 0.49761, 0.58292]
+  - [0.51061, 0.51051, 0.60113]
+  - [0.52462, 0.52437, 0.61824]
+  - [0.53804, 0.53859, 0.63411]
+  - [0.55088, 0.55245, 0.64925]
+  - [0.56343, 0.56555, 0.6643]
+  - [0.57591, 0.57802, 0.67969]
+  - [0.58834, 0.59037, 0.69545]
+  - [0.60055, 0.60301, 0.71135]
+  - [0.61242, 0.61595, 0.72718]
+  - [0.62415, 0.62882, 0.74297]
+  - [0.63622, 0.64125, 0.75888]
+  - [0.64917, 0.65314, 0.77496]
+  - [0.66318, 0.66483, 0.79101]
+  - [0.67793, 0.67683, 0.8066]
+  - [0.69264, 0.68947, 0.82144]
+  - [0.70653, 0.70271, 0.83561]
+  - [0.71925, 0.71618, 0.84967]
+  - [0.73101, 0.72948, 0.86428]
+  - [0.74251, 0.74241, 0.87981]
+  - [0.75441, 0.75497, 0.89613]
+  - [0.76703, 0.76726, 0.91269]
+  - [0.78036, 0.77946, 0.92879]
+  - [0.79421, 0.79175, 0.94391]
+  - [0.80823, 0.8041, 0.95819]
+  - [0.82198, 0.81621, 0.97251]
+  - [0.83518, 0.82786, 0.9879]
+  - [0.8481, 0.83946, 1.0047]
+  - [0.86139, 0.85194, 1.0221]
+  - [0.87538, 0.86577, 1.039]
+  - [0.88972, 0.88031, 1.0551]
+  - [0.90371, 0.89433, 1.0706]
+  - [0.91684, 0.90691, 1.0864]
+  - [0.92927, 0.91812, 1.1029]
+  - [0.94171, 0.92893, 1.1198]
+  - [0.95494, 0.94059, 1.1364]
+  - [0.96923, 0.95374, 1.152]
+  - [0.98419, 0.968, 1.1668]
+  - [0.99903, 0.98234, 1.1814]
+  - [1.0132, 0.99582, 1.1967]
+  - [1.0266, 1.0082, 1.2129]
+  - [1.0396, 1.0201, 1.2298]
+  - [1.0527, 1.0324, 1.2466]
+  - [1.0659, 1.0455, 1.2628]
+  - [1.0791, 1.0592, 1.2788]
+  - [1.0922, 1.073, 1.2952]
+  - [1.1049, 1.0865, 1.3126]
+  - [1.1174, 1.0994, 1.3306]
+  - [1.1299, 1.1116, 1.3482]
+  - [1.1426, 1.1234, 1.3642]
+  - [1.1558, 1.135, 1.3786]
+  - [1.1691, 1.1467, 1.3922]
+  - [1.1822, 1.1584, 1.4061]
+  - [1.1949, 1.1701, 1.4213]
+  - [1.2073, 1.1819, 1.4379]
+  - [1.2198, 1.1938, 1.4552]
+  - [1.2325, 1.2062, 1.4723]
+  - [1.2453, 1.2187, 1.4887]
+  - [1.2578, 1.2312, 1.5043]
+  - [1.27, 1.2435, 1.5196]
+  - [1.2818, 1.2555, 1.5352]
+  - [1.2935, 1.2673, 1.5511]
+  - [1.3051, 1.2791, 1.567]
+  - [1.3164, 1.2908, 1.5826]
+  - [1.3272, 1.3025, 1.5975]
+  - [1.3375, 1.314, 1.612]
+  - [1.3476, 1.325, 1.6265]
+  - [1.3581, 1.3359, 1.6417]
+  - [1.3692, 1.3467, 1.6577]
+  - [1.3806, 1.3578, 1.6742]
+  - [1.3915, 1.3692, 1.6907]
+  - [1.4014, 1.3806, 1.7067]
+  - [1.4099, 1.3916, 1.722]
+  - [1.4177, 1.4016, 1.7369]
+  - [1.4257, 1.4108, 1.7518]
+  - [1.4344, 1.4194, 1.7666]
+  - [1.4436, 1.4279, 1.7813]
+  - [1.4523, 1.4365, 1.7953]
+  - [1.4599, 1.4452, 1.8086]
+  - [1.4665, 1.454, 1.8213]
+  - [1.4728, 1.4627, 1.8339]
+  - [1.4795, 1.471, 1.8467]
+  - [1.4866, 1.4789, 1.8598]
+  - [1.4936, 1.4862, 1.8731]
+  - [1.4997, 1.493, 1.8861]
+  - [1.5046, 1.4994, 1.8986]
+  - [1.5088, 1.5055, 1.9103]
+  - [1.5131, 1.5118, 1.9213]
+  - [1.5181, 1.5182, 1.932]
+  - [1.5235, 1.5246, 1.9427]
+  - [1.5288, 1.5306, 1.9535]
+  - [1.5331, 1.536, 1.9641]
+  - [1.5361, 1.5407, 1.9742]
+  - [1.5384, 1.545, 1.9835]
+  - [1.5409, 1.5493, 1.992]
+  - [1.5441, 1.5536, 2]
+  - [1.5481, 1.5579, 2.0078]
+  - [1.5521, 1.5619, 2.0157]
+  - [1.5554, 1.5654, 2.0236]
+  - [1.5577, 1.5684, 2.0312]
+  - [1.5591, 1.571, 2.0382]
+  - [1.5604, 1.5737, 2.0444]
+  - [1.5621, 1.5766, 2.0501]
+  - [1.5643, 1.5796, 2.0554]
+  - [1.5666, 1.5824, 2.0606]
+  - [1.5685, 1.5846, 2.0658]
+  - [1.5697, 1.5861, 2.0709]
+  - [1.5704, 1.5871, 2.0756]
+  - [1.5709, 1.588, 2.08]
+  - [1.5715, 1.5892, 2.084]
+  - [1.5723, 1.5908, 2.0877]
+  - [1.5732, 1.5925, 2.0911]
+  - [1.5742, 1.5941, 2.0941]
+  - [1.5752, 1.5955, 2.0967]
+  - [1.5761, 1.5967, 2.099]
+  - [1.5768, 1.5976, 2.1014]
+  - [1.5774, 1.5984, 2.1037]
+  - [1.5778, 1.5992, 2.106]
+  - [1.5782, 1.5999, 2.1079]
+  - [1.5785, 1.6006, 2.1095]
+  - [1.5787, 1.6011, 2.1108]
+  - [1.5788, 1.6015, 2.1119]
+  - [1.579, 1.6016, 2.1129]
+  - [1.5792, 1.6017, 2.1141]
+  - [1.5794, 1.6018, 2.1155]
+  - [1.5798, 1.602, 2.1168]
+  - [1.58, 1.6023, 2.1179]
+  - [1.5802, 1.6026, 2.1189]
+  - [1.5803, 1.6029, 2.1197]
+  - [1.5802, 1.6031, 2.1204]
+  - [1.5801, 1.6033, 2.1209]
+  - [1.5801, 1.6034, 2.1214]
+  - [1.5801, 1.6035, 2.1217]
+  - [1.5803, 1.6037, 2.122]
+  - [1.5805, 1.604, 2.1222]
+  - [1.5806, 1.6042, 2.1226]
+  - [1.5807, 1.6043, 2.123]
+  - [1.5807, 1.6044, 2.1234]
+  - [1.5807, 1.6043, 2.1237]
+  - [1.5806, 1.6043, 2.1238]
+  - [1.5806, 1.6044, 2.1237]
+  - [1.5806, 1.6044, 2.1237]
+  - [1.5807, 1.6044, 2.1237]
+  - [1.5808, 1.6043, 2.124]
+  - [1.581, 1.6042, 2.1243]
+  - [1.5811, 1.6041, 2.1245]
+  - [1.5811, 1.6041, 2.1246]
+  - [1.581, 1.6042, 2.1244]
+  - [1.5807, 1.6044, 2.1243]
+  - [1.5805, 1.6046, 2.1244]
+  - [1.5804, 1.6047, 2.1247]
+  - [1.5804, 1.6047, 2.1251]
+  - [1.5806, 1.6045, 2.1254]
+  - [1.5808, 1.6043, 2.1255]
+  - [1.581, 1.6041, 2.1254]
+  - [1.581, 1.6041, 2.1251]
+  - [1.5809, 1.6042, 2.1249]
+  - [1.5808, 1.6044, 2.1249]
+  - [1.5807, 1.6045, 2.1249]
+  - [1.5806, 1.6047, 2.1248]
+  - [1.5806, 1.6047, 2.1247]
+  - [1.5805, 1.6048, 2.1246]
+  - [1.5805, 1.6048, 2.1246]

core/dr-film/profiles/fujifilm_provia_100f.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_provia_100f
+name: 'Fujifilm Provia 100F'
+kind: positive          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-3.27854, -3.446, -2.91708]   # 380nm
+  - [-3.26416, -3.39997, -2.5622]   # 385nm
+  - [-3.24927, -3.35169, -2.17506]   # 390nm
+  - [-3.23383, -3.301, -1.77696]   # 395nm
+  - [-3.21782, -3.24771, -1.38582]   # 400nm
+  - [-3.20121, -3.19162, -1.02441]   # 405nm
+  - [-3.18396, -3.13249, -0.690857]   # 410nm
+  - [-3.16604, -3.07008, -0.530376]   # 415nm
+  - [-3.14739, -3.0041, -0.469205]   # 420nm
+  - [-3.12799, -2.93424, -0.435437]   # 425nm
+  - [-3.10778, -2.86015, -0.421965]   # 430nm
+  - [-3.08671, -2.78142, -0.421164]   # 435nm
+  - [-3.06472, -2.69762, -0.411369]   # 440nm
+  - [-3.04175, -2.60823, -0.393547]   # 445nm
+  - [-3.01774, -2.51267, -0.362401]   # 450nm
+  - [-2.99261, -2.41029, -0.314866]   # 455nm
+  - [-2.96629, -2.30033, -0.296313]   # 460nm
+  - [-2.93868, -2.1819, -0.308723]   # 465nm
+  - [-2.90969, -2.05401, -0.369059]   # 470nm
+  - [-2.87922, -1.91545, -0.489683]   # 475nm
+  - [-2.84714, -1.76485, -0.694112]   # 480nm
+  - [-2.81333, -1.61679, -0.97105]   # 485nm
+  - [-2.77764, -1.46097, -1.28311]   # 490nm
+  - [-2.73991, -1.30768, -1.61248]   # 495nm
+  - [-2.69996, -1.1708, -1.9176]   # 500nm
+  - [-2.65759, -1.05465, -2.21498]   # 505nm
+  - [-2.61257, -0.952251, -2.48758]   # 510nm
+  - [-2.56465, -0.855799, -2.73837]   # 515nm
+  - [-2.51353, -0.764411, -2.96987]   # 520nm
+  - [-2.45888, -0.677428, -3.18422]   # 525nm
+  - [-2.40034, -0.601212, -3.38326]   # 530nm
+  - [-2.33745, -0.533179, -3.56858]   # 535nm
+  - [-2.26973, -0.467866, -3.74154]   # 540nm
+  - [-2.19659, -0.421884, -3.90334]   # 545nm
+  - [-2.11736, -0.41634, -4.05503]   # 550nm
+  - [-2.03124, -0.436924, -4.19752]   # 555nm
+  - [-1.93728, -0.464948, -4.33163]   # 560nm
+  - [-1.83438, -0.481413, -4.45808]   # 565nm
+  - [-1.72119, -0.476751, -4.57751]   # 570nm
+  - [-1.59609, -0.453429, -4.69048]   # 575nm
+  - [-1.50567, -0.42914, -4.7975]   # 580nm
+  - [-1.3884, -0.46206, -4.89903]   # 585nm
+  - [-1.21106, -0.678363, -4.99549]   # 590nm
+  - [-1.02992, -1.18858, -5.08725]   # 595nm
+  - [-0.862347, -1.67342, -5.17463]   # 600nm
+  - [-0.749535, -2.11948, -5.25795]   # 605nm
+  - [-0.693306, -2.53123, -5.33748]   # 610nm
+  - [-0.639163, -2.91248, -5.41348]   # 615nm
+  - [-0.573543, -3.26649, -5.48617]   # 620nm
+  - [-0.492354, -3.59609, -5.55577]   # 625nm
+  - [-0.395313, -3.90372, -5.62247]   # 630nm
+  - [-0.2868, -4.1915, -5.68645]   # 635nm
+  - [-0.175506, -4.46129, -5.74787]   # 640nm
+  - [-0.0880352, -4.71474, -5.80688]   # 645nm
+  - [-0.0986827, -4.95327, -5.86362]   # 650nm
+  - [-0.201359, -5.17817, -5.91822]   # 655nm
+  - [-0.442689, -5.39058, -5.97079]   # 660nm
+  - [-0.919104, -5.59151, -6.02146]   # 665nm
+  - [-1.49049, -5.78186, -6.07031]   # 670nm
+  - [-2.02926, -5.96245, -6.11745]   # 675nm
+  - [-2.51671, -6.13401, -6.16297]   # 680nm
+  - [-2.95985, -6.29721, -6.20694]   # 685nm
+  - [-3.36446, -6.45263, -6.24945]   # 690nm
+  - [-3.73535, -6.60082, -6.29056]   # 695nm
+  - [-4.07657, -6.74228, -6.33035]   # 700nm
+  - [-4.39154, -6.87745, -6.36887]   # 705nm
+  - [-4.68318, -7.00674, -6.40619]   # 710nm
+  - [-4.95399, -7.13053, -6.44237]   # 715nm
+  - [-5.20612, -7.24916, -6.47744]   # 720nm
+  - [-5.44144, -7.36295, -6.51147]   # 725nm
+  - [-5.66159, -7.47219, -6.5445]   # 730nm
+  - [-5.86797, -7.57715, -6.57657]   # 735nm
+  - [-6.06184, -7.67807, -6.60772]   # 740nm
+  - [-6.24431, -7.77518, -6.638]   # 745nm
+  - [-6.41636, -7.86869, -6.66743]   # 750nm
+  - [-6.57884, -7.9588, -6.69606]   # 755nm
+  - [-6.73254, -8.0457, -6.72392]   # 760nm
+  - [-6.87815, -8.12954, -6.75103]   # 765nm
+  - [-7.0163, -8.2105, -6.77743]   # 770nm
+  - [-7.14754, -8.28871, -6.80314]   # 775nm
+  - [-7.27237, -8.36431, -6.8282]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0.340585, 0.167429, 0.450022]   # 385nm
+  - [0.317222, 0.171975, 0.511085]   # 390nm
+  - [0.294334, 0.176237, 0.584739]   # 395nm
+  - [0.277553, 0.182409, 0.665767]   # 400nm
+  - [0.262595, 0.188487, 0.749822]   # 405nm
+  - [0.249865, 0.197039, 0.842488]   # 410nm
+  - [0.237666, 0.206535, 0.934394]   # 415nm
+  - [0.226554, 0.215115, 1.0118]   # 420nm
+  - [0.215966, 0.225818, 1.07136]   # 425nm
+  - [0.205587, 0.232808, 1.11735]   # 430nm
+  - [0.195694, 0.232378, 1.15061]   # 435nm
+  - [0.186408, 0.228196, 1.162]   # 440nm
+  - [0.176765, 0.221838, 1.15394]   # 445nm
+  - [0.167797, 0.220735, 1.12812]   # 450nm
+  - [0.160118, 0.227428, 1.08562]   # 455nm
+  - [0.152837, 0.239972, 1.02469]   # 460nm
+  - [0.145544, 0.260758, 0.944332]   # 465nm
+  - [0.139133, 0.292342, 0.857485]   # 470nm
+  - [0.133802, 0.332155, 0.770171]   # 475nm
+  - [0.128561, 0.380859, 0.673461]   # 480nm
+  - [0.125183, 0.437982, 0.585594]   # 485nm
+  - [0.123132, 0.502186, 0.502111]   # 490nm
+  - [0.123177, 0.584157, 0.421624]   # 495nm
+  - [0.125027, 0.665414, 0.355637]   # 500nm
+  - [0.128379, 0.739195, 0.289161]   # 505nm
+  - [0.133974, 0.824938, 0.233355]   # 510nm
+  - [0.141885, 0.908946, 0.186757]   # 515nm
+  - [0.152957, 0.982131, 0.150276]   # 520nm
+  - [0.165908, 1.03467, 0.116434]   # 525nm
+  - [0.184358, 1.06615, 0.0927855]   # 530nm
+  - [0.20924, 1.08375, 0.0755337]   # 535nm
+  - [0.235768, 1.07989, 0.0634362]   # 540nm
+  - [0.263741, 1.064, 0.0548441]   # 545nm
+  - [0.294088, 1.03436, 0.048549]   # 550nm
+  - [0.326789, 0.990486, 0.0442157]   # 555nm
+  - [0.363118, 0.929966, 0.0409986]   # 560nm
+  - [0.402213, 0.859209, 0.0382997]   # 565nm
+  - [0.444833, 0.785694, 0.0364875]   # 570nm
+  - [0.490344, 0.710945, 0.0347009]   # 575nm
+  - [0.537961, 0.626937, 0.0333383]   # 580nm
+  - [0.5883, 0.554466, 0.0326828]   # 585nm
+  - [0.643578, 0.482206, 0.0325632]   # 590nm
+  - [0.70262, 0.421966, 0.0323535]   # 595nm
+  - [0.762281, 0.35931, 0.0317377]   # 600nm
+  - [0.823007, 0.309663, 0.0328651]   # 605nm
+  - [0.882433, 0.263622, 0.0309579]   # 610nm
+  - [0.940826, 0.225974, 0.0306508]   # 615nm
+  - [0.993406, 0.195083, 0.0305293]   # 620nm
+  - [1.04038, 0.169247, 0.0308059]   # 625nm
+  - [1.07942, 0.147295, 0.031742]   # 630nm
+  - [1.11165, 0.12886, 0.0323982]   # 635nm
+  - [1.13828, 0.114916, 0.0337083]   # 640nm
+  - [1.15907, 0.101852, 0.0348531]   # 645nm
+  - [1.16928, 0.0902782, 0.0350249]   # 650nm
+  - [1.16785, 0.0797517, 0.0337312]   # 655nm
+  - [1.1564, 0.0699903, 0.0316397]   # 660nm
+  - [1.13796, 0.0608943, 0.0284302]   # 665nm
+  - [1.11138, 0.0536555, 0.0253923]   # 670nm
+  - [1.07802, 0.0470709, 0.0213704]   # 675nm
+  - [1.04001, 0.0417618, 0.0175123]   # 680nm
+  - [1.00111, 0.036918, 0.0149526]   # 685nm
+  - [0.953646, 0.0329179, 0.0131364]   # 690nm
+  - [0.90109, 0.0302608, 0.0114814]   # 695nm
+  - [0.846141, 0.0275454, 0.0100454]   # 700nm
+  - [0.789601, 0.0250569, 0.00960445]   # 705nm
+  - [0.733837, 0.0237014, 0.00960445]   # 710nm
+  - [0.680331, 0.0236079, 0.00960445]   # 715nm
+  - [0, 0, 0]   # 720nm
+  - [0, 0, 0]   # 725nm
+  - [0, 0, 0]   # 730nm
+  - [0, 0, 0]   # 735nm
+  - [0, 0, 0]   # 740nm
+  - [0, 0, 0]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900273, 0.0900274, 0.0900274, 0.0900274, 0.0900276, 0.0900279, 0.0900284, 0.0900293, 0.090031, 0.0900337, 0.0900378, 0.0900439, 0.0900524, 0.0900638, 0.0900782, 0.0900958, 0.0901165, 0.09014, 0.090166, 0.0901938, 0.090223, 0.0902531, 0.0902836, 0.0903142, 0.0903443, 0.0903735, 0.0904013, 0.0904272, 0.0904508, 0.0904715, 0.0904891, 0.0905035, 0.0905148, 0.0905233, 0.0905294, 0.0905336, 0.0905363, 0.0905379, 0.0905389, 0.0905394, 0.0905397, 0.0905398, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399, 0.0905399]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [2.5543, 2.5433, 2.0745]
+  - [2.5544, 2.5434, 2.0745]
+  - [2.5546, 2.5436, 2.0747]
+  - [2.5548, 2.5439, 2.0749]
+  - [2.555, 2.544, 2.0751]
+  - [2.5551, 2.5441, 2.0754]
+  - [2.5552, 2.544, 2.0756]
+  - [2.5554, 2.5441, 2.0757]
+  - [2.5555, 2.5442, 2.0756]
+  - [2.5556, 2.5444, 2.0755]
+  - [2.5557, 2.5445, 2.0753]
+  - [2.5556, 2.5444, 2.0752]
+  - [2.5554, 2.5442, 2.0752]
+  - [2.5552, 2.544, 2.0752]
+  - [2.5551, 2.5439, 2.0753]
+  - [2.5549, 2.5439, 2.0753]
+  - [2.5549, 2.544, 2.0754]
+  - [2.5549, 2.5441, 2.0755]
+  - [2.5549, 2.5442, 2.0755]
+  - [2.555, 2.5443, 2.0753]
+  - [2.5551, 2.5443, 2.0751]
+  - [2.5552, 2.5442, 2.0748]
+  - [2.5551, 2.544, 2.0746]
+  - [2.5549, 2.5438, 2.0745]
+  - [2.5544, 2.5436, 2.0745]
+  - [2.554, 2.5435, 2.0745]
+  - [2.5535, 2.5435, 2.0744]
+  - [2.5532, 2.5436, 2.0741]
+  - [2.5529, 2.5437, 2.0737]
+  - [2.5527, 2.5435, 2.0732]
+  - [2.5523, 2.5432, 2.0727]
+  - [2.5518, 2.5428, 2.0723]
+  - [2.5509, 2.5424, 2.0718]
+  - [2.5499, 2.5421, 2.0711]
+  - [2.5488, 2.5419, 2.0702]
+  - [2.5476, 2.5416, 2.069]
+  - [2.5463, 2.5409, 2.0675]
+  - [2.5448, 2.5398, 2.0658]
+  - [2.543, 2.5384, 2.0639]
+  - [2.5408, 2.5367, 2.0619]
+  - [2.5381, 2.535, 2.0597]
+  - [2.535, 2.5333, 2.0572]
+  - [2.5314, 2.5315, 2.0543]
+  - [2.5274, 2.5294, 2.051]
+  - [2.5231, 2.5267, 2.0471]
+  - [2.5182, 2.5234, 2.0425]
+  - [2.5129, 2.5192, 2.0373]
+  - [2.5068, 2.5143, 2.0312]
+  - [2.4999, 2.5088, 2.0246]
+  - [2.4918, 2.5025, 2.0174]
+  - [2.4827, 2.4954, 2.0096]
+  - [2.4723, 2.4876, 2.0012]
+  - [2.4609, 2.4789, 1.9921]
+  - [2.4488, 2.4692, 1.9822]
+  - [2.4359, 2.4584, 1.9713]
+  - [2.4219, 2.4459, 1.9589]
+  - [2.4065, 2.4314, 1.9451]
+  - [2.3895, 2.4149, 1.93]
+  - [2.371, 2.3968, 1.9142]
+  - [2.3509, 2.3777, 1.8977]
+  - [2.3296, 2.3578, 1.8802]
+  - [2.307, 2.3369, 1.8613]
+  - [2.2833, 2.3143, 1.8405]
+  - [2.2585, 2.2893, 1.8181]
+  - [2.2324, 2.2617, 1.7942]
+  - [2.2044, 2.2316, 1.7693]
+  - [2.1743, 2.1996, 1.7436]
+  - [2.1419, 2.1659, 1.7171]
+  - [2.1076, 2.1305, 1.6896]
+  - [2.072, 2.0928, 1.6613]
+  - [2.0359, 2.0526, 1.6324]
+  - [1.9998, 2.0104, 1.6032]
+  - [1.9634, 1.9671, 1.5733]
+  - [1.9261, 1.9237, 1.5422]
+  - [1.8871, 1.8805, 1.5095]
+  - [1.8461, 1.8369, 1.4751]
+  - [1.8035, 1.792, 1.4396]
+  - [1.7603, 1.7451, 1.404]
+  - [1.7173, 1.6967, 1.3693]
+  - [1.675, 1.6477, 1.3357]
+  - [1.633, 1.5991, 1.3029]
+  - [1.5908, 1.5512, 1.27]
+  - [1.5481, 1.5037, 1.2367]
+  - [1.5049, 1.4558, 1.2028]
+  - [1.4619, 1.4077, 1.1685]
+  - [1.4194, 1.3599, 1.1341]
+  - [1.3774, 1.3138, 1.0998]
+  - [1.3355, 1.27, 1.0658]
+  - [1.2933, 1.2284, 1.0323]
+  - [1.251, 1.1876, 0.99939]
+  - [1.2092, 1.1465, 0.96746]
+  - [1.1686, 1.1047, 0.93677]
+  - [1.1296, 1.0631, 0.90742]
+  - [1.092, 1.023, 0.87905]
+  - [1.0554, 0.98521, 0.85088]
+  - [1.0191, 0.94969, 0.82211]
+  - [0.98269, 0.91565, 0.79256]
+  - [0.94627, 0.88213, 0.76277]
+  - [0.91009, 0.84862, 0.73345]
+  - [0.87441, 0.81522, 0.70503]
+  - [0.8392, 0.78244, 0.67749]
+  - [0.80423, 0.75066, 0.65052]
+  - [0.76933, 0.71981, 0.62388]
+  - [0.73469, 0.68941, 0.59756]
+  - [0.70085, 0.65897, 0.5717]
+  - [0.66837, 0.62838, 0.54634]
+  - [0.63744, 0.59796, 0.52123]
+  - [0.60764, 0.56824, 0.49593]
+  - [0.57815, 0.53956, 0.47011]
+  - [0.54814, 0.51185, 0.44392]
+  - [0.51729, 0.48473, 0.41796]
+  - [0.48596, 0.45781, 0.39296]
+  - [0.45492, 0.43094, 0.36932]
+  - [0.42491, 0.40417, 0.34691]
+  - [0.3963, 0.37768, 0.32518]
+  - [0.3691, 0.35171, 0.3035]
+  - [0.34315, 0.32652, 0.28147]
+  - [0.31816, 0.30213, 0.25933]
+  - [0.29379, 0.27833, 0.23798]
+  - [0.2699, 0.25502, 0.21837]
+  - [0.24679, 0.23265, 0.20073]
+  - [0.22507, 0.21203, 0.18439]
+  - [0.205, 0.19354, 0.16848]
+  - [0.18631, 0.17661, 0.15272]
+  - [0.16846, 0.16028, 0.13751]
+  - [0.15116, 0.14394, 0.12343]
+  - [0.13456, 0.12773, 0.11077]
+  - [0.11919, 0.11244, 0.099287]
+  - [0.10551, 0.098883, 0.088469]
+  - [0.093613, 0.087392, 0.077965]
+  - [0.083149, 0.077608, 0.067863]
+  - [0.073605, 0.068802, 0.05859]
+  - [0.06463, 0.06039, 0.050554]
+  - [0.056196, 0.052262, 0.043834]
+  - [0.048481, 0.044737, 0.038138]
+  - [0.041628, 0.03822, 0.033039]
+  - [0.035638, 0.032854, 0.028288]
+  - [0.030392, 0.028458, 0.023994]
+  - [0.025735, 0.024723, 0.020457]
+  - [0.02156, 0.021383, 0.017806]
+  - [0.017838, 0.018277, 0.015799]
+  - [0.01462, 0.015347, 0.013946]
+  - [0.011973, 0.012634, 0.01185]
+  - [0.009892, 0.010222, 0.0094557]
+  - [0.0082299, 0.0081576, 0.0070528]
+  - [0.0067829, 0.0064155, 0.0050541]
+  - [0.0054591, 0.0049394, 0.0037427]
+  - [0.0042994, 0.0037164, 0.0031109]
+  - [0.0033912, 0.0027743, 0.0028868]
+  - [0.0027591, 0.0021264, 0.0027192]
+  - [0.0023267, 0.0017209, 0.0023864]
+  - [0.0019742, 0.001446, 0.0018902]
+  - [0.0016295, 0.001192, 0.0013898]
+  - [0.0013057, 0.00091573, 0.0010425]
+  - [0.0010523, 0.00065282, 0.0008748]
+  - [0.00087169, 0.00046612, 0.00077072]
+  - [0.00068895, 0.00037567, 0.00057165]
+  - [0.00041464, 0.0003314, 0.00020385]
+  - [5.0336e-05, 0.00025343, -0.00026182]
+  - [-0.00026665, 0.00010573, -0.00065464]
+  - [-0.00034113, -6.1651e-05, -0.00081371]
+  - [-8.2885e-05, -0.00015295, -0.00067318]
+  - [0.00041581, -6.1147e-05, -0.00031371]
+  - [0.00088712, 0.00025272, 7.9571e-05]
+  - [0.0010138, 0.00067703, 0.00034414]
+  - [0.00068069, 0.0010003, 0.00043541]
+  - [0.00011856, 0.0010456, 0.00043653]
+  - [-0.00024591, 0.0007855, 0.00046909]
+  - [-0.00014417, 0.00035475, 0.00057314]
+  - [0.00029777, -4.2573e-05, 0.00066334]
+  - [0.00067725, -0.00025913, 0.0006087]
+  - [0.00068216, -0.00028102, 0.00036311]
+  - [0.0003325, -0.00016561, -7.2703e-06]
+  - [-5.1127e-05, 9.8278e-06, -0.00035979]
+  - [-0.00012046, 0.00016945, -0.00055013]
+  - [0.00019902, 0.00024227, -0.00051293]
+  - [0.00062919, 0.00017211, -0.0002996]
+  - [0.00075686, -5.1426e-05, -4.9664e-05]
+  - [0.00038003, -0.0003606, 8.9406e-05]
+  - [-0.00029965, -0.00061664, 4.8035e-05]
+  - [-0.00080729, -0.00067606, -0.00012514]
+  - [-0.00076121, -0.00048539, -0.00029495]
+  - [-0.00019163, -0.00013524, -0.0003268]
+  - [0.00044951, 0.00017966, -0.00017655]
+  - [0.00061405, 0.00028237, 7.5227e-05]
+  - [8.0176e-05, 0.00013693, 0.00027055]
+  - [-0.00085311, -0.00012077, 0.00027641]
+  - [-0.0015595, -0.00027699, 7.6167e-05]
+  - [-0.0015328, -0.00019786, -0.00021269]
+  - [-0.00075642, 6.5676e-05, -0.00041069]
+  - [0.00028032, 0.00030979, -0.00039293]
+  - [0.00093224, 0.00033099, -0.00017231]
+  - [0.00085249, 8.9965e-05, 0.0001084]
+  - [0.00021757, -0.0002401, 0.00027097]
+  - [-0.00043186, -0.00038631, 0.00021842]
+  - [-0.00059981, -0.00017661, -5.3125e-06]
+  - [-0.00018225, 0.0003153, -0.00025112]
+  - [0.00049481, 0.00079004, -0.00036657]
+  - [0.000945, 0.00090219, -0.00028892]
+  - [0.00086621, 0.00048513, -6.6985e-05]
+  - [0.00036906, -0.00028899, 0.00017012]
+  - [-0.00021405, -0.0010194, 0.00033786]
+  - [-0.00064117, -0.0013644, 0.00045045]
+  - [-0.00084149, -0.0012406, 0.00054246]
+  - [-0.00080636, -0.00080673, 0.00057742]
+  - [-0.00054163, -0.00030449, 0.00047883]
+  - [-0.00014085, 9.0816e-05, 0.00025062]
+  - [0.00020645, 0.00032748, 2.2587e-05]
+  - [0.00039606, 0.00042477, -7.1076e-05]
+  - [0.00046421, 0.00045154, -3.5319e-06]
+  - [0.00045927, 0.00050805, 0.00014307]
+  - [0.00041221, 0.00062938, 0.00021518]
+  - [0.00032428, 0.00075855, 9.2604e-05]
+  - [0.00019112, 0.00078669, -0.0002217]
+  - [3.4831e-05, 0.00063167, -0.00059374]
+  - [-8.8526e-05, 0.00030183, -0.00084102]
+  - [-0.00011636, -9.7907e-05, -0.00084713]
+  - [-2.3143e-05, -0.00042194, -0.00062749]
+  - [0.00015297, -0.00056606, -0.00030374]
+  - [0.00032266, -0.0005232, -1.3704e-05]
+  - [0.00039221, -0.00037849, 0.00017119]
+  - [0.00031597, -0.00024908, 0.00026249]
+  - [0.00012212, -0.00020961, 0.00030531]
+  - [-0.00010306, -0.00025131, 0.00031688]
+  - [-0.00026154, -0.000299, 0.00027163]
+  - [-0.00029259, -0.00027061, 0.00014416]
+  - [-0.000198, -0.00013689, -3.495e-05]
+  - [-3.3834e-05, 5.8756e-05, -0.00017183]
+  - [0.00012171, 0.00023137, -0.00017006]
+  - [0.00020459, 0.00031205, -1.5488e-05]
+  - [0.00018864, 0.00029076, 0.00018992]
+  - [9.0619e-05, 0.00021548, 0.00028646]
+  - [-3.9992e-05, 0.00015062, 0.00017361]
+  - [-0.00013957, 0.00012675, -0.00010314]
+  - [-0.00015232, 0.00011888, -0.00037067]
+  - [-5.2034e-05, 6.9298e-05, -0.00044858]
+  - [0.00014165, -6.1556e-05, -0.00028559]
+  - [0.00036103, -0.00025352, -5.6164e-06]
+  - [0.00050974, -0.00042611, 0.00017901]
+  - [0.0005025, -0.00048282, 0.00012788]
+  - [0.00031031, -0.00037305, -0.0001142]
+  - [-1.2991e-05, -0.00013156, -0.00034072]
+  - [-0.00034329, 0.00013132, -0.00033198]
+  - [-0.00053914, 0.00028491, -1.9892e-05]
+  - [-0.00051235, 0.00024706, 0.00045446]
+  - [-0.00027822, 2.7433e-05, 0.00083498]
+  - [4.533e-05, -0.00027584, 0.0009199]
+  - [0.00028471, -0.0005081, 0.00068138]
+  - [0.00031968, -0.0005594, 0.00034871]
+  - [0.00017724, -0.00042893, 0.00014744]
+  - [-1.6195e-05, -0.00019955, 9.3372e-05]
+  - [-0.00015589, 3.0964e-05, 5.2417e-05]
+  - [-0.00023099, 0.00020411, -6.4328e-05]
+  - [-0.00028939, 0.00031064, -0.00021919]
+  - [-0.00035502, 0.00036863, -0.00033587]
+  - [-0.00039868, 0.00039829, -0.00039436]

core/dr-film/profiles/fujifilm_velvia_100.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_velvia_100
+name: 'Fujifilm Velvia 100'
+kind: positive          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-3.46067, -4.1332, -3.16912]   # 380nm
+  - [-3.44044, -4.07777, -2.80303]   # 385nm
+  - [-3.41952, -4.01971, -2.40878]   # 390nm
+  - [-3.39788, -3.95881, -1.983]   # 395nm
+  - [-3.37548, -3.89487, -1.52173]   # 400nm
+  - [-3.35228, -3.82765, -1.04717]   # 405nm
+  - [-3.32825, -3.75689, -0.689314]   # 410nm
+  - [-3.30332, -3.6823, -0.517479]   # 415nm
+  - [-3.27745, -3.60358, -0.455525]   # 420nm
+  - [-3.25059, -3.52035, -0.417597]   # 425nm
+  - [-3.22267, -3.43223, -0.401658]   # 430nm
+  - [-3.19365, -3.33876, -0.375228]   # 435nm
+  - [-3.16343, -3.23946, -0.323421]   # 440nm
+  - [-3.13197, -3.13375, -0.283274]   # 445nm
+  - [-3.09916, -3.02099, -0.310132]   # 450nm
+  - [-3.06494, -2.90046, -0.38891]   # 455nm
+  - [-3.02919, -2.77131, -0.474094]   # 460nm
+  - [-2.99183, -2.6326, -0.500674]   # 465nm
+  - [-2.95273, -2.48322, -0.521555]   # 470nm
+  - [-2.91178, -2.32189, -0.603407]   # 475nm
+  - [-2.86884, -2.14711, -0.734161]   # 480nm
+  - [-2.82376, -1.95714, -0.877703]   # 485nm
+  - [-2.77639, -1.7623, -0.994107]   # 490nm
+  - [-2.72653, -1.57157, -1.06623]   # 495nm
+  - [-2.674, -1.38028, -1.14992]   # 500nm
+  - [-2.61858, -1.20902, -1.30529]   # 505nm
+  - [-2.56002, -1.04042, -1.52606]   # 510nm
+  - [-2.49807, -0.933224, -1.74645]   # 515nm
+  - [-2.43243, -0.814152, -1.96609]   # 520nm
+  - [-2.36279, -0.673924, -2.17492]   # 525nm
+  - [-2.28881, -0.556623, -2.36769]   # 530nm
+  - [-2.21016, -0.469029, -2.54617]   # 535nm
+  - [-2.12654, -0.408977, -2.71191]   # 540nm
+  - [-2.03791, -0.354302, -2.86622]   # 545nm
+  - [-1.94519, -0.316193, -3.01023]   # 550nm
+  - [-1.85567, -0.330569, -3.14496]   # 555nm
+  - [-1.77887, -0.405287, -3.27127]   # 560nm
+  - [-1.70567, -0.445626, -3.38992]   # 565nm
+  - [-1.64962, -0.453081, -3.5016]   # 570nm
+  - [-1.52834, -0.457653, -3.60689]   # 575nm
+  - [-1.37743, -0.510379, -3.70633]   # 580nm
+  - [-1.21685, -0.615097, -3.8004]   # 585nm
+  - [-1.07095, -0.922013, -3.88951]   # 590nm
+  - [-0.95086, -1.34105, -3.97406]   # 595nm
+  - [-0.858274, -1.82082, -4.05438]   # 600nm
+  - [-0.769746, -2.27677, -4.13078]   # 605nm
+  - [-0.680491, -2.69624, -4.20354]   # 610nm
+  - [-0.59083, -3.08345, -4.27292]   # 615nm
+  - [-0.501804, -3.44198, -4.33914]   # 620nm
+  - [-0.414956, -3.77489, -4.40242]   # 625nm
+  - [-0.329959, -4.08485, -4.46295]   # 630nm
+  - [-0.246551, -4.37414, -4.52091]   # 635nm
+  - [-0.188507, -4.64477, -4.57645]   # 640nm
+  - [-0.180264, -4.89849, -4.62972]   # 645nm
+  - [-0.264482, -5.13682, -4.68086]   # 650nm
+  - [-0.404872, -5.36114, -4.73]   # 655nm
+  - [-0.556563, -5.57264, -4.77724]   # 660nm
+  - [-0.703482, -5.77239, -4.82271]   # 665nm
+  - [-0.840754, -5.96134, -4.86649]   # 670nm
+  - [-1.00663, -6.14035, -4.90867]   # 675nm
+  - [-1.25532, -6.31018, -4.94935]   # 680nm
+  - [-1.57868, -6.47151, -4.98861]   # 685nm
+  - [-1.88779, -6.62498, -5.02651]   # 690nm
+  - [-2.17482, -6.77114, -5.06312]   # 695nm
+  - [-2.44206, -6.9105, -5.09852]   # 700nm
+  - [-2.69148, -7.04353, -5.13275]   # 705nm
+  - [-2.92481, -7.17064, -5.16588]   # 710nm
+  - [-3.14355, -7.29223, -5.19796]   # 715nm
+  - [-3.34904, -7.40864, -5.22903]   # 720nm
+  - [-3.54244, -7.5202, -5.25915]   # 725nm
+  - [-3.72479, -7.62721, -5.28836]   # 730nm
+  - [-3.89701, -7.72994, -5.3167]   # 735nm
+  - [-4.05992, -7.82864, -5.3442]   # 740nm
+  - [-4.21426, -7.92354, -5.3709]   # 745nm
+  - [-4.36068, -8.01486, -5.39684]   # 750nm
+  - [-4.49978, -8.1028, -5.42205]   # 755nm
+  - [-4.63209, -8.18755, -5.44656]   # 760nm
+  - [-4.75811, -8.26926, -5.4704]   # 765nm
+  - [-4.87826, -8.34811, -5.4936]   # 770nm
+  - [-4.99295, -8.42424, -5.51617]   # 775nm
+  - [-5.10254, -8.49779, -5.53816]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0, 0, 0]   # 385nm
+  - [0, 0, 0]   # 390nm
+  - [0, 0, 0]   # 395nm
+  - [0.103508, 0.0439042, 0.736087]   # 400nm
+  - [0.0955073, 0.0389726, 0.793055]   # 405nm
+  - [0.0877816, 0.0349954, 0.851657]   # 410nm
+  - [0.0801834, 0.0321858, 0.911481]   # 415nm
+  - [0.0729001, 0.0308953, 0.969509]   # 420nm
+  - [0.0657606, 0.0310694, 1.02438]   # 425nm
+  - [0.0588639, 0.0332375, 1.07429]   # 430nm
+  - [0.0528495, 0.0368916, 1.12164]   # 435nm
+  - [0.0460547, 0.0436813, 1.15294]   # 440nm
+  - [0.0390092, 0.0525085, 1.16706]   # 445nm
+  - [0.0341579, 0.0631992, 1.15727]   # 450nm
+  - [0.0296911, 0.0766163, 1.11987]   # 455nm
+  - [0.0273577, 0.0957769, 1.06279]   # 460nm
+  - [0.0265341, 0.12149, 0.986092]   # 465nm
+  - [0.0270454, 0.153396, 0.889785]   # 470nm
+  - [0.028063, 0.1884, 0.783029]   # 475nm
+  - [0.0295912, 0.232004, 0.667141]   # 480nm
+  - [0.0317152, 0.285046, 0.548391]   # 485nm
+  - [0.0342649, 0.34591, 0.437923]   # 490nm
+  - [0.0374594, 0.421242, 0.358549]   # 495nm
+  - [0.0411935, 0.507529, 0.279448]   # 500nm
+  - [0.0455533, 0.59826, 0.214026]   # 505nm
+  - [0.0505787, 0.69018, 0.161055]   # 510nm
+  - [0.0566154, 0.78006, 0.127514]   # 515nm
+  - [0.0634245, 0.864955, 0.0972487]   # 520nm
+  - [0.0721136, 0.944086, 0.0733985]   # 525nm
+  - [0.0828877, 1.01529, 0.0538613]   # 530nm
+  - [0.0954968, 1.07967, 0.0395563]   # 535nm
+  - [0.114129, 1.13381, 0.0281628]   # 540nm
+  - [0.137576, 1.18378, 0.0194472]   # 545nm
+  - [0.16388, 1.21831, 0.012891]   # 550nm
+  - [0.193168, 1.22378, 0.0090571]   # 555nm
+  - [0.226205, 1.19374, 0.00642384]   # 560nm
+  - [0.263176, 1.13251, 0.00528374]   # 565nm
+  - [0.305252, 1.04228, 0.00526008]   # 570nm
+  - [0.353637, 0.921528, 0.00513917]   # 575nm
+  - [0.410895, 0.78927, 0.0043747]   # 580nm
+  - [0.476269, 0.659263, 0.0043747]   # 585nm
+  - [0.545727, 0.531554, 0.0043747]   # 590nm
+  - [0.622993, 0.425497, 0.0043747]   # 595nm
+  - [0.701631, 0.33692, 0.00413956]   # 600nm
+  - [0.778665, 0.261743, 0.00446621]   # 605nm
+  - [0.855515, 0.202167, 0.00341477]   # 610nm
+  - [0.924407, 0.16563, 0.00261948]   # 615nm
+  - [0.987837, 0.133438, 0.00260396]   # 620nm
+  - [1.04612, 0.107518, 0.00260396]   # 625nm
+  - [1.09843, 0.0858923, 0.00260396]   # 630nm
+  - [1.14513, 0.0677051, 0.00260396]   # 635nm
+  - [1.18644, 0.0522253, 0.0018675]   # 640nm
+  - [1.22417, 0.0393377, 0.00171859]   # 645nm
+  - [1.25762, 0.0283038, 0.00171859]   # 650nm
+  - [1.28362, 0.0193283, 0.00171859]   # 655nm
+  - [1.29877, 0.0132644, 0.00122916]   # 660nm
+  - [1.28855, 0.00700278, 0.00081904]   # 665nm
+  - [1.25385, 0.003361, 0.000511626]   # 670nm
+  - [1.20339, 0.0030863, -5.21537e-05]   # 675nm
+  - [1.1202, 0.0030863, -5.21537e-05]   # 680nm
+  - [1.03413, 0.0030863, -5.21537e-05]   # 685nm
+  - [0.93652, 0.0030863, -5.21537e-05]   # 690nm
+  - [0.826282, 0.00306512, -5.21537e-05]   # 695nm
+  - [0.699343, 0.00278782, -5.21537e-05]   # 700nm
+  - [0.549664, 0.00248959, -5.21537e-05]   # 705nm
+  - [0, 0.00242626, 0]   # 710nm
+  - [0, 0, 0]   # 715nm
+  - [0, 0, 0]   # 720nm
+  - [0, 0, 0]   # 725nm
+  - [0, 0, 0]   # 730nm
+  - [0, 0, 0]   # 735nm
+  - [0, 0, 0]   # 740nm
+  - [0, 0, 0]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.130243, 0.130243, 0.130242, 0.130241, 0.130239, 0.130236, 0.130229, 0.130217, 0.130199, 0.13017, 0.130127, 0.130068, 0.129988, 0.129888, 0.129764, 0.12962, 0.129455, 0.129274, 0.129079, 0.128875, 0.128665, 0.128453, 0.128242, 0.128036, 0.127842, 0.127664, 0.127512, 0.127393, 0.127316, 0.127287, 0.127312, 0.127391, 0.127524, 0.127705, 0.127928, 0.128184, 0.128464, 0.128761, 0.129067, 0.129376, 0.129683, 0.129981, 0.130265, 0.13053, 0.130771, 0.130983, 0.131164, 0.131311, 0.131427, 0.131514, 0.131577, 0.131619, 0.131647, 0.131664, 0.131674, 0.131679, 0.131682, 0.131683, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684, 0.131684]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [2.7296, 3.5719, 2.8576]
+  - [2.7298, 3.5721, 2.8577]
+  - [2.7299, 3.5723, 2.8579]
+  - [2.7302, 3.5725, 2.858]
+  - [2.7303, 3.5727, 2.8583]
+  - [2.7304, 3.5727, 2.8585]
+  - [2.7305, 3.5727, 2.8588]
+  - [2.7307, 3.5727, 2.8589]
+  - [2.7308, 3.5729, 2.8588]
+  - [2.7309, 3.5731, 2.8587]
+  - [2.731, 3.5732, 2.8585]
+  - [2.7309, 3.5731, 2.8584]
+  - [2.7308, 3.5729, 2.8584]
+  - [2.7306, 3.5727, 2.8584]
+  - [2.7305, 3.5725, 2.8585]
+  - [2.7303, 3.5725, 2.8586]
+  - [2.7303, 3.5727, 2.8587]
+  - [2.7303, 3.5728, 2.8588]
+  - [2.7304, 3.5729, 2.8588]
+  - [2.7306, 3.573, 2.8587]
+  - [2.7308, 3.573, 2.8586]
+  - [2.7309, 3.5729, 2.8584]
+  - [2.7309, 3.5728, 2.8582]
+  - [2.7308, 3.5726, 2.8582]
+  - [2.7306, 3.5725, 2.8583]
+  - [2.7303, 3.5725, 2.8585]
+  - [2.7301, 3.5726, 2.8586]
+  - [2.73, 3.5727, 2.8586]
+  - [2.7302, 3.5729, 2.8585]
+  - [2.7304, 3.5729, 2.8584]
+  - [2.7305, 3.5728, 2.8584]
+  - [2.7305, 3.5726, 2.8584]
+  - [2.7305, 3.5725, 2.8586]
+  - [2.7303, 3.5725, 2.8586]
+  - [2.7302, 3.5727, 2.8586]
+  - [2.7302, 3.5728, 2.8584]
+  - [2.7303, 3.5727, 2.8581]
+  - [2.7305, 3.5723, 2.8578]
+  - [2.7305, 3.5717, 2.8575]
+  - [2.7305, 3.571, 2.8572]
+  - [2.7303, 3.5704, 2.857]
+  - [2.7301, 3.5699, 2.8567]
+  - [2.7298, 3.5694, 2.8563]
+  - [2.7296, 3.5688, 2.8558]
+  - [2.7294, 3.5678, 2.8551]
+  - [2.7292, 3.5663, 2.8541]
+  - [2.7289, 3.5643, 2.8527]
+  - [2.7285, 3.5617, 2.851]
+  - [2.7279, 3.5585, 2.849]
+  - [2.7269, 3.5548, 2.8467]
+  - [2.7254, 3.5504, 2.8441]
+  - [2.7235, 3.5451, 2.8412]
+  - [2.7212, 3.5388, 2.8377]
+  - [2.7187, 3.5315, 2.8337]
+  - [2.7158, 3.5227, 2.8288]
+  - [2.7123, 3.512, 2.8228]
+  - [2.7079, 3.4989, 2.8155]
+  - [2.7024, 3.4832, 2.8071]
+  - [2.6957, 3.4652, 2.7977]
+  - [2.6876, 3.4451, 2.7872]
+  - [2.6782, 3.4228, 2.7754]
+  - [2.6674, 3.398, 2.7619]
+  - [2.6549, 3.37, 2.7462]
+  - [2.6407, 3.338, 2.7284]
+  - [2.6243, 3.3016, 2.7085]
+  - [2.6054, 3.2608, 2.6866]
+  - [2.5834, 3.2158, 2.6628]
+  - [2.558, 3.1668, 2.6368]
+  - [2.5293, 3.1136, 2.6087]
+  - [2.4974, 3.0557, 2.5783]
+  - [2.4629, 2.993, 2.5458]
+  - [2.4261, 2.9258, 2.5113]
+  - [2.3867, 2.8551, 2.4745]
+  - [2.3442, 2.7819, 2.435]
+  - [2.298, 2.7069, 2.3922]
+  - [2.2476, 2.6297, 2.3462]
+  - [2.1936, 2.5496, 2.2973]
+  - [2.1368, 2.4663, 2.2465]
+  - [2.0783, 2.3804, 2.1946]
+  - [2.0186, 2.2933, 2.142]
+  - [1.9577, 2.2063, 2.0884]
+  - [1.8953, 2.1202, 2.0334]
+  - [1.8315, 2.0347, 1.9766]
+  - [1.7665, 1.9497, 1.9179]
+  - [1.7012, 1.8653, 1.8576]
+  - [1.6363, 1.7827, 1.7963]
+  - [1.572, 1.7032, 1.7343]
+  - [1.5083, 1.6277, 1.6718]
+  - [1.445, 1.5561, 1.6093]
+  - [1.3825, 1.4873, 1.5472]
+  - [1.3216, 1.4201, 1.486]
+  - [1.2631, 1.3544, 1.4263]
+  - [1.2075, 1.2909, 1.3681]
+  - [1.1548, 1.2308, 1.3115]
+  - [1.1043, 1.1746, 1.2556]
+  - [1.0555, 1.1222, 1.1998]
+  - [1.0081, 1.0727, 1.144]
+  - [0.96198, 1.025, 1.089]
+  - [0.91735, 0.97857, 1.0354]
+  - [0.87431, 0.93335, 0.9839]
+  - [0.83273, 0.88959, 0.93441]
+  - [0.79228, 0.84747, 0.88665]
+  - [0.75268, 0.80677, 0.84036]
+  - [0.71399, 0.76699, 0.79552]
+  - [0.67655, 0.72763, 0.75225]
+  - [0.6407, 0.68852, 0.71053]
+  - [0.60652, 0.6499, 0.67007]
+  - [0.57358, 0.61218, 0.63043]
+  - [0.54117, 0.57562, 0.59128]
+  - [0.50858, 0.54018, 0.55273]
+  - [0.47557, 0.50558, 0.51529]
+  - [0.44242, 0.47154, 0.47956]
+  - [0.40979, 0.43799, 0.44584]
+  - [0.37833, 0.40504, 0.41396]
+  - [0.34835, 0.37288, 0.38342]
+  - [0.31989, 0.34176, 0.35366]
+  - [0.29287, 0.31194, 0.32432]
+  - [0.26708, 0.28347, 0.29563]
+  - [0.2423, 0.25623, 0.26832]
+  - [0.21841, 0.23015, 0.24318]
+  - [0.1957, 0.2056, 0.22038]
+  - [0.17465, 0.18321, 0.19934]
+  - [0.15548, 0.16327, 0.17933]
+  - [0.13794, 0.1453, 0.16011]
+  - [0.12159, 0.12851, 0.14197]
+  - [0.10618, 0.11239, 0.12538]
+  - [0.091805, 0.096997, 0.11055]
+  - [0.078824, 0.082891, 0.097247]
+  - [0.067568, 0.07066, 0.085008]
+  - [0.058058, 0.060504, 0.073507]
+  - [0.049978, 0.052091, 0.062774]
+  - [0.042873, 0.044795, 0.053117]
+  - [0.036416, 0.038087, 0.044839]
+  - [0.030533, 0.03182, 0.037969]
+  - [0.025326, 0.026194, 0.032231]
+  - [0.020872, 0.021501, 0.027229]
+  - [0.017143, 0.01783, 0.022712]
+  - [0.014016, 0.01501, 0.018738]
+  - [0.011338, 0.01276, 0.015543]
+  - [0.0089998, 0.010831, 0.013223]
+  - [0.0069643, 0.0090601, 0.011549]
+  - [0.005266, 0.0073789, 0.010067]
+  - [0.0039654, 0.0058107, 0.0083921]
+  - [0.003064, 0.004424, 0.0064482]
+  - [0.0024355, 0.0032637, 0.0044813]
+  - [0.0019005, 0.00231, 0.0028675]
+  - [0.0013782, 0.0015172, 0.0018754]
+  - [0.00091243, 0.00088058, 0.0015059]
+  - [0.00059444, 0.00043535, 0.0015069]
+  - [0.00045871, 0.00020435, 0.0015437]
+  - [0.00044328, 0.00014741, 0.0014002]
+  - [0.00044199, 0.00016489, 0.001075]
+  - [0.00039236, 0.00015649, 0.00072265]
+  - [0.00031388, 8.5418e-05, 0.00049885]
+  - [0.00026176, -8.2573e-06, 0.00043299]
+  - [0.00024502, -5.7361e-05, 0.00041378]
+  - [0.0001956, -3.6951e-05, 0.00028653]
+  - [2.9817e-05, 7.943e-06, -2.0676e-05]
+  - [-0.00024703, 1.7376e-06, -0.00043651]
+  - [-0.00049512, -8.8482e-05, -0.00078981]
+  - [-0.00051672, -0.00021045, -0.00091851]
+  - [-0.00021839, -0.00026647, -0.00075494]
+  - [0.000311, -0.00014771, -0.00037772]
+  - [0.00080653, 0.00018663, 2.9661e-05]
+  - [0.00095281, 0.00062664, 0.00030567]
+  - [0.00063555, 0.00096225, 0.00040618]
+  - [8.565e-05, 0.0010172, 0.00041454]
+  - [-0.0002699, 0.00076473, 0.00045263]
+  - [-0.00016187, 0.00033972, 0.00056084]
+  - [0.00028458, -5.3368e-05, 0.00065421]
+  - [0.00066749, -0.00026689, 0.00060202]
+  - [0.0006751, -0.00028661, 0.0003583]
+  - [0.00032749, -0.00016965, -1.0676e-05]
+  - [-5.4637e-05, 6.9271e-06, -0.00036219]
+  - [-0.00012295, 0.00016737, -0.00055182]
+  - [0.00019723, 0.0002408, -0.00051414]
+  - [0.0006279, 0.00017108, -0.00030047]
+  - [0.00075595, -5.2134e-05, -5.0285e-05]
+  - [0.00037941, -0.00036109, 8.8967e-05]
+  - [-0.00030007, -0.00061697, 4.7731e-05]
+  - [-0.00080756, -0.00067629, -0.00012535]
+  - [-0.0007614, -0.00048554, -0.00029509]
+  - [-0.00019177, -0.00013535, -0.0003269]
+  - [0.00044942, 0.00017959, -0.00017661]
+  - [0.00061399, 0.00028232, 7.5181e-05]
+  - [8.0134e-05, 0.00013689, 0.00027052]
+  - [-0.00085313, -0.00012079, 0.00027639]
+  - [-0.0015595, -0.00027701, 7.6153e-05]
+  - [-0.0015328, -0.00019787, -0.0002127]
+  - [-0.00075643, 6.567e-05, -0.00041069]
+  - [0.00028032, 0.00030979, -0.00039294]
+  - [0.00093224, 0.00033099, -0.00017231]
+  - [0.00085249, 8.9964e-05, 0.0001084]
+  - [0.00021756, -0.0002401, 0.00027097]
+  - [-0.00043186, -0.00038632, 0.00021842]
+  - [-0.00059981, -0.00017661, -5.3129e-06]
+  - [-0.00018225, 0.0003153, -0.00025112]
+  - [0.00049481, 0.00079004, -0.00036657]
+  - [0.000945, 0.00090219, -0.00028892]
+  - [0.00086621, 0.00048513, -6.6986e-05]
+  - [0.00036906, -0.00028899, 0.00017012]
+  - [-0.00021405, -0.0010194, 0.00033786]
+  - [-0.00064117, -0.0013644, 0.00045045]
+  - [-0.00084149, -0.0012406, 0.00054246]
+  - [-0.00080636, -0.00080673, 0.00057742]
+  - [-0.00054163, -0.00030449, 0.00047883]
+  - [-0.00014085, 9.0816e-05, 0.00025062]
+  - [0.00020645, 0.00032748, 2.2587e-05]
+  - [0.00039606, 0.00042477, -7.1076e-05]
+  - [0.00046421, 0.00045154, -3.5319e-06]
+  - [0.00045927, 0.00050805, 0.00014307]
+  - [0.00041221, 0.00062938, 0.00021518]
+  - [0.00032428, 0.00075855, 9.2604e-05]
+  - [0.00019112, 0.00078669, -0.0002217]
+  - [3.4831e-05, 0.00063167, -0.00059374]
+  - [-8.8526e-05, 0.00030183, -0.00084102]
+  - [-0.00011636, -9.7907e-05, -0.00084713]
+  - [-2.3143e-05, -0.00042194, -0.00062749]
+  - [0.00015297, -0.00056606, -0.00030374]
+  - [0.00032266, -0.0005232, -1.3704e-05]
+  - [0.00039221, -0.00037849, 0.00017119]
+  - [0.00031597, -0.00024908, 0.00026249]
+  - [0.00012212, -0.00020961, 0.00030531]
+  - [-0.00010306, -0.00025131, 0.00031688]
+  - [-0.00026154, -0.000299, 0.00027163]
+  - [-0.00029259, -0.00027061, 0.00014416]
+  - [-0.000198, -0.00013689, -3.495e-05]
+  - [-3.3834e-05, 5.8756e-05, -0.00017183]
+  - [0.00012171, 0.00023137, -0.00017006]
+  - [0.00020459, 0.00031205, -1.5488e-05]
+  - [0.00018864, 0.00029076, 0.00018992]
+  - [9.0619e-05, 0.00021548, 0.00028646]
+  - [-3.9992e-05, 0.00015062, 0.00017361]
+  - [-0.00013957, 0.00012675, -0.00010314]
+  - [-0.00015232, 0.00011888, -0.00037067]
+  - [-5.2034e-05, 6.9298e-05, -0.00044858]
+  - [0.00014165, -6.1556e-05, -0.00028559]
+  - [0.00036103, -0.00025352, -5.6164e-06]
+  - [0.00050974, -0.00042611, 0.00017901]
+  - [0.0005025, -0.00048282, 0.00012788]
+  - [0.00031031, -0.00037305, -0.0001142]
+  - [-1.2991e-05, -0.00013156, -0.00034072]
+  - [-0.00034329, 0.00013132, -0.00033198]
+  - [-0.00053914, 0.00028491, -1.9892e-05]
+  - [-0.00051235, 0.00024706, 0.00045446]
+  - [-0.00027822, 2.7433e-05, 0.00083498]
+  - [4.533e-05, -0.00027584, 0.0009199]
+  - [0.00028471, -0.0005081, 0.00068138]
+  - [0.00031968, -0.0005594, 0.00034871]
+  - [0.00017724, -0.00042893, 0.00014744]
+  - [-1.6195e-05, -0.00019955, 9.3372e-05]
+  - [-0.00015589, 3.0964e-05, 5.2417e-05]
+  - [-0.00023099, 0.00020411, -6.4328e-05]
+  - [-0.00028939, 0.00031064, -0.00021919]
+  - [-0.00035502, 0.00036863, -0.00033587]
+  - [-0.00039868, 0.00039829, -0.00039436]

core/dr-film/profiles/fujifilm_xtra_400.yaml

@@ -0,0 +1,453 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: fujifilm_xtra_400
+name: 'Fujifilm X-Tra 400'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+target_print: fujifilm_crystal_archive_typeii
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-4.38865, -4.19425, -2.02729]   # 380nm
+  - [-4.36119, -4.12743, -1.81374]   # 385nm
+  - [-4.33273, -4.05719, -1.57986]   # 390nm
+  - [-4.30322, -3.98325, -1.32258]   # 395nm
+  - [-4.27259, -3.90532, -1.03823]   # 400nm
+  - [-4.24079, -3.82305, -0.742603]   # 405nm
+  - [-4.20774, -3.73609, -0.614667]   # 410nm
+  - [-4.17336, -3.644, -0.551248]   # 415nm
+  - [-4.13759, -3.54634, -0.521058]   # 420nm
+  - [-4.10032, -3.44258, -0.509634]   # 425nm
+  - [-4.06147, -3.33212, -0.506458]   # 430nm
+  - [-4.02092, -3.21429, -0.504602]   # 435nm
+  - [-3.97858, -3.08834, -0.503705]   # 440nm
+  - [-3.93431, -2.95339, -0.501026]   # 445nm
+  - [-3.88798, -2.80845, -0.491563]   # 450nm
+  - [-3.83945, -2.65236, -0.468842]   # 455nm
+  - [-3.78855, -2.48378, -0.427724]   # 460nm
+  - [-3.7351, -2.30115, -0.360532]   # 465nm
+  - [-3.67891, -2.10264, -0.314344]   # 470nm
+  - [-3.61977, -1.88609, -0.322937]   # 475nm
+  - [-3.55743, -1.66204, -0.395587]   # 480nm
+  - [-3.49162, -1.45228, -0.588307]   # 485nm
+  - [-3.42206, -1.27844, -0.966605]   # 490nm
+  - [-3.3484, -1.13012, -1.67805]   # 495nm
+  - [-3.27028, -1.00757, -2.3471]   # 500nm
+  - [-3.18727, -0.927043, -2.95244]   # 505nm
+  - [-3.09891, -0.856777, -3.50274]   # 510nm
+  - [-3.00466, -0.800281, -4.00519]   # 515nm
+  - [-2.90391, -0.750453, -4.46576]   # 520nm
+  - [-2.79597, -0.672648, -4.8895]   # 525nm
+  - [-2.68003, -0.577175, -5.28063]   # 530nm
+  - [-2.55517, -0.485456, -5.6428]   # 535nm
+  - [-2.42032, -0.405656, -5.97909]   # 540nm
+  - [-2.27423, -0.338931, -6.29219]   # 545nm
+  - [-2.11544, -0.289217, -6.58442]   # 550nm
+  - [-1.94221, -0.261427, -6.8578]   # 555nm
+  - [-1.75249, -0.264028, -7.11409]   # 560nm
+  - [-1.54379, -0.303718, -7.35484]   # 565nm
+  - [-1.31313, -0.425622, -7.58144]   # 570nm
+  - [-1.07244, -0.734317, -7.79508]   # 575nm
+  - [-0.882812, -1.15024, -7.99686]   # 580nm
+  - [-0.717011, -1.6282, -8.18773]   # 585nm
+  - [-0.599759, -2.08148, -8.36856]   # 590nm
+  - [-0.504649, -2.49698, -8.54011]   # 595nm
+  - [-0.429596, -2.87924, -8.70308]   # 600nm
+  - [-0.378624, -3.2321, -8.8581]   # 605nm
+  - [-0.350262, -3.55882, -9.00575]   # 610nm
+  - [-0.336925, -3.8622, -9.14652]   # 615nm
+  - [-0.326672, -4.14466, -9.2809]   # 620nm
+  - [-0.319524, -4.40829, -9.4093]   # 625nm
+  - [-0.318332, -4.65491, -9.53212]   # 630nm
+  - [-0.328513, -4.88611, -9.64972]   # 635nm
+  - [-0.372299, -5.10331, -9.76241]   # 640nm
+  - [-0.538776, -5.30773, -9.8705]   # 645nm
+  - [-0.779935, -5.50046, -9.97428]   # 650nm
+  - [-1.03199, -5.68249, -10.074]   # 655nm
+  - [-1.2983, -5.85468, -10.1698]   # 660nm
+  - [-1.55342, -6.01781, -10.2621]   # 665nm
+  - [-1.79738, -6.17257, -10.3509]   # 670nm
+  - [-2.0181, -6.3196, -10.4365]   # 675nm
+  - [-2.21876, -6.45945, -10.5191]   # 680nm
+  - [-2.40196, -6.59264, -10.5987]   # 685nm
+  - [-2.5699, -6.71964, -10.6756]   # 690nm
+  - [-2.72441, -6.84086, -10.7499]   # 695nm
+  - [-2.86703, -6.9567, -10.8217]   # 700nm
+  - [-2.99909, -7.0675, -10.8912]   # 705nm
+  - [-3.12171, -7.17359, -10.9584]   # 710nm
+  - [-3.23588, -7.27525, -11.0235]   # 715nm
+  - [-3.34243, -7.37277, -11.0866]   # 720nm
+  - [-3.44211, -7.46638, -11.1477]   # 725nm
+  - [-3.53556, -7.55633, -11.2069]   # 730nm
+  - [-3.62335, -7.64281, -11.2644]   # 735nm
+  - [-3.70597, -7.72603, -11.3202]   # 740nm
+  - [-3.78387, -7.80617, -11.3744]   # 745nm
+  - [-3.85745, -7.8834, -11.4271]   # 750nm
+  - [-3.92705, -7.95786, -11.4782]   # 755nm
+  - [-3.99298, -8.02972, -11.528]   # 760nm
+  - [-4.05553, -8.09909, -11.5763]   # 765nm
+  - [-4.11496, -8.16612, -11.6234]   # 770nm
+  - [-4.17148, -8.23091, -11.6692]   # 775nm
+  - [-4.22532, -8.29357, -11.7138]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0.222857, 0.0732304, 0.210496]   # 385nm
+  - [0.1836, 0.0663671, 0.296593]   # 390nm
+  - [0.144481, 0.0584631, 0.381601]   # 395nm
+  - [0.106515, 0.0497767, 0.469805]   # 400nm
+  - [0.0707021, 0.0408295, 0.563757]   # 405nm
+  - [0.0383167, 0.0321522, 0.662611]   # 410nm
+  - [0.0108064, 0.0239874, 0.763544]   # 415nm
+  - [-0.0105008, 0.0161607, 0.863165]   # 420nm
+  - [-0.0246604, 0.00822761, 0.957597]   # 425nm
+  - [-0.0314231, -0.000208947, 1.04222]   # 430nm
+  - [-0.0313872, -0.00918302, 1.11207]   # 435nm
+  - [-0.0258609, -0.018075, 1.16292]   # 440nm
+  - [-0.0165886, -0.025369, 1.19202]   # 445nm
+  - [-0.00543822, -0.0286668, 1.19759]   # 450nm
+  - [0.00591591, -0.0252879, 1.17828]   # 455nm
+  - [0.0162112, -0.0132668, 1.13351]   # 460nm
+  - [0.024653, 0.00823095, 1.0642]   # 465nm
+  - [0.0308451, 0.0398857, 0.973202]   # 470nm
+  - [0.0346695, 0.0835264, 0.865355]   # 475nm
+  - [0.0362171, 0.141733, 0.74699]   # 480nm
+  - [0.0357123, 0.215914, 0.624896]   # 485nm
+  - [0.0334214, 0.305395, 0.505029]   # 490nm
+  - [0.0295551, 0.408113, 0.392105]   # 495nm
+  - [0.0242436, 0.521275, 0.290072]   # 500nm
+  - [0.017624, 0.641022, 0.20217]   # 505nm
+  - [0.00996428, 0.762284, 0.13043]   # 510nm
+  - [0.00170299, 0.879801, 0.0752484]   # 515nm
+  - [-0.00659919, 0.989197, 0.0355036]   # 520nm
+  - [-0.0143022, 1.08703, 0.00905612]   # 525nm
+  - [-0.0206663, 1.17018, -0.00664406]   # 530nm
+  - [-0.0247841, 1.23496, -0.0140237]   # 535nm
+  - [-0.025552, 1.27676, -0.0152636]   # 540nm
+  - [-0.0217759, 1.29161, -0.0124342]   # 545nm
+  - [-0.012344, 1.27808, -0.00748786]   # 550nm
+  - [0.00372297, 1.23749, -0.00195166]   # 555nm
+  - [0.0272996, 1.17235, 0.00323949]   # 560nm
+  - [0.0590749, 1.08548, 0.00761413]   # 565nm
+  - [0.0993119, 0.980649, 0.0109788]   # 570nm
+  - [0.147578, 0.863617, 0.0133374]   # 575nm
+  - [0.202633, 0.74216, 0.0148713]   # 580nm
+  - [0.262633, 0.624435, 0.0158757]   # 585nm
+  - [0.325724, 0.516634, 0.016591]   # 590nm
+  - [0.390554, 0.422011, 0.0170299]   # 595nm
+  - [0.456294, 0.341727, 0.0169743]   # 600nm
+  - [0.522326, 0.275784, 0.0161441]   # 605nm
+  - [0.587938, 0.223202, 0.0143899]   # 610nm
+  - [0.652331, 0.181977, 0.0118381]   # 615nm
+  - [0.714945, 0.149426, 0.00892776]   # 620nm
+  - [0.775739, 0.122974, 0.00626222]   # 625nm
+  - [0.83503, 0.100901, 0.00428799]   # 630nm
+  - [0.892968, 0.0823296, 0.0030565]   # 635nm
+  - [0.949244, 0.06678, 0.00233122]   # 640nm
+  - [1.00339, 0.0539257, 0.00184422]   # 645nm
+  - [1.05519, 0.0435951, 0.0014387]   # 650nm
+  - [1.10467, 0.0357793, 0.00106805]   # 655nm
+  - [1.15171, 0.0305464, 0.000739508]   # 660nm
+  - [1.19565, 0.0278597, 0.000468868]   # 665nm
+  - [1.2352, 0.0274199, 0.00026172]   # 670nm
+  - [1.2688, 0.0286469, 0.000111234]   # 675nm
+  - [1.29539, 0.0308117, 1.88206e-06]   # 680nm
+  - [1.31483, 0.0332177, -1.49903e-09]   # 685nm
+  - [1.32768, 0.0353511, -5.12292e-10]   # 690nm
+  - [1.3342, 0.0369464, -1.69837e-10]   # 695nm
+  - [1.33373, 0.0379395, -5.46205e-11]   # 700nm
+  - [1.32494, 0.0383508, -1.70407e-11]   # 705nm
+  - [1.30654, 0.0382531, -5.15739e-12]   # 710nm
+  - [1.27792, 0.037777, -1.51419e-12]   # 715nm
+  - [1.23946, 0.0370649, -4.31261e-13]   # 720nm
+  - [1.19244, 0.0362405, -1.19154e-13]   # 725nm
+  - [1.13855, 0.0354007, 8.39336e-05]   # 730nm
+  - [1.07941, 0.0346195, 0.000203042]   # 735nm
+  - [1.01631, 0.033957, 0.000259093]   # 740nm
+  - [0.950466, 0.0334664, 0.00021304]   # 745nm
+  - [0, 0.0332, 2.53831e-05]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0, 0, 0, 0, 0, 0.848553, 0.827517, 0.819464, 0.823125, 0.833258, 0.842166, 0.848946, 0.849583, 0.842719, 0.833291, 0.8224, 0.80986, 0.795933, 0.781364, 0.765776, 0.750072, 0.733818, 0.717994, 0.701974, 0.687197, 0.674231, 0.663412, 0.654042, 0.645163, 0.63596, 0.626271, 0.615854, 0.604626, 0.592353, 0.579418, 0.566238, 0.552306, 0.534826, 0.504085, 0.467685, 0.429387, 0.391086, 0.353535, 0.318547, 0.287102, 0.262974, 0.250192, 0.24397, 0.240039, 0.239892, 0.241816, 0.245818, 0.25127, 0.257803, 0.265157, 0.272354, 0.279618, 0.283315, 0.281583, 0.276365, 0.269959, 0.262804, 0.255661, 0.248294, 0.240291, 0.23244, 0.22412, 0.215489, 0.207355, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.0006236, -0.00080906, -0.00082678]
+  - [-0.00046664, -0.00066677, -0.0007417]
+  - [-0.00022623, -0.00042245, -0.00059259]
+  - [3.7008e-05, -0.00016846, -0.00040163]
+  - [0.00026863, -1.0513e-05, -0.0001715]
+  - [0.00045523, 1.277e-05, 8.5916e-05]
+  - [0.00063244, -2.0835e-05, 0.0003126]
+  - [0.00084724, 2.0772e-05, 0.0004233]
+  - [0.0011044, 0.00019158, 0.0003768]
+  - [0.001353, 0.00040388, 0.00022179]
+  - [0.0015324, 0.00050991, 5.9035e-05]
+  - [0.0016284, 0.00044275, -4.2241e-05]
+  - [0.0016624, 0.00024912, -6.1931e-05]
+  - [0.0016852, 4.5503e-05, -1.6017e-05]
+  - [0.0017526, -5.8042e-05, 6.9195e-05]
+  - [0.0019035, -1.9084e-05, 0.00017446]
+  - [0.0021565, 0.00012902, 0.0002836]
+  - [0.0025201, 0.00031566, 0.00036951]
+  - [0.0030003, 0.00048013, 0.00039248]
+  - [0.0035939, 0.00059285, 0.0003218]
+  - [0.0042718, 0.00064656, 0.00016681]
+  - [0.0049714, 0.00064105, -1.0867e-05]
+  - [0.005617, 0.00058452, -0.00012238]
+  - [0.006163, 0.00051029, -0.00010367]
+  - [0.0066359, 0.00048386, 4.0655e-05]
+  - [0.0071409, 0.00057853, 0.00023572]
+  - [0.0078216, 0.00082654, 0.00038279]
+  - [0.0087877, 0.0011832, 0.00042406]
+  - [0.010057, 0.0015411, 0.00038058]
+  - [0.011545, 0.0017982, 0.00033619]
+  - [0.013124, 0.0019352, 0.00037847]
+  - [0.014695, 0.0020432, 0.00053807]
+  - [0.016259, 0.0022725, 0.00076861]
+  - [0.017909, 0.0027281, 0.00097907]
+  - [0.019781, 0.0033869, 0.0010942]
+  - [0.021973, 0.0040998, 0.0011008]
+  - [0.024495, 0.0046853, 0.0010517]
+  - [0.027278, 0.0050554, 0.0010304]
+  - [0.030222, 0.0052872, 0.001106]
+  - [0.033259, 0.005589, 0.0013071]
+  - [0.036396, 0.0061813, 0.0016247]
+  - [0.0397, 0.0071707, 0.0020313]
+  - [0.043277, 0.0084992, 0.0024944]
+  - [0.047228, 0.009994, 0.0029779]
+  - [0.051625, 0.011478, 0.0034413]
+  - [0.056493, 0.012867, 0.0038505]
+  - [0.061797, 0.014193, 0.0042044]
+  - [0.067437, 0.015566, 0.0045575]
+  - [0.073262, 0.017106, 0.0050152]
+  - [0.079123, 0.01891, 0.0056873]
+  - [0.084952, 0.021023, 0.006608]
+  - [0.090888, 0.023463, 0.0077542]
+  - [0.097263, 0.026282, 0.0091107]
+  - [0.1044, 0.029495, 0.010647]
+  - [0.11234, 0.032966, 0.012257]
+  - [0.1208, 0.036414, 0.013807]
+  - [0.12945, 0.039629, 0.015281]
+  - [0.13815, 0.042722, 0.016866]
+  - [0.14702, 0.046166, 0.018834]
+  - [0.1562, 0.050467, 0.021278]
+  - [0.16588, 0.055863, 0.024055]
+  - [0.17625, 0.062183, 0.026932]
+  - [0.18739, 0.068942, 0.029767]
+  - [0.19926, 0.075661, 0.032608]
+  - [0.21157, 0.082171, 0.035649]
+  - [0.22392, 0.088685, 0.03909]
+  - [0.23591, 0.095585, 0.043018]
+  - [0.2474, 0.10308, 0.047413]
+  - [0.25869, 0.11101, 0.05224]
+  - [0.27039, 0.11901, 0.05755]
+  - [0.28316, 0.12688, 0.063466]
+  - [0.29729, 0.13483, 0.070056]
+  - [0.31249, 0.14351, 0.077202]
+  - [0.32799, 0.15352, 0.084602]
+  - [0.34297, 0.165, 0.091945]
+  - [0.35708, 0.17742, 0.099147]
+  - [0.37061, 0.18994, 0.10648]
+  - [0.3843, 0.20195, 0.11445]
+  - [0.39884, 0.21352, 0.12356]
+  - [0.41441, 0.22526, 0.13398]
+  - [0.43065, 0.23782, 0.14547]
+  - [0.44692, 0.25135, 0.15761]
+  - [0.4628, 0.26536, 0.16998]
+  - [0.47831, 0.27914, 0.18245]
+  - [0.49381, 0.29247, 0.19507]
+  - [0.50958, 0.30586, 0.20797]
+  - [0.52552, 0.32026, 0.22122]
+  - [0.54118, 0.33639, 0.23488]
+  - [0.55615, 0.35398, 0.24904]
+  - [0.57047, 0.37177, 0.26385]
+  - [0.58465, 0.38838, 0.27955]
+  - [0.59936, 0.40335, 0.29639]
+  - [0.615, 0.41741, 0.31451]
+  - [0.63144, 0.43197, 0.33364]
+  - [0.64818, 0.44806, 0.35305]
+  - [0.66461, 0.46574, 0.37194]
+  - [0.68037, 0.48419, 0.39005]
+  - [0.69547, 0.50232, 0.40785]
+  - [0.71024, 0.51952, 0.42604]
+  - [0.72496, 0.53595, 0.44511]
+  - [0.73965, 0.55231, 0.46509]
+  - [0.75408, 0.56916, 0.48568]
+  - [0.76812, 0.58649, 0.5066]
+  - [0.78198, 0.60375, 0.52784]
+  - [0.79627, 0.62035, 0.54956]
+  - [0.81164, 0.63614, 0.57179]
+  - [0.82835, 0.65158, 0.59421]
+  - [0.84596, 0.66741, 0.61622]
+  - [0.86352, 0.6841, 0.63738]
+  - [0.88007, 0.70153, 0.65776]
+  - [0.89514, 0.71918, 0.67801]
+  - [0.90904, 0.73646, 0.699]
+  - [0.9226, 0.75306, 0.72119]
+  - [0.93667, 0.76901, 0.74436]
+  - [0.95164, 0.78445, 0.76775]
+  - [0.96751, 0.79963, 0.79039]
+  - [0.98403, 0.81482, 0.81163]
+  - [1.0008, 0.82999, 0.83162]
+  - [1.0173, 0.84471, 0.8515]
+  - [1.0331, 0.8587, 0.8726]
+  - [1.0486, 0.87255, 0.89526]
+  - [1.0646, 0.88753, 0.91852]
+  - [1.0815, 0.9043, 0.94101]
+  - [1.0989, 0.92197, 0.96216]
+  - [1.116, 0.93888, 0.98251]
+  - [1.132, 0.95383, 1.003]
+  - [1.1472, 0.96689, 1.0242]
+  - [1.1625, 0.97942, 1.0458]
+  - [1.1789, 0.99312, 1.0668]
+  - [1.1967, 1.0089, 1.0865]
+  - [1.2154, 1.0262, 1.1051]
+  - [1.2341, 1.0437, 1.1234]
+  - [1.252, 1.0601, 1.1425]
+  - [1.269, 1.0751, 1.1627]
+  - [1.2856, 1.0894, 1.1836]
+  - [1.3023, 1.1044, 1.2044]
+  - [1.3192, 1.1206, 1.2245]
+  - [1.3362, 1.1377, 1.2443]
+  - [1.3531, 1.1552, 1.2647]
+  - [1.3697, 1.1723, 1.2864]
+  - [1.3859, 1.1888, 1.3089]
+  - [1.4022, 1.2045, 1.3308]
+  - [1.4189, 1.2196, 1.351]
+  - [1.4362, 1.2346, 1.3693]
+  - [1.4538, 1.2497, 1.3867]
+  - [1.4711, 1.265, 1.4046]
+  - [1.4879, 1.2805, 1.4241]
+  - [1.5044, 1.2962, 1.4455]
+  - [1.5211, 1.3124, 1.468]
+  - [1.5381, 1.3291, 1.4903]
+  - [1.5552, 1.3464, 1.5118]
+  - [1.5721, 1.3639, 1.5325]
+  - [1.5885, 1.3812, 1.5529]
+  - [1.6046, 1.3981, 1.5739]
+  - [1.6205, 1.4149, 1.5953]
+  - [1.6363, 1.4318, 1.617]
+  - [1.6518, 1.449, 1.6383]
+  - [1.6666, 1.4662, 1.6589]
+  - [1.6807, 1.4832, 1.6791]
+  - [1.6948, 1.4998, 1.6995]
+  - [1.7095, 1.5163, 1.7209]
+  - [1.725, 1.5329, 1.7435]
+  - [1.741, 1.5503, 1.767]
+  - [1.7567, 1.5684, 1.7907]
+  - [1.7709, 1.5868, 1.8139]
+  - [1.7832, 1.6047, 1.8363]
+  - [1.7946, 1.6215, 1.8584]
+  - [1.8063, 1.6369, 1.8807]
+  - [1.8193, 1.6516, 1.9032]
+  - [1.833, 1.6663, 1.9256]
+  - [1.8463, 1.6816, 1.9473]
+  - [1.858, 1.6975, 1.9683]
+  - [1.8685, 1.7138, 1.9887]
+  - [1.8785, 1.7301, 2.0091]
+  - [1.8892, 1.7462, 2.03]
+  - [1.9007, 1.7618, 2.0518]
+  - [1.9122, 1.7767, 2.0741]
+  - [1.9225, 1.7909, 2.0964]
+  - [1.9312, 1.8045, 2.1181]
+  - [1.9388, 1.8182, 2.1389]
+  - [1.9466, 1.8324, 2.1591]
+  - [1.9556, 1.8472, 2.1791]
+  - [1.9656, 1.8623, 2.1994]
+  - [1.9754, 1.8771, 2.2202]
+  - [1.9837, 1.8908, 2.2411]
+  - [1.9901, 1.9035, 2.2616]
+  - [1.9954, 1.9156, 2.2811]
+  - [2.0009, 1.9278, 2.2996]
+  - [2.0079, 1.9404, 2.3175]
+  - [2.0162, 1.9534, 2.3355]
+  - [2.0247, 1.966, 2.3539]
+  - [2.032, 1.9777, 2.3727]
+  - [2.0376, 1.9882, 2.3915]
+  - [2.0419, 1.9983, 2.4094]
+  - [2.0459, 2.0086, 2.4263]
+  - [2.0507, 2.0197, 2.4423]
+  - [2.0563, 2.0313, 2.458]
+  - [2.0621, 2.0424, 2.4737]
+  - [2.0672, 2.0523, 2.4896]
+  - [2.0712, 2.0605, 2.5057]
+  - [2.0743, 2.0675, 2.5214]
+  - [2.0771, 2.0744, 2.5365]
+  - [2.08, 2.0821, 2.551]
+  - [2.0831, 2.0906, 2.5651]
+  - [2.0864, 2.0996, 2.5787]
+  - [2.0898, 2.1084, 2.5915]
+  - [2.0933, 2.1167, 2.6036]
+  - [2.0965, 2.1243, 2.6153]
+  - [2.0993, 2.1313, 2.627]
+  - [2.1018, 2.1379, 2.6388]
+  - [2.104, 2.1443, 2.6504]
+  - [2.1061, 2.1505, 2.6614]
+  - [2.1079, 2.1565, 2.6716]
+  - [2.1096, 2.1621, 2.6809]
+  - [2.1112, 2.1671, 2.6898]
+  - [2.1126, 2.1715, 2.6987]
+  - [2.1141, 2.1756, 2.7078]
+  - [2.1157, 2.1796, 2.717]
+  - [2.1172, 2.1837, 2.726]
+  - [2.1187, 2.188, 2.7346]
+  - [2.1199, 2.1923, 2.7427]
+  - [2.1209, 2.1963, 2.7502]
+  - [2.1217, 2.1999, 2.7573]
+  - [2.1224, 2.2032, 2.7641]
+  - [2.123, 2.2064, 2.7704]
+  - [2.1238, 2.2095, 2.7763]
+  - [2.1246, 2.2126, 2.7818]
+  - [2.1255, 2.2156, 2.7871]
+  - [2.1263, 2.2184, 2.7924]
+  - [2.127, 2.2209, 2.7977]
+  - [2.1275, 2.2231, 2.8028]
+  - [2.1279, 2.2252, 2.8074]
+  - [2.1282, 2.2271, 2.8115]
+  - [2.1285, 2.2289, 2.8152]
+  - [2.1289, 2.2307, 2.8186]
+  - [2.1293, 2.2323, 2.8221]
+  - [2.1299, 2.2336, 2.8258]
+  - [2.1304, 2.2348, 2.8294]
+  - [2.1308, 2.236, 2.8327]
+  - [2.1311, 2.2372, 2.8354]
+  - [2.1311, 2.2385, 2.8378]
+  - [2.1309, 2.2399, 2.84]
+  - [2.1308, 2.2412, 2.8424]
+  - [2.1308, 2.2423, 2.845]
+  - [2.1309, 2.2431, 2.8477]
+  - [2.1313, 2.2437, 2.8501]
+  - [2.1318, 2.2441, 2.852]
+  - [2.1321, 2.2445, 2.8533]
+  - [2.1323, 2.2451, 2.8545]
+  - [2.1322, 2.2458, 2.8557]
+  - [2.1321, 2.2466, 2.857]
+  - [2.132, 2.2474, 2.8582]
+  - [2.132, 2.248, 2.8592]
+  - [2.132, 2.2485, 2.8601]
+  - [2.132, 2.249, 2.861]
+  - [2.132, 2.2494, 2.8618]

core/dr-film/profiles/ilford_delta_100.yaml

@@ -0,0 +1,460 @@
+# Generated by tools/film-profiles/convert.py.
+#
+# *** CONSTRUCTED, NOT MEASURED. ***
+#
+# Ilford publish this film's spectral sensitivity and characteristic
+# curve as graphs, and no granularity figure at all, so this profile is
+# built rather than extracted. Its speed is the published ISO rating,
+# and its contrast is ISO 6:1993's normal development (average gradient
+# 0.62). Its spectral response is borrowed from Kodak Double-X, a
+# *measured* panchromatic negative, shifted by the speed difference.
+# Its granularity is an estimate, ordered against the other films here.
+#
+# So it renders as a film of this speed and contrast, not as a
+# measurement of this emulsion. Replace it outright if anyone digitises
+# the real curves.
+
+version: 'constructed-1'
+stock: ilford_delta_100
+name: 'Ilford Delta 100'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: true
+target_print: kodak_2302
+reference_illuminant: D55
+viewing_illuminant: D50
+
+rms_granularity: [6, 6, 6]
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm.
+log_sensitivity:
+  - [-9, -9, -9]   # 380nm
+  - [-9, -9, -9]   # 385nm
+  - [-9, -9, -9]   # 390nm
+  - [-9, -9, -9]   # 395nm
+  - [-9, -9, -9]   # 400nm
+  - [-9, -9, -9]   # 405nm
+  - [-9, -9, -9]   # 410nm
+  - [-9, -9, -9]   # 415nm
+  - [-9, -9, -9]   # 420nm
+  - [-1.11516, -1.11516, -1.11516]   # 425nm
+  - [-1.1149, -1.1149, -1.1149]   # 430nm
+  - [-1.1149, -1.1149, -1.1149]   # 435nm
+  - [-1.11525, -1.11525, -1.11525]   # 440nm
+  - [-1.12495, -1.12495, -1.12495]   # 445nm
+  - [-1.13768, -1.13768, -1.13768]   # 450nm
+  - [-1.15447, -1.15447, -1.15447]   # 455nm
+  - [-1.17373, -1.17373, -1.17373]   # 460nm
+  - [-1.19518, -1.19518, -1.19518]   # 465nm
+  - [-1.21361, -1.21361, -1.21361]   # 470nm
+  - [-1.2395, -1.2395, -1.2395]   # 475nm
+  - [-1.26728, -1.26728, -1.26728]   # 480nm
+  - [-1.30522, -1.30522, -1.30522]   # 485nm
+  - [-1.34497, -1.34497, -1.34497]   # 490nm
+  - [-1.38465, -1.38465, -1.38465]   # 495nm
+  - [-1.41792, -1.41792, -1.41792]   # 500nm
+  - [-1.4332, -1.4332, -1.4332]   # 505nm
+  - [-1.43637, -1.43637, -1.43637]   # 510nm
+  - [-1.43566, -1.43566, -1.43566]   # 515nm
+  - [-1.42589, -1.42589, -1.42589]   # 520nm
+  - [-1.41287, -1.41287, -1.41287]   # 525nm
+  - [-1.3981, -1.3981, -1.3981]   # 530nm
+  - [-1.38014, -1.38014, -1.38014]   # 535nm
+  - [-1.36192, -1.36192, -1.36192]   # 540nm
+  - [-1.34305, -1.34305, -1.34305]   # 545nm
+  - [-1.32648, -1.32648, -1.32648]   # 550nm
+  - [-1.30871, -1.30871, -1.30871]   # 555nm
+  - [-1.29546, -1.29546, -1.29546]   # 560nm
+  - [-1.28805, -1.28805, -1.28805]   # 565nm
+  - [-1.28317, -1.28317, -1.28317]   # 570nm
+  - [-1.27961, -1.27961, -1.27961]   # 575nm
+  - [-1.28242, -1.28242, -1.28242]   # 580nm
+  - [-1.28885, -1.28885, -1.28885]   # 585nm
+  - [-1.29837, -1.29837, -1.29837]   # 590nm
+  - [-1.31101, -1.31101, -1.31101]   # 595nm
+  - [-1.32288, -1.32288, -1.32288]   # 600nm
+  - [-1.33805, -1.33805, -1.33805]   # 605nm
+  - [-1.35316, -1.35316, -1.35316]   # 610nm
+  - [-1.35819, -1.35819, -1.35819]   # 615nm
+  - [-1.34978, -1.34978, -1.34978]   # 620nm
+  - [-1.35875, -1.35875, -1.35875]   # 625nm
+  - [-1.38789, -1.38789, -1.38789]   # 630nm
+  - [-1.47825, -1.47825, -1.47825]   # 635nm
+  - [-1.66767, -1.66767, -1.66767]   # 640nm
+  - [-1.88331, -1.88331, -1.88331]   # 645nm
+  - [-2.13893, -2.13893, -2.13893]   # 650nm
+  - [-2.40079, -2.40079, -2.40079]   # 655nm
+  - [-2.66866, -2.66866, -2.66866]   # 660nm
+  - [-9, -9, -9]   # 665nm
+  - [-9, -9, -9]   # 670nm
+  - [-9, -9, -9]   # 675nm
+  - [-9, -9, -9]   # 680nm
+  - [-9, -9, -9]   # 685nm
+  - [-9, -9, -9]   # 690nm
+  - [-9, -9, -9]   # 695nm
+  - [-9, -9, -9]   # 700nm
+  - [-9, -9, -9]   # 705nm
+  - [-9, -9, -9]   # 710nm
+  - [-9, -9, -9]   # 715nm
+  - [-9, -9, -9]   # 720nm
+  - [-9, -9, -9]   # 725nm
+  - [-9, -9, -9]   # 730nm
+  - [-9, -9, -9]   # 735nm
+  - [-9, -9, -9]   # 740nm
+  - [-9, -9, -9]   # 745nm
+  - [-9, -9, -9]   # 750nm
+  - [-9, -9, -9]   # 755nm
+  - [-9, -9, -9]   # 760nm
+  - [-9, -9, -9]   # 765nm
+  - [-9, -9, -9]   # 770nm
+  - [-9, -9, -9]   # 775nm
+  - [-9, -9, -9]   # 780nm
+
+# Developed silver: neutral across the band.
+dye_density:
+  - [0.333333, 0.333333, 0.333333]   # 380nm
+  - [0.333333, 0.333333, 0.333333]   # 385nm
+  - [0.333333, 0.333333, 0.333333]   # 390nm
+  - [0.333333, 0.333333, 0.333333]   # 395nm
+  - [0.333333, 0.333333, 0.333333]   # 400nm
+  - [0.333333, 0.333333, 0.333333]   # 405nm
+  - [0.333333, 0.333333, 0.333333]   # 410nm
+  - [0.333333, 0.333333, 0.333333]   # 415nm
+  - [0.333333, 0.333333, 0.333333]   # 420nm
+  - [0.333333, 0.333333, 0.333333]   # 425nm
+  - [0.333333, 0.333333, 0.333333]   # 430nm
+  - [0.333333, 0.333333, 0.333333]   # 435nm
+  - [0.333333, 0.333333, 0.333333]   # 440nm
+  - [0.333333, 0.333333, 0.333333]   # 445nm
+  - [0.333333, 0.333333, 0.333333]   # 450nm
+  - [0.333333, 0.333333, 0.333333]   # 455nm
+  - [0.333333, 0.333333, 0.333333]   # 460nm
+  - [0.333333, 0.333333, 0.333333]   # 465nm
+  - [0.333333, 0.333333, 0.333333]   # 470nm
+  - [0.333333, 0.333333, 0.333333]   # 475nm
+  - [0.333333, 0.333333, 0.333333]   # 480nm
+  - [0.333333, 0.333333, 0.333333]   # 485nm
+  - [0.333333, 0.333333, 0.333333]   # 490nm
+  - [0.333333, 0.333333, 0.333333]   # 495nm
+  - [0.333333, 0.333333, 0.333333]   # 500nm
+  - [0.333333, 0.333333, 0.333333]   # 505nm
+  - [0.333333, 0.333333, 0.333333]   # 510nm
+  - [0.333333, 0.333333, 0.333333]   # 515nm
+  - [0.333333, 0.333333, 0.333333]   # 520nm
+  - [0.333333, 0.333333, 0.333333]   # 525nm
+  - [0.333333, 0.333333, 0.333333]   # 530nm
+  - [0.333333, 0.333333, 0.333333]   # 535nm
+  - [0.333333, 0.333333, 0.333333]   # 540nm
+  - [0.333333, 0.333333, 0.333333]   # 545nm
+  - [0.333333, 0.333333, 0.333333]   # 550nm
+  - [0.333333, 0.333333, 0.333333]   # 555nm
+  - [0.333333, 0.333333, 0.333333]   # 560nm
+  - [0.333333, 0.333333, 0.333333]   # 565nm
+  - [0.333333, 0.333333, 0.333333]   # 570nm
+  - [0.333333, 0.333333, 0.333333]   # 575nm
+  - [0.333333, 0.333333, 0.333333]   # 580nm
+  - [0.333333, 0.333333, 0.333333]   # 585nm
+  - [0.333333, 0.333333, 0.333333]   # 590nm
+  - [0.333333, 0.333333, 0.333333]   # 595nm
+  - [0.333333, 0.333333, 0.333333]   # 600nm
+  - [0.333333, 0.333333, 0.333333]   # 605nm
+  - [0.333333, 0.333333, 0.333333]   # 610nm
+  - [0.333333, 0.333333, 0.333333]   # 615nm
+  - [0.333333, 0.333333, 0.333333]   # 620nm
+  - [0.333333, 0.333333, 0.333333]   # 625nm
+  - [0.333333, 0.333333, 0.333333]   # 630nm
+  - [0.333333, 0.333333, 0.333333]   # 635nm
+  - [0.333333, 0.333333, 0.333333]   # 640nm
+  - [0.333333, 0.333333, 0.333333]   # 645nm
+  - [0.333333, 0.333333, 0.333333]   # 650nm
+  - [0.333333, 0.333333, 0.333333]   # 655nm
+  - [0.333333, 0.333333, 0.333333]   # 660nm
+  - [0.333333, 0.333333, 0.333333]   # 665nm
+  - [0.333333, 0.333333, 0.333333]   # 670nm
+  - [0.333333, 0.333333, 0.333333]   # 675nm
+  - [0.333333, 0.333333, 0.333333]   # 680nm
+  - [0.333333, 0.333333, 0.333333]   # 685nm
+  - [0.333333, 0.333333, 0.333333]   # 690nm
+  - [0.333333, 0.333333, 0.333333]   # 695nm
+  - [0.333333, 0.333333, 0.333333]   # 700nm
+  - [0.333333, 0.333333, 0.333333]   # 705nm
+  - [0.333333, 0.333333, 0.333333]   # 710nm
+  - [0.333333, 0.333333, 0.333333]   # 715nm
+  - [0.333333, 0.333333, 0.333333]   # 720nm
+  - [0.333333, 0.333333, 0.333333]   # 725nm
+  - [0.333333, 0.333333, 0.333333]   # 730nm
+  - [0.333333, 0.333333, 0.333333]   # 735nm
+  - [0.333333, 0.333333, 0.333333]   # 740nm
+  - [0.333333, 0.333333, 0.333333]   # 745nm
+  - [0.333333, 0.333333, 0.333333]   # 750nm
+  - [0.333333, 0.333333, 0.333333]   # 755nm
+  - [0.333333, 0.333333, 0.333333]   # 760nm
+  - [0.333333, 0.333333, 0.333333]   # 765nm
+  - [0.333333, 0.333333, 0.333333]   # 770nm
+  - [0.333333, 0.333333, 0.333333]   # 775nm
+  - [0.333333, 0.333333, 0.333333]   # 780nm
+
+# Base plus fog. No orange mask on a black-and-white film.
+base_density: [0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1]
+
+# The characteristic curve, parametric.
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [3.5129e-07, 3.5129e-07, 3.5129e-07]
+  - [4.2083e-07, 4.2083e-07, 4.2083e-07]
+  - [5.0412e-07, 5.0412e-07, 5.0412e-07]
+  - [6.039e-07, 6.039e-07, 6.039e-07]
+  - [7.2343e-07, 7.2343e-07, 7.2343e-07]
+  - [8.6662e-07, 8.6662e-07, 8.6662e-07]
+  - [1.0381e-06, 1.0381e-06, 1.0381e-06]
+  - [1.2436e-06, 1.2436e-06, 1.2436e-06]
+  - [1.4898e-06, 1.4898e-06, 1.4898e-06]
+  - [1.7846e-06, 1.7846e-06, 1.7846e-06]
+  - [2.1379e-06, 2.1379e-06, 2.1379e-06]
+  - [2.561e-06, 2.561e-06, 2.561e-06]
+  - [3.0679e-06, 3.0679e-06, 3.0679e-06]
+  - [3.6751e-06, 3.6751e-06, 3.6751e-06]
+  - [4.4025e-06, 4.4025e-06, 4.4025e-06]
+  - [5.2739e-06, 5.2739e-06, 5.2739e-06]
+  - [6.3177e-06, 6.3177e-06, 6.3177e-06]
+  - [7.5681e-06, 7.5681e-06, 7.5681e-06]
+  - [9.066e-06, 9.066e-06, 9.066e-06]
+  - [1.086e-05, 1.086e-05, 1.086e-05]
+  - [1.301e-05, 1.301e-05, 1.301e-05]
+  - [1.5585e-05, 1.5585e-05, 1.5585e-05]
+  - [1.8669e-05, 1.8669e-05, 1.8669e-05]
+  - [2.2364e-05, 2.2364e-05, 2.2364e-05]
+  - [2.6789e-05, 2.6789e-05, 2.6789e-05]
+  - [3.2091e-05, 3.2091e-05, 3.2091e-05]
+  - [3.8441e-05, 3.8441e-05, 3.8441e-05]
+  - [4.6048e-05, 4.6048e-05, 4.6048e-05]
+  - [5.516e-05, 5.516e-05, 5.516e-05]
+  - [6.6074e-05, 6.6074e-05, 6.6074e-05]
+  - [7.9146e-05, 7.9146e-05, 7.9146e-05]
+  - [9.4804e-05, 9.4804e-05, 9.4804e-05]
+  - [0.00011356, 0.00011356, 0.00011356]
+  - [0.00013602, 0.00013602, 0.00013602]
+  - [0.00016292, 0.00016292, 0.00016292]
+  - [0.00019513, 0.00019513, 0.00019513]
+  - [0.0002337, 0.0002337, 0.0002337]
+  - [0.00027989, 0.00027989, 0.00027989]
+  - [0.00033519, 0.00033519, 0.00033519]
+  - [0.00040139, 0.00040139, 0.00040139]
+  - [0.00048064, 0.00048064, 0.00048064]
+  - [0.00057548, 0.00057548, 0.00057548]
+  - [0.00068897, 0.00068897, 0.00068897]
+  - [0.00082475, 0.00082475, 0.00082475]
+  - [0.00098713, 0.00098713, 0.00098713]
+  - [0.0011813, 0.0011813, 0.0011813]
+  - [0.0014134, 0.0014134, 0.0014134]
+  - [0.0016906, 0.0016906, 0.0016906]
+  - [0.0020217, 0.0020217, 0.0020217]
+  - [0.0024167, 0.0024167, 0.0024167]
+  - [0.0028878, 0.0028878, 0.0028878]
+  - [0.0034491, 0.0034491, 0.0034491]
+  - [0.004117, 0.004117, 0.004117]
+  - [0.004911, 0.004911, 0.004911]
+  - [0.0058534, 0.0058534, 0.0058534]
+  - [0.0069701, 0.0069701, 0.0069701]
+  - [0.0082906, 0.0082906, 0.0082906]
+  - [0.0098485, 0.0098485, 0.0098485]
+  - [0.011681, 0.011681, 0.011681]
+  - [0.013831, 0.013831, 0.013831]
+  - [0.016344, 0.016344, 0.016344]
+  - [0.019268, 0.019268, 0.019268]
+  - [0.022655, 0.022655, 0.022655]
+  - [0.026559, 0.026559, 0.026559]
+  - [0.031032, 0.031032, 0.031032]
+  - [0.036126, 0.036126, 0.036126]
+  - [0.041886, 0.041886, 0.041886]
+  - [0.048352, 0.048352, 0.048352]
+  - [0.055556, 0.055556, 0.055556]
+  - [0.063518, 0.063518, 0.063518]
+  - [0.072247, 0.072247, 0.072247]
+  - [0.081739, 0.081739, 0.081739]
+  - [0.09198, 0.09198, 0.09198]
+  - [0.10294, 0.10294, 0.10294]
+  - [0.11459, 0.11459, 0.11459]
+  - [0.12687, 0.12687, 0.12687]
+  - [0.13975, 0.13975, 0.13975]
+  - [0.15317, 0.15317, 0.15317]
+  - [0.16707, 0.16707, 0.16707]
+  - [0.18141, 0.18141, 0.18141]
+  - [0.19613, 0.19613, 0.19613]
+  - [0.21119, 0.21119, 0.21119]
+  - [0.22653, 0.22653, 0.22653]
+  - [0.24214, 0.24214, 0.24214]
+  - [0.25796, 0.25796, 0.25796]
+  - [0.27396, 0.27396, 0.27396]
+  - [0.29013, 0.29013, 0.29013]
+  - [0.30643, 0.30643, 0.30643]
+  - [0.32284, 0.32284, 0.32284]
+  - [0.33935, 0.33935, 0.33935]
+  - [0.35595, 0.35595, 0.35595]
+  - [0.37261, 0.37261, 0.37261]
+  - [0.38933, 0.38933, 0.38933]
+  - [0.4061, 0.4061, 0.4061]
+  - [0.42291, 0.42291, 0.42291]
+  - [0.43975, 0.43975, 0.43975]
+  - [0.45663, 0.45663, 0.45663]
+  - [0.47352, 0.47352, 0.47352]
+  - [0.49044, 0.49044, 0.49044]
+  - [0.50737, 0.50737, 0.50737]
+  - [0.52432, 0.52432, 0.52432]
+  - [0.54128, 0.54128, 0.54128]
+  - [0.55825, 0.55825, 0.55825]
+  - [0.57523, 0.57523, 0.57523]
+  - [0.59222, 0.59222, 0.59222]
+  - [0.60921, 0.60921, 0.60921]
+  - [0.6262, 0.6262, 0.6262]
+  - [0.6432, 0.6432, 0.6432]
+  - [0.6602, 0.6602, 0.6602]
+  - [0.67721, 0.67721, 0.67721]
+  - [0.69422, 0.69422, 0.69422]
+  - [0.71123, 0.71123, 0.71123]
+  - [0.72824, 0.72824, 0.72824]
+  - [0.74525, 0.74525, 0.74525]
+  - [0.76226, 0.76226, 0.76226]
+  - [0.77928, 0.77928, 0.77928]
+  - [0.79629, 0.79629, 0.79629]
+  - [0.81331, 0.81331, 0.81331]
+  - [0.83033, 0.83033, 0.83033]
+  - [0.84734, 0.84734, 0.84734]
+  - [0.86436, 0.86436, 0.86436]
+  - [0.88138, 0.88138, 0.88138]
+  - [0.8984, 0.8984, 0.8984]
+  - [0.91542, 0.91542, 0.91542]
+  - [0.93244, 0.93244, 0.93244]
+  - [0.94945, 0.94945, 0.94945]
+  - [0.96647, 0.96647, 0.96647]
+  - [0.98349, 0.98349, 0.98349]
+  - [1.0005, 1.0005, 1.0005]
+  - [1.0175, 1.0175, 1.0175]
+  - [1.0345, 1.0345, 1.0345]
+  - [1.0516, 1.0516, 1.0516]
+  - [1.0686, 1.0686, 1.0686]
+  - [1.0856, 1.0856, 1.0856]
+  - [1.1026, 1.1026, 1.1026]
+  - [1.1196, 1.1196, 1.1196]
+  - [1.1367, 1.1367, 1.1367]
+  - [1.1537, 1.1537, 1.1537]
+  - [1.1707, 1.1707, 1.1707]
+  - [1.1877, 1.1877, 1.1877]
+  - [1.2047, 1.2047, 1.2047]
+  - [1.2218, 1.2218, 1.2218]
+  - [1.2388, 1.2388, 1.2388]
+  - [1.2558, 1.2558, 1.2558]
+  - [1.2728, 1.2728, 1.2728]
+  - [1.2898, 1.2898, 1.2898]
+  - [1.3068, 1.3068, 1.3068]
+  - [1.3239, 1.3239, 1.3239]
+  - [1.3409, 1.3409, 1.3409]
+  - [1.3579, 1.3579, 1.3579]
+  - [1.3749, 1.3749, 1.3749]
+  - [1.3919, 1.3919, 1.3919]
+  - [1.4089, 1.4089, 1.4089]
+  - [1.426, 1.426, 1.426]
+  - [1.443, 1.443, 1.443]
+  - [1.46, 1.46, 1.46]
+  - [1.477, 1.477, 1.477]
+  - [1.494, 1.494, 1.494]
+  - [1.511, 1.511, 1.511]
+  - [1.528, 1.528, 1.528]
+  - [1.545, 1.545, 1.545]
+  - [1.562, 1.562, 1.562]
+  - [1.579, 1.579, 1.579]
+  - [1.596, 1.596, 1.596]
+  - [1.613, 1.613, 1.613]
+  - [1.63, 1.63, 1.63]
+  - [1.647, 1.647, 1.647]
+  - [1.664, 1.664, 1.664]
+  - [1.681, 1.681, 1.681]
+  - [1.6979, 1.6979, 1.6979]
+  - [1.7149, 1.7149, 1.7149]
+  - [1.7319, 1.7319, 1.7319]
+  - [1.7488, 1.7488, 1.7488]
+  - [1.7657, 1.7657, 1.7657]
+  - [1.7827, 1.7827, 1.7827]
+  - [1.7996, 1.7996, 1.7996]
+  - [1.8165, 1.8165, 1.8165]
+  - [1.8333, 1.8333, 1.8333]
+  - [1.8502, 1.8502, 1.8502]
+  - [1.867, 1.867, 1.867]
+  - [1.8838, 1.8838, 1.8838]
+  - [1.9006, 1.9006, 1.9006]
+  - [1.9173, 1.9173, 1.9173]
+  - [1.934, 1.934, 1.934]
+  - [1.9506, 1.9506, 1.9506]
+  - [1.9672, 1.9672, 1.9672]
+  - [1.9837, 1.9837, 1.9837]
+  - [2.0001, 2.0001, 2.0001]
+  - [2.0165, 2.0165, 2.0165]
+  - [2.0327, 2.0327, 2.0327]
+  - [2.0489, 2.0489, 2.0489]
+  - [2.0649, 2.0649, 2.0649]
+  - [2.0807, 2.0807, 2.0807]
+  - [2.0965, 2.0965, 2.0965]
+  - [2.112, 2.112, 2.112]
+  - [2.1273, 2.1273, 2.1273]
+  - [2.1424, 2.1424, 2.1424]
+  - [2.1573, 2.1573, 2.1573]
+  - [2.1719, 2.1719, 2.1719]
+  - [2.1861, 2.1861, 2.1861]
+  - [2.2001, 2.2001, 2.2001]
+  - [2.2136, 2.2136, 2.2136]
+  - [2.2268, 2.2268, 2.2268]
+  - [2.2395, 2.2395, 2.2395]
+  - [2.2518, 2.2518, 2.2518]
+  - [2.2635, 2.2635, 2.2635]
+  - [2.2748, 2.2748, 2.2748]
+  - [2.2855, 2.2855, 2.2855]
+  - [2.2956, 2.2956, 2.2956]
+  - [2.3051, 2.3051, 2.3051]
+  - [2.3141, 2.3141, 2.3141]
+  - [2.3224, 2.3224, 2.3224]
+  - [2.3302, 2.3302, 2.3302]
+  - [2.3373, 2.3373, 2.3373]
+  - [2.3439, 2.3439, 2.3439]
+  - [2.3499, 2.3499, 2.3499]
+  - [2.3554, 2.3554, 2.3554]
+  - [2.3604, 2.3604, 2.3604]
+  - [2.3649, 2.3649, 2.3649]
+  - [2.369, 2.369, 2.369]
+  - [2.3726, 2.3726, 2.3726]
+  - [2.3759, 2.3759, 2.3759]
+  - [2.3788, 2.3788, 2.3788]
+  - [2.3814, 2.3814, 2.3814]
+  - [2.3836, 2.3836, 2.3836]
+  - [2.3857, 2.3857, 2.3857]
+  - [2.3875, 2.3875, 2.3875]
+  - [2.389, 2.389, 2.389]
+  - [2.3904, 2.3904, 2.3904]
+  - [2.3916, 2.3916, 2.3916]
+  - [2.3927, 2.3927, 2.3927]
+  - [2.3936, 2.3936, 2.3936]
+  - [2.3944, 2.3944, 2.3944]
+  - [2.3952, 2.3952, 2.3952]
+  - [2.3958, 2.3958, 2.3958]
+  - [2.3963, 2.3963, 2.3963]
+  - [2.3968, 2.3968, 2.3968]
+  - [2.3972, 2.3972, 2.3972]
+  - [2.3976, 2.3976, 2.3976]
+  - [2.3979, 2.3979, 2.3979]
+  - [2.3982, 2.3982, 2.3982]
+  - [2.3984, 2.3984, 2.3984]
+  - [2.3986, 2.3986, 2.3986]
+  - [2.3988, 2.3988, 2.3988]
+  - [2.3989, 2.3989, 2.3989]
+  - [2.3991, 2.3991, 2.3991]
+  - [2.3992, 2.3992, 2.3992]
+  - [2.3993, 2.3993, 2.3993]
+  - [2.3994, 2.3994, 2.3994]
+  - [2.3995, 2.3995, 2.3995]
+  - [2.3995, 2.3995, 2.3995]
+  - [2.3996, 2.3996, 2.3996]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3998, 2.3998, 2.3998]

core/dr-film/profiles/ilford_delta_400.yaml

@@ -0,0 +1,460 @@
+# Generated by tools/film-profiles/convert.py.
+#
+# *** CONSTRUCTED, NOT MEASURED. ***
+#
+# Ilford publish this film's spectral sensitivity and characteristic
+# curve as graphs, and no granularity figure at all, so this profile is
+# built rather than extracted. Its speed is the published ISO rating,
+# and its contrast is ISO 6:1993's normal development (average gradient
+# 0.62). Its spectral response is borrowed from Kodak Double-X, a
+# *measured* panchromatic negative, shifted by the speed difference.
+# Its granularity is an estimate, ordered against the other films here.
+#
+# So it renders as a film of this speed and contrast, not as a
+# measurement of this emulsion. Replace it outright if anyone digitises
+# the real curves.
+
+version: 'constructed-1'
+stock: ilford_delta_400
+name: 'Ilford Delta 400'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: true
+target_print: kodak_2302
+reference_illuminant: D55
+viewing_illuminant: D50
+
+rms_granularity: [9, 9, 9]
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm.
+log_sensitivity:
+  - [-9, -9, -9]   # 380nm
+  - [-9, -9, -9]   # 385nm
+  - [-9, -9, -9]   # 390nm
+  - [-9, -9, -9]   # 395nm
+  - [-9, -9, -9]   # 400nm
+  - [-9, -9, -9]   # 405nm
+  - [-9, -9, -9]   # 410nm
+  - [-9, -9, -9]   # 415nm
+  - [-9, -9, -9]   # 420nm
+  - [-0.513098, -0.513098, -0.513098]   # 425nm
+  - [-0.51284, -0.51284, -0.51284]   # 430nm
+  - [-0.51284, -0.51284, -0.51284]   # 435nm
+  - [-0.51319, -0.51319, -0.51319]   # 440nm
+  - [-0.522893, -0.522893, -0.522893]   # 445nm
+  - [-0.53562, -0.53562, -0.53562]   # 450nm
+  - [-0.552412, -0.552412, -0.552412]   # 455nm
+  - [-0.571665, -0.571665, -0.571665]   # 460nm
+  - [-0.593122, -0.593122, -0.593122]   # 465nm
+  - [-0.611553, -0.611553, -0.611553]   # 470nm
+  - [-0.637438, -0.637438, -0.637438]   # 475nm
+  - [-0.665217, -0.665217, -0.665217]   # 480nm
+  - [-0.703161, -0.703161, -0.703161]   # 485nm
+  - [-0.742909, -0.742909, -0.742909]   # 490nm
+  - [-0.782594, -0.782594, -0.782594]   # 495nm
+  - [-0.815861, -0.815861, -0.815861]   # 500nm
+  - [-0.831143, -0.831143, -0.831143]   # 505nm
+  - [-0.834309, -0.834309, -0.834309]   # 510nm
+  - [-0.833599, -0.833599, -0.833599]   # 515nm
+  - [-0.823829, -0.823829, -0.823829]   # 520nm
+  - [-0.810809, -0.810809, -0.810809]   # 525nm
+  - [-0.796036, -0.796036, -0.796036]   # 530nm
+  - [-0.778081, -0.778081, -0.778081]   # 535nm
+  - [-0.759864, -0.759864, -0.759864]   # 540nm
+  - [-0.740987, -0.740987, -0.740987]   # 545nm
+  - [-0.724425, -0.724425, -0.724425]   # 550nm
+  - [-0.706653, -0.706653, -0.706653]   # 555nm
+  - [-0.693404, -0.693404, -0.693404]   # 560nm
+  - [-0.685993, -0.685993, -0.685993]   # 565nm
+  - [-0.68111, -0.68111, -0.68111]   # 570nm
+  - [-0.677547, -0.677547, -0.677547]   # 575nm
+  - [-0.680358, -0.680358, -0.680358]   # 580nm
+  - [-0.686794, -0.686794, -0.686794]   # 585nm
+  - [-0.696308, -0.696308, -0.696308]   # 590nm
+  - [-0.708955, -0.708955, -0.708955]   # 595nm
+  - [-0.720822, -0.720822, -0.720822]   # 600nm
+  - [-0.735995, -0.735995, -0.735995]   # 605nm
+  - [-0.751102, -0.751102, -0.751102]   # 610nm
+  - [-0.75613, -0.75613, -0.75613]   # 615nm
+  - [-0.747716, -0.747716, -0.747716]   # 620nm
+  - [-0.756689, -0.756689, -0.756689]   # 625nm
+  - [-0.785834, -0.785834, -0.785834]   # 630nm
+  - [-0.876194, -0.876194, -0.876194]   # 635nm
+  - [-1.06561, -1.06561, -1.06561]   # 640nm
+  - [-1.28125, -1.28125, -1.28125]   # 645nm
+  - [-1.53687, -1.53687, -1.53687]   # 650nm
+  - [-1.79873, -1.79873, -1.79873]   # 655nm
+  - [-2.0666, -2.0666, -2.0666]   # 660nm
+  - [-9, -9, -9]   # 665nm
+  - [-9, -9, -9]   # 670nm
+  - [-9, -9, -9]   # 675nm
+  - [-9, -9, -9]   # 680nm
+  - [-9, -9, -9]   # 685nm
+  - [-9, -9, -9]   # 690nm
+  - [-9, -9, -9]   # 695nm
+  - [-9, -9, -9]   # 700nm
+  - [-9, -9, -9]   # 705nm
+  - [-9, -9, -9]   # 710nm
+  - [-9, -9, -9]   # 715nm
+  - [-9, -9, -9]   # 720nm
+  - [-9, -9, -9]   # 725nm
+  - [-9, -9, -9]   # 730nm
+  - [-9, -9, -9]   # 735nm
+  - [-9, -9, -9]   # 740nm
+  - [-9, -9, -9]   # 745nm
+  - [-9, -9, -9]   # 750nm
+  - [-9, -9, -9]   # 755nm
+  - [-9, -9, -9]   # 760nm
+  - [-9, -9, -9]   # 765nm
+  - [-9, -9, -9]   # 770nm
+  - [-9, -9, -9]   # 775nm
+  - [-9, -9, -9]   # 780nm
+
+# Developed silver: neutral across the band.
+dye_density:
+  - [0.333333, 0.333333, 0.333333]   # 380nm
+  - [0.333333, 0.333333, 0.333333]   # 385nm
+  - [0.333333, 0.333333, 0.333333]   # 390nm
+  - [0.333333, 0.333333, 0.333333]   # 395nm
+  - [0.333333, 0.333333, 0.333333]   # 400nm
+  - [0.333333, 0.333333, 0.333333]   # 405nm
+  - [0.333333, 0.333333, 0.333333]   # 410nm
+  - [0.333333, 0.333333, 0.333333]   # 415nm
+  - [0.333333, 0.333333, 0.333333]   # 420nm
+  - [0.333333, 0.333333, 0.333333]   # 425nm
+  - [0.333333, 0.333333, 0.333333]   # 430nm
+  - [0.333333, 0.333333, 0.333333]   # 435nm
+  - [0.333333, 0.333333, 0.333333]   # 440nm
+  - [0.333333, 0.333333, 0.333333]   # 445nm
+  - [0.333333, 0.333333, 0.333333]   # 450nm
+  - [0.333333, 0.333333, 0.333333]   # 455nm
+  - [0.333333, 0.333333, 0.333333]   # 460nm
+  - [0.333333, 0.333333, 0.333333]   # 465nm
+  - [0.333333, 0.333333, 0.333333]   # 470nm
+  - [0.333333, 0.333333, 0.333333]   # 475nm
+  - [0.333333, 0.333333, 0.333333]   # 480nm
+  - [0.333333, 0.333333, 0.333333]   # 485nm
+  - [0.333333, 0.333333, 0.333333]   # 490nm
+  - [0.333333, 0.333333, 0.333333]   # 495nm
+  - [0.333333, 0.333333, 0.333333]   # 500nm
+  - [0.333333, 0.333333, 0.333333]   # 505nm
+  - [0.333333, 0.333333, 0.333333]   # 510nm
+  - [0.333333, 0.333333, 0.333333]   # 515nm
+  - [0.333333, 0.333333, 0.333333]   # 520nm
+  - [0.333333, 0.333333, 0.333333]   # 525nm
+  - [0.333333, 0.333333, 0.333333]   # 530nm
+  - [0.333333, 0.333333, 0.333333]   # 535nm
+  - [0.333333, 0.333333, 0.333333]   # 540nm
+  - [0.333333, 0.333333, 0.333333]   # 545nm
+  - [0.333333, 0.333333, 0.333333]   # 550nm
+  - [0.333333, 0.333333, 0.333333]   # 555nm
+  - [0.333333, 0.333333, 0.333333]   # 560nm
+  - [0.333333, 0.333333, 0.333333]   # 565nm
+  - [0.333333, 0.333333, 0.333333]   # 570nm
+  - [0.333333, 0.333333, 0.333333]   # 575nm
+  - [0.333333, 0.333333, 0.333333]   # 580nm
+  - [0.333333, 0.333333, 0.333333]   # 585nm
+  - [0.333333, 0.333333, 0.333333]   # 590nm
+  - [0.333333, 0.333333, 0.333333]   # 595nm
+  - [0.333333, 0.333333, 0.333333]   # 600nm
+  - [0.333333, 0.333333, 0.333333]   # 605nm
+  - [0.333333, 0.333333, 0.333333]   # 610nm
+  - [0.333333, 0.333333, 0.333333]   # 615nm
+  - [0.333333, 0.333333, 0.333333]   # 620nm
+  - [0.333333, 0.333333, 0.333333]   # 625nm
+  - [0.333333, 0.333333, 0.333333]   # 630nm
+  - [0.333333, 0.333333, 0.333333]   # 635nm
+  - [0.333333, 0.333333, 0.333333]   # 640nm
+  - [0.333333, 0.333333, 0.333333]   # 645nm
+  - [0.333333, 0.333333, 0.333333]   # 650nm
+  - [0.333333, 0.333333, 0.333333]   # 655nm
+  - [0.333333, 0.333333, 0.333333]   # 660nm
+  - [0.333333, 0.333333, 0.333333]   # 665nm
+  - [0.333333, 0.333333, 0.333333]   # 670nm
+  - [0.333333, 0.333333, 0.333333]   # 675nm
+  - [0.333333, 0.333333, 0.333333]   # 680nm
+  - [0.333333, 0.333333, 0.333333]   # 685nm
+  - [0.333333, 0.333333, 0.333333]   # 690nm
+  - [0.333333, 0.333333, 0.333333]   # 695nm
+  - [0.333333, 0.333333, 0.333333]   # 700nm
+  - [0.333333, 0.333333, 0.333333]   # 705nm
+  - [0.333333, 0.333333, 0.333333]   # 710nm
+  - [0.333333, 0.333333, 0.333333]   # 715nm
+  - [0.333333, 0.333333, 0.333333]   # 720nm
+  - [0.333333, 0.333333, 0.333333]   # 725nm
+  - [0.333333, 0.333333, 0.333333]   # 730nm
+  - [0.333333, 0.333333, 0.333333]   # 735nm
+  - [0.333333, 0.333333, 0.333333]   # 740nm
+  - [0.333333, 0.333333, 0.333333]   # 745nm
+  - [0.333333, 0.333333, 0.333333]   # 750nm
+  - [0.333333, 0.333333, 0.333333]   # 755nm
+  - [0.333333, 0.333333, 0.333333]   # 760nm
+  - [0.333333, 0.333333, 0.333333]   # 765nm
+  - [0.333333, 0.333333, 0.333333]   # 770nm
+  - [0.333333, 0.333333, 0.333333]   # 775nm
+  - [0.333333, 0.333333, 0.333333]   # 780nm
+
+# Base plus fog. No orange mask on a black-and-white film.
+base_density: [0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1]
+
+# The characteristic curve, parametric.
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [3.5129e-07, 3.5129e-07, 3.5129e-07]
+  - [4.2083e-07, 4.2083e-07, 4.2083e-07]
+  - [5.0412e-07, 5.0412e-07, 5.0412e-07]
+  - [6.039e-07, 6.039e-07, 6.039e-07]
+  - [7.2343e-07, 7.2343e-07, 7.2343e-07]
+  - [8.6662e-07, 8.6662e-07, 8.6662e-07]
+  - [1.0381e-06, 1.0381e-06, 1.0381e-06]
+  - [1.2436e-06, 1.2436e-06, 1.2436e-06]
+  - [1.4898e-06, 1.4898e-06, 1.4898e-06]
+  - [1.7846e-06, 1.7846e-06, 1.7846e-06]
+  - [2.1379e-06, 2.1379e-06, 2.1379e-06]
+  - [2.561e-06, 2.561e-06, 2.561e-06]
+  - [3.0679e-06, 3.0679e-06, 3.0679e-06]
+  - [3.6751e-06, 3.6751e-06, 3.6751e-06]
+  - [4.4025e-06, 4.4025e-06, 4.4025e-06]
+  - [5.2739e-06, 5.2739e-06, 5.2739e-06]
+  - [6.3177e-06, 6.3177e-06, 6.3177e-06]
+  - [7.5681e-06, 7.5681e-06, 7.5681e-06]
+  - [9.066e-06, 9.066e-06, 9.066e-06]
+  - [1.086e-05, 1.086e-05, 1.086e-05]
+  - [1.301e-05, 1.301e-05, 1.301e-05]
+  - [1.5585e-05, 1.5585e-05, 1.5585e-05]
+  - [1.8669e-05, 1.8669e-05, 1.8669e-05]
+  - [2.2364e-05, 2.2364e-05, 2.2364e-05]
+  - [2.6789e-05, 2.6789e-05, 2.6789e-05]
+  - [3.2091e-05, 3.2091e-05, 3.2091e-05]
+  - [3.8441e-05, 3.8441e-05, 3.8441e-05]
+  - [4.6048e-05, 4.6048e-05, 4.6048e-05]
+  - [5.516e-05, 5.516e-05, 5.516e-05]
+  - [6.6074e-05, 6.6074e-05, 6.6074e-05]
+  - [7.9146e-05, 7.9146e-05, 7.9146e-05]
+  - [9.4804e-05, 9.4804e-05, 9.4804e-05]
+  - [0.00011356, 0.00011356, 0.00011356]
+  - [0.00013602, 0.00013602, 0.00013602]
+  - [0.00016292, 0.00016292, 0.00016292]
+  - [0.00019513, 0.00019513, 0.00019513]
+  - [0.0002337, 0.0002337, 0.0002337]
+  - [0.00027989, 0.00027989, 0.00027989]
+  - [0.00033519, 0.00033519, 0.00033519]
+  - [0.00040139, 0.00040139, 0.00040139]
+  - [0.00048064, 0.00048064, 0.00048064]
+  - [0.00057548, 0.00057548, 0.00057548]
+  - [0.00068897, 0.00068897, 0.00068897]
+  - [0.00082475, 0.00082475, 0.00082475]
+  - [0.00098713, 0.00098713, 0.00098713]
+  - [0.0011813, 0.0011813, 0.0011813]
+  - [0.0014134, 0.0014134, 0.0014134]
+  - [0.0016906, 0.0016906, 0.0016906]
+  - [0.0020217, 0.0020217, 0.0020217]
+  - [0.0024167, 0.0024167, 0.0024167]
+  - [0.0028878, 0.0028878, 0.0028878]
+  - [0.0034491, 0.0034491, 0.0034491]
+  - [0.004117, 0.004117, 0.004117]
+  - [0.004911, 0.004911, 0.004911]
+  - [0.0058534, 0.0058534, 0.0058534]
+  - [0.0069701, 0.0069701, 0.0069701]
+  - [0.0082906, 0.0082906, 0.0082906]
+  - [0.0098485, 0.0098485, 0.0098485]
+  - [0.011681, 0.011681, 0.011681]
+  - [0.013831, 0.013831, 0.013831]
+  - [0.016344, 0.016344, 0.016344]
+  - [0.019268, 0.019268, 0.019268]
+  - [0.022655, 0.022655, 0.022655]
+  - [0.026559, 0.026559, 0.026559]
+  - [0.031032, 0.031032, 0.031032]
+  - [0.036126, 0.036126, 0.036126]
+  - [0.041886, 0.041886, 0.041886]
+  - [0.048352, 0.048352, 0.048352]
+  - [0.055556, 0.055556, 0.055556]
+  - [0.063518, 0.063518, 0.063518]
+  - [0.072247, 0.072247, 0.072247]
+  - [0.081739, 0.081739, 0.081739]
+  - [0.09198, 0.09198, 0.09198]
+  - [0.10294, 0.10294, 0.10294]
+  - [0.11459, 0.11459, 0.11459]
+  - [0.12687, 0.12687, 0.12687]
+  - [0.13975, 0.13975, 0.13975]
+  - [0.15317, 0.15317, 0.15317]
+  - [0.16707, 0.16707, 0.16707]
+  - [0.18141, 0.18141, 0.18141]
+  - [0.19613, 0.19613, 0.19613]
+  - [0.21119, 0.21119, 0.21119]
+  - [0.22653, 0.22653, 0.22653]
+  - [0.24214, 0.24214, 0.24214]
+  - [0.25796, 0.25796, 0.25796]
+  - [0.27396, 0.27396, 0.27396]
+  - [0.29013, 0.29013, 0.29013]
+  - [0.30643, 0.30643, 0.30643]
+  - [0.32284, 0.32284, 0.32284]
+  - [0.33935, 0.33935, 0.33935]
+  - [0.35595, 0.35595, 0.35595]
+  - [0.37261, 0.37261, 0.37261]
+  - [0.38933, 0.38933, 0.38933]
+  - [0.4061, 0.4061, 0.4061]
+  - [0.42291, 0.42291, 0.42291]
+  - [0.43975, 0.43975, 0.43975]
+  - [0.45663, 0.45663, 0.45663]
+  - [0.47352, 0.47352, 0.47352]
+  - [0.49044, 0.49044, 0.49044]
+  - [0.50737, 0.50737, 0.50737]
+  - [0.52432, 0.52432, 0.52432]
+  - [0.54128, 0.54128, 0.54128]
+  - [0.55825, 0.55825, 0.55825]
+  - [0.57523, 0.57523, 0.57523]
+  - [0.59222, 0.59222, 0.59222]
+  - [0.60921, 0.60921, 0.60921]
+  - [0.6262, 0.6262, 0.6262]
+  - [0.6432, 0.6432, 0.6432]
+  - [0.6602, 0.6602, 0.6602]
+  - [0.67721, 0.67721, 0.67721]
+  - [0.69422, 0.69422, 0.69422]
+  - [0.71123, 0.71123, 0.71123]
+  - [0.72824, 0.72824, 0.72824]
+  - [0.74525, 0.74525, 0.74525]
+  - [0.76226, 0.76226, 0.76226]
+  - [0.77928, 0.77928, 0.77928]
+  - [0.79629, 0.79629, 0.79629]
+  - [0.81331, 0.81331, 0.81331]
+  - [0.83033, 0.83033, 0.83033]
+  - [0.84734, 0.84734, 0.84734]
+  - [0.86436, 0.86436, 0.86436]
+  - [0.88138, 0.88138, 0.88138]
+  - [0.8984, 0.8984, 0.8984]
+  - [0.91542, 0.91542, 0.91542]
+  - [0.93244, 0.93244, 0.93244]
+  - [0.94945, 0.94945, 0.94945]
+  - [0.96647, 0.96647, 0.96647]
+  - [0.98349, 0.98349, 0.98349]
+  - [1.0005, 1.0005, 1.0005]
+  - [1.0175, 1.0175, 1.0175]
+  - [1.0345, 1.0345, 1.0345]
+  - [1.0516, 1.0516, 1.0516]
+  - [1.0686, 1.0686, 1.0686]
+  - [1.0856, 1.0856, 1.0856]
+  - [1.1026, 1.1026, 1.1026]
+  - [1.1196, 1.1196, 1.1196]
+  - [1.1367, 1.1367, 1.1367]
+  - [1.1537, 1.1537, 1.1537]
+  - [1.1707, 1.1707, 1.1707]
+  - [1.1877, 1.1877, 1.1877]
+  - [1.2047, 1.2047, 1.2047]
+  - [1.2218, 1.2218, 1.2218]
+  - [1.2388, 1.2388, 1.2388]
+  - [1.2558, 1.2558, 1.2558]
+  - [1.2728, 1.2728, 1.2728]
+  - [1.2898, 1.2898, 1.2898]
+  - [1.3068, 1.3068, 1.3068]
+  - [1.3239, 1.3239, 1.3239]
+  - [1.3409, 1.3409, 1.3409]
+  - [1.3579, 1.3579, 1.3579]
+  - [1.3749, 1.3749, 1.3749]
+  - [1.3919, 1.3919, 1.3919]
+  - [1.4089, 1.4089, 1.4089]
+  - [1.426, 1.426, 1.426]
+  - [1.443, 1.443, 1.443]
+  - [1.46, 1.46, 1.46]
+  - [1.477, 1.477, 1.477]
+  - [1.494, 1.494, 1.494]
+  - [1.511, 1.511, 1.511]
+  - [1.528, 1.528, 1.528]
+  - [1.545, 1.545, 1.545]
+  - [1.562, 1.562, 1.562]
+  - [1.579, 1.579, 1.579]
+  - [1.596, 1.596, 1.596]
+  - [1.613, 1.613, 1.613]
+  - [1.63, 1.63, 1.63]
+  - [1.647, 1.647, 1.647]
+  - [1.664, 1.664, 1.664]
+  - [1.681, 1.681, 1.681]
+  - [1.6979, 1.6979, 1.6979]
+  - [1.7149, 1.7149, 1.7149]
+  - [1.7319, 1.7319, 1.7319]
+  - [1.7488, 1.7488, 1.7488]
+  - [1.7657, 1.7657, 1.7657]
+  - [1.7827, 1.7827, 1.7827]
+  - [1.7996, 1.7996, 1.7996]
+  - [1.8165, 1.8165, 1.8165]
+  - [1.8333, 1.8333, 1.8333]
+  - [1.8502, 1.8502, 1.8502]
+  - [1.867, 1.867, 1.867]
+  - [1.8838, 1.8838, 1.8838]
+  - [1.9006, 1.9006, 1.9006]
+  - [1.9173, 1.9173, 1.9173]
+  - [1.934, 1.934, 1.934]
+  - [1.9506, 1.9506, 1.9506]
+  - [1.9672, 1.9672, 1.9672]
+  - [1.9837, 1.9837, 1.9837]
+  - [2.0001, 2.0001, 2.0001]
+  - [2.0165, 2.0165, 2.0165]
+  - [2.0327, 2.0327, 2.0327]
+  - [2.0489, 2.0489, 2.0489]
+  - [2.0649, 2.0649, 2.0649]
+  - [2.0807, 2.0807, 2.0807]
+  - [2.0965, 2.0965, 2.0965]
+  - [2.112, 2.112, 2.112]
+  - [2.1273, 2.1273, 2.1273]
+  - [2.1424, 2.1424, 2.1424]
+  - [2.1573, 2.1573, 2.1573]
+  - [2.1719, 2.1719, 2.1719]
+  - [2.1861, 2.1861, 2.1861]
+  - [2.2001, 2.2001, 2.2001]
+  - [2.2136, 2.2136, 2.2136]
+  - [2.2268, 2.2268, 2.2268]
+  - [2.2395, 2.2395, 2.2395]
+  - [2.2518, 2.2518, 2.2518]
+  - [2.2635, 2.2635, 2.2635]
+  - [2.2748, 2.2748, 2.2748]
+  - [2.2855, 2.2855, 2.2855]
+  - [2.2956, 2.2956, 2.2956]
+  - [2.3051, 2.3051, 2.3051]
+  - [2.3141, 2.3141, 2.3141]
+  - [2.3224, 2.3224, 2.3224]
+  - [2.3302, 2.3302, 2.3302]
+  - [2.3373, 2.3373, 2.3373]
+  - [2.3439, 2.3439, 2.3439]
+  - [2.3499, 2.3499, 2.3499]
+  - [2.3554, 2.3554, 2.3554]
+  - [2.3604, 2.3604, 2.3604]
+  - [2.3649, 2.3649, 2.3649]
+  - [2.369, 2.369, 2.369]
+  - [2.3726, 2.3726, 2.3726]
+  - [2.3759, 2.3759, 2.3759]
+  - [2.3788, 2.3788, 2.3788]
+  - [2.3814, 2.3814, 2.3814]
+  - [2.3836, 2.3836, 2.3836]
+  - [2.3857, 2.3857, 2.3857]
+  - [2.3875, 2.3875, 2.3875]
+  - [2.389, 2.389, 2.389]
+  - [2.3904, 2.3904, 2.3904]
+  - [2.3916, 2.3916, 2.3916]
+  - [2.3927, 2.3927, 2.3927]
+  - [2.3936, 2.3936, 2.3936]
+  - [2.3944, 2.3944, 2.3944]
+  - [2.3952, 2.3952, 2.3952]
+  - [2.3958, 2.3958, 2.3958]
+  - [2.3963, 2.3963, 2.3963]
+  - [2.3968, 2.3968, 2.3968]
+  - [2.3972, 2.3972, 2.3972]
+  - [2.3976, 2.3976, 2.3976]
+  - [2.3979, 2.3979, 2.3979]
+  - [2.3982, 2.3982, 2.3982]
+  - [2.3984, 2.3984, 2.3984]
+  - [2.3986, 2.3986, 2.3986]
+  - [2.3988, 2.3988, 2.3988]
+  - [2.3989, 2.3989, 2.3989]
+  - [2.3991, 2.3991, 2.3991]
+  - [2.3992, 2.3992, 2.3992]
+  - [2.3993, 2.3993, 2.3993]
+  - [2.3994, 2.3994, 2.3994]
+  - [2.3995, 2.3995, 2.3995]
+  - [2.3995, 2.3995, 2.3995]
+  - [2.3996, 2.3996, 2.3996]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3997, 2.3997, 2.3997]
+  - [2.3998, 2.3998, 2.3998]

core/dr-film/profiles/ilford_fp4_plus.yaml

@@ -0,0 +1,460 @@
+# Generated by tools/film-profiles/convert.py.
+#
+# *** CONSTRUCTED, NOT MEASURED. ***
+#
+# Ilford publish this film's spectral sensitivity and characteristic
+# curve as graphs, and no granularity figure at all, so this profile is
+# built rather than extracted. Its speed is the published ISO rating,
+# and its contrast is ISO 6:1993's normal development (average gradient
+# 0.62). Its spectral response is borrowed from Kodak Double-X, a
+# *measured* panchromatic negative, shifted by the speed difference.
+# Its granularity is an estimate, ordered against the other films here.
+#
+# So it renders as a film of this speed and contrast, not as a
+# measurement of this emulsion. Replace it outright if anyone digitises
+# the real curves.
+
+version: 'constructed-1'
+stock: ilford_fp4_plus
+name: 'Ilford FP4 Plus'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: true
+target_print: kodak_2302
+reference_illuminant: D55
+viewing_illuminant: D50
+
+rms_granularity: [7, 7, 7]
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm.
+log_sensitivity:
+  - [-9, -9, -9]   # 380nm
+  - [-9, -9, -9]   # 385nm
+  - [-9, -9, -9]   # 390nm
+  - [-9, -9, -9]   # 395nm
+  - [-9, -9, -9]   # 400nm
+  - [-9, -9, -9]   # 405nm
+  - [-9, -9, -9]   # 410nm
+  - [-9, -9, -9]   # 415nm
+  - [-9, -9, -9]   # 420nm
+  - [-1.01825, -1.01825, -1.01825]   # 425nm
+  - [-1.01799, -1.01799, -1.01799]   # 430nm
+  - [-1.01799, -1.01799, -1.01799]   # 435nm
+  - [-1.01834, -1.01834, -1.01834]   # 440nm
+  - [-1.02804, -1.02804, -1.02804]   # 445nm
+  - [-1.04077, -1.04077, -1.04077]   # 450nm
+  - [-1.05756, -1.05756, -1.05756]   # 455nm
+  - [-1.07682, -1.07682, -1.07682]   # 460nm
+  - [-1.09827, -1.09827, -1.09827]   # 465nm
+  - [-1.1167, -1.1167, -1.1167]   # 470nm
+  - [-1.14259, -1.14259, -1.14259]   # 475nm
+  - [-1.17037, -1.17037, -1.17037]   # 480nm
+  - [-1.20831, -1.20831, -1.20831]   # 485nm
+  - [-1.24806, -1.24806, -1.24806]   # 490nm
+  - [-1.28774, -1.28774, -1.28774]   # 495nm
+  - [-1.32101, -1.32101, -1.32101]   # 500nm
+  - [-1.33629, -1.33629, -1.33629]   # 505nm
+  - [-1.33946, -1.33946, -1.33946]   # 510nm
+  - [-1.33875, -1.33875, -1.33875]   # 515nm
+  - [-1.32898, -1.32898, -1.32898]   # 520nm
+  - [-1.31596, -1.31596, -1.31596]   # 525nm
+  - [-1.30119, -1.30119, -1.30119]   # 530nm
+  - [-1.28323, -1.28323, -1.28323]   # 535nm
+  - [-1.26501, -1.26501, -1.26501]   # 540nm
+  - [-1.24614, -1.24614, -1.24614]   # 545nm
+  - [-1.22957, -1.22957, -1.22957]   # 550nm
+  - [-1.2118, -1.2118, -1.2118]   # 555nm
+  - [-1.19855, -1.19855, -1.19855]   # 560nm
+  - [-1.19114, -1.19114, -1.19114]   # 565nm
+  - [-1.18626, -1.18626, -1.18626]   # 570nm
+  - [-1.1827, -1.1827, -1.1827]   # 575nm
+  - [-1.18551, -1.18551, -1.18551]   # 580nm
+  - [-1.19194, -1.19194, -1.19194]   # 585nm
+  - [-1.20146, -1.20146, -1.20146]   # 590nm
+  - [-1.2141, -1.2141, -1.2141]   # 595nm
+  - [-1.22597, -1.22597, -1.22597]   # 600nm
+  - [-1.24114, -1.24114, -1.24114]   # 605nm
+  - [-1.25625, -1.25625, -1.25625]   # 610nm
+  - [-1.26128, -1.26128, -1.26128]   # 615nm
+  - [-1.25287, -1.25287, -1.25287]   # 620nm
+  - [-1.26184, -1.26184, -1.26184]   # 625nm
+  - [-1.29098, -1.29098, -1.29098]   # 630nm
+  - [-1.38134, -1.38134, -1.38134]   # 635nm
+  - [-1.57076, -1.57076, -1.57076]   # 640nm
+  - [-1.7864, -1.7864, -1.7864]   # 645nm
+  - [-2.04202, -2.04202, -2.04202]   # 650nm
+  - [-2.30388, -2.30388, -2.30388]   # 655nm
+  - [-2.57175, -2.57175, -2.57175]   # 660nm
+  - [-9, -9, -9]   # 665nm
+  - [-9, -9, -9]   # 670nm
+  - [-9, -9, -9]   # 675nm
+  - [-9, -9, -9]   # 680nm
+  - [-9, -9, -9]   # 685nm
+  - [-9, -9, -9]   # 690nm
+  - [-9, -9, -9]   # 695nm
+  - [-9, -9, -9]   # 700nm
+  - [-9, -9, -9]   # 705nm
+  - [-9, -9, -9]   # 710nm
+  - [-9, -9, -9]   # 715nm
+  - [-9, -9, -9]   # 720nm
+  - [-9, -9, -9]   # 725nm
+  - [-9, -9, -9]   # 730nm
+  - [-9, -9, -9]   # 735nm
+  - [-9, -9, -9]   # 740nm
+  - [-9, -9, -9]   # 745nm
+  - [-9, -9, -9]   # 750nm
+  - [-9, -9, -9]   # 755nm
+  - [-9, -9, -9]   # 760nm
+  - [-9, -9, -9]   # 765nm
+  - [-9, -9, -9]   # 770nm
+  - [-9, -9, -9]   # 775nm
+  - [-9, -9, -9]   # 780nm
+
+# Developed silver: neutral across the band.
+dye_density:
+  - [0.333333, 0.333333, 0.333333]   # 380nm
+  - [0.333333, 0.333333, 0.333333]   # 385nm
+  - [0.333333, 0.333333, 0.333333]   # 390nm
+  - [0.333333, 0.333333, 0.333333]   # 395nm
+  - [0.333333, 0.333333, 0.333333]   # 400nm
+  - [0.333333, 0.333333, 0.333333]   # 405nm
+  - [0.333333, 0.333333, 0.333333]   # 410nm
+  - [0.333333, 0.333333, 0.333333]   # 415nm
+  - [0.333333, 0.333333, 0.333333]   # 420nm
+  - [0.333333, 0.333333, 0.333333]   # 425nm
+  - [0.333333, 0.333333, 0.333333]   # 430nm
+  - [0.333333, 0.333333, 0.333333]   # 435nm
+  - [0.333333, 0.333333, 0.333333]   # 440nm
+  - [0.333333, 0.333333, 0.333333]   # 445nm
+  - [0.333333, 0.333333, 0.333333]   # 450nm
+  - [0.333333, 0.333333, 0.333333]   # 455nm
+  - [0.333333, 0.333333, 0.333333]   # 460nm
+  - [0.333333, 0.333333, 0.333333]   # 465nm
+  - [0.333333, 0.333333, 0.333333]   # 470nm
+  - [0.333333, 0.333333, 0.333333]   # 475nm
+  - [0.333333, 0.333333, 0.333333]   # 480nm
+  - [0.333333, 0.333333, 0.333333]   # 485nm
+  - [0.333333, 0.333333, 0.333333]   # 490nm
+  - [0.333333, 0.333333, 0.333333]   # 495nm
+  - [0.333333, 0.333333, 0.333333]   # 500nm
+  - [0.333333, 0.333333, 0.333333]   # 505nm
+  - [0.333333, 0.333333, 0.333333]   # 510nm
+  - [0.333333, 0.333333, 0.333333]   # 515nm
+  - [0.333333, 0.333333, 0.333333]   # 520nm
+  - [0.333333, 0.333333, 0.333333]   # 525nm
+  - [0.333333, 0.333333, 0.333333]   # 530nm
+  - [0.333333, 0.333333, 0.333333]   # 535nm
+  - [0.333333, 0.333333, 0.333333]   # 540nm
+  - [0.333333, 0.333333, 0.333333]   # 545nm
+  - [0.333333, 0.333333, 0.333333]   # 550nm
+  - [0.333333, 0.333333, 0.333333]   # 555nm
+  - [0.333333, 0.333333, 0.333333]   # 560nm
+  - [0.333333, 0.333333, 0.333333]   # 565nm
+  - [0.333333, 0.333333, 0.333333]   # 570nm
+  - [0.333333, 0.333333, 0.333333]   # 575nm
+  - [0.333333, 0.333333, 0.333333]   # 580nm
+  - [0.333333, 0.333333, 0.333333]   # 585nm
+  - [0.333333, 0.333333, 0.333333]   # 590nm
+  - [0.333333, 0.333333, 0.333333]   # 595nm
+  - [0.333333, 0.333333, 0.333333]   # 600nm
+  - [0.333333, 0.333333, 0.333333]   # 605nm
+  - [0.333333, 0.333333, 0.333333]   # 610nm
+  - [0.333333, 0.333333, 0.333333]   # 615nm
+  - [0.333333, 0.333333, 0.333333]   # 620nm
+  - [0.333333, 0.333333, 0.333333]   # 625nm
+  - [0.333333, 0.333333, 0.333333]   # 630nm
+  - [0.333333, 0.333333, 0.333333]   # 635nm
+  - [0.333333, 0.333333, 0.333333]   # 640nm
+  - [0.333333, 0.333333, 0.333333]   # 645nm
+  - [0.333333, 0.333333, 0.333333]   # 650nm
+  - [0.333333, 0.333333, 0.333333]   # 655nm
+  - [0.333333, 0.333333, 0.333333]   # 660nm
+  - [0.333333, 0.333333, 0.333333]   # 665nm
+  - [0.333333, 0.333333, 0.333333]   # 670nm
+  - [0.333333, 0.333333, 0.333333]   # 675nm
+  - [0.333333, 0.333333, 0.333333]   # 680nm
+  - [0.333333, 0.333333, 0.333333]   # 685nm
+  - [0.333333, 0.333333, 0.333333]   # 690nm
+  - [0.333333, 0.333333, 0.333333]   # 695nm
+  - [0.333333, 0.333333, 0.333333]   # 700nm
+  - [0.333333, 0.333333, 0.333333]   # 705nm
+  - [0.333333, 0.333333, 0.333333]   # 710nm
+  - [0.333333, 0.333333, 0.333333]   # 715nm
+  - [0.333333, 0.333333, 0.333333]   # 720nm
+  - [0.333333, 0.333333, 0.333333]   # 725nm
+  - [0.333333, 0.333333, 0.333333]   # 730nm
+  - [0.333333, 0.333333, 0.333333]   # 735nm
+  - [0.333333, 0.333333, 0.333333]   # 740nm
+  - [0.333333, 0.333333, 0.333333]   # 745nm
+  - [0.333333, 0.333333, 0.333333]   # 750nm
+  - [0.333333, 0.333333, 0.333333]   # 755nm
+  - [0.333333, 0.333333, 0.333333]   # 760nm
+  - [0.333333, 0.333333, 0.333333]   # 765nm
+  - [0.333333, 0.333333, 0.333333]   # 770nm
+  - [0.333333, 0.333333, 0.333333]   # 775nm
+  - [0.333333, 0.333333, 0.333333]   # 780nm
+
+# Base plus fog. No orange mask on a black-and-white film.
+base_density: [0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1]
+
+# The characteristic curve, parametric.
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [3.5129e-07, 3.5129e-07, 3.5129e-07]
+  - [4.2083e-07, 4.2083e-07, 4.2083e-07]
+  - [5.0412e-07, 5.0412e-07, 5.0412e-07]
+  - [6.039e-07, 6.039e-07, 6.039e-07]
+  - [7.2343e-07, 7.2343e-07, 7.2343e-07]
+  - [8.6662e-07, 8.6662e-07, 8.6662e-07]
+  - [1.0381e-06, 1.0381e-06, 1.0381e-06]
+  - [1.2436e-06, 1.2436e-06, 1.2436e-06]
+  - [1.4898e-06, 1.4898e-06, 1.4898e-06]
+  - [1.7846e-06, 1.7846e-06, 1.7846e-06]
+  - [2.1379e-06, 2.1379e-06, 2.1379e-06]
+  - [2.561e-06, 2.561e-06, 2.561e-06]
+  - [3.0679e-06, 3.0679e-06, 3.0679e-06]
+  - [3.6751e-06, 3.6751e-06, 3.6751e-06]
+  - [4.4025e-06, 4.4025e-06, 4.4025e-06]
+  - [5.2739e-06, 5.2739e-06, 5.2739e-06]
+  - [6.3177e-06, 6.3177e-06, 6.3177e-06]
+  - [7.5681e-06, 7.5681e-06, 7.5681e-06]
+  - [9.066e-06, 9.066e-06, 9.066e-06]
+  - [1.086e-05, 1.086e-05, 1.086e-05]
+  - [1.301e-05, 1.301e-05, 1.301e-05]
+  - [1.5585e-05, 1.5585e-05, 1.5585e-05]
+  - [1.8669e-05, 1.8669e-05, 1.8669e-05]
+  - [2.2364e-05, 2.2364e-05, 2.2364e-05]
+  - [2.6789e-05, 2.6789e-05, 2.6789e-05]
+  - [3.2091e-05, 3.2091e-05, 3.2091e-05]
+  - [3.8441e-05, 3.8441e-05, 3.8441e-05]
+  - [4.6048e-05, 4.6048e-05, 4.6048e-05]
+  - [5.516e-05, 5.516e-05, 5.516e-05]
+  - [6.6074e-05, 6.6074e-05, 6.6074e-05]
+  - [7.9146e-05, 7.9146e-05, 7.9146e-05]
+  - [9.4804e-05, 9.4804e-05, 9.4804e-05]
+  - [0.00011356, 0.00011356, 0.00011356]
+  - [0.00013602, 0.00013602, 0.00013602]
+  - [0.00016292, 0.00016292, 0.00016292]
+  - [0.00019513, 0.00019513, 0.00019513]
+  - [0.0002337, 0.0002337, 0.0002337]
+  - [0.00027989, 0.00027989, 0.00027989]
+  - [0.00033519, 0.00033519, 0.00033519]
+  - [0.00040139, 0.00040139, 0.00040139]
+  - [0.00048064, 0.00048064, 0.00048064]
+  - [0.00057548, 0.00057548, 0.00057548]
+  - [0.00068897, 0.00068897, 0.00068897]
+  - [0.00082475, 0.00082475, 0.00082475]
+  - [0.00098713, 0.00098713, 0.00098713]
+  - [0.0011813, 0.0011813, 0.0011813]
+  - [0.0014134, 0.0014134, 0.0014134]
+  - [0.0016906, 0.0016906, 0.0016906]
+  - [0.0020217, 0.0020217, 0.0020217]
+  - [0.0024167, 0.0024167, 0.0024167]
+  - [0.0028878, 0.0028878, 0.0028878]
+  - [0.0034491, 0.0034491, 0.0034491]
+  - [0.004117, 0.004117, 0.004117]
+  - [0.004911, 0.004911, 0.004911]
+  - [0.0058534, 0.0058534, 0.0058534]
+  - [0.0069701, 0.0069701, 0.0069701]
+  - [0.0082906, 0.0082906, 0.0082906]
+  - [0.0098485, 0.0098485, 0.0098485]
+  - [0.011681, 0.011681, 0.011681]
+  - [0.013831, 0.013831, 0.013831]
+  - [0.016344, 0.016344, 0.016344]
+  - [0.019268, 0.019268, 0.019268]
+  - [0.022655, 0.022655, 0.022655]
+  - [0.026559, 0.026559, 0.026559]
+  - [0.031032, 0.031032, 0.031032]
+  - [0.036126, 0.036126, 0.036126]
+  - [0.041886, 0.041886, 0.041886]
+  - [0.048352, 0.048352, 0.048352]
+  - [0.055556, 0.055556, 0.055556]
+  - [0.063518, 0.063518, 0.063518]
+  - [0.072247, 0.072247, 0.072247]
+  - [0.081739, 0.081739, 0.081739]
+  - [0.09198, 0.09198, 0.09198]
+  - [0.10294, 0.10294, 0.10294]
+  - [0.11459, 0.11459, 0.11459]
+  - [0.12687, 0.12687, 0.12687]
+  - [0.13975, 0.13975, 0.13975]
+  - [0.15317, 0.15317, 0.15317]
+  - [0.16707, 0.16707, 0.16707]
+  - [0.18141, 0.18141, 0.18141]
+  - [0.19613, 0.19613, 0.19613]
+  - [0.21119, 0.21119, 0.21119]
+  - [0.22653, 0.22653, 0.22653]
+  - [0.24214, 0.24214, 0.24214]
+  - [0.25796, 0.25796, 0.25796]
+  - [0.27396, 0.27396, 0.27396]
+  - [0.29013, 0.29013, 0.29013]
+  - [0.30643, 0.30643, 0.30643]
+  - [0.32284, 0.32284, 0.32284]
+  - [0.33935, 0.33935, 0.33935]
+  - [0.35595, 0.35595, 0.35595]
+  - [0.37261, 0.37261, 0.37261]
+  - [0.38933, 0.38933, 0.38933]
+  - [0.4061, 0.4061, 0.4061]
+  - [0.42291, 0.42291, 0.42291]
+  - [0.43975, 0.43975, 0.43975]
+  - [0.45663, 0.45663, 0.45663]
+  - [0.47352, 0.47352, 0.47352]
+  - [0.49044, 0.49044, 0.49044]
+  - [0.50737, 0.50737, 0.50737]
+  - [0.52432, 0.52432, 0.52432]
+  - [0.54128, 0.54128, 0.54128]
+  - [0.55825, 0.55825, 0.55825]
+  - [0.57523, 0.57523, 0.57523]
+  - [0.59222, 0.59222, 0.59222]
+  - [0.60921, 0.60921, 0.60921]
+  - [0.6262, 0.6262, 0.6262]
+  - [0.6432, 0.6432, 0.6432]
+  - [0.6602, 0.6602, 0.6602]
+  - [0.67721, 0.67721, 0.67721]
+  - [0.69422, 0.69422, 0.69422]
+  - [0.71123, 0.71123, 0.71123]
+  - [0.72824, 0.72824, 0.72824]
+  - [0.74525, 0.74525, 0.74525]
+  - [0.76226, 0.76226, 0.76226]
+  - [0.77928, 0.77928, 0.77928]
+  - [0.79629, 0.79629, 0.79629]
+  - [0.81331, 0.81331, 0.81331]
+  - [0.83033, 0.83033, 0.83033]
+  - [0.84734, 0.84734, 0.84734]
+  - [0.86436, 0.86436, 0.86436]
+  - [0.88138, 0.88138, 0.88138]
+  - [0.8984, 0.8984, 0.8984]
+  - [0.91542, 0.91542, 0.91542]
+  - [0.93244, 0.93244, 0.93244]
+  - [0.94945, 0.94945, 0.94945]
+  - [0.96647, 0.96647, 0.96647]
+  - [0.98349, 0.98349, 0.98349]
+  - [1.0005, 1.0005, 1.0005]
+  - [1.0175, 1.0175, 1.0175]
+  - [1.0345, 1.0345, 1.0345]
+  - [1.0516, 1.0516, 1.0516]
+  - [1.0686, 1.0686, 1.0686]
+  - [1.0856, 1.0856, 1.0856]
+  - [1.1026, 1.1026, 1.1026]
+  - [1.1196, 1.1196, 1.1196]
+  - [1.1367, 1.1367, 1.1367]
+  - [1.1537, 1.1537, 1.1537]
+  - [1.1707, 1.1707, 1.1707]
+  - [1.1877, 1.1877, 1.1877]
+  - [1.2047, 1.2047, 1.2047]
+  - [1.2218, 1.2218, 1.2218]
+  - [1.2388, 1.2388, 1.2388]
+  - [1.2558, 1.2558, 1.2558]
+  - [1.2728, 1.2728, 1.2728]
+  - [1.2898, 1.2898, 1.2898]
+  - [1.3069, 1.3069, 1.3069]
+  - [1.3239, 1.3239, 1.3239]
+  - [1.3409, 1.3409, 1.3409]
+  - [1.3579, 1.3579, 1.3579]
+  - [1.3749, 1.3749, 1.3749]
+  - [1.3919, 1.3919, 1.3919]
+  - [1.409, 1.409, 1.409]
+  - [1.426, 1.426, 1.426]
+  - [1.443, 1.443, 1.443]
+  - [1.46, 1.46, 1.46]
+  - [1.477, 1.477, 1.477]
+  - [1.494, 1.494, 1.494]
+  - [1.5111, 1.5111, 1.5111]
+  - [1.5281, 1.5281, 1.5281]
+  - [1.5451, 1.5451, 1.5451]
+  - [1.5621, 1.5621, 1.5621]
+  - [1.5791, 1.5791, 1.5791]
+  - [1.5961, 1.5961, 1.5961]
+  - [1.6131, 1.6131, 1.6131]
+  - [1.6301, 1.6301, 1.6301]
+  - [1.6471, 1.6471, 1.6471]
+  - [1.6642, 1.6642, 1.6642]
+  - [1.6812, 1.6812, 1.6812]
+  - [1.6982, 1.6982, 1.6982]
+  - [1.7151, 1.7151, 1.7151]
+  - [1.7321, 1.7321, 1.7321]
+  - [1.7491, 1.7491, 1.7491]
+  - [1.7661, 1.7661, 1.7661]
+  - [1.7831, 1.7831, 1.7831]
+  - [1.8001, 1.8001, 1.8001]
+  - [1.817, 1.817, 1.817]
+  - [1.834, 1.834, 1.834]
+  - [1.8509, 1.8509, 1.8509]
+  - [1.8679, 1.8679, 1.8679]
+  - [1.8848, 1.8848, 1.8848]
+  - [1.9017, 1.9017, 1.9017]
+  - [1.9186, 1.9186, 1.9186]
+  - [1.9354, 1.9354, 1.9354]
+  - [1.9523, 1.9523, 1.9523]
+  - [1.9691, 1.9691, 1.9691]
+  - [1.9859, 1.9859, 1.9859]
+  - [2.0027, 2.0027, 2.0027]
+  - [2.0194, 2.0194, 2.0194]
+  - [2.036, 2.036, 2.036]
+  - [2.0527, 2.0527, 2.0527]
+  - [2.0692, 2.0692, 2.0692]
+  - [2.0857, 2.0857, 2.0857]
+  - [2.1022, 2.1022, 2.1022]
+  - [2.1185, 2.1185, 2.1185]
+  - [2.1347, 2.1347, 2.1347]
+  - [2.1509, 2.1509, 2.1509]
+  - [2.1669, 2.1669, 2.1669]
+  - [2.1827, 2.1827, 2.1827]
+  - [2.1984, 2.1984, 2.1984]
+  - [2.2139, 2.2139, 2.2139]
+  - [2.2292, 2.2292, 2.2292]
+  - [2.2443, 2.2443, 2.2443]
+  - [2.2591, 2.2591, 2.2591]
+  - [2.2737, 2.2737, 2.2737]
+  - [2.2879, 2.2879, 2.2879]
+  - [2.3018, 2.3018, 2.3018]
+  - [2.3153, 2.3153, 2.3153]
+  - [2.3284, 2.3284, 2.3284]
+  - [2.3411, 2.3411, 2.3411]
+  - [2.3533, 2.3533, 2.3533]
+  - [2.365, 2.365, 2.365]
+  - [2.3761, 2.3761, 2.3761]
+  - [2.3867, 2.3867, 2.3867]
+  - [2.3968, 2.3968, 2.3968]
+  - [2.4063, 2.4063, 2.4063]
+  - [2.4151, 2.4151, 2.4151]
+  - [2.4234, 2.4234, 2.4234]
+  - [2.4311, 2.4311, 2.4311]
+  - [2.4382, 2.4382, 2.4382]
+  - [2.4447, 2.4447, 2.4447]
+  - [2.4507, 2.4507, 2.4507]
+  - [2.4561, 2.4561, 2.4561]
+  - [2.461, 2.461, 2.461]
+  - [2.4655, 2.4655, 2.4655]
+  - [2.4695, 2.4695, 2.4695]
+  - [2.4731, 2.4731, 2.4731]
+  - [2.4763, 2.4763, 2.4763]
+  - [2.4791, 2.4791, 2.4791]
+  - [2.4817, 2.4817, 2.4817]
+  - [2.4839, 2.4839, 2.4839]
+  - [2.4859, 2.4859, 2.4859]
+  - [2.4877, 2.4877, 2.4877]
+  - [2.4892, 2.4892, 2.4892]
+  - [2.4906, 2.4906, 2.4906]
+  - [2.4918, 2.4918, 2.4918]
+  - [2.4928, 2.4928, 2.4928]
+  - [2.4937, 2.4937, 2.4937]
+  - [2.4945, 2.4945, 2.4945]
+  - [2.4952, 2.4952, 2.4952]
+  - [2.4958, 2.4958, 2.4958]
+  - [2.4964, 2.4964, 2.4964]
+  - [2.4969, 2.4969, 2.4969]
+  - [2.4973, 2.4973, 2.4973]
+  - [2.4976, 2.4976, 2.4976]
+  - [2.4979, 2.4979, 2.4979]
+  - [2.4982, 2.4982, 2.4982]
+  - [2.4984, 2.4984, 2.4984]
+  - [2.4986, 2.4986, 2.4986]
+  - [2.4988, 2.4988, 2.4988]
+  - [2.499, 2.499, 2.499]
+  - [2.4991, 2.4991, 2.4991]
+  - [2.4992, 2.4992, 2.4992]
+  - [2.4993, 2.4993, 2.4993]
+  - [2.4994, 2.4994, 2.4994]
+  - [2.4995, 2.4995, 2.4995]

core/dr-film/profiles/ilford_hp5_plus.yaml

@@ -0,0 +1,460 @@
+# Generated by tools/film-profiles/convert.py.
+#
+# *** CONSTRUCTED, NOT MEASURED. ***
+#
+# Ilford publish this film's spectral sensitivity and characteristic
+# curve as graphs, and no granularity figure at all, so this profile is
+# built rather than extracted. Its speed is the published ISO rating,
+# and its contrast is ISO 6:1993's normal development (average gradient
+# 0.62). Its spectral response is borrowed from Kodak Double-X, a
+# *measured* panchromatic negative, shifted by the speed difference.
+# Its granularity is an estimate, ordered against the other films here.
+#
+# So it renders as a film of this speed and contrast, not as a
+# measurement of this emulsion. Replace it outright if anyone digitises
+# the real curves.
+
+version: 'constructed-1'
+stock: ilford_hp5_plus
+name: 'Ilford HP5 Plus'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: true
+target_print: kodak_2302
+reference_illuminant: D55
+viewing_illuminant: D50
+
+rms_granularity: [11, 11, 11]
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm.
+log_sensitivity:
+  - [-9, -9, -9]   # 380nm
+  - [-9, -9, -9]   # 385nm
+  - [-9, -9, -9]   # 390nm
+  - [-9, -9, -9]   # 395nm
+  - [-9, -9, -9]   # 400nm
+  - [-9, -9, -9]   # 405nm
+  - [-9, -9, -9]   # 410nm
+  - [-9, -9, -9]   # 415nm
+  - [-9, -9, -9]   # 420nm
+  - [-0.513098, -0.513098, -0.513098]   # 425nm
+  - [-0.51284, -0.51284, -0.51284]   # 430nm
+  - [-0.51284, -0.51284, -0.51284]   # 435nm
+  - [-0.51319, -0.51319, -0.51319]   # 440nm
+  - [-0.522893, -0.522893, -0.522893]   # 445nm
+  - [-0.53562, -0.53562, -0.53562]   # 450nm
+  - [-0.552412, -0.552412, -0.552412]   # 455nm
+  - [-0.571665, -0.571665, -0.571665]   # 460nm
+  - [-0.593122, -0.593122, -0.593122]   # 465nm
+  - [-0.611553, -0.611553, -0.611553]   # 470nm
+  - [-0.637438, -0.637438, -0.637438]   # 475nm
+  - [-0.665217, -0.665217, -0.665217]   # 480nm
+  - [-0.703161, -0.703161, -0.703161]   # 485nm
+  - [-0.742909, -0.742909, -0.742909]   # 490nm
+  - [-0.782594, -0.782594, -0.782594]   # 495nm
+  - [-0.815861, -0.815861, -0.815861]   # 500nm
+  - [-0.831143, -0.831143, -0.831143]   # 505nm
+  - [-0.834309, -0.834309, -0.834309]   # 510nm
+  - [-0.833599, -0.833599, -0.833599]   # 515nm
+  - [-0.823829, -0.823829, -0.823829]   # 520nm
+  - [-0.810809, -0.810809, -0.810809]   # 525nm
+  - [-0.796036, -0.796036, -0.796036]   # 530nm
+  - [-0.778081, -0.778081, -0.778081]   # 535nm
+  - [-0.759864, -0.759864, -0.759864]   # 540nm
+  - [-0.740987, -0.740987, -0.740987]   # 545nm
+  - [-0.724425, -0.724425, -0.724425]   # 550nm
+  - [-0.706653, -0.706653, -0.706653]   # 555nm
+  - [-0.693404, -0.693404, -0.693404]   # 560nm
+  - [-0.685993, -0.685993, -0.685993]   # 565nm
+  - [-0.68111, -0.68111, -0.68111]   # 570nm
+  - [-0.677547, -0.677547, -0.677547]   # 575nm
+  - [-0.680358, -0.680358, -0.680358]   # 580nm
+  - [-0.686794, -0.686794, -0.686794]   # 585nm
+  - [-0.696308, -0.696308, -0.696308]   # 590nm
+  - [-0.708955, -0.708955, -0.708955]   # 595nm
+  - [-0.720822, -0.720822, -0.720822]   # 600nm
+  - [-0.735995, -0.735995, -0.735995]   # 605nm
+  - [-0.751102, -0.751102, -0.751102]   # 610nm
+  - [-0.75613, -0.75613, -0.75613]   # 615nm
+  - [-0.747716, -0.747716, -0.747716]   # 620nm
+  - [-0.756689, -0.756689, -0.756689]   # 625nm
+  - [-0.785834, -0.785834, -0.785834]   # 630nm
+  - [-0.876194, -0.876194, -0.876194]   # 635nm
+  - [-1.06561, -1.06561, -1.06561]   # 640nm
+  - [-1.28125, -1.28125, -1.28125]   # 645nm
+  - [-1.53687, -1.53687, -1.53687]   # 650nm
+  - [-1.79873, -1.79873, -1.79873]   # 655nm
+  - [-2.0666, -2.0666, -2.0666]   # 660nm
+  - [-9, -9, -9]   # 665nm
+  - [-9, -9, -9]   # 670nm
+  - [-9, -9, -9]   # 675nm
+  - [-9, -9, -9]   # 680nm
+  - [-9, -9, -9]   # 685nm
+  - [-9, -9, -9]   # 690nm
+  - [-9, -9, -9]   # 695nm
+  - [-9, -9, -9]   # 700nm
+  - [-9, -9, -9]   # 705nm
+  - [-9, -9, -9]   # 710nm
+  - [-9, -9, -9]   # 715nm
+  - [-9, -9, -9]   # 720nm
+  - [-9, -9, -9]   # 725nm
+  - [-9, -9, -9]   # 730nm
+  - [-9, -9, -9]   # 735nm
+  - [-9, -9, -9]   # 740nm
+  - [-9, -9, -9]   # 745nm
+  - [-9, -9, -9]   # 750nm
+  - [-9, -9, -9]   # 755nm
+  - [-9, -9, -9]   # 760nm
+  - [-9, -9, -9]   # 765nm
+  - [-9, -9, -9]   # 770nm
+  - [-9, -9, -9]   # 775nm
+  - [-9, -9, -9]   # 780nm
+
+# Developed silver: neutral across the band.
+dye_density:
+  - [0.333333, 0.333333, 0.333333]   # 380nm
+  - [0.333333, 0.333333, 0.333333]   # 385nm
+  - [0.333333, 0.333333, 0.333333]   # 390nm
+  - [0.333333, 0.333333, 0.333333]   # 395nm
+  - [0.333333, 0.333333, 0.333333]   # 400nm
+  - [0.333333, 0.333333, 0.333333]   # 405nm
+  - [0.333333, 0.333333, 0.333333]   # 410nm
+  - [0.333333, 0.333333, 0.333333]   # 415nm
+  - [0.333333, 0.333333, 0.333333]   # 420nm
+  - [0.333333, 0.333333, 0.333333]   # 425nm
+  - [0.333333, 0.333333, 0.333333]   # 430nm
+  - [0.333333, 0.333333, 0.333333]   # 435nm
+  - [0.333333, 0.333333, 0.333333]   # 440nm
+  - [0.333333, 0.333333, 0.333333]   # 445nm
+  - [0.333333, 0.333333, 0.333333]   # 450nm
+  - [0.333333, 0.333333, 0.333333]   # 455nm
+  - [0.333333, 0.333333, 0.333333]   # 460nm
+  - [0.333333, 0.333333, 0.333333]   # 465nm
+  - [0.333333, 0.333333, 0.333333]   # 470nm
+  - [0.333333, 0.333333, 0.333333]   # 475nm
+  - [0.333333, 0.333333, 0.333333]   # 480nm
+  - [0.333333, 0.333333, 0.333333]   # 485nm
+  - [0.333333, 0.333333, 0.333333]   # 490nm
+  - [0.333333, 0.333333, 0.333333]   # 495nm
+  - [0.333333, 0.333333, 0.333333]   # 500nm
+  - [0.333333, 0.333333, 0.333333]   # 505nm
+  - [0.333333, 0.333333, 0.333333]   # 510nm
+  - [0.333333, 0.333333, 0.333333]   # 515nm
+  - [0.333333, 0.333333, 0.333333]   # 520nm
+  - [0.333333, 0.333333, 0.333333]   # 525nm
+  - [0.333333, 0.333333, 0.333333]   # 530nm
+  - [0.333333, 0.333333, 0.333333]   # 535nm
+  - [0.333333, 0.333333, 0.333333]   # 540nm
+  - [0.333333, 0.333333, 0.333333]   # 545nm
+  - [0.333333, 0.333333, 0.333333]   # 550nm
+  - [0.333333, 0.333333, 0.333333]   # 555nm
+  - [0.333333, 0.333333, 0.333333]   # 560nm
+  - [0.333333, 0.333333, 0.333333]   # 565nm
+  - [0.333333, 0.333333, 0.333333]   # 570nm
+  - [0.333333, 0.333333, 0.333333]   # 575nm
+  - [0.333333, 0.333333, 0.333333]   # 580nm
+  - [0.333333, 0.333333, 0.333333]   # 585nm
+  - [0.333333, 0.333333, 0.333333]   # 590nm
+  - [0.333333, 0.333333, 0.333333]   # 595nm
+  - [0.333333, 0.333333, 0.333333]   # 600nm
+  - [0.333333, 0.333333, 0.333333]   # 605nm
+  - [0.333333, 0.333333, 0.333333]   # 610nm
+  - [0.333333, 0.333333, 0.333333]   # 615nm
+  - [0.333333, 0.333333, 0.333333]   # 620nm
+  - [0.333333, 0.333333, 0.333333]   # 625nm
+  - [0.333333, 0.333333, 0.333333]   # 630nm
+  - [0.333333, 0.333333, 0.333333]   # 635nm
+  - [0.333333, 0.333333, 0.333333]   # 640nm
+  - [0.333333, 0.333333, 0.333333]   # 645nm
+  - [0.333333, 0.333333, 0.333333]   # 650nm
+  - [0.333333, 0.333333, 0.333333]   # 655nm
+  - [0.333333, 0.333333, 0.333333]   # 660nm
+  - [0.333333, 0.333333, 0.333333]   # 665nm
+  - [0.333333, 0.333333, 0.333333]   # 670nm
+  - [0.333333, 0.333333, 0.333333]   # 675nm
+  - [0.333333, 0.333333, 0.333333]   # 680nm
+  - [0.333333, 0.333333, 0.333333]   # 685nm
+  - [0.333333, 0.333333, 0.333333]   # 690nm
+  - [0.333333, 0.333333, 0.333333]   # 695nm
+  - [0.333333, 0.333333, 0.333333]   # 700nm
+  - [0.333333, 0.333333, 0.333333]   # 705nm
+  - [0.333333, 0.333333, 0.333333]   # 710nm
+  - [0.333333, 0.333333, 0.333333]   # 715nm
+  - [0.333333, 0.333333, 0.333333]   # 720nm
+  - [0.333333, 0.333333, 0.333333]   # 725nm
+  - [0.333333, 0.333333, 0.333333]   # 730nm
+  - [0.333333, 0.333333, 0.333333]   # 735nm
+  - [0.333333, 0.333333, 0.333333]   # 740nm
+  - [0.333333, 0.333333, 0.333333]   # 745nm
+  - [0.333333, 0.333333, 0.333333]   # 750nm
+  - [0.333333, 0.333333, 0.333333]   # 755nm
+  - [0.333333, 0.333333, 0.333333]   # 760nm
+  - [0.333333, 0.333333, 0.333333]   # 765nm
+  - [0.333333, 0.333333, 0.333333]   # 770nm
+  - [0.333333, 0.333333, 0.333333]   # 775nm
+  - [0.333333, 0.333333, 0.333333]   # 780nm
+
+# Base plus fog. No orange mask on a black-and-white film.
+base_density: [0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1]
+
+# The characteristic curve, parametric.
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [3.5129e-07, 3.5129e-07, 3.5129e-07]
+  - [4.2083e-07, 4.2083e-07, 4.2083e-07]
+  - [5.0412e-07, 5.0412e-07, 5.0412e-07]
+  - [6.039e-07, 6.039e-07, 6.039e-07]
+  - [7.2343e-07, 7.2343e-07, 7.2343e-07]
+  - [8.6662e-07, 8.6662e-07, 8.6662e-07]
+  - [1.0381e-06, 1.0381e-06, 1.0381e-06]
+  - [1.2436e-06, 1.2436e-06, 1.2436e-06]
+  - [1.4898e-06, 1.4898e-06, 1.4898e-06]
+  - [1.7846e-06, 1.7846e-06, 1.7846e-06]
+  - [2.1379e-06, 2.1379e-06, 2.1379e-06]
+  - [2.561e-06, 2.561e-06, 2.561e-06]
+  - [3.0679e-06, 3.0679e-06, 3.0679e-06]
+  - [3.6751e-06, 3.6751e-06, 3.6751e-06]
+  - [4.4025e-06, 4.4025e-06, 4.4025e-06]
+  - [5.2739e-06, 5.2739e-06, 5.2739e-06]
+  - [6.3177e-06, 6.3177e-06, 6.3177e-06]
+  - [7.5681e-06, 7.5681e-06, 7.5681e-06]
+  - [9.066e-06, 9.066e-06, 9.066e-06]
+  - [1.086e-05, 1.086e-05, 1.086e-05]
+  - [1.301e-05, 1.301e-05, 1.301e-05]
+  - [1.5585e-05, 1.5585e-05, 1.5585e-05]
+  - [1.8669e-05, 1.8669e-05, 1.8669e-05]
+  - [2.2364e-05, 2.2364e-05, 2.2364e-05]
+  - [2.6789e-05, 2.6789e-05, 2.6789e-05]
+  - [3.2091e-05, 3.2091e-05, 3.2091e-05]
+  - [3.8441e-05, 3.8441e-05, 3.8441e-05]
+  - [4.6048e-05, 4.6048e-05, 4.6048e-05]
+  - [5.516e-05, 5.516e-05, 5.516e-05]
+  - [6.6074e-05, 6.6074e-05, 6.6074e-05]
+  - [7.9146e-05, 7.9146e-05, 7.9146e-05]
+  - [9.4804e-05, 9.4804e-05, 9.4804e-05]
+  - [0.00011356, 0.00011356, 0.00011356]
+  - [0.00013602, 0.00013602, 0.00013602]
+  - [0.00016292, 0.00016292, 0.00016292]
+  - [0.00019513, 0.00019513, 0.00019513]
+  - [0.0002337, 0.0002337, 0.0002337]
+  - [0.00027989, 0.00027989, 0.00027989]
+  - [0.00033519, 0.00033519, 0.00033519]
+  - [0.00040139, 0.00040139, 0.00040139]
+  - [0.00048064, 0.00048064, 0.00048064]
+  - [0.00057548, 0.00057548, 0.00057548]
+  - [0.00068897, 0.00068897, 0.00068897]
+  - [0.00082475, 0.00082475, 0.00082475]
+  - [0.00098713, 0.00098713, 0.00098713]
+  - [0.0011813, 0.0011813, 0.0011813]
+  - [0.0014134, 0.0014134, 0.0014134]
+  - [0.0016906, 0.0016906, 0.0016906]
+  - [0.0020217, 0.0020217, 0.0020217]
+  - [0.0024167, 0.0024167, 0.0024167]
+  - [0.0028878, 0.0028878, 0.0028878]
+  - [0.0034491, 0.0034491, 0.0034491]
+  - [0.004117, 0.004117, 0.004117]
+  - [0.004911, 0.004911, 0.004911]
+  - [0.0058534, 0.0058534, 0.0058534]
+  - [0.0069701, 0.0069701, 0.0069701]
+  - [0.0082906, 0.0082906, 0.0082906]
+  - [0.0098485, 0.0098485, 0.0098485]
+  - [0.011681, 0.011681, 0.011681]
+  - [0.013831, 0.013831, 0.013831]
+  - [0.016344, 0.016344, 0.016344]
+  - [0.019268, 0.019268, 0.019268]
+  - [0.022655, 0.022655, 0.022655]
+  - [0.026559, 0.026559, 0.026559]
+  - [0.031032, 0.031032, 0.031032]
+  - [0.036126, 0.036126, 0.036126]
+  - [0.041886, 0.041886, 0.041886]
+  - [0.048352, 0.048352, 0.048352]
+  - [0.055556, 0.055556, 0.055556]
+  - [0.063518, 0.063518, 0.063518]
+  - [0.072247, 0.072247, 0.072247]
+  - [0.081739, 0.081739, 0.081739]
+  - [0.09198, 0.09198, 0.09198]
+  - [0.10294, 0.10294, 0.10294]
+  - [0.11459, 0.11459, 0.11459]
+  - [0.12687, 0.12687, 0.12687]
+  - [0.13975, 0.13975, 0.13975]
+  - [0.15317, 0.15317, 0.15317]
+  - [0.16707, 0.16707, 0.16707]
+  - [0.18141, 0.18141, 0.18141]
+  - [0.19613, 0.19613, 0.19613]
+  - [0.21119, 0.21119, 0.21119]
+  - [0.22653, 0.22653, 0.22653]
+  - [0.24214, 0.24214, 0.24214]
+  - [0.25796, 0.25796, 0.25796]
+  - [0.27396, 0.27396, 0.27396]
+  - [0.29013, 0.29013, 0.29013]
+  - [0.30643, 0.30643, 0.30643]
+  - [0.32284, 0.32284, 0.32284]
+  - [0.33935, 0.33935, 0.33935]
+  - [0.35595, 0.35595, 0.35595]
+  - [0.37261, 0.37261, 0.37261]
+  - [0.38933, 0.38933, 0.38933]
+  - [0.4061, 0.4061, 0.4061]
+  - [0.42291, 0.42291, 0.42291]
+  - [0.43975, 0.43975, 0.43975]
+  - [0.45663, 0.45663, 0.45663]
+  - [0.47352, 0.47352, 0.47352]
+  - [0.49044, 0.49044, 0.49044]
+  - [0.50737, 0.50737, 0.50737]
+  - [0.52432, 0.52432, 0.52432]
+  - [0.54128, 0.54128, 0.54128]
+  - [0.55825, 0.55825, 0.55825]
+  - [0.57523, 0.57523, 0.57523]
+  - [0.59222, 0.59222, 0.59222]
+  - [0.60921, 0.60921, 0.60921]
+  - [0.6262, 0.6262, 0.6262]
+  - [0.6432, 0.6432, 0.6432]
+  - [0.6602, 0.6602, 0.6602]
+  - [0.67721, 0.67721, 0.67721]
+  - [0.69422, 0.69422, 0.69422]
+  - [0.71123, 0.71123, 0.71123]
+  - [0.72824, 0.72824, 0.72824]
+  - [0.74525, 0.74525, 0.74525]
+  - [0.76226, 0.76226, 0.76226]
+  - [0.77928, 0.77928, 0.77928]
+  - [0.79629, 0.79629, 0.79629]
+  - [0.81331, 0.81331, 0.81331]
+  - [0.83033, 0.83033, 0.83033]
+  - [0.84735, 0.84735, 0.84735]
+  - [0.86436, 0.86436, 0.86436]
+  - [0.88138, 0.88138, 0.88138]
+  - [0.8984, 0.8984, 0.8984]
+  - [0.91542, 0.91542, 0.91542]
+  - [0.93244, 0.93244, 0.93244]
+  - [0.94945, 0.94945, 0.94945]
+  - [0.96647, 0.96647, 0.96647]
+  - [0.98349, 0.98349, 0.98349]
+  - [1.0005, 1.0005, 1.0005]
+  - [1.0175, 1.0175, 1.0175]
+  - [1.0346, 1.0346, 1.0346]
+  - [1.0516, 1.0516, 1.0516]
+  - [1.0686, 1.0686, 1.0686]
+  - [1.0856, 1.0856, 1.0856]
+  - [1.1026, 1.1026, 1.1026]
+  - [1.1196, 1.1196, 1.1196]
+  - [1.1367, 1.1367, 1.1367]
+  - [1.1537, 1.1537, 1.1537]
+  - [1.1707, 1.1707, 1.1707]
+  - [1.1877, 1.1877, 1.1877]
+  - [1.2047, 1.2047, 1.2047]
+  - [1.2218, 1.2218, 1.2218]
+  - [1.2388, 1.2388, 1.2388]
+  - [1.2558, 1.2558, 1.2558]
+  - [1.2728, 1.2728, 1.2728]
+  - [1.2898, 1.2898, 1.2898]
+  - [1.3069, 1.3069, 1.3069]
+  - [1.3239, 1.3239, 1.3239]
+  - [1.3409, 1.3409, 1.3409]
+  - [1.3579, 1.3579, 1.3579]
+  - [1.3749, 1.3749, 1.3749]
+  - [1.392, 1.392, 1.392]
+  - [1.409, 1.409, 1.409]
+  - [1.426, 1.426, 1.426]
+  - [1.443, 1.443, 1.443]
+  - [1.46, 1.46, 1.46]
+  - [1.477, 1.477, 1.477]
+  - [1.4941, 1.4941, 1.4941]
+  - [1.5111, 1.5111, 1.5111]
+  - [1.5281, 1.5281, 1.5281]
+  - [1.5451, 1.5451, 1.5451]
+  - [1.5621, 1.5621, 1.5621]
+  - [1.5791, 1.5791, 1.5791]
+  - [1.5962, 1.5962, 1.5962]
+  - [1.6132, 1.6132, 1.6132]
+  - [1.6302, 1.6302, 1.6302]
+  - [1.6472, 1.6472, 1.6472]
+  - [1.6642, 1.6642, 1.6642]
+  - [1.6812, 1.6812, 1.6812]
+  - [1.6982, 1.6982, 1.6982]
+  - [1.7153, 1.7153, 1.7153]
+  - [1.7323, 1.7323, 1.7323]
+  - [1.7493, 1.7493, 1.7493]
+  - [1.7663, 1.7663, 1.7663]
+  - [1.7833, 1.7833, 1.7833]
+  - [1.8003, 1.8003, 1.8003]
+  - [1.8173, 1.8173, 1.8173]
+  - [1.8343, 1.8343, 1.8343]
+  - [1.8512, 1.8512, 1.8512]
+  - [1.8682, 1.8682, 1.8682]
+  - [1.8852, 1.8852, 1.8852]
+  - [1.9022, 1.9022, 1.9022]
+  - [1.9191, 1.9191, 1.9191]
+  - [1.9361, 1.9361, 1.9361]
+  - [1.953, 1.953, 1.953]
+  - [1.97, 1.97, 1.97]
+  - [1.9869, 1.9869, 1.9869]
+  - [2.0038, 2.0038, 2.0038]
+  - [2.0207, 2.0207, 2.0207]
+  - [2.0375, 2.0375, 2.0375]
+  - [2.0544, 2.0544, 2.0544]
+  - [2.0712, 2.0712, 2.0712]
+  - [2.088, 2.088, 2.088]
+  - [2.1047, 2.1047, 2.1047]
+  - [2.1214, 2.1214, 2.1214]
+  - [2.1381, 2.1381, 2.1381]
+  - [2.1547, 2.1547, 2.1547]
+  - [2.1713, 2.1713, 2.1713]
+  - [2.1878, 2.1878, 2.1878]
+  - [2.2042, 2.2042, 2.2042]
+  - [2.2205, 2.2205, 2.2205]
+  - [2.2367, 2.2367, 2.2367]
+  - [2.2529, 2.2529, 2.2529]
+  - [2.2688, 2.2688, 2.2688]
+  - [2.2847, 2.2847, 2.2847]
+  - [2.3003, 2.3003, 2.3003]
+  - [2.3158, 2.3158, 2.3158]
+  - [2.3311, 2.3311, 2.3311]
+  - [2.3462, 2.3462, 2.3462]
+  - [2.361, 2.361, 2.361]
+  - [2.3755, 2.3755, 2.3755]
+  - [2.3896, 2.3896, 2.3896]
+  - [2.4035, 2.4035, 2.4035]
+  - [2.417, 2.417, 2.417]
+  - [2.43, 2.43, 2.43]
+  - [2.4426, 2.4426, 2.4426]
+  - [2.4547, 2.4547, 2.4547]
+  - [2.4664, 2.4664, 2.4664]
+  - [2.4775, 2.4775, 2.4775]
+  - [2.488, 2.488, 2.488]
+  - [2.498, 2.498, 2.498]
+  - [2.5074, 2.5074, 2.5074]
+  - [2.5162, 2.5162, 2.5162]
+  - [2.5244, 2.5244, 2.5244]
+  - [2.532, 2.532, 2.532]
+  - [2.539, 2.539, 2.539]
+  - [2.5455, 2.5455, 2.5455]
+  - [2.5514, 2.5514, 2.5514]
+  - [2.5567, 2.5567, 2.5567]
+  - [2.5616, 2.5616, 2.5616]
+  - [2.566, 2.566, 2.566]
+  - [2.5699, 2.5699, 2.5699]
+  - [2.5735, 2.5735, 2.5735]
+  - [2.5766, 2.5766, 2.5766]
+  - [2.5795, 2.5795, 2.5795]
+  - [2.582, 2.582, 2.582]
+  - [2.5842, 2.5842, 2.5842]
+  - [2.5861, 2.5861, 2.5861]
+  - [2.5879, 2.5879, 2.5879]
+  - [2.5894, 2.5894, 2.5894]
+  - [2.5907, 2.5907, 2.5907]
+  - [2.5919, 2.5919, 2.5919]
+  - [2.5929, 2.5929, 2.5929]
+  - [2.5938, 2.5938, 2.5938]
+  - [2.5946, 2.5946, 2.5946]
+  - [2.5953, 2.5953, 2.5953]
+  - [2.5959, 2.5959, 2.5959]
+  - [2.5964, 2.5964, 2.5964]
+  - [2.5969, 2.5969, 2.5969]
+  - [2.5973, 2.5973, 2.5973]
+  - [2.5977, 2.5977, 2.5977]
+  - [2.598, 2.598, 2.598]
+  - [2.5982, 2.5982, 2.5982]
+  - [2.5985, 2.5985, 2.5985]
+  - [2.5987, 2.5987, 2.5987]
+  - [2.5988, 2.5988, 2.5988]

core/dr-film/profiles/ilford_pan_f_plus.yaml

@@ -0,0 +1,460 @@
+# Generated by tools/film-profiles/convert.py.
+#
+# *** CONSTRUCTED, NOT MEASURED. ***
+#
+# Ilford publish this film's spectral sensitivity and characteristic
+# curve as graphs, and no granularity figure at all, so this profile is
+# built rather than extracted. Its speed is the published ISO rating,
+# and its contrast is ISO 6:1993's normal development (average gradient
+# 0.62). Its spectral response is borrowed from Kodak Double-X, a
+# *measured* panchromatic negative, shifted by the speed difference.
+# Its granularity is an estimate, ordered against the other films here.
+#
+# So it renders as a film of this speed and contrast, not as a
+# measurement of this emulsion. Replace it outright if anyone digitises
+# the real curves.
+
+version: 'constructed-1'
+stock: ilford_pan_f_plus
+name: 'Ilford Pan F Plus'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: true
+target_print: kodak_2302
+reference_illuminant: D55
+viewing_illuminant: D50
+
+rms_granularity: [5, 5, 5]
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm.
+log_sensitivity:
+  - [-9, -9, -9]   # 380nm
+  - [-9, -9, -9]   # 385nm
+  - [-9, -9, -9]   # 390nm
+  - [-9, -9, -9]   # 395nm
+  - [-9, -9, -9]   # 400nm
+  - [-9, -9, -9]   # 405nm
+  - [-9, -9, -9]   # 410nm
+  - [-9, -9, -9]   # 415nm
+  - [-9, -9, -9]   # 420nm
+  - [-1.41619, -1.41619, -1.41619]   # 425nm
+  - [-1.41593, -1.41593, -1.41593]   # 430nm
+  - [-1.41593, -1.41593, -1.41593]   # 435nm
+  - [-1.41628, -1.41628, -1.41628]   # 440nm
+  - [-1.42598, -1.42598, -1.42598]   # 445nm
+  - [-1.43871, -1.43871, -1.43871]   # 450nm
+  - [-1.4555, -1.4555, -1.4555]   # 455nm
+  - [-1.47476, -1.47476, -1.47476]   # 460nm
+  - [-1.49621, -1.49621, -1.49621]   # 465nm
+  - [-1.51464, -1.51464, -1.51464]   # 470nm
+  - [-1.54053, -1.54053, -1.54053]   # 475nm
+  - [-1.56831, -1.56831, -1.56831]   # 480nm
+  - [-1.60625, -1.60625, -1.60625]   # 485nm
+  - [-1.646, -1.646, -1.646]   # 490nm
+  - [-1.68568, -1.68568, -1.68568]   # 495nm
+  - [-1.71895, -1.71895, -1.71895]   # 500nm
+  - [-1.73423, -1.73423, -1.73423]   # 505nm
+  - [-1.7374, -1.7374, -1.7374]   # 510nm
+  - [-1.73669, -1.73669, -1.73669]   # 515nm
+  - [-1.72692, -1.72692, -1.72692]   # 520nm
+  - [-1.7139, -1.7139, -1.7139]   # 525nm
+  - [-1.69913, -1.69913, -1.69913]   # 530nm
+  - [-1.68117, -1.68117, -1.68117]   # 535nm
+  - [-1.66295, -1.66295, -1.66295]   # 540nm
+  - [-1.64408, -1.64408, -1.64408]   # 545nm
+  - [-1.62751, -1.62751, -1.62751]   # 550nm
+  - [-1.60974, -1.60974, -1.60974]   # 555nm
+  - [-1.59649, -1.59649, -1.59649]   # 560nm
+  - [-1.58908, -1.58908, -1.58908]   # 565nm
+  - [-1.5842, -1.5842, -1.5842]   # 570nm
+  - [-1.58064, -1.58064, -1.58064]   # 575nm
+  - [-1.58345, -1.58345, -1.58345]   # 580nm
+  - [-1.58988, -1.58988, -1.58988]   # 585nm
+  - [-1.5994, -1.5994, -1.5994]   # 590nm
+  - [-1.61204, -1.61204, -1.61204]   # 595nm
+  - [-1.62391, -1.62391, -1.62391]   # 600nm
+  - [-1.63908, -1.63908, -1.63908]   # 605nm
+  - [-1.65419, -1.65419, -1.65419]   # 610nm
+  - [-1.65922, -1.65922, -1.65922]   # 615nm
+  - [-1.65081, -1.65081, -1.65081]   # 620nm
+  - [-1.65978, -1.65978, -1.65978]   # 625nm
+  - [-1.68892, -1.68892, -1.68892]   # 630nm
+  - [-1.77928, -1.77928, -1.77928]   # 635nm
+  - [-1.9687, -1.9687, -1.9687]   # 640nm
+  - [-2.18434, -2.18434, -2.18434]   # 645nm
+  - [-2.43996, -2.43996, -2.43996]   # 650nm
+  - [-2.70182, -2.70182, -2.70182]   # 655nm
+  - [-2.96969, -2.96969, -2.96969]   # 660nm
+  - [-9, -9, -9]   # 665nm
+  - [-9, -9, -9]   # 670nm
+  - [-9, -9, -9]   # 675nm
+  - [-9, -9, -9]   # 680nm
+  - [-9, -9, -9]   # 685nm
+  - [-9, -9, -9]   # 690nm
+  - [-9, -9, -9]   # 695nm
+  - [-9, -9, -9]   # 700nm
+  - [-9, -9, -9]   # 705nm
+  - [-9, -9, -9]   # 710nm
+  - [-9, -9, -9]   # 715nm
+  - [-9, -9, -9]   # 720nm
+  - [-9, -9, -9]   # 725nm
+  - [-9, -9, -9]   # 730nm
+  - [-9, -9, -9]   # 735nm
+  - [-9, -9, -9]   # 740nm
+  - [-9, -9, -9]   # 745nm
+  - [-9, -9, -9]   # 750nm
+  - [-9, -9, -9]   # 755nm
+  - [-9, -9, -9]   # 760nm
+  - [-9, -9, -9]   # 765nm
+  - [-9, -9, -9]   # 770nm
+  - [-9, -9, -9]   # 775nm
+  - [-9, -9, -9]   # 780nm
+
+# Developed silver: neutral across the band.
+dye_density:
+  - [0.333333, 0.333333, 0.333333]   # 380nm
+  - [0.333333, 0.333333, 0.333333]   # 385nm
+  - [0.333333, 0.333333, 0.333333]   # 390nm
+  - [0.333333, 0.333333, 0.333333]   # 395nm
+  - [0.333333, 0.333333, 0.333333]   # 400nm
+  - [0.333333, 0.333333, 0.333333]   # 405nm
+  - [0.333333, 0.333333, 0.333333]   # 410nm
+  - [0.333333, 0.333333, 0.333333]   # 415nm
+  - [0.333333, 0.333333, 0.333333]   # 420nm
+  - [0.333333, 0.333333, 0.333333]   # 425nm
+  - [0.333333, 0.333333, 0.333333]   # 430nm
+  - [0.333333, 0.333333, 0.333333]   # 435nm
+  - [0.333333, 0.333333, 0.333333]   # 440nm
+  - [0.333333, 0.333333, 0.333333]   # 445nm
+  - [0.333333, 0.333333, 0.333333]   # 450nm
+  - [0.333333, 0.333333, 0.333333]   # 455nm
+  - [0.333333, 0.333333, 0.333333]   # 460nm
+  - [0.333333, 0.333333, 0.333333]   # 465nm
+  - [0.333333, 0.333333, 0.333333]   # 470nm
+  - [0.333333, 0.333333, 0.333333]   # 475nm
+  - [0.333333, 0.333333, 0.333333]   # 480nm
+  - [0.333333, 0.333333, 0.333333]   # 485nm
+  - [0.333333, 0.333333, 0.333333]   # 490nm
+  - [0.333333, 0.333333, 0.333333]   # 495nm
+  - [0.333333, 0.333333, 0.333333]   # 500nm
+  - [0.333333, 0.333333, 0.333333]   # 505nm
+  - [0.333333, 0.333333, 0.333333]   # 510nm
+  - [0.333333, 0.333333, 0.333333]   # 515nm
+  - [0.333333, 0.333333, 0.333333]   # 520nm
+  - [0.333333, 0.333333, 0.333333]   # 525nm
+  - [0.333333, 0.333333, 0.333333]   # 530nm
+  - [0.333333, 0.333333, 0.333333]   # 535nm
+  - [0.333333, 0.333333, 0.333333]   # 540nm
+  - [0.333333, 0.333333, 0.333333]   # 545nm
+  - [0.333333, 0.333333, 0.333333]   # 550nm
+  - [0.333333, 0.333333, 0.333333]   # 555nm
+  - [0.333333, 0.333333, 0.333333]   # 560nm
+  - [0.333333, 0.333333, 0.333333]   # 565nm
+  - [0.333333, 0.333333, 0.333333]   # 570nm
+  - [0.333333, 0.333333, 0.333333]   # 575nm
+  - [0.333333, 0.333333, 0.333333]   # 580nm
+  - [0.333333, 0.333333, 0.333333]   # 585nm
+  - [0.333333, 0.333333, 0.333333]   # 590nm
+  - [0.333333, 0.333333, 0.333333]   # 595nm
+  - [0.333333, 0.333333, 0.333333]   # 600nm
+  - [0.333333, 0.333333, 0.333333]   # 605nm
+  - [0.333333, 0.333333, 0.333333]   # 610nm
+  - [0.333333, 0.333333, 0.333333]   # 615nm
+  - [0.333333, 0.333333, 0.333333]   # 620nm
+  - [0.333333, 0.333333, 0.333333]   # 625nm
+  - [0.333333, 0.333333, 0.333333]   # 630nm
+  - [0.333333, 0.333333, 0.333333]   # 635nm
+  - [0.333333, 0.333333, 0.333333]   # 640nm
+  - [0.333333, 0.333333, 0.333333]   # 645nm
+  - [0.333333, 0.333333, 0.333333]   # 650nm
+  - [0.333333, 0.333333, 0.333333]   # 655nm
+  - [0.333333, 0.333333, 0.333333]   # 660nm
+  - [0.333333, 0.333333, 0.333333]   # 665nm
+  - [0.333333, 0.333333, 0.333333]   # 670nm
+  - [0.333333, 0.333333, 0.333333]   # 675nm
+  - [0.333333, 0.333333, 0.333333]   # 680nm
+  - [0.333333, 0.333333, 0.333333]   # 685nm
+  - [0.333333, 0.333333, 0.333333]   # 690nm
+  - [0.333333, 0.333333, 0.333333]   # 695nm
+  - [0.333333, 0.333333, 0.333333]   # 700nm
+  - [0.333333, 0.333333, 0.333333]   # 705nm
+  - [0.333333, 0.333333, 0.333333]   # 710nm
+  - [0.333333, 0.333333, 0.333333]   # 715nm
+  - [0.333333, 0.333333, 0.333333]   # 720nm
+  - [0.333333, 0.333333, 0.333333]   # 725nm
+  - [0.333333, 0.333333, 0.333333]   # 730nm
+  - [0.333333, 0.333333, 0.333333]   # 735nm
+  - [0.333333, 0.333333, 0.333333]   # 740nm
+  - [0.333333, 0.333333, 0.333333]   # 745nm
+  - [0.333333, 0.333333, 0.333333]   # 750nm
+  - [0.333333, 0.333333, 0.333333]   # 755nm
+  - [0.333333, 0.333333, 0.333333]   # 760nm
+  - [0.333333, 0.333333, 0.333333]   # 765nm
+  - [0.333333, 0.333333, 0.333333]   # 770nm
+  - [0.333333, 0.333333, 0.333333]   # 775nm
+  - [0.333333, 0.333333, 0.333333]   # 780nm
+
+# Base plus fog. No orange mask on a black-and-white film.
+base_density: [0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1]
+
+# The characteristic curve, parametric.
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [3.5129e-07, 3.5129e-07, 3.5129e-07]
+  - [4.2083e-07, 4.2083e-07, 4.2083e-07]
+  - [5.0412e-07, 5.0412e-07, 5.0412e-07]
+  - [6.039e-07, 6.039e-07, 6.039e-07]
+  - [7.2343e-07, 7.2343e-07, 7.2343e-07]
+  - [8.6662e-07, 8.6662e-07, 8.6662e-07]
+  - [1.0381e-06, 1.0381e-06, 1.0381e-06]
+  - [1.2436e-06, 1.2436e-06, 1.2436e-06]
+  - [1.4898e-06, 1.4898e-06, 1.4898e-06]
+  - [1.7846e-06, 1.7846e-06, 1.7846e-06]
+  - [2.1379e-06, 2.1379e-06, 2.1379e-06]
+  - [2.561e-06, 2.561e-06, 2.561e-06]
+  - [3.0679e-06, 3.0679e-06, 3.0679e-06]
+  - [3.6751e-06, 3.6751e-06, 3.6751e-06]
+  - [4.4025e-06, 4.4025e-06, 4.4025e-06]
+  - [5.2739e-06, 5.2739e-06, 5.2739e-06]
+  - [6.3177e-06, 6.3177e-06, 6.3177e-06]
+  - [7.5681e-06, 7.5681e-06, 7.5681e-06]
+  - [9.066e-06, 9.066e-06, 9.066e-06]
+  - [1.086e-05, 1.086e-05, 1.086e-05]
+  - [1.301e-05, 1.301e-05, 1.301e-05]
+  - [1.5585e-05, 1.5585e-05, 1.5585e-05]
+  - [1.8669e-05, 1.8669e-05, 1.8669e-05]
+  - [2.2364e-05, 2.2364e-05, 2.2364e-05]
+  - [2.6789e-05, 2.6789e-05, 2.6789e-05]
+  - [3.2091e-05, 3.2091e-05, 3.2091e-05]
+  - [3.8441e-05, 3.8441e-05, 3.8441e-05]
+  - [4.6048e-05, 4.6048e-05, 4.6048e-05]
+  - [5.516e-05, 5.516e-05, 5.516e-05]
+  - [6.6074e-05, 6.6074e-05, 6.6074e-05]
+  - [7.9146e-05, 7.9146e-05, 7.9146e-05]
+  - [9.4804e-05, 9.4804e-05, 9.4804e-05]
+  - [0.00011356, 0.00011356, 0.00011356]
+  - [0.00013602, 0.00013602, 0.00013602]
+  - [0.00016292, 0.00016292, 0.00016292]
+  - [0.00019513, 0.00019513, 0.00019513]
+  - [0.0002337, 0.0002337, 0.0002337]
+  - [0.00027989, 0.00027989, 0.00027989]
+  - [0.00033519, 0.00033519, 0.00033519]
+  - [0.00040139, 0.00040139, 0.00040139]
+  - [0.00048064, 0.00048064, 0.00048064]
+  - [0.00057548, 0.00057548, 0.00057548]
+  - [0.00068897, 0.00068897, 0.00068897]
+  - [0.00082475, 0.00082475, 0.00082475]
+  - [0.00098713, 0.00098713, 0.00098713]
+  - [0.0011813, 0.0011813, 0.0011813]
+  - [0.0014134, 0.0014134, 0.0014134]
+  - [0.0016906, 0.0016906, 0.0016906]
+  - [0.0020217, 0.0020217, 0.0020217]
+  - [0.0024167, 0.0024167, 0.0024167]
+  - [0.0028878, 0.0028878, 0.0028878]
+  - [0.0034491, 0.0034491, 0.0034491]
+  - [0.004117, 0.004117, 0.004117]
+  - [0.004911, 0.004911, 0.004911]
+  - [0.0058534, 0.0058534, 0.0058534]
+  - [0.0069701, 0.0069701, 0.0069701]
+  - [0.0082906, 0.0082906, 0.0082906]
+  - [0.0098485, 0.0098485, 0.0098485]
+  - [0.011681, 0.011681, 0.011681]
+  - [0.013831, 0.013831, 0.013831]
+  - [0.016344, 0.016344, 0.016344]
+  - [0.019268, 0.019268, 0.019268]
+  - [0.022655, 0.022655, 0.022655]
+  - [0.026559, 0.026559, 0.026559]
+  - [0.031032, 0.031032, 0.031032]
+  - [0.036126, 0.036126, 0.036126]
+  - [0.041886, 0.041886, 0.041886]
+  - [0.048352, 0.048352, 0.048352]
+  - [0.055556, 0.055556, 0.055556]
+  - [0.063518, 0.063518, 0.063518]
+  - [0.072247, 0.072247, 0.072247]
+  - [0.081739, 0.081739, 0.081739]
+  - [0.09198, 0.09198, 0.09198]
+  - [0.10294, 0.10294, 0.10294]
+  - [0.11459, 0.11459, 0.11459]
+  - [0.12687, 0.12687, 0.12687]
+  - [0.13975, 0.13975, 0.13975]
+  - [0.15317, 0.15317, 0.15317]
+  - [0.16707, 0.16707, 0.16707]
+  - [0.18141, 0.18141, 0.18141]
+  - [0.19613, 0.19613, 0.19613]
+  - [0.21119, 0.21119, 0.21119]
+  - [0.22653, 0.22653, 0.22653]
+  - [0.24214, 0.24214, 0.24214]
+  - [0.25796, 0.25796, 0.25796]
+  - [0.27396, 0.27396, 0.27396]
+  - [0.29013, 0.29013, 0.29013]
+  - [0.30643, 0.30643, 0.30643]
+  - [0.32284, 0.32284, 0.32284]
+  - [0.33935, 0.33935, 0.33935]
+  - [0.35595, 0.35595, 0.35595]
+  - [0.37261, 0.37261, 0.37261]
+  - [0.38933, 0.38933, 0.38933]
+  - [0.4061, 0.4061, 0.4061]
+  - [0.42291, 0.42291, 0.42291]
+  - [0.43975, 0.43975, 0.43975]
+  - [0.45663, 0.45663, 0.45663]
+  - [0.47352, 0.47352, 0.47352]
+  - [0.49044, 0.49044, 0.49044]
+  - [0.50737, 0.50737, 0.50737]
+  - [0.52432, 0.52432, 0.52432]
+  - [0.54128, 0.54128, 0.54128]
+  - [0.55825, 0.55825, 0.55825]
+  - [0.57523, 0.57523, 0.57523]
+  - [0.59222, 0.59222, 0.59222]
+  - [0.60921, 0.60921, 0.60921]
+  - [0.6262, 0.6262, 0.6262]
+  - [0.6432, 0.6432, 0.6432]
+  - [0.6602, 0.6602, 0.6602]
+  - [0.67721, 0.67721, 0.67721]
+  - [0.69422, 0.69422, 0.69422]
+  - [0.71123, 0.71123, 0.71123]
+  - [0.72824, 0.72824, 0.72824]
+  - [0.74525, 0.74525, 0.74525]
+  - [0.76226, 0.76226, 0.76226]
+  - [0.77928, 0.77928, 0.77928]
+  - [0.79629, 0.79629, 0.79629]
+  - [0.81331, 0.81331, 0.81331]
+  - [0.83033, 0.83033, 0.83033]
+  - [0.84734, 0.84734, 0.84734]
+  - [0.86436, 0.86436, 0.86436]
+  - [0.88138, 0.88138, 0.88138]
+  - [0.8984, 0.8984, 0.8984]
+  - [0.91542, 0.91542, 0.91542]
+  - [0.93244, 0.93244, 0.93244]
+  - [0.94945, 0.94945, 0.94945]
+  - [0.96647, 0.96647, 0.96647]
+  - [0.98349, 0.98349, 0.98349]
+  - [1.0005, 1.0005, 1.0005]
+  - [1.0175, 1.0175, 1.0175]
+  - [1.0345, 1.0345, 1.0345]
+  - [1.0516, 1.0516, 1.0516]
+  - [1.0686, 1.0686, 1.0686]
+  - [1.0856, 1.0856, 1.0856]
+  - [1.1026, 1.1026, 1.1026]
+  - [1.1196, 1.1196, 1.1196]
+  - [1.1367, 1.1367, 1.1367]
+  - [1.1537, 1.1537, 1.1537]
+  - [1.1707, 1.1707, 1.1707]
+  - [1.1877, 1.1877, 1.1877]
+  - [1.2047, 1.2047, 1.2047]
+  - [1.2218, 1.2218, 1.2218]
+  - [1.2388, 1.2388, 1.2388]
+  - [1.2558, 1.2558, 1.2558]
+  - [1.2728, 1.2728, 1.2728]
+  - [1.2898, 1.2898, 1.2898]
+  - [1.3069, 1.3069, 1.3069]
+  - [1.3239, 1.3239, 1.3239]
+  - [1.3409, 1.3409, 1.3409]
+  - [1.3579, 1.3579, 1.3579]
+  - [1.3749, 1.3749, 1.3749]
+  - [1.3919, 1.3919, 1.3919]
+  - [1.409, 1.409, 1.409]
+  - [1.426, 1.426, 1.426]
+  - [1.443, 1.443, 1.443]
+  - [1.46, 1.46, 1.46]
+  - [1.477, 1.477, 1.477]
+  - [1.494, 1.494, 1.494]
+  - [1.5111, 1.5111, 1.5111]
+  - [1.5281, 1.5281, 1.5281]
+  - [1.5451, 1.5451, 1.5451]
+  - [1.5621, 1.5621, 1.5621]
+  - [1.5791, 1.5791, 1.5791]
+  - [1.5961, 1.5961, 1.5961]
+  - [1.6131, 1.6131, 1.6131]
+  - [1.6301, 1.6301, 1.6301]
+  - [1.6471, 1.6471, 1.6471]
+  - [1.6642, 1.6642, 1.6642]
+  - [1.6812, 1.6812, 1.6812]
+  - [1.6982, 1.6982, 1.6982]
+  - [1.7151, 1.7151, 1.7151]
+  - [1.7321, 1.7321, 1.7321]
+  - [1.7491, 1.7491, 1.7491]
+  - [1.7661, 1.7661, 1.7661]
+  - [1.7831, 1.7831, 1.7831]
+  - [1.8001, 1.8001, 1.8001]
+  - [1.817, 1.817, 1.817]
+  - [1.834, 1.834, 1.834]
+  - [1.8509, 1.8509, 1.8509]
+  - [1.8679, 1.8679, 1.8679]
+  - [1.8848, 1.8848, 1.8848]
+  - [1.9017, 1.9017, 1.9017]
+  - [1.9186, 1.9186, 1.9186]
+  - [1.9354, 1.9354, 1.9354]
+  - [1.9523, 1.9523, 1.9523]
+  - [1.9691, 1.9691, 1.9691]
+  - [1.9859, 1.9859, 1.9859]
+  - [2.0027, 2.0027, 2.0027]
+  - [2.0194, 2.0194, 2.0194]
+  - [2.036, 2.036, 2.036]
+  - [2.0527, 2.0527, 2.0527]
+  - [2.0692, 2.0692, 2.0692]
+  - [2.0857, 2.0857, 2.0857]
+  - [2.1022, 2.1022, 2.1022]
+  - [2.1185, 2.1185, 2.1185]
+  - [2.1347, 2.1347, 2.1347]
+  - [2.1509, 2.1509, 2.1509]
+  - [2.1669, 2.1669, 2.1669]
+  - [2.1827, 2.1827, 2.1827]
+  - [2.1984, 2.1984, 2.1984]
+  - [2.2139, 2.2139, 2.2139]
+  - [2.2292, 2.2292, 2.2292]
+  - [2.2443, 2.2443, 2.2443]
+  - [2.2591, 2.2591, 2.2591]
+  - [2.2737, 2.2737, 2.2737]
+  - [2.2879, 2.2879, 2.2879]
+  - [2.3018, 2.3018, 2.3018]
+  - [2.3153, 2.3153, 2.3153]
+  - [2.3284, 2.3284, 2.3284]
+  - [2.3411, 2.3411, 2.3411]
+  - [2.3533, 2.3533, 2.3533]
+  - [2.365, 2.365, 2.365]
+  - [2.3761, 2.3761, 2.3761]
+  - [2.3867, 2.3867, 2.3867]
+  - [2.3968, 2.3968, 2.3968]
+  - [2.4063, 2.4063, 2.4063]
+  - [2.4151, 2.4151, 2.4151]
+  - [2.4234, 2.4234, 2.4234]
+  - [2.4311, 2.4311, 2.4311]
+  - [2.4382, 2.4382, 2.4382]
+  - [2.4447, 2.4447, 2.4447]
+  - [2.4507, 2.4507, 2.4507]
+  - [2.4561, 2.4561, 2.4561]
+  - [2.461, 2.461, 2.461]
+  - [2.4655, 2.4655, 2.4655]
+  - [2.4695, 2.4695, 2.4695]
+  - [2.4731, 2.4731, 2.4731]
+  - [2.4763, 2.4763, 2.4763]
+  - [2.4791, 2.4791, 2.4791]
+  - [2.4817, 2.4817, 2.4817]
+  - [2.4839, 2.4839, 2.4839]
+  - [2.4859, 2.4859, 2.4859]
+  - [2.4877, 2.4877, 2.4877]
+  - [2.4892, 2.4892, 2.4892]
+  - [2.4906, 2.4906, 2.4906]
+  - [2.4918, 2.4918, 2.4918]
+  - [2.4928, 2.4928, 2.4928]
+  - [2.4937, 2.4937, 2.4937]
+  - [2.4945, 2.4945, 2.4945]
+  - [2.4952, 2.4952, 2.4952]
+  - [2.4958, 2.4958, 2.4958]
+  - [2.4964, 2.4964, 2.4964]
+  - [2.4969, 2.4969, 2.4969]
+  - [2.4973, 2.4973, 2.4973]
+  - [2.4976, 2.4976, 2.4976]
+  - [2.4979, 2.4979, 2.4979]
+  - [2.4982, 2.4982, 2.4982]
+  - [2.4984, 2.4984, 2.4984]
+  - [2.4986, 2.4986, 2.4986]
+  - [2.4988, 2.4988, 2.4988]
+  - [2.499, 2.499, 2.499]
+  - [2.4991, 2.4991, 2.4991]
+  - [2.4992, 2.4992, 2.4992]
+  - [2.4993, 2.4993, 2.4993]
+  - [2.4994, 2.4994, 2.4994]
+  - [2.4995, 2.4995, 2.4995]

core/dr-film/profiles/kodak_2383.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: kodak_2383
+name: 'Kodak Vision 2383'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: printing        # filming | printing
+monochrome: false
+reference_illuminant: TH-KG3
+viewing_illuminant: K75P
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-0.883808, 0.150828, 0.5583]   # 380nm
+  - [-0.207411, -0.78523, 0.487229]   # 385nm
+  - [-0.361328, -1.86435, 0.412157]   # 390nm
+  - [-1.18339, -2.33066, 0.348404]   # 395nm
+  - [-2.18923, -2.77101, 0.309857]   # 400nm
+  - [-2.3357, -3.17019, 0.326938]   # 405nm
+  - [-2.49276, -3.50597, 0.375358]   # 410nm
+  - [-2.65879, -3.75612, 0.450451]   # 415nm
+  - [-2.83218, -3.89841, 0.534901]   # 420nm
+  - [-3.01134, -3.91061, 0.634267]   # 425nm
+  - [-3.19465, -3.77049, 0.737682]   # 430nm
+  - [-3.38049, -3.45581, 0.792506]   # 435nm
+  - [-3.56727, -2.94436, 0.846104]   # 440nm
+  - [-3.75338, -2.21388, 0.927953]   # 445nm
+  - [-3.9372, -0.692207, 1.01962]   # 450nm
+  - [-4.11713, -0.558681, 1.14188]   # 455nm
+  - [-4.29155, -0.502874, 1.24899]   # 460nm
+  - [-4.45887, -0.427225, 1.29287]   # 465nm
+  - [-4.61747, -0.3508, 1.26857]   # 470nm
+  - [-4.76574, -0.282084, 1.04607]   # 475nm
+  - [-4.90208, -0.21023, 0.692538]   # 480nm
+  - [-5.02488, -0.118926, 0.210161]   # 485nm
+  - [-5.13252, -0.022579, -0.296747]   # 490nm
+  - [-5.2234, 0.0498084, -0.764108]   # 495nm
+  - [-5.29591, 0.107209, -1.23077]   # 500nm
+  - [-5.34845, 0.149272, -1.78664]   # 505nm
+  - [-5.3794, 0.173934, -2.31584]   # 510nm
+  - [-5.38716, 0.179172, -2.80583]   # 515nm
+  - [-5.37011, 0.184326, -3.26083]   # 520nm
+  - [-5.32665, 0.208962, -3.68445]   # 525nm
+  - [-5.25517, 0.260557, -4.07982]   # 530nm
+  - [-5.15407, 0.354333, -4.44969]   # 535nm
+  - [-5.02172, 0.501374, -4.79644]   # 540nm
+  - [-4.85653, 0.771704, -5.12218]   # 545nm
+  - [-4.65689, 0.916834, -5.42875]   # 550nm
+  - [-4.42119, 0.677765, -5.71781]   # 555nm
+  - [-4.14781, 0.354352, -5.99081]   # 560nm
+  - [-3.83516, 0.101789, -6.24905]   # 565nm
+  - [-3.48162, -0.16131, -6.4937]   # 570nm
+  - [-3.08558, -0.418834, -6.7258]   # 575nm
+  - [-2.64544, -0.666563, -6.9463]   # 580nm
+  - [-2.14045, -1.01837, -7.15604]   # 585nm
+  - [-1.65561, -1.35887, -7.3558]   # 590nm
+  - [-1.58929, -1.68353, -7.54626]   # 595nm
+  - [-1.563, -1.99343, -7.72807]   # 600nm
+  - [-1.4964, -2.28956, -7.90179]   # 605nm
+  - [-1.41382, -2.57282, -8.06797]   # 610nm
+  - [-1.32759, -2.84402, -8.22707]   # 615nm
+  - [-1.23505, -3.10392, -8.37954]   # 620nm
+  - [-1.14185, -3.35322, -8.52579]   # 625nm
+  - [-1.06632, -3.59254, -8.66619]   # 630nm
+  - [-1.01884, -3.82247, -8.80108]   # 635nm
+  - [-0.989966, -4.04357, -8.93078]   # 640nm
+  - [-0.980042, -4.25631, -9.05559]   # 645nm
+  - [-0.96699, -4.46118, -9.17578]   # 650nm
+  - [-0.926413, -4.6586, -9.2916]   # 655nm
+  - [-0.866449, -4.84897, -9.40328]   # 660nm
+  - [-0.760525, -5.03266, -9.51104]   # 665nm
+  - [-0.645559, -5.21002, -9.61509]   # 670nm
+  - [-0.535662, -5.38136, -9.71561]   # 675nm
+  - [-0.430857, -5.54699, -9.81278]   # 680nm
+  - [-0.347318, -5.7072, -9.90676]   # 685nm
+  - [-0.295084, -5.86223, -9.99771]   # 690nm
+  - [-0.290194, -6.01234, -10.0858]   # 695nm
+  - [-0.330919, -6.15776, -10.1711]   # 700nm
+  - [-0.457022, -6.29871, -10.2538]   # 705nm
+  - [-0.625307, -6.43538, -10.334]   # 710nm
+  - [-0.811931, -6.56798, -10.4117]   # 715nm
+  - [-1.10502, -6.69668, -10.4872]   # 720nm
+  - [-1.60889, -6.82164, -10.5606]   # 725nm
+  - [-2.10202, -6.94304, -10.6318]   # 730nm
+  - [-2.58107, -7.06101, -10.701]   # 735nm
+  - [-3.04662, -7.17571, -10.7683]   # 740nm
+  - [-3.49924, -7.28727, -10.8337]   # 745nm
+  - [-3.93946, -7.39581, -10.8974]   # 750nm
+  - [-4.36779, -7.50145, -10.9594]   # 755nm
+  - [-4.78469, -7.60432, -11.0197]   # 760nm
+  - [-5.19062, -7.70451, -11.0785]   # 765nm
+  - [-5.586, -7.80214, -11.1358]   # 770nm
+  - [-5.97125, -7.89729, -11.1916]   # 775nm
+  - [-6.34674, -7.99007, -11.246]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0.328986, 0.0494454, 0.299156]   # 380nm
+  - [0.336504, 0.0510529, 0.343005]   # 385nm
+  - [0.3402, 0.0555116, 0.406073]   # 390nm
+  - [0.336466, 0.0651289, 0.482104]   # 395nm
+  - [0.32656, 0.0750952, 0.563436]   # 400nm
+  - [0.309699, 0.0829418, 0.655731]   # 405nm
+  - [0.286499, 0.0890979, 0.752916]   # 410nm
+  - [0.255415, 0.0943034, 0.850953]   # 415nm
+  - [0.221951, 0.100645, 0.949009]   # 420nm
+  - [0.189029, 0.111732, 1.03685]   # 425nm
+  - [0.159868, 0.119186, 1.10663]   # 430nm
+  - [0.132417, 0.10616, 1.15544]   # 435nm
+  - [0.109273, 0.0910754, 1.18289]   # 440nm
+  - [0.0915387, 0.0883877, 1.19449]   # 445nm
+  - [0.0737649, 0.0954276, 1.18856]   # 450nm
+  - [0.0617125, 0.112444, 1.16634]   # 455nm
+  - [0.0518078, 0.138253, 1.12038]   # 460nm
+  - [0.0439813, 0.167942, 1.05639]   # 465nm
+  - [0.0392137, 0.209864, 0.97062]   # 470nm
+  - [0.0368973, 0.259982, 0.875373]   # 475nm
+  - [0.0355868, 0.321888, 0.771241]   # 480nm
+  - [0.0345324, 0.388751, 0.663754]   # 485nm
+  - [0.0344955, 0.469372, 0.562666]   # 490nm
+  - [0.0355061, 0.556036, 0.465867]   # 495nm
+  - [0.0366856, 0.650234, 0.387591]   # 500nm
+  - [0.0379067, 0.742187, 0.31118]   # 505nm
+  - [0.0413467, 0.826601, 0.247904]   # 510nm
+  - [0.0481787, 0.903731, 0.198016]   # 515nm
+  - [0.057178, 0.964939, 0.159676]   # 520nm
+  - [0.0681133, 1.01623, 0.129016]   # 525nm
+  - [0.0803422, 1.05817, 0.106182]   # 530nm
+  - [0.10028, 1.09675, 0.0884244]   # 535nm
+  - [0.121123, 1.11559, 0.0763817]   # 540nm
+  - [0.146407, 1.11349, 0.0674767]   # 545nm
+  - [0.174623, 1.09034, 0.0604038]   # 550nm
+  - [0.20452, 1.03979, 0.0543507]   # 555nm
+  - [0.243368, 0.969812, 0.0486648]   # 560nm
+  - [0.286176, 0.87937, 0.0434019]   # 565nm
+  - [0.335617, 0.776654, 0.0383795]   # 570nm
+  - [0.388536, 0.668154, 0.0338406]   # 575nm
+  - [0.445432, 0.562247, 0.0296466]   # 580nm
+  - [0.509302, 0.465045, 0.0265871]   # 585nm
+  - [0.573817, 0.37766, 0.0235633]   # 590nm
+  - [0.64277, 0.310708, 0.0208485]   # 595nm
+  - [0.713472, 0.251217, 0.0180477]   # 600nm
+  - [0.782746, 0.203133, 0.0165478]   # 605nm
+  - [0.851817, 0.16503, 0.0149352]   # 610nm
+  - [0.921828, 0.138575, 0.0147504]   # 615nm
+  - [0.985922, 0.115047, 0.0147504]   # 620nm
+  - [1.04479, 0.0961419, 0.0147504]   # 625nm
+  - [1.09745, 0.0811408, 0.0148558]   # 630nm
+  - [1.14188, 0.0685567, 0.0158056]   # 635nm
+  - [1.1788, 0.05962, 0.016592]   # 640nm
+  - [1.21155, 0.0521869, 0.0178857]   # 645nm
+  - [1.23287, 0.0458328, 0.0192774]   # 650nm
+  - [1.24562, 0.0408726, 0.0197619]   # 655nm
+  - [1.25044, 0.0360851, 0.0197971]   # 660nm
+  - [1.24882, 0.0314533, 0.0212521]   # 665nm
+  - [1.23925, 0.0277924, 0.0221059]   # 670nm
+  - [1.21968, 0.0247973, 0.0226475]   # 675nm
+  - [1.18839, 0.0220063, 0.0221877]   # 680nm
+  - [1.14956, 0.0175037, 0.0201579]   # 685nm
+  - [1.10637, 0.0151801, 0.0178864]   # 690nm
+  - [1.05507, 0.0138794, 0.0168086]   # 695nm
+  - [0.999137, 0.0126962, 0.0155962]   # 700nm
+  - [0.935888, 0.0114308, 0.0147806]   # 705nm
+  - [0.869866, 0.0101682, 0.0134294]   # 710nm
+  - [0.799826, 0.0091101, 0.0124033]   # 715nm
+  - [0.73307, 0.00829069, 0.0115992]   # 720nm
+  - [0.666632, 0.00808895, 0.0108166]   # 725nm
+  - [0.600848, 0.00813718, 0.00973079]   # 730nm
+  - [0.540287, 0.00730659, 0.00973079]   # 735nm
+  - [0.478772, 0.00644088, 0.00948581]   # 740nm
+  - [0.420256, 0.00579725, 0.00803998]   # 745nm
+  - [0.367259, 0, 0.00690876]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.113637, 0.113635, 0.113629, 0.113617, 0.113591, 0.113541, 0.113451, 0.113297, 0.113045, 0.112657, 0.112088, 0.111294, 0.110236, 0.108888, 0.107242, 0.105307, 0.103109, 0.100686, 0.0980824, 0.0953448, 0.0925152, 0.0896305, 0.0867224, 0.0838195, 0.0809498, 0.0781429, 0.0754307, 0.072847, 0.0704243, 0.0681903, 0.0661639, 0.0643517, 0.0627473, 0.061332, 0.0600789, 0.0589566, 0.0579344, 0.0569854, 0.0560894, 0.0552338, 0.0544135, 0.05363, 0.05289, 0.0522035, 0.0515817, 0.0510349, 0.0505699, 0.0501894, 0.0498905, 0.0496661, 0.0495053, 0.0493957, 0.0493247, 0.0492811, 0.0492557, 0.0492417, 0.0492344, 0.0492308, 0.0492292, 0.0492285, 0.0492282, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281, 0.0492281]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00082207, -0.00082089, -0.0008278]
+  - [-0.00070251, -0.00068042, -0.00074299]
+  - [-0.00050646, -0.00043818, -0.00059421]
+  - [-0.00029511, -0.00018684, -0.00040366]
+  - [-0.00012342, -3.2448e-05, -0.00017405]
+  - [-5.7059e-06, -1.3791e-05, 8.2719e-05]
+  - [9.1999e-05, -5.3052e-05, 0.00030861]
+  - [0.00021437, -1.8094e-05, 0.00041835]
+  - [0.00036418, 0.00014486, 0.00037072]
+  - [0.00048967, 0.00034766, 0.00021435]
+  - [0.00052986, 0.00044217, 4.9948e-05]
+  - [0.00046977, 0.0003613, -5.334e-05]
+  - [0.00032883, 0.00015162, -7.5506e-05]
+  - [0.00015441, -7.0724e-05, -3.2627e-05]
+  - [-2.3977e-06, -0.00019632, 4.8881e-05]
+  - [-0.00010783, -0.00018362, 0.00014965]
+  - [-0.00014853, -6.686e-05, 0.00025336]
+  - [-0.00012144, 8.2629e-05, 0.00033274]
+  - [-2.6361e-05, 0.00020353, 0.00034796]
+  - [0.00012767, 0.00026558, 0.00026816]
+  - [0.00030747, 0.00026076, 0.00010248]
+  - [0.00045058, 0.00018801, -8.7828e-05]
+  - [0.00048483, 5.4486e-05, -0.00021447]
+  - [0.00036793, -0.00010806, -0.0002141]
+  - [0.00012262, -0.00023675, -9.1985e-05]
+  - [-0.00016103, -0.00026207, 7.6502e-05]
+  - [-0.00036566, -0.00015576, 0.00019237]
+  - [-0.00040922, 3.4806e-05, 0.0001975]
+  - [-0.00029184, 0.00020223, 0.0001122]
+  - [-9.5598e-05, 0.0002456, 1.8958e-05]
+  - [6.4346e-05, 0.00014515, 3.3839e-06]
+  - [0.00010726, -1.3323e-05, 9.4186e-05]
+  - [3.0731e-05, -9.0986e-05, 0.00024356]
+  - [-9.5183e-05, 4.5391e-06, 0.00035985]
+  - [-0.00017677, 0.0002432, 0.00036739]
+  - [-0.00015513, 0.00047913, 0.00025196]
+  - [-3.7732e-05, 0.00054189, 6.3884e-05]
+  - [0.00011277, 0.00035217, -0.00011721]
+  - [0.00022, -1.8482e-05, -0.00022712]
+  - [0.00023668, -0.00038648, -0.00024211]
+  - [0.00016449, -0.00056744, -0.00017542]
+  - [4.5733e-05, -0.00048498, -5.8592e-05]
+  - [-6.1163e-05, -0.00020711, 7.2217e-05]
+  - [-0.00010543, 0.00010638, 0.00017793]
+  - [-5.838e-05, 0.00030228, 0.0002157]
+  - [7.9904e-05, 0.00031091, 0.00014993]
+  - [0.00027736, 0.00016019, -2.3776e-05]
+  - [0.00047152, -6.566e-05, -0.00025874]
+  - [0.0005833, -0.00028087, -0.00046438]
+  - [0.0005422, -0.00042305, -0.00055043]
+  - [0.00032611, -0.00047594, -0.00049841]
+  - [8.5758e-06, -0.00044112, -0.00034187]
+  - [-0.00025635, -0.00030015, -0.00010732]
+  - [-0.00033721, -6.1138e-05, 0.00016606]
+  - [-0.00023362, 0.00017239, 0.00037915]
+  - [-7.3449e-05, 0.0002207, 0.00041402]
+  - [3.2502e-06, -3.4787e-05, 0.00025723]
+  - [-4.7319e-05, -0.0005097, 5.7212e-05]
+  - [-0.00017546, -0.00092832, 1.3464e-05]
+  - [-0.00032121, -0.0010273, 0.00017569]
+  - [-0.00041149, -0.00071637, 0.00041454]
+  - [-0.00038262, -0.00012697, 0.00054762]
+  - [-0.00020614, 0.00047118, 0.00047235]
+  - [9.0769e-05, 0.00084241, 0.00022692]
+  - [0.00041803, 0.00092424, -5.6038e-05]
+  - [0.00064508, 0.00083595, -0.00025289]
+  - [0.00065906, 0.00075679, -0.00032172]
+  - [0.00043671, 0.00077331, -0.00029231]
+  - [8.5246e-05, 0.00081752, -0.00019681]
+  - [-0.00018734, 0.0007449, -1.4069e-05]
+  - [-0.00017174, 0.00048813, 0.00031617]
+  - [0.00022531, 0.00015841, 0.00082016]
+  - [0.00092137, 4.2207e-06, 0.0014272]
+  - [0.0017036, 0.00024924, 0.0019845]
+  - [0.0023606, 0.00093112, 0.0023549]
+  - [0.0028196, 0.0018688, 0.0025316]
+  - [0.003202, 0.0027911, 0.0026808]
+  - [0.003757, 0.0035367, 0.0030725]
+  - [0.0047208, 0.0041749, 0.0039422]
+  - [0.0061942, 0.0049591, 0.0053756]
+  - [0.0081217, 0.0061484, 0.0072932]
+  - [0.010381, 0.0078377, 0.0095378]
+  - [0.012911, 0.0099305, 0.011995]
+  - [0.015788, 0.012279, 0.014663]
+  - [0.019192, 0.014885, 0.017636]
+  - [0.023296, 0.017997, 0.021038]
+  - [0.028165, 0.022016, 0.02497]
+  - [0.033751, 0.027284, 0.029525]
+  - [0.040025, 0.033843, 0.034821]
+  - [0.047094, 0.041409, 0.040999]
+  - [0.055231, 0.049631, 0.048231]
+  - [0.064784, 0.058436, 0.05671]
+  - [0.07604, 0.068171, 0.066578]
+  - [0.089121, 0.079452, 0.07782]
+  - [0.104, 0.092819, 0.09023]
+  - [0.12061, 0.10847, 0.10355]
+  - [0.13893, 0.12624, 0.11774]
+  - [0.15911, 0.14581, 0.13305]
+  - [0.18145, 0.167, 0.14986]
+  - [0.20626, 0.18994, 0.16844]
+  - [0.23376, 0.21502, 0.18893]
+  - [0.26407, 0.24262, 0.21127]
+  - [0.29734, 0.27285, 0.23546]
+  - [0.33395, 0.30553, 0.26162]
+  - [0.37453, 0.34041, 0.28998]
+  - [0.41986, 0.37745, 0.32074]
+  - [0.47052, 0.41697, 0.35396]
+  - [0.52668, 0.45953, 0.38953]
+  - [0.58806, 0.5056, 0.42742]
+  - [0.6542, 0.5553, 0.46791]
+  - [0.72487, 0.60839, 0.51166]
+  - [0.80034, 0.66457, 0.55956]
+  - [0.8813, 0.72367, 0.61233]
+  - [0.96846, 0.7857, 0.67023]
+  - [1.0621, 0.85079, 0.733]
+  - [1.1621, 0.91912, 0.80009]
+  - [1.2679, 0.99089, 0.87093]
+  - [1.3785, 1.066, 0.94551]
+  - [1.4926, 1.1438, 1.0246]
+  - [1.6092, 1.2238, 1.1093]
+  - [1.7276, 1.3062, 1.1995]
+  - [1.8478, 1.3921, 1.2938]
+  - [1.9691, 1.4818, 1.3902]
+  - [2.0903, 1.5738, 1.4872]
+  - [2.2092, 1.6659, 1.5844]
+  - [2.3246, 1.7561, 1.6819]
+  - [2.4356, 1.844, 1.7794]
+  - [2.5427, 1.9305, 1.8755]
+  - [2.6461, 2.0169, 1.9685]
+  - [2.7456, 2.1036, 2.0569]
+  - [2.8403, 2.1894, 2.1404]
+  - [2.9292, 2.2726, 2.2192]
+  - [3.0116, 2.3515, 2.2941]
+  - [3.0875, 2.4256, 2.365]
+  - [3.1576, 2.4956, 2.4314]
+  - [3.2223, 2.5624, 2.4925]
+  - [3.282, 2.6265, 2.548]
+  - [3.3369, 2.6875, 2.5985]
+  - [3.387, 2.7447, 2.6449]
+  - [3.4326, 2.7979, 2.6877]
+  - [3.474, 2.8469, 2.7269]
+  - [3.5117, 2.8918, 2.762]
+  - [3.546, 2.9329, 2.7927]
+  - [3.5774, 2.9707, 2.8193]
+  - [3.6058, 3.0056, 2.8427]
+  - [3.6312, 3.0376, 2.8639]
+  - [3.6538, 3.0669, 2.8836]
+  - [3.6739, 3.0936, 2.902]
+  - [3.6918, 3.1181, 2.9187]
+  - [3.7078, 3.1404, 2.9336]
+  - [3.7219, 3.1607, 2.9464]
+  - [3.7343, 3.1789, 2.9574]
+  - [3.7449, 3.1951, 2.9669]
+  - [3.7541, 3.2093, 2.9754]
+  - [3.762, 3.2217, 2.9829]
+  - [3.7688, 3.2326, 2.9894]
+  - [3.7745, 3.2423, 2.9949]
+  - [3.7792, 3.2506, 2.9994]
+  - [3.7829, 3.2578, 3.0031]
+  - [3.7861, 3.2638, 3.0061]
+  - [3.7889, 3.2688, 3.0089]
+  - [3.7916, 3.2731, 3.0116]
+  - [3.794, 3.277, 3.014]
+  - [3.7961, 3.2804, 3.0162]
+  - [3.7975, 3.2835, 3.0178]
+  - [3.7982, 3.2859, 3.0191]
+  - [3.7984, 3.2877, 3.02]
+  - [3.7987, 3.2888, 3.0208]
+  - [3.7993, 3.2895, 3.0215]
+  - [3.8001, 3.29, 3.022]
+  - [3.8008, 3.2905, 3.0224]
+  - [3.801, 3.291, 3.0224]
+  - [3.8009, 3.2916, 3.0223]
+  - [3.8006, 3.2921, 3.0221]
+  - [3.8007, 3.2926, 3.022]
+  - [3.8011, 3.2929, 3.0222]
+  - [3.8016, 3.293, 3.0225]
+  - [3.8017, 3.2929, 3.0228]
+  - [3.8014, 3.2926, 3.023]
+  - [3.8007, 3.2924, 3.023]
+  - [3.8002, 3.2924, 3.0228]
+  - [3.8003, 3.2927, 3.0227]
+  - [3.8009, 3.2931, 3.0226]
+  - [3.8015, 3.2934, 3.0228]
+  - [3.8017, 3.2935, 3.0231]
+  - [3.8012, 3.2934, 3.0233]
+  - [3.8002, 3.2931, 3.0233]
+  - [3.7995, 3.293, 3.0231]
+  - [3.7995, 3.2931, 3.0228]
+  - [3.8003, 3.2933, 3.0226]
+  - [3.8014, 3.2936, 3.0226]
+  - [3.802, 3.2936, 3.0228]
+  - [3.8019, 3.2933, 3.0231]
+  - [3.8013, 3.293, 3.0233]
+  - [3.8006, 3.2929, 3.0232]
+  - [3.8005, 3.2931, 3.023]
+  - [3.8009, 3.2936, 3.0228]
+  - [3.8016, 3.294, 3.0226]
+  - [3.802, 3.2942, 3.0227]
+  - [3.8019, 3.2937, 3.0229]
+  - [3.8014, 3.293, 3.0232]
+  - [3.8009, 3.2922, 3.0233]
+  - [3.8004, 3.2919, 3.0235]
+  - [3.8002, 3.292, 3.0236]
+  - [3.8003, 3.2925, 3.0236]
+  - [3.8005, 3.293, 3.0235]
+  - [3.8009, 3.2933, 3.0233]
+  - [3.8013, 3.2936, 3.023]
+  - [3.8015, 3.2937, 3.0229]
+  - [3.8015, 3.2937, 3.023]
+  - [3.8015, 3.2938, 3.0232]
+  - [3.8015, 3.2939, 3.0232]
+  - [3.8014, 3.294, 3.0231]
+  - [3.8013, 3.294, 3.0228]
+  - [3.8011, 3.2939, 3.0224]
+  - [3.801, 3.2936, 3.0222]
+  - [3.801, 3.2932, 3.0222]
+  - [3.8011, 3.2928, 3.0224]
+  - [3.8012, 3.2927, 3.0227]
+  - [3.8014, 3.2927, 3.023]
+  - [3.8015, 3.2929, 3.0232]
+  - [3.8014, 3.293, 3.0233]
+  - [3.8012, 3.293, 3.0233]
+  - [3.801, 3.293, 3.0233]
+  - [3.8008, 3.293, 3.0233]
+  - [3.8008, 3.293, 3.0232]
+  - [3.8009, 3.2931, 3.023]
+  - [3.801, 3.2933, 3.0228]
+  - [3.8012, 3.2935, 3.0228]
+  - [3.8013, 3.2936, 3.023]
+  - [3.8013, 3.2935, 3.0232]
+  - [3.8012, 3.2935, 3.0233]
+  - [3.801, 3.2934, 3.0232]
+  - [3.8009, 3.2934, 3.0229]
+  - [3.8009, 3.2934, 3.0226]
+  - [3.801, 3.2933, 3.0226]
+  - [3.8012, 3.2932, 3.0227]
+  - [3.8014, 3.293, 3.023]
+  - [3.8016, 3.2928, 3.0232]
+  - [3.8016, 3.2928, 3.0231]
+  - [3.8014, 3.2929, 3.0229]
+  - [3.8011, 3.2931, 3.0227]
+  - [3.8007, 3.2934, 3.0227]
+  - [3.8005, 3.2935, 3.023]
+  - [3.8006, 3.2935, 3.0235]
+  - [3.8008, 3.2933, 3.0238]
+  - [3.8011, 3.293, 3.0239]
+  - [3.8014, 3.2928, 3.0237]
+  - [3.8014, 3.2927, 3.0234]
+  - [3.8013, 3.2928, 3.0232]
+  - [3.8011, 3.2931, 3.0231]
+  - [3.8009, 3.2933, 3.0231]
+  - [3.8008, 3.2935, 3.0229]
+  - [3.8008, 3.2936, 3.0228]
+  - [3.8007, 3.2936, 3.0227]
+  - [3.8007, 3.2937, 3.0226]

core/dr-film/profiles/kodak_2393.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: kodak_2393
+name: 'Kodak Vision Premier 2393'
+kind: negative          # negative | positive
+support: film    # film | paper
+stage: printing        # filming | printing
+monochrome: false
+reference_illuminant: TH-KG3
+viewing_illuminant: K75P
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-6.38706, -6.73576, 0.220346]   # 380nm
+  - [-6.34032, -6.45024, 0.161528]   # 385nm
+  - [-6.29218, -6.15008, 0.187294]   # 390nm
+  - [-6.24258, -5.83412, 0.251027]   # 395nm
+  - [-6.19146, -5.50108, 0.314302]   # 400nm
+  - [-6.13874, -5.14953, 0.366303]   # 405nm
+  - [-6.08435, -4.7779, 0.421851]   # 410nm
+  - [-6.0282, -4.38441, 0.490894]   # 415nm
+  - [-5.97021, -3.96707, 0.582608]   # 420nm
+  - [-5.91029, -3.52365, 0.677497]   # 425nm
+  - [-5.84834, -3.05162, 0.768436]   # 430nm
+  - [-5.78425, -2.54812, 0.856478]   # 435nm
+  - [-5.71791, -2.0099, 0.943324]   # 440nm
+  - [-5.6492, -1.43323, 1.0304]   # 445nm
+  - [-5.578, -0.842602, 1.11896]   # 450nm
+  - [-5.50416, -0.584435, 1.21087]   # 455nm
+  - [-5.42753, -0.490407, 1.27082]   # 460nm
+  - [-5.34795, -0.408291, 1.30207]   # 465nm
+  - [-5.26525, -0.330238, 1.20335]   # 470nm
+  - [-5.17925, -0.254033, 0.90501]   # 475nm
+  - [-5.08973, -0.141301, 0.522446]   # 480nm
+  - [-4.99649, -0.00930504, 0.0924237]   # 485nm
+  - [-4.89927, 0.101568, -0.372282]   # 490nm
+  - [-4.79783, 0.165248, -0.864203]   # 495nm
+  - [-4.69189, 0.209648, -1.52674]   # 500nm
+  - [-4.58112, 0.236945, -2.15642]   # 505nm
+  - [-4.46521, 0.229435, -2.73766]   # 510nm
+  - [-4.34377, 0.222211, -3.27585]   # 515nm
+  - [-4.21641, 0.222618, -3.77559]   # 520nm
+  - [-4.08268, 0.242737, -4.24087]   # 525nm
+  - [-3.9421, 0.292345, -4.67513]   # 530nm
+  - [-3.79411, 0.410222, -5.08138]   # 535nm
+  - [-3.63813, 0.590163, -5.46223]   # 540nm
+  - [-3.47348, 0.800373, -5.82]   # 545nm
+  - [-3.29942, 0.853441, -6.15673]   # 550nm
+  - [-3.11513, 0.665462, -6.47421]   # 555nm
+  - [-2.91966, 0.359858, -6.77406]   # 560nm
+  - [-2.71198, 0.0564512, -7.0577]   # 565nm
+  - [-2.4909, -0.245276, -7.32641]   # 570nm
+  - [-2.25507, -0.572887, -7.58134]   # 575nm
+  - [-2.00299, -0.957532, -7.82352]   # 580nm
+  - [-1.74444, -1.42954, -8.05389]   # 585nm
+  - [-1.7149, -1.88137, -8.27329]   # 590nm
+  - [-1.68124, -2.30308, -8.48249]   # 595nm
+  - [-1.60974, -2.69758, -8.68217]   # 600nm
+  - [-1.54055, -3.06743, -8.87299]   # 605nm
+  - [-1.4476, -3.41486, -9.0555]   # 610nm
+  - [-1.37318, -3.74186, -9.23025]   # 615nm
+  - [-1.25774, -4.05016, -9.39772]   # 620nm
+  - [-1.16371, -4.34135, -9.55835]   # 625nm
+  - [-1.11482, -4.61679, -9.71256]   # 630nm
+  - [-1.08761, -4.87773, -9.86072]   # 635nm
+  - [-1.0646, -5.12529, -10.0032]   # 640nm
+  - [-1.03032, -5.36048, -10.1403]   # 645nm
+  - [-0.986823, -5.58419, -10.2723]   # 650nm
+  - [-0.935193, -5.79725, -10.3995]   # 655nm
+  - [-0.876013, -6.0004, -10.5221]   # 660nm
+  - [-0.799898, -6.19431, -10.6405]   # 665nm
+  - [-0.682598, -6.37961, -10.7548]   # 670nm
+  - [-0.577348, -6.55685, -10.8652]   # 675nm
+  - [-0.340454, -6.72655, -10.9719]   # 680nm
+  - [-0.172452, -6.88918, -11.0751]   # 685nm
+  - [-0.152901, -7.04517, -11.175]   # 690nm
+  - [-0.260099, -7.19492, -11.2718]   # 695nm
+  - [-0.449934, -7.3388, -11.3655]   # 700nm
+  - [-0.582681, -7.47714, -11.4563]   # 705nm
+  - [-0.758751, -7.61026, -11.5443]   # 710nm
+  - [-1.00918, -7.73846, -11.6298]   # 715nm
+  - [-1.40657, -7.86199, -11.7127]   # 720nm
+  - [-1.88394, -7.98111, -11.7932]   # 725nm
+  - [-2.34221, -8.09605, -11.8715]   # 730nm
+  - [-2.77092, -8.20702, -11.9475]   # 735nm
+  - [-3.17283, -8.31424, -12.0214]   # 740nm
+  - [-3.55038, -8.41788, -12.0933]   # 745nm
+  - [-3.90573, -8.51812, -12.1632]   # 750nm
+  - [-4.24077, -8.61513, -12.2313]   # 755nm
+  - [-4.5572, -8.70906, -12.2976]   # 760nm
+  - [-4.85652, -8.80005, -12.3621]   # 765nm
+  - [-5.14009, -8.88825, -12.425]   # 770nm
+  - [-5.40911, -8.97377, -12.4863]   # 775nm
+  - [-5.66469, -9.05674, -12.5461]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0.348359, 0.0541461, 0.346906]   # 380nm
+  - [0.352865, 0.0536263, 0.379638]   # 385nm
+  - [0.35245, 0.0550341, 0.439112]   # 390nm
+  - [0.348388, 0.058513, 0.51498]   # 395nm
+  - [0.339222, 0.0640309, 0.600159]   # 400nm
+  - [0.322342, 0.0707414, 0.69195]   # 405nm
+  - [0.297655, 0.0786195, 0.788426]   # 410nm
+  - [0.267174, 0.0890524, 0.879218]   # 415nm
+  - [0.234145, 0.0999203, 0.96289]   # 420nm
+  - [0.202712, 0.108705, 1.03275]   # 425nm
+  - [0.173819, 0.112497, 1.09239]   # 430nm
+  - [0.148217, 0.111658, 1.12838]   # 435nm
+  - [0.125212, 0.107855, 1.14948]   # 440nm
+  - [0.105622, 0.10559, 1.15803]   # 445nm
+  - [0.087123, 0.109437, 1.1566]   # 450nm
+  - [0.0697223, 0.121793, 1.14642]   # 455nm
+  - [0.0545372, 0.142381, 1.12446]   # 460nm
+  - [0.044302, 0.17005, 1.08653]   # 465nm
+  - [0.0386227, 0.205605, 1.02403]   # 470nm
+  - [0.0362424, 0.247192, 0.948582]   # 475nm
+  - [0.0357649, 0.303254, 0.858799]   # 480nm
+  - [0.0357649, 0.373669, 0.755465]   # 485nm
+  - [0.0357649, 0.453275, 0.647434]   # 490nm
+  - [0.0357649, 0.538276, 0.544068]   # 495nm
+  - [0.0357649, 0.630136, 0.447618]   # 500nm
+  - [0.0359242, 0.721171, 0.36334]   # 505nm
+  - [0.0386611, 0.808445, 0.290536]   # 510nm
+  - [0.0459982, 0.884974, 0.227495]   # 515nm
+  - [0.0579839, 0.951357, 0.183785]   # 520nm
+  - [0.0735487, 1.0057, 0.145589]   # 525nm
+  - [0.0906838, 1.05512, 0.116472]   # 530nm
+  - [0.108566, 1.09133, 0.0957736]   # 535nm
+  - [0.128974, 1.11508, 0.079254]   # 540nm
+  - [0.153795, 1.11885, 0.0644266]   # 545nm
+  - [0.182226, 1.10059, 0.0511924]   # 550nm
+  - [0.211981, 1.06033, 0.0407672]   # 555nm
+  - [0.24372, 1.00397, 0.0342171]   # 560nm
+  - [0.281891, 0.929598, 0.0313661]   # 565nm
+  - [0.329348, 0.835941, 0.0286413]   # 570nm
+  - [0.380305, 0.727228, 0.024393]   # 575nm
+  - [0.436474, 0.623032, 0.0193241]   # 580nm
+  - [0.497021, 0.525169, 0.0162746]   # 585nm
+  - [0.562689, 0.433257, 0.0149367]   # 590nm
+  - [0.631658, 0.354434, 0.0148282]   # 595nm
+  - [0.702837, 0.289379, 0.0148282]   # 600nm
+  - [0.77681, 0.236512, 0.0148282]   # 605nm
+  - [0.851016, 0.196467, 0.0148282]   # 610nm
+  - [0.919689, 0.159154, 0.0148282]   # 615nm
+  - [0.98382, 0.129968, 0.0148282]   # 620nm
+  - [1.04409, 0.109398, 0.0148282]   # 625nm
+  - [1.09715, 0.0945298, 0.0148282]   # 630nm
+  - [1.14579, 0.0817305, 0.0148282]   # 635nm
+  - [1.18129, 0.070091, 0.0148282]   # 640nm
+  - [1.2125, 0.0611412, 0.0148282]   # 645nm
+  - [1.23864, 0.0539845, 0.0148282]   # 650nm
+  - [1.25673, 0.0475015, 0.0148282]   # 655nm
+  - [1.26763, 0.04096, 0.0148282]   # 660nm
+  - [1.27133, 0.0346818, 0.0148282]   # 665nm
+  - [1.26877, 0.0296867, 0.0148282]   # 670nm
+  - [1.25731, 0.0268906, 0.0148282]   # 675nm
+  - [1.23729, 0.0248274, 0.0148282]   # 680nm
+  - [1.20862, 0.0214232, 0.0146066]   # 685nm
+  - [1.17028, 0.0177576, 0.0128235]   # 690nm
+  - [1.12542, 0.0151628, 0.0116854]   # 695nm
+  - [1.07635, 0.0138851, 0.013971]   # 700nm
+  - [1.01852, 0.0122393, 0.0150172]   # 705nm
+  - [0.954189, 0.0105577, 0.015368]   # 710nm
+  - [0.886115, 0.0073301, 0.0151927]   # 715nm
+  - [0.815741, 0.00369962, 0.0138001]   # 720nm
+  - [0.744385, 0.000580877, 0.00805805]   # 725nm
+  - [0.674477, 0.000358487, 0.0052296]   # 730nm
+  - [0.603866, 0.000358487, 0.00125818]   # 735nm
+  - [0.53315, 0.000358487, 0.00108627]   # 740nm
+  - [0.464063, 0.000358487, 0.00108627]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.0745085, 0.0745078, 0.074506, 0.0745019, 0.0744936, 0.0744778, 0.0744489, 0.0743994, 0.0743188, 0.0741944, 0.074012, 0.0737573, 0.0734181, 0.0729862, 0.0724586, 0.0718383, 0.0711335, 0.0703568, 0.0695224, 0.0686451, 0.0677387, 0.0668154, 0.0658858, 0.0649601, 0.0640486, 0.0631625, 0.0623143, 0.0615171, 0.0607838, 0.0601254, 0.0595493, 0.0590581, 0.0586493, 0.0583155, 0.0580459, 0.057828, 0.0576492, 0.0574984, 0.0573669, 0.0572483, 0.0571388, 0.0570365, 0.0569411, 0.0568532, 0.0567737, 0.056704, 0.0566447, 0.0565962, 0.0565582, 0.0565296, 0.0565091, 0.0564951, 0.0564861, 0.0564805, 0.0564773, 0.0564755, 0.0564746, 0.0564741, 0.0564739, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738, 0.0564738]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00082207, -0.00082089, -0.0008278]
+  - [-0.00070251, -0.00068042, -0.00074299]
+  - [-0.00050646, -0.00043818, -0.00059421]
+  - [-0.00029511, -0.00018684, -0.00040366]
+  - [-0.00012342, -3.2448e-05, -0.00017405]
+  - [-5.7059e-06, -1.3791e-05, 8.2719e-05]
+  - [9.1999e-05, -5.3052e-05, 0.00030861]
+  - [0.00021437, -1.8094e-05, 0.00041835]
+  - [0.00036418, 0.00014486, 0.00037072]
+  - [0.00048967, 0.00034766, 0.00021435]
+  - [0.00052986, 0.00044217, 4.9948e-05]
+  - [0.00046977, 0.0003613, -5.334e-05]
+  - [0.00032883, 0.00015162, -7.5506e-05]
+  - [0.00015441, -7.0724e-05, -3.2627e-05]
+  - [-2.3977e-06, -0.00019632, 4.8881e-05]
+  - [-0.00010783, -0.00018362, 0.00014965]
+  - [-0.00014853, -6.686e-05, 0.00025336]
+  - [-0.00012144, 8.2629e-05, 0.00033274]
+  - [-2.6361e-05, 0.00020353, 0.00034796]
+  - [0.00012767, 0.00026558, 0.00026816]
+  - [0.00030747, 0.00026076, 0.00010248]
+  - [0.00045058, 0.00018801, -8.7828e-05]
+  - [0.00048483, 5.4486e-05, -0.00021447]
+  - [0.00036793, -0.00010806, -0.0002141]
+  - [0.00012262, -0.00023675, -9.1984e-05]
+  - [-0.00016103, -0.00026207, 7.6503e-05]
+  - [-0.00036566, -0.00015576, 0.00019237]
+  - [-0.00040922, 3.4806e-05, 0.0001975]
+  - [-0.00029184, 0.00020223, 0.0001122]
+  - [-9.5598e-05, 0.0002456, 1.8959e-05]
+  - [6.4346e-05, 0.00014515, 3.385e-06]
+  - [0.00010726, -1.3323e-05, 9.4188e-05]
+  - [3.0731e-05, -9.0986e-05, 0.00024357]
+  - [-9.5183e-05, 4.5392e-06, 0.00035985]
+  - [-0.00017677, 0.0002432, 0.0003674]
+  - [-0.00015513, 0.00047913, 0.00025198]
+  - [-3.7733e-05, 0.00054189, 6.39e-05]
+  - [0.00011277, 0.00035218, -0.00011718]
+  - [0.00022, -1.8481e-05, -0.00022708]
+  - [0.00023667, -0.00038647, -0.00024206]
+  - [0.00016449, -0.00056743, -0.00017533]
+  - [4.5726e-05, -0.00048498, -5.8466e-05]
+  - [-6.1174e-05, -0.00020711, 7.2404e-05]
+  - [-0.00010544, 0.0001064, 0.0001782]
+  - [-5.8407e-05, 0.0003023, 0.00021611]
+  - [7.9861e-05, 0.00031094, 0.00015051]
+  - [0.00027729, 0.00016024, -2.2941e-05]
+  - [0.00047142, -6.5589e-05, -0.00025755]
+  - [0.00058314, -0.00028076, -0.00046269]
+  - [0.00054195, -0.00042289, -0.00054804]
+  - [0.00032575, -0.0004757, -0.00049504]
+  - [8.0356e-06, -0.00044079, -0.00033713]
+  - [-0.00025714, -0.00029966, -0.0001007]
+  - [-0.00033838, -6.0428e-05, 0.00017525]
+  - [-0.00023534, 0.0001734, 0.00039182]
+  - [-7.5975e-05, 0.00022215, 0.00043135]
+  - [-4.119e-07, -3.2754e-05, 0.00028074]
+  - [-5.2574e-05, -0.00050686, 8.8912e-05]
+  - [-0.00018294, -0.00092438, 5.6025e-05]
+  - [-0.00033179, -0.0010218, 0.00023261]
+  - [-0.00042635, -0.00070888, 0.00049025]
+  - [-0.00040343, -0.00011674, 0.00064761]
+  - [-0.00023517, 0.00048505, 0.0006034]
+  - [5.0501e-05, 0.00086105, 0.00039745]
+  - [0.00036253, 0.00094912, 0.00016454]
+  - [0.00056926, 0.00086891, 3.0952e-05]
+  - [0.00055652, 0.00080017, 4.1715e-05]
+  - [0.00029943, 0.00083003, 0.00017055]
+  - [-9.7042e-05, 0.00089121, 0.00038935]
+  - [-0.0004281, 0.00084002, 0.00072411]
+  - [-0.0004888, 0.00061019, 0.0012408]
+  - [-0.00019118, 0.00031416, 0.001972]
+  - [0.00037652, 0.00020172, 0.0028538]
+  - [0.00099577, 0.000498, 0.0037399]
+  - [0.0014493, 0.0012422, 0.0045001]
+  - [0.0016577, 0.0022552, 0.0051358]
+  - [0.0017329, 0.0032687, 0.0058232]
+  - [0.001911, 0.0041244, 0.0068447]
+  - [0.0024117, 0.0048953, 0.0084491]
+  - [0.0033186, 0.0058383, 0.010734]
+  - [0.0045602, 0.007216, 0.013632]
+  - [0.0059997, 0.0091274, 0.016994]
+  - [0.0075624, 0.011482, 0.020715]
+  - [0.0093067, 0.014141, 0.024803]
+  - [0.01139, 0.017114, 0.029365]
+  - [0.01396, 0.020658, 0.034535]
+  - [0.017064, 0.025181, 0.040427]
+  - [0.020642, 0.031032, 0.047144]
+  - [0.024658, 0.038264, 0.054815]
+  - [0.029209, 0.046614, 0.063592]
+  - [0.034544, 0.055761, 0.073659]
+  - [0.040984, 0.065656, 0.085223]
+  - [0.048788, 0.076667, 0.098437]
+  - [0.058068, 0.089421, 0.1133]
+  - [0.068805, 0.10447, 0.12962]
+  - [0.080939, 0.12204, 0.14717]
+  - [0.094479, 0.14199, 0.16592]
+  - [0.10957, 0.16404, 0.18616]
+  - [0.12649, 0.18804, 0.20829]
+  - [0.14551, 0.21413, 0.23263]
+  - [0.16681, 0.24272, 0.25932]
+  - [0.1905, 0.27416, 0.28838]
+  - [0.2167, 0.30855, 0.3198]
+  - [0.24568, 0.3457, 0.35373]
+  - [0.27798, 0.38533, 0.39042]
+  - [0.31419, 0.42736, 0.43007]
+  - [0.35475, 0.47205, 0.47272]
+  - [0.39977, 0.51983, 0.51824]
+  - [0.449, 0.57106, 0.56656]
+  - [0.50208, 0.62574, 0.6179]
+  - [0.55887, 0.68357, 0.67286]
+  - [0.61968, 0.74416, 0.73221]
+  - [0.68523, 0.80728, 0.79659]
+  - [0.75631, 0.87293, 0.86615]
+  - [0.83343, 0.94119, 0.94064]
+  - [0.91678, 1.0123, 1.0195]
+  - [1.0063, 1.0864, 1.1024]
+  - [1.1017, 1.1635, 1.1893]
+  - [1.2023, 1.2434, 1.2811]
+  - [1.3078, 1.3256, 1.379]
+  - [1.4181, 1.4108, 1.4833]
+  - [1.5336, 1.5, 1.5929]
+  - [1.6544, 1.594, 1.7063]
+  - [1.7796, 1.6918, 1.8223]
+  - [1.9077, 1.7918, 1.941]
+  - [2.0373, 1.8923, 2.0626]
+  - [2.1679, 1.9932, 2.187]
+  - [2.2997, 2.0956, 2.3132]
+  - [2.4328, 2.2008, 2.4393]
+  - [2.5669, 2.3096, 2.5638]
+  - [2.7005, 2.421, 2.6859]
+  - [2.8318, 2.5331, 2.8057]
+  - [2.9595, 2.6439, 2.9235]
+  - [3.0827, 2.7527, 3.0389]
+  - [3.2014, 2.8598, 3.1506]
+  - [3.3155, 2.9659, 3.2572]
+  - [3.4248, 3.0712, 3.3576]
+  - [3.5287, 3.1748, 3.4518]
+  - [3.6268, 3.2756, 3.5403]
+  - [3.7189, 3.3725, 3.6232]
+  - [3.8049, 3.465, 3.7001]
+  - [3.8851, 3.5525, 3.7698]
+  - [3.9597, 3.6352, 3.8317]
+  - [4.0292, 3.7133, 3.8862]
+  - [4.0932, 3.7868, 3.9342]
+  - [4.1518, 3.8558, 3.977]
+  - [4.205, 3.9201, 4.0155]
+  - [4.2534, 3.9798, 4.05]
+  - [4.2973, 4.0351, 4.0803]
+  - [4.3372, 4.0861, 4.1063]
+  - [4.3732, 4.133, 4.1282]
+  - [4.4055, 4.1757, 4.1464]
+  - [4.4343, 4.2141, 4.1616]
+  - [4.4598, 4.2485, 4.1745]
+  - [4.4825, 4.2792, 4.1853]
+  - [4.5025, 4.3066, 4.1942]
+  - [4.5202, 4.331, 4.2014]
+  - [4.5355, 4.3525, 4.2071]
+  - [4.5487, 4.3714, 4.2114]
+  - [4.5602, 4.3877, 4.2149]
+  - [4.5704, 4.4018, 4.2179]
+  - [4.5796, 4.4141, 4.2206]
+  - [4.5879, 4.4249, 4.2229]
+  - [4.5949, 4.4345, 4.2249]
+  - [4.6006, 4.4428, 4.2264]
+  - [4.6049, 4.4498, 4.2274]
+  - [4.6082, 4.4553, 4.2281]
+  - [4.6111, 4.4597, 4.2287]
+  - [4.614, 4.4631, 4.2292]
+  - [4.6167, 4.4659, 4.2296]
+  - [4.619, 4.4683, 4.2298]
+  - [4.6205, 4.4705, 4.2297]
+  - [4.6214, 4.4724, 4.2294]
+  - [4.6221, 4.474, 4.2292]
+  - [4.6228, 4.4754, 4.2291]
+  - [4.6238, 4.4764, 4.2292]
+  - [4.6248, 4.4771, 4.2294]
+  - [4.6253, 4.4774, 4.2297]
+  - [4.6253, 4.4776, 4.2298]
+  - [4.6248, 4.4777, 4.2298]
+  - [4.6245, 4.4779, 4.2296]
+  - [4.6247, 4.4784, 4.2295]
+  - [4.6254, 4.4789, 4.2295]
+  - [4.6262, 4.4793, 4.2296]
+  - [4.6264, 4.4795, 4.2299]
+  - [4.6259, 4.4795, 4.2301]
+  - [4.625, 4.4793, 4.2301]
+  - [4.6243, 4.4791, 4.2299]
+  - [4.6244, 4.4793, 4.2296]
+  - [4.6252, 4.4795, 4.2294]
+  - [4.6262, 4.4798, 4.2294]
+  - [4.6269, 4.4798, 4.2296]
+  - [4.6268, 4.4796, 4.2299]
+  - [4.6262, 4.4793, 4.2301]
+  - [4.6255, 4.4791, 4.23]
+  - [4.6254, 4.4794, 4.2298]
+  - [4.6258, 4.4799, 4.2295]
+  - [4.6265, 4.4803, 4.2294]
+  - [4.6269, 4.4804, 4.2295]
+  - [4.6268, 4.48, 4.2297]
+  - [4.6264, 4.4793, 4.23]
+  - [4.6258, 4.4785, 4.2301]
+  - [4.6253, 4.4782, 4.2302]
+  - [4.6251, 4.4783, 4.2303]
+  - [4.6252, 4.4787, 4.2304]
+  - [4.6254, 4.4792, 4.2303]
+  - [4.6258, 4.4796, 4.23]
+  - [4.6262, 4.4799, 4.2298]
+  - [4.6264, 4.48, 4.2297]
+  - [4.6264, 4.48, 4.2298]
+  - [4.6264, 4.4801, 4.2299]
+  - [4.6264, 4.4802, 4.23]
+  - [4.6263, 4.4803, 4.2299]
+  - [4.6262, 4.4803, 4.2296]
+  - [4.626, 4.4802, 4.2292]
+  - [4.6259, 4.4798, 4.229]
+  - [4.6259, 4.4794, 4.2289]
+  - [4.626, 4.4791, 4.2292]
+  - [4.6261, 4.479, 4.2295]
+  - [4.6263, 4.479, 4.2298]
+  - [4.6264, 4.4792, 4.23]
+  - [4.6263, 4.4793, 4.2301]
+  - [4.6261, 4.4793, 4.2301]
+  - [4.6259, 4.4793, 4.2301]
+  - [4.6257, 4.4792, 4.2301]
+  - [4.6257, 4.4793, 4.2299]
+  - [4.6258, 4.4794, 4.2298]
+  - [4.626, 4.4796, 4.2296]
+  - [4.6261, 4.4798, 4.2296]
+  - [4.6262, 4.4799, 4.2298]
+  - [4.6262, 4.4798, 4.23]
+  - [4.6261, 4.4798, 4.2301]
+  - [4.6259, 4.4797, 4.23]
+  - [4.6258, 4.4797, 4.2297]
+  - [4.6258, 4.4797, 4.2294]
+  - [4.6259, 4.4796, 4.2293]
+  - [4.6261, 4.4795, 4.2295]
+  - [4.6263, 4.4793, 4.2298]
+  - [4.6265, 4.4791, 4.23]
+  - [4.6265, 4.4791, 4.2299]
+  - [4.6263, 4.4792, 4.2297]
+  - [4.626, 4.4794, 4.2295]
+  - [4.6256, 4.4797, 4.2295]
+  - [4.6254, 4.4798, 4.2298]
+  - [4.6255, 4.4798, 4.2302]
+  - [4.6257, 4.4796, 4.2306]
+  - [4.626, 4.4793, 4.2307]
+  - [4.6263, 4.479, 4.2305]
+  - [4.6263, 4.479, 4.2301]
+  - [4.6262, 4.4791, 4.2299]
+  - [4.626, 4.4793, 4.2299]
+  - [4.6258, 4.4796, 4.2298]
+  - [4.6258, 4.4797, 4.2297]
+  - [4.6257, 4.4799, 4.2296]
+  - [4.6256, 4.4799, 4.2295]
+  - [4.6256, 4.4799, 4.2294]

core/dr-film/profiles/kodak_ektachrome_100.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: kodak_ektachrome_100
+name: 'Kodak Ektachrome 100'
+kind: positive          # negative | positive
+support: film    # film | paper
+stage: filming        # filming | printing
+monochrome: false
+reference_illuminant: D55
+viewing_illuminant: D50
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-4.85665, -4.94942, -1.84408]   # 380nm
+  - [-4.82936, -4.86387, -1.63395]   # 385nm
+  - [-4.80114, -4.77435, -1.40702]   # 390nm
+  - [-4.77195, -4.68057, -1.16117]   # 395nm
+  - [-4.74173, -4.58221, -0.893944]   # 400nm
+  - [-4.71044, -4.47893, -0.618543]   # 405nm
+  - [-4.67801, -4.37036, -0.475547]   # 410nm
+  - [-4.64438, -4.25607, -0.39012]   # 415nm
+  - [-4.60948, -4.1356, -0.321792]   # 420nm
+  - [-4.57324, -4.00845, -0.242086]   # 425nm
+  - [-4.53558, -3.87402, -0.250121]   # 430nm
+  - [-4.49641, -3.73169, -0.389513]   # 435nm
+  - [-4.45565, -3.58073, -0.430417]   # 440nm
+  - [-4.4132, -3.42034, -0.43559]   # 445nm
+  - [-4.36893, -3.2496, -0.410233]   # 450nm
+  - [-4.32275, -3.06747, -0.372955]   # 455nm
+  - [-4.27452, -2.87279, -0.369571]   # 460nm
+  - [-4.2241, -2.6642, -0.419118]   # 465nm
+  - [-4.17133, -2.44016, -0.614775]   # 470nm
+  - [-4.11606, -2.19889, -0.957109]   # 475nm
+  - [-4.05811, -1.93831, -1.27902]   # 480nm
+  - [-3.99726, -1.6701, -1.5094]   # 485nm
+  - [-3.9333, -1.43558, -1.64762]   # 490nm
+  - [-3.86599, -1.24404, -1.74093]   # 495nm
+  - [-3.79505, -1.08588, -1.85634]   # 500nm
+  - [-3.72019, -0.975744, -2.01368]   # 505nm
+  - [-3.64108, -0.90134, -2.18427]   # 510nm
+  - [-3.55736, -0.834369, -2.33568]   # 515nm
+  - [-3.4686, -0.767927, -2.48697]   # 520nm
+  - [-3.37437, -0.683837, -2.62617]   # 525nm
+  - [-3.27416, -0.602357, -2.75465]   # 530nm
+  - [-3.16742, -0.529644, -2.87362]   # 535nm
+  - [-3.05358, -0.459416, -2.98409]   # 540nm
+  - [-2.93208, -0.35565, -3.08694]   # 545nm
+  - [-2.80254, -0.360654, -3.18294]   # 550nm
+  - [-2.66555, -0.392191, -3.27274]   # 555nm
+  - [-2.52805, -0.380059, -3.35693]   # 560nm
+  - [-2.48164, -0.363515, -3.43601]   # 565nm
+  - [-2.41276, -0.366189, -3.51045]   # 570nm
+  - [-2.15603, -0.348994, -3.58063]   # 575nm
+  - [-1.78335, -0.534256, -3.64691]   # 580nm
+  - [-1.38521, -0.946225, -3.70961]   # 585nm
+  - [-1.1037, -1.48404, -3.76901]   # 590nm
+  - [-0.905114, -1.82779, -3.82536]   # 595nm
+  - [-0.792225, -2.17353, -3.8789]   # 600nm
+  - [-0.714863, -2.57108, -3.92982]   # 605nm
+  - [-0.663443, -2.95018, -3.97832]   # 610nm
+  - [-0.597104, -3.30119, -4.02457]   # 615nm
+  - [-0.512514, -3.62713, -4.06871]   # 620nm
+  - [-0.44471, -3.9306, -4.11089]   # 625nm
+  - [-0.359616, -4.21383, -4.15123]   # 630nm
+  - [-0.274941, -4.47879, -4.18986]   # 635nm
+  - [-0.189039, -4.72719, -4.22688]   # 640nm
+  - [-0.109487, -4.96054, -4.26239]   # 645nm
+  - [-0.0716631, -5.18016, -4.29648]   # 650nm
+  - [-0.160346, -5.38723, -4.32923]   # 655nm
+  - [-0.625234, -5.58279, -4.36072]   # 660nm
+  - [-1.17994, -5.76779, -4.39102]   # 665nm
+  - [-1.63315, -5.94305, -4.42021]   # 670nm
+  - [-1.9721, -6.10932, -4.44832]   # 675nm
+  - [-2.25899, -6.26728, -4.47544]   # 680nm
+  - [-2.52006, -6.41753, -4.5016]   # 685nm
+  - [-2.8185, -6.56062, -4.52687]   # 690nm
+  - [-3.10792, -6.69707, -4.55127]   # 695nm
+  - [-3.37983, -6.82731, -4.57486]   # 700nm
+  - [-3.63421, -6.95176, -4.59768]   # 705nm
+  - [-3.87221, -7.0708, -4.61976]   # 710nm
+  - [-4.09519, -7.18477, -4.64115]   # 715nm
+  - [-4.30443, -7.294, -4.66186]   # 720nm
+  - [-4.50111, -7.39876, -4.68193]   # 725nm
+  - [-4.68631, -7.49934, -4.7014]   # 730nm
+  - [-4.86099, -7.59597, -4.72029]   # 735nm
+  - [-5.02601, -7.68889, -4.73862]   # 740nm
+  - [-5.18215, -7.7783, -4.75642]   # 745nm
+  - [-5.33009, -7.8644, -4.77371]   # 750nm
+  - [-5.47046, -7.94737, -4.79051]   # 755nm
+  - [-5.60383, -8.02737, -4.80685]   # 760nm
+  - [-5.73071, -8.10457, -4.82274]   # 765nm
+  - [-5.85156, -8.1791, -4.8382]   # 770nm
+  - [-5.96679, -8.25111, -4.85325]   # 775nm
+  - [-6.0768, -8.32072, -4.8679]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0, 0, 0]   # 385nm
+  - [0, 0, 0]   # 390nm
+  - [0, 0, 0]   # 395nm
+  - [0, 0, 0]   # 400nm
+  - [0.180464, 0.104311, 0.693125]   # 405nm
+  - [0.161878, 0.115517, 0.775177]   # 410nm
+  - [0.143809, 0.125943, 0.856196]   # 415nm
+  - [0.126409, 0.139731, 0.93457]   # 420nm
+  - [0.111728, 0.154671, 1.00383]   # 425nm
+  - [0.102098, 0.17231, 1.05822]   # 430nm
+  - [0.0918584, 0.180271, 1.09993]   # 435nm
+  - [0.0827838, 0.182519, 1.13151]   # 440nm
+  - [0.0795659, 0.170564, 1.14625]   # 445nm
+  - [0.0737039, 0.168602, 1.13605]   # 450nm
+  - [0.0671759, 0.172841, 1.11897]   # 455nm
+  - [0.0616399, 0.186024, 1.08384]   # 460nm
+  - [0.0580043, 0.208638, 1.01978]   # 465nm
+  - [0.055568, 0.236349, 0.940145]   # 470nm
+  - [0.0534651, 0.26922, 0.852417]   # 475nm
+  - [0.0533722, 0.309507, 0.765092]   # 480nm
+  - [0.0545964, 0.358599, 0.672701]   # 485nm
+  - [0.0568066, 0.41531, 0.577864]   # 490nm
+  - [0.0609147, 0.478512, 0.48753]   # 495nm
+  - [0.0661795, 0.547127, 0.404006]   # 500nm
+  - [0.0736616, 0.624611, 0.33134]   # 505nm
+  - [0.0830465, 0.710129, 0.266674]   # 510nm
+  - [0.0941995, 0.800805, 0.209943]   # 515nm
+  - [0.107065, 0.880853, 0.160811]   # 520nm
+  - [0.122019, 0.952266, 0.122156]   # 525nm
+  - [0.137739, 1.02092, 0.0914488]   # 530nm
+  - [0.156631, 1.07901, 0.0675434]   # 535nm
+  - [0.178395, 1.12064, 0.0485736]   # 540nm
+  - [0.204282, 1.14368, 0.033498]   # 545nm
+  - [0.233375, 1.15125, 0.0242128]   # 550nm
+  - [0.266096, 1.14318, 0.0183816]   # 555nm
+  - [0.302473, 1.11856, 0.0141331]   # 560nm
+  - [0.343324, 1.07339, 0.0106754]   # 565nm
+  - [0.386862, 1.00944, 0.00869585]   # 570nm
+  - [0.434907, 0.93069, 0.0086148]   # 575nm
+  - [0.487162, 0.847658, 0.0086148]   # 580nm
+  - [0.545756, 0.751218, 0.00822464]   # 585nm
+  - [0.610603, 0.646389, 0.0086148]   # 590nm
+  - [0.67755, 0.540057, 0.0086148]   # 595nm
+  - [0.742669, 0.452851, 0.0086148]   # 600nm
+  - [0.806047, 0.378527, 0.0086148]   # 605nm
+  - [0.869686, 0.315248, 0.0086148]   # 610nm
+  - [0.930828, 0.26122, 0.0086148]   # 615nm
+  - [0.986526, 0.214492, 0.0086148]   # 620nm
+  - [1.03689, 0.175074, 0.00865665]   # 625nm
+  - [1.08361, 0.144079, 0.00958442]   # 630nm
+  - [1.12419, 0.119693, 0.0105266]   # 635nm
+  - [1.15659, 0.0988434, 0.010703]   # 640nm
+  - [1.1809, 0.0806145, 0.0116345]   # 645nm
+  - [1.19765, 0.0673346, 0.0122958]   # 650nm
+  - [1.20686, 0.0569868, 0.0127171]   # 655nm
+  - [1.20802, 0.0479997, 0.013263]   # 660nm
+  - [1.20138, 0.0397239, 0.0137542]   # 665nm
+  - [1.18659, 0.0332454, 0.0137542]   # 670nm
+  - [1.16464, 0.0278887, 0.0137542]   # 675nm
+  - [1.13604, 0.0236656, 0.0133222]   # 680nm
+  - [1.09955, 0.0199837, 0.0122152]   # 685nm
+  - [1.05381, 0.0177226, 0.0118712]   # 690nm
+  - [1.00432, 0.0155389, 0.0127002]   # 695nm
+  - [0.957476, 0.0137565, 0.013493]   # 700nm
+  - [0, 0, 0]   # 705nm
+  - [0, 0, 0]   # 710nm
+  - [0, 0, 0]   # 715nm
+  - [0, 0, 0]   # 720nm
+  - [0, 0, 0]   # 725nm
+  - [0, 0, 0]   # 730nm
+  - [0, 0, 0]   # 735nm
+  - [0, 0, 0]   # 740nm
+  - [0, 0, 0]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.0953401, 0.0953409, 0.0953429, 0.0953474, 0.0953566, 0.0953743, 0.0954063, 0.0954614, 0.095551, 0.0956893, 0.0958921, 0.0961753, 0.0965523, 0.0970325, 0.0976191, 0.0983087, 0.099092, 0.099955, 0.100881, 0.101854, 0.102855, 0.103869, 0.104879, 0.105864, 0.106802, 0.107665, 0.10842, 0.10903, 0.109459, 0.109677, 0.109662, 0.109409, 0.108923, 0.108226, 0.107349, 0.106329, 0.105201, 0.104002, 0.102762, 0.101507, 0.100262, 0.0990492, 0.0978922, 0.0968134, 0.0958338, 0.0949712, 0.0942373, 0.0936365, 0.0931648, 0.0928105, 0.0925567, 0.0923837, 0.0922716, 0.0922027, 0.0921626, 0.0921405, 0.092129, 0.0921233, 0.0921207, 0.0921196, 0.0921191, 0.092119, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189, 0.0921189]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [2.5095, 2.8036, 2.8105]
+  - [2.5096, 2.8037, 2.8106]
+  - [2.5098, 2.804, 2.8107]
+  - [2.51, 2.8042, 2.8109]
+  - [2.5102, 2.8044, 2.8111]
+  - [2.5103, 2.8044, 2.8114]
+  - [2.5104, 2.8043, 2.8116]
+  - [2.5105, 2.8044, 2.8117]
+  - [2.5106, 2.8045, 2.8117]
+  - [2.5108, 2.8047, 2.8115]
+  - [2.5108, 2.8048, 2.8113]
+  - [2.5107, 2.8047, 2.8112]
+  - [2.5106, 2.8045, 2.8112]
+  - [2.5104, 2.8043, 2.8112]
+  - [2.5102, 2.8041, 2.8113]
+  - [2.5101, 2.8041, 2.8113]
+  - [2.51, 2.8042, 2.8114]
+  - [2.51, 2.8043, 2.8114]
+  - [2.5101, 2.8044, 2.8114]
+  - [2.5102, 2.8044, 2.8112]
+  - [2.5103, 2.8044, 2.811]
+  - [2.5104, 2.8042, 2.8107]
+  - [2.5104, 2.804, 2.8104]
+  - [2.5102, 2.8037, 2.8102]
+  - [2.5098, 2.8034, 2.8101]
+  - [2.5094, 2.8031, 2.81]
+  - [2.509, 2.803, 2.8098]
+  - [2.5087, 2.8029, 2.8094]
+  - [2.5085, 2.8027, 2.8089]
+  - [2.5084, 2.8023, 2.8082]
+  - [2.5081, 2.8017, 2.8075]
+  - [2.5077, 2.8009, 2.8068]
+  - [2.507, 2.8, 2.8059]
+  - [2.5061, 2.7992, 2.8049]
+  - [2.5052, 2.7983, 2.8035]
+  - [2.5042, 2.7973, 2.8018]
+  - [2.5031, 2.7958, 2.7997]
+  - [2.5018, 2.7938, 2.7972]
+  - [2.5003, 2.7912, 2.7945]
+  - [2.4984, 2.7882, 2.7914]
+  - [2.496, 2.7851, 2.788]
+  - [2.4932, 2.7818, 2.7841]
+  - [2.49, 2.7782, 2.7797]
+  - [2.4864, 2.7742, 2.7746]
+  - [2.4824, 2.7693, 2.7687]
+  - [2.478, 2.7635, 2.7618]
+  - [2.473, 2.7566, 2.7539]
+  - [2.4674, 2.7487, 2.7448]
+  - [2.4608, 2.7399, 2.7348]
+  - [2.4532, 2.7301, 2.7238]
+  - [2.4443, 2.7193, 2.7118]
+  - [2.4343, 2.7074, 2.6988]
+  - [2.4232, 2.6944, 2.6845]
+  - [2.4113, 2.6802, 2.6689]
+  - [2.3985, 2.6646, 2.6516]
+  - [2.3846, 2.647, 2.6324]
+  - [2.3691, 2.6272, 2.611]
+  - [2.3519, 2.605, 2.5877]
+  - [2.3331, 2.5811, 2.563]
+  - [2.3126, 2.5561, 2.537]
+  - [2.2906, 2.5303, 2.5093]
+  - [2.2673, 2.5034, 2.4795]
+  - [2.2427, 2.4746, 2.4471]
+  - [2.2168, 2.4434, 2.4123]
+  - [2.1893, 2.4094, 2.3755]
+  - [2.1599, 2.373, 2.337]
+  - [2.1281, 2.3347, 2.297]
+  - [2.0939, 2.2948, 2.2556]
+  - [2.0576, 2.2532, 2.2128]
+  - [2.0198, 2.2094, 2.1686]
+  - [1.9814, 2.1633, 2.1234]
+  - [1.9429, 2.1153, 2.0774]
+  - [1.9039, 2.0664, 2.0305]
+  - [1.864, 2.0176, 1.9821]
+  - [1.8222, 1.9691, 1.9319]
+  - [1.7783, 1.9204, 1.8798]
+  - [1.7329, 1.8705, 1.8265]
+  - [1.6868, 1.8188, 1.7733]
+  - [1.6411, 1.7657, 1.721]
+  - [1.596, 1.7122, 1.6699]
+  - [1.5513, 1.6591, 1.6199]
+  - [1.5065, 1.6069, 1.5701]
+  - [1.4613, 1.5551, 1.5202]
+  - [1.4158, 1.5031, 1.4702]
+  - [1.3707, 1.4509, 1.4202]
+  - [1.3262, 1.399, 1.3706]
+  - [1.2825, 1.3489, 1.3218]
+  - [1.2392, 1.3011, 1.2738]
+  - [1.1959, 1.2555, 1.227]
+  - [1.1528, 1.2108, 1.1814]
+  - [1.1105, 1.1658, 1.1375]
+  - [1.0697, 1.1203, 1.0954]
+  - [1.0308, 1.075, 1.0554]
+  - [0.99369, 1.0313, 1.0169]
+  - [0.95788, 0.99006, 0.97939]
+  - [0.92276, 0.95127, 0.94205]
+  - [0.88801, 0.91415, 0.90476]
+  - [0.85367, 0.87778, 0.86801]
+  - [0.82, 0.84169, 0.83241]
+  - [0.78724, 0.80603, 0.79832]
+  - [0.75535, 0.77131, 0.76567]
+  - [0.72411, 0.73793, 0.73417]
+  - [0.69336, 0.70583, 0.70356]
+  - [0.66326, 0.67456, 0.6738]
+  - [0.63423, 0.64367, 0.64497]
+  - [0.60673, 0.61304, 0.61706]
+  - [0.58086, 0.583, 0.58982]
+  - [0.55623, 0.55402, 0.56285]
+  - [0.53206, 0.52637, 0.53586]
+  - [0.50763, 0.49997, 0.50893]
+  - [0.48263, 0.47442, 0.4825]
+  - [0.45732, 0.44934, 0.45711]
+  - [0.43231, 0.42455, 0.43304]
+  - [0.40818, 0.40007, 0.41012]
+  - [0.3852, 0.37602, 0.38792]
+  - [0.36332, 0.35257, 0.36589]
+  - [0.34238, 0.32991, 0.34369]
+  - [0.32212, 0.30803, 0.32147]
+  - [0.30219, 0.28669, 0.29992]
+  - [0.28244, 0.26576, 0.2798]
+  - [0.26312, 0.24561, 0.26129]
+  - [0.24473, 0.22695, 0.24385]
+  - [0.22751, 0.21012, 0.22677]
+  - [0.21122, 0.19458, 0.20981]
+  - [0.19538, 0.17945, 0.19326]
+  - [0.1797, 0.16415, 0.17764]
+  - [0.16434, 0.14878, 0.16321]
+  - [0.14978, 0.13407, 0.14978]
+  - [0.1365, 0.1208, 0.13691]
+  - [0.12463, 0.10932, 0.12429]
+  - [0.11388, 0.099305, 0.11199]
+  - [0.10378, 0.090091, 0.10043]
+  - [0.094022, 0.08112, 0.089997]
+  - [0.084587, 0.072291, 0.080815]
+  - [0.075687, 0.063933, 0.072642]
+  - [0.067502, 0.056476, 0.065088]
+  - [0.060072, 0.050092, 0.057922]
+  - [0.05331, 0.04463, 0.051266]
+  - [0.047085, 0.0398, 0.045437]
+  - [0.041315, 0.035349, 0.04059]
+  - [0.035997, 0.031126, 0.036495]
+  - [0.031207, 0.027086, 0.032662]
+  - [0.027042, 0.023286, 0.028683]
+  - [0.023516, 0.019824, 0.024502]
+  - [0.020485, 0.016761, 0.02042]
+  - [0.017743, 0.014079, 0.016871]
+  - [0.015201, 0.011726, 0.014153]
+  - [0.012909, 0.0096932, 0.012258]
+  - [0.010963, 0.0080114, 0.010899]
+  - [0.0093906, 0.0066946, 0.0097057]
+  - [0.0081091, 0.005688, 0.0084439]
+  - [0.0069902, 0.0048742, 0.0071106]
+  - [0.0059561, 0.0041379, 0.0058655]
+  - [0.0050172, 0.0034324, 0.0048645]
+  - [0.004221, 0.0027909, 0.0041271]
+  - [0.0035646, 0.0022739, 0.0035266]
+  - [0.0029654, 0.0018974, 0.002894]
+  - [0.0023268, 0.0016064, 0.0021483]
+  - [0.0016463, 0.0013157, 0.0013567]
+  - [0.0010592, 0.00098562, 0.00068687]
+  - [0.00075854, 0.00066324, 0.00029582]
+  - [0.00082941, 0.00044183, 0.00024363]
+  - [0.0011722, 0.00042573, 0.00044281]
+  - [0.0015115, 0.0006507, 0.00070166]
+  - [0.0015241, 0.0010015, 0.00085282]
+  - [0.0010927, 0.0012633, 0.0008487]
+  - [0.00044825, 0.0012569, 0.00077049]
+  - [1.7484e-05, 0.00095365, 0.00073795]
+  - [6.7175e-05, 0.00048749, 0.00078895]
+  - [0.00046781, 6.1756e-05, 0.00083584]
+  - [0.00081336, -0.00017726, 0.00074568]
+  - [0.00078984, -0.00021683, 0.00047106]
+  - [0.00041665, -0.00011537, 7.723e-05]
+  - [1.4274e-05, 4.9042e-05, -0.00029393]
+  - [-6.9497e-05, 0.00019992, -0.00049887]
+  - [0.00023896, 0.00026581, -0.000473]
+  - [0.00066045, 0.00019015, -0.0002685]
+  - [0.00078106, -3.7711e-05, -2.5508e-05]
+  - [0.00039844, -0.00035025, 0.00010805]
+  - [-0.00028585, -0.00060885, 6.231e-05]
+  - [-0.00079693, -0.0006702, -0.00011429]
+  - [-0.00075336, -0.00048096, -0.00028674]
+  - [-0.00018559, -0.00013189, -0.00032059]
+  - [0.00045415, 0.00018218, -0.00017184]
+  - [0.00061755, 0.00028425, 7.8787e-05]
+  - [8.274e-05, 0.00013831, 0.00027323]
+  - [-0.00085127, -0.00011976, 0.00027841]
+  - [-0.0015582, -0.00027626, 7.7643e-05]
+  - [-0.0015318, -0.00019732, -0.00021161]
+  - [-0.00075568, 6.6071e-05, -0.00040989]
+  - [0.00028089, 0.00031008, -0.00039235]
+  - [0.00093266, 0.0003312, -0.00017188]
+  - [0.0008528, 9.0114e-05, 0.00010872]
+  - [0.00021778, -0.00024, 0.0002712]
+  - [-0.00043171, -0.00038624, 0.00021859]
+  - [-0.0005997, -0.00017655, -5.1936e-06]
+  - [-0.00018218, 0.00031534, -0.00025103]
+  - [0.00049487, 0.00079007, -0.00036651]
+  - [0.00094504, 0.00090221, -0.00028888]
+  - [0.00086624, 0.00048514, -6.6955e-05]
+  - [0.00036908, -0.00028899, 0.00017014]
+  - [-0.00021404, -0.0010194, 0.00033787]
+  - [-0.00064116, -0.0013644, 0.00045046]
+  - [-0.00084149, -0.0012406, 0.00054247]
+  - [-0.00080635, -0.00080673, 0.00057742]
+  - [-0.00054163, -0.00030449, 0.00047883]
+  - [-0.00014085, 9.0817e-05, 0.00025062]
+  - [0.00020645, 0.00032748, 2.2589e-05]
+  - [0.00039606, 0.00042477, -7.1075e-05]
+  - [0.00046421, 0.00045154, -3.5311e-06]
+  - [0.00045927, 0.00050805, 0.00014307]
+  - [0.00041221, 0.00062938, 0.00021518]
+  - [0.00032428, 0.00075855, 9.2605e-05]
+  - [0.00019112, 0.00078669, -0.0002217]
+  - [3.4831e-05, 0.00063167, -0.00059374]
+  - [-8.8526e-05, 0.00030183, -0.00084102]
+  - [-0.00011636, -9.7907e-05, -0.00084713]
+  - [-2.3143e-05, -0.00042194, -0.00062749]
+  - [0.00015297, -0.00056606, -0.00030374]
+  - [0.00032266, -0.0005232, -1.3704e-05]
+  - [0.00039221, -0.00037849, 0.00017119]
+  - [0.00031597, -0.00024908, 0.00026249]
+  - [0.00012212, -0.00020961, 0.00030531]
+  - [-0.00010306, -0.00025131, 0.00031688]
+  - [-0.00026154, -0.000299, 0.00027163]
+  - [-0.00029259, -0.00027061, 0.00014416]
+  - [-0.000198, -0.00013689, -3.495e-05]
+  - [-3.3834e-05, 5.8756e-05, -0.00017183]
+  - [0.00012171, 0.00023137, -0.00017006]
+  - [0.00020459, 0.00031205, -1.5488e-05]
+  - [0.00018864, 0.00029076, 0.00018992]
+  - [9.0619e-05, 0.00021548, 0.00028646]
+  - [-3.9992e-05, 0.00015062, 0.00017361]
+  - [-0.00013957, 0.00012675, -0.00010314]
+  - [-0.00015232, 0.00011888, -0.00037067]
+  - [-5.2034e-05, 6.9298e-05, -0.00044858]
+  - [0.00014165, -6.1556e-05, -0.00028559]
+  - [0.00036103, -0.00025352, -5.6164e-06]
+  - [0.00050974, -0.00042611, 0.00017901]
+  - [0.0005025, -0.00048282, 0.00012788]
+  - [0.00031031, -0.00037305, -0.0001142]
+  - [-1.2991e-05, -0.00013156, -0.00034072]
+  - [-0.00034329, 0.00013132, -0.00033198]
+  - [-0.00053914, 0.00028491, -1.9892e-05]
+  - [-0.00051235, 0.00024706, 0.00045446]
+  - [-0.00027822, 2.7433e-05, 0.00083498]
+  - [4.533e-05, -0.00027584, 0.0009199]
+  - [0.00028471, -0.0005081, 0.00068138]
+  - [0.00031968, -0.0005594, 0.00034871]
+  - [0.00017724, -0.00042893, 0.00014744]
+  - [-1.6195e-05, -0.00019955, 9.3372e-05]
+  - [-0.00015589, 3.0964e-05, 5.2417e-05]
+  - [-0.00023099, 0.00020411, -6.4328e-05]
+  - [-0.00028939, 0.00031064, -0.00021919]
+  - [-0.00035502, 0.00036863, -0.00033587]
+  - [-0.00039868, 0.00039829, -0.00039436]

core/dr-film/profiles/kodak_ektacolor_edge.yaml

@@ -0,0 +1,452 @@
+# Generated by tools/film-profiles/convert.py from spektrafilm.
+# Do not edit by hand: re-run the converter instead.
+#
+# spektrafilm by Andrea Volpato, https://github.com/andreavolpato/spektrafilm
+# Licensed CC BY-SA 4.0. Modified for DarkRoom: trimmed to the fields the
+# renderer uses and reformatted; see profiles/CHANGELOG.txt.
+
+version: '0.3.2'
+stock: kodak_ektacolor_edge
+name: 'Kodak Ektacolor Edge'
+kind: negative          # negative | positive
+support: paper    # film | paper
+stage: printing        # filming | printing
+monochrome: false
+reference_illuminant: TH-KG3
+viewing_illuminant: D50
+
+# log10 spectral sensitivity per layer, 380-780nm at 5nm, in R,G,B layer
+# order. A null upstream means the datasheet has no reading there, which is
+# blindness, so it is written as the sentinel the loader reads as such.
+log_sensitivity:
+  - [-2.10565, -0.766543, 0.132008]   # 380nm
+  - [-2.08591, -0.699369, 0.252323]   # 385nm
+  - [-2.06561, -0.629269, 0.374375]   # 390nm
+  - [-2.04473, -0.557084, 0.477732]   # 395nm
+  - [-2.02323, -0.48822, 0.615436]   # 400nm
+  - [-2.00109, -0.429295, 0.689884]   # 405nm
+  - [-1.97829, -0.441378, 0.684867]   # 410nm
+  - [-1.95479, -0.556211, 0.654099]   # 415nm
+  - [-1.93056, -0.617418, 0.625488]   # 420nm
+  - [-1.90557, -0.595162, 0.698717]   # 425nm
+  - [-1.87978, -0.533044, 0.811467]   # 430nm
+  - [-1.85315, -0.461198, 0.89265]   # 435nm
+  - [-1.82565, -0.387504, 0.973525]   # 440nm
+  - [-1.79723, -0.313213, 1.07643]   # 445nm
+  - [-1.76784, -0.2295, 1.17756]   # 450nm
+  - [-1.73744, -0.138607, 1.27633]   # 455nm
+  - [-1.70598, -0.0582647, 1.39065]   # 460nm
+  - [-1.6734, 0.0170387, 1.55467]   # 465nm
+  - [-1.63966, 0.0914911, 1.59798]   # 470nm
+  - [-1.6047, 0.155627, 1.5519]   # 475nm
+  - [-1.56846, 0.256651, 1.36169]   # 480nm
+  - [-1.5309, 0.364828, 0.776747]   # 485nm
+  - [-1.49199, 0.457774, 0.215451]   # 490nm
+  - [-1.45171, 0.525793, -0.240751]   # 495nm
+  - [-1.41012, 0.576504, -0.612618]   # 500nm
+  - [-1.36741, 0.603367, -1.06746]   # 505nm
+  - [-1.32417, 0.607025, -1.50048]   # 510nm
+  - [-1.28242, 0.602695, -1.90143]   # 515nm
+  - [-1.25269, 0.614533, -2.27374]   # 520nm
+  - [-1.26212, 0.658035, -2.62037]   # 525nm
+  - [-1.25726, 0.752032, -2.94389]   # 530nm
+  - [-1.24054, 0.879948, -3.24654]   # 535nm
+  - [-1.21995, 1.02689, -3.53027]   # 540nm
+  - [-1.20751, 1.19539, -3.79681]   # 545nm
+  - [-1.19234, 1.29487, -4.04767]   # 550nm
+  - [-1.16025, 1.01784, -4.28419]   # 555nm
+  - [-1.12667, 0.22508, -4.50758]   # 560nm
+  - [-1.10198, -0.440528, -4.71888]   # 565nm
+  - [-1.08837, -0.86477, -4.91907]   # 570nm
+  - [-1.079, -1.16115, -5.10899]   # 575nm
+  - [-1.05682, -1.60823, -5.28942]   # 580nm
+  - [-1.02737, -2.03733, -5.46104]   # 585nm
+  - [-0.992937, -2.44536, -5.62449]   # 590nm
+  - [-0.961398, -2.83305, -5.78034]   # 595nm
+  - [-0.934129, -3.20165, -5.92911]   # 600nm
+  - [-0.912949, -3.55242, -6.07126]   # 605nm
+  - [-0.874195, -3.88659, -6.20724]   # 610nm
+  - [-0.799521, -4.20528, -6.33742]   # 615nm
+  - [-0.719242, -4.50952, -6.46218]   # 620nm
+  - [-0.64176, -4.80028, -6.58185]   # 625nm
+  - [-0.580191, -5.07841, -6.69674]   # 630nm
+  - [-0.549232, -5.34473, -6.80712]   # 635nm
+  - [-0.529717, -5.59996, -6.91325]   # 640nm
+  - [-0.524682, -5.84479, -7.01538]   # 645nm
+  - [-0.530441, -6.07983, -7.11372]   # 650nm
+  - [-0.519568, -6.30566, -7.20849]   # 655nm
+  - [-0.493857, -6.52281, -7.29987]   # 660nm
+  - [-0.457344, -6.73177, -7.38805]   # 665nm
+  - [-0.399716, -6.933, -7.47319]   # 670nm
+  - [-0.321314, -7.12691, -7.55544]   # 675nm
+  - [-0.224668, -7.3139, -7.63495]   # 680nm
+  - [-0.118959, -7.49433, -7.71185]   # 685nm
+  - [-0.009875, -7.66854, -7.78627]   # 690nm
+  - [0.0742892, -7.83684, -7.85833]   # 695nm
+  - [0.127284, -7.99954, -7.92814]   # 700nm
+  - [0.136163, -8.15691, -7.9958]   # 705nm
+  - [0.0709927, -8.3092, -8.06141]   # 710nm
+  - [-0.0642817, -8.45665, -8.12506]   # 715nm
+  - [-0.268529, -8.5995, -8.18684]   # 720nm
+  - [-0.496031, -8.73795, -8.24683]   # 725nm
+  - [-0.689006, -8.87221, -8.3051]   # 730nm
+  - [-1.00308, -9.00246, -8.36173]   # 735nm
+  - [-1.26788, -9.12889, -8.41679]   # 740nm
+  - [-1.54706, -9.25164, -8.47034]   # 745nm
+  - [-1.8141, -9.37089, -8.52245]   # 750nm
+  - [-2.06978, -9.48679, -8.57316]   # 755nm
+  - [-2.31481, -9.59946, -8.62254]   # 760nm
+  - [-2.54983, -9.70905, -8.67064]   # 765nm
+  - [-2.77546, -9.81567, -8.7175]   # 770nm
+  - [-2.99223, -9.91945, -8.76318]   # 775nm
+  - [-3.20067, -10.0205, -8.80772]   # 780nm
+
+# Spectral density of each layer's dye at unit density, same grid and order.
+dye_density:
+  - [0, 0, 0]   # 380nm
+  - [0, 0, 0]   # 385nm
+  - [0, 0, 0]   # 390nm
+  - [0, 0, 0]   # 395nm
+  - [0.240593, 0.052629, 0]   # 400nm
+  - [0.254856, 0.0485797, 0.673846]   # 405nm
+  - [0.253509, 0.0425851, 0.807598]   # 410nm
+  - [0.23041, 0.0358028, 0.905068]   # 415nm
+  - [0.195173, 0.0295552, 0.970543]   # 420nm
+  - [0.161014, 0.0272047, 1.02818]   # 425nm
+  - [0.131451, 0.0295763, 1.08239]   # 430nm
+  - [0.105028, 0.0358174, 1.12488]   # 435nm
+  - [0.0809028, 0.0455654, 1.14576]   # 440nm
+  - [0.059948, 0.0594067, 1.14853]   # 445nm
+  - [0.0437462, 0.0763235, 1.13436]   # 450nm
+  - [0.0325183, 0.0982167, 1.09804]   # 455nm
+  - [0.0244678, 0.127071, 1.04027]   # 460nm
+  - [0.0194053, 0.162306, 0.969006]   # 465nm
+  - [0.0173851, 0.203964, 0.883614]   # 470nm
+  - [0.0182536, 0.254188, 0.787753]   # 475nm
+  - [0.0210962, 0.310452, 0.690034]   # 480nm
+  - [0.0249313, 0.374912, 0.593124]   # 485nm
+  - [0.0290238, 0.439456, 0.5022]   # 490nm
+  - [0.0354645, 0.524464, 0.418393]   # 495nm
+  - [0.0443303, 0.606478, 0.341823]   # 500nm
+  - [0.052683, 0.689377, 0.275233]   # 505nm
+  - [0.0620608, 0.770613, 0.218403]   # 510nm
+  - [0.0742872, 0.848228, 0.172115]   # 515nm
+  - [0.0885545, 0.919175, 0.134756]   # 520nm
+  - [0.104967, 0.984612, 0.102564]   # 525nm
+  - [0.122624, 1.04947, 0.0791862]   # 530nm
+  - [0.142937, 1.10182, 0.0625807]   # 535nm
+  - [0.166492, 1.12697, 0.0491518]   # 540nm
+  - [0.192772, 1.13085, 0.0389186]   # 545nm
+  - [0.222565, 1.1135, 0.0309954]   # 550nm
+  - [0.25625, 1.06112, 0.0252955]   # 555nm
+  - [0.29379, 0.969922, 0.0212597]   # 560nm
+  - [0.335861, 0.868627, 0.018648]   # 565nm
+  - [0.382219, 0.76046, 0.0133413]   # 570nm
+  - [0.43289, 0.646939, 0.00965515]   # 575nm
+  - [0.488016, 0.539429, 0.00831938]   # 580nm
+  - [0.545091, 0.441496, 0.00872245]   # 585nm
+  - [0.608398, 0.353123, 0.0100141]   # 590nm
+  - [0.671639, 0.280325, 0.0109626]   # 595nm
+  - [0.736958, 0.219873, 0.0125306]   # 600nm
+  - [0.80269, 0.171694, 0.00946088]   # 605nm
+  - [0.867385, 0.133109, 0.00946088]   # 610nm
+  - [0.929185, 0.102987, 0.00946088]   # 615nm
+  - [0.987113, 0.0796955, 0.00956765]   # 620nm
+  - [1.04051, 0.0616698, 0.0103155]   # 625nm
+  - [1.08782, 0.046994, 0.0106135]   # 630nm
+  - [1.12957, 0.0363474, 0.0105415]   # 635nm
+  - [1.16684, 0.0270981, 0.00872195]   # 640nm
+  - [1.19578, 0.0199602, 0.00961837]   # 645nm
+  - [1.21238, 0.0148634, 0.00980721]   # 650nm
+  - [1.21925, 0.0108325, 0.00980721]   # 655nm
+  - [1.2165, 0.00737892, 0.00980721]   # 660nm
+  - [1.20086, 0.00505575, 0.00997812]   # 665nm
+  - [1.17144, 0.00478584, 0.0118266]   # 670nm
+  - [1.13417, 0.00495537, 0.0120957]   # 675nm
+  - [1.09142, 0.00335593, 0.0112014]   # 680nm
+  - [1.04201, 0.00171195, 0.0101837]   # 685nm
+  - [0.986639, 0.000158098, 0.00974891]   # 690nm
+  - [0.929767, -7.149e-19, 0.00967094]   # 695nm
+  - [0, 0, 0]   # 700nm
+  - [0, 0, 0]   # 705nm
+  - [0, 0, 0]   # 710nm
+  - [0, 0, 0]   # 715nm
+  - [0, 0, 0]   # 720nm
+  - [0, 0, 0]   # 725nm
+  - [0, 0, 0]   # 730nm
+  - [0, 0, 0]   # 735nm
+  - [0, 0, 0]   # 740nm
+  - [0, 0, 0]   # 745nm
+  - [0, 0, 0]   # 750nm
+  - [0, 0, 0]   # 755nm
+  - [0, 0, 0]   # 760nm
+  - [0, 0, 0]   # 765nm
+  - [0, 0, 0]   # 770nm
+  - [0, 0, 0]   # 775nm
+  - [0, 0, 0]   # 780nm
+
+# The support's own density -- film base plus, for a colour negative, the
+# orange mask. Flat zero where the datasheet does not give it.
+base_density: [0.104539, 0.104539, 0.104539, 0.104539, 0.104539, 0.10454, 0.10454, 0.104542, 0.104544, 0.104548, 0.104553, 0.104561, 0.104571, 0.104583, 0.104599, 0.104617, 0.104637, 0.10466, 0.104684, 0.10471, 0.104736, 0.104762, 0.104787, 0.10481, 0.104831, 0.104847, 0.104856, 0.104857, 0.104847, 0.104824, 0.104788, 0.104737, 0.104672, 0.104595, 0.104507, 0.10441, 0.104307, 0.1042, 0.104091, 0.103981, 0.103873, 0.103768, 0.103668, 0.103574, 0.10349, 0.103415, 0.103351, 0.1033, 0.103259, 0.103228, 0.103206, 0.103191, 0.103181, 0.103175, 0.103172, 0.10317, 0.103169, 0.103169, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168, 0.103168]
+
+# The characteristic curves: density against log10 exposure, sampled
+# uniformly over [-3, 4].
+log_exposure_min: -3
+log_exposure_max: 4
+density_curves:
+  - [-0.00082207, -0.00082089, -0.0008278]
+  - [-0.00070251, -0.00068042, -0.00074299]
+  - [-0.00050646, -0.00043818, -0.00059421]
+  - [-0.00029511, -0.00018684, -0.00040366]
+  - [-0.00012342, -3.2448e-05, -0.00017405]
+  - [-5.7059e-06, -1.3791e-05, 8.2719e-05]
+  - [9.1999e-05, -5.3052e-05, 0.00030861]
+  - [0.00021437, -1.8094e-05, 0.00041835]
+  - [0.00036418, 0.00014486, 0.00037072]
+  - [0.00048967, 0.00034766, 0.00021435]
+  - [0.00052986, 0.00044217, 4.9948e-05]
+  - [0.00046977, 0.0003613, -5.334e-05]
+  - [0.00032883, 0.00015162, -7.5506e-05]
+  - [0.00015441, -7.0724e-05, -3.2627e-05]
+  - [-2.3977e-06, -0.00019632, 4.8881e-05]
+  - [-0.00010783, -0.00018362, 0.00014965]
+  - [-0.00014853, -6.686e-05, 0.00025336]
+  - [-0.00012144, 8.2629e-05, 0.00033274]
+  - [-2.6361e-05, 0.00020353, 0.00034796]
+  - [0.00012767, 0.00026558, 0.00026816]
+  - [0.00030747, 0.00026076, 0.00010248]
+  - [0.00045058, 0.00018801, -8.7828e-05]
+  - [0.00048483, 5.4486e-05, -0.00021447]
+  - [0.00036793, -0.00010806, -0.0002141]
+  - [0.00012262, -0.00023675, -9.1985e-05]
+  - [-0.00016103, -0.00026207, 7.6502e-05]
+  - [-0.00036566, -0.00015576, 0.00019237]
+  - [-0.00040922, 3.4806e-05, 0.0001975]
+  - [-0.00029184, 0.00020223, 0.0001122]
+  - [-9.5598e-05, 0.0002456, 1.8958e-05]
+  - [6.4346e-05, 0.00014515, 3.3838e-06]
+  - [0.00010726, -1.3323e-05, 9.4186e-05]
+  - [3.073e-05, -9.0986e-05, 0.00024356]
+  - [-9.5183e-05, 4.539e-06, 0.00035985]
+  - [-0.00017677, 0.0002432, 0.00036739]
+  - [-0.00015513, 0.00047913, 0.00025196]
+  - [-3.7734e-05, 0.00054189, 6.3882e-05]
+  - [0.00011276, 0.00035217, -0.00011721]
+  - [0.00021999, -1.8483e-05, -0.00022712]
+  - [0.00023667, -0.00038648, -0.00024212]
+  - [0.00016448, -0.00056744, -0.00017543]
+  - [4.5715e-05, -0.00048498, -5.8608e-05]
+  - [-6.119e-05, -0.00020712, 7.2192e-05]
+  - [-0.00010547, 0.00010637, 0.00017789]
+  - [-5.8445e-05, 0.00030226, 0.00021564]
+  - [7.9804e-05, 0.00031088, 0.00014984]
+  - [0.0002772, 0.00016015, -2.392e-05]
+  - [0.00047129, -6.5726e-05, -0.00025896]
+  - [0.00058294, -0.00028097, -0.0004647]
+  - [0.00054167, -0.00042321, -0.00055092]
+  - [0.00032533, -0.00047618, -0.00049915]
+  - [7.4273e-06, -0.0004415, -0.00034297]
+  - [-0.00025803, -0.00030073, -0.00010895]
+  - [-0.00033966, -6.2029e-05, 0.00016366]
+  - [-0.00023718, 0.00017103, 0.00037563]
+  - [-7.8604e-05, 0.00021867, 0.00040893]
+  - [-4.1517e-06, -3.777e-05, 0.00024995]
+  - [-5.7852e-05, -0.00051403, 4.6868e-05]
+  - [-0.00019034, -0.00093458, -1.1987e-06]
+  - [-0.00034209, -0.0010364, 0.00015494]
+  - [-0.00044062, -0.00072963, 0.00038534]
+  - [-0.00042311, -0.00014631, 0.00050689]
+  - [-0.00026217, 0.00044323, 0.00041616]
+  - [1.3631e-05, 0.00080257, 0.00015012]
+  - [0.00031251, 0.00086828, -0.00016031]
+  - [0.00050193, 0.00075815, -0.00039378]
+  - [0.00046661, 0.00064937, -0.00051125]
+  - [0.00018033, 0.00062574, -0.00054594]
+  - [-0.00025373, 0.00061614, -0.00053421]
+  - [-0.0006331, 0.0004726, -0.00046026]
+  - [-0.00075578, 0.00012357, -0.00027068]
+  - [-0.00053728, -0.00032577, 5.2511e-05]
+  - [-6.9703e-05, -0.00063604, 0.00042974]
+  - [0.00042435, -0.00059579, 0.00069927]
+  - [0.00072301, -0.00018137, 0.00071484]
+  - [0.00074158, 0.00041242, 0.00045833]
+  - [0.00058511, 0.00090217, 8.0137e-05]
+  - [0.00048186, 0.0011128, -0.00017103]
+  - [0.00064265, 0.001095, -8.5217e-05]
+  - [0.0011418, 0.0010742, 0.00039796]
+  - [0.0018989, 0.0012749, 0.001178]
+  - [0.0027679, 0.0017568, 0.0020814]
+  - [0.0036641, 0.0023949, 0.0029792]
+  - [0.0046355, 0.0030187, 0.0038544]
+  - [0.0058292, 0.0036015, 0.0047845]
+  - [0.0073855, 0.0043467, 0.0058766]
+  - [0.0093438, 0.0055956, 0.0072205]
+  - [0.011639, 0.0076272, 0.0089067]
+  - [0.014231, 0.01045, 0.011053]
+  - [0.017215, 0.013789, 0.013813]
+  - [0.020852, 0.017333, 0.017383]
+  - [0.025491, 0.021031, 0.021998]
+  - [0.031442, 0.025223, 0.027871]
+  - [0.038884, 0.030505, 0.035093]
+  - [0.047872, 0.037443, 0.043587]
+  - [0.058428, 0.046338, 0.053237]
+  - [0.070658, 0.057203, 0.064149]
+  - [0.084846, 0.069946, 0.076763]
+  - [0.10145, 0.084618, 0.091703]
+  - [0.12098, 0.1016, 0.10958]
+  - [0.14385, 0.12159, 0.13086]
+  - [0.17036, 0.14533, 0.15586]
+  - [0.20083, 0.17331, 0.18489]
+  - [0.23576, 0.20574, 0.2184]
+  - [0.27596, 0.24263, 0.25696]
+  - [0.32229, 0.28416, 0.30099]
+  - [0.37531, 0.33086, 0.35056]
+  - [0.43486, 0.38341, 0.40532]
+  - [0.50006, 0.44229, 0.46477]
+  - [0.56963, 0.50732, 0.52865]
+  - [0.64249, 0.57769, 0.59707]
+  - [0.71816, 0.65224, 0.67022]
+  - [0.79663, 0.72983, 0.7478]
+  - [0.87788, 0.80949, 0.82864]
+  - [0.96141, 0.8903, 0.91087]
+  - [1.0462, 0.97141, 0.99232]
+  - [1.131, 1.052, 1.0711]
+  - [1.2144, 1.1312, 1.1465]
+  - [1.295, 1.2074, 1.2186]
+  - [1.3718, 1.2797, 1.2878]
+  - [1.4447, 1.3482, 1.3539]
+  - [1.5141, 1.4137, 1.4154]
+  - [1.5801, 1.4763, 1.4709]
+  - [1.6421, 1.535, 1.5201]
+  - [1.6995, 1.5883, 1.5636]
+  - [1.7519, 1.6355, 1.6025]
+  - [1.7997, 1.6771, 1.6372]
+  - [1.8439, 1.7145, 1.6681]
+  - [1.8853, 1.7492, 1.6947]
+  - [1.9243, 1.7818, 1.7173]
+  - [1.9607, 1.812, 1.7364]
+  - [1.9939, 1.8393, 1.7528]
+  - [2.0238, 1.8632, 1.7672]
+  - [2.0507, 1.8838, 1.78]
+  - [2.0748, 1.9018, 1.7913]
+  - [2.0968, 1.918, 1.8008]
+  - [2.1167, 1.9328, 1.8086]
+  - [2.1346, 1.9462, 1.8151]
+  - [2.1506, 1.9581, 1.8207]
+  - [2.1647, 1.9682, 1.8258]
+  - [2.177, 1.9767, 1.8302]
+  - [2.1879, 1.9838, 1.8338]
+  - [2.1975, 1.9896, 1.8362]
+  - [2.2061, 1.9944, 1.8376]
+  - [2.2137, 1.9985, 1.8384]
+  - [2.2201, 2.0019, 1.8389]
+  - [2.2254, 2.0047, 1.8397]
+  - [2.2299, 2.007, 1.8407]
+  - [2.2338, 2.009, 1.8418]
+  - [2.2371, 2.0108, 1.8427]
+  - [2.24, 2.0123, 1.8432]
+  - [2.2424, 2.0136, 1.8434]
+  - [2.2443, 2.0146, 1.8434]
+  - [2.2458, 2.0154, 1.8435]
+  - [2.247, 2.0159, 1.8437]
+  - [2.248, 2.0164, 1.8438]
+  - [2.2488, 2.0168, 1.8438]
+  - [2.2493, 2.0171, 1.8436]
+  - [2.2495, 2.0173, 1.8432]
+  - [2.2496, 2.0174, 1.8429]
+  - [2.2499, 2.0174, 1.8428]
+  - [2.2505, 2.0175, 1.843]
+  - [2.2512, 2.0177, 1.8434]
+  - [2.2518, 2.0181, 1.8438]
+  - [2.2521, 2.0185, 1.8441]
+  - [2.2518, 2.0189, 1.8442]
+  - [2.2513, 2.019, 1.8442]
+  - [2.251, 2.0187, 1.8443]
+  - [2.2512, 2.0183, 1.8444]
+  - [2.2516, 2.0179, 1.8445]
+  - [2.252, 2.0177, 1.8444]
+  - [2.2521, 2.0177, 1.8442]
+  - [2.2517, 2.0178, 1.8438]
+  - [2.2514, 2.018, 1.8435]
+  - [2.2513, 2.0182, 1.8433]
+  - [2.2516, 2.0183, 1.8433]
+  - [2.252, 2.0182, 1.8435]
+  - [2.2522, 2.018, 1.8438]
+  - [2.2518, 2.0177, 1.8439]
+  - [2.2511, 2.0174, 1.8439]
+  - [2.2506, 2.0173, 1.8437]
+  - [2.2507, 2.0175, 1.8435]
+  - [2.2512, 2.0179, 1.8435]
+  - [2.2519, 2.0182, 1.8437]
+  - [2.252, 2.0183, 1.8439]
+  - [2.2515, 2.0182, 1.8441]
+  - [2.2506, 2.0179, 1.8441]
+  - [2.2499, 2.0177, 1.8439]
+  - [2.2499, 2.0178, 1.8436]
+  - [2.2507, 2.0181, 1.8434]
+  - [2.2517, 2.0183, 1.8435]
+  - [2.2524, 2.0183, 1.8437]
+  - [2.2523, 2.0181, 1.844]
+  - [2.2516, 2.0178, 1.8441]
+  - [2.251, 2.0176, 1.8441]
+  - [2.2508, 2.0178, 1.8438]
+  - [2.2512, 2.0183, 1.8436]
+  - [2.2519, 2.0188, 1.8435]
+  - [2.2524, 2.0189, 1.8436]
+  - [2.2523, 2.0185, 1.8438]
+  - [2.2518, 2.0177, 1.844]
+  - [2.2512, 2.017, 1.8442]
+  - [2.2508, 2.0166, 1.8443]
+  - [2.2506, 2.0168, 1.8444]
+  - [2.2506, 2.0172, 1.8444]
+  - [2.2509, 2.0177, 1.8443]
+  - [2.2513, 2.0181, 1.8441]
+  - [2.2516, 2.0183, 1.8439]
+  - [2.2518, 2.0184, 1.8438]
+  - [2.2519, 2.0185, 1.8438]
+  - [2.2519, 2.0185, 1.844]
+  - [2.2518, 2.0186, 1.8441]
+  - [2.2517, 2.0188, 1.8439]
+  - [2.2516, 2.0188, 1.8436]
+  - [2.2515, 2.0186, 1.8432]
+  - [2.2513, 2.0183, 1.843]
+  - [2.2513, 2.0179, 1.843]
+  - [2.2514, 2.0176, 1.8432]
+  - [2.2516, 2.0174, 1.8435]
+  - [2.2517, 2.0175, 1.8438]
+  - [2.2518, 2.0176, 1.844]
+  - [2.2517, 2.0178, 1.8441]
+  - [2.2515, 2.0178, 1.8441]
+  - [2.2513, 2.0178, 1.8442]
+  - [2.2512, 2.0177, 1.8441]
+  - [2.2511, 2.0177, 1.844]
+  - [2.2512, 2.0179, 1.8438]
+  - [2.2514, 2.0181, 1.8437]
+  - [2.2515, 2.0182, 1.8437]
+  - [2.2516, 2.0183, 1.8438]
+  - [2.2516, 2.0183, 1.844]
+  - [2.2515, 2.0182, 1.8441]
+  - [2.2514, 2.0182, 1.844]
+  - [2.2513, 2.0181, 1.8437]
+  - [2.2513, 2.0181, 1.8435]
+  - [2.2514, 2.0181, 1.8434]
+  - [2.2516, 2.018, 1.8436]
+  - [2.2518, 2.0178, 1.8438]
+  - [2.2519, 2.0176, 1.844]
+  - [2.2519, 2.0175, 1.844]
+  - [2.2517, 2.0176, 1.8437]
+  - [2.2514, 2.0179, 1.8435]
+  - [2.2511, 2.0181, 1.8435]
+  - [2.2509, 2.0183, 1.8438]
+  - [2.2509, 2.0183, 1.8443]
+  - [2.2511, 2.018, 1.8447]
+  - [2.2515, 2.0177, 1.8448]
+  - [2.2517, 2.0175, 1.8445]
+  - [2.2517, 2.0175, 1.8442]
+  - [2.2516, 2.0176, 1.844]
+  - [2.2514, 2.0178, 1.8439]
+  - [2.2513, 2.018, 1.8439]
+  - [2.2512, 2.0182, 1.8438]
+  - [2.2511, 2.0183, 1.8436]
+  - [2.2511, 2.0184, 1.8435]
+  - [2.251, 2.0184, 1.8434]